joyce8/EMBER2024-capa huggingface dataset:
Function at 0x54bd20
Capabilities:
Hash data using fnv

Disassembly:
test byte [rax], al
mov rcx, rbx
and ebx, 0x7f
shl rbx, 5
lea rdx, [rax + rbx]
xor eax, eax
jmp 0x54bd37
inc rax
cmp rax, 4
jge 0x54bd4f
lea rbx, [rdx + rax*8]
mov rbx, qword [rbx]
cmp rbx, rcx
jne 0x54bd34
mov eax, 1
ret
xor eax, eax
movabs rbx, 0xcbf29ce484222325
jmp 0x54bd60
inc rax
cmp rax, 4
jge 0x54bd6e
mov rsi, qword [rdx + rax*8]
xor edi, edi
jmp 0x54bd97
and ebx, 3
lea rdx, [rdx + rbx*8]
xchg qword [rdx], rcx
xor eax, eax
ret
movzx r8d, sil
xor rbx, r8
inc rdi
shr rsi, 8
movabs r8, 0x100000001b3
imul rbx, r8
cmp rdi, 8
jl 0x54bd7b
jmp 0x54bd5d
Function at 0x551a40
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x551afd
push rbp
mov rbp, rsp
sub rsp, 0x30
movabs rdx, 0xc0484373e3dc68dd
mov qword [rsp + 0x1a], rdx
mov word [rsp + 0x22], 0xcd86
movabs rdx, 0x9070701030103
mov qword [rsp + 0x24], rdx
mov dword [rsp + 0x2c], 0x2030802
xor eax, eax
jmp 0x551aa0
movzx r9d, byte [rsp + rsi + 0x1a]
sub r9d, edx
lea edx, [r9 - 0x7b]
mov byte [rsp + rdi + 0x1a], dl
lea edx, [r8 - 0x7b]
mov byte [rsp + rsi + 0x1a], dl
add rax, 2
cmp rax, 0xc
jge 0x551acd
movzx edx, byte [rsp + rax + 0x24]
movzx esi, byte [rsp + rax + 0x25]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0xa
jae 0x551af0
movzx r8d, byte [rsp + rdi + 0x1a]
sub r8d, edx
cmp rsi, 0xa
jb 0x551a83
jmp 0x551ae4
xor eax, eax
lea rbx, [rsp + 0x1a]
mov ecx, 0xa
call fcn.0044bb20
add rsp, 0x30
pop rbp
ret
mov eax, esi
mov ecx, 0xa
call fcn.00461020
mov eax, edi
mov ecx, 0xa
call fcn.00461020
nop
nop dword [rax]
call fcn.0045eda0
jmp fcn.00551a40

Function at 0x552580
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x55266c
push rbp
mov rbp, rsp
sub rsp, 0x40
movabs rdx, 0x186553b3646ffd35
mov qword [rsp + 0x18], rdx
movabs rdx, 0x6502186553b3646f
mov qword [rsp + 0x1a], rdx
movabs rdx, 0x6528c1bc6906131c
mov qword [rsp + 0x22], rdx
movabs rdx, 0xa0e0a0b040c0701
mov qword [rsp + 0x2a], rdx
movabs rdx, 0xf00080c0c0f0a0e
mov qword [rsp + 0x30], rdx
movabs rdx, 0xc0c0a0c04081007
mov qword [rsp + 0x38], rdx
xor eax, eax
jmp 0x55260a
movzx r9d, byte [rsp + rsi + 0x18]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x25]
mov byte [rsp + rdi + 0x18], dl
mov byte [rsp + rsi + 0x18], r8b
add rax, 2
cmp rax, 0x16
jge 0x55263c
movzx edx, byte [rsp + rax + 0x2a]
movzx esi, byte [rsp + rax + 0x2b]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x12
jae 0x55265f
movzx r8d, byte [rsp + rdi + 0x18]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x25]
cmp rsi, 0x12
jb 0x5525f0
jmp 0x552653
xor eax, eax
lea rbx, [rsp + 0x18]
mov ecx, 0x12
call fcn.0044bb20
add rsp, 0x40
pop rbp
ret
mov eax, esi
mov ecx, 0x12
call fcn.00461020
mov eax, edi
mov ecx, 0x12
call fcn.00461020
nop
call fcn.0045eda0
jmp fcn.00552580
Function at 0x553ec0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x553faa
push rbp
mov rbp, rsp
sub rsp, 0x48
movabs rdx, 0x799b61ce20706fb7
mov qword [rsp + 0x19], rdx
movabs rdx, 0x1a2218d61b164c79
mov qword [rsp + 0x20], rdx
movabs rdx, 0x29e831261e817313
mov qword [rsp + 0x28], rdx
movabs rdx, 0x40f041102110806
mov qword [rsp + 0x30], rdx
movabs rdx, 0xc09060b02120a00
mov qword [rsp + 0x38], rdx
movabs rdx, 0x15080d060e0a0b13
mov qword [rsp + 0x40], rdx
xor eax, eax
jmp 0x553f4d
movzx r9d, byte [rsp + rsi + 0x19]
sub r9d, edx
lea edx, [r9 + 0x6b]
mov byte [rsp + rdi + 0x19], dl
lea edx, [r8 + 0x6b]
mov byte [rsp + rsi + 0x19], dl
add rax, 2
cmp rax, 0x18
jge 0x553f7a
movzx edx, byte [rsp + rax + 0x30]
movzx esi, byte [rsp + rax + 0x31]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x17
jae 0x553f9d
movzx r8d, byte [rsp + rdi + 0x19]
sub r8d, edx
cmp rsi, 0x17
jb 0x553f30
jmp 0x553f91
xor eax, eax
lea rbx, [rsp + 0x19]
mov ecx, 0x17
call fcn.0044bb20
add rsp, 0x48
pop rbp
ret
mov eax, esi
mov ecx, 0x17
call fcn.00461020
mov eax, edi
mov ecx, 0x17
call fcn.00461020
nop
call fcn.0045eda0
jmp fcn.00553ec0

Function at 0x555140
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x555278
push rbp
mov rbp, rsp
sub rsp, 0x68
movabs rdx, 0xa76e70a720c6319d
mov qword [rsp + 0x19], rdx
movabs rdx, 0x7551f4a76e70a720
mov qword [rsp + 0x1c], rdx
movabs rdx, 0x6163eca5259a7ba7
mov qword [rsp + 0x24], rdx
movabs rdx, 0x20a46372b1206f74
mov qword [rsp + 0x2c], rdx
movabs rdx, 0x973738353536f8b5
mov qword [rsp + 0x34], rdx
movabs rdx, 0x40f1b0d070c0812
mov qword [rsp + 0x3c], rdx
movabs rdx, 0x7220e11111b051c
mov qword [rsp + 0x44], rdx
movabs rdx, 0x1919000507220e11
mov qword [rsp + 0x48], rdx
movabs rdx, 0xa1c22070a102207
mov qword [rsp + 0x50], rdx
movabs rdx, 0xb20161021160a11
mov qword [rsp + 0x58], rdx
movabs rdx, 0x20e0b161217010b
mov qword [rsp + 0x60], rdx
xor eax, eax
jmp 0x555218
movzx r9d, byte [rsp + rsi + 0x19]
sub r9d, edx
lea edx, [r9 - 0x27]
mov byte [rsp + rdi + 0x19], dl
lea edx, [r8 - 0x27]
mov byte [rsp + rsi + 0x19], dl
add rax, 2
cmp rax, 0x2c
jge 0x555248
movzx edx, byte [rsp + rax + 0x3c]
movzx esi, byte [rsp + rax + 0x3d]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x23
jae 0x55526b
movzx r8d, byte [rsp + rdi + 0x19]
sub r8d, edx
nop dword [rax]
cmp rsi, 0x23
jb 0x5551fb
jmp 0x55525f
xor eax, eax
lea rbx, [rsp + 0x19]
mov ecx, 0x23
call fcn.0044bb20
add rsp, 0x68
pop rbp
ret
mov eax, esi
mov ecx, 0x23
call fcn.00461020
mov eax, edi
mov ecx, 0x23
call fcn.00461020
nop
call fcn.0045eda0
nop dword [rax]
jmp fcn.00555140
Function at 0x556360
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x5564a7
push rbp
mov rbp, rsp
sub rsp, 0x78
movabs rdx, 0x652a492c72f3caca
mov qword [rsp + 0x1d], rdx
movabs rdx, 0x8f6e697274cc7272
mov qword [rsp + 0x25], rdx
movabs rdx, 0x2841051ed88f6e69
mov qword [rsp + 0x2a], rdx
movabs rdx, 0x5650615920736465
mov qword [rsp + 0x32], rdx
movabs rdx, 0xdb6e65f0fcbd37ea
mov qword [rsp + 0x3a], rdx
movabs rdx, 0x29e7353267200632
mov qword [rsp + 0x42], rdx
movabs rdx, 0x100a122b0009
mov qword [rsp + 0x4a], rdx
movabs rdx, 0xa1f250f10212426
mov qword [rsp + 0x52], rdx
movabs rdx, 0x2519200a1d110a1f
mov qword [rsp + 0x58], rdx
movabs rdx, 0x20020919211c0a11
mov qword [rsp + 0x60], rdx
movabs rdx, 0x51e140412282600
mov qword [rsp + 0x68], rdx
movabs rdx, 0x131b1b061c260601
mov qword [rsp + 0x70], rdx
xor eax, eax
jmp 0x556447
movzx r9d, byte [rsp + rsi + 0x1d]
sub r9d, edx
lea edx, [r9 + 0x6b]
mov byte [rsp + rdi + 0x1d], dl
lea edx, [r8 + 0x6b]
mov byte [rsp + rsi + 0x1d], dl
add rax, 2
cmp rax, 0x2e
jge 0x556477
movzx edx, byte [rsp + rax + 0x4a]
movzx esi, byte [rsp + rax + 0x4b]
mov edi, edx
xor edx, esi
add edx, eax
nop dword [rax]
cmp rdi, 0x2d
jae 0x55649a
movzx r8d, byte [rsp + rdi + 0x1d]
sub r8d, edx
cmp rsi, 0x2d
jb 0x55642a
jmp 0x55648e
xor eax, eax
lea rbx, [rsp + 0x1d]
mov ecx, 0x2d
call fcn.0044bb20
add rsp, 0x78
pop rbp
ret
mov eax, esi
mov ecx, 0x2d
call fcn.00461020
mov eax, edi
mov ecx, 0x2d
call fcn.00461020
nop
call fcn.0045eda0
jmp fcn.00556360

Function at 0x556860
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x55691d
push rbp
mov rbp, rsp
sub rsp, 0x30
movabs rdx, 0x38691833413f1041
mov qword [rsp + 0x1d], rdx
mov byte [rsp + 0x25], 0x46
movabs rdx, 0x103080205020404
mov qword [rsp + 0x26], rdx
mov word [rsp + 0x2e], 0x307
xor eax, eax
nop
jmp 0x5568c0
movzx r9d, byte [rsp + rsi + 0x1d]
sub r9d, edx
lea edx, [r9 + 0x3c]
mov byte [rsp + rdi + 0x1d], dl
lea edx, [r8 + 0x3c]
mov byte [rsp + rsi + 0x1d], dl
add rax, 2
nop
cmp rax, 0xa
jge 0x5568ed
movzx edx, byte [rsp + rax + 0x26]
movzx esi, byte [rsp + rax + 0x27]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 9
jae 0x556910
movzx r8d, byte [rsp + rdi + 0x1d]
sub r8d, edx
cmp rsi, 9
jb 0x5568a2
jmp 0x556904
xor eax, eax
lea rbx, [rsp + 0x1d]
mov ecx, 9
call fcn.0044bb20
add rsp, 0x30
pop rbp
ret
mov eax, esi
mov ecx, 9
call fcn.00461020
mov eax, edi
mov ecx, 9
call fcn.00461020
nop
nop dword [rax]
call fcn.0045eda0
jmp fcn.00556860
Function at 0x559fa0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x55a058
push rbp
mov rbp, rsp
sub rsp, 0x30
movabs rdx, 0xe0359e76dfd68603
mov qword [rsp + 0x1e], rdx
movabs rdx, 0x302050700040701
mov qword [rsp + 0x26], rdx
mov word [rsp + 0x2e], 0x700
xor eax, eax
jmp 0x559ff5
movzx r9d, byte [rsp + rsi + 0x1e]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x54]
mov byte [rsp + rdi + 0x1e], dl
mov byte [rsp + rsi + 0x1e], r8b
add rax, 2
cmp rax, 0xa
jge 0x55a028
movzx edx, byte [rsp + rax + 0x26]
movzx esi, byte [rsp + rax + 0x27]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 8
jae 0x55a04b
movzx r8d, byte [rsp + rdi + 0x1e]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x54]
nop
cmp rsi, 8
jb 0x559fdb
jmp 0x55a03f
xor eax, eax
lea rbx, [rsp + 0x1e]
mov ecx, 8
call fcn.0044bb20
add rsp, 0x30
pop rbp
ret
mov eax, esi
mov ecx, 8
call fcn.00461020
mov eax, edi
mov ecx, 8
call fcn.00461020
nop
call fcn.0045eda0
nop dword [rax]
jmp fcn.00559fa0

Function at 0x55b6a0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x55b75d
push rbp
mov rbp, rsp
sub rsp, 0x30
movabs rdx, 0x6d9c3b7f6f767936
mov qword [rsp + 0x1b], rdx
mov byte [rsp + 0x23], 0x72
movabs rdx, 0x408060803050301
mov qword [rsp + 0x24], rdx
mov dword [rsp + 0x2c], 0x50004
xor eax, eax
nop
jmp 0x55b700
movzx r9d, byte [rsp + rsi + 0x1b]
sub r9d, edx
lea edx, [r9 + 3]
mov byte [rsp + rdi + 0x1b], dl
lea edx, [r8 + 3]
mov byte [rsp + rsi + 0x1b], dl
add rax, 2
nop
cmp rax, 0xc
jge 0x55b72d
movzx edx, byte [rsp + rax + 0x24]
movzx esi, byte [rsp + rax + 0x25]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 9
jae 0x55b750
movzx r8d, byte [rsp + rdi + 0x1b]
sub r8d, edx
cmp rsi, 9
jb 0x55b6e2
jmp 0x55b744
xor eax, eax
lea rbx, [rsp + 0x1b]
mov ecx, 9
call fcn.0044bb20
add rsp, 0x30
pop rbp
ret
mov eax, esi
mov ecx, 9
call fcn.00461020
mov eax, edi
mov ecx, 9
call fcn.00461020
nop
nop dword [rax]
call fcn.0045eda0
jmp fcn.0055b6a0
Function at 0x55b780
Capabilities:
Encrypt data using rc4 prga

Disassembly:
lea r12, [rsp - 0x30]
cmp r12, qword [r14 + 0x10]
jbe 0x55b8d5
push rbp
mov rbp, rsp
sub rsp, 0xa8
movabs rdx, 0x7073657220074e20
mov qword [rsp + 0x1c], rdx
movabs rdx, 0x2c2454441146cb6f
mov qword [rsp + 0x24], rdx
movabs rdx, 0x61742c2454441146
mov qword [rsp + 0x26], rdx
movabs rdx, 0x7bd572632d7b7623
mov qword [rsp + 0x2e], rdx
movabs rdx, 0x695977fe14276c70
mov qword [rsp + 0x36], rdx
movabs rdx, 0x4674fb57d75246c3
mov qword [rsp + 0x3e], rdx
movabs rdx, 0x1c3a6a7076471b4d
mov qword [rsp + 0x46], rdx
movabs rdx, 0x3b654a613a473532
mov qword [rsp + 0x4e], rdx
movabs rdx, 0xe1c1e2c2a342535
mov qword [rsp + 0x56], rdx
lea rdi, [rsp + 0x58]
lea rsi, [0x006c0984]
nop word [rax + rax]
nop word [rax + rax]
nop
mov qword [rsp - 0x10], rbp
lea rbp, [rsp - 0x10]
call fcn.0046165a
mov rbp, qword [rbp]
xor eax, eax
jmp 0x55b874
movzx r9d, byte [rsp + rsi + 0x1c]
sub r9d, edx
lea edx, [r9 + 0x58]
mov byte [rsp + rdi + 0x1c], dl
lea edx, [r8 + 0x58]
mov byte [rsp + rsi + 0x1c], dl
add rax, 2
cmp rax, 0x52
jge 0x55b8a2
movzx edx, byte [rsp + rax + 0x56]
movzx esi, byte [rsp + rax + 0x57]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x3a
jae 0x55b8c8
movzx r8d, byte [rsp + rdi + 0x1c]
sub r8d, edx
cmp rsi, 0x3a
jb 0x55b857
nop
jmp 0x55b8bc
xor eax, eax
lea rbx, [rsp + 0x1c]
mov ecx, 0x3a
call fcn.0044bb20
add rsp, 0xa8
pop rbp
ret
mov eax, esi
mov ecx, 0x3a
call fcn.00461020
mov eax, edi
mov ecx, 0x3a
call fcn.00461020
nop
call fcn.0045eda0
jmp fcn.0055b780

Function at 0x55f240
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x55f306
push rbp
mov rbp, rsp
sub rsp, 0x30
movabs rdx, 0x70c1b10206bec415
mov qword [rsp + 0x1d], rdx
mov byte [rsp + 0x25], 0x74
movabs rdx, 0x300060402010400
mov qword [rsp + 0x26], rdx
mov word [rsp + 0x2e], 5
xor eax, eax
nop
jmp 0x55f2a0
movzx r9d, byte [rsp + rsi + 0x1d]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x55]
mov byte [rsp + rdi + 0x1d], dl
mov byte [rsp + rsi + 0x1d], r8b
add rax, 2
nop dword [rax]
cmp rax, 0xa
jge 0x55f2d2
movzx edx, byte [rsp + rax + 0x26]
movzx esi, byte [rsp + rax + 0x27]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 9
jae 0x55f2f7
movzx r8d, byte [rsp + rdi + 0x1d]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x55]
cmp rsi, 9
jb 0x55f282
jmp 0x55f2eb
xor eax, eax
lea rbx, [rsp + 0x1d]
mov ecx, 9
nop
call fcn.0044bb20
add rsp, 0x30
pop rbp
ret
mov eax, esi
mov ecx, 9
call fcn.00461020
mov eax, edi
mov ecx, 9
nop
call fcn.00461020
nop
call fcn.0045eda0
jmp fcn.0055f240
Function at 0x55f8c0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x55f97d
push rbp
mov rbp, rsp
sub rsp, 0x30
movabs rdx, 0x6f727265c78dd062
mov qword [rsp + 0x1d], rdx
mov byte [rsp + 0x25], 0x5c
movabs rdx, 0x102010803020801
mov qword [rsp + 0x26], rdx
mov word [rsp + 0x2e], 0x101
xor eax, eax
nop
jmp 0x55f920
movzx r9d, byte [rsp + rsi + 0x1d]
sub r9d, edx
lea edx, [r9 - 0x6a]
mov byte [rsp + rdi + 0x1d], dl
lea edx, [r8 - 0x6a]
mov byte [rsp + rsi + 0x1d], dl
add rax, 2
nop
cmp rax, 0xa
jge 0x55f94d
movzx edx, byte [rsp + rax + 0x26]
movzx esi, byte [rsp + rax + 0x27]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 9
jae 0x55f970
movzx r8d, byte [rsp + rdi + 0x1d]
sub r8d, edx
cmp rsi, 9
jb 0x55f902
jmp 0x55f964
xor eax, eax
lea rbx, [rsp + 0x1d]
mov ecx, 9
call fcn.0044bb20
add rsp, 0x30
pop rbp
ret
mov eax, esi
mov ecx, 9
call fcn.00461020
mov eax, edi
mov ecx, 9
call fcn.00461020
nop
nop dword [rax]
call fcn.0045eda0
jmp fcn.0055f8c0

Function at 0x55fd60
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x55fe4a
push rbp
mov rbp, rsp
sub rsp, 0x40
movabs rdx, 0x4c956edce65eed73
mov qword [rsp + 0x2e], rdx
movabs rdx, 0xd6744c956edce65e
mov qword [rsp + 0x30], rdx
movabs rdx, 0x586c75df54586e6f
mov qword [rsp + 0x38], rdx
movabs rdx, 0x40d0c0611010907
mov qword [rsp + 0x1c], rdx
movabs rdx, 0x90e040d0c061101
mov qword [rsp + 0x1e], rdx
movabs rdx, 0x106010404030204
mov qword [rsp + 0x26], rdx
xor eax, eax
jmp 0x55fded
movzx r9d, byte [rsp + rsi + 0x2e]
sub r9d, edx
lea edx, [r9 - 0x67]
mov byte [rsp + rdi + 0x2e], dl
lea edx, [r8 - 0x67]
mov byte [rsp + rsi + 0x2e], dl
add rax, 2
cmp rax, 0x12
jge 0x55fe1a
movzx edx, byte [rsp + rax + 0x1c]
movzx esi, byte [rsp + rax + 0x1d]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x12
jae 0x55fe3d
movzx r8d, byte [rsp + rdi + 0x2e]
sub r8d, edx
cmp rsi, 0x12
jb 0x55fdd0
jmp 0x55fe31
xor eax, eax
lea rbx, [rsp + 0x2e]
mov ecx, 0x12
call fcn.0044bb20
add rsp, 0x40
pop rbp
ret
mov eax, esi
mov ecx, 0x12
call fcn.00461020
mov eax, edi
mov ecx, 0x12
call fcn.00461020
nop
call fcn.0045eda0
jmp fcn.0055fd60
Function at 0x562720
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x28
mov qword [rsp + 0x38], 0
movabs rax, 0x44411f2095c1ee2b
mov qword [rsp + 0x18], rax
movabs rax, 0x65d6eb74a3db3a2f
mov qword [rsp + 0x20], rax
mov qword [rsp + 0xf], 0
mov qword [rsp + 0x10], 0
movzx eax, byte [rsp + 0x27]
movzx ecx, byte [rsp + 0x22]
xor eax, ecx
movzx ecx, byte [rsp + 0x20]
movzx edx, byte [rsp + 0x1d]
add ecx, edx
movzx edx, byte [rsp + 0x1c]
movzx ebx, byte [rsp + 0x1f]
add edx, ebx
movzx ebx, byte [rsp + 0x23]
movzx esi, byte [rsp + 0x26]
sub ebx, esi
movzx esi, byte [rsp + 0x21]
movzx edi, byte [rsp + 0x19]
sub esi, edi
movzx edi, byte [rsp + 0x18]
movzx r8d, byte [rsp + 0x24]
sub edi, r8d
movzx r8d, byte [rsp + 0x1b]
movzx r9d, byte [rsp + 0x1e]
add r8d, r9d
movzx r9d, byte [rsp + 0x25]
movzx r10d, byte [rsp + 0x1a]
mov byte [rsp + 0xf], al
mov byte [rsp + 0x10], cl
mov byte [rsp + 0x11], dl
mov byte [rsp + 0x12], bl
mov byte [rsp + 0x13], sil
mov byte [rsp + 0x14], dil
mov byte [rsp + 0x15], r8b
lea eax, [r10 + r9]
mov byte [rsp + 0x16], al
mov qword [rsp + 7], 0
xor eax, eax
jmp 0x562806
movzx ecx, byte [rsp + rax + 0xf]
mov byte [rsp + rax + 7], cl
inc rax
cmp rax, 8
jl 0x5627fa
mov rax, qword [rsp + 7]
mov qword [rsp + 0x38], rax
add rsp, 0x28
pop rbp
ret

Function at 0x562820
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x28
mov qword [rsp + 0x38], 0
movabs rax, 0x42c42d1ac98e43bd
mov qword [rsp + 0x18], rax
movabs rax, 0x650981afae758343
mov qword [rsp + 0x20], rax
mov qword [rsp + 0xf], 0
mov qword [rsp + 0x10], 0
movzx eax, byte [rsp + 0x26]
movzx ecx, byte [rsp + 0x25]
sub eax, ecx
movzx ecx, byte [rsp + 0x23]
movzx edx, byte [rsp + 0x24]
sub ecx, edx
movzx edx, byte [rsp + 0x1d]
movzx ebx, byte [rsp + 0x21]
add edx, ebx
movzx ebx, byte [rsp + 0x20]
movzx esi, byte [rsp + 0x1a]
add ebx, esi
movzx esi, byte [rsp + 0x18]
movzx edi, byte [rsp + 0x1b]
add esi, edi
movzx edi, byte [rsp + 0x19]
movzx r8d, byte [rsp + 0x22]
add edi, r8d
movzx r8d, byte [rsp + 0x1e]
movzx r9d, byte [rsp + 0x1c]
xor r8d, r9d
movzx r9d, byte [rsp + 0x1f]
movzx r10d, byte [rsp + 0x27]
mov byte [rsp + 0xf], al
mov byte [rsp + 0x10], cl
mov byte [rsp + 0x11], dl
mov byte [rsp + 0x12], bl
mov byte [rsp + 0x13], sil
mov byte [rsp + 0x14], dil
mov byte [rsp + 0x15], r8b
sub r9d, r10d
mov byte [rsp + 0x16], r9b
mov qword [rsp + 7], 0
xor eax, eax
jmp 0x562906
movzx ecx, byte [rsp + rax + 0xf]
mov byte [rsp + rax + 7], cl
inc rax
cmp rax, 8
jl 0x5628fa
mov rax, qword [rsp + 7]
mov qword [rsp + 0x38], rax
add rsp, 0x28
pop rbp
ret
Function at 0x562920
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov qword [rsp + 0x40], 0
movabs rdx, 0x6ade99a73a525586
mov qword [rsp + 0x1e], rdx
movabs rdx, 0x605060405010303
mov qword [rsp + 0x26], rdx
mov word [rsp + 0x2e], 0x702
xor eax, eax
jmp 0x562976
movzx r8d, byte [rsp + rbx + 0x1e]
sub r8d, edx
lea edx, [r8 - 0x47]
mov byte [rsp + rsi + 0x1e], dl
lea edx, [rdi - 0x47]
mov byte [rsp + rbx + 0x1e], dl
add rax, 2
cmp rax, 0xa
jge 0x5629a2
movzx edx, byte [rsp + rax + 0x26]
movzx ebx, byte [rsp + rax + 0x27]
mov esi, edx
xor edx, ebx
add edx, eax
cmp rsi, 8
jae 0x5629e5
movzx edi, byte [rsp + rsi + 0x1e]
sub edi, edx
cmp rbx, 8
jb 0x56295a
nop
jmp 0x5629d6
mov qword [rsp + 0x16], 0
xor eax, eax
jmp 0x5629c0
movzx ecx, byte [rsp + rax + 0x1e]
mov byte [rsp + rax + 0x16], cl
inc rax
nop dword [rax + rax]
cmp rax, 8
jl 0x5629af
mov rax, qword [rsp + 0x16]
mov qword [rsp + 0x40], rax
add rsp, 0x30
pop rbp
ret
mov eax, ebx
mov ecx, 8
nop dword [rax]
call fcn.00461020
mov eax, esi
mov ecx, 8
call fcn.00461020
nop
int3

Function at 0x5635a0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov qword [rsp + 0x40], 0
movabs rdx, 0x34a9dc03e61014b9
mov qword [rsp + 0x1e], rdx
movabs rdx, 0x6030407060106
mov qword [rsp + 0x26], rdx
mov word [rsp + 0x2e], 0x601
xor eax, eax
jmp 0x5635f6
movzx r8d, byte [rsp + rbx + 0x1e]
sub r8d, edx
lea edx, [r8 + 0x35]
mov byte [rsp + rsi + 0x1e], dl
lea edx, [rdi + 0x35]
mov byte [rsp + rbx + 0x1e], dl
add rax, 2
cmp rax, 0xa
jge 0x563622
movzx edx, byte [rsp + rax + 0x26]
movzx ebx, byte [rsp + rax + 0x27]
mov esi, edx
xor edx, ebx
add edx, eax
cmp rsi, 8
jae 0x563665
movzx edi, byte [rsp + rsi + 0x1e]
sub edi, edx
cmp rbx, 8
jb 0x5635da
nop
jmp 0x563656
mov qword [rsp + 0x16], 0
xor eax, eax
jmp 0x563640
movzx ecx, byte [rsp + rax + 0x1e]
mov byte [rsp + rax + 0x16], cl
inc rax
nop dword [rax + rax]
cmp rax, 8
jl 0x56362f
mov rax, qword [rsp + 0x16]
mov qword [rsp + 0x40], rax
add rsp, 0x30
pop rbp
ret
mov eax, ebx
mov ecx, 8
nop dword [rax]
call fcn.00461020
mov eax, esi
mov ecx, 8
call fcn.00461020
nop
int3
Function at 0x563ae0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x28
mov qword [rsp + 0x38], 0
movabs rdx, 0x73a1c26ff83d00f6
mov qword [rsp + 0x20], rdx
movabs rdx, 0x306020000000203
mov qword [rsp + 0x10], rdx
xor eax, eax
jmp 0x563b2f
movzx r8d, byte [rsp + rbx + 0x20]
sub r8d, edx
lea edx, [r8 - 0x34]
mov byte [rsp + rsi + 0x20], dl
lea edx, [rdi - 0x34]
mov byte [rsp + rbx + 0x20], dl
add rax, 2
cmp rax, 8
jge 0x563b5a
movzx edx, byte [rsp + rax + 0x10]
movzx ebx, byte [rsp + rax + 0x11]
mov esi, edx
xor edx, ebx
add edx, eax
cmp rsi, 8
jae 0x563b95
movzx edi, byte [rsp + rsi + 0x20]
sub edi, edx
cmp rbx, 8
jb 0x563b13
jmp 0x563b89
mov qword [rsp + 0x18], 0
xor eax, eax
jmp 0x563b73
movzx ecx, byte [rsp + rax + 0x20]
mov byte [rsp + rax + 0x18], cl
inc rax
cmp rax, 8
jl 0x563b67
mov rax, qword [rsp + 0x18]
mov qword [rsp + 0x38], rax
add rsp, 0x28
pop rbp
ret
mov eax, ebx
mov ecx, 8
call fcn.00461020
mov eax, esi
mov ecx, 8
nop dword [rax]
call fcn.00461020
nop
int3

Function at 0x564f00
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov qword [rsp + 0x40], 0
movabs rdx, 0xb61bcb437316183d
mov qword [rsp + 0x1c], rdx
movabs rdx, 0x607060607070505
mov qword [rsp + 0x24], rdx
mov dword [rsp + 0x2c], 0x5050000
xor eax, eax
jmp 0x564f55
movzx r8d, byte [rsp + rbx + 0x1c]
lea edx, [r8 + rdx]
lea edx, [rdx + 0x78]
mov byte [rsp + rsi + 0x1c], dl
mov byte [rsp + rbx + 0x1c], dil
add rax, 2
cmp rax, 0xc
jge 0x564f88
movzx edx, byte [rsp + rax + 0x24]
movzx ebx, byte [rsp + rax + 0x25]
mov esi, edx
xor edx, ebx
add edx, eax
cmp rsi, 8
jae 0x564fc5
movzx edi, byte [rsp + rsi + 0x1c]
lea edi, [rdi + rdx]
lea edi, [rdi + 0x78]
nop dword [rax]
cmp rbx, 8
jb 0x564f3b
jmp 0x564fb7
mov qword [rsp + 0x14], 0
xor eax, eax
jmp 0x564fa1
movzx ecx, byte [rsp + rax + 0x1c]
mov byte [rsp + rax + 0x14], cl
inc rax
cmp rax, 8
jl 0x564f95
mov rax, qword [rsp + 0x14]
mov qword [rsp + 0x40], rax
add rsp, 0x30
pop rbp
ret
mov eax, ebx
mov ecx, 8
nop
call fcn.00461020
mov eax, esi
mov ecx, 8
call fcn.00461020
nop
int3
Function at 0x565140
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov qword [rsp + 0x40], 0
movabs rdx, 0x8b9cda30e56281a7
mov qword [rsp + 0x1e], rdx
movabs rdx, 0x705060306020503
mov qword [rsp + 0x26], rdx
mov word [rsp + 0x2e], 0x503
xor eax, eax
jmp 0x565194
movzx r8d, byte [rsp + rbx + 0x1e]
lea edx, [r8 + rdx]
lea edx, [rdx - 0x48]
mov byte [rsp + rsi + 0x1e], dl
mov byte [rsp + rbx + 0x1e], dil
add rax, 2
cmp rax, 0xa
jge 0x5651c8
movzx edx, byte [rsp + rax + 0x26]
movzx ebx, byte [rsp + rax + 0x27]
mov esi, edx
xor edx, ebx
add edx, eax
cmp rsi, 8
jae 0x565205
movzx edi, byte [rsp + rsi + 0x1e]
lea edi, [rdi + rdx]
lea edi, [rdi - 0x48]
nop dword [rax + rax]
cmp rbx, 8
jb 0x56517a
jmp 0x5651f7
mov qword [rsp + 0x16], 0
xor eax, eax
jmp 0x5651e1
movzx ecx, byte [rsp + rax + 0x1e]
mov byte [rsp + rax + 0x16], cl
inc rax
cmp rax, 8
jl 0x5651d5
mov rax, qword [rsp + 0x16]
mov qword [rsp + 0x40], rax
add rsp, 0x30
pop rbp
ret
mov eax, ebx
mov ecx, 8
nop
call fcn.00461020
mov eax, esi
mov ecx, 8
call fcn.00461020
nop
int3

Function at 0x565220
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x28
mov qword [rsp + 0x38], 0
movabs rdx, 0xca0e51e5b1781e61
mov qword [rsp + 0x20], rdx
movabs rdx, 0x407060702000102
mov qword [rsp + 0x10], rdx
xor eax, eax
jmp 0x56526d
movzx r8d, byte [rsp + rbx + 0x20]
lea edx, [r8 + rdx]
lea edx, [rdx - 0x37]
mov byte [rsp + rsi + 0x20], dl
mov byte [rsp + rbx + 0x20], dil
add rax, 2
cmp rax, 8
jge 0x56529c
movzx edx, byte [rsp + rax + 0x10]
movzx ebx, byte [rsp + rax + 0x11]
mov esi, edx
xor edx, ebx
add edx, eax
cmp rsi, 8
jae 0x5652d7
movzx edi, byte [rsp + rsi + 0x20]
lea edi, [rdi + rdx]
lea edi, [rdi - 0x37]
cmp rbx, 8
jb 0x565253
jmp 0x5652cb
mov qword [rsp + 0x18], 0
xor eax, eax
jmp 0x5652b5
movzx ecx, byte [rsp + rax + 0x20]
mov byte [rsp + rax + 0x18], cl
inc rax
cmp rax, 8
jl 0x5652a9
mov rax, qword [rsp + 0x18]
mov qword [rsp + 0x38], rax
add rsp, 0x28
pop rbp
ret
mov eax, ebx
mov ecx, 8
call fcn.00461020
mov eax, esi
mov ecx, 8
nop
call fcn.00461020
nop
int3