joyce8/EMBER2024-capa huggingface dataset:
Function at 0x53d320
Capabilities:
Decrypt data using aes via x86 extensions

Disassembly:
mov rcx, qword [rsp + 8]
mov rax, qword [rsp + 0x10]
mov rdx, qword [rsp + 0x18]
mov rbx, qword [rsp + 0x20]
movups xmm1, xmmword [rax]
movups xmm0, xmmword [rbx]
add rax, 0x10
pxor xmm0, xmm1
sub rcx, 0xc
je 0x53d35f
jb 0x53d374
movups xmm1, xmmword [rax]
aesdec xmm0, xmm1
movups xmm1, xmmword [rax + 0x10]
aesdec xmm0, xmm1
add rax, 0x20
movups xmm1, xmmword [rax]
aesdec xmm0, xmm1
movups xmm1, xmmword [rax + 0x10]
aesdec xmm0, xmm1
add rax, 0x20
movups xmm1, xmmword [rax]
aesdec xmm0, xmm1
movups xmm1, xmmword [rax + 0x10]
aesdec xmm0, xmm1
movups xmm1, xmmword [rax + 0x20]
aesdec xmm0, xmm1
movups xmm1, xmmword [rax + 0x30]
aesdec xmm0, xmm1
movups xmm1, xmmword [rax + 0x40]
aesdec xmm0, xmm1
movups xmm1, xmmword [rax + 0x50]
aesdec xmm0, xmm1
movups xmm1, xmmword [rax + 0x60]
aesdec xmm0, xmm1
movups xmm1, xmmword [rax + 0x70]
aesdec xmm0, xmm1
movups xmm1, xmmword [rax + 0x80]
aesdec xmm0, xmm1
movups xmm1, xmmword [rax + 0x90]
aesdeclast xmm0, xmm1
movups xmmword [rdx], xmm0
ret
Function at 0x53d3e0
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
mov rcx, qword [rsp + 8]
mov rax, qword [rsp + 0x10]
mov rbx, qword [rsp + 0x18]
mov rdx, qword [rsp + 0x20]
movups xmm0, xmmword [rax]
movups xmmword [rbx], xmm0
add rbx, 0x10
pxor xmm4, xmm4
cmp ecx, 0xc
je 0x53d4b0
jb 0x53d50f
movups xmm2, xmmword [rax + 0x10]
movups xmmword [rbx], xmm2
add rbx, 0x10
aeskeygenassist xmm1, xmm2, 1
call fcn.0053d2c0
aeskeygenassist xmm1, xmm0, 1
call fcn.0053d2e0
aeskeygenassist xmm1, xmm2, 2
call fcn.0053d2c0
aeskeygenassist xmm1, xmm0, 2
call fcn.0053d2e0
aeskeygenassist xmm1, xmm2, 4
call fcn.0053d2c0
aeskeygenassist xmm1, xmm0, 4
call fcn.0053d2e0
aeskeygenassist xmm1, xmm2, 8
call fcn.0053d2c0
aeskeygenassist xmm1, xmm0, 8
call fcn.0053d2e0
aeskeygenassist xmm1, xmm2, 0x10
call fcn.0053d2c0
aeskeygenassist xmm1, xmm0, 0x10
call fcn.0053d2e0
aeskeygenassist xmm1, xmm2, 0x20
call fcn.0053d2c0
aeskeygenassist xmm1, xmm0, 0x20
call fcn.0053d2e0
aeskeygenassist xmm1, xmm2, 0x40
call fcn.0053d2c0
jmp 0x53d57d
movq xmm2, qword [rax + 0x10]
aeskeygenassist xmm1, xmm2, 1
call fcn.0053d220
aeskeygenassist xmm1, xmm2, 2
call fcn.0053d280
aeskeygenassist xmm1, xmm2, 4
call fcn.0053d220
aeskeygenassist xmm1, xmm2, 8
call fcn.0053d280
aeskeygenassist xmm1, xmm2, 0x10
call fcn.0053d220
aeskeygenassist xmm1, xmm2, 0x20
call fcn.0053d280
aeskeygenassist xmm1, xmm2, 0x40
call fcn.0053d220
aeskeygenassist xmm1, xmm2, 0x80
call fcn.0053d280
jmp 0x53d57d
aeskeygenassist xmm1, xmm0, 1
call fcn.0053d1e0
aeskeygenassist xmm1, xmm0, 2
call fcn.0053d1e0
aeskeygenassist xmm1, xmm0, 4
call fcn.0053d1e0
aeskeygenassist xmm1, xmm0, 8
call fcn.0053d1e0
aeskeygenassist xmm1, xmm0, 0x10
call fcn.0053d1e0
aeskeygenassist xmm1, xmm0, 0x20
call fcn.0053d1e0
aeskeygenassist xmm1, xmm0, 0x40
call fcn.0053d1e0
aeskeygenassist xmm1, xmm0, 0x80
call fcn.0053d1e0
aeskeygenassist xmm1, xmm0, 0x1b
call fcn.0053d1e0
aeskeygenassist xmm1, xmm0, 0x36
call fcn.0053d1e0
sub rbx, 0x10
movups xmm1, xmmword [rbx]
movups xmmword [rdx], xmm1
dec rcx
movups xmm1, xmmword [rbx - 0x10]
aesimc xmm0, xmm1
movups xmmword [rdx + 0x10], xmm0
sub rbx, 0x10
add rdx, 0x10
dec rcx
jne 0x53d58a
movups xmm0, xmmword [rbx - 0x10]
movups xmmword [rdx + 0x10], xmm0
ret
Function at 0x53d720
Capabilities:
Resolve function by parsing pe exports

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x53d915
add rsp, 0xffffffffffffff80
mov qword [rsp + 0x78], rbp
lea rbp, [rsp + 0x78]
mov qword [rsp + 0x88], rax
cmp rbx, 0x40
jne 0x53d8f9
xor ecx, ecx
jmp 0x53d751
inc rcx
cmp rcx, 0x40
jge 0x53d825
movzx edx, byte [rax + rcx]
nop
cmp dl, 0xa
je 0x53d76a
cmp dl, 0xd
jne 0x53d74e
movabs rdx, 0x52141e3494ba4a2e
mov qword [rsp + 0x44], rdx
movabs rdx, 0xa399d1dcada3193
mov qword [rsp + 0x4c], rdx
movabs rdx, 0x82f5fb550a399d1d
mov qword [rsp + 0x50], rdx
movabs rdx, 0xea388f2216b64701
mov qword [rsp + 0x58], rdx
movabs rdx, 0x19226cdcc79f01b9
mov qword [rsp + 0x60], rdx
movabs rdx, 0x5110b7598b5251d1
mov qword [rsp + 0x68], rdx
movabs rdx, 0x155a4b30dba92437
mov qword [rsp + 0x18], rdx
movabs rdx, 0x5b29c44ba692308d
mov qword [rsp + 0x20], rdx
movabs rdx, 0xed6e251f5b29c44b
mov qword [rsp + 0x24], rdx
movabs rdx, 0x84e8e44c53ab2d6d
mov qword [rsp + 0x2c], rdx
movabs rdx, 0x4afef992a2cd76ac
mov qword [rsp + 0x34], rdx
movabs rdx, 0x2155bd0ad6201097
mov qword [rsp + 0x3c], rdx
xor eax, eax
jmp 0x53d8cb
mov qword [rsp + 0x88], rax
lea rax, [0x005c9500]
call fcn.0040c900
mov qword [rsp + 0x70], rax
mov dword [rax + 0x140], 0x3d
mov rbx, qword [rsp + 0x88]
cmp rax, rbx
je 0x53d86c
mov ecx, 0x40
call fcn.0045fd00
mov rax, qword [rsp + 0x70]
mov rbx, qword [rsp + 0x88]
lea rdx, [rax + 0x40]
lea rsi, [0x005d7d3a]
cmp rsi, rdx
je 0x53d899
mov rax, rdx
mov rbx, rsi
mov ecx, 0x100
call fcn.0045fd00
mov rax, qword [rsp + 0x70]
mov rbx, qword [rsp + 0x88]
xor ecx, ecx
jmp 0x53d8a8
movzx edx, byte [rbx + rcx]
mov byte [rax + rdx + 0x40], cl
inc rcx
cmp rcx, 0x40
jl 0x53d89d
mov rbp, qword [rsp + 0x78]
sub rsp, 0xffffffffffffff80
ret
movzx edx, byte [rsp + rax + 0x44]
movzx esi, byte [rsp + rax + 0x18]
add edx, esi
mov byte [rsp + rax + 0x18], dl
inc rax
cmp rax, 0x2c
jl 0x53d8b8
xor eax, eax
lea rbx, [rsp + 0x18]
mov ecx, 0x2c
nop dword [rax]
call fcn.0044a0a0
call fcn.0040a0c0
mov rbx, rax
lea rax, [0x005b8f00]
call fcn.004334e0
call fcn.005402c0
nop
call fcn.0040a0c0
mov rbx, rax
lea rax, [0x005b8f00]
call fcn.004334e0
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
nop
call fcn.0045cd20
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.0053d720
Function at 0x542a00
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x542adc
sub rsp, 0x40
mov qword [rsp + 0x38], rbp
lea rbp, [rsp + 0x38]
movabs rdx, 0x1045481cf0e48b10
mov qword [rsp + 0x1f], rdx
movabs rdx, 0xf3e8491045481cf0
mov qword [rsp + 0x22], rdx
movabs rdx, 0x100090a04040109
mov qword [rsp + 0x2a], rdx
movabs rdx, 0x202030700020100
mov qword [rsp + 0x30], rdx
xor eax, eax
jmp 0x542a72
movzx r9d, byte [rsp + rsi + 0x1f]
add r9d, 0x55
add edx, r9d
mov byte [rsp + rdi + 0x1f], dl
mov byte [rsp + rsi + 0x1f], r8b
add rax, 2
cmp rax, 0xe
jge 0x542aa8
movzx edx, byte [rsp + rax + 0x2a]
movzx esi, byte [rsp + rax + 0x2b]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0xb
jae 0x542acf
movzx r8d, byte [rsp + rdi + 0x1f]
add r8d, 0x55
add r8d, edx
nop dword [rax + rax]
cmp rsi, 0xb
jb 0x542a58
jmp 0x542ac3
xor eax, eax
lea rbx, [rsp + 0x1f]
mov ecx, 0xb
call fcn.0044a0a0
mov rbp, qword [rsp + 0x38]
add rsp, 0x40
ret
mov eax, esi
mov ecx, 0xb
call fcn.0045f380
mov eax, edi
mov ecx, 0xb
call fcn.0045f380
nop
nop dword [rax]
call fcn.0045cd20
jmp fcn.00542a00

Function at 0x543460
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x543568
sub rsp, 0x50
mov qword [rsp + 0x48], rbp
lea rbp, [rsp + 0x48]
movabs rdx, 0x262e2965496fe40a
mov qword [rsp + 0x19], rdx
movabs rdx, 0x27b71f262e296549
mov qword [rsp + 0x1c], rdx
movabs rdx, 0x6436585c106d6114
mov qword [rsp + 0x24], rdx
movabs rdx, 0xb0108000109060e
mov qword [rsp + 0x2c], rdx
movabs rdx, 0x8091007060a0b11
mov qword [rsp + 0x34], rdx
movabs rdx, 0xc110c1008091007
mov qword [rsp + 0x38], rdx
movabs rdx, 0x5050f110b060c03
mov qword [rsp + 0x40], rdx
xor eax, eax
jmp 0x543502
movzx r9d, byte [rsp + rsi + 0x19]
sub r9d, edx
lea edx, [r9 + 0x3f]
mov byte [rsp + rdi + 0x19], dl
lea edx, [r8 + 0x3f]
mov byte [rsp + rsi + 0x19], dl
add rax, 2
cmp rax, 0x1c
jge 0x54352f
movzx edx, byte [rsp + rax + 0x2c]
movzx esi, byte [rsp + rax + 0x2d]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x13
jae 0x54355b
movzx r8d, byte [rsp + rdi + 0x19]
sub r8d, edx
cmp rsi, 0x13
jb 0x5434e5
jmp 0x54354f
xor eax, eax
lea rbx, [rsp + 0x19]
mov ecx, 0x13
nop dword [rax + rax]
call fcn.0044a0a0
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
mov eax, esi
mov ecx, 0x13
call fcn.0045f380
mov eax, edi
mov ecx, 0x13
call fcn.0045f380
nop
call fcn.0045cd20
jmp fcn.00543460
Function at 0x545120
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x545228
sub rsp, 0x58
mov qword [rsp + 0x50], rbp
lea rbp, [rsp + 0x50]
movabs rdx, 0xd0ef24a06de02ee1
mov qword [rsp + 0x1b], rdx
movabs rdx, 0xada24d890656cd0
mov qword [rsp + 0x22], rdx
movabs rdx, 0x67bd2b6c20770d14
mov qword [rsp + 0x2a], rdx
movabs rdx, 0x207040c07060a01
mov qword [rsp + 0x32], rdx
movabs rdx, 0x1000b0d11140c0c
mov qword [rsp + 0x3a], rdx
movabs rdx, 0xd0d050c00150100
mov qword [rsp + 0x40], rdx
movabs rdx, 0x6100f0b0100140e
mov qword [rsp + 0x48], rdx
xor eax, eax
jmp 0x5451c0
movzx r9d, byte [rsp + rsi + 0x1b]
add r9d, 0x35
add edx, r9d
mov byte [rsp + rdi + 0x1b], dl
mov byte [rsp + rsi + 0x1b], r8b
add rax, 2
nop
cmp rax, 0x1e
jge 0x5451f1
movzx edx, byte [rsp + rax + 0x32]
movzx esi, byte [rsp + rax + 0x33]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x17
jae 0x54521b
movzx r8d, byte [rsp + rdi + 0x1b]
add r8d, 0x35
add r8d, edx
cmp rsi, 0x17
jb 0x5451a5
jmp 0x54520f
xor eax, eax
lea rbx, [rsp + 0x1b]
mov ecx, 0x17
nop dword [rax]
call fcn.0044a0a0
mov rbp, qword [rsp + 0x50]
add rsp, 0x58
ret
mov eax, esi
mov ecx, 0x17
call fcn.0045f380
mov eax, edi
mov ecx, 0x17
call fcn.0045f380
nop
call fcn.0045cd20
jmp fcn.00545120

Function at 0x5467c0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
lea r12, [rsp - 0x10]
cmp r12, qword [r14 + 0x10]
jbe 0x546947
sub rsp, 0x90
mov qword [rsp + 0x88], rbp
lea rbp, [rsp + 0x88]
movabs rdx, 0x6503416a722c6c63
mov qword [rsp + 0x1b], rdx
movabs rdx, 0xabb7a511360a2020
mov qword [rsp + 0x23], rdx
movabs rdx, 0x6506e7187aabb7a5
mov qword [rsp + 0x28], rdx
movabs rdx, 0xe1f0ae11272b64dd
mov qword [rsp + 0x30], rdx
movabs rdx, 0x5d6e65ed2058436d
mov qword [rsp + 0x38], rdx
movabs rdx, 0x294038d5cc3f68ed
mov qword [rsp + 0x40], rdx
movabs rdx, 0x281a101f2b24010d
mov qword [rsp + 0x48], rdx
movabs rdx, 0x11f190e0c240b04
mov qword [rsp + 0x50], rdx
movabs rdx, 0x1a21251e2712100f
mov qword [rsp + 0x58], rdx
movabs rdx, 0xf0a28100c1e292b
mov qword [rsp + 0x60], rdx
movabs rdx, 0x1c19082a0d13180b
mov qword [rsp + 0x68], rdx
movabs rdx, 0x210d111a052b1304
mov qword [rsp + 0x70], rdx
movabs rdx, 0x190102061306241e
mov qword [rsp + 0x78], rdx
movabs rdx, 0x132a1b13172b1510
mov qword [rsp + 0x80], rdx
xor eax, eax
jmp 0x5468e0
movzx r9d, byte [rsp + rsi + 0x1b]
sub r9d, edx
lea edx, [r9 - 0x80]
mov byte [rsp + rdi + 0x1b], dl
lea edx, [r8 - 0x80]
mov byte [rsp + rsi + 0x1b], dl
add rax, 2
nop dword [rax]
cmp rax, 0x40
jge 0x54690d
movzx edx, byte [rsp + rax + 0x48]
movzx esi, byte [rsp + rax + 0x49]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x2d
jae 0x54693a
movzx r8d, byte [rsp + rdi + 0x1b]
sub r8d, edx
cmp rsi, 0x2d
jb 0x5468bf
jmp 0x54692e
xor eax, eax
lea rbx, [rsp + 0x1b]
mov ecx, 0x2d
call fcn.0044a0a0
mov rbp, qword [rsp + 0x88]
add rsp, 0x90
ret
mov eax, esi
mov ecx, 0x2d
call fcn.0045f380
mov eax, edi
mov ecx, 0x2d
call fcn.0045f380
nop
call fcn.0045cd20
jmp fcn.005467c0
Function at 0x54a900
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x54a9c8
sub rsp, 0x38
mov qword [rsp + 0x30], rbp
lea rbp, [rsp + 0x30]
movabs rdx, 0xc1353abbbf3a3af1
mov qword [rsp + 0x1e], rdx
movabs rdx, 0x307030704000400
mov qword [rsp + 0x26], rdx
mov word [rsp + 0x2e], 0x404
xor eax, eax
nop
jmp 0x54a960
movzx r9d, byte [rsp + rsi + 0x1e]
add r9d, 0x30
add edx, r9d
mov byte [rsp + rdi + 0x1e], dl
mov byte [rsp + rsi + 0x1e], r8b
add rax, 2
nop dword [rax]
cmp rax, 0xa
jge 0x54a991
movzx edx, byte [rsp + rax + 0x26]
movzx esi, byte [rsp + rax + 0x27]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 8
jae 0x54a9bb
movzx r8d, byte [rsp + rdi + 0x1e]
add r8d, 0x30
add r8d, edx
cmp rsi, 8
jb 0x54a942
jmp 0x54a9af
xor eax, eax
lea rbx, [rsp + 0x1e]
mov ecx, 8
nop dword [rax]
call fcn.0044a0a0
mov rbp, qword [rsp + 0x30]
add rsp, 0x38
ret
mov eax, esi
mov ecx, 8
call fcn.0045f380
mov eax, edi
mov ecx, 8
call fcn.0045f380
nop
call fcn.0045cd20
jmp fcn.0054a900

Function at 0x54b020
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x54b132
sub rsp, 0x60
mov qword [rsp + 0x58], rbp
lea rbp, [rsp + 0x58]
movabs rdx, 0x2064806cb5d8a887
mov qword [rsp + 0x3a], rdx
movabs rdx, 0xd86b726fcbe2db6e
mov qword [rsp + 0x42], rdx
movabs rdx, 0xb0ced074d269d86b
mov qword [rsp + 0x48], rdx
movabs rdx, 0xe040bb6ef97063c7
mov qword [rsp + 0x50], rdx
movabs rdx, 0x5161d0b0b150301
mov qword [rsp + 0x1c], rdx
movabs rdx, 0x181c001419181b16
mov qword [rsp + 0x24], rdx
movabs rdx, 0x21813141109181c
mov qword [rsp + 0x2a], rdx
movabs rdx, 0xa1d0a1c0b0f131b
mov qword [rsp + 0x32], rdx
xor eax, eax
jmp 0x54b0d1
movzx r9d, byte [rsp + rsi + 0x3a]
sub r9d, edx
lea edx, [r9 - 0x45]
mov byte [rsp + rdi + 0x3a], dl
lea edx, [r8 - 0x45]
mov byte [rsp + rsi + 0x3a], dl
add rax, 2
cmp rax, 0x1e
jge 0x54b0fe
movzx edx, byte [rsp + rax + 0x1c]
movzx esi, byte [rsp + rax + 0x1d]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x1e
jae 0x54b125
movzx r8d, byte [rsp + rdi + 0x3a]
sub r8d, edx
cmp rsi, 0x1e
jb 0x54b0b4
jmp 0x54b119
xor eax, eax
lea rbx, [rsp + 0x3a]
mov ecx, 0x1e
call fcn.0044a0a0
mov rbp, qword [rsp + 0x58]
add rsp, 0x60
ret
mov eax, esi
mov ecx, 0x1e
call fcn.0045f380
mov eax, edi
mov ecx, 0x1e
call fcn.0045f380
nop
call fcn.0045cd20
jmp fcn.0054b020
Function at 0x550000
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x5500f6
sub rsp, 0x48
mov qword [rsp + 0x40], rbp
lea rbp, [rsp + 0x40]
movabs rdx, 0x5e76111656cf570
mov qword [rsp + 0x19], rdx
movabs rdx, 0x386eac05e7611165
mov qword [rsp + 0x1c], rdx
movabs rdx, 0x6ea66974bb04ef74
mov qword [rsp + 0x24], rdx
movabs rdx, 0x1060a0d00070d04
mov qword [rsp + 0x2c], rdx
movabs rdx, 0xc110601060a0d
mov qword [rsp + 0x30], rdx
movabs rdx, 0x10e0e0d00080404
mov qword [rsp + 0x38], rdx
xor eax, eax
jmp 0x550090
movzx r9d, byte [rsp + rsi + 0x19]
add r9d, 0xffffffa7
add edx, r9d
mov byte [rsp + rdi + 0x19], dl
mov byte [rsp + rsi + 0x19], r8b
add rax, 2
cmp rax, 0x14
jge 0x5500c2
movzx edx, byte [rsp + rax + 0x2c]
movzx esi, byte [rsp + rax + 0x2d]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x13
jae 0x5500e9
movzx r8d, byte [rsp + rdi + 0x19]
add r8d, 0xffffffa7
add r8d, edx
cmp rsi, 0x13
jb 0x550076
nop
jmp 0x5500dd
xor eax, eax
lea rbx, [rsp + 0x19]
mov ecx, 0x13
call fcn.0044a0a0
mov rbp, qword [rsp + 0x40]
add rsp, 0x48
ret
mov eax, esi
mov ecx, 0x13
call fcn.0045f380
mov eax, edi
mov ecx, 0x13
call fcn.0045f380
nop
call fcn.0045cd20
nop dword [rax + rax]
jmp fcn.00550000

Function at 0x551d00
Capabilities:
Encrypt data using rc4 prga

Disassembly:
sub rsp, 0x30
mov qword [rsp + 0x28], rbp
lea rbp, [rsp + 0x28]
mov qword [rsp + 0x38], 0
movabs rax, 0xf63b42c46994981b
mov qword [rsp + 0x18], rax
movabs rax, 0x49020b76c4d48c89
mov qword [rsp + 0x20], rax
mov qword [rsp + 0xf], 0
mov qword [rsp + 0x10], 0
movzx eax, byte [rsp + 0x1b]
movzx ecx, byte [rsp + 0x18]
add eax, ecx
movzx ecx, byte [rsp + 0x1e]
movzx edx, byte [rsp + 0x1a]
movzx ebx, byte [rsp + 0x27]
movzx esi, byte [rsp + 0x1c]
movzx edi, byte [rsp + 0x24]
movzx r8d, byte [rsp + 0x19]
movzx r9d, byte [rsp + 0x1d]
movzx r10d, byte [rsp + 0x26]
movzx r11d, byte [rsp + 0x23]
movzx r12d, byte [rsp + 0x25]
movzx r13d, byte [rsp + 0x22]
mov byte [rsp + 6], r13b
movzx r15d, byte [rsp + 0x21]
movzx r13d, byte [rsp + 0x1f]
mov byte [rsp + 5], r13b
movzx r13d, byte [rsp + 0x20]
mov byte [rsp + 0xf], al
sub ecx, edx
mov byte [rsp + 0x10], cl
lea eax, [rsi + rbx]
mov byte [rsp + 0x11], al
xor edi, r8d
mov byte [rsp + 0x12], dil
lea eax, [r10 + r9]
mov byte [rsp + 0x13], al
lea eax, [r12 + r11]
mov byte [rsp + 0x14], al
movzx eax, byte [rsp + 6]
add eax, r15d
mov byte [rsp + 0x15], al
movzx eax, byte [rsp + 5]
sub eax, r13d
mov byte [rsp + 0x16], al
mov qword [rsp + 7], 0
xor eax, eax
jmp 0x551e06
movzx ecx, byte [rsp + rax + 0xf]
mov byte [rsp + rax + 7], cl
inc rax
cmp rax, 8
jl 0x551dfa
mov rax, qword [rsp + 7]
mov qword [rsp + 0x38], rax
mov rbp, qword [rsp + 0x28]
add rsp, 0x30
nop
ret
Function at 0x551e40
Capabilities:
Encrypt data using rc4 prga

Disassembly:
sub rsp, 0x30
mov qword [rsp + 0x28], rbp
lea rbp, [rsp + 0x28]
mov qword [rsp + 0x38], 0
movabs rax, 0x440eb54661a1622e
mov qword [rsp + 0x18], rax
movabs rax, 0x685f43922bbd6231
mov qword [rsp + 0x20], rax
mov qword [rsp + 0xf], 0
mov qword [rsp + 0x10], 0
movzx eax, byte [rsp + 0x23]
movzx ecx, byte [rsp + 0x26]
add eax, ecx
movzx ecx, byte [rsp + 0x20]
movzx edx, byte [rsp + 0x19]
movzx ebx, byte [rsp + 0x1f]
movzx esi, byte [rsp + 0x1a]
movzx edi, byte [rsp + 0x24]
movzx r8d, byte [rsp + 0x22]
movzx r9d, byte [rsp + 0x18]
movzx r10d, byte [rsp + 0x1d]
movzx r11d, byte [rsp + 0x1e]
movzx r12d, byte [rsp + 0x25]
movzx r13d, byte [rsp + 0x21]
mov byte [rsp + 6], r13b
movzx r15d, byte [rsp + 0x1b]
movzx r13d, byte [rsp + 0x27]
mov byte [rsp + 5], r13b
movzx r13d, byte [rsp + 0x1c]
mov byte [rsp + 0xf], al
xor ecx, edx
mov byte [rsp + 0x10], cl
lea eax, [rsi + rbx]
mov byte [rsp + 0x11], al
lea eax, [r8 + rdi]
mov byte [rsp + 0x12], al
lea eax, [r10 + r9]
mov byte [rsp + 0x13], al
lea eax, [r12 + r11]
mov byte [rsp + 0x14], al
movzx eax, byte [rsp + 6]
add eax, r15d
mov byte [rsp + 0x15], al
movzx eax, byte [rsp + 5]
sub eax, r13d
mov byte [rsp + 0x16], al
mov qword [rsp + 7], 0
xor eax, eax
jmp 0x551f46
movzx ecx, byte [rsp + rax + 0xf]
mov byte [rsp + rax + 7], cl
inc rax
cmp rax, 8
jl 0x551f3a
mov rax, qword [rsp + 7]
mov qword [rsp + 0x38], rax
mov rbp, qword [rsp + 0x28]
add rsp, 0x30
nop
ret

Function at 0x5522e0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
sub rsp, 0x30
mov qword [rsp + 0x28], rbp
lea rbp, [rsp + 0x28]
mov qword [rsp + 0x38], 0
movabs rdx, 0xc17c66765d790d92
mov qword [rsp + 0x20], rdx
movabs rdx, 0x407040007040307
mov qword [rsp + 0x10], rdx
xor eax, eax
jmp 0x552335
movzx r8d, byte [rsp + rbx + 0x20]
sub r8d, edx
lea edx, [r8 + 0x13]
mov byte [rsp + rsi + 0x20], dl
lea edx, [rdi + 0x13]
mov byte [rsp + rbx + 0x20], dl
add rax, 2
cmp rax, 8
jge 0x552362
movzx edx, byte [rsp + rax + 0x10]
movzx ebx, byte [rsp + rax + 0x11]
mov esi, edx
xor edx, ebx
add edx, eax
cmp rsi, 8
jae 0x5523a6
movzx edi, byte [rsp + rsi + 0x20]
sub edi, edx
cmp rbx, 8
jb 0x552319
nop
jmp 0x55239a
mov qword [rsp + 0x18], 0
xor eax, eax
jmp 0x552380
movzx ecx, byte [rsp + rax + 0x20]
mov byte [rsp + rax + 0x18], cl
inc rax
nop dword [rax + rax]
cmp rax, 8
jl 0x55236f
mov rax, qword [rsp + 0x18]
mov qword [rsp + 0x38], rax
mov rbp, qword [rsp + 0x28]
add rsp, 0x30
ret
mov eax, ebx
mov ecx, 8
call fcn.0045f380
mov eax, esi
mov ecx, 8
call fcn.0045f380
nop
int3
Function at 0x552500
Capabilities:
Encrypt data using rc4 prga

Disassembly:
sub rsp, 0x38
mov qword [rsp + 0x30], rbp
lea rbp, [rsp + 0x30]
mov qword [rsp + 0x40], 0
movabs rdx, 0x92107b27150014fa
mov qword [rsp + 0x1c], rdx
movabs rdx, 0x703020704000406
mov qword [rsp + 0x24], rdx
mov dword [rsp + 0x2c], 0x2050403
xor eax, eax
nop
jmp 0x552560
movzx r8d, byte [rsp + rbx + 0x1c]
add r8d, 0x44
add edx, r8d
mov byte [rsp + rsi + 0x1c], dl
mov byte [rsp + rbx + 0x1c], dil
add rax, 2
nop dword [rax]
cmp rax, 0xc
jge 0x55258e
movzx edx, byte [rsp + rax + 0x24]
movzx ebx, byte [rsp + rax + 0x25]
mov esi, edx
xor edx, ebx
add edx, eax
cmp rsi, 8
jae 0x5525cd
movzx edi, byte [rsp + rsi + 0x1c]
add edi, 0x44
add edi, edx
cmp rbx, 8
jb 0x552542
jmp 0x5525c1
mov qword [rsp + 0x14], 0
xor eax, eax
jmp 0x5525a7
movzx ecx, byte [rsp + rax + 0x1c]
mov byte [rsp + rax + 0x14], cl
inc rax
cmp rax, 8
jl 0x55259b
mov rax, qword [rsp + 0x14]
mov qword [rsp + 0x40], rax
mov rbp, qword [rsp + 0x30]
add rsp, 0x38
ret
mov eax, ebx
mov ecx, 8
call fcn.0045f380
mov eax, esi
mov ecx, 8
call fcn.0045f380
nop
int3

Function at 0x5525e0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
sub rsp, 0x30
mov qword [rsp + 0x28], rbp
lea rbp, [rsp + 0x28]
mov qword [rsp + 0x38], 0
movabs rdx, 0x851406a9bda50fa6
mov qword [rsp + 0x20], rdx
movabs rdx, 0x106010101020401
mov qword [rsp + 0x10], rdx
xor eax, eax
jmp 0x552633
movzx r8d, byte [rsp + rbx + 0x20]
add r8d, 0x42
add edx, r8d
mov byte [rsp + rsi + 0x20], dl
mov byte [rsp + rbx + 0x20], dil
add rax, 2
cmp rax, 8
jge 0x552662
movzx edx, byte [rsp + rax + 0x10]
movzx ebx, byte [rsp + rax + 0x11]
mov esi, edx
xor edx, ebx
add edx, eax
cmp rsi, 8
jae 0x5526a6
movzx edi, byte [rsp + rsi + 0x20]
add edi, 0x42
add edi, edx
cmp rbx, 8
jb 0x552619
nop
jmp 0x55269a
mov qword [rsp + 0x18], 0
xor eax, eax
jmp 0x552680
movzx ecx, byte [rsp + rax + 0x20]
mov byte [rsp + rax + 0x18], cl
inc rax
nop dword [rax + rax]
cmp rax, 8
jl 0x55266f
mov rax, qword [rsp + 0x18]
mov qword [rsp + 0x38], rax
mov rbp, qword [rsp + 0x28]
add rsp, 0x30
ret
mov eax, ebx
mov ecx, 8
call fcn.0045f380
mov eax, esi
mov ecx, 8
call fcn.0045f380
nop
int3
Function at 0x552d20
Capabilities:
Encrypt data using rc4 prga

Disassembly:
sub rsp, 0x38
mov qword [rsp + 0x30], rbp
lea rbp, [rsp + 0x30]
mov qword [rsp + 0x40], 0
movabs rdx, 0xd3b8a291ee4dc5b6
mov qword [rsp + 0x1e], rdx
movabs rdx, 0x103000201020207
mov qword [rsp + 0x26], rdx
mov word [rsp + 0x2e], 0x507
xor eax, eax
nop
jmp 0x552d80
movzx r8d, byte [rsp + rbx + 0x1e]
sub r8d, edx
lea edx, [r8 + 0x66]
mov byte [rsp + rsi + 0x1e], dl
lea edx, [rdi + 0x66]
mov byte [rsp + rbx + 0x1e], dl
add rax, 2
nop
cmp rax, 0xa
jge 0x552dab
movzx edx, byte [rsp + rax + 0x26]
movzx ebx, byte [rsp + rax + 0x27]
mov esi, edx
xor edx, ebx
add edx, eax
cmp rsi, 8
jae 0x552dea
movzx edi, byte [rsp + rsi + 0x1e]
sub edi, edx
cmp rbx, 8
jb 0x552d62
jmp 0x552dde
mov qword [rsp + 0x16], 0
xor eax, eax
jmp 0x552dc4
movzx ecx, byte [rsp + rax + 0x1e]
mov byte [rsp + rax + 0x16], cl
inc rax
cmp rax, 8
jl 0x552db8
mov rax, qword [rsp + 0x16]
mov qword [rsp + 0x40], rax
mov rbp, qword [rsp + 0x30]
add rsp, 0x38
ret
mov eax, ebx
mov ecx, 8
call fcn.0045f380
mov eax, esi
mov ecx, 8
call fcn.0045f380
nop
int3

Function at 0x552e00
Capabilities:
Encrypt data using rc4 prga

Disassembly:
sub rsp, 0x38
mov qword [rsp + 0x30], rbp
lea rbp, [rsp + 0x30]
mov qword [rsp + 0x40], 0
movabs rdx, 0x51620b6ce9216db0
mov qword [rsp + 0x1c], rdx
movabs rdx, 0x402020607050606
mov qword [rsp + 0x24], rdx
mov dword [rsp + 0x2c], 0x6020401
xor eax, eax
nop
jmp 0x552e60
movzx r8d, byte [rsp + rbx + 0x1c]
sub r8d, edx
lea edx, [r8 + 0x3a]
mov byte [rsp + rsi + 0x1c], dl
lea edx, [rdi + 0x3a]
mov byte [rsp + rbx + 0x1c], dl
add rax, 2
nop
cmp rax, 0xc
jge 0x552e8b
movzx edx, byte [rsp + rax + 0x24]
movzx ebx, byte [rsp + rax + 0x25]
mov esi, edx
xor edx, ebx
add edx, eax
cmp rsi, 8
jae 0x552eca
movzx edi, byte [rsp + rsi + 0x1c]
sub edi, edx
cmp rbx, 8
jb 0x552e42
jmp 0x552ebe
mov qword [rsp + 0x14], 0
xor eax, eax
jmp 0x552ea4
movzx ecx, byte [rsp + rax + 0x1c]
mov byte [rsp + rax + 0x14], cl
inc rax
cmp rax, 8
jl 0x552e98
mov rax, qword [rsp + 0x14]
mov qword [rsp + 0x40], rax
mov rbp, qword [rsp + 0x30]
add rsp, 0x38
ret
mov eax, ebx
mov ecx, 8
call fcn.0045f380
mov eax, esi
mov ecx, 8
call fcn.0045f380
nop
int3