joyce8/EMBER2024-capa huggingface dataset:
Function at 0x54a020
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x54a11b
push rbp
mov rbp, rsp
sub rsp, 0x48
movabs rdx, 0x6dd3cf009872e7dd
mov qword [rsp + 0x1c], rdx
movabs rdx, 0xc8cc6dd3cf009872
mov qword [rsp + 0x1e], rdx
movabs rdx, 0x67a1af7661986562
mov qword [rsp + 0x26], rdx
movabs rdx, 0x504080f0010010f
mov qword [rsp + 0x2e], rdx
movabs rdx, 0xc0f061001040905
mov qword [rsp + 0x36], rdx
movabs rdx, 0x3100c0f06100104
mov qword [rsp + 0x38], rdx
movabs rdx, 0x909100805030406
mov qword [rsp + 0x40], rdx
xor eax, eax
jmp 0x54a0b9
movzx r9d, byte [rsp + rsi + 0x1c]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x40]
mov byte [rsp + rdi + 0x1c], dl
mov byte [rsp + rsi + 0x1c], r8b
add rax, 2
cmp rax, 0x1a
jge 0x54a0eb
movzx edx, byte [rsp + rax + 0x2e]
movzx esi, byte [rsp + rax + 0x2f]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x12
jae 0x54a10e
movzx r8d, byte [rsp + rdi + 0x1c]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x40]
cmp rsi, 0x12
jb 0x54a09f
jmp 0x54a102
xor eax, eax
lea rbx, [rsp + 0x1c]
mov ecx, 0x12
call fcn.0044bb20
add rsp, 0x48
pop rbp
ret
mov eax, esi
mov ecx, 0x12
call fcn.00461020
mov eax, edi
mov ecx, 0x12
call fcn.00461020
nop
nop dword [rax + rax]
call fcn.0045eda0
jmp fcn.0054a020

Function at 0x54aac0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x54abdd
push rbp
mov rbp, rsp
sub rsp, 0x58
movabs rdx, 0x87cea98e46bd9082
mov qword [rsp + 0x1d], rdx
movabs rdx, 0x816b87a38f3f94c7
mov qword [rsp + 0x25], rdx
movabs rdx, 0x95816b87a38f3f94
mov qword [rsp + 0x26], rdx
movabs rdx, 0xced16198ce9574a4
mov qword [rsp + 0x2e], rdx
movabs rdx, 0x800080214181805
mov qword [rsp + 0x36], rdx
movabs rdx, 0x50f080008021418
mov qword [rsp + 0x38], rdx
movabs rdx, 0x150102180413170b
mov qword [rsp + 0x40], rdx
movabs rdx, 0xd0910000f0a0c11
mov qword [rsp + 0x48], rdx
movabs rdx, 0xb02060207031818
mov qword [rsp + 0x50], rdx
xor eax, eax
jmp 0x54ab80
movzx r9d, byte [rsp + rsi + 0x1d]
sub r9d, edx
lea edx, [r9 - 6]
mov byte [rsp + rdi + 0x1d], dl
lea edx, [r8 - 6]
mov byte [rsp + rsi + 0x1d], dl
add rax, 2
nop word [rax + rax]
cmp rax, 0x22
jge 0x54abad
movzx edx, byte [rsp + rax + 0x36]
movzx esi, byte [rsp + rax + 0x37]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x19
jae 0x54abd0
movzx r8d, byte [rsp + rdi + 0x1d]
sub r8d, edx
cmp rsi, 0x19
jb 0x54ab5d
jmp 0x54abc4
xor eax, eax
lea rbx, [rsp + 0x1d]
mov ecx, 0x19
call fcn.0044bb20
add rsp, 0x58
pop rbp
ret
mov eax, esi
mov ecx, 0x19
call fcn.00461020
mov eax, edi
mov ecx, 0x19
call fcn.00461020
nop
nop dword [rax]
call fcn.0045eda0
jmp fcn.0054aac0
Function at 0x552120
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x55221d
push rbp
mov rbp, rsp
sub rsp, 0x50
movabs rdx, 0x30773891e331d5d6
mov qword [rsp + 0x1c], rdx
movabs rdx, 0x334831ebabd53077
mov qword [rsp + 0x22], rdx
movabs rdx, 0x94869234ccaf11ea
mov qword [rsp + 0x2a], rdx
movabs rdx, 0xc0e0f0e0c061114
mov qword [rsp + 0x32], rdx
movabs rdx, 0x40c0f11060108
mov qword [rsp + 0x3a], rdx
movabs rdx, 0x110c1309110004
mov qword [rsp + 0x40], rdx
movabs rdx, 0x150c13101510030a
mov qword [rsp + 0x48], rdx
xor eax, eax
jmp 0x5521c0
movzx r9d, byte [rsp + rsi + 0x1c]
sub r9d, edx
lea edx, [r9 + 0x6a]
mov byte [rsp + rdi + 0x1c], dl
lea edx, [r8 + 0x6a]
mov byte [rsp + rsi + 0x1c], dl
add rax, 2
nop dword [rax]
cmp rax, 0x1e
jge 0x5521ed
movzx edx, byte [rsp + rax + 0x32]
movzx esi, byte [rsp + rax + 0x33]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x16
jae 0x552210
movzx r8d, byte [rsp + rdi + 0x1c]
sub r8d, edx
cmp rsi, 0x16
jb 0x55219f
jmp 0x552204
xor eax, eax
lea rbx, [rsp + 0x1c]
mov ecx, 0x16
call fcn.0044bb20
add rsp, 0x50
pop rbp
ret
mov eax, esi
mov ecx, 0x16
call fcn.00461020
mov eax, edi
mov ecx, 0x16
call fcn.00461020
nop
nop dword [rax]
call fcn.0045eda0
jmp fcn.00552120

Function at 0x552ca0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x28
mov qword [rsp + 0x38], 0
movabs rax, 0x1d2a2907538aa1dc
mov qword [rsp + 0x18], rax
movabs rax, 0x5516c6eba381260f
mov qword [rsp + 0x20], rax
mov qword [rsp + 0xf], 0
mov qword [rsp + 0x10], 0
movzx eax, byte [rsp + 0x20]
movzx ecx, byte [rsp + 0x1a]
sub eax, ecx
movzx ecx, byte [rsp + 0x1e]
movzx edx, byte [rsp + 0x1f]
sub ecx, edx
movzx edx, byte [rsp + 0x27]
movzx ebx, byte [rsp + 0x18]
sub edx, ebx
movzx ebx, byte [rsp + 0x26]
movzx esi, byte [rsp + 0x25]
xor ebx, esi
movzx esi, byte [rsp + 0x24]
movzx edi, byte [rsp + 0x23]
add esi, edi
movzx edi, byte [rsp + 0x1c]
movzx r8d, byte [rsp + 0x19]
sub edi, r8d
movzx r8d, byte [rsp + 0x1d]
movzx r9d, byte [rsp + 0x1b]
add r8d, r9d
movzx r9d, byte [rsp + 0x21]
movzx r10d, byte [rsp + 0x22]
mov byte [rsp + 0xf], al
mov byte [rsp + 0x10], cl
mov byte [rsp + 0x11], dl
mov byte [rsp + 0x12], bl
mov byte [rsp + 0x13], sil
mov byte [rsp + 0x14], dil
mov byte [rsp + 0x15], r8b
lea eax, [r10 + r9]
mov byte [rsp + 0x16], al
mov qword [rsp + 7], 0
xor eax, eax
jmp 0x552d86
movzx ecx, byte [rsp + rax + 0xf]
mov byte [rsp + rax + 7], cl
inc rax
cmp rax, 8
jl 0x552d7a
mov rax, qword [rsp + 7]
mov qword [rsp + 0x38], rax
add rsp, 0x28
pop rbp
ret
Function at 0x5547c0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x28
mov qword [rsp + 0x38], 0
movabs rdx, 0xa7fe5601afaaa247
mov qword [rsp + 0x20], rdx
movabs rdx, 0x5000603020507
mov qword [rsp + 0x10], rdx
xor eax, eax
jmp 0x55480d
movzx r8d, byte [rsp + rbx + 0x20]
lea edx, [r8 + rdx]
lea edx, [rdx - 7]
mov byte [rsp + rsi + 0x20], dl
mov byte [rsp + rbx + 0x20], dil
add rax, 2
cmp rax, 8
jge 0x55483c
movzx edx, byte [rsp + rax + 0x10]
movzx ebx, byte [rsp + rax + 0x11]
mov esi, edx
xor edx, ebx
add edx, eax
cmp rsi, 8
jae 0x554877
movzx edi, byte [rsp + rsi + 0x20]
lea edi, [rdi + rdx]
lea edi, [rdi - 7]
cmp rbx, 8
jb 0x5547f3
jmp 0x55486b
mov qword [rsp + 0x18], 0
xor eax, eax
jmp 0x554855
movzx ecx, byte [rsp + rax + 0x20]
mov byte [rsp + rax + 0x18], cl
inc rax
cmp rax, 8
jl 0x554849
mov rax, qword [rsp + 0x18]
mov qword [rsp + 0x38], rax
add rsp, 0x28
pop rbp
ret
mov eax, ebx
mov ecx, 8
call fcn.00461020
mov eax, esi
mov ecx, 8
nop
call fcn.00461020
nop
int3

Function at 0x5548a0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov qword [rsp + 0x40], 0
movabs rdx, 0xc04846b0ef4a84ba
mov qword [rsp + 0x1e], rdx
movabs rdx, 0x107060402060204
mov qword [rsp + 0x26], rdx
mov word [rsp + 0x2e], 0x704
xor eax, eax
jmp 0x5548f4
movzx r8d, byte [rsp + rbx + 0x1e]
lea edx, [r8 + rdx]
lea edx, [rdx + 0x53]
mov byte [rsp + rsi + 0x1e], dl
mov byte [rsp + rbx + 0x1e], dil
add rax, 2
cmp rax, 0xa
jge 0x554928
movzx edx, byte [rsp + rax + 0x26]
movzx ebx, byte [rsp + rax + 0x27]
mov esi, edx
xor edx, ebx
add edx, eax
cmp rsi, 8
jae 0x554965
movzx edi, byte [rsp + rsi + 0x1e]
lea edi, [rdi + rdx]
lea edi, [rdi + 0x53]
nop dword [rax + rax]
cmp rbx, 8
jb 0x5548da
jmp 0x554957
mov qword [rsp + 0x16], 0
xor eax, eax
jmp 0x554941
movzx ecx, byte [rsp + rax + 0x1e]
mov byte [rsp + rax + 0x16], cl
inc rax
cmp rax, 8
jl 0x554935
mov rax, qword [rsp + 0x16]
mov qword [rsp + 0x40], rax
add rsp, 0x30
pop rbp
ret
mov eax, ebx
mov ecx, 8
nop
call fcn.00461020
mov eax, esi
mov ecx, 8
call fcn.00461020
nop
int3
Function at 0x5568e0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x28
mov qword [rsp + 0x38], 0
movabs rax, 0x8f01efc2f81d68fe
mov qword [rsp + 0x18], rax
movabs rax, 0xfe32c2837b346e4a
mov qword [rsp + 0x20], rax
mov qword [rsp + 0xf], 0
mov qword [rsp + 0x10], 0
movzx eax, byte [rsp + 0x1f]
movzx ecx, byte [rsp + 0x1e]
add eax, ecx
movzx ecx, byte [rsp + 0x1c]
movzx edx, byte [rsp + 0x22]
sub ecx, edx
movzx edx, byte [rsp + 0x24]
movzx ebx, byte [rsp + 0x23]
sub edx, ebx
movzx ebx, byte [rsp + 0x19]
movzx esi, byte [rsp + 0x25]
sub ebx, esi
movzx esi, byte [rsp + 0x1d]
movzx edi, byte [rsp + 0x27]
xor esi, edi
movzx edi, byte [rsp + 0x21]
movzx r8d, byte [rsp + 0x20]
add edi, r8d
movzx r8d, byte [rsp + 0x1a]
movzx r9d, byte [rsp + 0x26]
add r8d, r9d
movzx r9d, byte [rsp + 0x1b]
movzx r10d, byte [rsp + 0x18]
mov byte [rsp + 0xf], al
mov byte [rsp + 0x10], cl
mov byte [rsp + 0x11], dl
mov byte [rsp + 0x12], bl
mov byte [rsp + 0x13], sil
mov byte [rsp + 0x14], dil
mov byte [rsp + 0x15], r8b
lea eax, [r10 + r9]
mov byte [rsp + 0x16], al
mov qword [rsp + 7], 0
xor eax, eax
jmp 0x5569c6
movzx ecx, byte [rsp + rax + 0xf]
mov byte [rsp + rax + 7], cl
inc rax
cmp rax, 8
jl 0x5569ba
mov rax, qword [rsp + 7]
mov qword [rsp + 0x38], rax
add rsp, 0x28
pop rbp
ret

Function at 0x556fc0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov qword [rsp + 0x40], 0
movabs rdx, 0x187d01c62612d3ac
mov qword [rsp + 0x1e], rdx
movabs rdx, 0x705020303050300
mov qword [rsp + 0x26], rdx
mov word [rsp + 0x2e], 0x100
xor eax, eax
jmp 0x557016
movzx r8d, byte [rsp + rbx + 0x1e]
sub r8d, edx
lea edx, [r8 - 0x26]
mov byte [rsp + rsi + 0x1e], dl
lea edx, [rdi - 0x26]
mov byte [rsp + rbx + 0x1e], dl
add rax, 2
cmp rax, 0xa
jge 0x557042
movzx edx, byte [rsp + rax + 0x26]
movzx ebx, byte [rsp + rax + 0x27]
mov esi, edx
xor edx, ebx
add edx, eax
cmp rsi, 8
jae 0x557085
movzx edi, byte [rsp + rsi + 0x1e]
sub edi, edx
cmp rbx, 8
jb 0x556ffa
nop
jmp 0x557076
mov qword [rsp + 0x16], 0
xor eax, eax
jmp 0x557060
movzx ecx, byte [rsp + rax + 0x1e]
mov byte [rsp + rax + 0x16], cl
inc rax
nop dword [rax + rax]
cmp rax, 8
jl 0x55704f
mov rax, qword [rsp + 0x16]
mov qword [rsp + 0x40], rax
add rsp, 0x30
pop rbp
ret
mov eax, ebx
mov ecx, 8
nop dword [rax]
call fcn.00461020
mov eax, esi
mov ecx, 8
call fcn.00461020
nop
int3
Function at 0x557220
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov qword [rsp + 0x40], 0
movabs rdx, 0x4f86a09a39512f83
mov qword [rsp + 0x1c], rdx
movabs rdx, 0x201060707040506
mov qword [rsp + 0x24], rdx
mov dword [rsp + 0x2c], 0x6070502
xor eax, eax
jmp 0x557277
movzx r8d, byte [rsp + rbx + 0x1c]
sub r8d, edx
lea edx, [r8 + 0x12]
mov byte [rsp + rsi + 0x1c], dl
lea edx, [rdi + 0x12]
mov byte [rsp + rbx + 0x1c], dl
add rax, 2
cmp rax, 0xc
jge 0x5572a8
movzx edx, byte [rsp + rax + 0x24]
movzx ebx, byte [rsp + rax + 0x25]
mov esi, edx
xor edx, ebx
add edx, eax
cmp rsi, 8
jae 0x5572e5
movzx edi, byte [rsp + rsi + 0x1c]
sub edi, edx
nop word [rax + rax]
cmp rbx, 8
jb 0x55725b
jmp 0x5572d7
mov qword [rsp + 0x14], 0
xor eax, eax
jmp 0x5572c1
movzx ecx, byte [rsp + rax + 0x1c]
mov byte [rsp + rax + 0x14], cl
inc rax
cmp rax, 8
jl 0x5572b5
mov rax, qword [rsp + 0x14]
mov qword [rsp + 0x40], rax
add rsp, 0x30
pop rbp
ret
mov eax, ebx
mov ecx, 8
nop
call fcn.00461020
mov eax, esi
mov ecx, 8
call fcn.00461020
nop
int3

Function at 0x5579e0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov qword [rsp + 0x40], 0
movabs rdx, 0x5a446e8000df663
mov qword [rsp + 0x1e], rdx
movabs rdx, 0x404070605070700
mov qword [rsp + 0x26], rdx
mov word [rsp + 0x2e], 0x307
xor eax, eax
jmp 0x557a36
movzx r8d, byte [rsp + rbx + 0x1e]
sub r8d, edx
lea edx, [r8 - 0x77]
mov byte [rsp + rsi + 0x1e], dl
lea edx, [rdi - 0x77]
mov byte [rsp + rbx + 0x1e], dl
add rax, 2
cmp rax, 0xa
jge 0x557a62
movzx edx, byte [rsp + rax + 0x26]
movzx ebx, byte [rsp + rax + 0x27]
mov esi, edx
xor edx, ebx
add edx, eax
cmp rsi, 8
jae 0x557aa5
movzx edi, byte [rsp + rsi + 0x1e]
sub edi, edx
cmp rbx, 8
jb 0x557a1a
nop
jmp 0x557a96
mov qword [rsp + 0x16], 0
xor eax, eax
jmp 0x557a80
movzx ecx, byte [rsp + rax + 0x1e]
mov byte [rsp + rax + 0x16], cl
inc rax
nop dword [rax + rax]
cmp rax, 8
jl 0x557a6f
mov rax, qword [rsp + 0x16]
mov qword [rsp + 0x40], rax
add rsp, 0x30
pop rbp
ret
mov eax, ebx
mov ecx, 8
nop dword [rax]
call fcn.00461020
mov eax, esi
mov ecx, 8
call fcn.00461020
nop
int3
Function at 0x558600
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov qword [rsp + 0x40], 0
movabs rdx, 0xff0e0804225c0374
mov qword [rsp + 0x1e], rdx
movabs rdx, 0x101040702010401
mov qword [rsp + 0x26], rdx
mov word [rsp + 0x2e], 0x100
xor eax, eax
jmp 0x558654
movzx r8d, byte [rsp + rbx + 0x1e]
lea edx, [r8 + rdx]
lea edx, [rdx + 0x1a]
mov byte [rsp + rsi + 0x1e], dl
mov byte [rsp + rbx + 0x1e], dil
add rax, 2
cmp rax, 0xa
jge 0x558688
movzx edx, byte [rsp + rax + 0x26]
movzx ebx, byte [rsp + rax + 0x27]
mov esi, edx
xor edx, ebx
add edx, eax
cmp rsi, 8
jae 0x5586c5
movzx edi, byte [rsp + rsi + 0x1e]
lea edi, [rdi + rdx]
lea edi, [rdi + 0x1a]
nop dword [rax + rax]
cmp rbx, 8
jb 0x55863a
jmp 0x5586b7
mov qword [rsp + 0x16], 0
xor eax, eax
jmp 0x5586a1
movzx ecx, byte [rsp + rax + 0x1e]
mov byte [rsp + rax + 0x16], cl
inc rax
cmp rax, 8
jl 0x558695
mov rax, qword [rsp + 0x16]
mov qword [rsp + 0x40], rax
add rsp, 0x30
pop rbp
ret
mov eax, ebx
mov ecx, 8
nop
call fcn.00461020
mov eax, esi
mov ecx, 8
call fcn.00461020
nop
int3

Function at 0x5586e0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov qword [rsp + 0x40], 0
movabs rdx, 0xfcdd8682c4f51c84
mov qword [rsp + 0x1e], rdx
movabs rdx, 0x403040503020303
mov qword [rsp + 0x26], rdx
mov word [rsp + 0x2e], 0x504
xor eax, eax
jmp 0x558734
movzx r8d, byte [rsp + rbx + 0x1e]
lea edx, [r8 + rdx]
lea edx, [rdx - 0xe]
mov byte [rsp + rsi + 0x1e], dl
mov byte [rsp + rbx + 0x1e], dil
add rax, 2
cmp rax, 0xa
jge 0x558768
movzx edx, byte [rsp + rax + 0x26]
movzx ebx, byte [rsp + rax + 0x27]
mov esi, edx
xor edx, ebx
add edx, eax
cmp rsi, 8
jae 0x5587a5
movzx edi, byte [rsp + rsi + 0x1e]
lea edi, [rdi + rdx]
lea edi, [rdi - 0xe]
nop dword [rax + rax]
cmp rbx, 8
jb 0x55871a
jmp 0x558797
mov qword [rsp + 0x16], 0
xor eax, eax
jmp 0x558781
movzx ecx, byte [rsp + rax + 0x1e]
mov byte [rsp + rax + 0x16], cl
inc rax
cmp rax, 8
jl 0x558775
mov rax, qword [rsp + 0x16]
mov qword [rsp + 0x40], rax
add rsp, 0x30
pop rbp
ret
mov eax, ebx
mov ecx, 8
nop
call fcn.00461020
mov eax, esi
mov ecx, 8
call fcn.00461020
nop
int3
Function at 0x559760
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov qword [rsp + 0x40], 0
movabs rdx, 0x803b49cd7d69552f
mov qword [rsp + 0x1e], rdx
movabs rdx, 0x506010000060600
mov qword [rsp + 0x26], rdx
mov word [rsp + 0x2e], 0x105
xor eax, eax
jmp 0x5597b4
movzx r8d, byte [rsp + rbx + 0x1e]
lea edx, [r8 + rdx]
lea edx, [rdx + 0x49]
mov byte [rsp + rsi + 0x1e], dl
mov byte [rsp + rbx + 0x1e], dil
add rax, 2
cmp rax, 0xa
jge 0x5597e8
movzx edx, byte [rsp + rax + 0x26]
movzx ebx, byte [rsp + rax + 0x27]
mov esi, edx
xor edx, ebx
add edx, eax
cmp rsi, 8
jae 0x559825
movzx edi, byte [rsp + rsi + 0x1e]
lea edi, [rdi + rdx]
lea edi, [rdi + 0x49]
nop dword [rax + rax]
cmp rbx, 8
jb 0x55979a
jmp 0x559817
mov qword [rsp + 0x16], 0
xor eax, eax
jmp 0x559801
movzx ecx, byte [rsp + rax + 0x1e]
mov byte [rsp + rax + 0x16], cl
inc rax
cmp rax, 8
jl 0x5597f5
mov rax, qword [rsp + 0x16]
mov qword [rsp + 0x40], rax
add rsp, 0x30
pop rbp
ret
mov eax, ebx
mov ecx, 8
nop
call fcn.00461020
mov eax, esi
mov ecx, 8
call fcn.00461020
nop
int3

Function at 0x559840
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x28
mov qword [rsp + 0x38], 0
movabs rdx, 0x238d20a0e6acbbf9
mov qword [rsp + 0x20], rdx
movabs rdx, 0x4000602020004
mov qword [rsp + 0x10], rdx
xor eax, eax
jmp 0x55988f
movzx r8d, byte [rsp + rbx + 0x20]
sub r8d, edx
lea edx, [r8 - 0x24]
mov byte [rsp + rsi + 0x20], dl
lea edx, [rdi - 0x24]
mov byte [rsp + rbx + 0x20], dl
add rax, 2
cmp rax, 8
jge 0x5598ba
movzx edx, byte [rsp + rax + 0x10]
movzx ebx, byte [rsp + rax + 0x11]
mov esi, edx
xor edx, ebx
add edx, eax
cmp rsi, 8
jae 0x5598f5
movzx edi, byte [rsp + rsi + 0x20]
sub edi, edx
cmp rbx, 8
jb 0x559873
jmp 0x5598e9
mov qword [rsp + 0x18], 0
xor eax, eax
jmp 0x5598d3
movzx ecx, byte [rsp + rax + 0x20]
mov byte [rsp + rax + 0x18], cl
inc rax
cmp rax, 8
jl 0x5598c7
mov rax, qword [rsp + 0x18]
mov qword [rsp + 0x38], rax
add rsp, 0x28
pop rbp
ret
mov eax, ebx
mov ecx, 8
call fcn.00461020
mov eax, esi
mov ecx, 8
nop dword [rax]
call fcn.00461020
nop
int3
Function at 0x55ae80
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov qword [rsp + 0x40], 0
movabs rdx, 0x8079f273d352efa8
mov qword [rsp + 0x1c], rdx
movabs rdx, 0x107020202050003
mov qword [rsp + 0x24], rdx
mov dword [rsp + 0x2c], 0x2050104
xor eax, eax
jmp 0x55aed5
movzx r8d, byte [rsp + rbx + 0x1c]
lea edx, [r8 + rdx]
lea edx, [rdx - 0x3b]
mov byte [rsp + rsi + 0x1c], dl
mov byte [rsp + rbx + 0x1c], dil
add rax, 2
cmp rax, 0xc
jge 0x55af08
movzx edx, byte [rsp + rax + 0x24]
movzx ebx, byte [rsp + rax + 0x25]
mov esi, edx
xor edx, ebx
add edx, eax
cmp rsi, 8
jae 0x55af45
movzx edi, byte [rsp + rsi + 0x1c]
lea edi, [rdi + rdx]
lea edi, [rdi - 0x3b]
nop dword [rax]
cmp rbx, 8
jb 0x55aebb
jmp 0x55af37
mov qword [rsp + 0x14], 0
xor eax, eax
jmp 0x55af21
movzx ecx, byte [rsp + rax + 0x1c]
mov byte [rsp + rax + 0x14], cl
inc rax
cmp rax, 8
jl 0x55af15
mov rax, qword [rsp + 0x14]
mov qword [rsp + 0x40], rax
add rsp, 0x30
pop rbp
ret
mov eax, ebx
mov ecx, 8
nop
call fcn.00461020
mov eax, esi
mov ecx, 8
call fcn.00461020
nop
int3

Function at 0x55b5c0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov qword [rsp + 0x40], 0
movabs rdx, 0x26b049df80c8b4e3
mov qword [rsp + 0x1e], rdx
movabs rdx, 0x503000300020201
mov qword [rsp + 0x26], rdx
mov word [rsp + 0x2e], 0x604
xor eax, eax
jmp 0x55b616
movzx r8d, byte [rsp + rbx + 0x1e]
sub r8d, edx
lea edx, [r8 + 0x45]
mov byte [rsp + rsi + 0x1e], dl
lea edx, [rdi + 0x45]
mov byte [rsp + rbx + 0x1e], dl
add rax, 2
cmp rax, 0xa
jge 0x55b642
movzx edx, byte [rsp + rax + 0x26]
movzx ebx, byte [rsp + rax + 0x27]
mov esi, edx
xor edx, ebx
add edx, eax
cmp rsi, 8
jae 0x55b685
movzx edi, byte [rsp + rsi + 0x1e]
sub edi, edx
cmp rbx, 8
jb 0x55b5fa
nop
jmp 0x55b676
mov qword [rsp + 0x16], 0
xor eax, eax
jmp 0x55b660
movzx ecx, byte [rsp + rax + 0x1e]
mov byte [rsp + rax + 0x16], cl
inc rax
nop dword [rax + rax]
cmp rax, 8
jl 0x55b64f
mov rax, qword [rsp + 0x16]
mov qword [rsp + 0x40], rax
add rsp, 0x30
pop rbp
ret
mov eax, ebx
mov ecx, 8
nop dword [rax]
call fcn.00461020
mov eax, esi
mov ecx, 8
call fcn.00461020
nop
int3
Function at 0x55ba20
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov qword [rsp + 0x40], 0
movabs rdx, 0xae59f4ebe02dfee4
mov qword [rsp + 0x1e], rdx
movabs rdx, 0x703040000060401
mov qword [rsp + 0x26], rdx
mov word [rsp + 0x2e], 5
xor eax, eax
jmp 0x55ba76
movzx r8d, byte [rsp + rbx + 0x1e]
sub r8d, edx
lea edx, [r8 - 0x32]
mov byte [rsp + rsi + 0x1e], dl
lea edx, [rdi - 0x32]
mov byte [rsp + rbx + 0x1e], dl
add rax, 2
cmp rax, 0xa
jge 0x55baa2
movzx edx, byte [rsp + rax + 0x26]
movzx ebx, byte [rsp + rax + 0x27]
mov esi, edx
xor edx, ebx
add edx, eax
cmp rsi, 8
jae 0x55bae5
movzx edi, byte [rsp + rsi + 0x1e]
sub edi, edx
cmp rbx, 8
jb 0x55ba5a
nop
jmp 0x55bad6
mov qword [rsp + 0x16], 0
xor eax, eax
jmp 0x55bac0
movzx ecx, byte [rsp + rax + 0x1e]
mov byte [rsp + rax + 0x16], cl
inc rax
nop dword [rax + rax]
cmp rax, 8
jl 0x55baaf
mov rax, qword [rsp + 0x16]
mov qword [rsp + 0x40], rax
add rsp, 0x30
pop rbp
ret
mov eax, ebx
mov ecx, 8
nop dword [rax]
call fcn.00461020
mov eax, esi
mov ecx, 8
call fcn.00461020
nop
int3

Function at 0x55cfe0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov qword [rsp + 0x40], 0
movabs rdx, 0x74817dec90491ca7
mov qword [rsp + 0x1e], rdx
movabs rdx, 0x701030502020407
mov qword [rsp + 0x26], rdx
mov word [rsp + 0x2e], 0x704
xor eax, eax
jmp 0x55d036
movzx r8d, byte [rsp + rbx + 0x1e]
sub r8d, edx
lea edx, [r8 + 7]
mov byte [rsp + rsi + 0x1e], dl
lea edx, [rdi + 7]
mov byte [rsp + rbx + 0x1e], dl
add rax, 2
cmp rax, 0xa
jge 0x55d062
movzx edx, byte [rsp + rax + 0x26]
movzx ebx, byte [rsp + rax + 0x27]
mov esi, edx
xor edx, ebx
add edx, eax
cmp rsi, 8
jae 0x55d0a5
movzx edi, byte [rsp + rsi + 0x1e]
sub edi, edx
cmp rbx, 8
jb 0x55d01a
nop
jmp 0x55d096
mov qword [rsp + 0x16], 0
xor eax, eax
jmp 0x55d080
movzx ecx, byte [rsp + rax + 0x1e]
mov byte [rsp + rax + 0x16], cl
inc rax
nop dword [rax + rax]
cmp rax, 8
jl 0x55d06f
mov rax, qword [rsp + 0x16]
mov qword [rsp + 0x40], rax
add rsp, 0x30
pop rbp
ret
mov eax, ebx
mov ecx, 8
nop dword [rax]
call fcn.00461020
mov eax, esi
mov ecx, 8
call fcn.00461020
nop
int3

Function at 0x55d420
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x28
mov qword [rsp + 0x38], 0
movabs rdx, 0x2dd0137abc1f0d45
mov qword [rsp + 0x20], rdx
movabs rdx, 0x5060502030304
mov qword [rsp + 0x10], rdx
xor eax, eax
jmp 0x55d46d
movzx r8d, byte [rsp + rbx + 0x20]
lea edx, [r8 + rdx]
lea edx, [rdx + 0x6a]
mov byte [rsp + rsi + 0x20], dl
mov byte [rsp + rbx + 0x20], dil
add rax, 2
cmp rax, 8
jge 0x55d49c
movzx edx, byte [rsp + rax + 0x10]
movzx ebx, byte [rsp + rax + 0x11]
mov esi, edx
xor edx, ebx
add edx, eax
cmp rsi, 8
jae 0x55d4d7
movzx edi, byte [rsp + rsi + 0x20]
lea edi, [rdi + rdx]
lea edi, [rdi + 0x6a]
cmp rbx, 8
jb 0x55d453
jmp 0x55d4cb
mov qword [rsp + 0x18], 0
xor eax, eax
jmp 0x55d4b5
movzx ecx, byte [rsp + rax + 0x20]
mov byte [rsp + rax + 0x18], cl
inc rax
cmp rax, 8
jl 0x55d4a9
mov rax, qword [rsp + 0x18]
mov qword [rsp + 0x38], rax
add rsp, 0x28
pop rbp
ret
mov eax, ebx
mov ecx, 8
call fcn.00461020
mov eax, esi
mov ecx, 8
nop
call fcn.00461020
nop
int3
Function at 0x55f1e0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov qword [rsp + 0x40], 0
movabs rdx, 0xed08546cf320469f
mov qword [rsp + 0x1e], rdx
movabs rdx, 0x507070407010001
mov qword [rsp + 0x26], rdx
mov word [rsp + 0x2e], 0x107
xor eax, eax
jmp 0x55f236
movzx r8d, byte [rsp + rbx + 0x1e]
sub r8d, edx
lea edx, [r8 + 0x42]
mov byte [rsp + rsi + 0x1e], dl
lea edx, [rdi + 0x42]
mov byte [rsp + rbx + 0x1e], dl
add rax, 2
cmp rax, 0xa
jge 0x55f262
movzx edx, byte [rsp + rax + 0x26]
movzx ebx, byte [rsp + rax + 0x27]
mov esi, edx
xor edx, ebx
add edx, eax
cmp rsi, 8
jae 0x55f2a5
movzx edi, byte [rsp + rsi + 0x1e]
sub edi, edx
cmp rbx, 8
jb 0x55f21a
nop
jmp 0x55f296
mov qword [rsp + 0x16], 0
xor eax, eax
jmp 0x55f280
movzx ecx, byte [rsp + rax + 0x1e]
mov byte [rsp + rax + 0x16], cl
inc rax
nop dword [rax + rax]
cmp rax, 8
jl 0x55f26f
mov rax, qword [rsp + 0x16]
mov qword [rsp + 0x40], rax
add rsp, 0x30
pop rbp
ret
mov eax, ebx
mov ecx, 8
nop dword [rax]
call fcn.00461020
mov eax, esi
mov ecx, 8
call fcn.00461020
nop
int3

Function at 0x561c60
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x561d38
push rbp
mov rbp, rsp
sub rsp, 0x38
movabs rdx, 0x55656d6793995a44
mov qword [rsp + 0x1a], rdx
mov dword [rsp + 0x22], 0x4adc8182
movabs rdx, 0xb0808010a010208
mov qword [rsp + 0x26], rdx
movabs rdx, 0x6030b0808010a01
mov qword [rsp + 0x28], rdx
movabs rdx, 0x5090b090700060a
mov qword [rsp + 0x30], rdx
xor eax, eax
jmp 0x561cd4
movzx r9d, byte [rsp + rsi + 0x1a]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x25]
mov byte [rsp + rdi + 0x1a], dl
mov byte [rsp + rsi + 0x1a], r8b
add rax, 2
cmp rax, 0x12
jge 0x561d08
movzx edx, byte [rsp + rax + 0x26]
movzx esi, byte [rsp + rax + 0x27]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0xc
jae 0x561d2b
movzx r8d, byte [rsp + rdi + 0x1a]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x25]
nop
cmp rsi, 0xc
jb 0x561cba
jmp 0x561d1f
xor eax, eax
lea rbx, [rsp + 0x1a]
mov ecx, 0xc
call fcn.0044bb20
add rsp, 0x38
pop rbp
ret
mov eax, esi
mov ecx, 0xc
call fcn.00461020
mov eax, edi
mov ecx, 0xc
call fcn.00461020
nop
call fcn.0045eda0
nop dword [rax]
jmp fcn.00561c60