joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5a4100
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x5a4228
sub rsp, 0x60
mov qword [rsp + 0x58], rbp
lea rbp, [rsp + 0x58]
movabs rdx, 0xcc0e9f6e656e6163
mov qword [rsp + 0x18], rdx
movabs rdx, 0x4d64103ac69c0d6e
mov qword [rsp + 0x20], rdx
movabs rdx, 0x9c4e0eff4d64103a
mov qword [rsp + 0x24], rdx
movabs rdx, 0x65671dfb0595153a
mov qword [rsp + 0x2c], rdx
movabs rdx, 0x40f0a0e0e070c19
mov qword [rsp + 0x34], rdx
movabs rdx, 0xb0f170d040f0a0e
mov qword [rsp + 0x38], rdx
movabs rdx, 0x1903130e05031516
mov qword [rsp + 0x40], rdx
movabs rdx, 0x15110f0b0e030409
mov qword [rsp + 0x48], rdx
movabs rdx, 0x506180907100714
mov qword [rsp + 0x50], rdx
xor eax, eax
jmp 0x5a41c0
movzx r9d, byte [rsp + rsi + 0x18]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x41]
mov byte [rsp + rdi + 0x18], dl
mov byte [rsp + rsi + 0x18], r8b
add rax, 2
nop dword [rax]
cmp rax, 0x24
jge 0x5a41f2
movzx edx, byte [rsp + rax + 0x34]
movzx esi, byte [rsp + rax + 0x35]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x1c
jae 0x5a421b
movzx r8d, byte [rsp + rdi + 0x18]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x41]
cmp rsi, 0x1c
jb 0x5a41a3
jmp 0x5a420f
xor eax, eax
lea rbx, [rsp + 0x18]
mov ecx, 0x1c
nop
call fcn.00444d40
mov rbp, qword [rsp + 0x58]
add rsp, 0x60
ret
mov eax, esi
mov ecx, 0x1c
call fcn.00457d20
mov eax, edi
mov ecx, 0x1c
call fcn.00457d20
nop
call fcn.004556c0
jmp fcn.005a4100

Function at 0x5a4c80
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x5a4d4b
sub rsp, 0x38
mov qword [rsp + 0x30], rbp
lea rbp, [rsp + 0x30]
movabs rdx, 0x3e41693d49e52c4e
mov qword [rsp + 0x1b], rdx
mov byte [rsp + 0x23], 0x24
movabs rdx, 0x301000604070800
mov qword [rsp + 0x24], rdx
mov dword [rsp + 0x2c], 0x2030202
xor eax, eax
jmp 0x5a4ce4
movzx r9d, byte [rsp + rsi + 0x1b]
sub r9d, edx
lea edx, [r9 + 0x2d]
mov byte [rsp + rdi + 0x1b], dl
lea edx, [r8 + 0x2d]
mov byte [rsp + rsi + 0x1b], dl
add rax, 2
cmp rax, 0xc
jge 0x5a4d17
movzx edx, byte [rsp + rax + 0x24]
movzx esi, byte [rsp + rax + 0x25]
mov edi, edx
xor edx, esi
add edx, eax
nop word [rax + rax]
cmp rdi, 9
jae 0x5a4d3e
movzx r8d, byte [rsp + rdi + 0x1b]
sub r8d, edx
cmp rsi, 9
jb 0x5a4cc7
jmp 0x5a4d32
xor eax, eax
lea rbx, [rsp + 0x1b]
mov ecx, 9
call fcn.00444d40
mov rbp, qword [rsp + 0x30]
add rsp, 0x38
ret
mov eax, esi
mov ecx, 9
call fcn.00457d20
mov eax, edi
mov ecx, 9
call fcn.00457d20
nop
call fcn.004556c0
jmp fcn.005a4c80
Function at 0x5a57e0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x5a5912
sub rsp, 0x68
mov qword [rsp + 0x60], rbp
lea rbp, [rsp + 0x60]
movabs rdx, 0x2d9d69ba52eb6e69
mov qword [rsp + 0x18], rdx
movabs rdx, 0x1c1cc7f2c2c3d4b4
mov qword [rsp + 0x20], rdx
movabs rdx, 0xd372433a8a821c1c
mov qword [rsp + 0x26], rdx
movabs rdx, 0xe90c61393ac80a61
mov qword [rsp + 0x2e], rdx
movabs rdx, 0xf061903020c1717
mov qword [rsp + 0x36], rdx
movabs rdx, 0x171a06071803121d
mov qword [rsp + 0x3e], rdx
movabs rdx, 0x191c171a06071803
mov qword [rsp + 0x40], rdx
movabs rdx, 0xa10170e1310150b
mov qword [rsp + 0x48], rdx
movabs rdx, 0x11111d1308171119
mov qword [rsp + 0x50], rdx
movabs rdx, 0x61d090d0411041a
mov qword [rsp + 0x58], rdx
xor eax, eax
jmp 0x5a58ac
movzx r9d, byte [rsp + rsi + 0x18]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x74]
mov byte [rsp + rdi + 0x18], dl
mov byte [rsp + rsi + 0x18], r8b
add rax, 2
cmp rax, 0x2a
jge 0x5a58de
movzx edx, byte [rsp + rax + 0x36]
movzx esi, byte [rsp + rax + 0x37]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x1e
jae 0x5a5905
movzx r8d, byte [rsp + rdi + 0x18]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x74]
cmp rsi, 0x1e
jb 0x5a5892
jmp 0x5a58f9
xor eax, eax
lea rbx, [rsp + 0x18]
mov ecx, 0x1e
call fcn.00444d40
mov rbp, qword [rsp + 0x60]
add rsp, 0x68
ret
mov eax, esi
mov ecx, 0x1e
call fcn.00457d20
mov eax, edi
mov ecx, 0x1e
call fcn.00457d20
nop
call fcn.004556c0
jmp fcn.005a57e0

Function at 0x5a5cc0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x5a5d88
sub rsp, 0x38
mov qword [rsp + 0x30], rbp
lea rbp, [rsp + 0x30]
movabs rdx, 0x6761776c5f7e7266
mov qword [rsp + 0x1d], rdx
mov byte [rsp + 0x25], 0x79
movabs rdx, 0x208040304030003
mov qword [rsp + 0x26], rdx
mov word [rsp + 0x2e], 0x507
xor eax, eax
jmp 0x5a5d23
movzx r9d, byte [rsp + rsi + 0x1d]
sub r9d, edx
lea edx, [r9 + 6]
mov byte [rsp + rdi + 0x1d], dl
lea edx, [r8 + 6]
mov byte [rsp + rsi + 0x1d], dl
add rax, 2
cmp rax, 0xa
jge 0x5a5d50
movzx edx, byte [rsp + rax + 0x26]
movzx esi, byte [rsp + rax + 0x27]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 9
jae 0x5a5d7b
movzx r8d, byte [rsp + rdi + 0x1d]
sub r8d, edx
cmp rsi, 9
jb 0x5a5d06
jmp 0x5a5d6f
xor eax, eax
lea rbx, [rsp + 0x1d]
mov ecx, 9
nop dword [rax]
call fcn.00444d40
mov rbp, qword [rsp + 0x30]
add rsp, 0x38
ret
mov eax, esi
mov ecx, 9
call fcn.00457d20
mov eax, edi
mov ecx, 9
call fcn.00457d20
nop
call fcn.004556c0
jmp fcn.005a5cc0
Function at 0x5a5fe0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x5a60b2
sub rsp, 0x28
mov qword [rsp + 0x20], rbp
lea rbp, [rsp + 0x20]
lea rax, [0x00681420]
nop
call fcn.0040bea0
movabs rcx, 0xba2657b4b0b5
mov qword [rax], rcx
mov dword [rax + 8], 0xad75be10
movabs rcx, 0xb0a040b080b03
mov qword [rsp + 0x10], rcx
movabs rcx, 0x205090401000a02
mov qword [rsp + 0x18], rcx
xor ecx, ecx
jmp 0x5a6055
movzx r9d, byte [rsi + rax]
sub r9d, edx
lea edx, [r9 + 0x5b]
mov byte [rax + rdi], dl
lea edx, [r8 + 0x5b]
mov byte [rax + rsi], dl
add rcx, 2
cmp rcx, 0x10
jge 0x5a6082
movzx edx, byte [rsp + rcx + 0x10]
movzx esi, byte [rsp + rcx + 0x11]
mov edi, edx
xor edx, esi
add edx, ecx
cmp rdi, 0xc
jae 0x5a60a5
movzx r8d, byte [rdi + rax]
sub r8d, edx
cmp rsi, 0xc
jb 0x5a603b
nop
jmp 0x5a6094
mov ebx, 0xc
mov rcx, rbx
mov rbp, qword [rsp + 0x20]
add rsp, 0x28
ret
mov eax, esi
mov ecx, 0xc
nop dword [rax + rax]
call fcn.00457d20
mov eax, edi
mov ecx, 0xc
call fcn.00457d20
nop
call fcn.004556c0
jmp fcn.005a5fe0

Function at 0x5ab580
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x5ab65c
sub rsp, 0x40
mov qword [rsp + 0x38], rbp
lea rbp, [rsp + 0x38]
movabs rdx, 0xbe3036656b35b3c3
mov qword [rsp + 0x1f], rdx
movabs rdx, 0x432c3dbe3036656b
mov qword [rsp + 0x22], rdx
movabs rdx, 0x809050208070700
mov qword [rsp + 0x2a], rdx
movabs rdx, 0x60a0100010809
mov qword [rsp + 0x30], rdx
xor eax, eax
jmp 0x5ab5f5
movzx r9d, byte [rsp + rsi + 0x1f]
sub r9d, edx
lea edx, [r9 + 0x44]
mov byte [rsp + rdi + 0x1f], dl
lea edx, [r8 + 0x44]
mov byte [rsp + rsi + 0x1f], dl
add rax, 2
cmp rax, 0xe
jge 0x5ab628
movzx edx, byte [rsp + rax + 0x2a]
movzx esi, byte [rsp + rax + 0x2b]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0xb
jae 0x5ab64f
movzx r8d, byte [rsp + rdi + 0x1f]
sub r8d, edx
nop word [rax + rax]
cmp rsi, 0xb
jb 0x5ab5d8
jmp 0x5ab643
xor eax, eax
lea rbx, [rsp + 0x1f]
mov ecx, 0xb
call fcn.00444d40
mov rbp, qword [rsp + 0x38]
add rsp, 0x40
ret
mov eax, esi
mov ecx, 0xb
call fcn.00457d20
mov eax, edi
mov ecx, 0xb
call fcn.00457d20
nop
nop dword [rax]
call fcn.004556c0
jmp fcn.005ab580
Function at 0x5abba0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x5abca8
sub rsp, 0x58
mov qword [rsp + 0x50], rbp
lea rbp, [rsp + 0x50]
movabs rdx, 0x5e31c465c96bbde7
mov qword [rsp + 0x1d], rdx
movabs rdx, 0xdfd5bfbc572e345e
mov qword [rsp + 0x24], rdx
movabs rdx, 0xdab8c9a7c7ba5c69
mov qword [rsp + 0x2c], rdx
movabs rdx, 0xa1003140f020000
mov qword [rsp + 0x34], rdx
movabs rdx, 0xd040c1016130e0e
mov qword [rsp + 0x3c], rdx
movabs rdx, 0x12020b110d040c10
mov qword [rsp + 0x40], rdx
movabs rdx, 0xd0a15010f050d07
mov qword [rsp + 0x48], rdx
xor eax, eax
jmp 0x5abc40
movzx r9d, byte [rsp + rsi + 0x1d]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x4a]
mov byte [rsp + rdi + 0x1d], dl
mov byte [rsp + rsi + 0x1d], r8b
add rax, 2
nop
cmp rax, 0x1c
jge 0x5abc72
movzx edx, byte [rsp + rax + 0x34]
movzx esi, byte [rsp + rax + 0x35]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x17
jae 0x5abc9b
movzx r8d, byte [rsp + rdi + 0x1d]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x4a]
cmp rsi, 0x17
jb 0x5abc25
jmp 0x5abc8f
xor eax, eax
lea rbx, [rsp + 0x1d]
mov ecx, 0x17
nop
call fcn.00444d40
mov rbp, qword [rsp + 0x50]
add rsp, 0x58
ret
mov eax, esi
mov ecx, 0x17
call fcn.00457d20
mov eax, edi
mov ecx, 0x17
call fcn.00457d20
nop
call fcn.004556c0
jmp fcn.005abba0

Function at 0x5abfc0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
sub rsp, 0x30
mov qword [rsp + 0x28], rbp
lea rbp, [rsp + 0x28]
mov qword [rsp + 0x38], 0
movabs rdx, 0xee95da4f0b00858c
mov qword [rsp + 0x20], rdx
movabs rdx, 0x301040305010503
mov qword [rsp + 0x10], rdx
xor eax, eax
jmp 0x5ac015
movzx r8d, byte [rsp + rbx + 0x20]
sub r8d, edx
lea edx, [r8 + 0x43]
mov byte [rsp + rsi + 0x20], dl
lea edx, [rdi + 0x43]
mov byte [rsp + rbx + 0x20], dl
add rax, 2
cmp rax, 8
jge 0x5ac042
movzx edx, byte [rsp + rax + 0x10]
movzx ebx, byte [rsp + rax + 0x11]
mov esi, edx
xor edx, ebx
add edx, eax
cmp rsi, 8
jae 0x5ac086
movzx edi, byte [rsp + rsi + 0x20]
sub edi, edx
cmp rbx, 8
jb 0x5abff9
nop
jmp 0x5ac07a
mov qword [rsp + 0x18], 0
xor eax, eax
jmp 0x5ac060
movzx ecx, byte [rsp + rax + 0x20]
mov byte [rsp + rax + 0x18], cl
inc rax
nop dword [rax + rax]
cmp rax, 8
jl 0x5ac04f
mov rax, qword [rsp + 0x18]
mov qword [rsp + 0x38], rax
mov rbp, qword [rsp + 0x28]
add rsp, 0x30
ret
mov eax, ebx
mov ecx, 8
call fcn.00457d20
mov eax, esi
mov ecx, 8
call fcn.00457d20
nop
int3
Function at 0x5ac740
Capabilities:
Encrypt data using rc4 prga

Disassembly:
sub rsp, 0x38
mov qword [rsp + 0x30], rbp
lea rbp, [rsp + 0x30]
mov qword [rsp + 0x40], 0
movabs rdx, 0x53ae9f1e4c877ffb
mov qword [rsp + 0x1e], rdx
movabs rdx, 0x502000200060003
mov qword [rsp + 0x26], rdx
mov word [rsp + 0x2e], 0x501
xor eax, eax
nop
jmp 0x5ac7a0
movzx r8d, byte [rsp + rbx + 0x1e]
sub r8d, edx
lea edx, [r8 + 0x2d]
mov byte [rsp + rsi + 0x1e], dl
lea edx, [rdi + 0x2d]
mov byte [rsp + rbx + 0x1e], dl
add rax, 2
nop
cmp rax, 0xa
jge 0x5ac7cb
movzx edx, byte [rsp + rax + 0x26]
movzx ebx, byte [rsp + rax + 0x27]
mov esi, edx
xor edx, ebx
add edx, eax
cmp rsi, 8
jae 0x5ac80a
movzx edi, byte [rsp + rsi + 0x1e]
sub edi, edx
cmp rbx, 8
jb 0x5ac782
jmp 0x5ac7fe
mov qword [rsp + 0x16], 0
xor eax, eax
jmp 0x5ac7e4
movzx ecx, byte [rsp + rax + 0x1e]
mov byte [rsp + rax + 0x16], cl
inc rax
cmp rax, 8
jl 0x5ac7d8
mov rax, qword [rsp + 0x16]
mov qword [rsp + 0x40], rax
mov rbp, qword [rsp + 0x30]
add rsp, 0x38
ret
mov eax, ebx
mov ecx, 8
call fcn.00457d20
mov eax, esi
mov ecx, 8
call fcn.00457d20
nop
int3

Function at 0x5adc80
Capabilities:
Encrypt data using rc4 prga

Disassembly:
sub rsp, 0x38
mov qword [rsp + 0x30], rbp
lea rbp, [rsp + 0x30]
mov qword [rsp + 0x40], 0
movabs rdx, 0xffdeb8080b369f88
mov qword [rsp + 0x1e], rdx
movabs rdx, 0x401030207070402
mov qword [rsp + 0x26], rdx
mov word [rsp + 0x2e], 0x302
xor eax, eax
nop
jmp 0x5adce0
movzx r8d, byte [rsp + rbx + 0x1e]
lea edx, [r8 + rdx]
lea edx, [rdx - 0x24]
mov byte [rsp + rsi + 0x1e], dl
mov byte [rsp + rbx + 0x1e], dil
add rax, 2
nop dword [rax]
cmp rax, 0xa
jge 0x5add0f
movzx edx, byte [rsp + rax + 0x26]
movzx ebx, byte [rsp + rax + 0x27]
mov esi, edx
xor edx, ebx
add edx, eax
cmp rsi, 8
jae 0x5add4e
movzx edi, byte [rsp + rsi + 0x1e]
lea edi, [rdi + rdx]
lea edi, [rdi - 0x24]
cmp rbx, 8
jb 0x5adcc2
jmp 0x5add42
mov qword [rsp + 0x16], 0
xor eax, eax
jmp 0x5add28
movzx ecx, byte [rsp + rax + 0x1e]
mov byte [rsp + rax + 0x16], cl
inc rax
cmp rax, 8
jl 0x5add1c
mov rax, qword [rsp + 0x16]
mov qword [rsp + 0x40], rax
mov rbp, qword [rsp + 0x30]
add rsp, 0x38
ret
mov eax, ebx
mov ecx, 8
call fcn.00457d20
mov eax, esi
mov ecx, 8
call fcn.00457d20
nop
int3
Function at 0x5ae000
Capabilities:
Encrypt data using rc4 prga

Disassembly:
sub rsp, 0x38
mov qword [rsp + 0x30], rbp
lea rbp, [rsp + 0x30]
mov qword [rsp + 0x40], 0
movabs rdx, 0x88ce619ae9aa29de
mov qword [rsp + 0x1e], rdx
movabs rdx, 0x607050000070207
mov qword [rsp + 0x26], rdx
mov word [rsp + 0x2e], 7
xor eax, eax
nop
jmp 0x5ae060
movzx r8d, byte [rsp + rbx + 0x1e]
sub r8d, edx
lea edx, [r8 - 4]
mov byte [rsp + rsi + 0x1e], dl
lea edx, [rdi - 4]
mov byte [rsp + rbx + 0x1e], dl
add rax, 2
nop
cmp rax, 0xa
jge 0x5ae08b
movzx edx, byte [rsp + rax + 0x26]
movzx ebx, byte [rsp + rax + 0x27]
mov esi, edx
xor edx, ebx
add edx, eax
cmp rsi, 8
jae 0x5ae0ca
movzx edi, byte [rsp + rsi + 0x1e]
sub edi, edx
cmp rbx, 8
jb 0x5ae042
jmp 0x5ae0be
mov qword [rsp + 0x16], 0
xor eax, eax
jmp 0x5ae0a4
movzx ecx, byte [rsp + rax + 0x1e]
mov byte [rsp + rax + 0x16], cl
inc rax
cmp rax, 8
jl 0x5ae098
mov rax, qword [rsp + 0x16]
mov qword [rsp + 0x40], rax
mov rbp, qword [rsp + 0x30]
add rsp, 0x38
ret
mov eax, ebx
mov ecx, 8
call fcn.00457d20
mov eax, esi
mov ecx, 8
call fcn.00457d20
nop
int3

Function at 0x5ae8c0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
sub rsp, 0x38
mov qword [rsp + 0x30], rbp
lea rbp, [rsp + 0x30]
mov qword [rsp + 0x40], 0
movabs rdx, 0xe278dc575d9e235c
mov qword [rsp + 0x1c], rdx
movabs rdx, 0x2010602070403
mov qword [rsp + 0x24], rdx
mov dword [rsp + 0x2c], 0x3010402
xor eax, eax
nop
jmp 0x5ae920
movzx r8d, byte [rsp + rbx + 0x1c]
lea edx, [r8 + rdx]
lea edx, [rdx - 0x31]
mov byte [rsp + rsi + 0x1c], dl
mov byte [rsp + rbx + 0x1c], dil
add rax, 2
nop dword [rax]
cmp rax, 0xc
jge 0x5ae94f
movzx edx, byte [rsp + rax + 0x24]
movzx ebx, byte [rsp + rax + 0x25]
mov esi, edx
xor edx, ebx
add edx, eax
cmp rsi, 8
jae 0x5ae98e
movzx edi, byte [rsp + rsi + 0x1c]
lea edi, [rdi + rdx]
lea edi, [rdi - 0x31]
cmp rbx, 8
jb 0x5ae902
jmp 0x5ae982
mov qword [rsp + 0x14], 0
xor eax, eax
jmp 0x5ae968
movzx ecx, byte [rsp + rax + 0x1c]
mov byte [rsp + rax + 0x14], cl
inc rax
cmp rax, 8
jl 0x5ae95c
mov rax, qword [rsp + 0x14]
mov qword [rsp + 0x40], rax
mov rbp, qword [rsp + 0x30]
add rsp, 0x38
ret
mov eax, ebx
mov ecx, 8
call fcn.00457d20
mov eax, esi
mov ecx, 8
call fcn.00457d20
nop
int3
Function at 0x5aec40
Capabilities:
Encrypt data using rc4 prga

Disassembly:
sub rsp, 0x30
mov qword [rsp + 0x28], rbp
lea rbp, [rsp + 0x28]
mov qword [rsp + 0x38], 0
movabs rdx, 0xdf338a5935bcbffd
mov qword [rsp + 0x20], rdx
movabs rdx, 0x701020305000107
mov qword [rsp + 0x10], rdx
xor eax, eax
jmp 0x5aec93
movzx r8d, byte [rsp + rbx + 0x20]
lea edx, [r8 + rdx]
lea edx, [rdx - 0xa]
mov byte [rsp + rsi + 0x20], dl
mov byte [rsp + rbx + 0x20], dil
add rax, 2
cmp rax, 8
jge 0x5aecc8
movzx edx, byte [rsp + rax + 0x10]
movzx ebx, byte [rsp + rax + 0x11]
mov esi, edx
xor edx, ebx
add edx, eax
cmp rsi, 8
jae 0x5aed07
movzx edi, byte [rsp + rsi + 0x20]
lea edi, [rdi + rdx]
lea edi, [rdi - 0xa]
nop word [rax + rax]
cmp rbx, 8
jb 0x5aec79
jmp 0x5aecfb
mov qword [rsp + 0x18], 0
xor eax, eax
jmp 0x5aece1
movzx ecx, byte [rsp + rax + 0x20]
mov byte [rsp + rax + 0x18], cl
inc rax
cmp rax, 8
jl 0x5aecd5
mov rax, qword [rsp + 0x18]
mov qword [rsp + 0x38], rax
mov rbp, qword [rsp + 0x28]
add rsp, 0x30
ret
mov eax, ebx
mov ecx, 8
call fcn.00457d20
mov eax, esi
mov ecx, 8
call fcn.00457d20
nop
int3

Function at 0x5af3a0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
sub rsp, 0x30
mov qword [rsp + 0x28], rbp
lea rbp, [rsp + 0x28]
mov qword [rsp + 0x38], 0
movabs rax, 0xa6f7448469d145d3
mov qword [rsp + 0x18], rax
movabs rax, 0xa35f6a270c24eff4
mov qword [rsp + 0x20], rax
mov qword [rsp + 0xf], 0
mov qword [rsp + 0x10], 0
movzx eax, byte [rsp + 0x24]
movzx ecx, byte [rsp + 0x26]
add eax, ecx
movzx ecx, byte [rsp + 0x1c]
movzx edx, byte [rsp + 0x20]
movzx ebx, byte [rsp + 0x25]
movzx esi, byte [rsp + 0x18]
movzx edi, byte [rsp + 0x23]
movzx r8d, byte [rsp + 0x27]
movzx r9d, byte [rsp + 0x1f]
movzx r10d, byte [rsp + 0x22]
movzx r11d, byte [rsp + 0x21]
movzx r12d, byte [rsp + 0x1e]
movzx r13d, byte [rsp + 0x1d]
mov byte [rsp + 6], r13b
movzx r15d, byte [rsp + 0x19]
movzx r13d, byte [rsp + 0x1b]
mov byte [rsp + 5], r13b
movzx r13d, byte [rsp + 0x1a]
mov byte [rsp + 0xf], al
sub ecx, edx
mov byte [rsp + 0x10], cl
lea eax, [rsi + rbx]
mov byte [rsp + 0x11], al
lea eax, [r8 + rdi]
mov byte [rsp + 0x12], al
lea eax, [r10 + r9]
mov byte [rsp + 0x13], al
lea eax, [r12 + r11]
mov byte [rsp + 0x14], al
movzx eax, byte [rsp + 6]
sub eax, r15d
mov byte [rsp + 0x15], al
movzx eax, byte [rsp + 5]
xor eax, r13d
mov byte [rsp + 0x16], al
mov qword [rsp + 7], 0
xor eax, eax
jmp 0x5af4a6
movzx ecx, byte [rsp + rax + 0xf]
mov byte [rsp + rax + 7], cl
inc rax
cmp rax, 8
jl 0x5af49a
mov rax, qword [rsp + 7]
mov qword [rsp + 0x38], rax
mov rbp, qword [rsp + 0x28]
add rsp, 0x30
nop
ret
Function at 0x5af840
Capabilities:
Encrypt data using rc4 prga

Disassembly:
sub rsp, 0x30
mov qword [rsp + 0x28], rbp
lea rbp, [rsp + 0x28]
mov qword [rsp + 0x38], 0
movabs rax, 0xbb25eca0000f7fdc
mov qword [rsp + 0x18], rax
movabs rax, 0xf42cbe6542d86202
mov qword [rsp + 0x20], rax
mov qword [rsp + 0xf], 0
mov qword [rsp + 0x10], 0
movzx eax, byte [rsp + 0x20]
movzx ecx, byte [rsp + 0x19]
add eax, ecx
movzx ecx, byte [rsp + 0x1c]
movzx edx, byte [rsp + 0x23]
movzx ebx, byte [rsp + 0x22]
movzx esi, byte [rsp + 0x18]
movzx edi, byte [rsp + 0x25]
movzx r8d, byte [rsp + 0x1f]
movzx r9d, byte [rsp + 0x24]
movzx r10d, byte [rsp + 0x1b]
movzx r11d, byte [rsp + 0x27]
movzx r12d, byte [rsp + 0x1d]
movzx r13d, byte [rsp + 0x21]
mov byte [rsp + 6], r13b
movzx r15d, byte [rsp + 0x26]
movzx r13d, byte [rsp + 0x1a]
mov byte [rsp + 5], r13b
movzx r13d, byte [rsp + 0x1e]
mov byte [rsp + 0xf], al
xor ecx, edx
mov byte [rsp + 0x10], cl
sub ebx, esi
mov byte [rsp + 0x11], bl
lea eax, [r8 + rdi]
mov byte [rsp + 0x12], al
lea eax, [r10 + r9]
mov byte [rsp + 0x13], al
sub r11d, r12d
mov byte [rsp + 0x14], r11b
movzx eax, byte [rsp + 6]
sub eax, r15d
mov byte [rsp + 0x15], al
movzx eax, byte [rsp + 5]
add eax, r13d
mov byte [rsp + 0x16], al
mov qword [rsp + 7], 0
xor eax, eax
jmp 0x5af945
movzx ecx, byte [rsp + rax + 0xf]
mov byte [rsp + rax + 7], cl
inc rax
cmp rax, 8
jl 0x5af939
mov rax, qword [rsp + 7]
mov qword [rsp + 0x38], rax
mov rbp, qword [rsp + 0x28]
add rsp, 0x30
ret

Function at 0x5afc00
Capabilities:
Encrypt data using rc4 prga

Disassembly:
sub rsp, 0x38
mov qword [rsp + 0x30], rbp
lea rbp, [rsp + 0x30]
mov qword [rsp + 0x40], 0
movabs rdx, 0xb1701541277b55f0
mov qword [rsp + 0x1e], rdx
movabs rdx, 0x700000707040003
mov qword [rsp + 0x26], rdx
mov word [rsp + 0x2e], 0x307
xor eax, eax
nop
jmp 0x5afc60
movzx r8d, byte [rsp + rbx + 0x1e]
lea edx, [r8 + rdx]
lea edx, [rdx - 0x37]
mov byte [rsp + rsi + 0x1e], dl
mov byte [rsp + rbx + 0x1e], dil
add rax, 2
nop dword [rax]
cmp rax, 0xa
jge 0x5afc8f
movzx edx, byte [rsp + rax + 0x26]
movzx ebx, byte [rsp + rax + 0x27]
mov esi, edx
xor edx, ebx
add edx, eax
cmp rsi, 8
jae 0x5afcce
movzx edi, byte [rsp + rsi + 0x1e]
lea edi, [rdi + rdx]
lea edi, [rdi - 0x37]
cmp rbx, 8
jb 0x5afc42
jmp 0x5afcc2
mov qword [rsp + 0x16], 0
xor eax, eax
jmp 0x5afca8
movzx ecx, byte [rsp + rax + 0x1e]
mov byte [rsp + rax + 0x16], cl
inc rax
cmp rax, 8
jl 0x5afc9c
mov rax, qword [rsp + 0x16]
mov qword [rsp + 0x40], rax
mov rbp, qword [rsp + 0x30]
add rsp, 0x38
ret
mov eax, ebx
mov ecx, 8
call fcn.00457d20
mov eax, esi
mov ecx, 8
call fcn.00457d20
nop
int3
Function at 0x5b0940
Capabilities:
Encrypt data using rc4 prga

Disassembly:
sub rsp, 0x38
mov qword [rsp + 0x30], rbp
lea rbp, [rsp + 0x30]
mov qword [rsp + 0x40], 0
movabs rdx, 0x73719f0622899763
mov qword [rsp + 0x1e], rdx
movabs rdx, 0x404000405030100
mov qword [rsp + 0x26], rdx
mov word [rsp + 0x2e], 0x204
xor eax, eax
nop
jmp 0x5b09a0
movzx r8d, byte [rsp + rbx + 0x1e]
sub r8d, edx
lea edx, [r8 - 0x64]
mov byte [rsp + rsi + 0x1e], dl
lea edx, [rdi - 0x64]
mov byte [rsp + rbx + 0x1e], dl
add rax, 2
nop
cmp rax, 0xa
jge 0x5b09cb
movzx edx, byte [rsp + rax + 0x26]
movzx ebx, byte [rsp + rax + 0x27]
mov esi, edx
xor edx, ebx
add edx, eax
cmp rsi, 8
jae 0x5b0a0a
movzx edi, byte [rsp + rsi + 0x1e]
sub edi, edx
cmp rbx, 8
jb 0x5b0982
jmp 0x5b09fe
mov qword [rsp + 0x16], 0
xor eax, eax
jmp 0x5b09e4
movzx ecx, byte [rsp + rax + 0x1e]
mov byte [rsp + rax + 0x16], cl
inc rax
cmp rax, 8
jl 0x5b09d8
mov rax, qword [rsp + 0x16]
mov qword [rsp + 0x40], rax
mov rbp, qword [rsp + 0x30]
add rsp, 0x38
ret
mov eax, ebx
mov ecx, 8
call fcn.00457d20
mov eax, esi
mov ecx, 8
call fcn.00457d20
nop
int3

Function at 0x5b0da0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
sub rsp, 0x38
mov qword [rsp + 0x30], rbp
lea rbp, [rsp + 0x30]
mov qword [rsp + 0x40], 0
movabs rdx, 0x7aefb9053f78cfc5
mov qword [rsp + 0x1e], rdx
movabs rdx, 0x1010702030602
mov qword [rsp + 0x26], rdx
mov word [rsp + 0x2e], 0x407
xor eax, eax
nop
jmp 0x5b0e00
movzx r8d, byte [rsp + rbx + 0x1e]
lea edx, [r8 + rdx]
lea edx, [rdx + 0x7e]
mov byte [rsp + rsi + 0x1e], dl
mov byte [rsp + rbx + 0x1e], dil
add rax, 2
nop dword [rax]
cmp rax, 0xa
jge 0x5b0e2f
movzx edx, byte [rsp + rax + 0x26]
movzx ebx, byte [rsp + rax + 0x27]
mov esi, edx
xor edx, ebx
add edx, eax
cmp rsi, 8
jae 0x5b0e6e
movzx edi, byte [rsp + rsi + 0x1e]
lea edi, [rdi + rdx]
lea edi, [rdi + 0x7e]
cmp rbx, 8
jb 0x5b0de2
jmp 0x5b0e62
mov qword [rsp + 0x16], 0
xor eax, eax
jmp 0x5b0e48
movzx ecx, byte [rsp + rax + 0x1e]
mov byte [rsp + rax + 0x16], cl
inc rax
cmp rax, 8
jl 0x5b0e3c
mov rax, qword [rsp + 0x16]
mov qword [rsp + 0x40], rax
mov rbp, qword [rsp + 0x30]
add rsp, 0x38
ret
mov eax, ebx
mov ecx, 8
call fcn.00457d20
mov eax, esi
mov ecx, 8
call fcn.00457d20
nop
int3
Function at 0x5b1120
Capabilities:
Encrypt data using rc4 prga

Disassembly:
sub rsp, 0x30
mov qword [rsp + 0x28], rbp
lea rbp, [rsp + 0x28]
mov qword [rsp + 0x38], 0
movabs rax, 0xd48ea37292d5db6a
mov qword [rsp + 0x18], rax
movabs rax, 0xcf902c79f0f9d55e
mov qword [rsp + 0x20], rax
mov qword [rsp + 0xf], 0
mov qword [rsp + 0x10], 0
movzx eax, byte [rsp + 0x25]
movzx ecx, byte [rsp + 0x1d]
sub eax, ecx
movzx ecx, byte [rsp + 0x22]
movzx edx, byte [rsp + 0x20]
movzx ebx, byte [rsp + 0x1f]
movzx esi, byte [rsp + 0x27]
movzx edi, byte [rsp + 0x23]
movzx r8d, byte [rsp + 0x24]
movzx r9d, byte [rsp + 0x18]
movzx r10d, byte [rsp + 0x1a]
movzx r11d, byte [rsp + 0x26]
movzx r12d, byte [rsp + 0x1c]
movzx r13d, byte [rsp + 0x1e]
mov byte [rsp + 6], r13b
movzx r15d, byte [rsp + 0x1b]
movzx r13d, byte [rsp + 0x19]
mov byte [rsp + 5], r13b
movzx r13d, byte [rsp + 0x21]
mov byte [rsp + 0xf], al
lea eax, [rdx + rcx]
mov byte [rsp + 0x10], al
lea eax, [rsi + rbx]
mov byte [rsp + 0x11], al
sub edi, r8d
mov byte [rsp + 0x12], dil
lea eax, [r10 + r9]
mov byte [rsp + 0x13], al
lea eax, [r12 + r11]
mov byte [rsp + 0x14], al
movzx eax, byte [rsp + 6]
add eax, r15d
mov byte [rsp + 0x15], al
movzx eax, byte [rsp + 5]
xor eax, r13d
mov byte [rsp + 0x16], al
mov qword [rsp + 7], 0
xor eax, eax
jmp 0x5b1227
movzx ecx, byte [rsp + rax + 0xf]
mov byte [rsp + rax + 7], cl
inc rax
cmp rax, 8
jl 0x5b121b
mov rax, qword [rsp + 7]
mov qword [rsp + 0x38], rax
mov rbp, qword [rsp + 0x28]
add rsp, 0x30
ret

Function at 0x5b1260
Capabilities:
Encrypt data using rc4 prga

Disassembly:
sub rsp, 0x30
mov qword [rsp + 0x28], rbp
lea rbp, [rsp + 0x28]
mov qword [rsp + 0x38], 0
movabs rdx, 0x7d4fea4dac22f6d1
mov qword [rsp + 0x20], rdx
movabs rdx, 0x304040205030000
mov qword [rsp + 0x10], rdx
xor eax, eax
jmp 0x5b12b3
movzx r8d, byte [rsp + rbx + 0x20]
lea edx, [r8 + rdx]
lea edx, [rdx - 0x4a]
mov byte [rsp + rsi + 0x20], dl
mov byte [rsp + rbx + 0x20], dil
add rax, 2
cmp rax, 8
jge 0x5b12e8
movzx edx, byte [rsp + rax + 0x10]
movzx ebx, byte [rsp + rax + 0x11]
mov esi, edx
xor edx, ebx
add edx, eax
cmp rsi, 8
jae 0x5b1327
movzx edi, byte [rsp + rsi + 0x20]
lea edi, [rdi + rdx]
lea edi, [rdi - 0x4a]
nop word [rax + rax]
cmp rbx, 8
jb 0x5b1299
jmp 0x5b131b
mov qword [rsp + 0x18], 0
xor eax, eax
jmp 0x5b1301
movzx ecx, byte [rsp + rax + 0x20]
mov byte [rsp + rax + 0x18], cl
inc rax
cmp rax, 8
jl 0x5b12f5
mov rax, qword [rsp + 0x18]
mov qword [rsp + 0x38], rax
mov rbp, qword [rsp + 0x28]
add rsp, 0x30
ret
mov eax, ebx
mov ecx, 8
call fcn.00457d20
mov eax, esi
mov ecx, 8
call fcn.00457d20
nop
int3