joyce8/EMBER2024-capa huggingface dataset:
Function at 0x56abe0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
sub rsp, 0x30
mov qword [rsp + 0x28], rbp
lea rbp, [rsp + 0x28]
mov qword [rsp + 0x38], 0
movabs rax, 0x6e8bf2816f46461f
mov qword [rsp + 0x18], rax
movabs rax, 0x37f71f4f4c62c4d7
mov qword [rsp + 0x20], rax
mov qword [rsp + 0xf], 0
mov qword [rsp + 0x10], 0
movzx eax, byte [rsp + 0x26]
movzx ecx, byte [rsp + 0x21]
add eax, ecx
movzx ecx, byte [rsp + 0x18]
movzx edx, byte [rsp + 0x1f]
movzx ebx, byte [rsp + 0x27]
movzx esi, byte [rsp + 0x20]
movzx edi, byte [rsp + 0x22]
movzx r8d, byte [rsp + 0x23]
movzx r9d, byte [rsp + 0x1d]
movzx r10d, byte [rsp + 0x1c]
movzx r11d, byte [rsp + 0x19]
movzx r12d, byte [rsp + 0x1b]
movzx r13d, byte [rsp + 0x1e]
mov byte [rsp + 6], r13b
movzx r15d, byte [rsp + 0x25]
movzx r13d, byte [rsp + 0x24]
mov byte [rsp + 5], r13b
movzx r13d, byte [rsp + 0x1a]
mov byte [rsp + 0xf], al
sub ecx, edx
mov byte [rsp + 0x10], cl
lea eax, [rsi + rbx]
mov byte [rsp + 0x11], al
lea eax, [r8 + rdi]
mov byte [rsp + 0x12], al
xor r9d, r10d
mov byte [rsp + 0x13], r9b
sub r11d, r12d
mov byte [rsp + 0x14], r11b
movzx eax, byte [rsp + 6]
sub eax, r15d
mov byte [rsp + 0x15], al
movzx eax, byte [rsp + 5]
add eax, r13d
mov byte [rsp + 0x16], al
mov qword [rsp + 7], 0
xor eax, eax
jmp 0x56ace6
movzx ecx, byte [rsp + rax + 0xf]
mov byte [rsp + rax + 7], cl
inc rax
cmp rax, 8
jl 0x56acda
mov rax, qword [rsp + 7]
mov qword [rsp + 0x38], rax
mov rbp, qword [rsp + 0x28]
add rsp, 0x30
nop
ret

Function at 0x56b500
Capabilities:
Encrypt data using rc4 prga

Disassembly:
sub rsp, 0x38
mov qword [rsp + 0x30], rbp
lea rbp, [rsp + 0x30]
mov qword [rsp + 0x40], 0
movabs rdx, 0xe85dcaa83d6a8e8f
mov qword [rsp + 0x1e], rdx
movabs rdx, 0x403070501050605
mov qword [rsp + 0x26], rdx
mov word [rsp + 0x2e], 7
xor eax, eax
nop
jmp 0x56b560
movzx r8d, byte [rsp + rbx + 0x1e]
lea edx, [r8 + rdx]
lea edx, [rdx - 8]
mov byte [rsp + rsi + 0x1e], dl
mov byte [rsp + rbx + 0x1e], dil
add rax, 2
nop dword [rax]
cmp rax, 0xa
jge 0x56b58f
movzx edx, byte [rsp + rax + 0x26]
movzx ebx, byte [rsp + rax + 0x27]
mov esi, edx
xor edx, ebx
add edx, eax
cmp rsi, 8
jae 0x56b5ce
movzx edi, byte [rsp + rsi + 0x1e]
lea edi, [rdi + rdx]
lea edi, [rdi - 8]
cmp rbx, 8
jb 0x56b542
jmp 0x56b5c2
mov qword [rsp + 0x16], 0
xor eax, eax
jmp 0x56b5a8
movzx ecx, byte [rsp + rax + 0x1e]
mov byte [rsp + rax + 0x16], cl
inc rax
cmp rax, 8
jl 0x56b59c
mov rax, qword [rsp + 0x16]
mov qword [rsp + 0x40], rax
mov rbp, qword [rsp + 0x30]
add rsp, 0x38
ret
mov eax, ebx
mov ecx, 8
call fcn.0045f5c0
mov eax, esi
mov ecx, 8
call fcn.0045f5c0
nop
int3
Function at 0x56ba80
Capabilities:
Encrypt data using rc4 prga

Disassembly:
sub rsp, 0x30
mov qword [rsp + 0x28], rbp
lea rbp, [rsp + 0x28]
mov qword [rsp + 0x38], 0
movabs rax, 0x6bfe0c7a40d86572
mov qword [rsp + 0x18], rax
movabs rax, 0x576ed13e153ba07e
mov qword [rsp + 0x20], rax
mov qword [rsp + 0xf], 0
mov qword [rsp + 0x10], 0
movzx eax, byte [rsp + 0x24]
movzx ecx, byte [rsp + 0x1c]
add eax, ecx
movzx ecx, byte [rsp + 0x1f]
movzx edx, byte [rsp + 0x1a]
movzx ebx, byte [rsp + 0x1b]
movzx esi, byte [rsp + 0x19]
movzx edi, byte [rsp + 0x27]
movzx r8d, byte [rsp + 0x23]
movzx r9d, byte [rsp + 0x1d]
movzx r10d, byte [rsp + 0x21]
movzx r11d, byte [rsp + 0x25]
movzx r12d, byte [rsp + 0x20]
movzx r13d, byte [rsp + 0x1e]
mov byte [rsp + 6], r13b
movzx r15d, byte [rsp + 0x26]
movzx r13d, byte [rsp + 0x22]
mov byte [rsp + 5], r13b
movzx r13d, byte [rsp + 0x18]
mov byte [rsp + 0xf], al
lea eax, [rdx + rcx]
mov byte [rsp + 0x10], al
lea eax, [rsi + rbx]
mov byte [rsp + 0x11], al
sub edi, r8d
mov byte [rsp + 0x12], dil
xor r9d, r10d
mov byte [rsp + 0x13], r9b
sub r11d, r12d
mov byte [rsp + 0x14], r11b
movzx eax, byte [rsp + 6]
add eax, r15d
mov byte [rsp + 0x15], al
movzx eax, byte [rsp + 5]
sub eax, r13d
mov byte [rsp + 0x16], al
mov qword [rsp + 7], 0
xor eax, eax
jmp 0x56bb87
movzx ecx, byte [rsp + rax + 0xf]
mov byte [rsp + rax + 7], cl
inc rax
cmp rax, 8
jl 0x56bb7b
mov rax, qword [rsp + 7]
mov qword [rsp + 0x38], rax
mov rbp, qword [rsp + 0x28]
add rsp, 0x30
ret

Function at 0x56bf20
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x56bff2
sub rsp, 0x40
mov qword [rsp + 0x38], rbp
lea rbp, [rsp + 0x38]
movabs rdx, 0x327e724a745a7c49
mov qword [rsp + 0x1c], rdx
mov dword [rsp + 0x24], 0x76766b2e
movabs rdx, 0x3090b0006010209
mov qword [rsp + 0x28], rdx
movabs rdx, 0x9090a010004060b
mov qword [rsp + 0x30], rdx
xor eax, eax
jmp 0x56bf8e
movzx r9d, byte [rsp + rsi + 0x1c]
sub r9d, edx
lea edx, [r9 + 7]
mov byte [rsp + rdi + 0x1c], dl
lea edx, [r8 + 7]
mov byte [rsp + rsi + 0x1c], dl
add rax, 2
cmp rax, 0x10
jge 0x56bfbb
movzx edx, byte [rsp + rax + 0x28]
movzx esi, byte [rsp + rax + 0x29]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0xc
jae 0x56bfe5
movzx r8d, byte [rsp + rdi + 0x1c]
sub r8d, edx
cmp rsi, 0xc
jb 0x56bf71
jmp 0x56bfd6
xor eax, eax
lea rbx, [rsp + 0x1c]
mov ecx, 0xc
call fcn.0044a200
mov rbp, qword [rsp + 0x38]
add rsp, 0x40
ret
mov eax, esi
mov ecx, 0xc
nop dword [rax]
call fcn.0045f5c0
mov eax, edi
mov ecx, 0xc
call fcn.0045f5c0
nop
call fcn.0045cf60
jmp fcn.0056bf20
Function at 0x56c000
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x56c0e8
sub rsp, 0x40
mov qword [rsp + 0x38], rbp
lea rbp, [rsp + 0x38]
movabs rdx, 0xf0b2a06cd0ee261
mov qword [rsp + 0x1a], rdx
mov dword [rsp + 0x22], 0x127043a
movabs rdx, 0x80906020b070102
mov qword [rsp + 0x26], rdx
movabs rdx, 0x103080906020b07
mov qword [rsp + 0x28], rdx
movabs rdx, 0x50a01040104020b
mov qword [rsp + 0x30], rdx
xor eax, eax
nop
jmp 0x56c080
movzx r9d, byte [rsp + rsi + 0x1a]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x23]
mov byte [rsp + rdi + 0x1a], dl
mov byte [rsp + rsi + 0x1a], r8b
add rax, 2
nop dword [rax]
cmp rax, 0x12
jge 0x56c0b2
movzx edx, byte [rsp + rax + 0x26]
movzx esi, byte [rsp + rax + 0x27]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0xc
jae 0x56c0db
movzx r8d, byte [rsp + rdi + 0x1a]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x23]
cmp rsi, 0xc
jb 0x56c062
jmp 0x56c0cf
xor eax, eax
lea rbx, [rsp + 0x1a]
mov ecx, 0xc
nop
call fcn.0044a200
mov rbp, qword [rsp + 0x38]
add rsp, 0x40
ret
mov eax, esi
mov ecx, 0xc
call fcn.0045f5c0
mov eax, edi
mov ecx, 0xc
call fcn.0045f5c0
nop
call fcn.0045cf60
jmp fcn.0056c000

Function at 0x56c420
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x56c4e8
sub rsp, 0x38
mov qword [rsp + 0x30], rbp
lea rbp, [rsp + 0x30]
movabs rdx, 0x642e676e67716e65
mov qword [rsp + 0x26], rdx
mov word [rsp + 0x2e], 0x735d
movabs rdx, 0x301030902040501
mov qword [rsp + 0x1c], rdx
mov word [rsp + 0x24], 8
xor eax, eax
jmp 0x56c482
movzx r9d, byte [rsp + rsi + 0x26]
lea edx, [r9 + rdx]
lea edx, [rdx - 9]
mov byte [rsp + rdi + 0x26], dl
mov byte [rsp + rsi + 0x26], r8b
add rax, 2
cmp rax, 0xa
jge 0x56c4b4
movzx edx, byte [rsp + rax + 0x1c]
movzx esi, byte [rsp + rax + 0x1d]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0xa
jae 0x56c4db
movzx r8d, byte [rsp + rdi + 0x26]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 9]
cmp rsi, 0xa
jb 0x56c468
jmp 0x56c4cf
xor eax, eax
lea rbx, [rsp + 0x26]
mov ecx, 0xa
call fcn.0044a200
mov rbp, qword [rsp + 0x30]
add rsp, 0x38
ret
mov eax, esi
mov ecx, 0xa
call fcn.0045f5c0
mov eax, edi
mov ecx, 0xa
call fcn.0045f5c0
nop
call fcn.0045cf60
jmp fcn.0056c420
Function at 0x56c6e0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x56c7ab
sub rsp, 0x38
mov qword [rsp + 0x30], rbp
lea rbp, [rsp + 0x30]
movabs rdx, 0x311fc765babec36b
mov qword [rsp + 0x24], rdx
mov dword [rsp + 0x2c], 0x8b6ce792
movabs rdx, 0x70809020b05060b
mov qword [rsp + 0x18], rdx
mov dword [rsp + 0x20], 0x8020103
xor eax, eax
jmp 0x56c747
movzx r9d, byte [rsp + rsi + 0x24]
sub r9d, edx
lea edx, [r9 - 0x4b]
mov byte [rsp + rdi + 0x24], dl
lea edx, [r8 - 0x4b]
mov byte [rsp + rsi + 0x24], dl
add rax, 2
cmp rax, 0xc
jge 0x56c777
movzx edx, byte [rsp + rax + 0x18]
movzx esi, byte [rsp + rax + 0x19]
mov edi, edx
xor edx, esi
add edx, eax
nop dword [rax]
cmp rdi, 0xc
jae 0x56c79e
movzx r8d, byte [rsp + rdi + 0x24]
sub r8d, edx
cmp rsi, 0xc
jb 0x56c72a
jmp 0x56c792
xor eax, eax
lea rbx, [rsp + 0x24]
mov ecx, 0xc
call fcn.0044a200
mov rbp, qword [rsp + 0x30]
add rsp, 0x38
ret
mov eax, esi
mov ecx, 0xc
call fcn.0045f5c0
mov eax, edi
mov ecx, 0xc
call fcn.0045f5c0
nop
call fcn.0045cf60
jmp fcn.0056c6e0

Function at 0x56d9c0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x56da9c
sub rsp, 0x40
mov qword [rsp + 0x38], rbp
lea rbp, [rsp + 0x38]
movabs rdx, 0x5076643dfc4e6e43
mov qword [rsp + 0x1f], rdx
movabs rdx, 0x6c54645076643dfc
mov qword [rsp + 0x22], rdx
movabs rdx, 0x209000909040103
mov qword [rsp + 0x2a], rdx
movabs rdx, 0x709000501090209
mov qword [rsp + 0x30], rdx
xor eax, eax
jmp 0x56da32
movzx r9d, byte [rsp + rsi + 0x1f]
lea edx, [r9 + rdx]
lea edx, [rdx + 2]
mov byte [rsp + rdi + 0x1f], dl
mov byte [rsp + rsi + 0x1f], r8b
add rax, 2
cmp rax, 0xe
jge 0x56da68
movzx edx, byte [rsp + rax + 0x2a]
movzx esi, byte [rsp + rax + 0x2b]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0xb
jae 0x56da8f
movzx r8d, byte [rsp + rdi + 0x1f]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 2]
nop dword [rax]
cmp rsi, 0xb
jb 0x56da18
jmp 0x56da83
xor eax, eax
lea rbx, [rsp + 0x1f]
mov ecx, 0xb
call fcn.0044a200
mov rbp, qword [rsp + 0x38]
add rsp, 0x40
ret
mov eax, esi
mov ecx, 0xb
call fcn.0045f5c0
mov eax, edi
mov ecx, 0xb
call fcn.0045f5c0
nop
nop dword [rax]
call fcn.0045cf60
jmp fcn.0056d9c0
Function at 0x56dec0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x56df88
sub rsp, 0x38
mov qword [rsp + 0x30], rbp
lea rbp, [rsp + 0x30]
movabs rdx, 0x6c6430b1256eae26
mov qword [rsp + 0x1d], rdx
mov byte [rsp + 0x25], 0x6c
movabs rdx, 0x103050501010504
mov qword [rsp + 0x26], rdx
mov word [rsp + 0x2e], 0x300
xor eax, eax
jmp 0x56df20
movzx r9d, byte [rsp + rsi + 0x1d]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x3c]
mov byte [rsp + rdi + 0x1d], dl
mov byte [rsp + rsi + 0x1d], r8b
add rax, 2
cmp rax, 0xa
jge 0x56df52
movzx edx, byte [rsp + rax + 0x26]
movzx esi, byte [rsp + rax + 0x27]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 9
jae 0x56df7b
movzx r8d, byte [rsp + rdi + 0x1d]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x3c]
cmp rsi, 9
jb 0x56df06
jmp 0x56df6f
xor eax, eax
lea rbx, [rsp + 0x1d]
mov ecx, 9
nop
call fcn.0044a200
mov rbp, qword [rsp + 0x30]
add rsp, 0x38
ret
mov eax, esi
mov ecx, 9
call fcn.0045f5c0
mov eax, edi
mov ecx, 9
call fcn.0045f5c0
nop
call fcn.0045cf60
jmp fcn.0056dec0

Function at 0x56e820
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x56e946
sub rsp, 0x68
mov qword [rsp + 0x60], rbp
lea rbp, [rsp + 0x60]
movabs rdx, 0xdd5fbe5f545f3285
mov qword [rsp + 0x1d], rdx
movabs rdx, 0x6e06d4edef4c3780
mov qword [rsp + 0x25], rdx
movabs rdx, 0x4f7fc65746e06d4
mov qword [rsp + 0x2a], rdx
movabs rdx, 0x5734d607785f6563
mov qword [rsp + 0x32], rdx
movabs rdx, 0x70a031b03031b09
mov qword [rsp + 0x3a], rdx
movabs rdx, 0x10513000408070a
mov qword [rsp + 0x40], rdx
movabs rdx, 0x71a08000e09070d
mov qword [rsp + 0x48], rdx
movabs rdx, 0x8131a1800050913
mov qword [rsp + 0x50], rdx
movabs rdx, 0x19040b0c1a121405
mov qword [rsp + 0x58], rdx
xor eax, eax
jmp 0x56e8e0
movzx r9d, byte [rsp + rsi + 0x1d]
sub r9d, edx
lea edx, [r9 - 0x61]
mov byte [rsp + rdi + 0x1d], dl
lea edx, [r8 - 0x61]
mov byte [rsp + rsi + 0x1d], dl
add rax, 2
cmp rax, 0x26
jge 0x56e90d
movzx edx, byte [rsp + rax + 0x3a]
movzx esi, byte [rsp + rax + 0x3b]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x1d
jae 0x56e934
movzx r8d, byte [rsp + rdi + 0x1d]
sub r8d, edx
cmp rsi, 0x1d
jb 0x56e8c3
jmp 0x56e928
xor eax, eax
lea rbx, [rsp + 0x1d]
mov ecx, 0x1d
call fcn.0044a200
mov rbp, qword [rsp + 0x60]
add rsp, 0x68
ret
mov eax, esi
mov ecx, 0x1d
call fcn.0045f5c0
mov eax, edi
mov ecx, 0x1d
nop dword [rax + rax]
call fcn.0045f5c0
nop
call fcn.0045cf60
jmp fcn.0056e820
Function at 0x56e960
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x56eaa6
sub rsp, 0x70
mov qword [rsp + 0x68], rbp
lea rbp, [rsp + 0x68]
movabs rdx, 0x8de18e9d47d30b91
mov qword [rsp + 0x1c], rdx
movabs rdx, 0xc6938de18e9d47d3
mov qword [rsp + 0x1e], rdx
movabs rdx, 0x7286ac495f656369
mov qword [rsp + 0x26], rdx
movabs rdx, 0xb04c5f656376a275
mov qword [rsp + 0x2e], rdx
movabs rdx, 0xef7cb0699c97a7d3
mov qword [rsp + 0x36], rdx
movabs rdx, 0x509050908080621
mov qword [rsp + 0x3e], rdx
movabs rdx, 0x4091f0412131b1a
mov qword [rsp + 0x46], rdx
movabs rdx, 0x111404091f041213
mov qword [rsp + 0x48], rdx
movabs rdx, 0x191020191a212001
mov qword [rsp + 0x50], rdx
movabs rdx, 0x1d0f1c020013061b
mov qword [rsp + 0x58], rdx
movabs rdx, 0x804061c1d07121b
mov qword [rsp + 0x60], rdx
xor eax, eax
nop
jmp 0x56ea40
movzx r9d, byte [rsp + rsi + 0x1c]
sub r9d, edx
lea edx, [r9 + 4]
mov byte [rsp + rdi + 0x1c], dl
lea edx, [r8 + 4]
mov byte [rsp + rsi + 0x1c], dl
add rax, 2
nop
cmp rax, 0x2a
jge 0x56ea6d
movzx edx, byte [rsp + rax + 0x3e]
movzx esi, byte [rsp + rax + 0x3f]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x22
jae 0x56ea94
movzx r8d, byte [rsp + rdi + 0x1c]
sub r8d, edx
cmp rsi, 0x22
jb 0x56ea22
jmp 0x56ea88
xor eax, eax
lea rbx, [rsp + 0x1c]
mov ecx, 0x22
call fcn.0044a200
mov rbp, qword [rsp + 0x68]
add rsp, 0x70
ret
mov eax, esi
mov ecx, 0x22
call fcn.0045f5c0
mov eax, edi
mov ecx, 0x22
nop dword [rax + rax]
call fcn.0045f5c0
nop
call fcn.0045cf60
jmp fcn.0056e960

Function at 0x56fa80
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x56fb7c
sub rsp, 0x48
mov qword [rsp + 0x40], rbp
lea rbp, [rsp + 0x40]
movabs rdx, 0x5c65e06573bca9c3
mov qword [rsp + 0x18], rdx
movabs rdx, 0x64b95c65e06573bc
mov qword [rsp + 0x1a], rdx
movabs rdx, 0x65abd113aae165c3
mov qword [rsp + 0x22], rdx
movabs rdx, 0x705100c0c0d0905
mov qword [rsp + 0x2a], rdx
movabs rdx, 0xe10050100020705
mov qword [rsp + 0x30], rdx
movabs rdx, 0xf02100a05080502
mov qword [rsp + 0x38], rdx
xor eax, eax
jmp 0x56fb10
movzx r9d, byte [rsp + rsi + 0x18]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x7d]
mov byte [rsp + rdi + 0x18], dl
mov byte [rsp + rsi + 0x18], r8b
add rax, 2
cmp rax, 0x16
jge 0x56fb48
movzx edx, byte [rsp + rax + 0x2a]
movzx esi, byte [rsp + rax + 0x2b]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x12
jae 0x56fb6f
movzx r8d, byte [rsp + rdi + 0x18]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x7d]
nop word [rax + rax]
cmp rsi, 0x12
jb 0x56faf6
jmp 0x56fb63
xor eax, eax
lea rbx, [rsp + 0x18]
mov ecx, 0x12
call fcn.0044a200
mov rbp, qword [rsp + 0x40]
add rsp, 0x48
ret
mov eax, esi
mov ecx, 0x12
call fcn.0045f5c0
mov eax, edi
mov ecx, 0x12
call fcn.0045f5c0
nop
nop dword [rax]
call fcn.0045cf60
jmp fcn.0056fa80
Function at 0x5709c0
Capabilities:
Encrypt data using rc4 prga
Resolve function by parsing pe exports

Disassembly:
lea r12, [rsp - 0x18]
cmp r12, qword [r14 + 0x10]
jbe 0x570b72
sub rsp, 0x98
mov qword [rsp + 0x90], rbp
lea rbp, [rsp + 0x90]
movabs rdx, 0x510a0e65214dab73
mov qword [rsp + 0x18], rdx
movabs rdx, 0x6e1172eb510a0e65
mov qword [rsp + 0x1c], rdx
movabs rdx, 0xbf6972b263a4c767
mov qword [rsp + 0x24], rdx
movabs rdx, 0xac1f29638e6544ab
mov qword [rsp + 0x2c], rdx
movabs rdx, 0xf40dd44054b16f74
mov qword [rsp + 0x34], rdx
movabs rdx, 0x58c9354b26447287
mov qword [rsp + 0x3c], rdx
movabs rdx, 0xf938bc252483bb63
mov qword [rsp + 0x44], rdx
movabs rdx, 0x1b29282032290206
mov qword [rsp + 0x4c], rdx
movabs rdx, 0x327232a1b292820
mov qword [rsp + 0x50], rdx
movabs rdx, 0x23241021072d2e23
mov qword [rsp + 0x58], rdx
movabs rdx, 0x2d1a30331908001b
mov qword [rsp + 0x60], rdx
movabs rdx, 0x53117001b202b13
mov qword [rsp + 0x68], rdx
movabs rdx, 0x271e08322226132e
mov qword [rsp + 0x70], rdx
movabs rdx, 0xe230a3322310300
mov qword [rsp + 0x78], rdx
movabs rdx, 0x6282003261a1a33
mov qword [rsp + 0x80], rdx
movabs rdx, 0x2e2d0e142f2d0d01
mov qword [rsp + 0x88], rdx
xor eax, eax
nop
jmp 0x570b00
movzx r9d, byte [rsp + rsi + 0x18]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x60]
mov byte [rsp + rdi + 0x18], dl
mov byte [rsp + rsi + 0x18], r8b
add rax, 2
nop dword [rax]
cmp rax, 0x44
jge 0x570b32
movzx edx, byte [rsp + rax + 0x4c]
movzx esi, byte [rsp + rax + 0x4d]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x34
jae 0x570b65
movzx r8d, byte [rsp + rdi + 0x18]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x60]
cmp rsi, 0x34
jb 0x570ae2
jmp 0x570b55
xor eax, eax
lea rbx, [rsp + 0x18]
mov ecx, 0x34
nop
call fcn.0044a200
mov rbp, qword [rsp + 0x90]
add rsp, 0x98
ret
mov eax, esi
mov ecx, 0x34
nop dword [rax]
call fcn.0045f5c0
mov eax, edi
mov ecx, 0x34
call fcn.0045f5c0
nop
call fcn.0045cf60
jmp fcn.005709c0

Function at 0x5715c0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x5716ab
sub rsp, 0x48
mov qword [rsp + 0x40], rbp
lea rbp, [rsp + 0x40]
movabs rdx, 0xa89de001707993df
mov qword [rsp + 0x1e], rdx
movabs rdx, 0xe88982bb9795a89d
mov qword [rsp + 0x24], rdx
movabs rdx, 0x406010a080c09
mov qword [rsp + 0x2c], rdx
movabs rdx, 0xb08000100040601
mov qword [rsp + 0x30], rdx
movabs rdx, 0x10705010d070401
mov qword [rsp + 0x38], rdx
xor eax, eax
jmp 0x571644
movzx r9d, byte [rsp + rsi + 0x1e]
sub r9d, edx
lea edx, [r9 - 0x23]
mov byte [rsp + rdi + 0x1e], dl
lea edx, [r8 - 0x23]
mov byte [rsp + rsi + 0x1e], dl
add rax, 2
cmp rax, 0x14
jge 0x571677
movzx edx, byte [rsp + rax + 0x2c]
movzx esi, byte [rsp + rax + 0x2d]
mov edi, edx
xor edx, esi
add edx, eax
nop word [rax + rax]
cmp rdi, 0xe
jae 0x57169e
movzx r8d, byte [rsp + rdi + 0x1e]
sub r8d, edx
cmp rsi, 0xe
jb 0x571627
jmp 0x571692
xor eax, eax
lea rbx, [rsp + 0x1e]
mov ecx, 0xe
call fcn.0044a200
mov rbp, qword [rsp + 0x40]
add rsp, 0x48
ret
mov eax, esi
mov ecx, 0xe
call fcn.0045f5c0
mov eax, edi
mov ecx, 0xe
call fcn.0045f5c0
nop
call fcn.0045cf60
jmp fcn.005715c0
Function at 0x571c60
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x571d5c
sub rsp, 0x50
mov qword [rsp + 0x48], rbp
lea rbp, [rsp + 0x48]
movabs rdx, 0x7473720265856586
mov qword [rsp + 0x1b], rdx
movabs rdx, 0x129c4572d0747372
mov qword [rsp + 0x20], rdx
movabs rdx, 0x657b748dc2945f6e
mov qword [rsp + 0x28], rdx
movabs rdx, 0xb0c05040c0b050f
mov qword [rsp + 0x30], rdx
movabs rdx, 0x1202111308000002
mov qword [rsp + 0x38], rdx
movabs rdx, 0xc0213110e020f10
mov qword [rsp + 0x40], rdx
xor eax, eax
jmp 0x571cf0
movzx r9d, byte [rsp + rsi + 0x1b]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x62]
mov byte [rsp + rdi + 0x1b], dl
mov byte [rsp + rsi + 0x1b], r8b
add rax, 2
cmp rax, 0x18
jge 0x571d28
movzx edx, byte [rsp + rax + 0x30]
movzx esi, byte [rsp + rax + 0x31]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x15
jae 0x571d4f
movzx r8d, byte [rsp + rdi + 0x1b]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x62]
nop word [rax + rax]
cmp rsi, 0x15
jb 0x571cd6
jmp 0x571d43
xor eax, eax
lea rbx, [rsp + 0x1b]
mov ecx, 0x15
call fcn.0044a200
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
mov eax, esi
mov ecx, 0x15
call fcn.0045f5c0
mov eax, edi
mov ecx, 0x15
call fcn.0045f5c0
nop
nop dword [rax]
call fcn.0045cf60
jmp fcn.00571c60

Function at 0x572fe0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x5730f6
sub rsp, 0x58
mov qword [rsp + 0x50], rbp
lea rbp, [rsp + 0x50]
movabs rdx, 0x342c63b153745b59
mov qword [rsp + 0x1b], rdx
movabs rdx, 0x494a3b6544477450
mov qword [rsp + 0x23], rdx
movabs rdx, 0x2c494a3b65444774
mov qword [rsp + 0x24], rdx
movabs rdx, 0x433b614472fc174c
mov qword [rsp + 0x2c], rdx
movabs rdx, 0xd0d04110f1113
mov qword [rsp + 0x34], rdx
movabs rdx, 0x60a0110130412
mov qword [rsp + 0x3c], rdx
movabs rdx, 0xe08080600060a01
mov qword [rsp + 0x40], rdx
movabs rdx, 0x13180f170e040703
mov qword [rsp + 0x48], rdx
xor eax, eax
jmp 0x57308e
movzx r9d, byte [rsp + rsi + 0x1b]
lea edx, [r9 + rdx]
lea edx, [rdx + 7]
mov byte [rsp + rdi + 0x1b], dl
mov byte [rsp + rsi + 0x1b], r8b
add rax, 2
cmp rax, 0x1c
jge 0x5730c2
movzx edx, byte [rsp + rax + 0x34]
movzx esi, byte [rsp + rax + 0x35]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x19
jae 0x5730e9
movzx r8d, byte [rsp + rdi + 0x1b]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 7]
cmp rsi, 0x19
jb 0x573074
nop
jmp 0x5730dd
xor eax, eax
lea rbx, [rsp + 0x1b]
mov ecx, 0x19
call fcn.0044a200
mov rbp, qword [rsp + 0x50]
add rsp, 0x58
ret
mov eax, esi
mov ecx, 0x19
call fcn.0045f5c0
mov eax, edi
mov ecx, 0x19
call fcn.0045f5c0
nop
call fcn.0045cf60
nop dword [rax + rax]
jmp fcn.00572fe0
Function at 0x573dc0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x573ea8
sub rsp, 0x48
mov qword [rsp + 0x40], rbp
lea rbp, [rsp + 0x40]
movabs rdx, 0x1d12d0cb17741447
mov qword [rsp + 0x1f], rdx
movabs rdx, 0x2004ab49f2170b1d
mov qword [rsp + 0x26], rdx
movabs rdx, 0xc010508070e0403
mov qword [rsp + 0x2e], rdx
movabs rdx, 0x80a0c010508070e
mov qword [rsp + 0x30], rdx
movabs rdx, 0x603010d09060908
mov qword [rsp + 0x38], rdx
xor eax, eax
jmp 0x573e41
movzx r9d, byte [rsp + rsi + 0x1f]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x47]
mov byte [rsp + rdi + 0x1f], dl
mov byte [rsp + rsi + 0x1f], r8b
add rax, 2
cmp rax, 0x12
jge 0x573e73
movzx edx, byte [rsp + rax + 0x2e]
movzx esi, byte [rsp + rax + 0x2f]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0xf
jae 0x573e9b
movzx r8d, byte [rsp + rdi + 0x1f]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x47]
cmp rsi, 0xf
jb 0x573e27
jmp 0x573e8f
xor eax, eax
lea rbx, [rsp + 0x1f]
mov ecx, 0xf
nop
call fcn.0044a200
mov rbp, qword [rsp + 0x40]
add rsp, 0x48
ret
mov eax, esi
mov ecx, 0xf
call fcn.0045f5c0
mov eax, edi
mov ecx, 0xf
call fcn.0045f5c0
nop
call fcn.0045cf60
jmp fcn.00573dc0

Function at 0x576840
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x576912
sub rsp, 0x40
mov qword [rsp + 0x38], rbp
lea rbp, [rsp + 0x38]
movabs rdx, 0x76484d432f23554f
mov qword [rsp + 0x1c], rdx
mov dword [rsp + 0x24], 0x2f65e149
movabs rdx, 0x209050803040902
mov qword [rsp + 0x28], rdx
movabs rdx, 0x6020103040b0904
mov qword [rsp + 0x30], rdx
xor eax, eax
jmp 0x5768ab
movzx r9d, byte [rsp + rsi + 0x1c]
lea edx, [r9 + rdx]
lea edx, [rdx + 0xb]
mov byte [rsp + rdi + 0x1c], dl
mov byte [rsp + rsi + 0x1c], r8b
add rax, 2
cmp rax, 0x10
jge 0x5768dd
movzx edx, byte [rsp + rax + 0x28]
movzx esi, byte [rsp + rax + 0x29]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0xc
jae 0x576905
movzx r8d, byte [rsp + rdi + 0x1c]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0xb]
cmp rsi, 0xc
jb 0x576891
jmp 0x5768f8
xor eax, eax
lea rbx, [rsp + 0x1c]
mov ecx, 0xc
call fcn.0044a200
mov rbp, qword [rsp + 0x38]
add rsp, 0x40
ret
mov eax, esi
mov ecx, 0xc
nop
call fcn.0045f5c0
mov eax, edi
mov ecx, 0xc
call fcn.0045f5c0
nop
call fcn.0045cf60
jmp fcn.00576840