joyce8/EMBER2024-capa huggingface dataset:
Function at 0x541a40
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x541b52
sub rsp, 0x58
mov qword [rsp + 0x50], rbp
lea rbp, [rsp + 0x50]
movabs rdx, 0x205e636973547672
mov qword [rsp + 0x1b], rdx
movabs rdx, 0x618b726f78767b0e
mov qword [rsp + 0x23], rdx
movabs rdx, 0x5a618b726f78767b
mov qword [rsp + 0x24], rdx
movabs rdx, 0x1f6d616684717470
mov qword [rsp + 0x2c], rdx
movabs rdx, 0x60f1804110802
mov qword [rsp + 0x34], rdx
movabs rdx, 0x13100b080b181409
mov qword [rsp + 0x3c], rdx
movabs rdx, 0x180e170613100b08
mov qword [rsp + 0x40], rdx
movabs rdx, 0xa0b011009170d18
mov qword [rsp + 0x48], rdx
xor eax, eax
jmp 0x541af1
movzx r9d, byte [rsp + rsi + 0x1b]
sub r9d, edx
lea edx, [r9 + 0x1c]
mov byte [rsp + rdi + 0x1b], dl
lea edx, [r8 + 0x1c]
mov byte [rsp + rsi + 0x1b], dl
add rax, 2
cmp rax, 0x1c
jge 0x541b1e
movzx edx, byte [rsp + rax + 0x34]
movzx esi, byte [rsp + rax + 0x35]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x19
jae 0x541b45
movzx r8d, byte [rsp + rdi + 0x1b]
sub r8d, edx
cmp rsi, 0x19
jb 0x541ad4
jmp 0x541b39
xor eax, eax
lea rbx, [rsp + 0x1b]
mov ecx, 0x19
call fcn.0044a140
mov rbp, qword [rsp + 0x50]
add rsp, 0x58
ret
mov eax, esi
mov ecx, 0x19
call fcn.0045f500
mov eax, edi
mov ecx, 0x19
call fcn.0045f500
nop
call fcn.0045cea0
jmp fcn.00541a40

Function at 0x542340
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x542408
sub rsp, 0x38
mov qword [rsp + 0x30], rbp
lea rbp, [rsp + 0x30]
movabs rdx, 0x8463877d788983a0
mov qword [rsp + 0x1e], rdx
movabs rdx, 0x707040405030200
mov qword [rsp + 0x26], rdx
mov word [rsp + 0x2e], 0x102
xor eax, eax
nop
jmp 0x5423a0
movzx r9d, byte [rsp + rsi + 0x1e]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x1f]
mov byte [rsp + rdi + 0x1e], dl
mov byte [rsp + rsi + 0x1e], r8b
add rax, 2
nop dword [rax]
cmp rax, 0xa
jge 0x5423d2
movzx edx, byte [rsp + rax + 0x26]
movzx esi, byte [rsp + rax + 0x27]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 8
jae 0x5423fb
movzx r8d, byte [rsp + rdi + 0x1e]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x1f]
cmp rsi, 8
jb 0x542382
jmp 0x5423ef
xor eax, eax
lea rbx, [rsp + 0x1e]
mov ecx, 8
nop
call fcn.0044a140
mov rbp, qword [rsp + 0x30]
add rsp, 0x38
ret
mov eax, esi
mov ecx, 8
call fcn.0045f500
mov eax, edi
mov ecx, 8
call fcn.0045f500
nop
call fcn.0045cea0
jmp fcn.00542340
Function at 0x542600
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x5426e6
sub rsp, 0x30
mov qword [rsp + 0x28], rbp
lea rbp, [rsp + 0x28]
lea rax, [0x005c0980]
nop
call fcn.0040c880
movabs rcx, 0x1800281d0b340a14
mov qword [rax], rcx
mov dword [rax + 8], 0x1eff0031
movabs rcx, 0x502020508010208
mov qword [rsp + 0x16], rcx
movabs rcx, 0x701050202050801
mov qword [rsp + 0x18], rcx
movabs rcx, 0x40b070002050103
mov qword [rsp + 0x20], rcx
xor ecx, ecx
jmp 0x542684
movzx r9d, byte [rsi + rax]
sub r9d, edx
lea edx, [r9 + 1]
mov byte [rax + rdi], dl
lea edx, [r8 + 1]
mov byte [rax + rsi], dl
add rcx, 2
cmp rcx, 0x12
jge 0x5426b6
movzx edx, byte [rsp + rcx + 0x16]
movzx esi, byte [rsp + rcx + 0x17]
mov edi, edx
xor edx, esi
add edx, ecx
nop word [rax + rax]
cmp rdi, 0xc
jae 0x5426d4
movzx r8d, byte [rdi + rax]
sub r8d, edx
cmp rsi, 0xc
jb 0x54266a
jmp 0x5426c8
mov ebx, 0xc
mov rcx, rbx
mov rbp, qword [rsp + 0x28]
add rsp, 0x30
ret
mov eax, esi
mov ecx, 0xc
call fcn.0045f500
mov eax, edi
mov ecx, 0xc
nop dword [rax + rax]
call fcn.0045f500
nop
call fcn.0045cea0
jmp fcn.00542600
Function at 0x546ec0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x546fc8
sub rsp, 0x50
mov qword [rsp + 0x48], rbp
lea rbp, [rsp + 0x48]
movabs rdx, 0x890b7fd96527adca
mov qword [rsp + 0x19], rdx
movabs rdx, 0x9131c890b7fd965
mov qword [rsp + 0x1c], rdx
movabs rdx, 0xc6b8692863882a83
mov qword [rsp + 0x24], rdx
movabs rdx, 0x504020d0b0d070d
mov qword [rsp + 0x2c], rdx
movabs rdx, 0x50a0c0f12070007
mov qword [rsp + 0x34], rdx
movabs rdx, 0x11061101050a0c0f
mov qword [rsp + 0x38], rdx
movabs rdx, 0xb08020001090104
mov qword [rsp + 0x40], rdx
xor eax, eax
jmp 0x546f60
movzx r9d, byte [rsp + rsi + 0x19]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x3b]
mov byte [rsp + rdi + 0x19], dl
mov byte [rsp + rsi + 0x19], r8b
add rax, 2
nop
cmp rax, 0x1c
jge 0x546f92
movzx edx, byte [rsp + rax + 0x2c]
movzx esi, byte [rsp + rax + 0x2d]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x13
jae 0x546fbb
movzx r8d, byte [rsp + rdi + 0x19]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x3b]
cmp rsi, 0x13
jb 0x546f45
jmp 0x546faf
xor eax, eax
lea rbx, [rsp + 0x19]
mov ecx, 0x13
nop
call fcn.0044a140
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
mov eax, esi
mov ecx, 0x13
call fcn.0045f500
mov eax, edi
mov ecx, 0x13
call fcn.0045f500
nop
call fcn.0045cea0
jmp fcn.00546ec0

Function at 0x547c40
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x547d1c
sub rsp, 0x40
mov qword [rsp + 0x38], rbp
lea rbp, [rsp + 0x38]
movabs rdx, 0x1c207f262117de24
mov qword [rsp + 0x1f], rdx
movabs rdx, 0x65dccb1c207f2621
mov qword [rsp + 0x22], rdx
movabs rdx, 0x805090101090508
mov qword [rsp + 0x2a], rdx
movabs rdx, 0x703020005040805
mov qword [rsp + 0x30], rdx
xor eax, eax
jmp 0x547cb2
movzx r9d, byte [rsp + rsi + 0x1f]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x3f]
mov byte [rsp + rdi + 0x1f], dl
mov byte [rsp + rsi + 0x1f], r8b
add rax, 2
cmp rax, 0xe
jge 0x547ce8
movzx edx, byte [rsp + rax + 0x2a]
movzx esi, byte [rsp + rax + 0x2b]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0xb
jae 0x547d0f
movzx r8d, byte [rsp + rdi + 0x1f]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x3f]
nop dword [rax]
cmp rsi, 0xb
jb 0x547c98
jmp 0x547d03
xor eax, eax
lea rbx, [rsp + 0x1f]
mov ecx, 0xb
call fcn.0044a140
mov rbp, qword [rsp + 0x38]
add rsp, 0x40
ret
mov eax, esi
mov ecx, 0xb
call fcn.0045f500
mov eax, edi
mov ecx, 0xb
call fcn.0045f500
nop
nop dword [rax]
call fcn.0045cea0
jmp fcn.00547c40
Function at 0x548fc0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
sub rsp, 0x38
mov qword [rsp + 0x30], rbp
lea rbp, [rsp + 0x30]
mov qword [rsp + 0x40], 0
movabs rdx, 0x3e55db8ce5db683e
mov qword [rsp + 0x1e], rdx
movabs rdx, 0x5000602010006
mov qword [rsp + 0x26], rdx
mov word [rsp + 0x2e], 0x600
xor eax, eax
nop
jmp 0x549020
movzx r8d, byte [rsp + rbx + 0x1e]
lea edx, [r8 + rdx]
lea edx, [rdx + 9]
mov byte [rsp + rsi + 0x1e], dl
mov byte [rsp + rbx + 0x1e], dil
add rax, 2
nop dword [rax]
cmp rax, 0xa
jge 0x54904f
movzx edx, byte [rsp + rax + 0x26]
movzx ebx, byte [rsp + rax + 0x27]
mov esi, edx
xor edx, ebx
add edx, eax
cmp rsi, 8
jae 0x54908e
movzx edi, byte [rsp + rsi + 0x1e]
lea edi, [rdi + rdx]
lea edi, [rdi + 9]
cmp rbx, 8
jb 0x549002
jmp 0x549082
mov qword [rsp + 0x16], 0
xor eax, eax
jmp 0x549068
movzx ecx, byte [rsp + rax + 0x1e]
mov byte [rsp + rax + 0x16], cl
inc rax
cmp rax, 8
jl 0x54905c
mov rax, qword [rsp + 0x16]
mov qword [rsp + 0x40], rax
mov rbp, qword [rsp + 0x30]
add rsp, 0x38
ret
mov eax, ebx
mov ecx, 8
call fcn.0045f500
mov eax, esi
mov ecx, 8
call fcn.0045f500
nop
int3

Function at 0x54a800
Capabilities:
Encrypt data using rc4 prga

Disassembly:
sub rsp, 0x38
mov qword [rsp + 0x30], rbp
lea rbp, [rsp + 0x30]
mov qword [rsp + 0x40], 0
movabs rdx, 0xcbe755767a584be6
mov qword [rsp + 0x1e], rdx
movabs rdx, 0x701070107050501
mov qword [rsp + 0x26], rdx
mov word [rsp + 0x2e], 0x500
xor eax, eax
nop
jmp 0x54a860
movzx r8d, byte [rsp + rbx + 0x1e]
lea edx, [r8 + rdx]
lea edx, [rdx - 0x1c]
mov byte [rsp + rsi + 0x1e], dl
mov byte [rsp + rbx + 0x1e], dil
add rax, 2
nop dword [rax]
cmp rax, 0xa
jge 0x54a88f
movzx edx, byte [rsp + rax + 0x26]
movzx ebx, byte [rsp + rax + 0x27]
mov esi, edx
xor edx, ebx
add edx, eax
cmp rsi, 8
jae 0x54a8ce
movzx edi, byte [rsp + rsi + 0x1e]
lea edi, [rdi + rdx]
lea edi, [rdi - 0x1c]
cmp rbx, 8
jb 0x54a842
jmp 0x54a8c2
mov qword [rsp + 0x16], 0
xor eax, eax
jmp 0x54a8a8
movzx ecx, byte [rsp + rax + 0x1e]
mov byte [rsp + rax + 0x16], cl
inc rax
cmp rax, 8
jl 0x54a89c
mov rax, qword [rsp + 0x16]
mov qword [rsp + 0x40], rax
mov rbp, qword [rsp + 0x30]
add rsp, 0x38
ret
mov eax, ebx
mov ecx, 8
call fcn.0045f500
mov eax, esi
mov ecx, 8
call fcn.0045f500
nop
int3
Function at 0x54aaa0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
sub rsp, 0x30
mov qword [rsp + 0x28], rbp
lea rbp, [rsp + 0x28]
mov qword [rsp + 0x38], 0
movabs rdx, 0xb0c37191f33c7dfd
mov qword [rsp + 0x20], rdx
movabs rdx, 0x605000207070100
mov qword [rsp + 0x10], rdx
xor eax, eax
jmp 0x54aaf5
movzx r8d, byte [rsp + rbx + 0x20]
sub r8d, edx
lea edx, [r8 + 0x50]
mov byte [rsp + rsi + 0x20], dl
lea edx, [rdi + 0x50]
mov byte [rsp + rbx + 0x20], dl
add rax, 2
cmp rax, 8
jge 0x54ab22
movzx edx, byte [rsp + rax + 0x10]
movzx ebx, byte [rsp + rax + 0x11]
mov esi, edx
xor edx, ebx
add edx, eax
cmp rsi, 8
jae 0x54ab66
movzx edi, byte [rsp + rsi + 0x20]
sub edi, edx
cmp rbx, 8
jb 0x54aad9
nop
jmp 0x54ab5a
mov qword [rsp + 0x18], 0
xor eax, eax
jmp 0x54ab40
movzx ecx, byte [rsp + rax + 0x20]
mov byte [rsp + rax + 0x18], cl
inc rax
nop dword [rax + rax]
cmp rax, 8
jl 0x54ab2f
mov rax, qword [rsp + 0x18]
mov qword [rsp + 0x38], rax
mov rbp, qword [rsp + 0x28]
add rsp, 0x30
ret
mov eax, ebx
mov ecx, 8
call fcn.0045f500
mov eax, esi
mov ecx, 8
call fcn.0045f500
nop
int3

Function at 0x54b220
Capabilities:
Encrypt data using rc4 prga

Disassembly:
sub rsp, 0x38
mov qword [rsp + 0x30], rbp
lea rbp, [rsp + 0x30]
mov qword [rsp + 0x40], 0
movabs rdx, 0x2e93c16def9580c0
mov qword [rsp + 0x1c], rdx
movabs rdx, 0x6000505040106
mov qword [rsp + 0x24], rdx
mov dword [rsp + 0x2c], 0x2010007
xor eax, eax
nop
jmp 0x54b280
movzx r8d, byte [rsp + rbx + 0x1c]
lea edx, [r8 + rdx]
lea edx, [rdx + 0x7d]
mov byte [rsp + rsi + 0x1c], dl
mov byte [rsp + rbx + 0x1c], dil
add rax, 2
nop dword [rax]
cmp rax, 0xc
jge 0x54b2af
movzx edx, byte [rsp + rax + 0x24]
movzx ebx, byte [rsp + rax + 0x25]
mov esi, edx
xor edx, ebx
add edx, eax
cmp rsi, 8
jae 0x54b2ee
movzx edi, byte [rsp + rsi + 0x1c]
lea edi, [rdi + rdx]
lea edi, [rdi + 0x7d]
cmp rbx, 8
jb 0x54b262
jmp 0x54b2e2
mov qword [rsp + 0x14], 0
xor eax, eax
jmp 0x54b2c8
movzx ecx, byte [rsp + rax + 0x1c]
mov byte [rsp + rax + 0x14], cl
inc rax
cmp rax, 8
jl 0x54b2bc
mov rax, qword [rsp + 0x14]
mov qword [rsp + 0x40], rax
mov rbp, qword [rsp + 0x30]
add rsp, 0x38
ret
mov eax, ebx
mov ecx, 8
call fcn.0045f500
mov eax, esi
mov ecx, 8
call fcn.0045f500
nop
int3
Function at 0x54d5e0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
sub rsp, 0x30
mov qword [rsp + 0x28], rbp
lea rbp, [rsp + 0x28]
mov qword [rsp + 0x38], 0
movabs rax, 0x537a325523d90e35
mov qword [rsp + 0x18], rax
movabs rax, 0x4b54684cbfc60e8f
mov qword [rsp + 0x20], rax
mov qword [rsp + 0xf], 0
mov qword [rsp + 0x10], 0
movzx eax, byte [rsp + 0x1a]
movzx ecx, byte [rsp + 0x1d]
sub eax, ecx
movzx ecx, byte [rsp + 0x18]
movzx edx, byte [rsp + 0x24]
movzx ebx, byte [rsp + 0x25]
movzx esi, byte [rsp + 0x21]
movzx edi, byte [rsp + 0x22]
movzx r8d, byte [rsp + 0x27]
movzx r9d, byte [rsp + 0x23]
movzx r10d, byte [rsp + 0x20]
movzx r11d, byte [rsp + 0x1f]
movzx r12d, byte [rsp + 0x26]
movzx r13d, byte [rsp + 0x1e]
mov byte [rsp + 6], r13b
movzx r15d, byte [rsp + 0x1b]
movzx r13d, byte [rsp + 0x19]
mov byte [rsp + 5], r13b
movzx r13d, byte [rsp + 0x1c]
mov byte [rsp + 0xf], al
lea eax, [rdx + rcx]
mov byte [rsp + 0x10], al
sub ebx, esi
mov byte [rsp + 0x11], bl
lea eax, [r8 + rdi]
mov byte [rsp + 0x12], al
sub r9d, r10d
mov byte [rsp + 0x13], r9b
lea eax, [r12 + r11]
mov byte [rsp + 0x14], al
movzx eax, byte [rsp + 6]
xor eax, r15d
mov byte [rsp + 0x15], al
movzx eax, byte [rsp + 5]
add eax, r13d
mov byte [rsp + 0x16], al
mov qword [rsp + 7], 0
xor eax, eax
jmp 0x54d6e6
movzx ecx, byte [rsp + rax + 0xf]
mov byte [rsp + rax + 7], cl
inc rax
cmp rax, 8
jl 0x54d6da
mov rax, qword [rsp + 7]
mov qword [rsp + 0x38], rax
mov rbp, qword [rsp + 0x28]
add rsp, 0x30
nop
ret

Function at 0x54e740
Capabilities:
Encrypt data using rc4 prga

Disassembly:
sub rsp, 0x30
mov qword [rsp + 0x28], rbp
lea rbp, [rsp + 0x28]
mov qword [rsp + 0x38], 0
movabs rax, 0x7170cbae6b4923b2
mov qword [rsp + 0x18], rax
movabs rax, 0xb6e3b5b59c61d77a
mov qword [rsp + 0x20], rax
mov qword [rsp + 0xf], 0
mov qword [rsp + 0x10], 0
movzx eax, byte [rsp + 0x1f]
movzx ecx, byte [rsp + 0x18]
sub eax, ecx
movzx ecx, byte [rsp + 0x1c]
movzx edx, byte [rsp + 0x26]
movzx ebx, byte [rsp + 0x21]
movzx esi, byte [rsp + 0x19]
movzx edi, byte [rsp + 0x20]
movzx r8d, byte [rsp + 0x1d]
movzx r9d, byte [rsp + 0x25]
movzx r10d, byte [rsp + 0x23]
movzx r11d, byte [rsp + 0x24]
movzx r12d, byte [rsp + 0x1b]
movzx r13d, byte [rsp + 0x1a]
mov byte [rsp + 6], r13b
movzx r15d, byte [rsp + 0x1e]
movzx r13d, byte [rsp + 0x27]
mov byte [rsp + 5], r13b
movzx r13d, byte [rsp + 0x22]
mov byte [rsp + 0xf], al
lea eax, [rdx + rcx]
mov byte [rsp + 0x10], al
xor ebx, esi
mov byte [rsp + 0x11], bl
lea eax, [r8 + rdi]
mov byte [rsp + 0x12], al
lea eax, [r10 + r9]
mov byte [rsp + 0x13], al
lea eax, [r12 + r11]
mov byte [rsp + 0x14], al
movzx eax, byte [rsp + 6]
add eax, r15d
mov byte [rsp + 0x15], al
movzx eax, byte [rsp + 5]
add eax, r13d
mov byte [rsp + 0x16], al
mov qword [rsp + 7], 0
xor eax, eax
jmp 0x54e846
movzx ecx, byte [rsp + rax + 0xf]
mov byte [rsp + rax + 7], cl
inc rax
cmp rax, 8
jl 0x54e83a
mov rax, qword [rsp + 7]
mov qword [rsp + 0x38], rax
mov rbp, qword [rsp + 0x28]
add rsp, 0x30
nop
ret
Function at 0x54eee0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
sub rsp, 0x30
mov qword [rsp + 0x28], rbp
lea rbp, [rsp + 0x28]
mov qword [rsp + 0x38], 0
movabs rax, 0x3baefaa0f3dce293
mov qword [rsp + 0x18], rax
movabs rax, 0x2e89b68137a0acaf
mov qword [rsp + 0x20], rax
mov qword [rsp + 0xf], 0
mov qword [rsp + 0x10], 0
movzx eax, byte [rsp + 0x19]
movzx ecx, byte [rsp + 0x27]
sub eax, ecx
movzx ecx, byte [rsp + 0x1a]
movzx edx, byte [rsp + 0x20]
movzx ebx, byte [rsp + 0x1b]
movzx esi, byte [rsp + 0x23]
movzx edi, byte [rsp + 0x1d]
movzx r8d, byte [rsp + 0x21]
movzx r9d, byte [rsp + 0x1f]
movzx r10d, byte [rsp + 0x1c]
movzx r11d, byte [rsp + 0x24]
movzx r12d, byte [rsp + 0x26]
movzx r13d, byte [rsp + 0x18]
mov byte [rsp + 6], r13b
movzx r15d, byte [rsp + 0x1e]
movzx r13d, byte [rsp + 0x25]
mov byte [rsp + 5], r13b
movzx r13d, byte [rsp + 0x22]
mov byte [rsp + 0xf], al
sub ecx, edx
mov byte [rsp + 0x10], cl
sub ebx, esi
mov byte [rsp + 0x11], bl
xor edi, r8d
mov byte [rsp + 0x12], dil
lea eax, [r10 + r9]
mov byte [rsp + 0x13], al
lea eax, [r12 + r11]
mov byte [rsp + 0x14], al
movzx eax, byte [rsp + 6]
sub eax, r15d
mov byte [rsp + 0x15], al
movzx eax, byte [rsp + 5]
sub eax, r13d
mov byte [rsp + 0x16], al
mov qword [rsp + 7], 0
xor eax, eax
jmp 0x54efe5
movzx ecx, byte [rsp + rax + 0xf]
mov byte [rsp + rax + 7], cl
inc rax
cmp rax, 8
jl 0x54efd9
mov rax, qword [rsp + 7]
mov qword [rsp + 0x38], rax
mov rbp, qword [rsp + 0x28]
add rsp, 0x30
ret

Function at 0x5519e0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
sub rsp, 0x38
mov qword [rsp + 0x30], rbp
lea rbp, [rsp + 0x30]
mov qword [rsp + 0x40], 0
movabs rdx, 0x57075e30d8425ca3
mov qword [rsp + 0x1e], rdx
movabs rdx, 0x202040504060307
mov qword [rsp + 0x26], rdx
mov word [rsp + 0x2e], 0x103
xor eax, eax
nop
jmp 0x551a40
movzx r8d, byte [rsp + rbx + 0x1e]
sub r8d, edx
lea edx, [r8 + 0x30]
mov byte [rsp + rsi + 0x1e], dl
lea edx, [rdi + 0x30]
mov byte [rsp + rbx + 0x1e], dl
add rax, 2
nop
cmp rax, 0xa
jge 0x551a6b
movzx edx, byte [rsp + rax + 0x26]
movzx ebx, byte [rsp + rax + 0x27]
mov esi, edx
xor edx, ebx
add edx, eax
cmp rsi, 8
jae 0x551aaa
movzx edi, byte [rsp + rsi + 0x1e]
sub edi, edx
cmp rbx, 8
jb 0x551a22
jmp 0x551a9e
mov qword [rsp + 0x16], 0
xor eax, eax
jmp 0x551a84
movzx ecx, byte [rsp + rax + 0x1e]
mov byte [rsp + rax + 0x16], cl
inc rax
cmp rax, 8
jl 0x551a78
mov rax, qword [rsp + 0x16]
mov qword [rsp + 0x40], rax
mov rbp, qword [rsp + 0x30]
add rsp, 0x38
ret
mov eax, ebx
mov ecx, 8
call fcn.0045f500
mov eax, esi
mov ecx, 8
call fcn.0045f500
nop
int3
Function at 0x551ac0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
sub rsp, 0x30
mov qword [rsp + 0x28], rbp
lea rbp, [rsp + 0x28]
mov qword [rsp + 0x38], 0
movabs rax, 0xe1df8961d5821ed0
mov qword [rsp + 0x18], rax
movabs rax, 0x4e020ce59a86ebbc
mov qword [rsp + 0x20], rax
mov qword [rsp + 0xf], 0
mov qword [rsp + 0x10], 0
movzx eax, byte [rsp + 0x1c]
movzx ecx, byte [rsp + 0x18]
sub eax, ecx
movzx ecx, byte [rsp + 0x1a]
movzx edx, byte [rsp + 0x19]
movzx ebx, byte [rsp + 0x21]
movzx esi, byte [rsp + 0x27]
movzx edi, byte [rsp + 0x24]
movzx r8d, byte [rsp + 0x1e]
movzx r9d, byte [rsp + 0x25]
movzx r10d, byte [rsp + 0x22]
movzx r11d, byte [rsp + 0x1b]
movzx r12d, byte [rsp + 0x1d]
movzx r13d, byte [rsp + 0x26]
mov byte [rsp + 6], r13b
movzx r15d, byte [rsp + 0x20]
movzx r13d, byte [rsp + 0x23]
mov byte [rsp + 5], r13b
movzx r13d, byte [rsp + 0x1f]
mov byte [rsp + 0xf], al
sub ecx, edx
mov byte [rsp + 0x10], cl
lea eax, [rsi + rbx]
mov byte [rsp + 0x11], al
lea eax, [r8 + rdi]
mov byte [rsp + 0x12], al
lea eax, [r10 + r9]
mov byte [rsp + 0x13], al
lea eax, [r12 + r11]
mov byte [rsp + 0x14], al
movzx eax, byte [rsp + 6]
sub eax, r15d
mov byte [rsp + 0x15], al
movzx eax, byte [rsp + 5]
xor eax, r13d
mov byte [rsp + 0x16], al
mov qword [rsp + 7], 0
xor eax, eax
jmp 0x551bc6
movzx ecx, byte [rsp + rax + 0xf]
mov byte [rsp + rax + 7], cl
inc rax
cmp rax, 8
jl 0x551bba
mov rax, qword [rsp + 7]
mov qword [rsp + 0x38], rax
mov rbp, qword [rsp + 0x28]
add rsp, 0x30
nop
ret

Function at 0x552ca0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
sub rsp, 0x38
mov qword [rsp + 0x30], rbp
lea rbp, [rsp + 0x30]
mov qword [rsp + 0x40], 0
movabs rdx, 0xe7a21294977a4476
mov qword [rsp + 0x1e], rdx
movabs rdx, 0x702000002020000
mov qword [rsp + 0x26], rdx
mov word [rsp + 0x2e], 0x405
xor eax, eax
nop
jmp 0x552d00
movzx r8d, byte [rsp + rbx + 0x1e]
sub r8d, edx
lea edx, [r8 - 0x76]
mov byte [rsp + rsi + 0x1e], dl
lea edx, [rdi - 0x76]
mov byte [rsp + rbx + 0x1e], dl
add rax, 2
nop
cmp rax, 0xa
jge 0x552d2b
movzx edx, byte [rsp + rax + 0x26]
movzx ebx, byte [rsp + rax + 0x27]
mov esi, edx
xor edx, ebx
add edx, eax
cmp rsi, 8
jae 0x552d6a
movzx edi, byte [rsp + rsi + 0x1e]
sub edi, edx
cmp rbx, 8
jb 0x552ce2
jmp 0x552d5e
mov qword [rsp + 0x16], 0
xor eax, eax
jmp 0x552d44
movzx ecx, byte [rsp + rax + 0x1e]
mov byte [rsp + rax + 0x16], cl
inc rax
cmp rax, 8
jl 0x552d38
mov rax, qword [rsp + 0x16]
mov qword [rsp + 0x40], rax
mov rbp, qword [rsp + 0x30]
add rsp, 0x38
ret
mov eax, ebx
mov ecx, 8
call fcn.0045f500
mov eax, esi
mov ecx, 8
call fcn.0045f500
nop
int3
Function at 0x553a60
Capabilities:
Encrypt data using rc4 prga

Disassembly:
sub rsp, 0x38
mov qword [rsp + 0x30], rbp
lea rbp, [rsp + 0x30]
mov qword [rsp + 0x40], 0
movabs rdx, 0x7ecd50d7d92c4f94
mov qword [rsp + 0x1e], rdx
movabs rdx, 0x203060603010607
mov qword [rsp + 0x26], rdx
mov word [rsp + 0x2e], 0x207
xor eax, eax
nop
jmp 0x553ac0
movzx r8d, byte [rsp + rbx + 0x1e]
lea edx, [r8 + rdx]
lea edx, [rdx - 0x21]
mov byte [rsp + rsi + 0x1e], dl
mov byte [rsp + rbx + 0x1e], dil
add rax, 2
nop dword [rax]
cmp rax, 0xa
jge 0x553aef
movzx edx, byte [rsp + rax + 0x26]
movzx ebx, byte [rsp + rax + 0x27]
mov esi, edx
xor edx, ebx
add edx, eax
cmp rsi, 8
jae 0x553b2e
movzx edi, byte [rsp + rsi + 0x1e]
lea edi, [rdi + rdx]
lea edi, [rdi - 0x21]
cmp rbx, 8
jb 0x553aa2
jmp 0x553b22
mov qword [rsp + 0x16], 0
xor eax, eax
jmp 0x553b08
movzx ecx, byte [rsp + rax + 0x1e]
mov byte [rsp + rax + 0x16], cl
inc rax
cmp rax, 8
jl 0x553afc
mov rax, qword [rsp + 0x16]
mov qword [rsp + 0x40], rax
mov rbp, qword [rsp + 0x30]
add rsp, 0x38
ret
mov eax, ebx
mov ecx, 8
call fcn.0045f500
mov eax, esi
mov ecx, 8
call fcn.0045f500
nop
int3

Function at 0x555640
Capabilities:
Encrypt data using rc4 prga

Disassembly:
sub rsp, 0x30
mov qword [rsp + 0x28], rbp
lea rbp, [rsp + 0x28]
mov qword [rsp + 0x38], 0
movabs rax, 0x17b38ffe1febd1e9
mov qword [rsp + 0x18], rax
movabs rax, 0xe277267f3ceb6d8c
mov qword [rsp + 0x20], rax
mov qword [rsp + 0xf], 0
mov qword [rsp + 0x10], 0
movzx eax, byte [rsp + 0x1c]
movzx ecx, byte [rsp + 0x20]
add eax, ecx
movzx ecx, byte [rsp + 0x22]
movzx edx, byte [rsp + 0x21]
movzx ebx, byte [rsp + 0x1a]
movzx esi, byte [rsp + 0x1d]
movzx edi, byte [rsp + 0x23]
movzx r8d, byte [rsp + 0x27]
movzx r9d, byte [rsp + 0x25]
movzx r10d, byte [rsp + 0x1f]
movzx r11d, byte [rsp + 0x24]
movzx r12d, byte [rsp + 0x19]
movzx r13d, byte [rsp + 0x1e]
mov byte [rsp + 6], r13b
movzx r15d, byte [rsp + 0x18]
movzx r13d, byte [rsp + 0x26]
mov byte [rsp + 5], r13b
movzx r13d, byte [rsp + 0x1b]
mov byte [rsp + 0xf], al
sub ecx, edx
mov byte [rsp + 0x10], cl
xor ebx, esi
mov byte [rsp + 0x11], bl
sub edi, r8d
mov byte [rsp + 0x12], dil
sub r9d, r10d
mov byte [rsp + 0x13], r9b
lea eax, [r12 + r11]
mov byte [rsp + 0x14], al
movzx eax, byte [rsp + 6]
sub eax, r15d
mov byte [rsp + 0x15], al
movzx eax, byte [rsp + 5]
sub eax, r13d
mov byte [rsp + 0x16], al
mov qword [rsp + 7], 0
xor eax, eax
jmp 0x555745
movzx ecx, byte [rsp + rax + 0xf]
mov byte [rsp + rax + 7], cl
inc rax
cmp rax, 8
jl 0x555739
mov rax, qword [rsp + 7]
mov qword [rsp + 0x38], rax
mov rbp, qword [rsp + 0x28]
add rsp, 0x30
ret
Function at 0x556400
Capabilities:
Encrypt data using rc4 prga

Disassembly:
sub rsp, 0x38
mov qword [rsp + 0x30], rbp
lea rbp, [rsp + 0x30]
mov qword [rsp + 0x40], 0
movabs rdx, 0x9c2ff896a5e9d8a7
mov qword [rsp + 0x1e], rdx
movabs rdx, 0x205020705020204
mov qword [rsp + 0x26], rdx
mov word [rsp + 0x2e], 0x706
xor eax, eax
nop
jmp 0x556460
movzx r8d, byte [rsp + rbx + 0x1e]
lea edx, [r8 + rdx]
lea edx, [rdx + 0x37]
mov byte [rsp + rsi + 0x1e], dl
mov byte [rsp + rbx + 0x1e], dil
add rax, 2
nop dword [rax]
cmp rax, 0xa
jge 0x55648f
movzx edx, byte [rsp + rax + 0x26]
movzx ebx, byte [rsp + rax + 0x27]
mov esi, edx
xor edx, ebx
add edx, eax
cmp rsi, 8
jae 0x5564ce
movzx edi, byte [rsp + rsi + 0x1e]
lea edi, [rdi + rdx]
lea edi, [rdi + 0x37]
cmp rbx, 8
jb 0x556442
jmp 0x5564c2
mov qword [rsp + 0x16], 0
xor eax, eax
jmp 0x5564a8
movzx ecx, byte [rsp + rax + 0x1e]
mov byte [rsp + rax + 0x16], cl
inc rax
cmp rax, 8
jl 0x55649c
mov rax, qword [rsp + 0x16]
mov qword [rsp + 0x40], rax
mov rbp, qword [rsp + 0x30]
add rsp, 0x38
ret
mov eax, ebx
mov ecx, 8
call fcn.0045f500
mov eax, esi
mov ecx, 8
call fcn.0045f500
nop
int3

Function at 0x5569a0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
sub rsp, 0x30
mov qword [rsp + 0x28], rbp
lea rbp, [rsp + 0x28]
mov qword [rsp + 0x38], 0
movabs rdx, 0x816848a65c284883
mov qword [rsp + 0x20], rdx
movabs rdx, 0x606070700030107
mov qword [rsp + 0x10], rdx
xor eax, eax
jmp 0x5569f3
movzx r8d, byte [rsp + rbx + 0x20]
lea edx, [r8 + rdx]
lea edx, [rdx + 0x52]
mov byte [rsp + rsi + 0x20], dl
mov byte [rsp + rbx + 0x20], dil
add rax, 2
cmp rax, 8
jge 0x556a28
movzx edx, byte [rsp + rax + 0x10]
movzx ebx, byte [rsp + rax + 0x11]
mov esi, edx
xor edx, ebx
add edx, eax
cmp rsi, 8
jae 0x556a67
movzx edi, byte [rsp + rsi + 0x20]
lea edi, [rdi + rdx]
lea edi, [rdi + 0x52]
nop word [rax + rax]
cmp rbx, 8
jb 0x5569d9
jmp 0x556a5b
mov qword [rsp + 0x18], 0
xor eax, eax
jmp 0x556a41
movzx ecx, byte [rsp + rax + 0x20]
mov byte [rsp + rax + 0x18], cl
inc rax
cmp rax, 8
jl 0x556a35
mov rax, qword [rsp + 0x18]
mov qword [rsp + 0x38], rax
mov rbp, qword [rsp + 0x28]
add rsp, 0x30
ret
mov eax, ebx
mov ecx, 8
call fcn.0045f500
mov eax, esi
mov ecx, 8
call fcn.0045f500
nop
int3