joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4fd100
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4fd1ed
sub rsp, 0x40
mov qword [rsp + 0x38], rbp
lea rbp, [rsp + 0x38]
movabs rdx, 0xe3636fedc8e57553
mov qword [rsp + 0x1f], rdx
movabs rdx, 0x65e069e3636fedc8
mov qword [rsp + 0x22], rdx
movabs rdx, 0x602090607010506
mov qword [rsp + 0x2a], rdx
movabs rdx, 0x303050407020602
mov qword [rsp + 0x30], rdx
xor eax, eax
jmp 0x4fd175
movzx r9d, byte [rsp + rsi + 0x1f]
sub r9d, edx
lea edx, [r9 - 0x76]
mov byte [rsp + rdi + 0x1f], dl
lea edx, [r8 - 0x76]
mov byte [rsp + rsi + 0x1f], dl
add rax, 2
cmp rax, 0xe
jge 0x4fd1ac
movzx edx, byte [rsp + rax + 0x2a]
lea rsi, [rax + 1]
cmp rsi, 0xe
jae 0x4fd1df
movzx esi, byte [rsp + rax + 0x2b]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0xb
jae 0x4fd1d3
movzx r8d, byte [rsp + rdi + 0x1f]
sub r8d, edx
cmp rsi, 0xb
jb 0x4fd158
jmp 0x4fd1c7
xor eax, eax
lea rbx, [rsp + 0x1f]
mov ecx, 0xb
call fcn.00443880
mov rbp, qword [rsp + 0x38]
add rsp, 0x40
ret
mov eax, esi
mov ecx, 0xb
call fcn.00456360
mov eax, edi
mov ecx, 0xb
call fcn.00456360
mov rax, rsi
mov ecx, 0xe
call fcn.00456360
nop
call fcn.00453c40
jmp fcn.004fd100

Function at 0x4fd9a0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4fdab3
sub rsp, 0x50
mov qword [rsp + 0x48], rbp
lea rbp, [rsp + 0x48]
movabs rdx, 0x515b6d524e744753
mov qword [rsp + 0x19], rdx
movabs rdx, 0x5e52414044694151
mov qword [rsp + 0x20], rdx
movabs rdx, 0x5b5e285353696264
mov qword [rsp + 0x28], rdx
movabs rdx, 0xe010a080b0e1606
mov qword [rsp + 0x30], rdx
movabs rdx, 0xc140d040a131110
mov qword [rsp + 0x38], rdx
movabs rdx, 0x1513070108080b0e
mov qword [rsp + 0x40], rdx
xor eax, eax
jmp 0x4fda30
movzx r9d, byte [rsp + rsi + 0x19]
lea edx, [r9 + rdx]
lea edx, [rdx - 6]
mov byte [rsp + rdi + 0x19], dl
mov byte [rsp + rsi + 0x19], r8b
add rax, 2
cmp rax, 0x18
jge 0x4fda6d
movzx edx, byte [rsp + rax + 0x30]
lea rsi, [rax + 1]
nop
cmp rsi, 0x18
jae 0x4fdaa5
movzx esi, byte [rsp + rax + 0x31]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x17
jae 0x4fda94
movzx r8d, byte [rsp + rdi + 0x19]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 6]
cmp rsi, 0x17
jb 0x4fda16
jmp 0x4fda88
xor eax, eax
lea rbx, [rsp + 0x19]
mov ecx, 0x17
call fcn.00443880
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
mov eax, esi
mov ecx, 0x17
call fcn.00456360
mov eax, edi
mov ecx, 0x17
nop dword [rax + rax]
call fcn.00456360
mov rax, rsi
mov ecx, 0x18
call fcn.00456360
nop
call fcn.00453c40
jmp fcn.004fd9a0
Function at 0x501720
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x50182b
sub rsp, 0x50
mov qword [rsp + 0x48], rbp
lea rbp, [rsp + 0x48]
movabs rdx, 0x2372434660623057
mov qword [rsp + 0x1a], rdx
movabs rdx, 0x47435d521d5f2372
mov qword [rsp + 0x20], rdx
movabs rdx, 0x1e744c623d626665
mov qword [rsp + 0x28], rdx
movabs rdx, 0x10713110d0c1513
mov qword [rsp + 0x30], rdx
movabs rdx, 0x702030802090512
mov qword [rsp + 0x38], rdx
movabs rdx, 0x15090a0b0a01120f
mov qword [rsp + 0x40], rdx
xor eax, eax
jmp 0x5017b3
movzx r9d, byte [rsp + rsi + 0x1a]
sub r9d, edx
lea edx, [r9 + 0x2c]
mov byte [rsp + rdi + 0x1a], dl
lea edx, [r8 + 0x2c]
mov byte [rsp + rsi + 0x1a], dl
add rax, 2
cmp rax, 0x18
jge 0x5017ea
movzx edx, byte [rsp + rax + 0x30]
lea rsi, [rax + 1]
cmp rsi, 0x18
jae 0x50181d
movzx esi, byte [rsp + rax + 0x31]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x16
jae 0x501811
movzx r8d, byte [rsp + rdi + 0x1a]
sub r8d, edx
cmp rsi, 0x16
jb 0x501796
jmp 0x501805
xor eax, eax
lea rbx, [rsp + 0x1a]
mov ecx, 0x16
call fcn.00443880
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
mov eax, esi
mov ecx, 0x16
call fcn.00456360
mov eax, edi
mov ecx, 0x16
call fcn.00456360
mov rax, rsi
mov ecx, 0x18
call fcn.00456360
nop
call fcn.00453c40
jmp fcn.00501720

Function at 0x5024e0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x5025ff
sub rsp, 0x58
mov qword [rsp + 0x50], rbp
lea rbp, [rsp + 0x50]
movabs rdx, 0x6f4a3c466474655b
mov qword [rsp + 0x1d], rdx
movabs rdx, 0x666b4949686f4a3c
mov qword [rsp + 0x22], rdx
movabs rdx, 0x7b6b716c617d726f
mov qword [rsp + 0x2a], rdx
movabs rdx, 0xb0f031111090e11
mov qword [rsp + 0x32], rdx
movabs rdx, 0x505141408040509
mov qword [rsp + 0x3a], rdx
movabs rdx, 0xf0f0509080f0505
mov qword [rsp + 0x40], rdx
movabs rdx, 0xf00110811051213
mov qword [rsp + 0x48], rdx
xor eax, eax
jmp 0x502580
movzx r9d, byte [rsp + rsi + 0x1d]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x19]
mov byte [rsp + rdi + 0x1d], dl
mov byte [rsp + rsi + 0x1d], r8b
add rax, 2
nop
cmp rax, 0x1e
jge 0x5025bc
movzx edx, byte [rsp + rax + 0x32]
lea rsi, [rax + 1]
cmp rsi, 0x1e
jae 0x5025f1
movzx esi, byte [rsp + rax + 0x33]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x15
jae 0x5025e5
movzx r8d, byte [rsp + rdi + 0x1d]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x19]
cmp rsi, 0x15
jb 0x502565
jmp 0x5025d7
xor eax, eax
lea rbx, [rsp + 0x1d]
mov ecx, 0x15
call fcn.00443880
mov rbp, qword [rsp + 0x50]
add rsp, 0x58
ret
mov eax, esi
mov ecx, 0x15
nop
call fcn.00456360
mov eax, edi
mov ecx, 0x15
call fcn.00456360
mov rax, rsi
mov ecx, 0x1e
call fcn.00456360
nop
nop
call fcn.00453c40
jmp fcn.005024e0
Function at 0x503880
Capabilities:
Encrypt data using rc4 prga

Disassembly:
lea r12, [rsp - 0x18]
cmp r12, qword [r14 + 0x10]
jbe 0x503a34
sub rsp, 0x98
mov qword [rsp + 0x90], rbp
lea rbp, [rsp + 0x90]
movabs rdx, 0x61af739c976c8b5f
mov qword [rsp + 0x1b], rdx
movabs rdx, 0x954a656d61683348
mov qword [rsp + 0x23], rdx
movabs rdx, 0x76c1743d9a6a7295
mov qword [rsp + 0x2a], rdx
movabs rdx, 0x8151a9ad74a39b65
mov qword [rsp + 0x32], rdx
movabs rdx, 0x865764734d556d53
mov qword [rsp + 0x3a], rdx
movabs rdx, 0xc95a3ab84043789c
mov qword [rsp + 0x42], rdx
movabs rdx, 0x60115150f120418
mov qword [rsp + 0x4a], rdx
movabs rdx, 0x1a151c231d190601
mov qword [rsp + 0x50], rdx
movabs rdx, 0x2627232811031b03
mov qword [rsp + 0x58], rdx
movabs rdx, 0x1b0a2e2b0f002b2e
mov qword [rsp + 0x60], rdx
movabs rdx, 0x282d10180a230e21
mov qword [rsp + 0x68], rdx
movabs rdx, 0x1d1e0823192d2915
mov qword [rsp + 0x70], rdx
movabs rdx, 0x2a1f081b281b0018
mov qword [rsp + 0x78], rdx
movabs rdx, 0x220f082709222b24
mov qword [rsp + 0x80], rdx
movabs rdx, 0x2921132d2c0e1b15
mov qword [rsp + 0x88], rdx
xor eax, eax
jmp 0x5039ab
movzx r9d, byte [rsp + rsi + 0x1b]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x48]
mov byte [rsp + rdi + 0x1b], dl
mov byte [rsp + rsi + 0x1b], r8b
add rax, 2
cmp rax, 0x46
jge 0x5039ed
movzx edx, byte [rsp + rax + 0x4a]
lea rsi, [rax + 1]
nop word [rax + rax]
cmp rsi, 0x46
jae 0x503a26
movzx esi, byte [rsp + rax + 0x4b]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x2f
jae 0x503a1a
movzx r8d, byte [rsp + rdi + 0x1b]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x48]
cmp rsi, 0x2f
jb 0x503991
jmp 0x503a0e
xor eax, eax
lea rbx, [rsp + 0x1b]
mov ecx, 0x2f
call fcn.00443880
mov rbp, qword [rsp + 0x90]
add rsp, 0x98
ret
mov eax, esi
mov ecx, 0x2f
call fcn.00456360
mov eax, edi
mov ecx, 0x2f
call fcn.00456360
mov rax, rsi
mov ecx, 0x46
call fcn.00456360
nop
call fcn.00453c40
jmp fcn.00503880

Function at 0x503ea0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x503f93
sub rsp, 0x40
mov qword [rsp + 0x38], rbp
lea rbp, [rsp + 0x38]
movabs rdx, 0x5874d6bf49c64352
mov qword [rsp + 0x1b], rdx
movabs rdx, 0x3cb6693d745874d6
mov qword [rsp + 0x20], rdx
movabs rdx, 0x50b07020104010b
mov qword [rsp + 0x28], rdx
movabs rdx, 0x4020c0402090201
mov qword [rsp + 0x30], rdx
xor eax, eax
jmp 0x503f12
movzx r9d, byte [rsp + rsi + 0x1b]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x7c]
mov byte [rsp + rdi + 0x1b], dl
mov byte [rsp + rsi + 0x1b], r8b
add rax, 2
cmp rax, 0x10
jge 0x503f4e
movzx edx, byte [rsp + rax + 0x28]
lea rsi, [rax + 1]
cmp rsi, 0x10
jae 0x503f85
movzx esi, byte [rsp + rax + 0x29]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0xd
jae 0x503f75
movzx r8d, byte [rsp + rdi + 0x1b]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x7c]
cmp rsi, 0xd
jb 0x503ef8
jmp 0x503f69
xor eax, eax
lea rbx, [rsp + 0x1b]
mov ecx, 0xd
call fcn.00443880
mov rbp, qword [rsp + 0x38]
add rsp, 0x40
ret
mov eax, esi
mov ecx, 0xd
call fcn.00456360
mov eax, edi
mov ecx, 0xd
nop dword [rax]
call fcn.00456360
mov rax, rsi
mov ecx, 0x10
call fcn.00456360
nop
call fcn.00453c40
jmp fcn.00503ea0
Function at 0x503fa0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x5040ab
sub rsp, 0x50
mov qword [rsp + 0x48], rbp
lea rbp, [rsp + 0x48]
movabs rdx, 0xf950698a1074ed52
mov qword [rsp + 0x1c], rdx
movabs rdx, 0xf740fd6ef950698a
mov qword [rsp + 0x20], rdx
movabs rdx, 0x736e6a07740a6564
mov qword [rsp + 0x28], rdx
movabs rdx, 0x6060b110a130a09
mov qword [rsp + 0x30], rdx
movabs rdx, 0x102091309030a0b
mov qword [rsp + 0x38], rdx
movabs rdx, 0xe13060710010401
mov qword [rsp + 0x40], rdx
xor eax, eax
jmp 0x504033
movzx r9d, byte [rsp + rsi + 0x1c]
sub r9d, edx
lea edx, [r9 - 0x70]
mov byte [rsp + rdi + 0x1c], dl
lea edx, [r8 - 0x70]
mov byte [rsp + rsi + 0x1c], dl
add rax, 2
cmp rax, 0x18
jge 0x50406a
movzx edx, byte [rsp + rax + 0x30]
lea rsi, [rax + 1]
cmp rsi, 0x18
jae 0x50409d
movzx esi, byte [rsp + rax + 0x31]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x14
jae 0x504091
movzx r8d, byte [rsp + rdi + 0x1c]
sub r8d, edx
cmp rsi, 0x14
jb 0x504016
jmp 0x504085
xor eax, eax
lea rbx, [rsp + 0x1c]
mov ecx, 0x14
call fcn.00443880
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
mov eax, esi
mov ecx, 0x14
call fcn.00456360
mov eax, edi
mov ecx, 0x14
call fcn.00456360
mov rax, rsi
mov ecx, 0x18
call fcn.00456360
nop
call fcn.00453c40
jmp fcn.00503fa0

Function at 0x505b60
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x505c4d
sub rsp, 0x40
mov qword [rsp + 0x38], rbp
lea rbp, [rsp + 0x38]
movabs rdx, 0x737a766c68487053
mov qword [rsp + 0x1b], rdx
movabs rdx, 0x827f746481737a76
mov qword [rsp + 0x20], rdx
movabs rdx, 0x10201030502060b
mov qword [rsp + 0x28], rdx
movabs rdx, 0x90c03010108070b
mov qword [rsp + 0x30], rdx
xor eax, eax
jmp 0x505bd5
movzx r9d, byte [rsp + rsi + 0x1b]
sub r9d, edx
lea edx, [r9 + 6]
mov byte [rsp + rdi + 0x1b], dl
lea edx, [r8 + 6]
mov byte [rsp + rsi + 0x1b], dl
add rax, 2
cmp rax, 0x10
jge 0x505c0c
movzx edx, byte [rsp + rax + 0x28]
lea rsi, [rax + 1]
cmp rsi, 0x10
jae 0x505c3f
movzx esi, byte [rsp + rax + 0x29]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0xd
jae 0x505c33
movzx r8d, byte [rsp + rdi + 0x1b]
sub r8d, edx
cmp rsi, 0xd
jb 0x505bb8
jmp 0x505c27
xor eax, eax
lea rbx, [rsp + 0x1b]
mov ecx, 0xd
call fcn.00443880
mov rbp, qword [rsp + 0x38]
add rsp, 0x40
ret
mov eax, esi
mov ecx, 0xd
call fcn.00456360
mov eax, edi
mov ecx, 0xd
call fcn.00456360
mov rax, rsi
mov ecx, 0x10
call fcn.00456360
nop
call fcn.00453c40
jmp fcn.00505b60
Function at 0x507c00
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x507d1f
sub rsp, 0x58
mov qword [rsp + 0x50], rbp
lea rbp, [rsp + 0x50]
movabs rdx, 0x54c4aec35f13257
mov qword [rsp + 0x1e], rdx
movabs rdx, 0xf70336c15cb054c
mov qword [rsp + 0x24], rdx
movabs rdx, 0x27190373531e6465
mov qword [rsp + 0x2c], rdx
movabs rdx, 0x40b081307031008
mov qword [rsp + 0x34], rdx
movabs rdx, 0x110d061503140810
mov qword [rsp + 0x3c], rdx
movabs rdx, 0xb021101110d0615
mov qword [rsp + 0x40], rdx
movabs rdx, 0x20b051103080902
mov qword [rsp + 0x48], rdx
xor eax, eax
jmp 0x507ca2
movzx r9d, byte [rsp + rsi + 0x1e]
sub r9d, edx
lea edx, [r9 + 0x47]
mov byte [rsp + rdi + 0x1e], dl
lea edx, [r8 + 0x47]
mov byte [rsp + rsi + 0x1e], dl
add rax, 2
cmp rax, 0x1c
jge 0x507cd9
movzx edx, byte [rsp + rax + 0x34]
lea rsi, [rax + 1]
cmp rsi, 0x1c
jae 0x507d11
movzx esi, byte [rsp + rax + 0x35]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x16
jae 0x507d05
movzx r8d, byte [rsp + rdi + 0x1e]
sub r8d, edx
cmp rsi, 0x16
jb 0x507c85
jmp 0x507cf4
xor eax, eax
lea rbx, [rsp + 0x1e]
mov ecx, 0x16
call fcn.00443880
mov rbp, qword [rsp + 0x50]
add rsp, 0x58
ret
mov eax, esi
mov ecx, 0x16
nop dword [rax + rax]
call fcn.00456360
mov eax, edi
mov ecx, 0x16
call fcn.00456360
mov rax, rsi
mov ecx, 0x1c
call fcn.00456360
nop
nop
call fcn.00453c40
jmp fcn.00507c00

Function at 0x508a20
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x508b0d
sub rsp, 0x40
mov qword [rsp + 0x38], rbp
lea rbp, [rsp + 0x38]
movabs rdx, 0x2a3aa63cfc323545
mov qword [rsp + 0x1d], rdx
movabs rdx, 0x106d142a3aa63cfc
mov qword [rsp + 0x20], rdx
movabs rdx, 0x702080707050203
mov qword [rsp + 0x28], rdx
movabs rdx, 0x104000601080a04
mov qword [rsp + 0x30], rdx
xor eax, eax
jmp 0x508a95
movzx r9d, byte [rsp + rsi + 0x1d]
sub r9d, edx
lea edx, [r9 + 0x3f]
mov byte [rsp + rdi + 0x1d], dl
lea edx, [r8 + 0x3f]
mov byte [rsp + rsi + 0x1d], dl
add rax, 2
cmp rax, 0x10
jge 0x508acc
movzx edx, byte [rsp + rax + 0x28]
lea rsi, [rax + 1]
cmp rsi, 0x10
jae 0x508aff
movzx esi, byte [rsp + rax + 0x29]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0xb
jae 0x508af3
movzx r8d, byte [rsp + rdi + 0x1d]
sub r8d, edx
cmp rsi, 0xb
jb 0x508a78
jmp 0x508ae7
xor eax, eax
lea rbx, [rsp + 0x1d]
mov ecx, 0xb
call fcn.00443880
mov rbp, qword [rsp + 0x38]
add rsp, 0x40
ret
mov eax, esi
mov ecx, 0xb
call fcn.00456360
mov eax, edi
mov ecx, 0xb
call fcn.00456360
mov rax, rsi
mov ecx, 0x10
call fcn.00456360
nop
call fcn.00453c40
jmp fcn.00508a20
Function at 0x5278a0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x5279e9
sub rsp, 0x70
mov qword [rsp + 0x68], rbp
lea rbp, [rsp + 0x68]
movabs rdx, 0xef61f5f2d7657865
mov qword [rsp + 0x1f], rdx
movabs rdx, 0xe4e5f3ef61f5f2d7
mov qword [rsp + 0x22], rdx
movabs rdx, 0x740df1d199e86973
mov qword [rsp + 0x2a], rdx
movabs rdx, 0xfeeaca8f756f1ed4
mov qword [rsp + 0x32], rdx
movabs rdx, 0xccd05c8950250a6e
mov qword [rsp + 0x3a], rdx
movabs rdx, 0x180d0810041a070e
mov qword [rsp + 0x42], rdx
movabs rdx, 0x17051c140703180d
mov qword [rsp + 0x48], rdx
movabs rdx, 0xb0a20210e091419
mov qword [rsp + 0x50], rdx
movabs rdx, 0x1105211c1f0d0f22
mov qword [rsp + 0x58], rdx
movabs rdx, 0x90d1921030a131f
mov qword [rsp + 0x60], rdx
xor eax, eax
jmp 0x52796f
movzx r9d, byte [rsp + rsi + 0x1f]
sub r9d, edx
lea edx, [r9 - 0x69]
mov byte [rsp + rdi + 0x1f], dl
lea edx, [r8 - 0x69]
mov byte [rsp + rsi + 0x1f], dl
add rax, 2
cmp rax, 0x26
jge 0x5279a8
movzx edx, byte [rsp + rax + 0x42]
lea rsi, [rax + 1]
nop
cmp rsi, 0x26
jae 0x5279db
movzx esi, byte [rsp + rax + 0x43]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x23
jae 0x5279cf
movzx r8d, byte [rsp + rdi + 0x1f]
sub r8d, edx
cmp rsi, 0x23
jb 0x527952
jmp 0x5279c3
xor eax, eax
lea rbx, [rsp + 0x1f]
mov ecx, 0x23
call fcn.00443880
mov rbp, qword [rsp + 0x68]
add rsp, 0x70
ret
mov eax, esi
mov ecx, 0x23
call fcn.00456360
mov eax, edi
mov ecx, 0x23
call fcn.00456360
mov rax, rsi
mov ecx, 0x26
call fcn.00456360
nop
call fcn.00453c40
jmp fcn.005278a0

Function at 0x5298e0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x5299d3
sub rsp, 0x40
mov qword [rsp + 0x38], rbp
lea rbp, [rsp + 0x38]
movabs rdx, 0x4ff9b0d57479d1ee
mov qword [rsp + 0x1d], rdx
movabs rdx, 0xf74d2e4ff9b0d574
mov qword [rsp + 0x20], rdx
movabs rdx, 0x604060907090705
mov qword [rsp + 0x28], rdx
movabs rdx, 0x1010a00060a07
mov qword [rsp + 0x30], rdx
xor eax, eax
jmp 0x529952
movzx r9d, byte [rsp + rsi + 0x1d]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x22]
mov byte [rsp + rdi + 0x1d], dl
mov byte [rsp + rsi + 0x1d], r8b
add rax, 2
cmp rax, 0x10
jge 0x52998e
movzx edx, byte [rsp + rax + 0x28]
lea rsi, [rax + 1]
cmp rsi, 0x10
jae 0x5299c5
movzx esi, byte [rsp + rax + 0x29]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0xb
jae 0x5299b5
movzx r8d, byte [rsp + rdi + 0x1d]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x22]
cmp rsi, 0xb
jb 0x529938
jmp 0x5299a9
xor eax, eax
lea rbx, [rsp + 0x1d]
mov ecx, 0xb
call fcn.00443880
mov rbp, qword [rsp + 0x38]
add rsp, 0x40
ret
mov eax, esi
mov ecx, 0xb
call fcn.00456360
mov eax, edi
mov ecx, 0xb
nop dword [rax]
call fcn.00456360
mov rax, rsi
mov ecx, 0x10
call fcn.00456360
nop
call fcn.00453c40
jmp fcn.005298e0
Function at 0x529a40
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x529b29
sub rsp, 0x38
mov qword [rsp + 0x30], rbp
lea rbp, [rsp + 0x30]
movabs rdx, 0x4d5f5858564d5153
mov qword [rsp + 0x18], rdx
mov word [rsp + 0x20], 0x544c
movabs rdx, 0x502060307040106
mov qword [rsp + 0x22], rdx
movabs rdx, 0x707030802020502
mov qword [rsp + 0x28], rdx
xor eax, eax
jmp 0x529aaa
movzx r9d, byte [rsp + rsi + 0x18]
lea edx, [r9 + rdx]
lea edx, [rdx - 0xd]
mov byte [rsp + rdi + 0x18], dl
mov byte [rsp + rsi + 0x18], r8b
add rax, 2
cmp rax, 0xe
jge 0x529ae8
movzx edx, byte [rsp + rax + 0x22]
lea rsi, [rax + 1]
cmp rsi, 0xe
jae 0x529b1b
movzx esi, byte [rsp + rax + 0x23]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0xa
jae 0x529b0f
movzx r8d, byte [rsp + rdi + 0x18]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0xd]
nop
cmp rsi, 0xa
jb 0x529a90
jmp 0x529b03
xor eax, eax
lea rbx, [rsp + 0x18]
mov ecx, 0xa
call fcn.00443880
mov rbp, qword [rsp + 0x30]
add rsp, 0x38
ret
mov eax, esi
mov ecx, 0xa
call fcn.00456360
mov eax, edi
mov ecx, 0xa
call fcn.00456360
mov rax, rsi
mov ecx, 0xe
call fcn.00456360
nop
call fcn.00453c40
jmp fcn.00529a40

Function at 0x52a5c0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x52a695
sub rsp, 0x30
mov qword [rsp + 0x28], rbp
lea rbp, [rsp + 0x28]
mov dword [rsp + 0x19], 0x2c20010b
mov dword [rsp + 0x1c], 0x541c452c
movabs rdx, 0x203000500000501
mov qword [rsp + 0x20], rdx
xor eax, eax
jmp 0x52a615
movzx r9d, byte [rsp + rsi + 0x19]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x21]
mov byte [rsp + rdi + 0x19], dl
mov byte [rsp + rsi + 0x19], r8b
add rax, 2
cmp rax, 8
jge 0x52a651
movzx edx, byte [rsp + rax + 0x20]
lea rsi, [rax + 1]
cmp rsi, 8
jae 0x52a687
movzx esi, byte [rsp + rax + 0x21]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 7
jae 0x52a67b
movzx r8d, byte [rsp + rdi + 0x19]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x21]
cmp rsi, 7
jb 0x52a5fb
jmp 0x52a66f
xor eax, eax
lea rbx, [rsp + 0x19]
mov ecx, 7
nop dword [rax]
call fcn.00443880
mov rbp, qword [rsp + 0x28]
add rsp, 0x30
ret
mov eax, esi
mov ecx, 7
call fcn.00456360
mov eax, edi
mov ecx, 7
call fcn.00456360
mov rax, rsi
mov ecx, 8
call fcn.00456360
nop
call fcn.00453c40
jmp fcn.0052a5c0
Function at 0x52c6a0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x52c809
add rsp, 0xffffffffffffff80
mov qword [rsp + 0x78], rbp
lea rbp, [rsp + 0x78]
movabs rdx, 0x25d250edff79e8bb
mov qword [rsp + 0x1e], rdx
movabs rdx, 0xfe333c6925d250ed
mov qword [rsp + 0x22], rdx
movabs rdx, 0xf675234d2f16296f
mov qword [rsp + 0x2a], rdx
movabs rdx, 0x6c5e3d207a6f358c
mov qword [rsp + 0x32], rdx
movabs rdx, 0x4226ea55130e2671
mov qword [rsp + 0x3a], rdx
movabs rdx, 0x2309001d1c140c0e
mov qword [rsp + 0x42], rdx
movabs rdx, 0x150a21100e062309
mov qword [rsp + 0x48], rdx
movabs rdx, 0x1d10010720151e1f
mov qword [rsp + 0x50], rdx
movabs rdx, 0xd0b04060307141c
mov qword [rsp + 0x58], rdx
movabs rdx, 0x10190f1c110f1a21
mov qword [rsp + 0x60], rdx
movabs rdx, 0x41f110522041d13
mov qword [rsp + 0x68], rdx
movabs rdx, 0x230117201f07070f
mov qword [rsp + 0x70], rdx
xor eax, eax
jmp 0x52c78d
movzx r9d, byte [rsp + rsi + 0x1e]
sub r9d, edx
lea edx, [r9 + 0x5e]
mov byte [rsp + rdi + 0x1e], dl
lea edx, [r8 + 0x5e]
mov byte [rsp + rsi + 0x1e], dl
add rax, 2
cmp rax, 0x36
jge 0x52c7c8
movzx edx, byte [rsp + rax + 0x42]
lea rsi, [rax + 1]
nop dword [rax]
cmp rsi, 0x36
jae 0x52c7fb
movzx esi, byte [rsp + rax + 0x43]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x24
jae 0x52c7ef
movzx r8d, byte [rsp + rdi + 0x1e]
sub r8d, edx
cmp rsi, 0x24
jb 0x52c770
jmp 0x52c7e3
xor eax, eax
lea rbx, [rsp + 0x1e]
mov ecx, 0x24
call fcn.00443880
mov rbp, qword [rsp + 0x78]
sub rsp, 0xffffffffffffff80
ret
mov eax, esi
mov ecx, 0x24
call fcn.00456360
mov eax, edi
mov ecx, 0x24
call fcn.00456360
mov rax, rsi
mov ecx, 0x36
call fcn.00456360
nop
call fcn.00453c40
jmp fcn.0052c6a0
Function at 0x52dbc0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
lea r12, [rsp - 8]
cmp r12, qword [r14 + 0x10]
jbe 0x52dd53
sub rsp, 0x88
mov qword [rsp + 0x80], rbp
lea rbp, [rsp + 0x80]
movabs rdx, 0x31abd674701eeee2
mov qword [rsp + 0x1e], rdx
movabs rdx, 0xc8c77636654770d8
mov qword [rsp + 0x26], rdx
movabs rdx, 0xf373d5151823a975
mov qword [rsp + 0x2e], rdx
movabs rdx, 0x8a7420ee9fd57961
mov qword [rsp + 0x36], rdx
movabs rdx, 0x80cc31c769202bdb
mov qword [rsp + 0x3e], rdx
movabs rdx, 0x8241c17010a1226
mov qword [rsp + 0x46], rdx
movabs rdx, 0xf25191b2519240a
mov qword [rsp + 0x4e], rdx
movabs rdx, 0x27070f25191b2519
mov qword [rsp + 0x50], rdx
movabs rdx, 0x524070c15130f
mov qword [rsp + 0x58], rdx
movabs rdx, 0x1515190e1a022101
mov qword [rsp + 0x60], rdx
movabs rdx, 0xe140a1a2620150d
mov qword [rsp + 0x68], rdx
movabs rdx, 0xe0e1f0d0e012427
mov qword [rsp + 0x70], rdx
movabs rdx, 0x6271a1a07111f0f
mov qword [rsp + 0x78], rdx
xor eax, eax
jmp 0x52dcc7
movzx r9d, byte [rsp + rsi + 0x1e]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x70]
mov byte [rsp + rdi + 0x1e], dl
mov byte [rsp + rsi + 0x1e], r8b
add rax, 2
cmp rax, 0x3a
jge 0x52dd08
movzx edx, byte [rsp + rax + 0x46]
lea rsi, [rax + 1]
cmp rsi, 0x3a
jae 0x52dd45
movzx esi, byte [rsp + rax + 0x47]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x28
jae 0x52dd35
movzx r8d, byte [rsp + rdi + 0x1e]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x70]
nop dword [rax + rax]
cmp rsi, 0x28
jb 0x52dcad
jmp 0x52dd29
xor eax, eax
lea rbx, [rsp + 0x1e]
mov ecx, 0x28
call fcn.00443880
mov rbp, qword [rsp + 0x80]
add rsp, 0x88
ret
mov eax, esi
mov ecx, 0x28
call fcn.00456360
mov eax, edi
mov ecx, 0x28
nop dword [rax]
call fcn.00456360
mov rax, rsi
mov ecx, 0x3a
call fcn.00456360
nop
call fcn.00453c40
jmp fcn.0052dbc0

Function at 0x52e600
Capabilities:
Encode data using xor

Disassembly:
mov rbx, qword [rsp + 8]
mov rsi, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdx, qword [rsp + 0x20]
test rdx, 0xf
jne 0x52e66b
mov rax, 0
movdqu xmm0, xmmword [rsi + rax]
movdqu xmm1, xmmword [rcx + rax]
pxor xmm0, xmm1
movdqu xmmword [rbx + rax], xmm0
add rax, 0x10
cmp rdx, rax
jne 0x52e624
ret
sub rdx, 1
mov dil, byte [rsi + rdx]
mov al, byte [rcx + rdx]
xor dil, al
mov byte [rbx + rdx], dil
test rdx, 7
jne 0x52e641
cmp rdx, 0
je 0x52e68d
test rdx, 0xf
je 0x52e61d
test rdx, 7
jne 0x52e641
sub rdx, 8
mov rdi, qword [rsi + rdx]
mov rax, qword [rcx + rdx]
xor rdi, rax
mov qword [rbx + rdx], rdi
cmp rdx, 0x10
jge 0x52e61d
ret
Function at 0x52fee0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
sub rsp, 0x50
mov qword [rsp + 0x48], rbp
lea rbp, [rsp + 0x48]
lea rdx, [rsp + 0x58]
movups xmmword [rdx], xmm15
movabs rdx, 0xbfd2d2dd08040201
mov qword [rsp + 0x26], rdx
movabs rdx, 0xcf9ae4e855af7251
mov qword [rsp + 0x2e], rdx
movabs rdx, 0x5060c09040f0805
mov qword [rsp + 0x36], rdx
movabs rdx, 0x80705060c09040f
mov qword [rsp + 0x38], rdx
movabs rdx, 0xb0a0a04060d0c0b
mov qword [rsp + 0x40], rdx
xor eax, eax
jmp 0x52ff60
movzx r8d, byte [rsp + rbx + 0x26]
lea edx, [r8 + rdx]
lea edx, [rdx + 0x45]
mov byte [rsp + rsi + 0x26], dl
mov byte [rsp + rbx + 0x26], dil
add rax, 2
cmp rax, 0x12
jge 0x52ff99
movzx edx, byte [rsp + rax + 0x36]
lea rbx, [rax + 1]
cmp rbx, 0x12
jae 0x52ffe5
movzx ebx, byte [rsp + rax + 0x37]
mov esi, edx
xor edx, ebx
add edx, eax
cmp rsi, 0x10
jae 0x52ffd8
movzx edi, byte [rsp + rsi + 0x26]
lea edi, [rdi + rdx]
lea edi, [rdi + 0x45]
cmp rbx, 0x10
jb 0x52ff46
jmp 0x52ffcc
lea rax, [rsp + 0x16]
movups xmmword [rax], xmm15
xor eax, eax
jmp 0x52ffb2
movzx ecx, byte [rsp + rax + 0x26]
mov byte [rsp + rax + 0x16], cl
inc rax
cmp rax, 0x10
jl 0x52ffa6
movups xmm0, xmmword [rsp + 0x16]
movups xmmword [rsp + 0x58], xmm0
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
mov eax, ebx
mov ecx, 0x10
call fcn.00456360
mov eax, esi
mov ecx, 0x10
nop
call fcn.00456360
mov rax, rbx
mov ecx, 0x12
call fcn.00456360
nop
int3