joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4e5340
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4e543d
push rbp
mov rbp, rsp
sub rsp, 0x48
movabs rdx, 0x527293ad796e8647
mov qword [rsp + 0x32], rdx
movabs rdx, 0x74779e6e8d765272
mov qword [rsp + 0x38], rdx
movabs rdx, 0xa7659a8180727453
mov qword [rsp + 0x40], rdx
movabs rdx, 0xc15060a1411020c
mov qword [rsp + 0x18], rdx
movabs rdx, 0xb12090b03080514
mov qword [rsp + 0x20], rdx
movabs rdx, 0x1030b12090b0308
mov qword [rsp + 0x22], rdx
movabs rdx, 0xc13091407030414
mov qword [rsp + 0x2a], rdx
xor eax, eax
jmp 0x4e53e0
movzx r9d, byte [rsp + rsi + 0x32]
sub r9d, edx
lea edx, [r9 + 0xb]
mov byte [rsp + rdi + 0x32], dl
lea edx, [r8 + 0xb]
mov byte [rsp + rsi + 0x32], dl
add rax, 2
nop dword [rax]
cmp rax, 0x1a
jge 0x4e540d
movzx edx, byte [rsp + rax + 0x18]
movzx esi, byte [rsp + rax + 0x19]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x16
jae 0x4e5430
movzx r8d, byte [rsp + rdi + 0x32]
sub r8d, edx
cmp rsi, 0x16
jb 0x4e53bf
jmp 0x4e5424
xor eax, eax
lea rbx, [rsp + 0x32]
mov ecx, 0x16
call fcn.00447260
add rsp, 0x48
pop rbp
ret
mov eax, esi
mov ecx, 0x16
call fcn.0045a040
mov eax, edi
mov ecx, 0x16
call fcn.0045a040
nop
nop dword [rax]
call fcn.00457d60
jmp fcn.004e5340

Function at 0x4e5d40
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4e5e2a
push rbp
mov rbp, rsp
sub rsp, 0x40
movabs rdx, 0x22a2699945749cdc
mov qword [rsp + 0x2e], rdx
movabs rdx, 0x64d022a269994574
mov qword [rsp + 0x30], rdx
movabs rdx, 0x83ea65636f77ebd3
mov qword [rsp + 0x38], rdx
movabs rdx, 0x4100c0b0a000a04
mov qword [rsp + 0x1a], rdx
movabs rdx, 0xc06080104100c0b
mov qword [rsp + 0x1e], rdx
movabs rdx, 0xa04110411070106
mov qword [rsp + 0x26], rdx
xor eax, eax
jmp 0x4e5dcd
movzx r9d, byte [rsp + rsi + 0x2e]
sub r9d, edx
lea edx, [r9 - 0x1c]
mov byte [rsp + rdi + 0x2e], dl
lea edx, [r8 - 0x1c]
mov byte [rsp + rsi + 0x2e], dl
add rax, 2
cmp rax, 0x14
jge 0x4e5dfa
movzx edx, byte [rsp + rax + 0x1a]
movzx esi, byte [rsp + rax + 0x1b]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x12
jae 0x4e5e1d
movzx r8d, byte [rsp + rdi + 0x2e]
sub r8d, edx
cmp rsi, 0x12
jb 0x4e5db0
jmp 0x4e5e11
xor eax, eax
lea rbx, [rsp + 0x2e]
mov ecx, 0x12
call fcn.00447260
add rsp, 0x40
pop rbp
ret
mov eax, esi
mov ecx, 0x12
call fcn.0045a040
mov eax, edi
mov ecx, 0x12
call fcn.0045a040
nop
call fcn.00457d60
jmp fcn.004e5d40
Function at 0x4e80c0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4e819d
push rbp
mov rbp, rsp
sub rsp, 0x40
movabs rdx, 0x63437b7179744175
mov qword [rsp + 0x32], rdx
movabs rdx, 0x52496572616e6343
mov qword [rsp + 0x38], rdx
movabs rdx, 0xd0608050d0d0606
mov qword [rsp + 0x1e], rdx
movabs rdx, 0x30d000c0d060805
mov qword [rsp + 0x22], rdx
movabs rdx, 0x904010108090107
mov qword [rsp + 0x2a], rdx
xor eax, eax
nop
jmp 0x4e8140
movzx r9d, byte [rsp + rsi + 0x32]
sub r9d, edx
lea edx, [r9 + 0x12]
mov byte [rsp + rdi + 0x32], dl
lea edx, [r8 + 0x12]
mov byte [rsp + rsi + 0x32], dl
add rax, 2
nop
cmp rax, 0x14
jge 0x4e816d
movzx edx, byte [rsp + rax + 0x1e]
movzx esi, byte [rsp + rax + 0x1f]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0xe
jae 0x4e8190
movzx r8d, byte [rsp + rdi + 0x32]
sub r8d, edx
cmp rsi, 0xe
jb 0x4e8122
jmp 0x4e8184
xor eax, eax
lea rbx, [rsp + 0x32]
mov ecx, 0xe
call fcn.00447260
add rsp, 0x40
pop rbp
ret
mov eax, esi
mov ecx, 0xe
call fcn.0045a040
mov eax, edi
mov ecx, 0xe
call fcn.0045a040
nop
nop dword [rax]
call fcn.00457d60
jmp fcn.004e80c0

Function at 0x4eb260
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4eb33d
push rbp
mov rbp, rsp
sub rsp, 0x40
movabs rdx, 0x90eeac5d637ab8a2
mov qword [rsp + 0x31], rdx
movabs rdx, 0x997e9cc669933290
mov qword [rsp + 0x38], rdx
movabs rdx, 0xb06050701090e02
mov qword [rsp + 0x1f], rdx
movabs rdx, 0x60c0b0605070109
mov qword [rsp + 0x21], rdx
movabs rdx, 0x7040902090b0d00
mov qword [rsp + 0x29], rdx
xor eax, eax
nop
jmp 0x4eb2e0
movzx r9d, byte [rsp + rsi + 0x31]
sub r9d, edx
lea edx, [r9 - 0x17]
mov byte [rsp + rdi + 0x31], dl
lea edx, [r8 - 0x17]
mov byte [rsp + rsi + 0x31], dl
add rax, 2
nop
cmp rax, 0x12
jge 0x4eb30d
movzx edx, byte [rsp + rax + 0x1f]
movzx esi, byte [rsp + rax + 0x20]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0xf
jae 0x4eb330
movzx r8d, byte [rsp + rdi + 0x31]
sub r8d, edx
cmp rsi, 0xf
jb 0x4eb2c2
jmp 0x4eb324
xor eax, eax
lea rbx, [rsp + 0x31]
mov ecx, 0xf
call fcn.00447260
add rsp, 0x40
pop rbp
ret
mov eax, esi
mov ecx, 0xf
call fcn.0045a040
mov eax, edi
mov ecx, 0xf
call fcn.0045a040
nop
nop dword [rax]
call fcn.00457d60
jmp fcn.004eb260
Function at 0x4ec3c0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4ec487
push rbp
mov rbp, rsp
sub rsp, 0x38
movabs rdx, 0x6694846945976577
mov qword [rsp + 0x2c], rdx
mov dword [rsp + 0x34], 0x7053b079
movabs rdx, 0x80a0600000b0604
mov qword [rsp + 0x1c], rdx
movabs rdx, 0x402020205090209
mov qword [rsp + 0x24], rdx
xor eax, eax
jmp 0x4ec428
movzx r9d, byte [rsp + rsi + 0x2c]
sub r9d, edx
lea edx, [r9 - 5]
mov byte [rsp + rdi + 0x2c], dl
lea edx, [r8 - 5]
mov byte [rsp + rsi + 0x2c], dl
add rax, 2
cmp rax, 0x10
jge 0x4ec457
movzx edx, byte [rsp + rax + 0x1c]
movzx esi, byte [rsp + rax + 0x1d]
mov edi, edx
xor edx, esi
add edx, eax
nop
cmp rdi, 0xc
jae 0x4ec47a
movzx r8d, byte [rsp + rdi + 0x2c]
sub r8d, edx
cmp rsi, 0xc
jb 0x4ec40b
jmp 0x4ec46e
xor eax, eax
lea rbx, [rsp + 0x2c]
mov ecx, 0xc
call fcn.00447260
add rsp, 0x38
pop rbp
ret
mov eax, esi
mov ecx, 0xc
call fcn.0045a040
mov eax, edi
mov ecx, 0xc
call fcn.0045a040
nop
call fcn.00457d60
jmp fcn.004ec3c0

Function at 0x4eece0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4eeddb
push rbp
mov rbp, rsp
sub rsp, 0x48
movabs rdx, 0x28726f1d03be61c1
mov qword [rsp + 0x35], rdx
movabs rdx, 0x316e2f28726f1d03
mov qword [rsp + 0x38], rdx
movabs rdx, 0xd8d656ab8bb6589
mov qword [rsp + 0x40], rdx
movabs rdx, 0xa080e00110e1200
mov qword [rsp + 0x1b], rdx
movabs rdx, 0xd030202110e0b0e
mov qword [rsp + 0x23], rdx
movabs rdx, 0x40b0d030202110e
mov qword [rsp + 0x25], rdx
movabs rdx, 0x703020411111200
mov qword [rsp + 0x2d], rdx
xor eax, eax
jmp 0x4eed79
movzx r9d, byte [rsp + rsi + 0x35]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x30]
mov byte [rsp + rdi + 0x35], dl
mov byte [rsp + rsi + 0x35], r8b
add rax, 2
cmp rax, 0x1a
jge 0x4eedab
movzx edx, byte [rsp + rax + 0x1b]
movzx esi, byte [rsp + rax + 0x1c]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x13
jae 0x4eedce
movzx r8d, byte [rsp + rdi + 0x35]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x30]
cmp rsi, 0x13
jb 0x4eed5f
jmp 0x4eedc2
xor eax, eax
lea rbx, [rsp + 0x35]
mov ecx, 0x13
call fcn.00447260
add rsp, 0x48
pop rbp
ret
mov eax, esi
mov ecx, 0x13
call fcn.0045a040
mov eax, edi
mov ecx, 0x13
call fcn.0045a040
nop
nop dword [rax + rax]
call fcn.00457d60
jmp fcn.004eece0
Function at 0x4f01a0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4f029b
push rbp
mov rbp, rsp
sub rsp, 0x50
movabs rdx, 0x786434656d5a785e
mov qword [rsp + 0x3a], rdx
movabs rdx, 0x6669623e45567864
mov qword [rsp + 0x40], rdx
movabs rdx, 0x734e454847684f4a
mov qword [rsp + 0x48], rdx
movabs rdx, 0x100d130f03110610
mov qword [rsp + 0x1c], rdx
movabs rdx, 0xd0d0a0f07010013
mov qword [rsp + 0x24], rdx
movabs rdx, 0x20505000e060d0d
mov qword [rsp + 0x2a], rdx
movabs rdx, 0xf140a050b0912
mov qword [rsp + 0x32], rdx
xor eax, eax
jmp 0x4f0239
movzx r9d, byte [rsp + rsi + 0x3a]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x14]
mov byte [rsp + rdi + 0x3a], dl
mov byte [rsp + rsi + 0x3a], r8b
add rax, 2
cmp rax, 0x1e
jge 0x4f026b
movzx edx, byte [rsp + rax + 0x1c]
movzx esi, byte [rsp + rax + 0x1d]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x16
jae 0x4f028e
movzx r8d, byte [rsp + rdi + 0x3a]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x14]
cmp rsi, 0x16
jb 0x4f021f
jmp 0x4f0282
xor eax, eax
lea rbx, [rsp + 0x3a]
mov ecx, 0x16
call fcn.00447260
add rsp, 0x50
pop rbp
ret
mov eax, esi
mov ecx, 0x16
call fcn.0045a040
mov eax, edi
mov ecx, 0x16
call fcn.0045a040
nop
nop dword [rax + rax]
call fcn.00457d60
jmp fcn.004f01a0

Function at 0x4f0aa0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4f0bac
push rbp
mov rbp, rsp
sub rsp, 0x58
movabs rdx, 0x503f653f0ee82149
mov qword [rsp + 0x40], rdx
movabs rdx, 0xf819363c114f4217
mov qword [rsp + 0x48], rdx
movabs rdx, 0x25271f6f7463421b
mov qword [rsp + 0x50], rdx
movabs rdx, 0xc0c040e0300170d
mov qword [rsp + 0x1e], rdx
movabs rdx, 0x100d0c0c040e0300
mov qword [rsp + 0x20], rdx
movabs rdx, 0xc0a040e0d151502
mov qword [rsp + 0x28], rdx
movabs rdx, 0x11020e000e0f0b02
mov qword [rsp + 0x30], rdx
movabs rdx, 0xe080001160d0906
mov qword [rsp + 0x38], rdx
xor eax, eax
jmp 0x4f0b48
movzx r9d, byte [rsp + rsi + 0x40]
lea edx, [r9 + rdx]
lea edx, [rdx + 7]
mov byte [rsp + rdi + 0x40], dl
mov byte [rsp + rsi + 0x40], r8b
add rax, 2
cmp rax, 0x22
jge 0x4f0b7c
movzx edx, byte [rsp + rax + 0x1e]
movzx esi, byte [rsp + rax + 0x1f]
mov edi, edx
xor edx, esi
add edx, eax
nop
cmp rdi, 0x18
jae 0x4f0b9f
movzx r8d, byte [rsp + rdi + 0x40]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 7]
cmp rsi, 0x18
jb 0x4f0b2e
jmp 0x4f0b93
xor eax, eax
lea rbx, [rsp + 0x40]
mov ecx, 0x18
call fcn.00447260
add rsp, 0x58
pop rbp
ret
mov eax, esi
mov ecx, 0x18
call fcn.0045a040
mov eax, edi
mov ecx, 0x18
call fcn.0045a040
nop
call fcn.00457d60
jmp fcn.004f0aa0
Function at 0x4f1400
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4f14ea
push rbp
mov rbp, rsp
sub rsp, 0x48
movabs rdx, 0x5044cc8a8e413510
mov qword [rsp + 0x37], rdx
movabs rdx, 0xc45044cc8a8e4135
mov qword [rsp + 0x38], rdx
movabs rdx, 0x57a6d56fd827d36f
mov qword [rsp + 0x40], rdx
movabs rdx, 0xf010a04050e0004
mov qword [rsp + 0x1f], rdx
movabs rdx, 0xc06060003010b0f
mov qword [rsp + 0x27], rdx
movabs rdx, 0xf030f0108000a03
mov qword [rsp + 0x2f], rdx
xor eax, eax
jmp 0x4f148d
movzx r9d, byte [rsp + rsi + 0x37]
sub r9d, edx
lea edx, [r9 - 0x53]
mov byte [rsp + rdi + 0x37], dl
lea edx, [r8 - 0x53]
mov byte [rsp + rsi + 0x37], dl
add rax, 2
cmp rax, 0x18
jge 0x4f14ba
movzx edx, byte [rsp + rax + 0x1f]
movzx esi, byte [rsp + rax + 0x20]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x11
jae 0x4f14dd
movzx r8d, byte [rsp + rdi + 0x37]
sub r8d, edx
cmp rsi, 0x11
jb 0x4f1470
jmp 0x4f14d1
xor eax, eax
lea rbx, [rsp + 0x37]
mov ecx, 0x11
call fcn.00447260
add rsp, 0x48
pop rbp
ret
mov eax, esi
mov ecx, 0x11
call fcn.0045a040
mov eax, edi
mov ecx, 0x11
call fcn.0045a040
nop
call fcn.00457d60
jmp fcn.004f1400

Function at 0x4f3a40
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4f3b0a
push rbp
mov rbp, rsp
sub rsp, 0x48
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rbx
mov qword [rsp], rax
mov qword [rsp + 8], rbx
mov byte [rsp + 0x10], 0
call fcn.00403280
xorps xmm15, xmm15
mov r14, qword [0x006ba420]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x18], 0xffffffffffffffff
jne 0x4f3aef
mov rcx, qword [rsp + 0x60]
lea rdx, [rcx + 1]
mov qword [rsp + 0x40], rdx
lea rax, [0x00550400]
xor ebx, ebx
mov rcx, rdx
call fcn.00443d80
mov rbx, qword [rsp + 0x60]
mov rcx, rax
xor edi, edi
mov rsi, qword [rsp + 0x40]
mov rax, qword [rsp + 0x58]
nop dword [rax]
call fcn.004f4040
inc rbx
cmp rcx, rbx
jae 0x4f3ade
mov edi, 1
lea rsi, [0x00550400]
call fcn.00443e60
mov word [rax + rbx*2 - 2], 0
xor edi, edi
xor esi, esi
add rsp, 0x48
pop rbp
ret
xor eax, eax
xor ebx, ebx
mov rcx, rbx
lea rdi, [0x0059a828]
lea rsi, [0x0059a508]
add rsp, 0x48
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.00457d60
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.004f3a40
Function at 0x4f8d40
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4f8e06
push rbp
mov rbp, rsp
sub rsp, 0x30
movabs rdx, 0xc6e24a4474d4d7be
mov qword [rsp + 0x27], rdx
mov byte [rsp + 0x2f], 0x72
movabs rdx, 0x504020601070700
mov qword [rsp + 0x1b], rdx
mov dword [rsp + 0x23], 0x1050404
xor eax, eax
nop
jmp 0x4f8da0
movzx r9d, byte [rsp + rsi + 0x27]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x7a]
mov byte [rsp + rdi + 0x27], dl
mov byte [rsp + rsi + 0x27], r8b
add rax, 2
nop dword [rax]
cmp rax, 0xc
jge 0x4f8dd2
movzx edx, byte [rsp + rax + 0x1b]
movzx esi, byte [rsp + rax + 0x1c]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 9
jae 0x4f8df7
movzx r8d, byte [rsp + rdi + 0x27]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x7a]
cmp rsi, 9
jb 0x4f8d82
jmp 0x4f8deb
xor eax, eax
lea rbx, [rsp + 0x27]
mov ecx, 9
nop
call fcn.00447260
add rsp, 0x30
pop rbp
ret
mov eax, esi
mov ecx, 9
call fcn.0045a040
mov eax, edi
mov ecx, 9
nop
call fcn.0045a040
nop
call fcn.00457d60
jmp fcn.004f8d40

Function at 0x4fbee0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4fbfdd
push rbp
mov rbp, rsp
sub rsp, 0x48
movabs rdx, 0x376dfcba0e6f241e
mov qword [rsp + 0x32], rdx
movabs rdx, 0xb6c2d0e42e0f376d
mov qword [rsp + 0x38], rdx
movabs rdx, 0x8b2f69dbf1647289
mov qword [rsp + 0x40], rdx
movabs rdx, 0x405030b0c0e1208
mov qword [rsp + 0x18], rdx
movabs rdx, 0xe000e010115110a
mov qword [rsp + 0x20], rdx
movabs rdx, 0xd030e000e010115
mov qword [rsp + 0x22], rdx
movabs rdx, 0xa0c14070c030509
mov qword [rsp + 0x2a], rdx
xor eax, eax
jmp 0x4fbf80
movzx r9d, byte [rsp + rsi + 0x32]
sub r9d, edx
lea edx, [r9 + 0x5f]
mov byte [rsp + rdi + 0x32], dl
lea edx, [r8 + 0x5f]
mov byte [rsp + rsi + 0x32], dl
add rax, 2
nop dword [rax]
cmp rax, 0x1a
jge 0x4fbfad
movzx edx, byte [rsp + rax + 0x18]
movzx esi, byte [rsp + rax + 0x19]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x16
jae 0x4fbfd0
movzx r8d, byte [rsp + rdi + 0x32]
sub r8d, edx
cmp rsi, 0x16
jb 0x4fbf5f
jmp 0x4fbfc4
xor eax, eax
lea rbx, [rsp + 0x32]
mov ecx, 0x16
call fcn.00447260
add rsp, 0x48
pop rbp
ret
mov eax, esi
mov ecx, 0x16
call fcn.0045a040
mov eax, edi
mov ecx, 0x16
call fcn.0045a040
nop
nop dword [rax]
call fcn.00457d60
jmp fcn.004fbee0
Function at 0x4fd040
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4fd12c
push rbp
mov rbp, rsp
sub rsp, 0x40
movabs rdx, 0x7c7f58616dcd9089
mov qword [rsp + 0x2d], rdx
movabs rdx, 0x819b8e7c7f58616d
mov qword [rsp + 0x30], rdx
movabs rdx, 0x656d6954a6647242
mov qword [rsp + 0x38], rdx
movabs rdx, 0xb0e080701020909
mov qword [rsp + 0x19], rdx
movabs rdx, 0x60301060b0e0807
mov qword [rsp + 0x1d], rdx
movabs rdx, 0x500080606000a0b
mov qword [rsp + 0x25], rdx
xor eax, eax
jmp 0x4fd0ca
movzx r9d, byte [rsp + rsi + 0x2d]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x2d]
mov byte [rsp + rdi + 0x2d], dl
mov byte [rsp + rsi + 0x2d], r8b
add rax, 2
cmp rax, 0x14
jge 0x4fd0fc
movzx edx, byte [rsp + rax + 0x19]
movzx esi, byte [rsp + rax + 0x1a]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x13
jae 0x4fd11f
movzx r8d, byte [rsp + rdi + 0x2d]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x2d]
cmp rsi, 0x13
jb 0x4fd0b0
jmp 0x4fd113
xor eax, eax
lea rbx, [rsp + 0x2d]
mov ecx, 0x13
call fcn.00447260
add rsp, 0x40
pop rbp
ret
mov eax, esi
mov ecx, 0x13
call fcn.0045a040
mov eax, edi
mov ecx, 0x13
call fcn.0045a040
nop
call fcn.00457d60
jmp fcn.004fd040

Function at 0x500180
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x50027b
push rbp
mov rbp, rsp
sub rsp, 0x48
movabs rdx, 0xe46305086919e898
mov qword [rsp + 0x33], rdx
movabs rdx, 0x641561a6f6e46305
mov qword [rsp + 0x38], rdx
movabs rdx, 0xe4d48b28208272b8
mov qword [rsp + 0x40], rdx
movabs rdx, 0xf021113000b0209
mov qword [rsp + 0x19], rdx
movabs rdx, 0x70d130807110012
mov qword [rsp + 0x21], rdx
movabs rdx, 0x405070d13080711
mov qword [rsp + 0x23], rdx
movabs rdx, 0x1140d0b02081200
mov qword [rsp + 0x2b], rdx
xor eax, eax
jmp 0x500219
movzx r9d, byte [rsp + rsi + 0x33]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x50]
mov byte [rsp + rdi + 0x33], dl
mov byte [rsp + rsi + 0x33], r8b
add rax, 2
cmp rax, 0x1a
jge 0x50024b
movzx edx, byte [rsp + rax + 0x19]
movzx esi, byte [rsp + rax + 0x1a]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x15
jae 0x50026e
movzx r8d, byte [rsp + rdi + 0x33]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x50]
cmp rsi, 0x15
jb 0x5001ff
jmp 0x500262
xor eax, eax
lea rbx, [rsp + 0x33]
mov ecx, 0x15
call fcn.00447260
add rsp, 0x48
pop rbp
ret
mov eax, esi
mov ecx, 0x15
call fcn.0045a040
mov eax, edi
mov ecx, 0x15
call fcn.0045a040
nop
nop dword [rax + rax]
call fcn.00457d60
jmp fcn.00500180
Function at 0x5002a0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x5003ba
push rbp
mov rbp, rsp
sub rsp, 0x60
movabs rdx, 0x969cca74f8386fb6
mov qword [rsp + 0x41], rdx
movabs rdx, 0x720c64d66110535b
mov qword [rsp + 0x49], rdx
movabs rdx, 0xa0a7869f78c2572
mov qword [rsp + 0x50], rdx
movabs rdx, 0x29f7fa69ab0cc228
mov qword [rsp + 0x58], rdx
movabs rdx, 0x1815021c19001502
mov qword [rsp + 0x19], rdx
movabs rdx, 0x503081816100a0c
mov qword [rsp + 0x21], rdx
movabs rdx, 0x1416050e1d08181a
mov qword [rsp + 0x29], rdx
movabs rdx, 0x1908081d0c051012
mov qword [rsp + 0x31], rdx
movabs rdx, 0xe111a0210060007
mov qword [rsp + 0x39], rdx
xor eax, eax
jmp 0x500357
movzx r9d, byte [rsp + rsi + 0x41]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x70]
mov byte [rsp + rdi + 0x41], dl
mov byte [rsp + rsi + 0x41], r8b
add rax, 2
cmp rax, 0x28
jge 0x500389
movzx edx, byte [rsp + rax + 0x19]
movzx esi, byte [rsp + rax + 0x1a]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x1f
jae 0x5003ad
movzx r8d, byte [rsp + rdi + 0x41]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x70]
cmp rsi, 0x1f
jb 0x50033d
jmp 0x5003a1
xor eax, eax
lea rbx, [rsp + 0x41]
mov ecx, 0x1f
call fcn.00447260
add rsp, 0x60
pop rbp
nop
ret
mov eax, esi
mov ecx, 0x1f
call fcn.0045a040
mov eax, edi
mov ecx, 0x1f
call fcn.0045a040
nop
call fcn.00457d60
nop
jmp fcn.005002a0

Function at 0x5003e0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x5004ec
push rbp
mov rbp, rsp
sub rsp, 0x58
movabs rdx, 0x205c9472576e6541
mov qword [rsp + 0x3a], rdx
movabs rdx, 0xc9766d646e96748f
mov qword [rsp + 0x42], rdx
movabs rdx, 0x738bc2697a81c976
mov qword [rsp + 0x48], rdx
movabs rdx, 0x296f636989658d72
mov qword [rsp + 0x50], rdx
movabs rdx, 0x160a150f0e0d11
mov qword [rsp + 0x1a], rdx
movabs rdx, 0x80510050506190f
mov qword [rsp + 0x22], rdx
movabs rdx, 0x515051417001413
mov qword [rsp + 0x2a], rdx
movabs rdx, 0x30019150f05000e
mov qword [rsp + 0x32], rdx
xor eax, eax
jmp 0x500488
movzx r9d, byte [rsp + rsi + 0x3a]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x35]
mov byte [rsp + rdi + 0x3a], dl
mov byte [rsp + rsi + 0x3a], r8b
add rax, 2
cmp rax, 0x20
jge 0x5004bc
movzx edx, byte [rsp + rax + 0x1a]
movzx esi, byte [rsp + rax + 0x1b]
mov edi, edx
xor edx, esi
add edx, eax
nop
cmp rdi, 0x1e
jae 0x5004df
movzx r8d, byte [rsp + rdi + 0x3a]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x35]
cmp rsi, 0x1e
jb 0x50046e
jmp 0x5004d3
xor eax, eax
lea rbx, [rsp + 0x3a]
mov ecx, 0x1e
call fcn.00447260
add rsp, 0x58
pop rbp
ret
mov eax, esi
mov ecx, 0x1e
call fcn.0045a040
mov eax, edi
mov ecx, 0x1e
call fcn.0045a040
nop
call fcn.00457d60
jmp fcn.005003e0
Function at 0x503620
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x50372c
push rbp
mov rbp, rsp
sub rsp, 0x50
movabs rdx, 0x646edc183928164e
mov qword [rsp + 0x36], rdx
movabs rdx, 0x2de3fd3064d20ebd
mov qword [rsp + 0x3e], rdx
movabs rdx, 0x79462de3fd3064d2
mov qword [rsp + 0x40], rdx
movabs rdx, 0x656d690620ec72c4
mov qword [rsp + 0x48], rdx
movabs rdx, 0xf0a0e0c12010503
mov qword [rsp + 0x1a], rdx
movabs rdx, 0xf0104100e020911
mov qword [rsp + 0x22], rdx
movabs rdx, 0x160804080f010410
mov qword [rsp + 0x26], rdx
movabs rdx, 0x4030d140c090c02
mov qword [rsp + 0x2e], rdx
xor eax, eax
jmp 0x5036c8
movzx r9d, byte [rsp + rsi + 0x36]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x36]
mov byte [rsp + rdi + 0x36], dl
mov byte [rsp + rsi + 0x36], r8b
add rax, 2
cmp rax, 0x1c
jge 0x5036fc
movzx edx, byte [rsp + rax + 0x1a]
movzx esi, byte [rsp + rax + 0x1b]
mov edi, edx
xor edx, esi
add edx, eax
nop
cmp rdi, 0x1a
jae 0x50371f
movzx r8d, byte [rsp + rdi + 0x36]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x36]
cmp rsi, 0x1a
jb 0x5036ae
jmp 0x503713
xor eax, eax
lea rbx, [rsp + 0x36]
mov ecx, 0x1a
call fcn.00447260
add rsp, 0x50
pop rbp
ret
mov eax, esi
mov ecx, 0x1a
call fcn.0045a040
mov eax, edi
mov ecx, 0x1a
call fcn.0045a040
nop
call fcn.00457d60
jmp fcn.00503620

Function at 0x503ea0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x503fac
push rbp
mov rbp, rsp
sub rsp, 0x50
movabs rdx, 0x806c74a0748b8843
mov qword [rsp + 0x36], rdx
movabs rdx, 0x64a4ef2061692d41
mov qword [rsp + 0x3e], rdx
movabs rdx, 0x889b64a4ef206169
mov qword [rsp + 0x40], rdx
movabs rdx, 0x656d9ea280617230
mov qword [rsp + 0x48], rdx
movabs rdx, 0x110202100e0d0516
mov qword [rsp + 0x1c], rdx
movabs rdx, 0x712071709151704
mov qword [rsp + 0x24], rdx
movabs rdx, 0xe01071207170915
mov qword [rsp + 0x26], rdx
movabs rdx, 0x140f0d0504050501
mov qword [rsp + 0x2e], rdx
xor eax, eax
jmp 0x503f48
movzx r9d, byte [rsp + rsi + 0x36]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x33]
mov byte [rsp + rdi + 0x36], dl
mov byte [rsp + rsi + 0x36], r8b
add rax, 2
cmp rax, 0x1a
jge 0x503f7c
movzx edx, byte [rsp + rax + 0x1c]
movzx esi, byte [rsp + rax + 0x1d]
mov edi, edx
xor edx, esi
add edx, eax
nop
cmp rdi, 0x1a
jae 0x503f9f
movzx r8d, byte [rsp + rdi + 0x36]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x33]
cmp rsi, 0x1a
jb 0x503f2e
jmp 0x503f93
xor eax, eax
lea rbx, [rsp + 0x36]
mov ecx, 0x1a
call fcn.00447260
add rsp, 0x50
pop rbp
ret
mov eax, esi
mov ecx, 0x1a
call fcn.0045a040
mov eax, edi
mov ecx, 0x1a
call fcn.0045a040
nop
call fcn.00457d60
jmp fcn.00503ea0
Function at 0x503fc0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x5040aa
push rbp
mov rbp, rsp
sub rsp, 0x48
movabs rdx, 0x53a5836193728e4a
mov qword [rsp + 0x34], rdx
movabs rdx, 0x8d8a458c53a58361
mov qword [rsp + 0x38], rdx
movabs rdx, 0x65afb5ca86c0cbc3
mov qword [rsp + 0x40], rdx
movabs rdx, 0xc08080d110a050b
mov qword [rsp + 0x1e], rdx
movabs rdx, 0x10a0e01100a0c08
mov qword [rsp + 0x24], rdx
movabs rdx, 0x6110c0308120f09
mov qword [rsp + 0x2c], rdx
xor eax, eax
jmp 0x50404d
movzx r9d, byte [rsp + rsi + 0x34]
sub r9d, edx
lea edx, [r9 - 0x11]
mov byte [rsp + rdi + 0x34], dl
lea edx, [r8 - 0x11]
mov byte [rsp + rsi + 0x34], dl
add rax, 2
cmp rax, 0x16
jge 0x50407a
movzx edx, byte [rsp + rax + 0x1e]
movzx esi, byte [rsp + rax + 0x1f]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x14
jae 0x50409d
movzx r8d, byte [rsp + rdi + 0x34]
sub r8d, edx
cmp rsi, 0x14
jb 0x504030
jmp 0x504091
xor eax, eax
lea rbx, [rsp + 0x34]
mov ecx, 0x14
call fcn.00447260
add rsp, 0x48
pop rbp
ret
mov eax, esi
mov ecx, 0x14
call fcn.0045a040
mov eax, edi
mov ecx, 0x14
call fcn.0045a040
nop
call fcn.00457d60
jmp fcn.00503fc0

Function at 0x504ce0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x504ddd
push rbp
mov rbp, rsp
sub rsp, 0x50
movabs rdx, 0x387d69e81128014c
mov qword [rsp + 0x3b], rdx
movabs rdx, 0x1a3061d43c387d69
mov qword [rsp + 0x40], rdx
movabs rdx, 0x27eb6954d3e53466
mov qword [rsp + 0x48], rdx
movabs rdx, 0xc000b0c04100f03
mov qword [rsp + 0x1d], rdx
movabs rdx, 0xd0601000c140902
mov qword [rsp + 0x25], rdx
movabs rdx, 0x140e0d10060d0d06
mov qword [rsp + 0x2b], rdx
movabs rdx, 0x40806010e031307
mov qword [rsp + 0x33], rdx
xor eax, eax
jmp 0x504d80
movzx r9d, byte [rsp + rsi + 0x3b]
sub r9d, edx
lea edx, [r9 + 0x5f]
mov byte [rsp + rdi + 0x3b], dl
lea edx, [r8 + 0x5f]
mov byte [rsp + rsi + 0x3b], dl
add rax, 2
nop dword [rax]
cmp rax, 0x1e
jge 0x504dad
movzx edx, byte [rsp + rax + 0x1d]
movzx esi, byte [rsp + rax + 0x1e]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x15
jae 0x504dd0
movzx r8d, byte [rsp + rdi + 0x3b]
sub r8d, edx
cmp rsi, 0x15
jb 0x504d5f
jmp 0x504dc4
xor eax, eax
lea rbx, [rsp + 0x3b]
mov ecx, 0x15
call fcn.00447260
add rsp, 0x50
pop rbp
ret
mov eax, esi
mov ecx, 0x15
call fcn.0045a040
mov eax, edi
mov ecx, 0x15
call fcn.0045a040
nop
nop dword [rax]
call fcn.00457d60
jmp fcn.00504ce0