joyce8/EMBER2024-capa huggingface dataset:
Function at 0x50cec0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x50cf78
push rbp
mov rbp, rsp
sub rsp, 0x30
movabs rdx, 0xe3fc6cbd63dd2a1d
mov qword [rsp + 0x28], rdx
movabs rdx, 0x401010207010606
mov qword [rsp + 0x1e], rdx
mov word [rsp + 0x26], 0x100
xor eax, eax
jmp 0x50cf18
movzx r9d, byte [rsp + rsi + 0x28]
sub r9d, edx
lea edx, [r9 + 0x4d]
mov byte [rsp + rdi + 0x28], dl
lea edx, [r8 + 0x4d]
mov byte [rsp + rsi + 0x28], dl
add rax, 2
cmp rax, 0xa
jge 0x50cf48
movzx edx, byte [rsp + rax + 0x1e]
movzx esi, byte [rsp + rax + 0x1f]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 8
jae 0x50cf6b
movzx r8d, byte [rsp + rdi + 0x28]
sub r8d, edx
nop dword [rax]
cmp rsi, 8
jb 0x50cefb
jmp 0x50cf5f
xor eax, eax
lea rbx, [rsp + 0x28]
mov ecx, 8
call fcn.004669c0
add rsp, 0x30
pop rbp
ret
mov eax, esi
mov ecx, 8
call fcn.0046c880
mov eax, edi
mov ecx, 8
call fcn.0046c880
nop
call fcn.0046a5a0
nop dword [rax]
jmp fcn.0050cec0

Function at 0x50d340
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x50d40c
push rbp
mov rbp, rsp
sub rsp, 0x38
movabs rdx, 0x6e665f653f516d6f
mov qword [rsp + 0x2d], rdx
mov dword [rsp + 0x34], 0x4f6c656e
movabs rdx, 0xa030506030a060a
mov qword [rsp + 0x1d], rdx
movabs rdx, 0x3020106080208
mov qword [rsp + 0x25], rdx
xor eax, eax
jmp 0x50d3a5
movzx r9d, byte [rsp + rsi + 0x2d]
lea edx, [r9 + rdx]
lea edx, [rdx - 0xd]
mov byte [rsp + rdi + 0x2d], dl
mov byte [rsp + rsi + 0x2d], r8b
add rax, 2
cmp rax, 0x10
jge 0x50d3dc
movzx edx, byte [rsp + rax + 0x1d]
movzx esi, byte [rsp + rax + 0x1e]
mov edi, edx
xor edx, esi
add edx, eax
nop dword [rax + rax]
cmp rdi, 0xb
jae 0x50d3ff
movzx r8d, byte [rsp + rdi + 0x2d]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0xd]
cmp rsi, 0xb
jb 0x50d38b
jmp 0x50d3f3
xor eax, eax
lea rbx, [rsp + 0x2d]
mov ecx, 0xb
call fcn.004669c0
add rsp, 0x38
pop rbp
ret
mov eax, esi
mov ecx, 0xb
call fcn.0046c880
mov eax, edi
mov ecx, 0xb
call fcn.0046c880
nop
call fcn.0046a5a0
jmp fcn.0050d340
Function at 0x50ef00
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x50efea
push rbp
mov rbp, rsp
sub rsp, 0x48
movabs rdx, 0xf653a1746dd4a2b5
mov qword [rsp + 0x35], rdx
movabs rdx, 0xa0a5acf653a1746d
mov qword [rsp + 0x38], rdx
movabs rdx, 0xf76bc4f9aa95a3c6
mov qword [rsp + 0x40], rdx
movabs rdx, 0x20912050a0a0312
mov qword [rsp + 0x1d], rdx
movabs rdx, 0xb10070c05010c0f
mov qword [rsp + 0x25], rdx
movabs rdx, 0xd000301090e080c
mov qword [rsp + 0x2d], rdx
xor eax, eax
jmp 0x50ef8d
movzx r9d, byte [rsp + rsi + 0x35]
sub r9d, edx
lea edx, [r9 - 0x2f]
mov byte [rsp + rdi + 0x35], dl
lea edx, [r8 - 0x2f]
mov byte [rsp + rsi + 0x35], dl
add rax, 2
cmp rax, 0x18
jge 0x50efba
movzx edx, byte [rsp + rax + 0x1d]
movzx esi, byte [rsp + rax + 0x1e]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x13
jae 0x50efdd
movzx r8d, byte [rsp + rdi + 0x35]
sub r8d, edx
cmp rsi, 0x13
jb 0x50ef70
jmp 0x50efd1
xor eax, eax
lea rbx, [rsp + 0x35]
mov ecx, 0x13
call fcn.004669c0
add rsp, 0x48
pop rbp
ret
mov eax, esi
mov ecx, 0x13
call fcn.0046c880
mov eax, edi
mov ecx, 0x13
call fcn.0046c880
nop
call fcn.0046a5a0
jmp fcn.0050ef00

Function at 0x50f940
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x50fa07
push rbp
mov rbp, rsp
sub rsp, 0x38
movabs rdx, 0x9c86dd9a159a2388
mov qword [rsp + 0x2d], rdx
mov dword [rsp + 0x34], 0x9e65ba9c
movabs rdx, 0x40502010a030303
mov qword [rsp + 0x1d], rdx
movabs rdx, 0x6000408070a0402
mov qword [rsp + 0x25], rdx
xor eax, eax
jmp 0x50f9a8
movzx r9d, byte [rsp + rsi + 0x2d]
sub r9d, edx
lea edx, [r9 - 0x2e]
mov byte [rsp + rdi + 0x2d], dl
lea edx, [r8 - 0x2e]
mov byte [rsp + rsi + 0x2d], dl
add rax, 2
cmp rax, 0x10
jge 0x50f9d7
movzx edx, byte [rsp + rax + 0x1d]
movzx esi, byte [rsp + rax + 0x1e]
mov edi, edx
xor edx, esi
add edx, eax
nop
cmp rdi, 0xb
jae 0x50f9fa
movzx r8d, byte [rsp + rdi + 0x2d]
sub r8d, edx
cmp rsi, 0xb
jb 0x50f98b
jmp 0x50f9ee
xor eax, eax
lea rbx, [rsp + 0x2d]
mov ecx, 0xb
call fcn.004669c0
add rsp, 0x38
pop rbp
ret
mov eax, esi
mov ecx, 0xb
call fcn.0046c880
mov eax, edi
mov ecx, 0xb
call fcn.0046c880
nop
call fcn.0046a5a0
jmp fcn.0050f940
Function at 0x50fe60
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x50ff46
push rbp
mov rbp, rsp
sub rsp, 0x40
movabs rdx, 0x63c8e9f2f14feb76
mov qword [rsp + 0x31], rdx
movabs rdx, 0xe26fea74f0ba4363
mov qword [rsp + 0x38], rdx
movabs rdx, 0x60309070a0004
mov qword [rsp + 0x1d], rdx
movabs rdx, 0x30e0a0100060309
mov qword [rsp + 0x21], rdx
movabs rdx, 0xe06040c020c0505
mov qword [rsp + 0x29], rdx
xor eax, eax
nop
jmp 0x50fee0
movzx r9d, byte [rsp + rsi + 0x31]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x70]
mov byte [rsp + rdi + 0x31], dl
mov byte [rsp + rsi + 0x31], r8b
add rax, 2
nop dword [rax]
cmp rax, 0x14
jge 0x50ff12
movzx edx, byte [rsp + rax + 0x1d]
movzx esi, byte [rsp + rax + 0x1e]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0xf
jae 0x50ff37
movzx r8d, byte [rsp + rdi + 0x31]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x70]
cmp rsi, 0xf
jb 0x50fec2
jmp 0x50ff2b
xor eax, eax
lea rbx, [rsp + 0x31]
mov ecx, 0xf
nop
call fcn.004669c0
add rsp, 0x40
pop rbp
ret
mov eax, esi
mov ecx, 0xf
call fcn.0046c880
mov eax, edi
mov ecx, 0xf
nop
call fcn.0046c880
nop
call fcn.0046a5a0
jmp fcn.0050fe60

Function at 0x513060
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x51314a
push rbp
mov rbp, rsp
sub rsp, 0x48
movabs rdx, 0x72691b43152b2af0
mov qword [rsp + 0x31], rdx
movabs rdx, 0x4943436512fa0b72
mov qword [rsp + 0x38], rdx
movabs rdx, 0x5765036246695217
mov qword [rsp + 0x40], rdx
movabs rdx, 0x912030800091403
mov qword [rsp + 0x19], rdx
movabs rdx, 0x101120d0a00050f
mov qword [rsp + 0x21], rdx
movabs rdx, 0xc04140f0e021005
mov qword [rsp + 0x29], rdx
xor eax, eax
jmp 0x5130ed
movzx r9d, byte [rsp + rsi + 0x31]
sub r9d, edx
lea edx, [r9 + 0x49]
mov byte [rsp + rdi + 0x31], dl
lea edx, [r8 + 0x49]
mov byte [rsp + rsi + 0x31], dl
add rax, 2
cmp rax, 0x18
jge 0x51311a
movzx edx, byte [rsp + rax + 0x19]
movzx esi, byte [rsp + rax + 0x1a]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x17
jae 0x51313d
movzx r8d, byte [rsp + rdi + 0x31]
sub r8d, edx
cmp rsi, 0x17
jb 0x5130d0
jmp 0x513131
xor eax, eax
lea rbx, [rsp + 0x31]
mov ecx, 0x17
call fcn.004669c0
add rsp, 0x48
pop rbp
ret
mov eax, esi
mov ecx, 0x17
call fcn.0046c880
mov eax, edi
mov ecx, 0x17
call fcn.0046c880
nop
call fcn.0046a5a0
jmp fcn.00513060
Function at 0x516220
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x5162ec
push rbp
mov rbp, rsp
sub rsp, 0x38
movabs rdx, 0x15f0f7ed2f746547
mov qword [rsp + 0x2c], rdx
mov dword [rsp + 0x34], 0xed6c0923
movabs rdx, 0x50804040609030b
mov qword [rsp + 0x1e], rdx
movabs rdx, 0x307040908080508
mov qword [rsp + 0x24], rdx
xor eax, eax
jmp 0x516285
movzx r9d, byte [rsp + rsi + 0x2c]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x2e]
mov byte [rsp + rdi + 0x2c], dl
mov byte [rsp + rsi + 0x2c], r8b
add rax, 2
cmp rax, 0xe
jge 0x5162bc
movzx edx, byte [rsp + rax + 0x1e]
movzx esi, byte [rsp + rax + 0x1f]
mov edi, edx
xor edx, esi
add edx, eax
nop dword [rax + rax]
cmp rdi, 0xc
jae 0x5162df
movzx r8d, byte [rsp + rdi + 0x2c]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x2e]
cmp rsi, 0xc
jb 0x51626b
jmp 0x5162d3
xor eax, eax
lea rbx, [rsp + 0x2c]
mov ecx, 0xc
call fcn.004669c0
add rsp, 0x38
pop rbp
ret
mov eax, esi
mov ecx, 0xc
call fcn.0046c880
mov eax, edi
mov ecx, 0xc
call fcn.0046c880
nop
call fcn.0046a5a0
jmp fcn.00516220

Function at 0x5172c0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x51737d
push rbp
mov rbp, rsp
sub rsp, 0x30
movabs rdx, 0x6984c665f5b09ea1
mov qword [rsp + 0x26], rdx
mov word [rsp + 0x2e], 0x6e6f
movabs rdx, 0x102050303050202
mov qword [rsp + 0x1a], rdx
mov dword [rsp + 0x22], 0x20306
xor eax, eax
jmp 0x517320
movzx r9d, byte [rsp + rsi + 0x26]
sub r9d, edx
lea edx, [r9 - 0x21]
mov byte [rsp + rdi + 0x26], dl
lea edx, [r8 - 0x21]
mov byte [rsp + rsi + 0x26], dl
add rax, 2
cmp rax, 0xc
jge 0x51734d
movzx edx, byte [rsp + rax + 0x1a]
movzx esi, byte [rsp + rax + 0x1b]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0xa
jae 0x517370
movzx r8d, byte [rsp + rdi + 0x26]
sub r8d, edx
cmp rsi, 0xa
jb 0x517303
jmp 0x517364
xor eax, eax
lea rbx, [rsp + 0x26]
mov ecx, 0xa
call fcn.004669c0
add rsp, 0x30
pop rbp
ret
mov eax, esi
mov ecx, 0xa
call fcn.0046c880
mov eax, edi
mov ecx, 0xa
call fcn.0046c880
nop
nop dword [rax]
call fcn.0046a5a0
jmp fcn.005172c0

Function at 0x518d20
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x518dde
push rbp
mov rbp, rsp
sub rsp, 0x30
movabs rdx, 0xbf6f7253ee6570c5
mov qword [rsp + 0x25], rdx
mov dword [rsp + 0x2c], 0x17bbecbf
movabs rdx, 0x40a080a0309040a
mov qword [rsp + 0x19], rdx
mov dword [rsp + 0x21], 0x7080009
xor eax, eax
jmp 0x518d81
movzx r9d, byte [rsp + rsi + 0x25]
sub r9d, edx
lea edx, [r9 - 0x41]
mov byte [rsp + rdi + 0x25], dl
lea edx, [r8 - 0x41]
mov byte [rsp + rsi + 0x25], dl
add rax, 2
cmp rax, 0xc
jge 0x518dae
movzx edx, byte [rsp + rax + 0x19]
movzx esi, byte [rsp + rax + 0x1a]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0xb
jae 0x518dd1
movzx r8d, byte [rsp + rdi + 0x25]
sub r8d, edx
cmp rsi, 0xb
jb 0x518d64
jmp 0x518dc5
xor eax, eax
lea rbx, [rsp + 0x25]
mov ecx, 0xb
call fcn.004669c0
add rsp, 0x30
pop rbp
ret
mov eax, esi
mov ecx, 0xb
call fcn.0046c880
mov eax, edi
mov ecx, 0xb
call fcn.0046c880
nop
nop
call fcn.0046a5a0
jmp fcn.00518d20
Function at 0x519200
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x5192cc
push rbp
mov rbp, rsp
sub rsp, 0x38
movabs rdx, 0x71876f87647a7152
mov qword [rsp + 0x2c], rdx
mov dword [rsp + 0x34], 0x66656d48
movabs rdx, 0x408040407060209
mov qword [rsp + 0x1e], rdx
movabs rdx, 0xb01010906090408
mov qword [rsp + 0x24], rdx
xor eax, eax
jmp 0x519265
movzx r9d, byte [rsp + rsi + 0x2c]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x17]
mov byte [rsp + rdi + 0x2c], dl
mov byte [rsp + rsi + 0x2c], r8b
add rax, 2
cmp rax, 0xe
jge 0x51929c
movzx edx, byte [rsp + rax + 0x1e]
movzx esi, byte [rsp + rax + 0x1f]
mov edi, edx
xor edx, esi
add edx, eax
nop dword [rax + rax]
cmp rdi, 0xc
jae 0x5192bf
movzx r8d, byte [rsp + rdi + 0x2c]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x17]
cmp rsi, 0xc
jb 0x51924b
jmp 0x5192b3
xor eax, eax
lea rbx, [rsp + 0x2c]
mov ecx, 0xc
call fcn.004669c0
add rsp, 0x38
pop rbp
ret
mov eax, esi
mov ecx, 0xc
call fcn.0046c880
mov eax, edi
mov ecx, 0xc
call fcn.0046c880
nop
call fcn.0046a5a0
jmp fcn.00519200

Function at 0x51c620
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x51c706
push rbp
mov rbp, rsp
sub rsp, 0x38
movabs rdx, 0x556cb97721ce3a90
mov qword [rsp + 0x2b], rdx
movabs rdx, 0xcf216fffc9556cb9
mov qword [rsp + 0x30], rdx
movabs rdx, 0x2040201030c0003
mov qword [rsp + 0x19], rdx
movabs rdx, 0xb0502040201030c
mov qword [rsp + 0x1b], rdx
movabs rdx, 0x509050502080c
mov qword [rsp + 0x23], rdx
xor eax, eax
nop
jmp 0x51c6a0
movzx r9d, byte [rsp + rsi + 0x2b]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x6c]
mov byte [rsp + rdi + 0x2b], dl
mov byte [rsp + rsi + 0x2b], r8b
add rax, 2
nop dword [rax]
cmp rax, 0x12
jge 0x51c6d2
movzx edx, byte [rsp + rax + 0x19]
movzx esi, byte [rsp + rax + 0x1a]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0xd
jae 0x51c6f7
movzx r8d, byte [rsp + rdi + 0x2b]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x6c]
cmp rsi, 0xd
jb 0x51c682
jmp 0x51c6eb
xor eax, eax
lea rbx, [rsp + 0x2b]
mov ecx, 0xd
nop
call fcn.004669c0
add rsp, 0x38
pop rbp
ret
mov eax, esi
mov ecx, 0xd
call fcn.0046c880
mov eax, edi
mov ecx, 0xd
nop
call fcn.0046c880
nop
call fcn.0046a5a0
jmp fcn.0051c620
Function at 0x51d400
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x51d4dd
push rbp
mov rbp, rsp
sub rsp, 0x38
movabs rdx, 0xb2382f2208610054
mov qword [rsp + 0x2a], rdx
movabs rdx, 0x32effc3a0065b238
mov qword [rsp + 0x30], rdx
movabs rdx, 0xd0b010a070c010c
mov qword [rsp + 0x18], rdx
movabs rdx, 0xc050d0b010a070c
mov qword [rsp + 0x1a], rdx
movabs rdx, 0x406090403060d05
mov qword [rsp + 0x22], rdx
xor eax, eax
nop
jmp 0x51d480
movzx r9d, byte [rsp + rsi + 0x2a]
sub r9d, edx
lea edx, [r9 + 0x47]
mov byte [rsp + rdi + 0x2a], dl
lea edx, [r8 + 0x47]
mov byte [rsp + rsi + 0x2a], dl
add rax, 2
nop
cmp rax, 0x12
jge 0x51d4ad
movzx edx, byte [rsp + rax + 0x18]
movzx esi, byte [rsp + rax + 0x19]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0xe
jae 0x51d4d0
movzx r8d, byte [rsp + rdi + 0x2a]
sub r8d, edx
cmp rsi, 0xe
jb 0x51d462
jmp 0x51d4c4
xor eax, eax
lea rbx, [rsp + 0x2a]
mov ecx, 0xe
call fcn.004669c0
add rsp, 0x38
pop rbp
ret
mov eax, esi
mov ecx, 0xe
call fcn.0046c880
mov eax, edi
mov ecx, 0xe
call fcn.0046c880
nop
nop dword [rax]
call fcn.0046a5a0
jmp fcn.0051d400

Function at 0x51e100
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x51e1cc
push rbp
mov rbp, rsp
sub rsp, 0x38
movabs rdx, 0xfc750a4b65d9fe46
mov qword [rsp + 0x2b], rdx
movabs rdx, 0x66f016e36fc750a
mov qword [rsp + 0x30], rdx
movabs rdx, 0x20a020404080604
mov qword [rsp + 0x1d], rdx
movabs rdx, 0xc01060c0705020a
mov qword [rsp + 0x23], rdx
xor eax, eax
jmp 0x51e16f
movzx r9d, byte [rsp + rsi + 0x2b]
sub r9d, edx
lea edx, [r9 + 0x72]
mov byte [rsp + rdi + 0x2b], dl
lea edx, [r8 + 0x72]
mov byte [rsp + rsi + 0x2b], dl
add rax, 2
cmp rax, 0xe
jge 0x51e19c
movzx edx, byte [rsp + rax + 0x1d]
movzx esi, byte [rsp + rax + 0x1e]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0xd
jae 0x51e1bf
movzx r8d, byte [rsp + rdi + 0x2b]
sub r8d, edx
cmp rsi, 0xd
jb 0x51e152
jmp 0x51e1b3
xor eax, eax
lea rbx, [rsp + 0x2b]
mov ecx, 0xd
call fcn.004669c0
add rsp, 0x38
pop rbp
ret
mov eax, esi
mov ecx, 0xd
call fcn.0046c880
mov eax, edi
mov ecx, 0xd
call fcn.0046c880
nop
call fcn.0046a5a0
jmp fcn.0051e100
Function at 0x51fb60
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x51fc2c
push rbp
mov rbp, rsp
sub rsp, 0x38
movabs rdx, 0xce6f731574127d26
mov qword [rsp + 0x2d], rdx
mov dword [rsp + 0x34], 0xc3652bce
movabs rdx, 0x70400030a080100
mov qword [rsp + 0x1f], rdx
movabs rdx, 0x803080002040704
mov qword [rsp + 0x25], rdx
xor eax, eax
jmp 0x51fbc5
movzx r9d, byte [rsp + rsi + 0x2d]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x45]
mov byte [rsp + rdi + 0x2d], dl
mov byte [rsp + rsi + 0x2d], r8b
add rax, 2
cmp rax, 0xe
jge 0x51fbfc
movzx edx, byte [rsp + rax + 0x1f]
movzx esi, byte [rsp + rax + 0x20]
mov edi, edx
xor edx, esi
add edx, eax
nop dword [rax + rax]
cmp rdi, 0xb
jae 0x51fc1f
movzx r8d, byte [rsp + rdi + 0x2d]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x45]
cmp rsi, 0xb
jb 0x51fbab
jmp 0x51fc13
xor eax, eax
lea rbx, [rsp + 0x2d]
mov ecx, 0xb
call fcn.004669c0
add rsp, 0x38
pop rbp
ret
mov eax, esi
mov ecx, 0xb
call fcn.0046c880
mov eax, edi
mov ecx, 0xb
call fcn.0046c880
nop
call fcn.0046a5a0
jmp fcn.0051fb60

Function at 0x5212c0
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x52138a
push rbp
mov rbp, rsp
sub rsp, 0x48
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rbx
mov qword [rsp], rax
mov qword [rsp + 8], rbx
mov byte [rsp + 0x10], 0
call fcn.00403180
xorps xmm15, xmm15
mov r14, qword [0x00717b90]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x18], 0xffffffffffffffff
jne 0x52136f
mov rcx, qword [rsp + 0x60]
lea rdx, [rcx + 1]
mov qword [rsp + 0x40], rdx
lea rax, [0x005860e0]
xor ebx, ebx
mov rcx, rdx
call fcn.00466120
mov rbx, qword [rsp + 0x60]
mov rcx, rax
xor edi, edi
mov rsi, qword [rsp + 0x40]
mov rax, qword [rsp + 0x58]
nop dword [rax]
call fcn.00521dc0
inc rbx
cmp rcx, rbx
jae 0x52135e
mov edi, 1
lea rsi, [0x005860e0]
call fcn.00466200
mov word [rax + rbx*2 - 2], 0
xor edi, edi
xor esi, esi
add rsp, 0x48
pop rbp
ret
xor eax, eax
xor ebx, ebx
mov rcx, rbx
lea rdi, [0x005f1468]
lea rsi, [0x005f0fd8]
add rsp, 0x48
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.0046a5a0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.005212c0
Function at 0x525ec0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x525f8c
push rbp
mov rbp, rsp
sub rsp, 0x38
movabs rdx, 0x2733b67061c66461
mov qword [rsp + 0x2c], rdx
mov dword [rsp + 0x34], 0xb3893305
movabs rdx, 0x8060a020a070609
mov qword [rsp + 0x1c], rdx
movabs rdx, 0x50b060608080609
mov qword [rsp + 0x24], rdx
xor eax, eax
jmp 0x525f25
movzx r9d, byte [rsp + rsi + 0x2c]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x66]
mov byte [rsp + rdi + 0x2c], dl
mov byte [rsp + rsi + 0x2c], r8b
add rax, 2
cmp rax, 0x10
jge 0x525f5c
movzx edx, byte [rsp + rax + 0x1c]
movzx esi, byte [rsp + rax + 0x1d]
mov edi, edx
xor edx, esi
add edx, eax
nop dword [rax + rax]
cmp rdi, 0xc
jae 0x525f7f
movzx r8d, byte [rsp + rdi + 0x2c]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x66]
cmp rsi, 0xc
jb 0x525f0b
jmp 0x525f73
xor eax, eax
lea rbx, [rsp + 0x2c]
mov ecx, 0xc
call fcn.004669c0
add rsp, 0x38
pop rbp
ret
mov eax, esi
mov ecx, 0xc
call fcn.0046c880
mov eax, edi
mov ecx, 0xc
call fcn.0046c880
nop
call fcn.0046a5a0
jmp fcn.00525ec0

Function at 0x526740
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x526812
push rbp
mov rbp, rsp
sub rsp, 0x38
movabs rdx, 0x5607116ede675f0c
mov qword [rsp + 0x2b], rdx
movabs rdx, 0x5765917561560711
mov qword [rsp + 0x30], rdx
movabs rdx, 0x60005060a0a0303
mov qword [rsp + 0x1b], rdx
movabs rdx, 0x60a010601090a
mov qword [rsp + 0x23], rdx
xor eax, eax
jmp 0x5267ac
movzx r9d, byte [rsp + rsi + 0x2b]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x67]
mov byte [rsp + rdi + 0x2b], dl
mov byte [rsp + rsi + 0x2b], r8b
add rax, 2
cmp rax, 0x10
jge 0x5267de
movzx edx, byte [rsp + rax + 0x1b]
movzx esi, byte [rsp + rax + 0x1c]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0xd
jae 0x526805
movzx r8d, byte [rsp + rdi + 0x2b]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x67]
cmp rsi, 0xd
jb 0x526792
jmp 0x5267f5
xor eax, eax
lea rbx, [rsp + 0x2b]
mov ecx, 0xd
call fcn.004669c0
add rsp, 0x38
pop rbp
ret
mov eax, esi
mov ecx, 0xd
nop dword [rax]
call fcn.0046c880
mov eax, edi
mov ecx, 0xd
call fcn.0046c880
nop
call fcn.0046a5a0
jmp fcn.00526740

Function at 0x5270c0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x52717d
push rbp
mov rbp, rsp
sub rsp, 0x30
movabs rdx, 0x2464f8180a64cc94
mov qword [rsp + 0x27], rdx
mov byte [rsp + 0x2f], 0x28
movabs rdx, 0x404030703000401
mov qword [rsp + 0x1b], rdx
mov dword [rsp + 0x23], 0x8070705
xor eax, eax
nop
jmp 0x527120
movzx r9d, byte [rsp + rsi + 0x27]
sub r9d, edx
lea edx, [r9 + 0x52]
mov byte [rsp + rdi + 0x27], dl
lea edx, [r8 + 0x52]
mov byte [rsp + rsi + 0x27], dl
add rax, 2
nop
cmp rax, 0xc
jge 0x52714d
movzx edx, byte [rsp + rax + 0x1b]
movzx esi, byte [rsp + rax + 0x1c]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 9
jae 0x527170
movzx r8d, byte [rsp + rdi + 0x27]
sub r8d, edx
cmp rsi, 9
jb 0x527102
jmp 0x527164
xor eax, eax
lea rbx, [rsp + 0x27]
mov ecx, 9
call fcn.004669c0
add rsp, 0x30
pop rbp
ret
mov eax, esi
mov ecx, 9
call fcn.0046c880
mov eax, edi
mov ecx, 9
call fcn.0046c880
nop
nop dword [rax]
call fcn.0046a5a0
jmp fcn.005270c0
Function at 0x5278c0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x52797d
push rbp
mov rbp, rsp
sub rsp, 0x30
movabs rdx, 0x53581d6549425053
mov qword [rsp + 0x27], rdx
mov byte [rsp + 0x2f], 0xe
movabs rdx, 0x206010308060503
mov qword [rsp + 0x1d], rdx
mov word [rsp + 0x25], 0x702
xor eax, eax
nop
jmp 0x527920
movzx r9d, byte [rsp + rsi + 0x27]
sub r9d, edx
lea edx, [r9 + 0x2a]
mov byte [rsp + rdi + 0x27], dl
lea edx, [r8 + 0x2a]
mov byte [rsp + rsi + 0x27], dl
add rax, 2
nop
cmp rax, 0xa
jge 0x52794d
movzx edx, byte [rsp + rax + 0x1d]
movzx esi, byte [rsp + rax + 0x1e]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 9
jae 0x527970
movzx r8d, byte [rsp + rdi + 0x27]
sub r8d, edx
cmp rsi, 9
jb 0x527902
jmp 0x527964
xor eax, eax
lea rbx, [rsp + 0x27]
mov ecx, 9
call fcn.004669c0
add rsp, 0x30
pop rbp
ret
mov eax, esi
mov ecx, 9
call fcn.0046c880
mov eax, edi
mov ecx, 9
call fcn.0046c880
nop
nop dword [rax]
call fcn.0046a5a0
jmp fcn.005278c0

Function at 0x52de00
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x52defb
push rbp
mov rbp, rsp
sub rsp, 0x50
movabs rdx, 0x45eefa67093a274a
mov qword [rsp + 0x3a], rdx
movabs rdx, 0x642c3152252045ee
mov qword [rsp + 0x40], rdx
movabs rdx, 0x656d4154cf277261
mov qword [rsp + 0x48], rdx
movabs rdx, 0x609020707010903
mov qword [rsp + 0x1e], rdx
movabs rdx, 0x307110509061002
mov qword [rsp + 0x26], rdx
movabs rdx, 0xc00020603071105
mov qword [rsp + 0x2a], rdx
movabs rdx, 0xb1313050102070a
mov qword [rsp + 0x32], rdx
xor eax, eax
jmp 0x52de99
movzx r9d, byte [rsp + rsi + 0x3a]
lea edx, [r9 + rdx]
lea edx, [rdx + 6]
mov byte [rsp + rdi + 0x3a], dl
mov byte [rsp + rsi + 0x3a], r8b
add rax, 2
cmp rax, 0x1c
jge 0x52decb
movzx edx, byte [rsp + rax + 0x1e]
movzx esi, byte [rsp + rax + 0x1f]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x16
jae 0x52deee
movzx r8d, byte [rsp + rdi + 0x3a]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 6]
cmp rsi, 0x16
jb 0x52de7f
jmp 0x52dee2
xor eax, eax
lea rbx, [rsp + 0x3a]
mov ecx, 0x16
call fcn.004669c0
add rsp, 0x50
pop rbp
ret
mov eax, esi
mov ecx, 0x16
call fcn.0046c880
mov eax, edi
mov ecx, 0x16
call fcn.0046c880
nop
nop dword [rax + rax]
call fcn.0046a5a0
jmp fcn.0052de00
Function at 0x530ec0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x530faa
push rbp
mov rbp, rsp
sub rsp, 0x48
movabs rdx, 0x6eb861749c75a6bb
mov qword [rsp + 0x32], rdx
movabs rdx, 0x64ab007453206eb8
mov qword [rsp + 0x38], rdx
movabs rdx, 0xf3c69f57fa678361
mov qword [rsp + 0x40], rdx
movabs rdx, 0x1511030b10010f10
mov qword [rsp + 0x1a], rdx
movabs rdx, 0xf0611010c12120f
mov qword [rsp + 0x22], rdx
movabs rdx, 0x1506111003140013
mov qword [rsp + 0x2a], rdx
xor eax, eax
jmp 0x530f4d
movzx r9d, byte [rsp + rsi + 0x32]
sub r9d, edx
lea edx, [r9 - 0x2f]
mov byte [rsp + rdi + 0x32], dl
lea edx, [r8 - 0x2f]
mov byte [rsp + rsi + 0x32], dl
add rax, 2
cmp rax, 0x18
jge 0x530f7a
movzx edx, byte [rsp + rax + 0x1a]
movzx esi, byte [rsp + rax + 0x1b]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x16
jae 0x530f9d
movzx r8d, byte [rsp + rdi + 0x32]
sub r8d, edx
cmp rsi, 0x16
jb 0x530f30
jmp 0x530f91
xor eax, eax
lea rbx, [rsp + 0x32]
mov ecx, 0x16
call fcn.004669c0
add rsp, 0x48
pop rbp
ret
mov eax, esi
mov ecx, 0x16
call fcn.0046c880
mov eax, edi
mov ecx, 0x16
call fcn.0046c880
nop
call fcn.0046a5a0
jmp fcn.00530ec0

Function at 0x5363c0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x5364bb
push rbp
mov rbp, rsp
sub rsp, 0x50
movabs rdx, 0x17426658620d5941
mov qword [rsp + 0x3b], rdx
movabs rdx, 0x4d43600d37174266
mov qword [rsp + 0x40], rdx
movabs rdx, 0x4152335446300b61
mov qword [rsp + 0x48], rdx
movabs rdx, 0x140a050c140b0a12
mov qword [rsp + 0x1d], rdx
movabs rdx, 0xf100a010e130513
mov qword [rsp + 0x25], rdx
movabs rdx, 0x907060810020f10
mov qword [rsp + 0x2b], rdx
movabs rdx, 0x913061413090b04
mov qword [rsp + 0x33], rdx
xor eax, eax
jmp 0x536459
movzx r9d, byte [rsp + rsi + 0x3b]
lea edx, [r9 + rdx]
lea edx, [rdx - 0xf]
mov byte [rsp + rdi + 0x3b], dl
mov byte [rsp + rsi + 0x3b], r8b
add rax, 2
cmp rax, 0x1e
jge 0x53648b
movzx edx, byte [rsp + rax + 0x1d]
movzx esi, byte [rsp + rax + 0x1e]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x15
jae 0x5364ae
movzx r8d, byte [rsp + rdi + 0x3b]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0xf]
cmp rsi, 0x15
jb 0x53643f
jmp 0x5364a2
xor eax, eax
lea rbx, [rsp + 0x3b]
mov ecx, 0x15
call fcn.004669c0
add rsp, 0x50
pop rbp
ret
mov eax, esi
mov ecx, 0x15
call fcn.0046c880
mov eax, edi
mov ecx, 0x15
call fcn.0046c880
nop
nop dword [rax + rax]
call fcn.0046a5a0
jmp fcn.005363c0