joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4f04e0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4f05ca
push rbp
mov rbp, rsp
sub rsp, 0x48
movabs rdx, 0xa69ab2eb616c65a3
mov qword [rsp + 0x1b], rdx
movabs rdx, 0x64e529746fa69ab2
mov qword [rsp + 0x20], rdx
movabs rdx, 0x72bf6954e3649084
mov qword [rsp + 0x28], rdx
movabs rdx, 0x4071006060a1010
mov qword [rsp + 0x30], rdx
movabs rdx, 0xb13080e000d080b
mov qword [rsp + 0x38], rdx
movabs rdx, 0x1014071405051310
mov qword [rsp + 0x40], rdx
xor eax, eax
jmp 0x4f056d
movzx r9d, byte [rsp + rsi + 0x1b]
sub r9d, edx
lea edx, [r9 - 0x2b]
mov byte [rsp + rdi + 0x1b], dl
lea edx, [r8 - 0x2b]
mov byte [rsp + rsi + 0x1b], dl
add rax, 2
cmp rax, 0x18
jge 0x4f059a
movzx edx, byte [rsp + rax + 0x30]
movzx esi, byte [rsp + rax + 0x31]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x15
jae 0x4f05bd
movzx r8d, byte [rsp + rdi + 0x1b]
sub r8d, edx
cmp rsi, 0x15
jb 0x4f0550
jmp 0x4f05b1
xor eax, eax
lea rbx, [rsp + 0x1b]
mov ecx, 0x15
call fcn.0044bb20
add rsp, 0x48
pop rbp
ret
mov eax, esi
mov ecx, 0x15
call fcn.00461020
mov eax, edi
mov ecx, 0x15
call fcn.00461020
nop
call fcn.0045eda0
jmp fcn.004f04e0

Function at 0x4f3180
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4f327b
push rbp
mov rbp, rsp
sub rsp, 0x50
movabs rdx, 0x50e36575b1e7d7dc
mov qword [rsp + 0x1f], rdx
movabs rdx, 0xf56ed9e653028750
mov qword [rsp + 0x26], rdx
movabs rdx, 0xf976699820648005
mov qword [rsp + 0x2e], rdx
movabs rdx, 0xf08090316101310
mov qword [rsp + 0x36], rdx
movabs rdx, 0x1007070c0113150b
mov qword [rsp + 0x3e], rdx
movabs rdx, 0xe021007070c0113
mov qword [rsp + 0x40], rdx
movabs rdx, 0xc0b0b0f061007
mov qword [rsp + 0x48], rdx
xor eax, eax
jmp 0x4f3219
movzx r9d, byte [rsp + rsi + 0x1f]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x61]
mov byte [rsp + rdi + 0x1f], dl
mov byte [rsp + rsi + 0x1f], r8b
add rax, 2
cmp rax, 0x1a
jge 0x4f324b
movzx edx, byte [rsp + rax + 0x36]
movzx esi, byte [rsp + rax + 0x37]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x17
jae 0x4f326e
movzx r8d, byte [rsp + rdi + 0x1f]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x61]
cmp rsi, 0x17
jb 0x4f31ff
jmp 0x4f3262
xor eax, eax
lea rbx, [rsp + 0x1f]
mov ecx, 0x17
call fcn.0044bb20
add rsp, 0x50
pop rbp
ret
mov eax, esi
mov ecx, 0x17
call fcn.00461020
mov eax, edi
mov ecx, 0x17
call fcn.00461020
nop
nop dword [rax + rax]
call fcn.0045eda0
jmp fcn.004f3180
Function at 0x4f3540
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4f364c
push rbp
mov rbp, rsp
sub rsp, 0x50
movabs rdx, 0x637995ba74a2651c
mov qword [rsp + 0x1a], rdx
movabs rdx, 0x61bca02063b2e7c7
mov qword [rsp + 0x22], rdx
movabs rdx, 0x648561bca02063b2
mov qword [rsp + 0x24], rdx
movabs rdx, 0x5c6dac1680647215
mov qword [rsp + 0x2c], rdx
movabs rdx, 0x191715090e080406
mov qword [rsp + 0x34], rdx
movabs rdx, 0x217100d12020017
mov qword [rsp + 0x3c], rdx
movabs rdx, 0x161700000217100d
mov qword [rsp + 0x40], rdx
movabs rdx, 0x91505001517020a
mov qword [rsp + 0x48], rdx
xor eax, eax
jmp 0x4f35e8
movzx r9d, byte [rsp + rsi + 0x1a]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x5b]
mov byte [rsp + rdi + 0x1a], dl
mov byte [rsp + rsi + 0x1a], r8b
add rax, 2
cmp rax, 0x1c
jge 0x4f361c
movzx edx, byte [rsp + rax + 0x34]
movzx esi, byte [rsp + rax + 0x35]
mov edi, edx
xor edx, esi
add edx, eax
nop
cmp rdi, 0x1a
jae 0x4f363f
movzx r8d, byte [rsp + rdi + 0x1a]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x5b]
cmp rsi, 0x1a
jb 0x4f35ce
jmp 0x4f3633
xor eax, eax
lea rbx, [rsp + 0x1a]
mov ecx, 0x1a
call fcn.0044bb20
add rsp, 0x50
pop rbp
ret
mov eax, esi
mov ecx, 0x1a
call fcn.00461020
mov eax, edi
mov ecx, 0x1a
call fcn.00461020
nop
call fcn.0045eda0
jmp fcn.004f3540
Function at 0x4fa260
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4fa33d
push rbp
mov rbp, rsp
sub rsp, 0x40
movabs rdx, 0x745cdbbcdb3bde4f
mov qword [rsp + 0x1c], rdx
movabs rdx, 0xe2b354b8d5cfc9e2
mov qword [rsp + 0x24], rdx
movabs rdx, 0xe000c090a05020d
mov qword [rsp + 0x2c], rdx
movabs rdx, 0xf020d0d0e000c09
mov qword [rsp + 0x30], rdx
movabs rdx, 0xe0408030b01060b
mov qword [rsp + 0x38], rdx
xor eax, eax
nop
jmp 0x4fa2e0
movzx r9d, byte [rsp + rsi + 0x1c]
sub r9d, edx
lea edx, [r9 - 0x5b]
mov byte [rsp + rdi + 0x1c], dl
lea edx, [r8 - 0x5b]
mov byte [rsp + rsi + 0x1c], dl
add rax, 2
nop
cmp rax, 0x14
jge 0x4fa30d
movzx edx, byte [rsp + rax + 0x2c]
movzx esi, byte [rsp + rax + 0x2d]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x10
jae 0x4fa330
movzx r8d, byte [rsp + rdi + 0x1c]
sub r8d, edx
cmp rsi, 0x10
jb 0x4fa2c2
jmp 0x4fa324
xor eax, eax
lea rbx, [rsp + 0x1c]
mov ecx, 0x10
call fcn.0044bb20
add rsp, 0x40
pop rbp
ret
mov eax, esi
mov ecx, 0x10
call fcn.00461020
mov eax, edi
mov ecx, 0x10
call fcn.00461020
nop
nop dword [rax]
call fcn.0045eda0
jmp fcn.004fa260

Function at 0x4fbb60
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4fbc4c
push rbp
mov rbp, rsp
sub rsp, 0x40
movabs rdx, 0xce1af0ad4d196504
mov qword [rsp + 0x2e], rdx
movabs rdx, 0x1665ce1af0ad4d19
mov qword [rsp + 0x30], rdx
movabs rdx, 0xbae5cdfb201d6c69
mov qword [rsp + 0x38], rdx
movabs rdx, 0xc0c040d090e0011
mov qword [rsp + 0x1c], rdx
movabs rdx, 0x60f0c0c040d090e
mov qword [rsp + 0x1e], rdx
movabs rdx, 0x506020207100d
mov qword [rsp + 0x26], rdx
xor eax, eax
jmp 0x4fbbea
movzx r9d, byte [rsp + rsi + 0x2e]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x42]
mov byte [rsp + rdi + 0x2e], dl
mov byte [rsp + rsi + 0x2e], r8b
add rax, 2
cmp rax, 0x12
jge 0x4fbc1c
movzx edx, byte [rsp + rax + 0x1c]
movzx esi, byte [rsp + rax + 0x1d]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x12
jae 0x4fbc3f
movzx r8d, byte [rsp + rdi + 0x2e]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x42]
cmp rsi, 0x12
jb 0x4fbbd0
jmp 0x4fbc33
xor eax, eax
lea rbx, [rsp + 0x2e]
mov ecx, 0x12
call fcn.0044bb20
add rsp, 0x40
pop rbp
ret
mov eax, esi
mov ecx, 0x12
call fcn.00461020
mov eax, edi
mov ecx, 0x12
call fcn.00461020
nop
call fcn.0045eda0
jmp fcn.004fbb60
Function at 0x4fbc60
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4fbd2c
push rbp
mov rbp, rsp
sub rsp, 0x38
movabs rdx, 0x501513e515b4021f
mov qword [rsp + 0x1b], rdx
movabs rdx, 0x16d305bef9501513
mov qword [rsp + 0x20], rdx
movabs rdx, 0x505040b00090203
mov qword [rsp + 0x28], rdx
movabs rdx, 0x406030100080c0a
mov qword [rsp + 0x30], rdx
xor eax, eax
jmp 0x4fbccf
movzx r9d, byte [rsp + rsi + 0x1b]
sub r9d, edx
lea edx, [r9 + 0x60]
mov byte [rsp + rdi + 0x1b], dl
lea edx, [r8 + 0x60]
mov byte [rsp + rsi + 0x1b], dl
add rax, 2
cmp rax, 0x10
jge 0x4fbcfc
movzx edx, byte [rsp + rax + 0x28]
movzx esi, byte [rsp + rax + 0x29]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0xd
jae 0x4fbd1f
movzx r8d, byte [rsp + rdi + 0x1b]
sub r8d, edx
cmp rsi, 0xd
jb 0x4fbcb2
jmp 0x4fbd13
xor eax, eax
lea rbx, [rsp + 0x1b]
mov ecx, 0xd
call fcn.0044bb20
add rsp, 0x38
pop rbp
ret
mov eax, esi
mov ecx, 0xd
call fcn.00461020
mov eax, edi
mov ecx, 0xd
call fcn.00461020
nop
call fcn.0045eda0
jmp fcn.004fbc60

Function at 0x4fbd40
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4fbe0c
push rbp
mov rbp, rsp
sub rsp, 0x38
movabs rdx, 0x32b85a438978818c
mov qword [rsp + 0x1a], rdx
movabs rdx, 0x8374c972874632b8
mov qword [rsp + 0x20], rdx
movabs rdx, 0x6040d060b0d0500
mov qword [rsp + 0x28], rdx
movabs rdx, 0x40305020d020901
mov qword [rsp + 0x30], rdx
xor eax, eax
jmp 0x4fbdaf
movzx r9d, byte [rsp + rsi + 0x1a]
sub r9d, edx
lea edx, [r9 - 8]
mov byte [rsp + rdi + 0x1a], dl
lea edx, [r8 - 8]
mov byte [rsp + rsi + 0x1a], dl
add rax, 2
cmp rax, 0x10
jge 0x4fbddc
movzx edx, byte [rsp + rax + 0x28]
movzx esi, byte [rsp + rax + 0x29]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0xe
jae 0x4fbdff
movzx r8d, byte [rsp + rdi + 0x1a]
sub r8d, edx
cmp rsi, 0xe
jb 0x4fbd92
jmp 0x4fbdf3
xor eax, eax
lea rbx, [rsp + 0x1a]
mov ecx, 0xe
call fcn.0044bb20
add rsp, 0x38
pop rbp
ret
mov eax, esi
mov ecx, 0xe
call fcn.00461020
mov eax, edi
mov ecx, 0xe
call fcn.00461020
nop
call fcn.0045eda0
jmp fcn.004fbd40
Function at 0x4fc480
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4fc59a
push rbp
mov rbp, rsp
sub rsp, 0x58
movabs rdx, 0x491f432f5474655a
mov qword [rsp + 0x1c], rdx
movabs rdx, 0x6f393562614c666e
mov qword [rsp + 0x24], rdx
movabs rdx, 0x6e4b6f393562614c
mov qword [rsp + 0x26], rdx
movabs rdx, 0x2e675e515d487957
mov qword [rsp + 0x2e], rdx
movabs rdx, 0x16190e121805170d
mov qword [rsp + 0x36], rdx
movabs rdx, 0xc1016190e121805
mov qword [rsp + 0x38], rdx
movabs rdx, 0x40b06190c050017
mov qword [rsp + 0x40], rdx
movabs rdx, 0x50e0b0f000a0515
mov qword [rsp + 0x48], rdx
movabs rdx, 0x190a180f0316190f
mov qword [rsp + 0x50], rdx
xor eax, eax
jmp 0x4fc537
movzx r9d, byte [rsp + rsi + 0x1c]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x17]
mov byte [rsp + rdi + 0x1c], dl
mov byte [rsp + rsi + 0x1c], r8b
add rax, 2
cmp rax, 0x22
jge 0x4fc569
movzx edx, byte [rsp + rax + 0x36]
movzx esi, byte [rsp + rax + 0x37]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x1a
jae 0x4fc58d
movzx r8d, byte [rsp + rdi + 0x1c]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x17]
cmp rsi, 0x1a
jb 0x4fc51d
jmp 0x4fc581
xor eax, eax
lea rbx, [rsp + 0x1c]
mov ecx, 0x1a
call fcn.0044bb20
add rsp, 0x58
pop rbp
nop
ret
mov eax, esi
mov ecx, 0x1a
call fcn.00461020
mov eax, edi
mov ecx, 0x1a
call fcn.00461020
nop
call fcn.0045eda0
nop
jmp fcn.004fc480
Function at 0x505c60
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x505d68
push rbp
mov rbp, rsp
sub rsp, 0x50
movabs rdx, 0x4869736e064a6e11
mov qword [rsp + 0x1d], rdx
movabs rdx, 0x493606587451384e
mov qword [rsp + 0x25], rdx
movabs rdx, 0x6c49360658745138
mov qword [rsp + 0x26], rdx
movabs rdx, 0x785b0475375a3459
mov qword [rsp + 0x2e], rdx
movabs rdx, 0x160c17080f120d09
mov qword [rsp + 0x36], rdx
movabs rdx, 0x9140711130e0900
mov qword [rsp + 0x3e], rdx
movabs rdx, 0xa1309140711130e
mov qword [rsp + 0x40], rdx
movabs rdx, 0xa1702090f11030f
mov qword [rsp + 0x48], rdx
xor eax, eax
jmp 0x505d0b
movzx r9d, byte [rsp + rsi + 0x1d]
sub r9d, edx
lea edx, [r9 + 0x3c]
mov byte [rsp + rdi + 0x1d], dl
lea edx, [r8 + 0x3c]
mov byte [rsp + rsi + 0x1d], dl
add rax, 2
cmp rax, 0x1a
jge 0x505d38
movzx edx, byte [rsp + rax + 0x36]
movzx esi, byte [rsp + rax + 0x37]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x19
jae 0x505d5b
movzx r8d, byte [rsp + rdi + 0x1d]
sub r8d, edx
cmp rsi, 0x19
jb 0x505cee
jmp 0x505d4f
xor eax, eax
lea rbx, [rsp + 0x1d]
mov ecx, 0x19
call fcn.0044bb20
add rsp, 0x50
pop rbp
ret
mov eax, esi
mov ecx, 0x19
call fcn.00461020
mov eax, edi
mov ecx, 0x19
call fcn.00461020
nop
call fcn.0045eda0
jmp fcn.00505c60
Function at 0x505d80
Capabilities:
Encrypt data using rc4 prga

Disassembly:
lea r12, [rsp - 0x38]
cmp r12, qword [r14 + 0x10]
jbe 0x505f4a
push rbp
mov rbp, rsp
sub rsp, 0xb0
movabs rdx, 0xb96d61fa70a36fd8
mov qword [rsp + 0x1f], rdx
movabs rdx, 0xc975996e6f638fb9
mov qword [rsp + 0x26], rdx
movabs rdx, 0xb1aa6f73876e9d63
mov qword [rsp + 0x2e], rdx
movabs rdx, 0x76836e8a69cbb1a8
mov qword [rsp + 0x36], rdx
movabs rdx, 0x7f698920af846e63
mov qword [rsp + 0x3e], rdx
movabs rdx, 0x656c696698917767
mov qword [rsp + 0x46], rdx
movabs rdx, 0x8f636f209479febb
mov qword [rsp + 0x4e], rdx
movabs rdx, 0x208e89bd28317431
mov qword [rsp + 0x56], rdx
movabs rdx, 0xd09a528338b9f3b2
mov qword [rsp + 0x5e], rdx
movabs rdx, 0x3918361738101f45
mov qword [rsp + 0x66], rdx
movabs rdx, 0x83d331328023032
mov qword [rsp + 0x6e], rdx
movabs rdx, 0x4126083d33132802
mov qword [rsp + 0x70], rdx
movabs rdx, 0x3c17291d1e370e10
mov qword [rsp + 0x78], rdx
movabs rdx, 0x312839303c162815
mov qword [rsp + 0x80], rdx
movabs rdx, 0x19072a4303101230
mov qword [rsp + 0x88], rdx
movabs rdx, 0x1b460f3f3f440c24
mov qword [rsp + 0x90], rdx
movabs rdx, 0x211938073b1808
mov qword [rsp + 0x98], rdx
movabs rdx, 0xf12403636043906
mov qword [rsp + 0xa0], rdx
movabs rdx, 0x1f2f3c03223c2100
mov qword [rsp + 0xa8], rdx
xor eax, eax
jmp 0x505eea
movzx r9d, byte [rsp + rsi + 0x1f]
sub r9d, edx
lea edx, [r9 + 0x2c]
mov byte [rsp + rdi + 0x1f], dl
lea edx, [r8 + 0x2c]
mov byte [rsp + rsi + 0x1f], dl
add rax, 2
cmp rax, 0x4a
jge 0x505f17
movzx edx, byte [rsp + rax + 0x66]
movzx esi, byte [rsp + rax + 0x67]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x47
jae 0x505f3d
movzx r8d, byte [rsp + rdi + 0x1f]
sub r8d, edx
cmp rsi, 0x47
jb 0x505ecd
jmp 0x505f31
xor eax, eax
lea rbx, [rsp + 0x1f]
mov ecx, 0x47
call fcn.0044bb20
add rsp, 0xb0
pop rbp
ret
mov eax, esi
mov ecx, 0x47
call fcn.00461020
mov eax, edi
mov ecx, 0x47
call fcn.00461020
nop
call fcn.0045eda0
jmp fcn.00505d80
Function at 0x510be0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
lea r12, [rsp - 0x18]
cmp r12, qword [r14 + 0x10]
jbe 0x510cea
push rbp
mov rbp, rsp
sub rsp, 0x90
movzx edx, byte [rax + 0x4c]
mov byte [rax + 0x4c], cl
nop
movabs rsi, 0xd77b2d7188f50d88
mov qword [rsp + 0x57], rsi
movabs rsi, 0x64d77b2d7188f50d
mov qword [rsp + 0x58], rsi
movabs rsi, 0xe6a2c443cea43d96
mov qword [rsp + 0x60], rsi
movabs rsi, 0xe04d1845bbc73cb8
mov qword [rsp + 0x46], rsi
movabs rsi, 0x5ce04d1845bbc73c
mov qword [rsp + 0x47], rsi
movabs rsi, 0x9ec4a127adc65caf
mov qword [rsp + 0x4f], rsi
xor ecx, ecx
nop
jmp 0x510c76
movzx esi, byte [rsp + rcx + 0x57]
movzx edi, byte [rsp + rcx + 0x46]
xor edi, esi
mov byte [rsp + rcx + 0x46], dil
inc rcx
cmp rcx, 0x11
jl 0x510c62
mov qword [rsp + 0xa0], rax
mov byte [rsp + 0x37], dl
mov qword [rsp + 0x38], rbx
lea rdx, [rax + 0x40]
mov qword [rsp + 0x88], rdx
lea rbx, [rsp + 0x46]
mov ecx, 0x11
lea rax, [rsp + 0x68]
call fcn.0044bb20
mov ecx, 0x10
xor edi, edi
mov esi, 0x76
mov r8, rax
mov r9, rbx
mov rax, qword [rsp + 0x88]
mov rbx, qword [rsp + 0x38]
call fcn.0050e420
movzx edx, byte [rsp + 0x37]
mov rsi, qword [rsp + 0xa0]
mov byte [rsi + 0x4c], dl
add rsp, 0x90
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov byte [rsp + 0x18], cl
call fcn.0045eda0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
movzx ecx, byte [rsp + 0x18]
jmp fcn.00510be0

Function at 0x518380
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x51843d
push rbp
mov rbp, rsp
sub rsp, 0x30
movabs rdx, 0x311a912d9528c125
mov qword [rsp + 0x1b], rdx
mov byte [rsp + 0x23], 0xb8
movabs rdx, 0x807060601040606
mov qword [rsp + 0x24], rdx
mov dword [rsp + 0x2c], 0x5010308
xor eax, eax
nop
jmp 0x5183e0
movzx r9d, byte [rsp + rsi + 0x1b]
sub r9d, edx
lea edx, [r9 - 0x62]
mov byte [rsp + rdi + 0x1b], dl
lea edx, [r8 - 0x62]
mov byte [rsp + rsi + 0x1b], dl
add rax, 2
nop
cmp rax, 0xc
jge 0x51840d
movzx edx, byte [rsp + rax + 0x24]
movzx esi, byte [rsp + rax + 0x25]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 9
jae 0x518430
movzx r8d, byte [rsp + rdi + 0x1b]
sub r8d, edx
cmp rsi, 9
jb 0x5183c2
jmp 0x518424
xor eax, eax
lea rbx, [rsp + 0x1b]
mov ecx, 9
call fcn.0044bb20
add rsp, 0x30
pop rbp
ret
mov eax, esi
mov ecx, 9
call fcn.00461020
mov eax, edi
mov ecx, 9
call fcn.00461020
nop
nop dword [rax]
call fcn.0045eda0
jmp fcn.00518380
Function at 0x527560
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x527687
push rbp
mov rbp, rsp
sub rsp, 0x68
movabs rdx, 0xcc9eea206dde003b
mov qword [rsp + 0x1e], rdx
movabs rdx, 0x586f26d806ed93ec
mov qword [rsp + 0x26], rdx
movabs rdx, 0xed20acf15b723e73
mov qword [rsp + 0x2e], rdx
movabs rdx, 0x4eefdf53f66c62d2
mov qword [rsp + 0x36], rdx
movabs rdx, 0x70700060b1c111b
mov qword [rsp + 0x3e], rdx
movabs rdx, 0x21b13181d031f05
mov qword [rsp + 0x46], rdx
movabs rdx, 0x1408021b13181d03
mov qword [rsp + 0x48], rdx
movabs rdx, 0xd110605030f1107
mov qword [rsp + 0x50], rdx
movabs rdx, 0xf15001d090c111e
mov qword [rsp + 0x58], rdx
movabs rdx, 0x1d1c030a1701180b
mov qword [rsp + 0x60], rdx
xor eax, eax
jmp 0x527629
movzx r9d, byte [rsp + rsi + 0x1e]
sub r9d, edx
lea edx, [r9 - 0x52]
mov byte [rsp + rdi + 0x1e], dl
lea edx, [r8 - 0x52]
mov byte [rsp + rsi + 0x1e], dl
add rax, 2
cmp rax, 0x2a
jge 0x527657
movzx edx, byte [rsp + rax + 0x3e]
movzx esi, byte [rsp + rax + 0x3f]
mov edi, edx
xor edx, esi
add edx, eax
nop
cmp rdi, 0x20
jae 0x52767a
movzx r8d, byte [rsp + rdi + 0x1e]
sub r8d, edx
cmp rsi, 0x20
jb 0x52760c
jmp 0x52766e
xor eax, eax
lea rbx, [rsp + 0x1e]
mov ecx, 0x20
call fcn.0044bb20
add rsp, 0x68
pop rbp
ret
mov eax, esi
mov ecx, 0x20
call fcn.00461020
mov eax, edi
mov ecx, 0x20
call fcn.00461020
nop
call fcn.0045eda0
jmp fcn.00527560

Function at 0x5276a0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x5277d8
push rbp
mov rbp, rsp
sub rsp, 0x70
movabs rdx, 0x336fcd2023166b59
mov qword [rsp + 0x1e], rdx
movabs rdx, 0xd9616513336fcd20
mov qword [rsp + 0x22], rdx
movabs rdx, 0xdf1f926727cfeb7
mov qword [rsp + 0x2a], rdx
movabs rdx, 0xc38d4656c55a7c9
mov qword [rsp + 0x32], rdx
movabs rdx, 0x762528490a21e919
mov qword [rsp + 0x3a], rdx
movabs rdx, 0xe21211d15070d16
mov qword [rsp + 0x42], rdx
movabs rdx, 0x21110d00011f1512
mov qword [rsp + 0x4a], rdx
movabs rdx, 0x70d0e1c21142111
mov qword [rsp + 0x50], rdx
movabs rdx, 0x111202051f131c1b
mov qword [rsp + 0x58], rdx
movabs rdx, 0x8001a200b130c19
mov qword [rsp + 0x60], rdx
movabs rdx, 0x21b2119201e1003
mov qword [rsp + 0x68], rdx
xor eax, eax
jmp 0x527778
movzx r9d, byte [rsp + rsi + 0x1e]
sub r9d, edx
lea edx, [r9 + 0x7f]
mov byte [rsp + rdi + 0x1e], dl
lea edx, [r8 + 0x7f]
mov byte [rsp + rsi + 0x1e], dl
add rax, 2
cmp rax, 0x2e
jge 0x5277a8
movzx edx, byte [rsp + rax + 0x42]
movzx esi, byte [rsp + rax + 0x43]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x24
jae 0x5277cb
movzx r8d, byte [rsp + rdi + 0x1e]
sub r8d, edx
nop dword [rax]
cmp rsi, 0x24
jb 0x52775b
jmp 0x5277bf
xor eax, eax
lea rbx, [rsp + 0x1e]
mov ecx, 0x24
call fcn.0044bb20
add rsp, 0x70
pop rbp
ret
mov eax, esi
mov ecx, 0x24
call fcn.00461020
mov eax, edi
mov ecx, 0x24
call fcn.00461020
nop
call fcn.0045eda0
nop dword [rax]
jmp fcn.005276a0
Function at 0x527b40
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x527c87
push rbp
mov rbp, rsp
sub rsp, 0x70
movabs rdx, 0x205774203f4f4233
mov qword [rsp + 0x46], rdx
movabs rdx, 0x205647076b6565da
mov qword [rsp + 0x4e], rdx
movabs rdx, 0x2c31205647076b65
mov qword [rsp + 0x50], rdx
movabs rdx, 0x3ce7693904657315
mov qword [rsp + 0x58], rdx
movabs rdx, 0xf26586ffb090a20
mov qword [rsp + 0x60], rdx
movabs rdx, 0xb032156873076f61
mov qword [rsp + 0x68], rdx
movabs rdx, 0x2428080c2921001c
mov qword [rsp + 0x1c], rdx
movabs rdx, 0x12271b1511031018
mov qword [rsp + 0x24], rdx
movabs rdx, 0x1d1612271b151103
mov qword [rsp + 0x26], rdx
movabs rdx, 0x2901191b21281626
mov qword [rsp + 0x2e], rdx
movabs rdx, 0xd1f000208152002
mov qword [rsp + 0x36], rdx
movabs rdx, 0x29290e1506080322
mov qword [rsp + 0x3e], rdx
xor eax, eax
jmp 0x527c27
movzx r9d, byte [rsp + rsi + 0x46]
sub r9d, edx
lea edx, [r9 + 0x4e]
mov byte [rsp + rdi + 0x46], dl
lea edx, [r8 + 0x4e]
mov byte [rsp + rsi + 0x46], dl
add rax, 2
cmp rax, 0x2a
jge 0x527c57
movzx edx, byte [rsp + rax + 0x1c]
movzx esi, byte [rsp + rax + 0x1d]
mov edi, edx
xor edx, esi
add edx, eax
nop dword [rax]
cmp rdi, 0x2a
jae 0x527c7a
movzx r8d, byte [rsp + rdi + 0x46]
sub r8d, edx
cmp rsi, 0x2a
jb 0x527c0a
jmp 0x527c6e
xor eax, eax
lea rbx, [rsp + 0x46]
mov ecx, 0x2a
call fcn.0044bb20
add rsp, 0x70
pop rbp
ret
mov eax, esi
mov ecx, 0x2a
call fcn.00461020
mov eax, edi
mov ecx, 0x2a
call fcn.00461020
nop
call fcn.0045eda0
jmp fcn.00527b40

Function at 0x527ca0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x527dd8
push rbp
mov rbp, rsp
sub rsp, 0x70
movabs rdx, 0xfc6f74206c545400
mov qword [rsp + 0x1c], rdx
movabs rdx, 0xf597a272fc6f7420
mov qword [rsp + 0x20], rdx
movabs rdx, 0xf82c5a74a421a420
mov qword [rsp + 0x28], rdx
movabs rdx, 0x573d1557280fe90c
mov qword [rsp + 0x30], rdx
movabs rdx, 0x1bade4ab736e10a5
mov qword [rsp + 0x38], rdx
movabs rdx, 0x14201b12090e1117
mov qword [rsp + 0x40], rdx
movabs rdx, 0xd16232218201a0a
mov qword [rsp + 0x48], rdx
movabs rdx, 0x1915130f001c1c0f
mov qword [rsp + 0x50], rdx
movabs rdx, 0x1618190017222302
mov qword [rsp + 0x58], rdx
movabs rdx, 0x23191d1d21010b17
mov qword [rsp + 0x60], rdx
movabs rdx, 0x12200e1a0a210007
mov qword [rsp + 0x68], rdx
xor eax, eax
jmp 0x527d75
movzx r9d, byte [rsp + rsi + 0x1c]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x3b]
mov byte [rsp + rdi + 0x1c], dl
mov byte [rsp + rsi + 0x1c], r8b
add rax, 2
cmp rax, 0x30
jge 0x527da8
movzx edx, byte [rsp + rax + 0x40]
movzx esi, byte [rsp + rax + 0x41]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x24
jae 0x527dcb
movzx r8d, byte [rsp + rdi + 0x1c]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x3b]
nop
cmp rsi, 0x24
jb 0x527d5b
jmp 0x527dbf
xor eax, eax
lea rbx, [rsp + 0x1c]
mov ecx, 0x24
call fcn.0044bb20
add rsp, 0x70
pop rbp
ret
mov eax, esi
mov ecx, 0x24
call fcn.00461020
mov eax, edi
mov ecx, 0x24
call fcn.00461020
nop
call fcn.0045eda0
nop dword [rax]
jmp fcn.00527ca0
Function at 0x5290a0
Capabilities:
Encrypt data using rc4 prga
Resolve function by parsing pe exports

Disassembly:
lea r12, [rsp - 0x18]
cmp r12, qword [r14 + 0x10]
jbe 0x529235
push rbp
mov rbp, rsp
sub rsp, 0x90
movabs rdx, 0x5c61246f6974786f
mov qword [rsp + 0x54], rdx
movabs rdx, 0x8f567a80489f68ef
mov qword [rsp + 0x5c], rdx
movabs rdx, 0x65758a738f567a80
mov qword [rsp + 0x60], rdx
movabs rdx, 0x7315698380734220
mov qword [rsp + 0x68], rdx
movabs rdx, 0x856f104e61657489
mov qword [rsp + 0x70], rdx
movabs rdx, 0x683f5c616e645070
mov qword [rsp + 0x78], rdx
movabs rdx, 0x61684d721d646182
mov qword [rsp + 0x80], rdx
movabs rdx, 0x547c697320814961
mov qword [rsp + 0x88], rdx
movabs rdx, 0x2c0f3a230f0c0b1c
mov qword [rsp + 0x18], rdx
movabs rdx, 0x3221052a3b110d3a
mov qword [rsp + 0x20], rdx
movabs rdx, 0x517190a3221052a
mov qword [rsp + 0x24], rdx
movabs rdx, 0x3b1e233b0e340119
mov qword [rsp + 0x2c], rdx
movabs rdx, 0xf1524362c11350a
mov qword [rsp + 0x34], rdx
movabs rdx, 0xc251e1126050d29
mov qword [rsp + 0x3c], rdx
movabs rdx, 0x1e070f3211211218
mov qword [rsp + 0x44], rdx
movabs rdx, 0x311a1a0820072f21
mov qword [rsp + 0x4c], rdx
xor eax, eax
jmp 0x5291ce
movzx r9d, byte [rsp + rsi + 0x54]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x3f]
mov byte [rsp + rdi + 0x54], dl
mov byte [rsp + rsi + 0x54], r8b
add rax, 2
cmp rax, 0x3c
jge 0x529202
movzx edx, byte [rsp + rax + 0x18]
movzx esi, byte [rsp + rax + 0x19]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x3c
jae 0x529228
movzx r8d, byte [rsp + rdi + 0x54]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x3f]
cmp rsi, 0x3c
jb 0x5291b4
nop
jmp 0x52921c
xor eax, eax
lea rbx, [rsp + 0x54]
mov ecx, 0x3c
call fcn.0044bb20
add rsp, 0x90
pop rbp
ret
mov eax, esi
mov ecx, 0x3c
call fcn.00461020
mov eax, edi
mov ecx, 0x3c
call fcn.00461020
nop
call fcn.0045eda0
jmp fcn.005290a0