joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4f88c0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
sub rsp, 0x30
mov qword [rsp + 0x28], rbp
lea rbp, [rsp + 0x28]
mov qword [rsp + 0x38], 0
movabs rdx, 0x22c3d98750424ce0
mov qword [rsp + 0x20], rdx
movabs rdx, 0x205020201030004
mov qword [rsp + 0x10], rdx
xor eax, eax
jmp 0x4f8913
movzx r8d, byte [rsp + rbx + 0x20]
lea edx, [r8 + rdx]
lea edx, [rdx - 1]
mov byte [rsp + rsi + 0x20], dl
mov byte [rsp + rbx + 0x20], dil
add rax, 2
cmp rax, 8
jge 0x4f8948
movzx edx, byte [rsp + rax + 0x10]
movzx ebx, byte [rsp + rax + 0x11]
mov esi, edx
xor edx, ebx
add edx, eax
cmp rsi, 8
jae 0x4f8987
movzx edi, byte [rsp + rsi + 0x20]
lea edi, [rdi + rdx]
lea edi, [rdi - 1]
nop word [rax + rax]
cmp rbx, 8
jb 0x4f88f9
jmp 0x4f897b
mov qword [rsp + 0x18], 0
xor eax, eax
jmp 0x4f8961
movzx ecx, byte [rsp + rax + 0x20]
mov byte [rsp + rax + 0x18], cl
inc rax
cmp rax, 8
jl 0x4f8955
mov rax, qword [rsp + 0x18]
mov qword [rsp + 0x38], rax
mov rbp, qword [rsp + 0x28]
add rsp, 0x30
ret
mov eax, ebx
mov ecx, 8
call fcn.00453440
mov eax, esi
mov ecx, 8
call fcn.00453440
nop
int3

Function at 0x4f89a0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4f8a72
sub rsp, 0x40
mov qword [rsp + 0x38], rbp
lea rbp, [rsp + 0x38]
movabs rdx, 0x91dc1d53618164e5
mov qword [rsp + 0x1c], rdx
mov dword [rsp + 0x24], 0x312464e5
movabs rdx, 0x40a020b04070208
mov qword [rsp + 0x28], rdx
movabs rdx, 0x700060807080a05
mov qword [rsp + 0x30], rdx
xor eax, eax
jmp 0x4f8a0b
movzx r9d, byte [rsp + rsi + 0x1c]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x38]
mov byte [rsp + rdi + 0x1c], dl
mov byte [rsp + rsi + 0x1c], r8b
add rax, 2
cmp rax, 0x10
jge 0x4f8a3d
movzx edx, byte [rsp + rax + 0x28]
movzx esi, byte [rsp + rax + 0x29]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0xc
jae 0x4f8a65
movzx r8d, byte [rsp + rdi + 0x1c]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x38]
cmp rsi, 0xc
jb 0x4f89f1
jmp 0x4f8a58
xor eax, eax
lea rbx, [rsp + 0x1c]
mov ecx, 0xc
call fcn.004418e0
mov rbp, qword [rsp + 0x38]
add rsp, 0x40
ret
mov eax, esi
mov ecx, 0xc
nop
call fcn.00453440
mov eax, edi
mov ecx, 0xc
call fcn.00453440
nop
call fcn.00450de0
jmp fcn.004f89a0
Function at 0x4f90a0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4f918b
sub rsp, 0x48
mov qword [rsp + 0x40], rbp
lea rbp, [rsp + 0x40]
movabs rdx, 0xa5903372b684f2f6
mov qword [rsp + 0x1b], rdx
movabs rdx, 0x666caebf5674aca5
mov qword [rsp + 0x22], rdx
movabs rdx, 0x20a0a0b070c0a0b
mov qword [rsp + 0x2a], rdx
movabs rdx, 0xa0305030100020a
mov qword [rsp + 0x30], rdx
movabs rdx, 0x2010a0803020006
mov qword [rsp + 0x38], rdx
xor eax, eax
jmp 0x4f9124
movzx r9d, byte [rsp + rsi + 0x1b]
sub r9d, edx
lea edx, [r9 - 0x33]
mov byte [rsp + rdi + 0x1b], dl
lea edx, [r8 - 0x33]
mov byte [rsp + rsi + 0x1b], dl
add rax, 2
cmp rax, 0x16
jge 0x4f9157
movzx edx, byte [rsp + rax + 0x2a]
movzx esi, byte [rsp + rax + 0x2b]
mov edi, edx
xor edx, esi
add edx, eax
nop word [rax + rax]
cmp rdi, 0xf
jae 0x4f917e
movzx r8d, byte [rsp + rdi + 0x1b]
sub r8d, edx
cmp rsi, 0xf
jb 0x4f9107
jmp 0x4f9172
xor eax, eax
lea rbx, [rsp + 0x1b]
mov ecx, 0xf
call fcn.004418e0
mov rbp, qword [rsp + 0x40]
add rsp, 0x48
ret
mov eax, esi
mov ecx, 0xf
call fcn.00453440
mov eax, edi
mov ecx, 0xf
call fcn.00453440
nop
call fcn.00450de0
jmp fcn.004f90a0

Function at 0x4f91a0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4f927c
sub rsp, 0x40
mov qword [rsp + 0x38], rbp
lea rbp, [rsp + 0x38]
movabs rdx, 0xad91777a6e65704f
mov qword [rsp + 0x19], rdx
movabs rdx, 0x28a6b9bd08561ad
mov qword [rsp + 0x20], rdx
movabs rdx, 0xe0b0e050a050704
mov qword [rsp + 0x28], rdx
movabs rdx, 0xe040906090d050d
mov qword [rsp + 0x30], rdx
xor eax, eax
jmp 0x4f9215
movzx r9d, byte [rsp + rsi + 0x19]
sub r9d, edx
lea edx, [r9 - 0x12]
mov byte [rsp + rdi + 0x19], dl
lea edx, [r8 - 0x12]
mov byte [rsp + rsi + 0x19], dl
add rax, 2
cmp rax, 0x10
jge 0x4f9248
movzx edx, byte [rsp + rax + 0x28]
movzx esi, byte [rsp + rax + 0x29]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0xf
jae 0x4f926f
movzx r8d, byte [rsp + rdi + 0x19]
sub r8d, edx
nop word [rax + rax]
cmp rsi, 0xf
jb 0x4f91f8
jmp 0x4f9263
xor eax, eax
lea rbx, [rsp + 0x19]
mov ecx, 0xf
call fcn.004418e0
mov rbp, qword [rsp + 0x38]
add rsp, 0x40
ret
mov eax, esi
mov ecx, 0xf
call fcn.00453440
mov eax, edi
mov ecx, 0xf
call fcn.00453440
nop
nop dword [rax]
call fcn.00450de0
jmp fcn.004f91a0
Function at 0x4f92a0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4f9372
sub rsp, 0x40
mov qword [rsp + 0x38], rbp
lea rbp, [rsp + 0x38]
movabs rdx, 0x6f548d718a886552
mov qword [rsp + 0x1e], rdx
mov dword [rsp + 0x26], 0x7675a399
movabs rdx, 0x20508080a0a0408
mov qword [rsp + 0x2a], rdx
movabs rdx, 0x203040b090b0205
mov qword [rsp + 0x30], rdx
xor eax, eax
jmp 0x4f930e
movzx r9d, byte [rsp + rsi + 0x1e]
sub r9d, edx
lea edx, [r9 - 7]
mov byte [rsp + rdi + 0x1e], dl
lea edx, [r8 - 7]
mov byte [rsp + rsi + 0x1e], dl
add rax, 2
cmp rax, 0xe
jge 0x4f933b
movzx edx, byte [rsp + rax + 0x2a]
movzx esi, byte [rsp + rax + 0x2b]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0xc
jae 0x4f9365
movzx r8d, byte [rsp + rdi + 0x1e]
sub r8d, edx
cmp rsi, 0xc
jb 0x4f92f1
jmp 0x4f9356
xor eax, eax
lea rbx, [rsp + 0x1e]
mov ecx, 0xc
call fcn.004418e0
mov rbp, qword [rsp + 0x38]
add rsp, 0x40
ret
mov eax, esi
mov ecx, 0xc
nop dword [rax]
call fcn.00453440
mov eax, edi
mov ecx, 0xc
call fcn.00453440
nop
call fcn.00450de0
jmp fcn.004f92a0

Function at 0x4f9660
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4f975c
sub rsp, 0x48
mov qword [rsp + 0x40], rbp
lea rbp, [rsp + 0x40]
movabs rdx, 0x99a66d9574ec7353
mov qword [rsp + 0x1d], rdx
movabs rdx, 0x9b99a66d9574ec73
mov qword [rsp + 0x1e], rdx
movabs rdx, 0x3633f39e8aa57407
mov qword [rsp + 0x26], rdx
movabs rdx, 0xe0d020d0b070e09
mov qword [rsp + 0x2e], rdx
movabs rdx, 0xc090e0d020d0b07
mov qword [rsp + 0x30], rdx
movabs rdx, 0xc04090e080d0601
mov qword [rsp + 0x38], rdx
xor eax, eax
jmp 0x4f96f0
movzx r9d, byte [rsp + rsi + 0x1d]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x3e]
mov byte [rsp + rdi + 0x1d], dl
mov byte [rsp + rsi + 0x1d], r8b
add rax, 2
cmp rax, 0x12
jge 0x4f9728
movzx edx, byte [rsp + rax + 0x2e]
movzx esi, byte [rsp + rax + 0x2f]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x11
jae 0x4f974f
movzx r8d, byte [rsp + rdi + 0x1d]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x3e]
nop word [rax + rax]
cmp rsi, 0x11
jb 0x4f96d6
jmp 0x4f9743
xor eax, eax
lea rbx, [rsp + 0x1d]
mov ecx, 0x11
call fcn.004418e0
mov rbp, qword [rsp + 0x40]
add rsp, 0x48
ret
mov eax, esi
mov ecx, 0x11
call fcn.00453440
mov eax, edi
mov ecx, 0x11
call fcn.00453440
nop
nop dword [rax]
call fcn.00450de0
jmp fcn.004f9660
Function at 0x4fa9c0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4faa89
sub rsp, 0x38
mov qword [rsp + 0x30], rbp
lea rbp, [rsp + 0x30]
movabs rdx, 0x131e3fb6bf8e713
mov qword [rsp + 0x1a], rdx
mov word [rsp + 0x22], 0x782b
movabs rdx, 0x102050800040104
mov qword [rsp + 0x24], rdx
mov dword [rsp + 0x2c], 0x1060807
xor eax, eax
jmp 0x4faa23
movzx r9d, byte [rsp + rsi + 0x1a]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x2d]
mov byte [rsp + rdi + 0x1a], dl
mov byte [rsp + rsi + 0x1a], r8b
add rax, 2
cmp rax, 0xc
jge 0x4faa55
movzx edx, byte [rsp + rax + 0x24]
movzx esi, byte [rsp + rax + 0x25]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0xa
jae 0x4faa7c
movzx r8d, byte [rsp + rdi + 0x1a]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x2d]
cmp rsi, 0xa
jb 0x4faa09
jmp 0x4faa70
xor eax, eax
lea rbx, [rsp + 0x1a]
mov ecx, 0xa
call fcn.004418e0
mov rbp, qword [rsp + 0x30]
add rsp, 0x38
ret
mov eax, esi
mov ecx, 0xa
call fcn.00453440
mov eax, edi
mov ecx, 0xa
call fcn.00453440
nop
call fcn.00450de0
jmp fcn.004fa9c0

Function at 0x4faaa0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4fab7c
sub rsp, 0x40
mov qword [rsp + 0x38], rbp
lea rbp, [rsp + 0x38]
movabs rdx, 0xdf2af8f4f70a6feb
mov qword [rsp + 0x1a], rdx
movabs rdx, 0xe174d772be26df2a
mov qword [rsp + 0x20], rdx
movabs rdx, 0x9040b0d06050d04
mov qword [rsp + 0x28], rdx
movabs rdx, 0x803040007000d02
mov qword [rsp + 0x30], rdx
xor eax, eax
jmp 0x4fab12
movzx r9d, byte [rsp + rsi + 0x1a]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x36]
mov byte [rsp + rdi + 0x1a], dl
mov byte [rsp + rsi + 0x1a], r8b
add rax, 2
cmp rax, 0x10
jge 0x4fab48
movzx edx, byte [rsp + rax + 0x28]
movzx esi, byte [rsp + rax + 0x29]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0xe
jae 0x4fab6f
movzx r8d, byte [rsp + rdi + 0x1a]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x36]
nop dword [rax]
cmp rsi, 0xe
jb 0x4faaf8
jmp 0x4fab63
xor eax, eax
lea rbx, [rsp + 0x1a]
mov ecx, 0xe
call fcn.004418e0
mov rbp, qword [rsp + 0x38]
add rsp, 0x40
ret
mov eax, esi
mov ecx, 0xe
call fcn.00453440
mov eax, edi
mov ecx, 0xe
call fcn.00453440
nop
nop dword [rax]
call fcn.00450de0
jmp fcn.004faaa0
Function at 0x504940
Capabilities:
Encrypt data using rc4 prga

Disassembly:
lea r12, [rsp - 0x38]
cmp r12, qword [r14 + 0x10]
jbe 0x504b26
sub rsp, 0xb8
mov qword [rsp + 0xb0], rbp
lea rbp, [rsp + 0xb0]
movabs rdx, 0x1e6e2964206f6f74
mov qword [rsp + 0x1b], rdx
movabs rdx, 0x65ae4a6e4853f31e
mov qword [rsp + 0x22], rdx
movabs rdx, 0xb470a020636e4102
mov qword [rsp + 0x2a], rdx
movabs rdx, 0x3d099d5769070bfc
mov qword [rsp + 0x32], rdx
movabs rdx, 0x3ecb83431314060b
mov qword [rsp + 0x3a], rdx
movabs rdx, 0x6514375bf3656c67
mov qword [rsp + 0x42], rdx
movabs rdx, 0x6b433e732472548b
mov qword [rsp + 0x4a], rdx
movabs rdx, 0x2062276d2bd17465
mov qword [rsp + 0x52], rdx
movabs rdx, 0x5735f4a5ea8d7838
mov qword [rsp + 0x5a], rdx
movabs rdx, 0x24441d3a14320544
mov qword [rsp + 0x62], rdx
movabs rdx, 0x392f1c2c19320d16
mov qword [rsp + 0x6a], rdx
movabs rdx, 0x42072c39053f392f
mov qword [rsp + 0x70], rdx
movabs rdx, 0x231621253a0d2022
mov qword [rsp + 0x78], rdx
movabs rdx, 0x2a083d43463f182c
mov qword [rsp + 0x80], rdx
movabs rdx, 0x351032172d1b190f
mov qword [rsp + 0x88], rdx
movabs rdx, 0x190c4018412b3c2c
mov qword [rsp + 0x90], rdx
movabs rdx, 0x260f1e1b04342417
mov qword [rsp + 0x98], rdx
movabs rdx, 0xf0a2c300f1f071e
mov qword [rsp + 0xa0], rdx
movabs rdx, 0x904301b0e120a44
mov qword [rsp + 0xa8], rdx
xor eax, eax
jmp 0x504ab6
movzx r9d, byte [rsp + rsi + 0x1b]
sub r9d, edx
lea edx, [r9 + 0x73]
mov byte [rsp + rdi + 0x1b], dl
lea edx, [r8 + 0x73]
mov byte [rsp + rsi + 0x1b], dl
add rax, 2
cmp rax, 0x4e
jge 0x504ae8
movzx edx, byte [rsp + rax + 0x62]
movzx esi, byte [rsp + rax + 0x63]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x47
jae 0x504b15
movzx r8d, byte [rsp + rdi + 0x1b]
sub r8d, edx
nop dword [rax + rax]
cmp rsi, 0x47
jb 0x504a99
jmp 0x504b09
xor eax, eax
lea rbx, [rsp + 0x1b]
mov ecx, 0x47
call fcn.004418e0
mov rbp, qword [rsp + 0xb0]
add rsp, 0xb8
ret
mov eax, esi
mov ecx, 0x47
call fcn.00453440
mov eax, edi
mov ecx, 0x47
nop dword [rax]
call fcn.00453440
nop
call fcn.00450de0
jmp fcn.00504940
Function at 0x5118e0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x511a26
sub rsp, 0x78
mov qword [rsp + 0x70], rbp
lea rbp, [rsp + 0x70]
movabs rdx, 0x7f7078686c897b7f
mov qword [rsp + 0x1c], rdx
movabs rdx, 0x726f724d7f707868
mov qword [rsp + 0x20], rdx
movabs rdx, 0x5c50769674128520
mov qword [rsp + 0x28], rdx
movabs rdx, 0x72cd74877963205c
mov qword [rsp + 0x30], rdx
movabs rdx, 0x7a35998d5d6d7982
mov qword [rsp + 0x38], rdx
movabs rdx, 0xe141c0302222306
mov qword [rsp + 0x40], rdx
movabs rdx, 0x191f0f081412001c
mov qword [rsp + 0x48], rdx
movabs rdx, 0xd1f0304021b1713
mov qword [rsp + 0x50], rdx
movabs rdx, 0x621011820081a06
mov qword [rsp + 0x58], rdx
movabs rdx, 0xd1f1a1e0711061b
mov qword [rsp + 0x60], rdx
movabs rdx, 0x422131c10211d12
mov qword [rsp + 0x68], rdx
xor eax, eax
nop
jmp 0x5119c0
movzx r9d, byte [rsp + rsi + 0x1c]
sub r9d, edx
lea edx, [r9 + 0x27]
mov byte [rsp + rdi + 0x1c], dl
lea edx, [r8 + 0x27]
mov byte [rsp + rsi + 0x1c], dl
add rax, 2
nop
cmp rax, 0x30
jge 0x5119ed
movzx edx, byte [rsp + rax + 0x40]
movzx esi, byte [rsp + rax + 0x41]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x24
jae 0x511a14
movzx r8d, byte [rsp + rdi + 0x1c]
sub r8d, edx
cmp rsi, 0x24
jb 0x5119a2
jmp 0x511a08
xor eax, eax
lea rbx, [rsp + 0x1c]
mov ecx, 0x24
call fcn.004418e0
mov rbp, qword [rsp + 0x70]
add rsp, 0x78
ret
mov eax, esi
mov ecx, 0x24
call fcn.00453440
mov eax, edi
mov ecx, 0x24
nop dword [rax + rax]
call fcn.00453440
nop
call fcn.00450de0
jmp fcn.005118e0

Function at 0x511da0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x511e72
sub rsp, 0x40
mov qword [rsp + 0x38], rbp
lea rbp, [rsp + 0x38]
movabs rdx, 0x8663a7aa7b28ab25
mov qword [rsp + 0x1e], rdx
mov dword [rsp + 0x26], 0xef4854fc
movabs rdx, 0x70b0103030b0608
mov qword [rsp + 0x2a], rdx
movabs rdx, 0x60706080504070b
mov qword [rsp + 0x30], rdx
xor eax, eax
jmp 0x511e0b
movzx r9d, byte [rsp + rsi + 0x1e]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x6f]
mov byte [rsp + rdi + 0x1e], dl
mov byte [rsp + rsi + 0x1e], r8b
add rax, 2
cmp rax, 0xe
jge 0x511e3d
movzx edx, byte [rsp + rax + 0x2a]
movzx esi, byte [rsp + rax + 0x2b]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0xc
jae 0x511e65
movzx r8d, byte [rsp + rdi + 0x1e]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x6f]
cmp rsi, 0xc
jb 0x511df1
jmp 0x511e58
xor eax, eax
lea rbx, [rsp + 0x1e]
mov ecx, 0xc
call fcn.004418e0
mov rbp, qword [rsp + 0x38]
add rsp, 0x40
ret
mov eax, esi
mov ecx, 0xc
nop
call fcn.00453440
mov eax, edi
mov ecx, 0xc
call fcn.00453440
nop
call fcn.00450de0
jmp fcn.00511da0
Function at 0x512700
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x5127c8
sub rsp, 0x38
mov qword [rsp + 0x30], rbp
lea rbp, [rsp + 0x30]
movabs rdx, 0x45cad049349b4228
mov qword [rsp + 0x26], rdx
mov word [rsp + 0x2e], 0xa338
movabs rdx, 0x605090309030508
mov qword [rsp + 0x1c], rdx
mov word [rsp + 0x24], 0x902
xor eax, eax
jmp 0x512762
movzx r9d, byte [rsp + rsi + 0x26]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x7b]
mov byte [rsp + rdi + 0x26], dl
mov byte [rsp + rsi + 0x26], r8b
add rax, 2
cmp rax, 0xa
jge 0x512794
movzx edx, byte [rsp + rax + 0x1c]
movzx esi, byte [rsp + rax + 0x1d]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0xa
jae 0x5127bb
movzx r8d, byte [rsp + rdi + 0x26]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x7b]
cmp rsi, 0xa
jb 0x512748
jmp 0x5127af
xor eax, eax
lea rbx, [rsp + 0x26]
mov ecx, 0xa
call fcn.004418e0
mov rbp, qword [rsp + 0x30]
add rsp, 0x38
ret
mov eax, esi
mov ecx, 0xa
call fcn.00453440
mov eax, edi
mov ecx, 0xa
call fcn.00453440
nop
call fcn.00450de0
jmp fcn.00512700

Function at 0x513000
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x5130fc
sub rsp, 0x48
mov qword [rsp + 0x40], rbp
lea rbp, [rsp + 0x40]
movabs rdx, 0x37369fd41310a9cf
mov qword [rsp + 0x1d], rdx
movabs rdx, 0x9d37369fd41310a9
mov qword [rsp + 0x1e], rdx
movabs rdx, 0xf466ea6463629439
mov qword [rsp + 0x26], rdx
movabs rdx, 0x200000e01080308
mov qword [rsp + 0x2e], rdx
movabs rdx, 0x2050200000e0108
mov qword [rsp + 0x30], rdx
movabs rdx, 0x40a0510040305
mov qword [rsp + 0x38], rdx
xor eax, eax
jmp 0x513090
movzx r9d, byte [rsp + rsi + 0x1d]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x7c]
mov byte [rsp + rdi + 0x1d], dl
mov byte [rsp + rsi + 0x1d], r8b
add rax, 2
cmp rax, 0x12
jge 0x5130c8
movzx edx, byte [rsp + rax + 0x2e]
movzx esi, byte [rsp + rax + 0x2f]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x11
jae 0x5130ef
movzx r8d, byte [rsp + rdi + 0x1d]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x7c]
nop word [rax + rax]
cmp rsi, 0x11
jb 0x513076
jmp 0x5130e3
xor eax, eax
lea rbx, [rsp + 0x1d]
mov ecx, 0x11
call fcn.004418e0
mov rbp, qword [rsp + 0x40]
add rsp, 0x48
ret
mov eax, esi
mov ecx, 0x11
call fcn.00453440
mov eax, edi
mov ecx, 0x11
call fcn.00453440
nop
nop dword [rax]
call fcn.00450de0
jmp fcn.00513000
Function at 0x513120
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x51321c
sub rsp, 0x48
mov qword [rsp + 0x40], rbp
lea rbp, [rsp + 0x40]
movabs rdx, 0xcfeb3534334eddf5
mov qword [rsp + 0x19], rdx
movabs rdx, 0x38cfeb3534334edd
mov qword [rsp + 0x1a], rdx
movabs rdx, 0xc44515e767e2ce
mov qword [rsp + 0x22], rdx
movabs rdx, 0xb01090606100b0d
mov qword [rsp + 0x2a], rdx
movabs rdx, 0x20c0a0f0f000b01
mov qword [rsp + 0x30], rdx
movabs rdx, 0xc090c020a07010d
mov qword [rsp + 0x38], rdx
xor eax, eax
jmp 0x5131b0
movzx r9d, byte [rsp + rsi + 0x19]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x55]
mov byte [rsp + rdi + 0x19], dl
mov byte [rsp + rsi + 0x19], r8b
add rax, 2
cmp rax, 0x16
jge 0x5131e8
movzx edx, byte [rsp + rax + 0x2a]
movzx esi, byte [rsp + rax + 0x2b]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x11
jae 0x51320f
movzx r8d, byte [rsp + rdi + 0x19]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x55]
nop word [rax + rax]
cmp rsi, 0x11
jb 0x513196
jmp 0x513203
xor eax, eax
lea rbx, [rsp + 0x19]
mov ecx, 0x11
call fcn.004418e0
mov rbp, qword [rsp + 0x40]
add rsp, 0x48
ret
mov eax, esi
mov ecx, 0x11
call fcn.00453440
mov eax, edi
mov ecx, 0x11
call fcn.00453440
nop
nop dword [rax]
call fcn.00450de0
jmp fcn.00513120
Function at 0x517c20
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x517d28
sub rsp, 0x50
mov qword [rsp + 0x48], rbp
lea rbp, [rsp + 0x48]
movabs rdx, 0x3a6c8a8488b07980
mov qword [rsp + 0x18], rdx
movabs rdx, 0xaf2f34c43a6c8a84
mov qword [rsp + 0x1c], rdx
movabs rdx, 0x614993c27d9e6920
mov qword [rsp + 0x24], rdx
movabs rdx, 0x802020101100405
mov qword [rsp + 0x2c], rdx
movabs rdx, 0x2080f0e090a0b03
mov qword [rsp + 0x34], rdx
movabs rdx, 0x102070f02080f0e
mov qword [rsp + 0x38], rdx
movabs rdx, 0x1102050003120804
mov qword [rsp + 0x40], rdx
xor eax, eax
jmp 0x517cc2
movzx r9d, byte [rsp + rsi + 0x18]
sub r9d, edx
lea edx, [r9 - 2]
mov byte [rsp + rdi + 0x18], dl
lea edx, [r8 - 2]
mov byte [rsp + rsi + 0x18], dl
add rax, 2
cmp rax, 0x1c
jge 0x517cef
movzx edx, byte [rsp + rax + 0x2c]
movzx esi, byte [rsp + rax + 0x2d]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x14
jae 0x517d1b
movzx r8d, byte [rsp + rdi + 0x18]
sub r8d, edx
cmp rsi, 0x14
jb 0x517ca5
jmp 0x517d0f
xor eax, eax
lea rbx, [rsp + 0x18]
mov ecx, 0x14
nop dword [rax + rax]
call fcn.004418e0
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
mov eax, esi
mov ecx, 0x14
call fcn.00453440
mov eax, edi
mov ecx, 0x14
call fcn.00453440
nop
call fcn.00450de0
jmp fcn.00517c20

Function at 0x518620
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x518708
sub rsp, 0x48
mov qword [rsp + 0x40], rbp
lea rbp, [rsp + 0x40]
movabs rdx, 0xfac9756b5e4572fc
mov qword [rsp + 0x1b], rdx
movabs rdx, 0xaf4ebf3e8654dfa
mov qword [rsp + 0x22], rdx
movabs rdx, 0x604040d07010d0e
mov qword [rsp + 0x2a], rdx
movabs rdx, 0x40e020b00030604
mov qword [rsp + 0x30], rdx
movabs rdx, 0xe0a070b040c0d
mov qword [rsp + 0x38], rdx
xor eax, eax
jmp 0x5186a1
movzx r9d, byte [rsp + rsi + 0x1b]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x6d]
mov byte [rsp + rdi + 0x1b], dl
mov byte [rsp + rsi + 0x1b], r8b
add rax, 2
cmp rax, 0x16
jge 0x5186d3
movzx edx, byte [rsp + rax + 0x2a]
movzx esi, byte [rsp + rax + 0x2b]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0xf
jae 0x5186fb
movzx r8d, byte [rsp + rdi + 0x1b]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x6d]
cmp rsi, 0xf
jb 0x518687
jmp 0x5186ef
xor eax, eax
lea rbx, [rsp + 0x1b]
mov ecx, 0xf
nop
call fcn.004418e0
mov rbp, qword [rsp + 0x40]
add rsp, 0x48
ret
mov eax, esi
mov ecx, 0xf
call fcn.00453440
mov eax, edi
mov ecx, 0xf
call fcn.00453440
nop
call fcn.00450de0
jmp fcn.00518620
Function at 0x518e00
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x518ee8
sub rsp, 0x48
mov qword [rsp + 0x40], rbp
lea rbp, [rsp + 0x40]
movabs rdx, 0x21fe850747ec790a
mov qword [rsp + 0x1a], rdx
movabs rdx, 0x6567fdec9a654d9b
mov qword [rsp + 0x22], rdx
movabs rdx, 0x701080307040b
mov qword [rsp + 0x2a], rdx
movabs rdx, 0x8030104050007
mov qword [rsp + 0x30], rdx
movabs rdx, 0x20108020d040c06
mov qword [rsp + 0x38], rdx
xor eax, eax
jmp 0x518e81
movzx r9d, byte [rsp + rsi + 0x1a]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x5d]
mov byte [rsp + rdi + 0x1a], dl
mov byte [rsp + rsi + 0x1a], r8b
add rax, 2
cmp rax, 0x16
jge 0x518eb3
movzx edx, byte [rsp + rax + 0x2a]
movzx esi, byte [rsp + rax + 0x2b]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x10
jae 0x518edb
movzx r8d, byte [rsp + rdi + 0x1a]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x5d]
cmp rsi, 0x10
jb 0x518e67
jmp 0x518ecf
xor eax, eax
lea rbx, [rsp + 0x1a]
mov ecx, 0x10
nop
call fcn.004418e0
mov rbp, qword [rsp + 0x40]
add rsp, 0x48
ret
mov eax, esi
mov ecx, 0x10
call fcn.00453440
mov eax, edi
mov ecx, 0x10
call fcn.00453440
nop
call fcn.00450de0
jmp fcn.00518e00

Function at 0x51ab80
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x51ac76
sub rsp, 0x50
mov qword [rsp + 0x48], rbp
lea rbp, [rsp + 0x48]
movabs rdx, 0x652ece3992746547
mov qword [rsp + 0x1f], rdx
movabs rdx, 0x2b7408652ece3992
mov qword [rsp + 0x22], rdx
movabs rdx, 0x54497373163dc0aa
mov qword [rsp + 0x2a], rdx
movabs rdx, 0x805050808030b04
mov qword [rsp + 0x32], rdx
movabs rdx, 0x4050a0e060d0805
mov qword [rsp + 0x38], rdx
movabs rdx, 0x1208080505080c08
mov qword [rsp + 0x40], rdx
xor eax, eax
jmp 0x51ac13
movzx r9d, byte [rsp + rsi + 0x1f]
sub r9d, edx
lea edx, [r9 + 0x48]
mov byte [rsp + rdi + 0x1f], dl
lea edx, [r8 + 0x48]
mov byte [rsp + rsi + 0x1f], dl
add rax, 2
cmp rax, 0x16
jge 0x51ac42
movzx edx, byte [rsp + rax + 0x32]
movzx esi, byte [rsp + rax + 0x33]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x13
jae 0x51ac69
movzx r8d, byte [rsp + rdi + 0x1f]
sub r8d, edx
cmp rsi, 0x13
jb 0x51abf6
nop
jmp 0x51ac5d
xor eax, eax
lea rbx, [rsp + 0x1f]
mov ecx, 0x13
call fcn.004418e0
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
mov eax, esi
mov ecx, 0x13
call fcn.00453440
mov eax, edi
mov ecx, 0x13
call fcn.00453440
nop
call fcn.00450de0
nop dword [rax + rax]
jmp fcn.0051ab80