joyce8/EMBER2024-capa huggingface dataset:
Function at 0x52e3c0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x52e4cc
push rbp
mov rbp, rsp
sub rsp, 0x58
movabs rdx, 0x72240f08da74767e
mov qword [rsp + 0x1f], rdx
movabs rdx, 0x90fbebed73797469
mov qword [rsp + 0x27], rdx
movabs rdx, 0xdb90fbebed737974
mov qword [rsp + 0x28], rdx
movabs rdx, 0x6c667178e55a9e73
mov qword [rsp + 0x30], rdx
movabs rdx, 0x404170c050f060f
mov qword [rsp + 0x38], rdx
movabs rdx, 0x31015031312000c
mov qword [rsp + 0x40], rdx
movabs rdx, 0x614011411061605
mov qword [rsp + 0x48], rdx
movabs rdx, 0xe0d1213050c0b12
mov qword [rsp + 0x50], rdx
xor eax, eax
jmp 0x52e468
movzx r9d, byte [rsp + rsi + 0x1f]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x57]
mov byte [rsp + rdi + 0x1f], dl
mov byte [rsp + rsi + 0x1f], r8b
add rax, 2
cmp rax, 0x20
jge 0x52e49c
movzx edx, byte [rsp + rax + 0x38]
movzx esi, byte [rsp + rax + 0x39]
mov edi, edx
xor edx, esi
add edx, eax
nop
cmp rdi, 0x19
jae 0x52e4bf
movzx r8d, byte [rsp + rdi + 0x1f]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x57]
cmp rsi, 0x19
jb 0x52e44e
jmp 0x52e4b3
xor eax, eax
lea rbx, [rsp + 0x1f]
mov ecx, 0x19
call fcn.00443420
add rsp, 0x58
pop rbp
ret
mov eax, esi
mov ecx, 0x19
call fcn.00454ec0
mov eax, edi
mov ecx, 0x19
call fcn.00454ec0
nop
call fcn.00452c40
jmp fcn.0052e3c0

Function at 0x530b20
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x530c28
push rbp
mov rbp, rsp
sub rsp, 0x50
movabs rdx, 0x2f5316221f74492a
mov qword [rsp + 0x18], rdx
movabs rdx, 0x6154700263307672
mov qword [rsp + 0x20], rdx
movabs rdx, 0x5774615470026330
mov qword [rsp + 0x22], rdx
movabs rdx, 0x576567392160494a
mov qword [rsp + 0x2a], rdx
movabs rdx, 0x10a04050313160e
mov qword [rsp + 0x32], rdx
movabs rdx, 0x11407001513040c
mov qword [rsp + 0x3a], rdx
movabs rdx, 0xa050704120d0114
mov qword [rsp + 0x40], rdx
movabs rdx, 0x141107140a0e070d
mov qword [rsp + 0x48], rdx
xor eax, eax
jmp 0x530bcb
movzx r9d, byte [rsp + rsi + 0x18]
sub r9d, edx
lea edx, [r9 + 0x32]
mov byte [rsp + rdi + 0x18], dl
lea edx, [r8 + 0x32]
mov byte [rsp + rsi + 0x18], dl
add rax, 2
cmp rax, 0x1e
jge 0x530bf8
movzx edx, byte [rsp + rax + 0x32]
movzx esi, byte [rsp + rax + 0x33]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x1a
jae 0x530c1b
movzx r8d, byte [rsp + rdi + 0x18]
sub r8d, edx
cmp rsi, 0x1a
jb 0x530bae
jmp 0x530c0f
xor eax, eax
lea rbx, [rsp + 0x18]
mov ecx, 0x1a
call fcn.00443420
add rsp, 0x50
pop rbp
ret
mov eax, esi
mov ecx, 0x1a
call fcn.00454ec0
mov eax, edi
mov ecx, 0x1a
call fcn.00454ec0
nop
call fcn.00452c40
jmp fcn.00530b20
Function at 0x530c40
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x530d1d
push rbp
mov rbp, rsp
sub rsp, 0x40
movabs rdx, 0x6f4d502f08031a
mov qword [rsp + 0x1c], rdx
movabs rdx, 0x31656b0da41f3f18
mov qword [rsp + 0x24], rdx
movabs rdx, 0x8070c0301000b
mov qword [rsp + 0x2c], rdx
movabs rdx, 0xf08020c0008070c
mov qword [rsp + 0x30], rdx
movabs rdx, 0xf050a050c070903
mov qword [rsp + 0x38], rdx
xor eax, eax
nop
jmp 0x530cc0
movzx r9d, byte [rsp + rsi + 0x1c]
sub r9d, edx
lea edx, [r9 + 0x45]
mov byte [rsp + rdi + 0x1c], dl
lea edx, [r8 + 0x45]
mov byte [rsp + rsi + 0x1c], dl
add rax, 2
nop
cmp rax, 0x14
jge 0x530ced
movzx edx, byte [rsp + rax + 0x2c]
movzx esi, byte [rsp + rax + 0x2d]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x10
jae 0x530d10
movzx r8d, byte [rsp + rdi + 0x1c]
sub r8d, edx
cmp rsi, 0x10
jb 0x530ca2
jmp 0x530d04
xor eax, eax
lea rbx, [rsp + 0x1c]
mov ecx, 0x10
call fcn.00443420
add rsp, 0x40
pop rbp
ret
mov eax, esi
mov ecx, 0x10
call fcn.00454ec0
mov eax, edi
mov ecx, 0x10
call fcn.00454ec0
nop
nop dword [rax]
call fcn.00452c40
jmp fcn.00530c40

Function at 0x5319c0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x531aac
push rbp
mov rbp, rsp
sub rsp, 0x40
movabs rdx, 0x726560797227485f
mov qword [rsp + 0x18], rdx
movabs rdx, 0x6d54726560797227
mov qword [rsp + 0x1a], rdx
movabs rdx, 0x7362535b63376663
mov qword [rsp + 0x22], rdx
movabs rdx, 0x100805050508050e
mov qword [rsp + 0x2a], rdx
movabs rdx, 0xd090901010c1008
mov qword [rsp + 0x30], rdx
movabs rdx, 0xf0b0d00020d0f0f
mov qword [rsp + 0x38], rdx
xor eax, eax
jmp 0x531a4a
movzx r9d, byte [rsp + rsi + 0x18]
lea edx, [r9 + rdx]
lea edx, [rdx - 0xa]
mov byte [rsp + rdi + 0x18], dl
mov byte [rsp + rsi + 0x18], r8b
add rax, 2
cmp rax, 0x16
jge 0x531a7c
movzx edx, byte [rsp + rax + 0x2a]
movzx esi, byte [rsp + rax + 0x2b]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x12
jae 0x531a9f
movzx r8d, byte [rsp + rdi + 0x18]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0xa]
cmp rsi, 0x12
jb 0x531a30
jmp 0x531a93
xor eax, eax
lea rbx, [rsp + 0x18]
mov ecx, 0x12
call fcn.00443420
add rsp, 0x40
pop rbp
ret
mov eax, esi
mov ecx, 0x12
call fcn.00454ec0
mov eax, edi
mov ecx, 0x12
call fcn.00454ec0
nop
call fcn.00452c40
jmp fcn.005319c0
Function at 0x532980
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x532a5d
push rbp
mov rbp, rsp
sub rsp, 0x40
movabs rdx, 0x1f3825100cb26136
mov qword [rsp + 0x1a], rdx
movabs rdx, 0xb900efbe18ec612f
mov qword [rsp + 0x22], rdx
movabs rdx, 0xa050f0e03010203
mov qword [rsp + 0x2a], rdx
movabs rdx, 0xe04080c0b0a05
mov qword [rsp + 0x30], rdx
movabs rdx, 0x705060b0d0b030b
mov qword [rsp + 0x38], rdx
xor eax, eax
nop
jmp 0x532a00
movzx r9d, byte [rsp + rsi + 0x1a]
sub r9d, edx
lea edx, [r9 + 0x5c]
mov byte [rsp + rdi + 0x1a], dl
lea edx, [r8 + 0x5c]
mov byte [rsp + rsi + 0x1a], dl
add rax, 2
nop
cmp rax, 0x16
jge 0x532a2d
movzx edx, byte [rsp + rax + 0x2a]
movzx esi, byte [rsp + rax + 0x2b]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x10
jae 0x532a50
movzx r8d, byte [rsp + rdi + 0x1a]
sub r8d, edx
cmp rsi, 0x10
jb 0x5329e2
jmp 0x532a44
xor eax, eax
lea rbx, [rsp + 0x1a]
mov ecx, 0x10
call fcn.00443420
add rsp, 0x40
pop rbp
ret
mov eax, esi
mov ecx, 0x10
call fcn.00454ec0
mov eax, edi
mov ecx, 0x10
call fcn.00454ec0
nop
nop dword [rax]
call fcn.00452c40
jmp fcn.00532980

Function at 0x532e00
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x532ec7
push rbp
mov rbp, rsp
sub rsp, 0x38
movabs rdx, 0xf9ffd4728868d51b
mov qword [rsp + 0x1c], rdx
mov dword [rsp + 0x24], 0x57e705f6
movabs rdx, 0x20300010a080002
mov qword [rsp + 0x28], rdx
movabs rdx, 0x605020906070703
mov qword [rsp + 0x30], rdx
xor eax, eax
jmp 0x532e68
movzx r9d, byte [rsp + rsi + 0x1c]
sub r9d, edx
lea edx, [r9 - 0x7e]
mov byte [rsp + rdi + 0x1c], dl
lea edx, [r8 - 0x7e]
mov byte [rsp + rsi + 0x1c], dl
add rax, 2
cmp rax, 0x10
jge 0x532e97
movzx edx, byte [rsp + rax + 0x28]
movzx esi, byte [rsp + rax + 0x29]
mov edi, edx
xor edx, esi
add edx, eax
nop
cmp rdi, 0xc
jae 0x532eba
movzx r8d, byte [rsp + rdi + 0x1c]
sub r8d, edx
cmp rsi, 0xc
jb 0x532e4b
jmp 0x532eae
xor eax, eax
lea rbx, [rsp + 0x1c]
mov ecx, 0xc
call fcn.00443420
add rsp, 0x38
pop rbp
ret
mov eax, esi
mov ecx, 0xc
call fcn.00454ec0
mov eax, edi
mov ecx, 0xc
call fcn.00454ec0
nop
call fcn.00452c40
jmp fcn.00532e00
Function at 0x532ee0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x532fac
push rbp
mov rbp, rsp
sub rsp, 0x38
movabs rdx, 0x9cfa74f619ba65fc
mov qword [rsp + 0x1c], rdx
mov dword [rsp + 0x24], 0x66166546
movabs rdx, 0x7080600070a040a
mov qword [rsp + 0x28], rdx
movabs rdx, 0x30207020a080202
mov qword [rsp + 0x30], rdx
xor eax, eax
jmp 0x532f45
movzx r9d, byte [rsp + rsi + 0x1c]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x4e]
mov byte [rsp + rdi + 0x1c], dl
mov byte [rsp + rsi + 0x1c], r8b
add rax, 2
cmp rax, 0x10
jge 0x532f7c
movzx edx, byte [rsp + rax + 0x28]
movzx esi, byte [rsp + rax + 0x29]
mov edi, edx
xor edx, esi
add edx, eax
nop dword [rax + rax]
cmp rdi, 0xc
jae 0x532f9f
movzx r8d, byte [rsp + rdi + 0x1c]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x4e]
cmp rsi, 0xc
jb 0x532f2b
jmp 0x532f93
xor eax, eax
lea rbx, [rsp + 0x1c]
mov ecx, 0xc
call fcn.00443420
add rsp, 0x38
pop rbp
ret
mov eax, esi
mov ecx, 0xc
call fcn.00454ec0
mov eax, edi
mov ecx, 0xc
call fcn.00454ec0
nop
call fcn.00452c40
jmp fcn.00532ee0

Function at 0x533260
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x53335b
push rbp
mov rbp, rsp
sub rsp, 0x50
movabs rdx, 0x20091b201d10281a
mov qword [rsp + 0x1b], rdx
movabs rdx, 0x7426c76a62216c20
mov qword [rsp + 0x22], rdx
movabs rdx, 0x2b7435c37563e86c
mov qword [rsp + 0x2a], rdx
movabs rdx, 0x302161613140300
mov qword [rsp + 0x32], rdx
movabs rdx, 0x40716020c0d000f
mov qword [rsp + 0x3a], rdx
movabs rdx, 0x209010506000407
mov qword [rsp + 0x40], rdx
movabs rdx, 0x16091006100f0d14
mov qword [rsp + 0x48], rdx
xor eax, eax
jmp 0x5332f9
movzx r9d, byte [rsp + rsi + 0x1b]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x34]
mov byte [rsp + rdi + 0x1b], dl
mov byte [rsp + rsi + 0x1b], r8b
add rax, 2
cmp rax, 0x1e
jge 0x53332b
movzx edx, byte [rsp + rax + 0x32]
movzx esi, byte [rsp + rax + 0x33]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x17
jae 0x53334e
movzx r8d, byte [rsp + rdi + 0x1b]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x34]
cmp rsi, 0x17
jb 0x5332df
jmp 0x533342
xor eax, eax
lea rbx, [rsp + 0x1b]
mov ecx, 0x17
call fcn.00443420
add rsp, 0x50
pop rbp
ret
mov eax, esi
mov ecx, 0x17
call fcn.00454ec0
mov eax, edi
mov ecx, 0x17
call fcn.00454ec0
nop
nop dword [rax + rax]
call fcn.00452c40
jmp fcn.00533260
Function at 0x533660
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x53377d
push rbp
mov rbp, rsp
sub rsp, 0x60
movabs rdx, 0x28d56394c39bf207
mov qword [rsp + 0x1e], rdx
movabs rdx, 0x80bb732731792620
mov qword [rsp + 0x26], rdx
movabs rdx, 0x6fdb702180bb7327
mov qword [rsp + 0x2a], rdx
movabs rdx, 0x1e06727402ebcd9d
mov qword [rsp + 0x32], rdx
movabs rdx, 0x104140f14120016
mov qword [rsp + 0x3a], rdx
movabs rdx, 0xb0f0e0315150104
mov qword [rsp + 0x40], rdx
movabs rdx, 0x801080f12080201
mov qword [rsp + 0x48], rdx
movabs rdx, 0xe140b061a031b0f
mov qword [rsp + 0x50], rdx
movabs rdx, 0x7091b0c170b100e
mov qword [rsp + 0x58], rdx
xor eax, eax
jmp 0x533720
movzx r9d, byte [rsp + rsi + 0x1e]
sub r9d, edx
lea edx, [r9 + 0x7e]
mov byte [rsp + rdi + 0x1e], dl
lea edx, [r8 + 0x7e]
mov byte [rsp + rsi + 0x1e], dl
add rax, 2
nop word [rax + rax]
cmp rax, 0x26
jge 0x53374d
movzx edx, byte [rsp + rax + 0x3a]
movzx esi, byte [rsp + rax + 0x3b]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x1c
jae 0x533770
movzx r8d, byte [rsp + rdi + 0x1e]
sub r8d, edx
cmp rsi, 0x1c
jb 0x5336fd
jmp 0x533764
xor eax, eax
lea rbx, [rsp + 0x1e]
mov ecx, 0x1c
call fcn.00443420
add rsp, 0x60
pop rbp
ret
mov eax, esi
mov ecx, 0x1c
call fcn.00454ec0
mov eax, edi
mov ecx, 0x1c
call fcn.00454ec0
nop
nop dword [rax]
call fcn.00452c40
jmp fcn.00533660

Function at 0x5337a0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x5338ba
push rbp
mov rbp, rsp
sub rsp, 0x58
movabs rdx, 0x44d7e7653874371b
mov qword [rsp + 0x1d], rdx
movabs rdx, 0xd563fd52443574c7
mov qword [rsp + 0x25], rdx
movabs rdx, 0x69d563fd52443574
mov qword [rsp + 0x26], rdx
movabs rdx, 0xb1e0cb30be3ccc6c
mov qword [rsp + 0x2e], rdx
movabs rdx, 0x1400130d110f120c
mov qword [rsp + 0x36], rdx
movabs rdx, 0x13121400130d110f
mov qword [rsp + 0x38], rdx
movabs rdx, 0x10a070503180f12
mov qword [rsp + 0x40], rdx
movabs rdx, 0x1415060d12170a18
mov qword [rsp + 0x48], rdx
movabs rdx, 0x14160f0516170108
mov qword [rsp + 0x50], rdx
xor eax, eax
jmp 0x533857
movzx r9d, byte [rsp + rsi + 0x1d]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x7b]
mov byte [rsp + rdi + 0x1d], dl
mov byte [rsp + rsi + 0x1d], r8b
add rax, 2
cmp rax, 0x22
jge 0x533889
movzx edx, byte [rsp + rax + 0x36]
movzx esi, byte [rsp + rax + 0x37]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x19
jae 0x5338ad
movzx r8d, byte [rsp + rdi + 0x1d]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x7b]
cmp rsi, 0x19
jb 0x53383d
jmp 0x5338a1
xor eax, eax
lea rbx, [rsp + 0x1d]
mov ecx, 0x19
call fcn.00443420
add rsp, 0x58
pop rbp
nop
ret
mov eax, esi
mov ecx, 0x19
call fcn.00454ec0
mov eax, edi
mov ecx, 0x19
call fcn.00454ec0
nop
call fcn.00452c40
nop
jmp fcn.005337a0
Function at 0x536be0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x536cdb
push rbp
mov rbp, rsp
sub rsp, 0x50
movabs rdx, 0xfb74392030725628
mov qword [rsp + 0x1b], rdx
movabs rdx, 0x3d5ae321743665fb
mov qword [rsp + 0x22], rdx
movabs rdx, 0x31254214436520ef
mov qword [rsp + 0x2a], rdx
movabs rdx, 0x40d0c0d00051503
mov qword [rsp + 0x32], rdx
movabs rdx, 0xf07041003150101
mov qword [rsp + 0x3a], rdx
movabs rdx, 0x1307100e0b000f07
mov qword [rsp + 0x40], rdx
movabs rdx, 0x5090f051413160d
mov qword [rsp + 0x48], rdx
xor eax, eax
jmp 0x536c79
movzx r9d, byte [rsp + rsi + 0x1b]
lea edx, [r9 + rdx]
lea edx, [rdx + 7]
mov byte [rsp + rdi + 0x1b], dl
mov byte [rsp + rsi + 0x1b], r8b
add rax, 2
cmp rax, 0x1e
jge 0x536cab
movzx edx, byte [rsp + rax + 0x32]
movzx esi, byte [rsp + rax + 0x33]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x17
jae 0x536cce
movzx r8d, byte [rsp + rdi + 0x1b]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 7]
cmp rsi, 0x17
jb 0x536c5f
jmp 0x536cc2
xor eax, eax
lea rbx, [rsp + 0x1b]
mov ecx, 0x17
call fcn.00443420
add rsp, 0x50
pop rbp
ret
mov eax, esi
mov ecx, 0x17
call fcn.00454ec0
mov eax, edi
mov ecx, 0x17
call fcn.00454ec0
nop
nop dword [rax + rax]
call fcn.00452c40
jmp fcn.00536be0

Function at 0x538860
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x53894c
push rbp
mov rbp, rsp
sub rsp, 0x48
movabs rdx, 0x99ea63f409e9c2d6
mov qword [rsp + 0x1f], rdx
movabs rdx, 0x7b99ea63f409e9c2
mov qword [rsp + 0x20], rdx
movabs rdx, 0xe9f572dfb005f0ce
mov qword [rsp + 0x28], rdx
movabs rdx, 0x30b0d0d0307080b
mov qword [rsp + 0x30], rdx
movabs rdx, 0x802100c09000f01
mov qword [rsp + 0x38], rdx
movabs rdx, 0x402100f0f10060a
mov qword [rsp + 0x40], rdx
xor eax, eax
jmp 0x5388ea
movzx r9d, byte [rsp + rsi + 0x1f]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x63]
mov byte [rsp + rdi + 0x1f], dl
mov byte [rsp + rsi + 0x1f], r8b
add rax, 2
cmp rax, 0x18
jge 0x53891c
movzx edx, byte [rsp + rax + 0x30]
movzx esi, byte [rsp + rax + 0x31]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x11
jae 0x53893f
movzx r8d, byte [rsp + rdi + 0x1f]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x63]
cmp rsi, 0x11
jb 0x5388d0
jmp 0x538933
xor eax, eax
lea rbx, [rsp + 0x1f]
mov ecx, 0x11
call fcn.00443420
add rsp, 0x48
pop rbp
ret
mov eax, esi
mov ecx, 0x11
call fcn.00454ec0
mov eax, edi
mov ecx, 0x11
call fcn.00454ec0
nop
call fcn.00452c40
jmp fcn.00538860
Function at 0x538a20
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x538b1d
push rbp
mov rbp, rsp
sub rsp, 0x50
movabs rdx, 0xdf577465537401a4
mov qword [rsp + 0x1d], rdx
movabs rdx, 0xd57d97dcc2df5774
mov qword [rsp + 0x22], rdx
movabs rdx, 0x65d9c4bf69e4d5f8
mov qword [rsp + 0x2a], rdx
movabs rdx, 0x13120d0c0c07090b
mov qword [rsp + 0x32], rdx
movabs rdx, 0x20c0f00110d0b0a
mov qword [rsp + 0x3a], rdx
movabs rdx, 0xe0a1307010e020c
mov qword [rsp + 0x40], rdx
movabs rdx, 0x812000d01020a0a
mov qword [rsp + 0x48], rdx
xor eax, eax
jmp 0x538ac0
movzx r9d, byte [rsp + rsi + 0x1d]
sub r9d, edx
lea edx, [r9 - 0x17]
mov byte [rsp + rdi + 0x1d], dl
lea edx, [r8 - 0x17]
mov byte [rsp + rsi + 0x1d], dl
add rax, 2
nop dword [rax]
cmp rax, 0x1e
jge 0x538aed
movzx edx, byte [rsp + rax + 0x32]
movzx esi, byte [rsp + rax + 0x33]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x15
jae 0x538b10
movzx r8d, byte [rsp + rdi + 0x1d]
sub r8d, edx
cmp rsi, 0x15
jb 0x538a9f
jmp 0x538b04
xor eax, eax
lea rbx, [rsp + 0x1d]
mov ecx, 0x15
call fcn.00443420
add rsp, 0x50
pop rbp
ret
mov eax, esi
mov ecx, 0x15
call fcn.00454ec0
mov eax, edi
mov ecx, 0x15
call fcn.00454ec0
nop
nop dword [rax]
call fcn.00452c40
jmp fcn.00538a20

Function at 0x539100
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x5391ec
push rbp
mov rbp, rsp
sub rsp, 0x48
movabs rdx, 0xeb749c654283a3d0
mov qword [rsp + 0x1e], rdx
movabs rdx, 0x743eeb749c654283
mov qword [rsp + 0x20], rdx
movabs rdx, 0x244ba012a2a2b9a0
mov qword [rsp + 0x28], rdx
movabs rdx, 0x100211080e081110
mov qword [rsp + 0x30], rdx
movabs rdx, 0xe070c0102000b08
mov qword [rsp + 0x38], rdx
movabs rdx, 0xf0a0207050e0d11
mov qword [rsp + 0x40], rdx
xor eax, eax
jmp 0x53918a
movzx r9d, byte [rsp + rsi + 0x1e]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x56]
mov byte [rsp + rdi + 0x1e], dl
mov byte [rsp + rsi + 0x1e], r8b
add rax, 2
cmp rax, 0x18
jge 0x5391bc
movzx edx, byte [rsp + rax + 0x30]
movzx esi, byte [rsp + rax + 0x31]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x12
jae 0x5391df
movzx r8d, byte [rsp + rdi + 0x1e]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x56]
cmp rsi, 0x12
jb 0x539170
jmp 0x5391d3
xor eax, eax
lea rbx, [rsp + 0x1e]
mov ecx, 0x12
call fcn.00443420
add rsp, 0x48
pop rbp
ret
mov eax, esi
mov ecx, 0x12
call fcn.00454ec0
mov eax, edi
mov ecx, 0x12
call fcn.00454ec0
nop
call fcn.00452c40
jmp fcn.00539100
Function at 0x539780
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x539846
push rbp
mov rbp, rsp
sub rsp, 0x30
movabs rdx, 0xc91399d09d6e61bd
mov qword [rsp + 0x1a], rdx
mov word [rsp + 0x22], 0xbd20
movabs rdx, 0x805060609040606
mov qword [rsp + 0x24], rdx
mov dword [rsp + 0x2c], 0x3000705
xor eax, eax
jmp 0x5397e0
movzx r9d, byte [rsp + rsi + 0x1a]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x67]
mov byte [rsp + rdi + 0x1a], dl
mov byte [rsp + rsi + 0x1a], r8b
add rax, 2
nop dword [rax]
cmp rax, 0xc
jge 0x539812
movzx edx, byte [rsp + rax + 0x24]
movzx esi, byte [rsp + rax + 0x25]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0xa
jae 0x539837
movzx r8d, byte [rsp + rdi + 0x1a]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x67]
cmp rsi, 0xa
jb 0x5397c3
jmp 0x53982b
xor eax, eax
lea rbx, [rsp + 0x1a]
mov ecx, 0xa
nop
call fcn.00443420
add rsp, 0x30
pop rbp
ret
mov eax, esi
mov ecx, 0xa
call fcn.00454ec0
mov eax, edi
mov ecx, 0xa
nop
call fcn.00454ec0
nop
call fcn.00452c40
jmp fcn.00539780

Function at 0x53a2a0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x53a372
push rbp
mov rbp, rsp
sub rsp, 0x38
movabs rdx, 0x1bfdefba05e7ee0a
mov qword [rsp + 0x1f], rdx
movabs rdx, 0x965fa1bfdefba05
mov qword [rsp + 0x22], rdx
movabs rdx, 0x7070405060604
mov qword [rsp + 0x2a], rdx
movabs rdx, 0x10a080300020007
mov qword [rsp + 0x30], rdx
xor eax, eax
jmp 0x53a30c
movzx r9d, byte [rsp + rsi + 0x1f]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x52]
mov byte [rsp + rdi + 0x1f], dl
mov byte [rsp + rsi + 0x1f], r8b
add rax, 2
cmp rax, 0xe
jge 0x53a33e
movzx edx, byte [rsp + rax + 0x2a]
movzx esi, byte [rsp + rax + 0x2b]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0xb
jae 0x53a365
movzx r8d, byte [rsp + rdi + 0x1f]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x52]
cmp rsi, 0xb
jb 0x53a2f2
jmp 0x53a355
xor eax, eax
lea rbx, [rsp + 0x1f]
mov ecx, 0xb
call fcn.00443420
add rsp, 0x38
pop rbp
ret
mov eax, esi
mov ecx, 0xb
nop dword [rax]
call fcn.00454ec0
mov eax, edi
mov ecx, 0xb
call fcn.00454ec0
nop
call fcn.00452c40
jmp fcn.0053a2a0
Function at 0x53a840
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x53a926
push rbp
mov rbp, rsp
sub rsp, 0x38
movabs rdx, 0x5648ecddb9e5d843
mov qword [rsp + 0x18], rdx
movabs rdx, 0xf8f36674c6745648
mov qword [rsp + 0x1e], rdx
movabs rdx, 0x90b03020d0a070c
mov qword [rsp + 0x26], rdx
movabs rdx, 0x20c090b03020d0a
mov qword [rsp + 0x28], rdx
movabs rdx, 0x40509010c0d060c
mov qword [rsp + 0x30], rdx
xor eax, eax
nop
jmp 0x53a8c0
movzx r9d, byte [rsp + rsi + 0x18]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x77]
mov byte [rsp + rdi + 0x18], dl
mov byte [rsp + rsi + 0x18], r8b
add rax, 2
nop dword [rax]
cmp rax, 0x12
jge 0x53a8f2
movzx edx, byte [rsp + rax + 0x26]
movzx esi, byte [rsp + rax + 0x27]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0xe
jae 0x53a917
movzx r8d, byte [rsp + rdi + 0x18]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x77]
cmp rsi, 0xe
jb 0x53a8a2
jmp 0x53a90b
xor eax, eax
lea rbx, [rsp + 0x18]
mov ecx, 0xe
nop
call fcn.00443420
add rsp, 0x38
pop rbp
ret
mov eax, esi
mov ecx, 0xe
call fcn.00454ec0
mov eax, edi
mov ecx, 0xe
nop
call fcn.00454ec0
nop
call fcn.00452c40
jmp fcn.0053a840

Function at 0x53b500
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x53b5dd
push rbp
mov rbp, rsp
sub rsp, 0x40
movabs rdx, 0x7244656e818f659e
mov qword [rsp + 0x1e], rdx
movabs rdx, 0x67688169607d5573
mov qword [rsp + 0x26], rdx
movabs rdx, 0x9000a0b070e0e0d
mov qword [rsp + 0x2e], rdx
movabs rdx, 0x20909000a0b070e
mov qword [rsp + 0x30], rdx
movabs rdx, 0xa090f0f02030303
mov qword [rsp + 0x38], rdx
xor eax, eax
nop
jmp 0x53b580
movzx r9d, byte [rsp + rsi + 0x1e]
sub r9d, edx
lea edx, [r9 - 2]
mov byte [rsp + rdi + 0x1e], dl
lea edx, [r8 - 2]
mov byte [rsp + rsi + 0x1e], dl
add rax, 2
nop
cmp rax, 0x12
jge 0x53b5ad
movzx edx, byte [rsp + rax + 0x2e]
movzx esi, byte [rsp + rax + 0x2f]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x10
jae 0x53b5d0
movzx r8d, byte [rsp + rdi + 0x1e]
sub r8d, edx
cmp rsi, 0x10
jb 0x53b562
jmp 0x53b5c4
xor eax, eax
lea rbx, [rsp + 0x1e]
mov ecx, 0x10
call fcn.00443420
add rsp, 0x40
pop rbp
ret
mov eax, esi
mov ecx, 0x10
call fcn.00454ec0
mov eax, edi
mov ecx, 0x10
call fcn.00454ec0
nop
nop dword [rax]
call fcn.00452c40
jmp fcn.0053b500
Function at 0x53c420
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x53c52c
push rbp
mov rbp, rsp
sub rsp, 0x58
movabs rdx, 0x73c06cc3c42bcfe9
mov qword [rsp + 0x1d], rdx
movabs rdx, 0x4e2567cb610999bd
mov qword [rsp + 0x25], rdx
movabs rdx, 0xa0326f4e2567cb61
mov qword [rsp + 0x28], rdx
movabs rdx, 0xc96f979d306377d1
mov qword [rsp + 0x30], rdx
movabs rdx, 0xa18060011171109
mov qword [rsp + 0x38], rdx
movabs rdx, 0x1804120908160e16
mov qword [rsp + 0x40], rdx
movabs rdx, 0xc01020a0314110c
mov qword [rsp + 0x48], rdx
movabs rdx, 0x170a030a020e131a
mov qword [rsp + 0x50], rdx
xor eax, eax
jmp 0x53c4c8
movzx r9d, byte [rsp + rsi + 0x1d]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x7c]
mov byte [rsp + rdi + 0x1d], dl
mov byte [rsp + rsi + 0x1d], r8b
add rax, 2
cmp rax, 0x20
jge 0x53c4fc
movzx edx, byte [rsp + rax + 0x38]
movzx esi, byte [rsp + rax + 0x39]
mov edi, edx
xor edx, esi
add edx, eax
nop
cmp rdi, 0x1b
jae 0x53c51f
movzx r8d, byte [rsp + rdi + 0x1d]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x7c]
cmp rsi, 0x1b
jb 0x53c4ae
jmp 0x53c513
xor eax, eax
lea rbx, [rsp + 0x1d]
mov ecx, 0x1b
call fcn.00443420
add rsp, 0x58
pop rbp
ret
mov eax, esi
mov ecx, 0x1b
call fcn.00454ec0
mov eax, edi
mov ecx, 0x1b
call fcn.00454ec0
nop
call fcn.00452c40
jmp fcn.0053c420

Function at 0x53e9c0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x53eabb
push rbp
mov rbp, rsp
sub rsp, 0x50
movabs rdx, 0x7956555b58356d5a
mov qword [rsp + 0x19], rdx
movabs rdx, 0x7364284472526179
mov qword [rsp + 0x20], rdx
movabs rdx, 0x654c4f6f43544b73
mov qword [rsp + 0x28], rdx
movabs rdx, 0xb0c040815080c16
mov qword [rsp + 0x30], rdx
movabs rdx, 0x160314140b010702
mov qword [rsp + 0x38], rdx
movabs rdx, 0x1004111614080611
mov qword [rsp + 0x40], rdx
movabs rdx, 0xc090100050d0107
mov qword [rsp + 0x48], rdx
xor eax, eax
jmp 0x53ea59
movzx r9d, byte [rsp + rsi + 0x19]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x12]
mov byte [rsp + rdi + 0x19], dl
mov byte [rsp + rsi + 0x19], r8b
add rax, 2
cmp rax, 0x20
jge 0x53ea8b
movzx edx, byte [rsp + rax + 0x30]
movzx esi, byte [rsp + rax + 0x31]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x17
jae 0x53eaae
movzx r8d, byte [rsp + rdi + 0x19]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x12]
cmp rsi, 0x17
jb 0x53ea3f
jmp 0x53eaa2
xor eax, eax
lea rbx, [rsp + 0x19]
mov ecx, 0x17
call fcn.00443420
add rsp, 0x50
pop rbp
ret
mov eax, esi
mov ecx, 0x17
call fcn.00454ec0
mov eax, edi
mov ecx, 0x17
call fcn.00454ec0
nop
nop dword [rax + rax]
call fcn.00452c40
jmp fcn.0053e9c0