joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4e4400
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4e4508
push rbp
mov rbp, rsp
sub rsp, 0x50
movabs rdx, 0x807d8070747a7543
mov qword [rsp + 0x36], rdx
movabs rdx, 0x91696d8674747643
mov qword [rsp + 0x3e], rdx
movabs rdx, 0x756191696d867474
mov qword [rsp + 0x40], rdx
movabs rdx, 0x8878696f7e6e8384
mov qword [rsp + 0x48], rdx
movabs rdx, 0x17140215050d0716
mov qword [rsp + 0x18], rdx
movabs rdx, 0xa060a190c16170f
mov qword [rsp + 0x20], rdx
movabs rdx, 0x1319010d04190a06
mov qword [rsp + 0x26], rdx
movabs rdx, 0x1211171609010607
mov qword [rsp + 0x2e], rdx
xor eax, eax
jmp 0x4e44ab
movzx r9d, byte [rsp + rsi + 0x36]
sub r9d, edx
lea edx, [r9 + 0xf]
mov byte [rsp + rdi + 0x36], dl
lea edx, [r8 + 0xf]
mov byte [rsp + rsi + 0x36], dl
add rax, 2
cmp rax, 0x1e
jge 0x4e44d8
movzx edx, byte [rsp + rax + 0x18]
movzx esi, byte [rsp + rax + 0x19]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x1a
jae 0x4e44fb
movzx r8d, byte [rsp + rdi + 0x36]
sub r8d, edx
cmp rsi, 0x1a
jb 0x4e448e
jmp 0x4e44ef
xor eax, eax
lea rbx, [rsp + 0x36]
mov ecx, 0x1a
call fcn.00444780
add rsp, 0x50
pop rbp
ret
mov eax, esi
mov ecx, 0x1a
call fcn.00456620
mov eax, edi
mov ecx, 0x1a
call fcn.00456620
nop
call fcn.00454340
jmp fcn.004e4400

Function at 0x4e5420
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4e5506
push rbp
mov rbp, rsp
sub rsp, 0x40
movabs rdx, 0x3edf371a1f21f144
mov qword [rsp + 0x30], rdx
movabs rdx, 0x3336170322e26d6f
mov qword [rsp + 0x38], rdx
movabs rdx, 0x5040e06070a0d04
mov qword [rsp + 0x1c], rdx
movabs rdx, 0xf010d0c05040e06
mov qword [rsp + 0x20], rdx
movabs rdx, 0xd02030e0f0b0707
mov qword [rsp + 0x28], rdx
xor eax, eax
nop
jmp 0x4e54a0
movzx r9d, byte [rsp + rsi + 0x30]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x23]
mov byte [rsp + rdi + 0x30], dl
mov byte [rsp + rsi + 0x30], r8b
add rax, 2
nop dword [rax]
cmp rax, 0x14
jge 0x4e54d2
movzx edx, byte [rsp + rax + 0x1c]
movzx esi, byte [rsp + rax + 0x1d]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x10
jae 0x4e54f7
movzx r8d, byte [rsp + rdi + 0x30]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x23]
cmp rsi, 0x10
jb 0x4e5482
jmp 0x4e54eb
xor eax, eax
lea rbx, [rsp + 0x30]
mov ecx, 0x10
nop
call fcn.00444780
add rsp, 0x40
pop rbp
ret
mov eax, esi
mov ecx, 0x10
call fcn.00456620
mov eax, edi
mov ecx, 0x10
nop
call fcn.00456620
nop
call fcn.00454340
jmp fcn.004e5420
Function at 0x4e60c0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4e6186
push rbp
mov rbp, rsp
sub rsp, 0x30
movabs rdx, 0x537a597a9b746547
mov qword [rsp + 0x26], rdx
mov word [rsp + 0x2e], 0x8a78
movabs rdx, 0x507090809050305
mov qword [rsp + 0x1a], rdx
mov dword [rsp + 0x22], 0x6060409
xor eax, eax
jmp 0x4e6120
movzx r9d, byte [rsp + rsi + 0x26]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x16]
mov byte [rsp + rdi + 0x26], dl
mov byte [rsp + rsi + 0x26], r8b
add rax, 2
nop dword [rax]
cmp rax, 0xc
jge 0x4e6152
movzx edx, byte [rsp + rax + 0x1a]
movzx esi, byte [rsp + rax + 0x1b]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0xa
jae 0x4e6177
movzx r8d, byte [rsp + rdi + 0x26]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x16]
cmp rsi, 0xa
jb 0x4e6103
jmp 0x4e616b
xor eax, eax
lea rbx, [rsp + 0x26]
mov ecx, 0xa
nop
call fcn.00444780
add rsp, 0x30
pop rbp
ret
mov eax, esi
mov ecx, 0xa
call fcn.00456620
mov eax, edi
mov ecx, 0xa
nop
call fcn.00456620
nop
call fcn.00454340
jmp fcn.004e60c0

Function at 0x4e61a0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4e6252
push rbp
mov rbp, rsp
sub rsp, 0x28
movabs rdx, 0x6f6e6c4963656143
mov qword [rsp + 0x20], rdx
movabs rdx, 0x406060204030304
mov qword [rsp + 0x18], rdx
xor eax, eax
jmp 0x4e61f1
movzx r9d, byte [rsp + rsi + 0x20]
sub r9d, edx
lea edx, [r9 + 8]
mov byte [rsp + rdi + 0x20], dl
lea edx, [r8 + 8]
mov byte [rsp + rsi + 0x20], dl
add rax, 2
cmp rax, 8
jge 0x4e621e
movzx edx, byte [rsp + rax + 0x18]
movzx esi, byte [rsp + rax + 0x19]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 8
jae 0x4e6245
movzx r8d, byte [rsp + rdi + 0x20]
sub r8d, edx
cmp rsi, 8
jb 0x4e61d4
jmp 0x4e6235
xor eax, eax
lea rbx, [rsp + 0x20]
mov ecx, 8
call fcn.00444780
add rsp, 0x28
pop rbp
ret
mov eax, esi
mov ecx, 8
nop dword [rax]
call fcn.00456620
mov eax, edi
mov ecx, 8
call fcn.00456620
nop
call fcn.00454340
jmp fcn.004e61a0
Function at 0x4e8320
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4e841b
push rbp
mov rbp, rsp
sub rsp, 0x48
movabs rdx, 0xa3ac65749a427299
mov qword [rsp + 0x35], rdx
movabs rdx, 0xfeeb6da3ac65749a
mov qword [rsp + 0x38], rdx
movabs rdx, 0x57716ecb2cdc961f
mov qword [rsp + 0x40], rdx
movabs rdx, 0xf070a0e060c0709
mov qword [rsp + 0x1b], rdx
movabs rdx, 0x20b0d0d0d0b070e
mov qword [rsp + 0x23], rdx
movabs rdx, 0x1100020b0d0d0d0b
mov qword [rsp + 0x25], rdx
movabs rdx, 0xd0b03030a0b0a0b
mov qword [rsp + 0x2d], rdx
xor eax, eax
jmp 0x4e83b9
movzx r9d, byte [rsp + rsi + 0x35]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x4f]
mov byte [rsp + rdi + 0x35], dl
mov byte [rsp + rsi + 0x35], r8b
add rax, 2
cmp rax, 0x1a
jge 0x4e83eb
movzx edx, byte [rsp + rax + 0x1b]
movzx esi, byte [rsp + rax + 0x1c]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x13
jae 0x4e840e
movzx r8d, byte [rsp + rdi + 0x35]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x4f]
cmp rsi, 0x13
jb 0x4e839f
jmp 0x4e8402
xor eax, eax
lea rbx, [rsp + 0x35]
mov ecx, 0x13
call fcn.00444780
add rsp, 0x48
pop rbp
ret
mov eax, esi
mov ecx, 0x13
call fcn.00456620
mov eax, edi
mov ecx, 0x13
call fcn.00456620
nop
nop dword [rax + rax]
call fcn.00454340
jmp fcn.004e8320

Function at 0x4e8440
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4e852c
push rbp
mov rbp, rsp
sub rsp, 0x48
movabs rdx, 0x90f496ab619372af
mov qword [rsp + 0x30], rdx
movabs rdx, 0xb8b8e86cf2c995b4
mov qword [rsp + 0x38], rdx
movabs rdx, 0x7483905fa29e6ea8
mov qword [rsp + 0x40], rdx
movabs rdx, 0xb080a0e00161005
mov qword [rsp + 0x18], rdx
movabs rdx, 0xf0d040913080609
mov qword [rsp + 0x20], rdx
movabs rdx, 0x150207120e0e140f
mov qword [rsp + 0x28], rdx
xor eax, eax
jmp 0x4e84ca
movzx r9d, byte [rsp + rsi + 0x30]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x58]
mov byte [rsp + rdi + 0x30], dl
mov byte [rsp + rsi + 0x30], r8b
add rax, 2
cmp rax, 0x18
jge 0x4e84fc
movzx edx, byte [rsp + rax + 0x18]
movzx esi, byte [rsp + rax + 0x19]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x18
jae 0x4e851f
movzx r8d, byte [rsp + rdi + 0x30]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x58]
cmp rsi, 0x18
jb 0x4e84b0
jmp 0x4e8513
xor eax, eax
lea rbx, [rsp + 0x30]
mov ecx, 0x18
call fcn.00444780
add rsp, 0x48
pop rbp
ret
mov eax, esi
mov ecx, 0x18
call fcn.00456620
mov eax, edi
mov ecx, 0x18
call fcn.00456620
nop
call fcn.00454340
jmp fcn.004e8440
Function at 0x4ead80
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4eae5d
push rbp
mov rbp, rsp
sub rsp, 0x38
movabs rdx, 0x2d3d3c2931723d58
mov qword [rsp + 0x2a], rdx
movabs rdx, 0x575b2561410b2d3d
mov qword [rsp + 0x30], rdx
movabs rdx, 0x507090104060b08
mov qword [rsp + 0x18], rdx
movabs rdx, 0xb08050709010406
mov qword [rsp + 0x1a], rdx
movabs rdx, 0x305070c080109
mov qword [rsp + 0x22], rdx
xor eax, eax
nop
jmp 0x4eae00
movzx r9d, byte [rsp + rsi + 0x2a]
sub r9d, edx
lea edx, [r9 + 0x28]
mov byte [rsp + rdi + 0x2a], dl
lea edx, [r8 + 0x28]
mov byte [rsp + rsi + 0x2a], dl
add rax, 2
nop
cmp rax, 0x12
jge 0x4eae2d
movzx edx, byte [rsp + rax + 0x18]
movzx esi, byte [rsp + rax + 0x19]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0xe
jae 0x4eae50
movzx r8d, byte [rsp + rdi + 0x2a]
sub r8d, edx
cmp rsi, 0xe
jb 0x4eade2
jmp 0x4eae44
xor eax, eax
lea rbx, [rsp + 0x2a]
mov ecx, 0xe
call fcn.00444780
add rsp, 0x38
pop rbp
ret
mov eax, esi
mov ecx, 0xe
call fcn.00456620
mov eax, edi
mov ecx, 0xe
call fcn.00456620
nop
nop dword [rax]
call fcn.00454340
jmp fcn.004ead80

Function at 0x4ef2e0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4ef3cc
push rbp
mov rbp, rsp
sub rsp, 0x40
movabs rdx, 0x74720b68cef4b024
mov qword [rsp + 0x2f], rdx
movabs rdx, 0xef74720b68cef4b0
mov qword [rsp + 0x30], rdx
movabs rdx, 0x5a652461a09af467
mov qword [rsp + 0x38], rdx
movabs rdx, 0xc09050c100009
mov qword [rsp + 0x19], rdx
movabs rdx, 0x3020e000e08000c
mov qword [rsp + 0x1f], rdx
movabs rdx, 0xc0b030809010a08
mov qword [rsp + 0x27], rdx
xor eax, eax
jmp 0x4ef36a
movzx r9d, byte [rsp + rsi + 0x2f]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x67]
mov byte [rsp + rdi + 0x2f], dl
mov byte [rsp + rsi + 0x2f], r8b
add rax, 2
cmp rax, 0x16
jge 0x4ef39c
movzx edx, byte [rsp + rax + 0x19]
movzx esi, byte [rsp + rax + 0x1a]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x11
jae 0x4ef3bf
movzx r8d, byte [rsp + rdi + 0x2f]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x67]
cmp rsi, 0x11
jb 0x4ef350
jmp 0x4ef3b3
xor eax, eax
lea rbx, [rsp + 0x2f]
mov ecx, 0x11
call fcn.00444780
add rsp, 0x40
pop rbp
ret
mov eax, esi
mov ecx, 0x11
call fcn.00456620
mov eax, edi
mov ecx, 0x11
call fcn.00456620
nop
call fcn.00454340
jmp fcn.004ef2e0
Function at 0x4ef660
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4ef71e
push rbp
mov rbp, rsp
sub rsp, 0x30
movabs rdx, 0x6148647453741b5d
mov qword [rsp + 0x24], rdx
mov dword [rsp + 0x2c], 0x1bcdbfc8
movabs rdx, 0xa09000a09090801
mov qword [rsp + 0x18], rdx
mov dword [rsp + 0x20], 0x9010b
xor eax, eax
jmp 0x4ef6c1
movzx r9d, byte [rsp + rsi + 0x24]
sub r9d, edx
lea edx, [r9 + 0x5c]
mov byte [rsp + rdi + 0x24], dl
lea edx, [r8 + 0x5c]
mov byte [rsp + rsi + 0x24], dl
add rax, 2
cmp rax, 0xc
jge 0x4ef6ee
movzx edx, byte [rsp + rax + 0x18]
movzx esi, byte [rsp + rax + 0x19]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0xc
jae 0x4ef711
movzx r8d, byte [rsp + rdi + 0x24]
sub r8d, edx
cmp rsi, 0xc
jb 0x4ef6a4
jmp 0x4ef705
xor eax, eax
lea rbx, [rsp + 0x24]
mov ecx, 0xc
call fcn.00444780
add rsp, 0x30
pop rbp
ret
mov eax, esi
mov ecx, 0xc
call fcn.00456620
mov eax, edi
mov ecx, 0xc
call fcn.00456620
nop
nop
call fcn.00454340
jmp fcn.004ef660
Function at 0x4f3bc0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4f3c8c
push rbp
mov rbp, rsp
sub rsp, 0x38
movabs rdx, 0xd2b31b6eb8c4b7c9
mov qword [rsp + 0x2c], rdx
mov dword [rsp + 0x34], 0x98a1b740
movabs rdx, 0x905080507020100
mov qword [rsp + 0x1e], rdx
movabs rdx, 0x6090b03080a0905
mov qword [rsp + 0x24], rdx
xor eax, eax
jmp 0x4f3c25
movzx r9d, byte [rsp + rsi + 0x2c]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x65]
mov byte [rsp + rdi + 0x2c], dl
mov byte [rsp + rsi + 0x2c], r8b
add rax, 2
cmp rax, 0xe
jge 0x4f3c5c
movzx edx, byte [rsp + rax + 0x1e]
movzx esi, byte [rsp + rax + 0x1f]
mov edi, edx
xor edx, esi
add edx, eax
nop dword [rax + rax]
cmp rdi, 0xc
jae 0x4f3c7f
movzx r8d, byte [rsp + rdi + 0x2c]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x65]
cmp rsi, 0xc
jb 0x4f3c0b
jmp 0x4f3c73
xor eax, eax
lea rbx, [rsp + 0x2c]
mov ecx, 0xc
call fcn.00444780
add rsp, 0x38
pop rbp
ret
mov eax, esi
mov ecx, 0xc
call fcn.00456620
mov eax, edi
mov ecx, 0xc
call fcn.00456620
nop
call fcn.00454340
jmp fcn.004f3bc0

Function at 0x4f7180
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4f727d
push rbp
mov rbp, rsp
sub rsp, 0x50
movabs rdx, 0x294a3b0f02d00e94
mov qword [rsp + 0x3b], rdx
movabs rdx, 0x1bfd2b6e18294a3b
mov qword [rsp + 0x40], rdx
movabs rdx, 0x6e1669e7617ff429
mov qword [rsp + 0x48], rdx
movabs rdx, 0xe0f070d080c1100
mov qword [rsp + 0x1f], rdx
movabs rdx, 0xb02040a05130111
mov qword [rsp + 0x27], rdx
movabs rdx, 0xb03030e0b02040a
mov qword [rsp + 0x2b], rdx
movabs rdx, 0xe0b000105110f02
mov qword [rsp + 0x33], rdx
xor eax, eax
jmp 0x4f7220
movzx r9d, byte [rsp + rsi + 0x3b]
sub r9d, edx
lea edx, [r9 + 0x54]
mov byte [rsp + rdi + 0x3b], dl
lea edx, [r8 + 0x54]
mov byte [rsp + rsi + 0x3b], dl
add rax, 2
nop dword [rax]
cmp rax, 0x1c
jge 0x4f724d
movzx edx, byte [rsp + rax + 0x1f]
movzx esi, byte [rsp + rax + 0x20]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x15
jae 0x4f7270
movzx r8d, byte [rsp + rdi + 0x3b]
sub r8d, edx
cmp rsi, 0x15
jb 0x4f71ff
jmp 0x4f7264
xor eax, eax
lea rbx, [rsp + 0x3b]
mov ecx, 0x15
call fcn.00444780
add rsp, 0x50
pop rbp
ret
mov eax, esi
mov ecx, 0x15
call fcn.00456620
mov eax, edi
mov ecx, 0x15
call fcn.00456620
nop
nop dword [rax]
call fcn.00454340
jmp fcn.004f7180
Function at 0x4f8fa0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4f9072
push rbp
mov rbp, rsp
sub rsp, 0x38
movabs rdx, 0x72f364a2a7a47c89
mov qword [rsp + 0x2b], rdx
movabs rdx, 0x78e0e26ea572f364
mov qword [rsp + 0x30], rdx
movabs rdx, 0xb040b030a020603
mov qword [rsp + 0x1d], rdx
movabs rdx, 0x8010c0003020b04
mov qword [rsp + 0x23], rdx
xor eax, eax
jmp 0x4f900c
movzx r9d, byte [rsp + rsi + 0x2b]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x48]
mov byte [rsp + rdi + 0x2b], dl
mov byte [rsp + rsi + 0x2b], r8b
add rax, 2
cmp rax, 0xe
jge 0x4f903e
movzx edx, byte [rsp + rax + 0x1d]
movzx esi, byte [rsp + rax + 0x1e]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0xd
jae 0x4f9065
movzx r8d, byte [rsp + rdi + 0x2b]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x48]
cmp rsi, 0xd
jb 0x4f8ff2
jmp 0x4f9055
xor eax, eax
lea rbx, [rsp + 0x2b]
mov ecx, 0xd
call fcn.00444780
add rsp, 0x38
pop rbp
ret
mov eax, esi
mov ecx, 0xd
nop dword [rax]
call fcn.00456620
mov eax, edi
mov ecx, 0xd
call fcn.00456620
nop
call fcn.00454340
jmp fcn.004f8fa0

Function at 0x4fa5c0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4fa68c
push rbp
mov rbp, rsp
sub rsp, 0x38
movabs rdx, 0x62b5036f15747e11
mov qword [rsp + 0x2b], rdx
movabs rdx, 0x6579176e1862b503
mov qword [rsp + 0x30], rdx
movabs rdx, 0xb06030b05030b06
mov qword [rsp + 0x1b], rdx
movabs rdx, 0x80b0a00060b0106
mov qword [rsp + 0x23], rdx
xor eax, eax
jmp 0x4fa62f
movzx r9d, byte [rsp + rsi + 0x2b]
sub r9d, edx
lea edx, [r9 + 0x66]
mov byte [rsp + rdi + 0x2b], dl
lea edx, [r8 + 0x66]
mov byte [rsp + rsi + 0x2b], dl
add rax, 2
cmp rax, 0x10
jge 0x4fa65c
movzx edx, byte [rsp + rax + 0x1b]
movzx esi, byte [rsp + rax + 0x1c]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0xd
jae 0x4fa67f
movzx r8d, byte [rsp + rdi + 0x2b]
sub r8d, edx
cmp rsi, 0xd
jb 0x4fa612
jmp 0x4fa673
xor eax, eax
lea rbx, [rsp + 0x2b]
mov ecx, 0xd
call fcn.00444780
add rsp, 0x38
pop rbp
ret
mov eax, esi
mov ecx, 0xd
call fcn.00456620
mov eax, edi
mov ecx, 0xd
call fcn.00456620
nop
call fcn.00454340
jmp fcn.004fa5c0
Function at 0x4fbc80
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4fbd4a
push rbp
mov rbp, rsp
sub rsp, 0x48
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rbx
mov qword [rsp], rax
mov qword [rsp + 8], rbx
mov byte [rsp + 0x10], 0
call fcn.00403260
xorps xmm15, xmm15
mov r14, qword [0x006bb258]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x18], 0xffffffffffffffff
jne 0x4fbd2f
mov rcx, qword [rsp + 0x60]
lea rdx, [rcx + 1]
mov qword [rsp + 0x40], rdx
lea rax, [0x005577c0]
xor ebx, ebx
mov rcx, rdx
call fcn.004412a0
mov rbx, qword [rsp + 0x60]
mov rcx, rax
xor edi, edi
mov rsi, qword [rsp + 0x40]
mov rax, qword [rsp + 0x58]
nop dword [rax]
call fcn.004fc3a0
inc rbx
cmp rcx, rbx
jae 0x4fbd1e
mov edi, 1
lea rsi, [0x005577c0]
call fcn.00441380
mov word [rax + rbx*2 - 2], 0
xor edi, edi
xor esi, esi
add rsp, 0x48
pop rbp
ret
xor eax, eax
xor ebx, ebx
mov rcx, rbx
lea rdi, [0x0059e638]
lea rsi, [0x0059e248]
add rsp, 0x48
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.00454340
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.004fbc80

Function at 0x502040
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x5020f8
push rbp
mov rbp, rsp
sub rsp, 0x30
movabs rdx, 0x72324e210e166f09
mov qword [rsp + 0x28], rdx
movabs rdx, 0x205000406060300
mov qword [rsp + 0x1e], rdx
mov word [rsp + 0x26], 0x503
xor eax, eax
jmp 0x502098
movzx r9d, byte [rsp + rsi + 0x28]
sub r9d, edx
lea edx, [r9 + 0x35]
mov byte [rsp + rdi + 0x28], dl
lea edx, [r8 + 0x35]
mov byte [rsp + rsi + 0x28], dl
add rax, 2
cmp rax, 0xa
jge 0x5020c8
movzx edx, byte [rsp + rax + 0x1e]
movzx esi, byte [rsp + rax + 0x1f]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 8
jae 0x5020eb
movzx r8d, byte [rsp + rdi + 0x28]
sub r8d, edx
nop dword [rax]
cmp rsi, 8
jb 0x50207b
jmp 0x5020df
xor eax, eax
lea rbx, [rsp + 0x28]
mov ecx, 8
call fcn.00444780
add rsp, 0x30
pop rbp
ret
mov eax, esi
mov ecx, 8
call fcn.00456620
mov eax, edi
mov ecx, 8
call fcn.00456620
nop
call fcn.00454340
nop dword [rax]
jmp fcn.00502040

Function at 0x502120
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x5021d8
push rbp
mov rbp, rsp
sub rsp, 0x30
movabs rdx, 0x6444626876616565
mov qword [rsp + 0x28], rdx
movabs rdx, 0x304000602050707
mov qword [rsp + 0x1e], rdx
mov word [rsp + 0x26], 0x407
xor eax, eax
jmp 0x502178
movzx r9d, byte [rsp + rsi + 0x28]
sub r9d, edx
lea edx, [r9 + 0xa]
mov byte [rsp + rdi + 0x28], dl
lea edx, [r8 + 0xa]
mov byte [rsp + rsi + 0x28], dl
add rax, 2
cmp rax, 0xa
jge 0x5021a8
movzx edx, byte [rsp + rax + 0x1e]
movzx esi, byte [rsp + rax + 0x1f]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 8
jae 0x5021cb
movzx r8d, byte [rsp + rdi + 0x28]
sub r8d, edx
nop dword [rax]
cmp rsi, 8
jb 0x50215b
jmp 0x5021bf
xor eax, eax
lea rbx, [rsp + 0x28]
mov ecx, 8
call fcn.00444780
add rsp, 0x30
pop rbp
ret
mov eax, esi
mov ecx, 8
call fcn.00456620
mov eax, edi
mov ecx, 8
call fcn.00456620
nop
call fcn.00454340
nop dword [rax]
jmp fcn.00502120
Function at 0x503480
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x50358c
push rbp
mov rbp, rsp
sub rsp, 0x50
movabs rdx, 0x7e7f857f74756f8d
mov qword [rsp + 0x37], rdx
movabs rdx, 0x8b61838e20684432
mov qword [rsp + 0x3f], rdx
movabs rdx, 0x648b61838e206844
mov qword [rsp + 0x40], rdx
movabs rdx, 0x6572636f9c647290
mov qword [rsp + 0x48], rdx
movabs rdx, 0x160c110708140509
mov qword [rsp + 0x1d], rdx
movabs rdx, 0x110a080d00110416
mov qword [rsp + 0x25], rdx
movabs rdx, 0xa15110a080d0011
mov qword [rsp + 0x27], rdx
movabs rdx, 0x170d060f1515070f
mov qword [rsp + 0x2f], rdx
xor eax, eax
jmp 0x503528
movzx r9d, byte [rsp + rsi + 0x37]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x30]
mov byte [rsp + rdi + 0x37], dl
mov byte [rsp + rsi + 0x37], r8b
add rax, 2
cmp rax, 0x1a
jge 0x50355c
movzx edx, byte [rsp + rax + 0x1d]
movzx esi, byte [rsp + rax + 0x1e]
mov edi, edx
xor edx, esi
add edx, eax
nop
cmp rdi, 0x19
jae 0x50357f
movzx r8d, byte [rsp + rdi + 0x37]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x30]
cmp rsi, 0x19
jb 0x50350e
jmp 0x503573
xor eax, eax
lea rbx, [rsp + 0x37]
mov ecx, 0x19
call fcn.00444780
add rsp, 0x50
pop rbp
ret
mov eax, esi
mov ecx, 0x19
call fcn.00456620
mov eax, edi
mov ecx, 0x19
call fcn.00456620
nop
call fcn.00454340
jmp fcn.00503480

Function at 0x5038e0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x5039fa
push rbp
mov rbp, rsp
sub rsp, 0x60
movabs rdx, 0x78637a6515537164
mov qword [rsp + 0x41], rdx
movabs rdx, 0x715a5266958f976d
mov qword [rsp + 0x49], rdx
movabs rdx, 0x7f6e676a3b684371
mov qword [rsp + 0x50], rdx
movabs rdx, 0x4c248554207a4c61
mov qword [rsp + 0x58], rdx
movabs rdx, 0x1803090a00160009
mov qword [rsp + 0x19], rdx
movabs rdx, 0xf011c1c0b1c0805
mov qword [rsp + 0x21], rdx
movabs rdx, 0x61c0b07070e1412
mov qword [rsp + 0x29], rdx
movabs rdx, 0x1411100d1319011d
mov qword [rsp + 0x31], rdx
movabs rdx, 0x8051802000d1e02
mov qword [rsp + 0x39], rdx
xor eax, eax
jmp 0x503997
movzx r9d, byte [rsp + rsi + 0x41]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x2a]
mov byte [rsp + rdi + 0x41], dl
mov byte [rsp + rsi + 0x41], r8b
add rax, 2
cmp rax, 0x28
jge 0x5039c9
movzx edx, byte [rsp + rax + 0x19]
movzx esi, byte [rsp + rax + 0x1a]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x1f
jae 0x5039ed
movzx r8d, byte [rsp + rdi + 0x41]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x2a]
cmp rsi, 0x1f
jb 0x50397d
jmp 0x5039e1
xor eax, eax
lea rbx, [rsp + 0x41]
mov ecx, 0x1f
call fcn.00444780
add rsp, 0x60
pop rbp
nop
ret
mov eax, esi
mov ecx, 0x1f
call fcn.00456620
mov eax, edi
mov ecx, 0x1f
call fcn.00456620
nop
call fcn.00454340
nop
jmp fcn.005038e0
Function at 0x506340
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x50642a
push rbp
mov rbp, rsp
sub rsp, 0x48
movabs rdx, 0xcf2061746e756f15
mov qword [rsp + 0x32], rdx
movabs rdx, 0x1052141753b8cf20
mov qword [rsp + 0x38], rdx
movabs rdx, 0xfd6d3d54204d4561
mov qword [rsp + 0x40], rdx
movabs rdx, 0x150f130b0d08000a
mov qword [rsp + 0x1a], rdx
movabs rdx, 0x7060d10130c0d06
mov qword [rsp + 0x22], rdx
movabs rdx, 0x70c0a0f06080f0f
mov qword [rsp + 0x2a], rdx
xor eax, eax
jmp 0x5063cd
movzx r9d, byte [rsp + rsi + 0x32]
sub r9d, edx
lea edx, [r9 + 0x40]
mov byte [rsp + rdi + 0x32], dl
lea edx, [r8 + 0x40]
mov byte [rsp + rsi + 0x32], dl
add rax, 2
cmp rax, 0x18
jge 0x5063fa
movzx edx, byte [rsp + rax + 0x1a]
movzx esi, byte [rsp + rax + 0x1b]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x16
jae 0x50641d
movzx r8d, byte [rsp + rdi + 0x32]
sub r8d, edx
cmp rsi, 0x16
jb 0x5063b0
jmp 0x506411
xor eax, eax
lea rbx, [rsp + 0x32]
mov ecx, 0x16
call fcn.00444780
add rsp, 0x48
pop rbp
ret
mov eax, esi
mov ecx, 0x16
call fcn.00456620
mov eax, edi
mov ecx, 0x16
call fcn.00456620
nop
call fcn.00454340
jmp fcn.00506340

Function at 0x50a660
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x50a768
push rbp
mov rbp, rsp
sub rsp, 0x58
movabs rdx, 0x206c613ef1291943
mov qword [rsp + 0x3e], rdx
movabs rdx, 0xc474e3ca16480a41
mov qword [rsp + 0x46], rdx
movabs rdx, 0xb630c474e3ca1648
mov qword [rsp + 0x48], rdx
movabs rdx, 0x406d69da20f591be
mov qword [rsp + 0x50], rdx
movabs rdx, 0x140211160f160310
mov qword [rsp + 0x1e], rdx
movabs rdx, 0x13160c160d090b0f
mov qword [rsp + 0x26], rdx
movabs rdx, 0x2120a13090c0916
mov qword [rsp + 0x2e], rdx
movabs rdx, 0x191004110119020c
mov qword [rsp + 0x36], rdx
xor eax, eax
jmp 0x50a70b
movzx r9d, byte [rsp + rsi + 0x3e]
sub r9d, edx
lea edx, [r9 + 0x57]
mov byte [rsp + rdi + 0x3e], dl
lea edx, [r8 + 0x57]
mov byte [rsp + rsi + 0x3e], dl
add rax, 2
cmp rax, 0x20
jge 0x50a738
movzx edx, byte [rsp + rax + 0x1e]
movzx esi, byte [rsp + rax + 0x1f]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x1a
jae 0x50a75b
movzx r8d, byte [rsp + rdi + 0x3e]
sub r8d, edx
cmp rsi, 0x1a
jb 0x50a6ee
jmp 0x50a74f
xor eax, eax
lea rbx, [rsp + 0x3e]
mov ecx, 0x1a
call fcn.00444780
add rsp, 0x58
pop rbp
ret
mov eax, esi
mov ecx, 0x1a
call fcn.00456620
mov eax, edi
mov ecx, 0x1a
call fcn.00456620
nop
call fcn.00454340
jmp fcn.0050a660