joyce8/EMBER2024-capa huggingface dataset:
Function at 0x50ab60
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x50ac68
push rbp
mov rbp, rsp
sub rsp, 0x58
movabs rdx, 0x4d5c2b4f2dd96e69
mov qword [rsp + 0x3f], rdx
movabs rdx, 0x285e54f0496e2c60
mov qword [rsp + 0x47], rdx
movabs rdx, 0x6c285e54f0496e2c
mov qword [rsp + 0x48], rdx
movabs rdx, 0x783e3a384d286651
mov qword [rsp + 0x50], rdx
movabs rdx, 0x1105131305020903
mov qword [rsp + 0x1f], rdx
movabs rdx, 0x130d0c0c15080b04
mov qword [rsp + 0x27], rdx
movabs rdx, 0x7071606170f160f
mov qword [rsp + 0x2f], rdx
movabs rdx, 0x30e0208060f1709
mov qword [rsp + 0x37], rdx
xor eax, eax
jmp 0x50ac0b
movzx r9d, byte [rsp + rsi + 0x3f]
sub r9d, edx
lea edx, [r9 + 0x3c]
mov byte [rsp + rdi + 0x3f], dl
lea edx, [r8 + 0x3c]
mov byte [rsp + rsi + 0x3f], dl
add rax, 2
cmp rax, 0x20
jge 0x50ac38
movzx edx, byte [rsp + rax + 0x1f]
movzx esi, byte [rsp + rax + 0x20]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x19
jae 0x50ac5b
movzx r8d, byte [rsp + rdi + 0x3f]
sub r8d, edx
cmp rsi, 0x19
jb 0x50abee
jmp 0x50ac4f
xor eax, eax
lea rbx, [rsp + 0x3f]
mov ecx, 0x19
call fcn.00448840
add rsp, 0x58
pop rbp
ret
mov eax, esi
mov ecx, 0x19
call fcn.0045b700
mov eax, edi
mov ecx, 0x19
call fcn.0045b700
nop
call fcn.00459420
jmp fcn.0050ab60

Function at 0x50b840
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x50b907
push rbp
mov rbp, rsp
sub rsp, 0x38
movabs rdx, 0x41263b74516f2f4e
mov qword [rsp + 0x2d], rdx
mov dword [rsp + 0x34], 0x57750341
movabs rdx, 0xa07030507000306
mov qword [rsp + 0x1f], rdx
movabs rdx, 0x5030708070a07
mov qword [rsp + 0x25], rdx
xor eax, eax
jmp 0x50b8a8
movzx r9d, byte [rsp + rsi + 0x2d]
sub r9d, edx
lea edx, [r9 + 0x21]
mov byte [rsp + rdi + 0x2d], dl
lea edx, [r8 + 0x21]
mov byte [rsp + rsi + 0x2d], dl
add rax, 2
cmp rax, 0xe
jge 0x50b8d7
movzx edx, byte [rsp + rax + 0x1f]
movzx esi, byte [rsp + rax + 0x20]
mov edi, edx
xor edx, esi
add edx, eax
nop
cmp rdi, 0xb
jae 0x50b8fa
movzx r8d, byte [rsp + rdi + 0x2d]
sub r8d, edx
cmp rsi, 0xb
jb 0x50b88b
jmp 0x50b8ee
xor eax, eax
lea rbx, [rsp + 0x2d]
mov ecx, 0xb
call fcn.00448840
add rsp, 0x38
pop rbp
ret
mov eax, esi
mov ecx, 0xb
call fcn.0045b700
mov eax, edi
mov ecx, 0xb
call fcn.0045b700
nop
call fcn.00459420
jmp fcn.0050b840
Function at 0x515c40
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x515d0c
push rbp
mov rbp, rsp
sub rsp, 0x38
movabs rdx, 0x733f5d466469696b
mov qword [rsp + 0x2b], rdx
movabs rdx, 0x655f644665733f5d
mov qword [rsp + 0x30], rdx
movabs rdx, 0x80c00060b020508
mov qword [rsp + 0x1b], rdx
movabs rdx, 0x80b0b0b0c0a0202
mov qword [rsp + 0x23], rdx
xor eax, eax
jmp 0x515caf
movzx r9d, byte [rsp + rsi + 0x2b]
sub r9d, edx
lea edx, [r9 + 0x11]
mov byte [rsp + rdi + 0x2b], dl
lea edx, [r8 + 0x11]
mov byte [rsp + rsi + 0x2b], dl
add rax, 2
cmp rax, 0x10
jge 0x515cdc
movzx edx, byte [rsp + rax + 0x1b]
movzx esi, byte [rsp + rax + 0x1c]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0xd
jae 0x515cff
movzx r8d, byte [rsp + rdi + 0x2b]
sub r8d, edx
cmp rsi, 0xd
jb 0x515c92
jmp 0x515cf3
xor eax, eax
lea rbx, [rsp + 0x2b]
mov ecx, 0xd
call fcn.00448840
add rsp, 0x38
pop rbp
ret
mov eax, esi
mov ecx, 0xd
call fcn.0045b700
mov eax, edi
mov ecx, 0xd
call fcn.0045b700
nop
call fcn.00459420
jmp fcn.00515c40

Function at 0x516100
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x5161cc
push rbp
mov rbp, rsp
sub rsp, 0x30
movabs rdx, 0x3346a7ba61eabcab
mov qword [rsp + 0x26], rdx
mov word [rsp + 0x2e], 0x65c1
movabs rdx, 0x404000201010207
mov qword [rsp + 0x18], rdx
movabs rdx, 0x705080008080404
mov qword [rsp + 0x1e], rdx
xor eax, eax
jmp 0x516164
movzx r9d, byte [rsp + rsi + 0x26]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x4c]
mov byte [rsp + rdi + 0x26], dl
mov byte [rsp + rsi + 0x26], r8b
add rax, 2
cmp rax, 0xe
jge 0x51619c
movzx edx, byte [rsp + rax + 0x18]
movzx esi, byte [rsp + rax + 0x19]
mov edi, edx
xor edx, esi
add edx, eax
nop word [rax + rax]
cmp rdi, 0xa
jae 0x5161bf
movzx r8d, byte [rsp + rdi + 0x26]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x4c]
cmp rsi, 0xa
jb 0x51614a
jmp 0x5161b3
xor eax, eax
lea rbx, [rsp + 0x26]
mov ecx, 0xa
call fcn.00448840
add rsp, 0x30
pop rbp
ret
mov eax, esi
mov ecx, 0xa
call fcn.0045b700
mov eax, edi
mov ecx, 0xa
call fcn.0045b700
nop
call fcn.00459420
jmp fcn.00516100
Function at 0x519ec0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x51a106
push rbp
mov rbp, rsp
sub rsp, 0x78
mov qword [rsp + 0x88], rax
mov qword [rsp + 0x98], rcx
test rdi, rdi
je 0x519f3f
cmp rbx, 1
je 0x519f06
cmp rbx, 8
jle 0x519f4c
movups xmmword [rsp + 0x1c], xmm15
movups xmmword [rsp + 0x2c], xmm15
xor edx, edx
jmp 0x51a0a1
movzx edx, byte [rax]
cmp edx, 0x80
mov esi, 0xfffd
cmovge edx, esi
mov rax, rcx
mov rbx, rdi
mov ecx, edx
nop
call fcn.00519ba0
test rax, rax
jl 0x519f32
xor eax, eax
add rsp, 0x78
pop rbp
ret
mov rax, 0xffffffffffffffff
add rsp, 0x78
pop rbp
ret
mov rax, 0xffffffffffffffff
add rsp, 0x78
pop rbp
ret
mov qword [rsp + 0x88], rax
mov qword [rsp + 0x90], rbx
nop dword [rax]
cmp rdi, 1
jne 0x519f85
movzx esi, byte [rcx]
cmp esi, 0x80
mov edi, 0xfffd
cmovge esi, edi
mov dword [rsp + 0x5c], esi
mov rcx, rbx
nop
jmp 0x51a040
mov qword [rsp + 0xa0], rdi
mov qword [rsp + 0x98], rcx
mov rdx, rbx
jmp 0x519fc0
mov rax, qword [rsp + 0x88]
mov rdx, qword [rsp + 0x90]
mov rdi, qword [rsp + 0xa0]
mov rbx, rcx
mov rcx, qword [rsp + 0x98]
nop dword [rax]
test rbx, rbx
jle 0x51a00e
cmp rdx, rbx
jb 0x51a01b
mov qword [rsp + 0x68], rbx
call fcn.004670a0
mov qword [rsp + 0x60], rbx
mov ecx, eax
mov rax, qword [rsp + 0x98]
mov rbx, qword [rsp + 0xa0]
call fcn.00519ba0
mov rcx, qword [rsp + 0x68]
mov rdx, qword [rsp + 0x60]
sub rcx, rdx
nop dword [rax]
test rax, rax
jl 0x519f9a
mov rax, rcx
add rsp, 0x78
pop rbp
ret
mov rax, 0xffffffffffffffff
add rsp, 0x78
pop rbp
ret
mov rcx, rbx
nop
call fcn.0045b740
mov rax, qword [rsp + 0x88]
mov rdi, qword [rsp + 0x90]
mov esi, edx
mov rbx, rcx
mov rcx, rdi
nop dword [rax]
test rbx, rbx
jle 0x51a06d
cmp rcx, rbx
jb 0x51a07a
mov qword [rsp + 0x70], rbx
call fcn.004670a0
mov rcx, qword [rsp + 0x70]
sub rcx, rbx
mov edx, dword [rsp + 0x5c]
cmp eax, edx
jne 0x51a025
mov rax, rcx
add rsp, 0x78
pop rbp
ret
mov rax, 0xffffffffffffffff
add rsp, 0x78
pop rbp
ret
mov rdx, rcx
mov rcx, rbx
call fcn.0045b740
mov r8d, esi
shr sil, 5
movzx esi, sil
mov r9d, dword [rsp + rsi*4 + 0x1c]
bts r9d, r8d
mov dword [rsp + rsi*4 + 0x1c], r9d
inc rdx
cmp rdi, rdx
jle 0x51a0b3
movzx esi, byte [rcx + rdx]
cmp sil, 0x80
jb 0x51a085
cmp rdi, rdx
movups xmm0, xmmword [rsp + 0x1c]
movups xmmword [rsp + 0x3c], xmm0
movups xmm0, xmmword [rsp + 0x2c]
movups xmmword [rsp + 0x4c], xmm0
jg 0x519f4c
lea rcx, [rbx - 1]
jmp 0x51a0d6
dec rcx
test rcx, rcx
jl 0x51a0f9
movzx edx, byte [rax + rcx]
mov ebx, edx
shr dl, 5
movzx edx, dl
mov edx, dword [rsp + rdx*4 + 0x3c]
bt edx, ebx
jae 0x51a0d3
mov rax, rcx
add rsp, 0x78
pop rbp
ret
mov rax, 0xffffffffffffffff
add rsp, 0x78
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
call fcn.00459420
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
jmp fcn.00519ec0
Function at 0x5214e0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x5215a6
push rbp
mov rbp, rsp
sub rsp, 0x30
movabs rdx, 0xbdcedc34c5533432
mov qword [rsp + 0x27], rdx
mov byte [rsp + 0x2f], 0x35
movabs rdx, 0x203020502020606
mov qword [rsp + 0x1d], rdx
mov word [rsp + 0x25], 0x703
xor eax, eax
nop
jmp 0x521540
movzx r9d, byte [rsp + rsi + 0x27]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x68]
mov byte [rsp + rdi + 0x27], dl
mov byte [rsp + rsi + 0x27], r8b
add rax, 2
nop dword [rax]
cmp rax, 0xa
jge 0x521572
movzx edx, byte [rsp + rax + 0x1d]
movzx esi, byte [rsp + rax + 0x1e]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 9
jae 0x521597
movzx r8d, byte [rsp + rdi + 0x27]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x68]
cmp rsi, 9
jb 0x521522
jmp 0x52158b
xor eax, eax
lea rbx, [rsp + 0x27]
mov ecx, 9
nop
call fcn.00448840
add rsp, 0x30
pop rbp
ret
mov eax, esi
mov ecx, 9
call fcn.0045b700
mov eax, edi
mov ecx, 9
nop
call fcn.0045b700
nop
call fcn.00459420
jmp fcn.005214e0

Function at 0x521980
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x521a3d
push rbp
mov rbp, rsp
sub rsp, 0x30
movabs rdx, 0x2235161d3323021c
mov qword [rsp + 0x26], rdx
mov word [rsp + 0x2e], 0x521
movabs rdx, 0x705000401050907
mov qword [rsp + 0x1c], rdx
mov word [rsp + 0x24], 0x802
xor eax, eax
jmp 0x5219e0
movzx r9d, byte [rsp + rsi + 0x26]
sub r9d, edx
lea edx, [r9 + 0x21]
mov byte [rsp + rdi + 0x26], dl
lea edx, [r8 + 0x21]
mov byte [rsp + rsi + 0x26], dl
add rax, 2
nop
cmp rax, 0xa
jge 0x521a0d
movzx edx, byte [rsp + rax + 0x1c]
movzx esi, byte [rsp + rax + 0x1d]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0xa
jae 0x521a30
movzx r8d, byte [rsp + rdi + 0x26]
sub r8d, edx
cmp rsi, 0xa
jb 0x5219c2
jmp 0x521a24
xor eax, eax
lea rbx, [rsp + 0x26]
mov ecx, 0xa
call fcn.00448840
add rsp, 0x30
pop rbp
ret
mov eax, esi
mov ecx, 0xa
call fcn.0045b700
mov eax, edi
mov ecx, 0xa
call fcn.0045b700
nop
nop dword [rax]
call fcn.00459420
jmp fcn.00521980

Function at 0x522240
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x52230c
push rbp
mov rbp, rsp
sub rsp, 0x38
movabs rdx, 0x423739b53431b44d
mov qword [rsp + 0x2b], rdx
movabs rdx, 0x3ec0b031b6423739
mov qword [rsp + 0x30], rdx
movabs rdx, 0xa080101070c090a
mov qword [rsp + 0x1d], rdx
movabs rdx, 0xc0b000b07040a08
mov qword [rsp + 0x23], rdx
xor eax, eax
jmp 0x5222af
movzx r9d, byte [rsp + rsi + 0x2b]
sub r9d, edx
lea edx, [r9 - 0x78]
mov byte [rsp + rdi + 0x2b], dl
lea edx, [r8 - 0x78]
mov byte [rsp + rsi + 0x2b], dl
add rax, 2
cmp rax, 0xe
jge 0x5222dc
movzx edx, byte [rsp + rax + 0x1d]
movzx esi, byte [rsp + rax + 0x1e]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0xd
jae 0x5222ff
movzx r8d, byte [rsp + rdi + 0x2b]
sub r8d, edx
cmp rsi, 0xd
jb 0x522292
jmp 0x5222f3
xor eax, eax
lea rbx, [rsp + 0x2b]
mov ecx, 0xd
call fcn.00448840
add rsp, 0x38
pop rbp
ret
mov eax, esi
mov ecx, 0xd
call fcn.0045b700
mov eax, edi
mov ecx, 0xd
call fcn.0045b700
nop
call fcn.00459420
jmp fcn.00522240
Function at 0x522de0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x522ec6
push rbp
mov rbp, rsp
sub rsp, 0x40
movabs rdx, 0xca7dd55e3427335c
mov qword [rsp + 0x30], rdx
movabs rdx, 0xcbd6d5ccd6d93f67
mov qword [rsp + 0x38], rdx
movabs rdx, 0xb0d090e0b060602
mov qword [rsp + 0x18], rdx
movabs rdx, 0xa08020502040e04
mov qword [rsp + 0x20], rdx
movabs rdx, 0xe0f000e050a070c
mov qword [rsp + 0x28], rdx
xor eax, eax
nop
jmp 0x522e60
movzx r9d, byte [rsp + rsi + 0x30]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x50]
mov byte [rsp + rdi + 0x30], dl
mov byte [rsp + rsi + 0x30], r8b
add rax, 2
nop dword [rax]
cmp rax, 0x18
jge 0x522e92
movzx edx, byte [rsp + rax + 0x18]
movzx esi, byte [rsp + rax + 0x19]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x10
jae 0x522eb7
movzx r8d, byte [rsp + rdi + 0x30]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x50]
cmp rsi, 0x10
jb 0x522e42
jmp 0x522eab
xor eax, eax
lea rbx, [rsp + 0x30]
mov ecx, 0x10
nop
call fcn.00448840
add rsp, 0x40
pop rbp
ret
mov eax, esi
mov ecx, 0x10
call fcn.0045b700
mov eax, edi
mov ecx, 0x10
nop
call fcn.0045b700
nop
call fcn.00459420
jmp fcn.00522de0

Function at 0x524340
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x52442c
push rbp
mov rbp, rsp
sub rsp, 0x48
movabs rdx, 0x3735b2322b25a126
mov qword [rsp + 0x33], rdx
movabs rdx, 0xae352bacb53735b2
mov qword [rsp + 0x38], rdx
movabs rdx, 0xafb69e35b7353837
mov qword [rsp + 0x40], rdx
movabs rdx, 0x1013020a09020514
mov qword [rsp + 0x1d], rdx
movabs rdx, 0x308080003091013
mov qword [rsp + 0x23], rdx
movabs rdx, 0xc0c08091201020a
mov qword [rsp + 0x2b], rdx
xor eax, eax
jmp 0x5243ca
movzx r9d, byte [rsp + rsi + 0x33]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x72]
mov byte [rsp + rdi + 0x33], dl
mov byte [rsp + rsi + 0x33], r8b
add rax, 2
cmp rax, 0x16
jge 0x5243fc
movzx edx, byte [rsp + rax + 0x1d]
movzx esi, byte [rsp + rax + 0x1e]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x15
jae 0x52441f
movzx r8d, byte [rsp + rdi + 0x33]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x72]
cmp rsi, 0x15
jb 0x5243b0
jmp 0x524413
xor eax, eax
lea rbx, [rsp + 0x33]
mov ecx, 0x15
call fcn.00448840
add rsp, 0x48
pop rbp
ret
mov eax, esi
mov ecx, 0x15
call fcn.0045b700
mov eax, edi
mov ecx, 0x15
call fcn.0045b700
nop
call fcn.00459420
jmp fcn.00524340
Function at 0x525160
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x52525b
push rbp
mov rbp, rsp
sub rsp, 0x50
movabs rdx, 0xbc36cecfd4bdddd1
mov qword [rsp + 0x38], rdx
movabs rdx, 0x3034de8574c0e4dc
mov qword [rsp + 0x40], rdx
movabs rdx, 0x35cd36767cd0ba9c
mov qword [rsp + 0x48], rdx
movabs rdx, 0xd0114130c0c1302
mov qword [rsp + 0x1a], rdx
movabs rdx, 0x414080902121002
mov qword [rsp + 0x22], rdx
movabs rdx, 0x503120a0b030414
mov qword [rsp + 0x28], rdx
movabs rdx, 0x1613040007110c0a
mov qword [rsp + 0x30], rdx
xor eax, eax
jmp 0x5251f9
movzx r9d, byte [rsp + rsi + 0x38]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x48]
mov byte [rsp + rdi + 0x38], dl
mov byte [rsp + rsi + 0x38], r8b
add rax, 2
cmp rax, 0x1e
jge 0x52522b
movzx edx, byte [rsp + rax + 0x1a]
movzx esi, byte [rsp + rax + 0x1b]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x18
jae 0x52524e
movzx r8d, byte [rsp + rdi + 0x38]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x48]
cmp rsi, 0x18
jb 0x5251df
jmp 0x525242
xor eax, eax
lea rbx, [rsp + 0x38]
mov ecx, 0x18
call fcn.00448840
add rsp, 0x50
pop rbp
ret
mov eax, esi
mov ecx, 0x18
call fcn.0045b700
mov eax, edi
mov ecx, 0x18
call fcn.0045b700
nop
nop dword [rax + rax]
call fcn.00459420
jmp fcn.00525160

Function at 0x526cc0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x526dda
push rbp
mov rbp, rsp
sub rsp, 0x58
movabs rdx, 0xb8c3d368c66730aa
mov qword [rsp + 0x3c], rdx
movabs rdx, 0xd6af323d3237b403
mov qword [rsp + 0x44], rdx
movabs rdx, 0x31b2376fd6af323d
mov qword [rsp + 0x48], rdx
movabs rdx, 0x37556abad233c4f9
mov qword [rsp + 0x50], rdx
movabs rdx, 0x517170215081408
mov qword [rsp + 0x18], rdx
movabs rdx, 0x40f041405171702
mov qword [rsp + 0x1c], rdx
movabs rdx, 0x190715101a0c191a
mov qword [rsp + 0x24], rdx
movabs rdx, 0xe18150e1b0f1514
mov qword [rsp + 0x2c], rdx
movabs rdx, 0x1b0f1a03060912
mov qword [rsp + 0x34], rdx
xor eax, eax
jmp 0x526d77
movzx r9d, byte [rsp + rsi + 0x3c]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x4e]
mov byte [rsp + rdi + 0x3c], dl
mov byte [rsp + rsi + 0x3c], r8b
add rax, 2
cmp rax, 0x24
jge 0x526da9
movzx edx, byte [rsp + rax + 0x18]
movzx esi, byte [rsp + rax + 0x19]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x1c
jae 0x526dcd
movzx r8d, byte [rsp + rdi + 0x3c]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x4e]
cmp rsi, 0x1c
jb 0x526d5d
jmp 0x526dc1
xor eax, eax
lea rbx, [rsp + 0x3c]
mov ecx, 0x1c
call fcn.00448840
add rsp, 0x58
pop rbp
nop
ret
mov eax, esi
mov ecx, 0x1c
call fcn.0045b700
mov eax, edi
mov ecx, 0x1c
call fcn.0045b700
nop
call fcn.00459420
nop
jmp fcn.00526cc0
Function at 0x5293c0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x5294f8
push rbp
mov rbp, rsp
sub rsp, 0x68
movabs rdx, 0x54332a1ff8dde533
mov qword [rsp + 0x46], rdx
movabs rdx, 0x6d3754332a1ff8dd
mov qword [rsp + 0x48], rdx
movabs rdx, 0xca3930e3c78fd17f
mov qword [rsp + 0x50], rdx
movabs rdx, 0x336b32f197c5e096
mov qword [rsp + 0x58], rdx
movabs rdx, 0xb1eafbdedd5ec533
mov qword [rsp + 0x60], rdx
movabs rdx, 0x111b0d0703071405
mov qword [rsp + 0x1a], rdx
movabs rdx, 0x15020a090d130b04
mov qword [rsp + 0x22], rdx
movabs rdx, 0x320030b15020a09
mov qword [rsp + 0x26], rdx
movabs rdx, 0x10c011812091e21
mov qword [rsp + 0x2e], rdx
movabs rdx, 0x9011e021e1c141d
mov qword [rsp + 0x36], rdx
movabs rdx, 0x161d0c21021f0e0a
mov qword [rsp + 0x3e], rdx
xor eax, eax
jmp 0x529498
movzx r9d, byte [rsp + rsi + 0x46]
sub r9d, edx
lea edx, [r9 + 0x7d]
mov byte [rsp + rdi + 0x46], dl
lea edx, [r8 + 0x7d]
mov byte [rsp + rsi + 0x46], dl
add rax, 2
cmp rax, 0x2c
jge 0x5294c8
movzx edx, byte [rsp + rax + 0x1a]
movzx esi, byte [rsp + rax + 0x1b]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x22
jae 0x5294eb
movzx r8d, byte [rsp + rdi + 0x46]
sub r8d, edx
nop dword [rax]
cmp rsi, 0x22
jb 0x52947b
jmp 0x5294df
xor eax, eax
lea rbx, [rsp + 0x46]
mov ecx, 0x22
call fcn.00448840
add rsp, 0x68
pop rbp
ret
mov eax, esi
mov ecx, 0x22
call fcn.0045b700
mov eax, edi
mov ecx, 0x22
call fcn.0045b700
nop
call fcn.00459420
nop dword [rax]
jmp fcn.005293c0

Function at 0x531d00
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x531dc7
push rbp
mov rbp, rsp
sub rsp, 0x30
movabs rdx, 0x98858c7a63657865
mov qword [rsp + 0x26], rdx
mov word [rsp + 0x2e], 0x7881
movabs rdx, 0x909090704060404
mov qword [rsp + 0x18], rdx
movabs rdx, 0x504080905040909
mov qword [rsp + 0x1e], rdx
xor eax, eax
jmp 0x531d67
movzx r9d, byte [rsp + rsi + 0x26]
sub r9d, edx
lea edx, [r9 - 2]
mov byte [rsp + rdi + 0x26], dl
lea edx, [r8 - 2]
mov byte [rsp + rsi + 0x26], dl
add rax, 2
cmp rax, 0xe
jge 0x531d97
movzx edx, byte [rsp + rax + 0x18]
movzx esi, byte [rsp + rax + 0x19]
mov edi, edx
xor edx, esi
add edx, eax
nop dword [rax]
cmp rdi, 0xa
jae 0x531dba
movzx r8d, byte [rsp + rdi + 0x26]
sub r8d, edx
cmp rsi, 0xa
jb 0x531d4a
jmp 0x531dae
xor eax, eax
lea rbx, [rsp + 0x26]
mov ecx, 0xa
call fcn.00448840
add rsp, 0x30
pop rbp
ret
mov eax, esi
mov ecx, 0xa
call fcn.0045b700
mov eax, edi
mov ecx, 0xa
call fcn.0045b700
nop
call fcn.00459420
jmp fcn.00531d00
Function at 0x536f80
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x5370b8
push rbp
mov rbp, rsp
sub rsp, 0x70
movabs rdx, 0x8a9e576d636678a7
mov qword [rsp + 0x49], rdx
movabs rdx, 0x8290623d4069768a
mov qword [rsp + 0x50], rdx
movabs rdx, 0x9c337821822074c8
mov qword [rsp + 0x58], rdx
movabs rdx, 0xfb896f7c818983c2
mov qword [rsp + 0x60], rdx
movabs rdx, 0x66573459816e697e
mov qword [rsp + 0x68], rdx
movabs rdx, 0x522171f1b0f1f00
mov qword [rsp + 0x19], rdx
movabs rdx, 0x1f1d0d070c05040c
mov qword [rsp + 0x21], rdx
movabs rdx, 0x151a16121a06121b
mov qword [rsp + 0x29], rdx
movabs rdx, 0x60e02191819260a
mov qword [rsp + 0x31], rdx
movabs rdx, 0xf16121e0b251e23
mov qword [rsp + 0x39], rdx
movabs rdx, 0x13240c22060d1415
mov qword [rsp + 0x41], rdx
xor eax, eax
jmp 0x537055
movzx r9d, byte [rsp + rsi + 0x49]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x38]
mov byte [rsp + rdi + 0x49], dl
mov byte [rsp + rsi + 0x49], r8b
add rax, 2
cmp rax, 0x30
jge 0x537088
movzx edx, byte [rsp + rax + 0x19]
movzx esi, byte [rsp + rax + 0x1a]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x27
jae 0x5370ab
movzx r8d, byte [rsp + rdi + 0x49]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x38]
nop
cmp rsi, 0x27
jb 0x53703b
jmp 0x53709f
xor eax, eax
lea rbx, [rsp + 0x49]
mov ecx, 0x27
call fcn.00448840
add rsp, 0x70
pop rbp
ret
mov eax, esi
mov ecx, 0x27
call fcn.0045b700
mov eax, edi
mov ecx, 0x27
call fcn.0045b700
nop
call fcn.00459420
nop dword [rax]
jmp fcn.00536f80

Function at 0x539020
Capabilities:
Encrypt data using rc4 prga

Disassembly:
lea r12, [rsp - 0x30]
cmp r12, qword [r14 + 0x10]
jbe 0x53917b
push rbp
mov rbp, rsp
sub rsp, 0xa8
movabs rdx, 0x6ddcf42019247812
mov qword [rsp + 0x6b], rdx
movabs rdx, 0xc61c08f34a792064
mov qword [rsp + 0x73], rdx
movabs rdx, 0x64af15f1b1c61c08
mov qword [rsp + 0x78], rdx
movabs rdx, 0x625dc50443634404
mov qword [rsp + 0x80], rdx
movabs rdx, 0x65c16165a820ad0e
mov qword [rsp + 0x88], rdx
movabs rdx, 0x1deec17469f20f64
mov qword [rsp + 0x90], rdx
movabs rdx, 0xe1661f6e4610217
mov qword [rsp + 0x98], rdx
movabs rdx, 0x198b61942023b820
mov qword [rsp + 0xa0], rdx
movabs rdx, 0x1a03021e0b161b30
mov qword [rsp + 0x19], rdx
lea rdi, [rsp + 0x1b]
lea rsi, [0x005944f2]
nop dword [rax]
mov qword [rsp - 0x10], rbp
lea rbp, [rsp - 0x10]
call fcn.0045bd3a
mov rbp, qword [rbp]
xor eax, eax
jmp 0x539111
movzx r9d, byte [rsp + rsi + 0x6b]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x11]
mov byte [rsp + rdi + 0x6b], dl
mov byte [rsp + rsi + 0x6b], r8b
add rax, 2
cmp rax, 0x52
jge 0x539148
movzx edx, byte [rsp + rax + 0x19]
movzx esi, byte [rsp + rax + 0x1a]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x3d
jae 0x53916e
movzx r8d, byte [rsp + rdi + 0x6b]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x11]
nop dword [rax + rax]
cmp rsi, 0x3d
jb 0x5390f7
jmp 0x539162
xor eax, eax
lea rbx, [rsp + 0x6b]
mov ecx, 0x3d
call fcn.00448840
add rsp, 0xa8
pop rbp
ret
mov eax, esi
mov ecx, 0x3d
call fcn.0045b700
mov eax, edi
mov ecx, 0x3d
call fcn.0045b700
nop
nop dword [rax + rax]
call fcn.00459420
jmp fcn.00539020
Function at 0x53a800
Capabilities:
Encrypt data using rc4 prga

Disassembly:
lea r12, [rsp - 0x48]
cmp r12, qword [r14 + 0x10]
jbe 0x53a97b
push rbp
mov rbp, rsp
sub rsp, 0xc0
movabs rdx, 0x6f3a20e241007821
mov qword [rsp + 0x79], rdx
movabs rdx, 0x77478a1e312e4c6f
mov qword [rsp + 0x80], rdx
movabs rdx, 0x233520c41310f304
mov qword [rsp + 0x88], rdx
movabs rdx, 0x211e606c698c7cdf
mov qword [rsp + 0x90], rdx
movabs rdx, 0x65a938c56c65de3a
mov qword [rsp + 0x98], rdx
movabs rdx, 0x65116320746ff774
mov qword [rsp + 0xa0], rdx
movabs rdx, 0x745a77203265a661
mov qword [rsp + 0xa8], rdx
movabs rdx, 0x8f6116b76f682066
mov qword [rsp + 0xb0], rdx
movabs rdx, 0x740c1e7a6e80be1d
mov qword [rsp + 0xb8], rdx
movabs rdx, 0x443715303b230217
mov qword [rsp + 0x1f], rdx
movabs rdx, 0x153f193f40182011
mov qword [rsp + 0x27], rdx
lea rdi, [rsp + 0x29]
lea rsi, [0x00594f22]
mov qword [rsp - 0x10], rbp
lea rbp, [rsp - 0x10]
call fcn.0045bd3a
mov rbp, qword [rbp]
xor eax, eax
jmp 0x53a917
movzx r9d, byte [rsp + rsi + 0x79]
sub r9d, edx
lea edx, [r9 - 0x7d]
mov byte [rsp + rdi + 0x79], dl
lea edx, [r8 - 0x7d]
mov byte [rsp + rsi + 0x79], dl
add rax, 2
cmp rax, 0x5a
jge 0x53a948
movzx edx, byte [rsp + rax + 0x1f]
movzx esi, byte [rsp + rax + 0x20]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x47
jae 0x53a96e
movzx r8d, byte [rsp + rdi + 0x79]
sub r8d, edx
nop dword [rax]
cmp rsi, 0x47
jb 0x53a8fa
jmp 0x53a962
xor eax, eax
lea rbx, [rsp + 0x79]
mov ecx, 0x47
call fcn.00448840
add rsp, 0xc0
pop rbp
ret
mov eax, esi
mov ecx, 0x47
call fcn.0045b700
mov eax, edi
mov ecx, 0x47
call fcn.0045b700
nop
nop dword [rax + rax]
call fcn.00459420
jmp fcn.0053a800
Function at 0x53cf60
Capabilities:
Encrypt data using rc4 prga

Disassembly:
lea r12, [rsp - 0x18]
cmp r12, qword [r14 + 0x10]
jbe 0x53d0e7
push rbp
mov rbp, rsp
sub rsp, 0x90
movabs rdx, 0x2c43320037742b30
mov qword [rsp + 0x5e], rdx
movabs rdx, 0x71652c4332003774
mov qword [rsp + 0x60], rdx
movabs rdx, 0x195637016e687238
mov qword [rsp + 0x68], rdx
movabs rdx, 0xf61b235468663848
mov qword [rsp + 0x70], rdx
movabs rdx, 0x75fc96668445c61
mov qword [rsp + 0x78], rdx
movabs rdx, 0x4a306969592ffed1
mov qword [rsp + 0x80], rdx
movabs rdx, 0x656a636f276d302b
mov qword [rsp + 0x88], rdx
movabs rdx, 0x70a04112a24222b
mov qword [rsp + 0x1e], rdx
movabs rdx, 0x231119210619281b
mov qword [rsp + 0x26], rdx
movabs rdx, 0x2d2b030e17131f1b
mov qword [rsp + 0x2e], rdx
movabs rdx, 0x211f180f2a052906
mov qword [rsp + 0x36], rdx
movabs rdx, 0x2f0a1b101d000001
mov qword [rsp + 0x3e], rdx
movabs rdx, 0x2530190118131119
mov qword [rsp + 0x46], rdx
movabs rdx, 0xc142b010f2c242b
mov qword [rsp + 0x4e], rdx
movabs rdx, 0x2f27240020271709
mov qword [rsp + 0x56], rdx
xor eax, eax
jmp 0x53d082
movzx r9d, byte [rsp + rsi + 0x5e]
sub r9d, edx
lea edx, [r9 + 0x4d]
mov byte [rsp + rdi + 0x5e], dl
lea edx, [r8 + 0x4d]
mov byte [rsp + rsi + 0x5e], dl
add rax, 2
cmp rax, 0x40
jge 0x53d0af
movzx edx, byte [rsp + rax + 0x1e]
movzx esi, byte [rsp + rax + 0x1f]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x32
jae 0x53d0da
movzx r8d, byte [rsp + rdi + 0x5e]
sub r8d, edx
cmp rsi, 0x32
jb 0x53d065
jmp 0x53d0ce
xor eax, eax
lea rbx, [rsp + 0x5e]
mov ecx, 0x32
nop dword [rax + rax]
call fcn.00448840
add rsp, 0x90
pop rbp
ret
mov eax, esi
mov ecx, 0x32
call fcn.0045b700
mov eax, edi
mov ecx, 0x32
call fcn.0045b700
nop
call fcn.00459420
jmp fcn.0053cf60