joyce8/EMBER2024-capa huggingface dataset:
Function at 0x51ef40
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x51f05a
push rbp
mov rbp, rsp
sub rsp, 0x60
movabs rdx, 0x94a1a18874d5b0df
mov qword [rsp + 0x43], rdx
movabs rdx, 0x20c96369b2656d72
mov qword [rsp + 0x4b], rdx
movabs rdx, 0x749ec2b45320c963
mov qword [rsp + 0x50], rdx
movabs rdx, 0x6096967eeb5d7261
mov qword [rsp + 0x58], rdx
movabs rdx, 0x1702040012061806
mov qword [rsp + 0x1b], rdx
movabs rdx, 0x1010e1c04130201
mov qword [rsp + 0x23], rdx
movabs rdx, 0x1a1c0519061b0b01
mov qword [rsp + 0x2b], rdx
movabs rdx, 0xb17080801121117
mov qword [rsp + 0x33], rdx
movabs rdx, 0xe18060706121914
mov qword [rsp + 0x3b], rdx
xor eax, eax
jmp 0x51eff7
movzx r9d, byte [rsp + rsi + 0x43]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x4d]
mov byte [rsp + rdi + 0x43], dl
mov byte [rsp + rsi + 0x43], r8b
add rax, 2
cmp rax, 0x28
jge 0x51f029
movzx edx, byte [rsp + rax + 0x1b]
movzx esi, byte [rsp + rax + 0x1c]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x1d
jae 0x51f04d
movzx r8d, byte [rsp + rdi + 0x43]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x4d]
cmp rsi, 0x1d
jb 0x51efdd
jmp 0x51f041
xor eax, eax
lea rbx, [rsp + 0x43]
mov ecx, 0x1d
call fcn.0045b080
add rsp, 0x60
pop rbp
nop
ret
mov eax, esi
mov ecx, 0x1d
call fcn.004607e0
mov eax, edi
mov ecx, 0x1d
call fcn.004607e0
nop
call fcn.0045e500
nop
jmp fcn.0051ef40

Function at 0x51fbc0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x51fcda
push rbp
mov rbp, rsp
sub rsp, 0x60
movabs rdx, 0xbfd1ac439b7f65f7
mov qword [rsp + 0x42], rdx
movabs rdx, 0x472acf0bf617402
mov qword [rsp + 0x4a], rdx
movabs rdx, 0x20316d2254ce0472
mov qword [rsp + 0x50], rdx
movabs rdx, 0x29b0636776f54d05
mov qword [rsp + 0x58], rdx
movabs rdx, 0x1012041816021407
mov qword [rsp + 0x1c], rdx
movabs rdx, 0x21002180f061012
mov qword [rsp + 0x22], rdx
movabs rdx, 0x71903000b080f0b
mov qword [rsp + 0x2a], rdx
movabs rdx, 0x101a050d10070803
mov qword [rsp + 0x32], rdx
movabs rdx, 0xb040b0c1c1a1906
mov qword [rsp + 0x3a], rdx
xor eax, eax
jmp 0x51fc77
movzx r9d, byte [rsp + rsi + 0x42]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x6d]
mov byte [rsp + rdi + 0x42], dl
mov byte [rsp + rsi + 0x42], r8b
add rax, 2
cmp rax, 0x26
jge 0x51fca9
movzx edx, byte [rsp + rax + 0x1c]
movzx esi, byte [rsp + rax + 0x1d]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x1e
jae 0x51fccd
movzx r8d, byte [rsp + rdi + 0x42]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x6d]
cmp rsi, 0x1e
jb 0x51fc5d
jmp 0x51fcc1
xor eax, eax
lea rbx, [rsp + 0x42]
mov ecx, 0x1e
call fcn.0045b080
add rsp, 0x60
pop rbp
nop
ret
mov eax, esi
mov ecx, 0x1e
call fcn.004607e0
mov eax, edi
mov ecx, 0x1e
call fcn.004607e0
nop
call fcn.0045e500
nop
jmp fcn.0051fbc0
Function at 0x520020
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x52011b
push rbp
mov rbp, rsp
sub rsp, 0x50
movabs rdx, 0x3f0807ab74eb17bd
mov qword [rsp + 0x38], rdx
movabs rdx, 0x649361c953202065
mov qword [rsp + 0x40], rdx
movabs rdx, 0xbaa969bcd5bf0e61
mov qword [rsp + 0x48], rdx
movabs rdx, 0xc01170614070905
mov qword [rsp + 0x1c], rdx
movabs rdx, 0x91702120c021311
mov qword [rsp + 0x24], rdx
movabs rdx, 0x405041209170212
mov qword [rsp + 0x28], rdx
movabs rdx, 0xe16000c06130e14
mov qword [rsp + 0x30], rdx
xor eax, eax
jmp 0x5200b9
movzx r9d, byte [rsp + rsi + 0x38]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x6d]
mov byte [rsp + rdi + 0x38], dl
mov byte [rsp + rsi + 0x38], r8b
add rax, 2
cmp rax, 0x1c
jge 0x5200eb
movzx edx, byte [rsp + rax + 0x1c]
movzx esi, byte [rsp + rax + 0x1d]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x18
jae 0x52010e
movzx r8d, byte [rsp + rdi + 0x38]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x6d]
cmp rsi, 0x18
jb 0x52009f
jmp 0x520102
xor eax, eax
lea rbx, [rsp + 0x38]
mov ecx, 0x18
call fcn.0045b080
add rsp, 0x50
pop rbp
ret
mov eax, esi
mov ecx, 0x18
call fcn.004607e0
mov eax, edi
mov ecx, 0x18
call fcn.004607e0
nop
nop dword [rax + rax]
call fcn.0045e500
jmp fcn.00520020

Function at 0x5218a0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x5219c7
push rbp
mov rbp, rsp
sub rsp, 0x60
movabs rdx, 0xee74feb9a1bcc3eb
mov qword [rsp + 0x42], rdx
movabs rdx, 0xe631472756d2720
mov qword [rsp + 0x4a], rdx
movabs rdx, 0xec6f48c01c200e63
mov qword [rsp + 0x50], rdx
movabs rdx, 0xb8f5dbaf91642c61
mov qword [rsp + 0x58], rdx
movabs rdx, 0x171b01121b010314
mov qword [rsp + 0x18], rdx
movabs rdx, 0x140519121513171b
mov qword [rsp + 0x20], rdx
movabs rdx, 0x121d140519121513
mov qword [rsp + 0x22], rdx
movabs rdx, 0x2040d1b0b17140d
mov qword [rsp + 0x2a], rdx
movabs rdx, 0x1a1c041209170300
mov qword [rsp + 0x32], rdx
movabs rdx, 0x1b1c151c07090f11
mov qword [rsp + 0x3a], rdx
xor eax, eax
jmp 0x521969
movzx r9d, byte [rsp + rsi + 0x42]
sub r9d, edx
lea edx, [r9 - 0x7b]
mov byte [rsp + rdi + 0x42], dl
lea edx, [r8 - 0x7b]
mov byte [rsp + rsi + 0x42], dl
add rax, 2
cmp rax, 0x2a
jge 0x521997
movzx edx, byte [rsp + rax + 0x18]
movzx esi, byte [rsp + rax + 0x19]
mov edi, edx
xor edx, esi
add edx, eax
nop
cmp rdi, 0x1e
jae 0x5219ba
movzx r8d, byte [rsp + rdi + 0x42]
sub r8d, edx
cmp rsi, 0x1e
jb 0x52194c
jmp 0x5219ae
xor eax, eax
lea rbx, [rsp + 0x42]
mov ecx, 0x1e
call fcn.0045b080
add rsp, 0x60
pop rbp
ret
mov eax, esi
mov ecx, 0x1e
call fcn.004607e0
mov eax, edi
mov ecx, 0x1e
call fcn.004607e0
nop
call fcn.0045e500
jmp fcn.005218a0
Function at 0x521d00
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x521dec
push rbp
mov rbp, rsp
sub rsp, 0x48
movabs rdx, 0x74862074a3957559
mov qword [rsp + 0x35], rdx
movabs rdx, 0x77a09b74862074a3
mov qword [rsp + 0x38], rdx
movabs rdx, 0x696b89a62064a9fc
mov qword [rsp + 0x40], rdx
movabs rdx, 0x80311060b08090c
mov qword [rsp + 0x1f], rdx
movabs rdx, 0x3020f0909100803
mov qword [rsp + 0x25], rdx
movabs rdx, 0x8040b1209020a11
mov qword [rsp + 0x2d], rdx
xor eax, eax
jmp 0x521d8a
movzx r9d, byte [rsp + rsi + 0x35]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x33]
mov byte [rsp + rdi + 0x35], dl
mov byte [rsp + rsi + 0x35], r8b
add rax, 2
cmp rax, 0x16
jge 0x521dbc
movzx edx, byte [rsp + rax + 0x1f]
movzx esi, byte [rsp + rax + 0x20]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x13
jae 0x521ddf
movzx r8d, byte [rsp + rdi + 0x35]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x33]
cmp rsi, 0x13
jb 0x521d70
jmp 0x521dd3
xor eax, eax
lea rbx, [rsp + 0x35]
mov ecx, 0x13
call fcn.0045b080
add rsp, 0x48
pop rbp
ret
mov eax, esi
mov ecx, 0x13
call fcn.004607e0
mov eax, edi
mov ecx, 0x13
call fcn.004607e0
nop
call fcn.0045e500
jmp fcn.00521d00

Function at 0x526ea0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x526f9d
push rbp
mov rbp, rsp
sub rsp, 0x50
movabs rdx, 0x989d9a58af6730dd
mov qword [rsp + 0x3b], rdx
movabs rdx, 0xd2d7b49e88989d9a
mov qword [rsp + 0x40], rdx
movabs rdx, 0x65abaca39c6481ac
mov qword [rsp + 0x48], rdx
movabs rdx, 0xb07050a0a03050d
mov qword [rsp + 0x1f], rdx
movabs rdx, 0xe04100d08000c
mov qword [rsp + 0x27], rdx
movabs rdx, 0x120c1306000e0410
mov qword [rsp + 0x2b], rdx
movabs rdx, 0x1109110301031307
mov qword [rsp + 0x33], rdx
xor eax, eax
jmp 0x526f40
movzx r9d, byte [rsp + rsi + 0x3b]
sub r9d, edx
lea edx, [r9 - 0x18]
mov byte [rsp + rdi + 0x3b], dl
lea edx, [r8 - 0x18]
mov byte [rsp + rsi + 0x3b], dl
add rax, 2
nop dword [rax]
cmp rax, 0x1c
jge 0x526f6d
movzx edx, byte [rsp + rax + 0x1f]
movzx esi, byte [rsp + rax + 0x20]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x15
jae 0x526f90
movzx r8d, byte [rsp + rdi + 0x3b]
sub r8d, edx
cmp rsi, 0x15
jb 0x526f1f
jmp 0x526f84
xor eax, eax
lea rbx, [rsp + 0x3b]
mov ecx, 0x15
call fcn.0045b080
add rsp, 0x50
pop rbp
ret
mov eax, esi
mov ecx, 0x15
call fcn.004607e0
mov eax, edi
mov ecx, 0x15
call fcn.004607e0
nop
nop dword [rax]
call fcn.0045e500
jmp fcn.00526ea0
Function at 0x527300
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x5273fd
push rbp
mov rbp, rsp
sub rsp, 0x50
movabs rdx, 0x9bcdbf98b27a8e84
mov qword [rsp + 0x39], rdx
movabs rdx, 0xf6e6193be20a89b
mov qword [rsp + 0x40], rdx
movabs rdx, 0x91c669548ded727f
mov qword [rsp + 0x48], rdx
movabs rdx, 0x506080e06080b01
mov qword [rsp + 0x1b], rdx
movabs rdx, 0xf0f040811040304
mov qword [rsp + 0x23], rdx
movabs rdx, 0x4120a000a0f0f
mov qword [rsp + 0x29], rdx
movabs rdx, 0x80e160007060615
mov qword [rsp + 0x31], rdx
xor eax, eax
jmp 0x5273a0
movzx r9d, byte [rsp + rsi + 0x39]
sub r9d, edx
lea edx, [r9 - 0x10]
mov byte [rsp + rdi + 0x39], dl
lea edx, [r8 - 0x10]
mov byte [rsp + rsi + 0x39], dl
add rax, 2
nop dword [rax]
cmp rax, 0x1e
jge 0x5273cd
movzx edx, byte [rsp + rax + 0x1b]
movzx esi, byte [rsp + rax + 0x1c]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x17
jae 0x5273f0
movzx r8d, byte [rsp + rdi + 0x39]
sub r8d, edx
cmp rsi, 0x17
jb 0x52737f
jmp 0x5273e4
xor eax, eax
lea rbx, [rsp + 0x39]
mov ecx, 0x17
call fcn.0045b080
add rsp, 0x50
pop rbp
ret
mov eax, esi
mov ecx, 0x17
call fcn.004607e0
mov eax, edi
mov ecx, 0x17
call fcn.004607e0
nop
nop dword [rax]
call fcn.0045e500
jmp fcn.00527300

Function at 0x529700
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x5297ec
push rbp
mov rbp, rsp
sub rsp, 0x48
movabs rdx, 0x93b208a46edab9f0
mov qword [rsp + 0x36], rdx
movabs rdx, 0x54f693b208a46eda
mov qword [rsp + 0x38], rdx
movabs rdx, 0x9d91699cdd64b46e
mov qword [rsp + 0x40], rdx
movabs rdx, 0x1102070010050a0d
mov qword [rsp + 0x1e], rdx
movabs rdx, 0x10108110410060b
mov qword [rsp + 0x26], rdx
movabs rdx, 0xa0e040911040707
mov qword [rsp + 0x2e], rdx
xor eax, eax
jmp 0x52978a
movzx r9d, byte [rsp + rsi + 0x36]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x55]
mov byte [rsp + rdi + 0x36], dl
mov byte [rsp + rsi + 0x36], r8b
add rax, 2
cmp rax, 0x18
jge 0x5297bc
movzx edx, byte [rsp + rax + 0x1e]
movzx esi, byte [rsp + rax + 0x1f]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x12
jae 0x5297df
movzx r8d, byte [rsp + rdi + 0x36]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x55]
cmp rsi, 0x12
jb 0x529770
jmp 0x5297d3
xor eax, eax
lea rbx, [rsp + 0x36]
mov ecx, 0x12
call fcn.0045b080
add rsp, 0x48
pop rbp
ret
mov eax, esi
mov ecx, 0x12
call fcn.004607e0
mov eax, edi
mov ecx, 0x12
call fcn.004607e0
nop
call fcn.0045e500
jmp fcn.00529700
Function at 0x52b040
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x52b15d
push rbp
mov rbp, rsp
sub rsp, 0x60
movabs rdx, 0xcc41fe2010580059
mov qword [rsp + 0x44], rdx
movabs rdx, 0x14fef510ea610ca7
mov qword [rsp + 0x4c], rdx
movabs rdx, 0x728615714fef510
mov qword [rsp + 0x50], rdx
movabs rdx, 0xd90c5c0de564c961
mov qword [rsp + 0x58], rdx
movabs rdx, 0xe0818020d0b0e06
mov qword [rsp + 0x1c], rdx
movabs rdx, 0x17181a0c17000705
mov qword [rsp + 0x24], rdx
movabs rdx, 0x8090f191b031910
mov qword [rsp + 0x2c], rdx
movabs rdx, 0xf01181009120e1a
mov qword [rsp + 0x34], rdx
movabs rdx, 0x151718121313120e
mov qword [rsp + 0x3c], rdx
xor eax, eax
jmp 0x52b100
movzx r9d, byte [rsp + rsi + 0x44]
sub r9d, edx
lea edx, [r9 + 0x7f]
mov byte [rsp + rdi + 0x44], dl
lea edx, [r8 + 0x7f]
mov byte [rsp + rsi + 0x44], dl
add rax, 2
nop word [rax + rax]
cmp rax, 0x28
jge 0x52b12d
movzx edx, byte [rsp + rax + 0x1c]
movzx esi, byte [rsp + rax + 0x1d]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x1c
jae 0x52b150
movzx r8d, byte [rsp + rdi + 0x44]
sub r8d, edx
cmp rsi, 0x1c
jb 0x52b0dd
jmp 0x52b144
xor eax, eax
lea rbx, [rsp + 0x44]
mov ecx, 0x1c
call fcn.0045b080
add rsp, 0x60
pop rbp
ret
mov eax, esi
mov ecx, 0x1c
call fcn.004607e0
mov eax, edi
mov ecx, 0x1c
call fcn.004607e0
nop
nop dword [rax]
call fcn.0045e500
jmp fcn.0052b040

Function at 0x52b180
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x52b288
push rbp
mov rbp, rsp
sub rsp, 0x50
movabs rdx, 0x79c373f64120eb48
mov qword [rsp + 0x36], rdx
movabs rdx, 0xfa74b7bcb473b7cc
mov qword [rsp + 0x3e], rdx
movabs rdx, 0x14b1fa74b7bcb473
mov qword [rsp + 0x40], rdx
movabs rdx, 0x87a0ce12cb64bb61
mov qword [rsp + 0x48], rdx
movabs rdx, 0x1090918110d0f00
mov qword [rsp + 0x18], rdx
movabs rdx, 0x1910190108130004
mov qword [rsp + 0x20], rdx
movabs rdx, 0x170607150f161910
mov qword [rsp + 0x26], rdx
movabs rdx, 0xd090f0b0a0c0016
mov qword [rsp + 0x2e], rdx
xor eax, eax
jmp 0x52b22b
movzx r9d, byte [rsp + rsi + 0x36]
sub r9d, edx
lea edx, [r9 - 0x35]
mov byte [rsp + rdi + 0x36], dl
lea edx, [r8 - 0x35]
mov byte [rsp + rsi + 0x36], dl
add rax, 2
cmp rax, 0x1e
jge 0x52b258
movzx edx, byte [rsp + rax + 0x18]
movzx esi, byte [rsp + rax + 0x19]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x1a
jae 0x52b27b
movzx r8d, byte [rsp + rdi + 0x36]
sub r8d, edx
cmp rsi, 0x1a
jb 0x52b20e
jmp 0x52b26f
xor eax, eax
lea rbx, [rsp + 0x36]
mov ecx, 0x1a
call fcn.0045b080
add rsp, 0x50
pop rbp
ret
mov eax, esi
mov ecx, 0x1a
call fcn.004607e0
mov eax, edi
mov ecx, 0x1a
call fcn.004607e0
nop
call fcn.0045e500
jmp fcn.0052b180
Function at 0x52b2a0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x52b3ac
push rbp
mov rbp, rsp
sub rsp, 0x58
movabs rdx, 0x576e0743e3fb7541
mov qword [rsp + 0x3c], rdx
movabs rdx, 0xaa0dfa2af01e6172
mov qword [rsp + 0x44], rdx
movabs rdx, 0x5050d826aa0dfa2a
mov qword [rsp + 0x48], rdx
movabs rdx, 0x656d3b3620f44e5f
mov qword [rsp + 0x50], rdx
movabs rdx, 0x14151307100f0705
mov qword [rsp + 0x1e], rdx
movabs rdx, 0x110c1002110b160e
mov qword [rsp + 0x26], rdx
movabs rdx, 0xd0b02031003110c
mov qword [rsp + 0x2c], rdx
movabs rdx, 0x19121316180a1210
mov qword [rsp + 0x34], rdx
xor eax, eax
jmp 0x52b348
movzx r9d, byte [rsp + rsi + 0x3c]
lea edx, [r9 + rdx]
lea edx, [rdx + 0xc]
mov byte [rsp + rdi + 0x3c], dl
mov byte [rsp + rsi + 0x3c], r8b
add rax, 2
cmp rax, 0x1e
jge 0x52b37c
movzx edx, byte [rsp + rax + 0x1e]
movzx esi, byte [rsp + rax + 0x1f]
mov edi, edx
xor edx, esi
add edx, eax
nop
cmp rdi, 0x1c
jae 0x52b39f
movzx r8d, byte [rsp + rdi + 0x3c]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0xc]
cmp rsi, 0x1c
jb 0x52b32e
jmp 0x52b393
xor eax, eax
lea rbx, [rsp + 0x3c]
mov ecx, 0x1c
call fcn.0045b080
add rsp, 0x58
pop rbp
ret
mov eax, esi
mov ecx, 0x1c
call fcn.004607e0
mov eax, edi
mov ecx, 0x1c
call fcn.004607e0
nop
call fcn.0045e500
jmp fcn.0052b2a0

Function at 0x52cc60
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x52cd4c
push rbp
mov rbp, rsp
sub rsp, 0x40
movabs rdx, 0xf12436532042f4bc
mov qword [rsp + 0x2f], rdx
movabs rdx, 0xeff12436532042f4
mov qword [rsp + 0x30], rdx
movabs rdx, 0xd72b694220643e33
mov qword [rsp + 0x38], rdx
movabs rdx, 0x60907060f100010
mov qword [rsp + 0x1b], rdx
movabs rdx, 0xa07080506090706
mov qword [rsp + 0x1f], rdx
movabs rdx, 0x9050f0d010f0005
mov qword [rsp + 0x27], rdx
xor eax, eax
jmp 0x52ccea
movzx r9d, byte [rsp + rsi + 0x2f]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x19]
mov byte [rsp + rdi + 0x2f], dl
mov byte [rsp + rsi + 0x2f], r8b
add rax, 2
cmp rax, 0x14
jge 0x52cd1c
movzx edx, byte [rsp + rax + 0x1b]
movzx esi, byte [rsp + rax + 0x1c]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x11
jae 0x52cd3f
movzx r8d, byte [rsp + rdi + 0x2f]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x19]
cmp rsi, 0x11
jb 0x52ccd0
jmp 0x52cd33
xor eax, eax
lea rbx, [rsp + 0x2f]
mov ecx, 0x11
call fcn.0045b080
add rsp, 0x40
pop rbp
ret
mov eax, esi
mov ecx, 0x11
call fcn.004607e0
mov eax, edi
mov ecx, 0x11
call fcn.004607e0
nop
call fcn.0045e500
jmp fcn.0052cc60
Function at 0x52cd60
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x52ce7d
push rbp
mov rbp, rsp
sub rsp, 0x58
movabs rdx, 0x206c60697453f2e4
mov qword [rsp + 0x3c], rdx
movabs rdx, 0x53456970597245dc
mov qword [rsp + 0x44], rdx
movabs rdx, 0xc6d061ea53456970
mov qword [rsp + 0x48], rdx
movabs rdx, 0x65dceb005564b268
mov qword [rsp + 0x50], rdx
movabs rdx, 0x91000150512190b
mov qword [rsp + 0x18], rdx
movabs rdx, 0x10120b0e09100015
mov qword [rsp + 0x1c], rdx
movabs rdx, 0x1710081302080b14
mov qword [rsp + 0x24], rdx
movabs rdx, 0x150101040d01011a
mov qword [rsp + 0x2c], rdx
movabs rdx, 0xb010d1810191804
mov qword [rsp + 0x34], rdx
xor eax, eax
jmp 0x52ce20
movzx r9d, byte [rsp + rsi + 0x3c]
sub r9d, edx
lea edx, [r9 - 0x56]
mov byte [rsp + rdi + 0x3c], dl
lea edx, [r8 - 0x56]
mov byte [rsp + rsi + 0x3c], dl
add rax, 2
nop word [rax + rax]
cmp rax, 0x24
jge 0x52ce4d
movzx edx, byte [rsp + rax + 0x18]
movzx esi, byte [rsp + rax + 0x19]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x1c
jae 0x52ce70
movzx r8d, byte [rsp + rdi + 0x3c]
sub r8d, edx
cmp rsi, 0x1c
jb 0x52cdfd
jmp 0x52ce64
xor eax, eax
lea rbx, [rsp + 0x3c]
mov ecx, 0x1c
call fcn.0045b080
add rsp, 0x58
pop rbp
ret
mov eax, esi
mov ecx, 0x1c
call fcn.004607e0
mov eax, edi
mov ecx, 0x1c
call fcn.004607e0
nop
nop dword [rax]
call fcn.0045e500
jmp fcn.0052cd60

Function at 0x530000
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x53011a
push rbp
mov rbp, rsp
sub rsp, 0x58
movabs rdx, 0x20bf65ec2d37cc97
mov qword [rsp + 0x3f], rdx
movabs rdx, 0x25333a402083dac2
mov qword [rsp + 0x47], rdx
movabs rdx, 0x2f25333a402083da
mov qword [rsp + 0x48], rdx
movabs rdx, 0x8d6d2254207c72ea
mov qword [rsp + 0x50], rdx
movabs rdx, 0x13080311100f0a0c
mov qword [rsp + 0x1d], rdx
movabs rdx, 0x41613080311100f
mov qword [rsp + 0x1f], rdx
movabs rdx, 0x20d08071601070c
mov qword [rsp + 0x27], rdx
movabs rdx, 0x160800090618070e
mov qword [rsp + 0x2f], rdx
movabs rdx, 0x6030e1813000e09
mov qword [rsp + 0x37], rdx
xor eax, eax
jmp 0x5300b7
movzx r9d, byte [rsp + rsi + 0x3f]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x1e]
mov byte [rsp + rdi + 0x3f], dl
mov byte [rsp + rsi + 0x3f], r8b
add rax, 2
cmp rax, 0x22
jge 0x5300e9
movzx edx, byte [rsp + rax + 0x1d]
movzx esi, byte [rsp + rax + 0x1e]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x19
jae 0x53010d
movzx r8d, byte [rsp + rdi + 0x3f]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x1e]
cmp rsi, 0x19
jb 0x53009d
jmp 0x530101
xor eax, eax
lea rbx, [rsp + 0x3f]
mov ecx, 0x19
call fcn.0045b080
add rsp, 0x58
pop rbp
nop
ret
mov eax, esi
mov ecx, 0x19
call fcn.004607e0
mov eax, edi
mov ecx, 0x19
call fcn.004607e0
nop
call fcn.0045e500
nop
jmp fcn.00530000
Function at 0x530140
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x53025a
push rbp
mov rbp, rsp
sub rsp, 0x58
movabs rdx, 0x766e690c71750894
mov qword [rsp + 0x3e], rdx
movabs rdx, 0x6103531bfccf7e1f
mov qword [rsp + 0x46], rdx
movabs rdx, 0x5c976103531bfccf
mov qword [rsp + 0x48], rdx
movabs rdx, 0xf66d6522c4648927
mov qword [rsp + 0x50], rdx
movabs rdx, 0x1116000117100313
mov qword [rsp + 0x1a], rdx
movabs rdx, 0x1203121711160001
mov qword [rsp + 0x1e], rdx
movabs rdx, 0x801150115130109
mov qword [rsp + 0x26], rdx
movabs rdx, 0x19160e100c0a0810
mov qword [rsp + 0x2e], rdx
movabs rdx, 0xb19090912130408
mov qword [rsp + 0x36], rdx
xor eax, eax
jmp 0x5301f7
movzx r9d, byte [rsp + rsi + 0x3e]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x35]
mov byte [rsp + rdi + 0x3e], dl
mov byte [rsp + rsi + 0x3e], r8b
add rax, 2
cmp rax, 0x24
jge 0x530229
movzx edx, byte [rsp + rax + 0x1a]
movzx esi, byte [rsp + rax + 0x1b]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x1a
jae 0x53024d
movzx r8d, byte [rsp + rdi + 0x3e]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x35]
cmp rsi, 0x1a
jb 0x5301dd
jmp 0x530241
xor eax, eax
lea rbx, [rsp + 0x3e]
mov ecx, 0x1a
call fcn.0045b080
add rsp, 0x58
pop rbp
nop
ret
mov eax, esi
mov ecx, 0x1a
call fcn.004607e0
mov eax, edi
mov ecx, 0x1a
call fcn.004607e0
nop
call fcn.0045e500
nop
jmp fcn.00530140

Function at 0x530700
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x5307fd
push rbp
mov rbp, rsp
sub rsp, 0x48
movabs rdx, 0x61d853f669292bd1
mov qword [rsp + 0x36], rdx
movabs rdx, 0x92dd61d853f66929
mov qword [rsp + 0x38], rdx
movabs rdx, 0xb72b69e1d464e3bd
mov qword [rsp + 0x40], rdx
movabs rdx, 0xb01090900061106
mov qword [rsp + 0x1c], rdx
movabs rdx, 0x6080e0d0a060804
mov qword [rsp + 0x24], rdx
movabs rdx, 0x100e06080e0d0a06
mov qword [rsp + 0x26], rdx
movabs rdx, 0x90d081001020811
mov qword [rsp + 0x2e], rdx
xor eax, eax
jmp 0x5307a0
movzx r9d, byte [rsp + rsi + 0x36]
sub r9d, edx
lea edx, [r9 + 0x57]
mov byte [rsp + rdi + 0x36], dl
lea edx, [r8 + 0x57]
mov byte [rsp + rsi + 0x36], dl
add rax, 2
nop dword [rax]
cmp rax, 0x1a
jge 0x5307cd
movzx edx, byte [rsp + rax + 0x1c]
movzx esi, byte [rsp + rax + 0x1d]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x12
jae 0x5307f0
movzx r8d, byte [rsp + rdi + 0x36]
sub r8d, edx
cmp rsi, 0x12
jb 0x53077f
jmp 0x5307e4
xor eax, eax
lea rbx, [rsp + 0x36]
mov ecx, 0x12
call fcn.0045b080
add rsp, 0x48
pop rbp
ret
mov eax, esi
mov ecx, 0x12
call fcn.004607e0
mov eax, edi
mov ecx, 0x12
call fcn.004607e0
nop
nop dword [rax]
call fcn.0045e500
jmp fcn.00530700
Function at 0x539f60
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x53a00c
push rbp
mov rbp, rsp
sub rsp, 0x40
mov byte [rsp + 0x60], cl
mov byte [rsp + 0x61], dil
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], rbx
mov qword [rsp], rax
mov qword [rsp + 8], rbx
mov byte [rsp + 0x10], cl
call fcn.00403180
xorps xmm15, xmm15
mov r14, qword [0x006c7ac0]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x18], 0xffffffffffffffff
je 0x539fd3
lea rax, [rsp + 0x20]
mov rbx, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x58]
call fcn.00445060
movzx edx, byte [rsp + 0x61]
movzx esi, byte [rsp + 0x60]
xor ecx, ecx
jmp 0x539fe6
mov rax, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x58]
add rsp, 0x40
pop rbp
ret
inc rcx
cmp rbx, rcx
jle 0x539ff9
movzx edi, byte [rax + rcx]
cmp dil, sil
jne 0x539fe3
mov byte [rax + rcx], dl
jmp 0x539fe3
mov rcx, rbx
mov rbx, rax
xor eax, eax
call fcn.0045b080
add rsp, 0x40
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov byte [rsp + 0x18], cl
mov byte [rsp + 0x19], dil
nop
call fcn.0045e500
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
movzx ecx, byte [rsp + 0x18]
movzx edi, byte [rsp + 0x19]
jmp fcn.00539f60

Function at 0x540940
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x540a0c
push rbp
mov rbp, rsp
sub rsp, 0x38
movabs rdx, 0x8f7298746eeff299
mov qword [rsp + 0x29], rdx
movabs rdx, 0x6e0305ff0e64618f
mov qword [rsp + 0x30], rdx
movabs rdx, 0x40b050d000207
mov qword [rsp + 0x19], rdx
movabs rdx, 0xa01020d0c0b0004
mov qword [rsp + 0x21], rdx
xor eax, eax
jmp 0x5409af
movzx r9d, byte [rsp + rsi + 0x29]
sub r9d, edx
lea edx, [r9 + 0x7b]
mov byte [rsp + rdi + 0x29], dl
lea edx, [r8 + 0x7b]
mov byte [rsp + rsi + 0x29], dl
add rax, 2
cmp rax, 0x10
jge 0x5409dc
movzx edx, byte [rsp + rax + 0x19]
movzx esi, byte [rsp + rax + 0x1a]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0xf
jae 0x5409ff
movzx r8d, byte [rsp + rdi + 0x29]
sub r8d, edx
cmp rsi, 0xf
jb 0x540992
jmp 0x5409f3
xor eax, eax
lea rbx, [rsp + 0x29]
mov ecx, 0xf
call fcn.0045b080
add rsp, 0x38
pop rbp
ret
mov eax, esi
mov ecx, 0xf
call fcn.004607e0
mov eax, edi
mov ecx, 0xf
call fcn.004607e0
nop
call fcn.0045e500
jmp fcn.00540940