joyce8/EMBER2024-capa huggingface dataset:
Function at 0x58eb60
Capabilities:
Encrypt data using rc4 prga

Disassembly:
sub rsp, 0x38
mov qword [rsp + 0x30], rbp
lea rbp, [rsp + 0x30]
mov qword [rsp + 0x40], 0
movabs rdx, 0xbe2617928c61a836
mov qword [rsp + 0x1c], rdx
movabs rdx, 0x306040404020302
mov qword [rsp + 0x24], rdx
mov dword [rsp + 0x2c], 0x5000005
xor eax, eax
nop
jmp 0x58ebc0
movzx r8d, byte [rsp + rbx + 0x1c]
add r8d, 0xffffffb3
add edx, r8d
mov byte [rsp + rsi + 0x1c], dl
mov byte [rsp + rbx + 0x1c], dil
add rax, 2
nop dword [rax]
cmp rax, 0xc
jge 0x58ebee
movzx edx, byte [rsp + rax + 0x24]
movzx ebx, byte [rsp + rax + 0x25]
mov esi, edx
xor edx, ebx
add edx, eax
cmp rsi, 8
jae 0x58ec2d
movzx edi, byte [rsp + rsi + 0x1c]
add edi, 0xffffffb3
add edi, edx
cmp rbx, 8
jb 0x58eba2
jmp 0x58ec21
mov qword [rsp + 0x14], 0
xor eax, eax
jmp 0x58ec07
movzx ecx, byte [rsp + rax + 0x1c]
mov byte [rsp + rax + 0x14], cl
inc rax
cmp rax, 8
jl 0x58ebfb
mov rax, qword [rsp + 0x14]
mov qword [rsp + 0x40], rax
mov rbp, qword [rsp + 0x30]
add rsp, 0x38
ret
mov eax, ebx
mov ecx, 8
call fcn.00457420
mov eax, esi
mov ecx, 8
call fcn.00457420
nop
int3

Function at 0x58ec40
Capabilities:
Encrypt data using rc4 prga

Disassembly:
sub rsp, 0x38
mov qword [rsp + 0x30], rbp
lea rbp, [rsp + 0x30]
mov qword [rsp + 0x40], 0
movabs rdx, 0x1788cc798a1cdc80
mov qword [rsp + 0x1c], rdx
movabs rdx, 0x2020604050401
mov qword [rsp + 0x24], rdx
mov dword [rsp + 0x2c], 0x3010205
xor eax, eax
nop
jmp 0x58eca0
movzx r8d, byte [rsp + rbx + 0x1c]
add r8d, 0xfffffffa
add edx, r8d
mov byte [rsp + rsi + 0x1c], dl
mov byte [rsp + rbx + 0x1c], dil
add rax, 2
nop dword [rax]
cmp rax, 0xc
jge 0x58ecce
movzx edx, byte [rsp + rax + 0x24]
movzx ebx, byte [rsp + rax + 0x25]
mov esi, edx
xor edx, ebx
add edx, eax
cmp rsi, 8
jae 0x58ed0d
movzx edi, byte [rsp + rsi + 0x1c]
add edi, 0xfffffffa
add edi, edx
cmp rbx, 8
jb 0x58ec82
jmp 0x58ed01
mov qword [rsp + 0x14], 0
xor eax, eax
jmp 0x58ece7
movzx ecx, byte [rsp + rax + 0x1c]
mov byte [rsp + rax + 0x14], cl
inc rax
cmp rax, 8
jl 0x58ecdb
mov rax, qword [rsp + 0x14]
mov qword [rsp + 0x40], rax
mov rbp, qword [rsp + 0x30]
add rsp, 0x38
ret
mov eax, ebx
mov ecx, 8
call fcn.00457420
mov eax, esi
mov ecx, 8
call fcn.00457420
nop
int3
Function at 0x58ee60
Capabilities:
Encrypt data using rc4 prga

Disassembly:
sub rsp, 0x30
mov qword [rsp + 0x28], rbp
lea rbp, [rsp + 0x28]
mov qword [rsp + 0x38], 0
movabs rdx, 0x2ec7500545816db2
mov qword [rsp + 0x20], rdx
movabs rdx, 0x204040505010702
mov qword [rsp + 0x10], rdx
xor eax, eax
jmp 0x58eeb2
movzx r8d, byte [rsp + rbx + 0x20]
dec r8d
add edx, r8d
mov byte [rsp + rsi + 0x20], dl
mov byte [rsp + rbx + 0x20], dil
add rax, 2
cmp rax, 8
jge 0x58eedf
movzx edx, byte [rsp + rax + 0x10]
movzx ebx, byte [rsp + rax + 0x11]
mov esi, edx
xor edx, ebx
add edx, eax
cmp rsi, 8
jae 0x58ef1e
movzx edi, byte [rsp + rsi + 0x20]
dec edi
add edi, edx
cmp rbx, 8
jb 0x58ee99
jmp 0x58ef12
mov qword [rsp + 0x18], 0
xor eax, eax
jmp 0x58eef8
movzx ecx, byte [rsp + rax + 0x20]
mov byte [rsp + rax + 0x18], cl
inc rax
cmp rax, 8
jl 0x58eeec
mov rax, qword [rsp + 0x18]
mov qword [rsp + 0x38], rax
mov rbp, qword [rsp + 0x28]
add rsp, 0x30
ret
mov eax, ebx
mov ecx, 8
call fcn.00457420
mov eax, esi
mov ecx, 8
call fcn.00457420
nop
int3

Function at 0x5907e0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
sub rsp, 0x30
mov qword [rsp + 0x28], rbp
lea rbp, [rsp + 0x28]
mov qword [rsp + 0x38], 0
movabs rdx, 0x9e5956987ed7f8ec
mov qword [rsp + 0x20], rdx
movabs rdx, 0x501030607050005
mov qword [rsp + 0x10], rdx
xor eax, eax
jmp 0x590835
movzx r8d, byte [rsp + rbx + 0x20]
sub r8d, edx
lea edx, [r8 + 0x63]
mov byte [rsp + rsi + 0x20], dl
lea edx, [rdi + 0x63]
mov byte [rsp + rbx + 0x20], dl
add rax, 2
cmp rax, 8
jge 0x590862
movzx edx, byte [rsp + rax + 0x10]
movzx ebx, byte [rsp + rax + 0x11]
mov esi, edx
xor edx, ebx
add edx, eax
cmp rsi, 8
jae 0x5908a6
movzx edi, byte [rsp + rsi + 0x20]
sub edi, edx
cmp rbx, 8
jb 0x590819
nop
jmp 0x59089a
mov qword [rsp + 0x18], 0
xor eax, eax
jmp 0x590880
movzx ecx, byte [rsp + rax + 0x20]
mov byte [rsp + rax + 0x18], cl
inc rax
nop dword [rax + rax]
cmp rax, 8
jl 0x59086f
mov rax, qword [rsp + 0x18]
mov qword [rsp + 0x38], rax
mov rbp, qword [rsp + 0x28]
add rsp, 0x30
ret
mov eax, ebx
mov ecx, 8
call fcn.00457420
mov eax, esi
mov ecx, 8
call fcn.00457420
nop
int3
Function at 0x5909a0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
sub rsp, 0x38
mov qword [rsp + 0x30], rbp
lea rbp, [rsp + 0x30]
mov qword [rsp + 0x40], 0
movabs rdx, 0x8eb51f1d80e8f096
mov qword [rsp + 0x1e], rdx
movabs rdx, 0x103040707020402
mov qword [rsp + 0x26], rdx
mov word [rsp + 0x2e], 0x304
xor eax, eax
nop
jmp 0x590a00
movzx r8d, byte [rsp + rbx + 0x1e]
sub r8d, edx
lea edx, [r8 - 0x1e]
mov byte [rsp + rsi + 0x1e], dl
lea edx, [rdi - 0x1e]
mov byte [rsp + rbx + 0x1e], dl
add rax, 2
nop
cmp rax, 0xa
jge 0x590a2b
movzx edx, byte [rsp + rax + 0x26]
movzx ebx, byte [rsp + rax + 0x27]
mov esi, edx
xor edx, ebx
add edx, eax
cmp rsi, 8
jae 0x590a6a
movzx edi, byte [rsp + rsi + 0x1e]
sub edi, edx
cmp rbx, 8
jb 0x5909e2
jmp 0x590a5e
mov qword [rsp + 0x16], 0
xor eax, eax
jmp 0x590a44
movzx ecx, byte [rsp + rax + 0x1e]
mov byte [rsp + rax + 0x16], cl
inc rax
cmp rax, 8
jl 0x590a38
mov rax, qword [rsp + 0x16]
mov qword [rsp + 0x40], rax
mov rbp, qword [rsp + 0x30]
add rsp, 0x38
ret
mov eax, ebx
mov ecx, 8
call fcn.00457420
mov eax, esi
mov ecx, 8
call fcn.00457420
nop
int3

Function at 0x590de0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
sub rsp, 0x38
mov qword [rsp + 0x30], rbp
lea rbp, [rsp + 0x30]
mov qword [rsp + 0x40], 0
movabs rdx, 0x16a7437532c5e87e
mov qword [rsp + 0x1e], rdx
movabs rdx, 0x104010101070007
mov qword [rsp + 0x26], rdx
mov word [rsp + 0x2e], 0x207
xor eax, eax
nop
jmp 0x590e40
movzx r8d, byte [rsp + rbx + 0x1e]
sub r8d, edx
lea edx, [r8 - 0x51]
mov byte [rsp + rsi + 0x1e], dl
lea edx, [rdi - 0x51]
mov byte [rsp + rbx + 0x1e], dl
add rax, 2
nop
cmp rax, 0xa
jge 0x590e6b
movzx edx, byte [rsp + rax + 0x26]
movzx ebx, byte [rsp + rax + 0x27]
mov esi, edx
xor edx, ebx
add edx, eax
cmp rsi, 8
jae 0x590eaa
movzx edi, byte [rsp + rsi + 0x1e]
sub edi, edx
cmp rbx, 8
jb 0x590e22
jmp 0x590e9e
mov qword [rsp + 0x16], 0
xor eax, eax
jmp 0x590e84
movzx ecx, byte [rsp + rax + 0x1e]
mov byte [rsp + rax + 0x16], cl
inc rax
cmp rax, 8
jl 0x590e78
mov rax, qword [rsp + 0x16]
mov qword [rsp + 0x40], rax
mov rbp, qword [rsp + 0x30]
add rsp, 0x38
ret
mov eax, ebx
mov ecx, 8
call fcn.00457420
mov eax, esi
mov ecx, 8
call fcn.00457420
nop
int3
Function at 0x591140
Capabilities:
Encrypt data using rc4 prga

Disassembly:
sub rsp, 0x30
mov qword [rsp + 0x28], rbp
lea rbp, [rsp + 0x28]
mov qword [rsp + 0x38], 0
movabs rdx, 0x224ba313f47fcf7b
mov qword [rsp + 0x20], rdx
movabs rdx, 0x401010001060401
mov qword [rsp + 0x10], rdx
xor eax, eax
jmp 0x591195
movzx r8d, byte [rsp + rbx + 0x20]
sub r8d, edx
lea edx, [r8 - 0x3f]
mov byte [rsp + rsi + 0x20], dl
lea edx, [rdi - 0x3f]
mov byte [rsp + rbx + 0x20], dl
add rax, 2
cmp rax, 8
jge 0x5911c2
movzx edx, byte [rsp + rax + 0x10]
movzx ebx, byte [rsp + rax + 0x11]
mov esi, edx
xor edx, ebx
add edx, eax
cmp rsi, 8
jae 0x591206
movzx edi, byte [rsp + rsi + 0x20]
sub edi, edx
cmp rbx, 8
jb 0x591179
nop
jmp 0x5911fa
mov qword [rsp + 0x18], 0
xor eax, eax
jmp 0x5911e0
movzx ecx, byte [rsp + rax + 0x20]
mov byte [rsp + rax + 0x18], cl
inc rax
nop dword [rax + rax]
cmp rax, 8
jl 0x5911cf
mov rax, qword [rsp + 0x18]
mov qword [rsp + 0x38], rax
mov rbp, qword [rsp + 0x28]
add rsp, 0x30
ret
mov eax, ebx
mov ecx, 8
call fcn.00457420
mov eax, esi
mov ecx, 8
call fcn.00457420
nop
int3

Function at 0x591580
Capabilities:
Encrypt data using rc4 prga

Disassembly:
sub rsp, 0x38
mov qword [rsp + 0x30], rbp
lea rbp, [rsp + 0x30]
mov qword [rsp + 0x40], 0
movabs rdx, 0x61fe7efc221fcb5d
mov qword [rsp + 0x1c], rdx
movabs rdx, 0x205070705010606
mov qword [rsp + 0x24], rdx
mov dword [rsp + 0x2c], 0x200
xor eax, eax
nop
jmp 0x5915e0
movzx r8d, byte [rsp + rbx + 0x1c]
sub r8d, edx
lea edx, [r8 - 7]
mov byte [rsp + rsi + 0x1c], dl
lea edx, [rdi - 7]
mov byte [rsp + rbx + 0x1c], dl
add rax, 2
nop
cmp rax, 0xc
jge 0x59160b
movzx edx, byte [rsp + rax + 0x24]
movzx ebx, byte [rsp + rax + 0x25]
mov esi, edx
xor edx, ebx
add edx, eax
cmp rsi, 8
jae 0x59164a
movzx edi, byte [rsp + rsi + 0x1c]
sub edi, edx
cmp rbx, 8
jb 0x5915c2
jmp 0x59163e
mov qword [rsp + 0x14], 0
xor eax, eax
jmp 0x591624
movzx ecx, byte [rsp + rax + 0x1c]
mov byte [rsp + rax + 0x14], cl
inc rax
cmp rax, 8
jl 0x591618
mov rax, qword [rsp + 0x14]
mov qword [rsp + 0x40], rax
mov rbp, qword [rsp + 0x30]
add rsp, 0x38
ret
mov eax, ebx
mov ecx, 8
call fcn.00457420
mov eax, esi
mov ecx, 8
call fcn.00457420
nop
int3
Function at 0x592880
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x592966
sub rsp, 0x40
mov qword [rsp + 0x38], rbp
lea rbp, [rsp + 0x38]
movabs rdx, 0x96f469a567ccf3a2
mov qword [rsp + 0x1a], rdx
mov dword [rsp + 0x22], 0x9790aa93
movabs rdx, 0x8060a080602010a
mov qword [rsp + 0x26], rdx
movabs rdx, 0x40208060a080602
mov qword [rsp + 0x28], rdx
movabs rdx, 0x307080609040b00
mov qword [rsp + 0x30], rdx
xor eax, eax
nop
jmp 0x592900
movzx r9d, byte [rsp + rsi + 0x1a]
sub r9d, edx
lea edx, [r9 - 0x21]
mov byte [rsp + rdi + 0x1a], dl
lea edx, [r8 - 0x21]
mov byte [rsp + rsi + 0x1a], dl
add rax, 2
nop
cmp rax, 0x12
jge 0x59292d
movzx edx, byte [rsp + rax + 0x26]
movzx esi, byte [rsp + rax + 0x27]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0xc
jae 0x592954
movzx r8d, byte [rsp + rdi + 0x1a]
sub r8d, edx
cmp rsi, 0xc
jb 0x5928e2
jmp 0x592948
xor eax, eax
lea rbx, [rsp + 0x1a]
mov ecx, 0xc
call fcn.004446e0
mov rbp, qword [rsp + 0x38]
add rsp, 0x40
ret
mov eax, esi
mov ecx, 0xc
call fcn.00457420
mov eax, edi
mov ecx, 0xc
nop dword [rax + rax]
call fcn.00457420
nop
call fcn.00454dc0
jmp fcn.00592880
Function at 0x597660
Capabilities:
Resolve function by parsing pe exports

Disassembly:
lea r12, [rsp - 0x10]
cmp r12, qword [r14 + 0x10]
jbe 0x5977f2
sub rsp, 0x90
mov qword [rsp + 0x88], rbp
lea rbp, [rsp + 0x88]
movabs rdx, 0x7a57b45d326e3a59
mov qword [rsp + 0x18], rdx
movabs rdx, 0x7691b747a57b45d
mov qword [rsp + 0x1c], rdx
movabs rdx, 0x7435ef7528655323
mov qword [rsp + 0x24], rdx
movabs rdx, 0x70065a3e21325e03
mov qword [rsp + 0x2c], rdx
movabs rdx, 0x45f1251954d66f12
mov qword [rsp + 0x34], rdx
movabs rdx, 0x73652a7072f40438
mov qword [rsp + 0x3c], rdx
movabs rdx, 0x5ea466744d71011a
mov qword [rsp + 0x44], rdx
movabs rdx, 0x32292c29150b032e
mov qword [rsp + 0x4c], rdx
movabs rdx, 0x2328333116051a00
mov qword [rsp + 0x54], rdx
movabs rdx, 0x2f250f0423283331
mov qword [rsp + 0x58], rdx
movabs rdx, 0xb272d042f0c2301
mov qword [rsp + 0x60], rdx
movabs rdx, 0x2f0903171a2e192c
mov qword [rsp + 0x68], rdx
movabs rdx, 0x17221c0920211a06
mov qword [rsp + 0x70], rdx
movabs rdx, 0x1a182c2412071126
mov qword [rsp + 0x78], rdx
movabs rdx, 0x2216291e120b0114
mov qword [rsp + 0x80], rdx
xor eax, eax
jmp 0x597785
movzx r9d, byte [rsp + rdi + 0x18]
xor r9d, esi
mov byte [rsp + rdx + 0x18], r9b
mov byte [rsp + rdi + 0x18], r8b
add rax, 2
cmp rax, 0x3c
jge 0x5977b7
movzx edx, byte [rsp + rax + 0x4c]
movzx esi, byte [rsp + rax + 0x4d]
mov edi, esi
xor esi, edx
lea r8d, [rax + 0x23]
add esi, r8d
cmp rdx, 0x34
jae 0x5977e5
movzx r8d, byte [rsp + rdx + 0x18]
xor r8d, esi
cmp rdi, 0x34
jb 0x59776e
jmp 0x5977d8
xor eax, eax
lea rbx, [rsp + 0x18]
mov ecx, 0x34
call fcn.004446e0
mov rbp, qword [rsp + 0x88]
add rsp, 0x90
ret
mov eax, edi
mov ecx, 0x34
nop
call fcn.00457420
mov eax, edx
mov ecx, 0x34
call fcn.00457420
nop
call fcn.00454dc0
jmp fcn.00597660

Function at 0x5988a0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x598988
sub rsp, 0x48
mov qword [rsp + 0x40], rbp
lea rbp, [rsp + 0x40]
movabs rdx, 0x604b597470797243
mov qword [rsp + 0x1e], rdx
movabs rdx, 0x736f6f696b5e604b
mov qword [rsp + 0x24], rdx
movabs rdx, 0xd0a0b080b090808
mov qword [rsp + 0x2c], rdx
movabs rdx, 0x50b07050d0a0b08
mov qword [rsp + 0x30], rdx
movabs rdx, 0xd070b07070b060b
mov qword [rsp + 0x38], rdx
xor eax, eax
jmp 0x598921
movzx r9d, byte [rsp + rsi + 0x1e]
add r9d, 0xffffffee
add edx, r9d
mov byte [rsp + rdi + 0x1e], dl
mov byte [rsp + rsi + 0x1e], r8b
add rax, 2
cmp rax, 0x14
jge 0x598952
movzx edx, byte [rsp + rax + 0x2c]
movzx esi, byte [rsp + rax + 0x2d]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0xe
jae 0x59897b
movzx r8d, byte [rsp + rdi + 0x1e]
add r8d, 0xffffffee
add r8d, edx
cmp rsi, 0xe
jb 0x598907
jmp 0x59896f
xor eax, eax
lea rbx, [rsp + 0x1e]
mov ecx, 0xe
nop
call fcn.004446e0
mov rbp, qword [rsp + 0x40]
add rsp, 0x48
ret
mov eax, esi
mov ecx, 0xe
call fcn.00457420
mov eax, edi
mov ecx, 0xe
call fcn.00457420
nop
call fcn.00454dc0
jmp fcn.005988a0
Function at 0x598d40
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x598e36
sub rsp, 0x50
mov qword [rsp + 0x48], rbp
lea rbp, [rsp + 0x48]
movabs rdx, 0xa81ff67657265fa
mov qword [rsp + 0x1b], rdx
movabs rdx, 0x209245fb150a81ff
mov qword [rsp + 0x20], rdx
movabs rdx, 0x13711375a9166a6e
mov qword [rsp + 0x28], rdx
movabs rdx, 0xb0b090e07060b06
mov qword [rsp + 0x30], rdx
movabs rdx, 0xf090f1013050706
mov qword [rsp + 0x38], rdx
movabs rdx, 0x708120c06140500
mov qword [rsp + 0x40], rdx
xor eax, eax
jmp 0x598dd3
movzx r9d, byte [rsp + rsi + 0x1b]
sub r9d, edx
lea edx, [r9 - 0x7c]
mov byte [rsp + rdi + 0x1b], dl
lea edx, [r8 - 0x7c]
mov byte [rsp + rsi + 0x1b], dl
add rax, 2
cmp rax, 0x18
jge 0x598e02
movzx edx, byte [rsp + rax + 0x30]
movzx esi, byte [rsp + rax + 0x31]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x15
jae 0x598e29
movzx r8d, byte [rsp + rdi + 0x1b]
sub r8d, edx
cmp rsi, 0x15
jb 0x598db6
nop
jmp 0x598e1d
xor eax, eax
lea rbx, [rsp + 0x1b]
mov ecx, 0x15
call fcn.004446e0
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
mov eax, esi
mov ecx, 0x15
call fcn.00457420
mov eax, edi
mov ecx, 0x15
call fcn.00457420
nop
call fcn.00454dc0
nop dword [rax + rax]
jmp fcn.00598d40

Function at 0x598e60
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x598f4b
sub rsp, 0x48
mov qword [rsp + 0x40], rbp
lea rbp, [rsp + 0x40]
movabs rdx, 0xe3aef690233bb3e
mov qword [rsp + 0x1e], rdx
movabs rdx, 0x78246e652d2915fa
mov qword [rsp + 0x26], rdx
movabs rdx, 0x2050b0a02010505
mov qword [rsp + 0x2e], rdx
movabs rdx, 0x80302050b0a0201
mov qword [rsp + 0x30], rdx
movabs rdx, 0x90e060805030700
mov qword [rsp + 0x38], rdx
xor eax, eax
jmp 0x598ee4
movzx r9d, byte [rsp + rsi + 0x1e]
sub r9d, edx
lea edx, [r9 + 0x47]
mov byte [rsp + rdi + 0x1e], dl
lea edx, [r8 + 0x47]
mov byte [rsp + rsi + 0x1e], dl
add rax, 2
cmp rax, 0x12
jge 0x598f17
movzx edx, byte [rsp + rax + 0x2e]
movzx esi, byte [rsp + rax + 0x2f]
mov edi, edx
xor edx, esi
add edx, eax
nop word [rax + rax]
cmp rdi, 0x10
jae 0x598f3e
movzx r8d, byte [rsp + rdi + 0x1e]
sub r8d, edx
cmp rsi, 0x10
jb 0x598ec7
jmp 0x598f32
xor eax, eax
lea rbx, [rsp + 0x1e]
mov ecx, 0x10
call fcn.004446e0
mov rbp, qword [rsp + 0x40]
add rsp, 0x48
ret
mov eax, esi
mov ecx, 0x10
call fcn.00457420
mov eax, edi
mov ecx, 0x10
call fcn.00457420
nop
call fcn.00454dc0
jmp fcn.00598e60
Function at 0x59a340
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x59a452
sub rsp, 0x58
mov qword [rsp + 0x50], rbp
lea rbp, [rsp + 0x50]
movabs rdx, 0x722b6365da74fe35
mov qword [rsp + 0x18], rdx
movabs rdx, 0xff63dc26c8df7489
mov qword [rsp + 0x20], rdx
movabs rdx, 0xfc69ff63dc26c8df
mov qword [rsp + 0x22], rdx
movabs rdx, 0x726526a44fc842d9
mov qword [rsp + 0x2a], rdx
movabs rdx, 0x61208080b140d16
mov qword [rsp + 0x32], rdx
movabs rdx, 0x170103010a0c080d
mov qword [rsp + 0x3a], rdx
movabs rdx, 0xd13001416161701
mov qword [rsp + 0x40], rdx
movabs rdx, 0x11080f0b0b11060c
mov qword [rsp + 0x48], rdx
xor eax, eax
jmp 0x59a3f1
movzx r9d, byte [rsp + rsi + 0x18]
sub r9d, edx
lea edx, [r9 + 0x63]
mov byte [rsp + rdi + 0x18], dl
lea edx, [r8 + 0x63]
mov byte [rsp + rsi + 0x18], dl
add rax, 2
cmp rax, 0x1e
jge 0x59a41e
movzx edx, byte [rsp + rax + 0x32]
movzx esi, byte [rsp + rax + 0x33]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x1a
jae 0x59a445
movzx r8d, byte [rsp + rdi + 0x18]
sub r8d, edx
cmp rsi, 0x1a
jb 0x59a3d4
jmp 0x59a439
xor eax, eax
lea rbx, [rsp + 0x18]
mov ecx, 0x1a
call fcn.004446e0
mov rbp, qword [rsp + 0x50]
add rsp, 0x58
ret
mov eax, esi
mov ecx, 0x1a
call fcn.00457420
mov eax, edi
mov ecx, 0x1a
call fcn.00457420
nop
call fcn.00454dc0
jmp fcn.0059a340

Function at 0x59a900
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x59aa13
sub rsp, 0x60
mov qword [rsp + 0x58], rbp
lea rbp, [rsp + 0x58]
movabs rdx, 0x725fc76d43745c61
mov qword [rsp + 0x1f], rdx
movabs rdx, 0x5052c7f3f6fa2369
mov qword [rsp + 0x27], rdx
movabs rdx, 0x595052c7f3f6fa23
mov qword [rsp + 0x28], rdx
movabs rdx, 0xba5f6124726fa7cc
mov qword [rsp + 0x30], rdx
movabs rdx, 0x401000e0d0a1017
mov qword [rsp + 0x38], rdx
movabs rdx, 0x1001010f0315060c
mov qword [rsp + 0x40], rdx
movabs rdx, 0x170911040a0b0c0e
mov qword [rsp + 0x48], rdx
movabs rdx, 0x1218151705030b
mov qword [rsp + 0x50], rdx
xor eax, eax
jmp 0x59a9ae
movzx r9d, byte [rsp + rsi + 0x1f]
add r9d, 0x70
add edx, r9d
mov byte [rsp + rdi + 0x1f], dl
mov byte [rsp + rsi + 0x1f], r8b
add rax, 2
cmp rax, 0x20
jge 0x59a9df
movzx edx, byte [rsp + rax + 0x38]
movzx esi, byte [rsp + rax + 0x39]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x19
jae 0x59aa06
movzx r8d, byte [rsp + rdi + 0x1f]
add r8d, 0x70
add r8d, edx
cmp rsi, 0x19
jb 0x59a994
jmp 0x59a9fa
xor eax, eax
lea rbx, [rsp + 0x1f]
mov ecx, 0x19
call fcn.004446e0
mov rbp, qword [rsp + 0x58]
add rsp, 0x60
ret
mov eax, esi
mov ecx, 0x19
call fcn.00457420
mov eax, edi
mov ecx, 0x19
call fcn.00457420
nop
call fcn.00454dc0
jmp fcn.0059a900
Function at 0x59b920
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x59ba08
sub rsp, 0x48
mov qword [rsp + 0x40], rbp
lea rbp, [rsp + 0x40]
movabs rdx, 0x8aac728265707e49
mov qword [rsp + 0x1f], rdx
movabs rdx, 0x666ca4bf9da6618a
mov qword [rsp + 0x26], rdx
movabs rdx, 0x40a060707090c0a
mov qword [rsp + 0x2e], rdx
movabs rdx, 0xa0b040a06070709
mov qword [rsp + 0x30], rdx
movabs rdx, 0x7010c0c05070a05
mov qword [rsp + 0x38], rdx
xor eax, eax
jmp 0x59b9a1
movzx r9d, byte [rsp + rsi + 0x1f]
add r9d, 0xffffffda
add edx, r9d
mov byte [rsp + rdi + 0x1f], dl
mov byte [rsp + rsi + 0x1f], r8b
add rax, 2
cmp rax, 0x12
jge 0x59b9d2
movzx edx, byte [rsp + rax + 0x2e]
movzx esi, byte [rsp + rax + 0x2f]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0xf
jae 0x59b9fb
movzx r8d, byte [rsp + rdi + 0x1f]
add r8d, 0xffffffda
add r8d, edx
cmp rsi, 0xf
jb 0x59b987
jmp 0x59b9ef
xor eax, eax
lea rbx, [rsp + 0x1f]
mov ecx, 0xf
nop
call fcn.004446e0
mov rbp, qword [rsp + 0x40]
add rsp, 0x48
ret
mov eax, esi
mov ecx, 0xf
call fcn.00457420
mov eax, edi
mov ecx, 0xf
call fcn.00457420
nop
call fcn.00454dc0
jmp fcn.0059b920

Function at 0x59ba20
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x59bb32
sub rsp, 0x60
mov qword [rsp + 0x58], rbp
lea rbp, [rsp + 0x58]
movabs rdx, 0x696cb269e369b1c0
mov qword [rsp + 0x1c], rdx
movabs rdx, 0x6972aba16c53ad81
mov qword [rsp + 0x24], rdx
movabs rdx, 0x55c479ac6972aba1
mov qword [rsp + 0x28], rdx
movabs rdx, 0xb0959f7096cb83ba
mov qword [rsp + 0x30], rdx
movabs rdx, 0x108050609161409
mov qword [rsp + 0x38], rdx
movabs rdx, 0x313121615001b
mov qword [rsp + 0x40], rdx
movabs rdx, 0x100d000b000d0619
mov qword [rsp + 0x48], rdx
movabs rdx, 0x91b171408131a0c
mov qword [rsp + 0x50], rdx
xor eax, eax
jmp 0x59bad1
movzx r9d, byte [rsp + rsi + 0x1c]
sub r9d, edx
lea edx, [r9 - 4]
mov byte [rsp + rdi + 0x1c], dl
lea edx, [r8 - 4]
mov byte [rsp + rsi + 0x1c], dl
add rax, 2
cmp rax, 0x20
jge 0x59bafe
movzx edx, byte [rsp + rax + 0x38]
movzx esi, byte [rsp + rax + 0x39]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x1c
jae 0x59bb25
movzx r8d, byte [rsp + rdi + 0x1c]
sub r8d, edx
cmp rsi, 0x1c
jb 0x59bab4
jmp 0x59bb19
xor eax, eax
lea rbx, [rsp + 0x1c]
mov ecx, 0x1c
call fcn.004446e0
mov rbp, qword [rsp + 0x58]
add rsp, 0x60
ret
mov eax, esi
mov ecx, 0x1c
call fcn.00457420
mov eax, edi
mov ecx, 0x1c
call fcn.00457420
nop
call fcn.00454dc0
jmp fcn.0059ba20
Function at 0x59d7c0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x59d8b6
sub rsp, 0x48
mov qword [rsp + 0x40], rbp
lea rbp, [rsp + 0x40]
movabs rdx, 0x722760cd3665ffc9
mov qword [rsp + 0x19], rdx
movabs rdx, 0x969f7722760cd36
mov qword [rsp + 0x1c], rdx
movabs rdx, 0x57d369d46ebb4325
mov qword [rsp + 0x24], rdx
movabs rdx, 0x8010b05050a050a
mov qword [rsp + 0x2c], rdx
movabs rdx, 0x508060d08010b05
mov qword [rsp + 0x30], rdx
movabs rdx, 0xd040001030d0f11
mov qword [rsp + 0x38], rdx
xor eax, eax
jmp 0x59d853
movzx r9d, byte [rsp + rsi + 0x19]
sub r9d, edx
lea edx, [r9 - 0x43]
mov byte [rsp + rdi + 0x19], dl
lea edx, [r8 - 0x43]
mov byte [rsp + rsi + 0x19], dl
add rax, 2
cmp rax, 0x14
jge 0x59d882
movzx edx, byte [rsp + rax + 0x2c]
movzx esi, byte [rsp + rax + 0x2d]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x13
jae 0x59d8a9
movzx r8d, byte [rsp + rdi + 0x19]
sub r8d, edx
cmp rsi, 0x13
jb 0x59d836
nop
jmp 0x59d89d
xor eax, eax
lea rbx, [rsp + 0x19]
mov ecx, 0x13
call fcn.004446e0
mov rbp, qword [rsp + 0x40]
add rsp, 0x48
ret
mov eax, esi
mov ecx, 0x13
call fcn.00457420
mov eax, edi
mov ecx, 0x13
call fcn.00457420
nop
call fcn.00454dc0
nop dword [rax + rax]
jmp fcn.0059d7c0

Function at 0x59e200
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x59e2f6
sub rsp, 0x48
mov qword [rsp + 0x40], rbp
lea rbp, [rsp + 0x40]
movabs rdx, 0x7266533156627568
mov qword [rsp + 0x18], rdx
movabs rdx, 0x6b76726653315662
mov qword [rsp + 0x1a], rdx
movabs rdx, 0x6940775a5b53653a
mov qword [rsp + 0x22], rdx
movabs rdx, 0xf0f0411020a0600
mov qword [rsp + 0x2a], rdx
movabs rdx, 0xe0d101100110f0f
mov qword [rsp + 0x30], rdx
movabs rdx, 0x31102021102090d
mov qword [rsp + 0x38], rdx
xor eax, eax
jmp 0x59e290
movzx r9d, byte [rsp + rsi + 0x18]
add r9d, 0xfffffff7
add edx, r9d
mov byte [rsp + rdi + 0x18], dl
mov byte [rsp + rsi + 0x18], r8b
add rax, 2
cmp rax, 0x16
jge 0x59e2c2
movzx edx, byte [rsp + rax + 0x2a]
movzx esi, byte [rsp + rax + 0x2b]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x12
jae 0x59e2e9
movzx r8d, byte [rsp + rdi + 0x18]
add r8d, 0xfffffff7
add r8d, edx
cmp rsi, 0x12
jb 0x59e276
nop
jmp 0x59e2dd
xor eax, eax
lea rbx, [rsp + 0x18]
mov ecx, 0x12
call fcn.004446e0
mov rbp, qword [rsp + 0x40]
add rsp, 0x48
ret
mov eax, esi
mov ecx, 0x12
call fcn.00457420
mov eax, edi
mov ecx, 0x12
call fcn.00457420
nop
call fcn.00454dc0
nop dword [rax + rax]
jmp fcn.0059e200