joyce8/EMBER2024-capa huggingface dataset:
Function at 0x50e880
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x50e988
push rbp
mov rbp, rsp
sub rsp, 0x58
movabs rdx, 0x73412073808f6f87
mov qword [rsp + 0x3b], rdx
movabs rdx, 0x2074918c452061b6
mov qword [rsp + 0x43], rdx
movabs rdx, 0x6f7fad7472207491
mov qword [rsp + 0x48], rdx
movabs rdx, 0x9d2dbf9cb0c99e64
mov qword [rsp + 0x50], rdx
movabs rdx, 0x141c041208040003
mov qword [rsp + 0x1b], rdx
movabs rdx, 0x1b1813161419120d
mov qword [rsp + 0x23], rdx
movabs rdx, 0x1304140c00121510
mov qword [rsp + 0x2b], rdx
movabs rdx, 0x319021b1702191a
mov qword [rsp + 0x33], rdx
xor eax, eax
jmp 0x50e92b
movzx r9d, byte [rsp + rsi + 0x3b]
sub r9d, edx
lea edx, [r9 + 4]
mov byte [rsp + rdi + 0x3b], dl
lea edx, [r8 + 4]
mov byte [rsp + rsi + 0x3b], dl
add rax, 2
cmp rax, 0x20
jge 0x50e958
movzx edx, byte [rsp + rax + 0x1b]
movzx esi, byte [rsp + rax + 0x1c]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x1d
jae 0x50e97b
movzx r8d, byte [rsp + rdi + 0x3b]
sub r8d, edx
cmp rsi, 0x1d
jb 0x50e90e
jmp 0x50e96f
xor eax, eax
lea rbx, [rsp + 0x3b]
mov ecx, 0x1d
call fcn.00449780
add rsp, 0x58
pop rbp
ret
mov eax, esi
mov ecx, 0x1d
call fcn.0045cd80
mov eax, edi
mov ecx, 0x1d
call fcn.0045cd80
nop
call fcn.0045aaa0
jmp fcn.0050e880

Function at 0x50e9a0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x50eaba
push rbp
mov rbp, rsp
sub rsp, 0x58
movabs rdx, 0x73566e3b683c1f46
mov qword [rsp + 0x3f], rdx
movabs rdx, 0x7d61735357816157
mov qword [rsp + 0x47], rdx
movabs rdx, 0x3f7d617353578161
mov qword [rsp + 0x48], rdx
movabs rdx, 0x6587696ba7877261
mov qword [rsp + 0x50], rdx
movabs rdx, 0xf0b08170f171413
mov qword [rsp + 0x1b], rdx
movabs rdx, 0x141313020f0b0817
mov qword [rsp + 0x1f], rdx
movabs rdx, 0xd05050a06150802
mov qword [rsp + 0x27], rdx
movabs rdx, 0xb010a051704100f
mov qword [rsp + 0x2f], rdx
movabs rdx, 0x410041700000f13
mov qword [rsp + 0x37], rdx
xor eax, eax
jmp 0x50ea57
movzx r9d, byte [rsp + rsi + 0x3f]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x23]
mov byte [rsp + rdi + 0x3f], dl
mov byte [rsp + rsi + 0x3f], r8b
add rax, 2
cmp rax, 0x24
jge 0x50ea89
movzx edx, byte [rsp + rax + 0x1b]
movzx esi, byte [rsp + rax + 0x1c]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x19
jae 0x50eaad
movzx r8d, byte [rsp + rdi + 0x3f]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x23]
cmp rsi, 0x19
jb 0x50ea3d
jmp 0x50eaa1
xor eax, eax
lea rbx, [rsp + 0x3f]
mov ecx, 0x19
call fcn.00449780
add rsp, 0x58
pop rbp
nop
ret
mov eax, esi
mov ecx, 0x19
call fcn.0045cd80
mov eax, edi
mov ecx, 0x19
call fcn.0045cd80
nop
call fcn.0045aaa0
nop
jmp fcn.0050e9a0
Function at 0x5109e0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x510adb
push rbp
mov rbp, rsp
sub rsp, 0x50
movabs rdx, 0xe869e26ceb7a62ec
mov qword [rsp + 0x39], rdx
movabs rdx, 0xed5261b1530561e8
mov qword [rsp + 0x40], rdx
movabs rdx, 0xf7f76a55208376d5
mov qword [rsp + 0x48], rdx
movabs rdx, 0x16011115060d0000
mov qword [rsp + 0x1f], rdx
movabs rdx, 0x100714130d160b09
mov qword [rsp + 0x27], rdx
movabs rdx, 0x703100714130d16
mov qword [rsp + 0x29], rdx
movabs rdx, 0x151506130f140e05
mov qword [rsp + 0x31], rdx
xor eax, eax
jmp 0x510a79
movzx r9d, byte [rsp + rsi + 0x39]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x65]
mov byte [rsp + rdi + 0x39], dl
mov byte [rsp + rsi + 0x39], r8b
add rax, 2
cmp rax, 0x1a
jge 0x510aab
movzx edx, byte [rsp + rax + 0x1f]
movzx esi, byte [rsp + rax + 0x20]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x17
jae 0x510ace
movzx r8d, byte [rsp + rdi + 0x39]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x65]
cmp rsi, 0x17
jb 0x510a5f
jmp 0x510ac2
xor eax, eax
lea rbx, [rsp + 0x39]
mov ecx, 0x17
call fcn.00449780
add rsp, 0x50
pop rbp
ret
mov eax, esi
mov ecx, 0x17
call fcn.0045cd80
mov eax, edi
mov ecx, 0x17
call fcn.0045cd80
nop
nop dword [rax + rax]
call fcn.0045aaa0
jmp fcn.005109e0

Function at 0x510b00
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x510bea
push rbp
mov rbp, rsp
sub rsp, 0x48
movabs rdx, 0x20876f6c6333684d
mov qword [rsp + 0x33], rdx
movabs rdx, 0x647c705d5320876f
mov qword [rsp + 0x38], rdx
movabs rdx, 0x65a08d7d8b9a8480
mov qword [rsp + 0x40], rdx
movabs rdx, 0xa090b130613030f
mov qword [rsp + 0x1d], rdx
movabs rdx, 0xe121103010d0a09
mov qword [rsp + 0x23], rdx
movabs rdx, 0x511020406110210
mov qword [rsp + 0x2b], rdx
xor eax, eax
jmp 0x510b8d
movzx r9d, byte [rsp + rsi + 0x33]
sub r9d, edx
lea edx, [r9 + 0xd]
mov byte [rsp + rdi + 0x33], dl
lea edx, [r8 + 0xd]
mov byte [rsp + rsi + 0x33], dl
add rax, 2
cmp rax, 0x16
jge 0x510bba
movzx edx, byte [rsp + rax + 0x1d]
movzx esi, byte [rsp + rax + 0x1e]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x15
jae 0x510bdd
movzx r8d, byte [rsp + rdi + 0x33]
sub r8d, edx
cmp rsi, 0x15
jb 0x510b70
jmp 0x510bd1
xor eax, eax
lea rbx, [rsp + 0x33]
mov ecx, 0x15
call fcn.00449780
add rsp, 0x48
pop rbp
ret
mov eax, esi
mov ecx, 0x15
call fcn.0045cd80
mov eax, edi
mov ecx, 0x15
call fcn.0045cd80
nop
call fcn.0045aaa0
jmp fcn.00510b00
Function at 0x512020
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x51211d
push rbp
mov rbp, rsp
sub rsp, 0x50
movabs rdx, 0x11b1b16167272d53
mov qword [rsp + 0x39], rdx
movabs rdx, 0xc718ad745320a911
mov qword [rsp + 0x40], rdx
movabs rdx, 0x156d22c820bb27fc
mov qword [rsp + 0x48], rdx
movabs rdx, 0x111130f13010616
mov qword [rsp + 0x1b], rdx
movabs rdx, 0xd0710110f050c08
mov qword [rsp + 0x23], rdx
movabs rdx, 0x206140613130d07
mov qword [rsp + 0x29], rdx
movabs rdx, 0x6110d0e07100507
mov qword [rsp + 0x31], rdx
xor eax, eax
jmp 0x5120c0
movzx r9d, byte [rsp + rsi + 0x39]
sub r9d, edx
lea edx, [r9 - 0x3c]
mov byte [rsp + rdi + 0x39], dl
lea edx, [r8 - 0x3c]
mov byte [rsp + rsi + 0x39], dl
add rax, 2
nop dword [rax]
cmp rax, 0x1e
jge 0x5120ed
movzx edx, byte [rsp + rax + 0x1b]
movzx esi, byte [rsp + rax + 0x1c]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x17
jae 0x512110
movzx r8d, byte [rsp + rdi + 0x39]
sub r8d, edx
cmp rsi, 0x17
jb 0x51209f
jmp 0x512104
xor eax, eax
lea rbx, [rsp + 0x39]
mov ecx, 0x17
call fcn.00449780
add rsp, 0x50
pop rbp
ret
mov eax, esi
mov ecx, 0x17
call fcn.0045cd80
mov eax, edi
mov ecx, 0x17
call fcn.0045cd80
nop
nop dword [rax]
call fcn.0045aaa0
jmp fcn.00512020

Function at 0x515dc0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x515ebd
push rbp
mov rbp, rsp
sub rsp, 0x50
movabs rdx, 0xaa9d94ff65706143
mov qword [rsp + 0x38], rdx
movabs rdx, 0x64d08961c67cb6b8
mov qword [rsp + 0x40], rdx
movabs rdx, 0xd98fb8e2dcb07275
mov qword [rsp + 0x48], rdx
movabs rdx, 0x50d060912160913
mov qword [rsp + 0x18], rdx
movabs rdx, 0x131314150e151613
mov qword [rsp + 0x20], rdx
movabs rdx, 0xa10040c08071716
mov qword [rsp + 0x28], rdx
movabs rdx, 0xc160c10150b1716
mov qword [rsp + 0x30], rdx
xor eax, eax
jmp 0x515e60
movzx r9d, byte [rsp + rsi + 0x38]
sub r9d, edx
lea edx, [r9 - 0x25]
mov byte [rsp + rdi + 0x38], dl
lea edx, [r8 - 0x25]
mov byte [rsp + rsi + 0x38], dl
add rax, 2
nop dword [rax]
cmp rax, 0x20
jge 0x515e8d
movzx edx, byte [rsp + rax + 0x18]
movzx esi, byte [rsp + rax + 0x19]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x18
jae 0x515eb0
movzx r8d, byte [rsp + rdi + 0x38]
sub r8d, edx
cmp rsi, 0x18
jb 0x515e3f
jmp 0x515ea4
xor eax, eax
lea rbx, [rsp + 0x38]
mov ecx, 0x18
call fcn.00449780
add rsp, 0x50
pop rbp
ret
mov eax, esi
mov ecx, 0x18
call fcn.0045cd80
mov eax, edi
mov ecx, 0x18
call fcn.0045cd80
nop
nop dword [rax]
call fcn.0045aaa0
jmp fcn.00515dc0
Function at 0x516520
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x51662c
push rbp
mov rbp, rsp
sub rsp, 0x58
movabs rdx, 0x7e7465e94120af6d
mov qword [rsp + 0x3e], rdx
movabs rdx, 0x7d749197d5697861
mov qword [rsp + 0x46], rdx
movabs rdx, 0x646e7d749197d569
mov qword [rsp + 0x48], rdx
movabs rdx, 0x58a5825e8c8272fe
mov qword [rsp + 0x50], rdx
movabs rdx, 0xf1201050c0b0401
mov qword [rsp + 0x1e], rdx
movabs rdx, 0xf1519150c140f19
mov qword [rsp + 0x26], rdx
movabs rdx, 0xd090c14180f0016
mov qword [rsp + 0x2e], rdx
movabs rdx, 0x5170c14070f1414
mov qword [rsp + 0x36], rdx
xor eax, eax
jmp 0x5165c8
movzx r9d, byte [rsp + rsi + 0x3e]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x3f]
mov byte [rsp + rdi + 0x3e], dl
mov byte [rsp + rsi + 0x3e], r8b
add rax, 2
cmp rax, 0x20
jge 0x5165fc
movzx edx, byte [rsp + rax + 0x1e]
movzx esi, byte [rsp + rax + 0x1f]
mov edi, edx
xor edx, esi
add edx, eax
nop
cmp rdi, 0x1a
jae 0x51661f
movzx r8d, byte [rsp + rdi + 0x3e]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x3f]
cmp rsi, 0x1a
jb 0x5165ae
jmp 0x516613
xor eax, eax
lea rbx, [rsp + 0x3e]
mov ecx, 0x1a
call fcn.00449780
add rsp, 0x58
pop rbp
ret
mov eax, esi
mov ecx, 0x1a
call fcn.0045cd80
mov eax, edi
mov ecx, 0x1a
call fcn.0045cd80
nop
call fcn.0045aaa0
jmp fcn.00516520

Function at 0x51c8e0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x51c9ec
push rbp
mov rbp, rsp
sub rsp, 0x50
movabs rdx, 0x2167cd65d37361f9
mov qword [rsp + 0x35], rdx
movabs rdx, 0x74d5bd6fcff9406e
mov qword [rsp + 0x3d], rdx
movabs rdx, 0xd96e0374d5bd6fcf
mov qword [rsp + 0x40], rdx
movabs rdx, 0x656dbfc02040eb6e
mov qword [rsp + 0x48], rdx
movabs rdx, 0x8090a15080613
mov qword [rsp + 0x19], rdx
movabs rdx, 0x705141510130c0c
mov qword [rsp + 0x21], rdx
movabs rdx, 0xe180b1207051415
mov qword [rsp + 0x25], rdx
movabs rdx, 0xd130a170c030605
mov qword [rsp + 0x2d], rdx
xor eax, eax
jmp 0x51c988
movzx r9d, byte [rsp + rsi + 0x35]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x6c]
mov byte [rsp + rdi + 0x35], dl
mov byte [rsp + rsi + 0x35], r8b
add rax, 2
cmp rax, 0x1c
jge 0x51c9bc
movzx edx, byte [rsp + rax + 0x19]
movzx esi, byte [rsp + rax + 0x1a]
mov edi, edx
xor edx, esi
add edx, eax
nop
cmp rdi, 0x1b
jae 0x51c9df
movzx r8d, byte [rsp + rdi + 0x35]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x6c]
cmp rsi, 0x1b
jb 0x51c96e
jmp 0x51c9d3
xor eax, eax
lea rbx, [rsp + 0x35]
mov ecx, 0x1b
call fcn.00449780
add rsp, 0x50
pop rbp
ret
mov eax, esi
mov ecx, 0x1b
call fcn.0045cd80
mov eax, edi
mov ecx, 0x1b
call fcn.0045cd80
nop
call fcn.0045aaa0
jmp fcn.0051c8e0
Function at 0x51ca00
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x51cb2c
push rbp
mov rbp, rsp
sub rsp, 0x60
movabs rdx, 0x8798782789907d43
mov qword [rsp + 0x43], rdx
movabs rdx, 0x9f6384b9c463619c
mov qword [rsp + 0x4b], rdx
movabs rdx, 0xcc7f615eac9f6384
mov qword [rsp + 0x50], rdx
movabs rdx, 0x6579692c20af6175
mov qword [rsp + 0x58], rdx
movabs rdx, 0x614130d1710020c
mov qword [rsp + 0x19], rdx
movabs rdx, 0xf080617011b0b17
mov qword [rsp + 0x21], rdx
movabs rdx, 0x6070f080617011b
mov qword [rsp + 0x23], rdx
movabs rdx, 0x1402051110021705
mov qword [rsp + 0x2b], rdx
movabs rdx, 0x519191103100608
mov qword [rsp + 0x33], rdx
movabs rdx, 0x711040f16101b15
mov qword [rsp + 0x3b], rdx
xor eax, eax
jmp 0x51cac6
movzx r9d, byte [rsp + rsi + 0x43]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x38]
mov byte [rsp + rdi + 0x43], dl
mov byte [rsp + rsi + 0x43], r8b
add rax, 2
cmp rax, 0x2a
jge 0x51cafc
movzx edx, byte [rsp + rax + 0x19]
movzx esi, byte [rsp + rax + 0x1a]
mov edi, edx
xor edx, esi
add edx, eax
nop dword [rax]
cmp rdi, 0x1d
jae 0x51cb1f
movzx r8d, byte [rsp + rdi + 0x43]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x38]
cmp rsi, 0x1d
jb 0x51caac
jmp 0x51cb13
xor eax, eax
lea rbx, [rsp + 0x43]
mov ecx, 0x1d
call fcn.00449780
add rsp, 0x60
pop rbp
ret
mov eax, esi
mov ecx, 0x1d
call fcn.0045cd80
mov eax, edi
mov ecx, 0x1d
call fcn.0045cd80
nop
call fcn.0045aaa0
jmp fcn.0051ca00

Function at 0x51d260
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x51d35b
push rbp
mov rbp, rsp
sub rsp, 0x48
movabs rdx, 0x266b6c6f0f721802
mov qword [rsp + 0x33], rdx
movabs rdx, 0xe62161742e266b6c
mov qword [rsp + 0x38], rdx
movabs rdx, 0xdbbf69bfab0f200f
mov qword [rsp + 0x40], rdx
movabs rdx, 0x1000010313000c10
mov qword [rsp + 0x19], rdx
movabs rdx, 0xd0e110f140b0d0e
mov qword [rsp + 0x21], rdx
movabs rdx, 0x13010d0e110f140b
mov qword [rsp + 0x23], rdx
movabs rdx, 0xc070b08080f0303
mov qword [rsp + 0x2b], rdx
xor eax, eax
jmp 0x51d2f9
movzx r9d, byte [rsp + rsi + 0x33]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x1b]
mov byte [rsp + rdi + 0x33], dl
mov byte [rsp + rsi + 0x33], r8b
add rax, 2
cmp rax, 0x1a
jge 0x51d32b
movzx edx, byte [rsp + rax + 0x19]
movzx esi, byte [rsp + rax + 0x1a]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x15
jae 0x51d34e
movzx r8d, byte [rsp + rdi + 0x33]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x1b]
cmp rsi, 0x15
jb 0x51d2df
jmp 0x51d342
xor eax, eax
lea rbx, [rsp + 0x33]
mov ecx, 0x15
call fcn.00449780
add rsp, 0x48
pop rbp
ret
mov eax, esi
mov ecx, 0x15
call fcn.0045cd80
mov eax, edi
mov ecx, 0x15
call fcn.0045cd80
nop
nop dword [rax + rax]
call fcn.0045aaa0
jmp fcn.0051d260
Function at 0x526b00
Capabilities:
Encrypt data using rc4 prga

Disassembly:
lea r12, [rsp - 0x10]
cmp r12, qword [r14 + 0x10]
jbe 0x526c72
push rbp
mov rbp, rsp
sub rsp, 0x88
movabs rdx, 0xa752c140d8631053
mov qword [rsp + 0x51], rdx
movabs rdx, 0xfb6fc2633c505ca7
mov qword [rsp + 0x58], rdx
movabs rdx, 0x6490ffd05c0c666f
mov qword [rsp + 0x60], rdx
movabs rdx, 0x12b754c2e7169cc6
mov qword [rsp + 0x68], rdx
movabs rdx, 0x90dc74a2a57272b7
mov qword [rsp + 0x70], rdx
movabs rdx, 0xc9d0ed6eb583b755
mov qword [rsp + 0x78], rdx
movabs rdx, 0xdacf80c95a206595
mov qword [rsp + 0x80], rdx
movabs rdx, 0x271a2e110c350233
mov qword [rsp + 0x19], rdx
movabs rdx, 0x2e04231b02090136
mov qword [rsp + 0x21], rdx
movabs rdx, 0x331427172c2e1e27
mov qword [rsp + 0x29], rdx
movabs rdx, 0xe131a01052f1f09
mov qword [rsp + 0x31], rdx
movabs rdx, 0x221403191d33030a
mov qword [rsp + 0x39], rdx
movabs rdx, 0x1525290726130218
mov qword [rsp + 0x41], rdx
movabs rdx, 0x2836150334012d2a
mov qword [rsp + 0x49], rdx
xor eax, eax
jmp 0x526c0d
movzx r9d, byte [rsp + rsi + 0x51]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x68]
mov byte [rsp + rdi + 0x51], dl
mov byte [rsp + rsi + 0x51], r8b
add rax, 2
cmp rax, 0x38
jge 0x526c3f
movzx edx, byte [rsp + rax + 0x19]
movzx esi, byte [rsp + rax + 0x1a]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x37
jae 0x526c65
movzx r8d, byte [rsp + rdi + 0x51]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x68]
cmp rsi, 0x37
jb 0x526bf3
jmp 0x526c59
xor eax, eax
lea rbx, [rsp + 0x51]
mov ecx, 0x37
call fcn.00449780
add rsp, 0x88
pop rbp
ret
mov eax, esi
mov ecx, 0x37
call fcn.0045cd80
mov eax, edi
mov ecx, 0x37
call fcn.0045cd80
nop
call fcn.0045aaa0
jmp fcn.00526b00

Function at 0x528b00
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x528bc7
push rbp
mov rbp, rsp
sub rsp, 0x30
movabs rdx, 0x96d3f865b3c03325
mov qword [rsp + 0x26], rdx
mov word [rsp + 0x2e], 0xcc79
movabs rdx, 0x709070503090203
mov qword [rsp + 0x18], rdx
movabs rdx, 0x107060501050709
mov qword [rsp + 0x1e], rdx
xor eax, eax
jmp 0x528b67
movzx r9d, byte [rsp + rsi + 0x26]
sub r9d, edx
lea edx, [r9 - 0x5b]
mov byte [rsp + rdi + 0x26], dl
lea edx, [r8 - 0x5b]
mov byte [rsp + rsi + 0x26], dl
add rax, 2
cmp rax, 0xe
jge 0x528b97
movzx edx, byte [rsp + rax + 0x18]
movzx esi, byte [rsp + rax + 0x19]
mov edi, edx
xor edx, esi
add edx, eax
nop dword [rax]
cmp rdi, 0xa
jae 0x528bba
movzx r8d, byte [rsp + rdi + 0x26]
sub r8d, edx
cmp rsi, 0xa
jb 0x528b4a
jmp 0x528bae
xor eax, eax
lea rbx, [rsp + 0x26]
mov ecx, 0xa
call fcn.00449780
add rsp, 0x30
pop rbp
ret
mov eax, esi
mov ecx, 0xa
call fcn.0045cd80
mov eax, edi
mov ecx, 0xa
call fcn.0045cd80
nop
call fcn.0045aaa0
jmp fcn.00528b00
Function at 0x52ac00
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x52acc6
push rbp
mov rbp, rsp
sub rsp, 0x30
movabs rdx, 0x9c8e985008f302d
mov qword [rsp + 0x27], rdx
mov byte [rsp + 0x2f], 0xe9
movabs rdx, 0x203040704020607
mov qword [rsp + 0x1b], rdx
mov dword [rsp + 0x23], 0x8050703
xor eax, eax
nop
jmp 0x52ac60
movzx r9d, byte [rsp + rsi + 0x27]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x30]
mov byte [rsp + rdi + 0x27], dl
mov byte [rsp + rsi + 0x27], r8b
add rax, 2
nop dword [rax]
cmp rax, 0xc
jge 0x52ac92
movzx edx, byte [rsp + rax + 0x1b]
movzx esi, byte [rsp + rax + 0x1c]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 9
jae 0x52acb7
movzx r8d, byte [rsp + rdi + 0x27]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x30]
cmp rsi, 9
jb 0x52ac42
jmp 0x52acab
xor eax, eax
lea rbx, [rsp + 0x27]
mov ecx, 9
nop
call fcn.00449780
add rsp, 0x30
pop rbp
ret
mov eax, esi
mov ecx, 9
call fcn.0045cd80
mov eax, edi
mov ecx, 9
nop
call fcn.0045cd80
nop
call fcn.0045aaa0
jmp fcn.0052ac00

Function at 0x52ace0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x52ad9d
push rbp
mov rbp, rsp
sub rsp, 0x30
movabs rdx, 0x30b66030885c5b68
mov qword [rsp + 0x27], rdx
mov byte [rsp + 0x2f], 0x92
movabs rdx, 0x102050106050508
mov qword [rsp + 0x1d], rdx
mov word [rsp + 0x25], 0x300
xor eax, eax
nop
jmp 0x52ad40
movzx r9d, byte [rsp + rsi + 0x27]
sub r9d, edx
lea edx, [r9 - 0x23]
mov byte [rsp + rdi + 0x27], dl
lea edx, [r8 - 0x23]
mov byte [rsp + rsi + 0x27], dl
add rax, 2
nop
cmp rax, 0xa
jge 0x52ad6d
movzx edx, byte [rsp + rax + 0x1d]
movzx esi, byte [rsp + rax + 0x1e]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 9
jae 0x52ad90
movzx r8d, byte [rsp + rdi + 0x27]
sub r8d, edx
cmp rsi, 9
jb 0x52ad22
jmp 0x52ad84
xor eax, eax
lea rbx, [rsp + 0x27]
mov ecx, 9
call fcn.00449780
add rsp, 0x30
pop rbp
ret
mov eax, esi
mov ecx, 9
call fcn.0045cd80
mov eax, edi
mov ecx, 9
call fcn.0045cd80
nop
nop dword [rax]
call fcn.0045aaa0
jmp fcn.0052ace0
Function at 0x52f4c0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x52f5bb
push rbp
mov rbp, rsp
sub rsp, 0x50
movabs rdx, 0x6517dde174e4dc30
mov qword [rsp + 0x39], rdx
movabs rdx, 0x60691bef04723765
mov qword [rsp + 0x40], rdx
movabs rdx, 0x6e23eb742dc8704d
mov qword [rsp + 0x48], rdx
movabs rdx, 0xf010215140c000e
mov qword [rsp + 0x1f], rdx
movabs rdx, 0x121500040c05080b
mov qword [rsp + 0x27], rdx
movabs rdx, 0x104121500040c05
mov qword [rsp + 0x29], rdx
movabs rdx, 0x60401080a000a11
mov qword [rsp + 0x31], rdx
xor eax, eax
jmp 0x52f559
movzx r9d, byte [rsp + rsi + 0x39]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x30]
mov byte [rsp + rdi + 0x39], dl
mov byte [rsp + rsi + 0x39], r8b
add rax, 2
cmp rax, 0x1a
jge 0x52f58b
movzx edx, byte [rsp + rax + 0x1f]
movzx esi, byte [rsp + rax + 0x20]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x17
jae 0x52f5ae
movzx r8d, byte [rsp + rdi + 0x39]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x30]
cmp rsi, 0x17
jb 0x52f53f
jmp 0x52f5a2
xor eax, eax
lea rbx, [rsp + 0x39]
mov ecx, 0x17
call fcn.00449780
add rsp, 0x50
pop rbp
ret
mov eax, esi
mov ecx, 0x17
call fcn.0045cd80
mov eax, edi
mov ecx, 0x17
call fcn.0045cd80
nop
nop dword [rax + rax]
call fcn.0045aaa0
jmp fcn.0052f4c0

Function at 0x52f800
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x52f8fb
push rbp
mov rbp, rsp
sub rsp, 0x48
movabs rdx, 0xb45d7420709b9273
mov qword [rsp + 0x35], rdx
movabs rdx, 0x647a8ab45d742070
mov qword [rsp + 0x38], rdx
movabs rdx, 0x9ec19890639d72b2
mov qword [rsp + 0x40], rdx
movabs rdx, 0x11060b0b12070f02
mov qword [rsp + 0x19], rdx
movabs rdx, 0xd12080110120610
mov qword [rsp + 0x21], rdx
movabs rdx, 0x120b12070d120801
mov qword [rsp + 0x25], rdx
movabs rdx, 0x606070909070911
mov qword [rsp + 0x2d], rdx
xor eax, eax
jmp 0x52f899
movzx r9d, byte [rsp + rsi + 0x35]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x34]
mov byte [rsp + rdi + 0x35], dl
mov byte [rsp + rsi + 0x35], r8b
add rax, 2
cmp rax, 0x1c
jge 0x52f8cb
movzx edx, byte [rsp + rax + 0x19]
movzx esi, byte [rsp + rax + 0x1a]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x13
jae 0x52f8ee
movzx r8d, byte [rsp + rdi + 0x35]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x34]
cmp rsi, 0x13
jb 0x52f87f
jmp 0x52f8e2
xor eax, eax
lea rbx, [rsp + 0x35]
mov ecx, 0x13
call fcn.00449780
add rsp, 0x48
pop rbp
ret
mov eax, esi
mov ecx, 0x13
call fcn.0045cd80
mov eax, edi
mov ecx, 0x13
call fcn.0045cd80
nop
nop dword [rax + rax]
call fcn.0045aaa0
jmp fcn.0052f800
Function at 0x532de0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov qword [rsp + 0x40], 0
movabs rdx, 0x6d2c1944ee36945c
mov qword [rsp + 0x28], rdx
movabs rdx, 0x501060600020502
mov qword [rsp + 0x16], rdx
mov word [rsp + 0x1e], 0x205
xor eax, eax
jmp 0x532e34
movzx r8d, byte [rsp + rbx + 0x28]
lea edx, [r8 + rdx]
lea edx, [rdx + 0x30]
mov byte [rsp + rsi + 0x28], dl
mov byte [rsp + rbx + 0x28], dil
add rax, 2
cmp rax, 0xa
jge 0x532e68
movzx edx, byte [rsp + rax + 0x16]
movzx ebx, byte [rsp + rax + 0x17]
mov esi, edx
xor edx, ebx
add edx, eax
cmp rsi, 8
jae 0x532ea5
movzx edi, byte [rsp + rsi + 0x28]
lea edi, [rdi + rdx]
lea edi, [rdi + 0x30]
nop dword [rax + rax]
cmp rbx, 8
jb 0x532e1a
jmp 0x532e97
mov qword [rsp + 0x20], 0
xor eax, eax
jmp 0x532e81
movzx ecx, byte [rsp + rax + 0x28]
mov byte [rsp + rax + 0x20], cl
inc rax
cmp rax, 8
jl 0x532e75
mov rax, qword [rsp + 0x20]
mov qword [rsp + 0x40], rax
add rsp, 0x30
pop rbp
ret
mov eax, ebx
mov ecx, 8
nop
call fcn.0045cd80
mov eax, esi
mov ecx, 8
call fcn.0045cd80
nop
int3

Function at 0x5333c0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x5334bd
push rbp
mov rbp, rsp
sub rsp, 0x50
movabs rdx, 0xa670c17079a8e5e6
mov qword [rsp + 0x3c], rdx
movabs rdx, 0x749fc374a670c170
mov qword [rsp + 0x40], rdx
movabs rdx, 0xf63bf729261376a9
mov qword [rsp + 0x48], rdx
movabs rdx, 0x70812091311020a
mov qword [rsp + 0x1e], rdx
movabs rdx, 0x51300020a0c08
mov qword [rsp + 0x26], rdx
movabs rdx, 0x1200071009050005
mov qword [rsp + 0x2c], rdx
movabs rdx, 0xf13050f10010e08
mov qword [rsp + 0x34], rdx
xor eax, eax
jmp 0x533460
movzx r9d, byte [rsp + rsi + 0x3c]
sub r9d, edx
lea edx, [r9 + 0x72]
mov byte [rsp + rdi + 0x3c], dl
lea edx, [r8 + 0x72]
mov byte [rsp + rsi + 0x3c], dl
add rax, 2
nop dword [rax]
cmp rax, 0x1e
jge 0x53348d
movzx edx, byte [rsp + rax + 0x1e]
movzx esi, byte [rsp + rax + 0x1f]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x14
jae 0x5334b0
movzx r8d, byte [rsp + rdi + 0x3c]
sub r8d, edx
cmp rsi, 0x14
jb 0x53343f
jmp 0x5334a4
xor eax, eax
lea rbx, [rsp + 0x3c]
mov ecx, 0x14
call fcn.00449780
add rsp, 0x50
pop rbp
ret
mov eax, esi
mov ecx, 0x14
call fcn.0045cd80
mov eax, edi
mov ecx, 0x14
call fcn.0045cd80
nop
nop dword [rax]
call fcn.0045aaa0
jmp fcn.005333c0