joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4fc8e0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4fc99d
push rbp
mov rbp, rsp
sub rsp, 0x30
movabs rdx, 0x87315e5fe74fa98
mov qword [rsp + 0x26], rdx
mov word [rsp + 0x2e], 0xa6d9
movabs rdx, 0x907080004030503
mov qword [rsp + 0x1a], rdx
mov dword [rsp + 0x22], 0x4010708
xor eax, eax
jmp 0x4fc940
movzx r9d, byte [rsp + rsi + 0x26]
sub r9d, edx
lea edx, [r9 + 0x7a]
mov byte [rsp + rdi + 0x26], dl
lea edx, [r8 + 0x7a]
mov byte [rsp + rsi + 0x26], dl
add rax, 2
cmp rax, 0xc
jge 0x4fc96d
movzx edx, byte [rsp + rax + 0x1a]
movzx esi, byte [rsp + rax + 0x1b]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0xa
jae 0x4fc990
movzx r8d, byte [rsp + rdi + 0x26]
sub r8d, edx
cmp rsi, 0xa
jb 0x4fc923
jmp 0x4fc984
xor eax, eax
lea rbx, [rsp + 0x26]
mov ecx, 0xa
call fcn.00444780
add rsp, 0x30
pop rbp
ret
mov eax, esi
mov ecx, 0xa
call fcn.00456420
mov eax, edi
mov ecx, 0xa
call fcn.00456420
nop
nop dword [rax]
call fcn.00454140
jmp fcn.004fc8e0

Function at 0x4fd360
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4fd41d
push rbp
mov rbp, rsp
sub rsp, 0x30
movabs rdx, 0x2f484de065e46f4d
mov qword [rsp + 0x27], rdx
mov byte [rsp + 0x2f], 0x57
movabs rdx, 0x602030605070605
mov qword [rsp + 0x1d], rdx
mov word [rsp + 0x25], 0x405
xor eax, eax
nop
jmp 0x4fd3c0
movzx r9d, byte [rsp + rsi + 0x27]
sub r9d, edx
lea edx, [r9 - 0x6e]
mov byte [rsp + rdi + 0x27], dl
lea edx, [r8 - 0x6e]
mov byte [rsp + rsi + 0x27], dl
add rax, 2
nop
cmp rax, 0xa
jge 0x4fd3ed
movzx edx, byte [rsp + rax + 0x1d]
movzx esi, byte [rsp + rax + 0x1e]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 9
jae 0x4fd410
movzx r8d, byte [rsp + rdi + 0x27]
sub r8d, edx
cmp rsi, 9
jb 0x4fd3a2
jmp 0x4fd404
xor eax, eax
lea rbx, [rsp + 0x27]
mov ecx, 9
call fcn.00444780
add rsp, 0x30
pop rbp
ret
mov eax, esi
mov ecx, 9
call fcn.00456420
mov eax, edi
mov ecx, 9
call fcn.00456420
nop
nop dword [rax]
call fcn.00454140
jmp fcn.004fd360

Function at 0x4fd440
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4fd50c
push rbp
mov rbp, rsp
sub rsp, 0x38
movabs rdx, 0xe16fe2ed347d7029
mov qword [rsp + 0x2d], rdx
mov dword [rsp + 0x34], 0x320b65e1
movabs rdx, 0x90a070503030904
mov qword [rsp + 0x1f], rdx
movabs rdx, 0x50007050207090a
mov qword [rsp + 0x25], rdx
xor eax, eax
jmp 0x4fd4a5
movzx r9d, byte [rsp + rsi + 0x2d]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x38]
mov byte [rsp + rdi + 0x2d], dl
mov byte [rsp + rsi + 0x2d], r8b
add rax, 2
cmp rax, 0xe
jge 0x4fd4dc
movzx edx, byte [rsp + rax + 0x1f]
movzx esi, byte [rsp + rax + 0x20]
mov edi, edx
xor edx, esi
add edx, eax
nop dword [rax + rax]
cmp rdi, 0xb
jae 0x4fd4ff
movzx r8d, byte [rsp + rdi + 0x2d]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x38]
cmp rsi, 0xb
jb 0x4fd48b
jmp 0x4fd4f3
xor eax, eax
lea rbx, [rsp + 0x2d]
mov ecx, 0xb
call fcn.00444780
add rsp, 0x38
pop rbp
ret
mov eax, esi
mov ecx, 0xb
call fcn.00456420
mov eax, edi
mov ecx, 0xb
call fcn.00456420
nop
call fcn.00454140
jmp fcn.004fd440
Function at 0x4fd640
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4fd712
push rbp
mov rbp, rsp
sub rsp, 0x38
movabs rdx, 0x33d01dd8d9dad1ac
mov qword [rsp + 0x29], rdx
movabs rdx, 0xbe74ca3599dad033
mov qword [rsp + 0x30], rdx
movabs rdx, 0xc0400090b020905
mov qword [rsp + 0x19], rdx
movabs rdx, 0x1060e0e080a0302
mov qword [rsp + 0x21], rdx
xor eax, eax
jmp 0x4fd6ac
movzx r9d, byte [rsp + rsi + 0x29]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x73]
mov byte [rsp + rdi + 0x29], dl
mov byte [rsp + rsi + 0x29], r8b
add rax, 2
cmp rax, 0x10
jge 0x4fd6de
movzx edx, byte [rsp + rax + 0x19]
movzx esi, byte [rsp + rax + 0x1a]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0xf
jae 0x4fd705
movzx r8d, byte [rsp + rdi + 0x29]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x73]
cmp rsi, 0xf
jb 0x4fd692
jmp 0x4fd6f5
xor eax, eax
lea rbx, [rsp + 0x29]
mov ecx, 0xf
call fcn.00444780
add rsp, 0x38
pop rbp
ret
mov eax, esi
mov ecx, 0xf
nop dword [rax]
call fcn.00456420
mov eax, edi
mov ecx, 0xf
call fcn.00456420
nop
call fcn.00454140
jmp fcn.004fd640

Function at 0x4fd720
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4fd7fd
push rbp
mov rbp, rsp
sub rsp, 0x38
movabs rdx, 0xde7f733c63edcd67
mov qword [rsp + 0x2a], rdx
movabs rdx, 0x57f578fc4eb4de7f
mov qword [rsp + 0x30], rdx
movabs rdx, 0xc06040708040200
mov qword [rsp + 0x18], rdx
movabs rdx, 0x7080c0604070804
mov qword [rsp + 0x1a], rdx
movabs rdx, 0xc0a0c0201020100
mov qword [rsp + 0x22], rdx
xor eax, eax
nop
jmp 0x4fd7a0
movzx r9d, byte [rsp + rsi + 0x2a]
sub r9d, edx
lea edx, [r9 - 0x72]
mov byte [rsp + rdi + 0x2a], dl
lea edx, [r8 - 0x72]
mov byte [rsp + rsi + 0x2a], dl
add rax, 2
nop
cmp rax, 0x12
jge 0x4fd7cd
movzx edx, byte [rsp + rax + 0x18]
movzx esi, byte [rsp + rax + 0x19]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0xe
jae 0x4fd7f0
movzx r8d, byte [rsp + rdi + 0x2a]
sub r8d, edx
cmp rsi, 0xe
jb 0x4fd782
jmp 0x4fd7e4
xor eax, eax
lea rbx, [rsp + 0x2a]
mov ecx, 0xe
call fcn.00444780
add rsp, 0x38
pop rbp
ret
mov eax, esi
mov ecx, 0xe
call fcn.00456420
mov eax, edi
mov ecx, 0xe
call fcn.00456420
nop
nop dword [rax]
call fcn.00454140
jmp fcn.004fd720
Function at 0x4fe3a0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4fe49d
push rbp
mov rbp, rsp
sub rsp, 0x50
movabs rdx, 0x7214b56e12b0d4c4
mov qword [rsp + 0x39], rdx
movabs rdx, 0x67c568656dc2c172
mov qword [rsp + 0x40], rdx
movabs rdx, 0x57156cb761c2a995
mov qword [rsp + 0x48], rdx
movabs rdx, 0x110606150c05030e
mov qword [rsp + 0x1f], rdx
movabs rdx, 0x10150e0500100f03
mov qword [rsp + 0x27], rdx
movabs rdx, 0x131510150e050010
mov qword [rsp + 0x29], rdx
movabs rdx, 0x10d0908130f0e02
mov qword [rsp + 0x31], rdx
xor eax, eax
jmp 0x4fe440
movzx r9d, byte [rsp + rsi + 0x39]
sub r9d, edx
lea edx, [r9 - 0x3c]
mov byte [rsp + rdi + 0x39], dl
lea edx, [r8 - 0x3c]
mov byte [rsp + rsi + 0x39], dl
add rax, 2
nop dword [rax]
cmp rax, 0x1a
jge 0x4fe46d
movzx edx, byte [rsp + rax + 0x1f]
movzx esi, byte [rsp + rax + 0x20]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x17
jae 0x4fe490
movzx r8d, byte [rsp + rdi + 0x39]
sub r8d, edx
cmp rsi, 0x17
jb 0x4fe41f
jmp 0x4fe484
xor eax, eax
lea rbx, [rsp + 0x39]
mov ecx, 0x17
call fcn.00444780
add rsp, 0x50
pop rbp
ret
mov eax, esi
mov ecx, 0x17
call fcn.00456420
mov eax, edi
mov ecx, 0x17
call fcn.00456420
nop
nop dword [rax]
call fcn.00454140
jmp fcn.004fe3a0

Function at 0x5013e0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x5014bd
push rbp
mov rbp, rsp
sub rsp, 0x40
movabs rdx, 0x75c4bc40c1656504
mov qword [rsp + 0x30], rdx
movabs rdx, 0xefb472a072657566
mov qword [rsp + 0x38], rdx
movabs rdx, 0xf0e020309050402
mov qword [rsp + 0x1e], rdx
movabs rdx, 0x30c0f0e02030905
mov qword [rsp + 0x20], rdx
movabs rdx, 0x50e0600050406
mov qword [rsp + 0x28], rdx
xor eax, eax
nop
jmp 0x501460
movzx r9d, byte [rsp + rsi + 0x30]
sub r9d, edx
lea edx, [r9 - 0x48]
mov byte [rsp + rdi + 0x30], dl
lea edx, [r8 - 0x48]
mov byte [rsp + rsi + 0x30], dl
add rax, 2
nop
cmp rax, 0x12
jge 0x50148d
movzx edx, byte [rsp + rax + 0x1e]
movzx esi, byte [rsp + rax + 0x1f]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x10
jae 0x5014b0
movzx r8d, byte [rsp + rdi + 0x30]
sub r8d, edx
cmp rsi, 0x10
jb 0x501442
jmp 0x5014a4
xor eax, eax
lea rbx, [rsp + 0x30]
mov ecx, 0x10
call fcn.00444780
add rsp, 0x40
pop rbp
ret
mov eax, esi
mov ecx, 0x10
call fcn.00456420
mov eax, edi
mov ecx, 0x10
call fcn.00456420
nop
nop dword [rax]
call fcn.00454140
jmp fcn.005013e0
Function at 0x5027a0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x5028ac
push rbp
mov rbp, rsp
sub rsp, 0x58
movabs rdx, 0x3772659e530a4347
mov qword [rsp + 0x40], rdx
movabs rdx, 0x3dec65f1693c11b4
mov qword [rsp + 0x48], rdx
movabs rdx, 0xf679c4181a63d9e9
mov qword [rsp + 0x50], rdx
movabs rdx, 0xc08140e0103110a
mov qword [rsp + 0x1c], rdx
movabs rdx, 0x8130c100c08140e
mov qword [rsp + 0x20], rdx
movabs rdx, 0x2081714150a0804
mov qword [rsp + 0x28], rdx
movabs rdx, 0x91702170a141014
mov qword [rsp + 0x30], rdx
movabs rdx, 0x1015080f1314070c
mov qword [rsp + 0x38], rdx
xor eax, eax
jmp 0x502848
movzx r9d, byte [rsp + rsi + 0x40]
lea edx, [r9 + rdx]
lea edx, [rdx + 0xe]
mov byte [rsp + rdi + 0x40], dl
mov byte [rsp + rsi + 0x40], r8b
add rax, 2
cmp rax, 0x24
jge 0x50287c
movzx edx, byte [rsp + rax + 0x1c]
movzx esi, byte [rsp + rax + 0x1d]
mov edi, edx
xor edx, esi
add edx, eax
nop
cmp rdi, 0x18
jae 0x50289f
movzx r8d, byte [rsp + rdi + 0x40]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0xe]
cmp rsi, 0x18
jb 0x50282e
jmp 0x502893
xor eax, eax
lea rbx, [rsp + 0x40]
mov ecx, 0x18
call fcn.00444780
add rsp, 0x58
pop rbp
ret
mov eax, esi
mov ecx, 0x18
call fcn.00456420
mov eax, edi
mov ecx, 0x18
call fcn.00456420
nop
call fcn.00454140
jmp fcn.005027a0

Function at 0x505440
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x5054fe
push rbp
mov rbp, rsp
sub rsp, 0x30
movabs rdx, 0x6e8a968873747d67
mov qword [rsp + 0x25], rdx
mov dword [rsp + 0x2c], 0x6585616e
movabs rdx, 0x409040504040601
mov qword [rsp + 0x19], rdx
mov dword [rsp + 0x21], 0x6050901
xor eax, eax
jmp 0x5054a1
movzx r9d, byte [rsp + rsi + 0x25]
sub r9d, edx
lea edx, [r9 - 3]
mov byte [rsp + rdi + 0x25], dl
lea edx, [r8 - 3]
mov byte [rsp + rsi + 0x25], dl
add rax, 2
cmp rax, 0xc
jge 0x5054ce
movzx edx, byte [rsp + rax + 0x19]
movzx esi, byte [rsp + rax + 0x1a]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0xb
jae 0x5054f1
movzx r8d, byte [rsp + rdi + 0x25]
sub r8d, edx
cmp rsi, 0xb
jb 0x505484
jmp 0x5054e5
xor eax, eax
lea rbx, [rsp + 0x25]
mov ecx, 0xb
call fcn.00444780
add rsp, 0x30
pop rbp
ret
mov eax, esi
mov ecx, 0xb
call fcn.00456420
mov eax, edi
mov ecx, 0xb
call fcn.00456420
nop
nop
call fcn.00454140
jmp fcn.00505440
Function at 0x5069c0
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x506a8a
push rbp
mov rbp, rsp
sub rsp, 0x48
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rbx
mov qword [rsp], rax
mov qword [rsp + 8], rbx
mov byte [rsp + 0x10], 0
call fcn.00403260
xorps xmm15, xmm15
mov r14, qword [0x006b9118]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x18], 0xffffffffffffffff
jne 0x506a6f
mov rcx, qword [rsp + 0x60]
lea rdx, [rcx + 1]
mov qword [rsp + 0x40], rdx
lea rax, [0x0055a5e0]
xor ebx, ebx
mov rcx, rdx
call fcn.004412a0
mov rbx, qword [rsp + 0x60]
mov rcx, rax
xor edi, edi
mov rsi, qword [rsp + 0x40]
mov rax, qword [rsp + 0x58]
nop dword [rax]
call fcn.00506fc0
inc rbx
cmp rcx, rbx
jae 0x506a5e
mov edi, 1
lea rsi, [0x0055a5e0]
call fcn.00441380
mov word [rax + rbx*2 - 2], 0
xor edi, edi
xor esi, esi
add rsp, 0x48
pop rbp
ret
xor eax, eax
xor ebx, ebx
mov rcx, rbx
lea rdi, [0x005a0128]
lea rsi, [0x0059fd98]
add rsp, 0x48
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.00454140
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.005069c0

Function at 0x508580
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x508666
push rbp
mov rbp, rsp
sub rsp, 0x40
movabs rdx, 0x7420347d9a6961da
mov qword [rsp + 0x31], rdx
movabs rdx, 0x2087a2618f786f74
mov qword [rsp + 0x38], rdx
movabs rdx, 0x5090d0a0b0d000b
mov qword [rsp + 0x1f], rdx
movabs rdx, 0xa0c05090d0a0b0d
mov qword [rsp + 0x21], rdx
movabs rdx, 0x30d0403030a030a
mov qword [rsp + 0x29], rdx
xor eax, eax
nop
jmp 0x508600
movzx r9d, byte [rsp + rsi + 0x31]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x26]
mov byte [rsp + rdi + 0x31], dl
mov byte [rsp + rsi + 0x31], r8b
add rax, 2
nop dword [rax]
cmp rax, 0x12
jge 0x508632
movzx edx, byte [rsp + rax + 0x1f]
movzx esi, byte [rsp + rax + 0x20]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0xf
jae 0x508657
movzx r8d, byte [rsp + rdi + 0x31]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x26]
cmp rsi, 0xf
jb 0x5085e2
jmp 0x50864b
xor eax, eax
lea rbx, [rsp + 0x31]
mov ecx, 0xf
nop
call fcn.00444780
add rsp, 0x40
pop rbp
ret
mov eax, esi
mov ecx, 0xf
call fcn.00456420
mov eax, edi
mov ecx, 0xf
nop
call fcn.00456420
nop
call fcn.00454140
jmp fcn.00508580
Function at 0x5099e0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x509ab8
push rbp
mov rbp, rsp
sub rsp, 0x38
movabs rdx, 0x79c520e818be65cc
mov qword [rsp + 0x2c], rdx
mov dword [rsp + 0x34], 0xcb88ccc5
movabs rdx, 0x305050a060a0707
mov qword [rsp + 0x1a], rdx
movabs rdx, 0x9020305050a060a
mov qword [rsp + 0x1c], rdx
movabs rdx, 0x80a000b0a040503
mov qword [rsp + 0x24], rdx
xor eax, eax
jmp 0x509a57
movzx r9d, byte [rsp + rsi + 0x2c]
sub r9d, edx
lea edx, [r9 - 0x47]
mov byte [rsp + rdi + 0x2c], dl
lea edx, [r8 - 0x47]
mov byte [rsp + rsi + 0x2c], dl
add rax, 2
cmp rax, 0x12
jge 0x509a88
movzx edx, byte [rsp + rax + 0x1a]
movzx esi, byte [rsp + rax + 0x1b]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0xc
jae 0x509aab
movzx r8d, byte [rsp + rdi + 0x2c]
sub r8d, edx
nop dword [rax]
cmp rsi, 0xc
jb 0x509a3a
jmp 0x509a9f
xor eax, eax
lea rbx, [rsp + 0x2c]
mov ecx, 0xc
call fcn.00444780
add rsp, 0x38
pop rbp
ret
mov eax, esi
mov ecx, 0xc
call fcn.00456420
mov eax, edi
mov ecx, 0xc
call fcn.00456420
nop
call fcn.00454140
nop dword [rax]
jmp fcn.005099e0

Function at 0x50d740
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x50d85a
push rbp
mov rbp, rsp
sub rsp, 0x60
movabs rdx, 0x7274ed7d657c8da8
mov qword [rsp + 0x41], rdx
movabs rdx, 0x81690066b220ad77
mov qword [rsp + 0x49], rdx
movabs rdx, 0x9677399d97726181
mov qword [rsp + 0x50], rdx
movabs rdx, 0x656dafcf9aa0726a
mov qword [rsp + 0x58], rdx
movabs rdx, 0x1b08170b1308130d
mov qword [rsp + 0x1b], rdx
movabs rdx, 0x1b00000519021b08
mov qword [rsp + 0x21], rdx
movabs rdx, 0x9161c161a191217
mov qword [rsp + 0x29], rdx
movabs rdx, 0x11131402151b1616
mov qword [rsp + 0x31], rdx
movabs rdx, 0x40f0f08031b1301
mov qword [rsp + 0x39], rdx
xor eax, eax
jmp 0x50d7f7
movzx r9d, byte [rsp + rsi + 0x41]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x49]
mov byte [rsp + rdi + 0x41], dl
mov byte [rsp + rsi + 0x41], r8b
add rax, 2
cmp rax, 0x26
jge 0x50d829
movzx edx, byte [rsp + rax + 0x1b]
movzx esi, byte [rsp + rax + 0x1c]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x1f
jae 0x50d84d
movzx r8d, byte [rsp + rdi + 0x41]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x49]
cmp rsi, 0x1f
jb 0x50d7dd
jmp 0x50d841
xor eax, eax
lea rbx, [rsp + 0x41]
mov ecx, 0x1f
call fcn.00444780
add rsp, 0x60
pop rbp
nop
ret
mov eax, esi
mov ecx, 0x1f
call fcn.00456420
mov eax, edi
mov ecx, 0x1f
call fcn.00456420
nop
call fcn.00454140
nop
jmp fcn.0050d740
Function at 0x50e8c0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x50e9bb
push rbp
mov rbp, rsp
sub rsp, 0x50
movabs rdx, 0xd26169ed0eafcf20
mov qword [rsp + 0x3a], rdx
movabs rdx, 0x64ec619abf13d261
mov qword [rsp + 0x40], rdx
movabs rdx, 0x9f16a41a91640c61
mov qword [rsp + 0x48], rdx
movabs rdx, 0x1113070807120314
mov qword [rsp + 0x1a], rdx
movabs rdx, 0x1515120f010f0004
mov qword [rsp + 0x22], rdx
movabs rdx, 0x21113130a130913
mov qword [rsp + 0x2a], rdx
movabs rdx, 0x8120f0a0a0f0c15
mov qword [rsp + 0x32], rdx
xor eax, eax
jmp 0x50e959
movzx r9d, byte [rsp + rsi + 0x3a]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x48]
mov byte [rsp + rdi + 0x3a], dl
mov byte [rsp + rsi + 0x3a], r8b
add rax, 2
cmp rax, 0x20
jge 0x50e98b
movzx edx, byte [rsp + rax + 0x1a]
movzx esi, byte [rsp + rax + 0x1b]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x16
jae 0x50e9ae
movzx r8d, byte [rsp + rdi + 0x3a]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x48]
cmp rsi, 0x16
jb 0x50e93f
jmp 0x50e9a2
xor eax, eax
lea rbx, [rsp + 0x3a]
mov ecx, 0x16
call fcn.00444780
add rsp, 0x50
pop rbp
ret
mov eax, esi
mov ecx, 0x16
call fcn.00456420
mov eax, edi
mov ecx, 0x16
call fcn.00456420
nop
nop dword [rax + rax]
call fcn.00454140
jmp fcn.0050e8c0

Function at 0x514800
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x514927
push rbp
mov rbp, rsp
sub rsp, 0x68
movabs rdx, 0x958b6972c8976543
mov qword [rsp + 0x4a], rdx
movabs rdx, 0x6e727a646e8b7487
mov qword [rsp + 0x52], rdx
movabs rdx, 0x207ac9a3c8486e72
mov qword [rsp + 0x58], rdx
movabs rdx, 0x79795c6a63654d7c
mov qword [rsp + 0x60], rdx
movabs rdx, 0x1b110d1d1c021d1b
mov qword [rsp + 0x1e], rdx
movabs rdx, 0x5050c051b0d020f
mov qword [rsp + 0x26], rdx
movabs rdx, 0x211160d05050c05
mov qword [rsp + 0x2a], rdx
movabs rdx, 0x30a140a13141612
mov qword [rsp + 0x32], rdx
movabs rdx, 0x3061c0a1d08081a
mov qword [rsp + 0x3a], rdx
movabs rdx, 0x1610121c1b071619
mov qword [rsp + 0x42], rdx
xor eax, eax
jmp 0x5148c9
movzx r9d, byte [rsp + rsi + 0x4a]
sub r9d, edx
lea edx, [r9 + 0x10]
mov byte [rsp + rdi + 0x4a], dl
lea edx, [r8 + 0x10]
mov byte [rsp + rsi + 0x4a], dl
add rax, 2
cmp rax, 0x2c
jge 0x5148f7
movzx edx, byte [rsp + rax + 0x1e]
movzx esi, byte [rsp + rax + 0x1f]
mov edi, edx
xor edx, esi
add edx, eax
nop
cmp rdi, 0x1e
jae 0x51491a
movzx r8d, byte [rsp + rdi + 0x4a]
sub r8d, edx
cmp rsi, 0x1e
jb 0x5148ac
jmp 0x51490e
xor eax, eax
lea rbx, [rsp + 0x4a]
mov ecx, 0x1e
call fcn.00444780
add rsp, 0x68
pop rbp
ret
mov eax, esi
mov ecx, 0x1e
call fcn.00456420
mov eax, edi
mov ecx, 0x1e
call fcn.00456420
nop
call fcn.00454140
jmp fcn.00514800
Function at 0x515660
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x51575b
push rbp
mov rbp, rsp
sub rsp, 0x50
movabs rdx, 0x856ec08a848c6245
mov qword [rsp + 0x3b], rdx
movabs rdx, 0xa5918a8b92856ec0
mov qword [rsp + 0x40], rdx
movabs rdx, 0x686d697e7b412b61
mov qword [rsp + 0x48], rdx
movabs rdx, 0x70f0e110b05030c
mov qword [rsp + 0x1f], rdx
movabs rdx, 0x100102090404080b
mov qword [rsp + 0x27], rdx
movabs rdx, 0xa080a0310010209
mov qword [rsp + 0x2b], rdx
movabs rdx, 0xa0108100811140a
mov qword [rsp + 0x33], rdx
xor eax, eax
jmp 0x5156f9
movzx r9d, byte [rsp + rsi + 0x3b]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x2f]
mov byte [rsp + rdi + 0x3b], dl
mov byte [rsp + rsi + 0x3b], r8b
add rax, 2
cmp rax, 0x1c
jge 0x51572b
movzx edx, byte [rsp + rax + 0x1f]
movzx esi, byte [rsp + rax + 0x20]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x15
jae 0x51574e
movzx r8d, byte [rsp + rdi + 0x3b]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x2f]
cmp rsi, 0x15
jb 0x5156df
jmp 0x515742
xor eax, eax
lea rbx, [rsp + 0x3b]
mov ecx, 0x15
call fcn.00444780
add rsp, 0x50
pop rbp
ret
mov eax, esi
mov ecx, 0x15
call fcn.00456420
mov eax, edi
mov ecx, 0x15
call fcn.00456420
nop
nop dword [rax + rax]
call fcn.00454140
jmp fcn.00515660

Function at 0x515780
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x51588c
push rbp
mov rbp, rsp
sub rsp, 0x58
movabs rdx, 0xbbcba5884d20cab3
mov qword [rsp + 0x3f], rdx
movabs rdx, 0xb2d57d9220ce697f
mov qword [rsp + 0x47], rdx
movabs rdx, 0xf8b2d57d9220ce69
mov qword [rsp + 0x48], rdx
movabs rdx, 0x97a469548d49c890
mov qword [rsp + 0x50], rdx
movabs rdx, 0x18070f0f0a001006
mov qword [rsp + 0x1f], rdx
movabs rdx, 0x60510180e0e0100
mov qword [rsp + 0x27], rdx
movabs rdx, 0x80005171712110d
mov qword [rsp + 0x2f], rdx
movabs rdx, 0xa0c04120e121314
mov qword [rsp + 0x37], rdx
xor eax, eax
jmp 0x515828
movzx r9d, byte [rsp + rsi + 0x3f]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x48]
mov byte [rsp + rdi + 0x3f], dl
mov byte [rsp + rsi + 0x3f], r8b
add rax, 2
cmp rax, 0x20
jge 0x51585c
movzx edx, byte [rsp + rax + 0x1f]
movzx esi, byte [rsp + rax + 0x20]
mov edi, edx
xor edx, esi
add edx, eax
nop
cmp rdi, 0x19
jae 0x51587f
movzx r8d, byte [rsp + rdi + 0x3f]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x48]
cmp rsi, 0x19
jb 0x51580e
jmp 0x515873
xor eax, eax
lea rbx, [rsp + 0x3f]
mov ecx, 0x19
call fcn.00444780
add rsp, 0x58
pop rbp
ret
mov eax, esi
mov ecx, 0x19
call fcn.00456420
mov eax, edi
mov ecx, 0x19
call fcn.00456420
nop
call fcn.00454140
jmp fcn.00515780
Function at 0x517160
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x51727d
push rbp
mov rbp, rsp
sub rsp, 0x58
movabs rdx, 0x843e75e966001d4e
mov qword [rsp + 0x3e], rdx
movabs rdx, 0x61eb323264ce6145
mov qword [rsp + 0x46], rdx
movabs rdx, 0xfb4161eb323264ce
mov qword [rsp + 0x48], rdx
movabs rdx, 0xd0e09b5441f87227
mov qword [rsp + 0x50], rdx
movabs rdx, 0x117070118110a19
mov qword [rsp + 0x1a], rdx
movabs rdx, 0x1911020e01170701
mov qword [rsp + 0x1e], rdx
movabs rdx, 0x110214140a0d040c
mov qword [rsp + 0x26], rdx
movabs rdx, 0x12061518170c0118
mov qword [rsp + 0x2e], rdx
movabs rdx, 0x10171106140d080e
mov qword [rsp + 0x36], rdx
xor eax, eax
jmp 0x517220
movzx r9d, byte [rsp + rsi + 0x3e]
sub r9d, edx
lea edx, [r9 + 0x51]
mov byte [rsp + rdi + 0x3e], dl
lea edx, [r8 + 0x51]
mov byte [rsp + rsi + 0x3e], dl
add rax, 2
nop word [rax + rax]
cmp rax, 0x24
jge 0x51724d
movzx edx, byte [rsp + rax + 0x1a]
movzx esi, byte [rsp + rax + 0x1b]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x1a
jae 0x517270
movzx r8d, byte [rsp + rdi + 0x3e]
sub r8d, edx
cmp rsi, 0x1a
jb 0x5171fd
jmp 0x517264
xor eax, eax
lea rbx, [rsp + 0x3e]
mov ecx, 0x1a
call fcn.00444780
add rsp, 0x58
pop rbp
ret
mov eax, esi
mov ecx, 0x1a
call fcn.00456420
mov eax, edi
mov ecx, 0x1a
call fcn.00456420
nop
nop dword [rax]
call fcn.00454140
jmp fcn.00517160

Function at 0x517e80
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x517f7d
push rbp
mov rbp, rsp
sub rsp, 0x50
movabs rdx, 0x20a697a126944553
mov qword [rsp + 0x3b], rdx
movabs rdx, 0xa415a694b220a697
mov qword [rsp + 0x40], rdx
movabs rdx, 0x79def2540548a261
mov qword [rsp + 0x48], rdx
movabs rdx, 0xe04020f03141305
mov qword [rsp + 0x1f], rdx
movabs rdx, 0xb05090c0214020b
mov qword [rsp + 0x27], rdx
movabs rdx, 0x21312080b05090c
mov qword [rsp + 0x2b], rdx
movabs rdx, 0x60a140810080805
mov qword [rsp + 0x33], rdx
xor eax, eax
jmp 0x517f20
movzx r9d, byte [rsp + rsi + 0x3b]
sub r9d, edx
lea edx, [r9 - 0x1f]
mov byte [rsp + rdi + 0x3b], dl
lea edx, [r8 - 0x1f]
mov byte [rsp + rsi + 0x3b], dl
add rax, 2
nop dword [rax]
cmp rax, 0x1c
jge 0x517f4d
movzx edx, byte [rsp + rax + 0x1f]
movzx esi, byte [rsp + rax + 0x20]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x15
jae 0x517f70
movzx r8d, byte [rsp + rdi + 0x3b]
sub r8d, edx
cmp rsi, 0x15
jb 0x517eff
jmp 0x517f64
xor eax, eax
lea rbx, [rsp + 0x3b]
mov ecx, 0x15
call fcn.00444780
add rsp, 0x50
pop rbp
ret
mov eax, esi
mov ecx, 0x15
call fcn.00456420
mov eax, edi
mov ecx, 0x15
call fcn.00456420
nop
nop dword [rax]
call fcn.00454140
jmp fcn.00517e80