joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4f2420
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4f2528
sub rsp, 0x50
mov qword [rsp + 0x48], rbp
lea rbp, [rsp + 0x48]
movabs rdx, 0xe5446cd2093d3c2b
mov qword [rsp + 0x19], rdx
movabs rdx, 0x64de263753e5446c
mov qword [rsp + 0x1e], rdx
movabs rdx, 0x2654815421e2811e
mov qword [rsp + 0x26], rdx
movabs rdx, 0x901130a0d120602
mov qword [rsp + 0x2e], rdx
movabs rdx, 0xb0a070f070e14
mov qword [rsp + 0x36], rdx
movabs rdx, 0x1004000b0a070f07
mov qword [rsp + 0x38], rdx
movabs rdx, 0x30014070d0f070d
mov qword [rsp + 0x40], rdx
xor eax, eax
jmp 0x4f24c0
movzx r9d, byte [rsp + rsi + 0x19]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x2a]
mov byte [rsp + rdi + 0x19], dl
mov byte [rsp + rsi + 0x19], r8b
add rax, 2
nop
cmp rax, 0x1a
jge 0x4f24f2
movzx edx, byte [rsp + rax + 0x2e]
movzx esi, byte [rsp + rax + 0x2f]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x15
jae 0x4f251b
movzx r8d, byte [rsp + rdi + 0x19]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x2a]
cmp rsi, 0x15
jb 0x4f24a5
jmp 0x4f250f
xor eax, eax
lea rbx, [rsp + 0x19]
mov ecx, 0x15
nop
call fcn.00441880
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
mov eax, esi
mov ecx, 0x15
call fcn.004533e0
mov eax, edi
mov ecx, 0x15
call fcn.004533e0
nop
call fcn.00450d80
jmp fcn.004f2420
Function at 0x4f4ec0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4f4fd6
sub rsp, 0x60
mov qword [rsp + 0x58], rbp
lea rbp, [rsp + 0x58]
movabs rdx, 0x2288b80a6a6e20e3
mov qword [rsp + 0x1f], rdx
movabs rdx, 0x1743ecb9146ea322
mov qword [rsp + 0x26], rdx
movabs rdx, 0xb093b5a969b86573
mov qword [rsp + 0x2e], rdx
movabs rdx, 0x50f030b0f0e0a04
mov qword [rsp + 0x36], rdx
movabs rdx, 0x150d050f030b0f0e
mov qword [rsp + 0x38], rdx
movabs rdx, 0x50a0d0011150413
mov qword [rsp + 0x40], rdx
movabs rdx, 0x14160d0c1107070c
mov qword [rsp + 0x48], rdx
movabs rdx, 0xa051106080d0713
mov qword [rsp + 0x50], rdx
xor eax, eax
jmp 0x4f4f6e
movzx r9d, byte [rsp + rsi + 0x1f]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x56]
mov byte [rsp + rdi + 0x1f], dl
mov byte [rsp + rsi + 0x1f], r8b
add rax, 2
cmp rax, 0x22
jge 0x4f4fa2
movzx edx, byte [rsp + rax + 0x36]
movzx esi, byte [rsp + rax + 0x37]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x17
jae 0x4f4fc9
movzx r8d, byte [rsp + rdi + 0x1f]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x56]
cmp rsi, 0x17
jb 0x4f4f54
nop
jmp 0x4f4fbd
xor eax, eax
lea rbx, [rsp + 0x1f]
mov ecx, 0x17
call fcn.00441880
mov rbp, qword [rsp + 0x58]
add rsp, 0x60
ret
mov eax, esi
mov ecx, 0x17
call fcn.004533e0
mov eax, edi
mov ecx, 0x17
call fcn.004533e0
nop
call fcn.00450d80
nop dword [rax + rax]
jmp fcn.004f4ec0

Function at 0x4f5000
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4f50e8
sub rsp, 0x48
mov qword [rsp + 0x40], rbp
lea rbp, [rsp + 0x40]
movabs rdx, 0x2c149d329d989b25
mov qword [rsp + 0x1d], rdx
movabs rdx, 0x6aba93adaa9c9f2c
mov qword [rsp + 0x24], rdx
movabs rdx, 0xe000d0106060b0a
mov qword [rsp + 0x2c], rdx
movabs rdx, 0x60e080e000d01
mov qword [rsp + 0x30], rdx
movabs rdx, 0x909060c03030502
mov qword [rsp + 0x38], rdx
xor eax, eax
jmp 0x4f5081
movzx r9d, byte [rsp + rsi + 0x1d]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x7d]
mov byte [rsp + rdi + 0x1d], dl
mov byte [rsp + rsi + 0x1d], r8b
add rax, 2
cmp rax, 0x14
jge 0x4f50b3
movzx edx, byte [rsp + rax + 0x2c]
movzx esi, byte [rsp + rax + 0x2d]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0xf
jae 0x4f50db
movzx r8d, byte [rsp + rdi + 0x1d]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x7d]
cmp rsi, 0xf
jb 0x4f5067
jmp 0x4f50cf
xor eax, eax
lea rbx, [rsp + 0x1d]
mov ecx, 0xf
nop
call fcn.00441880
mov rbp, qword [rsp + 0x40]
add rsp, 0x48
ret
mov eax, esi
mov ecx, 0xf
call fcn.004533e0
mov eax, edi
mov ecx, 0xf
call fcn.004533e0
nop
call fcn.00450d80
jmp fcn.004f5000
Function at 0x4fc0a0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4fc17c
sub rsp, 0x40
mov qword [rsp + 0x38], rbp
lea rbp, [rsp + 0x38]
movabs rdx, 0x2e6feef6fb7f7473
mov qword [rsp + 0x1f], rdx
movabs rdx, 0xef73642e6feef6fb
mov qword [rsp + 0x22], rdx
movabs rdx, 0xa04020102090006
mov qword [rsp + 0x2a], rdx
movabs rdx, 0x502030609000a04
mov qword [rsp + 0x30], rdx
xor eax, eax
jmp 0x4fc115
movzx r9d, byte [rsp + rsi + 0x1f]
sub r9d, edx
lea edx, [r9 - 0x76]
mov byte [rsp + rdi + 0x1f], dl
lea edx, [r8 - 0x76]
mov byte [rsp + rsi + 0x1f], dl
add rax, 2
cmp rax, 0xe
jge 0x4fc148
movzx edx, byte [rsp + rax + 0x2a]
movzx esi, byte [rsp + rax + 0x2b]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0xb
jae 0x4fc16f
movzx r8d, byte [rsp + rdi + 0x1f]
sub r8d, edx
nop word [rax + rax]
cmp rsi, 0xb
jb 0x4fc0f8
jmp 0x4fc163
xor eax, eax
lea rbx, [rsp + 0x1f]
mov ecx, 0xb
call fcn.00441880
mov rbp, qword [rsp + 0x38]
add rsp, 0x40
ret
mov eax, esi
mov ecx, 0xb
call fcn.004533e0
mov eax, edi
mov ecx, 0xb
call fcn.004533e0
nop
nop dword [rax]
call fcn.00450d80
jmp fcn.004fc0a0

Function at 0x4fcc60
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4fcd68
sub rsp, 0x50
mov qword [rsp + 0x48], rbp
lea rbp, [rsp + 0x48]
movabs rdx, 0x724a6c6d6b776f83
mov qword [rsp + 0x19], rdx
movabs rdx, 0x67374c5e75724a6c
mov qword [rsp + 0x1e], rdx
movabs rdx, 0x6f665f5a6d566567
mov qword [rsp + 0x26], rdx
movabs rdx, 0x130b0c080c000610
mov qword [rsp + 0x2e], rdx
movabs rdx, 0x609001002050806
mov qword [rsp + 0x36], rdx
movabs rdx, 0x1114060900100205
mov qword [rsp + 0x38], rdx
movabs rdx, 0x21213060904060a
mov qword [rsp + 0x40], rdx
xor eax, eax
jmp 0x4fcd00
movzx r9d, byte [rsp + rsi + 0x19]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x18]
mov byte [rsp + rdi + 0x19], dl
mov byte [rsp + rsi + 0x19], r8b
add rax, 2
nop
cmp rax, 0x1a
jge 0x4fcd32
movzx edx, byte [rsp + rax + 0x2e]
movzx esi, byte [rsp + rax + 0x2f]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x15
jae 0x4fcd5b
movzx r8d, byte [rsp + rdi + 0x19]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x18]
cmp rsi, 0x15
jb 0x4fcce5
jmp 0x4fcd4f
xor eax, eax
lea rbx, [rsp + 0x19]
mov ecx, 0x15
nop
call fcn.00441880
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
mov eax, esi
mov ecx, 0x15
call fcn.004533e0
mov eax, edi
mov ecx, 0x15
call fcn.004533e0
nop
call fcn.00450d80
jmp fcn.004fcc60
Function at 0x4fcd80
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4fce5c
sub rsp, 0x40
mov qword [rsp + 0x38], rbp
lea rbp, [rsp + 0x38]
movabs rdx, 0x654cfd543b36454f
mov qword [rsp + 0x19], rdx
movabs rdx, 0xa31486f28513565
mov qword [rsp + 0x20], rdx
movabs rdx, 0x30a030e0503080d
mov qword [rsp + 0x28], rdx
movabs rdx, 0x901060c020c0e03
mov qword [rsp + 0x30], rdx
xor eax, eax
jmp 0x4fcdf5
movzx r9d, byte [rsp + rsi + 0x19]
sub r9d, edx
lea edx, [r9 + 0x35]
mov byte [rsp + rdi + 0x19], dl
lea edx, [r8 + 0x35]
mov byte [rsp + rsi + 0x19], dl
add rax, 2
cmp rax, 0x10
jge 0x4fce28
movzx edx, byte [rsp + rax + 0x28]
movzx esi, byte [rsp + rax + 0x29]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0xf
jae 0x4fce4f
movzx r8d, byte [rsp + rdi + 0x19]
sub r8d, edx
nop word [rax + rax]
cmp rsi, 0xf
jb 0x4fcdd8
jmp 0x4fce43
xor eax, eax
lea rbx, [rsp + 0x19]
mov ecx, 0xf
call fcn.00441880
mov rbp, qword [rsp + 0x38]
add rsp, 0x40
ret
mov eax, esi
mov ecx, 0xf
call fcn.004533e0
mov eax, edi
mov ecx, 0xf
call fcn.004533e0
nop
nop dword [rax]
call fcn.00450d80
jmp fcn.004fcd80
Function at 0x4fe3a0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4fe4a8
sub rsp, 0x50
mov qword [rsp + 0x48], rbp
lea rbp, [rsp + 0x48]
movabs rdx, 0x6c7564af14996281
mov qword [rsp + 0x1c], rdx
movabs rdx, 0x81656c7564af1499
mov qword [rsp + 0x1e], rdx
movabs rdx, 0x9ac3d0b0b1dbcf94
mov qword [rsp + 0x26], rdx
movabs rdx, 0x110c030d0f00000e
mov qword [rsp + 0x2e], rdx
movabs rdx, 0xb010d0b01100001
mov qword [rsp + 0x36], rdx
movabs rdx, 0x110a0b010d0b0110
mov qword [rsp + 0x38], rdx
movabs rdx, 0x309020d01030402
mov qword [rsp + 0x40], rdx
xor eax, eax
jmp 0x4fe442
movzx r9d, byte [rsp + rsi + 0x1c]
sub r9d, edx
lea edx, [r9 - 0x12]
mov byte [rsp + rdi + 0x1c], dl
lea edx, [r8 - 0x12]
mov byte [rsp + rsi + 0x1c], dl
add rax, 2
cmp rax, 0x1a
jge 0x4fe46f
movzx edx, byte [rsp + rax + 0x2e]
movzx esi, byte [rsp + rax + 0x2f]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x12
jae 0x4fe49b
movzx r8d, byte [rsp + rdi + 0x1c]
sub r8d, edx
cmp rsi, 0x12
jb 0x4fe425
jmp 0x4fe48f
xor eax, eax
lea rbx, [rsp + 0x1c]
mov ecx, 0x12
nop dword [rax + rax]
call fcn.00441880
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
mov eax, esi
mov ecx, 0x12
call fcn.004533e0
mov eax, edi
mov ecx, 0x12
call fcn.004533e0
nop
call fcn.00450d80
jmp fcn.004fe3a0

Function at 0x4fe7e0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4fe8bc
sub rsp, 0x40
mov qword [rsp + 0x38], rbp
lea rbp, [rsp + 0x38]
movabs rdx, 0x6f3365cca764caf5
mov qword [rsp + 0x1b], rdx
movabs rdx, 0x5709c0d6666f3365
mov qword [rsp + 0x20], rdx
movabs rdx, 0x70b01040a0803
mov qword [rsp + 0x28], rdx
movabs rdx, 0x901000709030009
mov qword [rsp + 0x30], rdx
xor eax, eax
jmp 0x4fe852
movzx r9d, byte [rsp + rsi + 0x1b]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x64]
mov byte [rsp + rdi + 0x1b], dl
mov byte [rsp + rsi + 0x1b], r8b
add rax, 2
cmp rax, 0x10
jge 0x4fe888
movzx edx, byte [rsp + rax + 0x28]
movzx esi, byte [rsp + rax + 0x29]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0xd
jae 0x4fe8af
movzx r8d, byte [rsp + rdi + 0x1b]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x64]
nop dword [rax]
cmp rsi, 0xd
jb 0x4fe838
jmp 0x4fe8a3
xor eax, eax
lea rbx, [rsp + 0x1b]
mov ecx, 0xd
call fcn.00441880
mov rbp, qword [rsp + 0x38]
add rsp, 0x40
ret
mov eax, esi
mov ecx, 0xd
call fcn.004533e0
mov eax, edi
mov ecx, 0xd
call fcn.004533e0
nop
nop dword [rax]
call fcn.00450d80
jmp fcn.004fe7e0
Function at 0x4ff060
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4ff13c
sub rsp, 0x40
mov qword [rsp + 0x38], rbp
lea rbp, [rsp + 0x38]
movabs rdx, 0xf1fa611635fe65c8
mov qword [rsp + 0x1f], rdx
movabs rdx, 0x22f330f1fa611635
mov qword [rsp + 0x22], rdx
movabs rdx, 0x809060308070900
mov qword [rsp + 0x2a], rdx
movabs rdx, 0xa03000402030809
mov qword [rsp + 0x30], rdx
xor eax, eax
jmp 0x4ff0d5
movzx r9d, byte [rsp + rsi + 0x1f]
sub r9d, edx
lea edx, [r9 + 0x46]
mov byte [rsp + rdi + 0x1f], dl
lea edx, [r8 + 0x46]
mov byte [rsp + rsi + 0x1f], dl
add rax, 2
cmp rax, 0xe
jge 0x4ff108
movzx edx, byte [rsp + rax + 0x2a]
movzx esi, byte [rsp + rax + 0x2b]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0xb
jae 0x4ff12f
movzx r8d, byte [rsp + rdi + 0x1f]
sub r8d, edx
nop word [rax + rax]
cmp rsi, 0xb
jb 0x4ff0b8
jmp 0x4ff123
xor eax, eax
lea rbx, [rsp + 0x1f]
mov ecx, 0xb
call fcn.00441880
mov rbp, qword [rsp + 0x38]
add rsp, 0x40
ret
mov eax, esi
mov ecx, 0xb
call fcn.004533e0
mov eax, edi
mov ecx, 0xb
call fcn.004533e0
nop
nop dword [rax]
call fcn.00450d80
jmp fcn.004ff060

Function at 0x502620
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x5026f2
sub rsp, 0x38
mov qword [rsp + 0x30], rbp
lea rbp, [rsp + 0x30]
movabs rdx, 0x1b81970a6bc6faf
mov qword [rsp + 0x24], rdx
mov dword [rsp + 0x2c], 0x656c6405
movabs rdx, 0x7020500080505
mov qword [rsp + 0x18], rdx
mov dword [rsp + 0x20], 0x3090600
xor eax, eax
jmp 0x502684
movzx r9d, byte [rsp + rsi + 0x24]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x58]
mov byte [rsp + rdi + 0x24], dl
mov byte [rsp + rsi + 0x24], r8b
add rax, 2
cmp rax, 0xc
jge 0x5026bc
movzx edx, byte [rsp + rax + 0x18]
movzx esi, byte [rsp + rax + 0x19]
mov edi, edx
xor edx, esi
add edx, eax
nop word [rax + rax]
cmp rdi, 0xc
jae 0x5026e5
movzx r8d, byte [rsp + rdi + 0x24]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x58]
cmp rsi, 0xc
jb 0x50266a
jmp 0x5026d7
xor eax, eax
lea rbx, [rsp + 0x24]
mov ecx, 0xc
call fcn.00441880
mov rbp, qword [rsp + 0x30]
add rsp, 0x38
ret
mov eax, esi
mov ecx, 0xc
nop
call fcn.004533e0
mov eax, edi
mov ecx, 0xc
call fcn.004533e0
nop
call fcn.00450d80
jmp fcn.00502620
Function at 0x504b60
Capabilities:
Encrypt data using rc4 prga

Disassembly:
lea r12, [rsp - 0x10]
cmp r12, qword [r14 + 0x10]
jbe 0x504cf2
sub rsp, 0x90
mov qword [rsp + 0x88], rbp
lea rbp, [rsp + 0x88]
movabs rdx, 0x6c206e7203748975
mov qword [rsp + 0x18], rdx
movabs rdx, 0xd77e878865276c20
mov qword [rsp + 0x1e], rdx
movabs rdx, 0x6e676c746f01923a
mov qword [rsp + 0x26], rdx
movabs rdx, 0x7339758c6ef42067
mov qword [rsp + 0x2e], rdx
movabs rdx, 0x64c3743a7b869e6a
mov qword [rsp + 0x36], rdx
movabs rdx, 0x708672639cb7715d
mov qword [rsp + 0x3e], rdx
movabs rdx, 0xb595b274876fee79
mov qword [rsp + 0x46], rdx
movabs rdx, 0xc2e0a12140f221a
mov qword [rsp + 0x4e], rdx
movabs rdx, 0x1350b03311c2628
mov qword [rsp + 0x56], rdx
movabs rdx, 0x60801350b03311c
mov qword [rsp + 0x58], rdx
movabs rdx, 0x24183021291f2f01
mov qword [rsp + 0x60], rdx
movabs rdx, 0x342029240f062127
mov qword [rsp + 0x68], rdx
movabs rdx, 0x2c2010290d180a0a
mov qword [rsp + 0x70], rdx
movabs rdx, 0x261e01140b0b0000
mov qword [rsp + 0x78], rdx
movabs rdx, 0x14291833140b1203
mov qword [rsp + 0x80], rdx
xor eax, eax
jmp 0x504c8b
movzx r9d, byte [rsp + rsi + 0x18]
sub r9d, edx
lea edx, [r9 + 0x1e]
mov byte [rsp + rdi + 0x18], dl
lea edx, [r8 + 0x1e]
mov byte [rsp + rsi + 0x18], dl
add rax, 2
cmp rax, 0x3a
jge 0x504cb8
movzx edx, byte [rsp + rax + 0x4e]
movzx esi, byte [rsp + rax + 0x4f]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x36
jae 0x504ce5
movzx r8d, byte [rsp + rdi + 0x18]
sub r8d, edx
cmp rsi, 0x36
jb 0x504c6e
jmp 0x504cd9
xor eax, eax
lea rbx, [rsp + 0x18]
mov ecx, 0x36
call fcn.00441880
mov rbp, qword [rsp + 0x88]
add rsp, 0x90
ret
mov eax, esi
mov ecx, 0x36
call fcn.004533e0
mov eax, edi
mov ecx, 0x36
call fcn.004533e0
nop
call fcn.00450d80
jmp fcn.00504b60

Function at 0x505600
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x5056c9
sub rsp, 0x38
mov qword [rsp + 0x30], rbp
lea rbp, [rsp + 0x30]
movabs rdx, 0x6ba6bb99d0d56e75
mov qword [rsp + 0x1a], rdx
mov word [rsp + 0x22], 0x74f1
movabs rdx, 0x205040608030303
mov qword [rsp + 0x24], rdx
mov dword [rsp + 0x2c], 0x5020503
xor eax, eax
jmp 0x505663
movzx r9d, byte [rsp + rsi + 0x1a]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x3c]
mov byte [rsp + rdi + 0x1a], dl
mov byte [rsp + rsi + 0x1a], r8b
add rax, 2
cmp rax, 0xc
jge 0x505695
movzx edx, byte [rsp + rax + 0x24]
movzx esi, byte [rsp + rax + 0x25]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0xa
jae 0x5056bc
movzx r8d, byte [rsp + rdi + 0x1a]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x3c]
cmp rsi, 0xa
jb 0x505649
jmp 0x5056b0
xor eax, eax
lea rbx, [rsp + 0x1a]
mov ecx, 0xa
call fcn.00441880
mov rbp, qword [rsp + 0x30]
add rsp, 0x38
ret
mov eax, esi
mov ecx, 0xa
call fcn.004533e0
mov eax, edi
mov ecx, 0xa
call fcn.004533e0
nop
call fcn.00450d80
jmp fcn.00505600
Function at 0x505ce0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x505e28
sub rsp, 0x70
mov qword [rsp + 0x68], rbp
lea rbp, [rsp + 0x68]
movabs rdx, 0x20511bf62f694477
mov qword [rsp + 0x19], rdx
movabs rdx, 0xee20511bf62f6944
mov qword [rsp + 0x1a], rdx
movabs rdx, 0x453b576e3e20746f
mov qword [rsp + 0x22], rdx
movabs rdx, 0x3f20275e74726946
mov qword [rsp + 0x2a], rdx
movabs rdx, 0x405b2a644b544855
mov qword [rsp + 0x32], rdx
movabs rdx, 0xa041e1a0c1d1e0a
mov qword [rsp + 0x3a], rdx
movabs rdx, 0x1d121e190c060a03
mov qword [rsp + 0x42], rdx
movabs rdx, 0x81801200c151d12
mov qword [rsp + 0x48], rdx
movabs rdx, 0x1c030e1f1f10151e
mov qword [rsp + 0x50], rdx
movabs rdx, 0x121b180816050408
mov qword [rsp + 0x58], rdx
movabs rdx, 0x160a0f1908190511
mov qword [rsp + 0x60], rdx
xor eax, eax
nop
jmp 0x505dc0
movzx r9d, byte [rsp + rsi + 0x19]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x12]
mov byte [rsp + rdi + 0x19], dl
mov byte [rsp + rsi + 0x19], r8b
add rax, 2
nop dword [rax]
cmp rax, 0x2e
jge 0x505df2
movzx edx, byte [rsp + rax + 0x3a]
movzx esi, byte [rsp + rax + 0x3b]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x21
jae 0x505e1b
movzx r8d, byte [rsp + rdi + 0x19]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x12]
cmp rsi, 0x21
jb 0x505da2
jmp 0x505e0f
xor eax, eax
lea rbx, [rsp + 0x19]
mov ecx, 0x21
nop
call fcn.00441880
mov rbp, qword [rsp + 0x68]
add rsp, 0x70
ret
mov eax, esi
mov ecx, 0x21
call fcn.004533e0
mov eax, edi
mov ecx, 0x21
call fcn.004533e0
nop
call fcn.00450d80
jmp fcn.00505ce0
Function at 0x508100
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x5081d2
sub rsp, 0x40
mov qword [rsp + 0x38], rbp
lea rbp, [rsp + 0x38]
movabs rdx, 0x664484231584769
mov qword [rsp + 0x1e], rdx
mov dword [rsp + 0x26], 0x2c5a594a
movabs rdx, 0x40309080a02050b
mov qword [rsp + 0x2a], rdx
movabs rdx, 0x105040407070403
mov qword [rsp + 0x30], rdx
xor eax, eax
jmp 0x50816b
movzx r9d, byte [rsp + rsi + 0x1e]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x12]
mov byte [rsp + rdi + 0x1e], dl
mov byte [rsp + rsi + 0x1e], r8b
add rax, 2
cmp rax, 0xe
jge 0x50819d
movzx edx, byte [rsp + rax + 0x2a]
movzx esi, byte [rsp + rax + 0x2b]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0xc
jae 0x5081c5
movzx r8d, byte [rsp + rdi + 0x1e]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x12]
cmp rsi, 0xc
jb 0x508151
jmp 0x5081b8
xor eax, eax
lea rbx, [rsp + 0x1e]
mov ecx, 0xc
call fcn.00441880
mov rbp, qword [rsp + 0x38]
add rsp, 0x40
ret
mov eax, esi
mov ecx, 0xc
nop
call fcn.004533e0
mov eax, edi
mov ecx, 0xc
call fcn.004533e0
nop
call fcn.00450d80
jmp fcn.00508100
Function at 0x5147a0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x5148d2
sub rsp, 0x70
mov qword [rsp + 0x68], rbp
lea rbp, [rsp + 0x68]
movabs rdx, 0x6590973c829b8873
mov qword [rsp + 0x1c], rdx
movabs rdx, 0x5a6f72c66590973c
mov qword [rsp + 0x20], rdx
movabs rdx, 0xd969845a91c382f0
mov qword [rsp + 0x28], rdx
movabs rdx, 0xa86c70836fa986a1
mov qword [rsp + 0x30], rdx
movabs rdx, 0x72a3ab6d9ad0a778
mov qword [rsp + 0x38], rdx
movabs rdx, 0x13081d11180b1503
mov qword [rsp + 0x40], rdx
movabs rdx, 0x1d161f0514220810
mov qword [rsp + 0x48], rdx
movabs rdx, 0xf1e06080c1e211b
mov qword [rsp + 0x50], rdx
movabs rdx, 0x11020d040e010c04
mov qword [rsp + 0x58], rdx
movabs rdx, 0x181d100f13011815
mov qword [rsp + 0x60], rdx
xor eax, eax
jmp 0x51486f
movzx r9d, byte [rsp + rsi + 0x1c]
sub r9d, edx
lea edx, [r9 + 4]
mov byte [rsp + rdi + 0x1c], dl
lea edx, [r8 + 4]
mov byte [rsp + rsi + 0x1c], dl
add rax, 2
cmp rax, 0x28
jge 0x51489c
movzx edx, byte [rsp + rax + 0x40]
movzx esi, byte [rsp + rax + 0x41]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x24
jae 0x5148c5
movzx r8d, byte [rsp + rdi + 0x1c]
sub r8d, edx
cmp rsi, 0x24
jb 0x514852
jmp 0x5148b7
xor eax, eax
lea rbx, [rsp + 0x1c]
mov ecx, 0x24
call fcn.00441880
mov rbp, qword [rsp + 0x68]
add rsp, 0x70
ret
mov eax, esi
mov ecx, 0x24
nop
call fcn.004533e0
mov eax, edi
mov ecx, 0x24
call fcn.004533e0
nop
call fcn.00450d80
jmp fcn.005147a0

Function at 0x5148e0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x514a06
sub rsp, 0x68
mov qword [rsp + 0x60], rbp
lea rbp, [rsp + 0x60]
movabs rdx, 0xc82078a84c6e7908
mov qword [rsp + 0x1f], rdx
movabs rdx, 0xbba428e99afe05b7
mov qword [rsp + 0x27], rdx
movabs rdx, 0x674613bc6ebba428
mov qword [rsp + 0x2c], rdx
movabs rdx, 0x60166500b76f4faf
mov qword [rsp + 0x34], rdx
movabs rdx, 0x150e130b07180c04
mov qword [rsp + 0x3c], rdx
movabs rdx, 0x11161319150e130b
mov qword [rsp + 0x40], rdx
movabs rdx, 0x1b090b0812031c15
mov qword [rsp + 0x48], rdx
movabs rdx, 0x11150a0f080e1208
mov qword [rsp + 0x50], rdx
movabs rdx, 0x180b0a160d110007
mov qword [rsp + 0x58], rdx
xor eax, eax
jmp 0x5149a0
movzx r9d, byte [rsp + rsi + 0x1f]
sub r9d, edx
lea edx, [r9 - 0x80]
mov byte [rsp + rdi + 0x1f], dl
lea edx, [r8 - 0x80]
mov byte [rsp + rsi + 0x1f], dl
add rax, 2
cmp rax, 0x24
jge 0x5149cd
movzx edx, byte [rsp + rax + 0x3c]
movzx esi, byte [rsp + rax + 0x3d]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x1d
jae 0x5149f4
movzx r8d, byte [rsp + rdi + 0x1f]
sub r8d, edx
cmp rsi, 0x1d
jb 0x514983
jmp 0x5149e8
xor eax, eax
lea rbx, [rsp + 0x1f]
mov ecx, 0x1d
call fcn.00441880
mov rbp, qword [rsp + 0x60]
add rsp, 0x68
ret
mov eax, esi
mov ecx, 0x1d
call fcn.004533e0
mov eax, edi
mov ecx, 0x1d
nop dword [rax + rax]
call fcn.004533e0
nop
call fcn.00450d80
jmp fcn.005148e0
Function at 0x515100
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x515208
sub rsp, 0x58
mov qword [rsp + 0x50], rbp
lea rbp, [rsp + 0x50]
movabs rdx, 0xb08a861066ed8e6
mov qword [rsp + 0x1b], rdx
movabs rdx, 0xd3b168a2ef4e200b
mov qword [rsp + 0x22], rdx
movabs rdx, 0x1617faa80e8a9a1f
mov qword [rsp + 0x2a], rdx
movabs rdx, 0xb0507140d101100
mov qword [rsp + 0x32], rdx
movabs rdx, 0x130615030e000906
mov qword [rsp + 0x3a], rdx
movabs rdx, 0x130d06120c0d1306
mov qword [rsp + 0x40], rdx
movabs rdx, 0xb0501100f130a16
mov qword [rsp + 0x48], rdx
xor eax, eax
jmp 0x5151a2
movzx r9d, byte [rsp + rsi + 0x1b]
sub r9d, edx
lea edx, [r9 - 0x7f]
mov byte [rsp + rdi + 0x1b], dl
lea edx, [r8 - 0x7f]
mov byte [rsp + rsi + 0x1b], dl
add rax, 2
cmp rax, 0x1e
jge 0x5151cf
movzx edx, byte [rsp + rax + 0x32]
movzx esi, byte [rsp + rax + 0x33]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x17
jae 0x5151fb
movzx r8d, byte [rsp + rdi + 0x1b]
sub r8d, edx
cmp rsi, 0x17
jb 0x515185
jmp 0x5151ef
xor eax, eax
lea rbx, [rsp + 0x1b]
mov ecx, 0x17
nop dword [rax + rax]
call fcn.00441880
mov rbp, qword [rsp + 0x50]
add rsp, 0x58
ret
mov eax, esi
mov ecx, 0x17
call fcn.004533e0
mov eax, edi
mov ecx, 0x17
call fcn.004533e0
nop
call fcn.00450d80
jmp fcn.00515100

Function at 0x515540
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x515608
sub rsp, 0x38
mov qword [rsp + 0x30], rbp
lea rbp, [rsp + 0x30]
movabs rdx, 0x3a7ed67817651320
mov qword [rsp + 0x1d], rdx
mov byte [rsp + 0x25], 0x20
movabs rdx, 0x506010606010401
mov qword [rsp + 0x26], rdx
mov word [rsp + 0x2e], 0x603
xor eax, eax
jmp 0x5155a3
movzx r9d, byte [rsp + rsi + 0x1d]
sub r9d, edx
lea edx, [r9 + 0x5a]
mov byte [rsp + rdi + 0x1d], dl
lea edx, [r8 + 0x5a]
mov byte [rsp + rsi + 0x1d], dl
add rax, 2
cmp rax, 0xa
jge 0x5155d0
movzx edx, byte [rsp + rax + 0x26]
movzx esi, byte [rsp + rax + 0x27]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 9
jae 0x5155fb
movzx r8d, byte [rsp + rdi + 0x1d]
sub r8d, edx
cmp rsi, 9
jb 0x515586
jmp 0x5155ef
xor eax, eax
lea rbx, [rsp + 0x1d]
mov ecx, 9
nop dword [rax]
call fcn.00441880
mov rbp, qword [rsp + 0x30]
add rsp, 0x38
ret
mov eax, esi
mov ecx, 9
call fcn.004533e0
mov eax, edi
mov ecx, 9
call fcn.004533e0
nop
call fcn.00450d80
jmp fcn.00515540