joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4ec780
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4ec866
push rbp
mov rbp, rsp
sub rsp, 0x40
movabs rdx, 0x6572e9755a4c6747
mov qword [rsp + 0x1e], rdx
movabs rdx, 0x6461657240676528
mov qword [rsp + 0x26], rdx
movabs rdx, 0x501080a08020809
mov qword [rsp + 0x2e], rdx
movabs rdx, 0x1030501080a0802
mov qword [rsp + 0x30], rdx
movabs rdx, 0x90a0309030b0b03
mov qword [rsp + 0x38], rdx
xor eax, eax
nop
jmp 0x4ec800
movzx r9d, byte [rsp + rsi + 0x1e]
lea edx, [r9 + rdx]
lea edx, [rdx + 1]
mov byte [rsp + rdi + 0x1e], dl
mov byte [rsp + rsi + 0x1e], r8b
add rax, 2
nop dword [rax]
cmp rax, 0x12
jge 0x4ec832
movzx edx, byte [rsp + rax + 0x2e]
movzx esi, byte [rsp + rax + 0x2f]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x10
jae 0x4ec857
movzx r8d, byte [rsp + rdi + 0x1e]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 1]
cmp rsi, 0x10
jb 0x4ec7e2
jmp 0x4ec84b
xor eax, eax
lea rbx, [rsp + 0x1e]
mov ecx, 0x10
nop
call fcn.00441400
add rsp, 0x40
pop rbp
ret
mov eax, esi
mov ecx, 0x10
call fcn.00451920
mov eax, edi
mov ecx, 0x10
nop
call fcn.00451920
nop
call fcn.0044f6a0
jmp fcn.004ec780

Function at 0x4ed780
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4ed84c
push rbp
mov rbp, rsp
sub rsp, 0x38
movabs rdx, 0x65e6fc4652041347
mov qword [rsp + 0x1f], rdx
movabs rdx, 0x534c4565e6fc4652
mov qword [rsp + 0x22], rdx
movabs rdx, 0x600050106050201
mov qword [rsp + 0x2a], rdx
movabs rdx, 0x2030a0105090600
mov qword [rsp + 0x30], rdx
xor eax, eax
jmp 0x4ed7ef
movzx r9d, byte [rsp + rsi + 0x1f]
sub r9d, edx
lea edx, [r9 + 0x31]
mov byte [rsp + rdi + 0x1f], dl
lea edx, [r8 + 0x31]
mov byte [rsp + rsi + 0x1f], dl
add rax, 2
cmp rax, 0xe
jge 0x4ed81c
movzx edx, byte [rsp + rax + 0x2a]
movzx esi, byte [rsp + rax + 0x2b]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0xb
jae 0x4ed83f
movzx r8d, byte [rsp + rdi + 0x1f]
sub r8d, edx
cmp rsi, 0xb
jb 0x4ed7d2
jmp 0x4ed833
xor eax, eax
lea rbx, [rsp + 0x1f]
mov ecx, 0xb
call fcn.00441400
add rsp, 0x38
pop rbp
ret
mov eax, esi
mov ecx, 0xb
call fcn.00451920
mov eax, edi
mov ecx, 0xb
call fcn.00451920
nop
call fcn.0044f6a0
jmp fcn.004ed780
Function at 0x4ed860
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4ed94c
push rbp
mov rbp, rsp
sub rsp, 0x40
movabs rdx, 0x25796869746c0c4d
mov qword [rsp + 0x19], rdx
movabs rdx, 0x3354252579686974
mov qword [rsp + 0x1c], rdx
movabs rdx, 0x1e3a3a47e76469f3
mov qword [rsp + 0x24], rdx
movabs rdx, 0x70e1205050b0501
mov qword [rsp + 0x2c], rdx
movabs rdx, 0x7111111070e1205
mov qword [rsp + 0x30], rdx
movabs rdx, 0x100a0e120f08110b
mov qword [rsp + 0x38], rdx
xor eax, eax
jmp 0x4ed8ea
movzx r9d, byte [rsp + rsi + 0x19]
lea edx, [r9 + rdx]
lea edx, [rdx + 9]
mov byte [rsp + rdi + 0x19], dl
mov byte [rsp + rsi + 0x19], r8b
add rax, 2
cmp rax, 0x14
jge 0x4ed91c
movzx edx, byte [rsp + rax + 0x2c]
movzx esi, byte [rsp + rax + 0x2d]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x13
jae 0x4ed93f
movzx r8d, byte [rsp + rdi + 0x19]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 9]
cmp rsi, 0x13
jb 0x4ed8d0
jmp 0x4ed933
xor eax, eax
lea rbx, [rsp + 0x19]
mov ecx, 0x13
call fcn.00441400
add rsp, 0x40
pop rbp
ret
mov eax, esi
mov ecx, 0x13
call fcn.00451920
mov eax, edi
mov ecx, 0x13
call fcn.00451920
nop
call fcn.0044f6a0
jmp fcn.004ed860

Function at 0x4ee2a0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4ee367
push rbp
mov rbp, rsp
sub rsp, 0x38
movabs rdx, 0x6946857996845b85
mov qword [rsp + 0x1c], rdx
mov dword [rsp + 0x24], 0x9e778b6c
movabs rdx, 0x900020b050a050b
mov qword [rsp + 0x28], rdx
movabs rdx, 0x500010a030a0904
mov qword [rsp + 0x30], rdx
xor eax, eax
jmp 0x4ee308
movzx r9d, byte [rsp + rsi + 0x1c]
sub r9d, edx
lea edx, [r9 + 1]
mov byte [rsp + rdi + 0x1c], dl
lea edx, [r8 + 1]
mov byte [rsp + rsi + 0x1c], dl
add rax, 2
cmp rax, 0x10
jge 0x4ee337
movzx edx, byte [rsp + rax + 0x28]
movzx esi, byte [rsp + rax + 0x29]
mov edi, edx
xor edx, esi
add edx, eax
nop
cmp rdi, 0xc
jae 0x4ee35a
movzx r8d, byte [rsp + rdi + 0x1c]
sub r8d, edx
cmp rsi, 0xc
jb 0x4ee2eb
jmp 0x4ee34e
xor eax, eax
lea rbx, [rsp + 0x1c]
mov ecx, 0xc
call fcn.00441400
add rsp, 0x38
pop rbp
ret
mov eax, esi
mov ecx, 0xc
call fcn.00451920
mov eax, edi
mov ecx, 0xc
call fcn.00451920
nop
call fcn.0044f6a0
jmp fcn.004ee2a0
Function at 0x4ee740
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4ee80c
push rbp
mov rbp, rsp
sub rsp, 0x38
movabs rdx, 0x137229d27374134e
mov qword [rsp + 0x1f], rdx
movabs rdx, 0xd607d2137229d273
mov qword [rsp + 0x22], rdx
movabs rdx, 0x808090301070a04
mov qword [rsp + 0x2a], rdx
movabs rdx, 0x40804090a050808
mov qword [rsp + 0x30], rdx
xor eax, eax
jmp 0x4ee7af
movzx r9d, byte [rsp + rsi + 0x1f]
sub r9d, edx
lea edx, [r9 + 0x5a]
mov byte [rsp + rdi + 0x1f], dl
lea edx, [r8 + 0x5a]
mov byte [rsp + rsi + 0x1f], dl
add rax, 2
cmp rax, 0xe
jge 0x4ee7dc
movzx edx, byte [rsp + rax + 0x2a]
movzx esi, byte [rsp + rax + 0x2b]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0xb
jae 0x4ee7ff
movzx r8d, byte [rsp + rdi + 0x1f]
sub r8d, edx
cmp rsi, 0xb
jb 0x4ee792
jmp 0x4ee7f3
xor eax, eax
lea rbx, [rsp + 0x1f]
mov ecx, 0xb
call fcn.00441400
add rsp, 0x38
pop rbp
ret
mov eax, esi
mov ecx, 0xb
call fcn.00451920
mov eax, edi
mov ecx, 0xb
call fcn.00451920
nop
call fcn.0044f6a0
jmp fcn.004ee740

Function at 0x4f1800
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4f18ec
push rbp
mov rbp, rsp
sub rsp, 0x48
movabs rdx, 0x63da66a1a1caa50e
mov qword [rsp + 0x1e], rdx
movabs rdx, 0xdb9763da66a1a1ca
mov qword [rsp + 0x20], rdx
movabs rdx, 0x4e01dd66207bb373
mov qword [rsp + 0x28], rdx
movabs rdx, 0x10110f0f06110010
mov qword [rsp + 0x30], rdx
movabs rdx, 0xf0c010402030904
mov qword [rsp + 0x38], rdx
movabs rdx, 0xf0311000b080b00
mov qword [rsp + 0x40], rdx
xor eax, eax
jmp 0x4f188a
movzx r9d, byte [rsp + rsi + 0x1e]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x47]
mov byte [rsp + rdi + 0x1e], dl
mov byte [rsp + rsi + 0x1e], r8b
add rax, 2
cmp rax, 0x18
jge 0x4f18bc
movzx edx, byte [rsp + rax + 0x30]
movzx esi, byte [rsp + rax + 0x31]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x12
jae 0x4f18df
movzx r8d, byte [rsp + rdi + 0x1e]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x47]
cmp rsi, 0x12
jb 0x4f1870
jmp 0x4f18d3
xor eax, eax
lea rbx, [rsp + 0x1e]
mov ecx, 0x12
call fcn.00441400
add rsp, 0x48
pop rbp
ret
mov eax, esi
mov ecx, 0x12
call fcn.00451920
mov eax, edi
mov ecx, 0x12
call fcn.00451920
nop
call fcn.0044f6a0
jmp fcn.004f1800
Function at 0x4f5380
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4f54b8
push rbp
mov rbp, rsp
sub rsp, 0x70
movabs rdx, 0x1dc5ac20f8c8fb91
mov qword [rsp + 0x1f], rdx
movabs rdx, 0x661dc5ac20f8c8fb
mov qword [rsp + 0x20], rdx
movabs rdx, 0x70bd06a1cf5b726f
mov qword [rsp + 0x28], rdx
movabs rdx, 0x664b64145f72e1fd
mov qword [rsp + 0x30], rdx
movabs rdx, 0x980dee74202b3869
mov qword [rsp + 0x38], rdx
movabs rdx, 0x7061f050f1e1e1e
mov qword [rsp + 0x40], rdx
movabs rdx, 0x171a020b1b1e1f00
mov qword [rsp + 0x48], rdx
movabs rdx, 0x17171a1a0207041f
mov qword [rsp + 0x50], rdx
movabs rdx, 0x72015140c07031a
mov qword [rsp + 0x58], rdx
movabs rdx, 0xe010f1e0d171f0f
mov qword [rsp + 0x60], rdx
movabs rdx, 0x1520111201120f1f
mov qword [rsp + 0x68], rdx
xor eax, eax
jmp 0x4f5455
movzx r9d, byte [rsp + rsi + 0x1f]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x43]
mov byte [rsp + rdi + 0x1f], dl
mov byte [rsp + rsi + 0x1f], r8b
add rax, 2
cmp rax, 0x30
jge 0x4f5488
movzx edx, byte [rsp + rax + 0x40]
movzx esi, byte [rsp + rax + 0x41]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x21
jae 0x4f54ab
movzx r8d, byte [rsp + rdi + 0x1f]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x43]
nop
cmp rsi, 0x21
jb 0x4f543b
jmp 0x4f549f
xor eax, eax
lea rbx, [rsp + 0x1f]
mov ecx, 0x21
call fcn.00441400
add rsp, 0x70
pop rbp
ret
mov eax, esi
mov ecx, 0x21
call fcn.00451920
mov eax, edi
mov ecx, 0x21
call fcn.00451920
nop
call fcn.0044f6a0
nop dword [rax]
jmp fcn.004f5380

Function at 0x4f54e0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4f55e8
push rbp
mov rbp, rsp
sub rsp, 0x58
movabs rdx, 0x65e0e4dd80d36e69
mov qword [rsp + 0x1f], rdx
movabs rdx, 0x5756edee746ecd74
mov qword [rsp + 0x27], rdx
movabs rdx, 0xfc5756edee746ecd
mov qword [rsp + 0x28], rdx
movabs rdx, 0x196564999764ec50
mov qword [rsp + 0x30], rdx
movabs rdx, 0x150c07160e0f1811
mov qword [rsp + 0x38], rdx
movabs rdx, 0x909060211140512
mov qword [rsp + 0x40], rdx
movabs rdx, 0x30d15071203180f
mov qword [rsp + 0x48], rdx
movabs rdx, 0xe12041604021007
mov qword [rsp + 0x50], rdx
xor eax, eax
jmp 0x4f558b
movzx r9d, byte [rsp + rsi + 0x1f]
sub r9d, edx
lea edx, [r9 - 0x5a]
mov byte [rsp + rdi + 0x1f], dl
lea edx, [r8 - 0x5a]
mov byte [rsp + rsi + 0x1f], dl
add rax, 2
cmp rax, 0x20
jge 0x4f55b8
movzx edx, byte [rsp + rax + 0x38]
movzx esi, byte [rsp + rax + 0x39]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x19
jae 0x4f55db
movzx r8d, byte [rsp + rdi + 0x1f]
sub r8d, edx
cmp rsi, 0x19
jb 0x4f556e
jmp 0x4f55cf
xor eax, eax
lea rbx, [rsp + 0x1f]
mov ecx, 0x19
call fcn.00441400
add rsp, 0x58
pop rbp
ret
mov eax, esi
mov ecx, 0x19
call fcn.00451920
mov eax, edi
mov ecx, 0x19
call fcn.00451920
nop
call fcn.0044f6a0
jmp fcn.004f54e0
Function at 0x4f7f40
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4f805d
push rbp
mov rbp, rsp
sub rsp, 0x60
movabs rdx, 0xa26f9f1fd6ee73b1
mov qword [rsp + 0x1c], rdx
movabs rdx, 0x65d9ee8220eba865
mov qword [rsp + 0x24], rdx
movabs rdx, 0x577904d465d9ee82
mov qword [rsp + 0x28], rdx
movabs rdx, 0x64cff4ff9d628366
mov qword [rsp + 0x30], rdx
movabs rdx, 0x171318041510030c
mov qword [rsp + 0x38], rdx
movabs rdx, 0x717180d030e0915
mov qword [rsp + 0x40], rdx
movabs rdx, 0x1103190c13021800
mov qword [rsp + 0x48], rdx
movabs rdx, 0xa0e0a0e050c0318
mov qword [rsp + 0x50], rdx
movabs rdx, 0x1a040e0d1613070d
mov qword [rsp + 0x58], rdx
xor eax, eax
jmp 0x4f8000
movzx r9d, byte [rsp + rsi + 0x1c]
sub r9d, edx
lea edx, [r9 - 0x1b]
mov byte [rsp + rdi + 0x1c], dl
lea edx, [r8 - 0x1b]
mov byte [rsp + rsi + 0x1c], dl
add rax, 2
nop word [rax + rax]
cmp rax, 0x28
jge 0x4f802d
movzx edx, byte [rsp + rax + 0x38]
movzx esi, byte [rsp + rax + 0x39]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x1c
jae 0x4f8050
movzx r8d, byte [rsp + rdi + 0x1c]
sub r8d, edx
cmp rsi, 0x1c
jb 0x4f7fdd
jmp 0x4f8044
xor eax, eax
lea rbx, [rsp + 0x1c]
mov ecx, 0x1c
call fcn.00441400
add rsp, 0x60
pop rbp
ret
mov eax, esi
mov ecx, 0x1c
call fcn.00451920
mov eax, edi
mov ecx, 0x1c
call fcn.00451920
nop
nop dword [rax]
call fcn.0044f6a0
jmp fcn.004f7f40

Function at 0x4f87a0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4f885d
push rbp
mov rbp, rsp
sub rsp, 0x30
movabs rdx, 0x64cd210ed3651a81
mov qword [rsp + 0x1a], rdx
mov word [rsp + 0x22], 0x6e2c
movabs rdx, 0x304040101050003
mov qword [rsp + 0x24], rdx
mov dword [rsp + 0x2c], 0x8030603
xor eax, eax
jmp 0x4f8800
movzx r9d, byte [rsp + rsi + 0x1a]
sub r9d, edx
lea edx, [r9 + 0x5f]
mov byte [rsp + rdi + 0x1a], dl
lea edx, [r8 + 0x5f]
mov byte [rsp + rsi + 0x1a], dl
add rax, 2
cmp rax, 0xc
jge 0x4f882d
movzx edx, byte [rsp + rax + 0x24]
movzx esi, byte [rsp + rax + 0x25]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0xa
jae 0x4f8850
movzx r8d, byte [rsp + rdi + 0x1a]
sub r8d, edx
cmp rsi, 0xa
jb 0x4f87e3
jmp 0x4f8844
xor eax, eax
lea rbx, [rsp + 0x1a]
mov ecx, 0xa
call fcn.00441400
add rsp, 0x30
pop rbp
ret
mov eax, esi
mov ecx, 0xa
call fcn.00451920
mov eax, edi
mov ecx, 0xa
call fcn.00451920
nop
nop dword [rax]
call fcn.0044f6a0
jmp fcn.004f87a0
Function at 0x4f8c80
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4f8d4c
push rbp
mov rbp, rsp
sub rsp, 0x38
movabs rdx, 0x24ce73ed62dd645d
mov qword [rsp + 0x1d], rdx
movabs rdx, 0x5d0e5d24ce73ed62
mov qword [rsp + 0x20], rdx
movabs rdx, 0x307080709090602
mov qword [rsp + 0x28], rdx
movabs rdx, 0x709080409000a04
mov qword [rsp + 0x30], rdx
xor eax, eax
jmp 0x4f8cef
movzx r9d, byte [rsp + rsi + 0x1d]
sub r9d, edx
lea edx, [r9 - 0x65]
mov byte [rsp + rdi + 0x1d], dl
lea edx, [r8 - 0x65]
mov byte [rsp + rsi + 0x1d], dl
add rax, 2
cmp rax, 0x10
jge 0x4f8d1c
movzx edx, byte [rsp + rax + 0x28]
movzx esi, byte [rsp + rax + 0x29]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0xb
jae 0x4f8d3f
movzx r8d, byte [rsp + rdi + 0x1d]
sub r8d, edx
cmp rsi, 0xb
jb 0x4f8cd2
jmp 0x4f8d33
xor eax, eax
lea rbx, [rsp + 0x1d]
mov ecx, 0xb
call fcn.00441400
add rsp, 0x38
pop rbp
ret
mov eax, esi
mov ecx, 0xb
call fcn.00451920
mov eax, edi
mov ecx, 0xb
call fcn.00451920
nop
call fcn.0044f6a0
jmp fcn.004f8c80

Function at 0x4f8e60
Capabilities:
Encrypt data using rc4 prga

Disassembly:
lea r12, [rsp - 0x20]
cmp r12, qword [r14 + 0x10]
jbe 0x4f8ffb
push rbp
mov rbp, rsp
sub rsp, 0x98
movabs rdx, 0x61d69669cd3a2da9
mov qword [rsp + 0x1b], rdx
movabs rdx, 0x953075201f69cf61
mov qword [rsp + 0x22], rdx
movabs rdx, 0x1e7bfe5761cd78d7
mov qword [rsp + 0x2a], rdx
movabs rdx, 0xc0206ef1e3a1b831
mov qword [rsp + 0x32], rdx
movabs rdx, 0xb46570d4650f6cb9
mov qword [rsp + 0x3a], rdx
movabs rdx, 0xac684669cc20d0f7
mov qword [rsp + 0x42], rdx
movabs rdx, 0x704e3cbba06e5f9e
mov qword [rsp + 0x4a], rdx
movabs rdx, 0x220e1a0d16081f26
mov qword [rsp + 0x52], rdx
movabs rdx, 0x320627190e01220e
mov qword [rsp + 0x58], rdx
movabs rdx, 0x14331b2e08210f16
mov qword [rsp + 0x60], rdx
movabs rdx, 0xd030a0e28332c0e
mov qword [rsp + 0x68], rdx
movabs rdx, 0x832101a19062a23
mov qword [rsp + 0x70], rdx
movabs rdx, 0x181e2f0e190e212e
mov qword [rsp + 0x78], rdx
movabs rdx, 0x220f0f11012f3118
mov qword [rsp + 0x80], rdx
movabs rdx, 0xa36150a332f1632
mov qword [rsp + 0x88], rdx
movabs rdx, 0x500123411052217
mov qword [rsp + 0x90], rdx
xor eax, eax
jmp 0x4f8f91
movzx r9d, byte [rsp + rsi + 0x1b]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x7c]
mov byte [rsp + rdi + 0x1b], dl
mov byte [rsp + rsi + 0x1b], r8b
add rax, 2
cmp rax, 0x46
jge 0x4f8fc8
movzx edx, byte [rsp + rax + 0x52]
movzx esi, byte [rsp + rax + 0x53]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x37
jae 0x4f8fee
movzx r8d, byte [rsp + rdi + 0x1b]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x7c]
nop dword [rax + rax]
cmp rsi, 0x37
jb 0x4f8f77
jmp 0x4f8fe2
xor eax, eax
lea rbx, [rsp + 0x1b]
mov ecx, 0x37
call fcn.00441400
add rsp, 0x98
pop rbp
ret
mov eax, esi
mov ecx, 0x37
call fcn.00451920
mov eax, edi
mov ecx, 0x37
call fcn.00451920
nop
nop dword [rax + rax]
call fcn.0044f6a0
jmp fcn.004f8e60
Function at 0x505dc0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x505eac
push rbp
mov rbp, rsp
sub rsp, 0x40
movabs rdx, 0x374ae03443321cf4
mov qword [rsp + 0x1d], rdx
movabs rdx, 0x38374ae03443321c
mov qword [rsp + 0x1e], rdx
movabs rdx, 0x781c18641062fe39
mov qword [rsp + 0x26], rdx
movabs rdx, 0x50c0c0c060a0e00
mov qword [rsp + 0x2e], rdx
movabs rdx, 0xc03050c0c0c060a
mov qword [rsp + 0x30], rdx
movabs rdx, 0x3060e01010f0100
mov qword [rsp + 0x38], rdx
xor eax, eax
jmp 0x505e4a
movzx r9d, byte [rsp + rsi + 0x1d]
lea edx, [r9 + rdx]
lea edx, [rdx + 9]
mov byte [rsp + rdi + 0x1d], dl
mov byte [rsp + rsi + 0x1d], r8b
add rax, 2
cmp rax, 0x12
jge 0x505e7c
movzx edx, byte [rsp + rax + 0x2e]
movzx esi, byte [rsp + rax + 0x2f]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x11
jae 0x505e9f
movzx r8d, byte [rsp + rdi + 0x1d]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 9]
cmp rsi, 0x11
jb 0x505e30
jmp 0x505e93
xor eax, eax
lea rbx, [rsp + 0x1d]
mov ecx, 0x11
call fcn.00441400
add rsp, 0x40
pop rbp
ret
mov eax, esi
mov ecx, 0x11
call fcn.00451920
mov eax, edi
mov ecx, 0x11
call fcn.00451920
nop
call fcn.0044f6a0
jmp fcn.00505dc0
Function at 0x50bcc0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x50bd8c
push rbp
mov rbp, rsp
sub rsp, 0x38
movabs rdx, 0x6f646e5664626544
mov qword [rsp + 0x2a], rdx
movabs rdx, 0x5757576a50456f64
mov qword [rsp + 0x30], rdx
movabs rdx, 0x8030b030c0b080c
mov qword [rsp + 0x1c], rdx
movabs rdx, 0x30a0a040c020803
mov qword [rsp + 0x22], rdx
xor eax, eax
jmp 0x50bd2f
movzx r9d, byte [rsp + rsi + 0x2a]
sub r9d, edx
lea edx, [r9 + 0x17]
mov byte [rsp + rdi + 0x2a], dl
lea edx, [r8 + 0x17]
mov byte [rsp + rsi + 0x2a], dl
add rax, 2
cmp rax, 0xe
jge 0x50bd5c
movzx edx, byte [rsp + rax + 0x1c]
movzx esi, byte [rsp + rax + 0x1d]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0xe
jae 0x50bd7f
movzx r8d, byte [rsp + rdi + 0x2a]
sub r8d, edx
cmp rsi, 0xe
jb 0x50bd12
jmp 0x50bd73
xor eax, eax
lea rbx, [rsp + 0x2a]
mov ecx, 0xe
call fcn.00441400
add rsp, 0x38
pop rbp
ret
mov eax, esi
mov ecx, 0xe
call fcn.00451920
mov eax, edi
mov ecx, 0xe
call fcn.00451920
nop
call fcn.0044f6a0
jmp fcn.0050bcc0

Function at 0x50c880
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x50c952
push rbp
mov rbp, rsp
sub rsp, 0x38
movabs rdx, 0x5a616a475f475a47
mov qword [rsp + 0x1f], rdx
movabs rdx, 0x6265565a616a475f
mov qword [rsp + 0x22], rdx
movabs rdx, 0x304080202060807
mov qword [rsp + 0x2a], rdx
movabs rdx, 0x60a050201070304
mov qword [rsp + 0x30], rdx
xor eax, eax
jmp 0x50c8ec
movzx r9d, byte [rsp + rsi + 0x1f]
lea edx, [r9 + rdx]
lea edx, [rdx - 7]
mov byte [rsp + rdi + 0x1f], dl
mov byte [rsp + rsi + 0x1f], r8b
add rax, 2
cmp rax, 0xe
jge 0x50c91e
movzx edx, byte [rsp + rax + 0x2a]
movzx esi, byte [rsp + rax + 0x2b]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0xb
jae 0x50c945
movzx r8d, byte [rsp + rdi + 0x1f]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 7]
cmp rsi, 0xb
jb 0x50c8d2
jmp 0x50c935
xor eax, eax
lea rbx, [rsp + 0x1f]
mov ecx, 0xb
call fcn.00441400
add rsp, 0x38
pop rbp
ret
mov eax, esi
mov ecx, 0xb
nop dword [rax]
call fcn.00451920
mov eax, edi
mov ecx, 0xb
call fcn.00451920
nop
call fcn.0044f6a0
jmp fcn.0050c880

Function at 0x50d160
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x50d227
push rbp
mov rbp, rsp
sub rsp, 0x30
movabs rdx, 0x7861f94964616f7d
mov qword [rsp + 0x18], rdx
mov word [rsp + 0x20], 0x5775
movabs rdx, 0x705070108070007
mov qword [rsp + 0x22], rdx
movabs rdx, 0x701050800070705
mov qword [rsp + 0x28], rdx
xor eax, eax
jmp 0x50d1c7
movzx r9d, byte [rsp + rsi + 0x18]
sub r9d, edx
lea edx, [r9 - 0x4b]
mov byte [rsp + rdi + 0x18], dl
lea edx, [r8 - 0x4b]
mov byte [rsp + rsi + 0x18], dl
add rax, 2
cmp rax, 0xe
jge 0x50d1f7
movzx edx, byte [rsp + rax + 0x22]
movzx esi, byte [rsp + rax + 0x23]
mov edi, edx
xor edx, esi
add edx, eax
nop dword [rax]
cmp rdi, 0xa
jae 0x50d21a
movzx r8d, byte [rsp + rdi + 0x18]
sub r8d, edx
cmp rsi, 0xa
jb 0x50d1aa
jmp 0x50d20e
xor eax, eax
lea rbx, [rsp + 0x18]
mov ecx, 0xa
call fcn.00441400
add rsp, 0x30
pop rbp
ret
mov eax, esi
mov ecx, 0xa
call fcn.00451920
mov eax, edi
mov ecx, 0xa
call fcn.00451920
nop
call fcn.0044f6a0
jmp fcn.0050d160
Function at 0x140001050
Capabilities:
Encode data using xor

Disassembly:
shl rcx, 4
xor eax, eax
and ecx, 0xff0
add r8, rcx
lea r9, [rdx + rax]
lea r10, [rax + r8]
xor ecx, ecx
mov r11b, byte [r10 + rcx]
inc rcx
xor byte [r9], r11b
inc r9
cmp rcx, 4
jne 0x140001069
add rax, 4
cmp rax, 0x10
jne 0x14000105f
ret

Function at 0x1400011e0
Capabilities:
Encode data using xor
Encrypt data using aes
Reference aes constants

Disassembly:
push rbp
lea rax, [rdx + r8]
mov rbp, rsp
push r15
push r14
push r13
push r12
push rdi
push rsi
mov rsi, rdx
push rbx
mov rbx, rcx
and rsp, 0xfffffffffffffff0
sub rsp, 0x40
lea rdi, [rsp + 0x30]
mov qword [rsp + 0x28], rax
mov eax, 0x10
mov qword [rsp + 0x20], rdi
cmp qword [rsp + 0x28], rsi
je 0x1400013ff
cmp eax, 0x10
jne 0x1400013ec
movups xmm0, xmmword [rbx + 0xf0]
mov r8, rbx
xor ecx, ecx
mov r12b, 0x1b
lea rdx, [rsp + 0x30]
mov r14d, 1
lea rdi, [rsp + 0x34]
movups xmmword [rsp + 0x30], xmm0
lea r13, str.cw
call fcn.140001050
lea rdx, [rsp + 0x30]
mov rcx, rdx
mov rax, rcx
xor r8d, r8d
movzx r9d, byte [rax]
inc r8d
add rax, 4
mov r9b, byte [r13 + r9]
mov byte [rax - 4], r9b
cmp r8b, 4
jne 0x140001267
inc rcx
cmp rdi, rcx
jne 0x140001261
mov cl, byte [rsp + 0x35]
mov al, byte [rsp + 0x31]
mov byte [rsp + 0x31], cl
mov cl, byte [rsp + 0x39]
mov byte [rsp + 0x35], cl
mov cl, byte [rsp + 0x3d]
mov byte [rsp + 0x3d], al
mov al, byte [rsp + 0x32]
mov byte [rsp + 0x39], cl
mov cl, byte [rsp + 0x3a]
mov byte [rsp + 0x3a], al
mov al, byte [rsp + 0x36]
mov byte [rsp + 0x32], cl
mov cl, byte [rsp + 0x3e]
mov byte [rsp + 0x3e], al
mov al, byte [rsp + 0x33]
mov byte [rsp + 0x36], cl
mov cl, byte [rsp + 0x3f]
mov byte [rsp + 0x33], cl
mov cl, byte [rsp + 0x3b]
mov byte [rsp + 0x3f], cl
mov cl, byte [rsp + 0x37]
mov byte [rsp + 0x37], al
mov byte [rsp + 0x3b], cl
cmp r14d, 0xe
je 0x1400013b1
lea r11, [rdx + 0x10]
mov cl, byte [rdx]
mov r9b, byte [rdx + 1]
add rdx, 4
mov r8b, byte [rdx - 2]
xor r8b, byte [rdx - 1]
xor r9d, ecx
mov r15d, ecx
xor cl, byte [rdx - 1]
mov eax, r9d
mov r10d, r9d
add r9d, r9d
shr al, 7
xor r10d, r8d
imul eax, r12d
xor r15d, r10d
xor r15d, eax
xor r9d, r15d
mov r15b, byte [rdx - 3]
xor r15b, byte [rdx - 2]
mov eax, r15d
mov byte [rdx - 4], r9b
mov r9b, byte [rdx - 3]
add r15d, r15d
shr al, 7
imul eax, r12d
xor r9d, r10d
xor r9d, eax
mov eax, r8d
add r8d, r8d
shr al, 7
xor r15d, r9d
mov r9b, byte [rdx - 2]
imul eax, r12d
mov byte [rdx - 3], r15b
xor r9d, r10d
xor r10b, byte [rdx - 1]
xor r9d, eax
mov eax, ecx
add ecx, ecx
shr al, 7
xor r8d, r9d
imul eax, r12d
mov byte [rdx - 2], r8b
mov r8d, r10d
xor eax, r8d
xor ecx, eax
mov byte [rdx - 1], cl
cmp r11, rdx
jne 0x1400012f7
mov rdx, qword [rsp + 0x20]
mov ecx, r14d
mov r8, rbx
inc r14d
call fcn.140001050
jmp 0x140001259
mov r8, rbx
mov ecx, 0xe
call fcn.140001050
mov eax, 0xf
mov dl, byte [rbx + rax + 0xf0]
cmp dl, 0xff
jne 0x1400013df
mov byte [rbx + rax + 0xf0], 0
sub rax, 1
jae 0x1400013c3
jmp 0x1400013ea
cdqe
inc edx
mov byte [rbx + rax + 0xf0], dl
xor eax, eax
movsxd rdx, eax
inc eax
mov dl, byte [rsp + rdx + 0x30]
xor byte [rsi], dl
inc rsi
jmp 0x140001215
lea rsp, [rbp - 0x38]
pop rbx
pop rsi
pop rdi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret