joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4f83a0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4f848a
push rbp
mov rbp, rsp
sub rsp, 0x40
movabs rdx, 0xf76d756e8041d6f0
mov qword [rsp + 0x2f], rdx
movabs rdx, 0xbf76d756e8041d6
mov qword [rsp + 0x30], rdx
movabs rdx, 0xd5736cfa636f018d
mov qword [rsp + 0x38], rdx
movabs rdx, 0xa07070a0310080a
mov qword [rsp + 0x1b], rdx
movabs rdx, 0x80801010a07070a
mov qword [rsp + 0x1f], rdx
movabs rdx, 0x707080d0010090d
mov qword [rsp + 0x27], rdx
xor eax, eax
jmp 0x4f842d
movzx r9d, byte [rsp + rsi + 0x2f]
sub r9d, edx
lea edx, [r9 - 0x7b]
mov byte [rsp + rdi + 0x2f], dl
lea edx, [r8 - 0x7b]
mov byte [rsp + rsi + 0x2f], dl
add rax, 2
cmp rax, 0x14
jge 0x4f845a
movzx edx, byte [rsp + rax + 0x1b]
movzx esi, byte [rsp + rax + 0x1c]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x11
jae 0x4f847d
movzx r8d, byte [rsp + rdi + 0x2f]
sub r8d, edx
cmp rsi, 0x11
jb 0x4f8410
jmp 0x4f8471
xor eax, eax
lea rbx, [rsp + 0x2f]
mov ecx, 0x11
call fcn.00447380
add rsp, 0x40
pop rbp
ret
mov eax, esi
mov ecx, 0x11
call fcn.0045a8c0
mov eax, edi
mov ecx, 0x11
call fcn.0045a8c0
nop
call fcn.004585e0
jmp fcn.004f83a0

Function at 0x4f84a0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4f8558
push rbp
mov rbp, rsp
sub rsp, 0x30
movabs rdx, 0x67caf7747f75d657
mov qword [rsp + 0x28], rdx
movabs rdx, 0x405060207030203
mov qword [rsp + 0x1c], rdx
mov dword [rsp + 0x24], 0x3010505
xor eax, eax
jmp 0x4f84f9
movzx r9d, byte [rsp + rsi + 0x28]
sub r9d, edx
lea edx, [r9 + 0x7f]
mov byte [rsp + rdi + 0x28], dl
lea edx, [r8 + 0x7f]
mov byte [rsp + rsi + 0x28], dl
add rax, 2
cmp rax, 0xc
jge 0x4f8528
movzx edx, byte [rsp + rax + 0x1c]
movzx esi, byte [rsp + rax + 0x1d]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 8
jae 0x4f854b
movzx r8d, byte [rsp + rdi + 0x28]
sub r8d, edx
nop
cmp rsi, 8
jb 0x4f84dc
jmp 0x4f853f
xor eax, eax
lea rbx, [rsp + 0x28]
mov ecx, 8
call fcn.00447380
add rsp, 0x30
pop rbp
ret
mov eax, esi
mov ecx, 8
call fcn.0045a8c0
mov eax, edi
mov ecx, 8
call fcn.0045a8c0
nop
call fcn.004585e0
nop dword [rax]
jmp fcn.004f84a0

Function at 0x4f8f40
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4f8ffe
push rbp
mov rbp, rsp
sub rsp, 0x30
movabs rdx, 0x8fd6599010292a7
mov qword [rsp + 0x25], rdx
mov dword [rsp + 0x2c], 0x176d1008
movabs rdx, 0x308060401060702
mov qword [rsp + 0x19], rdx
mov dword [rsp + 0x21], 0xa060600
xor eax, eax
jmp 0x4f8fa1
movzx r9d, byte [rsp + rsi + 0x25]
sub r9d, edx
lea edx, [r9 + 0x71]
mov byte [rsp + rdi + 0x25], dl
lea edx, [r8 + 0x71]
mov byte [rsp + rsi + 0x25], dl
add rax, 2
cmp rax, 0xc
jge 0x4f8fce
movzx edx, byte [rsp + rax + 0x19]
movzx esi, byte [rsp + rax + 0x1a]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0xb
jae 0x4f8ff1
movzx r8d, byte [rsp + rdi + 0x25]
sub r8d, edx
cmp rsi, 0xb
jb 0x4f8f84
jmp 0x4f8fe5
xor eax, eax
lea rbx, [rsp + 0x25]
mov ecx, 0xb
call fcn.00447380
add rsp, 0x30
pop rbp
ret
mov eax, esi
mov ecx, 0xb
call fcn.0045a8c0
mov eax, edi
mov ecx, 0xb
call fcn.0045a8c0
nop
nop
call fcn.004585e0
jmp fcn.004f8f40
Function at 0x4f9c40
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4f9d06
push rbp
mov rbp, rsp
sub rsp, 0x30
movabs rdx, 0x72a4639172747c7a
mov qword [rsp + 0x26], rdx
mov word [rsp + 0x2e], 0x7472
movabs rdx, 0x404070108060604
mov qword [rsp + 0x1a], rdx
mov dword [rsp + 0x22], 0x8030400
xor eax, eax
jmp 0x4f9ca0
movzx r9d, byte [rsp + rsi + 0x26]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x17]
mov byte [rsp + rdi + 0x26], dl
mov byte [rsp + rsi + 0x26], r8b
add rax, 2
nop dword [rax]
cmp rax, 0xc
jge 0x4f9cd2
movzx edx, byte [rsp + rax + 0x1a]
movzx esi, byte [rsp + rax + 0x1b]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0xa
jae 0x4f9cf7
movzx r8d, byte [rsp + rdi + 0x26]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x17]
cmp rsi, 0xa
jb 0x4f9c83
jmp 0x4f9ceb
xor eax, eax
lea rbx, [rsp + 0x26]
mov ecx, 0xa
nop
call fcn.00447380
add rsp, 0x30
pop rbp
ret
mov eax, esi
mov ecx, 0xa
call fcn.0045a8c0
mov eax, edi
mov ecx, 0xa
nop
call fcn.0045a8c0
nop
call fcn.004585e0
jmp fcn.004f9c40

Function at 0x4faa80
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4fab4a
push rbp
mov rbp, rsp
sub rsp, 0x48
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rbx
mov qword [rsp], rax
mov qword [rsp + 8], rbx
mov byte [rsp + 0x10], 0
call fcn.00403280
xorps xmm15, xmm15
mov r14, qword [0x00704a00]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x18], 0xffffffffffffffff
jne 0x4fab2f
mov rcx, qword [rsp + 0x60]
lea rdx, [rcx + 1]
mov qword [rsp + 0x40], rdx
lea rax, [0x00582320]
xor ebx, ebx
mov rcx, rdx
call fcn.00443ea0
mov rbx, qword [rsp + 0x60]
mov rcx, rax
xor edi, edi
mov rsi, qword [rsp + 0x40]
mov rax, qword [rsp + 0x58]
nop dword [rax]
call fcn.004fb140
inc rbx
cmp rcx, rbx
jae 0x4fab1e
mov edi, 1
lea rsi, [0x00582320]
call fcn.00443f80
mov word [rax + rbx*2 - 2], 0
xor edi, edi
xor esi, esi
add rsp, 0x48
pop rbp
ret
xor eax, eax
xor ebx, ebx
mov rcx, rbx
lea rdi, [0x005d2a98]
lea rsi, [0x005d26e8]
add rsp, 0x48
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.004585e0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.004faa80
Function at 0x4fd8a0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4fd97d
push rbp
mov rbp, rsp
sub rsp, 0x40
movabs rdx, 0x65550d4d616e4a55
mov qword [rsp + 0x32], rdx
movabs rdx, 0x235a530069696555
mov qword [rsp + 0x38], rdx
movabs rdx, 0x90c0406010b0a
mov qword [rsp + 0x1e], rdx
movabs rdx, 0x408050c00090c04
mov qword [rsp + 0x22], rdx
movabs rdx, 0xc0b0c050909060c
mov qword [rsp + 0x2a], rdx
xor eax, eax
nop
jmp 0x4fd920
movzx r9d, byte [rsp + rsi + 0x32]
sub r9d, edx
lea edx, [r9 + 0x1d]
mov byte [rsp + rdi + 0x32], dl
lea edx, [r8 + 0x1d]
mov byte [rsp + rsi + 0x32], dl
add rax, 2
nop
cmp rax, 0x14
jge 0x4fd94d
movzx edx, byte [rsp + rax + 0x1e]
movzx esi, byte [rsp + rax + 0x1f]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0xe
jae 0x4fd970
movzx r8d, byte [rsp + rdi + 0x32]
sub r8d, edx
cmp rsi, 0xe
jb 0x4fd902
jmp 0x4fd964
xor eax, eax
lea rbx, [rsp + 0x32]
mov ecx, 0xe
call fcn.00447380
add rsp, 0x40
pop rbp
ret
mov eax, esi
mov ecx, 0xe
call fcn.0045a8c0
mov eax, edi
mov ecx, 0xe
call fcn.0045a8c0
nop
nop dword [rax]
call fcn.004585e0
jmp fcn.004fd8a0

Function at 0x4ffa60
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4ffb4a
push rbp
mov rbp, rsp
sub rsp, 0x48
movabs rdx, 0x1b50612935671852
mov qword [rsp + 0x37], rdx
movabs rdx, 0xf1b506129356718
mov qword [rsp + 0x38], rdx
movabs rdx, 0x4034435548460a39
mov qword [rsp + 0x40], rdx
movabs rdx, 0xb10080408040707
mov qword [rsp + 0x1f], rdx
movabs rdx, 0xa0f0e0601090a0a
mov qword [rsp + 0x27], rdx
movabs rdx, 0xd0109030b060f0c
mov qword [rsp + 0x2f], rdx
xor eax, eax
jmp 0x4ffaed
movzx r9d, byte [rsp + rsi + 0x37]
sub r9d, edx
lea edx, [r9 + 0x32]
mov byte [rsp + rdi + 0x37], dl
lea edx, [r8 + 0x32]
mov byte [rsp + rsi + 0x37], dl
add rax, 2
cmp rax, 0x18
jge 0x4ffb1a
movzx edx, byte [rsp + rax + 0x1f]
movzx esi, byte [rsp + rax + 0x20]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x11
jae 0x4ffb3d
movzx r8d, byte [rsp + rdi + 0x37]
sub r8d, edx
cmp rsi, 0x11
jb 0x4ffad0
jmp 0x4ffb31
xor eax, eax
lea rbx, [rsp + 0x37]
mov ecx, 0x11
call fcn.00447380
add rsp, 0x48
pop rbp
ret
mov eax, esi
mov ecx, 0x11
call fcn.0045a8c0
mov eax, edi
mov ecx, 0x11
call fcn.0045a8c0
nop
call fcn.004585e0
jmp fcn.004ffa60
Function at 0x501020
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x5010e6
push rbp
mov rbp, rsp
sub rsp, 0x30
movabs rdx, 0x948c83656e80a682
mov qword [rsp + 0x27], rdx
mov byte [rsp + 0x2f], 0xaa
movabs rdx, 0x2050102070806
mov qword [rsp + 0x1b], rdx
mov dword [rsp + 0x23], 0x8050806
xor eax, eax
nop
jmp 0x501080
movzx r9d, byte [rsp + rsi + 0x27]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x26]
mov byte [rsp + rdi + 0x27], dl
mov byte [rsp + rsi + 0x27], r8b
add rax, 2
nop dword [rax]
cmp rax, 0xc
jge 0x5010b2
movzx edx, byte [rsp + rax + 0x1b]
movzx esi, byte [rsp + rax + 0x1c]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 9
jae 0x5010d7
movzx r8d, byte [rsp + rdi + 0x27]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x26]
cmp rsi, 9
jb 0x501062
jmp 0x5010cb
xor eax, eax
lea rbx, [rsp + 0x27]
mov ecx, 9
nop
call fcn.00447380
add rsp, 0x30
pop rbp
ret
mov eax, esi
mov ecx, 9
call fcn.0045a8c0
mov eax, edi
mov ecx, 9
nop
call fcn.0045a8c0
nop
call fcn.004585e0
jmp fcn.00501020

Function at 0x502020
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x50211b
push rbp
mov rbp, rsp
sub rsp, 0x50
movabs rdx, 0xbcb06305a172ba89
mov qword [rsp + 0x3b], rdx
movabs rdx, 0x786e603612bcb063
mov qword [rsp + 0x40], rdx
movabs rdx, 0x8ebb69ad20baddc8
mov qword [rsp + 0x48], rdx
movabs rdx, 0xe0e09000a0f0000
mov qword [rsp + 0x1f], rdx
movabs rdx, 0xc07010d0a110006
mov qword [rsp + 0x27], rdx
movabs rdx, 0x110309130c07010d
mov qword [rsp + 0x2b], rdx
movabs rdx, 0x814030f03040f08
mov qword [rsp + 0x33], rdx
xor eax, eax
jmp 0x5020b9
movzx r9d, byte [rsp + rsi + 0x3b]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x71]
mov byte [rsp + rdi + 0x3b], dl
mov byte [rsp + rsi + 0x3b], r8b
add rax, 2
cmp rax, 0x1c
jge 0x5020eb
movzx edx, byte [rsp + rax + 0x1f]
movzx esi, byte [rsp + rax + 0x20]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x15
jae 0x50210e
movzx r8d, byte [rsp + rdi + 0x3b]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x71]
cmp rsi, 0x15
jb 0x50209f
jmp 0x502102
xor eax, eax
lea rbx, [rsp + 0x3b]
mov ecx, 0x15
call fcn.00447380
add rsp, 0x50
pop rbp
ret
mov eax, esi
mov ecx, 0x15
call fcn.0045a8c0
mov eax, edi
mov ecx, 0x15
call fcn.0045a8c0
nop
nop dword [rax + rax]
call fcn.004585e0
jmp fcn.00502020
Function at 0x5034a0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x50358c
push rbp
mov rbp, rsp
sub rsp, 0x40
movabs rdx, 0x41bc2e613be8694c
mov qword [rsp + 0x2d], rdx
movabs rdx, 0x646ed841bc2e613b
mov qword [rsp + 0x30], rdx
movabs rdx, 0xb9ac695413ea88b8
mov qword [rsp + 0x38], rdx
movabs rdx, 0x308050c0807030d
mov qword [rsp + 0x19], rdx
movabs rdx, 0xe0802080308050c
mov qword [rsp + 0x1d], rdx
movabs rdx, 0xd0c110b02120608
mov qword [rsp + 0x25], rdx
xor eax, eax
jmp 0x50352a
movzx r9d, byte [rsp + rsi + 0x2d]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x75]
mov byte [rsp + rdi + 0x2d], dl
mov byte [rsp + rsi + 0x2d], r8b
add rax, 2
cmp rax, 0x14
jge 0x50355c
movzx edx, byte [rsp + rax + 0x19]
movzx esi, byte [rsp + rax + 0x1a]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x13
jae 0x50357f
movzx r8d, byte [rsp + rdi + 0x2d]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x75]
cmp rsi, 0x13
jb 0x503510
jmp 0x503573
xor eax, eax
lea rbx, [rsp + 0x2d]
mov ecx, 0x13
call fcn.00447380
add rsp, 0x40
pop rbp
ret
mov eax, esi
mov ecx, 0x13
call fcn.0045a8c0
mov eax, edi
mov ecx, 0x13
call fcn.0045a8c0
nop
call fcn.004585e0
jmp fcn.005034a0

Function at 0x503980
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x503a7b
push rbp
mov rbp, rsp
sub rsp, 0x48
movabs rdx, 0x80906976812c6c41
mov qword [rsp + 0x32], rdx
movabs rdx, 0x677c717e949d8090
mov qword [rsp + 0x38], rdx
movabs rdx, 0x669e72542064ca89
mov qword [rsp + 0x40], rdx
movabs rdx, 0x3080e0707140f09
mov qword [rsp + 0x18], rdx
movabs rdx, 0x150d0813030b090b
mov qword [rsp + 0x20], rdx
movabs rdx, 0x603150d0813030b
mov qword [rsp + 0x22], rdx
movabs rdx, 0x40c030a0b0e0802
mov qword [rsp + 0x2a], rdx
xor eax, eax
jmp 0x503a19
movzx r9d, byte [rsp + rsi + 0x32]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x28]
mov byte [rsp + rdi + 0x32], dl
mov byte [rsp + rsi + 0x32], r8b
add rax, 2
cmp rax, 0x1a
jge 0x503a4b
movzx edx, byte [rsp + rax + 0x18]
movzx esi, byte [rsp + rax + 0x19]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x16
jae 0x503a6e
movzx r8d, byte [rsp + rdi + 0x32]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x28]
cmp rsi, 0x16
jb 0x5039ff
jmp 0x503a62
xor eax, eax
lea rbx, [rsp + 0x32]
mov ecx, 0x16
call fcn.00447380
add rsp, 0x48
pop rbp
ret
mov eax, esi
mov ecx, 0x16
call fcn.0045a8c0
mov eax, edi
mov ecx, 0x16
call fcn.0045a8c0
nop
nop dword [rax + rax]
call fcn.004585e0
jmp fcn.00503980
Function at 0x504f20
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x50501d
push rbp
mov rbp, rsp
sub rsp, 0x50
movabs rdx, 0x660d77612020b653
mov qword [rsp + 0x38], rdx
movabs rdx, 0x9fe061744c48638e
mov qword [rsp + 0x40], rdx
movabs rdx, 0x656dcb54c9457461
mov qword [rsp + 0x48], rdx
movabs rdx, 0x13111305030e0806
mov qword [rsp + 0x18], rdx
movabs rdx, 0x150b11060b010808
mov qword [rsp + 0x20], rdx
movabs rdx, 0x811150f11120a03
mov qword [rsp + 0x28], rdx
movabs rdx, 0x111030e11151106
mov qword [rsp + 0x30], rdx
xor eax, eax
jmp 0x504fc0
movzx r9d, byte [rsp + rsi + 0x38]
sub r9d, edx
lea edx, [r9 - 0x4c]
mov byte [rsp + rdi + 0x38], dl
lea edx, [r8 - 0x4c]
mov byte [rsp + rsi + 0x38], dl
add rax, 2
nop dword [rax]
cmp rax, 0x20
jge 0x504fed
movzx edx, byte [rsp + rax + 0x18]
movzx esi, byte [rsp + rax + 0x19]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x18
jae 0x505010
movzx r8d, byte [rsp + rdi + 0x38]
sub r8d, edx
cmp rsi, 0x18
jb 0x504f9f
jmp 0x505004
xor eax, eax
lea rbx, [rsp + 0x38]
mov ecx, 0x18
call fcn.00447380
add rsp, 0x50
pop rbp
ret
mov eax, esi
mov ecx, 0x18
call fcn.0045a8c0
mov eax, edi
mov ecx, 0x18
call fcn.0045a8c0
nop
nop dword [rax]
call fcn.004585e0
jmp fcn.00504f20

Function at 0x506060
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x506168
push rbp
mov rbp, rsp
sub rsp, 0x58
movabs rdx, 0x657c459445e99780
mov qword [rsp + 0x40], rdx
movabs rdx, 0x8e809a649d208db2
mov qword [rsp + 0x48], rdx
movabs rdx, 0x65b79f9d20d87691
mov qword [rsp + 0x50], rdx
movabs rdx, 0x14160e150e121114
mov qword [rsp + 0x1e], rdx
movabs rdx, 0xe0614160e150e12
mov qword [rsp + 0x20], rdx
movabs rdx, 0xf10110d1414020b
mov qword [rsp + 0x28], rdx
movabs rdx, 0x10c0b060d000208
mov qword [rsp + 0x30], rdx
movabs rdx, 0x205091404150615
mov qword [rsp + 0x38], rdx
xor eax, eax
jmp 0x50610b
movzx r9d, byte [rsp + rsi + 0x40]
sub r9d, edx
lea edx, [r9 + 2]
mov byte [rsp + rdi + 0x40], dl
lea edx, [r8 + 2]
mov byte [rsp + rsi + 0x40], dl
add rax, 2
cmp rax, 0x22
jge 0x506138
movzx edx, byte [rsp + rax + 0x1e]
movzx esi, byte [rsp + rax + 0x1f]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x18
jae 0x50615b
movzx r8d, byte [rsp + rdi + 0x40]
sub r8d, edx
cmp rsi, 0x18
jb 0x5060ee
jmp 0x50614f
xor eax, eax
lea rbx, [rsp + 0x40]
mov ecx, 0x18
call fcn.00447380
add rsp, 0x58
pop rbp
ret
mov eax, esi
mov ecx, 0x18
call fcn.0045a8c0
mov eax, edi
mov ecx, 0x18
call fcn.0045a8c0
nop
call fcn.004585e0
jmp fcn.00506060
Function at 0x508740
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x50884c
push rbp
mov rbp, rsp
sub rsp, 0x58
movabs rdx, 0x65740d610e2d00c6
mov qword [rsp + 0x40], rdx
movabs rdx, 0x1e6e37cd53f25442
mov qword [rsp + 0x48], rdx
movabs rdx, 0x1d9a0e5420ba7268
mov qword [rsp + 0x50], rdx
movabs rdx, 0x810090d080a170f
mov qword [rsp + 0x1e], rdx
movabs rdx, 0x160a0810090d080a
mov qword [rsp + 0x20], rdx
movabs rdx, 0x5100a0d0012020c
mov qword [rsp + 0x28], rdx
movabs rdx, 0x802160201030d08
mov qword [rsp + 0x30], rdx
movabs rdx, 0x15120d000a050a02
mov qword [rsp + 0x38], rdx
xor eax, eax
jmp 0x5087e8
movzx r9d, byte [rsp + rsi + 0x40]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x2f]
mov byte [rsp + rdi + 0x40], dl
mov byte [rsp + rsi + 0x40], r8b
add rax, 2
cmp rax, 0x22
jge 0x50881c
movzx edx, byte [rsp + rax + 0x1e]
movzx esi, byte [rsp + rax + 0x1f]
mov edi, edx
xor edx, esi
add edx, eax
nop
cmp rdi, 0x18
jae 0x50883f
movzx r8d, byte [rsp + rdi + 0x40]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x2f]
cmp rsi, 0x18
jb 0x5087ce
jmp 0x508833
xor eax, eax
lea rbx, [rsp + 0x40]
mov ecx, 0x18
call fcn.00447380
add rsp, 0x58
pop rbp
ret
mov eax, esi
mov ecx, 0x18
call fcn.0045a8c0
mov eax, edi
mov ecx, 0x18
call fcn.0045a8c0
nop
call fcn.004585e0
jmp fcn.00508740

Function at 0x509cc0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x509dbb
push rbp
mov rbp, rsp
sub rsp, 0x50
movabs rdx, 0x45f67665514f6f5c
mov qword [rsp + 0x38], rdx
movabs rdx, 0x94d613b530eecfe
mov qword [rsp + 0x40], rdx
movabs rdx, 0x105a693cb8644e61
mov qword [rsp + 0x48], rdx
movabs rdx, 0x700020c1606130f
mov qword [rsp + 0x18], rdx
movabs rdx, 0x91116031617060c
mov qword [rsp + 0x20], rdx
movabs rdx, 0xa170a110f14170f
mov qword [rsp + 0x28], rdx
movabs rdx, 0xb030e110e020802
mov qword [rsp + 0x30], rdx
xor eax, eax
jmp 0x509d59
movzx r9d, byte [rsp + rsi + 0x38]
lea edx, [r9 + rdx]
lea edx, [rdx - 5]
mov byte [rsp + rdi + 0x38], dl
mov byte [rsp + rsi + 0x38], r8b
add rax, 2
cmp rax, 0x20
jge 0x509d8b
movzx edx, byte [rsp + rax + 0x18]
movzx esi, byte [rsp + rax + 0x19]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x18
jae 0x509dae
movzx r8d, byte [rsp + rdi + 0x38]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 5]
cmp rsi, 0x18
jb 0x509d3f
jmp 0x509da2
xor eax, eax
lea rbx, [rsp + 0x38]
mov ecx, 0x18
call fcn.00447380
add rsp, 0x50
pop rbp
ret
mov eax, esi
mov ecx, 0x18
call fcn.0045a8c0
mov eax, edi
mov ecx, 0x18
call fcn.0045a8c0
nop
nop dword [rax + rax]
call fcn.004585e0
jmp fcn.00509cc0
Function at 0x50b860
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x50b94a
push rbp
mov rbp, rsp
sub rsp, 0x48
movabs rdx, 0x70656381857d6c41
mov qword [rsp + 0x34], rdx
movabs rdx, 0x2170996870656381
mov qword [rsp + 0x38], rdx
movabs rdx, 0x798e7a70209789ad
mov qword [rsp + 0x40], rdx
movabs rdx, 0xe120c130910060b
mov qword [rsp + 0x1c], rdx
movabs rdx, 0xa1012110e080411
mov qword [rsp + 0x24], rdx
movabs rdx, 0x110302010d130c07
mov qword [rsp + 0x2c], rdx
xor eax, eax
jmp 0x50b8ed
movzx r9d, byte [rsp + rsi + 0x34]
sub r9d, edx
lea edx, [r9 + 0xc]
mov byte [rsp + rdi + 0x34], dl
lea edx, [r8 + 0xc]
mov byte [rsp + rsi + 0x34], dl
add rax, 2
cmp rax, 0x18
jge 0x50b91a
movzx edx, byte [rsp + rax + 0x1c]
movzx esi, byte [rsp + rax + 0x1d]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x14
jae 0x50b93d
movzx r8d, byte [rsp + rdi + 0x34]
sub r8d, edx
cmp rsi, 0x14
jb 0x50b8d0
jmp 0x50b931
xor eax, eax
lea rbx, [rsp + 0x34]
mov ecx, 0x14
call fcn.00447380
add rsp, 0x48
pop rbp
ret
mov eax, esi
mov ecx, 0x14
call fcn.0045a8c0
mov eax, edi
mov ecx, 0x14
call fcn.0045a8c0
nop
call fcn.004585e0
jmp fcn.0050b860

Function at 0x50c2a0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x50c38c
push rbp
mov rbp, rsp
sub rsp, 0x40
movabs rdx, 0x74537d0fbe9d6e49
mov qword [rsp + 0x2d], rdx
movabs rdx, 0xee6e9474537d0fbe
mov qword [rsp + 0x30], rdx
movabs rdx, 0x659fe354a8e3afa9
mov qword [rsp + 0x38], rdx
movabs rdx, 0x5040c0d0510020e
mov qword [rsp + 0x19], rdx
movabs rdx, 0xb0a031105040c0d
mov qword [rsp + 0x1d], rdx
movabs rdx, 0xc0b11080e100e05
mov qword [rsp + 0x25], rdx
xor eax, eax
jmp 0x50c32a
movzx r9d, byte [rsp + rsi + 0x2d]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x50]
mov byte [rsp + rdi + 0x2d], dl
mov byte [rsp + rsi + 0x2d], r8b
add rax, 2
cmp rax, 0x14
jge 0x50c35c
movzx edx, byte [rsp + rax + 0x19]
movzx esi, byte [rsp + rax + 0x1a]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x13
jae 0x50c37f
movzx r8d, byte [rsp + rdi + 0x2d]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x50]
cmp rsi, 0x13
jb 0x50c310
jmp 0x50c373
xor eax, eax
lea rbx, [rsp + 0x2d]
mov ecx, 0x13
call fcn.00447380
add rsp, 0x40
pop rbp
ret
mov eax, esi
mov ecx, 0x13
call fcn.0045a8c0
mov eax, edi
mov ecx, 0x13
call fcn.0045a8c0
nop
call fcn.004585e0
jmp fcn.0050c2a0
Function at 0x50d040
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x50d14c
push rbp
mov rbp, rsp
sub rsp, 0x58
movabs rdx, 0x6fb06ef8fefea057
mov qword [rsp + 0x3f], rdx
movabs rdx, 0x93e7f4f52bc706ae
mov qword [rsp + 0x47], rdx
movabs rdx, 0x9d93e7f4f52bc706
mov qword [rsp + 0x48], rdx
movabs rdx, 0x653f695447f272ab
mov qword [rsp + 0x50], rdx
movabs rdx, 0x6090b0f11010f14
mov qword [rsp + 0x1f], rdx
movabs rdx, 0x10d010914080210
mov qword [rsp + 0x27], rdx
movabs rdx, 0x4170f130a0b010a
mov qword [rsp + 0x2f], rdx
movabs rdx, 0xe0c030d02041311
mov qword [rsp + 0x37], rdx
xor eax, eax
jmp 0x50d0e8
movzx r9d, byte [rsp + rsi + 0x3f]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x4c]
mov byte [rsp + rdi + 0x3f], dl
mov byte [rsp + rsi + 0x3f], r8b
add rax, 2
cmp rax, 0x20
jge 0x50d11c
movzx edx, byte [rsp + rax + 0x1f]
movzx esi, byte [rsp + rax + 0x20]
mov edi, edx
xor edx, esi
add edx, eax
nop
cmp rdi, 0x19
jae 0x50d13f
movzx r8d, byte [rsp + rdi + 0x3f]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x4c]
cmp rsi, 0x19
jb 0x50d0ce
jmp 0x50d133
xor eax, eax
lea rbx, [rsp + 0x3f]
mov ecx, 0x19
call fcn.00447380
add rsp, 0x58
pop rbp
ret
mov eax, esi
mov ecx, 0x19
call fcn.0045a8c0
mov eax, edi
mov ecx, 0x19
call fcn.0045a8c0
nop
call fcn.004585e0
jmp fcn.0050d040

Function at 0x50efe0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x50f0db
push rbp
mov rbp, rsp
sub rsp, 0x48
movabs rdx, 0xe06ea6fc61ea6b4d
mov qword [rsp + 0x33], rdx
movabs rdx, 0xb6ac848fa6e06ea6
mov qword [rsp + 0x38], rdx
movabs rdx, 0x9ecc69c36d578e94
mov qword [rsp + 0x40], rdx
movabs rdx, 0xb0c010707040f02
mov qword [rsp + 0x19], rdx
movabs rdx, 0x9140208110a1010
mov qword [rsp + 0x21], rdx
movabs rdx, 0xd1309140208110a
mov qword [rsp + 0x23], rdx
movabs rdx, 0x40a0e05080e0f0d
mov qword [rsp + 0x2b], rdx
xor eax, eax
jmp 0x50f079
movzx r9d, byte [rsp + rsi + 0x33]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x55]
mov byte [rsp + rdi + 0x33], dl
mov byte [rsp + rsi + 0x33], r8b
add rax, 2
cmp rax, 0x1a
jge 0x50f0ab
movzx edx, byte [rsp + rax + 0x19]
movzx esi, byte [rsp + rax + 0x1a]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x15
jae 0x50f0ce
movzx r8d, byte [rsp + rdi + 0x33]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x55]
cmp rsi, 0x15
jb 0x50f05f
jmp 0x50f0c2
xor eax, eax
lea rbx, [rsp + 0x33]
mov ecx, 0x15
call fcn.00447380
add rsp, 0x48
pop rbp
ret
mov eax, esi
mov ecx, 0x15
call fcn.0045a8c0
mov eax, edi
mov ecx, 0x15
call fcn.0045a8c0
nop
nop dword [rax + rax]
call fcn.004585e0
jmp fcn.0050efe0