joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4fa820
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4fa8ec
push rbp
mov rbp, rsp
sub rsp, 0x38
movabs rdx, 0x204b6d65fc213a47
mov qword [rsp + 0x2c], rdx
mov dword [rsp + 0x34], 0xc137391c
movabs rdx, 0x602010a08020b03
mov qword [rsp + 0x1e], rdx
movabs rdx, 0xb07030b08090602
mov qword [rsp + 0x24], rdx
xor eax, eax
jmp 0x4fa885
movzx r9d, byte [rsp + rsi + 0x2c]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x1f]
mov byte [rsp + rdi + 0x2c], dl
mov byte [rsp + rsi + 0x2c], r8b
add rax, 2
cmp rax, 0xe
jge 0x4fa8bc
movzx edx, byte [rsp + rax + 0x1e]
movzx esi, byte [rsp + rax + 0x1f]
mov edi, edx
xor edx, esi
add edx, eax
nop dword [rax + rax]
cmp rdi, 0xc
jae 0x4fa8df
movzx r8d, byte [rsp + rdi + 0x2c]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x1f]
cmp rsi, 0xc
jb 0x4fa86b
jmp 0x4fa8d3
xor eax, eax
lea rbx, [rsp + 0x2c]
mov ecx, 0xc
call fcn.00444780
add rsp, 0x38
pop rbp
ret
mov eax, esi
mov ecx, 0xc
call fcn.004564a0
mov eax, edi
mov ecx, 0xc
call fcn.004564a0
nop
call fcn.004541c0
jmp fcn.004fa820

Function at 0x4fbd80
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4fbe58
push rbp
mov rbp, rsp
sub rsp, 0x38
movabs rdx, 0x6b8dac9c896b8f8f
mov qword [rsp + 0x2c], rdx
mov dword [rsp + 0x34], 0x66b07b63
movabs rdx, 0x4080b000506010a
mov qword [rsp + 0x1a], rdx
movabs rdx, 0x30904080b000506
mov qword [rsp + 0x1c], rdx
movabs rdx, 0x8070a06020b0801
mov qword [rsp + 0x24], rdx
xor eax, eax
jmp 0x4fbdf4
movzx r9d, byte [rsp + rsi + 0x2c]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x29]
mov byte [rsp + rdi + 0x2c], dl
mov byte [rsp + rsi + 0x2c], r8b
add rax, 2
cmp rax, 0x12
jge 0x4fbe28
movzx edx, byte [rsp + rax + 0x1a]
movzx esi, byte [rsp + rax + 0x1b]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0xc
jae 0x4fbe4b
movzx r8d, byte [rsp + rdi + 0x2c]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x29]
nop
cmp rsi, 0xc
jb 0x4fbdda
jmp 0x4fbe3f
xor eax, eax
lea rbx, [rsp + 0x2c]
mov ecx, 0xc
call fcn.00444780
add rsp, 0x38
pop rbp
ret
mov eax, esi
mov ecx, 0xc
call fcn.004564a0
mov eax, edi
mov ecx, 0xc
call fcn.004564a0
nop
call fcn.004541c0
nop dword [rax]
jmp fcn.004fbd80
Function at 0x4fe640
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4fe72a
push rbp
mov rbp, rsp
sub rsp, 0x40
movabs rdx, 0x41666c8146a56578
mov qword [rsp + 0x2e], rdx
movabs rdx, 0x74b541666c8146a5
mov qword [rsp + 0x30], rdx
movabs rdx, 0x579765a579679785
mov qword [rsp + 0x38], rdx
movabs rdx, 0x20a0d040c0c0e04
mov qword [rsp + 0x1c], rdx
movabs rdx, 0xa0b020a0d040c0c
mov qword [rsp + 0x1e], rdx
movabs rdx, 0x100b080b0a0d0006
mov qword [rsp + 0x26], rdx
xor eax, eax
jmp 0x4fe6cd
movzx r9d, byte [rsp + rsi + 0x2e]
sub r9d, edx
lea edx, [r9 - 3]
mov byte [rsp + rdi + 0x2e], dl
lea edx, [r8 - 3]
mov byte [rsp + rsi + 0x2e], dl
add rax, 2
cmp rax, 0x12
jge 0x4fe6fa
movzx edx, byte [rsp + rax + 0x1c]
movzx esi, byte [rsp + rax + 0x1d]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x12
jae 0x4fe71d
movzx r8d, byte [rsp + rdi + 0x2e]
sub r8d, edx
cmp rsi, 0x12
jb 0x4fe6b0
jmp 0x4fe711
xor eax, eax
lea rbx, [rsp + 0x2e]
mov ecx, 0x12
call fcn.00444780
add rsp, 0x40
pop rbp
ret
mov eax, esi
mov ecx, 0x12
call fcn.004564a0
mov eax, edi
mov ecx, 0x12
call fcn.004564a0
nop
call fcn.004541c0
jmp fcn.004fe640

Function at 0x4ff080
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4ff166
push rbp
mov rbp, rsp
sub rsp, 0x40
movabs rdx, 0xae7bc484bd6de77d
mov qword [rsp + 0x31], rdx
movabs rdx, 0x6d6469057d4f77ae
mov qword [rsp + 0x38], rdx
movabs rdx, 0x1030507070b0305
mov qword [rsp + 0x1d], rdx
movabs rdx, 0x605030401030507
mov qword [rsp + 0x21], rdx
movabs rdx, 0xa0604060b0d0e00
mov qword [rsp + 0x29], rdx
xor eax, eax
nop
jmp 0x4ff100
movzx r9d, byte [rsp + rsi + 0x31]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x32]
mov byte [rsp + rdi + 0x31], dl
mov byte [rsp + rsi + 0x31], r8b
add rax, 2
nop dword [rax]
cmp rax, 0x14
jge 0x4ff132
movzx edx, byte [rsp + rax + 0x1d]
movzx esi, byte [rsp + rax + 0x1e]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0xf
jae 0x4ff157
movzx r8d, byte [rsp + rdi + 0x31]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x32]
cmp rsi, 0xf
jb 0x4ff0e2
jmp 0x4ff14b
xor eax, eax
lea rbx, [rsp + 0x31]
mov ecx, 0xf
nop
call fcn.00444780
add rsp, 0x40
pop rbp
ret
mov eax, esi
mov ecx, 0xf
call fcn.004564a0
mov eax, edi
mov ecx, 0xf
nop
call fcn.004564a0
nop
call fcn.004541c0
jmp fcn.004ff080
Function at 0x4ff700
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4ff7ec
push rbp
mov rbp, rsp
sub rsp, 0x48
movabs rdx, 0x530faa4691e28ba2
mov qword [rsp + 0x35], rdx
movabs rdx, 0x677c69530faa4691
mov qword [rsp + 0x38], rdx
movabs rdx, 0xa4b687d4a24fcf6c
mov qword [rsp + 0x40], rdx
movabs rdx, 0x2000e120c0e0602
mov qword [rsp + 0x1d], rdx
movabs rdx, 0x30f061101100f11
mov qword [rsp + 0x25], rdx
movabs rdx, 0x120e000605060911
mov qword [rsp + 0x2d], rdx
xor eax, eax
jmp 0x4ff78a
movzx r9d, byte [rsp + rsi + 0x35]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x41]
mov byte [rsp + rdi + 0x35], dl
mov byte [rsp + rsi + 0x35], r8b
add rax, 2
cmp rax, 0x18
jge 0x4ff7bc
movzx edx, byte [rsp + rax + 0x1d]
movzx esi, byte [rsp + rax + 0x1e]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x13
jae 0x4ff7df
movzx r8d, byte [rsp + rdi + 0x35]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x41]
cmp rsi, 0x13
jb 0x4ff770
jmp 0x4ff7d3
xor eax, eax
lea rbx, [rsp + 0x35]
mov ecx, 0x13
call fcn.00444780
add rsp, 0x48
pop rbp
ret
mov eax, esi
mov ecx, 0x13
call fcn.004564a0
mov eax, edi
mov ecx, 0x13
call fcn.004564a0
nop
call fcn.004541c0
jmp fcn.004ff700

Function at 0x5006c0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x50079d
push rbp
mov rbp, rsp
sub rsp, 0x40
movabs rdx, 0x75cb69a741a3a6be
mov qword [rsp + 0x30], rdx
movabs rdx, 0xeaa272a0bd65d3d6
mov qword [rsp + 0x38], rdx
movabs rdx, 0x4020e0b060b090f
mov qword [rsp + 0x1e], rdx
movabs rdx, 0x804020e0b060b
mov qword [rsp + 0x20], rdx
movabs rdx, 0x60c0c090f010800
mov qword [rsp + 0x28], rdx
xor eax, eax
nop
jmp 0x500740
movzx r9d, byte [rsp + rsi + 0x30]
sub r9d, edx
lea edx, [r9 - 0x27]
mov byte [rsp + rdi + 0x30], dl
lea edx, [r8 - 0x27]
mov byte [rsp + rsi + 0x30], dl
add rax, 2
nop
cmp rax, 0x12
jge 0x50076d
movzx edx, byte [rsp + rax + 0x1e]
movzx esi, byte [rsp + rax + 0x1f]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x10
jae 0x500790
movzx r8d, byte [rsp + rdi + 0x30]
sub r8d, edx
cmp rsi, 0x10
jb 0x500722
jmp 0x500784
xor eax, eax
lea rbx, [rsp + 0x30]
mov ecx, 0x10
call fcn.00444780
add rsp, 0x40
pop rbp
ret
mov eax, esi
mov ecx, 0x10
call fcn.004564a0
mov eax, edi
mov ecx, 0x10
call fcn.004564a0
nop
nop dword [rax]
call fcn.004541c0
jmp fcn.005006c0
Function at 0x5016a0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x50178a
push rbp
mov rbp, rsp
sub rsp, 0x40
movabs rdx, 0x17646e61e68b6fb2
mov qword [rsp + 0x2e], rdx
movabs rdx, 0xb96917646e61e68b
mov qword [rsp + 0x30], rdx
movabs rdx, 0x1a021b724b59b2fa
mov qword [rsp + 0x38], rdx
movabs rdx, 0x209030d0b00000d
mov qword [rsp + 0x1a], rdx
movabs rdx, 0xc0700090209030d
mov qword [rsp + 0x1e], rdx
movabs rdx, 0xa0b1011020f0710
mov qword [rsp + 0x26], rdx
xor eax, eax
jmp 0x50172d
movzx r9d, byte [rsp + rsi + 0x2e]
sub r9d, edx
lea edx, [r9 + 0x6d]
mov byte [rsp + rdi + 0x2e], dl
lea edx, [r8 + 0x6d]
mov byte [rsp + rsi + 0x2e], dl
add rax, 2
cmp rax, 0x14
jge 0x50175a
movzx edx, byte [rsp + rax + 0x1a]
movzx esi, byte [rsp + rax + 0x1b]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x12
jae 0x50177d
movzx r8d, byte [rsp + rdi + 0x2e]
sub r8d, edx
cmp rsi, 0x12
jb 0x501710
jmp 0x501771
xor eax, eax
lea rbx, [rsp + 0x2e]
mov ecx, 0x12
call fcn.00444780
add rsp, 0x40
pop rbp
ret
mov eax, esi
mov ecx, 0x12
call fcn.004564a0
mov eax, edi
mov ecx, 0x12
call fcn.004564a0
nop
call fcn.004541c0
jmp fcn.005016a0

Function at 0x501aa0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x501b72
push rbp
mov rbp, rsp
sub rsp, 0x38
movabs rdx, 0x421a45410e1b7246
mov qword [rsp + 0x2b], rdx
movabs rdx, 0x3b434cea3f421a45
mov qword [rsp + 0x30], rdx
movabs rdx, 0x50c090702060305
mov qword [rsp + 0x1d], rdx
movabs rdx, 0x60208070a0b050c
mov qword [rsp + 0x23], rdx
xor eax, eax
jmp 0x501b0c
movzx r9d, byte [rsp + rsi + 0x2b]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x1a]
mov byte [rsp + rdi + 0x2b], dl
mov byte [rsp + rsi + 0x2b], r8b
add rax, 2
cmp rax, 0xe
jge 0x501b3e
movzx edx, byte [rsp + rax + 0x1d]
movzx esi, byte [rsp + rax + 0x1e]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0xd
jae 0x501b65
movzx r8d, byte [rsp + rdi + 0x2b]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x1a]
cmp rsi, 0xd
jb 0x501af2
jmp 0x501b55
xor eax, eax
lea rbx, [rsp + 0x2b]
mov ecx, 0xd
call fcn.00444780
add rsp, 0x38
pop rbp
ret
mov eax, esi
mov ecx, 0xd
nop dword [rax]
call fcn.004564a0
mov eax, edi
mov ecx, 0xd
call fcn.004564a0
nop
call fcn.004541c0
jmp fcn.00501aa0
Function at 0x5037a0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x50386c
push rbp
mov rbp, rsp
sub rsp, 0x38
movabs rdx, 0xc7c2c7c4d374d167
mov qword [rsp + 0x2a], rdx
movabs rdx, 0x2cc0bb6ed725c7c2
mov qword [rsp + 0x30], rdx
movabs rdx, 0xb0c080b0504060d
mov qword [rsp + 0x1c], rdx
movabs rdx, 0x909010703060b0c
mov qword [rsp + 0x22], rdx
xor eax, eax
jmp 0x50380f
movzx r9d, byte [rsp + rsi + 0x2a]
sub r9d, edx
lea edx, [r9 - 0x52]
mov byte [rsp + rdi + 0x2a], dl
lea edx, [r8 - 0x52]
mov byte [rsp + rsi + 0x2a], dl
add rax, 2
cmp rax, 0xe
jge 0x50383c
movzx edx, byte [rsp + rax + 0x1c]
movzx esi, byte [rsp + rax + 0x1d]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0xe
jae 0x50385f
movzx r8d, byte [rsp + rdi + 0x2a]
sub r8d, edx
cmp rsi, 0xe
jb 0x5037f2
jmp 0x503853
xor eax, eax
lea rbx, [rsp + 0x2a]
mov ecx, 0xe
call fcn.00444780
add rsp, 0x38
pop rbp
ret
mov eax, esi
mov ecx, 0xe
call fcn.004564a0
mov eax, edi
mov ecx, 0xe
call fcn.004564a0
nop
call fcn.004541c0
jmp fcn.005037a0

Function at 0x504400
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x5044b8
push rbp
mov rbp, rsp
sub rsp, 0x30
movabs rdx, 0x657f6b756e7d6c73
mov qword [rsp + 0x28], rdx
movabs rdx, 0x201030205040602
mov qword [rsp + 0x1c], rdx
mov dword [rsp + 0x24], 0x5020207
xor eax, eax
jmp 0x504456
movzx r9d, byte [rsp + rsi + 0x28]
lea edx, [r9 + rdx]
lea edx, [rdx - 0xa]
mov byte [rsp + rdi + 0x28], dl
mov byte [rsp + rsi + 0x28], r8b
add rax, 2
cmp rax, 0xc
jge 0x504488
movzx edx, byte [rsp + rax + 0x1c]
movzx esi, byte [rsp + rax + 0x1d]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 8
jae 0x5044ab
movzx r8d, byte [rsp + rdi + 0x28]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0xa]
cmp rsi, 8
jb 0x50443c
jmp 0x50449f
xor eax, eax
lea rbx, [rsp + 0x28]
mov ecx, 8
call fcn.00444780
add rsp, 0x30
pop rbp
ret
mov eax, esi
mov ecx, 8
call fcn.004564a0
mov eax, edi
mov ecx, 8
call fcn.004564a0
nop
call fcn.004541c0
nop dword [rax]
jmp fcn.00504400

Function at 0x504fa0
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x50506a
push rbp
mov rbp, rsp
sub rsp, 0x48
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rbx
mov qword [rsp], rax
mov qword [rsp + 8], rbx
mov byte [rsp + 0x10], 0
call fcn.00403280
xorps xmm15, xmm15
mov r14, qword [0x006bc158]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x18], 0xffffffffffffffff
jne 0x50504f
mov rcx, qword [rsp + 0x60]
lea rdx, [rcx + 1]
mov qword [rsp + 0x40], rdx
lea rax, [0x0055b600]
xor ebx, ebx
mov rcx, rdx
call fcn.004412a0
mov rbx, qword [rsp + 0x60]
mov rcx, rax
xor edi, edi
mov rsi, qword [rsp + 0x40]
mov rax, qword [rsp + 0x58]
nop dword [rax]
call fcn.005055a0
inc rbx
cmp rcx, rbx
jae 0x50503e
mov edi, 1
lea rsi, [0x0055b600]
call fcn.00441380
mov word [rax + rbx*2 - 2], 0
xor edi, edi
xor esi, esi
add rsp, 0x48
pop rbp
ret
xor eax, eax
xor ebx, ebx
mov rcx, rbx
lea rdi, [0x005a1eb8]
lea rsi, [0x005a1a08]
add rsp, 0x48
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.004541c0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.00504fa0
Function at 0x506e00
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x506ee6
push rbp
mov rbp, rsp
sub rsp, 0x40
movabs rdx, 0x5c59635e6f176146
mov qword [rsp + 0x31], rdx
movabs rdx, 0xd6462420048585c
mov qword [rsp + 0x38], rdx
movabs rdx, 0x60a05080303020b
mov qword [rsp + 0x1f], rdx
movabs rdx, 0xb09060a05080303
mov qword [rsp + 0x21], rdx
movabs rdx, 0xe06040b070c0204
mov qword [rsp + 0x29], rdx
xor eax, eax
nop
jmp 0x506e80
movzx r9d, byte [rsp + rsi + 0x31]
lea edx, [r9 + rdx]
lea edx, [rdx - 5]
mov byte [rsp + rdi + 0x31], dl
mov byte [rsp + rsi + 0x31], r8b
add rax, 2
nop dword [rax]
cmp rax, 0x12
jge 0x506eb2
movzx edx, byte [rsp + rax + 0x1f]
movzx esi, byte [rsp + rax + 0x20]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0xf
jae 0x506ed7
movzx r8d, byte [rsp + rdi + 0x31]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 5]
cmp rsi, 0xf
jb 0x506e62
jmp 0x506ecb
xor eax, eax
lea rbx, [rsp + 0x31]
mov ecx, 0xf
nop
call fcn.00444780
add rsp, 0x40
pop rbp
ret
mov eax, esi
mov ecx, 0xf
call fcn.004564a0
mov eax, edi
mov ecx, 0xf
nop
call fcn.004564a0
nop
call fcn.004541c0
jmp fcn.00506e00

Function at 0x508320
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x5083e7
push rbp
mov rbp, rsp
sub rsp, 0x38
movabs rdx, 0x933660b0a72b86b
mov qword [rsp + 0x2c], rdx
mov dword [rsp + 0x34], 0x526c237b
movabs rdx, 0x405090403080b03
mov qword [rsp + 0x1c], rdx
movabs rdx, 0x805070304080107
mov qword [rsp + 0x24], rdx
xor eax, eax
jmp 0x508388
movzx r9d, byte [rsp + rsi + 0x2c]
sub r9d, edx
lea edx, [r9 + 0x6a]
mov byte [rsp + rdi + 0x2c], dl
lea edx, [r8 + 0x6a]
mov byte [rsp + rsi + 0x2c], dl
add rax, 2
cmp rax, 0x10
jge 0x5083b7
movzx edx, byte [rsp + rax + 0x1c]
movzx esi, byte [rsp + rax + 0x1d]
mov edi, edx
xor edx, esi
add edx, eax
nop
cmp rdi, 0xc
jae 0x5083da
movzx r8d, byte [rsp + rdi + 0x2c]
sub r8d, edx
cmp rsi, 0xc
jb 0x50836b
jmp 0x5083ce
xor eax, eax
lea rbx, [rsp + 0x2c]
mov ecx, 0xc
call fcn.00444780
add rsp, 0x38
pop rbp
ret
mov eax, esi
mov ecx, 0xc
call fcn.004564a0
mov eax, edi
mov ecx, 0xc
call fcn.004564a0
nop
call fcn.004541c0
jmp fcn.00508320
Function at 0x508400
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x5084e6
push rbp
mov rbp, rsp
sub rsp, 0x40
movabs rdx, 0x7461659a9bde8152
mov qword [rsp + 0x31], rdx
movabs rdx, 0xb4867ccb9f4b5774
mov qword [rsp + 0x38], rdx
movabs rdx, 0x10a0e0a0e020b03
mov qword [rsp + 0x1b], rdx
movabs rdx, 0x403020c020b010a
mov qword [rsp + 0x21], rdx
movabs rdx, 0x101080e0d040308
mov qword [rsp + 0x29], rdx
xor eax, eax
nop
jmp 0x508480
movzx r9d, byte [rsp + rsi + 0x31]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x2d]
mov byte [rsp + rdi + 0x31], dl
mov byte [rsp + rsi + 0x31], r8b
add rax, 2
nop dword [rax]
cmp rax, 0x16
jge 0x5084b2
movzx edx, byte [rsp + rax + 0x1b]
movzx esi, byte [rsp + rax + 0x1c]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0xf
jae 0x5084d7
movzx r8d, byte [rsp + rdi + 0x31]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x2d]
cmp rsi, 0xf
jb 0x508462
jmp 0x5084cb
xor eax, eax
lea rbx, [rsp + 0x31]
mov ecx, 0xf
nop
call fcn.00444780
add rsp, 0x40
pop rbp
ret
mov eax, esi
mov ecx, 0xf
call fcn.004564a0
mov eax, edi
mov ecx, 0xf
nop
call fcn.004564a0
nop
call fcn.004541c0
jmp fcn.00508400

Function at 0x50ace0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x50ad98
push rbp
mov rbp, rsp
sub rsp, 0x30
movabs rdx, 0x7207314365bd0200
mov qword [rsp + 0x28], rdx
movabs rdx, 0x1050602040000
mov qword [rsp + 0x1c], rdx
mov dword [rsp + 0x24], 0x50405
xor eax, eax
jmp 0x50ad39
movzx r9d, byte [rsp + rsi + 0x28]
sub r9d, edx
lea edx, [r9 + 0x3b]
mov byte [rsp + rdi + 0x28], dl
lea edx, [r8 + 0x3b]
mov byte [rsp + rsi + 0x28], dl
add rax, 2
cmp rax, 0xc
jge 0x50ad68
movzx edx, byte [rsp + rax + 0x1c]
movzx esi, byte [rsp + rax + 0x1d]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 8
jae 0x50ad8b
movzx r8d, byte [rsp + rdi + 0x28]
sub r8d, edx
nop
cmp rsi, 8
jb 0x50ad1c
jmp 0x50ad7f
xor eax, eax
lea rbx, [rsp + 0x28]
mov ecx, 8
call fcn.00444780
add rsp, 0x30
pop rbp
ret
mov eax, esi
mov ecx, 8
call fcn.004564a0
mov eax, edi
mov ecx, 8
call fcn.004564a0
nop
call fcn.004541c0
nop dword [rax]
jmp fcn.0050ace0

Function at 0x50adc0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x50ae78
push rbp
mov rbp, rsp
sub rsp, 0x30
movabs rdx, 0xd296966dc66365a4
mov qword [rsp + 0x28], rdx
movabs rdx, 0x505000705030700
mov qword [rsp + 0x1e], rdx
mov word [rsp + 0x26], 0x606
xor eax, eax
jmp 0x50ae15
movzx r9d, byte [rsp + rsi + 0x28]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x39]
mov byte [rsp + rdi + 0x28], dl
mov byte [rsp + rsi + 0x28], r8b
add rax, 2
cmp rax, 0xa
jge 0x50ae48
movzx edx, byte [rsp + rax + 0x1e]
movzx esi, byte [rsp + rax + 0x1f]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 8
jae 0x50ae6b
movzx r8d, byte [rsp + rdi + 0x28]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x39]
nop
cmp rsi, 8
jb 0x50adfb
jmp 0x50ae5f
xor eax, eax
lea rbx, [rsp + 0x28]
mov ecx, 8
call fcn.00444780
add rsp, 0x30
pop rbp
ret
mov eax, esi
mov ecx, 8
call fcn.004564a0
mov eax, edi
mov ecx, 8
call fcn.004564a0
nop
call fcn.004541c0
nop dword [rax]
jmp fcn.0050adc0
Function at 0x50c0c0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x50c1c8
push rbp
mov rbp, rsp
sub rsp, 0x58
movabs rdx, 0xf8e9b971e0fceff3
mov qword [rsp + 0x3e], rdx
movabs rdx, 0xe40d92205bf57972
mov qword [rsp + 0x46], rdx
movabs rdx, 0x466ee40d92205bf5
mov qword [rsp + 0x48], rdx
movabs rdx, 0x7cee690120fe9410
mov qword [rsp + 0x50], rdx
movabs rdx, 0x911040f0b04060e
mov qword [rsp + 0x1e], rdx
movabs rdx, 0x161909160b030506
mov qword [rsp + 0x26], rdx
movabs rdx, 0x10718110d110a19
mov qword [rsp + 0x2e], rdx
movabs rdx, 0x12020016140a1413
mov qword [rsp + 0x36], rdx
xor eax, eax
jmp 0x50c16b
movzx r9d, byte [rsp + rsi + 0x3e]
sub r9d, edx
lea edx, [r9 - 0x6d]
mov byte [rsp + rdi + 0x3e], dl
lea edx, [r8 - 0x6d]
mov byte [rsp + rsi + 0x3e], dl
add rax, 2
cmp rax, 0x20
jge 0x50c198
movzx edx, byte [rsp + rax + 0x1e]
movzx esi, byte [rsp + rax + 0x1f]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x1a
jae 0x50c1bb
movzx r8d, byte [rsp + rdi + 0x3e]
sub r8d, edx
cmp rsi, 0x1a
jb 0x50c14e
jmp 0x50c1af
xor eax, eax
lea rbx, [rsp + 0x3e]
mov ecx, 0x1a
call fcn.00444780
add rsp, 0x58
pop rbp
ret
mov eax, esi
mov ecx, 0x1a
call fcn.004564a0
mov eax, edi
mov ecx, 0x1a
call fcn.004564a0
nop
call fcn.004541c0
jmp fcn.0050c0c0

Function at 0x50d460
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x50d55d
push rbp
mov rbp, rsp
sub rsp, 0x50
movabs rdx, 0x26146361961041c2
mov qword [rsp + 0x38], rdx
movabs rdx, 0xb9b461d653a51e69
mov qword [rsp + 0x40], rdx
movabs rdx, 0xa6d6954bf13cab5
mov qword [rsp + 0x48], rdx
movabs rdx, 0x110913100a0e0307
mov qword [rsp + 0x1e], rdx
movabs rdx, 0x1202100c0f070612
mov qword [rsp + 0x26], rdx
movabs rdx, 0x2031202100c0f07
mov qword [rsp + 0x28], rdx
movabs rdx, 0x170310090e070002
mov qword [rsp + 0x30], rdx
xor eax, eax
jmp 0x50d500
movzx r9d, byte [rsp + rsi + 0x38]
sub r9d, edx
lea edx, [r9 + 0x72]
mov byte [rsp + rdi + 0x38], dl
lea edx, [r8 + 0x72]
mov byte [rsp + rsi + 0x38], dl
add rax, 2
nop dword [rax]
cmp rax, 0x1a
jge 0x50d52d
movzx edx, byte [rsp + rax + 0x1e]
movzx esi, byte [rsp + rax + 0x1f]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x18
jae 0x50d550
movzx r8d, byte [rsp + rdi + 0x38]
sub r8d, edx
cmp rsi, 0x18
jb 0x50d4df
jmp 0x50d544
xor eax, eax
lea rbx, [rsp + 0x38]
mov ecx, 0x18
call fcn.00444780
add rsp, 0x50
pop rbp
ret
mov eax, esi
mov ecx, 0x18
call fcn.004564a0
mov eax, edi
mov ecx, 0x18
call fcn.004564a0
nop
nop dword [rax]
call fcn.004541c0
jmp fcn.0050d460
Function at 0x50e8c0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x50e9bd
push rbp
mov rbp, rsp
sub rsp, 0x50
movabs rdx, 0xaeb2cb096e75c24c
mov qword [rsp + 0x3a], rdx
movabs rdx, 0x4e808dab53ddaeb2
mov qword [rsp + 0x40], rdx
movabs rdx, 0xc7926954c4afcba8
mov qword [rsp + 0x48], rdx
movabs rdx, 0xc0b0a0a06150d11
mov qword [rsp + 0x1c], rdx
movabs rdx, 0xa06081015040515
mov qword [rsp + 0x24], rdx
movabs rdx, 0xd1008000d0f0a06
mov qword [rsp + 0x2a], rdx
movabs rdx, 0x71415140e010101
mov qword [rsp + 0x32], rdx
xor eax, eax
jmp 0x50e960
movzx r9d, byte [rsp + rsi + 0x3a]
sub r9d, edx
lea edx, [r9 - 0x12]
mov byte [rsp + rdi + 0x3a], dl
lea edx, [r8 - 0x12]
mov byte [rsp + rsi + 0x3a], dl
add rax, 2
nop dword [rax]
cmp rax, 0x1e
jge 0x50e98d
movzx edx, byte [rsp + rax + 0x1c]
movzx esi, byte [rsp + rax + 0x1d]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x16
jae 0x50e9b0
movzx r8d, byte [rsp + rdi + 0x3a]
sub r8d, edx
cmp rsi, 0x16
jb 0x50e93f
jmp 0x50e9a4
xor eax, eax
lea rbx, [rsp + 0x3a]
mov ecx, 0x16
call fcn.00444780
add rsp, 0x50
pop rbp
ret
mov eax, esi
mov ecx, 0x16
call fcn.004564a0
mov eax, edi
mov ecx, 0x16
call fcn.004564a0
nop
nop dword [rax]
call fcn.004541c0
jmp fcn.0050e8c0

Function at 0x50e9e0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x50eadd
push rbp
mov rbp, rsp
sub rsp, 0x50
movabs rdx, 0x6ec7000eae657216
mov qword [rsp + 0x39], rdx
movabs rdx, 0x6476d674531b756e
mov qword [rsp + 0x40], rdx
movabs rdx, 0x65c0210c201d891b
mov qword [rsp + 0x48], rdx
movabs rdx, 0x10001509150d0515
mov qword [rsp + 0x1d], rdx
movabs rdx, 0xc13140d0d081306
mov qword [rsp + 0x25], rdx
movabs rdx, 0x81100000c13140d
mov qword [rsp + 0x29], rdx
movabs rdx, 0x51413030303040f
mov qword [rsp + 0x31], rdx
xor eax, eax
jmp 0x50ea80
movzx r9d, byte [rsp + rsi + 0x39]
sub r9d, edx
lea edx, [r9 + 0x72]
mov byte [rsp + rdi + 0x39], dl
lea edx, [r8 + 0x72]
mov byte [rsp + rsi + 0x39], dl
add rax, 2
nop dword [rax]
cmp rax, 0x1c
jge 0x50eaad
movzx edx, byte [rsp + rax + 0x1d]
movzx esi, byte [rsp + rax + 0x1e]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x17
jae 0x50ead0
movzx r8d, byte [rsp + rdi + 0x39]
sub r8d, edx
cmp rsi, 0x17
jb 0x50ea5f
jmp 0x50eac4
xor eax, eax
lea rbx, [rsp + 0x39]
mov ecx, 0x17
call fcn.00444780
add rsp, 0x50
pop rbp
ret
mov eax, esi
mov ecx, 0x17
call fcn.004564a0
mov eax, edi
mov ecx, 0x17
call fcn.004564a0
nop
nop dword [rax]
call fcn.004541c0
jmp fcn.0050e9e0