joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4e8500
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4e85fb
push rbp
mov rbp, rsp
sub rsp, 0x48
movabs rdx, 0xdd9bf36493746547
mov qword [rsp + 0x18], rdx
movabs rdx, 0xb8b67265dd9bf364
mov qword [rsp + 0x1c], rdx
movabs rdx, 0xd31d73c542f2aeff
mov qword [rsp + 0x24], rdx
movabs rdx, 0xd0f0c0b070a0b12
mov qword [rsp + 0x2c], rdx
movabs rdx, 0xd0b0e0c0c05130e
mov qword [rsp + 0x34], rdx
movabs rdx, 0x10030d0b0d0b0e0c
mov qword [rsp + 0x38], rdx
movabs rdx, 0x60a0310120d0613
mov qword [rsp + 0x40], rdx
xor eax, eax
jmp 0x4e8599
movzx r9d, byte [rsp + rsi + 0x18]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x51]
mov byte [rsp + rdi + 0x18], dl
mov byte [rsp + rsi + 0x18], r8b
add rax, 2
cmp rax, 0x1c
jge 0x4e85cb
movzx edx, byte [rsp + rax + 0x2c]
movzx esi, byte [rsp + rax + 0x2d]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x14
jae 0x4e85ee
movzx r8d, byte [rsp + rdi + 0x18]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x51]
cmp rsi, 0x14
jb 0x4e857f
jmp 0x4e85e2
xor eax, eax
lea rbx, [rsp + 0x18]
mov ecx, 0x14
call fcn.00443420
add rsp, 0x48
pop rbp
ret
mov eax, esi
mov ecx, 0x14
call fcn.00454ec0
mov eax, edi
mov ecx, 0x14
call fcn.00454ec0
nop
nop dword [rax + rax]
call fcn.00452c40
jmp fcn.004e8500

Function at 0x4e9ea0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4e9f9d
push rbp
mov rbp, rsp
sub rsp, 0x50
movabs rdx, 0x26bf2a8ac6ca803
mov qword [rsp + 0x1a], rdx
movabs rdx, 0x74a66eb04670026b
mov qword [rsp + 0x20], rdx
movabs rdx, 0x79bba9c6b76efb81
mov qword [rsp + 0x28], rdx
movabs rdx, 0x1411131301031205
mov qword [rsp + 0x30], rdx
movabs rdx, 0x113110a0f121307
mov qword [rsp + 0x38], rdx
movabs rdx, 0xf0c010f11000c12
mov qword [rsp + 0x40], rdx
movabs rdx, 0xe03031104031405
mov qword [rsp + 0x48], rdx
xor eax, eax
jmp 0x4e9f40
movzx r9d, byte [rsp + rsi + 0x1a]
sub r9d, edx
lea edx, [r9 - 0xa]
mov byte [rsp + rdi + 0x1a], dl
lea edx, [r8 - 0xa]
mov byte [rsp + rsi + 0x1a], dl
add rax, 2
nop dword [rax]
cmp rax, 0x20
jge 0x4e9f6d
movzx edx, byte [rsp + rax + 0x30]
movzx esi, byte [rsp + rax + 0x31]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x16
jae 0x4e9f90
movzx r8d, byte [rsp + rdi + 0x1a]
sub r8d, edx
cmp rsi, 0x16
jb 0x4e9f1f
jmp 0x4e9f84
xor eax, eax
lea rbx, [rsp + 0x1a]
mov ecx, 0x16
call fcn.00443420
add rsp, 0x50
pop rbp
ret
mov eax, esi
mov ecx, 0x16
call fcn.00454ec0
mov eax, edi
mov ecx, 0x16
call fcn.00454ec0
nop
nop dword [rax]
call fcn.00452c40
jmp fcn.004e9ea0
Function at 0x4ea5c0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4ea68c
push rbp
mov rbp, rsp
sub rsp, 0x30
movabs rdx, 0x659f61e34174d0aa
mov qword [rsp + 0x19], rdx
movabs rdx, 0xc3643c659f61e341
mov qword [rsp + 0x1c], rdx
movabs rdx, 0x40606060a010a03
mov qword [rsp + 0x24], rdx
mov dword [rsp + 0x2c], 0x40008
xor eax, eax
jmp 0x4ea625
movzx r9d, byte [rsp + rsi + 0x19]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x79]
mov byte [rsp + rdi + 0x19], dl
mov byte [rsp + rsi + 0x19], r8b
add rax, 2
cmp rax, 0xc
jge 0x4ea65c
movzx edx, byte [rsp + rax + 0x24]
movzx esi, byte [rsp + rax + 0x25]
mov edi, edx
xor edx, esi
add edx, eax
nop dword [rax + rax]
cmp rdi, 0xb
jae 0x4ea67f
movzx r8d, byte [rsp + rdi + 0x19]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x79]
cmp rsi, 0xb
jb 0x4ea60b
jmp 0x4ea673
xor eax, eax
lea rbx, [rsp + 0x19]
mov ecx, 0xb
call fcn.00443420
add rsp, 0x30
pop rbp
ret
mov eax, esi
mov ecx, 0xb
call fcn.00454ec0
mov eax, edi
mov ecx, 0xb
call fcn.00454ec0
nop
call fcn.00452c40
jmp fcn.004ea5c0

Function at 0x4eb6e0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4eb7ac
push rbp
mov rbp, rsp
sub rsp, 0x30
movabs rdx, 0x6e565b694d416643
mov qword [rsp + 0x18], rdx
mov word [rsp + 0x20], 0x4c64
movabs rdx, 0x309060001070507
mov qword [rsp + 0x22], rdx
movabs rdx, 0x905050604080309
mov qword [rsp + 0x28], rdx
xor eax, eax
jmp 0x4eb744
movzx r9d, byte [rsp + rsi + 0x18]
lea edx, [r9 + rdx]
lea edx, [rdx - 9]
mov byte [rsp + rdi + 0x18], dl
mov byte [rsp + rsi + 0x18], r8b
add rax, 2
cmp rax, 0xe
jge 0x4eb77c
movzx edx, byte [rsp + rax + 0x22]
movzx esi, byte [rsp + rax + 0x23]
mov edi, edx
xor edx, esi
add edx, eax
nop word [rax + rax]
cmp rdi, 0xa
jae 0x4eb79f
movzx r8d, byte [rsp + rdi + 0x18]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 9]
cmp rsi, 0xa
jb 0x4eb72a
jmp 0x4eb793
xor eax, eax
lea rbx, [rsp + 0x18]
mov ecx, 0xa
call fcn.00443420
add rsp, 0x30
pop rbp
ret
mov eax, esi
mov ecx, 0xa
call fcn.00454ec0
mov eax, edi
mov ecx, 0xa
call fcn.00454ec0
nop
call fcn.00452c40
jmp fcn.004eb6e0
Function at 0x4f3780
Capabilities:
Encrypt data using rc4 prga

Disassembly:
lea r12, [rsp - 0x38]
cmp r12, qword [r14 + 0x10]
jbe 0x4f3952
push rbp
mov rbp, rsp
sub rsp, 0xb0
movabs rdx, 0x795d5d4b20447169
mov qword [rsp + 0x1f], rdx
movabs rdx, 0x8e750fdf6f480779
mov qword [rsp + 0x26], rdx
movabs rdx, 0x65709c209b6ed072
mov qword [rsp + 0x2e], rdx
movabs rdx, 0x20f56e6faf747e72
mov qword [rsp + 0x36], rdx
movabs rdx, 0x209940c665858d6f
mov qword [rsp + 0x3e], rdx
movabs rdx, 0xa694b484a0656cc4
mov qword [rsp + 0x46], rdx
movabs rdx, 0x3d636f992ecf6fb6
mov qword [rsp + 0x4e], rdx
movabs rdx, 0x9378619a9c9874a8
mov qword [rsp + 0x56], rdx
movabs rdx, 0x2935553556201ea1
mov qword [rsp + 0x5e], rdx
movabs rdx, 0x3a09081832402031
mov qword [rsp + 0x66], rdx
movabs rdx, 0x2c0e1d2e27142d0b
mov qword [rsp + 0x6e], rdx
movabs rdx, 0xc1a2c0e1d2e2714
mov qword [rsp + 0x70], rdx
movabs rdx, 0x22443a12231a023e
mov qword [rsp + 0x78], rdx
movabs rdx, 0x610142b2f040b23
mov qword [rsp + 0x80], rdx
movabs rdx, 0x4131422625062e04
mov qword [rsp + 0x88], rdx
movabs rdx, 0x1a183b2d33122b15
mov qword [rsp + 0x90], rdx
movabs rdx, 0x444404051041333f
mov qword [rsp + 0x98], rdx
movabs rdx, 0x2c2a36212137043a
mov qword [rsp + 0xa0], rdx
movabs rdx, 0x243f2c0031393301
mov qword [rsp + 0xa8], rdx
xor eax, eax
jmp 0x4f38e7
movzx r9d, byte [rsp + rsi + 0x1f]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x72]
mov byte [rsp + rdi + 0x1f], dl
mov byte [rsp + rsi + 0x1f], r8b
add rax, 2
cmp rax, 0x4a
jge 0x4f391c
movzx edx, byte [rsp + rax + 0x66]
movzx esi, byte [rsp + rax + 0x67]
mov edi, edx
xor edx, esi
add edx, eax
nop dword [rax]
cmp rdi, 0x47
jae 0x4f3945
movzx r8d, byte [rsp + rdi + 0x1f]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x72]
cmp rsi, 0x47
jb 0x4f38cd
jmp 0x4f3936
xor eax, eax
lea rbx, [rsp + 0x1f]
mov ecx, 0x47
call fcn.00443420
add rsp, 0xb0
pop rbp
ret
mov eax, esi
mov ecx, 0x47
nop dword [rax]
call fcn.00454ec0
mov eax, edi
mov ecx, 0x47
call fcn.00454ec0
nop
call fcn.00452c40
jmp fcn.004f3780

Function at 0x4f5500
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4f55cc
push rbp
mov rbp, rsp
sub rsp, 0x38
movabs rdx, 0xe87478a5aaa99b2f
mov qword [rsp + 0x1f], rdx
movabs rdx, 0xb2756fe87478a5aa
mov qword [rsp + 0x22], rdx
movabs rdx, 0x10a05030402030a
mov qword [rsp + 0x2a], rdx
movabs rdx, 0x30402040207010a
mov qword [rsp + 0x30], rdx
xor eax, eax
jmp 0x4f556f
movzx r9d, byte [rsp + rsi + 0x1f]
sub r9d, edx
lea edx, [r9 - 0x16]
mov byte [rsp + rdi + 0x1f], dl
lea edx, [r8 - 0x16]
mov byte [rsp + rsi + 0x1f], dl
add rax, 2
cmp rax, 0xe
jge 0x4f559c
movzx edx, byte [rsp + rax + 0x2a]
movzx esi, byte [rsp + rax + 0x2b]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0xb
jae 0x4f55bf
movzx r8d, byte [rsp + rdi + 0x1f]
sub r8d, edx
cmp rsi, 0xb
jb 0x4f5552
jmp 0x4f55b3
xor eax, eax
lea rbx, [rsp + 0x1f]
mov ecx, 0xb
call fcn.00443420
add rsp, 0x38
pop rbp
ret
mov eax, esi
mov ecx, 0xb
call fcn.00454ec0
mov eax, edi
mov ecx, 0xb
call fcn.00454ec0
nop
call fcn.00452c40
jmp fcn.004f5500
Function at 0x4f6680
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4f679d
push rbp
mov rbp, rsp
sub rsp, 0x60
movabs rdx, 0xf6eb6fb3c74c235
mov qword [rsp + 0x19], rdx
movabs rdx, 0x7310694174bc2e63
mov qword [rsp + 0x21], rdx
movabs rdx, 0x38200add41fdf673
mov qword [rsp + 0x28], rdx
movabs rdx, 0xe6f74a5d2c0700d
mov qword [rsp + 0x30], rdx
movabs rdx, 0x107191e10091714
mov qword [rsp + 0x38], rdx
movabs rdx, 0x1016160a100a1a04
mov qword [rsp + 0x40], rdx
movabs rdx, 0x100e1a1300110410
mov qword [rsp + 0x48], rdx
movabs rdx, 0x9101a1b1a1e07
mov qword [rsp + 0x50], rdx
movabs rdx, 0x307161e05030c12
mov qword [rsp + 0x58], rdx
xor eax, eax
jmp 0x4f6740
movzx r9d, byte [rsp + rsi + 0x19]
sub r9d, edx
lea edx, [r9 + 0x5e]
mov byte [rsp + rdi + 0x19], dl
lea edx, [r8 + 0x5e]
mov byte [rsp + rsi + 0x19], dl
add rax, 2
nop word [rax + rax]
cmp rax, 0x28
jge 0x4f676d
movzx edx, byte [rsp + rax + 0x38]
movzx esi, byte [rsp + rax + 0x39]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x1f
jae 0x4f6790
movzx r8d, byte [rsp + rdi + 0x19]
sub r8d, edx
cmp rsi, 0x1f
jb 0x4f671d
jmp 0x4f6784
xor eax, eax
lea rbx, [rsp + 0x19]
mov ecx, 0x1f
call fcn.00443420
add rsp, 0x60
pop rbp
ret
mov eax, esi
mov ecx, 0x1f
call fcn.00454ec0
mov eax, edi
mov ecx, 0x1f
call fcn.00454ec0
nop
nop dword [rax]
call fcn.00452c40
jmp fcn.004f6680
Function at 0x4ffee0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4fffcc
push rbp
mov rbp, rsp
sub rsp, 0x48
movabs rdx, 0xf397a0e6e7f231e6
mov qword [rsp + 0x1f], rdx
movabs rdx, 0xe9f397a0e6e7f231
mov qword [rsp + 0x20], rdx
movabs rdx, 0xd64645b9e0d7f4fc
mov qword [rsp + 0x28], rdx
movabs rdx, 0x3040d10090a0202
mov qword [rsp + 0x30], rdx
movabs rdx, 0x7100c050000050d
mov qword [rsp + 0x38], rdx
movabs rdx, 0x80b070b0c0d060c
mov qword [rsp + 0x40], rdx
xor eax, eax
jmp 0x4fff6a
movzx r9d, byte [rsp + rsi + 0x1f]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x40]
mov byte [rsp + rdi + 0x1f], dl
mov byte [rsp + rsi + 0x1f], r8b
add rax, 2
cmp rax, 0x18
jge 0x4fff9c
movzx edx, byte [rsp + rax + 0x30]
movzx esi, byte [rsp + rax + 0x31]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x11
jae 0x4fffbf
movzx r8d, byte [rsp + rdi + 0x1f]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x40]
cmp rsi, 0x11
jb 0x4fff50
jmp 0x4fffb3
xor eax, eax
lea rbx, [rsp + 0x1f]
mov ecx, 0x11
call fcn.00443420
add rsp, 0x48
pop rbp
ret
mov eax, esi
mov ecx, 0x11
call fcn.00454ec0
mov eax, edi
mov ecx, 0x11
call fcn.00454ec0
nop
call fcn.00452c40
jmp fcn.004ffee0
Function at 0x505060
Capabilities:
Hash data using fnv

Disassembly:
test byte [rax], al
mov rcx, rbx
and ebx, 0x7f
shl rbx, 5
lea rdx, [rax + rbx]
xor eax, eax
jmp 0x505077
inc rax
cmp rax, 4
jge 0x50508f
lea rbx, [rdx + rax*8]
mov rbx, qword [rbx]
cmp rbx, rcx
jne 0x505074
mov eax, 1
ret
xor eax, eax
movabs rbx, 0xcbf29ce484222325
jmp 0x5050a0
inc rax
cmp rax, 4
jge 0x5050ae
mov rsi, qword [rdx + rax*8]
xor edi, edi
jmp 0x5050d7
and ebx, 3
lea rdx, [rdx + rbx*8]
xchg qword [rdx], rcx
xor eax, eax
ret
movzx r8d, sil
xor rbx, r8
inc rdi
shr rsi, 8
movabs r8, 0x100000001b3
imul rbx, r8
cmp rdi, 8
jl 0x5050bb
jmp 0x50509d

Function at 0x509fe0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x50a0ac
push rbp
mov rbp, rsp
sub rsp, 0x30
movabs rdx, 0x877f4325d38b6c43
mov qword [rsp + 0x18], rdx
mov word [rsp + 0x20], 0x5338
movabs rdx, 0x208060206070602
mov qword [rsp + 0x22], rdx
movabs rdx, 0x302030406070208
mov qword [rsp + 0x28], rdx
xor eax, eax
jmp 0x50a044
movzx r9d, byte [rsp + rsi + 0x18]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x71]
mov byte [rsp + rdi + 0x18], dl
mov byte [rsp + rsi + 0x18], r8b
add rax, 2
cmp rax, 0xe
jge 0x50a07c
movzx edx, byte [rsp + rax + 0x22]
movzx esi, byte [rsp + rax + 0x23]
mov edi, edx
xor edx, esi
add edx, eax
nop word [rax + rax]
cmp rdi, 0xa
jae 0x50a09f
movzx r8d, byte [rsp + rdi + 0x18]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x71]
cmp rsi, 0xa
jb 0x50a02a
jmp 0x50a093
xor eax, eax
lea rbx, [rsp + 0x18]
mov ecx, 0xa
call fcn.00443420
add rsp, 0x30
pop rbp
ret
mov eax, esi
mov ecx, 0xa
call fcn.00454ec0
mov eax, edi
mov ecx, 0xa
call fcn.00454ec0
nop
call fcn.00452c40
jmp fcn.00509fe0

Function at 0x50ab00
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x50abe6
push rbp
mov rbp, rsp
sub rsp, 0x38
movabs rdx, 0x49074ef1641c4740
mov qword [rsp + 0x18], rdx
movabs rdx, 0xd4007234472d4907
mov qword [rsp + 0x1e], rdx
movabs rdx, 0x40208000c070d0c
mov qword [rsp + 0x26], rdx
movabs rdx, 0x60a040208000c07
mov qword [rsp + 0x28], rdx
movabs rdx, 0x1070d0901020a04
mov qword [rsp + 0x30], rdx
xor eax, eax
nop
jmp 0x50ab80
movzx r9d, byte [rsp + rsi + 0x18]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x19]
mov byte [rsp + rdi + 0x18], dl
mov byte [rsp + rsi + 0x18], r8b
add rax, 2
nop dword [rax]
cmp rax, 0x12
jge 0x50abb2
movzx edx, byte [rsp + rax + 0x26]
movzx esi, byte [rsp + rax + 0x27]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0xe
jae 0x50abd7
movzx r8d, byte [rsp + rdi + 0x18]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x19]
cmp rsi, 0xe
jb 0x50ab62
jmp 0x50abcb
xor eax, eax
lea rbx, [rsp + 0x18]
mov ecx, 0xe
nop
call fcn.00443420
add rsp, 0x38
pop rbp
ret
mov eax, esi
mov ecx, 0xe
call fcn.00454ec0
mov eax, edi
mov ecx, 0xe
nop
call fcn.00454ec0
nop
call fcn.00452c40
jmp fcn.0050ab00
Function at 0x50bce0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
lea r12, [rsp - 8]
cmp r12, qword [r14 + 0x10]
jbe 0x50be3d
push rbp
mov rbp, rsp
add rsp, 0xffffffffffffff80
movabs rdx, 0x63aeda66b073cc94
mov qword [rsp + 0x1c], rdx
movabs rdx, 0x812ab799746e9264
mov qword [rsp + 0x24], rdx
movabs rdx, 0x7d66205c812ab799
mov qword [rsp + 0x28], rdx
movabs rdx, 0x6b71ab8b618d5772
mov qword [rsp + 0x30], rdx
movabs rdx, 0x6e7ba020a9657499
mov qword [rsp + 0x38], rdx
movabs rdx, 0xa07079b720a1748e
mov qword [rsp + 0x40], rdx
movabs rdx, 0x1f151c2b03261928
mov qword [rsp + 0x48], rdx
movabs rdx, 0xc010f0f1c01011a
mov qword [rsp + 0x50], rdx
movabs rdx, 0x102415080e2b1610
mov qword [rsp + 0x58], rdx
movabs rdx, 0x132b1b1b2822130d
mov qword [rsp + 0x60], rdx
movabs rdx, 0x321060c22001300
mov qword [rsp + 0x68], rdx
movabs rdx, 0x26010c132205011a
mov qword [rsp + 0x70], rdx
movabs rdx, 0x190f0c1509180822
mov qword [rsp + 0x78], rdx
xor eax, eax
jmp 0x50bde0
movzx r9d, byte [rsp + rsi + 0x1c]
sub r9d, edx
lea edx, [r9 + 0x1d]
mov byte [rsp + rdi + 0x1c], dl
lea edx, [r8 + 0x1d]
mov byte [rsp + rsi + 0x1c], dl
add rax, 2
nop dword [rax + rax]
cmp rax, 0x38
jge 0x50be0d
movzx edx, byte [rsp + rax + 0x48]
movzx esi, byte [rsp + rax + 0x49]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x2c
jae 0x50be30
movzx r8d, byte [rsp + rdi + 0x1c]
sub r8d, edx
cmp rsi, 0x2c
jb 0x50bdbe
jmp 0x50be24
xor eax, eax
lea rbx, [rsp + 0x1c]
mov ecx, 0x2c
call fcn.00443420
sub rsp, 0xffffffffffffff80
pop rbp
ret
mov eax, esi
mov ecx, 0x2c
call fcn.00454ec0
mov eax, edi
mov ecx, 0x2c
call fcn.00454ec0
nop
nop dword [rax]
call fcn.00452c40
jmp fcn.0050bce0

Function at 0x50d220
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x50d32c
push rbp
mov rbp, rsp
sub rsp, 0x58
movabs rdx, 0x6563cc5e5573165c
mov qword [rsp + 0x1c], rdx
movabs rdx, 0x65337467d459b6cb
mov qword [rsp + 0x24], rdx
movabs rdx, 0xbf6e246ce7787cee
mov qword [rsp + 0x2c], rdx
movabs rdx, 0x1304040001150f00
mov qword [rsp + 0x34], rdx
movabs rdx, 0xf09030a13040400
mov qword [rsp + 0x38], rdx
movabs rdx, 0x100a090910121513
mov qword [rsp + 0x40], rdx
movabs rdx, 0x811170a03090a0f
mov qword [rsp + 0x48], rdx
movabs rdx, 0xb0e05000e0100
mov qword [rsp + 0x50], rdx
xor eax, eax
jmp 0x50d2c8
movzx r9d, byte [rsp + rsi + 0x1c]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x71]
mov byte [rsp + rdi + 0x1c], dl
mov byte [rsp + rsi + 0x1c], r8b
add rax, 2
cmp rax, 0x24
jge 0x50d2fc
movzx edx, byte [rsp + rax + 0x34]
movzx esi, byte [rsp + rax + 0x35]
mov edi, edx
xor edx, esi
add edx, eax
nop
cmp rdi, 0x18
jae 0x50d31f
movzx r8d, byte [rsp + rdi + 0x1c]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x71]
cmp rsi, 0x18
jb 0x50d2ae
jmp 0x50d313
xor eax, eax
lea rbx, [rsp + 0x1c]
mov ecx, 0x18
call fcn.00443420
add rsp, 0x58
pop rbp
ret
mov eax, esi
mov ecx, 0x18
call fcn.00454ec0
mov eax, edi
mov ecx, 0x18
call fcn.00454ec0
nop
call fcn.00452c40
jmp fcn.0050d220
Function at 0x50d6c0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x50d7f8
push rbp
mov rbp, rsp
sub rsp, 0x68
movabs rdx, 0x79c9b70adf14bb21
mov qword [rsp + 0x1d], rdx
movabs rdx, 0xe79c9b70adf14bb
mov qword [rsp + 0x1e], rdx
movabs rdx, 0x2039726577816f88
mov qword [rsp + 0x26], rdx
movabs rdx, 0xab6bb4a27b6cc484
mov qword [rsp + 0x2e], rdx
movabs rdx, 0x2935263535bb3e42
mov qword [rsp + 0x36], rdx
movabs rdx, 0x1314151e0b0f1908
mov qword [rsp + 0x3e], rdx
movabs rdx, 0x919140f11081103
mov qword [rsp + 0x46], rdx
movabs rdx, 0x20b0919140f1108
mov qword [rsp + 0x48], rdx
movabs rdx, 0x5150a1312060611
mov qword [rsp + 0x50], rdx
movabs rdx, 0x140b12121b000012
mov qword [rsp + 0x58], rdx
movabs rdx, 0x218010a160f040a
mov qword [rsp + 0x60], rdx
xor eax, eax
jmp 0x50d795
movzx r9d, byte [rsp + rsi + 0x1d]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x7e]
mov byte [rsp + rdi + 0x1d], dl
mov byte [rsp + rsi + 0x1d], r8b
add rax, 2
cmp rax, 0x2a
jge 0x50d7c8
movzx edx, byte [rsp + rax + 0x3e]
movzx esi, byte [rsp + rax + 0x3f]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x21
jae 0x50d7eb
movzx r8d, byte [rsp + rdi + 0x1d]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x7e]
nop
cmp rsi, 0x21
jb 0x50d77b
jmp 0x50d7df
xor eax, eax
lea rbx, [rsp + 0x1d]
mov ecx, 0x21
call fcn.00443420
add rsp, 0x68
pop rbp
ret
mov eax, esi
mov ecx, 0x21
call fcn.00454ec0
mov eax, edi
mov ecx, 0x21
call fcn.00454ec0
nop
call fcn.00452c40
nop dword [rax]
jmp fcn.0050d6c0

Function at 0x50d820
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x50d958
push rbp
mov rbp, rsp
sub rsp, 0x70
movabs rdx, 0x55ab616dde206f74
mov qword [rsp + 0x1b], rdx
movabs rdx, 0xc2747541bf55ab61
mov qword [rsp + 0x20], rdx
movabs rdx, 0xbc42dc03b0c7722d
mov qword [rsp + 0x28], rdx
movabs rdx, 0x3204638370e75604
mov qword [rsp + 0x30], rdx
movabs rdx, 0x29193317350f5128
mov qword [rsp + 0x38], rdx
movabs rdx, 0x1011140317161b19
mov qword [rsp + 0x40], rdx
movabs rdx, 0x230f1c231b0d0617
mov qword [rsp + 0x48], rdx
movabs rdx, 0xd1614120c0d2319
mov qword [rsp + 0x50], rdx
movabs rdx, 0x1711080617031c21
mov qword [rsp + 0x58], rdx
movabs rdx, 0x1315021e151f0617
mov qword [rsp + 0x60], rdx
movabs rdx, 0x1623190821080710
mov qword [rsp + 0x68], rdx
xor eax, eax
jmp 0x50d8f8
movzx r9d, byte [rsp + rsi + 0x1b]
sub r9d, edx
lea edx, [r9 + 0x5e]
mov byte [rsp + rdi + 0x1b], dl
lea edx, [r8 + 0x5e]
mov byte [rsp + rsi + 0x1b], dl
add rax, 2
cmp rax, 0x30
jge 0x50d928
movzx edx, byte [rsp + rax + 0x40]
movzx esi, byte [rsp + rax + 0x41]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x25
jae 0x50d94b
movzx r8d, byte [rsp + rdi + 0x1b]
sub r8d, edx
nop dword [rax]
cmp rsi, 0x25
jb 0x50d8db
jmp 0x50d93f
xor eax, eax
lea rbx, [rsp + 0x1b]
mov ecx, 0x25
call fcn.00443420
add rsp, 0x70
pop rbp
ret
mov eax, esi
mov ecx, 0x25
call fcn.00454ec0
mov eax, edi
mov ecx, 0x25
call fcn.00454ec0
nop
call fcn.00452c40
nop dword [rax]
jmp fcn.0050d820
Function at 0x514f40
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x515018
push rbp
mov rbp, rsp
sub rsp, 0x38
movabs rdx, 0x20d8584b8bdb6f6e
mov qword [rsp + 0x1a], rdx
mov dword [rsp + 0x22], 0x8dde6faa
movabs rdx, 0x40405050a08080b
mov qword [rsp + 0x26], rdx
movabs rdx, 0xb04040405050a08
mov qword [rsp + 0x28], rdx
movabs rdx, 0x30602030405020a
mov qword [rsp + 0x30], rdx
xor eax, eax
jmp 0x514fb4
movzx r9d, byte [rsp + rsi + 0x1a]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x7a]
mov byte [rsp + rdi + 0x1a], dl
mov byte [rsp + rsi + 0x1a], r8b
add rax, 2
cmp rax, 0x12
jge 0x514fe8
movzx edx, byte [rsp + rax + 0x26]
movzx esi, byte [rsp + rax + 0x27]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0xc
jae 0x51500b
movzx r8d, byte [rsp + rdi + 0x1a]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x7a]
nop
cmp rsi, 0xc
jb 0x514f9a
jmp 0x514fff
xor eax, eax
lea rbx, [rsp + 0x1a]
mov ecx, 0xc
call fcn.00443420
add rsp, 0x38
pop rbp
ret
mov eax, esi
mov ecx, 0xc
call fcn.00454ec0
mov eax, edi
mov ecx, 0xc
call fcn.00454ec0
nop
call fcn.00452c40
nop dword [rax]
jmp fcn.00514f40

Function at 0x518000
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x5180fb
push rbp
mov rbp, rsp
sub rsp, 0x50
movabs rdx, 0xbfa18f6eb3657396
mov qword [rsp + 0x1f], rdx
movabs rdx, 0xa8bc8ed4ddbfa18f
mov qword [rsp + 0x24], rdx
movabs rdx, 0xcea8db506e47a7ad
mov qword [rsp + 0x2c], rdx
movabs rdx, 0xb0c14040b0d0703
mov qword [rsp + 0x34], rdx
movabs rdx, 0x130f110401130612
mov qword [rsp + 0x3c], rdx
movabs rdx, 0xe080e0f130f1104
mov qword [rsp + 0x40], rdx
movabs rdx, 0x600050a0e08090e
mov qword [rsp + 0x48], rdx
xor eax, eax
jmp 0x518099
movzx r9d, byte [rsp + rsi + 0x1f]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x51]
mov byte [rsp + rdi + 0x1f], dl
mov byte [rsp + rsi + 0x1f], r8b
add rax, 2
cmp rax, 0x1c
jge 0x5180cb
movzx edx, byte [rsp + rax + 0x34]
movzx esi, byte [rsp + rax + 0x35]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x15
jae 0x5180ee
movzx r8d, byte [rsp + rdi + 0x1f]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x51]
cmp rsi, 0x15
jb 0x51807f
jmp 0x5180e2
xor eax, eax
lea rbx, [rsp + 0x1f]
mov ecx, 0x15
call fcn.00443420
add rsp, 0x50
pop rbp
ret
mov eax, esi
mov ecx, 0x15
call fcn.00454ec0
mov eax, edi
mov ecx, 0x15
call fcn.00454ec0
nop
nop dword [rax + rax]
call fcn.00452c40
jmp fcn.00518000
Function at 0x519640
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov qword [rsp + 0x40], 0
movabs rdx, 0xc252a188b0f67ba8
mov qword [rsp + 0x1e], rdx
movabs rdx, 0x204020407000605
mov qword [rsp + 0x26], rdx
mov word [rsp + 0x2e], 0x500
xor eax, eax
jmp 0x519694
movzx r8d, byte [rsp + rbx + 0x1e]
lea edx, [r8 + rdx]
lea edx, [rdx - 0x66]
mov byte [rsp + rsi + 0x1e], dl
mov byte [rsp + rbx + 0x1e], dil
add rax, 2
cmp rax, 0xa
jge 0x5196c8
movzx edx, byte [rsp + rax + 0x26]
movzx ebx, byte [rsp + rax + 0x27]
mov esi, edx
xor edx, ebx
add edx, eax
cmp rsi, 8
jae 0x519705
movzx edi, byte [rsp + rsi + 0x1e]
lea edi, [rdi + rdx]
lea edi, [rdi - 0x66]
nop dword [rax + rax]
cmp rbx, 8
jb 0x51967a
jmp 0x5196f7
mov qword [rsp + 0x16], 0
xor eax, eax
jmp 0x5196e1
movzx ecx, byte [rsp + rax + 0x1e]
mov byte [rsp + rax + 0x16], cl
inc rax
cmp rax, 8
jl 0x5196d5
mov rax, qword [rsp + 0x16]
mov qword [rsp + 0x40], rax
add rsp, 0x30
pop rbp
ret
mov eax, ebx
mov ecx, 8
nop
call fcn.00454ec0
mov eax, esi
mov ecx, 8
call fcn.00454ec0
nop
int3

Function at 0x519a20
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x28
mov qword [rsp + 0x38], 0
movabs rax, 0x71387c1a8ec19740
mov qword [rsp + 0x18], rax
movabs rax, 0xe51b1371bcb6462c
mov qword [rsp + 0x20], rax
mov qword [rsp + 0xf], 0
mov qword [rsp + 0x10], 0
movzx eax, byte [rsp + 0x1d]
movzx ecx, byte [rsp + 0x26]
add eax, ecx
movzx ecx, byte [rsp + 0x20]
movzx edx, byte [rsp + 0x27]
xor ecx, edx
movzx edx, byte [rsp + 0x1b]
movzx ebx, byte [rsp + 0x1c]
sub edx, ebx
movzx ebx, byte [rsp + 0x1a]
movzx esi, byte [rsp + 0x22]
add ebx, esi
movzx esi, byte [rsp + 0x23]
movzx edi, byte [rsp + 0x1e]
sub esi, edi
movzx edi, byte [rsp + 0x19]
movzx r8d, byte [rsp + 0x18]
add edi, r8d
movzx r8d, byte [rsp + 0x24]
movzx r9d, byte [rsp + 0x25]
add r8d, r9d
movzx r9d, byte [rsp + 0x1f]
movzx r10d, byte [rsp + 0x21]
mov byte [rsp + 0xf], al
mov byte [rsp + 0x10], cl
mov byte [rsp + 0x11], dl
mov byte [rsp + 0x12], bl
mov byte [rsp + 0x13], sil
mov byte [rsp + 0x14], dil
mov byte [rsp + 0x15], r8b
lea eax, [r10 + r9]
mov byte [rsp + 0x16], al
mov qword [rsp + 7], 0
xor eax, eax
jmp 0x519b06
movzx ecx, byte [rsp + rax + 0xf]
mov byte [rsp + rax + 7], cl
inc rax
cmp rax, 8
jl 0x519afa
mov rax, qword [rsp + 7]
mov qword [rsp + 0x38], rax
add rsp, 0x28
pop rbp
ret