joyce8/EMBER2024-capa huggingface dataset:
Function at 0x509680
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x50974c
push rbp
mov rbp, rsp
sub rsp, 0x38
movabs rdx, 0xe6a0a09e458b0f53
mov qword [rsp + 0x2c], rdx
mov dword [rsp + 0x34], 0x656c01a0
movabs rdx, 0x409040408020605
mov qword [rsp + 0x1c], rdx
movabs rdx, 0x607080505010201
mov qword [rsp + 0x24], rdx
xor eax, eax
jmp 0x5096e5
movzx r9d, byte [rsp + rsi + 0x2c]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x5a]
mov byte [rsp + rdi + 0x2c], dl
mov byte [rsp + rsi + 0x2c], r8b
add rax, 2
cmp rax, 0x10
jge 0x50971c
movzx edx, byte [rsp + rax + 0x1c]
movzx esi, byte [rsp + rax + 0x1d]
mov edi, edx
xor edx, esi
add edx, eax
nop dword [rax + rax]
cmp rdi, 0xc
jae 0x50973f
movzx r8d, byte [rsp + rdi + 0x2c]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x5a]
cmp rsi, 0xc
jb 0x5096cb
jmp 0x509733
xor eax, eax
lea rbx, [rsp + 0x2c]
mov ecx, 0xc
call fcn.00467060
add rsp, 0x38
pop rbp
ret
mov eax, esi
mov ecx, 0xc
call fcn.0046d060
mov eax, edi
mov ecx, 0xc
call fcn.0046d060
nop
call fcn.0046ad80
jmp fcn.00509680

Function at 0x509760
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x50985b
push rbp
mov rbp, rsp
sub rsp, 0x50
movabs rdx, 0xd42acd6ad3e895a6
mov qword [rsp + 0x39], rdx
movabs rdx, 0x5684f3ce6d6ea3d4
mov qword [rsp + 0x40], rdx
movabs rdx, 0x43656c8361dcb761
mov qword [rsp + 0x48], rdx
movabs rdx, 0xc11060d160c0b
mov qword [rsp + 0x19], rdx
movabs rdx, 0x70602030d071102
mov qword [rsp + 0x21], rdx
movabs rdx, 0xd0802100311010b
mov qword [rsp + 0x29], rdx
movabs rdx, 0x403060213010506
mov qword [rsp + 0x31], rdx
xor eax, eax
jmp 0x5097f9
movzx r9d, byte [rsp + rsi + 0x39]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x4a]
mov byte [rsp + rdi + 0x39], dl
mov byte [rsp + rsi + 0x39], r8b
add rax, 2
cmp rax, 0x20
jge 0x50982b
movzx edx, byte [rsp + rax + 0x19]
movzx esi, byte [rsp + rax + 0x1a]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x17
jae 0x50984e
movzx r8d, byte [rsp + rdi + 0x39]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x4a]
cmp rsi, 0x17
jb 0x5097df
jmp 0x509842
xor eax, eax
lea rbx, [rsp + 0x39]
mov ecx, 0x17
call fcn.00467060
add rsp, 0x50
pop rbp
ret
mov eax, esi
mov ecx, 0x17
call fcn.0046d060
mov eax, edi
mov ecx, 0x17
call fcn.0046d060
nop
nop dword [rax + rax]
call fcn.0046ad80
jmp fcn.00509760
Function at 0x50a5c0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x50a68c
push rbp
mov rbp, rsp
sub rsp, 0x38
movabs rdx, 0x54656c3c48fc604e
mov qword [rsp + 0x2d], rdx
mov dword [rsp + 0x34], 0x96d3154
movabs rdx, 0x2040a000203080a
mov qword [rsp + 0x1d], rdx
movabs rdx, 0x808080308030201
mov qword [rsp + 0x25], rdx
xor eax, eax
jmp 0x50a625
movzx r9d, byte [rsp + rsi + 0x2d]
lea edx, [r9 + rdx]
lea edx, [rdx + 9]
mov byte [rsp + rdi + 0x2d], dl
mov byte [rsp + rsi + 0x2d], r8b
add rax, 2
cmp rax, 0x10
jge 0x50a65c
movzx edx, byte [rsp + rax + 0x1d]
movzx esi, byte [rsp + rax + 0x1e]
mov edi, edx
xor edx, esi
add edx, eax
nop dword [rax + rax]
cmp rdi, 0xb
jae 0x50a67f
movzx r8d, byte [rsp + rdi + 0x2d]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 9]
cmp rsi, 0xb
jb 0x50a60b
jmp 0x50a673
xor eax, eax
lea rbx, [rsp + 0x2d]
mov ecx, 0xb
call fcn.00467060
add rsp, 0x38
pop rbp
ret
mov eax, esi
mov ecx, 0xb
call fcn.0046d060
mov eax, edi
mov ecx, 0xb
call fcn.0046d060
nop
call fcn.0046ad80
jmp fcn.0050a5c0

Function at 0x50b4c0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x50b5aa
push rbp
mov rbp, rsp
sub rsp, 0x48
movabs rdx, 0x53fa6f443e691532
mov qword [rsp + 0x35], rdx
movabs rdx, 0x67422153fa6f443e
mov qword [rsp + 0x38], rdx
movabs rdx, 0x743c556a3e5f64db
mov qword [rsp + 0x40], rdx
movabs rdx, 0x6060e08040b0e
mov qword [rsp + 0x1d], rdx
movabs rdx, 0x110d01091110100e
mov qword [rsp + 0x25], rdx
movabs rdx, 0x100c0d090611030d
mov qword [rsp + 0x2d], rdx
xor eax, eax
jmp 0x50b54d
movzx r9d, byte [rsp + rsi + 0x35]
sub r9d, edx
lea edx, [r9 + 0x33]
mov byte [rsp + rdi + 0x35], dl
lea edx, [r8 + 0x33]
mov byte [rsp + rsi + 0x35], dl
add rax, 2
cmp rax, 0x18
jge 0x50b57a
movzx edx, byte [rsp + rax + 0x1d]
movzx esi, byte [rsp + rax + 0x1e]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x13
jae 0x50b59d
movzx r8d, byte [rsp + rdi + 0x35]
sub r8d, edx
cmp rsi, 0x13
jb 0x50b530
jmp 0x50b591
xor eax, eax
lea rbx, [rsp + 0x35]
mov ecx, 0x13
call fcn.00467060
add rsp, 0x48
pop rbp
ret
mov eax, esi
mov ecx, 0x13
call fcn.0046d060
mov eax, edi
mov ecx, 0x13
call fcn.0046d060
nop
call fcn.0046ad80
jmp fcn.0050b4c0
Function at 0x50b920
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x50b9d8
push rbp
mov rbp, rsp
sub rsp, 0x30
movabs rdx, 0x133be504b4110841
mov qword [rsp + 0x28], rdx
movabs rdx, 0x705060503010402
mov qword [rsp + 0x1e], rdx
mov word [rsp + 0x26], 0x107
xor eax, eax
jmp 0x50b975
movzx r9d, byte [rsp + rsi + 0x28]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x59]
mov byte [rsp + rdi + 0x28], dl
mov byte [rsp + rsi + 0x28], r8b
add rax, 2
cmp rax, 0xa
jge 0x50b9a8
movzx edx, byte [rsp + rax + 0x1e]
movzx esi, byte [rsp + rax + 0x1f]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 8
jae 0x50b9cb
movzx r8d, byte [rsp + rdi + 0x28]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x59]
nop
cmp rsi, 8
jb 0x50b95b
jmp 0x50b9bf
xor eax, eax
lea rbx, [rsp + 0x28]
mov ecx, 8
call fcn.00467060
add rsp, 0x30
pop rbp
ret
mov eax, esi
mov ecx, 8
call fcn.0046d060
mov eax, edi
mov ecx, 8
call fcn.0046d060
nop
call fcn.0046ad80
nop dword [rax]
jmp fcn.0050b920

Function at 0x50c6e0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x50c7b2
push rbp
mov rbp, rsp
sub rsp, 0x38
movabs rdx, 0x4e9565fc55c665ed
mov qword [rsp + 0x2a], rdx
movabs rdx, 0xa1b8a465a2614e95
mov qword [rsp + 0x30], rdx
movabs rdx, 0x6090d040902040c
mov qword [rsp + 0x1a], rdx
movabs rdx, 0x90b0b0909000c0b
mov qword [rsp + 0x22], rdx
xor eax, eax
jmp 0x50c74c
movzx r9d, byte [rsp + rsi + 0x2a]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x3b]
mov byte [rsp + rdi + 0x2a], dl
mov byte [rsp + rsi + 0x2a], r8b
add rax, 2
cmp rax, 0x10
jge 0x50c77e
movzx edx, byte [rsp + rax + 0x1a]
movzx esi, byte [rsp + rax + 0x1b]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0xe
jae 0x50c7a5
movzx r8d, byte [rsp + rdi + 0x2a]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x3b]
cmp rsi, 0xe
jb 0x50c732
jmp 0x50c795
xor eax, eax
lea rbx, [rsp + 0x2a]
mov ecx, 0xe
call fcn.00467060
add rsp, 0x38
pop rbp
ret
mov eax, esi
mov ecx, 0xe
nop dword [rax]
call fcn.0046d060
mov eax, edi
mov ecx, 0xe
call fcn.0046d060
nop
call fcn.0046ad80
jmp fcn.0050c6e0

Function at 0x50e060
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x50e126
push rbp
mov rbp, rsp
sub rsp, 0x30
movabs rdx, 0x17be0265c56f2266
mov qword [rsp + 0x25], rdx
mov dword [rsp + 0x2c], 0xb9656b17
movabs rdx, 0x50a060701070a00
mov qword [rsp + 0x19], rdx
mov dword [rsp + 0x21], 0xa010305
xor eax, eax
jmp 0x50e0c0
movzx r9d, byte [rsp + rsi + 0x25]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x60]
mov byte [rsp + rdi + 0x25], dl
mov byte [rsp + rsi + 0x25], r8b
add rax, 2
nop
cmp rax, 0xc
jge 0x50e0f2
movzx edx, byte [rsp + rax + 0x19]
movzx esi, byte [rsp + rax + 0x1a]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0xb
jae 0x50e117
movzx r8d, byte [rsp + rdi + 0x25]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x60]
cmp rsi, 0xb
jb 0x50e0a4
jmp 0x50e10b
xor eax, eax
lea rbx, [rsp + 0x25]
mov ecx, 0xb
nop
call fcn.00467060
add rsp, 0x30
pop rbp
ret
mov eax, esi
mov ecx, 0xb
call fcn.0046d060
mov eax, edi
mov ecx, 0xb
nop
call fcn.0046d060
nop
call fcn.0046ad80
jmp fcn.0050e060
Function at 0x50fce0
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x50fdaa
push rbp
mov rbp, rsp
sub rsp, 0x48
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rbx
mov qword [rsp], rax
mov qword [rsp + 8], rbx
mov byte [rsp + 0x10], 0
call fcn.004031e0
xorps xmm15, xmm15
mov r14, qword [0x007e8200]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x18], 0xffffffffffffffff
jne 0x50fd8f
mov rcx, qword [rsp + 0x60]
lea rdx, [rcx + 1]
mov qword [rsp + 0x40], rdx
lea rax, [0x00619440]
xor ebx, ebx
mov rcx, rdx
call fcn.004667c0
mov rbx, qword [rsp + 0x60]
mov rcx, rax
xor edi, edi
mov rsi, qword [rsp + 0x40]
mov rax, qword [rsp + 0x58]
nop dword [rax]
call fcn.005102e0
inc rbx
cmp rcx, rbx
jae 0x50fd7e
mov edi, 1
lea rsi, [0x00619440]
call fcn.004668a0
mov word [rax + rbx*2 - 2], 0
xor edi, edi
xor esi, esi
add rsp, 0x48
pop rbp
ret
xor eax, eax
xor ebx, ebx
mov rcx, rbx
lea rdi, [0x0068a378]
lea rsi, [0x00689ee0]
add rsp, 0x48
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.0046ad80
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.0050fce0

Function at 0x511ec0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x511f92
push rbp
mov rbp, rsp
sub rsp, 0x38
movabs rdx, 0xd220ce702a7fe224
mov qword [rsp + 0x2a], rdx
movabs rdx, 0x1cce721f7219d220
mov qword [rsp + 0x30], rdx
movabs rdx, 0xd02000a0a010803
mov qword [rsp + 0x1c], rdx
movabs rdx, 0x50c070d0c0d0d02
mov qword [rsp + 0x22], rdx
xor eax, eax
jmp 0x511f2c
movzx r9d, byte [rsp + rsi + 0x2a]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x3d]
mov byte [rsp + rdi + 0x2a], dl
mov byte [rsp + rsi + 0x2a], r8b
add rax, 2
cmp rax, 0xe
jge 0x511f5e
movzx edx, byte [rsp + rax + 0x1c]
movzx esi, byte [rsp + rax + 0x1d]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0xe
jae 0x511f85
movzx r8d, byte [rsp + rdi + 0x2a]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x3d]
cmp rsi, 0xe
jb 0x511f12
jmp 0x511f75
xor eax, eax
lea rbx, [rsp + 0x2a]
mov ecx, 0xe
call fcn.00467060
add rsp, 0x38
pop rbp
ret
mov eax, esi
mov ecx, 0xe
nop dword [rax]
call fcn.0046d060
mov eax, edi
mov ecx, 0xe
call fcn.0046d060
nop
call fcn.0046ad80
jmp fcn.00511ec0
Function at 0x513ec0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x513f9d
push rbp
mov rbp, rsp
sub rsp, 0x38
movabs rdx, 0x856d7a916b77657b
mov qword [rsp + 0x2b], rdx
movabs rdx, 0x596d848b65856d7a
mov qword [rsp + 0x30], rdx
movabs rdx, 0x70a0005090b0204
mov qword [rsp + 0x19], rdx
movabs rdx, 0xc03070a0005090b
mov qword [rsp + 0x1b], rdx
movabs rdx, 0xb04080007010204
mov qword [rsp + 0x23], rdx
xor eax, eax
nop
jmp 0x513f40
movzx r9d, byte [rsp + rsi + 0x2b]
sub r9d, edx
lea edx, [r9 + 3]
mov byte [rsp + rdi + 0x2b], dl
lea edx, [r8 + 3]
mov byte [rsp + rsi + 0x2b], dl
add rax, 2
nop
cmp rax, 0x12
jge 0x513f6d
movzx edx, byte [rsp + rax + 0x19]
movzx esi, byte [rsp + rax + 0x1a]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0xd
jae 0x513f90
movzx r8d, byte [rsp + rdi + 0x2b]
sub r8d, edx
cmp rsi, 0xd
jb 0x513f22
jmp 0x513f84
xor eax, eax
lea rbx, [rsp + 0x2b]
mov ecx, 0xd
call fcn.00467060
add rsp, 0x38
pop rbp
ret
mov eax, esi
mov ecx, 0xd
call fcn.0046d060
mov eax, edi
mov ecx, 0xd
call fcn.0046d060
nop
nop dword [rax]
call fcn.0046ad80
jmp fcn.00513ec0

Function at 0x515900
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x5159b8
push rbp
mov rbp, rsp
sub rsp, 0x30
movabs rdx, 0xa7bb907f9a89b646
mov qword [rsp + 0x28], rdx
movabs rdx, 0x402070301020607
mov qword [rsp + 0x1e], rdx
mov word [rsp + 0x26], 0x506
xor eax, eax
jmp 0x515955
movzx r9d, byte [rsp + rsi + 0x28]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x29]
mov byte [rsp + rdi + 0x28], dl
mov byte [rsp + rsi + 0x28], r8b
add rax, 2
cmp rax, 0xa
jge 0x515988
movzx edx, byte [rsp + rax + 0x1e]
movzx esi, byte [rsp + rax + 0x1f]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 8
jae 0x5159ab
movzx r8d, byte [rsp + rdi + 0x28]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x29]
nop
cmp rsi, 8
jb 0x51593b
jmp 0x51599f
xor eax, eax
lea rbx, [rsp + 0x28]
mov ecx, 8
call fcn.00467060
add rsp, 0x30
pop rbp
ret
mov eax, esi
mov ecx, 8
call fcn.0046d060
mov eax, edi
mov ecx, 8
call fcn.0046d060
nop
call fcn.0046ad80
nop dword [rax]
jmp fcn.00515900

Function at 0x5159e0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x515aa6
push rbp
mov rbp, rsp
sub rsp, 0x30
movabs rdx, 0x65622608d6df9ee8
mov qword [rsp + 0x27], rdx
mov byte [rsp + 0x2f], 0x72
movabs rdx, 0x205030001000000
mov qword [rsp + 0x1b], rdx
mov dword [rsp + 0x23], 0x40305
xor eax, eax
nop
jmp 0x515a40
movzx r9d, byte [rsp + rsi + 0x27]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x3d]
mov byte [rsp + rdi + 0x27], dl
mov byte [rsp + rsi + 0x27], r8b
add rax, 2
nop dword [rax]
cmp rax, 0xc
jge 0x515a72
movzx edx, byte [rsp + rax + 0x1b]
movzx esi, byte [rsp + rax + 0x1c]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 9
jae 0x515a97
movzx r8d, byte [rsp + rdi + 0x27]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x3d]
cmp rsi, 9
jb 0x515a22
jmp 0x515a8b
xor eax, eax
lea rbx, [rsp + 0x27]
mov ecx, 9
nop
call fcn.00467060
add rsp, 0x30
pop rbp
ret
mov eax, esi
mov ecx, 9
call fcn.0046d060
mov eax, edi
mov ecx, 9
nop
call fcn.0046d060
nop
call fcn.0046ad80
jmp fcn.005159e0
Function at 0x515d00
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x515db2
push rbp
mov rbp, rsp
sub rsp, 0x28
movabs rdx, 0x72446255655f482a
mov qword [rsp + 0x20], rdx
movabs rdx, 0x100000601000402
mov qword [rsp + 0x18], rdx
xor eax, eax
jmp 0x515d4e
movzx r9d, byte [rsp + rsi + 0x20]
lea edx, [r9 + rdx]
lea edx, [rdx + 8]
mov byte [rsp + rdi + 0x20], dl
mov byte [rsp + rsi + 0x20], r8b
add rax, 2
cmp rax, 8
jge 0x515d82
movzx edx, byte [rsp + rax + 0x18]
movzx esi, byte [rsp + rax + 0x19]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 8
jae 0x515da5
movzx r8d, byte [rsp + rdi + 0x20]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 8]
cmp rsi, 8
jb 0x515d34
nop
jmp 0x515d99
xor eax, eax
lea rbx, [rsp + 0x20]
mov ecx, 8
call fcn.00467060
add rsp, 0x28
pop rbp
ret
mov eax, esi
mov ecx, 8
call fcn.0046d060
mov eax, edi
mov ecx, 8
call fcn.0046d060
nop
call fcn.0046ad80
jmp fcn.00515d00

Function at 0x515dc0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x515eaa
push rbp
mov rbp, rsp
sub rsp, 0x48
movabs rdx, 0x22d203a272c69cc
mov qword [rsp + 0x34], rdx
movabs rdx, 0x236c8903022d203a
mov qword [rsp + 0x38], rdx
movabs rdx, 0x5965bc6d56c13f44
mov qword [rsp + 0x40], rdx
movabs rdx, 0x90e00030b1106
mov qword [rsp + 0x1c], rdx
movabs rdx, 0x40e02090d000907
mov qword [rsp + 0x24], rdx
movabs rdx, 0x80c0f130d06080d
mov qword [rsp + 0x2c], rdx
xor eax, eax
jmp 0x515e4d
movzx r9d, byte [rsp + rsi + 0x34]
sub r9d, edx
lea edx, [r9 + 0x4c]
mov byte [rsp + rdi + 0x34], dl
lea edx, [r8 + 0x4c]
mov byte [rsp + rsi + 0x34], dl
add rax, 2
cmp rax, 0x18
jge 0x515e7a
movzx edx, byte [rsp + rax + 0x1c]
movzx esi, byte [rsp + rax + 0x1d]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x14
jae 0x515e9d
movzx r8d, byte [rsp + rdi + 0x34]
sub r8d, edx
cmp rsi, 0x14
jb 0x515e30
jmp 0x515e91
xor eax, eax
lea rbx, [rsp + 0x34]
mov ecx, 0x14
call fcn.00467060
add rsp, 0x48
pop rbp
ret
mov eax, esi
mov ecx, 0x14
call fcn.0046d060
mov eax, edi
mov ecx, 0x14
call fcn.0046d060
nop
call fcn.0046ad80
jmp fcn.00515dc0
Function at 0x518dc0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x518ebb
push rbp
mov rbp, rsp
sub rsp, 0x48
movabs rdx, 0x6e616974d12533b9
mov qword [rsp + 0x32], rdx
movabs rdx, 0xc10a263ba8206e61
mov qword [rsp + 0x38], rdx
movabs rdx, 0x252509d920050761
mov qword [rsp + 0x40], rdx
movabs rdx, 0xf000215090d0d00
mov qword [rsp + 0x18], rdx
movabs rdx, 0x3120f010d030a0c
mov qword [rsp + 0x20], rdx
movabs rdx, 0x91003120f010d03
mov qword [rsp + 0x22], rdx
movabs rdx, 0xd130b0b03140a0a
mov qword [rsp + 0x2a], rdx
xor eax, eax
jmp 0x518e59
movzx r9d, byte [rsp + rsi + 0x32]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x25]
mov byte [rsp + rdi + 0x32], dl
mov byte [rsp + rsi + 0x32], r8b
add rax, 2
cmp rax, 0x1a
jge 0x518e8b
movzx edx, byte [rsp + rax + 0x18]
movzx esi, byte [rsp + rax + 0x19]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x16
jae 0x518eae
movzx r8d, byte [rsp + rdi + 0x32]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x25]
cmp rsi, 0x16
jb 0x518e3f
jmp 0x518ea2
xor eax, eax
lea rbx, [rsp + 0x32]
mov ecx, 0x16
call fcn.00467060
add rsp, 0x48
pop rbp
ret
mov eax, esi
mov ecx, 0x16
call fcn.0046d060
mov eax, edi
mov ecx, 0x16
call fcn.0046d060
nop
nop dword [rax + rax]
call fcn.0046ad80
jmp fcn.00518dc0

Function at 0x51ac40
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x51ad5d
push rbp
mov rbp, rsp
sub rsp, 0x60
movabs rdx, 0xda316172c26e652d
mov qword [rsp + 0x41], rdx
movabs rdx, 0xc66c397af5a472bb
mov qword [rsp + 0x49], rdx
movabs rdx, 0x8bdd61e4c6ec01c6
mov qword [rsp + 0x50], rdx
movabs rdx, 0xef6dcba69264efc2
mov qword [rsp + 0x58], rdx
movabs rdx, 0x120f1c151500060a
mov qword [rsp + 0x19], rdx
movabs rdx, 0x160f08080d13030a
mov qword [rsp + 0x21], rdx
movabs rdx, 0xc111308160f060f
mov qword [rsp + 0x29], rdx
movabs rdx, 0x131e0b10071b0017
mov qword [rsp + 0x31], rdx
movabs rdx, 0x181711061a1a180e
mov qword [rsp + 0x39], rdx
xor eax, eax
jmp 0x51ad00
movzx r9d, byte [rsp + rsi + 0x41]
sub r9d, edx
lea edx, [r9 - 0x50]
mov byte [rsp + rdi + 0x41], dl
lea edx, [r8 - 0x50]
mov byte [rsp + rsi + 0x41], dl
add rax, 2
nop word [rax + rax]
cmp rax, 0x28
jge 0x51ad2d
movzx edx, byte [rsp + rax + 0x19]
movzx esi, byte [rsp + rax + 0x1a]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x1f
jae 0x51ad50
movzx r8d, byte [rsp + rdi + 0x41]
sub r8d, edx
cmp rsi, 0x1f
jb 0x51acdd
jmp 0x51ad44
xor eax, eax
lea rbx, [rsp + 0x41]
mov ecx, 0x1f
call fcn.00467060
add rsp, 0x60
pop rbp
ret
mov eax, esi
mov ecx, 0x1f
call fcn.0046d060
mov eax, edi
mov ecx, 0x1f
call fcn.0046d060
nop
nop dword [rax]
call fcn.0046ad80
jmp fcn.0051ac40
Function at 0x51bfa0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x51c08a
push rbp
mov rbp, rsp
sub rsp, 0x48
movabs rdx, 0x447473d2eca353dc
mov qword [rsp + 0x30], rdx
movabs rdx, 0x77e861745320f9e4
mov qword [rsp + 0x38], rdx
movabs rdx, 0x6ad0de6ba3e15961
mov qword [rsp + 0x40], rdx
movabs rdx, 0x1516111204071717
mov qword [rsp + 0x18], rdx
movabs rdx, 0x917001402130e08
mov qword [rsp + 0x20], rdx
movabs rdx, 0x40f031215150f
mov qword [rsp + 0x28], rdx
xor eax, eax
jmp 0x51c02d
movzx r9d, byte [rsp + rsi + 0x30]
sub r9d, edx
lea edx, [r9 - 0x68]
mov byte [rsp + rdi + 0x30], dl
lea edx, [r8 - 0x68]
mov byte [rsp + rsi + 0x30], dl
add rax, 2
cmp rax, 0x18
jge 0x51c05a
movzx edx, byte [rsp + rax + 0x18]
movzx esi, byte [rsp + rax + 0x19]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x18
jae 0x51c07d
movzx r8d, byte [rsp + rdi + 0x30]
sub r8d, edx
cmp rsi, 0x18
jb 0x51c010
jmp 0x51c071
xor eax, eax
lea rbx, [rsp + 0x30]
mov ecx, 0x18
call fcn.00467060
add rsp, 0x48
pop rbp
ret
mov eax, esi
mov ecx, 0x18
call fcn.0046d060
mov eax, edi
mov ecx, 0x18
call fcn.0046d060
nop
call fcn.0046ad80
jmp fcn.0051bfa0

Function at 0x51ee40
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x51ef48
push rbp
mov rbp, rsp
sub rsp, 0x58
movabs rdx, 0x5774df3a06032e45
mov qword [rsp + 0x3a], rdx
movabs rdx, 0x61634872006d4d48
mov qword [rsp + 0x42], rdx
movabs rdx, 0x58f861383b1a6163
mov qword [rsp + 0x48], rdx
movabs rdx, 0x656d58544c04052d
mov qword [rsp + 0x50], rdx
movabs rdx, 0x15090d0500180b05
mov qword [rsp + 0x1a], rdx
movabs rdx, 0x190b161110020004
mov qword [rsp + 0x22], rdx
movabs rdx, 0x140308031b0d1719
mov qword [rsp + 0x2a], rdx
movabs rdx, 0x407020312000917
mov qword [rsp + 0x32], rdx
xor eax, eax
jmp 0x51eeeb
movzx r9d, byte [rsp + rsi + 0x3a]
sub r9d, edx
lea edx, [r9 + 0x39]
mov byte [rsp + rdi + 0x3a], dl
lea edx, [r8 + 0x39]
mov byte [rsp + rsi + 0x3a], dl
add rax, 2
cmp rax, 0x20
jge 0x51ef18
movzx edx, byte [rsp + rax + 0x1a]
movzx esi, byte [rsp + rax + 0x1b]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x1e
jae 0x51ef3b
movzx r8d, byte [rsp + rdi + 0x3a]
sub r8d, edx
cmp rsi, 0x1e
jb 0x51eece
jmp 0x51ef2f
xor eax, eax
lea rbx, [rsp + 0x3a]
mov ecx, 0x1e
call fcn.00467060
add rsp, 0x58
pop rbp
ret
mov eax, esi
mov ecx, 0x1e
call fcn.0046d060
mov eax, edi
mov ecx, 0x1e
call fcn.0046d060
nop
call fcn.0046ad80
jmp fcn.0051ee40
Function at 0x51fcc0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x51fdaa
push rbp
mov rbp, rsp
sub rsp, 0x48
movabs rdx, 0xe55320dc6fcc7535
mov qword [rsp + 0x35], rdx
movabs rdx, 0xbec3d0e55320dc6f
mov qword [rsp + 0x38], rdx
movabs rdx, 0x66df69f8e1e693cc
mov qword [rsp + 0x40], rdx
movabs rdx, 0xa0b0e1202000809
mov qword [rsp + 0x1f], rdx
movabs rdx, 0x110f07120b000a0b
mov qword [rsp + 0x25], rdx
movabs rdx, 0x20b070e0c0d04
mov qword [rsp + 0x2d], rdx
xor eax, eax
jmp 0x51fd4d
movzx r9d, byte [rsp + rsi + 0x35]
sub r9d, edx
lea edx, [r9 - 0x61]
mov byte [rsp + rdi + 0x35], dl
lea edx, [r8 - 0x61]
mov byte [rsp + rsi + 0x35], dl
add rax, 2
cmp rax, 0x16
jge 0x51fd7a
movzx edx, byte [rsp + rax + 0x1f]
movzx esi, byte [rsp + rax + 0x20]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x13
jae 0x51fd9d
movzx r8d, byte [rsp + rdi + 0x35]
sub r8d, edx
cmp rsi, 0x13
jb 0x51fd30
jmp 0x51fd91
xor eax, eax
lea rbx, [rsp + 0x35]
mov ecx, 0x13
call fcn.00467060
add rsp, 0x48
pop rbp
ret
mov eax, esi
mov ecx, 0x13
call fcn.0046d060
mov eax, edi
mov ecx, 0x13
call fcn.0046d060
nop
call fcn.0046ad80
jmp fcn.0051fcc0

Function at 0x5207e0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x5208dd
push rbp
mov rbp, rsp
sub rsp, 0x48
movabs rdx, 0x42061e6164c63c4b
mov qword [rsp + 0x34], rdx
movabs rdx, 0xf024d7442061e61
mov qword [rsp + 0x38], rdx
movabs rdx, 0x651b05342047d8f5
mov qword [rsp + 0x40], rdx
movabs rdx, 0xa0c121006110a0c
mov qword [rsp + 0x1a], rdx
movabs rdx, 0x60b0d0b0702010e
mov qword [rsp + 0x22], rdx
movabs rdx, 0x1100060b0d0b0702
mov qword [rsp + 0x24], rdx
movabs rdx, 0xb0b0d0907060b05
mov qword [rsp + 0x2c], rdx
xor eax, eax
jmp 0x520880
movzx r9d, byte [rsp + rsi + 0x34]
sub r9d, edx
lea edx, [r9 + 0x3f]
mov byte [rsp + rdi + 0x34], dl
lea edx, [r8 + 0x3f]
mov byte [rsp + rsi + 0x34], dl
add rax, 2
nop dword [rax]
cmp rax, 0x1a
jge 0x5208ad
movzx edx, byte [rsp + rax + 0x1a]
movzx esi, byte [rsp + rax + 0x1b]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x14
jae 0x5208d0
movzx r8d, byte [rsp + rdi + 0x34]
sub r8d, edx
cmp rsi, 0x14
jb 0x52085f
jmp 0x5208c4
xor eax, eax
lea rbx, [rsp + 0x34]
mov ecx, 0x14
call fcn.00467060
add rsp, 0x48
pop rbp
ret
mov eax, esi
mov ecx, 0x14
call fcn.0046d060
mov eax, edi
mov ecx, 0x14
call fcn.0046d060
nop
nop dword [rax]
call fcn.0046ad80
jmp fcn.005207e0