joyce8/EMBER2024-capa huggingface dataset:
Function at 0x50e9a0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x50ea9f
sub rsp, 0x40
mov qword [rsp + 0x38], rbp
lea rbp, [rsp + 0x38]
movabs rdx, 0xdb9ed5752fe95456
mov qword [rsp + 0x1a], rdx
mov dword [rsp + 0x22], 0xa1725b52
movabs rdx, 0x3020806010b0808
mov qword [rsp + 0x26], rdx
movabs rdx, 0x80903020806010b
mov qword [rsp + 0x28], rdx
movabs rdx, 0x509070205010b08
mov qword [rsp + 0x30], rdx
xor eax, eax
nop
jmp 0x50ea20
movzx r9d, byte [rsp + rsi + 0x1a]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x7c]
mov byte [rsp + rdi + 0x1a], dl
mov byte [rsp + rsi + 0x1a], r8b
add rax, 2
nop dword [rax]
cmp rax, 0x12
jge 0x50ea5c
movzx edx, byte [rsp + rax + 0x26]
lea rsi, [rax + 1]
cmp rsi, 0x12
jae 0x50ea91
movzx esi, byte [rsp + rax + 0x27]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0xc
jae 0x50ea85
movzx r8d, byte [rsp + rdi + 0x1a]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x7c]
cmp rsi, 0xc
jb 0x50ea02
jmp 0x50ea77
xor eax, eax
lea rbx, [rsp + 0x1a]
mov ecx, 0xc
call fcn.00446000
mov rbp, qword [rsp + 0x38]
add rsp, 0x40
ret
mov eax, esi
mov ecx, 0xc
nop
call fcn.00457f40
mov eax, edi
mov ecx, 0xc
call fcn.00457f40
mov rax, rsi
mov ecx, 0x12
call fcn.00457f40
nop
nop
call fcn.00455860
jmp fcn.0050e9a0

Function at 0x50eac0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x50ebb3
sub rsp, 0x38
mov qword [rsp + 0x30], rbp
lea rbp, [rsp + 0x30]
movabs rdx, 0x9072905c967dac4e
mov qword [rsp + 0x19], rdx
movabs rdx, 0x647c859072905c96
mov qword [rsp + 0x1c], rdx
movabs rdx, 0x304040808010707
mov qword [rsp + 0x24], rdx
mov dword [rsp + 0x2c], 0x4090205
xor eax, eax
jmp 0x50eb2b
movzx r9d, byte [rsp + rsi + 0x19]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x2b]
mov byte [rsp + rdi + 0x19], dl
mov byte [rsp + rsi + 0x19], r8b
add rax, 2
cmp rax, 0xc
jge 0x50eb6d
movzx edx, byte [rsp + rax + 0x24]
lea rsi, [rax + 1]
nop word [rax + rax]
cmp rsi, 0xc
jae 0x50eba5
movzx esi, byte [rsp + rax + 0x25]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0xb
jae 0x50eb94
movzx r8d, byte [rsp + rdi + 0x19]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x2b]
cmp rsi, 0xb
jb 0x50eb11
jmp 0x50eb88
xor eax, eax
lea rbx, [rsp + 0x19]
mov ecx, 0xb
call fcn.00446000
mov rbp, qword [rsp + 0x30]
add rsp, 0x38
ret
mov eax, esi
mov ecx, 0xb
call fcn.00457f40
mov eax, edi
mov ecx, 0xb
nop dword [rax + rax]
call fcn.00457f40
mov rax, rsi
mov ecx, 0xc
call fcn.00457f40
nop
call fcn.00455860
jmp fcn.0050eac0
Function at 0x50f020
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x50f13f
sub rsp, 0x50
mov qword [rsp + 0x48], rbp
lea rbp, [rsp + 0x48]
movabs rdx, 0x475c0f293cd26558
mov qword [rsp + 0x1a], rdx
movabs rdx, 0x654de647475c0f29
mov qword [rsp + 0x1e], rdx
movabs rdx, 0x30383b2b79176f3e
mov qword [rsp + 0x26], rdx
movabs rdx, 0x10030c050e090902
mov qword [rsp + 0x2e], rdx
movabs rdx, 0x12040c02070e0c12
mov qword [rsp + 0x36], rdx
movabs rdx, 0x121112040c02070e
mov qword [rsp + 0x38], rdx
movabs rdx, 0x906100c00130808
mov qword [rsp + 0x40], rdx
xor eax, eax
jmp 0x50f0c2
movzx r9d, byte [rsp + rsi + 0x1a]
sub r9d, edx
lea edx, [r9 + 0x3e]
mov byte [rsp + rdi + 0x1a], dl
lea edx, [r8 + 0x3e]
mov byte [rsp + rsi + 0x1a], dl
add rax, 2
cmp rax, 0x1a
jge 0x50f0f9
movzx edx, byte [rsp + rax + 0x2e]
lea rsi, [rax + 1]
cmp rsi, 0x1a
jae 0x50f131
movzx esi, byte [rsp + rax + 0x2f]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x14
jae 0x50f125
movzx r8d, byte [rsp + rdi + 0x1a]
sub r8d, edx
cmp rsi, 0x14
jb 0x50f0a5
jmp 0x50f114
xor eax, eax
lea rbx, [rsp + 0x1a]
mov ecx, 0x14
call fcn.00446000
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
mov eax, esi
mov ecx, 0x14
nop dword [rax + rax]
call fcn.00457f40
mov eax, edi
mov ecx, 0x14
call fcn.00457f40
mov rax, rsi
mov ecx, 0x1a
call fcn.00457f40
nop
nop
call fcn.00455860
jmp fcn.0050f020
Function at 0x513c00
Capabilities:
Encrypt data using rc4 prga

Disassembly:
lea r12, [rsp - 0x48]
cmp r12, qword [r14 + 0x10]
jbe 0x513d94
sub rsp, 0xc8
mov qword [rsp + 0xc0], rbp
lea rbp, [rsp + 0xc0]
movabs rdx, 0x7907246d3c793c4d
mov qword [rsp + 0x1b], rdx
movabs rdx, 0x3802177e783b4b79
mov qword [rsp + 0x22], rdx
movabs rdx, 0x65624f1c0fb165bf
mov qword [rsp + 0x2a], rdx
movabs rdx, 0x9572956f2d747972
mov qword [rsp + 0x32], rdx
movabs rdx, 0x6ed6c542928d2acc
mov qword [rsp + 0x3a], rdx
movabs rdx, 0x26064b44206d6cc5
mov qword [rsp + 0x42], rdx
movabs rdx, 0x6b633c7370687a79
mov qword [rsp + 0x4a], rdx
movabs rdx, 0x681760df1fc46e69
mov qword [rsp + 0x52], rdx
movabs rdx, 0xfa35e43538cafc31
mov qword [rsp + 0x5a], rdx
movabs rdx, 0x1d1c0a1c022c3b38
mov qword [rsp + 0x62], rdx
movabs rdx, 0x21380b06111e2229
mov qword [rsp + 0x6a], rdx
lea rdi, [rsp + 0x70]
lea rsi, [0x006ca8c6]
nop word [rax + rax]
mov qword [rsp - 0x10], rbp
lea rbp, [rsp - 0x10]
call fcn.0045857a
mov rbp, qword [rbp]
xor eax, eax
jmp 0x513d11
movzx r9d, byte [rsp + rsi + 0x1b]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x40]
mov byte [rsp + rdi + 0x1b], dl
mov byte [rsp + rsi + 0x1b], r8b
add rax, 2
cmp rax, 0x5e
jge 0x513d4d
movzx edx, byte [rsp + rax + 0x62]
lea rsi, [rax + 1]
cmp rsi, 0x5e
jae 0x513d86
movzx esi, byte [rsp + rax + 0x63]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x47
jae 0x513d7a
movzx r8d, byte [rsp + rdi + 0x1b]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x40]
cmp rsi, 0x47
jb 0x513cf7
jmp 0x513d6e
xor eax, eax
lea rbx, [rsp + 0x1b]
mov ecx, 0x47
call fcn.00446000
mov rbp, qword [rsp + 0xc0]
add rsp, 0xc8
ret
mov eax, esi
mov ecx, 0x47
call fcn.00457f40
mov eax, edi
mov ecx, 0x47
call fcn.00457f40
mov rax, rsi
mov ecx, 0x5e
call fcn.00457f40
nop
call fcn.00455860
jmp fcn.00513c00
Function at 0x514000
Capabilities:
Encrypt data using rc4 prga

Disassembly:
lea r12, [rsp - 0x38]
cmp r12, qword [r14 + 0x10]
jbe 0x5141f4
sub rsp, 0xb8
mov qword [rsp + 0xb0], rbp
lea rbp, [rsp + 0xb0]
movabs rdx, 0x79bc7cce20d44a74
mov qword [rsp + 0x1f], rdx
movabs rdx, 0x72c4ea6e6f1b0b79
mov qword [rsp + 0x26], rdx
movabs rdx, 0x87708873146ed4e2
mov qword [rsp + 0x2e], rdx
movabs rdx, 0x20e96e1cd3ab2672
mov qword [rsp + 0x36], rdx
movabs rdx, 0x19b0072061e5da67
mov qword [rsp + 0x3e], rdx
movabs rdx, 0x48b56966203b9c67
mov qword [rsp + 0x46], rdx
movabs rdx, 0x63cdce6d77726f74
mov qword [rsp + 0x4e], rdx
movabs rdx, 0x378c066f936b2e7
mov qword [rsp + 0x56], rdx
movabs rdx, 0x35091d063834514d
mov qword [rsp + 0x5e], rdx
movabs rdx, 0x1212083638384535
mov qword [rsp + 0x66], rdx
movabs rdx, 0x2913100d252e2f39
mov qword [rsp + 0x6e], rdx
movabs rdx, 0x13052913100d252e
mov qword [rsp + 0x70], rdx
movabs rdx, 0x12373e2501203b14
mov qword [rsp + 0x78], rdx
movabs rdx, 0x2419333443040c20
mov qword [rsp + 0x80], rdx
movabs rdx, 0x2f361d451f38323f
mov qword [rsp + 0x88], rdx
movabs rdx, 0x3f023e062832440f
mov qword [rsp + 0x90], rdx
movabs rdx, 0x40343c08241b0816
mov qword [rsp + 0x98], rdx
movabs rdx, 0x2d3a1446061f2938
mov qword [rsp + 0xa0], rdx
movabs rdx, 0x1a2f093b26182125
mov qword [rsp + 0xa8], rdx
xor eax, eax
jmp 0x514176
movzx r9d, byte [rsp + rsi + 0x1f]
sub r9d, edx
lea edx, [r9 - 0x36]
mov byte [rsp + rdi + 0x1f], dl
lea edx, [r8 - 0x36]
mov byte [rsp + rsi + 0x1f], dl
add rax, 2
cmp rax, 0x4a
jge 0x5141ad
movzx edx, byte [rsp + rax + 0x66]
lea rsi, [rax + 1]
cmp rsi, 0x4a
jae 0x5141e6
movzx esi, byte [rsp + rax + 0x67]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x47
jae 0x5141da
movzx r8d, byte [rsp + rdi + 0x1f]
sub r8d, edx
cmp rsi, 0x47
jb 0x514159
jmp 0x5141ce
xor eax, eax
lea rbx, [rsp + 0x1f]
mov ecx, 0x47
call fcn.00446000
mov rbp, qword [rsp + 0xb0]
add rsp, 0xb8
ret
mov eax, esi
mov ecx, 0x47
call fcn.00457f40
mov eax, edi
mov ecx, 0x47
call fcn.00457f40
mov rax, rsi
mov ecx, 0x4a
call fcn.00457f40
nop
call fcn.00455860
jmp fcn.00514000
Function at 0x514ce0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x514e29
sub rsp, 0x68
mov qword [rsp + 0x60], rbp
lea rbp, [rsp + 0x60]
movabs rdx, 0x8c809f70b48f8d7e
mov qword [rsp + 0x1b], rdx
movabs rdx, 0x668c809f70b48f8d
mov qword [rsp + 0x1c], rdx
movabs rdx, 0x708c866e75207292
mov qword [rsp + 0x24], rdx
movabs rdx, 0x3f818a657472af7e
mov qword [rsp + 0x2c], rdx
movabs rdx, 0x6570ad740b8cb96e
mov qword [rsp + 0x34], rdx
movabs rdx, 0xe031a070402
mov qword [rsp + 0x3c], rdx
movabs rdx, 0x1e051c0e00000e03
mov qword [rsp + 0x40], rdx
movabs rdx, 0x11160e1906051712
mov qword [rsp + 0x48], rdx
movabs rdx, 0x1c181c190f090001
mov qword [rsp + 0x50], rdx
movabs rdx, 0x181b041704060e07
mov qword [rsp + 0x58], rdx
xor eax, eax
jmp 0x514daf
movzx r9d, byte [rsp + rsi + 0x1b]
sub r9d, edx
lea edx, [r9 - 1]
mov byte [rsp + rdi + 0x1b], dl
lea edx, [r8 - 1]
mov byte [rsp + rsi + 0x1b], dl
add rax, 2
cmp rax, 0x24
jge 0x514de8
movzx edx, byte [rsp + rax + 0x3c]
lea rsi, [rax + 1]
nop
cmp rsi, 0x24
jae 0x514e1b
movzx esi, byte [rsp + rax + 0x3d]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x21
jae 0x514e0f
movzx r8d, byte [rsp + rdi + 0x1b]
sub r8d, edx
cmp rsi, 0x21
jb 0x514d92
jmp 0x514e03
xor eax, eax
lea rbx, [rsp + 0x1b]
mov ecx, 0x21
call fcn.00446000
mov rbp, qword [rsp + 0x60]
add rsp, 0x68
ret
mov eax, esi
mov ecx, 0x21
call fcn.00457f40
mov eax, edi
mov ecx, 0x21
call fcn.00457f40
mov rax, rsi
mov ecx, 0x24
call fcn.00457f40
nop
call fcn.00455860
jmp fcn.00514ce0

Function at 0x51ab40
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x51ac20
sub rsp, 0x38
mov qword [rsp + 0x30], rbp
lea rbp, [rsp + 0x30]
movabs rdx, 0x7f7373716c41684d
mov qword [rsp + 0x1a], rdx
mov word [rsp + 0x22], 0x6e89
movabs rdx, 0x803080804020002
mov qword [rsp + 0x24], rdx
mov dword [rsp + 0x2c], 0x7010607
xor eax, eax
jmp 0x51aba3
movzx r9d, byte [rsp + rsi + 0x1a]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x14]
mov byte [rsp + rdi + 0x1a], dl
mov byte [rsp + rsi + 0x1a], r8b
add rax, 2
cmp rax, 0xc
jge 0x51abdf
movzx edx, byte [rsp + rax + 0x24]
lea rsi, [rax + 1]
cmp rsi, 0xc
jae 0x51ac12
movzx esi, byte [rsp + rax + 0x25]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0xa
jae 0x51ac06
movzx r8d, byte [rsp + rdi + 0x1a]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x14]
cmp rsi, 0xa
jb 0x51ab89
jmp 0x51abfa
xor eax, eax
lea rbx, [rsp + 0x1a]
mov ecx, 0xa
call fcn.00446000
mov rbp, qword [rsp + 0x30]
add rsp, 0x38
ret
mov eax, esi
mov ecx, 0xa
call fcn.00457f40
mov eax, edi
mov ecx, 0xa
call fcn.00457f40
mov rax, rsi
mov ecx, 0xc
call fcn.00457f40
nop
call fcn.00455860
jmp fcn.0051ab40
Function at 0x51d180
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x51d26d
sub rsp, 0x40
mov qword [rsp + 0x38], rbp
lea rbp, [rsp + 0x38]
movabs rdx, 0x7372d046fb6e9023
mov qword [rsp + 0x1d], rdx
movabs rdx, 0xfa858c467f7372d0
mov qword [rsp + 0x22], rdx
movabs rdx, 0xa010c0300050b08
mov qword [rsp + 0x2a], rdx
movabs rdx, 0xb0a080105010a01
mov qword [rsp + 0x30], rdx
xor eax, eax
jmp 0x51d1f5
movzx r9d, byte [rsp + rsi + 0x1d]
sub r9d, edx
lea edx, [r9 + 0x7d]
mov byte [rsp + rdi + 0x1d], dl
lea edx, [r8 + 0x7d]
mov byte [rsp + rsi + 0x1d], dl
add rax, 2
cmp rax, 0xe
jge 0x51d22c
movzx edx, byte [rsp + rax + 0x2a]
lea rsi, [rax + 1]
cmp rsi, 0xe
jae 0x51d25f
movzx esi, byte [rsp + rax + 0x2b]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0xd
jae 0x51d253
movzx r8d, byte [rsp + rdi + 0x1d]
sub r8d, edx
cmp rsi, 0xd
jb 0x51d1d8
jmp 0x51d247
xor eax, eax
lea rbx, [rsp + 0x1d]
mov ecx, 0xd
call fcn.00446000
mov rbp, qword [rsp + 0x38]
add rsp, 0x40
ret
mov eax, esi
mov ecx, 0xd
call fcn.00457f40
mov eax, edi
mov ecx, 0xd
call fcn.00457f40
mov rax, rsi
mov ecx, 0xe
call fcn.00457f40
nop
call fcn.00455860
jmp fcn.0051d180

Function at 0x51e480
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x51e5b8
sub rsp, 0x68
mov qword [rsp + 0x60], rbp
lea rbp, [rsp + 0x60]
movabs rdx, 0x513e4d4f71743844
mov qword [rsp + 0x1d], rdx
movabs rdx, 0x453d5161744c1236
mov qword [rsp + 0x25], rdx
movabs rdx, 0x4620585b614b2045
mov qword [rsp + 0x2c], rdx
movabs rdx, 0x726f6e5472f27964
mov qword [rsp + 0x34], rdx
movabs rdx, 0x1905090f0e040801
mov qword [rsp + 0x3c], rdx
movabs rdx, 0xf07130d1905090f
mov qword [rsp + 0x40], rdx
movabs rdx, 0xa19001316070614
mov qword [rsp + 0x48], rdx
movabs rdx, 0x141911030507111b
mov qword [rsp + 0x50], rdx
movabs rdx, 0xe1c171318050e11
mov qword [rsp + 0x58], rdx
xor eax, eax
jmp 0x51e540
movzx r9d, byte [rsp + rsi + 0x1d]
sub r9d, edx
lea edx, [r9 + 0x34]
mov byte [rsp + rdi + 0x1d], dl
lea edx, [r8 + 0x34]
mov byte [rsp + rsi + 0x1d], dl
add rax, 2
cmp rax, 0x24
jge 0x51e577
movzx edx, byte [rsp + rax + 0x3c]
lea rsi, [rax + 1]
cmp rsi, 0x24
jae 0x51e5aa
movzx esi, byte [rsp + rax + 0x3d]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x1f
jae 0x51e59e
movzx r8d, byte [rsp + rdi + 0x1d]
sub r8d, edx
cmp rsi, 0x1f
jb 0x51e523
jmp 0x51e592
xor eax, eax
lea rbx, [rsp + 0x1d]
mov ecx, 0x1f
call fcn.00446000
mov rbp, qword [rsp + 0x60]
add rsp, 0x68
ret
mov eax, esi
mov ecx, 0x1f
call fcn.00457f40
mov eax, edi
mov ecx, 0x1f
call fcn.00457f40
mov rax, rsi
mov ecx, 0x24
call fcn.00457f40
nop
call fcn.00455860
nop dword [rax]
jmp fcn.0051e480
Function at 0x51eba0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x51ec7f
sub rsp, 0x38
mov qword [rsp + 0x30], rbp
lea rbp, [rsp + 0x30]
movabs rdx, 0x99a8f692056cc7fd
mov qword [rsp + 0x1c], rdx
movabs rdx, 0x407030300040101
mov qword [rsp + 0x24], rdx
mov dword [rsp + 0x2c], 0x6030605
xor eax, eax
jmp 0x51ec00
movzx r9d, byte [rsp + rsi + 0x1c]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x52]
mov byte [rsp + rdi + 0x1c], dl
mov byte [rsp + rsi + 0x1c], r8b
add rax, 2
nop dword [rax]
cmp rax, 0xc
jge 0x51ec3c
movzx edx, byte [rsp + rax + 0x24]
lea rsi, [rax + 1]
cmp rsi, 0xc
jae 0x51ec71
movzx esi, byte [rsp + rax + 0x25]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 8
jae 0x51ec65
movzx r8d, byte [rsp + rdi + 0x1c]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x52]
cmp rsi, 8
jb 0x51ebe2
jmp 0x51ec57
xor eax, eax
lea rbx, [rsp + 0x1c]
mov ecx, 8
call fcn.00446000
mov rbp, qword [rsp + 0x30]
add rsp, 0x38
ret
mov eax, esi
mov ecx, 8
nop
call fcn.00457f40
mov eax, edi
mov ecx, 8
call fcn.00457f40
mov rax, rsi
mov ecx, 0xc
call fcn.00457f40
nop
nop
call fcn.00455860
jmp fcn.0051eba0
Function at 0x523c80
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x523d8b
sub rsp, 0x50
mov qword [rsp + 0x48], rbp
lea rbp, [rsp + 0x48]
movabs rdx, 0xde8a35c397ddeed3
mov qword [rsp + 0x1f], rdx
movabs rdx, 0xe7de8a35c397ddee
mov qword [rsp + 0x20], rdx
movabs rdx, 0xc1f4c615df626c39
mov qword [rsp + 0x28], rdx
movabs rdx, 0x40c100f0a030c06
mov qword [rsp + 0x30], rdx
movabs rdx, 0x80102000a070703
mov qword [rsp + 0x38], rdx
movabs rdx, 0x2100f020d0c0e10
mov qword [rsp + 0x40], rdx
xor eax, eax
jmp 0x523d13
movzx r9d, byte [rsp + rsi + 0x1f]
sub r9d, edx
lea edx, [r9 + 0x61]
mov byte [rsp + rdi + 0x1f], dl
lea edx, [r8 + 0x61]
mov byte [rsp + rsi + 0x1f], dl
add rax, 2
cmp rax, 0x18
jge 0x523d4a
movzx edx, byte [rsp + rax + 0x30]
lea rsi, [rax + 1]
cmp rsi, 0x18
jae 0x523d7d
movzx esi, byte [rsp + rax + 0x31]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x11
jae 0x523d71
movzx r8d, byte [rsp + rdi + 0x1f]
sub r8d, edx
cmp rsi, 0x11
jb 0x523cf6
jmp 0x523d65
xor eax, eax
lea rbx, [rsp + 0x1f]
mov ecx, 0x11
call fcn.00446000
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
mov eax, esi
mov ecx, 0x11
call fcn.00457f40
mov eax, edi
mov ecx, 0x11
call fcn.00457f40
mov rax, rsi
mov ecx, 0x18
call fcn.00457f40
nop
call fcn.00455860
jmp fcn.00523c80

Function at 0x5247c0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x5248cb
sub rsp, 0x48
mov qword [rsp + 0x40], rbp
lea rbp, [rsp + 0x40]
movabs rdx, 0xe6ef1d3433328d16
mov qword [rsp + 0x19], rdx
movabs rdx, 0x38e6ef1d3433328d
mov qword [rsp + 0x1a], rdx
movabs rdx, 0x3434054a63f2a452
mov qword [rsp + 0x22], rdx
movabs rdx, 0x10606090f0f0f0f
mov qword [rsp + 0x2a], rdx
movabs rdx, 0x7010f05000a0106
mov qword [rsp + 0x30], rdx
movabs rdx, 0xb0d1000060e10
mov qword [rsp + 0x38], rdx
xor eax, eax
jmp 0x524853
movzx r9d, byte [rsp + rsi + 0x19]
sub r9d, edx
lea edx, [r9 + 0x5d]
mov byte [rsp + rdi + 0x19], dl
lea edx, [r8 + 0x5d]
mov byte [rsp + rsi + 0x19], dl
add rax, 2
cmp rax, 0x16
jge 0x52488a
movzx edx, byte [rsp + rax + 0x2a]
lea rsi, [rax + 1]
cmp rsi, 0x16
jae 0x5248bd
movzx esi, byte [rsp + rax + 0x2b]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x11
jae 0x5248b1
movzx r8d, byte [rsp + rdi + 0x19]
sub r8d, edx
cmp rsi, 0x11
jb 0x524836
jmp 0x5248a5
xor eax, eax
lea rbx, [rsp + 0x19]
mov ecx, 0x11
call fcn.00446000
mov rbp, qword [rsp + 0x40]
add rsp, 0x48
ret
mov eax, esi
mov ecx, 0x11
call fcn.00457f40
mov eax, edi
mov ecx, 0x11
call fcn.00457f40
mov rax, rsi
mov ecx, 0x16
call fcn.00457f40
nop
call fcn.00455860
jmp fcn.005247c0
Function at 0x52a420
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x52a4ff
sub rsp, 0x38
mov qword [rsp + 0x30], rbp
lea rbp, [rsp + 0x30]
movabs rdx, 0x49f0d7c165c9e125
mov qword [rsp + 0x24], rdx
mov dword [rsp + 0x2c], 0xdf48f144
movabs rdx, 0x6060b02030b0505
mov qword [rsp + 0x18], rdx
mov dword [rsp + 0x20], 0x9090104
xor eax, eax
jmp 0x52a487
movzx r9d, byte [rsp + rsi + 0x24]
sub r9d, edx
lea edx, [r9 + 0x6d]
mov byte [rsp + rdi + 0x24], dl
lea edx, [r8 + 0x6d]
mov byte [rsp + rsi + 0x24], dl
add rax, 2
cmp rax, 0xc
jge 0x52a4be
movzx edx, byte [rsp + rax + 0x18]
lea rsi, [rax + 1]
cmp rsi, 0xc
jae 0x52a4f1
movzx esi, byte [rsp + rax + 0x19]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0xc
jae 0x52a4e5
movzx r8d, byte [rsp + rdi + 0x24]
sub r8d, edx
cmp rsi, 0xc
jb 0x52a46a
jmp 0x52a4d9
xor eax, eax
lea rbx, [rsp + 0x24]
mov ecx, 0xc
call fcn.00446000
mov rbp, qword [rsp + 0x30]
add rsp, 0x38
ret
mov eax, esi
mov ecx, 0xc
call fcn.00457f40
mov eax, edi
mov ecx, 0xc
call fcn.00457f40
mov rax, rsi
mov ecx, 0xc
call fcn.00457f40
nop
nop
call fcn.00455860
jmp fcn.0052a420

Function at 0x52d0c0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x52d1d3
sub rsp, 0x50
mov qword [rsp + 0x48], rbp
lea rbp, [rsp + 0x48]
movabs rdx, 0x96e7dfbb93f07762
mov qword [rsp + 0x19], rdx
movabs rdx, 0xee9c3aa957816796
mov qword [rsp + 0x20], rdx
movabs rdx, 0xa6ae72618c206fab
mov qword [rsp + 0x28], rdx
movabs rdx, 0x8050e0602021504
mov qword [rsp + 0x30], rdx
movabs rdx, 0xd0a08081607020f
mov qword [rsp + 0x38], rdx
movabs rdx, 0x91512030e0b0106
mov qword [rsp + 0x40], rdx
xor eax, eax
jmp 0x52d150
movzx r9d, byte [rsp + rsi + 0x19]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x4c]
mov byte [rsp + rdi + 0x19], dl
mov byte [rsp + rsi + 0x19], r8b
add rax, 2
cmp rax, 0x18
jge 0x52d18d
movzx edx, byte [rsp + rax + 0x30]
lea rsi, [rax + 1]
nop
cmp rsi, 0x18
jae 0x52d1c5
movzx esi, byte [rsp + rax + 0x31]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x17
jae 0x52d1b4
movzx r8d, byte [rsp + rdi + 0x19]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x4c]
cmp rsi, 0x17
jb 0x52d136
jmp 0x52d1a8
xor eax, eax
lea rbx, [rsp + 0x19]
mov ecx, 0x17
call fcn.00446000
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
mov eax, esi
mov ecx, 0x17
call fcn.00457f40
mov eax, edi
mov ecx, 0x17
nop dword [rax + rax]
call fcn.00457f40
mov rax, rsi
mov ecx, 0x18
call fcn.00457f40
nop
call fcn.00455860
jmp fcn.0052d0c0
Function at 0x52fc60
Capabilities:
Resolve function by parsing pe exports

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x52fe46
add rsp, 0xffffffffffffff80
mov qword [rsp + 0x78], rbp
lea rbp, [rsp + 0x78]
mov qword [rsp + 0x88], rax
cmp rbx, 0x40
jne 0x52fe2b
xor ecx, ecx
jmp 0x52fc91
inc rcx
cmp rcx, 0x40
jge 0x52fd65
movzx edx, byte [rax + rcx]
nop
cmp dl, 0xa
je 0x52fcaa
cmp dl, 0xd
jne 0x52fc8e
movabs rdx, 0x3004f6885a43095b
mov qword [rsp + 0x44], rdx
movabs rdx, 0x994a36702c1586c2
mov qword [rsp + 0x4c], rdx
movabs rdx, 0x2c4b02f1994a3670
mov qword [rsp + 0x50], rdx
movabs rdx, 0xff6f89c91de53518
mov qword [rsp + 0x58], rdx
movabs rdx, 0xe29f90745706bd37
mov qword [rsp + 0x60], rdx
movabs rdx, 0xb39e12b5d9735003
mov qword [rsp + 0x68], rdx
movabs rdx, 0x576a9fec3520673e
mov qword [rsp + 0x18], rdx
movabs rdx, 0xfc2857185c79e7e2
mov qword [rsp + 0x20], rdx
movabs rdx, 0x43282285fc285718
mov qword [rsp + 0x24], rdx
movabs rdx, 0x914ffaa774844176
mov qword [rsp + 0x2c], rdx
movabs rdx, 0x81bff51a3e6aca52
mov qword [rsp + 0x34], rdx
movabs rdx, 0xc1fb66d6b801316b
mov qword [rsp + 0x3c], rdx
xor eax, eax
jmp 0x52fe00
mov qword [rsp + 0x88], rax
lea rax, [0x0066c200]
call fcn.0040b9a0
mov dword [rax + 0x140], 0x3d
mov rbx, qword [rsp + 0x88]
cmp rax, rbx
je 0x52fdac
mov qword [rsp + 0x70], rax
mov ecx, 0x40
call fcn.004588e0
mov rax, qword [rsp + 0x70]
mov rbx, qword [rsp + 0x88]
xor ecx, ecx
jmp 0x52fdc0
mov byte [rax + rcx + 0x40], 0xff
inc rcx
nop dword [rax + rax]
cmp rcx, 0x100
jl 0x52fdb0
xor ecx, ecx
jmp 0x52fdd8
movzx edx, byte [rbx + rcx]
mov byte [rax + rdx + 0x40], cl
inc rcx
cmp rcx, 0x40
jl 0x52fdcd
mov rbp, qword [rsp + 0x78]
sub rsp, 0xffffffffffffff80
ret
movzx edx, byte [rsp + rax + 0x44]
movzx esi, byte [rsp + rax + 0x18]
xor esi, edx
mov byte [rsp + rax + 0x18], sil
inc rax
nop dword [rax]
cmp rax, 0x2c
jl 0x52fde8
xor eax, eax
lea rbx, [rsp + 0x18]
mov ecx, 0x2c
call fcn.00446000
call fcn.00409540
mov rbx, rax
lea rax, [0x0064df00]
call fcn.00431740
call fcn.0052f520
call fcn.00409540
mov rbx, rax
lea rax, [0x0064df00]
nop
call fcn.00431740
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.00455860
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
nop
jmp fcn.0052fc60