joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4f5c40
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4f5d12
push rbp
mov rbp, rsp
sub rsp, 0x38
movabs rdx, 0xda61080e6e617222
mov qword [rsp + 0x2a], rdx
movabs rdx, 0x1d16d36f0516da61
mov qword [rsp + 0x30], rdx
movabs rdx, 0x40a070b0a0a070b
mov qword [rsp + 0x1a], rdx
movabs rdx, 0x40c080909050d
mov qword [rsp + 0x22], rdx
xor eax, eax
jmp 0x4f5cac
movzx r9d, byte [rsp + rsi + 0x2a]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x3f]
mov byte [rsp + rdi + 0x2a], dl
mov byte [rsp + rsi + 0x2a], r8b
add rax, 2
cmp rax, 0x10
jge 0x4f5cde
movzx edx, byte [rsp + rax + 0x1a]
movzx esi, byte [rsp + rax + 0x1b]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0xe
jae 0x4f5d05
movzx r8d, byte [rsp + rdi + 0x2a]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x3f]
cmp rsi, 0xe
jb 0x4f5c92
jmp 0x4f5cf5
xor eax, eax
lea rbx, [rsp + 0x2a]
mov ecx, 0xe
call fcn.0045af60
add rsp, 0x38
pop rbp
ret
mov eax, esi
mov ecx, 0xe
nop dword [rax]
call fcn.004605c0
mov eax, edi
mov ecx, 0xe
call fcn.004605c0
nop
call fcn.0045e2e0
jmp fcn.004f5c40

Function at 0x4f5d20
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4f5e1d
push rbp
mov rbp, rsp
sub rsp, 0x48
movabs rdx, 0x948d6e61e58abd43
mov qword [rsp + 0x36], rdx
movabs rdx, 0xa505948d6e61e58a
mov qword [rsp + 0x38], rdx
movabs rdx, 0x579b67728a85a1c5
mov qword [rsp + 0x40], rdx
movabs rdx, 0x90c0b0b09030803
mov qword [rsp + 0x1c], rdx
movabs rdx, 0xd0c0b0106081001
mov qword [rsp + 0x24], rdx
movabs rdx, 0x3020d0c0b010608
mov qword [rsp + 0x26], rdx
movabs rdx, 0x2070a07020d0610
mov qword [rsp + 0x2e], rdx
xor eax, eax
jmp 0x4f5dc0
movzx r9d, byte [rsp + rsi + 0x36]
sub r9d, edx
lea edx, [r9 - 0xc]
mov byte [rsp + rdi + 0x36], dl
lea edx, [r8 - 0xc]
mov byte [rsp + rsi + 0x36], dl
add rax, 2
nop dword [rax]
cmp rax, 0x1a
jge 0x4f5ded
movzx edx, byte [rsp + rax + 0x1c]
movzx esi, byte [rsp + rax + 0x1d]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x12
jae 0x4f5e10
movzx r8d, byte [rsp + rdi + 0x36]
sub r8d, edx
cmp rsi, 0x12
jb 0x4f5d9f
jmp 0x4f5e04
xor eax, eax
lea rbx, [rsp + 0x36]
mov ecx, 0x12
call fcn.0045af60
add rsp, 0x48
pop rbp
ret
mov eax, esi
mov ecx, 0x12
call fcn.004605c0
mov eax, edi
mov ecx, 0x12
call fcn.004605c0
nop
nop dword [rax]
call fcn.0045e2e0
jmp fcn.004f5d20
Function at 0x4f67a0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4f6886
push rbp
mov rbp, rsp
sub rsp, 0x38
movabs rdx, 0xa5646459b4cbfd23
mov qword [rsp + 0x2b], rdx
movabs rdx, 0x16f66deeda56464
mov qword [rsp + 0x30], rdx
movabs rdx, 0x402020708020704
mov qword [rsp + 0x19], rdx
movabs rdx, 0x203040202070802
mov qword [rsp + 0x1b], rdx
movabs rdx, 0x1000402080c0009
mov qword [rsp + 0x23], rdx
xor eax, eax
nop
jmp 0x4f6820
movzx r9d, byte [rsp + rsi + 0x2b]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x38]
mov byte [rsp + rdi + 0x2b], dl
mov byte [rsp + rsi + 0x2b], r8b
add rax, 2
nop dword [rax]
cmp rax, 0x12
jge 0x4f6852
movzx edx, byte [rsp + rax + 0x19]
movzx esi, byte [rsp + rax + 0x1a]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0xd
jae 0x4f6877
movzx r8d, byte [rsp + rdi + 0x2b]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x38]
cmp rsi, 0xd
jb 0x4f6802
jmp 0x4f686b
xor eax, eax
lea rbx, [rsp + 0x2b]
mov ecx, 0xd
nop
call fcn.0045af60
add rsp, 0x38
pop rbp
ret
mov eax, esi
mov ecx, 0xd
call fcn.004605c0
mov eax, edi
mov ecx, 0xd
nop
call fcn.004605c0
nop
call fcn.0045e2e0
jmp fcn.004f67a0

Function at 0x4f9400
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4f94c7
push rbp
mov rbp, rsp
sub rsp, 0x30
movabs rdx, 0x9c6b91cae59e0ac7
mov qword [rsp + 0x26], rdx
mov word [rsp + 0x2e], 0xab70
movabs rdx, 0x501040103040700
mov qword [rsp + 0x18], rdx
movabs rdx, 0x907070403020501
mov qword [rsp + 0x1e], rdx
xor eax, eax
jmp 0x4f9467
movzx r9d, byte [rsp + rsi + 0x26]
sub r9d, edx
lea edx, [r9 - 0x22]
mov byte [rsp + rdi + 0x26], dl
lea edx, [r8 - 0x22]
mov byte [rsp + rsi + 0x26], dl
add rax, 2
cmp rax, 0xe
jge 0x4f9497
movzx edx, byte [rsp + rax + 0x18]
movzx esi, byte [rsp + rax + 0x19]
mov edi, edx
xor edx, esi
add edx, eax
nop dword [rax]
cmp rdi, 0xa
jae 0x4f94ba
movzx r8d, byte [rsp + rdi + 0x26]
sub r8d, edx
cmp rsi, 0xa
jb 0x4f944a
jmp 0x4f94ae
xor eax, eax
lea rbx, [rsp + 0x26]
mov ecx, 0xa
call fcn.0045af60
add rsp, 0x30
pop rbp
ret
mov eax, esi
mov ecx, 0xa
call fcn.004605c0
mov eax, edi
mov ecx, 0xa
call fcn.004605c0
nop
call fcn.0045e2e0
jmp fcn.004f9400
Function at 0x4fa3c0
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4fa48a
push rbp
mov rbp, rsp
sub rsp, 0x48
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rbx
mov qword [rsp], rax
mov qword [rsp + 8], rbx
mov byte [rsp + 0x10], 0
call fcn.00403180
xorps xmm15, xmm15
mov r14, qword [0x00689858]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x18], 0xffffffffffffffff
jne 0x4fa46f
mov rcx, qword [rsp + 0x60]
lea rdx, [rcx + 1]
mov qword [rsp + 0x40], rdx
lea rax, [0x00557b80]
xor ebx, ebx
mov rcx, rdx
call fcn.0045a6c0
mov rbx, qword [rsp + 0x60]
mov rcx, rax
xor edi, edi
mov rsi, qword [rsp + 0x40]
mov rax, qword [rsp + 0x58]
nop dword [rax]
call fcn.004fae00
inc rbx
cmp rcx, rbx
jae 0x4fa45e
mov edi, 1
lea rsi, [0x00557b80]
call fcn.0045a7a0
mov word [rax + rbx*2 - 2], 0
xor edi, edi
xor esi, esi
add rsp, 0x48
pop rbp
ret
xor eax, eax
xor ebx, ebx
mov rcx, rbx
lea rdi, [0x005a4af8]
lea rsi, [0x005a46b8]
add rsp, 0x48
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.0045e2e0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.004fa3c0

Function at 0x4feb80
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4fec4c
push rbp
mov rbp, rsp
sub rsp, 0x38
movabs rdx, 0xd46d75e3d95b65ee
mov qword [rsp + 0x2b], rdx
movabs rdx, 0xf6e2dd3bf1d46d75
mov qword [rsp + 0x30], rdx
movabs rdx, 0x30b04020b090307
mov qword [rsp + 0x1b], rdx
movabs rdx, 0xc040b00070b0a08
mov qword [rsp + 0x23], rdx
xor eax, eax
jmp 0x4febef
movzx r9d, byte [rsp + rsi + 0x2b]
sub r9d, edx
lea edx, [r9 - 0x72]
mov byte [rsp + rdi + 0x2b], dl
lea edx, [r8 - 0x72]
mov byte [rsp + rsi + 0x2b], dl
add rax, 2
cmp rax, 0x10
jge 0x4fec1c
movzx edx, byte [rsp + rax + 0x1b]
movzx esi, byte [rsp + rax + 0x1c]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0xd
jae 0x4fec3f
movzx r8d, byte [rsp + rdi + 0x2b]
sub r8d, edx
cmp rsi, 0xd
jb 0x4febd2
jmp 0x4fec33
xor eax, eax
lea rbx, [rsp + 0x2b]
mov ecx, 0xd
call fcn.0045af60
add rsp, 0x38
pop rbp
ret
mov eax, esi
mov ecx, 0xd
call fcn.004605c0
mov eax, edi
mov ecx, 0xd
call fcn.004605c0
nop
call fcn.0045e2e0
jmp fcn.004feb80

Function at 0x4ffc80
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4ffd38
push rbp
mov rbp, rsp
sub rsp, 0x30
movabs rdx, 0xf7603b7572264f48
mov qword [rsp + 0x28], rdx
movabs rdx, 0x706020005050507
mov qword [rsp + 0x1c], rdx
mov dword [rsp + 0x24], 0x5010005
xor eax, eax
jmp 0x4ffcd9
movzx r9d, byte [rsp + rsi + 0x28]
sub r9d, edx
lea edx, [r9 + 0x20]
mov byte [rsp + rdi + 0x28], dl
lea edx, [r8 + 0x20]
mov byte [rsp + rsi + 0x28], dl
add rax, 2
cmp rax, 0xc
jge 0x4ffd08
movzx edx, byte [rsp + rax + 0x1c]
movzx esi, byte [rsp + rax + 0x1d]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 8
jae 0x4ffd2b
movzx r8d, byte [rsp + rdi + 0x28]
sub r8d, edx
nop
cmp rsi, 8
jb 0x4ffcbc
jmp 0x4ffd1f
xor eax, eax
lea rbx, [rsp + 0x28]
mov ecx, 8
call fcn.0045af60
add rsp, 0x30
pop rbp
ret
mov eax, esi
mov ecx, 8
call fcn.004605c0
mov eax, edi
mov ecx, 8
call fcn.004605c0
nop
call fcn.0045e2e0
nop dword [rax]
jmp fcn.004ffc80
Function at 0x5020e0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x5021ec
push rbp
mov rbp, rsp
sub rsp, 0x50
movabs rdx, 0x2167867254898970
mov qword [rsp + 0x37], rdx
movabs rdx, 0x4c612f53566e6164
mov qword [rsp + 0x3f], rdx
movabs rdx, 0x724c612f53566e61
mov qword [rsp + 0x40], rdx
movabs rdx, 0x6565696e2059726b
mov qword [rsp + 0x48], rdx
movabs rdx, 0x4010d0513000206
mov qword [rsp + 0x1b], rdx
movabs rdx, 0xb07110b04040115
mov qword [rsp + 0x23], rdx
movabs rdx, 0x10130f0d0b07110b
mov qword [rsp + 0x27], rdx
movabs rdx, 0x20613171703150d
mov qword [rsp + 0x2f], rdx
xor eax, eax
jmp 0x502188
movzx r9d, byte [rsp + rsi + 0x37]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x1b]
mov byte [rsp + rdi + 0x37], dl
mov byte [rsp + rsi + 0x37], r8b
add rax, 2
cmp rax, 0x1c
jge 0x5021bc
movzx edx, byte [rsp + rax + 0x1b]
movzx esi, byte [rsp + rax + 0x1c]
mov edi, edx
xor edx, esi
add edx, eax
nop
cmp rdi, 0x19
jae 0x5021df
movzx r8d, byte [rsp + rdi + 0x37]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x1b]
cmp rsi, 0x19
jb 0x50216e
jmp 0x5021d3
xor eax, eax
lea rbx, [rsp + 0x37]
mov ecx, 0x19
call fcn.0045af60
add rsp, 0x50
pop rbp
ret
mov eax, esi
mov ecx, 0x19
call fcn.004605c0
mov eax, edi
mov ecx, 0x19
call fcn.004605c0
nop
call fcn.0045e2e0
jmp fcn.005020e0

Function at 0x502cc0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x502dbd
push rbp
mov rbp, rsp
sub rsp, 0x50
movabs rdx, 0x633d32403f58bec3
mov qword [rsp + 0x39], rdx
movabs rdx, 0x1e193d0315e9fe63
mov qword [rsp + 0x40], rdx
movabs rdx, 0x496d695b2029724f
mov qword [rsp + 0x48], rdx
movabs rdx, 0xe160b0101000e0a
mov qword [rsp + 0x1d], rdx
movabs rdx, 0x6040011000b0d13
mov qword [rsp + 0x25], rdx
movabs rdx, 0xf0c0b0f06040011
mov qword [rsp + 0x29], rdx
movabs rdx, 0x802050209080313
mov qword [rsp + 0x31], rdx
xor eax, eax
jmp 0x502d60
movzx r9d, byte [rsp + rsi + 0x39]
sub r9d, edx
lea edx, [r9 + 0x39]
mov byte [rsp + rdi + 0x39], dl
lea edx, [r8 + 0x39]
mov byte [rsp + rsi + 0x39], dl
add rax, 2
nop dword [rax]
cmp rax, 0x1c
jge 0x502d8d
movzx edx, byte [rsp + rax + 0x1d]
movzx esi, byte [rsp + rax + 0x1e]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x17
jae 0x502db0
movzx r8d, byte [rsp + rdi + 0x39]
sub r8d, edx
cmp rsi, 0x17
jb 0x502d3f
jmp 0x502da4
xor eax, eax
lea rbx, [rsp + 0x39]
mov ecx, 0x17
call fcn.0045af60
add rsp, 0x50
pop rbp
ret
mov eax, esi
mov ecx, 0x17
call fcn.004605c0
mov eax, edi
mov ecx, 0x17
call fcn.004605c0
nop
nop dword [rax]
call fcn.0045e2e0
jmp fcn.00502cc0
Function at 0x505e20
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x505f2c
push rbp
mov rbp, rsp
sub rsp, 0x58
movabs rdx, 0xa2ad28f597968aa4
mov qword [rsp + 0x41], rdx
movabs rdx, 0x876ea26b502056a2
mov qword [rsp + 0x48], rdx
movabs rdx, 0x7a6d6963a89db4b3
mov qword [rsp + 0x50], rdx
movabs rdx, 0x602000e070c0704
mov qword [rsp + 0x1f], rdx
movabs rdx, 0x2110602000e070c
mov qword [rsp + 0x21], rdx
movabs rdx, 0x103100112020f02
mov qword [rsp + 0x29], rdx
movabs rdx, 0x51212020b16030c
mov qword [rsp + 0x31], rdx
movabs rdx, 0x307000a0e0e1308
mov qword [rsp + 0x39], rdx
xor eax, eax
jmp 0x505ec8
movzx r9d, byte [rsp + rsi + 0x41]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x37]
mov byte [rsp + rdi + 0x41], dl
mov byte [rsp + rsi + 0x41], r8b
add rax, 2
cmp rax, 0x22
jge 0x505efc
movzx edx, byte [rsp + rax + 0x1f]
movzx esi, byte [rsp + rax + 0x20]
mov edi, edx
xor edx, esi
add edx, eax
nop
cmp rdi, 0x17
jae 0x505f1f
movzx r8d, byte [rsp + rdi + 0x41]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x37]
cmp rsi, 0x17
jb 0x505eae
jmp 0x505f13
xor eax, eax
lea rbx, [rsp + 0x41]
mov ecx, 0x17
call fcn.0045af60
add rsp, 0x58
pop rbp
ret
mov eax, esi
mov ecx, 0x17
call fcn.004605c0
mov eax, edi
mov ecx, 0x17
call fcn.004605c0
nop
call fcn.0045e2e0
jmp fcn.00505e20

Function at 0x505f40
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x50605a
push rbp
mov rbp, rsp
sub rsp, 0x58
movabs rdx, 0xc4a8079ea06e61c6
mov qword [rsp + 0x3a], rdx
movabs rdx, 0xc67fec64dc618ca9
mov qword [rsp + 0x42], rdx
movabs rdx, 0x20656dbf5420c67f
mov qword [rsp + 0x48], rdx
movabs rdx, 0xa56f636982c19241
mov qword [rsp + 0x50], rdx
movabs rdx, 0x40d000e0f0b001d
mov qword [rsp + 0x18], rdx
movabs rdx, 0x805040d000e0f0b
mov qword [rsp + 0x1a], rdx
movabs rdx, 0x171809121d120304
mov qword [rsp + 0x22], rdx
movabs rdx, 0x190f170208070606
mov qword [rsp + 0x2a], rdx
movabs rdx, 0x160e091d080b0716
mov qword [rsp + 0x32], rdx
xor eax, eax
jmp 0x505ff7
movzx r9d, byte [rsp + rsi + 0x3a]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x4c]
mov byte [rsp + rdi + 0x3a], dl
mov byte [rsp + rsi + 0x3a], r8b
add rax, 2
cmp rax, 0x22
jge 0x506029
movzx edx, byte [rsp + rax + 0x18]
movzx esi, byte [rsp + rax + 0x19]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x1e
jae 0x50604d
movzx r8d, byte [rsp + rdi + 0x3a]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x4c]
cmp rsi, 0x1e
jb 0x505fdd
jmp 0x506041
xor eax, eax
lea rbx, [rsp + 0x3a]
mov ecx, 0x1e
call fcn.0045af60
add rsp, 0x58
pop rbp
nop
ret
mov eax, esi
mov ecx, 0x1e
call fcn.004605c0
mov eax, edi
mov ecx, 0x1e
call fcn.004605c0
nop
call fcn.0045e2e0
nop
jmp fcn.00505f40
Function at 0x507540
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x507648
push rbp
mov rbp, rsp
sub rsp, 0x58
movabs rdx, 0x6e61946dfd8e7239
mov qword [rsp + 0x41], rdx
movabs rdx, 0x1792e7178198f26e
mov qword [rsp + 0x48], rdx
movabs rdx, 0xfa60fd0a206472cf
mov qword [rsp + 0x50], rdx
movabs rdx, 0xa0f09040c030b04
mov qword [rsp + 0x1f], rdx
movabs rdx, 0xb0b0a0f09040c03
mov qword [rsp + 0x21], rdx
movabs rdx, 0xf14160c160d0516
mov qword [rsp + 0x29], rdx
movabs rdx, 0x808040800160208
mov qword [rsp + 0x31], rdx
movabs rdx, 0x16090e1515160813
mov qword [rsp + 0x39], rdx
xor eax, eax
jmp 0x5075eb
movzx r9d, byte [rsp + rsi + 0x41]
sub r9d, edx
lea edx, [r9 - 0x71]
mov byte [rsp + rdi + 0x41], dl
lea edx, [r8 - 0x71]
mov byte [rsp + rsi + 0x41], dl
add rax, 2
cmp rax, 0x22
jge 0x507618
movzx edx, byte [rsp + rax + 0x1f]
movzx esi, byte [rsp + rax + 0x20]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x17
jae 0x50763b
movzx r8d, byte [rsp + rdi + 0x41]
sub r8d, edx
cmp rsi, 0x17
jb 0x5075ce
jmp 0x50762f
xor eax, eax
lea rbx, [rsp + 0x41]
mov ecx, 0x17
call fcn.0045af60
add rsp, 0x58
pop rbp
ret
mov eax, esi
mov ecx, 0x17
call fcn.004605c0
mov eax, edi
mov ecx, 0x17
call fcn.004605c0
nop
call fcn.0045e2e0
jmp fcn.00507540

Function at 0x50ec60
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x50ed6c
push rbp
mov rbp, rsp
sub rsp, 0x50
movabs rdx, 0x5e377a6c887f6963
mov qword [rsp + 0x37], rdx
movabs rdx, 0x7877948637747382
mov qword [rsp + 0x3f], rdx
movabs rdx, 0x8278779486377473
mov qword [rsp + 0x40], rdx
movabs rdx, 0x526d695d65827c61
mov qword [rsp + 0x48], rdx
movabs rdx, 0x18100e0512130f
mov qword [rsp + 0x1b], rdx
movabs rdx, 0x30b060c150802
mov qword [rsp + 0x23], rdx
movabs rdx, 0x120e0d0d00030b06
mov qword [rsp + 0x27], rdx
movabs rdx, 0x70c140315101800
mov qword [rsp + 0x2f], rdx
xor eax, eax
jmp 0x50ed08
movzx r9d, byte [rsp + rsi + 0x37]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x30]
mov byte [rsp + rdi + 0x37], dl
mov byte [rsp + rsi + 0x37], r8b
add rax, 2
cmp rax, 0x1c
jge 0x50ed3c
movzx edx, byte [rsp + rax + 0x1b]
movzx esi, byte [rsp + rax + 0x1c]
mov edi, edx
xor edx, esi
add edx, eax
nop
cmp rdi, 0x19
jae 0x50ed5f
movzx r8d, byte [rsp + rdi + 0x37]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x30]
cmp rsi, 0x19
jb 0x50ecee
jmp 0x50ed53
xor eax, eax
lea rbx, [rsp + 0x37]
mov ecx, 0x19
call fcn.0045af60
add rsp, 0x50
pop rbp
ret
mov eax, esi
mov ecx, 0x19
call fcn.004605c0
mov eax, edi
mov ecx, 0x19
call fcn.004605c0
nop
call fcn.0045e2e0
jmp fcn.0050ec60
Function at 0x510760
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x51085d
push rbp
mov rbp, rsp
sub rsp, 0x50
movabs rdx, 0x20f761fc62fc4741
mov qword [rsp + 0x3b], rdx
movabs rdx, 0x1afa5a74ca20f761
mov qword [rsp + 0x40], rdx
movabs rdx, 0xee4b3f6223532061
mov qword [rsp + 0x48], rdx
movabs rdx, 0x60b140804020c12
mov qword [rsp + 0x1f], rdx
movabs rdx, 0x41310140e080206
mov qword [rsp + 0x27], rdx
movabs rdx, 0x130b120f04131014
mov qword [rsp + 0x2b], rdx
movabs rdx, 0x140a010f13130e11
mov qword [rsp + 0x33], rdx
xor eax, eax
jmp 0x510800
movzx r9d, byte [rsp + rsi + 0x3b]
sub r9d, edx
lea edx, [r9 + 0x43]
mov byte [rsp + rdi + 0x3b], dl
lea edx, [r8 + 0x43]
mov byte [rsp + rsi + 0x3b], dl
add rax, 2
nop dword [rax]
cmp rax, 0x1c
jge 0x51082d
movzx edx, byte [rsp + rax + 0x1f]
movzx esi, byte [rsp + rax + 0x20]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x15
jae 0x510850
movzx r8d, byte [rsp + rdi + 0x3b]
sub r8d, edx
cmp rsi, 0x15
jb 0x5107df
jmp 0x510844
xor eax, eax
lea rbx, [rsp + 0x3b]
mov ecx, 0x15
call fcn.0045af60
add rsp, 0x50
pop rbp
ret
mov eax, esi
mov ecx, 0x15
call fcn.004605c0
mov eax, edi
mov ecx, 0x15
call fcn.004605c0
nop
nop dword [rax]
call fcn.0045e2e0
jmp fcn.00510760

Function at 0x512f00
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x512fec
push rbp
mov rbp, rsp
sub rsp, 0x40
movabs rdx, 0x7c1353c06bc5ba4f
mov qword [rsp + 0x2e], rdx
movabs rdx, 0xc36e7c1353c06bc5
mov qword [rsp + 0x30], rdx
movabs rdx, 0x9d6d1724dbc0c6c6
mov qword [rsp + 0x38], rdx
movabs rdx, 0xa01070d110e0e0f
mov qword [rsp + 0x1c], rdx
movabs rdx, 0x7040a01070d110e
mov qword [rsp + 0x1e], rdx
movabs rdx, 0xf0c020b09060606
mov qword [rsp + 0x26], rdx
xor eax, eax
jmp 0x512f8a
movzx r9d, byte [rsp + rsi + 0x2e]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x6a]
mov byte [rsp + rdi + 0x2e], dl
mov byte [rsp + rsi + 0x2e], r8b
add rax, 2
cmp rax, 0x12
jge 0x512fbc
movzx edx, byte [rsp + rax + 0x1c]
movzx esi, byte [rsp + rax + 0x1d]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x12
jae 0x512fdf
movzx r8d, byte [rsp + rdi + 0x2e]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x6a]
cmp rsi, 0x12
jb 0x512f70
jmp 0x512fd3
xor eax, eax
lea rbx, [rsp + 0x2e]
mov ecx, 0x12
call fcn.0045af60
add rsp, 0x40
pop rbp
ret
mov eax, esi
mov ecx, 0x12
call fcn.004605c0
mov eax, edi
mov ecx, 0x12
call fcn.004605c0
nop
call fcn.0045e2e0
jmp fcn.00512f00
Function at 0x517dc0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x517ecc
push rbp
mov rbp, rsp
sub rsp, 0x58
movabs rdx, 0x2e75908851368365
mov qword [rsp + 0x3c], rdx
movabs rdx, 0x538261697c611e43
mov qword [rsp + 0x44], rdx
movabs rdx, 0x646e1e7e53826169
mov qword [rsp + 0x48], rdx
movabs rdx, 0x655369387a887261
mov qword [rsp + 0x50], rdx
movabs rdx, 0x17030e1a010b0e05
mov qword [rsp + 0x1c], rdx
movabs rdx, 0x110e0716051010
mov qword [rsp + 0x24], rdx
movabs rdx, 0x18050817000405
mov qword [rsp + 0x2c], rdx
movabs rdx, 0x1807100203020904
mov qword [rsp + 0x34], rdx
xor eax, eax
jmp 0x517e68
movzx r9d, byte [rsp + rsi + 0x3c]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x23]
mov byte [rsp + rdi + 0x3c], dl
mov byte [rsp + rsi + 0x3c], r8b
add rax, 2
cmp rax, 0x20
jge 0x517e9c
movzx edx, byte [rsp + rax + 0x1c]
movzx esi, byte [rsp + rax + 0x1d]
mov edi, edx
xor edx, esi
add edx, eax
nop
cmp rdi, 0x1c
jae 0x517ebf
movzx r8d, byte [rsp + rdi + 0x3c]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x23]
cmp rsi, 0x1c
jb 0x517e4e
jmp 0x517eb3
xor eax, eax
lea rbx, [rsp + 0x3c]
mov ecx, 0x1c
call fcn.0045af60
add rsp, 0x58
pop rbp
ret
mov eax, esi
mov ecx, 0x1c
call fcn.004605c0
mov eax, edi
mov ecx, 0x1c
call fcn.004605c0
nop
call fcn.0045e2e0
jmp fcn.00517dc0

Function at 0x5183a0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x5184ac
push rbp
mov rbp, rsp
sub rsp, 0x50
movabs rdx, 0xfb9d9cd49d6a558b
mov qword [rsp + 0x37], rdx
movabs rdx, 0xa8e0745320d6eca4
mov qword [rsp + 0x3f], rdx
movabs rdx, 0xe1a8e0745320d6ec
mov qword [rsp + 0x40], rdx
movabs rdx, 0x656d537da9647261
mov qword [rsp + 0x48], rdx
movabs rdx, 0x90e070710140302
mov qword [rsp + 0x1d], rdx
movabs rdx, 0xf080a05040e070e
mov qword [rsp + 0x25], rdx
movabs rdx, 0x6050f080a05040e
mov qword [rsp + 0x27], rdx
movabs rdx, 0x9001614150e0e09
mov qword [rsp + 0x2f], rdx
xor eax, eax
jmp 0x518448
movzx r9d, byte [rsp + rsi + 0x37]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x4b]
mov byte [rsp + rdi + 0x37], dl
mov byte [rsp + rsi + 0x37], r8b
add rax, 2
cmp rax, 0x1a
jge 0x51847c
movzx edx, byte [rsp + rax + 0x1d]
movzx esi, byte [rsp + rax + 0x1e]
mov edi, edx
xor edx, esi
add edx, eax
nop
cmp rdi, 0x19
jae 0x51849f
movzx r8d, byte [rsp + rdi + 0x37]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x4b]
cmp rsi, 0x19
jb 0x51842e
jmp 0x518493
xor eax, eax
lea rbx, [rsp + 0x37]
mov ecx, 0x19
call fcn.0045af60
add rsp, 0x50
pop rbp
ret
mov eax, esi
mov ecx, 0x19
call fcn.004605c0
mov eax, edi
mov ecx, 0x19
call fcn.004605c0
nop
call fcn.0045e2e0
jmp fcn.005183a0
Function at 0x51ab60
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x51ac4a
push rbp
mov rbp, rsp
sub rsp, 0x40
movabs rdx, 0x3226c565c0c3c054
mov qword [rsp + 0x2c], rdx
movabs rdx, 0xae2061743226c565
mov qword [rsp + 0x30], rdx
movabs rdx, 0x65ce692a20d27234
mov qword [rsp + 0x38], rdx
movabs rdx, 0xb120b070a0e0102
mov qword [rsp + 0x18], rdx
movabs rdx, 0x60a10100b120b07
mov qword [rsp + 0x1c], rdx
movabs rdx, 0xa0e050c03100c0c
mov qword [rsp + 0x24], rdx
xor eax, eax
jmp 0x51abed
movzx r9d, byte [rsp + rsi + 0x2c]
sub r9d, edx
lea edx, [r9 - 0x4b]
mov byte [rsp + rdi + 0x2c], dl
lea edx, [r8 - 0x4b]
mov byte [rsp + rsi + 0x2c], dl
add rax, 2
cmp rax, 0x14
jge 0x51ac1a
movzx edx, byte [rsp + rax + 0x18]
movzx esi, byte [rsp + rax + 0x19]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x14
jae 0x51ac3d
movzx r8d, byte [rsp + rdi + 0x2c]
sub r8d, edx
cmp rsi, 0x14
jb 0x51abd0
jmp 0x51ac31
xor eax, eax
lea rbx, [rsp + 0x2c]
mov ecx, 0x14
call fcn.0045af60
add rsp, 0x40
pop rbp
ret
mov eax, esi
mov ecx, 0x14
call fcn.004605c0
mov eax, edi
mov ecx, 0x14
call fcn.004605c0
nop
call fcn.0045e2e0
jmp fcn.0051ab60

Function at 0x51c1c0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x51c2dd
push rbp
mov rbp, rsp
sub rsp, 0x58
movabs rdx, 0x2b6c0a38f3b9292e
mov qword [rsp + 0x3a], rdx
movabs rdx, 0x34dc16f26f724d45
mov qword [rsp + 0x42], rdx
movabs rdx, 0x3f54a5f5fa4234dc
mov qword [rsp + 0x48], rdx
movabs rdx, 0xc6d1d543b1230ef
mov qword [rsp + 0x50], rdx
movabs rdx, 0x1d0f1707181813
mov qword [rsp + 0x18], rdx
movabs rdx, 0x1204001d0f170718
mov qword [rsp + 0x1a], rdx
movabs rdx, 0x100c1b1b0d0e020e
mov qword [rsp + 0x22], rdx
movabs rdx, 0x1905150403030201
mov qword [rsp + 0x2a], rdx
movabs rdx, 0x30d071109141916
mov qword [rsp + 0x32], rdx
xor eax, eax
jmp 0x51c280
movzx r9d, byte [rsp + rsi + 0x3a]
sub r9d, edx
lea edx, [r9 + 0x5a]
mov byte [rsp + rdi + 0x3a], dl
lea edx, [r8 + 0x5a]
mov byte [rsp + rsi + 0x3a], dl
add rax, 2
nop word [rax + rax]
cmp rax, 0x22
jge 0x51c2ad
movzx edx, byte [rsp + rax + 0x18]
movzx esi, byte [rsp + rax + 0x19]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x1e
jae 0x51c2d0
movzx r8d, byte [rsp + rdi + 0x3a]
sub r8d, edx
cmp rsi, 0x1e
jb 0x51c25d
jmp 0x51c2c4
xor eax, eax
lea rbx, [rsp + 0x3a]
mov ecx, 0x1e
call fcn.0045af60
add rsp, 0x58
pop rbp
ret
mov eax, esi
mov ecx, 0x1e
call fcn.004605c0
mov eax, edi
mov ecx, 0x1e
call fcn.004605c0
nop
nop dword [rax]
call fcn.0045e2e0
jmp fcn.0051c1c0