joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4f2de0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4f2e98
push rbp
mov rbp, rsp
sub rsp, 0x30
movabs rdx, 0x935350b809666908
mov qword [rsp + 0x28], rdx
movabs rdx, 0x307000605040506
mov qword [rsp + 0x1c], rdx
mov dword [rsp + 0x24], 0x3000405
xor eax, eax
jmp 0x4f2e36
movzx r9d, byte [rsp + rsi + 0x28]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x55]
mov byte [rsp + rdi + 0x28], dl
mov byte [rsp + rsi + 0x28], r8b
add rax, 2
cmp rax, 0xc
jge 0x4f2e68
movzx edx, byte [rsp + rax + 0x1c]
movzx esi, byte [rsp + rax + 0x1d]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 8
jae 0x4f2e8b
movzx r8d, byte [rsp + rdi + 0x28]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x55]
cmp rsi, 8
jb 0x4f2e1c
jmp 0x4f2e7f
xor eax, eax
lea rbx, [rsp + 0x28]
mov ecx, 8
call fcn.004451c0
add rsp, 0x30
pop rbp
ret
mov eax, esi
mov ecx, 8
call fcn.00457340
mov eax, edi
mov ecx, 8
call fcn.00457340
nop
call fcn.00455060
nop dword [rax]
jmp fcn.004f2de0

Function at 0x4f3a20
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4f3ad8
push rbp
mov rbp, rsp
sub rsp, 0x30
movabs rdx, 0x9cd4f2980e8b78f4
mov qword [rsp + 0x28], rdx
movabs rdx, 0x6040704070302
mov qword [rsp + 0x1e], rdx
mov word [rsp + 0x26], 0x503
xor eax, eax
jmp 0x4f3a75
movzx r9d, byte [rsp + rsi + 0x28]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x65]
mov byte [rsp + rdi + 0x28], dl
mov byte [rsp + rsi + 0x28], r8b
add rax, 2
cmp rax, 0xa
jge 0x4f3aa8
movzx edx, byte [rsp + rax + 0x1e]
movzx esi, byte [rsp + rax + 0x1f]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 8
jae 0x4f3acb
movzx r8d, byte [rsp + rdi + 0x28]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x65]
nop
cmp rsi, 8
jb 0x4f3a5b
jmp 0x4f3abf
xor eax, eax
lea rbx, [rsp + 0x28]
mov ecx, 8
call fcn.004451c0
add rsp, 0x30
pop rbp
ret
mov eax, esi
mov ecx, 8
call fcn.00457340
mov eax, edi
mov ecx, 8
call fcn.00457340
nop
call fcn.00455060
nop dword [rax]
jmp fcn.004f3a20

Function at 0x4f5b60
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4f5c2c
push rbp
mov rbp, rsp
sub rsp, 0x38
movabs rdx, 0x9d49839c8582aec1
mov qword [rsp + 0x2a], rdx
movabs rdx, 0xa26f617c9d7f9d49
mov qword [rsp + 0x30], rdx
movabs rdx, 0x10d0c0700010302
mov qword [rsp + 0x1a], rdx
movabs rdx, 0x4040800090a0505
mov qword [rsp + 0x22], rdx
xor eax, eax
jmp 0x4f5bcf
movzx r9d, byte [rsp + rsi + 0x2a]
sub r9d, edx
lea edx, [r9 - 0x1c]
mov byte [rsp + rdi + 0x2a], dl
lea edx, [r8 - 0x1c]
mov byte [rsp + rsi + 0x2a], dl
add rax, 2
cmp rax, 0x10
jge 0x4f5bfc
movzx edx, byte [rsp + rax + 0x1a]
movzx esi, byte [rsp + rax + 0x1b]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0xe
jae 0x4f5c1f
movzx r8d, byte [rsp + rdi + 0x2a]
sub r8d, edx
cmp rsi, 0xe
jb 0x4f5bb2
jmp 0x4f5c13
xor eax, eax
lea rbx, [rsp + 0x2a]
mov ecx, 0xe
call fcn.004451c0
add rsp, 0x38
pop rbp
ret
mov eax, esi
mov ecx, 0xe
call fcn.00457340
mov eax, edi
mov ecx, 0xe
call fcn.00457340
nop
call fcn.00455060
jmp fcn.004f5b60
Function at 0x4f78c0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4f79aa
push rbp
mov rbp, rsp
sub rsp, 0x40
movabs rdx, 0x6c616e20690f3c5d
mov qword [rsp + 0x2e], rdx
movabs rdx, 0x365f6c616e20690f
mov qword [rsp + 0x30], rdx
movabs rdx, 0x416f1e3425694755
mov qword [rsp + 0x38], rdx
movabs rdx, 0x10902020d0f0202
mov qword [rsp + 0x18], rdx
movabs rdx, 0xd0b0f0a000e0109
mov qword [rsp + 0x1e], rdx
movabs rdx, 0x1110e04010911
mov qword [rsp + 0x26], rdx
xor eax, eax
jmp 0x4f794d
movzx r9d, byte [rsp + rsi + 0x2e]
sub r9d, edx
lea edx, [r9 + 0x2e]
mov byte [rsp + rdi + 0x2e], dl
lea edx, [r8 + 0x2e]
mov byte [rsp + rsi + 0x2e], dl
add rax, 2
cmp rax, 0x16
jge 0x4f797a
movzx edx, byte [rsp + rax + 0x18]
movzx esi, byte [rsp + rax + 0x19]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x12
jae 0x4f799d
movzx r8d, byte [rsp + rdi + 0x2e]
sub r8d, edx
cmp rsi, 0x12
jb 0x4f7930
jmp 0x4f7991
xor eax, eax
lea rbx, [rsp + 0x2e]
mov ecx, 0x12
call fcn.004451c0
add rsp, 0x40
pop rbp
ret
mov eax, esi
mov ecx, 0x12
call fcn.00457340
mov eax, edi
mov ecx, 0x12
call fcn.00457340
nop
call fcn.00455060
jmp fcn.004f78c0
Function at 0x4ffce0
Capabilities:
Hash data using fnv

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4fff1b
push rbp
mov rbp, rsp
sub rsp, 0x78
mov ebx, dword [rax + 0x2c]
test ebx, ebx
jne 0x4ffd7a
mov qword [rsp + 0x88], rax
lea rbx, [0x0057ffe0]
mov rcx, rax
lea rax, [0x0063fc80]
call fcn.00461ac0
test cl, cl
jne 0x4ffd63
mov rax, qword [rsp + 0x88]
call fcn.004ff5c0
mov ecx, 1
mov rdi, rax
mov rsi, rbx
lea rax, [rsp + 0x28]
lea rbx, [0x005a6b80]
call fcn.00444e40
mov qword [rsp + 0x68], rax
mov qword [rsp + 0x48], rbx
call fcn.004fffc0
mov rcx, qword [rsp + 0x88]
xor edx, edx
jmp 0x4ffda0
lea rdx, [0x0057e420]
cmp rax, rdx
jne 0x4ffd8b
test byte [rbx], al
mov rax, rbx
add rsp, 0x78
pop rbp
ret
nop
nop dword [rax + rax]
call fcn.00452e60
add rsp, 0x78
pop rbp
ret
mov rbx, rdx
lea rcx, [0x005626a0]
call fcn.00409c20
inc rdx
nop dword [rax]
cmp rbx, rdx
jle 0x4ffde4
mov rsi, qword [rax + rdx*8]
cmp qword [rsi + 0x30], rcx
jne 0x4ffd9a
lea rax, [0x0063fc80]
lea rbx, [0x0057ffe0]
lea rdi, [0x0057e420]
call fcn.00461c80
lea rdx, [0x0057e420]
cmp rax, rdx
jne 0x4fff0b
test byte [rbx], al
mov rax, rbx
add rsp, 0x78
pop rbp
ret
lea rcx, [0x0055ab00]
mov qword [rsp + 0x50], rcx
mov qword [rsp + 0x58], 0
mov rcx, qword [rsp + 0x50]
mov qword [rsp + 0x60], rcx
lea rax, [0x0056a120]
call fcn.0040cae0
mov qword [rsp + 0x70], rax
mov rcx, qword [rsp + 0x60]
test byte [rcx], al
cmp dword [0x006c5100], 0
je 0x4ffe3d
mov rbx, rax
lea rax, [0x0056a120]
call fcn.004118a0
mov rax, qword [rsp + 0x70]
mov rcx, qword [rsp + 0x60]
mov rdx, qword [rcx]
mov qword [rax], rdx
movups xmm0, xmmword [rcx + 8]
movups xmmword [rax + 8], xmm0
movups xmm0, xmmword [rcx + 0x18]
movups xmmword [rax + 0x18], xmm0
movups xmm0, xmmword [rcx + 0x28]
movups xmmword [rax + 0x28], xmm0
nop
mov rbx, qword [rsp + 0x48]
xor ecx, ecx
xor edi, edi
xor esi, esi
mov r8d, esi
mov rax, qword [rsp + 0x68]
call fcn.004013e0
nop
call fcn.00452f20
mov rsi, qword [rsp + 0x70]
mov dword [rsi + 0x28], eax
mov dword [rsi + 0x2c], 0
mov rcx, qword [rsp + 0x88]
mov edx, dword [rcx + 0x10]
xor eax, eax
jmp 0x4ffea6
imul edx, edx, 0x1000193
xor edx, 0x2a
mov eax, 1
test rax, rax
jle 0x4ffe98
mov dword [rsi + 0x10], edx
cmp dword [0x006c5100], 0
je 0x4ffec7
call fcn.00456fa0
mov qword [r11], rcx
mov rdx, qword [rsi + 0x30]
mov qword [r11 + 8], rdx
mov qword [rsi + 0x30], rcx
lea rax, [0x0063fc80]
lea rbx, [0x0057ffe0]
lea rdi, [0x0057e420]
call fcn.00461c80
lea rdx, [0x0057e420]
cmp rax, rdx
jne 0x4ffefc
test byte [rbx], al
mov rax, rbx
add rsp, 0x78
pop rbp
ret
mov rbx, rdx
lea rcx, [0x005626a0]
call fcn.00409c20
mov rbx, rdx
lea rcx, [0x005626a0]
call fcn.00409c20
nop
mov qword [rsp + 8], rax
call fcn.00455060
mov rax, qword [rsp + 8]
jmp fcn.004ffce0
Function at 0x503180
Capabilities:
Resolve function by parsing pe exports

Disassembly:
lea r12, [rsp - 0x18]
cmp r12, qword [r14 + 0x10]
jbe 0x50334f
push rbp
mov rbp, rsp
sub rsp, 0x90
mov qword [rsp + 0xa0], rax
mov qword [rsp + 0xa8], rbx
mov rdx, rcx
and ecx, 0x1f
cmp rcx, 0x19
jne 0x5032ec
nop word [rax + rax]
cmp qword [rax + 0x40], rdi
jbe 0x5032d3
mov rsi, qword [rax + 0x38]
lea rdi, [rdi + rdi*2]
mov r8, qword [rsi + rdi*8 + 8]
and edx, 0x1a0
mov r9, qword [rsi + rdi*8]
movzx r10d, byte [r8 + 0x17]
and r10d, 0x1f
movzx r9d, byte [r9]
or rdx, r10
nop
test r9b, 1
jne 0x50320d
mov r10, rdx
or r10, 0x40
or rdx, 0x20
nop
nop
test r9b, 8
cmovne rdx, r10
nop
movabs r9, 0x3a2c9b862a4c7d68
mov qword [rsp + 0x3c], r9
movabs r9, 0xbdcad63a0cf85d43
mov qword [rsp + 0x44], r9
movabs r9, 0xb298fd06bdcad63a
mov qword [rsp + 0x48], r9
movabs r9, 0x9a30025a79c497d
mov qword [rsp + 0x50], r9
xor eax, eax
jmp 0x50326b
lea r9, [0x005865d3]
movzx r10d, byte [r9 + rax]
movzx r11d, byte [rsp + rax + 0x3c]
add r10d, r11d
mov byte [rsp + rax + 0x3c], r10b
inc rax
cmp rax, 0x1c
jl 0x50324e
mov qword [rsp + 0x70], r8
mov qword [rsp + 0x88], rsi
mov qword [rsp + 0x80], rbx
mov qword [rsp + 0x68], rdi
mov qword [rsp + 0x58], rdx
lea rax, [rsp + 0x1c]
lea rbx, [rsp + 0x3c]
mov ecx, 0x1c
nop
call fcn.004451c0
mov rbx, qword [rsp + 0x80]
mov rdx, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x88]
add rbx, qword [rsi + rdx*8 + 0x10]
nop
mov rax, qword [rsp + 0x70]
mov rcx, qword [rsp + 0x58]
add rsp, 0x90
pop rbp
ret
call fcn.0051a420
call fcn.00409fa0
mov rbx, rax
lea rax, [0x0055f0c0]
call fcn.0042f960
mov qword [rsp + 0x60], rcx
call fcn.0051a320
mov qword [rsp + 0x68], rbx
mov qword [rsp + 0x78], rax
lea rax, [0x0056c320]
call fcn.0040cae0
mov rcx, qword [rsp + 0x68]
mov qword [rax + 8], rcx
cmp dword [0x006c5100], 0
jne 0x50333e
mov rcx, qword [rsp + 0x78]
mov qword [rax], rcx
mov rcx, qword [rsp + 0x60]
mov qword [rax + 0x10], rcx
mov rbx, rax
lea rax, [0x00564860]
call fcn.0042f960
nop
call fcn.00456f80
mov rcx, qword [rsp + 0x78]
mov qword [r11], rcx
jmp 0x50331e
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
call fcn.00455060
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
nop dword [rax]
jmp fcn.00503180
Function at 0x50a0e0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x50a1cc
push rbp
mov rbp, rsp
sub rsp, 0x48
movabs rdx, 0x746380a59f8f7cd0
mov qword [rsp + 0x33], rdx
movabs rdx, 0x619a207fbc746380
mov qword [rsp + 0x38], rdx
movabs rdx, 0x82de74702065759e
mov qword [rsp + 0x40], rdx
movabs rdx, 0x1302140d0d0b000b
mov qword [rsp + 0x1b], rdx
movabs rdx, 0x205110904030d13
mov qword [rsp + 0x23], rdx
movabs rdx, 0x301040505010108
mov qword [rsp + 0x2b], rdx
xor eax, eax
jmp 0x50a16a
movzx r9d, byte [rsp + rsi + 0x33]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x30]
mov byte [rsp + rdi + 0x33], dl
mov byte [rsp + rsi + 0x33], r8b
add rax, 2
cmp rax, 0x18
jge 0x50a19c
movzx edx, byte [rsp + rax + 0x1b]
movzx esi, byte [rsp + rax + 0x1c]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x15
jae 0x50a1bf
movzx r8d, byte [rsp + rdi + 0x33]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x30]
cmp rsi, 0x15
jb 0x50a150
jmp 0x50a1b3
xor eax, eax
lea rbx, [rsp + 0x33]
mov ecx, 0x15
call fcn.004451c0
add rsp, 0x48
pop rbp
ret
mov eax, esi
mov ecx, 0x15
call fcn.00457340
mov eax, edi
mov ecx, 0x15
call fcn.00457340
nop
call fcn.00455060
jmp fcn.0050a0e0

Function at 0x511d00
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x511e27
push rbp
mov rbp, rsp
sub rsp, 0x60
movabs rdx, 0x3d7447bb0d6642cd
mov qword [rsp + 0x3e], rdx
movabs rdx, 0x46203d7447bb0d66
mov qword [rsp + 0x40], rdx
movabs rdx, 0x1311004258fb6524
mov qword [rsp + 0x48], rdx
movabs rdx, 0xfb2074ea6fd31365
mov qword [rsp + 0x50], rdx
movabs rdx, 0x658b847ee623a38
mov qword [rsp + 0x58], rdx
movabs rdx, 0xa041f190c0f1416
mov qword [rsp + 0x18], rdx
movabs rdx, 0xe21160e1a030a04
mov qword [rsp + 0x1e], rdx
movabs rdx, 0x51a000119010513
mov qword [rsp + 0x26], rdx
movabs rdx, 0xd201d1407111b10
mov qword [rsp + 0x2e], rdx
movabs rdx, 0x1070f1f0a1b0c1e
mov qword [rsp + 0x36], rdx
xor eax, eax
jmp 0x511dc9
movzx r9d, byte [rsp + rsi + 0x3e]
sub r9d, edx
lea edx, [r9 + 0x55]
mov byte [rsp + rdi + 0x3e], dl
lea edx, [r8 + 0x55]
mov byte [rsp + rsi + 0x3e], dl
add rax, 2
cmp rax, 0x26
jge 0x511df7
movzx edx, byte [rsp + rax + 0x18]
movzx esi, byte [rsp + rax + 0x19]
mov edi, edx
xor edx, esi
add edx, eax
nop
cmp rdi, 0x22
jae 0x511e1a
movzx r8d, byte [rsp + rdi + 0x3e]
sub r8d, edx
cmp rsi, 0x22
jb 0x511dac
jmp 0x511e0e
xor eax, eax
lea rbx, [rsp + 0x3e]
mov ecx, 0x22
call fcn.004451c0
add rsp, 0x60
pop rbp
ret
mov eax, esi
mov ecx, 0x22
call fcn.00457340
mov eax, edi
mov ecx, 0x22
call fcn.00457340
nop
call fcn.00455060
jmp fcn.00511d00
Function at 0x512960
Capabilities:
Encrypt data using rc4 prga

Disassembly:
lea r12, [rsp - 0x38]
cmp r12, qword [r14 + 0x10]
jbe 0x512adb
push rbp
mov rbp, rsp
sub rsp, 0xb0
movabs rdx, 0x65ca715a896d9292
mov qword [rsp + 0x6c], rdx
movabs rdx, 0x75566e9265ca715a
mov qword [rsp + 0x70], rdx
movabs rdx, 0xe410562eba63a06c
mov qword [rsp + 0x78], rdx
movabs rdx, 0xe561476e8b776575
mov qword [rsp + 0x80], rdx
movabs rdx, 0xf46574b74dbf508d
mov qword [rsp + 0x88], rdx
movabs rdx, 0x65833161c8585620
mov qword [rsp + 0x90], rdx
movabs rdx, 0x527764526cd530e8
mov qword [rsp + 0x98], rdx
movabs rdx, 0xa83e65195e1b746f
mov qword [rsp + 0xa0], rdx
movabs rdx, 0x726f335d467b70a5
mov qword [rsp + 0xa8], rdx
movabs rdx, 0x2e2e2336121b3236
mov qword [rsp + 0x18], rdx
lea rdi, [rsp + 0x1c]
lea rsi, str.6.._
nop word [rax + rax]
nop word [rax + rax]
mov qword [rsp - 0x10], rbp
lea rbp, [rsp - 0x10]
call fcn.0045795a
mov rbp, qword [rbp]
xor eax, eax
jmp 0x512a71
movzx r9d, byte [rsp + rsi + 0x6c]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x69]
mov byte [rsp + rdi + 0x6c], dl
mov byte [rsp + rsi + 0x6c], r8b
add rax, 2
cmp rax, 0x54
jge 0x512aa8
movzx edx, byte [rsp + rax + 0x18]
movzx esi, byte [rsp + rax + 0x19]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x44
jae 0x512ace
movzx r8d, byte [rsp + rdi + 0x6c]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x69]
nop dword [rax + rax]
cmp rsi, 0x44
jb 0x512a57
jmp 0x512ac2
xor eax, eax
lea rbx, [rsp + 0x6c]
mov ecx, 0x44
call fcn.004451c0
add rsp, 0xb0
pop rbp
ret
mov eax, esi
mov ecx, 0x44
call fcn.00457340
mov eax, edi
mov ecx, 0x44
call fcn.00457340
nop
nop dword [rax + rax]
call fcn.00455060
jmp fcn.00512960

Function at 0x512b00
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x512c1d
push rbp
mov rbp, rsp
sub rsp, 0x60
movabs rdx, 0x65c660d6c668672
mov qword [rsp + 0x45], rdx
movabs rdx, 0x6eb4ccc44a0f1aad
mov qword [rsp + 0x4d], rdx
movabs rdx, 0x661a736eb4ccc44a
mov qword [rsp + 0x50], rdx
movabs rdx, 0xaea4dea5696fc8f9
mov qword [rsp + 0x58], rdx
movabs rdx, 0x41908050e130b1a
mov qword [rsp + 0x1d], rdx
movabs rdx, 0x70806070c041a0a
mov qword [rsp + 0x25], rdx
movabs rdx, 0x17080a1305131717
mov qword [rsp + 0x2d], rdx
movabs rdx, 0xb0b11090a011804
mov qword [rsp + 0x35], rdx
movabs rdx, 0x40a01140d0a1414
mov qword [rsp + 0x3d], rdx
xor eax, eax
jmp 0x512bc0
movzx r9d, byte [rsp + rsi + 0x45]
sub r9d, edx
lea edx, [r9 + 0x7b]
mov byte [rsp + rdi + 0x45], dl
lea edx, [r8 + 0x7b]
mov byte [rsp + rsi + 0x45], dl
add rax, 2
nop word [rax + rax]
cmp rax, 0x28
jge 0x512bed
movzx edx, byte [rsp + rax + 0x1d]
movzx esi, byte [rsp + rax + 0x1e]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x1b
jae 0x512c10
movzx r8d, byte [rsp + rdi + 0x45]
sub r8d, edx
cmp rsi, 0x1b
jb 0x512b9d
jmp 0x512c04
xor eax, eax
lea rbx, [rsp + 0x45]
mov ecx, 0x1b
call fcn.004451c0
add rsp, 0x60
pop rbp
ret
mov eax, esi
mov ecx, 0x1b
call fcn.00457340
mov eax, edi
mov ecx, 0x1b
call fcn.00457340
nop
nop dword [rax]
call fcn.00455060
jmp fcn.00512b00
Function at 0x514740
Capabilities:
Encrypt data using rc4 prga

Disassembly:
lea r12, [rsp - 0x38]
cmp r12, qword [r14 + 0x10]
jbe 0x514895
push rbp
mov rbp, rsp
sub rsp, 0xb0
movabs rdx, 0xd27cacaf6c66c59a
mov qword [rsp + 0x72], rdx
movabs rdx, 0x741daadf66e09220
mov qword [rsp + 0x7a], rdx
movabs rdx, 0x26996c61568f741d
mov qword [rsp + 0x80], rdx
movabs rdx, 0x1652b6e69455080
mov qword [rsp + 0x88], rdx
movabs rdx, 0xd0796e98e02b51ce
mov qword [rsp + 0x90], rdx
movabs rdx, 0x7c3eef696c61269e
mov qword [rsp + 0x98], rdx
movabs rdx, 0xcc612d0820c04b6f
mov qword [rsp + 0xa0], rdx
movabs rdx, 0x726f7494b16fe320
mov qword [rsp + 0xa8], rdx
movabs rdx, 0x61b101d04353121
mov qword [rsp + 0x1a], rdx
lea rdi, [rsp + 0x22]
lea rsi, [0x005aa240]
nop
mov qword [rsp - 0x10], rbp
lea rbp, [rsp - 0x10]
call fcn.0045795a
mov rbp, qword [rbp]
xor eax, eax
jmp 0x514834
movzx r9d, byte [rsp + rsi + 0x72]
sub r9d, edx
lea edx, [r9 - 0xc]
mov byte [rsp + rdi + 0x72], dl
lea edx, [r8 - 0xc]
mov byte [rsp + rsi + 0x72], dl
add rax, 2
cmp rax, 0x58
jge 0x514862
movzx edx, byte [rsp + rax + 0x1a]
movzx esi, byte [rsp + rax + 0x1b]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x3e
jae 0x514888
movzx r8d, byte [rsp + rdi + 0x72]
sub r8d, edx
cmp rsi, 0x3e
jb 0x514817
nop
jmp 0x51487c
xor eax, eax
lea rbx, [rsp + 0x72]
mov ecx, 0x3e
call fcn.004451c0
add rsp, 0xb0
pop rbp
ret
mov eax, esi
mov ecx, 0x3e
call fcn.00457340
mov eax, edi
mov ecx, 0x3e
call fcn.00457340
nop
call fcn.00455060
jmp fcn.00514740

Function at 0x514cc0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
lea r12, [rsp - 0x40]
cmp r12, qword [r14 + 0x10]
jbe 0x514e35
push rbp
mov rbp, rsp
sub rsp, 0xb8
movabs rdx, 0xe44e6574416e384d
mov qword [rsp + 0x6b], rdx
movabs rdx, 0x6c23f22d1b14654e
mov qword [rsp + 0x73], rdx
movabs rdx, 0x2318f912d36c23f2
mov qword [rsp + 0x78], rdx
movabs rdx, 0x1fd97ae76e613939
mov qword [rsp + 0x80], rdx
movabs rdx, 0xeaec2072dc719f27
mov qword [rsp + 0x88], rdx
movabs rdx, 0xd7613c6f644b1b66
mov qword [rsp + 0x90], rdx
movabs rdx, 0x6c76b86f36746ff2
mov qword [rsp + 0x98], rdx
movabs rdx, 0x6f9f7361b5b16120
mov qword [rsp + 0xa0], rdx
movabs rdx, 0x6d207f51fb616927
mov qword [rsp + 0xa8], rdx
movabs rdx, 0x10216c133f204361
mov qword [rsp + 0xb0], rdx
lea rdi, [rsp + 0x1b]
lea rsi, [0x005a94f0]
nop word [rax + rax]
nop word [rax + rax]
mov qword [rsp - 0x10], rbp
lea rbp, [rsp - 0x10]
call fcn.0045795a
mov rbp, qword [rbp]
xor eax, eax
jmp 0x514dd4
movzx r9d, byte [rsp + rsi + 0x6b]
sub r9d, edx
lea edx, [r9 - 0x70]
mov byte [rsp + rdi + 0x6b], dl
lea edx, [r8 - 0x70]
mov byte [rsp + rsi + 0x6b], dl
add rax, 2
cmp rax, 0x50
jge 0x514e02
movzx edx, byte [rsp + rax + 0x1b]
movzx esi, byte [rsp + rax + 0x1c]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x4d
jae 0x514e28
movzx r8d, byte [rsp + rdi + 0x6b]
sub r8d, edx
cmp rsi, 0x4d
jb 0x514db7
nop
jmp 0x514e1c
xor eax, eax
lea rbx, [rsp + 0x6b]
mov ecx, 0x4d
call fcn.004451c0
add rsp, 0xb8
pop rbp
ret
mov eax, esi
mov ecx, 0x4d
call fcn.00457340
mov eax, edi
mov ecx, 0x4d
call fcn.00457340
nop
call fcn.00455060
jmp fcn.00514cc0
Function at 0x5177e0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x517927
push rbp
mov rbp, rsp
sub rsp, 0x78
movabs rdx, 0x2e72cd7418a56137
mov qword [rsp + 0x50], rdx
movabs rdx, 0x26c07c808e0b082
mov qword [rsp + 0x58], rdx
movabs rdx, 0x78d6a47328b1649c
mov qword [rsp + 0x60], rdx
movabs rdx, 0xf83465c272609468
mov qword [rsp + 0x68], rdx
movabs rdx, 0x72c374da21d6a43a
mov qword [rsp + 0x70], rdx
movabs rdx, 0x1f19191b141e141b
mov qword [rsp + 0x1a], rdx
movabs rdx, 0xc21192326141f19
mov qword [rsp + 0x20], rdx
movabs rdx, 0x150a00080d150b0c
mov qword [rsp + 0x28], rdx
movabs rdx, 0x150a020903150f13
mov qword [rsp + 0x30], rdx
movabs rdx, 0x1e1022161a1f1008
mov qword [rsp + 0x38], rdx
movabs rdx, 0x1c1a19120f260519
mov qword [rsp + 0x40], rdx
movabs rdx, 0xc2413102010100f
mov qword [rsp + 0x48], rdx
xor eax, eax
jmp 0x5178c7
movzx r9d, byte [rsp + rsi + 0x50]
sub r9d, edx
lea edx, [r9 - 0x1b]
mov byte [rsp + rdi + 0x50], dl
lea edx, [r8 - 0x1b]
mov byte [rsp + rsi + 0x50], dl
add rax, 2
cmp rax, 0x36
jge 0x5178f7
movzx edx, byte [rsp + rax + 0x1a]
movzx esi, byte [rsp + rax + 0x1b]
mov edi, edx
xor edx, esi
add edx, eax
nop dword [rax]
cmp rdi, 0x28
jae 0x51791a
movzx r8d, byte [rsp + rdi + 0x50]
sub r8d, edx
cmp rsi, 0x28
jb 0x5178aa
jmp 0x51790e
xor eax, eax
lea rbx, [rsp + 0x50]
mov ecx, 0x28
call fcn.004451c0
add rsp, 0x78
pop rbp
ret
mov eax, esi
mov ecx, 0x28
call fcn.00457340
mov eax, edi
mov ecx, 0x28
call fcn.00457340
nop
call fcn.00455060
jmp fcn.005177e0

Function at 0x51ac80
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x51ad6c
push rbp
mov rbp, rsp
sub rsp, 0x40
movabs rdx, 0xbbb3f365a466cc72
mov qword [rsp + 0x2e], rdx
movabs rdx, 0x61babbb3f365a466
mov qword [rsp + 0x30], rdx
movabs rdx, 0xbffeb4332265917c
mov qword [rsp + 0x38], rdx
movabs rdx, 0x70f080310110f01
mov qword [rsp + 0x1a], rdx
movabs rdx, 0xa110a0d070f0803
mov qword [rsp + 0x1e], rdx
movabs rdx, 0x60b05110b050b0e
mov qword [rsp + 0x26], rdx
xor eax, eax
jmp 0x51ad0a
movzx r9d, byte [rsp + rsi + 0x2e]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x5d]
mov byte [rsp + rdi + 0x2e], dl
mov byte [rsp + rsi + 0x2e], r8b
add rax, 2
cmp rax, 0x14
jge 0x51ad3c
movzx edx, byte [rsp + rax + 0x1a]
movzx esi, byte [rsp + rax + 0x1b]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x12
jae 0x51ad5f
movzx r8d, byte [rsp + rdi + 0x2e]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x5d]
cmp rsi, 0x12
jb 0x51acf0
jmp 0x51ad53
xor eax, eax
lea rbx, [rsp + 0x2e]
mov ecx, 0x12
call fcn.004451c0
add rsp, 0x40
pop rbp
ret
mov eax, esi
mov ecx, 0x12
call fcn.00457340
mov eax, edi
mov ecx, 0x12
call fcn.00457340
nop
call fcn.00455060
jmp fcn.0051ac80
Function at 0x51be60
Capabilities:
Encrypt data using rc4 prga

Disassembly:
lea r12, [rsp - 8]
cmp r12, qword [r14 + 0x10]
jbe 0x51bfbd
push rbp
mov rbp, rsp
add rsp, 0xffffffffffffff80
movabs rdx, 0xde5c0f74276bff08
mov qword [rsp + 0x57], rdx
movabs rdx, 0x745b14ca0dbcae22
mov qword [rsp + 0x5f], rdx
movabs rdx, 0xb2745b14ca0dbcae
mov qword [rsp + 0x60], rdx
movabs rdx, 0x6e656113bb18181e
mov qword [rsp + 0x68], rdx
movabs rdx, 0x746e276f7002a3a1
mov qword [rsp + 0x70], rdx
movabs rdx, 0x39196c331cb11c28
mov qword [rsp + 0x78], rdx
movabs rdx, 0x23000017070a0607
mov qword [rsp + 0x1f], rdx
movabs rdx, 0x80e0a0a1923051a
mov qword [rsp + 0x27], rdx
movabs rdx, 0x100101021300050c
mov qword [rsp + 0x2f], rdx
movabs rdx, 0x1417012409211208
mov qword [rsp + 0x37], rdx
movabs rdx, 0x140d0b2810230a
mov qword [rsp + 0x3f], rdx
movabs rdx, 0xe111e15142722
mov qword [rsp + 0x47], rdx
movabs rdx, 0x725052112001b23
mov qword [rsp + 0x4f], rdx
xor eax, eax
jmp 0x51bf60
movzx r9d, byte [rsp + rsi + 0x57]
sub r9d, edx
lea edx, [r9 - 0x7a]
mov byte [rsp + rdi + 0x57], dl
lea edx, [r8 - 0x7a]
mov byte [rsp + rsi + 0x57], dl
add rax, 2
nop dword [rax + rax]
cmp rax, 0x38
jge 0x51bf8d
movzx edx, byte [rsp + rax + 0x1f]
movzx esi, byte [rsp + rax + 0x20]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x29
jae 0x51bfb0
movzx r8d, byte [rsp + rdi + 0x57]
sub r8d, edx
cmp rsi, 0x29
jb 0x51bf3e
jmp 0x51bfa4
xor eax, eax
lea rbx, [rsp + 0x57]
mov ecx, 0x29
call fcn.004451c0
sub rsp, 0xffffffffffffff80
pop rbp
ret
mov eax, esi
mov ecx, 0x29
call fcn.00457340
mov eax, edi
mov ecx, 0x29
call fcn.00457340
nop
nop dword [rax]
call fcn.00455060
jmp fcn.0051be60

Function at 0x51c800
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x51c8c6
push rbp
mov rbp, rsp
sub rsp, 0x30
movabs rdx, 0x518f69d3920d9e69
mov qword [rsp + 0x27], rdx
mov byte [rsp + 0x2f], 0x6e
movabs rdx, 0x603020104010402
mov qword [rsp + 0x1d], rdx
mov word [rsp + 0x25], 0x707
xor eax, eax
nop
jmp 0x51c860
movzx r9d, byte [rsp + rsi + 0x27]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x39]
mov byte [rsp + rdi + 0x27], dl
mov byte [rsp + rsi + 0x27], r8b
add rax, 2
nop dword [rax]
cmp rax, 0xa
jge 0x51c892
movzx edx, byte [rsp + rax + 0x1d]
movzx esi, byte [rsp + rax + 0x1e]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 9
jae 0x51c8b7
movzx r8d, byte [rsp + rdi + 0x27]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x39]
cmp rsi, 9
jb 0x51c842
jmp 0x51c8ab
xor eax, eax
lea rbx, [rsp + 0x27]
mov ecx, 9
nop
call fcn.004451c0
add rsp, 0x30
pop rbp
ret
mov eax, esi
mov ecx, 9
call fcn.00457340
mov eax, edi
mov ecx, 9
nop
call fcn.00457340
nop
call fcn.00455060
jmp fcn.0051c800