joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4f8720
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4f881b
push rbp
mov rbp, rsp
sub rsp, 0x50
movabs rdx, 0x7675655f75696d47
mov qword [rsp + 0x3a], rdx
movabs rdx, 0x62686659884e7675
mov qword [rsp + 0x40], rdx
movabs rdx, 0x886f7b5d616d7274
mov qword [rsp + 0x48], rdx
movabs rdx, 0xb0708060f09150f
mov qword [rsp + 0x1a], rdx
movabs rdx, 0xb0405121312120c
mov qword [rsp + 0x22], rdx
movabs rdx, 0xc0a0113020e030a
mov qword [rsp + 0x2a], rdx
movabs rdx, 0x80e13120d0a0b06
mov qword [rsp + 0x32], rdx
xor eax, eax
jmp 0x4f87b9
movzx r9d, byte [rsp + rsi + 0x3a]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x1e]
mov byte [rsp + rdi + 0x3a], dl
mov byte [rsp + rsi + 0x3a], r8b
add rax, 2
cmp rax, 0x20
jge 0x4f87eb
movzx edx, byte [rsp + rax + 0x1a]
movzx esi, byte [rsp + rax + 0x1b]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x16
jae 0x4f880e
movzx r8d, byte [rsp + rdi + 0x3a]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x1e]
cmp rsi, 0x16
jb 0x4f879f
jmp 0x4f8802
xor eax, eax
lea rbx, [rsp + 0x3a]
mov ecx, 0x16
call fcn.0045b720
add rsp, 0x50
pop rbp
ret
mov eax, esi
mov ecx, 0x16
call fcn.00460fc0
mov eax, edi
mov ecx, 0x16
call fcn.00460fc0
nop
nop dword [rax + rax]
call fcn.0045ece0
jmp fcn.004f8720

Function at 0x4fa4c0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4fa5bd
push rbp
mov rbp, rsp
sub rsp, 0x50
movabs rdx, 0x723d62513d746564
mov qword [rsp + 0x39], rdx
movabs rdx, 0x2afb6e52656e6f72
mov qword [rsp + 0x40], rdx
movabs rdx, 0x63536e5d55696c5e
mov qword [rsp + 0x48], rdx
movabs rdx, 0xe030e030314140d
mov qword [rsp + 0x19], rdx
movabs rdx, 0x1415160600120f13
mov qword [rsp + 0x21], rdx
movabs rdx, 0x100d1204000a0416
mov qword [rsp + 0x29], rdx
movabs rdx, 0x5060b001216000d
mov qword [rsp + 0x31], rdx
xor eax, eax
jmp 0x4fa560
movzx r9d, byte [rsp + rsi + 0x39]
sub r9d, edx
lea edx, [r9 + 0x28]
mov byte [rsp + rdi + 0x39], dl
lea edx, [r8 + 0x28]
mov byte [rsp + rsi + 0x39], dl
add rax, 2
nop dword [rax]
cmp rax, 0x20
jge 0x4fa58d
movzx edx, byte [rsp + rax + 0x19]
movzx esi, byte [rsp + rax + 0x1a]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x17
jae 0x4fa5b0
movzx r8d, byte [rsp + rdi + 0x39]
sub r8d, edx
cmp rsi, 0x17
jb 0x4fa53f
jmp 0x4fa5a4
xor eax, eax
lea rbx, [rsp + 0x39]
mov ecx, 0x17
call fcn.0045b720
add rsp, 0x50
pop rbp
ret
mov eax, esi
mov ecx, 0x17
call fcn.00460fc0
mov eax, edi
mov ecx, 0x17
call fcn.00460fc0
nop
nop dword [rax]
call fcn.0045ece0
jmp fcn.004fa4c0
Function at 0x4fc200
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4fc2c6
push rbp
mov rbp, rsp
sub rsp, 0x30
movabs rdx, 0x4c421d20f53c6941
mov qword [rsp + 0x25], rdx
mov dword [rsp + 0x2c], 0x5cc6f4c
movabs rdx, 0xa0903000a090206
mov qword [rsp + 0x19], rdx
mov dword [rsp + 0x21], 0x9040500
xor eax, eax
jmp 0x4fc260
movzx r9d, byte [rsp + rsi + 0x25]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x2c]
mov byte [rsp + rdi + 0x25], dl
mov byte [rsp + rsi + 0x25], r8b
add rax, 2
nop
cmp rax, 0xc
jge 0x4fc292
movzx edx, byte [rsp + rax + 0x19]
movzx esi, byte [rsp + rax + 0x1a]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0xb
jae 0x4fc2b7
movzx r8d, byte [rsp + rdi + 0x25]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x2c]
cmp rsi, 0xb
jb 0x4fc244
jmp 0x4fc2ab
xor eax, eax
lea rbx, [rsp + 0x25]
mov ecx, 0xb
nop
call fcn.0045b720
add rsp, 0x30
pop rbp
ret
mov eax, esi
mov ecx, 0xb
call fcn.00460fc0
mov eax, edi
mov ecx, 0xb
nop
call fcn.00460fc0
nop
call fcn.0045ece0
jmp fcn.004fc200

Function at 0x500480
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x500547
push rbp
mov rbp, rsp
sub rsp, 0x38
movabs rdx, 0xe8a9a9ff730f6c63
mov qword [rsp + 0x2d], rdx
mov dword [rsp + 0x34], 0xd8a598e8
movabs rdx, 0x209060a08040204
mov qword [rsp + 0x1f], rdx
movabs rdx, 0x508060909070209
mov qword [rsp + 0x25], rdx
xor eax, eax
jmp 0x5004e8
movzx r9d, byte [rsp + rsi + 0x2d]
sub r9d, edx
lea edx, [r9 - 0x25]
mov byte [rsp + rdi + 0x2d], dl
lea edx, [r8 - 0x25]
mov byte [rsp + rsi + 0x2d], dl
add rax, 2
cmp rax, 0xe
jge 0x500517
movzx edx, byte [rsp + rax + 0x1f]
movzx esi, byte [rsp + rax + 0x20]
mov edi, edx
xor edx, esi
add edx, eax
nop
cmp rdi, 0xb
jae 0x50053a
movzx r8d, byte [rsp + rdi + 0x2d]
sub r8d, edx
cmp rsi, 0xb
jb 0x5004cb
jmp 0x50052e
xor eax, eax
lea rbx, [rsp + 0x2d]
mov ecx, 0xb
call fcn.0045b720
add rsp, 0x38
pop rbp
ret
mov eax, esi
mov ecx, 0xb
call fcn.00460fc0
mov eax, edi
mov ecx, 0xb
call fcn.00460fc0
nop
call fcn.0045ece0
jmp fcn.00500480

Function at 0x5014a0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x501566
push rbp
mov rbp, rsp
sub rsp, 0x30
movabs rdx, 0x886b9a6f9774fcff
mov qword [rsp + 0x25], rdx
mov dword [rsp + 0x2c], 0x8b6df688
movabs rdx, 0x30a070301000501
mov qword [rsp + 0x19], rdx
mov dword [rsp + 0x21], 0x3070808
xor eax, eax
jmp 0x501500
movzx r9d, byte [rsp + rsi + 0x25]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x63]
mov byte [rsp + rdi + 0x25], dl
mov byte [rsp + rsi + 0x25], r8b
add rax, 2
nop
cmp rax, 0xc
jge 0x501532
movzx edx, byte [rsp + rax + 0x19]
movzx esi, byte [rsp + rax + 0x1a]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0xb
jae 0x501557
movzx r8d, byte [rsp + rdi + 0x25]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x63]
cmp rsi, 0xb
jb 0x5014e4
jmp 0x50154b
xor eax, eax
lea rbx, [rsp + 0x25]
mov ecx, 0xb
nop
call fcn.0045b720
add rsp, 0x30
pop rbp
ret
mov eax, esi
mov ecx, 0xb
call fcn.00460fc0
mov eax, edi
mov ecx, 0xb
nop
call fcn.00460fc0
nop
call fcn.0045ece0
jmp fcn.005014a0
Function at 0x502680
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x50274a
push rbp
mov rbp, rsp
sub rsp, 0x48
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rbx
mov qword [rsp], rax
mov qword [rsp + 8], rbx
mov byte [rsp + 0x10], 0
call fcn.004031e0
xorps xmm15, xmm15
mov r14, qword [0x00780128]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x18], 0xffffffffffffffff
jne 0x50272f
mov rcx, qword [rsp + 0x60]
lea rdx, [rcx + 1]
mov qword [rsp + 0x40], rdx
lea rax, [0x006046c0]
xor ebx, ebx
mov rcx, rdx
call fcn.0045ae80
mov rbx, qword [rsp + 0x60]
mov rcx, rax
xor edi, edi
mov rsi, qword [rsp + 0x40]
mov rax, qword [rsp + 0x58]
nop dword [rax]
call fcn.00502c80
inc rbx
cmp rcx, rbx
jae 0x50271e
mov edi, 1
lea rsi, [0x006046c0]
call fcn.0045af60
mov word [rax + rbx*2 - 2], 0
xor edi, edi
xor esi, esi
add rsp, 0x48
pop rbp
ret
xor eax, eax
xor ebx, ebx
mov rcx, rbx
lea rdi, [0x00674188]
lea rsi, [0x00673cf8]
add rsp, 0x48
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.0045ece0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.00502680

Function at 0x504a40
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x504b0c
push rbp
mov rbp, rsp
sub rsp, 0x38
movabs rdx, 0x7499648c93928587
mov qword [rsp + 0x29], rdx
movabs rdx, 0x76c461f078206f74
mov qword [rsp + 0x30], rdx
movabs rdx, 0xa06020d0b0e0104
mov qword [rsp + 0x19], rdx
movabs rdx, 0x2030b0600010e06
mov qword [rsp + 0x21], rdx
xor eax, eax
jmp 0x504aaf
movzx r9d, byte [rsp + rsi + 0x29]
sub r9d, edx
lea edx, [r9 - 0x1b]
mov byte [rsp + rdi + 0x29], dl
lea edx, [r8 - 0x1b]
mov byte [rsp + rsi + 0x29], dl
add rax, 2
cmp rax, 0x10
jge 0x504adc
movzx edx, byte [rsp + rax + 0x19]
movzx esi, byte [rsp + rax + 0x1a]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0xf
jae 0x504aff
movzx r8d, byte [rsp + rdi + 0x29]
sub r8d, edx
cmp rsi, 0xf
jb 0x504a92
jmp 0x504af3
xor eax, eax
lea rbx, [rsp + 0x29]
mov ecx, 0xf
call fcn.0045b720
add rsp, 0x38
pop rbp
ret
mov eax, esi
mov ecx, 0xf
call fcn.00460fc0
mov eax, edi
mov ecx, 0xf
call fcn.00460fc0
nop
call fcn.0045ece0
jmp fcn.00504a40
Function at 0x5050e0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x5051bd
push rbp
mov rbp, rsp
sub rsp, 0x38
movabs rdx, 0x1a64c1acd8728320
mov qword [rsp + 0x2a], rdx
movabs rdx, 0xd1d02d20658d1a64
mov qword [rsp + 0x30], rdx
movabs rdx, 0xc0d080707010d05
mov qword [rsp + 0x18], rdx
movabs rdx, 0xd030c0d08070701
mov qword [rsp + 0x1a], rdx
movabs rdx, 0x508050b040b070b
mov qword [rsp + 0x22], rdx
xor eax, eax
nop
jmp 0x505160
movzx r9d, byte [rsp + rsi + 0x2a]
sub r9d, edx
lea edx, [r9 + 0x5e]
mov byte [rsp + rdi + 0x2a], dl
lea edx, [r8 + 0x5e]
mov byte [rsp + rsi + 0x2a], dl
add rax, 2
nop
cmp rax, 0x12
jge 0x50518d
movzx edx, byte [rsp + rax + 0x18]
movzx esi, byte [rsp + rax + 0x19]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0xe
jae 0x5051b0
movzx r8d, byte [rsp + rdi + 0x2a]
sub r8d, edx
cmp rsi, 0xe
jb 0x505142
jmp 0x5051a4
xor eax, eax
lea rbx, [rsp + 0x2a]
mov ecx, 0xe
call fcn.0045b720
add rsp, 0x38
pop rbp
ret
mov eax, esi
mov ecx, 0xe
call fcn.00460fc0
mov eax, edi
mov ecx, 0xe
call fcn.00460fc0
nop
nop dword [rax]
call fcn.0045ece0
jmp fcn.005050e0

Function at 0x5061a0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x5062a8
push rbp
mov rbp, rsp
sub rsp, 0x50
movabs rdx, 0x7499f8b49dae9290
mov qword [rsp + 0x37], rdx
movabs rdx, 0x76987965a32091db
mov qword [rsp + 0x3f], rdx
movabs rdx, 0xad76987965a32091
mov qword [rsp + 0x40], rdx
movabs rdx, 0x65a3793720fdaba9
mov qword [rsp + 0x48], rdx
movabs rdx, 0x1110306040113
mov qword [rsp + 0x1d], rdx
movabs rdx, 0x217100b00150406
mov qword [rsp + 0x25], rdx
movabs rdx, 0x9080217100b0015
mov qword [rsp + 0x27], rdx
movabs rdx, 0x1209090005120e06
mov qword [rsp + 0x2f], rdx
xor eax, eax
jmp 0x50624b
movzx r9d, byte [rsp + rsi + 0x37]
sub r9d, edx
lea edx, [r9 - 0x1b]
mov byte [rsp + rdi + 0x37], dl
lea edx, [r8 - 0x1b]
mov byte [rsp + rsi + 0x37], dl
add rax, 2
cmp rax, 0x1a
jge 0x506278
movzx edx, byte [rsp + rax + 0x1d]
movzx esi, byte [rsp + rax + 0x1e]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x19
jae 0x50629b
movzx r8d, byte [rsp + rdi + 0x37]
sub r8d, edx
cmp rsi, 0x19
jb 0x50622e
jmp 0x50628f
xor eax, eax
lea rbx, [rsp + 0x37]
mov ecx, 0x19
call fcn.0045b720
add rsp, 0x50
pop rbp
ret
mov eax, esi
mov ecx, 0x19
call fcn.00460fc0
mov eax, edi
mov ecx, 0x19
call fcn.00460fc0
nop
call fcn.0045ece0
jmp fcn.005061a0
Function at 0x5063a0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x50647d
push rbp
mov rbp, rsp
sub rsp, 0x40
movabs rdx, 0x91b439a160b1f52
mov qword [rsp + 0x31], rdx
movabs rdx, 0x571f951a65f6aa09
mov qword [rsp + 0x38], rdx
movabs rdx, 0x401060702020705
mov qword [rsp + 0x1d], rdx
movabs rdx, 0xc09080c04010607
mov qword [rsp + 0x21], rdx
movabs rdx, 0xd0b0b080306010d
mov qword [rsp + 0x29], rdx
xor eax, eax
nop
jmp 0x506420
movzx r9d, byte [rsp + rsi + 0x31]
sub r9d, edx
lea edx, [r9 + 0x5e]
mov byte [rsp + rdi + 0x31], dl
lea edx, [r8 + 0x5e]
mov byte [rsp + rsi + 0x31], dl
add rax, 2
nop
cmp rax, 0x14
jge 0x50644d
movzx edx, byte [rsp + rax + 0x1d]
movzx esi, byte [rsp + rax + 0x1e]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0xf
jae 0x506470
movzx r8d, byte [rsp + rdi + 0x31]
sub r8d, edx
cmp rsi, 0xf
jb 0x506402
jmp 0x506464
xor eax, eax
lea rbx, [rsp + 0x31]
mov ecx, 0xf
call fcn.0045b720
add rsp, 0x40
pop rbp
ret
mov eax, esi
mov ecx, 0xf
call fcn.00460fc0
mov eax, edi
mov ecx, 0xf
call fcn.00460fc0
nop
nop dword [rax]
call fcn.0045ece0
jmp fcn.005063a0

Function at 0x507220
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x50730c
push rbp
mov rbp, rsp
sub rsp, 0x40
movabs rdx, 0x7b078f6f4c67f0e0
mov qword [rsp + 0x2f], rdx
movabs rdx, 0xb7b078f6f4c67f0
mov qword [rsp + 0x30], rdx
movabs rdx, 0xfa67d569f9f5dfd9
mov qword [rsp + 0x38], rdx
movabs rdx, 0x10090705060c0b10
mov qword [rsp + 0x1d], rdx
movabs rdx, 0x80910090705060c
mov qword [rsp + 0x1f], rdx
movabs rdx, 0xe010e090507000a
mov qword [rsp + 0x27], rdx
xor eax, eax
jmp 0x5072aa
movzx r9d, byte [rsp + rsi + 0x2f]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x5f]
mov byte [rsp + rdi + 0x2f], dl
mov byte [rsp + rsi + 0x2f], r8b
add rax, 2
cmp rax, 0x12
jge 0x5072dc
movzx edx, byte [rsp + rax + 0x1d]
movzx esi, byte [rsp + rax + 0x1e]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x11
jae 0x5072ff
movzx r8d, byte [rsp + rdi + 0x2f]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x5f]
cmp rsi, 0x11
jb 0x507290
jmp 0x5072f3
xor eax, eax
lea rbx, [rsp + 0x2f]
mov ecx, 0x11
call fcn.0045b720
add rsp, 0x40
pop rbp
ret
mov eax, esi
mov ecx, 0x11
call fcn.00460fc0
mov eax, edi
mov ecx, 0x11
call fcn.00460fc0
nop
call fcn.0045ece0
jmp fcn.00507220
Function at 0x509880
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x50997d
push rbp
mov rbp, rsp
sub rsp, 0x48
movabs rdx, 0xff5320806fa275f8
mov qword [rsp + 0x35], rdx
movabs rdx, 0x57da79ff5320806f
mov qword [rsp + 0x38], rdx
movabs rdx, 0x6286695a04640161
mov qword [rsp + 0x40], rdx
movabs rdx, 0xe0212030e110f0a
mov qword [rsp + 0x1b], rdx
movabs rdx, 0x80f0f0d12110203
mov qword [rsp + 0x23], rdx
movabs rdx, 0xf09080f0f0d1211
mov qword [rsp + 0x25], rdx
movabs rdx, 0xa040012030c07
mov qword [rsp + 0x2d], rdx
xor eax, eax
jmp 0x509920
movzx r9d, byte [rsp + rsi + 0x35]
sub r9d, edx
lea edx, [r9 - 0x70]
mov byte [rsp + rdi + 0x35], dl
lea edx, [r8 - 0x70]
mov byte [rsp + rsi + 0x35], dl
add rax, 2
nop dword [rax]
cmp rax, 0x1a
jge 0x50994d
movzx edx, byte [rsp + rax + 0x1b]
movzx esi, byte [rsp + rax + 0x1c]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x13
jae 0x509970
movzx r8d, byte [rsp + rdi + 0x35]
sub r8d, edx
cmp rsi, 0x13
jb 0x5098ff
jmp 0x509964
xor eax, eax
lea rbx, [rsp + 0x35]
mov ecx, 0x13
call fcn.0045b720
add rsp, 0x48
pop rbp
ret
mov eax, esi
mov ecx, 0x13
call fcn.00460fc0
mov eax, edi
mov ecx, 0x13
call fcn.00460fc0
nop
nop dword [rax]
call fcn.0045ece0
jmp fcn.00509880

Function at 0x5099a0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x509a9b
push rbp
mov rbp, rsp
sub rsp, 0x50
movabs rdx, 0xadb728e794ac647
mov qword [rsp + 0x39], rdx
movabs rdx, 0x646e4f74a99a9a0a
mov qword [rsp + 0x40], rdx
movabs rdx, 0x658f699790f172fe
mov qword [rsp + 0x48], rdx
movabs rdx, 0x70f020203090401
mov qword [rsp + 0x1d], rdx
movabs rdx, 0x2021107150a0800
mov qword [rsp + 0x25], rdx
movabs rdx, 0xf06060802021107
mov qword [rsp + 0x29], rdx
movabs rdx, 0x707120c13021308
mov qword [rsp + 0x31], rdx
xor eax, eax
jmp 0x509a39
movzx r9d, byte [rsp + rsi + 0x39]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x65]
mov byte [rsp + rdi + 0x39], dl
mov byte [rsp + rsi + 0x39], r8b
add rax, 2
cmp rax, 0x1c
jge 0x509a6b
movzx edx, byte [rsp + rax + 0x1d]
movzx esi, byte [rsp + rax + 0x1e]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x17
jae 0x509a8e
movzx r8d, byte [rsp + rdi + 0x39]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x65]
cmp rsi, 0x17
jb 0x509a1f
jmp 0x509a82
xor eax, eax
lea rbx, [rsp + 0x39]
mov ecx, 0x17
call fcn.0045b720
add rsp, 0x50
pop rbp
ret
mov eax, esi
mov ecx, 0x17
call fcn.00460fc0
mov eax, edi
mov ecx, 0x17
call fcn.00460fc0
nop
nop dword [rax + rax]
call fcn.0045ece0
jmp fcn.005099a0
Function at 0x50a820
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x50a92c
push rbp
mov rbp, rsp
sub rsp, 0x58
movabs rdx, 0x14693e6e61197254
mov qword [rsp + 0x41], rdx
movabs rdx, 0x796e595c6c5a2614
mov qword [rsp + 0x48], rdx
movabs rdx, 0x3468486d5d7a7263
mov qword [rsp + 0x50], rdx
movabs rdx, 0xb0505110f161501
mov qword [rsp + 0x1f], rdx
movabs rdx, 0xc0a0b0505110f16
mov qword [rsp + 0x21], rdx
movabs rdx, 0x1207131412050e02
mov qword [rsp + 0x29], rdx
movabs rdx, 0x5080201110a0202
mov qword [rsp + 0x31], rdx
movabs rdx, 0x13070507090e130f
mov qword [rsp + 0x39], rdx
xor eax, eax
jmp 0x50a8c8
movzx r9d, byte [rsp + rsi + 0x41]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x19]
mov byte [rsp + rdi + 0x41], dl
mov byte [rsp + rsi + 0x41], r8b
add rax, 2
cmp rax, 0x22
jge 0x50a8fc
movzx edx, byte [rsp + rax + 0x1f]
movzx esi, byte [rsp + rax + 0x20]
mov edi, edx
xor edx, esi
add edx, eax
nop
cmp rdi, 0x17
jae 0x50a91f
movzx r8d, byte [rsp + rdi + 0x41]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x19]
cmp rsi, 0x17
jb 0x50a8ae
jmp 0x50a913
xor eax, eax
lea rbx, [rsp + 0x41]
mov ecx, 0x17
call fcn.0045b720
add rsp, 0x58
pop rbp
ret
mov eax, esi
mov ecx, 0x17
call fcn.00460fc0
mov eax, edi
mov ecx, 0x17
call fcn.00460fc0
nop
call fcn.0045ece0
jmp fcn.0050a820

Function at 0x50c4c0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x50c5dd
push rbp
mov rbp, rsp
sub rsp, 0x58
movabs rdx, 0x34411b50184a753b
mov qword [rsp + 0x3a], rdx
movabs rdx, 0xf15763692e432064
mov qword [rsp + 0x42], rdx
movabs rdx, 0x643a74543868f157
mov qword [rsp + 0x48], rdx
movabs rdx, 0x65e33c2e20364047
mov qword [rsp + 0x50], rdx
movabs rdx, 0x18171c041c030f05
mov qword [rsp + 0x18], rdx
movabs rdx, 0xb18171c041c03
mov qword [rsp + 0x1a], rdx
movabs rdx, 0x16140402030f0712
mov qword [rsp + 0x22], rdx
movabs rdx, 0x1b110f100e101a11
mov qword [rsp + 0x2a], rdx
movabs rdx, 0x41b0f13171b1217
mov qword [rsp + 0x32], rdx
xor eax, eax
jmp 0x50c580
movzx r9d, byte [rsp + rsi + 0x3a]
sub r9d, edx
lea edx, [r9 + 0x39]
mov byte [rsp + rdi + 0x3a], dl
lea edx, [r8 + 0x39]
mov byte [rsp + rsi + 0x3a], dl
add rax, 2
nop word [rax + rax]
cmp rax, 0x22
jge 0x50c5ad
movzx edx, byte [rsp + rax + 0x18]
movzx esi, byte [rsp + rax + 0x19]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x1e
jae 0x50c5d0
movzx r8d, byte [rsp + rdi + 0x3a]
sub r8d, edx
cmp rsi, 0x1e
jb 0x50c55d
jmp 0x50c5c4
xor eax, eax
lea rbx, [rsp + 0x3a]
mov ecx, 0x1e
call fcn.0045b720
add rsp, 0x58
pop rbp
ret
mov eax, esi
mov ecx, 0x1e
call fcn.00460fc0
mov eax, edi
mov ecx, 0x1e
call fcn.00460fc0
nop
nop dword [rax]
call fcn.0045ece0
jmp fcn.0050c4c0
Function at 0x50c940
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x50ca3d
push rbp
mov rbp, rsp
sub rsp, 0x48
movabs rdx, 0x6312435a60283343
mov qword [rsp + 0x32], rdx
movabs rdx, 0x766e544153206312
mov qword [rsp + 0x38], rdx
movabs rdx, 0x696d695451576c51
mov qword [rsp + 0x40], rdx
movabs rdx, 0xf15110605010e12
mov qword [rsp + 0x18], rdx
movabs rdx, 0x20003100d120b0a
mov qword [rsp + 0x20], rdx
movabs rdx, 0xd04020003100d12
mov qword [rsp + 0x22], rdx
movabs rdx, 0x206150105120d10
mov qword [rsp + 0x2a], rdx
xor eax, eax
jmp 0x50c9e0
movzx r9d, byte [rsp + rsi + 0x32]
sub r9d, edx
lea edx, [r9 + 0x29]
mov byte [rsp + rdi + 0x32], dl
lea edx, [r8 + 0x29]
mov byte [rsp + rsi + 0x32], dl
add rax, 2
nop dword [rax]
cmp rax, 0x1a
jge 0x50ca0d
movzx edx, byte [rsp + rax + 0x18]
movzx esi, byte [rsp + rax + 0x19]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x16
jae 0x50ca30
movzx r8d, byte [rsp + rdi + 0x32]
sub r8d, edx
cmp rsi, 0x16
jb 0x50c9bf
jmp 0x50ca24
xor eax, eax
lea rbx, [rsp + 0x32]
mov ecx, 0x16
call fcn.0045b720
add rsp, 0x48
pop rbp
ret
mov eax, esi
mov ecx, 0x16
call fcn.00460fc0
mov eax, edi
mov ecx, 0x16
call fcn.00460fc0
nop
nop dword [rax]
call fcn.0045ece0
jmp fcn.0050c940

Function at 0x50daa0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x50db9d
push rbp
mov rbp, rsp
sub rsp, 0x50
movabs rdx, 0x654d585c5f62515c
mov qword [rsp + 0x38], rdx
movabs rdx, 0x156e31537d206e72
mov qword [rsp + 0x40], rdx
movabs rdx, 0x5f587e5f20546656
mov qword [rsp + 0x48], rdx
movabs rdx, 0x20f06040d010510
mov qword [rsp + 0x1c], rdx
movabs rdx, 0x121203150c0f0f00
mov qword [rsp + 0x24], rdx
movabs rdx, 0x1517161112120315
mov qword [rsp + 0x28], rdx
movabs rdx, 0xb05051400141103
mov qword [rsp + 0x30], rdx
xor eax, eax
jmp 0x50db40
movzx r9d, byte [rsp + rsi + 0x38]
sub r9d, edx
lea edx, [r9 + 0x1e]
mov byte [rsp + rdi + 0x38], dl
lea edx, [r8 + 0x1e]
mov byte [rsp + rsi + 0x38], dl
add rax, 2
nop dword [rax]
cmp rax, 0x1c
jge 0x50db6d
movzx edx, byte [rsp + rax + 0x1c]
movzx esi, byte [rsp + rax + 0x1d]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x18
jae 0x50db90
movzx r8d, byte [rsp + rdi + 0x38]
sub r8d, edx
cmp rsi, 0x18
jb 0x50db1f
jmp 0x50db84
xor eax, eax
lea rbx, [rsp + 0x38]
mov ecx, 0x18
call fcn.0045b720
add rsp, 0x50
pop rbp
ret
mov eax, esi
mov ecx, 0x18
call fcn.00460fc0
mov eax, edi
mov ecx, 0x18
call fcn.00460fc0
nop
nop dword [rax]
call fcn.0045ece0
jmp fcn.0050daa0
Function at 0x511a40
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x511b3d
push rbp
mov rbp, rsp
sub rsp, 0x50
movabs rdx, 0x7d637367816e2e67
mov qword [rsp + 0x38], rdx
movabs rdx, 0x6b21495c53744153
mov qword [rsp + 0x40], rdx
movabs rdx, 0x656c5c542564726f
mov qword [rsp + 0x48], rdx
movabs rdx, 0x21605040d0a13
mov qword [rsp + 0x1c], rdx
movabs rdx, 0xd0c070e15100f00
mov qword [rsp + 0x24], rdx
movabs rdx, 0x40001130d0c070e
mov qword [rsp + 0x28], rdx
movabs rdx, 0x30e1516020f0f0c
mov qword [rsp + 0x30], rdx
xor eax, eax
jmp 0x511ae0
movzx r9d, byte [rsp + rsi + 0x38]
sub r9d, edx
lea edx, [r9 + 0x14]
mov byte [rsp + rdi + 0x38], dl
lea edx, [r8 + 0x14]
mov byte [rsp + rsi + 0x38], dl
add rax, 2
nop dword [rax]
cmp rax, 0x1c
jge 0x511b0d
movzx edx, byte [rsp + rax + 0x1c]
movzx esi, byte [rsp + rax + 0x1d]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x18
jae 0x511b30
movzx r8d, byte [rsp + rdi + 0x38]
sub r8d, edx
cmp rsi, 0x18
jb 0x511abf
jmp 0x511b24
xor eax, eax
lea rbx, [rsp + 0x38]
mov ecx, 0x18
call fcn.0045b720
add rsp, 0x50
pop rbp
ret
mov eax, esi
mov ecx, 0x18
call fcn.00460fc0
mov eax, edi
mov ecx, 0x18
call fcn.00460fc0
nop
nop dword [rax]
call fcn.0045ece0
jmp fcn.00511a40

Function at 0x514ba0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x514c8a
push rbp
mov rbp, rsp
sub rsp, 0x48
movabs rdx, 0x84d27c6133859986
mov qword [rsp + 0x35], rdx
movabs rdx, 0x6d6e8584d27c6133
mov qword [rsp + 0x38], rdx
movabs rdx, 0x7495ecae2064a296
mov qword [rsp + 0x40], rdx
movabs rdx, 0x7110a0a100f0107
mov qword [rsp + 0x1d], rdx
movabs rdx, 0xc060c0812000503
mov qword [rsp + 0x25], rdx
movabs rdx, 0xb0210080c08100f
mov qword [rsp + 0x2d], rdx
xor eax, eax
jmp 0x514c2d
movzx r9d, byte [rsp + rsi + 0x35]
sub r9d, edx
lea edx, [r9 - 5]
mov byte [rsp + rdi + 0x35], dl
lea edx, [r8 - 5]
mov byte [rsp + rsi + 0x35], dl
add rax, 2
cmp rax, 0x18
jge 0x514c5a
movzx edx, byte [rsp + rax + 0x1d]
movzx esi, byte [rsp + rax + 0x1e]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x13
jae 0x514c7d
movzx r8d, byte [rsp + rdi + 0x35]
sub r8d, edx
cmp rsi, 0x13
jb 0x514c10
jmp 0x514c71
xor eax, eax
lea rbx, [rsp + 0x35]
mov ecx, 0x13
call fcn.0045b720
add rsp, 0x48
pop rbp
ret
mov eax, esi
mov ecx, 0x13
call fcn.00460fc0
mov eax, edi
mov ecx, 0x13
call fcn.00460fc0
nop
call fcn.0045ece0
jmp fcn.00514ba0