joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4f8960
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4f8a68
sub rsp, 0x58
mov qword [rsp + 0x50], rbp
lea rbp, [rsp + 0x50]
movabs rdx, 0x4fe2869a009e04d
mov qword [rsp + 0x1b], rdx
movabs rdx, 0x646eeb7403a53404
mov qword [rsp + 0x22], rdx
movabs rdx, 0x656d4fb82e4621a9
mov qword [rsp + 0x2a], rdx
movabs rdx, 0x708060c09130313
mov qword [rsp + 0x32], rdx
movabs rdx, 0x100c0f020a100f0f
mov qword [rsp + 0x3a], rdx
movabs rdx, 0x131205061201100c
mov qword [rsp + 0x40], rdx
movabs rdx, 0x20f110f03111408
mov qword [rsp + 0x48], rdx
xor eax, eax
jmp 0x4f8a02
movzx r9d, byte [rsp + rsi + 0x1b]
sub r9d, edx
lea edx, [r9 + 0x56]
mov byte [rsp + rdi + 0x1b], dl
lea edx, [r8 + 0x56]
mov byte [rsp + rsi + 0x1b], dl
add rax, 2
cmp rax, 0x1e
jge 0x4f8a2f
movzx edx, byte [rsp + rax + 0x32]
movzx esi, byte [rsp + rax + 0x33]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x17
jae 0x4f8a5b
movzx r8d, byte [rsp + rdi + 0x1b]
sub r8d, edx
cmp rsi, 0x17
jb 0x4f89e5
jmp 0x4f8a4f
xor eax, eax
lea rbx, [rsp + 0x1b]
mov ecx, 0x17
nop dword [rax + rax]
call fcn.0044a0a0
mov rbp, qword [rsp + 0x50]
add rsp, 0x58
ret
mov eax, esi
mov ecx, 0x17
call fcn.0045f380
mov eax, edi
mov ecx, 0x17
call fcn.0045f380
nop
call fcn.0045cd20
jmp fcn.004f8960

Function at 0x4f9020
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4f9146
sub rsp, 0x60
mov qword [rsp + 0x58], rbp
lea rbp, [rsp + 0x58]
movabs rdx, 0xa5006904a375ff09
mov qword [rsp + 0x1a], rdx
movabs rdx, 0x1d14b206546f369
mov qword [rsp + 0x22], rdx
movabs rdx, 0x64b901d14b206546
mov qword [rsp + 0x24], rdx
movabs rdx, 0x576dfc542020a961
mov qword [rsp + 0x2c], rdx
movabs rdx, 0x190f13000309070a
mov qword [rsp + 0x34], rdx
movabs rdx, 0x6011704190f1300
mov qword [rsp + 0x38], rdx
movabs rdx, 0x10110d070e0f100d
mov qword [rsp + 0x40], rdx
movabs rdx, 0xe0f0f0f140a0d10
mov qword [rsp + 0x48], rdx
movabs rdx, 0xf000d110f0f0e09
mov qword [rsp + 0x50], rdx
xor eax, eax
jmp 0x4f90e0
movzx r9d, byte [rsp + rsi + 0x1a]
sub r9d, edx
lea edx, [r9 - 0x80]
mov byte [rsp + rdi + 0x1a], dl
lea edx, [r8 - 0x80]
mov byte [rsp + rsi + 0x1a], dl
add rax, 2
cmp rax, 0x24
jge 0x4f910d
movzx edx, byte [rsp + rax + 0x34]
movzx esi, byte [rsp + rax + 0x35]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x1a
jae 0x4f9134
movzx r8d, byte [rsp + rdi + 0x1a]
sub r8d, edx
cmp rsi, 0x1a
jb 0x4f90c3
jmp 0x4f9128
xor eax, eax
lea rbx, [rsp + 0x1a]
mov ecx, 0x1a
call fcn.0044a0a0
mov rbp, qword [rsp + 0x58]
add rsp, 0x60
ret
mov eax, esi
mov ecx, 0x1a
call fcn.0045f380
mov eax, edi
mov ecx, 0x1a
nop dword [rax + rax]
call fcn.0045f380
nop
call fcn.0045cd20
jmp fcn.004f9020
Function at 0x4f98c0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4f99e6
sub rsp, 0x60
mov qword [rsp + 0x58], rbp
lea rbp, [rsp + 0x58]
movabs rdx, 0x24d820728f3c6543
mov qword [rsp + 0x19], rdx
movabs rdx, 0x202df622182d6114
mov qword [rsp + 0x21], rdx
movabs rdx, 0xc98e617435202df6
mov qword [rsp + 0x26], rdx
movabs rdx, 0x276d0f11202e9615
mov qword [rsp + 0x2e], rdx
movabs rdx, 0x1516150815130c03
mov qword [rsp + 0x36], rdx
movabs rdx, 0x814151615081513
mov qword [rsp + 0x38], rdx
movabs rdx, 0x150d1c081c16050b
mov qword [rsp + 0x40], rdx
movabs rdx, 0x60719100c100e15
mov qword [rsp + 0x48], rdx
movabs rdx, 0x17080d0a1a08021c
mov qword [rsp + 0x50], rdx
xor eax, eax
jmp 0x4f9980
movzx r9d, byte [rsp + rsi + 0x19]
sub r9d, edx
lea edx, [r9 + 0x61]
mov byte [rsp + rdi + 0x19], dl
lea edx, [r8 + 0x61]
mov byte [rsp + rsi + 0x19], dl
add rax, 2
cmp rax, 0x22
jge 0x4f99ad
movzx edx, byte [rsp + rax + 0x36]
movzx esi, byte [rsp + rax + 0x37]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x1d
jae 0x4f99d4
movzx r8d, byte [rsp + rdi + 0x19]
sub r8d, edx
cmp rsi, 0x1d
jb 0x4f9963
jmp 0x4f99c8
xor eax, eax
lea rbx, [rsp + 0x19]
mov ecx, 0x1d
call fcn.0044a0a0
mov rbp, qword [rsp + 0x58]
add rsp, 0x60
ret
mov eax, esi
mov ecx, 0x1d
call fcn.0045f380
mov eax, edi
mov ecx, 0x1d
nop dword [rax + rax]
call fcn.0045f380
nop
call fcn.0045cd20
jmp fcn.004f98c0

Function at 0x4f9a00
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4f9b08
sub rsp, 0x58
mov qword [rsp + 0x50], rbp
lea rbp, [rsp + 0x50]
movabs rdx, 0x2014e0bc0c77b225
mov qword [rsp + 0x1c], rdx
movabs rdx, 0x9c6e31748eaf2014
mov qword [rsp + 0x22], rdx
movabs rdx, 0x46dcf541b9620d3
mov qword [rsp + 0x2a], rdx
movabs rdx, 0x915111111010d11
mov qword [rsp + 0x32], rdx
movabs rdx, 0x810000310101307
mov qword [rsp + 0x3a], rdx
movabs rdx, 0x50115110f0b0810
mov qword [rsp + 0x40], rdx
movabs rdx, 0x61006040e060107
mov qword [rsp + 0x48], rdx
xor eax, eax
jmp 0x4f9aa0
movzx r9d, byte [rsp + rsi + 0x1c]
add r9d, 0x2d
add edx, r9d
mov byte [rsp + rdi + 0x1c], dl
mov byte [rsp + rsi + 0x1c], r8b
add rax, 2
nop
cmp rax, 0x1e
jge 0x4f9ad1
movzx edx, byte [rsp + rax + 0x32]
movzx esi, byte [rsp + rax + 0x33]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x16
jae 0x4f9afb
movzx r8d, byte [rsp + rdi + 0x1c]
add r8d, 0x2d
add r8d, edx
cmp rsi, 0x16
jb 0x4f9a85
jmp 0x4f9aef
xor eax, eax
lea rbx, [rsp + 0x1c]
mov ecx, 0x16
nop dword [rax]
call fcn.0044a0a0
mov rbp, qword [rsp + 0x50]
add rsp, 0x58
ret
mov eax, esi
mov ecx, 0x16
call fcn.0045f380
mov eax, edi
mov ecx, 0x16
call fcn.0045f380
nop
call fcn.0045cd20
jmp fcn.004f9a00
Function at 0x4fa0a0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4fa196
sub rsp, 0x50
mov qword [rsp + 0x48], rbp
lea rbp, [rsp + 0x48]
movabs rdx, 0x2073c29895726fb8
mov qword [rsp + 0x1d], rdx
movabs rdx, 0x64a493738b2073c2
mov qword [rsp + 0x22], rdx
movabs rdx, 0x65b8a954b9649ad0
mov qword [rsp + 0x2a], rdx
movabs rdx, 0x30e130406080010
mov qword [rsp + 0x32], rdx
movabs rdx, 0x9100d0a05030e
mov qword [rsp + 0x38], rdx
movabs rdx, 0x1010120b1003040a
mov qword [rsp + 0x40], rdx
xor eax, eax
jmp 0x4fa133
movzx r9d, byte [rsp + rsi + 0x1d]
sub r9d, edx
lea edx, [r9 - 0x10]
mov byte [rsp + rdi + 0x1d], dl
lea edx, [r8 - 0x10]
mov byte [rsp + rsi + 0x1d], dl
add rax, 2
cmp rax, 0x16
jge 0x4fa162
movzx edx, byte [rsp + rax + 0x32]
movzx esi, byte [rsp + rax + 0x33]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x15
jae 0x4fa189
movzx r8d, byte [rsp + rdi + 0x1d]
sub r8d, edx
cmp rsi, 0x15
jb 0x4fa116
nop
jmp 0x4fa17d
xor eax, eax
lea rbx, [rsp + 0x1d]
mov ecx, 0x15
call fcn.0044a0a0
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
mov eax, esi
mov ecx, 0x15
call fcn.0045f380
mov eax, edi
mov ecx, 0x15
call fcn.0045f380
nop
call fcn.0045cd20
nop dword [rax + rax]
jmp fcn.004fa0a0
Function at 0x503040
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x503128
sub rsp, 0x48
mov qword [rsp + 0x40], rbp
lea rbp, [rsp + 0x40]
movabs rdx, 0xea720515433b0408
mov qword [rsp + 0x1e], rdx
movabs rdx, 0x2f2f323405547438
mov qword [rsp + 0x26], rdx
movabs rdx, 0x405050b0f010f
mov qword [rsp + 0x2e], rdx
movabs rdx, 0xf0d000405050b0f
mov qword [rsp + 0x30], rdx
movabs rdx, 0xe05080c04020507
mov qword [rsp + 0x38], rdx
xor eax, eax
jmp 0x5030c1
movzx r9d, byte [rsp + rsi + 0x1e]
add r9d, 0x28
add edx, r9d
mov byte [rsp + rdi + 0x1e], dl
mov byte [rsp + rsi + 0x1e], r8b
add rax, 2
cmp rax, 0x12
jge 0x5030f2
movzx edx, byte [rsp + rax + 0x2e]
movzx esi, byte [rsp + rax + 0x2f]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x10
jae 0x50311b
movzx r8d, byte [rsp + rdi + 0x1e]
add r8d, 0x28
add r8d, edx
cmp rsi, 0x10
jb 0x5030a7
jmp 0x50310f
xor eax, eax
lea rbx, [rsp + 0x1e]
mov ecx, 0x10
nop
call fcn.0044a0a0
mov rbp, qword [rsp + 0x40]
add rsp, 0x48
ret
mov eax, esi
mov ecx, 0x10
call fcn.0045f380
mov eax, edi
mov ecx, 0x10
call fcn.0045f380
nop
call fcn.0045cd20
jmp fcn.00503040
Function at 0x5040c0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x5041a8
sub rsp, 0x40
mov qword [rsp + 0x38], rbp
lea rbp, [rsp + 0x38]
movabs rdx, 0xe59db2a974052cfe
mov qword [rsp + 0x1a], rdx
mov dword [rsp + 0x22], 0xc3b7c402
movabs rdx, 0xb080201090a
mov qword [rsp + 0x26], rdx
movabs rdx, 0x70600000b080201
mov qword [rsp + 0x28], rdx
movabs rdx, 0x104050b06000b02
mov qword [rsp + 0x30], rdx
xor eax, eax
nop
jmp 0x504140
movzx r9d, byte [rsp + rsi + 0x1a]
add r9d, 0xffffffab
add edx, r9d
mov byte [rsp + rdi + 0x1a], dl
mov byte [rsp + rsi + 0x1a], r8b
add rax, 2
nop dword [rax]
cmp rax, 0x12
jge 0x504171
movzx edx, byte [rsp + rax + 0x26]
movzx esi, byte [rsp + rax + 0x27]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0xc
jae 0x50419b
movzx r8d, byte [rsp + rdi + 0x1a]
add r8d, 0xffffffab
add r8d, edx
cmp rsi, 0xc
jb 0x504122
jmp 0x50418f
xor eax, eax
lea rbx, [rsp + 0x1a]
mov ecx, 0xc
nop dword [rax]
call fcn.0044a0a0
mov rbp, qword [rsp + 0x38]
add rsp, 0x40
ret
mov eax, esi
mov ecx, 0xc
call fcn.0045f380
mov eax, edi
mov ecx, 0xc
call fcn.0045f380
nop
call fcn.0045cd20
jmp fcn.005040c0

Function at 0x50c100
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x50c1c6
sub rsp, 0x38
mov qword [rsp + 0x30], rbp
lea rbp, [rsp + 0x30]
movabs rdx, 0xf803f3ed78f96e9b
mov qword [rsp + 0x1e], rdx
movabs rdx, 0x604000600000705
mov qword [rsp + 0x26], rdx
mov word [rsp + 0x2e], 0x204
xor eax, eax
nop
jmp 0x50c160
movzx r9d, byte [rsp + rsi + 0x1e]
sub r9d, edx
lea edx, [r9 + 0x7c]
mov byte [rsp + rdi + 0x1e], dl
lea edx, [r8 + 0x7c]
mov byte [rsp + rsi + 0x1e], dl
add rax, 2
nop
cmp rax, 0xa
jge 0x50c18d
movzx edx, byte [rsp + rax + 0x26]
movzx esi, byte [rsp + rax + 0x27]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 8
jae 0x50c1b4
movzx r8d, byte [rsp + rdi + 0x1e]
sub r8d, edx
cmp rsi, 8
jb 0x50c142
jmp 0x50c1a8
xor eax, eax
lea rbx, [rsp + 0x1e]
mov ecx, 8
call fcn.0044a0a0
mov rbp, qword [rsp + 0x30]
add rsp, 0x38
ret
mov eax, esi
mov ecx, 8
call fcn.0045f380
mov eax, edi
mov ecx, 8
nop dword [rax + rax]
call fcn.0045f380
nop
call fcn.0045cd20
jmp fcn.0050c100
Function at 0x50e200
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x50e2d2
sub rsp, 0x38
mov qword [rsp + 0x30], rbp
lea rbp, [rsp + 0x30]
movabs rdx, 0x9ca66974a08b2fea
mov qword [rsp + 0x19], rdx
movabs rdx, 0x9fa4129ca66974a0
mov qword [rsp + 0x1c], rdx
movabs rdx, 0xa06090200020208
mov qword [rsp + 0x24], rdx
mov dword [rsp + 0x2c], 0x70308
xor eax, eax
jmp 0x50e26b
movzx r9d, byte [rsp + rsi + 0x19]
add r9d, 0xffffffbc
add edx, r9d
mov byte [rsp + rdi + 0x19], dl
mov byte [rsp + rsi + 0x19], r8b
add rax, 2
cmp rax, 0xc
jge 0x50e29c
movzx edx, byte [rsp + rax + 0x24]
movzx esi, byte [rsp + rax + 0x25]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0xb
jae 0x50e2c5
movzx r8d, byte [rsp + rdi + 0x19]
add r8d, 0xffffffbc
add r8d, edx
cmp rsi, 0xb
jb 0x50e251
jmp 0x50e2b7
xor eax, eax
lea rbx, [rsp + 0x19]
mov ecx, 0xb
call fcn.0044a0a0
mov rbp, qword [rsp + 0x30]
add rsp, 0x38
ret
mov eax, esi
mov ecx, 0xb
nop
call fcn.0045f380
mov eax, edi
mov ecx, 0xb
call fcn.0045f380
nop
call fcn.0045cd20
jmp fcn.0050e200

Function at 0x5102a0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x510368
sub rsp, 0x38
mov qword [rsp + 0x30], rbp
lea rbp, [rsp + 0x30]
movabs rdx, 0x5e742ce1e0dbdcdf
mov qword [rsp + 0x1a], rdx
mov word [rsp + 0x22], 0x69a5
movabs rdx, 0x8070407050709
mov qword [rsp + 0x24], rdx
mov dword [rsp + 0x2c], 0x2010309
xor eax, eax
jmp 0x510303
movzx r9d, byte [rsp + rsi + 0x1a]
add r9d, 0x7c
add edx, r9d
mov byte [rsp + rdi + 0x1a], dl
mov byte [rsp + rsi + 0x1a], r8b
add rax, 2
cmp rax, 0xc
jge 0x510334
movzx edx, byte [rsp + rax + 0x24]
movzx esi, byte [rsp + rax + 0x25]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0xa
jae 0x51035b
movzx r8d, byte [rsp + rdi + 0x1a]
add r8d, 0x7c
add r8d, edx
cmp rsi, 0xa
jb 0x5102e9
jmp 0x51034f
xor eax, eax
lea rbx, [rsp + 0x1a]
mov ecx, 0xa
call fcn.0044a0a0
mov rbp, qword [rsp + 0x30]
add rsp, 0x38
ret
mov eax, esi
mov ecx, 0xa
call fcn.0045f380
mov eax, edi
mov ecx, 0xa
call fcn.0045f380
nop
call fcn.0045cd20
jmp fcn.005102a0
Function at 0x516e20
Capabilities:
Encrypt data using rc4 prga

Disassembly:
lea r12, [rsp - 0x10]
cmp r12, qword [r14 + 0x10]
jbe 0x516f36
sub rsp, 0x90
mov qword [rsp + 0x88], rbp
lea rbp, [rsp + 0x88]
movzx edx, byte [rax + 0x4c]
mov byte [rax + 0x4c], cl
nop
movabs rsi, 0x99dc4e82546f69e4
mov qword [rsp + 0x57], rsi
movabs rsi, 0xda99dc4e82546f69
mov qword [rsp + 0x58], rsi
movabs rsi, 0x37e1533015b2b359
mov qword [rsp + 0x60], rsi
movabs rsi, 0xaeea7bb6675d58d4
mov qword [rsp + 0x46], rsi
movabs rsi, 0xe2aeea7bb6675d58
mov qword [rsp + 0x47], rsi
movabs rsi, 0x4f87365476d0d260
mov qword [rsp + 0x4f], rsi
xor ecx, ecx
jmp 0x516ec0
movzx esi, byte [rsp + rcx + 0x57]
movzx edi, byte [rsp + rcx + 0x46]
xor edi, esi
mov byte [rsp + rcx + 0x46], dil
inc rcx
cmp rcx, 0x11
jl 0x516eac
mov qword [rsp + 0x98], rax
mov byte [rsp + 0x37], dl
mov qword [rsp + 0x38], rbx
lea rax, [rsp + 0x68]
lea rbx, [rsp + 0x46]
mov ecx, 0x11
call fcn.0044a0a0
mov rdx, qword [rsp + 0x98]
lea rsi, [rdx + 0x40]
mov ecx, 0x10
xor edi, edi
mov r8, rax
mov r9, rbx
mov rax, rsi
mov rbx, qword [rsp + 0x38]
mov esi, 0x76
call fcn.00514680
movzx edx, byte [rsp + 0x37]
mov rsi, qword [rsp + 0x98]
mov byte [rsi + 0x4c], dl
mov rbp, qword [rsp + 0x88]
add rsp, 0x90
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov byte [rsp + 0x18], cl
call fcn.0045cd20
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
movzx ecx, byte [rsp + 0x18]
jmp fcn.00516e20

Function at 0x51e0c0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x51e188
sub rsp, 0x38
mov qword [rsp + 0x30], rbp
lea rbp, [rsp + 0x30]
movabs rdx, 0x47e9b2e453490118
mov qword [rsp + 0x1d], rdx
mov byte [rsp + 0x25], 0xba
movabs rdx, 0x604080001040001
mov qword [rsp + 0x26], rdx
mov word [rsp + 0x2e], 0x805
xor eax, eax
jmp 0x51e120
movzx r9d, byte [rsp + rsi + 0x1d]
add r9d, 0x62
add edx, r9d
mov byte [rsp + rdi + 0x1d], dl
mov byte [rsp + rsi + 0x1d], r8b
add rax, 2
cmp rax, 0xa
jge 0x51e151
movzx edx, byte [rsp + rax + 0x26]
movzx esi, byte [rsp + rax + 0x27]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 9
jae 0x51e17b
movzx r8d, byte [rsp + rdi + 0x1d]
add r8d, 0x62
add r8d, edx
cmp rsi, 9
jb 0x51e106
jmp 0x51e16f
xor eax, eax
lea rbx, [rsp + 0x1d]
mov ecx, 9
nop dword [rax]
call fcn.0044a0a0
mov rbp, qword [rsp + 0x30]
add rsp, 0x38
ret
mov eax, esi
mov ecx, 9
call fcn.0045f380
mov eax, edi
mov ecx, 9
call fcn.0045f380
nop
call fcn.0045cd20
jmp fcn.0051e0c0
Function at 0x51e560
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x51e668
sub rsp, 0x58
mov qword [rsp + 0x50], rbp
lea rbp, [rsp + 0x50]
movabs rdx, 0x86696c617685744f
mov qword [rsp + 0x19], rdx
movabs rdx, 0x4665356b4a6d9786
mov qword [rsp + 0x20], rdx
movabs rdx, 0x858f876e4587b78a
mov qword [rsp + 0x28], rdx
movabs rdx, 0x1415151000161109
mov qword [rsp + 0x30], rdx
movabs rdx, 0x130002070e130a01
mov qword [rsp + 0x38], rdx
movabs rdx, 0xb07120a01100c08
mov qword [rsp + 0x40], rdx
movabs rdx, 0xe0a110a090c0f0c
mov qword [rsp + 0x48], rdx
xor eax, eax
jmp 0x51e600
movzx r9d, byte [rsp + rsi + 0x19]
add r9d, 0xffffffd7
add edx, r9d
mov byte [rsp + rdi + 0x19], dl
mov byte [rsp + rsi + 0x19], r8b
add rax, 2
nop
cmp rax, 0x20
jge 0x51e631
movzx edx, byte [rsp + rax + 0x30]
movzx esi, byte [rsp + rax + 0x31]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x17
jae 0x51e65b
movzx r8d, byte [rsp + rdi + 0x19]
add r8d, 0xffffffd7
add r8d, edx
cmp rsi, 0x17
jb 0x51e5e5
jmp 0x51e64f
xor eax, eax
lea rbx, [rsp + 0x19]
mov ecx, 0x17
nop dword [rax]
call fcn.0044a0a0
mov rbp, qword [rsp + 0x50]
add rsp, 0x58
ret
mov eax, esi
mov ecx, 0x17
call fcn.0045f380
mov eax, edi
mov ecx, 0x17
call fcn.0045f380
nop
call fcn.0045cd20
jmp fcn.0051e560

Function at 0x51ece0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x51edd6
sub rsp, 0x48
mov qword [rsp + 0x40], rbp
lea rbp, [rsp + 0x40]
movabs rdx, 0x45eabf494fc64930
mov qword [rsp + 0x19], rdx
movabs rdx, 0xc045eabf494fc649
mov qword [rsp + 0x1a], rdx
movabs rdx, 0xc8cc4544cfe141c5
mov qword [rsp + 0x22], rdx
movabs rdx, 0x701040b06100404
mov qword [rsp + 0x2a], rdx
movabs rdx, 0xc0f080204030701
mov qword [rsp + 0x30], rdx
movabs rdx, 0x101040705050309
mov qword [rsp + 0x38], rdx
xor eax, eax
jmp 0x51ed73
movzx r9d, byte [rsp + rsi + 0x19]
sub r9d, edx
lea edx, [r9 - 0x7a]
mov byte [rsp + rdi + 0x19], dl
lea edx, [r8 - 0x7a]
mov byte [rsp + rsi + 0x19], dl
add rax, 2
cmp rax, 0x16
jge 0x51eda2
movzx edx, byte [rsp + rax + 0x2a]
movzx esi, byte [rsp + rax + 0x2b]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x11
jae 0x51edc9
movzx r8d, byte [rsp + rdi + 0x19]
sub r8d, edx
cmp rsi, 0x11
jb 0x51ed56
nop
jmp 0x51edbd
xor eax, eax
lea rbx, [rsp + 0x19]
mov ecx, 0x11
call fcn.0044a0a0
mov rbp, qword [rsp + 0x40]
add rsp, 0x48
ret
mov eax, esi
mov ecx, 0x11
call fcn.0045f380
mov eax, edi
mov ecx, 0x11
call fcn.0045f380
nop
call fcn.0045cd20
nop dword [rax + rax]
jmp fcn.0051ece0
Function at 0x51f440
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x51f536
sub rsp, 0x48
mov qword [rsp + 0x40], rbp
lea rbp, [rsp + 0x40]
movabs rdx, 0x9721353433ee1130
mov qword [rsp + 0x1d], rdx
movabs rdx, 0x969721353433ee11
mov qword [rsp + 0x1e], rdx
movabs rdx, 0x987e65204e628eb6
mov qword [rsp + 0x26], rdx
movabs rdx, 0x20f0a090807020f
mov qword [rsp + 0x2e], rdx
movabs rdx, 0x110020f0a090807
mov qword [rsp + 0x30], rdx
movabs rdx, 0x6100c0f0c0d060c
mov qword [rsp + 0x38], rdx
xor eax, eax
jmp 0x51f4d3
movzx r9d, byte [rsp + rsi + 0x1d]
sub r9d, edx
lea edx, [r9 - 0x4e]
mov byte [rsp + rdi + 0x1d], dl
lea edx, [r8 - 0x4e]
mov byte [rsp + rsi + 0x1d], dl
add rax, 2
cmp rax, 0x12
jge 0x51f502
movzx edx, byte [rsp + rax + 0x2e]
movzx esi, byte [rsp + rax + 0x2f]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x11
jae 0x51f529
movzx r8d, byte [rsp + rdi + 0x1d]
sub r8d, edx
cmp rsi, 0x11
jb 0x51f4b6
nop
jmp 0x51f51d
xor eax, eax
lea rbx, [rsp + 0x1d]
mov ecx, 0x11
call fcn.0044a0a0
mov rbp, qword [rsp + 0x40]
add rsp, 0x48
ret
mov eax, esi
mov ecx, 0x11
call fcn.0045f380
mov eax, edi
mov ecx, 0x11
call fcn.0045f380
nop
call fcn.0045cd20
nop dword [rax + rax]
jmp fcn.0051f440
Function at 0x532960
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x532ab2
sub rsp, 0x78
mov qword [rsp + 0x70], rbp
lea rbp, [rsp + 0x70]
movabs rdx, 0xf130e8a3f474166f
mov qword [rsp + 0x44], rdx
movabs rdx, 0x20eb65ef13eb0cf2
mov qword [rsp + 0x4c], rdx
movabs rdx, 0xedeaec9320eb65ef
mov qword [rsp + 0x50], rdx
movabs rdx, 0x15dc9ae09565dfcf
mov qword [rsp + 0x58], rdx
movabs rdx, 0x11a42f614d20db65
mov qword [rsp + 0x60], rdx
movabs rdx, 0xf25701d1f666f20
mov qword [rsp + 0x68], rdx
movabs rdx, 0x7120a1a2b292b15
mov qword [rsp + 0x18], rdx
movabs rdx, 0x17131a0b2b050510
mov qword [rsp + 0x20], rdx
movabs rdx, 0x30e1b2217131a0b
mov qword [rsp + 0x24], rdx
movabs rdx, 0xb19181a29140408
mov qword [rsp + 0x2c], rdx
movabs rdx, 0x211428111d272309
mov qword [rsp + 0x34], rdx
movabs rdx, 0x1180c0c06291b0b
mov qword [rsp + 0x3c], rdx
xor eax, eax
jmp 0x532a4d
movzx r9d, byte [rsp + rsi + 0x44]
sub r9d, edx
lea edx, [r9 - 0x63]
mov byte [rsp + rdi + 0x44], dl
lea edx, [r8 - 0x63]
mov byte [rsp + rsi + 0x44], dl
add rax, 2
cmp rax, 0x2c
jge 0x532a7a
movzx edx, byte [rsp + rax + 0x18]
movzx esi, byte [rsp + rax + 0x19]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x2c
jae 0x532aa5
movzx r8d, byte [rsp + rdi + 0x44]
sub r8d, edx
cmp rsi, 0x2c
jb 0x532a30
jmp 0x532a95
xor eax, eax
lea rbx, [rsp + 0x44]
mov ecx, 0x2c
call fcn.0044a0a0
mov rbp, qword [rsp + 0x70]
add rsp, 0x78
ret
mov eax, esi
mov ecx, 0x2c
nop dword [rax]
call fcn.0045f380
mov eax, edi
mov ecx, 0x2c
call fcn.0045f380
nop
call fcn.0045cd20
jmp fcn.00532960

Function at 0x5346a0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x5347d2
sub rsp, 0x70
mov qword [rsp + 0x68], rbp
lea rbp, [rsp + 0x68]
movabs rdx, 0xc16c69ffe201fab8
mov qword [rsp + 0x1b], rdx
movabs rdx, 0x2869c09bec36953f
mov qword [rsp + 0x23], rdx
movabs rdx, 0x62edf069bc81bb28
mov qword [rsp + 0x2a], rdx
movabs rdx, 0xbf3fed923a654ce1
mov qword [rsp + 0x32], rdx
movabs rdx, 0xa110b020614080d
mov qword [rsp + 0x3a], rdx
movabs rdx, 0xf1d0901010d0d
mov qword [rsp + 0x42], rdx
movabs rdx, 0x14181c0a1117000f
mov qword [rsp + 0x48], rdx
movabs rdx, 0x1c0c1c1d17040f03
mov qword [rsp + 0x50], rdx
movabs rdx, 0x14141c1b1517001e
mov qword [rsp + 0x58], rdx
movabs rdx, 0x1207091004030a1b
mov qword [rsp + 0x60], rdx
xor eax, eax
jmp 0x53476c
movzx r9d, byte [rsp + rsi + 0x1b]
add r9d, 0x6a
add edx, r9d
mov byte [rsp + rdi + 0x1b], dl
mov byte [rsp + rsi + 0x1b], r8b
add rax, 2
cmp rax, 0x2e
jge 0x53479d
movzx edx, byte [rsp + rax + 0x3a]
movzx esi, byte [rsp + rax + 0x3b]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x1f
jae 0x5347c5
movzx r8d, byte [rsp + rdi + 0x1b]
add r8d, 0x6a
add r8d, edx
cmp rsi, 0x1f
jb 0x534752
jmp 0x5347b8
xor eax, eax
lea rbx, [rsp + 0x1b]
mov ecx, 0x1f
call fcn.0044a0a0
mov rbp, qword [rsp + 0x68]
add rsp, 0x70
ret
mov eax, esi
mov ecx, 0x1f
nop
call fcn.0045f380
mov eax, edi
mov ecx, 0x1f
call fcn.0045f380
nop
call fcn.0045cd20
jmp fcn.005346a0
Function at 0x534ae0
Capabilities:
Encode data using xor

Disassembly:
mov rbx, qword [rsp + 8]
mov rsi, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdx, qword [rsp + 0x20]
test rdx, 0xf
jne 0x534b4b
mov rax, 0
movdqu xmm0, xmmword [rsi + rax]
movdqu xmm1, xmmword [rcx + rax]
pxor xmm0, xmm1
movdqu xmmword [rbx + rax], xmm0
add rax, 0x10
cmp rdx, rax
jne 0x534b04
ret
sub rdx, 1
mov dil, byte [rsi + rdx]
mov al, byte [rcx + rdx]
xor dil, al
mov byte [rbx + rdx], dil
test rdx, 7
jne 0x534b21
cmp rdx, 0
je 0x534b6d
test rdx, 0xf
je 0x534afd
test rdx, 7
jne 0x534b21
sub rdx, 8
mov rdi, qword [rsi + rdx]
mov rax, qword [rcx + rdx]
xor rdi, rax
mov qword [rbx + rdx], rdi
cmp rdx, 0x10
jge 0x534afd
ret
Function at 0x5362e0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x536426
sub rsp, 0x70
mov qword [rsp + 0x68], rbp
lea rbp, [rsp + 0x68]
movabs rdx, 0xf2d5c74ccd37263
mov qword [rsp + 0x19], rdx
movabs rdx, 0x7265beb4e30f2d5c
mov qword [rsp + 0x1e], rdx
movabs rdx, 0xc1d2619dcb691dde
mov qword [rsp + 0x26], rdx
movabs rdx, 0x7265666675629a64
mov qword [rsp + 0x2e], rdx
movabs rdx, 0x70f7b485dbf16f20
mov qword [rsp + 0x36], rdx
movabs rdx, 0x523030d10130705
mov qword [rsp + 0x3e], rdx
movabs rdx, 0x607110d16080e05
mov qword [rsp + 0x46], rdx
movabs rdx, 0x22050607110d1608
mov qword [rsp + 0x48], rdx
movabs rdx, 0x1f20220802021f08
mov qword [rsp + 0x50], rdx
movabs rdx, 0x913160d20101603
mov qword [rsp + 0x58], rdx
movabs rdx, 0xe210a2314020e07
mov qword [rsp + 0x60], rdx
xor eax, eax
nop
jmp 0x5363c0
movzx r9d, byte [rsp + rsi + 0x19]
sub r9d, edx
lea edx, [r9 - 0xe]
mov byte [rsp + rdi + 0x19], dl
lea edx, [r8 - 0xe]
mov byte [rsp + rsi + 0x19], dl
add rax, 2
nop
cmp rax, 0x2a
jge 0x5363ed
movzx edx, byte [rsp + rax + 0x3e]
movzx esi, byte [rsp + rax + 0x3f]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x25
jae 0x536414
movzx r8d, byte [rsp + rdi + 0x19]
sub r8d, edx
cmp rsi, 0x25
jb 0x5363a2
jmp 0x536408
xor eax, eax
lea rbx, [rsp + 0x19]
mov ecx, 0x25
call fcn.0044a0a0
mov rbp, qword [rsp + 0x68]
add rsp, 0x70
ret
mov eax, esi
mov ecx, 0x25
call fcn.0045f380
mov eax, edi
mov ecx, 0x25
nop dword [rax + rax]
call fcn.0045f380
nop
call fcn.0045cd20
jmp fcn.005362e0