joyce8/EMBER2024-capa huggingface dataset:
Function at 0x32604c2a0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x32604c352
push rbp
mov rbp, rsp
sub rsp, 0x28
movabs rdx, 0x63aaf5a77c72aaa2
mov qword [rsp + 0x20], rdx
movabs rdx, 0x3010106040501
mov qword [rsp + 0x18], rdx
xor eax, eax
jmp 0x32604c2ee
movzx r9d, byte [rsp + rsi + 0x20]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x42]
mov byte [rsp + rdi + 0x20], dl
mov byte [rsp + rsi + 0x20], r8b
add rax, 2
cmp rax, 8
jge 0x32604c322
movzx edx, byte [rsp + rax + 0x18]
movzx esi, byte [rsp + rax + 0x19]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 8
jae 0x32604c345
movzx r8d, byte [rsp + rdi + 0x20]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x42]
cmp rsi, 8
jb 0x32604c2d4
nop
jmp 0x32604c339
xor eax, eax
lea rbx, [rsp + 0x20]
mov ecx, 8
call fcn.32601d600
add rsp, 0x28
pop rbp
ret
mov eax, esi
mov ecx, 8
call fcn.326033020
mov eax, edi
mov ecx, 8
call fcn.326033020
nop
call fcn.326030d20
jmp fcn.32604c2a0

Function at 0x32604c360
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x32604c41d
push rbp
mov rbp, rsp
sub rsp, 0x30
movabs rdx, 0x6167476e19761d3a
mov qword [rsp + 0x26], rdx
mov word [rsp + 0x2e], 0xb548
movabs rdx, 0x300030309050903
mov qword [rsp + 0x1a], rdx
mov dword [rsp + 0x22], 0x1080001
xor eax, eax
jmp 0x32604c3c0
movzx r9d, byte [rsp + rsi + 0x26]
sub r9d, edx
lea edx, [r9 + 0x30]
mov byte [rsp + rdi + 0x26], dl
lea edx, [r8 + 0x30]
mov byte [rsp + rsi + 0x26], dl
add rax, 2
cmp rax, 0xc
jge 0x32604c3ed
movzx edx, byte [rsp + rax + 0x1a]
movzx esi, byte [rsp + rax + 0x1b]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0xa
jae 0x32604c410
movzx r8d, byte [rsp + rdi + 0x26]
sub r8d, edx
cmp rsi, 0xa
jb 0x32604c3a3
jmp 0x32604c404
xor eax, eax
lea rbx, [rsp + 0x26]
mov ecx, 0xa
call fcn.32601d600
add rsp, 0x30
pop rbp
ret
mov eax, esi
mov ecx, 0xa
call fcn.326033020
mov eax, edi
mov ecx, 0xa
call fcn.326033020
nop
nop dword [rax]
call fcn.326030d20
jmp fcn.32604c360

Function at 0x32604e0a0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x32604e15d
push rbp
mov rbp, rsp
sub rsp, 0x30
movabs rdx, 0x748b8a826489744b
mov qword [rsp + 0x27], rdx
mov byte [rsp + 0x2f], 0x69
movabs rdx, 0x106040502070705
mov qword [rsp + 0x1d], rdx
mov word [rsp + 0x25], 0x701
xor eax, eax
nop
jmp 0x32604e100
movzx r9d, byte [rsp + rsi + 0x27]
sub r9d, edx
lea edx, [r9 - 6]
mov byte [rsp + rdi + 0x27], dl
lea edx, [r8 - 6]
mov byte [rsp + rsi + 0x27], dl
add rax, 2
nop
cmp rax, 0xa
jge 0x32604e12d
movzx edx, byte [rsp + rax + 0x1d]
movzx esi, byte [rsp + rax + 0x1e]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 9
jae 0x32604e150
movzx r8d, byte [rsp + rdi + 0x27]
sub r8d, edx
cmp rsi, 9
jb 0x32604e0e2
jmp 0x32604e144
xor eax, eax
lea rbx, [rsp + 0x27]
mov ecx, 9
call fcn.32601d600
add rsp, 0x30
pop rbp
ret
mov eax, esi
mov ecx, 9
call fcn.326033020
mov eax, edi
mov ecx, 9
call fcn.326033020
nop
nop dword [rax]
call fcn.326030d20
jmp fcn.32604e0a0
Function at 0x32604e7c0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x32604e886
push rbp
mov rbp, rsp
sub rsp, 0x30
movabs rdx, 0x61a1828082838e87
mov qword [rsp + 0x27], rdx
mov byte [rsp + 0x2f], 0x7d
movabs rdx, 0x600060801020305
mov qword [rsp + 0x1d], rdx
mov word [rsp + 0x25], 0x408
xor eax, eax
nop
jmp 0x32604e820
movzx r9d, byte [rsp + rsi + 0x27]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x27]
mov byte [rsp + rdi + 0x27], dl
mov byte [rsp + rsi + 0x27], r8b
add rax, 2
nop dword [rax]
cmp rax, 0xa
jge 0x32604e852
movzx edx, byte [rsp + rax + 0x1d]
movzx esi, byte [rsp + rax + 0x1e]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 9
jae 0x32604e877
movzx r8d, byte [rsp + rdi + 0x27]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x27]
cmp rsi, 9
jb 0x32604e802
jmp 0x32604e86b
xor eax, eax
lea rbx, [rsp + 0x27]
mov ecx, 9
nop
call fcn.32601d600
add rsp, 0x30
pop rbp
ret
mov eax, esi
mov ecx, 9
call fcn.326033020
mov eax, edi
mov ecx, 9
nop
call fcn.326033020
nop
call fcn.326030d20
jmp fcn.32604e7c0

Function at 0x32604f400
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x32604f4bd
push rbp
mov rbp, rsp
sub rsp, 0x30
movabs rdx, 0x612e514667615b4d
mov qword [rsp + 0x27], rdx
mov byte [rsp + 0x2f], 0x4e
movabs rdx, 0x501020805040605
mov qword [rsp + 0x1b], rdx
mov dword [rsp + 0x23], 0x4040202
xor eax, eax
nop
jmp 0x32604f460
movzx r9d, byte [rsp + rsi + 0x27]
sub r9d, edx
lea edx, [r9 + 0x1b]
mov byte [rsp + rdi + 0x27], dl
lea edx, [r8 + 0x1b]
mov byte [rsp + rsi + 0x27], dl
add rax, 2
nop
cmp rax, 0xc
jge 0x32604f48d
movzx edx, byte [rsp + rax + 0x1b]
movzx esi, byte [rsp + rax + 0x1c]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 9
jae 0x32604f4b0
movzx r8d, byte [rsp + rdi + 0x27]
sub r8d, edx
cmp rsi, 9
jb 0x32604f442
jmp 0x32604f4a4
xor eax, eax
lea rbx, [rsp + 0x27]
mov ecx, 9
call fcn.32601d600
add rsp, 0x30
pop rbp
ret
mov eax, esi
mov ecx, 9
call fcn.326033020
mov eax, edi
mov ecx, 9
call fcn.326033020
nop
nop dword [rax]
call fcn.326030d20
jmp fcn.32604f400

Function at 0x3260510a0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x326051167
push rbp
mov rbp, rsp
sub rsp, 0x38
movabs rdx, 0x5f6aece1ff75e4ff
mov qword [rsp + 0x2d], rdx
mov dword [rsp + 0x34], 0x8ef4fa5f
movabs rdx, 0x1080103030a0905
mov qword [rsp + 0x1d], rdx
movabs rdx, 0x408060006060108
mov qword [rsp + 0x25], rdx
xor eax, eax
jmp 0x326051108
movzx r9d, byte [rsp + rsi + 0x2d]
sub r9d, edx
lea edx, [r9 - 0x7f]
mov byte [rsp + rdi + 0x2d], dl
lea edx, [r8 - 0x7f]
mov byte [rsp + rsi + 0x2d], dl
add rax, 2
cmp rax, 0x10
jge 0x326051137
movzx edx, byte [rsp + rax + 0x1d]
movzx esi, byte [rsp + rax + 0x1e]
mov edi, edx
xor edx, esi
add edx, eax
nop
cmp rdi, 0xb
jae 0x32605115a
movzx r8d, byte [rsp + rdi + 0x2d]
sub r8d, edx
cmp rsi, 0xb
jb 0x3260510eb
jmp 0x32605114e
xor eax, eax
lea rbx, [rsp + 0x2d]
mov ecx, 0xb
call fcn.32601d600
add rsp, 0x38
pop rbp
ret
mov eax, esi
mov ecx, 0xb
call fcn.326033020
mov eax, edi
mov ecx, 0xb
call fcn.326033020
nop
call fcn.326030d20
jmp fcn.3260510a0
Function at 0x326051180
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x326051238
push rbp
mov rbp, rsp
sub rsp, 0x30
movabs rdx, 0x6101fc4a67612745
mov qword [rsp + 0x28], rdx
movabs rdx, 0x600060605060104
mov qword [rsp + 0x1c], rdx
mov dword [rsp + 0x24], 0x4060504
xor eax, eax
jmp 0x3260511d9
movzx r9d, byte [rsp + rsi + 0x28]
sub r9d, edx
lea edx, [r9 + 0x23]
mov byte [rsp + rdi + 0x28], dl
lea edx, [r8 + 0x23]
mov byte [rsp + rsi + 0x28], dl
add rax, 2
cmp rax, 0xc
jge 0x326051208
movzx edx, byte [rsp + rax + 0x1c]
movzx esi, byte [rsp + rax + 0x1d]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 8
jae 0x32605122b
movzx r8d, byte [rsp + rdi + 0x28]
sub r8d, edx
nop
cmp rsi, 8
jb 0x3260511bc
jmp 0x32605121f
xor eax, eax
lea rbx, [rsp + 0x28]
mov ecx, 8
call fcn.32601d600
add rsp, 0x30
pop rbp
ret
mov eax, esi
mov ecx, 8
call fcn.326033020
mov eax, edi
mov ecx, 8
call fcn.326033020
nop
call fcn.326030d20
nop dword [rax]
jmp fcn.326051180

Function at 0x326051c00
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x326051cbd
push rbp
mov rbp, rsp
sub rsp, 0x30
movabs rdx, 0xb965836178997583
mov qword [rsp + 0x27], rdx
mov byte [rsp + 0x2f], 0x8f
movabs rdx, 0x200080503020807
mov qword [rsp + 0x1d], rdx
mov word [rsp + 0x25], 0x503
xor eax, eax
nop
jmp 0x326051c60
movzx r9d, byte [rsp + rsi + 0x27]
sub r9d, edx
lea edx, [r9 - 0xd]
mov byte [rsp + rdi + 0x27], dl
lea edx, [r8 - 0xd]
mov byte [rsp + rsi + 0x27], dl
add rax, 2
nop
cmp rax, 0xa
jge 0x326051c8d
movzx edx, byte [rsp + rax + 0x1d]
movzx esi, byte [rsp + rax + 0x1e]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 9
jae 0x326051cb0
movzx r8d, byte [rsp + rdi + 0x27]
sub r8d, edx
cmp rsi, 9
jb 0x326051c42
jmp 0x326051ca4
xor eax, eax
lea rbx, [rsp + 0x27]
mov ecx, 9
call fcn.32601d600
add rsp, 0x30
pop rbp
ret
mov eax, esi
mov ecx, 9
call fcn.326033020
mov eax, edi
mov ecx, 9
call fcn.326033020
nop
nop dword [rax]
call fcn.326030d20
jmp fcn.326051c00

Function at 0x326052700
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x3260527c7
push rbp
mov rbp, rsp
sub rsp, 0x38
movabs rdx, 0xbbac6769a272e7bb
mov qword [rsp + 0x2d], rdx
mov dword [rsp + 0x34], 0x69bbb3bb
movabs rdx, 0x801090004070001
mov qword [rsp + 0x1f], rdx
movabs rdx, 0x403010009060801
mov qword [rsp + 0x25], rdx
xor eax, eax
jmp 0x326052768
movzx r9d, byte [rsp + rsi + 0x2d]
sub r9d, edx
lea edx, [r9 - 0x21]
mov byte [rsp + rdi + 0x2d], dl
lea edx, [r8 - 0x21]
mov byte [rsp + rsi + 0x2d], dl
add rax, 2
cmp rax, 0xe
jge 0x326052797
movzx edx, byte [rsp + rax + 0x1f]
movzx esi, byte [rsp + rax + 0x20]
mov edi, edx
xor edx, esi
add edx, eax
nop
cmp rdi, 0xb
jae 0x3260527ba
movzx r8d, byte [rsp + rdi + 0x2d]
sub r8d, edx
cmp rsi, 0xb
jb 0x32605274b
jmp 0x3260527ae
xor eax, eax
lea rbx, [rsp + 0x2d]
mov ecx, 0xb
call fcn.32601d600
add rsp, 0x38
pop rbp
ret
mov eax, esi
mov ecx, 0xb
call fcn.326033020
mov eax, edi
mov ecx, 0xb
call fcn.326033020
nop
call fcn.326030d20
jmp fcn.326052700
Function at 0x326052b00
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x326052bbd
push rbp
mov rbp, rsp
sub rsp, 0x30
movabs rdx, 0x49e963f1e47065e7
mov qword [rsp + 0x26], rdx
mov word [rsp + 0x2e], 0x62f7
movabs rdx, 0x8030409060807
mov qword [rsp + 0x1c], rdx
mov word [rsp + 0x24], 0x606
xor eax, eax
jmp 0x326052b60
movzx r9d, byte [rsp + rsi + 0x26]
sub r9d, edx
lea edx, [r9 - 0x74]
mov byte [rsp + rdi + 0x26], dl
lea edx, [r8 - 0x74]
mov byte [rsp + rsi + 0x26], dl
add rax, 2
nop
cmp rax, 0xa
jge 0x326052b8d
movzx edx, byte [rsp + rax + 0x1c]
movzx esi, byte [rsp + rax + 0x1d]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0xa
jae 0x326052bb0
movzx r8d, byte [rsp + rdi + 0x26]
sub r8d, edx
cmp rsi, 0xa
jb 0x326052b42
jmp 0x326052ba4
xor eax, eax
lea rbx, [rsp + 0x26]
mov ecx, 0xa
call fcn.32601d600
add rsp, 0x30
pop rbp
ret
mov eax, esi
mov ecx, 0xa
call fcn.326033020
mov eax, edi
mov ecx, 0xa
call fcn.326033020
nop
nop dword [rax]
call fcn.326030d20
jmp fcn.326052b00

Function at 0x326052c60
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x326052d12
push rbp
mov rbp, rsp
sub rsp, 0x28
movabs rdx, 0x72dec56ed8a4cb28
mov qword [rsp + 0x20], rdx
movabs rdx, 0x302050506010002
mov qword [rsp + 0x18], rdx
xor eax, eax
jmp 0x326052cb1
movzx r9d, byte [rsp + rsi + 0x20]
sub r9d, edx
lea edx, [r9 - 0x5d]
mov byte [rsp + rdi + 0x20], dl
lea edx, [r8 - 0x5d]
mov byte [rsp + rsi + 0x20], dl
add rax, 2
cmp rax, 8
jge 0x326052cde
movzx edx, byte [rsp + rax + 0x18]
movzx esi, byte [rsp + rax + 0x19]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 8
jae 0x326052d05
movzx r8d, byte [rsp + rdi + 0x20]
sub r8d, edx
cmp rsi, 8
jb 0x326052c94
jmp 0x326052cf5
xor eax, eax
lea rbx, [rsp + 0x20]
mov ecx, 8
call fcn.32601d600
add rsp, 0x28
pop rbp
ret
mov eax, esi
mov ecx, 8
nop dword [rax]
call fcn.326033020
mov eax, edi
mov ecx, 8
call fcn.326033020
nop
call fcn.326030d20
jmp fcn.326052c60

Function at 0x326052f00
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x326052fc6
push rbp
mov rbp, rsp
sub rsp, 0x30
movabs rdx, 0xb73eda3d6f3a6442
mov qword [rsp + 0x25], rdx
mov dword [rsp + 0x2c], 0x633b48b7
movabs rdx, 0x602070804090508
mov qword [rsp + 0x19], rdx
mov dword [rsp + 0x21], 0x7000708
xor eax, eax
jmp 0x326052f60
movzx r9d, byte [rsp + rsi + 0x25]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x1d]
mov byte [rsp + rdi + 0x25], dl
mov byte [rsp + rsi + 0x25], r8b
add rax, 2
nop
cmp rax, 0xc
jge 0x326052f92
movzx edx, byte [rsp + rax + 0x19]
movzx esi, byte [rsp + rax + 0x1a]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0xb
jae 0x326052fb7
movzx r8d, byte [rsp + rdi + 0x25]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x1d]
cmp rsi, 0xb
jb 0x326052f44
jmp 0x326052fab
xor eax, eax
lea rbx, [rsp + 0x25]
mov ecx, 0xb
nop
call fcn.32601d600
add rsp, 0x30
pop rbp
ret
mov eax, esi
mov ecx, 0xb
call fcn.326033020
mov eax, edi
mov ecx, 0xb
nop
call fcn.326033020
nop
call fcn.326030d20
jmp fcn.326052f00
Function at 0x326053fe0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x3260540ac
push rbp
mov rbp, rsp
sub rsp, 0x30
movabs rdx, 0x614db9141750b84f
mov qword [rsp + 0x26], rdx
mov word [rsp + 0x2e], 0xccb2
movabs rdx, 0x102030305080209
mov qword [rsp + 0x18], rdx
movabs rdx, 0x205040809020102
mov qword [rsp + 0x1e], rdx
xor eax, eax
jmp 0x326054044
movzx r9d, byte [rsp + rsi + 0x26]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x4a]
mov byte [rsp + rdi + 0x26], dl
mov byte [rsp + rsi + 0x26], r8b
add rax, 2
cmp rax, 0xe
jge 0x32605407c
movzx edx, byte [rsp + rax + 0x18]
movzx esi, byte [rsp + rax + 0x19]
mov edi, edx
xor edx, esi
add edx, eax
nop word [rax + rax]
cmp rdi, 0xa
jae 0x32605409f
movzx r8d, byte [rsp + rdi + 0x26]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x4a]
cmp rsi, 0xa
jb 0x32605402a
jmp 0x326054093
xor eax, eax
lea rbx, [rsp + 0x26]
mov ecx, 0xa
call fcn.32601d600
add rsp, 0x30
pop rbp
ret
mov eax, esi
mov ecx, 0xa
call fcn.326033020
mov eax, edi
mov ecx, 0xa
call fcn.326033020
nop
call fcn.326030d20
jmp fcn.326053fe0

Function at 0x326054140
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x32605423b
push rbp
mov rbp, rsp
sub rsp, 0x48
movabs rdx, 0xc76e364d7474d83d
mov qword [rsp + 0x35], rdx
movabs rdx, 0xe168bec76e364d74
mov qword [rsp + 0x38], rdx
movabs rdx, 0x653e2c0d21ca6589
mov qword [rsp + 0x40], rdx
movabs rdx, 0x10070700050f050d
mov qword [rsp + 0x1b], rdx
movabs rdx, 0x50e0a0f04011107
mov qword [rsp + 0x23], rdx
movabs rdx, 0xb07050e0a0f0401
mov qword [rsp + 0x25], rdx
movabs rdx, 0xd08050107080e05
mov qword [rsp + 0x2d], rdx
xor eax, eax
jmp 0x3260541d9
movzx r9d, byte [rsp + rsi + 0x35]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x7e]
mov byte [rsp + rdi + 0x35], dl
mov byte [rsp + rsi + 0x35], r8b
add rax, 2
cmp rax, 0x1a
jge 0x32605420b
movzx edx, byte [rsp + rax + 0x1b]
movzx esi, byte [rsp + rax + 0x1c]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x13
jae 0x32605422e
movzx r8d, byte [rsp + rdi + 0x35]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x7e]
cmp rsi, 0x13
jb 0x3260541bf
jmp 0x326054222
xor eax, eax
lea rbx, [rsp + 0x35]
mov ecx, 0x13
call fcn.32601d600
add rsp, 0x48
pop rbp
ret
mov eax, esi
mov ecx, 0x13
call fcn.326033020
mov eax, edi
mov ecx, 0x13
call fcn.326033020
nop
nop dword [rax + rax]
call fcn.326030d20
jmp fcn.326054140
Function at 0x326054260
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x326054346
push rbp
mov rbp, rsp
sub rsp, 0x40
movabs rdx, 0x514e4461376fb956
mov qword [rsp + 0x32], rdx
movabs rdx, 0x6b72e455c9c4514e
mov qword [rsp + 0x38], rdx
movabs rdx, 0x9090a0a070b0009
mov qword [rsp + 0x1e], rdx
movabs rdx, 0xa06000809090a0a
mov qword [rsp + 0x22], rdx
movabs rdx, 0x80b030808050a01
mov qword [rsp + 0x2a], rdx
xor eax, eax
nop
jmp 0x3260542e0
movzx r9d, byte [rsp + rsi + 0x32]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x7d]
mov byte [rsp + rdi + 0x32], dl
mov byte [rsp + rsi + 0x32], r8b
add rax, 2
nop dword [rax]
cmp rax, 0x14
jge 0x326054312
movzx edx, byte [rsp + rax + 0x1e]
movzx esi, byte [rsp + rax + 0x1f]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0xe
jae 0x326054337
movzx r8d, byte [rsp + rdi + 0x32]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x7d]
cmp rsi, 0xe
jb 0x3260542c2
jmp 0x32605432b
xor eax, eax
lea rbx, [rsp + 0x32]
mov ecx, 0xe
nop
call fcn.32601d600
add rsp, 0x40
pop rbp
ret
mov eax, esi
mov ecx, 0xe
call fcn.326033020
mov eax, edi
mov ecx, 0xe
nop
call fcn.326033020
nop
call fcn.326030d20
jmp fcn.326054260

Function at 0x326054360
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x32605445d
push rbp
mov rbp, rsp
sub rsp, 0x48
movabs rdx, 0x241e46f61d95a55
mov qword [rsp + 0x36], rdx
movabs rdx, 0x495f0241e46f61d9
mov qword [rsp + 0x38], rdx
movabs rdx, 0xf786745263694efb
mov qword [rsp + 0x40], rdx
movabs rdx, 0x205060510050607
mov qword [rsp + 0x1c], rdx
movabs rdx, 0x2020e03060e010b
mov qword [rsp + 0x24], rdx
movabs rdx, 0x110a02020e03060e
mov qword [rsp + 0x26], rdx
movabs rdx, 0x6010e03070b0300
mov qword [rsp + 0x2e], rdx
xor eax, eax
jmp 0x326054400
movzx r9d, byte [rsp + rsi + 0x36]
sub r9d, edx
lea edx, [r9 - 0x5e]
mov byte [rsp + rdi + 0x36], dl
lea edx, [r8 - 0x5e]
mov byte [rsp + rsi + 0x36], dl
add rax, 2
nop dword [rax]
cmp rax, 0x1a
jge 0x32605442d
movzx edx, byte [rsp + rax + 0x1c]
movzx esi, byte [rsp + rax + 0x1d]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x12
jae 0x326054450
movzx r8d, byte [rsp + rdi + 0x36]
sub r8d, edx
cmp rsi, 0x12
jb 0x3260543df
jmp 0x326054444
xor eax, eax
lea rbx, [rsp + 0x36]
mov ecx, 0x12
call fcn.32601d600
add rsp, 0x48
pop rbp
ret
mov eax, esi
mov ecx, 0x12
call fcn.326033020
mov eax, edi
mov ecx, 0x12
call fcn.326033020
nop
nop dword [rax]
call fcn.326030d20
jmp fcn.326054360
Function at 0x326054720
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x3260547ec
push rbp
mov rbp, rsp
sub rsp, 0x38
movabs rdx, 0x74ca2126bbec1653
mov qword [rsp + 0x2d], rdx
mov dword [rsp + 0x34], 0x27c01c74
movabs rdx, 0x801090106080409
mov qword [rsp + 0x1d], rdx
movabs rdx, 0x20504040305080a
mov qword [rsp + 0x25], rdx
xor eax, eax
jmp 0x326054785
movzx r9d, byte [rsp + rsi + 0x2d]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x43]
mov byte [rsp + rdi + 0x2d], dl
mov byte [rsp + rsi + 0x2d], r8b
add rax, 2
cmp rax, 0x10
jge 0x3260547bc
movzx edx, byte [rsp + rax + 0x1d]
movzx esi, byte [rsp + rax + 0x1e]
mov edi, edx
xor edx, esi
add edx, eax
nop dword [rax + rax]
cmp rdi, 0xb
jae 0x3260547df
movzx r8d, byte [rsp + rdi + 0x2d]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x43]
cmp rsi, 0xb
jb 0x32605476b
jmp 0x3260547d3
xor eax, eax
lea rbx, [rsp + 0x2d]
mov ecx, 0xb
call fcn.32601d600
add rsp, 0x38
pop rbp
ret
mov eax, esi
mov ecx, 0xb
call fcn.326033020
mov eax, edi
mov ecx, 0xb
call fcn.326033020
nop
call fcn.326030d20
jmp fcn.326054720

Function at 0x326054800
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x3260548fb
push rbp
mov rbp, rsp
sub rsp, 0x50
movabs rdx, 0x10383cd96fb65e8
mov qword [rsp + 0x3c], rdx
movabs rdx, 0x16ff82fb010383cd
mov qword [rsp + 0x40], rdx
movabs rdx, 0x6e1069af8ad87aa9
mov qword [rsp + 0x48], rdx
movabs rdx, 0xa05060610100c03
mov qword [rsp + 0x1e], rdx
movabs rdx, 0xd090b0f030f1012
mov qword [rsp + 0x26], rdx
movabs rdx, 0xe0007020f000d09
mov qword [rsp + 0x2c], rdx
movabs rdx, 0x4090c0d030a0b08
mov qword [rsp + 0x34], rdx
xor eax, eax
jmp 0x326054899
movzx r9d, byte [rsp + rsi + 0x3c]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x5a]
mov byte [rsp + rdi + 0x3c], dl
mov byte [rsp + rsi + 0x3c], r8b
add rax, 2
cmp rax, 0x1e
jge 0x3260548cb
movzx edx, byte [rsp + rax + 0x1e]
movzx esi, byte [rsp + rax + 0x1f]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x14
jae 0x3260548ee
movzx r8d, byte [rsp + rdi + 0x3c]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x5a]
cmp rsi, 0x14
jb 0x32605487f
jmp 0x3260548e2
xor eax, eax
lea rbx, [rsp + 0x3c]
mov ecx, 0x14
call fcn.32601d600
add rsp, 0x50
pop rbp
ret
mov eax, esi
mov ecx, 0x14
call fcn.326033020
mov eax, edi
mov ecx, 0x14
call fcn.326033020
nop
nop dword [rax + rax]
call fcn.326030d20
jmp fcn.326054800
Function at 0x326054d20
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x326054de6
push rbp
mov rbp, rsp
sub rsp, 0x30
movabs rdx, 0xa39874cbb768c9c6
mov qword [rsp + 0x27], rdx
mov byte [rsp + 0x2f], 0x94
movabs rdx, 0x107040701000603
mov qword [rsp + 0x1b], rdx
mov dword [rsp + 0x23], 0x6080005
xor eax, eax
nop
jmp 0x326054d80
movzx r9d, byte [rsp + rsi + 0x27]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x38]
mov byte [rsp + rdi + 0x27], dl
mov byte [rsp + rsi + 0x27], r8b
add rax, 2
nop dword [rax]
cmp rax, 0xc
jge 0x326054db2
movzx edx, byte [rsp + rax + 0x1b]
movzx esi, byte [rsp + rax + 0x1c]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 9
jae 0x326054dd7
movzx r8d, byte [rsp + rdi + 0x27]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x38]
cmp rsi, 9
jb 0x326054d62
jmp 0x326054dcb
xor eax, eax
lea rbx, [rsp + 0x27]
mov ecx, 9
nop
call fcn.32601d600
add rsp, 0x30
pop rbp
ret
mov eax, esi
mov ecx, 9
call fcn.326033020
mov eax, edi
mov ecx, 9
nop
call fcn.326033020
nop
call fcn.326030d20
jmp fcn.326054d20

Function at 0x326058e20
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x326058ee6
push rbp
mov rbp, rsp
sub rsp, 0x30
movabs rdx, 0x36d8d6291fe02f29
mov qword [rsp + 0x27], rdx
mov byte [rsp + 0x2f], 0x34
movabs rdx, 0x300010603050402
mov qword [rsp + 0x1d], rdx
mov word [rsp + 0x25], 0x104
xor eax, eax
nop
jmp 0x326058e80
movzx r9d, byte [rsp + rsi + 0x27]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x3e]
mov byte [rsp + rdi + 0x27], dl
mov byte [rsp + rsi + 0x27], r8b
add rax, 2
nop dword [rax]
cmp rax, 0xa
jge 0x326058eb2
movzx edx, byte [rsp + rax + 0x1d]
movzx esi, byte [rsp + rax + 0x1e]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 9
jae 0x326058ed7
movzx r8d, byte [rsp + rdi + 0x27]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x3e]
cmp rsi, 9
jb 0x326058e62
jmp 0x326058ecb
xor eax, eax
lea rbx, [rsp + 0x27]
mov ecx, 9
nop
call fcn.32601d600
add rsp, 0x30
pop rbp
ret
mov eax, esi
mov ecx, 9
call fcn.326033020
mov eax, edi
mov ecx, 9
nop
call fcn.326033020
nop
call fcn.326030d20
jmp fcn.326058e20

Function at 0x326058f00
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x326058fbd
push rbp
mov rbp, rsp
sub rsp, 0x30
movabs rdx, 0x63614c5c6f5d6e57
mov qword [rsp + 0x27], rdx
mov byte [rsp + 0x2f], 0x72
movabs rdx, 0x304020802000505
mov qword [rsp + 0x1b], rdx
mov dword [rsp + 0x23], 0x3030605
xor eax, eax
nop
jmp 0x326058f60
movzx r9d, byte [rsp + rsi + 0x27]
sub r9d, edx
lea edx, [r9 + 0x10]
mov byte [rsp + rdi + 0x27], dl
lea edx, [r8 + 0x10]
mov byte [rsp + rsi + 0x27], dl
add rax, 2
nop
cmp rax, 0xc
jge 0x326058f8d
movzx edx, byte [rsp + rax + 0x1b]
movzx esi, byte [rsp + rax + 0x1c]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 9
jae 0x326058fb0
movzx r8d, byte [rsp + rdi + 0x27]
sub r8d, edx
cmp rsi, 9
jb 0x326058f42
jmp 0x326058fa4
xor eax, eax
lea rbx, [rsp + 0x27]
mov ecx, 9
call fcn.32601d600
add rsp, 0x30
pop rbp
ret
mov eax, esi
mov ecx, 9
call fcn.326033020
mov eax, edi
mov ecx, 9
call fcn.326033020
nop
nop dword [rax]
call fcn.326030d20
jmp fcn.326058f00