joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4fcec0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4fcfbb
push rbp
mov rbp, rsp
sub rsp, 0x50
movabs rdx, 0x65f07379748e6571
mov qword [rsp + 0x39], rdx
movabs rdx, 0xdc4182df7d6cfe65
mov qword [rsp + 0x40], rdx
movabs rdx, 0xd8090ef8dd0a8746
mov qword [rsp + 0x48], rdx
movabs rdx, 0xb13100216000214
mov qword [rsp + 0x1f], rdx
movabs rdx, 0x31210020c101115
mov qword [rsp + 0x27], rdx
movabs rdx, 0x614031210020c10
mov qword [rsp + 0x29], rdx
movabs rdx, 0x1608120e09080a08
mov qword [rsp + 0x31], rdx
xor eax, eax
jmp 0x4fcf59
movzx r9d, byte [rsp + rsi + 0x39]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x57]
mov byte [rsp + rdi + 0x39], dl
mov byte [rsp + rsi + 0x39], r8b
add rax, 2
cmp rax, 0x1a
jge 0x4fcf8b
movzx edx, byte [rsp + rax + 0x1f]
movzx esi, byte [rsp + rax + 0x20]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x17
jae 0x4fcfae
movzx r8d, byte [rsp + rdi + 0x39]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x57]
cmp rsi, 0x17
jb 0x4fcf3f
jmp 0x4fcfa2
xor eax, eax
lea rbx, [rsp + 0x39]
mov ecx, 0x17
call fcn.0044d560
add rsp, 0x50
pop rbp
ret
mov eax, esi
mov ecx, 0x17
call fcn.00462f80
mov eax, edi
mov ecx, 0x17
call fcn.00462f80
nop
nop dword [rax + rax]
call fcn.00460ca0
jmp fcn.004fcec0

Function at 0x4fdfc0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4fe0c8
push rbp
mov rbp, rsp
sub rsp, 0x58
movabs rdx, 0x74657598758b6f50
mov qword [rsp + 0x3e], rdx
movabs rdx, 0x866d7e6d816d64c9
mov qword [rsp + 0x46], rdx
movabs rdx, 0x6987866d7e6d816d
mov qword [rsp + 0x48], rdx
movabs rdx, 0x9e9d747876a18790
mov qword [rsp + 0x50], rdx
movabs rdx, 0x3180a0d0e160f03
mov qword [rsp + 0x1e], rdx
movabs rdx, 0x807150b190b130a
mov qword [rsp + 0x26], rdx
movabs rdx, 0x140307120f0b0310
mov qword [rsp + 0x2e], rdx
movabs rdx, 0x410030212020f0a
mov qword [rsp + 0x36], rdx
xor eax, eax
jmp 0x4fe06b
movzx r9d, byte [rsp + rsi + 0x3e]
sub r9d, edx
lea edx, [r9 + 0xe]
mov byte [rsp + rdi + 0x3e], dl
lea edx, [r8 + 0xe]
mov byte [rsp + rsi + 0x3e], dl
add rax, 2
cmp rax, 0x20
jge 0x4fe098
movzx edx, byte [rsp + rax + 0x1e]
movzx esi, byte [rsp + rax + 0x1f]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x1a
jae 0x4fe0bb
movzx r8d, byte [rsp + rdi + 0x3e]
sub r8d, edx
cmp rsi, 0x1a
jb 0x4fe04e
jmp 0x4fe0af
xor eax, eax
lea rbx, [rsp + 0x3e]
mov ecx, 0x1a
call fcn.0044d560
add rsp, 0x58
pop rbp
ret
mov eax, esi
mov ecx, 0x1a
call fcn.00462f80
mov eax, edi
mov ecx, 0x1a
call fcn.00462f80
nop
call fcn.00460ca0
jmp fcn.004fdfc0
Function at 0x5001e0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x5002db
push rbp
mov rbp, rsp
sub rsp, 0x48
movabs rdx, 0xc365043f4667cdbe
mov qword [rsp + 0x36], rdx
movabs rdx, 0x6714c365043f4667
mov qword [rsp + 0x38], rdx
movabs rdx, 0x57fe06b775b86972
mov qword [rsp + 0x40], rdx
movabs rdx, 0x204001009070c01
mov qword [rsp + 0x1c], rdx
movabs rdx, 0x2100e020e0b0804
mov qword [rsp + 0x24], rdx
movabs rdx, 0xf0102100e020e0b
mov qword [rsp + 0x26], rdx
movabs rdx, 0xe09050b080c0e07
mov qword [rsp + 0x2e], rdx
xor eax, eax
jmp 0x500279
movzx r9d, byte [rsp + rsi + 0x36]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x41]
mov byte [rsp + rdi + 0x36], dl
mov byte [rsp + rsi + 0x36], r8b
add rax, 2
cmp rax, 0x1a
jge 0x5002ab
movzx edx, byte [rsp + rax + 0x1c]
movzx esi, byte [rsp + rax + 0x1d]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x12
jae 0x5002ce
movzx r8d, byte [rsp + rdi + 0x36]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x41]
cmp rsi, 0x12
jb 0x50025f
jmp 0x5002c2
xor eax, eax
lea rbx, [rsp + 0x36]
mov ecx, 0x12
call fcn.0044d560
add rsp, 0x48
pop rbp
ret
mov eax, esi
mov ecx, 0x12
call fcn.00462f80
mov eax, edi
mov ecx, 0x12
call fcn.00462f80
nop
nop dword [rax + rax]
call fcn.00460ca0
jmp fcn.005001e0

Function at 0x501680
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x50177b
push rbp
mov rbp, rsp
sub rsp, 0x48
movabs rdx, 0x3d91f22a35e165d3
mov qword [rsp + 0x34], rdx
movabs rdx, 0x256edb243d91f22a
mov qword [rsp + 0x38], rdx
movabs rdx, 0x196fc1f426991b18
mov qword [rsp + 0x40], rdx
movabs rdx, 0xb040d0007100e07
mov qword [rsp + 0x18], rdx
movabs rdx, 0x60f05021111030d
mov qword [rsp + 0x20], rdx
movabs rdx, 0xf10130c060f0502
mov qword [rsp + 0x24], rdx
movabs rdx, 0x1011091108050207
mov qword [rsp + 0x2c], rdx
xor eax, eax
jmp 0x501719
movzx r9d, byte [rsp + rsi + 0x34]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x27]
mov byte [rsp + rdi + 0x34], dl
mov byte [rsp + rsi + 0x34], r8b
add rax, 2
cmp rax, 0x1c
jge 0x50174b
movzx edx, byte [rsp + rax + 0x18]
movzx esi, byte [rsp + rax + 0x19]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x14
jae 0x50176e
movzx r8d, byte [rsp + rdi + 0x34]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x27]
cmp rsi, 0x14
jb 0x5016ff
jmp 0x501762
xor eax, eax
lea rbx, [rsp + 0x34]
mov ecx, 0x14
call fcn.0044d560
add rsp, 0x48
pop rbp
ret
mov eax, esi
mov ecx, 0x14
call fcn.00462f80
mov eax, edi
mov ecx, 0x14
call fcn.00462f80
nop
nop dword [rax + rax]
call fcn.00460ca0
jmp fcn.00501680
Function at 0x504160
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x50424c
push rbp
mov rbp, rsp
sub rsp, 0x48
movabs rdx, 0x9415283a476c74c4
mov qword [rsp + 0x32], rdx
movabs rdx, 0x6f291f7265f99415
mov qword [rsp + 0x38], rdx
movabs rdx, 0xf77230628e751c2c
mov qword [rsp + 0x40], rdx
movabs rdx, 0x1311050406000705
mov qword [rsp + 0x1c], rdx
movabs rdx, 0xe13070e150f1311
mov qword [rsp + 0x22], rdx
movabs rdx, 0x41308060e0e0b0c
mov qword [rsp + 0x2a], rdx
xor eax, eax
jmp 0x5041ea
movzx r9d, byte [rsp + rsi + 0x32]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x35]
mov byte [rsp + rdi + 0x32], dl
mov byte [rsp + rsi + 0x32], r8b
add rax, 2
cmp rax, 0x16
jge 0x50421c
movzx edx, byte [rsp + rax + 0x1c]
movzx esi, byte [rsp + rax + 0x1d]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x16
jae 0x50423f
movzx r8d, byte [rsp + rdi + 0x32]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x35]
cmp rsi, 0x16
jb 0x5041d0
jmp 0x504233
xor eax, eax
lea rbx, [rsp + 0x32]
mov ecx, 0x16
call fcn.0044d560
add rsp, 0x48
pop rbp
ret
mov eax, esi
mov ecx, 0x16
call fcn.00462f80
mov eax, edi
mov ecx, 0x16
call fcn.00462f80
nop
call fcn.00460ca0
jmp fcn.00504160

Function at 0x504aa0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x504b9b
push rbp
mov rbp, rsp
sub rsp, 0x50
movabs rdx, 0xab9165dcf574c1bc
mov qword [rsp + 0x38], rdx
movabs rdx, 0x684465ab35de8e21
mov qword [rsp + 0x40], rdx
movabs rdx, 0xc2f472aa74e265ae
mov qword [rsp + 0x48], rdx
movabs rdx, 0x412160f01010b0f
mov qword [rsp + 0x18], rdx
movabs rdx, 0x600100308101714
mov qword [rsp + 0x20], rdx
movabs rdx, 0x40a160f0907070b
mov qword [rsp + 0x28], rdx
movabs rdx, 0x40c160310101209
mov qword [rsp + 0x30], rdx
xor eax, eax
jmp 0x504b39
movzx r9d, byte [rsp + rsi + 0x38]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x5e]
mov byte [rsp + rdi + 0x38], dl
mov byte [rsp + rsi + 0x38], r8b
add rax, 2
cmp rax, 0x20
jge 0x504b6b
movzx edx, byte [rsp + rax + 0x18]
movzx esi, byte [rsp + rax + 0x19]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x18
jae 0x504b8e
movzx r8d, byte [rsp + rdi + 0x38]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x5e]
cmp rsi, 0x18
jb 0x504b1f
jmp 0x504b82
xor eax, eax
lea rbx, [rsp + 0x38]
mov ecx, 0x18
call fcn.0044d560
add rsp, 0x50
pop rbp
ret
mov eax, esi
mov ecx, 0x18
call fcn.00462f80
mov eax, edi
mov ecx, 0x18
call fcn.00462f80
nop
nop dword [rax + rax]
call fcn.00460ca0
jmp fcn.00504aa0
Function at 0x505fa0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x506086
push rbp
mov rbp, rsp
sub rsp, 0x38
movabs rdx, 0x6b74647b6d79657a
mov qword [rsp + 0x2b], rdx
movabs rdx, 0x656d5c897c6b7464
mov qword [rsp + 0x30], rdx
movabs rdx, 0x502040006060609
mov qword [rsp + 0x19], rdx
movabs rdx, 0x900050204000606
mov qword [rsp + 0x1b], rdx
movabs rdx, 0x808020a070a0300
mov qword [rsp + 0x23], rdx
xor eax, eax
nop
jmp 0x506020
movzx r9d, byte [rsp + rsi + 0x2b]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x13]
mov byte [rsp + rdi + 0x2b], dl
mov byte [rsp + rsi + 0x2b], r8b
add rax, 2
nop dword [rax]
cmp rax, 0x12
jge 0x506052
movzx edx, byte [rsp + rax + 0x19]
movzx esi, byte [rsp + rax + 0x1a]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0xd
jae 0x506077
movzx r8d, byte [rsp + rdi + 0x2b]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x13]
cmp rsi, 0xd
jb 0x506002
jmp 0x50606b
xor eax, eax
lea rbx, [rsp + 0x2b]
mov ecx, 0xd
nop
call fcn.0044d560
add rsp, 0x38
pop rbp
ret
mov eax, esi
mov ecx, 0xd
call fcn.00462f80
mov eax, edi
mov ecx, 0xd
nop
call fcn.00462f80
nop
call fcn.00460ca0
jmp fcn.00505fa0

Function at 0x508000
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x5080ca
push rbp
mov rbp, rsp
sub rsp, 0x48
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rbx
mov qword [rsp], rax
mov qword [rsp + 8], rbx
mov byte [rsp + 0x10], 0
call fcn.004035e0
xorps xmm15, xmm15
mov r14, qword [0x006f38f0]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x18], 0xffffffffffffffff
jne 0x5080af
mov rcx, qword [rsp + 0x60]
lea rdx, [rcx + 1]
mov qword [rsp + 0x40], rdx
lea rax, [0x00562c20]
xor ebx, ebx
mov rcx, rdx
call fcn.004493e0
mov rbx, qword [rsp + 0x60]
mov rcx, rax
xor edi, edi
mov rsi, qword [rsp + 0x40]
mov rax, qword [rsp + 0x58]
nop dword [rax]
call fcn.00508600
inc rbx
cmp rcx, rbx
jae 0x50809e
mov edi, 1
lea rsi, [0x00562c20]
call fcn.004494c0
mov word [rax + rbx*2 - 2], 0
xor edi, edi
xor esi, esi
add rsp, 0x48
pop rbp
ret
xor eax, eax
xor ebx, ebx
mov rcx, rbx
lea rdi, [0x005a8df8]
lea rsi, [0x005a8930]
add rsp, 0x48
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.00460ca0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.00508000
Function at 0x50a620
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x50a6fd
push rbp
mov rbp, rsp
sub rsp, 0x40
movabs rdx, 0x8364817c317a297d
mov qword [rsp + 0x32], rdx
movabs rdx, 0x798a738969278364
mov qword [rsp + 0x38], rdx
movabs rdx, 0x30b00020b0905
mov qword [rsp + 0x1e], rdx
movabs rdx, 0xd08020900030b00
mov qword [rsp + 0x22], rdx
movabs rdx, 0x70c0100000a0b04
mov qword [rsp + 0x2a], rdx
xor eax, eax
nop
jmp 0x50a6a0
movzx r9d, byte [rsp + rsi + 0x32]
sub r9d, edx
lea edx, [r9 + 8]
mov byte [rsp + rdi + 0x32], dl
lea edx, [r8 + 8]
mov byte [rsp + rsi + 0x32], dl
add rax, 2
nop
cmp rax, 0x14
jge 0x50a6cd
movzx edx, byte [rsp + rax + 0x1e]
movzx esi, byte [rsp + rax + 0x1f]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0xe
jae 0x50a6f0
movzx r8d, byte [rsp + rdi + 0x32]
sub r8d, edx
cmp rsi, 0xe
jb 0x50a682
jmp 0x50a6e4
xor eax, eax
lea rbx, [rsp + 0x32]
mov ecx, 0xe
call fcn.0044d560
add rsp, 0x40
pop rbp
ret
mov eax, esi
mov ecx, 0xe
call fcn.00462f80
mov eax, edi
mov ecx, 0xe
call fcn.00462f80
nop
nop dword [rax]
call fcn.00460ca0
jmp fcn.0050a620

Function at 0x50b6e0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x50b7a7
push rbp
mov rbp, rsp
sub rsp, 0x38
movabs rdx, 0x32aef0702f1a2aec
mov qword [rsp + 0x2c], rdx
mov dword [rsp + 0x34], 0xae6ce627
movabs rdx, 0x3020106010b0900
mov qword [rsp + 0x1e], rdx
movabs rdx, 0x9050901080302
mov qword [rsp + 0x24], rdx
xor eax, eax
jmp 0x50b748
movzx r9d, byte [rsp + rsi + 0x2c]
sub r9d, edx
lea edx, [r9 + 0x4e]
mov byte [rsp + rdi + 0x2c], dl
lea edx, [r8 + 0x4e]
mov byte [rsp + rsi + 0x2c], dl
add rax, 2
cmp rax, 0xe
jge 0x50b777
movzx edx, byte [rsp + rax + 0x1e]
movzx esi, byte [rsp + rax + 0x1f]
mov edi, edx
xor edx, esi
add edx, eax
nop
cmp rdi, 0xc
jae 0x50b79a
movzx r8d, byte [rsp + rdi + 0x2c]
sub r8d, edx
cmp rsi, 0xc
jb 0x50b72b
jmp 0x50b78e
xor eax, eax
lea rbx, [rsp + 0x2c]
mov ecx, 0xc
call fcn.0044d560
add rsp, 0x38
pop rbp
ret
mov eax, esi
mov ecx, 0xc
call fcn.00462f80
mov eax, edi
mov ecx, 0xc
call fcn.00462f80
nop
call fcn.00460ca0
jmp fcn.0050b6e0
Function at 0x50c560
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x50c64c
push rbp
mov rbp, rsp
sub rsp, 0x40
movabs rdx, 0xce6761fde1980352
mov qword [rsp + 0x2f], rdx
movabs rdx, 0x3cce6761fde19803
mov qword [rsp + 0x30], rdx
movabs rdx, 0x578d6eeb72f8a1d2
mov qword [rsp + 0x38], rdx
movabs rdx, 0x40102010f0a0208
mov qword [rsp + 0x1d], rdx
movabs rdx, 0x80d040102010f0a
mov qword [rsp + 0x1f], rdx
movabs rdx, 0x9070b0f0a03060a
mov qword [rsp + 0x27], rdx
xor eax, eax
jmp 0x50c5ea
movzx r9d, byte [rsp + rsi + 0x2f]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x5d]
mov byte [rsp + rdi + 0x2f], dl
mov byte [rsp + rsi + 0x2f], r8b
add rax, 2
cmp rax, 0x12
jge 0x50c61c
movzx edx, byte [rsp + rax + 0x1d]
movzx esi, byte [rsp + rax + 0x1e]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x11
jae 0x50c63f
movzx r8d, byte [rsp + rdi + 0x2f]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x5d]
cmp rsi, 0x11
jb 0x50c5d0
jmp 0x50c633
xor eax, eax
lea rbx, [rsp + 0x2f]
mov ecx, 0x11
call fcn.0044d560
add rsp, 0x40
pop rbp
ret
mov eax, esi
mov ecx, 0x11
call fcn.00462f80
mov eax, edi
mov ecx, 0x11
call fcn.00462f80
nop
call fcn.00460ca0
jmp fcn.0050c560

Function at 0x50ca60
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x50cb1d
push rbp
mov rbp, rsp
sub rsp, 0x30
movabs rdx, 0xf4647365b1b596b8
mov qword [rsp + 0x27], rdx
mov byte [rsp + 0x2f], 0xa6
movabs rdx, 0x308020000070000
mov qword [rsp + 0x1b], rdx
mov dword [rsp + 0x23], 0x201
xor eax, eax
nop
jmp 0x50cac0
movzx r9d, byte [rsp + rsi + 0x27]
sub r9d, edx
lea edx, [r9 - 0x27]
mov byte [rsp + rdi + 0x27], dl
lea edx, [r8 - 0x27]
mov byte [rsp + rsi + 0x27], dl
add rax, 2
nop
cmp rax, 0xc
jge 0x50caed
movzx edx, byte [rsp + rax + 0x1b]
movzx esi, byte [rsp + rax + 0x1c]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 9
jae 0x50cb10
movzx r8d, byte [rsp + rdi + 0x27]
sub r8d, edx
cmp rsi, 9
jb 0x50caa2
jmp 0x50cb04
xor eax, eax
lea rbx, [rsp + 0x27]
mov ecx, 9
call fcn.0044d560
add rsp, 0x30
pop rbp
ret
mov eax, esi
mov ecx, 9
call fcn.00462f80
mov eax, edi
mov ecx, 9
call fcn.00462f80
nop
nop dword [rax]
call fcn.00460ca0
jmp fcn.0050ca60

Function at 0x50d2a0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x50d358
push rbp
mov rbp, rsp
sub rsp, 0x30
movabs rdx, 0xe9281b6d08e7341f
mov qword [rsp + 0x28], rdx
movabs rdx, 0x102050500030607
mov qword [rsp + 0x1e], rdx
mov word [rsp + 0x26], 0x106
xor eax, eax
jmp 0x50d2f8
movzx r9d, byte [rsp + rsi + 0x28]
sub r9d, edx
lea edx, [r9 + 0x4b]
mov byte [rsp + rdi + 0x28], dl
lea edx, [r8 + 0x4b]
mov byte [rsp + rsi + 0x28], dl
add rax, 2
cmp rax, 0xa
jge 0x50d328
movzx edx, byte [rsp + rax + 0x1e]
movzx esi, byte [rsp + rax + 0x1f]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 8
jae 0x50d34b
movzx r8d, byte [rsp + rdi + 0x28]
sub r8d, edx
nop dword [rax]
cmp rsi, 8
jb 0x50d2db
jmp 0x50d33f
xor eax, eax
lea rbx, [rsp + 0x28]
mov ecx, 8
call fcn.0044d560
add rsp, 0x30
pop rbp
ret
mov eax, esi
mov ecx, 8
call fcn.00462f80
mov eax, edi
mov ecx, 8
call fcn.00462f80
nop
call fcn.00460ca0
nop dword [rax]
jmp fcn.0050d2a0
Function at 0x50d680
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x50d788
push rbp
mov rbp, rsp
sub rsp, 0x58
movabs rdx, 0xa269a29ba5a90174
mov qword [rsp + 0x3d], rdx
movabs rdx, 0xc76ca38a9f6c61ad
mov qword [rsp + 0x45], rdx
movabs rdx, 0xc7e763c76ca38a9f
mov qword [rsp + 0x48], rdx
movabs rdx, 0x5d6d61c92067a7a1
mov qword [rsp + 0x50], rdx
movabs rdx, 0xf1117170b120107
mov qword [rsp + 0x1f], rdx
movabs rdx, 0x51a150411010c0f
mov qword [rsp + 0x27], rdx
movabs rdx, 0x14020b071708051a
mov qword [rsp + 0x2d], rdx
movabs rdx, 0x3130c0c0b0c110d
mov qword [rsp + 0x35], rdx
xor eax, eax
jmp 0x50d72b
movzx r9d, byte [rsp + rsi + 0x3d]
sub r9d, edx
lea edx, [r9 - 0x10]
mov byte [rsp + rdi + 0x3d], dl
lea edx, [r8 - 0x10]
mov byte [rsp + rsi + 0x3d], dl
add rax, 2
cmp rax, 0x1e
jge 0x50d758
movzx edx, byte [rsp + rax + 0x1f]
movzx esi, byte [rsp + rax + 0x20]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x1b
jae 0x50d77b
movzx r8d, byte [rsp + rdi + 0x3d]
sub r8d, edx
cmp rsi, 0x1b
jb 0x50d70e
jmp 0x50d76f
xor eax, eax
lea rbx, [rsp + 0x3d]
mov ecx, 0x1b
call fcn.0044d560
add rsp, 0x58
pop rbp
ret
mov eax, esi
mov ecx, 0x1b
call fcn.00462f80
mov eax, edi
mov ecx, 0x1b
call fcn.00462f80
nop
call fcn.00460ca0
jmp fcn.0050d680

Function at 0x50e0a0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x50e1a8
push rbp
mov rbp, rsp
sub rsp, 0x58
movabs rdx, 0xc9fd2016b87357fe
mov qword [rsp + 0x3f], rdx
movabs rdx, 0x46a8f85320cb8d64
mov qword [rsp + 0x47], rdx
movabs rdx, 0x6446a8f85320cb8d
mov qword [rsp + 0x48], rdx
movabs rdx, 0x650969a12007720e
mov qword [rsp + 0x50], rdx
movabs rdx, 0x1301041102130009
mov qword [rsp + 0x1f], rdx
movabs rdx, 0xe0d011706150f0e
mov qword [rsp + 0x27], rdx
movabs rdx, 0x150e15130a11170a
mov qword [rsp + 0x2f], rdx
movabs rdx, 0x110201090d070403
mov qword [rsp + 0x37], rdx
xor eax, eax
jmp 0x50e14b
movzx r9d, byte [rsp + rsi + 0x3f]
sub r9d, edx
lea edx, [r9 - 0x31]
mov byte [rsp + rdi + 0x3f], dl
lea edx, [r8 - 0x31]
mov byte [rsp + rsi + 0x3f], dl
add rax, 2
cmp rax, 0x20
jge 0x50e178
movzx edx, byte [rsp + rax + 0x1f]
movzx esi, byte [rsp + rax + 0x20]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x19
jae 0x50e19b
movzx r8d, byte [rsp + rdi + 0x3f]
sub r8d, edx
cmp rsi, 0x19
jb 0x50e12e
jmp 0x50e18f
xor eax, eax
lea rbx, [rsp + 0x3f]
mov ecx, 0x19
call fcn.0044d560
add rsp, 0x58
pop rbp
ret
mov eax, esi
mov ecx, 0x19
call fcn.00462f80
mov eax, edi
mov ecx, 0x19
call fcn.00462f80
nop
call fcn.00460ca0
jmp fcn.0050e0a0
Function at 0x50e2c0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x50e3dd
push rbp
mov rbp, rsp
sub rsp, 0x60
movabs rdx, 0xa9746eaad9f4b495
mov qword [rsp + 0x41], rdx
movabs rdx, 0x61ffbf04165e1fe
mov qword [rsp + 0x49], rdx
movabs rdx, 0xd26e617453ec8b06
mov qword [rsp + 0x50], rdx
movabs rdx, 0x75f06842ccf20eb0
mov qword [rsp + 0x58], rdx
movabs rdx, 0x1b0d1b0a091c101a
mov qword [rsp + 0x19], rdx
movabs rdx, 0x10318090a000402
mov qword [rsp + 0x21], rdx
movabs rdx, 0x190c0107091e1b16
mov qword [rsp + 0x29], rdx
movabs rdx, 0xe16080702170904
mov qword [rsp + 0x31], rdx
movabs rdx, 0x1d0f1117091e1d16
mov qword [rsp + 0x39], rdx
xor eax, eax
jmp 0x50e380
movzx r9d, byte [rsp + rsi + 0x41]
sub r9d, edx
lea edx, [r9 - 0x61]
mov byte [rsp + rdi + 0x41], dl
lea edx, [r8 - 0x61]
mov byte [rsp + rsi + 0x41], dl
add rax, 2
nop word [rax + rax]
cmp rax, 0x28
jge 0x50e3ad
movzx edx, byte [rsp + rax + 0x19]
movzx esi, byte [rsp + rax + 0x1a]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x1f
jae 0x50e3d0
movzx r8d, byte [rsp + rdi + 0x41]
sub r8d, edx
cmp rsi, 0x1f
jb 0x50e35d
jmp 0x50e3c4
xor eax, eax
lea rbx, [rsp + 0x41]
mov ecx, 0x1f
call fcn.0044d560
add rsp, 0x60
pop rbp
ret
mov eax, esi
mov ecx, 0x1f
call fcn.00462f80
mov eax, edi
mov ecx, 0x1f
call fcn.00462f80
nop
nop dword [rax]
call fcn.00460ca0
jmp fcn.0050e2c0

Function at 0x50ffe0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x5100dd
push rbp
mov rbp, rsp
sub rsp, 0x50
movabs rdx, 0x4604a86ecf0a6f9f
mov qword [rsp + 0x39], rdx
movabs rdx, 0x2140007424ca2046
mov qword [rsp + 0x40], rdx
movabs rdx, 0x65ed2af520112561
mov qword [rsp + 0x48], rdx
movabs rdx, 0x70c15130d0c1113
mov qword [rsp + 0x1d], rdx
movabs rdx, 0x60214080e150500
mov qword [rsp + 0x25], rdx
movabs rdx, 0xa05000c06021408
mov qword [rsp + 0x29], rdx
movabs rdx, 0x30700000903100e
mov qword [rsp + 0x31], rdx
xor eax, eax
jmp 0x510080
movzx r9d, byte [rsp + rsi + 0x39]
sub r9d, edx
lea edx, [r9 + 0x71]
mov byte [rsp + rdi + 0x39], dl
lea edx, [r8 + 0x71]
mov byte [rsp + rsi + 0x39], dl
add rax, 2
nop dword [rax]
cmp rax, 0x1c
jge 0x5100ad
movzx edx, byte [rsp + rax + 0x1d]
movzx esi, byte [rsp + rax + 0x1e]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x17
jae 0x5100d0
movzx r8d, byte [rsp + rdi + 0x39]
sub r8d, edx
cmp rsi, 0x17
jb 0x51005f
jmp 0x5100c4
xor eax, eax
lea rbx, [rsp + 0x39]
mov ecx, 0x17
call fcn.0044d560
add rsp, 0x50
pop rbp
ret
mov eax, esi
mov ecx, 0x17
call fcn.00462f80
mov eax, edi
mov ecx, 0x17
call fcn.00462f80
nop
nop dword [rax]
call fcn.00460ca0
jmp fcn.0050ffe0
Function at 0x510ce0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x510ddb
push rbp
mov rbp, rsp
sub rsp, 0x50
movabs rdx, 0x476995ba7fa17241
mov qword [rsp + 0x39], rdx
movabs rdx, 0x946ec39aacb06147
mov qword [rsp + 0x40], rdx
movabs rdx, 0x8af16f9b20a699ad
mov qword [rsp + 0x48], rdx
movabs rdx, 0xe0213160b0f0410
mov qword [rsp + 0x1d], rdx
movabs rdx, 0x1115070c09070a11
mov qword [rsp + 0x25], rdx
movabs rdx, 0x3110a151115070c
mov qword [rsp + 0x29], rdx
movabs rdx, 0xe14101505070315
mov qword [rsp + 0x31], rdx
xor eax, eax
jmp 0x510d79
movzx r9d, byte [rsp + rsi + 0x39]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x3f]
mov byte [rsp + rdi + 0x39], dl
mov byte [rsp + rsi + 0x39], r8b
add rax, 2
cmp rax, 0x1c
jge 0x510dab
movzx edx, byte [rsp + rax + 0x1d]
movzx esi, byte [rsp + rax + 0x1e]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x17
jae 0x510dce
movzx r8d, byte [rsp + rdi + 0x39]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x3f]
cmp rsi, 0x17
jb 0x510d5f
jmp 0x510dc2
xor eax, eax
lea rbx, [rsp + 0x39]
mov ecx, 0x17
call fcn.0044d560
add rsp, 0x50
pop rbp
ret
mov eax, esi
mov ecx, 0x17
call fcn.00462f80
mov eax, edi
mov ecx, 0x17
call fcn.00462f80
nop
nop dword [rax + rax]
call fcn.00460ca0
jmp fcn.00510ce0

Function at 0x511400
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x5114fd
push rbp
mov rbp, rsp
sub rsp, 0x50
movabs rdx, 0xf3e49de4a1856543
mov qword [rsp + 0x3b], rdx
movabs rdx, 0xcdd47e92c5f3e49d
mov qword [rsp + 0x40], rdx
movabs rdx, 0x7ee595a2f37d728c
mov qword [rsp + 0x48], rdx
movabs rdx, 0x512110414140a0f
mov qword [rsp + 0x1d], rdx
movabs rdx, 0xb070f1008021306
mov qword [rsp + 0x25], rdx
movabs rdx, 0x708070b0d0c0b07
mov qword [rsp + 0x2b], rdx
movabs rdx, 0x2110f031306090d
mov qword [rsp + 0x33], rdx
xor eax, eax
jmp 0x5114a0
movzx r9d, byte [rsp + rsi + 0x3b]
sub r9d, edx
lea edx, [r9 - 0x17]
mov byte [rsp + rdi + 0x3b], dl
lea edx, [r8 - 0x17]
mov byte [rsp + rsi + 0x3b], dl
add rax, 2
nop dword [rax]
cmp rax, 0x1e
jge 0x5114cd
movzx edx, byte [rsp + rax + 0x1d]
movzx esi, byte [rsp + rax + 0x1e]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x15
jae 0x5114f0
movzx r8d, byte [rsp + rdi + 0x3b]
sub r8d, edx
cmp rsi, 0x15
jb 0x51147f
jmp 0x5114e4
xor eax, eax
lea rbx, [rsp + 0x3b]
mov ecx, 0x15
call fcn.0044d560
add rsp, 0x50
pop rbp
ret
mov eax, esi
mov ecx, 0x15
call fcn.00462f80
mov eax, edi
mov ecx, 0x15
call fcn.00462f80
nop
nop dword [rax]
call fcn.00460ca0
jmp fcn.00511400