joyce8/EMBER2024-capa huggingface dataset:
Function at 0x47e5c0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x47e6da
push rbp
mov rbp, rsp
sub rsp, 0x60
movabs rdx, 0xe8e3a39a966fabc
mov qword [rsp + 0x18], rdx
movabs rdx, 0x750f3b0f0bee5176
mov qword [rsp + 0x20], rdx
movabs rdx, 0x1557a6610fe2d73
mov qword [rsp + 0x28], rdx
movabs rdx, 0x65d475526461039d
mov qword [rsp + 0x30], rdx
movabs rdx, 0x70b0e1318180913
mov qword [rsp + 0x38], rdx
movabs rdx, 0x19110c040e000e11
mov qword [rsp + 0x40], rdx
movabs rdx, 0x815131701180d
mov qword [rsp + 0x48], rdx
movabs rdx, 0x1812130a0d130606
mov qword [rsp + 0x50], rdx
movabs rdx, 0x306001e0c151919
mov qword [rsp + 0x58], rdx
xor eax, eax
jmp 0x47e677
movzx r9d, byte [rsp + rsi + 0x18]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x4c]
mov byte [rsp + rdi + 0x18], dl
mov byte [rsp + rsi + 0x18], r8b
add rax, 2
cmp rax, 0x28
jge 0x47e6a9
movzx edx, byte [rsp + rax + 0x38]
movzx esi, byte [rsp + rax + 0x39]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x20
jae 0x47e6cd
movzx r8d, byte [rsp + rdi + 0x18]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x4c]
cmp rsi, 0x20
jb 0x47e65d
jmp 0x47e6c1
xor eax, eax
lea rbx, [rsp + 0x18]
mov ecx, 0x20
call fcn.0044bb20
add rsp, 0x60
pop rbp
nop
ret
mov eax, esi
mov ecx, 0x20
call fcn.00461020
mov eax, edi
mov ecx, 0x20
call fcn.00461020
nop
call fcn.0045eda0
nop
jmp fcn.0047e5c0

Function at 0x47e700
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x47e7ea
push rbp
mov rbp, rsp
sub rsp, 0x40
movabs rdx, 0x9c2035b969cf1a62
mov qword [rsp + 0x2e], rdx
movabs rdx, 0xd8ba9c2035b969cf
mov qword [rsp + 0x30], rdx
movabs rdx, 0xcfcf756620726566
mov qword [rsp + 0x38], rdx
movabs rdx, 0x1011070501080409
mov qword [rsp + 0x1c], rdx
movabs rdx, 0x109101107050108
mov qword [rsp + 0x1e], rdx
movabs rdx, 0x909010907020801
mov qword [rsp + 0x26], rdx
xor eax, eax
jmp 0x47e78d
movzx r9d, byte [rsp + rsi + 0x2e]
sub r9d, edx
lea edx, [r9 - 0x5c]
mov byte [rsp + rdi + 0x2e], dl
lea edx, [r8 - 0x5c]
mov byte [rsp + rsi + 0x2e], dl
add rax, 2
cmp rax, 0x12
jge 0x47e7ba
movzx edx, byte [rsp + rax + 0x1c]
movzx esi, byte [rsp + rax + 0x1d]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x12
jae 0x47e7dd
movzx r8d, byte [rsp + rdi + 0x2e]
sub r8d, edx
cmp rsi, 0x12
jb 0x47e770
jmp 0x47e7d1
xor eax, eax
lea rbx, [rsp + 0x2e]
mov ecx, 0x12
call fcn.0044bb20
add rsp, 0x40
pop rbp
ret
mov eax, esi
mov ecx, 0x12
call fcn.00461020
mov eax, edi
mov ecx, 0x12
call fcn.00461020
nop
call fcn.0045eda0
jmp fcn.0047e700
Function at 0x4816a0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
lea r12, [rsp - 0x70]
cmp r12, qword [r14 + 0x10]
jbe 0x481872
push rbp
mov rbp, rsp
sub rsp, 0xe8
movups xmmword [rsp + 0xf8], xmm15
movups xmmword [rsp + 0x108], xmm15
movups xmmword [rsp + 0x118], xmm15
movups xmmword [rsp + 0x128], xmm15
movabs rdx, 0x97e751398e384206
mov qword [rsp + 0x50], rdx
movabs rdx, 0x47a1dff6c2a89ed
mov qword [rsp + 0x58], rdx
movabs rdx, 0x712416d116850963
mov qword [rsp + 0x60], rdx
movabs rdx, 0x570b0187821f535
mov qword [rsp + 0x68], rdx
movabs rdx, 0x10986e121b3019b3
mov qword [rsp + 0x70], rdx
movabs rdx, 0x4cc64884858376be
mov qword [rsp + 0x78], rdx
movabs rdx, 0xe246b622b9546236
mov qword [rsp + 0x80], rdx
movabs rdx, 0x3dc2087bca7ab845
mov qword [rsp + 0x88], rdx
movabs rdx, 0x72b0e3338380913
mov qword [rsp + 0x90], rdx
lea rdi, [rsp + 0x98]
lea rsi, [0x006d9e40]
nop dword [rax]
mov qword [rsp - 0x10], rbp
lea rbp, [rsp - 0x10]
call fcn.0046165a
mov rbp, qword [rbp]
xor eax, eax
jmp 0x4817b1
movzx r8d, byte [rsp + rbx + 0x50]
lea edx, [r8 + rdx]
lea edx, [rdx + 0x4c]
mov byte [rsp + rsi + 0x50], dl
mov byte [rsp + rbx + 0x50], dil
add rax, 2
cmp rax, 0x58
jge 0x4817ea
movzx edx, byte [rsp + rax + 0x90]
movzx ebx, byte [rsp + rax + 0x91]
mov esi, edx
xor edx, ebx
add edx, eax
cmp rsi, 0x40
jae 0x481865
movzx edi, byte [rsp + rsi + 0x50]
lea edi, [rdi + rdx]
lea edi, [rdi + 0x4c]
cmp rbx, 0x40
jb 0x481797
jmp 0x481855
movups xmmword [rsp + 0x10], xmm15
movups xmmword [rsp + 0x20], xmm15
movups xmmword [rsp + 0x30], xmm15
movups xmmword [rsp + 0x40], xmm15
xor eax, eax
jmp 0x481812
movzx ecx, byte [rsp + rax + 0x50]
mov byte [rsp + rax + 0x10], cl
inc rax
cmp rax, 0x40
jl 0x481806
movups xmm0, xmmword [rsp + 0x10]
movups xmmword [rsp + 0xf8], xmm0
movups xmm0, xmmword [rsp + 0x20]
movups xmmword [rsp + 0x108], xmm0
movups xmm0, xmmword [rsp + 0x30]
movups xmmword [rsp + 0x118], xmm0
movups xmm0, xmmword [rsp + 0x40]
movups xmmword [rsp + 0x128], xmm0
add rsp, 0xe8
pop rbp
ret
mov eax, ebx
mov ecx, 0x40
nop dword [rax]
call fcn.00461020
mov eax, esi
mov ecx, 0x40
call fcn.00461020
nop
call fcn.0045eda0
jmp fcn.004816a0
Function at 0x483760
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x48383d
push rbp
mov rbp, rsp
sub rsp, 0x38
movabs rdx, 0xb6aa3fa09e86b969
mov qword [rsp + 0x18], rdx
movabs rdx, 0xe99b996e88bcb6aa
mov qword [rsp + 0x1e], rdx
movabs rdx, 0x903010d0c020906
mov qword [rsp + 0x26], rdx
movabs rdx, 0x7050903010d0c02
mov qword [rsp + 0x28], rdx
movabs rdx, 0x501080b08010d04
mov qword [rsp + 0x30], rdx
xor eax, eax
nop
jmp 0x4837e0
movzx r9d, byte [rsp + rsi + 0x18]
sub r9d, edx
lea edx, [r9 - 0x15]
mov byte [rsp + rdi + 0x18], dl
lea edx, [r8 - 0x15]
mov byte [rsp + rsi + 0x18], dl
add rax, 2
nop
cmp rax, 0x12
jge 0x48380d
movzx edx, byte [rsp + rax + 0x26]
movzx esi, byte [rsp + rax + 0x27]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0xe
jae 0x483830
movzx r8d, byte [rsp + rdi + 0x18]
sub r8d, edx
cmp rsi, 0xe
jb 0x4837c2
jmp 0x483824
xor eax, eax
lea rbx, [rsp + 0x18]
mov ecx, 0xe
call fcn.0044bb20
add rsp, 0x38
pop rbp
ret
mov eax, esi
mov ecx, 0xe
call fcn.00461020
mov eax, edi
mov ecx, 0xe
call fcn.00461020
nop
nop dword [rax]
call fcn.0045eda0
jmp fcn.00483760

Function at 0x485d40
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x485e12
push rbp
mov rbp, rsp
sub rsp, 0x38
movabs rdx, 0x38372e3930352f2b
mov qword [rsp + 0x1f], rdx
movabs rdx, 0x372f2338372e3930
mov qword [rsp + 0x22], rdx
movabs rdx, 0x9050a0308050a03
mov qword [rsp + 0x2a], rdx
movabs rdx, 0x301090004070905
mov qword [rsp + 0x30], rdx
xor eax, eax
jmp 0x485dac
movzx r9d, byte [rsp + rsi + 0x1f]
lea edx, [r9 + rdx]
lea edx, [rdx - 0xc]
mov byte [rsp + rdi + 0x1f], dl
mov byte [rsp + rsi + 0x1f], r8b
add rax, 2
cmp rax, 0xe
jge 0x485dde
movzx edx, byte [rsp + rax + 0x2a]
movzx esi, byte [rsp + rax + 0x2b]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0xb
jae 0x485e05
movzx r8d, byte [rsp + rdi + 0x1f]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0xc]
cmp rsi, 0xb
jb 0x485d92
jmp 0x485df5
xor eax, eax
lea rbx, [rsp + 0x1f]
mov ecx, 0xb
call fcn.0044bb20
add rsp, 0x38
pop rbp
ret
mov eax, esi
mov ecx, 0xb
nop dword [rax]
call fcn.00461020
mov eax, edi
mov ecx, 0xb
call fcn.00461020
nop
call fcn.0045eda0
jmp fcn.00485d40
Function at 0x4873a0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x48749d
push rbp
mov rbp, rsp
sub rsp, 0x50
movabs rdx, 0x373532053374d872
mov qword [rsp + 0x1f], rdx
movabs rdx, 0x3435ab9ea6373532
mov qword [rsp + 0x24], rdx
movabs rdx, 0xd6798ac331b3bd06
mov qword [rsp + 0x2c], rdx
movabs rdx, 0xe01020d0d090101
mov qword [rsp + 0x34], rdx
movabs rdx, 0xa0f09110114080a
mov qword [rsp + 0x3c], rdx
movabs rdx, 0x4000a0e0a0f0911
mov qword [rsp + 0x40], rdx
movabs rdx, 0x112131109080011
mov qword [rsp + 0x48], rdx
xor eax, eax
jmp 0x487440
movzx r9d, byte [rsp + rsi + 0x1f]
sub r9d, edx
lea edx, [r9 - 0x2a]
mov byte [rsp + rdi + 0x1f], dl
lea edx, [r8 - 0x2a]
mov byte [rsp + rsi + 0x1f], dl
add rax, 2
nop dword [rax]
cmp rax, 0x1c
jge 0x48746d
movzx edx, byte [rsp + rax + 0x34]
movzx esi, byte [rsp + rax + 0x35]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x15
jae 0x487490
movzx r8d, byte [rsp + rdi + 0x1f]
sub r8d, edx
cmp rsi, 0x15
jb 0x48741f
jmp 0x487484
xor eax, eax
lea rbx, [rsp + 0x1f]
mov ecx, 0x15
call fcn.0044bb20
add rsp, 0x50
pop rbp
ret
mov eax, esi
mov ecx, 0x15
call fcn.00461020
mov eax, edi
mov ecx, 0x15
call fcn.00461020
nop
nop dword [rax]
call fcn.0045eda0
jmp fcn.004873a0

Function at 0x487dc0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x487eda
push rbp
mov rbp, rsp
sub rsp, 0x58
movabs rdx, 0xaf4c3868d1c03993
mov qword [rsp + 0x1b], rdx
movabs rdx, 0x7f50636a5f36b482
mov qword [rsp + 0x23], rdx
movabs rdx, 0xc77f50636a5f36b4
mov qword [rsp + 0x24], rdx
movabs rdx, 0x5b5157388b737b36
mov qword [rsp + 0x2c], rdx
movabs rdx, 0x309000203100d
mov qword [rsp + 0x34], rdx
movabs rdx, 0x140f0c0700030900
mov qword [rsp + 0x38], rdx
movabs rdx, 0x120e180d14081609
mov qword [rsp + 0x40], rdx
movabs rdx, 0x1314040b0b020c17
mov qword [rsp + 0x48], rdx
movabs rdx, 0x6170f0e0b141817
mov qword [rsp + 0x50], rdx
xor eax, eax
jmp 0x487e77
movzx r9d, byte [rsp + rsi + 0x1b]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x4d]
mov byte [rsp + rdi + 0x1b], dl
mov byte [rsp + rsi + 0x1b], r8b
add rax, 2
cmp rax, 0x24
jge 0x487ea9
movzx edx, byte [rsp + rax + 0x34]
movzx esi, byte [rsp + rax + 0x35]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x19
jae 0x487ecd
movzx r8d, byte [rsp + rdi + 0x1b]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x4d]
cmp rsi, 0x19
jb 0x487e5d
jmp 0x487ec1
xor eax, eax
lea rbx, [rsp + 0x1b]
mov ecx, 0x19
call fcn.0044bb20
add rsp, 0x58
pop rbp
nop
ret
mov eax, esi
mov ecx, 0x19
call fcn.00461020
mov eax, edi
mov ecx, 0x19
call fcn.00461020
nop
call fcn.0045eda0
nop
jmp fcn.00487dc0
Function at 0x487f00
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x488008
push rbp
mov rbp, rsp
sub rsp, 0x50
movabs rdx, 0x7b4d3f313535485e
mov qword [rsp + 0x18], rdx
movabs rdx, 0x7357375d3a445f54
mov qword [rsp + 0x20], rdx
movabs rdx, 0x383a7357375d3a44
mov qword [rsp + 0x22], rdx
movabs rdx, 0x44446a627536663d
mov qword [rsp + 0x2a], rdx
movabs rdx, 0x91310180d0b1605
mov qword [rsp + 0x32], rdx
movabs rdx, 0x10120c0a17061319
mov qword [rsp + 0x3a], rdx
movabs rdx, 0x708090115061012
mov qword [rsp + 0x40], rdx
movabs rdx, 0xe0008050f05060a
mov qword [rsp + 0x48], rdx
xor eax, eax
jmp 0x487fab
movzx r9d, byte [rsp + rsi + 0x18]
sub r9d, edx
lea edx, [r9 + 4]
mov byte [rsp + rdi + 0x18], dl
lea edx, [r8 + 4]
mov byte [rsp + rsi + 0x18], dl
add rax, 2
cmp rax, 0x1e
jge 0x487fd8
movzx edx, byte [rsp + rax + 0x32]
movzx esi, byte [rsp + rax + 0x33]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x1a
jae 0x487ffb
movzx r8d, byte [rsp + rdi + 0x18]
sub r8d, edx
cmp rsi, 0x1a
jb 0x487f8e
jmp 0x487fef
xor eax, eax
lea rbx, [rsp + 0x18]
mov ecx, 0x1a
call fcn.0044bb20
add rsp, 0x50
pop rbp
ret
mov eax, esi
mov ecx, 0x1a
call fcn.00461020
mov eax, edi
mov ecx, 0x1a
call fcn.00461020
nop
call fcn.0045eda0
jmp fcn.00487f00

Function at 0x48b9a0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x48bad8
push rbp
mov rbp, rsp
sub rsp, 0x70
movabs rdx, 0x92f3ef7fa5a296a5
mov qword [rsp + 0x1a], rdx
movabs rdx, 0x669e9792349492f3
mov qword [rsp + 0x20], rdx
movabs rdx, 0x94320ea66cb6f7bf
mov qword [rsp + 0x28], rdx
movabs rdx, 0x3992fd7daf07e836
mov qword [rsp + 0x30], rdx
movabs rdx, 0x351ce2331986384b
mov qword [rsp + 0x38], rdx
movabs rdx, 0x2310191312001821
mov qword [rsp + 0x40], rdx
movabs rdx, 0x20c1c070e201e1b
mov qword [rsp + 0x48], rdx
movabs rdx, 0x1808100601150305
mov qword [rsp + 0x50], rdx
movabs rdx, 0x1120031b03172403
mov qword [rsp + 0x58], rdx
movabs rdx, 0xd230f0b1019041e
mov qword [rsp + 0x60], rdx
movabs rdx, 0x317081a21080a0b
mov qword [rsp + 0x68], rdx
xor eax, eax
jmp 0x48ba75
movzx r9d, byte [rsp + rsi + 0x1a]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x77]
mov byte [rsp + rdi + 0x1a], dl
mov byte [rsp + rsi + 0x1a], r8b
add rax, 2
cmp rax, 0x30
jge 0x48baa8
movzx edx, byte [rsp + rax + 0x40]
movzx esi, byte [rsp + rax + 0x41]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x26
jae 0x48bacb
movzx r8d, byte [rsp + rdi + 0x1a]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x77]
nop
cmp rsi, 0x26
jb 0x48ba5b
jmp 0x48babf
xor eax, eax
lea rbx, [rsp + 0x1a]
mov ecx, 0x26
call fcn.0044bb20
add rsp, 0x70
pop rbp
ret
mov eax, esi
mov ecx, 0x26
call fcn.00461020
mov eax, edi
mov ecx, 0x26
call fcn.00461020
nop
call fcn.0045eda0
nop dword [rax]
jmp fcn.0048b9a0
Function at 0x48c140
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x48c287
push rbp
mov rbp, rsp
sub rsp, 0x78
movabs rdx, 0x3537457a5b5d8840
mov qword [rsp + 0x1b], rdx
movabs rdx, 0x3e4e5d3f35497135
mov qword [rsp + 0x22], rdx
movabs rdx, 0x6f3985cb3f324f46
mov qword [rsp + 0x2a], rdx
movabs rdx, 0x3776755c8f312549
mov qword [rsp + 0x32], rdx
movabs rdx, 0x7c32774b5d6f755c
mov qword [rsp + 0x3a], rdx
movabs rdx, 0x261b1e1804031d26
mov qword [rsp + 0x42], rdx
movabs rdx, 0xb120b131f0b261b
mov qword [rsp + 0x48], rdx
movabs rdx, 0x4182303111f1422
mov qword [rsp + 0x50], rdx
movabs rdx, 0x130d01180c1a0011
mov qword [rsp + 0x58], rdx
movabs rdx, 0x1621022218201c09
mov qword [rsp + 0x60], rdx
movabs rdx, 0x2412101a0e0f0501
mov qword [rsp + 0x68], rdx
movabs rdx, 0x91d230c24081717
mov qword [rsp + 0x70], rdx
xor eax, eax
jmp 0x48c227
movzx r9d, byte [rsp + rsi + 0x1b]
sub r9d, edx
lea edx, [r9 + 0x1c]
mov byte [rsp + rdi + 0x1b], dl
lea edx, [r8 + 0x1c]
mov byte [rsp + rsi + 0x1b], dl
add rax, 2
cmp rax, 0x36
jge 0x48c257
movzx edx, byte [rsp + rax + 0x42]
movzx esi, byte [rsp + rax + 0x43]
mov edi, edx
xor edx, esi
add edx, eax
nop dword [rax]
cmp rdi, 0x27
jae 0x48c27a
movzx r8d, byte [rsp + rdi + 0x1b]
sub r8d, edx
cmp rsi, 0x27
jb 0x48c20a
jmp 0x48c26e
xor eax, eax
lea rbx, [rsp + 0x1b]
mov ecx, 0x27
call fcn.0044bb20
add rsp, 0x78
pop rbp
ret
mov eax, esi
mov ecx, 0x27
call fcn.00461020
mov eax, edi
mov ecx, 0x27
call fcn.00461020
nop
call fcn.0045eda0
jmp fcn.0048c140

Function at 0x48c860
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x48c998
push rbp
mov rbp, rsp
sub rsp, 0x70
movabs rdx, 0x1f253938380d3924
mov qword [rsp + 0x1c], rdx
movabs rdx, 0x3432452817333830
mov qword [rsp + 0x24], rdx
movabs rdx, 0x26485e270b153f27
mov qword [rsp + 0x2c], rdx
movabs rdx, 0x4a37362b35222bf9
mov qword [rsp + 0x34], rdx
movabs rdx, 0x3632512016453635
mov qword [rsp + 0x3c], rdx
movabs rdx, 0xa19112024060718
mov qword [rsp + 0x44], rdx
movabs rdx, 0x71c092712132423
mov qword [rsp + 0x4c], rdx
movabs rdx, 0xb021f20071c0927
mov qword [rsp + 0x50], rdx
movabs rdx, 0x241610000b1f2219
mov qword [rsp + 0x58], rdx
movabs rdx, 0x190b250a1a1c0f14
mov qword [rsp + 0x60], rdx
movabs rdx, 0x1523130d16170c0f
mov qword [rsp + 0x68], rdx
xor eax, eax
jmp 0x48c938
movzx r9d, byte [rsp + rsi + 0x1c]
sub r9d, edx
lea edx, [r9 + 0x37]
mov byte [rsp + rdi + 0x1c], dl
lea edx, [r8 + 0x37]
mov byte [rsp + rsi + 0x1c], dl
add rax, 2
cmp rax, 0x2c
jge 0x48c968
movzx edx, byte [rsp + rax + 0x44]
movzx esi, byte [rsp + rax + 0x45]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x28
jae 0x48c98b
movzx r8d, byte [rsp + rdi + 0x1c]
sub r8d, edx
nop dword [rax]
cmp rsi, 0x28
jb 0x48c91b
jmp 0x48c97f
xor eax, eax
lea rbx, [rsp + 0x1c]
mov ecx, 0x28
call fcn.0044bb20
add rsp, 0x70
pop rbp
ret
mov eax, esi
mov ecx, 0x28
call fcn.00461020
mov eax, edi
mov ecx, 0x28
call fcn.00461020
nop
call fcn.0045eda0
nop dword [rax]
jmp fcn.0048c860
Function at 0x494200
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4942c6
push rbp
mov rbp, rsp
sub rsp, 0x30
movabs rdx, 0x6e041124d315612a
mov qword [rsp + 0x1d], rdx
mov byte [rsp + 0x25], 0xd3
movabs rdx, 0x304000605050008
mov qword [rsp + 0x26], rdx
mov word [rsp + 0x2e], 0x204
xor eax, eax
nop
jmp 0x494260
movzx r9d, byte [rsp + rsi + 0x1d]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x42]
mov byte [rsp + rdi + 0x1d], dl
mov byte [rsp + rsi + 0x1d], r8b
add rax, 2
nop dword [rax]
cmp rax, 0xa
jge 0x494292
movzx edx, byte [rsp + rax + 0x26]
movzx esi, byte [rsp + rax + 0x27]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 9
jae 0x4942b7
movzx r8d, byte [rsp + rdi + 0x1d]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x42]
cmp rsi, 9
jb 0x494242
jmp 0x4942ab
xor eax, eax
lea rbx, [rsp + 0x1d]
mov ecx, 9
nop
call fcn.0044bb20
add rsp, 0x30
pop rbp
ret
mov eax, esi
mov ecx, 9
call fcn.00461020
mov eax, edi
mov ecx, 9
nop
call fcn.00461020
nop
call fcn.0045eda0
jmp fcn.00494200

Function at 0x4952a0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x495366
push rbp
mov rbp, rsp
sub rsp, 0x30
movabs rdx, 0x61f3d98378f86104
mov qword [rsp + 0x1b], rdx
mov byte [rsp + 0x23], 0x74
movabs rdx, 0x305030705000604
mov qword [rsp + 0x24], rdx
mov dword [rsp + 0x2c], 0x2030607
xor eax, eax
nop
jmp 0x495300
movzx r9d, byte [rsp + rsi + 0x1b]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x70]
mov byte [rsp + rdi + 0x1b], dl
mov byte [rsp + rsi + 0x1b], r8b
add rax, 2
nop dword [rax]
cmp rax, 0xc
jge 0x495332
movzx edx, byte [rsp + rax + 0x24]
movzx esi, byte [rsp + rax + 0x25]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 9
jae 0x495357
movzx r8d, byte [rsp + rdi + 0x1b]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x70]
cmp rsi, 9
jb 0x4952e2
jmp 0x49534b
xor eax, eax
lea rbx, [rsp + 0x1b]
mov ecx, 9
nop
call fcn.0044bb20
add rsp, 0x30
pop rbp
ret
mov eax, esi
mov ecx, 9
call fcn.00461020
mov eax, edi
mov ecx, 9
nop
call fcn.00461020
nop
call fcn.0045eda0
jmp fcn.004952a0

Function at 0x495580
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x49565d
push rbp
mov rbp, rsp
sub rsp, 0x38
movabs rdx, 0x6ee669db611cdfde
mov qword [rsp + 0x19], rdx
movabs rdx, 0x20c34f24626ee669
mov qword [rsp + 0x1e], rdx
movabs rdx, 0xb0a070b020b0b09
mov qword [rsp + 0x26], rdx
movabs rdx, 0x2070b0a070b020b
mov qword [rsp + 0x28], rdx
movabs rdx, 0x10b040002060a07
mov qword [rsp + 0x30], rdx
xor eax, eax
nop
jmp 0x495600
movzx r9d, byte [rsp + rsi + 0x19]
sub r9d, edx
lea edx, [r9 - 0x60]
mov byte [rsp + rdi + 0x19], dl
lea edx, [r8 - 0x60]
mov byte [rsp + rsi + 0x19], dl
add rax, 2
nop
cmp rax, 0x12
jge 0x49562d
movzx edx, byte [rsp + rax + 0x26]
movzx esi, byte [rsp + rax + 0x27]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0xd
jae 0x495650
movzx r8d, byte [rsp + rdi + 0x19]
sub r8d, edx
cmp rsi, 0xd
jb 0x4955e2
jmp 0x495644
xor eax, eax
lea rbx, [rsp + 0x19]
mov ecx, 0xd
call fcn.0044bb20
add rsp, 0x38
pop rbp
ret
mov eax, esi
mov ecx, 0xd
call fcn.00461020
mov eax, edi
mov ecx, 0xd
call fcn.00461020
nop
nop dword [rax]
call fcn.0045eda0
jmp fcn.00495580
Function at 0x498d40
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x498e26
push rbp
mov rbp, rsp
sub rsp, 0x40
movabs rdx, 0x50aa596619d06e12
mov qword [rsp + 0x1e], rdx
movabs rdx, 0x670574b969a750aa
mov qword [rsp + 0x24], rdx
movabs rdx, 0x30c02000a0d0d03
mov qword [rsp + 0x2c], rdx
movabs rdx, 0xd0c0502030c0200
mov qword [rsp + 0x30], rdx
movabs rdx, 0xc06030802030c03
mov qword [rsp + 0x38], rdx
xor eax, eax
nop
jmp 0x498dc0
movzx r9d, byte [rsp + rsi + 0x1e]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x61]
mov byte [rsp + rdi + 0x1e], dl
mov byte [rsp + rsi + 0x1e], r8b
add rax, 2
nop dword [rax]
cmp rax, 0x14
jge 0x498df2
movzx edx, byte [rsp + rax + 0x2c]
movzx esi, byte [rsp + rax + 0x2d]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0xe
jae 0x498e17
movzx r8d, byte [rsp + rdi + 0x1e]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x61]
cmp rsi, 0xe
jb 0x498da2
jmp 0x498e0b
xor eax, eax
lea rbx, [rsp + 0x1e]
mov ecx, 0xe
nop
call fcn.0044bb20
add rsp, 0x40
pop rbp
ret
mov eax, esi
mov ecx, 0xe
call fcn.00461020
mov eax, edi
mov ecx, 0xe
nop
call fcn.00461020
nop
call fcn.0045eda0
jmp fcn.00498d40

Function at 0x49f460
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x49f55b
push rbp
mov rbp, rsp
sub rsp, 0x50
movabs rdx, 0x2ea695df6cd2a204
mov qword [rsp + 0x1b], rdx
movabs rdx, 0x49b465b495e0702e
mov qword [rsp + 0x22], rdx
movabs rdx, 0x65639794c8c4dcac
mov qword [rsp + 0x2a], rdx
movabs rdx, 0x1000b100108020b
mov qword [rsp + 0x32], rdx
movabs rdx, 0x10b0a1113090d00
mov qword [rsp + 0x3a], rdx
movabs rdx, 0x41205141313010b
mov qword [rsp + 0x40], rdx
movabs rdx, 0x100d0a04120d0f06
mov qword [rsp + 0x48], rdx
xor eax, eax
jmp 0x49f4f9
movzx r9d, byte [rsp + rsi + 0x1b]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x57]
mov byte [rsp + rdi + 0x1b], dl
mov byte [rsp + rsi + 0x1b], r8b
add rax, 2
cmp rax, 0x1e
jge 0x49f52b
movzx edx, byte [rsp + rax + 0x32]
movzx esi, byte [rsp + rax + 0x33]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x17
jae 0x49f54e
movzx r8d, byte [rsp + rdi + 0x1b]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x57]
cmp rsi, 0x17
jb 0x49f4df
jmp 0x49f542
xor eax, eax
lea rbx, [rsp + 0x1b]
mov ecx, 0x17
call fcn.0044bb20
add rsp, 0x50
pop rbp
ret
mov eax, esi
mov ecx, 0x17
call fcn.00461020
mov eax, edi
mov ecx, 0x17
call fcn.00461020
nop
nop dword [rax + rax]
call fcn.0045eda0
jmp fcn.0049f460
Function at 0x49fde0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x49ff2c
push rbp
mov rbp, rsp
sub rsp, 0x78
movabs rdx, 0x978150626892656d
mov qword [rsp + 0x1d], rdx
movabs rdx, 0x9792479b74978150
mov qword [rsp + 0x22], rdx
movabs rdx, 0x3cf07b8359757e9c
mov qword [rsp + 0x2a], rdx
movabs rdx, 0x717e3a8b6f5b55af
mov qword [rsp + 0x32], rdx
movabs rdx, 0x784e4559fb204c96
mov qword [rsp + 0x3a], rdx
movabs rdx, 0x1c241e0d17131512
mov qword [rsp + 0x42], rdx
movabs rdx, 0x1817100b17021c24
mov qword [rsp + 0x48], rdx
movabs rdx, 0x1b0b1d090c02100f
mov qword [rsp + 0x50], rdx
movabs rdx, 0x61e11190f070e0a
mov qword [rsp + 0x58], rdx
movabs rdx, 0x8051a0916052316
mov qword [rsp + 0x60], rdx
movabs rdx, 0x6130d1822180421
mov qword [rsp + 0x68], rdx
movabs rdx, 0x1d041420090a1d1c
mov qword [rsp + 0x70], rdx
xor eax, eax
jmp 0x49fec4
movzx r9d, byte [rsp + rsi + 0x1d]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x41]
mov byte [rsp + rdi + 0x1d], dl
mov byte [rsp + rsi + 0x1d], r8b
add rax, 2
cmp rax, 0x36
jge 0x49fefc
movzx edx, byte [rsp + rax + 0x42]
movzx esi, byte [rsp + rax + 0x43]
mov edi, edx
xor edx, esi
add edx, eax
nop word [rax + rax]
cmp rdi, 0x25
jae 0x49ff1f
movzx r8d, byte [rsp + rdi + 0x1d]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x41]
cmp rsi, 0x25
jb 0x49feaa
jmp 0x49ff13
xor eax, eax
lea rbx, [rsp + 0x1d]
mov ecx, 0x25
call fcn.0044bb20
add rsp, 0x78
pop rbp
ret
mov eax, esi
mov ecx, 0x25
call fcn.00461020
mov eax, edi
mov ecx, 0x25
call fcn.00461020
nop
call fcn.0045eda0
jmp fcn.0049fde0

Function at 0x4a0600
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4a070c
push rbp
mov rbp, rsp
sub rsp, 0x58
movabs rdx, 0x1e6d836e4e45fa5a
mov qword [rsp + 0x1e], rdx
movabs rdx, 0xedc1e9f943d06305
mov qword [rsp + 0x26], rdx
movabs rdx, 0x5af6ea6666ee206b
mov qword [rsp + 0x2e], rdx
movabs rdx, 0xf09090416070c01
mov qword [rsp + 0x36], rdx
movabs rdx, 0x5050f0909041607
mov qword [rsp + 0x38], rdx
movabs rdx, 0x5170d0002160605
mov qword [rsp + 0x40], rdx
movabs rdx, 0xd05080302161512
mov qword [rsp + 0x48], rdx
movabs rdx, 0xe160a030804030b
mov qword [rsp + 0x50], rdx
xor eax, eax
jmp 0x4a06a8
movzx r9d, byte [rsp + rsi + 0x1e]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x6c]
mov byte [rsp + rdi + 0x1e], dl
mov byte [rsp + rsi + 0x1e], r8b
add rax, 2
cmp rax, 0x22
jge 0x4a06dc
movzx edx, byte [rsp + rax + 0x36]
movzx esi, byte [rsp + rax + 0x37]
mov edi, edx
xor edx, esi
add edx, eax
nop
cmp rdi, 0x18
jae 0x4a06ff
movzx r8d, byte [rsp + rdi + 0x1e]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x6c]
cmp rsi, 0x18
jb 0x4a068e
jmp 0x4a06f3
xor eax, eax
lea rbx, [rsp + 0x1e]
mov ecx, 0x18
call fcn.0044bb20
add rsp, 0x58
pop rbp
ret
mov eax, esi
mov ecx, 0x18
call fcn.00461020
mov eax, edi
mov ecx, 0x18
call fcn.00461020
nop
call fcn.0045eda0
jmp fcn.004a0600