joyce8/EMBER2024-capa huggingface dataset:
Function at 0x47de20
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x47deec
push rbp
mov rbp, rsp
sub rsp, 0x30
movabs rdx, 0x3934a9246e673553
mov qword [rsp + 0x19], rdx
movabs rdx, 0x2c302c3934a9246e
mov qword [rsp + 0x1c], rdx
movabs rdx, 0x507060604040901
mov qword [rsp + 0x24], rdx
mov dword [rsp + 0x2c], 0xa080807
xor eax, eax
jmp 0x47de85
movzx r9d, byte [rsp + rsi + 0x19]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x31]
mov byte [rsp + rdi + 0x19], dl
mov byte [rsp + rsi + 0x19], r8b
add rax, 2
cmp rax, 0xc
jge 0x47debc
movzx edx, byte [rsp + rax + 0x24]
movzx esi, byte [rsp + rax + 0x25]
mov edi, edx
xor edx, esi
add edx, eax
nop dword [rax + rax]
cmp rdi, 0xb
jae 0x47dedf
movzx r8d, byte [rsp + rdi + 0x19]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x31]
cmp rsi, 0xb
jb 0x47de6b
jmp 0x47ded3
xor eax, eax
lea rbx, [rsp + 0x19]
mov ecx, 0xb
call fcn.00441980
add rsp, 0x30
pop rbp
ret
mov eax, esi
mov ecx, 0xb
call fcn.00452300
mov eax, edi
mov ecx, 0xb
call fcn.00452300
nop
call fcn.00450080
jmp fcn.0047de20

Function at 0x47e580
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x47e638
push rbp
mov rbp, rsp
sub rsp, 0x30
movabs rdx, 0x3c5c4754564c1854
mov qword [rsp + 0x1e], rdx
movabs rdx, 0x105010102030706
mov qword [rsp + 0x26], rdx
mov word [rsp + 0x2e], 0x506
xor eax, eax
jmp 0x47e5d5
movzx r9d, byte [rsp + rsi + 0x1e]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x10]
mov byte [rsp + rdi + 0x1e], dl
mov byte [rsp + rsi + 0x1e], r8b
add rax, 2
cmp rax, 0xa
jge 0x47e608
movzx edx, byte [rsp + rax + 0x26]
movzx esi, byte [rsp + rax + 0x27]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 8
jae 0x47e62b
movzx r8d, byte [rsp + rdi + 0x1e]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x10]
nop
cmp rsi, 8
jb 0x47e5bb
jmp 0x47e61f
xor eax, eax
lea rbx, [rsp + 0x1e]
mov ecx, 8
call fcn.00441980
add rsp, 0x30
pop rbp
ret
mov eax, esi
mov ecx, 8
call fcn.00452300
mov eax, edi
mov ecx, 8
call fcn.00452300
nop
call fcn.00450080
nop dword [rax]
jmp fcn.0047e580

Function at 0x47efe0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x47f09e
push rbp
mov rbp, rsp
sub rsp, 0x30
movabs rdx, 0x346843fc6964f209
mov qword [rsp + 0x24], rdx
mov dword [rsp + 0x2c], 0x96fac01
movabs rdx, 0x906040106090706
mov qword [rsp + 0x18], rdx
mov dword [rsp + 0x20], 0x70b08
xor eax, eax
jmp 0x47f041
movzx r9d, byte [rsp + rsi + 0x24]
sub r9d, edx
lea edx, [r9 + 0x76]
mov byte [rsp + rdi + 0x24], dl
lea edx, [r8 + 0x76]
mov byte [rsp + rsi + 0x24], dl
add rax, 2
cmp rax, 0xc
jge 0x47f06e
movzx edx, byte [rsp + rax + 0x18]
movzx esi, byte [rsp + rax + 0x19]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0xc
jae 0x47f091
movzx r8d, byte [rsp + rdi + 0x24]
sub r8d, edx
cmp rsi, 0xc
jb 0x47f024
jmp 0x47f085
xor eax, eax
lea rbx, [rsp + 0x24]
mov ecx, 0xc
call fcn.00441980
add rsp, 0x30
pop rbp
ret
mov eax, esi
mov ecx, 0xc
call fcn.00452300
mov eax, edi
mov ecx, 0xc
call fcn.00452300
nop
nop
call fcn.00450080
jmp fcn.0047efe0
Function at 0x481500
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4815dd
push rbp
mov rbp, rsp
sub rsp, 0x40
movabs rdx, 0x6c815f5474684075
mov qword [rsp + 0x1e], rdx
movabs rdx, 0x4a756174535f6c81
mov qword [rsp + 0x24], rdx
movabs rdx, 0xc010d0401030d
mov qword [rsp + 0x2c], rdx
movabs rdx, 0x6080b000c010d
mov qword [rsp + 0x30], rdx
movabs rdx, 0x703080b000d0406
mov qword [rsp + 0x38], rdx
xor eax, eax
nop
jmp 0x481580
movzx r9d, byte [rsp + rsi + 0x1e]
sub r9d, edx
lea edx, [r9 + 0xf]
mov byte [rsp + rdi + 0x1e], dl
lea edx, [r8 + 0xf]
mov byte [rsp + rsi + 0x1e], dl
add rax, 2
nop
cmp rax, 0x14
jge 0x4815ad
movzx edx, byte [rsp + rax + 0x2c]
movzx esi, byte [rsp + rax + 0x2d]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0xe
jae 0x4815d0
movzx r8d, byte [rsp + rdi + 0x1e]
sub r8d, edx
cmp rsi, 0xe
jb 0x481562
jmp 0x4815c4
xor eax, eax
lea rbx, [rsp + 0x1e]
mov ecx, 0xe
call fcn.00441980
add rsp, 0x40
pop rbp
ret
mov eax, esi
mov ecx, 0xe
call fcn.00452300
mov eax, edi
mov ecx, 0xe
call fcn.00452300
nop
nop dword [rax]
call fcn.00450080
jmp fcn.00481500

Function at 0x4827c0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x482892
push rbp
mov rbp, rsp
sub rsp, 0x38
movabs rdx, 0xbb20388dff666f20
mov qword [rsp + 0x1f], rdx
movabs rdx, 0xa93e2bb20388dff
mov qword [rsp + 0x22], rdx
movabs rdx, 0x806050807060003
mov qword [rsp + 0x2a], rdx
movabs rdx, 0x40909040a060806
mov qword [rsp + 0x30], rdx
xor eax, eax
jmp 0x48282c
movzx r9d, byte [rsp + rsi + 0x1f]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x51]
mov byte [rsp + rdi + 0x1f], dl
mov byte [rsp + rsi + 0x1f], r8b
add rax, 2
cmp rax, 0xe
jge 0x48285e
movzx edx, byte [rsp + rax + 0x2a]
movzx esi, byte [rsp + rax + 0x2b]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0xb
jae 0x482885
movzx r8d, byte [rsp + rdi + 0x1f]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x51]
cmp rsi, 0xb
jb 0x482812
jmp 0x482875
xor eax, eax
lea rbx, [rsp + 0x1f]
mov ecx, 0xb
call fcn.00441980
add rsp, 0x38
pop rbp
ret
mov eax, esi
mov ecx, 0xb
nop dword [rax]
call fcn.00452300
mov eax, edi
mov ecx, 0xb
call fcn.00452300
nop
call fcn.00450080
jmp fcn.004827c0
Function at 0x482960
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x482a4a
push rbp
mov rbp, rsp
sub rsp, 0x40
movabs rdx, 0x4a84869b01fb655
mov qword [rsp + 0x1d], rdx
movabs rdx, 0xc04a84869b01fb6
mov qword [rsp + 0x1e], rdx
movabs rdx, 0xcdff6172676fb7d1
mov qword [rsp + 0x26], rdx
movabs rdx, 0x706010a0a050a0f
mov qword [rsp + 0x2e], rdx
movabs rdx, 0x3030706010a0a05
mov qword [rsp + 0x30], rdx
movabs rdx, 0x108100902060802
mov qword [rsp + 0x38], rdx
xor eax, eax
jmp 0x4829ed
movzx r9d, byte [rsp + rsi + 0x1d]
sub r9d, edx
lea edx, [r9 - 0x42]
mov byte [rsp + rdi + 0x1d], dl
lea edx, [r8 - 0x42]
mov byte [rsp + rsi + 0x1d], dl
add rax, 2
cmp rax, 0x12
jge 0x482a1a
movzx edx, byte [rsp + rax + 0x2e]
movzx esi, byte [rsp + rax + 0x2f]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x11
jae 0x482a3d
movzx r8d, byte [rsp + rdi + 0x1d]
sub r8d, edx
cmp rsi, 0x11
jb 0x4829d0
jmp 0x482a31
xor eax, eax
lea rbx, [rsp + 0x1d]
mov ecx, 0x11
call fcn.00441980
add rsp, 0x40
pop rbp
ret
mov eax, esi
mov ecx, 0x11
call fcn.00452300
mov eax, edi
mov ecx, 0x11
call fcn.00452300
nop
call fcn.00450080
jmp fcn.00482960
Function at 0x489dc0
Capabilities:
Hash data using fnv

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x489ffb
push rbp
mov rbp, rsp
sub rsp, 0x78
mov ebx, dword [rax + 0x2c]
test ebx, ebx
jne 0x489e5a
mov qword [rsp + 0x88], rax
lea rbx, [0x005554a0]
mov rcx, rax
lea rax, [0x00613080]
call fcn.0045b040
test cl, cl
jne 0x489e43
mov rax, qword [rsp + 0x88]
call fcn.00489280
mov ecx, 1
mov rdi, rax
mov rsi, rbx
lea rax, [rsp + 0x30]
lea rbx, [0x00578e20]
call fcn.00441600
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x28], rbx
call fcn.0048a0a0
mov rcx, qword [rsp + 0x88]
xor edx, edx
jmp 0x489e80
lea rdx, [0x00553980]
cmp rax, rdx
jne 0x489e6b
test byte [rbx], al
mov rax, rbx
add rsp, 0x78
pop rbp
ret
nop
nop dword [rax + rax]
call fcn.0044de80
add rsp, 0x78
pop rbp
ret
mov rbx, rdx
lea rcx, [0x005377c0]
call fcn.00408f00
inc rdx
nop dword [rax]
cmp rbx, rdx
jle 0x489ec4
mov rsi, qword [rax + rdx*8]
cmp qword [rsi + 0x30], rcx
jne 0x489e7a
lea rax, [0x00613080]
lea rbx, [0x005554a0]
lea rdi, [0x00553980]
call fcn.0045b200
lea rdx, [0x00553980]
cmp rax, rdx
jne 0x489feb
test byte [rbx], al
mov rax, rbx
add rsp, 0x78
pop rbp
ret
lea rcx, [0x00530b20]
mov qword [rsp + 0x68], rcx
mov qword [rsp + 0x70], 0
mov rcx, qword [rsp + 0x68]
mov qword [rsp + 0x58], rcx
lea rax, [0x0053f0e0]
call fcn.0040b660
mov qword [rsp + 0x60], rax
mov rcx, qword [rsp + 0x58]
test byte [rcx], al
cmp dword [0x00666900], 0
je 0x489f1d
mov rbx, rax
lea rax, [0x0053f0e0]
call fcn.00410440
mov rax, qword [rsp + 0x60]
mov rcx, qword [rsp + 0x58]
mov rdx, qword [rcx]
mov qword [rax], rdx
movups xmm0, xmmword [rcx + 8]
movups xmmword [rax + 8], xmm0
movups xmm0, xmmword [rcx + 0x18]
movups xmmword [rax + 0x18], xmm0
movups xmm0, xmmword [rcx + 0x28]
movups xmmword [rax + 0x28], xmm0
nop
mov rbx, qword [rsp + 0x28]
xor ecx, ecx
xor edi, edi
xor esi, esi
mov r8d, esi
mov rax, qword [rsp + 0x50]
call fcn.00401400
nop
call fcn.0044df40
mov rsi, qword [rsp + 0x60]
mov dword [rsi + 0x28], eax
mov dword [rsi + 0x2c], 0
mov rcx, qword [rsp + 0x88]
mov edx, dword [rcx + 0x10]
xor eax, eax
jmp 0x489f86
imul edx, edx, 0x1000193
xor edx, 0x2a
mov eax, 1
test rax, rax
jle 0x489f78
mov dword [rsi + 0x10], edx
cmp dword [0x00666900], 0
je 0x489fa7
call fcn.00451fa0
mov qword [r11], rcx
mov rdx, qword [rsi + 0x30]
mov qword [r11 + 8], rdx
mov qword [rsi + 0x30], rcx
lea rax, [0x00613080]
lea rbx, [0x005554a0]
lea rdi, [0x00553980]
call fcn.0045b200
lea rdx, [0x00553980]
cmp rax, rdx
jne 0x489fdc
test byte [rbx], al
mov rax, rbx
add rsp, 0x78
pop rbp
ret
mov rbx, rdx
lea rcx, [0x005377c0]
call fcn.00408f00
mov rbx, rdx
lea rcx, [0x005377c0]
call fcn.00408f00
nop
mov qword [rsp + 8], rax
call fcn.00450080
mov rax, qword [rsp + 8]
jmp fcn.00489dc0
Function at 0x492600
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x49270c
push rbp
mov rbp, rsp
sub rsp, 0x58
movabs rdx, 0x75e5356fdbee69f3
mov qword [rsp + 0x1c], rdx
movabs rdx, 0xb8ee746bd67deefe
mov qword [rsp + 0x24], rdx
movabs rdx, 0x740c7366902fa5ed
mov qword [rsp + 0x2c], rdx
movabs rdx, 0x8050f080f051216
mov qword [rsp + 0x34], rdx
movabs rdx, 0x1216121108050f08
mov qword [rsp + 0x38], rdx
movabs rdx, 0x90201120e03030a
mov qword [rsp + 0x40], rdx
movabs rdx, 0xc0010160c070c16
mov qword [rsp + 0x48], rdx
movabs rdx, 0x11080a11130b1206
mov qword [rsp + 0x50], rdx
xor eax, eax
jmp 0x4926a8
movzx r9d, byte [rsp + rsi + 0x1c]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x5a]
mov byte [rsp + rdi + 0x1c], dl
mov byte [rsp + rsi + 0x1c], r8b
add rax, 2
cmp rax, 0x24
jge 0x4926dc
movzx edx, byte [rsp + rax + 0x34]
movzx esi, byte [rsp + rax + 0x35]
mov edi, edx
xor edx, esi
add edx, eax
nop
cmp rdi, 0x18
jae 0x4926ff
movzx r8d, byte [rsp + rdi + 0x1c]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x5a]
cmp rsi, 0x18
jb 0x49268e
jmp 0x4926f3
xor eax, eax
lea rbx, [rsp + 0x1c]
mov ecx, 0x18
call fcn.00441980
add rsp, 0x58
pop rbp
ret
mov eax, esi
mov ecx, 0x18
call fcn.00452300
mov eax, edi
mov ecx, 0x18
call fcn.00452300
nop
call fcn.00450080
jmp fcn.00492600

Function at 0x492720
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x49281d
push rbp
mov rbp, rsp
sub rsp, 0x50
movabs rdx, 0xa903d40b416521ae
mov qword [rsp + 0x18], rdx
movabs rdx, 0xa11e741e202412d3
mov qword [rsp + 0x20], rdx
movabs rdx, 0x7465b104246fd802
mov qword [rsp + 0x28], rdx
movabs rdx, 0x40615140f071004
mov qword [rsp + 0x30], rdx
movabs rdx, 0x60f090103010007
mov qword [rsp + 0x38], rdx
movabs rdx, 0xa07110514090309
mov qword [rsp + 0x40], rdx
movabs rdx, 0x140f0c05130e0e08
mov qword [rsp + 0x48], rdx
xor eax, eax
jmp 0x4927c0
movzx r9d, byte [rsp + rsi + 0x18]
sub r9d, edx
lea edx, [r9 + 0x74]
mov byte [rsp + rdi + 0x18], dl
lea edx, [r8 + 0x74]
mov byte [rsp + rsi + 0x18], dl
add rax, 2
nop dword [rax]
cmp rax, 0x20
jge 0x4927ed
movzx edx, byte [rsp + rax + 0x30]
movzx esi, byte [rsp + rax + 0x31]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x18
jae 0x492810
movzx r8d, byte [rsp + rdi + 0x18]
sub r8d, edx
cmp rsi, 0x18
jb 0x49279f
jmp 0x492804
xor eax, eax
lea rbx, [rsp + 0x18]
mov ecx, 0x18
call fcn.00441980
add rsp, 0x50
pop rbp
ret
mov eax, esi
mov ecx, 0x18
call fcn.00452300
mov eax, edi
mov ecx, 0x18
call fcn.00452300
nop
nop dword [rax]
call fcn.00450080
jmp fcn.00492720
Function at 0x492d20
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x492e1b
push rbp
mov rbp, rsp
sub rsp, 0x48
movabs rdx, 0x12d4333917076ed2
mov qword [rsp + 0x19], rdx
movabs rdx, 0x61feeb64b112d433
mov qword [rsp + 0x1e], rdx
movabs rdx, 0x1265126820c4d2af
mov qword [rsp + 0x26], rdx
movabs rdx, 0xb0514040504120b
mov qword [rsp + 0x2e], rdx
movabs rdx, 0xf0403060a110700
mov qword [rsp + 0x36], rdx
movabs rdx, 0xe0e0f0403060a11
mov qword [rsp + 0x38], rdx
movabs rdx, 0xd001108020d0612
mov qword [rsp + 0x40], rdx
xor eax, eax
jmp 0x492db9
movzx r9d, byte [rsp + rsi + 0x19]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x6d]
mov byte [rsp + rdi + 0x19], dl
mov byte [rsp + rsi + 0x19], r8b
add rax, 2
cmp rax, 0x1a
jge 0x492deb
movzx edx, byte [rsp + rax + 0x2e]
movzx esi, byte [rsp + rax + 0x2f]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x15
jae 0x492e0e
movzx r8d, byte [rsp + rdi + 0x19]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x6d]
cmp rsi, 0x15
jb 0x492d9f
jmp 0x492e02
xor eax, eax
lea rbx, [rsp + 0x19]
mov ecx, 0x15
call fcn.00441980
add rsp, 0x48
pop rbp
ret
mov eax, esi
mov ecx, 0x15
call fcn.00452300
mov eax, edi
mov ecx, 0x15
call fcn.00452300
nop
nop dword [rax + rax]
call fcn.00450080
jmp fcn.00492d20

Function at 0x493d60
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x493e1d
push rbp
mov rbp, rsp
sub rsp, 0x30
movabs rdx, 0x3af8f3a2c18d65a7
mov qword [rsp + 0x1b], rdx
mov byte [rsp + 0x23], 0xc
movabs rdx, 0x604000805050602
mov qword [rsp + 0x24], rdx
mov dword [rsp + 0x2c], 0x6060803
xor eax, eax
nop
jmp 0x493dc0
movzx r9d, byte [rsp + rsi + 0x1b]
sub r9d, edx
lea edx, [r9 + 0x72]
mov byte [rsp + rdi + 0x1b], dl
lea edx, [r8 + 0x72]
mov byte [rsp + rsi + 0x1b], dl
add rax, 2
nop
cmp rax, 0xc
jge 0x493ded
movzx edx, byte [rsp + rax + 0x24]
movzx esi, byte [rsp + rax + 0x25]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 9
jae 0x493e10
movzx r8d, byte [rsp + rdi + 0x1b]
sub r8d, edx
cmp rsi, 9
jb 0x493da2
jmp 0x493e04
xor eax, eax
lea rbx, [rsp + 0x1b]
mov ecx, 9
call fcn.00441980
add rsp, 0x30
pop rbp
ret
mov eax, esi
mov ecx, 9
call fcn.00452300
mov eax, edi
mov ecx, 9
call fcn.00452300
nop
nop dword [rax]
call fcn.00450080
jmp fcn.00493d60
Function at 0x495620
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x49570a
push rbp
mov rbp, rsp
sub rsp, 0x40
movabs rdx, 0x4e10fc0c2b44413c
mov qword [rsp + 0x19], rdx
movabs rdx, 0x2c4e10fc0c2b4441
mov qword [rsp + 0x1a], rdx
movabs rdx, 0x51666ff4621c6135
mov qword [rsp + 0x22], rdx
movabs rdx, 0xb070d0d08030900
mov qword [rsp + 0x2a], rdx
movabs rdx, 0x102050104100b07
mov qword [rsp + 0x30], rdx
movabs rdx, 0xc080603080802
mov qword [rsp + 0x38], rdx
xor eax, eax
jmp 0x4956ad
movzx r9d, byte [rsp + rsi + 0x19]
sub r9d, edx
lea edx, [r9 + 0x30]
mov byte [rsp + rdi + 0x19], dl
lea edx, [r8 + 0x30]
mov byte [rsp + rsi + 0x19], dl
add rax, 2
cmp rax, 0x16
jge 0x4956da
movzx edx, byte [rsp + rax + 0x2a]
movzx esi, byte [rsp + rax + 0x2b]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x11
jae 0x4956fd
movzx r8d, byte [rsp + rdi + 0x19]
sub r8d, edx
cmp rsi, 0x11
jb 0x495690
jmp 0x4956f1
xor eax, eax
lea rbx, [rsp + 0x19]
mov ecx, 0x11
call fcn.00441980
add rsp, 0x40
pop rbp
ret
mov eax, esi
mov ecx, 0x11
call fcn.00452300
mov eax, edi
mov ecx, 0x11
call fcn.00452300
nop
call fcn.00450080
jmp fcn.00495620

Function at 0x495de0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
lea r12, [rsp - 0x10]
cmp r12, qword [r14 + 0x10]
jbe 0x495f52
push rbp
mov rbp, rsp
sub rsp, 0x88
movabs rdx, 0x3a4c5c683c8c654d
mov qword [rsp + 0x1e], rdx
movabs rdx, 0x153d23906efe2025
mov qword [rsp + 0x26], rdx
movabs rdx, 0x2066756f153d2390
mov qword [rsp + 0x2a], rdx
movabs rdx, 0x4b48371911503e77
mov qword [rsp + 0x32], rdx
movabs rdx, 0x43fc2423c5e5721f
mov qword [rsp + 0x3a], rdx
movabs rdx, 0x202048fc1dce5d5f
mov qword [rsp + 0x42], rdx
movabs rdx, 0x161b0c0f0200231f
mov qword [rsp + 0x4a], rdx
movabs rdx, 0x211e0d281a0c160a
mov qword [rsp + 0x52], rdx
movabs rdx, 0x290c2506280d211e
mov qword [rsp + 0x58], rdx
movabs rdx, 0x1523231a0416222a
mov qword [rsp + 0x60], rdx
movabs rdx, 0x41926242a080303
mov qword [rsp + 0x68], rdx
movabs rdx, 0x12120a2a0d020405
mov qword [rsp + 0x70], rdx
movabs rdx, 0x1c0e1a2728191824
mov qword [rsp + 0x78], rdx
movabs rdx, 0x17211e1b0920030e
mov qword [rsp + 0x80], rdx
xor eax, eax
jmp 0x495eed
movzx r9d, byte [rsp + rsi + 0x1e]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x1e]
mov byte [rsp + rdi + 0x1e], dl
mov byte [rsp + rsi + 0x1e], r8b
add rax, 2
cmp rax, 0x3e
jge 0x495f1f
movzx edx, byte [rsp + rax + 0x4a]
movzx esi, byte [rsp + rax + 0x4b]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x2c
jae 0x495f45
movzx r8d, byte [rsp + rdi + 0x1e]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x1e]
cmp rsi, 0x2c
jb 0x495ed3
jmp 0x495f39
xor eax, eax
lea rbx, [rsp + 0x1e]
mov ecx, 0x2c
call fcn.00441980
add rsp, 0x88
pop rbp
ret
mov eax, esi
mov ecx, 0x2c
call fcn.00452300
mov eax, edi
mov ecx, 0x2c
call fcn.00452300
nop
call fcn.00450080
jmp fcn.00495de0
Function at 0x4962c0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4963ac
push rbp
mov rbp, rsp
sub rsp, 0x40
movabs rdx, 0x72281c00fe5e6973
mov qword [rsp + 0x1b], rdx
movabs rdx, 0x5672281c00fe5e69
mov qword [rsp + 0x1c], rdx
movabs rdx, 0xf511fb432ef86869
mov qword [rsp + 0x24], rdx
movabs rdx, 0x9090e0c0b08020a
mov qword [rsp + 0x2c], rdx
movabs rdx, 0xd03080f09090e0c
mov qword [rsp + 0x30], rdx
movabs rdx, 0x41008050c100508
mov qword [rsp + 0x38], rdx
xor eax, eax
jmp 0x49634a
movzx r9d, byte [rsp + rsi + 0x1b]
lea edx, [r9 + rdx]
lea edx, [rdx + 0xa]
mov byte [rsp + rdi + 0x1b], dl
mov byte [rsp + rsi + 0x1b], r8b
add rax, 2
cmp rax, 0x14
jge 0x49637c
movzx edx, byte [rsp + rax + 0x2c]
movzx esi, byte [rsp + rax + 0x2d]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x11
jae 0x49639f
movzx r8d, byte [rsp + rdi + 0x1b]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0xa]
cmp rsi, 0x11
jb 0x496330
jmp 0x496393
xor eax, eax
lea rbx, [rsp + 0x1b]
mov ecx, 0x11
call fcn.00441980
add rsp, 0x40
pop rbp
ret
mov eax, esi
mov ecx, 0x11
call fcn.00452300
mov eax, edi
mov ecx, 0x11
call fcn.00452300
nop
call fcn.00450080
jmp fcn.004962c0

Function at 0x497800
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x497958
push rbp
mov rbp, rsp
sub rsp, 0x78
movabs rdx, 0x3a907396926688a1
mov qword [rsp + 0x19], rdx
movabs rdx, 0x4c518c65746e7120
mov qword [rsp + 0x21], rdx
movabs rdx, 0x4a43375f894c518c
mov qword [rsp + 0x26], rdx
movabs rdx, 0x94766c759c3a729f
mov qword [rsp + 0x2e], rdx
movabs rdx, 0x6e71486d49648438
mov qword [rsp + 0x36], rdx
movabs rdx, 0xb665a48a8f8a8793
mov qword [rsp + 0x3e], rdx
movabs rdx, 0x11262c2a011e0015
mov qword [rsp + 0x46], rdx
movabs rdx, 0x231511262c2a011e
mov qword [rsp + 0x48], rdx
movabs rdx, 0x20272625101c1418
mov qword [rsp + 0x50], rdx
movabs rdx, 0x2c002a0e2405030d
mov qword [rsp + 0x58], rdx
movabs rdx, 0x190e2829111d0e04
mov qword [rsp + 0x60], rdx
movabs rdx, 0x2a13190e0606122a
mov qword [rsp + 0x68], rdx
movabs rdx, 0x25042520220f1a09
mov qword [rsp + 0x70], rdx
xor eax, eax
jmp 0x4978f3
movzx r9d, byte [rsp + rsi + 0x19]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x40]
mov byte [rsp + rdi + 0x19], dl
mov byte [rsp + rsi + 0x19], r8b
add rax, 2
cmp rax, 0x32
jge 0x497928
movzx edx, byte [rsp + rax + 0x46]
movzx esi, byte [rsp + rax + 0x47]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x2d
jae 0x49794b
movzx r8d, byte [rsp + rdi + 0x19]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x40]
nop dword [rax]
cmp rsi, 0x2d
jb 0x4978d9
jmp 0x49793f
xor eax, eax
lea rbx, [rsp + 0x19]
mov ecx, 0x2d
call fcn.00441980
add rsp, 0x78
pop rbp
ret
mov eax, esi
mov ecx, 0x2d
call fcn.00452300
mov eax, edi
mov ecx, 0x2d
call fcn.00452300
nop
call fcn.00450080
nop dword [rax]
jmp fcn.00497800
Function at 0x498820
Capabilities:
Encrypt data using rc4 prga

Disassembly:
lea r12, [rsp - 0x18]
cmp r12, qword [r14 + 0x10]
jbe 0x4989a7
push rbp
mov rbp, rsp
sub rsp, 0x90
movabs rdx, 0x7b4b63456c666d7c
mov qword [rsp + 0x1f], rdx
movabs rdx, 0x13488561677b4b63
mov qword [rsp + 0x24], rdx
movabs rdx, 0x206e657add8d8751
mov qword [rsp + 0x2c], rdx
movabs rdx, 0xef73676e8e727448
mov qword [rsp + 0x34], rdx
movabs rdx, 0x3965697d651c5074
mov qword [rsp + 0x3c], rdx
movabs rdx, 0x6f37741f4d676465
mov qword [rsp + 0x44], rdx
movabs rdx, 0x3924093c1162741a
mov qword [rsp + 0x4c], rdx
movabs rdx, 0x4112734000a0e0f
mov qword [rsp + 0x54], rdx
movabs rdx, 0x322133060b131815
mov qword [rsp + 0x5c], rdx
movabs rdx, 0x1833340f32213306
mov qword [rsp + 0x60], rdx
movabs rdx, 0x230828111b2810
mov qword [rsp + 0x68], rdx
movabs rdx, 0x1e1d240e2d13310c
mov qword [rsp + 0x70], rdx
movabs rdx, 0x2e29070601021c21
mov qword [rsp + 0x78], rdx
movabs rdx, 0x10a0d1f26242b08
mov qword [rsp + 0x80], rdx
movabs rdx, 0x331c0b0f13301d31
mov qword [rsp + 0x88], rdx
xor eax, eax
jmp 0x498940
movzx r9d, byte [rsp + rsi + 0x1f]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x30]
mov byte [rsp + rdi + 0x1f], dl
mov byte [rsp + rsi + 0x1f], r8b
add rax, 2
nop
cmp rax, 0x3c
jge 0x498972
movzx edx, byte [rsp + rax + 0x54]
movzx esi, byte [rsp + rax + 0x55]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x35
jae 0x49899a
movzx r8d, byte [rsp + rdi + 0x1f]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x30]
cmp rsi, 0x35
jb 0x498925
jmp 0x49898e
xor eax, eax
lea rbx, [rsp + 0x1f]
mov ecx, 0x35
nop
call fcn.00441980
add rsp, 0x90
pop rbp
ret
mov eax, esi
mov ecx, 0x35
call fcn.00452300
mov eax, edi
mov ecx, 0x35
call fcn.00452300
nop
call fcn.00450080
jmp fcn.00498820
Function at 0x499380
Capabilities:
Encrypt data using rc4 prga

Disassembly:
lea r12, [rsp - 0x40]
cmp r12, qword [r14 + 0x10]
jbe 0x4994e0
push rbp
mov rbp, rsp
sub rsp, 0xb8
movabs rdx, 0x637265920882614d
mov qword [rsp + 0x19], rdx
movabs rdx, 0x2f315f17966b774e
mov qword [rsp + 0x21], rdx
movabs rdx, 0xfe206465722f315f
mov qword [rsp + 0x26], rdx
movabs rdx, 0x88327a206e6188a2
mov qword [rsp + 0x2e], rdx
movabs rdx, 0x68f44802ed7e8061
mov qword [rsp + 0x36], rdx
movabs rdx, 0x2073656fa92066d5
mov qword [rsp + 0x3e], rdx
movabs rdx, 0xd52e8c685e4e467e
mov qword [rsp + 0x46], rdx
movabs rdx, 0x7e4240fba46eaa4d
mov qword [rsp + 0x4e], rdx
movabs rdx, 0x774eb604df61a380
mov qword [rsp + 0x56], rdx
movabs rdx, 0xa6afdeac56a8bb61
mov qword [rsp + 0x5e], rdx
movabs rdx, 0x210e3514300c2547
mov qword [rsp + 0x66], rdx
lea rdi, [rsp + 0x68]
lea rsi, [0x0057b932]
mov qword [rsp - 0x10], rbp
lea rbp, [rsp - 0x10]
call fcn.0045293a
mov rbp, qword [rbp]
xor eax, eax
jmp 0x499480
movzx r9d, byte [rsp + rsi + 0x19]
sub r9d, edx
lea edx, [r9 + 0x47]
mov byte [rsp + rdi + 0x19], dl
lea edx, [r8 + 0x47]
mov byte [rsp + rsi + 0x19], dl
add rax, 2
nop
cmp rax, 0x52
jge 0x4994ad
movzx edx, byte [rsp + rax + 0x66]
movzx esi, byte [rsp + rax + 0x67]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x4d
jae 0x4994d3
movzx r8d, byte [rsp + rdi + 0x19]
sub r8d, edx
cmp rsi, 0x4d
jb 0x499462
jmp 0x4994c7
xor eax, eax
lea rbx, [rsp + 0x19]
mov ecx, 0x4d
call fcn.00441980
add rsp, 0xb8
pop rbp
ret
mov eax, esi
mov ecx, 0x4d
call fcn.00452300
mov eax, edi
mov ecx, 0x4d
call fcn.00452300
nop
call fcn.00450080
jmp fcn.00499380