joyce8/EMBER2024-capa huggingface dataset:
Function at 0x486a00
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x486ab2
push rbp
mov rbp, rsp
sub rsp, 0x28
movabs rdx, 0x65fb65272c6ce3ae
mov qword [rsp + 0x20], rdx
movabs rdx, 0x6010000010403
mov qword [rsp + 0x18], rdx
xor eax, eax
jmp 0x486a4e
movzx r9d, byte [rsp + rsi + 0x20]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x3b]
mov byte [rsp + rdi + 0x20], dl
mov byte [rsp + rsi + 0x20], r8b
add rax, 2
cmp rax, 8
jge 0x486a82
movzx edx, byte [rsp + rax + 0x18]
movzx esi, byte [rsp + rax + 0x19]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 8
jae 0x486aa5
movzx r8d, byte [rsp + rdi + 0x20]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x3b]
cmp rsi, 8
jb 0x486a34
nop
jmp 0x486a99
xor eax, eax
lea rbx, [rsp + 0x20]
mov ecx, 8
call fcn.0044d560
add rsp, 0x28
pop rbp
ret
mov eax, esi
mov ecx, 8
call fcn.00462f80
mov eax, edi
mov ecx, 8
call fcn.00462f80
nop
call fcn.00460ca0
jmp fcn.00486a00

Function at 0x487e40
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x487f06
push rbp
mov rbp, rsp
sub rsp, 0x30
movabs rdx, 0x166f251b656e4dca
mov qword [rsp + 0x27], rdx
mov byte [rsp + 0x2f], 0x6d
movabs rdx, 0x104050000070104
mov qword [rsp + 0x1d], rdx
mov word [rsp + 0x25], 0x100
xor eax, eax
nop
jmp 0x487ea0
movzx r9d, byte [rsp + rsi + 0x27]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x61]
mov byte [rsp + rdi + 0x27], dl
mov byte [rsp + rsi + 0x27], r8b
add rax, 2
nop dword [rax]
cmp rax, 0xa
jge 0x487ed2
movzx edx, byte [rsp + rax + 0x1d]
movzx esi, byte [rsp + rax + 0x1e]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 9
jae 0x487ef7
movzx r8d, byte [rsp + rdi + 0x27]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x61]
cmp rsi, 9
jb 0x487e82
jmp 0x487eeb
xor eax, eax
lea rbx, [rsp + 0x27]
mov ecx, 9
nop
call fcn.0044d560
add rsp, 0x30
pop rbp
ret
mov eax, esi
mov ecx, 9
call fcn.00462f80
mov eax, edi
mov ecx, 9
nop
call fcn.00462f80
nop
call fcn.00460ca0
jmp fcn.00487e40

Function at 0x4886e0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x48879d
push rbp
mov rbp, rsp
sub rsp, 0x30
movabs rdx, 0xe058614c61d7aa3f
mov qword [rsp + 0x26], rdx
mov word [rsp + 0x2e], 0xd846
movabs rdx, 0x709020800010204
mov qword [rsp + 0x1a], rdx
mov dword [rsp + 0x22], 0x2010601
xor eax, eax
jmp 0x488740
movzx r9d, byte [rsp + rsi + 0x26]
sub r9d, edx
lea edx, [r9 - 0x63]
mov byte [rsp + rdi + 0x26], dl
lea edx, [r8 - 0x63]
mov byte [rsp + rsi + 0x26], dl
add rax, 2
cmp rax, 0xc
jge 0x48876d
movzx edx, byte [rsp + rax + 0x1a]
movzx esi, byte [rsp + rax + 0x1b]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0xa
jae 0x488790
movzx r8d, byte [rsp + rdi + 0x26]
sub r8d, edx
cmp rsi, 0xa
jb 0x488723
jmp 0x488784
xor eax, eax
lea rbx, [rsp + 0x26]
mov ecx, 0xa
call fcn.0044d560
add rsp, 0x30
pop rbp
ret
mov eax, esi
mov ecx, 0xa
call fcn.00462f80
mov eax, edi
mov ecx, 0xa
call fcn.00462f80
nop
nop dword [rax]
call fcn.00460ca0
jmp fcn.004886e0
Function at 0x4887c0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x488887
push rbp
mov rbp, rsp
sub rsp, 0x38
movabs rdx, 0xe981787381ac69bc
mov qword [rsp + 0x2d], rdx
mov dword [rsp + 0x34], 0x759c75e9
movabs rdx, 0x702000605050603
mov qword [rsp + 0x1f], rdx
movabs rdx, 0x709020607020702
mov qword [rsp + 0x25], rdx
xor eax, eax
jmp 0x488828
movzx r9d, byte [rsp + rsi + 0x2d]
sub r9d, edx
lea edx, [r9 - 0x17]
mov byte [rsp + rdi + 0x2d], dl
lea edx, [r8 - 0x17]
mov byte [rsp + rsi + 0x2d], dl
add rax, 2
cmp rax, 0xe
jge 0x488857
movzx edx, byte [rsp + rax + 0x1f]
movzx esi, byte [rsp + rax + 0x20]
mov edi, edx
xor edx, esi
add edx, eax
nop
cmp rdi, 0xb
jae 0x48887a
movzx r8d, byte [rsp + rdi + 0x2d]
sub r8d, edx
cmp rsi, 0xb
jb 0x48880b
jmp 0x48886e
xor eax, eax
lea rbx, [rsp + 0x2d]
mov ecx, 0xb
call fcn.0044d560
add rsp, 0x38
pop rbp
ret
mov eax, esi
mov ecx, 0xb
call fcn.00462f80
mov eax, edi
mov ecx, 0xb
call fcn.00462f80
nop
call fcn.00460ca0
jmp fcn.004887c0

Function at 0x4888a0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x488958
push rbp
mov rbp, rsp
sub rsp, 0x30
movabs rdx, 0x6e610a6f05028b10
mov qword [rsp + 0x28], rdx
movabs rdx, 0x502030301000200
mov qword [rsp + 0x1e], rdx
mov word [rsp + 0x26], 0x203
xor eax, eax
jmp 0x4888f8
movzx r9d, byte [rsp + rsi + 0x28]
sub r9d, edx
lea edx, [r9 - 0x44]
mov byte [rsp + rdi + 0x28], dl
lea edx, [r8 - 0x44]
mov byte [rsp + rsi + 0x28], dl
add rax, 2
cmp rax, 0xa
jge 0x488928
movzx edx, byte [rsp + rax + 0x1e]
movzx esi, byte [rsp + rax + 0x1f]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 8
jae 0x48894b
movzx r8d, byte [rsp + rdi + 0x28]
sub r8d, edx
nop dword [rax]
cmp rsi, 8
jb 0x4888db
jmp 0x48893f
xor eax, eax
lea rbx, [rsp + 0x28]
mov ecx, 8
call fcn.0044d560
add rsp, 0x30
pop rbp
ret
mov eax, esi
mov ecx, 8
call fcn.00462f80
mov eax, edi
mov ecx, 8
call fcn.00462f80
nop
call fcn.00460ca0
nop dword [rax]
jmp fcn.004888a0

Function at 0x489340
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4893f8
push rbp
mov rbp, rsp
sub rsp, 0x30
movabs rdx, 0x1f551772250e1310
mov qword [rsp + 0x28], rdx
movabs rdx, 0x701030005020306
mov qword [rsp + 0x1e], rdx
mov word [rsp + 0x26], 0
xor eax, eax
jmp 0x489395
movzx r9d, byte [rsp + rsi + 0x28]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x4a]
mov byte [rsp + rdi + 0x28], dl
mov byte [rsp + rsi + 0x28], r8b
add rax, 2
cmp rax, 0xa
jge 0x4893c8
movzx edx, byte [rsp + rax + 0x1e]
movzx esi, byte [rsp + rax + 0x1f]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 8
jae 0x4893eb
movzx r8d, byte [rsp + rdi + 0x28]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x4a]
nop
cmp rsi, 8
jb 0x48937b
jmp 0x4893df
xor eax, eax
lea rbx, [rsp + 0x28]
mov ecx, 8
call fcn.0044d560
add rsp, 0x30
pop rbp
ret
mov eax, esi
mov ecx, 8
call fcn.00462f80
mov eax, edi
mov ecx, 8
call fcn.00462f80
nop
call fcn.00460ca0
nop dword [rax]
jmp fcn.00489340
Function at 0x48a020
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x48a10a
push rbp
mov rbp, rsp
sub rsp, 0x48
movabs rdx, 0x69635162552f1e49
mov qword [rsp + 0x33], rdx
movabs rdx, 0x6c796e6a27696351
mov qword [rsp + 0x38], rdx
movabs rdx, 0x7476617f6e61675f
mov qword [rsp + 0x40], rdx
movabs rdx, 0x5050100030308
mov qword [rsp + 0x1d], rdx
movabs rdx, 0x1407090404020005
mov qword [rsp + 0x23], rdx
movabs rdx, 0x60b110b090e0110
mov qword [rsp + 0x2b], rdx
xor eax, eax
jmp 0x48a0ad
movzx r9d, byte [rsp + rsi + 0x33]
sub r9d, edx
lea edx, [r9 + 0x1f]
mov byte [rsp + rdi + 0x33], dl
lea edx, [r8 + 0x1f]
mov byte [rsp + rsi + 0x33], dl
add rax, 2
cmp rax, 0x16
jge 0x48a0da
movzx edx, byte [rsp + rax + 0x1d]
movzx esi, byte [rsp + rax + 0x1e]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x15
jae 0x48a0fd
movzx r8d, byte [rsp + rdi + 0x33]
sub r8d, edx
cmp rsi, 0x15
jb 0x48a090
jmp 0x48a0f1
xor eax, eax
lea rbx, [rsp + 0x33]
mov ecx, 0x15
call fcn.0044d560
add rsp, 0x48
pop rbp
ret
mov eax, esi
mov ecx, 0x15
call fcn.00462f80
mov eax, edi
mov ecx, 0x15
call fcn.00462f80
nop
call fcn.00460ca0
jmp fcn.0048a020

Function at 0x48c000
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x48c0c7
push rbp
mov rbp, rsp
sub rsp, 0x38
movabs rdx, 0xd8f2edfc756465f8
mov qword [rsp + 0x2d], rdx
mov dword [rsp + 0x34], 0x79f2eed8
movabs rdx, 0xa080408080906
mov qword [rsp + 0x1f], rdx
movabs rdx, 0x40500070305000a
mov qword [rsp + 0x25], rdx
xor eax, eax
jmp 0x48c068
movzx r9d, byte [rsp + rsi + 0x2d]
sub r9d, edx
lea edx, [r9 - 0x7a]
mov byte [rsp + rdi + 0x2d], dl
lea edx, [r8 - 0x7a]
mov byte [rsp + rsi + 0x2d], dl
add rax, 2
cmp rax, 0xe
jge 0x48c097
movzx edx, byte [rsp + rax + 0x1f]
movzx esi, byte [rsp + rax + 0x20]
mov edi, edx
xor edx, esi
add edx, eax
nop
cmp rdi, 0xb
jae 0x48c0ba
movzx r8d, byte [rsp + rdi + 0x2d]
sub r8d, edx
cmp rsi, 0xb
jb 0x48c04b
jmp 0x48c0ae
xor eax, eax
lea rbx, [rsp + 0x2d]
mov ecx, 0xb
call fcn.0044d560
add rsp, 0x38
pop rbp
ret
mov eax, esi
mov ecx, 0xb
call fcn.00462f80
mov eax, edi
mov ecx, 0xb
call fcn.00462f80
nop
call fcn.00460ca0
jmp fcn.0048c000

Function at 0x490340
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4903fd
push rbp
mov rbp, rsp
sub rsp, 0x30
movabs rdx, 0x6ef07279dc6c7ff9
mov qword [rsp + 0x27], rdx
mov byte [rsp + 0x2f], 0xf4
movabs rdx, 0x808010106060003
mov qword [rsp + 0x1d], rdx
mov word [rsp + 0x25], 0x101
xor eax, eax
nop
jmp 0x4903a0
movzx r9d, byte [rsp + rsi + 0x27]
sub r9d, edx
lea edx, [r9 + 0x77]
mov byte [rsp + rdi + 0x27], dl
lea edx, [r8 + 0x77]
mov byte [rsp + rsi + 0x27], dl
add rax, 2
nop
cmp rax, 0xa
jge 0x4903cd
movzx edx, byte [rsp + rax + 0x1d]
movzx esi, byte [rsp + rax + 0x1e]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 9
jae 0x4903f0
movzx r8d, byte [rsp + rdi + 0x27]
sub r8d, edx
cmp rsi, 9
jb 0x490382
jmp 0x4903e4
xor eax, eax
lea rbx, [rsp + 0x27]
mov ecx, 9
call fcn.0044d560
add rsp, 0x30
pop rbp
ret
mov eax, esi
mov ecx, 9
call fcn.00462f80
mov eax, edi
mov ecx, 9
call fcn.00462f80
nop
nop dword [rax]
call fcn.00460ca0
jmp fcn.00490340
Function at 0x490a80
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x490b3d
push rbp
mov rbp, rsp
sub rsp, 0x30
movabs rdx, 0xd363506ed9d1b5cd
mov qword [rsp + 0x26], rdx
mov word [rsp + 0x2e], 0x4ddf
movabs rdx, 0x709070508020001
mov qword [rsp + 0x1c], rdx
mov word [rsp + 0x24], 0x703
xor eax, eax
jmp 0x490ae0
movzx r9d, byte [rsp + rsi + 0x26]
sub r9d, edx
lea edx, [r9 - 0x64]
mov byte [rsp + rdi + 0x26], dl
lea edx, [r8 - 0x64]
mov byte [rsp + rsi + 0x26], dl
add rax, 2
nop
cmp rax, 0xa
jge 0x490b0d
movzx edx, byte [rsp + rax + 0x1c]
movzx esi, byte [rsp + rax + 0x1d]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0xa
jae 0x490b30
movzx r8d, byte [rsp + rdi + 0x26]
sub r8d, edx
cmp rsi, 0xa
jb 0x490ac2
jmp 0x490b24
xor eax, eax
lea rbx, [rsp + 0x26]
mov ecx, 0xa
call fcn.0044d560
add rsp, 0x30
pop rbp
ret
mov eax, esi
mov ecx, 0xa
call fcn.00462f80
mov eax, edi
mov ecx, 0xa
call fcn.00462f80
nop
nop dword [rax]
call fcn.00460ca0
jmp fcn.00490a80

Function at 0x492100
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4921b8
push rbp
mov rbp, rsp
sub rsp, 0x30
movabs rdx, 0x8180c1957a679554
mov qword [rsp + 0x28], rdx
movabs rdx, 0x104070304010705
mov qword [rsp + 0x1e], rdx
mov word [rsp + 0x26], 0x603
xor eax, eax
jmp 0x492158
movzx r9d, byte [rsp + rsi + 0x28]
sub r9d, edx
lea edx, [r9 - 0x11]
mov byte [rsp + rdi + 0x28], dl
lea edx, [r8 - 0x11]
mov byte [rsp + rsi + 0x28], dl
add rax, 2
cmp rax, 0xa
jge 0x492188
movzx edx, byte [rsp + rax + 0x1e]
movzx esi, byte [rsp + rax + 0x1f]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 8
jae 0x4921ab
movzx r8d, byte [rsp + rdi + 0x28]
sub r8d, edx
nop dword [rax]
cmp rsi, 8
jb 0x49213b
jmp 0x49219f
xor eax, eax
lea rbx, [rsp + 0x28]
mov ecx, 8
call fcn.0044d560
add rsp, 0x30
pop rbp
ret
mov eax, esi
mov ecx, 8
call fcn.00462f80
mov eax, edi
mov ecx, 8
call fcn.00462f80
nop
call fcn.00460ca0
nop dword [rax]
jmp fcn.00492100

Function at 0x4925c0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x492678
push rbp
mov rbp, rsp
sub rsp, 0x30
movabs rdx, 0x63e7f41c2d342c30
mov qword [rsp + 0x28], rdx
movabs rdx, 0x101020506030400
mov qword [rsp + 0x1e], rdx
mov word [rsp + 0x26], 0x302
xor eax, eax
jmp 0x492615
movzx r9d, byte [rsp + rsi + 0x28]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x35]
mov byte [rsp + rdi + 0x28], dl
mov byte [rsp + rsi + 0x28], r8b
add rax, 2
cmp rax, 0xa
jge 0x492648
movzx edx, byte [rsp + rax + 0x1e]
movzx esi, byte [rsp + rax + 0x1f]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 8
jae 0x49266b
movzx r8d, byte [rsp + rdi + 0x28]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x35]
nop
cmp rsi, 8
jb 0x4925fb
jmp 0x49265f
xor eax, eax
lea rbx, [rsp + 0x28]
mov ecx, 8
call fcn.0044d560
add rsp, 0x30
pop rbp
ret
mov eax, esi
mov ecx, 8
call fcn.00462f80
mov eax, edi
mov ecx, 8
call fcn.00462f80
nop
call fcn.00460ca0
nop dword [rax]
jmp fcn.004925c0
Function at 0x492c20
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x492d06
push rbp
mov rbp, rsp
sub rsp, 0x40
movabs rdx, 0x39d429f4e7233900
mov qword [rsp + 0x30], rdx
movabs rdx, 0x65720928713e1672
mov qword [rsp + 0x38], rdx
movabs rdx, 0x90001070d03060d
mov qword [rsp + 0x1c], rdx
movabs rdx, 0xa02000c09000107
mov qword [rsp + 0x20], rdx
movabs rdx, 0x50d0604040d0903
mov qword [rsp + 0x28], rdx
xor eax, eax
nop
jmp 0x492ca0
movzx r9d, byte [rsp + rsi + 0x30]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x1e]
mov byte [rsp + rdi + 0x30], dl
mov byte [rsp + rsi + 0x30], r8b
add rax, 2
nop dword [rax]
cmp rax, 0x14
jge 0x492cd2
movzx edx, byte [rsp + rax + 0x1c]
movzx esi, byte [rsp + rax + 0x1d]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x10
jae 0x492cf7
movzx r8d, byte [rsp + rdi + 0x30]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x1e]
cmp rsi, 0x10
jb 0x492c82
jmp 0x492ceb
xor eax, eax
lea rbx, [rsp + 0x30]
mov ecx, 0x10
nop
call fcn.0044d560
add rsp, 0x40
pop rbp
ret
mov eax, esi
mov ecx, 0x10
call fcn.00462f80
mov eax, edi
mov ecx, 0x10
nop
call fcn.00462f80
nop
call fcn.00460ca0
jmp fcn.00492c20

Function at 0x493c00
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x493cec
push rbp
mov rbp, rsp
sub rsp, 0x48
movabs rdx, 0x6106e5b4d853d704
mov qword [rsp + 0x35], rdx
movabs rdx, 0x5f1fa46106e5b4d8
mov qword [rsp + 0x38], rdx
movabs rdx, 0x726fe6b428f502a1
mov qword [rsp + 0x40], rdx
movabs rdx, 0x909080e0e040f0b
mov qword [rsp + 0x1d], rdx
movabs rdx, 0xd10000c050c0b05
mov qword [rsp + 0x25], rdx
movabs rdx, 0x1030f0f0401060e
mov qword [rsp + 0x2d], rdx
xor eax, eax
jmp 0x493c8a
movzx r9d, byte [rsp + rsi + 0x35]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x54]
mov byte [rsp + rdi + 0x35], dl
mov byte [rsp + rsi + 0x35], r8b
add rax, 2
cmp rax, 0x18
jge 0x493cbc
movzx edx, byte [rsp + rax + 0x1d]
movzx esi, byte [rsp + rax + 0x1e]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x13
jae 0x493cdf
movzx r8d, byte [rsp + rdi + 0x35]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x54]
cmp rsi, 0x13
jb 0x493c70
jmp 0x493cd3
xor eax, eax
lea rbx, [rsp + 0x35]
mov ecx, 0x13
call fcn.0044d560
add rsp, 0x48
pop rbp
ret
mov eax, esi
mov ecx, 0x13
call fcn.00462f80
mov eax, edi
mov ecx, 0x13
call fcn.00462f80
nop
call fcn.00460ca0
jmp fcn.00493c00
Function at 0x4942a0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x49439b
push rbp
mov rbp, rsp
sub rsp, 0x50
movabs rdx, 0x11bdc1a869671f62
mov qword [rsp + 0x39], rdx
movabs rdx, 0x455fd3d7a6724f11
mov qword [rsp + 0x40], rdx
movabs rdx, 0xf4a1ac74700b6364
mov qword [rsp + 0x48], rdx
movabs rdx, 0xb0c01060f050b00
mov qword [rsp + 0x1d], rdx
movabs rdx, 0x15050a0014000c11
mov qword [rsp + 0x25], rdx
movabs rdx, 0x1040f0b15050a00
mov qword [rsp + 0x29], rdx
movabs rdx, 0x1500160501071514
mov qword [rsp + 0x31], rdx
xor eax, eax
jmp 0x494339
movzx r9d, byte [rsp + rsi + 0x39]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x42]
mov byte [rsp + rdi + 0x39], dl
mov byte [rsp + rsi + 0x39], r8b
add rax, 2
cmp rax, 0x1c
jge 0x49436b
movzx edx, byte [rsp + rax + 0x1d]
movzx esi, byte [rsp + rax + 0x1e]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x17
jae 0x49438e
movzx r8d, byte [rsp + rdi + 0x39]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x42]
cmp rsi, 0x17
jb 0x49431f
jmp 0x494382
xor eax, eax
lea rbx, [rsp + 0x39]
mov ecx, 0x17
call fcn.0044d560
add rsp, 0x50
pop rbp
ret
mov eax, esi
mov ecx, 0x17
call fcn.00462f80
mov eax, edi
mov ecx, 0x17
call fcn.00462f80
nop
nop dword [rax + rax]
call fcn.00460ca0
jmp fcn.004942a0

Function at 0x4943c0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4944bd
push rbp
mov rbp, rsp
sub rsp, 0x50
movabs rdx, 0x85985c57637a6f4e
mov qword [rsp + 0x39], rdx
movabs rdx, 0x6674799d65406285
mov qword [rsp + 0x40], rdx
movabs rdx, 0x876eae8975898361
mov qword [rsp + 0x48], rdx
movabs rdx, 0xd090f080405130e
mov qword [rsp + 0x1d], rdx
movabs rdx, 0x90b040c0c060e11
mov qword [rsp + 0x25], rdx
movabs rdx, 0x13120210090b040c
mov qword [rsp + 0x29], rdx
movabs rdx, 0x1604041409040b07
mov qword [rsp + 0x31], rdx
xor eax, eax
jmp 0x494460
movzx r9d, byte [rsp + rsi + 0x39]
sub r9d, edx
lea edx, [r9 + 0xd]
mov byte [rsp + rdi + 0x39], dl
lea edx, [r8 + 0xd]
mov byte [rsp + rsi + 0x39], dl
add rax, 2
nop dword [rax]
cmp rax, 0x1c
jge 0x49448d
movzx edx, byte [rsp + rax + 0x1d]
movzx esi, byte [rsp + rax + 0x1e]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x17
jae 0x4944b0
movzx r8d, byte [rsp + rdi + 0x39]
sub r8d, edx
cmp rsi, 0x17
jb 0x49443f
jmp 0x4944a4
xor eax, eax
lea rbx, [rsp + 0x39]
mov ecx, 0x17
call fcn.0044d560
add rsp, 0x50
pop rbp
ret
mov eax, esi
mov ecx, 0x17
call fcn.00462f80
mov eax, edi
mov ecx, 0x17
call fcn.00462f80
nop
nop dword [rax]
call fcn.00460ca0
jmp fcn.004943c0
Function at 0x498a20
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x498add
push rbp
mov rbp, rsp
sub rsp, 0x30
movabs rdx, 0x8f7484727f787f49
mov qword [rsp + 0x27], rdx
mov byte [rsp + 0x2f], 0x96
movabs rdx, 0x202010503080207
mov qword [rsp + 0x1d], rdx
mov word [rsp + 0x25], 0x303
xor eax, eax
nop
jmp 0x498a80
movzx r9d, byte [rsp + rsi + 0x27]
sub r9d, edx
lea edx, [r9 - 0xe]
mov byte [rsp + rdi + 0x27], dl
lea edx, [r8 - 0xe]
mov byte [rsp + rsi + 0x27], dl
add rax, 2
nop
cmp rax, 0xa
jge 0x498aad
movzx edx, byte [rsp + rax + 0x1d]
movzx esi, byte [rsp + rax + 0x1e]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 9
jae 0x498ad0
movzx r8d, byte [rsp + rdi + 0x27]
sub r8d, edx
cmp rsi, 9
jb 0x498a62
jmp 0x498ac4
xor eax, eax
lea rbx, [rsp + 0x27]
mov ecx, 9
call fcn.0044d560
add rsp, 0x30
pop rbp
ret
mov eax, esi
mov ecx, 9
call fcn.00462f80
mov eax, edi
mov ecx, 9
call fcn.00462f80
nop
nop dword [rax]
call fcn.00460ca0
jmp fcn.00498a20
Function at 0x4a9bc0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4a9cbb
push rbp
mov rbp, rsp
sub rsp, 0x50
movabs rdx, 0x1570166f63b4c570
mov qword [rsp + 0x38], rdx
movabs rdx, 0x63b90c732e942174
mov qword [rsp + 0x40], rdx
movabs rdx, 0xe3d520c30e2d2069
mov qword [rsp + 0x48], rdx
movabs rdx, 0x1012010b100a1716
mov qword [rsp + 0x1e], rdx
movabs rdx, 0x9090a070e050b14
mov qword [rsp + 0x26], rdx
movabs rdx, 0x130209090a070e05
mov qword [rsp + 0x28], rdx
movabs rdx, 0x170d130507161512
mov qword [rsp + 0x30], rdx
xor eax, eax
jmp 0x4a9c59
movzx r9d, byte [rsp + rsi + 0x38]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x36]
mov byte [rsp + rdi + 0x38], dl
mov byte [rsp + rsi + 0x38], r8b
add rax, 2
cmp rax, 0x1a
jge 0x4a9c8b
movzx edx, byte [rsp + rax + 0x1e]
movzx esi, byte [rsp + rax + 0x1f]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x18
jae 0x4a9cae
movzx r8d, byte [rsp + rdi + 0x38]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x36]
cmp rsi, 0x18
jb 0x4a9c3f
jmp 0x4a9ca2
xor eax, eax
lea rbx, [rsp + 0x38]
mov ecx, 0x18
call fcn.0044d560
add rsp, 0x50
pop rbp
ret
mov eax, esi
mov ecx, 0x18
call fcn.00462f80
mov eax, edi
mov ecx, 0x18
call fcn.00462f80
nop
nop dword [rax + rax]
call fcn.00460ca0
jmp fcn.004a9bc0

Function at 0x4aada0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4aae66
push rbp
mov rbp, rsp
sub rsp, 0x30
movabs rdx, 0x54746302224659e4
mov qword [rsp + 0x27], rdx
mov byte [rsp + 0x2f], 0x43
movabs rdx, 0x108010004080307
mov qword [rsp + 0x1d], rdx
mov word [rsp + 0x25], 0x102
xor eax, eax
nop
jmp 0x4aae00
movzx r9d, byte [rsp + rsi + 0x27]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x14]
mov byte [rsp + rdi + 0x27], dl
mov byte [rsp + rsi + 0x27], r8b
add rax, 2
nop dword [rax]
cmp rax, 0xa
jge 0x4aae32
movzx edx, byte [rsp + rax + 0x1d]
movzx esi, byte [rsp + rax + 0x1e]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 9
jae 0x4aae57
movzx r8d, byte [rsp + rdi + 0x27]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x14]
cmp rsi, 9
jb 0x4aade2
jmp 0x4aae4b
xor eax, eax
lea rbx, [rsp + 0x27]
mov ecx, 9
nop
call fcn.0044d560
add rsp, 0x30
pop rbp
ret
mov eax, esi
mov ecx, 9
call fcn.00462f80
mov eax, edi
mov ecx, 9
nop
call fcn.00462f80
nop
call fcn.00460ca0
jmp fcn.004aada0
Function at 0x4ab6a0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
lea r12, [rsp - 8]
cmp r12, qword [r14 + 0x10]
jbe 0x4ab7fd
push rbp
mov rbp, rsp
add rsp, 0xffffffffffffff80
movabs rdx, 0x3a1963656c661a5f
mov qword [rsp + 0x53], rdx
movabs rdx, 0x4b31e86538f4101b
mov qword [rsp + 0x5b], rdx
movabs rdx, 0x197265206c4b31e8
mov qword [rsp + 0x60], rdx
movabs rdx, 0x376b369203d7295
mov qword [rsp + 0x68], rdx
movabs rdx, 0xfd8a88e86616be6c
mov qword [rsp + 0x70], rdx
movabs rdx, 0x78722afcf0cddfc4
mov qword [rsp + 0x78], rdx
movabs rdx, 0x91524001c092227
mov qword [rsp + 0x1d], rdx
movabs rdx, 0x20082b26080e0915
mov qword [rsp + 0x23], rdx
movabs rdx, 0xe0d0f291f242328
mov qword [rsp + 0x2b], rdx
movabs rdx, 0xb0a150629262a21
mov qword [rsp + 0x33], rdx
movabs rdx, 0x200820151e1c1e21
mov qword [rsp + 0x3b], rdx
movabs rdx, 0x91a140a2125261f
mov qword [rsp + 0x43], rdx
movabs rdx, 0xd2117280114091e
mov qword [rsp + 0x4b], rdx
xor eax, eax
jmp 0x4ab7a0
movzx r9d, byte [rsp + rsi + 0x53]
sub r9d, edx
lea edx, [r9 - 0x63]
mov byte [rsp + rdi + 0x53], dl
lea edx, [r8 - 0x63]
mov byte [rsp + rsi + 0x53], dl
add rax, 2
nop dword [rax + rax]
cmp rax, 0x36
jge 0x4ab7cd
movzx edx, byte [rsp + rax + 0x1d]
movzx esi, byte [rsp + rax + 0x1e]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x2d
jae 0x4ab7f0
movzx r8d, byte [rsp + rdi + 0x53]
sub r8d, edx
cmp rsi, 0x2d
jb 0x4ab77e
jmp 0x4ab7e4
xor eax, eax
lea rbx, [rsp + 0x53]
mov ecx, 0x2d
call fcn.0044d560
sub rsp, 0xffffffffffffff80
pop rbp
ret
mov eax, esi
mov ecx, 0x2d
call fcn.00462f80
mov eax, edi
mov ecx, 0x2d
call fcn.00462f80
nop
nop dword [rax]
call fcn.00460ca0
jmp fcn.004ab6a0

Function at 0x4abf80
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4ac066
push rbp
mov rbp, rsp
sub rsp, 0x38
movabs rdx, 0xf474fda603b7e9fd
mov qword [rsp + 0x2a], rdx
movabs rdx, 0x2eeceb6c6f9ff474
mov qword [rsp + 0x30], rdx
movabs rdx, 0x50b010401040801
mov qword [rsp + 0x18], rdx
movabs rdx, 0x3050b01040104
mov qword [rsp + 0x1a], rdx
movabs rdx, 0x10c0702090c0407
mov qword [rsp + 0x22], rdx
xor eax, eax
nop
jmp 0x4ac000
movzx r9d, byte [rsp + rsi + 0x2a]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x64]
mov byte [rsp + rdi + 0x2a], dl
mov byte [rsp + rsi + 0x2a], r8b
add rax, 2
nop dword [rax]
cmp rax, 0x12
jge 0x4ac032
movzx edx, byte [rsp + rax + 0x18]
movzx esi, byte [rsp + rax + 0x19]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0xe
jae 0x4ac057
movzx r8d, byte [rsp + rdi + 0x2a]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x64]
cmp rsi, 0xe
jb 0x4abfe2
jmp 0x4ac04b
xor eax, eax
lea rbx, [rsp + 0x2a]
mov ecx, 0xe
nop
call fcn.0044d560
add rsp, 0x38
pop rbp
ret
mov eax, esi
mov ecx, 0xe
call fcn.00462f80
mov eax, edi
mov ecx, 0xe
nop
call fcn.00462f80
nop
call fcn.00460ca0
jmp fcn.004abf80