joyce8/EMBER2024-capa huggingface dataset:
Function at 0x326097780
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x32609786c
push rbp
mov rbp, rsp
sub rsp, 0x48
movabs rdx, 0x4e65752a653bfcf5
mov qword [rsp + 0x31], rdx
movabs rdx, 0x2ee31974ee23484e
mov qword [rsp + 0x38], rdx
movabs rdx, 0x1efa694020642161
mov qword [rsp + 0x40], rdx
movabs rdx, 0x2080115100a0d07
mov qword [rsp + 0x19], rdx
movabs rdx, 0x1315090016130c07
mov qword [rsp + 0x21], rdx
movabs rdx, 0x10c07070400100e
mov qword [rsp + 0x29], rdx
xor eax, eax
jmp 0x32609780a
movzx r9d, byte [rsp + rsi + 0x31]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x16]
mov byte [rsp + rdi + 0x31], dl
mov byte [rsp + rsi + 0x31], r8b
add rax, 2
cmp rax, 0x18
jge 0x32609783c
movzx edx, byte [rsp + rax + 0x19]
movzx esi, byte [rsp + rax + 0x1a]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x17
jae 0x32609785f
movzx r8d, byte [rsp + rdi + 0x31]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x16]
cmp rsi, 0x17
jb 0x3260977f0
jmp 0x326097853
xor eax, eax
lea rbx, [rsp + 0x31]
mov ecx, 0x17
call fcn.32601d600
add rsp, 0x48
pop rbp
ret
mov eax, esi
mov ecx, 0x17
call fcn.326033020
mov eax, edi
mov ecx, 0x17
call fcn.326033020
nop
call fcn.326030d20
jmp fcn.326097780

Function at 0x326099800
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x32609990c
push rbp
mov rbp, rsp
sub rsp, 0x58
movabs rdx, 0x533f766565554d4d
mov qword [rsp + 0x40], rdx
movabs rdx, 0x6401297549206f65
mov qword [rsp + 0x48], rdx
movabs rdx, 0x616c69513b5f4578
mov qword [rsp + 0x50], rdx
movabs rdx, 0x1610060b01170c06
mov qword [rsp + 0x1e], rdx
movabs rdx, 0x30b1610060b0117
mov qword [rsp + 0x20], rdx
movabs rdx, 0xd17130c0b130b0b
mov qword [rsp + 0x28], rdx
movabs rdx, 0xb1702120e01030e
mov qword [rsp + 0x30], rdx
movabs rdx, 0x1107031313140b06
mov qword [rsp + 0x38], rdx
xor eax, eax
jmp 0x3260998a8
movzx r9d, byte [rsp + rsi + 0x40]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x17]
mov byte [rsp + rdi + 0x40], dl
mov byte [rsp + rsi + 0x40], r8b
add rax, 2
cmp rax, 0x22
jge 0x3260998dc
movzx edx, byte [rsp + rax + 0x1e]
movzx esi, byte [rsp + rax + 0x1f]
mov edi, edx
xor edx, esi
add edx, eax
nop
cmp rdi, 0x18
jae 0x3260998ff
movzx r8d, byte [rsp + rdi + 0x40]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x17]
cmp rsi, 0x18
jb 0x32609988e
jmp 0x3260998f3
xor eax, eax
lea rbx, [rsp + 0x40]
mov ecx, 0x18
call fcn.32601d600
add rsp, 0x58
pop rbp
ret
mov eax, esi
mov ecx, 0x18
call fcn.326033020
mov eax, edi
mov ecx, 0x18
call fcn.326033020
nop
call fcn.326030d20
jmp fcn.326099800
Function at 0x32609b580
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x32609b67b
push rbp
mov rbp, rsp
sub rsp, 0x50
movabs rdx, 0xd72508fd6423edc2
mov qword [rsp + 0x3c], rdx
movabs rdx, 0x64bca809d72508fd
mov qword [rsp + 0x40], rdx
movabs rdx, 0xd6d696820610de9
mov qword [rsp + 0x48], rdx
movabs rdx, 0xe0a000c010e0a13
mov qword [rsp + 0x1e], rdx
movabs rdx, 0x130c091305000807
mov qword [rsp + 0x26], rdx
movabs rdx, 0x802100e0601130c
mov qword [rsp + 0x2c], rdx
movabs rdx, 0x1006100e040d0e04
mov qword [rsp + 0x34], rdx
xor eax, eax
jmp 0x32609b619
movzx r9d, byte [rsp + rsi + 0x3c]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x33]
mov byte [rsp + rdi + 0x3c], dl
mov byte [rsp + rsi + 0x3c], r8b
add rax, 2
cmp rax, 0x1e
jge 0x32609b64b
movzx edx, byte [rsp + rax + 0x1e]
movzx esi, byte [rsp + rax + 0x1f]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x14
jae 0x32609b66e
movzx r8d, byte [rsp + rdi + 0x3c]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x33]
cmp rsi, 0x14
jb 0x32609b5ff
jmp 0x32609b662
xor eax, eax
lea rbx, [rsp + 0x3c]
mov ecx, 0x14
call fcn.32601d600
add rsp, 0x50
pop rbp
ret
mov eax, esi
mov ecx, 0x14
call fcn.326033020
mov eax, edi
mov ecx, 0x14
call fcn.326033020
nop
nop dword [rax + rax]
call fcn.326030d20
jmp fcn.32609b580

Function at 0x32609c740
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x32609c82c
push rbp
mov rbp, rsp
sub rsp, 0x48
movabs rdx, 0x206e5721505a3841
mov qword [rsp + 0x33], rdx
movabs rdx, 0x516e613e40206e57
mov qword [rsp + 0x38], rdx
movabs rdx, 0x596d69544763ee3e
mov qword [rsp + 0x40], rdx
movabs rdx, 0xd010f0902010803
mov qword [rsp + 0x1b], rdx
movabs rdx, 0xe09050c0c031404
mov qword [rsp + 0x23], rdx
movabs rdx, 0x10f10090f140210
mov qword [rsp + 0x2b], rdx
xor eax, eax
jmp 0x32609c7ca
movzx r9d, byte [rsp + rsi + 0x33]
lea edx, [r9 + rdx]
lea edx, [rdx - 8]
mov byte [rsp + rdi + 0x33], dl
mov byte [rsp + rsi + 0x33], r8b
add rax, 2
cmp rax, 0x18
jge 0x32609c7fc
movzx edx, byte [rsp + rax + 0x1b]
movzx esi, byte [rsp + rax + 0x1c]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x15
jae 0x32609c81f
movzx r8d, byte [rsp + rdi + 0x33]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 8]
cmp rsi, 0x15
jb 0x32609c7b0
jmp 0x32609c813
xor eax, eax
lea rbx, [rsp + 0x33]
mov ecx, 0x15
call fcn.32601d600
add rsp, 0x48
pop rbp
ret
mov eax, esi
mov ecx, 0x15
call fcn.326033020
mov eax, edi
mov ecx, 0x15
call fcn.326033020
nop
call fcn.326030d20
jmp fcn.32609c740
Function at 0x32609e8a0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x32609e98c
push rbp
mov rbp, rsp
sub rsp, 0x48
movabs rdx, 0x532069655c467854
mov qword [rsp + 0x34], rdx
movabs rdx, 0x5c722e7453206965
mov qword [rsp + 0x38], rdx
movabs rdx, 0x695e695b6f707265
mov qword [rsp + 0x40], rdx
movabs rdx, 0x3030113090f1301
mov qword [rsp + 0x1e], rdx
movabs rdx, 0x3120e0e0c0a0303
mov qword [rsp + 0x24], rdx
movabs rdx, 0xa0c021001030b12
mov qword [rsp + 0x2c], rdx
xor eax, eax
jmp 0x32609e92a
movzx r9d, byte [rsp + rsi + 0x34]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x16]
mov byte [rsp + rdi + 0x34], dl
mov byte [rsp + rsi + 0x34], r8b
add rax, 2
cmp rax, 0x16
jge 0x32609e95c
movzx edx, byte [rsp + rax + 0x1e]
movzx esi, byte [rsp + rax + 0x1f]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x14
jae 0x32609e97f
movzx r8d, byte [rsp + rdi + 0x34]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x16]
cmp rsi, 0x14
jb 0x32609e910
jmp 0x32609e973
xor eax, eax
lea rbx, [rsp + 0x34]
mov ecx, 0x14
call fcn.32601d600
add rsp, 0x48
pop rbp
ret
mov eax, esi
mov ecx, 0x14
call fcn.326033020
mov eax, edi
mov ecx, 0x14
call fcn.326033020
nop
call fcn.326030d20
jmp fcn.32609e8a0

Function at 0x32609e9a0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x32609ea9d
push rbp
mov rbp, rsp
sub rsp, 0x50
movabs rdx, 0x7873684274707a62
mov qword [rsp + 0x39], rdx
movabs rdx, 0x646e618658206978
mov qword [rsp + 0x40], rdx
movabs rdx, 0x656d89996564722b
mov qword [rsp + 0x48], rdx
movabs rdx, 0x70a08140a0414
mov qword [rsp + 0x1b], rdx
movabs rdx, 0x805000b0a121213
mov qword [rsp + 0x23], rdx
movabs rdx, 0xf04120a01140805
mov qword [rsp + 0x29], rdx
movabs rdx, 0x12011300000b0f02
mov qword [rsp + 0x31], rdx
xor eax, eax
jmp 0x32609ea40
movzx r9d, byte [rsp + rsi + 0x39]
sub r9d, edx
lea edx, [r9 + 0x14]
mov byte [rsp + rdi + 0x39], dl
lea edx, [r8 + 0x14]
mov byte [rsp + rsi + 0x39], dl
add rax, 2
nop dword [rax]
cmp rax, 0x1e
jge 0x32609ea6d
movzx edx, byte [rsp + rax + 0x1b]
movzx esi, byte [rsp + rax + 0x1c]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x17
jae 0x32609ea90
movzx r8d, byte [rsp + rdi + 0x39]
sub r8d, edx
cmp rsi, 0x17
jb 0x32609ea1f
jmp 0x32609ea84
xor eax, eax
lea rbx, [rsp + 0x39]
mov ecx, 0x17
call fcn.32601d600
add rsp, 0x50
pop rbp
ret
mov eax, esi
mov ecx, 0x17
call fcn.326033020
mov eax, edi
mov ecx, 0x17
call fcn.326033020
nop
nop dword [rax]
call fcn.326030d20
jmp fcn.32609e9a0
Function at 0x32609fda0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x32609feba
push rbp
mov rbp, rsp
sub rsp, 0x58
movabs rdx, 0x64747c6ef920954b
mov qword [rsp + 0x3e], rdx
movabs rdx, 0x8174532061691384
mov qword [rsp + 0x46], rdx
movabs rdx, 0x7175817453206169
mov qword [rsp + 0x48], rdx
movabs rdx, 0xe5090542a1c8261
mov qword [rsp + 0x50], rdx
movabs rdx, 0x1408011113000904
mov qword [rsp + 0x18], rdx
movabs rdx, 0x13191103081408
mov qword [rsp + 0x1e], rdx
movabs rdx, 0x1517090305070f15
mov qword [rsp + 0x26], rdx
movabs rdx, 0x1315101400131807
mov qword [rsp + 0x2e], rdx
movabs rdx, 0x10f140700051100
mov qword [rsp + 0x36], rdx
xor eax, eax
jmp 0x32609fe57
movzx r9d, byte [rsp + rsi + 0x3e]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x55]
mov byte [rsp + rdi + 0x3e], dl
mov byte [rsp + rsi + 0x3e], r8b
add rax, 2
cmp rax, 0x26
jge 0x32609fe89
movzx edx, byte [rsp + rax + 0x18]
movzx esi, byte [rsp + rax + 0x19]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x1a
jae 0x32609fead
movzx r8d, byte [rsp + rdi + 0x3e]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x55]
cmp rsi, 0x1a
jb 0x32609fe3d
jmp 0x32609fea1
xor eax, eax
lea rbx, [rsp + 0x3e]
mov ecx, 0x1a
call fcn.32601d600
add rsp, 0x58
pop rbp
nop
ret
mov eax, esi
mov ecx, 0x1a
call fcn.326033020
mov eax, edi
mov ecx, 0x1a
call fcn.326033020
nop
call fcn.326030d20
nop
jmp fcn.32609fda0

Function at 0x3260a0020
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x3260a010a
push rbp
mov rbp, rsp
sub rsp, 0x48
movabs rdx, 0x6169b6ba6d73d054
mov qword [rsp + 0x32], rdx
movabs rdx, 0x648aa5268a206169
mov qword [rsp + 0x38], rdx
movabs rdx, 0x6501c854c364afc3
mov qword [rsp + 0x40], rdx
movabs rdx, 0x50e0b110b0c0a14
mov qword [rsp + 0x1c], rdx
movabs rdx, 0x41314010a11050e
mov qword [rsp + 0x22], rdx
movabs rdx, 0x130c0f09130c1109
mov qword [rsp + 0x2a], rdx
xor eax, eax
jmp 0x3260a00ad
movzx r9d, byte [rsp + rsi + 0x32]
sub r9d, edx
lea edx, [r9 - 0x44]
mov byte [rsp + rdi + 0x32], dl
lea edx, [r8 - 0x44]
mov byte [rsp + rsi + 0x32], dl
add rax, 2
cmp rax, 0x16
jge 0x3260a00da
movzx edx, byte [rsp + rax + 0x1c]
movzx esi, byte [rsp + rax + 0x1d]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x16
jae 0x3260a00fd
movzx r8d, byte [rsp + rdi + 0x32]
sub r8d, edx
cmp rsi, 0x16
jb 0x3260a0090
jmp 0x3260a00f1
xor eax, eax
lea rbx, [rsp + 0x32]
mov ecx, 0x16
call fcn.32601d600
add rsp, 0x48
pop rbp
ret
mov eax, esi
mov ecx, 0x16
call fcn.326033020
mov eax, edi
mov ecx, 0x16
call fcn.326033020
nop
call fcn.326030d20
jmp fcn.3260a0020
Function at 0x3260a1060
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x3260a114a
push rbp
mov rbp, rsp
sub rsp, 0x40
movabs rdx, 0x6e4feb53f25f54a4
mov qword [rsp + 0x2f], rdx
movabs rdx, 0x646e4feb53f25f54
mov qword [rsp + 0x30], rdx
movabs rdx, 0xd2a6d05469a4728a
mov qword [rsp + 0x38], rdx
movabs rdx, 0xe0f000903050b06
mov qword [rsp + 0x1b], rdx
movabs rdx, 0x20c02030e0f0009
mov qword [rsp + 0x1f], rdx
movabs rdx, 0x505100f020f050b
mov qword [rsp + 0x27], rdx
xor eax, eax
jmp 0x3260a10ed
movzx r9d, byte [rsp + rsi + 0x2f]
sub r9d, edx
lea edx, [r9 - 0x36]
mov byte [rsp + rdi + 0x2f], dl
lea edx, [r8 - 0x36]
mov byte [rsp + rsi + 0x2f], dl
add rax, 2
cmp rax, 0x14
jge 0x3260a111a
movzx edx, byte [rsp + rax + 0x1b]
movzx esi, byte [rsp + rax + 0x1c]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x11
jae 0x3260a113d
movzx r8d, byte [rsp + rdi + 0x2f]
sub r8d, edx
cmp rsi, 0x11
jb 0x3260a10d0
jmp 0x3260a1131
xor eax, eax
lea rbx, [rsp + 0x2f]
mov ecx, 0x11
call fcn.32601d600
add rsp, 0x40
pop rbp
ret
mov eax, esi
mov ecx, 0x11
call fcn.326033020
mov eax, edi
mov ecx, 0x11
call fcn.326033020
nop
call fcn.326030d20
jmp fcn.3260a1060

Function at 0x3260a20c0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x3260a21bd
push rbp
mov rbp, rsp
sub rsp, 0x50
movabs rdx, 0x4c1a5231616dec60
mov qword [rsp + 0x3b], rdx
movabs rdx, 0x48e46174534c1a52
mov qword [rsp + 0x40], rdx
movabs rdx, 0x515853e8504a0261
mov qword [rsp + 0x48], rdx
movabs rdx, 0xb0c140e060b0114
mov qword [rsp + 0x1d], rdx
movabs rdx, 0x407060f0e0f1104
mov qword [rsp + 0x25], rdx
movabs rdx, 0x1111051314110407
mov qword [rsp + 0x2b], rdx
movabs rdx, 0xf0f1000121306
mov qword [rsp + 0x33], rdx
xor eax, eax
jmp 0x3260a2160
movzx r9d, byte [rsp + rsi + 0x3b]
sub r9d, edx
lea edx, [r9 + 0x33]
mov byte [rsp + rdi + 0x3b], dl
lea edx, [r8 + 0x33]
mov byte [rsp + rsi + 0x3b], dl
add rax, 2
nop dword [rax]
cmp rax, 0x1e
jge 0x3260a218d
movzx edx, byte [rsp + rax + 0x1d]
movzx esi, byte [rsp + rax + 0x1e]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x15
jae 0x3260a21b0
movzx r8d, byte [rsp + rdi + 0x3b]
sub r8d, edx
cmp rsi, 0x15
jb 0x3260a213f
jmp 0x3260a21a4
xor eax, eax
lea rbx, [rsp + 0x3b]
mov ecx, 0x15
call fcn.32601d600
add rsp, 0x50
pop rbp
ret
mov eax, esi
mov ecx, 0x15
call fcn.326033020
mov eax, edi
mov ecx, 0x15
call fcn.326033020
nop
nop dword [rax]
call fcn.326030d20
jmp fcn.3260a20c0
Function at 0x3260a2580
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x3260a267b
push rbp
mov rbp, rsp
sub rsp, 0x48
movabs rdx, 0x1adbba0f61260344
mov qword [rsp + 0x33], rdx
movabs rdx, 0x34df6174421adbba
mov qword [rsp + 0x38], rdx
movabs rdx, 0x2c1e2e2dece0cdf8
mov qword [rsp + 0x40], rdx
movabs rdx, 0x100b11010d040508
mov qword [rsp + 0x19], rdx
movabs rdx, 0xd0b040008070e12
mov qword [rsp + 0x21], rdx
movabs rdx, 0x20c0d0b04000807
mov qword [rsp + 0x23], rdx
movabs rdx, 0x6140f1213110f06
mov qword [rsp + 0x2b], rdx
xor eax, eax
jmp 0x3260a2619
movzx r9d, byte [rsp + rsi + 0x33]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x20]
mov byte [rsp + rdi + 0x33], dl
mov byte [rsp + rsi + 0x33], r8b
add rax, 2
cmp rax, 0x1a
jge 0x3260a264b
movzx edx, byte [rsp + rax + 0x19]
movzx esi, byte [rsp + rax + 0x1a]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x15
jae 0x3260a266e
movzx r8d, byte [rsp + rdi + 0x33]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x20]
cmp rsi, 0x15
jb 0x3260a25ff
jmp 0x3260a2662
xor eax, eax
lea rbx, [rsp + 0x33]
mov ecx, 0x15
call fcn.32601d600
add rsp, 0x48
pop rbp
ret
mov eax, esi
mov ecx, 0x15
call fcn.326033020
mov eax, edi
mov ecx, 0x15
call fcn.326033020
nop
nop dword [rax + rax]
call fcn.326030d20
jmp fcn.3260a2580

Function at 0x3260a3060
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x3260a317a
push rbp
mov rbp, rsp
sub rsp, 0x58
movabs rdx, 0xdb8ecd976758e042
mov qword [rsp + 0x3e], rdx
movabs rdx, 0xc5141fbd65376c69
mov qword [rsp + 0x46], rdx
movabs rdx, 0xf86ec5141fbd6537
mov qword [rsp + 0x48], rdx
movabs rdx, 0x413669e6c6647261
mov qword [rsp + 0x50], rdx
movabs rdx, 0x181904021607010a
mov qword [rsp + 0x1c], rdx
movabs rdx, 0x604181904021607
mov qword [rsp + 0x1e], rdx
movabs rdx, 0xf180e1802111615
mov qword [rsp + 0x26], rdx
movabs rdx, 0x104150e0d0c0d02
mov qword [rsp + 0x2e], rdx
movabs rdx, 0x2050e190111070c
mov qword [rsp + 0x36], rdx
xor eax, eax
jmp 0x3260a3117
movzx r9d, byte [rsp + rsi + 0x3e]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x7f]
mov byte [rsp + rdi + 0x3e], dl
mov byte [rsp + rsi + 0x3e], r8b
add rax, 2
cmp rax, 0x22
jge 0x3260a3149
movzx edx, byte [rsp + rax + 0x1c]
movzx esi, byte [rsp + rax + 0x1d]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x1a
jae 0x3260a316d
movzx r8d, byte [rsp + rdi + 0x3e]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x7f]
cmp rsi, 0x1a
jb 0x3260a30fd
jmp 0x3260a3161
xor eax, eax
lea rbx, [rsp + 0x3e]
mov ecx, 0x1a
call fcn.32601d600
add rsp, 0x58
pop rbp
nop
ret
mov eax, esi
mov ecx, 0x1a
call fcn.326033020
mov eax, edi
mov ecx, 0x1a
call fcn.326033020
nop
call fcn.326030d20
nop
jmp fcn.3260a3060
Function at 0x3260a34c0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x3260a35aa
push rbp
mov rbp, rsp
sub rsp, 0x40
movabs rdx, 0x6174852069fb7ff1
mov qword [rsp + 0x2e], rdx
movabs rdx, 0xef6e6174852069fb
mov qword [rsp + 0x30], rdx
movabs rdx, 0x23bcda540964e8f2
mov qword [rsp + 0x38], rdx
movabs rdx, 0x101100d0f050b07
mov qword [rsp + 0x1c], rdx
movabs rdx, 0x11020101100d0f05
mov qword [rsp + 0x1e], rdx
movabs rdx, 0xa090b000f010200
mov qword [rsp + 0x26], rdx
xor eax, eax
jmp 0x3260a354d
movzx r9d, byte [rsp + rsi + 0x2e]
sub r9d, edx
lea edx, [r9 - 0x7b]
mov byte [rsp + rdi + 0x2e], dl
lea edx, [r8 - 0x7b]
mov byte [rsp + rsi + 0x2e], dl
add rax, 2
cmp rax, 0x12
jge 0x3260a357a
movzx edx, byte [rsp + rax + 0x1c]
movzx esi, byte [rsp + rax + 0x1d]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x12
jae 0x3260a359d
movzx r8d, byte [rsp + rdi + 0x2e]
sub r8d, edx
cmp rsi, 0x12
jb 0x3260a3530
jmp 0x3260a3591
xor eax, eax
lea rbx, [rsp + 0x2e]
mov ecx, 0x12
call fcn.32601d600
add rsp, 0x40
pop rbp
ret
mov eax, esi
mov ecx, 0x12
call fcn.326033020
mov eax, edi
mov ecx, 0x12
call fcn.326033020
nop
call fcn.326030d20
jmp fcn.3260a34c0

Function at 0x3260a3d80
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x3260a3e7b
push rbp
mov rbp, rsp
sub rsp, 0x48
movabs rdx, 0x7f6b6d308b2d91b2
mov qword [rsp + 0x33], rdx
movabs rdx, 0x86878774537f6b6d
mov qword [rsp + 0x38], rdx
movabs rdx, 0x654c7854bf86766d
mov qword [rsp + 0x40], rdx
movabs rdx, 0x1010120b0f0c0001
mov qword [rsp + 0x19], rdx
movabs rdx, 0xa0e120501020210
mov qword [rsp + 0x21], rdx
movabs rdx, 0x3050a0e12050102
mov qword [rsp + 0x23], rdx
movabs rdx, 0x50113000704030d
mov qword [rsp + 0x2b], rdx
xor eax, eax
jmp 0x3260a3e19
movzx r9d, byte [rsp + rsi + 0x33]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x27]
mov byte [rsp + rdi + 0x33], dl
mov byte [rsp + rsi + 0x33], r8b
add rax, 2
cmp rax, 0x1a
jge 0x3260a3e4b
movzx edx, byte [rsp + rax + 0x19]
movzx esi, byte [rsp + rax + 0x1a]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x15
jae 0x3260a3e6e
movzx r8d, byte [rsp + rdi + 0x33]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x27]
cmp rsi, 0x15
jb 0x3260a3dff
jmp 0x3260a3e62
xor eax, eax
lea rbx, [rsp + 0x33]
mov ecx, 0x15
call fcn.32601d600
add rsp, 0x48
pop rbp
ret
mov eax, esi
mov ecx, 0x15
call fcn.326033020
mov eax, edi
mov ecx, 0x15
call fcn.326033020
nop
nop dword [rax + rax]
call fcn.326030d20
jmp fcn.3260a3d80
Function at 0x3260ab5a0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x28
mov qword [rsp + 0x38], 0
movabs rdx, 0x3e9de24ad367538a
mov qword [rsp + 0x20], rdx
movabs rdx, 0x204050306070405
mov qword [rsp + 0x10], rdx
xor eax, eax
jmp 0x3260ab5ef
movzx r8d, byte [rsp + rbx + 0x20]
sub r8d, edx
lea edx, [r8 - 0x78]
mov byte [rsp + rsi + 0x20], dl
lea edx, [rdi - 0x78]
mov byte [rsp + rbx + 0x20], dl
add rax, 2
cmp rax, 8
jge 0x3260ab61a
movzx edx, byte [rsp + rax + 0x10]
movzx ebx, byte [rsp + rax + 0x11]
mov esi, edx
xor edx, ebx
add edx, eax
cmp rsi, 8
jae 0x3260ab655
movzx edi, byte [rsp + rsi + 0x20]
sub edi, edx
cmp rbx, 8
jb 0x3260ab5d3
jmp 0x3260ab649
mov qword [rsp + 0x18], 0
xor eax, eax
jmp 0x3260ab633
movzx ecx, byte [rsp + rax + 0x20]
mov byte [rsp + rax + 0x18], cl
inc rax
cmp rax, 8
jl 0x3260ab627
mov rax, qword [rsp + 0x18]
mov qword [rsp + 0x38], rax
add rsp, 0x28
pop rbp
ret
mov eax, ebx
mov ecx, 8
call fcn.326033020
mov eax, esi
mov ecx, 8
nop dword [rax]
call fcn.326033020
nop
int3

Function at 0x3260ab680
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x3260ab747
push rbp
mov rbp, rsp
sub rsp, 0x38
movabs rdx, 0x6341797039723161
mov qword [rsp + 0x2c], rdx
mov dword [rsp + 0x34], 0x8473847b
movabs rdx, 0xb020a050701060b
mov qword [rsp + 0x1c], rdx
movabs rdx, 0x30a020906030208
mov qword [rsp + 0x24], rdx
xor eax, eax
jmp 0x3260ab6e8
movzx r9d, byte [rsp + rsi + 0x2c]
sub r9d, edx
lea edx, [r9 + 9]
mov byte [rsp + rdi + 0x2c], dl
lea edx, [r8 + 9]
mov byte [rsp + rsi + 0x2c], dl
add rax, 2
cmp rax, 0x10
jge 0x3260ab717
movzx edx, byte [rsp + rax + 0x1c]
movzx esi, byte [rsp + rax + 0x1d]
mov edi, edx
xor edx, esi
add edx, eax
nop
cmp rdi, 0xc
jae 0x3260ab73a
movzx r8d, byte [rsp + rdi + 0x2c]
sub r8d, edx
cmp rsi, 0xc
jb 0x3260ab6cb
jmp 0x3260ab72e
xor eax, eax
lea rbx, [rsp + 0x2c]
mov ecx, 0xc
call fcn.32601d600
add rsp, 0x38
pop rbp
ret
mov eax, esi
mov ecx, 0xc
call fcn.326033020
mov eax, edi
mov ecx, 0xc
call fcn.326033020
nop
call fcn.326030d20
jmp fcn.3260ab680

Function at 0x3260ab9a0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x3260aba67
push rbp
mov rbp, rsp
sub rsp, 0x38
movabs rdx, 0x3295d91a6ec57f28
mov qword [rsp + 0x2c], rdx
mov dword [rsp + 0x34], 0x6c6c64dd
movabs rdx, 0x405050106020002
mov qword [rsp + 0x1c], rdx
movabs rdx, 0x102000406020808
mov qword [rsp + 0x24], rdx
xor eax, eax
jmp 0x3260aba08
movzx r9d, byte [rsp + rsi + 0x2c]
sub r9d, edx
lea edx, [r9 + 0x59]
mov byte [rsp + rdi + 0x2c], dl
lea edx, [r8 + 0x59]
mov byte [rsp + rsi + 0x2c], dl
add rax, 2
cmp rax, 0x10
jge 0x3260aba37
movzx edx, byte [rsp + rax + 0x1c]
movzx esi, byte [rsp + rax + 0x1d]
mov edi, edx
xor edx, esi
add edx, eax
nop
cmp rdi, 0xc
jae 0x3260aba5a
movzx r8d, byte [rsp + rdi + 0x2c]
sub r8d, edx
cmp rsi, 0xc
jb 0x3260ab9eb
jmp 0x3260aba4e
xor eax, eax
lea rbx, [rsp + 0x2c]
mov ecx, 0xc
call fcn.32601d600
add rsp, 0x38
pop rbp
ret
mov eax, esi
mov ecx, 0xc
call fcn.326033020
mov eax, edi
mov ecx, 0xc
call fcn.326033020
nop
call fcn.326030d20
jmp fcn.3260ab9a0
Function at 0x3260ad1c0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x3260ad28c
push rbp
mov rbp, rsp
sub rsp, 0x38
movabs rdx, 0x8373738f675f747a
mov qword [rsp + 0x2d], rdx
mov dword [rsp + 0x34], 0x67829583
movabs rdx, 0x702030403090308
mov qword [rsp + 0x1f], rdx
movabs rdx, 0x109000803020702
mov qword [rsp + 0x25], rdx
xor eax, eax
jmp 0x3260ad225
movzx r9d, byte [rsp + rsi + 0x2d]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x1a]
mov byte [rsp + rdi + 0x2d], dl
mov byte [rsp + rsi + 0x2d], r8b
add rax, 2
cmp rax, 0xe
jge 0x3260ad25c
movzx edx, byte [rsp + rax + 0x1f]
movzx esi, byte [rsp + rax + 0x20]
mov edi, edx
xor edx, esi
add edx, eax
nop dword [rax + rax]
cmp rdi, 0xb
jae 0x3260ad27f
movzx r8d, byte [rsp + rdi + 0x2d]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x1a]
cmp rsi, 0xb
jb 0x3260ad20b
jmp 0x3260ad273
xor eax, eax
lea rbx, [rsp + 0x2d]
mov ecx, 0xb
call fcn.32601d600
add rsp, 0x38
pop rbp
ret
mov eax, esi
mov ecx, 0xb
call fcn.326033020
mov eax, edi
mov ecx, 0xb
call fcn.326033020
nop
call fcn.326030d20
jmp fcn.3260ad1c0

Function at 0x3260ada60
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x3260adb7a
push rbp
mov rbp, rsp
sub rsp, 0x60
movabs rdx, 0x5440425856405a47
mov qword [rsp + 0x43], rdx
movabs rdx, 0x486d393a6a6e6d1c
mov qword [rsp + 0x4b], rdx
movabs rdx, 0x46564f5967486d39
mov qword [rsp + 0x50], rdx
movabs rdx, 0x545f0a243e618579
mov qword [rsp + 0x58], rdx
movabs rdx, 0x161214051616010d
mov qword [rsp + 0x1b], rdx
movabs rdx, 0x905021001140b09
mov qword [rsp + 0x23], rdx
movabs rdx, 0x110111191a060806
mov qword [rsp + 0x2b], rdx
movabs rdx, 0x81a1c0c0710131b
mov qword [rsp + 0x33], rdx
movabs rdx, 0x1c1806090d04010f
mov qword [rsp + 0x3b], rdx
xor eax, eax
jmp 0x3260adb17
movzx r9d, byte [rsp + rsi + 0x43]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x11]
mov byte [rsp + rdi + 0x43], dl
mov byte [rsp + rsi + 0x43], r8b
add rax, 2
cmp rax, 0x28
jge 0x3260adb49
movzx edx, byte [rsp + rax + 0x1b]
movzx esi, byte [rsp + rax + 0x1c]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x1d
jae 0x3260adb6d
movzx r8d, byte [rsp + rdi + 0x43]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x11]
cmp rsi, 0x1d
jb 0x3260adafd
jmp 0x3260adb61
xor eax, eax
lea rbx, [rsp + 0x43]
mov ecx, 0x1d
call fcn.32601d600
add rsp, 0x60
pop rbp
nop
ret
mov eax, esi
mov ecx, 0x1d
call fcn.326033020
mov eax, edi
mov ecx, 0x1d
call fcn.326033020
nop
call fcn.326030d20
nop
jmp fcn.3260ada60