joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4478a0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x10
mov qword [rsp + 0x20], rax
test rbx, rbx
jbe 0x447a17
movzx edx, byte [rax]
test edx, edx
jne 0x4478d4
nop dword [rax]
test r8b, r8b
jne 0x4478d4
xor eax, eax
xor ebx, ebx
mov rcx, rbx
xor edi, edi
add rsp, 0x10
pop rbp
ret
bt edx, 7
jae 0x4478e7
xor edx, edx
xor r8d, r8d
xor r9d, r9d
jmp 0x4479d7
mov r8d, 1
mov r9d, edx
and edx, 1
neg edx
shr r9d, 1
xor edx, r9d
add dword [rsi], edx
nop dword [rax]
cmp rbx, r8
jb 0x4479c5
sub rbx, r8
sub rcx, r8
mov rdx, rcx
neg rdx
sar rdx, 0x3f
and r8, rdx
lea rdx, [rax + r8]
test rbx, rbx
jbe 0x4479b7
movzx esi, byte [rax + r8]
bt esi, 7
jae 0x44793d
xor eax, eax
xor esi, esi
xor r8d, r8d
jmp 0x447980
mov eax, 1
cmp rax, rbx
ja 0x44796b
add qword [rdi], rsi
sub rcx, rax
sub rbx, rax
mov rsi, rcx
neg rsi
sar rsi, 0x3f
and rax, rsi
add rax, rdx
mov edi, 1
add rsp, 0x10
pop rbp
ret
mov rcx, rbx
call fcn.00457400
lea r8d, [rcx + 7]
mov rcx, r11
mov eax, r12d
nop dword [rax]
cmp rax, rbx
jae 0x4479af
movzx r9d, byte [rax + rdx]
mov r10d, r9d
and r9d, 0x7f
mov r11, rcx
mov ecx, r8d
shl r9d, cl
lea r12d, [rax + 1]
or esi, r9d
test r10b, 0x80
jne 0x447973
mov rcx, r11
mov eax, r12d
jmp 0x447942
mov rcx, rbx
call fcn.00457340
xor eax, eax
mov rcx, rax
nop dword [rax]
call fcn.00457340
mov eax, r8d
mov rcx, rbx
call fcn.00457400
lea r9d, [rcx + 7]
mov rcx, r12
cmp rbx, rdx
jbe 0x447a0d
movzx r10d, byte [rdx + rax]
mov r11d, r10d
and r10d, 0x7f
mov r12, rcx
mov ecx, r9d
shl r10d, cl
inc edx
or r8d, r10d
test r11b, 0x80
jne 0x4479d0
mov rcx, r12
mov r9d, edx
mov edx, r8d
mov r8d, r9d
jmp 0x4478ed
mov eax, edx
mov rcx, rbx
call fcn.00457340
xor eax, eax
mov rcx, rax
nop dword [rax]
call fcn.00457340
nop
int3

Function at 0x44d540
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x44d5f5
push rbp
mov rbp, rsp
sub rsp, 0x48
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x68], rcx
mov qword [rsp + 0x70], rdi
test byte [rax], al
lea rdx, [rax + 0x10]
mov rsi, qword [rsp + 0x68]
mov rcx, rdi
mov rax, rdx
mov rbx, rsi
call fcn.0044b260
nop
test bl, bl
je 0x44d5ef
mov qword [rsp + 0x18], rax
movups xmmword [rsp + 0x20], xmm15
movups xmmword [rsp + 0x28], xmm15
movups xmmword [rsp + 0x38], xmm15
lea rcx, [0x0044d640]
mov qword [rsp + 0x20], rcx
mov rcx, qword [rsp + 0x58]
mov qword [rsp + 0x28], rcx
mov rcx, qword [rsp + 0x60]
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x38], rax
lea rcx, [rsp + 0x68]
mov qword [rsp + 0x40], rcx
lea rcx, [rsp + 0x20]
mov qword [rsp], rcx
call fcn.00454f40
xorps xmm15, xmm15
mov r14, qword [0x006c50d8]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x18]
add rsp, 0x48
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
call fcn.00455060
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
jmp fcn.0044d540
Function at 0x44e700
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x44e7af
push rbp
mov rbp, rsp
sub rsp, 0x58
mov qword [rsp + 0x70], rbx
lea rdx, [rsp + 0x68]
mov qword [rsp + 8], 0
movups xmmword [rsp + 0x10], xmm15
movups xmmword [rsp + 0x18], xmm15
movups xmmword [rsp + 0x28], xmm15
movups xmmword [rsp + 0x38], xmm15
movups xmmword [rsp + 0x48], xmm15
lea rsi, [0x0044e800]
mov qword [rsp + 0x10], rsi
mov rsi, qword [rsp + 0x60]
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdx
mov rdx, r14
mov qword [rsp + 0x28], rdx
lea rdx, [rsp + 8]
mov qword [rsp + 0x30], rdx
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x48], rcx
mov qword [rsp + 0x50], rdi
mov qword [rsp + 0x40], rbx
lea rax, [rsp + 0x10]
mov qword [rsp], rax
call fcn.00454f40
xorps xmm15, xmm15
mov r14, qword [0x006c50d8]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 8]
add rsp, 0x58
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
call fcn.00455060
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
nop dword [rax]
jmp fcn.0044e700
Function at 0x456e60
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x404303
push rbp
mov rbp, rsp
sub rsp, 0x18
mov rdx, qword [rax]
mov rcx, qword [rax + 8]
mov rax, rdx
call fcn.00408f00
add rsp, 0x18
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.00455060
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp 0x4042e0
cmp byte [0x006c4eea], 0
je 0x456e75
mov rcx, qword [rax + 8]
mov rax, qword [rax]
jmp 0x4540a0
jmp 0x4042e0

Function at 0x456e80
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
nop
mov eax, dword [rax]
movabs rcx, 0xe7037ed1a0b428db
xor rcx, rax
xor rax, rbx
xor rax, qword [0x006c51a0]
movabs rdx, 0xa0761d6478bd642f
xor rdx, rax
mov rax, rcx
mul rdx
xor rax, rdx
mov rcx, rax
movabs rax, 0x1d8e4e27c47d124b
mul rcx
xor rax, rdx
nop
nop
ret
cmp byte [0x006c4eea], 0
je 0x456eb5
movq xmm0, rbx
pinsrd xmm0, dword [rax], 2
aesenc xmm0, xmmword [0x006c5520]
aesenc xmm0, xmmword [0x006c5530]
aesenc xmm0, xmmword [0x006c5540]
movq rax, xmm0
ret
jmp 0x409120

Function at 0x456ec0
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
nop
mov rax, qword [rax]
movabs rcx, 0xe7037ed1a0b428db
xor rcx, rax
xor rax, rbx
xor rax, qword [0x006c51a0]
movabs rdx, 0xa0761d6478bd642f
xor rdx, rax
mov rax, rcx
mul rdx
xor rax, rdx
mov rcx, rax
movabs rax, 0x1d8e4e27c47d1247
mul rcx
xor rax, rdx
nop
nop
ret
cmp byte [0x006c4eea], 0
je 0x456ef6
movq xmm0, rbx
pinsrq xmm0, qword [rax], 1
aesenc xmm0, xmmword [0x006c5520]
aesenc xmm0, xmmword [0x006c5530]
aesenc xmm0, xmmword [0x006c5540]
movq rax, xmm0
ret
jmp 0x409180

Function at 0x458c80
Capabilities:
Allocate thread local storage

Disassembly:
push rbp
mov rbp, rsp
mov rax, rsp
and rsp, 0xfffffffffffffff0
sub rsp, 0x30
mov qword [rsp + 0x20], rax
mov rax, qword [sym.imp.kernel32.dll_TlsAlloc]
call rax
mov rsp, qword [rsp + 0x20]
mov rcx, rax
cmp rcx, 0x40
jb 0x458cb4
mov rcx, 0x28
jmp 0x458cbf
shl rcx, 3
add rcx, 0x1480
mov qword [0x006c50d8], rcx
pop rbp
ret
Function at 0x45ed80
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x45ee6a
push rbp
mov rbp, rsp
sub rsp, 0x40
movabs rdx, 0xd1c66315dc66e3e2
mov qword [rsp + 0x2f], rdx
movabs rdx, 0xf5d1c66315dc66e3
mov qword [rsp + 0x30], rdx
movabs rdx, 0xd7dbff2ed3986c38
mov qword [rsp + 0x38], rdx
movabs rdx, 0x4100c0b040f0e08
mov qword [rsp + 0x19], rdx
movabs rdx, 0x1070c0406070410
mov qword [rsp + 0x1f], rdx
movabs rdx, 0x309060003040b
mov qword [rsp + 0x27], rdx
xor eax, eax
jmp 0x45ee0d
movzx r9d, byte [rsp + rsi + 0x2f]
sub r9d, edx
lea edx, [r9 + 0x5d]
mov byte [rsp + rdi + 0x2f], dl
lea edx, [r8 + 0x5d]
mov byte [rsp + rsi + 0x2f], dl
add rax, 2
cmp rax, 0x16
jge 0x45ee3a
movzx edx, byte [rsp + rax + 0x19]
movzx esi, byte [rsp + rax + 0x1a]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x11
jae 0x45ee5d
movzx r8d, byte [rsp + rdi + 0x2f]
sub r8d, edx
cmp rsi, 0x11
jb 0x45edf0
jmp 0x45ee51
xor eax, eax
lea rbx, [rsp + 0x2f]
mov ecx, 0x11
call fcn.004451c0
add rsp, 0x40
pop rbp
ret
mov eax, esi
mov ecx, 0x11
call fcn.00457340
mov eax, edi
mov ecx, 0x11
call fcn.00457340
nop
call fcn.00455060
jmp fcn.0045ed80

Function at 0x468e00
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x468efb
push rbp
mov rbp, rsp
sub rsp, 0x48
movabs rdx, 0x658f8e20aa6c968c
mov qword [rsp + 0x35], rdx
movabs rdx, 0x6e2096658f8e20aa
mov qword [rsp + 0x38], rdx
movabs rdx, 0xa6c5ae95bdafdeb8
mov qword [rsp + 0x40], rdx
movabs rdx, 0x110f0d03100e0f0c
mov qword [rsp + 0x19], rdx
movabs rdx, 0x111005001206010b
mov qword [rsp + 0x21], rdx
movabs rdx, 0x1103060111100500
mov qword [rsp + 0x25], rdx
movabs rdx, 0x8080d0e0c0e080f
mov qword [rsp + 0x2d], rdx
xor eax, eax
jmp 0x468e99
movzx r9d, byte [rsp + rsi + 0x35]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x39]
mov byte [rsp + rdi + 0x35], dl
mov byte [rsp + rsi + 0x35], r8b
add rax, 2
cmp rax, 0x1c
jge 0x468ecb
movzx edx, byte [rsp + rax + 0x19]
movzx esi, byte [rsp + rax + 0x1a]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x13
jae 0x468eee
movzx r8d, byte [rsp + rdi + 0x35]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x39]
cmp rsi, 0x13
jb 0x468e7f
jmp 0x468ee2
xor eax, eax
lea rbx, [rsp + 0x35]
mov ecx, 0x13
call fcn.004451c0
add rsp, 0x48
pop rbp
ret
mov eax, esi
mov ecx, 0x13
call fcn.00457340
mov eax, edi
mov ecx, 0x13
call fcn.00457340
nop
nop dword [rax + rax]
call fcn.00455060
jmp fcn.00468e00
Function at 0x475800
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4758ea
push rbp
mov rbp, rsp
sub rsp, 0x48
movabs rdx, 0x3034822e4ee72ee8
mov qword [rsp + 0x32], rdx
movabs rdx, 0x3389312efd2e3034
mov qword [rsp + 0x38], rdx
movabs rdx, 0x6994ed732eed0e37
mov qword [rsp + 0x40], rdx
movabs rdx, 0x30f050c14091312
mov qword [rsp + 0x1a], rdx
movabs rdx, 0x10150f0003101500
mov qword [rsp + 0x22], rdx
movabs rdx, 0x302120f02020014
mov qword [rsp + 0x2a], rdx
xor eax, eax
jmp 0x47588d
movzx r9d, byte [rsp + rsi + 0x32]
sub r9d, edx
lea edx, [r9 - 0x44]
mov byte [rsp + rdi + 0x32], dl
lea edx, [r8 - 0x44]
mov byte [rsp + rsi + 0x32], dl
add rax, 2
cmp rax, 0x18
jge 0x4758ba
movzx edx, byte [rsp + rax + 0x1a]
movzx esi, byte [rsp + rax + 0x1b]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x16
jae 0x4758dd
movzx r8d, byte [rsp + rdi + 0x32]
sub r8d, edx
cmp rsi, 0x16
jb 0x475870
jmp 0x4758d1
xor eax, eax
lea rbx, [rsp + 0x32]
mov ecx, 0x16
call fcn.004451c0
add rsp, 0x48
pop rbp
ret
mov eax, esi
mov ecx, 0x16
call fcn.00457340
mov eax, edi
mov ecx, 0x16
call fcn.00457340
nop
call fcn.00455060
jmp fcn.00475800

Function at 0x477b80
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x477c9d
push rbp
mov rbp, rsp
sub rsp, 0x60
movabs rdx, 0x391f722065334f81
mov qword [rsp + 0x44], rdx
movabs rdx, 0x4800717470564c63
mov qword [rsp + 0x4c], rdx
movabs rdx, 0x6265ea2348007174
mov qword [rsp + 0x50], rdx
movabs rdx, 0x717361294d751b61
mov qword [rsp + 0x58], rdx
movabs rdx, 0x1001060e180e020f
mov qword [rsp + 0x1e], rdx
movabs rdx, 0x1707150f17111001
mov qword [rsp + 0x24], rdx
movabs rdx, 0x617110d0e090901
mov qword [rsp + 0x2c], rdx
movabs rdx, 0xf120d111812060a
mov qword [rsp + 0x34], rdx
movabs rdx, 0x1a0016071b050901
mov qword [rsp + 0x3c], rdx
xor eax, eax
jmp 0x477c40
movzx r9d, byte [rsp + rsi + 0x44]
sub r9d, edx
lea edx, [r9 + 0x31]
mov byte [rsp + rdi + 0x44], dl
lea edx, [r8 + 0x31]
mov byte [rsp + rsi + 0x44], dl
add rax, 2
nop word [rax + rax]
cmp rax, 0x26
jge 0x477c6d
movzx edx, byte [rsp + rax + 0x1e]
movzx esi, byte [rsp + rax + 0x1f]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x1c
jae 0x477c90
movzx r8d, byte [rsp + rdi + 0x44]
sub r8d, edx
cmp rsi, 0x1c
jb 0x477c1d
jmp 0x477c84
xor eax, eax
lea rbx, [rsp + 0x44]
mov ecx, 0x1c
call fcn.004451c0
add rsp, 0x60
pop rbp
ret
mov eax, esi
mov ecx, 0x1c
call fcn.00457340
mov eax, edi
mov ecx, 0x1c
call fcn.00457340
nop
nop dword [rax]
call fcn.00455060
jmp fcn.00477b80
Function at 0x4786e0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4787dd
push rbp
mov rbp, rsp
sub rsp, 0x48
movabs rdx, 0x5d6e6f4572423315
mov qword [rsp + 0x34], rdx
movabs rdx, 0x6c5166205d6e6f45
mov qword [rsp + 0x38], rdx
movabs rdx, 0x4a615c566f662018
mov qword [rsp + 0x40], rdx
movabs rdx, 0x11040a1002100c
mov qword [rsp + 0x18], rdx
movabs rdx, 0xa07100c130a0201
mov qword [rsp + 0x20], rdx
movabs rdx, 0x10213100a07100c
mov qword [rsp + 0x24], rdx
movabs rdx, 0x110300070c0c0310
mov qword [rsp + 0x2c], rdx
xor eax, eax
jmp 0x478780
movzx r9d, byte [rsp + rsi + 0x34]
sub r9d, edx
lea edx, [r9 + 0x27]
mov byte [rsp + rdi + 0x34], dl
lea edx, [r8 + 0x27]
mov byte [rsp + rsi + 0x34], dl
add rax, 2
nop dword [rax]
cmp rax, 0x1c
jge 0x4787ad
movzx edx, byte [rsp + rax + 0x18]
movzx esi, byte [rsp + rax + 0x19]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x14
jae 0x4787d0
movzx r8d, byte [rsp + rdi + 0x34]
sub r8d, edx
cmp rsi, 0x14
jb 0x47875f
jmp 0x4787c4
xor eax, eax
lea rbx, [rsp + 0x34]
mov ecx, 0x14
call fcn.004451c0
add rsp, 0x48
pop rbp
ret
mov eax, esi
mov ecx, 0x14
call fcn.00457340
mov eax, edi
mov ecx, 0x14
call fcn.00457340
nop
nop dword [rax]
call fcn.00455060
jmp fcn.004786e0

Function at 0x47bac0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x47bbec
push rbp
mov rbp, rsp
sub rsp, 0x68
movabs rdx, 0x6168f0140c86d594
mov qword [rsp + 0x48], rdx
movabs rdx, 0x65e57cd67261206c
mov qword [rsp + 0x50], rdx
movabs rdx, 0xeaf15d00ec20746c
mov qword [rsp + 0x58], rdx
movabs rdx, 0x7e0586d3663511b
mov qword [rsp + 0x60], rdx
movabs rdx, 0x1f14061803000602
mov qword [rsp + 0x1a], rdx
movabs rdx, 0xe1a130319061d16
mov qword [rsp + 0x22], rdx
movabs rdx, 0x1e02101005170e1a
mov qword [rsp + 0x28], rdx
movabs rdx, 0xd0e0e150d0d150c
mov qword [rsp + 0x30], rdx
movabs rdx, 0x40c040d1e041b06
mov qword [rsp + 0x38], rdx
movabs rdx, 0x10010601160c1e06
mov qword [rsp + 0x40], rdx
xor eax, eax
jmp 0x47bb86
movzx r9d, byte [rsp + rsi + 0x48]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x5d]
mov byte [rsp + rdi + 0x48], dl
mov byte [rsp + rsi + 0x48], r8b
add rax, 2
cmp rax, 0x2e
jge 0x47bbbc
movzx edx, byte [rsp + rax + 0x1a]
movzx esi, byte [rsp + rax + 0x1b]
mov edi, edx
xor edx, esi
add edx, eax
nop dword [rax]
cmp rdi, 0x20
jae 0x47bbdf
movzx r8d, byte [rsp + rdi + 0x48]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x5d]
cmp rsi, 0x20
jb 0x47bb6c
jmp 0x47bbd3
xor eax, eax
lea rbx, [rsp + 0x48]
mov ecx, 0x20
call fcn.004451c0
add rsp, 0x68
pop rbp
ret
mov eax, esi
mov ecx, 0x20
call fcn.00457340
mov eax, edi
mov ecx, 0x20
call fcn.00457340
nop
call fcn.00455060
jmp fcn.0047bac0
Function at 0x47c9e0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x47cabd
push rbp
mov rbp, rsp
sub rsp, 0x40
movabs rdx, 0xba6f7412bd11b162
mov qword [rsp + 0x32], rdx
movabs rdx, 0xb67bfb90f18ba6f
mov qword [rsp + 0x38], rdx
movabs rdx, 0xd09010a00030d02
mov qword [rsp + 0x1e], rdx
movabs rdx, 0xd0704090d09010a
mov qword [rsp + 0x22], rdx
movabs rdx, 0x2000b0900080903
mov qword [rsp + 0x2a], rdx
xor eax, eax
nop
jmp 0x47ca60
movzx r9d, byte [rsp + rsi + 0x32]
sub r9d, edx
lea edx, [r9 - 0x41]
mov byte [rsp + rdi + 0x32], dl
lea edx, [r8 - 0x41]
mov byte [rsp + rsi + 0x32], dl
add rax, 2
nop
cmp rax, 0x14
jge 0x47ca8d
movzx edx, byte [rsp + rax + 0x1e]
movzx esi, byte [rsp + rax + 0x1f]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0xe
jae 0x47cab0
movzx r8d, byte [rsp + rdi + 0x32]
sub r8d, edx
cmp rsi, 0xe
jb 0x47ca42
jmp 0x47caa4
xor eax, eax
lea rbx, [rsp + 0x32]
mov ecx, 0xe
call fcn.004451c0
add rsp, 0x40
pop rbp
ret
mov eax, esi
mov ecx, 0xe
call fcn.00457340
mov eax, edi
mov ecx, 0xe
call fcn.00457340
nop
nop dword [rax]
call fcn.00455060
jmp fcn.0047c9e0

Function at 0x4815e0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4816db
push rbp
mov rbp, rsp
sub rsp, 0x50
movabs rdx, 0xa2f6b268206a6508
mov qword [rsp + 0x3c], rdx
movabs rdx, 0x16bd659da2f6b268
mov qword [rsp + 0x40], rdx
movabs rdx, 0x6413a86fce1f33b1
mov qword [rsp + 0x48], rdx
movabs rdx, 0xb0e110805021107
mov qword [rsp + 0x1e], rdx
movabs rdx, 0x8000f0a0a0f070c
mov qword [rsp + 0x26], rdx
movabs rdx, 0xc0002120d000800
mov qword [rsp + 0x2c], rdx
movabs rdx, 0x50c061100070d0d
mov qword [rsp + 0x34], rdx
xor eax, eax
jmp 0x481679
movzx r9d, byte [rsp + rsi + 0x3c]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x44]
mov byte [rsp + rdi + 0x3c], dl
mov byte [rsp + rsi + 0x3c], r8b
add rax, 2
cmp rax, 0x1e
jge 0x4816ab
movzx edx, byte [rsp + rax + 0x1e]
movzx esi, byte [rsp + rax + 0x1f]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x14
jae 0x4816ce
movzx r8d, byte [rsp + rdi + 0x3c]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x44]
cmp rsi, 0x14
jb 0x48165f
jmp 0x4816c2
xor eax, eax
lea rbx, [rsp + 0x3c]
mov ecx, 0x14
call fcn.004451c0
add rsp, 0x50
pop rbp
ret
mov eax, esi
mov ecx, 0x14
call fcn.00457340
mov eax, edi
mov ecx, 0x14
call fcn.00457340
nop
nop dword [rax + rax]
call fcn.00455060
jmp fcn.004815e0
Function at 0x481980
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x481a6c
push rbp
mov rbp, rsp
sub rsp, 0x48
movabs rdx, 0x204b0d4a4d76f700
mov qword [rsp + 0x30], rdx
movabs rdx, 0x36cb656b20096f36
mov qword [rsp + 0x38], rdx
movabs rdx, 0x643f7a076e264050
mov qword [rsp + 0x40], rdx
movabs rdx, 0x1103081612040d0c
mov qword [rsp + 0x18], rdx
movabs rdx, 0x5040e05101410
mov qword [rsp + 0x20], rdx
movabs rdx, 0x100f0f010410060a
mov qword [rsp + 0x28], rdx
xor eax, eax
jmp 0x481a0a
movzx r9d, byte [rsp + rsi + 0x30]
lea edx, [r9 + rdx]
lea edx, [rdx + 0xd]
mov byte [rsp + rdi + 0x30], dl
mov byte [rsp + rsi + 0x30], r8b
add rax, 2
cmp rax, 0x18
jge 0x481a3c
movzx edx, byte [rsp + rax + 0x18]
movzx esi, byte [rsp + rax + 0x19]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x18
jae 0x481a5f
movzx r8d, byte [rsp + rdi + 0x30]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0xd]
cmp rsi, 0x18
jb 0x4819f0
jmp 0x481a53
xor eax, eax
lea rbx, [rsp + 0x30]
mov ecx, 0x18
call fcn.004451c0
add rsp, 0x48
pop rbp
ret
mov eax, esi
mov ecx, 0x18
call fcn.00457340
mov eax, edi
mov ecx, 0x18
call fcn.00457340
nop
call fcn.00455060
jmp fcn.00481980

Function at 0x484880
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4849b8
push rbp
mov rbp, rsp
sub rsp, 0x68
movabs rdx, 0xed53566d4c6f5774
mov qword [rsp + 0x47], rdx
movabs rdx, 0xcded53566d4c6f57
mov qword [rsp + 0x48], rdx
movabs rdx, 0x42f736c2d4a6506
mov qword [rsp + 0x50], rdx
movabs rdx, 0x3c6f128279732051
mov qword [rsp + 0x58], rdx
movabs rdx, 0x1b6b6e17ca1b093f
mov qword [rsp + 0x60], rdx
movabs rdx, 0xf0b0b10070f0807
mov qword [rsp + 0x1b], rdx
movabs rdx, 0x161b0c0c1c081c08
mov qword [rsp + 0x23], rdx
movabs rdx, 0x11c0f20161b0c0c
mov qword [rsp + 0x27], rdx
movabs rdx, 0x1161b0918191a03
mov qword [rsp + 0x2f], rdx
movabs rdx, 0x1616051115200906
mov qword [rsp + 0x37], rdx
movabs rdx, 0x71d1c151d081c01
mov qword [rsp + 0x3f], rdx
xor eax, eax
jmp 0x484958
movzx r9d, byte [rsp + rsi + 0x47]
sub r9d, edx
lea edx, [r9 + 0x44]
mov byte [rsp + rdi + 0x47], dl
lea edx, [r8 + 0x44]
mov byte [rsp + rsi + 0x47], dl
add rax, 2
cmp rax, 0x2c
jge 0x484988
movzx edx, byte [rsp + rax + 0x1b]
movzx esi, byte [rsp + rax + 0x1c]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x21
jae 0x4849ab
movzx r8d, byte [rsp + rdi + 0x47]
sub r8d, edx
nop dword [rax]
cmp rsi, 0x21
jb 0x48493b
jmp 0x48499f
xor eax, eax
lea rbx, [rsp + 0x47]
mov ecx, 0x21
call fcn.004451c0
add rsp, 0x68
pop rbp
ret
mov eax, esi
mov ecx, 0x21
call fcn.00457340
mov eax, edi
mov ecx, 0x21
call fcn.00457340
nop
call fcn.00455060
nop dword [rax]
jmp fcn.00484880
Function at 0x484f00
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x484fdd
push rbp
mov rbp, rsp
sub rsp, 0x40
movabs rdx, 0xcb7f121018ba650c
mov qword [rsp + 0x30], rdx
movabs rdx, 0x7c707a1222576f18
mov qword [rsp + 0x38], rdx
movabs rdx, 0x40f020d060a0e04
mov qword [rsp + 0x18], rdx
movabs rdx, 0x20b06070c0d0500
mov qword [rsp + 0x20], rdx
movabs rdx, 0x603070a080f0704
mov qword [rsp + 0x28], rdx
xor eax, eax
nop
jmp 0x484f80
movzx r9d, byte [rsp + rsi + 0x30]
sub r9d, edx
lea edx, [r9 + 0x68]
mov byte [rsp + rdi + 0x30], dl
lea edx, [r8 + 0x68]
mov byte [rsp + rsi + 0x30], dl
add rax, 2
nop
cmp rax, 0x18
jge 0x484fad
movzx edx, byte [rsp + rax + 0x18]
movzx esi, byte [rsp + rax + 0x19]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x10
jae 0x484fd0
movzx r8d, byte [rsp + rdi + 0x30]
sub r8d, edx
cmp rsi, 0x10
jb 0x484f62
jmp 0x484fc4
xor eax, eax
lea rbx, [rsp + 0x30]
mov ecx, 0x10
call fcn.004451c0
add rsp, 0x40
pop rbp
ret
mov eax, esi
mov ecx, 0x10
call fcn.00457340
mov eax, edi
mov ecx, 0x10
call fcn.00457340
nop
nop dword [rax]
call fcn.00455060
jmp fcn.00484f00

Function at 0x488400
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4884d8
push rbp
mov rbp, rsp
sub rsp, 0x40
movabs rdx, 0x5069064e425c6f60
mov qword [rsp + 0x31], rdx
movabs rdx, 0x6459696ffa4a3150
mov qword [rsp + 0x38], rdx
movabs rdx, 0x70202030a04080c
mov qword [rsp + 0x1d], rdx
movabs rdx, 0x3000a0a07020203
mov qword [rsp + 0x21], rdx
movabs rdx, 0x70d04020509020c
mov qword [rsp + 0x29], rdx
xor eax, eax
nop
jmp 0x488478
movzx r9d, byte [rsp + rsi + 0x31]
add edx, r9d
mov byte [rsp + rdi + 0x31], dl
mov byte [rsp + rsi + 0x31], r8b
add rax, 2
cmp rax, 0x14
jge 0x4884a8
movzx edx, byte [rsp + rax + 0x1d]
movzx esi, byte [rsp + rax + 0x1e]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0xf
jae 0x4884cb
movzx r8d, byte [rsp + rdi + 0x31]
add r8d, edx
nop dword [rax]
cmp rsi, 0xf
jb 0x488462
jmp 0x4884bf
xor eax, eax
lea rbx, [rsp + 0x31]
mov ecx, 0xf
call fcn.004451c0
add rsp, 0x40
pop rbp
ret
mov eax, esi
mov ecx, 0xf
call fcn.00457340
mov eax, edi
mov ecx, 0xf
call fcn.00457340
nop
call fcn.00455060
nop dword [rax]
jmp fcn.00488400
Function at 0x4887e0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4888ec
push rbp
mov rbp, rsp
sub rsp, 0x50
movabs rdx, 0x618df7e22d20e7ea
mov qword [rsp + 0x36], rdx
movabs rdx, 0xfdee17666ff83067
mov qword [rsp + 0x3e], rdx
movabs rdx, 0x6945fdee17666ff8
mov qword [rsp + 0x40], rdx
movabs rdx, 0x65e87974f255654e
mov qword [rsp + 0x48], rdx
movabs rdx, 0x1401140f10150d03
mov qword [rsp + 0x18], rdx
movabs rdx, 0x603001803060a09
mov qword [rsp + 0x20], rdx
movabs rdx, 0xe0e010515150603
mov qword [rsp + 0x26], rdx
movabs rdx, 0x100f0a0d04121012
mov qword [rsp + 0x2e], rdx
xor eax, eax
jmp 0x488888
movzx r9d, byte [rsp + rsi + 0x36]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x62]
mov byte [rsp + rdi + 0x36], dl
mov byte [rsp + rsi + 0x36], r8b
add rax, 2
cmp rax, 0x1e
jge 0x4888bc
movzx edx, byte [rsp + rax + 0x18]
movzx esi, byte [rsp + rax + 0x19]
mov edi, edx
xor edx, esi
add edx, eax
nop
cmp rdi, 0x1a
jae 0x4888df
movzx r8d, byte [rsp + rdi + 0x36]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x62]
cmp rsi, 0x1a
jb 0x48886e
jmp 0x4888d3
xor eax, eax
lea rbx, [rsp + 0x36]
mov ecx, 0x1a
call fcn.004451c0
add rsp, 0x50
pop rbp
ret
mov eax, esi
mov ecx, 0x1a
call fcn.00457340
mov eax, edi
mov ecx, 0x1a
call fcn.00457340
nop
call fcn.00455060
jmp fcn.004887e0

Function at 0x4899e0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x489add
push rbp
mov rbp, rsp
sub rsp, 0x50
movabs rdx, 0x2620fa6fd874eb40
mov qword [rsp + 0x38], rdx
movabs rdx, 0x729173333f394a08
mov qword [rsp + 0x40], rdx
movabs rdx, 0x33652128df393541
mov qword [rsp + 0x48], rdx
movabs rdx, 0x140a08050a15030e
mov qword [rsp + 0x1a], rdx
movabs rdx, 0x121105080e0e1303
mov qword [rsp + 0x22], rdx
movabs rdx, 0x1031017130e1211
mov qword [rsp + 0x28], rdx
movabs rdx, 0xa00070a09010b0c
mov qword [rsp + 0x30], rdx
xor eax, eax
jmp 0x489a80
movzx r9d, byte [rsp + rsi + 0x38]
sub r9d, edx
lea edx, [r9 + 0x4b]
mov byte [rsp + rdi + 0x38], dl
lea edx, [r8 + 0x4b]
mov byte [rsp + rsi + 0x38], dl
add rax, 2
nop dword [rax]
cmp rax, 0x1e
jge 0x489aad
movzx edx, byte [rsp + rax + 0x1a]
movzx esi, byte [rsp + rax + 0x1b]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x18
jae 0x489ad0
movzx r8d, byte [rsp + rdi + 0x38]
sub r8d, edx
cmp rsi, 0x18
jb 0x489a5f
jmp 0x489ac4
xor eax, eax
lea rbx, [rsp + 0x38]
mov ecx, 0x18
call fcn.004451c0
add rsp, 0x50
pop rbp
ret
mov eax, esi
mov ecx, 0x18
call fcn.00457340
mov eax, edi
mov ecx, 0x18
call fcn.00457340
nop
nop dword [rax]
call fcn.00455060
jmp fcn.004899e0