joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140049500
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x10
mov qword [rsp + 0x20], rax
test rbx, rbx
jbe 0x140049677
movzx edx, byte [rax]
test edx, edx
jne 0x140049534
nop dword [rax]
test r8b, r8b
jne 0x140049534
xor eax, eax
xor ebx, ebx
mov rcx, rbx
xor edi, edi
add rsp, 0x10
pop rbp
ret
bt edx, 7
jae 0x140049547
xor edx, edx
xor r8d, r8d
xor r9d, r9d
jmp 0x140049637
mov r8d, 1
mov r9d, edx
and edx, 1
neg edx
shr r9d, 1
xor edx, r9d
add dword [rsi], edx
nop dword [rax]
cmp rbx, r8
jb 0x140049625
sub rbx, r8
sub rcx, r8
mov rdx, rcx
neg rdx
sar rdx, 0x3f
and r8, rdx
lea rdx, [rax + r8]
test rbx, rbx
jbe 0x140049617
movzx esi, byte [rax + r8]
bt esi, 7
jae 0x14004959d
xor eax, eax
xor esi, esi
xor r8d, r8d
jmp 0x1400495e0
mov eax, 1
cmp rax, rbx
ja 0x1400495cb
add qword [rdi], rsi
sub rcx, rax
sub rbx, rax
mov rsi, rcx
neg rsi
sar rsi, 0x3f
and rax, rsi
add rax, rdx
mov edi, 1
add rsp, 0x10
pop rbp
ret
mov rcx, rbx
call fcn.1400598c0
lea r8d, [rcx + 7]
mov rcx, r11
mov eax, r12d
nop dword [rax]
cmp rax, rbx
jae 0x14004960f
movzx r9d, byte [rax + rdx]
mov r10d, r9d
and r9d, 0x7f
mov r11, rcx
mov ecx, r8d
shl r9d, cl
lea r12d, [rax + 1]
or esi, r9d
test r10b, 0x80
jne 0x1400495d3
mov rcx, r11
mov eax, r12d
jmp 0x1400495a2
mov rcx, rbx
call fcn.140059800
xor eax, eax
mov rcx, rax
nop dword [rax]
call fcn.140059800
mov eax, r8d
mov rcx, rbx
call fcn.1400598c0
lea r9d, [rcx + 7]
mov rcx, r12
cmp rbx, rdx
jbe 0x14004966d
movzx r10d, byte [rdx + rax]
mov r11d, r10d
and r10d, 0x7f
mov r12, rcx
mov ecx, r9d
shl r10d, cl
inc edx
or r8d, r10d
test r11b, 0x80
jne 0x140049630
mov rcx, r12
mov r9d, edx
mov edx, r8d
mov r8d, r9d
jmp 0x14004954d
mov eax, edx
mov rcx, rbx
call fcn.140059800
xor eax, eax
mov rcx, rax
nop dword [rax]
call fcn.140059800
nop
int3

Function at 0x14004f300
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x14004f3b5
push rbp
mov rbp, rsp
sub rsp, 0x48
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x68], rcx
mov qword [rsp + 0x70], rdi
test byte [rax], al
lea rdx, [rax + 0x10]
mov rsi, qword [rsp + 0x68]
mov rcx, rdi
mov rax, rdx
mov rbx, rsi
call fcn.14004d020
nop
test bl, bl
je 0x14004f3af
mov qword [rsp + 0x18], rax
movups xmmword [rsp + 0x20], xmm15
movups xmmword [rsp + 0x28], xmm15
movups xmmword [rsp + 0x38], xmm15
lea rcx, [0x14004f400]
mov qword [rsp + 0x20], rcx
mov rcx, qword [rsp + 0x58]
mov qword [rsp + 0x28], rcx
mov rcx, qword [rsp + 0x60]
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x38], rax
lea rcx, [rsp + 0x68]
mov qword [rsp + 0x40], rcx
lea rcx, [rsp + 0x20]
mov qword [rsp], rcx
call fcn.140057400
xorps xmm15, xmm15
mov r14, qword [0x1402dbe20]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x18]
add rsp, 0x48
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
call fcn.140057520
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
jmp fcn.14004f300
Function at 0x1400504c0
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x14005056f
push rbp
mov rbp, rsp
sub rsp, 0x58
mov qword [rsp + 0x70], rbx
lea rdx, [rsp + 0x68]
mov qword [rsp + 8], 0
movups xmmword [rsp + 0x10], xmm15
movups xmmword [rsp + 0x18], xmm15
movups xmmword [rsp + 0x28], xmm15
movups xmmword [rsp + 0x38], xmm15
movups xmmword [rsp + 0x48], xmm15
lea rsi, [0x1400505c0]
mov qword [rsp + 0x10], rsi
mov rsi, qword [rsp + 0x60]
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdx
mov rdx, r14
mov qword [rsp + 0x28], rdx
lea rdx, [rsp + 8]
mov qword [rsp + 0x30], rdx
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x48], rcx
mov qword [rsp + 0x50], rdi
mov qword [rsp + 0x40], rbx
lea rax, [rsp + 0x10]
mov qword [rsp], rax
call fcn.140057400
xorps xmm15, xmm15
mov r14, qword [0x1402dbe20]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 8]
add rsp, 0x58
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
call fcn.140057520
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
nop dword [rax]
jmp fcn.1400504c0
Function at 0x140059320
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x140004203
push rbp
mov rbp, rsp
sub rsp, 0x18
mov rdx, qword [rax]
mov rcx, qword [rax + 8]
mov rax, rdx
call fcn.140008de0
add rsp, 0x18
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.140057520
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp 0x1400041e0
cmp byte [0x1402dbc29], 0
je 0x140059335
mov rcx, qword [rax + 8]
mov rax, qword [rax]
jmp 0x140056560
jmp 0x1400041e0

Function at 0x140059340
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
nop
mov eax, dword [rax]
movabs rcx, 0xe7037ed1a0b428db
xor rcx, rax
xor rax, rbx
xor rax, qword [0x1402dbf00]
movabs rdx, 0xa0761d6478bd642f
xor rdx, rax
mov rax, rcx
mul rdx
xor rax, rdx
mov rcx, rax
movabs rax, 0x1d8e4e27c47d124b
mul rcx
xor rax, rdx
nop
nop
ret
cmp byte [0x1402dbc29], 0
je 0x140059375
movq xmm0, rbx
pinsrd xmm0, dword [rax], 2
aesenc xmm0, xmmword [0x1402dc260]
aesenc xmm0, xmmword [0x1402dc270]
aesenc xmm0, xmmword [0x1402dc280]
movq rax, xmm0
ret
jmp 0x140009000

Function at 0x140059380
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
nop
mov rax, qword [rax]
movabs rcx, 0xe7037ed1a0b428db
xor rcx, rax
xor rax, rbx
xor rax, qword [0x1402dbf00]
movabs rdx, 0xa0761d6478bd642f
xor rdx, rax
mov rax, rcx
mul rdx
xor rax, rdx
mov rcx, rax
movabs rax, 0x1d8e4e27c47d1247
mul rcx
xor rax, rdx
nop
nop
ret
cmp byte [0x1402dbc29], 0
je 0x1400593b6
movq xmm0, rbx
pinsrq xmm0, qword [rax], 1
aesenc xmm0, xmmword [0x1402dc260]
aesenc xmm0, xmmword [0x1402dc270]
aesenc xmm0, xmmword [0x1402dc280]
movq rax, xmm0
ret
jmp 0x140009060

Function at 0x140061e60
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x140061f7d
push rbp
mov rbp, rsp
sub rsp, 0x60
movabs rdx, 0x31cb884e6c8e6553
mov qword [rsp + 0x42], rdx
movabs rdx, 0x6697c56d658445a4
mov qword [rsp + 0x4a], rdx
movabs rdx, 0x1084a97d5d206697
mov qword [rsp + 0x50], rdx
movabs rdx, 0x209aa779b3a5b969
mov qword [rsp + 0x58], rdx
movabs rdx, 0x5120e041706190a
mov qword [rsp + 0x1e], rdx
movabs rdx, 0x70d1b1405120e04
mov qword [rsp + 0x22], rdx
movabs rdx, 0x1504071113060807
mov qword [rsp + 0x2a], rdx
movabs rdx, 0x214131c1704060a
mov qword [rsp + 0x32], rdx
movabs rdx, 0x6040e0800181708
mov qword [rsp + 0x3a], rdx
xor eax, eax
jmp 0x140061f20
movzx r9d, byte [rsp + rsi + 0x42]
sub r9d, edx
lea edx, [r9 + 3]
mov byte [rsp + rdi + 0x42], dl
lea edx, [r8 + 3]
mov byte [rsp + rsi + 0x42], dl
add rax, 2
nop word [rax + rax]
cmp rax, 0x24
jge 0x140061f4d
movzx edx, byte [rsp + rax + 0x1e]
movzx esi, byte [rsp + rax + 0x1f]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x1e
jae 0x140061f70
movzx r8d, byte [rsp + rdi + 0x42]
sub r8d, edx
cmp rsi, 0x1e
jb 0x140061efd
jmp 0x140061f64
xor eax, eax
lea rbx, [rsp + 0x42]
mov ecx, 0x1e
call fcn.140046d40
add rsp, 0x60
pop rbp
ret
mov eax, esi
mov ecx, 0x1e
call fcn.140059800
mov eax, edi
mov ecx, 0x1e
call fcn.140059800
nop
nop dword [rax]
call fcn.140057520
jmp fcn.140061e60
Function at 0x14006d7e0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x14006d8ca
push rbp
mov rbp, rsp
sub rsp, 0x40
movabs rdx, 0x92749a658e67659c
mov qword [rsp + 0x2e], rdx
movabs rdx, 0x954c92749a658e67
mov qword [rsp + 0x30], rdx
movabs rdx, 0x9b6c758166829ce1
mov qword [rsp + 0x38], rdx
movabs rdx, 0x9080a050b0e0009
mov qword [rsp + 0x1c], rdx
movabs rdx, 0xc0909080a050b0e
mov qword [rsp + 0x1e], rdx
movabs rdx, 0x311030507000e0a
mov qword [rsp + 0x26], rdx
xor eax, eax
jmp 0x14006d86d
movzx r9d, byte [rsp + rsi + 0x2e]
sub r9d, edx
lea edx, [r9 - 0xc]
mov byte [rsp + rdi + 0x2e], dl
lea edx, [r8 - 0xc]
mov byte [rsp + rsi + 0x2e], dl
add rax, 2
cmp rax, 0x12
jge 0x14006d89a
movzx edx, byte [rsp + rax + 0x1c]
movzx esi, byte [rsp + rax + 0x1d]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x12
jae 0x14006d8bd
movzx r8d, byte [rsp + rdi + 0x2e]
sub r8d, edx
cmp rsi, 0x12
jb 0x14006d850
jmp 0x14006d8b1
xor eax, eax
lea rbx, [rsp + 0x2e]
mov ecx, 0x12
call fcn.140046d40
add rsp, 0x40
pop rbp
ret
mov eax, esi
mov ecx, 0x12
call fcn.140059800
mov eax, edi
mov ecx, 0x12
call fcn.140059800
nop
call fcn.140057520
jmp fcn.14006d7e0

Function at 0x14006f260
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x14006f34c
push rbp
mov rbp, rsp
sub rsp, 0x40
movabs rdx, 0xca73d3a8ca726570
mov qword [rsp + 0x2f], rdx
movabs rdx, 0xaeca73d3a8ca7265
mov qword [rsp + 0x30], rdx
movabs rdx, 0x6465b0089a11200c
mov qword [rsp + 0x38], rdx
movabs rdx, 0x809040d0b050e0e
mov qword [rsp + 0x1b], rdx
movabs rdx, 0x80705070809040d
mov qword [rsp + 0x1f], rdx
movabs rdx, 0x703050b0c040403
mov qword [rsp + 0x27], rdx
xor eax, eax
jmp 0x14006f2ea
movzx r9d, byte [rsp + rsi + 0x2f]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x47]
mov byte [rsp + rdi + 0x2f], dl
mov byte [rsp + rsi + 0x2f], r8b
add rax, 2
cmp rax, 0x14
jge 0x14006f31c
movzx edx, byte [rsp + rax + 0x1b]
movzx esi, byte [rsp + rax + 0x1c]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x11
jae 0x14006f33f
movzx r8d, byte [rsp + rdi + 0x2f]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x47]
cmp rsi, 0x11
jb 0x14006f2d0
jmp 0x14006f333
xor eax, eax
lea rbx, [rsp + 0x2f]
mov ecx, 0x11
call fcn.140046d40
add rsp, 0x40
pop rbp
ret
mov eax, esi
mov ecx, 0x11
call fcn.140059800
mov eax, edi
mov ecx, 0x11
call fcn.140059800
nop
call fcn.140057520
jmp fcn.14006f260
Function at 0x140072e00
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x140072efd
push rbp
mov rbp, rsp
sub rsp, 0x48
movabs rdx, 0x20abd86c613d6e13
mov qword [rsp + 0x34], rdx
movabs rdx, 0xef0630d420abd86c
mov qword [rsp + 0x38], rdx
movabs rdx, 0xfe64fdd3d574ac65
mov qword [rsp + 0x40], rdx
movabs rdx, 0x13060b060f0d0810
mov qword [rsp + 0x18], rdx
movabs rdx, 0x80f02110d09060a
mov qword [rsp + 0x20], rdx
movabs rdx, 0x10000502080f0211
mov qword [rsp + 0x24], rdx
movabs rdx, 0x100b0f020f0806
mov qword [rsp + 0x2c], rdx
xor eax, eax
jmp 0x140072ea0
movzx r9d, byte [rsp + rsi + 0x34]
sub r9d, edx
lea edx, [r9 + 0x51]
mov byte [rsp + rdi + 0x34], dl
lea edx, [r8 + 0x51]
mov byte [rsp + rsi + 0x34], dl
add rax, 2
nop dword [rax]
cmp rax, 0x1c
jge 0x140072ecd
movzx edx, byte [rsp + rax + 0x18]
movzx esi, byte [rsp + rax + 0x19]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x14
jae 0x140072ef0
movzx r8d, byte [rsp + rdi + 0x34]
sub r8d, edx
cmp rsi, 0x14
jb 0x140072e7f
jmp 0x140072ee4
xor eax, eax
lea rbx, [rsp + 0x34]
mov ecx, 0x14
call fcn.140046d40
add rsp, 0x48
pop rbp
ret
mov eax, esi
mov ecx, 0x14
call fcn.140059800
mov eax, edi
mov ecx, 0x14
call fcn.140059800
nop
nop dword [rax]
call fcn.140057520
jmp fcn.140072e00

Function at 0x1400749c0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x140074abb
push rbp
mov rbp, rsp
sub rsp, 0x48
movabs rdx, 0x86749290bca4ebc1
mov qword [rsp + 0x36], rdx
movabs rdx, 0xdc6f86749290bca4
mov qword [rsp + 0x38], rdx
movabs rdx, 0xb6adb4d566a2c720
mov qword [rsp + 0x40], rdx
movabs rdx, 0x7100e0b0e090103
mov qword [rsp + 0x1c], rdx
movabs rdx, 0x20e0f0c00051103
mov qword [rsp + 0x24], rdx
movabs rdx, 0x309020e0f0c0005
mov qword [rsp + 0x26], rdx
movabs rdx, 0xc030e0507040111
mov qword [rsp + 0x2e], rdx
xor eax, eax
jmp 0x140074a59
movzx r9d, byte [rsp + rsi + 0x36]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x3e]
mov byte [rsp + rdi + 0x36], dl
mov byte [rsp + rsi + 0x36], r8b
add rax, 2
cmp rax, 0x1a
jge 0x140074a8b
movzx edx, byte [rsp + rax + 0x1c]
movzx esi, byte [rsp + rax + 0x1d]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x12
jae 0x140074aae
movzx r8d, byte [rsp + rdi + 0x36]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x3e]
cmp rsi, 0x12
jb 0x140074a3f
jmp 0x140074aa2
xor eax, eax
lea rbx, [rsp + 0x36]
mov ecx, 0x12
call fcn.140046d40
add rsp, 0x48
pop rbp
ret
mov eax, esi
mov ecx, 0x12
call fcn.140059800
mov eax, edi
mov ecx, 0x12
call fcn.140059800
nop
nop dword [rax + rax]
call fcn.140057520
jmp fcn.1400749c0
Function at 0x140074ae0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x140074bec
push rbp
mov rbp, rsp
sub rsp, 0x58
movabs rdx, 0x69741d27da17486f
mov qword [rsp + 0x40], rdx
movabs rdx, 0x125a0d651920a047
mov qword [rsp + 0x48], rdx
movabs rdx, 0x7265ab630a0a9503
mov qword [rsp + 0x50], rdx
movabs rdx, 0x141203040e13
mov qword [rsp + 0x1e], rdx
movabs rdx, 0x1408000014120304
mov qword [rsp + 0x20], rdx
movabs rdx, 0xd05010b12130f04
mov qword [rsp + 0x28], rdx
movabs rdx, 0x11021008020b1415
mov qword [rsp + 0x30], rdx
movabs rdx, 0x1512140200131509
mov qword [rsp + 0x38], rdx
xor eax, eax
jmp 0x140074b88
movzx r9d, byte [rsp + rsi + 0x40]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x3e]
mov byte [rsp + rdi + 0x40], dl
mov byte [rsp + rsi + 0x40], r8b
add rax, 2
cmp rax, 0x22
jge 0x140074bbc
movzx edx, byte [rsp + rax + 0x1e]
movzx esi, byte [rsp + rax + 0x1f]
mov edi, edx
xor edx, esi
add edx, eax
nop
cmp rdi, 0x18
jae 0x140074bdf
movzx r8d, byte [rsp + rdi + 0x40]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x3e]
cmp rsi, 0x18
jb 0x140074b6e
jmp 0x140074bd3
xor eax, eax
lea rbx, [rsp + 0x40]
mov ecx, 0x18
call fcn.140046d40
add rsp, 0x58
pop rbp
ret
mov eax, esi
mov ecx, 0x18
call fcn.140059800
mov eax, edi
mov ecx, 0x18
call fcn.140059800
nop
call fcn.140057520
jmp fcn.140074ae0

Function at 0x1400758e0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x1400759e8
push rbp
mov rbp, rsp
sub rsp, 0x58
movabs rdx, 0x4c166e3a08fb56f0
mov qword [rsp + 0x3c], rdx
movabs rdx, 0x1b64644c37bc4d69
mov qword [rsp + 0x44], rdx
movabs rdx, 0x467373521b64644c
mov qword [rsp + 0x48], rdx
movabs rdx, 0x646572ec312f6521
mov qword [rsp + 0x50], rdx
movabs rdx, 0x160a1706040f0b18
mov qword [rsp + 0x1e], rdx
movabs rdx, 0x30c1600000b0203
mov qword [rsp + 0x26], rdx
movabs rdx, 0x130010021701030c
mov qword [rsp + 0x2c], rdx
movabs rdx, 0x904140c1414070a
mov qword [rsp + 0x34], rdx
xor eax, eax
jmp 0x14007598b
movzx r9d, byte [rsp + rsi + 0x3c]
sub r9d, edx
lea edx, [r9 + 0x45]
mov byte [rsp + rdi + 0x3c], dl
lea edx, [r8 + 0x45]
mov byte [rsp + rsi + 0x3c], dl
add rax, 2
cmp rax, 0x1e
jge 0x1400759b8
movzx edx, byte [rsp + rax + 0x1e]
movzx esi, byte [rsp + rax + 0x1f]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x1c
jae 0x1400759db
movzx r8d, byte [rsp + rdi + 0x3c]
sub r8d, edx
cmp rsi, 0x1c
jb 0x14007596e
jmp 0x1400759cf
xor eax, eax
lea rbx, [rsp + 0x3c]
mov ecx, 0x1c
call fcn.140046d40
add rsp, 0x58
pop rbp
ret
mov eax, esi
mov ecx, 0x1c
call fcn.140059800
mov eax, edi
mov ecx, 0x1c
call fcn.140059800
nop
call fcn.140057520
jmp fcn.1400758e0
Function at 0x140076680
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x14007676c
push rbp
mov rbp, rsp
sub rsp, 0x40
movabs rdx, 0x4c4d59732053143f
mov qword [rsp + 0x2e], rdx
movabs rdx, 0x5f484c4d59732053
mov qword [rsp + 0x30], rdx
movabs rdx, 0x3d31725d6435631a
mov qword [rsp + 0x38], rdx
movabs rdx, 0x50d08000c0a1010
mov qword [rsp + 0x1a], rdx
movabs rdx, 0xa0e1001050d0800
mov qword [rsp + 0x1e], rdx
movabs rdx, 0x110706080e09100e
mov qword [rsp + 0x26], rdx
xor eax, eax
jmp 0x14007670a
movzx r9d, byte [rsp + rsi + 0x2e]
lea edx, [r9 + rdx]
lea edx, [rdx - 2]
mov byte [rsp + rdi + 0x2e], dl
mov byte [rsp + rsi + 0x2e], r8b
add rax, 2
cmp rax, 0x14
jge 0x14007673c
movzx edx, byte [rsp + rax + 0x1a]
movzx esi, byte [rsp + rax + 0x1b]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x12
jae 0x14007675f
movzx r8d, byte [rsp + rdi + 0x2e]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 2]
cmp rsi, 0x12
jb 0x1400766f0
jmp 0x140076753
xor eax, eax
lea rbx, [rsp + 0x2e]
mov ecx, 0x12
call fcn.140046d40
add rsp, 0x40
pop rbp
ret
mov eax, esi
mov ecx, 0x12
call fcn.140059800
mov eax, edi
mov ecx, 0x12
call fcn.140059800
nop
call fcn.140057520
jmp fcn.140076680

Function at 0x140079220
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x14007931d
push rbp
mov rbp, rsp
sub rsp, 0x50
movabs rdx, 0x7021dea165abdb69
mov qword [rsp + 0x39], rdx
movabs rdx, 0x279291b11d02870
mov qword [rsp + 0x40], rdx
movabs rdx, 0xe51b7f6320a77b29
mov qword [rsp + 0x48], rdx
movabs rdx, 0x2140e0a15040110
mov qword [rsp + 0x1b], rdx
movabs rdx, 0xf16110801090b02
mov qword [rsp + 0x23], rdx
movabs rdx, 0x150b1008140b0f16
mov qword [rsp + 0x29], rdx
movabs rdx, 0xc0f050b09100601
mov qword [rsp + 0x31], rdx
xor eax, eax
jmp 0x1400792c0
movzx r9d, byte [rsp + rsi + 0x39]
sub r9d, edx
lea edx, [r9 + 0x6a]
mov byte [rsp + rdi + 0x39], dl
lea edx, [r8 + 0x6a]
mov byte [rsp + rsi + 0x39], dl
add rax, 2
nop dword [rax]
cmp rax, 0x1e
jge 0x1400792ed
movzx edx, byte [rsp + rax + 0x1b]
movzx esi, byte [rsp + rax + 0x1c]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x17
jae 0x140079310
movzx r8d, byte [rsp + rdi + 0x39]
sub r8d, edx
cmp rsi, 0x17
jb 0x14007929f
jmp 0x140079304
xor eax, eax
lea rbx, [rsp + 0x39]
mov ecx, 0x17
call fcn.140046d40
add rsp, 0x50
pop rbp
ret
mov eax, esi
mov ecx, 0x17
call fcn.140059800
mov eax, edi
mov ecx, 0x17
call fcn.140059800
nop
nop dword [rax]
call fcn.140057520
jmp fcn.140079220
Function at 0x14007cb60
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x14007cc8c
push rbp
mov rbp, rsp
sub rsp, 0x68
movabs rdx, 0xb620956fe8b36163
mov qword [rsp + 0x43], rdx
movabs rdx, 0x6fcb241e78b62095
mov qword [rsp + 0x48], rdx
movabs rdx, 0x206465b5615faeb0
mov qword [rsp + 0x50], rdx
movabs rdx, 0x20048a9afbeeb3b5
mov qword [rsp + 0x58], rdx
movabs rdx, 0x7990386365d569bc
mov qword [rsp + 0x60], rdx
movabs rdx, 0x30b07220f180c0f
mov qword [rsp + 0x1b], rdx
movabs rdx, 0xe15071618091d0c
mov qword [rsp + 0x23], rdx
movabs rdx, 0x171b231a0f160218
mov qword [rsp + 0x2b], rdx
movabs rdx, 0xd1b17111f111b0a
mov qword [rsp + 0x33], rdx
movabs rdx, 0xb1719021d050c0d
mov qword [rsp + 0x3b], rdx
xor eax, eax
jmp 0x14007cc26
movzx r9d, byte [rsp + rsi + 0x43]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x6b]
mov byte [rsp + rdi + 0x43], dl
mov byte [rsp + rsi + 0x43], r8b
add rax, 2
cmp rax, 0x28
jge 0x14007cc5c
movzx edx, byte [rsp + rax + 0x1b]
movzx esi, byte [rsp + rax + 0x1c]
mov edi, edx
xor edx, esi
add edx, eax
nop dword [rax]
cmp rdi, 0x25
jae 0x14007cc7f
movzx r8d, byte [rsp + rdi + 0x43]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x6b]
cmp rsi, 0x25
jb 0x14007cc0c
jmp 0x14007cc73
xor eax, eax
lea rbx, [rsp + 0x43]
mov ecx, 0x25
call fcn.140046d40
add rsp, 0x68
pop rbp
ret
mov eax, esi
mov ecx, 0x25
call fcn.140059800
mov eax, edi
mov ecx, 0x25
call fcn.140059800
nop
call fcn.140057520
jmp fcn.14007cb60

Function at 0x14007f060
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x14007f14a
push rbp
mov rbp, rsp
sub rsp, 0x48
movabs rdx, 0x68545e67275f6e59
mov qword [rsp + 0x37], rdx
movabs rdx, 0x1668545e67275f6e
mov qword [rsp + 0x38], rdx
movabs rdx, 0x65707960660c5755
mov qword [rsp + 0x40], rdx
movabs rdx, 0x20003090b0a0d
mov qword [rsp + 0x1f], rdx
movabs rdx, 0x80c050c0d010206
mov qword [rsp + 0x27], rdx
movabs rdx, 0x60705090802000a
mov qword [rsp + 0x2f], rdx
xor eax, eax
jmp 0x14007f0ed
movzx r9d, byte [rsp + rsi + 0x37]
sub r9d, edx
lea edx, [r9 + 0x1c]
mov byte [rsp + rdi + 0x37], dl
lea edx, [r8 + 0x1c]
mov byte [rsp + rsi + 0x37], dl
add rax, 2
cmp rax, 0x18
jge 0x14007f11a
movzx edx, byte [rsp + rax + 0x1f]
movzx esi, byte [rsp + rax + 0x20]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x11
jae 0x14007f13d
movzx r8d, byte [rsp + rdi + 0x37]
sub r8d, edx
cmp rsi, 0x11
jb 0x14007f0d0
jmp 0x14007f131
xor eax, eax
lea rbx, [rsp + 0x37]
mov ecx, 0x11
call fcn.140046d40
add rsp, 0x48
pop rbp
ret
mov eax, esi
mov ecx, 0x11
call fcn.140059800
mov eax, edi
mov ecx, 0x11
call fcn.140059800
nop
call fcn.140057520
jmp fcn.14007f060
Function at 0x1400840a0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x1400841ac
push rbp
mov rbp, rsp
sub rsp, 0x50
movabs rdx, 0x1dfd73dd6d246f6e
mov qword [rsp + 0x36], rdx
movabs rdx, 0xc1640a016fba0767
mov qword [rsp + 0x3e], rdx
movabs rdx, 0xab6fc1640a016fba
mov qword [rsp + 0x40], rdx
movabs rdx, 0xc0c179b0a9641ad4
mov qword [rsp + 0x48], rdx
movabs rdx, 0x1212191310070402
mov qword [rsp + 0x1a], rdx
movabs rdx, 0xf0a160a150a0711
mov qword [rsp + 0x22], rdx
movabs rdx, 0x1211180a0f0a160a
mov qword [rsp + 0x26], rdx
movabs rdx, 0xd09070c06130904
mov qword [rsp + 0x2e], rdx
xor eax, eax
jmp 0x140084148
movzx r9d, byte [rsp + rsi + 0x36]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x3d]
mov byte [rsp + rdi + 0x36], dl
mov byte [rsp + rsi + 0x36], r8b
add rax, 2
cmp rax, 0x1c
jge 0x14008417c
movzx edx, byte [rsp + rax + 0x1a]
movzx esi, byte [rsp + rax + 0x1b]
mov edi, edx
xor edx, esi
add edx, eax
nop
cmp rdi, 0x1a
jae 0x14008419f
movzx r8d, byte [rsp + rdi + 0x36]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x3d]
cmp rsi, 0x1a
jb 0x14008412e
jmp 0x140084193
xor eax, eax
lea rbx, [rsp + 0x36]
mov ecx, 0x1a
call fcn.140046d40
add rsp, 0x50
pop rbp
ret
mov eax, esi
mov ecx, 0x1a
call fcn.140059800
mov eax, edi
mov ecx, 0x1a
call fcn.140059800
nop
call fcn.140057520
jmp fcn.1400840a0

Function at 0x140085bc0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x140085caa
push rbp
mov rbp, rsp
sub rsp, 0x48
movabs rdx, 0xf642013d96f73c9
mov qword [rsp + 0x33], rdx
movabs rdx, 0xc665f913120f6420
mov qword [rsp + 0x38], rdx
movabs rdx, 0x185cd6097571be72
mov qword [rsp + 0x40], rdx
movabs rdx, 0x713031109140e0a
mov qword [rsp + 0x1d], rdx
movabs rdx, 0x12000701120c0713
mov qword [rsp + 0x23], rdx
movabs rdx, 0x110804010a120807
mov qword [rsp + 0x2b], rdx
xor eax, eax
jmp 0x140085c4d
movzx r9d, byte [rsp + rsi + 0x33]
sub r9d, edx
lea edx, [r9 + 0x70]
mov byte [rsp + rdi + 0x33], dl
lea edx, [r8 + 0x70]
mov byte [rsp + rsi + 0x33], dl
add rax, 2
cmp rax, 0x16
jge 0x140085c7a
movzx edx, byte [rsp + rax + 0x1d]
movzx esi, byte [rsp + rax + 0x1e]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x15
jae 0x140085c9d
movzx r8d, byte [rsp + rdi + 0x33]
sub r8d, edx
cmp rsi, 0x15
jb 0x140085c30
jmp 0x140085c91
xor eax, eax
lea rbx, [rsp + 0x33]
mov ecx, 0x15
call fcn.140046d40
add rsp, 0x48
pop rbp
ret
mov eax, esi
mov ecx, 0x15
call fcn.140059800
mov eax, edi
mov ecx, 0x15
call fcn.140059800
nop
call fcn.140057520
jmp fcn.140085bc0