joyce8/EMBER2024-capa huggingface dataset:
Function at 0x475fa0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4760b6
sub rsp, 0x60
mov qword [rsp + 0x58], rbp
lea rbp, [rsp + 0x58]
movabs rdx, 0x5836656c486275b2
mov qword [rsp + 0x1a], rdx
movabs rdx, 0x3a73b074f225d01e
mov qword [rsp + 0x22], rdx
movabs rdx, 0xf90223e8b3203a73
mov qword [rsp + 0x28], rdx
movabs rdx, 0x79cdd26f4183b19
mov qword [rsp + 0x30], rdx
movabs rdx, 0xd1d1c11030b1d11
mov qword [rsp + 0x38], rdx
movabs rdx, 0x121b0914160d171d
mov qword [rsp + 0x40], rdx
movabs rdx, 0x171b0a1915080600
mov qword [rsp + 0x48], rdx
movabs rdx, 0x1a12111803130606
mov qword [rsp + 0x50], rdx
xor eax, eax
jmp 0x47604e
movzx r9d, byte [rsp + rsi + 0x1a]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x27]
mov byte [rsp + rdi + 0x1a], dl
mov byte [rsp + rsi + 0x1a], r8b
add rax, 2
cmp rax, 0x20
jge 0x476082
movzx edx, byte [rsp + rax + 0x38]
movzx esi, byte [rsp + rax + 0x39]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x1e
jae 0x4760a9
movzx r8d, byte [rsp + rdi + 0x1a]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x27]
cmp rsi, 0x1e
jb 0x476034
nop
jmp 0x47609d
xor eax, eax
lea rbx, [rsp + 0x1a]
mov ecx, 0x1e
call fcn.00444360
mov rbp, qword [rsp + 0x58]
add rsp, 0x60
ret
mov eax, esi
mov ecx, 0x1e
call fcn.00456a60
mov eax, edi
mov ecx, 0x1e
call fcn.00456a60
nop
call fcn.00454400
nop dword [rax + rax]
jmp fcn.00475fa0

Function at 0x4760e0
Capabilities:
Encode data using xor

Disassembly:
mov rbx, qword [rsp + 8]
mov rsi, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdx, qword [rsp + 0x20]
test rdx, 0xf
jne 0x47614b
mov rax, 0
movdqu xmm0, xmmword [rsi + rax]
movdqu xmm1, xmmword [rcx + rax]
pxor xmm0, xmm1
movdqu xmmword [rbx + rax], xmm0
add rax, 0x10
cmp rdx, rax
jne 0x476104
ret
sub rdx, 1
mov dil, byte [rsi + rdx]
mov al, byte [rcx + rdx]
xor dil, al
mov byte [rbx + rdx], dil
test rdx, 7
jne 0x476121
cmp rdx, 0
je 0x47616d
test rdx, 0xf
je 0x4760fd
test rdx, 7
jne 0x476121
sub rdx, 8
mov rdi, qword [rsi + rdx]
mov rax, qword [rcx + rdx]
xor rdi, rax
mov qword [rbx + rdx], rdi
cmp rdx, 0x10
jge 0x4760fd
ret
Function at 0x476560
Capabilities:
Encrypt data using rc4 prga

Disassembly:
lea r12, [rsp - 0x60]
cmp r12, qword [r14 + 0x10]
jbe 0x4767b2
sub rsp, 0xe0
mov qword [rsp + 0xd8], rbp
lea rbp, [rsp + 0xd8]
movups xmmword [rsp + 0xe8], xmm15
movups xmmword [rsp + 0xf8], xmm15
movups xmmword [rsp + 0x108], xmm15
movups xmmword [rsp + 0x118], xmm15
movabs rdx, 0xe9642c39021921cd
mov qword [rsp + 0x52], rdx
movabs rdx, 0x4af9504322abde2
mov qword [rsp + 0x5a], rdx
movabs rdx, 0xb55bb1c557e4f43e
mov qword [rsp + 0x62], rdx
movabs rdx, 0xac0cac1859d52f9d
mov qword [rsp + 0x6a], rdx
movabs rdx, 0x445f9fe71b3037c0
mov qword [rsp + 0x72], rdx
movabs rdx, 0x929f105415ff232e
mov qword [rsp + 0x7a], rdx
movabs rdx, 0x3b1faa220f28a6ca
mov qword [rsp + 0x82], rdx
movabs rdx, 0x6a8080db0130e2b
mov qword [rsp + 0x8a], rdx
movabs rdx, 0x2f1d0c2705111b0d
mov qword [rsp + 0x92], rdx
movabs rdx, 0x372018131b1f2f1d
mov qword [rsp + 0x98], rdx
movabs rdx, 0x381507162c143809
mov qword [rsp + 0xa0], rdx
movabs rdx, 0x310c111d08121b13
mov qword [rsp + 0xa8], rdx
movabs rdx, 0x11a00062d022630
mov qword [rsp + 0xb0], rdx
movabs rdx, 0x19112e1530141d24
mov qword [rsp + 0xb8], rdx
movabs rdx, 0x120251835023b11
mov qword [rsp + 0xc0], rdx
movabs rdx, 0x2a27190e071a0d00
mov qword [rsp + 0xc8], rdx
movabs rdx, 0x2a20271d17092d3e
mov qword [rsp + 0xd0], rdx
xor eax, eax
jmp 0x4766e8
movzx r8d, byte [rsp + rbx + 0x52]
lea edx, [r8 + rdx]
lea edx, [rdx + 0x27]
mov byte [rsp + rsi + 0x52], dl
mov byte [rsp + rbx + 0x52], dil
add rax, 2
cmp rax, 0x46
jge 0x476722
movzx edx, byte [rsp + rax + 0x92]
movzx ebx, byte [rsp + rax + 0x93]
mov esi, edx
xor edx, ebx
add edx, eax
cmp rsi, 0x40
jae 0x4767a5
movzx edi, byte [rsp + rsi + 0x52]
lea edi, [rdi + rdx]
lea edi, [rdi + 0x27]
cmp rbx, 0x40
jb 0x4766ce
nop
jmp 0x476794
movups xmmword [rsp + 0x12], xmm15
movups xmmword [rsp + 0x22], xmm15
movups xmmword [rsp + 0x32], xmm15
movups xmmword [rsp + 0x42], xmm15
xor eax, eax
jmp 0x47674a
movzx ecx, byte [rsp + rax + 0x52]
mov byte [rsp + rax + 0x12], cl
inc rax
cmp rax, 0x40
jl 0x47673e
movups xmm0, xmmword [rsp + 0x12]
movups xmmword [rsp + 0xe8], xmm0
movups xmm0, xmmword [rsp + 0x22]
movups xmmword [rsp + 0xf8], xmm0
movups xmm0, xmmword [rsp + 0x32]
movups xmmword [rsp + 0x108], xmm0
movups xmm0, xmmword [rsp + 0x42]
movups xmmword [rsp + 0x118], xmm0
mov rbp, qword [rsp + 0xd8]
add rsp, 0xe0
ret
mov eax, ebx
mov ecx, 0x40
nop dword [rax + rax]
call fcn.00456a60
mov eax, esi
mov ecx, 0x40
call fcn.00456a60
nop
call fcn.00454400
jmp fcn.00476560
Function at 0x477120
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4771e8
sub rsp, 0x38
mov qword [rsp + 0x30], rbp
lea rbp, [rsp + 0x30]
movabs rdx, 0xf4e79bace8e63851
mov qword [rsp + 0x1c], rdx
movabs rdx, 0x6070703050704
mov qword [rsp + 0x24], rdx
mov dword [rsp + 0x2c], 0x3020306
xor eax, eax
jmp 0x477180
movzx r9d, byte [rsp + rsi + 0x1c]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x41]
mov byte [rsp + rdi + 0x1c], dl
mov byte [rsp + rsi + 0x1c], r8b
add rax, 2
nop dword [rax]
cmp rax, 0xc
jge 0x4771b2
movzx edx, byte [rsp + rax + 0x24]
movzx esi, byte [rsp + rax + 0x25]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 8
jae 0x4771db
movzx r8d, byte [rsp + rdi + 0x1c]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x41]
cmp rsi, 8
jb 0x477162
jmp 0x4771cf
xor eax, eax
lea rbx, [rsp + 0x1c]
mov ecx, 8
nop
call fcn.00444360
mov rbp, qword [rsp + 0x30]
add rsp, 0x38
ret
mov eax, esi
mov ecx, 8
call fcn.00456a60
mov eax, edi
mov ecx, 8
call fcn.00456a60
nop
call fcn.00454400
jmp fcn.00477120

Function at 0x47a720
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x47a828
sub rsp, 0x58
mov qword [rsp + 0x50], rbp
lea rbp, [rsp + 0x50]
movabs rdx, 0x34cbf5d2a80733ff
mov qword [rsp + 0x1d], rdx
movabs rdx, 0x1c36d80835f79634
mov qword [rsp + 0x24], rdx
movabs rdx, 0x3532c6c30807c636
mov qword [rsp + 0x2c], rdx
movabs rdx, 0x614130803090303
mov qword [rsp + 0x34], rdx
movabs rdx, 0x20c110413101208
mov qword [rsp + 0x3c], rdx
movabs rdx, 0x5050600020c1104
mov qword [rsp + 0x40], rdx
movabs rdx, 0xb02111013140e12
mov qword [rsp + 0x48], rdx
xor eax, eax
jmp 0x47a7c2
movzx r9d, byte [rsp + rsi + 0x1d]
sub r9d, edx
lea edx, [r9 + 0x4d]
mov byte [rsp + rdi + 0x1d], dl
lea edx, [r8 + 0x4d]
mov byte [rsp + rsi + 0x1d], dl
add rax, 2
cmp rax, 0x1c
jge 0x47a7ef
movzx edx, byte [rsp + rax + 0x34]
movzx esi, byte [rsp + rax + 0x35]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x17
jae 0x47a81b
movzx r8d, byte [rsp + rdi + 0x1d]
sub r8d, edx
cmp rsi, 0x17
jb 0x47a7a5
jmp 0x47a80f
xor eax, eax
lea rbx, [rsp + 0x1d]
mov ecx, 0x17
nop dword [rax + rax]
call fcn.00444360
mov rbp, qword [rsp + 0x50]
add rsp, 0x58
ret
mov eax, esi
mov ecx, 0x17
call fcn.00456a60
mov eax, edi
mov ecx, 0x17
call fcn.00456a60
nop
call fcn.00454400
jmp fcn.0047a720
Function at 0x47a840
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x47a948
sub rsp, 0x58
mov qword [rsp + 0x50], rbp
lea rbp, [rsp + 0x50]
movabs rdx, 0x32dadf3173e1dccf
mov qword [rsp + 0x1e], rdx
movabs rdx, 0x6e34d1d83676df8b
mov qword [rsp + 0x26], rdx
movabs rdx, 0xdf3f31dace7bdacf
mov qword [rsp + 0x2e], rdx
movabs rdx, 0x517080a160a120c
mov qword [rsp + 0x36], rdx
movabs rdx, 0x209110a1103160d
mov qword [rsp + 0x3e], rdx
movabs rdx, 0x130f0209110a1103
mov qword [rsp + 0x40], rdx
movabs rdx, 0x80c131400100601
mov qword [rsp + 0x48], rdx
xor eax, eax
jmp 0x47a8e0
movzx r9d, byte [rsp + rsi + 0x1e]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x3e]
mov byte [rsp + rdi + 0x1e], dl
mov byte [rsp + rsi + 0x1e], r8b
add rax, 2
nop
cmp rax, 0x1a
jge 0x47a912
movzx edx, byte [rsp + rax + 0x36]
movzx esi, byte [rsp + rax + 0x37]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x18
jae 0x47a93b
movzx r8d, byte [rsp + rdi + 0x1e]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x3e]
cmp rsi, 0x18
jb 0x47a8c5
jmp 0x47a92f
xor eax, eax
lea rbx, [rsp + 0x1e]
mov ecx, 0x18
nop
call fcn.00444360
mov rbp, qword [rsp + 0x50]
add rsp, 0x58
ret
mov eax, esi
mov ecx, 0x18
call fcn.00456a60
mov eax, edi
mov ecx, 0x18
call fcn.00456a60
nop
call fcn.00454400
jmp fcn.0047a840
Function at 0x47b800
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x47b916
sub rsp, 0x60
mov qword [rsp + 0x58], rbp
lea rbp, [rsp + 0x58]
movabs rdx, 0x2a22341534283026
mov qword [rsp + 0x1e], rdx
movabs rdx, 0x290f17291a311d31
mov qword [rsp + 0x26], rdx
movabs rdx, 0x3104f316290f1729
mov qword [rsp + 0x2a], rdx
movabs rdx, 0x3c322c3039331635
mov qword [rsp + 0x32], rdx
movabs rdx, 0xa0c1b1b0f191500
mov qword [rsp + 0x3a], rdx
movabs rdx, 0xb111204100d0c0f
mov qword [rsp + 0x42], rdx
movabs rdx, 0xb070a020e070b11
mov qword [rsp + 0x48], rdx
movabs rdx, 0x6090412120707
mov qword [rsp + 0x50], rdx
xor eax, eax
jmp 0x47b8ae
movzx r9d, byte [rsp + rsi + 0x1e]
lea edx, [r9 + rdx]
lea edx, [rdx - 0xb]
mov byte [rsp + rdi + 0x1e], dl
mov byte [rsp + rsi + 0x1e], r8b
add rax, 2
cmp rax, 0x1e
jge 0x47b8e2
movzx edx, byte [rsp + rax + 0x3a]
movzx esi, byte [rsp + rax + 0x3b]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x1c
jae 0x47b909
movzx r8d, byte [rsp + rdi + 0x1e]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0xb]
cmp rsi, 0x1c
jb 0x47b894
nop
jmp 0x47b8fd
xor eax, eax
lea rbx, [rsp + 0x1e]
mov ecx, 0x1c
call fcn.00444360
mov rbp, qword [rsp + 0x58]
add rsp, 0x60
ret
mov eax, esi
mov ecx, 0x1c
call fcn.00456a60
mov eax, edi
mov ecx, 0x1c
call fcn.00456a60
nop
call fcn.00454400
nop dword [rax + rax]
jmp fcn.0047b800

Function at 0x47b940
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x47ba72
sub rsp, 0x68
mov qword [rsp + 0x60], rbp
lea rbp, [rsp + 0x60]
movabs rdx, 0x35cc7ca21934e142
mov qword [rsp + 0x19], rdx
movabs rdx, 0xa484f0d968a978f5
mov qword [rsp + 0x21], rdx
movabs rdx, 0xc1f0c17c31a484f0
mov qword [rsp + 0x26], rdx
movabs rdx, 0xd43219f23539bd35
mov qword [rsp + 0x2e], rdx
movabs rdx, 0xf03040d13190008
mov qword [rsp + 0x36], rdx
movabs rdx, 0x8030a1103090909
mov qword [rsp + 0x3e], rdx
movabs rdx, 0x110108030a110309
mov qword [rsp + 0x40], rdx
movabs rdx, 0x10c0a060d0e1a06
mov qword [rsp + 0x48], rdx
movabs rdx, 0xd03140f08140a05
mov qword [rsp + 0x50], rdx
movabs rdx, 0xa12160c141c0a0b
mov qword [rsp + 0x58], rdx
xor eax, eax
jmp 0x47ba0c
movzx r9d, byte [rsp + rsi + 0x19]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x37]
mov byte [rsp + rdi + 0x19], dl
mov byte [rsp + rsi + 0x19], r8b
add rax, 2
cmp rax, 0x2a
jge 0x47ba3e
movzx edx, byte [rsp + rax + 0x36]
movzx esi, byte [rsp + rax + 0x37]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x1d
jae 0x47ba65
movzx r8d, byte [rsp + rdi + 0x19]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x37]
cmp rsi, 0x1d
jb 0x47b9f2
jmp 0x47ba59
xor eax, eax
lea rbx, [rsp + 0x19]
mov ecx, 0x1d
call fcn.00444360
mov rbp, qword [rsp + 0x60]
add rsp, 0x68
ret
mov eax, esi
mov ecx, 0x1d
call fcn.00456a60
mov eax, edi
mov ecx, 0x1d
call fcn.00456a60
nop
call fcn.00454400
jmp fcn.0047b940
Function at 0x47bec0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x47bfe6
sub rsp, 0x68
mov qword [rsp + 0x60], rbp
lea rbp, [rsp + 0x60]
movabs rdx, 0x392a4a434d6e483c
mov qword [rsp + 0x1c], rdx
movabs rdx, 0x4556344a34255533
mov qword [rsp + 0x24], rdx
movabs rdx, 0x396a525b653e3428
mov qword [rsp + 0x2c], rdx
movabs rdx, 0x353256312f746637
mov qword [rsp + 0x34], rdx
movabs rdx, 0x1c0c0a091b101a00
mov qword [rsp + 0x3c], rdx
movabs rdx, 0xf1201121c0c0a09
mov qword [rsp + 0x40], rdx
movabs rdx, 0x131d190608000604
mov qword [rsp + 0x48], rdx
movabs rdx, 0x215160515081c06
mov qword [rsp + 0x50], rdx
movabs rdx, 0x140a051d13030e15
mov qword [rsp + 0x58], rdx
xor eax, eax
jmp 0x47bf80
movzx r9d, byte [rsp + rsi + 0x1c]
sub r9d, edx
lea edx, [r9 + 0x15]
mov byte [rsp + rdi + 0x1c], dl
lea edx, [r8 + 0x15]
mov byte [rsp + rsi + 0x1c], dl
add rax, 2
cmp rax, 0x24
jge 0x47bfad
movzx edx, byte [rsp + rax + 0x3c]
movzx esi, byte [rsp + rax + 0x3d]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x20
jae 0x47bfd4
movzx r8d, byte [rsp + rdi + 0x1c]
sub r8d, edx
cmp rsi, 0x20
jb 0x47bf63
jmp 0x47bfc8
xor eax, eax
lea rbx, [rsp + 0x1c]
mov ecx, 0x20
call fcn.00444360
mov rbp, qword [rsp + 0x60]
add rsp, 0x68
ret
mov eax, esi
mov ecx, 0x20
call fcn.00456a60
mov eax, edi
mov ecx, 0x20
nop dword [rax + rax]
call fcn.00456a60
nop
call fcn.00454400
jmp fcn.0047bec0

Function at 0x47ce00
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x47cf32
sub rsp, 0x70
mov qword [rsp + 0x68], rbp
lea rbp, [rsp + 0x68]
movabs rdx, 0x31280cff212a072a
mov qword [rsp + 0x1d], rdx
movabs rdx, 0x9379c31280cff21
mov qword [rsp + 0x20], rdx
movabs rdx, 0xf2e3332ea0631de
mov qword [rsp + 0x28], rdx
movabs rdx, 0x15261c3530143807
mov qword [rsp + 0x30], rdx
movabs rdx, 0x35eb360400201134
mov qword [rsp + 0x38], rdx
movabs rdx, 0x1a1e031e06130419
mov qword [rsp + 0x40], rdx
movabs rdx, 0x21051f0b080e1811
mov qword [rsp + 0x48], rdx
movabs rdx, 0x51e0b1c1f111d08
mov qword [rsp + 0x50], rdx
movabs rdx, 0x1d0a0d110e190200
mov qword [rsp + 0x58], rdx
movabs rdx, 0x306151212011901
mov qword [rsp + 0x60], rdx
xor eax, eax
jmp 0x47cecc
movzx r9d, byte [rsp + rsi + 0x1d]
lea edx, [r9 + rdx]
lea edx, [rdx - 0xc]
mov byte [rsp + rdi + 0x1d], dl
mov byte [rsp + rsi + 0x1d], r8b
add rax, 2
cmp rax, 0x28
jge 0x47cefe
movzx edx, byte [rsp + rax + 0x40]
movzx esi, byte [rsp + rax + 0x41]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x23
jae 0x47cf25
movzx r8d, byte [rsp + rdi + 0x1d]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0xc]
cmp rsi, 0x23
jb 0x47ceb2
jmp 0x47cf19
xor eax, eax
lea rbx, [rsp + 0x1d]
mov ecx, 0x23
call fcn.00444360
mov rbp, qword [rsp + 0x68]
add rsp, 0x70
ret
mov eax, esi
mov ecx, 0x23
call fcn.00456a60
mov eax, edi
mov ecx, 0x23
call fcn.00456a60
nop
call fcn.00454400
jmp fcn.0047ce00
Function at 0x47cf40
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x47d088
sub rsp, 0x70
mov qword [rsp + 0x68], rbp
lea rbp, [rsp + 0x68]
movabs rdx, 0x30809ff683343480
mov qword [rsp + 0x1a], rdx
movabs rdx, 0xf0357be330809ff6
mov qword [rsp + 0x1e], rdx
movabs rdx, 0xec28d83177a7367d
mov qword [rsp + 0x26], rdx
movabs rdx, 0x93373608326f4e39
mov qword [rsp + 0x2e], rdx
movabs rdx, 0x355fce18bf753686
mov qword [rsp + 0x36], rdx
movabs rdx, 0xb04210c0b180511
mov qword [rsp + 0x3e], rdx
movabs rdx, 0x1f130c1f15120e0e
mov qword [rsp + 0x46], rdx
movabs rdx, 0x20161f130c1f1512
mov qword [rsp + 0x48], rdx
movabs rdx, 0x1b1f081f1216180b
mov qword [rsp + 0x50], rdx
movabs rdx, 0xc221c1300150f12
mov qword [rsp + 0x58], rdx
movabs rdx, 0x309051e001c1606
mov qword [rsp + 0x60], rdx
xor eax, eax
nop
jmp 0x47d020
movzx r9d, byte [rsp + rsi + 0x1a]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x7d]
mov byte [rsp + rdi + 0x1a], dl
mov byte [rsp + rsi + 0x1a], r8b
add rax, 2
nop dword [rax]
cmp rax, 0x2a
jge 0x47d052
movzx edx, byte [rsp + rax + 0x3e]
movzx esi, byte [rsp + rax + 0x3f]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x24
jae 0x47d07b
movzx r8d, byte [rsp + rdi + 0x1a]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x7d]
cmp rsi, 0x24
jb 0x47d002
jmp 0x47d06f
xor eax, eax
lea rbx, [rsp + 0x1a]
mov ecx, 0x24
nop
call fcn.00444360
mov rbp, qword [rsp + 0x68]
add rsp, 0x70
ret
mov eax, esi
mov ecx, 0x24
call fcn.00456a60
mov eax, edi
mov ecx, 0x24
call fcn.00456a60
nop
call fcn.00454400
jmp fcn.0047cf40

Function at 0x47dfa0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x47e0e6
sub rsp, 0x78
mov qword [rsp + 0x70], rbp
lea rbp, [rsp + 0x70]
movabs rdx, 0x4d95e33e8538338e
mov qword [rsp + 0x1a], rdx
movabs rdx, 0x27f0a534381c30c7
mov qword [rsp + 0x22], rdx
movabs rdx, 0x9f984e1d35c43736
mov qword [rsp + 0x2a], rdx
movabs rdx, 0x3597313da4a67fa8
mov qword [rsp + 0x32], rdx
movabs rdx, 0x35179caf3933caf0
mov qword [rsp + 0x3a], rdx
movabs rdx, 0x182015122014261a
mov qword [rsp + 0x42], rdx
movabs rdx, 0x1c24030f250c1419
mov qword [rsp + 0x4a], rdx
movabs rdx, 0xa1e050e03071c24
mov qword [rsp + 0x50], rdx
movabs rdx, 0x3241e16060e07
mov qword [rsp + 0x58], rdx
movabs rdx, 0x12151b0d001a0517
mov qword [rsp + 0x60], rdx
movabs rdx, 0x825211215040412
mov qword [rsp + 0x68], rdx
xor eax, eax
nop
jmp 0x47e080
movzx r9d, byte [rsp + rsi + 0x1a]
sub r9d, edx
lea edx, [r9 - 0x38]
mov byte [rsp + rdi + 0x1a], dl
lea edx, [r8 - 0x38]
mov byte [rsp + rsi + 0x1a], dl
add rax, 2
nop
cmp rax, 0x2e
jge 0x47e0ad
movzx edx, byte [rsp + rax + 0x42]
movzx esi, byte [rsp + rax + 0x43]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x28
jae 0x47e0d4
movzx r8d, byte [rsp + rdi + 0x1a]
sub r8d, edx
cmp rsi, 0x28
jb 0x47e062
jmp 0x47e0c8
xor eax, eax
lea rbx, [rsp + 0x1a]
mov ecx, 0x28
call fcn.00444360
mov rbp, qword [rsp + 0x70]
add rsp, 0x78
ret
mov eax, esi
mov ecx, 0x28
call fcn.00456a60
mov eax, edi
mov ecx, 0x28
nop dword [rax + rax]
call fcn.00456a60
nop
call fcn.00454400
jmp fcn.0047dfa0
Function at 0x47e660
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x47e7b2
add rsp, 0xffffffffffffff80
mov qword [rsp + 0x78], rbp
lea rbp, [rsp + 0x78]
movabs rdx, 0x313332372b3de731
mov qword [rsp + 0x1e], rdx
movabs rdx, 0x3c0c381d37403533
mov qword [rsp + 0x26], rdx
movabs rdx, 0x394a3c0c381d3740
mov qword [rsp + 0x28], rdx
movabs rdx, 0x342e38394d310024
mov qword [rsp + 0x30], rdx
movabs rdx, 0x11303a1b09473b38
mov qword [rsp + 0x38], rdx
movabs rdx, 0x3553111c321e3329
mov qword [rsp + 0x40], rdx
movabs rdx, 0x822021e100a0c28
mov qword [rsp + 0x48], rdx
movabs rdx, 0x1c151226131c1324
mov qword [rsp + 0x50], rdx
movabs rdx, 0xa1f0c0817081c0f
mov qword [rsp + 0x58], rdx
movabs rdx, 0xf1815071d272115
mov qword [rsp + 0x60], rdx
movabs rdx, 0x151224011b182802
mov qword [rsp + 0x68], rdx
movabs rdx, 0x240e21280701030c
mov qword [rsp + 0x70], rdx
xor eax, eax
jmp 0x47e74a
movzx r9d, byte [rsp + rsi + 0x1e]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x2c]
mov byte [rsp + rdi + 0x1e], dl
mov byte [rsp + rsi + 0x1e], r8b
add rax, 2
cmp rax, 0x30
jge 0x47e77c
movzx edx, byte [rsp + rax + 0x48]
movzx esi, byte [rsp + rax + 0x49]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x2a
jae 0x47e7a5
movzx r8d, byte [rsp + rdi + 0x1e]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x2c]
cmp rsi, 0x2a
jb 0x47e730
jmp 0x47e797
xor eax, eax
lea rbx, [rsp + 0x1e]
mov ecx, 0x2a
call fcn.00444360
mov rbp, qword [rsp + 0x78]
sub rsp, 0xffffffffffffff80
ret
mov eax, esi
mov ecx, 0x2a
nop
call fcn.00456a60
mov eax, edi
mov ecx, 0x2a
call fcn.00456a60
nop
call fcn.00454400
jmp fcn.0047e660
Function at 0x489700
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4897c8
sub rsp, 0x38
mov qword [rsp + 0x30], rbp
lea rbp, [rsp + 0x30]
movabs rdx, 0x123e3a7265093f44
mov qword [rsp + 0x1b], rdx
mov byte [rsp + 0x23], 0x3d
movabs rdx, 0x100050702020606
mov qword [rsp + 0x24], rdx
mov dword [rsp + 0x2c], 0x2080505
xor eax, eax
jmp 0x489761
movzx r9d, byte [rsp + rsi + 0x1b]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x23]
mov byte [rsp + rdi + 0x1b], dl
mov byte [rsp + rsi + 0x1b], r8b
add rax, 2
cmp rax, 0xc
jge 0x489793
movzx edx, byte [rsp + rax + 0x24]
movzx esi, byte [rsp + rax + 0x25]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 9
jae 0x4897bb
movzx r8d, byte [rsp + rdi + 0x1b]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x23]
cmp rsi, 9
jb 0x489747
jmp 0x4897af
xor eax, eax
lea rbx, [rsp + 0x1b]
mov ecx, 9
nop
call fcn.00444360
mov rbp, qword [rsp + 0x30]
add rsp, 0x38
ret
mov eax, esi
mov ecx, 9
call fcn.00456a60
mov eax, edi
mov ecx, 9
call fcn.00456a60
nop
call fcn.00454400
jmp fcn.00489700

Function at 0x491180
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x491288
sub rsp, 0x58
mov qword [rsp + 0x50], rbp
lea rbp, [rsp + 0x50]
movabs rdx, 0x3f444f4c48525e23
mov qword [rsp + 0x18], rdx
movabs rdx, 0x10d0e484464413c
mov qword [rsp + 0x20], rdx
movabs rdx, 0x93673664a6f4edc
mov qword [rsp + 0x28], rdx
movabs rdx, 0x506020d060311
mov qword [rsp + 0x30], rdx
movabs rdx, 0x1117081306000501
mov qword [rsp + 0x38], rdx
movabs rdx, 0x902070d10070e16
mov qword [rsp + 0x40], rdx
movabs rdx, 0xd16040c09010b0f
mov qword [rsp + 0x48], rdx
xor eax, eax
jmp 0x491220
movzx r9d, byte [rsp + rsi + 0x18]
lea edx, [r9 + rdx]
lea edx, [rdx + 3]
mov byte [rsp + rdi + 0x18], dl
mov byte [rsp + rsi + 0x18], r8b
add rax, 2
nop
cmp rax, 0x20
jge 0x491252
movzx edx, byte [rsp + rax + 0x30]
movzx esi, byte [rsp + rax + 0x31]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x18
jae 0x49127b
movzx r8d, byte [rsp + rdi + 0x18]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 3]
cmp rsi, 0x18
jb 0x491205
jmp 0x49126f
xor eax, eax
lea rbx, [rsp + 0x18]
mov ecx, 0x18
nop
call fcn.00444360
mov rbp, qword [rsp + 0x50]
add rsp, 0x58
ret
mov eax, esi
mov ecx, 0x18
call fcn.00456a60
mov eax, edi
mov ecx, 0x18
call fcn.00456a60
nop
call fcn.00454400
jmp fcn.00491180
Function at 0x491600
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x491752
add rsp, 0xffffffffffffff80
mov qword [rsp + 0x78], rbp
lea rbp, [rsp + 0x78]
movabs rdx, 0x41d9bf3ede742c49
mov qword [rsp + 0x1e], rdx
movabs rdx, 0xd1ded64241d9bf3e
mov qword [rsp + 0x22], rdx
movabs rdx, 0x65474861b2200720
mov qword [rsp + 0x2a], rdx
movabs rdx, 0x359564f492f1b8f5
mov qword [rsp + 0x32], rdx
movabs rdx, 0xc45f8789f99f5204
mov qword [rsp + 0x3a], rdx
movabs rdx, 0x180a061521201b0d
mov qword [rsp + 0x42], rdx
movabs rdx, 0x1161f04221d180a
mov qword [rsp + 0x48], rdx
movabs rdx, 0x1c1a1622141f1217
mov qword [rsp + 0x50], rdx
movabs rdx, 0x9201c0521030c20
mov qword [rsp + 0x58], rdx
movabs rdx, 0x230b17221c17121d
mov qword [rsp + 0x60], rdx
movabs rdx, 0x1100181e060d060a
mov qword [rsp + 0x68], rdx
movabs rdx, 0x1100160a051e170f
mov qword [rsp + 0x70], rdx
xor eax, eax
jmp 0x4916ea
movzx r9d, byte [rsp + rsi + 0x1e]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x51]
mov byte [rsp + rdi + 0x1e], dl
mov byte [rsp + rsi + 0x1e], r8b
add rax, 2
cmp rax, 0x36
jge 0x49171c
movzx edx, byte [rsp + rax + 0x42]
movzx esi, byte [rsp + rax + 0x43]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x24
jae 0x491745
movzx r8d, byte [rsp + rdi + 0x1e]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x51]
cmp rsi, 0x24
jb 0x4916d0
jmp 0x491737
xor eax, eax
lea rbx, [rsp + 0x1e]
mov ecx, 0x24
call fcn.00444360
mov rbp, qword [rsp + 0x78]
sub rsp, 0xffffffffffffff80
ret
mov eax, esi
mov ecx, 0x24
nop
call fcn.00456a60
mov eax, edi
mov ecx, 0x24
call fcn.00456a60
nop
call fcn.00454400
jmp fcn.00491600