joyce8/EMBER2024-capa huggingface dataset:
Function at 0x47a2a0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x47a366
push rbp
mov rbp, rsp
sub rsp, 0x30
movabs rdx, 0x8373bf6c706d06ff
mov qword [rsp + 0x1d], rdx
mov byte [rsp + 0x25], 0x34
movabs rdx, 0x705060607000100
mov qword [rsp + 0x26], rdx
mov word [rsp + 0x2e], 0x600
xor eax, eax
nop
jmp 0x47a300
movzx r9d, byte [rsp + rsi + 0x1d]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x6f]
mov byte [rsp + rdi + 0x1d], dl
mov byte [rsp + rsi + 0x1d], r8b
add rax, 2
nop dword [rax]
cmp rax, 0xa
jge 0x47a332
movzx edx, byte [rsp + rax + 0x26]
movzx esi, byte [rsp + rax + 0x27]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 9
jae 0x47a357
movzx r8d, byte [rsp + rdi + 0x1d]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x6f]
cmp rsi, 9
jb 0x47a2e2
jmp 0x47a34b
xor eax, eax
lea rbx, [rsp + 0x1d]
mov ecx, 9
nop
call fcn.004454c0
add rsp, 0x30
pop rbp
ret
mov eax, esi
mov ecx, 9
call fcn.004579c0
mov eax, edi
mov ecx, 9
nop
call fcn.004579c0
nop
call fcn.00455760
jmp fcn.0047a2a0

Function at 0x47b160
Capabilities:
Encrypt data using rc4 prga

Disassembly:
lea r12, [rsp - 0x28]
cmp r12, qword [r14 + 0x10]
jbe 0x47b30a
push rbp
mov rbp, rsp
sub rsp, 0xa0
movabs rdx, 0xf6a8ec76444342c8
mov qword [rsp + 0x1c], rdx
movabs rdx, 0xdf27974d8f4b3899
mov qword [rsp + 0x24], rdx
movabs rdx, 0x58575655dfbc94ca
mov qword [rsp + 0x2c], rdx
movabs rdx, 0x64d0b63b9615abf
mov qword [rsp + 0x34], rdx
movabs rdx, 0x146ddb6ba0a568c8
mov qword [rsp + 0x3c], rdx
movabs rdx, 0x7661747f729a864d
mov qword [rsp + 0x44], rdx
movabs rdx, 0xe7b012932dbc7841
mov qword [rsp + 0x4c], rdx
movabs rdx, 0x6d2b588b6c0fb3c2
mov qword [rsp + 0x54], rdx
movabs rdx, 0x1e3f002a04073608
mov qword [rsp + 0x5c], rdx
movabs rdx, 0x2c3a0e321e3f002a
mov qword [rsp + 0x60], rdx
movabs rdx, 0xb0500390427093f
mov qword [rsp + 0x68], rdx
movabs rdx, 0xd1f29381135351e
mov qword [rsp + 0x70], rdx
movabs rdx, 0x1e120f201f3f1332
mov qword [rsp + 0x78], rdx
movabs rdx, 0x3c343039060b223d
mov qword [rsp + 0x80], rdx
movabs rdx, 0x2e39283b092c3f23
mov qword [rsp + 0x88], rdx
movabs rdx, 0x40d22332c25101b
mov qword [rsp + 0x90], rdx
movabs rdx, 0x22392537281d3b18
mov qword [rsp + 0x98], rdx
xor eax, eax
jmp 0x47b2a6
movzx r9d, byte [rsp + rsi + 0x1c]
sub r9d, edx
lea edx, [r9 - 0x29]
mov byte [rsp + rdi + 0x1c], dl
lea edx, [r8 - 0x29]
mov byte [rsp + rsi + 0x1c], dl
add rax, 2
cmp rax, 0x44
jge 0x47b2d7
movzx edx, byte [rsp + rax + 0x5c]
movzx esi, byte [rsp + rax + 0x5d]
mov edi, edx
xor edx, esi
add edx, eax
nop dword [rax]
cmp rdi, 0x40
jae 0x47b2fd
movzx r8d, byte [rsp + rdi + 0x1c]
sub r8d, edx
cmp rsi, 0x40
jb 0x47b289
jmp 0x47b2f1
xor eax, eax
lea rbx, [rsp + 0x1c]
mov ecx, 0x40
call fcn.004454c0
add rsp, 0xa0
pop rbp
ret
mov eax, esi
mov ecx, 0x40
call fcn.004579c0
mov eax, edi
mov ecx, 0x40
call fcn.004579c0
nop
call fcn.00455760
jmp fcn.0047b160
Function at 0x47f060
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x47f12a
push rbp
mov rbp, rsp
sub rsp, 0x48
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x58], rax
mov qword [rsp], rax
mov qword [rsp + 8], rbx
mov byte [rsp + 0x10], 0
call fcn.004027a0
xorps xmm15, xmm15
mov r14, qword [0x0224ba38]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x18], 0xffffffffffffffff
jne 0x47f10f
mov rcx, qword [rsp + 0x60]
lea rdx, [rcx + 1]
mov qword [rsp + 0x40], rdx
lea rax, [0x004b7980]
xor ebx, ebx
mov rcx, rdx
call fcn.00441440
mov rbx, qword [rsp + 0x60]
mov rcx, rax
xor edi, edi
mov rsi, qword [rsp + 0x40]
mov rax, qword [rsp + 0x58]
nop dword [rax]
call fcn.00481500
inc rbx
cmp rcx, rbx
jae 0x47f0fe
mov edi, 1
lea rsi, [0x004b7980]
call fcn.00441520
mov word [rax + rbx*2 - 2], 0
xor edi, edi
xor esi, esi
add rsp, 0x48
pop rbp
ret
xor eax, eax
xor ebx, ebx
mov rcx, rbx
lea rdi, [0x0217a4e8]
lea rsi, [0x0217a1f8]
add rsp, 0x48
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.00455760
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.0047f060

Function at 0x47fda0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x47fe66
push rbp
mov rbp, rsp
sub rsp, 0x30
movabs rdx, 0x1e7279e1ed6b7585
mov qword [rsp + 0x1b], rdx
mov byte [rsp + 0x23], 0x72
movabs rdx, 0x507050500020000
mov qword [rsp + 0x24], rdx
mov dword [rsp + 0x2c], 0x5030400
xor eax, eax
nop
jmp 0x47fe00
movzx r9d, byte [rsp + rsi + 0x1b]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x75]
mov byte [rsp + rdi + 0x1b], dl
mov byte [rsp + rsi + 0x1b], r8b
add rax, 2
nop dword [rax]
cmp rax, 0xc
jge 0x47fe32
movzx edx, byte [rsp + rax + 0x24]
movzx esi, byte [rsp + rax + 0x25]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 9
jae 0x47fe57
movzx r8d, byte [rsp + rdi + 0x1b]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x75]
cmp rsi, 9
jb 0x47fde2
jmp 0x47fe4b
xor eax, eax
lea rbx, [rsp + 0x1b]
mov ecx, 9
nop
call fcn.004454c0
add rsp, 0x30
pop rbp
ret
mov eax, esi
mov ecx, 9
call fcn.004579c0
mov eax, edi
mov ecx, 9
nop
call fcn.004579c0
nop
call fcn.00455760
jmp fcn.0047fda0
Function at 0x47fe80
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x47ff7b
push rbp
mov rbp, rsp
sub rsp, 0x50
movabs rdx, 0x3a7764747d81949c
mov qword [rsp + 0x1a], rdx
movabs rdx, 0x65a38294746c5920
mov qword [rsp + 0x22], rdx
movabs rdx, 0x6e7777888d646a7e
mov qword [rsp + 0x2a], rdx
movabs rdx, 0x1413100d150b0100
mov qword [rsp + 0x32], rdx
movabs rdx, 0x14000207020c0e07
mov qword [rsp + 0x3a], rdx
movabs rdx, 0x140b160a06161400
mov qword [rsp + 0x40], rdx
movabs rdx, 0x912130603010511
mov qword [rsp + 0x48], rdx
xor eax, eax
jmp 0x47ff19
movzx r9d, byte [rsp + rsi + 0x1a]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x2b]
mov byte [rsp + rdi + 0x1a], dl
mov byte [rsp + rsi + 0x1a], r8b
add rax, 2
cmp rax, 0x1e
jge 0x47ff4b
movzx edx, byte [rsp + rax + 0x32]
movzx esi, byte [rsp + rax + 0x33]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x18
jae 0x47ff6e
movzx r8d, byte [rsp + rdi + 0x1a]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x2b]
cmp rsi, 0x18
jb 0x47feff
jmp 0x47ff62
xor eax, eax
lea rbx, [rsp + 0x1a]
mov ecx, 0x18
call fcn.004454c0
add rsp, 0x50
pop rbp
ret
mov eax, esi
mov ecx, 0x18
call fcn.004579c0
mov eax, edi
mov ecx, 0x18
call fcn.004579c0
nop
nop dword [rax + rax]
call fcn.00455760
jmp fcn.0047fe80

Function at 0x4809c0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x480a8c
push rbp
mov rbp, rsp
sub rsp, 0x30
movabs rdx, 0x95aad218d8726574
mov qword [rsp + 0x18], rdx
mov word [rsp + 0x20], 0xfcd5
movabs rdx, 0x907060904060305
mov qword [rsp + 0x22], rdx
movabs rdx, 0x308050608060907
mov qword [rsp + 0x28], rdx
xor eax, eax
jmp 0x480a24
movzx r9d, byte [rsp + rsi + 0x18]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x45]
mov byte [rsp + rdi + 0x18], dl
mov byte [rsp + rsi + 0x18], r8b
add rax, 2
cmp rax, 0xe
jge 0x480a5c
movzx edx, byte [rsp + rax + 0x22]
movzx esi, byte [rsp + rax + 0x23]
mov edi, edx
xor edx, esi
add edx, eax
nop word [rax + rax]
cmp rdi, 0xa
jae 0x480a7f
movzx r8d, byte [rsp + rdi + 0x18]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x45]
cmp rsi, 0xa
jb 0x480a0a
jmp 0x480a73
xor eax, eax
lea rbx, [rsp + 0x18]
mov ecx, 0xa
call fcn.004454c0
add rsp, 0x30
pop rbp
ret
mov eax, esi
mov ecx, 0xa
call fcn.004579c0
mov eax, edi
mov ecx, 0xa
call fcn.004579c0
nop
call fcn.00455760
jmp fcn.004809c0
Function at 0x483880
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x483952
push rbp
mov rbp, rsp
sub rsp, 0x38
movabs rdx, 0x7373dce3de58dee4
mov qword [rsp + 0x1f], rdx
movabs rdx, 0x65681f7373dce3de
mov qword [rsp + 0x22], rdx
movabs rdx, 0x402020901010008
mov qword [rsp + 0x2a], rdx
movabs rdx, 0x3050909010402
mov qword [rsp + 0x30], rdx
xor eax, eax
jmp 0x4838ec
movzx r9d, byte [rsp + rsi + 0x1f]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x75]
mov byte [rsp + rdi + 0x1f], dl
mov byte [rsp + rsi + 0x1f], r8b
add rax, 2
cmp rax, 0xe
jge 0x48391e
movzx edx, byte [rsp + rax + 0x2a]
movzx esi, byte [rsp + rax + 0x2b]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0xb
jae 0x483945
movzx r8d, byte [rsp + rdi + 0x1f]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x75]
cmp rsi, 0xb
jb 0x4838d2
jmp 0x483935
xor eax, eax
lea rbx, [rsp + 0x1f]
mov ecx, 0xb
call fcn.004454c0
add rsp, 0x38
pop rbp
ret
mov eax, esi
mov ecx, 0xb
nop dword [rax]
call fcn.004579c0
mov eax, edi
mov ecx, 0xb
call fcn.004579c0
nop
call fcn.00455760
jmp fcn.00483880

Function at 0x483e40
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x483f3b
push rbp
mov rbp, rsp
sub rsp, 0x50
movabs rdx, 0x7ac763ece2deddf0
mov qword [rsp + 0x1b], rdx
movabs rdx, 0x7059f565e591ed7a
mov qword [rsp + 0x22], rdx
movabs rdx, 0x797358c0b46563e5
mov qword [rsp + 0x2a], rdx
movabs rdx, 0x9140912130c070d
mov qword [rsp + 0x32], rdx
movabs rdx, 0xd0c14030e0e0405
mov qword [rsp + 0x3a], rdx
movabs rdx, 0x20e0813090d0c
mov qword [rsp + 0x40], rdx
movabs rdx, 0x1070d040f0a0613
mov qword [rsp + 0x48], rdx
xor eax, eax
jmp 0x483ed9
movzx r9d, byte [rsp + rsi + 0x1b]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x70]
mov byte [rsp + rdi + 0x1b], dl
mov byte [rsp + rsi + 0x1b], r8b
add rax, 2
cmp rax, 0x1e
jge 0x483f0b
movzx edx, byte [rsp + rax + 0x32]
movzx esi, byte [rsp + rax + 0x33]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x17
jae 0x483f2e
movzx r8d, byte [rsp + rdi + 0x1b]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x70]
cmp rsi, 0x17
jb 0x483ebf
jmp 0x483f22
xor eax, eax
lea rbx, [rsp + 0x1b]
mov ecx, 0x17
call fcn.004454c0
add rsp, 0x50
pop rbp
ret
mov eax, esi
mov ecx, 0x17
call fcn.004579c0
mov eax, edi
mov ecx, 0x17
call fcn.004579c0
nop
nop dword [rax + rax]
call fcn.00455760
jmp fcn.00483e40
Function at 0x483f60
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x48405d
push rbp
mov rbp, rsp
sub rsp, 0x48
movabs rdx, 0x48691bc370c770b4
mov qword [rsp + 0x1c], rdx
movabs rdx, 0x9ca648691bc370c7
mov qword [rsp + 0x1e], rdx
movabs rdx, 0xc065ed99e6a7b363
mov qword [rsp + 0x26], rdx
movabs rdx, 0x9090e0f0e0d0b07
mov qword [rsp + 0x2e], rdx
movabs rdx, 0x903000d0b080e0c
mov qword [rsp + 0x36], rdx
movabs rdx, 0x3000903000d0b08
mov qword [rsp + 0x38], rdx
movabs rdx, 0x802030005021104
mov qword [rsp + 0x40], rdx
xor eax, eax
jmp 0x484000
movzx r9d, byte [rsp + rsi + 0x1c]
sub r9d, edx
lea edx, [r9 - 0x38]
mov byte [rsp + rdi + 0x1c], dl
lea edx, [r8 - 0x38]
mov byte [rsp + rsi + 0x1c], dl
add rax, 2
nop dword [rax]
cmp rax, 0x1a
jge 0x48402d
movzx edx, byte [rsp + rax + 0x2e]
movzx esi, byte [rsp + rax + 0x2f]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x12
jae 0x484050
movzx r8d, byte [rsp + rdi + 0x1c]
sub r8d, edx
cmp rsi, 0x12
jb 0x483fdf
jmp 0x484044
xor eax, eax
lea rbx, [rsp + 0x1c]
mov ecx, 0x12
call fcn.004454c0
add rsp, 0x48
pop rbp
ret
mov eax, esi
mov ecx, 0x12
call fcn.004579c0
mov eax, edi
mov ecx, 0x12
call fcn.004579c0
nop
nop dword [rax]
call fcn.00455760
jmp fcn.00483f60

Function at 0x484800
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x48491d
push rbp
mov rbp, rsp
sub rsp, 0x60
movabs rdx, 0x652b397774afb549
mov qword [rsp + 0x1c], rdx
movabs rdx, 0xf9643d05f7e7fc44
mov qword [rsp + 0x24], rdx
movabs rdx, 0x24740965302f3c63
mov qword [rsp + 0x2c], rdx
movabs rdx, 0x34f82f3a3c2034cf
mov qword [rsp + 0x34], rdx
movabs rdx, 0x180509021206011f
mov qword [rsp + 0x3c], rdx
movabs rdx, 0x905150a18050902
mov qword [rsp + 0x40], rdx
movabs rdx, 0x81f0b0c150f131d
mov qword [rsp + 0x48], rdx
movabs rdx, 0x11091517051b0d19
mov qword [rsp + 0x50], rdx
movabs rdx, 0xb1e0f0c021c0a
mov qword [rsp + 0x58], rdx
xor eax, eax
jmp 0x4848c0
movzx r9d, byte [rsp + rsi + 0x1c]
sub r9d, edx
lea edx, [r9 + 0x59]
mov byte [rsp + rdi + 0x1c], dl
lea edx, [r8 + 0x59]
mov byte [rsp + rsi + 0x1c], dl
add rax, 2
nop word [rax + rax]
cmp rax, 0x24
jge 0x4848ed
movzx edx, byte [rsp + rax + 0x3c]
movzx esi, byte [rsp + rax + 0x3d]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x20
jae 0x484910
movzx r8d, byte [rsp + rdi + 0x1c]
sub r8d, edx
cmp rsi, 0x20
jb 0x48489d
jmp 0x484904
xor eax, eax
lea rbx, [rsp + 0x1c]
mov ecx, 0x20
call fcn.004454c0
add rsp, 0x60
pop rbp
ret
mov eax, esi
mov ecx, 0x20
call fcn.004579c0
mov eax, edi
mov ecx, 0x20
call fcn.004579c0
nop
nop dword [rax]
call fcn.00455760
jmp fcn.00484800
Function at 0x484940
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x484a2a
push rbp
mov rbp, rsp
sub rsp, 0x40
movabs rdx, 0x40e1d5db338fdb63
mov qword [rsp + 0x1a], rdx
movabs rdx, 0x6e6f40e1d5db338f
mov qword [rsp + 0x1c], rdx
movabs rdx, 0xa6dce23766337220
mov qword [rsp + 0x24], rdx
movabs rdx, 0x100c070c010e020c
mov qword [rsp + 0x2c], rdx
movabs rdx, 0x5030511100c070c
mov qword [rsp + 0x30], rdx
movabs rdx, 0x401060f05070302
mov qword [rsp + 0x38], rdx
xor eax, eax
jmp 0x4849cd
movzx r9d, byte [rsp + rsi + 0x1a]
sub r9d, edx
lea edx, [r9 - 0x55]
mov byte [rsp + rdi + 0x1a], dl
lea edx, [r8 - 0x55]
mov byte [rsp + rsi + 0x1a], dl
add rax, 2
cmp rax, 0x14
jge 0x4849fa
movzx edx, byte [rsp + rax + 0x2c]
movzx esi, byte [rsp + rax + 0x2d]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x12
jae 0x484a1d
movzx r8d, byte [rsp + rdi + 0x1a]
sub r8d, edx
cmp rsi, 0x12
jb 0x4849b0
jmp 0x484a11
xor eax, eax
lea rbx, [rsp + 0x1a]
mov ecx, 0x12
call fcn.004454c0
add rsp, 0x40
pop rbp
ret
mov eax, esi
mov ecx, 0x12
call fcn.004579c0
mov eax, edi
mov ecx, 0x12
call fcn.004579c0
nop
call fcn.00455760
jmp fcn.00484940
Function at 0x4866a0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x48676c
push rbp
mov rbp, rsp
sub rsp, 0x38
movabs rdx, 0x838381207d6c74a9
mov qword [rsp + 0x1a], rdx
movabs rdx, 0x659996636c878383
mov qword [rsp + 0x20], rdx
movabs rdx, 0x1030a000b030c03
mov qword [rsp + 0x28], rdx
movabs rdx, 0x1080607050a0001
mov qword [rsp + 0x30], rdx
xor eax, eax
jmp 0x48670f
movzx r9d, byte [rsp + rsi + 0x1a]
sub r9d, edx
lea edx, [r9 - 7]
mov byte [rsp + rdi + 0x1a], dl
lea edx, [r8 - 7]
mov byte [rsp + rsi + 0x1a], dl
add rax, 2
cmp rax, 0x10
jge 0x48673c
movzx edx, byte [rsp + rax + 0x28]
movzx esi, byte [rsp + rax + 0x29]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0xe
jae 0x48675f
movzx r8d, byte [rsp + rdi + 0x1a]
sub r8d, edx
cmp rsi, 0xe
jb 0x4866f2
jmp 0x486753
xor eax, eax
lea rbx, [rsp + 0x1a]
mov ecx, 0xe
call fcn.004454c0
add rsp, 0x38
pop rbp
ret
mov eax, esi
mov ecx, 0xe
call fcn.004579c0
mov eax, edi
mov ecx, 0xe
call fcn.004579c0
nop
call fcn.00455760
jmp fcn.004866a0

Function at 0x486860
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x486946
push rbp
mov rbp, rsp
sub rsp, 0x40
movabs rdx, 0x65f184eea5be6fef
mov qword [rsp + 0x18], rdx
movabs rdx, 0xadebb2685bbbff5b
mov qword [rsp + 0x20], rdx
movabs rdx, 0xf0002050a030909
mov qword [rsp + 0x28], rdx
movabs rdx, 0x6090e0606020f04
mov qword [rsp + 0x30], rdx
movabs rdx, 0x80b0f0d0e0e020a
mov qword [rsp + 0x38], rdx
xor eax, eax
nop
jmp 0x4868e0
movzx r9d, byte [rsp + rsi + 0x18]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x54]
mov byte [rsp + rdi + 0x18], dl
mov byte [rsp + rsi + 0x18], r8b
add rax, 2
nop dword [rax]
cmp rax, 0x18
jge 0x486912
movzx edx, byte [rsp + rax + 0x28]
movzx esi, byte [rsp + rax + 0x29]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x10
jae 0x486937
movzx r8d, byte [rsp + rdi + 0x18]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x54]
cmp rsi, 0x10
jb 0x4868c2
jmp 0x48692b
xor eax, eax
lea rbx, [rsp + 0x18]
mov ecx, 0x10
nop
call fcn.004454c0
add rsp, 0x40
pop rbp
ret
mov eax, esi
mov ecx, 0x10
call fcn.004579c0
mov eax, edi
mov ecx, 0x10
nop
call fcn.004579c0
nop
call fcn.00455760
jmp fcn.00486860
Function at 0x486c20
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x486d2c
push rbp
mov rbp, rsp
sub rsp, 0x50
movabs rdx, 0x6f33024b6065700e
mov qword [rsp + 0x1d], rdx
movabs rdx, 0x4b636163520b2037
mov qword [rsp + 0x25], rdx
movabs rdx, 0x554b636163520b20
mov qword [rsp + 0x26], rdx
movabs rdx, 0x3b7337723e6f7240
mov qword [rsp + 0x2e], rdx
movabs rdx, 0x10000c161006180c
mov qword [rsp + 0x36], rdx
movabs rdx, 0xe110d0b050e0306
mov qword [rsp + 0x3e], rdx
movabs rdx, 0xf0d0e110d0b050e
mov qword [rsp + 0x40], rdx
movabs rdx, 0x1408000c11040a0d
mov qword [rsp + 0x48], rdx
xor eax, eax
jmp 0x486cc8
movzx r9d, byte [rsp + rsi + 0x1d]
lea edx, [r9 + rdx]
lea edx, [rdx - 4]
mov byte [rsp + rdi + 0x1d], dl
mov byte [rsp + rsi + 0x1d], r8b
add rax, 2
cmp rax, 0x1a
jge 0x486cfc
movzx edx, byte [rsp + rax + 0x36]
movzx esi, byte [rsp + rax + 0x37]
mov edi, edx
xor edx, esi
add edx, eax
nop
cmp rdi, 0x19
jae 0x486d1f
movzx r8d, byte [rsp + rdi + 0x1d]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 4]
cmp rsi, 0x19
jb 0x486cae
jmp 0x486d13
xor eax, eax
lea rbx, [rsp + 0x1d]
mov ecx, 0x19
call fcn.004454c0
add rsp, 0x50
pop rbp
ret
mov eax, esi
mov ecx, 0x19
call fcn.004579c0
mov eax, edi
mov ecx, 0x19
call fcn.004579c0
nop
call fcn.00455760
jmp fcn.00486c20

Function at 0x4888c0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4889e7
push rbp
mov rbp, rsp
sub rsp, 0x68
movabs rdx, 0x6e359e6faf5f3b02
mov qword [rsp + 0x1d], rdx
movabs rdx, 0x4b4c63657d6e359e
mov qword [rsp + 0x22], rdx
movabs rdx, 0x596465721c047320
mov qword [rsp + 0x2a], rdx
movabs rdx, 0x7c998f77b65c8ca5
mov qword [rsp + 0x32], rdx
movabs rdx, 0x797574848c4a6958
mov qword [rsp + 0x3a], rdx
movabs rdx, 0xb0f230706001703
mov qword [rsp + 0x42], rdx
movabs rdx, 0x20181d1f14000b0f
mov qword [rsp + 0x48], rdx
movabs rdx, 0x211521050c0c0217
mov qword [rsp + 0x50], rdx
movabs rdx, 0x81607190221201a
mov qword [rsp + 0x58], rdx
movabs rdx, 0x1c011b211a181410
mov qword [rsp + 0x60], rdx
xor eax, eax
jmp 0x488989
movzx r9d, byte [rsp + rsi + 0x1d]
sub r9d, edx
lea edx, [r9 + 0x26]
mov byte [rsp + rdi + 0x1d], dl
lea edx, [r8 + 0x26]
mov byte [rsp + rsi + 0x1d], dl
add rax, 2
cmp rax, 0x26
jge 0x4889b7
movzx edx, byte [rsp + rax + 0x42]
movzx esi, byte [rsp + rax + 0x43]
mov edi, edx
xor edx, esi
add edx, eax
nop
cmp rdi, 0x25
jae 0x4889da
movzx r8d, byte [rsp + rdi + 0x1d]
sub r8d, edx
cmp rsi, 0x25
jb 0x48896c
jmp 0x4889ce
xor eax, eax
lea rbx, [rsp + 0x1d]
mov ecx, 0x25
call fcn.004454c0
add rsp, 0x68
pop rbp
ret
mov eax, esi
mov ecx, 0x25
call fcn.004579c0
mov eax, edi
mov ecx, 0x25
call fcn.004579c0
nop
call fcn.00455760
jmp fcn.004888c0
Function at 0x4890e0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x48920c
push rbp
mov rbp, rsp
sub rsp, 0x68
movabs rdx, 0x8b658a9bf0caa194
mov qword [rsp + 0x1d], rdx
movabs rdx, 0x206e50a5976f6974
mov qword [rsp + 0x25], rdx
movabs rdx, 0xc344c7bbf12e5220
mov qword [rsp + 0x2c], rdx
movabs rdx, 0xd3aa6bbba3ecd02d
mov qword [rsp + 0x34], rdx
movabs rdx, 0x121302100c171017
mov qword [rsp + 0x3c], rdx
movabs rdx, 0x141e1316031e191b
mov qword [rsp + 0x44], rdx
movabs rdx, 0x7101e1a141e1316
mov qword [rsp + 0x48], rdx
movabs rdx, 0x1a0001021d18041c
mov qword [rsp + 0x50], rdx
movabs rdx, 0xc0d1b1b15040c0c
mov qword [rsp + 0x58], rdx
movabs rdx, 0xb0b13051d141303
mov qword [rsp + 0x60], rdx
xor eax, eax
jmp 0x4891a6
movzx r9d, byte [rsp + rsi + 0x1d]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x53]
mov byte [rsp + rdi + 0x1d], dl
mov byte [rsp + rsi + 0x1d], r8b
add rax, 2
cmp rax, 0x2c
jge 0x4891dc
movzx edx, byte [rsp + rax + 0x3c]
movzx esi, byte [rsp + rax + 0x3d]
mov edi, edx
xor edx, esi
add edx, eax
nop dword [rax]
cmp rdi, 0x1f
jae 0x4891ff
movzx r8d, byte [rsp + rdi + 0x1d]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x53]
cmp rsi, 0x1f
jb 0x48918c
jmp 0x4891f3
xor eax, eax
lea rbx, [rsp + 0x1d]
mov ecx, 0x1f
call fcn.004454c0
add rsp, 0x68
pop rbp
ret
mov eax, esi
mov ecx, 0x1f
call fcn.004579c0
mov eax, edi
mov ecx, 0x1f
call fcn.004579c0
nop
call fcn.00455760
jmp fcn.004890e0

Function at 0x48a0a0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x48a186
push rbp
mov rbp, rsp
sub rsp, 0x40
movabs rdx, 0xf0d4d0d84dd9406d
mov qword [rsp + 0x1a], rdx
movabs rdx, 0x676e6f6c5d6f9d1a
mov qword [rsp + 0x22], rdx
movabs rdx, 0x5030b09050b0801
mov qword [rsp + 0x2a], rdx
movabs rdx, 0x201010707080503
mov qword [rsp + 0x30], rdx
movabs rdx, 0x805090908070406
mov qword [rsp + 0x38], rdx
xor eax, eax
nop
jmp 0x48a120
movzx r9d, byte [rsp + rsi + 0x1a]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x7d]
mov byte [rsp + rdi + 0x1a], dl
mov byte [rsp + rsi + 0x1a], r8b
add rax, 2
nop dword [rax]
cmp rax, 0x16
jge 0x48a152
movzx edx, byte [rsp + rax + 0x2a]
movzx esi, byte [rsp + rax + 0x2b]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x10
jae 0x48a177
movzx r8d, byte [rsp + rdi + 0x1a]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x7d]
cmp rsi, 0x10
jb 0x48a102
jmp 0x48a16b
xor eax, eax
lea rbx, [rsp + 0x1a]
mov ecx, 0x10
nop
call fcn.004454c0
add rsp, 0x40
pop rbp
ret
mov eax, esi
mov ecx, 0x10
call fcn.004579c0
mov eax, edi
mov ecx, 0x10
nop
call fcn.004579c0
nop
call fcn.00455760
jmp fcn.0048a0a0
Function at 0x48c9c0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x48cabd
push rbp
mov rbp, rsp
sub rsp, 0x48
movabs rdx, 0xc208cdcc76e6163
mov qword [rsp + 0x18], rdx
movabs rdx, 0xa5619dc5c48f0c20
mov qword [rsp + 0x1e], rdx
movabs rdx, 0xa59cb5be5fdaa3a1
mov qword [rsp + 0x26], rdx
movabs rdx, 0x140e091403040712
mov qword [rsp + 0x2e], rdx
movabs rdx, 0xa03050b120d100f
mov qword [rsp + 0x36], rdx
movabs rdx, 0x7080a03050b120d
mov qword [rsp + 0x38], rdx
movabs rdx, 0x30a15040d130f11
mov qword [rsp + 0x40], rdx
xor eax, eax
jmp 0x48ca60
movzx r9d, byte [rsp + rsi + 0x18]
sub r9d, edx
lea edx, [r9 - 0xf]
mov byte [rsp + rdi + 0x18], dl
lea edx, [r8 - 0xf]
mov byte [rsp + rsi + 0x18], dl
add rax, 2
nop dword [rax]
cmp rax, 0x1a
jge 0x48ca8d
movzx edx, byte [rsp + rax + 0x2e]
movzx esi, byte [rsp + rax + 0x2f]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x16
jae 0x48cab0
movzx r8d, byte [rsp + rdi + 0x18]
sub r8d, edx
cmp rsi, 0x16
jb 0x48ca3f
jmp 0x48caa4
xor eax, eax
lea rbx, [rsp + 0x18]
mov ecx, 0x16
call fcn.004454c0
add rsp, 0x48
pop rbp
ret
mov eax, esi
mov ecx, 0x16
call fcn.004579c0
mov eax, edi
mov ecx, 0x16
call fcn.004579c0
nop
nop dword [rax]
call fcn.00455760
jmp fcn.0048c9c0

Function at 0x48cae0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x48cbdb
push rbp
mov rbp, rsp
sub rsp, 0x50
movabs rdx, 0xef1267360c631c70
mov qword [rsp + 0x1d], rdx
movabs rdx, 0x5804d73535ef1267
mov qword [rsp + 0x22], rdx
movabs rdx, 0xea32d96c4274e705
mov qword [rsp + 0x2a], rdx
movabs rdx, 0xe070e120a011403
mov qword [rsp + 0x32], rdx
movabs rdx, 0x120313040a0c0810
mov qword [rsp + 0x3a], rdx
movabs rdx, 0xe0c0d0609121203
mov qword [rsp + 0x40], rdx
movabs rdx, 0x10c010b1406030d
mov qword [rsp + 0x48], rdx
xor eax, eax
jmp 0x48cb79
movzx r9d, byte [rsp + rsi + 0x1d]
lea edx, [r9 + rdx]
lea edx, [rdx + 0xc]
mov byte [rsp + rdi + 0x1d], dl
mov byte [rsp + rsi + 0x1d], r8b
add rax, 2
cmp rax, 0x1e
jge 0x48cbab
movzx edx, byte [rsp + rax + 0x32]
movzx esi, byte [rsp + rax + 0x33]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x15
jae 0x48cbce
movzx r8d, byte [rsp + rdi + 0x1d]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0xc]
cmp rsi, 0x15
jb 0x48cb5f
jmp 0x48cbc2
xor eax, eax
lea rbx, [rsp + 0x1d]
mov ecx, 0x15
call fcn.004454c0
add rsp, 0x50
pop rbp
ret
mov eax, esi
mov ecx, 0x15
call fcn.004579c0
mov eax, edi
mov ecx, 0x15
call fcn.004579c0
nop
nop dword [rax + rax]
call fcn.00455760
jmp fcn.0048cae0