joyce8/EMBER2024-capa huggingface dataset:
Function at 0x467e20
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x467f1b
push rbp
mov rbp, rsp
sub rsp, 0x48
movabs rdx, 0x6a7d777fad699083
mov qword [rsp + 0x18], rdx
movabs rdx, 0x4bada081505f6a7d
mov qword [rsp + 0x1e], rdx
movabs rdx, 0x679e736d80a98773
mov qword [rsp + 0x26], rdx
movabs rdx, 0x100501140b140c03
mov qword [rsp + 0x2e], rdx
movabs rdx, 0x3040f0c06110a05
mov qword [rsp + 0x36], rdx
movabs rdx, 0x70003040f0c0611
mov qword [rsp + 0x38], rdx
movabs rdx, 0xe14010b110d130e
mov qword [rsp + 0x40], rdx
xor eax, eax
jmp 0x467eb9
movzx r9d, byte [rsp + rsi + 0x18]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x33]
mov byte [rsp + rdi + 0x18], dl
mov byte [rsp + rsi + 0x18], r8b
add rax, 2
cmp rax, 0x1a
jge 0x467eeb
movzx edx, byte [rsp + rax + 0x2e]
movzx esi, byte [rsp + rax + 0x2f]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x16
jae 0x467f0e
movzx r8d, byte [rsp + rdi + 0x18]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x33]
cmp rsi, 0x16
jb 0x467e9f
jmp 0x467f02
xor eax, eax
lea rbx, [rsp + 0x18]
mov ecx, 0x16
call fcn.00444ce0
add rsp, 0x48
pop rbp
ret
mov eax, esi
mov ecx, 0x16
call fcn.00456b60
mov eax, edi
mov ecx, 0x16
call fcn.00456b60
nop
nop dword [rax + rax]
call fcn.004548e0
jmp fcn.00467e20

Function at 0x4680e0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4681a7
push rbp
mov rbp, rsp
sub rsp, 0x30
movabs rdx, 0x4d55473558514b2f
mov qword [rsp + 0x18], rdx
mov word [rsp + 0x20], 0x3c6f
movabs rdx, 0x607020507090004
mov qword [rsp + 0x22], rdx
movabs rdx, 0x805020903010607
mov qword [rsp + 0x28], rdx
xor eax, eax
jmp 0x468147
movzx r9d, byte [rsp + rsi + 0x18]
sub r9d, edx
lea edx, [r9 + 0x1e]
mov byte [rsp + rdi + 0x18], dl
lea edx, [r8 + 0x1e]
mov byte [rsp + rsi + 0x18], dl
add rax, 2
cmp rax, 0xe
jge 0x468177
movzx edx, byte [rsp + rax + 0x22]
movzx esi, byte [rsp + rax + 0x23]
mov edi, edx
xor edx, esi
add edx, eax
nop dword [rax]
cmp rdi, 0xa
jae 0x46819a
movzx r8d, byte [rsp + rdi + 0x18]
sub r8d, edx
cmp rsi, 0xa
jb 0x46812a
jmp 0x46818e
xor eax, eax
lea rbx, [rsp + 0x18]
mov ecx, 0xa
call fcn.00444ce0
add rsp, 0x30
pop rbp
ret
mov eax, esi
mov ecx, 0xa
call fcn.00456b60
mov eax, edi
mov ecx, 0xa
call fcn.00456b60
nop
call fcn.004548e0
jmp fcn.004680e0
Function at 0x4681c0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4682ac
push rbp
mov rbp, rsp
sub rsp, 0x40
movabs rdx, 0x525a666567645968
mov qword [rsp + 0x1b], rdx
movabs rdx, 0x5f525a6665676459
mov qword [rsp + 0x1c], rdx
movabs rdx, 0x403b6c5b6172415e
mov qword [rsp + 0x24], rdx
movabs rdx, 0x606050e00070003
mov qword [rsp + 0x2c], rdx
movabs rdx, 0xf0107100606050e
mov qword [rsp + 0x30], rdx
movabs rdx, 0x7080f0604010d09
mov qword [rsp + 0x38], rdx
xor eax, eax
jmp 0x46824a
movzx r9d, byte [rsp + rsi + 0x1b]
lea edx, [r9 + rdx]
lea edx, [rdx - 0xc]
mov byte [rsp + rdi + 0x1b], dl
mov byte [rsp + rsi + 0x1b], r8b
add rax, 2
cmp rax, 0x14
jge 0x46827c
movzx edx, byte [rsp + rax + 0x2c]
movzx esi, byte [rsp + rax + 0x2d]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x11
jae 0x46829f
movzx r8d, byte [rsp + rdi + 0x1b]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0xc]
cmp rsi, 0x11
jb 0x468230
jmp 0x468293
xor eax, eax
lea rbx, [rsp + 0x1b]
mov ecx, 0x11
call fcn.00444ce0
add rsp, 0x40
pop rbp
ret
mov eax, esi
mov ecx, 0x11
call fcn.00456b60
mov eax, edi
mov ecx, 0x11
call fcn.00456b60
nop
call fcn.004548e0
jmp fcn.004681c0

Function at 0x4697c0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x469887
push rbp
mov rbp, rsp
sub rsp, 0x30
movabs rdx, 0x756b6c75766f756c
mov qword [rsp + 0x18], rdx
mov word [rsp + 0x20], 0x6c5b
movabs rdx, 0x705090103090604
mov qword [rsp + 0x22], rdx
movabs rdx, 0x507070600080705
mov qword [rsp + 0x28], rdx
xor eax, eax
jmp 0x469827
movzx r9d, byte [rsp + rsi + 0x18]
sub r9d, edx
lea edx, [r9 + 5]
mov byte [rsp + rdi + 0x18], dl
lea edx, [r8 + 5]
mov byte [rsp + rsi + 0x18], dl
add rax, 2
cmp rax, 0xe
jge 0x469857
movzx edx, byte [rsp + rax + 0x22]
movzx esi, byte [rsp + rax + 0x23]
mov edi, edx
xor edx, esi
add edx, eax
nop dword [rax]
cmp rdi, 0xa
jae 0x46987a
movzx r8d, byte [rsp + rdi + 0x18]
sub r8d, edx
cmp rsi, 0xa
jb 0x46980a
jmp 0x46986e
xor eax, eax
lea rbx, [rsp + 0x18]
mov ecx, 0xa
call fcn.00444ce0
add rsp, 0x30
pop rbp
ret
mov eax, esi
mov ecx, 0xa
call fcn.00456b60
mov eax, edi
mov ecx, 0xa
call fcn.00456b60
nop
call fcn.004548e0
jmp fcn.004697c0

Function at 0x46b020
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x46b0d8
push rbp
mov rbp, rsp
sub rsp, 0x30
movabs rdx, 0x80e5911d68096900
mov qword [rsp + 0x1e], rdx
movabs rdx, 0x502040506000507
mov qword [rsp + 0x26], rdx
mov word [rsp + 0x2e], 0x702
xor eax, eax
jmp 0x46b078
movzx r9d, byte [rsp + rsi + 0x1e]
sub r9d, edx
lea edx, [r9 + 0x79]
mov byte [rsp + rdi + 0x1e], dl
lea edx, [r8 + 0x79]
mov byte [rsp + rsi + 0x1e], dl
add rax, 2
cmp rax, 0xa
jge 0x46b0a8
movzx edx, byte [rsp + rax + 0x26]
movzx esi, byte [rsp + rax + 0x27]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 8
jae 0x46b0cb
movzx r8d, byte [rsp + rdi + 0x1e]
sub r8d, edx
nop dword [rax]
cmp rsi, 8
jb 0x46b05b
jmp 0x46b0bf
xor eax, eax
lea rbx, [rsp + 0x1e]
mov ecx, 8
call fcn.00444ce0
add rsp, 0x30
pop rbp
ret
mov eax, esi
mov ecx, 8
call fcn.00456b60
mov eax, edi
mov ecx, 8
call fcn.00456b60
nop
call fcn.004548e0
nop dword [rax]
jmp fcn.0046b020
Function at 0x46b8e0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x46b99d
push rbp
mov rbp, rsp
sub rsp, 0x30
movabs rdx, 0x4e6163604a4d5856
mov qword [rsp + 0x26], rdx
mov word [rsp + 0x2e], 0x6535
movabs rdx, 0x8030402010709
mov qword [rsp + 0x1c], rdx
mov word [rsp + 0x24], 0x904
xor eax, eax
jmp 0x46b940
movzx r9d, byte [rsp + rsi + 0x26]
sub r9d, edx
lea edx, [r9 + 0x1d]
mov byte [rsp + rdi + 0x26], dl
lea edx, [r8 + 0x1d]
mov byte [rsp + rsi + 0x26], dl
add rax, 2
nop
cmp rax, 0xa
jge 0x46b96d
movzx edx, byte [rsp + rax + 0x1c]
movzx esi, byte [rsp + rax + 0x1d]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0xa
jae 0x46b990
movzx r8d, byte [rsp + rdi + 0x26]
sub r8d, edx
cmp rsi, 0xa
jb 0x46b922
jmp 0x46b984
xor eax, eax
lea rbx, [rsp + 0x26]
mov ecx, 0xa
call fcn.00444ce0
add rsp, 0x30
pop rbp
ret
mov eax, esi
mov ecx, 0xa
call fcn.00456b60
mov eax, edi
mov ecx, 0xa
call fcn.00456b60
nop
nop dword [rax]
call fcn.004548e0
jmp fcn.0046b8e0

Function at 0x46bec0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x46bfaa
push rbp
mov rbp, rsp
sub rsp, 0x40
movabs rdx, 0x2b6e69423e436c4f
mov qword [rsp + 0x19], rdx
movabs rdx, 0x374e552b6e69423e
mov qword [rsp + 0x1c], rdx
movabs rdx, 0x5d603b137254494f
mov qword [rsp + 0x24], rdx
movabs rdx, 0xa10000f07020908
mov qword [rsp + 0x2c], rdx
movabs rdx, 0x30c0d0a10000f
mov qword [rsp + 0x30], rdx
movabs rdx, 0xa00111203020110
mov qword [rsp + 0x38], rdx
xor eax, eax
jmp 0x46bf4d
movzx r9d, byte [rsp + rsi + 0x19]
sub r9d, edx
lea edx, [r9 + 0x25]
mov byte [rsp + rdi + 0x19], dl
lea edx, [r8 + 0x25]
mov byte [rsp + rsi + 0x19], dl
add rax, 2
cmp rax, 0x14
jge 0x46bf7a
movzx edx, byte [rsp + rax + 0x2c]
movzx esi, byte [rsp + rax + 0x2d]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x13
jae 0x46bf9d
movzx r8d, byte [rsp + rdi + 0x19]
sub r8d, edx
cmp rsi, 0x13
jb 0x46bf30
jmp 0x46bf91
xor eax, eax
lea rbx, [rsp + 0x19]
mov ecx, 0x13
call fcn.00444ce0
add rsp, 0x40
pop rbp
ret
mov eax, esi
mov ecx, 0x13
call fcn.00456b60
mov eax, edi
mov ecx, 0x13
call fcn.00456b60
nop
call fcn.004548e0
jmp fcn.0046bec0
Function at 0x46ef20
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x46f00a
push rbp
mov rbp, rsp
sub rsp, 0x40
movabs rdx, 0x6cebcf696d49d534
mov qword [rsp + 0x2c], rdx
movabs rdx, 0xcccef13d6cebcf69
mov qword [rsp + 0x30], rdx
movabs rdx, 0x6ed26951be7574b1
mov qword [rsp + 0x38], rdx
movabs rdx, 0x210010b0f00080c
mov qword [rsp + 0x18], rdx
movabs rdx, 0x50806100210010b
mov qword [rsp + 0x1c], rdx
movabs rdx, 0x2050f0f09120a0c
mov qword [rsp + 0x24], rdx
xor eax, eax
jmp 0x46efad
movzx r9d, byte [rsp + rsi + 0x2c]
sub r9d, edx
lea edx, [r9 - 0x59]
mov byte [rsp + rdi + 0x2c], dl
lea edx, [r8 - 0x59]
mov byte [rsp + rsi + 0x2c], dl
add rax, 2
cmp rax, 0x14
jge 0x46efda
movzx edx, byte [rsp + rax + 0x18]
movzx esi, byte [rsp + rax + 0x19]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x14
jae 0x46effd
movzx r8d, byte [rsp + rdi + 0x2c]
sub r8d, edx
cmp rsi, 0x14
jb 0x46ef90
jmp 0x46eff1
xor eax, eax
lea rbx, [rsp + 0x2c]
mov ecx, 0x14
call fcn.00444ce0
add rsp, 0x40
pop rbp
ret
mov eax, esi
mov ecx, 0x14
call fcn.00456b60
mov eax, edi
mov ecx, 0x14
call fcn.00456b60
nop
call fcn.004548e0
jmp fcn.0046ef20

Function at 0x46f4c0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x46f57d
push rbp
mov rbp, rsp
sub rsp, 0x30
movabs rdx, 0x97d0cfa899966e49
mov qword [rsp + 0x1d], rdx
mov byte [rsp + 0x25], 0xe6
movabs rdx, 0x604030207080705
mov qword [rsp + 0x26], rdx
mov word [rsp + 0x2e], 0x407
xor eax, eax
nop
jmp 0x46f520
movzx r9d, byte [rsp + rsi + 0x1d]
sub r9d, edx
lea edx, [r9 - 0x2c]
mov byte [rsp + rdi + 0x1d], dl
lea edx, [r8 - 0x2c]
mov byte [rsp + rsi + 0x1d], dl
add rax, 2
nop
cmp rax, 0xa
jge 0x46f54d
movzx edx, byte [rsp + rax + 0x26]
movzx esi, byte [rsp + rax + 0x27]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 9
jae 0x46f570
movzx r8d, byte [rsp + rdi + 0x1d]
sub r8d, edx
cmp rsi, 9
jb 0x46f502
jmp 0x46f564
xor eax, eax
lea rbx, [rsp + 0x1d]
mov ecx, 9
call fcn.00444ce0
add rsp, 0x30
pop rbp
ret
mov eax, esi
mov ecx, 9
call fcn.00456b60
mov eax, edi
mov ecx, 9
call fcn.00456b60
nop
nop dword [rax]
call fcn.004548e0
jmp fcn.0046f4c0
Function at 0x479a40
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x479b0c
push rbp
mov rbp, rsp
sub rsp, 0x38
movabs rdx, 0x4a535c4258533f19
mov qword [rsp + 0x1d], rdx
movabs rdx, 0x27176b4a535c4258
mov qword [rsp + 0x20], rdx
movabs rdx, 0x10402060002020a
mov qword [rsp + 0x28], rdx
movabs rdx, 0x509040106000307
mov qword [rsp + 0x30], rdx
xor eax, eax
jmp 0x479aaf
movzx r9d, byte [rsp + rsi + 0x1d]
sub r9d, edx
lea edx, [r9 + 0x23]
mov byte [rsp + rdi + 0x1d], dl
lea edx, [r8 + 0x23]
mov byte [rsp + rsi + 0x1d], dl
add rax, 2
cmp rax, 0x10
jge 0x479adc
movzx edx, byte [rsp + rax + 0x28]
movzx esi, byte [rsp + rax + 0x29]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0xb
jae 0x479aff
movzx r8d, byte [rsp + rdi + 0x1d]
sub r8d, edx
cmp rsi, 0xb
jb 0x479a92
jmp 0x479af3
xor eax, eax
lea rbx, [rsp + 0x1d]
mov ecx, 0xb
call fcn.00444ce0
add rsp, 0x38
pop rbp
ret
mov eax, esi
mov ecx, 0xb
call fcn.00456b60
mov eax, edi
mov ecx, 0xb
call fcn.00456b60
nop
call fcn.004548e0
jmp fcn.00479a40
Function at 0x47a960
Capabilities:
Encrypt data using rc4 prga

Disassembly:
lea r12, [rsp - 0x78]
cmp r12, qword [r14 + 0x10]
jbe 0x47ab52
push rbp
mov rbp, rsp
sub rsp, 0xf0
movups xmmword [rsp + 0x100], xmm15
movups xmmword [rsp + 0x110], xmm15
movups xmmword [rsp + 0x120], xmm15
movups xmmword [rsp + 0x130], xmm15
movabs rdx, 0xcd6cf357b387ec7
mov qword [rsp + 0x54], rdx
movabs rdx, 0xbc86de5ecb2a894d
mov qword [rsp + 0x5c], rdx
movabs rdx, 0xbdbcc4b75d3b213e
mov qword [rsp + 0x64], rdx
movabs rdx, 0x8ed1121868a627de
mov qword [rsp + 0x6c], rdx
movabs rdx, 0xa4891d3c563a374a
mov qword [rsp + 0x74], rdx
movabs rdx, 0xb38f0f1be68a48c
mov qword [rsp + 0x7c], rdx
movabs rdx, 0x44be14690fafca36
mov qword [rsp + 0x84], rdx
movabs rdx, 0xb00708c51dc6ae19
mov qword [rsp + 0x8c], rdx
movabs rdx, 0x2e052218362e0308
mov qword [rsp + 0x94], rdx
movabs rdx, 0x2d0d2d04361b2b17
mov qword [rsp + 0x9c], rdx
lea rdi, [rsp + 0xa0]
lea rsi, [0x0055faa4]
nop word [rax + rax]
nop dword [rax + rax]
mov qword [rsp - 0x10], rbp
lea rbp, [rsp - 0x10]
call fcn.004571ba
mov rbp, qword [rbp]
xor eax, eax
jmp 0x47aa91
movzx r8d, byte [rsp + rbx + 0x54]
lea edx, [r8 + rdx]
lea edx, [rdx + 0x14]
mov byte [rsp + rsi + 0x54], dl
mov byte [rsp + rbx + 0x54], dil
add rax, 2
cmp rax, 0x5c
jge 0x47aaca
movzx edx, byte [rsp + rax + 0x94]
movzx ebx, byte [rsp + rax + 0x95]
mov esi, edx
xor edx, ebx
add edx, eax
cmp rsi, 0x40
jae 0x47ab45
movzx edi, byte [rsp + rsi + 0x54]
lea edi, [rdi + rdx]
lea edi, [rdi + 0x14]
cmp rbx, 0x40
jb 0x47aa77
jmp 0x47ab35
movups xmmword [rsp + 0x14], xmm15
movups xmmword [rsp + 0x24], xmm15
movups xmmword [rsp + 0x34], xmm15
movups xmmword [rsp + 0x44], xmm15
xor eax, eax
jmp 0x47aaf2
movzx ecx, byte [rsp + rax + 0x54]
mov byte [rsp + rax + 0x14], cl
inc rax
cmp rax, 0x40
jl 0x47aae6
movups xmm0, xmmword [rsp + 0x14]
movups xmmword [rsp + 0x100], xmm0
movups xmm0, xmmword [rsp + 0x24]
movups xmmword [rsp + 0x110], xmm0
movups xmm0, xmmword [rsp + 0x34]
movups xmmword [rsp + 0x120], xmm0
movups xmm0, xmmword [rsp + 0x44]
movups xmmword [rsp + 0x130], xmm0
add rsp, 0xf0
pop rbp
ret
mov eax, ebx
mov ecx, 0x40
nop dword [rax]
call fcn.00456b60
mov eax, esi
mov ecx, 0x40
call fcn.00456b60
nop
call fcn.004548e0
jmp fcn.0047a960
Function at 0x47d7c0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x47d8aa
push rbp
mov rbp, rsp
sub rsp, 0x40
movabs rdx, 0x9e32393032514a57
mov qword [rsp + 0x19], rdx
movabs rdx, 0x479e32393032514a
mov qword [rsp + 0x1a], rdx
movabs rdx, 0x623c65558b443562
mov qword [rsp + 0x22], rdx
movabs rdx, 0xf0f0c000d0b0002
mov qword [rsp + 0x2a], rdx
movabs rdx, 0xe080b0101070f0f
mov qword [rsp + 0x30], rdx
movabs rdx, 0xb0200080910000b
mov qword [rsp + 0x38], rdx
xor eax, eax
jmp 0x47d84d
movzx r9d, byte [rsp + rsi + 0x19]
sub r9d, edx
lea edx, [r9 - 4]
mov byte [rsp + rdi + 0x19], dl
lea edx, [r8 - 4]
mov byte [rsp + rsi + 0x19], dl
add rax, 2
cmp rax, 0x16
jge 0x47d87a
movzx edx, byte [rsp + rax + 0x2a]
movzx esi, byte [rsp + rax + 0x2b]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x11
jae 0x47d89d
movzx r8d, byte [rsp + rdi + 0x19]
sub r8d, edx
cmp rsi, 0x11
jb 0x47d830
jmp 0x47d891
xor eax, eax
lea rbx, [rsp + 0x19]
mov ecx, 0x11
call fcn.00444ce0
add rsp, 0x40
pop rbp
ret
mov eax, esi
mov ecx, 0x11
call fcn.00456b60
mov eax, edi
mov ecx, 0x11
call fcn.00456b60
nop
call fcn.004548e0
jmp fcn.0047d7c0

Function at 0x47db60
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x47dc4a
push rbp
mov rbp, rsp
sub rsp, 0x40
movabs rdx, 0x4e8768327b675c32
mov qword [rsp + 0x1a], rdx
movabs rdx, 0x384e4e8768327b67
mov qword [rsp + 0x1c], rdx
movabs rdx, 0x8b325f3335644b70
mov qword [rsp + 0x24], rdx
movabs rdx, 0x60702020a0a0b08
mov qword [rsp + 0x2c], rdx
movabs rdx, 0x1105030206070202
mov qword [rsp + 0x30], rdx
movabs rdx, 0xc0705050a0f0201
mov qword [rsp + 0x38], rdx
xor eax, eax
jmp 0x47dbed
movzx r9d, byte [rsp + rsi + 0x1a]
sub r9d, edx
lea edx, [r9 - 0x15]
mov byte [rsp + rdi + 0x1a], dl
lea edx, [r8 - 0x15]
mov byte [rsp + rsi + 0x1a], dl
add rax, 2
cmp rax, 0x14
jge 0x47dc1a
movzx edx, byte [rsp + rax + 0x2c]
movzx esi, byte [rsp + rax + 0x2d]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x12
jae 0x47dc3d
movzx r8d, byte [rsp + rdi + 0x1a]
sub r8d, edx
cmp rsi, 0x12
jb 0x47dbd0
jmp 0x47dc31
xor eax, eax
lea rbx, [rsp + 0x1a]
mov ecx, 0x12
call fcn.00444ce0
add rsp, 0x40
pop rbp
ret
mov eax, esi
mov ecx, 0x12
call fcn.00456b60
mov eax, edi
mov ecx, 0x12
call fcn.00456b60
nop
call fcn.004548e0
jmp fcn.0047db60
Function at 0x47fc40
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x47fd5a
push rbp
mov rbp, rsp
sub rsp, 0x58
movabs rdx, 0x35f72ef9ddec29ef
mov qword [rsp + 0x19], rdx
movabs rdx, 0x340d341038261a
mov qword [rsp + 0x21], rdx
movabs rdx, 0xeb35fa05e100340d
mov qword [rsp + 0x26], rdx
movabs rdx, 0xfcf40e33353931fc
mov qword [rsp + 0x2e], rdx
movabs rdx, 0x1a12141c05020b12
mov qword [rsp + 0x36], rdx
movabs rdx, 0x81b1a12141c0502
mov qword [rsp + 0x38], rdx
movabs rdx, 0xd12041012000901
mov qword [rsp + 0x40], rdx
movabs rdx, 0x5060310101c1408
mov qword [rsp + 0x48], rdx
movabs rdx, 0x410150f0b051106
mov qword [rsp + 0x50], rdx
xor eax, eax
jmp 0x47fcf7
movzx r9d, byte [rsp + rsi + 0x19]
lea edx, [r9 + rdx]
lea edx, [rdx - 3]
mov byte [rsp + rdi + 0x19], dl
mov byte [rsp + rsi + 0x19], r8b
add rax, 2
cmp rax, 0x22
jge 0x47fd29
movzx edx, byte [rsp + rax + 0x36]
movzx esi, byte [rsp + rax + 0x37]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x1d
jae 0x47fd4d
movzx r8d, byte [rsp + rdi + 0x19]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 3]
cmp rsi, 0x1d
jb 0x47fcdd
jmp 0x47fd41
xor eax, eax
lea rbx, [rsp + 0x19]
mov ecx, 0x1d
call fcn.00444ce0
add rsp, 0x58
pop rbp
nop
ret
mov eax, esi
mov ecx, 0x1d
call fcn.00456b60
mov eax, edi
mov ecx, 0x1d
call fcn.00456b60
nop
call fcn.004548e0
nop
jmp fcn.0047fc40
Function at 0x480560
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x48068c
push rbp
mov rbp, rsp
sub rsp, 0x68
movabs rdx, 0x783067c4707461cf
mov qword [rsp + 0x1c], rdx
movabs rdx, 0xbe6934c76c30ec80
mov qword [rsp + 0x24], rdx
movabs rdx, 0x393434d9d5926737
mov qword [rsp + 0x2c], rdx
movabs rdx, 0xe8323159d0e79b62
mov qword [rsp + 0x34], rdx
movabs rdx, 0x1f1a000c1b03131a
mov qword [rsp + 0x3c], rdx
movabs rdx, 0x21a090804091402
mov qword [rsp + 0x44], rdx
movabs rdx, 0x180e0407021a0908
mov qword [rsp + 0x48], rdx
movabs rdx, 0x50c0c1907110b1a
mov qword [rsp + 0x50], rdx
movabs rdx, 0x1303001312190f
mov qword [rsp + 0x58], rdx
movabs rdx, 0x102031c1c121912
mov qword [rsp + 0x60], rdx
xor eax, eax
jmp 0x480626
movzx r9d, byte [rsp + rsi + 0x1c]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x5a]
mov byte [rsp + rdi + 0x1c], dl
mov byte [rsp + rsi + 0x1c], r8b
add rax, 2
cmp rax, 0x2c
jge 0x48065c
movzx edx, byte [rsp + rax + 0x3c]
movzx esi, byte [rsp + rax + 0x3d]
mov edi, edx
xor edx, esi
add edx, eax
nop dword [rax]
cmp rdi, 0x20
jae 0x48067f
movzx r8d, byte [rsp + rdi + 0x1c]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x5a]
cmp rsi, 0x20
jb 0x48060c
jmp 0x480673
xor eax, eax
lea rbx, [rsp + 0x1c]
mov ecx, 0x20
call fcn.00444ce0
add rsp, 0x68
pop rbp
ret
mov eax, esi
mov ecx, 0x20
call fcn.00456b60
mov eax, edi
mov ecx, 0x20
call fcn.00456b60
nop
call fcn.004548e0
jmp fcn.00480560
Function at 0x484700
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x484858
push rbp
mov rbp, rsp
sub rsp, 0x78
movabs rdx, 0x33019536330a3638
mov qword [rsp + 0x18], rdx
movabs rdx, 0xa708cae0fe38b4d4
mov qword [rsp + 0x20], rdx
movabs rdx, 0x32e5a708cae0fe38
mov qword [rsp + 0x22], rdx
movabs rdx, 0xe1c0a129f62b3010
mov qword [rsp + 0x2a], rdx
movabs rdx, 0xfaccd533657bd41e
mov qword [rsp + 0x32], rdx
movabs rdx, 0xedb636e934eee736
mov qword [rsp + 0x3a], rdx
movabs rdx, 0x1b0d141119161406
mov qword [rsp + 0x42], rdx
movabs rdx, 0x1e1e0c21211c1b0d
mov qword [rsp + 0x48], rdx
movabs rdx, 0x811021d16291520
mov qword [rsp + 0x50], rdx
movabs rdx, 0x17090e1a181a1b10
mov qword [rsp + 0x58], rdx
movabs rdx, 0x240c110f0e102128
mov qword [rsp + 0x60], rdx
movabs rdx, 0x2311230512151f21
mov qword [rsp + 0x68], rdx
movabs rdx, 0xd17260902260b1b
mov qword [rsp + 0x70], rdx
xor eax, eax
jmp 0x4847f3
movzx r9d, byte [rsp + rsi + 0x18]
lea edx, [r9 + rdx]
lea edx, [rdx - 6]
mov byte [rsp + rdi + 0x18], dl
mov byte [rsp + rsi + 0x18], r8b
add rax, 2
cmp rax, 0x36
jge 0x484828
movzx edx, byte [rsp + rax + 0x42]
movzx esi, byte [rsp + rax + 0x43]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x2a
jae 0x48484b
movzx r8d, byte [rsp + rdi + 0x18]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 6]
nop dword [rax]
cmp rsi, 0x2a
jb 0x4847d9
jmp 0x48483f
xor eax, eax
lea rbx, [rsp + 0x18]
mov ecx, 0x2a
call fcn.00444ce0
add rsp, 0x78
pop rbp
ret
mov eax, esi
mov ecx, 0x2a
call fcn.00456b60
mov eax, edi
mov ecx, 0x2a
call fcn.00456b60
nop
call fcn.004548e0
nop dword [rax]
jmp fcn.00484700

Function at 0x485ca0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x485dec
push rbp
mov rbp, rsp
sub rsp, 0x78
movabs rdx, 0x3a766e6f63728f73
mov qword [rsp + 0x1f], rdx
movabs rdx, 0xab795d7590134689
mov qword [rsp + 0x27], rdx
movabs rdx, 0x20ab795d75901346
mov qword [rsp + 0x28], rdx
movabs rdx, 0x8f4d644065537027
mov qword [rsp + 0x30], rdx
movabs rdx, 0x28075e725f462f82
mov qword [rsp + 0x38], rdx
movabs rdx, 0x68588321477a6e6d
mov qword [rsp + 0x40], rdx
movabs rdx, 0x813190b250a2109
mov qword [rsp + 0x48], rdx
movabs rdx, 0x1c1823281e241c01
mov qword [rsp + 0x50], rdx
movabs rdx, 0xc0e20110d230f1c
mov qword [rsp + 0x58], rdx
movabs rdx, 0x2515211c27261319
mov qword [rsp + 0x60], rdx
movabs rdx, 0x2420210a011e2615
mov qword [rsp + 0x68], rdx
movabs rdx, 0x1f08240a23271717
mov qword [rsp + 0x70], rdx
xor eax, eax
jmp 0x485d84
movzx r9d, byte [rsp + rsi + 0x1f]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x2c]
mov byte [rsp + rdi + 0x1f], dl
mov byte [rsp + rsi + 0x1f], r8b
add rax, 2
cmp rax, 0x30
jge 0x485dbc
movzx edx, byte [rsp + rax + 0x48]
movzx esi, byte [rsp + rax + 0x49]
mov edi, edx
xor edx, esi
add edx, eax
nop word [rax + rax]
cmp rdi, 0x29
jae 0x485ddf
movzx r8d, byte [rsp + rdi + 0x1f]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x2c]
cmp rsi, 0x29
jb 0x485d6a
jmp 0x485dd3
xor eax, eax
lea rbx, [rsp + 0x1f]
mov ecx, 0x29
call fcn.00444ce0
add rsp, 0x78
pop rbp
ret
mov eax, esi
mov ecx, 0x29
call fcn.00456b60
mov eax, edi
mov ecx, 0x29
call fcn.00456b60
nop
call fcn.004548e0
jmp fcn.00485ca0
Function at 0x48b1c0
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x48b28a
push rbp
mov rbp, rsp
sub rsp, 0x48
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x58], rax
mov qword [rsp], rax
mov qword [rsp + 8], rbx
mov byte [rsp + 0x10], 0
call fcn.00403420
xorps xmm15, xmm15
mov r14, qword [0x006447e0]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x18], 0xffffffffffffffff
jne 0x48b26f
mov rcx, qword [rsp + 0x60]
lea rdx, [rcx + 1]
mov qword [rsp + 0x40], rdx
lea rax, [0x005196c0]
xor ebx, ebx
mov rcx, rdx
call fcn.00441820
mov rbx, qword [rsp + 0x60]
mov rcx, rax
xor edi, edi
mov rsi, qword [rsp + 0x40]
mov rax, qword [rsp + 0x58]
nop dword [rax]
call fcn.0048dd20
inc rbx
cmp rcx, rbx
jae 0x48b25e
mov edi, 1
lea rsi, [0x005196c0]
call fcn.00441900
mov word [rax + rbx*2 - 2], 0
xor edi, edi
xor esi, esi
add rsp, 0x48
pop rbp
ret
xor eax, eax
xor ebx, ebx
mov rcx, rbx
lea rdi, [0x0055d598]
lea rsi, [0x0055d1a8]
add rsp, 0x48
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.004548e0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.0048b1c0

Function at 0x48bb80
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x48bc5d
push rbp
mov rbp, rsp
sub rsp, 0x40
movabs rdx, 0x50654f5f5c744150
mov qword [rsp + 0x18], rdx
movabs rdx, 0x57453d66576e521a
mov qword [rsp + 0x20], rdx
movabs rdx, 0xd040800090f010f
mov qword [rsp + 0x28], rdx
movabs rdx, 0x50c040900010405
mov qword [rsp + 0x30], rdx
movabs rdx, 0xb00080903010d0f
mov qword [rsp + 0x38], rdx
xor eax, eax
nop
jmp 0x48bc00
movzx r9d, byte [rsp + rsi + 0x18]
sub r9d, edx
lea edx, [r9 + 0x1d]
mov byte [rsp + rdi + 0x18], dl
lea edx, [r8 + 0x1d]
mov byte [rsp + rsi + 0x18], dl
add rax, 2
nop
cmp rax, 0x18
jge 0x48bc2d
movzx edx, byte [rsp + rax + 0x28]
movzx esi, byte [rsp + rax + 0x29]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x10
jae 0x48bc50
movzx r8d, byte [rsp + rdi + 0x18]
sub r8d, edx
cmp rsi, 0x10
jb 0x48bbe2
jmp 0x48bc44
xor eax, eax
lea rbx, [rsp + 0x18]
mov ecx, 0x10
call fcn.00444ce0
add rsp, 0x40
pop rbp
ret
mov eax, esi
mov ecx, 0x10
call fcn.00456b60
mov eax, edi
mov ecx, 0x10
call fcn.00456b60
nop
nop dword [rax]
call fcn.004548e0
jmp fcn.0048bb80