joyce8/EMBER2024-capa huggingface dataset:
Function at 0x47ea60
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x47eb4c
push rbp
mov rbp, rsp
sub rsp, 0x48
movabs rdx, 0xe14030605060005
mov qword [rsp + 0x1b], rdx
movabs rdx, 0x110d120105071101
mov qword [rsp + 0x23], rdx
movabs rdx, 0xe0e111308040114
mov qword [rsp + 0x2b], rdx
movabs rdx, 0x6d83545b77733d80
mov qword [rsp + 0x33], rdx
movabs rdx, 0x6c616e6f646d8354
mov qword [rsp + 0x38], rdx
movabs rdx, 0x3a66454a68614956
mov qword [rsp + 0x40], rdx
xor eax, eax
jmp 0x47eaea
movzx r9d, byte [rsp + rsi + 0x33]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x10]
mov byte [rsp + rdi + 0x33], dl
mov byte [rsp + rsi + 0x33], r8b
add rax, 2
cmp rax, 0x18
jge 0x47eb1c
movzx edx, byte [rsp + rax + 0x1b]
movzx esi, byte [rsp + rax + 0x1c]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x15
jae 0x47eb3f
movzx r8d, byte [rsp + rdi + 0x33]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x10]
cmp rsi, 0x15
jb 0x47ead0
jmp 0x47eb33
xor eax, eax
lea rbx, [rsp + 0x33]
mov ecx, 0x15
call fcn.0044d280
add rsp, 0x48
pop rbp
ret
mov eax, esi
mov ecx, 0x15
call fcn.00462ca0
mov eax, edi
mov ecx, 0x15
call fcn.00462ca0
nop
call fcn.004609c0
jmp fcn.0047ea60

Function at 0x47efe0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x47f092
push rbp
mov rbp, rsp
sub rsp, 0x28
movabs rdx, 0x205050502050406
mov qword [rsp + 0x18], rdx
movabs rdx, 0x694e3d32613f614b
mov qword [rsp + 0x20], rdx
xor eax, eax
jmp 0x47f031
movzx r9d, byte [rsp + rsi + 0x20]
sub r9d, edx
lea edx, [r9 + 0x1c]
mov byte [rsp + rdi + 0x20], dl
lea edx, [r8 + 0x1c]
mov byte [rsp + rsi + 0x20], dl
add rax, 2
cmp rax, 8
jge 0x47f05e
movzx edx, byte [rsp + rax + 0x18]
movzx esi, byte [rsp + rax + 0x19]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 8
jae 0x47f085
movzx r8d, byte [rsp + rdi + 0x20]
sub r8d, edx
cmp rsi, 8
jb 0x47f014
jmp 0x47f075
xor eax, eax
lea rbx, [rsp + 0x20]
mov ecx, 8
call fcn.0044d280
add rsp, 0x28
pop rbp
ret
mov eax, esi
mov ecx, 8
nop dword [rax]
call fcn.00462ca0
mov eax, edi
mov ecx, 8
call fcn.00462ca0
nop
call fcn.004609c0
jmp fcn.0047efe0

Function at 0x47f1a0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x47f266
push rbp
mov rbp, rsp
sub rsp, 0x30
movabs rdx, 0x205080407010201
mov qword [rsp + 0x1b], rdx
mov dword [rsp + 0x23], 0x3070201
movabs rdx, 0xee61dc9f9c1df34b
mov qword [rsp + 0x27], rdx
mov byte [rsp + 0x2f], 0x97
xor eax, eax
nop
jmp 0x47f200
movzx r9d, byte [rsp + rsi + 0x27]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x46]
mov byte [rsp + rdi + 0x27], dl
mov byte [rsp + rsi + 0x27], r8b
add rax, 2
nop dword [rax]
cmp rax, 0xc
jge 0x47f232
movzx edx, byte [rsp + rax + 0x1b]
movzx esi, byte [rsp + rax + 0x1c]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 9
jae 0x47f257
movzx r8d, byte [rsp + rdi + 0x27]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x46]
cmp rsi, 9
jb 0x47f1e2
jmp 0x47f24b
xor eax, eax
lea rbx, [rsp + 0x27]
mov ecx, 9
nop
call fcn.0044d280
add rsp, 0x30
pop rbp
ret
mov eax, esi
mov ecx, 9
call fcn.00462ca0
mov eax, edi
mov ecx, 9
nop
call fcn.00462ca0
nop
call fcn.004609c0
jmp fcn.0047f1a0
Function at 0x47fb40
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x47fc12
push rbp
mov rbp, rsp
sub rsp, 0x38
movabs rdx, 0x20a07040b030804
mov qword [rsp + 0x1d], rdx
movabs rdx, 0x80b0c0a0207020a
mov qword [rsp + 0x23], rdx
movabs rdx, 0x9f6d61b196b3614d
mov qword [rsp + 0x2b], rdx
movabs rdx, 0x928bac6fef9f6d61
mov qword [rsp + 0x30], rdx
xor eax, eax
jmp 0x47fbac
movzx r9d, byte [rsp + rsi + 0x2b]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x34]
mov byte [rsp + rdi + 0x2b], dl
mov byte [rsp + rsi + 0x2b], r8b
add rax, 2
cmp rax, 0xe
jge 0x47fbde
movzx edx, byte [rsp + rax + 0x1d]
movzx esi, byte [rsp + rax + 0x1e]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0xd
jae 0x47fc05
movzx r8d, byte [rsp + rdi + 0x2b]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x34]
cmp rsi, 0xd
jb 0x47fb92
jmp 0x47fbf5
xor eax, eax
lea rbx, [rsp + 0x2b]
mov ecx, 0xd
call fcn.0044d280
add rsp, 0x38
pop rbp
ret
mov eax, esi
mov ecx, 0xd
nop dword [rax]
call fcn.00462ca0
mov eax, edi
mov ecx, 0xd
call fcn.00462ca0
nop
call fcn.004609c0
jmp fcn.0047fb40

Function at 0x482c60
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x482d27
push rbp
mov rbp, rsp
sub rsp, 0x38
movabs rdx, 0xa09020704050307
mov qword [rsp + 0x1c], rdx
movabs rdx, 0x70005050b080602
mov qword [rsp + 0x24], rdx
movabs rdx, 0x59686e5f54566151
mov qword [rsp + 0x2c], rdx
mov dword [rsp + 0x34], 0x6e6c6b68
xor eax, eax
jmp 0x482cc8
movzx r9d, byte [rsp + rsi + 0x2c]
sub r9d, edx
lea edx, [r9 + 0xc]
mov byte [rsp + rdi + 0x2c], dl
lea edx, [r8 + 0xc]
mov byte [rsp + rsi + 0x2c], dl
add rax, 2
cmp rax, 0x10
jge 0x482cf7
movzx edx, byte [rsp + rax + 0x1c]
movzx esi, byte [rsp + rax + 0x1d]
mov edi, edx
xor edx, esi
add edx, eax
nop
cmp rdi, 0xc
jae 0x482d1a
movzx r8d, byte [rsp + rdi + 0x2c]
sub r8d, edx
cmp rsi, 0xc
jb 0x482cab
jmp 0x482d0e
xor eax, eax
lea rbx, [rsp + 0x2c]
mov ecx, 0xc
call fcn.0044d280
add rsp, 0x38
pop rbp
ret
mov eax, esi
mov ecx, 0xc
call fcn.00462ca0
mov eax, edi
mov ecx, 0xc
call fcn.00462ca0
nop
call fcn.004609c0
jmp fcn.00482c60

Function at 0x483580
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x48364c
push rbp
mov rbp, rsp
sub rsp, 0x38
movabs rdx, 0x807010705060001
mov qword [rsp + 0x1d], rdx
movabs rdx, 0x2020603070407
mov qword [rsp + 0x25], rdx
movabs rdx, 0x566413435d50442e
mov qword [rsp + 0x2d], rdx
mov dword [rsp + 0x34], 0x676e2556
xor eax, eax
jmp 0x4835e5
movzx r9d, byte [rsp + rsi + 0x2d]
lea edx, [r9 + rdx]
lea edx, [rdx + 9]
mov byte [rsp + rdi + 0x2d], dl
mov byte [rsp + rsi + 0x2d], r8b
add rax, 2
cmp rax, 0x10
jge 0x48361c
movzx edx, byte [rsp + rax + 0x1d]
movzx esi, byte [rsp + rax + 0x1e]
mov edi, edx
xor edx, esi
add edx, eax
nop dword [rax + rax]
cmp rdi, 0xb
jae 0x48363f
movzx r8d, byte [rsp + rdi + 0x2d]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 9]
cmp rsi, 0xb
jb 0x4835cb
jmp 0x483633
xor eax, eax
lea rbx, [rsp + 0x2d]
mov ecx, 0xb
call fcn.0044d280
add rsp, 0x38
pop rbp
ret
mov eax, esi
mov ecx, 0xb
call fcn.00462ca0
mov eax, edi
mov ecx, 0xb
call fcn.00462ca0
nop
call fcn.004609c0
jmp fcn.00483580
Function at 0x484040
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4840f8
push rbp
mov rbp, rsp
sub rsp, 0x30
movabs rdx, 0x302030704000700
mov qword [rsp + 0x1e], rdx
mov word [rsp + 0x26], 0x707
movabs rdx, 0xa76168febd086163
mov qword [rsp + 0x28], rdx
xor eax, eax
jmp 0x484095
movzx r9d, byte [rsp + rsi + 0x28]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x50]
mov byte [rsp + rdi + 0x28], dl
mov byte [rsp + rsi + 0x28], r8b
add rax, 2
cmp rax, 0xa
jge 0x4840c8
movzx edx, byte [rsp + rax + 0x1e]
movzx esi, byte [rsp + rax + 0x1f]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 8
jae 0x4840eb
movzx r8d, byte [rsp + rdi + 0x28]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x50]
nop
cmp rsi, 8
jb 0x48407b
jmp 0x4840df
xor eax, eax
lea rbx, [rsp + 0x28]
mov ecx, 8
call fcn.0044d280
add rsp, 0x30
pop rbp
ret
mov eax, esi
mov ecx, 8
call fcn.00462ca0
mov eax, edi
mov ecx, 8
call fcn.00462ca0
nop
call fcn.004609c0
nop dword [rax]
jmp fcn.00484040

Function at 0x484360
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x484418
push rbp
mov rbp, rsp
sub rsp, 0x30
movabs rdx, 0x20105010403
mov qword [rsp + 0x1c], rdx
mov dword [rsp + 0x24], 0x7040103
movabs rdx, 0xcf671b222422bbae
mov qword [rsp + 0x28], rdx
xor eax, eax
jmp 0x4843b9
movzx r9d, byte [rsp + rsi + 0x28]
sub r9d, edx
lea edx, [r9 - 0x54]
mov byte [rsp + rdi + 0x28], dl
lea edx, [r8 - 0x54]
mov byte [rsp + rsi + 0x28], dl
add rax, 2
cmp rax, 0xc
jge 0x4843e8
movzx edx, byte [rsp + rax + 0x1c]
movzx esi, byte [rsp + rax + 0x1d]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 8
jae 0x48440b
movzx r8d, byte [rsp + rdi + 0x28]
sub r8d, edx
nop
cmp rsi, 8
jb 0x48439c
jmp 0x4843ff
xor eax, eax
lea rbx, [rsp + 0x28]
mov ecx, 8
call fcn.0044d280
add rsp, 0x30
pop rbp
ret
mov eax, esi
mov ecx, 8
call fcn.00462ca0
mov eax, edi
mov ecx, 8
call fcn.00462ca0
nop
call fcn.004609c0
nop dword [rax]
jmp fcn.00484360

Function at 0x484440
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4844f8
push rbp
mov rbp, rsp
sub rsp, 0x30
movabs rdx, 0x300000103060002
mov qword [rsp + 0x1c], rdx
mov dword [rsp + 0x24], 0x6060106
movabs rdx, 0x63a77469bf0dc204
mov qword [rsp + 0x28], rdx
xor eax, eax
jmp 0x484499
movzx r9d, byte [rsp + rsi + 0x28]
sub r9d, edx
lea edx, [r9 + 0x5f]
mov byte [rsp + rdi + 0x28], dl
lea edx, [r8 + 0x5f]
mov byte [rsp + rsi + 0x28], dl
add rax, 2
cmp rax, 0xc
jge 0x4844c8
movzx edx, byte [rsp + rax + 0x1c]
movzx esi, byte [rsp + rax + 0x1d]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 8
jae 0x4844eb
movzx r8d, byte [rsp + rdi + 0x28]
sub r8d, edx
nop
cmp rsi, 8
jb 0x48447c
jmp 0x4844df
xor eax, eax
lea rbx, [rsp + 0x28]
mov ecx, 8
call fcn.0044d280
add rsp, 0x30
pop rbp
ret
mov eax, esi
mov ecx, 8
call fcn.00462ca0
mov eax, edi
mov ecx, 8
call fcn.00462ca0
nop
call fcn.004609c0
nop dword [rax]
jmp fcn.00484440
Function at 0x484ee0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x484fac
push rbp
mov rbp, rsp
sub rsp, 0x38
movabs rdx, 0x807050602060a02
mov qword [rsp + 0x1e], rdx
movabs rdx, 0x302030b02040807
mov qword [rsp + 0x24], rdx
movabs rdx, 0xa1cfaad29ca96942
mov qword [rsp + 0x2c], rdx
mov dword [rsp + 0x34], 0xc9f4729b
xor eax, eax
jmp 0x484f45
movzx r9d, byte [rsp + rsi + 0x2c]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x42]
mov byte [rsp + rdi + 0x2c], dl
mov byte [rsp + rsi + 0x2c], r8b
add rax, 2
cmp rax, 0xe
jge 0x484f7c
movzx edx, byte [rsp + rax + 0x1e]
movzx esi, byte [rsp + rax + 0x1f]
mov edi, edx
xor edx, esi
add edx, eax
nop dword [rax + rax]
cmp rdi, 0xc
jae 0x484f9f
movzx r8d, byte [rsp + rdi + 0x2c]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x42]
cmp rsi, 0xc
jb 0x484f2b
jmp 0x484f93
xor eax, eax
lea rbx, [rsp + 0x2c]
mov ecx, 0xc
call fcn.0044d280
add rsp, 0x38
pop rbp
ret
mov eax, esi
mov ecx, 0xc
call fcn.00462ca0
mov eax, edi
mov ecx, 0xc
call fcn.00462ca0
nop
call fcn.004609c0
jmp fcn.00484ee0

Function at 0x485e40
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x485f0c
push rbp
mov rbp, rsp
sub rsp, 0x38
movabs rdx, 0x5030602060a0201
mov qword [rsp + 0x1c], rdx
movabs rdx, 0x40204090504030a
mov qword [rsp + 0x24], rdx
movabs rdx, 0x6eb3b66ad89ec84a
mov qword [rsp + 0x2c], rdx
mov dword [rsp + 0x34], 0x6ccba074
xor eax, eax
jmp 0x485ea5
movzx r9d, byte [rsp + rsi + 0x2c]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x32]
mov byte [rsp + rdi + 0x2c], dl
mov byte [rsp + rsi + 0x2c], r8b
add rax, 2
cmp rax, 0x10
jge 0x485edc
movzx edx, byte [rsp + rax + 0x1c]
movzx esi, byte [rsp + rax + 0x1d]
mov edi, edx
xor edx, esi
add edx, eax
nop dword [rax + rax]
cmp rdi, 0xc
jae 0x485eff
movzx r8d, byte [rsp + rdi + 0x2c]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x32]
cmp rsi, 0xc
jb 0x485e8b
jmp 0x485ef3
xor eax, eax
lea rbx, [rsp + 0x2c]
mov ecx, 0xc
call fcn.0044d280
add rsp, 0x38
pop rbp
ret
mov eax, esi
mov ecx, 0xc
call fcn.00462ca0
mov eax, edi
mov ecx, 0xc
call fcn.00462ca0
nop
call fcn.004609c0
jmp fcn.00485e40
Function at 0x486280
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x486388
push rbp
mov rbp, rsp
sub rsp, 0x58
movabs rdx, 0x13050d14130c0805
mov qword [rsp + 0x1f], rdx
movabs rdx, 0xf0413050d14130c
mov qword [rsp + 0x21], rdx
movabs rdx, 0x130716030815130e
mov qword [rsp + 0x29], rdx
movabs rdx, 0x1007011610101304
mov qword [rsp + 0x31], rdx
movabs rdx, 0x51412070a010305
mov qword [rsp + 0x39], rdx
movabs rdx, 0xa172906dbe6e974e
mov qword [rsp + 0x41], rdx
movabs rdx, 0xc19ba2728c74a1a1
mov qword [rsp + 0x48], rdx
movabs rdx, 0xbf8256768a5fa897
mov qword [rsp + 0x50], rdx
xor eax, eax
jmp 0x48632b
movzx r9d, byte [rsp + rsi + 0x41]
sub r9d, edx
lea edx, [r9 + 0xa]
mov byte [rsp + rdi + 0x41], dl
lea edx, [r8 + 0xa]
mov byte [rsp + rsi + 0x41], dl
add rax, 2
cmp rax, 0x22
jge 0x486358
movzx edx, byte [rsp + rax + 0x1f]
movzx esi, byte [rsp + rax + 0x20]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x17
jae 0x48637b
movzx r8d, byte [rsp + rdi + 0x41]
sub r8d, edx
cmp rsi, 0x17
jb 0x48630e
jmp 0x48636f
xor eax, eax
lea rbx, [rsp + 0x41]
mov ecx, 0x17
call fcn.0044d280
add rsp, 0x58
pop rbp
ret
mov eax, esi
mov ecx, 0x17
call fcn.00462ca0
mov eax, edi
mov ecx, 0x17
call fcn.00462ca0
nop
call fcn.004609c0
jmp fcn.00486280

Function at 0x4867c0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4868bd
push rbp
mov rbp, rsp
sub rsp, 0x50
movabs rdx, 0x4111002050e010a
mov qword [rsp + 0x1f], rdx
movabs rdx, 0x1404120904050f09
mov qword [rsp + 0x27], rdx
movabs rdx, 0x1207030e14041209
mov qword [rsp + 0x2b], rdx
movabs rdx, 0xa0f0a100e10040c
mov qword [rsp + 0x33], rdx
movabs rdx, 0xfe477301af8d994f
mov qword [rsp + 0x3b], rdx
movabs rdx, 0x65f17961fe4773
mov qword [rsp + 0x40], rdx
movabs rdx, 0x8b6e0969f024f065
mov qword [rsp + 0x48], rdx
xor eax, eax
jmp 0x486860
movzx r9d, byte [rsp + rsi + 0x3b]
sub r9d, edx
lea edx, [r9 - 0x72]
mov byte [rsp + rdi + 0x3b], dl
lea edx, [r8 - 0x72]
mov byte [rsp + rsi + 0x3b], dl
add rax, 2
nop dword [rax]
cmp rax, 0x1c
jge 0x48688d
movzx edx, byte [rsp + rax + 0x1f]
movzx esi, byte [rsp + rax + 0x20]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x15
jae 0x4868b0
movzx r8d, byte [rsp + rdi + 0x3b]
sub r8d, edx
cmp rsi, 0x15
jb 0x48683f
jmp 0x4868a4
xor eax, eax
lea rbx, [rsp + 0x3b]
mov ecx, 0x15
call fcn.0044d280
add rsp, 0x50
pop rbp
ret
mov eax, esi
mov ecx, 0x15
call fcn.00462ca0
mov eax, edi
mov ecx, 0x15
call fcn.00462ca0
nop
nop dword [rax]
call fcn.004609c0
jmp fcn.004867c0
Function at 0x4872c0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4873aa
push rbp
mov rbp, rsp
sub rsp, 0x48
movabs rdx, 0x70d0d01060f0c0b
mov qword [rsp + 0x1f], rdx
movabs rdx, 0x8040e0e0501070d
mov qword [rsp + 0x25], rdx
movabs rdx, 0x120911010d030507
mov qword [rsp + 0x2d], rdx
movabs rdx, 0x62df5212f74b850
mov qword [rsp + 0x35], rdx
movabs rdx, 0x69462f062df5212f
mov qword [rsp + 0x38], rdx
movabs rdx, 0x4935612b0fa12d1e
mov qword [rsp + 0x40], rdx
xor eax, eax
jmp 0x48734d
movzx r9d, byte [rsp + rsi + 0x35]
sub r9d, edx
lea edx, [r9 + 0x4e]
mov byte [rsp + rdi + 0x35], dl
lea edx, [r8 + 0x4e]
mov byte [rsp + rsi + 0x35], dl
add rax, 2
cmp rax, 0x16
jge 0x48737a
movzx edx, byte [rsp + rax + 0x1f]
movzx esi, byte [rsp + rax + 0x20]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x13
jae 0x48739d
movzx r8d, byte [rsp + rdi + 0x35]
sub r8d, edx
cmp rsi, 0x13
jb 0x487330
jmp 0x487391
xor eax, eax
lea rbx, [rsp + 0x35]
mov ecx, 0x13
call fcn.0044d280
add rsp, 0x48
pop rbp
ret
mov eax, esi
mov ecx, 0x13
call fcn.00462ca0
mov eax, edi
mov ecx, 0x13
call fcn.00462ca0
nop
call fcn.004609c0
jmp fcn.004872c0

Function at 0x487500
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4875d2
push rbp
mov rbp, rsp
sub rsp, 0x38
movabs rdx, 0x10808060c0d0d08
mov qword [rsp + 0x1a], rdx
movabs rdx, 0x2060b0c020b0703
mov qword [rsp + 0x22], rdx
movabs rdx, 0xb4ec7461afe4ab51
mov qword [rsp + 0x2a], rdx
movabs rdx, 0x2ab4dc4d5f2ab4ec
mov qword [rsp + 0x30], rdx
xor eax, eax
jmp 0x48756c
movzx r9d, byte [rsp + rsi + 0x2a]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x4c]
mov byte [rsp + rdi + 0x2a], dl
mov byte [rsp + rsi + 0x2a], r8b
add rax, 2
cmp rax, 0x10
jge 0x48759e
movzx edx, byte [rsp + rax + 0x1a]
movzx esi, byte [rsp + rax + 0x1b]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0xe
jae 0x4875c5
movzx r8d, byte [rsp + rdi + 0x2a]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x4c]
cmp rsi, 0xe
jb 0x487552
jmp 0x4875b5
xor eax, eax
lea rbx, [rsp + 0x2a]
mov ecx, 0xe
call fcn.0044d280
add rsp, 0x38
pop rbp
ret
mov eax, esi
mov ecx, 0xe
nop dword [rax]
call fcn.00462ca0
mov eax, edi
mov ecx, 0xe
call fcn.00462ca0
nop
call fcn.004609c0
jmp fcn.00487500
Function at 0x487660
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x48774c
push rbp
mov rbp, rsp
sub rsp, 0x40
movabs rdx, 0x90c0108030e0c0a
mov qword [rsp + 0x1d], rdx
movabs rdx, 0x204090c0108030e
mov qword [rsp + 0x1f], rdx
movabs rdx, 0x503020b03030b0d
mov qword [rsp + 0x27], rdx
movabs rdx, 0x6563c821c9c1bc53
mov qword [rsp + 0x2f], rdx
movabs rdx, 0xc26563c821c9c1bc
mov qword [rsp + 0x30], rdx
movabs rdx, 0x6c617b1bc9c317cc
mov qword [rsp + 0x38], rdx
xor eax, eax
jmp 0x4876ea
movzx r9d, byte [rsp + rsi + 0x2f]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x6a]
mov byte [rsp + rdi + 0x2f], dl
mov byte [rsp + rsi + 0x2f], r8b
add rax, 2
cmp rax, 0x12
jge 0x48771c
movzx edx, byte [rsp + rax + 0x1d]
movzx esi, byte [rsp + rax + 0x1e]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x11
jae 0x48773f
movzx r8d, byte [rsp + rdi + 0x2f]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x6a]
cmp rsi, 0x11
jb 0x4876d0
jmp 0x487733
xor eax, eax
lea rbx, [rsp + 0x2f]
mov ecx, 0x11
call fcn.0044d280
add rsp, 0x40
pop rbp
ret
mov eax, esi
mov ecx, 0x11
call fcn.00462ca0
mov eax, edi
mov ecx, 0x11
call fcn.00462ca0
nop
call fcn.004609c0
jmp fcn.00487660

Function at 0x487b60
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x487c5b
push rbp
mov rbp, rsp
sub rsp, 0x50
movabs rdx, 0x100604110c0e0405
mov qword [rsp + 0x1e], rdx
movabs rdx, 0x12070b010b040707
mov qword [rsp + 0x26], rdx
movabs rdx, 0xe10011103041207
mov qword [rsp + 0x2c], rdx
movabs rdx, 0xd0a100600091002
mov qword [rsp + 0x34], rdx
movabs rdx, 0xeed128c2a7b3ad84
mov qword [rsp + 0x3c], rdx
movabs rdx, 0xe7a6885feed128c2
mov qword [rsp + 0x40], rdx
movabs rdx, 0x6e9e53d261b4a713
mov qword [rsp + 0x48], rdx
xor eax, eax
jmp 0x487bf9
movzx r9d, byte [rsp + rsi + 0x3c]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x55]
mov byte [rsp + rdi + 0x3c], dl
mov byte [rsp + rsi + 0x3c], r8b
add rax, 2
cmp rax, 0x1e
jge 0x487c2b
movzx edx, byte [rsp + rax + 0x1e]
movzx esi, byte [rsp + rax + 0x1f]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x14
jae 0x487c4e
movzx r8d, byte [rsp + rdi + 0x3c]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x55]
cmp rsi, 0x14
jb 0x487bdf
jmp 0x487c42
xor eax, eax
lea rbx, [rsp + 0x3c]
mov ecx, 0x14
call fcn.0044d280
add rsp, 0x50
pop rbp
ret
mov eax, esi
mov ecx, 0x14
call fcn.00462ca0
mov eax, edi
mov ecx, 0x14
call fcn.00462ca0
nop
nop dword [rax + rax]
call fcn.004609c0
jmp fcn.00487b60
Function at 0x494540
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x49463b
push rbp
mov rbp, rsp
sub rsp, 0x50
movabs rdx, 0x614070a0e020313
mov qword [rsp + 0x1b], rdx
movabs rdx, 0x13110a0201040110
mov qword [rsp + 0x23], rdx
movabs rdx, 0xf06010208051311
mov qword [rsp + 0x29], rdx
movabs rdx, 0xf03091004000810
mov qword [rsp + 0x31], rdx
movabs rdx, 0xe4dc9c686bce35dc
mov qword [rsp + 0x39], rdx
movabs rdx, 0x702e6575b0d4d9e4
mov qword [rsp + 0x40], rdx
movabs rdx, 0x6563c85c72e9e7ea
mov qword [rsp + 0x48], rdx
xor eax, eax
jmp 0x4945d9
movzx r9d, byte [rsp + rsi + 0x39]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x6d]
mov byte [rsp + rdi + 0x39], dl
mov byte [rsp + rsi + 0x39], r8b
add rax, 2
cmp rax, 0x1e
jge 0x49460b
movzx edx, byte [rsp + rax + 0x1b]
movzx esi, byte [rsp + rax + 0x1c]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x17
jae 0x49462e
movzx r8d, byte [rsp + rdi + 0x39]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x6d]
cmp rsi, 0x17
jb 0x4945bf
jmp 0x494622
xor eax, eax
lea rbx, [rsp + 0x39]
mov ecx, 0x17
call fcn.0044d280
add rsp, 0x50
pop rbp
ret
mov eax, esi
mov ecx, 0x17
call fcn.00462ca0
mov eax, edi
mov ecx, 0x17
call fcn.00462ca0
nop
nop dword [rax + rax]
call fcn.004609c0
jmp fcn.00494540

Function at 0x4949e0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x494b2c
push rbp
mov rbp, rsp
sub rsp, 0x78
movabs rdx, 0x141612211100230d
mov qword [rsp + 0x1d], rdx
movabs rdx, 0x101e15080a061416
mov qword [rsp + 0x23], rdx
movabs rdx, 0x1f1e16181b0c2017
mov qword [rsp + 0x2b], rdx
movabs rdx, 0xc201b231d112402
mov qword [rsp + 0x33], rdx
movabs rdx, 0x1211241d0a1d050c
mov qword [rsp + 0x3b], rdx
movabs rdx, 0x11060d00031d071d
mov qword [rsp + 0x43], rdx
movabs rdx, 0xd021a18231b121c
mov qword [rsp + 0x4b], rdx
movabs rdx, 0x5473806f6215655d
mov qword [rsp + 0x53], rdx
movabs rdx, 0xea61874953547380
mov qword [rsp + 0x58], rdx
movabs rdx, 0xbe656e926376202a
mov qword [rsp + 0x60], rdx
movabs rdx, 0x726425645b5b5154
mov qword [rsp + 0x68], rdx
movabs rdx, 0x577a692a3d988092
mov qword [rsp + 0x70], rdx
xor eax, eax
jmp 0x494ac4
movzx r9d, byte [rsp + rsi + 0x53]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x39]
mov byte [rsp + rdi + 0x53], dl
mov byte [rsp + rsi + 0x53], r8b
add rax, 2
cmp rax, 0x36
jge 0x494afc
movzx edx, byte [rsp + rax + 0x1d]
movzx esi, byte [rsp + rax + 0x1e]
mov edi, edx
xor edx, esi
add edx, eax
nop word [rax + rax]
cmp rdi, 0x25
jae 0x494b1f
movzx r8d, byte [rsp + rdi + 0x53]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x39]
cmp rsi, 0x25
jb 0x494aaa
jmp 0x494b13
xor eax, eax
lea rbx, [rsp + 0x53]
mov ecx, 0x25
call fcn.0044d280
add rsp, 0x78
pop rbp
ret
mov eax, esi
mov ecx, 0x25
call fcn.00462ca0
mov eax, edi
mov ecx, 0x25
call fcn.00462ca0
nop
call fcn.004609c0
jmp fcn.004949e0