joyce8/EMBER2024-capa huggingface dataset:
Function at 0x498c80
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x498d48
sub rsp, 0x38
mov qword [rsp + 0x30], rbp
lea rbp, [rsp + 0x30]
movabs rdx, 0x65762e23303cec5a
mov qword [rsp + 0x1d], rdx
mov byte [rsp + 0x25], 0xfd
movabs rdx, 0x1060308040406
mov qword [rsp + 0x26], rdx
mov word [rsp + 0x2e], 0x106
xor eax, eax
jmp 0x498ce3
movzx r9d, byte [rsp + rsi + 0x1d]
sub r9d, edx
lea edx, [r9 - 0x7c]
mov byte [rsp + rdi + 0x1d], dl
lea edx, [r8 - 0x7c]
mov byte [rsp + rsi + 0x1d], dl
add rax, 2
cmp rax, 0xa
jge 0x498d10
movzx edx, byte [rsp + rax + 0x26]
movzx esi, byte [rsp + rax + 0x27]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 9
jae 0x498d3b
movzx r8d, byte [rsp + rdi + 0x1d]
sub r8d, edx
cmp rsi, 9
jb 0x498cc6
jmp 0x498d2f
xor eax, eax
lea rbx, [rsp + 0x1d]
mov ecx, 9
nop dword [rax]
call fcn.00441e20
mov rbp, qword [rsp + 0x30]
add rsp, 0x38
ret
mov eax, esi
mov ecx, 9
call fcn.00453d80
mov eax, edi
mov ecx, 9
call fcn.00453d80
nop
call fcn.00451720
jmp fcn.00498c80

Function at 0x499aa0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
lea r12, [rsp - 0x48]
cmp r12, qword [r14 + 0x10]
jbe 0x499c26
sub rsp, 0xc8
mov qword [rsp + 0xc0], rbp
lea rbp, [rsp + 0xc0]
movabs rdx, 0x304667054919614f
mov qword [rsp + 0x1d], rdx
movabs rdx, 0x68614e53c58d4552
mov qword [rsp + 0x25], rdx
movabs rdx, 0x836946f86c68614e
mov qword [rsp + 0x2a], rdx
movabs rdx, 0x9d04f220370f615a
mov qword [rsp + 0x32], rdx
movabs rdx, 0x684220fb6f44153a
mov qword [rsp + 0x3a], rdx
movabs rdx, 0xa73506f4ed25261
mov qword [rsp + 0x42], rdx
movabs rdx, 0xa01731682008f456
mov qword [rsp + 0x4a], rdx
movabs rdx, 0x4273738a1f6e6120
mov qword [rsp + 0x52], rdx
movabs rdx, 0x6df63b7e74d65afb
mov qword [rsp + 0x5a], rdx
movabs rdx, 0x65756cfa9ce5f461
mov qword [rsp + 0x62], rdx
movabs rdx, 0x39261838211c0a1c
mov qword [rsp + 0x6a], rdx
lea rdi, [rsp + 0x70]
lea rsi, [0x0055565a]
nop word [rax + rax]
mov qword [rsp - 0x10], rbp
lea rbp, [rsp - 0x10]
call fcn.0045439a
mov rbp, qword [rbp]
xor eax, eax
jmp 0x499bb1
movzx r9d, byte [rsp + rsi + 0x1d]
add r9d, 0xffffffc5
add edx, r9d
mov byte [rsp + rdi + 0x1d], dl
mov byte [rsp + rsi + 0x1d], r8b
add rax, 2
cmp rax, 0x56
jge 0x499be8
movzx edx, byte [rsp + rax + 0x6a]
movzx esi, byte [rsp + rax + 0x6b]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x4d
jae 0x499c15
movzx r8d, byte [rsp + rdi + 0x1d]
add r8d, 0xffffffc5
add r8d, edx
nop word [rax + rax]
cmp rsi, 0x4d
jb 0x499b97
jmp 0x499c09
xor eax, eax
lea rbx, [rsp + 0x1d]
mov ecx, 0x4d
call fcn.00441e20
mov rbp, qword [rsp + 0xc0]
add rsp, 0xc8
ret
mov eax, esi
mov ecx, 0x4d
call fcn.00453d80
mov eax, edi
mov ecx, 0x4d
nop dword [rax]
call fcn.00453d80
nop
call fcn.00451720
jmp fcn.00499aa0
Function at 0x49a260
Capabilities:
Encrypt data using rc4 prga

Disassembly:
lea r12, [rsp - 8]
cmp r12, qword [r14 + 0x10]
jbe 0x49a3e6
sub rsp, 0x88
mov qword [rsp + 0x80], rbp
lea rbp, [rsp + 0x80]
movabs rdx, 0x673e62740846611b
mov qword [rsp + 0x1c], rdx
movabs rdx, 0x5ace1f105376871b
mov qword [rsp + 0x24], rdx
movabs rdx, 0x47f85ace1f105376
mov qword [rsp + 0x26], rdx
movabs rdx, 0x456c51013e1f644e
mov qword [rsp + 0x2e], rdx
movabs rdx, 0x23b14b251c75614b
mov qword [rsp + 0x36], rdx
movabs rdx, 0x333b1e61ee290459
mov qword [rsp + 0x3e], rdx
movabs rdx, 0x90b12030d140817
mov qword [rsp + 0x46], rdx
movabs rdx, 0x1518020a1025120f
mov qword [rsp + 0x4e], rdx
movabs rdx, 0x18271518020a1025
mov qword [rsp + 0x50], rdx
movabs rdx, 0xc181e1505190a07
mov qword [rsp + 0x58], rdx
movabs rdx, 0x5290515280e0024
mov qword [rsp + 0x60], rdx
movabs rdx, 0x1f06222820181028
mov qword [rsp + 0x68], rdx
movabs rdx, 0x111a24211009210f
mov qword [rsp + 0x70], rdx
movabs rdx, 0x1d25071823210716
mov qword [rsp + 0x78], rdx
xor eax, eax
jmp 0x49a376
movzx r9d, byte [rsp + rsi + 0x1c]
add r9d, 0xffffffe6
add edx, r9d
mov byte [rsp + rdi + 0x1c], dl
mov byte [rsp + rsi + 0x1c], r8b
add rax, 2
cmp rax, 0x3a
jge 0x49a3a8
movzx edx, byte [rsp + rax + 0x46]
movzx esi, byte [rsp + rax + 0x47]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x2a
jae 0x49a3d5
movzx r8d, byte [rsp + rdi + 0x1c]
add r8d, 0xffffffe6
add r8d, edx
nop
cmp rsi, 0x2a
jb 0x49a35c
jmp 0x49a3c9
xor eax, eax
lea rbx, [rsp + 0x1c]
mov ecx, 0x2a
call fcn.00441e20
mov rbp, qword [rsp + 0x80]
add rsp, 0x88
ret
mov eax, esi
mov ecx, 0x2a
call fcn.00453d80
mov eax, edi
mov ecx, 0x2a
nop dword [rax]
call fcn.00453d80
nop
call fcn.00451720
jmp fcn.0049a260

Function at 0x49ae40
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x49af53
sub rsp, 0x58
mov qword [rsp + 0x50], rbp
lea rbp, [rsp + 0x50]
movabs rdx, 0xc0bab020656d4bf0
mov qword [rsp + 0x19], rdx
movabs rdx, 0x69acfc57c756ba6a
mov qword [rsp + 0x21], rdx
movabs rdx, 0xb369acfc57c756ba
mov qword [rsp + 0x22], rdx
movabs rdx, 0xe865cf83c24fa63c
mov qword [rsp + 0x2a], rdx
movabs rdx, 0x141605180d130b07
mov qword [rsp + 0x32], rdx
movabs rdx, 0xc120d0107081306
mov qword [rsp + 0x3a], rdx
movabs rdx, 0x10d0e0c09010c12
mov qword [rsp + 0x40], rdx
movabs rdx, 0xa15010501001610
mov qword [rsp + 0x48], rdx
xor eax, eax
jmp 0x49aeee
movzx r9d, byte [rsp + rsi + 0x19]
add r9d, 0xffffff9d
add edx, r9d
mov byte [rsp + rdi + 0x19], dl
mov byte [rsp + rsi + 0x19], r8b
add rax, 2
cmp rax, 0x1e
jge 0x49af1f
movzx edx, byte [rsp + rax + 0x32]
movzx esi, byte [rsp + rax + 0x33]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x19
jae 0x49af46
movzx r8d, byte [rsp + rdi + 0x19]
add r8d, 0xffffff9d
add r8d, edx
cmp rsi, 0x19
jb 0x49aed4
jmp 0x49af3a
xor eax, eax
lea rbx, [rsp + 0x19]
mov ecx, 0x19
call fcn.00441e20
mov rbp, qword [rsp + 0x50]
add rsp, 0x58
ret
mov eax, esi
mov ecx, 0x19
call fcn.00453d80
mov eax, edi
mov ecx, 0x19
call fcn.00453d80
nop
call fcn.00451720
jmp fcn.0049ae40
Function at 0x49c360
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x49c473
sub rsp, 0x60
mov qword [rsp + 0x58], rbp
lea rbp, [rsp + 0x58]
movabs rdx, 0x79f7ec20dde561eb
mov qword [rsp + 0x1e], rdx
movabs rdx, 0xece3e9052ddf68f0
mov qword [rsp + 0x26], rdx
movabs rdx, 0xb8ea63ebece3e905
mov qword [rsp + 0x2a], rdx
movabs rdx, 0xf769edd9b12e7655
mov qword [rsp + 0x32], rdx
movabs rdx, 0xd171b0817071414
mov qword [rsp + 0x3a], rdx
movabs rdx, 0x1008060913140219
mov qword [rsp + 0x42], rdx
movabs rdx, 0x31810060c0c1008
mov qword [rsp + 0x48], rdx
movabs rdx, 0xe0f00120e1a050a
mov qword [rsp + 0x50], rdx
xor eax, eax
jmp 0x49c40e
movzx r9d, byte [rsp + rsi + 0x1e]
add r9d, 0x5d
add edx, r9d
mov byte [rsp + rdi + 0x1e], dl
mov byte [rsp + rsi + 0x1e], r8b
add rax, 2
cmp rax, 0x1e
jge 0x49c43f
movzx edx, byte [rsp + rax + 0x3a]
movzx esi, byte [rsp + rax + 0x3b]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x1c
jae 0x49c466
movzx r8d, byte [rsp + rdi + 0x1e]
add r8d, 0x5d
add r8d, edx
cmp rsi, 0x1c
jb 0x49c3f4
jmp 0x49c45a
xor eax, eax
lea rbx, [rsp + 0x1e]
mov ecx, 0x1c
call fcn.00441e20
mov rbp, qword [rsp + 0x58]
add rsp, 0x60
ret
mov eax, esi
mov ecx, 0x1c
call fcn.00453d80
mov eax, edi
mov ecx, 0x1c
call fcn.00453d80
nop
call fcn.00451720
jmp fcn.0049c360
Function at 0x4a0080
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4a0295
sub rsp, 0x50
mov qword [rsp + 0x48], rbp
lea rbp, [rsp + 0x48]
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x68], rcx
mov qword [rsp + 0x58], rax
add qword [rax + 0x58], rcx
mov rdx, qword [rax + 0x50]
test rdx, rdx
jle 0x4a01ad
nop dword [rax + rax]
cmp rdx, 0x40
ja 0x4a0287
mov qword [rsp + 0x70], rdi
mov qword [rsp + 0x60], rbx
lea rsi, [rdx - 0x40]
mov r8, rsi
neg rsi
cmp rcx, rsi
cmovl rsi, rcx
mov qword [rsp + 0x28], rsi
sar r8, 0x3f
and r8, rdx
lea rdx, [r8 + 0x10]
add rdx, rax
cmp rbx, rdx
je 0x4a0121
mov rax, rdx
mov rcx, rsi
call fcn.00454700
mov rax, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x68]
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x28]
mov rdi, qword [rsp + 0x70]
mov rdx, qword [rax + 0x50]
add rdx, rsi
mov qword [rax + 0x50], rdx
cmp rdx, 0x40
jne 0x4a0189
mov qword [rsp], rax
lea rcx, [rax + 0x10]
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], 0x40
mov qword [rsp + 0x18], 0x40
call fcn.004a05e0
xorps xmm15, xmm15
mov r14, qword [0x00639228]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x58]
mov qword [rax + 0x50], 0
mov rcx, qword [rsp + 0x68]
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x28]
mov rdi, qword [rsp + 0x70]
cmp rcx, rsi
jb 0x4a027f
sub rdi, rsi
mov rdx, rcx
sub rcx, rsi
mov r8, rdi
neg rdi
sar rdi, 0x3f
and rsi, rdi
add rbx, rsi
jmp 0x4a01b3
mov rdx, rcx
mov r8, rdi
cmp rcx, 0x40
jl 0x4a0230
mov qword [rsp + 0x38], r8
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x40], rbx
mov qword [rsp], rax
mov qword [rsp + 8], rbx
and rcx, 0xffffffffffffffc0
mov qword [rsp + 0x20], rcx
mov qword [rsp + 0x10], rcx
mov qword [rsp + 0x18], r8
call fcn.004a05e0
xorps xmm15, xmm15
mov r14, qword [0x00639228]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x20]
mov rcx, qword [rsp + 0x38]
mov rdx, rax
sub rax, rcx
sar rax, 0x3f
mov rcx, qword [rsp + 0x30]
and rax, rcx
and rax, 0xffffffffffffffc0
mov rbx, qword [rsp + 0x40]
add rbx, rax
sub rcx, rdx
mov rax, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x68]
test rcx, rcx
je 0x4a026e
cmp rcx, 0x40
mov esi, 0x40
cmovl rsi, rcx
lea rdi, [rax + 0x10]
cmp rbx, rdi
je 0x4a026a
mov qword [rsp + 0x38], rsi
mov rax, rdi
mov rcx, rsi
call fcn.00454700
mov rax, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x38]
mov qword [rax + 0x50], rsi
mov rax, rdx
xor ebx, ebx
xor ecx, ecx
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
mov rax, rsi
call fcn.00453e40
mov rax, rdx
mov ecx, 0x40
call fcn.00453e40
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
call fcn.00451720
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
jmp fcn.004a0080
Function at 0x4a0500
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4a05c8
sub rsp, 0x38
mov qword [rsp + 0x30], rbp
lea rbp, [rsp + 0x30]
movabs rdx, 0xb0cb3aef787b2ef4
mov qword [rsp + 0x1b], rdx
mov byte [rsp + 0x23], 0x30
movabs rdx, 0x700040400070205
mov qword [rsp + 0x24], rdx
mov dword [rsp + 0x2c], 0x5060605
xor eax, eax
jmp 0x4a0561
movzx r9d, byte [rsp + rsi + 0x1b]
add r9d, 0x2d
add edx, r9d
mov byte [rsp + rdi + 0x1b], dl
mov byte [rsp + rsi + 0x1b], r8b
add rax, 2
cmp rax, 0xc
jge 0x4a0592
movzx edx, byte [rsp + rax + 0x24]
movzx esi, byte [rsp + rax + 0x25]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 9
jae 0x4a05bb
movzx r8d, byte [rsp + rdi + 0x1b]
add r8d, 0x2d
add r8d, edx
cmp rsi, 9
jb 0x4a0547
jmp 0x4a05af
xor eax, eax
lea rbx, [rsp + 0x1b]
mov ecx, 9
nop
call fcn.00441e20
mov rbp, qword [rsp + 0x30]
add rsp, 0x38
ret
mov eax, esi
mov ecx, 9
call fcn.00453d80
mov eax, edi
mov ecx, 9
call fcn.00453d80
nop
call fcn.00451720
jmp fcn.004a0500

Function at 0x4a7d60
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4a7e68
sub rsp, 0x58
mov qword [rsp + 0x50], rbp
lea rbp, [rsp + 0x50]
movabs rdx, 0xff00a874816fab66
mov qword [rsp + 0x18], rdx
movabs rdx, 0x65667c6669d670a5
mov qword [rsp + 0x20], rdx
movabs rdx, 0x6eee057470d09a0d
mov qword [rsp + 0x28], rdx
movabs rdx, 0x120816100c0a0a03
mov qword [rsp + 0x30], rdx
movabs rdx, 0xa050c1105120e0d
mov qword [rsp + 0x38], rdx
movabs rdx, 0x1080d0c0c120c16
mov qword [rsp + 0x40], rdx
movabs rdx, 0x10e0d0a11071506
mov qword [rsp + 0x48], rdx
xor eax, eax
jmp 0x4a7e02
movzx r9d, byte [rsp + rsi + 0x18]
sub r9d, edx
lea edx, [r9 - 0x6c]
mov byte [rsp + rdi + 0x18], dl
lea edx, [r8 - 0x6c]
mov byte [rsp + rsi + 0x18], dl
add rax, 2
cmp rax, 0x20
jge 0x4a7e2f
movzx edx, byte [rsp + rax + 0x30]
movzx esi, byte [rsp + rax + 0x31]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x18
jae 0x4a7e5b
movzx r8d, byte [rsp + rdi + 0x18]
sub r8d, edx
cmp rsi, 0x18
jb 0x4a7de5
jmp 0x4a7e4f
xor eax, eax
lea rbx, [rsp + 0x18]
mov ecx, 0x18
nop dword [rax + rax]
call fcn.00441e20
mov rbp, qword [rsp + 0x50]
add rsp, 0x58
ret
mov eax, esi
mov ecx, 0x18
call fcn.00453d80
mov eax, edi
mov ecx, 0x18
call fcn.00453d80
nop
call fcn.00451720
jmp fcn.004a7d60
Function at 0x4aa0e0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4aa1f3
sub rsp, 0x60
mov qword [rsp + 0x58], rbp
lea rbp, [rsp + 0x58]
movabs rdx, 0x716372c615e6bb79
mov qword [rsp + 0x38], rdx
movabs rdx, 0xbdc86fb0cdb07420
mov qword [rsp + 0x40], rdx
movabs rdx, 0x61d4adb6ff6c2e72
mov qword [rsp + 0x48], rdx
movabs rdx, 0x65cc621db6690076
mov qword [rsp + 0x50], rdx
movabs rdx, 0x161e1e1111130200
mov qword [rsp + 0x18], rdx
movabs rdx, 0x160f1c1302191607
mov qword [rsp + 0x20], rdx
movabs rdx, 0xb0e190a13040f15
mov qword [rsp + 0x28], rdx
movabs rdx, 0xc011514021b1403
mov qword [rsp + 0x30], rdx
xor eax, eax
jmp 0x4aa18e
movzx r9d, byte [rsp + rsi + 0x38]
add r9d, 0xffffff8a
add edx, r9d
mov byte [rsp + rdi + 0x38], dl
mov byte [rsp + rsi + 0x38], r8b
add rax, 2
cmp rax, 0x20
jge 0x4aa1bf
movzx edx, byte [rsp + rax + 0x18]
movzx esi, byte [rsp + rax + 0x19]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x20
jae 0x4aa1e6
movzx r8d, byte [rsp + rdi + 0x38]
add r8d, 0xffffff8a
add r8d, edx
cmp rsi, 0x20
jb 0x4aa174
jmp 0x4aa1da
xor eax, eax
lea rbx, [rsp + 0x38]
mov ecx, 0x20
call fcn.00441e20
mov rbp, qword [rsp + 0x58]
add rsp, 0x60
ret
mov eax, esi
mov ecx, 0x20
call fcn.00453d80
mov eax, edi
mov ecx, 0x20
call fcn.00453d80
nop
call fcn.00451720
jmp fcn.004aa0e0
Function at 0x4aa9a0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4aaaa8
sub rsp, 0x50
mov qword [rsp + 0x48], rbp
lea rbp, [rsp + 0x48]
movabs rdx, 0xa18a697a89648d6a
mov qword [rsp + 0x1b], rdx
movabs rdx, 0x656320a18a697a89
mov qword [rsp + 0x1e], rdx
movabs rdx, 0x336f8b706381a9b2
mov qword [rsp + 0x26], rdx
movabs rdx, 0x40e0e0c12120901
mov qword [rsp + 0x2e], rdx
movabs rdx, 0x12030e10070e
mov qword [rsp + 0x36], rdx
movabs rdx, 0x60b000012030e10
mov qword [rsp + 0x38], rdx
movabs rdx, 0x40d060906060604
mov qword [rsp + 0x40], rdx
xor eax, eax
jmp 0x4aaa42
movzx r9d, byte [rsp + rsi + 0x1b]
sub r9d, edx
lea edx, [r9 + 6]
mov byte [rsp + rdi + 0x1b], dl
lea edx, [r8 + 6]
mov byte [rsp + rsi + 0x1b], dl
add rax, 2
cmp rax, 0x1a
jge 0x4aaa6f
movzx edx, byte [rsp + rax + 0x2e]
movzx esi, byte [rsp + rax + 0x2f]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x13
jae 0x4aaa9b
movzx r8d, byte [rsp + rdi + 0x1b]
sub r8d, edx
cmp rsi, 0x13
jb 0x4aaa25
jmp 0x4aaa8f
xor eax, eax
lea rbx, [rsp + 0x1b]
mov ecx, 0x13
nop dword [rax + rax]
call fcn.00441e20
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
mov eax, esi
mov ecx, 0x13
call fcn.00453d80
mov eax, edi
mov ecx, 0x13
call fcn.00453d80
nop
call fcn.00451720
jmp fcn.004aa9a0

Function at 0x4aaf00
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4aafdc
sub rsp, 0x40
mov qword [rsp + 0x38], rbp
lea rbp, [rsp + 0x38]
movabs rdx, 0x4b165b1c564610f
mov qword [rsp + 0x1f], rdx
movabs rdx, 0x89bcb304b165b1c5
mov qword [rsp + 0x22], rdx
movabs rdx, 0xa00060309060007
mov qword [rsp + 0x2a], rdx
movabs rdx, 0x708070400040a00
mov qword [rsp + 0x30], rdx
xor eax, eax
jmp 0x4aaf72
movzx r9d, byte [rsp + rsi + 0x1f]
add r9d, 0xffffffa5
add edx, r9d
mov byte [rsp + rdi + 0x1f], dl
mov byte [rsp + rsi + 0x1f], r8b
add rax, 2
cmp rax, 0xe
jge 0x4aafa8
movzx edx, byte [rsp + rax + 0x2a]
movzx esi, byte [rsp + rax + 0x2b]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0xb
jae 0x4aafcf
movzx r8d, byte [rsp + rdi + 0x1f]
add r8d, 0xffffffa5
add r8d, edx
nop dword [rax + rax]
cmp rsi, 0xb
jb 0x4aaf58
jmp 0x4aafc3
xor eax, eax
lea rbx, [rsp + 0x1f]
mov ecx, 0xb
call fcn.00441e20
mov rbp, qword [rsp + 0x38]
add rsp, 0x40
ret
mov eax, esi
mov ecx, 0xb
call fcn.00453d80
mov eax, edi
mov ecx, 0xb
call fcn.00453d80
nop
nop dword [rax]
call fcn.00451720
jmp fcn.004aaf00
Function at 0x4ab000
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4ab0d2
sub rsp, 0x40
mov qword [rsp + 0x38], rbp
lea rbp, [rsp + 0x38]
movabs rdx, 0x3840be6c16396e43
mov qword [rsp + 0x1c], rdx
mov dword [rsp + 0x24], 0x161c3239
movabs rdx, 0x500050b09080809
mov qword [rsp + 0x28], rdx
movabs rdx, 0xb07020603070a06
mov qword [rsp + 0x30], rdx
xor eax, eax
jmp 0x4ab06b
movzx r9d, byte [rsp + rsi + 0x1c]
add r9d, 0x1b
add edx, r9d
mov byte [rsp + rdi + 0x1c], dl
mov byte [rsp + rsi + 0x1c], r8b
add rax, 2
cmp rax, 0x10
jge 0x4ab09c
movzx edx, byte [rsp + rax + 0x28]
movzx esi, byte [rsp + rax + 0x29]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0xc
jae 0x4ab0c5
movzx r8d, byte [rsp + rdi + 0x1c]
add r8d, 0x1b
add r8d, edx
cmp rsi, 0xc
jb 0x4ab051
jmp 0x4ab0b7
xor eax, eax
lea rbx, [rsp + 0x1c]
mov ecx, 0xc
call fcn.00441e20
mov rbp, qword [rsp + 0x38]
add rsp, 0x40
ret
mov eax, esi
mov ecx, 0xc
nop
call fcn.00453d80
mov eax, edi
mov ecx, 0xc
call fcn.00453d80
nop
call fcn.00451720
jmp fcn.004ab000

Function at 0x4ac220
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4ac346
sub rsp, 0x68
mov qword [rsp + 0x60], rbp
lea rbp, [rsp + 0x60]
movabs rdx, 0xc344a3176d6d1663
mov qword [rsp + 0x1f], rdx
movabs rdx, 0xb46528328c697416
mov qword [rsp + 0x27], rdx
movabs rdx, 0xbd3c89b46528328c
mov qword [rsp + 0x2a], rdx
movabs rdx, 0x474565739c3bd920
mov qword [rsp + 0x32], rdx
movabs rdx, 0x5100401080c100d
mov qword [rsp + 0x3a], rdx
movabs rdx, 0x150406160f070510
mov qword [rsp + 0x40], rdx
movabs rdx, 0x1a12061906100b16
mov qword [rsp + 0x48], rdx
movabs rdx, 0x106041a0b0c0b0d
mov qword [rsp + 0x50], rdx
movabs rdx, 0x1411111110081204
mov qword [rsp + 0x58], rdx
xor eax, eax
jmp 0x4ac2e0
movzx r9d, byte [rsp + rsi + 0x1f]
sub r9d, edx
lea edx, [r9 - 0x41]
mov byte [rsp + rdi + 0x1f], dl
lea edx, [r8 - 0x41]
mov byte [rsp + rsi + 0x1f], dl
add rax, 2
cmp rax, 0x26
jge 0x4ac30d
movzx edx, byte [rsp + rax + 0x3a]
movzx esi, byte [rsp + rax + 0x3b]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x1b
jae 0x4ac334
movzx r8d, byte [rsp + rdi + 0x1f]
sub r8d, edx
cmp rsi, 0x1b
jb 0x4ac2c3
jmp 0x4ac328
xor eax, eax
lea rbx, [rsp + 0x1f]
mov ecx, 0x1b
call fcn.00441e20
mov rbp, qword [rsp + 0x60]
add rsp, 0x68
ret
mov eax, esi
mov ecx, 0x1b
call fcn.00453d80
mov eax, edi
mov ecx, 0x1b
nop dword [rax + rax]
call fcn.00453d80
nop
call fcn.00451720
jmp fcn.004ac220
Function at 0x4ac760
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4ac872
sub rsp, 0x58
mov qword [rsp + 0x50], rbp
lea rbp, [rsp + 0x50]
movabs rdx, 0x656572ff6f73a272
mov qword [rsp + 0x1b], rdx
movabs rdx, 0x636fac0961c52b13
mov qword [rsp + 0x23], rdx
movabs rdx, 0xbe636fac0961c52b
mov qword [rsp + 0x24], rdx
movabs rdx, 0x64c36406a407f920
mov qword [rsp + 0x2c], rdx
movabs rdx, 0xc061514010c1208
mov qword [rsp + 0x34], rdx
movabs rdx, 0x8090a0417090d06
mov qword [rsp + 0x3c], rdx
movabs rdx, 0x1001140d08090a04
mov qword [rsp + 0x40], rdx
movabs rdx, 0x1712170c12130a0a
mov qword [rsp + 0x48], rdx
xor eax, eax
jmp 0x4ac811
movzx r9d, byte [rsp + rsi + 0x1b]
sub r9d, edx
lea edx, [r9 - 0x36]
mov byte [rsp + rdi + 0x1b], dl
lea edx, [r8 - 0x36]
mov byte [rsp + rsi + 0x1b], dl
add rax, 2
cmp rax, 0x1c
jge 0x4ac83e
movzx edx, byte [rsp + rax + 0x34]
movzx esi, byte [rsp + rax + 0x35]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x19
jae 0x4ac865
movzx r8d, byte [rsp + rdi + 0x1b]
sub r8d, edx
cmp rsi, 0x19
jb 0x4ac7f4
jmp 0x4ac859
xor eax, eax
lea rbx, [rsp + 0x1b]
mov ecx, 0x19
call fcn.00441e20
mov rbp, qword [rsp + 0x50]
add rsp, 0x58
ret
mov eax, esi
mov ecx, 0x19
call fcn.00453d80
mov eax, edi
mov ecx, 0x19
call fcn.00453d80
nop
call fcn.00451720
jmp fcn.004ac760
Function at 0x4ae880
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4ae968
sub rsp, 0x40
mov qword [rsp + 0x38], rbp
lea rbp, [rsp + 0x38]
movabs rdx, 0x948a92d96120a78a
mov qword [rsp + 0x18], rdx
movabs rdx, 0xc2722e749984948a
mov qword [rsp + 0x1e], rdx
movabs rdx, 0x6000904010d0104
mov qword [rsp + 0x26], rdx
movabs rdx, 0xd0706000904010d
mov qword [rsp + 0x28], rdx
movabs rdx, 0xb040a0507080501
mov qword [rsp + 0x30], rdx
xor eax, eax
jmp 0x4ae901
movzx r9d, byte [rsp + rsi + 0x18]
add r9d, 0xffffffd3
add edx, r9d
mov byte [rsp + rdi + 0x18], dl
mov byte [rsp + rsi + 0x18], r8b
add rax, 2
cmp rax, 0x12
jge 0x4ae932
movzx edx, byte [rsp + rax + 0x26]
movzx esi, byte [rsp + rax + 0x27]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0xe
jae 0x4ae95b
movzx r8d, byte [rsp + rdi + 0x18]
add r8d, 0xffffffd3
add r8d, edx
cmp rsi, 0xe
jb 0x4ae8e7
jmp 0x4ae94f
xor eax, eax
lea rbx, [rsp + 0x18]
mov ecx, 0xe
nop
call fcn.00441e20
mov rbp, qword [rsp + 0x38]
add rsp, 0x40
ret
mov eax, esi
mov ecx, 0xe
call fcn.00453d80
mov eax, edi
mov ecx, 0xe
call fcn.00453d80
nop
call fcn.00451720
jmp fcn.004ae880

Function at 0x4af420
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4af528
sub rsp, 0x58
mov qword [rsp + 0x50], rbp
lea rbp, [rsp + 0x50]
movabs rdx, 0x5c32340c657c5a5e
mov qword [rsp + 0x18], rdx
movabs rdx, 0x587b79737f545122
mov qword [rsp + 0x20], rdx
movabs rdx, 0x646589696c515f18
mov qword [rsp + 0x28], rdx
movabs rdx, 0xe021115020b0914
mov qword [rsp + 0x30], rdx
movabs rdx, 0x1110010a05100f04
mov qword [rsp + 0x38], rdx
movabs rdx, 0x140a0a110b081013
mov qword [rsp + 0x40], rdx
movabs rdx, 0x1500120401070f01
mov qword [rsp + 0x48], rdx
xor eax, eax
jmp 0x4af4c0
movzx r9d, byte [rsp + rsi + 0x18]
add r9d, 0xffffffe9
add edx, r9d
mov byte [rsp + rdi + 0x18], dl
mov byte [rsp + rsi + 0x18], r8b
add rax, 2
nop
cmp rax, 0x20
jge 0x4af4f1
movzx edx, byte [rsp + rax + 0x30]
movzx esi, byte [rsp + rax + 0x31]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x18
jae 0x4af51b
movzx r8d, byte [rsp + rdi + 0x18]
add r8d, 0xffffffe9
add r8d, edx
cmp rsi, 0x18
jb 0x4af4a5
jmp 0x4af50f
xor eax, eax
lea rbx, [rsp + 0x18]
mov ecx, 0x18
nop dword [rax]
call fcn.00441e20
mov rbp, qword [rsp + 0x50]
add rsp, 0x58
ret
mov eax, esi
mov ecx, 0x18
call fcn.00453d80
mov eax, edi
mov ecx, 0x18
call fcn.00453d80
nop
call fcn.00451720
jmp fcn.004af420