joyce8/EMBER2024-capa huggingface dataset:
Function at 0x473d80
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x473e48
sub rsp, 0x38
mov qword [rsp + 0x30], rbp
lea rbp, [rsp + 0x30]
movabs rdx, 0x6974aaa159e4829e
mov qword [rsp + 0x1d], rdx
mov byte [rsp + 0x25], 0x63
movabs rdx, 0x1000202030504
mov qword [rsp + 0x26], rdx
mov word [rsp + 0x2e], 0x301
xor eax, eax
jmp 0x473de3
movzx r9d, byte [rsp + rsi + 0x1d]
sub r9d, edx
lea edx, [r9 - 0x37]
mov byte [rsp + rdi + 0x1d], dl
lea edx, [r8 - 0x37]
mov byte [rsp + rsi + 0x1d], dl
add rax, 2
cmp rax, 0xa
jge 0x473e10
movzx edx, byte [rsp + rax + 0x26]
movzx esi, byte [rsp + rax + 0x27]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 9
jae 0x473e3b
movzx r8d, byte [rsp + rdi + 0x1d]
sub r8d, edx
cmp rsi, 9
jb 0x473dc6
jmp 0x473e2f
xor eax, eax
lea rbx, [rsp + 0x1d]
mov ecx, 9
nop dword [rax]
call fcn.00444d40
mov rbp, qword [rsp + 0x30]
add rsp, 0x38
ret
mov eax, esi
mov ecx, 9
call fcn.00457d20
mov eax, edi
mov ecx, 9
call fcn.00457d20
nop
call fcn.004556c0
jmp fcn.00473d80
Function at 0x476ba0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x476c9c
sub rsp, 0x48
mov qword [rsp + 0x40], rbp
lea rbp, [rsp + 0x40]
movabs rdx, 0xe851ceeb746e5753
mov qword [rsp + 0x19], rdx
movabs rdx, 0xdce851ceeb746e57
mov qword [rsp + 0x1a], rdx
movabs rdx, 0xc6d56e49d52c65ce
mov qword [rsp + 0x22], rdx
movabs rdx, 0x106050d0704040b
mov qword [rsp + 0x2a], rdx
movabs rdx, 0xc060d0601080106
mov qword [rsp + 0x30], rdx
movabs rdx, 0xf0f051010070909
mov qword [rsp + 0x38], rdx
xor eax, eax
jmp 0x476c30
movzx r9d, byte [rsp + rsi + 0x19]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x78]
mov byte [rsp + rdi + 0x19], dl
mov byte [rsp + rsi + 0x19], r8b
add rax, 2
cmp rax, 0x16
jge 0x476c68
movzx edx, byte [rsp + rax + 0x2a]
movzx esi, byte [rsp + rax + 0x2b]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x11
jae 0x476c8f
movzx r8d, byte [rsp + rdi + 0x19]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x78]
nop word [rax + rax]
cmp rsi, 0x11
jb 0x476c16
jmp 0x476c83
xor eax, eax
lea rbx, [rsp + 0x19]
mov ecx, 0x11
call fcn.00444d40
mov rbp, qword [rsp + 0x40]
add rsp, 0x48
ret
mov eax, esi
mov ecx, 0x11
call fcn.00457d20
mov eax, edi
mov ecx, 0x11
call fcn.00457d20
nop
nop dword [rax]
call fcn.004556c0
jmp fcn.00476ba0

Function at 0x486600
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4866dc
sub rsp, 0x40
mov qword [rsp + 0x38], rbp
lea rbp, [rsp + 0x38]
movabs rdx, 0xe1dc37e78ae7e634
mov qword [rsp + 0x19], rdx
movabs rdx, 0x35e798d69d329ae1
mov qword [rsp + 0x20], rdx
movabs rdx, 0x60803070b0b060c
mov qword [rsp + 0x28], rdx
movabs rdx, 0x6070201040d040a
mov qword [rsp + 0x30], rdx
xor eax, eax
jmp 0x486675
movzx r9d, byte [rsp + rsi + 0x19]
sub r9d, edx
lea edx, [r9 + 0x5f]
mov byte [rsp + rdi + 0x19], dl
lea edx, [r8 + 0x5f]
mov byte [rsp + rsi + 0x19], dl
add rax, 2
cmp rax, 0x10
jge 0x4866a8
movzx edx, byte [rsp + rax + 0x28]
movzx esi, byte [rsp + rax + 0x29]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0xf
jae 0x4866cf
movzx r8d, byte [rsp + rdi + 0x19]
sub r8d, edx
nop word [rax + rax]
cmp rsi, 0xf
jb 0x486658
jmp 0x4866c3
xor eax, eax
lea rbx, [rsp + 0x19]
mov ecx, 0xf
call fcn.00444d40
mov rbp, qword [rsp + 0x38]
add rsp, 0x40
ret
mov eax, esi
mov ecx, 0xf
call fcn.00457d20
mov eax, edi
mov ecx, 0xf
call fcn.00457d20
nop
nop dword [rax]
call fcn.004556c0
jmp fcn.00486600
Function at 0x488a80
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x488b92
sub rsp, 0x58
mov qword [rsp + 0x50], rbp
lea rbp, [rsp + 0x50]
movabs rdx, 0xf9f435e9b53732c7
mov qword [rsp + 0x36], rdx
movabs rdx, 0xaae8e6fc38e53401
mov qword [rsp + 0x3e], rdx
movabs rdx, 0x9139aae8e6fc38e5
mov qword [rsp + 0x40], rdx
movabs rdx, 0xb4fb313330eadb40
mov qword [rsp + 0x48], rdx
movabs rdx, 0x4030f0a19001213
mov qword [rsp + 0x1c], rdx
movabs rdx, 0x141108130e0d0419
mov qword [rsp + 0x24], rdx
movabs rdx, 0x60a141108130e0d
mov qword [rsp + 0x26], rdx
movabs rdx, 0x1814180c070800
mov qword [rsp + 0x2e], rdx
xor eax, eax
jmp 0x488b31
movzx r9d, byte [rsp + rsi + 0x36]
sub r9d, edx
lea edx, [r9 + 0x59]
mov byte [rsp + rdi + 0x36], dl
lea edx, [r8 + 0x59]
mov byte [rsp + rsi + 0x36], dl
add rax, 2
cmp rax, 0x1a
jge 0x488b5e
movzx edx, byte [rsp + rax + 0x1c]
movzx esi, byte [rsp + rax + 0x1d]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x1a
jae 0x488b85
movzx r8d, byte [rsp + rdi + 0x36]
sub r8d, edx
cmp rsi, 0x1a
jb 0x488b14
jmp 0x488b79
xor eax, eax
lea rbx, [rsp + 0x36]
mov ecx, 0x1a
call fcn.00444d40
mov rbp, qword [rsp + 0x50]
add rsp, 0x58
ret
mov eax, esi
mov ecx, 0x1a
call fcn.00457d20
mov eax, edi
mov ecx, 0x1a
call fcn.00457d20
nop
call fcn.004556c0
jmp fcn.00488a80
Function at 0x48b6a0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x48b7d2
sub rsp, 0x70
mov qword [rsp + 0x68], rbp
lea rbp, [rsp + 0x68]
movabs rdx, 0x303239b6304a3456
mov qword [rsp + 0x1c], rdx
movabs rdx, 0x98ba3843303239b6
mov qword [rsp + 0x20], rdx
movabs rdx, 0x366f365c658b3630
mov qword [rsp + 0x28], rdx
movabs rdx, 0xc07c5aca87359e80
mov qword [rsp + 0x30], rdx
movabs rdx, 0x3532703886d29933
mov qword [rsp + 0x38], rdx
movabs rdx, 0x1b0b1e040b151714
mov qword [rsp + 0x40], rdx
movabs rdx, 0x12181e0a1921040a
mov qword [rsp + 0x48], rdx
movabs rdx, 0x821040f12040f1d
mov qword [rsp + 0x50], rdx
movabs rdx, 0x1a0b1f190e0b0a12
mov qword [rsp + 0x58], rdx
movabs rdx, 0xe02021519100b00
mov qword [rsp + 0x60], rdx
xor eax, eax
jmp 0x48b76c
movzx r9d, byte [rsp + rsi + 0x1c]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x51]
mov byte [rsp + rdi + 0x1c], dl
mov byte [rsp + rsi + 0x1c], r8b
add rax, 2
cmp rax, 0x28
jge 0x48b79e
movzx edx, byte [rsp + rax + 0x40]
movzx esi, byte [rsp + rax + 0x41]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x24
jae 0x48b7c5
movzx r8d, byte [rsp + rdi + 0x1c]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x51]
cmp rsi, 0x24
jb 0x48b752
jmp 0x48b7b9
xor eax, eax
lea rbx, [rsp + 0x1c]
mov ecx, 0x24
call fcn.00444d40
mov rbp, qword [rsp + 0x68]
add rsp, 0x70
ret
mov eax, esi
mov ecx, 0x24
call fcn.00457d20
mov eax, edi
mov ecx, 0x24
call fcn.00457d20
nop
call fcn.004556c0
jmp fcn.0048b6a0

Function at 0x48bdc0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x48bf12
sub rsp, 0x78
mov qword [rsp + 0x70], rbp
lea rbp, [rsp + 0x70]
movabs rdx, 0x68564999535b3831
mov qword [rsp + 0x18], rdx
movabs rdx, 0x76a532b1c6326856
mov qword [rsp + 0x1e], rdx
movabs rdx, 0x85b0583f89f45755
mov qword [rsp + 0x26], rdx
movabs rdx, 0x4f309bb836313ab0
mov qword [rsp + 0x2e], rdx
movabs rdx, 0x686683b163583871
mov qword [rsp + 0x36], rdx
movabs rdx, 0x17100901120d0612
mov qword [rsp + 0x3e], rdx
movabs rdx, 0x112517100901120d
mov qword [rsp + 0x40], rdx
movabs rdx, 0xc22150514240c01
mov qword [rsp + 0x48], rdx
movabs rdx, 0x11b1d160421120f
mov qword [rsp + 0x50], rdx
movabs rdx, 0x30e02130a032107
mov qword [rsp + 0x58], rdx
movabs rdx, 0x11a20252317220c
mov qword [rsp + 0x60], rdx
movabs rdx, 0x1d2301241e050e1b
mov qword [rsp + 0x68], rdx
xor eax, eax
jmp 0x48bead
movzx r9d, byte [rsp + rsi + 0x18]
sub r9d, edx
lea edx, [r9 + 8]
mov byte [rsp + rdi + 0x18], dl
lea edx, [r8 + 8]
mov byte [rsp + rsi + 0x18], dl
add rax, 2
cmp rax, 0x32
jge 0x48beda
movzx edx, byte [rsp + rax + 0x3e]
movzx esi, byte [rsp + rax + 0x3f]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x26
jae 0x48bf05
movzx r8d, byte [rsp + rdi + 0x18]
sub r8d, edx
cmp rsi, 0x26
jb 0x48be90
jmp 0x48bef5
xor eax, eax
lea rbx, [rsp + 0x18]
mov ecx, 0x26
call fcn.00444d40
mov rbp, qword [rsp + 0x70]
add rsp, 0x78
ret
mov eax, esi
mov ecx, 0x26
nop dword [rax]
call fcn.00457d20
mov eax, edi
mov ecx, 0x26
call fcn.00457d20
nop
call fcn.004556c0
jmp fcn.0048bdc0
Function at 0x48c2e0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x48c432
add rsp, 0xffffffffffffff80
mov qword [rsp + 0x78], rbp
lea rbp, [rsp + 0x78]
movabs rdx, 0x50b00d9aba55943a
mov qword [rsp + 0x1b], rdx
movabs rdx, 0x733890365dfab450
mov qword [rsp + 0x22], rdx
movabs rdx, 0xcb92768d73647857
mov qword [rsp + 0x2a], rdx
movabs rdx, 0x7e91af30854f3937
mov qword [rsp + 0x32], rdx
movabs rdx, 0x620689c7377b9687
mov qword [rsp + 0x3a], rdx
movabs rdx, 0x210a191f0f040208
mov qword [rsp + 0x42], rdx
movabs rdx, 0x207241c2109210a
mov qword [rsp + 0x48], rdx
movabs rdx, 0x712160623262124
mov qword [rsp + 0x50], rdx
movabs rdx, 0x324160f03021911
mov qword [rsp + 0x58], rdx
movabs rdx, 0x6200e13250c0e00
mov qword [rsp + 0x60], rdx
movabs rdx, 0x91a141013241d02
mov qword [rsp + 0x68], rdx
movabs rdx, 0xc26011526051a1e
mov qword [rsp + 0x70], rdx
xor eax, eax
jmp 0x48c3cd
movzx r9d, byte [rsp + rsi + 0x1b]
sub r9d, edx
lea edx, [r9 - 0x15]
mov byte [rsp + rdi + 0x1b], dl
lea edx, [r8 - 0x15]
mov byte [rsp + rsi + 0x1b], dl
add rax, 2
cmp rax, 0x36
jge 0x48c3fa
movzx edx, byte [rsp + rax + 0x42]
movzx esi, byte [rsp + rax + 0x43]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x27
jae 0x48c425
movzx r8d, byte [rsp + rdi + 0x1b]
sub r8d, edx
cmp rsi, 0x27
jb 0x48c3b0
jmp 0x48c415
xor eax, eax
lea rbx, [rsp + 0x1b]
mov ecx, 0x27
call fcn.00444d40
mov rbp, qword [rsp + 0x78]
sub rsp, 0xffffffffffffff80
ret
mov eax, esi
mov ecx, 0x27
nop dword [rax]
call fcn.00457d20
mov eax, edi
mov ecx, 0x27
call fcn.00457d20
nop
call fcn.004556c0
jmp fcn.0048c2e0
Function at 0x494a20
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x494b7f
add rsp, 0xffffffffffffff80
mov qword [rsp + 0x78], rbp
lea rbp, [rsp + 0x78]
movabs rdx, 0x633c6e6f4272d344
mov qword [rsp + 0x1b], rdx
movabs rdx, 0x6c61672f4c6e3c2e
mov qword [rsp + 0x23], rdx
movabs rdx, 0x136c61672f4c6e3c
mov qword [rsp + 0x24], rdx
movabs rdx, 0x764946495e702a19
mov qword [rsp + 0x2c], rdx
movabs rdx, 0x631bcf0f1d435bff
mov qword [rsp + 0x34], rdx
movabs rdx, 0xe92f871e201e6908
mov qword [rsp + 0x3c], rdx
movabs rdx, 0x151a1900111a2627
mov qword [rsp + 0x44], rdx
movabs rdx, 0x110c1521151a1900
mov qword [rsp + 0x48], rdx
movabs rdx, 0x19180a0007152101
mov qword [rsp + 0x50], rdx
movabs rdx, 0x10211b1b14012525
mov qword [rsp + 0x58], rdx
movabs rdx, 0x1f261c1220221c16
mov qword [rsp + 0x60], rdx
movabs rdx, 0x1e250a1a1623180b
mov qword [rsp + 0x68], rdx
movabs rdx, 0x903251d061c2808
mov qword [rsp + 0x70], rdx
xor eax, eax
jmp 0x494b19
movzx r9d, byte [rsp + rsi + 0x1b]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x15]
mov byte [rsp + rdi + 0x1b], dl
mov byte [rsp + rsi + 0x1b], r8b
add rax, 2
cmp rax, 0x34
jge 0x494b4b
movzx edx, byte [rsp + rax + 0x44]
movzx esi, byte [rsp + rax + 0x45]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x29
jae 0x494b72
movzx r8d, byte [rsp + rdi + 0x1b]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x15]
cmp rsi, 0x29
jb 0x494aff
jmp 0x494b66
xor eax, eax
lea rbx, [rsp + 0x1b]
mov ecx, 0x29
call fcn.00444d40
mov rbp, qword [rsp + 0x78]
sub rsp, 0xffffffffffffff80
ret
mov eax, esi
mov ecx, 0x29
call fcn.00457d20
mov eax, edi
mov ecx, 0x29
call fcn.00457d20
nop
nop
call fcn.004556c0
jmp fcn.00494a20
Function at 0x4963e0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
lea r12, [rsp - 0x10]
cmp r12, qword [r14 + 0x10]
jbe 0x496566
sub rsp, 0x90
mov qword [rsp + 0x88], rbp
lea rbp, [rsp + 0x88]
movabs rdx, 0xf86f5e3d24e1d53d
mov qword [rsp + 0x1c], rdx
movabs rdx, 0xb6eca6351204f4c
mov qword [rsp + 0x24], rdx
movabs rdx, 0xad3c74fed33f20b5
mov qword [rsp + 0x2c], rdx
movabs rdx, 0x6508bfdd41c4d026
mov qword [rsp + 0x34], rdx
movabs rdx, 0x3422741d756d1ae2
mov qword [rsp + 0x3c], rdx
movabs rdx, 0xa83124f41f74128a
mov qword [rsp + 0x44], rdx
movabs rdx, 0xc05130d0b11072b
mov qword [rsp + 0x4c], rdx
movabs rdx, 0x1c212f2407132d09
mov qword [rsp + 0x54], rdx
movabs rdx, 0x170009181c212f24
mov qword [rsp + 0x58], rdx
movabs rdx, 0x1a20011b00240412
mov qword [rsp + 0x60], rdx
movabs rdx, 0x8022c03260d1921
mov qword [rsp + 0x68], rdx
movabs rdx, 0x1a072b081020291d
mov qword [rsp + 0x70], rdx
movabs rdx, 0x90b03001e291428
mov qword [rsp + 0x78], rdx
movabs rdx, 0xf241b201a201614
mov qword [rsp + 0x80], rdx
xor eax, eax
jmp 0x4964f9
movzx r9d, byte [rsp + rsi + 0x1c]
lea edx, [r9 + rdx]
lea edx, [rdx - 4]
mov byte [rsp + rdi + 0x1c], dl
mov byte [rsp + rsi + 0x1c], r8b
add rax, 2
cmp rax, 0x3c
jge 0x49652b
movzx edx, byte [rsp + rax + 0x4c]
movzx esi, byte [rsp + rax + 0x4d]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x30
jae 0x496558
movzx r8d, byte [rsp + rdi + 0x1c]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 4]
cmp rsi, 0x30
jb 0x4964df
jmp 0x49654c
xor eax, eax
lea rbx, [rsp + 0x1c]
mov ecx, 0x30
call fcn.00444d40
mov rbp, qword [rsp + 0x88]
add rsp, 0x90
ret
mov eax, esi
mov ecx, 0x30
call fcn.00457d20
mov eax, edi
mov ecx, 0x30
nop
call fcn.00457d20
nop
call fcn.004556c0
jmp fcn.004963e0

Function at 0x498200
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4982c6
sub rsp, 0x38
mov qword [rsp + 0x30], rbp
lea rbp, [rsp + 0x30]
movabs rdx, 0x665c555673596150
mov qword [rsp + 0x1d], rdx
mov byte [rsp + 0x25], 0x57
movabs rdx, 0x402040707060101
mov qword [rsp + 0x26], rdx
mov word [rsp + 0x2e], 0x807
xor eax, eax
jmp 0x498260
movzx r9d, byte [rsp + rsi + 0x1d]
add edx, r9d
mov byte [rsp + rdi + 0x1d], dl
mov byte [rsp + rsi + 0x1d], r8b
add rax, 2
nop dword [rax]
cmp rax, 0xa
jge 0x49828d
movzx edx, byte [rsp + rax + 0x26]
movzx esi, byte [rsp + rax + 0x27]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 9
jae 0x4982b4
movzx r8d, byte [rsp + rdi + 0x1d]
add r8d, edx
cmp rsi, 9
jb 0x498246
jmp 0x4982a8
xor eax, eax
lea rbx, [rsp + 0x1d]
mov ecx, 9
call fcn.00444d40
mov rbp, qword [rsp + 0x30]
add rsp, 0x38
ret
mov eax, esi
mov ecx, 9
call fcn.00457d20
mov eax, edi
mov ecx, 9
nop dword [rax + rax]
call fcn.00457d20
nop
call fcn.004556c0
jmp fcn.00498200
Function at 0x4993c0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x499492
sub rsp, 0x38
mov qword [rsp + 0x30], rbp
lea rbp, [rsp + 0x30]
movabs rdx, 0xc4bc9ebfdf729050
mov qword [rsp + 0x18], rdx
mov word [rsp + 0x20], 0x6797
movabs rdx, 0x507040304030606
mov qword [rsp + 0x22], rdx
movabs rdx, 0x601090508030507
mov qword [rsp + 0x28], rdx
xor eax, eax
jmp 0x49942a
movzx r9d, byte [rsp + rsi + 0x18]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x37]
mov byte [rsp + rdi + 0x18], dl
mov byte [rsp + rsi + 0x18], r8b
add rax, 2
cmp rax, 0xe
jge 0x49945c
movzx edx, byte [rsp + rax + 0x22]
movzx esi, byte [rsp + rax + 0x23]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0xa
jae 0x499485
movzx r8d, byte [rsp + rdi + 0x18]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x37]
cmp rsi, 0xa
jb 0x499410
jmp 0x499477
xor eax, eax
lea rbx, [rsp + 0x18]
mov ecx, 0xa
call fcn.00444d40
mov rbp, qword [rsp + 0x30]
add rsp, 0x38
ret
mov eax, esi
mov ecx, 0xa
nop
call fcn.00457d20
mov eax, edi
mov ecx, 0xa
call fcn.00457d20
nop
call fcn.004556c0
jmp fcn.004993c0
Function at 0x49f140
Capabilities:
Hash data using fnv

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x49f38c
add rsp, 0xffffffffffffff80
mov qword [rsp + 0x78], rbp
lea rbp, [rsp + 0x78]
mov ebx, dword [rax + 0x2c]
nop dword [rax + rax]
test ebx, ebx
jne 0x49f1ec
mov qword [rsp + 0x88], rax
lea rbx, [0x006be5a0]
mov rcx, rax
lea rax, [0x00866e40]
call fcn.00462460
test cl, cl
jne 0x49f1d1
mov rax, qword [rsp + 0x88]
call fcn.0049dca0
mov ecx, 1
mov rdi, rax
mov rsi, rbx
lea rax, [rsp + 0x30]
lea rbx, [0x0075c488]
call fcn.004449a0
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x28], rbx
nop dword [rax]
call fcn.004a0600
mov rcx, qword [rsp + 0x88]
xor edx, edx
jmp 0x49f20e
lea rdx, [0x006be2e0]
cmp rax, rdx
jne 0x49f1fc
test byte [rbx], al
mov rax, rbx
mov rbp, qword [rsp + 0x78]
sub rsp, 0xffffffffffffff80
ret
nop
call fcn.00453440
mov rbp, qword [rsp + 0x78]
sub rsp, 0xffffffffffffff80
ret
mov rbx, rdx
lea rcx, [0x006851c0]
call fcn.00409460
inc rdx
cmp rbx, rdx
jle 0x49f258
mov rsi, qword [rax + rdx*8]
cmp qword [rsi + 0x30], rcx
jne 0x49f20b
lea rax, [0x00866e40]
lea rbx, [0x006be5a0]
lea rdi, [0x006be2e0]
call fcn.00462620
lea rdx, [0x006be2e0]
nop
cmp rax, rdx
jne 0x49f37c
test byte [rbx], al
mov rax, rbx
mov rbp, qword [rsp + 0x78]
sub rsp, 0xffffffffffffff80
ret
lea rcx, [0x0067e140]
mov qword [rsp + 0x68], rcx
mov qword [rsp + 0x70], 0
mov rcx, qword [rsp + 0x68]
mov qword [rsp + 0x50], rcx
lea rax, [0x00699900]
nop
call fcn.0040bea0
mov qword [rsp + 0x60], rax
mov rcx, qword [rsp + 0x50]
test byte [rcx], al
cmp dword [0x008bb990], 0
jne 0x49f2ba
mov rdx, qword [rcx]
mov qword [rax], rdx
movups xmm0, xmmword [rcx + 8]
movups xmmword [rax + 8], xmm0
movups xmm0, xmmword [rcx + 0x18]
movups xmmword [rax + 0x18], xmm0
movups xmm0, xmmword [rcx + 0x28]
movups xmmword [rax + 0x28], xmm0
jmp 0x49f2c9
mov rbx, rax
lea rax, [0x00699900]
call fcn.00411c00
mov rax, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x28]
xor ecx, ecx
xor edi, edi
xor esi, esi
mov r8d, esi
nop dword [rax]
call fcn.0049ce40
nop
call fcn.00453500
mov rsi, qword [rsp + 0x60]
mov dword [rsi + 0x28], eax
mov dword [rsi + 0x2c], 0
mov rcx, qword [rsp + 0x88]
mov edx, dword [rcx + 0x10]
xor eax, eax
jmp 0x49f317
imul edx, edx, 0x1000193
xor edx, 0x2a
mov eax, 1
cmp rax, 1
jl 0x49f309
mov dword [rsi + 0x10], edx
cmp dword [0x008bb990], 0
jne 0x49f32f
mov qword [rsi + 0x30], rcx
jmp 0x49f338
lea rdi, [rsi + 0x30]
call fcn.00457980
lea rax, [0x00866e40]
lea rbx, [0x006be5a0]
lea rdi, [0x006be2e0]
call fcn.00462620
lea rdx, [0x006be2e0]
cmp rax, rdx
jne 0x49f36d
test byte [rbx], al
mov rax, rbx
mov rbp, qword [rsp + 0x78]
sub rsp, 0xffffffffffffff80
ret
mov rbx, rdx
lea rcx, [0x006851c0]
call fcn.00409460
mov rbx, rdx
lea rcx, [0x006851c0]
call fcn.00409460
nop
mov qword [rsp + 8], rax
call fcn.004556c0
mov rax, qword [rsp + 8]
nop dword [rax + rax]
jmp fcn.0049f140
Function at 0x4ab7a0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4ab89c
sub rsp, 0x50
mov qword [rsp + 0x48], rbp
lea rbp, [rsp + 0x48]
movabs rdx, 0x18728b13c8e22c31
mov qword [rsp + 0x1a], rdx
movabs rdx, 0x3e74e7fc20271872
mov qword [rsp + 0x20], rdx
movabs rdx, 0x20c9740d2c7a6cc7
mov qword [rsp + 0x28], rdx
movabs rdx, 0x50d0b0e0d0a0e0a
mov qword [rsp + 0x30], rdx
movabs rdx, 0x120400020d031110
mov qword [rsp + 0x38], rdx
movabs rdx, 0xd070801110d0314
mov qword [rsp + 0x40], rdx
xor eax, eax
jmp 0x4ab830
movzx r9d, byte [rsp + rsi + 0x1a]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x30]
mov byte [rsp + rdi + 0x1a], dl
mov byte [rsp + rsi + 0x1a], r8b
add rax, 2
cmp rax, 0x18
jge 0x4ab868
movzx edx, byte [rsp + rax + 0x30]
movzx esi, byte [rsp + rax + 0x31]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x16
jae 0x4ab88f
movzx r8d, byte [rsp + rdi + 0x1a]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x30]
nop word [rax + rax]
cmp rsi, 0x16
jb 0x4ab816
jmp 0x4ab883
xor eax, eax
lea rbx, [rsp + 0x1a]
mov ecx, 0x16
call fcn.00444d40
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
mov eax, esi
mov ecx, 0x16
call fcn.00457d20
mov eax, edi
mov ecx, 0x16
call fcn.00457d20
nop
nop dword [rax]
call fcn.004556c0
jmp fcn.004ab7a0

Function at 0x4ad960
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4ada86
sub rsp, 0x68
mov qword [rsp + 0x60], rbp
lea rbp, [rsp + 0x60]
movabs rdx, 0xe1b059df6c386521
mov qword [rsp + 0x1b], rdx
movabs rdx, 0xc4ef37f665e6a64d
mov qword [rsp + 0x23], rdx
movabs rdx, 0x61343924247b65c4
mov qword [rsp + 0x2a], rdx
movabs rdx, 0x2df74329df766974
mov qword [rsp + 0x32], rdx
movabs rdx, 0x13090600110e0504
mov qword [rsp + 0x3a], rdx
movabs rdx, 0x1d070e04070a1309
mov qword [rsp + 0x40], rdx
movabs rdx, 0x121a1c000e000411
mov qword [rsp + 0x48], rdx
movabs rdx, 0x1b0c0214151e1302
mov qword [rsp + 0x50], rdx
movabs rdx, 0x50d0a0d140e0a0f
mov qword [rsp + 0x58], rdx
xor eax, eax
jmp 0x4ada20
movzx r9d, byte [rsp + rsi + 0x1b]
sub r9d, edx
lea edx, [r9 + 0x5d]
mov byte [rsp + rdi + 0x1b], dl
lea edx, [r8 + 0x5d]
mov byte [rsp + rsi + 0x1b], dl
add rax, 2
cmp rax, 0x26
jge 0x4ada4d
movzx edx, byte [rsp + rax + 0x3a]
movzx esi, byte [rsp + rax + 0x3b]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x1f
jae 0x4ada74
movzx r8d, byte [rsp + rdi + 0x1b]
sub r8d, edx
cmp rsi, 0x1f
jb 0x4ada03
jmp 0x4ada68
xor eax, eax
lea rbx, [rsp + 0x1b]
mov ecx, 0x1f
call fcn.00444d40
mov rbp, qword [rsp + 0x60]
add rsp, 0x68
ret
mov eax, esi
mov ecx, 0x1f
call fcn.00457d20
mov eax, edi
mov ecx, 0x1f
nop dword [rax + rax]
call fcn.00457d20
nop
call fcn.004556c0
jmp fcn.004ad960
Function at 0x4adbe0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4add06
sub rsp, 0x60
mov qword [rsp + 0x58], rbp
lea rbp, [rsp + 0x58]
movabs rdx, 0x6b749b96ca54b2cb
mov qword [rsp + 0x18], rdx
movabs rdx, 0x52d0eabf734661c5
mov qword [rsp + 0x20], rdx
movabs rdx, 0xea96286552d0eabf
mov qword [rsp + 0x24], rdx
movabs rdx, 0xb261376d3e966e65
mov qword [rsp + 0x2c], rdx
movabs rdx, 0x1907000a0405190b
mov qword [rsp + 0x34], rdx
movabs rdx, 0x21118071907000a
mov qword [rsp + 0x38], rdx
movabs rdx, 0x10b0e05130d0403
mov qword [rsp + 0x40], rdx
movabs rdx, 0x21119001b070f0b
mov qword [rsp + 0x48], rdx
movabs rdx, 0xb0316120e0f0c08
mov qword [rsp + 0x50], rdx
xor eax, eax
jmp 0x4adca0
movzx r9d, byte [rsp + rsi + 0x18]
sub r9d, edx
lea edx, [r9 - 0x52]
mov byte [rsp + rdi + 0x18], dl
lea edx, [r8 - 0x52]
mov byte [rsp + rsi + 0x18], dl
add rax, 2
cmp rax, 0x24
jge 0x4adccd
movzx edx, byte [rsp + rax + 0x34]
movzx esi, byte [rsp + rax + 0x35]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x1c
jae 0x4adcf4
movzx r8d, byte [rsp + rdi + 0x18]
sub r8d, edx
cmp rsi, 0x1c
jb 0x4adc83
jmp 0x4adce8
xor eax, eax
lea rbx, [rsp + 0x18]
mov ecx, 0x1c
call fcn.00444d40
mov rbp, qword [rsp + 0x58]
add rsp, 0x60
ret
mov eax, esi
mov ecx, 0x1c
call fcn.00457d20
mov eax, edi
mov ecx, 0x1c
nop dword [rax + rax]
call fcn.00457d20
nop
call fcn.004556c0
jmp fcn.004adbe0
Function at 0x4b1760
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4b185c
sub rsp, 0x50
mov qword [rsp + 0x48], rbp
lea rbp, [rsp + 0x48]
movabs rdx, 0xbcb165701ec6dd1e
mov qword [rsp + 0x1d], rdx
movabs rdx, 0xe9182be61fbcb165
mov qword [rsp + 0x22], rdx
movabs rdx, 0x231e747309650e76
mov qword [rsp + 0x2a], rdx
movabs rdx, 0x14000c09130e0a01
mov qword [rsp + 0x32], rdx
movabs rdx, 0x10060c030d031400
mov qword [rsp + 0x38], rdx
movabs rdx, 0xc08090b02100708
mov qword [rsp + 0x40], rdx
xor eax, eax
jmp 0x4b17f0
movzx r9d, byte [rsp + rsi + 0x1d]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x38]
mov byte [rsp + rdi + 0x1d], dl
mov byte [rsp + rsi + 0x1d], r8b
add rax, 2
cmp rax, 0x16
jge 0x4b1828
movzx edx, byte [rsp + rax + 0x32]
movzx esi, byte [rsp + rax + 0x33]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x15
jae 0x4b184f
movzx r8d, byte [rsp + rdi + 0x1d]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x38]
nop word [rax + rax]
cmp rsi, 0x15
jb 0x4b17d6
jmp 0x4b1843
xor eax, eax
lea rbx, [rsp + 0x1d]
mov ecx, 0x15
call fcn.00444d40
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
mov eax, esi
mov ecx, 0x15
call fcn.00457d20
mov eax, edi
mov ecx, 0x15
call fcn.00457d20
nop
nop dword [rax]
call fcn.004556c0
jmp fcn.004b1760