joyce8/EMBER2024-capa huggingface dataset:
Function at 0x475220
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4752e8
sub rsp, 0x38
mov qword [rsp + 0x30], rbp
lea rbp, [rsp + 0x30]
movabs rdx, 0x698a8283ba6e7eaa
mov qword [rsp + 0x1e], rdx
movabs rdx, 0x7060500040603
mov qword [rsp + 0x26], rdx
mov word [rsp + 0x2e], 0x401
xor eax, eax
nop
jmp 0x475280
movzx r9d, byte [rsp + rsi + 0x1e]
add r9d, 0xffffffd6
add edx, r9d
mov byte [rsp + rdi + 0x1e], dl
mov byte [rsp + rsi + 0x1e], r8b
add rax, 2
nop dword [rax]
cmp rax, 0xa
jge 0x4752b1
movzx edx, byte [rsp + rax + 0x26]
movzx esi, byte [rsp + rax + 0x27]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 8
jae 0x4752db
movzx r8d, byte [rsp + rdi + 0x1e]
add r8d, 0xffffffd6
add r8d, edx
cmp rsi, 8
jb 0x475262
jmp 0x4752cf
xor eax, eax
lea rbx, [rsp + 0x1e]
mov ecx, 8
nop dword [rax]
call fcn.00441820
mov rbp, qword [rsp + 0x30]
add rsp, 0x38
ret
mov eax, esi
mov ecx, 8
call fcn.00453360
mov eax, edi
mov ecx, 8
call fcn.00453360
nop
call fcn.00450d00
jmp fcn.00475220

Function at 0x476140
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x476248
sub rsp, 0x50
mov qword [rsp + 0x48], rbp
lea rbp, [rsp + 0x48]
movabs rdx, 0x10192c6924f1654d
mov qword [rsp + 0x18], rdx
movabs rdx, 0x1190ee5f10192c69
mov qword [rsp + 0x1c], rdx
movabs rdx, 0x7b68ccbac71331dc
mov qword [rsp + 0x24], rdx
movabs rdx, 0x50d0a101302090b
mov qword [rsp + 0x2c], rdx
movabs rdx, 0xf0b1101030c1013
mov qword [rsp + 0x34], rdx
movabs rdx, 0x20306010f0b1101
mov qword [rsp + 0x38], rdx
movabs rdx, 0xe03130a13110b07
mov qword [rsp + 0x40], rdx
xor eax, eax
jmp 0x4761e0
movzx r9d, byte [rsp + rsi + 0x18]
add r9d, 0x35
add edx, r9d
mov byte [rsp + rdi + 0x18], dl
mov byte [rsp + rsi + 0x18], r8b
add rax, 2
nop
cmp rax, 0x1c
jge 0x476211
movzx edx, byte [rsp + rax + 0x2c]
movzx esi, byte [rsp + rax + 0x2d]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x14
jae 0x47623b
movzx r8d, byte [rsp + rdi + 0x18]
add r8d, 0x35
add r8d, edx
cmp rsi, 0x14
jb 0x4761c5
jmp 0x47622f
xor eax, eax
lea rbx, [rsp + 0x18]
mov ecx, 0x14
nop dword [rax]
call fcn.00441820
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
mov eax, esi
mov ecx, 0x14
call fcn.00453360
mov eax, edi
mov ecx, 0x14
call fcn.00453360
nop
call fcn.00450d00
jmp fcn.00476140
Function at 0x476d00
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x476dc8
sub rsp, 0x38
mov qword [rsp + 0x30], rbp
lea rbp, [rsp + 0x30]
movabs rdx, 0xf761aa025fbf6c19
mov qword [rsp + 0x1a], rdx
mov word [rsp + 0x22], 0x8469
movabs rdx, 0x204090909020500
mov qword [rsp + 0x24], rdx
mov dword [rsp + 0x2c], 0x70709
xor eax, eax
jmp 0x476d63
movzx r9d, byte [rsp + rsi + 0x1a]
add r9d, 0x56
add edx, r9d
mov byte [rsp + rdi + 0x1a], dl
mov byte [rsp + rsi + 0x1a], r8b
add rax, 2
cmp rax, 0xc
jge 0x476d94
movzx edx, byte [rsp + rax + 0x24]
movzx esi, byte [rsp + rax + 0x25]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0xa
jae 0x476dbb
movzx r8d, byte [rsp + rdi + 0x1a]
add r8d, 0x56
add r8d, edx
cmp rsi, 0xa
jb 0x476d49
jmp 0x476daf
xor eax, eax
lea rbx, [rsp + 0x1a]
mov ecx, 0xa
call fcn.00441820
mov rbp, qword [rsp + 0x30]
add rsp, 0x38
ret
mov eax, esi
mov ecx, 0xa
call fcn.00453360
mov eax, edi
mov ecx, 0xa
call fcn.00453360
nop
call fcn.00450d00
jmp fcn.00476d00

Function at 0x4774e0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4775d6
sub rsp, 0x50
mov qword [rsp + 0x48], rbp
lea rbp, [rsp + 0x48]
movabs rdx, 0x8b88747d9c718799
mov qword [rsp + 0x1f], rdx
movabs rdx, 0xb78b88747d9c7187
mov qword [rsp + 0x20], rdx
movabs rdx, 0x76e59b968c728585
mov qword [rsp + 0x28], rdx
movabs rdx, 0x70d03060910070f
mov qword [rsp + 0x30], rdx
movabs rdx, 0x40d0c0d0c080600
mov qword [rsp + 0x38], rdx
movabs rdx, 0x5010c020e0a050e
mov qword [rsp + 0x40], rdx
xor eax, eax
jmp 0x477570
movzx r9d, byte [rsp + rsi + 0x1f]
add r9d, 0xffffffce
add edx, r9d
mov byte [rsp + rdi + 0x1f], dl
mov byte [rsp + rsi + 0x1f], r8b
add rax, 2
cmp rax, 0x18
jge 0x4775a2
movzx edx, byte [rsp + rax + 0x30]
movzx esi, byte [rsp + rax + 0x31]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x11
jae 0x4775c9
movzx r8d, byte [rsp + rdi + 0x1f]
add r8d, 0xffffffce
add r8d, edx
cmp rsi, 0x11
jb 0x477556
nop
jmp 0x4775bd
xor eax, eax
lea rbx, [rsp + 0x1f]
mov ecx, 0x11
call fcn.00441820
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
mov eax, esi
mov ecx, 0x11
call fcn.00453360
mov eax, edi
mov ecx, 0x11
call fcn.00453360
nop
call fcn.00450d00
nop dword [rax + rax]
jmp fcn.004774e0
Function at 0x478140
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x47821c
sub rsp, 0x40
mov qword [rsp + 0x38], rbp
lea rbp, [rsp + 0x38]
movabs rdx, 0x5f4a65fd8961a2e0
mov qword [rsp + 0x19], rdx
movabs rdx, 0x6976c46c68e7b85f
mov qword [rsp + 0x20], rdx
movabs rdx, 0x8060900040c0306
mov qword [rsp + 0x28], rdx
movabs rdx, 0x9000c010c030008
mov qword [rsp + 0x30], rdx
xor eax, eax
jmp 0x4781b2
movzx r9d, byte [rsp + rsi + 0x19]
add r9d, 0xffffffa6
add edx, r9d
mov byte [rsp + rdi + 0x19], dl
mov byte [rsp + rsi + 0x19], r8b
add rax, 2
cmp rax, 0x10
jge 0x4781e8
movzx edx, byte [rsp + rax + 0x28]
movzx esi, byte [rsp + rax + 0x29]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0xf
jae 0x47820f
movzx r8d, byte [rsp + rdi + 0x19]
add r8d, 0xffffffa6
add r8d, edx
nop dword [rax + rax]
cmp rsi, 0xf
jb 0x478198
jmp 0x478203
xor eax, eax
lea rbx, [rsp + 0x19]
mov ecx, 0xf
call fcn.00441820
mov rbp, qword [rsp + 0x38]
add rsp, 0x40
ret
mov eax, esi
mov ecx, 0xf
call fcn.00453360
mov eax, edi
mov ecx, 0xf
call fcn.00453360
nop
nop dword [rax]
call fcn.00450d00
jmp fcn.00478140

Function at 0x478f20
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x478fe6
sub rsp, 0x38
mov qword [rsp + 0x30], rbp
lea rbp, [rsp + 0x30]
movabs rdx, 0x744869fc5f69b002
mov qword [rsp + 0x1e], rdx
movabs rdx, 0x404060006060100
mov qword [rsp + 0x26], rdx
mov word [rsp + 0x2e], 0
xor eax, eax
nop
jmp 0x478f80
movzx r9d, byte [rsp + rsi + 0x1e]
sub r9d, edx
lea edx, [r9 + 0x60]
mov byte [rsp + rdi + 0x1e], dl
lea edx, [r8 + 0x60]
mov byte [rsp + rsi + 0x1e], dl
add rax, 2
nop
cmp rax, 0xa
jge 0x478fad
movzx edx, byte [rsp + rax + 0x26]
movzx esi, byte [rsp + rax + 0x27]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 8
jae 0x478fd4
movzx r8d, byte [rsp + rdi + 0x1e]
sub r8d, edx
cmp rsi, 8
jb 0x478f62
jmp 0x478fc8
xor eax, eax
lea rbx, [rsp + 0x1e]
mov ecx, 8
call fcn.00441820
mov rbp, qword [rsp + 0x30]
add rsp, 0x38
ret
mov eax, esi
mov ecx, 8
call fcn.00453360
mov eax, edi
mov ecx, 8
nop dword [rax + rax]
call fcn.00453360
nop
call fcn.00450d00
jmp fcn.00478f20

Function at 0x479ca0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x479d68
sub rsp, 0x38
mov qword [rsp + 0x30], rbp
lea rbp, [rsp + 0x30]
movabs rdx, 0x18226365137f65a1
mov qword [rsp + 0x1a], rdx
mov word [rsp + 0x22], 0x6403
movabs rdx, 0x208060003060703
mov qword [rsp + 0x24], rdx
mov dword [rsp + 0x2c], 0x6080603
xor eax, eax
jmp 0x479d03
movzx r9d, byte [rsp + rsi + 0x1a]
add r9d, 0x5d
add edx, r9d
mov byte [rsp + rdi + 0x1a], dl
mov byte [rsp + rsi + 0x1a], r8b
add rax, 2
cmp rax, 0xc
jge 0x479d34
movzx edx, byte [rsp + rax + 0x24]
movzx esi, byte [rsp + rax + 0x25]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0xa
jae 0x479d5b
movzx r8d, byte [rsp + rdi + 0x1a]
add r8d, 0x5d
add r8d, edx
cmp rsi, 0xa
jb 0x479ce9
jmp 0x479d4f
xor eax, eax
lea rbx, [rsp + 0x1a]
mov ecx, 0xa
call fcn.00441820
mov rbp, qword [rsp + 0x30]
add rsp, 0x38
ret
mov eax, esi
mov ecx, 0xa
call fcn.00453360
mov eax, edi
mov ecx, 0xa
call fcn.00453360
nop
call fcn.00450d00
jmp fcn.00479ca0
Function at 0x47b040
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x47b172
sub rsp, 0x68
mov qword [rsp + 0x60], rbp
lea rbp, [rsp + 0x60]
movabs rdx, 0xf0986972f0edf34f
mov qword [rsp + 0x1a], rdx
movabs rdx, 0x6107f0986972f0ed
mov qword [rsp + 0x1c], rdx
movabs rdx, 0x196e6449e6746c72
mov qword [rsp + 0x24], rdx
movabs rdx, 0xf2e4f4dd6c79ea72
mov qword [rsp + 0x2c], rdx
movabs rdx, 0xa196c5b8505fde64
mov qword [rsp + 0x34], rdx
movabs rdx, 0x140a0f131f20190a
mov qword [rsp + 0x3c], rdx
movabs rdx, 0xd050d14140a0f13
mov qword [rsp + 0x40], rdx
movabs rdx, 0x11210a0120081e18
mov qword [rsp + 0x48], rdx
movabs rdx, 0x1b06170d051f1316
mov qword [rsp + 0x50], rdx
movabs rdx, 0x11190207031b0308
mov qword [rsp + 0x58], rdx
xor eax, eax
jmp 0x47b10f
movzx r9d, byte [rsp + rsi + 0x1a]
sub r9d, edx
lea edx, [r9 - 0x63]
mov byte [rsp + rdi + 0x1a], dl
lea edx, [r8 - 0x63]
mov byte [rsp + rsi + 0x1a], dl
add rax, 2
cmp rax, 0x24
jge 0x47b13c
movzx edx, byte [rsp + rax + 0x3c]
movzx esi, byte [rsp + rax + 0x3d]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x22
jae 0x47b165
movzx r8d, byte [rsp + rdi + 0x1a]
sub r8d, edx
cmp rsi, 0x22
jb 0x47b0f2
jmp 0x47b157
xor eax, eax
lea rbx, [rsp + 0x1a]
mov ecx, 0x22
call fcn.00441820
mov rbp, qword [rsp + 0x60]
add rsp, 0x68
ret
mov eax, esi
mov ecx, 0x22
nop
call fcn.00453360
mov eax, edi
mov ecx, 0x22
call fcn.00453360
nop
call fcn.00450d00
jmp fcn.0047b040
Function at 0x483cc0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x483da8
sub rsp, 0x48
mov qword [rsp + 0x40], rbp
lea rbp, [rsp + 0x40]
movabs rdx, 0x7df47a9361ef6efc
mov qword [rsp + 0x1e], rdx
movabs rdx, 0x72f074db02447df4
mov qword [rsp + 0x24], rdx
movabs rdx, 0x5080900070a0400
mov qword [rsp + 0x2c], rdx
movabs rdx, 0xa05060505080900
mov qword [rsp + 0x30], rdx
movabs rdx, 0xc0a0208090a0a05
mov qword [rsp + 0x38], rdx
xor eax, eax
jmp 0x483d41
movzx r9d, byte [rsp + rsi + 0x1e]
add r9d, 0x66
add edx, r9d
mov byte [rsp + rdi + 0x1e], dl
mov byte [rsp + rsi + 0x1e], r8b
add rax, 2
cmp rax, 0x14
jge 0x483d72
movzx edx, byte [rsp + rax + 0x2c]
movzx esi, byte [rsp + rax + 0x2d]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0xe
jae 0x483d9b
movzx r8d, byte [rsp + rdi + 0x1e]
add r8d, 0x66
add r8d, edx
cmp rsi, 0xe
jb 0x483d27
jmp 0x483d8f
xor eax, eax
lea rbx, [rsp + 0x1e]
mov ecx, 0xe
nop
call fcn.00441820
mov rbp, qword [rsp + 0x40]
add rsp, 0x48
ret
mov eax, esi
mov ecx, 0xe
call fcn.00453360
mov eax, edi
mov ecx, 0xe
call fcn.00453360
nop
call fcn.00450d00
jmp fcn.00483cc0

Function at 0x484540
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x484648
sub rsp, 0x68
mov qword [rsp + 0x60], rbp
lea rbp, [rsp + 0x60]
movzx edx, byte [rax + 0x14]
movzx esi, word [rax + 0x32]
and esi, 0x7fff
test si, si
je 0x48459d
movabs rdi, 0xaf4a8cb50803021c
mov qword [rsp + 0x34], rdi
mov dword [rsp + 0x3c], 0x996788cf
movabs rdi, 0xdb24f9da4b777773
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x30], 0xa947b6ef
xor ecx, ecx
jmp 0x4845c4
xor eax, eax
xor ebx, ebx
mov rcx, rbx
mov rbp, qword [rsp + 0x60]
add rsp, 0x68
ret
movzx edi, byte [rsp + rcx + 0x34]
movzx r8d, byte [rsp + rcx + 0x28]
xor r8d, edi
mov byte [rsp + rcx + 0x28], r8b
inc rcx
cmp rcx, 0xc
jl 0x4845ae
mov qword [rsp + 0x70], rax
mov word [rsp + 0x1e], si
test dl, 1
mov edx, 0x38
mov esi, 0x48
cmovne rdx, rsi
mov qword [rsp + 0x20], rdx
lea rax, [rsp + 0x40]
lea rbx, [rsp + 0x28]
mov ecx, 0xc
call fcn.00441820
mov rdx, qword [rsp + 0x70]
movzx eax, word [rdx + 0x30]
movzx esi, word [rsp + 0x1e]
add esi, eax
mov rdi, qword [rsp + 0x20]
add rdx, rdi
movzx ecx, si
cmp rax, rcx
ja 0x484642
sub rcx, rax
mov rbx, rcx
neg rcx
shl rax, 3
sar rcx, 0x3f
and rax, rcx
add rax, rdx
mov rcx, rbx
mov rbp, qword [rsp + 0x60]
add rsp, 0x68
ret
call fcn.004534a0
nop
mov qword [rsp + 8], rax
call fcn.00450d00
mov rax, qword [rsp + 8]
jmp fcn.00484540
Function at 0x48b500
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x48b652
sub rsp, 0x78
mov qword [rsp + 0x70], rbp
lea rbp, [rsp + 0x70]
movabs rdx, 0xa50d4dd7c965cd6d
mov qword [rsp + 0x19], rdx
movabs rdx, 0x8061a31542a50d4d
mov qword [rsp + 0x1e], rdx
movabs rdx, 0xfaa905d0f776c47f
mov qword [rsp + 0x26], rdx
movabs rdx, 0xeb813c44f9499ade
mov qword [rsp + 0x2e], rdx
movabs rdx, 0x6e6b506c1033ddde
mov qword [rsp + 0x36], rdx
movabs rdx, 0x1812061f1a102204
mov qword [rsp + 0x3e], rdx
movabs rdx, 0x1e0d1812061f1a10
mov qword [rsp + 0x40], rdx
movabs rdx, 0x1009151902021606
mov qword [rsp + 0x48], rdx
movabs rdx, 0x13071d1105112314
mov qword [rsp + 0x50], rdx
movabs rdx, 0x4021f1f1c231301
mov qword [rsp + 0x58], rdx
movabs rdx, 0xa2015100101031e
mov qword [rsp + 0x60], rdx
movabs rdx, 0x181b0a0c1c0e2303
mov qword [rsp + 0x68], rdx
xor eax, eax
jmp 0x48b5ea
movzx r9d, byte [rsp + rsi + 0x19]
add r9d, 0x6c
add edx, r9d
mov byte [rsp + rdi + 0x19], dl
mov byte [rsp + rsi + 0x19], r8b
add rax, 2
cmp rax, 0x32
jge 0x48b61b
movzx edx, byte [rsp + rax + 0x3e]
movzx esi, byte [rsp + rax + 0x3f]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x25
jae 0x48b645
movzx r8d, byte [rsp + rdi + 0x19]
add r8d, 0x6c
add r8d, edx
cmp rsi, 0x25
jb 0x48b5d0
jmp 0x48b636
xor eax, eax
lea rbx, [rsp + 0x19]
mov ecx, 0x25
call fcn.00441820
mov rbp, qword [rsp + 0x70]
add rsp, 0x78
ret
mov eax, esi
mov ecx, 0x25
nop dword [rax]
call fcn.00453360
mov eax, edi
mov ecx, 0x25
call fcn.00453360
nop
call fcn.00450d00
jmp fcn.0048b500

Function at 0x48b660
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x48b792
sub rsp, 0x70
mov qword [rsp + 0x68], rbp
lea rbp, [rsp + 0x68]
movabs rdx, 0x4120b26fc3f11b2f
mov qword [rsp + 0x1b], rdx
movabs rdx, 0x2aa320e2424120b2
mov qword [rsp + 0x20], rdx
movabs rdx, 0x2065026cf3ef3764
mov qword [rsp + 0x28], rdx
movabs rdx, 0x6ef69a47549a048c
mov qword [rsp + 0x30], rdx
movabs rdx, 0x131699761200c8b
mov qword [rsp + 0x38], rdx
movabs rdx, 0x1b05171d0309020f
mov qword [rsp + 0x40], rdx
movabs rdx, 0x160e1d001a18210b
mov qword [rsp + 0x48], rdx
movabs rdx, 0x121d0e0015150019
mov qword [rsp + 0x50], rdx
movabs rdx, 0x1a1600151e011910
mov qword [rsp + 0x58], rdx
movabs rdx, 0x230c0b1724211a12
mov qword [rsp + 0x60], rdx
xor eax, eax
jmp 0x48b72f
movzx r9d, byte [rsp + rsi + 0x1b]
sub r9d, edx
lea edx, [r9 - 0x6e]
mov byte [rsp + rdi + 0x1b], dl
lea edx, [r8 - 0x6e]
mov byte [rsp + rsi + 0x1b], dl
add rax, 2
cmp rax, 0x28
jge 0x48b75c
movzx edx, byte [rsp + rax + 0x40]
movzx esi, byte [rsp + rax + 0x41]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x25
jae 0x48b785
movzx r8d, byte [rsp + rdi + 0x1b]
sub r8d, edx
cmp rsi, 0x25
jb 0x48b712
jmp 0x48b777
xor eax, eax
lea rbx, [rsp + 0x1b]
mov ecx, 0x25
call fcn.00441820
mov rbp, qword [rsp + 0x68]
add rsp, 0x70
ret
mov eax, esi
mov ecx, 0x25
nop
call fcn.00453360
mov eax, edi
mov ecx, 0x25
call fcn.00453360
nop
call fcn.00450d00
jmp fcn.0048b660
Function at 0x48c5a0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x48c6a8
sub rsp, 0x58
mov qword [rsp + 0x50], rbp
lea rbp, [rsp + 0x50]
movabs rdx, 0x24111e7033a0c321
mov qword [rsp + 0x1d], rdx
movabs rdx, 0xe9762ff02224111e
mov qword [rsp + 0x22], rdx
movabs rdx, 0x708db9be2522d017
mov qword [rsp + 0x2a], rdx
movabs rdx, 0xe1012030a020606
mov qword [rsp + 0x32], rdx
movabs rdx, 0x1313010903060c00
mov qword [rsp + 0x3a], rdx
movabs rdx, 0x130a06070f081313
mov qword [rsp + 0x40], rdx
movabs rdx, 0x1309050d00011311
mov qword [rsp + 0x48], rdx
xor eax, eax
jmp 0x48c640
movzx r9d, byte [rsp + rsi + 0x1d]
add r9d, 0x2c
add edx, r9d
mov byte [rsp + rdi + 0x1d], dl
mov byte [rsp + rsi + 0x1d], r8b
add rax, 2
nop
cmp rax, 0x1e
jge 0x48c671
movzx edx, byte [rsp + rax + 0x32]
movzx esi, byte [rsp + rax + 0x33]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x15
jae 0x48c69b
movzx r8d, byte [rsp + rdi + 0x1d]
add r8d, 0x2c
add r8d, edx
cmp rsi, 0x15
jb 0x48c625
jmp 0x48c68f
xor eax, eax
lea rbx, [rsp + 0x1d]
mov ecx, 0x15
nop dword [rax]
call fcn.00441820
mov rbp, qword [rsp + 0x50]
add rsp, 0x58
ret
mov eax, esi
mov ecx, 0x15
call fcn.00453360
mov eax, edi
mov ecx, 0x15
call fcn.00453360
nop
call fcn.00450d00
jmp fcn.0048c5a0
Function at 0x48dec0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x48df88
sub rsp, 0x38
mov qword [rsp + 0x30], rbp
lea rbp, [rsp + 0x30]
movabs rdx, 0x5a8f639297b165ae
mov qword [rsp + 0x1d], rdx
mov byte [rsp + 0x25], 0x20
movabs rdx, 0x402070703060400
mov qword [rsp + 0x26], rdx
mov word [rsp + 0x2e], 0x404
xor eax, eax
jmp 0x48df23
movzx r9d, byte [rsp + rsi + 0x1d]
sub r9d, edx
lea edx, [r9 - 0x1c]
mov byte [rsp + rdi + 0x1d], dl
lea edx, [r8 - 0x1c]
mov byte [rsp + rsi + 0x1d], dl
add rax, 2
cmp rax, 0xa
jge 0x48df50
movzx edx, byte [rsp + rax + 0x26]
movzx esi, byte [rsp + rax + 0x27]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 9
jae 0x48df7b
movzx r8d, byte [rsp + rdi + 0x1d]
sub r8d, edx
cmp rsi, 9
jb 0x48df06
jmp 0x48df6f
xor eax, eax
lea rbx, [rsp + 0x1d]
mov ecx, 9
nop dword [rax]
call fcn.00441820
mov rbp, qword [rsp + 0x30]
add rsp, 0x38
ret
mov eax, esi
mov ecx, 9
call fcn.00453360
mov eax, edi
mov ecx, 9
call fcn.00453360
nop
call fcn.00450d00
jmp fcn.0048dec0

Function at 0x48fd80
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x48fe48
sub rsp, 0x38
mov qword [rsp + 0x30], rbp
lea rbp, [rsp + 0x30]
movabs rdx, 0xe478dea0e9646108
mov qword [rsp + 0x1d], rdx
mov byte [rsp + 0x25], 0xf5
movabs rdx, 0x807000704030506
mov qword [rsp + 0x26], rdx
mov word [rsp + 0x2e], 0x508
xor eax, eax
jmp 0x48fde3
movzx r9d, byte [rsp + rsi + 0x1d]
sub r9d, edx
lea edx, [r9 - 0x77]
mov byte [rsp + rdi + 0x1d], dl
lea edx, [r8 - 0x77]
mov byte [rsp + rsi + 0x1d], dl
add rax, 2
cmp rax, 0xa
jge 0x48fe10
movzx edx, byte [rsp + rax + 0x26]
movzx esi, byte [rsp + rax + 0x27]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 9
jae 0x48fe3b
movzx r8d, byte [rsp + rdi + 0x1d]
sub r8d, edx
cmp rsi, 9
jb 0x48fdc6
jmp 0x48fe2f
xor eax, eax
lea rbx, [rsp + 0x1d]
mov ecx, 9
nop dword [rax]
call fcn.00441820
mov rbp, qword [rsp + 0x30]
add rsp, 0x38
ret
mov eax, esi
mov ecx, 9
call fcn.00453360
mov eax, edi
mov ecx, 9
call fcn.00453360
nop
call fcn.00450d00
jmp fcn.0048fd80
Function at 0x490ac0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x490be8
sub rsp, 0x68
mov qword [rsp + 0x60], rbp
lea rbp, [rsp + 0x60]
movabs rdx, 0xa4af6365c921d972
mov qword [rsp + 0x1a], rdx
movabs rdx, 0x2fc67206f5f0c26e
mov qword [rsp + 0x22], rdx
movabs rdx, 0x99bb56e615ee13a
mov qword [rsp + 0x2a], rdx
movabs rdx, 0x208bbcd8b43120fb
mov qword [rsp + 0x32], rdx
movabs rdx, 0x61d1b09030e1c0c
mov qword [rsp + 0x3a], rdx
movabs rdx, 0xb0f170b0b1a061d
mov qword [rsp + 0x40], rdx
movabs rdx, 0xb171e0c021a1a01
mov qword [rsp + 0x48], rdx
movabs rdx, 0x170a14151a0a1815
mov qword [rsp + 0x50], rdx
movabs rdx, 0x7121c1a16021102
mov qword [rsp + 0x58], rdx
xor eax, eax
jmp 0x490b80
movzx r9d, byte [rsp + rsi + 0x1a]
add r9d, 0xffffff97
add edx, r9d
mov byte [rsp + rdi + 0x1a], dl
mov byte [rsp + rsi + 0x1a], r8b
add rax, 2
nop dword [rax]
cmp rax, 0x26
jge 0x490bb1
movzx edx, byte [rsp + rax + 0x3a]
movzx esi, byte [rsp + rax + 0x3b]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x20
jae 0x490bdb
movzx r8d, byte [rsp + rdi + 0x1a]
add r8d, 0xffffff97
add r8d, edx
cmp rsi, 0x20
jb 0x490b63
jmp 0x490bcf
xor eax, eax
lea rbx, [rsp + 0x1a]
mov ecx, 0x20
nop dword [rax]
call fcn.00441820
mov rbp, qword [rsp + 0x60]
add rsp, 0x68
ret
mov eax, esi
mov ecx, 0x20
call fcn.00453360
mov eax, edi
mov ecx, 0x20
call fcn.00453360
nop
call fcn.00450d00
jmp fcn.00490ac0

Function at 0x492540
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x492692
add rsp, 0xffffffffffffff80
mov qword [rsp + 0x78], rbp
lea rbp, [rsp + 0x78]
movabs rdx, 0xdd2063fb3b1fff31
mov qword [rsp + 0x1b], rdx
movabs rdx, 0xaacaa1e974ce69f7
mov qword [rsp + 0x23], rdx
movabs rdx, 0x722e35f906aacaa1
mov qword [rsp + 0x28], rdx
movabs rdx, 0x36453e4620493f6f
mov qword [rsp + 0x30], rdx
movabs rdx, 0x1804061311f2696c
mov qword [rsp + 0x38], rdx
movabs rdx, 0x7827336e6920646f
mov qword [rsp + 0x40], rdx
movabs rdx, 0x2b1a24212311010e
mov qword [rsp + 0x48], rdx
movabs rdx, 0xf0a07080c112022
mov qword [rsp + 0x50], rdx
movabs rdx, 0x40a2a23160a160d
mov qword [rsp + 0x58], rdx
movabs rdx, 0x30a1f1303101c16
mov qword [rsp + 0x60], rdx
movabs rdx, 0x41b0106171312
mov qword [rsp + 0x68], rdx
movabs rdx, 0x1702191b0e1a0f20
mov qword [rsp + 0x70], rdx
xor eax, eax
jmp 0x49262d
movzx r9d, byte [rsp + rsi + 0x1b]
sub r9d, edx
lea edx, [r9 + 0x5e]
mov byte [rsp + rdi + 0x1b], dl
lea edx, [r8 + 0x5e]
mov byte [rsp + rsi + 0x1b], dl
add rax, 2
cmp rax, 0x30
jge 0x49265a
movzx edx, byte [rsp + rax + 0x48]
movzx esi, byte [rsp + rax + 0x49]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x2d
jae 0x492685
movzx r8d, byte [rsp + rdi + 0x1b]
sub r8d, edx
cmp rsi, 0x2d
jb 0x492610
jmp 0x492675
xor eax, eax
lea rbx, [rsp + 0x1b]
mov ecx, 0x2d
call fcn.00441820
mov rbp, qword [rsp + 0x78]
sub rsp, 0xffffffffffffff80
ret
mov eax, esi
mov ecx, 0x2d
nop dword [rax]
call fcn.00453360
mov eax, edi
mov ecx, 0x2d
call fcn.00453360
nop
call fcn.00450d00
jmp fcn.00492540
Function at 0x492c40
Capabilities:
Encrypt data using rc4 prga

Disassembly:
lea r12, [rsp - 0x18]
cmp r12, qword [r14 + 0x10]
jbe 0x492dd6
sub rsp, 0x98
mov qword [rsp + 0x90], rbp
lea rbp, [rsp + 0x90]
movabs rdx, 0x30743c3f6c553146
mov qword [rsp + 0x1d], rdx
movabs rdx, 0x6575fd2f0e30743c
mov qword [rsp + 0x22], rdx
movabs rdx, 0x39382af7ec4f052e
mov qword [rsp + 0x2a], rdx
movabs rdx, 0xb4c5e3b48233b10
mov qword [rsp + 0x32], rdx
movabs rdx, 0x64fc691a136369e6
mov qword [rsp + 0x3a], rdx
movabs rdx, 0x6f15df156f203120
mov qword [rsp + 0x42], rdx
movabs rdx, 0x73b26e496f012002
mov qword [rsp + 0x4a], rdx
movabs rdx, 0x1a09132101312a10
mov qword [rsp + 0x52], rdx
movabs rdx, 0xe190814260a2b25
mov qword [rsp + 0x5a], rdx
movabs rdx, 0xe0a2f052a180e19
mov qword [rsp + 0x60], rdx
movabs rdx, 0x1d2d121831153307
mov qword [rsp + 0x68], rdx
movabs rdx, 0x180821200f02071c
mov qword [rsp + 0x70], rdx
movabs rdx, 0x31231d04101b1c31
mov qword [rsp + 0x78], rdx
movabs rdx, 0x192d000a1125311a
mov qword [rsp + 0x80], rdx
movabs rdx, 0x1612261729052525
mov qword [rsp + 0x88], rdx
xor eax, eax
jmp 0x492d6b
movzx r9d, byte [rsp + rsi + 0x1d]
add r9d, 0xffffffea
add edx, r9d
mov byte [rsp + rdi + 0x1d], dl
mov byte [rsp + rsi + 0x1d], r8b
add rax, 2
cmp rax, 0x3e
jge 0x492d9c
movzx edx, byte [rsp + rax + 0x52]
movzx esi, byte [rsp + rax + 0x53]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x35
jae 0x492dc9
movzx r8d, byte [rsp + rdi + 0x1d]
add r8d, 0xffffffea
add r8d, edx
cmp rsi, 0x35
jb 0x492d51
jmp 0x492dbd
xor eax, eax
lea rbx, [rsp + 0x1d]
mov ecx, 0x35
call fcn.00441820
mov rbp, qword [rsp + 0x90]
add rsp, 0x98
ret
mov eax, esi
mov ecx, 0x35
call fcn.00453360
mov eax, edi
mov ecx, 0x35
call fcn.00453360
nop
call fcn.00450d00
nop dword [rax + rax]
jmp fcn.00492c40