joyce8/EMBER2024-capa huggingface dataset:
Function at 0x45da80
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x45db7d
push rbp
mov rbp, rsp
sub rsp, 0x50
movabs rdx, 0x3036bb3730aa3835
mov qword [rsp + 0x1e], rdx
movabs rdx, 0x17af9fb8343fc0a3
mov qword [rsp + 0x26], rdx
movabs rdx, 0x56c3b0af36b2cfbd
mov qword [rsp + 0x2e], rdx
movabs rdx, 0x802110a1509170e
mov qword [rsp + 0x36], rdx
movabs rdx, 0xa100f0d100e0c15
mov qword [rsp + 0x3e], rdx
movabs rdx, 0xd0d0a100f0d100e
mov qword [rsp + 0x40], rdx
movabs rdx, 0x100a12140511160c
mov qword [rsp + 0x48], rdx
xor eax, eax
jmp 0x45db20
movzx r9d, byte [rsp + rsi + 0x1e]
sub r9d, edx
lea edx, [r9 - 0x61]
mov byte [rsp + rdi + 0x1e], dl
lea edx, [r8 - 0x61]
mov byte [rsp + rsi + 0x1e], dl
add rax, 2
nop dword [rax]
cmp rax, 0x1a
jge 0x45db4d
movzx edx, byte [rsp + rax + 0x36]
movzx esi, byte [rsp + rax + 0x37]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x18
jae 0x45db70
movzx r8d, byte [rsp + rdi + 0x1e]
sub r8d, edx
cmp rsi, 0x18
jb 0x45daff
jmp 0x45db64
xor eax, eax
lea rbx, [rsp + 0x1e]
mov ecx, 0x18
call fcn.00441380
add rsp, 0x50
pop rbp
ret
mov eax, esi
mov ecx, 0x18
call fcn.00451880
mov eax, edi
mov ecx, 0x18
call fcn.00451880
nop
nop dword [rax]
call fcn.0044f600
jmp fcn.0045da80
Function at 0x46eb80
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x46ec7b
push rbp
mov rbp, rsp
sub rsp, 0x48
movabs rdx, 0x6169749023dd1341
mov qword [rsp + 0x19], rdx
movabs rdx, 0xc3ddd5da6e616974
mov qword [rsp + 0x1e], rdx
movabs rdx, 0x736823bfa2876f72
mov qword [rsp + 0x26], rdx
movabs rdx, 0x9020f0504120b02
mov qword [rsp + 0x2e], rdx
movabs rdx, 0xf0a0f1011030312
mov qword [rsp + 0x36], rdx
movabs rdx, 0xb0c0f0a0f101103
mov qword [rsp + 0x38], rdx
movabs rdx, 0xf03020b10010205
mov qword [rsp + 0x40], rdx
xor eax, eax
jmp 0x46ec19
movzx r9d, byte [rsp + rsi + 0x19]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x34]
mov byte [rsp + rdi + 0x19], dl
mov byte [rsp + rsi + 0x19], r8b
add rax, 2
cmp rax, 0x1a
jge 0x46ec4b
movzx edx, byte [rsp + rax + 0x2e]
movzx esi, byte [rsp + rax + 0x2f]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x15
jae 0x46ec6e
movzx r8d, byte [rsp + rdi + 0x19]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x34]
cmp rsi, 0x15
jb 0x46ebff
jmp 0x46ec62
xor eax, eax
lea rbx, [rsp + 0x19]
mov ecx, 0x15
call fcn.00441380
add rsp, 0x48
pop rbp
ret
mov eax, esi
mov ecx, 0x15
call fcn.00451880
mov eax, edi
mov ecx, 0x15
call fcn.00451880
nop
nop dword [rax + rax]
call fcn.0044f600
jmp fcn.0046eb80

Function at 0x46efe0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x46f09d
push rbp
mov rbp, rsp
sub rsp, 0x30
movabs rdx, 0x9ca173916961026e
mov qword [rsp + 0x1d], rdx
mov byte [rsp + 0x25], 0xc
movabs rdx, 0x6010707040006
mov qword [rsp + 0x26], rdx
mov word [rsp + 0x2e], 0x408
xor eax, eax
nop
jmp 0x46f040
movzx r9d, byte [rsp + rsi + 0x1d]
sub r9d, edx
lea edx, [r9 + 0x73]
mov byte [rsp + rdi + 0x1d], dl
lea edx, [r8 + 0x73]
mov byte [rsp + rsi + 0x1d], dl
add rax, 2
nop
cmp rax, 0xa
jge 0x46f06d
movzx edx, byte [rsp + rax + 0x26]
movzx esi, byte [rsp + rax + 0x27]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 9
jae 0x46f090
movzx r8d, byte [rsp + rdi + 0x1d]
sub r8d, edx
cmp rsi, 9
jb 0x46f022
jmp 0x46f084
xor eax, eax
lea rbx, [rsp + 0x1d]
mov ecx, 9
call fcn.00441380
add rsp, 0x30
pop rbp
ret
mov eax, esi
mov ecx, 9
call fcn.00451880
mov eax, edi
mov ecx, 9
call fcn.00451880
nop
nop dword [rax]
call fcn.0044f600
jmp fcn.0046efe0
Function at 0x46f700
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x46f7b8
push rbp
mov rbp, rsp
sub rsp, 0x30
movabs rdx, 0x65f28e6f8df21543
mov qword [rsp + 0x1e], rdx
movabs rdx, 0x606020302050102
mov qword [rsp + 0x26], rdx
mov word [rsp + 0x2e], 0x502
xor eax, eax
jmp 0x46f758
movzx r9d, byte [rsp + rsi + 0x1e]
sub r9d, edx
lea edx, [r9 + 0x79]
mov byte [rsp + rdi + 0x1e], dl
lea edx, [r8 + 0x79]
mov byte [rsp + rsi + 0x1e], dl
add rax, 2
cmp rax, 0xa
jge 0x46f788
movzx edx, byte [rsp + rax + 0x26]
movzx esi, byte [rsp + rax + 0x27]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 8
jae 0x46f7ab
movzx r8d, byte [rsp + rdi + 0x1e]
sub r8d, edx
nop dword [rax]
cmp rsi, 8
jb 0x46f73b
jmp 0x46f79f
xor eax, eax
lea rbx, [rsp + 0x1e]
mov ecx, 8
call fcn.00441380
add rsp, 0x30
pop rbp
ret
mov eax, esi
mov ecx, 8
call fcn.00451880
mov eax, edi
mov ecx, 8
call fcn.00451880
nop
call fcn.0044f600
nop dword [rax]
jmp fcn.0046f700

Function at 0x470f40
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x470ff2
push rbp
mov rbp, rsp
sub rsp, 0x28
movabs rdx, 0x6968786e6d724c76
mov qword [rsp + 0x20], rdx
movabs rdx, 0x104050004000105
mov qword [rsp + 0x18], rdx
xor eax, eax
jmp 0x470f8e
movzx r9d, byte [rsp + rsi + 0x20]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x77]
mov byte [rsp + rdi + 0x20], dl
mov byte [rsp + rsi + 0x20], r8b
add rax, 2
cmp rax, 8
jge 0x470fc2
movzx edx, byte [rsp + rax + 0x18]
movzx esi, byte [rsp + rax + 0x19]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 8
jae 0x470fe5
movzx r8d, byte [rsp + rdi + 0x20]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x77]
cmp rsi, 8
jb 0x470f74
nop
jmp 0x470fd9
xor eax, eax
lea rbx, [rsp + 0x20]
mov ecx, 8
call fcn.00441380
add rsp, 0x28
pop rbp
ret
mov eax, esi
mov ecx, 8
call fcn.00451880
mov eax, edi
mov ecx, 8
call fcn.00451880
nop
call fcn.0044f600
jmp fcn.00470f40

Function at 0x472700
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4727b2
push rbp
mov rbp, rsp
sub rsp, 0x28
movabs rdx, 0x5a5f7256294b694c
mov qword [rsp + 0x20], rdx
movabs rdx, 0x404020703070302
mov qword [rsp + 0x18], rdx
xor eax, eax
jmp 0x472751
movzx r9d, byte [rsp + rsi + 0x20]
sub r9d, edx
lea edx, [r9 + 0x11]
mov byte [rsp + rdi + 0x20], dl
lea edx, [r8 + 0x11]
mov byte [rsp + rsi + 0x20], dl
add rax, 2
cmp rax, 8
jge 0x47277e
movzx edx, byte [rsp + rax + 0x18]
movzx esi, byte [rsp + rax + 0x19]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 8
jae 0x4727a5
movzx r8d, byte [rsp + rdi + 0x20]
sub r8d, edx
cmp rsi, 8
jb 0x472734
jmp 0x472795
xor eax, eax
lea rbx, [rsp + 0x20]
mov ecx, 8
call fcn.00441380
add rsp, 0x28
pop rbp
ret
mov eax, esi
mov ecx, 8
nop dword [rax]
call fcn.00451880
mov eax, edi
mov ecx, 8
call fcn.00451880
nop
call fcn.0044f600
jmp fcn.00472700
Function at 0x472d20
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x472df2
push rbp
mov rbp, rsp
sub rsp, 0x38
movabs rdx, 0xc392f0c78d776193
mov qword [rsp + 0x1d], rdx
movabs rdx, 0xc6906e6f47c392f0
mov qword [rsp + 0x22], rdx
movabs rdx, 0x5030607000c0705
mov qword [rsp + 0x2a], rdx
movabs rdx, 0x20000040b060503
mov qword [rsp + 0x30], rdx
xor eax, eax
jmp 0x472d8c
movzx r9d, byte [rsp + rsi + 0x1d]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x38]
mov byte [rsp + rdi + 0x1d], dl
mov byte [rsp + rsi + 0x1d], r8b
add rax, 2
cmp rax, 0xe
jge 0x472dbe
movzx edx, byte [rsp + rax + 0x2a]
movzx esi, byte [rsp + rax + 0x2b]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0xd
jae 0x472de5
movzx r8d, byte [rsp + rdi + 0x1d]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x38]
cmp rsi, 0xd
jb 0x472d72
jmp 0x472dd5
xor eax, eax
lea rbx, [rsp + 0x1d]
mov ecx, 0xd
call fcn.00441380
add rsp, 0x38
pop rbp
ret
mov eax, esi
mov ecx, 0xd
nop dword [rax]
call fcn.00451880
mov eax, edi
mov ecx, 0xd
call fcn.00451880
nop
call fcn.0044f600
jmp fcn.00472d20

Function at 0x473540
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x47361d
push rbp
mov rbp, rsp
sub rsp, 0x38
movabs rdx, 0x365438652f525449
mov qword [rsp + 0x19], rdx
movabs rdx, 0x36441b5f2e365438
mov qword [rsp + 0x1e], rdx
movabs rdx, 0x80b0a010b050c08
mov qword [rsp + 0x26], rdx
movabs rdx, 0x3080b0a010b05
mov qword [rsp + 0x28], rdx
movabs rdx, 0x6070c0509020001
mov qword [rsp + 0x30], rdx
xor eax, eax
nop
jmp 0x4735c0
movzx r9d, byte [rsp + rsi + 0x19]
sub r9d, edx
lea edx, [r9 + 0x26]
mov byte [rsp + rdi + 0x19], dl
lea edx, [r8 + 0x26]
mov byte [rsp + rsi + 0x19], dl
add rax, 2
nop
cmp rax, 0x12
jge 0x4735ed
movzx edx, byte [rsp + rax + 0x26]
movzx esi, byte [rsp + rax + 0x27]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0xd
jae 0x473610
movzx r8d, byte [rsp + rdi + 0x19]
sub r8d, edx
cmp rsi, 0xd
jb 0x4735a2
jmp 0x473604
xor eax, eax
lea rbx, [rsp + 0x19]
mov ecx, 0xd
call fcn.00441380
add rsp, 0x38
pop rbp
ret
mov eax, esi
mov ecx, 0xd
call fcn.00451880
mov eax, edi
mov ecx, 0xd
call fcn.00451880
nop
nop dword [rax]
call fcn.0044f600
jmp fcn.00473540
Function at 0x4739a0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x473a66
push rbp
mov rbp, rsp
sub rsp, 0x30
movabs rdx, 0xa09c9f748f62dda2
mov qword [rsp + 0x1d], rdx
mov byte [rsp + 0x25], 0xae
movabs rdx, 0x505080805010003
mov qword [rsp + 0x26], rdx
mov word [rsp + 0x2e], 0x607
xor eax, eax
nop
jmp 0x473a00
movzx r9d, byte [rsp + rsi + 0x1d]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x44]
mov byte [rsp + rdi + 0x1d], dl
mov byte [rsp + rsi + 0x1d], r8b
add rax, 2
nop dword [rax]
cmp rax, 0xa
jge 0x473a32
movzx edx, byte [rsp + rax + 0x26]
movzx esi, byte [rsp + rax + 0x27]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 9
jae 0x473a57
movzx r8d, byte [rsp + rdi + 0x1d]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x44]
cmp rsi, 9
jb 0x4739e2
jmp 0x473a4b
xor eax, eax
lea rbx, [rsp + 0x1d]
mov ecx, 9
nop
call fcn.00441380
add rsp, 0x30
pop rbp
ret
mov eax, esi
mov ecx, 9
call fcn.00451880
mov eax, edi
mov ecx, 9
nop
call fcn.00451880
nop
call fcn.0044f600
jmp fcn.004739a0

Function at 0x473a80
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x473b47
push rbp
mov rbp, rsp
sub rsp, 0x30
movabs rdx, 0x64e04adae265ee4e
mov qword [rsp + 0x19], rdx
movabs rdx, 0x4a576164e04adae2
mov qword [rsp + 0x1c], rdx
movabs rdx, 0x90503060402060a
mov qword [rsp + 0x24], rdx
mov dword [rsp + 0x2c], 0x5010904
xor eax, eax
jmp 0x473ae8
movzx r9d, byte [rsp + rsi + 0x19]
sub r9d, edx
lea edx, [r9 - 0x6b]
mov byte [rsp + rdi + 0x19], dl
lea edx, [r8 - 0x6b]
mov byte [rsp + rsi + 0x19], dl
add rax, 2
cmp rax, 0xc
jge 0x473b17
movzx edx, byte [rsp + rax + 0x24]
movzx esi, byte [rsp + rax + 0x25]
mov edi, edx
xor edx, esi
add edx, eax
nop
cmp rdi, 0xb
jae 0x473b3a
movzx r8d, byte [rsp + rdi + 0x19]
sub r8d, edx
cmp rsi, 0xb
jb 0x473acb
jmp 0x473b2e
xor eax, eax
lea rbx, [rsp + 0x19]
mov ecx, 0xb
call fcn.00441380
add rsp, 0x30
pop rbp
ret
mov eax, esi
mov ecx, 0xb
call fcn.00451880
mov eax, edi
mov ecx, 0xb
call fcn.00451880
nop
call fcn.0044f600
jmp fcn.00473a80

Function at 0x4751c0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x475287
push rbp
mov rbp, rsp
sub rsp, 0x30
movabs rdx, 0x64f5922aa7a290e5
mov qword [rsp + 0x19], rdx
movabs rdx, 0x6e61b564f5922aa7
mov qword [rsp + 0x1c], rdx
movabs rdx, 0x500010601000401
mov qword [rsp + 0x24], rdx
mov dword [rsp + 0x2c], 0x2030108
xor eax, eax
jmp 0x475228
movzx r9d, byte [rsp + rsi + 0x19]
sub r9d, edx
lea edx, [r9 - 0x38]
mov byte [rsp + rdi + 0x19], dl
lea edx, [r8 - 0x38]
mov byte [rsp + rsi + 0x19], dl
add rax, 2
cmp rax, 0xc
jge 0x475257
movzx edx, byte [rsp + rax + 0x24]
movzx esi, byte [rsp + rax + 0x25]
mov edi, edx
xor edx, esi
add edx, eax
nop
cmp rdi, 0xb
jae 0x47527a
movzx r8d, byte [rsp + rdi + 0x19]
sub r8d, edx
cmp rsi, 0xb
jb 0x47520b
jmp 0x47526e
xor eax, eax
lea rbx, [rsp + 0x19]
mov ecx, 0xb
call fcn.00441380
add rsp, 0x30
pop rbp
ret
mov eax, esi
mov ecx, 0xb
call fcn.00451880
mov eax, edi
mov ecx, 0xb
call fcn.00451880
nop
call fcn.0044f600
jmp fcn.004751c0
Function at 0x4756c0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x47577d
push rbp
mov rbp, rsp
sub rsp, 0x30
movabs rdx, 0x6867f655d4acdfb7
mov qword [rsp + 0x26], rdx
mov word [rsp + 0x2e], 0x72e6
movabs rdx, 0x201000800050803
mov qword [rsp + 0x1c], rdx
mov word [rsp + 0x24], 0x203
xor eax, eax
jmp 0x475720
movzx r9d, byte [rsp + rsi + 0x26]
sub r9d, edx
lea edx, [r9 - 0x37]
mov byte [rsp + rdi + 0x26], dl
lea edx, [r8 - 0x37]
mov byte [rsp + rsi + 0x26], dl
add rax, 2
nop
cmp rax, 0xa
jge 0x47574d
movzx edx, byte [rsp + rax + 0x1c]
movzx esi, byte [rsp + rax + 0x1d]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0xa
jae 0x475770
movzx r8d, byte [rsp + rdi + 0x26]
sub r8d, edx
cmp rsi, 0xa
jb 0x475702
jmp 0x475764
xor eax, eax
lea rbx, [rsp + 0x26]
mov ecx, 0xa
call fcn.00441380
add rsp, 0x30
pop rbp
ret
mov eax, esi
mov ecx, 0xa
call fcn.00451880
mov eax, edi
mov ecx, 0xa
call fcn.00451880
nop
nop dword [rax]
call fcn.0044f600
jmp fcn.004756c0

Function at 0x477d80
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x477e46
push rbp
mov rbp, rsp
sub rsp, 0x30
movabs rdx, 0x3ed3636572cc1bca
mov qword [rsp + 0x26], rdx
mov word [rsp + 0x2e], 0x49dc
movabs rdx, 0x802080906010708
mov qword [rsp + 0x1c], rdx
mov word [rsp + 0x24], 6
xor eax, eax
jmp 0x477de0
movzx r9d, byte [rsp + rsi + 0x26]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x77]
mov byte [rsp + rdi + 0x26], dl
mov byte [rsp + rsi + 0x26], r8b
add rax, 2
nop dword [rax]
cmp rax, 0xa
jge 0x477e12
movzx edx, byte [rsp + rax + 0x1c]
movzx esi, byte [rsp + rax + 0x1d]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0xa
jae 0x477e37
movzx r8d, byte [rsp + rdi + 0x26]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x77]
cmp rsi, 0xa
jb 0x477dc2
jmp 0x477e2b
xor eax, eax
lea rbx, [rsp + 0x26]
mov ecx, 0xa
nop
call fcn.00441380
add rsp, 0x30
pop rbp
ret
mov eax, esi
mov ecx, 0xa
call fcn.00451880
mov eax, edi
mov ecx, 0xa
nop
call fcn.00451880
nop
call fcn.0044f600
jmp fcn.00477d80
Function at 0x478e20
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x478f1b
push rbp
mov rbp, rsp
sub rsp, 0x50
movabs rdx, 0x87bb61817ec36fe2
mov qword [rsp + 0x19], rdx
movabs rdx, 0x735a7265647b9687
mov qword [rsp + 0x20], rdx
movabs rdx, 0xab6f9e748696b48b
mov qword [rsp + 0x28], rdx
movabs rdx, 0x2060f0f11100006
mov qword [rsp + 0x30], rdx
movabs rdx, 0x414110c16091206
mov qword [rsp + 0x38], rdx
movabs rdx, 0xc07000904030212
mov qword [rsp + 0x40], rdx
movabs rdx, 0xd0e0e04000f0804
mov qword [rsp + 0x48], rdx
xor eax, eax
jmp 0x478eb9
movzx r9d, byte [rsp + rsi + 0x19]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x36]
mov byte [rsp + rdi + 0x19], dl
mov byte [rsp + rsi + 0x19], r8b
add rax, 2
cmp rax, 0x20
jge 0x478eeb
movzx edx, byte [rsp + rax + 0x30]
movzx esi, byte [rsp + rax + 0x31]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x17
jae 0x478f0e
movzx r8d, byte [rsp + rdi + 0x19]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x36]
cmp rsi, 0x17
jb 0x478e9f
jmp 0x478f02
xor eax, eax
lea rbx, [rsp + 0x19]
mov ecx, 0x17
call fcn.00441380
add rsp, 0x50
pop rbp
ret
mov eax, esi
mov ecx, 0x17
call fcn.00451880
mov eax, edi
mov ecx, 0x17
call fcn.00451880
nop
nop dword [rax + rax]
call fcn.0044f600
jmp fcn.00478e20

Function at 0x479280
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x47935d
push rbp
mov rbp, rsp
sub rsp, 0x40
movabs rdx, 0x26415f60202b744e
mov qword [rsp + 0x1c], rdx
movabs rdx, 0xe1d4e2941616849
mov qword [rsp + 0x24], rdx
movabs rdx, 0x8030d02070f0e0b
mov qword [rsp + 0x2c], rdx
movabs rdx, 0xf00070008030d02
mov qword [rsp + 0x30], rdx
movabs rdx, 0x80d040d0b0d0c
mov qword [rsp + 0x38], rdx
xor eax, eax
nop
jmp 0x479300
movzx r9d, byte [rsp + rsi + 0x1c]
sub r9d, edx
lea edx, [r9 + 0x2d]
mov byte [rsp + rdi + 0x1c], dl
lea edx, [r8 + 0x2d]
mov byte [rsp + rsi + 0x1c], dl
add rax, 2
nop
cmp rax, 0x14
jge 0x47932d
movzx edx, byte [rsp + rax + 0x2c]
movzx esi, byte [rsp + rax + 0x2d]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x10
jae 0x479350
movzx r8d, byte [rsp + rdi + 0x1c]
sub r8d, edx
cmp rsi, 0x10
jb 0x4792e2
jmp 0x479344
xor eax, eax
lea rbx, [rsp + 0x1c]
mov ecx, 0x10
call fcn.00441380
add rsp, 0x40
pop rbp
ret
mov eax, esi
mov ecx, 0x10
call fcn.00451880
mov eax, edi
mov ecx, 0x10
call fcn.00451880
nop
nop dword [rax]
call fcn.0044f600
jmp fcn.00479280
Function at 0x47a220
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x47a31b
push rbp
mov rbp, rsp
sub rsp, 0x48
movabs rdx, 0x856ec27f88749b7e
mov qword [rsp + 0x1b], rdx
movabs rdx, 0xf06857856ec27f88
mov qword [rsp + 0x1e], rdx
movabs rdx, 0xb363618676d299ca
mov qword [rsp + 0x26], rdx
movabs rdx, 0xf0b120f0a0b050d
mov qword [rsp + 0x2e], rdx
movabs rdx, 0xd0f01030f05120e
mov qword [rsp + 0x36], rdx
movabs rdx, 0xc000d0f01030f05
mov qword [rsp + 0x38], rdx
movabs rdx, 0xe0e0e00000a0704
mov qword [rsp + 0x40], rdx
xor eax, eax
jmp 0x47a2b9
movzx r9d, byte [rsp + rsi + 0x1b]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x35]
mov byte [rsp + rdi + 0x1b], dl
mov byte [rsp + rsi + 0x1b], r8b
add rax, 2
cmp rax, 0x1a
jge 0x47a2eb
movzx edx, byte [rsp + rax + 0x2e]
movzx esi, byte [rsp + rax + 0x2f]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x13
jae 0x47a30e
movzx r8d, byte [rsp + rdi + 0x1b]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x35]
cmp rsi, 0x13
jb 0x47a29f
jmp 0x47a302
xor eax, eax
lea rbx, [rsp + 0x1b]
mov ecx, 0x13
call fcn.00441380
add rsp, 0x48
pop rbp
ret
mov eax, esi
mov ecx, 0x13
call fcn.00451880
mov eax, edi
mov ecx, 0x13
call fcn.00451880
nop
nop dword [rax + rax]
call fcn.0044f600
jmp fcn.0047a220
Function at 0x4878c0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4879cc
push rbp
mov rbp, rsp
sub rsp, 0x50
movabs rdx, 0x756e596f7c262740
mov qword [rsp + 0x36], rdx
movabs rdx, 0x6c1b65737c494274
mov qword [rsp + 0x3e], rdx
movabs rdx, 0x74566c1b65737c49
mov qword [rsp + 0x40], rdx
movabs rdx, 0x646e706e4a726074
mov qword [rsp + 0x48], rdx
movabs rdx, 0x20b171106030e0d
mov qword [rsp + 0x1c], rdx
movabs rdx, 0x80302130e0107
mov qword [rsp + 0x24], rdx
movabs rdx, 0x50c00080302130e
mov qword [rsp + 0x26], rdx
movabs rdx, 0x10020c0f0d151616
mov qword [rsp + 0x2e], rdx
xor eax, eax
jmp 0x487968
movzx r9d, byte [rsp + rsi + 0x36]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x15]
mov byte [rsp + rdi + 0x36], dl
mov byte [rsp + rsi + 0x36], r8b
add rax, 2
cmp rax, 0x1a
jge 0x48799c
movzx edx, byte [rsp + rax + 0x1c]
movzx esi, byte [rsp + rax + 0x1d]
mov edi, edx
xor edx, esi
add edx, eax
nop
cmp rdi, 0x1a
jae 0x4879bf
movzx r8d, byte [rsp + rdi + 0x36]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x15]
cmp rsi, 0x1a
jb 0x48794e
jmp 0x4879b3
xor eax, eax
lea rbx, [rsp + 0x36]
mov ecx, 0x1a
call fcn.00441380
add rsp, 0x50
pop rbp
ret
mov eax, esi
mov ecx, 0x1a
call fcn.00451880
mov eax, edi
mov ecx, 0x1a
call fcn.00451880
nop
call fcn.0044f600
jmp fcn.004878c0

Function at 0x489340
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x489448
push rbp
mov rbp, rsp
sub rsp, 0x58
movabs rdx, 0x6126092475a4ee76
mov qword [rsp + 0x1b], rdx
movabs rdx, 0xd0691320b666536d
mov qword [rsp + 0x23], rdx
movabs rdx, 0x72c85d1128d06913
mov qword [rsp + 0x28], rdx
movabs rdx, 0x8165d33066a37462
mov qword [rsp + 0x30], rdx
movabs rdx, 0x12130211130a1c09
mov qword [rsp + 0x38], rdx
movabs rdx, 0xa1a0b0d1c061115
mov qword [rsp + 0x40], rdx
movabs rdx, 0x1050612190f1706
mov qword [rsp + 0x48], rdx
movabs rdx, 0x10191009040d1311
mov qword [rsp + 0x50], rdx
xor eax, eax
jmp 0x4893eb
movzx r9d, byte [rsp + rsi + 0x1b]
sub r9d, edx
lea edx, [r9 + 0x72]
mov byte [rsp + rdi + 0x1b], dl
lea edx, [r8 + 0x72]
mov byte [rsp + rsi + 0x1b], dl
add rax, 2
cmp rax, 0x20
jge 0x489418
movzx edx, byte [rsp + rax + 0x38]
movzx esi, byte [rsp + rax + 0x39]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x1d
jae 0x48943b
movzx r8d, byte [rsp + rdi + 0x1b]
sub r8d, edx
cmp rsi, 0x1d
jb 0x4893ce
jmp 0x48942f
xor eax, eax
lea rbx, [rsp + 0x1b]
mov ecx, 0x1d
call fcn.00441380
add rsp, 0x58
pop rbp
ret
mov eax, esi
mov ecx, 0x1d
call fcn.00451880
mov eax, edi
mov ecx, 0x1d
call fcn.00451880
nop
call fcn.0044f600
jmp fcn.00489340
Function at 0x489b20
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x489bdd
push rbp
mov rbp, rsp
sub rsp, 0x30
movabs rdx, 0xce2763651eb2b172
mov qword [rsp + 0x1b], rdx
mov byte [rsp + 0x23], 0xbf
movabs rdx, 0x307010603080302
mov qword [rsp + 0x24], rdx
mov dword [rsp + 0x2c], 0x6080308
xor eax, eax
nop
jmp 0x489b80
movzx r9d, byte [rsp + rsi + 0x1b]
sub r9d, edx
lea edx, [r9 + 0x49]
mov byte [rsp + rdi + 0x1b], dl
lea edx, [r8 + 0x49]
mov byte [rsp + rsi + 0x1b], dl
add rax, 2
nop
cmp rax, 0xc
jge 0x489bad
movzx edx, byte [rsp + rax + 0x24]
movzx esi, byte [rsp + rax + 0x25]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 9
jae 0x489bd0
movzx r8d, byte [rsp + rdi + 0x1b]
sub r8d, edx
cmp rsi, 9
jb 0x489b62
jmp 0x489bc4
xor eax, eax
lea rbx, [rsp + 0x1b]
mov ecx, 9
call fcn.00441380
add rsp, 0x30
pop rbp
ret
mov eax, esi
mov ecx, 9
call fcn.00451880
mov eax, edi
mov ecx, 9
call fcn.00451880
nop
nop dword [rax]
call fcn.0044f600
jmp fcn.00489b20

Function at 0x489c00
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x489d38
push rbp
mov rbp, rsp
sub rsp, 0x70
movabs rdx, 0xf042d06d5f5b6220
mov qword [rsp + 0x1f], rdx
movabs rdx, 0x6ff042d06d5f5b62
mov qword [rsp + 0x20], rdx
movabs rdx, 0xbae96ee4ececd2fe
mov qword [rsp + 0x28], rdx
movabs rdx, 0xf90ee1b674e413b4
mov qword [rsp + 0x30], rdx
movabs rdx, 0x60d26c14f2fc659f
mov qword [rsp + 0x38], rdx
movabs rdx, 0x201c1210110d1511
mov qword [rsp + 0x40], rdx
movabs rdx, 0x6051c1b17100a06
mov qword [rsp + 0x48], rdx
movabs rdx, 0x1b05130f1d050116
mov qword [rsp + 0x50], rdx
movabs rdx, 0x1f19071119030211
mov qword [rsp + 0x58], rdx
movabs rdx, 0x1c111f1109161d0a
mov qword [rsp + 0x60], rdx
movabs rdx, 0xb050c180d101f02
mov qword [rsp + 0x68], rdx
xor eax, eax
jmp 0x489cd8
movzx r9d, byte [rsp + rsi + 0x1f]
sub r9d, edx
lea edx, [r9 - 0x4b]
mov byte [rsp + rdi + 0x1f], dl
lea edx, [r8 - 0x4b]
mov byte [rsp + rsi + 0x1f], dl
add rax, 2
cmp rax, 0x30
jge 0x489d08
movzx edx, byte [rsp + rax + 0x40]
movzx esi, byte [rsp + rax + 0x41]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x21
jae 0x489d2b
movzx r8d, byte [rsp + rdi + 0x1f]
sub r8d, edx
nop dword [rax]
cmp rsi, 0x21
jb 0x489cbb
jmp 0x489d1f
xor eax, eax
lea rbx, [rsp + 0x1f]
mov ecx, 0x21
call fcn.00441380
add rsp, 0x70
pop rbp
ret
mov eax, esi
mov ecx, 0x21
call fcn.00451880
mov eax, edi
mov ecx, 0x21
call fcn.00451880
nop
call fcn.0044f600
nop dword [rax]
jmp fcn.00489c00
Function at 0x489d60
Capabilities:
Encrypt data using rc4 prga

Disassembly:
lea r12, [rsp - 8]
cmp r12, qword [r14 + 0x10]
jbe 0x489ebd
push rbp
mov rbp, rsp
add rsp, 0xffffffffffffff80
movabs rdx, 0x15236765a9afec2f
mov qword [rsp + 0x1b], rdx
movabs rdx, 0x9eca722aeb6e6932
mov qword [rsp + 0x23], rdx
movabs rdx, 0x72273978e69eca72
mov qword [rsp + 0x28], rdx
movabs rdx, 0x363b0b69ea67726f
mov qword [rsp + 0x30], rdx
movabs rdx, 0xfb74226d3f64696c
mov qword [rsp + 0x38], rdx
movabs rdx, 0x35f9221892885e04
mov qword [rsp + 0x40], rdx
movabs rdx, 0x52628260211170f
mov qword [rsp + 0x48], rdx
movabs rdx, 0x2b26030c29271828
mov qword [rsp + 0x50], rdx
movabs rdx, 0xc1a17240d032529
mov qword [rsp + 0x58], rdx
movabs rdx, 0xf0d0e030327012a
mov qword [rsp + 0x60], rdx
movabs rdx, 0x200b00280e13032a
mov qword [rsp + 0x68], rdx
movabs rdx, 0x1c061b2b12222c0d
mov qword [rsp + 0x70], rdx
movabs rdx, 0x24120810251b0207
mov qword [rsp + 0x78], rdx
xor eax, eax
jmp 0x489e60
movzx r9d, byte [rsp + rsi + 0x1b]
sub r9d, edx
lea edx, [r9 - 0x7a]
mov byte [rsp + rdi + 0x1b], dl
lea edx, [r8 - 0x7a]
mov byte [rsp + rsi + 0x1b], dl
add rax, 2
nop dword [rax + rax]
cmp rax, 0x38
jge 0x489e8d
movzx edx, byte [rsp + rax + 0x48]
movzx esi, byte [rsp + rax + 0x49]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x2d
jae 0x489eb0
movzx r8d, byte [rsp + rdi + 0x1b]
sub r8d, edx
cmp rsi, 0x2d
jb 0x489e3e
jmp 0x489ea4
xor eax, eax
lea rbx, [rsp + 0x1b]
mov ecx, 0x2d
call fcn.00441380
sub rsp, 0xffffffffffffff80
pop rbp
ret
mov eax, esi
mov ecx, 0x2d
call fcn.00451880
mov eax, edi
mov ecx, 0x2d
call fcn.00451880
nop
nop dword [rax]
call fcn.0044f600
jmp fcn.00489d60