joyce8/EMBER2024-capa huggingface dataset:
Function at 0x46a5c0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x46a686
push rbp
mov rbp, rsp
sub rsp, 0x30
movabs rdx, 0xf774acab616de23d
mov qword [rsp + 0x27], rdx
mov byte [rsp + 0x2f], 0xf8
movabs rdx, 0x808070405010007
mov qword [rsp + 0x1b], rdx
mov dword [rsp + 0x23], 0x8040005
xor eax, eax
nop
jmp 0x46a620
movzx r9d, byte [rsp + rsi + 0x27]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x51]
mov byte [rsp + rdi + 0x27], dl
mov byte [rsp + rsi + 0x27], r8b
add rax, 2
nop dword [rax]
cmp rax, 0xc
jge 0x46a652
movzx edx, byte [rsp + rax + 0x1b]
movzx esi, byte [rsp + rax + 0x1c]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 9
jae 0x46a677
movzx r8d, byte [rsp + rdi + 0x27]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x51]
cmp rsi, 9
jb 0x46a602
jmp 0x46a66b
xor eax, eax
lea rbx, [rsp + 0x27]
mov ecx, 9
nop
call fcn.00444780
add rsp, 0x30
pop rbp
ret
mov eax, esi
mov ecx, 9
call fcn.004564a0
mov eax, edi
mov ecx, 9
nop
call fcn.004564a0
nop
call fcn.004541c0
jmp fcn.0046a5c0

Function at 0x46b680
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x46b732
push rbp
mov rbp, rsp
sub rsp, 0x28
movabs rdx, 0xe0ef694cd769c9cc
mov qword [rsp + 0x20], rdx
movabs rdx, 0x1030300040706
mov qword [rsp + 0x18], rdx
xor eax, eax
jmp 0x46b6ce
movzx r9d, byte [rsp + rsi + 0x20]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x7c]
mov byte [rsp + rdi + 0x20], dl
mov byte [rsp + rsi + 0x20], r8b
add rax, 2
cmp rax, 8
jge 0x46b702
movzx edx, byte [rsp + rax + 0x18]
movzx esi, byte [rsp + rax + 0x19]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 8
jae 0x46b725
movzx r8d, byte [rsp + rdi + 0x20]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x7c]
cmp rsi, 8
jb 0x46b6b4
nop
jmp 0x46b719
xor eax, eax
lea rbx, [rsp + 0x20]
mov ecx, 8
call fcn.00444780
add rsp, 0x28
pop rbp
ret
mov eax, esi
mov ecx, 8
call fcn.004564a0
mov eax, edi
mov ecx, 8
call fcn.004564a0
nop
call fcn.004541c0
jmp fcn.0046b680

Function at 0x46b740
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x46b7f8
push rbp
mov rbp, rsp
sub rsp, 0x30
movabs rdx, 0x77037becda6669ee
mov qword [rsp + 0x28], rdx
movabs rdx, 0x3050607000607
mov qword [rsp + 0x1e], rdx
mov word [rsp + 0x26], 0x604
xor eax, eax
jmp 0x46b795
movzx r9d, byte [rsp + rsi + 0x28]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x71]
mov byte [rsp + rdi + 0x28], dl
mov byte [rsp + rsi + 0x28], r8b
add rax, 2
cmp rax, 0xa
jge 0x46b7c8
movzx edx, byte [rsp + rax + 0x1e]
movzx esi, byte [rsp + rax + 0x1f]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 8
jae 0x46b7eb
movzx r8d, byte [rsp + rdi + 0x28]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x71]
nop
cmp rsi, 8
jb 0x46b77b
jmp 0x46b7df
xor eax, eax
lea rbx, [rsp + 0x28]
mov ecx, 8
call fcn.00444780
add rsp, 0x30
pop rbp
ret
mov eax, esi
mov ecx, 8
call fcn.004564a0
mov eax, edi
mov ecx, 8
call fcn.004564a0
nop
call fcn.004541c0
nop dword [rax]
jmp fcn.0046b740
Function at 0x46ea80
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x46eb7b
push rbp
mov rbp, rsp
sub rsp, 0x50
movabs rdx, 0x63d76142de1248bd
mov qword [rsp + 0x39], rdx
movabs rdx, 0xd52ac820ca746363
mov qword [rsp + 0x40], rdx
movabs rdx, 0xd4d1cb6fccac10d2
mov qword [rsp + 0x48], rdx
movabs rdx, 0x70302010d100212
mov qword [rsp + 0x1d], rdx
movabs rdx, 0x6030a150b15100c
mov qword [rsp + 0x25], rdx
movabs rdx, 0x10e0d1206030a15
mov qword [rsp + 0x29], rdx
movabs rdx, 0x16141100020f1404
mov qword [rsp + 0x31], rdx
xor eax, eax
jmp 0x46eb19
movzx r9d, byte [rsp + rsi + 0x39]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x79]
mov byte [rsp + rdi + 0x39], dl
mov byte [rsp + rsi + 0x39], r8b
add rax, 2
cmp rax, 0x1c
jge 0x46eb4b
movzx edx, byte [rsp + rax + 0x1d]
movzx esi, byte [rsp + rax + 0x1e]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x17
jae 0x46eb6e
movzx r8d, byte [rsp + rdi + 0x39]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x79]
cmp rsi, 0x17
jb 0x46eaff
jmp 0x46eb62
xor eax, eax
lea rbx, [rsp + 0x39]
mov ecx, 0x17
call fcn.00444780
add rsp, 0x50
pop rbp
ret
mov eax, esi
mov ecx, 0x17
call fcn.004564a0
mov eax, edi
mov ecx, 0x17
call fcn.004564a0
nop
nop dword [rax + rax]
call fcn.004541c0
jmp fcn.0046ea80

Function at 0x46eba0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x46ec7d
push rbp
mov rbp, rsp
sub rsp, 0x40
movabs rdx, 0x8e0c07720de5744f
mov qword [rsp + 0x30], rdx
movabs rdx, 0xf69246d0e617270
mov qword [rsp + 0x38], rdx
movabs rdx, 0x90b0c070602030f
mov qword [rsp + 0x1e], rdx
movabs rdx, 0xb07090b0c070602
mov qword [rsp + 0x20], rdx
movabs rdx, 0x70d0b0b070c0505
mov qword [rsp + 0x28], rdx
xor eax, eax
nop
jmp 0x46ec20
movzx r9d, byte [rsp + rsi + 0x30]
sub r9d, edx
lea edx, [r9 + 0x62]
mov byte [rsp + rdi + 0x30], dl
lea edx, [r8 + 0x62]
mov byte [rsp + rsi + 0x30], dl
add rax, 2
nop
cmp rax, 0x12
jge 0x46ec4d
movzx edx, byte [rsp + rax + 0x1e]
movzx esi, byte [rsp + rax + 0x1f]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x10
jae 0x46ec70
movzx r8d, byte [rsp + rdi + 0x30]
sub r8d, edx
cmp rsi, 0x10
jb 0x46ec02
jmp 0x46ec64
xor eax, eax
lea rbx, [rsp + 0x30]
mov ecx, 0x10
call fcn.00444780
add rsp, 0x40
pop rbp
ret
mov eax, esi
mov ecx, 0x10
call fcn.004564a0
mov eax, edi
mov ecx, 0x10
call fcn.004564a0
nop
nop dword [rax]
call fcn.004541c0
jmp fcn.0046eba0
Function at 0x46eca0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x46edd8
push rbp
mov rbp, rsp
sub rsp, 0x68
movabs rdx, 0x24955f7265fe7487
mov qword [rsp + 0x46], rdx
movabs rdx, 0xdbbf24955f7265fe
mov qword [rsp + 0x48], rdx
movabs rdx, 0x1ecc68498bbcc4c5
mov qword [rsp + 0x50], rdx
movabs rdx, 0x6f9c1dbd506261a4
mov qword [rsp + 0x58], rdx
movabs rdx, 0xb4f4696fa99fac2a
mov qword [rsp + 0x60], rdx
movabs rdx, 0x211720020d000b0d
mov qword [rsp + 0x1c], rdx
movabs rdx, 0xf070c0f1c11201a
mov qword [rsp + 0x24], rdx
movabs rdx, 0x2060f070c0f1c11
mov qword [rsp + 0x26], rdx
movabs rdx, 0xf1b200c16151c08
mov qword [rsp + 0x2e], rdx
movabs rdx, 0x1c181b081d150600
mov qword [rsp + 0x36], rdx
movabs rdx, 0x122021090a101612
mov qword [rsp + 0x3e], rdx
xor eax, eax
jmp 0x46ed78
movzx r9d, byte [rsp + rsi + 0x46]
sub r9d, edx
lea edx, [r9 - 0x19]
mov byte [rsp + rdi + 0x46], dl
lea edx, [r8 - 0x19]
mov byte [rsp + rsi + 0x46], dl
add rax, 2
cmp rax, 0x2a
jge 0x46eda8
movzx edx, byte [rsp + rax + 0x1c]
movzx esi, byte [rsp + rax + 0x1d]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x22
jae 0x46edcb
movzx r8d, byte [rsp + rdi + 0x46]
sub r8d, edx
nop dword [rax]
cmp rsi, 0x22
jb 0x46ed5b
jmp 0x46edbf
xor eax, eax
lea rbx, [rsp + 0x46]
mov ecx, 0x22
call fcn.00444780
add rsp, 0x68
pop rbp
ret
mov eax, esi
mov ecx, 0x22
call fcn.004564a0
mov eax, edi
mov ecx, 0x22
call fcn.004564a0
nop
call fcn.004541c0
nop dword [rax]
jmp fcn.0046eca0

Function at 0x46f760
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x46f846
push rbp
mov rbp, rsp
sub rsp, 0x40
movabs rdx, 0x49ecd7724d33d54f
mov qword [rsp + 0x31], rdx
movabs rdx, 0xdc73dff4c4b34b49
mov qword [rsp + 0x38], rdx
movabs rdx, 0x607080b02080e03
mov qword [rsp + 0x1f], rdx
movabs rdx, 0x10b0607080b0208
mov qword [rsp + 0x21], rdx
movabs rdx, 0xa050609010c0e02
mov qword [rsp + 0x29], rdx
xor eax, eax
nop
jmp 0x46f7e0
movzx r9d, byte [rsp + rsi + 0x31]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x7c]
mov byte [rsp + rdi + 0x31], dl
mov byte [rsp + rsi + 0x31], r8b
add rax, 2
nop dword [rax]
cmp rax, 0x12
jge 0x46f812
movzx edx, byte [rsp + rax + 0x1f]
movzx esi, byte [rsp + rax + 0x20]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0xf
jae 0x46f837
movzx r8d, byte [rsp + rdi + 0x31]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x7c]
cmp rsi, 0xf
jb 0x46f7c2
jmp 0x46f82b
xor eax, eax
lea rbx, [rsp + 0x31]
mov ecx, 0xf
nop
call fcn.00444780
add rsp, 0x40
pop rbp
ret
mov eax, esi
mov ecx, 0xf
call fcn.004564a0
mov eax, edi
mov ecx, 0xf
nop
call fcn.004564a0
nop
call fcn.004541c0
jmp fcn.0046f760
Function at 0x46f860
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x46f926
push rbp
mov rbp, rsp
sub rsp, 0x30
movabs rdx, 0x7387657265705267
mov qword [rsp + 0x26], rdx
mov word [rsp + 0x2e], 0x6862
movabs rdx, 0x100010607080006
mov qword [rsp + 0x1a], rdx
mov dword [rsp + 0x22], 0x7050202
xor eax, eax
jmp 0x46f8c0
movzx r9d, byte [rsp + rsi + 0x26]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x10]
mov byte [rsp + rdi + 0x26], dl
mov byte [rsp + rsi + 0x26], r8b
add rax, 2
nop dword [rax]
cmp rax, 0xc
jge 0x46f8f2
movzx edx, byte [rsp + rax + 0x1a]
movzx esi, byte [rsp + rax + 0x1b]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0xa
jae 0x46f917
movzx r8d, byte [rsp + rdi + 0x26]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x10]
cmp rsi, 0xa
jb 0x46f8a3
jmp 0x46f90b
xor eax, eax
lea rbx, [rsp + 0x26]
mov ecx, 0xa
nop
call fcn.00444780
add rsp, 0x30
pop rbp
ret
mov eax, esi
mov ecx, 0xa
call fcn.004564a0
mov eax, edi
mov ecx, 0xa
nop
call fcn.004564a0
nop
call fcn.004541c0
jmp fcn.0046f860

Function at 0x4717a0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x47188c
push rbp
mov rbp, rsp
sub rsp, 0x40
movabs rdx, 0x9c97970dc4828a56
mov qword [rsp + 0x2e], rdx
movabs rdx, 0x5f849c97970dc482
mov qword [rsp + 0x30], rdx
movabs rdx, 0xb76fb591866cbc53
mov qword [rsp + 0x38], rdx
movabs rdx, 0xf05030711050411
mov qword [rsp + 0x1a], rdx
movabs rdx, 0x10d050b0f050307
mov qword [rsp + 0x1e], rdx
movabs rdx, 0x607020e0f050408
mov qword [rsp + 0x26], rdx
xor eax, eax
jmp 0x47182a
movzx r9d, byte [rsp + rsi + 0x2e]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x3b]
mov byte [rsp + rdi + 0x2e], dl
mov byte [rsp + rsi + 0x2e], r8b
add rax, 2
cmp rax, 0x14
jge 0x47185c
movzx edx, byte [rsp + rax + 0x1a]
movzx esi, byte [rsp + rax + 0x1b]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x12
jae 0x47187f
movzx r8d, byte [rsp + rdi + 0x2e]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x3b]
cmp rsi, 0x12
jb 0x471810
jmp 0x471873
xor eax, eax
lea rbx, [rsp + 0x2e]
mov ecx, 0x12
call fcn.00444780
add rsp, 0x40
pop rbp
ret
mov eax, esi
mov ecx, 0x12
call fcn.004564a0
mov eax, edi
mov ecx, 0x12
call fcn.004564a0
nop
call fcn.004541c0
jmp fcn.004717a0
Function at 0x476100
Capabilities:
Encrypt data using rc4 prga

Disassembly:
lea r12, [rsp - 0x10]
cmp r12, qword [r14 + 0x10]
jbe 0x476272
push rbp
mov rbp, rsp
sub rsp, 0x88
movabs rdx, 0xaa2219b16574e530
mov qword [rsp + 0x52], rdx
movabs rdx, 0x203a72652166aa22
mov qword [rsp + 0x58], rdx
movabs rdx, 0x4bd7041519611072
mov qword [rsp + 0x60], rdx
movabs rdx, 0x4d645ac13b754865
mov qword [rsp + 0x68], rdx
movabs rdx, 0x6576695061209bfa
mov qword [rsp + 0x70], rdx
movabs rdx, 0xe124146e752d3d39
mov qword [rsp + 0x78], rdx
movabs rdx, 0x5661e25244503aeb
mov qword [rsp + 0x80], rdx
movabs rdx, 0x27131a2f15301d11
mov qword [rsp + 0x1c], rdx
movabs rdx, 0x1f1b2c2b260f2713
mov qword [rsp + 0x22], rdx
movabs rdx, 0x3506312f111e0735
mov qword [rsp + 0x2a], rdx
movabs rdx, 0x331426041704171b
mov qword [rsp + 0x32], rdx
movabs rdx, 0x112e2009222b2b07
mov qword [rsp + 0x3a], rdx
movabs rdx, 0x27282d0517011911
mov qword [rsp + 0x42], rdx
movabs rdx, 0x3312001706012206
mov qword [rsp + 0x4a], rdx
xor eax, eax
jmp 0x47620d
movzx r9d, byte [rsp + rsi + 0x52]
lea edx, [r9 + rdx]
lea edx, [rdx - 5]
mov byte [rsp + rdi + 0x52], dl
mov byte [rsp + rsi + 0x52], r8b
add rax, 2
cmp rax, 0x36
jge 0x47623f
movzx edx, byte [rsp + rax + 0x1c]
movzx esi, byte [rsp + rax + 0x1d]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x36
jae 0x476265
movzx r8d, byte [rsp + rdi + 0x52]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 5]
cmp rsi, 0x36
jb 0x4761f3
jmp 0x476259
xor eax, eax
lea rbx, [rsp + 0x52]
mov ecx, 0x36
call fcn.00444780
add rsp, 0x88
pop rbp
ret
mov eax, esi
mov ecx, 0x36
call fcn.004564a0
mov eax, edi
mov ecx, 0x36
call fcn.004564a0
nop
call fcn.004541c0
jmp fcn.00476100

Function at 0x4763c0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4764da
push rbp
mov rbp, rsp
sub rsp, 0x58
movabs rdx, 0x4ce6df6c65ee7573
mov qword [rsp + 0x3a], rdx
movabs rdx, 0x645046742d42524f
mov qword [rsp + 0x42], rdx
movabs rdx, 0x2b6d30410c506450
mov qword [rsp + 0x48], rdx
movabs rdx, 0x872353c67601e39
mov qword [rsp + 0x50], rdx
movabs rdx, 0x151914170312110b
mov qword [rsp + 0x18], rdx
movabs rdx, 0x1a09151914170312
mov qword [rsp + 0x1a], rdx
movabs rdx, 0x1d06130b071b0213
mov qword [rsp + 0x22], rdx
movabs rdx, 0x11100b0f1d181305
mov qword [rsp + 0x2a], rdx
movabs rdx, 0x10130d19030e0216
mov qword [rsp + 0x32], rdx
xor eax, eax
jmp 0x476477
movzx r9d, byte [rsp + rsi + 0x3a]
lea edx, [r9 + rdx]
lea edx, [rdx - 5]
mov byte [rsp + rdi + 0x3a], dl
mov byte [rsp + rsi + 0x3a], r8b
add rax, 2
cmp rax, 0x22
jge 0x4764a9
movzx edx, byte [rsp + rax + 0x18]
movzx esi, byte [rsp + rax + 0x19]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x1e
jae 0x4764cd
movzx r8d, byte [rsp + rdi + 0x3a]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 5]
cmp rsi, 0x1e
jb 0x47645d
jmp 0x4764c1
xor eax, eax
lea rbx, [rsp + 0x3a]
mov ecx, 0x1e
call fcn.00444780
add rsp, 0x58
pop rbp
nop
ret
mov eax, esi
mov ecx, 0x1e
call fcn.004564a0
mov eax, edi
mov ecx, 0x1e
call fcn.004564a0
nop
call fcn.004541c0
nop
jmp fcn.004763c0
Function at 0x4764f0
Capabilities:
Encode data using xor

Disassembly:
mov rbx, qword [rsp + 8]
mov rsi, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdx, qword [rsp + 0x20]
test rdx, 0xf
jne 0x47656a
mov rax, 0
nop word [rax + rax]
nop dword [rax]
movdqu xmm0, xmmword [rsi + rax]
movdqu xmm1, xmmword [rcx + rax]
pxor xmm0, xmm1
movdqu xmmword [rbx + rax], xmm0
add rax, 0x10
cmp rdx, rax
jne 0x476520
ret
sub rdx, 1
mov dil, byte [rsi + rdx]
mov al, byte [rcx + rdx]
xor dil, al
mov byte [rbx + rdx], dil
test rdx, 7
jne 0x476540
cmp rdx, 0
je 0x47658c
test rdx, 0xf
je 0x47650d
test rdx, 7
jne 0x476540
sub rdx, 8
mov rdi, qword [rsi + rdx]
mov rax, qword [rcx + rdx]
xor rdi, rax
mov qword [rbx + rdx], rdi
cmp rdx, 0x10
jge 0x47650d
ret
Function at 0x4769e0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
lea r12, [rsp - 0x68]
cmp r12, qword [r14 + 0x10]
jbe 0x476c35
push rbp
mov rbp, rsp
sub rsp, 0xe0
movups xmmword [rsp + 0xf0], xmm15
movups xmmword [rsp + 0x100], xmm15
movups xmmword [rsp + 0x110], xmm15
movups xmmword [rsp + 0x120], xmm15
movabs rdx, 0xc6b11e39a49301fc
mov qword [rsp + 0xa0], rdx
movabs rdx, 0x4eabf26bb2a0ed1
mov qword [rsp + 0xa8], rdx
movabs rdx, 0x16332b77c6ff2f79
mov qword [rsp + 0xb0], rdx
movabs rdx, 0xe00cb218f1212735
mov qword [rsp + 0xb8], rdx
movabs rdx, 0xd9c629afeefbf8d0
mov qword [rsp + 0xc0], rdx
movabs rdx, 0xb17d6c9159bc2a1
mov qword [rsp + 0xc8], rdx
movabs rdx, 0xede573dcc5c27e46
mov qword [rsp + 0xd0], rdx
movabs rdx, 0xe5e3d4c781dac719
mov qword [rsp + 0xd8], rdx
movabs rdx, 0x2709060905242d03
mov qword [rsp + 0x16], rdx
movabs rdx, 0x3093b070e030809
mov qword [rsp + 0x1e], rdx
movabs rdx, 0x230203093b070e03
mov qword [rsp + 0x20], rdx
movabs rdx, 0x1b2013310332291f
mov qword [rsp + 0x28], rdx
movabs rdx, 0x10353d0d1d123012
mov qword [rsp + 0x30], rdx
movabs rdx, 0x2323052731120221
mov qword [rsp + 0x38], rdx
movabs rdx, 0xb28223f263537
mov qword [rsp + 0x40], rdx
movabs rdx, 0x391314342d3a0809
mov qword [rsp + 0x48], rdx
movabs rdx, 0x2a07333c36223e21
mov qword [rsp + 0x50], rdx
movabs rdx, 0x2c233e1d37340010
mov qword [rsp + 0x58], rdx
xor eax, eax
jmp 0x476b6b
movzx r8d, byte [rsp + rbx + 0xa0]
lea edx, [r8 + rdx]
lea edx, [rdx - 5]
mov byte [rsp + rsi + 0xa0], dl
mov byte [rsp + rbx + 0xa0], dil
add rax, 2
cmp rax, 0x4a
jge 0x476ba2
movzx edx, byte [rsp + rax + 0x16]
movzx ebx, byte [rsp + rax + 0x17]
mov esi, edx
xor edx, ebx
add edx, eax
cmp rsi, 0x40
jae 0x476c28
movzx edi, byte [rsp + rsi + 0xa0]
lea edi, [rdi + rdx]
lea edi, [rdi - 5]
cmp rbx, 0x40
jb 0x476b48
nop
jmp 0x476c1c
movups xmmword [rsp + 0x60], xmm15
movups xmmword [rsp + 0x70], xmm15
movups xmmword [rsp + 0x80], xmm15
movups xmmword [rsp + 0x90], xmm15
xor eax, eax
jmp 0x476bd3
movzx ecx, byte [rsp + rax + 0xa0]
mov byte [rsp + rax + 0x60], cl
inc rax
cmp rax, 0x40
jl 0x476bc4
movups xmm0, xmmword [rsp + 0x60]
movups xmmword [rsp + 0xf0], xmm0
movups xmm0, xmmword [rsp + 0x70]
movups xmmword [rsp + 0x100], xmm0
movups xmm0, xmmword [rsp + 0x80]
movups xmmword [rsp + 0x110], xmm0
movups xmm0, xmmword [rsp + 0x90]
movups xmmword [rsp + 0x120], xmm0
add rsp, 0xe0
pop rbp
ret
mov eax, ebx
mov ecx, 0x40
call fcn.004564a0
mov eax, esi
mov ecx, 0x40
call fcn.004564a0
nop
call fcn.004541c0
jmp fcn.004769e0
Function at 0x4787c0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x47887d
push rbp
mov rbp, rsp
sub rsp, 0x30
movabs rdx, 0xab363026a9b5b232
mov qword [rsp + 0x27], rdx
mov byte [rsp + 0x2f], 0xb9
movabs rdx, 0x701030307020407
mov qword [rsp + 0x1d], rdx
mov word [rsp + 0x25], 0x108
xor eax, eax
nop
jmp 0x478820
movzx r9d, byte [rsp + rsi + 0x27]
sub r9d, edx
lea edx, [r9 - 0x74]
mov byte [rsp + rdi + 0x27], dl
lea edx, [r8 - 0x74]
mov byte [rsp + rsi + 0x27], dl
add rax, 2
nop
cmp rax, 0xa
jge 0x47884d
movzx edx, byte [rsp + rax + 0x1d]
movzx esi, byte [rsp + rax + 0x1e]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 9
jae 0x478870
movzx r8d, byte [rsp + rdi + 0x27]
sub r8d, edx
cmp rsi, 9
jb 0x478802
jmp 0x478864
xor eax, eax
lea rbx, [rsp + 0x27]
mov ecx, 9
call fcn.00444780
add rsp, 0x30
pop rbp
ret
mov eax, esi
mov ecx, 9
call fcn.004564a0
mov eax, edi
mov ecx, 9
call fcn.004564a0
nop
nop dword [rax]
call fcn.004541c0
jmp fcn.004787c0

Function at 0x47a3c0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x47a4aa
push rbp
mov rbp, rsp
sub rsp, 0x48
movabs rdx, 0x763b313630382f41
mov qword [rsp + 0x36], rdx
movabs rdx, 0x3033763b31363038
mov qword [rsp + 0x38], rdx
movabs rdx, 0x3d6a4d333d343737
mov qword [rsp + 0x40], rdx
movabs rdx, 0xb060504090c0101
mov qword [rsp + 0x1e], rdx
movabs rdx, 0x9000f04100c0c07
mov qword [rsp + 0x26], rdx
movabs rdx, 0x11110401100c050d
mov qword [rsp + 0x2e], rdx
xor eax, eax
jmp 0x47a44d
movzx r9d, byte [rsp + rsi + 0x36]
sub r9d, edx
lea edx, [r9 + 0xe]
mov byte [rsp + rdi + 0x36], dl
lea edx, [r8 + 0xe]
mov byte [rsp + rsi + 0x36], dl
add rax, 2
cmp rax, 0x18
jge 0x47a47a
movzx edx, byte [rsp + rax + 0x1e]
movzx esi, byte [rsp + rax + 0x1f]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x12
jae 0x47a49d
movzx r8d, byte [rsp + rdi + 0x36]
sub r8d, edx
cmp rsi, 0x12
jb 0x47a430
jmp 0x47a491
xor eax, eax
lea rbx, [rsp + 0x36]
mov ecx, 0x12
call fcn.00444780
add rsp, 0x48
pop rbp
ret
mov eax, esi
mov ecx, 0x12
call fcn.004564a0
mov eax, edi
mov ecx, 0x12
call fcn.004564a0
nop
call fcn.004541c0
jmp fcn.0047a3c0
Function at 0x47c5c0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x47c6bb
push rbp
mov rbp, rsp
sub rsp, 0x50
movabs rdx, 0xad36a2911dfba3aa
mov qword [rsp + 0x38], rdx
movabs rdx, 0xab1c37a8078c0d66
mov qword [rsp + 0x40], rdx
movabs rdx, 0x8b0ba7357f96329b
mov qword [rsp + 0x48], rdx
movabs rdx, 0x160e13000715030e
mov qword [rsp + 0x1a], rdx
movabs rdx, 0x9050c000f010b08
mov qword [rsp + 0x22], rdx
movabs rdx, 0xc030b1002100905
mov qword [rsp + 0x28], rdx
movabs rdx, 0x100a1708050e0412
mov qword [rsp + 0x30], rdx
xor eax, eax
jmp 0x47c659
movzx r9d, byte [rsp + rsi + 0x38]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x75]
mov byte [rsp + rdi + 0x38], dl
mov byte [rsp + rsi + 0x38], r8b
add rax, 2
cmp rax, 0x1e
jge 0x47c68b
movzx edx, byte [rsp + rax + 0x1a]
movzx esi, byte [rsp + rax + 0x1b]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x18
jae 0x47c6ae
movzx r8d, byte [rsp + rdi + 0x38]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x75]
cmp rsi, 0x18
jb 0x47c63f
jmp 0x47c6a2
xor eax, eax
lea rbx, [rsp + 0x38]
mov ecx, 0x18
call fcn.00444780
add rsp, 0x50
pop rbp
ret
mov eax, esi
mov ecx, 0x18
call fcn.004564a0
mov eax, edi
mov ecx, 0x18
call fcn.004564a0
nop
nop dword [rax + rax]
call fcn.004541c0
jmp fcn.0047c5c0

Function at 0x47d920
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x47da3a
push rbp
mov rbp, rsp
sub rsp, 0x60
movabs rdx, 0xba3c33b833bb3218
mov qword [rsp + 0x42], rdx
movabs rdx, 0x30325539b3a534af
mov qword [rsp + 0x4a], rdx
movabs rdx, 0xa6383134c3353032
mov qword [rsp + 0x50], rdx
movabs rdx, 0x2632aababcc8bbd1
mov qword [rsp + 0x58], rdx
movabs rdx, 0xa060d060c0a041a
mov qword [rsp + 0x1e], rdx
movabs rdx, 0x130716170a060d06
mov qword [rsp + 0x22], rdx
movabs rdx, 0x180b061b19181611
mov qword [rsp + 0x2a], rdx
movabs rdx, 0xb0002070711150c
mov qword [rsp + 0x32], rdx
movabs rdx, 0x21b080d150b0d1d
mov qword [rsp + 0x3a], rdx
xor eax, eax
jmp 0x47d9d7
movzx r9d, byte [rsp + rsi + 0x42]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x5f]
mov byte [rsp + rdi + 0x42], dl
mov byte [rsp + rsi + 0x42], r8b
add rax, 2
cmp rax, 0x24
jge 0x47da09
movzx edx, byte [rsp + rax + 0x1e]
movzx esi, byte [rsp + rax + 0x1f]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x1e
jae 0x47da2d
movzx r8d, byte [rsp + rdi + 0x42]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x5f]
cmp rsi, 0x1e
jb 0x47d9bd
jmp 0x47da21
xor eax, eax
lea rbx, [rsp + 0x42]
mov ecx, 0x1e
call fcn.00444780
add rsp, 0x60
pop rbp
nop
ret
mov eax, esi
mov ecx, 0x1e
call fcn.004564a0
mov eax, edi
mov ecx, 0x1e
call fcn.004564a0
nop
call fcn.004541c0
nop
jmp fcn.0047d920
Function at 0x480d00
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x480e47
push rbp
mov rbp, rsp
sub rsp, 0x78
movabs rdx, 0xc18e32e7bab4c2e9
mov qword [rsp + 0x52], rdx
movabs rdx, 0xd2baec61da32c18e
mov qword [rsp + 0x58], rdx
movabs rdx, 0x7dfcdb763452dc52
mov qword [rsp + 0x60], rdx
movabs rdx, 0xf9e138b820e33341
mov qword [rsp + 0x68], rdx
movabs rdx, 0x35d41020eaf3d630
mov qword [rsp + 0x70], rdx
movabs rdx, 0xe0312161f10190f
mov qword [rsp + 0x1a], rdx
movabs rdx, 0x90f1a161f152103
mov qword [rsp + 0x22], rdx
movabs rdx, 0x1f1c0a0706022409
mov qword [rsp + 0x2a], rdx
movabs rdx, 0xd13011d12070924
mov qword [rsp + 0x32], rdx
movabs rdx, 0x12180c1d00070402
mov qword [rsp + 0x3a], rdx
movabs rdx, 0xa16130b1d140623
mov qword [rsp + 0x42], rdx
movabs rdx, 0xe130d1521201222
mov qword [rsp + 0x4a], rdx
xor eax, eax
jmp 0x480de7
movzx r9d, byte [rsp + rsi + 0x52]
sub r9d, edx
lea edx, [r9 + 0x70]
mov byte [rsp + rdi + 0x52], dl
lea edx, [r8 + 0x70]
mov byte [rsp + rsi + 0x52], dl
add rax, 2
cmp rax, 0x38
jge 0x480e17
movzx edx, byte [rsp + rax + 0x1a]
movzx esi, byte [rsp + rax + 0x1b]
mov edi, edx
xor edx, esi
add edx, eax
nop dword [rax]
cmp rdi, 0x26
jae 0x480e3a
movzx r8d, byte [rsp + rdi + 0x52]
sub r8d, edx
cmp rsi, 0x26
jb 0x480dca
jmp 0x480e2e
xor eax, eax
lea rbx, [rsp + 0x52]
mov ecx, 0x26
call fcn.00444780
add rsp, 0x78
pop rbp
ret
mov eax, esi
mov ecx, 0x26
call fcn.004564a0
mov eax, edi
mov ecx, 0x26
call fcn.004564a0
nop
call fcn.004541c0
jmp fcn.00480d00
Function at 0x489140
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x48928c
push rbp
mov rbp, rsp
sub rsp, 0x78
movabs rdx, 0x903c8413745a7577
mov qword [rsp + 0x4c], rdx
movabs rdx, 0x3b7e315f62417469
mov qword [rsp + 0x54], rdx
movabs rdx, 0x826870433b7e315f
mov qword [rsp + 0x58], rdx
movabs rdx, 0x77316d8d38f58748
mov qword [rsp + 0x60], rdx
movabs rdx, 0x5a672d0c20916969
mov qword [rsp + 0x68], rdx
movabs rdx, 0x65246e708d83666f
mov qword [rsp + 0x70], rdx
movabs rdx, 0x1e02261e1e141800
mov qword [rsp + 0x1c], rdx
movabs rdx, 0x722210e0e180a19
mov qword [rsp + 0x24], rdx
movabs rdx, 0x206280b10050c0f
mov qword [rsp + 0x2c], rdx
movabs rdx, 0x2023021c22272310
mov qword [rsp + 0x34], rdx
movabs rdx, 0x100c171b1513062a
mov qword [rsp + 0x3c], rdx
movabs rdx, 0x23161202211e1904
mov qword [rsp + 0x44], rdx
xor eax, eax
jmp 0x489224
movzx r9d, byte [rsp + rsi + 0x4c]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x38]
mov byte [rsp + rdi + 0x4c], dl
mov byte [rsp + rsi + 0x4c], r8b
add rax, 2
cmp rax, 0x30
jge 0x48925c
movzx edx, byte [rsp + rax + 0x1c]
movzx esi, byte [rsp + rax + 0x1d]
mov edi, edx
xor edx, esi
add edx, eax
nop word [rax + rax]
cmp rdi, 0x2c
jae 0x48927f
movzx r8d, byte [rsp + rdi + 0x4c]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x38]
cmp rsi, 0x2c
jb 0x48920a
jmp 0x489273
xor eax, eax
lea rbx, [rsp + 0x4c]
mov ecx, 0x2c
call fcn.00444780
add rsp, 0x78
pop rbp
ret
mov eax, esi
mov ecx, 0x2c
call fcn.004564a0
mov eax, edi
mov ecx, 0x2c
call fcn.004564a0
nop
call fcn.004541c0
jmp fcn.00489140