joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1de516200
Capabilities:
Encrypt data using rc4 prga

Disassembly:
sub rsp, 0x30
mov qword [rsp + 0x28], rbp
lea rbp, [rsp + 0x28]
mov qword [rsp + 0x38], 0
movabs rdx, 0xaa3c51e37d75533e
mov qword [rsp + 0x20], rdx
movabs rdx, 0x606000206020307
mov qword [rsp + 0x10], rdx
xor eax, eax
jmp 0x1de516253
movzx r8d, byte [rsp + rbx + 0x20]
lea edx, [r8 + rdx]
lea edx, [rdx - 0x5f]
mov byte [rsp + rsi + 0x20], dl
mov byte [rsp + rbx + 0x20], dil
add rax, 2
cmp rax, 8
jge 0x1de51628c
movzx edx, byte [rsp + rax + 0x10]
lea rbx, [rax + 1]
cmp rbx, 8
jae 0x1de5162d7
movzx ebx, byte [rsp + rax + 0x11]
mov esi, edx
xor edx, ebx
add edx, eax
cmp rsi, 8
jae 0x1de5162cb
movzx edi, byte [rsp + rsi + 0x20]
lea edi, [rdi + rdx]
lea edi, [rdi - 0x5f]
cmp rbx, 8
jb 0x1de516239
jmp 0x1de5162bf
mov qword [rsp + 0x18], 0
xor eax, eax
jmp 0x1de5162a5
movzx ecx, byte [rsp + rax + 0x20]
mov byte [rsp + rax + 0x18], cl
inc rax
cmp rax, 8
jl 0x1de516299
mov rax, qword [rsp + 0x18]
mov qword [rsp + 0x38], rax
mov rbp, qword [rsp + 0x28]
add rsp, 0x30
ret
mov eax, ebx
mov ecx, 8
call fcn.1de49fa60
mov eax, esi
mov ecx, 8
call fcn.1de49fa60
mov rax, rbx
mov ecx, 8
nop
call fcn.1de49fa60
nop
int3

Function at 0x1de516900
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x1de5169df
sub rsp, 0x38
mov qword [rsp + 0x30], rbp
lea rbp, [rsp + 0x30]
movabs rdx, 0x3e4610323aa07370
mov qword [rsp + 0x1b], rdx
mov byte [rsp + 0x23], 0xea
movabs rdx, 0x308070605020208
mov qword [rsp + 0x24], rdx
mov dword [rsp + 0x2c], 0x5030402
xor eax, eax
jmp 0x1de516961
movzx r9d, byte [rsp + rsi + 0x1b]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x21]
mov byte [rsp + rdi + 0x1b], dl
mov byte [rsp + rsi + 0x1b], r8b
add rax, 2
cmp rax, 0xc
jge 0x1de51699d
movzx edx, byte [rsp + rax + 0x24]
lea rsi, [rax + 1]
cmp rsi, 0xc
jae 0x1de5169d1
movzx esi, byte [rsp + rax + 0x25]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 9
jae 0x1de5169c5
movzx r8d, byte [rsp + rdi + 0x1b]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x21]
cmp rsi, 9
jb 0x1de516947
jmp 0x1de5169b8
xor eax, eax
lea rbx, [rsp + 0x1b]
mov ecx, 9
call fcn.1de48b520
mov rbp, qword [rsp + 0x30]
add rsp, 0x38
ret
mov eax, esi
mov ecx, 9
nop
call fcn.1de49fa60
mov eax, edi
mov ecx, 9
call fcn.1de49fa60
mov rax, rsi
mov ecx, 0xc
call fcn.1de49fa60
nop
nop
call fcn.1de49d360
jmp fcn.1de516900
Function at 0x1de517480
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x1de517593
sub rsp, 0x50
mov qword [rsp + 0x48], rbp
lea rbp, [rsp + 0x48]
movabs rdx, 0x2d50352342286f7d
mov qword [rsp + 0x1d], rdx
movabs rdx, 0x656c24ece62d5035
mov qword [rsp + 0x22], rdx
movabs rdx, 0x57f09e2b61376567
mov qword [rsp + 0x2a], rdx
movabs rdx, 0x303050800040912
mov qword [rsp + 0x32], rdx
movabs rdx, 0x13090f0a13040303
mov qword [rsp + 0x38], rdx
movabs rdx, 0x409051312070211
mov qword [rsp + 0x40], rdx
xor eax, eax
jmp 0x1de517510
movzx r9d, byte [rsp + rsi + 0x1d]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x23]
mov byte [rsp + rdi + 0x1d], dl
mov byte [rsp + rsi + 0x1d], r8b
add rax, 2
cmp rax, 0x16
jge 0x1de51754d
movzx edx, byte [rsp + rax + 0x32]
lea rsi, [rax + 1]
nop
cmp rsi, 0x16
jae 0x1de517585
movzx esi, byte [rsp + rax + 0x33]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x15
jae 0x1de517574
movzx r8d, byte [rsp + rdi + 0x1d]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x23]
cmp rsi, 0x15
jb 0x1de5174f6
jmp 0x1de517568
xor eax, eax
lea rbx, [rsp + 0x1d]
mov ecx, 0x15
call fcn.1de48b520
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
mov eax, esi
mov ecx, 0x15
call fcn.1de49fa60
mov eax, edi
mov ecx, 0x15
nop dword [rax + rax]
call fcn.1de49fa60
mov rax, rsi
mov ecx, 0x16
call fcn.1de49fa60
nop
call fcn.1de49d360
jmp fcn.1de517480

Function at 0x1de5194a0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x1de51957f
sub rsp, 0x38
mov qword [rsp + 0x30], rbp
lea rbp, [rsp + 0x30]
movabs rdx, 0x66cf9469edafc4c
mov qword [rsp + 0x1a], rdx
mov word [rsp + 0x22], 0xfe21
movabs rdx, 0x205020202080309
mov qword [rsp + 0x24], rdx
mov dword [rsp + 0x2c], 0x9090107
xor eax, eax
jmp 0x1de519506
movzx r9d, byte [rsp + rsi + 0x1a]
sub r9d, edx
lea edx, [r9 + 0x77]
mov byte [rsp + rdi + 0x1a], dl
lea edx, [r8 + 0x77]
mov byte [rsp + rsi + 0x1a], dl
add rax, 2
cmp rax, 0xc
jge 0x1de51953d
movzx edx, byte [rsp + rax + 0x24]
lea rsi, [rax + 1]
cmp rsi, 0xc
jae 0x1de519571
movzx esi, byte [rsp + rax + 0x25]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0xa
jae 0x1de519565
movzx r8d, byte [rsp + rdi + 0x1a]
sub r8d, edx
cmp rsi, 0xa
jb 0x1de5194e9
jmp 0x1de519558
xor eax, eax
lea rbx, [rsp + 0x1a]
mov ecx, 0xa
call fcn.1de48b520
mov rbp, qword [rsp + 0x30]
add rsp, 0x38
ret
mov eax, esi
mov ecx, 0xa
nop
call fcn.1de49fa60
mov eax, edi
mov ecx, 0xa
call fcn.1de49fa60
mov rax, rsi
mov ecx, 0xc
call fcn.1de49fa60
nop
nop
call fcn.1de49d360
jmp fcn.1de5194a0
Function at 0x1de5199a0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x1de519aab
sub rsp, 0x50
mov qword [rsp + 0x48], rbp
lea rbp, [rsp + 0x48]
movabs rdx, 0xd50b9efc173a6400
mov qword [rsp + 0x1d], rdx
movabs rdx, 0xf06816d50b9efc17
mov qword [rsp + 0x20], rdx
movabs rdx, 0x726101a165645657
mov qword [rsp + 0x28], rdx
movabs rdx, 0x90302100a0c0103
mov qword [rsp + 0x30], rdx
movabs rdx, 0x610050100030f0a
mov qword [rsp + 0x38], rdx
movabs rdx, 0xa01040405070608
mov qword [rsp + 0x40], rdx
xor eax, eax
jmp 0x1de519a33
movzx r9d, byte [rsp + rsi + 0x1d]
sub r9d, edx
lea edx, [r9 - 0x7f]
mov byte [rsp + rdi + 0x1d], dl
lea edx, [r8 - 0x7f]
mov byte [rsp + rsi + 0x1d], dl
add rax, 2
cmp rax, 0x18
jge 0x1de519a6a
movzx edx, byte [rsp + rax + 0x30]
lea rsi, [rax + 1]
cmp rsi, 0x18
jae 0x1de519a9d
movzx esi, byte [rsp + rax + 0x31]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x13
jae 0x1de519a91
movzx r8d, byte [rsp + rdi + 0x1d]
sub r8d, edx
cmp rsi, 0x13
jb 0x1de519a16
jmp 0x1de519a85
xor eax, eax
lea rbx, [rsp + 0x1d]
mov ecx, 0x13
call fcn.1de48b520
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
mov eax, esi
mov ecx, 0x13
call fcn.1de49fa60
mov eax, edi
mov ecx, 0x13
call fcn.1de49fa60
mov rax, rsi
mov ecx, 0x18
call fcn.1de49fa60
nop
call fcn.1de49d360
jmp fcn.1de5199a0

Function at 0x1de519ac0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x1de519bff
sub rsp, 0x60
mov qword [rsp + 0x58], rbp
lea rbp, [rsp + 0x58]
movabs rdx, 0x403b25fe469b6502
mov qword [rsp + 0x1a], rdx
movabs rdx, 0x69eb6c29f56fb66e
mov qword [rsp + 0x22], rdx
movabs rdx, 0x1b0369eb6c29f56f
mov qword [rsp + 0x24], rdx
movabs rdx, 0xbb6c0a366148032b
mov qword [rsp + 0x2c], rdx
movabs rdx, 0x100e09060d130711
mov qword [rsp + 0x34], rdx
movabs rdx, 0x19020013100e0906
mov qword [rsp + 0x38], rdx
movabs rdx, 0x100c021606120519
mov qword [rsp + 0x40], rdx
movabs rdx, 0x1704160b0e1602
mov qword [rsp + 0x48], rdx
movabs rdx, 0x51704120d0e1316
mov qword [rsp + 0x50], rdx
xor eax, eax
jmp 0x1de519b80
movzx r9d, byte [rsp + rsi + 0x1a]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x18]
mov byte [rsp + rdi + 0x1a], dl
mov byte [rsp + rsi + 0x1a], r8b
add rax, 2
nop dword [rax]
cmp rax, 0x24
jge 0x1de519bbc
movzx edx, byte [rsp + rax + 0x34]
lea rsi, [rax + 1]
cmp rsi, 0x24
jae 0x1de519bf1
movzx esi, byte [rsp + rax + 0x35]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x1a
jae 0x1de519be5
movzx r8d, byte [rsp + rdi + 0x1a]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x18]
cmp rsi, 0x1a
jb 0x1de519b63
jmp 0x1de519bd7
xor eax, eax
lea rbx, [rsp + 0x1a]
mov ecx, 0x1a
call fcn.1de48b520
mov rbp, qword [rsp + 0x58]
add rsp, 0x60
ret
mov eax, esi
mov ecx, 0x1a
nop
call fcn.1de49fa60
mov eax, edi
mov ecx, 0x1a
call fcn.1de49fa60
mov rax, rsi
mov ecx, 0x24
call fcn.1de49fa60
nop
nop
call fcn.1de49d360
jmp fcn.1de519ac0
Function at 0x1de51a5a0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x1de51a6bf
sub rsp, 0x58
mov qword [rsp + 0x50], rbp
lea rbp, [rsp + 0x50]
movabs rdx, 0x456e8ae69284e744
mov qword [rsp + 0x1d], rdx
movabs rdx, 0xeff900722259ee45
mov qword [rsp + 0x24], rdx
movabs rdx, 0x6bfdf16c42eb76fa
mov qword [rsp + 0x2c], rdx
movabs rdx, 0x30f020c0a030e10
mov qword [rsp + 0x34], rdx
movabs rdx, 0xe05030a0c0f0505
mov qword [rsp + 0x3c], rdx
movabs rdx, 0x110915140e05030a
mov qword [rsp + 0x40], rdx
movabs rdx, 0xd0811040a010d06
mov qword [rsp + 0x48], rdx
xor eax, eax
jmp 0x1de51a640
movzx r9d, byte [rsp + rsi + 0x1d]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x61]
mov byte [rsp + rdi + 0x1d], dl
mov byte [rsp + rsi + 0x1d], r8b
add rax, 2
nop
cmp rax, 0x1c
jge 0x1de51a67c
movzx edx, byte [rsp + rax + 0x34]
lea rsi, [rax + 1]
cmp rsi, 0x1c
jae 0x1de51a6b1
movzx esi, byte [rsp + rax + 0x35]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x17
jae 0x1de51a6a5
movzx r8d, byte [rsp + rdi + 0x1d]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x61]
cmp rsi, 0x17
jb 0x1de51a625
jmp 0x1de51a697
xor eax, eax
lea rbx, [rsp + 0x1d]
mov ecx, 0x17
call fcn.1de48b520
mov rbp, qword [rsp + 0x50]
add rsp, 0x58
ret
mov eax, esi
mov ecx, 0x17
nop
call fcn.1de49fa60
mov eax, edi
mov ecx, 0x17
call fcn.1de49fa60
mov rax, rsi
mov ecx, 0x1c
call fcn.1de49fa60
nop
nop
call fcn.1de49d360
jmp fcn.1de51a5a0
Function at 0x1de51dd20
Capabilities:
Encrypt data using rc4 prga

Disassembly:
lea r12, [rsp - 0x58]
cmp r12, qword [r14 + 0x10]
jbe 0x1de51deb3
sub rsp, 0xd8
mov qword [rsp + 0xd0], rbp
lea rbp, [rsp + 0xd0]
movabs rdx, 0xfcabe11200a4a85
mov qword [rsp + 0x1f], rdx
movabs rdx, 0x6042636e6f83200f
mov qword [rsp + 0x26], rdx
movabs rdx, 0xd08e1c20da9ed371
mov qword [rsp + 0x2e], rdx
movabs rdx, 0x20616ee869c92ccb
mov qword [rsp + 0x36], rdx
movabs rdx, 0x6e18c8daca188abf
mov qword [rsp + 0x3e], rdx
movabs rdx, 0xd6f5f1b4437d10ec
mov qword [rsp + 0x46], rdx
movabs rdx, 0x6b776ff5ccb09a20
mov qword [rsp + 0x4e], rdx
movabs rdx, 0x5a78616d282036f9
mov qword [rsp + 0x56], rdx
movabs rdx, 0x3f354de23831c2bd
mov qword [rsp + 0x5e], rdx
movabs rdx, 0x1b1f302d19154018
mov qword [rsp + 0x66], rdx
movabs rdx, 0x1922381b2a44371f
mov qword [rsp + 0x6e], rdx
lea rdi, [rsp + 0x70]
lea rsi, [0x1de668bdc]
nop word [rax + rax]
mov qword [rsp - 0x10], rbp
lea rbp, [rsp - 0x10]
call fcn.1de4a006c
mov rbp, qword [rbp]
xor eax, eax
jmp 0x1de51de34
movzx r9d, byte [rsp + rsi + 0x1f]
sub r9d, edx
lea edx, [r9 - 9]
mov byte [rsp + rdi + 0x1f], dl
lea edx, [r8 - 9]
mov byte [rsp + rsi + 0x1f], dl
add rax, 2
cmp rax, 0x6a
jge 0x1de51de6b
movzx edx, byte [rsp + rax + 0x66]
lea rsi, [rax + 1]
cmp rsi, 0x6a
jae 0x1de51dea5
movzx esi, byte [rsp + rax + 0x67]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x47
jae 0x1de51de98
movzx r8d, byte [rsp + rdi + 0x1f]
sub r8d, edx
cmp rsi, 0x47
jb 0x1de51de17
jmp 0x1de51de8c
xor eax, eax
lea rbx, [rsp + 0x1f]
mov ecx, 0x47
call fcn.1de48b520
mov rbp, qword [rsp + 0xd0]
add rsp, 0xd8
ret
mov eax, esi
mov ecx, 0x47
call fcn.1de49fa60
mov eax, edi
mov ecx, 0x47
nop
call fcn.1de49fa60
mov rax, rsi
mov ecx, 0x6a
call fcn.1de49fa60
nop
call fcn.1de49d360
jmp fcn.1de51dd20
Function at 0x1de521540
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x1de5216a6
sub rsp, 0x58
mov qword [rsp + 0x50], rbp
lea rbp, [rsp + 0x50]
test bl, bl
je 0x1de521578
test byte [rax], al
lea rcx, [rax + 8]
mov edx, 2
movabs rbx, 0x7ffff800000
mov esi, 0x800000
jmp 0x1de521597
test byte [rax], al
lea rcx, [rax + 0xc]
mov edx, 4
movabs rbx, 0x7ffff80000000000
movabs rsi, 0x80000000000
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x48], rcx
mov qword [rsp + 0x20], rsi
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x38], rdx
jmp 0x1de5215b7
mov rax, qword [rsp + 0x60]
test byte [rax], al
mov qword [rsp], rax
nop dword [rax]
call fcn.1de4a6180
xorps xmm15, xmm15
mov r14, qword gs:[0x28]
mov r14, qword [r14]
mov rax, qword [rsp + 8]
mov rcx, qword [rsp + 0x38]
test rax, rcx
je 0x1de52168b
test rax, 0x7ffff8
je 0x1de52168b
mov qword [rsp + 0x40], rax
mov rdx, qword [rsp + 0x60]
mov qword [rsp], rdx
not rcx
and rcx, rax
lea rsi, [rcx - 8]
mov rdi, qword [rsp + 0x20]
sub rcx, rdi
add rcx, 0xfffffffffffffff8
mov r8, qword [rsp + 0x30]
test rax, r8
cmovne rsi, rcx
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x10], rsi
call fcn.1de4a6100
xorps xmm15, xmm15
mov r14, qword gs:[0x28]
mov r14, qword [r14]
cmp byte [rsp + 0x18], 0
je 0x1de5215b2
mov rcx, qword [rsp + 0x30]
mov rdx, qword [rsp + 0x40]
test rdx, rcx
je 0x1de52166f
mov rax, qword [rsp + 0x48]
call fcn.1de49b1e0
mov rcx, qword [rsp + 0x28]
and ecx, 0x7ffff9
cmp rcx, 1
sete al
mov rbp, qword [rsp + 0x50]
add rsp, 0x58
ret
call fcn.1de521000
call fcn.1de44a520
mov rbx, rax
lea rax, [0x1de6138c0]
nop
call fcn.1de474e40
nop
mov qword [rsp + 8], rax
mov byte [rsp + 0x10], bl
call fcn.1de49d360
mov rax, qword [rsp + 8]
movzx ebx, byte [rsp + 0x10]
nop
jmp fcn.1de521540

Function at 0x1de527980
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x1de527a73
sub rsp, 0x40
mov qword [rsp + 0x38], rbp
lea rbp, [rsp + 0x38]
movabs rdx, 0x746126da1a7075d9
mov qword [rsp + 0x19], rdx
movabs rdx, 0x5a1a391b61482174
mov qword [rsp + 0x20], rdx
movabs rdx, 0x80c0804050b000e
mov qword [rsp + 0x28], rdx
movabs rdx, 0xe000d030e00080e
mov qword [rsp + 0x30], rdx
xor eax, eax
jmp 0x1de5279f2
movzx r9d, byte [rsp + rsi + 0x19]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x38]
mov byte [rsp + rdi + 0x19], dl
mov byte [rsp + rsi + 0x19], r8b
add rax, 2
cmp rax, 0x10
jge 0x1de527a2e
movzx edx, byte [rsp + rax + 0x28]
lea rsi, [rax + 1]
cmp rsi, 0x10
jae 0x1de527a65
movzx esi, byte [rsp + rax + 0x29]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0xf
jae 0x1de527a55
movzx r8d, byte [rsp + rdi + 0x19]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x38]
cmp rsi, 0xf
jb 0x1de5279d8
jmp 0x1de527a49
xor eax, eax
lea rbx, [rsp + 0x19]
mov ecx, 0xf
call fcn.1de48b520
mov rbp, qword [rsp + 0x38]
add rsp, 0x40
ret
mov eax, esi
mov ecx, 0xf
call fcn.1de49fa60
mov eax, edi
mov ecx, 0xf
nop dword [rax]
call fcn.1de49fa60
mov rax, rsi
mov ecx, 0x10
call fcn.1de49fa60
nop
call fcn.1de49d360
jmp fcn.1de527980
Function at 0x1de5334e0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x1de5335eb
sub rsp, 0x48
mov qword [rsp + 0x40], rbp
lea rbp, [rsp + 0x40]
movabs rdx, 0xb066ab34ababe0b2
mov qword [rsp + 0x19], rdx
movabs rdx, 0xd7b066ab34ababe0
mov qword [rsp + 0x1a], rdx
movabs rdx, 0x78667464840170b3
mov qword [rsp + 0x22], rdx
movabs rdx, 0xa08090e05030006
mov qword [rsp + 0x2a], rdx
movabs rdx, 0xb0a020e010b0a08
mov qword [rsp + 0x30], rdx
movabs rdx, 0x5060c0703030105
mov qword [rsp + 0x38], rdx
xor eax, eax
jmp 0x1de533573
movzx r9d, byte [rsp + rsi + 0x19]
sub r9d, edx
lea edx, [r9 - 0x30]
mov byte [rsp + rdi + 0x19], dl
lea edx, [r8 - 0x30]
mov byte [rsp + rsi + 0x19], dl
add rax, 2
cmp rax, 0x16
jge 0x1de5335aa
movzx edx, byte [rsp + rax + 0x2a]
lea rsi, [rax + 1]
cmp rsi, 0x16
jae 0x1de5335dd
movzx esi, byte [rsp + rax + 0x2b]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x11
jae 0x1de5335d1
movzx r8d, byte [rsp + rdi + 0x19]
sub r8d, edx
cmp rsi, 0x11
jb 0x1de533556
jmp 0x1de5335c5
xor eax, eax
lea rbx, [rsp + 0x19]
mov ecx, 0x11
call fcn.1de48b520
mov rbp, qword [rsp + 0x40]
add rsp, 0x48
ret
mov eax, esi
mov ecx, 0x11
call fcn.1de49fa60
mov eax, edi
mov ecx, 0x11
call fcn.1de49fa60
mov rax, rsi
mov ecx, 0x16
call fcn.1de49fa60
nop
call fcn.1de49d360
jmp fcn.1de5334e0

Function at 0x1de5376e0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x1de5377b3
sub rsp, 0x30
mov qword [rsp + 0x28], rbp
lea rbp, [rsp + 0x28]
mov dword [rsp + 0x1a], 0x334f2529
mov word [rsp + 0x1e], 0x672c
movabs rdx, 0x204040304010004
mov qword [rsp + 0x20], rdx
xor eax, eax
jmp 0x1de537737
movzx r9d, byte [rsp + rsi + 0x1a]
sub r9d, edx
lea edx, [r9 + 0x2b]
mov byte [rsp + rdi + 0x1a], dl
lea edx, [r8 + 0x2b]
mov byte [rsp + rsi + 0x1a], dl
add rax, 2
cmp rax, 8
jge 0x1de53776e
movzx edx, byte [rsp + rax + 0x20]
lea rsi, [rax + 1]
cmp rsi, 8
jae 0x1de5377a5
movzx esi, byte [rsp + rax + 0x21]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 6
jae 0x1de537795
movzx r8d, byte [rsp + rdi + 0x1a]
sub r8d, edx
cmp rsi, 6
jb 0x1de53771a
jmp 0x1de537789
xor eax, eax
lea rbx, [rsp + 0x1a]
mov ecx, 6
call fcn.1de48b520
mov rbp, qword [rsp + 0x28]
add rsp, 0x30
ret
mov eax, esi
mov ecx, 6
call fcn.1de49fa60
mov eax, edi
mov ecx, 6
nop dword [rax]
call fcn.1de49fa60
mov rax, rsi
mov ecx, 8
call fcn.1de49fa60
nop
call fcn.1de49d360
jmp fcn.1de5376e0
Function at 0x1de53bf80
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x1de53c060
sub rsp, 0x38
mov qword [rsp + 0x30], rbp
lea rbp, [rsp + 0x30]
movabs rdx, 0xce8f4e394447421e
mov qword [rsp + 0x1a], rdx
mov word [rsp + 0x22], 0xbcbb
movabs rdx, 0x400000207080906
mov qword [rsp + 0x24], rdx
mov dword [rsp + 0x2c], 0x2000902
xor eax, eax
jmp 0x1de53bfe3
movzx r9d, byte [rsp + rsi + 0x1a]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x79]
mov byte [rsp + rdi + 0x1a], dl
mov byte [rsp + rsi + 0x1a], r8b
add rax, 2
cmp rax, 0xc
jge 0x1de53c01f
movzx edx, byte [rsp + rax + 0x24]
lea rsi, [rax + 1]
cmp rsi, 0xc
jae 0x1de53c052
movzx esi, byte [rsp + rax + 0x25]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0xa
jae 0x1de53c046
movzx r8d, byte [rsp + rdi + 0x1a]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x79]
cmp rsi, 0xa
jb 0x1de53bfc9
jmp 0x1de53c03a
xor eax, eax
lea rbx, [rsp + 0x1a]
mov ecx, 0xa
call fcn.1de48b520
mov rbp, qword [rsp + 0x30]
add rsp, 0x38
ret
mov eax, esi
mov ecx, 0xa
call fcn.1de49fa60
mov eax, edi
mov ecx, 0xa
call fcn.1de49fa60
mov rax, rsi
mov ecx, 0xc
call fcn.1de49fa60
nop
call fcn.1de49d360
jmp fcn.1de53bf80

Function at 0x1de53f400
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x1de53f529
sub rsp, 0x60
mov qword [rsp + 0x58], rbp
lea rbp, [rsp + 0x58]
movabs rdx, 0xa674e0f1e5e235a3
mov qword [rsp + 0x1c], rdx
movabs rdx, 0xf56de3de9f508de2
mov qword [rsp + 0x24], rdx
movabs rdx, 0x65670961edfcd673
mov qword [rsp + 0x2c], rdx
movabs rdx, 0x31307050a06050c
mov qword [rsp + 0x34], rdx
movabs rdx, 0x915100503130705
mov qword [rsp + 0x38], rdx
movabs rdx, 0xd04000612000509
mov qword [rsp + 0x40], rdx
movabs rdx, 0xb150f010a110802
mov qword [rsp + 0x48], rdx
movabs rdx, 0x1507060f0510100e
mov qword [rsp + 0x50], rdx
xor eax, eax
jmp 0x1de53f4b1
movzx r9d, byte [rsp + rsi + 0x1c]
sub r9d, edx
lea edx, [r9 - 0x63]
mov byte [rsp + rdi + 0x1c], dl
lea edx, [r8 - 0x63]
mov byte [rsp + rsi + 0x1c], dl
add rax, 2
cmp rax, 0x24
jge 0x1de53f4e8
movzx edx, byte [rsp + rax + 0x34]
lea rsi, [rax + 1]
cmp rsi, 0x24
jae 0x1de53f51b
movzx esi, byte [rsp + rax + 0x35]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x18
jae 0x1de53f50f
movzx r8d, byte [rsp + rdi + 0x1c]
sub r8d, edx
cmp rsi, 0x18
jb 0x1de53f494
jmp 0x1de53f503
xor eax, eax
lea rbx, [rsp + 0x1c]
mov ecx, 0x18
call fcn.1de48b520
mov rbp, qword [rsp + 0x58]
add rsp, 0x60
ret
mov eax, esi
mov ecx, 0x18
call fcn.1de49fa60
mov eax, edi
mov ecx, 0x18
call fcn.1de49fa60
mov rax, rsi
mov ecx, 0x24
call fcn.1de49fa60
nop
call fcn.1de49d360
jmp fcn.1de53f400
Function at 0x1de53f540
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x1de53f69f
sub rsp, 0x70
mov qword [rsp + 0x68], rbp
lea rbp, [rsp + 0x68]
movabs rdx, 0xe875f24366612494
mov qword [rsp + 0x1b], rdx
movabs rdx, 0x44e875f243666124
mov qword [rsp + 0x1c], rdx
movabs rdx, 0xb583426161da2e73
mov qword [rsp + 0x24], rdx
movabs rdx, 0x6955e71eb6e05d23
mov qword [rsp + 0x2c], rdx
movabs rdx, 0x8d33a21c2cfad0b
mov qword [rsp + 0x34], rdx
movabs rdx, 0x808001a010a1e16
mov qword [rsp + 0x3c], rdx
movabs rdx, 0x111c131a000b1f
mov qword [rsp + 0x44], rdx
movabs rdx, 0x1e07201600111c13
mov qword [rsp + 0x48], rdx
movabs rdx, 0x14140d1c0b101705
mov qword [rsp + 0x50], rdx
movabs rdx, 0x150f1c1b1905151a
mov qword [rsp + 0x58], rdx
movabs rdx, 0xf140b1920151b13
mov qword [rsp + 0x60], rdx
xor eax, eax
nop
jmp 0x1de53f620
movzx r9d, byte [rsp + rsi + 0x1b]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x2a]
mov byte [rsp + rdi + 0x1b], dl
mov byte [rsp + rsi + 0x1b], r8b
add rax, 2
nop dword [rax]
cmp rax, 0x2c
jge 0x1de53f65c
movzx edx, byte [rsp + rax + 0x3c]
lea rsi, [rax + 1]
cmp rsi, 0x2c
jae 0x1de53f691
movzx esi, byte [rsp + rax + 0x3d]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x21
jae 0x1de53f685
movzx r8d, byte [rsp + rdi + 0x1b]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x2a]
cmp rsi, 0x21
jb 0x1de53f602
jmp 0x1de53f677
xor eax, eax
lea rbx, [rsp + 0x1b]
mov ecx, 0x21
call fcn.1de48b520
mov rbp, qword [rsp + 0x68]
add rsp, 0x70
ret
mov eax, esi
mov ecx, 0x21
nop
call fcn.1de49fa60
mov eax, edi
mov ecx, 0x21
call fcn.1de49fa60
mov rax, rsi
mov ecx, 0x2c
call fcn.1de49fa60
nop
nop
call fcn.1de49d360
jmp fcn.1de53f540
Function at 0x1de5448c0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
lea r12, [rsp - 8]
cmp r12, qword [r14 + 0x10]
jbe 0x1de544a49
sub rsp, 0x88
mov qword [rsp + 0x80], rbp
lea rbp, [rsp + 0x80]
movabs rdx, 0x6fcbca922d856fa0
mov qword [rsp + 0x1e], rdx
movabs rdx, 0x74e96576e7b9b310
mov qword [rsp + 0x26], rdx
movabs rdx, 0xe965d2b274e96576
mov qword [rsp + 0x2a], rdx
movabs rdx, 0x82dc209ca97c9390
mov qword [rsp + 0x32], rdx
movabs rdx, 0xdfbb746f6d06937a
mov qword [rsp + 0x3a], rdx
movabs rdx, 0x7aa974726f707060
mov qword [rsp + 0x42], rdx
movabs rdx, 0x5100c151316020e
mov qword [rsp + 0x4a], rdx
movabs rdx, 0x23062b201d020510
mov qword [rsp + 0x50], rdx
movabs rdx, 0x2a1d230c1a2a0c06
mov qword [rsp + 0x58], rdx
movabs rdx, 0x1e10221f1b130214
mov qword [rsp + 0x60], rdx
movabs rdx, 0xe0a160b18002408
mov qword [rsp + 0x68], rdx
movabs rdx, 0xe1716090e10040b
mov qword [rsp + 0x70], rdx
movabs rdx, 0x141e241105042a2a
mov qword [rsp + 0x78], rdx
xor eax, eax
jmp 0x1de5449ca
movzx r9d, byte [rsp + rsi + 0x1e]
sub r9d, edx
lea edx, [r9 + 0xa]
mov byte [rsp + rdi + 0x1e], dl
lea edx, [r8 + 0xa]
mov byte [rsp + rsi + 0x1e], dl
add rax, 2
cmp rax, 0x36
jge 0x1de544a02
movzx edx, byte [rsp + rax + 0x4a]
lea rsi, [rax + 1]
cmp rsi, 0x36
jae 0x1de544a3b
movzx esi, byte [rsp + rax + 0x4b]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x2c
jae 0x1de544a2f
movzx r8d, byte [rsp + rdi + 0x1e]
sub r8d, edx
cmp rsi, 0x2c
jb 0x1de5449ad
nop
jmp 0x1de544a23
xor eax, eax
lea rbx, [rsp + 0x1e]
mov ecx, 0x2c
call fcn.1de48b520
mov rbp, qword [rsp + 0x80]
add rsp, 0x88
ret
mov eax, esi
mov ecx, 0x2c
call fcn.1de49fa60
mov eax, edi
mov ecx, 0x2c
call fcn.1de49fa60
mov rax, rsi
mov ecx, 0x36
call fcn.1de49fa60
nop
call fcn.1de49d360
jmp fcn.1de5448c0
Function at 0x1de549800
Capabilities:
Encrypt data using rc4 prga

Disassembly:
lea r12, [rsp - 0x58]
cmp r12, qword [r14 + 0x10]
jbe 0x1de54999f
sub rsp, 0xd8
mov qword [rsp + 0xd0], rbp
lea rbp, [rsp + 0xd0]
movabs rdx, 0x6c61976f7786d696
mov qword [rsp + 0x1a], rdx
movabs rdx, 0x9872f837498fbf59
mov qword [rsp + 0x22], rdx
movabs rdx, 0x659c69899872f837
mov qword [rsp + 0x26], rdx
movabs rdx, 0xbe218169b62be128
mov qword [rsp + 0x2e], rdx
movabs rdx, 0x77befb8918737c33
mov qword [rsp + 0x36], rdx
movabs rdx, 0x24c76e8ad497b669
mov qword [rsp + 0x3e], rdx
movabs rdx, 0x2f72296425d14d3e
mov qword [rsp + 0x46], rdx
movabs rdx, 0x5f47508e56a16d6f
mov qword [rsp + 0x4e], rdx
movabs rdx, 0xb56ee463a5788963
mov qword [rsp + 0x56], rdx
movabs rdx, 0x655c8931176f6c
mov qword [rsp + 0x5e], rdx
movabs rdx, 0x2041251f270c0922
mov qword [rsp + 0x66], rdx
movabs rdx, 0x13f230f182e3540
mov qword [rsp + 0x6e], rdx
lea rdi, [rsp + 0x70]
lea rsi, [0x1de668b72]
mov qword [rsp - 0x10], rbp
lea rbp, [rsp - 0x10]
call fcn.1de4a006c
mov rbp, qword [rbp]
xor eax, eax
jmp 0x1de549917
movzx r9d, byte [rsp + rsi + 0x1a]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x7f]
mov byte [rsp + rdi + 0x1a], dl
mov byte [rsp + rsi + 0x1a], r8b
add rax, 2
cmp rax, 0x6a
jge 0x1de549953
movzx edx, byte [rsp + rax + 0x66]
lea rsi, [rax + 1]
cmp rsi, 0x6a
jae 0x1de549991
movzx esi, byte [rsp + rax + 0x67]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x4c
jae 0x1de549985
movzx r8d, byte [rsp + rdi + 0x1a]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x7f]
cmp rsi, 0x4c
jb 0x1de5498fd
jmp 0x1de549975
xor eax, eax
lea rbx, [rsp + 0x1a]
mov ecx, 0x4c
nop
call fcn.1de48b520
mov rbp, qword [rsp + 0xd0]
add rsp, 0xd8
ret
mov eax, esi
mov ecx, 0x4c
nop dword [rax]
call fcn.1de49fa60
mov eax, edi
mov ecx, 0x4c
call fcn.1de49fa60
mov rax, rsi
mov ecx, 0x6a
call fcn.1de49fa60
nop
nop
call fcn.1de49d360
jmp fcn.1de549800