joyce8/EMBER2024-capa huggingface dataset:
Function at 0x470da0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x470ee6
sub rsp, 0x78
mov qword [rsp + 0x70], rbp
lea rbp, [rsp + 0x70]
movabs rdx, 0x46616f8346c719f0
mov qword [rsp + 0x1f], rdx
movabs rdx, 0xad786946616f8346
mov qword [rsp + 0x22], rdx
movabs rdx, 0xf80087632069db64
mov qword [rsp + 0x2a], rdx
movabs rdx, 0xe116defb718d6465
mov qword [rsp + 0x32], rdx
movabs rdx, 0x9520fd8d13267a70
mov qword [rsp + 0x3a], rdx
movabs rdx, 0x20011a160c1d1f15
mov qword [rsp + 0x42], rdx
movabs rdx, 0xd0d160100191822
mov qword [rsp + 0x4a], rdx
movabs rdx, 0x411010020040d0d
mov qword [rsp + 0x50], rdx
movabs rdx, 0x1a1c1a1c011e1001
mov qword [rsp + 0x58], rdx
movabs rdx, 0x1018121917161a0a
mov qword [rsp + 0x60], rdx
movabs rdx, 0x1a020d2018120c12
mov qword [rsp + 0x68], rdx
xor eax, eax
nop
jmp 0x470e80
movzx r9d, byte [rsp + rsi + 0x1f]
sub r9d, edx
lea edx, [r9 - 0x63]
mov byte [rsp + rdi + 0x1f], dl
lea edx, [r8 - 0x63]
mov byte [rsp + rsi + 0x1f], dl
add rax, 2
nop
cmp rax, 0x2e
jge 0x470ead
movzx edx, byte [rsp + rax + 0x42]
movzx esi, byte [rsp + rax + 0x43]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x23
jae 0x470ed4
movzx r8d, byte [rsp + rdi + 0x1f]
sub r8d, edx
cmp rsi, 0x23
jb 0x470e62
jmp 0x470ec8
xor eax, eax
lea rbx, [rsp + 0x1f]
mov ecx, 0x23
call fcn.00441e20
mov rbp, qword [rsp + 0x70]
add rsp, 0x78
ret
mov eax, esi
mov ecx, 0x23
call fcn.00453d80
mov eax, edi
mov ecx, 0x23
nop dword [rax + rax]
call fcn.00453d80
nop
call fcn.00451720
jmp fcn.00470da0

Function at 0x471640
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x47172b
sub rsp, 0x48
mov qword [rsp + 0x40], rbp
lea rbp, [rsp + 0x40]
movabs rdx, 0x9636c934771ad9f9
mov qword [rsp + 0x1a], rdx
movabs rdx, 0x66da3e63c7d01d07
mov qword [rsp + 0x22], rdx
movabs rdx, 0x7070502020d000b
mov qword [rsp + 0x2a], rdx
movabs rdx, 0x1090a07030a0707
mov qword [rsp + 0x30], rdx
movabs rdx, 0x108080d0101050e
mov qword [rsp + 0x38], rdx
xor eax, eax
jmp 0x4716c4
movzx r9d, byte [rsp + rsi + 0x1a]
sub r9d, edx
lea edx, [r9 + 0x74]
mov byte [rsp + rdi + 0x1a], dl
lea edx, [r8 + 0x74]
mov byte [rsp + rsi + 0x1a], dl
add rax, 2
cmp rax, 0x16
jge 0x4716f7
movzx edx, byte [rsp + rax + 0x2a]
movzx esi, byte [rsp + rax + 0x2b]
mov edi, edx
xor edx, esi
add edx, eax
nop word [rax + rax]
cmp rdi, 0x10
jae 0x47171e
movzx r8d, byte [rsp + rdi + 0x1a]
sub r8d, edx
cmp rsi, 0x10
jb 0x4716a7
jmp 0x471712
xor eax, eax
lea rbx, [rsp + 0x1a]
mov ecx, 0x10
call fcn.00441e20
mov rbp, qword [rsp + 0x40]
add rsp, 0x48
ret
mov eax, esi
mov ecx, 0x10
call fcn.00453d80
mov eax, edi
mov ecx, 0x10
call fcn.00453d80
nop
call fcn.00451720
jmp fcn.00471640
Function at 0x477ee0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x477fa8
sub rsp, 0x38
mov qword [rsp + 0x30], rbp
lea rbp, [rsp + 0x30]
movabs rdx, 0x42ce7261c8d23f26
mov qword [rsp + 0x1e], rdx
movabs rdx, 0x20103060000
mov qword [rsp + 0x26], rdx
mov word [rsp + 0x2e], 0x202
xor eax, eax
nop
jmp 0x477f40
movzx r9d, byte [rsp + rsi + 0x1e]
add r9d, 0xffffff90
add edx, r9d
mov byte [rsp + rdi + 0x1e], dl
mov byte [rsp + rsi + 0x1e], r8b
add rax, 2
nop dword [rax]
cmp rax, 0xa
jge 0x477f71
movzx edx, byte [rsp + rax + 0x26]
movzx esi, byte [rsp + rax + 0x27]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 8
jae 0x477f9b
movzx r8d, byte [rsp + rdi + 0x1e]
add r8d, 0xffffff90
add r8d, edx
cmp rsi, 8
jb 0x477f22
jmp 0x477f8f
xor eax, eax
lea rbx, [rsp + 0x1e]
mov ecx, 8
nop dword [rax]
call fcn.00441e20
mov rbp, qword [rsp + 0x30]
add rsp, 0x38
ret
mov eax, esi
mov ecx, 8
call fcn.00453d80
mov eax, edi
mov ecx, 8
call fcn.00453d80
nop
call fcn.00451720
jmp fcn.00477ee0

Function at 0x478780
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x47885c
sub rsp, 0x40
mov qword [rsp + 0x38], rbp
lea rbp, [rsp + 0x38]
movabs rdx, 0x1eca0e729073610b
mov qword [rsp + 0x1d], rdx
movabs rdx, 0x70d16e6f471eca0e
mov qword [rsp + 0x22], rdx
movabs rdx, 0x70c0c03060b
mov qword [rsp + 0x2a], rdx
movabs rdx, 0x50b030b06070000
mov qword [rsp + 0x30], rdx
xor eax, eax
jmp 0x4787f2
movzx r9d, byte [rsp + rsi + 0x1d]
add r9d, 0x3c
add edx, r9d
mov byte [rsp + rdi + 0x1d], dl
mov byte [rsp + rsi + 0x1d], r8b
add rax, 2
cmp rax, 0xe
jge 0x478828
movzx edx, byte [rsp + rax + 0x2a]
movzx esi, byte [rsp + rax + 0x2b]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0xd
jae 0x47884f
movzx r8d, byte [rsp + rdi + 0x1d]
add r8d, 0x3c
add r8d, edx
nop dword [rax + rax]
cmp rsi, 0xd
jb 0x4787d8
jmp 0x478843
xor eax, eax
lea rbx, [rsp + 0x1d]
mov ecx, 0xd
call fcn.00441e20
mov rbp, qword [rsp + 0x38]
add rsp, 0x40
ret
mov eax, esi
mov ecx, 0xd
call fcn.00453d80
mov eax, edi
mov ecx, 0xd
call fcn.00453d80
nop
nop dword [rax]
call fcn.00451720
jmp fcn.00478780

Function at 0x479a20
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x479adc
sub rsp, 0x30
mov qword [rsp + 0x28], rbp
lea rbp, [rsp + 0x28]
movabs rdx, 0x698ef96d43fdf0f5
mov qword [rsp + 0x20], rdx
movabs rdx, 0x6040501020406
mov qword [rsp + 0x18], rdx
xor eax, eax
jmp 0x479a74
movzx r9d, byte [rsp + rsi + 0x20]
add r9d, 0x6a
add edx, r9d
mov byte [rsp + rdi + 0x20], dl
mov byte [rsp + rsi + 0x20], r8b
add rax, 2
cmp rax, 8
jge 0x479aa8
movzx edx, byte [rsp + rax + 0x18]
movzx esi, byte [rsp + rax + 0x19]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 8
jae 0x479acf
movzx r8d, byte [rsp + rdi + 0x20]
add r8d, 0x6a
add r8d, edx
nop dword [rax]
cmp rsi, 8
jb 0x479a5a
jmp 0x479ac3
xor eax, eax
lea rbx, [rsp + 0x20]
mov ecx, 8
call fcn.00441e20
mov rbp, qword [rsp + 0x28]
add rsp, 0x30
ret
mov eax, esi
mov ecx, 8
call fcn.00453d80
mov eax, edi
mov ecx, 8
call fcn.00453d80
nop
nop dword [rax]
call fcn.00451720
jmp fcn.00479a20
Function at 0x47a6a0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x47a768
sub rsp, 0x38
mov qword [rsp + 0x30], rbp
lea rbp, [rsp + 0x30]
movabs rdx, 0xc0a7e85c5f6403bb
mov qword [rsp + 0x26], rdx
mov word [rsp + 0x2e], 0x6369
movabs rdx, 0x600010506050406
mov qword [rsp + 0x1c], rdx
mov word [rsp + 0x24], 0x507
xor eax, eax
jmp 0x47a702
movzx r9d, byte [rsp + rsi + 0x26]
add r9d, 0xffffffab
add edx, r9d
mov byte [rsp + rdi + 0x26], dl
mov byte [rsp + rsi + 0x26], r8b
add rax, 2
cmp rax, 0xa
jge 0x47a733
movzx edx, byte [rsp + rax + 0x1c]
movzx esi, byte [rsp + rax + 0x1d]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0xa
jae 0x47a75b
movzx r8d, byte [rsp + rdi + 0x26]
add r8d, 0xffffffab
add r8d, edx
cmp rsi, 0xa
jb 0x47a6e8
jmp 0x47a74f
xor eax, eax
lea rbx, [rsp + 0x26]
mov ecx, 0xa
nop
call fcn.00441e20
mov rbp, qword [rsp + 0x30]
add rsp, 0x38
ret
mov eax, esi
mov ecx, 0xa
call fcn.00453d80
mov eax, edi
mov ecx, 0xa
call fcn.00453d80
nop
call fcn.00451720
jmp fcn.0047a6a0

Function at 0x47bfe0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x47c0a6
sub rsp, 0x38
mov qword [rsp + 0x30], rbp
lea rbp, [rsp + 0x30]
movabs rdx, 0x4b3c2735e36961c3
mov qword [rsp + 0x1e], rdx
movabs rdx, 0x703040006050405
mov qword [rsp + 0x26], rdx
mov word [rsp + 0x2e], 0x503
xor eax, eax
nop
jmp 0x47c040
movzx r9d, byte [rsp + rsi + 0x1e]
sub r9d, edx
lea edx, [r9 - 0x65]
mov byte [rsp + rdi + 0x1e], dl
lea edx, [r8 - 0x65]
mov byte [rsp + rsi + 0x1e], dl
add rax, 2
nop
cmp rax, 0xa
jge 0x47c06d
movzx edx, byte [rsp + rax + 0x26]
movzx esi, byte [rsp + rax + 0x27]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 8
jae 0x47c094
movzx r8d, byte [rsp + rdi + 0x1e]
sub r8d, edx
cmp rsi, 8
jb 0x47c022
jmp 0x47c088
xor eax, eax
lea rbx, [rsp + 0x1e]
mov ecx, 8
call fcn.00441e20
mov rbp, qword [rsp + 0x30]
add rsp, 0x38
ret
mov eax, esi
mov ecx, 8
call fcn.00453d80
mov eax, edi
mov ecx, 8
nop dword [rax + rax]
call fcn.00453d80
nop
call fcn.00451720
jmp fcn.0047bfe0

Function at 0x47cb80
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x47cc48
sub rsp, 0x38
mov qword [rsp + 0x30], rbp
lea rbp, [rsp + 0x30]
movabs rdx, 0x1e67f61bbd296519
mov qword [rsp + 0x1b], rdx
mov byte [rsp + 0x23], 0
movabs rdx, 0x405030000070807
mov qword [rsp + 0x24], rdx
mov dword [rsp + 0x2c], 0x30202
xor eax, eax
jmp 0x47cbe1
movzx r9d, byte [rsp + rsi + 0x1b]
add r9d, 0x47
add edx, r9d
mov byte [rsp + rdi + 0x1b], dl
mov byte [rsp + rsi + 0x1b], r8b
add rax, 2
cmp rax, 0xc
jge 0x47cc12
movzx edx, byte [rsp + rax + 0x24]
movzx esi, byte [rsp + rax + 0x25]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 9
jae 0x47cc3b
movzx r8d, byte [rsp + rdi + 0x1b]
add r8d, 0x47
add r8d, edx
cmp rsi, 9
jb 0x47cbc7
jmp 0x47cc2f
xor eax, eax
lea rbx, [rsp + 0x1b]
mov ecx, 9
nop
call fcn.00441e20
mov rbp, qword [rsp + 0x30]
add rsp, 0x38
ret
mov eax, esi
mov ecx, 9
call fcn.00453d80
mov eax, edi
mov ecx, 9
call fcn.00453d80
nop
call fcn.00451720
jmp fcn.0047cb80
Function at 0x47e4e0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x47e5bc
sub rsp, 0x40
mov qword [rsp + 0x38], rbp
lea rbp, [rsp + 0x38]
movabs rdx, 0x5f6e72658574616b
mov qword [rsp + 0x1a], rdx
movabs rdx, 0x7e60748088535f6e
mov qword [rsp + 0x20], rdx
movabs rdx, 0x90b0c0a000b0d
mov qword [rsp + 0x28], rdx
movabs rdx, 0xb000c0a030c0c0c
mov qword [rsp + 0x30], rdx
xor eax, eax
jmp 0x47e555
movzx r9d, byte [rsp + rsi + 0x1a]
sub r9d, edx
lea edx, [r9 + 0xa]
mov byte [rsp + rdi + 0x1a], dl
lea edx, [r8 + 0xa]
mov byte [rsp + rsi + 0x1a], dl
add rax, 2
cmp rax, 0x10
jge 0x47e588
movzx edx, byte [rsp + rax + 0x28]
movzx esi, byte [rsp + rax + 0x29]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0xe
jae 0x47e5af
movzx r8d, byte [rsp + rdi + 0x1a]
sub r8d, edx
nop word [rax + rax]
cmp rsi, 0xe
jb 0x47e538
jmp 0x47e5a3
xor eax, eax
lea rbx, [rsp + 0x1a]
mov ecx, 0xe
call fcn.00441e20
mov rbp, qword [rsp + 0x38]
add rsp, 0x40
ret
mov eax, esi
mov ecx, 0xe
call fcn.00453d80
mov eax, edi
mov ecx, 0xe
call fcn.00453d80
nop
nop dword [rax]
call fcn.00451720
jmp fcn.0047e4e0

Function at 0x47e820
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x47e916
sub rsp, 0x48
mov qword [rsp + 0x40], rbp
lea rbp, [rsp + 0x40]
movabs rdx, 0x6c596e6167676554
mov qword [rsp + 0x1a], rdx
movabs rdx, 0x495f6c596e616767
mov qword [rsp + 0x1c], rdx
movabs rdx, 0x526f664b4f486474
mov qword [rsp + 0x24], rdx
movabs rdx, 0xa0f000e1100000f
mov qword [rsp + 0x2c], rdx
movabs rdx, 0x60c04060a0f000e
mov qword [rsp + 0x30], rdx
movabs rdx, 0xd060a030a0a0304
mov qword [rsp + 0x38], rdx
xor eax, eax
jmp 0x47e8b0
movzx r9d, byte [rsp + rsi + 0x1a]
add r9d, 0xfffffff5
add edx, r9d
mov byte [rsp + rdi + 0x1a], dl
mov byte [rsp + rsi + 0x1a], r8b
add rax, 2
cmp rax, 0x14
jge 0x47e8e2
movzx edx, byte [rsp + rax + 0x2c]
movzx esi, byte [rsp + rax + 0x2d]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x12
jae 0x47e909
movzx r8d, byte [rsp + rdi + 0x1a]
add r8d, 0xfffffff5
add r8d, edx
cmp rsi, 0x12
jb 0x47e896
nop
jmp 0x47e8fd
xor eax, eax
lea rbx, [rsp + 0x1a]
mov ecx, 0x12
call fcn.00441e20
mov rbp, qword [rsp + 0x40]
add rsp, 0x48
ret
mov eax, esi
mov ecx, 0x12
call fcn.00453d80
mov eax, edi
mov ecx, 0x12
call fcn.00453d80
nop
call fcn.00451720
nop dword [rax + rax]
jmp fcn.0047e820
Function at 0x4863c0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x48649c
sub rsp, 0x40
mov qword [rsp + 0x38], rbp
lea rbp, [rsp + 0x38]
movabs rdx, 0xd1980e6605906e88
mov qword [rsp + 0x1a], rdx
movabs rdx, 0x46574030a11d198
mov qword [rsp + 0x20], rdx
movabs rdx, 0xd02080807060305
mov qword [rsp + 0x28], rdx
movabs rdx, 0xd0a090703090009
mov qword [rsp + 0x30], rdx
xor eax, eax
jmp 0x486432
movzx r9d, byte [rsp + rsi + 0x1a]
add r9d, 0x5a
add edx, r9d
mov byte [rsp + rdi + 0x1a], dl
mov byte [rsp + rsi + 0x1a], r8b
add rax, 2
cmp rax, 0x10
jge 0x486468
movzx edx, byte [rsp + rax + 0x28]
movzx esi, byte [rsp + rax + 0x29]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0xe
jae 0x48648f
movzx r8d, byte [rsp + rdi + 0x1a]
add r8d, 0x5a
add r8d, edx
nop dword [rax + rax]
cmp rsi, 0xe
jb 0x486418
jmp 0x486483
xor eax, eax
lea rbx, [rsp + 0x1a]
mov ecx, 0xe
call fcn.00441e20
mov rbp, qword [rsp + 0x38]
add rsp, 0x40
ret
mov eax, esi
mov ecx, 0xe
call fcn.00453d80
mov eax, edi
mov ecx, 0xe
call fcn.00453d80
nop
nop dword [rax]
call fcn.00451720
jmp fcn.004863c0
Function at 0x486fe0
Capabilities:
Hash data using fnv

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x48722c
add rsp, 0xffffffffffffff80
mov qword [rsp + 0x78], rbp
lea rbp, [rsp + 0x78]
mov ebx, dword [rax + 0x2c]
nop dword [rax + rax]
test ebx, ebx
jne 0x48708c
mov qword [rsp + 0x88], rax
lea rbx, [0x00531f00]
mov rcx, rax
lea rax, [0x005e5b80]
call fcn.0045d700
test cl, cl
jne 0x487071
mov rax, qword [rsp + 0x88]
call fcn.00486540
mov ecx, 1
mov rdi, rax
mov rsi, rbx
lea rax, [rsp + 0x30]
lea rbx, [0x00552868]
call fcn.00441a80
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x28], rbx
nop dword [rax]
call fcn.004872c0
mov rcx, qword [rsp + 0x88]
xor edx, edx
jmp 0x4870ae
lea rdx, [0x00531c40]
cmp rax, rdx
jne 0x48709c
test byte [rbx], al
mov rax, rbx
mov rbp, qword [rsp + 0x78]
sub rsp, 0xffffffffffffff80
ret
nop
call fcn.0044f5e0
mov rbp, qword [rsp + 0x78]
sub rsp, 0xffffffffffffff80
ret
mov rbx, rdx
lea rcx, [0x00523520]
call fcn.00409100
inc rdx
cmp rbx, rdx
jle 0x4870f8
mov rsi, qword [rax + rdx*8]
cmp qword [rsi + 0x30], rcx
jne 0x4870ab
lea rax, [0x005e5b80]
lea rbx, [0x00531f00]
lea rdi, [0x00531c40]
call fcn.0045d8c0
lea rdx, [0x00531c40]
nop
cmp rax, rdx
jne 0x48721c
test byte [rbx], al
mov rax, rbx
mov rbp, qword [rsp + 0x78]
sub rsp, 0xffffffffffffff80
ret
lea rcx, [0x0051f720]
mov qword [rsp + 0x68], rcx
mov qword [rsp + 0x70], 0
mov rcx, qword [rsp + 0x68]
mov qword [rsp + 0x50], rcx
lea rax, [0x005287a0]
nop
call fcn.0040b9c0
mov qword [rsp + 0x60], rax
mov rcx, qword [rsp + 0x50]
test byte [rcx], al
cmp dword [0x00639290], 0
jne 0x48715a
mov rdx, qword [rcx]
mov qword [rax], rdx
movups xmm0, xmmword [rcx + 8]
movups xmmword [rax + 8], xmm0
movups xmm0, xmmword [rcx + 0x18]
movups xmmword [rax + 0x18], xmm0
movups xmm0, xmmword [rcx + 0x28]
movups xmmword [rax + 0x28], xmm0
jmp 0x487169
mov rbx, rax
lea rax, [0x005287a0]
call fcn.00410a00
mov rax, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x28]
xor ecx, ecx
xor edi, edi
xor esi, esi
mov r8d, esi
nop dword [rax]
call fcn.004859c0
nop
call fcn.0044f6a0
mov rsi, qword [rsp + 0x60]
mov dword [rsi + 0x28], eax
mov dword [rsi + 0x2c], 0
mov rcx, qword [rsp + 0x88]
mov edx, dword [rcx + 0x10]
xor eax, eax
jmp 0x4871b7
imul edx, edx, 0x1000193
xor edx, 0x2a
mov eax, 1
cmp rax, 1
jl 0x4871a9
mov dword [rsi + 0x10], edx
cmp dword [0x00639290], 0
jne 0x4871cf
mov qword [rsi + 0x30], rcx
jmp 0x4871d8
lea rdi, [rsi + 0x30]
call fcn.004539e0
lea rax, [0x005e5b80]
lea rbx, [0x00531f00]
lea rdi, [0x00531c40]
call fcn.0045d8c0
lea rdx, [0x00531c40]
cmp rax, rdx
jne 0x48720d
test byte [rbx], al
mov rax, rbx
mov rbp, qword [rsp + 0x78]
sub rsp, 0xffffffffffffff80
ret
mov rbx, rdx
lea rcx, [0x00523520]
call fcn.00409100
mov rbx, rdx
lea rcx, [0x00523520]
call fcn.00409100
nop
mov qword [rsp + 8], rax
call fcn.00451720
mov rax, qword [rsp + 8]
nop dword [rax + rax]
jmp fcn.00486fe0
Function at 0x493bc0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x493c92
sub rsp, 0x38
mov qword [rsp + 0x30], rbp
lea rbp, [rsp + 0x30]
movabs rdx, 0xa88f6470a574656d
mov qword [rsp + 0x19], rdx
movabs rdx, 0x2893b8a88f6470a5
mov qword [rsp + 0x1c], rdx
movabs rdx, 0x709040408030406
mov qword [rsp + 0x24], rdx
mov dword [rsp + 0x2c], 0x8090309
xor eax, eax
jmp 0x493c2e
movzx r9d, byte [rsp + rsi + 0x19]
sub r9d, edx
lea edx, [r9 - 0xd]
mov byte [rsp + rdi + 0x19], dl
lea edx, [r8 - 0xd]
mov byte [rsp + rsi + 0x19], dl
add rax, 2
cmp rax, 0xc
jge 0x493c5b
movzx edx, byte [rsp + rax + 0x24]
movzx esi, byte [rsp + rax + 0x25]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0xb
jae 0x493c85
movzx r8d, byte [rsp + rdi + 0x19]
sub r8d, edx
cmp rsi, 0xb
jb 0x493c11
jmp 0x493c76
xor eax, eax
lea rbx, [rsp + 0x19]
mov ecx, 0xb
call fcn.00441e20
mov rbp, qword [rsp + 0x30]
add rsp, 0x38
ret
mov eax, esi
mov ecx, 0xb
nop dword [rax]
call fcn.00453d80
mov eax, edi
mov ecx, 0xb
call fcn.00453d80
nop
call fcn.00451720
jmp fcn.00493bc0

Function at 0x495900
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4959d2
sub rsp, 0x40
mov qword [rsp + 0x38], rbp
lea rbp, [rsp + 0x38]
movabs rdx, 0x8f51aac04391758d
mov qword [rsp + 0x1e], rdx
mov dword [rsp + 0x26], 0x8f201020
movabs rdx, 0x705070409060b
mov qword [rsp + 0x2a], rdx
movabs rdx, 0x907020902040007
mov qword [rsp + 0x30], rdx
xor eax, eax
jmp 0x49596e
movzx r9d, byte [rsp + rsi + 0x1e]
sub r9d, edx
lea edx, [r9 - 0x14]
mov byte [rsp + rdi + 0x1e], dl
lea edx, [r8 - 0x14]
mov byte [rsp + rsi + 0x1e], dl
add rax, 2
cmp rax, 0xe
jge 0x49599b
movzx edx, byte [rsp + rax + 0x2a]
movzx esi, byte [rsp + rax + 0x2b]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0xc
jae 0x4959c5
movzx r8d, byte [rsp + rdi + 0x1e]
sub r8d, edx
cmp rsi, 0xc
jb 0x495951
jmp 0x4959b6
xor eax, eax
lea rbx, [rsp + 0x1e]
mov ecx, 0xc
call fcn.00441e20
mov rbp, qword [rsp + 0x38]
add rsp, 0x40
ret
mov eax, esi
mov ecx, 0xc
nop dword [rax]
call fcn.00453d80
mov eax, edi
mov ecx, 0xc
call fcn.00453d80
nop
call fcn.00451720
jmp fcn.00495900
Function at 0x4970e0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4971d6
sub rsp, 0x50
mov qword [rsp + 0x48], rbp
lea rbp, [rsp + 0x48]
movabs rdx, 0x2574d618bf10ee72
mov qword [rsp + 0x1e], rdx
movabs rdx, 0x1b1a2574d618bf10
mov qword [rsp + 0x20], rdx
movabs rdx, 0x86ed2a62e91c8c8
mov qword [rsp + 0x28], rdx
movabs rdx, 0xc110f050a0a0107
mov qword [rsp + 0x30], rdx
movabs rdx, 0x110e09090b0b0f03
mov qword [rsp + 0x38], rdx
movabs rdx, 0x80a0b110f020405
mov qword [rsp + 0x40], rdx
xor eax, eax
jmp 0x497170
movzx r9d, byte [rsp + rsi + 0x1e]
add r9d, 0x3a
add edx, r9d
mov byte [rsp + rdi + 0x1e], dl
mov byte [rsp + rsi + 0x1e], r8b
add rax, 2
cmp rax, 0x18
jge 0x4971a2
movzx edx, byte [rsp + rax + 0x30]
movzx esi, byte [rsp + rax + 0x31]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x12
jae 0x4971c9
movzx r8d, byte [rsp + rdi + 0x1e]
add r8d, 0x3a
add r8d, edx
cmp rsi, 0x12
jb 0x497156
nop
jmp 0x4971bd
xor eax, eax
lea rbx, [rsp + 0x1e]
mov ecx, 0x12
call fcn.00441e20
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
mov eax, esi
mov ecx, 0x12
call fcn.00453d80
mov eax, edi
mov ecx, 0x12
call fcn.00453d80
nop
call fcn.00451720
nop dword [rax + rax]
jmp fcn.004970e0

Function at 0x4974e0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x49763e
add rsp, 0xffffffffffffff80
mov qword [rsp + 0x78], rbp
lea rbp, [rsp + 0x78]
movabs rdx, 0x2c74636b6f866572
mov qword [rsp + 0x19], rdx
movabs rdx, 0x936e4d659e5e7d20
mov qword [rsp + 0x21], rdx
movabs rdx, 0x567263206c936e4d
mov qword [rsp + 0x26], rdx
movabs rdx, 0x6146d378863a6a74
mov qword [rsp + 0x2e], rdx
movabs rdx, 0x686c650b20646975
mov qword [rsp + 0x36], rdx
movabs rdx, 0x637864497456545d
mov qword [rsp + 0x3e], rdx
movabs rdx, 0x162c02281b2b1a1a
mov qword [rsp + 0x46], rdx
movabs rdx, 0x1a0b162c02281b2b
mov qword [rsp + 0x48], rdx
movabs rdx, 0xf1a142b1a0f0318
mov qword [rsp + 0x50], rdx
movabs rdx, 0x1821140716232c09
mov qword [rsp + 0x58], rdx
movabs rdx, 0x1204250a2b120d16
mov qword [rsp + 0x60], rdx
movabs rdx, 0x427282b1404031b
mov qword [rsp + 0x68], rdx
movabs rdx, 0x1b15291a1d191626
mov qword [rsp + 0x70], rdx
xor eax, eax
jmp 0x4975d9
movzx r9d, byte [rsp + rsi + 0x19]
add r9d, 0xffffffc4
add edx, r9d
mov byte [rsp + rdi + 0x19], dl
mov byte [rsp + rsi + 0x19], r8b
add rax, 2
cmp rax, 0x32
jge 0x49760a
movzx edx, byte [rsp + rax + 0x46]
movzx esi, byte [rsp + rax + 0x47]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x2d
jae 0x497631
movzx r8d, byte [rsp + rdi + 0x19]
add r8d, 0xffffffc4
add r8d, edx
cmp rsi, 0x2d
jb 0x4975bf
jmp 0x497625
xor eax, eax
lea rbx, [rsp + 0x19]
mov ecx, 0x2d
call fcn.00441e20
mov rbp, qword [rsp + 0x78]
sub rsp, 0xffffffffffffff80
ret
mov eax, esi
mov ecx, 0x2d
call fcn.00453d80
mov eax, edi
mov ecx, 0x2d
call fcn.00453d80
nop
nop
call fcn.00451720
jmp fcn.004974e0
Function at 0x497660
Capabilities:
Encrypt data using rc4 prga

Disassembly:
lea r12, [rsp - 8]
cmp r12, qword [r14 + 0x10]
jbe 0x4977e6
sub rsp, 0x88
mov qword [rsp + 0x80], rbp
lea rbp, [rsp + 0x80]
movabs rdx, 0x15a9635800b765b2
mov qword [rsp + 0x19], rdx
movabs rdx, 0x466ea83674ece3d9
mov qword [rsp + 0x21], rdx
movabs rdx, 0xb89e65207e466ea8
mov qword [rsp + 0x26], rdx
movabs rdx, 0x81d16e11fcddad6f
mov qword [rsp + 0x2e], rdx
movabs rdx, 0xe574a6db2064f16c
mov qword [rsp + 0x36], rdx
movabs rdx, 0xd751d347690e95de
mov qword [rsp + 0x3e], rdx
movabs rdx, 0x2c140a0d1e1c0826
mov qword [rsp + 0x46], rdx
movabs rdx, 0x2106091c2c070421
mov qword [rsp + 0x4e], rdx
movabs rdx, 0x270d2106091c2c07
mov qword [rsp + 0x50], rdx
movabs rdx, 0x2227032110292b29
mov qword [rsp + 0x58], rdx
movabs rdx, 0x1b0c0d1707131813
mov qword [rsp + 0x60], rdx
movabs rdx, 0x22b0a2921190721
mov qword [rsp + 0x68], rdx
movabs rdx, 0x1b090f0924251e1e
mov qword [rsp + 0x70], rdx
movabs rdx, 0x30a0029162c212a
mov qword [rsp + 0x78], rdx
xor eax, eax
jmp 0x497776
movzx r9d, byte [rsp + rsi + 0x19]
add r9d, 0x5d
add edx, r9d
mov byte [rsp + rdi + 0x19], dl
mov byte [rsp + rsi + 0x19], r8b
add rax, 2
cmp rax, 0x3a
jge 0x4977a8
movzx edx, byte [rsp + rax + 0x46]
movzx esi, byte [rsp + rax + 0x47]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x2d
jae 0x4977d5
movzx r8d, byte [rsp + rdi + 0x19]
add r8d, 0x5d
add r8d, edx
nop
cmp rsi, 0x2d
jb 0x49775c
jmp 0x4977c9
xor eax, eax
lea rbx, [rsp + 0x19]
mov ecx, 0x2d
call fcn.00441e20
mov rbp, qword [rsp + 0x80]
add rsp, 0x88
ret
mov eax, esi
mov ecx, 0x2d
call fcn.00453d80
mov eax, edi
mov ecx, 0x2d
nop dword [rax]
call fcn.00453d80
nop
call fcn.00451720
jmp fcn.00497660

Function at 0x497a20
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x497b16
sub rsp, 0x50
mov qword [rsp + 0x48], rbp
lea rbp, [rsp + 0x48]
movabs rdx, 0xf374403a6cf53e72
mov qword [rsp + 0x1f], rdx
movabs rdx, 0x1b619df374403a6c
mov qword [rsp + 0x22], rdx
movabs rdx, 0x7c1f69ef22f33b75
mov qword [rsp + 0x2a], rdx
movabs rdx, 0xa0805010e08020c
mov qword [rsp + 0x32], rdx
movabs rdx, 0x110c120c0f080a08
mov qword [rsp + 0x38], rdx
movabs rdx, 0xd071108110e0404
mov qword [rsp + 0x40], rdx
xor eax, eax
jmp 0x497ab0
movzx r9d, byte [rsp + rsi + 0x1f]
add r9d, 0x1d
add edx, r9d
mov byte [rsp + rdi + 0x1f], dl
mov byte [rsp + rsi + 0x1f], r8b
add rax, 2
cmp rax, 0x16
jge 0x497ae2
movzx edx, byte [rsp + rax + 0x32]
movzx esi, byte [rsp + rax + 0x33]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x13
jae 0x497b09
movzx r8d, byte [rsp + rdi + 0x1f]
add r8d, 0x1d
add r8d, edx
cmp rsi, 0x13
jb 0x497a96
nop
jmp 0x497afd
xor eax, eax
lea rbx, [rsp + 0x1f]
mov ecx, 0x13
call fcn.00441e20
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
mov eax, esi
mov ecx, 0x13
call fcn.00453d80
mov eax, edi
mov ecx, 0x13
call fcn.00453d80
nop
call fcn.00451720
nop dword [rax + rax]
jmp fcn.00497a20