joyce8/EMBER2024-capa huggingface dataset:
Function at 0x47f600
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x47f732
sub rsp, 0x70
mov qword [rsp + 0x68], rbp
lea rbp, [rsp + 0x68]
movabs rdx, 0x6e6984e9af752294
mov qword [rsp + 0x1e], rdx
movabs rdx, 0xfa0eaf46619616ff
mov qword [rsp + 0x26], rdx
movabs rdx, 0xf8ea0b20226efa0e
mov qword [rsp + 0x2c], rdx
movabs rdx, 0x3d7461039c149195
mov qword [rsp + 0x34], rdx
movabs rdx, 0x50b170c030f1d04
mov qword [rsp + 0x3c], rdx
movabs rdx, 0x503110b14150215
mov qword [rsp + 0x44], rdx
movabs rdx, 0xb160b0f0503110b
mov qword [rsp + 0x48], rdx
movabs rdx, 0x13000c000c010404
mov qword [rsp + 0x50], rdx
movabs rdx, 0x17180c0b1a0f050d
mov qword [rsp + 0x58], rdx
movabs rdx, 0x80909190e16080a
mov qword [rsp + 0x60], rdx
xor eax, eax
jmp 0x47f6cf
movzx r9d, byte [rsp + rsi + 0x1e]
sub r9d, edx
lea edx, [r9 - 0x6b]
mov byte [rsp + rdi + 0x1e], dl
lea edx, [r8 - 0x6b]
mov byte [rsp + rsi + 0x1e], dl
add rax, 2
cmp rax, 0x2c
jge 0x47f6fc
movzx edx, byte [rsp + rax + 0x3c]
movzx esi, byte [rsp + rax + 0x3d]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x1e
jae 0x47f725
movzx r8d, byte [rsp + rdi + 0x1e]
sub r8d, edx
cmp rsi, 0x1e
jb 0x47f6b2
jmp 0x47f717
xor eax, eax
lea rbx, [rsp + 0x1e]
mov ecx, 0x1e
call fcn.004446e0
mov rbp, qword [rsp + 0x68]
add rsp, 0x70
ret
mov eax, esi
mov ecx, 0x1e
nop
call fcn.00457420
mov eax, edi
mov ecx, 0x1e
call fcn.00457420
nop
call fcn.00454dc0
jmp fcn.0047f600

Function at 0x481160
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x48121c
sub rsp, 0x30
mov qword [rsp + 0x28], rbp
lea rbp, [rsp + 0x28]
movabs rdx, 0x65c265166915dbbd
mov qword [rsp + 0x20], rdx
movabs rdx, 0x600060106040002
mov qword [rsp + 0x18], rdx
xor eax, eax
jmp 0x4811b4
movzx r9d, byte [rsp + rsi + 0x20]
add r9d, 0xffffffa8
add edx, r9d
mov byte [rsp + rdi + 0x20], dl
mov byte [rsp + rsi + 0x20], r8b
add rax, 2
cmp rax, 8
jge 0x4811e8
movzx edx, byte [rsp + rax + 0x18]
movzx esi, byte [rsp + rax + 0x19]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 8
jae 0x48120f
movzx r8d, byte [rsp + rdi + 0x20]
add r8d, 0xffffffa8
add r8d, edx
nop dword [rax]
cmp rsi, 8
jb 0x48119a
jmp 0x481203
xor eax, eax
lea rbx, [rsp + 0x20]
mov ecx, 8
call fcn.004446e0
mov rbp, qword [rsp + 0x28]
add rsp, 0x30
ret
mov eax, esi
mov ecx, 8
call fcn.00457420
mov eax, edi
mov ecx, 8
call fcn.00457420
nop
nop dword [rax]
call fcn.00454dc0
jmp fcn.00481160
Function at 0x481540
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x481636
sub rsp, 0x48
mov qword [rsp + 0x40], rbp
lea rbp, [rsp + 0x40]
movabs rdx, 0x877373619c757a62
mov qword [rsp + 0x2e], rdx
movabs rdx, 0x5f8a877373619c75
mov qword [rsp + 0x30], rdx
movabs rdx, 0x6e73449761628841
mov qword [rsp + 0x38], rdx
movabs rdx, 0xe01080b100f0803
mov qword [rsp + 0x1c], rdx
movabs rdx, 0x1010e01080b100f
mov qword [rsp + 0x1e], rdx
movabs rdx, 0x10060f03010107
mov qword [rsp + 0x26], rdx
xor eax, eax
jmp 0x4815d0
movzx r9d, byte [rsp + rsi + 0x2e]
add r9d, 0xffffffdf
add edx, r9d
mov byte [rsp + rdi + 0x2e], dl
mov byte [rsp + rsi + 0x2e], r8b
add rax, 2
cmp rax, 0x12
jge 0x481602
movzx edx, byte [rsp + rax + 0x1c]
movzx esi, byte [rsp + rax + 0x1d]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x12
jae 0x481629
movzx r8d, byte [rsp + rdi + 0x2e]
add r8d, 0xffffffdf
add r8d, edx
cmp rsi, 0x12
jb 0x4815b6
nop
jmp 0x48161d
xor eax, eax
lea rbx, [rsp + 0x2e]
mov ecx, 0x12
call fcn.004446e0
mov rbp, qword [rsp + 0x40]
add rsp, 0x48
ret
mov eax, esi
mov ecx, 0x12
call fcn.00457420
mov eax, edi
mov ecx, 0x12
call fcn.00457420
nop
call fcn.00454dc0
nop dword [rax + rax]
jmp fcn.00481540

Function at 0x4831e0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4832a6
sub rsp, 0x38
mov qword [rsp + 0x30], rbp
lea rbp, [rsp + 0x30]
movabs rdx, 0xde970100f7fa8f04
mov qword [rsp + 0x1e], rdx
movabs rdx, 0x1040306030502
mov qword [rsp + 0x26], rdx
mov word [rsp + 0x2e], 7
xor eax, eax
nop
jmp 0x483240
movzx r9d, byte [rsp + rsi + 0x1e]
sub r9d, edx
lea edx, [r9 + 0x78]
mov byte [rsp + rdi + 0x1e], dl
lea edx, [r8 + 0x78]
mov byte [rsp + rsi + 0x1e], dl
add rax, 2
nop
cmp rax, 0xa
jge 0x48326d
movzx edx, byte [rsp + rax + 0x26]
movzx esi, byte [rsp + rax + 0x27]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 8
jae 0x483294
movzx r8d, byte [rsp + rdi + 0x1e]
sub r8d, edx
cmp rsi, 8
jb 0x483222
jmp 0x483288
xor eax, eax
lea rbx, [rsp + 0x1e]
mov ecx, 8
call fcn.004446e0
mov rbp, qword [rsp + 0x30]
add rsp, 0x38
ret
mov eax, esi
mov ecx, 8
call fcn.00457420
mov eax, edi
mov ecx, 8
nop dword [rax + rax]
call fcn.00457420
nop
call fcn.00454dc0
jmp fcn.004831e0
Function at 0x485040
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x48511c
sub rsp, 0x40
mov qword [rsp + 0x38], rbp
lea rbp, [rsp + 0x38]
movabs rdx, 0x32f2b66120c45c1
mov qword [rsp + 0x1f], rdx
movabs rdx, 0x3c3734032f2b6612
mov qword [rsp + 0x22], rdx
movabs rdx, 0x805070303000205
mov qword [rsp + 0x2a], rdx
movabs rdx, 0x10a060703090805
mov qword [rsp + 0x30], rdx
xor eax, eax
jmp 0x4850b5
movzx r9d, byte [rsp + rsi + 0x1f]
sub r9d, edx
lea edx, [r9 + 0x40]
mov byte [rsp + rdi + 0x1f], dl
lea edx, [r8 + 0x40]
mov byte [rsp + rsi + 0x1f], dl
add rax, 2
cmp rax, 0xe
jge 0x4850e8
movzx edx, byte [rsp + rax + 0x2a]
movzx esi, byte [rsp + rax + 0x2b]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0xb
jae 0x48510f
movzx r8d, byte [rsp + rdi + 0x1f]
sub r8d, edx
nop word [rax + rax]
cmp rsi, 0xb
jb 0x485098
jmp 0x485103
xor eax, eax
lea rbx, [rsp + 0x1f]
mov ecx, 0xb
call fcn.004446e0
mov rbp, qword [rsp + 0x38]
add rsp, 0x40
ret
mov eax, esi
mov ecx, 0xb
call fcn.00457420
mov eax, edi
mov ecx, 0xb
call fcn.00457420
nop
nop dword [rax]
call fcn.00454dc0
jmp fcn.00485040

Function at 0x485b40
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x485c12
sub rsp, 0x38
mov qword [rsp + 0x30], rbp
lea rbp, [rsp + 0x30]
movabs rdx, 0xee6900647b77044e
mov qword [rsp + 0x19], rdx
movabs rdx, 0x657befee6900647b
mov qword [rsp + 0x1c], rdx
movabs rdx, 0x109030805090403
mov qword [rsp + 0x24], rdx
mov dword [rsp + 0x2c], 0x7050401
xor eax, eax
jmp 0x485bae
movzx r9d, byte [rsp + rsi + 0x19]
sub r9d, edx
lea edx, [r9 + 0x7f]
mov byte [rsp + rdi + 0x19], dl
lea edx, [r8 + 0x7f]
mov byte [rsp + rsi + 0x19], dl
add rax, 2
cmp rax, 0xc
jge 0x485bdb
movzx edx, byte [rsp + rax + 0x24]
movzx esi, byte [rsp + rax + 0x25]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0xb
jae 0x485c05
movzx r8d, byte [rsp + rdi + 0x19]
sub r8d, edx
cmp rsi, 0xb
jb 0x485b91
jmp 0x485bf6
xor eax, eax
lea rbx, [rsp + 0x19]
mov ecx, 0xb
call fcn.004446e0
mov rbp, qword [rsp + 0x30]
add rsp, 0x38
ret
mov eax, esi
mov ecx, 0xb
nop dword [rax]
call fcn.00457420
mov eax, edi
mov ecx, 0xb
call fcn.00457420
nop
call fcn.00454dc0
jmp fcn.00485b40
Function at 0x486a20
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x486af2
sub rsp, 0x38
mov qword [rsp + 0x30], rbp
lea rbp, [rsp + 0x30]
movabs rdx, 0x642122082d64fe0f
mov qword [rsp + 0x19], rdx
movabs rdx, 0x6e2bf7642122082d
mov qword [rsp + 0x1c], rdx
movabs rdx, 0x805050109030005
mov qword [rsp + 0x24], rdx
mov dword [rsp + 0x2c], 0x6050604
xor eax, eax
jmp 0x486a8b
movzx r9d, byte [rsp + rsi + 0x19]
add r9d, 0x28
add edx, r9d
mov byte [rsp + rdi + 0x19], dl
mov byte [rsp + rsi + 0x19], r8b
add rax, 2
cmp rax, 0xc
jge 0x486abc
movzx edx, byte [rsp + rax + 0x24]
movzx esi, byte [rsp + rax + 0x25]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0xb
jae 0x486ae5
movzx r8d, byte [rsp + rdi + 0x19]
add r8d, 0x28
add r8d, edx
cmp rsi, 0xb
jb 0x486a71
jmp 0x486ad7
xor eax, eax
lea rbx, [rsp + 0x19]
mov ecx, 0xb
call fcn.004446e0
mov rbp, qword [rsp + 0x30]
add rsp, 0x38
ret
mov eax, esi
mov ecx, 0xb
nop
call fcn.00457420
mov eax, edi
mov ecx, 0xb
call fcn.00457420
nop
call fcn.00454dc0
jmp fcn.00486a20

Function at 0x487ba0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x487c72
sub rsp, 0x38
mov qword [rsp + 0x30], rbp
lea rbp, [rsp + 0x30]
movabs rdx, 0xcb6fc35fddccba30
mov qword [rsp + 0x24], rdx
mov dword [rsp + 0x2c], 0x11d0cb70
movabs rdx, 0x90900010a0b0302
mov qword [rsp + 0x18], rdx
mov dword [rsp + 0x20], 0x1070a05
xor eax, eax
jmp 0x487c04
movzx r9d, byte [rsp + rsi + 0x24]
add r9d, 0xffffff94
add edx, r9d
mov byte [rsp + rdi + 0x24], dl
mov byte [rsp + rsi + 0x24], r8b
add rax, 2
cmp rax, 0xc
jge 0x487c3b
movzx edx, byte [rsp + rax + 0x18]
movzx esi, byte [rsp + rax + 0x19]
mov edi, edx
xor edx, esi
add edx, eax
nop word [rax + rax]
cmp rdi, 0xc
jae 0x487c65
movzx r8d, byte [rsp + rdi + 0x24]
add r8d, 0xffffff94
add r8d, edx
cmp rsi, 0xc
jb 0x487bea
jmp 0x487c56
xor eax, eax
lea rbx, [rsp + 0x24]
mov ecx, 0xc
call fcn.004446e0
mov rbp, qword [rsp + 0x30]
add rsp, 0x38
ret
mov eax, esi
mov ecx, 0xc
nop dword [rax]
call fcn.00457420
mov eax, edi
mov ecx, 0xc
call fcn.00457420
nop
call fcn.00454dc0
jmp fcn.00487ba0
Function at 0x488de0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x488ec6
sub rsp, 0x40
mov qword [rsp + 0x38], rbp
lea rbp, [rsp + 0x38]
movabs rdx, 0xaa9bed9e9d649065
mov qword [rsp + 0x1a], rdx
mov dword [rsp + 0x22], 0x919dbcd2
movabs rdx, 0x607050006070608
mov qword [rsp + 0x26], rdx
movabs rdx, 0x903060705000607
mov qword [rsp + 0x28], rdx
movabs rdx, 0x10a01000103040b
mov qword [rsp + 0x30], rdx
xor eax, eax
nop
jmp 0x488e60
movzx r9d, byte [rsp + rsi + 0x1a]
sub r9d, edx
lea edx, [r9 - 0x19]
mov byte [rsp + rdi + 0x1a], dl
lea edx, [r8 - 0x19]
mov byte [rsp + rsi + 0x1a], dl
add rax, 2
nop
cmp rax, 0x12
jge 0x488e8d
movzx edx, byte [rsp + rax + 0x26]
movzx esi, byte [rsp + rax + 0x27]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0xc
jae 0x488eb4
movzx r8d, byte [rsp + rdi + 0x1a]
sub r8d, edx
cmp rsi, 0xc
jb 0x488e42
jmp 0x488ea8
xor eax, eax
lea rbx, [rsp + 0x1a]
mov ecx, 0xc
call fcn.004446e0
mov rbp, qword [rsp + 0x38]
add rsp, 0x40
ret
mov eax, esi
mov ecx, 0xc
call fcn.00457420
mov eax, edi
mov ecx, 0xc
nop dword [rax + rax]
call fcn.00457420
nop
call fcn.00454dc0
jmp fcn.00488de0

Function at 0x489fe0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x48a112
sub rsp, 0x70
mov qword [rsp + 0x68], rbp
lea rbp, [rsp + 0x68]
movabs rdx, 0xc7a6ca729068e983
mov qword [rsp + 0x1e], rdx
movabs rdx, 0x94c4c7a6ca729068
mov qword [rsp + 0x20], rdx
movabs rdx, 0x7a7b9f498c8ff275
mov qword [rsp + 0x28], rdx
movabs rdx, 0x81aab89f6c62c672
mov qword [rsp + 0x30], rdx
movabs rdx, 0xb6ad696f505fa18c
mov qword [rsp + 0x38], rdx
movabs rdx, 0x70501170f190f1b
mov qword [rsp + 0x40], rdx
movabs rdx, 0x1160b1a0b011011
mov qword [rsp + 0x48], rdx
movabs rdx, 0xf060700170c1813
mov qword [rsp + 0x50], rdx
movabs rdx, 0xc001b130c160118
mov qword [rsp + 0x58], rdx
movabs rdx, 0x520082103090d0f
mov qword [rsp + 0x60], rdx
xor eax, eax
jmp 0x48a0af
movzx r9d, byte [rsp + rsi + 0x1e]
sub r9d, edx
lea edx, [r9 - 3]
mov byte [rsp + rdi + 0x1e], dl
lea edx, [r8 - 3]
mov byte [rsp + rsi + 0x1e], dl
add rax, 2
cmp rax, 0x28
jge 0x48a0dc
movzx edx, byte [rsp + rax + 0x40]
movzx esi, byte [rsp + rax + 0x41]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x22
jae 0x48a105
movzx r8d, byte [rsp + rdi + 0x1e]
sub r8d, edx
cmp rsi, 0x22
jb 0x48a092
jmp 0x48a0f7
xor eax, eax
lea rbx, [rsp + 0x1e]
mov ecx, 0x22
call fcn.004446e0
mov rbp, qword [rsp + 0x68]
add rsp, 0x70
ret
mov eax, esi
mov ecx, 0x22
nop
call fcn.00457420
mov eax, edi
mov ecx, 0x22
call fcn.00457420
nop
call fcn.00454dc0
jmp fcn.00489fe0
Function at 0x48a120
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x48a228
sub rsp, 0x50
mov qword [rsp + 0x48], rbp
lea rbp, [rsp + 0x48]
movabs rdx, 0x3c47323c65464d4f
mov qword [rsp + 0x19], rdx
movabs rdx, 0x6862265e2e3c4732
mov qword [rsp + 0x1e], rdx
movabs rdx, 0x2e1a5646350f5f65
mov qword [rsp + 0x26], rdx
movabs rdx, 0x140f020708041013
mov qword [rsp + 0x2e], rdx
movabs rdx, 0x10111140a0f0810
mov qword [rsp + 0x36], rdx
movabs rdx, 0x130c010111140a0f
mov qword [rsp + 0x38], rdx
movabs rdx, 0xf05040b11121409
mov qword [rsp + 0x40], rdx
xor eax, eax
jmp 0x48a1c2
movzx r9d, byte [rsp + rsi + 0x19]
sub r9d, edx
lea edx, [r9 + 0x35]
mov byte [rsp + rdi + 0x19], dl
lea edx, [r8 + 0x35]
mov byte [rsp + rsi + 0x19], dl
add rax, 2
cmp rax, 0x1a
jge 0x48a1ef
movzx edx, byte [rsp + rax + 0x2e]
movzx esi, byte [rsp + rax + 0x2f]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x15
jae 0x48a21b
movzx r8d, byte [rsp + rdi + 0x19]
sub r8d, edx
cmp rsi, 0x15
jb 0x48a1a5
jmp 0x48a20f
xor eax, eax
lea rbx, [rsp + 0x19]
mov ecx, 0x15
nop dword [rax + rax]
call fcn.004446e0
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
mov eax, esi
mov ecx, 0x15
call fcn.00457420
mov eax, edi
mov ecx, 0x15
call fcn.00457420
nop
call fcn.00454dc0
jmp fcn.0048a120

Function at 0x48b7e0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x48b8d6
sub rsp, 0x48
mov qword [rsp + 0x40], rbp
lea rbp, [rsp + 0x40]
movabs rdx, 0xbc6465694365fe55
mov qword [rsp + 0x19], rdx
movabs rdx, 0xc2bc6465694365fe
mov qword [rsp + 0x1a], rdx
movabs rdx, 0xb8c7d699a9016564
mov qword [rsp + 0x22], rdx
movabs rdx, 0x1002020b0b0b0f0e
mov qword [rsp + 0x2a], rdx
movabs rdx, 0xc030c100b0b1002
mov qword [rsp + 0x30], rdx
movabs rdx, 0x10c0d08010c0b07
mov qword [rsp + 0x38], rdx
xor eax, eax
jmp 0x48b870
movzx r9d, byte [rsp + rsi + 0x19]
add r9d, 0xffffff99
add edx, r9d
mov byte [rsp + rdi + 0x19], dl
mov byte [rsp + rsi + 0x19], r8b
add rax, 2
cmp rax, 0x16
jge 0x48b8a2
movzx edx, byte [rsp + rax + 0x2a]
movzx esi, byte [rsp + rax + 0x2b]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x11
jae 0x48b8c9
movzx r8d, byte [rsp + rdi + 0x19]
add r8d, 0xffffff99
add r8d, edx
cmp rsi, 0x11
jb 0x48b856
nop
jmp 0x48b8bd
xor eax, eax
lea rbx, [rsp + 0x19]
mov ecx, 0x11
call fcn.004446e0
mov rbp, qword [rsp + 0x40]
add rsp, 0x48
ret
mov eax, esi
mov ecx, 0x11
call fcn.00457420
mov eax, edi
mov ecx, 0x11
call fcn.00457420
nop
call fcn.00454dc0
nop dword [rax + rax]
jmp fcn.0048b7e0
Function at 0x493500
Capabilities:
Hash data using fnv

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x49374c
add rsp, 0xffffffffffffff80
mov qword [rsp + 0x78], rbp
lea rbp, [rsp + 0x78]
mov ebx, dword [rax + 0x2c]
nop dword [rax + rax]
test ebx, ebx
jne 0x4935ac
mov qword [rsp + 0x88], rax
lea rbx, [0x00631080]
mov rcx, rax
lea rax, [0x00c91cc0]
call fcn.0047c660
test cl, cl
jne 0x493591
mov rax, qword [rsp + 0x88]
call fcn.00492900
mov ecx, 1
mov rdi, rax
mov rsi, rbx
lea rax, [rsp + 0x30]
lea rbx, [0x0066a960]
call fcn.00444340
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x28], rbx
nop dword [rax]
call fcn.00493800
mov rcx, qword [rsp + 0x88]
xor edx, edx
jmp 0x4935ce
lea rdx, [0x00630dc0]
cmp rax, rdx
jne 0x4935bc
test byte [rbx], al
mov rax, rbx
mov rbp, qword [rsp + 0x78]
sub rsp, 0xffffffffffffff80
ret
nop
call fcn.00452840
mov rbp, qword [rsp + 0x78]
sub rsp, 0xffffffffffffff80
ret
mov rbx, rdx
lea rcx, [0x006195c0]
call fcn.00409680
inc rdx
cmp rbx, rdx
jle 0x493618
mov rsi, qword [rax + rdx*8]
cmp qword [rsi + 0x30], rcx
jne 0x4935cb
lea rax, [0x00c91cc0]
lea rbx, [0x00631080]
lea rdi, [0x00630dc0]
call fcn.0047c820
lea rdx, [0x00630dc0]
nop
cmp rax, rdx
jne 0x49373c
test byte [rbx], al
mov rax, rbx
mov rbp, qword [rsp + 0x78]
sub rsp, 0xffffffffffffff80
ret
lea rcx, [0x00613940]
mov qword [rsp + 0x68], rcx
mov qword [rsp + 0x70], 0
mov rcx, qword [rsp + 0x68]
mov qword [rsp + 0x50], rcx
lea rax, [0x00621e80]
nop
call fcn.0040c0c0
mov qword [rsp + 0x60], rax
mov rcx, qword [rsp + 0x50]
test byte [rcx], al
cmp dword [0x00ce5620], 0
jne 0x49367a
mov rdx, qword [rcx]
mov qword [rax], rdx
movups xmm0, xmmword [rcx + 8]
movups xmmword [rax + 8], xmm0
movups xmm0, xmmword [rcx + 0x18]
movups xmmword [rax + 0x18], xmm0
movups xmm0, xmmword [rcx + 0x28]
movups xmmword [rax + 0x28], xmm0
jmp 0x493689
mov rbx, rax
lea rax, [0x00621e80]
call fcn.00411440
mov rax, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x28]
xor ecx, ecx
xor edi, edi
xor esi, esi
mov r8d, esi
nop dword [rax]
call fcn.004919a0
nop
call fcn.00452900
mov rsi, qword [rsp + 0x60]
mov dword [rsi + 0x28], eax
mov dword [rsi + 0x2c], 0
mov rcx, qword [rsp + 0x88]
mov edx, dword [rcx + 0x10]
xor eax, eax
jmp 0x4936d7
imul edx, edx, 0x1000193
xor edx, 0x2a
mov eax, 1
cmp rax, 1
jl 0x4936c9
mov dword [rsi + 0x10], edx
cmp dword [0x00ce5620], 0
jne 0x4936ef
mov qword [rsi + 0x30], rcx
jmp 0x4936f8
lea rdi, [rsi + 0x30]
call fcn.00457080
lea rax, [0x00c91cc0]
lea rbx, [0x00631080]
lea rdi, [0x00630dc0]
call fcn.0047c820
lea rdx, [0x00630dc0]
cmp rax, rdx
jne 0x49372d
test byte [rbx], al
mov rax, rbx
mov rbp, qword [rsp + 0x78]
sub rsp, 0xffffffffffffff80
ret
mov rbx, rdx
lea rcx, [0x006195c0]
call fcn.00409680
mov rbx, rdx
lea rcx, [0x006195c0]
call fcn.00409680
nop
mov qword [rsp + 8], rax
call fcn.00454dc0
mov rax, qword [rsp + 8]
nop dword [rax + rax]
jmp fcn.00493500
Function at 0x49cc20
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x49cd68
sub rsp, 0x78
mov qword [rsp + 0x70], rbp
lea rbp, [rsp + 0x70]
movabs rdx, 0x8b4ead6f9726356d
mov qword [rsp + 0x1f], rdx
movabs rdx, 0x6e7020491c8b4ead
mov qword [rsp + 0x24], rdx
movabs rdx, 0xcd65756cc01e070c
mov qword [rsp + 0x2c], rdx
movabs rdx, 0xdc20e264ea4929c7
mov qword [rsp + 0x34], rdx
movabs rdx, 0x6e0a6c6c0e20d6fa
mov qword [rsp + 0x3c], rdx
movabs rdx, 0xe22060b10160714
mov qword [rsp + 0x44], rdx
movabs rdx, 0x1c0802010b03140e
mov qword [rsp + 0x4c], rdx
movabs rdx, 0x71a08201c080201
mov qword [rsp + 0x50], rdx
movabs rdx, 0x1518031515060808
mov qword [rsp + 0x58], rdx
movabs rdx, 0x20180d0508080b16
mov qword [rsp + 0x60], rdx
movabs rdx, 0x1d0d0f0f081e2023
mov qword [rsp + 0x68], rdx
xor eax, eax
nop
jmp 0x49cd00
movzx r9d, byte [rsp + rsi + 0x1f]
add r9d, 0x30
add edx, r9d
mov byte [rsp + rdi + 0x1f], dl
mov byte [rsp + rsi + 0x1f], r8b
add rax, 2
nop dword [rax]
cmp rax, 0x2c
jge 0x49cd31
movzx edx, byte [rsp + rax + 0x44]
movzx esi, byte [rsp + rax + 0x45]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x25
jae 0x49cd5b
movzx r8d, byte [rsp + rdi + 0x1f]
add r8d, 0x30
add r8d, edx
cmp rsi, 0x25
jb 0x49cce2
jmp 0x49cd4f
xor eax, eax
lea rbx, [rsp + 0x1f]
mov ecx, 0x25
nop dword [rax]
call fcn.004446e0
mov rbp, qword [rsp + 0x70]
add rsp, 0x78
ret
mov eax, esi
mov ecx, 0x25
call fcn.00457420
mov eax, edi
mov ecx, 0x25
call fcn.00457420
nop
call fcn.00454dc0
jmp fcn.0049cc20
Function at 0x49e460
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x49e5b2
sub rsp, 0x78
mov qword [rsp + 0x70], rbp
lea rbp, [rsp + 0x70]
movabs rdx, 0xf58602d668611a2d
mov qword [rsp + 0x18], rdx
movabs rdx, 0xc9fe2cf6f58602d6
mov qword [rsp + 0x1c], rdx
movabs rdx, 0xf0336c02293beb6e
mov qword [rsp + 0x24], rdx
movabs rdx, 0xd3c028208f204221
mov qword [rsp + 0x2c], rdx
movabs rdx, 0xdf8c69a96142ae27
mov qword [rsp + 0x34], rdx
movabs rdx, 0xb171e081702070f
mov qword [rsp + 0x3c], rdx
movabs rdx, 0xf150b020b171e08
mov qword [rsp + 0x40], rdx
movabs rdx, 0x1d17051900230623
mov qword [rsp + 0x48], rdx
movabs rdx, 0x200e10080e0d0822
mov qword [rsp + 0x50], rdx
movabs rdx, 0x191d131d0a17100b
mov qword [rsp + 0x58], rdx
movabs rdx, 0x220e09001001121a
mov qword [rsp + 0x60], rdx
movabs rdx, 0x16120216141b0a04
mov qword [rsp + 0x68], rdx
xor eax, eax
jmp 0x49e54a
movzx r9d, byte [rsp + rsi + 0x18]
add r9d, 0x10
add edx, r9d
mov byte [rsp + rdi + 0x18], dl
mov byte [rsp + rsi + 0x18], r8b
add rax, 2
cmp rax, 0x34
jge 0x49e57b
movzx edx, byte [rsp + rax + 0x3c]
movzx esi, byte [rsp + rax + 0x3d]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x24
jae 0x49e5a5
movzx r8d, byte [rsp + rdi + 0x18]
add r8d, 0x10
add r8d, edx
cmp rsi, 0x24
jb 0x49e530
jmp 0x49e596
xor eax, eax
lea rbx, [rsp + 0x18]
mov ecx, 0x24
call fcn.004446e0
mov rbp, qword [rsp + 0x70]
add rsp, 0x78
ret
mov eax, esi
mov ecx, 0x24
nop dword [rax]
call fcn.00457420
mov eax, edi
mov ecx, 0x24
call fcn.00457420
nop
call fcn.00454dc0
jmp fcn.0049e460
Function at 0x4a0da0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
lea r12, [rsp - 0x10]
cmp r12, qword [r14 + 0x10]
jbe 0x4a0f26
sub rsp, 0x90
mov qword [rsp + 0x88], rbp
lea rbp, [rsp + 0x88]
movabs rdx, 0x3a7fe68fb5ca12bb
mov qword [rsp + 0x1c], rdx
movabs rdx, 0x35094cd3ed2d7f20
mov qword [rsp + 0x24], rdx
movabs rdx, 0x20cbc16f35094cd3
mov qword [rsp + 0x28], rdx
movabs rdx, 0x8d6ede6f1571ed00
mov qword [rsp + 0x30], rdx
movabs rdx, 0x7209867367187242
mov qword [rsp + 0x38], rdx
movabs rdx, 0xf8eb4a76656563bf
mov qword [rsp + 0x40], rdx
movabs rdx, 0x121c2716060a1621
mov qword [rsp + 0x48], rdx
movabs rdx, 0x22291c17220f1f2a
mov qword [rsp + 0x50], rdx
movabs rdx, 0xe12000322150a1b
mov qword [rsp + 0x58], rdx
movabs rdx, 0x2009140316152709
mov qword [rsp + 0x60], rdx
movabs rdx, 0x1112a0a29211b
mov qword [rsp + 0x68], rdx
movabs rdx, 0x2a271e05212b040e
mov qword [rsp + 0x70], rdx
movabs rdx, 0xe0b24190c271905
mov qword [rsp + 0x78], rdx
movabs rdx, 0x1822022409091524
mov qword [rsp + 0x80], rdx
xor eax, eax
jmp 0x4a0eb9
movzx r9d, byte [rsp + rsi + 0x1c]
add r9d, 0x39
add edx, r9d
mov byte [rsp + rdi + 0x1c], dl
mov byte [rsp + rsi + 0x1c], r8b
add rax, 2
cmp rax, 0x40
jge 0x4a0eea
movzx edx, byte [rsp + rax + 0x48]
movzx esi, byte [rsp + rax + 0x49]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x2c
jae 0x4a0f17
movzx r8d, byte [rsp + rdi + 0x1c]
add r8d, 0x39
add r8d, edx
cmp rsi, 0x2c
jb 0x4a0e9f
jmp 0x4a0f0b
xor eax, eax
lea rbx, [rsp + 0x1c]
mov ecx, 0x2c
call fcn.004446e0
mov rbp, qword [rsp + 0x88]
add rsp, 0x90
ret
mov eax, esi
mov ecx, 0x2c
call fcn.00457420
mov eax, edi
mov ecx, 0x2c
nop
call fcn.00457420
nop
call fcn.00454dc0
jmp fcn.004a0da0

Function at 0x4a1020
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4a10eb
sub rsp, 0x38
mov qword [rsp + 0x30], rbp
lea rbp, [rsp + 0x30]
movabs rdx, 0xfc747344ec6eea84
mov qword [rsp + 0x1b], rdx
mov byte [rsp + 0x23], 8
movabs rdx, 0x3010405000306
mov qword [rsp + 0x24], rdx
mov dword [rsp + 0x2c], 0x1080507
xor eax, eax
jmp 0x4a1084
movzx r9d, byte [rsp + rsi + 0x1b]
sub r9d, edx
lea edx, [r9 - 0x80]
mov byte [rsp + rdi + 0x1b], dl
lea edx, [r8 - 0x80]
mov byte [rsp + rsi + 0x1b], dl
add rax, 2
cmp rax, 0xc
jge 0x4a10b7
movzx edx, byte [rsp + rax + 0x24]
movzx esi, byte [rsp + rax + 0x25]
mov edi, edx
xor edx, esi
add edx, eax
nop word [rax + rax]
cmp rdi, 9
jae 0x4a10de
movzx r8d, byte [rsp + rdi + 0x1b]
sub r8d, edx
cmp rsi, 9
jb 0x4a1067
jmp 0x4a10d2
xor eax, eax
lea rbx, [rsp + 0x1b]
mov ecx, 9
call fcn.004446e0
mov rbp, qword [rsp + 0x30]
add rsp, 0x38
ret
mov eax, esi
mov ecx, 9
call fcn.00457420
mov eax, edi
mov ecx, 9
call fcn.00457420
nop
call fcn.00454dc0
jmp fcn.004a1020