joyce8/EMBER2024-capa huggingface dataset:
Function at 0x46e780
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x46e832
push rbp
mov rbp, rsp
sub rsp, 0x28
movabs rdx, 0x690b616a257b61bd
mov qword [rsp + 0x20], rdx
movabs rdx, 0x2020603000302
mov qword [rsp + 0x18], rdx
xor eax, eax
jmp 0x46e7d1
movzx r9d, byte [rsp + rsi + 0x20]
sub r9d, edx
lea edx, [r9 - 0x57]
mov byte [rsp + rdi + 0x20], dl
lea edx, [r8 - 0x57]
mov byte [rsp + rsi + 0x20], dl
add rax, 2
cmp rax, 8
jge 0x46e7fe
movzx edx, byte [rsp + rax + 0x18]
movzx esi, byte [rsp + rax + 0x19]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 8
jae 0x46e825
movzx r8d, byte [rsp + rdi + 0x20]
sub r8d, edx
cmp rsi, 8
jb 0x46e7b4
jmp 0x46e815
xor eax, eax
lea rbx, [rsp + 0x20]
mov ecx, 8
call fcn.004454c0
add rsp, 0x28
pop rbp
ret
mov eax, esi
mov ecx, 8
nop dword [rax]
call fcn.004579c0
mov eax, edi
mov ecx, 8
call fcn.004579c0
nop
call fcn.00455760
jmp fcn.0046e780

Function at 0x46f7a0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x46f866
push rbp
mov rbp, rsp
sub rsp, 0x30
movabs rdx, 0xa79a61acb6620413
mov qword [rsp + 0x1b], rdx
mov byte [rsp + 0x23], 0xbc
movabs rdx, 0x701060400080304
mov qword [rsp + 0x24], rdx
mov dword [rsp + 0x2c], 0x1030400
xor eax, eax
nop
jmp 0x46f800
movzx r9d, byte [rsp + rsi + 0x1b]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x51]
mov byte [rsp + rdi + 0x1b], dl
mov byte [rsp + rsi + 0x1b], r8b
add rax, 2
nop dword [rax]
cmp rax, 0xc
jge 0x46f832
movzx edx, byte [rsp + rax + 0x24]
movzx esi, byte [rsp + rax + 0x25]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 9
jae 0x46f857
movzx r8d, byte [rsp + rdi + 0x1b]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x51]
cmp rsi, 9
jb 0x46f7e2
jmp 0x46f84b
xor eax, eax
lea rbx, [rsp + 0x1b]
mov ecx, 9
nop
call fcn.004454c0
add rsp, 0x30
pop rbp
ret
mov eax, esi
mov ecx, 9
call fcn.004579c0
mov eax, edi
mov ecx, 9
nop
call fcn.004579c0
nop
call fcn.00455760
jmp fcn.0046f7a0

Function at 0x470920
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4709e7
push rbp
mov rbp, rsp
sub rsp, 0x30
movabs rdx, 0xba72a69f5f8babec
mov qword [rsp + 0x19], rdx
movabs rdx, 0x93ddaeba72a69f5f
mov qword [rsp + 0x1c], rdx
movabs rdx, 0x40200050507090a
mov qword [rsp + 0x24], rdx
mov dword [rsp + 0x2c], 0x801050a
xor eax, eax
jmp 0x470988
movzx r9d, byte [rsp + rsi + 0x19]
sub r9d, edx
lea edx, [r9 - 0x2f]
mov byte [rsp + rdi + 0x19], dl
lea edx, [r8 - 0x2f]
mov byte [rsp + rsi + 0x19], dl
add rax, 2
cmp rax, 0xc
jge 0x4709b7
movzx edx, byte [rsp + rax + 0x24]
movzx esi, byte [rsp + rax + 0x25]
mov edi, edx
xor edx, esi
add edx, eax
nop
cmp rdi, 0xb
jae 0x4709da
movzx r8d, byte [rsp + rdi + 0x19]
sub r8d, edx
cmp rsi, 0xb
jb 0x47096b
jmp 0x4709ce
xor eax, eax
lea rbx, [rsp + 0x19]
mov ecx, 0xb
call fcn.004454c0
add rsp, 0x30
pop rbp
ret
mov eax, esi
mov ecx, 0xb
call fcn.004579c0
mov eax, edi
mov ecx, 0xb
call fcn.004579c0
nop
call fcn.00455760
jmp fcn.00470920
Function at 0x4712e0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4713a6
push rbp
mov rbp, rsp
sub rsp, 0x30
movabs rdx, 0x38673543fb3a6c4f
mov qword [rsp + 0x26], rdx
mov word [rsp + 0x2e], 0x2e23
movabs rdx, 0x505050208040203
mov qword [rsp + 0x1c], rdx
mov word [rsp + 0x24], 0x709
xor eax, eax
jmp 0x471340
movzx r9d, byte [rsp + rsi + 0x26]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x24]
mov byte [rsp + rdi + 0x26], dl
mov byte [rsp + rsi + 0x26], r8b
add rax, 2
nop dword [rax]
cmp rax, 0xa
jge 0x471372
movzx edx, byte [rsp + rax + 0x1c]
movzx esi, byte [rsp + rax + 0x1d]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0xa
jae 0x471397
movzx r8d, byte [rsp + rdi + 0x26]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x24]
cmp rsi, 0xa
jb 0x471322
jmp 0x47138b
xor eax, eax
lea rbx, [rsp + 0x26]
mov ecx, 0xa
nop
call fcn.004454c0
add rsp, 0x30
pop rbp
ret
mov eax, esi
mov ecx, 0xa
call fcn.004579c0
mov eax, edi
mov ecx, 0xa
nop
call fcn.004579c0
nop
call fcn.00455760
jmp fcn.004712e0

Function at 0x471520
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4715e6
push rbp
mov rbp, rsp
sub rsp, 0x30
movabs rdx, 0x8c657d698e758450
mov qword [rsp + 0x1b], rdx
mov byte [rsp + 0x23], 0x65
movabs rdx, 0x503010403010507
mov qword [rsp + 0x24], rdx
mov dword [rsp + 0x2c], 0x7020302
xor eax, eax
nop
jmp 0x471580
movzx r9d, byte [rsp + rsi + 0x1b]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x11]
mov byte [rsp + rdi + 0x1b], dl
mov byte [rsp + rsi + 0x1b], r8b
add rax, 2
nop dword [rax]
cmp rax, 0xc
jge 0x4715b2
movzx edx, byte [rsp + rax + 0x24]
movzx esi, byte [rsp + rax + 0x25]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 9
jae 0x4715d7
movzx r8d, byte [rsp + rdi + 0x1b]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x11]
cmp rsi, 9
jb 0x471562
jmp 0x4715cb
xor eax, eax
lea rbx, [rsp + 0x1b]
mov ecx, 9
nop
call fcn.004454c0
add rsp, 0x30
pop rbp
ret
mov eax, esi
mov ecx, 9
call fcn.004579c0
mov eax, edi
mov ecx, 9
nop
call fcn.004579c0
nop
call fcn.00455760
jmp fcn.00471520

Function at 0x471d00
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x471dc6
push rbp
mov rbp, rsp
sub rsp, 0x30
movabs rdx, 0xda74816c616d797c
mov qword [rsp + 0x1d], rdx
mov byte [rsp + 0x25], 0xf6
movabs rdx, 0x700040801000500
mov qword [rsp + 0x26], rdx
mov word [rsp + 0x2e], 0x805
xor eax, eax
nop
jmp 0x471d60
movzx r9d, byte [rsp + rsi + 0x1d]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x6c]
mov byte [rsp + rdi + 0x1d], dl
mov byte [rsp + rsi + 0x1d], r8b
add rax, 2
nop dword [rax]
cmp rax, 0xa
jge 0x471d92
movzx edx, byte [rsp + rax + 0x26]
movzx esi, byte [rsp + rax + 0x27]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 9
jae 0x471db7
movzx r8d, byte [rsp + rdi + 0x1d]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x6c]
cmp rsi, 9
jb 0x471d42
jmp 0x471dab
xor eax, eax
lea rbx, [rsp + 0x1d]
mov ecx, 9
nop
call fcn.004454c0
add rsp, 0x30
pop rbp
ret
mov eax, esi
mov ecx, 9
call fcn.004579c0
mov eax, edi
mov ecx, 9
nop
call fcn.004579c0
nop
call fcn.00455760
jmp fcn.00471d00
Function at 0x472360
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x47242c
push rbp
mov rbp, rsp
sub rsp, 0x38
movabs rdx, 0x135fe1887d6c83d9
mov qword [rsp + 0x1c], rdx
mov dword [rsp + 0x24], 0xe1f36763
movabs rdx, 0x30400030007080a
mov qword [rsp + 0x28], rdx
movabs rdx, 0x50b0a0001030101
mov qword [rsp + 0x30], rdx
xor eax, eax
jmp 0x4723c5
movzx r9d, byte [rsp + rsi + 0x1c]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x6c]
mov byte [rsp + rdi + 0x1c], dl
mov byte [rsp + rsi + 0x1c], r8b
add rax, 2
cmp rax, 0x10
jge 0x4723fc
movzx edx, byte [rsp + rax + 0x28]
movzx esi, byte [rsp + rax + 0x29]
mov edi, edx
xor edx, esi
add edx, eax
nop dword [rax + rax]
cmp rdi, 0xc
jae 0x47241f
movzx r8d, byte [rsp + rdi + 0x1c]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x6c]
cmp rsi, 0xc
jb 0x4723ab
jmp 0x472413
xor eax, eax
lea rbx, [rsp + 0x1c]
mov ecx, 0xc
call fcn.004454c0
add rsp, 0x38
pop rbp
ret
mov eax, esi
mov ecx, 0xc
call fcn.004579c0
mov eax, edi
mov ecx, 0xc
call fcn.004579c0
nop
call fcn.00455760
jmp fcn.00472360

Function at 0x472a80
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x472b38
push rbp
mov rbp, rsp
sub rsp, 0x30
movabs rdx, 0x747b746d5f766475
mov qword [rsp + 0x1c], rdx
movabs rdx, 0x102010600050401
mov qword [rsp + 0x24], rdx
mov dword [rsp + 0x2c], 0x60101
xor eax, eax
jmp 0x472ad6
movzx r9d, byte [rsp + rsi + 0x1c]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x13]
mov byte [rsp + rdi + 0x1c], dl
mov byte [rsp + rsi + 0x1c], r8b
add rax, 2
cmp rax, 0xc
jge 0x472b08
movzx edx, byte [rsp + rax + 0x24]
movzx esi, byte [rsp + rax + 0x25]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 8
jae 0x472b2b
movzx r8d, byte [rsp + rdi + 0x1c]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x13]
cmp rsi, 8
jb 0x472abc
jmp 0x472b1f
xor eax, eax
lea rbx, [rsp + 0x1c]
mov ecx, 8
call fcn.004454c0
add rsp, 0x30
pop rbp
ret
mov eax, esi
mov ecx, 8
call fcn.004579c0
mov eax, edi
mov ecx, 8
call fcn.004579c0
nop
call fcn.00455760
nop dword [rax]
jmp fcn.00472a80

Function at 0x473380
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x47344c
push rbp
mov rbp, rsp
sub rsp, 0x38
movabs rdx, 0x29485fc5ed3a5341
mov qword [rsp + 0x19], rdx
movabs rdx, 0x4eb0b9e02311e29
mov qword [rsp + 0x20], rdx
movabs rdx, 0x70d0408080b030a
mov qword [rsp + 0x28], rdx
movabs rdx, 0x7090e0a0c040802
mov qword [rsp + 0x30], rdx
xor eax, eax
jmp 0x4733ef
movzx r9d, byte [rsp + rsi + 0x19]
sub r9d, edx
lea edx, [r9 + 0x50]
mov byte [rsp + rdi + 0x19], dl
lea edx, [r8 + 0x50]
mov byte [rsp + rsi + 0x19], dl
add rax, 2
cmp rax, 0x10
jge 0x47341c
movzx edx, byte [rsp + rax + 0x28]
movzx esi, byte [rsp + rax + 0x29]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0xf
jae 0x47343f
movzx r8d, byte [rsp + rdi + 0x19]
sub r8d, edx
cmp rsi, 0xf
jb 0x4733d2
jmp 0x473433
xor eax, eax
lea rbx, [rsp + 0x19]
mov ecx, 0xf
call fcn.004454c0
add rsp, 0x38
pop rbp
ret
mov eax, esi
mov ecx, 0xf
call fcn.004579c0
mov eax, edi
mov ecx, 0xf
call fcn.004579c0
nop
call fcn.00455760
jmp fcn.00473380
Function at 0x473540
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4735fd
push rbp
mov rbp, rsp
sub rsp, 0x30
movabs rdx, 0xce3363c5c5d22e44
mov qword [rsp + 0x26], rdx
mov word [rsp + 0x2e], 0xddce
movabs rdx, 0x603080401040702
mov qword [rsp + 0x1c], rdx
mov word [rsp + 0x24], 0x309
xor eax, eax
jmp 0x4735a0
movzx r9d, byte [rsp + rsi + 0x26]
sub r9d, edx
lea edx, [r9 - 0x59]
mov byte [rsp + rdi + 0x26], dl
lea edx, [r8 - 0x59]
mov byte [rsp + rsi + 0x26], dl
add rax, 2
nop
cmp rax, 0xa
jge 0x4735cd
movzx edx, byte [rsp + rax + 0x1c]
movzx esi, byte [rsp + rax + 0x1d]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0xa
jae 0x4735f0
movzx r8d, byte [rsp + rdi + 0x26]
sub r8d, edx
cmp rsi, 0xa
jb 0x473582
jmp 0x4735e4
xor eax, eax
lea rbx, [rsp + 0x26]
mov ecx, 0xa
call fcn.004454c0
add rsp, 0x30
pop rbp
ret
mov eax, esi
mov ecx, 0xa
call fcn.004579c0
mov eax, edi
mov ecx, 0xa
call fcn.004579c0
nop
nop dword [rax]
call fcn.00455760
jmp fcn.00473540

Function at 0x474200
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4742ea
push rbp
mov rbp, rsp
sub rsp, 0x48
movabs rdx, 0x61bdb727bc25bf0e
mov qword [rsp + 0x19], rdx
movabs rdx, 0xb343511dc90aa961
mov qword [rsp + 0x20], rdx
movabs rdx, 0x746e6937d25f65b4
mov qword [rsp + 0x28], rdx
movabs rdx, 0xe12130209000b13
mov qword [rsp + 0x30], rdx
movabs rdx, 0x10a04030606050f
mov qword [rsp + 0x38], rdx
movabs rdx, 0xb13030908000c13
mov qword [rsp + 0x40], rdx
xor eax, eax
jmp 0x47428d
movzx r9d, byte [rsp + rsi + 0x19]
sub r9d, edx
lea edx, [r9 - 0x41]
mov byte [rsp + rdi + 0x19], dl
lea edx, [r8 - 0x41]
mov byte [rsp + rsi + 0x19], dl
add rax, 2
cmp rax, 0x18
jge 0x4742ba
movzx edx, byte [rsp + rax + 0x30]
movzx esi, byte [rsp + rax + 0x31]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x17
jae 0x4742dd
movzx r8d, byte [rsp + rdi + 0x19]
sub r8d, edx
cmp rsi, 0x17
jb 0x474270
jmp 0x4742d1
xor eax, eax
lea rbx, [rsp + 0x19]
mov ecx, 0x17
call fcn.004454c0
add rsp, 0x48
pop rbp
ret
mov eax, esi
mov ecx, 0x17
call fcn.004579c0
mov eax, edi
mov ecx, 0x17
call fcn.004579c0
nop
call fcn.00455760
jmp fcn.00474200
Function at 0x4758e0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4759bd
push rbp
mov rbp, rsp
sub rsp, 0x38
movabs rdx, 0xec6e7265a2f6d650
mov qword [rsp + 0x18], rdx
movabs rdx, 0x78eca86e9df5ec6e
mov qword [rsp + 0x1e], rdx
movabs rdx, 0x20c080702080309
mov qword [rsp + 0x26], rdx
movabs rdx, 0x108020c08070208
mov qword [rsp + 0x28], rdx
movabs rdx, 0xb080c07020b0101
mov qword [rsp + 0x30], rdx
xor eax, eax
nop
jmp 0x475960
movzx r9d, byte [rsp + rsi + 0x18]
sub r9d, edx
lea edx, [r9 - 0x1f]
mov byte [rsp + rdi + 0x18], dl
lea edx, [r8 - 0x1f]
mov byte [rsp + rsi + 0x18], dl
add rax, 2
nop
cmp rax, 0x12
jge 0x47598d
movzx edx, byte [rsp + rax + 0x26]
movzx esi, byte [rsp + rax + 0x27]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0xe
jae 0x4759b0
movzx r8d, byte [rsp + rdi + 0x18]
sub r8d, edx
cmp rsi, 0xe
jb 0x475942
jmp 0x4759a4
xor eax, eax
lea rbx, [rsp + 0x18]
mov ecx, 0xe
call fcn.004454c0
add rsp, 0x38
pop rbp
ret
mov eax, esi
mov ecx, 0xe
call fcn.004579c0
mov eax, edi
mov ecx, 0xe
call fcn.004579c0
nop
nop dword [rax]
call fcn.00455760
jmp fcn.004758e0

Function at 0x47cd20
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x47ce4c
push rbp
mov rbp, rsp
sub rsp, 0x60
movabs rdx, 0x389d61676528a419
mov qword [rsp + 0x3e], rdx
movabs rdx, 0x3162389d61676528
mov qword [rsp + 0x40], rdx
movabs rdx, 0xeca24c20232a6530
mov qword [rsp + 0x48], rdx
movabs rdx, 0xe71412204561d11e
mov qword [rsp + 0x50], rdx
movabs rdx, 0x2065743b162aecdd
mov qword [rsp + 0x58], rdx
movabs rdx, 0x19011e15101b1e17
mov qword [rsp + 0x1c], rdx
movabs rdx, 0x110c19011e15101b
mov qword [rsp + 0x1e], rdx
movabs rdx, 0x21a0706091b020f
mov qword [rsp + 0x26], rdx
movabs rdx, 0x18000713190d091d
mov qword [rsp + 0x2e], rdx
movabs rdx, 0x1c1a0a0a12100201
mov qword [rsp + 0x36], rdx
xor eax, eax
jmp 0x47cde6
movzx r9d, byte [rsp + rsi + 0x3e]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x25]
mov byte [rsp + rdi + 0x3e], dl
mov byte [rsp + rsi + 0x3e], r8b
add rax, 2
cmp rax, 0x22
jge 0x47ce1c
movzx edx, byte [rsp + rax + 0x1c]
movzx esi, byte [rsp + rax + 0x1d]
mov edi, edx
xor edx, esi
add edx, eax
nop dword [rax]
cmp rdi, 0x22
jae 0x47ce3f
movzx r8d, byte [rsp + rdi + 0x3e]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x25]
cmp rsi, 0x22
jb 0x47cdcc
jmp 0x47ce33
xor eax, eax
lea rbx, [rsp + 0x3e]
mov ecx, 0x22
call fcn.004454c0
add rsp, 0x60
pop rbp
ret
mov eax, esi
mov ecx, 0x22
call fcn.004579c0
mov eax, edi
mov ecx, 0x22
call fcn.004579c0
nop
call fcn.00455760
jmp fcn.0047cd20
Function at 0x47f700
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x47f7ca
push rbp
mov rbp, rsp
sub rsp, 0x48
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x58], rax
mov qword [rsp], rax
mov qword [rsp + 8], rbx
mov byte [rsp + 0x10], 0
call fcn.004027a0
xorps xmm15, xmm15
mov r14, qword [0x005d1a38]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x18], 0xffffffffffffffff
jne 0x47f7af
mov rcx, qword [rsp + 0x60]
lea rdx, [rcx + 1]
mov qword [rsp + 0x40], rdx
lea rax, [0x004b90e0]
xor ebx, ebx
mov rcx, rdx
call fcn.00441440
mov rbx, qword [rsp + 0x60]
mov rcx, rax
xor edi, edi
mov rsi, qword [rsp + 0x40]
mov rax, qword [rsp + 0x58]
nop dword [rax]
call fcn.00481b60
inc rbx
cmp rcx, rbx
jae 0x47f79e
mov edi, 1
lea rsi, [0x004b90e0]
call fcn.00441520
mov word [rax + rbx*2 - 2], 0
xor edi, edi
xor esi, esi
add rsp, 0x48
pop rbp
ret
xor eax, eax
xor ebx, ebx
mov rcx, rbx
lea rdi, [0x005000b8]
lea rsi, [0x004ffdc0]
add rsp, 0x48
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.00455760
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.0047f700

Function at 0x481060
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x481127
push rbp
mov rbp, rsp
sub rsp, 0x30
movabs rdx, 0x6c63781b72756e6a
mov qword [rsp + 0x19], rdx
movabs rdx, 0x6b7c796c63781b72
mov qword [rsp + 0x1c], rdx
movabs rdx, 0xa00090001040405
mov qword [rsp + 0x24], rdx
mov dword [rsp + 0x2c], 0x8010a02
xor eax, eax
jmp 0x4810c8
movzx r9d, byte [rsp + rsi + 0x19]
sub r9d, edx
lea edx, [r9 + 6]
mov byte [rsp + rdi + 0x19], dl
lea edx, [r8 + 6]
mov byte [rsp + rsi + 0x19], dl
add rax, 2
cmp rax, 0xc
jge 0x4810f7
movzx edx, byte [rsp + rax + 0x24]
movzx esi, byte [rsp + rax + 0x25]
mov edi, edx
xor edx, esi
add edx, eax
nop
cmp rdi, 0xb
jae 0x48111a
movzx r8d, byte [rsp + rdi + 0x19]
sub r8d, edx
cmp rsi, 0xb
jb 0x4810ab
jmp 0x48110e
xor eax, eax
lea rbx, [rsp + 0x19]
mov ecx, 0xb
call fcn.004454c0
add rsp, 0x30
pop rbp
ret
mov eax, esi
mov ecx, 0xb
call fcn.004579c0
mov eax, edi
mov ecx, 0xb
call fcn.004579c0
nop
call fcn.00455760
jmp fcn.00481060

Function at 0x481a80
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x28
mov qword [rsp + 0x38], 0
movabs rdx, 0xa506f78c9d148a55
mov qword [rsp + 0x20], rdx
movabs rdx, 0x501000702050305
mov qword [rsp + 0x10], rdx
xor eax, eax
jmp 0x481acf
movzx r8d, byte [rsp + rbx + 0x20]
sub r8d, edx
lea edx, [r8 - 0xc]
mov byte [rsp + rsi + 0x20], dl
lea edx, [rdi - 0xc]
mov byte [rsp + rbx + 0x20], dl
add rax, 2
cmp rax, 8
jge 0x481afa
movzx edx, byte [rsp + rax + 0x10]
movzx ebx, byte [rsp + rax + 0x11]
mov esi, edx
xor edx, ebx
add edx, eax
cmp rsi, 8
jae 0x481b35
movzx edi, byte [rsp + rsi + 0x20]
sub edi, edx
cmp rbx, 8
jb 0x481ab3
jmp 0x481b29
mov qword [rsp + 0x18], 0
xor eax, eax
jmp 0x481b13
movzx ecx, byte [rsp + rax + 0x20]
mov byte [rsp + rax + 0x18], cl
inc rax
cmp rax, 8
jl 0x481b07
mov rax, qword [rsp + 0x18]
mov qword [rsp + 0x38], rax
add rsp, 0x28
pop rbp
ret
mov eax, ebx
mov ecx, 8
call fcn.004579c0
mov eax, esi
mov ecx, 8
nop dword [rax]
call fcn.004579c0
nop
int3
Function at 0x482de0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x482ec6
push rbp
mov rbp, rsp
sub rsp, 0x40
movabs rdx, 0xbbab0bb365d9d361
mov qword [rsp + 0x1d], rdx
movabs rdx, 0x726fa88f058b65bb
mov qword [rsp + 0x24], rdx
movabs rdx, 0x50c010205050407
mov qword [rsp + 0x2c], rdx
movabs rdx, 0xa0a0406050c0102
mov qword [rsp + 0x30], rdx
movabs rdx, 0x906020c010b0a0c
mov qword [rsp + 0x38], rdx
xor eax, eax
nop
jmp 0x482e60
movzx r9d, byte [rsp + rsi + 0x1d]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x43]
mov byte [rsp + rdi + 0x1d], dl
mov byte [rsp + rsi + 0x1d], r8b
add rax, 2
nop dword [rax]
cmp rax, 0x14
jge 0x482e92
movzx edx, byte [rsp + rax + 0x2c]
movzx esi, byte [rsp + rax + 0x2d]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0xf
jae 0x482eb7
movzx r8d, byte [rsp + rdi + 0x1d]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x43]
cmp rsi, 0xf
jb 0x482e42
jmp 0x482eab
xor eax, eax
lea rbx, [rsp + 0x1d]
mov ecx, 0xf
nop
call fcn.004454c0
add rsp, 0x40
pop rbp
ret
mov eax, esi
mov ecx, 0xf
call fcn.004579c0
mov eax, edi
mov ecx, 0xf
nop
call fcn.004579c0
nop
call fcn.00455760
jmp fcn.00482de0
Function at 0x484f80
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x48509d
push rbp
mov rbp, rsp
sub rsp, 0x60
movabs rdx, 0x65de61ec9c666f73
mov qword [rsp + 0x1e], rdx
movabs rdx, 0x8564f57375a59045
mov qword [rsp + 0x26], rdx
movabs rdx, 0x8c7c63659e8f6f86
mov qword [rsp + 0x2e], rdx
movabs rdx, 0x7a8f849c90bb3781
mov qword [rsp + 0x36], rdx
movabs rdx, 0x1e061c0a190f1618
mov qword [rsp + 0x3e], rdx
movabs rdx, 0x1a031e061c0a190f
mov qword [rsp + 0x40], rdx
movabs rdx, 0x101a091d100a0d04
mov qword [rsp + 0x48], rdx
movabs rdx, 0x4121c1f081a1e12
mov qword [rsp + 0x50], rdx
movabs rdx, 0x171b03130d131b12
mov qword [rsp + 0x58], rdx
xor eax, eax
jmp 0x485040
movzx r9d, byte [rsp + rsi + 0x1e]
sub r9d, edx
lea edx, [r9 + 1]
mov byte [rsp + rdi + 0x1e], dl
lea edx, [r8 + 1]
mov byte [rsp + rsi + 0x1e], dl
add rax, 2
nop word [rax + rax]
cmp rax, 0x22
jge 0x48506d
movzx edx, byte [rsp + rax + 0x3e]
movzx esi, byte [rsp + rax + 0x3f]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x20
jae 0x485090
movzx r8d, byte [rsp + rdi + 0x1e]
sub r8d, edx
cmp rsi, 0x20
jb 0x48501d
jmp 0x485084
xor eax, eax
lea rbx, [rsp + 0x1e]
mov ecx, 0x20
call fcn.004454c0
add rsp, 0x60
pop rbp
ret
mov eax, esi
mov ecx, 0x20
call fcn.004579c0
mov eax, edi
mov ecx, 0x20
call fcn.004579c0
nop
nop dword [rax]
call fcn.00455760
jmp fcn.00484f80

Function at 0x485720
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x48583d
push rbp
mov rbp, rsp
sub rsp, 0x58
movabs rdx, 0x8d858d749e73658a
mov qword [rsp + 0x1d], rdx
movabs rdx, 0x63db6caea6d5c1b9
mov qword [rsp + 0x25], rdx
movabs rdx, 0xb263db6caea6d5c1
mov qword [rsp + 0x26], rdx
movabs rdx, 0xeea2aff76f76f9a9
mov qword [rsp + 0x2e], rdx
movabs rdx, 0x905110e080c0712
mov qword [rsp + 0x36], rdx
movabs rdx, 0xc040905110e080c
mov qword [rsp + 0x38], rdx
movabs rdx, 0xa18170b0a070006
mov qword [rsp + 0x40], rdx
movabs rdx, 0xa0a1503160c08
mov qword [rsp + 0x48], rdx
movabs rdx, 0x161110110a100705
mov qword [rsp + 0x50], rdx
xor eax, eax
jmp 0x4857e0
movzx r9d, byte [rsp + rsi + 0x1d]
sub r9d, edx
lea edx, [r9 - 0x17]
mov byte [rsp + rdi + 0x1d], dl
lea edx, [r8 - 0x17]
mov byte [rsp + rsi + 0x1d], dl
add rax, 2
nop word [rax + rax]
cmp rax, 0x22
jge 0x48580d
movzx edx, byte [rsp + rax + 0x36]
movzx esi, byte [rsp + rax + 0x37]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x19
jae 0x485830
movzx r8d, byte [rsp + rdi + 0x1d]
sub r8d, edx
cmp rsi, 0x19
jb 0x4857bd
jmp 0x485824
xor eax, eax
lea rbx, [rsp + 0x1d]
mov ecx, 0x19
call fcn.004454c0
add rsp, 0x58
pop rbp
ret
mov eax, esi
mov ecx, 0x19
call fcn.004579c0
mov eax, edi
mov ecx, 0x19
call fcn.004579c0
nop
nop dword [rax]
call fcn.00455760
jmp fcn.00485720
Function at 0x485f40
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x48605a
push rbp
mov rbp, rsp
sub rsp, 0x60
movabs rdx, 0x7fe16972df4d5454
mov qword [rsp + 0x1c], rdx
movabs rdx, 0xa06d75675261a8c7
mov qword [rsp + 0x24], rdx
movabs rdx, 0x32071756fcd6786
mov qword [rsp + 0x2c], rdx
movabs rdx, 0x566961e26fcffdd7
mov qword [rsp + 0x34], rdx
movabs rdx, 0x1f0b091911191815
mov qword [rsp + 0x3c], rdx
movabs rdx, 0x21f18171f0b0919
mov qword [rsp + 0x40], rdx
movabs rdx, 0x603090f0b000b15
mov qword [rsp + 0x48], rdx
movabs rdx, 0xf0b010f07191009
mov qword [rsp + 0x50], rdx
movabs rdx, 0x121807101a081f1c
mov qword [rsp + 0x58], rdx
xor eax, eax
jmp 0x485ff7
movzx r9d, byte [rsp + rsi + 0x1c]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x6d]
mov byte [rsp + rdi + 0x1c], dl
mov byte [rsp + rsi + 0x1c], r8b
add rax, 2
cmp rax, 0x24
jge 0x486029
movzx edx, byte [rsp + rax + 0x3c]
movzx esi, byte [rsp + rax + 0x3d]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x20
jae 0x48604d
movzx r8d, byte [rsp + rdi + 0x1c]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x6d]
cmp rsi, 0x20
jb 0x485fdd
jmp 0x486041
xor eax, eax
lea rbx, [rsp + 0x1c]
mov ecx, 0x20
call fcn.004454c0
add rsp, 0x60
pop rbp
nop
ret
mov eax, esi
mov ecx, 0x20
call fcn.004579c0
mov eax, edi
mov ecx, 0x20
call fcn.004579c0
nop
call fcn.00455760
nop
jmp fcn.00485f40

Function at 0x487d40
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x487e3b
push rbp
mov rbp, rsp
sub rsp, 0x50
movabs rdx, 0xf9800ffc43749469
mov qword [rsp + 0x1d], rdx
movabs rdx, 0x8a7973208165e1f9
mov qword [rsp + 0x24], rdx
movabs rdx, 0x2f670886d65de
mov qword [rsp + 0x2c], rdx
movabs rdx, 0x1504010a0612050e
mov qword [rsp + 0x34], rdx
movabs rdx, 0x50a061601140306
mov qword [rsp + 0x3c], rdx
movabs rdx, 0x8120f13050a0616
mov qword [rsp + 0x40], rdx
movabs rdx, 0x70f031603121603
mov qword [rsp + 0x48], rdx
xor eax, eax
jmp 0x487dd9
movzx r9d, byte [rsp + rsi + 0x1d]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x59]
mov byte [rsp + rdi + 0x1d], dl
mov byte [rsp + rsi + 0x1d], r8b
add rax, 2
cmp rax, 0x1c
jge 0x487e0b
movzx edx, byte [rsp + rax + 0x34]
movzx esi, byte [rsp + rax + 0x35]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x17
jae 0x487e2e
movzx r8d, byte [rsp + rdi + 0x1d]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x59]
cmp rsi, 0x17
jb 0x487dbf
jmp 0x487e22
xor eax, eax
lea rbx, [rsp + 0x1d]
mov ecx, 0x17
call fcn.004454c0
add rsp, 0x50
pop rbp
ret
mov eax, esi
mov ecx, 0x17
call fcn.004579c0
mov eax, edi
mov ecx, 0x17
call fcn.004579c0
nop
nop dword [rax + rax]
call fcn.00455760
jmp fcn.00487d40