joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4611e0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4612e8
push rbp
mov rbp, rsp
sub rsp, 0x58
movabs rdx, 0x21f412f3b72a1034
mov qword [rsp + 0x1c], rdx
movabs rdx, 0x6355458fb6ca1b6e
mov qword [rsp + 0x24], rdx
movabs rdx, 0x64657a5a40052bd8
mov qword [rsp + 0x2c], rdx
movabs rdx, 0x100a0c1007010305
mov qword [rsp + 0x34], rdx
movabs rdx, 0xb060002100a0c10
mov qword [rsp + 0x38], rdx
movabs rdx, 0xc11040b0a0c0d10
mov qword [rsp + 0x40], rdx
movabs rdx, 0xc0d13110a090605
mov qword [rsp + 0x48], rdx
movabs rdx, 0xc03040a0e141207
mov qword [rsp + 0x50], rdx
xor eax, eax
jmp 0x46128b
movzx r9d, byte [rsp + rsi + 0x1c]
sub r9d, edx
lea edx, [r9 + 0x4c]
mov byte [rsp + rdi + 0x1c], dl
lea edx, [r8 + 0x4c]
mov byte [rsp + rsi + 0x1c], dl
add rax, 2
cmp rax, 0x24
jge 0x4612b8
movzx edx, byte [rsp + rax + 0x34]
movzx esi, byte [rsp + rax + 0x35]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x18
jae 0x4612db
movzx r8d, byte [rsp + rdi + 0x1c]
sub r8d, edx
cmp rsi, 0x18
jb 0x46126e
jmp 0x4612cf
xor eax, eax
lea rbx, [rsp + 0x1c]
mov ecx, 0x18
call fcn.0043b400
add rsp, 0x58
pop rbp
ret
mov eax, esi
mov ecx, 0x18
call fcn.00449a60
mov eax, edi
mov ecx, 0x18
call fcn.00449a60
nop
call fcn.00447800
jmp fcn.004611e0

Function at 0x463f80
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4640a7
push rbp
mov rbp, rsp
sub rsp, 0x60
movabs rdx, 0x796e611120dbc121
mov qword [rsp + 0x1d], rdx
movabs rdx, 0xe7796e611120dbc1
mov qword [rsp + 0x1e], rdx
movabs rdx, 0x3d2073e9654bec6c
mov qword [rsp + 0x26], rdx
movabs rdx, 0xc0c4942e8e73e738
mov qword [rsp + 0x2e], rdx
movabs rdx, 0x73efb2b7c02056bd
mov qword [rsp + 0x36], rdx
movabs rdx, 0x1115150401161d1e
mov qword [rsp + 0x3e], rdx
movabs rdx, 0x1111515040116
mov qword [rsp + 0x40], rdx
movabs rdx, 0x19171a1714081c18
mov qword [rsp + 0x48], rdx
movabs rdx, 0x4021f000210120b
mov qword [rsp + 0x50], rdx
movabs rdx, 0x1219150d0a010a17
mov qword [rsp + 0x58], rdx
xor eax, eax
jmp 0x464049
movzx r9d, byte [rsp + rsi + 0x1d]
sub r9d, edx
lea edx, [r9 - 0x46]
mov byte [rsp + rdi + 0x1d], dl
lea edx, [r8 - 0x46]
mov byte [rsp + rsi + 0x1d], dl
add rax, 2
cmp rax, 0x22
jge 0x464077
movzx edx, byte [rsp + rax + 0x3e]
movzx esi, byte [rsp + rax + 0x3f]
mov edi, edx
xor edx, esi
add edx, eax
nop
cmp rdi, 0x21
jae 0x46409a
movzx r8d, byte [rsp + rdi + 0x1d]
sub r8d, edx
cmp rsi, 0x21
jb 0x46402c
jmp 0x46408e
xor eax, eax
lea rbx, [rsp + 0x1d]
mov ecx, 0x21
call fcn.0043b400
add rsp, 0x60
pop rbp
ret
mov eax, esi
mov ecx, 0x21
call fcn.00449a60
mov eax, edi
mov ecx, 0x21
call fcn.00449a60
nop
call fcn.00447800
jmp fcn.00463f80
Function at 0x469080
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x46916c
push rbp
mov rbp, rsp
sub rsp, 0x48
movabs rdx, 0x2170717863657888
mov qword [rsp + 0x1f], rdx
movabs rdx, 0xab21707178636578
mov qword [rsp + 0x20], rdx
movabs rdx, 0x6084787294276f6f
mov qword [rsp + 0x28], rdx
movabs rdx, 0xc0e0a1008000c08
mov qword [rsp + 0x30], rdx
movabs rdx, 0xb07090606000f0e
mov qword [rsp + 0x38], rdx
movabs rdx, 0x90a090507040e08
mov qword [rsp + 0x40], rdx
xor eax, eax
jmp 0x46910a
movzx r9d, byte [rsp + rsi + 0x1f]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x1b]
mov byte [rsp + rdi + 0x1f], dl
mov byte [rsp + rsi + 0x1f], r8b
add rax, 2
cmp rax, 0x18
jge 0x46913c
movzx edx, byte [rsp + rax + 0x30]
movzx esi, byte [rsp + rax + 0x31]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x11
jae 0x46915f
movzx r8d, byte [rsp + rdi + 0x1f]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x1b]
cmp rsi, 0x11
jb 0x4690f0
jmp 0x469153
xor eax, eax
lea rbx, [rsp + 0x1f]
mov ecx, 0x11
call fcn.0043b400
add rsp, 0x48
pop rbp
ret
mov eax, esi
mov ecx, 0x11
call fcn.00449a60
mov eax, edi
mov ecx, 0x11
call fcn.00449a60
nop
call fcn.00447800
jmp fcn.00469080

Function at 0x46d140
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x46d23d
push rbp
mov rbp, rsp
sub rsp, 0x48
movabs rdx, 0x6f7f8cb92961747f
mov qword [rsp + 0x19], rdx
movabs rdx, 0x979977209c6f7f8c
mov qword [rsp + 0x1e], rdx
movabs rdx, 0x9290b091c99e736f
mov qword [rsp + 0x26], rdx
movabs rdx, 0x503130f130b0a0e
mov qword [rsp + 0x2e], rdx
movabs rdx, 0x13120c1014031304
mov qword [rsp + 0x36], rdx
movabs rdx, 0x1113120c101403
mov qword [rsp + 0x38], rdx
movabs rdx, 0x8130b1206060b0c
mov qword [rsp + 0x40], rdx
xor eax, eax
jmp 0x46d1e0
movzx r9d, byte [rsp + rsi + 0x19]
sub r9d, edx
lea edx, [r9 + 3]
mov byte [rsp + rdi + 0x19], dl
lea edx, [r8 + 3]
mov byte [rsp + rsi + 0x19], dl
add rax, 2
nop dword [rax]
cmp rax, 0x1a
jge 0x46d20d
movzx edx, byte [rsp + rax + 0x2e]
movzx esi, byte [rsp + rax + 0x2f]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x15
jae 0x46d230
movzx r8d, byte [rsp + rdi + 0x19]
sub r8d, edx
cmp rsi, 0x15
jb 0x46d1bf
jmp 0x46d224
xor eax, eax
lea rbx, [rsp + 0x19]
mov ecx, 0x15
call fcn.0043b400
add rsp, 0x48
pop rbp
ret
mov eax, esi
mov ecx, 0x15
call fcn.00449a60
mov eax, edi
mov ecx, 0x15
call fcn.00449a60
nop
nop dword [rax]
call fcn.00447800
jmp fcn.0046d140
Function at 0x46d260
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x46d37a
push rbp
mov rbp, rsp
sub rsp, 0x58
movabs rdx, 0x6d207465717f6279
mov qword [rsp + 0x18], rdx
movabs rdx, 0x6e5e89745f907c71
mov qword [rsp + 0x20], rdx
movabs rdx, 0x246e208e71736e5e
mov qword [rsp + 0x26], rdx
movabs rdx, 0x8c9282697f772d6e
mov qword [rsp + 0x2e], rdx
movabs rdx, 0x121b1c1d02190d00
mov qword [rsp + 0x36], rdx
movabs rdx, 0x1a0a121b1c1d0219
mov qword [rsp + 0x38], rdx
movabs rdx, 0xb07111b180a191a
mov qword [rsp + 0x40], rdx
movabs rdx, 0xe1c08090302011b
mov qword [rsp + 0x48], rdx
movabs rdx, 0xb07180d0e0a1015
mov qword [rsp + 0x50], rdx
xor eax, eax
jmp 0x46d317
movzx r9d, byte [rsp + rsi + 0x18]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x23]
mov byte [rsp + rdi + 0x18], dl
mov byte [rsp + rsi + 0x18], r8b
add rax, 2
cmp rax, 0x22
jge 0x46d349
movzx edx, byte [rsp + rax + 0x36]
movzx esi, byte [rsp + rax + 0x37]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x1e
jae 0x46d36d
movzx r8d, byte [rsp + rdi + 0x18]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x23]
cmp rsi, 0x1e
jb 0x46d2fd
jmp 0x46d361
xor eax, eax
lea rbx, [rsp + 0x18]
mov ecx, 0x1e
call fcn.0043b400
add rsp, 0x58
pop rbp
nop
ret
mov eax, esi
mov ecx, 0x1e
call fcn.00449a60
mov eax, edi
mov ecx, 0x1e
call fcn.00449a60
nop
call fcn.00447800
nop
jmp fcn.0046d260

Function at 0x46efe0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x46f0fa
push rbp
mov rbp, rsp
sub rsp, 0x60
movabs rdx, 0xb6d32b1f74c17270
mov qword [rsp + 0x1d], rdx
movabs rdx, 0x9412af166de42b10
mov qword [rsp + 0x25], rdx
movabs rdx, 0xbb250e6f2a9412af
mov qword [rsp + 0x2a], rdx
movabs rdx, 0x1b24abde60e3b075
mov qword [rsp + 0x32], rdx
movabs rdx, 0x120a090c0f0a0613
mov qword [rsp + 0x3a], rdx
movabs rdx, 0x1b1b10171819120a
mov qword [rsp + 0x40], rdx
movabs rdx, 0x1012180e160d0405
mov qword [rsp + 0x48], rdx
movabs rdx, 0x70914130d1a1c16
mov qword [rsp + 0x50], rdx
movabs rdx, 0x130713190208090d
mov qword [rsp + 0x58], rdx
xor eax, eax
jmp 0x46f097
movzx r9d, byte [rsp + rsi + 0x1d]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x35]
mov byte [rsp + rdi + 0x1d], dl
mov byte [rsp + rsi + 0x1d], r8b
add rax, 2
cmp rax, 0x26
jge 0x46f0c9
movzx edx, byte [rsp + rax + 0x3a]
movzx esi, byte [rsp + rax + 0x3b]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x1d
jae 0x46f0ed
movzx r8d, byte [rsp + rdi + 0x1d]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x35]
cmp rsi, 0x1d
jb 0x46f07d
jmp 0x46f0e1
xor eax, eax
lea rbx, [rsp + 0x1d]
mov ecx, 0x1d
call fcn.0043b400
add rsp, 0x60
pop rbp
nop
ret
mov eax, esi
mov ecx, 0x1d
call fcn.00449a60
mov eax, edi
mov ecx, 0x1d
call fcn.00449a60
nop
call fcn.00447800
nop
jmp fcn.0046efe0
Function at 0x46f520
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x46f5f2
push rbp
mov rbp, rsp
sub rsp, 0x38
movabs rdx, 0x8895867f74a67270
mov qword [rsp + 0x1a], rdx
movabs rdx, 0x41909e72a4938895
mov qword [rsp + 0x20], rdx
movabs rdx, 0x60c070b0c090d08
mov qword [rsp + 0x28], rdx
movabs rdx, 0x40c050905070702
mov qword [rsp + 0x30], rdx
xor eax, eax
jmp 0x46f58c
movzx r9d, byte [rsp + rsi + 0x1a]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x26]
mov byte [rsp + rdi + 0x1a], dl
mov byte [rsp + rsi + 0x1a], r8b
add rax, 2
cmp rax, 0x10
jge 0x46f5be
movzx edx, byte [rsp + rax + 0x28]
movzx esi, byte [rsp + rax + 0x29]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0xe
jae 0x46f5e5
movzx r8d, byte [rsp + rdi + 0x1a]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x26]
cmp rsi, 0xe
jb 0x46f572
jmp 0x46f5d5
xor eax, eax
lea rbx, [rsp + 0x1a]
mov ecx, 0xe
call fcn.0043b400
add rsp, 0x38
pop rbp
ret
mov eax, esi
mov ecx, 0xe
nop dword [rax]
call fcn.00449a60
mov eax, edi
mov ecx, 0xe
call fcn.00449a60
nop
call fcn.00447800
jmp fcn.0046f520

Function at 0x4702a0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x47037d
push rbp
mov rbp, rsp
sub rsp, 0x40
movabs rdx, 0x6f3c3fee6f54e416
mov qword [rsp + 0x1c], rdx
movabs rdx, 0x726fbdf0659a4c2f
mov qword [rsp + 0x24], rdx
movabs rdx, 0x901010d07050005
mov qword [rsp + 0x2c], rdx
movabs rdx, 0x10205090901010d
mov qword [rsp + 0x30], rdx
movabs rdx, 0xc040100090a060a
mov qword [rsp + 0x38], rdx
xor eax, eax
nop
jmp 0x470320
movzx r9d, byte [rsp + rsi + 0x1c]
sub r9d, edx
lea edx, [r9 - 0x62]
mov byte [rsp + rdi + 0x1c], dl
lea edx, [r8 - 0x62]
mov byte [rsp + rsi + 0x1c], dl
add rax, 2
nop
cmp rax, 0x14
jge 0x47034d
movzx edx, byte [rsp + rax + 0x2c]
movzx esi, byte [rsp + rax + 0x2d]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x10
jae 0x470370
movzx r8d, byte [rsp + rdi + 0x1c]
sub r8d, edx
cmp rsi, 0x10
jb 0x470302
jmp 0x470364
xor eax, eax
lea rbx, [rsp + 0x1c]
mov ecx, 0x10
call fcn.0043b400
add rsp, 0x40
pop rbp
ret
mov eax, esi
mov ecx, 0x10
call fcn.00449a60
mov eax, edi
mov ecx, 0x10
call fcn.00449a60
nop
nop dword [rax]
call fcn.00447800
jmp fcn.004702a0
Function at 0x4707a0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x47089d
push rbp
mov rbp, rsp
sub rsp, 0x48
movabs rdx, 0xadad769ed9618783
mov qword [rsp + 0x19], rdx
movabs rdx, 0x85a6ac895badad76
mov qword [rsp + 0x1e], rdx
movabs rdx, 0xbf65caa87973208d
mov qword [rsp + 0x26], rdx
movabs rdx, 0x904090804031405
mov qword [rsp + 0x2e], rdx
movabs rdx, 0xb12070d05030a00
mov qword [rsp + 0x36], rdx
movabs rdx, 0xb0b12070d0503
mov qword [rsp + 0x38], rdx
movabs rdx, 0x61103010c0d1409
mov qword [rsp + 0x40], rdx
xor eax, eax
jmp 0x470840
movzx r9d, byte [rsp + rsi + 0x19]
sub r9d, edx
lea edx, [r9 - 0xb]
mov byte [rsp + rdi + 0x19], dl
lea edx, [r8 - 0xb]
mov byte [rsp + rsi + 0x19], dl
add rax, 2
nop dword [rax]
cmp rax, 0x1a
jge 0x47086d
movzx edx, byte [rsp + rax + 0x2e]
movzx esi, byte [rsp + rax + 0x2f]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x15
jae 0x470890
movzx r8d, byte [rsp + rdi + 0x19]
sub r8d, edx
cmp rsi, 0x15
jb 0x47081f
jmp 0x470884
xor eax, eax
lea rbx, [rsp + 0x19]
mov ecx, 0x15
call fcn.0043b400
add rsp, 0x48
pop rbp
ret
mov eax, esi
mov ecx, 0x15
call fcn.00449a60
mov eax, edi
mov ecx, 0x15
call fcn.00449a60
nop
nop dword [rax]
call fcn.00447800
jmp fcn.004707a0

Function at 0x471c80
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x471d88
push rbp
mov rbp, rsp
sub rsp, 0x50
movabs rdx, 0x914b8a9295a36f73
mov qword [rsp + 0x1b], rdx
movabs rdx, 0xb38bbd36b299708d
mov qword [rsp + 0x23], rdx
movabs rdx, 0x8bb38bbd36b29970
mov qword [rsp + 0x24], rdx
movabs rdx, 0x92919fd88f70c075
mov qword [rsp + 0x2c], rdx
movabs rdx, 0x151216120b0c0c06
mov qword [rsp + 0x34], rdx
movabs rdx, 0x40d14100a050312
mov qword [rsp + 0x3c], rdx
movabs rdx, 0x1817040e040d1410
mov qword [rsp + 0x40], rdx
movabs rdx, 0xf160c1607030208
mov qword [rsp + 0x48], rdx
xor eax, eax
jmp 0x471d2b
movzx r9d, byte [rsp + rsi + 0x1b]
sub r9d, edx
lea edx, [r9 - 0xc]
mov byte [rsp + rdi + 0x1b], dl
lea edx, [r8 - 0xc]
mov byte [rsp + rsi + 0x1b], dl
add rax, 2
cmp rax, 0x1c
jge 0x471d58
movzx edx, byte [rsp + rax + 0x34]
movzx esi, byte [rsp + rax + 0x35]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x19
jae 0x471d7b
movzx r8d, byte [rsp + rdi + 0x1b]
sub r8d, edx
cmp rsi, 0x19
jb 0x471d0e
jmp 0x471d6f
xor eax, eax
lea rbx, [rsp + 0x1b]
mov ecx, 0x19
call fcn.0043b400
add rsp, 0x50
pop rbp
ret
mov eax, esi
mov ecx, 0x19
call fcn.00449a60
mov eax, edi
mov ecx, 0x19
call fcn.00449a60
nop
call fcn.00447800
jmp fcn.00471c80
Function at 0x472740
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x472826
push rbp
mov rbp, rsp
sub rsp, 0x38
movabs rdx, 0x67820fbfb6d69f8
mov qword [rsp + 0x19], rdx
movabs rdx, 0xfa05827f02067820
mov qword [rsp + 0x1e], rdx
movabs rdx, 0xc0b0b0a0c090406
mov qword [rsp + 0x26], rdx
movabs rdx, 0x80c0b0b0a0c09
mov qword [rsp + 0x28], rdx
movabs rdx, 0x30400030b040707
mov qword [rsp + 0x30], rdx
xor eax, eax
nop
jmp 0x4727c0
movzx r9d, byte [rsp + rsi + 0x19]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x68]
mov byte [rsp + rdi + 0x19], dl
mov byte [rsp + rsi + 0x19], r8b
add rax, 2
nop dword [rax]
cmp rax, 0x12
jge 0x4727f2
movzx edx, byte [rsp + rax + 0x26]
movzx esi, byte [rsp + rax + 0x27]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0xd
jae 0x472817
movzx r8d, byte [rsp + rdi + 0x19]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x68]
cmp rsi, 0xd
jb 0x4727a2
jmp 0x47280b
xor eax, eax
lea rbx, [rsp + 0x19]
mov ecx, 0xd
nop
call fcn.0043b400
add rsp, 0x38
pop rbp
ret
mov eax, esi
mov ecx, 0xd
call fcn.00449a60
mov eax, edi
mov ecx, 0xd
nop
call fcn.00449a60
nop
call fcn.00447800
jmp fcn.00472740

Function at 0x478080
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x47817b
push rbp
mov rbp, rsp
sub rsp, 0x48
movabs rdx, 0x756a7565726e6172
mov qword [rsp + 0x18], rdx
movabs rdx, 0x795d4b69986c756a
mov qword [rsp + 0x1e], rdx
movabs rdx, 0x6243746576a05769
mov qword [rsp + 0x26], rdx
movabs rdx, 0x1100713060d1010
mov qword [rsp + 0x2e], rdx
movabs rdx, 0x11081105030c090c
mov qword [rsp + 0x36], rdx
movabs rdx, 0x140011081105030c
mov qword [rsp + 0x38], rdx
movabs rdx, 0x70f120906140b15
mov qword [rsp + 0x40], rdx
xor eax, eax
jmp 0x478119
movzx r9d, byte [rsp + rsi + 0x18]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x24]
mov byte [rsp + rdi + 0x18], dl
mov byte [rsp + rsi + 0x18], r8b
add rax, 2
cmp rax, 0x1a
jge 0x47814b
movzx edx, byte [rsp + rax + 0x2e]
movzx esi, byte [rsp + rax + 0x2f]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x16
jae 0x47816e
movzx r8d, byte [rsp + rdi + 0x18]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x24]
cmp rsi, 0x16
jb 0x4780ff
jmp 0x478162
xor eax, eax
lea rbx, [rsp + 0x18]
mov ecx, 0x16
call fcn.0043b400
add rsp, 0x48
pop rbp
ret
mov eax, esi
mov ecx, 0x16
call fcn.00449a60
mov eax, edi
mov ecx, 0x16
call fcn.00449a60
nop
nop dword [rax + rax]
call fcn.00447800
jmp fcn.00478080
Function at 0x47ff20
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x48001b
push rbp
mov rbp, rsp
sub rsp, 0x50
movabs rdx, 0x6f2465746187edf8
mov qword [rsp + 0x1c], rdx
movabs rdx, 0xb8b170a8790b6f24
mov qword [rsp + 0x22], rdx
movabs rdx, 0xf4a46f506e8f6794
mov qword [rsp + 0x2a], rdx
movabs rdx, 0xa0c0e1000000f0c
mov qword [rsp + 0x32], rdx
movabs rdx, 0xe1001060d060614
mov qword [rsp + 0x3a], rdx
movabs rdx, 0x140c020f11090e10
mov qword [rsp + 0x40], rdx
movabs rdx, 0xa0a08090f11150c
mov qword [rsp + 0x48], rdx
xor eax, eax
jmp 0x47ffb9
movzx r9d, byte [rsp + rsi + 0x1c]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x49]
mov byte [rsp + rdi + 0x1c], dl
mov byte [rsp + rsi + 0x1c], r8b
add rax, 2
cmp rax, 0x1e
jge 0x47ffeb
movzx edx, byte [rsp + rax + 0x32]
movzx esi, byte [rsp + rax + 0x33]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x16
jae 0x48000e
movzx r8d, byte [rsp + rdi + 0x1c]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x49]
cmp rsi, 0x16
jb 0x47ff9f
jmp 0x480002
xor eax, eax
lea rbx, [rsp + 0x1c]
mov ecx, 0x16
call fcn.0043b400
add rsp, 0x50
pop rbp
ret
mov eax, esi
mov ecx, 0x16
call fcn.00449a60
mov eax, edi
mov ecx, 0x16
call fcn.00449a60
nop
nop dword [rax + rax]
call fcn.00447800
jmp fcn.0047ff20

Function at 0x480580
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x48067b
push rbp
mov rbp, rsp
sub rsp, 0x50
movabs rdx, 0xf3d657444013f43
mov qword [rsp + 0x1e], rdx
movabs rdx, 0xfe33706c652708ac
mov qword [rsp + 0x26], rdx
movabs rdx, 0x1d1368733e45261d
mov qword [rsp + 0x2e], rdx
movabs rdx, 0xf16020a0a101208
mov qword [rsp + 0x36], rdx
movabs rdx, 0xa071216120a0311
mov qword [rsp + 0x3e], rdx
movabs rdx, 0x3010a071216120a
mov qword [rsp + 0x40], rdx
movabs rdx, 0x70a06170f091213
mov qword [rsp + 0x48], rdx
xor eax, eax
jmp 0x480619
movzx r9d, byte [rsp + rsi + 0x1e]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x10]
mov byte [rsp + rdi + 0x1e], dl
mov byte [rsp + rsi + 0x1e], r8b
add rax, 2
cmp rax, 0x1a
jge 0x48064b
movzx edx, byte [rsp + rax + 0x36]
movzx esi, byte [rsp + rax + 0x37]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x18
jae 0x48066e
movzx r8d, byte [rsp + rdi + 0x1e]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x10]
cmp rsi, 0x18
jb 0x4805ff
jmp 0x480662
xor eax, eax
lea rbx, [rsp + 0x1e]
mov ecx, 0x18
call fcn.0043b400
add rsp, 0x50
pop rbp
ret
mov eax, esi
mov ecx, 0x18
call fcn.00449a60
mov eax, edi
mov ecx, 0x18
call fcn.00449a60
nop
nop dword [rax + rax]
call fcn.00447800
jmp fcn.00480580
Function at 0x4809e0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x480abd
push rbp
mov rbp, rsp
sub rsp, 0x40
movabs rdx, 0xda5128c4d3572eb3
mov qword [rsp + 0x1b], rdx
movabs rdx, 0xb46cc25a61af65da
mov qword [rsp + 0x22], rdx
movabs rdx, 0x90405030e0301
mov qword [rsp + 0x2a], rdx
movabs rdx, 0x20b0c0c04060009
mov qword [rsp + 0x30], rdx
movabs rdx, 0x702040b070c0703
mov qword [rsp + 0x38], rdx
xor eax, eax
nop
jmp 0x480a60
movzx r9d, byte [rsp + rsi + 0x1b]
sub r9d, edx
lea edx, [r9 - 0x5c]
mov byte [rsp + rdi + 0x1b], dl
lea edx, [r8 - 0x5c]
mov byte [rsp + rsi + 0x1b], dl
add rax, 2
nop
cmp rax, 0x16
jge 0x480a8d
movzx edx, byte [rsp + rax + 0x2a]
movzx esi, byte [rsp + rax + 0x2b]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0xf
jae 0x480ab0
movzx r8d, byte [rsp + rdi + 0x1b]
sub r8d, edx
cmp rsi, 0xf
jb 0x480a42
jmp 0x480aa4
xor eax, eax
lea rbx, [rsp + 0x1b]
mov ecx, 0xf
call fcn.0043b400
add rsp, 0x40
pop rbp
ret
mov eax, esi
mov ecx, 0xf
call fcn.00449a60
mov eax, edi
mov ecx, 0xf
call fcn.00449a60
nop
nop dword [rax]
call fcn.00447800
jmp fcn.004809e0

Function at 0x481320
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x481406
push rbp
mov rbp, rsp
sub rsp, 0x40
movabs rdx, 0x6245de40e4b96cdf
mov qword [rsp + 0x1d], rdx
movabs rdx, 0x65bb6946c4dfed62
mov qword [rsp + 0x24], rdx
movabs rdx, 0x7040708030a03
mov qword [rsp + 0x2c], rdx
movabs rdx, 0x4080d0400070407
mov qword [rsp + 0x30], rdx
movabs rdx, 0x209040508060406
mov qword [rsp + 0x38], rdx
xor eax, eax
nop
jmp 0x4813a0
movzx r9d, byte [rsp + rsi + 0x1d]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x79]
mov byte [rsp + rdi + 0x1d], dl
mov byte [rsp + rsi + 0x1d], r8b
add rax, 2
nop dword [rax]
cmp rax, 0x14
jge 0x4813d2
movzx edx, byte [rsp + rax + 0x2c]
movzx esi, byte [rsp + rax + 0x2d]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0xf
jae 0x4813f7
movzx r8d, byte [rsp + rdi + 0x1d]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x79]
cmp rsi, 0xf
jb 0x481382
jmp 0x4813eb
xor eax, eax
lea rbx, [rsp + 0x1d]
mov ecx, 0xf
nop
call fcn.0043b400
add rsp, 0x40
pop rbp
ret
mov eax, esi
mov ecx, 0xf
call fcn.00449a60
mov eax, edi
mov ecx, 0xf
nop
call fcn.00449a60
nop
call fcn.00447800
jmp fcn.00481320
Function at 0x4822a0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x48237d
push rbp
mov rbp, rsp
sub rsp, 0x38
movabs rdx, 0x591c36575b74655f
mov qword [rsp + 0x18], rdx
movabs rdx, 0x5a5a4f11534c591c
mov qword [rsp + 0x1e], rdx
movabs rdx, 0x9080c0b0604070a
mov qword [rsp + 0x26], rdx
movabs rdx, 0xd0309080c0b0604
mov qword [rsp + 0x28], rdx
movabs rdx, 0xa07030400050507
mov qword [rsp + 0x30], rdx
xor eax, eax
nop
jmp 0x482320
movzx r9d, byte [rsp + rsi + 0x18]
sub r9d, edx
lea edx, [r9 + 0x20]
mov byte [rsp + rdi + 0x18], dl
lea edx, [r8 + 0x20]
mov byte [rsp + rsi + 0x18], dl
add rax, 2
nop
cmp rax, 0x12
jge 0x48234d
movzx edx, byte [rsp + rax + 0x26]
movzx esi, byte [rsp + rax + 0x27]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0xe
jae 0x482370
movzx r8d, byte [rsp + rdi + 0x18]
sub r8d, edx
cmp rsi, 0xe
jb 0x482302
jmp 0x482364
xor eax, eax
lea rbx, [rsp + 0x18]
mov ecx, 0xe
call fcn.0043b400
add rsp, 0x38
pop rbp
ret
mov eax, esi
mov ecx, 0xe
call fcn.00449a60
mov eax, edi
mov ecx, 0xe
call fcn.00449a60
nop
nop dword [rax]
call fcn.00447800
jmp fcn.004822a0

Function at 0x4823a0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x48249d
push rbp
mov rbp, rsp
sub rsp, 0x48
movabs rdx, 0xc5f73f703b746547
mov qword [rsp + 0x1a], rdx
movabs rdx, 0xc8de7467c5f73f70
mov qword [rsp + 0x1e], rdx
movabs rdx, 0x57794b267ebb65e7
mov qword [rsp + 0x26], rdx
movabs rdx, 0xf1110040e0b0508
mov qword [rsp + 0x2e], rdx
movabs rdx, 0xf080408080b0304
mov qword [rsp + 0x36], rdx
movabs rdx, 0x80a0f080408080b
mov qword [rsp + 0x38], rdx
movabs rdx, 0x5110a0710060c0f
mov qword [rsp + 0x40], rdx
xor eax, eax
jmp 0x482440
movzx r9d, byte [rsp + rsi + 0x1a]
sub r9d, edx
lea edx, [r9 - 0x5e]
mov byte [rsp + rdi + 0x1a], dl
lea edx, [r8 - 0x5e]
mov byte [rsp + rsi + 0x1a], dl
add rax, 2
nop dword [rax]
cmp rax, 0x1a
jge 0x48246d
movzx edx, byte [rsp + rax + 0x2e]
movzx esi, byte [rsp + rax + 0x2f]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x14
jae 0x482490
movzx r8d, byte [rsp + rdi + 0x1a]
sub r8d, edx
cmp rsi, 0x14
jb 0x48241f
jmp 0x482484
xor eax, eax
lea rbx, [rsp + 0x1a]
mov ecx, 0x14
call fcn.0043b400
add rsp, 0x48
pop rbp
ret
mov eax, esi
mov ecx, 0x14
call fcn.00449a60
mov eax, edi
mov ecx, 0x14
call fcn.00449a60
nop
nop dword [rax]
call fcn.00447800
jmp fcn.004823a0
Function at 0x482d40
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x482e2a
push rbp
mov rbp, rsp
sub rsp, 0x48
movabs rdx, 0x49275f2b47746147
mov qword [rsp + 0x1e], rdx
movabs rdx, 0x513649275f2b4774
mov qword [rsp + 0x20], rdx
movabs rdx, 0x7673504e2c762b65
mov qword [rsp + 0x28], rdx
movabs rdx, 0x9080f0d03060b0b
mov qword [rsp + 0x30], rdx
movabs rdx, 0xf0e0c1107040e09
mov qword [rsp + 0x38], rdx
movabs rdx, 0xe050f110e010406
mov qword [rsp + 0x40], rdx
xor eax, eax
jmp 0x482dcd
movzx r9d, byte [rsp + rsi + 0x1e]
sub r9d, edx
lea edx, [r9 + 0x25]
mov byte [rsp + rdi + 0x1e], dl
lea edx, [r8 + 0x25]
mov byte [rsp + rsi + 0x1e], dl
add rax, 2
cmp rax, 0x18
jge 0x482dfa
movzx edx, byte [rsp + rax + 0x30]
movzx esi, byte [rsp + rax + 0x31]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x12
jae 0x482e1d
movzx r8d, byte [rsp + rdi + 0x1e]
sub r8d, edx
cmp rsi, 0x12
jb 0x482db0
jmp 0x482e11
xor eax, eax
lea rbx, [rsp + 0x1e]
mov ecx, 0x12
call fcn.0043b400
add rsp, 0x48
pop rbp
ret
mov eax, esi
mov ecx, 0x12
call fcn.00449a60
mov eax, edi
mov ecx, 0x12
call fcn.00449a60
nop
call fcn.00447800
jmp fcn.00482d40

Function at 0x488780
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x488852
push rbp
mov rbp, rsp
sub rsp, 0x38
movabs rdx, 0x4f735fcc7170effe
mov qword [rsp + 0x1b], rdx
movabs rdx, 0x65526974664f735f
mov qword [rsp + 0x20], rdx
movabs rdx, 0x600050b01060409
mov qword [rsp + 0x28], rdx
movabs rdx, 0x4040b0105000300
mov qword [rsp + 0x30], rdx
xor eax, eax
jmp 0x4887ec
movzx r9d, byte [rsp + rsi + 0x1b]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x6d]
mov byte [rsp + rdi + 0x1b], dl
mov byte [rsp + rsi + 0x1b], r8b
add rax, 2
cmp rax, 0x10
jge 0x48881e
movzx edx, byte [rsp + rax + 0x28]
movzx esi, byte [rsp + rax + 0x29]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0xd
jae 0x488845
movzx r8d, byte [rsp + rdi + 0x1b]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x6d]
cmp rsi, 0xd
jb 0x4887d2
jmp 0x488835
xor eax, eax
lea rbx, [rsp + 0x1b]
mov ecx, 0xd
call fcn.0043b400
add rsp, 0x38
pop rbp
ret
mov eax, esi
mov ecx, 0xd
nop dword [rax]
call fcn.00449a60
mov eax, edi
mov ecx, 0xd
call fcn.00449a60
nop
call fcn.00447800
jmp fcn.00488780