joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140085cc0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x140085df8
push rbp
mov rbp, rsp
sub rsp, 0x70
movabs rdx, 0x72dfd173d6d76374
mov qword [rsp + 0x4d], rdx
movabs rdx, 0x32351272dfd173d6
mov qword [rsp + 0x50], rdx
movabs rdx, 0x2074e2cfd23cafea
mov qword [rsp + 0x58], rdx
movabs rdx, 0x639f165ad6bf7369
mov qword [rsp + 0x60], rdx
movabs rdx, 0x64b1e3fbe0e66e95
mov qword [rsp + 0x68], rdx
movabs rdx, 0xc1b170101100118
mov qword [rsp + 0x1f], rdx
movabs rdx, 0xd1f0b181f09201f
mov qword [rsp + 0x27], rdx
movabs rdx, 0x171d1e0d0a010d1f
mov qword [rsp + 0x2d], rdx
movabs rdx, 0x806020f16031919
mov qword [rsp + 0x35], rdx
movabs rdx, 0x1b1e1f01200c0c10
mov qword [rsp + 0x3d], rdx
movabs rdx, 0x21061e10050e0b15
mov qword [rsp + 0x45], rdx
xor eax, eax
jmp 0x140085d95
movzx r9d, byte [rsp + rsi + 0x4d]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x6b]
mov byte [rsp + rdi + 0x4d], dl
mov byte [rsp + rsi + 0x4d], r8b
add rax, 2
cmp rax, 0x2e
jge 0x140085dc8
movzx edx, byte [rsp + rax + 0x1f]
movzx esi, byte [rsp + rax + 0x20]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x23
jae 0x140085deb
movzx r8d, byte [rsp + rdi + 0x4d]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x6b]
nop
cmp rsi, 0x23
jb 0x140085d7b
jmp 0x140085ddf
xor eax, eax
lea rbx, [rsp + 0x4d]
mov ecx, 0x23
call fcn.140046d40
add rsp, 0x70
pop rbp
ret
mov eax, esi
mov ecx, 0x23
call fcn.140059800
mov eax, edi
mov ecx, 0x23
call fcn.140059800
nop
call fcn.140057520
nop dword [rax]
jmp fcn.140085cc0

Function at 0x14008bf80
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x14008c04c
push rbp
mov rbp, rsp
sub rsp, 0x38
movabs rdx, 0x6c2f666672787977
mov qword [rsp + 0x2a], rdx
movabs rdx, 0x797870811d626c2f
mov qword [rsp + 0x30], rdx
movabs rdx, 0x4010b010c000b09
mov qword [rsp + 0x1c], rdx
movabs rdx, 0x80306090a080401
mov qword [rsp + 0x22], rdx
xor eax, eax
jmp 0x14008bfef
movzx r9d, byte [rsp + rsi + 0x2a]
sub r9d, edx
lea edx, [r9 + 0xa]
mov byte [rsp + rdi + 0x2a], dl
lea edx, [r8 + 0xa]
mov byte [rsp + rsi + 0x2a], dl
add rax, 2
cmp rax, 0xe
jge 0x14008c01c
movzx edx, byte [rsp + rax + 0x1c]
movzx esi, byte [rsp + rax + 0x1d]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0xe
jae 0x14008c03f
movzx r8d, byte [rsp + rdi + 0x2a]
sub r8d, edx
cmp rsi, 0xe
jb 0x14008bfd2
jmp 0x14008c033
xor eax, eax
lea rbx, [rsp + 0x2a]
mov ecx, 0xe
call fcn.140046d40
add rsp, 0x38
pop rbp
ret
mov eax, esi
mov ecx, 0xe
call fcn.140059800
mov eax, edi
mov ecx, 0xe
call fcn.140059800
nop
call fcn.140057520
jmp fcn.14008bf80
Function at 0x14008c9c0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x14008cac8
push rbp
mov rbp, rsp
sub rsp, 0x58
movabs rdx, 0x6c8daa6fb09e722d
mov qword [rsp + 0x3c], rdx
movabs rdx, 0x2072767669c4647d
mov qword [rsp + 0x44], rdx
movabs rdx, 0x95c9966e20727676
mov qword [rsp + 0x48], rdx
movabs rdx, 0x2f93dbcac0747461
mov qword [rsp + 0x50], rdx
movabs rdx, 0x20211181b130008
mov qword [rsp + 0x1e], rdx
movabs rdx, 0x190a0d0d0512111b
mov qword [rsp + 0x26], rdx
movabs rdx, 0x20a121a1b03190a
mov qword [rsp + 0x2c], rdx
movabs rdx, 0x6020519181b0617
mov qword [rsp + 0x34], rdx
xor eax, eax
jmp 0x14008ca6b
movzx r9d, byte [rsp + rsi + 0x3c]
sub r9d, edx
lea edx, [r9 - 5]
mov byte [rsp + rdi + 0x3c], dl
lea edx, [r8 - 5]
mov byte [rsp + rsi + 0x3c], dl
add rax, 2
cmp rax, 0x1e
jge 0x14008ca98
movzx edx, byte [rsp + rax + 0x1e]
movzx esi, byte [rsp + rax + 0x1f]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x1c
jae 0x14008cabb
movzx r8d, byte [rsp + rdi + 0x3c]
sub r8d, edx
cmp rsi, 0x1c
jb 0x14008ca4e
jmp 0x14008caaf
xor eax, eax
lea rbx, [rsp + 0x3c]
mov ecx, 0x1c
call fcn.140046d40
add rsp, 0x58
pop rbp
ret
mov eax, esi
mov ecx, 0x1c
call fcn.140059800
mov eax, edi
mov ecx, 0x1c
call fcn.140059800
nop
call fcn.140057520
jmp fcn.14008c9c0

Function at 0x14008cbe0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x14008ccfd
push rbp
mov rbp, rsp
sub rsp, 0x60
movabs rdx, 0x6563098ee2c9ddcc
mov qword [rsp + 0x40], rdx
movabs rdx, 0x28aa2bd2948a7435
mov qword [rsp + 0x48], rdx
movabs rdx, 0xdd36e4ce79826972
mov qword [rsp + 0x50], rdx
movabs rdx, 0xd1a8ef61e569b376
mov qword [rsp + 0x58], rdx
movabs rdx, 0x5051608040a191e
mov qword [rsp + 0x1c], rdx
movabs rdx, 0xb0a0f0e05051608
mov qword [rsp + 0x20], rdx
movabs rdx, 0xa161f0b0204050d
mov qword [rsp + 0x28], rdx
movabs rdx, 0x1502081f05160017
mov qword [rsp + 0x30], rdx
movabs rdx, 0x31d010c0e1b1214
mov qword [rsp + 0x38], rdx
xor eax, eax
jmp 0x14008cca0
movzx r9d, byte [rsp + rsi + 0x40]
sub r9d, edx
lea edx, [r9 - 0x40]
mov byte [rsp + rdi + 0x40], dl
lea edx, [r8 - 0x40]
mov byte [rsp + rsi + 0x40], dl
add rax, 2
nop word [rax + rax]
cmp rax, 0x24
jge 0x14008cccd
movzx edx, byte [rsp + rax + 0x1c]
movzx esi, byte [rsp + rax + 0x1d]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x20
jae 0x14008ccf0
movzx r8d, byte [rsp + rdi + 0x40]
sub r8d, edx
cmp rsi, 0x20
jb 0x14008cc7d
jmp 0x14008cce4
xor eax, eax
lea rbx, [rsp + 0x40]
mov ecx, 0x20
call fcn.140046d40
add rsp, 0x60
pop rbp
ret
mov eax, esi
mov ecx, 0x20
call fcn.140059800
mov eax, edi
mov ecx, 0x20
call fcn.140059800
nop
nop dword [rax]
call fcn.140057520
jmp fcn.14008cbe0
Function at 0x14008cd20
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x14008ce3d
push rbp
mov rbp, rsp
sub rsp, 0x58
movabs rdx, 0x49ba4d7ead6e10
mov qword [rsp + 0x3f], rdx
movabs rdx, 0x6509287fca247263
mov qword [rsp + 0x47], rdx
movabs rdx, 0xc46509287fca2472
mov qword [rsp + 0x48], rdx
movabs rdx, 0x6b6eb213bed36389
mov qword [rsp + 0x50], rdx
movabs rdx, 0xe130d06140407
mov qword [rsp + 0x1d], rdx
movabs rdx, 0x140d000e130d0614
mov qword [rsp + 0x1f], rdx
movabs rdx, 0x16150c130d060502
mov qword [rsp + 0x27], rdx
movabs rdx, 0x10000a0003140714
mov qword [rsp + 0x2f], rdx
movabs rdx, 0x11070b0e1604130b
mov qword [rsp + 0x37], rdx
xor eax, eax
jmp 0x14008cde0
movzx r9d, byte [rsp + rsi + 0x3f]
sub r9d, edx
lea edx, [r9 - 0x33]
mov byte [rsp + rdi + 0x3f], dl
lea edx, [r8 - 0x33]
mov byte [rsp + rsi + 0x3f], dl
add rax, 2
nop word [rax + rax]
cmp rax, 0x22
jge 0x14008ce0d
movzx edx, byte [rsp + rax + 0x1d]
movzx esi, byte [rsp + rax + 0x1e]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x19
jae 0x14008ce30
movzx r8d, byte [rsp + rdi + 0x3f]
sub r8d, edx
cmp rsi, 0x19
jb 0x14008cdbd
jmp 0x14008ce24
xor eax, eax
lea rbx, [rsp + 0x3f]
mov ecx, 0x19
call fcn.140046d40
add rsp, 0x58
pop rbp
ret
mov eax, esi
mov ecx, 0x19
call fcn.140059800
mov eax, edi
mov ecx, 0x19
call fcn.140059800
nop
nop dword [rax]
call fcn.140057520
jmp fcn.14008cd20

Function at 0x140094580
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x14009468c
push rbp
mov rbp, rsp
sub rsp, 0x50
movabs rdx, 0x65c824467480cd43
mov qword [rsp + 0x36], rdx
movabs rdx, 0xbeb5dd697472c743
mov qword [rsp + 0x3e], rdx
movabs rdx, 0x74d8beb5dd697472
mov qword [rsp + 0x40], rdx
movabs rdx, 0xcbe7b9941bf1d2c7
mov qword [rsp + 0x48], rdx
movabs rdx, 0xd190d0d12091614
mov qword [rsp + 0x1a], rdx
movabs rdx, 0x1302150119021405
mov qword [rsp + 0x22], rdx
movabs rdx, 0x1019181813021501
mov qword [rsp + 0x26], rdx
movabs rdx, 0x510010f0e170614
mov qword [rsp + 0x2e], rdx
xor eax, eax
jmp 0x140094628
movzx r9d, byte [rsp + rsi + 0x36]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x7f]
mov byte [rsp + rdi + 0x36], dl
mov byte [rsp + rsi + 0x36], r8b
add rax, 2
cmp rax, 0x1c
jge 0x14009465c
movzx edx, byte [rsp + rax + 0x1a]
movzx esi, byte [rsp + rax + 0x1b]
mov edi, edx
xor edx, esi
add edx, eax
nop
cmp rdi, 0x1a
jae 0x14009467f
movzx r8d, byte [rsp + rdi + 0x36]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x7f]
cmp rsi, 0x1a
jb 0x14009460e
jmp 0x140094673
xor eax, eax
lea rbx, [rsp + 0x36]
mov ecx, 0x1a
call fcn.140046d40
add rsp, 0x50
pop rbp
ret
mov eax, esi
mov ecx, 0x1a
call fcn.140059800
mov eax, edi
mov ecx, 0x1a
call fcn.140059800
nop
call fcn.140057520
jmp fcn.140094580
Function at 0x140097520
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x14009760c
push rbp
mov rbp, rsp
sub rsp, 0x40
movabs rdx, 0xe8f3652537654fd8
mov qword [rsp + 0x2d], rdx
movabs rdx, 0x80626de8f3652537
mov qword [rsp + 0x30], rdx
movabs rdx, 0x57c06edde8f3f76c
mov qword [rsp + 0x38], rdx
movabs rdx, 0x601070c0d0f0c0a
mov qword [rsp + 0x19], rdx
movabs rdx, 0x1106060d0601070c
mov qword [rsp + 0x1d], rdx
movabs rdx, 0xe000e040003000d
mov qword [rsp + 0x25], rdx
xor eax, eax
jmp 0x1400975aa
movzx r9d, byte [rsp + rsi + 0x2d]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x72]
mov byte [rsp + rdi + 0x2d], dl
mov byte [rsp + rsi + 0x2d], r8b
add rax, 2
cmp rax, 0x14
jge 0x1400975dc
movzx edx, byte [rsp + rax + 0x19]
movzx esi, byte [rsp + rax + 0x1a]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x13
jae 0x1400975ff
movzx r8d, byte [rsp + rdi + 0x2d]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x72]
cmp rsi, 0x13
jb 0x140097590
jmp 0x1400975f3
xor eax, eax
lea rbx, [rsp + 0x2d]
mov ecx, 0x13
call fcn.140046d40
add rsp, 0x40
pop rbp
ret
mov eax, esi
mov ecx, 0x13
call fcn.140059800
mov eax, edi
mov ecx, 0x13
call fcn.140059800
nop
call fcn.140057520
jmp fcn.140097520

Function at 0x14009a1c0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x14009a2bd
push rbp
mov rbp, rsp
sub rsp, 0x48
movabs rdx, 0x65b072752b056527
mov qword [rsp + 0x34], rdx
movabs rdx, 0x694462b865b07275
mov qword [rsp + 0x38], rdx
movabs rdx, 0xe2ea30fffad665de
mov qword [rsp + 0x40], rdx
movabs rdx, 0x30c001013111109
mov qword [rsp + 0x1a], rdx
movabs rdx, 0x2130e020306080f
mov qword [rsp + 0x22], rdx
movabs rdx, 0x120e02130e020306
mov qword [rsp + 0x24], rdx
movabs rdx, 0x1108020f110e0f03
mov qword [rsp + 0x2c], rdx
xor eax, eax
jmp 0x14009a260
movzx r9d, byte [rsp + rsi + 0x34]
sub r9d, edx
lea edx, [r9 + 0x5c]
mov byte [rsp + rdi + 0x34], dl
lea edx, [r8 + 0x5c]
mov byte [rsp + rsi + 0x34], dl
add rax, 2
nop dword [rax]
cmp rax, 0x1a
jge 0x14009a28d
movzx edx, byte [rsp + rax + 0x1a]
movzx esi, byte [rsp + rax + 0x1b]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x14
jae 0x14009a2b0
movzx r8d, byte [rsp + rdi + 0x34]
sub r8d, edx
cmp rsi, 0x14
jb 0x14009a23f
jmp 0x14009a2a4
xor eax, eax
lea rbx, [rsp + 0x34]
mov ecx, 0x14
call fcn.140046d40
add rsp, 0x48
pop rbp
ret
mov eax, esi
mov ecx, 0x14
call fcn.140059800
mov eax, edi
mov ecx, 0x14
call fcn.140059800
nop
nop dword [rax]
call fcn.140057520
jmp fcn.14009a1c0
Function at 0x14009ac40
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x14009ad2a
push rbp
mov rbp, rsp
sub rsp, 0x48
movabs rdx, 0x72221f4e60586547
mov qword [rsp + 0x31], rdx
movabs rdx, 0x56496e426d3f4472
mov qword [rsp + 0x38], rdx
movabs rdx, 0x4a356c67053e5846
mov qword [rsp + 0x40], rdx
movabs rdx, 0x16080d110d050512
mov qword [rsp + 0x19], rdx
movabs rdx, 0x12040d1315120909
mov qword [rsp + 0x21], rdx
movabs rdx, 0x8020b0f10031006
mov qword [rsp + 0x29], rdx
xor eax, eax
jmp 0x14009accd
movzx r9d, byte [rsp + rsi + 0x31]
sub r9d, edx
lea edx, [r9 + 0x37]
mov byte [rsp + rdi + 0x31], dl
lea edx, [r8 + 0x37]
mov byte [rsp + rsi + 0x31], dl
add rax, 2
cmp rax, 0x18
jge 0x14009acfa
movzx edx, byte [rsp + rax + 0x19]
movzx esi, byte [rsp + rax + 0x1a]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x17
jae 0x14009ad1d
movzx r8d, byte [rsp + rdi + 0x31]
sub r8d, edx
cmp rsi, 0x17
jb 0x14009acb0
jmp 0x14009ad11
xor eax, eax
lea rbx, [rsp + 0x31]
mov ecx, 0x17
call fcn.140046d40
add rsp, 0x48
pop rbp
ret
mov eax, esi
mov ecx, 0x17
call fcn.140059800
mov eax, edi
mov ecx, 0x17
call fcn.140059800
nop
call fcn.140057520
jmp fcn.14009ac40

Function at 0x14009c820
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x14009c8e7
push rbp
mov rbp, rsp
sub rsp, 0x38
movabs rdx, 0x582c4e3b4e593547
mov qword [rsp + 0x2c], rdx
mov dword [rsp + 0x34], 0x4d4f642f
movabs rdx, 0x9060a0b040b0a08
mov qword [rsp + 0x1c], rdx
movabs rdx, 0x709010302020705
mov qword [rsp + 0x24], rdx
xor eax, eax
jmp 0x14009c888
movzx r9d, byte [rsp + rsi + 0x2c]
sub r9d, edx
lea edx, [r9 + 0x25]
mov byte [rsp + rdi + 0x2c], dl
lea edx, [r8 + 0x25]
mov byte [rsp + rsi + 0x2c], dl
add rax, 2
cmp rax, 0x10
jge 0x14009c8b7
movzx edx, byte [rsp + rax + 0x1c]
movzx esi, byte [rsp + rax + 0x1d]
mov edi, edx
xor edx, esi
add edx, eax
nop
cmp rdi, 0xc
jae 0x14009c8da
movzx r8d, byte [rsp + rdi + 0x2c]
sub r8d, edx
cmp rsi, 0xc
jb 0x14009c86b
jmp 0x14009c8ce
xor eax, eax
lea rbx, [rsp + 0x2c]
mov ecx, 0xc
call fcn.140046d40
add rsp, 0x38
pop rbp
ret
mov eax, esi
mov ecx, 0xc
call fcn.140059800
mov eax, edi
mov ecx, 0xc
call fcn.140059800
nop
call fcn.140057520
jmp fcn.14009c820
Function at 0x14009cf20
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x14009cff2
push rbp
mov rbp, rsp
sub rsp, 0x38
movabs rdx, 0xa18c6fce9f73659d
mov qword [rsp + 0x2a], rdx
movabs rdx, 0xa6d465e6baafa18c
mov qword [rsp + 0x30], rdx
movabs rdx, 0xd08040d080a0306
mov qword [rsp + 0x1a], rdx
movabs rdx, 0x90009000207070c
mov qword [rsp + 0x22], rdx
xor eax, eax
jmp 0x14009cf8c
movzx r9d, byte [rsp + rsi + 0x2a]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x41]
mov byte [rsp + rdi + 0x2a], dl
mov byte [rsp + rsi + 0x2a], r8b
add rax, 2
cmp rax, 0x10
jge 0x14009cfbe
movzx edx, byte [rsp + rax + 0x1a]
movzx esi, byte [rsp + rax + 0x1b]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0xe
jae 0x14009cfe5
movzx r8d, byte [rsp + rdi + 0x2a]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x41]
cmp rsi, 0xe
jb 0x14009cf72
jmp 0x14009cfd5
xor eax, eax
lea rbx, [rsp + 0x2a]
mov ecx, 0xe
call fcn.140046d40
add rsp, 0x38
pop rbp
ret
mov eax, esi
mov ecx, 0xe
nop dword [rax]
call fcn.140059800
mov eax, edi
mov ecx, 0xe
call fcn.140059800
nop
call fcn.140057520
jmp fcn.14009cf20

Function at 0x14009dfc0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x14009e0aa
push rbp
mov rbp, rsp
sub rsp, 0x48
movabs rdx, 0xe74e903f274d00a
mov qword [rsp + 0x31], rdx
movabs rdx, 0x7325106d69311f0e
mov qword [rsp + 0x38], rdx
movabs rdx, 0x4beb69541d6cc93c
mov qword [rsp + 0x40], rdx
movabs rdx, 0x10d09050c100c03
mov qword [rsp + 0x19], rdx
movabs rdx, 0xd000f1209070c08
mov qword [rsp + 0x21], rdx
movabs rdx, 0x915040916081504
mov qword [rsp + 0x29], rdx
xor eax, eax
jmp 0x14009e04d
movzx r9d, byte [rsp + rsi + 0x31]
sub r9d, edx
lea edx, [r9 + 0x52]
mov byte [rsp + rdi + 0x31], dl
lea edx, [r8 + 0x52]
mov byte [rsp + rsi + 0x31], dl
add rax, 2
cmp rax, 0x18
jge 0x14009e07a
movzx edx, byte [rsp + rax + 0x19]
movzx esi, byte [rsp + rax + 0x1a]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x17
jae 0x14009e09d
movzx r8d, byte [rsp + rdi + 0x31]
sub r8d, edx
cmp rsi, 0x17
jb 0x14009e030
jmp 0x14009e091
xor eax, eax
lea rbx, [rsp + 0x31]
mov ecx, 0x17
call fcn.140046d40
add rsp, 0x48
pop rbp
ret
mov eax, esi
mov ecx, 0x17
call fcn.140059800
mov eax, edi
mov ecx, 0x17
call fcn.140059800
nop
call fcn.140057520
jmp fcn.14009dfc0
Function at 0x14009f180
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x14009f247
push rbp
mov rbp, rsp
sub rsp, 0x38
movabs rdx, 0x8b620e7377d8fc91
mov qword [rsp + 0x2c], rdx
mov dword [rsp + 0x34], 0x5786f661
movabs rdx, 0x50a07010400070a
mov qword [rsp + 0x1e], rdx
movabs rdx, 0x90400020309050a
mov qword [rsp + 0x24], rdx
xor eax, eax
jmp 0x14009f1e8
movzx r9d, byte [rsp + rsi + 0x2c]
sub r9d, edx
lea edx, [r9 - 0x80]
mov byte [rsp + rdi + 0x2c], dl
lea edx, [r8 - 0x80]
mov byte [rsp + rsi + 0x2c], dl
add rax, 2
cmp rax, 0xe
jge 0x14009f217
movzx edx, byte [rsp + rax + 0x1e]
movzx esi, byte [rsp + rax + 0x1f]
mov edi, edx
xor edx, esi
add edx, eax
nop
cmp rdi, 0xc
jae 0x14009f23a
movzx r8d, byte [rsp + rdi + 0x2c]
sub r8d, edx
cmp rsi, 0xc
jb 0x14009f1cb
jmp 0x14009f22e
xor eax, eax
lea rbx, [rsp + 0x2c]
mov ecx, 0xc
call fcn.140046d40
add rsp, 0x38
pop rbp
ret
mov eax, esi
mov ecx, 0xc
call fcn.140059800
mov eax, edi
mov ecx, 0xc
call fcn.140059800
nop
call fcn.140057520
jmp fcn.14009f180

Function at 0x1400a0e80
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x1400a0f47
push rbp
mov rbp, rsp
sub rsp, 0x38
movabs rdx, 0xff10f11664b4582b
mov qword [rsp + 0x2c], rdx
mov dword [rsp + 0x34], 0xb365140d
movabs rdx, 0x6050b0700050102
mov qword [rsp + 0x1c], rdx
movabs rdx, 0x604080902080107
mov qword [rsp + 0x24], rdx
xor eax, eax
jmp 0x1400a0ee8
movzx r9d, byte [rsp + rsi + 0x2c]
sub r9d, edx
lea edx, [r9 + 0x68]
mov byte [rsp + rdi + 0x2c], dl
lea edx, [r8 + 0x68]
mov byte [rsp + rsi + 0x2c], dl
add rax, 2
cmp rax, 0x10
jge 0x1400a0f17
movzx edx, byte [rsp + rax + 0x1c]
movzx esi, byte [rsp + rax + 0x1d]
mov edi, edx
xor edx, esi
add edx, eax
nop
cmp rdi, 0xc
jae 0x1400a0f3a
movzx r8d, byte [rsp + rdi + 0x2c]
sub r8d, edx
cmp rsi, 0xc
jb 0x1400a0ecb
jmp 0x1400a0f2e
xor eax, eax
lea rbx, [rsp + 0x2c]
mov ecx, 0xc
call fcn.140046d40
add rsp, 0x38
pop rbp
ret
mov eax, esi
mov ecx, 0xc
call fcn.140059800
mov eax, edi
mov ecx, 0xc
call fcn.140059800
nop
call fcn.140057520
jmp fcn.1400a0e80
Function at 0x1400a30a0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x1400a319b
push rbp
mov rbp, rsp
sub rsp, 0x50
movabs rdx, 0x1ceb1c4804232553
mov qword [rsp + 0x3c], rdx
movabs rdx, 0x332c413a1ceb1c48
mov qword [rsp + 0x40], rdx
movabs rdx, 0x3b05f4d3ac6d7236
mov qword [rsp + 0x48], rdx
movabs rdx, 0x109060f10021213
mov qword [rsp + 0x1e], rdx
movabs rdx, 0x60c0a1110120305
mov qword [rsp + 0x26], rdx
movabs rdx, 0xb0f07030402060c
mov qword [rsp + 0x2c], rdx
movabs rdx, 0xa080b0513040c0b
mov qword [rsp + 0x34], rdx
xor eax, eax
jmp 0x1400a3139
movzx r9d, byte [rsp + rsi + 0x3c]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x16]
mov byte [rsp + rdi + 0x3c], dl
mov byte [rsp + rsi + 0x3c], r8b
add rax, 2
cmp rax, 0x1e
jge 0x1400a316b
movzx edx, byte [rsp + rax + 0x1e]
movzx esi, byte [rsp + rax + 0x1f]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x14
jae 0x1400a318e
movzx r8d, byte [rsp + rdi + 0x3c]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x16]
cmp rsi, 0x14
jb 0x1400a311f
jmp 0x1400a3182
xor eax, eax
lea rbx, [rsp + 0x3c]
mov ecx, 0x14
call fcn.140046d40
add rsp, 0x50
pop rbp
ret
mov eax, esi
mov ecx, 0x14
call fcn.140059800
mov eax, edi
mov ecx, 0x14
call fcn.140059800
nop
nop dword [rax + rax]
call fcn.140057520
jmp fcn.1400a30a0

Function at 0x1400a3800
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x1400a38dd
push rbp
mov rbp, rsp
sub rsp, 0x40
movabs rdx, 0x45d7a4702a6d6e55
mov qword [rsp + 0x31], rdx
movabs rdx, 0x65b0692f8e4ff945
mov qword [rsp + 0x38], rdx
movabs rdx, 0xd0b0a030d0a0506
mov qword [rsp + 0x1f], rdx
movabs rdx, 0x8070d0b0a030d0a
mov qword [rsp + 0x21], rdx
movabs rdx, 0x5050b0b07030706
mov qword [rsp + 0x29], rdx
xor eax, eax
nop
jmp 0x1400a3880
movzx r9d, byte [rsp + rsi + 0x31]
sub r9d, edx
lea edx, [r9 + 0x49]
mov byte [rsp + rdi + 0x31], dl
lea edx, [r8 + 0x49]
mov byte [rsp + rsi + 0x31], dl
add rax, 2
nop
cmp rax, 0x12
jge 0x1400a38ad
movzx edx, byte [rsp + rax + 0x1f]
movzx esi, byte [rsp + rax + 0x20]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0xf
jae 0x1400a38d0
movzx r8d, byte [rsp + rdi + 0x31]
sub r8d, edx
cmp rsi, 0xf
jb 0x1400a3862
jmp 0x1400a38c4
xor eax, eax
lea rbx, [rsp + 0x31]
mov ecx, 0xf
call fcn.140046d40
add rsp, 0x40
pop rbp
ret
mov eax, esi
mov ecx, 0xf
call fcn.140059800
mov eax, edi
mov ecx, 0xf
call fcn.140059800
nop
nop dword [rax]
call fcn.140057520
jmp fcn.1400a3800
Function at 0x1400a4f60
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x1400a504a
push rbp
mov rbp, rsp
sub rsp, 0x40
movabs rdx, 0x3114d02c0d050ec2
mov qword [rsp + 0x2c], rdx
movabs rdx, 0xe578f3253114d02c
mov qword [rsp + 0x30], rdx
movabs rdx, 0xa772f264616b636f
mov qword [rsp + 0x38], rdx
movabs rdx, 0x90b060200110107
mov qword [rsp + 0x18], rdx
movabs rdx, 0x4131105090b0602
mov qword [rsp + 0x1c], rdx
movabs rdx, 0x303081103010411
mov qword [rsp + 0x24], rdx
xor eax, eax
jmp 0x1400a4fed
movzx r9d, byte [rsp + rsi + 0x2c]
sub r9d, edx
lea edx, [r9 + 0x68]
mov byte [rsp + rdi + 0x2c], dl
lea edx, [r8 + 0x68]
mov byte [rsp + rsi + 0x2c], dl
add rax, 2
cmp rax, 0x14
jge 0x1400a501a
movzx edx, byte [rsp + rax + 0x18]
movzx esi, byte [rsp + rax + 0x19]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x14
jae 0x1400a503d
movzx r8d, byte [rsp + rdi + 0x2c]
sub r8d, edx
cmp rsi, 0x14
jb 0x1400a4fd0
jmp 0x1400a5031
xor eax, eax
lea rbx, [rsp + 0x2c]
mov ecx, 0x14
call fcn.140046d40
add rsp, 0x40
pop rbp
ret
mov eax, esi
mov ecx, 0x14
call fcn.140059800
mov eax, edi
mov ecx, 0x14
call fcn.140059800
nop
call fcn.140057520
jmp fcn.1400a4f60

Function at 0x1400a75e0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x1400a7698
push rbp
mov rbp, rsp
sub rsp, 0x30
movabs rdx, 0x6cd26a9680b35372
mov qword [rsp + 0x28], rdx
movabs rdx, 0x505050206040206
mov qword [rsp + 0x1e], rdx
mov word [rsp + 0x26], 3
xor eax, eax
jmp 0x1400a7638
movzx r9d, byte [rsp + rsi + 0x28]
sub r9d, edx
lea edx, [r9 - 0x1e]
mov byte [rsp + rdi + 0x28], dl
lea edx, [r8 - 0x1e]
mov byte [rsp + rsi + 0x28], dl
add rax, 2
cmp rax, 0xa
jge 0x1400a7668
movzx edx, byte [rsp + rax + 0x1e]
movzx esi, byte [rsp + rax + 0x1f]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 8
jae 0x1400a768b
movzx r8d, byte [rsp + rdi + 0x28]
sub r8d, edx
nop dword [rax]
cmp rsi, 8
jb 0x1400a761b
jmp 0x1400a767f
xor eax, eax
lea rbx, [rsp + 0x28]
mov ecx, 8
call fcn.140046d40
add rsp, 0x30
pop rbp
ret
mov eax, esi
mov ecx, 8
call fcn.140059800
mov eax, edi
mov ecx, 8
call fcn.140059800
nop
call fcn.140057520
nop dword [rax]
jmp fcn.1400a75e0
Function at 0x1400a88a0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x1400a8986
push rbp
mov rbp, rsp
sub rsp, 0x40
movabs rdx, 0x23ae6fbd2c37f12b
mov qword [rsp + 0x32], rdx
movabs rdx, 0x3efef96eb96223ae
mov qword [rsp + 0x38], rdx
movabs rdx, 0x1040901060c0b03
mov qword [rsp + 0x1e], rdx
movabs rdx, 0xd09030101040901
mov qword [rsp + 0x22], rdx
movabs rdx, 0x3040700040c0602
mov qword [rsp + 0x2a], rdx
xor eax, eax
nop
jmp 0x1400a8920
movzx r9d, byte [rsp + rsi + 0x32]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x2d]
mov byte [rsp + rdi + 0x32], dl
mov byte [rsp + rsi + 0x32], r8b
add rax, 2
nop dword [rax]
cmp rax, 0x14
jge 0x1400a8952
movzx edx, byte [rsp + rax + 0x1e]
movzx esi, byte [rsp + rax + 0x1f]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0xe
jae 0x1400a8977
movzx r8d, byte [rsp + rdi + 0x32]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x2d]
cmp rsi, 0xe
jb 0x1400a8902
jmp 0x1400a896b
xor eax, eax
lea rbx, [rsp + 0x32]
mov ecx, 0xe
nop
call fcn.140046d40
add rsp, 0x40
pop rbp
ret
mov eax, esi
mov ecx, 0xe
call fcn.140059800
mov eax, edi
mov ecx, 0xe
nop
call fcn.140059800
nop
call fcn.140057520
jmp fcn.1400a88a0

Function at 0x1400aa160
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x1400aa22a
push rbp
mov rbp, rsp
sub rsp, 0x48
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rbx
mov qword [rsp], rax
mov qword [rsp + 8], rbx
mov byte [rsp + 0x10], 0
call fcn.140003760
xorps xmm15, xmm15
mov r14, qword [0x1402dbe20]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x18], 0xffffffffffffffff
jne 0x1400aa20f
mov rcx, qword [rsp + 0x60]
lea rdx, [rcx + 1]
mov qword [rsp + 0x40], rdx
lea rax, [0x140184060]
xor ebx, ebx
mov rcx, rdx
call fcn.140043860
mov rbx, qword [rsp + 0x60]
mov rcx, rax
xor edi, edi
mov rsi, qword [rsp + 0x40]
mov rax, qword [rsp + 0x58]
nop dword [rax]
call fcn.1400aa620
inc rbx
cmp rcx, rbx
jae 0x1400aa1fe
mov edi, 1
lea rsi, [0x140184060]
call fcn.140043940
mov word [rax + rbx*2 - 2], 0
xor edi, edi
xor esi, esi
add rsp, 0x48
pop rbp
ret
xor eax, eax
xor ebx, ebx
mov rcx, rbx
lea rdi, [0x1401cafc0]
lea rsi, [0x1401cabe0]
add rsp, 0x48
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.140057520
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.1400aa160