joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4673c0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x467478
push rbp
mov rbp, rsp
sub rsp, 0x30
movabs rdx, 0xfe6169cf03360747
mov qword [rsp + 0x28], rdx
movabs rdx, 0x304010704020402
mov qword [rsp + 0x1e], rdx
mov word [rsp + 0x26], 0x203
xor eax, eax
jmp 0x467418
movzx r9d, byte [rsp + rsi + 0x28]
sub r9d, edx
lea edx, [r9 + 0x71]
mov byte [rsp + rdi + 0x28], dl
lea edx, [r8 + 0x71]
mov byte [rsp + rsi + 0x28], dl
add rax, 2
cmp rax, 0xa
jge 0x467448
movzx edx, byte [rsp + rax + 0x1e]
movzx esi, byte [rsp + rax + 0x1f]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 8
jae 0x46746b
movzx r8d, byte [rsp + rdi + 0x28]
sub r8d, edx
nop dword [rax]
cmp rsi, 8
jb 0x4673fb
jmp 0x46745f
xor eax, eax
lea rbx, [rsp + 0x28]
mov ecx, 8
call fcn.00444780
add rsp, 0x30
pop rbp
ret
mov eax, esi
mov ecx, 8
call fcn.00456420
mov eax, edi
mov ecx, 8
call fcn.00456420
nop
call fcn.00454140
nop dword [rax]
jmp fcn.004673c0

Function at 0x467b40
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x467bf8
push rbp
mov rbp, rsp
sub rsp, 0x30
movabs rdx, 0x7568676678726f47
mov qword [rsp + 0x28], rdx
movabs rdx, 0x304010704010505
mov qword [rsp + 0x1e], rdx
mov word [rsp + 0x26], 0x503
xor eax, eax
jmp 0x467b98
movzx r9d, byte [rsp + rsi + 0x28]
sub r9d, edx
lea edx, [r9 + 0xa]
mov byte [rsp + rdi + 0x28], dl
lea edx, [r8 + 0xa]
mov byte [rsp + rsi + 0x28], dl
add rax, 2
cmp rax, 0xa
jge 0x467bc8
movzx edx, byte [rsp + rax + 0x1e]
movzx esi, byte [rsp + rax + 0x1f]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 8
jae 0x467beb
movzx r8d, byte [rsp + rdi + 0x28]
sub r8d, edx
nop dword [rax]
cmp rsi, 8
jb 0x467b7b
jmp 0x467bdf
xor eax, eax
lea rbx, [rsp + 0x28]
mov ecx, 8
call fcn.00444780
add rsp, 0x30
pop rbp
ret
mov eax, esi
mov ecx, 8
call fcn.00456420
mov eax, edi
mov ecx, 8
call fcn.00456420
nop
call fcn.00454140
nop dword [rax]
jmp fcn.00467b40

Function at 0x4689a0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x468a58
push rbp
mov rbp, rsp
sub rsp, 0x30
movabs rdx, 0x3bc2b76ba7e161f0
mov qword [rsp + 0x28], rdx
movabs rdx, 0x605060000070206
mov qword [rsp + 0x1e], rdx
mov word [rsp + 0x26], 0x307
xor eax, eax
jmp 0x4689f5
movzx r9d, byte [rsp + rsi + 0x28]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x52]
mov byte [rsp + rdi + 0x28], dl
mov byte [rsp + rsi + 0x28], r8b
add rax, 2
cmp rax, 0xa
jge 0x468a28
movzx edx, byte [rsp + rax + 0x1e]
movzx esi, byte [rsp + rax + 0x1f]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 8
jae 0x468a4b
movzx r8d, byte [rsp + rdi + 0x28]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x52]
nop
cmp rsi, 8
jb 0x4689db
jmp 0x468a3f
xor eax, eax
lea rbx, [rsp + 0x28]
mov ecx, 8
call fcn.00444780
add rsp, 0x30
pop rbp
ret
mov eax, esi
mov ecx, 8
call fcn.00456420
mov eax, edi
mov ecx, 8
call fcn.00456420
nop
call fcn.00454140
nop dword [rax]
jmp fcn.004689a0
Function at 0x4697e0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x46989d
push rbp
mov rbp, rsp
sub rsp, 0x30
movabs rdx, 0xa46177eb8675e2df
mov qword [rsp + 0x27], rdx
mov byte [rsp + 0x2f], 0xa1
movabs rdx, 0x108030001010408
mov qword [rsp + 0x1d], rdx
mov word [rsp + 0x25], 0x307
xor eax, eax
nop
jmp 0x469840
movzx r9d, byte [rsp + rsi + 0x27]
sub r9d, edx
lea edx, [r9 - 0x34]
mov byte [rsp + rdi + 0x27], dl
lea edx, [r8 - 0x34]
mov byte [rsp + rsi + 0x27], dl
add rax, 2
nop
cmp rax, 0xa
jge 0x46986d
movzx edx, byte [rsp + rax + 0x1d]
movzx esi, byte [rsp + rax + 0x1e]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 9
jae 0x469890
movzx r8d, byte [rsp + rdi + 0x27]
sub r8d, edx
cmp rsi, 9
jb 0x469822
jmp 0x469884
xor eax, eax
lea rbx, [rsp + 0x27]
mov ecx, 9
call fcn.00444780
add rsp, 0x30
pop rbp
ret
mov eax, esi
mov ecx, 9
call fcn.00456420
mov eax, edi
mov ecx, 9
call fcn.00456420
nop
nop dword [rax]
call fcn.00454140
jmp fcn.004697e0

Function at 0x46a1e0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x46a2c6
push rbp
mov rbp, rsp
sub rsp, 0x38
movabs rdx, 0xedebeb6ce2d6004d
mov qword [rsp + 0x2b], rdx
movabs rdx, 0xdaec6e6f47edebeb
mov qword [rsp + 0x30], rdx
movabs rdx, 0x6040507040a010a
mov qword [rsp + 0x19], rdx
movabs rdx, 0x20406040507040a
mov qword [rsp + 0x1b], rdx
movabs rdx, 0x20b0a01040a030c
mov qword [rsp + 0x23], rdx
xor eax, eax
nop
jmp 0x46a260
movzx r9d, byte [rsp + rsi + 0x2b]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x6e]
mov byte [rsp + rdi + 0x2b], dl
mov byte [rsp + rsi + 0x2b], r8b
add rax, 2
nop dword [rax]
cmp rax, 0x12
jge 0x46a292
movzx edx, byte [rsp + rax + 0x19]
movzx esi, byte [rsp + rax + 0x1a]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0xd
jae 0x46a2b7
movzx r8d, byte [rsp + rdi + 0x2b]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x6e]
cmp rsi, 0xd
jb 0x46a242
jmp 0x46a2ab
xor eax, eax
lea rbx, [rsp + 0x2b]
mov ecx, 0xd
nop
call fcn.00444780
add rsp, 0x38
pop rbp
ret
mov eax, esi
mov ecx, 0xd
call fcn.00456420
mov eax, edi
mov ecx, 0xd
nop
call fcn.00456420
nop
call fcn.00454140
jmp fcn.0046a1e0
Function at 0x46be40
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x46bf2c
push rbp
mov rbp, rsp
sub rsp, 0x48
movabs rdx, 0x676e1511b3a3c312
mov qword [rsp + 0x32], rdx
movabs rdx, 0x689a7af75098676e
mov qword [rsp + 0x38], rdx
movabs rdx, 0x15fe6faf48ef6512
mov qword [rsp + 0x40], rdx
movabs rdx, 0xe0c050202010304
mov qword [rsp + 0x1c], rdx
movabs rdx, 0xe00150412150e0c
mov qword [rsp + 0x22], rdx
movabs rdx, 0x10010810140a100b
mov qword [rsp + 0x2a], rdx
xor eax, eax
jmp 0x46beca
movzx r9d, byte [rsp + rsi + 0x32]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x49]
mov byte [rsp + rdi + 0x32], dl
mov byte [rsp + rsi + 0x32], r8b
add rax, 2
cmp rax, 0x16
jge 0x46befc
movzx edx, byte [rsp + rax + 0x1c]
movzx esi, byte [rsp + rax + 0x1d]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x16
jae 0x46bf1f
movzx r8d, byte [rsp + rdi + 0x32]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x49]
cmp rsi, 0x16
jb 0x46beb0
jmp 0x46bf13
xor eax, eax
lea rbx, [rsp + 0x32]
mov ecx, 0x16
call fcn.00444780
add rsp, 0x48
pop rbp
ret
mov eax, esi
mov ecx, 0x16
call fcn.00456420
mov eax, edi
mov ecx, 0x16
call fcn.00456420
nop
call fcn.00454140
jmp fcn.0046be40

Function at 0x46db60
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x46dc1d
push rbp
mov rbp, rsp
sub rsp, 0x30
movabs rdx, 0xc06779395fc4c90d
mov qword [rsp + 0x26], rdx
mov word [rsp + 0x2e], 0xb943
movabs rdx, 0x101040404000207
mov qword [rsp + 0x1a], rdx
mov dword [rsp + 0x22], 0x90800
xor eax, eax
jmp 0x46dbc0
movzx r9d, byte [rsp + rsi + 0x26]
sub r9d, edx
lea edx, [r9 - 0x57]
mov byte [rsp + rdi + 0x26], dl
lea edx, [r8 - 0x57]
mov byte [rsp + rsi + 0x26], dl
add rax, 2
cmp rax, 0xc
jge 0x46dbed
movzx edx, byte [rsp + rax + 0x1a]
movzx esi, byte [rsp + rax + 0x1b]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0xa
jae 0x46dc10
movzx r8d, byte [rsp + rdi + 0x26]
sub r8d, edx
cmp rsi, 0xa
jb 0x46dba3
jmp 0x46dc04
xor eax, eax
lea rbx, [rsp + 0x26]
mov ecx, 0xa
call fcn.00444780
add rsp, 0x30
pop rbp
ret
mov eax, esi
mov ecx, 0xa
call fcn.00456420
mov eax, edi
mov ecx, 0xa
call fcn.00456420
nop
nop dword [rax]
call fcn.00454140
jmp fcn.0046db60
Function at 0x46f800
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x46f8c6
push rbp
mov rbp, rsp
sub rsp, 0x30
movabs rdx, 0x3b656ef38a063b53
mov qword [rsp + 0x27], rdx
mov byte [rsp + 0x2f], 0xf9
movabs rdx, 0x102040308030308
mov qword [rsp + 0x1b], rdx
mov dword [rsp + 0x23], 0x1070304
xor eax, eax
nop
jmp 0x46f860
movzx r9d, byte [rsp + rsi + 0x27]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x2a]
mov byte [rsp + rdi + 0x27], dl
mov byte [rsp + rsi + 0x27], r8b
add rax, 2
nop dword [rax]
cmp rax, 0xc
jge 0x46f892
movzx edx, byte [rsp + rax + 0x1b]
movzx esi, byte [rsp + rax + 0x1c]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 9
jae 0x46f8b7
movzx r8d, byte [rsp + rdi + 0x27]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x2a]
cmp rsi, 9
jb 0x46f842
jmp 0x46f8ab
xor eax, eax
lea rbx, [rsp + 0x27]
mov ecx, 9
nop
call fcn.00444780
add rsp, 0x30
pop rbp
ret
mov eax, esi
mov ecx, 9
call fcn.00456420
mov eax, edi
mov ecx, 9
nop
call fcn.00456420
nop
call fcn.00454140
jmp fcn.0046f800

Function at 0x470280
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x470338
push rbp
mov rbp, rsp
sub rsp, 0x30
movabs rdx, 0x1967516e23306937
mov qword [rsp + 0x28], rdx
movabs rdx, 0x702000305050203
mov qword [rsp + 0x1c], rdx
mov dword [rsp + 0x24], 0x3070702
xor eax, eax
jmp 0x4702d6
movzx r9d, byte [rsp + rsi + 0x28]
lea edx, [r9 + rdx]
lea edx, [rdx + 0xe]
mov byte [rsp + rdi + 0x28], dl
mov byte [rsp + rsi + 0x28], r8b
add rax, 2
cmp rax, 0xc
jge 0x470308
movzx edx, byte [rsp + rax + 0x1c]
movzx esi, byte [rsp + rax + 0x1d]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 8
jae 0x47032b
movzx r8d, byte [rsp + rdi + 0x28]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0xe]
cmp rsi, 8
jb 0x4702bc
jmp 0x47031f
xor eax, eax
lea rbx, [rsp + 0x28]
mov ecx, 8
call fcn.00444780
add rsp, 0x30
pop rbp
ret
mov eax, esi
mov ecx, 8
call fcn.00456420
mov eax, edi
mov ecx, 8
call fcn.00456420
nop
call fcn.00454140
nop dword [rax]
jmp fcn.00470280

Function at 0x470780
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x470852
push rbp
mov rbp, rsp
sub rsp, 0x38
movabs rdx, 0x6ba25f491243b1be
mov qword [rsp + 0x29], rdx
movabs rdx, 0x8991bc1144a5fc6b
mov qword [rsp + 0x30], rdx
movabs rdx, 0xc060603000b0c07
mov qword [rsp + 0x19], rdx
movabs rdx, 0xd06000e08060901
mov qword [rsp + 0x21], rdx
xor eax, eax
jmp 0x4707ec
movzx r9d, byte [rsp + rsi + 0x29]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x62]
mov byte [rsp + rdi + 0x29], dl
mov byte [rsp + rsi + 0x29], r8b
add rax, 2
cmp rax, 0x10
jge 0x47081e
movzx edx, byte [rsp + rax + 0x19]
movzx esi, byte [rsp + rax + 0x1a]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0xf
jae 0x470845
movzx r8d, byte [rsp + rdi + 0x29]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x62]
cmp rsi, 0xf
jb 0x4707d2
jmp 0x470835
xor eax, eax
lea rbx, [rsp + 0x29]
mov ecx, 0xf
call fcn.00444780
add rsp, 0x38
pop rbp
ret
mov eax, esi
mov ecx, 0xf
nop dword [rax]
call fcn.00456420
mov eax, edi
mov ecx, 0xf
call fcn.00456420
nop
call fcn.00454140
jmp fcn.00470780
Function at 0x4710a0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x471158
push rbp
mov rbp, rsp
sub rsp, 0x30
movabs rdx, 0x7238666e3674484b
mov qword [rsp + 0x28], rdx
movabs rdx, 0x303000300060501
mov qword [rsp + 0x1e], rdx
mov word [rsp + 0x26], 0x605
xor eax, eax
jmp 0x4710f8
movzx r9d, byte [rsp + rsi + 0x28]
sub r9d, edx
lea edx, [r9 + 0x16]
mov byte [rsp + rdi + 0x28], dl
lea edx, [r8 + 0x16]
mov byte [rsp + rsi + 0x28], dl
add rax, 2
cmp rax, 0xa
jge 0x471128
movzx edx, byte [rsp + rax + 0x1e]
movzx esi, byte [rsp + rax + 0x1f]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 8
jae 0x47114b
movzx r8d, byte [rsp + rdi + 0x28]
sub r8d, edx
nop dword [rax]
cmp rsi, 8
jb 0x4710db
jmp 0x47113f
xor eax, eax
lea rbx, [rsp + 0x28]
mov ecx, 8
call fcn.00444780
add rsp, 0x30
pop rbp
ret
mov eax, esi
mov ecx, 8
call fcn.00456420
mov eax, edi
mov ecx, 8
call fcn.00456420
nop
call fcn.00454140
nop dword [rax]
jmp fcn.004710a0

Function at 0x471b20
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x471be7
push rbp
mov rbp, rsp
sub rsp, 0x38
movabs rdx, 0x4a63768e89657771
mov qword [rsp + 0x2d], rdx
mov dword [rsp + 0x34], 0x6372714a
movabs rdx, 0x403090307000601
mov qword [rsp + 0x1d], rdx
movabs rdx, 0x309050506080309
mov qword [rsp + 0x25], rdx
xor eax, eax
jmp 0x471b88
movzx r9d, byte [rsp + rsi + 0x2d]
sub r9d, edx
lea edx, [r9 + 8]
mov byte [rsp + rdi + 0x2d], dl
lea edx, [r8 + 8]
mov byte [rsp + rsi + 0x2d], dl
add rax, 2
cmp rax, 0x10
jge 0x471bb7
movzx edx, byte [rsp + rax + 0x1d]
movzx esi, byte [rsp + rax + 0x1e]
mov edi, edx
xor edx, esi
add edx, eax
nop
cmp rdi, 0xb
jae 0x471bda
movzx r8d, byte [rsp + rdi + 0x2d]
sub r8d, edx
cmp rsi, 0xb
jb 0x471b6b
jmp 0x471bce
xor eax, eax
lea rbx, [rsp + 0x2d]
mov ecx, 0xb
call fcn.00444780
add rsp, 0x38
pop rbp
ret
mov eax, esi
mov ecx, 0xb
call fcn.00456420
mov eax, edi
mov ecx, 0xb
call fcn.00456420
nop
call fcn.00454140
jmp fcn.00471b20
Function at 0x472de0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x472edd
push rbp
mov rbp, rsp
sub rsp, 0x50
movabs rdx, 0x29303bfe13eb4415
mov qword [rsp + 0x3b], rdx
movabs rdx, 0x386535bb6129303b
mov qword [rsp + 0x40], rdx
movabs rdx, 0x596e19fe08451dfc
mov qword [rsp + 0x48], rdx
movabs rdx, 0xe00071200020d07
mov qword [rsp + 0x1d], rdx
movabs rdx, 0x4050a100c030a09
mov qword [rsp + 0x25], rdx
movabs rdx, 0x506010711100405
mov qword [rsp + 0x2b], rdx
movabs rdx, 0x1006140c0a0c0211
mov qword [rsp + 0x33], rdx
xor eax, eax
jmp 0x472e80
movzx r9d, byte [rsp + rsi + 0x3b]
sub r9d, edx
lea edx, [r9 + 0x46]
mov byte [rsp + rdi + 0x3b], dl
lea edx, [r8 + 0x46]
mov byte [rsp + rsi + 0x3b], dl
add rax, 2
nop dword [rax]
cmp rax, 0x1e
jge 0x472ead
movzx edx, byte [rsp + rax + 0x1d]
movzx esi, byte [rsp + rax + 0x1e]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x15
jae 0x472ed0
movzx r8d, byte [rsp + rdi + 0x3b]
sub r8d, edx
cmp rsi, 0x15
jb 0x472e5f
jmp 0x472ec4
xor eax, eax
lea rbx, [rsp + 0x3b]
mov ecx, 0x15
call fcn.00444780
add rsp, 0x50
pop rbp
ret
mov eax, esi
mov ecx, 0x15
call fcn.00456420
mov eax, edi
mov ecx, 0x15
call fcn.00456420
nop
nop dword [rax]
call fcn.00454140
jmp fcn.00472de0

Function at 0x472f80
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x473066
push rbp
mov rbp, rsp
sub rsp, 0x40
movabs rdx, 0xa29d5f729f6877c7
mov qword [rsp + 0x32], rdx
movabs rdx, 0x97725b805381a29d
mov qword [rsp + 0x38], rdx
movabs rdx, 0x70b000d03080d07
mov qword [rsp + 0x1e], rdx
movabs rdx, 0xd000801070b000d
mov qword [rsp + 0x22], rdx
movabs rdx, 0xa01010d060d0100
mov qword [rsp + 0x2a], rdx
xor eax, eax
nop
jmp 0x473000
movzx r9d, byte [rsp + rsi + 0x32]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x29]
mov byte [rsp + rdi + 0x32], dl
mov byte [rsp + rsi + 0x32], r8b
add rax, 2
nop dword [rax]
cmp rax, 0x14
jge 0x473032
movzx edx, byte [rsp + rax + 0x1e]
movzx esi, byte [rsp + rax + 0x1f]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0xe
jae 0x473057
movzx r8d, byte [rsp + rdi + 0x32]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x29]
cmp rsi, 0xe
jb 0x472fe2
jmp 0x47304b
xor eax, eax
lea rbx, [rsp + 0x32]
mov ecx, 0xe
nop
call fcn.00444780
add rsp, 0x40
pop rbp
ret
mov eax, esi
mov ecx, 0xe
call fcn.00456420
mov eax, edi
mov ecx, 0xe
nop
call fcn.00456420
nop
call fcn.00454140
jmp fcn.00472f80
Function at 0x473080
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x47315d
push rbp
mov rbp, rsp
sub rsp, 0x40
movabs rdx, 0x3b4b5c5635686638
mov qword [rsp + 0x31], rdx
movabs rdx, 0x634f6142eb3a773b
mov qword [rsp + 0x38], rdx
movabs rdx, 0x906030d060b0a0b
mov qword [rsp + 0x1d], rdx
movabs rdx, 0x30d090d0906030d
mov qword [rsp + 0x21], rdx
movabs rdx, 0x507010a0e040007
mov qword [rsp + 0x29], rdx
xor eax, eax
nop
jmp 0x473100
movzx r9d, byte [rsp + rsi + 0x31]
sub r9d, edx
lea edx, [r9 + 0x27]
mov byte [rsp + rdi + 0x31], dl
lea edx, [r8 + 0x27]
mov byte [rsp + rsi + 0x31], dl
add rax, 2
nop
cmp rax, 0x14
jge 0x47312d
movzx edx, byte [rsp + rax + 0x1d]
movzx esi, byte [rsp + rax + 0x1e]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0xf
jae 0x473150
movzx r8d, byte [rsp + rdi + 0x31]
sub r8d, edx
cmp rsi, 0xf
jb 0x4730e2
jmp 0x473144
xor eax, eax
lea rbx, [rsp + 0x31]
mov ecx, 0xf
call fcn.00444780
add rsp, 0x40
pop rbp
ret
mov eax, esi
mov ecx, 0xf
call fcn.00456420
mov eax, edi
mov ecx, 0xf
call fcn.00456420
nop
nop dword [rax]
call fcn.00454140
jmp fcn.00473080

Function at 0x473180
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x47323d
push rbp
mov rbp, rsp
sub rsp, 0x30
movabs rdx, 0x35655f465b48744f
mov qword [rsp + 0x26], rdx
mov word [rsp + 0x2e], 0x3d39
movabs rdx, 0x706020908060409
mov qword [rsp + 0x1a], rdx
mov dword [rsp + 0x22], 0x7040309
xor eax, eax
jmp 0x4731e0
movzx r9d, byte [rsp + rsi + 0x26]
sub r9d, edx
lea edx, [r9 + 0x1f]
mov byte [rsp + rdi + 0x26], dl
lea edx, [r8 + 0x1f]
mov byte [rsp + rsi + 0x26], dl
add rax, 2
cmp rax, 0xc
jge 0x47320d
movzx edx, byte [rsp + rax + 0x1a]
movzx esi, byte [rsp + rax + 0x1b]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0xa
jae 0x473230
movzx r8d, byte [rsp + rdi + 0x26]
sub r8d, edx
cmp rsi, 0xa
jb 0x4731c3
jmp 0x473224
xor eax, eax
lea rbx, [rsp + 0x26]
mov ecx, 0xa
call fcn.00444780
add rsp, 0x30
pop rbp
ret
mov eax, esi
mov ecx, 0xa
call fcn.00456420
mov eax, edi
mov ecx, 0xa
call fcn.00456420
nop
nop dword [rax]
call fcn.00454140
jmp fcn.00473180
Function at 0x473260
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x473346
push rbp
mov rbp, rsp
sub rsp, 0x40
movabs rdx, 0x2da7bb45c236f20f
mov qword [rsp + 0x31], rdx
movabs rdx, 0x100d61637265702d
mov qword [rsp + 0x38], rdx
movabs rdx, 0xe0e040307020d07
mov qword [rsp + 0x1b], rdx
movabs rdx, 0x307010d00000e0e
mov qword [rsp + 0x21], rdx
movabs rdx, 0x30601000d0e0705
mov qword [rsp + 0x29], rdx
xor eax, eax
nop
jmp 0x4732e0
movzx r9d, byte [rsp + rsi + 0x31]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x5b]
mov byte [rsp + rdi + 0x31], dl
mov byte [rsp + rsi + 0x31], r8b
add rax, 2
nop dword [rax]
cmp rax, 0x16
jge 0x473312
movzx edx, byte [rsp + rax + 0x1b]
movzx esi, byte [rsp + rax + 0x1c]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0xf
jae 0x473337
movzx r8d, byte [rsp + rdi + 0x31]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x5b]
cmp rsi, 0xf
jb 0x4732c2
jmp 0x47332b
xor eax, eax
lea rbx, [rsp + 0x31]
mov ecx, 0xf
nop
call fcn.00444780
add rsp, 0x40
pop rbp
ret
mov eax, esi
mov ecx, 0xf
call fcn.00456420
mov eax, edi
mov ecx, 0xf
nop
call fcn.00456420
nop
call fcn.00454140
jmp fcn.00473260

Function at 0x474a60
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x474b26
push rbp
mov rbp, rsp
sub rsp, 0x30
movabs rdx, 0x12765f65b969680f
mov qword [rsp + 0x25], rdx
mov dword [rsp + 0x2c], 0x23632712
movabs rdx, 0x807080a00030608
mov qword [rsp + 0x19], rdx
mov dword [rsp + 0x21], 0xa080603
xor eax, eax
jmp 0x474ac0
movzx r9d, byte [rsp + rsi + 0x25]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x67]
mov byte [rsp + rdi + 0x25], dl
mov byte [rsp + rsi + 0x25], r8b
add rax, 2
nop
cmp rax, 0xc
jge 0x474af2
movzx edx, byte [rsp + rax + 0x19]
movzx esi, byte [rsp + rax + 0x1a]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0xb
jae 0x474b17
movzx r8d, byte [rsp + rdi + 0x25]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x67]
cmp rsi, 0xb
jb 0x474aa4
jmp 0x474b0b
xor eax, eax
lea rbx, [rsp + 0x25]
mov ecx, 0xb
nop
call fcn.00444780
add rsp, 0x30
pop rbp
ret
mov eax, esi
mov ecx, 0xb
call fcn.00456420
mov eax, edi
mov ecx, 0xb
nop
call fcn.00456420
nop
call fcn.00454140
jmp fcn.00474a60
Function at 0x478a00
Capabilities:
Encrypt data using rc4 prga

Disassembly:
lea r12, [rsp - 0x20]
cmp r12, qword [r14 + 0x10]
jbe 0x478b9b
push rbp
mov rbp, rsp
sub rsp, 0x98
movabs rdx, 0x11bb37ac6574795a
mov qword [rsp + 0x62], rdx
movabs rdx, 0xc9b5bdeadab111bb
mov qword [rsp + 0x68], rdx
movabs rdx, 0x8b0bdf6564fc8a72
mov qword [rsp + 0x70], rdx
movabs rdx, 0xcd70656e7233bc65
mov qword [rsp + 0x78], rdx
movabs rdx, 0x8ee4e7a661b86507
mov qword [rsp + 0x80], rdx
movabs rdx, 0x82bc748b96f163d9
mov qword [rsp + 0x88], rdx
movabs rdx, 0xc5c71af020025972
mov qword [rsp + 0x90], rdx
movabs rdx, 0x2228253332300929
mov qword [rsp + 0x1c], rdx
movabs rdx, 0x2805132314072228
mov qword [rsp + 0x22], rdx
movabs rdx, 0xb2814250817262a
mov qword [rsp + 0x2a], rdx
movabs rdx, 0x2004302c10103507
mov qword [rsp + 0x32], rdx
movabs rdx, 0xd1c330d240a090d
mov qword [rsp + 0x3a], rdx
movabs rdx, 0x61e1e1d1d180a1c
mov qword [rsp + 0x42], rdx
movabs rdx, 0x32000c0f052f1333
mov qword [rsp + 0x4a], rdx
movabs rdx, 0xb15153422102f24
mov qword [rsp + 0x52], rdx
movabs rdx, 0x14322307171d1e2d
mov qword [rsp + 0x5a], rdx
xor eax, eax
jmp 0x478b31
movzx r9d, byte [rsp + rsi + 0x62]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x7b]
mov byte [rsp + rdi + 0x62], dl
mov byte [rsp + rsi + 0x62], r8b
add rax, 2
cmp rax, 0x46
jge 0x478b68
movzx edx, byte [rsp + rax + 0x1c]
movzx esi, byte [rsp + rax + 0x1d]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x36
jae 0x478b8e
movzx r8d, byte [rsp + rdi + 0x62]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x7b]
nop dword [rax + rax]
cmp rsi, 0x36
jb 0x478b17
jmp 0x478b82
xor eax, eax
lea rbx, [rsp + 0x62]
mov ecx, 0x36
call fcn.00444780
add rsp, 0x98
pop rbp
ret
mov eax, esi
mov ecx, 0x36
call fcn.00456420
mov eax, edi
mov ecx, 0x36
call fcn.00456420
nop
nop dword [rax + rax]
call fcn.00454140
jmp fcn.00478a00
Function at 0x478bc0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
lea r12, [rsp - 0x40]
cmp r12, qword [r14 + 0x10]
jbe 0x478d3b
push rbp
mov rbp, rsp
sub rsp, 0xb8
movabs rdx, 0x75eb2ea26589b205
mov qword [rsp + 0x72], rdx
movabs rdx, 0x9455edee66e075eb
mov qword [rsp + 0x78], rdx
movabs rdx, 0x7942780565306ee1
mov qword [rsp + 0x80], rdx
movabs rdx, 0x766511df323a6574
mov qword [rsp + 0x88], rdx
movabs rdx, 0x1bcafbf573136fc3
mov qword [rsp + 0x90], rdx
movabs rdx, 0x6a20ae326926a7f4
mov qword [rsp + 0x98], rdx
movabs rdx, 0x63b0df6a160b5939
mov qword [rsp + 0xa0], rdx
movabs rdx, 0x802e65076319e220
mov qword [rsp + 0xa8], rdx
movabs rdx, 0xfb68656720d3217b
mov qword [rsp + 0xb0], rdx
movabs rdx, 0x3d19000e0804220c
mov qword [rsp + 0x1c], rdx
lea rdi, [rsp + 0x22]
lea rsi, [0x005a145a]
nop word [rax + rax]
nop word [rax + rax]
mov qword [rsp - 0x10], rbp
lea rbp, [rsp - 0x10]
call fcn.00456a3a
mov rbp, qword [rbp]
xor eax, eax
jmp 0x478cd1
movzx r9d, byte [rsp + rsi + 0x72]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x17]
mov byte [rsp + rdi + 0x72], dl
mov byte [rsp + rsi + 0x72], r8b
add rax, 2
cmp rax, 0x56
jge 0x478d08
movzx edx, byte [rsp + rax + 0x1c]
movzx esi, byte [rsp + rax + 0x1d]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x46
jae 0x478d2e
movzx r8d, byte [rsp + rdi + 0x72]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x17]
nop dword [rax + rax]
cmp rsi, 0x46
jb 0x478cb7
jmp 0x478d22
xor eax, eax
lea rbx, [rsp + 0x72]
mov ecx, 0x46
call fcn.00444780
add rsp, 0xb8
pop rbp
ret
mov eax, esi
mov ecx, 0x46
call fcn.00456420
mov eax, edi
mov ecx, 0x46
call fcn.00456420
nop
nop dword [rax + rax]
call fcn.00454140
jmp fcn.00478bc0

Function at 0x479200
Capabilities:
Encode data using xor

Disassembly:
mov rbx, qword [rsp + 8]
mov rsi, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdx, qword [rsp + 0x20]
test rdx, 0xf
jne 0x47927a
mov rax, 0
nop word [rax + rax]
nop dword [rax]
movdqu xmm0, xmmword [rsi + rax]
movdqu xmm1, xmmword [rcx + rax]
pxor xmm0, xmm1
movdqu xmmword [rbx + rax], xmm0
add rax, 0x10
cmp rdx, rax
jne 0x479230
ret
sub rdx, 1
mov dil, byte [rsi + rdx]
mov al, byte [rcx + rdx]
xor dil, al
mov byte [rbx + rdx], dil
test rdx, 7
jne 0x479250
cmp rdx, 0
je 0x47929c
test rdx, 0xf
je 0x47921d
test rdx, 7
jne 0x479250
sub rdx, 8
mov rdi, qword [rsi + rdx]
mov rax, qword [rcx + rdx]
xor rdi, rax
mov qword [rbx + rdx], rdi
cmp rdx, 0x10
jge 0x47921d
ret