joyce8/EMBER2024-capa huggingface dataset:
Function at 0x470ce0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x470d98
push rbp
mov rbp, rsp
sub rsp, 0x30
movabs rdx, 0x736879794e727170
mov qword [rsp + 0x1c], rdx
movabs rdx, 0x305050100040703
mov qword [rsp + 0x24], rdx
mov dword [rsp + 0x2c], 0x4000704
xor eax, eax
jmp 0x470d36
movzx r9d, byte [rsp + rsi + 0x1c]
lea edx, [r9 + rdx]
lea edx, [rdx - 0xc]
mov byte [rsp + rdi + 0x1c], dl
mov byte [rsp + rsi + 0x1c], r8b
add rax, 2
cmp rax, 0xc
jge 0x470d68
movzx edx, byte [rsp + rax + 0x24]
movzx esi, byte [rsp + rax + 0x25]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 8
jae 0x470d8b
movzx r8d, byte [rsp + rdi + 0x1c]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0xc]
cmp rsi, 8
jb 0x470d1c
jmp 0x470d7f
xor eax, eax
lea rbx, [rsp + 0x1c]
mov ecx, 8
call fcn.00441380
add rsp, 0x30
pop rbp
ret
mov eax, esi
mov ecx, 8
call fcn.00451880
mov eax, edi
mov ecx, 8
call fcn.00451880
nop
call fcn.0044f600
nop dword [rax]
jmp fcn.00470ce0

Function at 0x471ea0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x471f6c
push rbp
mov rbp, rsp
sub rsp, 0x30
movabs rdx, 0xa768046f31a915b2
mov qword [rsp + 0x18], rdx
mov word [rsp + 0x20], 0x999
movabs rdx, 0x2010705080703
mov qword [rsp + 0x22], rdx
movabs rdx, 0x100090302050002
mov qword [rsp + 0x28], rdx
xor eax, eax
jmp 0x471f04
movzx r9d, byte [rsp + rsi + 0x18]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x55]
mov byte [rsp + rdi + 0x18], dl
mov byte [rsp + rsi + 0x18], r8b
add rax, 2
cmp rax, 0xe
jge 0x471f3c
movzx edx, byte [rsp + rax + 0x22]
movzx esi, byte [rsp + rax + 0x23]
mov edi, edx
xor edx, esi
add edx, eax
nop word [rax + rax]
cmp rdi, 0xa
jae 0x471f5f
movzx r8d, byte [rsp + rdi + 0x18]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x55]
cmp rsi, 0xa
jb 0x471eea
jmp 0x471f53
xor eax, eax
lea rbx, [rsp + 0x18]
mov ecx, 0xa
call fcn.00441380
add rsp, 0x30
pop rbp
ret
mov eax, esi
mov ecx, 0xa
call fcn.00451880
mov eax, edi
mov ecx, 0xa
call fcn.00451880
nop
call fcn.0044f600
jmp fcn.00471ea0

Function at 0x472b20
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x472be6
push rbp
mov rbp, rsp
sub rsp, 0x30
movabs rdx, 0xf1f1682f696e1efa
mov qword [rsp + 0x26], rdx
mov word [rsp + 0x2e], 0x6e25
movabs rdx, 0x707080404060001
mov qword [rsp + 0x1c], rdx
mov word [rsp + 0x24], 0x701
xor eax, eax
jmp 0x472b80
movzx r9d, byte [rsp + rsi + 0x26]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x2e]
mov byte [rsp + rdi + 0x26], dl
mov byte [rsp + rsi + 0x26], r8b
add rax, 2
nop dword [rax]
cmp rax, 0xa
jge 0x472bb2
movzx edx, byte [rsp + rax + 0x1c]
movzx esi, byte [rsp + rax + 0x1d]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0xa
jae 0x472bd7
movzx r8d, byte [rsp + rdi + 0x26]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x2e]
cmp rsi, 0xa
jb 0x472b62
jmp 0x472bcb
xor eax, eax
lea rbx, [rsp + 0x26]
mov ecx, 0xa
nop
call fcn.00441380
add rsp, 0x30
pop rbp
ret
mov eax, esi
mov ecx, 0xa
call fcn.00451880
mov eax, edi
mov ecx, 0xa
nop
call fcn.00451880
nop
call fcn.0044f600
jmp fcn.00472b20
Function at 0x477ca0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x477d67
push rbp
mov rbp, rsp
sub rsp, 0x38
movabs rdx, 0x906f564f71846982
mov qword [rsp + 0x1e], rdx
mov dword [rsp + 0x26], 0xa07d988a
movabs rdx, 0x807040304000900
mov qword [rsp + 0x2a], rdx
movabs rdx, 0x505020a020b0807
mov qword [rsp + 0x30], rdx
xor eax, eax
jmp 0x477d08
movzx r9d, byte [rsp + rsi + 0x1e]
sub r9d, edx
lea edx, [r9 - 7]
mov byte [rsp + rdi + 0x1e], dl
lea edx, [r8 - 7]
mov byte [rsp + rsi + 0x1e], dl
add rax, 2
cmp rax, 0xe
jge 0x477d37
movzx edx, byte [rsp + rax + 0x2a]
movzx esi, byte [rsp + rax + 0x2b]
mov edi, edx
xor edx, esi
add edx, eax
nop
cmp rdi, 0xc
jae 0x477d5a
movzx r8d, byte [rsp + rdi + 0x1e]
sub r8d, edx
cmp rsi, 0xc
jb 0x477ceb
jmp 0x477d4e
xor eax, eax
lea rbx, [rsp + 0x1e]
mov ecx, 0xc
call fcn.00441380
add rsp, 0x38
pop rbp
ret
mov eax, esi
mov ecx, 0xc
call fcn.00451880
mov eax, edi
mov ecx, 0xc
call fcn.00451880
nop
call fcn.0044f600
jmp fcn.00477ca0

Function at 0x478120
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4781e6
push rbp
mov rbp, rsp
sub rsp, 0x30
movabs rdx, 0x4874f73bf036693d
mov qword [rsp + 0x1b], rdx
mov byte [rsp + 0x23], 0xe4
movabs rdx, 0x802030405070803
mov qword [rsp + 0x24], rdx
mov dword [rsp + 0x2c], 0x2040007
xor eax, eax
nop
jmp 0x478180
movzx r9d, byte [rsp + rsi + 0x1b]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x1d]
mov byte [rsp + rdi + 0x1b], dl
mov byte [rsp + rsi + 0x1b], r8b
add rax, 2
nop dword [rax]
cmp rax, 0xc
jge 0x4781b2
movzx edx, byte [rsp + rax + 0x24]
movzx esi, byte [rsp + rax + 0x25]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 9
jae 0x4781d7
movzx r8d, byte [rsp + rdi + 0x1b]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x1d]
cmp rsi, 9
jb 0x478162
jmp 0x4781cb
xor eax, eax
lea rbx, [rsp + 0x1b]
mov ecx, 9
nop
call fcn.00441380
add rsp, 0x30
pop rbp
ret
mov eax, esi
mov ecx, 9
call fcn.00451880
mov eax, edi
mov ecx, 9
nop
call fcn.00451880
nop
call fcn.0044f600
jmp fcn.00478120

Function at 0x47aa60
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x47ab46
push rbp
mov rbp, rsp
sub rsp, 0x38
movabs rdx, 0x6f6974b14fd43d20
mov qword [rsp + 0x18], rdx
movabs rdx, 0xae4797c5d6e06f69
mov qword [rsp + 0x1e], rdx
movabs rdx, 0x40a01080c0c0103
mov qword [rsp + 0x26], rdx
movabs rdx, 0xc02040a01080c0c
mov qword [rsp + 0x28], rdx
movabs rdx, 0x90d0d0009030b03
mov qword [rsp + 0x30], rdx
xor eax, eax
nop
jmp 0x47aae0
movzx r9d, byte [rsp + rsi + 0x18]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x78]
mov byte [rsp + rdi + 0x18], dl
mov byte [rsp + rsi + 0x18], r8b
add rax, 2
nop dword [rax]
cmp rax, 0x12
jge 0x47ab12
movzx edx, byte [rsp + rax + 0x26]
movzx esi, byte [rsp + rax + 0x27]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0xe
jae 0x47ab37
movzx r8d, byte [rsp + rdi + 0x18]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x78]
cmp rsi, 0xe
jb 0x47aac2
jmp 0x47ab2b
xor eax, eax
lea rbx, [rsp + 0x18]
mov ecx, 0xe
nop
call fcn.00441380
add rsp, 0x38
pop rbp
ret
mov eax, esi
mov ecx, 0xe
call fcn.00451880
mov eax, edi
mov ecx, 0xe
nop
call fcn.00451880
nop
call fcn.0044f600
jmp fcn.0047aa60
Function at 0x481140
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x48121d
push rbp
mov rbp, rsp
sub rsp, 0x38
movabs rdx, 0x2fc4654106b54e4d
mov qword [rsp + 0x18], rdx
movabs rdx, 0x1242486e69212fc4
mov qword [rsp + 0x1e], rdx
movabs rdx, 0x703060302060603
mov qword [rsp + 0x26], rdx
movabs rdx, 0x80d070306030206
mov qword [rsp + 0x28], rdx
movabs rdx, 0x40c0808010b0d00
mov qword [rsp + 0x30], rdx
xor eax, eax
nop
jmp 0x4811c0
movzx r9d, byte [rsp + rsi + 0x18]
sub r9d, edx
lea edx, [r9 + 0x3c]
mov byte [rsp + rdi + 0x18], dl
lea edx, [r8 + 0x3c]
mov byte [rsp + rsi + 0x18], dl
add rax, 2
nop
cmp rax, 0x12
jge 0x4811ed
movzx edx, byte [rsp + rax + 0x26]
movzx esi, byte [rsp + rax + 0x27]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0xe
jae 0x481210
movzx r8d, byte [rsp + rdi + 0x18]
sub r8d, edx
cmp rsi, 0xe
jb 0x4811a2
jmp 0x481204
xor eax, eax
lea rbx, [rsp + 0x18]
mov ecx, 0xe
call fcn.00441380
add rsp, 0x38
pop rbp
ret
mov eax, esi
mov ecx, 0xe
call fcn.00451880
mov eax, edi
mov ecx, 0xe
call fcn.00451880
nop
nop dword [rax]
call fcn.0044f600
jmp fcn.00481140

Function at 0x4875e0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4876dd
push rbp
mov rbp, rsp
sub rsp, 0x50
movabs rdx, 0xa0706d8d63657270
mov qword [rsp + 0x1e], rdx
movabs rdx, 0xb094cabf2064e7b6
mov qword [rsp + 0x26], rdx
movabs rdx, 0x8265ac96d6b2a55b
mov qword [rsp + 0x2e], rdx
movabs rdx, 0x10150d0717120715
mov qword [rsp + 0x36], rdx
movabs rdx, 0x141108110e071409
mov qword [rsp + 0x3e], rdx
movabs rdx, 0xc0e141108110e07
mov qword [rsp + 0x40], rdx
movabs rdx, 0x170f040e15110e13
mov qword [rsp + 0x48], rdx
xor eax, eax
jmp 0x487680
movzx r9d, byte [rsp + rsi + 0x1e]
sub r9d, edx
lea edx, [r9 - 0xc]
mov byte [rsp + rdi + 0x1e], dl
lea edx, [r8 - 0xc]
mov byte [rsp + rsi + 0x1e], dl
add rax, 2
nop dword [rax]
cmp rax, 0x1a
jge 0x4876ad
movzx edx, byte [rsp + rax + 0x36]
movzx esi, byte [rsp + rax + 0x37]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x18
jae 0x4876d0
movzx r8d, byte [rsp + rdi + 0x1e]
sub r8d, edx
cmp rsi, 0x18
jb 0x48765f
jmp 0x4876c4
xor eax, eax
lea rbx, [rsp + 0x1e]
mov ecx, 0x18
call fcn.00441380
add rsp, 0x50
pop rbp
ret
mov eax, esi
mov ecx, 0x18
call fcn.00451880
mov eax, edi
mov ecx, 0x18
call fcn.00451880
nop
nop dword [rax]
call fcn.0044f600
jmp fcn.004875e0
Function at 0x487700
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x487808
push rbp
mov rbp, rsp
sub rsp, 0x58
movabs rdx, 0x1a390621b90e1edc
mov qword [rsp + 0x1e], rdx
movabs rdx, 0x340b27f9a73b2674
mov qword [rsp + 0x26], rdx
movabs rdx, 0x17ba733d316f9d85
mov qword [rsp + 0x2e], rdx
movabs rdx, 0x2050a060c0e1709
mov qword [rsp + 0x36], rdx
movabs rdx, 0x1602050a060c0e
mov qword [rsp + 0x38], rdx
movabs rdx, 0x1607030011060610
mov qword [rsp + 0x40], rdx
movabs rdx, 0x60d01040b10000a
mov qword [rsp + 0x48], rdx
movabs rdx, 0x110f13140d1011
mov qword [rsp + 0x50], rdx
xor eax, eax
jmp 0x4877ab
movzx r9d, byte [rsp + rsi + 0x1e]
sub r9d, edx
lea edx, [r9 + 0x6c]
mov byte [rsp + rdi + 0x1e], dl
lea edx, [r8 + 0x6c]
mov byte [rsp + rsi + 0x1e], dl
add rax, 2
cmp rax, 0x22
jge 0x4877d8
movzx edx, byte [rsp + rax + 0x36]
movzx esi, byte [rsp + rax + 0x37]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x18
jae 0x4877fb
movzx r8d, byte [rsp + rdi + 0x1e]
sub r8d, edx
cmp rsi, 0x18
jb 0x48778e
jmp 0x4877ef
xor eax, eax
lea rbx, [rsp + 0x1e]
mov ecx, 0x18
call fcn.00441380
add rsp, 0x58
pop rbp
ret
mov eax, esi
mov ecx, 0x18
call fcn.00451880
mov eax, edi
mov ecx, 0x18
call fcn.00451880
nop
call fcn.0044f600
jmp fcn.00487700

Function at 0x488140
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x488278
push rbp
mov rbp, rsp
sub rsp, 0x70
movabs rdx, 0x6b85706f8430657b
mov qword [rsp + 0x1c], rdx
movabs rdx, 0x618f2d6b6b85706f
mov qword [rsp + 0x20], rdx
movabs rdx, 0x659499873f70646e
mov qword [rsp + 0x28], rdx
movabs rdx, 0x3e8a7bc7864271d5
mov qword [rsp + 0x30], rdx
movabs rdx, 0x7b81695e25757456
mov qword [rsp + 0x38], rdx
movabs rdx, 0x1c1f050222100002
mov qword [rsp + 0x40], rdx
movabs rdx, 0x506140e19081202
mov qword [rsp + 0x48], rdx
movabs rdx, 0x1e1b150e021a1120
mov qword [rsp + 0x50], rdx
movabs rdx, 0x1a170f18090e1523
mov qword [rsp + 0x58], rdx
movabs rdx, 0x717080f1e1c1411
mov qword [rsp + 0x60], rdx
movabs rdx, 0x305000a06110f08
mov qword [rsp + 0x68], rdx
xor eax, eax
jmp 0x488218
movzx r9d, byte [rsp + rsi + 0x1c]
sub r9d, edx
lea edx, [r9 + 0x14]
mov byte [rsp + rdi + 0x1c], dl
lea edx, [r8 + 0x14]
mov byte [rsp + rsi + 0x1c], dl
add rax, 2
cmp rax, 0x30
jge 0x488248
movzx edx, byte [rsp + rax + 0x40]
movzx esi, byte [rsp + rax + 0x41]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x24
jae 0x48826b
movzx r8d, byte [rsp + rdi + 0x1c]
sub r8d, edx
nop dword [rax]
cmp rsi, 0x24
jb 0x4881fb
jmp 0x48825f
xor eax, eax
lea rbx, [rsp + 0x1c]
mov ecx, 0x24
call fcn.00441380
add rsp, 0x70
pop rbp
ret
mov eax, esi
mov ecx, 0x24
call fcn.00451880
mov eax, edi
mov ecx, 0x24
call fcn.00451880
nop
call fcn.0044f600
nop dword [rax]
jmp fcn.00488140
Function at 0x489800
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x489947
push rbp
mov rbp, rsp
sub rsp, 0x78
movabs rdx, 0xce391f306c666572
mov qword [rsp + 0x1b], rdx
movabs rdx, 0xf1181021746e380e
mov qword [rsp + 0x23], rdx
movabs rdx, 0xfde5b117e5f11810
mov qword [rsp + 0x28], rdx
movabs rdx, 0x33765d0820ee7236
mov qword [rsp + 0x30], rdx
movabs rdx, 0x957400c33e9605b3
mov qword [rsp + 0x38], rdx
movabs rdx, 0x78ef41bb3b35646f
mov qword [rsp + 0x40], rdx
movabs rdx, 0x1e10211c2229291a
mov qword [rsp + 0x48], rdx
movabs rdx, 0x152a1f1d12080f24
mov qword [rsp + 0x50], rdx
movabs rdx, 0x70f1f271a19112b
mov qword [rsp + 0x58], rdx
movabs rdx, 0x24091c200f140f13
mov qword [rsp + 0x60], rdx
movabs rdx, 0x1e22271d062b0d05
mov qword [rsp + 0x68], rdx
movabs rdx, 0x280f0c0e0817041e
mov qword [rsp + 0x70], rdx
xor eax, eax
jmp 0x4898e7
movzx r9d, byte [rsp + rsi + 0x1b]
sub r9d, edx
lea edx, [r9 + 0x7b]
mov byte [rsp + rdi + 0x1b], dl
lea edx, [r8 + 0x7b]
mov byte [rsp + rsi + 0x1b], dl
add rax, 2
cmp rax, 0x30
jge 0x489917
movzx edx, byte [rsp + rax + 0x48]
movzx esi, byte [rsp + rax + 0x49]
mov edi, edx
xor edx, esi
add edx, eax
nop dword [rax]
cmp rdi, 0x2d
jae 0x48993a
movzx r8d, byte [rsp + rdi + 0x1b]
sub r8d, edx
cmp rsi, 0x2d
jb 0x4898ca
jmp 0x48992e
xor eax, eax
lea rbx, [rsp + 0x1b]
mov ecx, 0x2d
call fcn.00441380
add rsp, 0x78
pop rbp
ret
mov eax, esi
mov ecx, 0x2d
call fcn.00451880
mov eax, edi
mov ecx, 0x2d
call fcn.00451880
nop
call fcn.0044f600
jmp fcn.00489800

Function at 0x489ba0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x489c8c
push rbp
mov rbp, rsp
sub rsp, 0x48
movabs rdx, 0xdad5d249ded4e302
mov qword [rsp + 0x1b], rdx
movabs rdx, 0x6974c8d670dad5d2
mov qword [rsp + 0x20], rdx
movabs rdx, 0xce292d74d5c22057
mov qword [rsp + 0x28], rdx
movabs rdx, 0x413090d14000c
mov qword [rsp + 0x30], rdx
movabs rdx, 0xf1203091409100a
mov qword [rsp + 0x38], rdx
movabs rdx, 0x50f01070602000c
mov qword [rsp + 0x40], rdx
xor eax, eax
jmp 0x489c2a
movzx r9d, byte [rsp + rsi + 0x1b]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x7b]
mov byte [rsp + rdi + 0x1b], dl
mov byte [rsp + rsi + 0x1b], r8b
add rax, 2
cmp rax, 0x18
jge 0x489c5c
movzx edx, byte [rsp + rax + 0x30]
movzx esi, byte [rsp + rax + 0x31]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x15
jae 0x489c7f
movzx r8d, byte [rsp + rdi + 0x1b]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x7b]
cmp rsi, 0x15
jb 0x489c10
jmp 0x489c73
xor eax, eax
lea rbx, [rsp + 0x1b]
mov ecx, 0x15
call fcn.00441380
add rsp, 0x48
pop rbp
ret
mov eax, esi
mov ecx, 0x15
call fcn.00451880
mov eax, edi
mov ecx, 0x15
call fcn.00451880
nop
call fcn.0044f600
jmp fcn.00489ba0
Function at 0x489ca0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x489d86
push rbp
mov rbp, rsp
sub rsp, 0x40
movabs rdx, 0x24749fb16cb1326a
mov qword [rsp + 0x1e], rdx
movabs rdx, 0x2a1775e7df562474
mov qword [rsp + 0x24], rdx
movabs rdx, 0x409090400040a01
mov qword [rsp + 0x2c], rdx
movabs rdx, 0x202050204090904
mov qword [rsp + 0x30], rdx
movabs rdx, 0x20c04010705000d
mov qword [rsp + 0x38], rdx
xor eax, eax
nop
jmp 0x489d20
movzx r9d, byte [rsp + rsi + 0x1e]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x2f]
mov byte [rsp + rdi + 0x1e], dl
mov byte [rsp + rsi + 0x1e], r8b
add rax, 2
nop dword [rax]
cmp rax, 0x14
jge 0x489d52
movzx edx, byte [rsp + rax + 0x2c]
movzx esi, byte [rsp + rax + 0x2d]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0xe
jae 0x489d77
movzx r8d, byte [rsp + rdi + 0x1e]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x2f]
cmp rsi, 0xe
jb 0x489d02
jmp 0x489d6b
xor eax, eax
lea rbx, [rsp + 0x1e]
mov ecx, 0xe
nop
call fcn.00441380
add rsp, 0x40
pop rbp
ret
mov eax, esi
mov ecx, 0xe
call fcn.00451880
mov eax, edi
mov ecx, 0xe
nop
call fcn.00451880
nop
call fcn.0044f600
jmp fcn.00489ca0

Function at 0x48a0a0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x48a18a
push rbp
mov rbp, rsp
sub rsp, 0x48
movabs rdx, 0x1aac63bd12b658fb
mov qword [rsp + 0x1f], rdx
movabs rdx, 0x4a1aac63bd12b658
mov qword [rsp + 0x20], rdx
movabs rdx, 0x208044a9056c4a63
mov qword [rsp + 0x28], rdx
movabs rdx, 0x40d0e08000a0e0a
mov qword [rsp + 0x30], rdx
movabs rdx, 0x6020e0f0c040e01
mov qword [rsp + 0x38], rdx
movabs rdx, 0x1020e07030f0006
mov qword [rsp + 0x40], rdx
xor eax, eax
jmp 0x48a12d
movzx r9d, byte [rsp + rsi + 0x1f]
sub r9d, edx
lea edx, [r9 + 0x72]
mov byte [rsp + rdi + 0x1f], dl
lea edx, [r8 + 0x72]
mov byte [rsp + rsi + 0x1f], dl
add rax, 2
cmp rax, 0x18
jge 0x48a15a
movzx edx, byte [rsp + rax + 0x30]
movzx esi, byte [rsp + rax + 0x31]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x11
jae 0x48a17d
movzx r8d, byte [rsp + rdi + 0x1f]
sub r8d, edx
cmp rsi, 0x11
jb 0x48a110
jmp 0x48a171
xor eax, eax
lea rbx, [rsp + 0x1f]
mov ecx, 0x11
call fcn.00441380
add rsp, 0x48
pop rbp
ret
mov eax, esi
mov ecx, 0x11
call fcn.00451880
mov eax, edi
mov ecx, 0x11
call fcn.00451880
nop
call fcn.0044f600
jmp fcn.0048a0a0
Function at 0x48c9a0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x48ca9b
push rbp
mov rbp, rsp
sub rsp, 0x48
movabs rdx, 0x2f956326fd6633f2
mov qword [rsp + 0x1c], rdx
movabs rdx, 0x8f982f956326fd66
mov qword [rsp + 0x1e], rdx
movabs rdx, 0x74f769ff2e651e6c
mov qword [rsp + 0x26], rdx
movabs rdx, 0x8010410080b0e0e
mov qword [rsp + 0x2e], rdx
movabs rdx, 0x6070707080b0310
mov qword [rsp + 0x36], rdx
movabs rdx, 0x906070707080b
mov qword [rsp + 0x38], rdx
movabs rdx, 0x307000b06030601
mov qword [rsp + 0x40], rdx
xor eax, eax
jmp 0x48ca39
movzx r9d, byte [rsp + rsi + 0x1c]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x56]
mov byte [rsp + rdi + 0x1c], dl
mov byte [rsp + rsi + 0x1c], r8b
add rax, 2
cmp rax, 0x1a
jge 0x48ca6b
movzx edx, byte [rsp + rax + 0x2e]
movzx esi, byte [rsp + rax + 0x2f]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x12
jae 0x48ca8e
movzx r8d, byte [rsp + rdi + 0x1c]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x56]
cmp rsi, 0x12
jb 0x48ca1f
jmp 0x48ca82
xor eax, eax
lea rbx, [rsp + 0x1c]
mov ecx, 0x12
call fcn.00441380
add rsp, 0x48
pop rbp
ret
mov eax, esi
mov ecx, 0x12
call fcn.00451880
mov eax, edi
mov ecx, 0x12
call fcn.00451880
nop
nop dword [rax + rax]
call fcn.0044f600
jmp fcn.0048c9a0

Function at 0x48d800
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x48d8d2
push rbp
mov rbp, rsp
sub rsp, 0x38
movabs rdx, 0x69828961763f733c
mov qword [rsp + 0x19], rdx
movabs rdx, 0x7a7a756c76366c69
mov qword [rsp + 0x20], rdx
movabs rdx, 0x70d0a0709080605
mov qword [rsp + 0x28], rdx
movabs rdx, 0x702020e070e0106
mov qword [rsp + 0x30], rdx
xor eax, eax
jmp 0x48d86c
movzx r9d, byte [rsp + rsi + 0x19]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x19]
mov byte [rsp + rdi + 0x19], dl
mov byte [rsp + rsi + 0x19], r8b
add rax, 2
cmp rax, 0x10
jge 0x48d89e
movzx edx, byte [rsp + rax + 0x28]
movzx esi, byte [rsp + rax + 0x29]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0xf
jae 0x48d8c5
movzx r8d, byte [rsp + rdi + 0x19]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x19]
cmp rsi, 0xf
jb 0x48d852
jmp 0x48d8b5
xor eax, eax
lea rbx, [rsp + 0x19]
mov ecx, 0xf
call fcn.00441380
add rsp, 0x38
pop rbp
ret
mov eax, esi
mov ecx, 0xf
nop dword [rax]
call fcn.00451880
mov eax, edi
mov ecx, 0xf
call fcn.00451880
nop
call fcn.0044f600
jmp fcn.0048d800
Function at 0x490960
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x490a87
push rbp
mov rbp, rsp
sub rsp, 0x68
movabs rdx, 0x8f4a365d567b614d
mov qword [rsp + 0x1e], rdx
movabs rdx, 0x6a59200473638371
mov qword [rsp + 0x26], rdx
movabs rdx, 0x61654656616a6c6c
mov qword [rsp + 0x2e], rdx
movabs rdx, 0x3f626c4e20650485
mov qword [rsp + 0x36], rdx
movabs rdx, 0x40e0c0414191315
mov qword [rsp + 0x3e], rdx
movabs rdx, 0x81e0c171d060e1e
mov qword [rsp + 0x46], rdx
movabs rdx, 0x81d081e0c171d06
mov qword [rsp + 0x48], rdx
movabs rdx, 0x180a0e12091d0305
mov qword [rsp + 0x50], rdx
movabs rdx, 0x1812150b170b0513
mov qword [rsp + 0x58], rdx
movabs rdx, 0x1f0a050f071f1d02
mov qword [rsp + 0x60], rdx
xor eax, eax
jmp 0x490a29
movzx r9d, byte [rsp + rsi + 0x1e]
sub r9d, edx
lea edx, [r9 + 0x2b]
mov byte [rsp + rdi + 0x1e], dl
lea edx, [r8 + 0x2b]
mov byte [rsp + rsi + 0x1e], dl
add rax, 2
cmp rax, 0x2a
jge 0x490a57
movzx edx, byte [rsp + rax + 0x3e]
movzx esi, byte [rsp + rax + 0x3f]
mov edi, edx
xor edx, esi
add edx, eax
nop
cmp rdi, 0x20
jae 0x490a7a
movzx r8d, byte [rsp + rdi + 0x1e]
sub r8d, edx
cmp rsi, 0x20
jb 0x490a0c
jmp 0x490a6e
xor eax, eax
lea rbx, [rsp + 0x1e]
mov ecx, 0x20
call fcn.00441380
add rsp, 0x68
pop rbp
ret
mov eax, esi
mov ecx, 0x20
call fcn.00451880
mov eax, edi
mov ecx, 0x20
call fcn.00451880
nop
call fcn.0044f600
jmp fcn.00490960

Function at 0x490aa0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x490bbd
push rbp
mov rbp, rsp
sub rsp, 0x60
movabs rdx, 0x2e4918fb037061b2
mov qword [rsp + 0x1c], rdx
movabs rdx, 0xb3b6ce8820a6c70f
mov qword [rsp + 0x24], rdx
movabs rdx, 0xbb65c6c3c4c1b3b6
mov qword [rsp + 0x2a], rdx
movabs rdx, 0xb78bab1da55de28
mov qword [rsp + 0x32], rdx
movabs rdx, 0x319061d040f0a05
mov qword [rsp + 0x3a], rdx
movabs rdx, 0x160808180f110319
mov qword [rsp + 0x40], rdx
movabs rdx, 0x90615160c101b1d
mov qword [rsp + 0x48], rdx
movabs rdx, 0x19030d10001a170a
mov qword [rsp + 0x50], rdx
movabs rdx, 0x13181b080e0d1612
mov qword [rsp + 0x58], rdx
xor eax, eax
jmp 0x490b60
movzx r9d, byte [rsp + rsi + 0x1c]
sub r9d, edx
lea edx, [r9 - 0x32]
mov byte [rsp + rdi + 0x1c], dl
lea edx, [r8 - 0x32]
mov byte [rsp + rsi + 0x1c], dl
add rax, 2
nop word [rax + rax]
cmp rax, 0x26
jge 0x490b8d
movzx edx, byte [rsp + rax + 0x3a]
movzx esi, byte [rsp + rax + 0x3b]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x1e
jae 0x490bb0
movzx r8d, byte [rsp + rdi + 0x1c]
sub r8d, edx
cmp rsi, 0x1e
jb 0x490b3d
jmp 0x490ba4
xor eax, eax
lea rbx, [rsp + 0x1c]
mov ecx, 0x1e
call fcn.00441380
add rsp, 0x60
pop rbp
ret
mov eax, esi
mov ecx, 0x1e
call fcn.00451880
mov eax, edi
mov ecx, 0x1e
call fcn.00451880
nop
nop dword [rax]
call fcn.0044f600
jmp fcn.00490aa0
Function at 0x491a00
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x491b0c
push rbp
mov rbp, rsp
sub rsp, 0x50
movabs rdx, 0x1a74c1a16c66fbd2
mov qword [rsp + 0x1a], rdx
movabs rdx, 0xaf4391620bca5756
mov qword [rsp + 0x22], rdx
movabs rdx, 0x496eaf4391620bca
mov qword [rsp + 0x24], rdx
movabs rdx, 0x1d63fe66101b0cfb
mov qword [rsp + 0x2c], rdx
movabs rdx, 0x151907050c090f01
mov qword [rsp + 0x34], rdx
movabs rdx, 0xb13000d14120912
mov qword [rsp + 0x3c], rdx
movabs rdx, 0x107010f0b13000d
mov qword [rsp + 0x40], rdx
movabs rdx, 0x17000c04040c070a
mov qword [rsp + 0x48], rdx
xor eax, eax
jmp 0x491aa8
movzx r9d, byte [rsp + rsi + 0x1a]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x43]
mov byte [rsp + rdi + 0x1a], dl
mov byte [rsp + rsi + 0x1a], r8b
add rax, 2
cmp rax, 0x1c
jge 0x491adc
movzx edx, byte [rsp + rax + 0x34]
movzx esi, byte [rsp + rax + 0x35]
mov edi, edx
xor edx, esi
add edx, eax
nop
cmp rdi, 0x1a
jae 0x491aff
movzx r8d, byte [rsp + rdi + 0x1a]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x43]
cmp rsi, 0x1a
jb 0x491a8e
jmp 0x491af3
xor eax, eax
lea rbx, [rsp + 0x1a]
mov ecx, 0x1a
call fcn.00441380
add rsp, 0x50
pop rbp
ret
mov eax, esi
mov ecx, 0x1a
call fcn.00451880
mov eax, edi
mov ecx, 0x1a
call fcn.00451880
nop
call fcn.0044f600
jmp fcn.00491a00
Function at 0x492900
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4929bd
push rbp
mov rbp, rsp
sub rsp, 0x30
movabs rdx, 0x654cb480864d2094
mov qword [rsp + 0x1b], rdx
mov byte [rsp + 0x23], 0xaf
movabs rdx, 0x800040204030502
mov qword [rsp + 0x24], rdx
mov dword [rsp + 0x2c], 0x3020000
xor eax, eax
nop
jmp 0x492960
movzx r9d, byte [rsp + rsi + 0x1b]
sub r9d, edx
lea edx, [r9 - 0x18]
mov byte [rsp + rdi + 0x1b], dl
lea edx, [r8 - 0x18]
mov byte [rsp + rsi + 0x1b], dl
add rax, 2
nop
cmp rax, 0xc
jge 0x49298d
movzx edx, byte [rsp + rax + 0x24]
movzx esi, byte [rsp + rax + 0x25]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 9
jae 0x4929b0
movzx r8d, byte [rsp + rdi + 0x1b]
sub r8d, edx
cmp rsi, 9
jb 0x492942
jmp 0x4929a4
xor eax, eax
lea rbx, [rsp + 0x1b]
mov ecx, 9
call fcn.00441380
add rsp, 0x30
pop rbp
ret
mov eax, esi
mov ecx, 9
call fcn.00451880
mov eax, edi
mov ecx, 9
call fcn.00451880
nop
nop dword [rax]
call fcn.0044f600
jmp fcn.00492900