joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4795a0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x47965d
push rbp
mov rbp, rsp
sub rsp, 0x30
movabs rdx, 0xf50f55726548b149
mov qword [rsp + 0x1b], rdx
mov byte [rsp + 0x23], 0xc4
movabs rdx, 0x207010508060702
mov qword [rsp + 0x24], rdx
mov dword [rsp + 0x2c], 0x2080801
xor eax, eax
nop
jmp 0x479600
movzx r9d, byte [rsp + rsi + 0x1b]
sub r9d, edx
lea edx, [r9 - 0x40]
mov byte [rsp + rdi + 0x1b], dl
lea edx, [r8 - 0x40]
mov byte [rsp + rsi + 0x1b], dl
add rax, 2
nop
cmp rax, 0xc
jge 0x47962d
movzx edx, byte [rsp + rax + 0x24]
movzx esi, byte [rsp + rax + 0x25]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 9
jae 0x479650
movzx r8d, byte [rsp + rdi + 0x1b]
sub r8d, edx
cmp rsi, 9
jb 0x4795e2
jmp 0x479644
xor eax, eax
lea rbx, [rsp + 0x1b]
mov ecx, 9
call fcn.0044bb80
add rsp, 0x30
pop rbp
ret
mov eax, esi
mov ecx, 9
call fcn.004610a0
mov eax, edi
mov ecx, 9
call fcn.004610a0
nop
nop dword [rax]
call fcn.0045ee20
jmp fcn.004795a0

Function at 0x47cec0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
lea r12, [rsp - 0x10]
cmp r12, qword [r14 + 0x10]
jbe 0x47d047
push rbp
mov rbp, rsp
sub rsp, 0x88
movabs rdx, 0xf642b573116c2162
mov qword [rsp + 0x18], rdx
movabs rdx, 0x20a9048d4caff642
mov qword [rsp + 0x1e], rdx
movabs rdx, 0xae20bc1310616572
mov qword [rsp + 0x26], rdx
movabs rdx, 0xf2fa65e572d974a4
mov qword [rsp + 0x2e], rdx
movabs rdx, 0xd7c0699e61d16519
mov qword [rsp + 0x36], rdx
movabs rdx, 0xf87274ff756ff1fa
mov qword [rsp + 0x3e], rdx
movabs rdx, 0x2410655e166ddf00
mov qword [rsp + 0x46], rdx
movabs rdx, 0x2c200913340a1134
mov qword [rsp + 0x4e], rdx
movabs rdx, 0x1151c2d160c0525
mov qword [rsp + 0x56], rdx
movabs rdx, 0x352a01151c2d160c
mov qword [rsp + 0x58], rdx
movabs rdx, 0x16341a32221d2502
mov qword [rsp + 0x60], rdx
movabs rdx, 0x913082c2431352e
mov qword [rsp + 0x68], rdx
movabs rdx, 0xc2e1e1e12010c2a
mov qword [rsp + 0x70], rdx
movabs rdx, 0x2f182734251a030b
mov qword [rsp + 0x78], rdx
movabs rdx, 0x262009070a270807
mov qword [rsp + 0x80], rdx
xor eax, eax
jmp 0x47cfe0
movzx r9d, byte [rsp + rsi + 0x18]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x2f]
mov byte [rsp + rdi + 0x18], dl
mov byte [rsp + rsi + 0x18], r8b
add rax, 2
nop dword [rax]
cmp rax, 0x3a
jge 0x47d012
movzx edx, byte [rsp + rax + 0x4e]
movzx esi, byte [rsp + rax + 0x4f]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x36
jae 0x47d03a
movzx r8d, byte [rsp + rdi + 0x18]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x2f]
cmp rsi, 0x36
jb 0x47cfc2
jmp 0x47d02e
xor eax, eax
lea rbx, [rsp + 0x18]
mov ecx, 0x36
nop
call fcn.0044bb80
add rsp, 0x88
pop rbp
ret
mov eax, esi
mov ecx, 0x36
call fcn.004610a0
mov eax, edi
mov ecx, 0x36
call fcn.004610a0
nop
call fcn.0045ee20
jmp fcn.0047cec0
Function at 0x47eae0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
lea r12, [rsp - 0x28]
cmp r12, qword [r14 + 0x10]
jbe 0x47ec88
push rbp
mov rbp, rsp
sub rsp, 0xa0
movabs rdx, 0x8c537e6f43f96262
mov qword [rsp + 0x1d], rdx
movabs rdx, 0xb0a07b9ff26e638c
mov qword [rsp + 0x24], rdx
movabs rdx, 0x80655f74050f7036
mov qword [rsp + 0x2c], rdx
movabs rdx, 0xb3afc7749fc0dca9
mov qword [rsp + 0x34], rdx
movabs rdx, 0x6989cfbb656e2073
mov qword [rsp + 0x3c], rdx
movabs rdx, 0x2b7c6eb88b5b655e
mov qword [rsp + 0x44], rdx
movabs rdx, 0xac5d756f34b12d63
mov qword [rsp + 0x4c], rdx
movabs rdx, 0x2b16192a021e1e0a
mov qword [rsp + 0x54], rdx
movabs rdx, 0x181731231d122716
mov qword [rsp + 0x5c], rdx
movabs rdx, 0x3224251d18173123
mov qword [rsp + 0x60], rdx
movabs rdx, 0x242a3617080e0b1a
mov qword [rsp + 0x68], rdx
movabs rdx, 0xa322d2a2d1e0d15
mov qword [rsp + 0x70], rdx
movabs rdx, 0xa17142d252a1c0a
mov qword [rsp + 0x78], rdx
movabs rdx, 0x180f16072a16170c
mov qword [rsp + 0x80], rdx
movabs rdx, 0x302c1129220b2519
mov qword [rsp + 0x88], rdx
movabs rdx, 0x1232e142c31141c
mov qword [rsp + 0x90], rdx
movabs rdx, 0xf2a193507080305
mov qword [rsp + 0x98], rdx
xor eax, eax
jmp 0x47ec23
movzx r9d, byte [rsp + rsi + 0x1d]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x5f]
mov byte [rsp + rdi + 0x1d], dl
mov byte [rsp + rsi + 0x1d], r8b
add rax, 2
cmp rax, 0x4c
jge 0x47ec55
movzx edx, byte [rsp + rax + 0x54]
movzx esi, byte [rsp + rax + 0x55]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x37
jae 0x47ec7b
movzx r8d, byte [rsp + rdi + 0x1d]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x5f]
cmp rsi, 0x37
jb 0x47ec09
jmp 0x47ec6f
xor eax, eax
lea rbx, [rsp + 0x1d]
mov ecx, 0x37
call fcn.0044bb80
add rsp, 0xa0
pop rbp
ret
mov eax, esi
mov ecx, 0x37
call fcn.004610a0
mov eax, edi
mov ecx, 0x37
call fcn.004610a0
nop
call fcn.0045ee20
jmp fcn.0047eae0
Function at 0x47eca0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
lea r12, [rsp - 0x28]
cmp r12, qword [r14 + 0x10]
jbe 0x47ee5b
push rbp
mov rbp, rsp
sub rsp, 0xa0
movabs rdx, 0x1e362e6f69cfc9cc
mov qword [rsp + 0x19], rdx
movabs rdx, 0x801291bb1da3ef61
mov qword [rsp + 0x21], rdx
movabs rdx, 0xde15b0801291bb1d
mov qword [rsp + 0x24], rdx
movabs rdx, 0x9ff96563d075d6bb
mov qword [rsp + 0x2c], rdx
movabs rdx, 0x64ae20d76ef94c0e
mov qword [rsp + 0x34], rdx
movabs rdx, 0x56d42024fa6e40e1
mov qword [rsp + 0x3c], rdx
movabs rdx, 0x9d7954db19171ad6
mov qword [rsp + 0x44], rdx
movabs rdx, 0xdf8a70a8cca8646e
mov qword [rsp + 0x4c], rdx
movabs rdx, 0x7292b3914393011
mov qword [rsp + 0x54], rdx
movabs rdx, 0x13092a2601003018
mov qword [rsp + 0x5c], rdx
movabs rdx, 0x924391c13092a26
mov qword [rsp + 0x60], rdx
movabs rdx, 0x2b09191d010b3023
mov qword [rsp + 0x68], rdx
movabs rdx, 0xc272d2e242f1400
mov qword [rsp + 0x70], rdx
movabs rdx, 0x3626140a14060b37
mov qword [rsp + 0x78], rdx
movabs rdx, 0x10021b122c1c3507
mov qword [rsp + 0x80], rdx
movabs rdx, 0x320c1116393a122d
mov qword [rsp + 0x88], rdx
movabs rdx, 0xe0f360d1f1c2c1a
mov qword [rsp + 0x90], rdx
movabs rdx, 0x12129322e02000f
mov qword [rsp + 0x98], rdx
xor eax, eax
jmp 0x47edf2
movzx r9d, byte [rsp + rsi + 0x19]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x5d]
mov byte [rsp + rdi + 0x19], dl
mov byte [rsp + rsi + 0x19], r8b
add rax, 2
cmp rax, 0x4c
jge 0x47ee28
movzx edx, byte [rsp + rax + 0x54]
movzx esi, byte [rsp + rax + 0x55]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x3b
jae 0x47ee4e
movzx r8d, byte [rsp + rdi + 0x19]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x5d]
nop dword [rax]
cmp rsi, 0x3b
jb 0x47edd8
jmp 0x47ee42
xor eax, eax
lea rbx, [rsp + 0x19]
mov ecx, 0x3b
call fcn.0044bb80
add rsp, 0xa0
pop rbp
ret
mov eax, esi
mov ecx, 0x3b
call fcn.004610a0
mov eax, edi
mov ecx, 0x3b
call fcn.004610a0
nop
nop dword [rax + rax]
call fcn.0045ee20
jmp fcn.0047eca0

Function at 0x4829c0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x482aa6
push rbp
mov rbp, rsp
sub rsp, 0x38
movabs rdx, 0xce6421c7610d1569
mov qword [rsp + 0x18], rdx
movabs rdx, 0xbb2822d1c224ce64
mov qword [rsp + 0x1e], rdx
movabs rdx, 0x2050708070b010c
mov qword [rsp + 0x26], rdx
movabs rdx, 0xa0202050708070b
mov qword [rsp + 0x28], rdx
movabs rdx, 0xd040c0509010702
mov qword [rsp + 0x30], rdx
xor eax, eax
nop
jmp 0x482a40
movzx r9d, byte [rsp + rsi + 0x18]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x68]
mov byte [rsp + rdi + 0x18], dl
mov byte [rsp + rsi + 0x18], r8b
add rax, 2
nop dword [rax]
cmp rax, 0x12
jge 0x482a72
movzx edx, byte [rsp + rax + 0x26]
movzx esi, byte [rsp + rax + 0x27]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0xe
jae 0x482a97
movzx r8d, byte [rsp + rdi + 0x18]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x68]
cmp rsi, 0xe
jb 0x482a22
jmp 0x482a8b
xor eax, eax
lea rbx, [rsp + 0x18]
mov ecx, 0xe
nop
call fcn.0044bb80
add rsp, 0x38
pop rbp
ret
mov eax, esi
mov ecx, 0xe
call fcn.004610a0
mov eax, edi
mov ecx, 0xe
nop
call fcn.004610a0
nop
call fcn.0045ee20
jmp fcn.004829c0
Function at 0x4847e0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4848a6
push rbp
mov rbp, rsp
sub rsp, 0x30
movabs rdx, 0x32aefc00c0ff0078
mov qword [rsp + 0x1b], rdx
mov byte [rsp + 0x23], 0xf7
movabs rdx, 0x608080002030401
mov qword [rsp + 0x24], rdx
mov dword [rsp + 0x2c], 0x2080506
xor eax, eax
nop
jmp 0x484840
movzx r9d, byte [rsp + rsi + 0x1b]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x2f]
mov byte [rsp + rdi + 0x1b], dl
mov byte [rsp + rsi + 0x1b], r8b
add rax, 2
nop dword [rax]
cmp rax, 0xc
jge 0x484872
movzx edx, byte [rsp + rax + 0x24]
movzx esi, byte [rsp + rax + 0x25]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 9
jae 0x484897
movzx r8d, byte [rsp + rdi + 0x1b]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x2f]
cmp rsi, 9
jb 0x484822
jmp 0x48488b
xor eax, eax
lea rbx, [rsp + 0x1b]
mov ecx, 9
nop
call fcn.0044bb80
add rsp, 0x30
pop rbp
ret
mov eax, esi
mov ecx, 9
call fcn.004610a0
mov eax, edi
mov ecx, 9
nop
call fcn.004610a0
nop
call fcn.0045ee20
jmp fcn.004847e0

Function at 0x4856a0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x485786
push rbp
mov rbp, rsp
sub rsp, 0x38
movabs rdx, 0xe4a534eaeb333595
mov qword [rsp + 0x18], rdx
movabs rdx, 0xf8fbf10a9f93e4a5
mov qword [rsp + 0x1e], rdx
movabs rdx, 0x8060b00090a0c0d
mov qword [rsp + 0x26], rdx
movabs rdx, 0x80908060b00090a
mov qword [rsp + 0x28], rdx
movabs rdx, 0x60b0a0704030807
mov qword [rsp + 0x30], rdx
xor eax, eax
nop
jmp 0x485720
movzx r9d, byte [rsp + rsi + 0x18]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x39]
mov byte [rsp + rdi + 0x18], dl
mov byte [rsp + rsi + 0x18], r8b
add rax, 2
nop dword [rax]
cmp rax, 0x12
jge 0x485752
movzx edx, byte [rsp + rax + 0x26]
movzx esi, byte [rsp + rax + 0x27]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0xe
jae 0x485777
movzx r8d, byte [rsp + rdi + 0x18]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x39]
cmp rsi, 0xe
jb 0x485702
jmp 0x48576b
xor eax, eax
lea rbx, [rsp + 0x18]
mov ecx, 0xe
nop
call fcn.0044bb80
add rsp, 0x38
pop rbp
ret
mov eax, esi
mov ecx, 0xe
call fcn.004610a0
mov eax, edi
mov ecx, 0xe
nop
call fcn.004610a0
nop
call fcn.0045ee20
jmp fcn.004856a0
Function at 0x487180
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x48726a
push rbp
mov rbp, rsp
sub rsp, 0x48
movabs rdx, 0x342730695f328a7e
mov qword [rsp + 0x19], rdx
movabs rdx, 0x5f3638334b367b34
mov qword [rsp + 0x20], rdx
movabs rdx, 0x35ae685658389866
mov qword [rsp + 0x28], rdx
movabs rdx, 0x100106150a080012
mov qword [rsp + 0x30], rdx
movabs rdx, 0x1401140615131506
mov qword [rsp + 0x38], rdx
movabs rdx, 0x301040f0a0e1210
mov qword [rsp + 0x40], rdx
xor eax, eax
jmp 0x48720d
movzx r9d, byte [rsp + rsi + 0x19]
sub r9d, edx
lea edx, [r9 - 0x14]
mov byte [rsp + rdi + 0x19], dl
lea edx, [r8 - 0x14]
mov byte [rsp + rsi + 0x19], dl
add rax, 2
cmp rax, 0x18
jge 0x48723a
movzx edx, byte [rsp + rax + 0x30]
movzx esi, byte [rsp + rax + 0x31]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x17
jae 0x48725d
movzx r8d, byte [rsp + rdi + 0x19]
sub r8d, edx
cmp rsi, 0x17
jb 0x4871f0
jmp 0x487251
xor eax, eax
lea rbx, [rsp + 0x19]
mov ecx, 0x17
call fcn.0044bb80
add rsp, 0x48
pop rbp
ret
mov eax, esi
mov ecx, 0x17
call fcn.004610a0
mov eax, edi
mov ecx, 0x17
call fcn.004610a0
nop
call fcn.0045ee20
jmp fcn.00487180

Function at 0x487280
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x48737d
push rbp
mov rbp, rsp
sub rsp, 0x50
movabs rdx, 0x191d361b1e283835
mov qword [rsp + 0x1a], rdx
movabs rdx, 0x142d2336442e2839
mov qword [rsp + 0x22], rdx
movabs rdx, 0x2d32423537291f1b
mov qword [rsp + 0x2a], rdx
movabs rdx, 0x120406120f0f1109
mov qword [rsp + 0x32], rdx
movabs rdx, 0xf02030710120710
mov qword [rsp + 0x3a], rdx
movabs rdx, 0xf040b150d090f02
mov qword [rsp + 0x40], rdx
movabs rdx, 0x60417170a0e1302
mov qword [rsp + 0x48], rdx
xor eax, eax
jmp 0x487320
movzx r9d, byte [rsp + rsi + 0x1a]
sub r9d, edx
lea edx, [r9 + 0x22]
mov byte [rsp + rdi + 0x1a], dl
lea edx, [r8 + 0x22]
mov byte [rsp + rsi + 0x1a], dl
add rax, 2
nop dword [rax]
cmp rax, 0x1e
jge 0x48734d
movzx edx, byte [rsp + rax + 0x32]
movzx esi, byte [rsp + rax + 0x33]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x18
jae 0x487370
movzx r8d, byte [rsp + rdi + 0x1a]
sub r8d, edx
cmp rsi, 0x18
jb 0x4872ff
jmp 0x487364
xor eax, eax
lea rbx, [rsp + 0x1a]
mov ecx, 0x18
call fcn.0044bb80
add rsp, 0x50
pop rbp
ret
mov eax, esi
mov ecx, 0x18
call fcn.004610a0
mov eax, edi
mov ecx, 0x18
call fcn.004610a0
nop
nop dword [rax]
call fcn.0045ee20
jmp fcn.00487280
Function at 0x487d60
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x487e7a
push rbp
mov rbp, rsp
sub rsp, 0x58
movabs rdx, 0x3857f8ae4b333625
mov qword [rsp + 0x19], rdx
movabs rdx, 0x32314831396e3f4f
mov qword [rsp + 0x21], rdx
movabs rdx, 0x3152c83231483139
mov qword [rsp + 0x24], rdx
movabs rdx, 0xb43536d931c32b55
mov qword [rsp + 0x2c], rdx
movabs rdx, 0x1317110d03080a03
mov qword [rsp + 0x34], rdx
movabs rdx, 0x509000d1317110d
mov qword [rsp + 0x38], rdx
movabs rdx, 0x1510171009170615
mov qword [rsp + 0x40], rdx
movabs rdx, 0x1315140a1911031a
mov qword [rsp + 0x48], rdx
movabs rdx, 0x150511050a04110d
mov qword [rsp + 0x50], rdx
xor eax, eax
jmp 0x487e17
movzx r9d, byte [rsp + rsi + 0x19]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x56]
mov byte [rsp + rdi + 0x19], dl
mov byte [rsp + rsi + 0x19], r8b
add rax, 2
cmp rax, 0x24
jge 0x487e49
movzx edx, byte [rsp + rax + 0x34]
movzx esi, byte [rsp + rax + 0x35]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x1b
jae 0x487e6d
movzx r8d, byte [rsp + rdi + 0x19]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x56]
cmp rsi, 0x1b
jb 0x487dfd
jmp 0x487e61
xor eax, eax
lea rbx, [rsp + 0x19]
mov ecx, 0x1b
call fcn.0044bb80
add rsp, 0x58
pop rbp
nop
ret
mov eax, esi
mov ecx, 0x1b
call fcn.004610a0
mov eax, edi
mov ecx, 0x1b
call fcn.004610a0
nop
call fcn.0045ee20
nop
jmp fcn.00487d60

Function at 0x4880e0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4881fd
push rbp
mov rbp, rsp
sub rsp, 0x60
movabs rdx, 0x4c3b2f3743762e5e
mov qword [rsp + 0x1e], rdx
movabs rdx, 0x3039333243343435
mov qword [rsp + 0x26], rdx
movabs rdx, 0x4130632129233039
mov qword [rsp + 0x2c], rdx
movabs rdx, 0x61182d3335363935
mov qword [rsp + 0x34], rdx
movabs rdx, 0xe191c111c1c0714
mov qword [rsp + 0x3c], rdx
movabs rdx, 0x1b1218100e191c11
mov qword [rsp + 0x40], rdx
movabs rdx, 0x51005061b18001d
mov qword [rsp + 0x48], rdx
movabs rdx, 0x1d021301011a18
mov qword [rsp + 0x50], rdx
movabs rdx, 0xb03021413151302
mov qword [rsp + 0x58], rdx
xor eax, eax
jmp 0x4881a0
movzx r9d, byte [rsp + rsi + 0x1e]
sub r9d, edx
lea edx, [r9 + 0x1a]
mov byte [rsp + rdi + 0x1e], dl
lea edx, [r8 + 0x1a]
mov byte [rsp + rsi + 0x1e], dl
add rax, 2
nop word [rax + rax]
cmp rax, 0x24
jge 0x4881cd
movzx edx, byte [rsp + rax + 0x3c]
movzx esi, byte [rsp + rax + 0x3d]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x1e
jae 0x4881f0
movzx r8d, byte [rsp + rdi + 0x1e]
sub r8d, edx
cmp rsi, 0x1e
jb 0x48817d
jmp 0x4881e4
xor eax, eax
lea rbx, [rsp + 0x1e]
mov ecx, 0x1e
call fcn.0044bb80
add rsp, 0x60
pop rbp
ret
mov eax, esi
mov ecx, 0x1e
call fcn.004610a0
mov eax, edi
mov ecx, 0x1e
call fcn.004610a0
nop
nop dword [rax]
call fcn.0045ee20
jmp fcn.004880e0
Function at 0x4886e0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4887fa
push rbp
mov rbp, rsp
sub rsp, 0x60
movabs rdx, 0xbaa5b071acf6bba0
mov qword [rsp + 0x18], rdx
movabs rdx, 0x9d308293f68f95aa
mov qword [rsp + 0x20], rdx
movabs rdx, 0xae34a438347e0c37
mov qword [rsp + 0x28], rdx
movabs rdx, 0xb00e619097f0a888
mov qword [rsp + 0x30], rdx
movabs rdx, 0x121f1e001d080417
mov qword [rsp + 0x38], rdx
movabs rdx, 0x111f0305030d0701
mov qword [rsp + 0x40], rdx
movabs rdx, 0x91702170b061519
mov qword [rsp + 0x48], rdx
movabs rdx, 0x61b051a1b080f1f
mov qword [rsp + 0x50], rdx
movabs rdx, 0x180a021105000c1c
mov qword [rsp + 0x58], rdx
xor eax, eax
jmp 0x488797
movzx r9d, byte [rsp + rsi + 0x18]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x70]
mov byte [rsp + rdi + 0x18], dl
mov byte [rsp + rsi + 0x18], r8b
add rax, 2
cmp rax, 0x28
jge 0x4887c9
movzx edx, byte [rsp + rax + 0x38]
movzx esi, byte [rsp + rax + 0x39]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x20
jae 0x4887ed
movzx r8d, byte [rsp + rdi + 0x18]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x70]
cmp rsi, 0x20
jb 0x48877d
jmp 0x4887e1
xor eax, eax
lea rbx, [rsp + 0x18]
mov ecx, 0x20
call fcn.0044bb80
add rsp, 0x60
pop rbp
nop
ret
mov eax, esi
mov ecx, 0x20
call fcn.004610a0
mov eax, edi
mov ecx, 0x20
call fcn.004610a0
nop
call fcn.0045ee20
nop
jmp fcn.004886e0
Function at 0x4896c0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4897f8
push rbp
mov rbp, rsp
sub rsp, 0x70
movabs rdx, 0xeaf73a230737375c
mov qword [rsp + 0x1f], rdx
movabs rdx, 0xe83933eaf73a2307
mov qword [rsp + 0x22], rdx
movabs rdx, 0xf100faac7be8c230
mov qword [rsp + 0x2a], rdx
movabs rdx, 0x6eeea8a8ecfcd1b7
mov qword [rsp + 0x32], rdx
movabs rdx, 0x353231a235f33938
mov qword [rsp + 0x3a], rdx
movabs rdx, 0x140e150c131a0013
mov qword [rsp + 0x42], rdx
movabs rdx, 0x1f111a1a030e1a05
mov qword [rsp + 0x4a], rdx
movabs rdx, 0x1a0f1706041d1f11
mov qword [rsp + 0x50], rdx
movabs rdx, 0xa0a0a14071a1d10
mov qword [rsp + 0x58], rdx
movabs rdx, 0x1916101512051218
mov qword [rsp + 0x60], rdx
movabs rdx, 0x60d150006130f11
mov qword [rsp + 0x68], rdx
xor eax, eax
jmp 0x489795
movzx r9d, byte [rsp + rsi + 0x1f]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x17]
mov byte [rsp + rdi + 0x1f], dl
mov byte [rsp + rsi + 0x1f], r8b
add rax, 2
cmp rax, 0x2e
jge 0x4897c8
movzx edx, byte [rsp + rax + 0x42]
movzx esi, byte [rsp + rax + 0x43]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x23
jae 0x4897eb
movzx r8d, byte [rsp + rdi + 0x1f]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x17]
nop
cmp rsi, 0x23
jb 0x48977b
jmp 0x4897df
xor eax, eax
lea rbx, [rsp + 0x1f]
mov ecx, 0x23
call fcn.0044bb80
add rsp, 0x70
pop rbp
ret
mov eax, esi
mov ecx, 0x23
call fcn.004610a0
mov eax, edi
mov ecx, 0x23
call fcn.004610a0
nop
call fcn.0045ee20
nop dword [rax]
jmp fcn.004896c0

Function at 0x48b140
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x48b28c
push rbp
mov rbp, rsp
sub rsp, 0x70
movabs rdx, 0x3e27da37343376ea
mov qword [rsp + 0x1a], rdx
movabs rdx, 0x37308bef37e0dbe3
mov qword [rsp + 0x22], rdx
movabs rdx, 0xa13037308bef37e0
mov qword [rsp + 0x24], rdx
movabs rdx, 0x4af1328174310634
mov qword [rsp + 0x2c], rdx
movabs rdx, 0x7730ba823933f102
mov qword [rsp + 0x34], rdx
movabs rdx, 0xdc89e5edbfbbd837
mov qword [rsp + 0x3c], rdx
movabs rdx, 0x11080a211a130826
mov qword [rsp + 0x44], rdx
movabs rdx, 0x280d2901180c0727
mov qword [rsp + 0x4c], rdx
movabs rdx, 0x19250615280d2901
mov qword [rsp + 0x50], rdx
movabs rdx, 0xd091e2827161b
mov qword [rsp + 0x58], rdx
movabs rdx, 0x110915050a291f24
mov qword [rsp + 0x60], rdx
movabs rdx, 0x250623280908051b
mov qword [rsp + 0x68], rdx
xor eax, eax
jmp 0x48b224
movzx r9d, byte [rsp + rsi + 0x1a]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x27]
mov byte [rsp + rdi + 0x1a], dl
mov byte [rsp + rsi + 0x1a], r8b
add rax, 2
cmp rax, 0x2c
jge 0x48b25c
movzx edx, byte [rsp + rax + 0x44]
movzx esi, byte [rsp + rax + 0x45]
mov edi, edx
xor edx, esi
add edx, eax
nop word [rax + rax]
cmp rdi, 0x2a
jae 0x48b27f
movzx r8d, byte [rsp + rdi + 0x1a]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x27]
cmp rsi, 0x2a
jb 0x48b20a
jmp 0x48b273
xor eax, eax
lea rbx, [rsp + 0x1a]
mov ecx, 0x2a
call fcn.0044bb80
add rsp, 0x70
pop rbp
ret
mov eax, esi
mov ecx, 0x2a
call fcn.004610a0
mov eax, edi
mov ecx, 0x2a
call fcn.004610a0
nop
call fcn.0045ee20
jmp fcn.0048b140
Function at 0x491ac0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x491b9d
push rbp
mov rbp, rsp
sub rsp, 0x40
movabs rdx, 0x3757171a0f326230
mov qword [rsp + 0x1a], rdx
movabs rdx, 0x664bf318502c3955
mov qword [rsp + 0x22], rdx
movabs rdx, 0x3050b0c0e04050d
mov qword [rsp + 0x2a], rdx
movabs rdx, 0x40e030e060a0305
mov qword [rsp + 0x30], rdx
movabs rdx, 0x40104050d01080b
mov qword [rsp + 0x38], rdx
xor eax, eax
nop
jmp 0x491b40
movzx r9d, byte [rsp + rsi + 0x1a]
sub r9d, edx
lea edx, [r9 + 0x1e]
mov byte [rsp + rdi + 0x1a], dl
lea edx, [r8 + 0x1e]
mov byte [rsp + rsi + 0x1a], dl
add rax, 2
nop
cmp rax, 0x16
jge 0x491b6d
movzx edx, byte [rsp + rax + 0x2a]
movzx esi, byte [rsp + rax + 0x2b]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x10
jae 0x491b90
movzx r8d, byte [rsp + rdi + 0x1a]
sub r8d, edx
cmp rsi, 0x10
jb 0x491b22
jmp 0x491b84
xor eax, eax
lea rbx, [rsp + 0x1a]
mov ecx, 0x10
call fcn.0044bb80
add rsp, 0x40
pop rbp
ret
mov eax, esi
mov ecx, 0x10
call fcn.004610a0
mov eax, edi
mov ecx, 0x10
call fcn.004610a0
nop
nop dword [rax]
call fcn.0045ee20
jmp fcn.00491ac0

Function at 0x492cc0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x492d7d
push rbp
mov rbp, rsp
sub rsp, 0x30
movabs rdx, 0x6ef60aa11b949d14
mov qword [rsp + 0x1b], rdx
mov byte [rsp + 0x23], 0x1a
movabs rdx, 0x605080304010401
mov qword [rsp + 0x24], rdx
mov dword [rsp + 0x2c], 2
xor eax, eax
nop
jmp 0x492d20
movzx r9d, byte [rsp + rsi + 0x1b]
sub r9d, edx
lea edx, [r9 + 0x68]
mov byte [rsp + rdi + 0x1b], dl
lea edx, [r8 + 0x68]
mov byte [rsp + rsi + 0x1b], dl
add rax, 2
nop
cmp rax, 0xc
jge 0x492d4d
movzx edx, byte [rsp + rax + 0x24]
movzx esi, byte [rsp + rax + 0x25]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 9
jae 0x492d70
movzx r8d, byte [rsp + rdi + 0x1b]
sub r8d, edx
cmp rsi, 9
jb 0x492d02
jmp 0x492d64
xor eax, eax
lea rbx, [rsp + 0x1b]
mov ecx, 9
call fcn.0044bb80
add rsp, 0x30
pop rbp
ret
mov eax, esi
mov ecx, 9
call fcn.004610a0
mov eax, edi
mov ecx, 9
call fcn.004610a0
nop
nop dword [rax]
call fcn.0045ee20
jmp fcn.00492cc0

Function at 0x493580
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x493646
push rbp
mov rbp, rsp
sub rsp, 0x30
movabs rdx, 0xf87c6486fded6150
mov qword [rsp + 0x1d], rdx
mov byte [rsp + 0x25], 0xd2
movabs rdx, 0x805030204020706
mov qword [rsp + 0x26], rdx
mov word [rsp + 0x2e], 0x708
xor eax, eax
nop
jmp 0x4935e0
movzx r9d, byte [rsp + rsi + 0x1d]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x70]
mov byte [rsp + rdi + 0x1d], dl
mov byte [rsp + rsi + 0x1d], r8b
add rax, 2
nop dword [rax]
cmp rax, 0xa
jge 0x493612
movzx edx, byte [rsp + rax + 0x26]
movzx esi, byte [rsp + rax + 0x27]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 9
jae 0x493637
movzx r8d, byte [rsp + rdi + 0x1d]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x70]
cmp rsi, 9
jb 0x4935c2
jmp 0x49362b
xor eax, eax
lea rbx, [rsp + 0x1d]
mov ecx, 9
nop
call fcn.0044bb80
add rsp, 0x30
pop rbp
ret
mov eax, esi
mov ecx, 9
call fcn.004610a0
mov eax, edi
mov ecx, 9
nop
call fcn.004610a0
nop
call fcn.0045ee20
jmp fcn.00493580
Function at 0x493960
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x493a2c
push rbp
mov rbp, rsp
sub rsp, 0x38
movabs rdx, 0x32649a9caf766ebb
mov qword [rsp + 0x1b], rdx
movabs rdx, 0x9565edfc6232649a
mov qword [rsp + 0x20], rdx
movabs rdx, 0x703090a05090504
mov qword [rsp + 0x28], rdx
movabs rdx, 0xa040000000c0a03
mov qword [rsp + 0x30], rdx
xor eax, eax
jmp 0x4939cf
movzx r9d, byte [rsp + rsi + 0x1b]
sub r9d, edx
lea edx, [r9 + 0x7b]
mov byte [rsp + rdi + 0x1b], dl
lea edx, [r8 + 0x7b]
mov byte [rsp + rsi + 0x1b], dl
add rax, 2
cmp rax, 0x10
jge 0x4939fc
movzx edx, byte [rsp + rax + 0x28]
movzx esi, byte [rsp + rax + 0x29]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0xd
jae 0x493a1f
movzx r8d, byte [rsp + rdi + 0x1b]
sub r8d, edx
cmp rsi, 0xd
jb 0x4939b2
jmp 0x493a13
xor eax, eax
lea rbx, [rsp + 0x1b]
mov ecx, 0xd
call fcn.0044bb80
add rsp, 0x38
pop rbp
ret
mov eax, esi
mov ecx, 0xd
call fcn.004610a0
mov eax, edi
mov ecx, 0xd
call fcn.004610a0
nop
call fcn.0045ee20
jmp fcn.00493960