joyce8/EMBER2024-capa huggingface dataset:
Function at 0x469f60
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x46a068
push rbp
mov rbp, rsp
sub rsp, 0x58
movabs rdx, 0x4c754d43205b593b
mov qword [rsp + 0x1a], rdx
movabs rdx, 0xa486f201258556c
mov qword [rsp + 0x22], rdx
movabs rdx, 0x6b635b6c56080a48
mov qword [rsp + 0x28], rdx
movabs rdx, 0x784e744f32202155
mov qword [rsp + 0x30], rdx
movabs rdx, 0x100f091a0e17040b
mov qword [rsp + 0x38], rdx
movabs rdx, 0x160e000302191105
mov qword [rsp + 0x40], rdx
movabs rdx, 0x161c110f0a000207
mov qword [rsp + 0x48], rdx
movabs rdx, 0x510010707130f11
mov qword [rsp + 0x50], rdx
xor eax, eax
jmp 0x46a00b
movzx r9d, byte [rsp + rsi + 0x1a]
sub r9d, edx
lea edx, [r9 + 0x37]
mov byte [rsp + rdi + 0x1a], dl
lea edx, [r8 + 0x37]
mov byte [rsp + rsi + 0x1a], dl
add rax, 2
cmp rax, 0x20
jge 0x46a038
movzx edx, byte [rsp + rax + 0x38]
movzx esi, byte [rsp + rax + 0x39]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x1e
jae 0x46a05b
movzx r8d, byte [rsp + rdi + 0x1a]
sub r8d, edx
cmp rsi, 0x1e
jb 0x469fee
jmp 0x46a04f
xor eax, eax
lea rbx, [rsp + 0x1a]
mov ecx, 0x1e
call fcn.0044c4e0
add rsp, 0x58
pop rbp
ret
mov eax, esi
mov ecx, 0x1e
call fcn.004617c0
mov eax, edi
mov ecx, 0x1e
call fcn.004617c0
nop
call fcn.0045f540
jmp fcn.00469f60

Function at 0x46a660
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x46a75d
push rbp
mov rbp, rsp
sub rsp, 0x48
movabs rdx, 0x206460e161976ef3
mov qword [rsp + 0x1a], rdx
movabs rdx, 0x113e477206460e1
mov qword [rsp + 0x1e], rdx
movabs rdx, 0x266c070ca7e876ef
mov qword [rsp + 0x26], rdx
movabs rdx, 0x130b000e090e0d0e
mov qword [rsp + 0x2e], rdx
movabs rdx, 0x2110004110b0504
mov qword [rsp + 0x36], rdx
movabs rdx, 0x90902110004110b
mov qword [rsp + 0x38], rdx
movabs rdx, 0xc0f0f0d110a0910
mov qword [rsp + 0x40], rdx
xor eax, eax
jmp 0x46a700
movzx r9d, byte [rsp + rsi + 0x1a]
sub r9d, edx
lea edx, [r9 - 0x6f]
mov byte [rsp + rdi + 0x1a], dl
lea edx, [r8 - 0x6f]
mov byte [rsp + rsi + 0x1a], dl
add rax, 2
nop dword [rax]
cmp rax, 0x1a
jge 0x46a72d
movzx edx, byte [rsp + rax + 0x2e]
movzx esi, byte [rsp + rax + 0x2f]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x14
jae 0x46a750
movzx r8d, byte [rsp + rdi + 0x1a]
sub r8d, edx
cmp rsi, 0x14
jb 0x46a6df
jmp 0x46a744
xor eax, eax
lea rbx, [rsp + 0x1a]
mov ecx, 0x14
call fcn.0044c4e0
add rsp, 0x48
pop rbp
ret
mov eax, esi
mov ecx, 0x14
call fcn.004617c0
mov eax, edi
mov ecx, 0x14
call fcn.004617c0
nop
nop dword [rax]
call fcn.0045f540
jmp fcn.0046a660
Function at 0x46a780
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x46a85d
push rbp
mov rbp, rsp
sub rsp, 0x38
movabs rdx, 0xa0316570781b3475
mov qword [rsp + 0x18], rdx
movabs rdx, 0xb12726f66465a031
mov qword [rsp + 0x1e], rdx
movabs rdx, 0xc0b060601020a0d
mov qword [rsp + 0x26], rdx
movabs rdx, 0x1070c0b06060102
mov qword [rsp + 0x28], rdx
movabs rdx, 0xd0b0b01010a010a
mov qword [rsp + 0x30], rdx
xor eax, eax
nop
jmp 0x46a800
movzx r9d, byte [rsp + rsi + 0x18]
sub r9d, edx
lea edx, [r9 + 0x36]
mov byte [rsp + rdi + 0x18], dl
lea edx, [r8 + 0x36]
mov byte [rsp + rsi + 0x18], dl
add rax, 2
nop
cmp rax, 0x12
jge 0x46a82d
movzx edx, byte [rsp + rax + 0x26]
movzx esi, byte [rsp + rax + 0x27]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0xe
jae 0x46a850
movzx r8d, byte [rsp + rdi + 0x18]
sub r8d, edx
cmp rsi, 0xe
jb 0x46a7e2
jmp 0x46a844
xor eax, eax
lea rbx, [rsp + 0x18]
mov ecx, 0xe
call fcn.0044c4e0
add rsp, 0x38
pop rbp
ret
mov eax, esi
mov ecx, 0xe
call fcn.004617c0
mov eax, edi
mov ecx, 0xe
call fcn.004617c0
nop
nop dword [rax]
call fcn.0045f540
jmp fcn.0046a780

Function at 0x46c3a0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x46c45d
push rbp
mov rbp, rsp
sub rsp, 0x30
movabs rdx, 0xe956f78b737361aa
mov qword [rsp + 0x1d], rdx
mov byte [rsp + 0x25], 0xf6
movabs rdx, 0x400080807070805
mov qword [rsp + 0x26], rdx
mov word [rsp + 0x2e], 0x705
xor eax, eax
nop
jmp 0x46c400
movzx r9d, byte [rsp + rsi + 0x1d]
sub r9d, edx
lea edx, [r9 - 0x3f]
mov byte [rsp + rdi + 0x1d], dl
lea edx, [r8 - 0x3f]
mov byte [rsp + rsi + 0x1d], dl
add rax, 2
nop
cmp rax, 0xa
jge 0x46c42d
movzx edx, byte [rsp + rax + 0x26]
movzx esi, byte [rsp + rax + 0x27]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 9
jae 0x46c450
movzx r8d, byte [rsp + rdi + 0x1d]
sub r8d, edx
cmp rsi, 9
jb 0x46c3e2
jmp 0x46c444
xor eax, eax
lea rbx, [rsp + 0x1d]
mov ecx, 9
call fcn.0044c4e0
add rsp, 0x30
pop rbp
ret
mov eax, esi
mov ecx, 9
call fcn.004617c0
mov eax, edi
mov ecx, 9
call fcn.004617c0
nop
nop dword [rax]
call fcn.0045f540
jmp fcn.0046c3a0
Function at 0x46efa0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x46f07d
push rbp
mov rbp, rsp
sub rsp, 0x40
movabs rdx, 0x8e890ca5a16ea3cc
mov qword [rsp + 0x1f], rdx
movabs rdx, 0xa9c8989d69956f8e
mov qword [rsp + 0x26], rdx
movabs rdx, 0x90903060e010d
mov qword [rsp + 0x2e], rdx
movabs rdx, 0x50b00090903060e
mov qword [rsp + 0x30], rdx
movabs rdx, 0x6070409010c040b
mov qword [rsp + 0x38], rdx
xor eax, eax
nop
jmp 0x46f020
movzx r9d, byte [rsp + rsi + 0x1f]
sub r9d, edx
lea edx, [r9 - 0x1e]
mov byte [rsp + rdi + 0x1f], dl
lea edx, [r8 - 0x1e]
mov byte [rsp + rsi + 0x1f], dl
add rax, 2
nop
cmp rax, 0x12
jge 0x46f04d
movzx edx, byte [rsp + rax + 0x2e]
movzx esi, byte [rsp + rax + 0x2f]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0xf
jae 0x46f070
movzx r8d, byte [rsp + rdi + 0x1f]
sub r8d, edx
cmp rsi, 0xf
jb 0x46f002
jmp 0x46f064
xor eax, eax
lea rbx, [rsp + 0x1f]
mov ecx, 0xf
call fcn.0044c4e0
add rsp, 0x40
pop rbp
ret
mov eax, esi
mov ecx, 0xf
call fcn.004617c0
mov eax, edi
mov ecx, 0xf
call fcn.004617c0
nop
nop dword [rax]
call fcn.0045f540
jmp fcn.0046efa0

Function at 0x46f6c0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x46f787
push rbp
mov rbp, rsp
sub rsp, 0x30
movabs rdx, 0x4b35736fd73cb84b
mov qword [rsp + 0x18], rdx
mov word [rsp + 0x20], 0x4257
movabs rdx, 0x708090106020103
mov qword [rsp + 0x22], rdx
movabs rdx, 0x900000900030708
mov qword [rsp + 0x28], rdx
xor eax, eax
jmp 0x46f727
movzx r9d, byte [rsp + rsi + 0x18]
sub r9d, edx
lea edx, [r9 + 0x32]
mov byte [rsp + rdi + 0x18], dl
lea edx, [r8 + 0x32]
mov byte [rsp + rsi + 0x18], dl
add rax, 2
cmp rax, 0xe
jge 0x46f757
movzx edx, byte [rsp + rax + 0x22]
movzx esi, byte [rsp + rax + 0x23]
mov edi, edx
xor edx, esi
add edx, eax
nop dword [rax]
cmp rdi, 0xa
jae 0x46f77a
movzx r8d, byte [rsp + rdi + 0x18]
sub r8d, edx
cmp rsi, 0xa
jb 0x46f70a
jmp 0x46f76e
xor eax, eax
lea rbx, [rsp + 0x18]
mov ecx, 0xa
call fcn.0044c4e0
add rsp, 0x30
pop rbp
ret
mov eax, esi
mov ecx, 0xa
call fcn.004617c0
mov eax, edi
mov ecx, 0xa
call fcn.004617c0
nop
call fcn.0045f540
jmp fcn.0046f6c0

Function at 0x470380
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x470446
push rbp
mov rbp, rsp
sub rsp, 0x30
movabs rdx, 0xaf6c61f78e6c61a0
mov qword [rsp + 0x1b], rdx
mov byte [rsp + 0x23], 0x6d
movabs rdx, 0x7000407030707
mov qword [rsp + 0x24], rdx
mov dword [rsp + 0x2c], 0x4070707
xor eax, eax
nop
jmp 0x4703e0
movzx r9d, byte [rsp + rsi + 0x1b]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x2a]
mov byte [rsp + rdi + 0x1b], dl
mov byte [rsp + rsi + 0x1b], r8b
add rax, 2
nop dword [rax]
cmp rax, 0xc
jge 0x470412
movzx edx, byte [rsp + rax + 0x24]
movzx esi, byte [rsp + rax + 0x25]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 9
jae 0x470437
movzx r8d, byte [rsp + rdi + 0x1b]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x2a]
cmp rsi, 9
jb 0x4703c2
jmp 0x47042b
xor eax, eax
lea rbx, [rsp + 0x1b]
mov ecx, 9
nop
call fcn.0044c4e0
add rsp, 0x30
pop rbp
ret
mov eax, esi
mov ecx, 9
call fcn.004617c0
mov eax, edi
mov ecx, 9
nop
call fcn.004617c0
nop
call fcn.0045f540
jmp fcn.00470380
Function at 0x472040
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x47212c
push rbp
mov rbp, rsp
sub rsp, 0x40
movabs rdx, 0x95807f785f645f80
mov qword [rsp + 0x19], rdx
movabs rdx, 0x8c95807f785f645f
mov qword [rsp + 0x1a], rdx
movabs rdx, 0x867a668a7b72a486
mov qword [rsp + 0x22], rdx
movabs rdx, 0xe000909010a1008
mov qword [rsp + 0x2a], rdx
movabs rdx, 0x40d07070d050e00
mov qword [rsp + 0x30], rdx
movabs rdx, 0xc080f0f01061008
mov qword [rsp + 0x38], rdx
xor eax, eax
jmp 0x4720ca
movzx r9d, byte [rsp + rsi + 0x19]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x2b]
mov byte [rsp + rdi + 0x19], dl
mov byte [rsp + rsi + 0x19], r8b
add rax, 2
cmp rax, 0x16
jge 0x4720fc
movzx edx, byte [rsp + rax + 0x2a]
movzx esi, byte [rsp + rax + 0x2b]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x11
jae 0x47211f
movzx r8d, byte [rsp + rdi + 0x19]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x2b]
cmp rsi, 0x11
jb 0x4720b0
jmp 0x472113
xor eax, eax
lea rbx, [rsp + 0x19]
mov ecx, 0x11
call fcn.0044c4e0
add rsp, 0x40
pop rbp
ret
mov eax, esi
mov ecx, 0x11
call fcn.004617c0
mov eax, edi
mov ecx, 0x11
call fcn.004617c0
nop
call fcn.0045f540
jmp fcn.00472040

Function at 0x472280
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x472352
push rbp
mov rbp, rsp
sub rsp, 0x38
movabs rdx, 0x772b704af486c4f
mov qword [rsp + 0x1d], rdx
movabs rdx, 0xffe54c0772b704af
mov qword [rsp + 0x20], rdx
movabs rdx, 0x708030902050a07
mov qword [rsp + 0x28], rdx
movabs rdx, 0x4030504070a0704
mov qword [rsp + 0x30], rdx
xor eax, eax
jmp 0x4722ec
movzx r9d, byte [rsp + rsi + 0x1d]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x5c]
mov byte [rsp + rdi + 0x1d], dl
mov byte [rsp + rsi + 0x1d], r8b
add rax, 2
cmp rax, 0x10
jge 0x47231e
movzx edx, byte [rsp + rax + 0x28]
movzx esi, byte [rsp + rax + 0x29]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0xb
jae 0x472345
movzx r8d, byte [rsp + rdi + 0x1d]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x5c]
cmp rsi, 0xb
jb 0x4722d2
jmp 0x472335
xor eax, eax
lea rbx, [rsp + 0x1d]
mov ecx, 0xb
call fcn.0044c4e0
add rsp, 0x38
pop rbp
ret
mov eax, esi
mov ecx, 0xb
nop dword [rax]
call fcn.004617c0
mov eax, edi
mov ecx, 0xb
call fcn.004617c0
nop
call fcn.0045f540
jmp fcn.00472280
Function at 0x4726c0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x47277d
push rbp
mov rbp, rsp
sub rsp, 0x30
movabs rdx, 0xf71cd6135f646c33
mov qword [rsp + 0x1a], rdx
mov word [rsp + 0x22], 0x23f
movabs rdx, 0x900070004040805
mov qword [rsp + 0x24], rdx
mov dword [rsp + 0x2c], 0x6000008
xor eax, eax
jmp 0x472720
movzx r9d, byte [rsp + rsi + 0x1a]
sub r9d, edx
lea edx, [r9 + 0x43]
mov byte [rsp + rdi + 0x1a], dl
lea edx, [r8 + 0x43]
mov byte [rsp + rsi + 0x1a], dl
add rax, 2
cmp rax, 0xc
jge 0x47274d
movzx edx, byte [rsp + rax + 0x24]
movzx esi, byte [rsp + rax + 0x25]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0xa
jae 0x472770
movzx r8d, byte [rsp + rdi + 0x1a]
sub r8d, edx
cmp rsi, 0xa
jb 0x472703
jmp 0x472764
xor eax, eax
lea rbx, [rsp + 0x1a]
mov ecx, 0xa
call fcn.0044c4e0
add rsp, 0x30
pop rbp
ret
mov eax, esi
mov ecx, 0xa
call fcn.004617c0
mov eax, edi
mov ecx, 0xa
call fcn.004617c0
nop
nop dword [rax]
call fcn.0045f540
jmp fcn.004726c0

Function at 0x473120
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4731ec
push rbp
mov rbp, rsp
sub rsp, 0x38
movabs rdx, 0x5ff169c9fc3161f8
mov qword [rsp + 0x1d], rdx
movabs rdx, 0x75d0605ff169c9fc
mov qword [rsp + 0x20], rdx
movabs rdx, 0x908030304000002
mov qword [rsp + 0x28], rdx
movabs rdx, 0x906080203090208
mov qword [rsp + 0x30], rdx
xor eax, eax
jmp 0x47318f
movzx r9d, byte [rsp + rsi + 0x1d]
sub r9d, edx
lea edx, [r9 - 0x73]
mov byte [rsp + rdi + 0x1d], dl
lea edx, [r8 - 0x73]
mov byte [rsp + rsi + 0x1d], dl
add rax, 2
cmp rax, 0x10
jge 0x4731bc
movzx edx, byte [rsp + rax + 0x28]
movzx esi, byte [rsp + rax + 0x29]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0xb
jae 0x4731df
movzx r8d, byte [rsp + rdi + 0x1d]
sub r8d, edx
cmp rsi, 0xb
jb 0x473172
jmp 0x4731d3
xor eax, eax
lea rbx, [rsp + 0x1d]
mov ecx, 0xb
call fcn.0044c4e0
add rsp, 0x38
pop rbp
ret
mov eax, esi
mov ecx, 0xb
call fcn.004617c0
mov eax, edi
mov ecx, 0xb
call fcn.004617c0
nop
call fcn.0045f540
jmp fcn.00473120

Function at 0x473200
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4732b2
push rbp
mov rbp, rsp
sub rsp, 0x28
movabs rdx, 0x61755f5167685c50
mov qword [rsp + 0x20], rdx
movabs rdx, 0x404060401020101
mov qword [rsp + 0x18], rdx
xor eax, eax
jmp 0x473251
movzx r9d, byte [rsp + rsi + 0x20]
sub r9d, edx
lea edx, [r9 + 5]
mov byte [rsp + rdi + 0x20], dl
lea edx, [r8 + 5]
mov byte [rsp + rsi + 0x20], dl
add rax, 2
cmp rax, 8
jge 0x47327e
movzx edx, byte [rsp + rax + 0x18]
movzx esi, byte [rsp + rax + 0x19]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 8
jae 0x4732a5
movzx r8d, byte [rsp + rdi + 0x20]
sub r8d, edx
cmp rsi, 8
jb 0x473234
jmp 0x473295
xor eax, eax
lea rbx, [rsp + 0x20]
mov ecx, 8
call fcn.0044c4e0
add rsp, 0x28
pop rbp
ret
mov eax, esi
mov ecx, 8
nop dword [rax]
call fcn.004617c0
mov eax, edi
mov ecx, 8
call fcn.004617c0
nop
call fcn.0045f540
jmp fcn.00473200
Function at 0x4745e0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x474698
push rbp
mov rbp, rsp
sub rsp, 0x30
movabs rdx, 0x61938a6496796183
mov qword [rsp + 0x1e], rdx
movabs rdx, 0x400050603020603
mov qword [rsp + 0x26], rdx
mov word [rsp + 0x2e], 0x404
xor eax, eax
jmp 0x474635
movzx r9d, byte [rsp + rsi + 0x1e]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x1a]
mov byte [rsp + rdi + 0x1e], dl
mov byte [rsp + rsi + 0x1e], r8b
add rax, 2
cmp rax, 0xa
jge 0x474668
movzx edx, byte [rsp + rax + 0x26]
movzx esi, byte [rsp + rax + 0x27]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 8
jae 0x47468b
movzx r8d, byte [rsp + rdi + 0x1e]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x1a]
nop
cmp rsi, 8
jb 0x47461b
jmp 0x47467f
xor eax, eax
lea rbx, [rsp + 0x1e]
mov ecx, 8
call fcn.0044c4e0
add rsp, 0x30
pop rbp
ret
mov eax, esi
mov ecx, 8
call fcn.004617c0
mov eax, edi
mov ecx, 8
call fcn.004617c0
nop
call fcn.0045f540
nop dword [rax]
jmp fcn.004745e0

Function at 0x4746c0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x474778
push rbp
mov rbp, rsp
sub rsp, 0x30
movabs rdx, 0x6d79686356696354
mov qword [rsp + 0x1e], rdx
movabs rdx, 0x101030401060606
mov qword [rsp + 0x26], rdx
mov word [rsp + 0x2e], 0x603
xor eax, eax
jmp 0x474715
movzx r9d, byte [rsp + rsi + 0x1e]
lea edx, [r9 + rdx]
lea edx, [rdx - 0xd]
mov byte [rsp + rdi + 0x1e], dl
mov byte [rsp + rsi + 0x1e], r8b
add rax, 2
cmp rax, 0xa
jge 0x474748
movzx edx, byte [rsp + rax + 0x26]
movzx esi, byte [rsp + rax + 0x27]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 8
jae 0x47476b
movzx r8d, byte [rsp + rdi + 0x1e]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0xd]
nop
cmp rsi, 8
jb 0x4746fb
jmp 0x47475f
xor eax, eax
lea rbx, [rsp + 0x1e]
mov ecx, 8
call fcn.0044c4e0
add rsp, 0x30
pop rbp
ret
mov eax, esi
mov ecx, 8
call fcn.004617c0
mov eax, edi
mov ecx, 8
call fcn.004617c0
nop
call fcn.0045f540
nop dword [rax]
jmp fcn.004746c0

Function at 0x474b40
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x474bf8
push rbp
mov rbp, rsp
sub rsp, 0x30
movabs rdx, 0x7b698b9963618b9f
mov qword [rsp + 0x1e], rdx
movabs rdx, 0x703070403050300
mov qword [rsp + 0x26], rdx
mov word [rsp + 0x2e], 0x501
xor eax, eax
jmp 0x474b98
movzx r9d, byte [rsp + rsi + 0x1e]
sub r9d, edx
lea edx, [r9 - 0xb]
mov byte [rsp + rdi + 0x1e], dl
lea edx, [r8 - 0xb]
mov byte [rsp + rsi + 0x1e], dl
add rax, 2
cmp rax, 0xa
jge 0x474bc8
movzx edx, byte [rsp + rax + 0x26]
movzx esi, byte [rsp + rax + 0x27]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 8
jae 0x474beb
movzx r8d, byte [rsp + rdi + 0x1e]
sub r8d, edx
nop dword [rax]
cmp rsi, 8
jb 0x474b7b
jmp 0x474bdf
xor eax, eax
lea rbx, [rsp + 0x1e]
mov ecx, 8
call fcn.0044c4e0
add rsp, 0x30
pop rbp
ret
mov eax, esi
mov ecx, 8
call fcn.004617c0
mov eax, edi
mov ecx, 8
call fcn.004617c0
nop
call fcn.0045f540
nop dword [rax]
jmp fcn.00474b40
Function at 0x474c20
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x474cd8
push rbp
mov rbp, rsp
sub rsp, 0x30
movabs rdx, 0x1f40de3f2711694c
mov qword [rsp + 0x1c], rdx
movabs rdx, 0x300060507060002
mov qword [rsp + 0x24], rdx
mov dword [rsp + 0x2c], 0x4060606
xor eax, eax
jmp 0x474c76
movzx r9d, byte [rsp + rsi + 0x1c]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x26]
mov byte [rsp + rdi + 0x1c], dl
mov byte [rsp + rsi + 0x1c], r8b
add rax, 2
cmp rax, 0xc
jge 0x474ca8
movzx edx, byte [rsp + rax + 0x24]
movzx esi, byte [rsp + rax + 0x25]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 8
jae 0x474ccb
movzx r8d, byte [rsp + rdi + 0x1c]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x26]
cmp rsi, 8
jb 0x474c5c
jmp 0x474cbf
xor eax, eax
lea rbx, [rsp + 0x1c]
mov ecx, 8
call fcn.0044c4e0
add rsp, 0x30
pop rbp
ret
mov eax, esi
mov ecx, 8
call fcn.004617c0
mov eax, edi
mov ecx, 8
call fcn.004617c0
nop
call fcn.0045f540
nop dword [rax]
jmp fcn.00474c20

Function at 0x4762a0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4763a8
push rbp
mov rbp, rsp
sub rsp, 0x58
movabs rdx, 0x724d82685e6e2569
mov qword [rsp + 0x1f], rdx
movabs rdx, 0x6b6d5f6d9e6f7872
mov qword [rsp + 0x26], rdx
movabs rdx, 0x746e646e50846251
mov qword [rsp + 0x2e], rdx
movabs rdx, 0x1014080610000100
mov qword [rsp + 0x36], rdx
movabs rdx, 0xf08101408061000
mov qword [rsp + 0x38], rdx
movabs rdx, 0xe0b0d0103080a10
mov qword [rsp + 0x40], rdx
movabs rdx, 0x614001400100e11
mov qword [rsp + 0x48], rdx
movabs rdx, 0x100d0905070a1314
mov qword [rsp + 0x50], rdx
xor eax, eax
jmp 0x47634b
movzx r9d, byte [rsp + rsi + 0x1f]
sub r9d, edx
lea edx, [r9 + 0x1c]
mov byte [rsp + rdi + 0x1f], dl
lea edx, [r8 + 0x1c]
mov byte [rsp + rsi + 0x1f], dl
add rax, 2
cmp rax, 0x22
jge 0x476378
movzx edx, byte [rsp + rax + 0x36]
movzx esi, byte [rsp + rax + 0x37]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x17
jae 0x47639b
movzx r8d, byte [rsp + rdi + 0x1f]
sub r8d, edx
cmp rsi, 0x17
jb 0x47632e
jmp 0x47638f
xor eax, eax
lea rbx, [rsp + 0x1f]
mov ecx, 0x17
call fcn.0044c4e0
add rsp, 0x58
pop rbp
ret
mov eax, esi
mov ecx, 0x17
call fcn.004617c0
mov eax, edi
mov ecx, 0x17
call fcn.004617c0
nop
call fcn.0045f540
jmp fcn.004762a0
Function at 0x476e80
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x476f6c
push rbp
mov rbp, rsp
sub rsp, 0x40
movabs rdx, 0x24440e7265ed3f3e
mov qword [rsp + 0x1d], rdx
movabs rdx, 0x5f24440e7265ed3f
mov qword [rsp + 0x1e], rdx
movabs rdx, 0x3c3e2969d5564e43
mov qword [rsp + 0x26], rdx
movabs rdx, 0xe0c000502100b0b
mov qword [rsp + 0x2e], rdx
movabs rdx, 0xc0a0e0c00050210
mov qword [rsp + 0x30], rdx
movabs rdx, 0xf0110000607060e
mov qword [rsp + 0x38], rdx
xor eax, eax
jmp 0x476f0a
movzx r9d, byte [rsp + rsi + 0x1d]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x18]
mov byte [rsp + rdi + 0x1d], dl
mov byte [rsp + rsi + 0x1d], r8b
add rax, 2
cmp rax, 0x12
jge 0x476f3c
movzx edx, byte [rsp + rax + 0x2e]
movzx esi, byte [rsp + rax + 0x2f]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x11
jae 0x476f5f
movzx r8d, byte [rsp + rdi + 0x1d]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x18]
cmp rsi, 0x11
jb 0x476ef0
jmp 0x476f53
xor eax, eax
lea rbx, [rsp + 0x1d]
mov ecx, 0x11
call fcn.0044c4e0
add rsp, 0x40
pop rbp
ret
mov eax, esi
mov ecx, 0x11
call fcn.004617c0
mov eax, edi
mov ecx, 0x11
call fcn.004617c0
nop
call fcn.0045f540
jmp fcn.00476e80

Function at 0x477440
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x477512
push rbp
mov rbp, rsp
sub rsp, 0x38
movabs rdx, 0x7055cf186568bbca
mov qword [rsp + 0x19], rdx
movabs rdx, 0x9b1b2d1503c2aa70
mov qword [rsp + 0x20], rdx
movabs rdx, 0x901010b0d000c09
mov qword [rsp + 0x28], rdx
movabs rdx, 0x805000e000a0504
mov qword [rsp + 0x30], rdx
xor eax, eax
jmp 0x4774ac
movzx r9d, byte [rsp + rsi + 0x19]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x66]
mov byte [rsp + rdi + 0x19], dl
mov byte [rsp + rsi + 0x19], r8b
add rax, 2
cmp rax, 0x10
jge 0x4774de
movzx edx, byte [rsp + rax + 0x28]
movzx esi, byte [rsp + rax + 0x29]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0xf
jae 0x477505
movzx r8d, byte [rsp + rdi + 0x19]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x66]
cmp rsi, 0xf
jb 0x477492
jmp 0x4774f5
xor eax, eax
lea rbx, [rsp + 0x19]
mov ecx, 0xf
call fcn.0044c4e0
add rsp, 0x38
pop rbp
ret
mov eax, esi
mov ecx, 0xf
nop dword [rax]
call fcn.004617c0
mov eax, edi
mov ecx, 0xf
call fcn.004617c0
nop
call fcn.0045f540
jmp fcn.00477440
Function at 0x478cc0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x478d87
push rbp
mov rbp, rsp
sub rsp, 0x30
movabs rdx, 0x7053a2b0e6a09e57
mov qword [rsp + 0x19], rdx
movabs rdx, 0xe7f2a87053a2b0e6
mov qword [rsp + 0x1c], rdx
movabs rdx, 0x5030a0a02080509
mov qword [rsp + 0x24], rdx
mov dword [rsp + 0x2c], 0x40a0501
xor eax, eax
jmp 0x478d28
movzx r9d, byte [rsp + rsi + 0x19]
sub r9d, edx
lea edx, [r9 - 0x33]
mov byte [rsp + rdi + 0x19], dl
lea edx, [r8 - 0x33]
mov byte [rsp + rsi + 0x19], dl
add rax, 2
cmp rax, 0xc
jge 0x478d57
movzx edx, byte [rsp + rax + 0x24]
movzx esi, byte [rsp + rax + 0x25]
mov edi, edx
xor edx, esi
add edx, eax
nop
cmp rdi, 0xb
jae 0x478d7a
movzx r8d, byte [rsp + rdi + 0x19]
sub r8d, edx
cmp rsi, 0xb
jb 0x478d0b
jmp 0x478d6e
xor eax, eax
lea rbx, [rsp + 0x19]
mov ecx, 0xb
call fcn.0044c4e0
add rsp, 0x30
pop rbp
ret
mov eax, esi
mov ecx, 0xb
call fcn.004617c0
mov eax, edi
mov ecx, 0xb
call fcn.004617c0
nop
call fcn.0045f540
jmp fcn.00478cc0

Function at 0x47d560
Capabilities:
Encode data using xor

Disassembly:
mov rbx, qword [rsp + 8]
mov rsi, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdx, qword [rsp + 0x20]
test rdx, 0xf
jne 0x47d5cb
mov rax, 0
movdqu xmm0, xmmword [rsi + rax]
movdqu xmm1, xmmword [rcx + rax]
pxor xmm0, xmm1
movdqu xmmword [rbx + rax], xmm0
add rax, 0x10
cmp rdx, rax
jne 0x47d584
ret
sub rdx, 1
mov dil, byte [rsi + rdx]
mov al, byte [rcx + rdx]
xor dil, al
mov byte [rbx + rdx], dil
test rdx, 7
jne 0x47d5a1
cmp rdx, 0
je 0x47d5ed
test rdx, 0xf
je 0x47d57d
test rdx, 7
jne 0x47d5a1
sub rdx, 8
mov rdi, qword [rsi + rdx]
mov rax, qword [rcx + rdx]
xor rdi, rax
mov qword [rbx + rdx], rdi
cmp rdx, 0x10
jge 0x47d57d
ret