joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4b5520
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4b55ec
push rbp
mov rbp, rsp
sub rsp, 0x38
movabs rdx, 0x9733c42254f4c3c
mov qword [rsp + 0x1c], rdx
mov dword [rsp + 0x24], 0x6eea5b64
movabs rdx, 0x502090a03090004
mov qword [rsp + 0x28], rdx
movabs rdx, 0x1020a07070904
mov qword [rsp + 0x30], rdx
xor eax, eax
jmp 0x4b5585
movzx r9d, byte [rsp + rsi + 0x1c]
lea edx, [r9 + rdx]
lea edx, [rdx + 0xd]
mov byte [rsp + rdi + 0x1c], dl
mov byte [rsp + rsi + 0x1c], r8b
add rax, 2
cmp rax, 0x10
jge 0x4b55bc
movzx edx, byte [rsp + rax + 0x28]
movzx esi, byte [rsp + rax + 0x29]
mov edi, edx
xor edx, esi
add edx, eax
nop dword [rax + rax]
cmp rdi, 0xc
jae 0x4b55df
movzx r8d, byte [rsp + rdi + 0x1c]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0xd]
cmp rsi, 0xc
jb 0x4b556b
jmp 0x4b55d3
xor eax, eax
lea rbx, [rsp + 0x1c]
mov ecx, 0xc
call fcn.0044bb20
add rsp, 0x38
pop rbp
ret
mov eax, esi
mov ecx, 0xc
call fcn.00461020
mov eax, edi
mov ecx, 0xc
call fcn.00461020
nop
call fcn.0045eda0
jmp fcn.004b5520

Function at 0x4b5900
Capabilities:
Encrypt data using rc4 prga

Disassembly:
lea r12, [rsp - 0x18]
cmp r12, qword [r14 + 0x10]
jbe 0x4b5a87
push rbp
mov rbp, rsp
sub rsp, 0x90
movabs rdx, 0x2067696c7e616e5b
mov qword [rsp + 0x1f], rdx
movabs rdx, 0x602067696c7e616e
mov qword [rsp + 0x20], rdx
movabs rdx, 0x1246261f6e39205e
mov qword [rsp + 0x28], rdx
movabs rdx, 0x381a9120655e654a
mov qword [rsp + 0x30], rdx
movabs rdx, 0x6f12656a60626565
mov qword [rsp + 0x38], rdx
movabs rdx, 0x6a20657480773172
mov qword [rsp + 0x40], rdx
movabs rdx, 0x5175894b6143552b
mov qword [rsp + 0x48], rdx
movabs rdx, 0x9090b180916171f
mov qword [rsp + 0x50], rdx
movabs rdx, 0x2d2911080d0e1008
mov qword [rsp + 0x58], rdx
movabs rdx, 0x1d02302a1f091922
mov qword [rsp + 0x60], rdx
movabs rdx, 0x1a2a190f17290222
mov qword [rsp + 0x68], rdx
movabs rdx, 0x241022162b16280f
mov qword [rsp + 0x70], rdx
movabs rdx, 0x12292813192e1c
mov qword [rsp + 0x78], rdx
movabs rdx, 0x31d2e2f0b2f0025
mov qword [rsp + 0x80], rdx
movabs rdx, 0x302416090e060311
mov qword [rsp + 0x88], rdx
xor eax, eax
jmp 0x4b5a22
movzx r9d, byte [rsp + rsi + 0x1f]
sub r9d, edx
lea edx, [r9 + 0x4a]
mov byte [rsp + rdi + 0x1f], dl
lea edx, [r8 + 0x4a]
mov byte [rsp + rsi + 0x1f], dl
add rax, 2
cmp rax, 0x40
jge 0x4b5a4f
movzx edx, byte [rsp + rax + 0x50]
movzx esi, byte [rsp + rax + 0x51]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x31
jae 0x4b5a7a
movzx r8d, byte [rsp + rdi + 0x1f]
sub r8d, edx
cmp rsi, 0x31
jb 0x4b5a05
jmp 0x4b5a6e
xor eax, eax
lea rbx, [rsp + 0x1f]
mov ecx, 0x31
nop dword [rax + rax]
call fcn.0044bb20
add rsp, 0x90
pop rbp
ret
mov eax, esi
mov ecx, 0x31
call fcn.00461020
mov eax, edi
mov ecx, 0x31
call fcn.00461020
nop
call fcn.0045eda0
jmp fcn.004b5900
Function at 0x4b60a0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4b618c
push rbp
mov rbp, rsp
sub rsp, 0x48
movabs rdx, 0xb26fdfbe6f706e69
mov qword [rsp + 0x1e], rdx
movabs rdx, 0xc2beb26fdfbe6f70
mov qword [rsp + 0x20], rdx
movabs rdx, 0xc44a8dce24c9746c
mov qword [rsp + 0x28], rdx
movabs rdx, 0x30e0911110a0f03
mov qword [rsp + 0x30], rdx
movabs rdx, 0xc090f050e090d05
mov qword [rsp + 0x38], rdx
movabs rdx, 0x804070810070d05
mov qword [rsp + 0x40], rdx
xor eax, eax
jmp 0x4b612a
movzx r9d, byte [rsp + rsi + 0x1e]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x6c]
mov byte [rsp + rdi + 0x1e], dl
mov byte [rsp + rsi + 0x1e], r8b
add rax, 2
cmp rax, 0x18
jge 0x4b615c
movzx edx, byte [rsp + rax + 0x30]
movzx esi, byte [rsp + rax + 0x31]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x12
jae 0x4b617f
movzx r8d, byte [rsp + rdi + 0x1e]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x6c]
cmp rsi, 0x12
jb 0x4b6110
jmp 0x4b6173
xor eax, eax
lea rbx, [rsp + 0x1e]
mov ecx, 0x12
call fcn.0044bb20
add rsp, 0x48
pop rbp
ret
mov eax, esi
mov ecx, 0x12
call fcn.00461020
mov eax, edi
mov ecx, 0x12
call fcn.00461020
nop
call fcn.0045eda0
jmp fcn.004b60a0

Function at 0x4b6e80
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4b6f8c
push rbp
mov rbp, rsp
sub rsp, 0x58
movabs rdx, 0x20bb61d1dc9665d1
mov qword [rsp + 0x1d], rdx
movabs rdx, 0xaa44356377ce65b5
mov qword [rsp + 0x25], rdx
movabs rdx, 0x79f920aa44356377
mov qword [rsp + 0x28], rdx
movabs rdx, 0xf7636976d7bbc1d8
mov qword [rsp + 0x30], rdx
movabs rdx, 0x30a11151300001a
mov qword [rsp + 0x38], rdx
movabs rdx, 0x60a141a0f080804
mov qword [rsp + 0x40], rdx
movabs rdx, 0x130d151303161a04
mov qword [rsp + 0x48], rdx
movabs rdx, 0xe0a02000b11030e
mov qword [rsp + 0x50], rdx
xor eax, eax
jmp 0x4b6f28
movzx r9d, byte [rsp + rsi + 0x1d]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x49]
mov byte [rsp + rdi + 0x1d], dl
mov byte [rsp + rsi + 0x1d], r8b
add rax, 2
cmp rax, 0x20
jge 0x4b6f5c
movzx edx, byte [rsp + rax + 0x38]
movzx esi, byte [rsp + rax + 0x39]
mov edi, edx
xor edx, esi
add edx, eax
nop
cmp rdi, 0x1b
jae 0x4b6f7f
movzx r8d, byte [rsp + rdi + 0x1d]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x49]
cmp rsi, 0x1b
jb 0x4b6f0e
jmp 0x4b6f73
xor eax, eax
lea rbx, [rsp + 0x1d]
mov ecx, 0x1b
call fcn.0044bb20
add rsp, 0x58
pop rbp
ret
mov eax, esi
mov ecx, 0x1b
call fcn.00461020
mov eax, edi
mov ecx, 0x1b
call fcn.00461020
nop
call fcn.0045eda0
jmp fcn.004b6e80
Function at 0x4b7220
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4b72fd
push rbp
mov rbp, rsp
sub rsp, 0x40
movabs rdx, 0xbb55f16c6504b4b4
mov qword [rsp + 0x1e], rdx
movabs rdx, 0xbc654e0bb868bb55
mov qword [rsp + 0x24], rdx
movabs rdx, 0x906020a0b070502
mov qword [rsp + 0x2c], rdx
movabs rdx, 0xd09070906020a
mov qword [rsp + 0x30], rdx
movabs rdx, 0x109060702050702
mov qword [rsp + 0x38], rdx
xor eax, eax
nop
jmp 0x4b72a0
movzx r9d, byte [rsp + rsi + 0x1e]
sub r9d, edx
lea edx, [r9 - 0x39]
mov byte [rsp + rdi + 0x1e], dl
lea edx, [r8 - 0x39]
mov byte [rsp + rsi + 0x1e], dl
add rax, 2
nop
cmp rax, 0x14
jge 0x4b72cd
movzx edx, byte [rsp + rax + 0x2c]
movzx esi, byte [rsp + rax + 0x2d]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0xe
jae 0x4b72f0
movzx r8d, byte [rsp + rdi + 0x1e]
sub r8d, edx
cmp rsi, 0xe
jb 0x4b7282
jmp 0x4b72e4
xor eax, eax
lea rbx, [rsp + 0x1e]
mov ecx, 0xe
call fcn.0044bb20
add rsp, 0x40
pop rbp
ret
mov eax, esi
mov ecx, 0xe
call fcn.00461020
mov eax, edi
mov ecx, 0xe
call fcn.00461020
nop
nop dword [rax]
call fcn.0045eda0
jmp fcn.004b7220

Function at 0x4b75a0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4b766c
push rbp
mov rbp, rsp
sub rsp, 0x38
movabs rdx, 0x3a3332e64e3b4812
mov qword [rsp + 0x1d], rdx
movabs rdx, 0x420d0eff723a3332
mov qword [rsp + 0x22], rdx
movabs rdx, 0x30c0c0a07000405
mov qword [rsp + 0x2a], rdx
movabs rdx, 0x90701020b02030c
mov qword [rsp + 0x30], rdx
xor eax, eax
jmp 0x4b760f
movzx r9d, byte [rsp + rsi + 0x1d]
sub r9d, edx
lea edx, [r9 + 0x3b]
mov byte [rsp + rdi + 0x1d], dl
lea edx, [r8 + 0x3b]
mov byte [rsp + rsi + 0x1d], dl
add rax, 2
cmp rax, 0xe
jge 0x4b763c
movzx edx, byte [rsp + rax + 0x2a]
movzx esi, byte [rsp + rax + 0x2b]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0xd
jae 0x4b765f
movzx r8d, byte [rsp + rdi + 0x1d]
sub r8d, edx
cmp rsi, 0xd
jb 0x4b75f2
jmp 0x4b7653
xor eax, eax
lea rbx, [rsp + 0x1d]
mov ecx, 0xd
call fcn.0044bb20
add rsp, 0x38
pop rbp
ret
mov eax, esi
mov ecx, 0xd
call fcn.00461020
mov eax, edi
mov ecx, 0xd
call fcn.00461020
nop
call fcn.0045eda0
jmp fcn.004b75a0
Function at 0x4b97c0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4b98ac
push rbp
mov rbp, rsp
sub rsp, 0x48
movabs rdx, 0x1d614d56494f57e3
mov qword [rsp + 0x1e], rdx
movabs rdx, 0x3f561d614d56494f
mov qword [rsp + 0x20], rdx
movabs rdx, 0x403c6a00234c4f13
mov qword [rsp + 0x28], rdx
movabs rdx, 0x3040d0a00110c0f
mov qword [rsp + 0x30], rdx
movabs rdx, 0x11090a0408020f01
mov qword [rsp + 0x38], rdx
movabs rdx, 0xb100e040500070b
mov qword [rsp + 0x40], rdx
xor eax, eax
jmp 0x4b984a
movzx r9d, byte [rsp + rsi + 0x1e]
lea edx, [r9 + rdx]
lea edx, [rdx + 2]
mov byte [rsp + rdi + 0x1e], dl
mov byte [rsp + rsi + 0x1e], r8b
add rax, 2
cmp rax, 0x18
jge 0x4b987c
movzx edx, byte [rsp + rax + 0x30]
movzx esi, byte [rsp + rax + 0x31]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x12
jae 0x4b989f
movzx r8d, byte [rsp + rdi + 0x1e]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 2]
cmp rsi, 0x12
jb 0x4b9830
jmp 0x4b9893
xor eax, eax
lea rbx, [rsp + 0x1e]
mov ecx, 0x12
call fcn.0044bb20
add rsp, 0x48
pop rbp
ret
mov eax, esi
mov ecx, 0x12
call fcn.00461020
mov eax, edi
mov ecx, 0x12
call fcn.00461020
nop
call fcn.0045eda0
jmp fcn.004b97c0

Function at 0x4b9ba0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4b9c9d
push rbp
mov rbp, rsp
sub rsp, 0x50
movabs rdx, 0xa8b5aae9b1a8ab6e
mov qword [rsp + 0x1e], rdx
movabs rdx, 0xf704f2a4c3a9a8b5
mov qword [rsp + 0x24], rdx
movabs rdx, 0xbdf0d0a468636765
mov qword [rsp + 0x2c], rdx
movabs rdx, 0x150d0d0a0502120d
mov qword [rsp + 0x34], rdx
movabs rdx, 0x801121401040b0b
mov qword [rsp + 0x3c], rdx
movabs rdx, 0x70f060c08011214
mov qword [rsp + 0x40], rdx
movabs rdx, 0x91215120b130603
mov qword [rsp + 0x48], rdx
xor eax, eax
jmp 0x4b9c40
movzx r9d, byte [rsp + rsi + 0x1e]
sub r9d, edx
lea edx, [r9 - 0x2d]
mov byte [rsp + rdi + 0x1e], dl
lea edx, [r8 - 0x2d]
mov byte [rsp + rsi + 0x1e], dl
add rax, 2
nop dword [rax]
cmp rax, 0x1c
jge 0x4b9c6d
movzx edx, byte [rsp + rax + 0x34]
movzx esi, byte [rsp + rax + 0x35]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x16
jae 0x4b9c90
movzx r8d, byte [rsp + rdi + 0x1e]
sub r8d, edx
cmp rsi, 0x16
jb 0x4b9c1f
jmp 0x4b9c84
xor eax, eax
lea rbx, [rsp + 0x1e]
mov ecx, 0x16
call fcn.0044bb20
add rsp, 0x50
pop rbp
ret
mov eax, esi
mov ecx, 0x16
call fcn.00461020
mov eax, edi
mov ecx, 0x16
call fcn.00461020
nop
nop dword [rax]
call fcn.0045eda0
jmp fcn.004b9ba0
Function at 0x4b9cc0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4b9de7
push rbp
mov rbp, rsp
sub rsp, 0x60
movabs rdx, 0x5a83835353766b32
mov qword [rsp + 0x19], rdx
movabs rdx, 0x2e7a876e5d804240
mov qword [rsp + 0x21], rdx
movabs rdx, 0x69207f656c2e7a87
mov qword [rsp + 0x26], rdx
movabs rdx, 0x84b63071586f9173
mov qword [rsp + 0x2e], rdx
movabs rdx, 0x1709180b0b030809
mov qword [rsp + 0x36], rdx
movabs rdx, 0x15020804040e17
mov qword [rsp + 0x3e], rdx
movabs rdx, 0x11b001502080404
mov qword [rsp + 0x40], rdx
movabs rdx, 0x190518010a170215
mov qword [rsp + 0x48], rdx
movabs rdx, 0x61c160218071807
mov qword [rsp + 0x50], rdx
movabs rdx, 0xd07030f1202081a
mov qword [rsp + 0x58], rdx
xor eax, eax
jmp 0x4b9d89
movzx r9d, byte [rsp + rsi + 0x19]
sub r9d, edx
lea edx, [r9 + 0x24]
mov byte [rsp + rdi + 0x19], dl
lea edx, [r8 + 0x24]
mov byte [rsp + rsi + 0x19], dl
add rax, 2
cmp rax, 0x2a
jge 0x4b9db7
movzx edx, byte [rsp + rax + 0x36]
movzx esi, byte [rsp + rax + 0x37]
mov edi, edx
xor edx, esi
add edx, eax
nop
cmp rdi, 0x1d
jae 0x4b9dda
movzx r8d, byte [rsp + rdi + 0x19]
sub r8d, edx
cmp rsi, 0x1d
jb 0x4b9d6c
jmp 0x4b9dce
xor eax, eax
lea rbx, [rsp + 0x19]
mov ecx, 0x1d
call fcn.0044bb20
add rsp, 0x60
pop rbp
ret
mov eax, esi
mov ecx, 0x1d
call fcn.00461020
mov eax, edi
mov ecx, 0x1d
call fcn.00461020
nop
call fcn.0045eda0
jmp fcn.004b9cc0

Function at 0x4b9e00
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4b9eb8
push rbp
mov rbp, rsp
sub rsp, 0x30
movabs rdx, 0x83e21fd289dc6f6e
mov qword [rsp + 0x1c], rdx
movabs rdx, 0x704020703060703
mov qword [rsp + 0x24], rdx
mov dword [rsp + 0x2c], 0x5030607
xor eax, eax
jmp 0x4b9e59
movzx r9d, byte [rsp + rsi + 0x1c]
sub r9d, edx
lea edx, [r9 + 0x52]
mov byte [rsp + rdi + 0x1c], dl
lea edx, [r8 + 0x52]
mov byte [rsp + rsi + 0x1c], dl
add rax, 2
cmp rax, 0xc
jge 0x4b9e88
movzx edx, byte [rsp + rax + 0x24]
movzx esi, byte [rsp + rax + 0x25]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 8
jae 0x4b9eab
movzx r8d, byte [rsp + rdi + 0x1c]
sub r8d, edx
nop
cmp rsi, 8
jb 0x4b9e3c
jmp 0x4b9e9f
xor eax, eax
lea rbx, [rsp + 0x1c]
mov ecx, 8
call fcn.0044bb20
add rsp, 0x30
pop rbp
ret
mov eax, esi
mov ecx, 8
call fcn.00461020
mov eax, edi
mov ecx, 8
call fcn.00461020
nop
call fcn.0045eda0
nop dword [rax]
jmp fcn.004b9e00
Function at 0x4b9ee0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4b9ffa
push rbp
mov rbp, rsp
sub rsp, 0x58
movabs rdx, 0x6599eedddf06f2e7
mov qword [rsp + 0x1b], rdx
movabs rdx, 0x51efeeeee573a4b4
mov qword [rsp + 0x23], rdx
movabs rdx, 0x6151efeeeee573a4
mov qword [rsp + 0x24], rdx
movabs rdx, 0x7c6cf7e8f2697068
mov qword [rsp + 0x2c], rdx
movabs rdx, 0x2080c06180d1201
mov qword [rsp + 0x34], rdx
movabs rdx, 0x611031502080c06
mov qword [rsp + 0x38], rdx
movabs rdx, 0x16140e0518011801
mov qword [rsp + 0x40], rdx
movabs rdx, 0xf090d01140c0c15
mov qword [rsp + 0x48], rdx
movabs rdx, 0xb00040c06110915
mov qword [rsp + 0x50], rdx
xor eax, eax
jmp 0x4b9f97
movzx r9d, byte [rsp + rsi + 0x1b]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x5c]
mov byte [rsp + rdi + 0x1b], dl
mov byte [rsp + rsi + 0x1b], r8b
add rax, 2
cmp rax, 0x24
jge 0x4b9fc9
movzx edx, byte [rsp + rax + 0x34]
movzx esi, byte [rsp + rax + 0x35]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x19
jae 0x4b9fed
movzx r8d, byte [rsp + rdi + 0x1b]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x5c]
cmp rsi, 0x19
jb 0x4b9f7d
jmp 0x4b9fe1
xor eax, eax
lea rbx, [rsp + 0x1b]
mov ecx, 0x19
call fcn.0044bb20
add rsp, 0x58
pop rbp
nop
ret
mov eax, esi
mov ecx, 0x19
call fcn.00461020
mov eax, edi
mov ecx, 0x19
call fcn.00461020
nop
call fcn.0045eda0
nop
jmp fcn.004b9ee0

Function at 0x4bb340
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4bb43b
push rbp
mov rbp, rsp
sub rsp, 0x50
movabs rdx, 0x8fcb6974cebbcd97
mov qword [rsp + 0x1c], rdx
movabs rdx, 0xdb6d69208f917c20
mov qword [rsp + 0x24], rdx
movabs rdx, 0xc6b5b306a3939e9c
mov qword [rsp + 0x2c], rdx
movabs rdx, 0x17150f160b111514
mov qword [rsp + 0x34], rdx
movabs rdx, 0x20313100a120601
mov qword [rsp + 0x3c], rdx
movabs rdx, 0x1703160902031310
mov qword [rsp + 0x40], rdx
movabs rdx, 0x60201090007150f
mov qword [rsp + 0x48], rdx
xor eax, eax
jmp 0x4bb3d9
movzx r9d, byte [rsp + rsi + 0x1c]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x46]
mov byte [rsp + rdi + 0x1c], dl
mov byte [rsp + rsi + 0x1c], r8b
add rax, 2
cmp rax, 0x1c
jge 0x4bb40b
movzx edx, byte [rsp + rax + 0x34]
movzx esi, byte [rsp + rax + 0x35]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x18
jae 0x4bb42e
movzx r8d, byte [rsp + rdi + 0x1c]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x46]
cmp rsi, 0x18
jb 0x4bb3bf
jmp 0x4bb422
xor eax, eax
lea rbx, [rsp + 0x1c]
mov ecx, 0x18
call fcn.0044bb20
add rsp, 0x50
pop rbp
ret
mov eax, esi
mov ecx, 0x18
call fcn.00461020
mov eax, edi
mov ecx, 0x18
call fcn.00461020
nop
nop dword [rax + rax]
call fcn.0045eda0
jmp fcn.004bb340
Function at 0x4bb460
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4bb55b
push rbp
mov rbp, rsp
sub rsp, 0x50
movabs rdx, 0x363f6336630cf542
mov qword [rsp + 0x1d], rdx
movabs rdx, 0x396551640d363f63
mov qword [rsp + 0x22], rdx
movabs rdx, 0x443c4e3b454b5c3b
mov qword [rsp + 0x2a], rdx
movabs rdx, 0x6120d0901020a09
mov qword [rsp + 0x32], rdx
movabs rdx, 0x120f091408050112
mov qword [rsp + 0x3a], rdx
movabs rdx, 0x100d0d0c020d120f
mov qword [rsp + 0x40], rdx
movabs rdx, 0x130400110f0e070f
mov qword [rsp + 0x48], rdx
xor eax, eax
jmp 0x4bb4f9
movzx r9d, byte [rsp + rsi + 0x1d]
lea edx, [r9 + rdx]
lea edx, [rdx - 4]
mov byte [rsp + rdi + 0x1d], dl
mov byte [rsp + rsi + 0x1d], r8b
add rax, 2
cmp rax, 0x1e
jge 0x4bb52b
movzx edx, byte [rsp + rax + 0x32]
movzx esi, byte [rsp + rax + 0x33]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x15
jae 0x4bb54e
movzx r8d, byte [rsp + rdi + 0x1d]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 4]
cmp rsi, 0x15
jb 0x4bb4df
jmp 0x4bb542
xor eax, eax
lea rbx, [rsp + 0x1d]
mov ecx, 0x15
call fcn.0044bb20
add rsp, 0x50
pop rbp
ret
mov eax, esi
mov ecx, 0x15
call fcn.00461020
mov eax, edi
mov ecx, 0x15
call fcn.00461020
nop
nop dword [rax + rax]
call fcn.0045eda0
jmp fcn.004bb460

Function at 0x4bbb00
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4bbbea
push rbp
mov rbp, rsp
sub rsp, 0x48
movabs rdx, 0xdbab74c2f17256cd
mov qword [rsp + 0x1f], rdx
movabs rdx, 0x6e8d33dbab74c2f1
mov qword [rsp + 0x22], rdx
movabs rdx, 0xdd74706d43fa74c0
mov qword [rsp + 0x2a], rdx
movabs rdx, 0x100080d04040e06
mov qword [rsp + 0x32], rdx
movabs rdx, 0xb0d12030d0e0100
mov qword [rsp + 0x38], rdx
movabs rdx, 0x800080d09090607
mov qword [rsp + 0x40], rdx
xor eax, eax
jmp 0x4bbb8d
movzx r9d, byte [rsp + rsi + 0x1f]
sub r9d, edx
lea edx, [r9 - 0x5d]
mov byte [rsp + rdi + 0x1f], dl
lea edx, [r8 - 0x5d]
mov byte [rsp + rsi + 0x1f], dl
add rax, 2
cmp rax, 0x16
jge 0x4bbbba
movzx edx, byte [rsp + rax + 0x32]
movzx esi, byte [rsp + rax + 0x33]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x13
jae 0x4bbbdd
movzx r8d, byte [rsp + rdi + 0x1f]
sub r8d, edx
cmp rsi, 0x13
jb 0x4bbb70
jmp 0x4bbbd1
xor eax, eax
lea rbx, [rsp + 0x1f]
mov ecx, 0x13
call fcn.0044bb20
add rsp, 0x48
pop rbp
ret
mov eax, esi
mov ecx, 0x13
call fcn.00461020
mov eax, edi
mov ecx, 0x13
call fcn.00461020
nop
call fcn.0045eda0
jmp fcn.004bbb00
Function at 0x4bc3c0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4bc4c8
push rbp
mov rbp, rsp
sub rsp, 0x58
movabs rdx, 0xe3e974fa92fcea06
mov qword [rsp + 0x3a], rdx
movabs rdx, 0x6e6f3ca161b09870
mov qword [rsp + 0x42], rdx
movabs rdx, 0x6fb99a614b206e6f
mov qword [rsp + 0x48], rdx
movabs rdx, 0x7465f1ebff732dcd
mov qword [rsp + 0x50], rdx
movabs rdx, 0x1113070c1b060903
mov qword [rsp + 0x1c], rdx
movabs rdx, 0x1190d1a1206021b
mov qword [rsp + 0x24], rdx
movabs rdx, 0x40d010c000a0119
mov qword [rsp + 0x2a], rdx
movabs rdx, 0x160a19141a190d1b
mov qword [rsp + 0x32], rdx
xor eax, eax
jmp 0x4bc46b
movzx r9d, byte [rsp + rsi + 0x3a]
sub r9d, edx
lea edx, [r9 - 0x23]
mov byte [rsp + rdi + 0x3a], dl
lea edx, [r8 - 0x23]
mov byte [rsp + rsi + 0x3a], dl
add rax, 2
cmp rax, 0x1e
jge 0x4bc498
movzx edx, byte [rsp + rax + 0x1c]
movzx esi, byte [rsp + rax + 0x1d]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x1e
jae 0x4bc4bb
movzx r8d, byte [rsp + rdi + 0x3a]
sub r8d, edx
cmp rsi, 0x1e
jb 0x4bc44e
jmp 0x4bc4af
xor eax, eax
lea rbx, [rsp + 0x3a]
mov ecx, 0x1e
call fcn.0044bb20
add rsp, 0x58
pop rbp
ret
mov eax, esi
mov ecx, 0x1e
call fcn.00461020
mov eax, edi
mov ecx, 0x1e
call fcn.00461020
nop
call fcn.0045eda0
jmp fcn.004bc3c0

Function at 0x4bc4e0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4bc5ca
push rbp
mov rbp, rsp
sub rsp, 0x48
movabs rdx, 0xa4537405729c706f
mov qword [rsp + 0x19], rdx
movabs rdx, 0x7332e96f6e2024a4
mov qword [rsp + 0x20], rdx
movabs rdx, 0x2ef5197240013027
mov qword [rsp + 0x28], rdx
movabs rdx, 0x404160802150614
mov qword [rsp + 0x30], rdx
movabs rdx, 0xf0c07100f150d11
mov qword [rsp + 0x38], rdx
movabs rdx, 0x14020d101410120f
mov qword [rsp + 0x40], rdx
xor eax, eax
jmp 0x4bc56d
movzx r9d, byte [rsp + rsi + 0x19]
sub r9d, edx
lea edx, [r9 + 0x62]
mov byte [rsp + rdi + 0x19], dl
lea edx, [r8 + 0x62]
mov byte [rsp + rsi + 0x19], dl
add rax, 2
cmp rax, 0x18
jge 0x4bc59a
movzx edx, byte [rsp + rax + 0x30]
movzx esi, byte [rsp + rax + 0x31]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x17
jae 0x4bc5bd
movzx r8d, byte [rsp + rdi + 0x19]
sub r8d, edx
cmp rsi, 0x17
jb 0x4bc550
jmp 0x4bc5b1
xor eax, eax
lea rbx, [rsp + 0x19]
mov ecx, 0x17
call fcn.0044bb20
add rsp, 0x48
pop rbp
ret
mov eax, esi
mov ecx, 0x17
call fcn.00461020
mov eax, edi
mov ecx, 0x17
call fcn.00461020
nop
call fcn.0045eda0
jmp fcn.004bc4e0
Function at 0x4bc940
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4bca5d
push rbp
mov rbp, rsp
sub rsp, 0x58
movabs rdx, 0xb56f675e36db0432
mov qword [rsp + 0x1a], rdx
movabs rdx, 0x204a3d1d6a367520
mov qword [rsp + 0x22], rdx
movabs rdx, 0x6e6f204a3d1d6a36
mov qword [rsp + 0x24], rdx
movabs rdx, 0x637250773c655e64
mov qword [rsp + 0x2c], rdx
movabs rdx, 0x701130a0d13000c
mov qword [rsp + 0x34], rdx
movabs rdx, 0x701020e0701130a
mov qword [rsp + 0x38], rdx
movabs rdx, 0x120713041703000e
mov qword [rsp + 0x40], rdx
movabs rdx, 0x150512040b17190c
mov qword [rsp + 0x48], rdx
movabs rdx, 0xb0500120505010b
mov qword [rsp + 0x50], rdx
xor eax, eax
jmp 0x4bca00
movzx r9d, byte [rsp + rsi + 0x1a]
sub r9d, edx
lea edx, [r9 + 0x37]
mov byte [rsp + rdi + 0x1a], dl
lea edx, [r8 + 0x37]
mov byte [rsp + rsi + 0x1a], dl
add rax, 2
nop word [rax + rax]
cmp rax, 0x24
jge 0x4bca2d
movzx edx, byte [rsp + rax + 0x34]
movzx esi, byte [rsp + rax + 0x35]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x1a
jae 0x4bca50
movzx r8d, byte [rsp + rdi + 0x1a]
sub r8d, edx
cmp rsi, 0x1a
jb 0x4bc9dd
jmp 0x4bca44
xor eax, eax
lea rbx, [rsp + 0x1a]
mov ecx, 0x1a
call fcn.0044bb20
add rsp, 0x58
pop rbp
ret
mov eax, esi
mov ecx, 0x1a
call fcn.00461020
mov eax, edi
mov ecx, 0x1a
call fcn.00461020
nop
nop dword [rax]
call fcn.0045eda0
jmp fcn.004bc940

Function at 0x4bd3a0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4bd49b
push rbp
mov rbp, rsp
sub rsp, 0x50
movabs rdx, 0x6f2359612d462a6f
mov qword [rsp + 0x1d], rdx
movabs rdx, 0x364c58654144df6f
mov qword [rsp + 0x24], rdx
movabs rdx, 0x126522f8695d5b43
mov qword [rsp + 0x2c], rdx
movabs rdx, 0xd130f160b080510
mov qword [rsp + 0x34], rdx
movabs rdx, 0x11140b0c020b0a0f
mov qword [rsp + 0x3c], rdx
movabs rdx, 0x209030f11140b0c
mov qword [rsp + 0x40], rdx
movabs rdx, 0x6010f0a06010e11
mov qword [rsp + 0x48], rdx
xor eax, eax
jmp 0x4bd439
movzx r9d, byte [rsp + rsi + 0x1d]
lea edx, [r9 + rdx]
lea edx, [rdx + 4]
mov byte [rsp + rdi + 0x1d], dl
mov byte [rsp + rsi + 0x1d], r8b
add rax, 2
cmp rax, 0x1c
jge 0x4bd46b
movzx edx, byte [rsp + rax + 0x34]
movzx esi, byte [rsp + rax + 0x35]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x17
jae 0x4bd48e
movzx r8d, byte [rsp + rdi + 0x1d]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 4]
cmp rsi, 0x17
jb 0x4bd41f
jmp 0x4bd482
xor eax, eax
lea rbx, [rsp + 0x1d]
mov ecx, 0x17
call fcn.0044bb20
add rsp, 0x50
pop rbp
ret
mov eax, esi
mov ecx, 0x17
call fcn.00461020
mov eax, edi
mov ecx, 0x17
call fcn.00461020
nop
nop dword [rax + rax]
call fcn.0045eda0
jmp fcn.004bd3a0