joyce8/EMBER2024-capa huggingface dataset:
Function at 0x488d00
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x488e1a
push rbp
mov rbp, rsp
sub rsp, 0x58
movabs rdx, 0x6b7f7827400e62d
mov qword [rsp + 0x18], rdx
movabs rdx, 0x576c980d2d10ff65
mov qword [rsp + 0x20], rdx
movabs rdx, 0x691b576c980d2d10
mov qword [rsp + 0x22], rdx
movabs rdx, 0xe2759e797403f28c
mov qword [rsp + 0x2a], rdx
movabs rdx, 0x1601060f0c17100a
mov qword [rsp + 0x32], rdx
movabs rdx, 0xd0b0500140c1601
mov qword [rsp + 0x38], rdx
movabs rdx, 0x6070412140a020f
mov qword [rsp + 0x40], rdx
movabs rdx, 0x7051419120b140d
mov qword [rsp + 0x48], rdx
movabs rdx, 0x130a010413160907
mov qword [rsp + 0x50], rdx
xor eax, eax
jmp 0x488db7
movzx r9d, byte [rsp + rsi + 0x18]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x4a]
mov byte [rsp + rdi + 0x18], dl
mov byte [rsp + rsi + 0x18], r8b
add rax, 2
cmp rax, 0x26
jge 0x488de9
movzx edx, byte [rsp + rax + 0x32]
movzx esi, byte [rsp + rax + 0x33]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x1a
jae 0x488e0d
movzx r8d, byte [rsp + rdi + 0x18]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x4a]
cmp rsi, 0x1a
jb 0x488d9d
jmp 0x488e01
xor eax, eax
lea rbx, [rsp + 0x18]
mov ecx, 0x1a
call fcn.0043b400
add rsp, 0x58
pop rbp
nop
ret
mov eax, esi
mov ecx, 0x1a
call fcn.00449a60
mov eax, edi
mov ecx, 0x1a
call fcn.00449a60
nop
call fcn.00447800
nop
jmp fcn.00488d00

Function at 0x489320
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x48940c
push rbp
mov rbp, rsp
sub rsp, 0x48
movabs rdx, 0xf772844477610152
mov qword [rsp + 0x1d], rdx
movabs rdx, 0x79710074d4f77284
mov qword [rsp + 0x22], rdx
movabs rdx, 0xe6abfdf06edce3f4
mov qword [rsp + 0x2a], rdx
movabs rdx, 0x10a120b050a1305
mov qword [rsp + 0x32], rdx
movabs rdx, 0xa1103130f14010a
mov qword [rsp + 0x38], rdx
movabs rdx, 0x1110d0813070e12
mov qword [rsp + 0x40], rdx
xor eax, eax
jmp 0x4893aa
movzx r9d, byte [rsp + rsi + 0x1d]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x58]
mov byte [rsp + rdi + 0x1d], dl
mov byte [rsp + rsi + 0x1d], r8b
add rax, 2
cmp rax, 0x16
jge 0x4893dc
movzx edx, byte [rsp + rax + 0x32]
movzx esi, byte [rsp + rax + 0x33]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x15
jae 0x4893ff
movzx r8d, byte [rsp + rdi + 0x1d]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x58]
cmp rsi, 0x15
jb 0x489390
jmp 0x4893f3
xor eax, eax
lea rbx, [rsp + 0x1d]
mov ecx, 0x15
call fcn.0043b400
add rsp, 0x48
pop rbp
ret
mov eax, esi
mov ecx, 0x15
call fcn.00449a60
mov eax, edi
mov ecx, 0x15
call fcn.00449a60
nop
call fcn.00447800
jmp fcn.00489320
Function at 0x48a2a0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x48a366
push rbp
mov rbp, rsp
sub rsp, 0x38
movabs rdx, 0x8d4f646a456b6574
mov qword [rsp + 0x1e], rdx
mov dword [rsp + 0x26], 0x936f6984
movabs rdx, 0x2080b0a00040207
mov qword [rsp + 0x2a], rdx
movabs rdx, 0xb00080a000a0208
mov qword [rsp + 0x30], rdx
xor eax, eax
jmp 0x48a302
movzx r9d, byte [rsp + rsi + 0x1e]
sub r9d, edx
mov byte [rsp + rdi + 0x1e], r9b
mov byte [rsp + rsi + 0x1e], r8b
add rax, 2
cmp rax, 0xe
jge 0x48a32f
movzx edx, byte [rsp + rax + 0x2a]
movzx esi, byte [rsp + rax + 0x2b]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0xc
jae 0x48a357
movzx r8d, byte [rsp + rdi + 0x1e]
sub r8d, edx
cmp rsi, 0xc
jb 0x48a2eb
jmp 0x48a34b
xor eax, eax
lea rbx, [rsp + 0x1e]
mov ecx, 0xc
nop dword [rax + rax]
call fcn.0043b400
add rsp, 0x38
pop rbp
ret
mov eax, esi
mov ecx, 0xc
call fcn.00449a60
mov eax, edi
mov ecx, 0xc
nop
call fcn.00449a60
nop
call fcn.00447800
jmp fcn.0048a2a0

Function at 0x48a9a0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x48aa6c
push rbp
mov rbp, rsp
sub rsp, 0x38
movabs rdx, 0x357026c9cfb4c513
mov qword [rsp + 0x1d], rdx
movabs rdx, 0x1fdc69357026c9cf
mov qword [rsp + 0x20], rdx
movabs rdx, 0xa00060005010a00
mov qword [rsp + 0x28], rdx
movabs rdx, 0x30a010402090702
mov qword [rsp + 0x30], rdx
xor eax, eax
jmp 0x48aa0f
movzx r9d, byte [rsp + rsi + 0x1d]
sub r9d, edx
lea edx, [r9 - 0x53]
mov byte [rsp + rdi + 0x1d], dl
lea edx, [r8 - 0x53]
mov byte [rsp + rsi + 0x1d], dl
add rax, 2
cmp rax, 0x10
jge 0x48aa3c
movzx edx, byte [rsp + rax + 0x28]
movzx esi, byte [rsp + rax + 0x29]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0xb
jae 0x48aa5f
movzx r8d, byte [rsp + rdi + 0x1d]
sub r8d, edx
cmp rsi, 0xb
jb 0x48a9f2
jmp 0x48aa53
xor eax, eax
lea rbx, [rsp + 0x1d]
mov ecx, 0xb
call fcn.0043b400
add rsp, 0x38
pop rbp
ret
mov eax, esi
mov ecx, 0xb
call fcn.00449a60
mov eax, edi
mov ecx, 0xb
call fcn.00449a60
nop
call fcn.00447800
jmp fcn.0048a9a0
Function at 0x48f820
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x48f906
push rbp
mov rbp, rsp
sub rsp, 0x38
movabs rdx, 0x72fb696565e3eb46
mov qword [rsp + 0x19], rdx
movabs rdx, 0x576fbbd0db72fb69
mov qword [rsp + 0x1e], rdx
movabs rdx, 0x501010501060509
mov qword [rsp + 0x26], rdx
movabs rdx, 0xa04050101050106
mov qword [rsp + 0x28], rdx
movabs rdx, 0x802090a0a010205
mov qword [rsp + 0x30], rdx
xor eax, eax
nop
jmp 0x48f8a0
movzx r9d, byte [rsp + rsi + 0x19]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x70]
mov byte [rsp + rdi + 0x19], dl
mov byte [rsp + rsi + 0x19], r8b
add rax, 2
nop dword [rax]
cmp rax, 0x12
jge 0x48f8d2
movzx edx, byte [rsp + rax + 0x26]
movzx esi, byte [rsp + rax + 0x27]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0xd
jae 0x48f8f7
movzx r8d, byte [rsp + rdi + 0x19]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x70]
cmp rsi, 0xd
jb 0x48f882
jmp 0x48f8eb
xor eax, eax
lea rbx, [rsp + 0x19]
mov ecx, 0xd
nop
call fcn.0043b400
add rsp, 0x38
pop rbp
ret
mov eax, esi
mov ecx, 0xd
call fcn.00449a60
mov eax, edi
mov ecx, 0xd
nop
call fcn.00449a60
nop
call fcn.00447800
jmp fcn.0048f820

Function at 0x49d700
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x49d7cc
push rbp
mov rbp, rsp
sub rsp, 0x38
movabs rdx, 0x3233cb928f08476b
mov qword [rsp + 0x1c], rdx
mov dword [rsp + 0x24], 0xddcfd435
movabs rdx, 0xa080a02010a030b
mov qword [rsp + 0x28], rdx
movabs rdx, 0x905090a0b050a04
mov qword [rsp + 0x30], rdx
xor eax, eax
jmp 0x49d765
movzx r9d, byte [rsp + rsi + 0x1c]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x77]
mov byte [rsp + rdi + 0x1c], dl
mov byte [rsp + rsi + 0x1c], r8b
add rax, 2
cmp rax, 0x10
jge 0x49d79c
movzx edx, byte [rsp + rax + 0x28]
movzx esi, byte [rsp + rax + 0x29]
mov edi, edx
xor edx, esi
add edx, eax
nop dword [rax + rax]
cmp rdi, 0xc
jae 0x49d7bf
movzx r8d, byte [rsp + rdi + 0x1c]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x77]
cmp rsi, 0xc
jb 0x49d74b
jmp 0x49d7b3
xor eax, eax
lea rbx, [rsp + 0x1c]
mov ecx, 0xc
call fcn.0043b400
add rsp, 0x38
pop rbp
ret
mov eax, esi
mov ecx, 0xc
call fcn.00449a60
mov eax, edi
mov ecx, 0xc
call fcn.00449a60
nop
call fcn.00447800
jmp fcn.0049d700
Function at 0x49d7e0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x49d8ac
push rbp
mov rbp, rsp
sub rsp, 0x38
movabs rdx, 0x74a665120c8eb2b5
mov qword [rsp + 0x19], rdx
movabs rdx, 0xc4ae450f65fee274
mov qword [rsp + 0x20], rdx
movabs rdx, 0xe0b0d0803090803
mov qword [rsp + 0x28], rdx
movabs rdx, 0x60e010203040e
mov qword [rsp + 0x30], rdx
xor eax, eax
jmp 0x49d84f
movzx r9d, byte [rsp + rsi + 0x19]
sub r9d, edx
lea edx, [r9 - 0x40]
mov byte [rsp + rdi + 0x19], dl
lea edx, [r8 - 0x40]
mov byte [rsp + rsi + 0x19], dl
add rax, 2
cmp rax, 0x10
jge 0x49d87c
movzx edx, byte [rsp + rax + 0x28]
movzx esi, byte [rsp + rax + 0x29]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0xf
jae 0x49d89f
movzx r8d, byte [rsp + rdi + 0x19]
sub r8d, edx
cmp rsi, 0xf
jb 0x49d832
jmp 0x49d893
xor eax, eax
lea rbx, [rsp + 0x19]
mov ecx, 0xf
call fcn.0043b400
add rsp, 0x38
pop rbp
ret
mov eax, esi
mov ecx, 0xf
call fcn.00449a60
mov eax, edi
mov ecx, 0xf
call fcn.00449a60
nop
call fcn.00447800
jmp fcn.0049d7e0

Function at 0x49dba0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x49dc6c
push rbp
mov rbp, rsp
sub rsp, 0x38
movabs rdx, 0xb3adbd6544c0f8ed
mov qword [rsp + 0x19], rdx
movabs rdx, 0xb4650d08a956ebb3
mov qword [rsp + 0x20], rdx
movabs rdx, 0x80c0e0b01060100
mov qword [rsp + 0x28], rdx
movabs rdx, 0xa05080c0e0702
mov qword [rsp + 0x30], rdx
xor eax, eax
jmp 0x49dc0f
movzx r9d, byte [rsp + rsi + 0x19]
sub r9d, edx
lea edx, [r9 - 0x3f]
mov byte [rsp + rdi + 0x19], dl
lea edx, [r8 - 0x3f]
mov byte [rsp + rsi + 0x19], dl
add rax, 2
cmp rax, 0x10
jge 0x49dc3c
movzx edx, byte [rsp + rax + 0x28]
movzx esi, byte [rsp + rax + 0x29]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0xf
jae 0x49dc5f
movzx r8d, byte [rsp + rdi + 0x19]
sub r8d, edx
cmp rsi, 0xf
jb 0x49dbf2
jmp 0x49dc53
xor eax, eax
lea rbx, [rsp + 0x19]
mov ecx, 0xf
call fcn.0043b400
add rsp, 0x38
pop rbp
ret
mov eax, esi
mov ecx, 0xf
call fcn.00449a60
mov eax, edi
mov ecx, 0xf
call fcn.00449a60
nop
call fcn.00447800
jmp fcn.0049dba0
Function at 0x49dc80
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x49dd6a
push rbp
mov rbp, rsp
sub rsp, 0x40
movabs rdx, 0x4d6461a2d0600efc
mov qword [rsp + 0x1b], rdx
movabs rdx, 0xc64d6461a2d0600e
mov qword [rsp + 0x1c], rdx
movabs rdx, 0x57fa6ef47274584e
mov qword [rsp + 0x24], rdx
movabs rdx, 0x4080d090d020a0d
mov qword [rsp + 0x2c], rdx
movabs rdx, 0x102030f04080d09
mov qword [rsp + 0x30], rdx
movabs rdx, 0x90800000f04090d
mov qword [rsp + 0x38], rdx
xor eax, eax
jmp 0x49dd0d
movzx r9d, byte [rsp + rsi + 0x1b]
sub r9d, edx
lea edx, [r9 + 0x66]
mov byte [rsp + rdi + 0x1b], dl
lea edx, [r8 + 0x66]
mov byte [rsp + rsi + 0x1b], dl
add rax, 2
cmp rax, 0x14
jge 0x49dd3a
movzx edx, byte [rsp + rax + 0x2c]
movzx esi, byte [rsp + rax + 0x2d]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x11
jae 0x49dd5d
movzx r8d, byte [rsp + rdi + 0x1b]
sub r8d, edx
cmp rsi, 0x11
jb 0x49dcf0
jmp 0x49dd51
xor eax, eax
lea rbx, [rsp + 0x1b]
mov ecx, 0x11
call fcn.0043b400
add rsp, 0x40
pop rbp
ret
mov eax, esi
mov ecx, 0x11
call fcn.00449a60
mov eax, edi
mov ecx, 0x11
call fcn.00449a60
nop
call fcn.00447800
jmp fcn.0049dc80

Function at 0x49f140
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x49f206
push rbp
mov rbp, rsp
sub rsp, 0x30
movabs rdx, 0xd9626d65f60e739f
mov qword [rsp + 0x1b], rdx
mov byte [rsp + 0x23], 0x72
movabs rdx, 0x107030003000100
mov qword [rsp + 0x24], rdx
mov dword [rsp + 0x2c], 0x20107
xor eax, eax
nop
jmp 0x49f1a0
movzx r9d, byte [rsp + rsi + 0x1b]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x39]
mov byte [rsp + rdi + 0x1b], dl
mov byte [rsp + rsi + 0x1b], r8b
add rax, 2
nop dword [rax]
cmp rax, 0xc
jge 0x49f1d2
movzx edx, byte [rsp + rax + 0x24]
movzx esi, byte [rsp + rax + 0x25]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 9
jae 0x49f1f7
movzx r8d, byte [rsp + rdi + 0x1b]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x39]
cmp rsi, 9
jb 0x49f182
jmp 0x49f1eb
xor eax, eax
lea rbx, [rsp + 0x1b]
mov ecx, 9
nop
call fcn.0043b400
add rsp, 0x30
pop rbp
ret
mov eax, esi
mov ecx, 9
call fcn.00449a60
mov eax, edi
mov ecx, 9
nop
call fcn.00449a60
nop
call fcn.00447800
jmp fcn.0049f140

Function at 0x49f220
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x49f2d8
push rbp
mov rbp, rsp
sub rsp, 0x30
movabs rdx, 0xc3c537d330c2d14e
mov qword [rsp + 0x1e], rdx
movabs rdx, 0x104060703060205
mov qword [rsp + 0x26], rdx
mov word [rsp + 0x2e], 0x202
xor eax, eax
jmp 0x49f278
movzx r9d, byte [rsp + rsi + 0x1e]
sub r9d, edx
lea edx, [r9 - 0x59]
mov byte [rsp + rdi + 0x1e], dl
lea edx, [r8 - 0x59]
mov byte [rsp + rsi + 0x1e], dl
add rax, 2
cmp rax, 0xa
jge 0x49f2a8
movzx edx, byte [rsp + rax + 0x26]
movzx esi, byte [rsp + rax + 0x27]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 8
jae 0x49f2cb
movzx r8d, byte [rsp + rdi + 0x1e]
sub r8d, edx
nop dword [rax]
cmp rsi, 8
jb 0x49f25b
jmp 0x49f2bf
xor eax, eax
lea rbx, [rsp + 0x1e]
mov ecx, 8
call fcn.0043b400
add rsp, 0x30
pop rbp
ret
mov eax, esi
mov ecx, 8
call fcn.00449a60
mov eax, edi
mov ecx, 8
call fcn.00449a60
nop
call fcn.00447800
nop dword [rax]
jmp fcn.0049f220
Function at 0x4a3620
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4a370c
push rbp
mov rbp, rsp
sub rsp, 0x48
movabs rdx, 0x3927ca163f332754
mov qword [rsp + 0x19], rdx
movabs rdx, 0x64392f7464e1e739
mov qword [rsp + 0x20], rdx
movabs rdx, 0x173c69541eeaed21
mov qword [rsp + 0x28], rdx
movabs rdx, 0xa040111070d0803
mov qword [rsp + 0x30], rdx
movabs rdx, 0x40c031615061510
mov qword [rsp + 0x38], rdx
movabs rdx, 0x12050c0f0c090201
mov qword [rsp + 0x40], rdx
xor eax, eax
jmp 0x4a36aa
movzx r9d, byte [rsp + rsi + 0x19]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x29]
mov byte [rsp + rdi + 0x19], dl
mov byte [rsp + rsi + 0x19], r8b
add rax, 2
cmp rax, 0x18
jge 0x4a36dc
movzx edx, byte [rsp + rax + 0x30]
movzx esi, byte [rsp + rax + 0x31]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x17
jae 0x4a36ff
movzx r8d, byte [rsp + rdi + 0x19]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x29]
cmp rsi, 0x17
jb 0x4a3690
jmp 0x4a36f3
xor eax, eax
lea rbx, [rsp + 0x19]
mov ecx, 0x17
call fcn.0043b400
add rsp, 0x48
pop rbp
ret
mov eax, esi
mov ecx, 0x17
call fcn.00449a60
mov eax, edi
mov ecx, 0x17
call fcn.00449a60
nop
call fcn.00447800
jmp fcn.004a3620

Function at 0x4a6d00
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4a6e27
push rbp
mov rbp, rsp
sub rsp, 0x60
movabs rdx, 0x4541ab3128e475cd
mov qword [rsp + 0x18], rdx
movabs rdx, 0x2f77c34616c21864
mov qword [rsp + 0x20], rdx
movabs rdx, 0x6440d6e2c3c92f77
mov qword [rsp + 0x26], rdx
movabs rdx, 0x75a680b12064d3ce
mov qword [rsp + 0x2e], rdx
movabs rdx, 0x1d0f11030c10051b
mov qword [rsp + 0x36], rdx
movabs rdx, 0xe09090b04131414
mov qword [rsp + 0x3e], rdx
movabs rdx, 0x1c0f0e09090b0413
mov qword [rsp + 0x40], rdx
movabs rdx, 0x1b1007001c110f10
mov qword [rsp + 0x48], rdx
movabs rdx, 0x171412021a0a0d0b
mov qword [rsp + 0x50], rdx
movabs rdx, 0x171013160d101d00
mov qword [rsp + 0x58], rdx
xor eax, eax
jmp 0x4a6dc9
movzx r9d, byte [rsp + rsi + 0x18]
sub r9d, edx
lea edx, [r9 - 0x42]
mov byte [rsp + rdi + 0x18], dl
lea edx, [r8 - 0x42]
mov byte [rsp + rsi + 0x18], dl
add rax, 2
cmp rax, 0x2a
jge 0x4a6df7
movzx edx, byte [rsp + rax + 0x36]
movzx esi, byte [rsp + rax + 0x37]
mov edi, edx
xor edx, esi
add edx, eax
nop
cmp rdi, 0x1e
jae 0x4a6e1a
movzx r8d, byte [rsp + rdi + 0x18]
sub r8d, edx
cmp rsi, 0x1e
jb 0x4a6dac
jmp 0x4a6e0e
xor eax, eax
lea rbx, [rsp + 0x18]
mov ecx, 0x1e
call fcn.0043b400
add rsp, 0x60
pop rbp
ret
mov eax, esi
mov ecx, 0x1e
call fcn.00449a60
mov eax, edi
mov ecx, 0x1e
call fcn.00449a60
nop
call fcn.00447800
jmp fcn.004a6d00
Function at 0x4a6e40
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4a6f5d
push rbp
mov rbp, rsp
sub rsp, 0x60
movabs rdx, 0xf3ed6184920865ca
mov qword [rsp + 0x1b], rdx
movabs rdx, 0xdb6163698e85aa41
mov qword [rsp + 0x23], rdx
movabs rdx, 0xb96e619da3db6163
mov qword [rsp + 0x28], rdx
movabs rdx, 0x656d294f7595ac9f
mov qword [rsp + 0x30], rdx
movabs rdx, 0x60a150b140f0f17
mov qword [rsp + 0x38], rdx
movabs rdx, 0x90407140f170a18
mov qword [rsp + 0x40], rdx
movabs rdx, 0xf19060010040214
mov qword [rsp + 0x48], rdx
movabs rdx, 0x1a11140f0f1a0302
mov qword [rsp + 0x50], rdx
movabs rdx, 0x1116140609180f0a
mov qword [rsp + 0x58], rdx
xor eax, eax
jmp 0x4a6f00
movzx r9d, byte [rsp + rsi + 0x1b]
sub r9d, edx
lea edx, [r9 - 0xb]
mov byte [rsp + rdi + 0x1b], dl
lea edx, [r8 - 0xb]
mov byte [rsp + rsi + 0x1b], dl
add rax, 2
nop word [rax + rax]
cmp rax, 0x28
jge 0x4a6f2d
movzx edx, byte [rsp + rax + 0x38]
movzx esi, byte [rsp + rax + 0x39]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x1d
jae 0x4a6f50
movzx r8d, byte [rsp + rdi + 0x1b]
sub r8d, edx
cmp rsi, 0x1d
jb 0x4a6edd
jmp 0x4a6f44
xor eax, eax
lea rbx, [rsp + 0x1b]
mov ecx, 0x1d
call fcn.0043b400
add rsp, 0x60
pop rbp
ret
mov eax, esi
mov ecx, 0x1d
call fcn.00449a60
mov eax, edi
mov ecx, 0x1d
call fcn.00449a60
nop
nop dword [rax]
call fcn.00447800
jmp fcn.004a6e40

Function at 0x4a8480
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4a85ac
push rbp
mov rbp, rsp
sub rsp, 0x68
movabs rdx, 0x6e84487404116fa2
mov qword [rsp + 0x1f], rdx
movabs rdx, 0x9661210a228a8420
mov qword [rsp + 0x27], rdx
movabs rdx, 0x9ff816da0de65d96
mov qword [rsp + 0x2e], rdx
movabs rdx, 0x59b663693165655c
mov qword [rsp + 0x36], rdx
movabs rdx, 0x3100c1405020f16
mov qword [rsp + 0x3e], rdx
movabs rdx, 0x1109160d0a0b1a0a
mov qword [rsp + 0x46], rdx
movabs rdx, 0x3171109160d0a0b
mov qword [rsp + 0x48], rdx
movabs rdx, 0x1d16150c180c1602
mov qword [rsp + 0x50], rdx
movabs rdx, 0x1e111511121a0611
mov qword [rsp + 0x58], rdx
movabs rdx, 0xb13110018030f02
mov qword [rsp + 0x60], rdx
xor eax, eax
jmp 0x4a8546
movzx r9d, byte [rsp + rsi + 0x1f]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x47]
mov byte [rsp + rdi + 0x1f], dl
mov byte [rsp + rsi + 0x1f], r8b
add rax, 2
cmp rax, 0x2a
jge 0x4a857c
movzx edx, byte [rsp + rax + 0x3e]
movzx esi, byte [rsp + rax + 0x3f]
mov edi, edx
xor edx, esi
add edx, eax
nop dword [rax]
cmp rdi, 0x1f
jae 0x4a859f
movzx r8d, byte [rsp + rdi + 0x1f]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x47]
cmp rsi, 0x1f
jb 0x4a852c
jmp 0x4a8593
xor eax, eax
lea rbx, [rsp + 0x1f]
mov ecx, 0x1f
call fcn.0043b400
add rsp, 0x68
pop rbp
ret
mov eax, esi
mov ecx, 0x1f
call fcn.00449a60
mov eax, edi
mov ecx, 0x1f
call fcn.00449a60
nop
call fcn.00447800
jmp fcn.004a8480
Function at 0x4ac0c0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4ac1e7
push rbp
mov rbp, rsp
sub rsp, 0x68
movabs rdx, 0xcffa692ebf4b613b
mov qword [rsp + 0x1e], rdx
movabs rdx, 0xf81640f76e394653
mov qword [rsp + 0x26], rdx
movabs rdx, 0x35070712362cf816
mov qword [rsp + 0x2c], rdx
movabs rdx, 0x34bb386942105328
mov qword [rsp + 0x34], rdx
movabs rdx, 0x7120318060f0314
mov qword [rsp + 0x3c], rdx
movabs rdx, 0x1b151b1c13071909
mov qword [rsp + 0x44], rdx
movabs rdx, 0x10041d121b151b1c
mov qword [rsp + 0x48], rdx
movabs rdx, 0x110d110f140c060a
mov qword [rsp + 0x50], rdx
movabs rdx, 0x170417030e040c10
mov qword [rsp + 0x58], rdx
movabs rdx, 0x7140f120700020f
mov qword [rsp + 0x60], rdx
xor eax, eax
jmp 0x4ac189
movzx r9d, byte [rsp + rsi + 0x1e]
sub r9d, edx
lea edx, [r9 + 0x4a]
mov byte [rsp + rdi + 0x1e], dl
lea edx, [r8 + 0x4a]
mov byte [rsp + rsi + 0x1e], dl
add rax, 2
cmp rax, 0x2c
jge 0x4ac1b7
movzx edx, byte [rsp + rax + 0x3c]
movzx esi, byte [rsp + rax + 0x3d]
mov edi, edx
xor edx, esi
add edx, eax
nop
cmp rdi, 0x1e
jae 0x4ac1da
movzx r8d, byte [rsp + rdi + 0x1e]
sub r8d, edx
cmp rsi, 0x1e
jb 0x4ac16c
jmp 0x4ac1ce
xor eax, eax
lea rbx, [rsp + 0x1e]
mov ecx, 0x1e
call fcn.0043b400
add rsp, 0x68
pop rbp
ret
mov eax, esi
mov ecx, 0x1e
call fcn.00449a60
mov eax, edi
mov ecx, 0x1e
call fcn.00449a60
nop
call fcn.00447800
jmp fcn.004ac0c0

Function at 0x4acf80
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4ad06a
push rbp
mov rbp, rsp
sub rsp, 0x48
movabs rdx, 0xbc91b5894f7fb741
mov qword [rsp + 0x1d], rdx
movabs rdx, 0x64399abc91b5894f
mov qword [rsp + 0x20], rdx
movabs rdx, 0x9a6d967372bc7261
mov qword [rsp + 0x28], rdx
movabs rdx, 0x9050e0d03010605
mov qword [rsp + 0x30], rdx
movabs rdx, 0xe01060407120e03
mov qword [rsp + 0x38], rdx
movabs rdx, 0x30208121004060f
mov qword [rsp + 0x40], rdx
xor eax, eax
jmp 0x4ad00d
movzx r9d, byte [rsp + rsi + 0x1d]
sub r9d, edx
lea edx, [r9 - 7]
mov byte [rsp + rdi + 0x1d], dl
lea edx, [r8 - 7]
mov byte [rsp + rsi + 0x1d], dl
add rax, 2
cmp rax, 0x18
jge 0x4ad03a
movzx edx, byte [rsp + rax + 0x30]
movzx esi, byte [rsp + rax + 0x31]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x13
jae 0x4ad05d
movzx r8d, byte [rsp + rdi + 0x1d]
sub r8d, edx
cmp rsi, 0x13
jb 0x4acff0
jmp 0x4ad051
xor eax, eax
lea rbx, [rsp + 0x1d]
mov ecx, 0x13
call fcn.0043b400
add rsp, 0x48
pop rbp
ret
mov eax, esi
mov ecx, 0x13
call fcn.00449a60
mov eax, edi
mov ecx, 0x13
call fcn.00449a60
nop
call fcn.00447800
jmp fcn.004acf80
Function at 0x4ad620
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4ad71d
push rbp
mov rbp, rsp
sub rsp, 0x50
movabs rdx, 0x283961b4200db320
mov qword [rsp + 0x19], rdx
movabs rdx, 0xba3c6159e50cfc28
mov qword [rsp + 0x20], rdx
movabs rdx, 0x2b4233a2e9647215
mov qword [rsp + 0x28], rdx
movabs rdx, 0x7011413130b07
mov qword [rsp + 0x30], rdx
movabs rdx, 0x90a00120f040f0e
mov qword [rsp + 0x38], rdx
movabs rdx, 0x9130f0d140d0200
mov qword [rsp + 0x40], rdx
movabs rdx, 0x1616150808120d06
mov qword [rsp + 0x48], rdx
xor eax, eax
jmp 0x4ad6c0
movzx r9d, byte [rsp + rsi + 0x19]
sub r9d, edx
lea edx, [r9 + 0x58]
mov byte [rsp + rdi + 0x19], dl
lea edx, [r8 + 0x58]
mov byte [rsp + rsi + 0x19], dl
add rax, 2
nop dword [rax]
cmp rax, 0x20
jge 0x4ad6ed
movzx edx, byte [rsp + rax + 0x30]
movzx esi, byte [rsp + rax + 0x31]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x17
jae 0x4ad710
movzx r8d, byte [rsp + rdi + 0x19]
sub r8d, edx
cmp rsi, 0x17
jb 0x4ad69f
jmp 0x4ad704
xor eax, eax
lea rbx, [rsp + 0x19]
mov ecx, 0x17
call fcn.0043b400
add rsp, 0x50
pop rbp
ret
mov eax, esi
mov ecx, 0x17
call fcn.00449a60
mov eax, edi
mov ecx, 0x17
call fcn.00449a60
nop
nop dword [rax]
call fcn.00447800
jmp fcn.004ad620

Function at 0x4adfe0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4ae0ec
push rbp
mov rbp, rsp
sub rsp, 0x50
movabs rdx, 0x467da6f1e102e57
mov qword [rsp + 0x1b], rdx
movabs rdx, 0x79b806f920abc06c
mov qword [rsp + 0x23], rdx
movabs rdx, 0x2d79b806f920abc0
mov qword [rsp + 0x24], rdx
movabs rdx, 0xc4fad06720c27261
mov qword [rsp + 0x2c], rdx
movabs rdx, 0x7160d17150c0210
mov qword [rsp + 0x34], rdx
movabs rdx, 0x5130918050d0310
mov qword [rsp + 0x3c], rdx
movabs rdx, 0x20f0c1305130918
mov qword [rsp + 0x40], rdx
movabs rdx, 0xa1613100c150e17
mov qword [rsp + 0x48], rdx
xor eax, eax
jmp 0x4ae088
movzx r9d, byte [rsp + rsi + 0x1b]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x78]
mov byte [rsp + rdi + 0x1b], dl
mov byte [rsp + rsi + 0x1b], r8b
add rax, 2
cmp rax, 0x1c
jge 0x4ae0bc
movzx edx, byte [rsp + rax + 0x34]
movzx esi, byte [rsp + rax + 0x35]
mov edi, edx
xor edx, esi
add edx, eax
nop
cmp rdi, 0x19
jae 0x4ae0df
movzx r8d, byte [rsp + rdi + 0x1b]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x78]
cmp rsi, 0x19
jb 0x4ae06e
jmp 0x4ae0d3
xor eax, eax
lea rbx, [rsp + 0x1b]
mov ecx, 0x19
call fcn.0043b400
add rsp, 0x50
pop rbp
ret
mov eax, esi
mov ecx, 0x19
call fcn.00449a60
mov eax, edi
mov ecx, 0x19
call fcn.00449a60
nop
call fcn.00447800
jmp fcn.004adfe0