joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4cec80
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4ced3d
push rbp
mov rbp, rsp
sub rsp, 0x30
movabs rdx, 0x14f9bea6057065be
mov qword [rsp + 0x1d], rdx
mov byte [rsp + 0x25], 0x18
movabs rdx, 0x600050807030004
mov qword [rsp + 0x26], rdx
mov word [rsp + 0x2e], 0x408
xor eax, eax
nop
jmp 0x4cece0
movzx r9d, byte [rsp + rsi + 0x1d]
sub r9d, edx
lea edx, [r9 + 0x66]
mov byte [rsp + rdi + 0x1d], dl
lea edx, [r8 + 0x66]
mov byte [rsp + rsi + 0x1d], dl
add rax, 2
nop
cmp rax, 0xa
jge 0x4ced0d
movzx edx, byte [rsp + rax + 0x26]
movzx esi, byte [rsp + rax + 0x27]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 9
jae 0x4ced30
movzx r8d, byte [rsp + rdi + 0x1d]
sub r8d, edx
cmp rsi, 9
jb 0x4cecc2
jmp 0x4ced24
xor eax, eax
lea rbx, [rsp + 0x1d]
mov ecx, 9
call fcn.00441380
add rsp, 0x30
pop rbp
ret
mov eax, esi
mov ecx, 9
call fcn.00451880
mov eax, edi
mov ecx, 9
call fcn.00451880
nop
nop dword [rax]
call fcn.0044f600
jmp fcn.004cec80

Function at 0x4cefa0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4cf08a
push rbp
mov rbp, rsp
sub rsp, 0x48
movabs rdx, 0x569a20c37cc66974
mov qword [rsp + 0x1e], rdx
movabs rdx, 0xaf8561c7569a20c3
mov qword [rsp + 0x22], rdx
movabs rdx, 0xa69e62a9dc6ee865
mov qword [rsp + 0x2a], rdx
movabs rdx, 0xa0c070403030f10
mov qword [rsp + 0x32], rdx
movabs rdx, 0x12060a020a0d0a0c
mov qword [rsp + 0x38], rdx
movabs rdx, 0xa02080a130b0710
mov qword [rsp + 0x40], rdx
xor eax, eax
jmp 0x4cf02d
movzx r9d, byte [rsp + rsi + 0x1e]
sub r9d, edx
lea edx, [r9 - 0x15]
mov byte [rsp + rdi + 0x1e], dl
lea edx, [r8 - 0x15]
mov byte [rsp + rsi + 0x1e], dl
add rax, 2
cmp rax, 0x16
jge 0x4cf05a
movzx edx, byte [rsp + rax + 0x32]
movzx esi, byte [rsp + rax + 0x33]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x14
jae 0x4cf07d
movzx r8d, byte [rsp + rdi + 0x1e]
sub r8d, edx
cmp rsi, 0x14
jb 0x4cf010
jmp 0x4cf071
xor eax, eax
lea rbx, [rsp + 0x1e]
mov ecx, 0x14
call fcn.00441380
add rsp, 0x48
pop rbp
ret
mov eax, esi
mov ecx, 0x14
call fcn.00451880
mov eax, edi
mov ecx, 0x14
call fcn.00451880
nop
call fcn.0044f600
jmp fcn.004cefa0
Function at 0x4d31c0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4d32ac
push rbp
mov rbp, rsp
sub rsp, 0x40
movabs rdx, 0xa8b520949762e751
mov qword [rsp + 0x19], rdx
movabs rdx, 0x646e61a8b5209497
mov qword [rsp + 0x1c], rdx
movabs rdx, 0xa4d8a09852c572a3
mov qword [rsp + 0x24], rdx
movabs rdx, 0x10d0f110e0d0611
mov qword [rsp + 0x2c], rdx
movabs rdx, 0x6040701010d0f11
mov qword [rsp + 0x30], rdx
movabs rdx, 0xb071012000e030d
mov qword [rsp + 0x38], rdx
xor eax, eax
jmp 0x4d324a
movzx r9d, byte [rsp + rsi + 0x19]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x4d]
mov byte [rsp + rdi + 0x19], dl
mov byte [rsp + rsi + 0x19], r8b
add rax, 2
cmp rax, 0x14
jge 0x4d327c
movzx edx, byte [rsp + rax + 0x2c]
movzx esi, byte [rsp + rax + 0x2d]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x13
jae 0x4d329f
movzx r8d, byte [rsp + rdi + 0x19]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x4d]
cmp rsi, 0x13
jb 0x4d3230
jmp 0x4d3293
xor eax, eax
lea rbx, [rsp + 0x19]
mov ecx, 0x13
call fcn.00441380
add rsp, 0x40
pop rbp
ret
mov eax, esi
mov ecx, 0x13
call fcn.00451880
mov eax, edi
mov ecx, 0x13
call fcn.00451880
nop
call fcn.0044f600
jmp fcn.004d31c0

Function at 0x4d3620
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4d371d
push rbp
mov rbp, rsp
sub rsp, 0x50
movabs rdx, 0x6e83f674758ca806
mov qword [rsp + 0x1c], rdx
movabs rdx, 0x3d6e567fc9206e83
mov qword [rsp + 0x22], rdx
movabs rdx, 0x12e7758504e5d593
mov qword [rsp + 0x2a], rdx
movabs rdx, 0x1206021515061413
mov qword [rsp + 0x32], rdx
movabs rdx, 0xf000b0d1505010a
mov qword [rsp + 0x3a], rdx
movabs rdx, 0xe06110b14090f00
mov qword [rsp + 0x40], rdx
movabs rdx, 0xa140d1110120106
mov qword [rsp + 0x48], rdx
xor eax, eax
jmp 0x4d36c0
movzx r9d, byte [rsp + rsi + 0x1c]
sub r9d, edx
lea edx, [r9 - 0x77]
mov byte [rsp + rdi + 0x1c], dl
lea edx, [r8 - 0x77]
mov byte [rsp + rsi + 0x1c], dl
add rax, 2
nop dword [rax]
cmp rax, 0x1e
jge 0x4d36ed
movzx edx, byte [rsp + rax + 0x32]
movzx esi, byte [rsp + rax + 0x33]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x16
jae 0x4d3710
movzx r8d, byte [rsp + rdi + 0x1c]
sub r8d, edx
cmp rsi, 0x16
jb 0x4d369f
jmp 0x4d3704
xor eax, eax
lea rbx, [rsp + 0x1c]
mov ecx, 0x16
call fcn.00441380
add rsp, 0x50
pop rbp
ret
mov eax, esi
mov ecx, 0x16
call fcn.00451880
mov eax, edi
mov ecx, 0x16
call fcn.00451880
nop
nop dword [rax]
call fcn.0044f600
jmp fcn.004d3620
Function at 0x4d5240
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4d533d
push rbp
mov rbp, rsp
sub rsp, 0x50
movabs rdx, 0xcbf043746bebe04d
mov qword [rsp + 0x1c], rdx
movabs rdx, 0xfc7a6153539bcbf0
mov qword [rsp + 0x22], rdx
movabs rdx, 0xe746f0545ccf9b67
mov qword [rsp + 0x2a], rdx
movabs rdx, 0x60a0811150c1014
mov qword [rsp + 0x32], rdx
movabs rdx, 0x107080607050e03
mov qword [rsp + 0x3a], rdx
movabs rdx, 0x130e01150a150107
mov qword [rsp + 0x40], rdx
movabs rdx, 0x1015020d0f030f08
mov qword [rsp + 0x48], rdx
xor eax, eax
jmp 0x4d52e0
movzx r9d, byte [rsp + rsi + 0x1c]
sub r9d, edx
lea edx, [r9 - 0x5e]
mov byte [rsp + rdi + 0x1c], dl
lea edx, [r8 - 0x5e]
mov byte [rsp + rsi + 0x1c], dl
add rax, 2
nop dword [rax]
cmp rax, 0x1e
jge 0x4d530d
movzx edx, byte [rsp + rax + 0x32]
movzx esi, byte [rsp + rax + 0x33]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x16
jae 0x4d5330
movzx r8d, byte [rsp + rdi + 0x1c]
sub r8d, edx
cmp rsi, 0x16
jb 0x4d52bf
jmp 0x4d5324
xor eax, eax
lea rbx, [rsp + 0x1c]
mov ecx, 0x16
call fcn.00441380
add rsp, 0x50
pop rbp
ret
mov eax, esi
mov ecx, 0x16
call fcn.00451880
mov eax, edi
mov ecx, 0x16
call fcn.00451880
nop
nop dword [rax]
call fcn.0044f600
jmp fcn.004d5240

Function at 0x4d56c0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4d57cc
push rbp
mov rbp, rsp
sub rsp, 0x58
movabs rdx, 0x206532654f3f6543
mov qword [rsp + 0x1b], rdx
movabs rdx, 0x536119786554593b
mov qword [rsp + 0x23], rdx
movabs rdx, 0x4d58647453536119
mov qword [rsp + 0x28], rdx
movabs rdx, 0x655664525c63014a
mov qword [rsp + 0x30], rdx
movabs rdx, 0xa060d1819090c0a
mov qword [rsp + 0x38], rdx
movabs rdx, 0x17150219131b091a
mov qword [rsp + 0x40], rdx
movabs rdx, 0x140c0805121b040b
mov qword [rsp + 0x48], rdx
movabs rdx, 0x305131a05170f16
mov qword [rsp + 0x50], rdx
xor eax, eax
jmp 0x4d5768
movzx r9d, byte [rsp + rsi + 0x1b]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x12]
mov byte [rsp + rdi + 0x1b], dl
mov byte [rsp + rsi + 0x1b], r8b
add rax, 2
cmp rax, 0x20
jge 0x4d579c
movzx edx, byte [rsp + rax + 0x38]
movzx esi, byte [rsp + rax + 0x39]
mov edi, edx
xor edx, esi
add edx, eax
nop
cmp rdi, 0x1d
jae 0x4d57bf
movzx r8d, byte [rsp + rdi + 0x1b]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x12]
cmp rsi, 0x1d
jb 0x4d574e
jmp 0x4d57b3
xor eax, eax
lea rbx, [rsp + 0x1b]
mov ecx, 0x1d
call fcn.00441380
add rsp, 0x58
pop rbp
ret
mov eax, esi
mov ecx, 0x1d
call fcn.00451880
mov eax, edi
mov ecx, 0x1d
call fcn.00451880
nop
call fcn.0044f600
jmp fcn.004d56c0
Function at 0x4d57e0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4d58db
push rbp
mov rbp, rsp
sub rsp, 0x50
movabs rdx, 0x6317cda7616c7404
mov qword [rsp + 0x1e], rdx
movabs rdx, 0x64c8c7740b306317
mov qword [rsp + 0x24], rdx
movabs rdx, 0xd5b1c5d120641061
mov qword [rsp + 0x2c], rdx
movabs rdx, 0xf1514041404130c
mov qword [rsp + 0x34], rdx
movabs rdx, 0x130c08150b131405
mov qword [rsp + 0x3c], rdx
movabs rdx, 0x15091412130c0815
mov qword [rsp + 0x40], rdx
movabs rdx, 0x90014060f040908
mov qword [rsp + 0x48], rdx
xor eax, eax
jmp 0x4d5879
movzx r9d, byte [rsp + rsi + 0x1e]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x2c]
mov byte [rsp + rdi + 0x1e], dl
mov byte [rsp + rsi + 0x1e], r8b
add rax, 2
cmp rax, 0x1c
jge 0x4d58ab
movzx edx, byte [rsp + rax + 0x34]
movzx esi, byte [rsp + rax + 0x35]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x16
jae 0x4d58ce
movzx r8d, byte [rsp + rdi + 0x1e]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x2c]
cmp rsi, 0x16
jb 0x4d585f
jmp 0x4d58c2
xor eax, eax
lea rbx, [rsp + 0x1e]
mov ecx, 0x16
call fcn.00441380
add rsp, 0x50
pop rbp
ret
mov eax, esi
mov ecx, 0x16
call fcn.00451880
mov eax, edi
mov ecx, 0x16
call fcn.00451880
nop
nop dword [rax + rax]
call fcn.0044f600
jmp fcn.004d57e0

Function at 0x4d5900
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4d59fd
push rbp
mov rbp, rsp
sub rsp, 0x48
movabs rdx, 0x651a61785f62756c
mov qword [rsp + 0x1c], rdx
movabs rdx, 0x3c3d651a61785f62
mov qword [rsp + 0x1e], rdx
movabs rdx, 0x876d5e7a68647290
mov qword [rsp + 0x26], rdx
movabs rdx, 0x406080e090f0509
mov qword [rsp + 0x2e], rdx
movabs rdx, 0xa0d010800000500
mov qword [rsp + 0x36], rdx
movabs rdx, 0x11010a0d01080000
mov qword [rsp + 0x38], rdx
movabs rdx, 0x60d070e03050e06
mov qword [rsp + 0x40], rdx
xor eax, eax
jmp 0x4d59a0
movzx r9d, byte [rsp + rsi + 0x1c]
sub r9d, edx
lea edx, [r9 + 0xe]
mov byte [rsp + rdi + 0x1c], dl
lea edx, [r8 + 0xe]
mov byte [rsp + rsi + 0x1c], dl
add rax, 2
nop dword [rax]
cmp rax, 0x1a
jge 0x4d59cd
movzx edx, byte [rsp + rax + 0x2e]
movzx esi, byte [rsp + rax + 0x2f]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x12
jae 0x4d59f0
movzx r8d, byte [rsp + rdi + 0x1c]
sub r8d, edx
cmp rsi, 0x12
jb 0x4d597f
jmp 0x4d59e4
xor eax, eax
lea rbx, [rsp + 0x1c]
mov ecx, 0x12
call fcn.00441380
add rsp, 0x48
pop rbp
ret
mov eax, esi
mov ecx, 0x12
call fcn.00451880
mov eax, edi
mov ecx, 0x12
call fcn.00451880
nop
nop dword [rax]
call fcn.0044f600
jmp fcn.004d5900
Function at 0x4d6c00
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4d6d0c
push rbp
mov rbp, rsp
sub rsp, 0x50
movabs rdx, 0x7406b06fa1205334
mov qword [rsp + 0x19], rdx
movabs rdx, 0x6e61846bebace4b9
mov qword [rsp + 0x21], rdx
movabs rdx, 0x296e61846bebace4
mov qword [rsp + 0x22], rdx
movabs rdx, 0xb9b9693decae7261
mov qword [rsp + 0x2a], rdx
movabs rdx, 0xc14150d00060910
mov qword [rsp + 0x32], rdx
movabs rdx, 0xb10100c170d0918
mov qword [rsp + 0x3a], rdx
movabs rdx, 0x1705031817150b10
mov qword [rsp + 0x40], rdx
movabs rdx, 0x80a130500100610
mov qword [rsp + 0x48], rdx
xor eax, eax
jmp 0x4d6ca8
movzx r9d, byte [rsp + rsi + 0x19]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x69]
mov byte [rsp + rdi + 0x19], dl
mov byte [rsp + rsi + 0x19], r8b
add rax, 2
cmp rax, 0x1e
jge 0x4d6cdc
movzx edx, byte [rsp + rax + 0x32]
movzx esi, byte [rsp + rax + 0x33]
mov edi, edx
xor edx, esi
add edx, eax
nop
cmp rdi, 0x19
jae 0x4d6cff
movzx r8d, byte [rsp + rdi + 0x19]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x69]
cmp rsi, 0x19
jb 0x4d6c8e
jmp 0x4d6cf3
xor eax, eax
lea rbx, [rsp + 0x19]
mov ecx, 0x19
call fcn.00441380
add rsp, 0x50
pop rbp
ret
mov eax, esi
mov ecx, 0x19
call fcn.00451880
mov eax, edi
mov ecx, 0x19
call fcn.00451880
nop
call fcn.0044f600
jmp fcn.004d6c00

Function at 0x4d7b00
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4d7c0c
push rbp
mov rbp, rsp
sub rsp, 0x50
movabs rdx, 0xf16e752415299401
mov qword [rsp + 0x1a], rdx
movabs rdx, 0x1774b9356496c3d0
mov qword [rsp + 0x22], rdx
movabs rdx, 0x64f31774b9356496
mov qword [rsp + 0x24], rdx
movabs rdx, 0xf06d69541bc92520
mov qword [rsp + 0x2c], rdx
movabs rdx, 0x1901140a10090c07
mov qword [rsp + 0x34], rdx
movabs rdx, 0x81209041301140c
mov qword [rsp + 0x3c], rdx
movabs rdx, 0x3100d08120904
mov qword [rsp + 0x40], rdx
movabs rdx, 0x191503020a120f10
mov qword [rsp + 0x48], rdx
xor eax, eax
jmp 0x4d7ba8
movzx r9d, byte [rsp + rsi + 0x1a]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x24]
mov byte [rsp + rdi + 0x1a], dl
mov byte [rsp + rsi + 0x1a], r8b
add rax, 2
cmp rax, 0x1c
jge 0x4d7bdc
movzx edx, byte [rsp + rax + 0x34]
movzx esi, byte [rsp + rax + 0x35]
mov edi, edx
xor edx, esi
add edx, eax
nop
cmp rdi, 0x1a
jae 0x4d7bff
movzx r8d, byte [rsp + rdi + 0x1a]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x24]
cmp rsi, 0x1a
jb 0x4d7b8e
jmp 0x4d7bf3
xor eax, eax
lea rbx, [rsp + 0x1a]
mov ecx, 0x1a
call fcn.00441380
add rsp, 0x50
pop rbp
ret
mov eax, esi
mov ecx, 0x1a
call fcn.00451880
mov eax, edi
mov ecx, 0x1a
call fcn.00451880
nop
call fcn.0044f600
jmp fcn.004d7b00
Function at 0x4da4c0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4da5bd
push rbp
mov rbp, rsp
sub rsp, 0x50
movabs rdx, 0xd4cdba7331ad6de0
mov qword [rsp + 0x1c], rdx
movabs rdx, 0x64decc36c374d4cd
mov qword [rsp + 0x22], rdx
movabs rdx, 0xaf57695420f2dbe9
mov qword [rsp + 0x2a], rdx
movabs rdx, 0x314080a020b0506
mov qword [rsp + 0x32], rdx
movabs rdx, 0xc0a140e0b090a0a
mov qword [rsp + 0x3a], rdx
movabs rdx, 0xe070c100f030c0a
mov qword [rsp + 0x40], rdx
movabs rdx, 0x1508080107091000
mov qword [rsp + 0x48], rdx
xor eax, eax
jmp 0x4da560
movzx r9d, byte [rsp + rsi + 0x1c]
sub r9d, edx
lea edx, [r9 - 0x56]
mov byte [rsp + rdi + 0x1c], dl
lea edx, [r8 - 0x56]
mov byte [rsp + rsi + 0x1c], dl
add rax, 2
nop dword [rax]
cmp rax, 0x1e
jge 0x4da58d
movzx edx, byte [rsp + rax + 0x32]
movzx esi, byte [rsp + rax + 0x33]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x16
jae 0x4da5b0
movzx r8d, byte [rsp + rdi + 0x1c]
sub r8d, edx
cmp rsi, 0x16
jb 0x4da53f
jmp 0x4da5a4
xor eax, eax
lea rbx, [rsp + 0x1c]
mov ecx, 0x16
call fcn.00441380
add rsp, 0x50
pop rbp
ret
mov eax, esi
mov ecx, 0x16
call fcn.00451880
mov eax, edi
mov ecx, 0x16
call fcn.00451880
nop
nop dword [rax]
call fcn.0044f600
jmp fcn.004da4c0

Function at 0x4da5e0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4da6db
push rbp
mov rbp, rsp
sub rsp, 0x48
movabs rdx, 0x8f3208b0d3ce1ee
mov qword [rsp + 0x1b], rdx
movabs rdx, 0xebf9db08f3208b0d
mov qword [rsp + 0x1e], rdx
movabs rdx, 0xfb65eaf26f0d7261
mov qword [rsp + 0x26], rdx
movabs rdx, 0x90d010f0207040e
mov qword [rsp + 0x2e], rdx
movabs rdx, 0x11120a0308000903
mov qword [rsp + 0x36], rdx
movabs rdx, 0x90e11120a030800
mov qword [rsp + 0x38], rdx
movabs rdx, 0x101204060a12070e
mov qword [rsp + 0x40], rdx
xor eax, eax
jmp 0x4da679
movzx r9d, byte [rsp + rsi + 0x1b]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x61]
mov byte [rsp + rdi + 0x1b], dl
mov byte [rsp + rsi + 0x1b], r8b
add rax, 2
cmp rax, 0x1a
jge 0x4da6ab
movzx edx, byte [rsp + rax + 0x2e]
movzx esi, byte [rsp + rax + 0x2f]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x13
jae 0x4da6ce
movzx r8d, byte [rsp + rdi + 0x1b]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x61]
cmp rsi, 0x13
jb 0x4da65f
jmp 0x4da6c2
xor eax, eax
lea rbx, [rsp + 0x1b]
mov ecx, 0x13
call fcn.00441380
add rsp, 0x48
pop rbp
ret
mov eax, esi
mov ecx, 0x13
call fcn.00451880
mov eax, edi
mov ecx, 0x13
call fcn.00451880
nop
nop dword [rax + rax]
call fcn.0044f600
jmp fcn.004da5e0
Function at 0x4da700
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4da7fb
push rbp
mov rbp, rsp
sub rsp, 0x50
movabs rdx, 0x73487968a471c8a0
mov qword [rsp + 0x1c], rdx
movabs rdx, 0x87be7c7453ba8269
mov qword [rsp + 0x24], rdx
movabs rdx, 0x657ea3619ab6a1e5
mov qword [rsp + 0x2c], rdx
movabs rdx, 0x5061306020a1011
mov qword [rsp + 0x34], rdx
movabs rdx, 0xf16151103010912
mov qword [rsp + 0x3c], rdx
movabs rdx, 0x3090e0f161511
mov qword [rsp + 0x40], rdx
movabs rdx, 0x1400050a0d150902
mov qword [rsp + 0x48], rdx
xor eax, eax
jmp 0x4da799
movzx r9d, byte [rsp + rsi + 0x1c]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x41]
mov byte [rsp + rdi + 0x1c], dl
mov byte [rsp + rsi + 0x1c], r8b
add rax, 2
cmp rax, 0x1c
jge 0x4da7cb
movzx edx, byte [rsp + rax + 0x34]
movzx esi, byte [rsp + rax + 0x35]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x18
jae 0x4da7ee
movzx r8d, byte [rsp + rdi + 0x1c]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x41]
cmp rsi, 0x18
jb 0x4da77f
jmp 0x4da7e2
xor eax, eax
lea rbx, [rsp + 0x1c]
mov ecx, 0x18
call fcn.00441380
add rsp, 0x50
pop rbp
ret
mov eax, esi
mov ecx, 0x18
call fcn.00451880
mov eax, edi
mov ecx, 0x18
call fcn.00451880
nop
nop dword [rax + rax]
call fcn.0044f600
jmp fcn.004da700

Function at 0x4da820
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4da91d
push rbp
mov rbp, rsp
sub rsp, 0x50
movabs rdx, 0x4ddb612ad63e30e7
mov qword [rsp + 0x1f], rdx
movabs rdx, 0xe7d5e8c7534ddb61
mov qword [rsp + 0x24], rdx
movabs rdx, 0xd18ed9e32050d1eb
mov qword [rsp + 0x2c], rdx
movabs rdx, 0xc131307120f0904
mov qword [rsp + 0x34], rdx
movabs rdx, 0x2120902130d0b0e
mov qword [rsp + 0x3c], rdx
movabs rdx, 0x901120d02120902
mov qword [rsp + 0x40], rdx
movabs rdx, 0x3110a0614140900
mov qword [rsp + 0x48], rdx
xor eax, eax
jmp 0x4da8c0
movzx r9d, byte [rsp + rsi + 0x1f]
sub r9d, edx
lea edx, [r9 - 0x56]
mov byte [rsp + rdi + 0x1f], dl
lea edx, [r8 - 0x56]
mov byte [rsp + rsi + 0x1f], dl
add rax, 2
nop dword [rax]
cmp rax, 0x1c
jge 0x4da8ed
movzx edx, byte [rsp + rax + 0x34]
movzx esi, byte [rsp + rax + 0x35]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x15
jae 0x4da910
movzx r8d, byte [rsp + rdi + 0x1f]
sub r8d, edx
cmp rsi, 0x15
jb 0x4da89f
jmp 0x4da904
xor eax, eax
lea rbx, [rsp + 0x1f]
mov ecx, 0x15
call fcn.00441380
add rsp, 0x50
pop rbp
ret
mov eax, esi
mov ecx, 0x15
call fcn.00451880
mov eax, edi
mov ecx, 0x15
call fcn.00451880
nop
nop dword [rax]
call fcn.0044f600
jmp fcn.004da820
Function at 0x4db160
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4db25d
push rbp
mov rbp, rsp
sub rsp, 0x50
movabs rdx, 0x64ace4e69e0b2934
mov qword [rsp + 0x19], rdx
movabs rdx, 0xdb340b2f2d20c864
mov qword [rsp + 0x20], rdx
movabs rdx, 0xed4752de32647241
mov qword [rsp + 0x28], rdx
movabs rdx, 0xb061204030b160a
mov qword [rsp + 0x30], rdx
movabs rdx, 0xd0b000205010808
mov qword [rsp + 0x38], rdx
movabs rdx, 0x80a06130e080c01
mov qword [rsp + 0x40], rdx
movabs rdx, 0xf0d150e0f061401
mov qword [rsp + 0x48], rdx
xor eax, eax
jmp 0x4db200
movzx r9d, byte [rsp + rsi + 0x19]
sub r9d, edx
lea edx, [r9 + 0x54]
mov byte [rsp + rdi + 0x19], dl
lea edx, [r8 + 0x54]
mov byte [rsp + rsi + 0x19], dl
add rax, 2
nop dword [rax]
cmp rax, 0x20
jge 0x4db22d
movzx edx, byte [rsp + rax + 0x30]
movzx esi, byte [rsp + rax + 0x31]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x17
jae 0x4db250
movzx r8d, byte [rsp + rdi + 0x19]
sub r8d, edx
cmp rsi, 0x17
jb 0x4db1df
jmp 0x4db244
xor eax, eax
lea rbx, [rsp + 0x19]
mov ecx, 0x17
call fcn.00441380
add rsp, 0x50
pop rbp
ret
mov eax, esi
mov ecx, 0x17
call fcn.00451880
mov eax, edi
mov ecx, 0x17
call fcn.00451880
nop
nop dword [rax]
call fcn.0044f600
jmp fcn.004db160

Function at 0x4dc720
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4dc81b
push rbp
mov rbp, rsp
sub rsp, 0x50
movabs rdx, 0x835b5a8e777e6154
mov qword [rsp + 0x1e], rdx
movabs rdx, 0x64707f91835b5a8e
mov qword [rsp + 0x22], rdx
movabs rdx, 0x5e5f5e2b8f409487
mov qword [rsp + 0x2a], rdx
movabs rdx, 0x4020e03090c080d
mov qword [rsp + 0x32], rdx
movabs rdx, 0x12090e11070d0610
mov qword [rsp + 0x3a], rdx
movabs rdx, 0x30606090f091209
mov qword [rsp + 0x40], rdx
movabs rdx, 0xf0705130709020a
mov qword [rsp + 0x48], rdx
xor eax, eax
jmp 0x4dc7b9
movzx r9d, byte [rsp + rsi + 0x1e]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x25]
mov byte [rsp + rdi + 0x1e], dl
mov byte [rsp + rsi + 0x1e], r8b
add rax, 2
cmp rax, 0x1e
jge 0x4dc7eb
movzx edx, byte [rsp + rax + 0x32]
movzx esi, byte [rsp + rax + 0x33]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x14
jae 0x4dc80e
movzx r8d, byte [rsp + rdi + 0x1e]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x25]
cmp rsi, 0x14
jb 0x4dc79f
jmp 0x4dc802
xor eax, eax
lea rbx, [rsp + 0x1e]
mov ecx, 0x14
call fcn.00441380
add rsp, 0x50
pop rbp
ret
mov eax, esi
mov ecx, 0x14
call fcn.00451880
mov eax, edi
mov ecx, 0x14
call fcn.00451880
nop
nop dword [rax + rax]
call fcn.0044f600
jmp fcn.004dc720
Function at 0x4de320
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4de41d
push rbp
mov rbp, rsp
sub rsp, 0x50
movabs rdx, 0x5965355065436343
mov qword [rsp + 0x1e], rdx
movabs rdx, 0x75840105e206564
mov qword [rsp + 0x26], rdx
movabs rdx, 0x660e5b5420472440
mov qword [rsp + 0x2e], rdx
movabs rdx, 0xb050b110c0f100e
mov qword [rsp + 0x36], rdx
movabs rdx, 0x4160f0d0e021204
mov qword [rsp + 0x3e], rdx
movabs rdx, 0xc0c04160f0d0e02
mov qword [rsp + 0x40], rdx
movabs rdx, 0x150117070c0c0e10
mov qword [rsp + 0x48], rdx
xor eax, eax
jmp 0x4de3c0
movzx r9d, byte [rsp + rsi + 0x1e]
sub r9d, edx
lea edx, [r9 + 0x32]
mov byte [rsp + rdi + 0x1e], dl
lea edx, [r8 + 0x32]
mov byte [rsp + rsi + 0x1e], dl
add rax, 2
nop dword [rax]
cmp rax, 0x1a
jge 0x4de3ed
movzx edx, byte [rsp + rax + 0x36]
movzx esi, byte [rsp + rax + 0x37]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x18
jae 0x4de410
movzx r8d, byte [rsp + rdi + 0x1e]
sub r8d, edx
cmp rsi, 0x18
jb 0x4de39f
jmp 0x4de404
xor eax, eax
lea rbx, [rsp + 0x1e]
mov ecx, 0x18
call fcn.00441380
add rsp, 0x50
pop rbp
ret
mov eax, esi
mov ecx, 0x18
call fcn.00451880
mov eax, edi
mov ecx, 0x18
call fcn.00451880
nop
nop dword [rax]
call fcn.0044f600
jmp fcn.004de320

Function at 0x4dfbe0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4dfcfd
push rbp
mov rbp, rsp
sub rsp, 0x58
movabs rdx, 0x74d76145034155eb
mov qword [rsp + 0x1b], rdx
movabs rdx, 0x30612af1df6e7246
mov qword [rsp + 0x23], rdx
movabs rdx, 0xca30612af1df6e72
mov qword [rsp + 0x24], rdx
movabs rdx, 0x3b6da7dad14407c8
mov qword [rsp + 0x2c], rdx
movabs rdx, 0xc03130d180f1802
mov qword [rsp + 0x34], rdx
movabs rdx, 0x161308110c03130d
mov qword [rsp + 0x38], rdx
movabs rdx, 0x100b111216061302
mov qword [rsp + 0x40], rdx
movabs rdx, 0x10030d08140c030b
mov qword [rsp + 0x48], rdx
movabs rdx, 0x311021518000d06
mov qword [rsp + 0x50], rdx
xor eax, eax
jmp 0x4dfca0
movzx r9d, byte [rsp + rsi + 0x1b]
sub r9d, edx
lea edx, [r9 - 0x50]
mov byte [rsp + rdi + 0x1b], dl
lea edx, [r8 - 0x50]
mov byte [rsp + rsi + 0x1b], dl
add rax, 2
nop word [rax + rax]
cmp rax, 0x24
jge 0x4dfccd
movzx edx, byte [rsp + rax + 0x34]
movzx esi, byte [rsp + rax + 0x35]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x19
jae 0x4dfcf0
movzx r8d, byte [rsp + rdi + 0x1b]
sub r8d, edx
cmp rsi, 0x19
jb 0x4dfc7d
jmp 0x4dfce4
xor eax, eax
lea rbx, [rsp + 0x1b]
mov ecx, 0x19
call fcn.00441380
add rsp, 0x58
pop rbp
ret
mov eax, esi
mov ecx, 0x19
call fcn.00451880
mov eax, edi
mov ecx, 0x19
call fcn.00451880
nop
nop dword [rax]
call fcn.0044f600
jmp fcn.004dfbe0