joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4bd8e0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4bd9e8
sub rsp, 0x58
mov qword [rsp + 0x50], rbp
lea rbp, [rsp + 0x50]
movabs rdx, 0xdd766e7a48d858f5
mov qword [rsp + 0x1d], rdx
movabs rdx, 0xe46efeeb50d4f1dd
mov qword [rsp + 0x24], rdx
movabs rdx, 0xb7e5466ed47248ea
mov qword [rsp + 0x2c], rdx
movabs rdx, 0xc08020f0401150b
mov qword [rsp + 0x34], rdx
movabs rdx, 0x10a14090e030a00
mov qword [rsp + 0x3c], rdx
movabs rdx, 0x4160000010a1409
mov qword [rsp + 0x40], rdx
movabs rdx, 0x120e090710070101
mov qword [rsp + 0x48], rdx
xor eax, eax
jmp 0x4bd980
movzx r9d, byte [rsp + rsi + 0x1d]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x6a]
mov byte [rsp + rdi + 0x1d], dl
mov byte [rsp + rsi + 0x1d], r8b
add rax, 2
nop
cmp rax, 0x1c
jge 0x4bd9b2
movzx edx, byte [rsp + rax + 0x34]
movzx esi, byte [rsp + rax + 0x35]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x17
jae 0x4bd9db
movzx r8d, byte [rsp + rdi + 0x1d]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x6a]
cmp rsi, 0x17
jb 0x4bd965
jmp 0x4bd9cf
xor eax, eax
lea rbx, [rsp + 0x1d]
mov ecx, 0x17
nop
call fcn.00441100
mov rbp, qword [rsp + 0x50]
add rsp, 0x58
ret
mov eax, esi
mov ecx, 0x17
call fcn.00452c00
mov eax, edi
mov ecx, 0x17
call fcn.00452c00
nop
call fcn.004505a0
jmp fcn.004bd8e0

Function at 0x4bdf80
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4be06b
sub rsp, 0x40
mov qword [rsp + 0x38], rbp
lea rbp, [rsp + 0x38]
movabs rdx, 0x6f91e08743e892ce
mov qword [rsp + 0x18], rdx
movabs rdx, 0x9f646f4dd48b6f91
mov qword [rsp + 0x1e], rdx
movabs rdx, 0x102060006080904
mov qword [rsp + 0x26], rdx
movabs rdx, 0x506010206000608
mov qword [rsp + 0x28], rdx
movabs rdx, 0x50d0d01060d0504
mov qword [rsp + 0x30], rdx
xor eax, eax
jmp 0x4be004
movzx r9d, byte [rsp + rsi + 0x18]
sub r9d, edx
lea edx, [r9 - 0x15]
mov byte [rsp + rdi + 0x18], dl
lea edx, [r8 - 0x15]
mov byte [rsp + rsi + 0x18], dl
add rax, 2
cmp rax, 0x12
jge 0x4be037
movzx edx, byte [rsp + rax + 0x26]
movzx esi, byte [rsp + rax + 0x27]
mov edi, edx
xor edx, esi
add edx, eax
nop word [rax + rax]
cmp rdi, 0xe
jae 0x4be05e
movzx r8d, byte [rsp + rdi + 0x18]
sub r8d, edx
cmp rsi, 0xe
jb 0x4bdfe7
jmp 0x4be052
xor eax, eax
lea rbx, [rsp + 0x18]
mov ecx, 0xe
call fcn.00441100
mov rbp, qword [rsp + 0x38]
add rsp, 0x40
ret
mov eax, esi
mov ecx, 0xe
call fcn.00452c00
mov eax, edi
mov ecx, 0xe
call fcn.00452c00
nop
call fcn.004505a0
jmp fcn.004bdf80
Function at 0x4be3a0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4be496
sub rsp, 0x48
mov qword [rsp + 0x40], rbp
lea rbp, [rsp + 0x40]
movabs rdx, 0x7172a07543747a7c
mov qword [rsp + 0x1b], rdx
movabs rdx, 0x5e7172a07543747a
mov qword [rsp + 0x1c], rdx
movabs rdx, 0x988271696f865070
mov qword [rsp + 0x24], rdx
movabs rdx, 0xb05000f100b080d
mov qword [rsp + 0x2c], rdx
movabs rdx, 0x10e0b010b05000f
mov qword [rsp + 0x30], rdx
movabs rdx, 0x70107090e0500
mov qword [rsp + 0x38], rdx
xor eax, eax
jmp 0x4be433
movzx r9d, byte [rsp + rsi + 0x1b]
sub r9d, edx
lea edx, [r9 + 0xa]
mov byte [rsp + rdi + 0x1b], dl
lea edx, [r8 + 0xa]
mov byte [rsp + rsi + 0x1b], dl
add rax, 2
cmp rax, 0x14
jge 0x4be462
movzx edx, byte [rsp + rax + 0x2c]
movzx esi, byte [rsp + rax + 0x2d]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x11
jae 0x4be489
movzx r8d, byte [rsp + rdi + 0x1b]
sub r8d, edx
cmp rsi, 0x11
jb 0x4be416
nop
jmp 0x4be47d
xor eax, eax
lea rbx, [rsp + 0x1b]
mov ecx, 0x11
call fcn.00441100
mov rbp, qword [rsp + 0x40]
add rsp, 0x48
ret
mov eax, esi
mov ecx, 0x11
call fcn.00452c00
mov eax, edi
mov ecx, 0x11
call fcn.00452c00
nop
call fcn.004505a0
nop dword [rax + rax]
jmp fcn.004be3a0

Function at 0x4be8e0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4be9e8
sub rsp, 0x58
mov qword [rsp + 0x50], rbp
lea rbp, [rsp + 0x50]
movabs rdx, 0xdd69e70245746501
mov qword [rsp + 0x1f], rdx
movabs rdx, 0xd1fcd02ff0daf7dd
mov qword [rsp + 0x26], rdx
movabs rdx, 0x656bf0ed71d6fa79
mov qword [rsp + 0x2e], rdx
movabs rdx, 0x14001416080f0010
mov qword [rsp + 0x36], rdx
movabs rdx, 0x150908141215040d
mov qword [rsp + 0x3e], rdx
movabs rdx, 0x1307150908141215
mov qword [rsp + 0x40], rdx
movabs rdx, 0x110e050a0b110c12
mov qword [rsp + 0x48], rdx
xor eax, eax
jmp 0x4be980
movzx r9d, byte [rsp + rsi + 0x1f]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x61]
mov byte [rsp + rdi + 0x1f], dl
mov byte [rsp + rsi + 0x1f], r8b
add rax, 2
nop
cmp rax, 0x1a
jge 0x4be9b2
movzx edx, byte [rsp + rax + 0x36]
movzx esi, byte [rsp + rax + 0x37]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x17
jae 0x4be9db
movzx r8d, byte [rsp + rdi + 0x1f]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x61]
cmp rsi, 0x17
jb 0x4be965
jmp 0x4be9cf
xor eax, eax
lea rbx, [rsp + 0x1f]
mov ecx, 0x17
nop
call fcn.00441100
mov rbp, qword [rsp + 0x50]
add rsp, 0x58
ret
mov eax, esi
mov ecx, 0x17
call fcn.00452c00
mov eax, edi
mov ecx, 0x17
call fcn.00452c00
nop
call fcn.004505a0
jmp fcn.004be8e0
Function at 0x4befc0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4bf0d6
sub rsp, 0x58
mov qword [rsp + 0x50], rbp
lea rbp, [rsp + 0x50]
movabs rdx, 0x42656c6da37a8290
mov qword [rsp + 0x1a], rdx
movabs rdx, 0x5d7469694e6f8075
mov qword [rsp + 0x22], rdx
movabs rdx, 0x6e575d7469694e6f
mov qword [rsp + 0x24], rdx
movabs rdx, 0x5e6c646e6148734a
mov qword [rsp + 0x2c], rdx
movabs rdx, 0x300130408190901
mov qword [rsp + 0x34], rdx
movabs rdx, 0x120702000912020c
mov qword [rsp + 0x3c], rdx
movabs rdx, 0x709030812070200
mov qword [rsp + 0x40], rdx
movabs rdx, 0x13040b130f10060d
mov qword [rsp + 0x48], rdx
xor eax, eax
jmp 0x4bf06e
movzx r9d, byte [rsp + rsi + 0x1a]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x23]
mov byte [rsp + rdi + 0x1a], dl
mov byte [rsp + rsi + 0x1a], r8b
add rax, 2
cmp rax, 0x1c
jge 0x4bf0a2
movzx edx, byte [rsp + rax + 0x34]
movzx esi, byte [rsp + rax + 0x35]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x1a
jae 0x4bf0c9
movzx r8d, byte [rsp + rdi + 0x1a]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x23]
cmp rsi, 0x1a
jb 0x4bf054
nop
jmp 0x4bf0bd
xor eax, eax
lea rbx, [rsp + 0x1a]
mov ecx, 0x1a
call fcn.00441100
mov rbp, qword [rsp + 0x50]
add rsp, 0x58
ret
mov eax, esi
mov ecx, 0x1a
call fcn.00452c00
mov eax, edi
mov ecx, 0x1a
call fcn.00452c00
nop
call fcn.004505a0
nop dword [rax + rax]
jmp fcn.004befc0

Function at 0x4c1260
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4c1332
sub rsp, 0x38
mov qword [rsp + 0x30], rbp
lea rbp, [rsp + 0x30]
movabs rdx, 0xacaa6d6dc71dff47
mov qword [rsp + 0x24], rdx
mov dword [rsp + 0x2c], 0xf7687461
movabs rdx, 0x40b06020b070604
mov qword [rsp + 0x18], rdx
mov dword [rsp + 0x20], 0x2010103
xor eax, eax
jmp 0x4c12c4
movzx r9d, byte [rsp + rsi + 0x24]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x4b]
mov byte [rsp + rdi + 0x24], dl
mov byte [rsp + rsi + 0x24], r8b
add rax, 2
cmp rax, 0xc
jge 0x4c12fc
movzx edx, byte [rsp + rax + 0x18]
movzx esi, byte [rsp + rax + 0x19]
mov edi, edx
xor edx, esi
add edx, eax
nop word [rax + rax]
cmp rdi, 0xc
jae 0x4c1325
movzx r8d, byte [rsp + rdi + 0x24]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x4b]
cmp rsi, 0xc
jb 0x4c12aa
jmp 0x4c1317
xor eax, eax
lea rbx, [rsp + 0x24]
mov ecx, 0xc
call fcn.00441100
mov rbp, qword [rsp + 0x30]
add rsp, 0x38
ret
mov eax, esi
mov ecx, 0xc
nop
call fcn.00452c00
mov eax, edi
mov ecx, 0xc
call fcn.00452c00
nop
call fcn.004505a0
jmp fcn.004c1260
Function at 0x4c1ea0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4c1f8b
sub rsp, 0x48
mov qword [rsp + 0x40], rbp
lea rbp, [rsp + 0x40]
movabs rdx, 0x3373c707206f7233
mov qword [rsp + 0x1d], rdx
movabs rdx, 0x2a74fdef4416fc33
mov qword [rsp + 0x24], rdx
movabs rdx, 0x305090408050b
mov qword [rsp + 0x2c], rdx
movabs rdx, 0xa0b0c0c00030509
mov qword [rsp + 0x30], rdx
movabs rdx, 0x405090a0e0c0e04
mov qword [rsp + 0x38], rdx
xor eax, eax
jmp 0x4c1f24
movzx r9d, byte [rsp + rsi + 0x1d]
sub r9d, edx
lea edx, [r9 + 0x39]
mov byte [rsp + rdi + 0x1d], dl
lea edx, [r8 + 0x39]
mov byte [rsp + rsi + 0x1d], dl
add rax, 2
cmp rax, 0x14
jge 0x4c1f57
movzx edx, byte [rsp + rax + 0x2c]
movzx esi, byte [rsp + rax + 0x2d]
mov edi, edx
xor edx, esi
add edx, eax
nop word [rax + rax]
cmp rdi, 0xf
jae 0x4c1f7e
movzx r8d, byte [rsp + rdi + 0x1d]
sub r8d, edx
cmp rsi, 0xf
jb 0x4c1f07
jmp 0x4c1f72
xor eax, eax
lea rbx, [rsp + 0x1d]
mov ecx, 0xf
call fcn.00441100
mov rbp, qword [rsp + 0x40]
add rsp, 0x48
ret
mov eax, esi
mov ecx, 0xf
call fcn.00452c00
mov eax, edi
mov ecx, 0xf
call fcn.00452c00
nop
call fcn.004505a0
jmp fcn.004c1ea0

Function at 0x4c4500
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4c45f6
sub rsp, 0x50
mov qword [rsp + 0x48], rbp
lea rbp, [rsp + 0x48]
movabs rdx, 0x43555126312b4a56
mov qword [rsp + 0x1e], rdx
movabs rdx, 0x5378457443555126
mov qword [rsp + 0x22], rdx
movabs rdx, 0x4f647a5e4681476f
mov qword [rsp + 0x2a], rdx
movabs rdx, 0x401120203040207
mov qword [rsp + 0x32], rdx
movabs rdx, 0x13100d0006070401
mov qword [rsp + 0x38], rdx
movabs rdx, 0xf110e0500110e
mov qword [rsp + 0x40], rdx
xor eax, eax
jmp 0x4c4593
movzx r9d, byte [rsp + rsi + 0x1e]
sub r9d, edx
lea edx, [r9 + 0x24]
mov byte [rsp + rdi + 0x1e], dl
lea edx, [r8 + 0x24]
mov byte [rsp + rsi + 0x1e], dl
add rax, 2
cmp rax, 0x16
jge 0x4c45c2
movzx edx, byte [rsp + rax + 0x32]
movzx esi, byte [rsp + rax + 0x33]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x14
jae 0x4c45e9
movzx r8d, byte [rsp + rdi + 0x1e]
sub r8d, edx
cmp rsi, 0x14
jb 0x4c4576
nop
jmp 0x4c45dd
xor eax, eax
lea rbx, [rsp + 0x1e]
mov ecx, 0x14
call fcn.00441100
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
mov eax, esi
mov ecx, 0x14
call fcn.00452c00
mov eax, edi
mov ecx, 0x14
call fcn.00452c00
nop
call fcn.004505a0
nop dword [rax + rax]
jmp fcn.004c4500
Function at 0x4c7280
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4c734b
sub rsp, 0x38
mov qword [rsp + 0x30], rbp
lea rbp, [rsp + 0x30]
movabs rdx, 0xf70cb4b673020a73
mov qword [rsp + 0x26], rdx
mov word [rsp + 0x2e], 0x7470
movabs rdx, 0x105050206050407
mov qword [rsp + 0x1c], rdx
mov word [rsp + 0x24], 0x405
xor eax, eax
jmp 0x4c72e5
movzx r9d, byte [rsp + rsi + 0x26]
sub r9d, edx
lea edx, [r9 - 0x44]
mov byte [rsp + rdi + 0x26], dl
lea edx, [r8 - 0x44]
mov byte [rsp + rsi + 0x26], dl
add rax, 2
cmp rax, 0xa
jge 0x4c7317
movzx edx, byte [rsp + rax + 0x1c]
movzx esi, byte [rsp + rax + 0x1d]
mov edi, edx
xor edx, esi
add edx, eax
nop dword [rax + rax]
cmp rdi, 0xa
jae 0x4c733e
movzx r8d, byte [rsp + rdi + 0x26]
sub r8d, edx
cmp rsi, 0xa
jb 0x4c72c8
jmp 0x4c7332
xor eax, eax
lea rbx, [rsp + 0x26]
mov ecx, 0xa
call fcn.00441100
mov rbp, qword [rsp + 0x30]
add rsp, 0x38
ret
mov eax, esi
mov ecx, 0xa
call fcn.00452c00
mov eax, edi
mov ecx, 0xa
call fcn.00452c00
nop
call fcn.004505a0
jmp fcn.004c7280

Function at 0x4d4d40
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4d4e28
sub rsp, 0x40
mov qword [rsp + 0x38], rbp
lea rbp, [rsp + 0x38]
movabs rdx, 0xa36974e9cdc29789
mov qword [rsp + 0x18], rdx
movabs rdx, 0x8478c3a07587a369
mov qword [rsp + 0x1e], rdx
movabs rdx, 0xa0a070b0d000407
mov qword [rsp + 0x26], rdx
movabs rdx, 0x2030a0a070b0d00
mov qword [rsp + 0x28], rdx
movabs rdx, 0xb06020107080303
mov qword [rsp + 0x30], rdx
xor eax, eax
jmp 0x4d4dc1
movzx r9d, byte [rsp + rsi + 0x18]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x41]
mov byte [rsp + rdi + 0x18], dl
mov byte [rsp + rsi + 0x18], r8b
add rax, 2
cmp rax, 0x12
jge 0x4d4df3
movzx edx, byte [rsp + rax + 0x26]
movzx esi, byte [rsp + rax + 0x27]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0xe
jae 0x4d4e1b
movzx r8d, byte [rsp + rdi + 0x18]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x41]
cmp rsi, 0xe
jb 0x4d4da7
jmp 0x4d4e0f
xor eax, eax
lea rbx, [rsp + 0x18]
mov ecx, 0xe
nop
call fcn.00441100
mov rbp, qword [rsp + 0x38]
add rsp, 0x40
ret
mov eax, esi
mov ecx, 0xe
call fcn.00452c00
mov eax, edi
mov ecx, 0xe
call fcn.00452c00
nop
call fcn.004505a0
jmp fcn.004d4d40
Function at 0x4d92e0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4d93d6
sub rsp, 0x50
mov qword [rsp + 0x48], rbp
lea rbp, [rsp + 0x48]
movabs rdx, 0x8a55c37f778461df
mov qword [rsp + 0x1f], rdx
movabs rdx, 0x729c618a55c37f77
mov qword [rsp + 0x22], rdx
movabs rdx, 0x896de354a2643e61
mov qword [rsp + 0x2a], rdx
movabs rdx, 0x600090210051000
mov qword [rsp + 0x32], rdx
movabs rdx, 0xa06120203040600
mov qword [rsp + 0x38], rdx
movabs rdx, 0x100e070a0c100c05
mov qword [rsp + 0x40], rdx
xor eax, eax
jmp 0x4d9373
movzx r9d, byte [rsp + rsi + 0x1f]
sub r9d, edx
lea edx, [r9 - 7]
mov byte [rsp + rdi + 0x1f], dl
lea edx, [r8 - 7]
mov byte [rsp + rsi + 0x1f], dl
add rax, 2
cmp rax, 0x16
jge 0x4d93a2
movzx edx, byte [rsp + rax + 0x32]
movzx esi, byte [rsp + rax + 0x33]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x13
jae 0x4d93c9
movzx r8d, byte [rsp + rdi + 0x1f]
sub r8d, edx
cmp rsi, 0x13
jb 0x4d9356
nop
jmp 0x4d93bd
xor eax, eax
lea rbx, [rsp + 0x1f]
mov ecx, 0x13
call fcn.00441100
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
mov eax, esi
mov ecx, 0x13
call fcn.00452c00
mov eax, edi
mov ecx, 0x13
call fcn.00452c00
nop
call fcn.004505a0
nop dword [rax + rax]
jmp fcn.004d92e0

Function at 0x4d9400
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4d9508
sub rsp, 0x58
mov qword [rsp + 0x50], rbp
lea rbp, [rsp + 0x50]
movabs rdx, 0x9f5e96a250204153
mov qword [rsp + 0x1c], rdx
movabs rdx, 0xa1c042a12a2003a4
mov qword [rsp + 0x24], rdx
movabs rdx, 0xa9b2699fba6401ed
mov qword [rsp + 0x2c], rdx
movabs rdx, 0xb0606130c13140d
mov qword [rsp + 0x34], rdx
movabs rdx, 0x70f170917061004
mov qword [rsp + 0x3c], rdx
movabs rdx, 0x408050b070f1709
mov qword [rsp + 0x40], rdx
movabs rdx, 0x5171405160e1611
mov qword [rsp + 0x48], rdx
xor eax, eax
jmp 0x4d94a2
movzx r9d, byte [rsp + rsi + 0x1c]
sub r9d, edx
lea edx, [r9 - 0x25]
mov byte [rsp + rdi + 0x1c], dl
lea edx, [r8 - 0x25]
mov byte [rsp + rsi + 0x1c], dl
add rax, 2
cmp rax, 0x1c
jge 0x4d94cf
movzx edx, byte [rsp + rax + 0x34]
movzx esi, byte [rsp + rax + 0x35]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x18
jae 0x4d94fb
movzx r8d, byte [rsp + rdi + 0x1c]
sub r8d, edx
cmp rsi, 0x18
jb 0x4d9485
jmp 0x4d94ef
xor eax, eax
lea rbx, [rsp + 0x1c]
mov ecx, 0x18
nop dword [rax + rax]
call fcn.00441100
mov rbp, qword [rsp + 0x50]
add rsp, 0x58
ret
mov eax, esi
mov ecx, 0x18
call fcn.00452c00
mov eax, edi
mov ecx, 0x18
call fcn.00452c00
nop
call fcn.004505a0
jmp fcn.004d9400
Function at 0x4dbb80
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4dbca6
sub rsp, 0x68
mov qword [rsp + 0x60], rbp
lea rbp, [rsp + 0x60]
movabs rdx, 0x203a464ae3c665dd
mov qword [rsp + 0x1c], rdx
movabs rdx, 0xd08adc6468617453
mov qword [rsp + 0x24], rdx
movabs rdx, 0x20d01301d8ced08a
mov qword [rsp + 0x2a], rdx
movabs rdx, 0x646fbbeea62a58e4
mov qword [rsp + 0x32], rdx
movabs rdx, 0x20f1b180d131318
mov qword [rsp + 0x3a], rdx
movabs rdx, 0x17041614140b020f
mov qword [rsp + 0x40], rdx
movabs rdx, 0x161d031a11060b0e
mov qword [rsp + 0x48], rdx
movabs rdx, 0x60517060b1014
mov qword [rsp + 0x50], rdx
movabs rdx, 0x120e11171619040b
mov qword [rsp + 0x58], rdx
xor eax, eax
jmp 0x4dbc40
movzx r9d, byte [rsp + rsi + 0x1c]
sub r9d, edx
lea edx, [r9 - 0x4f]
mov byte [rsp + rdi + 0x1c], dl
lea edx, [r8 - 0x4f]
mov byte [rsp + rsi + 0x1c], dl
add rax, 2
cmp rax, 0x26
jge 0x4dbc6d
movzx edx, byte [rsp + rax + 0x3a]
movzx esi, byte [rsp + rax + 0x3b]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x1e
jae 0x4dbc94
movzx r8d, byte [rsp + rdi + 0x1c]
sub r8d, edx
cmp rsi, 0x1e
jb 0x4dbc23
jmp 0x4dbc88
xor eax, eax
lea rbx, [rsp + 0x1c]
mov ecx, 0x1e
call fcn.00441100
mov rbp, qword [rsp + 0x60]
add rsp, 0x68
ret
mov eax, esi
mov ecx, 0x1e
call fcn.00452c00
mov eax, edi
mov ecx, 0x1e
nop dword [rax + rax]
call fcn.00452c00
nop
call fcn.004505a0
jmp fcn.004dbb80
Function at 0x4dc120
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4dc228
sub rsp, 0x58
mov qword [rsp + 0x50], rbp
lea rbp, [rsp + 0x50]
movabs rdx, 0x3eccf91bcad3d5c8
mov qword [rsp + 0x1a], rdx
movabs rdx, 0x296e61ff53d56f65
mov qword [rsp + 0x22], rdx
movabs rdx, 0x1cc6d75addd12d3f
mov qword [rsp + 0x2a], rdx
movabs rdx, 0x51312020c051214
mov qword [rsp + 0x32], rdx
movabs rdx, 0x1010010703170000
mov qword [rsp + 0x3a], rdx
movabs rdx, 0x160f061104161010
mov qword [rsp + 0x40], rdx
movabs rdx, 0xc0a100301061615
mov qword [rsp + 0x48], rdx
xor eax, eax
jmp 0x4dc1c0
movzx r9d, byte [rsp + rsi + 0x1a]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x7d]
mov byte [rsp + rdi + 0x1a], dl
mov byte [rsp + rsi + 0x1a], r8b
add rax, 2
nop
cmp rax, 0x1e
jge 0x4dc1f2
movzx edx, byte [rsp + rax + 0x32]
movzx esi, byte [rsp + rax + 0x33]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x18
jae 0x4dc21b
movzx r8d, byte [rsp + rdi + 0x1a]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x7d]
cmp rsi, 0x18
jb 0x4dc1a5
jmp 0x4dc20f
xor eax, eax
lea rbx, [rsp + 0x1a]
mov ecx, 0x18
nop
call fcn.00441100
mov rbp, qword [rsp + 0x50]
add rsp, 0x58
ret
mov eax, esi
mov ecx, 0x18
call fcn.00452c00
mov eax, edi
mov ecx, 0x18
call fcn.00452c00
nop
call fcn.004505a0
jmp fcn.004dc120
Function at 0x4dd7c0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4dd8e6
sub rsp, 0x68
mov qword [rsp + 0x60], rbp
lea rbp, [rsp + 0x60]
movabs rdx, 0x3ee475375f201460
mov qword [rsp + 0x1e], rdx
movabs rdx, 0x375069286ce81620
mov qword [rsp + 0x26], rdx
movabs rdx, 0x6458e7740d203750
mov qword [rsp + 0x2c], rdx
movabs rdx, 0x296d3a5420415f31
mov qword [rsp + 0x34], rdx
movabs rdx, 0x130f110c1d1d130a
mov qword [rsp + 0x3c], rdx
movabs rdx, 0x4070102130f110c
mov qword [rsp + 0x40], rdx
movabs rdx, 0xe061602011b140c
mov qword [rsp + 0x48], rdx
movabs rdx, 0x20e0314010a0f13
mov qword [rsp + 0x50], rdx
movabs rdx, 0x1811130109170b
mov qword [rsp + 0x58], rdx
xor eax, eax
jmp 0x4dd880
movzx r9d, byte [rsp + rsi + 0x1e]
sub r9d, edx
lea edx, [r9 + 0x3e]
mov byte [rsp + rdi + 0x1e], dl
lea edx, [r8 + 0x3e]
mov byte [rsp + rsi + 0x1e], dl
add rax, 2
cmp rax, 0x24
jge 0x4dd8ad
movzx edx, byte [rsp + rax + 0x3c]
movzx esi, byte [rsp + rax + 0x3d]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x1e
jae 0x4dd8d4
movzx r8d, byte [rsp + rdi + 0x1e]
sub r8d, edx
cmp rsi, 0x1e
jb 0x4dd863
jmp 0x4dd8c8
xor eax, eax
lea rbx, [rsp + 0x1e]
mov ecx, 0x1e
call fcn.00441100
mov rbp, qword [rsp + 0x60]
add rsp, 0x68
ret
mov eax, esi
mov ecx, 0x1e
call fcn.00452c00
mov eax, edi
mov ecx, 0x1e
nop dword [rax + rax]
call fcn.00452c00
nop
call fcn.004505a0
jmp fcn.004dd7c0

Function at 0x4dd900
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4dda28
sub rsp, 0x60
mov qword [rsp + 0x58], rbp
lea rbp, [rsp + 0x58]
movabs rdx, 0xd64a693b1f634cf7
mov qword [rsp + 0x18], rdx
movabs rdx, 0x6472f49a3f612ceb
mov qword [rsp + 0x20], rdx
movabs rdx, 0x1f896d14e8c96472
mov qword [rsp + 0x26], rdx
movabs rdx, 0x256f633a78dfc128
mov qword [rsp + 0x2e], rdx
movabs rdx, 0x603010b10070c1a
mov qword [rsp + 0x36], rdx
movabs rdx, 0x15000603010b1007
mov qword [rsp + 0x38], rdx
movabs rdx, 0x101a0d071014171d
mov qword [rsp + 0x40], rdx
movabs rdx, 0x80d101d09180406
mov qword [rsp + 0x48], rdx
movabs rdx, 0x11151a1514090d12
mov qword [rsp + 0x50], rdx
xor eax, eax
jmp 0x4dd9c0
movzx r9d, byte [rsp + rsi + 0x18]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x14]
mov byte [rsp + rdi + 0x18], dl
mov byte [rsp + rsi + 0x18], r8b
add rax, 2
nop dword [rax]
cmp rax, 0x22
jge 0x4dd9f2
movzx edx, byte [rsp + rax + 0x36]
movzx esi, byte [rsp + rax + 0x37]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x1e
jae 0x4dda1b
movzx r8d, byte [rsp + rdi + 0x18]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x14]
cmp rsi, 0x1e
jb 0x4dd9a3
jmp 0x4dda0f
xor eax, eax
lea rbx, [rsp + 0x18]
mov ecx, 0x1e
nop
call fcn.00441100
mov rbp, qword [rsp + 0x58]
add rsp, 0x60
ret
mov eax, esi
mov ecx, 0x1e
call fcn.00452c00
mov eax, edi
mov ecx, 0x1e
call fcn.00452c00
nop
call fcn.004505a0
jmp fcn.004dd900
Function at 0x4dea80
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4deb88
sub rsp, 0x50
mov qword [rsp + 0x48], rbp
lea rbp, [rsp + 0x48]
movabs rdx, 0xbabf62db61b17141
mov qword [rsp + 0x1b], rdx
movabs rdx, 0x19841cbabf62db61
mov qword [rsp + 0x1e], rdx
movabs rdx, 0x1ea073711a97261
mov qword [rsp + 0x26], rdx
movabs rdx, 0x504091207090612
mov qword [rsp + 0x2e], rdx
movabs rdx, 0xf11010202070a08
mov qword [rsp + 0x36], rdx
movabs rdx, 0x4100f1101020207
mov qword [rsp + 0x38], rdx
movabs rdx, 0xe0207100e110d0e
mov qword [rsp + 0x40], rdx
xor eax, eax
jmp 0x4deb20
movzx r9d, byte [rsp + rsi + 0x1b]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x3e]
mov byte [rsp + rdi + 0x1b], dl
mov byte [rsp + rsi + 0x1b], r8b
add rax, 2
nop
cmp rax, 0x1a
jge 0x4deb52
movzx edx, byte [rsp + rax + 0x2e]
movzx esi, byte [rsp + rax + 0x2f]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x13
jae 0x4deb7b
movzx r8d, byte [rsp + rdi + 0x1b]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x3e]
cmp rsi, 0x13
jb 0x4deb05
jmp 0x4deb6f
xor eax, eax
lea rbx, [rsp + 0x1b]
mov ecx, 0x13
nop
call fcn.00441100
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
mov eax, esi
mov ecx, 0x13
call fcn.00452c00
mov eax, edi
mov ecx, 0x13
call fcn.00452c00
nop
call fcn.004505a0
jmp fcn.004dea80

Function at 0x4dfbe0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4dfcdc
sub rsp, 0x50
mov qword [rsp + 0x48], rbp
lea rbp, [rsp + 0x48]
movabs rdx, 0xde94d665ce7289c5
mov qword [rsp + 0x1e], rdx
movabs rdx, 0x3c6e61bdde94d665
mov qword [rsp + 0x22], rdx
movabs rdx, 0xf3de5b3240bb7261
mov qword [rsp + 0x2a], rdx
movabs rdx, 0x10505110b13100e
mov qword [rsp + 0x32], rdx
movabs rdx, 0x80713050f060105
mov qword [rsp + 0x38], rdx
movabs rdx, 0x12121300060b030e
mov qword [rsp + 0x40], rdx
xor eax, eax
jmp 0x4dfc70
movzx r9d, byte [rsp + rsi + 0x1e]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x7b]
mov byte [rsp + rdi + 0x1e], dl
mov byte [rsp + rsi + 0x1e], r8b
add rax, 2
cmp rax, 0x16
jge 0x4dfca8
movzx edx, byte [rsp + rax + 0x32]
movzx esi, byte [rsp + rax + 0x33]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x14
jae 0x4dfccf
movzx r8d, byte [rsp + rdi + 0x1e]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x7b]
nop word [rax + rax]
cmp rsi, 0x14
jb 0x4dfc56
jmp 0x4dfcc3
xor eax, eax
lea rbx, [rsp + 0x1e]
mov ecx, 0x14
call fcn.00441100
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
mov eax, esi
mov ecx, 0x14
call fcn.00452c00
mov eax, edi
mov ecx, 0x14
call fcn.00452c00
nop
nop dword [rax]
call fcn.004505a0
jmp fcn.004dfbe0
Function at 0x4e08c0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4e09b6
sub rsp, 0x50
mov qword [rsp + 0x48], rbp
lea rbp, [rsp + 0x48]
movabs rdx, 0x736e8b848671859d
mov qword [rsp + 0x1d], rdx
movabs rdx, 0x745b7f7340736e8b
mov qword [rsp + 0x22], rdx
movabs rdx, 0x657a8f972064cb61
mov qword [rsp + 0x2a], rdx
movabs rdx, 0x4120b000e12020c
mov qword [rsp + 0x32], rdx
movabs rdx, 0x905031309110412
mov qword [rsp + 0x38], rdx
movabs rdx, 0xa0107080401010b
mov qword [rsp + 0x40], rdx
xor eax, eax
jmp 0x4e0953
movzx r9d, byte [rsp + rsi + 0x1d]
sub r9d, edx
lea edx, [r9 + 1]
mov byte [rsp + rdi + 0x1d], dl
lea edx, [r8 + 1]
mov byte [rsp + rsi + 0x1d], dl
add rax, 2
cmp rax, 0x16
jge 0x4e0982
movzx edx, byte [rsp + rax + 0x32]
movzx esi, byte [rsp + rax + 0x33]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x15
jae 0x4e09a9
movzx r8d, byte [rsp + rdi + 0x1d]
sub r8d, edx
cmp rsi, 0x15
jb 0x4e0936
nop
jmp 0x4e099d
xor eax, eax
lea rbx, [rsp + 0x1d]
mov ecx, 0x15
call fcn.00441100
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
mov eax, esi
mov ecx, 0x15
call fcn.00452c00
mov eax, edi
mov ecx, 0x15
call fcn.00452c00
nop
call fcn.004505a0
nop dword [rax + rax]
jmp fcn.004e08c0