joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4a0600
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4a06fd
push rbp
mov rbp, rsp
sub rsp, 0x48
movabs rdx, 0x947293ed79a6791e
mov qword [rsp + 0x19], rdx
movabs rdx, 0xa46e619191947293
mov qword [rsp + 0x1e], rdx
movabs rdx, 0xd0f3699774cfa464
mov qword [rsp + 0x26], rdx
movabs rdx, 0x80d03000f090c07
mov qword [rsp + 0x2e], rdx
movabs rdx, 0x508110e11131114
mov qword [rsp + 0x36], rdx
movabs rdx, 0x5090508110e1113
mov qword [rsp + 0x38], rdx
movabs rdx, 0x1007090204090302
mov qword [rsp + 0x40], rdx
xor eax, eax
jmp 0x4a06a0
movzx r9d, byte [rsp + rsi + 0x19]
sub r9d, edx
lea edx, [r9 - 0x25]
mov byte [rsp + rdi + 0x19], dl
lea edx, [r8 - 0x25]
mov byte [rsp + rsi + 0x19], dl
add rax, 2
nop dword [rax]
cmp rax, 0x1a
jge 0x4a06cd
movzx edx, byte [rsp + rax + 0x2e]
movzx esi, byte [rsp + rax + 0x2f]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x15
jae 0x4a06f0
movzx r8d, byte [rsp + rdi + 0x19]
sub r8d, edx
cmp rsi, 0x15
jb 0x4a067f
jmp 0x4a06e4
xor eax, eax
lea rbx, [rsp + 0x19]
mov ecx, 0x15
call fcn.00443420
add rsp, 0x48
pop rbp
ret
mov eax, esi
mov ecx, 0x15
call fcn.00454ec0
mov eax, edi
mov ecx, 0x15
call fcn.00454ec0
nop
nop dword [rax]
call fcn.00452c40
jmp fcn.004a0600

Function at 0x4a2820
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4a290a
push rbp
mov rbp, rsp
sub rsp, 0x48
movabs rdx, 0x206b73579c6bb1ca
mov qword [rsp + 0x1b], rdx
movabs rdx, 0x646eb12af8206b73
mov qword [rsp + 0x20], rdx
movabs rdx, 0xa3f384d0061272ff
mov qword [rsp + 0x28], rdx
movabs rdx, 0xa080f0414040403
mov qword [rsp + 0x30], rdx
movabs rdx, 0x111310080d001208
mov qword [rsp + 0x38], rdx
movabs rdx, 0x10d09130d030101
mov qword [rsp + 0x40], rdx
xor eax, eax
jmp 0x4a28ad
movzx r9d, byte [rsp + rsi + 0x1b]
sub r9d, edx
lea edx, [r9 + 0x71]
mov byte [rsp + rdi + 0x1b], dl
lea edx, [r8 + 0x71]
mov byte [rsp + rsi + 0x1b], dl
add rax, 2
cmp rax, 0x18
jge 0x4a28da
movzx edx, byte [rsp + rax + 0x30]
movzx esi, byte [rsp + rax + 0x31]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x15
jae 0x4a28fd
movzx r8d, byte [rsp + rdi + 0x1b]
sub r8d, edx
cmp rsi, 0x15
jb 0x4a2890
jmp 0x4a28f1
xor eax, eax
lea rbx, [rsp + 0x1b]
mov ecx, 0x15
call fcn.00443420
add rsp, 0x48
pop rbp
ret
mov eax, esi
mov ecx, 0x15
call fcn.00454ec0
mov eax, edi
mov ecx, 0x15
call fcn.00454ec0
nop
call fcn.00452c40
jmp fcn.004a2820
Function at 0x4a32c0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4a33dd
push rbp
mov rbp, rsp
sub rsp, 0x60
movabs rdx, 0x16f0419cb301580e
mov qword [rsp + 0x1c], rdx
movabs rdx, 0x5af6176e561062e
mov qword [rsp + 0x24], rdx
movabs rdx, 0x64ba84d505af6176
mov qword [rsp + 0x28], rdx
movabs rdx, 0x5329fd71ee03a561
mov qword [rsp + 0x30], rdx
movabs rdx, 0x303021b1b01190c
mov qword [rsp + 0x38], rdx
movabs rdx, 0x110918170f040f06
mov qword [rsp + 0x40], rdx
movabs rdx, 0x10f091516120e0e
mov qword [rsp + 0x48], rdx
movabs rdx, 0xf09021004170b00
mov qword [rsp + 0x50], rdx
movabs rdx, 0x1904021a16070815
mov qword [rsp + 0x58], rdx
xor eax, eax
jmp 0x4a3380
movzx r9d, byte [rsp + rsi + 0x1c]
sub r9d, edx
lea edx, [r9 - 0x7f]
mov byte [rsp + rdi + 0x1c], dl
lea edx, [r8 - 0x7f]
mov byte [rsp + rsi + 0x1c], dl
add rax, 2
nop word [rax + rax]
cmp rax, 0x28
jge 0x4a33ad
movzx edx, byte [rsp + rax + 0x38]
movzx esi, byte [rsp + rax + 0x39]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x1c
jae 0x4a33d0
movzx r8d, byte [rsp + rdi + 0x1c]
sub r8d, edx
cmp rsi, 0x1c
jb 0x4a335d
jmp 0x4a33c4
xor eax, eax
lea rbx, [rsp + 0x1c]
mov ecx, 0x1c
call fcn.00443420
add rsp, 0x60
pop rbp
ret
mov eax, esi
mov ecx, 0x1c
call fcn.00454ec0
mov eax, edi
mov ecx, 0x1c
call fcn.00454ec0
nop
nop dword [rax]
call fcn.00452c40
jmp fcn.004a32c0

Function at 0x4a3520
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4a3628
push rbp
mov rbp, rsp
sub rsp, 0x50
movabs rdx, 0x2ee48989bcdc5503
mov qword [rsp + 0x19], rdx
movabs rdx, 0x1a0f745320ec1c37
mov qword [rsp + 0x21], rdx
movabs rdx, 0x2a1a0f745320ec1c
mov qword [rsp + 0x22], rdx
movabs rdx, 0x656d69f307ad7261
mov qword [rsp + 0x2a], rdx
movabs rdx, 0x1303020810060504
mov qword [rsp + 0x32], rdx
movabs rdx, 0x130e0210090915
mov qword [rsp + 0x3a], rdx
movabs rdx, 0xf0e130714040013
mov qword [rsp + 0x40], rdx
movabs rdx, 0xf05030a080a03
mov qword [rsp + 0x48], rdx
xor eax, eax
jmp 0x4a35cb
movzx r9d, byte [rsp + rsi + 0x19]
sub r9d, edx
lea edx, [r9 + 0x5c]
mov byte [rsp + rdi + 0x19], dl
lea edx, [r8 + 0x5c]
mov byte [rsp + rsi + 0x19], dl
add rax, 2
cmp rax, 0x1e
jge 0x4a35f8
movzx edx, byte [rsp + rax + 0x32]
movzx esi, byte [rsp + rax + 0x33]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x19
jae 0x4a361b
movzx r8d, byte [rsp + rdi + 0x19]
sub r8d, edx
cmp rsi, 0x19
jb 0x4a35ae
jmp 0x4a360f
xor eax, eax
lea rbx, [rsp + 0x19]
mov ecx, 0x19
call fcn.00443420
add rsp, 0x50
pop rbp
ret
mov eax, esi
mov ecx, 0x19
call fcn.00454ec0
mov eax, edi
mov ecx, 0x19
call fcn.00454ec0
nop
call fcn.00452c40
jmp fcn.004a3520
Function at 0x4a49e0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4a4add
push rbp
mov rbp, rsp
sub rsp, 0x50
movabs rdx, 0x453379656b3cdf54
mov qword [rsp + 0x1e], rdx
movabs rdx, 0xf5c55e5645337965
mov qword [rsp + 0x22], rdx
movabs rdx, 0x533c25c00b547261
mov qword [rsp + 0x2a], rdx
movabs rdx, 0xa0a100f0b0f0b01
mov qword [rsp + 0x32], rdx
movabs rdx, 0x9120f02130e1211
mov qword [rsp + 0x3a], rdx
movabs rdx, 0x20f080601080912
mov qword [rsp + 0x40], rdx
movabs rdx, 0xb08060f060a070b
mov qword [rsp + 0x48], rdx
xor eax, eax
jmp 0x4a4a80
movzx r9d, byte [rsp + rsi + 0x1e]
sub r9d, edx
lea edx, [r9 + 0x38]
mov byte [rsp + rdi + 0x1e], dl
lea edx, [r8 + 0x38]
mov byte [rsp + rsi + 0x1e], dl
add rax, 2
nop dword [rax]
cmp rax, 0x1e
jge 0x4a4aad
movzx edx, byte [rsp + rax + 0x32]
movzx esi, byte [rsp + rax + 0x33]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x14
jae 0x4a4ad0
movzx r8d, byte [rsp + rdi + 0x1e]
sub r8d, edx
cmp rsi, 0x14
jb 0x4a4a5f
jmp 0x4a4ac4
xor eax, eax
lea rbx, [rsp + 0x1e]
mov ecx, 0x14
call fcn.00443420
add rsp, 0x50
pop rbp
ret
mov eax, esi
mov ecx, 0x14
call fcn.00454ec0
mov eax, edi
mov ecx, 0x14
call fcn.00454ec0
nop
nop dword [rax]
call fcn.00452c40
jmp fcn.004a49e0

Function at 0x4a67a0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4a688a
push rbp
mov rbp, rsp
sub rsp, 0x48
movabs rdx, 0xdc1cba29b46d6153
mov qword [rsp + 0x1f], rdx
movabs rdx, 0x1e860ddc1cba29b4
mov qword [rsp + 0x22], rdx
movabs rdx, 0x22dd811d20031e16
mov qword [rsp + 0x2a], rdx
movabs rdx, 0x605070f0b030610
mov qword [rsp + 0x32], rdx
movabs rdx, 0xb080411060d0605
mov qword [rsp + 0x38], rdx
movabs rdx, 0xf12040a0c05090c
mov qword [rsp + 0x40], rdx
xor eax, eax
jmp 0x4a682d
movzx r9d, byte [rsp + rsi + 0x1f]
sub r9d, edx
lea edx, [r9 + 0x63]
mov byte [rsp + rdi + 0x1f], dl
lea edx, [r8 + 0x63]
mov byte [rsp + rsi + 0x1f], dl
add rax, 2
cmp rax, 0x16
jge 0x4a685a
movzx edx, byte [rsp + rax + 0x32]
movzx esi, byte [rsp + rax + 0x33]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x13
jae 0x4a687d
movzx r8d, byte [rsp + rdi + 0x1f]
sub r8d, edx
cmp rsi, 0x13
jb 0x4a6810
jmp 0x4a6871
xor eax, eax
lea rbx, [rsp + 0x1f]
mov ecx, 0x13
call fcn.00443420
add rsp, 0x48
pop rbp
ret
mov eax, esi
mov ecx, 0x13
call fcn.00454ec0
mov eax, edi
mov ecx, 0x13
call fcn.00454ec0
nop
call fcn.00452c40
jmp fcn.004a67a0
Function at 0x4b12e0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4b13dd
push rbp
mov rbp, rsp
sub rsp, 0x50
movabs rdx, 0x329ca57599f831b1
mov qword [rsp + 0x1a], rdx
movabs rdx, 0x386e923971039a31
mov qword [rsp + 0x22], rdx
movabs rdx, 0x3581319610133466
mov qword [rsp + 0x2a], rdx
movabs rdx, 0xa04160b0210020b
mov qword [rsp + 0x32], rdx
movabs rdx, 0x90413140e130d0b
mov qword [rsp + 0x3a], rdx
movabs rdx, 0x3020e0612140904
mov qword [rsp + 0x40], rdx
movabs rdx, 0x14100d03050a05
mov qword [rsp + 0x48], rdx
xor eax, eax
jmp 0x4b1380
movzx r9d, byte [rsp + rsi + 0x1a]
sub r9d, edx
lea edx, [r9 - 0x4e]
mov byte [rsp + rdi + 0x1a], dl
lea edx, [r8 - 0x4e]
mov byte [rsp + rsi + 0x1a], dl
add rax, 2
nop dword [rax]
cmp rax, 0x1e
jge 0x4b13ad
movzx edx, byte [rsp + rax + 0x32]
movzx esi, byte [rsp + rax + 0x33]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x18
jae 0x4b13d0
movzx r8d, byte [rsp + rdi + 0x1a]
sub r8d, edx
cmp rsi, 0x18
jb 0x4b135f
jmp 0x4b13c4
xor eax, eax
lea rbx, [rsp + 0x1a]
mov ecx, 0x18
call fcn.00443420
add rsp, 0x50
pop rbp
ret
mov eax, esi
mov ecx, 0x18
call fcn.00454ec0
mov eax, edi
mov ecx, 0x18
call fcn.00454ec0
nop
nop dword [rax]
call fcn.00452c40
jmp fcn.004b12e0

Function at 0x4b1400
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4b14fb
push rbp
mov rbp, rsp
sub rsp, 0x50
movabs rdx, 0x2e366640303e3c35
mov qword [rsp + 0x1a], rdx
movabs rdx, 0x3c2a4044514d3147
mov qword [rsp + 0x22], rdx
movabs rdx, 0x35322f4041493f37
mov qword [rsp + 0x2a], rdx
movabs rdx, 0x14010b0a13041201
mov qword [rsp + 0x32], rdx
movabs rdx, 0xd080b110d050f02
mov qword [rsp + 0x3a], rdx
movabs rdx, 0xe1407120c080d08
mov qword [rsp + 0x40], rdx
movabs rdx, 0x80e05150f020b0e
mov qword [rsp + 0x48], rdx
xor eax, eax
jmp 0x4b1499
movzx r9d, byte [rsp + rsi + 0x1a]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x23]
mov byte [rsp + rdi + 0x1a], dl
mov byte [rsp + rsi + 0x1a], r8b
add rax, 2
cmp rax, 0x1e
jge 0x4b14cb
movzx edx, byte [rsp + rax + 0x32]
movzx esi, byte [rsp + rax + 0x33]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x18
jae 0x4b14ee
movzx r8d, byte [rsp + rdi + 0x1a]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x23]
cmp rsi, 0x18
jb 0x4b147f
jmp 0x4b14e2
xor eax, eax
lea rbx, [rsp + 0x1a]
mov ecx, 0x18
call fcn.00443420
add rsp, 0x50
pop rbp
ret
mov eax, esi
mov ecx, 0x18
call fcn.00454ec0
mov eax, edi
mov ecx, 0x18
call fcn.00454ec0
nop
nop dword [rax + rax]
call fcn.00452c40
jmp fcn.004b1400
Function at 0x4b1d80
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4b1e9a
push rbp
mov rbp, rsp
sub rsp, 0x58
movabs rdx, 0x1a3837a1593336a8
mov qword [rsp + 0x19], rdx
movabs rdx, 0xa816fb6c3930f830
mov qword [rsp + 0x21], rdx
movabs rdx, 0x1bb9aba816fb6c39
mov qword [rsp + 0x24], rdx
movabs rdx, 0x137e36acafe8cb36
mov qword [rsp + 0x2c], rdx
movabs rdx, 0xe161a1015161111
mov qword [rsp + 0x34], rdx
movabs rdx, 0x70e17160e161a10
mov qword [rsp + 0x38], rdx
movabs rdx, 0xc030012120e0f
mov qword [rsp + 0x40], rdx
movabs rdx, 0x9000d0d1210000d
mov qword [rsp + 0x48], rdx
movabs rdx, 0x190c0c1407000404
mov qword [rsp + 0x50], rdx
xor eax, eax
jmp 0x4b1e37
movzx r9d, byte [rsp + rsi + 0x19]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x7c]
mov byte [rsp + rdi + 0x19], dl
mov byte [rsp + rsi + 0x19], r8b
add rax, 2
cmp rax, 0x24
jge 0x4b1e69
movzx edx, byte [rsp + rax + 0x34]
movzx esi, byte [rsp + rax + 0x35]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x1b
jae 0x4b1e8d
movzx r8d, byte [rsp + rdi + 0x19]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x7c]
cmp rsi, 0x1b
jb 0x4b1e1d
jmp 0x4b1e81
xor eax, eax
lea rbx, [rsp + 0x19]
mov ecx, 0x1b
call fcn.00443420
add rsp, 0x58
pop rbp
nop
ret
mov eax, esi
mov ecx, 0x1b
call fcn.00454ec0
mov eax, edi
mov ecx, 0x1b
call fcn.00454ec0
nop
call fcn.00452c40
nop
jmp fcn.004b1d80

Function at 0x4b22a0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4b23ba
push rbp
mov rbp, rsp
sub rsp, 0x58
movabs rdx, 0x300586e8ffd53012
mov qword [rsp + 0x18], rdx
movabs rdx, 0x15fc7739e13737f9
mov qword [rsp + 0x20], rdx
movabs rdx, 0xfd7e8e915fc7739
mov qword [rsp + 0x24], rdx
movabs rdx, 0xd32ccc7fc0dc927
mov qword [rsp + 0x2c], rdx
movabs rdx, 0xf05021b10001714
mov qword [rsp + 0x34], rdx
movabs rdx, 0x120d00140f05021b
mov qword [rsp + 0x38], rdx
movabs rdx, 0xf0d131604060611
mov qword [rsp + 0x40], rdx
movabs rdx, 0x60e1808030d0e19
mov qword [rsp + 0x48], rdx
movabs rdx, 0xb15121b12150308
mov qword [rsp + 0x50], rdx
xor eax, eax
jmp 0x4b2357
movzx r9d, byte [rsp + rsi + 0x18]
lea edx, [r9 + rdx]
lea edx, [rdx + 0xf]
mov byte [rsp + rdi + 0x18], dl
mov byte [rsp + rsi + 0x18], r8b
add rax, 2
cmp rax, 0x24
jge 0x4b2389
movzx edx, byte [rsp + rax + 0x34]
movzx esi, byte [rsp + rax + 0x35]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x1c
jae 0x4b23ad
movzx r8d, byte [rsp + rdi + 0x18]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0xf]
cmp rsi, 0x1c
jb 0x4b233d
jmp 0x4b23a1
xor eax, eax
lea rbx, [rsp + 0x18]
mov ecx, 0x1c
call fcn.00443420
add rsp, 0x58
pop rbp
nop
ret
mov eax, esi
mov ecx, 0x1c
call fcn.00454ec0
mov eax, edi
mov ecx, 0x1c
call fcn.00454ec0
nop
call fcn.00452c40
nop
jmp fcn.004b22a0
Function at 0x4b3240
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4b3378
push rbp
mov rbp, rsp
sub rsp, 0x68
movabs rdx, 0x94a2385ed6326031
mov qword [rsp + 0x1d], rdx
movabs rdx, 0x7094a2385ed63260
mov qword [rsp + 0x1e], rdx
movabs rdx, 0x6d303058308a3588
mov qword [rsp + 0x26], rdx
movabs rdx, 0x4c7d9b5cad37527b
mov qword [rsp + 0x2e], rdx
movabs rdx, 0xde32cd489d577a35
mov qword [rsp + 0x36], rdx
movabs rdx, 0x81b1b1018171b07
mov qword [rsp + 0x3e], rdx
movabs rdx, 0x1d1b14090b161e1d
mov qword [rsp + 0x46], rdx
movabs rdx, 0x121a1d1b14090b16
mov qword [rsp + 0x48], rdx
movabs rdx, 0x920061b0415030d
mov qword [rsp + 0x50], rdx
movabs rdx, 0x1090b1c16101214
mov qword [rsp + 0x58], rdx
movabs rdx, 0x110b181b01060d0b
mov qword [rsp + 0x60], rdx
xor eax, eax
jmp 0x4b3318
movzx r9d, byte [rsp + rsi + 0x1d]
sub r9d, edx
lea edx, [r9 - 7]
mov byte [rsp + rdi + 0x1d], dl
lea edx, [r8 - 7]
mov byte [rsp + rsi + 0x1d], dl
add rax, 2
cmp rax, 0x2a
jge 0x4b3348
movzx edx, byte [rsp + rax + 0x3e]
movzx esi, byte [rsp + rax + 0x3f]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x21
jae 0x4b336b
movzx r8d, byte [rsp + rdi + 0x1d]
sub r8d, edx
nop dword [rax]
cmp rsi, 0x21
jb 0x4b32fb
jmp 0x4b335f
xor eax, eax
lea rbx, [rsp + 0x1d]
mov ecx, 0x21
call fcn.00443420
add rsp, 0x68
pop rbp
ret
mov eax, esi
mov ecx, 0x21
call fcn.00454ec0
mov eax, edi
mov ecx, 0x21
call fcn.00454ec0
nop
call fcn.00452c40
nop dword [rax]
jmp fcn.004b3240
Function at 0x4b4700
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4b4838
push rbp
mov rbp, rsp
sub rsp, 0x70
movabs rdx, 0xa3f33938307d0190
mov qword [rsp + 0x1c], rdx
movabs rdx, 0x300bf317a3f33938
mov qword [rsp + 0x20], rdx
movabs rdx, 0xf5310e31f21611f7
mov qword [rsp + 0x28], rdx
movabs rdx, 0xfe289b23323500b9
mov qword [rsp + 0x30], rdx
movabs rdx, 0x97a9e938e433cfcd
mov qword [rsp + 0x38], rdx
movabs rdx, 0xe0f061a1a140e11
mov qword [rsp + 0x40], rdx
movabs rdx, 0x1f0d0a0c151b0c15
mov qword [rsp + 0x48], rdx
movabs rdx, 0x80c0e0818181a15
mov qword [rsp + 0x50], rdx
movabs rdx, 0x7230d1c021c011d
mov qword [rsp + 0x58], rdx
movabs rdx, 0x619020706220d21
mov qword [rsp + 0x60], rdx
movabs rdx, 0x2306020100230913
mov qword [rsp + 0x68], rdx
xor eax, eax
jmp 0x4b47d5
movzx r9d, byte [rsp + rsi + 0x1c]
lea edx, [r9 + rdx]
lea edx, [rdx + 1]
mov byte [rsp + rdi + 0x1c], dl
mov byte [rsp + rsi + 0x1c], r8b
add rax, 2
cmp rax, 0x30
jge 0x4b4808
movzx edx, byte [rsp + rax + 0x40]
movzx esi, byte [rsp + rax + 0x41]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x24
jae 0x4b482b
movzx r8d, byte [rsp + rdi + 0x1c]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 1]
nop
cmp rsi, 0x24
jb 0x4b47bb
jmp 0x4b481f
xor eax, eax
lea rbx, [rsp + 0x1c]
mov ecx, 0x24
call fcn.00443420
add rsp, 0x70
pop rbp
ret
mov eax, esi
mov ecx, 0x24
call fcn.00454ec0
mov eax, edi
mov ecx, 0x24
call fcn.00454ec0
nop
call fcn.00452c40
nop dword [rax]
jmp fcn.004b4700

Function at 0x4b4860
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4b4987
push rbp
mov rbp, rsp
sub rsp, 0x68
movabs rdx, 0x565d343430415832
mov qword [rsp + 0x1d], rdx
movabs rdx, 0x3035ac5d55565d34
mov qword [rsp + 0x22], rdx
movabs rdx, 0x525e2b559c513140
mov qword [rsp + 0x2a], rdx
movabs rdx, 0x4255b283335d555c
mov qword [rsp + 0x32], rdx
movabs rdx, 0x353236667f363168
mov qword [rsp + 0x3a], rdx
movabs rdx, 0x1212171b10121d20
mov qword [rsp + 0x42], rdx
movabs rdx, 0xf171d07020d1212
mov qword [rsp + 0x48], rdx
movabs rdx, 0x12081d1c0a160921
mov qword [rsp + 0x50], rdx
movabs rdx, 0x6151a1408130119
mov qword [rsp + 0x58], rdx
movabs rdx, 0x1311011b161b1401
mov qword [rsp + 0x60], rdx
xor eax, eax
jmp 0x4b4929
movzx r9d, byte [rsp + rsi + 0x1d]
sub r9d, edx
lea edx, [r9 + 9]
mov byte [rsp + rdi + 0x1d], dl
lea edx, [r8 + 9]
mov byte [rsp + rsi + 0x1d], dl
add rax, 2
cmp rax, 0x26
jge 0x4b4957
movzx edx, byte [rsp + rax + 0x42]
movzx esi, byte [rsp + rax + 0x43]
mov edi, edx
xor edx, esi
add edx, eax
nop
cmp rdi, 0x25
jae 0x4b497a
movzx r8d, byte [rsp + rdi + 0x1d]
sub r8d, edx
cmp rsi, 0x25
jb 0x4b490c
jmp 0x4b496e
xor eax, eax
lea rbx, [rsp + 0x1d]
mov ecx, 0x25
call fcn.00443420
add rsp, 0x68
pop rbp
ret
mov eax, esi
mov ecx, 0x25
call fcn.00454ec0
mov eax, edi
mov ecx, 0x25
call fcn.00454ec0
nop
call fcn.00452c40
jmp fcn.004b4860
Function at 0x4b54c0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4b560c
push rbp
mov rbp, rsp
sub rsp, 0x78
movabs rdx, 0xe038377f83a0cf0a
mov qword [rsp + 0x1e], rdx
movabs rdx, 0x8434cc8063dbdc38
mov qword [rsp + 0x26], rdx
movabs rdx, 0x5635b032a761413c
mov qword [rsp + 0x2e], rdx
movabs rdx, 0xe33331993538b938
mov qword [rsp + 0x36], rdx
movabs rdx, 0x406e9d30b533b9b8
mov qword [rsp + 0x3e], rdx
movabs rdx, 0x150010260c031517
mov qword [rsp + 0x46], rdx
movabs rdx, 0x204150010260c03
mov qword [rsp + 0x48], rdx
movabs rdx, 0x19211f0f1c0a1704
mov qword [rsp + 0x50], rdx
movabs rdx, 0x90007120a0b0110
mov qword [rsp + 0x58], rdx
movabs rdx, 0x323121f23112010
mov qword [rsp + 0x60], rdx
movabs rdx, 0xa27180718151326
mov qword [rsp + 0x68], rdx
movabs rdx, 0xa0d0c021520251f
mov qword [rsp + 0x70], rdx
xor eax, eax
jmp 0x4b55a4
movzx r9d, byte [rsp + rsi + 0x1e]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x34]
mov byte [rsp + rdi + 0x1e], dl
mov byte [rsp + rsi + 0x1e], r8b
add rax, 2
cmp rax, 0x32
jge 0x4b55dc
movzx edx, byte [rsp + rax + 0x46]
movzx esi, byte [rsp + rax + 0x47]
mov edi, edx
xor edx, esi
add edx, eax
nop word [rax + rax]
cmp rdi, 0x28
jae 0x4b55ff
movzx r8d, byte [rsp + rdi + 0x1e]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x34]
cmp rsi, 0x28
jb 0x4b558a
jmp 0x4b55f3
xor eax, eax
lea rbx, [rsp + 0x1e]
mov ecx, 0x28
call fcn.00443420
add rsp, 0x78
pop rbp
ret
mov eax, esi
mov ecx, 0x28
call fcn.00454ec0
mov eax, edi
mov ecx, 0x28
call fcn.00454ec0
nop
call fcn.00452c40
jmp fcn.004b54c0
Function at 0x4bc0a0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
lea r12, [rsp - 8]
cmp r12, qword [r14 + 0x10]
jbe 0x4bc1f2
push rbp
mov rbp, rsp
add rsp, 0xffffffffffffff80
movabs rdx, 0x3e3867adad2724a6
mov qword [rsp + 0x1e], rdx
movabs rdx, 0xf1309e77f250cde1
mov qword [rsp + 0x26], rdx
movabs rdx, 0x4bb5702ef1309e77
mov qword [rsp + 0x2a], rdx
movabs rdx, 0x30191330b6c32365
mov qword [rsp + 0x32], rdx
movabs rdx, 0xf2eea7242a73527f
mov qword [rsp + 0x3a], rdx
movabs rdx, 0x65cb26617220666f
mov qword [rsp + 0x42], rdx
movabs rdx, 0x18170f1c211602
mov qword [rsp + 0x4a], rdx
movabs rdx, 0x207050110170018
mov qword [rsp + 0x50], rdx
movabs rdx, 0xd22130b1d131d12
mov qword [rsp + 0x58], rdx
movabs rdx, 0x2171804231815
mov qword [rsp + 0x60], rdx
movabs rdx, 0x316230f13202a1a
mov qword [rsp + 0x68], rdx
movabs rdx, 0x71a1921081f2210
mov qword [rsp + 0x70], rdx
movabs rdx, 0x10150b291c162909
mov qword [rsp + 0x78], rdx
xor eax, eax
jmp 0x4bc194
movzx r9d, byte [rsp + rsi + 0x1e]
add edx, r9d
mov byte [rsp + rdi + 0x1e], dl
mov byte [rsp + rsi + 0x1e], r8b
add rax, 2
cmp rax, 0x36
jge 0x4bc1c2
movzx edx, byte [rsp + rax + 0x4a]
movzx esi, byte [rsp + rax + 0x4b]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x2c
jae 0x4bc1e5
movzx r8d, byte [rsp + rdi + 0x1e]
add r8d, edx
cmp rsi, 0x2c
jb 0x4bc17e
nop
jmp 0x4bc1d9
xor eax, eax
lea rbx, [rsp + 0x1e]
mov ecx, 0x2c
call fcn.00443420
sub rsp, 0xffffffffffffff80
pop rbp
ret
mov eax, esi
mov ecx, 0x2c
call fcn.00454ec0
mov eax, edi
mov ecx, 0x2c
call fcn.00454ec0
nop
call fcn.00452c40
jmp fcn.004bc0a0
Function at 0x4bd600
Capabilities:
Encrypt data using rc4 prga

Disassembly:
lea r12, [rsp - 0x18]
cmp r12, qword [r14 + 0x10]
jbe 0x4bd795
push rbp
mov rbp, rsp
sub rsp, 0x90
movabs rdx, 0xf5c46e2888debf1b
mov qword [rsp + 0x1b], rdx
movabs rdx, 0x67f5c46e2888debf
mov qword [rsp + 0x1c], rdx
movabs rdx, 0x66695c15d589bbc0
mov qword [rsp + 0x24], rdx
movabs rdx, 0xf1ebd27440923069
mov qword [rsp + 0x2c], rdx
movabs rdx, 0x72be31d34f0d6774
mov qword [rsp + 0x34], rdx
movabs rdx, 0x1e320c7436fab628
mov qword [rsp + 0x3c], rdx
movabs rdx, 0x1b8677c550026962
mov qword [rsp + 0x44], rdx
movabs rdx, 0x1a090d0e1c062117
mov qword [rsp + 0x4c], rdx
movabs rdx, 0x70314031a090d0e
mov qword [rsp + 0x50], rdx
movabs rdx, 0x101300921161f28
mov qword [rsp + 0x58], rdx
movabs rdx, 0x28262b161c2f2302
mov qword [rsp + 0x60], rdx
movabs rdx, 0x1a14042b1304162d
mov qword [rsp + 0x68], rdx
movabs rdx, 0xb21181b1c00021a
mov qword [rsp + 0x70], rdx
movabs rdx, 0x1231202181e001d
mov qword [rsp + 0x78], rdx
movabs rdx, 0x3021030c2d032324
mov qword [rsp + 0x80], rdx
movabs rdx, 0x222b1404220a0e00
mov qword [rsp + 0x88], rdx
xor eax, eax
jmp 0x4bd72e
movzx r9d, byte [rsp + rsi + 0x1b]
lea edx, [r9 + rdx]
lea edx, [rdx + 4]
mov byte [rsp + rdi + 0x1b], dl
mov byte [rsp + rsi + 0x1b], r8b
add rax, 2
cmp rax, 0x44
jge 0x4bd762
movzx edx, byte [rsp + rax + 0x4c]
movzx esi, byte [rsp + rax + 0x4d]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x31
jae 0x4bd788
movzx r8d, byte [rsp + rdi + 0x1b]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 4]
cmp rsi, 0x31
jb 0x4bd714
nop
jmp 0x4bd77c
xor eax, eax
lea rbx, [rsp + 0x1b]
mov ecx, 0x31
call fcn.00443420
add rsp, 0x90
pop rbp
ret
mov eax, esi
mov ecx, 0x31
call fcn.00454ec0
mov eax, edi
mov ecx, 0x31
call fcn.00454ec0
nop
call fcn.00452c40
jmp fcn.004bd600

Function at 0x4c0840
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4c08f8
push rbp
mov rbp, rsp
sub rsp, 0x30
movabs rdx, 0xfba9658d91939d9d
mov qword [rsp + 0x1e], rdx
movabs rdx, 0x400020301040407
mov qword [rsp + 0x26], rdx
mov word [rsp + 0x2e], 0x106
xor eax, eax
jmp 0x4c0898
movzx r9d, byte [rsp + rsi + 0x1e]
sub r9d, edx
lea edx, [r9 - 0x25]
mov byte [rsp + rdi + 0x1e], dl
lea edx, [r8 - 0x25]
mov byte [rsp + rsi + 0x1e], dl
add rax, 2
cmp rax, 0xa
jge 0x4c08c8
movzx edx, byte [rsp + rax + 0x26]
movzx esi, byte [rsp + rax + 0x27]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 8
jae 0x4c08eb
movzx r8d, byte [rsp + rdi + 0x1e]
sub r8d, edx
nop dword [rax]
cmp rsi, 8
jb 0x4c087b
jmp 0x4c08df
xor eax, eax
lea rbx, [rsp + 0x1e]
mov ecx, 8
call fcn.00443420
add rsp, 0x30
pop rbp
ret
mov eax, esi
mov ecx, 8
call fcn.00454ec0
mov eax, edi
mov ecx, 8
call fcn.00454ec0
nop
call fcn.00452c40
nop dword [rax]
jmp fcn.004c0840