joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4b02a0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4b038c
push rbp
mov rbp, rsp
sub rsp, 0x48
movabs rdx, 0x6edc968dbcecf4c0
mov qword [rsp + 0x34], rdx
movabs rdx, 0x74bd79b36edc968d
mov qword [rsp + 0x38], rdx
movabs rdx, 0x57ab80e974c14a3d
mov qword [rsp + 0x40], rdx
movabs rdx, 0xd0d061200010c0e
mov qword [rsp + 0x1c], rdx
movabs rdx, 0x805030a10020e0d
mov qword [rsp + 0x24], rdx
movabs rdx, 0xd1210020e110400
mov qword [rsp + 0x2c], rdx
xor eax, eax
jmp 0x4b032a
movzx r9d, byte [rsp + rsi + 0x34]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x5e]
mov byte [rsp + rdi + 0x34], dl
mov byte [rsp + rsi + 0x34], r8b
add rax, 2
cmp rax, 0x18
jge 0x4b035c
movzx edx, byte [rsp + rax + 0x1c]
movzx esi, byte [rsp + rax + 0x1d]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x14
jae 0x4b037f
movzx r8d, byte [rsp + rdi + 0x34]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x5e]
cmp rsi, 0x14
jb 0x4b0310
jmp 0x4b0373
xor eax, eax
lea rbx, [rsp + 0x34]
mov ecx, 0x14
call fcn.004415e0
add rsp, 0x48
pop rbp
ret
mov eax, esi
mov ecx, 0x14
call fcn.00451e00
mov eax, edi
mov ecx, 0x14
call fcn.00451e00
nop
call fcn.0044fb80
jmp fcn.004b02a0

Function at 0x4b2360
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4b241d
push rbp
mov rbp, rsp
sub rsp, 0x30
movabs rdx, 0x582e2d746109654e
mov qword [rsp + 0x26], rdx
mov word [rsp + 0x2e], 0x6567
movabs rdx, 0x600000602000500
mov qword [rsp + 0x1a], rdx
mov dword [rsp + 0x22], 0x7020108
xor eax, eax
jmp 0x4b23c0
movzx r9d, byte [rsp + rsi + 0x26]
sub r9d, edx
lea edx, [r9 + 0x1c]
mov byte [rsp + rdi + 0x26], dl
lea edx, [r8 + 0x1c]
mov byte [rsp + rsi + 0x26], dl
add rax, 2
cmp rax, 0xc
jge 0x4b23ed
movzx edx, byte [rsp + rax + 0x1a]
movzx esi, byte [rsp + rax + 0x1b]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0xa
jae 0x4b2410
movzx r8d, byte [rsp + rdi + 0x26]
sub r8d, edx
cmp rsi, 0xa
jb 0x4b23a3
jmp 0x4b2404
xor eax, eax
lea rbx, [rsp + 0x26]
mov ecx, 0xa
call fcn.004415e0
add rsp, 0x30
pop rbp
ret
mov eax, esi
mov ecx, 0xa
call fcn.00451e00
mov eax, edi
mov ecx, 0xa
call fcn.00451e00
nop
nop dword [rax]
call fcn.0044fb80
jmp fcn.004b2360
Function at 0x4b2e00
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4b2ec7
push rbp
mov rbp, rsp
sub rsp, 0x38
movabs rdx, 0x6946d5d2c9d69544
mov qword [rsp + 0x2d], rdx
mov dword [rsp + 0x34], 0x57d71c69
movabs rdx, 0x403040801050302
mov qword [rsp + 0x1f], rdx
movabs rdx, 0x201030809080403
mov qword [rsp + 0x25], rdx
xor eax, eax
jmp 0x4b2e68
movzx r9d, byte [rsp + rsi + 0x2d]
sub r9d, edx
lea edx, [r9 - 0x2a]
mov byte [rsp + rdi + 0x2d], dl
lea edx, [r8 - 0x2a]
mov byte [rsp + rsi + 0x2d], dl
add rax, 2
cmp rax, 0xe
jge 0x4b2e97
movzx edx, byte [rsp + rax + 0x1f]
movzx esi, byte [rsp + rax + 0x20]
mov edi, edx
xor edx, esi
add edx, eax
nop
cmp rdi, 0xb
jae 0x4b2eba
movzx r8d, byte [rsp + rdi + 0x2d]
sub r8d, edx
cmp rsi, 0xb
jb 0x4b2e4b
jmp 0x4b2eae
xor eax, eax
lea rbx, [rsp + 0x2d]
mov ecx, 0xb
call fcn.004415e0
add rsp, 0x38
pop rbp
ret
mov eax, esi
mov ecx, 0xb
call fcn.00451e00
mov eax, edi
mov ecx, 0xb
call fcn.00451e00
nop
call fcn.0044fb80
jmp fcn.004b2e00

Function at 0x4b2ee0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4b2fec
push rbp
mov rbp, rsp
sub rsp, 0x58
movabs rdx, 0x723b2b740ea4050f
mov qword [rsp + 0x3b], rdx
movabs rdx, 0x34e8205d6854636f
mov qword [rsp + 0x43], rdx
movabs rdx, 0x4a72de74d034e820
mov qword [rsp + 0x48], rdx
movabs rdx, 0x1dbb69f90eabe762
mov qword [rsp + 0x50], rdx
movabs rdx, 0xf0d1012050c1803
mov qword [rsp + 0x1b], rdx
movabs rdx, 0x1202101b14000601
mov qword [rsp + 0x23], rdx
movabs rdx, 0xd1c19050e00171c
mov qword [rsp + 0x2b], rdx
movabs rdx, 0x1c10120e19160112
mov qword [rsp + 0x33], rdx
xor eax, eax
jmp 0x4b2f88
movzx r9d, byte [rsp + rsi + 0x3b]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x3c]
mov byte [rsp + rdi + 0x3b], dl
mov byte [rsp + rsi + 0x3b], r8b
add rax, 2
cmp rax, 0x20
jge 0x4b2fbc
movzx edx, byte [rsp + rax + 0x1b]
movzx esi, byte [rsp + rax + 0x1c]
mov edi, edx
xor edx, esi
add edx, eax
nop
cmp rdi, 0x1d
jae 0x4b2fdf
movzx r8d, byte [rsp + rdi + 0x3b]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x3c]
cmp rsi, 0x1d
jb 0x4b2f6e
jmp 0x4b2fd3
xor eax, eax
lea rbx, [rsp + 0x3b]
mov ecx, 0x1d
call fcn.004415e0
add rsp, 0x58
pop rbp
ret
mov eax, esi
mov ecx, 0x1d
call fcn.00451e00
mov eax, edi
mov ecx, 0x1d
call fcn.00451e00
nop
call fcn.0044fb80
jmp fcn.004b2ee0
Function at 0x4b3d80
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4b3e66
push rbp
mov rbp, rsp
sub rsp, 0x40
movabs rdx, 0x6cb00c0f73246cab
mov qword [rsp + 0x30], rdx
movabs rdx, 0x1de1ed1166466a6a
mov qword [rsp + 0x38], rdx
movabs rdx, 0xf090f020a020809
mov qword [rsp + 0x1c], rdx
movabs rdx, 0x50d0c040f090f02
mov qword [rsp + 0x20], rdx
movabs rdx, 0xf080e0006080008
mov qword [rsp + 0x28], rdx
xor eax, eax
nop
jmp 0x4b3e00
movzx r9d, byte [rsp + rsi + 0x30]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x47]
mov byte [rsp + rdi + 0x30], dl
mov byte [rsp + rsi + 0x30], r8b
add rax, 2
nop dword [rax]
cmp rax, 0x14
jge 0x4b3e32
movzx edx, byte [rsp + rax + 0x1c]
movzx esi, byte [rsp + rax + 0x1d]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x10
jae 0x4b3e57
movzx r8d, byte [rsp + rdi + 0x30]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x47]
cmp rsi, 0x10
jb 0x4b3de2
jmp 0x4b3e4b
xor eax, eax
lea rbx, [rsp + 0x30]
mov ecx, 0x10
nop
call fcn.004415e0
add rsp, 0x40
pop rbp
ret
mov eax, esi
mov ecx, 0x10
call fcn.00451e00
mov eax, edi
mov ecx, 0x10
nop
call fcn.00451e00
nop
call fcn.0044fb80
jmp fcn.004b3d80

Function at 0x4b54c0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4b55ac
push rbp
mov rbp, rsp
sub rsp, 0x48
movabs rdx, 0x655972eee3b4cdaf
mov qword [rsp + 0x34], rdx
movabs rdx, 0xccd4034d655972ee
mov qword [rsp + 0x38], rdx
movabs rdx, 0x5726c36f7463b272
mov qword [rsp + 0x40], rdx
movabs rdx, 0x308001212020112
mov qword [rsp + 0x1c], rdx
movabs rdx, 0xd010a12090604
mov qword [rsp + 0x24], rdx
movabs rdx, 0x12030202110b0409
mov qword [rsp + 0x2c], rdx
xor eax, eax
jmp 0x4b554a
movzx r9d, byte [rsp + rsi + 0x34]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x7a]
mov byte [rsp + rdi + 0x34], dl
mov byte [rsp + rsi + 0x34], r8b
add rax, 2
cmp rax, 0x18
jge 0x4b557c
movzx edx, byte [rsp + rax + 0x1c]
movzx esi, byte [rsp + rax + 0x1d]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x14
jae 0x4b559f
movzx r8d, byte [rsp + rdi + 0x34]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x7a]
cmp rsi, 0x14
jb 0x4b5530
jmp 0x4b5593
xor eax, eax
lea rbx, [rsp + 0x34]
mov ecx, 0x14
call fcn.004415e0
add rsp, 0x48
pop rbp
ret
mov eax, esi
mov ecx, 0x14
call fcn.00451e00
mov eax, edi
mov ecx, 0x14
call fcn.00451e00
nop
call fcn.0044fb80
jmp fcn.004b54c0
Function at 0x4b6920
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4b6a2c
push rbp
mov rbp, rsp
sub rsp, 0x50
movabs rdx, 0xa161c6694693e4c0
mov qword [rsp + 0x37], rdx
movabs rdx, 0xa16d7fce6875ed50
mov qword [rsp + 0x3f], rdx
movabs rdx, 0xf6a16d7fce6875ed
mov qword [rsp + 0x40], rdx
movabs rdx, 0xda4ab8cb6e6148c1
mov qword [rsp + 0x48], rdx
movabs rdx, 0x5070c070c0a1117
mov qword [rsp + 0x1d], rdx
movabs rdx, 0x90111150d0d0d10
mov qword [rsp + 0x25], rdx
movabs rdx, 0x1518090111150d0d
mov qword [rsp + 0x27], rdx
movabs rdx, 0x10f161602001509
mov qword [rsp + 0x2f], rdx
xor eax, eax
jmp 0x4b69c8
movzx r9d, byte [rsp + rsi + 0x37]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x62]
mov byte [rsp + rdi + 0x37], dl
mov byte [rsp + rsi + 0x37], r8b
add rax, 2
cmp rax, 0x1a
jge 0x4b69fc
movzx edx, byte [rsp + rax + 0x1d]
movzx esi, byte [rsp + rax + 0x1e]
mov edi, edx
xor edx, esi
add edx, eax
nop
cmp rdi, 0x19
jae 0x4b6a1f
movzx r8d, byte [rsp + rdi + 0x37]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x62]
cmp rsi, 0x19
jb 0x4b69ae
jmp 0x4b6a13
xor eax, eax
lea rbx, [rsp + 0x37]
mov ecx, 0x19
call fcn.004415e0
add rsp, 0x50
pop rbp
ret
mov eax, esi
mov ecx, 0x19
call fcn.00451e00
mov eax, edi
mov ecx, 0x19
call fcn.00451e00
nop
call fcn.0044fb80
jmp fcn.004b6920

Function at 0x4b7860
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4b7932
push rbp
mov rbp, rsp
sub rsp, 0x38
movabs rdx, 0x6761787550746459
mov qword [rsp + 0x29], rdx
movabs rdx, 0x733b5c7854727167
mov qword [rsp + 0x30], rdx
movabs rdx, 0xb0c0405090b0701
mov qword [rsp + 0x19], rdx
movabs rdx, 0x70609080d00010b
mov qword [rsp + 0x21], rdx
xor eax, eax
jmp 0x4b78cc
movzx r9d, byte [rsp + rsi + 0x29]
lea edx, [r9 + rdx]
lea edx, [rdx - 0xb]
mov byte [rsp + rdi + 0x29], dl
mov byte [rsp + rsi + 0x29], r8b
add rax, 2
cmp rax, 0x10
jge 0x4b78fe
movzx edx, byte [rsp + rax + 0x19]
movzx esi, byte [rsp + rax + 0x1a]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0xf
jae 0x4b7925
movzx r8d, byte [rsp + rdi + 0x29]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0xb]
cmp rsi, 0xf
jb 0x4b78b2
jmp 0x4b7915
xor eax, eax
lea rbx, [rsp + 0x29]
mov ecx, 0xf
call fcn.004415e0
add rsp, 0x38
pop rbp
ret
mov eax, esi
mov ecx, 0xf
nop dword [rax]
call fcn.00451e00
mov eax, edi
mov ecx, 0xf
call fcn.00451e00
nop
call fcn.0044fb80
jmp fcn.004b7860
Function at 0x4b7d60
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4b7e27
push rbp
mov rbp, rsp
sub rsp, 0x38
movabs rdx, 0x8a48cf97539b65e2
mov qword [rsp + 0x2c], rdx
mov dword [rsp + 0x34], 0xd99f758f
movabs rdx, 0x807040a0700070b
mov qword [rsp + 0x1e], rdx
movabs rdx, 0x900020805080807
mov qword [rsp + 0x24], rdx
xor eax, eax
jmp 0x4b7dc8
movzx r9d, byte [rsp + rsi + 0x2c]
sub r9d, edx
lea edx, [r9 - 0x19]
mov byte [rsp + rdi + 0x2c], dl
lea edx, [r8 - 0x19]
mov byte [rsp + rsi + 0x2c], dl
add rax, 2
cmp rax, 0xe
jge 0x4b7df7
movzx edx, byte [rsp + rax + 0x1e]
movzx esi, byte [rsp + rax + 0x1f]
mov edi, edx
xor edx, esi
add edx, eax
nop
cmp rdi, 0xc
jae 0x4b7e1a
movzx r8d, byte [rsp + rdi + 0x2c]
sub r8d, edx
cmp rsi, 0xc
jb 0x4b7dab
jmp 0x4b7e0e
xor eax, eax
lea rbx, [rsp + 0x2c]
mov ecx, 0xc
call fcn.004415e0
add rsp, 0x38
pop rbp
ret
mov eax, esi
mov ecx, 0xc
call fcn.00451e00
mov eax, edi
mov ecx, 0xc
call fcn.00451e00
nop
call fcn.0044fb80
jmp fcn.004b7d60

Function at 0x4bb500
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4bb5ec
push rbp
mov rbp, rsp
sub rsp, 0x40
movabs rdx, 0xcf194254435565d9
mov qword [rsp + 0x2c], rdx
movabs rdx, 0xde443a6ecf194254
mov qword [rsp + 0x30], rdx
movabs rdx, 0x3979ed6f4d4f3972
mov qword [rsp + 0x38], rdx
movabs rdx, 0x1100060f04020713
mov qword [rsp + 0x18], rdx
movabs rdx, 0xb1311091100060f
mov qword [rsp + 0x1c], rdx
movabs rdx, 0xd0b130009050e0f
mov qword [rsp + 0x24], rdx
xor eax, eax
jmp 0x4bb58a
movzx r9d, byte [rsp + rsi + 0x2c]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x18]
mov byte [rsp + rdi + 0x2c], dl
mov byte [rsp + rsi + 0x2c], r8b
add rax, 2
cmp rax, 0x14
jge 0x4bb5bc
movzx edx, byte [rsp + rax + 0x18]
movzx esi, byte [rsp + rax + 0x19]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x14
jae 0x4bb5df
movzx r8d, byte [rsp + rdi + 0x2c]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x18]
cmp rsi, 0x14
jb 0x4bb570
jmp 0x4bb5d3
xor eax, eax
lea rbx, [rsp + 0x2c]
mov ecx, 0x14
call fcn.004415e0
add rsp, 0x40
pop rbp
ret
mov eax, esi
mov ecx, 0x14
call fcn.00451e00
mov eax, edi
mov ecx, 0x14
call fcn.00451e00
nop
call fcn.0044fb80
jmp fcn.004bb500
Function at 0x4bbee0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4bbfcc
push rbp
mov rbp, rsp
sub rsp, 0x40
movabs rdx, 0xc865106946201dc6
mov qword [rsp + 0x2e], rdx
movabs rdx, 0xddddc86510694620
mov qword [rsp + 0x30], rdx
movabs rdx, 0x9396c39575e4ab72
mov qword [rsp + 0x38], rdx
movabs rdx, 0x7100b1111010e0c
mov qword [rsp + 0x1a], rdx
movabs rdx, 0xc02080907100b11
mov qword [rsp + 0x1e], rdx
movabs rdx, 0x200010c0f0502
mov qword [rsp + 0x26], rdx
xor eax, eax
jmp 0x4bbf6a
movzx r9d, byte [rsp + rsi + 0x2e]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x72]
mov byte [rsp + rdi + 0x2e], dl
mov byte [rsp + rsi + 0x2e], r8b
add rax, 2
cmp rax, 0x14
jge 0x4bbf9c
movzx edx, byte [rsp + rax + 0x1a]
movzx esi, byte [rsp + rax + 0x1b]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x12
jae 0x4bbfbf
movzx r8d, byte [rsp + rdi + 0x2e]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x72]
cmp rsi, 0x12
jb 0x4bbf50
jmp 0x4bbfb3
xor eax, eax
lea rbx, [rsp + 0x2e]
mov ecx, 0x12
call fcn.004415e0
add rsp, 0x40
pop rbp
ret
mov eax, esi
mov ecx, 0x12
call fcn.00451e00
mov eax, edi
mov ecx, 0x12
call fcn.00451e00
nop
call fcn.0044fb80
jmp fcn.004bbee0

Function at 0x4bce40
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4bcf12
push rbp
mov rbp, rsp
sub rsp, 0x38
movabs rdx, 0xd08c61a274e469d6
mov qword [rsp + 0x2b], rdx
movabs rdx, 0x6bb911a6e0d08c61
mov qword [rsp + 0x30], rdx
movabs rdx, 0x90404080a080002
mov qword [rsp + 0x1b], rdx
movabs rdx, 0xa0207020b020006
mov qword [rsp + 0x23], rdx
xor eax, eax
jmp 0x4bceac
movzx r9d, byte [rsp + rsi + 0x2b]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x44]
mov byte [rsp + rdi + 0x2b], dl
mov byte [rsp + rsi + 0x2b], r8b
add rax, 2
cmp rax, 0x10
jge 0x4bcede
movzx edx, byte [rsp + rax + 0x1b]
movzx esi, byte [rsp + rax + 0x1c]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0xd
jae 0x4bcf05
movzx r8d, byte [rsp + rdi + 0x2b]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x44]
cmp rsi, 0xd
jb 0x4bce92
jmp 0x4bcef5
xor eax, eax
lea rbx, [rsp + 0x2b]
mov ecx, 0xd
call fcn.004415e0
add rsp, 0x38
pop rbp
ret
mov eax, esi
mov ecx, 0xd
nop dword [rax]
call fcn.00451e00
mov eax, edi
mov ecx, 0xd
call fcn.00451e00
nop
call fcn.0044fb80
jmp fcn.004bce40
Function at 0x4bea80
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4beb7d
push rbp
mov rbp, rsp
sub rsp, 0x50
movabs rdx, 0xf64e83f6476ce589
mov qword [rsp + 0x3a], rdx
movabs rdx, 0x722a33a46586f64e
mov qword [rsp + 0x40], rdx
movabs rdx, 0x6f72e8fde0f34e1d
mov qword [rsp + 0x48], rdx
movabs rdx, 0xe070a120715040c
mov qword [rsp + 0x1a], rdx
movabs rdx, 0xc05010413110c0d
mov qword [rsp + 0x22], rdx
movabs rdx, 0x8100c0b010b000b
mov qword [rsp + 0x2a], rdx
movabs rdx, 0x100c120d070d0010
mov qword [rsp + 0x32], rdx
xor eax, eax
jmp 0x4beb20
movzx r9d, byte [rsp + rsi + 0x3a]
sub r9d, edx
lea edx, [r9 - 0x6f]
mov byte [rsp + rdi + 0x3a], dl
lea edx, [r8 - 0x6f]
mov byte [rsp + rsi + 0x3a], dl
add rax, 2
nop dword [rax]
cmp rax, 0x20
jge 0x4beb4d
movzx edx, byte [rsp + rax + 0x1a]
movzx esi, byte [rsp + rax + 0x1b]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x16
jae 0x4beb70
movzx r8d, byte [rsp + rdi + 0x3a]
sub r8d, edx
cmp rsi, 0x16
jb 0x4beaff
jmp 0x4beb64
xor eax, eax
lea rbx, [rsp + 0x3a]
mov ecx, 0x16
call fcn.004415e0
add rsp, 0x50
pop rbp
ret
mov eax, esi
mov ecx, 0x16
call fcn.00451e00
mov eax, edi
mov ecx, 0x16
call fcn.00451e00
nop
nop dword [rax]
call fcn.0044fb80
jmp fcn.004bea80

Function at 0x4beba0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4bec7d
push rbp
mov rbp, rsp
sub rsp, 0x40
movabs rdx, 0x4e7265f149bfd154
mov qword [rsp + 0x32], rdx
movabs rdx, 0xf8e845d46d614e72
mov qword [rsp + 0x38], rdx
movabs rdx, 0x40c010201020c0a
mov qword [rsp + 0x1e], rdx
movabs rdx, 0xc0d0a040c0102
mov qword [rsp + 0x22], rdx
movabs rdx, 0x3040d0102030a00
mov qword [rsp + 0x2a], rdx
xor eax, eax
nop
jmp 0x4bec20
movzx r9d, byte [rsp + rsi + 0x32]
sub r9d, edx
lea edx, [r9 + 0x3a]
mov byte [rsp + rdi + 0x32], dl
lea edx, [r8 + 0x3a]
mov byte [rsp + rsi + 0x32], dl
add rax, 2
nop
cmp rax, 0x14
jge 0x4bec4d
movzx edx, byte [rsp + rax + 0x1e]
movzx esi, byte [rsp + rax + 0x1f]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0xe
jae 0x4bec70
movzx r8d, byte [rsp + rdi + 0x32]
sub r8d, edx
cmp rsi, 0xe
jb 0x4bec02
jmp 0x4bec64
xor eax, eax
lea rbx, [rsp + 0x32]
mov ecx, 0xe
call fcn.004415e0
add rsp, 0x40
pop rbp
ret
mov eax, esi
mov ecx, 0xe
call fcn.00451e00
mov eax, edi
mov ecx, 0xe
call fcn.00451e00
nop
nop dword [rax]
call fcn.0044fb80
jmp fcn.004beba0
Function at 0x4bff80
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4c003d
push rbp
mov rbp, rsp
sub rsp, 0x30
movabs rdx, 0x8661bf6c3976537c
mov qword [rsp + 0x26], rdx
mov word [rsp + 0x2e], 0x70d1
movabs rdx, 0x308000203080208
mov qword [rsp + 0x1a], rdx
mov dword [rsp + 0x22], 0x7030805
xor eax, eax
jmp 0x4bffe0
movzx r9d, byte [rsp + rsi + 0x26]
sub r9d, edx
lea edx, [r9 - 0x35]
mov byte [rsp + rdi + 0x26], dl
lea edx, [r8 - 0x35]
mov byte [rsp + rsi + 0x26], dl
add rax, 2
cmp rax, 0xc
jge 0x4c000d
movzx edx, byte [rsp + rax + 0x1a]
movzx esi, byte [rsp + rax + 0x1b]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0xa
jae 0x4c0030
movzx r8d, byte [rsp + rdi + 0x26]
sub r8d, edx
cmp rsi, 0xa
jb 0x4bffc3
jmp 0x4c0024
xor eax, eax
lea rbx, [rsp + 0x26]
mov ecx, 0xa
call fcn.004415e0
add rsp, 0x30
pop rbp
ret
mov eax, esi
mov ecx, 0xa
call fcn.00451e00
mov eax, edi
mov ecx, 0xa
call fcn.00451e00
nop
nop dword [rax]
call fcn.0044fb80
jmp fcn.004bff80

Function at 0x4c06e0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4c07ac
push rbp
mov rbp, rsp
sub rsp, 0x38
movabs rdx, 0x857d7365739677a1
mov qword [rsp + 0x2d], rdx
mov dword [rsp + 0x34], 0xa9868585
movabs rdx, 0x809070a08020000
mov qword [rsp + 0x1f], rdx
movabs rdx, 0x600010601070809
mov qword [rsp + 0x25], rdx
xor eax, eax
jmp 0x4c0745
movzx r9d, byte [rsp + rsi + 0x2d]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x22]
mov byte [rsp + rdi + 0x2d], dl
mov byte [rsp + rsi + 0x2d], r8b
add rax, 2
cmp rax, 0xe
jge 0x4c077c
movzx edx, byte [rsp + rax + 0x1f]
movzx esi, byte [rsp + rax + 0x20]
mov edi, edx
xor edx, esi
add edx, eax
nop dword [rax + rax]
cmp rdi, 0xb
jae 0x4c079f
movzx r8d, byte [rsp + rdi + 0x2d]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x22]
cmp rsi, 0xb
jb 0x4c072b
jmp 0x4c0793
xor eax, eax
lea rbx, [rsp + 0x2d]
mov ecx, 0xb
call fcn.004415e0
add rsp, 0x38
pop rbp
ret
mov eax, esi
mov ecx, 0xb
call fcn.00451e00
mov eax, edi
mov ecx, 0xb
call fcn.00451e00
nop
call fcn.0044fb80
jmp fcn.004c06e0
Function at 0x4c2040
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4c210a
push rbp
mov rbp, rsp
sub rsp, 0x48
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rbx
mov qword [rsp], rax
mov qword [rsp + 8], rbx
mov byte [rsp + 0x10], 0
call fcn.00402920
xorps xmm15, xmm15
mov r14, qword [0x007abb98]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x18], 0xffffffffffffffff
jne 0x4c20ef
mov rcx, qword [rsp + 0x60]
lea rdx, [rcx + 1]
mov qword [rsp + 0x40], rdx
lea rax, [0x00504480]
xor ebx, ebx
mov rcx, rdx
call fcn.0043e100
mov rbx, qword [rsp + 0x60]
mov rcx, rax
xor edi, edi
mov rsi, qword [rsp + 0x40]
mov rax, qword [rsp + 0x58]
nop dword [rax]
call fcn.004c23c0
inc rbx
cmp rcx, rbx
jae 0x4c20de
mov edi, 1
lea rsi, [0x00504480]
call fcn.0043e1e0
mov word [rax + rbx*2 - 2], 0
xor edi, edi
xor esi, esi
add rsp, 0x48
pop rbp
ret
xor eax, eax
xor ebx, ebx
mov rcx, rbx
lea rdi, [0x006b10b8]
lea rsi, [0x006b0da8]
add rsp, 0x48
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.0044fb80
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.004c2040

Function at 0x4c5500
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4c55c6
push rbp
mov rbp, rsp
sub rsp, 0x30
movabs rdx, 0x327f7cf947c6f861
mov qword [rsp + 0x24], rdx
mov dword [rsp + 0x2c], 0xee6cfef8
movabs rdx, 0x50409020b030602
mov qword [rsp + 0x18], rdx
mov dword [rsp + 0x20], 0x104080b
xor eax, eax
jmp 0x4c5560
movzx r9d, byte [rsp + rsi + 0x24]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x69]
mov byte [rsp + rdi + 0x24], dl
mov byte [rsp + rsi + 0x24], r8b
add rax, 2
nop
cmp rax, 0xc
jge 0x4c5592
movzx edx, byte [rsp + rax + 0x18]
movzx esi, byte [rsp + rax + 0x19]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0xc
jae 0x4c55b7
movzx r8d, byte [rsp + rdi + 0x24]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x69]
cmp rsi, 0xc
jb 0x4c5544
jmp 0x4c55ab
xor eax, eax
lea rbx, [rsp + 0x24]
mov ecx, 0xc
nop
call fcn.004415e0
add rsp, 0x30
pop rbp
ret
mov eax, esi
mov ecx, 0xc
call fcn.00451e00
mov eax, edi
mov ecx, 0xc
nop
call fcn.00451e00
nop
call fcn.0044fb80
jmp fcn.004c5500
Function at 0x4c55e0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4c56ac
push rbp
mov rbp, rsp
sub rsp, 0x38
movabs rdx, 0x4271837b8a777975
mov qword [rsp + 0x2c], rdx
mov dword [rsp + 0x34], 0x3c7a642e
movabs rdx, 0x60b00040b070503
mov qword [rsp + 0x1c], rdx
movabs rdx, 0x30a050503010a02
mov qword [rsp + 0x24], rdx
xor eax, eax
jmp 0x4c5645
movzx r9d, byte [rsp + rsi + 0x2c]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x18]
mov byte [rsp + rdi + 0x2c], dl
mov byte [rsp + rsi + 0x2c], r8b
add rax, 2
cmp rax, 0x10
jge 0x4c567c
movzx edx, byte [rsp + rax + 0x1c]
movzx esi, byte [rsp + rax + 0x1d]
mov edi, edx
xor edx, esi
add edx, eax
nop dword [rax + rax]
cmp rdi, 0xc
jae 0x4c569f
movzx r8d, byte [rsp + rdi + 0x2c]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x18]
cmp rsi, 0xc
jb 0x4c562b
jmp 0x4c5693
xor eax, eax
lea rbx, [rsp + 0x2c]
mov ecx, 0xc
call fcn.004415e0
add rsp, 0x38
pop rbp
ret
mov eax, esi
mov ecx, 0xc
call fcn.00451e00
mov eax, edi
mov ecx, 0xc
call fcn.00451e00
nop
call fcn.0044fb80
jmp fcn.004c55e0

Function at 0x4c5e40
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4c5f0c
push rbp
mov rbp, rsp
sub rsp, 0x38
movabs rdx, 0x11236cc9441b20fa
mov qword [rsp + 0x29], rdx
movabs rdx, 0x16575dcd502d511
mov qword [rsp + 0x30], rdx
movabs rdx, 0xb06000007010e09
mov qword [rsp + 0x19], rdx
movabs rdx, 0x8060204080a0408
mov qword [rsp + 0x21], rdx
xor eax, eax
jmp 0x4c5eaf
movzx r9d, byte [rsp + rsi + 0x29]
sub r9d, edx
lea edx, [r9 + 0x5c]
mov byte [rsp + rdi + 0x29], dl
lea edx, [r8 + 0x5c]
mov byte [rsp + rsi + 0x29], dl
add rax, 2
cmp rax, 0x10
jge 0x4c5edc
movzx edx, byte [rsp + rax + 0x19]
movzx esi, byte [rsp + rax + 0x1a]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0xf
jae 0x4c5eff
movzx r8d, byte [rsp + rdi + 0x29]
sub r8d, edx
cmp rsi, 0xf
jb 0x4c5e92
jmp 0x4c5ef3
xor eax, eax
lea rbx, [rsp + 0x29]
mov ecx, 0xf
call fcn.004415e0
add rsp, 0x38
pop rbp
ret
mov eax, esi
mov ecx, 0xf
call fcn.00451e00
mov eax, edi
mov ecx, 0xf
call fcn.00451e00
nop
call fcn.0044fb80
jmp fcn.004c5e40

Function at 0x4c6900
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4c69b8
push rbp
mov rbp, rsp
sub rsp, 0x30
movabs rdx, 0xf6619aaa45740bb8
mov qword [rsp + 0x28], rdx
movabs rdx, 0x407040100050003
mov qword [rsp + 0x1e], rdx
mov word [rsp + 0x26], 0x405
xor eax, eax
jmp 0x4c6958
movzx r9d, byte [rsp + rsi + 0x28]
sub r9d, edx
lea edx, [r9 - 0x40]
mov byte [rsp + rdi + 0x28], dl
lea edx, [r8 - 0x40]
mov byte [rsp + rsi + 0x28], dl
add rax, 2
cmp rax, 0xa
jge 0x4c6988
movzx edx, byte [rsp + rax + 0x1e]
movzx esi, byte [rsp + rax + 0x1f]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 8
jae 0x4c69ab
movzx r8d, byte [rsp + rdi + 0x28]
sub r8d, edx
nop dword [rax]
cmp rsi, 8
jb 0x4c693b
jmp 0x4c699f
xor eax, eax
lea rbx, [rsp + 0x28]
mov ecx, 8
call fcn.004415e0
add rsp, 0x30
pop rbp
ret
mov eax, esi
mov ecx, 8
call fcn.00451e00
mov eax, edi
mov ecx, 8
call fcn.00451e00
nop
call fcn.0044fb80
nop dword [rax]
jmp fcn.004c6900