joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4c0f80
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4c1032
push rbp
mov rbp, rsp
sub rsp, 0x28
movabs rdx, 0x67656e6672657144
mov qword [rsp + 0x20], rdx
movabs rdx, 0x50501070104
mov qword [rsp + 0x18], rdx
xor eax, eax
jmp 0x4c0fce
movzx r9d, byte [rsp + rsi + 0x20]
lea edx, [r9 + rdx]
lea edx, [rdx - 7]
mov byte [rsp + rdi + 0x20], dl
mov byte [rsp + rsi + 0x20], r8b
add rax, 2
cmp rax, 8
jge 0x4c1002
movzx edx, byte [rsp + rax + 0x18]
movzx esi, byte [rsp + rax + 0x19]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 8
jae 0x4c1025
movzx r8d, byte [rsp + rdi + 0x20]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 7]
cmp rsi, 8
jb 0x4c0fb4
nop
jmp 0x4c1019
xor eax, eax
lea rbx, [rsp + 0x20]
mov ecx, 8
call fcn.00443420
add rsp, 0x28
pop rbp
ret
mov eax, esi
mov ecx, 8
call fcn.00454ec0
mov eax, edi
mov ecx, 8
call fcn.00454ec0
nop
call fcn.00452c40
jmp fcn.004c0f80

Function at 0x4c2220
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4c22d8
push rbp
mov rbp, rsp
sub rsp, 0x30
movabs rdx, 0x6369616154666e45
mov qword [rsp + 0x1c], rdx
movabs rdx, 0x201040102050304
mov qword [rsp + 0x24], rdx
mov dword [rsp + 0x2c], 0x1040501
xor eax, eax
jmp 0x4c2279
movzx r9d, byte [rsp + rsi + 0x1c]
sub r9d, edx
lea edx, [r9 + 0xf]
mov byte [rsp + rdi + 0x1c], dl
lea edx, [r8 + 0xf]
mov byte [rsp + rsi + 0x1c], dl
add rax, 2
cmp rax, 0xc
jge 0x4c22a8
movzx edx, byte [rsp + rax + 0x24]
movzx esi, byte [rsp + rax + 0x25]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 8
jae 0x4c22cb
movzx r8d, byte [rsp + rdi + 0x1c]
sub r8d, edx
nop
cmp rsi, 8
jb 0x4c225c
jmp 0x4c22bf
xor eax, eax
lea rbx, [rsp + 0x1c]
mov ecx, 8
call fcn.00443420
add rsp, 0x30
pop rbp
ret
mov eax, esi
mov ecx, 8
call fcn.00454ec0
mov eax, edi
mov ecx, 8
call fcn.00454ec0
nop
call fcn.00452c40
nop dword [rax]
jmp fcn.004c2220

Function at 0x4c2760
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4c2818
push rbp
mov rbp, rsp
sub rsp, 0x30
movabs rdx, 0x3d0e6b7562334a51
mov qword [rsp + 0x1c], rdx
movabs rdx, 0x606000702030206
mov qword [rsp + 0x24], rdx
mov dword [rsp + 0x2c], 0x1060003
xor eax, eax
jmp 0x4c27b6
movzx r9d, byte [rsp + rsi + 0x1c]
lea edx, [r9 + rdx]
lea edx, [rdx + 0xd]
mov byte [rsp + rdi + 0x1c], dl
mov byte [rsp + rsi + 0x1c], r8b
add rax, 2
cmp rax, 0xc
jge 0x4c27e8
movzx edx, byte [rsp + rax + 0x24]
movzx esi, byte [rsp + rax + 0x25]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 8
jae 0x4c280b
movzx r8d, byte [rsp + rdi + 0x1c]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0xd]
cmp rsi, 8
jb 0x4c279c
jmp 0x4c27ff
xor eax, eax
lea rbx, [rsp + 0x1c]
mov ecx, 8
call fcn.00443420
add rsp, 0x30
pop rbp
ret
mov eax, esi
mov ecx, 8
call fcn.00454ec0
mov eax, edi
mov ecx, 8
call fcn.00454ec0
nop
call fcn.00452c40
nop dword [rax]
jmp fcn.004c2760
Function at 0x4c2840
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4c291d
push rbp
mov rbp, rsp
sub rsp, 0x40
movabs rdx, 0x525f38a8326e0dcd
mov qword [rsp + 0x1f], rdx
movabs rdx, 0x6137ae6e6933f852
mov qword [rsp + 0x26], rdx
movabs rdx, 0x90301010800080c
mov qword [rsp + 0x2e], rdx
movabs rdx, 0x400090301010800
mov qword [rsp + 0x30], rdx
movabs rdx, 0xd010c0508000008
mov qword [rsp + 0x38], rdx
xor eax, eax
nop
jmp 0x4c28c0
movzx r9d, byte [rsp + rsi + 0x1f]
sub r9d, edx
lea edx, [r9 + 0x46]
mov byte [rsp + rdi + 0x1f], dl
lea edx, [r8 + 0x46]
mov byte [rsp + rsi + 0x1f], dl
add rax, 2
nop
cmp rax, 0x12
jge 0x4c28ed
movzx edx, byte [rsp + rax + 0x2e]
movzx esi, byte [rsp + rax + 0x2f]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0xf
jae 0x4c2910
movzx r8d, byte [rsp + rdi + 0x1f]
sub r8d, edx
cmp rsi, 0xf
jb 0x4c28a2
jmp 0x4c2904
xor eax, eax
lea rbx, [rsp + 0x1f]
mov ecx, 0xf
call fcn.00443420
add rsp, 0x40
pop rbp
ret
mov eax, esi
mov ecx, 0xf
call fcn.00454ec0
mov eax, edi
mov ecx, 0xf
call fcn.00454ec0
nop
nop dword [rax]
call fcn.00452c40
jmp fcn.004c2840

Function at 0x4c3180
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4c3232
push rbp
mov rbp, rsp
sub rsp, 0x28
movabs rdx, 0x302d44063731304b
mov qword [rsp + 0x20], rdx
movabs rdx, 0x306040301070502
mov qword [rsp + 0x18], rdx
xor eax, eax
jmp 0x4c31ce
movzx r9d, byte [rsp + rsi + 0x20]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x29]
mov byte [rsp + rdi + 0x20], dl
mov byte [rsp + rsi + 0x20], r8b
add rax, 2
cmp rax, 8
jge 0x4c3202
movzx edx, byte [rsp + rax + 0x18]
movzx esi, byte [rsp + rax + 0x19]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 8
jae 0x4c3225
movzx r8d, byte [rsp + rdi + 0x20]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x29]
cmp rsi, 8
jb 0x4c31b4
nop
jmp 0x4c3219
xor eax, eax
lea rbx, [rsp + 0x20]
mov ecx, 8
call fcn.00443420
add rsp, 0x28
pop rbp
ret
mov eax, esi
mov ecx, 8
call fcn.00454ec0
mov eax, edi
mov ecx, 8
call fcn.00454ec0
nop
call fcn.00452c40
jmp fcn.004c3180

Function at 0x4c3480
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4c354c
push rbp
mov rbp, rsp
sub rsp, 0x30
movabs rdx, 0x1c68c289db6168a0
mov qword [rsp + 0x18], rdx
mov word [rsp + 0x20], 0xc82d
movabs rdx, 0x805030304000407
mov qword [rsp + 0x22], rdx
movabs rdx, 0x905070504050805
mov qword [rsp + 0x28], rdx
xor eax, eax
jmp 0x4c34e4
movzx r9d, byte [rsp + rsi + 0x18]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x6d]
mov byte [rsp + rdi + 0x18], dl
mov byte [rsp + rsi + 0x18], r8b
add rax, 2
cmp rax, 0xe
jge 0x4c351c
movzx edx, byte [rsp + rax + 0x22]
movzx esi, byte [rsp + rax + 0x23]
mov edi, edx
xor edx, esi
add edx, eax
nop word [rax + rax]
cmp rdi, 0xa
jae 0x4c353f
movzx r8d, byte [rsp + rdi + 0x18]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x6d]
cmp rsi, 0xa
jb 0x4c34ca
jmp 0x4c3533
xor eax, eax
lea rbx, [rsp + 0x18]
mov ecx, 0xa
call fcn.00443420
add rsp, 0x30
pop rbp
ret
mov eax, esi
mov ecx, 0xa
call fcn.00454ec0
mov eax, edi
mov ecx, 0xa
call fcn.00454ec0
nop
call fcn.00452c40
jmp fcn.004c3480
Function at 0x4c3620
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4c36e6
push rbp
mov rbp, rsp
sub rsp, 0x30
movabs rdx, 0x64b377c364312c45
mov qword [rsp + 0x1d], rdx
mov byte [rsp + 0x25], 0xbb
movabs rdx, 0x106010102060600
mov qword [rsp + 0x26], rdx
mov word [rsp + 0x2e], 0x804
xor eax, eax
nop
jmp 0x4c3680
movzx r9d, byte [rsp + rsi + 0x1d]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x6e]
mov byte [rsp + rdi + 0x1d], dl
mov byte [rsp + rsi + 0x1d], r8b
add rax, 2
nop dword [rax]
cmp rax, 0xa
jge 0x4c36b2
movzx edx, byte [rsp + rax + 0x26]
movzx esi, byte [rsp + rax + 0x27]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 9
jae 0x4c36d7
movzx r8d, byte [rsp + rdi + 0x1d]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x6e]
cmp rsi, 9
jb 0x4c3662
jmp 0x4c36cb
xor eax, eax
lea rbx, [rsp + 0x1d]
mov ecx, 9
nop
call fcn.00443420
add rsp, 0x30
pop rbp
ret
mov eax, esi
mov ecx, 9
call fcn.00454ec0
mov eax, edi
mov ecx, 9
nop
call fcn.00454ec0
nop
call fcn.00452c40
jmp fcn.004c3620

Function at 0x4c48a0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4c4978
push rbp
mov rbp, rsp
sub rsp, 0x38
movabs rdx, 0xac282673223a65ac
mov qword [rsp + 0x1a], rdx
mov dword [rsp + 0x22], 0x6b65b2b9
movabs rdx, 0x504070002060205
mov qword [rsp + 0x26], rdx
movabs rdx, 0x502050407000206
mov qword [rsp + 0x28], rdx
movabs rdx, 0x904040302080304
mov qword [rsp + 0x30], rdx
xor eax, eax
jmp 0x4c4914
movzx r9d, byte [rsp + rsi + 0x1a]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x6a]
mov byte [rsp + rdi + 0x1a], dl
mov byte [rsp + rsi + 0x1a], r8b
add rax, 2
cmp rax, 0x12
jge 0x4c4948
movzx edx, byte [rsp + rax + 0x26]
movzx esi, byte [rsp + rax + 0x27]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0xc
jae 0x4c496b
movzx r8d, byte [rsp + rdi + 0x1a]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x6a]
nop
cmp rsi, 0xc
jb 0x4c48fa
jmp 0x4c495f
xor eax, eax
lea rbx, [rsp + 0x1a]
mov ecx, 0xc
call fcn.00443420
add rsp, 0x38
pop rbp
ret
mov eax, esi
mov ecx, 0xc
call fcn.00454ec0
mov eax, edi
mov ecx, 0xc
call fcn.00454ec0
nop
call fcn.00452c40
nop dword [rax]
jmp fcn.004c48a0

Function at 0x4c5500
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4c55cc
push rbp
mov rbp, rsp
sub rsp, 0x38
movabs rdx, 0x4969d4fc6d64574e
mov qword [rsp + 0x1f], rdx
movabs rdx, 0x65755a4969d4fc6d
mov qword [rsp + 0x22], rdx
movabs rdx, 0x308020801010705
mov qword [rsp + 0x2a], rdx
movabs rdx, 0x204010108050308
mov qword [rsp + 0x30], rdx
xor eax, eax
jmp 0x4c556f
movzx r9d, byte [rsp + rsi + 0x1f]
sub r9d, edx
lea edx, [r9 - 0x73]
mov byte [rsp + rdi + 0x1f], dl
lea edx, [r8 - 0x73]
mov byte [rsp + rsi + 0x1f], dl
add rax, 2
cmp rax, 0xe
jge 0x4c559c
movzx edx, byte [rsp + rax + 0x2a]
movzx esi, byte [rsp + rax + 0x2b]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0xb
jae 0x4c55bf
movzx r8d, byte [rsp + rdi + 0x1f]
sub r8d, edx
cmp rsi, 0xb
jb 0x4c5552
jmp 0x4c55b3
xor eax, eax
lea rbx, [rsp + 0x1f]
mov ecx, 0xb
call fcn.00443420
add rsp, 0x38
pop rbp
ret
mov eax, esi
mov ecx, 0xb
call fcn.00454ec0
mov eax, edi
mov ecx, 0xb
call fcn.00454ec0
nop
call fcn.00452c40
jmp fcn.004c5500
Function at 0x4c7d60
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4c7e27
push rbp
mov rbp, rsp
sub rsp, 0x30
movabs rdx, 0xc1c0b0d52775611b
mov qword [rsp + 0x18], rdx
mov word [rsp + 0x20], 0x6159
movabs rdx, 0x405060408040007
mov qword [rsp + 0x22], rdx
movabs rdx, 0x6080304040405
mov qword [rsp + 0x28], rdx
xor eax, eax
jmp 0x4c7dc7
movzx r9d, byte [rsp + rsi + 0x18]
sub r9d, edx
lea edx, [r9 + 0x60]
mov byte [rsp + rdi + 0x18], dl
lea edx, [r8 + 0x60]
mov byte [rsp + rsi + 0x18], dl
add rax, 2
cmp rax, 0xe
jge 0x4c7df7
movzx edx, byte [rsp + rax + 0x22]
movzx esi, byte [rsp + rax + 0x23]
mov edi, edx
xor edx, esi
add edx, eax
nop dword [rax]
cmp rdi, 0xa
jae 0x4c7e1a
movzx r8d, byte [rsp + rdi + 0x18]
sub r8d, edx
cmp rsi, 0xa
jb 0x4c7daa
jmp 0x4c7e0e
xor eax, eax
lea rbx, [rsp + 0x18]
mov ecx, 0xa
call fcn.00443420
add rsp, 0x30
pop rbp
ret
mov eax, esi
mov ecx, 0xa
call fcn.00454ec0
mov eax, edi
mov ecx, 0xa
call fcn.00454ec0
nop
call fcn.00452c40
jmp fcn.004c7d60

Function at 0x4c8280
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4c8347
push rbp
mov rbp, rsp
sub rsp, 0x38
movabs rdx, 0xadf6b521d06c4353
mov qword [rsp + 0x1c], rdx
mov dword [rsp + 0x24], 0x692a6740
movabs rdx, 0x803010a04030605
mov qword [rsp + 0x28], rdx
movabs rdx, 0x30a0707010a0105
mov qword [rsp + 0x30], rdx
xor eax, eax
jmp 0x4c82e8
movzx r9d, byte [rsp + rsi + 0x1c]
sub r9d, edx
lea edx, [r9 - 0x53]
mov byte [rsp + rdi + 0x1c], dl
lea edx, [r8 - 0x53]
mov byte [rsp + rsi + 0x1c], dl
add rax, 2
cmp rax, 0x10
jge 0x4c8317
movzx edx, byte [rsp + rax + 0x28]
movzx esi, byte [rsp + rax + 0x29]
mov edi, edx
xor edx, esi
add edx, eax
nop
cmp rdi, 0xc
jae 0x4c833a
movzx r8d, byte [rsp + rdi + 0x1c]
sub r8d, edx
cmp rsi, 0xc
jb 0x4c82cb
jmp 0x4c832e
xor eax, eax
lea rbx, [rsp + 0x1c]
mov ecx, 0xc
call fcn.00443420
add rsp, 0x38
pop rbp
ret
mov eax, esi
mov ecx, 0xc
call fcn.00454ec0
mov eax, edi
mov ecx, 0xc
call fcn.00454ec0
nop
call fcn.00452c40
jmp fcn.004c8280
Function at 0x4c8ce0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4c8dc6
push rbp
mov rbp, rsp
sub rsp, 0x40
movabs rdx, 0x23352b62611c733c
mov qword [rsp + 0x18], rdx
movabs rdx, 0x65c42b7871160bbd
mov qword [rsp + 0x20], rdx
movabs rdx, 0x206080a06000705
mov qword [rsp + 0x28], rdx
movabs rdx, 0x5090c000d0e010d
mov qword [rsp + 0x30], rdx
movabs rdx, 0x80701060e050005
mov qword [rsp + 0x38], rdx
xor eax, eax
nop
jmp 0x4c8d60
movzx r9d, byte [rsp + rsi + 0x18]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x70]
mov byte [rsp + rdi + 0x18], dl
mov byte [rsp + rsi + 0x18], r8b
add rax, 2
nop dword [rax]
cmp rax, 0x18
jge 0x4c8d92
movzx edx, byte [rsp + rax + 0x28]
movzx esi, byte [rsp + rax + 0x29]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x10
jae 0x4c8db7
movzx r8d, byte [rsp + rdi + 0x18]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x70]
cmp rsi, 0x10
jb 0x4c8d42
jmp 0x4c8dab
xor eax, eax
lea rbx, [rsp + 0x18]
mov ecx, 0x10
nop
call fcn.00443420
add rsp, 0x40
pop rbp
ret
mov eax, esi
mov ecx, 0x10
call fcn.00454ec0
mov eax, edi
mov ecx, 0x10
nop
call fcn.00454ec0
nop
call fcn.00452c40
jmp fcn.004c8ce0

Function at 0x4c9400
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4c94b8
push rbp
mov rbp, rsp
sub rsp, 0x30
movabs rdx, 0x8a5e00f66574a845
mov qword [rsp + 0x1c], rdx
movabs rdx, 0x501040504060707
mov qword [rsp + 0x24], rdx
mov dword [rsp + 0x2c], 0x5070501
xor eax, eax
jmp 0x4c9459
movzx r9d, byte [rsp + rsi + 0x1c]
sub r9d, edx
lea edx, [r9 + 0x73]
mov byte [rsp + rdi + 0x1c], dl
lea edx, [r8 + 0x73]
mov byte [rsp + rsi + 0x1c], dl
add rax, 2
cmp rax, 0xc
jge 0x4c9488
movzx edx, byte [rsp + rax + 0x24]
movzx esi, byte [rsp + rax + 0x25]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 8
jae 0x4c94ab
movzx r8d, byte [rsp + rdi + 0x1c]
sub r8d, edx
nop
cmp rsi, 8
jb 0x4c943c
jmp 0x4c949f
xor eax, eax
lea rbx, [rsp + 0x1c]
mov ecx, 8
call fcn.00443420
add rsp, 0x30
pop rbp
ret
mov eax, esi
mov ecx, 8
call fcn.00454ec0
mov eax, edi
mov ecx, 8
call fcn.00454ec0
nop
call fcn.00452c40
nop dword [rax]
jmp fcn.004c9400
Function at 0x4da6e0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4da7db
push rbp
mov rbp, rsp
sub rsp, 0x50
movabs rdx, 0xca58bc1263aa72b4
mov qword [rsp + 0x1c], rdx
movabs rdx, 0x6361740507646526
mov qword [rsp + 0x24], rdx
movabs rdx, 0x74659c4ca960bfad
mov qword [rsp + 0x2c], rdx
movabs rdx, 0x508050611041405
mov qword [rsp + 0x34], rdx
movabs rdx, 0x120b06060b0c0507
mov qword [rsp + 0x3c], rdx
movabs rdx, 0x2130615120b0606
mov qword [rsp + 0x40], rdx
movabs rdx, 0xc00110610081115
mov qword [rsp + 0x48], rdx
xor eax, eax
jmp 0x4da779
movzx r9d, byte [rsp + rsi + 0x1c]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x67]
mov byte [rsp + rdi + 0x1c], dl
mov byte [rsp + rsi + 0x1c], r8b
add rax, 2
cmp rax, 0x1c
jge 0x4da7ab
movzx edx, byte [rsp + rax + 0x34]
movzx esi, byte [rsp + rax + 0x35]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x18
jae 0x4da7ce
movzx r8d, byte [rsp + rdi + 0x1c]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x67]
cmp rsi, 0x18
jb 0x4da75f
jmp 0x4da7c2
xor eax, eax
lea rbx, [rsp + 0x1c]
mov ecx, 0x18
call fcn.00443420
add rsp, 0x50
pop rbp
ret
mov eax, esi
mov ecx, 0x18
call fcn.00454ec0
mov eax, edi
mov ecx, 0x18
call fcn.00454ec0
nop
nop dword [rax + rax]
call fcn.00452c40
jmp fcn.004da6e0

Function at 0x4db720
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4db82c
push rbp
mov rbp, rsp
sub rsp, 0x58
movabs rdx, 0x1246176fa8bd1f2b
mov qword [rsp + 0x1a], rdx
movabs rdx, 0xc4e4d7738c652061
mov qword [rsp + 0x22], rdx
movabs rdx, 0x6eb7ac5065b1c4e4
mov qword [rsp + 0x28], rdx
movabs rdx, 0x746528dc6623b865
mov qword [rsp + 0x30], rdx
movabs rdx, 0x3021b09120f1a1b
mov qword [rsp + 0x38], rdx
movabs rdx, 0x517130d02001315
mov qword [rsp + 0x40], rdx
movabs rdx, 0x50b1410180701
mov qword [rsp + 0x48], rdx
movabs rdx, 0x15030f1405140e18
mov qword [rsp + 0x50], rdx
xor eax, eax
jmp 0x4db7c8
movzx r9d, byte [rsp + rsi + 0x1a]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x3d]
mov byte [rsp + rdi + 0x1a], dl
mov byte [rsp + rsi + 0x1a], r8b
add rax, 2
cmp rax, 0x20
jge 0x4db7fc
movzx edx, byte [rsp + rax + 0x38]
movzx esi, byte [rsp + rax + 0x39]
mov edi, edx
xor edx, esi
add edx, eax
nop
cmp rdi, 0x1e
jae 0x4db81f
movzx r8d, byte [rsp + rdi + 0x1a]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x3d]
cmp rsi, 0x1e
jb 0x4db7ae
jmp 0x4db813
xor eax, eax
lea rbx, [rsp + 0x1a]
mov ecx, 0x1e
call fcn.00443420
add rsp, 0x58
pop rbp
ret
mov eax, esi
mov ecx, 0x1e
call fcn.00454ec0
mov eax, edi
mov ecx, 0x1e
call fcn.00454ec0
nop
call fcn.00452c40
jmp fcn.004db720
Function at 0x4db980
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4dba7b
push rbp
mov rbp, rsp
sub rsp, 0x50
movabs rdx, 0x60736d7558685d21
mov qword [rsp + 0x1f], rdx
movabs rdx, 0x86e5c5c5660736d
mov qword [rsp + 0x24], rdx
movabs rdx, 0x5c6f5b606440204b
mov qword [rsp + 0x2c], rdx
movabs rdx, 0x50d0f0508100b0b
mov qword [rsp + 0x34], rdx
movabs rdx, 0xd0010140003110b
mov qword [rsp + 0x3c], rdx
movabs rdx, 0x607020a0d001014
mov qword [rsp + 0x40], rdx
movabs rdx, 0xc010910120905
mov qword [rsp + 0x48], rdx
xor eax, eax
jmp 0x4dba19
movzx r9d, byte [rsp + rsi + 0x1f]
lea edx, [r9 + rdx]
lea edx, [rdx - 0xe]
mov byte [rsp + rdi + 0x1f], dl
mov byte [rsp + rsi + 0x1f], r8b
add rax, 2
cmp rax, 0x1c
jge 0x4dba4b
movzx edx, byte [rsp + rax + 0x34]
movzx esi, byte [rsp + rax + 0x35]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x15
jae 0x4dba6e
movzx r8d, byte [rsp + rdi + 0x1f]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0xe]
cmp rsi, 0x15
jb 0x4db9ff
jmp 0x4dba62
xor eax, eax
lea rbx, [rsp + 0x1f]
mov ecx, 0x15
call fcn.00443420
add rsp, 0x50
pop rbp
ret
mov eax, esi
mov ecx, 0x15
call fcn.00454ec0
mov eax, edi
mov ecx, 0x15
call fcn.00454ec0
nop
nop dword [rax + rax]
call fcn.00452c40
jmp fcn.004db980
Function at 0x4dc740
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4dc806
push rbp
mov rbp, rsp
sub rsp, 0x30
movabs rdx, 0xb31ae4656c06c71c
mov qword [rsp + 0x1d], rdx
mov byte [rsp + 0x25], 0x20
movabs rdx, 0x705060001010101
mov qword [rsp + 0x26], rdx
mov word [rsp + 0x2e], 0x205
xor eax, eax
nop
jmp 0x4dc7a0
movzx r9d, byte [rsp + rsi + 0x1d]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x4e]
mov byte [rsp + rdi + 0x1d], dl
mov byte [rsp + rsi + 0x1d], r8b
add rax, 2
nop dword [rax]
cmp rax, 0xa
jge 0x4dc7d2
movzx edx, byte [rsp + rax + 0x26]
movzx esi, byte [rsp + rax + 0x27]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 9
jae 0x4dc7f7
movzx r8d, byte [rsp + rdi + 0x1d]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x4e]
cmp rsi, 9
jb 0x4dc782
jmp 0x4dc7eb
xor eax, eax
lea rbx, [rsp + 0x1d]
mov ecx, 9
nop
call fcn.00443420
add rsp, 0x30
pop rbp
ret
mov eax, esi
mov ecx, 9
call fcn.00454ec0
mov eax, edi
mov ecx, 9
nop
call fcn.00454ec0
nop
call fcn.00452c40
jmp fcn.004dc740

Function at 0x4dc820
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4dc8fd
push rbp
mov rbp, rsp
sub rsp, 0x38
movabs rdx, 0x2e743144f4664a51
mov qword [rsp + 0x18], rdx
movabs rdx, 0x3426253130562e74
mov qword [rsp + 0x1e], rdx
movabs rdx, 0xa0305040c0b09
mov qword [rsp + 0x26], rdx
movabs rdx, 0x3000a0305040c
mov qword [rsp + 0x28], rdx
movabs rdx, 0x40b050401090d05
mov qword [rsp + 0x30], rdx
xor eax, eax
nop
jmp 0x4dc8a0
movzx r9d, byte [rsp + rsi + 0x18]
sub r9d, edx
lea edx, [r9 + 0x2b]
mov byte [rsp + rdi + 0x18], dl
lea edx, [r8 + 0x2b]
mov byte [rsp + rsi + 0x18], dl
add rax, 2
nop
cmp rax, 0x12
jge 0x4dc8cd
movzx edx, byte [rsp + rax + 0x26]
movzx esi, byte [rsp + rax + 0x27]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0xe
jae 0x4dc8f0
movzx r8d, byte [rsp + rdi + 0x18]
sub r8d, edx
cmp rsi, 0xe
jb 0x4dc882
jmp 0x4dc8e4
xor eax, eax
lea rbx, [rsp + 0x18]
mov ecx, 0xe
call fcn.00443420
add rsp, 0x38
pop rbp
ret
mov eax, esi
mov ecx, 0xe
call fcn.00454ec0
mov eax, edi
mov ecx, 0xe
call fcn.00454ec0
nop
nop dword [rax]
call fcn.00452c40
jmp fcn.004dc820
Function at 0x4dcae0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4dcbcc
push rbp
mov rbp, rsp
sub rsp, 0x40
movabs rdx, 0x4f3d635b6cf55bf8
mov qword [rsp + 0x1b], rdx
movabs rdx, 0x204f3d635b6cf55b
mov qword [rsp + 0x1c], rdx
movabs rdx, 0x400b4856606c5a63
mov qword [rsp + 0x24], rdx
movabs rdx, 0xe0604010c0f0007
mov qword [rsp + 0x2c], rdx
movabs rdx, 0x60c07100e060401
mov qword [rsp + 0x30], rdx
movabs rdx, 0x7060a0e000d0002
mov qword [rsp + 0x38], rdx
xor eax, eax
jmp 0x4dcb6a
movzx r9d, byte [rsp + rsi + 0x1b]
lea edx, [r9 + rdx]
lea edx, [rdx + 1]
mov byte [rsp + rdi + 0x1b], dl
mov byte [rsp + rsi + 0x1b], r8b
add rax, 2
cmp rax, 0x14
jge 0x4dcb9c
movzx edx, byte [rsp + rax + 0x2c]
movzx esi, byte [rsp + rax + 0x2d]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x11
jae 0x4dcbbf
movzx r8d, byte [rsp + rdi + 0x1b]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 1]
cmp rsi, 0x11
jb 0x4dcb50
jmp 0x4dcbb3
xor eax, eax
lea rbx, [rsp + 0x1b]
mov ecx, 0x11
call fcn.00443420
add rsp, 0x40
pop rbp
ret
mov eax, esi
mov ecx, 0x11
call fcn.00454ec0
mov eax, edi
mov ecx, 0x11
call fcn.00454ec0
nop
call fcn.00452c40
jmp fcn.004dcae0

Function at 0x4dcec0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4dcf7d
push rbp
mov rbp, rsp
sub rsp, 0x30
movabs rdx, 0x6964b963f4e661e4
mov qword [rsp + 0x1d], rdx
mov byte [rsp + 0x25], 0xf3
movabs rdx, 0x200000204030805
mov qword [rsp + 0x26], rdx
mov word [rsp + 0x2e], 0x504
xor eax, eax
nop
jmp 0x4dcf20
movzx r9d, byte [rsp + rsi + 0x1d]
sub r9d, edx
lea edx, [r9 - 0x3a]
mov byte [rsp + rdi + 0x1d], dl
lea edx, [r8 - 0x3a]
mov byte [rsp + rsi + 0x1d], dl
add rax, 2
nop
cmp rax, 0xa
jge 0x4dcf4d
movzx edx, byte [rsp + rax + 0x26]
movzx esi, byte [rsp + rax + 0x27]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 9
jae 0x4dcf70
movzx r8d, byte [rsp + rdi + 0x1d]
sub r8d, edx
cmp rsi, 9
jb 0x4dcf02
jmp 0x4dcf64
xor eax, eax
lea rbx, [rsp + 0x1d]
mov ecx, 9
call fcn.00443420
add rsp, 0x30
pop rbp
ret
mov eax, esi
mov ecx, 9
call fcn.00454ec0
mov eax, edi
mov ecx, 9
call fcn.00454ec0
nop
nop dword [rax]
call fcn.00452c40
jmp fcn.004dcec0
Function at 0x4ddda0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
lea r12, [rsp - 0x10]
cmp r12, qword [r14 + 0x10]
jbe 0x4ddf12
push rbp
mov rbp, rsp
sub rsp, 0x88
movabs rdx, 0xee746341e0669272
mov qword [rsp + 0x19], rdx
movabs rdx, 0x6e5ffbbaf2690aee
mov qword [rsp + 0x20], rdx
movabs rdx, 0x726f7272aa2c76cd
mov qword [rsp + 0x28], rdx
movabs rdx, 0xa56c22ee6e3020eb
mov qword [rsp + 0x30], rdx
movabs rdx, 0x6619200bc10185ba
mov qword [rsp + 0x38], rdx
movabs rdx, 0x74fb5f3fc4f50020
mov qword [rsp + 0x40], rdx
movabs rdx, 0x11756c1324006fbd
mov qword [rsp + 0x48], rdx
movabs rdx, 0x8040f0b2b22360a
mov qword [rsp + 0x50], rdx
movabs rdx, 0x8200319072f3307
mov qword [rsp + 0x58], rdx
movabs rdx, 0x41004280d212f12
mov qword [rsp + 0x60], rdx
movabs rdx, 0xa1b2d0417032123
mov qword [rsp + 0x68], rdx
movabs rdx, 0x22291e250c102a2c
mov qword [rsp + 0x70], rdx
movabs rdx, 0x202125312f2a2f01
mov qword [rsp + 0x78], rdx
movabs rdx, 0x21111b32081f281c
mov qword [rsp + 0x80], rdx
xor eax, eax
jmp 0x4ddeb0
movzx r9d, byte [rsp + rsi + 0x19]
sub r9d, edx
lea edx, [r9 - 0x51]
mov byte [rsp + rdi + 0x19], dl
lea edx, [r8 - 0x51]
mov byte [rsp + rsi + 0x19], dl
add rax, 2
cmp rax, 0x38
jge 0x4ddedd
movzx edx, byte [rsp + rax + 0x50]
movzx esi, byte [rsp + rax + 0x51]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x37
jae 0x4ddf05
movzx r8d, byte [rsp + rdi + 0x19]
sub r8d, edx
cmp rsi, 0x37
jb 0x4dde93
jmp 0x4ddef7
xor eax, eax
lea rbx, [rsp + 0x19]
mov ecx, 0x37
call fcn.00443420
add rsp, 0x88
pop rbp
ret
mov eax, esi
mov ecx, 0x37
nop
call fcn.00454ec0
mov eax, edi
mov ecx, 0x37
call fcn.00454ec0
nop
call fcn.00452c40
jmp fcn.004ddda0