joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4d63a0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4d647d
push rbp
mov rbp, rsp
sub rsp, 0x38
movabs rdx, 0x966c03751b729756
mov qword [rsp + 0x19], rdx
movabs rdx, 0x3363f58799966c03
mov qword [rsp + 0x1e], rdx
movabs rdx, 0x3070809050a0301
mov qword [rsp + 0x26], rdx
movabs rdx, 0x70c03070809050a
mov qword [rsp + 0x28], rdx
movabs rdx, 0x309080c070c0801
mov qword [rsp + 0x30], rdx
xor eax, eax
nop
jmp 0x4d6420
movzx r9d, byte [rsp + rsi + 0x19]
sub r9d, edx
lea edx, [r9 + 0x7d]
mov byte [rsp + rdi + 0x19], dl
lea edx, [r8 + 0x7d]
mov byte [rsp + rsi + 0x19], dl
add rax, 2
nop
cmp rax, 0x12
jge 0x4d644d
movzx edx, byte [rsp + rax + 0x26]
movzx esi, byte [rsp + rax + 0x27]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0xd
jae 0x4d6470
movzx r8d, byte [rsp + rdi + 0x19]
sub r8d, edx
cmp rsi, 0xd
jb 0x4d6402
jmp 0x4d6464
xor eax, eax
lea rbx, [rsp + 0x19]
mov ecx, 0xd
call fcn.0044bb20
add rsp, 0x38
pop rbp
ret
mov eax, esi
mov ecx, 0xd
call fcn.00461020
mov eax, edi
mov ecx, 0xd
call fcn.00461020
nop
nop dword [rax]
call fcn.0045eda0
jmp fcn.004d63a0

Function at 0x4da0a0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4da158
push rbp
mov rbp, rsp
sub rsp, 0x30
movabs rdx, 0x6e776f5c7465706b
mov qword [rsp + 0x1c], rdx
movabs rdx, 0x201000003050104
mov qword [rsp + 0x24], rdx
mov dword [rsp + 0x2c], 0x3050204
xor eax, eax
jmp 0x4da0f9
movzx r9d, byte [rsp + rsi + 0x1c]
sub r9d, edx
lea edx, [r9 + 0xc]
mov byte [rsp + rdi + 0x1c], dl
lea edx, [r8 + 0xc]
mov byte [rsp + rsi + 0x1c], dl
add rax, 2
cmp rax, 0xc
jge 0x4da128
movzx edx, byte [rsp + rax + 0x24]
movzx esi, byte [rsp + rax + 0x25]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 8
jae 0x4da14b
movzx r8d, byte [rsp + rdi + 0x1c]
sub r8d, edx
nop
cmp rsi, 8
jb 0x4da0dc
jmp 0x4da13f
xor eax, eax
lea rbx, [rsp + 0x1c]
mov ecx, 8
call fcn.0044bb20
add rsp, 0x30
pop rbp
ret
mov eax, esi
mov ecx, 8
call fcn.00461020
mov eax, edi
mov ecx, 8
call fcn.00461020
nop
call fcn.0045eda0
nop dword [rax]
jmp fcn.004da0a0

Function at 0x4dbf40
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4dc00c
push rbp
mov rbp, rsp
sub rsp, 0x38
movabs rdx, 0x74e3b1656cceccb5
mov qword [rsp + 0x19], rdx
movabs rdx, 0x5e051b116c17c974
mov qword [rsp + 0x20], rdx
movabs rdx, 0xe010608050e0600
mov qword [rsp + 0x28], rdx
movabs rdx, 0xc0b09020d0d0b05
mov qword [rsp + 0x30], rdx
xor eax, eax
jmp 0x4dbfaf
movzx r9d, byte [rsp + rsi + 0x19]
sub r9d, edx
lea edx, [r9 + 0x69]
mov byte [rsp + rdi + 0x19], dl
lea edx, [r8 + 0x69]
mov byte [rsp + rsi + 0x19], dl
add rax, 2
cmp rax, 0x10
jge 0x4dbfdc
movzx edx, byte [rsp + rax + 0x28]
movzx esi, byte [rsp + rax + 0x29]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0xf
jae 0x4dbfff
movzx r8d, byte [rsp + rdi + 0x19]
sub r8d, edx
cmp rsi, 0xf
jb 0x4dbf92
jmp 0x4dbff3
xor eax, eax
lea rbx, [rsp + 0x19]
mov ecx, 0xf
call fcn.0044bb20
add rsp, 0x38
pop rbp
ret
mov eax, esi
mov ecx, 0xf
call fcn.00461020
mov eax, edi
mov ecx, 0xf
call fcn.00461020
nop
call fcn.0045eda0
jmp fcn.004dbf40
Function at 0x4e62e0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4e63e8
push rbp
mov rbp, rsp
sub rsp, 0x58
movabs rdx, 0x110e65340b22de75
mov qword [rsp + 0x1f], rdx
movabs rdx, 0x3c20a512948a3212
mov qword [rsp + 0x27], rdx
movabs rdx, 0x613c20a512948a32
mov qword [rsp + 0x28], rdx
movabs rdx, 0x263411dee120756c
mov qword [rsp + 0x30], rdx
movabs rdx, 0x130b01030f180b0f
mov qword [rsp + 0x38], rdx
movabs rdx, 0x20618020d17150a
mov qword [rsp + 0x40], rdx
movabs rdx, 0x6071415080c1613
mov qword [rsp + 0x48], rdx
movabs rdx, 0x904031604170715
mov qword [rsp + 0x50], rdx
xor eax, eax
jmp 0x4e638b
movzx r9d, byte [rsp + rsi + 0x1f]
sub r9d, edx
lea edx, [r9 + 0x69]
mov byte [rsp + rdi + 0x1f], dl
lea edx, [r8 + 0x69]
mov byte [rsp + rsi + 0x1f], dl
add rax, 2
cmp rax, 0x20
jge 0x4e63b8
movzx edx, byte [rsp + rax + 0x38]
movzx esi, byte [rsp + rax + 0x39]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x19
jae 0x4e63db
movzx r8d, byte [rsp + rdi + 0x1f]
sub r8d, edx
cmp rsi, 0x19
jb 0x4e636e
jmp 0x4e63cf
xor eax, eax
lea rbx, [rsp + 0x1f]
mov ecx, 0x19
call fcn.0044bb20
add rsp, 0x58
pop rbp
ret
mov eax, esi
mov ecx, 0x19
call fcn.00461020
mov eax, edi
mov ecx, 0x19
call fcn.00461020
nop
call fcn.0045eda0
jmp fcn.004e62e0

Function at 0x4e6400
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4e64d2
push rbp
mov rbp, rsp
sub rsp, 0x38
movabs rdx, 0xf38b6cdf447afd52
mov qword [rsp + 0x1d], rdx
movabs rdx, 0x8f79020df6f38b6c
mov qword [rsp + 0x22], rdx
movabs rdx, 0x40108060409060c
mov qword [rsp + 0x2a], rdx
movabs rdx, 0x10c020c0a070401
mov qword [rsp + 0x30], rdx
xor eax, eax
jmp 0x4e646c
movzx r9d, byte [rsp + rsi + 0x1d]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x5d]
mov byte [rsp + rdi + 0x1d], dl
mov byte [rsp + rsi + 0x1d], r8b
add rax, 2
cmp rax, 0xe
jge 0x4e649e
movzx edx, byte [rsp + rax + 0x2a]
movzx esi, byte [rsp + rax + 0x2b]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0xd
jae 0x4e64c5
movzx r8d, byte [rsp + rdi + 0x1d]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x5d]
cmp rsi, 0xd
jb 0x4e6452
jmp 0x4e64b5
xor eax, eax
lea rbx, [rsp + 0x1d]
mov ecx, 0xd
call fcn.0044bb20
add rsp, 0x38
pop rbp
ret
mov eax, esi
mov ecx, 0xd
nop dword [rax]
call fcn.00461020
mov eax, edi
mov ecx, 0xd
call fcn.00461020
nop
call fcn.0045eda0
jmp fcn.004e6400
Function at 0x4e66a0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4e6786
push rbp
mov rbp, rsp
sub rsp, 0x38
movabs rdx, 0xcd5c336e5ed35ee8
mov qword [rsp + 0x19], rdx
movabs rdx, 0x4e57ce6c61cd5c33
mov qword [rsp + 0x1e], rdx
movabs rdx, 0x30c0200050c060b
mov qword [rsp + 0x26], rdx
movabs rdx, 0x601030c0200050c
mov qword [rsp + 0x28], rdx
movabs rdx, 0x7070606050b0a0c
mov qword [rsp + 0x30], rdx
xor eax, eax
nop
jmp 0x4e6720
movzx r9d, byte [rsp + rsi + 0x19]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x79]
mov byte [rsp + rdi + 0x19], dl
mov byte [rsp + rsi + 0x19], r8b
add rax, 2
nop dword [rax]
cmp rax, 0x12
jge 0x4e6752
movzx edx, byte [rsp + rax + 0x26]
movzx esi, byte [rsp + rax + 0x27]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0xd
jae 0x4e6777
movzx r8d, byte [rsp + rdi + 0x19]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x79]
cmp rsi, 0xd
jb 0x4e6702
jmp 0x4e676b
xor eax, eax
lea rbx, [rsp + 0x19]
mov ecx, 0xd
nop
call fcn.0044bb20
add rsp, 0x38
pop rbp
ret
mov eax, esi
mov ecx, 0xd
call fcn.00461020
mov eax, edi
mov ecx, 0xd
nop
call fcn.00461020
nop
call fcn.0045eda0
jmp fcn.004e66a0

Function at 0x4e67a0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4e688c
push rbp
mov rbp, rsp
sub rsp, 0x48
movabs rdx, 0xe464615f4c13651e
mov qword [rsp + 0x1f], rdx
movabs rdx, 0xb3e464615f4c1365
mov qword [rsp + 0x20], rdx
movabs rdx, 0x75676e11c4bbc3bf
mov qword [rsp + 0x28], rdx
movabs rdx, 0x70b0b090c04070c
mov qword [rsp + 0x30], rdx
movabs rdx, 0xa080d02100a0a08
mov qword [rsp + 0x38], rdx
movabs rdx, 0x8090c080009000b
mov qword [rsp + 0x40], rdx
xor eax, eax
jmp 0x4e682a
movzx r9d, byte [rsp + rsi + 0x1f]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x3b]
mov byte [rsp + rdi + 0x1f], dl
mov byte [rsp + rsi + 0x1f], r8b
add rax, 2
cmp rax, 0x18
jge 0x4e685c
movzx edx, byte [rsp + rax + 0x30]
movzx esi, byte [rsp + rax + 0x31]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x11
jae 0x4e687f
movzx r8d, byte [rsp + rdi + 0x1f]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x3b]
cmp rsi, 0x11
jb 0x4e6810
jmp 0x4e6873
xor eax, eax
lea rbx, [rsp + 0x1f]
mov ecx, 0x11
call fcn.0044bb20
add rsp, 0x48
pop rbp
ret
mov eax, esi
mov ecx, 0x11
call fcn.00461020
mov eax, edi
mov ecx, 0x11
call fcn.00461020
nop
call fcn.0045eda0
jmp fcn.004e67a0
Function at 0x4e7500
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4e75b8
push rbp
mov rbp, rsp
sub rsp, 0x30
movabs rdx, 0x255d644b5875385c
mov qword [rsp + 0x1e], rdx
movabs rdx, 0x406070706030301
mov qword [rsp + 0x26], rdx
mov word [rsp + 0x2e], 7
xor eax, eax
jmp 0x4e7555
movzx r9d, byte [rsp + rsi + 0x1e]
lea edx, [r9 + rdx]
lea edx, [rdx + 0xe]
mov byte [rsp + rdi + 0x1e], dl
mov byte [rsp + rsi + 0x1e], r8b
add rax, 2
cmp rax, 0xa
jge 0x4e7588
movzx edx, byte [rsp + rax + 0x26]
movzx esi, byte [rsp + rax + 0x27]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 8
jae 0x4e75ab
movzx r8d, byte [rsp + rdi + 0x1e]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0xe]
nop
cmp rsi, 8
jb 0x4e753b
jmp 0x4e759f
xor eax, eax
lea rbx, [rsp + 0x1e]
mov ecx, 8
call fcn.0044bb20
add rsp, 0x30
pop rbp
ret
mov eax, esi
mov ecx, 8
call fcn.00461020
mov eax, edi
mov ecx, 8
call fcn.00461020
nop
call fcn.0045eda0
nop dword [rax]
jmp fcn.004e7500

Function at 0x4e8f80
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4e906c
push rbp
mov rbp, rsp
sub rsp, 0x48
movabs rdx, 0x930d6f5435c961b3
mov qword [rsp + 0x32], rdx
movabs rdx, 0x64bdc6d03ec7930d
mov qword [rsp + 0x38], rdx
movabs rdx, 0x396d7ece20641be2
mov qword [rsp + 0x40], rdx
movabs rdx, 0x307130815020f00
mov qword [rsp + 0x1c], rdx
movabs rdx, 0xe0f0f0906120307
mov qword [rsp + 0x22], rdx
movabs rdx, 0xa021200070b090c
mov qword [rsp + 0x2a], rdx
xor eax, eax
jmp 0x4e900a
movzx r9d, byte [rsp + rsi + 0x32]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x7d]
mov byte [rsp + rdi + 0x32], dl
mov byte [rsp + rsi + 0x32], r8b
add rax, 2
cmp rax, 0x16
jge 0x4e903c
movzx edx, byte [rsp + rax + 0x1c]
movzx esi, byte [rsp + rax + 0x1d]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x16
jae 0x4e905f
movzx r8d, byte [rsp + rdi + 0x32]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x7d]
cmp rsi, 0x16
jb 0x4e8ff0
jmp 0x4e9053
xor eax, eax
lea rbx, [rsp + 0x32]
mov ecx, 0x16
call fcn.0044bb20
add rsp, 0x48
pop rbp
ret
mov eax, esi
mov ecx, 0x16
call fcn.00461020
mov eax, edi
mov ecx, 0x16
call fcn.00461020
nop
call fcn.0045eda0
jmp fcn.004e8f80
Function at 0x4e9080
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4e916a
push rbp
mov rbp, rsp
sub rsp, 0x48
movabs rdx, 0x15320b85405b8f6
mov qword [rsp + 0x1f], rdx
movabs rdx, 0xb1969c015320b854
mov qword [rsp + 0x22], rdx
movabs rdx, 0x6506f4bf20647261
mov qword [rsp + 0x2a], rdx
movabs rdx, 0x1001090f0f030007
mov qword [rsp + 0x32], rdx
movabs rdx, 0x11000a0401021001
mov qword [rsp + 0x38], rdx
movabs rdx, 0x109090700080a07
mov qword [rsp + 0x40], rdx
xor eax, eax
jmp 0x4e910d
movzx r9d, byte [rsp + rsi + 0x1f]
sub r9d, edx
lea edx, [r9 - 0x38]
mov byte [rsp + rdi + 0x1f], dl
lea edx, [r8 - 0x38]
mov byte [rsp + rsi + 0x1f], dl
add rax, 2
cmp rax, 0x16
jge 0x4e913a
movzx edx, byte [rsp + rax + 0x32]
movzx esi, byte [rsp + rax + 0x33]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x13
jae 0x4e915d
movzx r8d, byte [rsp + rdi + 0x1f]
sub r8d, edx
cmp rsi, 0x13
jb 0x4e90f0
jmp 0x4e9151
xor eax, eax
lea rbx, [rsp + 0x1f]
mov ecx, 0x13
call fcn.0044bb20
add rsp, 0x48
pop rbp
ret
mov eax, esi
mov ecx, 0x13
call fcn.00461020
mov eax, edi
mov ecx, 0x13
call fcn.00461020
nop
call fcn.0045eda0
jmp fcn.004e9080

Function at 0x4e9540
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4e963d
push rbp
mov rbp, rsp
sub rsp, 0x50
movabs rdx, 0xac69746fd263ad27
mov qword [rsp + 0x1f], rdx
movabs rdx, 0xe4c6618353bd12ac
mov qword [rsp + 0x26], rdx
movabs rdx, 0x7920c96b20d94161
mov qword [rsp + 0x2e], rdx
movabs rdx, 0x714160d13070904
mov qword [rsp + 0x36], rdx
movabs rdx, 0x80b0d140b0d1514
mov qword [rsp + 0x3e], rdx
movabs rdx, 0x1403080b0d140b0d
mov qword [rsp + 0x40], rdx
movabs rdx, 0x110100010e0b100e
mov qword [rsp + 0x48], rdx
xor eax, eax
jmp 0x4e95e0
movzx r9d, byte [rsp + rsi + 0x1f]
sub r9d, edx
lea edx, [r9 - 0x42]
mov byte [rsp + rdi + 0x1f], dl
lea edx, [r8 - 0x42]
mov byte [rsp + rsi + 0x1f], dl
add rax, 2
nop dword [rax]
cmp rax, 0x1a
jge 0x4e960d
movzx edx, byte [rsp + rax + 0x36]
movzx esi, byte [rsp + rax + 0x37]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x17
jae 0x4e9630
movzx r8d, byte [rsp + rdi + 0x1f]
sub r8d, edx
cmp rsi, 0x17
jb 0x4e95bf
jmp 0x4e9624
xor eax, eax
lea rbx, [rsp + 0x1f]
mov ecx, 0x17
call fcn.0044bb20
add rsp, 0x50
pop rbp
ret
mov eax, esi
mov ecx, 0x17
call fcn.00461020
mov eax, edi
mov ecx, 0x17
call fcn.00461020
nop
nop dword [rax]
call fcn.0045eda0
jmp fcn.004e9540
Function at 0x4eb460
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4eb54c
push rbp
mov rbp, rsp
sub rsp, 0x40
movabs rdx, 0x6674497d6162757b
mov qword [rsp + 0x1a], rdx
movabs rdx, 0x64776674497d6162
mov qword [rsp + 0x1c], rdx
movabs rdx, 0x89875c75ae467261
mov qword [rsp + 0x24], rdx
movabs rdx, 0xe0e111008070c0d
mov qword [rsp + 0x2c], rdx
movabs rdx, 0xf10050c0e0e1110
mov qword [rsp + 0x30], rdx
movabs rdx, 0x800050c0c10040c
mov qword [rsp + 0x38], rdx
xor eax, eax
jmp 0x4eb4ea
movzx r9d, byte [rsp + rsi + 0x1a]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x27]
mov byte [rsp + rdi + 0x1a], dl
mov byte [rsp + rsi + 0x1a], r8b
add rax, 2
cmp rax, 0x14
jge 0x4eb51c
movzx edx, byte [rsp + rax + 0x2c]
movzx esi, byte [rsp + rax + 0x2d]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x12
jae 0x4eb53f
movzx r8d, byte [rsp + rdi + 0x1a]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x27]
cmp rsi, 0x12
jb 0x4eb4d0
jmp 0x4eb533
xor eax, eax
lea rbx, [rsp + 0x1a]
mov ecx, 0x12
call fcn.0044bb20
add rsp, 0x40
pop rbp
ret
mov eax, esi
mov ecx, 0x12
call fcn.00461020
mov eax, edi
mov ecx, 0x12
call fcn.00461020
nop
call fcn.0045eda0
jmp fcn.004eb460

Function at 0x4eb960
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4eba4c
push rbp
mov rbp, rsp
sub rsp, 0x48
movabs rdx, 0xba638eab69ae6150
mov qword [rsp + 0x1d], rdx
movabs rdx, 0x9756a0ae5cba638e
mov qword [rsp + 0x22], rdx
movabs rdx, 0x96b169aa8f647261
mov qword [rsp + 0x2a], rdx
movabs rdx, 0x70b11130a111305
mov qword [rsp + 0x32], rdx
movabs rdx, 0x131108100a07070b
mov qword [rsp + 0x38], rdx
movabs rdx, 0x140c13110402090a
mov qword [rsp + 0x40], rdx
xor eax, eax
jmp 0x4eb9ea
movzx r9d, byte [rsp + rsi + 0x1d]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x5e]
mov byte [rsp + rdi + 0x1d], dl
mov byte [rsp + rsi + 0x1d], r8b
add rax, 2
cmp rax, 0x16
jge 0x4eba1c
movzx edx, byte [rsp + rax + 0x32]
movzx esi, byte [rsp + rax + 0x33]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x15
jae 0x4eba3f
movzx r8d, byte [rsp + rdi + 0x1d]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x5e]
cmp rsi, 0x15
jb 0x4eb9d0
jmp 0x4eba33
xor eax, eax
lea rbx, [rsp + 0x1d]
mov ecx, 0x15
call fcn.0044bb20
add rsp, 0x48
pop rbp
ret
mov eax, esi
mov ecx, 0x15
call fcn.00461020
mov eax, edi
mov ecx, 0x15
call fcn.00461020
nop
call fcn.0045eda0
jmp fcn.004eb960
Function at 0x4ec3e0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4ec4fa
push rbp
mov rbp, rsp
sub rsp, 0x58
movabs rdx, 0x2b4926216e011953
mov qword [rsp + 0x18], rdx
movabs rdx, 0x2897420665d436e2
mov qword [rsp + 0x20], rdx
movabs rdx, 0xb50f2897420665d4
mov qword [rsp + 0x22], rdx
movabs rdx, 0xf4e269ea20f8ac61
mov qword [rsp + 0x2a], rdx
movabs rdx, 0xd160208140f0919
mov qword [rsp + 0x32], rdx
movabs rdx, 0x1611180e100d0d16
mov qword [rsp + 0x38], rdx
movabs rdx, 0x713021618080406
mov qword [rsp + 0x40], rdx
movabs rdx, 0x902070404071104
mov qword [rsp + 0x48], rdx
movabs rdx, 0x1080c110f0e050a
mov qword [rsp + 0x50], rdx
xor eax, eax
jmp 0x4ec497
movzx r9d, byte [rsp + rsi + 0x18]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x1f]
mov byte [rsp + rdi + 0x18], dl
mov byte [rsp + rsi + 0x18], r8b
add rax, 2
cmp rax, 0x26
jge 0x4ec4c9
movzx edx, byte [rsp + rax + 0x32]
movzx esi, byte [rsp + rax + 0x33]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x1a
jae 0x4ec4ed
movzx r8d, byte [rsp + rdi + 0x18]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x1f]
cmp rsi, 0x1a
jb 0x4ec47d
jmp 0x4ec4e1
xor eax, eax
lea rbx, [rsp + 0x18]
mov ecx, 0x1a
call fcn.0044bb20
add rsp, 0x58
pop rbp
nop
ret
mov eax, esi
mov ecx, 0x1a
call fcn.00461020
mov eax, edi
mov ecx, 0x1a
call fcn.00461020
nop
call fcn.0045eda0
nop
jmp fcn.004ec3e0

Function at 0x4ecd20
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4ece0c
push rbp
mov rbp, rsp
sub rsp, 0x40
movabs rdx, 0xe0530b107488b248
mov qword [rsp + 0x19], rdx
movabs rdx, 0x64111ee0530b1074
mov qword [rsp + 0x1c], rdx
movabs rdx, 0xc46d102b34641561
mov qword [rsp + 0x24], rdx
movabs rdx, 0x201070e02010212
mov qword [rsp + 0x2c], rdx
movabs rdx, 0x90f12020201070e
mov qword [rsp + 0x30], rdx
movabs rdx, 0x410120502080c01
mov qword [rsp + 0x38], rdx
xor eax, eax
jmp 0x4ecdaa
movzx r9d, byte [rsp + rsi + 0x19]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x33]
mov byte [rsp + rdi + 0x19], dl
mov byte [rsp + rsi + 0x19], r8b
add rax, 2
cmp rax, 0x14
jge 0x4ecddc
movzx edx, byte [rsp + rax + 0x2c]
movzx esi, byte [rsp + rax + 0x2d]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x13
jae 0x4ecdff
movzx r8d, byte [rsp + rdi + 0x19]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x33]
cmp rsi, 0x13
jb 0x4ecd90
jmp 0x4ecdf3
xor eax, eax
lea rbx, [rsp + 0x19]
mov ecx, 0x13
call fcn.0044bb20
add rsp, 0x40
pop rbp
ret
mov eax, esi
mov ecx, 0x13
call fcn.00461020
mov eax, edi
mov ecx, 0x13
call fcn.00461020
nop
call fcn.0045eda0
jmp fcn.004ecd20
Function at 0x4ed920
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4eda3d
push rbp
mov rbp, rsp
sub rsp, 0x60
movabs rdx, 0x528b757c537e6855
mov qword [rsp + 0x1e], rdx
movabs rdx, 0x6181706772963980
mov qword [rsp + 0x26], rdx
movabs rdx, 0x6447897447466181
mov qword [rsp + 0x2c], rdx
movabs rdx, 0x726d4e54208e7261
mov qword [rsp + 0x34], rdx
movabs rdx, 0x110a1b18041010
mov qword [rsp + 0x3c], rdx
movabs rdx, 0x113141d00110a1b
mov qword [rsp + 0x40], rdx
movabs rdx, 0xd0c0b18140e0408
mov qword [rsp + 0x48], rdx
movabs rdx, 0x1b0607090901041d
mov qword [rsp + 0x50], rdx
movabs rdx, 0x2010210020a0408
mov qword [rsp + 0x58], rdx
xor eax, eax
jmp 0x4ed9e0
movzx r9d, byte [rsp + rsi + 0x1e]
sub r9d, edx
lea edx, [r9 + 0x15]
mov byte [rsp + rdi + 0x1e], dl
lea edx, [r8 + 0x15]
mov byte [rsp + rsi + 0x1e], dl
add rax, 2
nop word [rax + rax]
cmp rax, 0x24
jge 0x4eda0d
movzx edx, byte [rsp + rax + 0x3c]
movzx esi, byte [rsp + rax + 0x3d]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x1e
jae 0x4eda30
movzx r8d, byte [rsp + rdi + 0x1e]
sub r8d, edx
cmp rsi, 0x1e
jb 0x4ed9bd
jmp 0x4eda24
xor eax, eax
lea rbx, [rsp + 0x1e]
mov ecx, 0x1e
call fcn.0044bb20
add rsp, 0x60
pop rbp
ret
mov eax, esi
mov ecx, 0x1e
call fcn.00461020
mov eax, edi
mov ecx, 0x1e
call fcn.00461020
nop
nop dword [rax]
call fcn.0045eda0
jmp fcn.004ed920

Function at 0x4eedc0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4eeebd
push rbp
mov rbp, rsp
sub rsp, 0x50
movabs rdx, 0x200569fcbcbe030a
mov qword [rsp + 0x1d], rdx
movabs rdx, 0x970970a0c3200569
mov qword [rsp + 0x22], rdx
movabs rdx, 0x65309825206437a6
mov qword [rsp + 0x2a], rdx
movabs rdx, 0x121213120e0a0a
mov qword [rsp + 0x32], rdx
movabs rdx, 0xa011313090b0c00
mov qword [rsp + 0x3a], rdx
movabs rdx, 0xb110203060d0a01
mov qword [rsp + 0x40], rdx
movabs rdx, 0x400030e06060800
mov qword [rsp + 0x48], rdx
xor eax, eax
jmp 0x4eee60
movzx r9d, byte [rsp + rsi + 0x1d]
sub r9d, edx
lea edx, [r9 + 0x77]
mov byte [rsp + rdi + 0x1d], dl
lea edx, [r8 + 0x77]
mov byte [rsp + rsi + 0x1d], dl
add rax, 2
nop dword [rax]
cmp rax, 0x1e
jge 0x4eee8d
movzx edx, byte [rsp + rax + 0x32]
movzx esi, byte [rsp + rax + 0x33]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x15
jae 0x4eeeb0
movzx r8d, byte [rsp + rdi + 0x1d]
sub r8d, edx
cmp rsi, 0x15
jb 0x4eee3f
jmp 0x4eeea4
xor eax, eax
lea rbx, [rsp + 0x1d]
mov ecx, 0x15
call fcn.0044bb20
add rsp, 0x50
pop rbp
ret
mov eax, esi
mov ecx, 0x15
call fcn.00461020
mov eax, edi
mov ecx, 0x15
call fcn.00461020
nop
nop dword [rax]
call fcn.0045eda0
jmp fcn.004eedc0
Function at 0x4eeee0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4eeffa
push rbp
mov rbp, rsp
sub rsp, 0x58
movabs rdx, 0x196965683e64692e
mov qword [rsp + 0x1b], rdx
movabs rdx, 0xc00984f7227473ea
mov qword [rsp + 0x23], rdx
movabs rdx, 0x3c00984f7227473
mov qword [rsp + 0x24], rdx
movabs rdx, 0x65eed15420ab7235
mov qword [rsp + 0x2c], rdx
movabs rdx, 0x30c04110f0c0d08
mov qword [rsp + 0x34], rdx
movabs rdx, 0x171608030c0411
mov qword [rsp + 0x38], rdx
movabs rdx, 0xc06161107070c11
mov qword [rsp + 0x40], rdx
movabs rdx, 0x110d160f03001616
mov qword [rsp + 0x48], rdx
movabs rdx, 0x100e0e130b080c08
mov qword [rsp + 0x50], rdx
xor eax, eax
jmp 0x4eef97
movzx r9d, byte [rsp + rsi + 0x1b]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x1e]
mov byte [rsp + rdi + 0x1b], dl
mov byte [rsp + rsi + 0x1b], r8b
add rax, 2
cmp rax, 0x24
jge 0x4eefc9
movzx edx, byte [rsp + rax + 0x34]
movzx esi, byte [rsp + rax + 0x35]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x19
jae 0x4eefed
movzx r8d, byte [rsp + rdi + 0x1b]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x1e]
cmp rsi, 0x19
jb 0x4eef7d
jmp 0x4eefe1
xor eax, eax
lea rbx, [rsp + 0x1b]
mov ecx, 0x19
call fcn.0044bb20
add rsp, 0x58
pop rbp
nop
ret
mov eax, esi
mov ecx, 0x19
call fcn.00461020
mov eax, edi
mov ecx, 0x19
call fcn.00461020
nop
call fcn.0045eda0
nop
jmp fcn.004eeee0

Function at 0x4ef2e0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4ef3e8
push rbp
mov rbp, rsp
sub rsp, 0x50
movabs rdx, 0x6961620f0c535df2
mov qword [rsp + 0x1b], rdx
movabs rdx, 0xdd6174991416f956
mov qword [rsp + 0x23], rdx
movabs rdx, 0x64dd6174991416f9
mov qword [rsp + 0x24], rdx
movabs rdx, 0xd1c7a00dfe64242a
mov qword [rsp + 0x2c], rdx
movabs rdx, 0x9080b1716110f0c
mov qword [rsp + 0x34], rdx
movabs rdx, 0xa04161401160200
mov qword [rsp + 0x3c], rdx
movabs rdx, 0x31111090a041614
mov qword [rsp + 0x40], rdx
movabs rdx, 0x150f011201001518
mov qword [rsp + 0x48], rdx
xor eax, eax
jmp 0x4ef38b
movzx r9d, byte [rsp + rsi + 0x1b]
sub r9d, edx
lea edx, [r9 + 0x79]
mov byte [rsp + rdi + 0x1b], dl
lea edx, [r8 + 0x79]
mov byte [rsp + rsi + 0x1b], dl
add rax, 2
cmp rax, 0x1c
jge 0x4ef3b8
movzx edx, byte [rsp + rax + 0x34]
movzx esi, byte [rsp + rax + 0x35]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x19
jae 0x4ef3db
movzx r8d, byte [rsp + rdi + 0x1b]
sub r8d, edx
cmp rsi, 0x19
jb 0x4ef36e
jmp 0x4ef3cf
xor eax, eax
lea rbx, [rsp + 0x1b]
mov ecx, 0x19
call fcn.0044bb20
add rsp, 0x50
pop rbp
ret
mov eax, esi
mov ecx, 0x19
call fcn.00461020
mov eax, edi
mov ecx, 0x19
call fcn.00461020
nop
call fcn.0045eda0
jmp fcn.004ef2e0