joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4ef940
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4efa1d
push rbp
mov rbp, rsp
sub rsp, 0x40
movabs rdx, 0x26427fe52574652f
mov qword [rsp + 0x30], rdx
movabs rdx, 0x653872464dd66646
mov qword [rsp + 0x38], rdx
movabs rdx, 0x4030504010a0801
mov qword [rsp + 0x1a], rdx
movabs rdx, 0xa0708010b0a0403
mov qword [rsp + 0x20], rdx
movabs rdx, 0xe070e050b0301
mov qword [rsp + 0x28], rdx
xor eax, eax
nop
jmp 0x4ef9c0
movzx r9d, byte [rsp + rsi + 0x30]
sub r9d, edx
lea edx, [r9 + 0x58]
mov byte [rsp + rdi + 0x30], dl
lea edx, [r8 + 0x58]
mov byte [rsp + rsi + 0x30], dl
add rax, 2
nop
cmp rax, 0x16
jge 0x4ef9ed
movzx edx, byte [rsp + rax + 0x1a]
movzx esi, byte [rsp + rax + 0x1b]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x10
jae 0x4efa10
movzx r8d, byte [rsp + rdi + 0x30]
sub r8d, edx
cmp rsi, 0x10
jb 0x4ef9a2
jmp 0x4efa04
xor eax, eax
lea rbx, [rsp + 0x30]
mov ecx, 0x10
call fcn.00444ae0
add rsp, 0x40
pop rbp
ret
mov eax, esi
mov ecx, 0x10
call fcn.00456860
mov eax, edi
mov ecx, 0x10
call fcn.00456860
nop
nop dword [rax]
call fcn.00454580
jmp fcn.004ef940

Function at 0x4f0e00
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4f0eec
push rbp
mov rbp, rsp
sub rsp, 0x48
movabs rdx, 0x507e655470889565
mov qword [rsp + 0x30], rdx
movabs rdx, 0x4378585969666172
mov qword [rsp + 0x38], rdx
movabs rdx, 0x808c728676885865
mov qword [rsp + 0x40], rdx
movabs rdx, 0x1209010416131412
mov qword [rsp + 0x18], rdx
movabs rdx, 0x4020c0310170e16
mov qword [rsp + 0x20], rdx
movabs rdx, 0xe010f000406110d
mov qword [rsp + 0x28], rdx
xor eax, eax
jmp 0x4f0e8a
movzx r9d, byte [rsp + rsi + 0x30]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x1f]
mov byte [rsp + rdi + 0x30], dl
mov byte [rsp + rsi + 0x30], r8b
add rax, 2
cmp rax, 0x18
jge 0x4f0ebc
movzx edx, byte [rsp + rax + 0x18]
movzx esi, byte [rsp + rax + 0x19]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x18
jae 0x4f0edf
movzx r8d, byte [rsp + rdi + 0x30]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x1f]
cmp rsi, 0x18
jb 0x4f0e70
jmp 0x4f0ed3
xor eax, eax
lea rbx, [rsp + 0x30]
mov ecx, 0x18
call fcn.00444ae0
add rsp, 0x48
pop rbp
ret
mov eax, esi
mov ecx, 0x18
call fcn.00456860
mov eax, edi
mov ecx, 0x18
call fcn.00456860
nop
call fcn.00454580
jmp fcn.004f0e00
Function at 0x4f1720
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4f17e7
push rbp
mov rbp, rsp
sub rsp, 0x38
movabs rdx, 0x7a76711b54cc5357
mov qword [rsp + 0x2d], rdx
mov dword [rsp + 0x34], 0xe06ff67a
movabs rdx, 0x503070203050403
mov qword [rsp + 0x1f], rdx
movabs rdx, 0x4020a08030a0503
mov qword [rsp + 0x25], rdx
xor eax, eax
jmp 0x4f1788
movzx r9d, byte [rsp + rsi + 0x2d]
sub r9d, edx
lea edx, [r9 - 0x7d]
mov byte [rsp + rdi + 0x2d], dl
lea edx, [r8 - 0x7d]
mov byte [rsp + rsi + 0x2d], dl
add rax, 2
cmp rax, 0xe
jge 0x4f17b7
movzx edx, byte [rsp + rax + 0x1f]
movzx esi, byte [rsp + rax + 0x20]
mov edi, edx
xor edx, esi
add edx, eax
nop
cmp rdi, 0xb
jae 0x4f17da
movzx r8d, byte [rsp + rdi + 0x2d]
sub r8d, edx
cmp rsi, 0xb
jb 0x4f176b
jmp 0x4f17ce
xor eax, eax
lea rbx, [rsp + 0x2d]
mov ecx, 0xb
call fcn.00444ae0
add rsp, 0x38
pop rbp
ret
mov eax, esi
mov ecx, 0xb
call fcn.00456860
mov eax, edi
mov ecx, 0xb
call fcn.00456860
nop
call fcn.00454580
jmp fcn.004f1720

Function at 0x4f2800
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4f28e6
push rbp
mov rbp, rsp
sub rsp, 0x40
movabs rdx, 0x390fa84a703a1f38
mov qword [rsp + 0x32], rdx
movabs rdx, 0xf90c616e35f6390f
mov qword [rsp + 0x38], rdx
movabs rdx, 0x70c070607010405
mov qword [rsp + 0x1e], rdx
movabs rdx, 0x4070d08070c0706
mov qword [rsp + 0x22], rdx
movabs rdx, 0xd08090200000007
mov qword [rsp + 0x2a], rdx
xor eax, eax
nop
jmp 0x4f2880
movzx r9d, byte [rsp + rsi + 0x32]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x24]
mov byte [rsp + rdi + 0x32], dl
mov byte [rsp + rsi + 0x32], r8b
add rax, 2
nop dword [rax]
cmp rax, 0x14
jge 0x4f28b2
movzx edx, byte [rsp + rax + 0x1e]
movzx esi, byte [rsp + rax + 0x1f]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0xe
jae 0x4f28d7
movzx r8d, byte [rsp + rdi + 0x32]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x24]
cmp rsi, 0xe
jb 0x4f2862
jmp 0x4f28cb
xor eax, eax
lea rbx, [rsp + 0x32]
mov ecx, 0xe
nop
call fcn.00444ae0
add rsp, 0x40
pop rbp
ret
mov eax, esi
mov ecx, 0xe
call fcn.00456860
mov eax, edi
mov ecx, 0xe
nop
call fcn.00456860
nop
call fcn.00454580
jmp fcn.004f2800
Function at 0x4f2b60
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4f2c26
push rbp
mov rbp, rsp
sub rsp, 0x30
movabs rdx, 0xfe7df673737c65fd
mov qword [rsp + 0x26], rdx
mov word [rsp + 0x2e], 0x74f8
movabs rdx, 0x707020605050408
mov qword [rsp + 0x1a], rdx
mov dword [rsp + 0x22], 0x20806
xor eax, eax
jmp 0x4f2bc0
movzx r9d, byte [rsp + rsi + 0x26]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x6b]
mov byte [rsp + rdi + 0x26], dl
mov byte [rsp + rsi + 0x26], r8b
add rax, 2
nop dword [rax]
cmp rax, 0xc
jge 0x4f2bf2
movzx edx, byte [rsp + rax + 0x1a]
movzx esi, byte [rsp + rax + 0x1b]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0xa
jae 0x4f2c17
movzx r8d, byte [rsp + rdi + 0x26]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x6b]
cmp rsi, 0xa
jb 0x4f2ba3
jmp 0x4f2c0b
xor eax, eax
lea rbx, [rsp + 0x26]
mov ecx, 0xa
nop
call fcn.00444ae0
add rsp, 0x30
pop rbp
ret
mov eax, esi
mov ecx, 0xa
call fcn.00456860
mov eax, edi
mov ecx, 0xa
nop
call fcn.00456860
nop
call fcn.00454580
jmp fcn.004f2b60

Function at 0x4f2c40
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4f2d06
push rbp
mov rbp, rsp
sub rsp, 0x30
movabs rdx, 0x5b6b636f2b3e2b73
mov qword [rsp + 0x26], rdx
mov word [rsp + 0x2e], 0x473b
movabs rdx, 0x703090102070108
mov qword [rsp + 0x1c], rdx
mov word [rsp + 0x24], 0x708
xor eax, eax
jmp 0x4f2ca0
movzx r9d, byte [rsp + rsi + 0x26]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x12]
mov byte [rsp + rdi + 0x26], dl
mov byte [rsp + rsi + 0x26], r8b
add rax, 2
nop dword [rax]
cmp rax, 0xa
jge 0x4f2cd2
movzx edx, byte [rsp + rax + 0x1c]
movzx esi, byte [rsp + rax + 0x1d]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0xa
jae 0x4f2cf7
movzx r8d, byte [rsp + rdi + 0x26]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x12]
cmp rsi, 0xa
jb 0x4f2c82
jmp 0x4f2ceb
xor eax, eax
lea rbx, [rsp + 0x26]
mov ecx, 0xa
nop
call fcn.00444ae0
add rsp, 0x30
pop rbp
ret
mov eax, esi
mov ecx, 0xa
call fcn.00456860
mov eax, edi
mov ecx, 0xa
nop
call fcn.00456860
nop
call fcn.00454580
jmp fcn.004f2c40

Function at 0x4f38e0
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4f39aa
push rbp
mov rbp, rsp
sub rsp, 0x48
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rbx
mov qword [rsp], rax
mov qword [rsp + 8], rbx
mov byte [rsp + 0x10], 0
call fcn.004035e0
xorps xmm15, xmm15
mov r14, qword [0x006ae098]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x18], 0xffffffffffffffff
jne 0x4f398f
mov rcx, qword [rsp + 0x60]
lea rdx, [rcx + 1]
mov qword [rsp + 0x40], rdx
lea rax, [0x00551e80]
xor ebx, ebx
mov rcx, rdx
call fcn.00441600
mov rbx, qword [rsp + 0x60]
mov rcx, rax
xor edi, edi
mov rsi, qword [rsp + 0x40]
mov rax, qword [rsp + 0x58]
nop dword [rax]
call fcn.004f3f40
inc rbx
cmp rcx, rbx
jae 0x4f397e
mov edi, 1
lea rsi, [0x00551e80]
call fcn.004416e0
mov word [rax + rbx*2 - 2], 0
xor edi, edi
xor esi, esi
add rsp, 0x48
pop rbp
ret
xor eax, eax
xor ebx, ebx
mov rcx, rbx
lea rdi, [0x00595bb8]
lea rsi, [0x00595700]
add rsp, 0x48
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.00454580
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.004f38e0
Function at 0x4f76a0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4f7767
push rbp
mov rbp, rsp
sub rsp, 0x38
movabs rdx, 0xabc86c520cdf65b6
mov qword [rsp + 0x2c], rdx
mov dword [rsp + 0x34], 0xd26c0f2e
movabs rdx, 0x90b0209030704
mov qword [rsp + 0x1e], rdx
movabs rdx, 0xb06030207020009
mov qword [rsp + 0x24], rdx
xor eax, eax
jmp 0x4f7708
movzx r9d, byte [rsp + rsi + 0x2c]
sub r9d, edx
lea edx, [r9 - 0x43]
mov byte [rsp + rdi + 0x2c], dl
lea edx, [r8 - 0x43]
mov byte [rsp + rsi + 0x2c], dl
add rax, 2
cmp rax, 0xe
jge 0x4f7737
movzx edx, byte [rsp + rax + 0x1e]
movzx esi, byte [rsp + rax + 0x1f]
mov edi, edx
xor edx, esi
add edx, eax
nop
cmp rdi, 0xc
jae 0x4f775a
movzx r8d, byte [rsp + rdi + 0x2c]
sub r8d, edx
cmp rsi, 0xc
jb 0x4f76eb
jmp 0x4f774e
xor eax, eax
lea rbx, [rsp + 0x2c]
mov ecx, 0xc
call fcn.00444ae0
add rsp, 0x38
pop rbp
ret
mov eax, esi
mov ecx, 0xc
call fcn.00456860
mov eax, edi
mov ecx, 0xc
call fcn.00456860
nop
call fcn.00454580
jmp fcn.004f76a0

Function at 0x4f8740
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4f885d
push rbp
mov rbp, rsp
sub rsp, 0x58
movabs rdx, 0xf94541303288002c
mov qword [rsp + 0x3f], rdx
movabs rdx, 0x6e0258346ffd6c76
mov qword [rsp + 0x47], rdx
movabs rdx, 0xd16e0258346ffd6c
mov qword [rsp + 0x48], rdx
movabs rdx, 0xd073263ea4333d53
mov qword [rsp + 0x50], rdx
movabs rdx, 0x18090e160e101402
mov qword [rsp + 0x1b], rdx
movabs rdx, 0x10c140a18090e16
mov qword [rsp + 0x1f], rdx
movabs rdx, 0x4140218120a0714
mov qword [rsp + 0x27], rdx
movabs rdx, 0x309001810021305
mov qword [rsp + 0x2f], rdx
movabs rdx, 0x1503120d0c161012
mov qword [rsp + 0x37], rdx
xor eax, eax
jmp 0x4f8800
movzx r9d, byte [rsp + rsi + 0x3f]
sub r9d, edx
lea edx, [r9 + 0x5b]
mov byte [rsp + rdi + 0x3f], dl
lea edx, [r8 + 0x5b]
mov byte [rsp + rsi + 0x3f], dl
add rax, 2
nop word [rax + rax]
cmp rax, 0x24
jge 0x4f882d
movzx edx, byte [rsp + rax + 0x1b]
movzx esi, byte [rsp + rax + 0x1c]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x19
jae 0x4f8850
movzx r8d, byte [rsp + rdi + 0x3f]
sub r8d, edx
cmp rsi, 0x19
jb 0x4f87dd
jmp 0x4f8844
xor eax, eax
lea rbx, [rsp + 0x3f]
mov ecx, 0x19
call fcn.00444ae0
add rsp, 0x58
pop rbp
ret
mov eax, esi
mov ecx, 0x19
call fcn.00456860
mov eax, edi
mov ecx, 0x19
call fcn.00456860
nop
nop dword [rax]
call fcn.00454580
jmp fcn.004f8740
Function at 0x4f9480
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4f953d
push rbp
mov rbp, rsp
sub rsp, 0x30
movabs rdx, 0x80ba84dcc470658a
mov qword [rsp + 0x27], rdx
mov byte [rsp + 0x2f], 0x72
movabs rdx, 0x503000605030405
mov qword [rsp + 0x1d], rdx
mov word [rsp + 0x25], 7
xor eax, eax
nop
jmp 0x4f94e0
movzx r9d, byte [rsp + rsi + 0x27]
sub r9d, edx
lea edx, [r9 - 0x1e]
mov byte [rsp + rdi + 0x27], dl
lea edx, [r8 - 0x1e]
mov byte [rsp + rsi + 0x27], dl
add rax, 2
nop
cmp rax, 0xa
jge 0x4f950d
movzx edx, byte [rsp + rax + 0x1d]
movzx esi, byte [rsp + rax + 0x1e]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 9
jae 0x4f9530
movzx r8d, byte [rsp + rdi + 0x27]
sub r8d, edx
cmp rsi, 9
jb 0x4f94c2
jmp 0x4f9524
xor eax, eax
lea rbx, [rsp + 0x27]
mov ecx, 9
call fcn.00444ae0
add rsp, 0x30
pop rbp
ret
mov eax, esi
mov ecx, 9
call fcn.00456860
mov eax, edi
mov ecx, 9
call fcn.00456860
nop
nop dword [rax]
call fcn.00454580
jmp fcn.004f9480

Function at 0x4f97a0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4f9858
push rbp
mov rbp, rsp
sub rsp, 0x30
movabs rdx, 0x635b733d645c6466
mov qword [rsp + 0x28], rdx
movabs rdx, 0x101030005070200
mov qword [rsp + 0x1c], rdx
mov dword [rsp + 0x24], 0x3060004
xor eax, eax
jmp 0x4f97f6
movzx r9d, byte [rsp + rsi + 0x28]
lea edx, [r9 + rdx]
lea edx, [rdx - 5]
mov byte [rsp + rdi + 0x28], dl
mov byte [rsp + rsi + 0x28], r8b
add rax, 2
cmp rax, 0xc
jge 0x4f9828
movzx edx, byte [rsp + rax + 0x1c]
movzx esi, byte [rsp + rax + 0x1d]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 8
jae 0x4f984b
movzx r8d, byte [rsp + rdi + 0x28]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 5]
cmp rsi, 8
jb 0x4f97dc
jmp 0x4f983f
xor eax, eax
lea rbx, [rsp + 0x28]
mov ecx, 8
call fcn.00444ae0
add rsp, 0x30
pop rbp
ret
mov eax, esi
mov ecx, 8
call fcn.00456860
mov eax, edi
mov ecx, 8
call fcn.00456860
nop
call fcn.00454580
nop dword [rax]
jmp fcn.004f97a0
Function at 0x4f9880
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4f997d
push rbp
mov rbp, rsp
sub rsp, 0x50
movabs rdx, 0xf169f3f1654be774
mov qword [rsp + 0x3c], rdx
movabs rdx, 0xf0e9342bf169f3f1
mov qword [rsp + 0x40], rdx
movabs rdx, 0x244c3f463e6e1930
mov qword [rsp + 0x48], rdx
movabs rdx, 0xf10110807080712
mov qword [rsp + 0x1e], rdx
movabs rdx, 0x5010405110d1209
mov qword [rsp + 0x26], rdx
movabs rdx, 0xc130c0a05010501
mov qword [rsp + 0x2c], rdx
movabs rdx, 0x1302110c0d0b050b
mov qword [rsp + 0x34], rdx
xor eax, eax
jmp 0x4f9920
movzx r9d, byte [rsp + rsi + 0x3c]
sub r9d, edx
lea edx, [r9 + 0x54]
mov byte [rsp + rdi + 0x3c], dl
lea edx, [r8 + 0x54]
mov byte [rsp + rsi + 0x3c], dl
add rax, 2
nop dword [rax]
cmp rax, 0x1e
jge 0x4f994d
movzx edx, byte [rsp + rax + 0x1e]
movzx esi, byte [rsp + rax + 0x1f]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x14
jae 0x4f9970
movzx r8d, byte [rsp + rdi + 0x3c]
sub r8d, edx
cmp rsi, 0x14
jb 0x4f98ff
jmp 0x4f9964
xor eax, eax
lea rbx, [rsp + 0x3c]
mov ecx, 0x14
call fcn.00444ae0
add rsp, 0x50
pop rbp
ret
mov eax, esi
mov ecx, 0x14
call fcn.00456860
mov eax, edi
mov ecx, 0x14
call fcn.00456860
nop
nop dword [rax]
call fcn.00454580
jmp fcn.004f9880

Function at 0x4fbf20
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4fc01d
push rbp
mov rbp, rsp
sub rsp, 0x50
movabs rdx, 0x656dd14a6f6f3e8b
mov qword [rsp + 0x3a], rdx
movabs rdx, 0xc9c82b7453f1656d
mov qword [rsp + 0x40], rdx
movabs rdx, 0xdb8fd254f864cc7e
mov qword [rsp + 0x48], rdx
movabs rdx, 0x1114000b130e0801
mov qword [rsp + 0x1c], rdx
movabs rdx, 0x130f0b0b1505040f
mov qword [rsp + 0x24], rdx
movabs rdx, 0x11103140b0d130f
mov qword [rsp + 0x2a], rdx
movabs rdx, 0xc140c040f080100
mov qword [rsp + 0x32], rdx
xor eax, eax
jmp 0x4fbfc0
movzx r9d, byte [rsp + rsi + 0x3a]
sub r9d, edx
lea edx, [r9 - 0x52]
mov byte [rsp + rdi + 0x3a], dl
lea edx, [r8 - 0x52]
mov byte [rsp + rsi + 0x3a], dl
add rax, 2
nop dword [rax]
cmp rax, 0x1e
jge 0x4fbfed
movzx edx, byte [rsp + rax + 0x1c]
movzx esi, byte [rsp + rax + 0x1d]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x16
jae 0x4fc010
movzx r8d, byte [rsp + rdi + 0x3a]
sub r8d, edx
cmp rsi, 0x16
jb 0x4fbf9f
jmp 0x4fc004
xor eax, eax
lea rbx, [rsp + 0x3a]
mov ecx, 0x16
call fcn.00444ae0
add rsp, 0x50
pop rbp
ret
mov eax, esi
mov ecx, 0x16
call fcn.00456860
mov eax, edi
mov ecx, 0x16
call fcn.00456860
nop
nop dword [rax]
call fcn.00454580
jmp fcn.004fbf20
Function at 0x4fc040
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4fc13d
push rbp
mov rbp, rsp
sub rsp, 0x50
movabs rdx, 0x68615b6256673362
mov qword [rsp + 0x3b], rdx
movabs rdx, 0x656e8b408a68615b
mov qword [rsp + 0x40], rdx
movabs rdx, 0x655b495b92606627
mov qword [rsp + 0x48], rdx
movabs rdx, 0x811050f020c0009
mov qword [rsp + 0x1d], rdx
movabs rdx, 0xe02090c03011213
mov qword [rsp + 0x25], rdx
movabs rdx, 0x70d020c02030e02
mov qword [rsp + 0x2b], rdx
movabs rdx, 0xa130e0c11130c10
mov qword [rsp + 0x33], rdx
xor eax, eax
jmp 0x4fc0e0
movzx r9d, byte [rsp + rsi + 0x3b]
sub r9d, edx
lea edx, [r9 + 0x17]
mov byte [rsp + rdi + 0x3b], dl
lea edx, [r8 + 0x17]
mov byte [rsp + rsi + 0x3b], dl
add rax, 2
nop dword [rax]
cmp rax, 0x1e
jge 0x4fc10d
movzx edx, byte [rsp + rax + 0x1d]
movzx esi, byte [rsp + rax + 0x1e]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x15
jae 0x4fc130
movzx r8d, byte [rsp + rdi + 0x3b]
sub r8d, edx
cmp rsi, 0x15
jb 0x4fc0bf
jmp 0x4fc124
xor eax, eax
lea rbx, [rsp + 0x3b]
mov ecx, 0x15
call fcn.00444ae0
add rsp, 0x50
pop rbp
ret
mov eax, esi
mov ecx, 0x15
call fcn.00456860
mov eax, edi
mov ecx, 0x15
call fcn.00456860
nop
nop dword [rax]
call fcn.00454580
jmp fcn.004fc040

Function at 0x4fd140
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4fd22a
push rbp
mov rbp, rsp
sub rsp, 0x48
movabs rdx, 0x1253fd383f684206
mov qword [rsp + 0x35], rdx
movabs rdx, 0x4858611253fd383f
mov qword [rsp + 0x38], rdx
movabs rdx, 0x360bdd402035311a
mov qword [rsp + 0x40], rdx
movabs rdx, 0x100a0c0111070005
mov qword [rsp + 0x1f], rdx
movabs rdx, 0xd040f110307100a
mov qword [rsp + 0x25], rdx
movabs rdx, 0x91112120a05000b
mov qword [rsp + 0x2d], rdx
xor eax, eax
jmp 0x4fd1cd
movzx r9d, byte [rsp + rsi + 0x35]
sub r9d, edx
lea edx, [r9 + 0x41]
mov byte [rsp + rdi + 0x35], dl
lea edx, [r8 + 0x41]
mov byte [rsp + rsi + 0x35], dl
add rax, 2
cmp rax, 0x16
jge 0x4fd1fa
movzx edx, byte [rsp + rax + 0x1f]
movzx esi, byte [rsp + rax + 0x20]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x13
jae 0x4fd21d
movzx r8d, byte [rsp + rdi + 0x35]
sub r8d, edx
cmp rsi, 0x13
jb 0x4fd1b0
jmp 0x4fd211
xor eax, eax
lea rbx, [rsp + 0x35]
mov ecx, 0x13
call fcn.00444ae0
add rsp, 0x48
pop rbp
ret
mov eax, esi
mov ecx, 0x13
call fcn.00456860
mov eax, edi
mov ecx, 0x13
call fcn.00456860
nop
call fcn.00454580
jmp fcn.004fd140
Function at 0x4fd620
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4fd71b
push rbp
mov rbp, rsp
sub rsp, 0x50
movabs rdx, 0x6ed52475cfb12e41
mov qword [rsp + 0x39], rdx
movabs rdx, 0xc94e738023a7cc6e
mov qword [rsp + 0x40], rdx
movabs rdx, 0x65c7693020c07229
mov qword [rsp + 0x48], rdx
movabs rdx, 0x10c090d15031301
mov qword [rsp + 0x1b], rdx
movabs rdx, 0x90f0e080b010d09
mov qword [rsp + 0x23], rdx
movabs rdx, 0xa020101130b090f
mov qword [rsp + 0x29], rdx
movabs rdx, 0x111060204090605
mov qword [rsp + 0x31], rdx
xor eax, eax
jmp 0x4fd6b9
movzx r9d, byte [rsp + rsi + 0x39]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x7a]
mov byte [rsp + rdi + 0x39], dl
mov byte [rsp + rsi + 0x39], r8b
add rax, 2
cmp rax, 0x1e
jge 0x4fd6eb
movzx edx, byte [rsp + rax + 0x1b]
movzx esi, byte [rsp + rax + 0x1c]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x17
jae 0x4fd70e
movzx r8d, byte [rsp + rdi + 0x39]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x7a]
cmp rsi, 0x17
jb 0x4fd69f
jmp 0x4fd702
xor eax, eax
lea rbx, [rsp + 0x39]
mov ecx, 0x17
call fcn.00444ae0
add rsp, 0x50
pop rbp
ret
mov eax, esi
mov ecx, 0x17
call fcn.00456860
mov eax, edi
mov ecx, 0x17
call fcn.00456860
nop
nop dword [rax + rax]
call fcn.00454580
jmp fcn.004fd620

Function at 0x4fdae0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4fdbdd
push rbp
mov rbp, rsp
sub rsp, 0x50
movabs rdx, 0x30741161eee8354a
mov qword [rsp + 0x38], rdx
movabs rdx, 0x311d6126238b2544
mov qword [rsp + 0x40], rdx
movabs rdx, 0x2a2d1954a7645761
mov qword [rsp + 0x48], rdx
movabs rdx, 0x1702020a150c0e05
mov qword [rsp + 0x1a], rdx
movabs rdx, 0x31613170e150f07
mov qword [rsp + 0x22], rdx
movabs rdx, 0x51117000c080316
mov qword [rsp + 0x28], rdx
movabs rdx, 0xb01030900020216
mov qword [rsp + 0x30], rdx
xor eax, eax
jmp 0x4fdb80
movzx r9d, byte [rsp + rsi + 0x38]
sub r9d, edx
lea edx, [r9 + 0x44]
mov byte [rsp + rdi + 0x38], dl
lea edx, [r8 + 0x44]
mov byte [rsp + rsi + 0x38], dl
add rax, 2
nop dword [rax]
cmp rax, 0x1e
jge 0x4fdbad
movzx edx, byte [rsp + rax + 0x1a]
movzx esi, byte [rsp + rax + 0x1b]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x18
jae 0x4fdbd0
movzx r8d, byte [rsp + rdi + 0x38]
sub r8d, edx
cmp rsi, 0x18
jb 0x4fdb5f
jmp 0x4fdbc4
xor eax, eax
lea rbx, [rsp + 0x38]
mov ecx, 0x18
call fcn.00444ae0
add rsp, 0x50
pop rbp
ret
mov eax, esi
mov ecx, 0x18
call fcn.00456860
mov eax, edi
mov ecx, 0x18
call fcn.00456860
nop
nop dword [rax]
call fcn.00454580
jmp fcn.004fdae0
Function at 0x4fdfa0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4fe0cc
push rbp
mov rbp, rsp
sub rsp, 0x68
movabs rdx, 0x6a5166575f027b43
mov qword [rsp + 0x49], rdx
movabs rdx, 0x6153293669617056
mov qword [rsp + 0x51], rdx
movabs rdx, 0x386e615e48635961
mov qword [rsp + 0x58], rdx
movabs rdx, 0x6521695d2e5c725f
mov qword [rsp + 0x60], rdx
movabs rdx, 0x80b0916081a0b17
mov qword [rsp + 0x1b], rdx
movabs rdx, 0x160319031c061301
mov qword [rsp + 0x23], rdx
movabs rdx, 0x5101212121c1603
mov qword [rsp + 0x29], rdx
movabs rdx, 0x1c1717041d1b0217
mov qword [rsp + 0x31], rdx
movabs rdx, 0x10e1b1a161d0b11
mov qword [rsp + 0x39], rdx
movabs rdx, 0xd1209171b0c0407
mov qword [rsp + 0x41], rdx
xor eax, eax
jmp 0x4fe066
movzx r9d, byte [rsp + rsi + 0x49]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x21]
mov byte [rsp + rdi + 0x49], dl
mov byte [rsp + rsi + 0x49], r8b
add rax, 2
cmp rax, 0x2e
jge 0x4fe09c
movzx edx, byte [rsp + rax + 0x1b]
movzx esi, byte [rsp + rax + 0x1c]
mov edi, edx
xor edx, esi
add edx, eax
nop dword [rax]
cmp rdi, 0x1f
jae 0x4fe0bf
movzx r8d, byte [rsp + rdi + 0x49]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x21]
cmp rsi, 0x1f
jb 0x4fe04c
jmp 0x4fe0b3
xor eax, eax
lea rbx, [rsp + 0x49]
mov ecx, 0x1f
call fcn.00444ae0
add rsp, 0x68
pop rbp
ret
mov eax, esi
mov ecx, 0x1f
call fcn.00456860
mov eax, edi
mov ecx, 0x1f
call fcn.00456860
nop
call fcn.00454580
jmp fcn.004fdfa0

Function at 0x4ffe40
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4fff2a
push rbp
mov rbp, rsp
sub rsp, 0x48
movabs rdx, 0xc3632ceadd171913
mov qword [rsp + 0x33], rdx
movabs rdx, 0x646e043900c3632c
mov qword [rsp + 0x38], rdx
movabs rdx, 0x65ae30545c647261
mov qword [rsp + 0x40], rdx
movabs rdx, 0x80702130503010a
mov qword [rsp + 0x1b], rdx
movabs rdx, 0x512040700050812
mov qword [rsp + 0x23], rdx
movabs rdx, 0x1051009130a0902
mov qword [rsp + 0x2b], rdx
xor eax, eax
jmp 0x4ffecd
movzx r9d, byte [rsp + rsi + 0x33]
sub r9d, edx
lea edx, [r9 + 0x45]
mov byte [rsp + rdi + 0x33], dl
lea edx, [r8 + 0x45]
mov byte [rsp + rsi + 0x33], dl
add rax, 2
cmp rax, 0x18
jge 0x4ffefa
movzx edx, byte [rsp + rax + 0x1b]
movzx esi, byte [rsp + rax + 0x1c]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x15
jae 0x4fff1d
movzx r8d, byte [rsp + rdi + 0x33]
sub r8d, edx
cmp rsi, 0x15
jb 0x4ffeb0
jmp 0x4fff11
xor eax, eax
lea rbx, [rsp + 0x33]
mov ecx, 0x15
call fcn.00444ae0
add rsp, 0x48
pop rbp
ret
mov eax, esi
mov ecx, 0x15
call fcn.00456860
mov eax, edi
mov ecx, 0x15
call fcn.00456860
nop
call fcn.00454580
jmp fcn.004ffe40