joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4dbba0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4dbca8
sub rsp, 0x50
mov qword [rsp + 0x48], rbp
lea rbp, [rsp + 0x48]
movabs rdx, 0x4f5d3229411b1711
mov qword [rsp + 0x18], rdx
movabs rdx, 0x3b43133e4f5d3229
mov qword [rsp + 0x1c], rdx
movabs rdx, 0x20724328443f290c
mov qword [rsp + 0x24], rdx
movabs rdx, 0x105020a0b0c0900
mov qword [rsp + 0x2c], rdx
movabs rdx, 0x51004080d130b11
mov qword [rsp + 0x34], rdx
movabs rdx, 0x7110b1305100408
mov qword [rsp + 0x38], rdx
movabs rdx, 0xe0a08060d0e050f
mov qword [rsp + 0x40], rdx
xor eax, eax
jmp 0x4dbc42
movzx r9d, byte [rsp + rsi + 0x18]
sub r9d, edx
lea edx, [r9 + 0x3d]
mov byte [rsp + rdi + 0x18], dl
lea edx, [r8 + 0x3d]
mov byte [rsp + rsi + 0x18], dl
add rax, 2
cmp rax, 0x1c
jge 0x4dbc6f
movzx edx, byte [rsp + rax + 0x2c]
movzx esi, byte [rsp + rax + 0x2d]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x14
jae 0x4dbc9b
movzx r8d, byte [rsp + rdi + 0x18]
sub r8d, edx
cmp rsi, 0x14
jb 0x4dbc25
jmp 0x4dbc8f
xor eax, eax
lea rbx, [rsp + 0x18]
mov ecx, 0x14
nop dword [rax + rax]
call fcn.004446e0
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
mov eax, esi
mov ecx, 0x14
call fcn.00457420
mov eax, edi
mov ecx, 0x14
call fcn.00457420
nop
call fcn.00454dc0
jmp fcn.004dbba0

Function at 0x4dce00
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4dcee8
sub rsp, 0x40
mov qword [rsp + 0x38], rbp
lea rbp, [rsp + 0x38]
movabs rdx, 0x305f446125445b46
mov qword [rsp + 0x19], rdx
movabs rdx, 0x4750414749305f44
mov qword [rsp + 0x1e], rdx
movabs rdx, 0x90201030b05090c
mov qword [rsp + 0x26], rdx
movabs rdx, 0x401090201030b05
mov qword [rsp + 0x28], rdx
movabs rdx, 0xb0907060c0a0704
mov qword [rsp + 0x30], rdx
xor eax, eax
jmp 0x4dce81
movzx r9d, byte [rsp + rsi + 0x19]
add r9d, 4
add edx, r9d
mov byte [rsp + rdi + 0x19], dl
mov byte [rsp + rsi + 0x19], r8b
add rax, 2
cmp rax, 0x12
jge 0x4dceb2
movzx edx, byte [rsp + rax + 0x26]
movzx esi, byte [rsp + rax + 0x27]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0xd
jae 0x4dcedb
movzx r8d, byte [rsp + rdi + 0x19]
add r8d, 4
add r8d, edx
cmp rsi, 0xd
jb 0x4dce67
jmp 0x4dcecf
xor eax, eax
lea rbx, [rsp + 0x19]
mov ecx, 0xd
nop
call fcn.004446e0
mov rbp, qword [rsp + 0x38]
add rsp, 0x40
ret
mov eax, esi
mov ecx, 0xd
call fcn.00457420
mov eax, edi
mov ecx, 0xd
call fcn.00457420
nop
call fcn.00454dc0
jmp fcn.004dce00
Function at 0x4dd300
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4dd3c8
sub rsp, 0x38
mov qword [rsp + 0x30], rbp
lea rbp, [rsp + 0x30]
movabs rdx, 0x59535a653e675360
mov qword [rsp + 0x1d], rdx
mov byte [rsp + 0x25], 0x6f
movabs rdx, 0x600050503050507
mov qword [rsp + 0x26], rdx
mov word [rsp + 0x2e], 0x502
xor eax, eax
jmp 0x4dd360
movzx r9d, byte [rsp + rsi + 0x1d]
add r9d, 0xfffffff8
add edx, r9d
mov byte [rsp + rdi + 0x1d], dl
mov byte [rsp + rsi + 0x1d], r8b
add rax, 2
cmp rax, 0xa
jge 0x4dd391
movzx edx, byte [rsp + rax + 0x26]
movzx esi, byte [rsp + rax + 0x27]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 9
jae 0x4dd3bb
movzx r8d, byte [rsp + rdi + 0x1d]
add r8d, 0xfffffff8
add r8d, edx
cmp rsi, 9
jb 0x4dd346
jmp 0x4dd3af
xor eax, eax
lea rbx, [rsp + 0x1d]
mov ecx, 9
nop dword [rax]
call fcn.004446e0
mov rbp, qword [rsp + 0x30]
add rsp, 0x38
ret
mov eax, esi
mov ecx, 9
call fcn.00457420
mov eax, edi
mov ecx, 9
call fcn.00457420
nop
call fcn.00454dc0
jmp fcn.004dd300

Function at 0x4dd9a0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4dda7c
sub rsp, 0x40
mov qword [rsp + 0x38], rbp
lea rbp, [rsp + 0x38]
movabs rdx, 0x62e7acba73bca29d
mov qword [rsp + 0x1d], rdx
movabs rdx, 0xe86d616ea562e7ac
mov qword [rsp + 0x22], rdx
movabs rdx, 0xc00060406020203
mov qword [rsp + 0x2a], rdx
movabs rdx, 0x2050801040c00
mov qword [rsp + 0x30], rdx
xor eax, eax
jmp 0x4dda12
movzx r9d, byte [rsp + rsi + 0x1d]
add r9d, 0xffffffb6
add edx, r9d
mov byte [rsp + rdi + 0x1d], dl
mov byte [rsp + rsi + 0x1d], r8b
add rax, 2
cmp rax, 0xe
jge 0x4dda48
movzx edx, byte [rsp + rax + 0x2a]
movzx esi, byte [rsp + rax + 0x2b]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0xd
jae 0x4dda6f
movzx r8d, byte [rsp + rdi + 0x1d]
add r8d, 0xffffffb6
add r8d, edx
nop dword [rax + rax]
cmp rsi, 0xd
jb 0x4dd9f8
jmp 0x4dda63
xor eax, eax
lea rbx, [rsp + 0x1d]
mov ecx, 0xd
call fcn.004446e0
mov rbp, qword [rsp + 0x38]
add rsp, 0x40
ret
mov eax, esi
mov ecx, 0xd
call fcn.00457420
mov eax, edi
mov ecx, 0xd
call fcn.00457420
nop
nop dword [rax]
call fcn.00454dc0
jmp fcn.004dd9a0

Function at 0x4ddfe0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4de09c
sub rsp, 0x30
mov qword [rsp + 0x28], rbp
lea rbp, [rsp + 0x28]
movabs rdx, 0xb377b2c1f5b568fb
mov qword [rsp + 0x20], rdx
movabs rdx, 0x402030205070200
mov qword [rsp + 0x18], rdx
xor eax, eax
jmp 0x4de037
movzx r9d, byte [rsp + rsi + 0x20]
sub r9d, edx
lea edx, [r9 - 0x40]
mov byte [rsp + rdi + 0x20], dl
lea edx, [r8 - 0x40]
mov byte [rsp + rsi + 0x20], dl
add rax, 2
cmp rax, 8
jge 0x4de068
movzx edx, byte [rsp + rax + 0x18]
movzx esi, byte [rsp + rax + 0x19]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 8
jae 0x4de08f
movzx r8d, byte [rsp + rdi + 0x20]
sub r8d, edx
nop dword [rax]
cmp rsi, 8
jb 0x4de01a
jmp 0x4de083
xor eax, eax
lea rbx, [rsp + 0x20]
mov ecx, 8
call fcn.004446e0
mov rbp, qword [rsp + 0x28]
add rsp, 0x30
ret
mov eax, esi
mov ecx, 8
call fcn.00457420
mov eax, edi
mov ecx, 8
call fcn.00457420
nop
nop dword [rax]
call fcn.00454dc0
jmp fcn.004ddfe0
Function at 0x4e2a40
Capabilities:
Encrypt data using rc4 prga

Disassembly:
lea r12, [rsp - 0x18]
cmp r12, qword [r14 + 0x10]
jbe 0x4e2bd5
sub rsp, 0x98
mov qword [rsp + 0x90], rbp
lea rbp, [rsp + 0x90]
movabs rdx, 0x246c6c6da2d6cfc8
mov qword [rsp + 0x1a], rdx
movabs rdx, 0xbc9a72df72426358
mov qword [rsp + 0x22], rdx
movabs rdx, 0xca1b4e9d7e74dda3
mov qword [rsp + 0x2a], rdx
movabs rdx, 0x24c5a8738c78e94f
mov qword [rsp + 0x32], rdx
movabs rdx, 0xafc4e3d572586f74
mov qword [rsp + 0x3a], rdx
movabs rdx, 0x3631c789483aa81d
mov qword [rsp + 0x42], rdx
movabs rdx, 0x8220029101b0c0d
mov qword [rsp + 0x4a], rdx
movabs rdx, 0x29230e1b03280822
mov qword [rsp + 0x50], rdx
movabs rdx, 0x92b18231f2b2b1a
mov qword [rsp + 0x58], rdx
movabs rdx, 0x11261e2a19141f04
mov qword [rsp + 0x60], rdx
movabs rdx, 0x91426231a091f27
mov qword [rsp + 0x68], rdx
movabs rdx, 0x1f131d2d13071417
mov qword [rsp + 0x70], rdx
movabs rdx, 0x2241f1a0f131604
mov qword [rsp + 0x78], rdx
movabs rdx, 0xf2b14160a250d27
mov qword [rsp + 0x80], rdx
movabs rdx, 0x1e01250304260f2c
mov qword [rsp + 0x88], rdx
xor eax, eax
jmp 0x4e2b6e
movzx r9d, byte [rsp + rsi + 0x1a]
sub r9d, edx
lea edx, [r9 - 8]
mov byte [rsp + rdi + 0x1a], dl
lea edx, [r8 - 8]
mov byte [rsp + rsi + 0x1a], dl
add rax, 2
cmp rax, 0x46
jge 0x4e2b9b
movzx edx, byte [rsp + rax + 0x4a]
movzx esi, byte [rsp + rax + 0x4b]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x30
jae 0x4e2bc8
movzx r8d, byte [rsp + rdi + 0x1a]
sub r8d, edx
cmp rsi, 0x30
jb 0x4e2b51
jmp 0x4e2bbc
xor eax, eax
lea rbx, [rsp + 0x1a]
mov ecx, 0x30
call fcn.004446e0
mov rbp, qword [rsp + 0x90]
add rsp, 0x98
ret
mov eax, esi
mov ecx, 0x30
call fcn.00457420
mov eax, edi
mov ecx, 0x30
call fcn.00457420
nop
call fcn.00454dc0
jmp fcn.004e2a40

Function at 0x4efa20
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4efb0b
sub rsp, 0x48
mov qword [rsp + 0x40], rbp
lea rbp, [rsp + 0x40]
movabs rdx, 0xaa9b657472cf9ba5
mov qword [rsp + 0x1d], rdx
movabs rdx, 0x8ea2947e656565aa
mov qword [rsp + 0x24], rdx
movabs rdx, 0xc070e0d04060601
mov qword [rsp + 0x2c], rdx
movabs rdx, 0x20e02020c070e0d
mov qword [rsp + 0x30], rdx
movabs rdx, 0xb00010e0903090c
mov qword [rsp + 0x38], rdx
xor eax, eax
jmp 0x4efaa4
movzx r9d, byte [rsp + rsi + 0x1d]
sub r9d, edx
lea edx, [r9 - 0xf]
mov byte [rsp + rdi + 0x1d], dl
lea edx, [r8 - 0xf]
mov byte [rsp + rsi + 0x1d], dl
add rax, 2
cmp rax, 0x14
jge 0x4efad7
movzx edx, byte [rsp + rax + 0x2c]
movzx esi, byte [rsp + rax + 0x2d]
mov edi, edx
xor edx, esi
add edx, eax
nop word [rax + rax]
cmp rdi, 0xf
jae 0x4efafe
movzx r8d, byte [rsp + rdi + 0x1d]
sub r8d, edx
cmp rsi, 0xf
jb 0x4efa87
jmp 0x4efaf2
xor eax, eax
lea rbx, [rsp + 0x1d]
mov ecx, 0xf
call fcn.004446e0
mov rbp, qword [rsp + 0x40]
add rsp, 0x48
ret
mov eax, esi
mov ecx, 0xf
call fcn.00457420
mov eax, edi
mov ecx, 0xf
call fcn.00457420
nop
call fcn.00454dc0
jmp fcn.004efa20
Function at 0x4f28a0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4f2996
sub rsp, 0x50
mov qword [rsp + 0x48], rbp
lea rbp, [rsp + 0x48]
movabs rdx, 0x6e69ad130f6d20ff
mov qword [rsp + 0x1c], rdx
movabs rdx, 0x6c60766e69ad13
mov qword [rsp + 0x20], rdx
movabs rdx, 0x7265483a994f5e64
mov qword [rsp + 0x28], rdx
movabs rdx, 0xe0409050d001003
mov qword [rsp + 0x30], rdx
movabs rdx, 0x4110d1103040100
mov qword [rsp + 0x38], rdx
movabs rdx, 0x1030b090d05010f
mov qword [rsp + 0x40], rdx
xor eax, eax
jmp 0x4f2930
movzx r9d, byte [rsp + rsi + 0x1c]
add r9d, 0x4b
add edx, r9d
mov byte [rsp + rdi + 0x1c], dl
mov byte [rsp + rsi + 0x1c], r8b
add rax, 2
cmp rax, 0x18
jge 0x4f2962
movzx edx, byte [rsp + rax + 0x30]
movzx esi, byte [rsp + rax + 0x31]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x14
jae 0x4f2989
movzx r8d, byte [rsp + rdi + 0x1c]
add r8d, 0x4b
add r8d, edx
cmp rsi, 0x14
jb 0x4f2916
nop
jmp 0x4f297d
xor eax, eax
lea rbx, [rsp + 0x1c]
mov ecx, 0x14
call fcn.004446e0
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
mov eax, esi
mov ecx, 0x14
call fcn.00457420
mov eax, edi
mov ecx, 0x14
call fcn.00457420
nop
call fcn.00454dc0
nop dword [rax + rax]
jmp fcn.004f28a0

Function at 0x4fa0c0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4fa1e6
sub rsp, 0x60
mov qword [rsp + 0x58], rbp
lea rbp, [rsp + 0x58]
movabs rdx, 0x3b552033f7756f53
mov qword [rsp + 0x1a], rdx
movabs rdx, 0x4474612061630a62
mov qword [rsp + 0x22], rdx
movabs rdx, 0x4523447461206163
mov qword [rsp + 0x24], rdx
movabs rdx, 0x683f654e335a7270
mov qword [rsp + 0x2c], rdx
movabs rdx, 0x416151509090309
mov qword [rsp + 0x34], rdx
movabs rdx, 0x914071604161515
mov qword [rsp + 0x38], rdx
movabs rdx, 0x180609170300100f
mov qword [rsp + 0x40], rdx
movabs rdx, 0xd19111012081408
mov qword [rsp + 0x48], rdx
movabs rdx, 0xf1510150d121818
mov qword [rsp + 0x50], rdx
xor eax, eax
jmp 0x4fa180
movzx r9d, byte [rsp + rsi + 0x1a]
sub r9d, edx
lea edx, [r9 + 0x32]
mov byte [rsp + rdi + 0x1a], dl
lea edx, [r8 + 0x32]
mov byte [rsp + rsi + 0x1a], dl
add rax, 2
cmp rax, 0x24
jge 0x4fa1ad
movzx edx, byte [rsp + rax + 0x34]
movzx esi, byte [rsp + rax + 0x35]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x1a
jae 0x4fa1d4
movzx r8d, byte [rsp + rdi + 0x1a]
sub r8d, edx
cmp rsi, 0x1a
jb 0x4fa163
jmp 0x4fa1c8
xor eax, eax
lea rbx, [rsp + 0x1a]
mov ecx, 0x1a
call fcn.004446e0
mov rbp, qword [rsp + 0x58]
add rsp, 0x60
ret
mov eax, esi
mov ecx, 0x1a
call fcn.00457420
mov eax, edi
mov ecx, 0x1a
nop dword [rax + rax]
call fcn.00457420
nop
call fcn.00454dc0
jmp fcn.004fa0c0
Function at 0x4fa200
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4fa328
sub rsp, 0x68
mov qword [rsp + 0x60], rbp
lea rbp, [rsp + 0x60]
movabs rdx, 0x8ac6eb9b0082ebc
mov qword [rsp + 0x1f], rdx
movabs rdx, 0xbb6c72ea1724a821
mov qword [rsp + 0x27], rdx
movabs rdx, 0x81cb617453b55dbb
mov qword [rsp + 0x2e], rdx
movabs rdx, 0xd4af69542064bfb7
mov qword [rsp + 0x36], rdx
movabs rdx, 0x151e0c1017080308
mov qword [rsp + 0x3e], rdx
movabs rdx, 0x70a151e0c101708
mov qword [rsp + 0x40], rdx
movabs rdx, 0xc071806110e0b02
mov qword [rsp + 0x48], rdx
movabs rdx, 0x100a0f0403101709
mov qword [rsp + 0x50], rdx
movabs rdx, 0x1d0709001802160b
mov qword [rsp + 0x58], rdx
xor eax, eax
jmp 0x4fa2c0
movzx r9d, byte [rsp + rsi + 0x1f]
add r9d, 0xffffff89
add edx, r9d
mov byte [rsp + rdi + 0x1f], dl
mov byte [rsp + rsi + 0x1f], r8b
add rax, 2
nop dword [rax]
cmp rax, 0x22
jge 0x4fa2f1
movzx edx, byte [rsp + rax + 0x3e]
movzx esi, byte [rsp + rax + 0x3f]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x1f
jae 0x4fa31b
movzx r8d, byte [rsp + rdi + 0x1f]
add r8d, 0xffffff89
add r8d, edx
cmp rsi, 0x1f
jb 0x4fa2a3
jmp 0x4fa30f
xor eax, eax
lea rbx, [rsp + 0x1f]
mov ecx, 0x1f
nop dword [rax]
call fcn.004446e0
mov rbp, qword [rsp + 0x60]
add rsp, 0x68
ret
mov eax, esi
mov ecx, 0x1f
call fcn.00457420
mov eax, edi
mov ecx, 0x1f
call fcn.00457420
nop
call fcn.00454dc0
jmp fcn.004fa200

Function at 0x4fa340
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4fa448
sub rsp, 0x58
mov qword [rsp + 0x50], rbp
lea rbp, [rsp + 0x50]
movabs rdx, 0x6369826641899144
mov qword [rsp + 0x1d], rdx
movabs rdx, 0x64bd616e7d698e63
mov qword [rsp + 0x24], rdx
movabs rdx, 0x4f75a654b167c6a6
mov qword [rsp + 0x2c], rdx
movabs rdx, 0xd0d111012160505
mov qword [rsp + 0x34], rdx
movabs rdx, 0xd0f1002140d0009
mov qword [rsp + 0x3c], rdx
movabs rdx, 0x5010d080d0f1002
mov qword [rsp + 0x40], rdx
movabs rdx, 0x141614110b150a0f
mov qword [rsp + 0x48], rdx
xor eax, eax
jmp 0x4fa3e0
movzx r9d, byte [rsp + rsi + 0x1d]
add r9d, 0xffffffcb
add edx, r9d
mov byte [rsp + rdi + 0x1d], dl
mov byte [rsp + rsi + 0x1d], r8b
add rax, 2
nop
cmp rax, 0x1c
jge 0x4fa411
movzx edx, byte [rsp + rax + 0x34]
movzx esi, byte [rsp + rax + 0x35]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x17
jae 0x4fa43b
movzx r8d, byte [rsp + rdi + 0x1d]
add r8d, 0xffffffcb
add r8d, edx
cmp rsi, 0x17
jb 0x4fa3c5
jmp 0x4fa42f
xor eax, eax
lea rbx, [rsp + 0x1d]
mov ecx, 0x17
nop dword [rax]
call fcn.004446e0
mov rbp, qword [rsp + 0x50]
add rsp, 0x58
ret
mov eax, esi
mov ecx, 0x17
call fcn.00457420
mov eax, edi
mov ecx, 0x17
call fcn.00457420
nop
call fcn.00454dc0
jmp fcn.004fa340
Function at 0x4fa760
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4fa856
sub rsp, 0x50
mov qword [rsp + 0x48], rbp
lea rbp, [rsp + 0x48]
movabs rdx, 0xc8da69c47f196121
mov qword [rsp + 0x1d], rdx
movabs rdx, 0xa456174dbc8da69
mov qword [rsp + 0x22], rdx
movabs rdx, 0x65a9d22de2a4bb61
mov qword [rsp + 0x2a], rdx
movabs rdx, 0xe000e0c11130204
mov qword [rsp + 0x32], rdx
movabs rdx, 0x6120307100b0e00
mov qword [rsp + 0x38], rdx
movabs rdx, 0x100f080e13100413
mov qword [rsp + 0x40], rdx
xor eax, eax
jmp 0x4fa7f3
movzx r9d, byte [rsp + rsi + 0x1d]
sub r9d, edx
lea edx, [r9 - 0x51]
mov byte [rsp + rdi + 0x1d], dl
lea edx, [r8 - 0x51]
mov byte [rsp + rsi + 0x1d], dl
add rax, 2
cmp rax, 0x16
jge 0x4fa822
movzx edx, byte [rsp + rax + 0x32]
movzx esi, byte [rsp + rax + 0x33]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x15
jae 0x4fa849
movzx r8d, byte [rsp + rdi + 0x1d]
sub r8d, edx
cmp rsi, 0x15
jb 0x4fa7d6
nop
jmp 0x4fa83d
xor eax, eax
lea rbx, [rsp + 0x1d]
mov ecx, 0x15
call fcn.004446e0
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
mov eax, esi
mov ecx, 0x15
call fcn.00457420
mov eax, edi
mov ecx, 0x15
call fcn.00457420
nop
call fcn.00454dc0
nop dword [rax + rax]
jmp fcn.004fa760

Function at 0x4fbe20
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4fbf48
sub rsp, 0x68
mov qword [rsp + 0x60], rbp
lea rbp, [rsp + 0x60]
movabs rdx, 0x20c27265f3b687e3
mov qword [rsp + 0x1a], rdx
movabs rdx, 0x5e8f98ab088eca53
mov qword [rsp + 0x22], rdx
movabs rdx, 0x7565ad9d54205e8f
mov qword [rsp + 0x28], rdx
movabs rdx, 0xe8792a78a16f87c1
mov qword [rsp + 0x30], rdx
movabs rdx, 0x160f1d090d031b03
mov qword [rsp + 0x38], rdx
movabs rdx, 0xc0c15030213001a
mov qword [rsp + 0x40], rdx
movabs rdx, 0xb090e1b12060b0b
mov qword [rsp + 0x48], rdx
movabs rdx, 0x31d0d13191a0e12
mov qword [rsp + 0x50], rdx
movabs rdx, 0xf0a181713091c01
mov qword [rsp + 0x58], rdx
xor eax, eax
jmp 0x4fbee0
movzx r9d, byte [rsp + rsi + 0x1a]
add r9d, 0xffffffab
add edx, r9d
mov byte [rsp + rdi + 0x1a], dl
mov byte [rsp + rsi + 0x1a], r8b
add rax, 2
nop dword [rax]
cmp rax, 0x28
jge 0x4fbf11
movzx edx, byte [rsp + rax + 0x38]
movzx esi, byte [rsp + rax + 0x39]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x1e
jae 0x4fbf3b
movzx r8d, byte [rsp + rdi + 0x1a]
add r8d, 0xffffffab
add r8d, edx
cmp rsi, 0x1e
jb 0x4fbec3
jmp 0x4fbf2f
xor eax, eax
lea rbx, [rsp + 0x1a]
mov ecx, 0x1e
nop dword [rax]
call fcn.004446e0
mov rbp, qword [rsp + 0x60]
add rsp, 0x68
ret
mov eax, esi
mov ecx, 0x1e
call fcn.00457420
mov eax, edi
mov ecx, 0x1e
call fcn.00457420
nop
call fcn.00454dc0
jmp fcn.004fbe20
Function at 0x4fd000
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4fd132
sub rsp, 0x68
mov qword [rsp + 0x60], rbp
lea rbp, [rsp + 0x60]
movabs rdx, 0x20250aaa740c314c
mov qword [rsp + 0x19], rdx
movabs rdx, 0xb6163e53f651841
mov qword [rsp + 0x21], rdx
movabs rdx, 0x2ce54f74530b6163
mov qword [rsp + 0x26], rdx
movabs rdx, 0x65f3064b015e452a
mov qword [rsp + 0x2e], rdx
movabs rdx, 0xc0418131804121b
mov qword [rsp + 0x36], rdx
movabs rdx, 0x914121a0f09121b
mov qword [rsp + 0x3e], rdx
movabs rdx, 0x60b0914121a0f09
mov qword [rsp + 0x40], rdx
movabs rdx, 0x11901050f1a0f13
mov qword [rsp + 0x48], rdx
movabs rdx, 0x9121502091a16
mov qword [rsp + 0x50], rdx
movabs rdx, 0xb170a1700040b12
mov qword [rsp + 0x58], rdx
xor eax, eax
jmp 0x4fd0cf
movzx r9d, byte [rsp + rsi + 0x19]
sub r9d, edx
lea edx, [r9 + 0x4a]
mov byte [rsp + rdi + 0x19], dl
lea edx, [r8 + 0x4a]
mov byte [rsp + rsi + 0x19], dl
add rax, 2
cmp rax, 0x2a
jge 0x4fd0fc
movzx edx, byte [rsp + rax + 0x36]
movzx esi, byte [rsp + rax + 0x37]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x1d
jae 0x4fd125
movzx r8d, byte [rsp + rdi + 0x19]
sub r8d, edx
cmp rsi, 0x1d
jb 0x4fd0b2
jmp 0x4fd117
xor eax, eax
lea rbx, [rsp + 0x19]
mov ecx, 0x1d
call fcn.004446e0
mov rbp, qword [rsp + 0x60]
add rsp, 0x68
ret
mov eax, esi
mov ecx, 0x1d
nop
call fcn.00457420
mov eax, edi
mov ecx, 0x1d
call fcn.00457420
nop
call fcn.00454dc0
jmp fcn.004fd000

Function at 0x4fe0c0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4fe1e6
sub rsp, 0x60
mov qword [rsp + 0x58], rbp
lea rbp, [rsp + 0x58]
movabs rdx, 0x625020741f693208
mov qword [rsp + 0x1c], rdx
movabs rdx, 0x615d692c5b725671
mov qword [rsp + 0x24], rdx
movabs rdx, 0x1e6e615d692c5b72
mov qword [rsp + 0x26], rdx
movabs rdx, 0x586d564c53626b54
mov qword [rsp + 0x2e], rdx
movabs rdx, 0xc00091103190b17
mov qword [rsp + 0x36], rdx
movabs rdx, 0x1000c0009110319
mov qword [rsp + 0x38], rdx
movabs rdx, 0xb19081319071912
mov qword [rsp + 0x40], rdx
movabs rdx, 0x1219011416120d15
mov qword [rsp + 0x48], rdx
movabs rdx, 0xb091203080e1509
mov qword [rsp + 0x50], rdx
xor eax, eax
jmp 0x4fe180
movzx r9d, byte [rsp + rsi + 0x1c]
sub r9d, edx
lea edx, [r9 + 0x2a]
mov byte [rsp + rdi + 0x1c], dl
lea edx, [r8 + 0x2a]
mov byte [rsp + rsi + 0x1c], dl
add rax, 2
cmp rax, 0x22
jge 0x4fe1ad
movzx edx, byte [rsp + rax + 0x36]
movzx esi, byte [rsp + rax + 0x37]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x1a
jae 0x4fe1d4
movzx r8d, byte [rsp + rdi + 0x1c]
sub r8d, edx
cmp rsi, 0x1a
jb 0x4fe163
jmp 0x4fe1c8
xor eax, eax
lea rbx, [rsp + 0x1c]
mov ecx, 0x1a
call fcn.004446e0
mov rbp, qword [rsp + 0x58]
add rsp, 0x60
ret
mov eax, esi
mov ecx, 0x1a
call fcn.00457420
mov eax, edi
mov ecx, 0x1a
nop dword [rax + rax]
call fcn.00457420
nop
call fcn.00454dc0
jmp fcn.004fe0c0
Function at 0x4ff3a0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4ff4b2
sub rsp, 0x60
mov qword [rsp + 0x58], rbp
lea rbp, [rsp + 0x58]
movabs rdx, 0x5863694a7c583316
mov qword [rsp + 0x1e], rdx
movabs rdx, 0x781b6b3a50683753
mov qword [rsp + 0x26], rdx
movabs rdx, 0x66a696e4b645561
mov qword [rsp + 0x2e], rdx
movabs rdx, 0xd09010417130109
mov qword [rsp + 0x36], rdx
movabs rdx, 0xf0b0d0901041713
mov qword [rsp + 0x38], rdx
movabs rdx, 0x9001509001609
mov qword [rsp + 0x40], rdx
movabs rdx, 0xa020a0e090c0e07
mov qword [rsp + 0x48], rdx
movabs rdx, 0xb11000a11141603
mov qword [rsp + 0x50], rdx
xor eax, eax
jmp 0x4ff451
movzx r9d, byte [rsp + rsi + 0x1e]
sub r9d, edx
lea edx, [r9 + 0x20]
mov byte [rsp + rdi + 0x1e], dl
lea edx, [r8 + 0x20]
mov byte [rsp + rsi + 0x1e], dl
add rax, 2
cmp rax, 0x22
jge 0x4ff47e
movzx edx, byte [rsp + rax + 0x36]
movzx esi, byte [rsp + rax + 0x37]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x18
jae 0x4ff4a5
movzx r8d, byte [rsp + rdi + 0x1e]
sub r8d, edx
cmp rsi, 0x18
jb 0x4ff434
jmp 0x4ff499
xor eax, eax
lea rbx, [rsp + 0x1e]
mov ecx, 0x18
call fcn.004446e0
mov rbp, qword [rsp + 0x58]
add rsp, 0x60
ret
mov eax, esi
mov ecx, 0x18
call fcn.00457420
mov eax, edi
mov ecx, 0x18
call fcn.00457420
nop
call fcn.00454dc0
jmp fcn.004ff3a0
Function at 0x5003e0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x500508
sub rsp, 0x60
mov qword [rsp + 0x58], rbp
lea rbp, [rsp + 0x58]
movabs rdx, 0xb82aaf7207290c03
mov qword [rsp + 0x18], rdx
movabs rdx, 0xf3685302b34a125d
mov qword [rsp + 0x20], rdx
movabs rdx, 0x6494f3685302b34a
mov qword [rsp + 0x22], rdx
movabs rdx, 0x65d915cee6c3b3b0
mov qword [rsp + 0x2a], rdx
movabs rdx, 0x11206020815160a
mov qword [rsp + 0x32], rdx
movabs rdx, 0xf16060e050b0112
mov qword [rsp + 0x38], rdx
movabs rdx, 0x130a170314170e0a
mov qword [rsp + 0x40], rdx
movabs rdx, 0x10010715090a1800
mov qword [rsp + 0x48], rdx
movabs rdx, 0xc060f0f0505010b
mov qword [rsp + 0x50], rdx
xor eax, eax
jmp 0x5004a0
movzx r9d, byte [rsp + rsi + 0x18]
add r9d, 0x3c
add edx, r9d
mov byte [rsp + rdi + 0x18], dl
mov byte [rsp + rsi + 0x18], r8b
add rax, 2
nop dword [rax]
cmp rax, 0x26
jge 0x5004d1
movzx edx, byte [rsp + rax + 0x32]
movzx esi, byte [rsp + rax + 0x33]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x1a
jae 0x5004fb
movzx r8d, byte [rsp + rdi + 0x18]
add r8d, 0x3c
add r8d, edx
cmp rsi, 0x1a
jb 0x500483
jmp 0x5004ef
xor eax, eax
lea rbx, [rsp + 0x18]
mov ecx, 0x1a
nop dword [rax]
call fcn.004446e0
mov rbp, qword [rsp + 0x58]
add rsp, 0x60
ret
mov eax, esi
mov ecx, 0x1a
call fcn.00457420
mov eax, edi
mov ecx, 0x1a
call fcn.00457420
nop
call fcn.00454dc0
jmp fcn.005003e0

Function at 0x500c40
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x500d36
sub rsp, 0x50
mov qword [rsp + 0x48], rbp
lea rbp, [rsp + 0x48]
movabs rdx, 0xd553d66961b464cd
mov qword [rsp + 0x1d], rdx
movabs rdx, 0x54e061d553d66961
mov qword [rsp + 0x20], rdx
movabs rdx, 0x6532da15e8dd9061
mov qword [rsp + 0x28], rdx
movabs rdx, 0x109100000010f07
mov qword [rsp + 0x30], rdx
movabs rdx, 0x101070e01000a05
mov qword [rsp + 0x38], rdx
movabs rdx, 0xd0900020911050c
mov qword [rsp + 0x40], rdx
xor eax, eax
jmp 0x500cd0
movzx r9d, byte [rsp + rsi + 0x1d]
add r9d, 0x77
add edx, r9d
mov byte [rsp + rdi + 0x1d], dl
mov byte [rsp + rsi + 0x1d], r8b
add rax, 2
cmp rax, 0x18
jge 0x500d02
movzx edx, byte [rsp + rax + 0x30]
movzx esi, byte [rsp + rax + 0x31]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x13
jae 0x500d29
movzx r8d, byte [rsp + rdi + 0x1d]
add r8d, 0x77
add r8d, edx
cmp rsi, 0x13
jb 0x500cb6
nop
jmp 0x500d1d
xor eax, eax
lea rbx, [rsp + 0x1d]
mov ecx, 0x13
call fcn.004446e0
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
mov eax, esi
mov ecx, 0x13
call fcn.00457420
mov eax, edi
mov ecx, 0x13
call fcn.00457420
nop
call fcn.00454dc0
nop dword [rax + rax]
jmp fcn.00500c40