joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4aa1e0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
lea r12, [rsp - 0x10]
cmp r12, qword [r14 + 0x10]
jbe 0x4aa367
push rbp
mov rbp, rsp
sub rsp, 0x88
movabs rdx, 0x45e7e7496c601050
mov qword [rsp + 0x19], rdx
movabs rdx, 0x4345e7e7496c6010
mov qword [rsp + 0x1a], rdx
movabs rdx, 0xb6c532e652e6c61
mov qword [rsp + 0x22], rdx
movabs rdx, 0x2076441520438508
mov qword [rsp + 0x2a], rdx
movabs rdx, 0x4f071420667b206f
mov qword [rsp + 0x32], rdx
movabs rdx, 0xe5b5f736f60fc4c
mov qword [rsp + 0x3a], rdx
movabs rdx, 0x3d3b321f6120656c
mov qword [rsp + 0x42], rdx
movabs rdx, 0x2261b1211233010
mov qword [rsp + 0x4a], rdx
movabs rdx, 0x1010211624280822
mov qword [rsp + 0x52], rdx
movabs rdx, 0x191001242e301010
mov qword [rsp + 0x58], rdx
movabs rdx, 0x262215111f232f15
mov qword [rsp + 0x60], rdx
movabs rdx, 0x408272000261517
mov qword [rsp + 0x68], rdx
movabs rdx, 0x2e06181823052d07
mov qword [rsp + 0x70], rdx
movabs rdx, 0x1f062f0b30271304
mov qword [rsp + 0x78], rdx
movabs rdx, 0x2319241e182e0107
mov qword [rsp + 0x80], rdx
xor eax, eax
jmp 0x4aa300
movzx r9d, byte [rsp + rsi + 0x19]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x23]
mov byte [rsp + rdi + 0x19], dl
mov byte [rsp + rsi + 0x19], r8b
add rax, 2
nop dword [rax]
cmp rax, 0x3e
jge 0x4aa332
movzx edx, byte [rsp + rax + 0x4a]
movzx esi, byte [rsp + rax + 0x4b]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x31
jae 0x4aa35a
movzx r8d, byte [rsp + rdi + 0x19]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x23]
cmp rsi, 0x31
jb 0x4aa2e2
jmp 0x4aa34e
xor eax, eax
lea rbx, [rsp + 0x19]
mov ecx, 0x31
nop
call fcn.0044bb20
add rsp, 0x88
pop rbp
ret
mov eax, esi
mov ecx, 0x31
call fcn.00461020
mov eax, edi
mov ecx, 0x31
call fcn.00461020
nop
call fcn.0045eda0
jmp fcn.004aa1e0
Function at 0x4ac6a0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
lea r12, [rsp - 0x40]
cmp r12, qword [r14 + 0x10]
jbe 0x4ac800
push rbp
mov rbp, rsp
sub rsp, 0xb8
movabs rdx, 0xb772cc5fb6706196
mov qword [rsp + 0x19], rdx
movabs rdx, 0xa787b0207404654e
mov qword [rsp + 0x21], rdx
movabs rdx, 0x842094656ca787b0
mov qword [rsp + 0x26], rdx
movabs rdx, 0x14cc69c5f561f9c7
mov qword [rsp + 0x2e], rdx
movabs rdx, 0x685558916f2a6172
mov qword [rsp + 0x36], rdx
movabs rdx, 0x74bea8a464207537
mov qword [rsp + 0x3e], rdx
movabs rdx, 0xc5ae61e020746f6e
mov qword [rsp + 0x46], rdx
movabs rdx, 0x108f7388c7779721
mov qword [rsp + 0x4e], rdx
movabs rdx, 0xb764665efd273ca
mov qword [rsp + 0x56], rdx
movabs rdx, 0x29376cfddd207061
mov qword [rsp + 0x5e], rdx
movabs rdx, 0x21142b140a492a3c
mov qword [rsp + 0x66], rdx
lea rdi, [rsp + 0x68]
lea rsi, [0x006c0932]
mov qword [rsp - 0x10], rbp
lea rbp, [rsp - 0x10]
call fcn.0046165a
mov rbp, qword [rbp]
xor eax, eax
jmp 0x4ac7a0
movzx r9d, byte [rsp + rsi + 0x19]
sub r9d, edx
lea edx, [r9 + 0x19]
mov byte [rsp + rdi + 0x19], dl
lea edx, [r8 + 0x19]
mov byte [rsp + rsi + 0x19], dl
add rax, 2
nop
cmp rax, 0x52
jge 0x4ac7cd
movzx edx, byte [rsp + rax + 0x66]
movzx esi, byte [rsp + rax + 0x67]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x4d
jae 0x4ac7f3
movzx r8d, byte [rsp + rdi + 0x19]
sub r8d, edx
cmp rsi, 0x4d
jb 0x4ac782
jmp 0x4ac7e7
xor eax, eax
lea rbx, [rsp + 0x19]
mov ecx, 0x4d
call fcn.0044bb20
add rsp, 0xb8
pop rbp
ret
mov eax, esi
mov ecx, 0x4d
call fcn.00461020
mov eax, edi
mov ecx, 0x4d
call fcn.00461020
nop
call fcn.0045eda0
jmp fcn.004ac6a0
Function at 0x4ad120
Capabilities:
Encrypt data using rc4 prga

Disassembly:
lea r12, [rsp - 8]
cmp r12, qword [r14 + 0x10]
jbe 0x4ad28c
push rbp
mov rbp, rsp
add rsp, 0xffffffffffffff80
movabs rdx, 0x1172aea54021334e
mov qword [rsp + 0x1c], rdx
movabs rdx, 0x6142206550404f36
mov qword [rsp + 0x24], rdx
movabs rdx, 0x6cd7614220655040
mov qword [rsp + 0x26], rdx
movabs rdx, 0x39652f6e1b216431
mov qword [rsp + 0x2e], rdx
movabs rdx, 0x6c643046730fbd68
mov qword [rsp + 0x36], rdx
movabs rdx, 0xfef174627c08500e
mov qword [rsp + 0x3e], rdx
movabs rdx, 0x291b0b0026040100
mov qword [rsp + 0x46], rdx
movabs rdx, 0x1226140705010529
mov qword [rsp + 0x4e], rdx
movabs rdx, 0x1b10122614070501
mov qword [rsp + 0x50], rdx
movabs rdx, 0x211b091021250302
mov qword [rsp + 0x58], rdx
movabs rdx, 0x150b291f01140803
mov qword [rsp + 0x60], rdx
movabs rdx, 0x120823280e091b0a
mov qword [rsp + 0x68], rdx
movabs rdx, 0x151e02191f22090b
mov qword [rsp + 0x70], rdx
movabs rdx, 0x231c050108240a17
mov qword [rsp + 0x78], rdx
xor eax, eax
jmp 0x4ad227
movzx r9d, byte [rsp + rsi + 0x1c]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x12]
mov byte [rsp + rdi + 0x1c], dl
mov byte [rsp + rsi + 0x1c], r8b
add rax, 2
cmp rax, 0x3a
jge 0x4ad25c
movzx edx, byte [rsp + rax + 0x46]
movzx esi, byte [rsp + rax + 0x47]
mov edi, edx
xor edx, esi
add edx, eax
nop dword [rax]
cmp rdi, 0x2a
jae 0x4ad27f
movzx r8d, byte [rsp + rdi + 0x1c]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x12]
cmp rsi, 0x2a
jb 0x4ad20d
jmp 0x4ad273
xor eax, eax
lea rbx, [rsp + 0x1c]
mov ecx, 0x2a
call fcn.0044bb20
sub rsp, 0xffffffffffffff80
pop rbp
ret
mov eax, esi
mov ecx, 0x2a
call fcn.00461020
mov eax, edi
mov ecx, 0x2a
call fcn.00461020
nop
call fcn.0045eda0
jmp fcn.004ad120

Function at 0x4ad2a0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4ad3a8
push rbp
mov rbp, rsp
sub rsp, 0x58
movabs rdx, 0x2e726367805d6b4d
mov qword [rsp + 0x3a], rdx
movabs rdx, 0x85336b632073674b
mov qword [rsp + 0x42], rdx
movabs rdx, 0x7d654b2065658533
mov qword [rsp + 0x48], rdx
movabs rdx, 0x5878724e74658864
mov qword [rsp + 0x50], rdx
movabs rdx, 0x131d160405191905
mov qword [rsp + 0x1c], rdx
movabs rdx, 0xf19031d02090419
mov qword [rsp + 0x24], rdx
movabs rdx, 0x1b110f09170a0f19
mov qword [rsp + 0x2a], rdx
movabs rdx, 0x10d0e1911170415
mov qword [rsp + 0x32], rdx
xor eax, eax
jmp 0x4ad34b
movzx r9d, byte [rsp + rsi + 0x3a]
sub r9d, edx
lea edx, [r9 + 0x1e]
mov byte [rsp + rdi + 0x3a], dl
lea edx, [r8 + 0x1e]
mov byte [rsp + rsi + 0x3a], dl
add rax, 2
cmp rax, 0x1e
jge 0x4ad378
movzx edx, byte [rsp + rax + 0x1c]
movzx esi, byte [rsp + rax + 0x1d]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x1e
jae 0x4ad39b
movzx r8d, byte [rsp + rdi + 0x3a]
sub r8d, edx
cmp rsi, 0x1e
jb 0x4ad32e
jmp 0x4ad38f
xor eax, eax
lea rbx, [rsp + 0x3a]
mov ecx, 0x1e
call fcn.0044bb20
add rsp, 0x58
pop rbp
ret
mov eax, esi
mov ecx, 0x1e
call fcn.00461020
mov eax, edi
mov ecx, 0x1e
call fcn.00461020
nop
call fcn.0045eda0
jmp fcn.004ad2a0
Function at 0x4ad3c0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4ad4f8
push rbp
mov rbp, rsp
sub rsp, 0x70
movabs rdx, 0x2e72decaffb061b6
mov qword [rsp + 0x18], rdx
movabs rdx, 0x4c7b4dc1fbc7654b
mov qword [rsp + 0x20], rdx
movabs rdx, 0x2d6520a2d020d8a4
mov qword [rsp + 0x28], rdx
movabs rdx, 0x20c942ca731ff768
mov qword [rsp + 0x30], rdx
movabs rdx, 0x6c0d42d172dfced0
mov qword [rsp + 0x38], rdx
movabs rdx, 0x19051a24261e260d
mov qword [rsp + 0x40], rdx
movabs rdx, 0xf0b17170e272703
mov qword [rsp + 0x48], rdx
movabs rdx, 0x25111d2013262713
mov qword [rsp + 0x50], rdx
movabs rdx, 0xc240d170a201310
mov qword [rsp + 0x58], rdx
movabs rdx, 0x1e0d041c00191121
mov qword [rsp + 0x60], rdx
movabs rdx, 0x10220f1405020314
mov qword [rsp + 0x68], rdx
xor eax, eax
jmp 0x4ad498
movzx r9d, byte [rsp + rsi + 0x18]
sub r9d, edx
lea edx, [r9 - 0x1a]
mov byte [rsp + rdi + 0x18], dl
lea edx, [r8 - 0x1a]
mov byte [rsp + rsi + 0x18], dl
add rax, 2
cmp rax, 0x30
jge 0x4ad4c8
movzx edx, byte [rsp + rax + 0x40]
movzx esi, byte [rsp + rax + 0x41]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x28
jae 0x4ad4eb
movzx r8d, byte [rsp + rdi + 0x18]
sub r8d, edx
nop dword [rax]
cmp rsi, 0x28
jb 0x4ad47b
jmp 0x4ad4df
xor eax, eax
lea rbx, [rsp + 0x18]
mov ecx, 0x28
call fcn.0044bb20
add rsp, 0x70
pop rbp
ret
mov eax, esi
mov ecx, 0x28
call fcn.00461020
mov eax, edi
mov ecx, 0x28
call fcn.00461020
nop
call fcn.0045eda0
nop dword [rax]
jmp fcn.004ad3c0

Function at 0x4ae320
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4ae40c
push rbp
mov rbp, rsp
sub rsp, 0x40
movabs rdx, 0xe45963bb6c666572
mov qword [rsp + 0x1d], rdx
movabs rdx, 0x56e45963bb6c6665
mov qword [rsp + 0x1e], rdx
movabs rdx, 0x68b2e22e62edd2e8
mov qword [rsp + 0x26], rdx
movabs rdx, 0xb0e040609060e06
mov qword [rsp + 0x2e], rdx
movabs rdx, 0xb070b0e04060906
mov qword [rsp + 0x30], rdx
movabs rdx, 0x100e070c0f0b0e0a
mov qword [rsp + 0x38], rdx
xor eax, eax
jmp 0x4ae3aa
movzx r9d, byte [rsp + rsi + 0x1d]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x4d]
mov byte [rsp + rdi + 0x1d], dl
mov byte [rsp + rsi + 0x1d], r8b
add rax, 2
cmp rax, 0x12
jge 0x4ae3dc
movzx edx, byte [rsp + rax + 0x2e]
movzx esi, byte [rsp + rax + 0x2f]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x11
jae 0x4ae3ff
movzx r8d, byte [rsp + rdi + 0x1d]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x4d]
cmp rsi, 0x11
jb 0x4ae390
jmp 0x4ae3f3
xor eax, eax
lea rbx, [rsp + 0x1d]
mov ecx, 0x11
call fcn.0044bb20
add rsp, 0x40
pop rbp
ret
mov eax, esi
mov ecx, 0x11
call fcn.00461020
mov eax, edi
mov ecx, 0x11
call fcn.00461020
nop
call fcn.0045eda0
jmp fcn.004ae320
Function at 0x4ae940
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4aea48
push rbp
mov rbp, rsp
sub rsp, 0x50
movabs rdx, 0x2073ecb265ddd573
mov qword [rsp + 0x19], rdx
movabs rdx, 0x6ba3a6f4a872766e
mov qword [rsp + 0x21], rdx
movabs rdx, 0x206ba3a6f4a87276
mov qword [rsp + 0x22], rdx
movabs rdx, 0x488012e5659d83c
mov qword [rsp + 0x2a], rdx
movabs rdx, 0x10a131217140f0a
mov qword [rsp + 0x32], rdx
movabs rdx, 0x80e050213011417
mov qword [rsp + 0x3a], rdx
movabs rdx, 0x40d010c0c02080e
mov qword [rsp + 0x40], rdx
movabs rdx, 0x18130b0e1712160f
mov qword [rsp + 0x48], rdx
xor eax, eax
jmp 0x4ae9eb
movzx r9d, byte [rsp + rsi + 0x19]
sub r9d, edx
lea edx, [r9 - 0x69]
mov byte [rsp + rdi + 0x19], dl
lea edx, [r8 - 0x69]
mov byte [rsp + rsi + 0x19], dl
add rax, 2
cmp rax, 0x1e
jge 0x4aea18
movzx edx, byte [rsp + rax + 0x32]
movzx esi, byte [rsp + rax + 0x33]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x19
jae 0x4aea3b
movzx r8d, byte [rsp + rdi + 0x19]
sub r8d, edx
cmp rsi, 0x19
jb 0x4ae9ce
jmp 0x4aea2f
xor eax, eax
lea rbx, [rsp + 0x19]
mov ecx, 0x19
call fcn.0044bb20
add rsp, 0x50
pop rbp
ret
mov eax, esi
mov ecx, 0x19
call fcn.00461020
mov eax, edi
mov ecx, 0x19
call fcn.00461020
nop
call fcn.0045eda0
jmp fcn.004ae940

Function at 0x4b0660
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4b07a7
push rbp
mov rbp, rsp
sub rsp, 0x78
movabs rdx, 0x2e346365acc31950
mov qword [rsp + 0x1d], rdx
movabs rdx, 0x444d6c54562e3463
mov qword [rsp + 0x22], rdx
movabs rdx, 0x1fe87301692e2ee0
mov qword [rsp + 0x2a], rdx
movabs rdx, 0x9e62c7430d6e2166
mov qword [rsp + 0x32], rdx
movabs rdx, 0xfe25193e6a4365e4
mov qword [rsp + 0x3a], rdx
movabs rdx, 0x1413111d1918111a
mov qword [rsp + 0x42], rdx
movabs rdx, 0x1c10181010131413
mov qword [rsp + 0x48], rdx
movabs rdx, 0x20118240e220e11
mov qword [rsp + 0x50], rdx
movabs rdx, 0x113030f0c232223
mov qword [rsp + 0x58], rdx
movabs rdx, 0x21240d01180e0f1f
mov qword [rsp + 0x60], rdx
movabs rdx, 0x140910201610130c
mov qword [rsp + 0x68], rdx
movabs rdx, 0xb001a01091c1a06
mov qword [rsp + 0x70], rdx
xor eax, eax
jmp 0x4b0747
movzx r9d, byte [rsp + rsi + 0x1d]
sub r9d, edx
lea edx, [r9 + 0x64]
mov byte [rsp + rdi + 0x1d], dl
lea edx, [r8 + 0x64]
mov byte [rsp + rsi + 0x1d], dl
add rax, 2
cmp rax, 0x36
jge 0x4b0777
movzx edx, byte [rsp + rax + 0x42]
movzx esi, byte [rsp + rax + 0x43]
mov edi, edx
xor edx, esi
add edx, eax
nop dword [rax]
cmp rdi, 0x25
jae 0x4b079a
movzx r8d, byte [rsp + rdi + 0x1d]
sub r8d, edx
cmp rsi, 0x25
jb 0x4b072a
jmp 0x4b078e
xor eax, eax
lea rbx, [rsp + 0x1d]
mov ecx, 0x25
call fcn.0044bb20
add rsp, 0x78
pop rbp
ret
mov eax, esi
mov ecx, 0x25
call fcn.00461020
mov eax, edi
mov ecx, 0x25
call fcn.00461020
nop
call fcn.0045eda0
jmp fcn.004b0660
Function at 0x4b68a0
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4b696a
push rbp
mov rbp, rsp
sub rsp, 0x48
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x58], rax
mov qword [rsp], rax
mov qword [rsp + 8], rbx
mov byte [rsp + 0x10], 0
call fcn.004030e0
xorps xmm15, xmm15
mov r14, qword [0x0082eac0]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x18], 0xffffffffffffffff
jne 0x4b694f
mov rcx, qword [rsp + 0x60]
lea rdx, [rcx + 1]
mov qword [rsp + 0x40], rdx
lea rax, [0x005d4960]
xor ebx, ebx
mov rcx, rdx
call fcn.00447980
mov rbx, qword [rsp + 0x60]
mov rcx, rax
xor edi, edi
mov rsi, qword [rsp + 0x40]
mov rax, qword [rsp + 0x58]
nop dword [rax]
call fcn.004b96a0
inc rbx
cmp rcx, rbx
jae 0x4b693e
mov edi, 1
lea rsi, [0x005d4960]
call fcn.00447a60
mov word [rax + rbx*2 - 2], 0
xor edi, edi
xor esi, esi
add rsp, 0x48
pop rbp
ret
xor eax, eax
xor ebx, ebx
mov rcx, rbx
lea rdi, [0x006bce38]
lea rsi, [0x006bcad0]
add rsp, 0x48
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.0045eda0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.004b68a0

Function at 0x4b7e80
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4b7f3d
push rbp
mov rbp, rsp
sub rsp, 0x30
movabs rdx, 0x6ff73b5c514e615d
mov qword [rsp + 0x1d], rdx
mov byte [rsp + 0x25], 0x72
movabs rdx, 0x300050300060402
mov qword [rsp + 0x26], rdx
mov word [rsp + 0x2e], 0x105
xor eax, eax
nop
jmp 0x4b7ee0
movzx r9d, byte [rsp + rsi + 0x1d]
sub r9d, edx
lea edx, [r9 + 0x1d]
mov byte [rsp + rdi + 0x1d], dl
lea edx, [r8 + 0x1d]
mov byte [rsp + rsi + 0x1d], dl
add rax, 2
nop
cmp rax, 0xa
jge 0x4b7f0d
movzx edx, byte [rsp + rax + 0x26]
movzx esi, byte [rsp + rax + 0x27]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 9
jae 0x4b7f30
movzx r8d, byte [rsp + rdi + 0x1d]
sub r8d, edx
cmp rsi, 9
jb 0x4b7ec2
jmp 0x4b7f24
xor eax, eax
lea rbx, [rsp + 0x1d]
mov ecx, 9
call fcn.0044bb20
add rsp, 0x30
pop rbp
ret
mov eax, esi
mov ecx, 9
call fcn.00461020
mov eax, edi
mov ecx, 9
call fcn.00461020
nop
nop dword [rax]
call fcn.0045eda0
jmp fcn.004b7e80
Function at 0x4b8260
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4b835d
push rbp
mov rbp, rsp
sub rsp, 0x50
movabs rdx, 0x6efa7a35e61805d3
mov qword [rsp + 0x1f], rdx
movabs rdx, 0xff64a0ece76efa7a
mov qword [rsp + 0x24], rdx
movabs rdx, 0xe3086c614967f2da
mov qword [rsp + 0x2c], rdx
movabs rdx, 0x10e0d0500021407
mov qword [rsp + 0x34], rdx
movabs rdx, 0xe080610030e040a
mov qword [rsp + 0x3c], rdx
movabs rdx, 0x130a06140e080610
mov qword [rsp + 0x40], rdx
movabs rdx, 0xd0308090a08000c
mov qword [rsp + 0x48], rdx
xor eax, eax
jmp 0x4b8300
movzx r9d, byte [rsp + rsi + 0x1f]
sub r9d, edx
lea edx, [r9 - 0x6a]
mov byte [rsp + rdi + 0x1f], dl
lea edx, [r8 - 0x6a]
mov byte [rsp + rsi + 0x1f], dl
add rax, 2
nop dword [rax]
cmp rax, 0x1c
jge 0x4b832d
movzx edx, byte [rsp + rax + 0x34]
movzx esi, byte [rsp + rax + 0x35]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x15
jae 0x4b8350
movzx r8d, byte [rsp + rdi + 0x1f]
sub r8d, edx
cmp rsi, 0x15
jb 0x4b82df
jmp 0x4b8344
xor eax, eax
lea rbx, [rsp + 0x1f]
mov ecx, 0x15
call fcn.0044bb20
add rsp, 0x50
pop rbp
ret
mov eax, esi
mov ecx, 0x15
call fcn.00461020
mov eax, edi
mov ecx, 0x15
call fcn.00461020
nop
nop dword [rax]
call fcn.0045eda0
jmp fcn.004b8260

Function at 0x4b92c0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4b93ac
push rbp
mov rbp, rsp
sub rsp, 0x48
movabs rdx, 0xc4312ee92e33faf5
mov qword [rsp + 0x19], rdx
movabs rdx, 0xe73133f4536334c4
mov qword [rsp + 0x20], rdx
movabs rdx, 0xe7332e8ddb4d4de5
mov qword [rsp + 0x28], rdx
movabs rdx, 0x1004130f0a100107
mov qword [rsp + 0x30], rdx
movabs rdx, 0x11090b0b0100120f
mov qword [rsp + 0x38], rdx
movabs rdx, 0x40e11160e090a04
mov qword [rsp + 0x40], rdx
xor eax, eax
jmp 0x4b934a
movzx r9d, byte [rsp + rsi + 0x19]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x2e]
mov byte [rsp + rdi + 0x19], dl
mov byte [rsp + rsi + 0x19], r8b
add rax, 2
cmp rax, 0x18
jge 0x4b937c
movzx edx, byte [rsp + rax + 0x30]
movzx esi, byte [rsp + rax + 0x31]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x17
jae 0x4b939f
movzx r8d, byte [rsp + rdi + 0x19]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x2e]
cmp rsi, 0x17
jb 0x4b9330
jmp 0x4b9393
xor eax, eax
lea rbx, [rsp + 0x19]
mov ecx, 0x17
call fcn.0044bb20
add rsp, 0x48
pop rbp
ret
mov eax, esi
mov ecx, 0x17
call fcn.00461020
mov eax, edi
mov ecx, 0x17
call fcn.00461020
nop
call fcn.0045eda0
jmp fcn.004b92c0
Function at 0x4bd6a0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4bd7ac
push rbp
mov rbp, rsp
sub rsp, 0x50
movabs rdx, 0x6333ee75526dc563
mov qword [rsp + 0x19], rdx
movabs rdx, 0x726520dcd569c478
mov qword [rsp + 0x21], rdx
movabs rdx, 0x9ee123726520dcd5
mov qword [rsp + 0x24], rdx
movabs rdx, 0x64c765fe3aca6f23
mov qword [rsp + 0x2c], rdx
movabs rdx, 0x1617120b0c030505
mov qword [rsp + 0x34], rdx
movabs rdx, 0x1509060c1608100b
mov qword [rsp + 0x3c], rdx
movabs rdx, 0x61311101509060c
mov qword [rsp + 0x40], rdx
movabs rdx, 0x60c01170b19080c
mov qword [rsp + 0x48], rdx
xor eax, eax
jmp 0x4bd748
movzx r9d, byte [rsp + rsi + 0x19]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x80]
mov byte [rsp + rdi + 0x19], dl
mov byte [rsp + rsi + 0x19], r8b
add rax, 2
cmp rax, 0x1c
jge 0x4bd77c
movzx edx, byte [rsp + rax + 0x34]
movzx esi, byte [rsp + rax + 0x35]
mov edi, edx
xor edx, esi
add edx, eax
nop
cmp rdi, 0x1b
jae 0x4bd79f
movzx r8d, byte [rsp + rdi + 0x19]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x80]
cmp rsi, 0x1b
jb 0x4bd72e
jmp 0x4bd793
xor eax, eax
lea rbx, [rsp + 0x19]
mov ecx, 0x1b
call fcn.0044bb20
add rsp, 0x50
pop rbp
ret
mov eax, esi
mov ecx, 0x1b
call fcn.00461020
mov eax, edi
mov ecx, 0x1b
call fcn.00461020
nop
call fcn.0045eda0
jmp fcn.004bd6a0

Function at 0x4be560
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4be68c
push rbp
mov rbp, rsp
sub rsp, 0x68
movabs rdx, 0x58201e0d656d04ff
mov qword [rsp + 0x1a], rdx
movabs rdx, 0x6516abbafd61be00
mov qword [rsp + 0x22], rdx
movabs rdx, 0xcfe9a4954a65e6e
mov qword [rsp + 0x2a], rdx
movabs rdx, 0x6e1651117d17207d
mov qword [rsp + 0x32], rdx
movabs rdx, 0x1c06091d0c1e1114
mov qword [rsp + 0x3a], rdx
movabs rdx, 0x171a13131307140e
mov qword [rsp + 0x42], rdx
movabs rdx, 0x11b0d050606171a
mov qword [rsp + 0x48], rdx
movabs rdx, 0x1c0b051316061e1d
mov qword [rsp + 0x50], rdx
movabs rdx, 0x1518091200040007
mov qword [rsp + 0x58], rdx
movabs rdx, 0x150b080e01181118
mov qword [rsp + 0x60], rdx
xor eax, eax
jmp 0x4be626
movzx r9d, byte [rsp + rsi + 0x1a]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x3d]
mov byte [rsp + rdi + 0x1a], dl
mov byte [rsp + rsi + 0x1a], r8b
add rax, 2
cmp rax, 0x2e
jge 0x4be65c
movzx edx, byte [rsp + rax + 0x3a]
movzx esi, byte [rsp + rax + 0x3b]
mov edi, edx
xor edx, esi
add edx, eax
nop dword [rax]
cmp rdi, 0x20
jae 0x4be67f
movzx r8d, byte [rsp + rdi + 0x1a]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x3d]
cmp rsi, 0x20
jb 0x4be60c
jmp 0x4be673
xor eax, eax
lea rbx, [rsp + 0x1a]
mov ecx, 0x20
call fcn.0044bb20
add rsp, 0x68
pop rbp
ret
mov eax, esi
mov ecx, 0x20
call fcn.00461020
mov eax, edi
mov ecx, 0x20
call fcn.00461020
nop
call fcn.0045eda0
jmp fcn.004be560
Function at 0x4be9a0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4bea9b
push rbp
mov rbp, rsp
sub rsp, 0x48
movabs rdx, 0xbb3f89566b736964
mov qword [rsp + 0x19], rdx
movabs rdx, 0x900315bb3f89566b
mov qword [rsp + 0x1c], rdx
movabs rdx, 0x7265e255aa9b7819
mov qword [rsp + 0x24], rdx
movabs rdx, 0x1209040807040608
mov qword [rsp + 0x2c], rdx
movabs rdx, 0xb0d0f050d0b0e04
mov qword [rsp + 0x34], rdx
movabs rdx, 0x120905040b0d0f05
mov qword [rsp + 0x38], rdx
movabs rdx, 0x7070f090b100a07
mov qword [rsp + 0x40], rdx
xor eax, eax
jmp 0x4bea39
movzx r9d, byte [rsp + rsi + 0x19]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x52]
mov byte [rsp + rdi + 0x19], dl
mov byte [rsp + rsi + 0x19], r8b
add rax, 2
cmp rax, 0x1c
jge 0x4bea6b
movzx edx, byte [rsp + rax + 0x2c]
movzx esi, byte [rsp + rax + 0x2d]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x13
jae 0x4bea8e
movzx r8d, byte [rsp + rdi + 0x19]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x52]
cmp rsi, 0x13
jb 0x4bea1f
jmp 0x4bea82
xor eax, eax
lea rbx, [rsp + 0x19]
mov ecx, 0x13
call fcn.0044bb20
add rsp, 0x48
pop rbp
ret
mov eax, esi
mov ecx, 0x13
call fcn.00461020
mov eax, edi
mov ecx, 0x13
call fcn.00461020
nop
nop dword [rax + rax]
call fcn.0045eda0
jmp fcn.004be9a0

Function at 0x4bf2c0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4bf3a6
push rbp
mov rbp, rsp
sub rsp, 0x40
movabs rdx, 0xe4efe548eb2090ee
mov qword [rsp + 0x1c], rdx
movabs rdx, 0x7369e6d0df6f7420
mov qword [rsp + 0x24], rdx
movabs rdx, 0x60f0e060f0f0d0d
mov qword [rsp + 0x2c], rdx
movabs rdx, 0x50d0000060f0e06
mov qword [rsp + 0x30], rdx
movabs rdx, 0xc0707040b010305
mov qword [rsp + 0x38], rdx
xor eax, eax
nop
jmp 0x4bf340
movzx r9d, byte [rsp + rsi + 0x1c]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x78]
mov byte [rsp + rdi + 0x1c], dl
mov byte [rsp + rsi + 0x1c], r8b
add rax, 2
nop dword [rax]
cmp rax, 0x14
jge 0x4bf372
movzx edx, byte [rsp + rax + 0x2c]
movzx esi, byte [rsp + rax + 0x2d]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x10
jae 0x4bf397
movzx r8d, byte [rsp + rdi + 0x1c]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x78]
cmp rsi, 0x10
jb 0x4bf322
jmp 0x4bf38b
xor eax, eax
lea rbx, [rsp + 0x1c]
mov ecx, 0x10
nop
call fcn.0044bb20
add rsp, 0x40
pop rbp
ret
mov eax, esi
mov ecx, 0x10
call fcn.00461020
mov eax, edi
mov ecx, 0x10
nop
call fcn.00461020
nop
call fcn.0045eda0
jmp fcn.004bf2c0
Function at 0x4bf3c0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4bf4aa
push rbp
mov rbp, rsp
sub rsp, 0x40
movabs rdx, 0x73668974716564b0
mov qword [rsp + 0x1a], rdx
movabs rdx, 0x7283736689747165
mov qword [rsp + 0x1c], rdx
movabs rdx, 0x65da7c906d38727a
mov qword [rsp + 0x24], rdx
movabs rdx, 0x11110807030c0000
mov qword [rsp + 0x2c], rdx
movabs rdx, 0x7000a0311110807
mov qword [rsp + 0x30], rdx
movabs rdx, 0x100e10070f050710
mov qword [rsp + 0x38], rdx
xor eax, eax
jmp 0x4bf44d
movzx r9d, byte [rsp + rsi + 0x1a]
sub r9d, edx
lea edx, [r9 + 5]
mov byte [rsp + rdi + 0x1a], dl
lea edx, [r8 + 5]
mov byte [rsp + rsi + 0x1a], dl
add rax, 2
cmp rax, 0x14
jge 0x4bf47a
movzx edx, byte [rsp + rax + 0x2c]
movzx esi, byte [rsp + rax + 0x2d]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x12
jae 0x4bf49d
movzx r8d, byte [rsp + rdi + 0x1a]
sub r8d, edx
cmp rsi, 0x12
jb 0x4bf430
jmp 0x4bf491
xor eax, eax
lea rbx, [rsp + 0x1a]
mov ecx, 0x12
call fcn.0044bb20
add rsp, 0x40
pop rbp
ret
mov eax, esi
mov ecx, 0x12
call fcn.00461020
mov eax, edi
mov ecx, 0x12
call fcn.00461020
nop
call fcn.0045eda0
jmp fcn.004bf3c0

Function at 0x4bff40
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4c002c
push rbp
mov rbp, rsp
sub rsp, 0x48
movabs rdx, 0xd8e42fe5759354c2
mov qword [rsp + 0x1e], rdx
movabs rdx, 0xe661d8e42fe57593
mov qword [rsp + 0x20], rdx
movabs rdx, 0x723bdf722d2034d6
mov qword [rsp + 0x28], rdx
movabs rdx, 0x100d080600040808
mov qword [rsp + 0x30], rdx
movabs rdx, 0x90b0f040d0a0d01
mov qword [rsp + 0x38], rdx
movabs rdx, 0x10090f0702100202
mov qword [rsp + 0x40], rdx
xor eax, eax
jmp 0x4bffca
movzx r9d, byte [rsp + rsi + 0x1e]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x7e]
mov byte [rsp + rdi + 0x1e], dl
mov byte [rsp + rsi + 0x1e], r8b
add rax, 2
cmp rax, 0x18
jge 0x4bfffc
movzx edx, byte [rsp + rax + 0x30]
movzx esi, byte [rsp + rax + 0x31]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x12
jae 0x4c001f
movzx r8d, byte [rsp + rdi + 0x1e]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x7e]
cmp rsi, 0x12
jb 0x4bffb0
jmp 0x4c0013
xor eax, eax
lea rbx, [rsp + 0x1e]
mov ecx, 0x12
call fcn.0044bb20
add rsp, 0x48
pop rbp
ret
mov eax, esi
mov ecx, 0x12
call fcn.00461020
mov eax, edi
mov ecx, 0x12
call fcn.00461020
nop
call fcn.0045eda0
jmp fcn.004bff40