joyce8/EMBER2024-capa huggingface dataset:
Function at 0x49a7a0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x49a8d8
push rbp
mov rbp, rsp
sub rsp, 0x68
movabs rdx, 0x5b64936f68426539
mov qword [rsp + 0x18], rdx
movabs rdx, 0x61a6795a5b64936f
mov qword [rsp + 0x1c], rdx
movabs rdx, 0x653b182f543ea26e
mov qword [rsp + 0x24], rdx
movabs rdx, 0x63434c20496e4120
mov qword [rsp + 0x2c], rdx
movabs rdx, 0x726756255f874c85
mov qword [rsp + 0x34], rdx
movabs rdx, 0xa201b0f211a0810
mov qword [rsp + 0x3c], rdx
movabs rdx, 0x1c0e1106211c201e
mov qword [rsp + 0x44], rdx
movabs rdx, 0x2101c1a1c0e1106
mov qword [rsp + 0x48], rdx
movabs rdx, 0x719070d0d231f1d
mov qword [rsp + 0x50], rdx
movabs rdx, 0x1a1b16121a101919
mov qword [rsp + 0x58], rdx
movabs rdx, 0x523071c001e1b09
mov qword [rsp + 0x60], rdx
xor eax, eax
jmp 0x49a878
movzx r9d, byte [rsp + rsi + 0x18]
sub r9d, edx
lea edx, [r9 + 0x2b]
mov byte [rsp + rdi + 0x18], dl
lea edx, [r8 + 0x2b]
mov byte [rsp + rsi + 0x18], dl
add rax, 2
cmp rax, 0x2c
jge 0x49a8a8
movzx edx, byte [rsp + rax + 0x3c]
movzx esi, byte [rsp + rax + 0x3d]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x24
jae 0x49a8cb
movzx r8d, byte [rsp + rdi + 0x18]
sub r8d, edx
nop dword [rax]
cmp rsi, 0x24
jb 0x49a85b
jmp 0x49a8bf
xor eax, eax
lea rbx, [rsp + 0x18]
mov ecx, 0x24
call fcn.00445b60
add rsp, 0x68
pop rbp
ret
mov eax, esi
mov ecx, 0x24
call fcn.00457ea0
mov eax, edi
mov ecx, 0x24
call fcn.00457ea0
nop
call fcn.00455c20
nop dword [rax]
jmp fcn.0049a7a0

Function at 0x49aba0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x49acba
push rbp
mov rbp, rsp
sub rsp, 0x60
movabs rdx, 0x61ca016585a561e2
mov qword [rsp + 0x1f], rdx
movabs rdx, 0x7a3b05207727656d
mov qword [rsp + 0x27], rdx
movabs rdx, 0x72f65ef1657a3b05
mov qword [rsp + 0x2c], rdx
movabs rdx, 0x82df73d11e7717d4
mov qword [rsp + 0x34], rdx
movabs rdx, 0x5171c18131c130e
mov qword [rsp + 0x3c], rdx
movabs rdx, 0x12060b1705171c18
mov qword [rsp + 0x40], rdx
movabs rdx, 0x11021817160d030d
mov qword [rsp + 0x48], rdx
movabs rdx, 0x191700150d13011c
mov qword [rsp + 0x50], rdx
movabs rdx, 0x5011b061c0b0100
mov qword [rsp + 0x58], rdx
xor eax, eax
jmp 0x49ac57
movzx r9d, byte [rsp + rsi + 0x1f]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x56]
mov byte [rsp + rdi + 0x1f], dl
mov byte [rsp + rsi + 0x1f], r8b
add rax, 2
cmp rax, 0x24
jge 0x49ac89
movzx edx, byte [rsp + rax + 0x3c]
movzx esi, byte [rsp + rax + 0x3d]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x1d
jae 0x49acad
movzx r8d, byte [rsp + rdi + 0x1f]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x56]
cmp rsi, 0x1d
jb 0x49ac3d
jmp 0x49aca1
xor eax, eax
lea rbx, [rsp + 0x1f]
mov ecx, 0x1d
call fcn.00445b60
add rsp, 0x60
pop rbp
nop
ret
mov eax, esi
mov ecx, 0x1d
call fcn.00457ea0
mov eax, edi
mov ecx, 0x1d
call fcn.00457ea0
nop
call fcn.00455c20
nop
jmp fcn.0049aba0
Function at 0x49c980
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x49ca4c
push rbp
mov rbp, rsp
sub rsp, 0x38
movabs rdx, 0x206e95b1898ed58c
mov qword [rsp + 0x1a], rdx
movabs rdx, 0x986f89c66598206e
mov qword [rsp + 0x20], rdx
movabs rdx, 0xd0a0a0403010000
mov qword [rsp + 0x28], rdx
movabs rdx, 0x40508020b0b0302
mov qword [rsp + 0x30], rdx
xor eax, eax
jmp 0x49c9ef
movzx r9d, byte [rsp + rsi + 0x1a]
sub r9d, edx
lea edx, [r9 - 0x17]
mov byte [rsp + rdi + 0x1a], dl
lea edx, [r8 - 0x17]
mov byte [rsp + rsi + 0x1a], dl
add rax, 2
cmp rax, 0x10
jge 0x49ca1c
movzx edx, byte [rsp + rax + 0x28]
movzx esi, byte [rsp + rax + 0x29]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0xe
jae 0x49ca3f
movzx r8d, byte [rsp + rdi + 0x1a]
sub r8d, edx
cmp rsi, 0xe
jb 0x49c9d2
jmp 0x49ca33
xor eax, eax
lea rbx, [rsp + 0x1a]
mov ecx, 0xe
call fcn.00445b60
add rsp, 0x38
pop rbp
ret
mov eax, esi
mov ecx, 0xe
call fcn.00457ea0
mov eax, edi
mov ecx, 0xe
call fcn.00457ea0
nop
call fcn.00455c20
jmp fcn.0049c980

Function at 0x49cf20
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x49d00c
push rbp
mov rbp, rsp
sub rsp, 0x40
movabs rdx, 0xea746365f6666562
mov qword [rsp + 0x1d], rdx
movabs rdx, 0x20ea746365f66665
mov qword [rsp + 0x1e], rdx
movabs rdx, 0xd06681e15b99b266
mov qword [rsp + 0x26], rdx
movabs rdx, 0x30c09000b0c07
mov qword [rsp + 0x2e], rdx
movabs rdx, 0x70a00030c09000b
mov qword [rsp + 0x30], rdx
movabs rdx, 0xc0b100e09090d03
mov qword [rsp + 0x38], rdx
xor eax, eax
jmp 0x49cfaa
movzx r9d, byte [rsp + rsi + 0x1d]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x73]
mov byte [rsp + rdi + 0x1d], dl
mov byte [rsp + rsi + 0x1d], r8b
add rax, 2
cmp rax, 0x12
jge 0x49cfdc
movzx edx, byte [rsp + rax + 0x2e]
movzx esi, byte [rsp + rax + 0x2f]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x11
jae 0x49cfff
movzx r8d, byte [rsp + rdi + 0x1d]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x73]
cmp rsi, 0x11
jb 0x49cf90
jmp 0x49cff3
xor eax, eax
lea rbx, [rsp + 0x1d]
mov ecx, 0x11
call fcn.00445b60
add rsp, 0x40
pop rbp
ret
mov eax, esi
mov ecx, 0x11
call fcn.00457ea0
mov eax, edi
mov ecx, 0x11
call fcn.00457ea0
nop
call fcn.00455c20
jmp fcn.0049cf20
Function at 0x49d020
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x49d0e6
push rbp
mov rbp, rsp
sub rsp, 0x30
movabs rdx, 0x21c76ec22064756c
mov qword [rsp + 0x1b], rdx
mov byte [rsp + 0x23], 0x22
movabs rdx, 0x100070800070108
mov qword [rsp + 0x24], rdx
mov dword [rsp + 0x2c], 0x7080406
xor eax, eax
nop
jmp 0x49d080
movzx r9d, byte [rsp + rsi + 0x1b]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x68]
mov byte [rsp + rdi + 0x1b], dl
mov byte [rsp + rsi + 0x1b], r8b
add rax, 2
nop dword [rax]
cmp rax, 0xc
jge 0x49d0b2
movzx edx, byte [rsp + rax + 0x24]
movzx esi, byte [rsp + rax + 0x25]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 9
jae 0x49d0d7
movzx r8d, byte [rsp + rdi + 0x1b]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x68]
cmp rsi, 9
jb 0x49d062
jmp 0x49d0cb
xor eax, eax
lea rbx, [rsp + 0x1b]
mov ecx, 9
nop
call fcn.00445b60
add rsp, 0x30
pop rbp
ret
mov eax, esi
mov ecx, 9
call fcn.00457ea0
mov eax, edi
mov ecx, 9
nop
call fcn.00457ea0
nop
call fcn.00455c20
jmp fcn.0049d020
Function at 0x49d720
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x49d86c
push rbp
mov rbp, rsp
sub rsp, 0x78
movabs rdx, 0x1b39cf0e6c1e654f
mov qword [rsp + 0x1c], rdx
movabs rdx, 0x40614c636e2d660b
mov qword [rsp + 0x24], rdx
movabs rdx, 0x51744bf040614c63
mov qword [rsp + 0x28], rdx
movabs rdx, 0x74114f28d5741dd3
mov qword [rsp + 0x30], rdx
movabs rdx, 0x722039633ce8f334
mov qword [rsp + 0x38], rdx
movabs rdx, 0x20d1652542ecc3dc
mov qword [rsp + 0x40], rdx
movabs rdx, 0xf111d1810261021
mov qword [rsp + 0x48], rdx
movabs rdx, 0x513260400141315
mov qword [rsp + 0x50], rdx
movabs rdx, 0x1825061d1a191121
mov qword [rsp + 0x58], rdx
movabs rdx, 0x242a0804101f2726
mov qword [rsp + 0x60], rdx
movabs rdx, 0x191c1724022a0a04
mov qword [rsp + 0x68], rdx
movabs rdx, 0x700211324281e07
mov qword [rsp + 0x70], rdx
xor eax, eax
jmp 0x49d804
movzx r9d, byte [rsp + rsi + 0x1c]
lea edx, [r9 + rdx]
lea edx, [rdx + 0xa]
mov byte [rsp + rdi + 0x1c], dl
mov byte [rsp + rsi + 0x1c], r8b
add rax, 2
cmp rax, 0x30
jge 0x49d83c
movzx edx, byte [rsp + rax + 0x48]
movzx esi, byte [rsp + rax + 0x49]
mov edi, edx
xor edx, esi
add edx, eax
nop word [rax + rax]
cmp rdi, 0x2c
jae 0x49d85f
movzx r8d, byte [rsp + rdi + 0x1c]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0xa]
cmp rsi, 0x2c
jb 0x49d7ea
jmp 0x49d853
xor eax, eax
lea rbx, [rsp + 0x1c]
mov ecx, 0x2c
call fcn.00445b60
add rsp, 0x78
pop rbp
ret
mov eax, esi
mov ecx, 0x2c
call fcn.00457ea0
mov eax, edi
mov ecx, 0x2c
call fcn.00457ea0
nop
call fcn.00455c20
jmp fcn.0049d720

Function at 0x49e040
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x49e16c
push rbp
mov rbp, rsp
sub rsp, 0x68
movabs rdx, 0x3afb636443663472
mov qword [rsp + 0x1e], rdx
movabs rdx, 0x39763afb63644366
mov qword [rsp + 0x20], rdx
movabs rdx, 0x83226943656c412a
mov qword [rsp + 0x28], rdx
movabs rdx, 0x6f7100016c576f1b
mov qword [rsp + 0x30], rdx
movabs rdx, 0x456b6e756f0e44fd
mov qword [rsp + 0x38], rdx
movabs rdx, 0x13110a080b141518
mov qword [rsp + 0x40], rdx
movabs rdx, 0x121817210d041510
mov qword [rsp + 0x48], rdx
movabs rdx, 0x120116081b081512
mov qword [rsp + 0x50], rdx
movabs rdx, 0x1c1b101021201b09
mov qword [rsp + 0x58], rdx
movabs rdx, 0x140603121a0e2001
mov qword [rsp + 0x60], rdx
xor eax, eax
jmp 0x49e106
movzx r9d, byte [rsp + rsi + 0x1e]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x13]
mov byte [rsp + rdi + 0x1e], dl
mov byte [rsp + rsi + 0x1e], r8b
add rax, 2
cmp rax, 0x28
jge 0x49e13c
movzx edx, byte [rsp + rax + 0x40]
movzx esi, byte [rsp + rax + 0x41]
mov edi, edx
xor edx, esi
add edx, eax
nop dword [rax]
cmp rdi, 0x22
jae 0x49e15f
movzx r8d, byte [rsp + rdi + 0x1e]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x13]
cmp rsi, 0x22
jb 0x49e0ec
jmp 0x49e153
xor eax, eax
lea rbx, [rsp + 0x1e]
mov ecx, 0x22
call fcn.00445b60
add rsp, 0x68
pop rbp
ret
mov eax, esi
mov ecx, 0x22
call fcn.00457ea0
mov eax, edi
mov ecx, 0x22
call fcn.00457ea0
nop
call fcn.00455c20
jmp fcn.0049e040
Function at 0x49f540
Capabilities:
Encrypt data using rc4 prga

Disassembly:
lea r12, [rsp - 8]
cmp r12, qword [r14 + 0x10]
jbe 0x49f69d
push rbp
mov rbp, rsp
add rsp, 0xffffffffffffff80
movabs rdx, 0x14996321afbaa972
mov qword [rsp + 0x1f], rdx
movabs rdx, 0xc06eab6593bf5920
mov qword [rsp + 0x27], rdx
movabs rdx, 0x707265206cc06eab
mov qword [rsp + 0x2c], rdx
movabs rdx, 0xead2c8c4a23a72cd
mov qword [rsp + 0x34], rdx
movabs rdx, 0x687a22cf256469ca
mov qword [rsp + 0x3c], rdx
movabs rdx, 0xf1e9c385c40b19e3
mov qword [rsp + 0x44], rdx
movabs rdx, 0x140d202b07232a01
mov qword [rsp + 0x4c], rdx
movabs rdx, 0x20b032b140d202b
mov qword [rsp + 0x50], rdx
movabs rdx, 0x211528191809231b
mov qword [rsp + 0x58], rdx
movabs rdx, 0x270d0a22252c2704
mov qword [rsp + 0x60], rdx
movabs rdx, 0x262c20012701030b
mov qword [rsp + 0x68], rdx
movabs rdx, 0x4061c251d032529
mov qword [rsp + 0x70], rdx
movabs rdx, 0xf1c1a0a1d2c2c04
mov qword [rsp + 0x78], rdx
xor eax, eax
jmp 0x49f640
movzx r9d, byte [rsp + rsi + 0x1f]
sub r9d, edx
lea edx, [r9 - 0x1a]
mov byte [rsp + rdi + 0x1f], dl
lea edx, [r8 - 0x1a]
mov byte [rsp + rsi + 0x1f], dl
add rax, 2
nop dword [rax + rax]
cmp rax, 0x34
jge 0x49f66d
movzx edx, byte [rsp + rax + 0x4c]
movzx esi, byte [rsp + rax + 0x4d]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x2d
jae 0x49f690
movzx r8d, byte [rsp + rdi + 0x1f]
sub r8d, edx
cmp rsi, 0x2d
jb 0x49f61e
jmp 0x49f684
xor eax, eax
lea rbx, [rsp + 0x1f]
mov ecx, 0x2d
call fcn.00445b60
sub rsp, 0xffffffffffffff80
pop rbp
ret
mov eax, esi
mov ecx, 0x2d
call fcn.00457ea0
mov eax, edi
mov ecx, 0x2d
call fcn.00457ea0
nop
nop dword [rax]
call fcn.00455c20
jmp fcn.0049f540

Function at 0x4a0540
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4a0606
push rbp
mov rbp, rsp
sub rsp, 0x30
movabs rdx, 0x3f4c99616c7f7569
mov qword [rsp + 0x1d], rdx
mov byte [rsp + 0x25], 0x6e
movabs rdx, 0x503030301070405
mov qword [rsp + 0x26], rdx
mov word [rsp + 0x2e], 0x207
xor eax, eax
nop
jmp 0x4a05a0
movzx r9d, byte [rsp + rsi + 0x1d]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x27]
mov byte [rsp + rdi + 0x1d], dl
mov byte [rsp + rsi + 0x1d], r8b
add rax, 2
nop dword [rax]
cmp rax, 0xa
jge 0x4a05d2
movzx edx, byte [rsp + rax + 0x26]
movzx esi, byte [rsp + rax + 0x27]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 9
jae 0x4a05f7
movzx r8d, byte [rsp + rdi + 0x1d]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x27]
cmp rsi, 9
jb 0x4a0582
jmp 0x4a05eb
xor eax, eax
lea rbx, [rsp + 0x1d]
mov ecx, 9
nop
call fcn.00445b60
add rsp, 0x30
pop rbp
ret
mov eax, esi
mov ecx, 9
call fcn.00457ea0
mov eax, edi
mov ecx, 9
nop
call fcn.00457ea0
nop
call fcn.00455c20
jmp fcn.004a0540
Function at 0x4a12e0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4a13dd
push rbp
mov rbp, rsp
sub rsp, 0x50
movabs rdx, 0x41a6632c39d865d0
mov qword [rsp + 0x1d], rdx
movabs rdx, 0x655d46613c41a663
mov qword [rsp + 0x22], rdx
movabs rdx, 0xdb472649696fa06c
mov qword [rsp + 0x2a], rdx
movabs rdx, 0x131208040a0a0412
mov qword [rsp + 0x32], rdx
movabs rdx, 0xa12040703040b12
mov qword [rsp + 0x3a], rdx
movabs rdx, 0xe07000403110a12
mov qword [rsp + 0x40], rdx
movabs rdx, 0x140e0611060d0302
mov qword [rsp + 0x48], rdx
xor eax, eax
jmp 0x4a1380
movzx r9d, byte [rsp + rsi + 0x1d]
sub r9d, edx
lea edx, [r9 - 0x55]
mov byte [rsp + rdi + 0x1d], dl
lea edx, [r8 - 0x55]
mov byte [rsp + rsi + 0x1d], dl
add rax, 2
nop dword [rax]
cmp rax, 0x1e
jge 0x4a13ad
movzx edx, byte [rsp + rax + 0x32]
movzx esi, byte [rsp + rax + 0x33]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x15
jae 0x4a13d0
movzx r8d, byte [rsp + rdi + 0x1d]
sub r8d, edx
cmp rsi, 0x15
jb 0x4a135f
jmp 0x4a13c4
xor eax, eax
lea rbx, [rsp + 0x1d]
mov ecx, 0x15
call fcn.00445b60
add rsp, 0x50
pop rbp
ret
mov eax, esi
mov ecx, 0x15
call fcn.00457ea0
mov eax, edi
mov ecx, 0x15
call fcn.00457ea0
nop
nop dword [rax]
call fcn.00455c20
jmp fcn.004a12e0

Function at 0x4a19c0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
lea r12, [rsp - 8]
cmp r12, qword [r14 + 0x10]
jbe 0x4a1b2c
push rbp
mov rbp, rsp
add rsp, 0xffffffffffffff80
movabs rdx, 0x2ee9c17cbe8e964d
mov qword [rsp + 0x1d], rdx
movabs rdx, 0x6d8ba16a8398654e
mov qword [rsp + 0x25], rdx
movabs rdx, 0x6c6d8ba16a839865
mov qword [rsp + 0x26], rdx
movabs rdx, 0x5765586e849277de
mov qword [rsp + 0x2e], rdx
movabs rdx, 0x2067795c7dad61d9
mov qword [rsp + 0x36], rdx
movabs rdx, 0x4e5cbb6161d08975
mov qword [rsp + 0x3e], rdx
movabs rdx, 0x11241f0526271e21
mov qword [rsp + 0x46], rdx
movabs rdx, 0x1b0203060d242423
mov qword [rsp + 0x4e], rdx
movabs rdx, 0x3191b0203060d24
mov qword [rsp + 0x50], rdx
movabs rdx, 0x1f06030d23021901
mov qword [rsp + 0x58], rdx
movabs rdx, 0x111322160b14231d
mov qword [rsp + 0x60], rdx
movabs rdx, 0x281f05160e0d240b
mov qword [rsp + 0x68], rdx
movabs rdx, 0x1b051c041f260a0b
mov qword [rsp + 0x70], rdx
movabs rdx, 0xa120c1f0f192218
mov qword [rsp + 0x78], rdx
xor eax, eax
jmp 0x4a1ac7
movzx r9d, byte [rsp + rsi + 0x1d]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x4f]
mov byte [rsp + rdi + 0x1d], dl
mov byte [rsp + rsi + 0x1d], r8b
add rax, 2
cmp rax, 0x3a
jge 0x4a1afc
movzx edx, byte [rsp + rax + 0x46]
movzx esi, byte [rsp + rax + 0x47]
mov edi, edx
xor edx, esi
add edx, eax
nop dword [rax]
cmp rdi, 0x29
jae 0x4a1b1f
movzx r8d, byte [rsp + rdi + 0x1d]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x4f]
cmp rsi, 0x29
jb 0x4a1aad
jmp 0x4a1b13
xor eax, eax
lea rbx, [rsp + 0x1d]
mov ecx, 0x29
call fcn.00445b60
sub rsp, 0xffffffffffffff80
pop rbp
ret
mov eax, esi
mov ecx, 0x29
call fcn.00457ea0
mov eax, edi
mov ecx, 0x29
call fcn.00457ea0
nop
call fcn.00455c20
jmp fcn.004a19c0
Function at 0x4a1b40
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4a1c6c
push rbp
mov rbp, rsp
sub rsp, 0x68
movabs rdx, 0x35de654b4870e826
mov qword [rsp + 0x1a], rdx
movabs rdx, 0x4b493f27626b1056
mov qword [rsp + 0x22], rdx
movabs rdx, 0xdb650720498ee94e
mov qword [rsp + 0x2a], rdx
movabs rdx, 0x7378fb4ec8f91733
mov qword [rsp + 0x32], rdx
movabs rdx, 0xb0a06170918091d
mov qword [rsp + 0x3a], rdx
movabs rdx, 0x1040d1a1800151b
mov qword [rsp + 0x42], rdx
movabs rdx, 0xf0e1f0915130104
mov qword [rsp + 0x48], rdx
movabs rdx, 0x604190607121018
mov qword [rsp + 0x50], rdx
movabs rdx, 0xd13030609130717
mov qword [rsp + 0x58], rdx
movabs rdx, 0x7111d0c19091719
mov qword [rsp + 0x60], rdx
xor eax, eax
jmp 0x4a1c06
movzx r9d, byte [rsp + rsi + 0x1a]
lea edx, [r9 + rdx]
lea edx, [rdx + 3]
mov byte [rsp + rdi + 0x1a], dl
mov byte [rsp + rsi + 0x1a], r8b
add rax, 2
cmp rax, 0x2e
jge 0x4a1c3c
movzx edx, byte [rsp + rax + 0x3a]
movzx esi, byte [rsp + rax + 0x3b]
mov edi, edx
xor edx, esi
add edx, eax
nop dword [rax]
cmp rdi, 0x20
jae 0x4a1c5f
movzx r8d, byte [rsp + rdi + 0x1a]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 3]
cmp rsi, 0x20
jb 0x4a1bec
jmp 0x4a1c53
xor eax, eax
lea rbx, [rsp + 0x1a]
mov ecx, 0x20
call fcn.00445b60
add rsp, 0x68
pop rbp
ret
mov eax, esi
mov ecx, 0x20
call fcn.00457ea0
mov eax, edi
mov ecx, 0x20
call fcn.00457ea0
nop
call fcn.00455c20
jmp fcn.004a1b40
Function at 0x4a2900
Capabilities:
Encrypt data using rc4 prga

Disassembly:
lea r12, [rsp - 0x28]
cmp r12, qword [r14 + 0x10]
jbe 0x4a2aaa
push rbp
mov rbp, rsp
sub rsp, 0xa0
movabs rdx, 0x3a8563e426fc0372
mov qword [rsp + 0x1c], rdx
movabs rdx, 0xb66f206c6c0ad50a
mov qword [rsp + 0x24], rdx
movabs rdx, 0xf2891420b66f206c
mov qword [rsp + 0x28], rdx
movabs rdx, 0xab8d560ace63c9db
mov qword [rsp + 0x30], rdx
movabs rdx, 0x6f058802944f1675
mov qword [rsp + 0x38], rdx
movabs rdx, 0x6f74ab82047f6709
mov qword [rsp + 0x40], rdx
movabs rdx, 0x87721b2de5fcdb66
mov qword [rsp + 0x48], rdx
movabs rdx, 0xc98876d5561c79cd
mov qword [rsp + 0x50], rdx
movabs rdx, 0x42d11181f361534
mov qword [rsp + 0x58], rdx
movabs rdx, 0x2528063a18122f1a
mov qword [rsp + 0x60], rdx
movabs rdx, 0x39112c213b1f1126
mov qword [rsp + 0x68], rdx
movabs rdx, 0x271d090431060a33
mov qword [rsp + 0x70], rdx
movabs rdx, 0x62202210f060827
mov qword [rsp + 0x78], rdx
movabs rdx, 0x13092e3a02081e22
mov qword [rsp + 0x80], rdx
movabs rdx, 0x120111b22290a20
mov qword [rsp + 0x88], rdx
movabs rdx, 0x22140f2f381e1126
mov qword [rsp + 0x90], rdx
movabs rdx, 0x36172824033b0108
mov qword [rsp + 0x98], rdx
xor eax, eax
jmp 0x4a2a46
movzx r9d, byte [rsp + rsi + 0x1c]
sub r9d, edx
lea edx, [r9 - 0x47]
mov byte [rsp + rdi + 0x1c], dl
lea edx, [r8 - 0x47]
mov byte [rsp + rsi + 0x1c], dl
add rax, 2
cmp rax, 0x48
jge 0x4a2a77
movzx edx, byte [rsp + rax + 0x58]
movzx esi, byte [rsp + rax + 0x59]
mov edi, edx
xor edx, esi
add edx, eax
nop dword [rax]
cmp rdi, 0x3c
jae 0x4a2a9d
movzx r8d, byte [rsp + rdi + 0x1c]
sub r8d, edx
cmp rsi, 0x3c
jb 0x4a2a29
jmp 0x4a2a91
xor eax, eax
lea rbx, [rsp + 0x1c]
mov ecx, 0x3c
call fcn.00445b60
add rsp, 0xa0
pop rbp
ret
mov eax, esi
mov ecx, 0x3c
call fcn.00457ea0
mov eax, edi
mov ecx, 0x3c
call fcn.00457ea0
nop
call fcn.00455c20
jmp fcn.004a2900

Function at 0x4a30a0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4a31ac
push rbp
mov rbp, rsp
sub rsp, 0x50
movabs rdx, 0xd0abd3af656d6173
mov qword [rsp + 0x19], rdx
movabs rdx, 0x69e76cb011e52c51
mov qword [rsp + 0x21], rdx
movabs rdx, 0x469e76cb011e52c
mov qword [rsp + 0x22], rdx
movabs rdx, 0x6e65127ab3744b30
mov qword [rsp + 0x2a], rdx
movabs rdx, 0x1204061014080511
mov qword [rsp + 0x32], rdx
movabs rdx, 0xb09071509050709
mov qword [rsp + 0x3a], rdx
movabs rdx, 0x1415040d070c0b09
mov qword [rsp + 0x40], rdx
movabs rdx, 0xa040e050a10160a
mov qword [rsp + 0x48], rdx
xor eax, eax
jmp 0x4a3148
movzx r9d, byte [rsp + rsi + 0x19]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x55]
mov byte [rsp + rdi + 0x19], dl
mov byte [rsp + rsi + 0x19], r8b
add rax, 2
cmp rax, 0x1e
jge 0x4a317c
movzx edx, byte [rsp + rax + 0x32]
movzx esi, byte [rsp + rax + 0x33]
mov edi, edx
xor edx, esi
add edx, eax
nop
cmp rdi, 0x19
jae 0x4a319f
movzx r8d, byte [rsp + rdi + 0x19]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x55]
cmp rsi, 0x19
jb 0x4a312e
jmp 0x4a3193
xor eax, eax
lea rbx, [rsp + 0x19]
mov ecx, 0x19
call fcn.00445b60
add rsp, 0x50
pop rbp
ret
mov eax, esi
mov ecx, 0x19
call fcn.00457ea0
mov eax, edi
mov ecx, 0x19
call fcn.00457ea0
nop
call fcn.00455c20
jmp fcn.004a30a0
Function at 0x4a35e0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4a36cc
push rbp
mov rbp, rsp
sub rsp, 0x48
movabs rdx, 0x96a87b9a6c5f6584
mov qword [rsp + 0x1f], rdx
movabs rdx, 0x69617196a87b9a6c
mov qword [rsp + 0x22], rdx
movabs rdx, 0x926197a7462e999d
mov qword [rsp + 0x2a], rdx
movabs rdx, 0x410120c06020f
mov qword [rsp + 0x32], rdx
movabs rdx, 0x70f0b02060c0004
mov qword [rsp + 0x38], rdx
movabs rdx, 0xa0502000f050808
mov qword [rsp + 0x40], rdx
xor eax, eax
jmp 0x4a366a
movzx r9d, byte [rsp + rsi + 0x1f]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x29]
mov byte [rsp + rdi + 0x1f], dl
mov byte [rsp + rsi + 0x1f], r8b
add rax, 2
cmp rax, 0x16
jge 0x4a369c
movzx edx, byte [rsp + rax + 0x32]
movzx esi, byte [rsp + rax + 0x33]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x13
jae 0x4a36bf
movzx r8d, byte [rsp + rdi + 0x1f]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x29]
cmp rsi, 0x13
jb 0x4a3650
jmp 0x4a36b3
xor eax, eax
lea rbx, [rsp + 0x1f]
mov ecx, 0x13
call fcn.00445b60
add rsp, 0x48
pop rbp
ret
mov eax, esi
mov ecx, 0x13
call fcn.00457ea0
mov eax, edi
mov ecx, 0x13
call fcn.00457ea0
nop
call fcn.00455c20
jmp fcn.004a35e0

Function at 0x4a5860
Capabilities:
Encrypt data using rc4 prga

Disassembly:
lea r12, [rsp - 8]
cmp r12, qword [r14 + 0x10]
jbe 0x4a59c7
push rbp
mov rbp, rsp
add rsp, 0xffffffffffffff80
movabs rdx, 0x78739833e67f61e2
mov qword [rsp + 0x1d], rdx
movabs rdx, 0x76a8a39070a64c6c
mov qword [rsp + 0x25], rdx
movabs rdx, 0x7976a8a39070a64c
mov qword [rsp + 0x26], rdx
movabs rdx, 0x1120786d9b6f2089
mov qword [rsp + 0x2e], rdx
movabs rdx, 0xf16eb4eb70b396a7
mov qword [rsp + 0x36], rdx
movabs rdx, 0xde75421bacbcbcad
mov qword [rsp + 0x3e], rdx
movabs rdx, 0x260325110f101415
mov qword [rsp + 0x46], rdx
movabs rdx, 0x28211926110d2411
mov qword [rsp + 0x4e], rdx
movabs rdx, 0x181528211926110d
mov qword [rsp + 0x50], rdx
movabs rdx, 0x182816071d141504
mov qword [rsp + 0x58], rdx
movabs rdx, 0x2421220606210600
mov qword [rsp + 0x60], rdx
movabs rdx, 0x60211190e210414
mov qword [rsp + 0x68], rdx
movabs rdx, 0x905241b230f1a14
mov qword [rsp + 0x70], rdx
movabs rdx, 0xa1a041e04200c1a
mov qword [rsp + 0x78], rdx
xor eax, eax
jmp 0x4a596a
movzx r9d, byte [rsp + rsi + 0x1d]
sub r9d, edx
lea edx, [r9 + 0x10]
mov byte [rsp + rdi + 0x1d], dl
lea edx, [r8 + 0x10]
mov byte [rsp + rsi + 0x1d], dl
add rax, 2
cmp rax, 0x3a
jge 0x4a5997
movzx edx, byte [rsp + rax + 0x46]
movzx esi, byte [rsp + rax + 0x47]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x29
jae 0x4a59ba
movzx r8d, byte [rsp + rdi + 0x1d]
sub r8d, edx
cmp rsi, 0x29
jb 0x4a594d
jmp 0x4a59ae
xor eax, eax
lea rbx, [rsp + 0x1d]
mov ecx, 0x29
call fcn.00445b60
sub rsp, 0xffffffffffffff80
pop rbp
ret
mov eax, esi
mov ecx, 0x29
call fcn.00457ea0
mov eax, edi
mov ecx, 0x29
call fcn.00457ea0
nop
call fcn.00455c20
jmp fcn.004a5860
Function at 0x4a59e0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4a5ab2
push rbp
mov rbp, rsp
sub rsp, 0x38
movabs rdx, 0x9fc1c8c620fb4a62
mov qword [rsp + 0x1f], rdx
movabs rdx, 0x657acd9fc1c8c620
mov qword [rsp + 0x22], rdx
movabs rdx, 0x706010102080207
mov qword [rsp + 0x2a], rdx
movabs rdx, 0x804050108060706
mov qword [rsp + 0x30], rdx
xor eax, eax
jmp 0x4a5a4c
movzx r9d, byte [rsp + rsi + 0x1f]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x75]
mov byte [rsp + rdi + 0x1f], dl
mov byte [rsp + rsi + 0x1f], r8b
add rax, 2
cmp rax, 0xe
jge 0x4a5a7e
movzx edx, byte [rsp + rax + 0x2a]
movzx esi, byte [rsp + rax + 0x2b]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0xb
jae 0x4a5aa5
movzx r8d, byte [rsp + rdi + 0x1f]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x75]
cmp rsi, 0xb
jb 0x4a5a32
jmp 0x4a5a95
xor eax, eax
lea rbx, [rsp + 0x1f]
mov ecx, 0xb
call fcn.00445b60
add rsp, 0x38
pop rbp
ret
mov eax, esi
mov ecx, 0xb
nop dword [rax]
call fcn.00457ea0
mov eax, edi
mov ecx, 0xb
call fcn.00457ea0
nop
call fcn.00455c20
jmp fcn.004a59e0

Function at 0x4a5ac0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4a5b86
push rbp
mov rbp, rsp
sub rsp, 0x30
movabs rdx, 0xb8bbc66c61765bc4
mov qword [rsp + 0x1b], rdx
mov byte [rsp + 0x23], 0xc0
movabs rdx, 0x501050105000008
mov qword [rsp + 0x24], rdx
mov dword [rsp + 0x2c], 0x1060007
xor eax, eax
nop
jmp 0x4a5b20
movzx r9d, byte [rsp + rsi + 0x1b]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x5e]
mov byte [rsp + rdi + 0x1b], dl
mov byte [rsp + rsi + 0x1b], r8b
add rax, 2
nop dword [rax]
cmp rax, 0xc
jge 0x4a5b52
movzx edx, byte [rsp + rax + 0x24]
movzx esi, byte [rsp + rax + 0x25]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 9
jae 0x4a5b77
movzx r8d, byte [rsp + rdi + 0x1b]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x5e]
cmp rsi, 9
jb 0x4a5b02
jmp 0x4a5b6b
xor eax, eax
lea rbx, [rsp + 0x1b]
mov ecx, 9
nop
call fcn.00445b60
add rsp, 0x30
pop rbp
ret
mov eax, esi
mov ecx, 9
call fcn.00457ea0
mov eax, edi
mov ecx, 9
nop
call fcn.00457ea0
nop
call fcn.00455c20
jmp fcn.004a5ac0