joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4b34a0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4b356b
sub rsp, 0x38
mov qword [rsp + 0x30], rbp
lea rbp, [rsp + 0x30]
movabs rdx, 0x4f92dc65cfd63d09
mov qword [rsp + 0x1b], rdx
mov byte [rsp + 0x23], 0x48
movabs rdx, 0x103020706080200
mov qword [rsp + 0x24], rdx
mov dword [rsp + 0x2c], 0x6020305
xor eax, eax
jmp 0x4b3504
movzx r9d, byte [rsp + rsi + 0x1b]
sub r9d, edx
lea edx, [r9 - 0x62]
mov byte [rsp + rdi + 0x1b], dl
lea edx, [r8 - 0x62]
mov byte [rsp + rsi + 0x1b], dl
add rax, 2
cmp rax, 0xc
jge 0x4b3537
movzx edx, byte [rsp + rax + 0x24]
movzx esi, byte [rsp + rax + 0x25]
mov edi, edx
xor edx, esi
add edx, eax
nop word [rax + rax]
cmp rdi, 9
jae 0x4b355e
movzx r8d, byte [rsp + rdi + 0x1b]
sub r8d, edx
cmp rsi, 9
jb 0x4b34e7
jmp 0x4b3552
xor eax, eax
lea rbx, [rsp + 0x1b]
mov ecx, 9
call fcn.00444d40
mov rbp, qword [rsp + 0x30]
add rsp, 0x38
ret
mov eax, esi
mov ecx, 9
call fcn.00457d20
mov eax, edi
mov ecx, 9
call fcn.00457d20
nop
call fcn.004556c0
jmp fcn.004b34a0

Function at 0x4b45a0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
lea r12, [rsp - 0x10]
cmp r12, qword [r14 + 0x10]
jbe 0x4b4727
sub rsp, 0x90
mov qword [rsp + 0x88], rbp
lea rbp, [rsp + 0x88]
movabs rdx, 0x5510d131261359e6
mov qword [rsp + 0x1c], rdx
movabs rdx, 0xd02609376e3eaf20
mov qword [rsp + 0x24], rdx
movabs rdx, 0x20742f6fd0260937
mov qword [rsp + 0x28], rdx
movabs rdx, 0x74620f0c4cd5dd77
mov qword [rsp + 0x30], rdx
movabs rdx, 0x29bd146351669665
mov qword [rsp + 0x38], rdx
movabs rdx, 0x200ac20a322cf765
mov qword [rsp + 0x40], rdx
movabs rdx, 0xf1122110c1d2600
mov qword [rsp + 0x48], rdx
movabs rdx, 0x292a26010d05181a
mov qword [rsp + 0x50], rdx
movabs rdx, 0x252826211616161d
mov qword [rsp + 0x58], rdx
movabs rdx, 0xc1d0d110a211509
mov qword [rsp + 0x60], rdx
movabs rdx, 0x15181d03072a020e
mov qword [rsp + 0x68], rdx
movabs rdx, 0x150f0f0a09042723
mov qword [rsp + 0x70], rdx
movabs rdx, 0x1119110f1d031604
mov qword [rsp + 0x78], rdx
movabs rdx, 0x170e28251f112206
mov qword [rsp + 0x80], rdx
xor eax, eax
jmp 0x4b46c0
movzx r9d, byte [rsp + rsi + 0x1c]
sub r9d, edx
lea edx, [r9 + 0x6c]
mov byte [rsp + rdi + 0x1c], dl
lea edx, [r8 + 0x6c]
mov byte [rsp + rsi + 0x1c], dl
add rax, 2
nop dword [rax]
cmp rax, 0x40
jge 0x4b46ed
movzx edx, byte [rsp + rax + 0x48]
movzx esi, byte [rsp + rax + 0x49]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x2c
jae 0x4b471a
movzx r8d, byte [rsp + rdi + 0x1c]
sub r8d, edx
cmp rsi, 0x2c
jb 0x4b469f
jmp 0x4b470e
xor eax, eax
lea rbx, [rsp + 0x1c]
mov ecx, 0x2c
call fcn.00444d40
mov rbp, qword [rsp + 0x88]
add rsp, 0x90
ret
mov eax, esi
mov ecx, 0x2c
call fcn.00457d20
mov eax, edi
mov ecx, 0x2c
call fcn.00457d20
nop
call fcn.004556c0
jmp fcn.004b45a0
Function at 0x4b4b40
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4b4c3c
sub rsp, 0x48
mov qword [rsp + 0x40], rbp
lea rbp, [rsp + 0x40]
movabs rdx, 0x1d12de6fa87a69bc
mov qword [rsp + 0x1d], rdx
movabs rdx, 0x31d12de6fa87a69
mov qword [rsp + 0x1e], rdx
movabs rdx, 0xb020b420b70a0b1a
mov qword [rsp + 0x26], rdx
movabs rdx, 0xe050a09030e0700
mov qword [rsp + 0x2e], rdx
movabs rdx, 0x3080e050a09030e
mov qword [rsp + 0x30], rdx
movabs rdx, 0x6070c100b0b0709
mov qword [rsp + 0x38], rdx
xor eax, eax
jmp 0x4b4bd0
movzx r9d, byte [rsp + rsi + 0x1d]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x4f]
mov byte [rsp + rdi + 0x1d], dl
mov byte [rsp + rsi + 0x1d], r8b
add rax, 2
cmp rax, 0x12
jge 0x4b4c08
movzx edx, byte [rsp + rax + 0x2e]
movzx esi, byte [rsp + rax + 0x2f]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x11
jae 0x4b4c2f
movzx r8d, byte [rsp + rdi + 0x1d]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x4f]
nop word [rax + rax]
cmp rsi, 0x11
jb 0x4b4bb6
jmp 0x4b4c23
xor eax, eax
lea rbx, [rsp + 0x1d]
mov ecx, 0x11
call fcn.00444d40
mov rbp, qword [rsp + 0x40]
add rsp, 0x48
ret
mov eax, esi
mov ecx, 0x11
call fcn.00457d20
mov eax, edi
mov ecx, 0x11
call fcn.00457d20
nop
nop dword [rax]
call fcn.004556c0
jmp fcn.004b4b40
Function at 0x4b5ee0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4b5fa8
sub rsp, 0x38
mov qword [rsp + 0x30], rbp
lea rbp, [rsp + 0x30]
movabs rdx, 0x8889977c878a8177
mov qword [rsp + 0x1d], rdx
mov byte [rsp + 0x25], 0x6e
movabs rdx, 0x304010600060205
mov qword [rsp + 0x26], rdx
mov word [rsp + 0x2e], 0x107
xor eax, eax
jmp 0x4b5f40
movzx r9d, byte [rsp + rsi + 0x1d]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x28]
mov byte [rsp + rdi + 0x1d], dl
mov byte [rsp + rsi + 0x1d], r8b
add rax, 2
cmp rax, 0xa
jge 0x4b5f72
movzx edx, byte [rsp + rax + 0x26]
movzx esi, byte [rsp + rax + 0x27]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 9
jae 0x4b5f9b
movzx r8d, byte [rsp + rdi + 0x1d]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x28]
cmp rsi, 9
jb 0x4b5f26
jmp 0x4b5f8f
xor eax, eax
lea rbx, [rsp + 0x1d]
mov ecx, 9
nop
call fcn.00444d40
mov rbp, qword [rsp + 0x30]
add rsp, 0x38
ret
mov eax, esi
mov ecx, 9
call fcn.00457d20
mov eax, edi
mov ecx, 9
call fcn.00457d20
nop
call fcn.004556c0
jmp fcn.004b5ee0

Function at 0x4b5fc0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4b60b6
sub rsp, 0x50
mov qword [rsp + 0x48], rbp
lea rbp, [rsp + 0x48]
movabs rdx, 0xe16e77d2dcd7313d
mov qword [rsp + 0x1f], rdx
movabs rdx, 0xb8e16e77d2dcd731
mov qword [rsp + 0x20], rdx
movabs rdx, 0xf3223008c81adb79
mov qword [rsp + 0x28], rdx
movabs rdx, 0x20a0b080a0c0a
mov qword [rsp + 0x30], rdx
movabs rdx, 0xc030d1007040302
mov qword [rsp + 0x38], rdx
movabs rdx, 0x1000e0210040f0d
mov qword [rsp + 0x40], rdx
xor eax, eax
jmp 0x4b6053
movzx r9d, byte [rsp + rsi + 0x1f]
sub r9d, edx
lea edx, [r9 + 0x5b]
mov byte [rsp + rdi + 0x1f], dl
lea edx, [r8 + 0x5b]
mov byte [rsp + rsi + 0x1f], dl
add rax, 2
cmp rax, 0x18
jge 0x4b6082
movzx edx, byte [rsp + rax + 0x30]
movzx esi, byte [rsp + rax + 0x31]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x11
jae 0x4b60a9
movzx r8d, byte [rsp + rdi + 0x1f]
sub r8d, edx
cmp rsi, 0x11
jb 0x4b6036
nop
jmp 0x4b609d
xor eax, eax
lea rbx, [rsp + 0x1f]
mov ecx, 0x11
call fcn.00444d40
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
mov eax, esi
mov ecx, 0x11
call fcn.00457d20
mov eax, edi
mov ecx, 0x11
call fcn.00457d20
nop
call fcn.004556c0
nop dword [rax + rax]
jmp fcn.004b5fc0
Function at 0x4b60e0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4b6232
add rsp, 0xffffffffffffff80
mov qword [rsp + 0x78], rbp
lea rbp, [rsp + 0x78]
movabs rdx, 0x3a74cd65ecb594b3
mov qword [rsp + 0x1f], rdx
movabs rdx, 0x70ee74e1ea696e20
mov qword [rsp + 0x27], rdx
movabs rdx, 0x2620f270ee74e1ea
mov qword [rsp + 0x2a], rdx
movabs rdx, 0xf774fbef5bd4fecd
mov qword [rsp + 0x32], rdx
movabs rdx, 0x6ddc2e9463e15469
mov qword [rsp + 0x3a], rdx
movabs rdx, 0xe76cd917fac96cb2
mov qword [rsp + 0x42], rdx
movabs rdx, 0xe261b1f1a011802
mov qword [rsp + 0x4a], rdx
movabs rdx, 0x171228152a1d1229
mov qword [rsp + 0x52], rdx
movabs rdx, 0x271b1a14161b1712
mov qword [rsp + 0x58], rdx
movabs rdx, 0x29131f270c251025
mov qword [rsp + 0x60], rdx
movabs rdx, 0x2112031e0b1b25
mov qword [rsp + 0x68], rdx
movabs rdx, 0x23050b0303161f23
mov qword [rsp + 0x70], rdx
xor eax, eax
jmp 0x4b61ca
movzx r9d, byte [rsp + rsi + 0x1f]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x51]
mov byte [rsp + rdi + 0x1f], dl
mov byte [rsp + rsi + 0x1f], r8b
add rax, 2
cmp rax, 0x2e
jge 0x4b61fc
movzx edx, byte [rsp + rax + 0x4a]
movzx esi, byte [rsp + rax + 0x4b]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x2b
jae 0x4b6225
movzx r8d, byte [rsp + rdi + 0x1f]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x51]
cmp rsi, 0x2b
jb 0x4b61b0
jmp 0x4b6217
xor eax, eax
lea rbx, [rsp + 0x1f]
mov ecx, 0x2b
call fcn.00444d40
mov rbp, qword [rsp + 0x78]
sub rsp, 0xffffffffffffff80
ret
mov eax, esi
mov ecx, 0x2b
nop
call fcn.00457d20
mov eax, edi
mov ecx, 0x2b
call fcn.00457d20
nop
call fcn.004556c0
jmp fcn.004b60e0

Function at 0x4b6be0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4b6d08
sub rsp, 0x68
mov qword [rsp + 0x60], rbp
lea rbp, [rsp + 0x60]
movabs rdx, 0x7b6e63496c986528
mov qword [rsp + 0x1a], rdx
movabs rdx, 0x85646e576d4b6f55
mov qword [rsp + 0x22], rdx
movabs rdx, 0x6a682d393725876d
mov qword [rsp + 0x2a], rdx
movabs rdx, 0x75541779748f636e
mov qword [rsp + 0x32], rdx
movabs rdx, 0x1411131a1f0f0402
mov qword [rsp + 0x3a], rdx
movabs rdx, 0x417131e130a1411
mov qword [rsp + 0x40], rdx
movabs rdx, 0x81f120f070216
mov qword [rsp + 0x48], rdx
movabs rdx, 0x9001d10070e071d
mov qword [rsp + 0x50], rdx
movabs rdx, 0x71606000c1e1307
mov qword [rsp + 0x58], rdx
xor eax, eax
jmp 0x4b6ca0
movzx r9d, byte [rsp + rsi + 0x1a]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x24]
mov byte [rsp + rdi + 0x1a], dl
mov byte [rsp + rsi + 0x1a], r8b
add rax, 2
nop dword [rax]
cmp rax, 0x26
jge 0x4b6cd2
movzx edx, byte [rsp + rax + 0x3a]
movzx esi, byte [rsp + rax + 0x3b]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x20
jae 0x4b6cfb
movzx r8d, byte [rsp + rdi + 0x1a]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x24]
cmp rsi, 0x20
jb 0x4b6c83
jmp 0x4b6cef
xor eax, eax
lea rbx, [rsp + 0x1a]
mov ecx, 0x20
nop
call fcn.00444d40
mov rbp, qword [rsp + 0x60]
add rsp, 0x68
ret
mov eax, esi
mov ecx, 0x20
call fcn.00457d20
mov eax, edi
mov ecx, 0x20
call fcn.00457d20
nop
call fcn.004556c0
jmp fcn.004b6be0
Function at 0x4b7420
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4b7546
sub rsp, 0x68
mov qword [rsp + 0x60], rbp
lea rbp, [rsp + 0x60]
movabs rdx, 0x3ace6365c0ddbf72
mov qword [rsp + 0x19], rdx
movabs rdx, 0x20666fba62bfd8bf
mov qword [rsp + 0x21], rdx
movabs rdx, 0x2072612dc86bd020
mov qword [rsp + 0x28], rdx
movabs rdx, 0x4484c079bd74ce44
mov qword [rsp + 0x30], rdx
movabs rdx, 0x171106181608111e
mov qword [rsp + 0x38], rdx
movabs rdx, 0x120b031016190c0b
mov qword [rsp + 0x40], rdx
movabs rdx, 0x1103121a1c1d111d
mov qword [rsp + 0x48], rdx
movabs rdx, 0x1a020a011e160806
mov qword [rsp + 0x50], rdx
movabs rdx, 0x9171e1d1e110316
mov qword [rsp + 0x58], rdx
xor eax, eax
jmp 0x4b74e0
movzx r9d, byte [rsp + rsi + 0x19]
sub r9d, edx
lea edx, [r9 - 0x33]
mov byte [rsp + rdi + 0x19], dl
lea edx, [r8 - 0x33]
mov byte [rsp + rsi + 0x19], dl
add rax, 2
cmp rax, 0x28
jge 0x4b750d
movzx edx, byte [rsp + rax + 0x38]
movzx esi, byte [rsp + rax + 0x39]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x1f
jae 0x4b7534
movzx r8d, byte [rsp + rdi + 0x19]
sub r8d, edx
cmp rsi, 0x1f
jb 0x4b74c3
jmp 0x4b7528
xor eax, eax
lea rbx, [rsp + 0x19]
mov ecx, 0x1f
call fcn.00444d40
mov rbp, qword [rsp + 0x60]
add rsp, 0x68
ret
mov eax, esi
mov ecx, 0x1f
call fcn.00457d20
mov eax, edi
mov ecx, 0x1f
nop dword [rax + rax]
call fcn.00457d20
nop
call fcn.004556c0
jmp fcn.004b7420

Function at 0x4b7960
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4b7a86
sub rsp, 0x68
mov qword [rsp + 0x60], rbp
lea rbp, [rsp + 0x60]
movabs rdx, 0xd0091ae9e0b1c11c
mov qword [rsp + 0x1b], rdx
movabs rdx, 0x1e345488066e492e
mov qword [rsp + 0x23], rdx
movabs rdx, 0x5b662d6ed41e3454
mov qword [rsp + 0x28], rdx
movabs rdx, 0xc3989b9a742dff6e
mov qword [rsp + 0x30], rdx
movabs rdx, 0x100d1b1a1c0b01
mov qword [rsp + 0x38], rdx
movabs rdx, 0xe140605070c0c19
mov qword [rsp + 0x40], rdx
movabs rdx, 0x170d0f02030c1b00
mov qword [rsp + 0x48], rdx
movabs rdx, 0x161a0e00191c190e
mov qword [rsp + 0x50], rdx
movabs rdx, 0x80419001a0c0f0c
mov qword [rsp + 0x58], rdx
xor eax, eax
jmp 0x4b7a20
movzx r9d, byte [rsp + rsi + 0x1b]
sub r9d, edx
lea edx, [r9 + 0x69]
mov byte [rsp + rdi + 0x1b], dl
lea edx, [r8 + 0x69]
mov byte [rsp + rsi + 0x1b], dl
add rax, 2
cmp rax, 0x28
jge 0x4b7a4d
movzx edx, byte [rsp + rax + 0x38]
movzx esi, byte [rsp + rax + 0x39]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x1d
jae 0x4b7a74
movzx r8d, byte [rsp + rdi + 0x1b]
sub r8d, edx
cmp rsi, 0x1d
jb 0x4b7a03
jmp 0x4b7a68
xor eax, eax
lea rbx, [rsp + 0x1b]
mov ecx, 0x1d
call fcn.00444d40
mov rbp, qword [rsp + 0x60]
add rsp, 0x68
ret
mov eax, esi
mov ecx, 0x1d
call fcn.00457d20
mov eax, edi
mov ecx, 0x1d
nop dword [rax + rax]
call fcn.00457d20
nop
call fcn.004556c0
jmp fcn.004b7960
Function at 0x4b83a0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4b84e8
sub rsp, 0x70
mov qword [rsp + 0x68], rbp
lea rbp, [rsp + 0x68]
movabs rdx, 0x8ca16365aeafa160
mov qword [rsp + 0x19], rdx
movabs rdx, 0x657dcbb9a18ca163
mov qword [rsp + 0x1e], rdx
movabs rdx, 0x7421ec906e485a62
mov qword [rsp + 0x26], rdx
movabs rdx, 0x6be075e1bb766b3a
mov qword [rsp + 0x2e], rdx
movabs rdx, 0x8d65874f74b2d1dc
mov qword [rsp + 0x36], rdx
movabs rdx, 0x822130e1f000f0a
mov qword [rsp + 0x3e], rdx
movabs rdx, 0x1824161c0903180b
mov qword [rsp + 0x46], rdx
movabs rdx, 0x12191824161c0903
mov qword [rsp + 0x48], rdx
movabs rdx, 0x180e131b0d210a1e
mov qword [rsp + 0x50], rdx
movabs rdx, 0x1e121b191d1e1813
mov qword [rsp + 0x58], rdx
movabs rdx, 0x72111010a190206
mov qword [rsp + 0x60], rdx
xor eax, eax
nop
jmp 0x4b8480
movzx r9d, byte [rsp + rsi + 0x19]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x61]
mov byte [rsp + rdi + 0x19], dl
mov byte [rsp + rsi + 0x19], r8b
add rax, 2
nop dword [rax]
cmp rax, 0x2a
jge 0x4b84b2
movzx edx, byte [rsp + rax + 0x3e]
movzx esi, byte [rsp + rax + 0x3f]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x25
jae 0x4b84db
movzx r8d, byte [rsp + rdi + 0x19]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x61]
cmp rsi, 0x25
jb 0x4b8462
jmp 0x4b84cf
xor eax, eax
lea rbx, [rsp + 0x19]
mov ecx, 0x25
nop
call fcn.00444d40
mov rbp, qword [rsp + 0x68]
add rsp, 0x70
ret
mov eax, esi
mov ecx, 0x25
call fcn.00457d20
mov eax, edi
mov ecx, 0x25
call fcn.00457d20
nop
call fcn.004556c0
jmp fcn.004b83a0

Function at 0x4b8860
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4b894b
sub rsp, 0x48
mov qword [rsp + 0x40], rbp
lea rbp, [rsp + 0x40]
movabs rdx, 0x576568515e09183a
mov qword [rsp + 0x1a], rdx
movabs rdx, 0x61f34a56e420663c
mov qword [rsp + 0x22], rdx
movabs rdx, 0xf020d0b07080b02
mov qword [rsp + 0x2a], rdx
movabs rdx, 0x407040e030d0f02
mov qword [rsp + 0x30], rdx
movabs rdx, 0x5080f010c0b030c
mov qword [rsp + 0x38], rdx
xor eax, eax
jmp 0x4b88e4
movzx r9d, byte [rsp + rsi + 0x1a]
sub r9d, edx
lea edx, [r9 + 0x28]
mov byte [rsp + rdi + 0x1a], dl
lea edx, [r8 + 0x28]
mov byte [rsp + rsi + 0x1a], dl
add rax, 2
cmp rax, 0x16
jge 0x4b8917
movzx edx, byte [rsp + rax + 0x2a]
movzx esi, byte [rsp + rax + 0x2b]
mov edi, edx
xor edx, esi
add edx, eax
nop word [rax + rax]
cmp rdi, 0x10
jae 0x4b893e
movzx r8d, byte [rsp + rdi + 0x1a]
sub r8d, edx
cmp rsi, 0x10
jb 0x4b88c7
jmp 0x4b8932
xor eax, eax
lea rbx, [rsp + 0x1a]
mov ecx, 0x10
call fcn.00444d40
mov rbp, qword [rsp + 0x40]
add rsp, 0x48
ret
mov eax, esi
mov ecx, 0x10
call fcn.00457d20
mov eax, edi
mov ecx, 0x10
call fcn.00457d20
nop
call fcn.004556c0
jmp fcn.004b8860
Function at 0x4b8960
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4b8a76
sub rsp, 0x60
mov qword [rsp + 0x58], rbp
lea rbp, [rsp + 0x58]
movabs rdx, 0xeed96fe4207369e9
mov qword [rsp + 0x1d], rdx
movabs rdx, 0xf0616e6a696c6fab
mov qword [rsp + 0x25], rdx
movabs rdx, 0x309e6f0616e6a69
mov qword [rsp + 0x28], rdx
movabs rdx, 0xec60531ee73bba74
mov qword [rsp + 0x30], rdx
movabs rdx, 0xc0910071514081a
mov qword [rsp + 0x38], rdx
movabs rdx, 0x1217161819060a16
mov qword [rsp + 0x40], rdx
movabs rdx, 0x1214120711090f04
mov qword [rsp + 0x48], rdx
movabs rdx, 0x9000606160c060a
mov qword [rsp + 0x50], rdx
xor eax, eax
jmp 0x4b8a0e
movzx r9d, byte [rsp + rsi + 0x1d]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x63]
mov byte [rsp + rdi + 0x1d], dl
mov byte [rsp + rsi + 0x1d], r8b
add rax, 2
cmp rax, 0x20
jge 0x4b8a42
movzx edx, byte [rsp + rax + 0x38]
movzx esi, byte [rsp + rax + 0x39]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x1b
jae 0x4b8a69
movzx r8d, byte [rsp + rdi + 0x1d]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x63]
cmp rsi, 0x1b
jb 0x4b89f4
nop
jmp 0x4b8a5d
xor eax, eax
lea rbx, [rsp + 0x1d]
mov ecx, 0x1b
call fcn.00444d40
mov rbp, qword [rsp + 0x58]
add rsp, 0x60
ret
mov eax, esi
mov ecx, 0x1b
call fcn.00457d20
mov eax, edi
mov ecx, 0x1b
call fcn.00457d20
nop
call fcn.004556c0
nop dword [rax + rax]
jmp fcn.004b8960

Function at 0x4b90c0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4b91bc
sub rsp, 0x48
mov qword [rsp + 0x40], rbp
lea rbp, [rsp + 0x40]
movabs rdx, 0xd774331f373d654d
mov qword [rsp + 0x1a], rdx
movabs rdx, 0x610ad774331f373d
mov qword [rsp + 0x1c], rdx
movabs rdx, 0x3a6e69e92e3e146c
mov qword [rsp + 0x24], rdx
movabs rdx, 0x5110705040b0208
mov qword [rsp + 0x2c], rdx
movabs rdx, 0x2070e0405110705
mov qword [rsp + 0x30], rdx
movabs rdx, 0x704030c000b0b11
mov qword [rsp + 0x38], rdx
xor eax, eax
jmp 0x4b9150
movzx r9d, byte [rsp + rsi + 0x1a]
lea edx, [r9 + rdx]
lea edx, [rdx + 0xf]
mov byte [rsp + rdi + 0x1a], dl
mov byte [rsp + rsi + 0x1a], r8b
add rax, 2
cmp rax, 0x14
jge 0x4b9188
movzx edx, byte [rsp + rax + 0x2c]
movzx esi, byte [rsp + rax + 0x2d]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x12
jae 0x4b91af
movzx r8d, byte [rsp + rdi + 0x1a]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0xf]
nop word [rax + rax]
cmp rsi, 0x12
jb 0x4b9136
jmp 0x4b91a3
xor eax, eax
lea rbx, [rsp + 0x1a]
mov ecx, 0x12
call fcn.00444d40
mov rbp, qword [rsp + 0x40]
add rsp, 0x48
ret
mov eax, esi
mov ecx, 0x12
call fcn.00457d20
mov eax, edi
mov ecx, 0x12
call fcn.00457d20
nop
nop dword [rax]
call fcn.004556c0
jmp fcn.004b90c0
Function at 0x4ba7c0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
lea r12, [rsp - 0x10]
cmp r12, qword [r14 + 0x10]
jbe 0x4ba947
sub rsp, 0x90
mov qword [rsp + 0x88], rbp
lea rbp, [rsp + 0x88]
movabs rdx, 0x4d74902d742cf044
mov qword [rsp + 0x1b], rdx
movabs rdx, 0x654b7080384d7490
mov qword [rsp + 0x20], rdx
movabs rdx, 0x203a6514634d663b
mov qword [rsp + 0x28], rdx
movabs rdx, 0x7361676e50724176
mov qword [rsp + 0x30], rdx
movabs rdx, 0x2e6e694e6563695c
mov qword [rsp + 0x38], rdx
movabs rdx, 0x38005b7e6f4be565
mov qword [rsp + 0x40], rdx
movabs rdx, 0x7389e9ec52781766
mov qword [rsp + 0x48], rdx
movabs rdx, 0x1d242e2621111600
mov qword [rsp + 0x50], rdx
movabs rdx, 0x71d100f2f320204
mov qword [rsp + 0x58], rdx
movabs rdx, 0x210d26302a31032c
mov qword [rsp + 0x60], rdx
movabs rdx, 0x9320b070a332b0b
mov qword [rsp + 0x68], rdx
movabs rdx, 0x926031b2f210301
mov qword [rsp + 0x70], rdx
movabs rdx, 0x180e2a2b160b2f27
mov qword [rsp + 0x78], rdx
movabs rdx, 0x5290f2c0a152708
mov qword [rsp + 0x80], rdx
xor eax, eax
jmp 0x4ba8e0
movzx r9d, byte [rsp + rsi + 0x1b]
sub r9d, edx
lea edx, [r9 + 0x47]
mov byte [rsp + rdi + 0x1b], dl
lea edx, [r8 + 0x47]
mov byte [rsp + rsi + 0x1b], dl
add rax, 2
nop dword [rax]
cmp rax, 0x38
jge 0x4ba90d
movzx edx, byte [rsp + rax + 0x50]
movzx esi, byte [rsp + rax + 0x51]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x35
jae 0x4ba93a
movzx r8d, byte [rsp + rdi + 0x1b]
sub r8d, edx
cmp rsi, 0x35
jb 0x4ba8bf
jmp 0x4ba92e
xor eax, eax
lea rbx, [rsp + 0x1b]
mov ecx, 0x35
call fcn.00444d40
mov rbp, qword [rsp + 0x88]
add rsp, 0x90
ret
mov eax, esi
mov ecx, 0x35
call fcn.00457d20
mov eax, edi
mov ecx, 0x35
call fcn.00457d20
nop
call fcn.004556c0
jmp fcn.004ba7c0

Function at 0x4ba960
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4baa28
sub rsp, 0x38
mov qword [rsp + 0x30], rbp
lea rbp, [rsp + 0x30]
movabs rdx, 0xaf8596a2a03c7469
mov qword [rsp + 0x1b], rdx
mov byte [rsp + 0x23], 0x6e
movabs rdx, 0x603050101060304
mov qword [rsp + 0x24], rdx
mov dword [rsp + 0x2c], 0x1070107
xor eax, eax
jmp 0x4ba9c1
movzx r9d, byte [rsp + rsi + 0x1b]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x34]
mov byte [rsp + rdi + 0x1b], dl
mov byte [rsp + rsi + 0x1b], r8b
add rax, 2
cmp rax, 0xc
jge 0x4ba9f3
movzx edx, byte [rsp + rax + 0x24]
movzx esi, byte [rsp + rax + 0x25]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 9
jae 0x4baa1b
movzx r8d, byte [rsp + rdi + 0x1b]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x34]
cmp rsi, 9
jb 0x4ba9a7
jmp 0x4baa0f
xor eax, eax
lea rbx, [rsp + 0x1b]
mov ecx, 9
nop
call fcn.00444d40
mov rbp, qword [rsp + 0x30]
add rsp, 0x38
ret
mov eax, esi
mov ecx, 9
call fcn.00457d20
mov eax, edi
mov ecx, 9
call fcn.00457d20
nop
call fcn.004556c0
jmp fcn.004ba960
Function at 0x4bc2e0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4bc428
sub rsp, 0x78
mov qword [rsp + 0x70], rbp
lea rbp, [rsp + 0x70]
movabs rdx, 0xf974d965ff43c272
mov qword [rsp + 0x18], rdx
movabs rdx, 0x797c083bef6cf6d4
mov qword [rsp + 0x20], rdx
movabs rdx, 0xe17aae65e97552cc
mov qword [rsp + 0x28], rdx
movabs rdx, 0xdb722d56ff6ee5b6
mov qword [rsp + 0x30], rdx
movabs rdx, 0xbe63b342737a5d6e
mov qword [rsp + 0x38], rdx
movabs rdx, 0x171c0f031c211b0f
mov qword [rsp + 0x40], rdx
movabs rdx, 0x170b020e081b0913
mov qword [rsp + 0x48], rdx
movabs rdx, 0x1c1c240c271c0107
mov qword [rsp + 0x50], rdx
movabs rdx, 0x272122160c241f02
mov qword [rsp + 0x58], rdx
movabs rdx, 0x150b0e0d051b1825
mov qword [rsp + 0x60], rdx
movabs rdx, 0x190e10051c030b19
mov qword [rsp + 0x68], rdx
xor eax, eax
nop
jmp 0x4bc3c0
movzx r9d, byte [rsp + rsi + 0x18]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x56]
mov byte [rsp + rdi + 0x18], dl
mov byte [rsp + rsi + 0x18], r8b
add rax, 2
nop dword [rax]
cmp rax, 0x30
jge 0x4bc3f2
movzx edx, byte [rsp + rax + 0x40]
movzx esi, byte [rsp + rax + 0x41]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x28
jae 0x4bc41b
movzx r8d, byte [rsp + rdi + 0x18]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x56]
cmp rsi, 0x28
jb 0x4bc3a2
jmp 0x4bc40f
xor eax, eax
lea rbx, [rsp + 0x18]
mov ecx, 0x28
nop
call fcn.00444d40
mov rbp, qword [rsp + 0x70]
add rsp, 0x78
ret
mov eax, esi
mov ecx, 0x28
call fcn.00457d20
mov eax, edi
mov ecx, 0x28
call fcn.00457d20
nop
call fcn.004556c0
jmp fcn.004bc2e0

Function at 0x4bc440
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4bc586
sub rsp, 0x78
mov qword [rsp + 0x70], rbp
lea rbp, [rsp + 0x70]
movabs rdx, 0x2b746350d96642e0
mov qword [rsp + 0x18], rdx
movabs rdx, 0x64d77654cfe6303
mov qword [rsp + 0x20], rdx
movabs rdx, 0x262c731ee114426b
mov qword [rsp + 0x28], rdx
movabs rdx, 0x796231286a2c4296
mov qword [rsp + 0x30], rdx
movabs rdx, 0x6d7c4f3989426574
mov qword [rsp + 0x38], rdx
movabs rdx, 0xb131912001c221c
mov qword [rsp + 0x40], rdx
movabs rdx, 0xb0b0708221d1d1c
mov qword [rsp + 0x48], rdx
movabs rdx, 0x190f092514160317
mov qword [rsp + 0x50], rdx
movabs rdx, 0x2227161a270a2610
mov qword [rsp + 0x58], rdx
movabs rdx, 0x10e0b0903041617
mov qword [rsp + 0x60], rdx
movabs rdx, 0x18231b0301140d24
mov qword [rsp + 0x68], rdx
xor eax, eax
nop
jmp 0x4bc520
movzx r9d, byte [rsp + rsi + 0x18]
sub r9d, edx
lea edx, [r9 + 0x46]
mov byte [rsp + rdi + 0x18], dl
lea edx, [r8 + 0x46]
mov byte [rsp + rsi + 0x18], dl
add rax, 2
nop
cmp rax, 0x30
jge 0x4bc54d
movzx edx, byte [rsp + rax + 0x40]
movzx esi, byte [rsp + rax + 0x41]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x28
jae 0x4bc574
movzx r8d, byte [rsp + rdi + 0x18]
sub r8d, edx
cmp rsi, 0x28
jb 0x4bc502
jmp 0x4bc568
xor eax, eax
lea rbx, [rsp + 0x18]
mov ecx, 0x28
call fcn.00444d40
mov rbp, qword [rsp + 0x70]
add rsp, 0x78
ret
mov eax, esi
mov ecx, 0x28
call fcn.00457d20
mov eax, edi
mov ecx, 0x28
nop dword [rax + rax]
call fcn.00457d20
nop
call fcn.004556c0
jmp fcn.004bc440