joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4c9d20
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4c9e33
sub rsp, 0x60
mov qword [rsp + 0x58], rbp
lea rbp, [rsp + 0x58]
movabs rdx, 0x8fd937355f08347
mov qword [rsp + 0x1c], rdx
movabs rdx, 0xeb29d574da666ff7
mov qword [rsp + 0x24], rdx
movabs rdx, 0x9fec12574f30a72
mov qword [rsp + 0x2c], rdx
movabs rdx, 0x14051217070d0611
mov qword [rsp + 0x34], rdx
movabs rdx, 0x1415141714051217
mov qword [rsp + 0x38], rdx
movabs rdx, 0x10c140c0f050f07
mov qword [rsp + 0x40], rdx
movabs rdx, 0x201140214050b0e
mov qword [rsp + 0x48], rdx
movabs rdx, 0xf0c16150b080b0b
mov qword [rsp + 0x50], rdx
xor eax, eax
jmp 0x4c9dce
movzx r9d, byte [rsp + rsi + 0x1c]
add r9d, 0x51
add edx, r9d
mov byte [rsp + rdi + 0x1c], dl
mov byte [rsp + rsi + 0x1c], r8b
add rax, 2
cmp rax, 0x24
jge 0x4c9dff
movzx edx, byte [rsp + rax + 0x34]
movzx esi, byte [rsp + rax + 0x35]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x18
jae 0x4c9e26
movzx r8d, byte [rsp + rdi + 0x1c]
add r8d, 0x51
add r8d, edx
cmp rsi, 0x18
jb 0x4c9db4
jmp 0x4c9e1a
xor eax, eax
lea rbx, [rsp + 0x1c]
mov ecx, 0x18
call fcn.00441e20
mov rbp, qword [rsp + 0x58]
add rsp, 0x60
ret
mov eax, esi
mov ecx, 0x18
call fcn.00453d80
mov eax, edi
mov ecx, 0x18
call fcn.00453d80
nop
call fcn.00451720
jmp fcn.004c9d20

Function at 0x4c9e40
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4c9f12
sub rsp, 0x40
mov qword [rsp + 0x38], rbp
lea rbp, [rsp + 0x38]
movabs rdx, 0x499a27640b74787c
mov qword [rsp + 0x1c], rdx
mov dword [rsp + 0x24], 0xa4cc6637
movabs rdx, 0x30105030b000808
mov qword [rsp + 0x28], rdx
movabs rdx, 0x50606030a080b05
mov qword [rsp + 0x30], rdx
xor eax, eax
jmp 0x4c9eab
movzx r9d, byte [rsp + rsi + 0x1c]
add r9d, 0xffffff96
add edx, r9d
mov byte [rsp + rdi + 0x1c], dl
mov byte [rsp + rsi + 0x1c], r8b
add rax, 2
cmp rax, 0x10
jge 0x4c9edc
movzx edx, byte [rsp + rax + 0x28]
movzx esi, byte [rsp + rax + 0x29]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0xc
jae 0x4c9f05
movzx r8d, byte [rsp + rdi + 0x1c]
add r8d, 0xffffff96
add r8d, edx
cmp rsi, 0xc
jb 0x4c9e91
jmp 0x4c9ef7
xor eax, eax
lea rbx, [rsp + 0x1c]
mov ecx, 0xc
call fcn.00441e20
mov rbp, qword [rsp + 0x38]
add rsp, 0x40
ret
mov eax, esi
mov ecx, 0xc
nop
call fcn.00453d80
mov eax, edi
mov ecx, 0xc
call fcn.00453d80
nop
call fcn.00451720
jmp fcn.004c9e40
Function at 0x4ca2e0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4ca3a8
sub rsp, 0x38
mov qword [rsp + 0x30], rbp
lea rbp, [rsp + 0x30]
movabs rdx, 0x6cf15bc69c0f531a
mov qword [rsp + 0x1e], rdx
movabs rdx, 0x400040305020503
mov qword [rsp + 0x26], rdx
mov word [rsp + 0x2e], 0x603
xor eax, eax
nop
jmp 0x4ca340
movzx r9d, byte [rsp + rsi + 0x1e]
add r9d, 0x4b
add edx, r9d
mov byte [rsp + rdi + 0x1e], dl
mov byte [rsp + rsi + 0x1e], r8b
add rax, 2
nop dword [rax]
cmp rax, 0xa
jge 0x4ca371
movzx edx, byte [rsp + rax + 0x26]
movzx esi, byte [rsp + rax + 0x27]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 8
jae 0x4ca39b
movzx r8d, byte [rsp + rdi + 0x1e]
add r8d, 0x4b
add r8d, edx
cmp rsi, 8
jb 0x4ca322
jmp 0x4ca38f
xor eax, eax
lea rbx, [rsp + 0x1e]
mov ecx, 8
nop dword [rax]
call fcn.00441e20
mov rbp, qword [rsp + 0x30]
add rsp, 0x38
ret
mov eax, esi
mov ecx, 8
call fcn.00453d80
mov eax, edi
mov ecx, 8
call fcn.00453d80
nop
call fcn.00451720
jmp fcn.004ca2e0

Function at 0x4cac80
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4cad5c
sub rsp, 0x40
mov qword [rsp + 0x38], rbp
lea rbp, [rsp + 0x38]
movabs rdx, 0xe414e56feaf4ab99
mov qword [rsp + 0x1d], rdx
movabs rdx, 0x65babae414e56fea
mov qword [rsp + 0x20], rdx
movabs rdx, 0x207030106020000
mov qword [rsp + 0x28], rdx
movabs rdx, 0x609070108020705
mov qword [rsp + 0x30], rdx
xor eax, eax
jmp 0x4cacf5
movzx r9d, byte [rsp + rsi + 0x1d]
sub r9d, edx
lea edx, [r9 - 0x32]
mov byte [rsp + rdi + 0x1d], dl
lea edx, [r8 - 0x32]
mov byte [rsp + rsi + 0x1d], dl
add rax, 2
cmp rax, 0x10
jge 0x4cad28
movzx edx, byte [rsp + rax + 0x28]
movzx esi, byte [rsp + rax + 0x29]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0xb
jae 0x4cad4f
movzx r8d, byte [rsp + rdi + 0x1d]
sub r8d, edx
nop word [rax + rax]
cmp rsi, 0xb
jb 0x4cacd8
jmp 0x4cad43
xor eax, eax
lea rbx, [rsp + 0x1d]
mov ecx, 0xb
call fcn.00441e20
mov rbp, qword [rsp + 0x38]
add rsp, 0x40
ret
mov eax, esi
mov ecx, 0xb
call fcn.00453d80
mov eax, edi
mov ecx, 0xb
call fcn.00453d80
nop
nop dword [rax]
call fcn.00451720
jmp fcn.004cac80
Function at 0x4cad80
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4cae52
sub rsp, 0x38
mov qword [rsp + 0x30], rbp
lea rbp, [rsp + 0x30]
movabs rdx, 0x3fe24040bc3b654a
mov qword [rsp + 0x18], rdx
mov word [rsp + 0x20], 0x323e
movabs rdx, 0x605000303060807
mov qword [rsp + 0x22], rdx
movabs rdx, 0x402090005000605
mov qword [rsp + 0x28], rdx
xor eax, eax
jmp 0x4cadea
movzx r9d, byte [rsp + rsi + 0x18]
add r9d, 0x22
add edx, r9d
mov byte [rsp + rdi + 0x18], dl
mov byte [rsp + rsi + 0x18], r8b
add rax, 2
cmp rax, 0xe
jge 0x4cae1b
movzx edx, byte [rsp + rax + 0x22]
movzx esi, byte [rsp + rax + 0x23]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0xa
jae 0x4cae45
movzx r8d, byte [rsp + rdi + 0x18]
add r8d, 0x22
add r8d, edx
cmp rsi, 0xa
jb 0x4cadd0
jmp 0x4cae36
xor eax, eax
lea rbx, [rsp + 0x18]
mov ecx, 0xa
call fcn.00441e20
mov rbp, qword [rsp + 0x30]
add rsp, 0x38
ret
mov eax, esi
mov ecx, 0xa
nop dword [rax]
call fcn.00453d80
mov eax, edi
mov ecx, 0xa
call fcn.00453d80
nop
call fcn.00451720
jmp fcn.004cad80

Function at 0x4cae60
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4caf32
sub rsp, 0x38
mov qword [rsp + 0x30], rbp
lea rbp, [rsp + 0x30]
movabs rdx, 0xf0de63dd73ebf175
mov qword [rsp + 0x18], rdx
mov word [rsp + 0x20], 0xf8fc
movabs rdx, 0x404000600040809
mov qword [rsp + 0x22], rdx
movabs rdx, 0x601000102070404
mov qword [rsp + 0x28], rdx
xor eax, eax
jmp 0x4caeca
movzx r9d, byte [rsp + rsi + 0x18]
add r9d, 0x77
add edx, r9d
mov byte [rsp + rdi + 0x18], dl
mov byte [rsp + rsi + 0x18], r8b
add rax, 2
cmp rax, 0xe
jge 0x4caefb
movzx edx, byte [rsp + rax + 0x22]
movzx esi, byte [rsp + rax + 0x23]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0xa
jae 0x4caf25
movzx r8d, byte [rsp + rdi + 0x18]
add r8d, 0x77
add r8d, edx
cmp rsi, 0xa
jb 0x4caeb0
jmp 0x4caf16
xor eax, eax
lea rbx, [rsp + 0x18]
mov ecx, 0xa
call fcn.00441e20
mov rbp, qword [rsp + 0x30]
add rsp, 0x38
ret
mov eax, esi
mov ecx, 0xa
nop dword [rax]
call fcn.00453d80
mov eax, edi
mov ecx, 0xa
call fcn.00453d80
nop
call fcn.00451720
jmp fcn.004cae60

Function at 0x4caf40
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4cb006
sub rsp, 0x38
mov qword [rsp + 0x30], rbp
lea rbp, [rsp + 0x30]
movabs rdx, 0x3237b264aee6682d
mov qword [rsp + 0x1c], rdx
movabs rdx, 0x302030500070302
mov qword [rsp + 0x24], rdx
mov dword [rsp + 0x2c], 0x2020306
xor eax, eax
jmp 0x4cafa0
movzx r9d, byte [rsp + rsi + 0x1c]
sub r9d, edx
lea edx, [r9 + 0x4a]
mov byte [rsp + rdi + 0x1c], dl
lea edx, [r8 + 0x4a]
mov byte [rsp + rsi + 0x1c], dl
add rax, 2
nop
cmp rax, 0xc
jge 0x4cafcd
movzx edx, byte [rsp + rax + 0x24]
movzx esi, byte [rsp + rax + 0x25]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 8
jae 0x4caff4
movzx r8d, byte [rsp + rdi + 0x1c]
sub r8d, edx
cmp rsi, 8
jb 0x4caf82
jmp 0x4cafe8
xor eax, eax
lea rbx, [rsp + 0x1c]
mov ecx, 8
call fcn.00441e20
mov rbp, qword [rsp + 0x30]
add rsp, 0x38
ret
mov eax, esi
mov ecx, 8
call fcn.00453d80
mov eax, edi
mov ecx, 8
nop dword [rax + rax]
call fcn.00453d80
nop
call fcn.00451720
jmp fcn.004caf40
Function at 0x4cc760
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4cc848
sub rsp, 0x48
mov qword [rsp + 0x40], rbp
lea rbp, [rsp + 0x40]
movabs rdx, 0xbffea956c5c67020
mov qword [rsp + 0x1e], rdx
movabs rdx, 0xacb26620b99abffe
mov qword [rsp + 0x24], rdx
movabs rdx, 0x60c070407050803
mov qword [rsp + 0x2c], rdx
movabs rdx, 0x3090207060c0704
mov qword [rsp + 0x30], rdx
movabs rdx, 0xb0d0c020c090d04
mov qword [rsp + 0x38], rdx
xor eax, eax
jmp 0x4cc7e1
movzx r9d, byte [rsp + rsi + 0x1e]
add r9d, 0xffffffa2
add edx, r9d
mov byte [rsp + rdi + 0x1e], dl
mov byte [rsp + rsi + 0x1e], r8b
add rax, 2
cmp rax, 0x14
jge 0x4cc812
movzx edx, byte [rsp + rax + 0x2c]
movzx esi, byte [rsp + rax + 0x2d]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0xe
jae 0x4cc83b
movzx r8d, byte [rsp + rdi + 0x1e]
add r8d, 0xffffffa2
add r8d, edx
cmp rsi, 0xe
jb 0x4cc7c7
jmp 0x4cc82f
xor eax, eax
lea rbx, [rsp + 0x1e]
mov ecx, 0xe
nop
call fcn.00441e20
mov rbp, qword [rsp + 0x40]
add rsp, 0x48
ret
mov eax, esi
mov ecx, 0xe
call fcn.00453d80
mov eax, edi
mov ecx, 0xe
call fcn.00453d80
nop
call fcn.00451720
jmp fcn.004cc760

Function at 0x4d7080
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4d7193
sub rsp, 0x58
mov qword [rsp + 0x50], rbp
lea rbp, [rsp + 0x50]
movabs rdx, 0x5669654378662052
mov qword [rsp + 0x19], rdx
movabs rdx, 0x762052476b203649
mov qword [rsp + 0x21], rdx
movabs rdx, 0x61762052476b2036
mov qword [rsp + 0x22], rdx
movabs rdx, 0x655479742041754a
mov qword [rsp + 0x2a], rdx
movabs rdx, 0x8000d0011000c17
mov qword [rsp + 0x32], rdx
movabs rdx, 0x204070717010909
mov qword [rsp + 0x3a], rdx
movabs rdx, 0x6071113090d0204
mov qword [rsp + 0x40], rdx
movabs rdx, 0x110d080002171717
mov qword [rsp + 0x48], rdx
xor eax, eax
jmp 0x4d712e
movzx r9d, byte [rsp + rsi + 0x19]
add r9d, 0xfffffff6
add edx, r9d
mov byte [rsp + rdi + 0x19], dl
mov byte [rsp + rsi + 0x19], r8b
add rax, 2
cmp rax, 0x1e
jge 0x4d715f
movzx edx, byte [rsp + rax + 0x32]
movzx esi, byte [rsp + rax + 0x33]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x19
jae 0x4d7186
movzx r8d, byte [rsp + rdi + 0x19]
add r8d, 0xfffffff6
add r8d, edx
cmp rsi, 0x19
jb 0x4d7114
jmp 0x4d717a
xor eax, eax
lea rbx, [rsp + 0x19]
mov ecx, 0x19
call fcn.00441e20
mov rbp, qword [rsp + 0x50]
add rsp, 0x58
ret
mov eax, esi
mov ecx, 0x19
call fcn.00453d80
mov eax, edi
mov ecx, 0x19
call fcn.00453d80
nop
call fcn.00451720
jmp fcn.004d7080
Function at 0x4d71a0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4d7272
sub rsp, 0x40
mov qword [rsp + 0x38], rbp
lea rbp, [rsp + 0x38]
movabs rdx, 0xd0ca6970c132ebff
mov qword [rsp + 0x1c], rdx
mov dword [rsp + 0x24], 0x91726424
movabs rdx, 0xa02070a0a0b06
mov qword [rsp + 0x28], rdx
movabs rdx, 0xa07030008000100
mov qword [rsp + 0x30], rdx
xor eax, eax
jmp 0x4d720e
movzx r9d, byte [rsp + rsi + 0x1c]
sub r9d, edx
lea edx, [r9 - 0x51]
mov byte [rsp + rdi + 0x1c], dl
lea edx, [r8 - 0x51]
mov byte [rsp + rsi + 0x1c], dl
add rax, 2
cmp rax, 0x10
jge 0x4d723b
movzx edx, byte [rsp + rax + 0x28]
movzx esi, byte [rsp + rax + 0x29]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0xc
jae 0x4d7265
movzx r8d, byte [rsp + rdi + 0x1c]
sub r8d, edx
cmp rsi, 0xc
jb 0x4d71f1
jmp 0x4d7256
xor eax, eax
lea rbx, [rsp + 0x1c]
mov ecx, 0xc
call fcn.00441e20
mov rbp, qword [rsp + 0x38]
add rsp, 0x40
ret
mov eax, esi
mov ecx, 0xc
nop dword [rax]
call fcn.00453d80
mov eax, edi
mov ecx, 0xc
call fcn.00453d80
nop
call fcn.00451720
jmp fcn.004d71a0
Function at 0x4d8f40
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4d9036
sub rsp, 0x48
mov qword [rsp + 0x40], rbp
lea rbp, [rsp + 0x40]
movabs rdx, 0x24950276e464fe62
mov qword [rsp + 0x19], rdx
movabs rdx, 0x6c20ef24950276e4
mov qword [rsp + 0x1c], rdx
movabs rdx, 0xf0a90beb66e87ef4
mov qword [rsp + 0x24], rdx
movabs rdx, 0xc110311070a0306
mov qword [rsp + 0x2c], rdx
movabs rdx, 0x100c0d0a0c110311
mov qword [rsp + 0x30], rdx
movabs rdx, 0x50b07011112080f
mov qword [rsp + 0x38], rdx
xor eax, eax
jmp 0x4d8fd3
movzx r9d, byte [rsp + rsi + 0x19]
sub r9d, edx
lea edx, [r9 - 0x73]
mov byte [rsp + rdi + 0x19], dl
lea edx, [r8 - 0x73]
mov byte [rsp + rsi + 0x19], dl
add rax, 2
cmp rax, 0x14
jge 0x4d9002
movzx edx, byte [rsp + rax + 0x2c]
movzx esi, byte [rsp + rax + 0x2d]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x13
jae 0x4d9029
movzx r8d, byte [rsp + rdi + 0x19]
sub r8d, edx
cmp rsi, 0x13
jb 0x4d8fb6
nop
jmp 0x4d901d
xor eax, eax
lea rbx, [rsp + 0x19]
mov ecx, 0x13
call fcn.00441e20
mov rbp, qword [rsp + 0x40]
add rsp, 0x48
ret
mov eax, esi
mov ecx, 0x13
call fcn.00453d80
mov eax, edi
mov ecx, 0x13
call fcn.00453d80
nop
call fcn.00451720
nop dword [rax + rax]
jmp fcn.004d8f40

Function at 0x4d94c0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4d95c8
sub rsp, 0x50
mov qword [rsp + 0x48], rbp
lea rbp, [rsp + 0x48]
movabs rdx, 0x2099f163c1726f4d
mov qword [rsp + 0x19], rdx
movabs rdx, 0x98ada352532099f1
mov qword [rsp + 0x1e], rdx
movabs rdx, 0xc86d91a7959872e2
mov qword [rsp + 0x26], rdx
movabs rdx, 0x60d05121403090d
mov qword [rsp + 0x2e], rdx
movabs rdx, 0xb0906090a011112
mov qword [rsp + 0x36], rdx
movabs rdx, 0x14030b0906090a01
mov qword [rsp + 0x38], rdx
movabs rdx, 0x11110a140a100f0c
mov qword [rsp + 0x40], rdx
xor eax, eax
jmp 0x4d9560
movzx r9d, byte [rsp + rsi + 0x19]
add r9d, 0xffffffb7
add edx, r9d
mov byte [rsp + rdi + 0x19], dl
mov byte [rsp + rsi + 0x19], r8b
add rax, 2
nop
cmp rax, 0x1a
jge 0x4d9591
movzx edx, byte [rsp + rax + 0x2e]
movzx esi, byte [rsp + rax + 0x2f]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x15
jae 0x4d95bb
movzx r8d, byte [rsp + rdi + 0x19]
add r8d, 0xffffffb7
add r8d, edx
cmp rsi, 0x15
jb 0x4d9545
jmp 0x4d95af
xor eax, eax
lea rbx, [rsp + 0x19]
mov ecx, 0x15
nop dword [rax]
call fcn.00441e20
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
mov eax, esi
mov ecx, 0x15
call fcn.00453d80
mov eax, edi
mov ecx, 0x15
call fcn.00453d80
nop
call fcn.00451720
jmp fcn.004d94c0
Function at 0x4d9a20
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4d9b46
sub rsp, 0x60
mov qword [rsp + 0x58], rbp
lea rbp, [rsp + 0x58]
movabs rdx, 0xd40db438c1af6f53
mov qword [rsp + 0x1d], rdx
movabs rdx, 0xcbc07419207f8364
mov qword [rsp + 0x25], rdx
movabs rdx, 0x7cbc07419207f83
mov qword [rsp + 0x26], rdx
movabs rdx, 0x650c2336c455a261
mov qword [rsp + 0x2e], rdx
movabs rdx, 0x215060304171203
mov qword [rsp + 0x36], rdx
movabs rdx, 0x914021506030417
mov qword [rsp + 0x38], rdx
movabs rdx, 0x40e030f0c0f100f
mov qword [rsp + 0x40], rdx
movabs rdx, 0xa0606060a160a05
mov qword [rsp + 0x48], rdx
movabs rdx, 0x2160713170a0a13
mov qword [rsp + 0x50], rdx
xor eax, eax
jmp 0x4d9ae0
movzx r9d, byte [rsp + rsi + 0x1d]
sub r9d, edx
lea edx, [r9 - 0x3e]
mov byte [rsp + rdi + 0x1d], dl
lea edx, [r8 - 0x3e]
mov byte [rsp + rsi + 0x1d], dl
add rax, 2
cmp rax, 0x22
jge 0x4d9b0d
movzx edx, byte [rsp + rax + 0x36]
movzx esi, byte [rsp + rax + 0x37]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x19
jae 0x4d9b34
movzx r8d, byte [rsp + rdi + 0x1d]
sub r8d, edx
cmp rsi, 0x19
jb 0x4d9ac3
jmp 0x4d9b28
xor eax, eax
lea rbx, [rsp + 0x1d]
mov ecx, 0x19
call fcn.00441e20
mov rbp, qword [rsp + 0x58]
add rsp, 0x60
ret
mov eax, esi
mov ecx, 0x19
call fcn.00453d80
mov eax, edi
mov ecx, 0x19
nop dword [rax + rax]
call fcn.00453d80
nop
call fcn.00451720
jmp fcn.004d9a20

Function at 0x4daa20
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4dab16
sub rsp, 0x50
mov qword [rsp + 0x48], rbp
lea rbp, [rsp + 0x48]
movabs rdx, 0x2061691d353d4910
mov qword [rsp + 0x1d], rdx
movabs rdx, 0x6427f57440206169
mov qword [rsp + 0x22], rdx
movabs rdx, 0x653102305a165d36
mov qword [rsp + 0x2a], rdx
movabs rdx, 0xb00120b0b0a1308
mov qword [rsp + 0x32], rdx
movabs rdx, 0x3110d02040d0b00
mov qword [rsp + 0x38], rdx
movabs rdx, 0xf101203130e0b01
mov qword [rsp + 0x40], rdx
xor eax, eax
jmp 0x4daab3
movzx r9d, byte [rsp + rsi + 0x1d]
sub r9d, edx
lea edx, [r9 + 0x3d]
mov byte [rsp + rdi + 0x1d], dl
lea edx, [r8 + 0x3d]
mov byte [rsp + rsi + 0x1d], dl
add rax, 2
cmp rax, 0x16
jge 0x4daae2
movzx edx, byte [rsp + rax + 0x32]
movzx esi, byte [rsp + rax + 0x33]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x15
jae 0x4dab09
movzx r8d, byte [rsp + rdi + 0x1d]
sub r8d, edx
cmp rsi, 0x15
jb 0x4daa96
nop
jmp 0x4daafd
xor eax, eax
lea rbx, [rsp + 0x1d]
mov ecx, 0x15
call fcn.00441e20
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
mov eax, esi
mov ecx, 0x15
call fcn.00453d80
mov eax, edi
mov ecx, 0x15
call fcn.00453d80
nop
call fcn.00451720
nop dword [rax + rax]
jmp fcn.004daa20
Function at 0x4db600
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4db708
sub rsp, 0x58
mov qword [rsp + 0x50], rbp
lea rbp, [rsp + 0x50]
movabs rdx, 0x6669706e0c4b545d
mov qword [rsp + 0x1a], rdx
movabs rdx, 0x5b42354e44215569
mov qword [rsp + 0x22], rdx
movabs rdx, 0x60f735426645055
mov qword [rsp + 0x2a], rdx
movabs rdx, 0x50503090d100404
mov qword [rsp + 0x32], rdx
movabs rdx, 0xf04040b15160a16
mov qword [rsp + 0x3a], rdx
movabs rdx, 0x11509130b0f0f04
mov qword [rsp + 0x40], rdx
movabs rdx, 0x1009110c1702000e
mov qword [rsp + 0x48], rdx
xor eax, eax
jmp 0x4db6a0
movzx r9d, byte [rsp + rsi + 0x1a]
add r9d, 0xffffffed
add edx, r9d
mov byte [rsp + rdi + 0x1a], dl
mov byte [rsp + rsi + 0x1a], r8b
add rax, 2
nop
cmp rax, 0x1e
jge 0x4db6d1
movzx edx, byte [rsp + rax + 0x32]
movzx esi, byte [rsp + rax + 0x33]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x18
jae 0x4db6fb
movzx r8d, byte [rsp + rdi + 0x1a]
add r8d, 0xffffffed
add r8d, edx
cmp rsi, 0x18
jb 0x4db685
jmp 0x4db6ef
xor eax, eax
lea rbx, [rsp + 0x1a]
mov ecx, 0x18
nop dword [rax]
call fcn.00441e20
mov rbp, qword [rsp + 0x50]
add rsp, 0x58
ret
mov eax, esi
mov ecx, 0x18
call fcn.00453d80
mov eax, edi
mov ecx, 0x18
call fcn.00453d80
nop
call fcn.00451720
jmp fcn.004db600

Function at 0x4dc960
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4dca68
sub rsp, 0x58
mov qword [rsp + 0x50], rbp
lea rbp, [rsp + 0x50]
movabs rdx, 0x6381cb6e08aa57cb
mov qword [rsp + 0x1e], rdx
movabs rdx, 0xc304aac253cf6381
mov qword [rsp + 0x24], rdx
movabs rdx, 0x8d0d69e7c3db72b2
mov qword [rsp + 0x2c], rdx
movabs rdx, 0xe12030c14110112
mov qword [rsp + 0x34], rdx
movabs rdx, 0x611020308140b0e
mov qword [rsp + 0x3c], rdx
movabs rdx, 0xa0a080806110203
mov qword [rsp + 0x40], rdx
movabs rdx, 0x10d0c05100815
mov qword [rsp + 0x48], rdx
xor eax, eax
jmp 0x4dca02
movzx r9d, byte [rsp + rsi + 0x1e]
sub r9d, edx
lea edx, [r9 - 0x3c]
mov byte [rsp + rdi + 0x1e], dl
lea edx, [r8 - 0x3c]
mov byte [rsp + rsi + 0x1e], dl
add rax, 2
cmp rax, 0x1c
jge 0x4dca2f
movzx edx, byte [rsp + rax + 0x34]
movzx esi, byte [rsp + rax + 0x35]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x16
jae 0x4dca5b
movzx r8d, byte [rsp + rdi + 0x1e]
sub r8d, edx
cmp rsi, 0x16
jb 0x4dc9e5
jmp 0x4dca4f
xor eax, eax
lea rbx, [rsp + 0x1e]
mov ecx, 0x16
nop dword [rax + rax]
call fcn.00441e20
mov rbp, qword [rsp + 0x50]
add rsp, 0x58
ret
mov eax, esi
mov ecx, 0x16
call fcn.00453d80
mov eax, edi
mov ecx, 0x16
call fcn.00453d80
nop
call fcn.00451720
jmp fcn.004dc960
Function at 0x4dd5c0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4dd6c8
sub rsp, 0x58
mov qword [rsp + 0x50], rbp
lea rbp, [rsp + 0x50]
movabs rdx, 0x64697c64706e6f4d
mov qword [rsp + 0x1e], rdx
movabs rdx, 0x6484427470897d75
mov qword [rsp + 0x26], rdx
movabs rdx, 0x5a618654bb468868
mov qword [rsp + 0x2e], rdx
movabs rdx, 0x1115120b12130a0d
mov qword [rsp + 0x36], rdx
movabs rdx, 0x1108030b17031708
mov qword [rsp + 0x3e], rdx
movabs rdx, 0xe051108030b1703
mov qword [rsp + 0x40], rdx
movabs rdx, 0x110d0905160d0410
mov qword [rsp + 0x48], rdx
xor eax, eax
jmp 0x4dd660
movzx r9d, byte [rsp + rsi + 0x1e]
add r9d, 0xffffffd7
add edx, r9d
mov byte [rsp + rdi + 0x1e], dl
mov byte [rsp + rsi + 0x1e], r8b
add rax, 2
nop
cmp rax, 0x1a
jge 0x4dd691
movzx edx, byte [rsp + rax + 0x36]
movzx esi, byte [rsp + rax + 0x37]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x18
jae 0x4dd6bb
movzx r8d, byte [rsp + rdi + 0x1e]
add r8d, 0xffffffd7
add r8d, edx
cmp rsi, 0x18
jb 0x4dd645
jmp 0x4dd6af
xor eax, eax
lea rbx, [rsp + 0x1e]
mov ecx, 0x18
nop dword [rax]
call fcn.00441e20
mov rbp, qword [rsp + 0x50]
add rsp, 0x58
ret
mov eax, esi
mov ecx, 0x18
call fcn.00453d80
mov eax, edi
mov ecx, 0x18
call fcn.00453d80
nop
call fcn.00451720
jmp fcn.004dd5c0

Function at 0x4de200
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4de313
sub rsp, 0x58
mov qword [rsp + 0x50], rbp
lea rbp, [rsp + 0x50]
movabs rdx, 0x6633616d6163613d
mov qword [rsp + 0x34], rdx
movabs rdx, 0x71206c6172925265
mov qword [rsp + 0x3c], rdx
movabs rdx, 0x5e6d617471206c61
mov qword [rsp + 0x40], rdx
movabs rdx, 0x286d1e7d86776661
mov qword [rsp + 0x48], rdx
movabs rdx, 0xf0a07181b180619
mov qword [rsp + 0x18], rdx
movabs rdx, 0x9180a0f17170013
mov qword [rsp + 0x20], rdx
movabs rdx, 0x13161209180a0f
mov qword [rsp + 0x24], rdx
movabs rdx, 0x1715020407151915
mov qword [rsp + 0x2c], rdx
xor eax, eax
jmp 0x4de2ae
movzx r9d, byte [rsp + rsi + 0x34]
add r9d, 0xffffffe3
add edx, r9d
mov byte [rsp + rdi + 0x34], dl
mov byte [rsp + rsi + 0x34], r8b
add rax, 2
cmp rax, 0x1c
jge 0x4de2df
movzx edx, byte [rsp + rax + 0x18]
movzx esi, byte [rsp + rax + 0x19]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x1c
jae 0x4de306
movzx r8d, byte [rsp + rdi + 0x34]
add r8d, 0xffffffe3
add r8d, edx
cmp rsi, 0x1c
jb 0x4de294
jmp 0x4de2fa
xor eax, eax
lea rbx, [rsp + 0x34]
mov ecx, 0x1c
call fcn.00441e20
mov rbp, qword [rsp + 0x50]
add rsp, 0x58
ret
mov eax, esi
mov ecx, 0x1c
call fcn.00453d80
mov eax, edi
mov ecx, 0x1c
call fcn.00453d80
nop
call fcn.00451720
jmp fcn.004de200
Function at 0x4de320
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4de432
sub rsp, 0x60
mov qword [rsp + 0x58], rbp
lea rbp, [rsp + 0x58]
movabs rdx, 0x705b69665b247f72
mov qword [rsp + 0x1c], rdx
movabs rdx, 0x521963257f546d63
mov qword [rsp + 0x24], rdx
movabs rdx, 0x657a76706d756561
mov qword [rsp + 0x2c], rdx
movabs rdx, 0x16061107130c1006
mov qword [rsp + 0x34], rdx
movabs rdx, 0x9120d0316061107
mov qword [rsp + 0x38], rdx
movabs rdx, 0xc010a0009070e
mov qword [rsp + 0x40], rdx
movabs rdx, 0xa140215020b0f08
mov qword [rsp + 0x48], rdx
movabs rdx, 0x91401000c060a0b
mov qword [rsp + 0x50], rdx
xor eax, eax
jmp 0x4de3d1
movzx r9d, byte [rsp + rsi + 0x1c]
sub r9d, edx
lea edx, [r9 + 0x1c]
mov byte [rsp + rdi + 0x1c], dl
lea edx, [r8 + 0x1c]
mov byte [rsp + rsi + 0x1c], dl
add rax, 2
cmp rax, 0x24
jge 0x4de3fe
movzx edx, byte [rsp + rax + 0x34]
movzx esi, byte [rsp + rax + 0x35]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x18
jae 0x4de425
movzx r8d, byte [rsp + rdi + 0x1c]
sub r8d, edx
cmp rsi, 0x18
jb 0x4de3b4
jmp 0x4de419
xor eax, eax
lea rbx, [rsp + 0x1c]
mov ecx, 0x18
call fcn.00441e20
mov rbp, qword [rsp + 0x58]
add rsp, 0x60
ret
mov eax, esi
mov ecx, 0x18
call fcn.00453d80
mov eax, edi
mov ecx, 0x18
call fcn.00453d80
nop
call fcn.00451720
jmp fcn.004de320
Function at 0x4df320
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4df416
sub rsp, 0x50
mov qword [rsp + 0x48], rbp
lea rbp, [rsp + 0x48]
movabs rdx, 0x53206ec21bd16f15
mov qword [rsp + 0x1e], rdx
movabs rdx, 0x64ca1ab653206ec2
mov qword [rsp + 0x22], rdx
movabs rdx, 0x316dd054ea320562
mov qword [rsp + 0x2a], rdx
movabs rdx, 0xf0f040c11080213
mov qword [rsp + 0x32], rdx
movabs rdx, 0x30909040a0e0f0f
mov qword [rsp + 0x38], rdx
movabs rdx, 0xe11130d000c0803
mov qword [rsp + 0x40], rdx
xor eax, eax
jmp 0x4df3b0
movzx r9d, byte [rsp + rsi + 0x1e]
add r9d, 0x30
add edx, r9d
mov byte [rsp + rdi + 0x1e], dl
mov byte [rsp + rsi + 0x1e], r8b
add rax, 2
cmp rax, 0x16
jge 0x4df3e2
movzx edx, byte [rsp + rax + 0x32]
movzx esi, byte [rsp + rax + 0x33]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x14
jae 0x4df409
movzx r8d, byte [rsp + rdi + 0x1e]
add r8d, 0x30
add r8d, edx
cmp rsi, 0x14
jb 0x4df396
nop
jmp 0x4df3fd
xor eax, eax
lea rbx, [rsp + 0x1e]
mov ecx, 0x14
call fcn.00441e20
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
mov eax, esi
mov ecx, 0x14
call fcn.00453d80
mov eax, edi
mov ecx, 0x14
call fcn.00453d80
nop
call fcn.00451720
nop dword [rax + rax]
jmp fcn.004df320