joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4de420
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4de528
push rbp
mov rbp, rsp
sub rsp, 0x58
movabs rdx, 0x4b69877786539241
mov qword [rsp + 0x1f], rdx
movabs rdx, 0x6e613a80928d5972
mov qword [rsp + 0x27], rdx
movabs rdx, 0xa36e613a80928d59
mov qword [rsp + 0x28], rdx
movabs rdx, 0x65983a547d697361
mov qword [rsp + 0x30], rdx
movabs rdx, 0xd0a130c070b1412
mov qword [rsp + 0x38], rdx
movabs rdx, 0x5061616160b1205
mov qword [rsp + 0x40], rdx
movabs rdx, 0x409030703171013
mov qword [rsp + 0x48], rdx
movabs rdx, 0x30a161412010d13
mov qword [rsp + 0x50], rdx
xor eax, eax
jmp 0x4de4cb
movzx r9d, byte [rsp + rsi + 0x1f]
sub r9d, edx
lea edx, [r9 + 0xd]
mov byte [rsp + rdi + 0x1f], dl
lea edx, [r8 + 0xd]
mov byte [rsp + rsi + 0x1f], dl
add rax, 2
cmp rax, 0x20
jge 0x4de4f8
movzx edx, byte [rsp + rax + 0x38]
movzx esi, byte [rsp + rax + 0x39]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x19
jae 0x4de51b
movzx r8d, byte [rsp + rdi + 0x1f]
sub r8d, edx
cmp rsi, 0x19
jb 0x4de4ae
jmp 0x4de50f
xor eax, eax
lea rbx, [rsp + 0x1f]
mov ecx, 0x19
call fcn.00441380
add rsp, 0x58
pop rbp
ret
mov eax, esi
mov ecx, 0x19
call fcn.004518a0
mov eax, edi
mov ecx, 0x19
call fcn.004518a0
nop
call fcn.0044f620
jmp fcn.004de420

Function at 0x4dfae0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4dfbcc
push rbp
mov rbp, rsp
sub rsp, 0x48
movabs rdx, 0x7048727530507545
mov qword [rsp + 0x19], rdx
movabs rdx, 0x6466612b55686e70
mov qword [rsp + 0x20], rdx
movabs rdx, 0x651c0a54690c231a
mov qword [rsp + 0x28], rdx
movabs rdx, 0xa0d0b01090f0b10
mov qword [rsp + 0x30], rdx
movabs rdx, 0xa0612150d081409
mov qword [rsp + 0x38], rdx
movabs rdx, 0x1008140303100211
mov qword [rsp + 0x40], rdx
xor eax, eax
jmp 0x4dfb6a
movzx r9d, byte [rsp + rsi + 0x19]
lea edx, [r9 + rdx]
lea edx, [rdx - 0xf]
mov byte [rsp + rdi + 0x19], dl
mov byte [rsp + rsi + 0x19], r8b
add rax, 2
cmp rax, 0x18
jge 0x4dfb9c
movzx edx, byte [rsp + rax + 0x30]
movzx esi, byte [rsp + rax + 0x31]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x17
jae 0x4dfbbf
movzx r8d, byte [rsp + rdi + 0x19]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0xf]
cmp rsi, 0x17
jb 0x4dfb50
jmp 0x4dfbb3
xor eax, eax
lea rbx, [rsp + 0x19]
mov ecx, 0x17
call fcn.00441380
add rsp, 0x48
pop rbp
ret
mov eax, esi
mov ecx, 0x17
call fcn.004518a0
mov eax, edi
mov ecx, 0x17
call fcn.004518a0
nop
call fcn.0044f620
jmp fcn.004dfae0
Function at 0x4dfbe0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4dfcdd
push rbp
mov rbp, rsp
sub rsp, 0x50
movabs rdx, 0xb7a4fd6511a80d54
mov qword [rsp + 0x1e], rdx
movabs rdx, 0x111c2136b7a4fd65
mov qword [rsp + 0x22], rdx
movabs rdx, 0xd1861d3920bf7261
mov qword [rsp + 0x2a], rdx
movabs rdx, 0x210101208050510
mov qword [rsp + 0x32], rdx
movabs rdx, 0x21107060e030305
mov qword [rsp + 0x3a], rdx
movabs rdx, 0x130a1011080b0211
mov qword [rsp + 0x40], rdx
movabs rdx, 0xa03010907100312
mov qword [rsp + 0x48], rdx
xor eax, eax
jmp 0x4dfc80
movzx r9d, byte [rsp + rsi + 0x1e]
sub r9d, edx
lea edx, [r9 + 0x76]
mov byte [rsp + rdi + 0x1e], dl
lea edx, [r8 + 0x76]
mov byte [rsp + rsi + 0x1e], dl
add rax, 2
nop dword [rax]
cmp rax, 0x1e
jge 0x4dfcad
movzx edx, byte [rsp + rax + 0x32]
movzx esi, byte [rsp + rax + 0x33]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x14
jae 0x4dfcd0
movzx r8d, byte [rsp + rdi + 0x1e]
sub r8d, edx
cmp rsi, 0x14
jb 0x4dfc5f
jmp 0x4dfcc4
xor eax, eax
lea rbx, [rsp + 0x1e]
mov ecx, 0x14
call fcn.00441380
add rsp, 0x50
pop rbp
ret
mov eax, esi
mov ecx, 0x14
call fcn.004518a0
mov eax, edi
mov ecx, 0x14
call fcn.004518a0
nop
nop dword [rax]
call fcn.0044f620
jmp fcn.004dfbe0

Function at 0x4e0560
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4e065d
push rbp
mov rbp, rsp
sub rsp, 0x50
movabs rdx, 0x20d479b7cabdd542
mov qword [rsp + 0x1f], rdx
movabs rdx, 0x1cb268745320d479
mov qword [rsp + 0x24], rdx
movabs rdx, 0x26cdf671e1acd5c9
mov qword [rsp + 0x2c], rdx
movabs rdx, 0x50b110b1404140a
mov qword [rsp + 0x34], rdx
movabs rdx, 0x40d0c0c0b120f0f
mov qword [rsp + 0x3c], rdx
movabs rdx, 0x50c0312040d0c0c
mov qword [rsp + 0x40], rdx
movabs rdx, 0x60e0b1001130a02
mov qword [rsp + 0x48], rdx
xor eax, eax
jmp 0x4e0600
movzx r9d, byte [rsp + rsi + 0x1f]
sub r9d, edx
lea edx, [r9 - 0x40]
mov byte [rsp + rdi + 0x1f], dl
lea edx, [r8 - 0x40]
mov byte [rsp + rsi + 0x1f], dl
add rax, 2
nop dword [rax]
cmp rax, 0x1c
jge 0x4e062d
movzx edx, byte [rsp + rax + 0x34]
movzx esi, byte [rsp + rax + 0x35]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x15
jae 0x4e0650
movzx r8d, byte [rsp + rdi + 0x1f]
sub r8d, edx
cmp rsi, 0x15
jb 0x4e05df
jmp 0x4e0644
xor eax, eax
lea rbx, [rsp + 0x1f]
mov ecx, 0x15
call fcn.00441380
add rsp, 0x50
pop rbp
ret
mov eax, esi
mov ecx, 0x15
call fcn.004518a0
mov eax, edi
mov ecx, 0x15
call fcn.004518a0
nop
nop dword [rax]
call fcn.0044f620
jmp fcn.004e0560
Function at 0x4e1520
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4e1628
push rbp
mov rbp, rsp
sub rsp, 0x50
movabs rdx, 0x32cc2a5ad477be0e
mov qword [rsp + 0x19], rdx
movabs rdx, 0x5d61dbdffabd1e61
mov qword [rsp + 0x21], rdx
movabs rdx, 0xe95d61dbdffabd1e
mov qword [rsp + 0x22], rdx
movabs rdx, 0xe6d69c7fb3acc61
mov qword [rsp + 0x2a], rdx
movabs rdx, 0x1415120b060f030d
mov qword [rsp + 0x32], rdx
movabs rdx, 0x6180d0b0a0001
mov qword [rsp + 0x3a], rdx
movabs rdx, 0x12090f0500000006
mov qword [rsp + 0x40], rdx
movabs rdx, 0xd1207130c0b0310
mov qword [rsp + 0x48], rdx
xor eax, eax
jmp 0x4e15cb
movzx r9d, byte [rsp + rsi + 0x19]
sub r9d, edx
lea edx, [r9 + 0x60]
mov byte [rsp + rdi + 0x19], dl
lea edx, [r8 + 0x60]
mov byte [rsp + rsi + 0x19], dl
add rax, 2
cmp rax, 0x1e
jge 0x4e15f8
movzx edx, byte [rsp + rax + 0x32]
movzx esi, byte [rsp + rax + 0x33]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x19
jae 0x4e161b
movzx r8d, byte [rsp + rdi + 0x19]
sub r8d, edx
cmp rsi, 0x19
jb 0x4e15ae
jmp 0x4e160f
xor eax, eax
lea rbx, [rsp + 0x19]
mov ecx, 0x19
call fcn.00441380
add rsp, 0x50
pop rbp
ret
mov eax, esi
mov ecx, 0x19
call fcn.004518a0
mov eax, edi
mov ecx, 0x19
call fcn.004518a0
nop
call fcn.0044f620
jmp fcn.004e1520

Function at 0x4e1640
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4e175a
push rbp
mov rbp, rsp
sub rsp, 0x58
movabs rdx, 0xe013f61c1cdc0c4
mov qword [rsp + 0x18], rdx
movabs rdx, 0x291a5320ff6cd8d6
mov qword [rsp + 0x20], rdx
movabs rdx, 0x3db8291a5320ff6c
mov qword [rsp + 0x22], rdx
movabs rdx, 0x6583b1542064a4d1
mov qword [rsp + 0x2a], rdx
movabs rdx, 0x218120809120713
mov qword [rsp + 0x32], rdx
movabs rdx, 0x211070511130218
mov qword [rsp + 0x38], rdx
movabs rdx, 0x20f03110600000e
mov qword [rsp + 0x40], rdx
movabs rdx, 0x611170e09181001
mov qword [rsp + 0x48], rdx
movabs rdx, 0x50e12100b110f01
mov qword [rsp + 0x50], rdx
xor eax, eax
jmp 0x4e16f7
movzx r9d, byte [rsp + rsi + 0x18]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x2b]
mov byte [rsp + rdi + 0x18], dl
mov byte [rsp + rsi + 0x18], r8b
add rax, 2
cmp rax, 0x26
jge 0x4e1729
movzx edx, byte [rsp + rax + 0x32]
movzx esi, byte [rsp + rax + 0x33]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x1a
jae 0x4e174d
movzx r8d, byte [rsp + rdi + 0x18]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x2b]
cmp rsi, 0x1a
jb 0x4e16dd
jmp 0x4e1741
xor eax, eax
lea rbx, [rsp + 0x18]
mov ecx, 0x1a
call fcn.00441380
add rsp, 0x58
pop rbp
nop
ret
mov eax, esi
mov ecx, 0x1a
call fcn.004518a0
mov eax, edi
mov ecx, 0x1a
call fcn.004518a0
nop
call fcn.0044f620
nop
jmp fcn.004e1640
Function at 0x4e1780
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4e189a
push rbp
mov rbp, rsp
sub rsp, 0x58
movabs rdx, 0x64392b776e606d63
mov qword [rsp + 0x19], rdx
movabs rdx, 0x6a7352555d6f5c7e
mov qword [rsp + 0x21], rdx
movabs rdx, 0x646e6174266a7352
mov qword [rsp + 0x26], rdx
movabs rdx, 0x655f6954204b6954
mov qword [rsp + 0x2e], rdx
movabs rdx, 0xf050b08160a100c
mov qword [rsp + 0x36], rdx
movabs rdx, 0xd0b0f050b08160a
mov qword [rsp + 0x38], rdx
movabs rdx, 0xd020b0004040c0c
mov qword [rsp + 0x40], rdx
movabs rdx, 0x5150309171b0517
mov qword [rsp + 0x48], rdx
movabs rdx, 0x10310101006070c
mov qword [rsp + 0x50], rdx
xor eax, eax
jmp 0x4e1837
movzx r9d, byte [rsp + rsi + 0x19]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x1b]
mov byte [rsp + rdi + 0x19], dl
mov byte [rsp + rsi + 0x19], r8b
add rax, 2
cmp rax, 0x22
jge 0x4e1869
movzx edx, byte [rsp + rax + 0x36]
movzx esi, byte [rsp + rax + 0x37]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x1d
jae 0x4e188d
movzx r8d, byte [rsp + rdi + 0x19]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x1b]
cmp rsi, 0x1d
jb 0x4e181d
jmp 0x4e1881
xor eax, eax
lea rbx, [rsp + 0x19]
mov ecx, 0x1d
call fcn.00441380
add rsp, 0x58
pop rbp
nop
ret
mov eax, esi
mov ecx, 0x1d
call fcn.004518a0
mov eax, edi
mov ecx, 0x1d
call fcn.004518a0
nop
call fcn.0044f620
nop
jmp fcn.004e1780

Function at 0x4e36a0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4e378a
push rbp
mov rbp, rsp
sub rsp, 0x40
movabs rdx, 0x3753df1b232ecde8
mov qword [rsp + 0x19], rdx
movabs rdx, 0x64de613753df1b23
mov qword [rsp + 0x1c], rdx
movabs rdx, 0x656d695431649795
mov qword [rsp + 0x24], rdx
movabs rdx, 0xb090c0b03040703
mov qword [rsp + 0x2c], rdx
movabs rdx, 0x90204050b090c0b
mov qword [rsp + 0x30], rdx
movabs rdx, 0xe0c040b04000401
mov qword [rsp + 0x38], rdx
xor eax, eax
jmp 0x4e372d
movzx r9d, byte [rsp + rsi + 0x19]
sub r9d, edx
lea edx, [r9 + 0x55]
mov byte [rsp + rdi + 0x19], dl
lea edx, [r8 + 0x55]
mov byte [rsp + rsi + 0x19], dl
add rax, 2
cmp rax, 0x14
jge 0x4e375a
movzx edx, byte [rsp + rax + 0x2c]
movzx esi, byte [rsp + rax + 0x2d]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x13
jae 0x4e377d
movzx r8d, byte [rsp + rdi + 0x19]
sub r8d, edx
cmp rsi, 0x13
jb 0x4e3710
jmp 0x4e3771
xor eax, eax
lea rbx, [rsp + 0x19]
mov ecx, 0x13
call fcn.00441380
add rsp, 0x40
pop rbp
ret
mov eax, esi
mov ecx, 0x13
call fcn.004518a0
mov eax, edi
mov ecx, 0x13
call fcn.004518a0
nop
call fcn.0044f620
jmp fcn.004e36a0
Function at 0x4e37a0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4e38cc
push rbp
mov rbp, rsp
sub rsp, 0x68
movabs rdx, 0x6e13436f386c6117
mov qword [rsp + 0x1d], rdx
movabs rdx, 0x4820657770747176
mov qword [rsp + 0x25], rdx
movabs rdx, 0x6652692628e86948
mov qword [rsp + 0x2c], rdx
movabs rdx, 0x6e6279036153496f
mov qword [rsp + 0x34], rdx
movabs rdx, 0xb081c0f181d1b07
mov qword [rsp + 0x3c], rdx
movabs rdx, 0x6130c0c19070809
mov qword [rsp + 0x44], rdx
movabs rdx, 0x1c1d121006130c0c
mov qword [rsp + 0x48], rdx
movabs rdx, 0x1903061002021c09
mov qword [rsp + 0x50], rdx
movabs rdx, 0x1006031115060015
mov qword [rsp + 0x58], rdx
movabs rdx, 0x51d090311191815
mov qword [rsp + 0x60], rdx
xor eax, eax
jmp 0x4e3866
movzx r9d, byte [rsp + rsi + 0x1d]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x16]
mov byte [rsp + rdi + 0x1d], dl
mov byte [rsp + rsi + 0x1d], r8b
add rax, 2
cmp rax, 0x2c
jge 0x4e389c
movzx edx, byte [rsp + rax + 0x3c]
movzx esi, byte [rsp + rax + 0x3d]
mov edi, edx
xor edx, esi
add edx, eax
nop dword [rax]
cmp rdi, 0x1f
jae 0x4e38bf
movzx r8d, byte [rsp + rdi + 0x1d]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x16]
cmp rsi, 0x1f
jb 0x4e384c
jmp 0x4e38b3
xor eax, eax
lea rbx, [rsp + 0x1d]
mov ecx, 0x1f
call fcn.00441380
add rsp, 0x68
pop rbp
ret
mov eax, esi
mov ecx, 0x1f
call fcn.004518a0
mov eax, edi
mov ecx, 0x1f
call fcn.004518a0
nop
call fcn.0044f620
jmp fcn.004e37a0

Function at 0x4e5b20
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4e5c06
push rbp
mov rbp, rsp
sub rsp, 0x40
movabs rdx, 0x2c2d333a2e2e4d26
mov qword [rsp + 0x1f], rdx
movabs rdx, 0x58332a34332c422c
mov qword [rsp + 0x26], rdx
movabs rdx, 0x9060c0b0e04080e
mov qword [rsp + 0x2e], rdx
movabs rdx, 0xd0a09060c0b0e04
mov qword [rsp + 0x30], rdx
movabs rdx, 0xc0d000b0e0e0205
mov qword [rsp + 0x38], rdx
xor eax, eax
nop
jmp 0x4e5ba0
movzx r9d, byte [rsp + rsi + 0x1f]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x11]
mov byte [rsp + rdi + 0x1f], dl
mov byte [rsp + rsi + 0x1f], r8b
add rax, 2
nop dword [rax]
cmp rax, 0x12
jge 0x4e5bd2
movzx edx, byte [rsp + rax + 0x2e]
movzx esi, byte [rsp + rax + 0x2f]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0xf
jae 0x4e5bf7
movzx r8d, byte [rsp + rdi + 0x1f]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x11]
cmp rsi, 0xf
jb 0x4e5b82
jmp 0x4e5beb
xor eax, eax
lea rbx, [rsp + 0x1f]
mov ecx, 0xf
nop
call fcn.00441380
add rsp, 0x40
pop rbp
ret
mov eax, esi
mov ecx, 0xf
call fcn.004518a0
mov eax, edi
mov ecx, 0xf
nop
call fcn.004518a0
nop
call fcn.0044f620
jmp fcn.004e5b20
Function at 0x4eb900
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov qword [rsp + 0x40], 0
movabs rdx, 0x611ac244eea25984
mov qword [rsp + 0x1c], rdx
movabs rdx, 0x102050206020701
mov qword [rsp + 0x24], rdx
mov dword [rsp + 0x2c], 0x1020605
xor eax, eax
jmp 0x4eb955
movzx r8d, byte [rsp + rbx + 0x1c]
lea edx, [r8 + rdx]
lea edx, [rdx + 0xe]
mov byte [rsp + rsi + 0x1c], dl
mov byte [rsp + rbx + 0x1c], dil
add rax, 2
cmp rax, 0xc
jge 0x4eb988
movzx edx, byte [rsp + rax + 0x24]
movzx ebx, byte [rsp + rax + 0x25]
mov esi, edx
xor edx, ebx
add edx, eax
cmp rsi, 8
jae 0x4eb9c5
movzx edi, byte [rsp + rsi + 0x1c]
lea edi, [rdi + rdx]
lea edi, [rdi + 0xe]
nop dword [rax]
cmp rbx, 8
jb 0x4eb93b
jmp 0x4eb9b7
mov qword [rsp + 0x14], 0
xor eax, eax
jmp 0x4eb9a1
movzx ecx, byte [rsp + rax + 0x1c]
mov byte [rsp + rax + 0x14], cl
inc rax
cmp rax, 8
jl 0x4eb995
mov rax, qword [rsp + 0x14]
mov qword [rsp + 0x40], rax
add rsp, 0x30
pop rbp
ret
mov eax, ebx
mov ecx, 8
nop
call fcn.004518a0
mov eax, esi
mov ecx, 8
call fcn.004518a0
nop
int3

Function at 0x4eb9e0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x28
mov qword [rsp + 0x38], 0
movabs rdx, 0x3c3b9e3034253fc
mov qword [rsp + 0x20], rdx
movabs rdx, 0x502000302030700
mov qword [rsp + 0x10], rdx
xor eax, eax
jmp 0x4eba2d
movzx r8d, byte [rsp + rbx + 0x20]
lea edx, [r8 + rdx]
lea edx, [rdx + 0x1f]
mov byte [rsp + rsi + 0x20], dl
mov byte [rsp + rbx + 0x20], dil
add rax, 2
cmp rax, 8
jge 0x4eba5c
movzx edx, byte [rsp + rax + 0x10]
movzx ebx, byte [rsp + rax + 0x11]
mov esi, edx
xor edx, ebx
add edx, eax
cmp rsi, 8
jae 0x4eba97
movzx edi, byte [rsp + rsi + 0x20]
lea edi, [rdi + rdx]
lea edi, [rdi + 0x1f]
cmp rbx, 8
jb 0x4eba13
jmp 0x4eba8b
mov qword [rsp + 0x18], 0
xor eax, eax
jmp 0x4eba75
movzx ecx, byte [rsp + rax + 0x20]
mov byte [rsp + rax + 0x18], cl
inc rax
cmp rax, 8
jl 0x4eba69
mov rax, qword [rsp + 0x18]
mov qword [rsp + 0x38], rax
add rsp, 0x28
pop rbp
ret
mov eax, ebx
mov ecx, 8
call fcn.004518a0
mov eax, esi
mov ecx, 8
nop
call fcn.004518a0
nop
int3

Function at 0x4ebc20
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4ebce7
push rbp
mov rbp, rsp
sub rsp, 0x38
movabs rdx, 0x32596956ff74652a
mov qword [rsp + 0x1e], rdx
mov dword [rsp + 0x26], 0x2048644e
movabs rdx, 0x40000000b060a03
mov qword [rsp + 0x2a], rdx
movabs rdx, 0x40808080a040400
mov qword [rsp + 0x30], rdx
xor eax, eax
jmp 0x4ebc88
movzx r9d, byte [rsp + rsi + 0x1e]
sub r9d, edx
lea edx, [r9 + 0x22]
mov byte [rsp + rdi + 0x1e], dl
lea edx, [r8 + 0x22]
mov byte [rsp + rsi + 0x1e], dl
add rax, 2
cmp rax, 0xe
jge 0x4ebcb7
movzx edx, byte [rsp + rax + 0x2a]
movzx esi, byte [rsp + rax + 0x2b]
mov edi, edx
xor edx, esi
add edx, eax
nop
cmp rdi, 0xc
jae 0x4ebcda
movzx r8d, byte [rsp + rdi + 0x1e]
sub r8d, edx
cmp rsi, 0xc
jb 0x4ebc6b
jmp 0x4ebcce
xor eax, eax
lea rbx, [rsp + 0x1e]
mov ecx, 0xc
call fcn.00441380
add rsp, 0x38
pop rbp
ret
mov eax, esi
mov ecx, 0xc
call fcn.004518a0
mov eax, edi
mov ecx, 0xc
call fcn.004518a0
nop
call fcn.0044f620
jmp fcn.004ebc20
Function at 0x4ec380
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4ec45d
push rbp
mov rbp, rsp
sub rsp, 0x40
movabs rdx, 0x56517072b3cab7a8
mov qword [rsp + 0x1b], rdx
movabs rdx, 0x661725c1bffa9056
mov qword [rsp + 0x22], rdx
movabs rdx, 0x60b0d0903070800
mov qword [rsp + 0x2a], rdx
movabs rdx, 0x50c0b030a01060b
mov qword [rsp + 0x30], rdx
movabs rdx, 0x30b09050d020d0c
mov qword [rsp + 0x38], rdx
xor eax, eax
nop
jmp 0x4ec400
movzx r9d, byte [rsp + rsi + 0x1b]
sub r9d, edx
lea edx, [r9 - 0x3f]
mov byte [rsp + rdi + 0x1b], dl
lea edx, [r8 - 0x3f]
mov byte [rsp + rsi + 0x1b], dl
add rax, 2
nop
cmp rax, 0x16
jge 0x4ec42d
movzx edx, byte [rsp + rax + 0x2a]
movzx esi, byte [rsp + rax + 0x2b]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0xf
jae 0x4ec450
movzx r8d, byte [rsp + rdi + 0x1b]
sub r8d, edx
cmp rsi, 0xf
jb 0x4ec3e2
jmp 0x4ec444
xor eax, eax
lea rbx, [rsp + 0x1b]
mov ecx, 0xf
call fcn.00441380
add rsp, 0x40
pop rbp
ret
mov eax, esi
mov ecx, 0xf
call fcn.004518a0
mov eax, edi
mov ecx, 0xf
call fcn.004518a0
nop
nop dword [rax]
call fcn.0044f620
jmp fcn.004ec380

Function at 0x4ec860
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4ec938
push rbp
mov rbp, rsp
sub rsp, 0x38
movabs rdx, 0xed6a5eabb5766532
mov qword [rsp + 0x1a], rdx
mov dword [rsp + 0x22], 0xdd6cbf53
movabs rdx, 0x70604070504000b
mov qword [rsp + 0x26], rdx
movabs rdx, 0x70b070604070504
mov qword [rsp + 0x28], rdx
movabs rdx, 0x600070304090b06
mov qword [rsp + 0x30], rdx
xor eax, eax
jmp 0x4ec8d7
movzx r9d, byte [rsp + rsi + 0x1a]
sub r9d, edx
lea edx, [r9 - 0x34]
mov byte [rsp + rdi + 0x1a], dl
lea edx, [r8 - 0x34]
mov byte [rsp + rsi + 0x1a], dl
add rax, 2
cmp rax, 0x12
jge 0x4ec908
movzx edx, byte [rsp + rax + 0x26]
movzx esi, byte [rsp + rax + 0x27]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0xc
jae 0x4ec92b
movzx r8d, byte [rsp + rdi + 0x1a]
sub r8d, edx
nop dword [rax]
cmp rsi, 0xc
jb 0x4ec8ba
jmp 0x4ec91f
xor eax, eax
lea rbx, [rsp + 0x1a]
mov ecx, 0xc
call fcn.00441380
add rsp, 0x38
pop rbp
ret
mov eax, esi
mov ecx, 0xc
call fcn.004518a0
mov eax, edi
mov ecx, 0xc
call fcn.004518a0
nop
call fcn.0044f620
nop dword [rax]
jmp fcn.004ec860
Function at 0x4ed240
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4ed307
push rbp
mov rbp, rsp
sub rsp, 0x38
movabs rdx, 0xf4736497a2b46547
mov qword [rsp + 0x1e], rdx
mov dword [rsp + 0x26], 0xc2879b5e
movabs rdx, 0x90404020503080a
mov qword [rsp + 0x2a], rdx
movabs rdx, 0x705050b0b070904
mov qword [rsp + 0x30], rdx
xor eax, eax
jmp 0x4ed2a8
movzx r9d, byte [rsp + rsi + 0x1e]
sub r9d, edx
lea edx, [r9 - 0x19]
mov byte [rsp + rdi + 0x1e], dl
lea edx, [r8 - 0x19]
mov byte [rsp + rsi + 0x1e], dl
add rax, 2
cmp rax, 0xe
jge 0x4ed2d7
movzx edx, byte [rsp + rax + 0x2a]
movzx esi, byte [rsp + rax + 0x2b]
mov edi, edx
xor edx, esi
add edx, eax
nop
cmp rdi, 0xc
jae 0x4ed2fa
movzx r8d, byte [rsp + rdi + 0x1e]
sub r8d, edx
cmp rsi, 0xc
jb 0x4ed28b
jmp 0x4ed2ee
xor eax, eax
lea rbx, [rsp + 0x1e]
mov ecx, 0xc
call fcn.00441380
add rsp, 0x38
pop rbp
ret
mov eax, esi
mov ecx, 0xc
call fcn.004518a0
mov eax, edi
mov ecx, 0xc
call fcn.004518a0
nop
call fcn.0044f620
jmp fcn.004ed240

Function at 0x4edec0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4edf92
push rbp
mov rbp, rsp
sub rsp, 0x38
movabs rdx, 0x8ca39c9a54c46578
mov qword [rsp + 0x1d], rdx
movabs rdx, 0xc03268899c8ca39c
mov qword [rsp + 0x22], rdx
movabs rdx, 0x70c050c06020404
mov qword [rsp + 0x2a], rdx
movabs rdx, 0x8090605000c070c
mov qword [rsp + 0x30], rdx
xor eax, eax
jmp 0x4edf2c
movzx r9d, byte [rsp + rsi + 0x1d]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x35]
mov byte [rsp + rdi + 0x1d], dl
mov byte [rsp + rsi + 0x1d], r8b
add rax, 2
cmp rax, 0xe
jge 0x4edf5e
movzx edx, byte [rsp + rax + 0x2a]
movzx esi, byte [rsp + rax + 0x2b]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0xd
jae 0x4edf85
movzx r8d, byte [rsp + rdi + 0x1d]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x35]
cmp rsi, 0xd
jb 0x4edf12
jmp 0x4edf75
xor eax, eax
lea rbx, [rsp + 0x1d]
mov ecx, 0xd
call fcn.00441380
add rsp, 0x38
pop rbp
ret
mov eax, esi
mov ecx, 0xd
nop dword [rax]
call fcn.004518a0
mov eax, edi
mov ecx, 0xd
call fcn.004518a0
nop
call fcn.0044f620
jmp fcn.004edec0

Function at 0x4ee520
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4ee5e7
push rbp
mov rbp, rsp
sub rsp, 0x30
movabs rdx, 0x3cdd694615fa322d
mov qword [rsp + 0x19], rdx
movabs rdx, 0xf178453cdd694615
mov qword [rsp + 0x1c], rdx
movabs rdx, 0x300060a0202060a
mov qword [rsp + 0x24], rdx
mov dword [rsp + 0x2c], 0x6020701
xor eax, eax
jmp 0x4ee588
movzx r9d, byte [rsp + rsi + 0x19]
sub r9d, edx
lea edx, [r9 + 0x41]
mov byte [rsp + rdi + 0x19], dl
lea edx, [r8 + 0x41]
mov byte [rsp + rsi + 0x19], dl
add rax, 2
cmp rax, 0xc
jge 0x4ee5b7
movzx edx, byte [rsp + rax + 0x24]
movzx esi, byte [rsp + rax + 0x25]
mov edi, edx
xor edx, esi
add edx, eax
nop
cmp rdi, 0xb
jae 0x4ee5da
movzx r8d, byte [rsp + rdi + 0x19]
sub r8d, edx
cmp rsi, 0xb
jb 0x4ee56b
jmp 0x4ee5ce
xor eax, eax
lea rbx, [rsp + 0x19]
mov ecx, 0xb
call fcn.00441380
add rsp, 0x30
pop rbp
ret
mov eax, esi
mov ecx, 0xb
call fcn.004518a0
mov eax, edi
mov ecx, 0xb
call fcn.004518a0
nop
call fcn.0044f620
jmp fcn.004ee520
Function at 0x4eed20
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4eedec
push rbp
mov rbp, rsp
sub rsp, 0x38
movabs rdx, 0xc846d7a86fe06e90
mov qword [rsp + 0x1e], rdx
mov dword [rsp + 0x26], 0xcf4565cc
movabs rdx, 0x8070b040b070205
mov qword [rsp + 0x2a], rdx
movabs rdx, 0x207050500000807
mov qword [rsp + 0x30], rdx
xor eax, eax
jmp 0x4eed85
movzx r9d, byte [rsp + rsi + 0x1e]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x43]
mov byte [rsp + rdi + 0x1e], dl
mov byte [rsp + rsi + 0x1e], r8b
add rax, 2
cmp rax, 0xe
jge 0x4eedbc
movzx edx, byte [rsp + rax + 0x2a]
movzx esi, byte [rsp + rax + 0x2b]
mov edi, edx
xor edx, esi
add edx, eax
nop dword [rax + rax]
cmp rdi, 0xc
jae 0x4eeddf
movzx r8d, byte [rsp + rdi + 0x1e]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x43]
cmp rsi, 0xc
jb 0x4eed6b
jmp 0x4eedd3
xor eax, eax
lea rbx, [rsp + 0x1e]
mov ecx, 0xc
call fcn.00441380
add rsp, 0x38
pop rbp
ret
mov eax, esi
mov ecx, 0xc
call fcn.004518a0
mov eax, edi
mov ecx, 0xc
call fcn.004518a0
nop
call fcn.0044f620
jmp fcn.004eed20

Function at 0x4f4b60
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4f4c87
push rbp
mov rbp, rsp
sub rsp, 0x60
movabs rdx, 0xc6b5ab70b6b1b560
mov qword [rsp + 0x1a], rdx
movabs rdx, 0xaa9fc6b5ab70b6b1
mov qword [rsp + 0x1c], rdx
movabs rdx, 0x28bca5ce6e91a37e
mov qword [rsp + 0x24], rdx
movabs rdx, 0xd4f56fb374acac70
mov qword [rsp + 0x2c], rdx
movabs rdx, 0x20d472f972b765b5
mov qword [rsp + 0x34], rdx
movabs rdx, 0x1a0b1119080607
mov qword [rsp + 0x3c], rdx
movabs rdx, 0x1e030c08001a0b11
mov qword [rsp + 0x40], rdx
movabs rdx, 0x505060716010e05
mov qword [rsp + 0x48], rdx
movabs rdx, 0x3030a120b091418
mov qword [rsp + 0x50], rdx
movabs rdx, 0x9021314101c0f20
mov qword [rsp + 0x58], rdx
xor eax, eax
jmp 0x4f4c29
movzx r9d, byte [rsp + rsi + 0x1a]
sub r9d, edx
lea edx, [r9 - 0x20]
mov byte [rsp + rdi + 0x1a], dl
lea edx, [r8 - 0x20]
mov byte [rsp + rsi + 0x1a], dl
add rax, 2
cmp rax, 0x24
jge 0x4f4c57
movzx edx, byte [rsp + rax + 0x3c]
movzx esi, byte [rsp + rax + 0x3d]
mov edi, edx
xor edx, esi
add edx, eax
nop
cmp rdi, 0x22
jae 0x4f4c7a
movzx r8d, byte [rsp + rdi + 0x1a]
sub r8d, edx
cmp rsi, 0x22
jb 0x4f4c0c
jmp 0x4f4c6e
xor eax, eax
lea rbx, [rsp + 0x1a]
mov ecx, 0x22
call fcn.00441380
add rsp, 0x60
pop rbp
ret
mov eax, esi
mov ecx, 0x22
call fcn.004518a0
mov eax, edi
mov ecx, 0x22
call fcn.004518a0
nop
call fcn.0044f620
jmp fcn.004f4b60