joyce8/EMBER2024-capa huggingface dataset:
Function at 0x49d5c0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x49d692
sub rsp, 0x38
mov qword [rsp + 0x30], rbp
lea rbp, [rsp + 0x30]
movabs rdx, 0x2238762064614e72
mov qword [rsp + 0x19], rdx
movabs rdx, 0x74c4ef2238762064
mov qword [rsp + 0x1c], rdx
movabs rdx, 0x108090801070807
mov qword [rsp + 0x24], rdx
mov dword [rsp + 0x2c], 0x6010101
xor eax, eax
jmp 0x49d62b
movzx r9d, byte [rsp + rsi + 0x19]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x1c]
mov byte [rsp + rdi + 0x19], dl
mov byte [rsp + rsi + 0x19], r8b
add rax, 2
cmp rax, 0xc
jge 0x49d65d
movzx edx, byte [rsp + rax + 0x24]
movzx esi, byte [rsp + rax + 0x25]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0xb
jae 0x49d685
movzx r8d, byte [rsp + rdi + 0x19]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x1c]
cmp rsi, 0xb
jb 0x49d611
jmp 0x49d678
xor eax, eax
lea rbx, [rsp + 0x19]
mov ecx, 0xb
call fcn.00441880
mov rbp, qword [rsp + 0x30]
add rsp, 0x38
ret
mov eax, esi
mov ecx, 0xb
nop
call fcn.004533e0
mov eax, edi
mov ecx, 0xb
call fcn.004533e0
nop
call fcn.00450d80
jmp fcn.0049d5c0

Function at 0x4a1220
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4a1348
sub rsp, 0x60
mov qword [rsp + 0x58], rbp
lea rbp, [rsp + 0x58]
movabs rdx, 0xd3cd7220f0ec69
mov qword [rsp + 0x19], rdx
movabs rdx, 0x6f20c9740ac47709
mov qword [rsp + 0x21], rdx
movabs rdx, 0x6f4ebf086e6f20c9
mov qword [rsp + 0x26], rdx
movabs rdx, 0x75df207012c32bfc
mov qword [rsp + 0x2e], rdx
movabs rdx, 0x171618050a120208
mov qword [rsp + 0x36], rdx
movabs rdx, 0x108171618050a12
mov qword [rsp + 0x38], rdx
movabs rdx, 0x21b0b120602021c
mov qword [rsp + 0x40], rdx
movabs rdx, 0xa06060d13061a15
mov qword [rsp + 0x48], rdx
movabs rdx, 0x7111c11160d1a07
mov qword [rsp + 0x50], rdx
xor eax, eax
jmp 0x4a12e0
movzx r9d, byte [rsp + rsi + 0x19]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x32]
mov byte [rsp + rdi + 0x19], dl
mov byte [rsp + rsi + 0x19], r8b
add rax, 2
nop dword [rax]
cmp rax, 0x22
jge 0x4a1312
movzx edx, byte [rsp + rax + 0x36]
movzx esi, byte [rsp + rax + 0x37]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x1d
jae 0x4a133b
movzx r8d, byte [rsp + rdi + 0x19]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x32]
cmp rsi, 0x1d
jb 0x4a12c3
jmp 0x4a132f
xor eax, eax
lea rbx, [rsp + 0x19]
mov ecx, 0x1d
nop
call fcn.00441880
mov rbp, qword [rsp + 0x58]
add rsp, 0x60
ret
mov eax, esi
mov ecx, 0x1d
call fcn.004533e0
mov eax, edi
mov ecx, 0x1d
call fcn.004533e0
nop
call fcn.00450d80
jmp fcn.004a1220
Function at 0x4a3ec0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4a3f88
sub rsp, 0x38
mov qword [rsp + 0x30], rbp
lea rbp, [rsp + 0x30]
movabs rdx, 0x6f9072657473954b
mov qword [rsp + 0x1b], rdx
mov byte [rsp + 0x23], 0xb3
movabs rdx, 0x80606010608
mov qword [rsp + 0x24], rdx
mov dword [rsp + 0x2c], 0x30101
xor eax, eax
jmp 0x4a3f21
movzx r9d, byte [rsp + rsi + 0x1b]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x1f]
mov byte [rsp + rdi + 0x1b], dl
mov byte [rsp + rsi + 0x1b], r8b
add rax, 2
cmp rax, 0xc
jge 0x4a3f53
movzx edx, byte [rsp + rax + 0x24]
movzx esi, byte [rsp + rax + 0x25]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 9
jae 0x4a3f7b
movzx r8d, byte [rsp + rdi + 0x1b]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x1f]
cmp rsi, 9
jb 0x4a3f07
jmp 0x4a3f6f
xor eax, eax
lea rbx, [rsp + 0x1b]
mov ecx, 9
nop
call fcn.00441880
mov rbp, qword [rsp + 0x30]
add rsp, 0x38
ret
mov eax, esi
mov ecx, 9
call fcn.004533e0
mov eax, edi
mov ecx, 9
call fcn.004533e0
nop
call fcn.00450d80
jmp fcn.004a3ec0

Function at 0x4a4d80
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4a4e52
sub rsp, 0x38
mov qword [rsp + 0x30], rbp
lea rbp, [rsp + 0x30]
movabs rdx, 0xd187c6bf6d91c2c4
mov qword [rsp + 0x18], rdx
mov word [rsp + 0x20], 0xd030
movabs rdx, 0x702060209050108
mov qword [rsp + 0x22], rdx
movabs rdx, 0x704010006040702
mov qword [rsp + 0x28], rdx
xor eax, eax
jmp 0x4a4ded
movzx r9d, byte [rsp + rsi + 0x18]
sub r9d, edx
lea edx, [r9 - 0x54]
mov byte [rsp + rdi + 0x18], dl
lea edx, [r8 - 0x54]
mov byte [rsp + rsi + 0x18], dl
add rax, 2
cmp rax, 0xe
jge 0x4a4e1a
movzx edx, byte [rsp + rax + 0x22]
movzx esi, byte [rsp + rax + 0x23]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0xa
jae 0x4a4e45
movzx r8d, byte [rsp + rdi + 0x18]
sub r8d, edx
cmp rsi, 0xa
jb 0x4a4dd0
jmp 0x4a4e35
xor eax, eax
lea rbx, [rsp + 0x18]
mov ecx, 0xa
call fcn.00441880
mov rbp, qword [rsp + 0x30]
add rsp, 0x38
ret
mov eax, esi
mov ecx, 0xa
nop dword [rax]
call fcn.004533e0
mov eax, edi
mov ecx, 0xa
call fcn.004533e0
nop
call fcn.00450d80
jmp fcn.004a4d80
Function at 0x4a61e0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4a62bc
sub rsp, 0x40
mov qword [rsp + 0x38], rbp
lea rbp, [rsp + 0x38]
movabs rdx, 0x4c55742965585d45
mov qword [rsp + 0x19], rdx
movabs rdx, 0x722c464c5220424c
mov qword [rsp + 0x20], rdx
movabs rdx, 0xd0a08040d040b06
mov qword [rsp + 0x28], rdx
movabs rdx, 0x1070204010c
mov qword [rsp + 0x30], rdx
xor eax, eax
jmp 0x4a6255
movzx r9d, byte [rsp + rsi + 0x19]
sub r9d, edx
lea edx, [r9 + 0x2a]
mov byte [rsp + rdi + 0x19], dl
lea edx, [r8 + 0x2a]
mov byte [rsp + rsi + 0x19], dl
add rax, 2
cmp rax, 0x10
jge 0x4a6288
movzx edx, byte [rsp + rax + 0x28]
movzx esi, byte [rsp + rax + 0x29]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0xf
jae 0x4a62af
movzx r8d, byte [rsp + rdi + 0x19]
sub r8d, edx
nop word [rax + rax]
cmp rsi, 0xf
jb 0x4a6238
jmp 0x4a62a3
xor eax, eax
lea rbx, [rsp + 0x19]
mov ecx, 0xf
call fcn.00441880
mov rbp, qword [rsp + 0x38]
add rsp, 0x40
ret
mov eax, esi
mov ecx, 0xf
call fcn.004533e0
mov eax, edi
mov ecx, 0xf
call fcn.004533e0
nop
nop dword [rax]
call fcn.00450d80
jmp fcn.004a61e0

Function at 0x4a7220
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4a72f2
sub rsp, 0x38
mov qword [rsp + 0x30], rbp
lea rbp, [rsp + 0x30]
movabs rdx, 0xf8fb19444b644e62
mov qword [rsp + 0x19], rdx
movabs rdx, 0x496761f8fb19444b
mov qword [rsp + 0x1c], rdx
movabs rdx, 0x104050406010a0a
mov qword [rsp + 0x24], rdx
mov dword [rsp + 0x2c], 0x4040307
xor eax, eax
jmp 0x4a728b
movzx r9d, byte [rsp + rsi + 0x19]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x1c]
mov byte [rsp + rdi + 0x19], dl
mov byte [rsp + rsi + 0x19], r8b
add rax, 2
cmp rax, 0xc
jge 0x4a72bd
movzx edx, byte [rsp + rax + 0x24]
movzx esi, byte [rsp + rax + 0x25]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0xb
jae 0x4a72e5
movzx r8d, byte [rsp + rdi + 0x19]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x1c]
cmp rsi, 0xb
jb 0x4a7271
jmp 0x4a72d8
xor eax, eax
lea rbx, [rsp + 0x19]
mov ecx, 0xb
call fcn.00441880
mov rbp, qword [rsp + 0x30]
add rsp, 0x38
ret
mov eax, esi
mov ecx, 0xb
nop
call fcn.004533e0
mov eax, edi
mov ecx, 0xb
call fcn.004533e0
nop
call fcn.00450d80
jmp fcn.004a7220
Function at 0x4a8080
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4a817c
sub rsp, 0x48
mov qword [rsp + 0x40], rbp
lea rbp, [rsp + 0x40]
movabs rdx, 0xfd5dd9e7ec7271f7
mov qword [rsp + 0x1a], rdx
movabs rdx, 0x7020fd5dd9e7ec72
mov qword [rsp + 0x1c], rdx
movabs rdx, 0x7370eeeea6e5f672
mov qword [rsp + 0x24], rdx
movabs rdx, 0x6070e0d021002
mov qword [rsp + 0x2c], rdx
movabs rdx, 0xf0100100006070e
mov qword [rsp + 0x30], rdx
movabs rdx, 0x50c0b0f10050403
mov qword [rsp + 0x38], rdx
xor eax, eax
jmp 0x4a8110
movzx r9d, byte [rsp + rsi + 0x1a]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x69]
mov byte [rsp + rdi + 0x1a], dl
mov byte [rsp + rsi + 0x1a], r8b
add rax, 2
cmp rax, 0x14
jge 0x4a8148
movzx edx, byte [rsp + rax + 0x2c]
movzx esi, byte [rsp + rax + 0x2d]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x12
jae 0x4a816f
movzx r8d, byte [rsp + rdi + 0x1a]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x69]
nop word [rax + rax]
cmp rsi, 0x12
jb 0x4a80f6
jmp 0x4a8163
xor eax, eax
lea rbx, [rsp + 0x1a]
mov ecx, 0x12
call fcn.00441880
mov rbp, qword [rsp + 0x40]
add rsp, 0x48
ret
mov eax, esi
mov ecx, 0x12
call fcn.004533e0
mov eax, edi
mov ecx, 0x12
call fcn.004533e0
nop
nop dword [rax]
call fcn.00450d80
jmp fcn.004a8080

Function at 0x4a81a0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4a82c8
sub rsp, 0x60
mov qword [rsp + 0x58], rbp
lea rbp, [rsp + 0x58]
movabs rdx, 0x46ac133f6e561341
mov qword [rsp + 0x19], rdx
movabs rdx, 0x6f48785fe86d756e
mov qword [rsp + 0x21], rdx
movabs rdx, 0x4a0c5e6f48785fe8
mov qword [rsp + 0x24], rdx
movabs rdx, 0x186a446161f6545a
mov qword [rsp + 0x2c], rdx
movabs rdx, 0x121a150501130d0d
mov qword [rsp + 0x34], rdx
movabs rdx, 0x41119121a1505
mov qword [rsp + 0x38], rdx
movabs rdx, 0x150518060e190c0c
mov qword [rsp + 0x40], rdx
movabs rdx, 0x13140204000b1610
mov qword [rsp + 0x48], rdx
movabs rdx, 0xe1a1a1805140007
mov qword [rsp + 0x50], rdx
xor eax, eax
jmp 0x4a8260
movzx r9d, byte [rsp + rsi + 0x19]
lea edx, [r9 + rdx]
lea edx, [rdx - 6]
mov byte [rsp + rdi + 0x19], dl
mov byte [rsp + rsi + 0x19], r8b
add rax, 2
nop dword [rax]
cmp rax, 0x24
jge 0x4a8292
movzx edx, byte [rsp + rax + 0x34]
movzx esi, byte [rsp + rax + 0x35]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x1b
jae 0x4a82bb
movzx r8d, byte [rsp + rdi + 0x19]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 6]
cmp rsi, 0x1b
jb 0x4a8243
jmp 0x4a82af
xor eax, eax
lea rbx, [rsp + 0x19]
mov ecx, 0x1b
nop
call fcn.00441880
mov rbp, qword [rsp + 0x58]
add rsp, 0x60
ret
mov eax, esi
mov ecx, 0x1b
call fcn.004533e0
mov eax, edi
mov ecx, 0x1b
call fcn.004533e0
nop
call fcn.00450d80
jmp fcn.004a81a0
Function at 0x4a90e0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4a9206
sub rsp, 0x60
mov qword [rsp + 0x58], rbp
lea rbp, [rsp + 0x58]
movabs rdx, 0x9da77275819e86c3
mov qword [rsp + 0x1d], rdx
movabs rdx, 0xf6b7b36461656489
mov qword [rsp + 0x25], rdx
movabs rdx, 0x8ef6b7b364616564
mov qword [rsp + 0x26], rdx
movabs rdx, 0x97e164a5d0874fc0
mov qword [rsp + 0x2e], rdx
movabs rdx, 0xd180e080d0f0201
mov qword [rsp + 0x36], rdx
movabs rdx, 0x18130d180e080d0f
mov qword [rsp + 0x38], rdx
movabs rdx, 0x11110f0006130301
mov qword [rsp + 0x40], rdx
movabs rdx, 0x17070f1014100812
mov qword [rsp + 0x48], rdx
movabs rdx, 0x1110071514111408
mov qword [rsp + 0x50], rdx
xor eax, eax
jmp 0x4a91a0
movzx r9d, byte [rsp + rsi + 0x1d]
sub r9d, edx
lea edx, [r9 - 0x10]
mov byte [rsp + rdi + 0x1d], dl
lea edx, [r8 - 0x10]
mov byte [rsp + rsi + 0x1d], dl
add rax, 2
cmp rax, 0x22
jge 0x4a91cd
movzx edx, byte [rsp + rax + 0x36]
movzx esi, byte [rsp + rax + 0x37]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x19
jae 0x4a91f4
movzx r8d, byte [rsp + rdi + 0x1d]
sub r8d, edx
cmp rsi, 0x19
jb 0x4a9183
jmp 0x4a91e8
xor eax, eax
lea rbx, [rsp + 0x1d]
mov ecx, 0x19
call fcn.00441880
mov rbp, qword [rsp + 0x58]
add rsp, 0x60
ret
mov eax, esi
mov ecx, 0x19
call fcn.004533e0
mov eax, edi
mov ecx, 0x19
nop dword [rax + rax]
call fcn.004533e0
nop
call fcn.00450d80
jmp fcn.004a90e0

Function at 0x4aa200
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4aa2e8
sub rsp, 0x40
mov qword [rsp + 0x38], rbp
lea rbp, [rsp + 0x38]
movabs rdx, 0xc345a017b3f16f4c
mov qword [rsp + 0x1a], rdx
mov dword [rsp + 0x22], 0x98a16f64
movabs rdx, 0x40004070502030a
mov qword [rsp + 0x26], rdx
movabs rdx, 0x507040004070502
mov qword [rsp + 0x28], rdx
movabs rdx, 0x7060a0a0b0b0a05
mov qword [rsp + 0x30], rdx
xor eax, eax
nop
jmp 0x4aa280
movzx r9d, byte [rsp + rsi + 0x1a]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x36]
mov byte [rsp + rdi + 0x1a], dl
mov byte [rsp + rsi + 0x1a], r8b
add rax, 2
nop dword [rax]
cmp rax, 0x12
jge 0x4aa2b2
movzx edx, byte [rsp + rax + 0x26]
movzx esi, byte [rsp + rax + 0x27]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0xc
jae 0x4aa2db
movzx r8d, byte [rsp + rdi + 0x1a]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x36]
cmp rsi, 0xc
jb 0x4aa262
jmp 0x4aa2cf
xor eax, eax
lea rbx, [rsp + 0x1a]
mov ecx, 0xc
nop
call fcn.00441880
mov rbp, qword [rsp + 0x38]
add rsp, 0x40
ret
mov eax, esi
mov ecx, 0xc
call fcn.004533e0
mov eax, edi
mov ecx, 0xc
call fcn.004533e0
nop
call fcn.00450d80
jmp fcn.004aa200
Function at 0x4acb60
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4acc56
sub rsp, 0x50
mov qword [rsp + 0x48], rbp
lea rbp, [rsp + 0x48]
movabs rdx, 0x405b61684a796507
mov qword [rsp + 0x1e], rdx
movabs rdx, 0x6e651a5d405b6168
mov qword [rsp + 0x22], rdx
movabs rdx, 0x71656b5d765f4310
mov qword [rsp + 0x2a], rdx
movabs rdx, 0x80e030009100708
mov qword [rsp + 0x32], rdx
movabs rdx, 0xd0900060710080e
mov qword [rsp + 0x38], rdx
movabs rdx, 0x130806080c0c0909
mov qword [rsp + 0x40], rdx
xor eax, eax
jmp 0x4acbf3
movzx r9d, byte [rsp + rsi + 0x1e]
sub r9d, edx
lea edx, [r9 + 0x20]
mov byte [rsp + rdi + 0x1e], dl
lea edx, [r8 + 0x20]
mov byte [rsp + rsi + 0x1e], dl
add rax, 2
cmp rax, 0x16
jge 0x4acc22
movzx edx, byte [rsp + rax + 0x32]
movzx esi, byte [rsp + rax + 0x33]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x14
jae 0x4acc49
movzx r8d, byte [rsp + rdi + 0x1e]
sub r8d, edx
cmp rsi, 0x14
jb 0x4acbd6
nop
jmp 0x4acc3d
xor eax, eax
lea rbx, [rsp + 0x1e]
mov ecx, 0x14
call fcn.00441880
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
mov eax, esi
mov ecx, 0x14
call fcn.004533e0
mov eax, edi
mov ecx, 0x14
call fcn.004533e0
nop
call fcn.00450d80
nop dword [rax + rax]
jmp fcn.004acb60

Function at 0x4ad860
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4ad9a6
sub rsp, 0x78
mov qword [rsp + 0x70], rbp
lea rbp, [rsp + 0x70]
movabs rdx, 0x80f3adf6216ecefb
mov qword [rsp + 0x1c], rdx
movabs rdx, 0xeb6501f56180f3
mov qword [rsp + 0x22], rdx
movabs rdx, 0x97df6893f1206620
mov qword [rsp + 0x2a], rdx
movabs rdx, 0xe765eddbdb0ffcfa
mov qword [rsp + 0x32], rdx
movabs rdx, 0x9b72e8726209dc20
mov qword [rsp + 0x3a], rdx
movabs rdx, 0x1a140f1a1d0c0315
mov qword [rsp + 0x42], rdx
movabs rdx, 0x1d070623131f2523
mov qword [rsp + 0x4a], rdx
movabs rdx, 0x1b11120114201d07
mov qword [rsp + 0x50], rdx
movabs rdx, 0x1909170506071a19
mov qword [rsp + 0x58], rdx
movabs rdx, 0xa040d1500161f12
mov qword [rsp + 0x60], rdx
movabs rdx, 0x1d01201d1d1f180d
mov qword [rsp + 0x68], rdx
xor eax, eax
nop
jmp 0x4ad940
movzx r9d, byte [rsp + rsi + 0x1c]
sub r9d, edx
lea edx, [r9 - 0x61]
mov byte [rsp + rdi + 0x1c], dl
lea edx, [r8 - 0x61]
mov byte [rsp + rsi + 0x1c], dl
add rax, 2
nop
cmp rax, 0x2e
jge 0x4ad96d
movzx edx, byte [rsp + rax + 0x42]
movzx esi, byte [rsp + rax + 0x43]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x26
jae 0x4ad994
movzx r8d, byte [rsp + rdi + 0x1c]
sub r8d, edx
cmp rsi, 0x26
jb 0x4ad922
jmp 0x4ad988
xor eax, eax
lea rbx, [rsp + 0x1c]
mov ecx, 0x26
call fcn.00441880
mov rbp, qword [rsp + 0x70]
add rsp, 0x78
ret
mov eax, esi
mov ecx, 0x26
call fcn.004533e0
mov eax, edi
mov ecx, 0x26
nop dword [rax + rax]
call fcn.004533e0
nop
call fcn.00450d80
jmp fcn.004ad860
Function at 0x4add80
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4aded2
add rsp, 0xffffffffffffff80
mov qword [rsp + 0x78], rbp
lea rbp, [rsp + 0x78]
movabs rdx, 0x527118696e086117
mov qword [rsp + 0x1f], rdx
movabs rdx, 0x50fa554078527118
mov qword [rsp + 0x24], rdx
movabs rdx, 0x416459223b41e3f8
mov qword [rsp + 0x2c], rdx
movabs rdx, 0x283272507262ec39
mov qword [rsp + 0x34], rdx
movabs rdx, 0xe920f7636635e5eb
mov qword [rsp + 0x3c], rdx
movabs rdx, 0x160a1d0010070415
mov qword [rsp + 0x44], rdx
movabs rdx, 0x190c2222160a1d00
mov qword [rsp + 0x48], rdx
movabs rdx, 0x1d09230905060b1e
mov qword [rsp + 0x50], rdx
movabs rdx, 0x22200a1c06061210
mov qword [rsp + 0x58], rdx
movabs rdx, 0x6022011070a1400
mov qword [rsp + 0x60], rdx
movabs rdx, 0x240e1f09111e1e0e
mov qword [rsp + 0x68], rdx
movabs rdx, 0xe110d0b020f1b04
mov qword [rsp + 0x70], rdx
xor eax, eax
jmp 0x4ade6a
movzx r9d, byte [rsp + rsi + 0x1f]
lea edx, [r9 + rdx]
lea edx, [rdx - 0xe]
mov byte [rsp + rdi + 0x1f], dl
mov byte [rsp + rsi + 0x1f], r8b
add rax, 2
cmp rax, 0x34
jge 0x4ade9c
movzx edx, byte [rsp + rax + 0x44]
movzx esi, byte [rsp + rax + 0x45]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x25
jae 0x4adec5
movzx r8d, byte [rsp + rdi + 0x1f]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0xe]
cmp rsi, 0x25
jb 0x4ade50
jmp 0x4adeb7
xor eax, eax
lea rbx, [rsp + 0x1f]
mov ecx, 0x25
call fcn.00441880
mov rbp, qword [rsp + 0x78]
sub rsp, 0xffffffffffffff80
ret
mov eax, esi
mov ecx, 0x25
nop
call fcn.004533e0
mov eax, edi
mov ecx, 0x25
call fcn.004533e0
nop
call fcn.00450d80
jmp fcn.004add80

Function at 0x4ae320
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4ae448
sub rsp, 0x68
mov qword [rsp + 0x60], rbp
lea rbp, [rsp + 0x60]
movabs rdx, 0x6365f7a463082d07
mov qword [rsp + 0x1b], rdx
movabs rdx, 0x20013b1941f4c674
mov qword [rsp + 0x23], rdx
movabs rdx, 0x637474f2022e6120
mov qword [rsp + 0x2a], rdx
movabs rdx, 0x8cf84711f00f726f
mov qword [rsp + 0x32], rdx
movabs rdx, 0xc0d0904151c1c0b
mov qword [rsp + 0x3a], rdx
movabs rdx, 0x30e1e1c000c0d
mov qword [rsp + 0x40], rdx
movabs rdx, 0x1309150b000c0212
mov qword [rsp + 0x48], rdx
movabs rdx, 0xa031d0e1a01191b
mov qword [rsp + 0x50], rdx
movabs rdx, 0x4121a000a050412
mov qword [rsp + 0x58], rdx
xor eax, eax
jmp 0x4ae3e0
movzx r9d, byte [rsp + rsi + 0x1b]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x49]
mov byte [rsp + rdi + 0x1b], dl
mov byte [rsp + rsi + 0x1b], r8b
add rax, 2
nop dword [rax]
cmp rax, 0x26
jge 0x4ae412
movzx edx, byte [rsp + rax + 0x3a]
movzx esi, byte [rsp + rax + 0x3b]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x1f
jae 0x4ae43b
movzx r8d, byte [rsp + rdi + 0x1b]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x49]
cmp rsi, 0x1f
jb 0x4ae3c3
jmp 0x4ae42f
xor eax, eax
lea rbx, [rsp + 0x1b]
mov ecx, 0x1f
nop
call fcn.00441880
mov rbp, qword [rsp + 0x60]
add rsp, 0x68
ret
mov eax, esi
mov ecx, 0x1f
call fcn.004533e0
mov eax, edi
mov ecx, 0x1f
call fcn.004533e0
nop
call fcn.00450d80
jmp fcn.004ae320
Function at 0x4af1e0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4af2dc
sub rsp, 0x48
mov qword [rsp + 0x40], rbp
lea rbp, [rsp + 0x40]
movabs rdx, 0x7012112c746c006d
mov qword [rsp + 0x2e], rdx
movabs rdx, 0x61207012112c746c
mov qword [rsp + 0x30], rdx
movabs rdx, 0x6650ae04f44484b
mov qword [rsp + 0x38], rdx
movabs rdx, 0xf0611040a0e0d0b
mov qword [rsp + 0x1c], rdx
movabs rdx, 0xf010f0611040a0e
mov qword [rsp + 0x1e], rdx
movabs rdx, 0x6040c0f040a0504
mov qword [rsp + 0x26], rdx
xor eax, eax
jmp 0x4af270
movzx r9d, byte [rsp + rsi + 0x2e]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x1f]
mov byte [rsp + rdi + 0x2e], dl
mov byte [rsp + rsi + 0x2e], r8b
add rax, 2
cmp rax, 0x12
jge 0x4af2a8
movzx edx, byte [rsp + rax + 0x1c]
movzx esi, byte [rsp + rax + 0x1d]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x12
jae 0x4af2cf
movzx r8d, byte [rsp + rdi + 0x2e]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x1f]
nop word [rax + rax]
cmp rsi, 0x12
jb 0x4af256
jmp 0x4af2c3
xor eax, eax
lea rbx, [rsp + 0x2e]
mov ecx, 0x12
call fcn.00441880
mov rbp, qword [rsp + 0x40]
add rsp, 0x48
ret
mov eax, esi
mov ecx, 0x12
call fcn.004533e0
mov eax, edi
mov ecx, 0x12
call fcn.004533e0
nop
nop dword [rax]
call fcn.00450d80
jmp fcn.004af1e0
Function at 0x4afd80
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4afec6
sub rsp, 0x70
mov qword [rsp + 0x68], rbp
lea rbp, [rsp + 0x68]
movabs rdx, 0x6e6bb96f1874656e
mov qword [rsp + 0x1b], rdx
movabs rdx, 0x51ae186e6bb96f18
mov qword [rsp + 0x1e], rdx
movabs rdx, 0x22cbae79cd653a62
mov qword [rsp + 0x26], rdx
movabs rdx, 0x79456f69dfc8ce6f
mov qword [rsp + 0x2e], rdx
movabs rdx, 0xc976cf657cbb6e6f
mov qword [rsp + 0x36], rdx
movabs rdx, 0x13210b1e1d071008
mov qword [rsp + 0x3e], rdx
movabs rdx, 0x12091e120a092120
mov qword [rsp + 0x46], rdx
movabs rdx, 0x31112091e120a09
mov qword [rsp + 0x48], rdx
movabs rdx, 0x1219121305150f1a
mov qword [rsp + 0x50], rdx
movabs rdx, 0x160b0c0b07210e10
mov qword [rsp + 0x58], rdx
movabs rdx, 0x111421121e0c2220
mov qword [rsp + 0x60], rdx
xor eax, eax
nop
jmp 0x4afe60
movzx r9d, byte [rsp + rsi + 0x1b]
sub r9d, edx
lea edx, [r9 - 0x32]
mov byte [rsp + rdi + 0x1b], dl
lea edx, [r8 - 0x32]
mov byte [rsp + rsi + 0x1b], dl
add rax, 2
nop
cmp rax, 0x2a
jge 0x4afe8d
movzx edx, byte [rsp + rax + 0x3e]
movzx esi, byte [rsp + rax + 0x3f]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x23
jae 0x4afeb4
movzx r8d, byte [rsp + rdi + 0x1b]
sub r8d, edx
cmp rsi, 0x23
jb 0x4afe42
jmp 0x4afea8
xor eax, eax
lea rbx, [rsp + 0x1b]
mov ecx, 0x23
call fcn.00441880
mov rbp, qword [rsp + 0x68]
add rsp, 0x70
ret
mov eax, esi
mov ecx, 0x23
call fcn.004533e0
mov eax, edi
mov ecx, 0x23
nop dword [rax + rax]
call fcn.004533e0
nop
call fcn.00450d80
jmp fcn.004afd80

Function at 0x4b2e40
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4b2f48
sub rsp, 0x58
mov qword [rsp + 0x50], rbp
lea rbp, [rsp + 0x50]
movabs rdx, 0x75f9bc0420ad756f
mov qword [rsp + 0x1e], rdx
movabs rdx, 0x72207328b6f7ebe8
mov qword [rsp + 0x26], rdx
movabs rdx, 0xee6563d8f2a873bc
mov qword [rsp + 0x2e], rdx
movabs rdx, 0x813060704170210
mov qword [rsp + 0x36], rdx
movabs rdx, 0x171704050b0c040a
mov qword [rsp + 0x3e], rdx
movabs rdx, 0x712171704050b0c
mov qword [rsp + 0x40], rdx
movabs rdx, 0x130814130b080908
mov qword [rsp + 0x48], rdx
xor eax, eax
jmp 0x4b2ee0
movzx r9d, byte [rsp + rsi + 0x1e]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x5a]
mov byte [rsp + rdi + 0x1e], dl
mov byte [rsp + rsi + 0x1e], r8b
add rax, 2
nop
cmp rax, 0x1a
jge 0x4b2f12
movzx edx, byte [rsp + rax + 0x36]
movzx esi, byte [rsp + rax + 0x37]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x18
jae 0x4b2f3b
movzx r8d, byte [rsp + rdi + 0x1e]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x5a]
cmp rsi, 0x18
jb 0x4b2ec5
jmp 0x4b2f2f
xor eax, eax
lea rbx, [rsp + 0x1e]
mov ecx, 0x18
nop
call fcn.00441880
mov rbp, qword [rsp + 0x50]
add rsp, 0x58
ret
mov eax, esi
mov ecx, 0x18
call fcn.004533e0
mov eax, edi
mov ecx, 0x18
call fcn.004533e0
nop
call fcn.00450d80
jmp fcn.004b2e40
Function at 0x4b3360
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4b34a8
sub rsp, 0x78
mov qword [rsp + 0x70], rbp
lea rbp, [rsp + 0x70]
movabs rdx, 0x1b733032a53438c4
mov qword [rsp + 0x1f], rdx
movabs rdx, 0x65d0e31b733032a5
mov qword [rsp + 0x22], rdx
movabs rdx, 0x1474b72fea14dd08
mov qword [rsp + 0x2a], rdx
movabs rdx, 0x6320247e6ecd100c
mov qword [rsp + 0x32], rdx
movabs rdx, 0xbf28746365c177c9
mov qword [rsp + 0x3a], rdx
movabs rdx, 0x721030822140518
mov qword [rsp + 0x42], rdx
movabs rdx, 0x120b061809020e08
mov qword [rsp + 0x4a], rdx
movabs rdx, 0x1b040c0f01120b
mov qword [rsp + 0x50], rdx
movabs rdx, 0x180c050d091c010f
mov qword [rsp + 0x58], rdx
movabs rdx, 0x171522210b10131d
mov qword [rsp + 0x60], rdx
movabs rdx, 0xc0e0d12051d0707
mov qword [rsp + 0x68], rdx
xor eax, eax
nop
jmp 0x4b3440
movzx r9d, byte [rsp + rsi + 0x1f]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x7c]
mov byte [rsp + rdi + 0x1f], dl
mov byte [rsp + rsi + 0x1f], r8b
add rax, 2
nop dword [rax]
cmp rax, 0x2e
jge 0x4b3472
movzx edx, byte [rsp + rax + 0x42]
movzx esi, byte [rsp + rax + 0x43]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x23
jae 0x4b349b
movzx r8d, byte [rsp + rdi + 0x1f]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x7c]
cmp rsi, 0x23
jb 0x4b3422
jmp 0x4b348f
xor eax, eax
lea rbx, [rsp + 0x1f]
mov ecx, 0x23
nop
call fcn.00441880
mov rbp, qword [rsp + 0x70]
add rsp, 0x78
ret
mov eax, esi
mov ecx, 0x23
call fcn.004533e0
mov eax, edi
mov ecx, 0x23
call fcn.004533e0
nop
call fcn.00450d80
jmp fcn.004b3360