joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4a0720
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4a080c
push rbp
mov rbp, rsp
sub rsp, 0x48
movabs rdx, 0xddfad27078eee4ee
mov qword [rsp + 0x1a], rdx
movabs rdx, 0xf367d22005ecddfa
mov qword [rsp + 0x20], rdx
movabs rdx, 0x70ce667320a26f68
mov qword [rsp + 0x28], rdx
movabs rdx, 0x5130d06090d0c00
mov qword [rsp + 0x30], rdx
movabs rdx, 0x7080b1013021314
mov qword [rsp + 0x38], rdx
movabs rdx, 0x1402060001050b14
mov qword [rsp + 0x40], rdx
xor eax, eax
jmp 0x4a07aa
movzx r9d, byte [rsp + rsi + 0x1a]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x6b]
mov byte [rsp + rdi + 0x1a], dl
mov byte [rsp + rsi + 0x1a], r8b
add rax, 2
cmp rax, 0x18
jge 0x4a07dc
movzx edx, byte [rsp + rax + 0x30]
movzx esi, byte [rsp + rax + 0x31]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x16
jae 0x4a07ff
movzx r8d, byte [rsp + rdi + 0x1a]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x6b]
cmp rsi, 0x16
jb 0x4a0790
jmp 0x4a07f3
xor eax, eax
lea rbx, [rsp + 0x1a]
mov ecx, 0x16
call fcn.0044bb20
add rsp, 0x48
pop rbp
ret
mov eax, esi
mov ecx, 0x16
call fcn.00461020
mov eax, edi
mov ecx, 0x16
call fcn.00461020
nop
call fcn.0045eda0
jmp fcn.004a0720

Function at 0x4a0820
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4a091d
push rbp
mov rbp, rsp
sub rsp, 0x50
movabs rdx, 0x7556474502342270
mov qword [rsp + 0x1a], rdx
movabs rdx, 0x232b0e7320644c52
mov qword [rsp + 0x22], rdx
movabs rdx, 0x7465114155e4e10d
mov qword [rsp + 0x2a], rdx
movabs rdx, 0x1112091415090303
mov qword [rsp + 0x32], rdx
movabs rdx, 0x3100f0e100f0d13
mov qword [rsp + 0x3a], rdx
movabs rdx, 0x1302120201130310
mov qword [rsp + 0x40], rdx
movabs rdx, 0x504011412060813
mov qword [rsp + 0x48], rdx
xor eax, eax
jmp 0x4a08c0
movzx r9d, byte [rsp + rsi + 0x1a]
sub r9d, edx
lea edx, [r9 + 0x45]
mov byte [rsp + rdi + 0x1a], dl
lea edx, [r8 + 0x45]
mov byte [rsp + rsi + 0x1a], dl
add rax, 2
nop dword [rax]
cmp rax, 0x1e
jge 0x4a08ed
movzx edx, byte [rsp + rax + 0x32]
movzx esi, byte [rsp + rax + 0x33]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x18
jae 0x4a0910
movzx r8d, byte [rsp + rdi + 0x1a]
sub r8d, edx
cmp rsi, 0x18
jb 0x4a089f
jmp 0x4a0904
xor eax, eax
lea rbx, [rsp + 0x1a]
mov ecx, 0x18
call fcn.0044bb20
add rsp, 0x50
pop rbp
ret
mov eax, esi
mov ecx, 0x18
call fcn.00461020
mov eax, edi
mov ecx, 0x18
call fcn.00461020
nop
nop dword [rax]
call fcn.0045eda0
jmp fcn.004a0820
Function at 0x4a1bc0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4a1d18
push rbp
mov rbp, rsp
sub rsp, 0x78
movabs rdx, 0x3a5cf609213d6572
mov qword [rsp + 0x19], rdx
movabs rdx, 0xeb6e236574f84d48
mov qword [rsp + 0x21], rdx
movabs rdx, 0x7256405f51eb6e23
mov qword [rsp + 0x26], rdx
movabs rdx, 0x5a76ea69dc3a66e2
mov qword [rsp + 0x2e], rdx
movabs rdx, 0x1f7465f75c2c5f25
mov qword [rsp + 0x36], rdx
movabs rdx, 0x578236f27316429
mov qword [rsp + 0x3e], rdx
movabs rdx, 0x1c112c1c0a162106
mov qword [rsp + 0x46], rdx
movabs rdx, 0x6201c112c1c0a16
mov qword [rsp + 0x48], rdx
movabs rdx, 0x82a12251d18292b
mov qword [rsp + 0x50], rdx
movabs rdx, 0x1f030d1e1a240524
mov qword [rsp + 0x58], rdx
movabs rdx, 0x21f1d1309161c10
mov qword [rsp + 0x60], rdx
movabs rdx, 0x1e050f241a122715
mov qword [rsp + 0x68], rdx
movabs rdx, 0x2803130809240304
mov qword [rsp + 0x70], rdx
xor eax, eax
jmp 0x4a1cb3
movzx r9d, byte [rsp + rsi + 0x19]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x16]
mov byte [rsp + rdi + 0x19], dl
mov byte [rsp + rsi + 0x19], r8b
add rax, 2
cmp rax, 0x32
jge 0x4a1ce8
movzx edx, byte [rsp + rax + 0x46]
movzx esi, byte [rsp + rax + 0x47]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x2d
jae 0x4a1d0b
movzx r8d, byte [rsp + rdi + 0x19]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x16]
nop dword [rax]
cmp rsi, 0x2d
jb 0x4a1c99
jmp 0x4a1cff
xor eax, eax
lea rbx, [rsp + 0x19]
mov ecx, 0x2d
call fcn.0044bb20
add rsp, 0x78
pop rbp
ret
mov eax, esi
mov ecx, 0x2d
call fcn.00461020
mov eax, edi
mov ecx, 0x2d
call fcn.00461020
nop
call fcn.0045eda0
nop dword [rax]
jmp fcn.004a1bc0

Function at 0x4a2b80
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4a2c66
push rbp
mov rbp, rsp
sub rsp, 0x38
movabs rdx, 0x6f72f6fe56b7213b
mov qword [rsp + 0x18], rdx
movabs rdx, 0x3d3c324e0e476f72
mov qword [rsp + 0x1e], rdx
movabs rdx, 0x3040d080203090d
mov qword [rsp + 0x26], rdx
movabs rdx, 0xa0b03040d080203
mov qword [rsp + 0x28], rdx
movabs rdx, 0x5080401080c0a
mov qword [rsp + 0x30], rdx
xor eax, eax
nop
jmp 0x4a2c00
movzx r9d, byte [rsp + rsi + 0x18]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x15]
mov byte [rsp + rdi + 0x18], dl
mov byte [rsp + rsi + 0x18], r8b
add rax, 2
nop dword [rax]
cmp rax, 0x12
jge 0x4a2c32
movzx edx, byte [rsp + rax + 0x26]
movzx esi, byte [rsp + rax + 0x27]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0xe
jae 0x4a2c57
movzx r8d, byte [rsp + rdi + 0x18]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x15]
cmp rsi, 0xe
jb 0x4a2be2
jmp 0x4a2c4b
xor eax, eax
lea rbx, [rsp + 0x18]
mov ecx, 0xe
nop
call fcn.0044bb20
add rsp, 0x38
pop rbp
ret
mov eax, esi
mov ecx, 0xe
call fcn.00461020
mov eax, edi
mov ecx, 0xe
nop
call fcn.00461020
nop
call fcn.0045eda0
jmp fcn.004a2b80
Function at 0x4a3e80
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4a3fc7
push rbp
mov rbp, rsp
sub rsp, 0x70
movabs rdx, 0x3a7463b002e0e700
mov qword [rsp + 0x1c], rdx
movabs rdx, 0x44db3a7463b002e0
mov qword [rsp + 0x1e], rdx
movabs rdx, 0xb58769dc64ef65e0
mov qword [rsp + 0x26], rdx
movabs rdx, 0x38c051751420c56c
mov qword [rsp + 0x2e], rdx
movabs rdx, 0x12648ebc1236c6c9
mov qword [rsp + 0x36], rdx
movabs rdx, 0x21e1b101913150a
mov qword [rsp + 0x3e], rdx
movabs rdx, 0xa17021e1b101913
mov qword [rsp + 0x40], rdx
movabs rdx, 0x131809020a151118
mov qword [rsp + 0x48], rdx
movabs rdx, 0x1c1a18180e1f1c1b
mov qword [rsp + 0x50], rdx
movabs rdx, 0x12171d211b0c1b19
mov qword [rsp + 0x58], rdx
movabs rdx, 0x1b04091203210c08
mov qword [rsp + 0x60], rdx
movabs rdx, 0x103040217000a13
mov qword [rsp + 0x68], rdx
xor eax, eax
jmp 0x4a3f67
movzx r9d, byte [rsp + rsi + 0x1c]
sub r9d, edx
lea edx, [r9 - 0x49]
mov byte [rsp + rdi + 0x1c], dl
lea edx, [r8 - 0x49]
mov byte [rsp + rsi + 0x1c], dl
add rax, 2
cmp rax, 0x32
jge 0x4a3f97
movzx edx, byte [rsp + rax + 0x3e]
movzx esi, byte [rsp + rax + 0x3f]
mov edi, edx
xor edx, esi
add edx, eax
nop dword [rax]
cmp rdi, 0x22
jae 0x4a3fba
movzx r8d, byte [rsp + rdi + 0x1c]
sub r8d, edx
cmp rsi, 0x22
jb 0x4a3f4a
jmp 0x4a3fae
xor eax, eax
lea rbx, [rsp + 0x1c]
mov ecx, 0x22
call fcn.0044bb20
add rsp, 0x70
pop rbp
ret
mov eax, esi
mov ecx, 0x22
call fcn.00461020
mov eax, edi
mov ecx, 0x22
call fcn.00461020
nop
call fcn.0045eda0
jmp fcn.004a3e80

Function at 0x4a3fe0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4a4118
push rbp
mov rbp, rsp
sub rsp, 0x70
movabs rdx, 0x4a3c4d656d667005
mov qword [rsp + 0x1b], rdx
movabs rdx, 0x786d7510204a3c4d
mov qword [rsp + 0x20], rdx
movabs rdx, 0x2066a2b864265b59
mov qword [rsp + 0x28], rdx
movabs rdx, 0x2e727273286da79b
mov qword [rsp + 0x30], rdx
movabs rdx, 0x4a8d83647d76c163
mov qword [rsp + 0x38], rdx
movabs rdx, 0x12406050e1c1809
mov qword [rsp + 0x40], rdx
movabs rdx, 0x162121070c01000d
mov qword [rsp + 0x48], rdx
movabs rdx, 0x2303160f07160d11
mov qword [rsp + 0x50], rdx
movabs rdx, 0x1e1703201a171e21
mov qword [rsp + 0x58], rdx
movabs rdx, 0x2409211215220d22
mov qword [rsp + 0x60], rdx
movabs rdx, 0xe0c161f011e0d0c
mov qword [rsp + 0x68], rdx
xor eax, eax
jmp 0x4a40b8
movzx r9d, byte [rsp + rsi + 0x1b]
sub r9d, edx
lea edx, [r9 + 0x2e]
mov byte [rsp + rdi + 0x1b], dl
lea edx, [r8 + 0x2e]
mov byte [rsp + rsi + 0x1b], dl
add rax, 2
cmp rax, 0x30
jge 0x4a40e8
movzx edx, byte [rsp + rax + 0x40]
movzx esi, byte [rsp + rax + 0x41]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x25
jae 0x4a410b
movzx r8d, byte [rsp + rdi + 0x1b]
sub r8d, edx
nop dword [rax]
cmp rsi, 0x25
jb 0x4a409b
jmp 0x4a40ff
xor eax, eax
lea rbx, [rsp + 0x1b]
mov ecx, 0x25
call fcn.0044bb20
add rsp, 0x70
pop rbp
ret
mov eax, esi
mov ecx, 0x25
call fcn.00461020
mov eax, edi
mov ecx, 0x25
call fcn.00461020
nop
call fcn.0045eda0
nop dword [rax]
jmp fcn.004a3fe0
Function at 0x4a4140
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4a425a
push rbp
mov rbp, rsp
sub rsp, 0x60
movabs rdx, 0x3ac192b3b1146526
mov qword [rsp + 0x1b], rdx
movabs rdx, 0x2066ed206e084cf9
mov qword [rsp + 0x23], rdx
movabs rdx, 0xfa151ef66e4b3420
mov qword [rsp + 0x2a], rdx
movabs rdx, 0x206509bdcda7a8fb
mov qword [rsp + 0x32], rdx
movabs rdx, 0x1a19111814081106
mov qword [rsp + 0x3a], rdx
movabs rdx, 0x600101510041a19
mov qword [rsp + 0x40], rdx
movabs rdx, 0x1c050002170d1304
mov qword [rsp + 0x48], rdx
movabs rdx, 0xa0508031c08060a
mov qword [rsp + 0x50], rdx
movabs rdx, 0xa031c16111a131b
mov qword [rsp + 0x58], rdx
xor eax, eax
jmp 0x4a41f7
movzx r9d, byte [rsp + rsi + 0x1b]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x4a]
mov byte [rsp + rdi + 0x1b], dl
mov byte [rsp + rsi + 0x1b], r8b
add rax, 2
cmp rax, 0x26
jge 0x4a4229
movzx edx, byte [rsp + rax + 0x3a]
movzx esi, byte [rsp + rax + 0x3b]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x1f
jae 0x4a424d
movzx r8d, byte [rsp + rdi + 0x1b]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x4a]
cmp rsi, 0x1f
jb 0x4a41dd
jmp 0x4a4241
xor eax, eax
lea rbx, [rsp + 0x1b]
mov ecx, 0x1f
call fcn.0044bb20
add rsp, 0x60
pop rbp
nop
ret
mov eax, esi
mov ecx, 0x1f
call fcn.00461020
mov eax, edi
mov ecx, 0x1f
call fcn.00461020
nop
call fcn.0045eda0
nop
jmp fcn.004a4140

Function at 0x4a4280
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4a43a7
push rbp
mov rbp, rsp
sub rsp, 0x68
movabs rdx, 0x3a35636576b4656e
mov qword [rsp + 0x1e], rdx
movabs rdx, 0x46203a35636576b4
mov qword [rsp + 0x20], rdx
movabs rdx, 0x20663d200df5f62f
mov qword [rsp + 0x28], rdx
movabs rdx, 0xe4eb1d393ba46f3b
mov qword [rsp + 0x30], rdx
movabs rdx, 0x52b17079d72e1de3
mov qword [rsp + 0x38], rdx
movabs rdx, 0x201500031b17141d
mov qword [rsp + 0x40], rdx
movabs rdx, 0xc21151a21191c03
mov qword [rsp + 0x48], rdx
movabs rdx, 0xf161a0b1c210c18
mov qword [rsp + 0x50], rdx
movabs rdx, 0x1d0014020d1d1206
mov qword [rsp + 0x58], rdx
movabs rdx, 0xd1a141c0c0a1a1d
mov qword [rsp + 0x60], rdx
xor eax, eax
jmp 0x4a4349
movzx r9d, byte [rsp + rsi + 0x1e]
sub r9d, edx
lea edx, [r9 + 0x65]
mov byte [rsp + rdi + 0x1e], dl
lea edx, [r8 + 0x65]
mov byte [rsp + rsi + 0x1e], dl
add rax, 2
cmp rax, 0x28
jge 0x4a4377
movzx edx, byte [rsp + rax + 0x40]
movzx esi, byte [rsp + rax + 0x41]
mov edi, edx
xor edx, esi
add edx, eax
nop
cmp rdi, 0x22
jae 0x4a439a
movzx r8d, byte [rsp + rdi + 0x1e]
sub r8d, edx
cmp rsi, 0x22
jb 0x4a432c
jmp 0x4a438e
xor eax, eax
lea rbx, [rsp + 0x1e]
mov ecx, 0x22
call fcn.0044bb20
add rsp, 0x68
pop rbp
ret
mov eax, esi
mov ecx, 0x22
call fcn.00461020
mov eax, edi
mov ecx, 0x22
call fcn.00461020
nop
call fcn.0045eda0
jmp fcn.004a4280
Function at 0x4a43c0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
lea r12, [rsp - 0x20]
cmp r12, qword [r14 + 0x10]
jbe 0x4a455b
push rbp
mov rbp, rsp
sub rsp, 0x98
movabs rdx, 0x5d386365778165ad
mov qword [rsp + 0x1f], rdx
movabs rdx, 0x4ab3658243974a5d
mov qword [rsp + 0x26], rdx
movabs rdx, 0x89356d89758b6cf8
mov qword [rsp + 0x2e], rdx
movabs rdx, 0x96585a763c42203a
mov qword [rsp + 0x36], rdx
movabs rdx, 0x6699206573732064
mov qword [rsp + 0x3e], rdx
movabs rdx, 0x74654d056b611373
mov qword [rsp + 0x46], rdx
movabs rdx, 0x611c4c616f647a4c
mov qword [rsp + 0x4e], rdx
movabs rdx, 0x902280a1d1a0232
mov qword [rsp + 0x56], rdx
movabs rdx, 0x1e0d0902280a1d1a
mov qword [rsp + 0x58], rdx
movabs rdx, 0x191114300b1e3221
mov qword [rsp + 0x60], rdx
movabs rdx, 0xd340700002125
mov qword [rsp + 0x68], rdx
movabs rdx, 0x3031613300a2706
mov qword [rsp + 0x70], rdx
movabs rdx, 0x15352503121c1d12
mov qword [rsp + 0x78], rdx
movabs rdx, 0x71a2f030a0b0e35
mov qword [rsp + 0x80], rdx
movabs rdx, 0x281c09120930082b
mov qword [rsp + 0x88], rdx
movabs rdx, 0x2815363602000f27
mov qword [rsp + 0x90], rdx
xor eax, eax
jmp 0x4a44f1
movzx r9d, byte [rsp + rsi + 0x1f]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x3a]
mov byte [rsp + rdi + 0x1f], dl
mov byte [rsp + rsi + 0x1f], r8b
add rax, 2
cmp rax, 0x42
jge 0x4a4528
movzx edx, byte [rsp + rax + 0x56]
movzx esi, byte [rsp + rax + 0x57]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x37
jae 0x4a454e
movzx r8d, byte [rsp + rdi + 0x1f]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x3a]
nop dword [rax + rax]
cmp rsi, 0x37
jb 0x4a44d7
jmp 0x4a4542
xor eax, eax
lea rbx, [rsp + 0x1f]
mov ecx, 0x37
call fcn.0044bb20
add rsp, 0x98
pop rbp
ret
mov eax, esi
mov ecx, 0x37
call fcn.00461020
mov eax, edi
mov ecx, 0x37
call fcn.00461020
nop
nop dword [rax + rax]
call fcn.0045eda0
jmp fcn.004a43c0

Function at 0x4a4880
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4a496c
push rbp
mov rbp, rsp
sub rsp, 0x48
movabs rdx, 0x7741dd375e2252a
mov qword [rsp + 0x1e], rdx
movabs rdx, 0xac2e07741dd375e2
mov qword [rsp + 0x20], rdx
movabs rdx, 0xaa1411542a901c30
mov qword [rsp + 0x28], rdx
movabs rdx, 0x110f030d09080311
mov qword [rsp + 0x30], rdx
movabs rdx, 0x1020c020b040a00
mov qword [rsp + 0x38], rdx
movabs rdx, 0x100f01050c0b0708
mov qword [rsp + 0x40], rdx
xor eax, eax
jmp 0x4a490a
movzx r9d, byte [rsp + rsi + 0x1e]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x30]
mov byte [rsp + rdi + 0x1e], dl
mov byte [rsp + rsi + 0x1e], r8b
add rax, 2
cmp rax, 0x18
jge 0x4a493c
movzx edx, byte [rsp + rax + 0x30]
movzx esi, byte [rsp + rax + 0x31]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x12
jae 0x4a495f
movzx r8d, byte [rsp + rdi + 0x1e]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x30]
cmp rsi, 0x12
jb 0x4a48f0
jmp 0x4a4953
xor eax, eax
lea rbx, [rsp + 0x1e]
mov ecx, 0x12
call fcn.0044bb20
add rsp, 0x48
pop rbp
ret
mov eax, esi
mov ecx, 0x12
call fcn.00461020
mov eax, edi
mov ecx, 0x12
call fcn.00461020
nop
call fcn.0045eda0
jmp fcn.004a4880
Function at 0x4a5100
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4a51e6
push rbp
mov rbp, rsp
sub rsp, 0x40
movabs rdx, 0x6426ec9c76cb693c
mov qword [rsp + 0x1f], rdx
movabs rdx, 0x26dfdb228acc3064
mov qword [rsp + 0x26], rdx
movabs rdx, 0xb0d060e06040a0e
mov qword [rsp + 0x2e], rdx
movabs rdx, 0x9060b0d060e0604
mov qword [rsp + 0x30], rdx
movabs rdx, 0x50e060b0b020c08
mov qword [rsp + 0x38], rdx
xor eax, eax
nop
jmp 0x4a5180
movzx r9d, byte [rsp + rsi + 0x1f]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x37]
mov byte [rsp + rdi + 0x1f], dl
mov byte [rsp + rsi + 0x1f], r8b
add rax, 2
nop dword [rax]
cmp rax, 0x12
jge 0x4a51b2
movzx edx, byte [rsp + rax + 0x2e]
movzx esi, byte [rsp + rax + 0x2f]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0xf
jae 0x4a51d7
movzx r8d, byte [rsp + rdi + 0x1f]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x37]
cmp rsi, 0xf
jb 0x4a5162
jmp 0x4a51cb
xor eax, eax
lea rbx, [rsp + 0x1f]
mov ecx, 0xf
nop
call fcn.0044bb20
add rsp, 0x40
pop rbp
ret
mov eax, esi
mov ecx, 0xf
call fcn.00461020
mov eax, edi
mov ecx, 0xf
nop
call fcn.00461020
nop
call fcn.0045eda0
jmp fcn.004a5100

Function at 0x4a6b00
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4a6bec
push rbp
mov rbp, rsp
sub rsp, 0x48
movabs rdx, 0xd619cc08262ced11
mov qword [rsp + 0x1d], rdx
movabs rdx, 0x65e96c3cecd619cc
mov qword [rsp + 0x22], rdx
movabs rdx, 0xcad569551965ea14
mov qword [rsp + 0x2a], rdx
movabs rdx, 0xe071413090b1301
mov qword [rsp + 0x32], rdx
movabs rdx, 0x40e03020d080e07
mov qword [rsp + 0x38], rdx
movabs rdx, 0x1301090010060501
mov qword [rsp + 0x40], rdx
xor eax, eax
jmp 0x4a6b8a
movzx r9d, byte [rsp + rsi + 0x1d]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x35]
mov byte [rsp + rdi + 0x1d], dl
mov byte [rsp + rsi + 0x1d], r8b
add rax, 2
cmp rax, 0x16
jge 0x4a6bbc
movzx edx, byte [rsp + rax + 0x32]
movzx esi, byte [rsp + rax + 0x33]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x15
jae 0x4a6bdf
movzx r8d, byte [rsp + rdi + 0x1d]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x35]
cmp rsi, 0x15
jb 0x4a6b70
jmp 0x4a6bd3
xor eax, eax
lea rbx, [rsp + 0x1d]
mov ecx, 0x15
call fcn.0044bb20
add rsp, 0x48
pop rbp
ret
mov eax, esi
mov ecx, 0x15
call fcn.00461020
mov eax, edi
mov ecx, 0x15
call fcn.00461020
nop
call fcn.0045eda0
jmp fcn.004a6b00
Function at 0x4a9fe0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4aa0cc
push rbp
mov rbp, rsp
sub rsp, 0x40
movabs rdx, 0x2e746365bb847372
mov qword [rsp + 0x1b], rdx
movabs rdx, 0x722e746365bb8473
mov qword [rsp + 0x1c], rdx
movabs rdx, 0x5b787b9964636c89
mov qword [rsp + 0x24], rdx
movabs rdx, 0x90e0d0203090e0d
mov qword [rsp + 0x2c], rdx
movabs rdx, 0xd010e0b090e0d02
mov qword [rsp + 0x30], rdx
movabs rdx, 0x100c0d080208030f
mov qword [rsp + 0x38], rdx
xor eax, eax
jmp 0x4aa06a
movzx r9d, byte [rsp + rsi + 0x1b]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x24]
mov byte [rsp + rdi + 0x1b], dl
mov byte [rsp + rsi + 0x1b], r8b
add rax, 2
cmp rax, 0x14
jge 0x4aa09c
movzx edx, byte [rsp + rax + 0x2c]
movzx esi, byte [rsp + rax + 0x2d]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x11
jae 0x4aa0bf
movzx r8d, byte [rsp + rdi + 0x1b]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x24]
cmp rsi, 0x11
jb 0x4aa050
jmp 0x4aa0b3
xor eax, eax
lea rbx, [rsp + 0x1b]
mov ecx, 0x11
call fcn.0044bb20
add rsp, 0x40
pop rbp
ret
mov eax, esi
mov ecx, 0x11
call fcn.00461020
mov eax, edi
mov ecx, 0x11
call fcn.00461020
nop
call fcn.0045eda0
jmp fcn.004a9fe0

Function at 0x4aab00
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4aac2c
push rbp
mov rbp, rsp
sub rsp, 0x60
movabs rdx, 0x287463ac1f66f632
mov qword [rsp + 0x19], rdx
movabs rdx, 0x20287463ac1f66f6
mov qword [rsp + 0x1a], rdx
movabs rdx, 0xa56978a9e67272c3
mov qword [rsp + 0x22], rdx
movabs rdx, 0x93747e6fae783b64
mov qword [rsp + 0x2a], rdx
movabs rdx, 0x9b85dbbfbdfdb86f
mov qword [rsp + 0x32], rdx
movabs rdx, 0x30018120e1f0718
mov qword [rsp + 0x3a], rdx
movabs rdx, 0x16180c0d1c030300
mov qword [rsp + 0x40], rdx
movabs rdx, 0x1e011b001f001e1f
mov qword [rsp + 0x48], rdx
movabs rdx, 0x20161a1d1b160c1e
mov qword [rsp + 0x50], rdx
movabs rdx, 0x10041a14041e0009
mov qword [rsp + 0x58], rdx
xor eax, eax
jmp 0x4aabc6
movzx r9d, byte [rsp + rsi + 0x19]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x78]
mov byte [rsp + rdi + 0x19], dl
mov byte [rsp + rsi + 0x19], r8b
add rax, 2
cmp rax, 0x26
jge 0x4aabfc
movzx edx, byte [rsp + rax + 0x3a]
movzx esi, byte [rsp + rax + 0x3b]
mov edi, edx
xor edx, esi
add edx, eax
nop dword [rax]
cmp rdi, 0x21
jae 0x4aac1f
movzx r8d, byte [rsp + rdi + 0x19]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x78]
cmp rsi, 0x21
jb 0x4aabac
jmp 0x4aac13
xor eax, eax
lea rbx, [rsp + 0x19]
mov ecx, 0x21
call fcn.0044bb20
add rsp, 0x60
pop rbp
ret
mov eax, esi
mov ecx, 0x21
call fcn.00461020
mov eax, edi
mov ecx, 0x21
call fcn.00461020
nop
call fcn.0045eda0
jmp fcn.004aab00
Function at 0x4ac6e0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4ac80c
push rbp
mov rbp, rsp
sub rsp, 0x60
movabs rdx, 0x825f53625f0c2a6a
mov qword [rsp + 0x1a], rdx
movabs rdx, 0x545f5c725e436f6e
mov qword [rsp + 0x22], rdx
movabs rdx, 0x52742669545f5c72
mov qword [rsp + 0x26], rdx
movabs rdx, 0x546c650b076c7680
mov qword [rsp + 0x2e], rdx
movabs rdx, 0x1414110413160f13
mov qword [rsp + 0x36], rdx
movabs rdx, 0x70e180000101405
mov qword [rsp + 0x3e], rdx
movabs rdx, 0xf0e070e18000010
mov qword [rsp + 0x40], rdx
movabs rdx, 0xb010a1116160317
mov qword [rsp + 0x48], rdx
movabs rdx, 0x1403060e070d130e
mov qword [rsp + 0x50], rdx
movabs rdx, 0x70d0d1b110213
mov qword [rsp + 0x58], rdx
xor eax, eax
jmp 0x4ac7a6
movzx r9d, byte [rsp + rsi + 0x1a]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x1f]
mov byte [rsp + rdi + 0x1a], dl
mov byte [rsp + rsi + 0x1a], r8b
add rax, 2
cmp rax, 0x2a
jge 0x4ac7dc
movzx edx, byte [rsp + rax + 0x36]
movzx esi, byte [rsp + rax + 0x37]
mov edi, edx
xor edx, esi
add edx, eax
nop dword [rax]
cmp rdi, 0x1c
jae 0x4ac7ff
movzx r8d, byte [rsp + rdi + 0x1a]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x1f]
cmp rsi, 0x1c
jb 0x4ac78c
jmp 0x4ac7f3
xor eax, eax
lea rbx, [rsp + 0x1a]
mov ecx, 0x1c
call fcn.0044bb20
add rsp, 0x60
pop rbp
ret
mov eax, esi
mov ecx, 0x1c
call fcn.00461020
mov eax, edi
mov ecx, 0x1c
call fcn.00461020
nop
call fcn.0045eda0
jmp fcn.004ac6e0

Function at 0x4ac820
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4ac90a
push rbp
mov rbp, rsp
sub rsp, 0x48
movabs rdx, 0x2e74465a572c3872
mov qword [rsp + 0x1e], rdx
movabs rdx, 0xb442e74465a572c
mov qword [rsp + 0x20], rdx
movabs rdx, 0x644b6c4d174f756c
mov qword [rsp + 0x28], rdx
movabs rdx, 0x30901100e02090d
mov qword [rsp + 0x30], rdx
movabs rdx, 0x100111080c051003
mov qword [rsp + 0x38], rdx
movabs rdx, 0x3080c0403090911
mov qword [rsp + 0x40], rdx
xor eax, eax
jmp 0x4ac8ad
movzx r9d, byte [rsp + rsi + 0x1e]
sub r9d, edx
lea edx, [r9 + 0x27]
mov byte [rsp + rdi + 0x1e], dl
lea edx, [r8 + 0x27]
mov byte [rsp + rsi + 0x1e], dl
add rax, 2
cmp rax, 0x18
jge 0x4ac8da
movzx edx, byte [rsp + rax + 0x30]
movzx esi, byte [rsp + rax + 0x31]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x12
jae 0x4ac8fd
movzx r8d, byte [rsp + rdi + 0x1e]
sub r8d, edx
cmp rsi, 0x12
jb 0x4ac890
jmp 0x4ac8f1
xor eax, eax
lea rbx, [rsp + 0x1e]
mov ecx, 0x12
call fcn.0044bb20
add rsp, 0x48
pop rbp
ret
mov eax, esi
mov ecx, 0x12
call fcn.00461020
mov eax, edi
mov ecx, 0x12
call fcn.00461020
nop
call fcn.0045eda0
jmp fcn.004ac820
Function at 0x4ad720
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4ad80a
push rbp
mov rbp, rsp
sub rsp, 0x48
movabs rdx, 0x2e2205a027b53a0c
mov qword [rsp + 0x1f], rdx
movabs rdx, 0xee61842e2205a027
mov qword [rsp + 0x22], rdx
movabs rdx, 0x2cde7479c72e16d7
mov qword [rsp + 0x2a], rdx
movabs rdx, 0x40000020805060b
mov qword [rsp + 0x32], rdx
movabs rdx, 0x11050c0a0e0400
mov qword [rsp + 0x38], rdx
movabs rdx, 0x11203000a0c0611
mov qword [rsp + 0x40], rdx
xor eax, eax
jmp 0x4ad7ad
movzx r9d, byte [rsp + rsi + 0x1f]
sub r9d, edx
lea edx, [r9 + 0x60]
mov byte [rsp + rdi + 0x1f], dl
lea edx, [r8 + 0x60]
mov byte [rsp + rsi + 0x1f], dl
add rax, 2
cmp rax, 0x16
jge 0x4ad7da
movzx edx, byte [rsp + rax + 0x32]
movzx esi, byte [rsp + rax + 0x33]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x13
jae 0x4ad7fd
movzx r8d, byte [rsp + rdi + 0x1f]
sub r8d, edx
cmp rsi, 0x13
jb 0x4ad790
jmp 0x4ad7f1
xor eax, eax
lea rbx, [rsp + 0x1f]
mov ecx, 0x13
call fcn.0044bb20
add rsp, 0x48
pop rbp
ret
mov eax, esi
mov ecx, 0x13
call fcn.00461020
mov eax, edi
mov ecx, 0x13
call fcn.00461020
nop
call fcn.0045eda0
jmp fcn.004ad720

Function at 0x4b33a0
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4b346a
push rbp
mov rbp, rsp
sub rsp, 0x48
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x58], rax
mov qword [rsp], rax
mov qword [rsp + 8], rbx
mov byte [rsp + 0x10], 0
call fcn.004030e0
xorps xmm15, xmm15
mov r14, qword [0x00842ac0]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x18], 0xffffffffffffffff
jne 0x4b344f
mov rcx, qword [rsp + 0x60]
lea rdx, [rcx + 1]
mov qword [rsp + 0x40], rdx
lea rax, [0x005c6280]
xor ebx, ebx
mov rcx, rdx
call fcn.00447980
mov rbx, qword [rsp + 0x60]
mov rcx, rax
xor edi, edi
mov rsi, qword [rsp + 0x40]
mov rax, qword [rsp + 0x58]
nop dword [rax]
call fcn.004b5200
inc rbx
cmp rcx, rbx
jae 0x4b343e
mov edi, 1
lea rsi, [0x005c6280]
call fcn.00447a60
mov word [rax + rbx*2 - 2], 0
xor edi, edi
xor esi, esi
add rsp, 0x48
pop rbp
ret
xor eax, eax
xor ebx, ebx
mov rcx, rbx
lea rdi, [0x006d5548]
lea rsi, [0x006d51d8]
add rsp, 0x48
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.0045eda0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.004b33a0