joyce8/EMBER2024-capa huggingface dataset:
Function at 0x494020
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x49410a
push rbp
mov rbp, rsp
sub rsp, 0x48
movabs rdx, 0x5162894475386576
mov qword [rsp + 0x33], rdx
movabs rdx, 0x79726f7486516289
mov qword [rsp + 0x38], rdx
movabs rdx, 0x6c756571ab615543
mov qword [rsp + 0x40], rdx
movabs rdx, 0x140307000e060207
mov qword [rsp + 0x1d], rdx
movabs rdx, 0x1406110814131403
mov qword [rsp + 0x23], rdx
movabs rdx, 0x110e11070710050e
mov qword [rsp + 0x2b], rdx
xor eax, eax
jmp 0x4940ad
movzx r9d, byte [rsp + rsi + 0x33]
sub r9d, edx
lea edx, [r9 + 0x15]
mov byte [rsp + rdi + 0x33], dl
lea edx, [r8 + 0x15]
mov byte [rsp + rsi + 0x33], dl
add rax, 2
cmp rax, 0x16
jge 0x4940da
movzx edx, byte [rsp + rax + 0x1d]
movzx esi, byte [rsp + rax + 0x1e]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x15
jae 0x4940fd
movzx r8d, byte [rsp + rdi + 0x33]
sub r8d, edx
cmp rsi, 0x15
jb 0x494090
jmp 0x4940f1
xor eax, eax
lea rbx, [rsp + 0x33]
mov ecx, 0x15
call fcn.00440dc0
add rsp, 0x48
pop rbp
ret
mov eax, esi
mov ecx, 0x15
call fcn.00451500
mov eax, edi
mov ecx, 0x15
call fcn.00451500
nop
call fcn.0044f280
jmp fcn.00494020

Function at 0x496240
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x49631d
push rbp
mov rbp, rsp
sub rsp, 0x38
movabs rdx, 0xac16faaf09baa453
mov qword [rsp + 0x2a], rdx
movabs rdx, 0xbab7b86e0433ac16
mov qword [rsp + 0x30], rdx
movabs rdx, 0xc0806090b0d0507
mov qword [rsp + 0x18], rdx
movabs rdx, 0x9020c0806090b0d
mov qword [rsp + 0x1a], rdx
movabs rdx, 0x10707030c070604
mov qword [rsp + 0x22], rdx
xor eax, eax
nop
jmp 0x4962c0
movzx r9d, byte [rsp + rsi + 0x2a]
sub r9d, edx
lea edx, [r9 - 0x3e]
mov byte [rsp + rdi + 0x2a], dl
lea edx, [r8 - 0x3e]
mov byte [rsp + rsi + 0x2a], dl
add rax, 2
nop
cmp rax, 0x12
jge 0x4962ed
movzx edx, byte [rsp + rax + 0x18]
movzx esi, byte [rsp + rax + 0x19]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0xe
jae 0x496310
movzx r8d, byte [rsp + rdi + 0x2a]
sub r8d, edx
cmp rsi, 0xe
jb 0x4962a2
jmp 0x496304
xor eax, eax
lea rbx, [rsp + 0x2a]
mov ecx, 0xe
call fcn.00440dc0
add rsp, 0x38
pop rbp
ret
mov eax, esi
mov ecx, 0xe
call fcn.00451500
mov eax, edi
mov ecx, 0xe
call fcn.00451500
nop
nop dword [rax]
call fcn.0044f280
jmp fcn.00496240
Function at 0x4972e0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4973ec
push rbp
mov rbp, rsp
sub rsp, 0x50
movabs rdx, 0x8b7b846844789089
mov qword [rsp + 0x37], rdx
movabs rdx, 0x646a686467896673
mov qword [rsp + 0x3f], rdx
movabs rdx, 0x6e646a6864678966
mov qword [rsp + 0x40], rdx
movabs rdx, 0x65746c62695b6c74
mov qword [rsp + 0x48], rdx
movabs rdx, 0x130a060e0a01100d
mov qword [rsp + 0x19], rdx
movabs rdx, 0x512090013080700
mov qword [rsp + 0x21], rdx
movabs rdx, 0x1612160c03100512
mov qword [rsp + 0x27], rdx
movabs rdx, 0x402120b05120503
mov qword [rsp + 0x2f], rdx
xor eax, eax
jmp 0x497388
movzx r9d, byte [rsp + rsi + 0x37]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x26]
mov byte [rsp + rdi + 0x37], dl
mov byte [rsp + rsi + 0x37], r8b
add rax, 2
cmp rax, 0x1e
jge 0x4973bc
movzx edx, byte [rsp + rax + 0x19]
movzx esi, byte [rsp + rax + 0x1a]
mov edi, edx
xor edx, esi
add edx, eax
nop
cmp rdi, 0x19
jae 0x4973df
movzx r8d, byte [rsp + rdi + 0x37]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x26]
cmp rsi, 0x19
jb 0x49736e
jmp 0x4973d3
xor eax, eax
lea rbx, [rsp + 0x37]
mov ecx, 0x19
call fcn.00440dc0
add rsp, 0x50
pop rbp
ret
mov eax, esi
mov ecx, 0x19
call fcn.00451500
mov eax, edi
mov ecx, 0x19
call fcn.00451500
nop
call fcn.0044f280
jmp fcn.004972e0

Function at 0x497ba0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x497c5d
push rbp
mov rbp, rsp
sub rsp, 0x30
movabs rdx, 0x64515a65425f7233
mov qword [rsp + 0x27], rdx
mov byte [rsp + 0x2f], 0x63
movabs rdx, 0x5020807020703
mov qword [rsp + 0x1b], rdx
mov dword [rsp + 0x23], 0x5050006
xor eax, eax
nop
jmp 0x497c00
movzx r9d, byte [rsp + rsi + 0x27]
sub r9d, edx
lea edx, [r9 + 0x14]
mov byte [rsp + rdi + 0x27], dl
lea edx, [r8 + 0x14]
mov byte [rsp + rsi + 0x27], dl
add rax, 2
nop
cmp rax, 0xc
jge 0x497c2d
movzx edx, byte [rsp + rax + 0x1b]
movzx esi, byte [rsp + rax + 0x1c]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 9
jae 0x497c50
movzx r8d, byte [rsp + rdi + 0x27]
sub r8d, edx
cmp rsi, 9
jb 0x497be2
jmp 0x497c44
xor eax, eax
lea rbx, [rsp + 0x27]
mov ecx, 9
call fcn.00440dc0
add rsp, 0x30
pop rbp
ret
mov eax, esi
mov ecx, 9
call fcn.00451500
mov eax, edi
mov ecx, 9
call fcn.00451500
nop
nop dword [rax]
call fcn.0044f280
jmp fcn.00497ba0
Function at 0x4983c0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x498487
push rbp
mov rbp, rsp
sub rsp, 0x38
movabs rdx, 0x1e426d1941443947
mov qword [rsp + 0x2c], rdx
mov dword [rsp + 0x34], 0x65d969db
movabs rdx, 0x702070804020106
mov qword [rsp + 0x1c], rdx
movabs rdx, 0x208020003030a00
mov qword [rsp + 0x24], rdx
xor eax, eax
jmp 0x498428
movzx r9d, byte [rsp + rsi + 0x2c]
sub r9d, edx
lea edx, [r9 + 0x37]
mov byte [rsp + rdi + 0x2c], dl
lea edx, [r8 + 0x37]
mov byte [rsp + rsi + 0x2c], dl
add rax, 2
cmp rax, 0x10
jge 0x498457
movzx edx, byte [rsp + rax + 0x1c]
movzx esi, byte [rsp + rax + 0x1d]
mov edi, edx
xor edx, esi
add edx, eax
nop
cmp rdi, 0xc
jae 0x49847a
movzx r8d, byte [rsp + rdi + 0x2c]
sub r8d, edx
cmp rsi, 0xc
jb 0x49840b
jmp 0x49846e
xor eax, eax
lea rbx, [rsp + 0x2c]
mov ecx, 0xc
call fcn.00440dc0
add rsp, 0x38
pop rbp
ret
mov eax, esi
mov ecx, 0xc
call fcn.00451500
mov eax, edi
mov ecx, 0xc
call fcn.00451500
nop
call fcn.0044f280
jmp fcn.004983c0

Function at 0x4992e0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4993db
push rbp
mov rbp, rsp
sub rsp, 0x48
movabs rdx, 0xde64ce7936476f82
mov qword [rsp + 0x36], rdx
movabs rdx, 0xcdd1de64ce793647
mov qword [rsp + 0x38], rdx
movabs rdx, 0x9f8867cdccb222dd
mov qword [rsp + 0x40], rdx
movabs rdx, 0xc1102030804000b
mov qword [rsp + 0x1c], rdx
movabs rdx, 0x910030a0a0c0702
mov qword [rsp + 0x24], rdx
movabs rdx, 0xb080910030a0a0c
mov qword [rsp + 0x26], rdx
movabs rdx, 0xb00080d0e050509
mov qword [rsp + 0x2e], rdx
xor eax, eax
jmp 0x499379
movzx r9d, byte [rsp + rsi + 0x36]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x7e]
mov byte [rsp + rdi + 0x36], dl
mov byte [rsp + rsi + 0x36], r8b
add rax, 2
cmp rax, 0x1a
jge 0x4993ab
movzx edx, byte [rsp + rax + 0x1c]
movzx esi, byte [rsp + rax + 0x1d]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x12
jae 0x4993ce
movzx r8d, byte [rsp + rdi + 0x36]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x7e]
cmp rsi, 0x12
jb 0x49935f
jmp 0x4993c2
xor eax, eax
lea rbx, [rsp + 0x36]
mov ecx, 0x12
call fcn.00440dc0
add rsp, 0x48
pop rbp
ret
mov eax, esi
mov ecx, 0x12
call fcn.00451500
mov eax, edi
mov ecx, 0x12
call fcn.00451500
nop
nop dword [rax + rax]
call fcn.0044f280
jmp fcn.004992e0
Function at 0x49a4c0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x49a58c
push rbp
mov rbp, rsp
sub rsp, 0x38
movabs rdx, 0x938e739d8d8665b1
mov qword [rsp + 0x2b], rdx
movabs rdx, 0xbbdda19479938e73
mov qword [rsp + 0x30], rdx
movabs rdx, 0x60a0c0b00020b00
mov qword [rsp + 0x1d], rdx
movabs rdx, 0x7030b090204060a
mov qword [rsp + 0x23], rdx
xor eax, eax
jmp 0x49a52f
movzx r9d, byte [rsp + rsi + 0x2b]
sub r9d, edx
lea edx, [r9 - 0x1b]
mov byte [rsp + rdi + 0x2b], dl
lea edx, [r8 - 0x1b]
mov byte [rsp + rsi + 0x2b], dl
add rax, 2
cmp rax, 0xe
jge 0x49a55c
movzx edx, byte [rsp + rax + 0x1d]
movzx esi, byte [rsp + rax + 0x1e]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0xd
jae 0x49a57f
movzx r8d, byte [rsp + rdi + 0x2b]
sub r8d, edx
cmp rsi, 0xd
jb 0x49a512
jmp 0x49a573
xor eax, eax
lea rbx, [rsp + 0x2b]
mov ecx, 0xd
call fcn.00440dc0
add rsp, 0x38
pop rbp
ret
mov eax, esi
mov ecx, 0xd
call fcn.00451500
mov eax, edi
mov ecx, 0xd
call fcn.00451500
nop
call fcn.0044f280
jmp fcn.0049a4c0

Function at 0x49b500
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x49b5b8
push rbp
mov rbp, rsp
sub rsp, 0x30
movabs rdx, 0x2088cf6483cf6873
mov qword [rsp + 0x28], rdx
movabs rdx, 0x502070306050307
mov qword [rsp + 0x1e], rdx
mov word [rsp + 0x26], 0x203
xor eax, eax
jmp 0x49b558
movzx r9d, byte [rsp + rsi + 0x28]
sub r9d, edx
lea edx, [r9 - 0x53]
mov byte [rsp + rdi + 0x28], dl
lea edx, [r8 - 0x53]
mov byte [rsp + rsi + 0x28], dl
add rax, 2
cmp rax, 0xa
jge 0x49b588
movzx edx, byte [rsp + rax + 0x1e]
movzx esi, byte [rsp + rax + 0x1f]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 8
jae 0x49b5ab
movzx r8d, byte [rsp + rdi + 0x28]
sub r8d, edx
nop dword [rax]
cmp rsi, 8
jb 0x49b53b
jmp 0x49b59f
xor eax, eax
lea rbx, [rsp + 0x28]
mov ecx, 8
call fcn.00440dc0
add rsp, 0x30
pop rbp
ret
mov eax, esi
mov ecx, 8
call fcn.00451500
mov eax, edi
mov ecx, 8
call fcn.00451500
nop
call fcn.0044f280
nop dword [rax]
jmp fcn.0049b500

Function at 0x49bf80
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x49c04a
push rbp
mov rbp, rsp
sub rsp, 0x48
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rbx
mov qword [rsp], rax
mov qword [rsp + 8], rbx
mov byte [rsp + 0x10], 0
call fcn.00402c80
xorps xmm15, xmm15
mov r14, qword [0x0062b238]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x18], 0xffffffffffffffff
jne 0x49c02f
mov rcx, qword [rsp + 0x60]
lea rdx, [rcx + 1]
mov qword [rsp + 0x40], rdx
lea rax, [0x004fbda0]
xor ebx, ebx
mov rcx, rdx
call fcn.0043d8e0
mov rbx, qword [rsp + 0x60]
mov rcx, rax
xor edi, edi
mov rsi, qword [rsp + 0x40]
mov rax, qword [rsp + 0x58]
nop dword [rax]
call fcn.0049c300
inc rbx
cmp rcx, rbx
jae 0x49c01e
mov edi, 1
lea rsi, [0x004fbda0]
call fcn.0043d9c0
mov word [rax + rbx*2 - 2], 0
xor edi, edi
xor esi, esi
add rsp, 0x48
pop rbp
ret
xor eax, eax
xor ebx, ebx
mov rcx, rbx
lea rdi, [0x00533938]
lea rsi, [0x00533648]
add rsp, 0x48
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.0044f280
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.0049bf80
Function at 0x49fe60
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x49ff46
push rbp
mov rbp, rsp
sub rsp, 0x40
movabs rdx, 0x7458fcfed567f1aa
mov qword [rsp + 0x31], rdx
movabs rdx, 0x63f6f27c09eca474
mov qword [rsp + 0x38], rdx
movabs rdx, 0x10400010b050805
mov qword [rsp + 0x1f], rdx
movabs rdx, 0xe05010400010b05
mov qword [rsp + 0x21], rdx
movabs rdx, 0x903050c0a0d0906
mov qword [rsp + 0x29], rdx
xor eax, eax
nop
jmp 0x49fee0
movzx r9d, byte [rsp + rsi + 0x31]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x5c]
mov byte [rsp + rdi + 0x31], dl
mov byte [rsp + rsi + 0x31], r8b
add rax, 2
nop dword [rax]
cmp rax, 0x12
jge 0x49ff12
movzx edx, byte [rsp + rax + 0x1f]
movzx esi, byte [rsp + rax + 0x20]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0xf
jae 0x49ff37
movzx r8d, byte [rsp + rdi + 0x31]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x5c]
cmp rsi, 0xf
jb 0x49fec2
jmp 0x49ff2b
xor eax, eax
lea rbx, [rsp + 0x31]
mov ecx, 0xf
nop
call fcn.00440dc0
add rsp, 0x40
pop rbp
ret
mov eax, esi
mov ecx, 0xf
call fcn.00451500
mov eax, edi
mov ecx, 0xf
nop
call fcn.00451500
nop
call fcn.0044f280
jmp fcn.0049fe60

Function at 0x4a0240
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4a0326
push rbp
mov rbp, rsp
sub rsp, 0x38
movabs rdx, 0x565e6b8b7b9f7e76
mov qword [rsp + 0x2b], rdx
movabs rdx, 0x74838b5491565e6b
mov qword [rsp + 0x30], rdx
movabs rdx, 0x90302050800050a
mov qword [rsp + 0x19], rdx
movabs rdx, 0x504090302050800
mov qword [rsp + 0x1b], rdx
movabs rdx, 0xa0b0c06000a0104
mov qword [rsp + 0x23], rdx
xor eax, eax
nop
jmp 0x4a02c0
movzx r9d, byte [rsp + rsi + 0x2b]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x1f]
mov byte [rsp + rdi + 0x2b], dl
mov byte [rsp + rsi + 0x2b], r8b
add rax, 2
nop dword [rax]
cmp rax, 0x12
jge 0x4a02f2
movzx edx, byte [rsp + rax + 0x19]
movzx esi, byte [rsp + rax + 0x1a]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0xd
jae 0x4a0317
movzx r8d, byte [rsp + rdi + 0x2b]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x1f]
cmp rsi, 0xd
jb 0x4a02a2
jmp 0x4a030b
xor eax, eax
lea rbx, [rsp + 0x2b]
mov ecx, 0xd
nop
call fcn.00440dc0
add rsp, 0x38
pop rbp
ret
mov eax, esi
mov ecx, 0xd
call fcn.00451500
mov eax, edi
mov ecx, 0xd
nop
call fcn.00451500
nop
call fcn.0044f280
jmp fcn.004a0240
Function at 0x4a1940
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4a19fd
push rbp
mov rbp, rsp
sub rsp, 0x30
movabs rdx, 0x659d6d3e4c2365ce
mov qword [rsp + 0x27], rdx
mov byte [rsp + 0x2f], 0x72
movabs rdx, 0x600030203040206
mov qword [rsp + 0x1d], rdx
mov word [rsp + 0x25], 0x304
xor eax, eax
nop
jmp 0x4a19a0
movzx r9d, byte [rsp + rsi + 0x27]
sub r9d, edx
lea edx, [r9 - 0x60]
mov byte [rsp + rdi + 0x27], dl
lea edx, [r8 - 0x60]
mov byte [rsp + rsi + 0x27], dl
add rax, 2
nop
cmp rax, 0xa
jge 0x4a19cd
movzx edx, byte [rsp + rax + 0x1d]
movzx esi, byte [rsp + rax + 0x1e]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 9
jae 0x4a19f0
movzx r8d, byte [rsp + rdi + 0x27]
sub r8d, edx
cmp rsi, 9
jb 0x4a1982
jmp 0x4a19e4
xor eax, eax
lea rbx, [rsp + 0x27]
mov ecx, 9
call fcn.00440dc0
add rsp, 0x30
pop rbp
ret
mov eax, esi
mov ecx, 9
call fcn.00451500
mov eax, edi
mov ecx, 9
call fcn.00451500
nop
nop dword [rax]
call fcn.0044f280
jmp fcn.004a1940

Function at 0x4a8140
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4a823b
push rbp
mov rbp, rsp
sub rsp, 0x50
movabs rdx, 0x9d9b73718da99153
mov qword [rsp + 0x38], rdx
movabs rdx, 0xba6e61749c2e6e72
mov qword [rsp + 0x40], rdx
movabs rdx, 0x6d5f773b20648da8
mov qword [rsp + 0x48], rdx
movabs rdx, 0x60b140202070104
mov qword [rsp + 0x1e], rdx
movabs rdx, 0x150a160b030f1110
mov qword [rsp + 0x26], rdx
movabs rdx, 0xa15150a160b030f
mov qword [rsp + 0x28], rdx
movabs rdx, 0x4070611170f0403
mov qword [rsp + 0x30], rdx
xor eax, eax
jmp 0x4a81d9
movzx r9d, byte [rsp + rsi + 0x38]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x35]
mov byte [rsp + rdi + 0x38], dl
mov byte [rsp + rsi + 0x38], r8b
add rax, 2
cmp rax, 0x1a
jge 0x4a820b
movzx edx, byte [rsp + rax + 0x1e]
movzx esi, byte [rsp + rax + 0x1f]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x18
jae 0x4a822e
movzx r8d, byte [rsp + rdi + 0x38]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x35]
cmp rsi, 0x18
jb 0x4a81bf
jmp 0x4a8222
xor eax, eax
lea rbx, [rsp + 0x38]
mov ecx, 0x18
call fcn.00440dc0
add rsp, 0x50
pop rbp
ret
mov eax, esi
mov ecx, 0x18
call fcn.00451500
mov eax, edi
mov ecx, 0x18
call fcn.00451500
nop
nop dword [rax + rax]
call fcn.0044f280
jmp fcn.004a8140
Function at 0x4a8260
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4a834c
push rbp
mov rbp, rsp
sub rsp, 0x48
movabs rdx, 0x2a375d58405c042f
mov qword [rsp + 0x33], rdx
movabs rdx, 0x646e61fb1a2a375d
mov qword [rsp + 0x38], rdx
movabs rdx, 0x656d161f4f224c42
mov qword [rsp + 0x40], rdx
movabs rdx, 0x9100e050d121208
mov qword [rsp + 0x1d], rdx
movabs rdx, 0xf040206080910
mov qword [rsp + 0x23], rdx
movabs rdx, 0x606030f07011107
mov qword [rsp + 0x2b], rdx
xor eax, eax
jmp 0x4a82ea
movzx r9d, byte [rsp + rsi + 0x33]
lea edx, [r9 + rdx]
lea edx, [rdx + 6]
mov byte [rsp + rdi + 0x33], dl
mov byte [rsp + rsi + 0x33], r8b
add rax, 2
cmp rax, 0x16
jge 0x4a831c
movzx edx, byte [rsp + rax + 0x1d]
movzx esi, byte [rsp + rax + 0x1e]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x15
jae 0x4a833f
movzx r8d, byte [rsp + rdi + 0x33]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 6]
cmp rsi, 0x15
jb 0x4a82d0
jmp 0x4a8333
xor eax, eax
lea rbx, [rsp + 0x33]
mov ecx, 0x15
call fcn.00440dc0
add rsp, 0x48
pop rbp
ret
mov eax, esi
mov ecx, 0x15
call fcn.00451500
mov eax, edi
mov ecx, 0x15
call fcn.00451500
nop
call fcn.0044f280
jmp fcn.004a8260

Function at 0x4ae1e0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4ae2ca
push rbp
mov rbp, rsp
sub rsp, 0x40
movabs rdx, 0x2de96369fc234d38
mov qword [rsp + 0x2c], rdx
movabs rdx, 0x4b5161042de96369
mov qword [rsp + 0x30], rdx
movabs rdx, 0xc96d6954200d3a61
mov qword [rsp + 0x38], rdx
movabs rdx, 0x6020d0313020e00
mov qword [rsp + 0x18], rdx
movabs rdx, 0x80d130b06020d03
mov qword [rsp + 0x1c], rdx
movabs rdx, 0xd0800020a010d07
mov qword [rsp + 0x24], rdx
xor eax, eax
jmp 0x4ae26d
movzx r9d, byte [rsp + rsi + 0x2c]
sub r9d, edx
lea edx, [r9 + 0x3a]
mov byte [rsp + rdi + 0x2c], dl
lea edx, [r8 + 0x3a]
mov byte [rsp + rsi + 0x2c], dl
add rax, 2
cmp rax, 0x14
jge 0x4ae29a
movzx edx, byte [rsp + rax + 0x18]
movzx esi, byte [rsp + rax + 0x19]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x14
jae 0x4ae2bd
movzx r8d, byte [rsp + rdi + 0x2c]
sub r8d, edx
cmp rsi, 0x14
jb 0x4ae250
jmp 0x4ae2b1
xor eax, eax
lea rbx, [rsp + 0x2c]
mov ecx, 0x14
call fcn.00440dc0
add rsp, 0x40
pop rbp
ret
mov eax, esi
mov ecx, 0x14
call fcn.00451500
mov eax, edi
mov ecx, 0x14
call fcn.00451500
nop
call fcn.0044f280
jmp fcn.004ae1e0
Function at 0x4af860
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4af95d
push rbp
mov rbp, rsp
sub rsp, 0x50
movabs rdx, 0xb011f86c6798610e
mov qword [rsp + 0x38], rdx
movabs rdx, 0x396e61fb53201f64
mov qword [rsp + 0x40], rdx
movabs rdx, 0x869f820f803b5
mov qword [rsp + 0x48], rdx
movabs rdx, 0x216080c09021407
mov qword [rsp + 0x1e], rdx
movabs rdx, 0xc09120f051106
mov qword [rsp + 0x26], rdx
movabs rdx, 0x509000c09120f05
mov qword [rsp + 0x28], rdx
movabs rdx, 0x914100505101617
mov qword [rsp + 0x30], rdx
xor eax, eax
jmp 0x4af900
movzx r9d, byte [rsp + rsi + 0x38]
sub r9d, edx
lea edx, [r9 - 0x80]
mov byte [rsp + rdi + 0x38], dl
lea edx, [r8 - 0x80]
mov byte [rsp + rsi + 0x38], dl
add rax, 2
nop dword [rax]
cmp rax, 0x1a
jge 0x4af92d
movzx edx, byte [rsp + rax + 0x1e]
movzx esi, byte [rsp + rax + 0x1f]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x18
jae 0x4af950
movzx r8d, byte [rsp + rdi + 0x38]
sub r8d, edx
cmp rsi, 0x18
jb 0x4af8df
jmp 0x4af944
xor eax, eax
lea rbx, [rsp + 0x38]
mov ecx, 0x18
call fcn.00440dc0
add rsp, 0x50
pop rbp
ret
mov eax, esi
mov ecx, 0x18
call fcn.00451500
mov eax, edi
mov ecx, 0x18
call fcn.00451500
nop
nop dword [rax]
call fcn.0044f280
jmp fcn.004af860

Function at 0x4b1f60
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4b204a
push rbp
mov rbp, rsp
sub rsp, 0x40
movabs rdx, 0x696953206b636d6d
mov qword [rsp + 0x2e], rdx
movabs rdx, 0x7526696953206b63
mov qword [rsp + 0x30], rdx
movabs rdx, 0x798c738274898777
mov qword [rsp + 0x38], rdx
movabs rdx, 0xc0609090f0c070c
mov qword [rsp + 0x18], rdx
movabs rdx, 0x80d100b09110c06
mov qword [rsp + 0x1e], rdx
movabs rdx, 0xa0f001107000e02
mov qword [rsp + 0x26], rdx
xor eax, eax
jmp 0x4b1fed
movzx r9d, byte [rsp + rsi + 0x2e]
sub r9d, edx
lea edx, [r9 + 0xb]
mov byte [rsp + rdi + 0x2e], dl
lea edx, [r8 + 0xb]
mov byte [rsp + rsi + 0x2e], dl
add rax, 2
cmp rax, 0x16
jge 0x4b201a
movzx edx, byte [rsp + rax + 0x18]
movzx esi, byte [rsp + rax + 0x19]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x12
jae 0x4b203d
movzx r8d, byte [rsp + rdi + 0x2e]
sub r8d, edx
cmp rsi, 0x12
jb 0x4b1fd0
jmp 0x4b2031
xor eax, eax
lea rbx, [rsp + 0x2e]
mov ecx, 0x12
call fcn.00440dc0
add rsp, 0x40
pop rbp
ret
mov eax, esi
mov ecx, 0x12
call fcn.00451500
mov eax, edi
mov ecx, 0x12
call fcn.00451500
nop
call fcn.0044f280
jmp fcn.004b1f60
Function at 0x4b37c0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4b38ac
push rbp
mov rbp, rsp
sub rsp, 0x48
movabs rdx, 0x6ca37061b5bc6953
mov qword [rsp + 0x31], rdx
movabs rdx, 0x8f6e77742420996c
mov qword [rsp + 0x38], rdx
movabs rdx, 0x656d8f54847a72a3
mov qword [rsp + 0x40], rdx
movabs rdx, 0x60f120e0f060203
mov qword [rsp + 0x19], rdx
movabs rdx, 0xc0802030e15140c
mov qword [rsp + 0x21], rdx
movabs rdx, 0xc06060a0a121107
mov qword [rsp + 0x29], rdx
xor eax, eax
jmp 0x4b384a
movzx r9d, byte [rsp + rsi + 0x31]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x2e]
mov byte [rsp + rdi + 0x31], dl
mov byte [rsp + rsi + 0x31], r8b
add rax, 2
cmp rax, 0x18
jge 0x4b387c
movzx edx, byte [rsp + rax + 0x19]
movzx esi, byte [rsp + rax + 0x1a]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x17
jae 0x4b389f
movzx r8d, byte [rsp + rdi + 0x31]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x2e]
cmp rsi, 0x17
jb 0x4b3830
jmp 0x4b3893
xor eax, eax
lea rbx, [rsp + 0x31]
mov ecx, 0x17
call fcn.00440dc0
add rsp, 0x48
pop rbp
ret
mov eax, esi
mov ecx, 0x17
call fcn.00451500
mov eax, edi
mov ecx, 0x17
call fcn.00451500
nop
call fcn.0044f280
jmp fcn.004b37c0

Function at 0x4b5080
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4b517b
push rbp
mov rbp, rsp
sub rsp, 0x48
movabs rdx, 0x203b207448f46159
mov qword [rsp + 0x33], rdx
movabs rdx, 0xe46ecbc4dd203b20
mov qword [rsp + 0x38], rdx
movabs rdx, 0x4c6d4834c664d577
mov qword [rsp + 0x40], rdx
movabs rdx, 0x60814020d0c1106
mov qword [rsp + 0x19], rdx
movabs rdx, 0xe0a0a1209140c10
mov qword [rsp + 0x21], rdx
movabs rdx, 0x3050e0a0a120914
mov qword [rsp + 0x23], rdx
movabs rdx, 0x1103091110100502
mov qword [rsp + 0x2b], rdx
xor eax, eax
jmp 0x4b5119
movzx r9d, byte [rsp + rsi + 0x33]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x7a]
mov byte [rsp + rdi + 0x33], dl
mov byte [rsp + rsi + 0x33], r8b
add rax, 2
cmp rax, 0x1a
jge 0x4b514b
movzx edx, byte [rsp + rax + 0x19]
movzx esi, byte [rsp + rax + 0x1a]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x15
jae 0x4b516e
movzx r8d, byte [rsp + rdi + 0x33]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x7a]
cmp rsi, 0x15
jb 0x4b50ff
jmp 0x4b5162
xor eax, eax
lea rbx, [rsp + 0x33]
mov ecx, 0x15
call fcn.00440dc0
add rsp, 0x48
pop rbp
ret
mov eax, esi
mov ecx, 0x15
call fcn.00451500
mov eax, edi
mov ecx, 0x15
call fcn.00451500
nop
nop dword [rax + rax]
call fcn.0044f280
jmp fcn.004b5080
Function at 0x4b5540
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4b562a
push rbp
mov rbp, rsp
sub rsp, 0x48
movabs rdx, 0x53dec6cfa7c00041
mov qword [rsp + 0x34], rdx
movabs rdx, 0x646e947453dec6cf
mov qword [rsp + 0x38], rdx
movabs rdx, 0x2f6d6954d79c7231
mov qword [rsp + 0x40], rdx
movabs rdx, 0x406090302030503
mov qword [rsp + 0x1e], rdx
movabs rdx, 0x41303010e010406
mov qword [rsp + 0x24], rdx
movabs rdx, 0x30c010e0f0f050c
mov qword [rsp + 0x2c], rdx
xor eax, eax
jmp 0x4b55cd
movzx r9d, byte [rsp + rsi + 0x34]
sub r9d, edx
lea edx, [r9 + 0x59]
mov byte [rsp + rdi + 0x34], dl
lea edx, [r8 + 0x59]
mov byte [rsp + rsi + 0x34], dl
add rax, 2
cmp rax, 0x16
jge 0x4b55fa
movzx edx, byte [rsp + rax + 0x1e]
movzx esi, byte [rsp + rax + 0x1f]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x14
jae 0x4b561d
movzx r8d, byte [rsp + rdi + 0x34]
sub r8d, edx
cmp rsi, 0x14
jb 0x4b55b0
jmp 0x4b5611
xor eax, eax
lea rbx, [rsp + 0x34]
mov ecx, 0x14
call fcn.00440dc0
add rsp, 0x48
pop rbp
ret
mov eax, esi
mov ecx, 0x14
call fcn.00451500
mov eax, edi
mov ecx, 0x14
call fcn.00451500
nop
call fcn.0044f280
jmp fcn.004b5540

Function at 0x4b72a0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4b73bd
push rbp
mov rbp, rsp
sub rsp, 0x58
movabs rdx, 0x74edac3f28222511
mov qword [rsp + 0x3f], rdx
movabs rdx, 0xdffae331206cc499
mov qword [rsp + 0x47], rdx
movabs rdx, 0x24dffae331206cc4
mov qword [rsp + 0x48], rdx
movabs rdx, 0x65d836c537e816d9
mov qword [rsp + 0x50], rdx
movabs rdx, 0x170f0e08140d0f11
mov qword [rsp + 0x1b], rdx
movabs rdx, 0x15131210170f0e08
mov qword [rsp + 0x1f], rdx
movabs rdx, 0x30e160602091101
mov qword [rsp + 0x27], rdx
movabs rdx, 0xf05130f02161708
mov qword [rsp + 0x2f], rdx
movabs rdx, 0x416130f040c15
mov qword [rsp + 0x37], rdx
xor eax, eax
jmp 0x4b7360
movzx r9d, byte [rsp + rsi + 0x3f]
sub r9d, edx
lea edx, [r9 + 0x58]
mov byte [rsp + rdi + 0x3f], dl
lea edx, [r8 + 0x58]
mov byte [rsp + rsi + 0x3f], dl
add rax, 2
nop word [rax + rax]
cmp rax, 0x24
jge 0x4b738d
movzx edx, byte [rsp + rax + 0x1b]
movzx esi, byte [rsp + rax + 0x1c]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x19
jae 0x4b73b0
movzx r8d, byte [rsp + rdi + 0x3f]
sub r8d, edx
cmp rsi, 0x19
jb 0x4b733d
jmp 0x4b73a4
xor eax, eax
lea rbx, [rsp + 0x3f]
mov ecx, 0x19
call fcn.00440dc0
add rsp, 0x58
pop rbp
ret
mov eax, esi
mov ecx, 0x19
call fcn.00451500
mov eax, edi
mov ecx, 0x19
call fcn.00451500
nop
nop dword [rax]
call fcn.0044f280
jmp fcn.004b72a0