joyce8/EMBER2024-capa huggingface dataset:
Function at 0x493d80
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x493e3d
push rbp
mov rbp, rsp
sub rsp, 0x30
movabs rdx, 0xa8b82e73a22620cc
mov qword [rsp + 0x1d], rdx
mov byte [rsp + 0x25], 0x6e
movabs rdx, 0x306020303060700
mov qword [rsp + 0x26], rdx
mov word [rsp + 0x2e], 0x706
xor eax, eax
nop
jmp 0x493de0
movzx r9d, byte [rsp + rsi + 0x1d]
sub r9d, edx
lea edx, [r9 - 0x38]
mov byte [rsp + rdi + 0x1d], dl
lea edx, [r8 - 0x38]
mov byte [rsp + rsi + 0x1d], dl
add rax, 2
nop
cmp rax, 0xa
jge 0x493e0d
movzx edx, byte [rsp + rax + 0x26]
movzx esi, byte [rsp + rax + 0x27]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 9
jae 0x493e30
movzx r8d, byte [rsp + rdi + 0x1d]
sub r8d, edx
cmp rsi, 9
jb 0x493dc2
jmp 0x493e24
xor eax, eax
lea rbx, [rsp + 0x1d]
mov ecx, 9
call fcn.00441380
add rsp, 0x30
pop rbp
ret
mov eax, esi
mov ecx, 9
call fcn.00451880
mov eax, edi
mov ecx, 9
call fcn.00451880
nop
nop dword [rax]
call fcn.0044f600
jmp fcn.00493d80

Function at 0x499f60
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x49a027
push rbp
mov rbp, rsp
sub rsp, 0x38
movabs rdx, 0x866283746a6f9b73
mov qword [rsp + 0x1c], rdx
mov dword [rsp + 0x24], 0xdc67ed65
movabs rdx, 0x90b0501050a0b08
mov qword [rsp + 0x28], rdx
movabs rdx, 0x30a09090a070309
mov qword [rsp + 0x30], rdx
xor eax, eax
jmp 0x499fc8
movzx r9d, byte [rsp + rsi + 0x1c]
sub r9d, edx
lea edx, [r9 - 0x73]
mov byte [rsp + rdi + 0x1c], dl
lea edx, [r8 - 0x73]
mov byte [rsp + rsi + 0x1c], dl
add rax, 2
cmp rax, 0x10
jge 0x499ff7
movzx edx, byte [rsp + rax + 0x28]
movzx esi, byte [rsp + rax + 0x29]
mov edi, edx
xor edx, esi
add edx, eax
nop
cmp rdi, 0xc
jae 0x49a01a
movzx r8d, byte [rsp + rdi + 0x1c]
sub r8d, edx
cmp rsi, 0xc
jb 0x499fab
jmp 0x49a00e
xor eax, eax
lea rbx, [rsp + 0x1c]
mov ecx, 0xc
call fcn.00441380
add rsp, 0x38
pop rbp
ret
mov eax, esi
mov ecx, 0xc
call fcn.00451880
mov eax, edi
mov ecx, 0xc
call fcn.00451880
nop
call fcn.0044f600
jmp fcn.00499f60

Function at 0x49a040
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x49a112
push rbp
mov rbp, rsp
sub rsp, 0x38
movabs rdx, 0x74bd65f501e96ef1
mov qword [rsp + 0x1a], rdx
movabs rdx, 0xccb888a4646574bd
mov qword [rsp + 0x20], rdx
movabs rdx, 0x6030003020a040c
mov qword [rsp + 0x28], rdx
movabs rdx, 0xc0b0c000a020b0d
mov qword [rsp + 0x30], rdx
xor eax, eax
jmp 0x49a0ac
movzx r9d, byte [rsp + rsi + 0x1a]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x50]
mov byte [rsp + rdi + 0x1a], dl
mov byte [rsp + rsi + 0x1a], r8b
add rax, 2
cmp rax, 0x10
jge 0x49a0de
movzx edx, byte [rsp + rax + 0x28]
movzx esi, byte [rsp + rax + 0x29]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0xe
jae 0x49a105
movzx r8d, byte [rsp + rdi + 0x1a]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x50]
cmp rsi, 0xe
jb 0x49a092
jmp 0x49a0f5
xor eax, eax
lea rbx, [rsp + 0x1a]
mov ecx, 0xe
call fcn.00441380
add rsp, 0x38
pop rbp
ret
mov eax, esi
mov ecx, 0xe
nop dword [rax]
call fcn.00451880
mov eax, edi
mov ecx, 0xe
call fcn.00451880
nop
call fcn.0044f600
jmp fcn.0049a040
Function at 0x49a120
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x49a20c
push rbp
mov rbp, rsp
sub rsp, 0x48
movabs rdx, 0x6eb06e136b556553
mov qword [rsp + 0x1e], rdx
movabs rdx, 0x697d617d6eb06e13
mov qword [rsp + 0x22], rdx
movabs rdx, 0xfff6e6585bc2064
mov qword [rsp + 0x2a], rdx
movabs rdx, 0x40a08060a021306
mov qword [rsp + 0x32], rdx
movabs rdx, 0xe0a0f041202040a
mov qword [rsp + 0x38], rdx
movabs rdx, 0x212050502120602
mov qword [rsp + 0x40], rdx
xor eax, eax
jmp 0x49a1aa
movzx r9d, byte [rsp + rsi + 0x1e]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x60]
mov byte [rsp + rdi + 0x1e], dl
mov byte [rsp + rsi + 0x1e], r8b
add rax, 2
cmp rax, 0x16
jge 0x49a1dc
movzx edx, byte [rsp + rax + 0x32]
movzx esi, byte [rsp + rax + 0x33]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x14
jae 0x49a1ff
movzx r8d, byte [rsp + rdi + 0x1e]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x60]
cmp rsi, 0x14
jb 0x49a190
jmp 0x49a1f3
xor eax, eax
lea rbx, [rsp + 0x1e]
mov ecx, 0x14
call fcn.00441380
add rsp, 0x48
pop rbp
ret
mov eax, esi
mov ecx, 0x14
call fcn.00451880
mov eax, edi
mov ecx, 0x14
call fcn.00451880
nop
call fcn.0044f600
jmp fcn.0049a120

Function at 0x49c740
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x49c80a
push rbp
mov rbp, rsp
sub rsp, 0x48
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x58], rax
mov qword [rsp], rax
mov qword [rsp + 8], rbx
mov byte [rsp + 0x10], 0
call fcn.00403080
xorps xmm15, xmm15
mov r14, qword [0x00647990]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x18], 0xffffffffffffffff
jne 0x49c7ef
mov rcx, qword [rsp + 0x60]
lea rdx, [rcx + 1]
mov qword [rsp + 0x40], rdx
lea rax, [0x0051f740]
xor ebx, ebx
mov rcx, rdx
call fcn.0043dec0
mov rbx, qword [rsp + 0x60]
mov rcx, rax
xor edi, edi
mov rsi, qword [rsp + 0x40]
mov rax, qword [rsp + 0x58]
nop dword [rax]
call fcn.0049eb00
inc rbx
cmp rcx, rbx
jae 0x49c7de
mov edi, 1
lea rsi, [0x0051f740]
call fcn.0043dfa0
mov word [rax + rbx*2 - 2], 0
xor edi, edi
xor esi, esi
add rsp, 0x48
pop rbp
ret
xor eax, eax
xor ebx, ebx
mov rcx, rbx
lea rdi, [0x00562be8]
lea rsi, [0x00562848]
add rsp, 0x48
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.0044f600
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.0049c740
Function at 0x49e760
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x49e85d
push rbp
mov rbp, rsp
sub rsp, 0x48
movabs rdx, 0x31342f3734313324
mov qword [rsp + 0x18], rdx
movabs rdx, 0x42373d28386d3134
mov qword [rsp + 0x1e], rdx
movabs rdx, 0x362d2e2e493331
mov qword [rsp + 0x26], rdx
movabs rdx, 0xb050d0a08141200
mov qword [rsp + 0x2e], rdx
movabs rdx, 0x13121210100e0907
mov qword [rsp + 0x36], rdx
movabs rdx, 0x30413121210100e
mov qword [rsp + 0x38], rdx
movabs rdx, 0x50a0104140a070c
mov qword [rsp + 0x40], rdx
xor eax, eax
jmp 0x49e800
movzx r9d, byte [rsp + rsi + 0x18]
sub r9d, edx
lea edx, [r9 + 0x16]
mov byte [rsp + rdi + 0x18], dl
lea edx, [r8 + 0x16]
mov byte [rsp + rsi + 0x18], dl
add rax, 2
nop dword [rax]
cmp rax, 0x1a
jge 0x49e82d
movzx edx, byte [rsp + rax + 0x2e]
movzx esi, byte [rsp + rax + 0x2f]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x16
jae 0x49e850
movzx r8d, byte [rsp + rdi + 0x18]
sub r8d, edx
cmp rsi, 0x16
jb 0x49e7df
jmp 0x49e844
xor eax, eax
lea rbx, [rsp + 0x18]
mov ecx, 0x16
call fcn.00441380
add rsp, 0x48
pop rbp
ret
mov eax, esi
mov ecx, 0x16
call fcn.00451880
mov eax, edi
mov ecx, 0x16
call fcn.00451880
nop
nop dword [rax]
call fcn.0044f600
jmp fcn.0049e760

Function at 0x4a23c0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4a24cc
push rbp
mov rbp, rsp
sub rsp, 0x50
movabs rdx, 0x6593a5a5739b658b
mov qword [rsp + 0x1b], rdx
movabs rdx, 0x866f74996165857d
mov qword [rsp + 0x23], rdx
movabs rdx, 0xcd866f7499616585
mov qword [rsp + 0x24], rdx
movabs rdx, 0x895964697aa58c20
mov qword [rsp + 0x2c], rdx
movabs rdx, 0x20410170c05120d
mov qword [rsp + 0x34], rdx
movabs rdx, 0x131817180f091008
mov qword [rsp + 0x3c], rdx
movabs rdx, 0x1706020d13181718
mov qword [rsp + 0x40], rdx
movabs rdx, 0x171402000218030c
mov qword [rsp + 0x48], rdx
xor eax, eax
jmp 0x4a2468
movzx r9d, byte [rsp + rsi + 0x1b]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x32]
mov byte [rsp + rdi + 0x1b], dl
mov byte [rsp + rsi + 0x1b], r8b
add rax, 2
cmp rax, 0x1c
jge 0x4a249c
movzx edx, byte [rsp + rax + 0x34]
movzx esi, byte [rsp + rax + 0x35]
mov edi, edx
xor edx, esi
add edx, eax
nop
cmp rdi, 0x19
jae 0x4a24bf
movzx r8d, byte [rsp + rdi + 0x1b]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x32]
cmp rsi, 0x19
jb 0x4a244e
jmp 0x4a24b3
xor eax, eax
lea rbx, [rsp + 0x1b]
mov ecx, 0x19
call fcn.00441380
add rsp, 0x50
pop rbp
ret
mov eax, esi
mov ecx, 0x19
call fcn.00451880
mov eax, edi
mov ecx, 0x19
call fcn.00451880
nop
call fcn.0044f600
jmp fcn.004a23c0
Function at 0x4a4580
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4a466c
push rbp
mov rbp, rsp
sub rsp, 0x48
movabs rdx, 0x1873780263cc65b9
mov qword [rsp + 0x1c], rdx
movabs rdx, 0xae65f22118737802
mov qword [rsp + 0x20], rdx
movabs rdx, 0xf3656b9bb3c97275
mov qword [rsp + 0x28], rdx
movabs rdx, 0x30b050b0c020303
mov qword [rsp + 0x30], rdx
movabs rdx, 0x702070e0f080700
mov qword [rsp + 0x38], rdx
movabs rdx, 0x50b091305100408
mov qword [rsp + 0x40], rdx
xor eax, eax
jmp 0x4a460a
movzx r9d, byte [rsp + rsi + 0x1c]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x44]
mov byte [rsp + rdi + 0x1c], dl
mov byte [rsp + rsi + 0x1c], r8b
add rax, 2
cmp rax, 0x18
jge 0x4a463c
movzx edx, byte [rsp + rax + 0x30]
movzx esi, byte [rsp + rax + 0x31]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x14
jae 0x4a465f
movzx r8d, byte [rsp + rdi + 0x1c]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x44]
cmp rsi, 0x14
jb 0x4a45f0
jmp 0x4a4653
xor eax, eax
lea rbx, [rsp + 0x1c]
mov ecx, 0x14
call fcn.00441380
add rsp, 0x48
pop rbp
ret
mov eax, esi
mov ecx, 0x14
call fcn.00451880
mov eax, edi
mov ecx, 0x14
call fcn.00451880
nop
call fcn.0044f600
jmp fcn.004a4580

Function at 0x4a4980
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4a4a66
push rbp
mov rbp, rsp
sub rsp, 0x40
movabs rdx, 0xfc338f9a06ee4e6c
mov qword [rsp + 0x1e], rdx
movabs rdx, 0x6574862e84fc33
mov qword [rsp + 0x24], rdx
movabs rdx, 0xd0205010a070504
mov qword [rsp + 0x2c], rdx
movabs rdx, 0x80805050d020501
mov qword [rsp + 0x30], rdx
movabs rdx, 0x407080909040403
mov qword [rsp + 0x38], rdx
xor eax, eax
nop
jmp 0x4a4a00
movzx r9d, byte [rsp + rsi + 0x1e]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x61]
mov byte [rsp + rdi + 0x1e], dl
mov byte [rsp + rsi + 0x1e], r8b
add rax, 2
nop dword [rax]
cmp rax, 0x14
jge 0x4a4a32
movzx edx, byte [rsp + rax + 0x2c]
movzx esi, byte [rsp + rax + 0x2d]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0xe
jae 0x4a4a57
movzx r8d, byte [rsp + rdi + 0x1e]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x61]
cmp rsi, 0xe
jb 0x4a49e2
jmp 0x4a4a4b
xor eax, eax
lea rbx, [rsp + 0x1e]
mov ecx, 0xe
nop
call fcn.00441380
add rsp, 0x40
pop rbp
ret
mov eax, esi
mov ecx, 0xe
call fcn.00451880
mov eax, edi
mov ecx, 0xe
nop
call fcn.00451880
nop
call fcn.0044f600
jmp fcn.004a4980
Function at 0x4a6280
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4a636a
push rbp
mov rbp, rsp
sub rsp, 0x40
movabs rdx, 0xc78b996974287544
mov qword [rsp + 0x18], rdx
movabs rdx, 0x6100c78b99697428
mov qword [rsp + 0x1a], rdx
movabs rdx, 0x64b9b470e00696fb
mov qword [rsp + 0x22], rdx
movabs rdx, 0x80a0b0a020506
mov qword [rsp + 0x2a], rdx
movabs rdx, 0x60a07100f080008
mov qword [rsp + 0x30], rdx
movabs rdx, 0xf10100d050c070b
mov qword [rsp + 0x38], rdx
xor eax, eax
jmp 0x4a630d
movzx r9d, byte [rsp + rsi + 0x18]
sub r9d, edx
lea edx, [r9 + 0x7b]
mov byte [rsp + rdi + 0x18], dl
lea edx, [r8 + 0x7b]
mov byte [rsp + rsi + 0x18], dl
add rax, 2
cmp rax, 0x16
jge 0x4a633a
movzx edx, byte [rsp + rax + 0x2a]
movzx esi, byte [rsp + rax + 0x2b]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x12
jae 0x4a635d
movzx r8d, byte [rsp + rdi + 0x18]
sub r8d, edx
cmp rsi, 0x12
jb 0x4a62f0
jmp 0x4a6351
xor eax, eax
lea rbx, [rsp + 0x18]
mov ecx, 0x12
call fcn.00441380
add rsp, 0x40
pop rbp
ret
mov eax, esi
mov ecx, 0x12
call fcn.00451880
mov eax, edi
mov ecx, 0x12
call fcn.00451880
nop
call fcn.0044f600
jmp fcn.004a6280

Function at 0x4a65a0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4a669d
push rbp
mov rbp, rsp
sub rsp, 0x50
movabs rdx, 0x7093836f7797778d
mov qword [rsp + 0x1c], rdx
movabs rdx, 0x729775bc2da27093
mov qword [rsp + 0x22], rdx
movabs rdx, 0x8d7a82953c75a68f
mov qword [rsp + 0x2a], rdx
movabs rdx, 0x20606140c070f10
mov qword [rsp + 0x32], rdx
movabs rdx, 0x1120a1107090213
mov qword [rsp + 0x3a], rdx
movabs rdx, 0xe14110111060112
mov qword [rsp + 0x40], rdx
movabs rdx, 0x900150608061005
mov qword [rsp + 0x48], rdx
xor eax, eax
jmp 0x4a6640
movzx r9d, byte [rsp + rsi + 0x1c]
sub r9d, edx
lea edx, [r9 + 0xb]
mov byte [rsp + rdi + 0x1c], dl
lea edx, [r8 + 0xb]
mov byte [rsp + rsi + 0x1c], dl
add rax, 2
nop dword [rax]
cmp rax, 0x1e
jge 0x4a666d
movzx edx, byte [rsp + rax + 0x32]
movzx esi, byte [rsp + rax + 0x33]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x16
jae 0x4a6690
movzx r8d, byte [rsp + rdi + 0x1c]
sub r8d, edx
cmp rsi, 0x16
jb 0x4a661f
jmp 0x4a6684
xor eax, eax
lea rbx, [rsp + 0x1c]
mov ecx, 0x16
call fcn.00441380
add rsp, 0x50
pop rbp
ret
mov eax, esi
mov ecx, 0x16
call fcn.00451880
mov eax, edi
mov ecx, 0x16
call fcn.00451880
nop
nop dword [rax]
call fcn.0044f600
jmp fcn.004a65a0
Function at 0x4a9320
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4a941b
push rbp
mov rbp, rsp
sub rsp, 0x50
movabs rdx, 0x6f46f9c5e15a54a6
mov qword [rsp + 0x1d], rdx
movabs rdx, 0xf56172bac36f46f9
mov qword [rsp + 0x22], rdx
movabs rdx, 0x65544cc9dc65d8ec
mov qword [rsp + 0x2a], rdx
movabs rdx, 0xe1305000d0b1308
mov qword [rsp + 0x32], rdx
movabs rdx, 0x20306010c08120e
mov qword [rsp + 0x3a], rdx
movabs rdx, 0x31006010c060203
mov qword [rsp + 0x40], rdx
movabs rdx, 0x9120e0d060d1104
mov qword [rsp + 0x48], rdx
xor eax, eax
jmp 0x4a93b9
movzx r9d, byte [rsp + rsi + 0x1d]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x71]
mov byte [rsp + rdi + 0x1d], dl
mov byte [rsp + rsi + 0x1d], r8b
add rax, 2
cmp rax, 0x1e
jge 0x4a93eb
movzx edx, byte [rsp + rax + 0x32]
movzx esi, byte [rsp + rax + 0x33]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x15
jae 0x4a940e
movzx r8d, byte [rsp + rdi + 0x1d]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x71]
cmp rsi, 0x15
jb 0x4a939f
jmp 0x4a9402
xor eax, eax
lea rbx, [rsp + 0x1d]
mov ecx, 0x15
call fcn.00441380
add rsp, 0x50
pop rbp
ret
mov eax, esi
mov ecx, 0x15
call fcn.00451880
mov eax, edi
mov ecx, 0x15
call fcn.00451880
nop
nop dword [rax + rax]
call fcn.0044f600
jmp fcn.004a9320

Function at 0x4a9f60
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4aa07d
push rbp
mov rbp, rsp
sub rsp, 0x58
movabs rdx, 0x676f8b2065839174
mov qword [rsp + 0x1c], rdx
movabs rdx, 0x1985b87f696e8e5f
mov qword [rsp + 0x24], rdx
movabs rdx, 0x6e641985b87f696e
mov qword [rsp + 0x26], rdx
movabs rdx, 0x686b8977a3479a20
mov qword [rsp + 0x2e], rdx
movabs rdx, 0x10190f0008001800
mov qword [rsp + 0x36], rdx
movabs rdx, 0x70f10190f000800
mov qword [rsp + 0x38], rdx
movabs rdx, 0x170d00130e150800
mov qword [rsp + 0x40], rdx
movabs rdx, 0x17090e140f011400
mov qword [rsp + 0x48], rdx
movabs rdx, 0x905000f1714020c
mov qword [rsp + 0x50], rdx
xor eax, eax
jmp 0x4aa020
movzx r9d, byte [rsp + rsi + 0x1c]
sub r9d, edx
lea edx, [r9 + 0x16]
mov byte [rsp + rdi + 0x1c], dl
lea edx, [r8 + 0x16]
mov byte [rsp + rsi + 0x1c], dl
add rax, 2
nop word [rax + rax]
cmp rax, 0x22
jge 0x4aa04d
movzx edx, byte [rsp + rax + 0x36]
movzx esi, byte [rsp + rax + 0x37]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x1a
jae 0x4aa070
movzx r8d, byte [rsp + rdi + 0x1c]
sub r8d, edx
cmp rsi, 0x1a
jb 0x4a9ffd
jmp 0x4aa064
xor eax, eax
lea rbx, [rsp + 0x1c]
mov ecx, 0x1a
call fcn.00441380
add rsp, 0x58
pop rbp
ret
mov eax, esi
mov ecx, 0x1a
call fcn.00451880
mov eax, edi
mov ecx, 0x1a
call fcn.00451880
nop
nop dword [rax]
call fcn.0044f600
jmp fcn.004a9f60
Function at 0x4aa0a0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4aa1bd
push rbp
mov rbp, rsp
sub rsp, 0x58
movabs rdx, 0x8ba631134ce0f1f
mov qword [rsp + 0x1b], rdx
movabs rdx, 0x75d726e61a136564
mov qword [rsp + 0x23], rdx
movabs rdx, 0x1975d726e61a1365
mov qword [rsp + 0x24], rdx
movabs rdx, 0xbded28c4bc646126
mov qword [rsp + 0x2c], rdx
movabs rdx, 0xd1015180700020f
mov qword [rsp + 0x34], rdx
movabs rdx, 0x10a0a010d101518
mov qword [rsp + 0x38], rdx
movabs rdx, 0xa0b060a01070414
mov qword [rsp + 0x40], rdx
movabs rdx, 0x20e0c1111010406
mov qword [rsp + 0x48], rdx
movabs rdx, 0x15160f0318180317
mov qword [rsp + 0x50], rdx
xor eax, eax
jmp 0x4aa160
movzx r9d, byte [rsp + rsi + 0x1b]
sub r9d, edx
lea edx, [r9 + 0x6f]
mov byte [rsp + rdi + 0x1b], dl
lea edx, [r8 + 0x6f]
mov byte [rsp + rsi + 0x1b], dl
add rax, 2
nop word [rax + rax]
cmp rax, 0x24
jge 0x4aa18d
movzx edx, byte [rsp + rax + 0x34]
movzx esi, byte [rsp + rax + 0x35]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x19
jae 0x4aa1b0
movzx r8d, byte [rsp + rdi + 0x1b]
sub r8d, edx
cmp rsi, 0x19
jb 0x4aa13d
jmp 0x4aa1a4
xor eax, eax
lea rbx, [rsp + 0x1b]
mov ecx, 0x19
call fcn.00441380
add rsp, 0x58
pop rbp
ret
mov eax, esi
mov ecx, 0x19
call fcn.00451880
mov eax, edi
mov ecx, 0x19
call fcn.00451880
nop
nop dword [rax]
call fcn.0044f600
jmp fcn.004aa0a0

Function at 0x4ab620
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4ab73d
push rbp
mov rbp, rsp
sub rsp, 0x60
movabs rdx, 0x3755c846461e7560
mov qword [rsp + 0x1f], rdx
movabs rdx, 0xce6c0d554446446c
mov qword [rsp + 0x27], rdx
movabs rdx, 0x6374465af9ce6c0d
mov qword [rsp + 0x2c], rdx
movabs rdx, 0xf267f1467220015f
mov qword [rsp + 0x34], rdx
movabs rdx, 0x101a0702030d0516
mov qword [rsp + 0x3c], rdx
movabs rdx, 0x1c0a0f05101a0702
mov qword [rsp + 0x40], rdx
movabs rdx, 0x140a0f1509051a16
mov qword [rsp + 0x48], rdx
movabs rdx, 0x11001200030b191a
mov qword [rsp + 0x50], rdx
movabs rdx, 0xc0b04060c191607
mov qword [rsp + 0x58], rdx
xor eax, eax
jmp 0x4ab6e0
movzx r9d, byte [rsp + rsi + 0x1f]
sub r9d, edx
lea edx, [r9 + 0x3f]
mov byte [rsp + rdi + 0x1f], dl
lea edx, [r8 + 0x3f]
mov byte [rsp + rsi + 0x1f], dl
add rax, 2
nop word [rax + rax]
cmp rax, 0x24
jge 0x4ab70d
movzx edx, byte [rsp + rax + 0x3c]
movzx esi, byte [rsp + rax + 0x3d]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x1d
jae 0x4ab730
movzx r8d, byte [rsp + rdi + 0x1f]
sub r8d, edx
cmp rsi, 0x1d
jb 0x4ab6bd
jmp 0x4ab724
xor eax, eax
lea rbx, [rsp + 0x1f]
mov ecx, 0x1d
call fcn.00441380
add rsp, 0x60
pop rbp
ret
mov eax, esi
mov ecx, 0x1d
call fcn.00451880
mov eax, edi
mov ecx, 0x1d
call fcn.00451880
nop
nop dword [rax]
call fcn.0044f600
jmp fcn.004ab620
Function at 0x4ab760
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4ab85b
push rbp
mov rbp, rsp
sub rsp, 0x48
movabs rdx, 0xbb7d759b9fea9972
mov qword [rsp + 0x18], rdx
movabs rdx, 0x916281e16482bb7d
mov qword [rsp + 0x1e], rdx
movabs rdx, 0x6438738c616883ae
mov qword [rsp + 0x26], rdx
movabs rdx, 0x708040e0402070a
mov qword [rsp + 0x2e], rdx
movabs rdx, 0xc08140603011204
mov qword [rsp + 0x36], rdx
movabs rdx, 0xa0d0c0814060301
mov qword [rsp + 0x38], rdx
movabs rdx, 0x50813010f0b080e
mov qword [rsp + 0x40], rdx
xor eax, eax
jmp 0x4ab7f9
movzx r9d, byte [rsp + rsi + 0x18]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x36]
mov byte [rsp + rdi + 0x18], dl
mov byte [rsp + rsi + 0x18], r8b
add rax, 2
cmp rax, 0x1a
jge 0x4ab82b
movzx edx, byte [rsp + rax + 0x2e]
movzx esi, byte [rsp + rax + 0x2f]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x16
jae 0x4ab84e
movzx r8d, byte [rsp + rdi + 0x18]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x36]
cmp rsi, 0x16
jb 0x4ab7df
jmp 0x4ab842
xor eax, eax
lea rbx, [rsp + 0x18]
mov ecx, 0x16
call fcn.00441380
add rsp, 0x48
pop rbp
ret
mov eax, esi
mov ecx, 0x16
call fcn.00451880
mov eax, edi
mov ecx, 0x16
call fcn.00451880
nop
nop dword [rax + rax]
call fcn.0044f600
jmp fcn.004ab760

Function at 0x4ab880
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4ab966
push rbp
mov rbp, rsp
sub rsp, 0x40
movabs rdx, 0x9fe0cdd799a1a6ca
mov qword [rsp + 0x1a], rdx
movabs rdx, 0x9754ad6dd572dddd
mov qword [rsp + 0x22], rdx
movabs rdx, 0x701080b09060f02
mov qword [rsp + 0x2a], rdx
movabs rdx, 0x4030206050d0701
mov qword [rsp + 0x30], rdx
movabs rdx, 0xd0b000b0308090e
mov qword [rsp + 0x38], rdx
xor eax, eax
nop
jmp 0x4ab900
movzx r9d, byte [rsp + rsi + 0x1a]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x49]
mov byte [rsp + rdi + 0x1a], dl
mov byte [rsp + rsi + 0x1a], r8b
add rax, 2
nop dword [rax]
cmp rax, 0x16
jge 0x4ab932
movzx edx, byte [rsp + rax + 0x2a]
movzx esi, byte [rsp + rax + 0x2b]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x10
jae 0x4ab957
movzx r8d, byte [rsp + rdi + 0x1a]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x49]
cmp rsi, 0x10
jb 0x4ab8e2
jmp 0x4ab94b
xor eax, eax
lea rbx, [rsp + 0x1a]
mov ecx, 0x10
nop
call fcn.00441380
add rsp, 0x40
pop rbp
ret
mov eax, esi
mov ecx, 0x10
call fcn.00451880
mov eax, edi
mov ecx, 0x10
nop
call fcn.00451880
nop
call fcn.0044f600
jmp fcn.004ab880
Function at 0x4ae7c0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4ae8da
push rbp
mov rbp, rsp
sub rsp, 0x58
movabs rdx, 0x20cf69544233545b
mov qword [rsp + 0x1d], rdx
movabs rdx, 0x6564ff59e8332f63
mov qword [rsp + 0x25], rdx
movabs rdx, 0x5d6564ff59e8332f
mov qword [rsp + 0x26], rdx
movabs rdx, 0xc16efb8e61396369
mov qword [rsp + 0x2e], rdx
movabs rdx, 0x16100d0c14001310
mov qword [rsp + 0x36], rdx
movabs rdx, 0x30416100d0c1400
mov qword [rsp + 0x38], rdx
movabs rdx, 0xa14160912141401
mov qword [rsp + 0x40], rdx
movabs rdx, 0x150d0b0200000a14
mov qword [rsp + 0x48], rdx
movabs rdx, 0x4180306160b1309
mov qword [rsp + 0x50], rdx
xor eax, eax
jmp 0x4ae877
movzx r9d, byte [rsp + rsi + 0x1d]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x6f]
mov byte [rsp + rdi + 0x1d], dl
mov byte [rsp + rsi + 0x1d], r8b
add rax, 2
cmp rax, 0x22
jge 0x4ae8a9
movzx edx, byte [rsp + rax + 0x36]
movzx esi, byte [rsp + rax + 0x37]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x19
jae 0x4ae8cd
movzx r8d, byte [rsp + rdi + 0x1d]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x6f]
cmp rsi, 0x19
jb 0x4ae85d
jmp 0x4ae8c1
xor eax, eax
lea rbx, [rsp + 0x1d]
mov ecx, 0x19
call fcn.00441380
add rsp, 0x58
pop rbp
nop
ret
mov eax, esi
mov ecx, 0x19
call fcn.00451880
mov eax, edi
mov ecx, 0x19
call fcn.00451880
nop
call fcn.0044f600
nop
jmp fcn.004ae7c0

Function at 0x4aed60
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4aee2c
push rbp
mov rbp, rsp
sub rsp, 0x38
movabs rdx, 0x5f328985893f9d63
mov qword [rsp + 0x1f], rdx
movabs rdx, 0x936c935f32898589
mov qword [rsp + 0x22], rdx
movabs rdx, 0x50a01070a070505
mov qword [rsp + 0x2a], rdx
movabs rdx, 0x80204030207050a
mov qword [rsp + 0x30], rdx
xor eax, eax
jmp 0x4aedcf
movzx r9d, byte [rsp + rsi + 0x1f]
sub r9d, edx
lea edx, [r9 - 4]
mov byte [rsp + rdi + 0x1f], dl
lea edx, [r8 - 4]
mov byte [rsp + rsi + 0x1f], dl
add rax, 2
cmp rax, 0xe
jge 0x4aedfc
movzx edx, byte [rsp + rax + 0x2a]
movzx esi, byte [rsp + rax + 0x2b]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0xb
jae 0x4aee1f
movzx r8d, byte [rsp + rdi + 0x1f]
sub r8d, edx
cmp rsi, 0xb
jb 0x4aedb2
jmp 0x4aee13
xor eax, eax
lea rbx, [rsp + 0x1f]
mov ecx, 0xb
call fcn.00441380
add rsp, 0x38
pop rbp
ret
mov eax, esi
mov ecx, 0xb
call fcn.00451880
mov eax, edi
mov ecx, 0xb
call fcn.00451880
nop
call fcn.0044f600
jmp fcn.004aed60