joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4e4600
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4e46c6
push rbp
mov rbp, rsp
sub rsp, 0x30
movabs rdx, 0xf4e21743d4e614e
mov qword [rsp + 0x27], rdx
mov byte [rsp + 0x2f], 0x45
movabs rdx, 0x508080606070603
mov qword [rsp + 0x1d], rdx
mov word [rsp + 0x25], 0x802
xor eax, eax
nop
jmp 0x4e4660
movzx r9d, byte [rsp + rsi + 0x27]
lea edx, [r9 + rdx]
lea edx, [rdx + 0xe]
mov byte [rsp + rdi + 0x27], dl
mov byte [rsp + rsi + 0x27], r8b
add rax, 2
nop dword [rax]
cmp rax, 0xa
jge 0x4e4692
movzx edx, byte [rsp + rax + 0x1d]
movzx esi, byte [rsp + rax + 0x1e]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 9
jae 0x4e46b7
movzx r8d, byte [rsp + rdi + 0x27]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0xe]
cmp rsi, 9
jb 0x4e4642
jmp 0x4e46ab
xor eax, eax
lea rbx, [rsp + 0x27]
mov ecx, 9
nop
call fcn.00444780
add rsp, 0x30
pop rbp
ret
mov eax, esi
mov ecx, 9
call fcn.00456440
mov eax, edi
mov ecx, 9
nop
call fcn.00456440
nop
call fcn.00454160
jmp fcn.004e4600

Function at 0x4e64c0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4e658c
push rbp
mov rbp, rsp
sub rsp, 0x38
movabs rdx, 0xf1728b8f8564b84f
mov qword [rsp + 0x2d], rdx
mov dword [rsp + 0x34], 0x6ec7eaf1
movabs rdx, 0x504070105090408
mov qword [rsp + 0x1d], rdx
movabs rdx, 0x904050307050701
mov qword [rsp + 0x25], rdx
xor eax, eax
jmp 0x4e6525
movzx r9d, byte [rsp + rsi + 0x2d]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x32]
mov byte [rsp + rdi + 0x2d], dl
mov byte [rsp + rsi + 0x2d], r8b
add rax, 2
cmp rax, 0x10
jge 0x4e655c
movzx edx, byte [rsp + rax + 0x1d]
movzx esi, byte [rsp + rax + 0x1e]
mov edi, edx
xor edx, esi
add edx, eax
nop dword [rax + rax]
cmp rdi, 0xb
jae 0x4e657f
movzx r8d, byte [rsp + rdi + 0x2d]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x32]
cmp rsi, 0xb
jb 0x4e650b
jmp 0x4e6573
xor eax, eax
lea rbx, [rsp + 0x2d]
mov ecx, 0xb
call fcn.00444780
add rsp, 0x38
pop rbp
ret
mov eax, esi
mov ecx, 0xb
call fcn.00456440
mov eax, edi
mov ecx, 0xb
call fcn.00456440
nop
call fcn.00454160
jmp fcn.004e64c0

Function at 0x4e6e80
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4e6f46
push rbp
mov rbp, rsp
sub rsp, 0x30
movabs rdx, 0x683438195f37dc41
mov qword [rsp + 0x26], rdx
mov word [rsp + 0x2e], 0xe83c
movabs rdx, 0x805090006020100
mov qword [rsp + 0x1a], rdx
mov dword [rsp + 0x22], 0x9090400
xor eax, eax
jmp 0x4e6ee0
movzx r9d, byte [rsp + rsi + 0x26]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x2a]
mov byte [rsp + rdi + 0x26], dl
mov byte [rsp + rsi + 0x26], r8b
add rax, 2
nop dword [rax]
cmp rax, 0xc
jge 0x4e6f12
movzx edx, byte [rsp + rax + 0x1a]
movzx esi, byte [rsp + rax + 0x1b]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0xa
jae 0x4e6f37
movzx r8d, byte [rsp + rdi + 0x26]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x2a]
cmp rsi, 0xa
jb 0x4e6ec3
jmp 0x4e6f2b
xor eax, eax
lea rbx, [rsp + 0x26]
mov ecx, 0xa
nop
call fcn.00444780
add rsp, 0x30
pop rbp
ret
mov eax, esi
mov ecx, 0xa
call fcn.00456440
mov eax, edi
mov ecx, 0xa
nop
call fcn.00456440
nop
call fcn.00454160
jmp fcn.004e6e80
Function at 0x4e75a0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4e7658
push rbp
mov rbp, rsp
sub rsp, 0x30
movabs rdx, 0x61381dd54220ad47
mov qword [rsp + 0x28], rdx
movabs rdx, 0x603040003040103
mov qword [rsp + 0x1c], rdx
mov dword [rsp + 0x24], 0x50602
xor eax, eax
jmp 0x4e75f6
movzx r9d, byte [rsp + rsi + 0x28]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x24]
mov byte [rsp + rdi + 0x28], dl
mov byte [rsp + rsi + 0x28], r8b
add rax, 2
cmp rax, 0xc
jge 0x4e7628
movzx edx, byte [rsp + rax + 0x1c]
movzx esi, byte [rsp + rax + 0x1d]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 8
jae 0x4e764b
movzx r8d, byte [rsp + rdi + 0x28]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x24]
cmp rsi, 8
jb 0x4e75dc
jmp 0x4e763f
xor eax, eax
lea rbx, [rsp + 0x28]
mov ecx, 8
call fcn.00444780
add rsp, 0x30
pop rbp
ret
mov eax, esi
mov ecx, 8
call fcn.00456440
mov eax, edi
mov ecx, 8
call fcn.00456440
nop
call fcn.00454160
nop dword [rax]
jmp fcn.004e75a0

Function at 0x4e7700
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4e77e6
push rbp
mov rbp, rsp
sub rsp, 0x40
movabs rdx, 0x272cae36c80ee81
mov qword [rsp + 0x31], rdx
movabs rdx, 0x79f261eb78ffeb02
mov qword [rsp + 0x38], rdx
movabs rdx, 0xb04020b01070004
mov qword [rsp + 0x1f], rdx
movabs rdx, 0xe0a0b04020b0107
mov qword [rsp + 0x21], rdx
movabs rdx, 0x5080e0a0908090d
mov qword [rsp + 0x29], rdx
xor eax, eax
nop
jmp 0x4e7780
movzx r9d, byte [rsp + rsi + 0x31]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x69]
mov byte [rsp + rdi + 0x31], dl
mov byte [rsp + rsi + 0x31], r8b
add rax, 2
nop dword [rax]
cmp rax, 0x12
jge 0x4e77b2
movzx edx, byte [rsp + rax + 0x1f]
movzx esi, byte [rsp + rax + 0x20]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0xf
jae 0x4e77d7
movzx r8d, byte [rsp + rdi + 0x31]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x69]
cmp rsi, 0xf
jb 0x4e7762
jmp 0x4e77cb
xor eax, eax
lea rbx, [rsp + 0x31]
mov ecx, 0xf
nop
call fcn.00444780
add rsp, 0x40
pop rbp
ret
mov eax, esi
mov ecx, 0xf
call fcn.00456440
mov eax, edi
mov ecx, 0xf
nop
call fcn.00456440
nop
call fcn.00454160
jmp fcn.004e7700

Function at 0x4e7800
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4e78bd
push rbp
mov rbp, rsp
sub rsp, 0x30
movabs rdx, 0x655a53545943695d
mov qword [rsp + 0x27], rdx
mov byte [rsp + 0x2f], 0x5c
movabs rdx, 0x704000203030505
mov qword [rsp + 0x1b], rdx
mov dword [rsp + 0x23], 0x3060801
xor eax, eax
nop
jmp 0x4e7860
movzx r9d, byte [rsp + rsi + 0x27]
sub r9d, edx
lea edx, [r9 + 0x16]
mov byte [rsp + rdi + 0x27], dl
lea edx, [r8 + 0x16]
mov byte [rsp + rsi + 0x27], dl
add rax, 2
nop
cmp rax, 0xc
jge 0x4e788d
movzx edx, byte [rsp + rax + 0x1b]
movzx esi, byte [rsp + rax + 0x1c]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 9
jae 0x4e78b0
movzx r8d, byte [rsp + rdi + 0x27]
sub r8d, edx
cmp rsi, 9
jb 0x4e7842
jmp 0x4e78a4
xor eax, eax
lea rbx, [rsp + 0x27]
mov ecx, 9
call fcn.00444780
add rsp, 0x30
pop rbp
ret
mov eax, esi
mov ecx, 9
call fcn.00456440
mov eax, edi
mov ecx, 9
call fcn.00456440
nop
nop dword [rax]
call fcn.00454160
jmp fcn.004e7800
Function at 0x4e78e0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4e799d
push rbp
mov rbp, rsp
sub rsp, 0x30
movabs rdx, 0x74c0806172f4b99c
mov qword [rsp + 0x26], rdx
mov word [rsp + 0x2e], 0x619f
movabs rdx, 0x601010608000802
mov qword [rsp + 0x1c], rdx
mov word [rsp + 0x24], 5
xor eax, eax
jmp 0x4e7940
movzx r9d, byte [rsp + rsi + 0x26]
sub r9d, edx
lea edx, [r9 - 0x20]
mov byte [rsp + rdi + 0x26], dl
lea edx, [r8 - 0x20]
mov byte [rsp + rsi + 0x26], dl
add rax, 2
nop
cmp rax, 0xa
jge 0x4e796d
movzx edx, byte [rsp + rax + 0x1c]
movzx esi, byte [rsp + rax + 0x1d]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0xa
jae 0x4e7990
movzx r8d, byte [rsp + rdi + 0x26]
sub r8d, edx
cmp rsi, 0xa
jb 0x4e7922
jmp 0x4e7984
xor eax, eax
lea rbx, [rsp + 0x26]
mov ecx, 0xa
call fcn.00444780
add rsp, 0x30
pop rbp
ret
mov eax, esi
mov ecx, 0xa
call fcn.00456440
mov eax, edi
mov ecx, 0xa
call fcn.00456440
nop
nop dword [rax]
call fcn.00454160
jmp fcn.004e78e0

Function at 0x4e8040
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4e8106
push rbp
mov rbp, rsp
sub rsp, 0x30
movabs rdx, 0x9365ca619ffc8e53
mov qword [rsp + 0x27], rdx
mov byte [rsp + 0x2f], 0x8f
movabs rdx, 0x702010308050502
mov qword [rsp + 0x1b], rdx
mov dword [rsp + 0x23], 0x8070808
xor eax, eax
nop
jmp 0x4e80a0
movzx r9d, byte [rsp + rsi + 0x27]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x30]
mov byte [rsp + rdi + 0x27], dl
mov byte [rsp + rsi + 0x27], r8b
add rax, 2
nop dword [rax]
cmp rax, 0xc
jge 0x4e80d2
movzx edx, byte [rsp + rax + 0x1b]
movzx esi, byte [rsp + rax + 0x1c]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 9
jae 0x4e80f7
movzx r8d, byte [rsp + rdi + 0x27]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x30]
cmp rsi, 9
jb 0x4e8082
jmp 0x4e80eb
xor eax, eax
lea rbx, [rsp + 0x27]
mov ecx, 9
nop
call fcn.00444780
add rsp, 0x30
pop rbp
ret
mov eax, esi
mov ecx, 9
call fcn.00456440
mov eax, edi
mov ecx, 9
nop
call fcn.00456440
nop
call fcn.00454160
jmp fcn.004e8040

Function at 0x4e8540
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4e85f8
push rbp
mov rbp, rsp
sub rsp, 0x30
movabs rdx, 0x7d76786eeef66954
mov qword [rsp + 0x28], rdx
movabs rdx, 0x705060307060202
mov qword [rsp + 0x1e], rdx
mov word [rsp + 0x26], 0x707
xor eax, eax
jmp 0x4e8595
movzx r9d, byte [rsp + rsi + 0x28]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x70]
mov byte [rsp + rdi + 0x28], dl
mov byte [rsp + rsi + 0x28], r8b
add rax, 2
cmp rax, 0xa
jge 0x4e85c8
movzx edx, byte [rsp + rax + 0x1e]
movzx esi, byte [rsp + rax + 0x1f]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 8
jae 0x4e85eb
movzx r8d, byte [rsp + rdi + 0x28]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x70]
nop
cmp rsi, 8
jb 0x4e857b
jmp 0x4e85df
xor eax, eax
lea rbx, [rsp + 0x28]
mov ecx, 8
call fcn.00444780
add rsp, 0x30
pop rbp
ret
mov eax, esi
mov ecx, 8
call fcn.00456440
mov eax, edi
mov ecx, 8
call fcn.00456440
nop
call fcn.00454160
nop dword [rax]
jmp fcn.004e8540
Function at 0x4e8c60
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4e8d27
push rbp
mov rbp, rsp
sub rsp, 0x38
movabs rdx, 0x725f81938da1846a
mov qword [rsp + 0x2d], rdx
mov dword [rsp + 0x34], 0x7f7c9a72
movabs rdx, 0x403000a050704
mov qword [rsp + 0x1d], rdx
movabs rdx, 0x703010908070201
mov qword [rsp + 0x25], rdx
xor eax, eax
jmp 0x4e8cc8
movzx r9d, byte [rsp + rsi + 0x2d]
sub r9d, edx
lea edx, [r9 - 7]
mov byte [rsp + rdi + 0x2d], dl
lea edx, [r8 - 7]
mov byte [rsp + rsi + 0x2d], dl
add rax, 2
cmp rax, 0x10
jge 0x4e8cf7
movzx edx, byte [rsp + rax + 0x1d]
movzx esi, byte [rsp + rax + 0x1e]
mov edi, edx
xor edx, esi
add edx, eax
nop
cmp rdi, 0xb
jae 0x4e8d1a
movzx r8d, byte [rsp + rdi + 0x2d]
sub r8d, edx
cmp rsi, 0xb
jb 0x4e8cab
jmp 0x4e8d0e
xor eax, eax
lea rbx, [rsp + 0x2d]
mov ecx, 0xb
call fcn.00444780
add rsp, 0x38
pop rbp
ret
mov eax, esi
mov ecx, 0xb
call fcn.00456440
mov eax, edi
mov ecx, 0xb
call fcn.00456440
nop
call fcn.00454160
jmp fcn.004e8c60

Function at 0x4e90a0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4e9166
push rbp
mov rbp, rsp
sub rsp, 0x30
movabs rdx, 0xdf6f2d4269646945
mov qword [rsp + 0x24], rdx
mov dword [rsp + 0x2c], 0x6ca53f13
movabs rdx, 0xa09040407040800
mov qword [rsp + 0x18], rdx
mov dword [rsp + 0x20], 0x4050904
xor eax, eax
jmp 0x4e9100
movzx r9d, byte [rsp + rsi + 0x24]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x27]
mov byte [rsp + rdi + 0x24], dl
mov byte [rsp + rsi + 0x24], r8b
add rax, 2
nop
cmp rax, 0xc
jge 0x4e9132
movzx edx, byte [rsp + rax + 0x18]
movzx esi, byte [rsp + rax + 0x19]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0xc
jae 0x4e9157
movzx r8d, byte [rsp + rdi + 0x24]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x27]
cmp rsi, 0xc
jb 0x4e90e4
jmp 0x4e914b
xor eax, eax
lea rbx, [rsp + 0x24]
mov ecx, 0xc
nop
call fcn.00444780
add rsp, 0x30
pop rbp
ret
mov eax, esi
mov ecx, 0xc
call fcn.00456440
mov eax, edi
mov ecx, 0xc
nop
call fcn.00456440
nop
call fcn.00454160
jmp fcn.004e90a0

Function at 0x4ea3c0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4ea498
push rbp
mov rbp, rsp
sub rsp, 0x38
movabs rdx, 0x2eec0c5f6ea810f7
mov qword [rsp + 0x2c], rdx
mov dword [rsp + 0x34], 0x2b6f7264
movabs rdx, 0x6050008000206
mov qword [rsp + 0x1a], rdx
movabs rdx, 0x501000605000800
mov qword [rsp + 0x1c], rdx
movabs rdx, 0x708020b02010200
mov qword [rsp + 0x24], rdx
xor eax, eax
jmp 0x4ea434
movzx r9d, byte [rsp + rsi + 0x2c]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x27]
mov byte [rsp + rdi + 0x2c], dl
mov byte [rsp + rsi + 0x2c], r8b
add rax, 2
cmp rax, 0x12
jge 0x4ea468
movzx edx, byte [rsp + rax + 0x1a]
movzx esi, byte [rsp + rax + 0x1b]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0xc
jae 0x4ea48b
movzx r8d, byte [rsp + rdi + 0x2c]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x27]
nop
cmp rsi, 0xc
jb 0x4ea41a
jmp 0x4ea47f
xor eax, eax
lea rbx, [rsp + 0x2c]
mov ecx, 0xc
call fcn.00444780
add rsp, 0x38
pop rbp
ret
mov eax, esi
mov ecx, 0xc
call fcn.00456440
mov eax, edi
mov ecx, 0xc
call fcn.00456440
nop
call fcn.00454160
nop dword [rax]
jmp fcn.004ea3c0
Function at 0x4eb960
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4eba3d
push rbp
mov rbp, rsp
sub rsp, 0x40
movabs rdx, 0x446ef672b4dad0e8
mov qword [rsp + 0x32], rdx
movabs rdx, 0xce72aaf9bd5f446e
mov qword [rsp + 0x38], rdx
movabs rdx, 0x5060b0b09090900
mov qword [rsp + 0x1e], rdx
movabs rdx, 0x503000a05060b0b
mov qword [rsp + 0x22], rdx
movabs rdx, 0x20d030106000a01
mov qword [rsp + 0x2a], rdx
xor eax, eax
nop
jmp 0x4eb9e0
movzx r9d, byte [rsp + rsi + 0x32]
sub r9d, edx
lea edx, [r9 - 0x45]
mov byte [rsp + rdi + 0x32], dl
lea edx, [r8 - 0x45]
mov byte [rsp + rsi + 0x32], dl
add rax, 2
nop
cmp rax, 0x14
jge 0x4eba0d
movzx edx, byte [rsp + rax + 0x1e]
movzx esi, byte [rsp + rax + 0x1f]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0xe
jae 0x4eba30
movzx r8d, byte [rsp + rdi + 0x32]
sub r8d, edx
cmp rsi, 0xe
jb 0x4eb9c2
jmp 0x4eba24
xor eax, eax
lea rbx, [rsp + 0x32]
mov ecx, 0xe
call fcn.00444780
add rsp, 0x40
pop rbp
ret
mov eax, esi
mov ecx, 0xe
call fcn.00456440
mov eax, edi
mov ecx, 0xe
call fcn.00456440
nop
nop dword [rax]
call fcn.00454160
jmp fcn.004eb960

Function at 0x4ecf40
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4ed012
push rbp
mov rbp, rsp
sub rsp, 0x38
movabs rdx, 0x5650716f5c4e7551
mov qword [rsp + 0x2a], rdx
movabs rdx, 0x66726b4d546e5650
mov qword [rsp + 0x30], rdx
movabs rdx, 0x40307050b0d0707
mov qword [rsp + 0x1a], rdx
movabs rdx, 0x9020b060b09050b
mov qword [rsp + 0x22], rdx
xor eax, eax
jmp 0x4ecfac
movzx r9d, byte [rsp + rsi + 0x2a]
lea edx, [r9 + rdx]
lea edx, [rdx - 8]
mov byte [rsp + rdi + 0x2a], dl
mov byte [rsp + rsi + 0x2a], r8b
add rax, 2
cmp rax, 0x10
jge 0x4ecfde
movzx edx, byte [rsp + rax + 0x1a]
movzx esi, byte [rsp + rax + 0x1b]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0xe
jae 0x4ed005
movzx r8d, byte [rsp + rdi + 0x2a]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 8]
cmp rsi, 0xe
jb 0x4ecf92
jmp 0x4ecff5
xor eax, eax
lea rbx, [rsp + 0x2a]
mov ecx, 0xe
call fcn.00444780
add rsp, 0x38
pop rbp
ret
mov eax, esi
mov ecx, 0xe
nop dword [rax]
call fcn.00456440
mov eax, edi
mov ecx, 0xe
call fcn.00456440
nop
call fcn.00454160
jmp fcn.004ecf40
Function at 0x4ed700
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4ed7ec
push rbp
mov rbp, rsp
sub rsp, 0x40
movabs rdx, 0x65636e857d956c53
mov qword [rsp + 0x2f], rdx
movabs rdx, 0x8965636e857d956c
mov qword [rsp + 0x30], rdx
movabs rdx, 0x6a709b6883776595
mov qword [rsp + 0x38], rdx
movabs rdx, 0xd100e041008090b
mov qword [rsp + 0x1d], rdx
movabs rdx, 0xd020d100e041008
mov qword [rsp + 0x1f], rdx
movabs rdx, 0x4100304010f0d0c
mov qword [rsp + 0x27], rdx
xor eax, eax
jmp 0x4ed78a
movzx r9d, byte [rsp + rsi + 0x2f]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x25]
mov byte [rsp + rdi + 0x2f], dl
mov byte [rsp + rsi + 0x2f], r8b
add rax, 2
cmp rax, 0x12
jge 0x4ed7bc
movzx edx, byte [rsp + rax + 0x1d]
movzx esi, byte [rsp + rax + 0x1e]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x11
jae 0x4ed7df
movzx r8d, byte [rsp + rdi + 0x2f]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x25]
cmp rsi, 0x11
jb 0x4ed770
jmp 0x4ed7d3
xor eax, eax
lea rbx, [rsp + 0x2f]
mov ecx, 0x11
call fcn.00444780
add rsp, 0x40
pop rbp
ret
mov eax, esi
mov ecx, 0x11
call fcn.00456440
mov eax, edi
mov ecx, 0x11
call fcn.00456440
nop
call fcn.00454160
jmp fcn.004ed700

Function at 0x4ee580
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4ee67b
push rbp
mov rbp, rsp
sub rsp, 0x48
movabs rdx, 0xd2974061aeace056
mov qword [rsp + 0x36], rdx
movabs rdx, 0x5f6ed2974061aeac
mov qword [rsp + 0x38], rdx
movabs rdx, 0x72a074a4d7fa03c8
mov qword [rsp + 0x40], rdx
movabs rdx, 0xd02020b010c100b
mov qword [rsp + 0x1c], rdx
movabs rdx, 0xd050c100a100701
mov qword [rsp + 0x24], rdx
movabs rdx, 0x10a0d050c100a10
mov qword [rsp + 0x26], rdx
movabs rdx, 0xe060e0203050d02
mov qword [rsp + 0x2e], rdx
xor eax, eax
jmp 0x4ee619
movzx r9d, byte [rsp + rsi + 0x36]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x54]
mov byte [rsp + rdi + 0x36], dl
mov byte [rsp + rsi + 0x36], r8b
add rax, 2
cmp rax, 0x1a
jge 0x4ee64b
movzx edx, byte [rsp + rax + 0x1c]
movzx esi, byte [rsp + rax + 0x1d]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x12
jae 0x4ee66e
movzx r8d, byte [rsp + rdi + 0x36]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x54]
cmp rsi, 0x12
jb 0x4ee5ff
jmp 0x4ee662
xor eax, eax
lea rbx, [rsp + 0x36]
mov ecx, 0x12
call fcn.00444780
add rsp, 0x48
pop rbp
ret
mov eax, esi
mov ecx, 0x12
call fcn.00456440
mov eax, edi
mov ecx, 0x12
call fcn.00456440
nop
nop dword [rax + rax]
call fcn.00454160
jmp fcn.004ee580
Function at 0x4f8c20
Capabilities:
Resolve function by parsing pe exports

Disassembly:
lea r12, [rsp - 0x18]
cmp r12, qword [r14 + 0x10]
jbe 0x4f8def
push rbp
mov rbp, rsp
sub rsp, 0x90
mov qword [rsp + 0xa0], rax
mov qword [rsp + 0xa8], rbx
mov rdx, rcx
and ecx, 0x1f
cmp rcx, 0x19
jne 0x4f8d8c
nop word [rax + rax]
cmp qword [rax + 0x40], rdi
jbe 0x4f8d73
mov rsi, qword [rax + 0x38]
lea rdi, [rdi + rdi*2]
mov r8, qword [rsi + rdi*8 + 8]
and edx, 0x1a0
mov r9, qword [rsi + rdi*8]
movzx r10d, byte [r8 + 0x17]
and r10d, 0x1f
movzx r9d, byte [r9]
or rdx, r10
nop
test r9b, 1
jne 0x4f8cad
mov r10, rdx
or r10, 0x40
or rdx, 0x20
nop
nop
test r9b, 8
cmovne rdx, r10
nop
movabs r9, 0xde725a1cf15dba90
mov qword [rsp + 0x3c], r9
movabs r9, 0x3b857506b601190f
mov qword [rsp + 0x44], r9
movabs r9, 0x487bf1e23b857506
mov qword [rsp + 0x48], r9
movabs r9, 0xcf3f46b7aeb949b5
mov qword [rsp + 0x50], r9
xor eax, eax
jmp 0x4f8d0b
lea r9, [0x00567426]
movzx r10d, byte [r9 + rax]
movzx r11d, byte [rsp + rax + 0x3c]
add r10d, r11d
mov byte [rsp + rax + 0x3c], r10b
inc rax
cmp rax, 0x1c
jl 0x4f8cee
mov qword [rsp + 0x70], r8
mov qword [rsp + 0x88], rsi
mov qword [rsp + 0x80], rbx
mov qword [rsp + 0x68], rdi
mov qword [rsp + 0x58], rdx
lea rax, [rsp + 0x1c]
lea rbx, [rsp + 0x3c]
mov ecx, 0x1c
nop
call fcn.00444780
mov rbx, qword [rsp + 0x80]
mov rdx, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x88]
add rbx, qword [rsi + rdx*8 + 0x10]
nop
mov rax, qword [rsp + 0x70]
mov rcx, qword [rsp + 0x58]
add rsp, 0x90
pop rbp
ret
call fcn.0050c920
call fcn.00409940
mov rbx, rax
lea rax, [0x005424c0]
call fcn.0042ef20
mov qword [rsp + 0x60], rcx
call fcn.0050c660
mov qword [rsp + 0x68], rbx
mov qword [rsp + 0x78], rax
lea rax, [0x0054e960]
call fcn.0040c480
mov rcx, qword [rsp + 0x68]
mov qword [rax + 8], rcx
cmp dword [0x007ed7f0], 0
jne 0x4f8dde
mov rcx, qword [rsp + 0x78]
mov qword [rax], rcx
mov rcx, qword [rsp + 0x60]
mov qword [rax + 0x10], rcx
mov rbx, rax
lea rax, [0x005495c0]
call fcn.0042ef20
nop
call fcn.00456080
mov rcx, qword [rsp + 0x78]
mov qword [r11], rcx
jmp 0x4f8dbe
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
call fcn.00454160
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
nop dword [rax]
jmp fcn.004f8c20
Function at 0x4fb620
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4fb73a
push rbp
mov rbp, rsp
sub rsp, 0x58
movabs rdx, 0xc149c572cba36ece
mov qword [rsp + 0x3e], rdx
movabs rdx, 0x419e08ea20f442bd
mov qword [rsp + 0x46], rdx
movabs rdx, 0x656d419e08ea20f4
mov qword [rsp + 0x48], rdx
movabs rdx, 0x647cdf15c59ea4dd
mov qword [rsp + 0x50], rdx
movabs rdx, 0x608020d130c0407
mov qword [rsp + 0x1a], rdx
movabs rdx, 0x1617080a0608020d
mov qword [rsp + 0x1e], rdx
movabs rdx, 0x1213180a17000608
mov qword [rsp + 0x26], rdx
movabs rdx, 0xf1514000e020503
mov qword [rsp + 0x2e], rdx
movabs rdx, 0xf0e161318031705
mov qword [rsp + 0x36], rdx
xor eax, eax
jmp 0x4fb6d7
movzx r9d, byte [rsp + rsi + 0x3e]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x55]
mov byte [rsp + rdi + 0x3e], dl
mov byte [rsp + rsi + 0x3e], r8b
add rax, 2
cmp rax, 0x24
jge 0x4fb709
movzx edx, byte [rsp + rax + 0x1a]
movzx esi, byte [rsp + rax + 0x1b]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x1a
jae 0x4fb72d
movzx r8d, byte [rsp + rdi + 0x3e]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x55]
cmp rsi, 0x1a
jb 0x4fb6bd
jmp 0x4fb721
xor eax, eax
lea rbx, [rsp + 0x3e]
mov ecx, 0x1a
call fcn.00444780
add rsp, 0x58
pop rbp
nop
ret
mov eax, esi
mov ecx, 0x1a
call fcn.00456440
mov eax, edi
mov ecx, 0x1a
call fcn.00456440
nop
call fcn.00454160
nop
jmp fcn.004fb620

Function at 0x4fd060
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4fd15d
push rbp
mov rbp, rsp
sub rsp, 0x50
movabs rdx, 0xee706de6fc6572ec
mov qword [rsp + 0x38], rdx
movabs rdx, 0xfb92e033ee160508
mov qword [rsp + 0x40], rdx
movabs rdx, 0x79657305fc6f0910
mov qword [rsp + 0x48], rdx
movabs rdx, 0x110d07000a0d1710
mov qword [rsp + 0x1c], rdx
movabs rdx, 0x1009140314070e04
mov qword [rsp + 0x24], rdx
movabs rdx, 0xc0f031710091403
mov qword [rsp + 0x28], rdx
movabs rdx, 0x804111703130b0f
mov qword [rsp + 0x30], rdx
xor eax, eax
jmp 0x4fd100
movzx r9d, byte [rsp + rsi + 0x38]
sub r9d, edx
lea edx, [r9 - 0x73]
mov byte [rsp + rdi + 0x38], dl
lea edx, [r8 - 0x73]
mov byte [rsp + rsi + 0x38], dl
add rax, 2
nop dword [rax]
cmp rax, 0x1c
jge 0x4fd12d
movzx edx, byte [rsp + rax + 0x1c]
movzx esi, byte [rsp + rax + 0x1d]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x18
jae 0x4fd150
movzx r8d, byte [rsp + rdi + 0x38]
sub r8d, edx
cmp rsi, 0x18
jb 0x4fd0df
jmp 0x4fd144
xor eax, eax
lea rbx, [rsp + 0x38]
mov ecx, 0x18
call fcn.00444780
add rsp, 0x50
pop rbp
ret
mov eax, esi
mov ecx, 0x18
call fcn.00456440
mov eax, edi
mov ecx, 0x18
call fcn.00456440
nop
nop dword [rax]
call fcn.00454160
jmp fcn.004fd060