joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4c82c0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
sub rsp, 0x38
mov qword [rsp + 0x30], rbp
lea rbp, [rsp + 0x30]
mov qword [rsp + 0x40], 0
movabs rdx, 0xff444953a900765e
mov qword [rsp + 0x1e], rdx
movabs rdx, 0x101000205010402
mov qword [rsp + 0x26], rdx
mov word [rsp + 0x2e], 0x104
xor eax, eax
nop
jmp 0x4c8320
movzx r8d, byte [rsp + rbx + 0x1e]
sub r8d, edx
lea edx, [r8 + 0x3a]
mov byte [rsp + rsi + 0x1e], dl
lea edx, [rdi + 0x3a]
mov byte [rsp + rbx + 0x1e], dl
add rax, 2
nop
cmp rax, 0xa
jge 0x4c8355
movzx edx, byte [rsp + rax + 0x26]
lea rbx, [rax + 1]
cmp rbx, 0xa
jae 0x4c83a5
movzx ebx, byte [rsp + rax + 0x27]
mov esi, edx
xor edx, ebx
add edx, eax
cmp rsi, 8
jae 0x4c8394
movzx edi, byte [rsp + rsi + 0x1e]
sub edi, edx
cmp rbx, 8
jb 0x4c8302
jmp 0x4c8388
mov qword [rsp + 0x16], 0
xor eax, eax
jmp 0x4c836e
movzx ecx, byte [rsp + rax + 0x1e]
mov byte [rsp + rax + 0x16], cl
inc rax
cmp rax, 8
jl 0x4c8362
mov rax, qword [rsp + 0x16]
mov qword [rsp + 0x40], rax
mov rbp, qword [rsp + 0x30]
add rsp, 0x38
ret
mov eax, ebx
mov ecx, 8
call fcn.00456360
mov eax, esi
mov ecx, 8
nop dword [rax + rax]
call fcn.00456360
mov rax, rbx
mov ecx, 0xa
call fcn.00456360
nop
int3

Function at 0x4ca360
Capabilities:
Encrypt data using rc4 prga

Disassembly:
sub rsp, 0x38
mov qword [rsp + 0x30], rbp
lea rbp, [rsp + 0x30]
mov qword [rsp + 0x40], 0
movabs rdx, 0x7bcab2d29cca9ffb
mov qword [rsp + 0x1e], rdx
movabs rdx, 0x605000300040102
mov qword [rsp + 0x26], rdx
mov word [rsp + 0x2e], 0x300
xor eax, eax
nop
jmp 0x4ca3c0
movzx r8d, byte [rsp + rbx + 0x1e]
sub r8d, edx
lea edx, [r8 - 0x63]
mov byte [rsp + rsi + 0x1e], dl
lea edx, [rdi - 0x63]
mov byte [rsp + rbx + 0x1e], dl
add rax, 2
nop
cmp rax, 0xa
jge 0x4ca3f5
movzx edx, byte [rsp + rax + 0x26]
lea rbx, [rax + 1]
cmp rbx, 0xa
jae 0x4ca445
movzx ebx, byte [rsp + rax + 0x27]
mov esi, edx
xor edx, ebx
add edx, eax
cmp rsi, 8
jae 0x4ca434
movzx edi, byte [rsp + rsi + 0x1e]
sub edi, edx
cmp rbx, 8
jb 0x4ca3a2
jmp 0x4ca428
mov qword [rsp + 0x16], 0
xor eax, eax
jmp 0x4ca40e
movzx ecx, byte [rsp + rax + 0x1e]
mov byte [rsp + rax + 0x16], cl
inc rax
cmp rax, 8
jl 0x4ca402
mov rax, qword [rsp + 0x16]
mov qword [rsp + 0x40], rax
mov rbp, qword [rsp + 0x30]
add rsp, 0x38
ret
mov eax, ebx
mov ecx, 8
call fcn.00456360
mov eax, esi
mov ecx, 8
nop dword [rax + rax]
call fcn.00456360
mov rax, rbx
mov ecx, 0xa
call fcn.00456360
nop
int3
Function at 0x4ca460
Capabilities:
Encrypt data using rc4 prga

Disassembly:
sub rsp, 0x30
mov qword [rsp + 0x28], rbp
lea rbp, [rsp + 0x28]
mov qword [rsp + 0x38], 0
movabs rdx, 0xc0045f83ffae1fc9
mov qword [rsp + 0x20], rdx
movabs rdx, 0x203040200010603
mov qword [rsp + 0x10], rdx
xor eax, eax
jmp 0x4ca4b5
movzx r8d, byte [rsp + rbx + 0x20]
sub r8d, edx
lea edx, [r8 + 0x7f]
mov byte [rsp + rsi + 0x20], dl
lea edx, [rdi + 0x7f]
mov byte [rsp + rbx + 0x20], dl
add rax, 2
cmp rax, 8
jge 0x4ca4ea
movzx edx, byte [rsp + rax + 0x10]
lea rbx, [rax + 1]
cmp rbx, 8
jae 0x4ca535
movzx ebx, byte [rsp + rax + 0x11]
mov esi, edx
xor edx, ebx
add edx, eax
cmp rsi, 8
jae 0x4ca529
movzx edi, byte [rsp + rsi + 0x20]
sub edi, edx
cmp rbx, 8
jb 0x4ca499
jmp 0x4ca51d
mov qword [rsp + 0x18], 0
xor eax, eax
jmp 0x4ca503
movzx ecx, byte [rsp + rax + 0x20]
mov byte [rsp + rax + 0x18], cl
inc rax
cmp rax, 8
jl 0x4ca4f7
mov rax, qword [rsp + 0x18]
mov qword [rsp + 0x38], rax
mov rbp, qword [rsp + 0x28]
add rsp, 0x30
ret
mov eax, ebx
mov ecx, 8
call fcn.00456360
mov eax, esi
mov ecx, 8
call fcn.00456360
mov rax, rbx
mov ecx, 8
nop dword [rax]
call fcn.00456360
nop
int3

Function at 0x4cbf00
Capabilities:
Encrypt data using rc4 prga

Disassembly:
sub rsp, 0x38
mov qword [rsp + 0x30], rbp
lea rbp, [rsp + 0x30]
mov qword [rsp + 0x40], 0
movabs rdx, 0x7c9b02181d836ef4
mov qword [rsp + 0x1c], rdx
movabs rdx, 0x602020003030000
mov qword [rsp + 0x24], rdx
mov dword [rsp + 0x2c], 0x2030401
xor eax, eax
nop
jmp 0x4cbf60
movzx r8d, byte [rsp + rbx + 0x1c]
lea edx, [r8 + rdx]
lea edx, [rdx + 0xe]
mov byte [rsp + rsi + 0x1c], dl
mov byte [rsp + rbx + 0x1c], dil
add rax, 2
nop dword [rax]
cmp rax, 0xc
jge 0x4cbf99
movzx edx, byte [rsp + rax + 0x24]
lea rbx, [rax + 1]
cmp rbx, 0xc
jae 0x4cbfe5
movzx ebx, byte [rsp + rax + 0x25]
mov esi, edx
xor edx, ebx
add edx, eax
cmp rsi, 8
jae 0x4cbfd8
movzx edi, byte [rsp + rsi + 0x1c]
lea edi, [rdi + rdx]
lea edi, [rdi + 0xe]
cmp rbx, 8
jb 0x4cbf42
jmp 0x4cbfcc
mov qword [rsp + 0x14], 0
xor eax, eax
jmp 0x4cbfb2
movzx ecx, byte [rsp + rax + 0x1c]
mov byte [rsp + rax + 0x14], cl
inc rax
cmp rax, 8
jl 0x4cbfa6
mov rax, qword [rsp + 0x14]
mov qword [rsp + 0x40], rax
mov rbp, qword [rsp + 0x30]
add rsp, 0x38
ret
mov eax, ebx
mov ecx, 8
call fcn.00456360
mov eax, esi
mov ecx, 8
nop
call fcn.00456360
mov rax, rbx
mov ecx, 0xc
call fcn.00456360
nop
int3
Function at 0x4cc3e0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
sub rsp, 0x38
mov qword [rsp + 0x30], rbp
lea rbp, [rsp + 0x30]
mov qword [rsp + 0x40], 0
movabs rdx, 0xa53a6d577ec3c6a7
mov qword [rsp + 0x1c], rdx
movabs rdx, 0x506020706050403
mov qword [rsp + 0x24], rdx
mov dword [rsp + 0x2c], 0x7010207
xor eax, eax
nop
jmp 0x4cc440
movzx r8d, byte [rsp + rbx + 0x1c]
lea edx, [r8 + rdx]
lea edx, [rdx - 0x11]
mov byte [rsp + rsi + 0x1c], dl
mov byte [rsp + rbx + 0x1c], dil
add rax, 2
nop dword [rax]
cmp rax, 0xc
jge 0x4cc479
movzx edx, byte [rsp + rax + 0x24]
lea rbx, [rax + 1]
cmp rbx, 0xc
jae 0x4cc4c5
movzx ebx, byte [rsp + rax + 0x25]
mov esi, edx
xor edx, ebx
add edx, eax
cmp rsi, 8
jae 0x4cc4b8
movzx edi, byte [rsp + rsi + 0x1c]
lea edi, [rdi + rdx]
lea edi, [rdi - 0x11]
cmp rbx, 8
jb 0x4cc422
jmp 0x4cc4ac
mov qword [rsp + 0x14], 0
xor eax, eax
jmp 0x4cc492
movzx ecx, byte [rsp + rax + 0x1c]
mov byte [rsp + rax + 0x14], cl
inc rax
cmp rax, 8
jl 0x4cc486
mov rax, qword [rsp + 0x14]
mov qword [rsp + 0x40], rax
mov rbp, qword [rsp + 0x30]
add rsp, 0x38
ret
mov eax, ebx
mov ecx, 8
call fcn.00456360
mov eax, esi
mov ecx, 8
nop
call fcn.00456360
mov rax, rbx
mov ecx, 0xc
call fcn.00456360
nop
int3

Function at 0x4cc780
Capabilities:
Encrypt data using rc4 prga

Disassembly:
sub rsp, 0x30
mov qword [rsp + 0x28], rbp
lea rbp, [rsp + 0x28]
mov qword [rsp + 0x38], 0
movabs rdx, 0xc8e7e300405f6de2
mov qword [rsp + 0x20], rdx
movabs rdx, 0x7000301050107
mov qword [rsp + 0x10], rdx
xor eax, eax
jmp 0x4cc7d3
movzx r8d, byte [rsp + rbx + 0x20]
lea edx, [r8 + rdx]
lea edx, [rdx - 0x71]
mov byte [rsp + rsi + 0x20], dl
mov byte [rsp + rbx + 0x20], dil
add rax, 2
cmp rax, 8
jge 0x4cc80c
movzx edx, byte [rsp + rax + 0x10]
lea rbx, [rax + 1]
cmp rbx, 8
jae 0x4cc857
movzx ebx, byte [rsp + rax + 0x11]
mov esi, edx
xor edx, ebx
add edx, eax
cmp rsi, 8
jae 0x4cc84b
movzx edi, byte [rsp + rsi + 0x20]
lea edi, [rdi + rdx]
lea edi, [rdi - 0x71]
cmp rbx, 8
jb 0x4cc7b9
jmp 0x4cc83f
mov qword [rsp + 0x18], 0
xor eax, eax
jmp 0x4cc825
movzx ecx, byte [rsp + rax + 0x20]
mov byte [rsp + rax + 0x18], cl
inc rax
cmp rax, 8
jl 0x4cc819
mov rax, qword [rsp + 0x18]
mov qword [rsp + 0x38], rax
mov rbp, qword [rsp + 0x28]
add rsp, 0x30
ret
mov eax, ebx
mov ecx, 8
call fcn.00456360
mov eax, esi
mov ecx, 8
call fcn.00456360
mov rax, rbx
mov ecx, 8
nop
call fcn.00456360
nop
int3
Function at 0x4ccca0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
sub rsp, 0x38
mov qword [rsp + 0x30], rbp
lea rbp, [rsp + 0x30]
mov qword [rsp + 0x40], 0
movabs rdx, 0x3e56bebae40ef4b8
mov qword [rsp + 0x1c], rdx
movabs rdx, 0x604010703070607
mov qword [rsp + 0x24], rdx
mov dword [rsp + 0x2c], 0x5050604
xor eax, eax
nop
jmp 0x4ccd00
movzx r8d, byte [rsp + rbx + 0x1c]
lea edx, [r8 + rdx]
lea edx, [rdx - 0x7a]
mov byte [rsp + rsi + 0x1c], dl
mov byte [rsp + rbx + 0x1c], dil
add rax, 2
nop dword [rax]
cmp rax, 0xc
jge 0x4ccd39
movzx edx, byte [rsp + rax + 0x24]
lea rbx, [rax + 1]
cmp rbx, 0xc
jae 0x4ccd85
movzx ebx, byte [rsp + rax + 0x25]
mov esi, edx
xor edx, ebx
add edx, eax
cmp rsi, 8
jae 0x4ccd78
movzx edi, byte [rsp + rsi + 0x1c]
lea edi, [rdi + rdx]
lea edi, [rdi - 0x7a]
cmp rbx, 8
jb 0x4ccce2
jmp 0x4ccd6c
mov qword [rsp + 0x14], 0
xor eax, eax
jmp 0x4ccd52
movzx ecx, byte [rsp + rax + 0x1c]
mov byte [rsp + rax + 0x14], cl
inc rax
cmp rax, 8
jl 0x4ccd46
mov rax, qword [rsp + 0x14]
mov qword [rsp + 0x40], rax
mov rbp, qword [rsp + 0x30]
add rsp, 0x38
ret
mov eax, ebx
mov ecx, 8
call fcn.00456360
mov eax, esi
mov ecx, 8
nop
call fcn.00456360
mov rax, rbx
mov ecx, 0xc
call fcn.00456360
nop
int3

Function at 0x4cd140
Capabilities:
Encrypt data using rc4 prga

Disassembly:
sub rsp, 0x30
mov qword [rsp + 0x28], rbp
lea rbp, [rsp + 0x28]
mov qword [rsp + 0x38], 0
movabs rdx, 0xabb022c344febe4
mov qword [rsp + 0x20], rdx
movabs rdx, 0x602060004010702
mov qword [rsp + 0x10], rdx
xor eax, eax
jmp 0x4cd193
movzx r8d, byte [rsp + rbx + 0x20]
lea edx, [r8 + rdx]
lea edx, [rdx - 0xe]
mov byte [rsp + rsi + 0x20], dl
mov byte [rsp + rbx + 0x20], dil
add rax, 2
cmp rax, 8
jge 0x4cd1cc
movzx edx, byte [rsp + rax + 0x10]
lea rbx, [rax + 1]
cmp rbx, 8
jae 0x4cd217
movzx ebx, byte [rsp + rax + 0x11]
mov esi, edx
xor edx, ebx
add edx, eax
cmp rsi, 8
jae 0x4cd20b
movzx edi, byte [rsp + rsi + 0x20]
lea edi, [rdi + rdx]
lea edi, [rdi - 0xe]
cmp rbx, 8
jb 0x4cd179
jmp 0x4cd1ff
mov qword [rsp + 0x18], 0
xor eax, eax
jmp 0x4cd1e5
movzx ecx, byte [rsp + rax + 0x20]
mov byte [rsp + rax + 0x18], cl
inc rax
cmp rax, 8
jl 0x4cd1d9
mov rax, qword [rsp + 0x18]
mov qword [rsp + 0x38], rax
mov rbp, qword [rsp + 0x28]
add rsp, 0x30
ret
mov eax, ebx
mov ecx, 8
call fcn.00456360
mov eax, esi
mov ecx, 8
call fcn.00456360
mov rax, rbx
mov ecx, 8
nop
call fcn.00456360
nop
int3
Function at 0x4cd240
Capabilities:
Encrypt data using rc4 prga

Disassembly:
sub rsp, 0x38
mov qword [rsp + 0x30], rbp
lea rbp, [rsp + 0x30]
mov qword [rsp + 0x40], 0
movabs rdx, 0x6e71fe78a989a85e
mov qword [rsp + 0x1c], rdx
movabs rdx, 0x204050706030002
mov qword [rsp + 0x24], rdx
mov dword [rsp + 0x2c], 0x7030207
xor eax, eax
nop
jmp 0x4cd2a0
movzx r8d, byte [rsp + rbx + 0x1c]
sub r8d, edx
lea edx, [r8 + 0x31]
mov byte [rsp + rsi + 0x1c], dl
lea edx, [rdi + 0x31]
mov byte [rsp + rbx + 0x1c], dl
add rax, 2
nop
cmp rax, 0xc
jge 0x4cd2d5
movzx edx, byte [rsp + rax + 0x24]
lea rbx, [rax + 1]
cmp rbx, 0xc
jae 0x4cd325
movzx ebx, byte [rsp + rax + 0x25]
mov esi, edx
xor edx, ebx
add edx, eax
cmp rsi, 8
jae 0x4cd314
movzx edi, byte [rsp + rsi + 0x1c]
sub edi, edx
cmp rbx, 8
jb 0x4cd282
jmp 0x4cd308
mov qword [rsp + 0x14], 0
xor eax, eax
jmp 0x4cd2ee
movzx ecx, byte [rsp + rax + 0x1c]
mov byte [rsp + rax + 0x14], cl
inc rax
cmp rax, 8
jl 0x4cd2e2
mov rax, qword [rsp + 0x14]
mov qword [rsp + 0x40], rax
mov rbp, qword [rsp + 0x30]
add rsp, 0x38
ret
mov eax, ebx
mov ecx, 8
call fcn.00456360
mov eax, esi
mov ecx, 8
nop dword [rax + rax]
call fcn.00456360
mov rax, rbx
mov ecx, 0xc
call fcn.00456360
nop
int3

Function at 0x4cd980
Capabilities:
Encrypt data using rc4 prga

Disassembly:
sub rsp, 0x30
mov qword [rsp + 0x28], rbp
lea rbp, [rsp + 0x28]
mov qword [rsp + 0x38], 0
movabs rdx, 0x83199314c702eeb7
mov qword [rsp + 0x20], rdx
movabs rdx, 0x503010305050704
mov qword [rsp + 0x10], rdx
xor eax, eax
jmp 0x4cd9d3
movzx r8d, byte [rsp + rbx + 0x20]
lea edx, [r8 + rdx]
lea edx, [rdx + 0x33]
mov byte [rsp + rsi + 0x20], dl
mov byte [rsp + rbx + 0x20], dil
add rax, 2
cmp rax, 8
jge 0x4cda0c
movzx edx, byte [rsp + rax + 0x10]
lea rbx, [rax + 1]
cmp rbx, 8
jae 0x4cda57
movzx ebx, byte [rsp + rax + 0x11]
mov esi, edx
xor edx, ebx
add edx, eax
cmp rsi, 8
jae 0x4cda4b
movzx edi, byte [rsp + rsi + 0x20]
lea edi, [rdi + rdx]
lea edi, [rdi + 0x33]
cmp rbx, 8
jb 0x4cd9b9
jmp 0x4cda3f
mov qword [rsp + 0x18], 0
xor eax, eax
jmp 0x4cda25
movzx ecx, byte [rsp + rax + 0x20]
mov byte [rsp + rax + 0x18], cl
inc rax
cmp rax, 8
jl 0x4cda19
mov rax, qword [rsp + 0x18]
mov qword [rsp + 0x38], rax
mov rbp, qword [rsp + 0x28]
add rsp, 0x30
ret
mov eax, ebx
mov ecx, 8
call fcn.00456360
mov eax, esi
mov ecx, 8
call fcn.00456360
mov rax, rbx
mov ecx, 8
nop
call fcn.00456360
nop
int3
Function at 0x4ceb20
Capabilities:
Encrypt data using rc4 prga

Disassembly:
sub rsp, 0x38
mov qword [rsp + 0x30], rbp
lea rbp, [rsp + 0x30]
mov qword [rsp + 0x40], 0
movabs rdx, 0x61894cee4a287021
mov qword [rsp + 0x1e], rdx
movabs rdx, 0x700040500030000
mov qword [rsp + 0x26], rdx
mov word [rsp + 0x2e], 0x106
xor eax, eax
nop
jmp 0x4ceb80
movzx r8d, byte [rsp + rbx + 0x1e]
sub r8d, edx
lea edx, [r8 + 0x5f]
mov byte [rsp + rsi + 0x1e], dl
lea edx, [rdi + 0x5f]
mov byte [rsp + rbx + 0x1e], dl
add rax, 2
nop
cmp rax, 0xa
jge 0x4cebb5
movzx edx, byte [rsp + rax + 0x26]
lea rbx, [rax + 1]
cmp rbx, 0xa
jae 0x4cec05
movzx ebx, byte [rsp + rax + 0x27]
mov esi, edx
xor edx, ebx
add edx, eax
cmp rsi, 8
jae 0x4cebf4
movzx edi, byte [rsp + rsi + 0x1e]
sub edi, edx
cmp rbx, 8
jb 0x4ceb62
jmp 0x4cebe8
mov qword [rsp + 0x16], 0
xor eax, eax
jmp 0x4cebce
movzx ecx, byte [rsp + rax + 0x1e]
mov byte [rsp + rax + 0x16], cl
inc rax
cmp rax, 8
jl 0x4cebc2
mov rax, qword [rsp + 0x16]
mov qword [rsp + 0x40], rax
mov rbp, qword [rsp + 0x30]
add rsp, 0x38
ret
mov eax, ebx
mov ecx, 8
call fcn.00456360
mov eax, esi
mov ecx, 8
nop dword [rax + rax]
call fcn.00456360
mov rax, rbx
mov ecx, 0xa
call fcn.00456360
nop
int3

Function at 0x4cf4c0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
sub rsp, 0x38
mov qword [rsp + 0x30], rbp
lea rbp, [rsp + 0x30]
mov qword [rsp + 0x40], 0
movabs rdx, 0x4760279a8138ee80
mov qword [rsp + 0x1e], rdx
movabs rdx, 0x301070606040606
mov qword [rsp + 0x26], rdx
mov word [rsp + 0x2e], 0x101
xor eax, eax
nop
jmp 0x4cf520
movzx r8d, byte [rsp + rbx + 0x1e]
sub r8d, edx
lea edx, [r8 - 0x6d]
mov byte [rsp + rsi + 0x1e], dl
lea edx, [rdi - 0x6d]
mov byte [rsp + rbx + 0x1e], dl
add rax, 2
nop
cmp rax, 0xa
jge 0x4cf555
movzx edx, byte [rsp + rax + 0x26]
lea rbx, [rax + 1]
cmp rbx, 0xa
jae 0x4cf5a5
movzx ebx, byte [rsp + rax + 0x27]
mov esi, edx
xor edx, ebx
add edx, eax
cmp rsi, 8
jae 0x4cf594
movzx edi, byte [rsp + rsi + 0x1e]
sub edi, edx
cmp rbx, 8
jb 0x4cf502
jmp 0x4cf588
mov qword [rsp + 0x16], 0
xor eax, eax
jmp 0x4cf56e
movzx ecx, byte [rsp + rax + 0x1e]
mov byte [rsp + rax + 0x16], cl
inc rax
cmp rax, 8
jl 0x4cf562
mov rax, qword [rsp + 0x16]
mov qword [rsp + 0x40], rax
mov rbp, qword [rsp + 0x30]
add rsp, 0x38
ret
mov eax, ebx
mov ecx, 8
call fcn.00456360
mov eax, esi
mov ecx, 8
nop dword [rax + rax]
call fcn.00456360
mov rax, rbx
mov ecx, 0xa
call fcn.00456360
nop
int3
Function at 0x4d1f80
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4d2073
sub rsp, 0x40
mov qword [rsp + 0x38], rbp
lea rbp, [rsp + 0x38]
movabs rdx, 0xf6eb617d818dec07
mov qword [rsp + 0x1c], rdx
mov dword [rsp + 0x24], 0x6cf0f12e
movabs rdx, 0x302000902020004
mov qword [rsp + 0x28], rdx
movabs rdx, 0x6020204010a0707
mov qword [rsp + 0x30], rdx
xor eax, eax
jmp 0x4d1feb
movzx r9d, byte [rsp + rsi + 0x1c]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x6b]
mov byte [rsp + rdi + 0x1c], dl
mov byte [rsp + rsi + 0x1c], r8b
add rax, 2
cmp rax, 0x10
jge 0x4d202d
movzx edx, byte [rsp + rax + 0x28]
lea rsi, [rax + 1]
nop word [rax + rax]
cmp rsi, 0x10
jae 0x4d2065
movzx esi, byte [rsp + rax + 0x29]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0xc
jae 0x4d2054
movzx r8d, byte [rsp + rdi + 0x1c]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x6b]
cmp rsi, 0xc
jb 0x4d1fd1
jmp 0x4d2048
xor eax, eax
lea rbx, [rsp + 0x1c]
mov ecx, 0xc
call fcn.00443880
mov rbp, qword [rsp + 0x38]
add rsp, 0x40
ret
mov eax, esi
mov ecx, 0xc
call fcn.00456360
mov eax, edi
mov ecx, 0xc
nop dword [rax + rax]
call fcn.00456360
mov rax, rsi
mov ecx, 0x10
call fcn.00456360
nop
call fcn.00453c40
jmp fcn.004d1f80

Function at 0x4d2d80
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4d2e73
sub rsp, 0x38
mov qword [rsp + 0x30], rbp
lea rbp, [rsp + 0x30]
movabs rdx, 0x2eebc16fcc636573
mov qword [rsp + 0x19], rdx
movabs rdx, 0x95ec962eebc16fcc
mov qword [rsp + 0x1c], rdx
movabs rdx, 0x908050609050803
mov qword [rsp + 0x24], rdx
mov dword [rsp + 0x2c], 0xa060a05
xor eax, eax
jmp 0x4d2deb
movzx r9d, byte [rsp + rsi + 0x19]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x39]
mov byte [rsp + rdi + 0x19], dl
mov byte [rsp + rsi + 0x19], r8b
add rax, 2
cmp rax, 0xc
jge 0x4d2e2d
movzx edx, byte [rsp + rax + 0x24]
lea rsi, [rax + 1]
nop word [rax + rax]
cmp rsi, 0xc
jae 0x4d2e65
movzx esi, byte [rsp + rax + 0x25]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0xb
jae 0x4d2e54
movzx r8d, byte [rsp + rdi + 0x19]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x39]
cmp rsi, 0xb
jb 0x4d2dd1
jmp 0x4d2e48
xor eax, eax
lea rbx, [rsp + 0x19]
mov ecx, 0xb
call fcn.00443880
mov rbp, qword [rsp + 0x30]
add rsp, 0x38
ret
mov eax, esi
mov ecx, 0xb
call fcn.00456360
mov eax, edi
mov ecx, 0xb
nop dword [rax + rax]
call fcn.00456360
mov rax, rsi
mov ecx, 0xc
call fcn.00456360
nop
call fcn.00453c40
jmp fcn.004d2d80
Function at 0x4d3840
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4d3933
sub rsp, 0x40
mov qword [rsp + 0x38], rbp
lea rbp, [rsp + 0x38]
movabs rdx, 0xfe56710d161117fe
mov qword [rsp + 0x1c], rdx
mov dword [rsp + 0x24], 0x6c9fa30e
movabs rdx, 0x204030506080506
mov qword [rsp + 0x28], rdx
movabs rdx, 0x7030a0700010900
mov qword [rsp + 0x30], rdx
xor eax, eax
jmp 0x4d38ab
movzx r9d, byte [rsp + rsi + 0x1c]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x55]
mov byte [rsp + rdi + 0x1c], dl
mov byte [rsp + rsi + 0x1c], r8b
add rax, 2
cmp rax, 0x10
jge 0x4d38ed
movzx edx, byte [rsp + rax + 0x28]
lea rsi, [rax + 1]
nop word [rax + rax]
cmp rsi, 0x10
jae 0x4d3925
movzx esi, byte [rsp + rax + 0x29]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0xc
jae 0x4d3914
movzx r8d, byte [rsp + rdi + 0x1c]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x55]
cmp rsi, 0xc
jb 0x4d3891
jmp 0x4d3908
xor eax, eax
lea rbx, [rsp + 0x1c]
mov ecx, 0xc
call fcn.00443880
mov rbp, qword [rsp + 0x38]
add rsp, 0x40
ret
mov eax, esi
mov ecx, 0xc
call fcn.00456360
mov eax, edi
mov ecx, 0xc
nop dword [rax + rax]
call fcn.00456360
mov rax, rsi
mov ecx, 0x10
call fcn.00456360
nop
call fcn.00453c40
jmp fcn.004d3840

Function at 0x4d4de0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4d4ef3
sub rsp, 0x48
mov qword [rsp + 0x40], rbp
lea rbp, [rsp + 0x40]
movabs rdx, 0x65ef56d4bb636843
mov qword [rsp + 0x2c], rdx
movabs rdx, 0xfc695ed565ef56d4
mov qword [rsp + 0x30], rdx
movabs rdx, 0xdf67c066576f43c2
mov qword [rsp + 0x38], rdx
movabs rdx, 0x11060603090b020c
mov qword [rsp + 0x18], rdx
movabs rdx, 0xb04050f11060603
mov qword [rsp + 0x1c], rdx
movabs rdx, 0x131105080f0c0802
mov qword [rsp + 0x24], rdx
xor eax, eax
jmp 0x4d4e70
movzx r9d, byte [rsp + rsi + 0x2c]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x76]
mov byte [rsp + rdi + 0x2c], dl
mov byte [rsp + rsi + 0x2c], r8b
add rax, 2
cmp rax, 0x14
jge 0x4d4ead
movzx edx, byte [rsp + rax + 0x18]
lea rsi, [rax + 1]
nop
cmp rsi, 0x14
jae 0x4d4ee5
movzx esi, byte [rsp + rax + 0x19]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x14
jae 0x4d4ed4
movzx r8d, byte [rsp + rdi + 0x2c]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x76]
cmp rsi, 0x14
jb 0x4d4e56
jmp 0x4d4ec8
xor eax, eax
lea rbx, [rsp + 0x2c]
mov ecx, 0x14
call fcn.00443880
mov rbp, qword [rsp + 0x40]
add rsp, 0x48
ret
mov eax, esi
mov ecx, 0x14
call fcn.00456360
mov eax, edi
mov ecx, 0x14
nop dword [rax + rax]
call fcn.00456360
mov rax, rsi
mov ecx, 0x14
call fcn.00456360
nop
call fcn.00453c40
jmp fcn.004d4de0
Function at 0x4d5dc0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4d5ecb
sub rsp, 0x50
mov qword [rsp + 0x48], rbp
lea rbp, [rsp + 0x48]
movabs rdx, 0x530b126501116f84
mov qword [rsp + 0x1a], rdx
movabs rdx, 0x74955e546469530b
mov qword [rsp + 0x20], rdx
movabs rdx, 0x576f697cc9f810b6
mov qword [rsp + 0x28], rdx
movabs rdx, 0xb12140b0b120c11
mov qword [rsp + 0x30], rdx
movabs rdx, 0x110c060211000e05
mov qword [rsp + 0x38], rdx
movabs rdx, 0x10120514030c0b0f
mov qword [rsp + 0x40], rdx
xor eax, eax
jmp 0x4d5e53
movzx r9d, byte [rsp + rsi + 0x1a]
sub r9d, edx
lea edx, [r9 + 0x73]
mov byte [rsp + rdi + 0x1a], dl
lea edx, [r8 + 0x73]
mov byte [rsp + rsi + 0x1a], dl
add rax, 2
cmp rax, 0x18
jge 0x4d5e8a
movzx edx, byte [rsp + rax + 0x30]
lea rsi, [rax + 1]
cmp rsi, 0x18
jae 0x4d5ebd
movzx esi, byte [rsp + rax + 0x31]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x16
jae 0x4d5eb1
movzx r8d, byte [rsp + rdi + 0x1a]
sub r8d, edx
cmp rsi, 0x16
jb 0x4d5e36
jmp 0x4d5ea5
xor eax, eax
lea rbx, [rsp + 0x1a]
mov ecx, 0x16
call fcn.00443880
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
mov eax, esi
mov ecx, 0x16
call fcn.00456360
mov eax, edi
mov ecx, 0x16
call fcn.00456360
mov rax, rsi
mov ecx, 0x18
call fcn.00456360
nop
call fcn.00453c40
jmp fcn.004d5dc0
Function at 0x4d5ee0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
lea r12, [rsp - 0x18]
cmp r12, qword [r14 + 0x10]
jbe 0x4d609f
sub rsp, 0x98
mov qword [rsp + 0x90], rbp
lea rbp, [rsp + 0x90]
movabs rdx, 0x9f83728da6b68493
mov qword [rsp + 0x18], rdx
movabs rdx, 0x6a8972999f83728d
mov qword [rsp + 0x1c], rdx
movabs rdx, 0x74314c475e955367
mov qword [rsp + 0x24], rdx
movabs rdx, 0x6969537d73684479
mov qword [rsp + 0x2c], rdx
movabs rdx, 0x73615f4f54726f9a
mov qword [rsp + 0x34], rdx
movabs rdx, 0x45857e8843699271
mov qword [rsp + 0x3c], rdx
movabs rdx, 0x74144ed972877106
mov qword [rsp + 0x44], rdx
movabs rdx, 0x1820200414000a2d
mov qword [rsp + 0x4c], rdx
movabs rdx, 0x1033060118202004
mov qword [rsp + 0x50], rdx
movabs rdx, 0xb22302803000207
mov qword [rsp + 0x58], rdx
movabs rdx, 0x16012f1c0f33252a
mov qword [rsp + 0x60], rdx
movabs rdx, 0x2f2e0f110a060804
mov qword [rsp + 0x68], rdx
movabs rdx, 0x2332c33230f0a0e
mov qword [rsp + 0x70], rdx
movabs rdx, 0x29322e230f2b3229
mov qword [rsp + 0x78], rdx
movabs rdx, 0x1224270821273301
mov qword [rsp + 0x80], rdx
movabs rdx, 0x1b1c311928120232
mov qword [rsp + 0x88], rdx
xor eax, eax
nop
jmp 0x4d6019
movzx r9d, byte [rsp + rdi + 0x18]
xor r9d, esi
mov byte [rsp + rdx + 0x18], r9b
mov byte [rsp + rdi + 0x18], r8b
add rax, 2
cmp rax, 0x44
jge 0x4d6057
movzx edx, byte [rsp + rax + 0x4c]
lea rsi, [rax + 1]
cmp rsi, 0x44
jae 0x4d6091
movzx esi, byte [rsp + rax + 0x4d]
mov edi, esi
xor esi, edx
lea esi, [rax + rsi]
lea esi, [rsi - 0x2c]
nop dword [rax]
cmp rdx, 0x34
jae 0x4d6085
movzx r8d, byte [rsp + rdx + 0x18]
xor r8d, esi
cmp rdi, 0x34
jb 0x4d6002
jmp 0x4d6078
xor eax, eax
lea rbx, [rsp + 0x18]
mov ecx, 0x34
call fcn.00443880
mov rbp, qword [rsp + 0x90]
add rsp, 0x98
ret
mov eax, edi
mov ecx, 0x34
nop
call fcn.00456360
mov eax, edx
mov ecx, 0x34
call fcn.00456360
mov rax, rsi
mov ecx, 0x44
call fcn.00456360
nop
nop
call fcn.00453c40
jmp fcn.004d5ee0