joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4dcee0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4dcfdb
push rbp
mov rbp, rsp
sub rsp, 0x48
movabs rdx, 0x8275727043515551
mov qword [rsp + 0x35], rdx
movabs rdx, 0x6f156e8275727043
mov qword [rsp + 0x38], rdx
movabs rdx, 0x641668735a4d5a72
mov qword [rsp + 0x40], rdx
movabs rdx, 0x100010090a0d0706
mov qword [rsp + 0x1b], rdx
movabs rdx, 0x100c0e0d0a0a1100
mov qword [rsp + 0x23], rdx
movabs rdx, 0xa00100c0e0d0a0a
mov qword [rsp + 0x25], rdx
movabs rdx, 0x110a04040d02010d
mov qword [rsp + 0x2d], rdx
xor eax, eax
jmp 0x4dcf79
movzx r9d, byte [rsp + rsi + 0x35]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x11]
mov byte [rsp + rdi + 0x35], dl
mov byte [rsp + rsi + 0x35], r8b
add rax, 2
cmp rax, 0x1a
jge 0x4dcfab
movzx edx, byte [rsp + rax + 0x1b]
movzx esi, byte [rsp + rax + 0x1c]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x13
jae 0x4dcfce
movzx r8d, byte [rsp + rdi + 0x35]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x11]
cmp rsi, 0x13
jb 0x4dcf5f
jmp 0x4dcfc2
xor eax, eax
lea rbx, [rsp + 0x35]
mov ecx, 0x13
call fcn.00444780
add rsp, 0x48
pop rbp
ret
mov eax, esi
mov ecx, 0x13
call fcn.00456420
mov eax, edi
mov ecx, 0x13
call fcn.00456420
nop
nop dword [rax + rax]
call fcn.00454140
jmp fcn.004dcee0

Function at 0x4e35c0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4e36ac
push rbp
mov rbp, rsp
sub rsp, 0x48
movabs rdx, 0xcbedf64464466552
mov qword [rsp + 0x33], rdx
movabs rdx, 0x57c1b06267cbedf6
mov qword [rsp + 0x38], rdx
movabs rdx, 0xab7324c46ebb6d2d
mov qword [rsp + 0x40], rdx
movabs rdx, 0x8020e0a06050908
mov qword [rsp + 0x1b], rdx
movabs rdx, 0x110e0e12140f140d
mov qword [rsp + 0x23], rdx
movabs rdx, 0x90a120b07080c0a
mov qword [rsp + 0x2b], rdx
xor eax, eax
jmp 0x4e364a
movzx r9d, byte [rsp + rsi + 0x33]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x77]
mov byte [rsp + rdi + 0x33], dl
mov byte [rsp + rsi + 0x33], r8b
add rax, 2
cmp rax, 0x18
jge 0x4e367c
movzx edx, byte [rsp + rax + 0x1b]
movzx esi, byte [rsp + rax + 0x1c]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x15
jae 0x4e369f
movzx r8d, byte [rsp + rdi + 0x33]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x77]
cmp rsi, 0x15
jb 0x4e3630
jmp 0x4e3693
xor eax, eax
lea rbx, [rsp + 0x33]
mov ecx, 0x15
call fcn.00444780
add rsp, 0x48
pop rbp
ret
mov eax, esi
mov ecx, 0x15
call fcn.00456420
mov eax, edi
mov ecx, 0x15
call fcn.00456420
nop
call fcn.00454140
jmp fcn.004e35c0
Function at 0x4e3f60
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4e4027
push rbp
mov rbp, rsp
sub rsp, 0x38
movabs rdx, 0x2762505c3f565553
mov qword [rsp + 0x2c], rdx
mov dword [rsp + 0x34], 0x20364846
movabs rdx, 0x70a04020b0a0307
mov qword [rsp + 0x1e], rdx
movabs rdx, 0x90607050b01070a
mov qword [rsp + 0x24], rdx
xor eax, eax
jmp 0x4e3fc8
movzx r9d, byte [rsp + rsi + 0x2c]
sub r9d, edx
lea edx, [r9 + 0x22]
mov byte [rsp + rdi + 0x2c], dl
lea edx, [r8 + 0x22]
mov byte [rsp + rsi + 0x2c], dl
add rax, 2
cmp rax, 0xe
jge 0x4e3ff7
movzx edx, byte [rsp + rax + 0x1e]
movzx esi, byte [rsp + rax + 0x1f]
mov edi, edx
xor edx, esi
add edx, eax
nop
cmp rdi, 0xc
jae 0x4e401a
movzx r8d, byte [rsp + rdi + 0x2c]
sub r8d, edx
cmp rsi, 0xc
jb 0x4e3fab
jmp 0x4e400e
xor eax, eax
lea rbx, [rsp + 0x2c]
mov ecx, 0xc
call fcn.00444780
add rsp, 0x38
pop rbp
ret
mov eax, esi
mov ecx, 0xc
call fcn.00456420
mov eax, edi
mov ecx, 0xc
call fcn.00456420
nop
call fcn.00454140
jmp fcn.004e3f60

Function at 0x4e4a00
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4e4ac6
push rbp
mov rbp, rsp
sub rsp, 0x30
movabs rdx, 0x546418160d0c1f14
mov qword [rsp + 0x25], rdx
mov dword [rsp + 0x2c], 0xee6d1754
movabs rdx, 0x30a040606060501
mov qword [rsp + 0x19], rdx
mov dword [rsp + 0x21], 0x2080004
xor eax, eax
jmp 0x4e4a60
movzx r9d, byte [rsp + rsi + 0x25]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x49]
mov byte [rsp + rdi + 0x25], dl
mov byte [rsp + rsi + 0x25], r8b
add rax, 2
nop
cmp rax, 0xc
jge 0x4e4a92
movzx edx, byte [rsp + rax + 0x19]
movzx esi, byte [rsp + rax + 0x1a]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0xb
jae 0x4e4ab7
movzx r8d, byte [rsp + rdi + 0x25]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x49]
cmp rsi, 0xb
jb 0x4e4a44
jmp 0x4e4aab
xor eax, eax
lea rbx, [rsp + 0x25]
mov ecx, 0xb
nop
call fcn.00444780
add rsp, 0x30
pop rbp
ret
mov eax, esi
mov ecx, 0xb
call fcn.00456420
mov eax, edi
mov ecx, 0xb
nop
call fcn.00456420
nop
call fcn.00454140
jmp fcn.004e4a00
Function at 0x4e4ec0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4e4fa6
push rbp
mov rbp, rsp
sub rsp, 0x40
movabs rdx, 0x9ea199c1a09acd8c
mov qword [rsp + 0x30], rdx
movabs rdx, 0xd4ff9a7d93ce5065
mov qword [rsp + 0x38], rdx
movabs rdx, 0x30d03010b060e0f
mov qword [rsp + 0x1c], rdx
movabs rdx, 0x204040a030d0301
mov qword [rsp + 0x20], rdx
movabs rdx, 0x70a050e0f07000c
mov qword [rsp + 0x28], rdx
xor eax, eax
nop
jmp 0x4e4f40
movzx r9d, byte [rsp + rsi + 0x30]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x41]
mov byte [rsp + rdi + 0x30], dl
mov byte [rsp + rsi + 0x30], r8b
add rax, 2
nop dword [rax]
cmp rax, 0x14
jge 0x4e4f72
movzx edx, byte [rsp + rax + 0x1c]
movzx esi, byte [rsp + rax + 0x1d]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x10
jae 0x4e4f97
movzx r8d, byte [rsp + rdi + 0x30]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x41]
cmp rsi, 0x10
jb 0x4e4f22
jmp 0x4e4f8b
xor eax, eax
lea rbx, [rsp + 0x30]
mov ecx, 0x10
nop
call fcn.00444780
add rsp, 0x40
pop rbp
ret
mov eax, esi
mov ecx, 0x10
call fcn.00456420
mov eax, edi
mov ecx, 0x10
nop
call fcn.00456420
nop
call fcn.00454140
jmp fcn.004e4ec0

Function at 0x4e4fc0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4e50a6
push rbp
mov rbp, rsp
sub rsp, 0x40
movabs rdx, 0x65fd85cf15686e97
mov qword [rsp + 0x31], rdx
movabs rdx, 0x650d69e066282065
mov qword [rsp + 0x38], rdx
movabs rdx, 0x50d030200030904
mov qword [rsp + 0x1f], rdx
movabs rdx, 0x906050d03020003
mov qword [rsp + 0x21], rdx
movabs rdx, 0x20b0203080d0b0d
mov qword [rsp + 0x29], rdx
xor eax, eax
nop
jmp 0x4e5040
movzx r9d, byte [rsp + rsi + 0x31]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x3b]
mov byte [rsp + rdi + 0x31], dl
mov byte [rsp + rsi + 0x31], r8b
add rax, 2
nop dword [rax]
cmp rax, 0x12
jge 0x4e5072
movzx edx, byte [rsp + rax + 0x1f]
movzx esi, byte [rsp + rax + 0x20]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0xf
jae 0x4e5097
movzx r8d, byte [rsp + rdi + 0x31]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x3b]
cmp rsi, 0xf
jb 0x4e5022
jmp 0x4e508b
xor eax, eax
lea rbx, [rsp + 0x31]
mov ecx, 0xf
nop
call fcn.00444780
add rsp, 0x40
pop rbp
ret
mov eax, esi
mov ecx, 0xf
call fcn.00456420
mov eax, edi
mov ecx, 0xf
nop
call fcn.00456420
nop
call fcn.00454140
jmp fcn.004e4fc0
Function at 0x4e50c0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4e517e
push rbp
mov rbp, rsp
sub rsp, 0x30
movabs rdx, 0x4cd4611ec6216919
mov qword [rsp + 0x25], rdx
mov dword [rsp + 0x2c], 0x41d6f4c
movabs rdx, 0xa090609030903
mov qword [rsp + 0x19], rdx
mov dword [rsp + 0x21], 0x6090204
xor eax, eax
jmp 0x4e5121
movzx r9d, byte [rsp + rsi + 0x25]
sub r9d, edx
lea edx, [r9 + 0x62]
mov byte [rsp + rdi + 0x25], dl
lea edx, [r8 + 0x62]
mov byte [rsp + rsi + 0x25], dl
add rax, 2
cmp rax, 0xc
jge 0x4e514e
movzx edx, byte [rsp + rax + 0x19]
movzx esi, byte [rsp + rax + 0x1a]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0xb
jae 0x4e5171
movzx r8d, byte [rsp + rdi + 0x25]
sub r8d, edx
cmp rsi, 0xb
jb 0x4e5104
jmp 0x4e5165
xor eax, eax
lea rbx, [rsp + 0x25]
mov ecx, 0xb
call fcn.00444780
add rsp, 0x30
pop rbp
ret
mov eax, esi
mov ecx, 0xb
call fcn.00456420
mov eax, edi
mov ecx, 0xb
call fcn.00456420
nop
nop
call fcn.00454140
jmp fcn.004e50c0

Function at 0x4e9220
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4e92e6
push rbp
mov rbp, rsp
sub rsp, 0x30
movabs rdx, 0xe1d9e665967465a6
mov qword [rsp + 0x25], rdx
mov dword [rsp + 0x2c], 0xaca8a5e1
movabs rdx, 0x90a090600050907
mov qword [rsp + 0x19], rdx
mov dword [rsp + 0x21], 0x803
xor eax, eax
jmp 0x4e9280
movzx r9d, byte [rsp + rsi + 0x25]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x48]
mov byte [rsp + rdi + 0x25], dl
mov byte [rsp + rsi + 0x25], r8b
add rax, 2
nop
cmp rax, 0xc
jge 0x4e92b2
movzx edx, byte [rsp + rax + 0x19]
movzx esi, byte [rsp + rax + 0x1a]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0xb
jae 0x4e92d7
movzx r8d, byte [rsp + rdi + 0x25]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x48]
cmp rsi, 0xb
jb 0x4e9264
jmp 0x4e92cb
xor eax, eax
lea rbx, [rsp + 0x25]
mov ecx, 0xb
nop
call fcn.00444780
add rsp, 0x30
pop rbp
ret
mov eax, esi
mov ecx, 0xb
call fcn.00456420
mov eax, edi
mov ecx, 0xb
nop
call fcn.00456420
nop
call fcn.00454140
jmp fcn.004e9220

Function at 0x4e9580
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4e9652
push rbp
mov rbp, rsp
sub rsp, 0x38
movabs rdx, 0x99b3b765b9d9e4d5
mov qword [rsp + 0x2b], rdx
movabs rdx, 0x656de86e7999b3b7
mov qword [rsp + 0x30], rdx
movabs rdx, 0x1000a0a06050203
mov qword [rsp + 0x1d], rdx
movabs rdx, 0x1070a0300000100
mov qword [rsp + 0x23], rdx
xor eax, eax
jmp 0x4e95ec
movzx r9d, byte [rsp + rsi + 0x2b]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x46]
mov byte [rsp + rdi + 0x2b], dl
mov byte [rsp + rsi + 0x2b], r8b
add rax, 2
cmp rax, 0xe
jge 0x4e961e
movzx edx, byte [rsp + rax + 0x1d]
movzx esi, byte [rsp + rax + 0x1e]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0xd
jae 0x4e9645
movzx r8d, byte [rsp + rdi + 0x2b]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x46]
cmp rsi, 0xd
jb 0x4e95d2
jmp 0x4e9635
xor eax, eax
lea rbx, [rsp + 0x2b]
mov ecx, 0xd
call fcn.00444780
add rsp, 0x38
pop rbp
ret
mov eax, esi
mov ecx, 0xd
nop dword [rax]
call fcn.00456420
mov eax, edi
mov ecx, 0xd
call fcn.00456420
nop
call fcn.00454140
jmp fcn.004e9580
Function at 0x4ea960
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4eaa2a
push rbp
mov rbp, rsp
sub rsp, 0x48
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rbx
mov qword [rsp], rax
mov qword [rsp + 8], rbx
mov byte [rsp + 0x10], 0
call fcn.00403260
xorps xmm15, xmm15
mov r14, qword [0x00697f98]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x18], 0xffffffffffffffff
jne 0x4eaa0f
mov rcx, qword [rsp + 0x60]
lea rdx, [rcx + 1]
mov qword [rsp + 0x40], rdx
lea rax, [0x0053fc60]
xor ebx, ebx
mov rcx, rdx
call fcn.004412a0
mov rbx, qword [rsp + 0x60]
mov rcx, rax
xor edi, edi
mov rsi, qword [rsp + 0x40]
mov rax, qword [rsp + 0x58]
nop dword [rax]
call fcn.004eaf60
inc rbx
cmp rcx, rbx
jae 0x4ea9fe
mov edi, 1
lea rsi, [0x0053fc60]
call fcn.00441380
mov word [rax + rbx*2 - 2], 0
xor edi, edi
xor esi, esi
add rsp, 0x48
pop rbp
ret
xor eax, eax
xor ebx, ebx
mov rcx, rbx
lea rdi, [0x005826c8]
lea rsi, [0x00582368]
add rsp, 0x48
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.00454140
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.004ea960

Function at 0x4efa00
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4efaec
push rbp
mov rbp, rsp
sub rsp, 0x40
movabs rdx, 0x4d3c2c12f7a36552
mov qword [rsp + 0x2f], rdx
movabs rdx, 0xf44d3c2c12f7a365
mov qword [rsp + 0x30], rdx
movabs rdx, 0x21676e192e745344
mov qword [rsp + 0x38], rdx
movabs rdx, 0xc090602030d0c08
mov qword [rsp + 0x1b], rdx
movabs rdx, 0x10060d060c090602
mov qword [rsp + 0x1f], rdx
movabs rdx, 0xd05040d04100d0d
mov qword [rsp + 0x27], rdx
xor eax, eax
jmp 0x4efa8a
movzx r9d, byte [rsp + rsi + 0x2f]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x23]
mov byte [rsp + rdi + 0x2f], dl
mov byte [rsp + rsi + 0x2f], r8b
add rax, 2
cmp rax, 0x14
jge 0x4efabc
movzx edx, byte [rsp + rax + 0x1b]
movzx esi, byte [rsp + rax + 0x1c]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x11
jae 0x4efadf
movzx r8d, byte [rsp + rdi + 0x2f]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x23]
cmp rsi, 0x11
jb 0x4efa70
jmp 0x4efad3
xor eax, eax
lea rbx, [rsp + 0x2f]
mov ecx, 0x11
call fcn.00444780
add rsp, 0x40
pop rbp
ret
mov eax, esi
mov ecx, 0x11
call fcn.00456420
mov eax, edi
mov ecx, 0x11
call fcn.00456420
nop
call fcn.00454140
jmp fcn.004efa00
Function at 0x4efb00
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4efbe6
push rbp
mov rbp, rsp
sub rsp, 0x40
movabs rdx, 0xd456e1ab3c48e4d9
mov qword [rsp + 0x32], rdx
movabs rdx, 0x57e4e136d42ad456
mov qword [rsp + 0x38], rdx
movabs rdx, 0x700050207020a0c
mov qword [rsp + 0x1e], rdx
movabs rdx, 0x50b080507000502
mov qword [rsp + 0x22], rdx
movabs rdx, 0x30c040b0109030b
mov qword [rsp + 0x2a], rdx
xor eax, eax
nop
jmp 0x4efb80
movzx r9d, byte [rsp + rsi + 0x32]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x7b]
mov byte [rsp + rdi + 0x32], dl
mov byte [rsp + rsi + 0x32], r8b
add rax, 2
nop dword [rax]
cmp rax, 0x14
jge 0x4efbb2
movzx edx, byte [rsp + rax + 0x1e]
movzx esi, byte [rsp + rax + 0x1f]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0xe
jae 0x4efbd7
movzx r8d, byte [rsp + rdi + 0x32]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x7b]
cmp rsi, 0xe
jb 0x4efb62
jmp 0x4efbcb
xor eax, eax
lea rbx, [rsp + 0x32]
mov ecx, 0xe
nop
call fcn.00444780
add rsp, 0x40
pop rbp
ret
mov eax, esi
mov ecx, 0xe
call fcn.00456420
mov eax, edi
mov ecx, 0xe
nop
call fcn.00456420
nop
call fcn.00454140
jmp fcn.004efb00

Function at 0x4f0f20
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4f1006
push rbp
mov rbp, rsp
sub rsp, 0x40
movabs rdx, 0xcb62fcdaa43c6939
mov qword [rsp + 0x30], rdx
movabs rdx, 0x1648c41fe4fa2088
mov qword [rsp + 0x38], rdx
movabs rdx, 0xe0f0b000f0a0c0e
mov qword [rsp + 0x1a], rdx
movabs rdx, 0x20405080e070e0f
mov qword [rsp + 0x20], rdx
movabs rdx, 0xc080d070a0b0403
mov qword [rsp + 0x28], rdx
xor eax, eax
nop
jmp 0x4f0fa0
movzx r9d, byte [rsp + rsi + 0x30]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x7f]
mov byte [rsp + rdi + 0x30], dl
mov byte [rsp + rsi + 0x30], r8b
add rax, 2
nop dword [rax]
cmp rax, 0x16
jge 0x4f0fd2
movzx edx, byte [rsp + rax + 0x1a]
movzx esi, byte [rsp + rax + 0x1b]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x10
jae 0x4f0ff7
movzx r8d, byte [rsp + rdi + 0x30]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x7f]
cmp rsi, 0x10
jb 0x4f0f82
jmp 0x4f0feb
xor eax, eax
lea rbx, [rsp + 0x30]
mov ecx, 0x10
nop
call fcn.00444780
add rsp, 0x40
pop rbp
ret
mov eax, esi
mov ecx, 0x10
call fcn.00456420
mov eax, edi
mov ecx, 0x10
nop
call fcn.00456420
nop
call fcn.00454140
jmp fcn.004f0f20
Function at 0x4f3380
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4f347b
push rbp
mov rbp, rsp
sub rsp, 0x50
movabs rdx, 0xfb5a155f544af345
mov qword [rsp + 0x39], rdx
movabs rdx, 0xe5586174193426fb
mov qword [rsp + 0x40], rdx
movabs rdx, 0x6e6d376920427255
mov qword [rsp + 0x48], rdx
movabs rdx, 0x8040e0413141616
mov qword [rsp + 0x1b], rdx
movabs rdx, 0x50a0111070d0509
mov qword [rsp + 0x23], rdx
movabs rdx, 0x403060d0211050a
mov qword [rsp + 0x29], rdx
movabs rdx, 0x50f051308130106
mov qword [rsp + 0x31], rdx
xor eax, eax
jmp 0x4f3419
movzx r9d, byte [rsp + rsi + 0x39]
lea edx, [r9 + rdx]
lea edx, [rdx - 9]
mov byte [rsp + rdi + 0x39], dl
mov byte [rsp + rsi + 0x39], r8b
add rax, 2
cmp rax, 0x1e
jge 0x4f344b
movzx edx, byte [rsp + rax + 0x1b]
movzx esi, byte [rsp + rax + 0x1c]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x17
jae 0x4f346e
movzx r8d, byte [rsp + rdi + 0x39]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 9]
cmp rsi, 0x17
jb 0x4f33ff
jmp 0x4f3462
xor eax, eax
lea rbx, [rsp + 0x39]
mov ecx, 0x17
call fcn.00444780
add rsp, 0x50
pop rbp
ret
mov eax, esi
mov ecx, 0x17
call fcn.00456420
mov eax, edi
mov ecx, 0x17
call fcn.00456420
nop
nop dword [rax + rax]
call fcn.00454140
jmp fcn.004f3380

Function at 0x4f9920
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4f9a3a
push rbp
mov rbp, rsp
sub rsp, 0x60
movabs rdx, 0x5acf617274b6a2a8
mov qword [rsp + 0x42], rdx
movabs rdx, 0x6e9718ef5bb8e4e1
mov qword [rsp + 0x4a], rdx
movabs rdx, 0xc61f6d9454a86e97
mov qword [rsp + 0x50], rdx
movabs rdx, 0xb2ed639c2aa24d28
mov qword [rsp + 0x58], rdx
movabs rdx, 0xe18020d070d150f
mov qword [rsp + 0x1a], rdx
movabs rdx, 0x61c140202180f07
mov qword [rsp + 0x22], rdx
movabs rdx, 0x91d0e101914060a
mov qword [rsp + 0x2a], rdx
movabs rdx, 0x141d01120c121c08
mov qword [rsp + 0x32], rdx
movabs rdx, 0x1a1c0001021a0b1d
mov qword [rsp + 0x3a], rdx
xor eax, eax
jmp 0x4f99d7
movzx r9d, byte [rsp + rsi + 0x42]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x68]
mov byte [rsp + rdi + 0x42], dl
mov byte [rsp + rsi + 0x42], r8b
add rax, 2
cmp rax, 0x28
jge 0x4f9a09
movzx edx, byte [rsp + rax + 0x1a]
movzx esi, byte [rsp + rax + 0x1b]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x1e
jae 0x4f9a2d
movzx r8d, byte [rsp + rdi + 0x42]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x68]
cmp rsi, 0x1e
jb 0x4f99bd
jmp 0x4f9a21
xor eax, eax
lea rbx, [rsp + 0x42]
mov ecx, 0x1e
call fcn.00444780
add rsp, 0x60
pop rbp
nop
ret
mov eax, esi
mov ecx, 0x1e
call fcn.00456420
mov eax, edi
mov ecx, 0x1e
call fcn.00456420
nop
call fcn.00454140
nop
jmp fcn.004f9920
Function at 0x4fa860
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4fa97a
push rbp
mov rbp, rsp
sub rsp, 0x58
movabs rdx, 0x4308bc6433ac0243
mov qword [rsp + 0x3c], rdx
movabs rdx, 0xb9f274b5d69beb97
mov qword [rsp + 0x44], rdx
movabs rdx, 0x64f36174b9f274b5
mov qword [rsp + 0x48], rdx
movabs rdx, 0x98eeb95420e3cda5
mov qword [rsp + 0x50], rdx
movabs rdx, 0x60d190c030e0819
mov qword [rsp + 0x18], rdx
movabs rdx, 0x12090e09060d190c
mov qword [rsp + 0x1c], rdx
movabs rdx, 0x160a05021a020114
mov qword [rsp + 0x24], rdx
movabs rdx, 0xf0b15141b030a0c
mov qword [rsp + 0x2c], rdx
movabs rdx, 0x120e09090a0d0f14
mov qword [rsp + 0x34], rdx
xor eax, eax
jmp 0x4fa917
movzx r9d, byte [rsp + rsi + 0x3c]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x65]
mov byte [rsp + rdi + 0x3c], dl
mov byte [rsp + rsi + 0x3c], r8b
add rax, 2
cmp rax, 0x24
jge 0x4fa949
movzx edx, byte [rsp + rax + 0x18]
movzx esi, byte [rsp + rax + 0x19]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x1c
jae 0x4fa96d
movzx r8d, byte [rsp + rdi + 0x3c]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x65]
cmp rsi, 0x1c
jb 0x4fa8fd
jmp 0x4fa961
xor eax, eax
lea rbx, [rsp + 0x3c]
mov ecx, 0x1c
call fcn.00444780
add rsp, 0x58
pop rbp
nop
ret
mov eax, esi
mov ecx, 0x1c
call fcn.00456420
mov eax, edi
mov ecx, 0x1c
call fcn.00456420
nop
call fcn.00454140
nop
jmp fcn.004fa860

Function at 0x4fae20
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4faf3d
push rbp
mov rbp, rsp
sub rsp, 0x58
movabs rdx, 0x20e369a5a7a56a50
mov qword [rsp + 0x3a], rdx
movabs rdx, 0xb17261eeb7611d53
mov qword [rsp + 0x42], rdx
movabs rdx, 0xd2a86dffdbecb172
mov qword [rsp + 0x48], rdx
movabs rdx, 0x29d062b578ecb7d1
mov qword [rsp + 0x50], rdx
movabs rdx, 0x161c101a15150609
mov qword [rsp + 0x18], rdx
movabs rdx, 0x412161c101a1515
mov qword [rsp + 0x1a], rdx
movabs rdx, 0x20c141c10111b16
mov qword [rsp + 0x22], rdx
movabs rdx, 0x170f1001041a180f
mov qword [rsp + 0x2a], rdx
movabs rdx, 0x2030b0903061215
mov qword [rsp + 0x32], rdx
xor eax, eax
jmp 0x4faee0
movzx r9d, byte [rsp + rsi + 0x3a]
sub r9d, edx
lea edx, [r9 - 0x23]
mov byte [rsp + rdi + 0x3a], dl
lea edx, [r8 - 0x23]
mov byte [rsp + rsi + 0x3a], dl
add rax, 2
nop word [rax + rax]
cmp rax, 0x22
jge 0x4faf0d
movzx edx, byte [rsp + rax + 0x18]
movzx esi, byte [rsp + rax + 0x19]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x1e
jae 0x4faf30
movzx r8d, byte [rsp + rdi + 0x3a]
sub r8d, edx
cmp rsi, 0x1e
jb 0x4faebd
jmp 0x4faf24
xor eax, eax
lea rbx, [rsp + 0x3a]
mov ecx, 0x1e
call fcn.00444780
add rsp, 0x58
pop rbp
ret
mov eax, esi
mov ecx, 0x1e
call fcn.00456420
mov eax, edi
mov ecx, 0x1e
call fcn.00456420
nop
nop dword [rax]
call fcn.00454140
jmp fcn.004fae20
Function at 0x4fb220
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4fb31b
push rbp
mov rbp, rsp
sub rsp, 0x48
movabs rdx, 0x938916109561257
mov qword [rsp + 0x34], rdx
movabs rdx, 0x646e0a2a09389161
mov qword [rsp + 0x38], rdx
movabs rdx, 0x2f6d3540f34c72df
mov qword [rsp + 0x40], rdx
movabs rdx, 0x102110900050f09
mov qword [rsp + 0x1a], rdx
movabs rdx, 0xc000c06070e0e
mov qword [rsp + 0x22], rdx
movabs rdx, 0x600000c000c0607
mov qword [rsp + 0x24], rdx
movabs rdx, 0xc0211080c031013
mov qword [rsp + 0x2c], rdx
xor eax, eax
jmp 0x4fb2b9
movzx r9d, byte [rsp + rsi + 0x34]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x10]
mov byte [rsp + rdi + 0x34], dl
mov byte [rsp + rsi + 0x34], r8b
add rax, 2
cmp rax, 0x1a
jge 0x4fb2eb
movzx edx, byte [rsp + rax + 0x1a]
movzx esi, byte [rsp + rax + 0x1b]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x14
jae 0x4fb30e
movzx r8d, byte [rsp + rdi + 0x34]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x10]
cmp rsi, 0x14
jb 0x4fb29f
jmp 0x4fb302
xor eax, eax
lea rbx, [rsp + 0x34]
mov ecx, 0x14
call fcn.00444780
add rsp, 0x48
pop rbp
ret
mov eax, esi
mov ecx, 0x14
call fcn.00456420
mov eax, edi
mov ecx, 0x14
call fcn.00456420
nop
nop dword [rax + rax]
call fcn.00454140
jmp fcn.004fb220

Function at 0x4fbde0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4fbedb
push rbp
mov rbp, rsp
sub rsp, 0x48
movabs rdx, 0x3acd50423e61f51e
mov qword [rsp + 0x35], rdx
movabs rdx, 0x643f4d3acd50423e
mov qword [rsp + 0x38], rdx
movabs rdx, 0x25e2614b15307218
mov qword [rsp + 0x40], rdx
movabs rdx, 0x102100b000d1210
mov qword [rsp + 0x19], rdx
movabs rdx, 0x40b090e050d030f
mov qword [rsp + 0x21], rdx
movabs rdx, 0x20e0611040b090e
mov qword [rsp + 0x25], rdx
movabs rdx, 0x1009090607080511
mov qword [rsp + 0x2d], rdx
xor eax, eax
jmp 0x4fbe79
movzx r9d, byte [rsp + rsi + 0x35]
lea edx, [r9 + rdx]
lea edx, [rdx + 2]
mov byte [rsp + rdi + 0x35], dl
mov byte [rsp + rsi + 0x35], r8b
add rax, 2
cmp rax, 0x1c
jge 0x4fbeab
movzx edx, byte [rsp + rax + 0x19]
movzx esi, byte [rsp + rax + 0x1a]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x13
jae 0x4fbece
movzx r8d, byte [rsp + rdi + 0x35]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 2]
cmp rsi, 0x13
jb 0x4fbe5f
jmp 0x4fbec2
xor eax, eax
lea rbx, [rsp + 0x35]
mov ecx, 0x13
call fcn.00444780
add rsp, 0x48
pop rbp
ret
mov eax, esi
mov ecx, 0x13
call fcn.00456420
mov eax, edi
mov ecx, 0x13
call fcn.00456420
nop
nop dword [rax + rax]
call fcn.00454140
jmp fcn.004fbde0