joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4cfa00
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4cfad2
push rbp
mov rbp, rsp
sub rsp, 0x38
movabs rdx, 0xe1c6ed4bdfe5c9ee
mov qword [rsp + 0x1b], rdx
movabs rdx, 0xbecf45b265e1c6ed
mov qword [rsp + 0x20], rdx
movabs rdx, 0xc07050900040704
mov qword [rsp + 0x28], rdx
movabs rdx, 0xb02050b06000103
mov qword [rsp + 0x30], rdx
xor eax, eax
jmp 0x4cfa6c
movzx r9d, byte [rsp + rsi + 0x1b]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x7c]
mov byte [rsp + rdi + 0x1b], dl
mov byte [rsp + rsi + 0x1b], r8b
add rax, 2
cmp rax, 0x10
jge 0x4cfa9e
movzx edx, byte [rsp + rax + 0x28]
movzx esi, byte [rsp + rax + 0x29]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0xd
jae 0x4cfac5
movzx r8d, byte [rsp + rdi + 0x1b]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x7c]
cmp rsi, 0xd
jb 0x4cfa52
jmp 0x4cfab5
xor eax, eax
lea rbx, [rsp + 0x1b]
mov ecx, 0xd
call fcn.0044bb20
add rsp, 0x38
pop rbp
ret
mov eax, esi
mov ecx, 0xd
nop dword [rax]
call fcn.00461020
mov eax, edi
mov ecx, 0xd
call fcn.00461020
nop
call fcn.0045eda0
jmp fcn.004cfa00

Function at 0x4d0140
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4d025d
push rbp
mov rbp, rsp
sub rsp, 0x58
movabs rdx, 0x37eedd212b723c43
mov qword [rsp + 0x18], rdx
movabs rdx, 0x66673432650c3974
mov qword [rsp + 0x20], rdx
movabs rdx, 0xb7343eff66673432
mov qword [rsp + 0x24], rdx
movabs rdx, 0xfad9e0eb6e002739
mov qword [rsp + 0x2c], rdx
movabs rdx, 0xc1b1309160c160e
mov qword [rsp + 0x34], rdx
movabs rdx, 0x181909040c1b1309
mov qword [rsp + 0x38], rdx
movabs rdx, 0x100a121b1a0e0503
mov qword [rsp + 0x40], rdx
movabs rdx, 0xd0c030710180a06
mov qword [rsp + 0x48], rdx
movabs rdx, 0x110119140a15040e
mov qword [rsp + 0x50], rdx
xor eax, eax
jmp 0x4d0200
movzx r9d, byte [rsp + rsi + 0x18]
sub r9d, edx
lea edx, [r9 + 0x59]
mov byte [rsp + rdi + 0x18], dl
lea edx, [r8 + 0x59]
mov byte [rsp + rsi + 0x18], dl
add rax, 2
nop word [rax + rax]
cmp rax, 0x24
jge 0x4d022d
movzx edx, byte [rsp + rax + 0x34]
movzx esi, byte [rsp + rax + 0x35]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x1c
jae 0x4d0250
movzx r8d, byte [rsp + rdi + 0x18]
sub r8d, edx
cmp rsi, 0x1c
jb 0x4d01dd
jmp 0x4d0244
xor eax, eax
lea rbx, [rsp + 0x18]
mov ecx, 0x1c
call fcn.0044bb20
add rsp, 0x58
pop rbp
ret
mov eax, esi
mov ecx, 0x1c
call fcn.00461020
mov eax, edi
mov ecx, 0x1c
call fcn.00461020
nop
nop dword [rax]
call fcn.0045eda0
jmp fcn.004d0140
Function at 0x4d0c60
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4d0d5d
push rbp
mov rbp, rsp
sub rsp, 0x50
movabs rdx, 0x43838fa998e16543
mov qword [rsp + 0x19], rdx
movabs rdx, 0x847c9d6c8ce78543
mov qword [rsp + 0x20], rdx
movabs rdx, 0x9d868d686dca7b6b
mov qword [rsp + 0x28], rdx
movabs rdx, 0xc020b061211060a
mov qword [rsp + 0x30], rdx
movabs rdx, 0x509060415100f12
mov qword [rsp + 0x38], rdx
movabs rdx, 0x160d08020c0d0508
mov qword [rsp + 0x40], rdx
movabs rdx, 0xe0e03061416020f
mov qword [rsp + 0x48], rdx
xor eax, eax
jmp 0x4d0d00
movzx r9d, byte [rsp + rsi + 0x19]
sub r9d, edx
lea edx, [r9 - 3]
mov byte [rsp + rdi + 0x19], dl
lea edx, [r8 - 3]
mov byte [rsp + rsi + 0x19], dl
add rax, 2
nop dword [rax]
cmp rax, 0x20
jge 0x4d0d2d
movzx edx, byte [rsp + rax + 0x30]
movzx esi, byte [rsp + rax + 0x31]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x17
jae 0x4d0d50
movzx r8d, byte [rsp + rdi + 0x19]
sub r8d, edx
cmp rsi, 0x17
jb 0x4d0cdf
jmp 0x4d0d44
xor eax, eax
lea rbx, [rsp + 0x19]
mov ecx, 0x17
call fcn.0044bb20
add rsp, 0x50
pop rbp
ret
mov eax, esi
mov ecx, 0x17
call fcn.00461020
mov eax, edi
mov ecx, 0x17
call fcn.00461020
nop
nop dword [rax]
call fcn.0045eda0
jmp fcn.004d0c60

Function at 0x4d1060
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4d115d
push rbp
mov rbp, rsp
sub rsp, 0x48
movabs rdx, 0x6e57485b743c325b
mov qword [rsp + 0x18], rdx
movabs rdx, 0x7a4b52536e57485b
mov qword [rsp + 0x1c], rdx
movabs rdx, 0x4a4a7c41124e6d66
mov qword [rsp + 0x24], rdx
movabs rdx, 0x130e020f120f0201
mov qword [rsp + 0x2c], rdx
movabs rdx, 0x212060510040a09
mov qword [rsp + 0x34], rdx
movabs rdx, 0xc02051002120605
mov qword [rsp + 0x38], rdx
movabs rdx, 0xb1112090c000f10
mov qword [rsp + 0x40], rdx
xor eax, eax
jmp 0x4d1100
movzx r9d, byte [rsp + rsi + 0x18]
sub r9d, edx
lea edx, [r9 + 0x2c]
mov byte [rsp + rdi + 0x18], dl
lea edx, [r8 + 0x2c]
mov byte [rsp + rsi + 0x18], dl
add rax, 2
nop dword [rax]
cmp rax, 0x1c
jge 0x4d112d
movzx edx, byte [rsp + rax + 0x2c]
movzx esi, byte [rsp + rax + 0x2d]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x14
jae 0x4d1150
movzx r8d, byte [rsp + rdi + 0x18]
sub r8d, edx
cmp rsi, 0x14
jb 0x4d10df
jmp 0x4d1144
xor eax, eax
lea rbx, [rsp + 0x18]
mov ecx, 0x14
call fcn.0044bb20
add rsp, 0x48
pop rbp
ret
mov eax, esi
mov ecx, 0x14
call fcn.00461020
mov eax, edi
mov ecx, 0x14
call fcn.00461020
nop
nop dword [rax]
call fcn.0045eda0
jmp fcn.004d1060
Function at 0x4d1180
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4d129a
push rbp
mov rbp, rsp
sub rsp, 0x60
movabs rdx, 0x8272654490767143
mov qword [rsp + 0x1e], rdx
movabs rdx, 0x7069697974699966
mov qword [rsp + 0x26], rdx
movabs rdx, 0x8276437f74748d84
mov qword [rsp + 0x2e], rdx
movabs rdx, 0x5d63576d7950738a
mov qword [rsp + 0x36], rdx
movabs rdx, 0x1c0b030910181117
mov qword [rsp + 0x3e], rdx
movabs rdx, 0x160d1c0b03091018
mov qword [rsp + 0x40], rdx
movabs rdx, 0x14121d0a010f070c
mov qword [rsp + 0x48], rdx
movabs rdx, 0x191b040a02030213
mov qword [rsp + 0x50], rdx
movabs rdx, 0x1f0317161012101b
mov qword [rsp + 0x58], rdx
xor eax, eax
jmp 0x4d1237
movzx r9d, byte [rsp + rsi + 0x1e]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x25]
mov byte [rsp + rdi + 0x1e], dl
mov byte [rsp + rsi + 0x1e], r8b
add rax, 2
cmp rax, 0x22
jge 0x4d1269
movzx edx, byte [rsp + rax + 0x3e]
movzx esi, byte [rsp + rax + 0x3f]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x20
jae 0x4d128d
movzx r8d, byte [rsp + rdi + 0x1e]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x25]
cmp rsi, 0x20
jb 0x4d121d
jmp 0x4d1281
xor eax, eax
lea rbx, [rsp + 0x1e]
mov ecx, 0x20
call fcn.0044bb20
add rsp, 0x60
pop rbp
nop
ret
mov eax, esi
mov ecx, 0x20
call fcn.00461020
mov eax, edi
mov ecx, 0x20
call fcn.00461020
nop
call fcn.0045eda0
nop
jmp fcn.004d1180

Function at 0x4d1d40
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4d1e0c
push rbp
mov rbp, rsp
sub rsp, 0x38
movabs rdx, 0x6eab2f65a8a3a177
mov qword [rsp + 0x1d], rdx
movabs rdx, 0x809156eab2f65a8
mov qword [rsp + 0x20], rdx
movabs rdx, 0x803050602000a01
mov qword [rsp + 0x28], rdx
movabs rdx, 0x80a020009050609
mov qword [rsp + 0x30], rdx
xor eax, eax
jmp 0x4d1daf
movzx r9d, byte [rsp + rsi + 0x1d]
sub r9d, edx
lea edx, [r9 + 0x6f]
mov byte [rsp + rdi + 0x1d], dl
lea edx, [r8 + 0x6f]
mov byte [rsp + rsi + 0x1d], dl
add rax, 2
cmp rax, 0x10
jge 0x4d1ddc
movzx edx, byte [rsp + rax + 0x28]
movzx esi, byte [rsp + rax + 0x29]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0xb
jae 0x4d1dff
movzx r8d, byte [rsp + rdi + 0x1d]
sub r8d, edx
cmp rsi, 0xb
jb 0x4d1d92
jmp 0x4d1df3
xor eax, eax
lea rbx, [rsp + 0x1d]
mov ecx, 0xb
call fcn.0044bb20
add rsp, 0x38
pop rbp
ret
mov eax, esi
mov ecx, 0xb
call fcn.00461020
mov eax, edi
mov ecx, 0xb
call fcn.00461020
nop
call fcn.0045eda0
jmp fcn.004d1d40
Function at 0x4d4820
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4d48fd
push rbp
mov rbp, rsp
sub rsp, 0x38
movabs rdx, 0xf8a0a2f06dddaee0
mov qword [rsp + 0x18], rdx
movabs rdx, 0xb9dffabc7380f8a0
mov qword [rsp + 0x1e], rdx
movabs rdx, 0x20d040b050c0800
mov qword [rsp + 0x26], rdx
movabs rdx, 0x70b020d040b050c
mov qword [rsp + 0x28], rdx
movabs rdx, 0x10a0504060d0b08
mov qword [rsp + 0x30], rdx
xor eax, eax
nop
jmp 0x4d48a0
movzx r9d, byte [rsp + rsi + 0x18]
sub r9d, edx
lea edx, [r9 - 0x32]
mov byte [rsp + rdi + 0x18], dl
lea edx, [r8 - 0x32]
mov byte [rsp + rsi + 0x18], dl
add rax, 2
nop
cmp rax, 0x12
jge 0x4d48cd
movzx edx, byte [rsp + rax + 0x26]
movzx esi, byte [rsp + rax + 0x27]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0xe
jae 0x4d48f0
movzx r8d, byte [rsp + rdi + 0x18]
sub r8d, edx
cmp rsi, 0xe
jb 0x4d4882
jmp 0x4d48e4
xor eax, eax
lea rbx, [rsp + 0x18]
mov ecx, 0xe
call fcn.0044bb20
add rsp, 0x38
pop rbp
ret
mov eax, esi
mov ecx, 0xe
call fcn.00461020
mov eax, edi
mov ecx, 0xe
call fcn.00461020
nop
nop dword [rax]
call fcn.0045eda0
jmp fcn.004d4820

Function at 0x4d6460
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4d6532
push rbp
mov rbp, rsp
sub rsp, 0x38
movabs rdx, 0x8465909f837974b7
mov qword [rsp + 0x1d], rdx
movabs rdx, 0xb8a4858465909f83
mov qword [rsp + 0x20], rdx
movabs rdx, 0x80402070a070001
mov qword [rsp + 0x28], rdx
movabs rdx, 0x103010908050909
mov qword [rsp + 0x30], rdx
xor eax, eax
jmp 0x4d64cc
movzx r9d, byte [rsp + rsi + 0x1d]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x2e]
mov byte [rsp + rdi + 0x1d], dl
mov byte [rsp + rsi + 0x1d], r8b
add rax, 2
cmp rax, 0x10
jge 0x4d64fe
movzx edx, byte [rsp + rax + 0x28]
movzx esi, byte [rsp + rax + 0x29]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0xb
jae 0x4d6525
movzx r8d, byte [rsp + rdi + 0x1d]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x2e]
cmp rsi, 0xb
jb 0x4d64b2
jmp 0x4d6515
xor eax, eax
lea rbx, [rsp + 0x1d]
mov ecx, 0xb
call fcn.0044bb20
add rsp, 0x38
pop rbp
ret
mov eax, esi
mov ecx, 0xb
nop dword [rax]
call fcn.00461020
mov eax, edi
mov ecx, 0xb
call fcn.00461020
nop
call fcn.0045eda0
jmp fcn.004d6460
Function at 0x4d6aa0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4d6b78
push rbp
mov rbp, rsp
sub rsp, 0x38
movabs rdx, 0xa291b3cf9b746616
mov qword [rsp + 0x1a], rdx
mov dword [rsp + 0x22], 0x5f5abab3
movabs rdx, 0x809090b0006080a
mov qword [rsp + 0x26], rdx
movabs rdx, 0x5010809090b0006
mov qword [rsp + 0x28], rdx
movabs rdx, 0x307090409050608
mov qword [rsp + 0x30], rdx
xor eax, eax
jmp 0x4d6b17
movzx r9d, byte [rsp + rsi + 0x1a]
sub r9d, edx
lea edx, [r9 - 0x42]
mov byte [rsp + rdi + 0x1a], dl
lea edx, [r8 - 0x42]
mov byte [rsp + rsi + 0x1a], dl
add rax, 2
cmp rax, 0x12
jge 0x4d6b48
movzx edx, byte [rsp + rax + 0x26]
movzx esi, byte [rsp + rax + 0x27]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0xc
jae 0x4d6b6b
movzx r8d, byte [rsp + rdi + 0x1a]
sub r8d, edx
nop dword [rax]
cmp rsi, 0xc
jb 0x4d6afa
jmp 0x4d6b5f
xor eax, eax
lea rbx, [rsp + 0x1a]
mov ecx, 0xc
call fcn.0044bb20
add rsp, 0x38
pop rbp
ret
mov eax, esi
mov ecx, 0xc
call fcn.00461020
mov eax, edi
mov ecx, 0xc
call fcn.00461020
nop
call fcn.0045eda0
nop dword [rax]
jmp fcn.004d6aa0

Function at 0x4d6ba0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4d6c72
push rbp
mov rbp, rsp
sub rsp, 0x38
movabs rdx, 0x2067ad9b4c94c447
mov qword [rsp + 0x28], rdx
movabs rdx, 0xe2df98618b68a7a7
mov qword [rsp + 0x30], rdx
movabs rdx, 0xd0f0905070b010e
mov qword [rsp + 0x18], rdx
movabs rdx, 0x40102080e0d0e0b
mov qword [rsp + 0x20], rdx
xor eax, eax
jmp 0x4d6c0c
movzx r9d, byte [rsp + rsi + 0x28]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x49]
mov byte [rsp + rdi + 0x28], dl
mov byte [rsp + rsi + 0x28], r8b
add rax, 2
cmp rax, 0x10
jge 0x4d6c3e
movzx edx, byte [rsp + rax + 0x18]
movzx esi, byte [rsp + rax + 0x19]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x10
jae 0x4d6c65
movzx r8d, byte [rsp + rdi + 0x28]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x49]
cmp rsi, 0x10
jb 0x4d6bf2
jmp 0x4d6c55
xor eax, eax
lea rbx, [rsp + 0x28]
mov ecx, 0x10
call fcn.0044bb20
add rsp, 0x38
pop rbp
ret
mov eax, esi
mov ecx, 0x10
nop dword [rax]
call fcn.00461020
mov eax, edi
mov ecx, 0x10
call fcn.00461020
nop
call fcn.0045eda0
jmp fcn.004d6ba0
Function at 0x4d6f00
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4d6fe6
push rbp
mov rbp, rsp
sub rsp, 0x40
movabs rdx, 0x652ff27246ecf047
mov qword [rsp + 0x1d], rdx
movabs rdx, 0x3b492a29f7287365
mov qword [rsp + 0x24], rdx
movabs rdx, 0xa050e020c0e010e
mov qword [rsp + 0x2c], rdx
movabs rdx, 0xa0a03050a050e02
mov qword [rsp + 0x30], rdx
movabs rdx, 0xb060c0d0a090e0d
mov qword [rsp + 0x38], rdx
xor eax, eax
nop
jmp 0x4d6f80
movzx r9d, byte [rsp + rsi + 0x1d]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x1b]
mov byte [rsp + rdi + 0x1d], dl
mov byte [rsp + rsi + 0x1d], r8b
add rax, 2
nop dword [rax]
cmp rax, 0x14
jge 0x4d6fb2
movzx edx, byte [rsp + rax + 0x2c]
movzx esi, byte [rsp + rax + 0x2d]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0xf
jae 0x4d6fd7
movzx r8d, byte [rsp + rdi + 0x1d]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x1b]
cmp rsi, 0xf
jb 0x4d6f62
jmp 0x4d6fcb
xor eax, eax
lea rbx, [rsp + 0x1d]
mov ecx, 0xf
nop
call fcn.0044bb20
add rsp, 0x40
pop rbp
ret
mov eax, esi
mov ecx, 0xf
call fcn.00461020
mov eax, edi
mov ecx, 0xf
nop
call fcn.00461020
nop
call fcn.0045eda0
jmp fcn.004d6f00

Function at 0x4d8a60
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4d8b32
push rbp
mov rbp, rsp
sub rsp, 0x38
movabs rdx, 0x4f5c4a5049447050
mov qword [rsp + 0x1f], rdx
movabs rdx, 0x58734d4f5c4a5049
mov qword [rsp + 0x22], rdx
movabs rdx, 0x200070805030000
mov qword [rsp + 0x2a], rdx
movabs rdx, 0x2030507060a0200
mov qword [rsp + 0x30], rdx
xor eax, eax
jmp 0x4d8acc
movzx r9d, byte [rsp + rsi + 0x1f]
lea edx, [r9 + rdx]
lea edx, [rdx + 3]
mov byte [rsp + rdi + 0x1f], dl
mov byte [rsp + rsi + 0x1f], r8b
add rax, 2
cmp rax, 0xe
jge 0x4d8afe
movzx edx, byte [rsp + rax + 0x2a]
movzx esi, byte [rsp + rax + 0x2b]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0xb
jae 0x4d8b25
movzx r8d, byte [rsp + rdi + 0x1f]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 3]
cmp rsi, 0xb
jb 0x4d8ab2
jmp 0x4d8b15
xor eax, eax
lea rbx, [rsp + 0x1f]
mov ecx, 0xb
call fcn.0044bb20
add rsp, 0x38
pop rbp
ret
mov eax, esi
mov ecx, 0xb
nop dword [rax]
call fcn.00461020
mov eax, edi
mov ecx, 0xb
call fcn.00461020
nop
call fcn.0045eda0
jmp fcn.004d8a60
Function at 0x4d9140
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4d922a
push rbp
mov rbp, rsp
sub rsp, 0x48
movabs rdx, 0x6572eb75abec65eb
mov qword [rsp + 0x1d], rdx
movabs rdx, 0xe9e92cda636572eb
mov qword [rsp + 0x22], rdx
movabs rdx, 0x57fd65106e0f6753
mov qword [rsp + 0x2a], rdx
movabs rdx, 0xb0d0a0b00090309
mov qword [rsp + 0x32], rdx
movabs rdx, 0x50e04000a0c0b0d
mov qword [rsp + 0x38], rdx
movabs rdx, 0xf130b0002050c11
mov qword [rsp + 0x40], rdx
xor eax, eax
jmp 0x4d91cd
movzx r9d, byte [rsp + rsi + 0x1d]
sub r9d, edx
lea edx, [r9 - 0x6c]
mov byte [rsp + rdi + 0x1d], dl
lea edx, [r8 - 0x6c]
mov byte [rsp + rsi + 0x1d], dl
add rax, 2
cmp rax, 0x16
jge 0x4d91fa
movzx edx, byte [rsp + rax + 0x32]
movzx esi, byte [rsp + rax + 0x33]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x15
jae 0x4d921d
movzx r8d, byte [rsp + rdi + 0x1d]
sub r8d, edx
cmp rsi, 0x15
jb 0x4d91b0
jmp 0x4d9211
xor eax, eax
lea rbx, [rsp + 0x1d]
mov ecx, 0x15
call fcn.0044bb20
add rsp, 0x48
pop rbp
ret
mov eax, esi
mov ecx, 0x15
call fcn.00461020
mov eax, edi
mov ecx, 0x15
call fcn.00461020
nop
call fcn.0045eda0
jmp fcn.004d9140

Function at 0x4d9cc0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4d9daa
push rbp
mov rbp, rsp
sub rsp, 0x48
movabs rdx, 0x4165979d979e687a
mov qword [rsp + 0x1e], rdx
movabs rdx, 0x7dac4165979d979e
mov qword [rsp + 0x20], rdx
movabs rdx, 0x579382f8a79d9ac2
mov qword [rsp + 0x28], rdx
movabs rdx, 0xf09080a0c0f0e0d
mov qword [rsp + 0x30], rdx
movabs rdx, 0x20d080304100100
mov qword [rsp + 0x38], rdx
movabs rdx, 0xa0e050b020a0c03
mov qword [rsp + 0x40], rdx
xor eax, eax
jmp 0x4d9d4d
movzx r9d, byte [rsp + rsi + 0x1e]
sub r9d, edx
lea edx, [r9 - 0xc]
mov byte [rsp + rdi + 0x1e], dl
lea edx, [r8 - 0xc]
mov byte [rsp + rsi + 0x1e], dl
add rax, 2
cmp rax, 0x18
jge 0x4d9d7a
movzx edx, byte [rsp + rax + 0x30]
movzx esi, byte [rsp + rax + 0x31]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x12
jae 0x4d9d9d
movzx r8d, byte [rsp + rdi + 0x1e]
sub r8d, edx
cmp rsi, 0x12
jb 0x4d9d30
jmp 0x4d9d91
xor eax, eax
lea rbx, [rsp + 0x1e]
mov ecx, 0x12
call fcn.0044bb20
add rsp, 0x48
pop rbp
ret
mov eax, esi
mov ecx, 0x12
call fcn.00461020
mov eax, edi
mov ecx, 0x12
call fcn.00461020
nop
call fcn.0045eda0
jmp fcn.004d9cc0
Function at 0x4d9dc0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4d9ee7
push rbp
mov rbp, rsp
sub rsp, 0x60
movabs rdx, 0x65651956137451d7
mov qword [rsp + 0x1a], rdx
movabs rdx, 0x3d35656519561374
mov qword [rsp + 0x1c], rdx
movabs rdx, 0xe6e6f4a44433b34
mov qword [rsp + 0x24], rdx
movabs rdx, 0x74245c5c2c69286f
mov qword [rsp + 0x2c], rdx
movabs rdx, 0x73433bdc456e491f
mov qword [rsp + 0x34], rdx
movabs rdx, 0xa0805000d1b1a11
mov qword [rsp + 0x3c], rdx
movabs rdx, 0x180b03050a080500
mov qword [rsp + 0x40], rdx
movabs rdx, 0x1a040e091e0e131a
mov qword [rsp + 0x48], rdx
movabs rdx, 0x1d150c1105171709
mov qword [rsp + 0x50], rdx
movabs rdx, 0x1f110516010b2007
mov qword [rsp + 0x58], rdx
xor eax, eax
jmp 0x4d9e89
movzx r9d, byte [rsp + rsi + 0x1a]
sub r9d, edx
lea edx, [r9 + 0x43]
mov byte [rsp + rdi + 0x1a], dl
lea edx, [r8 + 0x43]
mov byte [rsp + rsi + 0x1a], dl
add rax, 2
cmp rax, 0x24
jge 0x4d9eb7
movzx edx, byte [rsp + rax + 0x3c]
movzx esi, byte [rsp + rax + 0x3d]
mov edi, edx
xor edx, esi
add edx, eax
nop
cmp rdi, 0x22
jae 0x4d9eda
movzx r8d, byte [rsp + rdi + 0x1a]
sub r8d, edx
cmp rsi, 0x22
jb 0x4d9e6c
jmp 0x4d9ece
xor eax, eax
lea rbx, [rsp + 0x1a]
mov ecx, 0x22
call fcn.0044bb20
add rsp, 0x60
pop rbp
ret
mov eax, esi
mov ecx, 0x22
call fcn.00461020
mov eax, edi
mov ecx, 0x22
call fcn.00461020
nop
call fcn.0045eda0
jmp fcn.004d9dc0

Function at 0x4db560
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4db64a
push rbp
mov rbp, rsp
sub rsp, 0x48
movabs rdx, 0xba979999410d79e5
mov qword [rsp + 0x1e], rdx
movabs rdx, 0xa9782b71ba979999
mov qword [rsp + 0x22], rdx
movabs rdx, 0xdc72936461fe63a9
mov qword [rsp + 0x2a], rdx
movabs rdx, 0x9080c0e020c130e
mov qword [rsp + 0x32], rdx
movabs rdx, 0x1111108130908
mov qword [rsp + 0x38], rdx
movabs rdx, 0xe010b0605040713
mov qword [rsp + 0x40], rdx
xor eax, eax
jmp 0x4db5ed
movzx r9d, byte [rsp + rsi + 0x1e]
sub r9d, edx
lea edx, [r9 - 0x25]
mov byte [rsp + rdi + 0x1e], dl
lea edx, [r8 - 0x25]
mov byte [rsp + rsi + 0x1e], dl
add rax, 2
cmp rax, 0x16
jge 0x4db61a
movzx edx, byte [rsp + rax + 0x32]
movzx esi, byte [rsp + rax + 0x33]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x14
jae 0x4db63d
movzx r8d, byte [rsp + rdi + 0x1e]
sub r8d, edx
cmp rsi, 0x14
jb 0x4db5d0
jmp 0x4db631
xor eax, eax
lea rbx, [rsp + 0x1e]
mov ecx, 0x14
call fcn.0044bb20
add rsp, 0x48
pop rbp
ret
mov eax, esi
mov ecx, 0x14
call fcn.00461020
mov eax, edi
mov ecx, 0x14
call fcn.00461020
nop
call fcn.0045eda0
jmp fcn.004db560
Function at 0x4dc7c0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4dc8cc
push rbp
mov rbp, rsp
sub rsp, 0x58
movabs rdx, 0x5b722f041b042720
mov qword [rsp + 0x1e], rdx
movabs rdx, 0xe3db030723bf6f79
mov qword [rsp + 0x26], rdx
movabs rdx, 0xd72cb16f7263c272
mov qword [rsp + 0x2e], rdx
movabs rdx, 0xb010e040e081611
mov qword [rsp + 0x36], rdx
movabs rdx, 0x170d0b010e040e08
mov qword [rsp + 0x38], rdx
movabs rdx, 0xa03050002050f0d
mov qword [rsp + 0x40], rdx
movabs rdx, 0x15131508161607
mov qword [rsp + 0x48], rdx
movabs rdx, 0x31504000c130d08
mov qword [rsp + 0x50], rdx
xor eax, eax
jmp 0x4dc868
movzx r9d, byte [rsp + rsi + 0x1e]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x32]
mov byte [rsp + rdi + 0x1e], dl
mov byte [rsp + rsi + 0x1e], r8b
add rax, 2
cmp rax, 0x22
jge 0x4dc89c
movzx edx, byte [rsp + rax + 0x36]
movzx esi, byte [rsp + rax + 0x37]
mov edi, edx
xor edx, esi
add edx, eax
nop
cmp rdi, 0x18
jae 0x4dc8bf
movzx r8d, byte [rsp + rdi + 0x1e]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x32]
cmp rsi, 0x18
jb 0x4dc84e
jmp 0x4dc8b3
xor eax, eax
lea rbx, [rsp + 0x1e]
mov ecx, 0x18
call fcn.0044bb20
add rsp, 0x58
pop rbp
ret
mov eax, esi
mov ecx, 0x18
call fcn.00461020
mov eax, edi
mov ecx, 0x18
call fcn.00461020
nop
call fcn.0045eda0
jmp fcn.004dc7c0

Function at 0x4eb160
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4eb21e
push rbp
mov rbp, rsp
sub rsp, 0x30
movabs rdx, 0x3262287318516c61
mov qword [rsp + 0x24], rdx
mov dword [rsp + 0x2c], 0x59646163
movabs rdx, 0xb09060203020508
mov qword [rsp + 0x18], rdx
mov dword [rsp + 0x20], 0x2040a01
xor eax, eax
jmp 0x4eb1c1
movzx r9d, byte [rsp + rsi + 0x24]
sub r9d, edx
lea edx, [r9 + 0x13]
mov byte [rsp + rdi + 0x24], dl
lea edx, [r8 + 0x13]
mov byte [rsp + rsi + 0x24], dl
add rax, 2
cmp rax, 0xc
jge 0x4eb1ee
movzx edx, byte [rsp + rax + 0x18]
movzx esi, byte [rsp + rax + 0x19]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0xc
jae 0x4eb211
movzx r8d, byte [rsp + rdi + 0x24]
sub r8d, edx
cmp rsi, 0xc
jb 0x4eb1a4
jmp 0x4eb205
xor eax, eax
lea rbx, [rsp + 0x24]
mov ecx, 0xc
call fcn.0044bb20
add rsp, 0x30
pop rbp
ret
mov eax, esi
mov ecx, 0xc
call fcn.00461020
mov eax, edi
mov ecx, 0xc
call fcn.00461020
nop
nop
call fcn.0045eda0
jmp fcn.004eb160
Function at 0x4ec8a0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4ec952
push rbp
mov rbp, rsp
sub rsp, 0x28
movabs rdx, 0x79dc6472f472cddb
mov qword [rsp + 0x20], rdx
movabs rdx, 0x302020206060100
mov qword [rsp + 0x18], rdx
xor eax, eax
jmp 0x4ec8f1
movzx r9d, byte [rsp + rsi + 0x20]
sub r9d, edx
lea edx, [r9 - 0x79]
mov byte [rsp + rdi + 0x20], dl
lea edx, [r8 - 0x79]
mov byte [rsp + rsi + 0x20], dl
add rax, 2
cmp rax, 8
jge 0x4ec91e
movzx edx, byte [rsp + rax + 0x18]
movzx esi, byte [rsp + rax + 0x19]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 8
jae 0x4ec945
movzx r8d, byte [rsp + rdi + 0x20]
sub r8d, edx
cmp rsi, 8
jb 0x4ec8d4
jmp 0x4ec935
xor eax, eax
lea rbx, [rsp + 0x20]
mov ecx, 8
call fcn.0044bb20
add rsp, 0x28
pop rbp
ret
mov eax, esi
mov ecx, 8
nop dword [rax]
call fcn.00461020
mov eax, edi
mov ecx, 8
call fcn.00461020
nop
call fcn.0045eda0
jmp fcn.004ec8a0

Function at 0x4ed0c0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4ed178
push rbp
mov rbp, rsp
sub rsp, 0x30
movabs rdx, 0x725158515b635344
mov qword [rsp + 0x1c], rdx
movabs rdx, 0x603060606060401
mov qword [rsp + 0x24], rdx
mov dword [rsp + 0x2c], 0x5010403
xor eax, eax
jmp 0x4ed116
movzx r9d, byte [rsp + rsi + 0x1c]
lea edx, [r9 + rdx]
lea edx, [rdx - 1]
mov byte [rsp + rdi + 0x1c], dl
mov byte [rsp + rsi + 0x1c], r8b
add rax, 2
cmp rax, 0xc
jge 0x4ed148
movzx edx, byte [rsp + rax + 0x24]
movzx esi, byte [rsp + rax + 0x25]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 8
jae 0x4ed16b
movzx r8d, byte [rsp + rdi + 0x1c]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 1]
cmp rsi, 8
jb 0x4ed0fc
jmp 0x4ed15f
xor eax, eax
lea rbx, [rsp + 0x1c]
mov ecx, 8
call fcn.0044bb20
add rsp, 0x30
pop rbp
ret
mov eax, esi
mov ecx, 8
call fcn.00461020
mov eax, edi
mov ecx, 8
call fcn.00461020
nop
call fcn.0045eda0
nop dword [rax]
jmp fcn.004ed0c0

Function at 0x4eebe0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4eecdb
push rbp
mov rbp, rsp
sub rsp, 0x50
movabs rdx, 0x29611b744e336c55
mov qword [rsp + 0x1c], rdx
movabs rdx, 0x8524974405a2961
mov qword [rsp + 0x22], rdx
movabs rdx, 0x45e62e3b113a4dfb
mov qword [rsp + 0x2a], rdx
movabs rdx, 0xd000f09150b0c07
mov qword [rsp + 0x32], rdx
movabs rdx, 0x12121403110e0013
mov qword [rsp + 0x3a], rdx
movabs rdx, 0x308050702001212
mov qword [rsp + 0x40], rdx
movabs rdx, 0x100c0e1312070f02
mov qword [rsp + 0x48], rdx
xor eax, eax
jmp 0x4eec79
movzx r9d, byte [rsp + rsi + 0x1c]
lea edx, [r9 + rdx]
lea edx, [rdx - 4]
mov byte [rsp + rdi + 0x1c], dl
mov byte [rsp + rsi + 0x1c], r8b
add rax, 2
cmp rax, 0x1e
jge 0x4eecab
movzx edx, byte [rsp + rax + 0x32]
movzx esi, byte [rsp + rax + 0x33]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x16
jae 0x4eecce
movzx r8d, byte [rsp + rdi + 0x1c]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 4]
cmp rsi, 0x16
jb 0x4eec5f
jmp 0x4eecc2
xor eax, eax
lea rbx, [rsp + 0x1c]
mov ecx, 0x16
call fcn.0044bb20
add rsp, 0x50
pop rbp
ret
mov eax, esi
mov ecx, 0x16
call fcn.00461020
mov eax, edi
mov ecx, 0x16
call fcn.00461020
nop
nop dword [rax + rax]
call fcn.0045eda0
jmp fcn.004eebe0