joyce8/EMBER2024-capa huggingface dataset:
Function at 0x455d80
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4034af
sub rsp, 0x20
mov qword [rsp + 0x18], rbp
lea rbp, [rsp + 0x18]
mov rdx, qword [rax]
mov rcx, qword [rax + 8]
mov rax, rdx
nop
call fcn.00408a00
mov rbp, qword [rsp + 0x18]
add rsp, 0x20
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.00453c40
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp 0x403480
cmp byte [0x00814178], 0
je 0x455d95
mov rcx, qword [rax + 8]
mov rax, qword [rax]
jmp 0x452d60
jmp 0x403480

Function at 0x455da0
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
mov eax, dword [rax]
movabs rcx, 0xe7037ed1a0b428db
xor rcx, rax
xor rax, rbx
xor rax, qword [0x00814520]
movabs rdx, 0xa0761d6478bd642f
xor rdx, rax
mov rax, rcx
mul rdx
xor rax, rdx
mov rcx, rax
movabs rax, 0x1d8e4e27c47d124b
mul rcx
nop
nop
xor rax, rdx
ret
cmp byte [0x00814178], 0
je 0x455dd5
movq xmm0, rbx
pinsrd xmm0, dword [rax], 2
aesenc xmm0, xmmword [0x00814940]
aesenc xmm0, xmmword [0x00814950]
aesenc xmm0, xmmword [0x00814960]
movq rax, xmm0
ret
jmp 0x408c00

Function at 0x455de0
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
mov rax, qword [rax]
movabs rcx, 0xe7037ed1a0b428db
xor rcx, rax
xor rax, rbx
xor rax, qword [0x00814520]
movabs rdx, 0xa0761d6478bd642f
xor rdx, rax
mov rax, rcx
mul rdx
xor rax, rdx
mov rcx, rax
movabs rax, 0x1d8e4e27c47d1247
mul rcx
nop
nop
xor rax, rdx
ret
cmp byte [0x00814178], 0
je 0x455e16
movq xmm0, rbx
pinsrq xmm0, qword [rax], 1
aesenc xmm0, xmmword [0x00814940]
aesenc xmm0, xmmword [0x00814950]
aesenc xmm0, xmmword [0x00814960]
movq rax, xmm0
ret
jmp 0x408c60

Function at 0x458640
Capabilities:
Access peb ldr_data

Disassembly:
sub rsp, 0x78
mov qword [rsp + 0x70], rbp
lea rbp, [rsp + 0x70]
mov qword [rsp], rax
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rcx
mov qword [rsp + 0x18], rdi
mov qword [rsp + 0x20], rsi
mov qword [rsp + 0x28], r8
mov qword [rsp + 0x30], r9
mov qword [rsp + 0x38], r10
mov qword [rsp + 0x40], r11
mov rax, qword [rsp + 0x80]
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x88]
mov qword [rsp + 0x50], rax
call fcn.004525c0
xorps xmm15, xmm15
mov r14, qword gs:[0x28]
mov r14, qword [r14]
mov rax, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x60]
mov rcx, qword [rsp + 0x68]
mov rbp, qword [rsp + 0x70]
add rsp, 0x78
ret
Function at 0x4586e0
Capabilities:
Access peb ldr_data

Disassembly:
sub rsp, 0x90
mov qword [rsp + 0x88], rbp
lea rbp, [rsp + 0x88]
mov qword [rsp], rax
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rcx
mov qword [rsp + 0x18], rdi
mov qword [rsp + 0x20], rsi
mov qword [rsp + 0x28], r8
mov qword [rsp + 0x30], r9
mov qword [rsp + 0x38], r10
mov qword [rsp + 0x40], r11
mov rax, qword [rsp + 0x98]
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0xa0]
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0xa8]
mov qword [rsp + 0x58], rax
mov rax, qword [rsp + 0xb0]
mov qword [rsp + 0x60], rax
mov rax, qword [rsp + 0xb8]
mov qword [rsp + 0x68], rax
call fcn.00452700
xorps xmm15, xmm15
mov r14, qword gs:[0x28]
mov r14, qword [r14]
mov rax, qword [rsp + 0x70]
mov rbx, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x80]
mov rbp, qword [rsp + 0x88]
add rsp, 0x90
ret

Function at 0x4587a0
Capabilities:
Access peb ldr_data

Disassembly:
sub rsp, 0xa8
mov qword [rsp + 0xa0], rbp
lea rbp, [rsp + 0xa0]
mov qword [rsp], rax
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rcx
mov qword [rsp + 0x18], rdi
mov qword [rsp + 0x20], rsi
mov qword [rsp + 0x28], r8
mov qword [rsp + 0x30], r9
mov qword [rsp + 0x38], r10
mov qword [rsp + 0x40], r11
mov rax, qword [rsp + 0xb0]
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0xb8]
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0xc0]
mov qword [rsp + 0x58], rax
mov rax, qword [rsp + 0xc8]
mov qword [rsp + 0x60], rax
mov rax, qword [rsp + 0xd0]
mov qword [rsp + 0x68], rax
mov rax, qword [rsp + 0xd8]
mov qword [rsp + 0x70], rax
mov rax, qword [rsp + 0xe0]
mov qword [rsp + 0x78], rax
mov rax, qword [rsp + 0xe8]
mov qword [rsp + 0x80], rax
call fcn.00452840
xorps xmm15, xmm15
mov r14, qword gs:[0x28]
mov r14, qword [r14]
mov rax, qword [rsp + 0x88]
mov rbx, qword [rsp + 0x90]
mov rcx, qword [rsp + 0x98]
mov rbp, qword [rsp + 0xa0]
add rsp, 0xa8
ret

Function at 0x4588a0
Capabilities:
Access peb ldr_data

Disassembly:
sub rsp, 0xc0
mov qword [rsp + 0xb8], rbp
lea rbp, [rsp + 0xb8]
mov qword [rsp], rax
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rcx
mov qword [rsp + 0x18], rdi
mov qword [rsp + 0x20], rsi
mov qword [rsp + 0x28], r8
mov qword [rsp + 0x30], r9
mov qword [rsp + 0x38], r10
mov qword [rsp + 0x40], r11
mov rax, qword [rsp + 0xc8]
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0xd0]
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0xd8]
mov qword [rsp + 0x58], rax
mov rax, qword [rsp + 0xe0]
mov qword [rsp + 0x60], rax
mov rax, qword [rsp + 0xe8]
mov qword [rsp + 0x68], rax
mov rax, qword [rsp + 0xf0]
mov qword [rsp + 0x70], rax
mov rax, qword [rsp + 0xf8]
mov qword [rsp + 0x78], rax
mov rax, qword [rsp + 0x100]
mov qword [rsp + 0x80], rax
mov rax, qword [rsp + 0x108]
mov qword [rsp + 0x88], rax
mov rax, qword [rsp + 0x110]
mov qword [rsp + 0x90], rax
mov rax, qword [rsp + 0x118]
mov qword [rsp + 0x98], rax
nop
call fcn.00452980
xorps xmm15, xmm15
mov r14, qword gs:[0x28]
mov r14, qword [r14]
mov rax, qword [rsp + 0xa0]
mov rbx, qword [rsp + 0xa8]
mov rcx, qword [rsp + 0xb0]
mov rbp, qword [rsp + 0xb8]
add rsp, 0xc0
ret
Function at 0x470760
Capabilities:
Hash data using fnv

Disassembly:
mov qword [rsp + 0x10], rbx
xor edx, edx
jmp 0x470778
movzx esi, byte [rbx + rdx]
inc rdx
imul eax, eax, 0x1000193
xor eax, esi
cmp rcx, rdx
jg 0x470769
ret

Function at 0x4be140
Capabilities:
Encrypt data using rc4 prga

Disassembly:
sub rsp, 0x20
mov qword [rsp + 0x18], rbp
lea rbp, [rsp + 0x18]
mov dword [rsp + 0x28], 0
mov word [rsp + 0x2c], 0
mov dword [rsp + 0xc], 0x2cbcc1e2
mov word [rsp + 0x10], 0x7e8a
mov dword [rsp + 0x12], 0x2cbcc1e2
mov word [rsp + 0x16], 0x7f8a
xor eax, eax
jmp 0x4be192
movzx ecx, byte [rsp + rax + 0xc]
movzx edx, byte [rsp + rax + 0x12]
xor edx, ecx
mov byte [rsp + rax + 0x12], dl
inc rax
cmp rax, 6
jl 0x4be17f
mov dword [rsp + 6], 0
mov word [rsp + 0xa], 0
xor eax, eax
jmp 0x4be1b7
movzx ecx, byte [rsp + rax + 0x12]
mov byte [rsp + rax + 6], cl
inc rax
cmp rax, 6
jl 0x4be1ab
mov eax, dword [rsp + 6]
movzx ecx, word [rsp + 0xa]
mov dword [rsp + 0x28], eax
mov word [rsp + 0x2c], cx
mov rbp, qword [rsp + 0x18]
add rsp, 0x20
ret
Function at 0x4be1e0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4be37b
sub rsp, 0x68
mov qword [rsp + 0x60], rbp
lea rbp, [rsp + 0x60]
mov dword [rsp + 0x70], 0
mov word [rsp + 0x74], 0
movabs rdx, 0x797752284487b844
mov qword [rsp + 0x54], rdx
mov dword [rsp + 0x5c], 0xb88752d8
movzx edx, byte [rsp + 0x55]
mov byte [rsp + 0x4d], dl
movzx r8d, byte [rsp + 0x5f]
mov byte [rsp + 0x4c], r8b
movzx r9d, byte [rsp + 0x5e]
mov byte [rsp + 0x4b], r9b
movzx r10d, byte [rsp + 0x56]
mov byte [rsp + 0x4a], r10b
movzx r11d, byte [rsp + 0x5d]
mov byte [rsp + 0x49], r11b
movzx r12d, byte [rsp + 0x59]
mov byte [rsp + 0x48], r12b
movzx r13d, byte [rsp + 0x57]
mov byte [rsp + 0x47], r13b
movzx r15d, byte [rsp + 0x54]
mov byte [rsp + 0x46], r15b
movzx r13d, byte [rsp + 0x5c]
mov byte [rsp + 0x45], r13b
movzx r13d, byte [rsp + 0x58]
mov byte [rsp + 0x44], r13b
movzx r13d, byte [rsp + 0x5b]
mov byte [rsp + 0x43], r13b
movzx r13d, byte [rsp + 0x5a]
mov byte [rsp + 0x42], r13b
xor edi, edi
lea rax, [0x0062ea40]
xor ebx, ebx
mov rcx, rdi
mov esi, 6
call fcn.004407c0
movzx edx, byte [rsp + 0x4d]
movzx r8d, byte [rsp + 0x4c]
sub edx, r8d
mov byte [rax], dl
movzx edx, byte [rsp + 0x4b]
movzx r8d, byte [rsp + 0x4a]
sub edx, r8d
mov byte [rax + 1], dl
movzx edx, byte [rsp + 0x49]
movzx r8d, byte [rsp + 0x48]
sub edx, r8d
mov byte [rax + 2], dl
movzx edx, byte [rsp + 0x47]
movzx r8d, byte [rsp + 0x46]
xor edx, r8d
mov byte [rax + 3], dl
movzx edx, byte [rsp + 0x44]
movzx r8d, byte [rsp + 0x45]
add edx, r8d
mov byte [rax + 4], dl
movzx edx, byte [rsp + 0x43]
movzx r8d, byte [rsp + 0x42]
sub edx, r8d
mov byte [rax + 5], dl
mov dword [rsp + 0x4e], 0
mov word [rsp + 0x52], 0
lea rdx, [rbx + 6]
xor ecx, ecx
jmp 0x4be340
mov byte [rsp + rcx + 0x4e], bl
inc rcx
nop dword [rax + rax]
cmp rcx, rdx
jge 0x4be351
movzx ebx, byte [rax + rcx]
cmp rcx, 6
jb 0x4be334
jmp 0x4be36d
mov eax, dword [rsp + 0x4e]
movzx ecx, word [rsp + 0x52]
mov dword [rsp + 0x70], eax
mov word [rsp + 0x74], cx
mov rbp, qword [rsp + 0x60]
add rsp, 0x68
ret
mov rax, rcx
mov ecx, 6
call fcn.00456360
nop
nop dword [rax + rax]
call fcn.00453c40
jmp fcn.004be1e0
Function at 0x4beae0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4bebb3
sub rsp, 0x30
mov qword [rsp + 0x28], rbp
lea rbp, [rsp + 0x28]
mov dword [rsp + 0x1a], 0xf66e6b68
mov word [rsp + 0x1e], 0x5df1
movabs rdx, 0x305010104040501
mov qword [rsp + 0x20], rdx
xor eax, eax
jmp 0x4beb37
movzx r9d, byte [rsp + rsi + 0x1a]
sub r9d, edx
lea edx, [r9 - 0x7a]
mov byte [rsp + rdi + 0x1a], dl
lea edx, [r8 - 0x7a]
mov byte [rsp + rsi + 0x1a], dl
add rax, 2
cmp rax, 8
jge 0x4beb6e
movzx edx, byte [rsp + rax + 0x20]
lea rsi, [rax + 1]
cmp rsi, 8
jae 0x4beba5
movzx esi, byte [rsp + rax + 0x21]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 6
jae 0x4beb95
movzx r8d, byte [rsp + rdi + 0x1a]
sub r8d, edx
cmp rsi, 6
jb 0x4beb1a
jmp 0x4beb89
xor eax, eax
lea rbx, [rsp + 0x1a]
mov ecx, 6
call fcn.00443880
mov rbp, qword [rsp + 0x28]
add rsp, 0x30
ret
mov eax, esi
mov ecx, 6
call fcn.00456360
mov eax, edi
mov ecx, 6
nop dword [rax]
call fcn.00456360
mov rax, rsi
mov ecx, 8
call fcn.00456360
nop
call fcn.00453c40
jmp fcn.004beae0

Function at 0x4bf6e0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4bf7ff
sub rsp, 0x58
mov qword [rsp + 0x50], rbp
lea rbp, [rsp + 0x50]
movabs rdx, 0xfa36237409fe4766
mov qword [rsp + 0x1a], rdx
movabs rdx, 0x5e50222b69097020
mov qword [rsp + 0x22], rdx
movabs rdx, 0x320e69a370654e32
mov qword [rsp + 0x2a], rdx
movabs rdx, 0x170603160217070d
mov qword [rsp + 0x32], rdx
movabs rdx, 0xa0c0a02030c1403
mov qword [rsp + 0x3a], rdx
movabs rdx, 0x160c16050d020a0c
mov qword [rsp + 0x40], rdx
movabs rdx, 0xa010f110e16100f
mov qword [rsp + 0x48], rdx
xor eax, eax
jmp 0x4bf782
movzx r9d, byte [rsp + rsi + 0x1a]
sub r9d, edx
lea edx, [r9 + 0x4f]
mov byte [rsp + rdi + 0x1a], dl
lea edx, [r8 + 0x4f]
mov byte [rsp + rsi + 0x1a], dl
add rax, 2
cmp rax, 0x1e
jge 0x4bf7b9
movzx edx, byte [rsp + rax + 0x32]
lea rsi, [rax + 1]
cmp rsi, 0x1e
jae 0x4bf7f1
movzx esi, byte [rsp + rax + 0x33]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x18
jae 0x4bf7e5
movzx r8d, byte [rsp + rdi + 0x1a]
sub r8d, edx
cmp rsi, 0x18
jb 0x4bf765
jmp 0x4bf7d4
xor eax, eax
lea rbx, [rsp + 0x1a]
mov ecx, 0x18
call fcn.00443880
mov rbp, qword [rsp + 0x50]
add rsp, 0x58
ret
mov eax, esi
mov ecx, 0x18
nop dword [rax + rax]
call fcn.00456360
mov eax, edi
mov ecx, 0x18
call fcn.00456360
mov rax, rsi
mov ecx, 0x1e
call fcn.00456360
nop
nop
call fcn.00453c40
jmp fcn.004bf6e0
Function at 0x4c1b40
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4c1d17
sub rsp, 0x70
mov qword [rsp + 0x68], rbp
lea rbp, [rsp + 0x68]
mov qword [rsp + 0x78], 0
movabs rdx, 0x30f3b588425ac6f2
mov qword [rsp + 0x58], rdx
movabs rdx, 0x703b948040403b78
mov qword [rsp + 0x60], rdx
movzx edx, byte [rsp + 0x59]
mov byte [rsp + 0x4f], dl
movzx r8d, byte [rsp + 0x5f]
mov byte [rsp + 0x4e], r8b
movzx r9d, byte [rsp + 0x63]
mov byte [rsp + 0x4d], r9b
movzx r10d, byte [rsp + 0x66]
mov byte [rsp + 0x4c], r10b
movzx r11d, byte [rsp + 0x64]
mov byte [rsp + 0x4b], r11b
movzx r12d, byte [rsp + 0x62]
mov byte [rsp + 0x4a], r12b
movzx r13d, byte [rsp + 0x58]
mov byte [rsp + 0x49], r13b
movzx r15d, byte [rsp + 0x5b]
mov byte [rsp + 0x48], r15b
movzx r13d, byte [rsp + 0x5a]
mov byte [rsp + 0x47], r13b
movzx r13d, byte [rsp + 0x60]
mov byte [rsp + 0x46], r13b
movzx r13d, byte [rsp + 0x65]
mov byte [rsp + 0x45], r13b
movzx r13d, byte [rsp + 0x5c]
mov byte [rsp + 0x44], r13b
movzx r13d, byte [rsp + 0x5e]
mov byte [rsp + 0x43], r13b
movzx r13d, byte [rsp + 0x5d]
mov byte [rsp + 0x42], r13b
movzx r13d, byte [rsp + 0x67]
mov byte [rsp + 0x41], r13b
movzx r13d, byte [rsp + 0x61]
mov byte [rsp + 0x40], r13b
lea rax, [0x0062ea40]
xor ebx, ebx
xor ecx, ecx
mov rdi, rcx
mov esi, 8
call fcn.004407c0
movzx edx, byte [rsp + 0x4f]
movzx r8d, byte [rsp + 0x4e]
sub edx, r8d
mov byte [rax], dl
movzx edx, byte [rsp + 0x4d]
movzx r8d, byte [rsp + 0x4c]
add edx, r8d
mov byte [rax + 1], dl
movzx edx, byte [rsp + 0x4b]
movzx r8d, byte [rsp + 0x4a]
sub edx, r8d
mov byte [rax + 2], dl
movzx edx, byte [rsp + 0x49]
movzx r8d, byte [rsp + 0x48]
sub edx, r8d
mov byte [rax + 3], dl
movzx edx, byte [rsp + 0x47]
movzx r8d, byte [rsp + 0x46]
add edx, r8d
mov byte [rax + 4], dl
movzx edx, byte [rsp + 0x45]
movzx r8d, byte [rsp + 0x44]
sub edx, r8d
mov byte [rax + 5], dl
movzx edx, byte [rsp + 0x43]
movzx r8d, byte [rsp + 0x42]
sub edx, r8d
mov byte [rax + 6], dl
movzx edx, byte [rsp + 0x41]
movzx r8d, byte [rsp + 0x40]
xor edx, r8d
mov byte [rax + 7], dl
mov qword [rsp + 0x50], 0
lea rdx, [rbx + 8]
xor ecx, ecx
jmp 0x4c1ce4
mov byte [rsp + rcx + 0x50], bl
inc rcx
cmp rcx, rdx
jge 0x4c1cf5
movzx ebx, byte [rax + rcx]
cmp rcx, 8
jb 0x4c1cdd
jmp 0x4c1d09
mov rax, qword [rsp + 0x50]
mov qword [rsp + 0x78], rax
mov rbp, qword [rsp + 0x68]
add rsp, 0x70
ret
mov rax, rcx
mov ecx, 8
call fcn.00456360
nop
call fcn.00453c40
nop dword [rax]
jmp fcn.004c1b40
Function at 0x4c1f40
Capabilities:
Encrypt data using rc4 prga

Disassembly:
sub rsp, 0x30
mov qword [rsp + 0x28], rbp
lea rbp, [rsp + 0x28]
mov qword [rsp + 0x38], 0
movabs rdx, 0xb744d734e657c9d5
mov qword [rsp + 0x20], rdx
movabs rdx, 0x3030204030306
mov qword [rsp + 0x10], rdx
xor eax, eax
jmp 0x4c1f93
movzx r8d, byte [rsp + rbx + 0x20]
lea edx, [r8 + rdx]
lea edx, [rdx - 0x67]
mov byte [rsp + rsi + 0x20], dl
mov byte [rsp + rbx + 0x20], dil
add rax, 2
cmp rax, 8
jge 0x4c1fcc
movzx edx, byte [rsp + rax + 0x10]
lea rbx, [rax + 1]
cmp rbx, 8
jae 0x4c2017
movzx ebx, byte [rsp + rax + 0x11]
mov esi, edx
xor edx, ebx
add edx, eax
cmp rsi, 8
jae 0x4c200b
movzx edi, byte [rsp + rsi + 0x20]
lea edi, [rdi + rdx]
lea edi, [rdi - 0x67]
cmp rbx, 8
jb 0x4c1f79
jmp 0x4c1fff
mov qword [rsp + 0x18], 0
xor eax, eax
jmp 0x4c1fe5
movzx ecx, byte [rsp + rax + 0x20]
mov byte [rsp + rax + 0x18], cl
inc rax
cmp rax, 8
jl 0x4c1fd9
mov rax, qword [rsp + 0x18]
mov qword [rsp + 0x38], rax
mov rbp, qword [rsp + 0x28]
add rsp, 0x30
ret
mov eax, ebx
mov ecx, 8
call fcn.00456360
mov eax, esi
mov ecx, 8
call fcn.00456360
mov rax, rbx
mov ecx, 8
nop
call fcn.00456360
nop
int3

Function at 0x4c2a80
Capabilities:
Encrypt data using rc4 prga

Disassembly:
sub rsp, 0x30
mov qword [rsp + 0x28], rbp
lea rbp, [rsp + 0x28]
mov qword [rsp + 0x38], 0
movabs rdx, 0xed416a82c62a4c86
mov qword [rsp + 0x20], rdx
movabs rdx, 0x706020305060403
mov qword [rsp + 0x10], rdx
xor eax, eax
jmp 0x4c2ad3
movzx r8d, byte [rsp + rbx + 0x20]
lea edx, [r8 + rdx]
lea edx, [rdx - 0x3c]
mov byte [rsp + rsi + 0x20], dl
mov byte [rsp + rbx + 0x20], dil
add rax, 2
cmp rax, 8
jge 0x4c2b0c
movzx edx, byte [rsp + rax + 0x10]
lea rbx, [rax + 1]
cmp rbx, 8
jae 0x4c2b57
movzx ebx, byte [rsp + rax + 0x11]
mov esi, edx
xor edx, ebx
add edx, eax
cmp rsi, 8
jae 0x4c2b4b
movzx edi, byte [rsp + rsi + 0x20]
lea edi, [rdi + rdx]
lea edi, [rdi - 0x3c]
cmp rbx, 8
jb 0x4c2ab9
jmp 0x4c2b3f
mov qword [rsp + 0x18], 0
xor eax, eax
jmp 0x4c2b25
movzx ecx, byte [rsp + rax + 0x20]
mov byte [rsp + rax + 0x18], cl
inc rax
cmp rax, 8
jl 0x4c2b19
mov rax, qword [rsp + 0x18]
mov qword [rsp + 0x38], rax
mov rbp, qword [rsp + 0x28]
add rsp, 0x30
ret
mov eax, ebx
mov ecx, 8
call fcn.00456360
mov eax, esi
mov ecx, 8
call fcn.00456360
mov rax, rbx
mov ecx, 8
nop
call fcn.00456360
nop
int3
Function at 0x4c3180
Capabilities:
Encrypt data using rc4 prga

Disassembly:
sub rsp, 0x38
mov qword [rsp + 0x30], rbp
lea rbp, [rsp + 0x30]
mov qword [rsp + 0x40], 0
movabs rdx, 0xe34a5401a61b8503
mov qword [rsp + 0x1c], rdx
movabs rdx, 0x200050205050002
mov qword [rsp + 0x24], rdx
mov dword [rsp + 0x2c], 0x7050701
xor eax, eax
nop
jmp 0x4c31e0
movzx r8d, byte [rsp + rbx + 0x1c]
sub r8d, edx
lea edx, [r8 - 0x33]
mov byte [rsp + rsi + 0x1c], dl
lea edx, [rdi - 0x33]
mov byte [rsp + rbx + 0x1c], dl
add rax, 2
nop
cmp rax, 0xc
jge 0x4c3215
movzx edx, byte [rsp + rax + 0x24]
lea rbx, [rax + 1]
cmp rbx, 0xc
jae 0x4c3265
movzx ebx, byte [rsp + rax + 0x25]
mov esi, edx
xor edx, ebx
add edx, eax
cmp rsi, 8
jae 0x4c3254
movzx edi, byte [rsp + rsi + 0x1c]
sub edi, edx
cmp rbx, 8
jb 0x4c31c2
jmp 0x4c3248
mov qword [rsp + 0x14], 0
xor eax, eax
jmp 0x4c322e
movzx ecx, byte [rsp + rax + 0x1c]
mov byte [rsp + rax + 0x14], cl
inc rax
cmp rax, 8
jl 0x4c3222
mov rax, qword [rsp + 0x14]
mov qword [rsp + 0x40], rax
mov rbp, qword [rsp + 0x30]
add rsp, 0x38
ret
mov eax, ebx
mov ecx, 8
call fcn.00456360
mov eax, esi
mov ecx, 8
nop dword [rax + rax]
call fcn.00456360
mov rax, rbx
mov ecx, 0xc
call fcn.00456360
nop
int3

Function at 0x4c3620
Capabilities:
Encrypt data using rc4 prga

Disassembly:
sub rsp, 0x30
mov qword [rsp + 0x28], rbp
lea rbp, [rsp + 0x28]
mov qword [rsp + 0x38], 0
movabs rdx, 0x7afa7b44658a1d21
mov qword [rsp + 0x20], rdx
movabs rdx, 0x5010406030503
mov qword [rsp + 0x10], rdx
xor eax, eax
jmp 0x4c3673
movzx r8d, byte [rsp + rbx + 0x20]
lea edx, [r8 + rdx]
lea edx, [rdx + 8]
mov byte [rsp + rsi + 0x20], dl
mov byte [rsp + rbx + 0x20], dil
add rax, 2
cmp rax, 8
jge 0x4c36ac
movzx edx, byte [rsp + rax + 0x10]
lea rbx, [rax + 1]
cmp rbx, 8
jae 0x4c36f7
movzx ebx, byte [rsp + rax + 0x11]
mov esi, edx
xor edx, ebx
add edx, eax
cmp rsi, 8
jae 0x4c36eb
movzx edi, byte [rsp + rsi + 0x20]
lea edi, [rdi + rdx]
lea edi, [rdi + 8]
cmp rbx, 8
jb 0x4c3659
jmp 0x4c36df
mov qword [rsp + 0x18], 0
xor eax, eax
jmp 0x4c36c5
movzx ecx, byte [rsp + rax + 0x20]
mov byte [rsp + rax + 0x18], cl
inc rax
cmp rax, 8
jl 0x4c36b9
mov rax, qword [rsp + 0x18]
mov qword [rsp + 0x38], rax
mov rbp, qword [rsp + 0x28]
add rsp, 0x30
ret
mov eax, ebx
mov ecx, 8
call fcn.00456360
mov eax, esi
mov ecx, 8
call fcn.00456360
mov rax, rbx
mov ecx, 8
nop
call fcn.00456360
nop
int3
Function at 0x4c40a0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
sub rsp, 0x38
mov qword [rsp + 0x30], rbp
lea rbp, [rsp + 0x30]
mov qword [rsp + 0x40], 0
movabs rdx, 0x4f09a89e750704a0
mov qword [rsp + 0x1e], rdx
movabs rdx, 0x102020102070501
mov qword [rsp + 0x26], rdx
mov word [rsp + 0x2e], 0x205
xor eax, eax
nop
jmp 0x4c4100
movzx r8d, byte [rsp + rbx + 0x1e]
sub r8d, edx
lea edx, [r8 - 9]
mov byte [rsp + rsi + 0x1e], dl
lea edx, [rdi - 9]
mov byte [rsp + rbx + 0x1e], dl
add rax, 2
nop
cmp rax, 0xa
jge 0x4c4135
movzx edx, byte [rsp + rax + 0x26]
lea rbx, [rax + 1]
cmp rbx, 0xa
jae 0x4c4185
movzx ebx, byte [rsp + rax + 0x27]
mov esi, edx
xor edx, ebx
add edx, eax
cmp rsi, 8
jae 0x4c4174
movzx edi, byte [rsp + rsi + 0x1e]
sub edi, edx
cmp rbx, 8
jb 0x4c40e2
jmp 0x4c4168
mov qword [rsp + 0x16], 0
xor eax, eax
jmp 0x4c414e
movzx ecx, byte [rsp + rax + 0x1e]
mov byte [rsp + rax + 0x16], cl
inc rax
cmp rax, 8
jl 0x4c4142
mov rax, qword [rsp + 0x16]
mov qword [rsp + 0x40], rax
mov rbp, qword [rsp + 0x30]
add rsp, 0x38
ret
mov eax, ebx
mov ecx, 8
call fcn.00456360
mov eax, esi
mov ecx, 8
nop dword [rax + rax]
call fcn.00456360
mov rax, rbx
mov ecx, 0xa
call fcn.00456360
nop
int3

Function at 0x4c4540
Capabilities:
Encrypt data using rc4 prga

Disassembly:
sub rsp, 0x38
mov qword [rsp + 0x30], rbp
lea rbp, [rsp + 0x30]
mov qword [rsp + 0x40], 0
movabs rdx, 0x6745e310baad07ac
mov qword [rsp + 0x1e], rdx
movabs rdx, 0x603060004030601
mov qword [rsp + 0x26], rdx
mov word [rsp + 0x2e], 0x201
xor eax, eax
nop
jmp 0x4c45a0
movzx r8d, byte [rsp + rbx + 0x1e]
sub r8d, edx
lea edx, [r8 - 0x26]
mov byte [rsp + rsi + 0x1e], dl
lea edx, [rdi - 0x26]
mov byte [rsp + rbx + 0x1e], dl
add rax, 2
nop
cmp rax, 0xa
jge 0x4c45d5
movzx edx, byte [rsp + rax + 0x26]
lea rbx, [rax + 1]
cmp rbx, 0xa
jae 0x4c4625
movzx ebx, byte [rsp + rax + 0x27]
mov esi, edx
xor edx, ebx
add edx, eax
cmp rsi, 8
jae 0x4c4614
movzx edi, byte [rsp + rsi + 0x1e]
sub edi, edx
cmp rbx, 8
jb 0x4c4582
jmp 0x4c4608
mov qword [rsp + 0x16], 0
xor eax, eax
jmp 0x4c45ee
movzx ecx, byte [rsp + rax + 0x1e]
mov byte [rsp + rax + 0x16], cl
inc rax
cmp rax, 8
jl 0x4c45e2
mov rax, qword [rsp + 0x16]
mov qword [rsp + 0x40], rax
mov rbp, qword [rsp + 0x30]
add rsp, 0x38
ret
mov eax, ebx
mov ecx, 8
call fcn.00456360
mov eax, esi
mov ecx, 8
nop dword [rax + rax]
call fcn.00456360
mov rax, rbx
mov ecx, 0xa
call fcn.00456360
nop
int3
Function at 0x4c6a80
Capabilities:
Encrypt data using rc4 prga

Disassembly:
sub rsp, 0x38
mov qword [rsp + 0x30], rbp
lea rbp, [rsp + 0x30]
mov qword [rsp + 0x40], 0
movabs rdx, 0x57e021ecf26fb4a5
mov qword [rsp + 0x1e], rdx
movabs rdx, 0x506020101070000
mov qword [rsp + 0x26], rdx
mov word [rsp + 0x2e], 0x402
xor eax, eax
nop
jmp 0x4c6ae0
movzx r8d, byte [rsp + rbx + 0x1e]
sub r8d, edx
lea edx, [r8 - 0x1e]
mov byte [rsp + rsi + 0x1e], dl
lea edx, [rdi - 0x1e]
mov byte [rsp + rbx + 0x1e], dl
add rax, 2
nop
cmp rax, 0xa
jge 0x4c6b15
movzx edx, byte [rsp + rax + 0x26]
lea rbx, [rax + 1]
cmp rbx, 0xa
jae 0x4c6b65
movzx ebx, byte [rsp + rax + 0x27]
mov esi, edx
xor edx, ebx
add edx, eax
cmp rsi, 8
jae 0x4c6b54
movzx edi, byte [rsp + rsi + 0x1e]
sub edi, edx
cmp rbx, 8
jb 0x4c6ac2
jmp 0x4c6b48
mov qword [rsp + 0x16], 0
xor eax, eax
jmp 0x4c6b2e
movzx ecx, byte [rsp + rax + 0x1e]
mov byte [rsp + rax + 0x16], cl
inc rax
cmp rax, 8
jl 0x4c6b22
mov rax, qword [rsp + 0x16]
mov qword [rsp + 0x40], rax
mov rbp, qword [rsp + 0x30]
add rsp, 0x38
ret
mov eax, ebx
mov ecx, 8
call fcn.00456360
mov eax, esi
mov ecx, 8
nop dword [rax + rax]
call fcn.00456360
mov rax, rbx
mov ecx, 0xa
call fcn.00456360
nop
int3

Function at 0x4c81c0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
sub rsp, 0x38
mov qword [rsp + 0x30], rbp
lea rbp, [rsp + 0x30]
mov qword [rsp + 0x40], 0
movabs rdx, 0x377cbe985b8ff79a
mov qword [rsp + 0x1e], rdx
movabs rdx, 0x305070203050402
mov qword [rsp + 0x26], rdx
mov word [rsp + 0x2e], 0x304
xor eax, eax
nop
jmp 0x4c8220
movzx r8d, byte [rsp + rbx + 0x1e]
lea edx, [r8 + rdx]
lea edx, [rdx + 0xf]
mov byte [rsp + rsi + 0x1e], dl
mov byte [rsp + rbx + 0x1e], dil
add rax, 2
nop dword [rax]
cmp rax, 0xa
jge 0x4c8259
movzx edx, byte [rsp + rax + 0x26]
lea rbx, [rax + 1]
cmp rbx, 0xa
jae 0x4c82a5
movzx ebx, byte [rsp + rax + 0x27]
mov esi, edx
xor edx, ebx
add edx, eax
cmp rsi, 8
jae 0x4c8298
movzx edi, byte [rsp + rsi + 0x1e]
lea edi, [rdi + rdx]
lea edi, [rdi + 0xf]
cmp rbx, 8
jb 0x4c8202
jmp 0x4c828c
mov qword [rsp + 0x16], 0
xor eax, eax
jmp 0x4c8272
movzx ecx, byte [rsp + rax + 0x1e]
mov byte [rsp + rax + 0x16], cl
inc rax
cmp rax, 8
jl 0x4c8266
mov rax, qword [rsp + 0x16]
mov qword [rsp + 0x40], rax
mov rbp, qword [rsp + 0x30]
add rsp, 0x38
ret
mov eax, ebx
mov ecx, 8
call fcn.00456360
mov eax, esi
mov ecx, 8
nop
call fcn.00456360
mov rax, rbx
mov ecx, 0xa
call fcn.00456360
nop
int3