joyce8/EMBER2024-capa huggingface dataset:
Function at 0x497000
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4970c6
push rbp
mov rbp, rsp
sub rsp, 0x30
movabs rdx, 0x77899a7265747583
mov qword [rsp + 0x1b], rdx
mov byte [rsp + 0x23], 0x95
movabs rdx, 0x700010108010605
mov qword [rsp + 0x24], rdx
mov dword [rsp + 0x2c], 0x7050506
xor eax, eax
nop
jmp 0x497060
movzx r9d, byte [rsp + rsi + 0x1b]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x1b]
mov byte [rsp + rdi + 0x1b], dl
mov byte [rsp + rsi + 0x1b], r8b
add rax, 2
nop dword [rax]
cmp rax, 0xc
jge 0x497092
movzx edx, byte [rsp + rax + 0x24]
movzx esi, byte [rsp + rax + 0x25]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 9
jae 0x4970b7
movzx r8d, byte [rsp + rdi + 0x1b]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x1b]
cmp rsi, 9
jb 0x497042
jmp 0x4970ab
xor eax, eax
lea rbx, [rsp + 0x1b]
mov ecx, 9
nop
call fcn.0044bb80
add rsp, 0x30
pop rbp
ret
mov eax, esi
mov ecx, 9
call fcn.004610a0
mov eax, edi
mov ecx, 9
nop
call fcn.004610a0
nop
call fcn.0045ee20
jmp fcn.00497000

Function at 0x4970e0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4971c6
push rbp
mov rbp, rsp
sub rsp, 0x38
movabs rdx, 0xa82e65ed32fe6ef8
mov qword [rsp + 0x18], rdx
movabs rdx, 0xfa2508faff95a82e
mov qword [rsp + 0x1e], rdx
movabs rdx, 0xb08040207040c03
mov qword [rsp + 0x26], rdx
movabs rdx, 0x3000b0804020704
mov qword [rsp + 0x28], rdx
movabs rdx, 0xb00090a0c0d0c0c
mov qword [rsp + 0x30], rdx
xor eax, eax
nop
jmp 0x497160
movzx r9d, byte [rsp + rsi + 0x18]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x5e]
mov byte [rsp + rdi + 0x18], dl
mov byte [rsp + rsi + 0x18], r8b
add rax, 2
nop dword [rax]
cmp rax, 0x12
jge 0x497192
movzx edx, byte [rsp + rax + 0x26]
movzx esi, byte [rsp + rax + 0x27]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0xe
jae 0x4971b7
movzx r8d, byte [rsp + rdi + 0x18]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x5e]
cmp rsi, 0xe
jb 0x497142
jmp 0x4971ab
xor eax, eax
lea rbx, [rsp + 0x18]
mov ecx, 0xe
nop
call fcn.0044bb80
add rsp, 0x38
pop rbp
ret
mov eax, esi
mov ecx, 0xe
call fcn.004610a0
mov eax, edi
mov ecx, 0xe
nop
call fcn.004610a0
nop
call fcn.0045ee20
jmp fcn.004970e0
Function at 0x49e280
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x49e38c
push rbp
mov rbp, rsp
sub rsp, 0x58
movabs rdx, 0x3dac48f94de0271f
mov qword [rsp + 0x1c], rdx
movabs rdx, 0xc7ef743525372374
mov qword [rsp + 0x24], rdx
movabs rdx, 0xc53573666664202a
mov qword [rsp + 0x2c], rdx
movabs rdx, 0x607030407060101
mov qword [rsp + 0x34], rdx
movabs rdx, 0x61706070304
mov qword [rsp + 0x38], rdx
movabs rdx, 0xc0a0f0a05051206
mov qword [rsp + 0x40], rdx
movabs rdx, 0x100160e100c1606
mov qword [rsp + 0x48], rdx
movabs rdx, 0x30e0b0212161709
mov qword [rsp + 0x50], rdx
xor eax, eax
jmp 0x49e328
movzx r9d, byte [rsp + rsi + 0x1c]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x17]
mov byte [rsp + rdi + 0x1c], dl
mov byte [rsp + rsi + 0x1c], r8b
add rax, 2
cmp rax, 0x24
jge 0x49e35c
movzx edx, byte [rsp + rax + 0x34]
movzx esi, byte [rsp + rax + 0x35]
mov edi, edx
xor edx, esi
add edx, eax
nop
cmp rdi, 0x18
jae 0x49e37f
movzx r8d, byte [rsp + rdi + 0x1c]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x17]
cmp rsi, 0x18
jb 0x49e30e
jmp 0x49e373
xor eax, eax
lea rbx, [rsp + 0x1c]
mov ecx, 0x18
call fcn.0044bb80
add rsp, 0x58
pop rbp
ret
mov eax, esi
mov ecx, 0x18
call fcn.004610a0
mov eax, edi
mov ecx, 0x18
call fcn.004610a0
nop
call fcn.0045ee20
jmp fcn.0049e280

Function at 0x49f820
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x49f8dd
push rbp
mov rbp, rsp
sub rsp, 0x30
movabs rdx, 0x8924e8e46cf8653b
mov qword [rsp + 0x1b], rdx
mov byte [rsp + 0x23], 0xea
movabs rdx, 0x406080507020807
mov qword [rsp + 0x24], rdx
mov dword [rsp + 0x2c], 0x6000605
xor eax, eax
nop
jmp 0x49f880
movzx r9d, byte [rsp + rsi + 0x1b]
sub r9d, edx
lea edx, [r9 + 0x49]
mov byte [rsp + rdi + 0x1b], dl
lea edx, [r8 + 0x49]
mov byte [rsp + rsi + 0x1b], dl
add rax, 2
nop
cmp rax, 0xc
jge 0x49f8ad
movzx edx, byte [rsp + rax + 0x24]
movzx esi, byte [rsp + rax + 0x25]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 9
jae 0x49f8d0
movzx r8d, byte [rsp + rdi + 0x1b]
sub r8d, edx
cmp rsi, 9
jb 0x49f862
jmp 0x49f8c4
xor eax, eax
lea rbx, [rsp + 0x1b]
mov ecx, 9
call fcn.0044bb80
add rsp, 0x30
pop rbp
ret
mov eax, esi
mov ecx, 9
call fcn.004610a0
mov eax, edi
mov ecx, 9
call fcn.004610a0
nop
nop dword [rax]
call fcn.0045ee20
jmp fcn.0049f820
Function at 0x49fba0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x49fc5d
push rbp
mov rbp, rsp
sub rsp, 0x30
movabs rdx, 0xff817160b3661272
mov qword [rsp + 0x1b], rdx
mov byte [rsp + 0x23], 0xff
movabs rdx, 0x503050406070508
mov qword [rsp + 0x24], rdx
mov dword [rsp + 0x2c], 0x3060601
xor eax, eax
nop
jmp 0x49fc00
movzx r9d, byte [rsp + rsi + 0x1b]
sub r9d, edx
lea edx, [r9 - 0x44]
mov byte [rsp + rdi + 0x1b], dl
lea edx, [r8 - 0x44]
mov byte [rsp + rsi + 0x1b], dl
add rax, 2
nop
cmp rax, 0xc
jge 0x49fc2d
movzx edx, byte [rsp + rax + 0x24]
movzx esi, byte [rsp + rax + 0x25]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 9
jae 0x49fc50
movzx r8d, byte [rsp + rdi + 0x1b]
sub r8d, edx
cmp rsi, 9
jb 0x49fbe2
jmp 0x49fc44
xor eax, eax
lea rbx, [rsp + 0x1b]
mov ecx, 9
call fcn.0044bb80
add rsp, 0x30
pop rbp
ret
mov eax, esi
mov ecx, 9
call fcn.004610a0
mov eax, edi
mov ecx, 9
call fcn.004610a0
nop
nop dword [rax]
call fcn.0045ee20
jmp fcn.0049fba0

Function at 0x4a09a0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4a0a8a
push rbp
mov rbp, rsp
sub rsp, 0x48
movabs rdx, 0x3a8b1ab2041e1772
mov qword [rsp + 0x1f], rdx
movabs rdx, 0x43a8b1ab2041e17
mov qword [rsp + 0x20], rdx
movabs rdx, 0xc3bd6b45a86c61e6
mov qword [rsp + 0x28], rdx
movabs rdx, 0x40e0c080c0c0403
mov qword [rsp + 0x30], rdx
movabs rdx, 0xf040c010d101009
mov qword [rsp + 0x38], rdx
movabs rdx, 0x10060c050f020502
mov qword [rsp + 0x40], rdx
xor eax, eax
jmp 0x4a0a2d
movzx r9d, byte [rsp + rsi + 0x1f]
sub r9d, edx
lea edx, [r9 - 0x3f]
mov byte [rsp + rdi + 0x1f], dl
lea edx, [r8 - 0x3f]
mov byte [rsp + rsi + 0x1f], dl
add rax, 2
cmp rax, 0x18
jge 0x4a0a5a
movzx edx, byte [rsp + rax + 0x30]
movzx esi, byte [rsp + rax + 0x31]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x11
jae 0x4a0a7d
movzx r8d, byte [rsp + rdi + 0x1f]
sub r8d, edx
cmp rsi, 0x11
jb 0x4a0a10
jmp 0x4a0a71
xor eax, eax
lea rbx, [rsp + 0x1f]
mov ecx, 0x11
call fcn.0044bb80
add rsp, 0x48
pop rbp
ret
mov eax, esi
mov ecx, 0x11
call fcn.004610a0
mov eax, edi
mov ecx, 0x11
call fcn.004610a0
nop
call fcn.0045ee20
jmp fcn.004a09a0
Function at 0x4a3400
Capabilities:
Encrypt data using rc4 prga

Disassembly:
lea r12, [rsp - 0x20]
cmp r12, qword [r14 + 0x10]
jbe 0x4a3595
push rbp
mov rbp, rsp
sub rsp, 0x98
movabs rdx, 0xd51b17656c0f6572
mov qword [rsp + 0x19], rdx
movabs rdx, 0x57265d8366920d5
mov qword [rsp + 0x20], rdx
movabs rdx, 0x7217737a6a31ca61
mov qword [rsp + 0x28], rdx
movabs rdx, 0xca11b3b36e4c8a05
mov qword [rsp + 0x30], rdx
movabs rdx, 0xa76f31fb73d0d4c3
mov qword [rsp + 0x38], rdx
movabs rdx, 0xec5d4d656b6170cb
mov qword [rsp + 0x40], rdx
movabs rdx, 0x6575d14e0f146f3b
mov qword [rsp + 0x48], rdx
movabs rdx, 0x1d072d1134172418
mov qword [rsp + 0x50], rdx
movabs rdx, 0x28341e1319071114
mov qword [rsp + 0x58], rdx
movabs rdx, 0x28321c11120e311f
mov qword [rsp + 0x60], rdx
movabs rdx, 0x2623101b0710052d
mov qword [rsp + 0x68], rdx
movabs rdx, 0x202e182e0e050b02
mov qword [rsp + 0x70], rdx
movabs rdx, 0x34142e0a3123061e
mov qword [rsp + 0x78], rdx
movabs rdx, 0x22f272714151032
mov qword [rsp + 0x80], rdx
movabs rdx, 0x7200e19070a2721
mov qword [rsp + 0x88], rdx
movabs rdx, 0x202406131d330e05
mov qword [rsp + 0x90], rdx
xor eax, eax
jmp 0x4a3534
movzx r9d, byte [rsp + rsi + 0x19]
sub r9d, edx
lea edx, [r9 - 0x72]
mov byte [rsp + rdi + 0x19], dl
lea edx, [r8 - 0x72]
mov byte [rsp + rsi + 0x19], dl
add rax, 2
cmp rax, 0x48
jge 0x4a3562
movzx edx, byte [rsp + rax + 0x50]
movzx esi, byte [rsp + rax + 0x51]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x37
jae 0x4a3588
movzx r8d, byte [rsp + rdi + 0x19]
sub r8d, edx
cmp rsi, 0x37
jb 0x4a3517
nop
jmp 0x4a357c
xor eax, eax
lea rbx, [rsp + 0x19]
mov ecx, 0x37
call fcn.0044bb80
add rsp, 0x98
pop rbp
ret
mov eax, esi
mov ecx, 0x37
call fcn.004610a0
mov eax, edi
mov ecx, 0x37
call fcn.004610a0
nop
call fcn.0045ee20
jmp fcn.004a3400
Function at 0x4a5b20
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4a5c0c
push rbp
mov rbp, rsp
sub rsp, 0x48
movabs rdx, 0xbae822656cfa6572
mov qword [rsp + 0x1c], rdx
movabs rdx, 0xc26c0056bae82265
mov qword [rsp + 0x20], rdx
movabs rdx, 0xd517f941383c0f2a
mov qword [rsp + 0x28], rdx
movabs rdx, 0x13020d110d0b0711
mov qword [rsp + 0x30], rdx
movabs rdx, 0xf0f11020b090c0e
mov qword [rsp + 0x38], rdx
movabs rdx, 0x120510100b131306
mov qword [rsp + 0x40], rdx
xor eax, eax
jmp 0x4a5baa
movzx r9d, byte [rsp + rsi + 0x1c]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x1f]
mov byte [rsp + rdi + 0x1c], dl
mov byte [rsp + rsi + 0x1c], r8b
add rax, 2
cmp rax, 0x18
jge 0x4a5bdc
movzx edx, byte [rsp + rax + 0x30]
movzx esi, byte [rsp + rax + 0x31]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x14
jae 0x4a5bff
movzx r8d, byte [rsp + rdi + 0x1c]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x1f]
cmp rsi, 0x14
jb 0x4a5b90
jmp 0x4a5bf3
xor eax, eax
lea rbx, [rsp + 0x1c]
mov ecx, 0x14
call fcn.0044bb80
add rsp, 0x48
pop rbp
ret
mov eax, esi
mov ecx, 0x14
call fcn.004610a0
mov eax, edi
mov ecx, 0x14
call fcn.004610a0
nop
call fcn.0045ee20
jmp fcn.004a5b20

Function at 0x4a9620
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4a973d
push rbp
mov rbp, rsp
sub rsp, 0x58
movabs rdx, 0x2e747544353023b5
mov qword [rsp + 0x1c], rdx
movabs rdx, 0xd324469fff5a613d
mov qword [rsp + 0x24], rdx
movabs rdx, 0x46f9d324469fff5a
mov qword [rsp + 0x26], rdx
movabs rdx, 0x6546df6634062200
mov qword [rsp + 0x2e], rdx
movabs rdx, 0x171005000f001302
mov qword [rsp + 0x36], rdx
movabs rdx, 0xc171005000f00
mov qword [rsp + 0x38], rdx
movabs rdx, 0x150103141210120f
mov qword [rsp + 0x40], rdx
movabs rdx, 0x800170300000e0c
mov qword [rsp + 0x48], rdx
movabs rdx, 0xd0b0a150f110418
mov qword [rsp + 0x50], rdx
xor eax, eax
jmp 0x4a96e0
movzx r9d, byte [rsp + rsi + 0x1c]
sub r9d, edx
lea edx, [r9 + 0x55]
mov byte [rsp + rdi + 0x1c], dl
lea edx, [r8 + 0x55]
mov byte [rsp + rsi + 0x1c], dl
add rax, 2
nop word [rax + rax]
cmp rax, 0x22
jge 0x4a970d
movzx edx, byte [rsp + rax + 0x36]
movzx esi, byte [rsp + rax + 0x37]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x1a
jae 0x4a9730
movzx r8d, byte [rsp + rdi + 0x1c]
sub r8d, edx
cmp rsi, 0x1a
jb 0x4a96bd
jmp 0x4a9724
xor eax, eax
lea rbx, [rsp + 0x1c]
mov ecx, 0x1a
call fcn.0044bb80
add rsp, 0x58
pop rbp
ret
mov eax, esi
mov ecx, 0x1a
call fcn.004610a0
mov eax, edi
mov ecx, 0x1a
call fcn.004610a0
nop
nop dword [rax]
call fcn.0045ee20
jmp fcn.004a9620
Function at 0x4a9a00
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4a9b27
push rbp
mov rbp, rsp
sub rsp, 0x60
movabs rdx, 0x6174b54cb0197bff
mov qword [rsp + 0x19], rdx
movabs rdx, 0xc46174b54cb0197b
mov qword [rsp + 0x1a], rdx
movabs rdx, 0x1569b96bb572ba61
mov qword [rsp + 0x22], rdx
movabs rdx, 0xcd6575157bbcfbb7
mov qword [rsp + 0x2a], rdx
movabs rdx, 0x76676e61fa99f401
mov qword [rsp + 0x32], rdx
movabs rdx, 0x1a1b201807140e17
mov qword [rsp + 0x3a], rdx
movabs rdx, 0x191c001212041a1b
mov qword [rsp + 0x40], rdx
movabs rdx, 0x13190a0002191203
mov qword [rsp + 0x48], rdx
movabs rdx, 0x40c080d15110118
mov qword [rsp + 0x50], rdx
movabs rdx, 0x1b19111c01051c10
mov qword [rsp + 0x58], rdx
xor eax, eax
jmp 0x4a9ac9
movzx r9d, byte [rsp + rsi + 0x19]
sub r9d, edx
lea edx, [r9 - 0x2c]
mov byte [rsp + rdi + 0x19], dl
lea edx, [r8 - 0x2c]
mov byte [rsp + rsi + 0x19], dl
add rax, 2
cmp rax, 0x26
jge 0x4a9af7
movzx edx, byte [rsp + rax + 0x3a]
movzx esi, byte [rsp + rax + 0x3b]
mov edi, edx
xor edx, esi
add edx, eax
nop
cmp rdi, 0x21
jae 0x4a9b1a
movzx r8d, byte [rsp + rdi + 0x19]
sub r8d, edx
cmp rsi, 0x21
jb 0x4a9aac
jmp 0x4a9b0e
xor eax, eax
lea rbx, [rsp + 0x19]
mov ecx, 0x21
call fcn.0044bb80
add rsp, 0x60
pop rbp
ret
mov eax, esi
mov ecx, 0x21
call fcn.004610a0
mov eax, edi
mov ecx, 0x21
call fcn.004610a0
nop
call fcn.0045ee20
jmp fcn.004a9a00

Function at 0x4a9ec0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4a9ff8
push rbp
mov rbp, rsp
sub rsp, 0x68
movabs rdx, 0xba0a0b126cd9a8a2
mov qword [rsp + 0x1d], rdx
movabs rdx, 0xdaba0a0b126cd9a8
mov qword [rsp + 0x1e], rdx
movabs rdx, 0xb069202b638e7333
mov qword [rsp + 0x26], rdx
movabs rdx, 0xce66799220789e9f
mov qword [rsp + 0x2e], rdx
movabs rdx, 0x6567c7e66720447a
mov qword [rsp + 0x36], rdx
movabs rdx, 0xb0d0a1c04001112
mov qword [rsp + 0x3e], rdx
movabs rdx, 0x6070e1905011706
mov qword [rsp + 0x46], rdx
movabs rdx, 0x170806070e190501
mov qword [rsp + 0x48], rdx
movabs rdx, 0x10a071a16181c02
mov qword [rsp + 0x50], rdx
movabs rdx, 0x1d00150801021e19
mov qword [rsp + 0x58], rdx
movabs rdx, 0x1007070d0b150907
mov qword [rsp + 0x60], rdx
xor eax, eax
jmp 0x4a9f98
movzx r9d, byte [rsp + rsi + 0x1d]
sub r9d, edx
lea edx, [r9 - 0x37]
mov byte [rsp + rdi + 0x1d], dl
lea edx, [r8 - 0x37]
mov byte [rsp + rsi + 0x1d], dl
add rax, 2
cmp rax, 0x2a
jge 0x4a9fc8
movzx edx, byte [rsp + rax + 0x3e]
movzx esi, byte [rsp + rax + 0x3f]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x21
jae 0x4a9feb
movzx r8d, byte [rsp + rdi + 0x1d]
sub r8d, edx
nop dword [rax]
cmp rsi, 0x21
jb 0x4a9f7b
jmp 0x4a9fdf
xor eax, eax
lea rbx, [rsp + 0x1d]
mov ecx, 0x21
call fcn.0044bb80
add rsp, 0x68
pop rbp
ret
mov eax, esi
mov ecx, 0x21
call fcn.004610a0
mov eax, edi
mov ecx, 0x21
call fcn.004610a0
nop
call fcn.0045ee20
nop dword [rax]
jmp fcn.004a9ec0
Function at 0x4aa5c0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4aa6aa
push rbp
mov rbp, rsp
sub rsp, 0x48
movabs rdx, 0x2e746365fd662495
mov qword [rsp + 0x1d], rdx
movabs rdx, 0xcc1d732e746365fd
mov qword [rsp + 0x20], rdx
movabs rdx, 0xf01d641639d443cb
mov qword [rsp + 0x28], rdx
movabs rdx, 0x9000903010b0b08
mov qword [rsp + 0x30], rdx
movabs rdx, 0xd090a0d0c120001
mov qword [rsp + 0x38], rdx
movabs rdx, 0xf080801110e0c0a
mov qword [rsp + 0x40], rdx
xor eax, eax
jmp 0x4aa64d
movzx r9d, byte [rsp + rsi + 0x1d]
sub r9d, edx
lea edx, [r9 + 0x5d]
mov byte [rsp + rdi + 0x1d], dl
lea edx, [r8 + 0x5d]
mov byte [rsp + rsi + 0x1d], dl
add rax, 2
cmp rax, 0x18
jge 0x4aa67a
movzx edx, byte [rsp + rax + 0x30]
movzx esi, byte [rsp + rax + 0x31]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x13
jae 0x4aa69d
movzx r8d, byte [rsp + rdi + 0x1d]
sub r8d, edx
cmp rsi, 0x13
jb 0x4aa630
jmp 0x4aa691
xor eax, eax
lea rbx, [rsp + 0x1d]
mov ecx, 0x13
call fcn.0044bb80
add rsp, 0x48
pop rbp
ret
mov eax, esi
mov ecx, 0x13
call fcn.004610a0
mov eax, edi
mov ecx, 0x13
call fcn.004610a0
nop
call fcn.0045ee20
jmp fcn.004aa5c0

Function at 0x4aa6c0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4aa7aa
push rbp
mov rbp, rsp
sub rsp, 0x40
movabs rdx, 0x59cbdc656c68da9a
mov qword [rsp + 0x19], rdx
movabs rdx, 0x6c0e5659cbdc656c
mov qword [rsp + 0x1c], rdx
movabs rdx, 0xe3def3ec465265ed
mov qword [rsp + 0x24], rdx
movabs rdx, 0x5060b1007090d00
mov qword [rsp + 0x2c], rdx
movabs rdx, 0x1101060905060b10
mov qword [rsp + 0x30], rdx
movabs rdx, 0x707091202120f00
mov qword [rsp + 0x38], rdx
xor eax, eax
jmp 0x4aa74d
movzx r9d, byte [rsp + rsi + 0x19]
sub r9d, edx
lea edx, [r9 - 0x5f]
mov byte [rsp + rdi + 0x19], dl
lea edx, [r8 - 0x5f]
mov byte [rsp + rsi + 0x19], dl
add rax, 2
cmp rax, 0x14
jge 0x4aa77a
movzx edx, byte [rsp + rax + 0x2c]
movzx esi, byte [rsp + rax + 0x2d]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x13
jae 0x4aa79d
movzx r8d, byte [rsp + rdi + 0x19]
sub r8d, edx
cmp rsi, 0x13
jb 0x4aa730
jmp 0x4aa791
xor eax, eax
lea rbx, [rsp + 0x19]
mov ecx, 0x13
call fcn.0044bb80
add rsp, 0x40
pop rbp
ret
mov eax, esi
mov ecx, 0x13
call fcn.004610a0
mov eax, edi
mov ecx, 0x13
call fcn.004610a0
nop
call fcn.0045ee20
jmp fcn.004aa6c0
Function at 0x4b0200
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4b02ea
push rbp
mov rbp, rsp
sub rsp, 0x40
movabs rdx, 0x69fc242a27f0f870
mov qword [rsp + 0x1d], rdx
movabs rdx, 0x3069fc242a27f0f8
mov qword [rsp + 0x1e], rdx
movabs rdx, 0x3b65696e353b076e
mov qword [rsp + 0x26], rdx
movabs rdx, 0x405060c03040802
mov qword [rsp + 0x2e], rdx
movabs rdx, 0xb100405060c0304
mov qword [rsp + 0x30], rdx
movabs rdx, 0x1080c0a010a0c05
mov qword [rsp + 0x38], rdx
xor eax, eax
jmp 0x4b028d
movzx r9d, byte [rsp + rsi + 0x1d]
sub r9d, edx
lea edx, [r9 + 0x4c]
mov byte [rsp + rdi + 0x1d], dl
lea edx, [r8 + 0x4c]
mov byte [rsp + rsi + 0x1d], dl
add rax, 2
cmp rax, 0x12
jge 0x4b02ba
movzx edx, byte [rsp + rax + 0x2e]
movzx esi, byte [rsp + rax + 0x2f]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x11
jae 0x4b02dd
movzx r8d, byte [rsp + rdi + 0x1d]
sub r8d, edx
cmp rsi, 0x11
jb 0x4b0270
jmp 0x4b02d1
xor eax, eax
lea rbx, [rsp + 0x1d]
mov ecx, 0x11
call fcn.0044bb80
add rsp, 0x40
pop rbp
ret
mov eax, esi
mov ecx, 0x11
call fcn.004610a0
mov eax, edi
mov ecx, 0x11
call fcn.004610a0
nop
call fcn.0045ee20
jmp fcn.004b0200

Function at 0x4b0300
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4b03ea
push rbp
mov rbp, rsp
sub rsp, 0x48
movabs rdx, 0xa26ce7a3b1b86902
mov qword [rsp + 0x1d], rdx
movabs rdx, 0xa3fa80a26ce7a3b1
mov qword [rsp + 0x20], rdx
movabs rdx, 0x7374739ba1a299ef
mov qword [rsp + 0x28], rdx
movabs rdx, 0x50e090c0f070505
mov qword [rsp + 0x30], rdx
movabs rdx, 0x40b080b04000a0d
mov qword [rsp + 0x38], rdx
movabs rdx, 0x70c020708030704
mov qword [rsp + 0x40], rdx
xor eax, eax
jmp 0x4b038d
movzx r9d, byte [rsp + rsi + 0x1d]
sub r9d, edx
lea edx, [r9 - 0x2f]
mov byte [rsp + rdi + 0x1d], dl
lea edx, [r8 - 0x2f]
mov byte [rsp + rsi + 0x1d], dl
add rax, 2
cmp rax, 0x18
jge 0x4b03ba
movzx edx, byte [rsp + rax + 0x30]
movzx esi, byte [rsp + rax + 0x31]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x13
jae 0x4b03dd
movzx r8d, byte [rsp + rdi + 0x1d]
sub r8d, edx
cmp rsi, 0x13
jb 0x4b0370
jmp 0x4b03d1
xor eax, eax
lea rbx, [rsp + 0x1d]
mov ecx, 0x13
call fcn.0044bb80
add rsp, 0x48
pop rbp
ret
mov eax, esi
mov ecx, 0x13
call fcn.004610a0
mov eax, edi
mov ecx, 0x13
call fcn.004610a0
nop
call fcn.0045ee20
jmp fcn.004b0300
Function at 0x4b1520
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4b15ea
push rbp
mov rbp, rsp
sub rsp, 0x48
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x58], rax
mov qword [rsp], rax
mov qword [rsp + 8], rbx
mov byte [rsp + 0x10], 0
call fcn.004030e0
xorps xmm15, xmm15
mov r14, qword [0x007a2b00]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x18], 0xffffffffffffffff
jne 0x4b15cf
mov rcx, qword [rsp + 0x60]
lea rdx, [rcx + 1]
mov qword [rsp + 0x40], rdx
lea rax, [0x005cc620]
xor ebx, ebx
mov rcx, rdx
call fcn.004479e0
mov rbx, qword [rsp + 0x60]
mov rcx, rax
xor edi, edi
mov rsi, qword [rsp + 0x40]
mov rax, qword [rsp + 0x58]
nop dword [rax]
call fcn.004b42a0
inc rbx
cmp rcx, rbx
jae 0x4b15be
mov edi, 1
lea rsi, [0x005cc620]
call fcn.00447ac0
mov word [rax + rbx*2 - 2], 0
xor edi, edi
xor esi, esi
add rsp, 0x48
pop rbp
ret
xor eax, eax
xor ebx, ebx
mov rcx, rbx
lea rdi, [0x00634678]
lea rsi, [0x00634308]
add rsp, 0x48
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.0045ee20
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.004b1520

Function at 0x4b4ae0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4b4bca
push rbp
mov rbp, rsp
sub rsp, 0x40
movabs rdx, 0x1f1f4a691f98652b
mov qword [rsp + 0x1d], rdx
movabs rdx, 0x221f1f4a691f9865
mov qword [rsp + 0x1e], rdx
movabs rdx, 0x3165696e2dcdd02f
mov qword [rsp + 0x26], rdx
movabs rdx, 0xa0b030802070305
mov qword [rsp + 0x2e], rdx
movabs rdx, 0x70b0a0b03080207
mov qword [rsp + 0x30], rdx
movabs rdx, 0x90008100b0c06
mov qword [rsp + 0x38], rdx
xor eax, eax
jmp 0x4b4b6d
movzx r9d, byte [rsp + rsi + 0x1d]
sub r9d, edx
lea edx, [r9 + 0x5a]
mov byte [rsp + rdi + 0x1d], dl
lea edx, [r8 + 0x5a]
mov byte [rsp + rsi + 0x1d], dl
add rax, 2
cmp rax, 0x12
jge 0x4b4b9a
movzx edx, byte [rsp + rax + 0x2e]
movzx esi, byte [rsp + rax + 0x2f]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x11
jae 0x4b4bbd
movzx r8d, byte [rsp + rdi + 0x1d]
sub r8d, edx
cmp rsi, 0x11
jb 0x4b4b50
jmp 0x4b4bb1
xor eax, eax
lea rbx, [rsp + 0x1d]
mov ecx, 0x11
call fcn.0044bb80
add rsp, 0x40
pop rbp
ret
mov eax, esi
mov ecx, 0x11
call fcn.004610a0
mov eax, edi
mov ecx, 0x11
call fcn.004610a0
nop
call fcn.0045ee20
jmp fcn.004b4ae0
Function at 0x4b5d80
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4b5e9d
push rbp
mov rbp, rsp
sub rsp, 0x58
movabs rdx, 0x677cbf207a9c6939
mov qword [rsp + 0x1a], rdx
movabs rdx, 0x2072cb96816989aa
mov qword [rsp + 0x22], rdx
movabs rdx, 0x9a76a6a42072cb96
mov qword [rsp + 0x26], rdx
movabs rdx, 0x65749d74b67f75a9
mov qword [rsp + 0x2e], rdx
movabs rdx, 0x20b160015050819
mov qword [rsp + 0x36], rdx
movabs rdx, 0x910020b16001505
mov qword [rsp + 0x38], rdx
movabs rdx, 0x70b03021512140d
mov qword [rsp + 0x40], rdx
movabs rdx, 0x6061113120b0d09
mov qword [rsp + 0x48], rdx
movabs rdx, 0x1113140c19081719
mov qword [rsp + 0x50], rdx
xor eax, eax
jmp 0x4b5e40
movzx r9d, byte [rsp + rsi + 0x1a]
sub r9d, edx
lea edx, [r9 + 1]
mov byte [rsp + rdi + 0x1a], dl
lea edx, [r8 + 1]
mov byte [rsp + rsi + 0x1a], dl
add rax, 2
nop word [rax + rax]
cmp rax, 0x22
jge 0x4b5e6d
movzx edx, byte [rsp + rax + 0x36]
movzx esi, byte [rsp + rax + 0x37]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x1c
jae 0x4b5e90
movzx r8d, byte [rsp + rdi + 0x1a]
sub r8d, edx
cmp rsi, 0x1c
jb 0x4b5e1d
jmp 0x4b5e84
xor eax, eax
lea rbx, [rsp + 0x1a]
mov ecx, 0x1c
call fcn.0044bb80
add rsp, 0x58
pop rbp
ret
mov eax, esi
mov ecx, 0x1c
call fcn.004610a0
mov eax, edi
mov ecx, 0x1c
call fcn.004610a0
nop
nop dword [rax]
call fcn.0045ee20
jmp fcn.004b5d80

Function at 0x4b5ec0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4b5f87
push rbp
mov rbp, rsp
sub rsp, 0x30
movabs rdx, 0x847d65b6a938838e
mov qword [rsp + 0x19], rdx
movabs rdx, 0x6595b8847d65b6a9
mov qword [rsp + 0x1c], rdx
movabs rdx, 0x904010803020006
mov qword [rsp + 0x24], rdx
mov dword [rsp + 0x2c], 0x2090701
xor eax, eax
jmp 0x4b5f28
movzx r9d, byte [rsp + rsi + 0x19]
sub r9d, edx
lea edx, [r9 - 0x15]
mov byte [rsp + rdi + 0x19], dl
lea edx, [r8 - 0x15]
mov byte [rsp + rsi + 0x19], dl
add rax, 2
cmp rax, 0xc
jge 0x4b5f57
movzx edx, byte [rsp + rax + 0x24]
movzx esi, byte [rsp + rax + 0x25]
mov edi, edx
xor edx, esi
add edx, eax
nop
cmp rdi, 0xb
jae 0x4b5f7a
movzx r8d, byte [rsp + rdi + 0x19]
sub r8d, edx
cmp rsi, 0xb
jb 0x4b5f0b
jmp 0x4b5f6e
xor eax, eax
lea rbx, [rsp + 0x19]
mov ecx, 0xb
call fcn.0044bb80
add rsp, 0x30
pop rbp
ret
mov eax, esi
mov ecx, 0xb
call fcn.004610a0
mov eax, edi
mov ecx, 0xb
call fcn.004610a0
nop
call fcn.0045ee20
jmp fcn.004b5ec0