joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4ad160
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4ad28c
push rbp
mov rbp, rsp
sub rsp, 0x68
movabs rdx, 0x9b74636ef9666572
mov qword [rsp + 0x1e], rdx
movabs rdx, 0xdcfe9b74636ef966
mov qword [rsp + 0x20], rdx
movabs rdx, 0x8b4420679e69d5da
mov qword [rsp + 0x28], rdx
movabs rdx, 0xd5e87502fd195b79
mov qword [rsp + 0x30], rdx
movabs rdx, 0x65cb6e61e1a0fd6f
mov qword [rsp + 0x38], rdx
movabs rdx, 0x41210031416040b
mov qword [rsp + 0x40], rdx
movabs rdx, 0x1119161b1c030803
mov qword [rsp + 0x48], rdx
movabs rdx, 0x130915111d040318
mov qword [rsp + 0x50], rdx
movabs rdx, 0x9140b1207151c0d
mov qword [rsp + 0x58], rdx
movabs rdx, 0x2009090b0a1b1918
mov qword [rsp + 0x60], rdx
xor eax, eax
jmp 0x4ad226
movzx r9d, byte [rsp + rsi + 0x1e]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x59]
mov byte [rsp + rdi + 0x1e], dl
mov byte [rsp + rsi + 0x1e], r8b
add rax, 2
cmp rax, 0x28
jge 0x4ad25c
movzx edx, byte [rsp + rax + 0x40]
movzx esi, byte [rsp + rax + 0x41]
mov edi, edx
xor edx, esi
add edx, eax
nop dword [rax]
cmp rdi, 0x22
jae 0x4ad27f
movzx r8d, byte [rsp + rdi + 0x1e]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x59]
cmp rsi, 0x22
jb 0x4ad20c
jmp 0x4ad273
xor eax, eax
lea rbx, [rsp + 0x1e]
mov ecx, 0x22
call fcn.0044bb20
add rsp, 0x68
pop rbp
ret
mov eax, esi
mov ecx, 0x22
call fcn.00461020
mov eax, edi
mov ecx, 0x22
call fcn.00461020
nop
call fcn.0045eda0
jmp fcn.004ad160

Function at 0x4ad7a0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4ad88c
push rbp
mov rbp, rsp
sub rsp, 0x48
movabs rdx, 0x71f054969166a41c
mov qword [rsp + 0x1f], rdx
movabs rdx, 0xea612071f0549691
mov qword [rsp + 0x22], rdx
movabs rdx, 0x761ef6c002e6575
mov qword [rsp + 0x2a], rdx
movabs rdx, 0x807050807000101
mov qword [rsp + 0x32], rdx
movabs rdx, 0x1210000e10040807
mov qword [rsp + 0x38], rdx
movabs rdx, 0x10601030a080805
mov qword [rsp + 0x40], rdx
xor eax, eax
jmp 0x4ad82a
movzx r9d, byte [rsp + rsi + 0x1f]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x5a]
mov byte [rsp + rdi + 0x1f], dl
mov byte [rsp + rsi + 0x1f], r8b
add rax, 2
cmp rax, 0x16
jge 0x4ad85c
movzx edx, byte [rsp + rax + 0x32]
movzx esi, byte [rsp + rax + 0x33]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x13
jae 0x4ad87f
movzx r8d, byte [rsp + rdi + 0x1f]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x5a]
cmp rsi, 0x13
jb 0x4ad810
jmp 0x4ad873
xor eax, eax
lea rbx, [rsp + 0x1f]
mov ecx, 0x13
call fcn.0044bb20
add rsp, 0x48
pop rbp
ret
mov eax, esi
mov ecx, 0x13
call fcn.00461020
mov eax, edi
mov ecx, 0x13
call fcn.00461020
nop
call fcn.0045eda0
jmp fcn.004ad7a0
Function at 0x4ad8a0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4ad9cc
push rbp
mov rbp, rsp
sub rsp, 0x60
movabs rdx, 0xf8e96365752c629d
mov qword [rsp + 0x1b], rdx
movabs rdx, 0xeff8e96365752c62
mov qword [rsp + 0x1c], rdx
movabs rdx, 0x6ed220646c20715d
mov qword [rsp + 0x24], rdx
movabs rdx, 0xe274756f2062dff7
mov qword [rsp + 0x2c], rdx
movabs rdx, 0x64676ac9f5a9f76f
mov qword [rsp + 0x34], rdx
movabs rdx, 0xa0215081a061c07
mov qword [rsp + 0x3c], rdx
movabs rdx, 0x91d15150a021508
mov qword [rsp + 0x40], rdx
movabs rdx, 0x150b01131e130307
mov qword [rsp + 0x48], rdx
movabs rdx, 0x15070212180a1e03
mov qword [rsp + 0x50], rdx
movabs rdx, 0x1b2013111d0f0008
mov qword [rsp + 0x58], rdx
xor eax, eax
jmp 0x4ad966
movzx r9d, byte [rsp + rsi + 0x1b]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x5f]
mov byte [rsp + rdi + 0x1b], dl
mov byte [rsp + rsi + 0x1b], r8b
add rax, 2
cmp rax, 0x24
jge 0x4ad99c
movzx edx, byte [rsp + rax + 0x3c]
movzx esi, byte [rsp + rax + 0x3d]
mov edi, edx
xor edx, esi
add edx, eax
nop dword [rax]
cmp rdi, 0x21
jae 0x4ad9bf
movzx r8d, byte [rsp + rdi + 0x1b]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x5f]
cmp rsi, 0x21
jb 0x4ad94c
jmp 0x4ad9b3
xor eax, eax
lea rbx, [rsp + 0x1b]
mov ecx, 0x21
call fcn.0044bb20
add rsp, 0x60
pop rbp
ret
mov eax, esi
mov ecx, 0x21
call fcn.00461020
mov eax, edi
mov ecx, 0x21
call fcn.00461020
nop
call fcn.0045eda0
jmp fcn.004ad8a0

Function at 0x4ae780
Capabilities:
Encrypt data using rc4 prga

Disassembly:
lea r12, [rsp - 0x10]
cmp r12, qword [r14 + 0x10]
jbe 0x4ae8f2
push rbp
mov rbp, rsp
sub rsp, 0x88
movabs rdx, 0x2ed68265ece9edef
mov qword [rsp + 0x1f], rdx
movabs rdx, 0x9442f1ed75076156
mov qword [rsp + 0x27], rdx
movabs rdx, 0x20270395dcc7d094
mov qword [rsp + 0x2e], rdx
movabs rdx, 0xb4157264ee616e86
mov qword [rsp + 0x36], rdx
movabs rdx, 0xfa622465875c6173
mov qword [rsp + 0x3e], rdx
movabs rdx, 0x7ca0d96ff5824474
mov qword [rsp + 0x46], rdx
movabs rdx, 0x2e14152117112829
mov qword [rsp + 0x4e], rdx
movabs rdx, 0xf2d222a2a1e112d
mov qword [rsp + 0x56], rdx
movabs rdx, 0x11060f2d222a2a1e
mov qword [rsp + 0x58], rdx
movabs rdx, 0xa262b2c2d222a13
mov qword [rsp + 0x60], rdx
movabs rdx, 0x280f1e0c02122a00
mov qword [rsp + 0x68], rdx
movabs rdx, 0x1d2c0528011a0613
mov qword [rsp + 0x70], rdx
movabs rdx, 0x2128030c0d0f1515
mov qword [rsp + 0x78], rdx
movabs rdx, 0x2229062814051024
mov qword [rsp + 0x80], rdx
xor eax, eax
jmp 0x4ae890
movzx r9d, byte [rsp + rsi + 0x1f]
sub r9d, edx
lea edx, [r9 - 0x4a]
mov byte [rsp + rdi + 0x1f], dl
lea edx, [r8 - 0x4a]
mov byte [rsp + rsi + 0x1f], dl
add rax, 2
cmp rax, 0x3a
jge 0x4ae8bd
movzx edx, byte [rsp + rax + 0x4e]
movzx esi, byte [rsp + rax + 0x4f]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x2f
jae 0x4ae8e5
movzx r8d, byte [rsp + rdi + 0x1f]
sub r8d, edx
cmp rsi, 0x2f
jb 0x4ae873
jmp 0x4ae8d7
xor eax, eax
lea rbx, [rsp + 0x1f]
mov ecx, 0x2f
call fcn.0044bb20
add rsp, 0x88
pop rbp
ret
mov eax, esi
mov ecx, 0x2f
nop
call fcn.00461020
mov eax, edi
mov ecx, 0x2f
call fcn.00461020
nop
call fcn.0045eda0
jmp fcn.004ae780
Function at 0x4af040
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4af106
push rbp
mov rbp, rsp
sub rsp, 0x30
movabs rdx, 0x43000c650f660f09
mov qword [rsp + 0x1b], rdx
mov byte [rsp + 0x23], 0xee
movabs rdx, 0x505050500030601
mov qword [rsp + 0x24], rdx
mov dword [rsp + 0x2c], 0x8050705
xor eax, eax
nop
jmp 0x4af0a0
movzx r9d, byte [rsp + rsi + 0x1b]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x5e]
mov byte [rsp + rdi + 0x1b], dl
mov byte [rsp + rsi + 0x1b], r8b
add rax, 2
nop dword [rax]
cmp rax, 0xc
jge 0x4af0d2
movzx edx, byte [rsp + rax + 0x24]
movzx esi, byte [rsp + rax + 0x25]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 9
jae 0x4af0f7
movzx r8d, byte [rsp + rdi + 0x1b]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x5e]
cmp rsi, 9
jb 0x4af082
jmp 0x4af0eb
xor eax, eax
lea rbx, [rsp + 0x1b]
mov ecx, 9
nop
call fcn.0044bb20
add rsp, 0x30
pop rbp
ret
mov eax, esi
mov ecx, 9
call fcn.00461020
mov eax, edi
mov ecx, 9
nop
call fcn.00461020
nop
call fcn.0045eda0
jmp fcn.004af040

Function at 0x4aff60
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4b0026
push rbp
mov rbp, rsp
sub rsp, 0x30
movabs rdx, 0x4acbe06ccedd6efd
mov qword [rsp + 0x1b], rdx
mov byte [rsp + 0x23], 0xe5
movabs rdx, 0x7070705050802
mov qword [rsp + 0x24], rdx
mov dword [rsp + 0x2c], 0x6030707
xor eax, eax
nop
jmp 0x4affc0
movzx r9d, byte [rsp + rsi + 0x1b]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x79]
mov byte [rsp + rdi + 0x1b], dl
mov byte [rsp + rsi + 0x1b], r8b
add rax, 2
nop dword [rax]
cmp rax, 0xc
jge 0x4afff2
movzx edx, byte [rsp + rax + 0x24]
movzx esi, byte [rsp + rax + 0x25]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 9
jae 0x4b0017
movzx r8d, byte [rsp + rdi + 0x1b]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x79]
cmp rsi, 9
jb 0x4affa2
jmp 0x4b000b
xor eax, eax
lea rbx, [rsp + 0x1b]
mov ecx, 9
nop
call fcn.0044bb20
add rsp, 0x30
pop rbp
ret
mov eax, esi
mov ecx, 9
call fcn.00461020
mov eax, edi
mov ecx, 9
nop
call fcn.00461020
nop
call fcn.0045eda0
jmp fcn.004aff60
Function at 0x4b3320
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4b340c
push rbp
mov rbp, rsp
sub rsp, 0x40
movabs rdx, 0x82aabb95799969d3
mov qword [rsp + 0x19], rdx
movabs rdx, 0x64a18382aabb9579
mov qword [rsp + 0x1c], rdx
movabs rdx, 0x738673a6828f2079
mov qword [rsp + 0x24], rdx
movabs rdx, 0x30f060204000503
mov qword [rsp + 0x2c], rdx
movabs rdx, 0x405110e030f0602
mov qword [rsp + 0x30], rdx
movabs rdx, 0x5020509070d0803
mov qword [rsp + 0x38], rdx
xor eax, eax
jmp 0x4b33aa
movzx r9d, byte [rsp + rsi + 0x19]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x35]
mov byte [rsp + rdi + 0x19], dl
mov byte [rsp + rsi + 0x19], r8b
add rax, 2
cmp rax, 0x14
jge 0x4b33dc
movzx edx, byte [rsp + rax + 0x2c]
movzx esi, byte [rsp + rax + 0x2d]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x13
jae 0x4b33ff
movzx r8d, byte [rsp + rdi + 0x19]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x35]
cmp rsi, 0x13
jb 0x4b3390
jmp 0x4b33f3
xor eax, eax
lea rbx, [rsp + 0x19]
mov ecx, 0x13
call fcn.0044bb20
add rsp, 0x40
pop rbp
ret
mov eax, esi
mov ecx, 0x13
call fcn.00461020
mov eax, edi
mov ecx, 0x13
call fcn.00461020
nop
call fcn.0045eda0
jmp fcn.004b3320

Function at 0x4b46c0
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4b478a
push rbp
mov rbp, rsp
sub rsp, 0x48
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x58], rax
mov qword [rsp], rax
mov qword [rsp + 8], rbx
mov byte [rsp + 0x10], 0
call fcn.004030e0
xorps xmm15, xmm15
mov r14, qword [0x00b94a00]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x18], 0xffffffffffffffff
jne 0x4b476f
mov rcx, qword [rsp + 0x60]
lea rdx, [rcx + 1]
mov qword [rsp + 0x40], rdx
lea rax, [0x005bf380]
xor ebx, ebx
mov rcx, rdx
call fcn.00447980
mov rbx, qword [rsp + 0x60]
mov rcx, rax
xor edi, edi
mov rsi, qword [rsp + 0x40]
mov rax, qword [rsp + 0x58]
nop dword [rax]
call fcn.004b7200
inc rbx
cmp rcx, rbx
jae 0x4b475e
mov edi, 1
lea rsi, [0x005bf380]
call fcn.00447a60
mov word [rax + rbx*2 - 2], 0
xor edi, edi
xor esi, esi
add rsp, 0x48
pop rbp
ret
xor eax, eax
xor ebx, ebx
mov rcx, rbx
lea rdi, [0x00a2c2f8]
lea rsi, [0x00a2bf88]
add rsp, 0x48
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.0045eda0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.004b46c0
Function at 0x4b6800
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4b68c7
push rbp
mov rbp, rsp
sub rsp, 0x30
movabs rdx, 0x716b46dae61b2ad
mov qword [rsp + 0x19], rdx
movabs rdx, 0x6b63ca0716b46dae
mov qword [rsp + 0x1c], rdx
movabs rdx, 0x103050807070001
mov qword [rsp + 0x24], rdx
mov dword [rsp + 0x2c], 0x6010800
xor eax, eax
jmp 0x4b6868
movzx r9d, byte [rsp + rsi + 0x19]
sub r9d, edx
lea edx, [r9 + 0x67]
mov byte [rsp + rdi + 0x19], dl
lea edx, [r8 + 0x67]
mov byte [rsp + rsi + 0x19], dl
add rax, 2
cmp rax, 0xc
jge 0x4b6897
movzx edx, byte [rsp + rax + 0x24]
movzx esi, byte [rsp + rax + 0x25]
mov edi, edx
xor edx, esi
add edx, eax
nop
cmp rdi, 0xb
jae 0x4b68ba
movzx r8d, byte [rsp + rdi + 0x19]
sub r8d, edx
cmp rsi, 0xb
jb 0x4b684b
jmp 0x4b68ae
xor eax, eax
lea rbx, [rsp + 0x19]
mov ecx, 0xb
call fcn.0044bb20
add rsp, 0x30
pop rbp
ret
mov eax, esi
mov ecx, 0xb
call fcn.00461020
mov eax, edi
mov ecx, 0xb
call fcn.00461020
nop
call fcn.0045eda0
jmp fcn.004b6800

Function at 0x4b7120
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov qword [rsp + 0x40], 0
movabs rdx, 0xb0067a1ec520e736
mov qword [rsp + 0x1e], rdx
movabs rdx, 0x201000105070403
mov qword [rsp + 0x26], rdx
mov word [rsp + 0x2e], 0x200
xor eax, eax
jmp 0x4b7174
movzx r8d, byte [rsp + rbx + 0x1e]
lea edx, [r8 + rdx]
lea edx, [rdx - 0x40]
mov byte [rsp + rsi + 0x1e], dl
mov byte [rsp + rbx + 0x1e], dil
add rax, 2
cmp rax, 0xa
jge 0x4b71a8
movzx edx, byte [rsp + rax + 0x26]
movzx ebx, byte [rsp + rax + 0x27]
mov esi, edx
xor edx, ebx
add edx, eax
cmp rsi, 8
jae 0x4b71e5
movzx edi, byte [rsp + rsi + 0x1e]
lea edi, [rdi + rdx]
lea edi, [rdi - 0x40]
nop dword [rax + rax]
cmp rbx, 8
jb 0x4b715a
jmp 0x4b71d7
mov qword [rsp + 0x16], 0
xor eax, eax
jmp 0x4b71c1
movzx ecx, byte [rsp + rax + 0x1e]
mov byte [rsp + rax + 0x16], cl
inc rax
cmp rax, 8
jl 0x4b71b5
mov rax, qword [rsp + 0x16]
mov qword [rsp + 0x40], rax
add rsp, 0x30
pop rbp
ret
mov eax, ebx
mov ecx, 8
nop
call fcn.00461020
mov eax, esi
mov ecx, 8
call fcn.00461020
nop
int3
Function at 0x4b7760
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4b785d
push rbp
mov rbp, rsp
sub rsp, 0x50
movabs rdx, 0x74a7d96d7f367261
mov qword [rsp + 0x1c], rdx
movabs rdx, 0x977441696c3c74a7
mov qword [rsp + 0x22], rdx
movabs rdx, 0xb5f56f6f6536c220
mov qword [rsp + 0x2a], rdx
movabs rdx, 0x100f05151503140d
mov qword [rsp + 0x32], rdx
movabs rdx, 0x1215100d1114060e
mov qword [rsp + 0x3a], rdx
movabs rdx, 0x110e140b05111215
mov qword [rsp + 0x40], rdx
movabs rdx, 0xb0803080d021502
mov qword [rsp + 0x48], rdx
xor eax, eax
jmp 0x4b7800
movzx r9d, byte [rsp + rsi + 0x1c]
sub r9d, edx
lea edx, [r9 + 0x5e]
mov byte [rsp + rdi + 0x1c], dl
lea edx, [r8 + 0x5e]
mov byte [rsp + rsi + 0x1c], dl
add rax, 2
nop dword [rax]
cmp rax, 0x1e
jge 0x4b782d
movzx edx, byte [rsp + rax + 0x32]
movzx esi, byte [rsp + rax + 0x33]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x16
jae 0x4b7850
movzx r8d, byte [rsp + rdi + 0x1c]
sub r8d, edx
cmp rsi, 0x16
jb 0x4b77df
jmp 0x4b7844
xor eax, eax
lea rbx, [rsp + 0x1c]
mov ecx, 0x16
call fcn.0044bb20
add rsp, 0x50
pop rbp
ret
mov eax, esi
mov ecx, 0x16
call fcn.00461020
mov eax, edi
mov ecx, 0x16
call fcn.00461020
nop
nop dword [rax]
call fcn.0045eda0
jmp fcn.004b7760

Function at 0x4b7b20
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4b7c1b
push rbp
mov rbp, rsp
sub rsp, 0x50
movabs rdx, 0xa2596a0ad5acb21f
mov qword [rsp + 0x1a], rdx
movabs rdx, 0xac1ba8c0b1b1a259
mov qword [rsp + 0x20], rdx
movabs rdx, 0x65af753d6e9b2079
mov qword [rsp + 0x28], rdx
movabs rdx, 0x805080300140d02
mov qword [rsp + 0x30], rdx
movabs rdx, 0x40b10070a121209
mov qword [rsp + 0x38], rdx
movabs rdx, 0x1000c0010090c06
mov qword [rsp + 0x40], rdx
movabs rdx, 0xd02040003100708
mov qword [rsp + 0x48], rdx
xor eax, eax
jmp 0x4b7bb9
movzx r9d, byte [rsp + rsi + 0x1a]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x3e]
mov byte [rsp + rdi + 0x1a], dl
mov byte [rsp + rsi + 0x1a], r8b
add rax, 2
cmp rax, 0x20
jge 0x4b7beb
movzx edx, byte [rsp + rax + 0x30]
movzx esi, byte [rsp + rax + 0x31]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x16
jae 0x4b7c0e
movzx r8d, byte [rsp + rdi + 0x1a]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x3e]
cmp rsi, 0x16
jb 0x4b7b9f
jmp 0x4b7c02
xor eax, eax
lea rbx, [rsp + 0x1a]
mov ecx, 0x16
call fcn.0044bb20
add rsp, 0x50
pop rbp
ret
mov eax, esi
mov ecx, 0x16
call fcn.00461020
mov eax, edi
mov ecx, 0x16
call fcn.00461020
nop
nop dword [rax + rax]
call fcn.0045eda0
jmp fcn.004b7b20
Function at 0x4b8600
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4b871a
push rbp
mov rbp, rsp
sub rsp, 0x60
movabs rdx, 0xf77374f0efdc846f
mov qword [rsp + 0x1b], rdx
movabs rdx, 0xf461ffec6908206e
mov qword [rsp + 0x23], rdx
movabs rdx, 0x70ffad20ccf461ff
mov qword [rsp + 0x28], rdx
movabs rdx, 0x7365ec35d8e6c9
mov qword [rsp + 0x30], rdx
movabs rdx, 0xf160104060a1c13
mov qword [rsp + 0x38], rdx
movabs rdx, 0x12140d041c0b1507
mov qword [rsp + 0x40], rdx
movabs rdx, 0x306170d0c19010b
mov qword [rsp + 0x48], rdx
movabs rdx, 0xa02171c01040712
mov qword [rsp + 0x50], rdx
movabs rdx, 0x120b180b04100301
mov qword [rsp + 0x58], rdx
xor eax, eax
jmp 0x4b86b7
movzx r9d, byte [rsp + rsi + 0x1b]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x5f]
mov byte [rsp + rdi + 0x1b], dl
mov byte [rsp + rsi + 0x1b], r8b
add rax, 2
cmp rax, 0x28
jge 0x4b86e9
movzx edx, byte [rsp + rax + 0x38]
movzx esi, byte [rsp + rax + 0x39]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x1d
jae 0x4b870d
movzx r8d, byte [rsp + rdi + 0x1b]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x5f]
cmp rsi, 0x1d
jb 0x4b869d
jmp 0x4b8701
xor eax, eax
lea rbx, [rsp + 0x1b]
mov ecx, 0x1d
call fcn.0044bb20
add rsp, 0x60
pop rbp
nop
ret
mov eax, esi
mov ecx, 0x1d
call fcn.00461020
mov eax, edi
mov ecx, 0x1d
call fcn.00461020
nop
call fcn.0045eda0
nop
jmp fcn.004b8600

Function at 0x4b8740
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4b8826
push rbp
mov rbp, rsp
sub rsp, 0x40
movabs rdx, 0xe7e9696c5caa6e03
mov qword [rsp + 0x1a], rdx
movabs rdx, 0x1267f0c3b02aeab4
mov qword [rsp + 0x22], rdx
movabs rdx, 0xa0b0c090d070007
mov qword [rsp + 0x2a], rdx
movabs rdx, 0x2080602070b0a0b
mov qword [rsp + 0x30], rdx
movabs rdx, 0x703000c000f0f0f
mov qword [rsp + 0x38], rdx
xor eax, eax
nop
jmp 0x4b87c0
movzx r9d, byte [rsp + rsi + 0x1a]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x54]
mov byte [rsp + rdi + 0x1a], dl
mov byte [rsp + rsi + 0x1a], r8b
add rax, 2
nop dword [rax]
cmp rax, 0x16
jge 0x4b87f2
movzx edx, byte [rsp + rax + 0x2a]
movzx esi, byte [rsp + rax + 0x2b]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x10
jae 0x4b8817
movzx r8d, byte [rsp + rdi + 0x1a]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x54]
cmp rsi, 0x10
jb 0x4b87a2
jmp 0x4b880b
xor eax, eax
lea rbx, [rsp + 0x1a]
mov ecx, 0x10
nop
call fcn.0044bb20
add rsp, 0x40
pop rbp
ret
mov eax, esi
mov ecx, 0x10
call fcn.00461020
mov eax, edi
mov ecx, 0x10
nop
call fcn.00461020
nop
call fcn.0045eda0
jmp fcn.004b8740
Function at 0x4b8b80
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4b8c52
push rbp
mov rbp, rsp
sub rsp, 0x38
movabs rdx, 0x8b3c65b18f807562
mov qword [rsp + 0x1d], rdx
movabs rdx, 0xad789b8b3c65b18f
mov qword [rsp + 0x20], rdx
movabs rdx, 0x306020a08070404
mov qword [rsp + 0x28], rdx
movabs rdx, 0x709040701080902
mov qword [rsp + 0x30], rdx
xor eax, eax
jmp 0x4b8bec
movzx r9d, byte [rsp + rsi + 0x1d]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x27]
mov byte [rsp + rdi + 0x1d], dl
mov byte [rsp + rsi + 0x1d], r8b
add rax, 2
cmp rax, 0x10
jge 0x4b8c1e
movzx edx, byte [rsp + rax + 0x28]
movzx esi, byte [rsp + rax + 0x29]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0xb
jae 0x4b8c45
movzx r8d, byte [rsp + rdi + 0x1d]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x27]
cmp rsi, 0xb
jb 0x4b8bd2
jmp 0x4b8c35
xor eax, eax
lea rbx, [rsp + 0x1d]
mov ecx, 0xb
call fcn.0044bb20
add rsp, 0x38
pop rbp
ret
mov eax, esi
mov ecx, 0xb
nop dword [rax]
call fcn.00461020
mov eax, edi
mov ecx, 0xb
call fcn.00461020
nop
call fcn.0045eda0
jmp fcn.004b8b80

Function at 0x4b9080
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4b917b
push rbp
mov rbp, rsp
sub rsp, 0x48
movabs rdx, 0x3f5029552e766e44
mov qword [rsp + 0x18], rdx
movabs rdx, 0x4d21f7e33f502955
mov qword [rsp + 0x1c], rdx
movabs rdx, 0x376407462074733b
mov qword [rsp + 0x24], rdx
movabs rdx, 0x913060906110c00
mov qword [rsp + 0x2c], rdx
movabs rdx, 0x60610040308040a
mov qword [rsp + 0x34], rdx
movabs rdx, 0x80c0b0906061004
mov qword [rsp + 0x38], rdx
movabs rdx, 0x605030700000605
mov qword [rsp + 0x40], rdx
xor eax, eax
jmp 0x4b9119
movzx r9d, byte [rsp + rsi + 0x18]
lea edx, [r9 + rdx]
lea edx, [rdx + 6]
mov byte [rsp + rdi + 0x18], dl
mov byte [rsp + rsi + 0x18], r8b
add rax, 2
cmp rax, 0x1c
jge 0x4b914b
movzx edx, byte [rsp + rax + 0x2c]
movzx esi, byte [rsp + rax + 0x2d]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x14
jae 0x4b916e
movzx r8d, byte [rsp + rdi + 0x18]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 6]
cmp rsi, 0x14
jb 0x4b90ff
jmp 0x4b9162
xor eax, eax
lea rbx, [rsp + 0x18]
mov ecx, 0x14
call fcn.0044bb20
add rsp, 0x48
pop rbp
ret
mov eax, esi
mov ecx, 0x14
call fcn.00461020
mov eax, edi
mov ecx, 0x14
call fcn.00461020
nop
nop dword [rax + rax]
call fcn.0045eda0
jmp fcn.004b9080
Function at 0x4bb060
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4bb14c
push rbp
mov rbp, rsp
sub rsp, 0x40
movabs rdx, 0x63d770d89253f438
mov qword [rsp + 0x1a], rdx
movabs rdx, 0x66eb63d770d89253
mov qword [rsp + 0x1c], rdx
movabs rdx, 0x723ed9e204434469
mov qword [rsp + 0x24], rdx
movabs rdx, 0x60d080e0c031001
mov qword [rsp + 0x2c], rdx
movabs rdx, 0xb000600060d080e
mov qword [rsp + 0x30], rdx
movabs rdx, 0xf04010b10030600
mov qword [rsp + 0x38], rdx
xor eax, eax
jmp 0x4bb0ea
movzx r9d, byte [rsp + rsi + 0x1a]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x7d]
mov byte [rsp + rdi + 0x1a], dl
mov byte [rsp + rsi + 0x1a], r8b
add rax, 2
cmp rax, 0x14
jge 0x4bb11c
movzx edx, byte [rsp + rax + 0x2c]
movzx esi, byte [rsp + rax + 0x2d]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x12
jae 0x4bb13f
movzx r8d, byte [rsp + rdi + 0x1a]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x7d]
cmp rsi, 0x12
jb 0x4bb0d0
jmp 0x4bb133
xor eax, eax
lea rbx, [rsp + 0x1a]
mov ecx, 0x12
call fcn.0044bb20
add rsp, 0x40
pop rbp
ret
mov eax, esi
mov ecx, 0x12
call fcn.00461020
mov eax, edi
mov ecx, 0x12
call fcn.00461020
nop
call fcn.0045eda0
jmp fcn.004bb060

Function at 0x4bb500
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4bb5cc
push rbp
mov rbp, rsp
sub rsp, 0x38
movabs rdx, 0x2a51216120326129
mov qword [rsp + 0x1f], rdx
movabs rdx, 0x1c48302a51216120
mov qword [rsp + 0x22], rdx
movabs rdx, 0x90500060502060a
mov qword [rsp + 0x2a], rdx
movabs rdx, 0x602060807060905
mov qword [rsp + 0x30], rdx
xor eax, eax
jmp 0x4bb56f
movzx r9d, byte [rsp + rsi + 0x1f]
sub r9d, edx
lea edx, [r9 + 0x2e]
mov byte [rsp + rdi + 0x1f], dl
lea edx, [r8 + 0x2e]
mov byte [rsp + rsi + 0x1f], dl
add rax, 2
cmp rax, 0xe
jge 0x4bb59c
movzx edx, byte [rsp + rax + 0x2a]
movzx esi, byte [rsp + rax + 0x2b]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0xb
jae 0x4bb5bf
movzx r8d, byte [rsp + rdi + 0x1f]
sub r8d, edx
cmp rsi, 0xb
jb 0x4bb552
jmp 0x4bb5b3
xor eax, eax
lea rbx, [rsp + 0x1f]
mov ecx, 0xb
call fcn.0044bb20
add rsp, 0x38
pop rbp
ret
mov eax, esi
mov ecx, 0xb
call fcn.00461020
mov eax, edi
mov ecx, 0xb
call fcn.00461020
nop
call fcn.0045eda0
jmp fcn.004bb500
Function at 0x4bbc80
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4bbd7d
push rbp
mov rbp, rsp
sub rsp, 0x48
movabs rdx, 0x33cb69a46e9ef369
mov qword [rsp + 0x1c], rdx
movabs rdx, 0x72de33cb69a46e9e
mov qword [rsp + 0x1e], rdx
movabs rdx, 0xe01a162e2365012e
mov qword [rsp + 0x26], rdx
movabs rdx, 0x10b0b110208060f
mov qword [rsp + 0x2e], rdx
movabs rdx, 0x11100d110d0e0f08
mov qword [rsp + 0x36], rdx
movabs rdx, 0x71011100d110d0e
mov qword [rsp + 0x38], rdx
movabs rdx, 0xf0f07020a0b040b
mov qword [rsp + 0x40], rdx
xor eax, eax
jmp 0x4bbd20
movzx r9d, byte [rsp + rsi + 0x1c]
sub r9d, edx
lea edx, [r9 + 0x59]
mov byte [rsp + rdi + 0x1c], dl
lea edx, [r8 + 0x59]
mov byte [rsp + rsi + 0x1c], dl
add rax, 2
nop dword [rax]
cmp rax, 0x1a
jge 0x4bbd4d
movzx edx, byte [rsp + rax + 0x2e]
movzx esi, byte [rsp + rax + 0x2f]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x12
jae 0x4bbd70
movzx r8d, byte [rsp + rdi + 0x1c]
sub r8d, edx
cmp rsi, 0x12
jb 0x4bbcff
jmp 0x4bbd64
xor eax, eax
lea rbx, [rsp + 0x1c]
mov ecx, 0x12
call fcn.0044bb20
add rsp, 0x48
pop rbp
ret
mov eax, esi
mov ecx, 0x12
call fcn.00461020
mov eax, edi
mov ecx, 0x12
call fcn.00461020
nop
nop dword [rax]
call fcn.0045eda0
jmp fcn.004bbc80
Function at 0x4bc600
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4bc71d
push rbp
mov rbp, rsp
sub rsp, 0x58
movabs rdx, 0x6f69464f002d9c07
mov qword [rsp + 0x1b], rdx
movabs rdx, 0x2ad43381ee2aec4c
mov qword [rsp + 0x23], rdx
movabs rdx, 0x252ad43381ee2aec
mov qword [rsp + 0x24], rdx
movabs rdx, 0xd0e267f834e47270
mov qword [rsp + 0x2c], rdx
movabs rdx, 0x3130e0917101316
mov qword [rsp + 0x34], rdx
movabs rdx, 0xc01001603130e09
mov qword [rsp + 0x38], rdx
movabs rdx, 0xc0d15180f0a0b02
mov qword [rsp + 0x40], rdx
movabs rdx, 0x1401141516180302
mov qword [rsp + 0x48], rdx
movabs rdx, 0x50804130e021014
mov qword [rsp + 0x50], rdx
xor eax, eax
jmp 0x4bc6c0
movzx r9d, byte [rsp + rsi + 0x1b]
sub r9d, edx
lea edx, [r9 + 0x57]
mov byte [rsp + rdi + 0x1b], dl
lea edx, [r8 + 0x57]
mov byte [rsp + rsi + 0x1b], dl
add rax, 2
nop word [rax + rax]
cmp rax, 0x24
jge 0x4bc6ed
movzx edx, byte [rsp + rax + 0x34]
movzx esi, byte [rsp + rax + 0x35]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x19
jae 0x4bc710
movzx r8d, byte [rsp + rdi + 0x1b]
sub r8d, edx
cmp rsi, 0x19
jb 0x4bc69d
jmp 0x4bc704
xor eax, eax
lea rbx, [rsp + 0x1b]
mov ecx, 0x19
call fcn.0044bb20
add rsp, 0x58
pop rbp
ret
mov eax, esi
mov ecx, 0x19
call fcn.00461020
mov eax, edi
mov ecx, 0x19
call fcn.00461020
nop
nop dword [rax]
call fcn.0045eda0
jmp fcn.004bc600