joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4c5300
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4c539f
push rbp
mov rbp, rsp
sub rsp, 0x38
movabs rdx, 0x9da9d48ea1b7f584
mov qword [rsp + 0x2d], rdx
mov dword [rsp + 0x34], 0x91a1689d
movabs rdx, 0x107040808000200
mov qword [rsp + 0x1d], rdx
movabs rdx, 0x609030a0509070a
mov qword [rsp + 0x25], rdx
xor eax, eax
jmp 0x4c5382
movzx edx, byte [rsp + rax + 0x1d]
movzx esi, byte [rsp + rax + 0x1e]
mov edi, edx
xor edx, esi
add edx, eax
movzx r8d, byte [rsp + rsi + 0x2d]
sub r8d, edx
add r8d, 0xffffffe7
movzx r9d, byte [rsp + rdi + 0x2d]
mov byte [rsp + rdi + 0x2d], r8b
sub r9d, edx
lea edx, [r9 - 0x19]
mov byte [rsp + rsi + 0x2d], dl
add rax, 2
cmp rax, 0x10
jl 0x4c534b
xor eax, eax
lea rbx, [rsp + 0x2d]
mov ecx, 0xb
call fcn.004419a0
add rsp, 0x38
pop rbp
ret
nop
call fcn.004506a0
jmp fcn.004c5300

Function at 0x4c6740
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4c6814
push rbp
mov rbp, rsp
sub rsp, 0x48
movabs rdx, 0x317272aa4374a8f7
mov qword [rsp + 0x34], rdx
movabs rdx, 0xfac4db1317272aa
mov qword [rsp + 0x38], rdx
movabs rdx, 0xc80a9dd31863650b
mov qword [rsp + 0x40], rdx
movabs rdx, 0x7071009070f0c
mov qword [rsp + 0x18], rdx
movabs rdx, 0x130b071113120c09
mov qword [rsp + 0x20], rdx
movabs rdx, 0x8041001130b0711
mov qword [rsp + 0x24], rdx
movabs rdx, 0xf0f010c0b0a0113
mov qword [rsp + 0x2c], rdx
xor eax, eax
jmp 0x4c67f7
movzx edx, byte [rsp + rax + 0x18]
movzx esi, byte [rsp + rax + 0x19]
mov edi, edx
xor edx, esi
add edx, eax
movzx r8d, byte [rsp + rsi + 0x34]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x5a]
movzx r9d, byte [rsp + rdi + 0x34]
mov byte [rsp + rdi + 0x34], r8b
lea edx, [r9 + rdx]
lea edx, [rdx - 0x5a]
mov byte [rsp + rsi + 0x34], dl
add rax, 2
cmp rax, 0x1c
jl 0x4c67bf
xor eax, eax
lea rbx, [rsp + 0x34]
mov ecx, 0x14
call fcn.004419a0
add rsp, 0x48
pop rbp
ret
call fcn.004506a0
jmp fcn.004c6740

Function at 0x4c6ac0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4c6b85
push rbp
mov rbp, rsp
sub rsp, 0x48
movabs rdx, 0xc32afa1c2915c347
mov qword [rsp + 0x35], rdx
movabs rdx, 0x14e66ec32afa1c29
mov qword [rsp + 0x38], rdx
movabs rdx, 0xbb117b9119636fbd
mov qword [rsp + 0x40], rdx
movabs rdx, 0xf101202010e0b10
mov qword [rsp + 0x1f], rdx
movabs rdx, 0xb04100a05030f10
mov qword [rsp + 0x25], rdx
movabs rdx, 0x20e0e0709110604
mov qword [rsp + 0x2d], rdx
xor eax, eax
jmp 0x4c6b68
movzx edx, byte [rsp + rax + 0x1f]
movzx esi, byte [rsp + rax + 0x20]
mov edi, edx
xor edx, esi
add edx, eax
movzx r8d, byte [rsp + rsi + 0x35]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x3b]
movzx r9d, byte [rsp + rdi + 0x35]
mov byte [rsp + rdi + 0x35], r8b
lea edx, [r9 + rdx]
lea edx, [rdx + 0x3b]
mov byte [rsp + rsi + 0x35], dl
add rax, 2
cmp rax, 0x16
jl 0x4c6b30
xor eax, eax
lea rbx, [rsp + 0x35]
mov ecx, 0x13
call fcn.004419a0
add rsp, 0x48
pop rbp
ret
call fcn.004506a0
jmp fcn.004c6ac0
Function at 0x4c7540
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4c7614
push rbp
mov rbp, rsp
sub rsp, 0x48
movabs rdx, 0xd565fd4546ecb738
mov qword [rsp + 0x34], rdx
movabs rdx, 0xb4dbb956d565fd45
mov qword [rsp + 0x38], rdx
movabs rdx, 0x5e7845cb65744962
mov qword [rsp + 0x40], rdx
movabs rdx, 0xa05010d02080500
mov qword [rsp + 0x18], rdx
movabs rdx, 0x10b04000a0b0913
mov qword [rsp + 0x20], rdx
movabs rdx, 0xd040a02010b0400
mov qword [rsp + 0x24], rdx
movabs rdx, 0xd07040210001009
mov qword [rsp + 0x2c], rdx
xor eax, eax
jmp 0x4c75f7
movzx edx, byte [rsp + rax + 0x18]
movzx esi, byte [rsp + rax + 0x19]
mov edi, edx
xor edx, esi
add edx, eax
movzx r8d, byte [rsp + rsi + 0x34]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x7c]
movzx r9d, byte [rsp + rdi + 0x34]
mov byte [rsp + rdi + 0x34], r8b
lea edx, [r9 + rdx]
lea edx, [rdx + 0x7c]
mov byte [rsp + rsi + 0x34], dl
add rax, 2
cmp rax, 0x1c
jl 0x4c75bf
xor eax, eax
lea rbx, [rsp + 0x34]
mov ecx, 0x14
call fcn.004419a0
add rsp, 0x48
pop rbp
ret
call fcn.004506a0
jmp fcn.004c7540

Function at 0x4c7a40
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4c7af6
push rbp
mov rbp, rsp
sub rsp, 0x40
movabs rdx, 0xddd16e40ca74b8d6
mov qword [rsp + 0x30], rdx
movabs rdx, 0x36c1d04b2cbec8ad
mov qword [rsp + 0x38], rdx
movabs rdx, 0x30b0a0f06040803
mov qword [rsp + 0x1a], rdx
movabs rdx, 0xa060c0a070d030b
mov qword [rsp + 0x20], rdx
movabs rdx, 0x30900010b0e0703
mov qword [rsp + 0x28], rdx
xor eax, eax
nop
jmp 0x4c7ad9
movzx edx, byte [rsp + rax + 0x1a]
movzx esi, byte [rsp + rax + 0x1b]
mov edi, edx
xor edx, esi
add edx, eax
movzx r8d, byte [rsp + rsi + 0x30]
sub r8d, edx
add r8d, 0xffffffa2
movzx r9d, byte [rsp + rdi + 0x30]
mov byte [rsp + rdi + 0x30], r8b
sub r9d, edx
lea edx, [r9 - 0x5e]
mov byte [rsp + rsi + 0x30], dl
add rax, 2
cmp rax, 0x16
jl 0x4c7aa2
xor eax, eax
lea rbx, [rsp + 0x30]
mov ecx, 0x10
call fcn.004419a0
add rsp, 0x40
pop rbp
ret
call fcn.004506a0
nop dword [rax + rax]
jmp fcn.004c7a40

Function at 0x4c7e00
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4c7eab
push rbp
mov rbp, rsp
sub rsp, 0x38
movabs rdx, 0x6bb9888550a4c489
mov qword [rsp + 0x29], rdx
movabs rdx, 0x73656da99d89936b
mov qword [rsp + 0x30], rdx
movabs rdx, 0xb01090604050b02
mov qword [rsp + 0x19], rdx
movabs rdx, 0x20a080907000b02
mov qword [rsp + 0x21], rdx
xor eax, eax
jmp 0x4c7e89
movzx edx, byte [rsp + rax + 0x19]
movzx esi, byte [rsp + rax + 0x1a]
mov edi, edx
xor edx, esi
add edx, eax
movzx r8d, byte [rsp + rsi + 0x29]
sub r8d, edx
add r8d, 0xffffffed
movzx r9d, byte [rsp + rdi + 0x29]
mov byte [rsp + rdi + 0x29], r8b
sub r9d, edx
lea edx, [r9 - 0x13]
mov byte [rsp + rsi + 0x29], dl
add rax, 2
cmp rax, 0x10
jl 0x4c7e52
xor eax, eax
lea rbx, [rsp + 0x29]
mov ecx, 0xf
nop dword [rax + rax]
call fcn.004419a0
add rsp, 0x38
pop rbp
ret
call fcn.004506a0
jmp fcn.004c7e00
Function at 0x4c81e0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4c828b
push rbp
mov rbp, rsp
sub rsp, 0x38
movabs rdx, 0x367261d6e045651e
mov qword [rsp + 0x29], rdx
movabs rdx, 0x573d666e49e84436
mov qword [rsp + 0x30], rdx
movabs rdx, 0x2040d04030d0908
mov qword [rsp + 0x19], rdx
movabs rdx, 0x302020009040704
mov qword [rsp + 0x21], rdx
xor eax, eax
jmp 0x4c826a
movzx edx, byte [rsp + rax + 0x19]
movzx esi, byte [rsp + rax + 0x1a]
mov edi, edx
xor edx, esi
add edx, eax
movzx r8d, byte [rsp + rsi + 0x29]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x74]
movzx r9d, byte [rsp + rdi + 0x29]
mov byte [rsp + rdi + 0x29], r8b
lea edx, [r9 + rdx]
lea edx, [rdx - 0x74]
mov byte [rsp + rsi + 0x29], dl
add rax, 2
cmp rax, 0x10
jl 0x4c8232
xor eax, eax
lea rbx, [rsp + 0x29]
mov ecx, 0xf
nop dword [rax]
call fcn.004419a0
add rsp, 0x38
pop rbp
ret
call fcn.004506a0
jmp fcn.004c81e0

Function at 0x4c86c0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4c87cf
push rbp
mov rbp, rsp
sub rsp, 0x70
movabs rdx, 0x16c6169c767e515
mov qword [rsp + 0x4f], rdx
movabs rdx, 0xec016c6169c767e5
mov qword [rsp + 0x50], rdx
movabs rdx, 0x726870f5414ce0bc
mov qword [rsp + 0x58], rdx
movabs rdx, 0x7249bb5241643a4d
mov qword [rsp + 0x60], rdx
movabs rdx, 0xe1feba4c01677562
mov qword [rsp + 0x68], rdx
movabs rdx, 0x2011121f1f1f0c16
mov qword [rsp + 0x1f], rdx
movabs rdx, 0x1e021b0220001b
mov qword [rsp + 0x27], rdx
movabs rdx, 0xb0216031e202018
mov qword [rsp + 0x2f], rdx
movabs rdx, 0xa1e0e090c160115
mov qword [rsp + 0x37], rdx
movabs rdx, 0x2009170d161f010c
mov qword [rsp + 0x3f], rdx
movabs rdx, 0x81c1b070a0d0b02
mov qword [rsp + 0x47], rdx
xor eax, eax
jmp 0x4c87b2
movzx edx, byte [rsp + rax + 0x1f]
movzx esi, byte [rsp + rax + 0x20]
mov edi, edx
xor edx, esi
add edx, eax
movzx r8d, byte [rsp + rsi + 0x4f]
sub r8d, edx
add r8d, 0xffffffbb
movzx r9d, byte [rsp + rdi + 0x4f]
mov byte [rsp + rdi + 0x4f], r8b
sub r9d, edx
lea edx, [r9 - 0x45]
mov byte [rsp + rsi + 0x4f], dl
add rax, 2
cmp rax, 0x30
jl 0x4c877b
xor eax, eax
lea rbx, [rsp + 0x4f]
mov ecx, 0x21
call fcn.004419a0
add rsp, 0x70
pop rbp
ret
call fcn.004506a0
jmp fcn.004c86c0
Function at 0x4cf420
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4cf4dd
push rbp
mov rbp, rsp
sub rsp, 0x38
movabs rdx, 0x6d7a70656a8c658d
mov qword [rsp + 0x2b], rdx
movabs rdx, 0x7d807c6e916d7a70
mov qword [rsp + 0x30], rdx
movabs rdx, 0x2020b0b0800
mov qword [rsp + 0x19], rdx
movabs rdx, 0xc05000002020b0b
mov qword [rsp + 0x1b], rdx
movabs rdx, 0xb070b060b06030a
mov qword [rsp + 0x23], rdx
xor eax, eax
nop
jmp 0x4cf4c0
movzx edx, byte [rsp + rax + 0x19]
movzx esi, byte [rsp + rax + 0x1a]
mov edi, edx
xor edx, esi
add edx, eax
movzx r8d, byte [rsp + rsi + 0x2b]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x1c]
movzx r9d, byte [rsp + rdi + 0x2b]
mov byte [rsp + rdi + 0x2b], r8b
lea edx, [r9 + rdx]
lea edx, [rdx - 0x1c]
mov byte [rsp + rsi + 0x2b], dl
add rax, 2
nop word [rax + rax]
cmp rax, 0x12
jl 0x4cf482
xor eax, eax
lea rbx, [rsp + 0x2b]
mov ecx, 0xd
call fcn.004419a0
add rsp, 0x38
pop rbp
ret
nop dword [rax]
call fcn.004506a0
jmp fcn.004cf420

Function at 0x4d06e0
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4d07aa
push rbp
mov rbp, rsp
sub rsp, 0x48
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rbx
mov qword [rsp], rax
mov qword [rsp + 8], rbx
mov byte [rsp + 0x10], 0
call fcn.00403060
xorps xmm15, xmm15
mov r14, qword [0x00668e78]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x18], 0xffffffffffffffff
jne 0x4d078f
mov rcx, qword [rsp + 0x60]
lea rdx, [rcx + 1]
mov qword [rsp + 0x40], rdx
lea rax, [0x00513200]
xor ebx, ebx
mov rcx, rdx
call fcn.0043e7e0
mov rbx, qword [rsp + 0x60]
mov rcx, rax
xor edi, edi
mov rsi, qword [rsp + 0x40]
mov rax, qword [rsp + 0x58]
nop dword [rax]
call fcn.004d0d20
inc rbx
cmp rcx, rbx
jae 0x4d077e
mov edi, 1
lea rsi, [0x00513200]
call fcn.0043e8c0
mov word [rax + rbx*2 - 2], 0
xor edi, edi
xor esi, esi
add rsp, 0x48
pop rbp
ret
xor eax, eax
xor ebx, ebx
mov rcx, rbx
lea rdi, [0x00557238]
lea rsi, [0x00556ed0]
add rsp, 0x48
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.004506a0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.004d06e0

Function at 0x4d22c0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4d236b
push rbp
mov rbp, rsp
sub rsp, 0x38
movabs rdx, 0x774764086c08ba95
mov qword [rsp + 0x29], rdx
movabs rdx, 0x164d76ff6ee6f77
mov qword [rsp + 0x30], rdx
movabs rdx, 0xc020201060700
mov qword [rsp + 0x19], rdx
movabs rdx, 0x90107040a0e0c0a
mov qword [rsp + 0x21], rdx
xor eax, eax
jmp 0x4d234a
movzx edx, byte [rsp + rax + 0x19]
movzx esi, byte [rsp + rax + 0x1a]
mov edi, edx
xor edx, esi
add edx, eax
movzx r8d, byte [rsp + rsi + 0x29]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x5d]
movzx r9d, byte [rsp + rdi + 0x29]
mov byte [rsp + rdi + 0x29], r8b
lea edx, [r9 + rdx]
lea edx, [rdx + 0x5d]
mov byte [rsp + rsi + 0x29], dl
add rax, 2
cmp rax, 0x10
jl 0x4d2312
xor eax, eax
lea rbx, [rsp + 0x29]
mov ecx, 0xf
nop dword [rax]
call fcn.004419a0
add rsp, 0x38
pop rbp
ret
call fcn.004506a0
jmp fcn.004d22c0
Function at 0x4d3180
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4d3272
push rbp
mov rbp, rsp
sub rsp, 0x58
movabs rdx, 0x1de0477078016e75
mov qword [rsp + 0x3f], rdx
movabs rdx, 0x697d79e47e208059
mov qword [rsp + 0x47], rdx
movabs rdx, 0x61697d79e47e2080
mov qword [rsp + 0x48], rdx
movabs rdx, 0xda705af1205a5bff
mov qword [rsp + 0x50], rdx
movabs rdx, 0xf11070706150205
mov qword [rsp + 0x1b], rdx
movabs rdx, 0xf18070f0f110707
mov qword [rsp + 0x1f], rdx
movabs rdx, 0xb120c18090b020e
mov qword [rsp + 0x27], rdx
movabs rdx, 0xf020c090b150816
mov qword [rsp + 0x2f], rdx
movabs rdx, 0x80b021107161113
mov qword [rsp + 0x37], rdx
xor eax, eax
jmp 0x4d3255
movzx edx, byte [rsp + rax + 0x1b]
movzx esi, byte [rsp + rax + 0x1c]
mov edi, edx
xor edx, esi
add edx, eax
movzx r8d, byte [rsp + rsi + 0x3f]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x5d]
movzx r9d, byte [rsp + rdi + 0x3f]
mov byte [rsp + rdi + 0x3f], r8b
lea edx, [r9 + rdx]
lea edx, [rdx + 0x5d]
mov byte [rsp + rsi + 0x3f], dl
add rax, 2
cmp rax, 0x24
jl 0x4d321d
xor eax, eax
lea rbx, [rsp + 0x3f]
mov ecx, 0x19
call fcn.004419a0
add rsp, 0x58
pop rbp
ret
call fcn.004506a0
jmp fcn.004d3180

Function at 0x4d3a20
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4d3acb
push rbp
mov rbp, rsp
sub rsp, 0x38
movabs rdx, 0xbc37743253b9ced3
mov qword [rsp + 0x2a], rdx
movabs rdx, 0xa078dbc1d34ebc37
mov qword [rsp + 0x30], rdx
movabs rdx, 0xd0a09040008060d
mov qword [rsp + 0x1a], rdx
movabs rdx, 0xb02090007010607
mov qword [rsp + 0x22], rdx
xor eax, eax
jmp 0x4d3aa9
movzx edx, byte [rsp + rax + 0x1a]
movzx esi, byte [rsp + rax + 0x1b]
mov edi, edx
xor edx, esi
add edx, eax
movzx r8d, byte [rsp + rsi + 0x2a]
sub r8d, edx
add r8d, 0xffffffa3
movzx r9d, byte [rsp + rdi + 0x2a]
mov byte [rsp + rdi + 0x2a], r8b
sub r9d, edx
lea edx, [r9 - 0x5d]
mov byte [rsp + rsi + 0x2a], dl
add rax, 2
cmp rax, 0x10
jl 0x4d3a72
xor eax, eax
lea rbx, [rsp + 0x2a]
mov ecx, 0xe
nop dword [rax + rax]
call fcn.004419a0
add rsp, 0x38
pop rbp
ret
call fcn.004506a0
jmp fcn.004d3a20

Function at 0x4d4e80
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4d4f2b
push rbp
mov rbp, rsp
sub rsp, 0x38
movabs rdx, 0xcafdb93a65635f74
mov qword [rsp + 0x28], rdx
movabs rdx, 0x2a11392d3072ce64
mov qword [rsp + 0x30], rdx
movabs rdx, 0xa0207090509020a
mov qword [rsp + 0x18], rdx
movabs rdx, 0x60a020e010a0101
mov qword [rsp + 0x20], rdx
xor eax, eax
jmp 0x4d4f0a
movzx edx, byte [rsp + rax + 0x18]
movzx esi, byte [rsp + rax + 0x19]
mov edi, edx
xor edx, esi
add edx, eax
movzx r8d, byte [rsp + rsi + 0x28]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x44]
movzx r9d, byte [rsp + rdi + 0x28]
mov byte [rsp + rdi + 0x28], r8b
lea edx, [r9 + rdx]
lea edx, [rdx + 0x44]
mov byte [rsp + rsi + 0x28], dl
add rax, 2
cmp rax, 0x10
jl 0x4d4ed2
xor eax, eax
lea rbx, [rsp + 0x28]
mov ecx, 0x10
nop dword [rax]
call fcn.004419a0
add rsp, 0x38
pop rbp
ret
call fcn.004506a0
jmp fcn.004d4e80
Function at 0x4d6c40
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4d6d13
push rbp
mov rbp, rsp
sub rsp, 0x50
movabs rdx, 0x632c34e64120d645
mov qword [rsp + 0x39], rdx
movabs rdx, 0x3120e60231c42363
mov qword [rsp + 0x40], rdx
movabs rdx, 0x656dd1549e643818
mov qword [rsp + 0x48], rdx
movabs rdx, 0xc0d120912040109
mov qword [rsp + 0x1d], rdx
movabs rdx, 0x10100d0f0f01060e
mov qword [rsp + 0x25], rdx
movabs rdx, 0x10b041410100d0f
mov qword [rsp + 0x29], rdx
movabs rdx, 0xa0514120a080904
mov qword [rsp + 0x31], rdx
xor eax, eax
jmp 0x4d6cf6
movzx edx, byte [rsp + rax + 0x1d]
movzx esi, byte [rsp + rax + 0x1e]
mov edi, edx
xor edx, esi
add edx, eax
movzx r8d, byte [rsp + rsi + 0x39]
sub r8d, edx
add r8d, 0x48
movzx r9d, byte [rsp + rdi + 0x39]
mov byte [rsp + rdi + 0x39], r8b
sub r9d, edx
lea edx, [r9 + 0x48]
mov byte [rsp + rsi + 0x39], dl
add rax, 2
cmp rax, 0x1c
jl 0x4d6cbf
xor eax, eax
lea rbx, [rsp + 0x39]
mov ecx, 0x17
call fcn.004419a0
add rsp, 0x50
pop rbp
ret
call fcn.004506a0
jmp fcn.004d6c40

Function at 0x4d7320
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4d73e4
push rbp
mov rbp, rsp
sub rsp, 0x48
movabs rdx, 0x6e3b4d3a42d43f41
mov qword [rsp + 0x32], rdx
movabs rdx, 0x6448113f534e6e3b
mov qword [rsp + 0x38], rdx
movabs rdx, 0x6559215a2047512b
mov qword [rsp + 0x40], rdx
movabs rdx, 0x4120e060f130110
mov qword [rsp + 0x1c], rdx
movabs rdx, 0x50c0f0b020a0412
mov qword [rsp + 0x22], rdx
movabs rdx, 0xe1406030f06080a
mov qword [rsp + 0x2a], rdx
xor eax, eax
jmp 0x4d73c7
movzx edx, byte [rsp + rax + 0x1c]
movzx esi, byte [rsp + rax + 0x1d]
mov edi, edx
xor edx, esi
add edx, eax
movzx r8d, byte [rsp + rsi + 0x32]
sub r8d, edx
add r8d, 0x36
movzx r9d, byte [rsp + rdi + 0x32]
mov byte [rsp + rdi + 0x32], r8b
sub r9d, edx
lea edx, [r9 + 0x36]
mov byte [rsp + rsi + 0x32], dl
add rax, 2
cmp rax, 0x16
jl 0x4d7390
xor eax, eax
lea rbx, [rsp + 0x32]
mov ecx, 0x16
call fcn.004419a0
add rsp, 0x48
pop rbp
ret
call fcn.004506a0
jmp fcn.004d7320

Function at 0x4d7700
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4d77d3
push rbp
mov rbp, rsp
sub rsp, 0x50
movabs rdx, 0x7a3b756e7163b459
mov qword [rsp + 0x39], rdx
movabs rdx, 0x68716b6b537a737a
mov qword [rsp + 0x40], rdx
movabs rdx, 0x656d6c3284649263
mov qword [rsp + 0x48], rdx
movabs rdx, 0xd0b0300130f0710
mov qword [rsp + 0x1f], rdx
movabs rdx, 0x12050f0905141401
mov qword [rsp + 0x27], rdx
movabs rdx, 0xf0712050f090514
mov qword [rsp + 0x29], rdx
movabs rdx, 0x10012060e0c050f
mov qword [rsp + 0x31], rdx
xor eax, eax
jmp 0x4d77b6
movzx edx, byte [rsp + rax + 0x1f]
movzx esi, byte [rsp + rax + 0x20]
mov edi, edx
xor edx, esi
add edx, eax
movzx r8d, byte [rsp + rsi + 0x39]
sub r8d, edx
add r8d, 0xf
movzx r9d, byte [rsp + rdi + 0x39]
mov byte [rsp + rdi + 0x39], r8b
sub r9d, edx
lea edx, [r9 + 0xf]
mov byte [rsp + rsi + 0x39], dl
add rax, 2
cmp rax, 0x1a
jl 0x4d777f
xor eax, eax
lea rbx, [rsp + 0x39]
mov ecx, 0x17
call fcn.004419a0
add rsp, 0x50
pop rbp
ret
call fcn.004506a0
jmp fcn.004d7700
Function at 0x4d8000
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4d80d3
push rbp
mov rbp, rsp
sub rsp, 0x50
movabs rdx, 0xdccd183965131f19
mov qword [rsp + 0x39], rdx
movabs rdx, 0x6824f9749d1955dc
mov qword [rsp + 0x40], rdx
movabs rdx, 0xb16d13da20647220
mov qword [rsp + 0x48], rdx
movabs rdx, 0x16020614040d0804
mov qword [rsp + 0x19], rdx
movabs rdx, 0xa0e0e0a05140202
mov qword [rsp + 0x21], rdx
movabs rdx, 0xf070807040e0d13
mov qword [rsp + 0x29], rdx
movabs rdx, 0x80d010f0e09000c
mov qword [rsp + 0x31], rdx
xor eax, eax
jmp 0x4d80b6
movzx edx, byte [rsp + rax + 0x19]
movzx esi, byte [rsp + rax + 0x1a]
mov edi, edx
xor edx, esi
add edx, eax
movzx r8d, byte [rsp + rsi + 0x39]
sub r8d, edx
add r8d, 0x6c
movzx r9d, byte [rsp + rdi + 0x39]
mov byte [rsp + rdi + 0x39], r8b
sub r9d, edx
lea edx, [r9 + 0x6c]
mov byte [rsp + rsi + 0x39], dl
add rax, 2
cmp rax, 0x20
jl 0x4d807f
xor eax, eax
lea rbx, [rsp + 0x39]
mov ecx, 0x17
call fcn.004419a0
add rsp, 0x50
pop rbp
ret
call fcn.004506a0
jmp fcn.004d8000

Function at 0x4d9ec0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4d9f94
push rbp
mov rbp, rsp
sub rsp, 0x50
movabs rdx, 0x9274d19ca0208753
mov qword [rsp + 0x38], rdx
movabs rdx, 0x9999617553a7cb58
mov qword [rsp + 0x40], rdx
movabs rdx, 0xafc09ecd3af66761
mov qword [rsp + 0x48], rdx
movabs rdx, 0x809091213081116
mov qword [rsp + 0x1a], rdx
movabs rdx, 0x141209170e150905
mov qword [rsp + 0x22], rdx
movabs rdx, 0xc010f040f161412
mov qword [rsp + 0x28], rdx
movabs rdx, 0xc0a120912040703
mov qword [rsp + 0x30], rdx
xor eax, eax
jmp 0x4d9f77
movzx edx, byte [rsp + rax + 0x1a]
movzx esi, byte [rsp + rax + 0x1b]
mov edi, edx
xor edx, esi
add edx, eax
movzx r8d, byte [rsp + rsi + 0x38]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x55]
movzx r9d, byte [rsp + rdi + 0x38]
mov byte [rsp + rdi + 0x38], r8b
lea edx, [r9 + rdx]
lea edx, [rdx - 0x55]
mov byte [rsp + rsi + 0x38], dl
add rax, 2
cmp rax, 0x1e
jl 0x4d9f3f
xor eax, eax
lea rbx, [rsp + 0x38]
mov ecx, 0x18
call fcn.004419a0
add rsp, 0x50
pop rbp
ret
call fcn.004506a0
jmp fcn.004d9ec0

Function at 0x4dc980
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4dca45
push rbp
mov rbp, rsp
sub rsp, 0x48
movabs rdx, 0x3186642796967cc4
mov qword [rsp + 0x35], rdx
movabs rdx, 0x976e823186642796
mov qword [rsp + 0x38], rdx
movabs rdx, 0x656d5b7085647291
mov qword [rsp + 0x40], rdx
movabs rdx, 0xa08010b0b0f0f00
mov qword [rsp + 0x1d], rdx
movabs rdx, 0x602070e06030408
mov qword [rsp + 0x25], rdx
movabs rdx, 0x100510080b0f0604
mov qword [rsp + 0x2d], rdx
xor eax, eax
jmp 0x4dca28
movzx edx, byte [rsp + rax + 0x1d]
movzx esi, byte [rsp + rax + 0x1e]
mov edi, edx
xor edx, esi
add edx, eax
movzx r8d, byte [rsp + rsi + 0x35]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x26]
movzx r9d, byte [rsp + rdi + 0x35]
mov byte [rsp + rdi + 0x35], r8b
lea edx, [r9 + rdx]
lea edx, [rdx - 0x26]
mov byte [rsp + rsi + 0x35], dl
add rax, 2
cmp rax, 0x18
jl 0x4dc9f0
xor eax, eax
lea rbx, [rsp + 0x35]
mov ecx, 0x13
call fcn.004419a0
add rsp, 0x48
pop rbp
ret
call fcn.004506a0
jmp fcn.004dc980
Function at 0x4dd620
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4dd6e5
push rbp
mov rbp, rsp
sub rsp, 0x48
movabs rdx, 0x20ac69b4cc20adba
mov qword [rsp + 0x33], rdx
movabs rdx, 0x61fd6b746420ac69
mov qword [rsp + 0x38], rdx
movabs rdx, 0x656dc41eca641261
mov qword [rsp + 0x40], rdx
movabs rdx, 0x111100408040c0b
mov qword [rsp + 0x1d], rdx
movabs rdx, 0x30c100a030e0111
mov qword [rsp + 0x23], rdx
movabs rdx, 0x1212010106000b01
mov qword [rsp + 0x2b], rdx
xor eax, eax
jmp 0x4dd6c8
movzx edx, byte [rsp + rax + 0x1d]
movzx esi, byte [rsp + rax + 0x1e]
mov edi, edx
xor edx, esi
add edx, eax
movzx r8d, byte [rsp + rsi + 0x33]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x6f]
movzx r9d, byte [rsp + rdi + 0x33]
mov byte [rsp + rdi + 0x33], r8b
lea edx, [r9 + rdx]
lea edx, [rdx - 0x6f]
mov byte [rsp + rsi + 0x33], dl
add rax, 2
cmp rax, 0x16
jl 0x4dd690
xor eax, eax
lea rbx, [rsp + 0x33]
mov ecx, 0x15
call fcn.004419a0
add rsp, 0x48
pop rbp
ret
call fcn.004506a0
jmp fcn.004dd620

Function at 0x4ddae0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4ddbd2
push rbp
mov rbp, rsp
sub rsp, 0x58
movabs rdx, 0x6909c9736e61de9a
mov qword [rsp + 0x3f], rdx
movabs rdx, 0x23c83053e08873c0
mov qword [rsp + 0x47], rdx
movabs rdx, 0xe623c83053e08873
mov qword [rsp + 0x48], rdx
movabs rdx, 0x11bdc09a63cf723f
mov qword [rsp + 0x50], rdx
movabs rdx, 0x160e130d10110118
mov qword [rsp + 0x1b], rdx
movabs rdx, 0xf140a0b160e130d
mov qword [rsp + 0x1f], rdx
movabs rdx, 0x508180b11141313
mov qword [rsp + 0x27], rdx
movabs rdx, 0x4140614170f0609
mov qword [rsp + 0x2f], rdx
movabs rdx, 0x1500060910170118
mov qword [rsp + 0x37], rdx
xor eax, eax
jmp 0x4ddbb5
movzx edx, byte [rsp + rax + 0x1b]
movzx esi, byte [rsp + rax + 0x1c]
mov edi, edx
xor edx, esi
add edx, eax
movzx r8d, byte [rsp + rsi + 0x3f]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x7d]
movzx r9d, byte [rsp + rdi + 0x3f]
mov byte [rsp + rdi + 0x3f], r8b
lea edx, [r9 + rdx]
lea edx, [rdx - 0x7d]
mov byte [rsp + rsi + 0x3f], dl
add rax, 2
cmp rax, 0x24
jl 0x4ddb7d
xor eax, eax
lea rbx, [rsp + 0x3f]
mov ecx, 0x19
call fcn.004419a0
add rsp, 0x58
pop rbp
ret
call fcn.004506a0
jmp fcn.004ddae0