joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4a0040
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4a0106
push rbp
mov rbp, rsp
sub rsp, 0x30
movabs rdx, 0x3a57631d6cb2b1bf
mov qword [rsp + 0x1d], rdx
mov byte [rsp + 0x25], 2
movabs rdx, 0x800080406040201
mov qword [rsp + 0x26], rdx
mov word [rsp + 0x2e], 0x201
xor eax, eax
nop
jmp 0x4a00a0
movzx r9d, byte [rsp + rsi + 0x1d]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x53]
mov byte [rsp + rdi + 0x1d], dl
mov byte [rsp + rsi + 0x1d], r8b
add rax, 2
nop dword [rax]
cmp rax, 0xa
jge 0x4a00d2
movzx edx, byte [rsp + rax + 0x26]
movzx esi, byte [rsp + rax + 0x27]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 9
jae 0x4a00f7
movzx r8d, byte [rsp + rdi + 0x1d]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x53]
cmp rsi, 9
jb 0x4a0082
jmp 0x4a00eb
xor eax, eax
lea rbx, [rsp + 0x1d]
mov ecx, 9
nop
call fcn.0044bb20
add rsp, 0x30
pop rbp
ret
mov eax, esi
mov ecx, 9
call fcn.00461020
mov eax, edi
mov ecx, 9
nop
call fcn.00461020
nop
call fcn.0045eda0
jmp fcn.004a0040

Function at 0x4a0e00
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4a0ebd
push rbp
mov rbp, rsp
sub rsp, 0x30
movabs rdx, 0x826e7778206c6f83
mov qword [rsp + 0x1b], rdx
mov byte [rsp + 0x23], 0x72
movabs rdx, 0x102060004000505
mov qword [rsp + 0x24], rdx
mov dword [rsp + 0x2c], 0x4050705
xor eax, eax
nop
jmp 0x4a0e60
movzx r9d, byte [rsp + rsi + 0x1b]
sub r9d, edx
lea edx, [r9 - 2]
mov byte [rsp + rdi + 0x1b], dl
lea edx, [r8 - 2]
mov byte [rsp + rsi + 0x1b], dl
add rax, 2
nop
cmp rax, 0xc
jge 0x4a0e8d
movzx edx, byte [rsp + rax + 0x24]
movzx esi, byte [rsp + rax + 0x25]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 9
jae 0x4a0eb0
movzx r8d, byte [rsp + rdi + 0x1b]
sub r8d, edx
cmp rsi, 9
jb 0x4a0e42
jmp 0x4a0ea4
xor eax, eax
lea rbx, [rsp + 0x1b]
mov ecx, 9
call fcn.0044bb20
add rsp, 0x30
pop rbp
ret
mov eax, esi
mov ecx, 9
call fcn.00461020
mov eax, edi
mov ecx, 9
call fcn.00461020
nop
nop dword [rax]
call fcn.0045eda0
jmp fcn.004a0e00

Function at 0x4a0fc0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4a107d
push rbp
mov rbp, rsp
sub rsp, 0x30
movabs rdx, 0x202693617f1dd166
mov qword [rsp + 0x1b], rdx
mov byte [rsp + 0x23], 0xd4
movabs rdx, 0x708070506010301
mov qword [rsp + 0x24], rdx
mov dword [rsp + 0x2c], 0x6020307
xor eax, eax
nop
jmp 0x4a1020
movzx r9d, byte [rsp + rsi + 0x1b]
sub r9d, edx
lea edx, [r9 + 0x58]
mov byte [rsp + rdi + 0x1b], dl
lea edx, [r8 + 0x58]
mov byte [rsp + rsi + 0x1b], dl
add rax, 2
nop
cmp rax, 0xc
jge 0x4a104d
movzx edx, byte [rsp + rax + 0x24]
movzx esi, byte [rsp + rax + 0x25]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 9
jae 0x4a1070
movzx r8d, byte [rsp + rdi + 0x1b]
sub r8d, edx
cmp rsi, 9
jb 0x4a1002
jmp 0x4a1064
xor eax, eax
lea rbx, [rsp + 0x1b]
mov ecx, 9
call fcn.0044bb20
add rsp, 0x30
pop rbp
ret
mov eax, esi
mov ecx, 9
call fcn.00461020
mov eax, edi
mov ecx, 9
call fcn.00461020
nop
nop dword [rax]
call fcn.0045eda0
jmp fcn.004a0fc0
Function at 0x4a10a0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4a11ba
push rbp
mov rbp, rsp
sub rsp, 0x60
movabs rdx, 0x3d5f45136c661872
mov qword [rsp + 0x1e], rdx
movabs rdx, 0xe53b581e243a6145
mov qword [rsp + 0x26], rdx
movabs rdx, 0x670508454820e53b
mov qword [rsp + 0x2c], rdx
movabs rdx, 0x6c6511cc743e64ff
mov qword [rsp + 0x34], rdx
movabs rdx, 0xf1114120f1b1506
mov qword [rsp + 0x3c], rdx
movabs rdx, 0x40d0e1a0f111412
mov qword [rsp + 0x40], rdx
movabs rdx, 0xc14131d090a1a1d
mov qword [rsp + 0x48], rdx
movabs rdx, 0x180b0e0b05111401
mov qword [rsp + 0x50], rdx
movabs rdx, 0x12070e14081b160e
mov qword [rsp + 0x58], rdx
xor eax, eax
jmp 0x4a1157
movzx r9d, byte [rsp + rsi + 0x1e]
lea edx, [r9 + rdx]
lea edx, [rdx - 6]
mov byte [rsp + rdi + 0x1e], dl
mov byte [rsp + rsi + 0x1e], r8b
add rax, 2
cmp rax, 0x24
jge 0x4a1189
movzx edx, byte [rsp + rax + 0x3c]
movzx esi, byte [rsp + rax + 0x3d]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x1e
jae 0x4a11ad
movzx r8d, byte [rsp + rdi + 0x1e]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 6]
cmp rsi, 0x1e
jb 0x4a113d
jmp 0x4a11a1
xor eax, eax
lea rbx, [rsp + 0x1e]
mov ecx, 0x1e
call fcn.0044bb20
add rsp, 0x60
pop rbp
nop
ret
mov eax, esi
mov ecx, 0x1e
call fcn.00461020
mov eax, edi
mov ecx, 0x1e
call fcn.00461020
nop
call fcn.0045eda0
nop
jmp fcn.004a10a0
Function at 0x4a1ce0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4a1e18
push rbp
mov rbp, rsp
sub rsp, 0x68
movabs rdx, 0x7b745d3fd290d4c7
mov qword [rsp + 0x18], rdx
movabs rdx, 0x50207b745d3fd290
mov qword [rsp + 0x1a], rdx
movabs rdx, 0xcd668220f5e065eb
mov qword [rsp + 0x22], rdx
movabs rdx, 0xb572d8bef66e9f3b
mov qword [rsp + 0x2a], rdx
movabs rdx, 0x5244e7793c3b36e3
mov qword [rsp + 0x32], rdx
movabs rdx, 0x1a11111513091b11
mov qword [rsp + 0x3a], rdx
movabs rdx, 0x1b151d1304160711
mov qword [rsp + 0x42], rdx
movabs rdx, 0xc171c0f21021b15
mov qword [rsp + 0x48], rdx
movabs rdx, 0x1203030f12190f1d
mov qword [rsp + 0x50], rdx
movabs rdx, 0x1031f05022002
mov qword [rsp + 0x58], rdx
movabs rdx, 0x1902160d1b190a13
mov qword [rsp + 0x60], rdx
xor eax, eax
jmp 0x4a1db8
movzx r9d, byte [rsp + rsi + 0x18]
sub r9d, edx
lea edx, [r9 - 0x3d]
mov byte [rsp + rdi + 0x18], dl
lea edx, [r8 - 0x3d]
mov byte [rsp + rsi + 0x18], dl
add rax, 2
cmp rax, 0x2e
jge 0x4a1de8
movzx edx, byte [rsp + rax + 0x3a]
movzx esi, byte [rsp + rax + 0x3b]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x22
jae 0x4a1e0b
movzx r8d, byte [rsp + rdi + 0x18]
sub r8d, edx
nop dword [rax]
cmp rsi, 0x22
jb 0x4a1d9b
jmp 0x4a1dff
xor eax, eax
lea rbx, [rsp + 0x18]
mov ecx, 0x22
call fcn.0044bb20
add rsp, 0x68
pop rbp
ret
mov eax, esi
mov ecx, 0x22
call fcn.00461020
mov eax, edi
mov ecx, 0x22
call fcn.00461020
nop
call fcn.0045eda0
nop dword [rax]
jmp fcn.004a1ce0
Function at 0x4a2900
Capabilities:
Encrypt data using rc4 prga

Disassembly:
lea r12, [rsp - 0x10]
cmp r12, qword [r14 + 0x10]
jbe 0x4a2a72
push rbp
mov rbp, rsp
sub rsp, 0x88
movabs rdx, 0x301593656caf65bf
mov qword [rsp + 0x1f], rdx
movabs rdx, 0x86ef29e7414cec5
mov qword [rsp + 0x27], rdx
movabs rdx, 0x24d565446c086ef2
mov qword [rsp + 0x2c], rdx
movabs rdx, 0xe1952a3c3e0472cf
mov qword [rsp + 0x34], rdx
movabs rdx, 0x9ce4ada8aee2fed9
mov qword [rsp + 0x3c], rdx
movabs rdx, 0xc5c8647e69203421
mov qword [rsp + 0x44], rdx
movabs rdx, 0x18070d2517151f05
mov qword [rsp + 0x4c], rdx
movabs rdx, 0x1e2508082918192c
mov qword [rsp + 0x54], rdx
movabs rdx, 0x290f1c0a1e250808
mov qword [rsp + 0x58], rdx
movabs rdx, 0x111b2b061e200724
mov qword [rsp + 0x60], rdx
movabs rdx, 0x1a222620232c131f
mov qword [rsp + 0x68], rdx
movabs rdx, 0x29130809090f0d2b
mov qword [rsp + 0x70], rdx
movabs rdx, 0xc221b1d1c252514
mov qword [rsp + 0x78], rdx
movabs rdx, 0x9001c0c26200221
mov qword [rsp + 0x80], rdx
xor eax, eax
jmp 0x4a2a0d
movzx r9d, byte [rsp + rsi + 0x1f]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x67]
mov byte [rsp + rdi + 0x1f], dl
mov byte [rsp + rsi + 0x1f], r8b
add rax, 2
cmp rax, 0x3c
jge 0x4a2a3f
movzx edx, byte [rsp + rax + 0x4c]
movzx esi, byte [rsp + rax + 0x4d]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x2d
jae 0x4a2a65
movzx r8d, byte [rsp + rdi + 0x1f]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x67]
cmp rsi, 0x2d
jb 0x4a29f3
jmp 0x4a2a59
xor eax, eax
lea rbx, [rsp + 0x1f]
mov ecx, 0x2d
call fcn.0044bb20
add rsp, 0x88
pop rbp
ret
mov eax, esi
mov ecx, 0x2d
call fcn.00461020
mov eax, edi
mov ecx, 0x2d
call fcn.00461020
nop
call fcn.0045eda0
jmp fcn.004a2900

Function at 0x4a2de0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4a2e9d
push rbp
mov rbp, rsp
sub rsp, 0x30
movabs rdx, 0x65ad0573200a34e7
mov qword [rsp + 0x1b], rdx
mov byte [rsp + 0x23], 0x6e
movabs rdx, 0x5020000020006
mov qword [rsp + 0x24], rdx
mov dword [rsp + 0x2c], 0x20106
xor eax, eax
nop
jmp 0x4a2e40
movzx r9d, byte [rsp + rsi + 0x1b]
sub r9d, edx
lea edx, [r9 + 0x27]
mov byte [rsp + rdi + 0x1b], dl
lea edx, [r8 + 0x27]
mov byte [rsp + rsi + 0x1b], dl
add rax, 2
nop
cmp rax, 0xc
jge 0x4a2e6d
movzx edx, byte [rsp + rax + 0x24]
movzx esi, byte [rsp + rax + 0x25]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 9
jae 0x4a2e90
movzx r8d, byte [rsp + rdi + 0x1b]
sub r8d, edx
cmp rsi, 9
jb 0x4a2e22
jmp 0x4a2e84
xor eax, eax
lea rbx, [rsp + 0x1b]
mov ecx, 9
call fcn.0044bb20
add rsp, 0x30
pop rbp
ret
mov eax, esi
mov ecx, 9
call fcn.00461020
mov eax, edi
mov ecx, 9
call fcn.00461020
nop
nop dword [rax]
call fcn.0045eda0
jmp fcn.004a2de0
Function at 0x4a3c80
Capabilities:
Encrypt data using rc4 prga

Disassembly:
lea r12, [rsp - 0x30]
cmp r12, qword [r14 + 0x10]
jbe 0x4a3e3b
push rbp
mov rbp, rsp
sub rsp, 0xa8
movabs rdx, 0x3a3940686c66516f
mov qword [rsp + 0x1c], rdx
movabs rdx, 0x3c636577666c1120
mov qword [rsp + 0x24], rdx
movabs rdx, 0x655e4e6a563a3c63
mov qword [rsp + 0x2a], rdx
movabs rdx, 0x4f657a4e476f9935
mov qword [rsp + 0x32], rdx
movabs rdx, 0x691f6eaa485e6f20
mov qword [rsp + 0x3a], rdx
movabs rdx, 0x6e5f674a6c7d406e
mov qword [rsp + 0x42], rdx
movabs rdx, 0x6166653d6e633f90
mov qword [rsp + 0x4a], rdx
movabs rdx, 0x4e587059696f341f
mov qword [rsp + 0x52], rdx
movabs rdx, 0xa370f2d06140c28
mov qword [rsp + 0x5a], rdx
movabs rdx, 0x273c13320a09160f
mov qword [rsp + 0x62], rdx
movabs rdx, 0x122b1d341d3c273c
mov qword [rsp + 0x68], rdx
movabs rdx, 0x180f22012a2f0a19
mov qword [rsp + 0x70], rdx
movabs rdx, 0x3b2d3d2c1a1b2e35
mov qword [rsp + 0x78], rdx
movabs rdx, 0x2030130c3b3a2c3d
mov qword [rsp + 0x80], rdx
movabs rdx, 0x3624341421103a06
mov qword [rsp + 0x88], rdx
movabs rdx, 0x4062d3b28010c06
mov qword [rsp + 0x90], rdx
movabs rdx, 0x130f1622052c
mov qword [rsp + 0x98], rdx
movabs rdx, 0x6011722351a0f28
mov qword [rsp + 0xa0], rdx
xor eax, eax
jmp 0x4a3dd8
movzx r9d, byte [rsp + rsi + 0x1c]
sub r9d, edx
lea edx, [r9 + 0x47]
mov byte [rsp + rdi + 0x1c], dl
lea edx, [r8 + 0x47]
mov byte [rsp + rsi + 0x1c], dl
add rax, 2
cmp rax, 0x4e
jge 0x4a3e08
movzx edx, byte [rsp + rax + 0x5a]
movzx esi, byte [rsp + rax + 0x5b]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x3e
jae 0x4a3e2e
movzx r8d, byte [rsp + rdi + 0x1c]
sub r8d, edx
nop dword [rax]
cmp rsi, 0x3e
jb 0x4a3dbb
jmp 0x4a3e22
xor eax, eax
lea rbx, [rsp + 0x1c]
mov ecx, 0x3e
call fcn.0044bb20
add rsp, 0xa8
pop rbp
ret
mov eax, esi
mov ecx, 0x3e
call fcn.00461020
mov eax, edi
mov ecx, 0x3e
call fcn.00461020
nop
nop dword [rax + rax]
call fcn.0045eda0
jmp fcn.004a3c80
Function at 0x4a5b40
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4a5c78
push rbp
mov rbp, rsp
sub rsp, 0x70
movabs rdx, 0xcb9f657449749cb6
mov qword [rsp + 0x1e], rdx
movabs rdx, 0xe9bbd638d8a4a4b
mov qword [rsp + 0x26], rdx
movabs rdx, 0xa6202006988fbe9e
mov qword [rsp + 0x2e], rdx
movabs rdx, 0xa9642f2973af2208
mov qword [rsp + 0x36], rdx
movabs rdx, 0x7294f14c72ca74a8
mov qword [rsp + 0x3e], rdx
movabs rdx, 0x2610070f18141c19
mov qword [rsp + 0x46], rdx
movabs rdx, 0x725170d161c1d16
mov qword [rsp + 0x4e], rdx
movabs rdx, 0x240b0725170d161c
mov qword [rsp + 0x50], rdx
movabs rdx, 0x111f18061c111c22
mov qword [rsp + 0x58], rdx
movabs rdx, 0x20720141d141a19
mov qword [rsp + 0x60], rdx
movabs rdx, 0x140109120a000e13
mov qword [rsp + 0x68], rdx
xor eax, eax
jmp 0x4a5c15
movzx r9d, byte [rsp + rsi + 0x1e]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x6b]
mov byte [rsp + rdi + 0x1e], dl
mov byte [rsp + rsi + 0x1e], r8b
add rax, 2
cmp rax, 0x2a
jge 0x4a5c48
movzx edx, byte [rsp + rax + 0x46]
movzx esi, byte [rsp + rax + 0x47]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x28
jae 0x4a5c6b
movzx r8d, byte [rsp + rdi + 0x1e]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x6b]
nop
cmp rsi, 0x28
jb 0x4a5bfb
jmp 0x4a5c5f
xor eax, eax
lea rbx, [rsp + 0x1e]
mov ecx, 0x28
call fcn.0044bb20
add rsp, 0x70
pop rbp
ret
mov eax, esi
mov ecx, 0x28
call fcn.00461020
mov eax, edi
mov ecx, 0x28
call fcn.00461020
nop
call fcn.0045eda0
nop dword [rax]
jmp fcn.004a5b40

Function at 0x4a6180
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4a626c
push rbp
mov rbp, rsp
sub rsp, 0x40
movabs rdx, 0x2e3663654b666172
mov qword [rsp + 0x1b], rdx
movabs rdx, 0x362e3663654b6661
mov qword [rsp + 0x1c], rdx
movabs rdx, 0x6e4f432e41756c61
mov qword [rsp + 0x24], rdx
movabs rdx, 0xf0f080f05010e03
mov qword [rsp + 0x2c], rdx
movabs rdx, 0xc0c0e0e0f0f080f
mov qword [rsp + 0x30], rdx
movabs rdx, 0x3060e0f0c03060c
mov qword [rsp + 0x38], rdx
xor eax, eax
jmp 0x4a620a
movzx r9d, byte [rsp + rsi + 0x1b]
lea edx, [r9 + rdx]
lea edx, [rdx - 4]
mov byte [rsp + rdi + 0x1b], dl
mov byte [rsp + rsi + 0x1b], r8b
add rax, 2
cmp rax, 0x14
jge 0x4a623c
movzx edx, byte [rsp + rax + 0x2c]
movzx esi, byte [rsp + rax + 0x2d]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x11
jae 0x4a625f
movzx r8d, byte [rsp + rdi + 0x1b]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 4]
cmp rsi, 0x11
jb 0x4a61f0
jmp 0x4a6253
xor eax, eax
lea rbx, [rsp + 0x1b]
mov ecx, 0x11
call fcn.0044bb20
add rsp, 0x40
pop rbp
ret
mov eax, esi
mov ecx, 0x11
call fcn.00461020
mov eax, edi
mov ecx, 0x11
call fcn.00461020
nop
call fcn.0045eda0
jmp fcn.004a6180
Function at 0x4a7600
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4a76ea
push rbp
mov rbp, rsp
sub rsp, 0x48
movabs rdx, 0x6a8472745c877a93
mov qword [rsp + 0x1d], rdx
movabs rdx, 0x6961a26a8472745c
mov qword [rsp + 0x20], rdx
movabs rdx, 0x646e74a15b2e653f
mov qword [rsp + 0x28], rdx
movabs rdx, 0xf070a051102020f
mov qword [rsp + 0x30], rdx
movabs rdx, 0x11060e0811081004
mov qword [rsp + 0x38], rdx
movabs rdx, 0x30e01000b070e00
mov qword [rsp + 0x40], rdx
xor eax, eax
jmp 0x4a768d
movzx r9d, byte [rsp + rsi + 0x1d]
sub r9d, edx
lea edx, [r9 + 0xd]
mov byte [rsp + rdi + 0x1d], dl
lea edx, [r8 + 0xd]
mov byte [rsp + rsi + 0x1d], dl
add rax, 2
cmp rax, 0x18
jge 0x4a76ba
movzx edx, byte [rsp + rax + 0x30]
movzx esi, byte [rsp + rax + 0x31]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x13
jae 0x4a76dd
movzx r8d, byte [rsp + rdi + 0x1d]
sub r8d, edx
cmp rsi, 0x13
jb 0x4a7670
jmp 0x4a76d1
xor eax, eax
lea rbx, [rsp + 0x1d]
mov ecx, 0x13
call fcn.0044bb20
add rsp, 0x48
pop rbp
ret
mov eax, esi
mov ecx, 0x13
call fcn.00461020
mov eax, edi
mov ecx, 0x13
call fcn.00461020
nop
call fcn.0045eda0
jmp fcn.004a7600

Function at 0x4a7700
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4a782c
push rbp
mov rbp, rsp
sub rsp, 0x68
movabs rdx, 0x17115be453664872
mov qword [rsp + 0x1f], rdx
movabs rdx, 0x4a17115be4536648
mov qword [rsp + 0x20], rdx
movabs rdx, 0x21345d066c186321
mov qword [rsp + 0x28], rdx
movabs rdx, 0x2b744f6f59616580
mov qword [rsp + 0x30], rdx
movabs rdx, 0x654f3c630f205b09
mov qword [rsp + 0x38], rdx
movabs rdx, 0xf1a091f11110f05
mov qword [rsp + 0x40], rdx
movabs rdx, 0x111307101006091e
mov qword [rsp + 0x48], rdx
movabs rdx, 0x509161d0a060b0e
mov qword [rsp + 0x50], rdx
movabs rdx, 0x10140119181c0403
mov qword [rsp + 0x58], rdx
movabs rdx, 0x11f1c0a0d081403
mov qword [rsp + 0x60], rdx
xor eax, eax
jmp 0x4a77c6
movzx r9d, byte [rsp + rsi + 0x1f]
lea edx, [r9 + rdx]
lea edx, [rdx - 0xd]
mov byte [rsp + rdi + 0x1f], dl
mov byte [rsp + rsi + 0x1f], r8b
add rax, 2
cmp rax, 0x28
jge 0x4a77fc
movzx edx, byte [rsp + rax + 0x40]
movzx esi, byte [rsp + rax + 0x41]
mov edi, edx
xor edx, esi
add edx, eax
nop dword [rax]
cmp rdi, 0x21
jae 0x4a781f
movzx r8d, byte [rsp + rdi + 0x1f]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0xd]
cmp rsi, 0x21
jb 0x4a77ac
jmp 0x4a7813
xor eax, eax
lea rbx, [rsp + 0x1f]
mov ecx, 0x21
call fcn.0044bb20
add rsp, 0x68
pop rbp
ret
mov eax, esi
mov ecx, 0x21
call fcn.00461020
mov eax, edi
mov ecx, 0x21
call fcn.00461020
nop
call fcn.0045eda0
jmp fcn.004a7700
Function at 0x4a9200
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4a92fd
push rbp
mov rbp, rsp
sub rsp, 0x48
movabs rdx, 0x3f4863503327fd26
mov qword [rsp + 0x1b], rdx
movabs rdx, 0x5061493f48635033
mov qword [rsp + 0x1e], rdx
movabs rdx, 0x4a3cc5dc042e1239
mov qword [rsp + 0x26], rdx
movabs rdx, 0x1000e100f020c11
mov qword [rsp + 0x2e], rdx
movabs rdx, 0xe10001207110e11
mov qword [rsp + 0x36], rdx
movabs rdx, 0x20b0e1000120711
mov qword [rsp + 0x38], rdx
movabs rdx, 0x3080a06120f0b04
mov qword [rsp + 0x40], rdx
xor eax, eax
jmp 0x4a92a0
movzx r9d, byte [rsp + rsi + 0x1b]
sub r9d, edx
lea edx, [r9 + 0x46]
mov byte [rsp + rdi + 0x1b], dl
lea edx, [r8 + 0x46]
mov byte [rsp + rsi + 0x1b], dl
add rax, 2
nop dword [rax]
cmp rax, 0x1a
jge 0x4a92cd
movzx edx, byte [rsp + rax + 0x2e]
movzx esi, byte [rsp + rax + 0x2f]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x13
jae 0x4a92f0
movzx r8d, byte [rsp + rdi + 0x1b]
sub r8d, edx
cmp rsi, 0x13
jb 0x4a927f
jmp 0x4a92e4
xor eax, eax
lea rbx, [rsp + 0x1b]
mov ecx, 0x13
call fcn.0044bb20
add rsp, 0x48
pop rbp
ret
mov eax, esi
mov ecx, 0x13
call fcn.00461020
mov eax, edi
mov ecx, 0x13
call fcn.00461020
nop
nop dword [rax]
call fcn.0045eda0
jmp fcn.004a9200
Function at 0x4aedc0
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4aee8a
push rbp
mov rbp, rsp
sub rsp, 0x48
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x58], rax
mov qword [rsp], rax
mov qword [rsp + 8], rbx
mov byte [rsp + 0x10], 0
call fcn.004030e0
xorps xmm15, xmm15
mov r14, qword [0x0078dac0]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x18], 0xffffffffffffffff
jne 0x4aee6f
mov rcx, qword [rsp + 0x60]
lea rdx, [rcx + 1]
mov qword [rsp + 0x40], rdx
lea rax, [0x005ba600]
xor ebx, ebx
mov rcx, rdx
call fcn.00447980
mov rbx, qword [rsp + 0x60]
mov rcx, rax
xor edi, edi
mov rsi, qword [rsp + 0x40]
mov rax, qword [rsp + 0x58]
nop dword [rax]
call fcn.004b17c0
inc rbx
cmp rcx, rbx
jae 0x4aee5e
mov edi, 1
lea rsi, [0x005ba600]
call fcn.00447a60
mov word [rax + rbx*2 - 2], 0
xor edi, edi
xor esi, esi
add rsp, 0x48
pop rbp
ret
xor eax, eax
xor ebx, ebx
mov rcx, rbx
lea rdi, [0x006232a8]
lea rsi, [0x00622f40]
add rsp, 0x48
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.0045eda0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.004aedc0

Function at 0x4afa40
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4afafd
push rbp
mov rbp, rsp
sub rsp, 0x30
movabs rdx, 0xd1e672555b4a5069
mov qword [rsp + 0x1b], rdx
mov byte [rsp + 0x23], 0x5f
movabs rdx, 0x807040103070102
mov qword [rsp + 0x24], rdx
mov dword [rsp + 0x2c], 0x1070602
xor eax, eax
nop
jmp 0x4afaa0
movzx r9d, byte [rsp + rsi + 0x1b]
sub r9d, edx
lea edx, [r9 - 0x66]
mov byte [rsp + rdi + 0x1b], dl
lea edx, [r8 - 0x66]
mov byte [rsp + rsi + 0x1b], dl
add rax, 2
nop
cmp rax, 0xc
jge 0x4afacd
movzx edx, byte [rsp + rax + 0x24]
movzx esi, byte [rsp + rax + 0x25]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 9
jae 0x4afaf0
movzx r8d, byte [rsp + rdi + 0x1b]
sub r8d, edx
cmp rsi, 9
jb 0x4afa82
jmp 0x4afae4
xor eax, eax
lea rbx, [rsp + 0x1b]
mov ecx, 9
call fcn.0044bb20
add rsp, 0x30
pop rbp
ret
mov eax, esi
mov ecx, 9
call fcn.00461020
mov eax, edi
mov ecx, 9
call fcn.00461020
nop
nop dword [rax]
call fcn.0045eda0
jmp fcn.004afa40
Function at 0x4b0200
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4b02ec
push rbp
mov rbp, rsp
sub rsp, 0x48
movabs rdx, 0xd4f7b1207265b075
mov qword [rsp + 0x1d], rdx
movabs rdx, 0xf841844247d4f7b1
mov qword [rsp + 0x22], rdx
movabs rdx, 0xf91ee76138676932
mov qword [rsp + 0x2a], rdx
movabs rdx, 0x1001061409080c05
mov qword [rsp + 0x32], rdx
movabs rdx, 0x10070a130d0b1001
mov qword [rsp + 0x38], rdx
movabs rdx, 0x12130c1305100607
mov qword [rsp + 0x40], rdx
xor eax, eax
jmp 0x4b028a
movzx r9d, byte [rsp + rsi + 0x1d]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x24]
mov byte [rsp + rdi + 0x1d], dl
mov byte [rsp + rsi + 0x1d], r8b
add rax, 2
cmp rax, 0x16
jge 0x4b02bc
movzx edx, byte [rsp + rax + 0x32]
movzx esi, byte [rsp + rax + 0x33]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x15
jae 0x4b02df
movzx r8d, byte [rsp + rdi + 0x1d]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x24]
cmp rsi, 0x15
jb 0x4b0270
jmp 0x4b02d3
xor eax, eax
lea rbx, [rsp + 0x1d]
mov ecx, 0x15
call fcn.0044bb20
add rsp, 0x48
pop rbp
ret
mov eax, esi
mov ecx, 0x15
call fcn.00461020
mov eax, edi
mov ecx, 0x15
call fcn.00461020
nop
call fcn.0045eda0
jmp fcn.004b0200

Function at 0x4b0fc0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4b107d
push rbp
mov rbp, rsp
sub rsp, 0x30
movabs rdx, 0x74827f69747b7b7b
mov qword [rsp + 0x26], rdx
mov word [rsp + 0x2e], 0x648e
movabs rdx, 0x306030002050803
mov qword [rsp + 0x1c], rdx
mov word [rsp + 0x24], 0x103
xor eax, eax
jmp 0x4b1020
movzx r9d, byte [rsp + rsi + 0x26]
sub r9d, edx
lea edx, [r9 - 4]
mov byte [rsp + rdi + 0x26], dl
lea edx, [r8 - 4]
mov byte [rsp + rsi + 0x26], dl
add rax, 2
nop
cmp rax, 0xa
jge 0x4b104d
movzx edx, byte [rsp + rax + 0x1c]
movzx esi, byte [rsp + rax + 0x1d]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0xa
jae 0x4b1070
movzx r8d, byte [rsp + rdi + 0x26]
sub r8d, edx
cmp rsi, 0xa
jb 0x4b1002
jmp 0x4b1064
xor eax, eax
lea rbx, [rsp + 0x26]
mov ecx, 0xa
call fcn.0044bb20
add rsp, 0x30
pop rbp
ret
mov eax, esi
mov ecx, 0xa
call fcn.00461020
mov eax, edi
mov ecx, 0xa
call fcn.00461020
nop
nop dword [rax]
call fcn.0045eda0
jmp fcn.004b0fc0
Function at 0x4b16e0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov qword [rsp + 0x40], 0
movabs rdx, 0x3e597401941ac58e
mov qword [rsp + 0x1e], rdx
movabs rdx, 0x401030201010206
mov qword [rsp + 0x26], rdx
mov word [rsp + 0x2e], 0x603
xor eax, eax
jmp 0x4b1734
movzx r8d, byte [rsp + rbx + 0x1e]
lea edx, [r8 + rdx]
lea edx, [rdx - 0x23]
mov byte [rsp + rsi + 0x1e], dl
mov byte [rsp + rbx + 0x1e], dil
add rax, 2
cmp rax, 0xa
jge 0x4b1768
movzx edx, byte [rsp + rax + 0x26]
movzx ebx, byte [rsp + rax + 0x27]
mov esi, edx
xor edx, ebx
add edx, eax
cmp rsi, 8
jae 0x4b17a5
movzx edi, byte [rsp + rsi + 0x1e]
lea edi, [rdi + rdx]
lea edi, [rdi - 0x23]
nop dword [rax + rax]
cmp rbx, 8
jb 0x4b171a
jmp 0x4b1797
mov qword [rsp + 0x16], 0
xor eax, eax
jmp 0x4b1781
movzx ecx, byte [rsp + rax + 0x1e]
mov byte [rsp + rax + 0x16], cl
inc rax
cmp rax, 8
jl 0x4b1775
mov rax, qword [rsp + 0x16]
mov qword [rsp + 0x40], rax
add rsp, 0x30
pop rbp
ret
mov eax, ebx
mov ecx, 8
nop
call fcn.00461020
mov eax, esi
mov ecx, 8
call fcn.00461020
nop
int3

Function at 0x4b5180
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4b526a
push rbp
mov rbp, rsp
sub rsp, 0x48
movabs rdx, 0x6f4fb6206bb069fd
mov qword [rsp + 0x1d], rdx
movabs rdx, 0xb719636f4fb6206b
mov qword [rsp + 0x20], rdx
movabs rdx, 0x650f08c657bd7865
mov qword [rsp + 0x28], rdx
movabs rdx, 0x20d091106020e10
mov qword [rsp + 0x30], rdx
movabs rdx, 0xe000a0809121005
mov qword [rsp + 0x38], rdx
movabs rdx, 0xf050d110e0e0509
mov qword [rsp + 0x40], rdx
xor eax, eax
jmp 0x4b520d
movzx r9d, byte [rsp + rsi + 0x1d]
sub r9d, edx
lea edx, [r9 - 0x35]
mov byte [rsp + rdi + 0x1d], dl
lea edx, [r8 - 0x35]
mov byte [rsp + rsi + 0x1d], dl
add rax, 2
cmp rax, 0x18
jge 0x4b523a
movzx edx, byte [rsp + rax + 0x30]
movzx esi, byte [rsp + rax + 0x31]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x13
jae 0x4b525d
movzx r8d, byte [rsp + rdi + 0x1d]
sub r8d, edx
cmp rsi, 0x13
jb 0x4b51f0
jmp 0x4b5251
xor eax, eax
lea rbx, [rsp + 0x1d]
mov ecx, 0x13
call fcn.0044bb20
add rsp, 0x48
pop rbp
ret
mov eax, esi
mov ecx, 0x13
call fcn.00461020
mov eax, edi
mov ecx, 0x13
call fcn.00461020
nop
call fcn.0045eda0
jmp fcn.004b5180