joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4a8580
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4a866a
push rbp
mov rbp, rsp
sub rsp, 0x40
movabs rdx, 0xe9732b69dae5d5e7
mov qword [rsp + 0x1d], rdx
movabs rdx, 0x6fe9732b69dae5d5
mov qword [rsp + 0x1e], rdx
movabs rdx, 0xeb58e76e65e420de
mov qword [rsp + 0x26], rdx
movabs rdx, 0xf03010b0b0b0b05
mov qword [rsp + 0x2e], rdx
movabs rdx, 0x10070f03010b0b0b
mov qword [rsp + 0x30], rdx
movabs rdx, 0x20001091001030e
mov qword [rsp + 0x38], rdx
xor eax, eax
jmp 0x4a860d
movzx r9d, byte [rsp + rsi + 0x1d]
sub r9d, edx
lea edx, [r9 - 0x63]
mov byte [rsp + rdi + 0x1d], dl
lea edx, [r8 - 0x63]
mov byte [rsp + rsi + 0x1d], dl
add rax, 2
cmp rax, 0x12
jge 0x4a863a
movzx edx, byte [rsp + rax + 0x2e]
movzx esi, byte [rsp + rax + 0x2f]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x11
jae 0x4a865d
movzx r8d, byte [rsp + rdi + 0x1d]
sub r8d, edx
cmp rsi, 0x11
jb 0x4a85f0
jmp 0x4a8651
xor eax, eax
lea rbx, [rsp + 0x1d]
mov ecx, 0x11
call fcn.00445b60
add rsp, 0x40
pop rbp
ret
mov eax, esi
mov ecx, 0x11
call fcn.00457ea0
mov eax, edi
mov ecx, 0x11
call fcn.00457ea0
nop
call fcn.00455c20
jmp fcn.004a8580

Function at 0x4ac0a0
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4ac16a
push rbp
mov rbp, rsp
sub rsp, 0x48
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x58], rax
mov qword [rsp], rax
mov qword [rsp + 8], rbx
mov byte [rsp + 0x10], 0
call fcn.00403b00
xorps xmm15, xmm15
mov r14, qword [0x006b0ec0]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x18], 0xffffffffffffffff
jne 0x4ac14f
mov rcx, qword [rsp + 0x60]
lea rdx, [rcx + 1]
mov qword [rsp + 0x40], rdx
lea rax, [0x0055c8e0]
xor ebx, ebx
mov rcx, rdx
call fcn.004426a0
mov rbx, qword [rsp + 0x60]
mov rcx, rax
xor edi, edi
mov rsi, qword [rsp + 0x40]
mov rax, qword [rsp + 0x58]
nop dword [rax]
call fcn.004af020
inc rbx
cmp rcx, rbx
jae 0x4ac13e
mov edi, 1
lea rsi, [0x0055c8e0]
call fcn.00442780
mov word [rax + rbx*2 - 2], 0
xor edi, edi
xor esi, esi
add rsp, 0x48
pop rbp
ret
xor eax, eax
xor ebx, ebx
mov rcx, rbx
lea rdi, [0x005aca48]
lea rsi, [0x005ac638]
add rsp, 0x48
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.00455c20
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.004ac0a0
Function at 0x4ad720
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4ad80c
push rbp
mov rbp, rsp
sub rsp, 0x48
movabs rdx, 0xf00011a4fdedce06
mov qword [rsp + 0x1d], rdx
movabs rdx, 0x6f706b61dbf00011
mov qword [rsp + 0x22], rdx
movabs rdx, 0x5700b74ee9a6ef0
mov qword [rsp + 0x2a], rdx
movabs rdx, 0x120d030414120105
mov qword [rsp + 0x32], rdx
movabs rdx, 0x30d100f0003120d
mov qword [rsp + 0x38], rdx
movabs rdx, 0x7060808020d0813
mov qword [rsp + 0x40], rdx
xor eax, eax
jmp 0x4ad7aa
movzx r9d, byte [rsp + rsi + 0x1d]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x5d]
mov byte [rsp + rdi + 0x1d], dl
mov byte [rsp + rsi + 0x1d], r8b
add rax, 2
cmp rax, 0x16
jge 0x4ad7dc
movzx edx, byte [rsp + rax + 0x32]
movzx esi, byte [rsp + rax + 0x33]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x15
jae 0x4ad7ff
movzx r8d, byte [rsp + rdi + 0x1d]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x5d]
cmp rsi, 0x15
jb 0x4ad790
jmp 0x4ad7f3
xor eax, eax
lea rbx, [rsp + 0x1d]
mov ecx, 0x15
call fcn.00445b60
add rsp, 0x48
pop rbp
ret
mov eax, esi
mov ecx, 0x15
call fcn.00457ea0
mov eax, edi
mov ecx, 0x15
call fcn.00457ea0
nop
call fcn.00455c20
jmp fcn.004ad720

Function at 0x4ae5e0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4ae6db
push rbp
mov rbp, rsp
sub rsp, 0x50
movabs rdx, 0x39a6bfd5596fafb0
mov qword [rsp + 0x1d], rdx
movabs rdx, 0x201fa4a65c39a6bf
mov qword [rsp + 0x22], rdx
movabs rdx, 0xfbabc6a68a5869ae
mov qword [rsp + 0x2a], rdx
movabs rdx, 0x10b010800071402
mov qword [rsp + 0x32], rdx
movabs rdx, 0x2060d0103130002
mov qword [rsp + 0x3a], rdx
movabs rdx, 0x120a0b0a0f040206
mov qword [rsp + 0x40], rdx
movabs rdx, 0x90d111010050f0a
mov qword [rsp + 0x48], rdx
xor eax, eax
jmp 0x4ae679
movzx r9d, byte [rsp + rsi + 0x1d]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x53]
mov byte [rsp + rdi + 0x1d], dl
mov byte [rsp + rsi + 0x1d], r8b
add rax, 2
cmp rax, 0x1e
jge 0x4ae6ab
movzx edx, byte [rsp + rax + 0x32]
movzx esi, byte [rsp + rax + 0x33]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x15
jae 0x4ae6ce
movzx r8d, byte [rsp + rdi + 0x1d]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x53]
cmp rsi, 0x15
jb 0x4ae65f
jmp 0x4ae6c2
xor eax, eax
lea rbx, [rsp + 0x1d]
mov ecx, 0x15
call fcn.00445b60
add rsp, 0x50
pop rbp
ret
mov eax, esi
mov ecx, 0x15
call fcn.00457ea0
mov eax, edi
mov ecx, 0x15
call fcn.00457ea0
nop
nop dword [rax + rax]
call fcn.00455c20
jmp fcn.004ae5e0
Function at 0x4af580
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4af66c
push rbp
mov rbp, rsp
sub rsp, 0x40
movabs rdx, 0x69f8733a6d72063b
mov qword [rsp + 0x1d], rdx
movabs rdx, 0xf769f8733a6d7206
mov qword [rsp + 0x1e], rdx
movabs rdx, 0x646569053f642fcc
mov qword [rsp + 0x26], rdx
movabs rdx, 0x10c0906080d00
mov qword [rsp + 0x2e], rdx
movabs rdx, 0x10800010c090608
mov qword [rsp + 0x30], rdx
movabs rdx, 0x60a060804000a0c
mov qword [rsp + 0x38], rdx
xor eax, eax
jmp 0x4af60a
movzx r9d, byte [rsp + rsi + 0x1d]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x26]
mov byte [rsp + rdi + 0x1d], dl
mov byte [rsp + rsi + 0x1d], r8b
add rax, 2
cmp rax, 0x12
jge 0x4af63c
movzx edx, byte [rsp + rax + 0x2e]
movzx esi, byte [rsp + rax + 0x2f]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x11
jae 0x4af65f
movzx r8d, byte [rsp + rdi + 0x1d]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x26]
cmp rsi, 0x11
jb 0x4af5f0
jmp 0x4af653
xor eax, eax
lea rbx, [rsp + 0x1d]
mov ecx, 0x11
call fcn.00445b60
add rsp, 0x40
pop rbp
ret
mov eax, esi
mov ecx, 0x11
call fcn.00457ea0
mov eax, edi
mov ecx, 0x11
call fcn.00457ea0
nop
call fcn.00455c20
jmp fcn.004af580

Function at 0x4b1160
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4b122c
push rbp
mov rbp, rsp
sub rsp, 0x30
movabs rdx, 0xddc8e6e3cad5cc62
mov qword [rsp + 0x19], rdx
movabs rdx, 0x652bdaddc8e6e3ca
mov qword [rsp + 0x1c], rdx
movabs rdx, 0x509020204070806
mov qword [rsp + 0x24], rdx
mov dword [rsp + 0x2c], 0x1050309
xor eax, eax
jmp 0x4b11c5
movzx r9d, byte [rsp + rsi + 0x19]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x75]
mov byte [rsp + rdi + 0x19], dl
mov byte [rsp + rsi + 0x19], r8b
add rax, 2
cmp rax, 0xc
jge 0x4b11fc
movzx edx, byte [rsp + rax + 0x24]
movzx esi, byte [rsp + rax + 0x25]
mov edi, edx
xor edx, esi
add edx, eax
nop dword [rax + rax]
cmp rdi, 0xb
jae 0x4b121f
movzx r8d, byte [rsp + rdi + 0x19]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x75]
cmp rsi, 0xb
jb 0x4b11ab
jmp 0x4b1213
xor eax, eax
lea rbx, [rsp + 0x19]
mov ecx, 0xb
call fcn.00445b60
add rsp, 0x30
pop rbp
ret
mov eax, esi
mov ecx, 0xb
call fcn.00457ea0
mov eax, edi
mov ecx, 0xb
call fcn.00457ea0
nop
call fcn.00455c20
jmp fcn.004b1160
Function at 0x4b1c00
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4b1cec
push rbp
mov rbp, rsp
sub rsp, 0x48
movabs rdx, 0x51c0696855516f6e
mov qword [rsp + 0x1e], rdx
movabs rdx, 0x704451c069685551
mov qword [rsp + 0x20], rdx
movabs rdx, 0x4b65736628085d0b
mov qword [rsp + 0x28], rdx
movabs rdx, 0xb0e020805060d11
mov qword [rsp + 0x30], rdx
movabs rdx, 0x1107050e0e0a0a05
mov qword [rsp + 0x38], rdx
movabs rdx, 0x80c0203080e0503
mov qword [rsp + 0x40], rdx
xor eax, eax
jmp 0x4b1c8a
movzx r9d, byte [rsp + rsi + 0x1e]
lea edx, [r9 + rdx]
lea edx, [rdx - 2]
mov byte [rsp + rdi + 0x1e], dl
mov byte [rsp + rsi + 0x1e], r8b
add rax, 2
cmp rax, 0x18
jge 0x4b1cbc
movzx edx, byte [rsp + rax + 0x30]
movzx esi, byte [rsp + rax + 0x31]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x12
jae 0x4b1cdf
movzx r8d, byte [rsp + rdi + 0x1e]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 2]
cmp rsi, 0x12
jb 0x4b1c70
jmp 0x4b1cd3
xor eax, eax
lea rbx, [rsp + 0x1e]
mov ecx, 0x12
call fcn.00445b60
add rsp, 0x48
pop rbp
ret
mov eax, esi
mov ecx, 0x12
call fcn.00457ea0
mov eax, edi
mov ecx, 0x12
call fcn.00457ea0
nop
call fcn.00455c20
jmp fcn.004b1c00

Function at 0x4b1d00
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4b1e1d
push rbp
mov rbp, rsp
sub rsp, 0x60
movabs rdx, 0xa7b965b06e65aff9
mov qword [rsp + 0x1f], rdx
movabs rdx, 0x92a69065cff7e566
mov qword [rsp + 0x27], rdx
movabs rdx, 0xb3ccf192a69065cf
mov qword [rsp + 0x2a], rdx
movabs rdx, 0x6567bdceac20b36f
mov qword [rsp + 0x32], rdx
movabs rdx, 0x20a0b080f0d060f
mov qword [rsp + 0x3a], rdx
movabs rdx, 0x140804101702020a
mov qword [rsp + 0x40], rdx
movabs rdx, 0x171700021601090a
mov qword [rsp + 0x48], rdx
movabs rdx, 0xb0716120b12160e
mov qword [rsp + 0x50], rdx
movabs rdx, 0x1102110916180a04
mov qword [rsp + 0x58], rdx
xor eax, eax
jmp 0x4b1dc0
movzx r9d, byte [rsp + rsi + 0x1f]
sub r9d, edx
lea edx, [r9 - 0x1d]
mov byte [rsp + rdi + 0x1f], dl
lea edx, [r8 - 0x1d]
mov byte [rsp + rsi + 0x1f], dl
add rax, 2
nop word [rax + rax]
cmp rax, 0x26
jge 0x4b1ded
movzx edx, byte [rsp + rax + 0x3a]
movzx esi, byte [rsp + rax + 0x3b]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x1b
jae 0x4b1e10
movzx r8d, byte [rsp + rdi + 0x1f]
sub r8d, edx
cmp rsi, 0x1b
jb 0x4b1d9d
jmp 0x4b1e04
xor eax, eax
lea rbx, [rsp + 0x1f]
mov ecx, 0x1b
call fcn.00445b60
add rsp, 0x60
pop rbp
ret
mov eax, esi
mov ecx, 0x1b
call fcn.00457ea0
mov eax, edi
mov ecx, 0x1b
call fcn.00457ea0
nop
nop dword [rax]
call fcn.00455c20
jmp fcn.004b1d00
Function at 0x4b1e40
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4b1f5a
push rbp
mov rbp, rsp
sub rsp, 0x58
movabs rdx, 0x5c25807e666d6f84
mov qword [rsp + 0x1b], rdx
movabs rdx, 0x924e207986ae7675
mov qword [rsp + 0x23], rdx
movabs rdx, 0x726b72924e207986
mov qword [rsp + 0x26], rdx
movabs rdx, 0x63586e80206e4f61
mov qword [rsp + 0x2e], rdx
movabs rdx, 0x417050f000c050a
mov qword [rsp + 0x36], rdx
movabs rdx, 0x18030417050f000c
mov qword [rsp + 0x38], rdx
movabs rdx, 0x50906050b0f1407
mov qword [rsp + 0x40], rdx
movabs rdx, 0x8140a0803111a0e
mov qword [rsp + 0x48], rdx
movabs rdx, 0x9131a1308191a07
mov qword [rsp + 0x50], rdx
xor eax, eax
jmp 0x4b1ef7
movzx r9d, byte [rsp + rsi + 0x1b]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x24]
mov byte [rsp + rdi + 0x1b], dl
mov byte [rsp + rsi + 0x1b], r8b
add rax, 2
cmp rax, 0x22
jge 0x4b1f29
movzx edx, byte [rsp + rax + 0x36]
movzx esi, byte [rsp + rax + 0x37]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x1b
jae 0x4b1f4d
movzx r8d, byte [rsp + rdi + 0x1b]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x24]
cmp rsi, 0x1b
jb 0x4b1edd
jmp 0x4b1f41
xor eax, eax
lea rbx, [rsp + 0x1b]
mov ecx, 0x1b
call fcn.00445b60
add rsp, 0x58
pop rbp
nop
ret
mov eax, esi
mov ecx, 0x1b
call fcn.00457ea0
mov eax, edi
mov ecx, 0x1b
call fcn.00457ea0
nop
call fcn.00455c20
nop
jmp fcn.004b1e40

Function at 0x4b2a60
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4b2b68
push rbp
mov rbp, rsp
sub rsp, 0x50
movabs rdx, 0x8e909c75808bae72
mov qword [rsp + 0x1d], rdx
movabs rdx, 0xa090e764bc25836a
mov qword [rsp + 0x25], rdx
movabs rdx, 0x92a090e764bc2583
mov qword [rsp + 0x26], rdx
movabs rdx, 0x8fb164692e766186
mov qword [rsp + 0x2e], rdx
movabs rdx, 0x11140b170f11080a
mov qword [rsp + 0x36], rdx
movabs rdx, 0x17020501050e0718
mov qword [rsp + 0x3e], rdx
movabs rdx, 0x90d17020501050e
mov qword [rsp + 0x40], rdx
movabs rdx, 0x10050e060b030910
mov qword [rsp + 0x48], rdx
xor eax, eax
jmp 0x4b2b0b
movzx r9d, byte [rsp + rsi + 0x1d]
sub r9d, edx
lea edx, [r9 - 3]
mov byte [rsp + rdi + 0x1d], dl
lea edx, [r8 - 3]
mov byte [rsp + rsi + 0x1d], dl
add rax, 2
cmp rax, 0x1a
jge 0x4b2b38
movzx edx, byte [rsp + rax + 0x36]
movzx esi, byte [rsp + rax + 0x37]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x19
jae 0x4b2b5b
movzx r8d, byte [rsp + rdi + 0x1d]
sub r8d, edx
cmp rsi, 0x19
jb 0x4b2aee
jmp 0x4b2b4f
xor eax, eax
lea rbx, [rsp + 0x1d]
mov ecx, 0x19
call fcn.00445b60
add rsp, 0x50
pop rbp
ret
mov eax, esi
mov ecx, 0x19
call fcn.00457ea0
mov eax, edi
mov ecx, 0x19
call fcn.00457ea0
nop
call fcn.00455c20
jmp fcn.004b2a60
Function at 0x4b3b20
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4b3bf8
push rbp
mov rbp, rsp
sub rsp, 0x38
movabs rdx, 0xa7a9c0c620046fc1
mov qword [rsp + 0x1a], rdx
mov dword [rsp + 0x22], 0xfd11f4ba
movabs rdx, 0xb0a0402030b0005
mov qword [rsp + 0x26], rdx
movabs rdx, 0x60b0b0a0402030b
mov qword [rsp + 0x28], rdx
movabs rdx, 0xb07040908030709
mov qword [rsp + 0x30], rdx
xor eax, eax
jmp 0x4b3b94
movzx r9d, byte [rsp + rsi + 0x1a]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x5d]
mov byte [rsp + rdi + 0x1a], dl
mov byte [rsp + rsi + 0x1a], r8b
add rax, 2
cmp rax, 0x12
jge 0x4b3bc8
movzx edx, byte [rsp + rax + 0x26]
movzx esi, byte [rsp + rax + 0x27]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0xc
jae 0x4b3beb
movzx r8d, byte [rsp + rdi + 0x1a]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x5d]
nop
cmp rsi, 0xc
jb 0x4b3b7a
jmp 0x4b3bdf
xor eax, eax
lea rbx, [rsp + 0x1a]
mov ecx, 0xc
call fcn.00445b60
add rsp, 0x38
pop rbp
ret
mov eax, esi
mov ecx, 0xc
call fcn.00457ea0
mov eax, edi
mov ecx, 0xc
call fcn.00457ea0
nop
call fcn.00455c20
nop dword [rax]
jmp fcn.004b3b20

Function at 0x4b78c0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4b79da
push rbp
mov rbp, rsp
sub rsp, 0x60
movabs rdx, 0x63132e202d690a00
mov qword [rsp + 0x1d], rdx
movabs rdx, 0x200c2420006f5a4f
mov qword [rsp + 0x25], rdx
movabs rdx, 0xd6baf68d6ff20120
mov qword [rsp + 0x2c], rdx
movabs rdx, 0x642574702172426f
mov qword [rsp + 0x34], rdx
movabs rdx, 0x809130606011d1a
mov qword [rsp + 0x3c], rdx
movabs rdx, 0x1d16131408091306
mov qword [rsp + 0x40], rdx
movabs rdx, 0x151d150010031d06
mov qword [rsp + 0x48], rdx
movabs rdx, 0x30311000b060e0e
mov qword [rsp + 0x50], rdx
movabs rdx, 0xe05130d1a180601
mov qword [rsp + 0x58], rdx
xor eax, eax
jmp 0x4b7977
movzx r9d, byte [rsp + rsi + 0x1d]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x13]
mov byte [rsp + rdi + 0x1d], dl
mov byte [rsp + rsi + 0x1d], r8b
add rax, 2
cmp rax, 0x24
jge 0x4b79a9
movzx edx, byte [rsp + rax + 0x3c]
movzx esi, byte [rsp + rax + 0x3d]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x1f
jae 0x4b79cd
movzx r8d, byte [rsp + rdi + 0x1d]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x13]
cmp rsi, 0x1f
jb 0x4b795d
jmp 0x4b79c1
xor eax, eax
lea rbx, [rsp + 0x1d]
mov ecx, 0x1f
call fcn.00445b60
add rsp, 0x60
pop rbp
nop
ret
mov eax, esi
mov ecx, 0x1f
call fcn.00457ea0
mov eax, edi
mov ecx, 0x1f
call fcn.00457ea0
nop
call fcn.00455c20
nop
jmp fcn.004b78c0
Function at 0x4ba120
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4ba1ec
push rbp
mov rbp, rsp
sub rsp, 0x38
movabs rdx, 0x8468848fc02056a8
mov qword [rsp + 0x1a], rdx
movabs rdx, 0xa9ac82767b7f8468
mov qword [rsp + 0x20], rdx
movabs rdx, 0x309080d0c090501
mov qword [rsp + 0x28], rdx
movabs rdx, 0x7050904080b0008
mov qword [rsp + 0x30], rdx
xor eax, eax
jmp 0x4ba18f
movzx r9d, byte [rsp + rsi + 0x1a]
sub r9d, edx
lea edx, [r9 - 0x11]
mov byte [rsp + rdi + 0x1a], dl
lea edx, [r8 - 0x11]
mov byte [rsp + rsi + 0x1a], dl
add rax, 2
cmp rax, 0x10
jge 0x4ba1bc
movzx edx, byte [rsp + rax + 0x28]
movzx esi, byte [rsp + rax + 0x29]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0xe
jae 0x4ba1df
movzx r8d, byte [rsp + rdi + 0x1a]
sub r8d, edx
cmp rsi, 0xe
jb 0x4ba172
jmp 0x4ba1d3
xor eax, eax
lea rbx, [rsp + 0x1a]
mov ecx, 0xe
call fcn.00445b60
add rsp, 0x38
pop rbp
ret
mov eax, esi
mov ecx, 0xe
call fcn.00457ea0
mov eax, edi
mov ecx, 0xe
call fcn.00457ea0
nop
call fcn.00455c20
jmp fcn.004ba120

Function at 0x4bc400
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4bc4fd
push rbp
mov rbp, rsp
sub rsp, 0x50
movabs rdx, 0x6574c6cd21d57662
mov qword [rsp + 0x1f], rdx
movabs rdx, 0x7b656392cd6574c6
mov qword [rsp + 0x24], rdx
movabs rdx, 0x64c0c227757582c1
mov qword [rsp + 0x2c], rdx
movabs rdx, 0x60c03110d020e12
mov qword [rsp + 0x34], rdx
movabs rdx, 0xd0112130f05010c
mov qword [rsp + 0x3c], rdx
movabs rdx, 0x10601090d011213
mov qword [rsp + 0x40], rdx
movabs rdx, 0x608130104091103
mov qword [rsp + 0x48], rdx
xor eax, eax
jmp 0x4bc4a0
movzx r9d, byte [rsp + rsi + 0x1f]
sub r9d, edx
lea edx, [r9 - 0x41]
mov byte [rsp + rdi + 0x1f], dl
lea edx, [r8 - 0x41]
mov byte [rsp + rsi + 0x1f], dl
add rax, 2
nop dword [rax]
cmp rax, 0x1c
jge 0x4bc4cd
movzx edx, byte [rsp + rax + 0x34]
movzx esi, byte [rsp + rax + 0x35]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x15
jae 0x4bc4f0
movzx r8d, byte [rsp + rdi + 0x1f]
sub r8d, edx
cmp rsi, 0x15
jb 0x4bc47f
jmp 0x4bc4e4
xor eax, eax
lea rbx, [rsp + 0x1f]
mov ecx, 0x15
call fcn.00445b60
add rsp, 0x50
pop rbp
ret
mov eax, esi
mov ecx, 0x15
call fcn.00457ea0
mov eax, edi
mov ecx, 0x15
call fcn.00457ea0
nop
nop dword [rax]
call fcn.00455c20
jmp fcn.004bc400
Function at 0x4bdca0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4bdd9d
push rbp
mov rbp, rsp
sub rsp, 0x50
movabs rdx, 0xc0a37b6138859ab0
mov qword [rsp + 0x1f], rdx
movabs rdx, 0xa220746fa8a5f2c0
mov qword [rsp + 0x26], rdx
movabs rdx, 0x64baae729d709d8a
mov qword [rsp + 0x2e], rdx
movabs rdx, 0x309140107050109
mov qword [rsp + 0x36], rdx
movabs rdx, 0x80100021505050e
mov qword [rsp + 0x3e], rdx
movabs rdx, 0xf02080100021505
mov qword [rsp + 0x40], rdx
movabs rdx, 0x612100a1001050e
mov qword [rsp + 0x48], rdx
xor eax, eax
jmp 0x4bdd40
movzx r9d, byte [rsp + rsi + 0x1f]
sub r9d, edx
lea edx, [r9 - 8]
mov byte [rsp + rdi + 0x1f], dl
lea edx, [r8 - 8]
mov byte [rsp + rsi + 0x1f], dl
add rax, 2
nop dword [rax]
cmp rax, 0x1a
jge 0x4bdd6d
movzx edx, byte [rsp + rax + 0x36]
movzx esi, byte [rsp + rax + 0x37]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x17
jae 0x4bdd90
movzx r8d, byte [rsp + rdi + 0x1f]
sub r8d, edx
cmp rsi, 0x17
jb 0x4bdd1f
jmp 0x4bdd84
xor eax, eax
lea rbx, [rsp + 0x1f]
mov ecx, 0x17
call fcn.00445b60
add rsp, 0x50
pop rbp
ret
mov eax, esi
mov ecx, 0x17
call fcn.00457ea0
mov eax, edi
mov ecx, 0x17
call fcn.00457ea0
nop
nop dword [rax]
call fcn.00455c20
jmp fcn.004bdca0

Function at 0x4c0400
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4c051d
push rbp
mov rbp, rsp
sub rsp, 0x58
movabs rdx, 0x74e761a0dcf23273
mov qword [rsp + 0x1d], rdx
movabs rdx, 0x37e36fe716eff508
mov qword [rsp + 0x25], rdx
movabs rdx, 0x7337e36fe716eff5
mov qword [rsp + 0x26], rdx
movabs rdx, 0x37d4e828b70f7075
mov qword [rsp + 0x2e], rdx
movabs rdx, 0x614090313170503
mov qword [rsp + 0x36], rdx
movabs rdx, 0x40a061409031317
mov qword [rsp + 0x38], rdx
movabs rdx, 0x131415040a0b1808
mov qword [rsp + 0x40], rdx
movabs rdx, 0x216010916060902
mov qword [rsp + 0x48], rdx
movabs rdx, 0x3180e0f0c0b0505
mov qword [rsp + 0x50], rdx
xor eax, eax
jmp 0x4c04c0
movzx r9d, byte [rsp + rsi + 0x1d]
sub r9d, edx
lea edx, [r9 + 0x5c]
mov byte [rsp + rdi + 0x1d], dl
lea edx, [r8 + 0x5c]
mov byte [rsp + rsi + 0x1d], dl
add rax, 2
nop word [rax + rax]
cmp rax, 0x22
jge 0x4c04ed
movzx edx, byte [rsp + rax + 0x36]
movzx esi, byte [rsp + rax + 0x37]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x19
jae 0x4c0510
movzx r8d, byte [rsp + rdi + 0x1d]
sub r8d, edx
cmp rsi, 0x19
jb 0x4c049d
jmp 0x4c0504
xor eax, eax
lea rbx, [rsp + 0x1d]
mov ecx, 0x19
call fcn.00445b60
add rsp, 0x58
pop rbp
ret
mov eax, esi
mov ecx, 0x19
call fcn.00457ea0
mov eax, edi
mov ecx, 0x19
call fcn.00457ea0
nop
nop dword [rax]
call fcn.00455c20
jmp fcn.004c0400
Function at 0x4c0cc0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4c0dbb
push rbp
mov rbp, rsp
sub rsp, 0x48
movabs rdx, 0x44559651e617457
mov qword [rsp + 0x19], rdx
movabs rdx, 0x1569665218044559
mov qword [rsp + 0x1e], rdx
movabs rdx, 0x654af93768683d65
mov qword [rsp + 0x26], rdx
movabs rdx, 0x5011012130c0301
mov qword [rsp + 0x2e], rdx
movabs rdx, 0x10110e0811061009
mov qword [rsp + 0x36], rdx
movabs rdx, 0x10c10110e081106
mov qword [rsp + 0x38], rdx
movabs rdx, 0x907130804000905
mov qword [rsp + 0x40], rdx
xor eax, eax
jmp 0x4c0d59
movzx r9d, byte [rsp + rsi + 0x19]
lea edx, [r9 + rdx]
lea edx, [rdx - 0xa]
mov byte [rsp + rdi + 0x19], dl
mov byte [rsp + rsi + 0x19], r8b
add rax, 2
cmp rax, 0x1a
jge 0x4c0d8b
movzx edx, byte [rsp + rax + 0x2e]
movzx esi, byte [rsp + rax + 0x2f]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x15
jae 0x4c0dae
movzx r8d, byte [rsp + rdi + 0x19]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0xa]
cmp rsi, 0x15
jb 0x4c0d3f
jmp 0x4c0da2
xor eax, eax
lea rbx, [rsp + 0x19]
mov ecx, 0x15
call fcn.00445b60
add rsp, 0x48
pop rbp
ret
mov eax, esi
mov ecx, 0x15
call fcn.00457ea0
mov eax, edi
mov ecx, 0x15
call fcn.00457ea0
nop
nop dword [rax + rax]
call fcn.00455c20
jmp fcn.004c0cc0

Function at 0x4c1120
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4c11f2
push rbp
mov rbp, rsp
sub rsp, 0x38
movabs rdx, 0x7273207f656d8b81
mov qword [rsp + 0x1b], rdx
movabs rdx, 0x6495bc819e727320
mov qword [rsp + 0x20], rdx
movabs rdx, 0x9070100080b0a0b
mov qword [rsp + 0x28], rdx
movabs rdx, 0x400080600080b0a
mov qword [rsp + 0x30], rdx
xor eax, eax
jmp 0x4c118c
movzx r9d, byte [rsp + rsi + 0x1b]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x1d]
mov byte [rsp + rdi + 0x1b], dl
mov byte [rsp + rsi + 0x1b], r8b
add rax, 2
cmp rax, 0x10
jge 0x4c11be
movzx edx, byte [rsp + rax + 0x28]
movzx esi, byte [rsp + rax + 0x29]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0xd
jae 0x4c11e5
movzx r8d, byte [rsp + rdi + 0x1b]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x1d]
cmp rsi, 0xd
jb 0x4c1172
jmp 0x4c11d5
xor eax, eax
lea rbx, [rsp + 0x1b]
mov ecx, 0xd
call fcn.00445b60
add rsp, 0x38
pop rbp
ret
mov eax, esi
mov ecx, 0xd
nop dword [rax]
call fcn.00457ea0
mov eax, edi
mov ecx, 0xd
call fcn.00457ea0
nop
call fcn.00455c20
jmp fcn.004c1120