joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4849c0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x484a9d
push rbp
mov rbp, rsp
sub rsp, 0x40
movabs rdx, 0x7a78679e9c3869e1
mov qword [rsp + 0x1c], rdx
movabs rdx, 0x7c32d8647d8031b8
mov qword [rsp + 0x24], rdx
movabs rdx, 0x80600040c0d030d
mov qword [rsp + 0x2c], rdx
movabs rdx, 0x405010308060004
mov qword [rsp + 0x30], rdx
movabs rdx, 0x70f0b060a050001
mov qword [rsp + 0x38], rdx
xor eax, eax
nop
jmp 0x484a40
movzx r9d, byte [rsp + rsi + 0x1c]
sub r9d, edx
lea edx, [r9 - 0x2b]
mov byte [rsp + rdi + 0x1c], dl
lea edx, [r8 - 0x2b]
mov byte [rsp + rsi + 0x1c], dl
add rax, 2
nop
cmp rax, 0x14
jge 0x484a6d
movzx edx, byte [rsp + rax + 0x2c]
movzx esi, byte [rsp + rax + 0x2d]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x10
jae 0x484a90
movzx r8d, byte [rsp + rdi + 0x1c]
sub r8d, edx
cmp rsi, 0x10
jb 0x484a22
jmp 0x484a84
xor eax, eax
lea rbx, [rsp + 0x1c]
mov ecx, 0x10
call fcn.0044bb20
add rsp, 0x40
pop rbp
ret
mov eax, esi
mov ecx, 0x10
call fcn.00461020
mov eax, edi
mov ecx, 0x10
call fcn.00461020
nop
nop dword [rax]
call fcn.0045eda0
jmp fcn.004849c0

Function at 0x4865e0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4866fd
push rbp
mov rbp, rsp
sub rsp, 0x58
movabs rdx, 0xc733d5e0c8bfd513
mov qword [rsp + 0x1b], rdx
movabs rdx, 0x666133c81f36ff33
mov qword [rsp + 0x23], rdx
movabs rdx, 0xd2666133c81f36ff
mov qword [rsp + 0x24], rdx
movabs rdx, 0xdddfdddbe60d31d8
mov qword [rsp + 0x2c], rdx
movabs rdx, 0x110b13030e0f080f
mov qword [rsp + 0x34], rdx
movabs rdx, 0x200090e110b1303
mov qword [rsp + 0x38], rdx
movabs rdx, 0x703170c0c0e0116
mov qword [rsp + 0x40], rdx
movabs rdx, 0x50f180815040711
mov qword [rsp + 0x48], rdx
movabs rdx, 0x714090710100702
mov qword [rsp + 0x50], rdx
xor eax, eax
jmp 0x4866a0
movzx r9d, byte [rsp + rsi + 0x1b]
sub r9d, edx
lea edx, [r9 + 0x7f]
mov byte [rsp + rdi + 0x1b], dl
lea edx, [r8 + 0x7f]
mov byte [rsp + rsi + 0x1b], dl
add rax, 2
nop word [rax + rax]
cmp rax, 0x24
jge 0x4866cd
movzx edx, byte [rsp + rax + 0x34]
movzx esi, byte [rsp + rax + 0x35]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x19
jae 0x4866f0
movzx r8d, byte [rsp + rdi + 0x1b]
sub r8d, edx
cmp rsi, 0x19
jb 0x48667d
jmp 0x4866e4
xor eax, eax
lea rbx, [rsp + 0x1b]
mov ecx, 0x19
call fcn.0044bb20
add rsp, 0x58
pop rbp
ret
mov eax, esi
mov ecx, 0x19
call fcn.00461020
mov eax, edi
mov ecx, 0x19
call fcn.00461020
nop
nop dword [rax]
call fcn.0045eda0
jmp fcn.004865e0
Function at 0x488d40
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x488e7e
push rbp
mov rbp, rsp
sub rsp, 0x70
movabs rdx, 0x47536638eae29234
mov qword [rsp + 0x1a], rdx
movabs rdx, 0x8f63587147536638
mov qword [rsp + 0x1e], rdx
movabs rdx, 0x3631595f5e45b2b0
mov qword [rsp + 0x26], rdx
movabs rdx, 0x4a4b716b323507db
mov qword [rsp + 0x2e], rdx
movabs rdx, 0x9e32883892673680
mov qword [rsp + 0x36], rdx
movabs rdx, 0x6081f0a1b141f0a
mov qword [rsp + 0x3e], rdx
movabs rdx, 0x230806081f0a1b14
mov qword [rsp + 0x40], rdx
movabs rdx, 0x6111009070e0d23
mov qword [rsp + 0x48], rdx
movabs rdx, 0x1a1b0c1b1502011f
mov qword [rsp + 0x50], rdx
movabs rdx, 0xd180b0d1f0f0815
mov qword [rsp + 0x58], rdx
movabs rdx, 0xb0521081a0c0219
mov qword [rsp + 0x60], rdx
movabs rdx, 0x19231c051a1e2303
mov qword [rsp + 0x68], rdx
xor eax, eax
jmp 0x488e21
movzx r9d, byte [rsp + rsi + 0x1a]
sub r9d, edx
mov byte [rsp + rdi + 0x1a], r9b
mov byte [rsp + rsi + 0x1a], r8b
add rax, 2
cmp rax, 0x32
jge 0x488e4e
movzx edx, byte [rsp + rax + 0x3e]
movzx esi, byte [rsp + rax + 0x3f]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x24
jae 0x488e71
movzx r8d, byte [rsp + rdi + 0x1a]
sub r8d, edx
cmp rsi, 0x24
jb 0x488e0a
jmp 0x488e65
xor eax, eax
lea rbx, [rsp + 0x1a]
mov ecx, 0x24
call fcn.0044bb20
add rsp, 0x70
pop rbp
ret
mov eax, esi
mov ecx, 0x24
call fcn.00461020
mov eax, edi
mov ecx, 0x24
call fcn.00461020
nop
nop
call fcn.0045eda0
jmp fcn.00488d40
Function at 0x48a020
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x48a158
push rbp
mov rbp, rsp
sub rsp, 0x70
movabs rdx, 0xd938eda837c73380
mov qword [rsp + 0x1a], rdx
movabs rdx, 0xb73461e8b012f1aa
mov qword [rsp + 0x22], rdx
movabs rdx, 0x3335897f80353736
mov qword [rsp + 0x2a], rdx
movabs rdx, 0x86338584e338e49b
mov qword [rsp + 0x32], rdx
movabs rdx, 0x7aba3630c0e73532
mov qword [rsp + 0x3a], rdx
movabs rdx, 0xa0b18091b0d0805
mov qword [rsp + 0x42], rdx
movabs rdx, 0x2619220c0c230c1b
mov qword [rsp + 0x4a], rdx
movabs rdx, 0xc23070b0d272619
mov qword [rsp + 0x50], rdx
movabs rdx, 0x1408140c02151f04
mov qword [rsp + 0x58], rdx
movabs rdx, 0x150b1c131f26081d
mov qword [rsp + 0x60], rdx
movabs rdx, 0x1b1923001f180f00
mov qword [rsp + 0x68], rdx
xor eax, eax
jmp 0x48a0f5
movzx r9d, byte [rsp + rsi + 0x1a]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x80]
mov byte [rsp + rdi + 0x1a], dl
mov byte [rsp + rsi + 0x1a], r8b
add rax, 2
cmp rax, 0x2e
jge 0x48a128
movzx edx, byte [rsp + rax + 0x42]
movzx esi, byte [rsp + rax + 0x43]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x28
jae 0x48a14b
movzx r8d, byte [rsp + rdi + 0x1a]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x80]
nop
cmp rsi, 0x28
jb 0x48a0db
jmp 0x48a13f
xor eax, eax
lea rbx, [rsp + 0x1a]
mov ecx, 0x28
call fcn.0044bb20
add rsp, 0x70
pop rbp
ret
mov eax, esi
mov ecx, 0x28
call fcn.00461020
mov eax, edi
mov ecx, 0x28
call fcn.00461020
nop
call fcn.0045eda0
nop dword [rax]
jmp fcn.0048a020

Function at 0x48a180
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x48a2d8
push rbp
mov rbp, rsp
sub rsp, 0x78
movabs rdx, 0x80a3bc4569763731
mov qword [rsp + 0x1c], rdx
movabs rdx, 0xe794793637394676
mov qword [rsp + 0x24], rdx
movabs rdx, 0xebe1e79479363739
mov qword [rsp + 0x26], rdx
movabs rdx, 0x34343239cdcdd7a7
mov qword [rsp + 0x2e], rdx
movabs rdx, 0x873039e7b6d6fed2
mov qword [rsp + 0x36], rdx
movabs rdx, 0x3506313be3056e37
mov qword [rsp + 0x3e], rdx
movabs rdx, 0x1d07090521121e23
mov qword [rsp + 0x46], rdx
movabs rdx, 0xd051d0709052112
mov qword [rsp + 0x48], rdx
movabs rdx, 0xe071c121c030802
mov qword [rsp + 0x50], rdx
movabs rdx, 0x6131c0604251b26
mov qword [rsp + 0x58], rdx
movabs rdx, 0x1b1c1321100e251c
mov qword [rsp + 0x60], rdx
movabs rdx, 0x101e1d0815141a1c
mov qword [rsp + 0x68], rdx
movabs rdx, 0x20f110507282410
mov qword [rsp + 0x70], rdx
xor eax, eax
jmp 0x48a276
movzx r9d, byte [rsp + rsi + 0x1c]
sub r9d, edx
lea edx, [r9 - 0x77]
mov byte [rsp + rdi + 0x1c], dl
lea edx, [r8 - 0x77]
mov byte [rsp + rsi + 0x1c], dl
add rax, 2
cmp rax, 0x32
jge 0x48a2a8
movzx edx, byte [rsp + rax + 0x46]
movzx esi, byte [rsp + rax + 0x47]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x2a
jae 0x48a2cb
movzx r8d, byte [rsp + rdi + 0x1c]
sub r8d, edx
nop dword [rax + rax]
cmp rsi, 0x2a
jb 0x48a259
jmp 0x48a2bf
xor eax, eax
lea rbx, [rsp + 0x1c]
mov ecx, 0x2a
call fcn.0044bb20
add rsp, 0x78
pop rbp
ret
mov eax, esi
mov ecx, 0x2a
call fcn.00461020
mov eax, edi
mov ecx, 0x2a
call fcn.00461020
nop
call fcn.0045eda0
nop dword [rax]
jmp fcn.0048a180
Function at 0x490a00
Capabilities:
Encrypt data using rc4 prga

Disassembly:
lea r12, [rsp - 0x10]
cmp r12, qword [r14 + 0x10]
jbe 0x490b72
push rbp
mov rbp, rsp
sub rsp, 0x88
movabs rdx, 0xf66f6eecdd625a6e
mov qword [rsp + 0x1f], rdx
movabs rdx, 0x9ff66f6eecdd625a
mov qword [rsp + 0x20], rdx
movabs rdx, 0x6664aed0ec730168
mov qword [rsp + 0x28], rdx
movabs rdx, 0x3445e6894b18c14c
mov qword [rsp + 0x30], rdx
movabs rdx, 0x1b65746639fc8375
mov qword [rsp + 0x38], rdx
movabs rdx, 0x38326474b863b120
mov qword [rsp + 0x40], rdx
movabs rdx, 0xee3177c5c19e9c62
mov qword [rsp + 0x48], rdx
movabs rdx, 0x13141b0e26190126
mov qword [rsp + 0x50], rdx
movabs rdx, 0x1702140716082623
mov qword [rsp + 0x58], rdx
movabs rdx, 0x182d30220f07180d
mov qword [rsp + 0x60], rdx
movabs rdx, 0x26240111260d1a0c
mov qword [rsp + 0x68], rdx
movabs rdx, 0x12202d2d01171c04
mov qword [rsp + 0x70], rdx
movabs rdx, 0x70c240204121503
mov qword [rsp + 0x78], rdx
movabs rdx, 0x1c2a1c0a2b132c07
mov qword [rsp + 0x80], rdx
xor eax, eax
jmp 0x490b0d
movzx r9d, byte [rsp + rsi + 0x1f]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x59]
mov byte [rsp + rdi + 0x1f], dl
mov byte [rsp + rsi + 0x1f], r8b
add rax, 2
cmp rax, 0x38
jge 0x490b3f
movzx edx, byte [rsp + rax + 0x50]
movzx esi, byte [rsp + rax + 0x51]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x31
jae 0x490b65
movzx r8d, byte [rsp + rdi + 0x1f]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x59]
cmp rsi, 0x31
jb 0x490af3
jmp 0x490b59
xor eax, eax
lea rbx, [rsp + 0x1f]
mov ecx, 0x31
call fcn.0044bb20
add rsp, 0x88
pop rbp
ret
mov eax, esi
mov ecx, 0x31
call fcn.00461020
mov eax, edi
mov ecx, 0x31
call fcn.00461020
nop
call fcn.0045eda0
jmp fcn.00490a00

Function at 0x492ae0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x492b98
push rbp
mov rbp, rsp
sub rsp, 0x30
movabs rdx, 0x5b6e2f444f190f27
mov qword [rsp + 0x1c], rdx
movabs rdx, 0x303040103020500
mov qword [rsp + 0x24], rdx
mov dword [rsp + 0x2c], 0x7030405
xor eax, eax
jmp 0x492b39
movzx r9d, byte [rsp + rsi + 0x1c]
sub r9d, edx
lea edx, [r9 + 0x26]
mov byte [rsp + rdi + 0x1c], dl
lea edx, [r8 + 0x26]
mov byte [rsp + rsi + 0x1c], dl
add rax, 2
cmp rax, 0xc
jge 0x492b68
movzx edx, byte [rsp + rax + 0x24]
movzx esi, byte [rsp + rax + 0x25]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 8
jae 0x492b8b
movzx r8d, byte [rsp + rdi + 0x1c]
sub r8d, edx
nop
cmp rsi, 8
jb 0x492b1c
jmp 0x492b7f
xor eax, eax
lea rbx, [rsp + 0x1c]
mov ecx, 8
call fcn.0044bb20
add rsp, 0x30
pop rbp
ret
mov eax, esi
mov ecx, 8
call fcn.00461020
mov eax, edi
mov ecx, 8
call fcn.00461020
nop
call fcn.0045eda0
nop dword [rax]
jmp fcn.00492ae0
Function at 0x492fc0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x49307d
push rbp
mov rbp, rsp
sub rsp, 0x30
movabs rdx, 0x89669e8082856fc6
mov qword [rsp + 0x1b], rdx
mov byte [rsp + 0x23], 0x96
movabs rdx, 0x105030602070006
mov qword [rsp + 0x24], rdx
mov dword [rsp + 0x2c], 0x4010803
xor eax, eax
nop
jmp 0x493020
movzx r9d, byte [rsp + rsi + 0x1b]
sub r9d, edx
lea edx, [r9 - 0x10]
mov byte [rsp + rdi + 0x1b], dl
lea edx, [r8 - 0x10]
mov byte [rsp + rsi + 0x1b], dl
add rax, 2
nop
cmp rax, 0xc
jge 0x49304d
movzx edx, byte [rsp + rax + 0x24]
movzx esi, byte [rsp + rax + 0x25]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 9
jae 0x493070
movzx r8d, byte [rsp + rdi + 0x1b]
sub r8d, edx
cmp rsi, 9
jb 0x493002
jmp 0x493064
xor eax, eax
lea rbx, [rsp + 0x1b]
mov ecx, 9
call fcn.0044bb20
add rsp, 0x30
pop rbp
ret
mov eax, esi
mov ecx, 9
call fcn.00461020
mov eax, edi
mov ecx, 9
call fcn.00461020
nop
nop dword [rax]
call fcn.0045eda0
jmp fcn.00492fc0
Function at 0x49e240
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x49e33b
push rbp
mov rbp, rsp
sub rsp, 0x50
movabs rdx, 0x470b8c66e59c7fa
mov qword [rsp + 0x1c], rdx
movabs rdx, 0x6361741a20516574
mov qword [rsp + 0x24], rdx
movabs rdx, 0x74bb5fa3216f019f
mov qword [rsp + 0x2c], rdx
movabs rdx, 0x110a030a01040205
mov qword [rsp + 0x34], rdx
movabs rdx, 0x100716031315050c
mov qword [rsp + 0x3c], rdx
movabs rdx, 0x213010310071603
mov qword [rsp + 0x40], rdx
movabs rdx, 0x400070214000c16
mov qword [rsp + 0x48], rdx
xor eax, eax
jmp 0x49e2d9
movzx r9d, byte [rsp + rsi + 0x1c]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x42]
mov byte [rsp + rdi + 0x1c], dl
mov byte [rsp + rsi + 0x1c], r8b
add rax, 2
cmp rax, 0x1c
jge 0x49e30b
movzx edx, byte [rsp + rax + 0x34]
movzx esi, byte [rsp + rax + 0x35]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x18
jae 0x49e32e
movzx r8d, byte [rsp + rdi + 0x1c]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x42]
cmp rsi, 0x18
jb 0x49e2bf
jmp 0x49e322
xor eax, eax
lea rbx, [rsp + 0x1c]
mov ecx, 0x18
call fcn.0044bb20
add rsp, 0x50
pop rbp
ret
mov eax, esi
mov ecx, 0x18
call fcn.00461020
mov eax, edi
mov ecx, 0x18
call fcn.00461020
nop
nop dword [rax + rax]
call fcn.0045eda0
jmp fcn.0049e240

Function at 0x49ede0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x49eedd
push rbp
mov rbp, rsp
sub rsp, 0x50
movabs rdx, 0x292d356fef65e345
mov qword [rsp + 0x1a], rdx
movabs rdx, 0x953874e21a48193c
mov qword [rsp + 0x22], rdx
movabs rdx, 0xcdbb736666332037
mov qword [rsp + 0x2a], rdx
movabs rdx, 0x100512090701030b
mov qword [rsp + 0x32], rdx
movabs rdx, 0x6060a070816170a
mov qword [rsp + 0x3a], rdx
movabs rdx, 0xe0c080b0f0f0606
mov qword [rsp + 0x40], rdx
movabs rdx, 0x120f0007070e0e0f
mov qword [rsp + 0x48], rdx
xor eax, eax
jmp 0x49ee80
movzx r9d, byte [rsp + rsi + 0x1a]
sub r9d, edx
lea edx, [r9 + 0x51]
mov byte [rsp + rdi + 0x1a], dl
lea edx, [r8 + 0x51]
mov byte [rsp + rsi + 0x1a], dl
add rax, 2
nop dword [rax]
cmp rax, 0x1e
jge 0x49eead
movzx edx, byte [rsp + rax + 0x32]
movzx esi, byte [rsp + rax + 0x33]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x18
jae 0x49eed0
movzx r8d, byte [rsp + rdi + 0x1a]
sub r8d, edx
cmp rsi, 0x18
jb 0x49ee5f
jmp 0x49eec4
xor eax, eax
lea rbx, [rsp + 0x1a]
mov ecx, 0x18
call fcn.0044bb20
add rsp, 0x50
pop rbp
ret
mov eax, esi
mov ecx, 0x18
call fcn.00461020
mov eax, edi
mov ecx, 0x18
call fcn.00461020
nop
nop dword [rax]
call fcn.0045eda0
jmp fcn.0049ede0
Function at 0x4a0720
Capabilities:
Encrypt data using rc4 prga

Disassembly:
lea r12, [rsp - 8]
cmp r12, qword [r14 + 0x10]
jbe 0x4a087d
push rbp
mov rbp, rsp
add rsp, 0xffffffffffffff80
movabs rdx, 0xc88d63502eec3472
mov qword [rsp + 0x1f], rdx
movabs rdx, 0x61a754f852fb9920
mov qword [rsp + 0x27], rdx
movabs rdx, 0x1e2765f13561a754
mov qword [rsp + 0x2c], rdx
movabs rdx, 0x6103b969393a456f
mov qword [rsp + 0x34], rdx
movabs rdx, 0x6870656d2064e26c
mov qword [rsp + 0x3c], rdx
movabs rdx, 0x780464ab4e55642f
mov qword [rsp + 0x44], rdx
movabs rdx, 0x182909141e231b1a
mov qword [rsp + 0x4c], rdx
movabs rdx, 0x28161e2b18290914
mov qword [rsp + 0x50], rdx
movabs rdx, 0xa18070e02251b03
mov qword [rsp + 0x58], rdx
movabs rdx, 0x1413011e0b1e0a06
mov qword [rsp + 0x60], rdx
movabs rdx, 0xa010e0c0d230a11
mov qword [rsp + 0x68], rdx
movabs rdx, 0xd0e0e11270a2b0e
mov qword [rsp + 0x70], rdx
movabs rdx, 0x2518110718041310
mov qword [rsp + 0x78], rdx
xor eax, eax
jmp 0x4a0820
movzx r9d, byte [rsp + rsi + 0x1f]
sub r9d, edx
lea edx, [r9 + 0x6c]
mov byte [rsp + rdi + 0x1f], dl
lea edx, [r8 + 0x6c]
mov byte [rsp + rsi + 0x1f], dl
add rax, 2
nop dword [rax + rax]
cmp rax, 0x34
jge 0x4a084d
movzx edx, byte [rsp + rax + 0x4c]
movzx esi, byte [rsp + rax + 0x4d]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x2d
jae 0x4a0870
movzx r8d, byte [rsp + rdi + 0x1f]
sub r8d, edx
cmp rsi, 0x2d
jb 0x4a07fe
jmp 0x4a0864
xor eax, eax
lea rbx, [rsp + 0x1f]
mov ecx, 0x2d
call fcn.0044bb20
sub rsp, 0xffffffffffffff80
pop rbp
ret
mov eax, esi
mov ecx, 0x2d
call fcn.00461020
mov eax, edi
mov ecx, 0x2d
call fcn.00461020
nop
nop dword [rax]
call fcn.0045eda0
jmp fcn.004a0720
Function at 0x4a49c0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
lea r12, [rsp - 8]
cmp r12, qword [r14 + 0x10]
jbe 0x4a4b1a
push rbp
mov rbp, rsp
add rsp, 0xffffffffffffff80
movabs rdx, 0x3a8e71546c23651f
mov qword [rsp + 0x1d], rdx
movabs rdx, 0x4f127257256e7860
mov qword [rsp + 0x25], rdx
movabs rdx, 0x72724f206c4f1272
mov qword [rsp + 0x2a], rdx
movabs rdx, 0xe7644877865d723c
mov qword [rsp + 0x32], rdx
movabs rdx, 0x56667d6d6c64696c
mov qword [rsp + 0x3a], rdx
movabs rdx, 0x5eeb406753288c6f
mov qword [rsp + 0x42], rdx
movabs rdx, 0x2624231b2909290f
mov qword [rsp + 0x4a], rdx
movabs rdx, 0x2c0f0405190f2624
mov qword [rsp + 0x50], rdx
movabs rdx, 0x2026181a222a2006
mov qword [rsp + 0x58], rdx
movabs rdx, 0x2a260c2815092a0b
mov qword [rsp + 0x60], rdx
movabs rdx, 0x1902092205172c2a
mov qword [rsp + 0x68], rdx
movabs rdx, 0x1204271c19041726
mov qword [rsp + 0x70], rdx
movabs rdx, 0xe08150900172b18
mov qword [rsp + 0x78], rdx
xor eax, eax
jmp 0x4a4ab8
movzx r9d, byte [rsp + rsi + 0x1d]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x2c]
mov byte [rsp + rdi + 0x1d], dl
mov byte [rsp + rsi + 0x1d], r8b
add rax, 2
cmp rax, 0x36
jge 0x4a4aea
movzx edx, byte [rsp + rax + 0x4a]
movzx esi, byte [rsp + rax + 0x4b]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x2d
jae 0x4a4b0d
movzx r8d, byte [rsp + rdi + 0x1d]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x2c]
cmp rsi, 0x2d
jb 0x4a4a9e
jmp 0x4a4b01
xor eax, eax
lea rbx, [rsp + 0x1d]
mov ecx, 0x2d
call fcn.0044bb20
sub rsp, 0xffffffffffffff80
pop rbp
ret
mov eax, esi
mov ecx, 0x2d
call fcn.00461020
mov eax, edi
mov ecx, 0x2d
call fcn.00461020
nop
call fcn.0045eda0
nop
jmp fcn.004a49c0
Function at 0x4a5d00
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4a5dec
push rbp
mov rbp, rsp
sub rsp, 0x48
movabs rdx, 0x876bb2657a586572
mov qword [rsp + 0x1e], rdx
movabs rdx, 0x6b6cf6a3876bb265
mov qword [rsp + 0x22], rdx
movabs rdx, 0xe96effd4e153ddec
mov qword [rsp + 0x2a], rdx
movabs rdx, 0x90c02070309050b
mov qword [rsp + 0x32], rdx
movabs rdx, 0x130610110b02090c
mov qword [rsp + 0x38], rdx
movabs rdx, 0x13130708020d0f05
mov qword [rsp + 0x40], rdx
xor eax, eax
jmp 0x4a5d8a
movzx r9d, byte [rsp + rsi + 0x1e]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x6a]
mov byte [rsp + rdi + 0x1e], dl
mov byte [rsp + rsi + 0x1e], r8b
add rax, 2
cmp rax, 0x16
jge 0x4a5dbc
movzx edx, byte [rsp + rax + 0x32]
movzx esi, byte [rsp + rax + 0x33]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x14
jae 0x4a5ddf
movzx r8d, byte [rsp + rdi + 0x1e]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x6a]
cmp rsi, 0x14
jb 0x4a5d70
jmp 0x4a5dd3
xor eax, eax
lea rbx, [rsp + 0x1e]
mov ecx, 0x14
call fcn.0044bb20
add rsp, 0x48
pop rbp
ret
mov eax, esi
mov ecx, 0x14
call fcn.00461020
mov eax, edi
mov ecx, 0x14
call fcn.00461020
nop
call fcn.0045eda0
jmp fcn.004a5d00
Function at 0x4ab080
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4ab16c
push rbp
mov rbp, rsp
sub rsp, 0x40
movabs rdx, 0x2e0f0bb2889665f2
mov qword [rsp + 0x19], rdx
movabs rdx, 0x2a30e2e0f0bb288
mov qword [rsp + 0x1c], rdx
movabs rdx, 0x74349c6c462eec04
mov qword [rsp + 0x24], rdx
movabs rdx, 0x3110406050a100b
mov qword [rsp + 0x2c], rdx
movabs rdx, 0x3090c1103110406
mov qword [rsp + 0x30], rdx
movabs rdx, 0x9030b0603020008
mov qword [rsp + 0x38], rdx
xor eax, eax
jmp 0x4ab10a
movzx r9d, byte [rsp + rsi + 0x19]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x50]
mov byte [rsp + rdi + 0x19], dl
mov byte [rsp + rsi + 0x19], r8b
add rax, 2
cmp rax, 0x14
jge 0x4ab13c
movzx edx, byte [rsp + rax + 0x2c]
movzx esi, byte [rsp + rax + 0x2d]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x13
jae 0x4ab15f
movzx r8d, byte [rsp + rdi + 0x19]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x50]
cmp rsi, 0x13
jb 0x4ab0f0
jmp 0x4ab153
xor eax, eax
lea rbx, [rsp + 0x19]
mov ecx, 0x13
call fcn.0044bb20
add rsp, 0x40
pop rbp
ret
mov eax, esi
mov ecx, 0x13
call fcn.00461020
mov eax, edi
mov ecx, 0x13
call fcn.00461020
nop
call fcn.0045eda0
jmp fcn.004ab080

Function at 0x4ab7c0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4ab8da
push rbp
mov rbp, rsp
sub rsp, 0x60
movabs rdx, 0x974e0620bccf0305
mov qword [rsp + 0x1c], rdx
movabs rdx, 0x6c66fbfa2dcea2da
mov qword [rsp + 0x24], rdx
movabs rdx, 0xa4f2b3526c66fbfa
mov qword [rsp + 0x28], rdx
movabs rdx, 0xe9906569b013bb26
mov qword [rsp + 0x30], rdx
movabs rdx, 0x506081a020a1506
mov qword [rsp + 0x38], rdx
movabs rdx, 0x1b060808150c161a
mov qword [rsp + 0x40], rdx
movabs rdx, 0x1a15010503120d00
mov qword [rsp + 0x48], rdx
movabs rdx, 0x5090d0608131117
mov qword [rsp + 0x50], rdx
movabs rdx, 0x13110c0010070301
mov qword [rsp + 0x58], rdx
xor eax, eax
jmp 0x4ab877
movzx r9d, byte [rsp + rsi + 0x1c]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x6b]
mov byte [rsp + rdi + 0x1c], dl
mov byte [rsp + rsi + 0x1c], r8b
add rax, 2
cmp rax, 0x28
jge 0x4ab8a9
movzx edx, byte [rsp + rax + 0x38]
movzx esi, byte [rsp + rax + 0x39]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x1c
jae 0x4ab8cd
movzx r8d, byte [rsp + rdi + 0x1c]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x6b]
cmp rsi, 0x1c
jb 0x4ab85d
jmp 0x4ab8c1
xor eax, eax
lea rbx, [rsp + 0x1c]
mov ecx, 0x1c
call fcn.0044bb20
add rsp, 0x60
pop rbp
nop
ret
mov eax, esi
mov ecx, 0x1c
call fcn.00461020
mov eax, edi
mov ecx, 0x1c
call fcn.00461020
nop
call fcn.0045eda0
nop
jmp fcn.004ab7c0
Function at 0x4aca20
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4acb47
push rbp
mov rbp, rsp
sub rsp, 0x68
movabs rdx, 0xe574636b00235a26
mov qword [rsp + 0x1d], rdx
movabs rdx, 0x1756cf456e57463
mov qword [rsp + 0x22], rdx
movabs rdx, 0x8e20d3657479422e
mov qword [rsp + 0x2a], rdx
movabs rdx, 0xabe72d8e6f48fae7
mov qword [rsp + 0x32], rdx
movabs rdx, 0xa161278cf1206774
mov qword [rsp + 0x3a], rdx
movabs rdx, 0x1c14201c1e121716
mov qword [rsp + 0x42], rdx
movabs rdx, 0x700010914191c14
mov qword [rsp + 0x48], rdx
movabs rdx, 0x91b1421221c0115
mov qword [rsp + 0x50], rdx
movabs rdx, 0x320240416171414
mov qword [rsp + 0x58], rdx
movabs rdx, 0x224150c07240412
mov qword [rsp + 0x60], rdx
xor eax, eax
jmp 0x4acae9
movzx r9d, byte [rsp + rsi + 0x1d]
sub r9d, edx
lea edx, [r9 - 0x60]
mov byte [rsp + rdi + 0x1d], dl
lea edx, [r8 - 0x60]
mov byte [rsp + rsi + 0x1d], dl
add rax, 2
cmp rax, 0x26
jge 0x4acb17
movzx edx, byte [rsp + rax + 0x42]
movzx esi, byte [rsp + rax + 0x43]
mov edi, edx
xor edx, esi
add edx, eax
nop
cmp rdi, 0x25
jae 0x4acb3a
movzx r8d, byte [rsp + rdi + 0x1d]
sub r8d, edx
cmp rsi, 0x25
jb 0x4acacc
jmp 0x4acb2e
xor eax, eax
lea rbx, [rsp + 0x1d]
mov ecx, 0x25
call fcn.0044bb20
add rsp, 0x68
pop rbp
ret
mov eax, esi
mov ecx, 0x25
call fcn.00461020
mov eax, edi
mov ecx, 0x25
call fcn.00461020
nop
call fcn.0045eda0
jmp fcn.004aca20
Function at 0x4ae0a0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4ae167
push rbp
mov rbp, rsp
sub rsp, 0x30
movabs rdx, 0x423c2d612064dae3
mov qword [rsp + 0x19], rdx
movabs rdx, 0xebd6d2423c2d6120
mov qword [rsp + 0x1c], rdx
movabs rdx, 0x5070708010605
mov qword [rsp + 0x24], rdx
mov dword [rsp + 0x2c], 0x7060a09
xor eax, eax
jmp 0x4ae108
movzx r9d, byte [rsp + rsi + 0x19]
sub r9d, edx
lea edx, [r9 - 0x66]
mov byte [rsp + rdi + 0x19], dl
lea edx, [r8 - 0x66]
mov byte [rsp + rsi + 0x19], dl
add rax, 2
cmp rax, 0xc
jge 0x4ae137
movzx edx, byte [rsp + rax + 0x24]
movzx esi, byte [rsp + rax + 0x25]
mov edi, edx
xor edx, esi
add edx, eax
nop
cmp rdi, 0xb
jae 0x4ae15a
movzx r8d, byte [rsp + rdi + 0x19]
sub r8d, edx
cmp rsi, 0xb
jb 0x4ae0eb
jmp 0x4ae14e
xor eax, eax
lea rbx, [rsp + 0x19]
mov ecx, 0xb
call fcn.0044bb20
add rsp, 0x30
pop rbp
ret
mov eax, esi
mov ecx, 0xb
call fcn.00461020
mov eax, edi
mov ecx, 0xb
call fcn.00461020
nop
call fcn.0045eda0
jmp fcn.004ae0a0

Function at 0x4ae880
Capabilities:
Encrypt data using rc4 prga

Disassembly:
lea r12, [rsp - 0x28]
cmp r12, qword [r14 + 0x10]
jbe 0x4ae9bb
push rbp
mov rbp, rsp
sub rsp, 0xa0
movabs rdx, 0xf5958652d366f3f
mov qword [rsp + 0x18], rdx
movabs rdx, 0xe74ce8d34e0d509
mov qword [rsp + 0x20], rdx
movabs rdx, 0xc9ec207fdec91ee4
mov qword [rsp + 0x28], rdx
movabs rdx, 0x3fab262064a5103c
mov qword [rsp + 0x30], rdx
movabs rdx, 0x69c007f0054d6e36
mov qword [rsp + 0x38], rdx
movabs rdx, 0x7a693e2d2ec5b46e
mov qword [rsp + 0x40], rdx
movabs rdx, 0x73f0d2f4132c3139
mov qword [rsp + 0x48], rdx
lea rdi, [rsp + 0x50]
lea rsi, [0x00748e90]
nop word [rax + rax]
nop dword [rax + rax]
mov qword [rsp - 0x10], rbp
lea rbp, [rsp - 0x10]
call fcn.0046165a
mov rbp, qword [rbp]
xor eax, eax
jmp 0x4ae951
movzx r9d, byte [rsp + rsi + 0x18]
lea edx, [r9 + rdx]
lea edx, [rdx - 8]
mov byte [rsp + rdi + 0x18], dl
mov byte [rsp + rsi + 0x18], r8b
add rax, 2
cmp rax, 0x50
jge 0x4ae988
movzx edx, byte [rsp + rax + 0x50]
movzx esi, byte [rsp + rax + 0x51]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x38
jae 0x4ae9ae
movzx r8d, byte [rsp + rdi + 0x18]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 8]
nop dword [rax + rax]
cmp rsi, 0x38
jb 0x4ae937
jmp 0x4ae9a2
xor eax, eax
lea rbx, [rsp + 0x18]
mov ecx, 0x38
call fcn.0044bb20
add rsp, 0xa0
pop rbp
ret
mov eax, esi
mov ecx, 0x38
call fcn.00461020
mov eax, edi
mov ecx, 0x38
call fcn.00461020
nop
nop dword [rax + rax]
call fcn.0045eda0
jmp fcn.004ae880