joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4f2f20
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4f3028
sub rsp, 0x58
mov qword [rsp + 0x50], rbp
lea rbp, [rsp + 0x50]
movabs rdx, 0x6384726d6620cac7
mov qword [rsp + 0x1d], rdx
movabs rdx, 0x646e4c746c8d6d63
mov qword [rsp + 0x24], rdx
movabs rdx, 0x3e836554a33e4b6c
mov qword [rsp + 0x2c], rdx
movabs rdx, 0x1006121000101001
mov qword [rsp + 0x34], rdx
movabs rdx, 0x1408161203000f11
mov qword [rsp + 0x3c], rdx
movabs rdx, 0xf09150a14081612
mov qword [rsp + 0x40], rdx
movabs rdx, 0x40c0f0f0c0a0c03
mov qword [rsp + 0x48], rdx
xor eax, eax
jmp 0x4f2fc0
movzx r9d, byte [rsp + rsi + 0x1d]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x2e]
mov byte [rsp + rdi + 0x1d], dl
mov byte [rsp + rsi + 0x1d], r8b
add rax, 2
nop
cmp rax, 0x1c
jge 0x4f2ff2
movzx edx, byte [rsp + rax + 0x34]
movzx esi, byte [rsp + rax + 0x35]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x17
jae 0x4f301b
movzx r8d, byte [rsp + rdi + 0x1d]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x2e]
cmp rsi, 0x17
jb 0x4f2fa5
jmp 0x4f300f
xor eax, eax
lea rbx, [rsp + 0x1d]
mov ecx, 0x17
nop
call fcn.0044a200
mov rbp, qword [rsp + 0x50]
add rsp, 0x58
ret
mov eax, esi
mov ecx, 0x17
call fcn.0045f5c0
mov eax, edi
mov ecx, 0x17
call fcn.0045f5c0
nop
call fcn.0045cf60
jmp fcn.004f2f20

Function at 0x4f3320
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4f341c
sub rsp, 0x50
mov qword [rsp + 0x48], rbp
lea rbp, [rsp + 0x48]
movabs rdx, 0x87bbb11a8b44c4e
mov qword [rsp + 0x1b], rdx
movabs rdx, 0xc1c6130349087bbb
mov qword [rsp + 0x20], rdx
movabs rdx, 0x656dafb320c17261
mov qword [rsp + 0x28], rdx
movabs rdx, 0x70611120c0f1101
mov qword [rsp + 0x30], rdx
movabs rdx, 0x90b120a09080504
mov qword [rsp + 0x38], rdx
movabs rdx, 0xb06030803120205
mov qword [rsp + 0x40], rdx
xor eax, eax
jmp 0x4f33b0
movzx r9d, byte [rsp + rsi + 0x1b]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x62]
mov byte [rsp + rdi + 0x1b], dl
mov byte [rsp + rsi + 0x1b], r8b
add rax, 2
cmp rax, 0x18
jge 0x4f33e8
movzx edx, byte [rsp + rax + 0x30]
movzx esi, byte [rsp + rax + 0x31]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x15
jae 0x4f340f
movzx r8d, byte [rsp + rdi + 0x1b]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x62]
nop word [rax + rax]
cmp rsi, 0x15
jb 0x4f3396
jmp 0x4f3403
xor eax, eax
lea rbx, [rsp + 0x1b]
mov ecx, 0x15
call fcn.0044a200
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
mov eax, esi
mov ecx, 0x15
call fcn.0045f5c0
mov eax, edi
mov ecx, 0x15
call fcn.0045f5c0
nop
nop dword [rax]
call fcn.0045cf60
jmp fcn.004f3320
Function at 0x4f3c00
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4f3d08
sub rsp, 0x58
mov qword [rsp + 0x50], rbp
lea rbp, [rsp + 0x50]
movabs rdx, 0xc4b21d0c618cac4b
mov qword [rsp + 0x1b], rdx
movabs rdx, 0x645e617453dd1ec4
mov qword [rsp + 0x22], rdx
movabs rdx, 0x65a2e7cad7ce6e6c
mov qword [rsp + 0x2a], rdx
movabs rdx, 0x2151415120a15
mov qword [rsp + 0x32], rdx
movabs rdx, 0xd120f0d090d1502
mov qword [rsp + 0x3a], rdx
movabs rdx, 0x812060405130d12
mov qword [rsp + 0x40], rdx
movabs rdx, 0x1210071115061301
mov qword [rsp + 0x48], rdx
xor eax, eax
jmp 0x4f3ca2
movzx r9d, byte [rsp + rsi + 0x1b]
sub r9d, edx
lea edx, [r9 - 0x30]
mov byte [rsp + rdi + 0x1b], dl
lea edx, [r8 - 0x30]
mov byte [rsp + rsi + 0x1b], dl
add rax, 2
cmp rax, 0x1e
jge 0x4f3ccf
movzx edx, byte [rsp + rax + 0x32]
movzx esi, byte [rsp + rax + 0x33]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x17
jae 0x4f3cfb
movzx r8d, byte [rsp + rdi + 0x1b]
sub r8d, edx
cmp rsi, 0x17
jb 0x4f3c85
jmp 0x4f3cef
xor eax, eax
lea rbx, [rsp + 0x1b]
mov ecx, 0x17
nop dword [rax + rax]
call fcn.0044a200
mov rbp, qword [rsp + 0x50]
add rsp, 0x58
ret
mov eax, esi
mov ecx, 0x17
call fcn.0045f5c0
mov eax, edi
mov ecx, 0x17
call fcn.0045f5c0
nop
call fcn.0045cf60
jmp fcn.004f3c00

Function at 0x4f4020
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4f4116
sub rsp, 0x50
mov qword [rsp + 0x48], rbp
lea rbp, [rsp + 0x48]
movabs rdx, 0x74989361b4bea242
mov qword [rsp + 0x1d], rdx
movabs rdx, 0xcba15b74989361b4
mov qword [rsp + 0x20], rdx
movabs rdx, 0xc1ac69b4a25e01e8
mov qword [rsp + 0x28], rdx
movabs rdx, 0x11110b011106030c
mov qword [rsp + 0x30], rdx
movabs rdx, 0x911090805060d0e
mov qword [rsp + 0x38], rdx
movabs rdx, 0x120209030f01110a
mov qword [rsp + 0x40], rdx
xor eax, eax
jmp 0x4f40b3
movzx r9d, byte [rsp + rsi + 0x1d]
sub r9d, edx
lea edx, [r9 - 0x33]
mov byte [rsp + rdi + 0x1d], dl
lea edx, [r8 - 0x33]
mov byte [rsp + rsi + 0x1d], dl
add rax, 2
cmp rax, 0x18
jge 0x4f40e2
movzx edx, byte [rsp + rax + 0x30]
movzx esi, byte [rsp + rax + 0x31]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x13
jae 0x4f4109
movzx r8d, byte [rsp + rdi + 0x1d]
sub r8d, edx
cmp rsi, 0x13
jb 0x4f4096
nop
jmp 0x4f40fd
xor eax, eax
lea rbx, [rsp + 0x1d]
mov ecx, 0x13
call fcn.0044a200
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
mov eax, esi
mov ecx, 0x13
call fcn.0045f5c0
mov eax, edi
mov ecx, 0x13
call fcn.0045f5c0
nop
call fcn.0045cf60
nop dword [rax + rax]
jmp fcn.004f4020
Function at 0x4f4140
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4f4266
sub rsp, 0x60
mov qword [rsp + 0x58], rbp
lea rbp, [rsp + 0x58]
movabs rdx, 0x326ee56529736158
mov qword [rsp + 0x18], rdx
movabs rdx, 0x4d3661363d611647
mov qword [rsp + 0x20], rdx
movabs rdx, 0x20106d48aa204d36
mov qword [rsp + 0x26], rdx
movabs rdx, 0x266f2c1e47f4286c
mov qword [rsp + 0x2e], rdx
movabs rdx, 0xf12071118091d1a
mov qword [rsp + 0x36], rdx
movabs rdx, 0x7050f1207111809
mov qword [rsp + 0x38], rdx
movabs rdx, 0xe1d0b11051a1714
mov qword [rsp + 0x40], rdx
movabs rdx, 0x1609071d19141b17
mov qword [rsp + 0x48], rdx
movabs rdx, 0x300080c18181a07
mov qword [rsp + 0x50], rdx
xor eax, eax
jmp 0x4f4200
movzx r9d, byte [rsp + rsi + 0x18]
sub r9d, edx
lea edx, [r9 + 0x3f]
mov byte [rsp + rdi + 0x18], dl
lea edx, [r8 + 0x3f]
mov byte [rsp + rsi + 0x18], dl
add rax, 2
cmp rax, 0x22
jge 0x4f422d
movzx edx, byte [rsp + rax + 0x36]
movzx esi, byte [rsp + rax + 0x37]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x1e
jae 0x4f4254
movzx r8d, byte [rsp + rdi + 0x18]
sub r8d, edx
cmp rsi, 0x1e
jb 0x4f41e3
jmp 0x4f4248
xor eax, eax
lea rbx, [rsp + 0x18]
mov ecx, 0x1e
call fcn.0044a200
mov rbp, qword [rsp + 0x58]
add rsp, 0x60
ret
mov eax, esi
mov ecx, 0x1e
call fcn.0045f5c0
mov eax, edi
mov ecx, 0x1e
nop dword [rax + rax]
call fcn.0045f5c0
nop
call fcn.0045cf60
jmp fcn.004f4140

Function at 0x4f45a0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4f46b6
sub rsp, 0x60
mov qword [rsp + 0x58], rbp
lea rbp, [rsp + 0x58]
movabs rdx, 0x461660550d3b4353
mov qword [rsp + 0x1e], rdx
movabs rdx, 0x5c6e031a5d603d3d
mov qword [rsp + 0x26], rdx
movabs rdx, 0x65156954156435fa
mov qword [rsp + 0x2e], rdx
movabs rdx, 0xa0609010d0a110f
mov qword [rsp + 0x36], rdx
movabs rdx, 0x3070a0609010d0a
mov qword [rsp + 0x38], rdx
movabs rdx, 0x70413160f040509
mov qword [rsp + 0x40], rdx
movabs rdx, 0x304160c1616060b
mov qword [rsp + 0x48], rdx
movabs rdx, 0x30b050c02100816
mov qword [rsp + 0x50], rdx
xor eax, eax
jmp 0x4f464e
movzx r9d, byte [rsp + rsi + 0x1e]
lea edx, [r9 + rdx]
lea edx, [rdx - 8]
mov byte [rsp + rdi + 0x1e], dl
mov byte [rsp + rsi + 0x1e], r8b
add rax, 2
cmp rax, 0x22
jge 0x4f4682
movzx edx, byte [rsp + rax + 0x36]
movzx esi, byte [rsp + rax + 0x37]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x18
jae 0x4f46a9
movzx r8d, byte [rsp + rdi + 0x1e]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 8]
cmp rsi, 0x18
jb 0x4f4634
nop
jmp 0x4f469d
xor eax, eax
lea rbx, [rsp + 0x1e]
mov ecx, 0x18
call fcn.0044a200
mov rbp, qword [rsp + 0x58]
add rsp, 0x60
ret
mov eax, esi
mov ecx, 0x18
call fcn.0045f5c0
mov eax, edi
mov ecx, 0x18
call fcn.0045f5c0
nop
call fcn.0045cf60
nop dword [rax + rax]
jmp fcn.004f45a0
Function at 0x4f5760
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4f5892
sub rsp, 0x68
mov qword [rsp + 0x60], rbp
lea rbp, [rsp + 0x60]
movabs rdx, 0xe16685736b5d0556
mov qword [rsp + 0x18], rdx
movabs rdx, 0xd5d3f5d0ebe3c4de
mov qword [rsp + 0x20], rdx
movabs rdx, 0x64e9f6e0a62ed5d3
mov qword [rsp + 0x26], rdx
movabs rdx, 0xf36b6954204c7261
mov qword [rsp + 0x2e], rdx
movabs rdx, 0x9110d1d1c13130e
mov qword [rsp + 0x36], rdx
movabs rdx, 0x102110511110718
mov qword [rsp + 0x3e], rdx
movabs rdx, 0x601010211051111
mov qword [rsp + 0x40], rdx
movabs rdx, 0xa1c130c11121014
mov qword [rsp + 0x48], rdx
movabs rdx, 0x14100f06060f1808
mov qword [rsp + 0x50], rdx
movabs rdx, 0xb0f010814070700
mov qword [rsp + 0x58], rdx
xor eax, eax
jmp 0x4f582c
movzx r9d, byte [rsp + rsi + 0x18]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x5c]
mov byte [rsp + rdi + 0x18], dl
mov byte [rsp + rsi + 0x18], r8b
add rax, 2
cmp rax, 0x2a
jge 0x4f585e
movzx edx, byte [rsp + rax + 0x36]
movzx esi, byte [rsp + rax + 0x37]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x1e
jae 0x4f5885
movzx r8d, byte [rsp + rdi + 0x18]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x5c]
cmp rsi, 0x1e
jb 0x4f5812
jmp 0x4f5879
xor eax, eax
lea rbx, [rsp + 0x18]
mov ecx, 0x1e
call fcn.0044a200
mov rbp, qword [rsp + 0x60]
add rsp, 0x68
ret
mov eax, esi
mov ecx, 0x1e
call fcn.0045f5c0
mov eax, edi
mov ecx, 0x1e
call fcn.0045f5c0
nop
call fcn.0045cf60
jmp fcn.004f5760

Function at 0x4f5f00
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4f5ff6
sub rsp, 0x48
mov qword [rsp + 0x40], rbp
lea rbp, [rsp + 0x40]
movabs rdx, 0x76aaa2d061627548
mov qword [rsp + 0x18], rdx
movabs rdx, 0xb97076aaa2d06162
mov qword [rsp + 0x1a], rdx
movabs rdx, 0x65bca183c3eed661
mov qword [rsp + 0x22], rdx
movabs rdx, 0x90909050d000e07
mov qword [rsp + 0x2a], rdx
movabs rdx, 0x8050c0c100909
mov qword [rsp + 0x30], rdx
movabs rdx, 0x9040b0f040b1006
mov qword [rsp + 0x38], rdx
xor eax, eax
jmp 0x4f5f93
movzx r9d, byte [rsp + rsi + 0x18]
sub r9d, edx
lea edx, [r9 - 0x19]
mov byte [rsp + rdi + 0x18], dl
lea edx, [r8 - 0x19]
mov byte [rsp + rsi + 0x18], dl
add rax, 2
cmp rax, 0x16
jge 0x4f5fc2
movzx edx, byte [rsp + rax + 0x2a]
movzx esi, byte [rsp + rax + 0x2b]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x12
jae 0x4f5fe9
movzx r8d, byte [rsp + rdi + 0x18]
sub r8d, edx
cmp rsi, 0x12
jb 0x4f5f76
nop
jmp 0x4f5fdd
xor eax, eax
lea rbx, [rsp + 0x18]
mov ecx, 0x12
call fcn.0044a200
mov rbp, qword [rsp + 0x40]
add rsp, 0x48
ret
mov eax, esi
mov ecx, 0x12
call fcn.0045f5c0
mov eax, edi
mov ecx, 0x12
call fcn.0045f5c0
nop
call fcn.0045cf60
nop dword [rax + rax]
jmp fcn.004f5f00
Function at 0x4f6020
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4f6128
sub rsp, 0x58
mov qword [rsp + 0x50], rbp
lea rbp, [rsp + 0x50]
movabs rdx, 0xef63ee52615acc50
mov qword [rsp + 0x1d], rdx
movabs rdx, 0x644b2c7445ef63ee
mov qword [rsp + 0x22], rdx
movabs rdx, 0x124bf650483b3361
mov qword [rsp + 0x2a], rdx
movabs rdx, 0xb1214040302100a
mov qword [rsp + 0x32], rdx
movabs rdx, 0x401130b0e030f07
mov qword [rsp + 0x3a], rdx
movabs rdx, 0x1080310030f0401
mov qword [rsp + 0x40], rdx
movabs rdx, 0x1113070405100405
mov qword [rsp + 0x48], rdx
xor eax, eax
jmp 0x4f60c0
movzx r9d, byte [rsp + rsi + 0x1d]
lea edx, [r9 + rdx]
lea edx, [rdx - 1]
mov byte [rsp + rdi + 0x1d], dl
mov byte [rsp + rsi + 0x1d], r8b
add rax, 2
nop
cmp rax, 0x1e
jge 0x4f60f2
movzx edx, byte [rsp + rax + 0x32]
movzx esi, byte [rsp + rax + 0x33]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x15
jae 0x4f611b
movzx r8d, byte [rsp + rdi + 0x1d]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 1]
cmp rsi, 0x15
jb 0x4f60a5
jmp 0x4f610f
xor eax, eax
lea rbx, [rsp + 0x1d]
mov ecx, 0x15
nop
call fcn.0044a200
mov rbp, qword [rsp + 0x50]
add rsp, 0x58
ret
mov eax, esi
mov ecx, 0x15
call fcn.0045f5c0
mov eax, edi
mov ecx, 0x15
call fcn.0045f5c0
nop
call fcn.0045cf60
jmp fcn.004f6020
Function at 0x4f9240
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4f9348
sub rsp, 0x58
mov qword [rsp + 0x50], rbp
lea rbp, [rsp + 0x50]
movabs rdx, 0xf5f561b6b8659c41
mov qword [rsp + 0x18], rdx
movabs rdx, 0x2722e47408203a61
mov qword [rsp + 0x20], rdx
movabs rdx, 0x65f9aab7940372f7
mov qword [rsp + 0x28], rdx
movabs rdx, 0xf1310120e12090f
mov qword [rsp + 0x30], rdx
movabs rdx, 0x16040d0d0b150413
mov qword [rsp + 0x38], rdx
movabs rdx, 0x91403100f070b01
mov qword [rsp + 0x40], rdx
movabs rdx, 0xb06091014161612
mov qword [rsp + 0x48], rdx
xor eax, eax
jmp 0x4f92e2
movzx r9d, byte [rsp + rsi + 0x18]
sub r9d, edx
lea edx, [r9 - 0x77]
mov byte [rsp + rdi + 0x18], dl
lea edx, [r8 - 0x77]
mov byte [rsp + rsi + 0x18], dl
add rax, 2
cmp rax, 0x20
jge 0x4f930f
movzx edx, byte [rsp + rax + 0x30]
movzx esi, byte [rsp + rax + 0x31]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x18
jae 0x4f933b
movzx r8d, byte [rsp + rdi + 0x18]
sub r8d, edx
cmp rsi, 0x18
jb 0x4f92c5
jmp 0x4f932f
xor eax, eax
lea rbx, [rsp + 0x18]
mov ecx, 0x18
nop dword [rax + rax]
call fcn.0044a200
mov rbp, qword [rsp + 0x50]
add rsp, 0x58
ret
mov eax, esi
mov ecx, 0x18
call fcn.0045f5c0
mov eax, edi
mov ecx, 0x18
call fcn.0045f5c0
nop
call fcn.0045cf60
jmp fcn.004f9240

Function at 0x4f9360
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4f9456
sub rsp, 0x50
mov qword [rsp + 0x48], rbp
lea rbp, [rsp + 0x48]
movabs rdx, 0x20bb0e2217a2452a
mov qword [rsp + 0x1b], rdx
movabs rdx, 0x312061742a20bb0e
mov qword [rsp + 0x20], rdx
movabs rdx, 0xe07469df178fffd0
mov qword [rsp + 0x28], rdx
movabs rdx, 0x80e020608130f05
mov qword [rsp + 0x30], rdx
movabs rdx, 0x10140211000e030d
mov qword [rsp + 0x38], rdx
movabs rdx, 0xc0406030b0b1005
mov qword [rsp + 0x40], rdx
xor eax, eax
jmp 0x4f93f3
movzx r9d, byte [rsp + rsi + 0x1b]
sub r9d, edx
lea edx, [r9 + 0x60]
mov byte [rsp + rdi + 0x1b], dl
lea edx, [r8 + 0x60]
mov byte [rsp + rsi + 0x1b], dl
add rax, 2
cmp rax, 0x18
jge 0x4f9422
movzx edx, byte [rsp + rax + 0x30]
movzx esi, byte [rsp + rax + 0x31]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x15
jae 0x4f9449
movzx r8d, byte [rsp + rdi + 0x1b]
sub r8d, edx
cmp rsi, 0x15
jb 0x4f93d6
nop
jmp 0x4f943d
xor eax, eax
lea rbx, [rsp + 0x1b]
mov ecx, 0x15
call fcn.0044a200
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
mov eax, esi
mov ecx, 0x15
call fcn.0045f5c0
mov eax, edi
mov ecx, 0x15
call fcn.0045f5c0
nop
call fcn.0045cf60
nop dword [rax + rax]
jmp fcn.004f9360
Function at 0x4faac0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4fabd6
sub rsp, 0x58
mov qword [rsp + 0x50], rbp
lea rbp, [rsp + 0x50]
movabs rdx, 0x9567c56facec80d7
mov qword [rsp + 0x1b], rdx
movabs rdx, 0xdb6c76f687616970
mov qword [rsp + 0x23], rdx
movabs rdx, 0xcadb6c76f6876169
mov qword [rsp + 0x24], rdx
movabs rdx, 0x65a26954eff272f5
mov qword [rsp + 0x2c], rdx
movabs rdx, 0x1030d050b050e01
mov qword [rsp + 0x34], rdx
movabs rdx, 0xd01080b0e051311
mov qword [rsp + 0x3c], rdx
movabs rdx, 0x8010f0c0d01080b
mov qword [rsp + 0x40], rdx
movabs rdx, 0xb07001014170d02
mov qword [rsp + 0x48], rdx
xor eax, eax
jmp 0x4fab6e
movzx r9d, byte [rsp + rsi + 0x1b]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x65]
mov byte [rsp + rdi + 0x1b], dl
mov byte [rsp + rsi + 0x1b], r8b
add rax, 2
cmp rax, 0x1c
jge 0x4faba2
movzx edx, byte [rsp + rax + 0x34]
movzx esi, byte [rsp + rax + 0x35]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x19
jae 0x4fabc9
movzx r8d, byte [rsp + rdi + 0x1b]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x65]
cmp rsi, 0x19
jb 0x4fab54
nop
jmp 0x4fabbd
xor eax, eax
lea rbx, [rsp + 0x1b]
mov ecx, 0x19
call fcn.0044a200
mov rbp, qword [rsp + 0x50]
add rsp, 0x58
ret
mov eax, esi
mov ecx, 0x19
call fcn.0045f5c0
mov eax, edi
mov ecx, 0x19
call fcn.0045f5c0
nop
call fcn.0045cf60
nop dword [rax + rax]
jmp fcn.004faac0
Function at 0x4fc300
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4fc408
sub rsp, 0x58
mov qword [rsp + 0x50], rbp
lea rbp, [rsp + 0x50]
movabs rdx, 0x7dc0c0f1b6661451
mov qword [rsp + 0x19], rdx
movabs rdx, 0x64d2c574538afc7d
mov qword [rsp + 0x20], rdx
movabs rdx, 0x4b2e9a54a764bd21
mov qword [rsp + 0x28], rdx
movabs rdx, 0x802161216140412
mov qword [rsp + 0x30], rdx
movabs rdx, 0x90202040503010c
mov qword [rsp + 0x38], rdx
movabs rdx, 0xf0c15100d020c14
mov qword [rsp + 0x40], rdx
movabs rdx, 0x60c0d1006080709
mov qword [rsp + 0x48], rdx
xor eax, eax
jmp 0x4fc3a2
movzx r9d, byte [rsp + rsi + 0x19]
sub r9d, edx
lea edx, [r9 - 0x37]
mov byte [rsp + rdi + 0x19], dl
lea edx, [r8 - 0x37]
mov byte [rsp + rsi + 0x19], dl
add rax, 2
cmp rax, 0x20
jge 0x4fc3cf
movzx edx, byte [rsp + rax + 0x30]
movzx esi, byte [rsp + rax + 0x31]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x17
jae 0x4fc3fb
movzx r8d, byte [rsp + rdi + 0x19]
sub r8d, edx
cmp rsi, 0x17
jb 0x4fc385
jmp 0x4fc3ef
xor eax, eax
lea rbx, [rsp + 0x19]
mov ecx, 0x17
nop dword [rax + rax]
call fcn.0044a200
mov rbp, qword [rsp + 0x50]
add rsp, 0x58
ret
mov eax, esi
mov ecx, 0x17
call fcn.0045f5c0
mov eax, edi
mov ecx, 0x17
call fcn.0045f5c0
nop
call fcn.0045cf60
jmp fcn.004fc300

Function at 0x4fda60
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4fdb5c
sub rsp, 0x50
mov qword [rsp + 0x48], rbp
lea rbp, [rsp + 0x48]
movabs rdx, 0x499fd58aa19dc8c3
mov qword [rsp + 0x1e], rdx
movabs rdx, 0xe3af499fd58aa19d
mov qword [rsp + 0x20], rdx
movabs rdx, 0x9a9869b75264879d
mov qword [rsp + 0x28], rdx
movabs rdx, 0x90a03080e040b05
mov qword [rsp + 0x30], rdx
movabs rdx, 0x101103000111060b
mov qword [rsp + 0x38], rdx
movabs rdx, 0x7040a0403020d0d
mov qword [rsp + 0x40], rdx
xor eax, eax
jmp 0x4fdaf0
movzx r9d, byte [rsp + rsi + 0x1e]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x42]
mov byte [rsp + rdi + 0x1e], dl
mov byte [rsp + rsi + 0x1e], r8b
add rax, 2
cmp rax, 0x18
jge 0x4fdb28
movzx edx, byte [rsp + rax + 0x30]
movzx esi, byte [rsp + rax + 0x31]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x12
jae 0x4fdb4f
movzx r8d, byte [rsp + rdi + 0x1e]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x42]
nop word [rax + rax]
cmp rsi, 0x12
jb 0x4fdad6
jmp 0x4fdb43
xor eax, eax
lea rbx, [rsp + 0x1e]
mov ecx, 0x12
call fcn.0044a200
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
mov eax, esi
mov ecx, 0x12
call fcn.0045f5c0
mov eax, edi
mov ecx, 0x12
call fcn.0045f5c0
nop
nop dword [rax]
call fcn.0045cf60
jmp fcn.004fda60
Function at 0x4fe960
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4fea56
sub rsp, 0x50
mov qword [rsp + 0x48], rbp
lea rbp, [rsp + 0x48]
movabs rdx, 0x7d8792c498c18f4b
mov qword [rsp + 0x32], rdx
movabs rdx, 0x856e61937d207d87
mov qword [rsp + 0x38], rdx
movabs rdx, 0xb18e9e7c9764729b
mov qword [rsp + 0x40], rdx
movabs rdx, 0x1105120915020a0d
mov qword [rsp + 0x1c], rdx
movabs rdx, 0x107031402151105
mov qword [rsp + 0x22], rdx
movabs rdx, 0x60e0d131100040d
mov qword [rsp + 0x2a], rdx
xor eax, eax
jmp 0x4fe9f3
movzx r9d, byte [rsp + rsi + 0x32]
sub r9d, edx
lea edx, [r9 - 0xa]
mov byte [rsp + rdi + 0x32], dl
lea edx, [r8 - 0xa]
mov byte [rsp + rsi + 0x32], dl
add rax, 2
cmp rax, 0x16
jge 0x4fea22
movzx edx, byte [rsp + rax + 0x1c]
movzx esi, byte [rsp + rax + 0x1d]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x16
jae 0x4fea49
movzx r8d, byte [rsp + rdi + 0x32]
sub r8d, edx
cmp rsi, 0x16
jb 0x4fe9d6
nop
jmp 0x4fea3d
xor eax, eax
lea rbx, [rsp + 0x32]
mov ecx, 0x16
call fcn.0044a200
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
mov eax, esi
mov ecx, 0x16
call fcn.0045f5c0
mov eax, edi
mov ecx, 0x16
call fcn.0045f5c0
nop
call fcn.0045cf60
nop dword [rax + rax]
jmp fcn.004fe960

Function at 0x4fede0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4feef2
sub rsp, 0x60
mov qword [rsp + 0x58], rbp
lea rbp, [rsp + 0x58]
movabs rdx, 0x2c34b6e465382917
mov qword [rsp + 0x1f], rdx
movabs rdx, 0x371ffddb53a6ff2c
mov qword [rsp + 0x26], rdx
movabs rdx, 0x41ca4df4faf9dd61
mov qword [rsp + 0x2e], rdx
movabs rdx, 0x160b120405090c00
mov qword [rsp + 0x36], rdx
movabs rdx, 0xd08160b12040509
mov qword [rsp + 0x38], rdx
movabs rdx, 0x13090415010e0210
mov qword [rsp + 0x40], rdx
movabs rdx, 0x702161305040211
mov qword [rsp + 0x48], rdx
movabs rdx, 0x51106110d141304
mov qword [rsp + 0x50], rdx
xor eax, eax
jmp 0x4fee91
movzx r9d, byte [rsp + rsi + 0x1f]
sub r9d, edx
lea edx, [r9 + 0x56]
mov byte [rsp + rdi + 0x1f], dl
lea edx, [r8 + 0x56]
mov byte [rsp + rsi + 0x1f], dl
add rax, 2
cmp rax, 0x22
jge 0x4feebe
movzx edx, byte [rsp + rax + 0x36]
movzx esi, byte [rsp + rax + 0x37]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x17
jae 0x4feee5
movzx r8d, byte [rsp + rdi + 0x1f]
sub r8d, edx
cmp rsi, 0x17
jb 0x4fee74
jmp 0x4feed9
xor eax, eax
lea rbx, [rsp + 0x1f]
mov ecx, 0x17
call fcn.0044a200
mov rbp, qword [rsp + 0x58]
add rsp, 0x60
ret
mov eax, esi
mov ecx, 0x17
call fcn.0045f5c0
mov eax, edi
mov ecx, 0x17
call fcn.0045f5c0
nop
call fcn.0045cf60
jmp fcn.004fede0
Function at 0x4ffa00
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4ffaf6
sub rsp, 0x50
mov qword [rsp + 0x48], rbp
lea rbp, [rsp + 0x48]
movabs rdx, 0x776fbc20211c1a0e
mov qword [rsp + 0x19], rdx
movabs rdx, 0x646e78beea20f677
mov qword [rsp + 0x20], rdx
movabs rdx, 0x2916a0062e646c28
mov qword [rsp + 0x28], rdx
movabs rdx, 0x5081510050b0c14
mov qword [rsp + 0x30], rdx
movabs rdx, 0x151400130b031602
mov qword [rsp + 0x38], rdx
movabs rdx, 0x15140c12140a010f
mov qword [rsp + 0x40], rdx
xor eax, eax
jmp 0x4ffa93
movzx r9d, byte [rsp + rsi + 0x19]
sub r9d, edx
lea edx, [r9 + 0x65]
mov byte [rsp + rdi + 0x19], dl
lea edx, [r8 + 0x65]
mov byte [rsp + rsi + 0x19], dl
add rax, 2
cmp rax, 0x18
jge 0x4ffac2
movzx edx, byte [rsp + rax + 0x30]
movzx esi, byte [rsp + rax + 0x31]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x17
jae 0x4ffae9
movzx r8d, byte [rsp + rdi + 0x19]
sub r8d, edx
cmp rsi, 0x17
jb 0x4ffa76
nop
jmp 0x4ffadd
xor eax, eax
lea rbx, [rsp + 0x19]
mov ecx, 0x17
call fcn.0044a200
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
mov eax, esi
mov ecx, 0x17
call fcn.0045f5c0
mov eax, edi
mov ecx, 0x17
call fcn.0045f5c0
nop
call fcn.0045cf60
nop dword [rax + rax]
jmp fcn.004ffa00

Function at 0x501b20
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x501c28
sub rsp, 0x58
mov qword [rsp + 0x50], rbp
lea rbp, [rsp + 0x50]
movabs rdx, 0xd7306721f14c16e
mov qword [rsp + 0x1d], rdx
movabs rdx, 0xc06e0f746e0d7306
mov qword [rsp + 0x22], rdx
movabs rdx, 0x236d17f27c641790
mov qword [rsp + 0x2a], rdx
movabs rdx, 0x110100803000505
mov qword [rsp + 0x32], rdx
movabs rdx, 0x11000c0a02120e0a
mov qword [rsp + 0x3a], rdx
movabs rdx, 0x31007110d081100
mov qword [rsp + 0x40], rdx
movabs rdx, 0xa01140d14080c14
mov qword [rsp + 0x48], rdx
xor eax, eax
jmp 0x501bc2
movzx r9d, byte [rsp + rsi + 0x1d]
sub r9d, edx
lea edx, [r9 + 0x6f]
mov byte [rsp + rdi + 0x1d], dl
lea edx, [r8 + 0x6f]
mov byte [rsp + rsi + 0x1d], dl
add rax, 2
cmp rax, 0x1e
jge 0x501bef
movzx edx, byte [rsp + rax + 0x32]
movzx esi, byte [rsp + rax + 0x33]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x15
jae 0x501c1b
movzx r8d, byte [rsp + rdi + 0x1d]
sub r8d, edx
cmp rsi, 0x15
jb 0x501ba5
jmp 0x501c0f
xor eax, eax
lea rbx, [rsp + 0x1d]
mov ecx, 0x15
nop dword [rax + rax]
call fcn.0044a200
mov rbp, qword [rsp + 0x50]
add rsp, 0x58
ret
mov eax, esi
mov ecx, 0x15
call fcn.0045f5c0
mov eax, edi
mov ecx, 0x15
call fcn.0045f5c0
nop
call fcn.0045cf60
jmp fcn.00501b20