joyce8/EMBER2024-capa huggingface dataset:
Function at 0x499600
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x499708
sub rsp, 0x50
mov qword [rsp + 0x48], rbp
lea rbp, [rsp + 0x48]
movabs rdx, 0xc9094f1b392f31e5
mov qword [rsp + 0x1c], rdx
movabs rdx, 0x49c8c9094f1b392f
mov qword [rsp + 0x1e], rdx
movabs rdx, 0x1af449eb2de62b6e
mov qword [rsp + 0x26], rdx
movabs rdx, 0x10080704100e0f05
mov qword [rsp + 0x2e], rdx
movabs rdx, 0xc10110010040306
mov qword [rsp + 0x36], rdx
movabs rdx, 0x3100c1011001004
mov qword [rsp + 0x38], rdx
movabs rdx, 0x2010d0e0407110b
mov qword [rsp + 0x40], rdx
xor eax, eax
jmp 0x4996a0
movzx r9d, byte [rsp + rsi + 0x1c]
add r9d, 0x1b
add edx, r9d
mov byte [rsp + rdi + 0x1c], dl
mov byte [rsp + rsi + 0x1c], r8b
add rax, 2
nop
cmp rax, 0x1a
jge 0x4996d1
movzx edx, byte [rsp + rax + 0x2e]
movzx esi, byte [rsp + rax + 0x2f]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x12
jae 0x4996fb
movzx r8d, byte [rsp + rdi + 0x1c]
add r8d, 0x1b
add r8d, edx
cmp rsi, 0x12
jb 0x499685
jmp 0x4996ef
xor eax, eax
lea rbx, [rsp + 0x1c]
mov ecx, 0x12
nop dword [rax]
call fcn.0044ba20
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
mov eax, esi
mov ecx, 0x12
call fcn.00461e80
mov eax, edi
mov ecx, 0x12
call fcn.00461e80
nop
call fcn.0045f820
jmp fcn.00499600

Function at 0x499fc0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x49a0c8
sub rsp, 0x50
mov qword [rsp + 0x48], rbp
lea rbp, [rsp + 0x48]
movabs rdx, 0xe2c559dcd6f861d8
mov qword [rsp + 0x1c], rdx
movabs rdx, 0x646ee2c559dcd6f8
mov qword [rsp + 0x1e], rdx
movabs rdx, 0x727a7ebd65e5e553
mov qword [rsp + 0x26], rdx
movabs rdx, 0x6000e040f100509
mov qword [rsp + 0x2e], rdx
movabs rdx, 0x100509030304070c
mov qword [rsp + 0x36], rdx
movabs rdx, 0x30e100509030304
mov qword [rsp + 0x38], rdx
movabs rdx, 0x30e0b0b020f040b
mov qword [rsp + 0x40], rdx
xor eax, eax
jmp 0x49a062
movzx r9d, byte [rsp + rsi + 0x1c]
sub r9d, edx
lea edx, [r9 - 0x63]
mov byte [rsp + rdi + 0x1c], dl
lea edx, [r8 - 0x63]
mov byte [rsp + rsi + 0x1c], dl
add rax, 2
cmp rax, 0x1a
jge 0x49a08f
movzx edx, byte [rsp + rax + 0x2e]
movzx esi, byte [rsp + rax + 0x2f]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x12
jae 0x49a0bb
movzx r8d, byte [rsp + rdi + 0x1c]
sub r8d, edx
cmp rsi, 0x12
jb 0x49a045
jmp 0x49a0af
xor eax, eax
lea rbx, [rsp + 0x1c]
mov ecx, 0x12
nop dword [rax + rax]
call fcn.0044ba20
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
mov eax, esi
mov ecx, 0x12
call fcn.00461e80
mov eax, edi
mov ecx, 0x12
call fcn.00461e80
nop
call fcn.0045f820
jmp fcn.00499fc0
Function at 0x4a3d20
Capabilities:
Hash data using fnv

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4a3f6c
add rsp, 0xffffffffffffff80
mov qword [rsp + 0x78], rbp
lea rbp, [rsp + 0x78]
mov ebx, dword [rax + 0x2c]
nop dword [rax + rax]
test ebx, ebx
jne 0x4a3dcc
mov qword [rsp + 0x88], rax
lea rbx, [0x00666e80]
mov rcx, rax
lea rax, [0x008049a0]
call fcn.0046bde0
test cl, cl
jne 0x4a3db1
mov rax, qword [rsp + 0x88]
call fcn.004a2520
mov ecx, 1
mov rdi, rax
mov rsi, rbx
lea rax, [rsp + 0x30]
lea rbx, [0x006a4f78]
call fcn.0044b680
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x28], rbx
nop dword [rax]
call fcn.004a5380
mov rcx, qword [rsp + 0x88]
xor edx, edx
jmp 0x4a3dee
lea rdx, [0x00666bc0]
cmp rax, rdx
jne 0x4a3ddc
test byte [rbx], al
mov rax, rbx
mov rbp, qword [rsp + 0x78]
sub rsp, 0xffffffffffffff80
ret
nop
call fcn.0045d3c0
mov rbp, qword [rsp + 0x78]
sub rsp, 0xffffffffffffff80
ret
mov rbx, rdx
lea rcx, [0x0064f680]
call fcn.0040a460
inc rdx
cmp rbx, rdx
jle 0x4a3e38
mov rsi, qword [rax + rdx*8]
cmp qword [rsi + 0x30], rcx
jne 0x4a3deb
lea rax, [0x008049a0]
lea rbx, [0x00666e80]
lea rdi, [0x00666bc0]
call fcn.0046bfa0
lea rdx, [0x00666bc0]
nop
cmp rax, rdx
jne 0x4a3f5c
test byte [rbx], al
mov rax, rbx
mov rbp, qword [rsp + 0x78]
sub rsp, 0xffffffffffffff80
ret
lea rcx, [0x00649f80]
mov qword [rsp + 0x68], rcx
mov qword [rsp + 0x70], 0
mov rcx, qword [rsp + 0x68]
mov qword [rsp + 0x58], rcx
lea rax, [0x006582a0]
nop
call fcn.0040d100
mov qword [rsp + 0x60], rax
mov rcx, qword [rsp + 0x58]
test byte [rcx], al
cmp dword [0x00858270], 0
jne 0x4a3e9a
mov rdx, qword [rcx]
mov qword [rax], rdx
movups xmm0, xmmword [rcx + 8]
movups xmmword [rax + 8], xmm0
movups xmm0, xmmword [rcx + 0x18]
movups xmmword [rax + 0x18], xmm0
movups xmm0, xmmword [rcx + 0x28]
movups xmmword [rax + 0x28], xmm0
jmp 0x4a3ea9
mov rbx, rax
lea rax, [0x006582a0]
call fcn.00412fc0
mov rax, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x28]
xor ecx, ecx
xor edi, edi
xor esi, esi
mov r8d, esi
nop dword [rax]
call fcn.004a1780
nop
call fcn.0045d480
mov rsi, qword [rsp + 0x60]
mov dword [rsi + 0x28], eax
mov dword [rsi + 0x2c], 0
mov rcx, qword [rsp + 0x88]
mov edx, dword [rcx + 0x10]
xor eax, eax
jmp 0x4a3ef7
imul edx, edx, 0x1000193
xor edx, 0x2a
mov eax, 1
cmp rax, 1
jl 0x4a3ee9
mov dword [rsi + 0x10], edx
cmp dword [0x00858270], 0
jne 0x4a3f0f
mov qword [rsi + 0x30], rcx
jmp 0x4a3f18
lea rdi, [rsi + 0x30]
call fcn.00461ae0
lea rax, [0x008049a0]
lea rbx, [0x00666e80]
lea rdi, [0x00666bc0]
call fcn.0046bfa0
lea rdx, [0x00666bc0]
cmp rax, rdx
jne 0x4a3f4d
test byte [rbx], al
mov rax, rbx
mov rbp, qword [rsp + 0x78]
sub rsp, 0xffffffffffffff80
ret
mov rbx, rdx
lea rcx, [0x0064f680]
call fcn.0040a460
mov rbx, rdx
lea rcx, [0x0064f680]
call fcn.0040a460
nop
mov qword [rsp + 8], rax
call fcn.0045f820
mov rax, qword [rsp + 8]
nop dword [rax + rax]
jmp fcn.004a3d20
Function at 0x4b1700
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4b17f6
sub rsp, 0x48
mov qword [rsp + 0x40], rbp
lea rbp, [rsp + 0x40]
movabs rdx, 0x3a74ac6514d726e5
mov qword [rsp + 0x1b], rdx
movabs rdx, 0xdf3a74ac6514d726
mov qword [rsp + 0x1c], rdx
movabs rdx, 0xead4256e281d314e
mov qword [rsp + 0x24], rdx
movabs rdx, 0xf0b0e0b02080503
mov qword [rsp + 0x2c], rdx
movabs rdx, 0x31001000f0b0e0b
mov qword [rsp + 0x30], rdx
movabs rdx, 0x100102030a0b0f01
mov qword [rsp + 0x38], rdx
xor eax, eax
jmp 0x4b1793
movzx r9d, byte [rsp + rsi + 0x1b]
sub r9d, edx
lea edx, [r9 + 0x55]
mov byte [rsp + rdi + 0x1b], dl
lea edx, [r8 + 0x55]
mov byte [rsp + rsi + 0x1b], dl
add rax, 2
cmp rax, 0x14
jge 0x4b17c2
movzx edx, byte [rsp + rax + 0x2c]
movzx esi, byte [rsp + rax + 0x2d]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x11
jae 0x4b17e9
movzx r8d, byte [rsp + rdi + 0x1b]
sub r8d, edx
cmp rsi, 0x11
jb 0x4b1776
nop
jmp 0x4b17dd
xor eax, eax
lea rbx, [rsp + 0x1b]
mov ecx, 0x11
call fcn.0044ba20
mov rbp, qword [rsp + 0x40]
add rsp, 0x48
ret
mov eax, esi
mov ecx, 0x11
call fcn.00461e80
mov eax, edi
mov ecx, 0x11
call fcn.00461e80
nop
call fcn.0045f820
nop dword [rax + rax]
jmp fcn.004b1700

Function at 0x4b1820
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4b1916
sub rsp, 0x48
mov qword [rsp + 0x40], rbp
lea rbp, [rsp + 0x40]
movabs rdx, 0x4afc636d6c66b098
mov qword [rsp + 0x18], rdx
movabs rdx, 0xacb84afc636d6c66
mov qword [rsp + 0x1a], rdx
movabs rdx, 0x29b3b56eb0fe9460
mov qword [rsp + 0x22], rdx
movabs rdx, 0x806010c00000704
mov qword [rsp + 0x2a], rdx
movabs rdx, 0xa1004100b090806
mov qword [rsp + 0x30], rdx
movabs rdx, 0xa0d0f0110010800
mov qword [rsp + 0x38], rdx
xor eax, eax
jmp 0x4b18b3
movzx r9d, byte [rsp + rsi + 0x18]
sub r9d, edx
lea edx, [r9 - 0x30]
mov byte [rsp + rdi + 0x18], dl
lea edx, [r8 - 0x30]
mov byte [rsp + rsi + 0x18], dl
add rax, 2
cmp rax, 0x16
jge 0x4b18e2
movzx edx, byte [rsp + rax + 0x2a]
movzx esi, byte [rsp + rax + 0x2b]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x12
jae 0x4b1909
movzx r8d, byte [rsp + rdi + 0x18]
sub r8d, edx
cmp rsi, 0x12
jb 0x4b1896
nop
jmp 0x4b18fd
xor eax, eax
lea rbx, [rsp + 0x18]
mov ecx, 0x12
call fcn.0044ba20
mov rbp, qword [rsp + 0x40]
add rsp, 0x48
ret
mov eax, esi
mov ecx, 0x12
call fcn.00461e80
mov eax, edi
mov ecx, 0x12
call fcn.00461e80
nop
call fcn.0045f820
nop dword [rax + rax]
jmp fcn.004b1820
Function at 0x4b4440
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4b4508
sub rsp, 0x38
mov qword [rsp + 0x30], rbp
lea rbp, [rsp + 0x30]
movabs rdx, 0x61683f65655c6e54
mov qword [rsp + 0x1d], rdx
mov byte [rsp + 0x25], 0x72
movabs rdx, 0x206060804040500
mov qword [rsp + 0x26], rdx
mov word [rsp + 0x2e], 0x705
xor eax, eax
jmp 0x4b44a3
movzx r9d, byte [rsp + rsi + 0x1d]
sub r9d, edx
lea edx, [r9 + 0xf]
mov byte [rsp + rdi + 0x1d], dl
lea edx, [r8 + 0xf]
mov byte [rsp + rsi + 0x1d], dl
add rax, 2
cmp rax, 0xa
jge 0x4b44d0
movzx edx, byte [rsp + rax + 0x26]
movzx esi, byte [rsp + rax + 0x27]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 9
jae 0x4b44fb
movzx r8d, byte [rsp + rdi + 0x1d]
sub r8d, edx
cmp rsi, 9
jb 0x4b4486
jmp 0x4b44ef
xor eax, eax
lea rbx, [rsp + 0x1d]
mov ecx, 9
nop dword [rax]
call fcn.0044ba20
mov rbp, qword [rsp + 0x30]
add rsp, 0x38
ret
mov eax, esi
mov ecx, 9
call fcn.00461e80
mov eax, edi
mov ecx, 9
call fcn.00461e80
nop
call fcn.0045f820
jmp fcn.004b4440
Function at 0x4b5380
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4b5488
sub rsp, 0x58
mov qword [rsp + 0x50], rbp
lea rbp, [rsp + 0x50]
movabs rdx, 0x44ff6df828381f25
mov qword [rsp + 0x1a], rdx
movabs rdx, 0x4d493fd1504c6574
mov qword [rsp + 0x22], rdx
movabs rdx, 0x7460730066064630
mov qword [rsp + 0x2a], rdx
movabs rdx, 0x10c0002030e1612
mov qword [rsp + 0x32], rdx
movabs rdx, 0xb040f010b010b06
mov qword [rsp + 0x3a], rdx
movabs rdx, 0xe0e041614110b04
mov qword [rsp + 0x40], rdx
movabs rdx, 0xd04070010020c0a
mov qword [rsp + 0x48], rdx
xor eax, eax
jmp 0x4b5420
movzx r9d, byte [rsp + rsi + 0x1a]
add r9d, 0xb
add edx, r9d
mov byte [rsp + rdi + 0x1a], dl
mov byte [rsp + rsi + 0x1a], r8b
add rax, 2
nop
cmp rax, 0x1e
jge 0x4b5451
movzx edx, byte [rsp + rax + 0x32]
movzx esi, byte [rsp + rax + 0x33]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x18
jae 0x4b547b
movzx r8d, byte [rsp + rdi + 0x1a]
add r8d, 0xb
add r8d, edx
cmp rsi, 0x18
jb 0x4b5405
jmp 0x4b546f
xor eax, eax
lea rbx, [rsp + 0x1a]
mov ecx, 0x18
nop dword [rax]
call fcn.0044ba20
mov rbp, qword [rsp + 0x50]
add rsp, 0x58
ret
mov eax, esi
mov ecx, 0x18
call fcn.00461e80
mov eax, edi
mov ecx, 0x18
call fcn.00461e80
nop
call fcn.0045f820
jmp fcn.004b5380

Function at 0x4b5940
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4b5a52
sub rsp, 0x60
mov qword [rsp + 0x58], rbp
lea rbp, [rsp + 0x58]
movabs rdx, 0x758f8a9983b934b6
mov qword [rsp + 0x1e], rdx
movabs rdx, 0x988a7c8320cc9574
mov qword [rsp + 0x26], rdx
movabs rdx, 0x74c2739666e5a56b
mov qword [rsp + 0x2e], rdx
movabs rdx, 0x30612110112160a
mov qword [rsp + 0x36], rdx
movabs rdx, 0xc01030612110112
mov qword [rsp + 0x38], rdx
movabs rdx, 0xf1212060d020006
mov qword [rsp + 0x40], rdx
movabs rdx, 0xa0616050d05050c
mov qword [rsp + 0x48], rdx
movabs rdx, 0xd040e0314050906
mov qword [rsp + 0x50], rdx
xor eax, eax
jmp 0x4b59f1
movzx r9d, byte [rsp + rsi + 0x1e]
sub r9d, edx
lea edx, [r9 + 4]
mov byte [rsp + rdi + 0x1e], dl
lea edx, [r8 + 4]
mov byte [rsp + rsi + 0x1e], dl
add rax, 2
cmp rax, 0x22
jge 0x4b5a1e
movzx edx, byte [rsp + rax + 0x36]
movzx esi, byte [rsp + rax + 0x37]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x18
jae 0x4b5a45
movzx r8d, byte [rsp + rdi + 0x1e]
sub r8d, edx
cmp rsi, 0x18
jb 0x4b59d4
jmp 0x4b5a39
xor eax, eax
lea rbx, [rsp + 0x1e]
mov ecx, 0x18
call fcn.0044ba20
mov rbp, qword [rsp + 0x58]
add rsp, 0x60
ret
mov eax, esi
mov ecx, 0x18
call fcn.00461e80
mov eax, edi
mov ecx, 0x18
call fcn.00461e80
nop
call fcn.0045f820
jmp fcn.004b5940
Function at 0x4b6f80
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4b7088
sub rsp, 0x58
mov qword [rsp + 0x50], rbp
lea rbp, [rsp + 0x50]
movabs rdx, 0xa2f53aec3166361a
mov qword [rsp + 0x1d], rdx
movabs rdx, 0xe07488de27a2f53a
mov qword [rsp + 0x22], rdx
movabs rdx, 0x36eef7242e382d64
mov qword [rsp + 0x2a], rdx
movabs rdx, 0x60a08120711130c
mov qword [rsp + 0x32], rdx
movabs rdx, 0x6000c10070c1111
mov qword [rsp + 0x3a], rdx
movabs rdx, 0x13140a1104140600
mov qword [rsp + 0x40], rdx
movabs rdx, 0x805010f10030e09
mov qword [rsp + 0x48], rdx
xor eax, eax
jmp 0x4b7022
movzx r9d, byte [rsp + rsi + 0x1d]
sub r9d, edx
lea edx, [r9 + 0x5f]
mov byte [rsp + rdi + 0x1d], dl
lea edx, [r8 + 0x5f]
mov byte [rsp + rsi + 0x1d], dl
add rax, 2
cmp rax, 0x1e
jge 0x4b704f
movzx edx, byte [rsp + rax + 0x32]
movzx esi, byte [rsp + rax + 0x33]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x15
jae 0x4b707b
movzx r8d, byte [rsp + rdi + 0x1d]
sub r8d, edx
cmp rsi, 0x15
jb 0x4b7005
jmp 0x4b706f
xor eax, eax
lea rbx, [rsp + 0x1d]
mov ecx, 0x15
nop dword [rax + rax]
call fcn.0044ba20
mov rbp, qword [rsp + 0x50]
add rsp, 0x58
ret
mov eax, esi
mov ecx, 0x15
call fcn.00461e80
mov eax, edi
mov ecx, 0x15
call fcn.00461e80
nop
call fcn.0045f820
jmp fcn.004b6f80
Function at 0x4b8160
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4b8228
sub rsp, 0x38
mov qword [rsp + 0x30], rbp
lea rbp, [rsp + 0x30]
movabs rdx, 0xdbfc2e0be56665fb
mov qword [rsp + 0x1b], rdx
mov byte [rsp + 0x23], 0
movabs rdx, 0x600080306040407
mov qword [rsp + 0x24], rdx
mov dword [rsp + 0x2c], 0x5040306
xor eax, eax
jmp 0x4b81c1
movzx r9d, byte [rsp + rsi + 0x1b]
add r9d, 0x2c
add edx, r9d
mov byte [rsp + rdi + 0x1b], dl
mov byte [rsp + rsi + 0x1b], r8b
add rax, 2
cmp rax, 0xc
jge 0x4b81f2
movzx edx, byte [rsp + rax + 0x24]
movzx esi, byte [rsp + rax + 0x25]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 9
jae 0x4b821b
movzx r8d, byte [rsp + rdi + 0x1b]
add r8d, 0x2c
add r8d, edx
cmp rsi, 9
jb 0x4b81a7
jmp 0x4b820f
xor eax, eax
lea rbx, [rsp + 0x1b]
mov ecx, 9
nop
call fcn.0044ba20
mov rbp, qword [rsp + 0x30]
add rsp, 0x38
ret
mov eax, esi
mov ecx, 9
call fcn.00461e80
mov eax, edi
mov ecx, 9
call fcn.00461e80
nop
call fcn.0045f820
jmp fcn.004b8160

Function at 0x4b93e0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4b9512
sub rsp, 0x70
mov qword [rsp + 0x68], rbp
lea rbp, [rsp + 0x68]
movabs rdx, 0x3a7463deec8569ee
mov qword [rsp + 0x1b], rdx
movabs rdx, 0x63d8d9e9893a7463
mov qword [rsp + 0x20], rdx
movabs rdx, 0xc0d974f5e43c01d2
mov qword [rsp + 0x28], rdx
movabs rdx, 0x75667cb66f6ed7be
mov qword [rsp + 0x30], rdx
movabs rdx, 0x205836d6f820e56e
mov qword [rsp + 0x38], rdx
movabs rdx, 0x10231a0821091401
mov qword [rsp + 0x40], rdx
movabs rdx, 0xb152220200f0411
mov qword [rsp + 0x48], rdx
movabs rdx, 0x2200200222110d19
mov qword [rsp + 0x50], rdx
movabs rdx, 0x31913110416110e
mov qword [rsp + 0x58], rdx
movabs rdx, 0x30a0b0a1e101420
mov qword [rsp + 0x60], rdx
xor eax, eax
jmp 0x4b94af
movzx r9d, byte [rsp + rsi + 0x1b]
sub r9d, edx
lea edx, [r9 - 0x46]
mov byte [rsp + rdi + 0x1b], dl
lea edx, [r8 - 0x46]
mov byte [rsp + rsi + 0x1b], dl
add rax, 2
cmp rax, 0x28
jge 0x4b94dc
movzx edx, byte [rsp + rax + 0x40]
movzx esi, byte [rsp + rax + 0x41]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x25
jae 0x4b9505
movzx r8d, byte [rsp + rdi + 0x1b]
sub r8d, edx
cmp rsi, 0x25
jb 0x4b9492
jmp 0x4b94f7
xor eax, eax
lea rbx, [rsp + 0x1b]
mov ecx, 0x25
call fcn.0044ba20
mov rbp, qword [rsp + 0x68]
add rsp, 0x70
ret
mov eax, esi
mov ecx, 0x25
nop
call fcn.00461e80
mov eax, edi
mov ecx, 0x25
call fcn.00461e80
nop
call fcn.0045f820
jmp fcn.004b93e0
Function at 0x4ba380
Capabilities:
Encrypt data using rc4 prga

Disassembly:
lea r12, [rsp - 0x18]
cmp r12, qword [r14 + 0x10]
jbe 0x4ba515
sub rsp, 0x98
mov qword [rsp + 0x90], rbp
lea rbp, [rsp + 0x90]
movabs rdx, 0x3a2a4065596665f3
mov qword [rsp + 0x1f], rdx
movabs rdx, 0xbef96574f941463a
mov qword [rsp + 0x26], rdx
movabs rdx, 0x310859f73b436c61
mov qword [rsp + 0x2e], rdx
movabs rdx, 0xcf3a61316e691450
mov qword [rsp + 0x36], rdx
movabs rdx, 0x246f451507cd2064
mov qword [rsp + 0x3e], rdx
movabs rdx, 0x74654d1f4f613729
mov qword [rsp + 0x46], rdx
movabs rdx, 0x1f26624787592f49
mov qword [rsp + 0x4e], rdx
movabs rdx, 0x61332220e302b36
mov qword [rsp + 0x56], rdx
movabs rdx, 0x231b1e1805213528
mov qword [rsp + 0x5e], rdx
movabs rdx, 0xd12231b1e180521
mov qword [rsp + 0x60], rdx
movabs rdx, 0x6231b0a27222400
mov qword [rsp + 0x68], rdx
movabs rdx, 0x161d051626173003
mov qword [rsp + 0x70], rdx
movabs rdx, 0x3112a0912091b1b
mov qword [rsp + 0x78], rdx
movabs rdx, 0xd2815080e2f330d
mov qword [rsp + 0x80], rdx
movabs rdx, 0x150e28313314341e
mov qword [rsp + 0x88], rdx
xor eax, eax
jmp 0x4ba4ae
movzx r9d, byte [rsp + rsi + 0x1f]
sub r9d, edx
lea edx, [r9 + 0x63]
mov byte [rsp + rdi + 0x1f], dl
lea edx, [r8 + 0x63]
mov byte [rsp + rsi + 0x1f], dl
add rax, 2
cmp rax, 0x3a
jge 0x4ba4db
movzx edx, byte [rsp + rax + 0x56]
movzx esi, byte [rsp + rax + 0x57]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x37
jae 0x4ba508
movzx r8d, byte [rsp + rdi + 0x1f]
sub r8d, edx
cmp rsi, 0x37
jb 0x4ba491
jmp 0x4ba4fc
xor eax, eax
lea rbx, [rsp + 0x1f]
mov ecx, 0x37
call fcn.0044ba20
mov rbp, qword [rsp + 0x90]
add rsp, 0x98
ret
mov eax, esi
mov ecx, 0x37
call fcn.00461e80
mov eax, edi
mov ecx, 0x37
call fcn.00461e80
nop
call fcn.0045f820
jmp fcn.004ba380

Function at 0x4ba860
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4ba93c
sub rsp, 0x40
mov qword [rsp + 0x38], rbp
lea rbp, [rsp + 0x38]
movabs rdx, 0x7075536b6e8d6474
mov qword [rsp + 0x1b], rdx
movabs rdx, 0x92aa3e99a9707553
mov qword [rsp + 0x20], rdx
movabs rdx, 0x108050c010b0708
mov qword [rsp + 0x28], rdx
movabs rdx, 0xb09020709080404
mov qword [rsp + 0x30], rdx
xor eax, eax
jmp 0x4ba8d2
movzx r9d, byte [rsp + rsi + 0x1b]
add r9d, 0xffffffd0
add edx, r9d
mov byte [rsp + rdi + 0x1b], dl
mov byte [rsp + rsi + 0x1b], r8b
add rax, 2
cmp rax, 0x10
jge 0x4ba908
movzx edx, byte [rsp + rax + 0x28]
movzx esi, byte [rsp + rax + 0x29]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0xd
jae 0x4ba92f
movzx r8d, byte [rsp + rdi + 0x1b]
add r8d, 0xffffffd0
add r8d, edx
nop dword [rax + rax]
cmp rsi, 0xd
jb 0x4ba8b8
jmp 0x4ba923
xor eax, eax
lea rbx, [rsp + 0x1b]
mov ecx, 0xd
call fcn.0044ba20
mov rbp, qword [rsp + 0x38]
add rsp, 0x40
ret
mov eax, esi
mov ecx, 0xd
call fcn.00461e80
mov eax, edi
mov ecx, 0xd
call fcn.00461e80
nop
nop dword [rax]
call fcn.0045f820
jmp fcn.004ba860
Function at 0x4bca40
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4bcb72
sub rsp, 0x70
mov qword [rsp + 0x68], rbp
lea rbp, [rsp + 0x68]
movabs rdx, 0xd0d434ca6ce26572
mov qword [rsp + 0x1b], rdx
movabs rdx, 0xccd975e834d0d434
mov qword [rsp + 0x20], rdx
movabs rdx, 0x94fe6f4ec38ed069
mov qword [rsp + 0x28], rdx
movabs rdx, 0x95550a73b27be5c8
mov qword [rsp + 0x30], rdx
movabs rdx, 0xc47a5d99bbed741e
mov qword [rsp + 0x38], rdx
movabs rdx, 0x14080b2217131509
mov qword [rsp + 0x40], rdx
movabs rdx, 0x182310131d1f241a
mov qword [rsp + 0x48], rdx
movabs rdx, 0x210c111f16131422
mov qword [rsp + 0x50], rdx
movabs rdx, 0x50e20040b241f0f
mov qword [rsp + 0x58], rdx
movabs rdx, 0xe160206241b1c07
mov qword [rsp + 0x60], rdx
xor eax, eax
jmp 0x4bcb0c
movzx r9d, byte [rsp + rsi + 0x1b]
add r9d, 0x6a
add edx, r9d
mov byte [rsp + rdi + 0x1b], dl
mov byte [rsp + rsi + 0x1b], r8b
add rax, 2
cmp rax, 0x28
jge 0x4bcb3d
movzx edx, byte [rsp + rax + 0x40]
movzx esi, byte [rsp + rax + 0x41]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x25
jae 0x4bcb65
movzx r8d, byte [rsp + rdi + 0x1b]
add r8d, 0x6a
add r8d, edx
cmp rsi, 0x25
jb 0x4bcaf2
jmp 0x4bcb58
xor eax, eax
lea rbx, [rsp + 0x1b]
mov ecx, 0x25
call fcn.0044ba20
mov rbp, qword [rsp + 0x68]
add rsp, 0x70
ret
mov eax, esi
mov ecx, 0x25
nop
call fcn.00461e80
mov eax, edi
mov ecx, 0x25
call fcn.00461e80
nop
call fcn.0045f820
jmp fcn.004bca40

Function at 0x4bd440
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4bd588
sub rsp, 0x70
mov qword [rsp + 0x68], rbp
lea rbp, [rsp + 0x68]
movabs rdx, 0x9b4fa1ba85664872
mov qword [rsp + 0x18], rdx
movabs rdx, 0xa0f09b4fa1ba8566
mov qword [rsp + 0x1a], rdx
movabs rdx, 0x67713120bb7a6591
mov qword [rsp + 0x22], rdx
movabs rdx, 0xdf20f2b0aaee926e
mov qword [rsp + 0x2a], rdx
movabs rdx, 0x20f8cf79aa02c088
mov qword [rsp + 0x32], rdx
movabs rdx, 0x3140119101c040d
mov qword [rsp + 0x3a], rdx
movabs rdx, 0xf181d1720141808
mov qword [rsp + 0x42], rdx
movabs rdx, 0x181b191b03050f18
mov qword [rsp + 0x48], rdx
movabs rdx, 0x81f100a14101b16
mov qword [rsp + 0x50], rdx
movabs rdx, 0x1d1f080613011503
mov qword [rsp + 0x58], rdx
movabs rdx, 0x2011031a07170c09
mov qword [rsp + 0x60], rdx
xor eax, eax
nop
jmp 0x4bd520
movzx r9d, byte [rsp + rsi + 0x18]
add r9d, 0xffffffa1
add edx, r9d
mov byte [rsp + rdi + 0x18], dl
mov byte [rsp + rsi + 0x18], r8b
add rax, 2
nop dword [rax]
cmp rax, 0x2e
jge 0x4bd551
movzx edx, byte [rsp + rax + 0x3a]
movzx esi, byte [rsp + rax + 0x3b]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x22
jae 0x4bd57b
movzx r8d, byte [rsp + rdi + 0x18]
add r8d, 0xffffffa1
add r8d, edx
cmp rsi, 0x22
jb 0x4bd502
jmp 0x4bd56f
xor eax, eax
lea rbx, [rsp + 0x18]
mov ecx, 0x22
nop dword [rax]
call fcn.0044ba20
mov rbp, qword [rsp + 0x68]
add rsp, 0x70
ret
mov eax, esi
mov ecx, 0x22
call fcn.00461e80
mov eax, edi
mov ecx, 0x22
call fcn.00461e80
nop
call fcn.0045f820
jmp fcn.004bd440
Function at 0x4bdb00
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4bdc46
sub rsp, 0x78
mov qword [rsp + 0x70], rbp
lea rbp, [rsp + 0x70]
movabs rdx, 0x889c4e336c66654f
mov qword [rsp + 0x1f], rdx
movabs rdx, 0x8c536c3556889c4e
mov qword [rsp + 0x24], rdx
movabs rdx, 0x2e7165406e6f437d
mov qword [rsp + 0x2c], rdx
movabs rdx, 0x5d2dc5188c326b4f
mov qword [rsp + 0x34], rdx
movabs rdx, 0xb6653b854e2066a9
mov qword [rsp + 0x3c], rdx
movabs rdx, 0x1419000b241a0414
mov qword [rsp + 0x44], rdx
movabs rdx, 0x24060d22171c1b1d
mov qword [rsp + 0x4c], rdx
movabs rdx, 0xb13151524060d22
mov qword [rsp + 0x50], rdx
movabs rdx, 0x160c21060504181c
mov qword [rsp + 0x58], rdx
movabs rdx, 0x241d1c20211a1b24
mov qword [rsp + 0x60], rdx
movabs rdx, 0x7111b0914150916
mov qword [rsp + 0x68], rdx
xor eax, eax
nop
jmp 0x4bdbe0
movzx r9d, byte [rsp + rsi + 0x1f]
sub r9d, edx
lea edx, [r9 + 0x2e]
mov byte [rsp + rdi + 0x1f], dl
lea edx, [r8 + 0x2e]
mov byte [rsp + rsi + 0x1f], dl
add rax, 2
nop
cmp rax, 0x2c
jge 0x4bdc0d
movzx edx, byte [rsp + rax + 0x44]
movzx esi, byte [rsp + rax + 0x45]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x25
jae 0x4bdc34
movzx r8d, byte [rsp + rdi + 0x1f]
sub r8d, edx
cmp rsi, 0x25
jb 0x4bdbc2
jmp 0x4bdc28
xor eax, eax
lea rbx, [rsp + 0x1f]
mov ecx, 0x25
call fcn.0044ba20
mov rbp, qword [rsp + 0x70]
add rsp, 0x78
ret
mov eax, esi
mov ecx, 0x25
call fcn.00461e80
mov eax, edi
mov ecx, 0x25
nop dword [rax + rax]
call fcn.00461e80
nop
call fcn.0045f820
jmp fcn.004bdb00

Function at 0x4bdc60
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4bdd72
sub rsp, 0x60
mov qword [rsp + 0x58], rbp
lea rbp, [rsp + 0x58]
movabs rdx, 0x2074b9cbc22363e4
mov qword [rsp + 0x1b], rdx
movabs rdx, 0x867e7528bedb65bf
mov qword [rsp + 0x23], rdx
movabs rdx, 0xc7b065a74f867e75
mov qword [rsp + 0x28], rdx
movabs rdx, 0x20821dbc76d4b474
mov qword [rsp + 0x30], rdx
movabs rdx, 0x11130216041a1310
mov qword [rsp + 0x38], rdx
movabs rdx, 0x190019180e170d05
mov qword [rsp + 0x40], rdx
movabs rdx, 0xc00190a03041105
mov qword [rsp + 0x48], rdx
movabs rdx, 0x80b000f1116141b
mov qword [rsp + 0x50], rdx
xor eax, eax
jmp 0x4bdd11
movzx r9d, byte [rsp + rsi + 0x1b]
sub r9d, edx
lea edx, [r9 - 0x3b]
mov byte [rsp + rdi + 0x1b], dl
lea edx, [r8 - 0x3b]
mov byte [rsp + rsi + 0x1b], dl
add rax, 2
cmp rax, 0x20
jge 0x4bdd3e
movzx edx, byte [rsp + rax + 0x38]
movzx esi, byte [rsp + rax + 0x39]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x1d
jae 0x4bdd65
movzx r8d, byte [rsp + rdi + 0x1b]
sub r8d, edx
cmp rsi, 0x1d
jb 0x4bdcf4
jmp 0x4bdd59
xor eax, eax
lea rbx, [rsp + 0x1b]
mov ecx, 0x1d
call fcn.0044ba20
mov rbp, qword [rsp + 0x58]
add rsp, 0x60
ret
mov eax, esi
mov ecx, 0x1d
call fcn.00461e80
mov eax, edi
mov ecx, 0x1d
call fcn.00461e80
nop
call fcn.0045f820
jmp fcn.004bdc60