joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4a4240
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4a431d
push rbp
mov rbp, rsp
sub rsp, 0x40
movabs rdx, 0x4161a61e9b729ab3
mov qword [rsp + 0x30], rdx
movabs rdx, 0xb0510b086ff25065
mov qword [rsp + 0x38], rdx
movabs rdx, 0xc0f070f03010e05
mov qword [rsp + 0x1c], rdx
movabs rdx, 0x50e0a000c0f070f
mov qword [rsp + 0x20], rdx
movabs rdx, 0x40a0e070d01030c
mov qword [rsp + 0x28], rdx
xor eax, eax
nop
jmp 0x4a42c0
movzx r9d, byte [rsp + rsi + 0x30]
sub r9d, edx
lea edx, [r9 + 0x74]
mov byte [rsp + rdi + 0x30], dl
lea edx, [r8 + 0x74]
mov byte [rsp + rsi + 0x30], dl
add rax, 2
nop
cmp rax, 0x14
jge 0x4a42ed
movzx edx, byte [rsp + rax + 0x1c]
movzx esi, byte [rsp + rax + 0x1d]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x10
jae 0x4a4310
movzx r8d, byte [rsp + rdi + 0x30]
sub r8d, edx
cmp rsi, 0x10
jb 0x4a42a2
jmp 0x4a4304
xor eax, eax
lea rbx, [rsp + 0x30]
mov ecx, 0x10
call fcn.004451c0
add rsp, 0x40
pop rbp
ret
mov eax, esi
mov ecx, 0x10
call fcn.00457340
mov eax, edi
mov ecx, 0x10
call fcn.00457340
nop
nop dword [rax]
call fcn.00455060
jmp fcn.004a4240

Function at 0x4a5580
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4a566a
push rbp
mov rbp, rsp
sub rsp, 0x48
movabs rdx, 0xa1656363417f807e
mov qword [rsp + 0x34], rdx
movabs rdx, 0x83979e84a1656363
mov qword [rsp + 0x38], rdx
movabs rdx, 0x709da978986b7f9f
mov qword [rsp + 0x40], rdx
movabs rdx, 0x2020b0c0700080c
mov qword [rsp + 0x1c], rdx
movabs rdx, 0x101109130c0d0a12
mov qword [rsp + 0x24], rdx
movabs rdx, 0x101000b0800100f
mov qword [rsp + 0x2c], rdx
xor eax, eax
jmp 0x4a560d
movzx r9d, byte [rsp + rsi + 0x34]
sub r9d, edx
lea edx, [r9 - 5]
mov byte [rsp + rdi + 0x34], dl
lea edx, [r8 - 5]
mov byte [rsp + rsi + 0x34], dl
add rax, 2
cmp rax, 0x18
jge 0x4a563a
movzx edx, byte [rsp + rax + 0x1c]
movzx esi, byte [rsp + rax + 0x1d]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x14
jae 0x4a565d
movzx r8d, byte [rsp + rdi + 0x34]
sub r8d, edx
cmp rsi, 0x14
jb 0x4a55f0
jmp 0x4a5651
xor eax, eax
lea rbx, [rsp + 0x34]
mov ecx, 0x14
call fcn.004451c0
add rsp, 0x48
pop rbp
ret
mov eax, esi
mov ecx, 0x14
call fcn.00457340
mov eax, edi
mov ecx, 0x14
call fcn.00457340
nop
call fcn.00455060
jmp fcn.004a5580
Function at 0x4a5f80
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4a607b
push rbp
mov rbp, rsp
sub rsp, 0x48
movabs rdx, 0x744e032134274c31
mov qword [rsp + 0x32], rdx
movabs rdx, 0xc6690f51164d744e
mov qword [rsp + 0x38], rdx
movabs rdx, 0xb723f240e75e10a
mov qword [rsp + 0x40], rdx
movabs rdx, 0xb0a13050102050e
mov qword [rsp + 0x18], rdx
movabs rdx, 0xf1511030d0d080a
mov qword [rsp + 0x20], rdx
movabs rdx, 0x4120f1511030d0d
mov qword [rsp + 0x22], rdx
movabs rdx, 0x90d000e150101
mov qword [rsp + 0x2a], rdx
xor eax, eax
jmp 0x4a6019
movzx r9d, byte [rsp + rsi + 0x32]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x1b]
mov byte [rsp + rdi + 0x32], dl
mov byte [rsp + rsi + 0x32], r8b
add rax, 2
cmp rax, 0x1a
jge 0x4a604b
movzx edx, byte [rsp + rax + 0x18]
movzx esi, byte [rsp + rax + 0x19]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x16
jae 0x4a606e
movzx r8d, byte [rsp + rdi + 0x32]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x1b]
cmp rsi, 0x16
jb 0x4a5fff
jmp 0x4a6062
xor eax, eax
lea rbx, [rsp + 0x32]
mov ecx, 0x16
call fcn.004451c0
add rsp, 0x48
pop rbp
ret
mov eax, esi
mov ecx, 0x16
call fcn.00457340
mov eax, edi
mov ecx, 0x16
call fcn.00457340
nop
nop dword [rax + rax]
call fcn.00455060
jmp fcn.004a5f80

Function at 0x4a6600
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4a66e6
push rbp
mov rbp, rsp
sub rsp, 0x38
movabs rdx, 0x4c226c73454c1354
mov qword [rsp + 0x2a], rdx
movabs rdx, 0x5b0d61464e4c4c22
mov qword [rsp + 0x30], rdx
movabs rdx, 0xc020b01070b080d
mov qword [rsp + 0x18], rdx
movabs rdx, 0x6020c020b01070b
mov qword [rsp + 0x1a], rdx
movabs rdx, 0x20d0a030b0d0a06
mov qword [rsp + 0x22], rdx
xor eax, eax
nop
jmp 0x4a6680
movzx r9d, byte [rsp + rsi + 0x2a]
lea edx, [r9 + rdx]
lea edx, [rdx + 5]
mov byte [rsp + rdi + 0x2a], dl
mov byte [rsp + rsi + 0x2a], r8b
add rax, 2
nop dword [rax]
cmp rax, 0x12
jge 0x4a66b2
movzx edx, byte [rsp + rax + 0x18]
movzx esi, byte [rsp + rax + 0x19]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0xe
jae 0x4a66d7
movzx r8d, byte [rsp + rdi + 0x2a]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 5]
cmp rsi, 0xe
jb 0x4a6662
jmp 0x4a66cb
xor eax, eax
lea rbx, [rsp + 0x2a]
mov ecx, 0xe
nop
call fcn.004451c0
add rsp, 0x38
pop rbp
ret
mov eax, esi
mov ecx, 0xe
call fcn.00457340
mov eax, edi
mov ecx, 0xe
nop
call fcn.00457340
nop
call fcn.00455060
jmp fcn.004a6600
Function at 0x4a7e80
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4a7f3d
push rbp
mov rbp, rsp
sub rsp, 0x30
movabs rdx, 0x8b64959fbaaf90e9
mov qword [rsp + 0x27], rdx
mov byte [rsp + 0x2f], 0xd5
movabs rdx, 0x404000102080307
mov qword [rsp + 0x1b], rdx
mov dword [rsp + 0x23], 0x5010207
xor eax, eax
nop
jmp 0x4a7ee0
movzx r9d, byte [rsp + rsi + 0x27]
sub r9d, edx
lea edx, [r9 - 0x34]
mov byte [rsp + rdi + 0x27], dl
lea edx, [r8 - 0x34]
mov byte [rsp + rsi + 0x27], dl
add rax, 2
nop
cmp rax, 0xc
jge 0x4a7f0d
movzx edx, byte [rsp + rax + 0x1b]
movzx esi, byte [rsp + rax + 0x1c]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 9
jae 0x4a7f30
movzx r8d, byte [rsp + rdi + 0x27]
sub r8d, edx
cmp rsi, 9
jb 0x4a7ec2
jmp 0x4a7f24
xor eax, eax
lea rbx, [rsp + 0x27]
mov ecx, 9
call fcn.004451c0
add rsp, 0x30
pop rbp
ret
mov eax, esi
mov ecx, 9
call fcn.00457340
mov eax, edi
mov ecx, 9
call fcn.00457340
nop
nop dword [rax]
call fcn.00455060
jmp fcn.004a7e80

Function at 0x4a89c0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4a8a8c
push rbp
mov rbp, rsp
sub rsp, 0x38
movabs rdx, 0x9ad2a3dca8be6567
mov qword [rsp + 0x2a], rdx
movabs rdx, 0xa4c8c06e82a59ad2
mov qword [rsp + 0x30], rdx
movabs rdx, 0x9030c0602070b09
mov qword [rsp + 0x1a], rdx
movabs rdx, 0x50c060d040d0807
mov qword [rsp + 0x22], rdx
xor eax, eax
jmp 0x4a8a2f
movzx r9d, byte [rsp + rsi + 0x2a]
sub r9d, edx
lea edx, [r9 - 0x1f]
mov byte [rsp + rdi + 0x2a], dl
lea edx, [r8 - 0x1f]
mov byte [rsp + rsi + 0x2a], dl
add rax, 2
cmp rax, 0x10
jge 0x4a8a5c
movzx edx, byte [rsp + rax + 0x1a]
movzx esi, byte [rsp + rax + 0x1b]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0xe
jae 0x4a8a7f
movzx r8d, byte [rsp + rdi + 0x2a]
sub r8d, edx
cmp rsi, 0xe
jb 0x4a8a12
jmp 0x4a8a73
xor eax, eax
lea rbx, [rsp + 0x2a]
mov ecx, 0xe
call fcn.004451c0
add rsp, 0x38
pop rbp
ret
mov eax, esi
mov ecx, 0xe
call fcn.00457340
mov eax, edi
mov ecx, 0xe
call fcn.00457340
nop
call fcn.00455060
jmp fcn.004a89c0

Function at 0x4a9da0
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4a9e6a
push rbp
mov rbp, rsp
sub rsp, 0x48
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rbx
mov qword [rsp], rax
mov qword [rsp + 8], rbx
mov byte [rsp + 0x10], 0
call fcn.00403860
xorps xmm15, xmm15
mov r14, qword [0x006c50d8]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x18], 0xffffffffffffffff
jne 0x4a9e4f
mov rcx, qword [rsp + 0x60]
lea rdx, [rcx + 1]
mov qword [rsp + 0x40], rdx
lea rax, [0x0055f1c0]
xor ebx, ebx
mov rcx, rdx
call fcn.00441ce0
mov rbx, qword [rsp + 0x60]
mov rcx, rax
xor edi, edi
mov rsi, qword [rsp + 0x40]
mov rax, qword [rsp + 0x58]
nop dword [rax]
call fcn.004aa3a0
inc rbx
cmp rcx, rbx
jae 0x4a9e3e
mov edi, 1
lea rsi, [0x0055f1c0]
call fcn.00441dc0
mov word [rax + rbx*2 - 2], 0
xor edi, edi
xor esi, esi
add rsp, 0x48
pop rbp
ret
xor eax, eax
xor ebx, ebx
mov rcx, rbx
lea rdi, [0x005a7d18]
lea rsi, [0x005a7828]
add rsp, 0x48
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.00455060
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.004a9da0
Function at 0x4ad460
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4ad51e
push rbp
mov rbp, rsp
sub rsp, 0x30
movabs rdx, 0x323a697061dd64d8
mov qword [rsp + 0x24], rdx
mov dword [rsp + 0x2c], 0x373be745
movabs rdx, 0xb00060006090208
mov qword [rsp + 0x18], rdx
mov dword [rsp + 0x20], 0xa0a0806
xor eax, eax
jmp 0x4ad4c1
movzx r9d, byte [rsp + rsi + 0x24]
sub r9d, edx
lea edx, [r9 + 0x3b]
mov byte [rsp + rdi + 0x24], dl
lea edx, [r8 + 0x3b]
mov byte [rsp + rsi + 0x24], dl
add rax, 2
cmp rax, 0xc
jge 0x4ad4ee
movzx edx, byte [rsp + rax + 0x18]
movzx esi, byte [rsp + rax + 0x19]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0xc
jae 0x4ad511
movzx r8d, byte [rsp + rdi + 0x24]
sub r8d, edx
cmp rsi, 0xc
jb 0x4ad4a4
jmp 0x4ad505
xor eax, eax
lea rbx, [rsp + 0x24]
mov ecx, 0xc
call fcn.004451c0
add rsp, 0x30
pop rbp
ret
mov eax, esi
mov ecx, 0xc
call fcn.00457340
mov eax, edi
mov ecx, 0xc
call fcn.00457340
nop
nop
call fcn.00455060
jmp fcn.004ad460

Function at 0x4ae2e0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4ae3ca
push rbp
mov rbp, rsp
sub rsp, 0x48
movabs rdx, 0x4d1ee82839672c52
mov qword [rsp + 0x37], rdx
movabs rdx, 0x4a4d1ee82839672c
mov qword [rsp + 0x38], rdx
movabs rdx, 0x576745ad06e03af6
mov qword [rsp + 0x40], rdx
movabs rdx, 0xe0b0a0d060c0609
mov qword [rsp + 0x1f], rdx
movabs rdx, 0x603010306050a01
mov qword [rsp + 0x27], rdx
movabs rdx, 0x3080c060c04080e
mov qword [rsp + 0x2f], rdx
xor eax, eax
jmp 0x4ae36d
movzx r9d, byte [rsp + rsi + 0x37]
sub r9d, edx
lea edx, [r9 + 0x3a]
mov byte [rsp + rdi + 0x37], dl
lea edx, [r8 + 0x3a]
mov byte [rsp + rsi + 0x37], dl
add rax, 2
cmp rax, 0x18
jge 0x4ae39a
movzx edx, byte [rsp + rax + 0x1f]
movzx esi, byte [rsp + rax + 0x20]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x11
jae 0x4ae3bd
movzx r8d, byte [rsp + rdi + 0x37]
sub r8d, edx
cmp rsi, 0x11
jb 0x4ae350
jmp 0x4ae3b1
xor eax, eax
lea rbx, [rsp + 0x37]
mov ecx, 0x11
call fcn.004451c0
add rsp, 0x48
pop rbp
ret
mov eax, esi
mov ecx, 0x11
call fcn.00457340
mov eax, edi
mov ecx, 0x11
call fcn.00457340
nop
call fcn.00455060
jmp fcn.004ae2e0

Function at 0x4aeca0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4aed58
push rbp
mov rbp, rsp
sub rsp, 0x30
movabs rdx, 0x796f64e35adf5e54
mov qword [rsp + 0x28], rdx
movabs rdx, 0x401030402060404
mov qword [rsp + 0x1c], rdx
mov dword [rsp + 0x24], 0x3040202
xor eax, eax
jmp 0x4aecf6
movzx r9d, byte [rsp + rsi + 0x28]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x7c]
mov byte [rsp + rdi + 0x28], dl
mov byte [rsp + rsi + 0x28], r8b
add rax, 2
cmp rax, 0xc
jge 0x4aed28
movzx edx, byte [rsp + rax + 0x1c]
movzx esi, byte [rsp + rax + 0x1d]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 8
jae 0x4aed4b
movzx r8d, byte [rsp + rdi + 0x28]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x7c]
cmp rsi, 8
jb 0x4aecdc
jmp 0x4aed3f
xor eax, eax
lea rbx, [rsp + 0x28]
mov ecx, 8
call fcn.004451c0
add rsp, 0x30
pop rbp
ret
mov eax, esi
mov ecx, 8
call fcn.00457340
mov eax, edi
mov ecx, 8
call fcn.00457340
nop
call fcn.00455060
nop dword [rax]
jmp fcn.004aeca0
Function at 0x4b0740
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4b082a
push rbp
mov rbp, rsp
sub rsp, 0x40
movabs rdx, 0xe8fa6874ecd16745
mov qword [rsp + 0x2d], rdx
movabs rdx, 0x16ea7e8fa6874ec
mov qword [rsp + 0x30], rdx
movabs rdx, 0x65e0f9712004e2e3
mov qword [rsp + 0x38], rdx
movabs rdx, 0x1106070302050f02
mov qword [rsp + 0x19], rdx
movabs rdx, 0x5080c0a11060703
mov qword [rsp + 0x1d], rdx
movabs rdx, 0xb0b10080c08020d
mov qword [rsp + 0x25], rdx
xor eax, eax
jmp 0x4b07cd
movzx r9d, byte [rsp + rsi + 0x2d]
sub r9d, edx
lea edx, [r9 - 0x70]
mov byte [rsp + rdi + 0x2d], dl
lea edx, [r8 - 0x70]
mov byte [rsp + rsi + 0x2d], dl
add rax, 2
cmp rax, 0x14
jge 0x4b07fa
movzx edx, byte [rsp + rax + 0x19]
movzx esi, byte [rsp + rax + 0x1a]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x13
jae 0x4b081d
movzx r8d, byte [rsp + rdi + 0x2d]
sub r8d, edx
cmp rsi, 0x13
jb 0x4b07b0
jmp 0x4b0811
xor eax, eax
lea rbx, [rsp + 0x2d]
mov ecx, 0x13
call fcn.004451c0
add rsp, 0x40
pop rbp
ret
mov eax, esi
mov ecx, 0x13
call fcn.00457340
mov eax, edi
mov ecx, 0x13
call fcn.00457340
nop
call fcn.00455060
jmp fcn.004b0740

Function at 0x4b0b20
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4b0c28
push rbp
mov rbp, rsp
sub rsp, 0x58
movabs rdx, 0xca416ceb9375eee9
mov qword [rsp + 0x3e], rdx
movabs rdx, 0x7aeeec60615c69c9
mov qword [rsp + 0x46], rdx
movabs rdx, 0x644d7aeeec60615c
mov qword [rsp + 0x48], rdx
movabs rdx, 0x9f6ddfe732f95561
mov qword [rsp + 0x50], rdx
movabs rdx, 0x1503170c0f0f0816
mov qword [rsp + 0x1e], rdx
movabs rdx, 0x30a05190f07100f
mov qword [rsp + 0x26], rdx
movabs rdx, 0xe0300100a100c10
mov qword [rsp + 0x2e], rdx
movabs rdx, 0x14010d1919131704
mov qword [rsp + 0x36], rdx
xor eax, eax
jmp 0x4b0bcb
movzx r9d, byte [rsp + rsi + 0x3e]
sub r9d, edx
lea edx, [r9 - 0x57]
mov byte [rsp + rdi + 0x3e], dl
lea edx, [r8 - 0x57]
mov byte [rsp + rsi + 0x3e], dl
add rax, 2
cmp rax, 0x20
jge 0x4b0bf8
movzx edx, byte [rsp + rax + 0x1e]
movzx esi, byte [rsp + rax + 0x1f]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x1a
jae 0x4b0c1b
movzx r8d, byte [rsp + rdi + 0x3e]
sub r8d, edx
cmp rsi, 0x1a
jb 0x4b0bae
jmp 0x4b0c0f
xor eax, eax
lea rbx, [rsp + 0x3e]
mov ecx, 0x1a
call fcn.004451c0
add rsp, 0x58
pop rbp
ret
mov eax, esi
mov ecx, 0x1a
call fcn.00457340
mov eax, edi
mov ecx, 0x1a
call fcn.00457340
nop
call fcn.00455060
jmp fcn.004b0b20
Function at 0x4b44a0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4b45bd
push rbp
mov rbp, rsp
sub rsp, 0x60
movabs rdx, 0x46e62c7f13e61c9
mov qword [rsp + 0x42], rdx
movabs rdx, 0x649a212a6e269f53
mov qword [rsp + 0x4a], rdx
movabs rdx, 0xdc6546e9d520649a
mov qword [rsp + 0x50], rdx
movabs rdx, 0xfb6f08ef78df4dfb
mov qword [rsp + 0x58], rdx
movabs rdx, 0x1a0c0e110d051103
mov qword [rsp + 0x1c], rdx
movabs rdx, 0x15160d0311181a0c
mov qword [rsp + 0x22], rdx
movabs rdx, 0xc181b120c09040a
mov qword [rsp + 0x2a], rdx
movabs rdx, 0x71d000303001118
mov qword [rsp + 0x32], rdx
movabs rdx, 0x1b00150a12020c13
mov qword [rsp + 0x3a], rdx
xor eax, eax
jmp 0x4b4560
movzx r9d, byte [rsp + rsi + 0x42]
sub r9d, edx
lea edx, [r9 + 0x5b]
mov byte [rsp + rdi + 0x42], dl
lea edx, [r8 + 0x5b]
mov byte [rsp + rsi + 0x42], dl
add rax, 2
nop word [rax + rax]
cmp rax, 0x26
jge 0x4b458d
movzx edx, byte [rsp + rax + 0x1c]
movzx esi, byte [rsp + rax + 0x1d]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x1e
jae 0x4b45b0
movzx r8d, byte [rsp + rdi + 0x42]
sub r8d, edx
cmp rsi, 0x1e
jb 0x4b453d
jmp 0x4b45a4
xor eax, eax
lea rbx, [rsp + 0x42]
mov ecx, 0x1e
call fcn.004451c0
add rsp, 0x60
pop rbp
ret
mov eax, esi
mov ecx, 0x1e
call fcn.00457340
mov eax, edi
mov ecx, 0x1e
call fcn.00457340
nop
nop dword [rax]
call fcn.00455060
jmp fcn.004b44a0

Function at 0x4ba080
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4ba178
push rbp
mov rbp, rsp
sub rsp, 0x50
movabs rdx, 0x37613b7343204587
mov qword [rsp + 0x3b], rdx
movabs rdx, 0x645261745337613b
mov qword [rsp + 0x40], rdx
movabs rdx, 0x65dc692fd23acc1e
mov qword [rsp + 0x48], rdx
movabs rdx, 0xd110e0007070503
mov qword [rsp + 0x1f], rdx
movabs rdx, 0xb0f0e0f000f0710
mov qword [rsp + 0x27], rdx
movabs rdx, 0x10130d050b0f0e0f
mov qword [rsp + 0x2b], rdx
movabs rdx, 0x110e10070e110b11
mov qword [rsp + 0x33], rdx
xor eax, eax
jmp 0x4ba115
movzx r9d, byte [rsp + rsi + 0x3b]
add edx, r9d
mov byte [rsp + rdi + 0x3b], dl
mov byte [rsp + rsi + 0x3b], r8b
add rax, 2
cmp rax, 0x1c
jge 0x4ba148
movzx edx, byte [rsp + rax + 0x1f]
movzx esi, byte [rsp + rax + 0x20]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x15
jae 0x4ba16b
movzx r8d, byte [rsp + rdi + 0x3b]
add r8d, edx
nop word [rax + rax]
cmp rsi, 0x15
jb 0x4ba0ff
jmp 0x4ba15f
xor eax, eax
lea rbx, [rsp + 0x3b]
mov ecx, 0x15
call fcn.004451c0
add rsp, 0x50
pop rbp
ret
mov eax, esi
mov ecx, 0x15
call fcn.00457340
mov eax, edi
mov ecx, 0x15
call fcn.00457340
nop
call fcn.00455060
nop dword [rax]
jmp fcn.004ba080
Function at 0x4ba1a0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4ba28a
push rbp
mov rbp, rsp
sub rsp, 0x48
movabs rdx, 0x7b74738a2f546c77
mov qword [rsp + 0x35], rdx
movabs rdx, 0x8381617b74738a2f
mov qword [rsp + 0x38], rdx
movabs rdx, 0x65977a5d56641e7c
mov qword [rsp + 0x40], rdx
movabs rdx, 0x11040c0f04041005
mov qword [rsp + 0x1d], rdx
movabs rdx, 0xc0b0f0e09070602
mov qword [rsp + 0x25], rdx
movabs rdx, 0xb0305020a0411
mov qword [rsp + 0x2d], rdx
xor eax, eax
jmp 0x4ba22d
movzx r9d, byte [rsp + rsi + 0x35]
sub r9d, edx
lea edx, [r9 + 0xb]
mov byte [rsp + rdi + 0x35], dl
lea edx, [r8 + 0xb]
mov byte [rsp + rsi + 0x35], dl
add rax, 2
cmp rax, 0x18
jge 0x4ba25a
movzx edx, byte [rsp + rax + 0x1d]
movzx esi, byte [rsp + rax + 0x1e]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x13
jae 0x4ba27d
movzx r8d, byte [rsp + rdi + 0x35]
sub r8d, edx
cmp rsi, 0x13
jb 0x4ba210
jmp 0x4ba271
xor eax, eax
lea rbx, [rsp + 0x35]
mov ecx, 0x13
call fcn.004451c0
add rsp, 0x48
pop rbp
ret
mov eax, esi
mov ecx, 0x13
call fcn.00457340
mov eax, edi
mov ecx, 0x13
call fcn.00457340
nop
call fcn.00455060
jmp fcn.004ba1a0

Function at 0x4bad60
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4bae4a
push rbp
mov rbp, rsp
sub rsp, 0x40
movabs rdx, 0xdb508361dea99d53
mov qword [rsp + 0x2d], rdx
movabs rdx, 0x19494db508361de
mov qword [rsp + 0x30], rdx
movabs rdx, 0xab92ad5420913461
mov qword [rsp + 0x38], rdx
movabs rdx, 0xc07111101100309
mov qword [rsp + 0x19], rdx
movabs rdx, 0xd080c020c071111
mov qword [rsp + 0x1d], rdx
movabs rdx, 0x120912070a120506
mov qword [rsp + 0x25], rdx
xor eax, eax
jmp 0x4baded
movzx r9d, byte [rsp + rsi + 0x2d]
sub r9d, edx
lea edx, [r9 - 0x21]
mov byte [rsp + rdi + 0x2d], dl
lea edx, [r8 - 0x21]
mov byte [rsp + rsi + 0x2d], dl
add rax, 2
cmp rax, 0x14
jge 0x4bae1a
movzx edx, byte [rsp + rax + 0x19]
movzx esi, byte [rsp + rax + 0x1a]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x13
jae 0x4bae3d
movzx r8d, byte [rsp + rdi + 0x2d]
sub r8d, edx
cmp rsi, 0x13
jb 0x4badd0
jmp 0x4bae31
xor eax, eax
lea rbx, [rsp + 0x2d]
mov ecx, 0x13
call fcn.004451c0
add rsp, 0x40
pop rbp
ret
mov eax, esi
mov ecx, 0x13
call fcn.00457340
mov eax, edi
mov ecx, 0x13
call fcn.00457340
nop
call fcn.00455060
jmp fcn.004bad60
Function at 0x4bb140
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4bb23d
push rbp
mov rbp, rsp
sub rsp, 0x50
movabs rdx, 0x83536d447b726592
mov qword [rsp + 0x39], rdx
movabs rdx, 0x64558e3b2d826283
mov qword [rsp + 0x40], rdx
movabs rdx, 0x728a8e9a6b6c1985
mov qword [rsp + 0x48], rdx
movabs rdx, 0x160506080d001100
mov qword [rsp + 0x19], rdx
movabs rdx, 0xa08021115091210
mov qword [rsp + 0x21], rdx
movabs rdx, 0x1402070b05040f05
mov qword [rsp + 0x29], rdx
movabs rdx, 0x809030c07040913
mov qword [rsp + 0x31], rdx
xor eax, eax
jmp 0x4bb1e0
movzx r9d, byte [rsp + rsi + 0x39]
sub r9d, edx
lea edx, [r9 + 0x11]
mov byte [rsp + rdi + 0x39], dl
lea edx, [r8 + 0x11]
mov byte [rsp + rsi + 0x39], dl
add rax, 2
nop dword [rax]
cmp rax, 0x20
jge 0x4bb20d
movzx edx, byte [rsp + rax + 0x19]
movzx esi, byte [rsp + rax + 0x1a]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x17
jae 0x4bb230
movzx r8d, byte [rsp + rdi + 0x39]
sub r8d, edx
cmp rsi, 0x17
jb 0x4bb1bf
jmp 0x4bb224
xor eax, eax
lea rbx, [rsp + 0x39]
mov ecx, 0x17
call fcn.004451c0
add rsp, 0x50
pop rbp
ret
mov eax, esi
mov ecx, 0x17
call fcn.00457340
mov eax, edi
mov ecx, 0x17
call fcn.00457340
nop
nop dword [rax]
call fcn.00455060
jmp fcn.004bb140

Function at 0x4bcfa0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4bd09d
push rbp
mov rbp, rsp
sub rsp, 0x48
movabs rdx, 0x594757644554614d
mov qword [rsp + 0x33], rdx
movabs rdx, 0x4a60615a63594757
mov qword [rsp + 0x38], rdx
movabs rdx, 0x654e436e2169225f
mov qword [rsp + 0x40], rdx
movabs rdx, 0xd06100e0c02130f
mov qword [rsp + 0x19], rdx
movabs rdx, 0x50d11120b090305
mov qword [rsp + 0x21], rdx
movabs rdx, 0x912050d11120b09
mov qword [rsp + 0x23], rdx
movabs rdx, 0x80f0e0703070205
mov qword [rsp + 0x2b], rdx
xor eax, eax
jmp 0x4bd040
movzx r9d, byte [rsp + rsi + 0x33]
sub r9d, edx
lea edx, [r9 + 0x20]
mov byte [rsp + rdi + 0x33], dl
lea edx, [r8 + 0x20]
mov byte [rsp + rsi + 0x33], dl
add rax, 2
nop dword [rax]
cmp rax, 0x1a
jge 0x4bd06d
movzx edx, byte [rsp + rax + 0x19]
movzx esi, byte [rsp + rax + 0x1a]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x15
jae 0x4bd090
movzx r8d, byte [rsp + rdi + 0x33]
sub r8d, edx
cmp rsi, 0x15
jb 0x4bd01f
jmp 0x4bd084
xor eax, eax
lea rbx, [rsp + 0x33]
mov ecx, 0x15
call fcn.004451c0
add rsp, 0x48
pop rbp
ret
mov eax, esi
mov ecx, 0x15
call fcn.00457340
mov eax, edi
mov ecx, 0x15
call fcn.00457340
nop
nop dword [rax]
call fcn.00455060
jmp fcn.004bcfa0
Function at 0x4bef40
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4bf03d
push rbp
mov rbp, rsp
sub rsp, 0x50
movabs rdx, 0x726fc161676e6953
mov qword [rsp + 0x39], rdx
movabs rdx, 0x56b861bcbaa96872
mov qword [rsp + 0x40], rdx
movabs rdx, 0x65bdaf40cb64198a
mov qword [rsp + 0x48], rdx
movabs rdx, 0x130914141413090b
mov qword [rsp + 0x1d], rdx
movabs rdx, 0x8090a0b0b10100e
mov qword [rsp + 0x25], rdx
movabs rdx, 0x1014130e08090a0b
mov qword [rsp + 0x29], rdx
movabs rdx, 0x14150e0d0805120f
mov qword [rsp + 0x31], rdx
xor eax, eax
jmp 0x4befe0
movzx r9d, byte [rsp + rsi + 0x39]
sub r9d, edx
lea edx, [r9 - 0x39]
mov byte [rsp + rdi + 0x39], dl
lea edx, [r8 - 0x39]
mov byte [rsp + rsi + 0x39], dl
add rax, 2
nop dword [rax]
cmp rax, 0x1c
jge 0x4bf00d
movzx edx, byte [rsp + rax + 0x1d]
movzx esi, byte [rsp + rax + 0x1e]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x17
jae 0x4bf030
movzx r8d, byte [rsp + rdi + 0x39]
sub r8d, edx
cmp rsi, 0x17
jb 0x4befbf
jmp 0x4bf024
xor eax, eax
lea rbx, [rsp + 0x39]
mov ecx, 0x17
call fcn.004451c0
add rsp, 0x50
pop rbp
ret
mov eax, esi
mov ecx, 0x17
call fcn.00457340
mov eax, edi
mov ecx, 0x17
call fcn.00457340
nop
nop dword [rax]
call fcn.00455060
jmp fcn.004bef40

Function at 0x4bfae0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4bfbca
push rbp
mov rbp, rsp
sub rsp, 0x48
movabs rdx, 0x619a0120ab08c5a7
mov qword [rsp + 0x36], rdx
movabs rdx, 0xa619619a0120ab08
mov qword [rsp + 0x38], rdx
movabs rdx, 0x226d09eb40647608
mov qword [rsp + 0x40], rdx
movabs rdx, 0x9050f030b000d09
mov qword [rsp + 0x1e], rdx
movabs rdx, 0x10d0e0e00000f06
mov qword [rsp + 0x26], rdx
movabs rdx, 0xf05020a0b0b0811
mov qword [rsp + 0x2e], rdx
xor eax, eax
jmp 0x4bfb6d
movzx r9d, byte [rsp + rsi + 0x36]
sub r9d, edx
lea edx, [r9 + 0x75]
mov byte [rsp + rdi + 0x36], dl
lea edx, [r8 + 0x75]
mov byte [rsp + rsi + 0x36], dl
add rax, 2
cmp rax, 0x18
jge 0x4bfb9a
movzx edx, byte [rsp + rax + 0x1e]
movzx esi, byte [rsp + rax + 0x1f]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x12
jae 0x4bfbbd
movzx r8d, byte [rsp + rdi + 0x36]
sub r8d, edx
cmp rsi, 0x12
jb 0x4bfb50
jmp 0x4bfbb1
xor eax, eax
lea rbx, [rsp + 0x36]
mov ecx, 0x12
call fcn.004451c0
add rsp, 0x48
pop rbp
ret
mov eax, esi
mov ecx, 0x12
call fcn.00457340
mov eax, edi
mov ecx, 0x12
call fcn.00457340
nop
call fcn.00455060
jmp fcn.004bfae0