joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4a28e0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4a29a8
sub rsp, 0x38
mov qword [rsp + 0x30], rbp
lea rbp, [rsp + 0x30]
movabs rdx, 0xa37471846c66657b
mov qword [rsp + 0x1d], rdx
mov byte [rsp + 0x25], 0x69
movabs rdx, 0x808070404080504
mov qword [rsp + 0x26], rdx
mov word [rsp + 0x2e], 0x400
xor eax, eax
jmp 0x4a2940
movzx r9d, byte [rsp + rsi + 0x1d]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x22]
mov byte [rsp + rdi + 0x1d], dl
mov byte [rsp + rsi + 0x1d], r8b
add rax, 2
cmp rax, 0xa
jge 0x4a2972
movzx edx, byte [rsp + rax + 0x26]
movzx esi, byte [rsp + rax + 0x27]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 9
jae 0x4a299b
movzx r8d, byte [rsp + rdi + 0x1d]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x22]
cmp rsi, 9
jb 0x4a2926
jmp 0x4a298f
xor eax, eax
lea rbx, [rsp + 0x1d]
mov ecx, 9
nop
call fcn.0044a140
mov rbp, qword [rsp + 0x30]
add rsp, 0x38
ret
mov eax, esi
mov ecx, 9
call fcn.0045f500
mov eax, edi
mov ecx, 9
call fcn.0045f500
nop
call fcn.0045cea0
jmp fcn.004a28e0

Function at 0x4a3000
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4a30c8
sub rsp, 0x38
mov qword [rsp + 0x30], rbp
lea rbp, [rsp + 0x30]
movabs rdx, 0x306e63636c622672
mov qword [rsp + 0x1d], rdx
mov byte [rsp + 0x25], 0x6d
movabs rdx, 0x607060702040806
mov qword [rsp + 0x26], rdx
mov word [rsp + 0x2e], 0x801
xor eax, eax
jmp 0x4a3063
movzx r9d, byte [rsp + rsi + 0x1d]
sub r9d, edx
lea edx, [r9 + 0xb]
mov byte [rsp + rdi + 0x1d], dl
lea edx, [r8 + 0xb]
mov byte [rsp + rsi + 0x1d], dl
add rax, 2
cmp rax, 0xa
jge 0x4a3090
movzx edx, byte [rsp + rax + 0x26]
movzx esi, byte [rsp + rax + 0x27]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 9
jae 0x4a30bb
movzx r8d, byte [rsp + rdi + 0x1d]
sub r8d, edx
cmp rsi, 9
jb 0x4a3046
jmp 0x4a30af
xor eax, eax
lea rbx, [rsp + 0x1d]
mov ecx, 9
nop dword [rax]
call fcn.0044a140
mov rbp, qword [rsp + 0x30]
add rsp, 0x38
ret
mov eax, esi
mov ecx, 9
call fcn.0045f500
mov eax, edi
mov ecx, 9
call fcn.0045f500
nop
call fcn.0045cea0
jmp fcn.004a3000
Function at 0x4a31e0
Capabilities:
Authenticate hmac

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4a34b2
sub rsp, 0x70
mov qword [rsp + 0x68], rbp
lea rbp, [rsp + 0x68]
mov qword [rsp + 0x59], 0
mov qword [rsp + 0x60], 0
mov eax, 4
mov ecx, 0x36
xor edx, edx
mov ebx, 0xf
lea rsi, [rsp + 0x59]
xor edi, edi
jmp 0x4a3232
inc rdx
mov rax, rcx
mov rcx, qword [rsp + 0x40]
mov rdi, r8
cmp rax, 2
je 0x4a3472
mov qword [rsp + 0x48], rdi
mov qword [rsp + 0x50], rdx
mov r8, rax
imul rax, rdx
xor rax, rcx
mov qword [rsp + 0x40], rax
cmp r8, 3
jg 0x4a3320
nop
test r8, r8
jne 0x4a32ab
lea r8, [rdi + 1]
cmp rbx, r8
jae 0x4a329b
mov rax, rsi
mov rcx, rbx
mov edi, 1
lea rsi, [0x005c0580]
mov rbx, r8
call fcn.00446000
mov rdx, qword [rsp + 0x50]
mov r8, rbx
mov rsi, rax
mov rbx, rcx
mov rax, qword [rsp + 0x40]
mov byte [r8 + rsi - 1], 7
mov ecx, 3
jmp 0x4a3224
cmp r8, 1
jne 0x4a32c0
xor ecx, ecx
jmp 0x4a34a0
cmp r8, 3
jne 0x4a3467
lea r8, [rdi + 4]
cmp rbx, r8
jae 0x4a3305
mov rax, rsi
mov rcx, rbx
mov edi, 4
lea rsi, [0x005c0580]
mov rbx, r8
call fcn.00446000
mov rdx, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x48]
mov rsi, rax
mov r8, rbx
mov rbx, rcx
mov rax, qword [rsp + 0x40]
mov dword [rsi + rdi], 0x50484670
mov ecx, 5
jmp 0x4a3224
cmp r8, 5
jg 0x4a33c5
cmp r8, 4
jne 0x4a3376
lea r8, [rdi + 1]
cmp rbx, r8
jae 0x4a3366
mov rax, rsi
mov rcx, rbx
mov edi, 1
lea rsi, [0x005c0580]
mov rbx, r8
call fcn.00446000
mov rdx, qword [rsp + 0x50]
mov r8, rbx
mov rsi, rax
mov rbx, rcx
mov rax, qword [rsp + 0x40]
mov byte [r8 + rsi - 1], 0x5c
mov ecx, 7
jmp 0x4a3224
lea r8, [rdi + 2]
cmp rbx, r8
jae 0x4a33b1
mov rax, rsi
mov rcx, rbx
mov edi, 2
lea rsi, [0x005c0580]
mov rbx, r8
call fcn.00446000
mov rdx, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x48]
mov rsi, rax
mov r8, rbx
mov rbx, rcx
mov rax, qword [rsp + 0x40]
mov word [rsi + rdi], 0xd47
mov ecx, 1
nop dword [rax]
jmp 0x4a3224
cmp r8, 6
jne 0x4a3414
lea r8, [rdi + 4]
cmp rbx, r8
jae 0x4a3406
mov rax, rsi
mov rcx, rbx
mov edi, 4
lea rsi, [0x005c0580]
mov rbx, r8
call fcn.00446000
mov rdx, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x48]
mov rsi, rax
mov r8, rbx
mov rax, qword [rsp + 0x40]
mov rbx, rcx
mov dword [rsi + rdi], 0x5c484f41
xor ecx, ecx
jmp 0x4a3224
cmp r8, 7
jne 0x4a3467
lea r8, [rdi + 2]
nop
cmp rbx, r8
jae 0x4a3457
mov rax, rsi
mov rcx, rbx
mov edi, 2
lea rsi, [0x005c0580]
mov rbx, r8
call fcn.00446000
mov rdx, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x48]
mov rsi, rax
mov r8, rbx
mov rbx, rcx
mov rax, qword [rsp + 0x40]
mov word [rsi + rdi], 0x4a4a
mov ecx, 6
jmp 0x4a3224
mov rcx, r8
mov r8, rdi
jmp 0x4a3224
xor eax, eax
mov rbx, rsi
mov rcx, rdi
call fcn.0044a140
mov rbp, qword [rsp + 0x68]
add rsp, 0x70
ret
movzx r8d, byte [rsi + rcx]
mov r9, rcx
xor rcx, rax
xor r8d, ecx
mov byte [rsi + r9], r8b
lea rcx, [r9 + 1]
nop
cmp rdi, rcx
jg 0x4a3489
mov ecx, 2
mov r8, rdi
jmp 0x4a3224
call fcn.0045cea0
jmp fcn.004a31e0
Function at 0x4a3be0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4a3d32
add rsp, 0xffffffffffffff80
mov qword [rsp + 0x78], rbp
lea rbp, [rsp + 0x78]
movabs rdx, 0x6ab07b65a033cbc0
mov qword [rsp + 0x1e], rdx
movabs rdx, 0xb4ab4c016e22fc20
mov qword [rsp + 0x26], rdx
movabs rdx, 0x207419b1b4ab4c01
mov qword [rsp + 0x2a], rdx
movabs rdx, 0x74a1dbf068a2a4f4
mov qword [rsp + 0x32], rdx
movabs rdx, 0xe1e765a41566e6a2
mov qword [rsp + 0x3a], rdx
movabs rdx, 0x847265badb656acc
mov qword [rsp + 0x42], rdx
movabs rdx, 0x915241a2b072002
mov qword [rsp + 0x4a], rdx
movabs rdx, 0x18142415180a0a25
mov qword [rsp + 0x52], rdx
movabs rdx, 0x1f0c161628011814
mov qword [rsp + 0x58], rdx
movabs rdx, 0x2500101427190e03
mov qword [rsp + 0x60], rdx
movabs rdx, 0xc11051806060f0a
mov qword [rsp + 0x68], rdx
movabs rdx, 0xc1f201d221c2315
mov qword [rsp + 0x70], rdx
xor eax, eax
jmp 0x4a3ccd
movzx r9d, byte [rsp + rsi + 0x1e]
sub r9d, edx
lea edx, [r9 - 0x1c]
mov byte [rsp + rdi + 0x1e], dl
lea edx, [r8 - 0x1c]
mov byte [rsp + rsi + 0x1e], dl
add rax, 2
cmp rax, 0x2e
jge 0x4a3cfa
movzx edx, byte [rsp + rax + 0x4a]
movzx esi, byte [rsp + rax + 0x4b]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x2c
jae 0x4a3d25
movzx r8d, byte [rsp + rdi + 0x1e]
sub r8d, edx
cmp rsi, 0x2c
jb 0x4a3cb0
jmp 0x4a3d15
xor eax, eax
lea rbx, [rsp + 0x1e]
mov ecx, 0x2c
call fcn.0044a140
mov rbp, qword [rsp + 0x78]
sub rsp, 0xffffffffffffff80
ret
mov eax, esi
mov ecx, 0x2c
nop dword [rax]
call fcn.0045f500
mov eax, edi
mov ecx, 0x2c
call fcn.0045f500
nop
call fcn.0045cea0
jmp fcn.004a3be0
Function at 0x4a71c0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4a7312
add rsp, 0xffffffffffffff80
mov qword [rsp + 0x78], rbp
lea rbp, [rsp + 0x78]
movabs rdx, 0xea7463cdf0086503
mov qword [rsp + 0x1b], rdx
movabs rdx, 0x616e7249746e6995
mov qword [rsp + 0x23], rdx
movabs rdx, 0x72de2d2036616e72
mov qword [rsp + 0x28], rdx
movabs rdx, 0x61d16e69202472b9
mov qword [rsp + 0x30], rdx
movabs rdx, 0xe604ae6d2e3d0fa2
mov qword [rsp + 0x38], rdx
movabs rdx, 0x13651ebb691e6389
mov qword [rsp + 0x40], rdx
movabs rdx, 0xc0c001f040c2a15
mov qword [rsp + 0x48], rdx
movabs rdx, 0x2713251008130c1f
mov qword [rsp + 0x50], rdx
movabs rdx, 0x1e2308221029031f
mov qword [rsp + 0x58], rdx
movabs rdx, 0x251025262c1b121f
mov qword [rsp + 0x60], rdx
movabs rdx, 0x26082420022a252c
mov qword [rsp + 0x68], rdx
movabs rdx, 0x1707171d10292c29
mov qword [rsp + 0x70], rdx
xor eax, eax
jmp 0x4a72aa
movzx r9d, byte [rsp + rsi + 0x1b]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x12]
mov byte [rsp + rdi + 0x1b], dl
mov byte [rsp + rsi + 0x1b], r8b
add rax, 2
cmp rax, 0x30
jge 0x4a72dc
movzx edx, byte [rsp + rax + 0x48]
movzx esi, byte [rsp + rax + 0x49]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x2d
jae 0x4a7305
movzx r8d, byte [rsp + rdi + 0x1b]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x12]
cmp rsi, 0x2d
jb 0x4a7290
jmp 0x4a72f7
xor eax, eax
lea rbx, [rsp + 0x1b]
mov ecx, 0x2d
call fcn.0044a140
mov rbp, qword [rsp + 0x78]
sub rsp, 0xffffffffffffff80
ret
mov eax, esi
mov ecx, 0x2d
nop
call fcn.0045f500
mov eax, edi
mov ecx, 0x2d
call fcn.0045f500
nop
call fcn.0045cea0
jmp fcn.004a71c0
Function at 0x4a7320
Capabilities:
Encrypt data using rc4 prga

Disassembly:
lea r12, [rsp - 8]
cmp r12, qword [r14 + 0x10]
jbe 0x4a74a6
sub rsp, 0x88
mov qword [rsp + 0x80], rbp
lea rbp, [rsp + 0x80]
movabs rdx, 0x2edb49236caf77e0
mov qword [rsp + 0x1d], rdx
movabs rdx, 0xa92edb49236caf77
mov qword [rsp + 0x1e], rdx
movabs rdx, 0x69d9538f9475826b
mov qword [rsp + 0x26], rdx
movabs rdx, 0x6968657372286563
mov qword [rsp + 0x2e], rdx
movabs rdx, 0x67b8759066844265
mov qword [rsp + 0x36], rdx
movabs rdx, 0x62929302b16b645b
mov qword [rsp + 0x3e], rdx
movabs rdx, 0x9be672996144926c
mov qword [rsp + 0x46], rdx
movabs rdx, 0x20081b2725262301
mov qword [rsp + 0x4e], rdx
movabs rdx, 0x2a2120081b272526
mov qword [rsp + 0x50], rdx
movabs rdx, 0x1404260d0a24262b
mov qword [rsp + 0x58], rdx
movabs rdx, 0x1617003018090201
mov qword [rsp + 0x60], rdx
movabs rdx, 0x204062f131a2506
mov qword [rsp + 0x68], rdx
movabs rdx, 0xf2d1f0f0c200a21
mov qword [rsp + 0x70], rdx
movabs rdx, 0x1f25051d1d010630
mov qword [rsp + 0x78], rdx
xor eax, eax
jmp 0x4a7439
movzx r9d, byte [rsp + rsi + 0x1d]
sub r9d, edx
lea edx, [r9 + 0x1d]
mov byte [rsp + rdi + 0x1d], dl
lea edx, [r8 + 0x1d]
mov byte [rsp + rsi + 0x1d], dl
add rax, 2
cmp rax, 0x32
jge 0x4a7468
movzx edx, byte [rsp + rax + 0x4e]
movzx esi, byte [rsp + rax + 0x4f]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x31
jae 0x4a7495
movzx r8d, byte [rsp + rdi + 0x1d]
sub r8d, edx
nop
cmp rsi, 0x31
jb 0x4a741c
jmp 0x4a7489
xor eax, eax
lea rbx, [rsp + 0x1d]
mov ecx, 0x31
call fcn.0044a140
mov rbp, qword [rsp + 0x80]
add rsp, 0x88
ret
mov eax, esi
mov ecx, 0x31
call fcn.0045f500
mov eax, edi
mov ecx, 0x31
nop dword [rax]
call fcn.0045f500
nop
call fcn.0045cea0
jmp fcn.004a7320

Function at 0x4a84a0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4a85a8
sub rsp, 0x50
mov qword [rsp + 0x48], rbp
lea rbp, [rsp + 0x48]
movabs rdx, 0x1274b5026cb9c9c8
mov qword [rsp + 0x19], rdx
movabs rdx, 0x65fd6c61801274b5
mov qword [rsp + 0x1e], rdx
movabs rdx, 0xae6569f9694fb8b8
mov qword [rsp + 0x26], rdx
movabs rdx, 0x711111400050508
mov qword [rsp + 0x2e], rdx
movabs rdx, 0x211140e0f110b11
mov qword [rsp + 0x36], rdx
movabs rdx, 0xd040211140e0f11
mov qword [rsp + 0x38], rdx
movabs rdx, 0xb02070b00010d12
mov qword [rsp + 0x40], rdx
xor eax, eax
jmp 0x4a8540
movzx r9d, byte [rsp + rsi + 0x19]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x6c]
mov byte [rsp + rdi + 0x19], dl
mov byte [rsp + rsi + 0x19], r8b
add rax, 2
nop
cmp rax, 0x1a
jge 0x4a8572
movzx edx, byte [rsp + rax + 0x2e]
movzx esi, byte [rsp + rax + 0x2f]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x15
jae 0x4a859b
movzx r8d, byte [rsp + rdi + 0x19]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x6c]
cmp rsi, 0x15
jb 0x4a8525
jmp 0x4a858f
xor eax, eax
lea rbx, [rsp + 0x19]
mov ecx, 0x15
nop
call fcn.0044a140
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
mov eax, esi
mov ecx, 0x15
call fcn.0045f500
mov eax, edi
mov ecx, 0x15
call fcn.0045f500
nop
call fcn.0045cea0
jmp fcn.004a84a0
Function at 0x4ab4e0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4ab612
sub rsp, 0x68
mov qword [rsp + 0x60], rbp
lea rbp, [rsp + 0x60]
movabs rdx, 0x99a0b5656c662d72
mov qword [rsp + 0x1b], rdx
movabs rdx, 0x2099a0b5656c662d
mov qword [rsp + 0x1c], rdx
movabs rdx, 0xecb5a265a4599c73
mov qword [rsp + 0x24], rdx
movabs rdx, 0x90f989f175b36564
mov qword [rsp + 0x2c], rdx
movabs rdx, 0x1fae6e932f205abe
mov qword [rsp + 0x34], rdx
movabs rdx, 0x2016100501180f15
mov qword [rsp + 0x3c], rdx
movabs rdx, 0x1618171920161005
mov qword [rsp + 0x40], rdx
movabs rdx, 0x714131c071d1a1c
mov qword [rsp + 0x48], rdx
movabs rdx, 0x13180a05190c191a
mov qword [rsp + 0x50], rdx
movabs rdx, 0xb0e060f1f160118
mov qword [rsp + 0x58], rdx
xor eax, eax
jmp 0x4ab5ac
movzx r9d, byte [rsp + rsi + 0x1b]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x60]
mov byte [rsp + rdi + 0x1b], dl
mov byte [rsp + rsi + 0x1b], r8b
add rax, 2
cmp rax, 0x24
jge 0x4ab5de
movzx edx, byte [rsp + rax + 0x3c]
movzx esi, byte [rsp + rax + 0x3d]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x21
jae 0x4ab605
movzx r8d, byte [rsp + rdi + 0x1b]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x60]
cmp rsi, 0x21
jb 0x4ab592
jmp 0x4ab5f9
xor eax, eax
lea rbx, [rsp + 0x1b]
mov ecx, 0x21
call fcn.0044a140
mov rbp, qword [rsp + 0x60]
add rsp, 0x68
ret
mov eax, esi
mov ecx, 0x21
call fcn.0045f500
mov eax, edi
mov ecx, 0x21
call fcn.0045f500
nop
call fcn.0045cea0
jmp fcn.004ab4e0

Function at 0x4ada00
Capabilities:
Encrypt data using rc4 prga

Disassembly:
lea r12, [rsp - 8]
cmp r12, qword [r14 + 0x10]
jbe 0x4adb76
sub rsp, 0x88
mov qword [rsp + 0x80], rbp
lea rbp, [rsp + 0x80]
movabs rdx, 0x58494c65290a2b04
mov qword [rsp + 0x1f], rdx
movabs rdx, 0x79412e56174a614b
mov qword [rsp + 0x27], rdx
movabs rdx, 0x1a516f4573f23b79
mov qword [rsp + 0x2e], rdx
movabs rdx, 0x73654b64f8314528
mov qword [rsp + 0x36], rdx
movabs rdx, 0x795495656c62fe29
mov qword [rsp + 0x3e], rdx
movabs rdx, 0x192b72725b3c2df7
mov qword [rsp + 0x46], rdx
movabs rdx, 0xc17271f0a25080b
mov qword [rsp + 0x4e], rdx
movabs rdx, 0x271f0c17271f0a25
mov qword [rsp + 0x50], rdx
movabs rdx, 0x1107291a08240328
mov qword [rsp + 0x58], rdx
movabs rdx, 0x2d2a170015000018
mov qword [rsp + 0x60], rdx
movabs rdx, 0x27030213082a130c
mov qword [rsp + 0x68], rdx
movabs rdx, 0x1c06280b2a160720
mov qword [rsp + 0x70], rdx
movabs rdx, 0xe1801201005192e
mov qword [rsp + 0x78], rdx
xor eax, eax
jmp 0x4adb07
movzx r9d, byte [rsp + rsi + 0x1f]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x19]
mov byte [rsp + rdi + 0x1f], dl
mov byte [rsp + rsi + 0x1f], r8b
add rax, 2
cmp rax, 0x32
jge 0x4adb3c
movzx edx, byte [rsp + rax + 0x4e]
movzx esi, byte [rsp + rax + 0x4f]
mov edi, edx
xor edx, esi
add edx, eax
nop dword [rax]
cmp rdi, 0x2f
jae 0x4adb69
movzx r8d, byte [rsp + rdi + 0x1f]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x19]
cmp rsi, 0x2f
jb 0x4adaed
jmp 0x4adb5d
xor eax, eax
lea rbx, [rsp + 0x1f]
mov ecx, 0x2f
call fcn.0044a140
mov rbp, qword [rsp + 0x80]
add rsp, 0x88
ret
mov eax, esi
mov ecx, 0x2f
call fcn.0045f500
mov eax, edi
mov ecx, 0x2f
call fcn.0045f500
nop
call fcn.0045cea0
nop dword [rax + rax]
jmp fcn.004ada00
Function at 0x4ade80
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4adfdf
add rsp, 0xffffffffffffff80
mov qword [rsp + 0x78], rbp
lea rbp, [rsp + 0x78]
movabs rdx, 0x446320c302879560
mov qword [rsp + 0x19], rdx
movabs rdx, 0x6a6ea66fafbe6cc7
mov qword [rsp + 0x21], rdx
movabs rdx, 0x746a6ea66fafbe6c
mov qword [rsp + 0x22], rdx
movabs rdx, 0xd40fbeb96e90d2d7
mov qword [rsp + 0x2a], rdx
movabs rdx, 0xb16e6974b398dcd7
mov qword [rsp + 0x32], rdx
movabs rdx, 0xd75b9a4ac20923b
mov qword [rsp + 0x3a], rdx
movabs rdx, 0x211217031718160b
mov qword [rsp + 0x42], rdx
movabs rdx, 0x121920040d1a2112
mov qword [rsp + 0x48], rdx
movabs rdx, 0x1128151017071108
mov qword [rsp + 0x50], rdx
movabs rdx, 0xf0a00221b070826
mov qword [rsp + 0x58], rdx
movabs rdx, 0x1a17181c11191117
mov qword [rsp + 0x60], rdx
movabs rdx, 0x1308122225212408
mov qword [rsp + 0x68], rdx
movabs rdx, 0x21d240d0d011d20
mov qword [rsp + 0x70], rdx
xor eax, eax
jmp 0x4adf79
movzx r9d, byte [rsp + rsi + 0x19]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x6b]
mov byte [rsp + rdi + 0x19], dl
mov byte [rsp + rsi + 0x19], r8b
add rax, 2
cmp rax, 0x36
jge 0x4adfab
movzx edx, byte [rsp + rax + 0x42]
movzx esi, byte [rsp + rax + 0x43]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x29
jae 0x4adfd2
movzx r8d, byte [rsp + rdi + 0x19]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x6b]
cmp rsi, 0x29
jb 0x4adf5f
jmp 0x4adfc6
xor eax, eax
lea rbx, [rsp + 0x19]
mov ecx, 0x29
call fcn.0044a140
mov rbp, qword [rsp + 0x78]
sub rsp, 0xffffffffffffff80
ret
mov eax, esi
mov ecx, 0x29
call fcn.0045f500
mov eax, edi
mov ecx, 0x29
call fcn.0045f500
nop
nop
call fcn.0045cea0
jmp fcn.004ade80

Function at 0x4b2120
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4b2228
sub rsp, 0x50
mov qword [rsp + 0x48], rbp
lea rbp, [rsp + 0x48]
movabs rdx, 0x82f7838b46bba7f7
mov qword [rsp + 0x19], rdx
movabs rdx, 0x4a73882f7838b46
mov qword [rsp + 0x1c], rdx
movabs rdx, 0x9d7369789a208577
mov qword [rsp + 0x24], rdx
movabs rdx, 0x5060c040b0e020c
mov qword [rsp + 0x2c], rdx
movabs rdx, 0xb0a090807000a01
mov qword [rsp + 0x34], rdx
movabs rdx, 0x80807080b0a0908
mov qword [rsp + 0x38], rdx
movabs rdx, 0x812080512010304
mov qword [rsp + 0x40], rdx
xor eax, eax
jmp 0x4b21c2
movzx r9d, byte [rsp + rsi + 0x19]
sub r9d, edx
lea edx, [r9 - 0xb]
mov byte [rsp + rdi + 0x19], dl
lea edx, [r8 - 0xb]
mov byte [rsp + rsi + 0x19], dl
add rax, 2
cmp rax, 0x1c
jge 0x4b21ef
movzx edx, byte [rsp + rax + 0x2c]
movzx esi, byte [rsp + rax + 0x2d]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x13
jae 0x4b221b
movzx r8d, byte [rsp + rdi + 0x19]
sub r8d, edx
cmp rsi, 0x13
jb 0x4b21a5
jmp 0x4b220f
xor eax, eax
lea rbx, [rsp + 0x19]
mov ecx, 0x13
nop dword [rax + rax]
call fcn.0044a140
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
mov eax, esi
mov ecx, 0x13
call fcn.0045f500
mov eax, edi
mov ecx, 0x13
call fcn.0045f500
nop
call fcn.0045cea0
jmp fcn.004b2120
Function at 0x4b2240
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4b2336
sub rsp, 0x50
mov qword [rsp + 0x48], rbp
lea rbp, [rsp + 0x48]
movabs rdx, 0x726c509d0d6ca0ba
mov qword [rsp + 0x1d], rdx
movabs rdx, 0x93929d726c509d0d
mov qword [rsp + 0x20], rdx
movabs rdx, 0x64ba346fac90cf86
mov qword [rsp + 0x28], rdx
movabs rdx, 0x8110b01100e0b03
mov qword [rsp + 0x30], rdx
movabs rdx, 0x50c08010e0a000e
mov qword [rsp + 0x38], rdx
movabs rdx, 0x40108050d090800
mov qword [rsp + 0x40], rdx
xor eax, eax
jmp 0x4b22d3
movzx r9d, byte [rsp + rsi + 0x1d]
sub r9d, edx
lea edx, [r9 - 0x19]
mov byte [rsp + rdi + 0x1d], dl
lea edx, [r8 - 0x19]
mov byte [rsp + rsi + 0x1d], dl
add rax, 2
cmp rax, 0x18
jge 0x4b2302
movzx edx, byte [rsp + rax + 0x30]
movzx esi, byte [rsp + rax + 0x31]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x13
jae 0x4b2329
movzx r8d, byte [rsp + rdi + 0x1d]
sub r8d, edx
cmp rsi, 0x13
jb 0x4b22b6
nop
jmp 0x4b231d
xor eax, eax
lea rbx, [rsp + 0x1d]
mov ecx, 0x13
call fcn.0044a140
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
mov eax, esi
mov ecx, 0x13
call fcn.0045f500
mov eax, edi
mov ecx, 0x13
call fcn.0045f500
nop
call fcn.0045cea0
nop dword [rax + rax]
jmp fcn.004b2240

Function at 0x4b4fe0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4b50a8
sub rsp, 0x38
mov qword [rsp + 0x30], rbp
lea rbp, [rsp + 0x30]
movabs rdx, 0x2e807b657d736b7c
mov qword [rsp + 0x1d], rdx
mov byte [rsp + 0x25], 0x7d
movabs rdx, 0x800010806000307
mov qword [rsp + 0x26], rdx
mov word [rsp + 0x2e], 0x105
xor eax, eax
jmp 0x4b5040
movzx r9d, byte [rsp + rsi + 0x1d]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x12]
mov byte [rsp + rdi + 0x1d], dl
mov byte [rsp + rsi + 0x1d], r8b
add rax, 2
cmp rax, 0xa
jge 0x4b5072
movzx edx, byte [rsp + rax + 0x26]
movzx esi, byte [rsp + rax + 0x27]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 9
jae 0x4b509b
movzx r8d, byte [rsp + rdi + 0x1d]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x12]
cmp rsi, 9
jb 0x4b5026
jmp 0x4b508f
xor eax, eax
lea rbx, [rsp + 0x1d]
mov ecx, 9
nop
call fcn.0044a140
mov rbp, qword [rsp + 0x30]
add rsp, 0x38
ret
mov eax, esi
mov ecx, 9
call fcn.0045f500
mov eax, edi
mov ecx, 9
call fcn.0045f500
nop
call fcn.0045cea0
jmp fcn.004b4fe0
Function at 0x4b65c0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4b66c8
sub rsp, 0x58
mov qword [rsp + 0x50], rbp
lea rbp, [rsp + 0x50]
movabs rdx, 0xfef2efbdfd40b3f5
mov qword [rsp + 0x1c], rdx
movabs rdx, 0xebed31acf6e6fef2
mov qword [rsp + 0x22], rdx
movabs rdx, 0xc8d22e342e893337
mov qword [rsp + 0x2a], rdx
movabs rdx, 0x1015040704021415
mov qword [rsp + 0x32], rdx
movabs rdx, 0xa03030500091405
mov qword [rsp + 0x3a], rdx
movabs rdx, 0x20703010a030a03
mov qword [rsp + 0x40], rdx
movabs rdx, 0xc0d151508020306
mov qword [rsp + 0x48], rdx
xor eax, eax
jmp 0x4b6660
movzx r9d, byte [rsp + rsi + 0x1c]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x29]
mov byte [rsp + rdi + 0x1c], dl
mov byte [rsp + rsi + 0x1c], r8b
add rax, 2
nop
cmp rax, 0x1e
jge 0x4b6692
movzx edx, byte [rsp + rax + 0x32]
movzx esi, byte [rsp + rax + 0x33]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x16
jae 0x4b66bb
movzx r8d, byte [rsp + rdi + 0x1c]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x29]
cmp rsi, 0x16
jb 0x4b6645
jmp 0x4b66af
xor eax, eax
lea rbx, [rsp + 0x1c]
mov ecx, 0x16
nop
call fcn.0044a140
mov rbp, qword [rsp + 0x50]
add rsp, 0x58
ret
mov eax, esi
mov ecx, 0x16
call fcn.0045f500
mov eax, edi
mov ecx, 0x16
call fcn.0045f500
nop
call fcn.0045cea0
jmp fcn.004b65c0

Function at 0x4b66e0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
sub rsp, 0x38
mov qword [rsp + 0x30], rbp
lea rbp, [rsp + 0x30]
mov qword [rsp + 0x40], 0
movabs rdx, 0x3e06ee80cbece980
mov qword [rsp + 0x1e], rdx
movabs rdx, 0x4000400030502
mov qword [rsp + 0x26], rdx
mov word [rsp + 0x2e], 3
xor eax, eax
nop
jmp 0x4b6740
movzx r8d, byte [rsp + rbx + 0x1e]
sub r8d, edx
lea edx, [r8 - 0x71]
mov byte [rsp + rsi + 0x1e], dl
lea edx, [rdi - 0x71]
mov byte [rsp + rbx + 0x1e], dl
add rax, 2
nop
cmp rax, 0xa
jge 0x4b676b
movzx edx, byte [rsp + rax + 0x26]
movzx ebx, byte [rsp + rax + 0x27]
mov esi, edx
xor edx, ebx
add edx, eax
cmp rsi, 8
jae 0x4b67aa
movzx edi, byte [rsp + rsi + 0x1e]
sub edi, edx
cmp rbx, 8
jb 0x4b6722
jmp 0x4b679e
mov qword [rsp + 0x16], 0
xor eax, eax
jmp 0x4b6784
movzx ecx, byte [rsp + rax + 0x1e]
mov byte [rsp + rax + 0x16], cl
inc rax
cmp rax, 8
jl 0x4b6778
mov rax, qword [rsp + 0x16]
mov qword [rsp + 0x40], rax
mov rbp, qword [rsp + 0x30]
add rsp, 0x38
ret
mov eax, ebx
mov ecx, 8
call fcn.0045f500
mov eax, esi
mov ecx, 8
call fcn.0045f500
nop
int3
Function at 0x4b68e0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4b69dc
sub rsp, 0x48
mov qword [rsp + 0x40], rbp
lea rbp, [rsp + 0x40]
movabs rdx, 0xe3d3b9a3d272a970
mov qword [rsp + 0x1b], rdx
movabs rdx, 0x6fe3d3b9a3d272a9
mov qword [rsp + 0x1c], rdx
movabs rdx, 0xd66569116587a6a0
mov qword [rsp + 0x24], rdx
movabs rdx, 0x60b01090d061010
mov qword [rsp + 0x2c], rdx
movabs rdx, 0x7040a06060b0109
mov qword [rsp + 0x30], rdx
movabs rdx, 0x310050405030b0d
mov qword [rsp + 0x38], rdx
xor eax, eax
jmp 0x4b6970
movzx r9d, byte [rsp + rsi + 0x1b]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x47]
mov byte [rsp + rdi + 0x1b], dl
mov byte [rsp + rsi + 0x1b], r8b
add rax, 2
cmp rax, 0x14
jge 0x4b69a8
movzx edx, byte [rsp + rax + 0x2c]
movzx esi, byte [rsp + rax + 0x2d]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x11
jae 0x4b69cf
movzx r8d, byte [rsp + rdi + 0x1b]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x47]
nop word [rax + rax]
cmp rsi, 0x11
jb 0x4b6956
jmp 0x4b69c3
xor eax, eax
lea rbx, [rsp + 0x1b]
mov ecx, 0x11
call fcn.0044a140
mov rbp, qword [rsp + 0x40]
add rsp, 0x48
ret
mov eax, esi
mov ecx, 0x11
call fcn.0045f500
mov eax, edi
mov ecx, 0x11
call fcn.0045f500
nop
nop dword [rax]
call fcn.0045cea0
jmp fcn.004b68e0