joyce8/EMBER2024-capa huggingface dataset:
Function at 0x494bc0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x494cdf
sub rsp, 0x58
mov qword [rsp + 0x50], rbp
lea rbp, [rsp + 0x50]
movabs rdx, 0x837c4e9ad29184c9
mov qword [rsp + 0x1d], rdx
movabs rdx, 0x7b745a6f70837c4e
mov qword [rsp + 0x22], rdx
movabs rdx, 0x649d9e7465de4fa8
mov qword [rsp + 0x2a], rdx
movabs rdx, 0x80c0504050d0e05
mov qword [rsp + 0x32], rdx
movabs rdx, 0xa030d060d000f00
mov qword [rsp + 0x3a], rdx
movabs rdx, 0xe030a0513040a03
mov qword [rsp + 0x40], rdx
movabs rdx, 0x70601020512020f
mov qword [rsp + 0x48], rdx
xor eax, eax
jmp 0x494c62
movzx r9d, byte [rsp + rsi + 0x1d]
sub r9d, edx
lea edx, [r9 - 1]
mov byte [rsp + rdi + 0x1d], dl
lea edx, [r8 - 1]
mov byte [rsp + rsi + 0x1d], dl
add rax, 2
cmp rax, 0x1e
jge 0x494c99
movzx edx, byte [rsp + rax + 0x32]
lea rsi, [rax + 1]
cmp rsi, 0x1e
jae 0x494cd1
movzx esi, byte [rsp + rax + 0x33]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x15
jae 0x494cc5
movzx r8d, byte [rsp + rdi + 0x1d]
sub r8d, edx
cmp rsi, 0x15
jb 0x494c45
jmp 0x494cb4
xor eax, eax
lea rbx, [rsp + 0x1d]
mov ecx, 0x15
call fcn.00446000
mov rbp, qword [rsp + 0x50]
add rsp, 0x58
ret
mov eax, esi
mov ecx, 0x15
nop dword [rax + rax]
call fcn.00457f40
mov eax, edi
mov ecx, 0x15
call fcn.00457f40
mov rax, rsi
mov ecx, 0x1e
call fcn.00457f40
nop
nop
call fcn.00455860
jmp fcn.00494bc0

Function at 0x494e60
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x494fbf
sub rsp, 0x70
mov qword [rsp + 0x68], rbp
lea rbp, [rsp + 0x68]
movabs rdx, 0x8774736d20aa6fe7
mov qword [rsp + 0x19], rdx
movabs rdx, 0xfd8774736d20aa6f
mov qword [rsp + 0x1a], rdx
movabs rdx, 0x6ed4c49e998b53e9
mov qword [rsp + 0x22], rdx
movabs rdx, 0x34b7986594bb8e12
mov qword [rsp + 0x2a], rdx
movabs rdx, 0x807558a1b4949163
mov qword [rsp + 0x32], rdx
movabs rdx, 0x111e080912171200
mov qword [rsp + 0x3a], rdx
movabs rdx, 0x131e1d12130e0802
mov qword [rsp + 0x42], rdx
movabs rdx, 0x1020160e0a00131e
mov qword [rsp + 0x48], rdx
movabs rdx, 0x7091c0c1b0d0d0f
mov qword [rsp + 0x50], rdx
movabs rdx, 0xd18141a14130b07
mov qword [rsp + 0x58], rdx
movabs rdx, 0x12050c0c1b1d100e
mov qword [rsp + 0x60], rdx
xor eax, eax
nop
jmp 0x494f40
movzx r9d, byte [rsp + rsi + 0x19]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x4d]
mov byte [rsp + rdi + 0x19], dl
mov byte [rsp + rsi + 0x19], r8b
add rax, 2
nop dword [rax]
cmp rax, 0x2e
jge 0x494f7c
movzx edx, byte [rsp + rax + 0x3a]
lea rsi, [rax + 1]
cmp rsi, 0x2e
jae 0x494fb1
movzx esi, byte [rsp + rax + 0x3b]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x21
jae 0x494fa5
movzx r8d, byte [rsp + rdi + 0x19]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x4d]
cmp rsi, 0x21
jb 0x494f22
jmp 0x494f97
xor eax, eax
lea rbx, [rsp + 0x19]
mov ecx, 0x21
call fcn.00446000
mov rbp, qword [rsp + 0x68]
add rsp, 0x70
ret
mov eax, esi
mov ecx, 0x21
nop
call fcn.00457f40
mov eax, edi
mov ecx, 0x21
call fcn.00457f40
mov rax, rsi
mov ecx, 0x2e
call fcn.00457f40
nop
nop
call fcn.00455860
jmp fcn.00494e60
Function at 0x495880
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x49595f
sub rsp, 0x38
mov qword [rsp + 0x30], rbp
lea rbp, [rsp + 0x30]
movabs rdx, 0x227463259b1ef772
mov qword [rsp + 0x1b], rdx
mov byte [rsp + 0x23], 0x18
movabs rdx, 0x107020202080302
mov qword [rsp + 0x24], rdx
mov dword [rsp + 0x2c], 0x4080204
xor eax, eax
jmp 0x4958e4
movzx r9d, byte [rsp + rsi + 0x1b]
sub r9d, edx
lea edx, [r9 + 0x4f]
mov byte [rsp + rdi + 0x1b], dl
lea edx, [r8 + 0x4f]
mov byte [rsp + rsi + 0x1b], dl
add rax, 2
cmp rax, 0xc
jge 0x49591b
movzx edx, byte [rsp + rax + 0x24]
lea rsi, [rax + 1]
cmp rsi, 0xc
jae 0x495951
movzx esi, byte [rsp + rax + 0x25]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 9
jae 0x495945
movzx r8d, byte [rsp + rdi + 0x1b]
sub r8d, edx
cmp rsi, 9
jb 0x4958c7
jmp 0x495936
xor eax, eax
lea rbx, [rsp + 0x1b]
mov ecx, 9
call fcn.00446000
mov rbp, qword [rsp + 0x30]
add rsp, 0x38
ret
mov eax, esi
mov ecx, 9
nop dword [rax]
call fcn.00457f40
mov eax, edi
mov ecx, 9
call fcn.00457f40
mov rax, rsi
mov ecx, 0xc
call fcn.00457f40
nop
nop
call fcn.00455860
jmp fcn.00495880
Function at 0x49b640
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x49b74b
sub rsp, 0x48
mov qword [rsp + 0x40], rbp
lea rbp, [rsp + 0x40]
movabs rdx, 0x15cf636577a120eb
mov qword [rsp + 0x18], rdx
movabs rdx, 0x24c915cf636577a1
mov qword [rsp + 0x1a], rdx
movabs rdx, 0xc920cb172f207516
mov qword [rsp + 0x22], rdx
movabs rdx, 0xf020706030e0303
mov qword [rsp + 0x2a], rdx
movabs rdx, 0x20a10090e110f02
mov qword [rsp + 0x30], rdx
movabs rdx, 0xd010c0e0f0e08
mov qword [rsp + 0x38], rdx
xor eax, eax
jmp 0x49b6d3
movzx r9d, byte [rsp + rsi + 0x18]
sub r9d, edx
lea edx, [r9 + 0x64]
mov byte [rsp + rdi + 0x18], dl
lea edx, [r8 + 0x64]
mov byte [rsp + rsi + 0x18], dl
add rax, 2
cmp rax, 0x16
jge 0x49b70a
movzx edx, byte [rsp + rax + 0x2a]
lea rsi, [rax + 1]
cmp rsi, 0x16
jae 0x49b73d
movzx esi, byte [rsp + rax + 0x2b]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x12
jae 0x49b731
movzx r8d, byte [rsp + rdi + 0x18]
sub r8d, edx
cmp rsi, 0x12
jb 0x49b6b6
jmp 0x49b725
xor eax, eax
lea rbx, [rsp + 0x18]
mov ecx, 0x12
call fcn.00446000
mov rbp, qword [rsp + 0x40]
add rsp, 0x48
ret
mov eax, esi
mov ecx, 0x12
call fcn.00457f40
mov eax, edi
mov ecx, 0x12
call fcn.00457f40
mov rax, rsi
mov ecx, 0x16
call fcn.00457f40
nop
call fcn.00455860
jmp fcn.0049b640

Function at 0x49bc60
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x49bda9
sub rsp, 0x68
mov qword [rsp + 0x60], rbp
lea rbp, [rsp + 0x60]
movabs rdx, 0x3a746918334c6506
mov qword [rsp + 0x1b], rdx
movabs rdx, 0x4c3a746918334c65
mov qword [rsp + 0x1c], rdx
movabs rdx, 0x624c016d254c694b
mov qword [rsp + 0x24], rdx
movabs rdx, 0x75592c6451787765
mov qword [rsp + 0x2c], rdx
movabs rdx, 0x72116e613720666f
mov qword [rsp + 0x34], rdx
movabs rdx, 0xb17140b0e031c15
mov qword [rsp + 0x3c], rdx
movabs rdx, 0x20f0f030b17140b
mov qword [rsp + 0x40], rdx
movabs rdx, 0x51c1c20090c0e00
mov qword [rsp + 0x48], rdx
movabs rdx, 0x150d18080b102012
mov qword [rsp + 0x50], rdx
movabs rdx, 0x160811021f180414
mov qword [rsp + 0x58], rdx
xor eax, eax
jmp 0x49bd2f
movzx r9d, byte [rsp + rsi + 0x1b]
sub r9d, edx
lea edx, [r9 + 0x34]
mov byte [rsp + rdi + 0x1b], dl
lea edx, [r8 + 0x34]
mov byte [rsp + rsi + 0x1b], dl
add rax, 2
cmp rax, 0x24
jge 0x49bd68
movzx edx, byte [rsp + rax + 0x3c]
lea rsi, [rax + 1]
nop
cmp rsi, 0x24
jae 0x49bd9b
movzx esi, byte [rsp + rax + 0x3d]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x21
jae 0x49bd8f
movzx r8d, byte [rsp + rdi + 0x1b]
sub r8d, edx
cmp rsi, 0x21
jb 0x49bd12
jmp 0x49bd83
xor eax, eax
lea rbx, [rsp + 0x1b]
mov ecx, 0x21
call fcn.00446000
mov rbp, qword [rsp + 0x60]
add rsp, 0x68
ret
mov eax, esi
mov ecx, 0x21
call fcn.00457f40
mov eax, edi
mov ecx, 0x21
call fcn.00457f40
mov rax, rsi
mov ecx, 0x24
call fcn.00457f40
nop
call fcn.00455860
jmp fcn.0049bc60
Function at 0x49cf40
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x49d093
sub rsp, 0x70
mov qword [rsp + 0x68], rbp
lea rbp, [rsp + 0x68]
movabs rdx, 0x3c07d4656c662108
mov qword [rsp + 0x1f], rdx
movabs rdx, 0x5a3c07d4656c6621
mov qword [rsp + 0x20], rdx
movabs rdx, 0x3c69e51524316c24
mov qword [rsp + 0x28], rdx
movabs rdx, 0x2043072f20516500
mov qword [rsp + 0x30], rdx
movabs rdx, 0x654ffcc13043666f
mov qword [rsp + 0x38], rdx
movabs rdx, 0xe0d16071d1b0e1b
mov qword [rsp + 0x40], rdx
movabs rdx, 0x80b0c061f071b
mov qword [rsp + 0x48], rdx
movabs rdx, 0x15131b110c050917
mov qword [rsp + 0x50], rdx
movabs rdx, 0x161713101f10071d
mov qword [rsp + 0x58], rdx
movabs rdx, 0x1e0c1e0c011d1c0b
mov qword [rsp + 0x60], rdx
xor eax, eax
jmp 0x49d00c
movzx r9d, byte [rsp + rsi + 0x1f]
lea edx, [r9 + rdx]
lea edx, [rdx + 2]
mov byte [rsp + rdi + 0x1f], dl
mov byte [rsp + rsi + 0x1f], r8b
add rax, 2
cmp rax, 0x28
jge 0x49d04d
movzx edx, byte [rsp + rax + 0x40]
lea rsi, [rax + 1]
nop dword [rax + rax]
cmp rsi, 0x28
jae 0x49d085
movzx esi, byte [rsp + rax + 0x41]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x21
jae 0x49d074
movzx r8d, byte [rsp + rdi + 0x1f]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 2]
cmp rsi, 0x21
jb 0x49cff2
jmp 0x49d068
xor eax, eax
lea rbx, [rsp + 0x1f]
mov ecx, 0x21
call fcn.00446000
mov rbp, qword [rsp + 0x68]
add rsp, 0x70
ret
mov eax, esi
mov ecx, 0x21
call fcn.00457f40
mov eax, edi
mov ecx, 0x21
nop dword [rax + rax]
call fcn.00457f40
mov rax, rsi
mov ecx, 0x28
call fcn.00457f40
nop
call fcn.00455860
jmp fcn.0049cf40

Function at 0x49d0a0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x49d17f
sub rsp, 0x38
mov qword [rsp + 0x30], rbp
lea rbp, [rsp + 0x30]
movabs rdx, 0x7c4ca4ae71478739
mov qword [rsp + 0x1b], rdx
mov byte [rsp + 0x23], 0x39
movabs rdx, 0x204050208010403
mov qword [rsp + 0x24], rdx
mov dword [rsp + 0x2c], 0x7000003
xor eax, eax
jmp 0x49d101
movzx r9d, byte [rsp + rsi + 0x1b]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x24]
mov byte [rsp + rdi + 0x1b], dl
mov byte [rsp + rsi + 0x1b], r8b
add rax, 2
cmp rax, 0xc
jge 0x49d13d
movzx edx, byte [rsp + rax + 0x24]
lea rsi, [rax + 1]
cmp rsi, 0xc
jae 0x49d171
movzx esi, byte [rsp + rax + 0x25]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 9
jae 0x49d165
movzx r8d, byte [rsp + rdi + 0x1b]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x24]
cmp rsi, 9
jb 0x49d0e7
jmp 0x49d158
xor eax, eax
lea rbx, [rsp + 0x1b]
mov ecx, 9
call fcn.00446000
mov rbp, qword [rsp + 0x30]
add rsp, 0x38
ret
mov eax, esi
mov ecx, 9
nop
call fcn.00457f40
mov eax, edi
mov ecx, 9
call fcn.00457f40
mov rax, rsi
mov ecx, 0xc
call fcn.00457f40
nop
nop
call fcn.00455860
jmp fcn.0049d0a0
Function at 0x49da40
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x49db53
sub rsp, 0x50
mov qword [rsp + 0x48], rbp
lea rbp, [rsp + 0x48]
movabs rdx, 0xccd06387a842658d
mov qword [rsp + 0x1f], rdx
movabs rdx, 0xbaccd06387a84265
mov qword [rsp + 0x20], rdx
movabs rdx, 0x8ba88b8981777961
mov qword [rsp + 0x28], rdx
movabs rdx, 0x1006030a0c0c08
mov qword [rsp + 0x30], rdx
movabs rdx, 0x40b0e0a0c0d0307
mov qword [rsp + 0x38], rdx
movabs rdx, 0x7020706060f0703
mov qword [rsp + 0x40], rdx
xor eax, eax
jmp 0x49dad0
movzx r9d, byte [rsp + rsi + 0x1f]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x2f]
mov byte [rsp + rdi + 0x1f], dl
mov byte [rsp + rsi + 0x1f], r8b
add rax, 2
cmp rax, 0x18
jge 0x49db0d
movzx edx, byte [rsp + rax + 0x30]
lea rsi, [rax + 1]
nop
cmp rsi, 0x18
jae 0x49db45
movzx esi, byte [rsp + rax + 0x31]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x11
jae 0x49db34
movzx r8d, byte [rsp + rdi + 0x1f]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x2f]
cmp rsi, 0x11
jb 0x49dab6
jmp 0x49db28
xor eax, eax
lea rbx, [rsp + 0x1f]
mov ecx, 0x11
call fcn.00446000
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
mov eax, esi
mov ecx, 0x11
call fcn.00457f40
mov eax, edi
mov ecx, 0x11
nop dword [rax + rax]
call fcn.00457f40
mov rax, rsi
mov ecx, 0x18
call fcn.00457f40
nop
call fcn.00455860
jmp fcn.0049da40
Function at 0x49fbe0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
lea r12, [rsp - 0x20]
cmp r12, qword [r14 + 0x10]
jbe 0x49fd9f
sub rsp, 0xa0
mov qword [rsp + 0x98], rbp
lea rbp, [rsp + 0x98]
movabs rdx, 0x1f78e5bc096665aa
mov qword [rsp + 0x1e], rdx
movabs rdx, 0x7e8b206c9810632f
mov qword [rsp + 0x26], rdx
movabs rdx, 0xf9ec72207e8b206c
mov qword [rsp + 0x2a], rdx
movabs rdx, 0xf324562316e865a1
mov qword [rsp + 0x32], rdx
movabs rdx, 0xea20fb654c2f0c1a
mov qword [rsp + 0x3a], rdx
movabs rdx, 0x3874db727449f859
mov qword [rsp + 0x42], rdx
movabs rdx, 0x72330c2da66ffa28
mov qword [rsp + 0x4a], rdx
movabs rdx, 0x20354e6134cc7937
mov qword [rsp + 0x52], rdx
movabs rdx, 0x2d2f162913140b04
mov qword [rsp + 0x5a], rdx
movabs rdx, 0x2d0f0603310b0723
mov qword [rsp + 0x62], rdx
movabs rdx, 0x41321000a1d2d0f
mov qword [rsp + 0x68], rdx
movabs rdx, 0x37171a3b2c05261c
mov qword [rsp + 0x70], rdx
movabs rdx, 0x1b3a1b36160e252d
mov qword [rsp + 0x78], rdx
movabs rdx, 0x390b0026210b132d
mov qword [rsp + 0x80], rdx
movabs rdx, 0x3083a3212181634
mov qword [rsp + 0x88], rdx
movabs rdx, 0x240e2934291e392b
mov qword [rsp + 0x90], rdx
xor eax, eax
jmp 0x49fd20
movzx r9d, byte [rsp + rsi + 0x1e]
sub r9d, edx
lea edx, [r9 + 0x7c]
mov byte [rsp + rdi + 0x1e], dl
lea edx, [r8 + 0x7c]
mov byte [rsp + rsi + 0x1e], dl
add rax, 2
cmp rax, 0x3e
jge 0x49fd57
movzx edx, byte [rsp + rax + 0x5a]
lea rsi, [rax + 1]
cmp rsi, 0x3e
jae 0x49fd91
movzx esi, byte [rsp + rax + 0x5b]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x3c
jae 0x49fd85
movzx r8d, byte [rsp + rdi + 0x1e]
sub r8d, edx
cmp rsi, 0x3c
jb 0x49fd03
jmp 0x49fd78
xor eax, eax
lea rbx, [rsp + 0x1e]
mov ecx, 0x3c
call fcn.00446000
mov rbp, qword [rsp + 0x98]
add rsp, 0xa0
ret
mov eax, esi
mov ecx, 0x3c
nop
call fcn.00457f40
mov eax, edi
mov ecx, 0x3c
call fcn.00457f40
mov rax, rsi
mov ecx, 0x3e
call fcn.00457f40
nop
nop
call fcn.00455860
jmp fcn.0049fbe0
Function at 0x4a1600
Capabilities:
Encrypt data using rc4 prga

Disassembly:
lea r12, [rsp - 8]
cmp r12, qword [r14 + 0x10]
jbe 0x4a179f
sub rsp, 0x88
mov qword [rsp + 0x80], rbp
lea rbp, [rsp + 0x80]
movabs rdx, 0x8377658f0050714d
mov qword [rsp + 0x1c], rdx
movabs rdx, 0x746379264c70536a
mov qword [rsp + 0x24], rdx
movabs rdx, 0x6c6b746379264c70
mov qword [rsp + 0x26], rdx
movabs rdx, 0x7875203a6f3440b7
mov qword [rsp + 0x2e], rdx
movabs rdx, 0x9a646674a6936168
mov qword [rsp + 0x36], rdx
movabs rdx, 0x6584d061a3c2615b
mov qword [rsp + 0x3e], rdx
movabs rdx, 0x1318130c18161403
mov qword [rsp + 0x46], rdx
movabs rdx, 0x240b0c1802141f0b
mov qword [rsp + 0x4e], rdx
movabs rdx, 0x1f1c240b0c180214
mov qword [rsp + 0x50], rdx
movabs rdx, 0x141f0716290b0810
mov qword [rsp + 0x58], rdx
movabs rdx, 0x130f020d090c0b0a
mov qword [rsp + 0x60], rdx
movabs rdx, 0x211828010401160b
mov qword [rsp + 0x68], rdx
movabs rdx, 0x80c06021d290612
mov qword [rsp + 0x70], rdx
movabs rdx, 0x225231422070227
mov qword [rsp + 0x78], rdx
xor eax, eax
jmp 0x4a1719
movzx r9d, byte [rsp + rsi + 0x1c]
sub r9d, edx
lea edx, [r9 + 0x2c]
mov byte [rsp + rdi + 0x1c], dl
lea edx, [r8 + 0x2c]
mov byte [rsp + rsi + 0x1c], dl
add rax, 2
cmp rax, 0x3a
jge 0x4a1750
movzx edx, byte [rsp + rax + 0x46]
lea rsi, [rax + 1]
cmp rsi, 0x3a
jae 0x4a1791
movzx esi, byte [rsp + rax + 0x47]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x2a
jae 0x4a1785
movzx r8d, byte [rsp + rdi + 0x1c]
sub r8d, edx
cmp rsi, 0x2a
jb 0x4a16fc
jmp 0x4a1775
xor eax, eax
lea rbx, [rsp + 0x1c]
mov ecx, 0x2a
nop dword [rax]
call fcn.00446000
mov rbp, qword [rsp + 0x80]
add rsp, 0x88
ret
mov eax, esi
mov ecx, 0x2a
nop dword [rax]
call fcn.00457f40
mov eax, edi
mov ecx, 0x2a
call fcn.00457f40
mov rax, rsi
mov ecx, 0x3a
call fcn.00457f40
nop
nop
call fcn.00455860
jmp fcn.004a1600
Function at 0x4a18a0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
lea r12, [rsp - 0x48]
cmp r12, qword [r14 + 0x10]
jbe 0x4a1a33
sub rsp, 0xc8
mov qword [rsp + 0xc0], rbp
lea rbp, [rsp + 0xc0]
movabs rdx, 0x938857449c1d79f
mov qword [rsp + 0x1b], rdx
movabs rdx, 0xfad5b007cba4654e
mov qword [rsp + 0x23], rdx
movabs rdx, 0x6f2bd165cafad5b0
mov qword [rsp + 0x28], rdx
movabs rdx, 0x65cc8cf26ee620cc
mov qword [rsp + 0x30], rdx
movabs rdx, 0x6874b985037c61d0
mov qword [rsp + 0x38], rdx
movabs rdx, 0x6c73c8aa8a20e0ee
mov qword [rsp + 0x40], rdx
movabs rdx, 0xd97661a5dab83a6e
mov qword [rsp + 0x48], rdx
movabs rdx, 0xd5ec736120ccacce
mov qword [rsp + 0x50], rdx
movabs rdx, 0xec8802b62ed96903
mov qword [rsp + 0x58], rdx
movabs rdx, 0x6f336c61d43570c4
mov qword [rsp + 0x60], rdx
movabs rdx, 0x481d4b4337064047
mov qword [rsp + 0x68], rdx
lea rdi, [rsp + 0x70]
lea rsi, [0x006ca260]
nop word [rax + rax]
mov qword [rsp - 0x10], rbp
lea rbp, [rsp - 0x10]
call fcn.0045857a
mov rbp, qword [rbp]
xor eax, eax
jmp 0x4a19b4
movzx r9d, byte [rsp + rsi + 0x1b]
sub r9d, edx
lea edx, [r9 - 7]
mov byte [rsp + rdi + 0x1b], dl
lea edx, [r8 - 7]
mov byte [rsp + rsi + 0x1b], dl
add rax, 2
cmp rax, 0x58
jge 0x4a19eb
movzx edx, byte [rsp + rax + 0x68]
lea rsi, [rax + 1]
cmp rsi, 0x58
jae 0x4a1a25
movzx esi, byte [rsp + rax + 0x69]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x4d
jae 0x4a1a18
movzx r8d, byte [rsp + rdi + 0x1b]
sub r8d, edx
cmp rsi, 0x4d
jb 0x4a1997
jmp 0x4a1a0c
xor eax, eax
lea rbx, [rsp + 0x1b]
mov ecx, 0x4d
call fcn.00446000
mov rbp, qword [rsp + 0xc0]
add rsp, 0xc8
ret
mov eax, esi
mov ecx, 0x4d
call fcn.00457f40
mov eax, edi
mov ecx, 0x4d
nop
call fcn.00457f40
mov rax, rsi
mov ecx, 0x58
call fcn.00457f40
nop
call fcn.00455860
jmp fcn.004a18a0
Function at 0x4a3960
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4a3a7f
sub rsp, 0x50
mov qword [rsp + 0x48], rbp
lea rbp, [rsp + 0x48]
movabs rdx, 0x700d748db6665ed
mov qword [rsp + 0x1b], rdx
movabs rdx, 0x4371b0700d748db
mov qword [rsp + 0x1e], rdx
movabs rdx, 0x8292d6cf442492c
mov qword [rsp + 0x26], rdx
movabs rdx, 0x1008110e00060e06
mov qword [rsp + 0x2e], rdx
movabs rdx, 0x905071207090903
mov qword [rsp + 0x36], rdx
movabs rdx, 0xb09090507120709
mov qword [rsp + 0x38], rdx
movabs rdx, 0xe060a0d0b0c0410
mov qword [rsp + 0x40], rdx
xor eax, eax
jmp 0x4a3a02
movzx r9d, byte [rsp + rsi + 0x1b]
sub r9d, edx
lea edx, [r9 + 0x47]
mov byte [rsp + rdi + 0x1b], dl
lea edx, [r8 + 0x47]
mov byte [rsp + rsi + 0x1b], dl
add rax, 2
cmp rax, 0x1a
jge 0x4a3a39
movzx edx, byte [rsp + rax + 0x2e]
lea rsi, [rax + 1]
cmp rsi, 0x1a
jae 0x4a3a71
movzx esi, byte [rsp + rax + 0x2f]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x13
jae 0x4a3a65
movzx r8d, byte [rsp + rdi + 0x1b]
sub r8d, edx
cmp rsi, 0x13
jb 0x4a39e5
jmp 0x4a3a54
xor eax, eax
lea rbx, [rsp + 0x1b]
mov ecx, 0x13
call fcn.00446000
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
mov eax, esi
mov ecx, 0x13
nop dword [rax + rax]
call fcn.00457f40
mov eax, edi
mov ecx, 0x13
call fcn.00457f40
mov rax, rsi
mov ecx, 0x1a
call fcn.00457f40
nop
nop
call fcn.00455860
jmp fcn.004a3960
Function at 0x4aa660
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4aa773
sub rsp, 0x50
mov qword [rsp + 0x48], rbp
lea rbp, [rsp + 0x48]
movabs rdx, 0x6570b9749c795f62
mov qword [rsp + 0x1b], rdx
movabs rdx, 0xaebe76befd6570b9
mov qword [rsp + 0x20], rdx
movabs rdx, 0x30d2a0b2c3c96d6f
mov qword [rsp + 0x28], rdx
movabs rdx, 0x80a050f01050b0c
mov qword [rsp + 0x30], rdx
movabs rdx, 0x130210110f090b14
mov qword [rsp + 0x38], rdx
movabs rdx, 0x3120c0a02120b0c
mov qword [rsp + 0x40], rdx
xor eax, eax
jmp 0x4aa6f0
movzx r9d, byte [rsp + rsi + 0x1b]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x5e]
mov byte [rsp + rdi + 0x1b], dl
mov byte [rsp + rsi + 0x1b], r8b
add rax, 2
cmp rax, 0x18
jge 0x4aa72d
movzx edx, byte [rsp + rax + 0x30]
lea rsi, [rax + 1]
nop
cmp rsi, 0x18
jae 0x4aa765
movzx esi, byte [rsp + rax + 0x31]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x15
jae 0x4aa754
movzx r8d, byte [rsp + rdi + 0x1b]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x5e]
cmp rsi, 0x15
jb 0x4aa6d6
jmp 0x4aa748
xor eax, eax
lea rbx, [rsp + 0x1b]
mov ecx, 0x15
call fcn.00446000
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
mov eax, esi
mov ecx, 0x15
call fcn.00457f40
mov eax, edi
mov ecx, 0x15
nop dword [rax + rax]
call fcn.00457f40
mov rax, rsi
mov ecx, 0x18
call fcn.00457f40
nop
call fcn.00455860
jmp fcn.004aa660

Function at 0x4ab6c0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4ab7cb
sub rsp, 0x50
mov qword [rsp + 0x48], rbp
lea rbp, [rsp + 0x48]
movabs rdx, 0xc664b76cd8766ecc
mov qword [rsp + 0x1e], rdx
movabs rdx, 0x41e237d5c664b76c
mov qword [rsp + 0x22], rdx
movabs rdx, 0x746c6c73d0db20a5
mov qword [rsp + 0x2a], rdx
movabs rdx, 0xb03110e000f070c
mov qword [rsp + 0x32], rdx
movabs rdx, 0x90805070e030b03
mov qword [rsp + 0x38], rdx
movabs rdx, 0x50a080311030703
mov qword [rsp + 0x40], rdx
xor eax, eax
jmp 0x4ab753
movzx r9d, byte [rsp + rsi + 0x1e]
sub r9d, edx
lea edx, [r9 - 0x56]
mov byte [rsp + rdi + 0x1e], dl
lea edx, [r8 - 0x56]
mov byte [rsp + rsi + 0x1e], dl
add rax, 2
cmp rax, 0x16
jge 0x4ab78a
movzx edx, byte [rsp + rax + 0x32]
lea rsi, [rax + 1]
cmp rsi, 0x16
jae 0x4ab7bd
movzx esi, byte [rsp + rax + 0x33]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x14
jae 0x4ab7b1
movzx r8d, byte [rsp + rdi + 0x1e]
sub r8d, edx
cmp rsi, 0x14
jb 0x4ab736
jmp 0x4ab7a5
xor eax, eax
lea rbx, [rsp + 0x1e]
mov ecx, 0x14
call fcn.00446000
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
mov eax, esi
mov ecx, 0x14
call fcn.00457f40
mov eax, edi
mov ecx, 0x14
call fcn.00457f40
mov rax, rsi
mov ecx, 0x16
call fcn.00457f40
nop
call fcn.00455860
jmp fcn.004ab6c0
Function at 0x4acca0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4acdab
sub rsp, 0x48
mov qword [rsp + 0x40], rbp
lea rbp, [rsp + 0x40]
movabs rdx, 0x2c2a15696d193d49
mov qword [rsp + 0x19], rdx
movabs rdx, 0x312c2a15696d193d
mov qword [rsp + 0x1a], rdx
movabs rdx, 0x64654ef1214f536e
mov qword [rsp + 0x22], rdx
movabs rdx, 0xa060800020e0b05
mov qword [rsp + 0x2a], rdx
movabs rdx, 0x10a07070e0c0a06
mov qword [rsp + 0x30], rdx
movabs rdx, 0x70e0e0b000a000d
mov qword [rsp + 0x38], rdx
xor eax, eax
jmp 0x4acd33
movzx r9d, byte [rsp + rsi + 0x19]
sub r9d, edx
lea edx, [r9 + 0x32]
mov byte [rsp + rdi + 0x19], dl
lea edx, [r8 + 0x32]
mov byte [rsp + rsi + 0x19], dl
add rax, 2
cmp rax, 0x16
jge 0x4acd6a
movzx edx, byte [rsp + rax + 0x2a]
lea rsi, [rax + 1]
cmp rsi, 0x16
jae 0x4acd9d
movzx esi, byte [rsp + rax + 0x2b]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x11
jae 0x4acd91
movzx r8d, byte [rsp + rdi + 0x19]
sub r8d, edx
cmp rsi, 0x11
jb 0x4acd16
jmp 0x4acd85
xor eax, eax
lea rbx, [rsp + 0x19]
mov ecx, 0x11
call fcn.00446000
mov rbp, qword [rsp + 0x40]
add rsp, 0x48
ret
mov eax, esi
mov ecx, 0x11
call fcn.00457f40
mov eax, edi
mov ecx, 0x11
call fcn.00457f40
mov rax, rsi
mov ecx, 0x16
call fcn.00457f40
nop
call fcn.00455860
jmp fcn.004acca0

Function at 0x4adbe0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4add29
sub rsp, 0x70
mov qword [rsp + 0x68], rbp
lea rbp, [rsp + 0x68]
movabs rdx, 0xd920752762611d55
mov qword [rsp + 0x1a], rdx
movabs rdx, 0xf2740d6420e3d920
mov qword [rsp + 0x20], rdx
movabs rdx, 0x79733f403b4f4b9b
mov qword [rsp + 0x28], rdx
movabs rdx, 0x3709e43d26391f39
mov qword [rsp + 0x30], rdx
movabs rdx, 0xa3a79726f33fc3e
mov qword [rsp + 0x38], rdx
movabs rdx, 0x1a25041f0e070108
mov qword [rsp + 0x40], rdx
movabs rdx, 0x705011e171b190d
mov qword [rsp + 0x48], rdx
movabs rdx, 0x4160e0512251c17
mov qword [rsp + 0x50], rdx
movabs rdx, 0x100f20160b25111d
mov qword [rsp + 0x58], rdx
movabs rdx, 0x1819161617130717
mov qword [rsp + 0x60], rdx
xor eax, eax
jmp 0x4adcaf
movzx r9d, byte [rsp + rsi + 0x1a]
sub r9d, edx
lea edx, [r9 + 0x5b]
mov byte [rsp + rdi + 0x1a], dl
lea edx, [r8 + 0x5b]
mov byte [rsp + rsi + 0x1a], dl
add rax, 2
cmp rax, 0x28
jge 0x4adce8
movzx edx, byte [rsp + rax + 0x40]
lea rsi, [rax + 1]
nop
cmp rsi, 0x28
jae 0x4add1b
movzx esi, byte [rsp + rax + 0x41]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x26
jae 0x4add0f
movzx r8d, byte [rsp + rdi + 0x1a]
sub r8d, edx
cmp rsi, 0x26
jb 0x4adc92
jmp 0x4add03
xor eax, eax
lea rbx, [rsp + 0x1a]
mov ecx, 0x26
call fcn.00446000
mov rbp, qword [rsp + 0x68]
add rsp, 0x70
ret
mov eax, esi
mov ecx, 0x26
call fcn.00457f40
mov eax, edi
mov ecx, 0x26
call fcn.00457f40
mov rax, rsi
mov ecx, 0x28
call fcn.00457f40
nop
call fcn.00455860
jmp fcn.004adbe0