joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4ed5a0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4ed6a8
push rbp
mov rbp, rsp
sub rsp, 0x50
movabs rdx, 0x49656ccb46d265a3
mov qword [rsp + 0x36], rdx
movabs rdx, 0x69dafe6d72a7e0be
mov qword [rsp + 0x3e], rdx
movabs rdx, 0xbdb169dafe6d72a7
mov qword [rsp + 0x40], rdx
movabs rdx, 0xfb221dcf06ce0fb4
mov qword [rsp + 0x48], rdx
movabs rdx, 0x120215000d1209
mov qword [rsp + 0x18], rdx
movabs rdx, 0xa14170219131512
mov qword [rsp + 0x20], rdx
movabs rdx, 0x1602191318040a14
mov qword [rsp + 0x26], rdx
movabs rdx, 0x1111100e15100408
mov qword [rsp + 0x2e], rdx
xor eax, eax
jmp 0x4ed64b
movzx r9d, byte [rsp + rsi + 0x36]
sub r9d, edx
lea edx, [r9 - 0x33]
mov byte [rsp + rdi + 0x36], dl
lea edx, [r8 - 0x33]
mov byte [rsp + rsi + 0x36], dl
add rax, 2
cmp rax, 0x1e
jge 0x4ed678
movzx edx, byte [rsp + rax + 0x18]
movzx esi, byte [rsp + rax + 0x19]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x1a
jae 0x4ed69b
movzx r8d, byte [rsp + rdi + 0x36]
sub r8d, edx
cmp rsi, 0x1a
jb 0x4ed62e
jmp 0x4ed68f
xor eax, eax
lea rbx, [rsp + 0x36]
mov ecx, 0x1a
call fcn.00444780
add rsp, 0x50
pop rbp
ret
mov eax, esi
mov ecx, 0x1a
call fcn.00456420
mov eax, edi
mov ecx, 0x1a
call fcn.00456420
nop
call fcn.00454140
jmp fcn.004ed5a0

Function at 0x4ee960
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4eea3d
push rbp
mov rbp, rsp
sub rsp, 0x40
movabs rdx, 0xb346a106a774373d
mov qword [rsp + 0x31], rdx
movabs rdx, 0x73906de3a3fd9db3
mov qword [rsp + 0x38], rdx
movabs rdx, 0x109090b09060a
mov qword [rsp + 0x1b], rdx
movabs rdx, 0x3010a050d000001
mov qword [rsp + 0x21], rdx
movabs rdx, 0x50b0405070d0803
mov qword [rsp + 0x29], rdx
xor eax, eax
nop
jmp 0x4ee9e0
movzx r9d, byte [rsp + rsi + 0x31]
sub r9d, edx
lea edx, [r9 - 0x34]
mov byte [rsp + rdi + 0x31], dl
lea edx, [r8 - 0x34]
mov byte [rsp + rsi + 0x31], dl
add rax, 2
nop
cmp rax, 0x16
jge 0x4eea0d
movzx edx, byte [rsp + rax + 0x1b]
movzx esi, byte [rsp + rax + 0x1c]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0xf
jae 0x4eea30
movzx r8d, byte [rsp + rdi + 0x31]
sub r8d, edx
cmp rsi, 0xf
jb 0x4ee9c2
jmp 0x4eea24
xor eax, eax
lea rbx, [rsp + 0x31]
mov ecx, 0xf
call fcn.00444780
add rsp, 0x40
pop rbp
ret
mov eax, esi
mov ecx, 0xf
call fcn.00456420
mov eax, edi
mov ecx, 0xf
call fcn.00456420
nop
nop dword [rax]
call fcn.00454140
jmp fcn.004ee960
Function at 0x4eff80
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4f0058
push rbp
mov rbp, rsp
sub rsp, 0x38
movabs rdx, 0x205d693e101720b6
mov qword [rsp + 0x2c], rdx
mov dword [rsp + 0x34], 0x57461f19
movabs rdx, 0x80702030a010009
mov qword [rsp + 0x1a], rdx
movabs rdx, 0x703080702030a01
mov qword [rsp + 0x1c], rdx
movabs rdx, 0x406060a02080a09
mov qword [rsp + 0x24], rdx
xor eax, eax
jmp 0x4efff7
movzx r9d, byte [rsp + rsi + 0x2c]
sub r9d, edx
lea edx, [r9 + 0x36]
mov byte [rsp + rdi + 0x2c], dl
lea edx, [r8 + 0x36]
mov byte [rsp + rsi + 0x2c], dl
add rax, 2
cmp rax, 0x12
jge 0x4f0028
movzx edx, byte [rsp + rax + 0x1a]
movzx esi, byte [rsp + rax + 0x1b]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0xc
jae 0x4f004b
movzx r8d, byte [rsp + rdi + 0x2c]
sub r8d, edx
nop dword [rax]
cmp rsi, 0xc
jb 0x4effda
jmp 0x4f003f
xor eax, eax
lea rbx, [rsp + 0x2c]
mov ecx, 0xc
call fcn.00444780
add rsp, 0x38
pop rbp
ret
mov eax, esi
mov ecx, 0xc
call fcn.00456420
mov eax, edi
mov ecx, 0xc
call fcn.00456420
nop
call fcn.00454140
nop dword [rax]
jmp fcn.004eff80

Function at 0x4f0080
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4f0146
push rbp
mov rbp, rsp
sub rsp, 0x30
movabs rdx, 0x3d1e433230286f4c
mov qword [rsp + 0x27], rdx
mov byte [rsp + 0x2f], 0x38
movabs rdx, 0x306060406080503
mov qword [rsp + 0x1b], rdx
mov dword [rsp + 0x23], 0x7080502
xor eax, eax
nop
jmp 0x4f00e0
movzx r9d, byte [rsp + rsi + 0x27]
lea edx, [r9 + rdx]
lea edx, [rdx + 0xf]
mov byte [rsp + rdi + 0x27], dl
mov byte [rsp + rsi + 0x27], r8b
add rax, 2
nop dword [rax]
cmp rax, 0xc
jge 0x4f0112
movzx edx, byte [rsp + rax + 0x1b]
movzx esi, byte [rsp + rax + 0x1c]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 9
jae 0x4f0137
movzx r8d, byte [rsp + rdi + 0x27]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0xf]
cmp rsi, 9
jb 0x4f00c2
jmp 0x4f012b
xor eax, eax
lea rbx, [rsp + 0x27]
mov ecx, 9
nop
call fcn.00444780
add rsp, 0x30
pop rbp
ret
mov eax, esi
mov ecx, 9
call fcn.00456420
mov eax, edi
mov ecx, 9
nop
call fcn.00456420
nop
call fcn.00454140
jmp fcn.004f0080

Function at 0x4f0660
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4f0726
push rbp
mov rbp, rsp
sub rsp, 0x30
movabs rdx, 0xf3c4691c6535174d
mov qword [rsp + 0x27], rdx
mov byte [rsp + 0x2f], 0x57
movabs rdx, 0x604060701040606
mov qword [rsp + 0x1b], rdx
mov dword [rsp + 0x23], 0x2010207
xor eax, eax
nop
jmp 0x4f06c0
movzx r9d, byte [rsp + rsi + 0x27]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x23]
mov byte [rsp + rdi + 0x27], dl
mov byte [rsp + rsi + 0x27], r8b
add rax, 2
nop dword [rax]
cmp rax, 0xc
jge 0x4f06f2
movzx edx, byte [rsp + rax + 0x1b]
movzx esi, byte [rsp + rax + 0x1c]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 9
jae 0x4f0717
movzx r8d, byte [rsp + rdi + 0x27]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x23]
cmp rsi, 9
jb 0x4f06a2
jmp 0x4f070b
xor eax, eax
lea rbx, [rsp + 0x27]
mov ecx, 9
nop
call fcn.00444780
add rsp, 0x30
pop rbp
ret
mov eax, esi
mov ecx, 9
call fcn.00456420
mov eax, edi
mov ecx, 9
nop
call fcn.00456420
nop
call fcn.00454140
jmp fcn.004f0660
Function at 0x4f2e60
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4f2f4c
push rbp
mov rbp, rsp
sub rsp, 0x40
movabs rdx, 0xea646edd8f746507
mov qword [rsp + 0x2c], rdx
movabs rdx, 0x1019dda3ea646edd
mov qword [rsp + 0x30], rdx
movabs rdx, 0x8c6f767461ae726f
mov qword [rsp + 0x38], rdx
movabs rdx, 0xa07001308040903
mov qword [rsp + 0x18], rdx
movabs rdx, 0x70b08130a070013
mov qword [rsp + 0x1c], rdx
movabs rdx, 0xb081103070b0a0e
mov qword [rsp + 0x24], rdx
xor eax, eax
jmp 0x4f2eea
movzx r9d, byte [rsp + rsi + 0x2c]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x50]
mov byte [rsp + rdi + 0x2c], dl
mov byte [rsp + rsi + 0x2c], r8b
add rax, 2
cmp rax, 0x14
jge 0x4f2f1c
movzx edx, byte [rsp + rax + 0x18]
movzx esi, byte [rsp + rax + 0x19]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x14
jae 0x4f2f3f
movzx r8d, byte [rsp + rdi + 0x2c]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x50]
cmp rsi, 0x14
jb 0x4f2ed0
jmp 0x4f2f33
xor eax, eax
lea rbx, [rsp + 0x2c]
mov ecx, 0x14
call fcn.00444780
add rsp, 0x40
pop rbp
ret
mov eax, esi
mov ecx, 0x14
call fcn.00456420
mov eax, edi
mov ecx, 0x14
call fcn.00456420
nop
call fcn.00454140
jmp fcn.004f2e60

Function at 0x4f3da0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4f3e72
push rbp
mov rbp, rsp
sub rsp, 0x38
movabs rdx, 0x6e516b65747d737a
mov qword [rsp + 0x2b], rdx
movabs rdx, 0x57656c47726e516b
mov qword [rsp + 0x30], rdx
movabs rdx, 0x508020106090000
mov qword [rsp + 0x1b], rdx
movabs rdx, 0x900010605060801
mov qword [rsp + 0x23], rdx
xor eax, eax
jmp 0x4f3e0c
movzx r9d, byte [rsp + rsi + 0x2b]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x11]
mov byte [rsp + rdi + 0x2b], dl
mov byte [rsp + rsi + 0x2b], r8b
add rax, 2
cmp rax, 0x10
jge 0x4f3e3e
movzx edx, byte [rsp + rax + 0x1b]
movzx esi, byte [rsp + rax + 0x1c]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0xd
jae 0x4f3e65
movzx r8d, byte [rsp + rdi + 0x2b]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x11]
cmp rsi, 0xd
jb 0x4f3df2
jmp 0x4f3e55
xor eax, eax
lea rbx, [rsp + 0x2b]
mov ecx, 0xd
call fcn.00444780
add rsp, 0x38
pop rbp
ret
mov eax, esi
mov ecx, 0xd
nop dword [rax]
call fcn.00456420
mov eax, edi
mov ecx, 0xd
call fcn.00456420
nop
call fcn.00454140
jmp fcn.004f3da0
Function at 0x4f40c0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4f4178
push rbp
mov rbp, rsp
sub rsp, 0x30
movabs rdx, 0xb74528806563b99f
mov qword [rsp + 0x28], rdx
movabs rdx, 0x405000400050005
mov qword [rsp + 0x1c], rdx
mov dword [rsp + 0x24], 0x5010707
xor eax, eax
jmp 0x4f4119
movzx r9d, byte [rsp + rsi + 0x28]
sub r9d, edx
lea edx, [r9 - 0x37]
mov byte [rsp + rdi + 0x28], dl
lea edx, [r8 - 0x37]
mov byte [rsp + rsi + 0x28], dl
add rax, 2
cmp rax, 0xc
jge 0x4f4148
movzx edx, byte [rsp + rax + 0x1c]
movzx esi, byte [rsp + rax + 0x1d]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 8
jae 0x4f416b
movzx r8d, byte [rsp + rdi + 0x28]
sub r8d, edx
nop
cmp rsi, 8
jb 0x4f40fc
jmp 0x4f415f
xor eax, eax
lea rbx, [rsp + 0x28]
mov ecx, 8
call fcn.00444780
add rsp, 0x30
pop rbp
ret
mov eax, esi
mov ecx, 8
call fcn.00456420
mov eax, edi
mov ecx, 8
call fcn.00456420
nop
call fcn.00454140
nop dword [rax]
jmp fcn.004f40c0

Function at 0x4f41a0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4f429b
push rbp
mov rbp, rsp
sub rsp, 0x50
movabs rdx, 0xd1fcf1a06f236547
mov qword [rsp + 0x3c], rdx
movabs rdx, 0x1d58458ad1fcf1a0
mov qword [rsp + 0x40], rdx
movabs rdx, 0x735916b0616b1cd7
mov qword [rsp + 0x48], rdx
movabs rdx, 0x31103110b020702
mov qword [rsp + 0x1e], rdx
movabs rdx, 0x1005060a0d0a0c0c
mov qword [rsp + 0x26], rdx
movabs rdx, 0xb04100d0b121005
mov qword [rsp + 0x2c], rdx
movabs rdx, 0x308021204070a10
mov qword [rsp + 0x34], rdx
xor eax, eax
jmp 0x4f4239
movzx r9d, byte [rsp + rsi + 0x3c]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x70]
mov byte [rsp + rdi + 0x3c], dl
mov byte [rsp + rsi + 0x3c], r8b
add rax, 2
cmp rax, 0x1e
jge 0x4f426b
movzx edx, byte [rsp + rax + 0x1e]
movzx esi, byte [rsp + rax + 0x1f]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x14
jae 0x4f428e
movzx r8d, byte [rsp + rdi + 0x3c]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x70]
cmp rsi, 0x14
jb 0x4f421f
jmp 0x4f4282
xor eax, eax
lea rbx, [rsp + 0x3c]
mov ecx, 0x14
call fcn.00444780
add rsp, 0x50
pop rbp
ret
mov eax, esi
mov ecx, 0x14
call fcn.00456420
mov eax, edi
mov ecx, 0x14
call fcn.00456420
nop
nop dword [rax + rax]
call fcn.00454140
jmp fcn.004f41a0
Function at 0x4f5340
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4f542a
push rbp
mov rbp, rsp
sub rsp, 0x48
movabs rdx, 0x746e7465696c6552
mov qword [rsp + 0x32], rdx
movabs rdx, 0x322c685e7959746e
mov qword [rsp + 0x38], rdx
movabs rdx, 0x4f7257765d86678d
mov qword [rsp + 0x40], rdx
movabs rdx, 0xc08010b0d0a0c0c
mov qword [rsp + 0x1c], rdx
movabs rdx, 0x15030f0a030b0c08
mov qword [rsp + 0x22], rdx
movabs rdx, 0xe10121112090613
mov qword [rsp + 0x2a], rdx
xor eax, eax
jmp 0x4f53cd
movzx r9d, byte [rsp + rsi + 0x32]
sub r9d, edx
lea edx, [r9 + 0x1a]
mov byte [rsp + rdi + 0x32], dl
lea edx, [r8 + 0x1a]
mov byte [rsp + rsi + 0x32], dl
add rax, 2
cmp rax, 0x16
jge 0x4f53fa
movzx edx, byte [rsp + rax + 0x1c]
movzx esi, byte [rsp + rax + 0x1d]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x16
jae 0x4f541d
movzx r8d, byte [rsp + rdi + 0x32]
sub r8d, edx
cmp rsi, 0x16
jb 0x4f53b0
jmp 0x4f5411
xor eax, eax
lea rbx, [rsp + 0x32]
mov ecx, 0x16
call fcn.00444780
add rsp, 0x48
pop rbp
ret
mov eax, esi
mov ecx, 0x16
call fcn.00456420
mov eax, edi
mov ecx, 0x16
call fcn.00456420
nop
call fcn.00454140
jmp fcn.004f5340

Function at 0x4f6c60
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4f6d26
push rbp
mov rbp, rsp
sub rsp, 0x30
movabs rdx, 0x46e023212111ff33
mov qword [rsp + 0x25], rdx
mov dword [rsp + 0x2c], 0x62ccb46
movabs rdx, 0x504020106000608
mov qword [rsp + 0x19], rdx
mov dword [rsp + 0x21], 0x809030a
xor eax, eax
jmp 0x4f6cc0
movzx r9d, byte [rsp + rsi + 0x25]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x3b]
mov byte [rsp + rdi + 0x25], dl
mov byte [rsp + rsi + 0x25], r8b
add rax, 2
nop
cmp rax, 0xc
jge 0x4f6cf2
movzx edx, byte [rsp + rax + 0x19]
movzx esi, byte [rsp + rax + 0x1a]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0xb
jae 0x4f6d17
movzx r8d, byte [rsp + rdi + 0x25]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x3b]
cmp rsi, 0xb
jb 0x4f6ca4
jmp 0x4f6d0b
xor eax, eax
lea rbx, [rsp + 0x25]
mov ecx, 0xb
nop
call fcn.00444780
add rsp, 0x30
pop rbp
ret
mov eax, esi
mov ecx, 0xb
call fcn.00456420
mov eax, edi
mov ecx, 0xb
nop
call fcn.00456420
nop
call fcn.00454140
jmp fcn.004f6c60
Function at 0x4f92e0
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4f93aa
push rbp
mov rbp, rsp
sub rsp, 0x48
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rbx
mov qword [rsp], rax
mov qword [rsp + 8], rbx
mov byte [rsp + 0x10], 0
call fcn.00403260
xorps xmm15, xmm15
mov r14, qword [0x006bc118]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x18], 0xffffffffffffffff
jne 0x4f938f
mov rcx, qword [rsp + 0x60]
lea rdx, [rcx + 1]
mov qword [rsp + 0x40], rdx
lea rax, [0x00559920]
xor ebx, ebx
mov rcx, rdx
call fcn.004412a0
mov rbx, qword [rsp + 0x60]
mov rcx, rax
xor edi, edi
mov rsi, qword [rsp + 0x40]
mov rax, qword [rsp + 0x58]
nop dword [rax]
call fcn.004f98e0
inc rbx
cmp rcx, rbx
jae 0x4f937e
mov edi, 1
lea rsi, [0x00559920]
call fcn.00441380
mov word [rax + rbx*2 - 2], 0
xor edi, edi
xor esi, esi
add rsp, 0x48
pop rbp
ret
xor eax, eax
xor ebx, ebx
mov rcx, rbx
lea rdi, [0x0059fc08]
lea rsi, [0x0059f878]
add rsp, 0x48
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.00454140
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.004f92e0

Function at 0x4fc5c0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4fc698
push rbp
mov rbp, rsp
sub rsp, 0x38
movabs rdx, 0x4951b498eeed5774
mov qword [rsp + 0x2c], rdx
mov dword [rsp + 0x34], 0xa8d5e4cf
movabs rdx, 0x203060b05070300
mov qword [rsp + 0x1a], rdx
movabs rdx, 0x5010203060b0507
mov qword [rsp + 0x1c], rdx
movabs rdx, 0x4080a05090b0105
mov qword [rsp + 0x24], rdx
xor eax, eax
jmp 0x4fc634
movzx r9d, byte [rsp + rsi + 0x2c]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x7a]
mov byte [rsp + rdi + 0x2c], dl
mov byte [rsp + rsi + 0x2c], r8b
add rax, 2
cmp rax, 0x12
jge 0x4fc668
movzx edx, byte [rsp + rax + 0x1a]
movzx esi, byte [rsp + rax + 0x1b]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0xc
jae 0x4fc68b
movzx r8d, byte [rsp + rdi + 0x2c]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x7a]
nop
cmp rsi, 0xc
jb 0x4fc61a
jmp 0x4fc67f
xor eax, eax
lea rbx, [rsp + 0x2c]
mov ecx, 0xc
call fcn.00444780
add rsp, 0x38
pop rbp
ret
mov eax, esi
mov ecx, 0xc
call fcn.00456420
mov eax, edi
mov ecx, 0xc
call fcn.00456420
nop
call fcn.00454140
nop dword [rax]
jmp fcn.004fc5c0
Function at 0x4fce60
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4fcf4a
push rbp
mov rbp, rsp
sub rsp, 0x48
movabs rdx, 0xfa12c46f8867b895
mov qword [rsp + 0x37], rdx
movabs rdx, 0x4bfa12c46f8867b8
mov qword [rsp + 0x38], rdx
movabs rdx, 0x572008baefa31049
mov qword [rsp + 0x40], rdx
movabs rdx, 0xc08080e010f0007
mov qword [rsp + 0x1f], rdx
movabs rdx, 0xa0b08030d060e0e
mov qword [rsp + 0x27], rdx
movabs rdx, 0xe000008050d010b
mov qword [rsp + 0x2f], rdx
xor eax, eax
jmp 0x4fceed
movzx r9d, byte [rsp + rsi + 0x37]
sub r9d, edx
lea edx, [r9 - 0x41]
mov byte [rsp + rdi + 0x37], dl
lea edx, [r8 - 0x41]
mov byte [rsp + rsi + 0x37], dl
add rax, 2
cmp rax, 0x18
jge 0x4fcf1a
movzx edx, byte [rsp + rax + 0x1f]
movzx esi, byte [rsp + rax + 0x20]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x11
jae 0x4fcf3d
movzx r8d, byte [rsp + rdi + 0x37]
sub r8d, edx
cmp rsi, 0x11
jb 0x4fced0
jmp 0x4fcf31
xor eax, eax
lea rbx, [rsp + 0x37]
mov ecx, 0x11
call fcn.00444780
add rsp, 0x48
pop rbp
ret
mov eax, esi
mov ecx, 0x11
call fcn.00456420
mov eax, edi
mov ecx, 0x11
call fcn.00456420
nop
call fcn.00454140
jmp fcn.004fce60

Function at 0x4fe900
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4fe9dd
push rbp
mov rbp, rsp
sub rsp, 0x40
movabs rdx, 0x29645e6b31133070
mov qword [rsp + 0x30], rdx
movabs rdx, 0x7860395d305b485a
mov qword [rsp + 0x38], rdx
movabs rdx, 0xe08000f02060c07
mov qword [rsp + 0x1e], rdx
movabs rdx, 0x6050e08000f0206
mov qword [rsp + 0x20], rdx
movabs rdx, 0x40908080104030f
mov qword [rsp + 0x28], rdx
xor eax, eax
nop
jmp 0x4fe980
movzx r9d, byte [rsp + rsi + 0x30]
sub r9d, edx
lea edx, [r9 + 0xf]
mov byte [rsp + rdi + 0x30], dl
lea edx, [r8 + 0xf]
mov byte [rsp + rsi + 0x30], dl
add rax, 2
nop
cmp rax, 0x12
jge 0x4fe9ad
movzx edx, byte [rsp + rax + 0x1e]
movzx esi, byte [rsp + rax + 0x1f]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x10
jae 0x4fe9d0
movzx r8d, byte [rsp + rdi + 0x30]
sub r8d, edx
cmp rsi, 0x10
jb 0x4fe962
jmp 0x4fe9c4
xor eax, eax
lea rbx, [rsp + 0x30]
mov ecx, 0x10
call fcn.00444780
add rsp, 0x40
pop rbp
ret
mov eax, esi
mov ecx, 0x10
call fcn.00456420
mov eax, edi
mov ecx, 0x10
call fcn.00456420
nop
nop dword [rax]
call fcn.00454140
jmp fcn.004fe900
Function at 0x4ff5c0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4ff6ac
push rbp
mov rbp, rsp
sub rsp, 0x48
movabs rdx, 0x779163635f726f4d
mov qword [rsp + 0x33], rdx
movabs rdx, 0x646e9d7486779163
mov qword [rsp + 0x38], rdx
movabs rdx, 0x886f79542056c28e
mov qword [rsp + 0x40], rdx
movabs rdx, 0xe1207140a08060e
mov qword [rsp + 0x1d], rdx
movabs rdx, 0xf070d070f0f0e12
mov qword [rsp + 0x23], rdx
movabs rdx, 0x1306030808060606
mov qword [rsp + 0x2b], rdx
xor eax, eax
jmp 0x4ff64a
movzx r9d, byte [rsp + rsi + 0x33]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x29]
mov byte [rsp + rdi + 0x33], dl
mov byte [rsp + rsi + 0x33], r8b
add rax, 2
cmp rax, 0x16
jge 0x4ff67c
movzx edx, byte [rsp + rax + 0x1d]
movzx esi, byte [rsp + rax + 0x1e]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x15
jae 0x4ff69f
movzx r8d, byte [rsp + rdi + 0x33]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x29]
cmp rsi, 0x15
jb 0x4ff630
jmp 0x4ff693
xor eax, eax
lea rbx, [rsp + 0x33]
mov ecx, 0x15
call fcn.00444780
add rsp, 0x48
pop rbp
ret
mov eax, esi
mov ecx, 0x15
call fcn.00456420
mov eax, edi
mov ecx, 0x15
call fcn.00456420
nop
call fcn.00454140
jmp fcn.004ff5c0

Function at 0x4ff6c0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4ff7c8
push rbp
mov rbp, rsp
sub rsp, 0x58
movabs rdx, 0x2c410a688b1dd51c
mov qword [rsp + 0x3e], rdx
movabs rdx, 0xe79a5387ddc72e19
mov qword [rsp + 0x46], rdx
movabs rdx, 0x2f11e79a5387ddc7
mov qword [rsp + 0x48], rdx
movabs rdx, 0x651469541c640e81
mov qword [rsp + 0x50], rdx
movabs rdx, 0xe1108030a050313
mov qword [rsp + 0x1e], rdx
movabs rdx, 0x1513130c0b180808
mov qword [rsp + 0x26], rdx
movabs rdx, 0xf1208010c1112
mov qword [rsp + 0x2e], rdx
movabs rdx, 0x1115070218091000
mov qword [rsp + 0x36], rdx
xor eax, eax
jmp 0x4ff76b
movzx r9d, byte [rsp + rsi + 0x3e]
sub r9d, edx
lea edx, [r9 + 0x6a]
mov byte [rsp + rdi + 0x3e], dl
lea edx, [r8 + 0x6a]
mov byte [rsp + rsi + 0x3e], dl
add rax, 2
cmp rax, 0x20
jge 0x4ff798
movzx edx, byte [rsp + rax + 0x1e]
movzx esi, byte [rsp + rax + 0x1f]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x1a
jae 0x4ff7bb
movzx r8d, byte [rsp + rdi + 0x3e]
sub r8d, edx
cmp rsi, 0x1a
jb 0x4ff74e
jmp 0x4ff7af
xor eax, eax
lea rbx, [rsp + 0x3e]
mov ecx, 0x1a
call fcn.00444780
add rsp, 0x58
pop rbp
ret
mov eax, esi
mov ecx, 0x1a
call fcn.00456420
mov eax, edi
mov ecx, 0x1a
call fcn.00456420
nop
call fcn.00454140
jmp fcn.004ff6c0
Function at 0x500220
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x50031b
push rbp
mov rbp, rsp
sub rsp, 0x50
movabs rdx, 0x5ff372c89a232b45
mov qword [rsp + 0x39], rdx
movabs rdx, 0x966ef074531e615f
mov qword [rsp + 0x40], rdx
movabs rdx, 0xab9e34540e8b8c10
mov qword [rsp + 0x48], rdx
movabs rdx, 0x30c0e011609070c
mov qword [rsp + 0x1b], rdx
movabs rdx, 0x9010115020c0306
mov qword [rsp + 0x23], rdx
movabs rdx, 0x1410070f110f0901
mov qword [rsp + 0x29], rdx
movabs rdx, 0x412021403061507
mov qword [rsp + 0x31], rdx
xor eax, eax
jmp 0x5002b9
movzx r9d, byte [rsp + rsi + 0x39]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x26]
mov byte [rsp + rdi + 0x39], dl
mov byte [rsp + rsi + 0x39], r8b
add rax, 2
cmp rax, 0x1e
jge 0x5002eb
movzx edx, byte [rsp + rax + 0x1b]
movzx esi, byte [rsp + rax + 0x1c]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x17
jae 0x50030e
movzx r8d, byte [rsp + rdi + 0x39]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x26]
cmp rsi, 0x17
jb 0x50029f
jmp 0x500302
xor eax, eax
lea rbx, [rsp + 0x39]
mov ecx, 0x17
call fcn.00444780
add rsp, 0x50
pop rbp
ret
mov eax, esi
mov ecx, 0x17
call fcn.00456420
mov eax, edi
mov ecx, 0x17
call fcn.00456420
nop
nop dword [rax + rax]
call fcn.00454140
jmp fcn.00500220

Function at 0x5015e0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x5016db
push rbp
mov rbp, rsp
sub rsp, 0x50
movabs rdx, 0x848efc74c40c5999
mov qword [rsp + 0x3a], rdx
movabs rdx, 0xabd979cd53c2848e
mov qword [rsp + 0x40], rdx
movabs rdx, 0x6541ccc7d0a76861
mov qword [rsp + 0x48], rdx
movabs rdx, 0x1003131201110205
mov qword [rsp + 0x1a], rdx
movabs rdx, 0x8140210080a0b00
mov qword [rsp + 0x22], rdx
movabs rdx, 0x70507100c100d13
mov qword [rsp + 0x2a], rdx
movabs rdx, 0x6060701120f0a13
mov qword [rsp + 0x32], rdx
xor eax, eax
jmp 0x501679
movzx r9d, byte [rsp + rsi + 0x3a]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x4b]
mov byte [rsp + rdi + 0x3a], dl
mov byte [rsp + rsi + 0x3a], r8b
add rax, 2
cmp rax, 0x20
jge 0x5016ab
movzx edx, byte [rsp + rax + 0x1a]
movzx esi, byte [rsp + rax + 0x1b]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x16
jae 0x5016ce
movzx r8d, byte [rsp + rdi + 0x3a]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x4b]
cmp rsi, 0x16
jb 0x50165f
jmp 0x5016c2
xor eax, eax
lea rbx, [rsp + 0x3a]
mov ecx, 0x16
call fcn.00444780
add rsp, 0x50
pop rbp
ret
mov eax, esi
mov ecx, 0x16
call fcn.00456420
mov eax, edi
mov ecx, 0x16
call fcn.00456420
nop
nop dword [rax + rax]
call fcn.00454140
jmp fcn.005015e0
Function at 0x504e40
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x504f3d
push rbp
mov rbp, rsp
sub rsp, 0x50
movabs rdx, 0xcd7473b257954153
mov qword [rsp + 0x38], rdx
movabs rdx, 0x646e618caeb2af32
mov qword [rsp + 0x40], rdx
movabs rdx, 0x8d03feac67d272d3
mov qword [rsp + 0x48], rdx
movabs rdx, 0x71015040a091309
mov qword [rsp + 0x1a], rdx
movabs rdx, 0x15170c1416041312
mov qword [rsp + 0x22], rdx
movabs rdx, 0x130809070b161517
mov qword [rsp + 0x28], rdx
movabs rdx, 0x1002100b0b130402
mov qword [rsp + 0x30], rdx
xor eax, eax
jmp 0x504ee0
movzx r9d, byte [rsp + rsi + 0x38]
sub r9d, edx
lea edx, [r9 - 0x14]
mov byte [rsp + rdi + 0x38], dl
lea edx, [r8 - 0x14]
mov byte [rsp + rsi + 0x38], dl
add rax, 2
nop dword [rax]
cmp rax, 0x1e
jge 0x504f0d
movzx edx, byte [rsp + rax + 0x1a]
movzx esi, byte [rsp + rax + 0x1b]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x18
jae 0x504f30
movzx r8d, byte [rsp + rdi + 0x38]
sub r8d, edx
cmp rsi, 0x18
jb 0x504ebf
jmp 0x504f24
xor eax, eax
lea rbx, [rsp + 0x38]
mov ecx, 0x18
call fcn.00444780
add rsp, 0x50
pop rbp
ret
mov eax, esi
mov ecx, 0x18
call fcn.00456420
mov eax, edi
mov ecx, 0x18
call fcn.00456420
nop
nop dword [rax]
call fcn.00454140
jmp fcn.00504e40

Function at 0x507960
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x507a5b
push rbp
mov rbp, rsp
sub rsp, 0x50
movabs rdx, 0x4e06186605633633
mov qword [rsp + 0x38], rdx
movabs rdx, 0x333a22742f203050
mov qword [rsp + 0x40], rdx
movabs rdx, 0x196d160e42360d3f
mov qword [rsp + 0x48], rdx
movabs rdx, 0xf081413110b0d0e
mov qword [rsp + 0x1c], rdx
movabs rdx, 0xb111505171509
mov qword [rsp + 0x24], rdx
movabs rdx, 0x12060703000b1115
mov qword [rsp + 0x28], rdx
movabs rdx, 0x80e17100d050112
mov qword [rsp + 0x30], rdx
xor eax, eax
jmp 0x5079f9
movzx r9d, byte [rsp + rsi + 0x38]
lea edx, [r9 + rdx]
lea edx, [rdx + 7]
mov byte [rsp + rdi + 0x38], dl
mov byte [rsp + rsi + 0x38], r8b
add rax, 2
cmp rax, 0x1c
jge 0x507a2b
movzx edx, byte [rsp + rax + 0x1c]
movzx esi, byte [rsp + rax + 0x1d]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x18
jae 0x507a4e
movzx r8d, byte [rsp + rdi + 0x38]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 7]
cmp rsi, 0x18
jb 0x5079df
jmp 0x507a42
xor eax, eax
lea rbx, [rsp + 0x38]
mov ecx, 0x18
call fcn.00444780
add rsp, 0x50
pop rbp
ret
mov eax, esi
mov ecx, 0x18
call fcn.00456420
mov eax, edi
mov ecx, 0x18
call fcn.00456420
nop
nop dword [rax + rax]
call fcn.00454140
jmp fcn.00507960