joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4975c0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4976ac
push rbp
mov rbp, rsp
sub rsp, 0x48
movabs rdx, 0xd56e40c6e45b45dd
mov qword [rsp + 0x1f], rdx
movabs rdx, 0xa4d56e40c6e45b45
mov qword [rsp + 0x20], rdx
movabs rdx, 0xd0dec96b6d658579
mov qword [rsp + 0x28], rdx
movabs rdx, 0xe0005100110080c
mov qword [rsp + 0x30], rdx
movabs rdx, 0xf0f080005000f02
mov qword [rsp + 0x38], rdx
movabs rdx, 0xa07050304100301
mov qword [rsp + 0x40], rdx
xor eax, eax
jmp 0x49764a
movzx r9d, byte [rsp + rsi + 0x1f]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x78]
mov byte [rsp + rdi + 0x1f], dl
mov byte [rsp + rsi + 0x1f], r8b
add rax, 2
cmp rax, 0x18
jge 0x49767c
movzx edx, byte [rsp + rax + 0x30]
movzx esi, byte [rsp + rax + 0x31]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x11
jae 0x49769f
movzx r8d, byte [rsp + rdi + 0x1f]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x78]
cmp rsi, 0x11
jb 0x497630
jmp 0x497693
xor eax, eax
lea rbx, [rsp + 0x1f]
mov ecx, 0x11
call fcn.00441380
add rsp, 0x48
pop rbp
ret
mov eax, esi
mov ecx, 0x11
call fcn.00451880
mov eax, edi
mov ecx, 0x11
call fcn.00451880
nop
call fcn.0044f600
jmp fcn.004975c0

Function at 0x499700
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4997c7
push rbp
mov rbp, rsp
sub rsp, 0x38
movabs rdx, 0x7562f277a0697c6b
mov qword [rsp + 0x1c], rdx
mov dword [rsp + 0x24], 0xe6f98366
movabs rdx, 0x5030a01020a000a
mov qword [rsp + 0x28], rdx
movabs rdx, 0xa0b0b040b090a00
mov qword [rsp + 0x30], rdx
xor eax, eax
jmp 0x499768
movzx r9d, byte [rsp + rsi + 0x1c]
sub r9d, edx
lea edx, [r9 - 0x74]
mov byte [rsp + rdi + 0x1c], dl
lea edx, [r8 - 0x74]
mov byte [rsp + rsi + 0x1c], dl
add rax, 2
cmp rax, 0x10
jge 0x499797
movzx edx, byte [rsp + rax + 0x28]
movzx esi, byte [rsp + rax + 0x29]
mov edi, edx
xor edx, esi
add edx, eax
nop
cmp rdi, 0xc
jae 0x4997ba
movzx r8d, byte [rsp + rdi + 0x1c]
sub r8d, edx
cmp rsi, 0xc
jb 0x49974b
jmp 0x4997ae
xor eax, eax
lea rbx, [rsp + 0x1c]
mov ecx, 0xc
call fcn.00441380
add rsp, 0x38
pop rbp
ret
mov eax, esi
mov ecx, 0xc
call fcn.00451880
mov eax, edi
mov ecx, 0xc
call fcn.00451880
nop
call fcn.0044f600
jmp fcn.00499700
Function at 0x4997e0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4998c6
push rbp
mov rbp, rsp
sub rsp, 0x40
movabs rdx, 0x96b790ab22d76ea6
mov qword [rsp + 0x1e], rdx
movabs rdx, 0x46a6a8e2d3cf96b7
mov qword [rsp + 0x24], rdx
movabs rdx, 0x306090b0309050c
mov qword [rsp + 0x2c], rdx
movabs rdx, 0x7080a060306090b
mov qword [rsp + 0x30], rdx
movabs rdx, 0xb07040006070207
mov qword [rsp + 0x38], rdx
xor eax, eax
nop
jmp 0x499860
movzx r9d, byte [rsp + rsi + 0x1e]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x4a]
mov byte [rsp + rdi + 0x1e], dl
mov byte [rsp + rsi + 0x1e], r8b
add rax, 2
nop dword [rax]
cmp rax, 0x14
jge 0x499892
movzx edx, byte [rsp + rax + 0x2c]
movzx esi, byte [rsp + rax + 0x2d]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0xe
jae 0x4998b7
movzx r8d, byte [rsp + rdi + 0x1e]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x4a]
cmp rsi, 0xe
jb 0x499842
jmp 0x4998ab
xor eax, eax
lea rbx, [rsp + 0x1e]
mov ecx, 0xe
nop
call fcn.00441380
add rsp, 0x40
pop rbp
ret
mov eax, esi
mov ecx, 0xe
call fcn.00451880
mov eax, edi
mov ecx, 0xe
nop
call fcn.00451880
nop
call fcn.0044f600
jmp fcn.004997e0
Function at 0x49c720
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x49c7ea
push rbp
mov rbp, rsp
sub rsp, 0x48
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x58], rax
mov qword [rsp], rax
mov qword [rsp + 8], rbx
mov byte [rsp + 0x10], 0
call fcn.00403080
xorps xmm15, xmm15
mov r14, qword [0x007b0990]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x18], 0xffffffffffffffff
jne 0x49c7cf
mov rcx, qword [rsp + 0x60]
lea rdx, [rcx + 1]
mov qword [rsp + 0x40], rdx
lea rax, [0x005213a0]
xor ebx, ebx
mov rcx, rdx
call fcn.0043dec0
mov rbx, qword [rsp + 0x60]
mov rcx, rax
xor edi, edi
mov rsi, qword [rsp + 0x40]
mov rax, qword [rsp + 0x58]
nop dword [rax]
call fcn.0049ea20
inc rbx
cmp rcx, rbx
jae 0x49c7be
mov edi, 1
lea rsi, [0x005213a0]
call fcn.0043dfa0
mov word [rax + rbx*2 - 2], 0
xor edi, edi
xor esi, esi
add rsp, 0x48
pop rbp
ret
xor eax, eax
xor ebx, ebx
mov rcx, rbx
lea rdi, [0x006cb888]
lea rsi, [0x006cb4f0]
add rsp, 0x48
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.0044f600
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.0049c720

Function at 0x49dc80
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x49dd4c
push rbp
mov rbp, rsp
sub rsp, 0x38
movabs rdx, 0xddec60e6d26172db
mov qword [rsp + 0x1f], rdx
movabs rdx, 0xe87016ddec60e6d2
mov qword [rsp + 0x22], rdx
movabs rdx, 0x204050800030a07
mov qword [rsp + 0x2a], rdx
movabs rdx, 0x605080604080204
mov qword [rsp + 0x30], rdx
xor eax, eax
jmp 0x49dcef
movzx r9d, byte [rsp + rsi + 0x1f]
sub r9d, edx
lea edx, [r9 - 0x6b]
mov byte [rsp + rdi + 0x1f], dl
lea edx, [r8 - 0x6b]
mov byte [rsp + rsi + 0x1f], dl
add rax, 2
cmp rax, 0xe
jge 0x49dd1c
movzx edx, byte [rsp + rax + 0x2a]
movzx esi, byte [rsp + rax + 0x2b]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0xb
jae 0x49dd3f
movzx r8d, byte [rsp + rdi + 0x1f]
sub r8d, edx
cmp rsi, 0xb
jb 0x49dcd2
jmp 0x49dd33
xor eax, eax
lea rbx, [rsp + 0x1f]
mov ecx, 0xb
call fcn.00441380
add rsp, 0x38
pop rbp
ret
mov eax, esi
mov ecx, 0xb
call fcn.00451880
mov eax, edi
mov ecx, 0xb
call fcn.00451880
nop
call fcn.0044f600
jmp fcn.0049dc80
Function at 0x49e940
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov qword [rsp + 0x40], 0
movabs rdx, 0xa9c4bb8c7020ae3c
mov qword [rsp + 0x1e], rdx
movabs rdx, 0x702020106000105
mov qword [rsp + 0x26], rdx
mov word [rsp + 0x2e], 0x703
xor eax, eax
jmp 0x49e994
movzx r8d, byte [rsp + rbx + 0x1e]
lea edx, [r8 + rdx]
lea edx, [rdx - 0x3e]
mov byte [rsp + rsi + 0x1e], dl
mov byte [rsp + rbx + 0x1e], dil
add rax, 2
cmp rax, 0xa
jge 0x49e9c8
movzx edx, byte [rsp + rax + 0x26]
movzx ebx, byte [rsp + rax + 0x27]
mov esi, edx
xor edx, ebx
add edx, eax
cmp rsi, 8
jae 0x49ea05
movzx edi, byte [rsp + rsi + 0x1e]
lea edi, [rdi + rdx]
lea edi, [rdi - 0x3e]
nop dword [rax + rax]
cmp rbx, 8
jb 0x49e97a
jmp 0x49e9f7
mov qword [rsp + 0x16], 0
xor eax, eax
jmp 0x49e9e1
movzx ecx, byte [rsp + rax + 0x1e]
mov byte [rsp + rax + 0x16], cl
inc rax
cmp rax, 8
jl 0x49e9d5
mov rax, qword [rsp + 0x16]
mov qword [rsp + 0x40], rax
add rsp, 0x30
pop rbp
ret
mov eax, ebx
mov ecx, 8
nop
call fcn.00451880
mov eax, esi
mov ecx, 8
call fcn.00451880
nop
int3

Function at 0x49f7e0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x49f8e8
push rbp
mov rbp, rsp
sub rsp, 0x58
movabs rdx, 0x6e95743961896d91
mov qword [rsp + 0x19], rdx
movabs rdx, 0x69726e6e67587330
mov qword [rsp + 0x21], rdx
movabs rdx, 0x6488707365757f69
mov qword [rsp + 0x28], rdx
movabs rdx, 0x1a7a6d7258647e6d
mov qword [rsp + 0x30], rdx
movabs rdx, 0x1a180f0d1e170a03
mov qword [rsp + 0x38], rdx
movabs rdx, 0x3011a1a141a020d
mov qword [rsp + 0x40], rdx
movabs rdx, 0x6071a1c0f07040f
mov qword [rsp + 0x48], rdx
movabs rdx, 0x1d150d0814000710
mov qword [rsp + 0x50], rdx
xor eax, eax
jmp 0x49f88b
movzx r9d, byte [rsp + rsi + 0x19]
sub r9d, edx
lea edx, [r9 + 0x11]
mov byte [rsp + rdi + 0x19], dl
lea edx, [r8 + 0x11]
mov byte [rsp + rsi + 0x19], dl
add rax, 2
cmp rax, 0x20
jge 0x49f8b8
movzx edx, byte [rsp + rax + 0x38]
movzx esi, byte [rsp + rax + 0x39]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x1f
jae 0x49f8db
movzx r8d, byte [rsp + rdi + 0x19]
sub r8d, edx
cmp rsi, 0x1f
jb 0x49f86e
jmp 0x49f8cf
xor eax, eax
lea rbx, [rsp + 0x19]
mov ecx, 0x1f
call fcn.00441380
add rsp, 0x58
pop rbp
ret
mov eax, esi
mov ecx, 0x1f
call fcn.00451880
mov eax, edi
mov ecx, 0x1f
call fcn.00451880
nop
call fcn.0044f600
jmp fcn.0049f7e0
Function at 0x49fce0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x49fdfa
push rbp
mov rbp, rsp
sub rsp, 0x60
movabs rdx, 0xa4cf8175e8bfe0df
mov qword [rsp + 0x18], rdx
movabs rdx, 0xddf9e6546d657420
mov qword [rsp + 0x20], rdx
movabs rdx, 0x5754498579cde5eb
mov qword [rsp + 0x28], rdx
movabs rdx, 0xd4c6dc616c69dac2
mov qword [rsp + 0x30], rdx
movabs rdx, 0x1907000e14070503
mov qword [rsp + 0x38], rdx
movabs rdx, 0x19051d0f10031718
mov qword [rsp + 0x40], rdx
movabs rdx, 0x1817111911051601
mov qword [rsp + 0x48], rdx
movabs rdx, 0x1e060c15010e0c0e
mov qword [rsp + 0x50], rdx
movabs rdx, 0x1802121f0c0d1902
mov qword [rsp + 0x58], rdx
xor eax, eax
jmp 0x49fd97
movzx r9d, byte [rsp + rsi + 0x18]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x67]
mov byte [rsp + rdi + 0x18], dl
mov byte [rsp + rsi + 0x18], r8b
add rax, 2
cmp rax, 0x28
jge 0x49fdc9
movzx edx, byte [rsp + rax + 0x38]
movzx esi, byte [rsp + rax + 0x39]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x20
jae 0x49fded
movzx r8d, byte [rsp + rdi + 0x18]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x67]
cmp rsi, 0x20
jb 0x49fd7d
jmp 0x49fde1
xor eax, eax
lea rbx, [rsp + 0x18]
mov ecx, 0x20
call fcn.00441380
add rsp, 0x60
pop rbp
nop
ret
mov eax, esi
mov ecx, 0x20
call fcn.00451880
mov eax, edi
mov ecx, 0x20
call fcn.00451880
nop
call fcn.0044f600
nop
jmp fcn.0049fce0

Function at 0x49ff40
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4a002a
push rbp
mov rbp, rsp
sub rsp, 0x40
movabs rdx, 0x656c3766d7643133
mov qword [rsp + 0x19], rdx
movabs rdx, 0x656420656c3766d7
mov qword [rsp + 0x1c], rdx
movabs rdx, 0xd76ff0a1f4c66380
mov qword [rsp + 0x24], rdx
movabs rdx, 0xe100d0d12030b0b
mov qword [rsp + 0x2c], rdx
movabs rdx, 0x100501120e100d0d
mov qword [rsp + 0x30], rdx
movabs rdx, 0x800000f0e0d0b0e
mov qword [rsp + 0x38], rdx
xor eax, eax
jmp 0x49ffcd
movzx r9d, byte [rsp + rsi + 0x19]
sub r9d, edx
lea edx, [r9 + 0x5c]
mov byte [rsp + rdi + 0x19], dl
lea edx, [r8 + 0x5c]
mov byte [rsp + rsi + 0x19], dl
add rax, 2
cmp rax, 0x14
jge 0x49fffa
movzx edx, byte [rsp + rax + 0x2c]
movzx esi, byte [rsp + rax + 0x2d]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x13
jae 0x4a001d
movzx r8d, byte [rsp + rdi + 0x19]
sub r8d, edx
cmp rsi, 0x13
jb 0x49ffb0
jmp 0x4a0011
xor eax, eax
lea rbx, [rsp + 0x19]
mov ecx, 0x13
call fcn.00441380
add rsp, 0x40
pop rbp
ret
mov eax, esi
mov ecx, 0x13
call fcn.00451880
mov eax, edi
mov ecx, 0x13
call fcn.00451880
nop
call fcn.0044f600
jmp fcn.0049ff40
Function at 0x4a07e0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4a08e8
push rbp
mov rbp, rsp
sub rsp, 0x58
movabs rdx, 0x606402b4f892601f
mov qword [rsp + 0x1e], rdx
movabs rdx, 0x2049f865f8710641
mov qword [rsp + 0x26], rdx
movabs rdx, 0x65622049f865f871
mov qword [rsp + 0x28], rdx
movabs rdx, 0x726f21706916630f
mov qword [rsp + 0x30], rdx
movabs rdx, 0xd050e10030b0203
mov qword [rsp + 0x38], rdx
movabs rdx, 0xe03041210010b08
mov qword [rsp + 0x40], rdx
movabs rdx, 0x70b01100809070b
mov qword [rsp + 0x48], rdx
movabs rdx, 0x31201170e011400
mov qword [rsp + 0x50], rdx
xor eax, eax
jmp 0x4a088b
movzx r9d, byte [rsp + rsi + 0x1e]
sub r9d, edx
lea edx, [r9 + 0x7f]
mov byte [rsp + rdi + 0x1e], dl
lea edx, [r8 + 0x7f]
mov byte [rsp + rsi + 0x1e], dl
add rax, 2
cmp rax, 0x20
jge 0x4a08b8
movzx edx, byte [rsp + rax + 0x38]
movzx esi, byte [rsp + rax + 0x39]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x1a
jae 0x4a08db
movzx r8d, byte [rsp + rdi + 0x1e]
sub r8d, edx
cmp rsi, 0x1a
jb 0x4a086e
jmp 0x4a08cf
xor eax, eax
lea rbx, [rsp + 0x1e]
mov ecx, 0x1a
call fcn.00441380
add rsp, 0x58
pop rbp
ret
mov eax, esi
mov ecx, 0x1a
call fcn.00451880
mov eax, edi
mov ecx, 0x1a
call fcn.00451880
nop
call fcn.0044f600
jmp fcn.004a07e0

Function at 0x4a0cc0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4a0dac
push rbp
mov rbp, rsp
sub rsp, 0x48
movabs rdx, 0xc372a5bb08c46a62
mov qword [rsp + 0x1c], rdx
movabs rdx, 0xbdcf66abc372a5bb
mov qword [rsp + 0x20], rdx
movabs rdx, 0x1f26d20c9bbc065
mov qword [rsp + 0x28], rdx
movabs rdx, 0x20b07130f0a0310
mov qword [rsp + 0x30], rdx
movabs rdx, 0x2031205060d0e04
mov qword [rsp + 0x38], rdx
movabs rdx, 0x205010803020710
mov qword [rsp + 0x40], rdx
xor eax, eax
jmp 0x4a0d4a
movzx r9d, byte [rsp + rsi + 0x1c]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x67]
mov byte [rsp + rdi + 0x1c], dl
mov byte [rsp + rsi + 0x1c], r8b
add rax, 2
cmp rax, 0x18
jge 0x4a0d7c
movzx edx, byte [rsp + rax + 0x30]
movzx esi, byte [rsp + rax + 0x31]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x14
jae 0x4a0d9f
movzx r8d, byte [rsp + rdi + 0x1c]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x67]
cmp rsi, 0x14
jb 0x4a0d30
jmp 0x4a0d93
xor eax, eax
lea rbx, [rsp + 0x1c]
mov ecx, 0x14
call fcn.00441380
add rsp, 0x48
pop rbp
ret
mov eax, esi
mov ecx, 0x14
call fcn.00451880
mov eax, edi
mov ecx, 0x14
call fcn.00451880
nop
call fcn.0044f600
jmp fcn.004a0cc0
Function at 0x4a1f80
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4a207d
push rbp
mov rbp, rsp
sub rsp, 0x50
movabs rdx, 0x1d748198260f11d2
mov qword [rsp + 0x18], rdx
movabs rdx, 0x72941d6582201f1f
mov qword [rsp + 0x20], rdx
movabs rdx, 0x13652f9a10c66220
mov qword [rsp + 0x28], rdx
movabs rdx, 0x41713140f141200
mov qword [rsp + 0x30], rdx
movabs rdx, 0x5010202070b0e01
mov qword [rsp + 0x38], rdx
movabs rdx, 0x3150d080807090f
mov qword [rsp + 0x40], rdx
movabs rdx, 0x9120500010917
mov qword [rsp + 0x48], rdx
xor eax, eax
jmp 0x4a2020
movzx r9d, byte [rsp + rsi + 0x18]
sub r9d, edx
lea edx, [r9 + 0x6b]
mov byte [rsp + rdi + 0x18], dl
lea edx, [r8 + 0x6b]
mov byte [rsp + rsi + 0x18], dl
add rax, 2
nop dword [rax]
cmp rax, 0x20
jge 0x4a204d
movzx edx, byte [rsp + rax + 0x30]
movzx esi, byte [rsp + rax + 0x31]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x18
jae 0x4a2070
movzx r8d, byte [rsp + rdi + 0x18]
sub r8d, edx
cmp rsi, 0x18
jb 0x4a1fff
jmp 0x4a2064
xor eax, eax
lea rbx, [rsp + 0x18]
mov ecx, 0x18
call fcn.00441380
add rsp, 0x50
pop rbp
ret
mov eax, esi
mov ecx, 0x18
call fcn.00451880
mov eax, edi
mov ecx, 0x18
call fcn.00451880
nop
nop dword [rax]
call fcn.0044f600
jmp fcn.004a1f80

Function at 0x4a2480
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4a2588
push rbp
mov rbp, rsp
sub rsp, 0x58
movabs rdx, 0xd97ecfd889736564
mov qword [rsp + 0x1c], rdx
movabs rdx, 0xd8056441d96e0cfe
mov qword [rsp + 0x24], rdx
movabs rdx, 0xe9296865d8056441
mov qword [rsp + 0x28], rdx
movabs rdx, 0x6465ed7996fa6509
mov qword [rsp + 0x30], rdx
movabs rdx, 0xc050711070f1903
mov qword [rsp + 0x38], rdx
movabs rdx, 0x13190b0605041807
mov qword [rsp + 0x40], rdx
movabs rdx, 0x170b110e12160f16
mov qword [rsp + 0x48], rdx
movabs rdx, 0x914070813130b16
mov qword [rsp + 0x50], rdx
xor eax, eax
jmp 0x4a252b
movzx r9d, byte [rsp + rsi + 0x1c]
sub r9d, edx
lea edx, [r9 - 0x5f]
mov byte [rsp + rdi + 0x1c], dl
lea edx, [r8 - 0x5f]
mov byte [rsp + rsi + 0x1c], dl
add rax, 2
cmp rax, 0x20
jge 0x4a2558
movzx edx, byte [rsp + rax + 0x38]
movzx esi, byte [rsp + rax + 0x39]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x1c
jae 0x4a257b
movzx r8d, byte [rsp + rdi + 0x1c]
sub r8d, edx
cmp rsi, 0x1c
jb 0x4a250e
jmp 0x4a256f
xor eax, eax
lea rbx, [rsp + 0x1c]
mov ecx, 0x1c
call fcn.00441380
add rsp, 0x58
pop rbp
ret
mov eax, esi
mov ecx, 0x1c
call fcn.00451880
mov eax, edi
mov ecx, 0x1c
call fcn.00451880
nop
call fcn.0044f600
jmp fcn.004a2480
Function at 0x4a3620
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4a370a
push rbp
mov rbp, rsp
sub rsp, 0x40
movabs rdx, 0x6938690b6e471335
mov qword [rsp + 0x18], rdx
movabs rdx, 0xc1656938690b6e47
mov qword [rsp + 0x1a], rdx
movabs rdx, 0x9436ea6f372a3532
mov qword [rsp + 0x22], rdx
movabs rdx, 0xa090b0f0f0f0d11
mov qword [rsp + 0x2a], rdx
movabs rdx, 0x40d01100a010a09
mov qword [rsp + 0x30], rdx
movabs rdx, 0x20d00060a040c0c
mov qword [rsp + 0x38], rdx
xor eax, eax
jmp 0x4a36ad
movzx r9d, byte [rsp + rsi + 0x18]
sub r9d, edx
lea edx, [r9 + 0x49]
mov byte [rsp + rdi + 0x18], dl
lea edx, [r8 + 0x49]
mov byte [rsp + rsi + 0x18], dl
add rax, 2
cmp rax, 0x16
jge 0x4a36da
movzx edx, byte [rsp + rax + 0x2a]
movzx esi, byte [rsp + rax + 0x2b]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x12
jae 0x4a36fd
movzx r8d, byte [rsp + rdi + 0x18]
sub r8d, edx
cmp rsi, 0x12
jb 0x4a3690
jmp 0x4a36f1
xor eax, eax
lea rbx, [rsp + 0x18]
mov ecx, 0x12
call fcn.00441380
add rsp, 0x40
pop rbp
ret
mov eax, esi
mov ecx, 0x12
call fcn.00451880
mov eax, edi
mov ecx, 0x12
call fcn.00451880
nop
call fcn.0044f600
jmp fcn.004a3620

Function at 0x4a3720
Capabilities:
Encrypt data using rc4 prga

Disassembly:
lea r12, [rsp - 8]
cmp r12, qword [r14 + 0x10]
jbe 0x4a388c
push rbp
mov rbp, rsp
add rsp, 0xffffffffffffff80
movabs rdx, 0x3a1c6922eeb1ebe3
mov qword [rsp + 0x19], rdx
movabs rdx, 0xaf3a1c6922eeb1eb
mov qword [rsp + 0x1a], rdx
movabs rdx, 0x2786eb632369d672
mov qword [rsp + 0x22], rdx
movabs rdx, 0x7d756d2017e7326c
mov qword [rsp + 0x2a], rdx
movabs rdx, 0xe4d51c74796269cd
mov qword [rsp + 0x32], rdx
movabs rdx, 0x720e19569c8d972
mov qword [rsp + 0x3a], rdx
movabs rdx, 0x7214056330e7611c
mov qword [rsp + 0x42], rdx
movabs rdx, 0x2030f012b0a1300
mov qword [rsp + 0x4a], rdx
movabs rdx, 0x2e22081f0c2c0203
mov qword [rsp + 0x50], rdx
movabs rdx, 0x11f2803002f1326
mov qword [rsp + 0x58], rdx
movabs rdx, 0x32319130418070e
mov qword [rsp + 0x60], rdx
movabs rdx, 0x22201f23041e1f25
mov qword [rsp + 0x68], rdx
movabs rdx, 0x82e0101022b1012
mov qword [rsp + 0x70], rdx
movabs rdx, 0x1303060f2928141e
mov qword [rsp + 0x78], rdx
xor eax, eax
jmp 0x4a3827
movzx r9d, byte [rsp + rsi + 0x19]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x16]
mov byte [rsp + rdi + 0x19], dl
mov byte [rsp + rsi + 0x19], r8b
add rax, 2
cmp rax, 0x36
jge 0x4a385c
movzx edx, byte [rsp + rax + 0x4a]
movzx esi, byte [rsp + rax + 0x4b]
mov edi, edx
xor edx, esi
add edx, eax
nop dword [rax]
cmp rdi, 0x31
jae 0x4a387f
movzx r8d, byte [rsp + rdi + 0x19]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x16]
cmp rsi, 0x31
jb 0x4a380d
jmp 0x4a3873
xor eax, eax
lea rbx, [rsp + 0x19]
mov ecx, 0x31
call fcn.00441380
sub rsp, 0xffffffffffffff80
pop rbp
ret
mov eax, esi
mov ecx, 0x31
call fcn.00451880
mov eax, edi
mov ecx, 0x31
call fcn.00451880
nop
call fcn.0044f600
jmp fcn.004a3720
Function at 0x4a4860
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4a4968
push rbp
mov rbp, rsp
sub rsp, 0x58
movabs rdx, 0x20b2bc77dbf79e5e
mov qword [rsp + 0x1f], rdx
movabs rdx, 0x5cd91e63659da48b
mov qword [rsp + 0x27], rdx
movabs rdx, 0xd8a0a95cd91e6365
mov qword [rsp + 0x2a], rdx
movabs rdx, 0x43e2b4767291aec1
mov qword [rsp + 0x32], rdx
movabs rdx, 0xe08011a0a02131a
mov qword [rsp + 0x3a], rdx
movabs rdx, 0x11140a14120d1519
mov qword [rsp + 0x42], rdx
movabs rdx, 0x10000d0912031114
mov qword [rsp + 0x48], rdx
movabs rdx, 0x518151208060f03
mov qword [rsp + 0x50], rdx
xor eax, eax
jmp 0x4a490b
movzx r9d, byte [rsp + rsi + 0x1f]
sub r9d, edx
lea edx, [r9 - 0x1a]
mov byte [rsp + rdi + 0x1f], dl
lea edx, [r8 - 0x1a]
mov byte [rsp + rsi + 0x1f], dl
add rax, 2
cmp rax, 0x1e
jge 0x4a4938
movzx edx, byte [rsp + rax + 0x3a]
movzx esi, byte [rsp + rax + 0x3b]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x1b
jae 0x4a495b
movzx r8d, byte [rsp + rdi + 0x1f]
sub r8d, edx
cmp rsi, 0x1b
jb 0x4a48ee
jmp 0x4a494f
xor eax, eax
lea rbx, [rsp + 0x1f]
mov ecx, 0x1b
call fcn.00441380
add rsp, 0x58
pop rbp
ret
mov eax, esi
mov ecx, 0x1b
call fcn.00451880
mov eax, edi
mov ecx, 0x1b
call fcn.00451880
nop
call fcn.0044f600
jmp fcn.004a4860

Function at 0x4a4d60
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4a4e5b
push rbp
mov rbp, rsp
sub rsp, 0x50
movabs rdx, 0xf832206cfea91d02
mov qword [rsp + 0x1e], rdx
movabs rdx, 0x63f95973207481b4
mov qword [rsp + 0x26], rdx
movabs rdx, 0x16b3edfa0c98a313
mov qword [rsp + 0x2e], rdx
movabs rdx, 0x171301020d011208
mov qword [rsp + 0x36], rdx
movabs rdx, 0x1607020912090114
mov qword [rsp + 0x3e], rdx
movabs rdx, 0x1011160702091209
mov qword [rsp + 0x40], rdx
movabs rdx, 0xe15000802100312
mov qword [rsp + 0x48], rdx
xor eax, eax
jmp 0x4a4df9
movzx r9d, byte [rsp + rsi + 0x1e]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x4e]
mov byte [rsp + rdi + 0x1e], dl
mov byte [rsp + rsi + 0x1e], r8b
add rax, 2
cmp rax, 0x1a
jge 0x4a4e2b
movzx edx, byte [rsp + rax + 0x36]
movzx esi, byte [rsp + rax + 0x37]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x18
jae 0x4a4e4e
movzx r8d, byte [rsp + rdi + 0x1e]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x4e]
cmp rsi, 0x18
jb 0x4a4ddf
jmp 0x4a4e42
xor eax, eax
lea rbx, [rsp + 0x1e]
mov ecx, 0x18
call fcn.00441380
add rsp, 0x50
pop rbp
ret
mov eax, esi
mov ecx, 0x18
call fcn.00451880
mov eax, edi
mov ecx, 0x18
call fcn.00451880
nop
nop dword [rax + rax]
call fcn.0044f600
jmp fcn.004a4d60
Function at 0x4a4e80
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4a4f52
push rbp
mov rbp, rsp
sub rsp, 0x38
movabs rdx, 0x495a146c2176656c
mov qword [rsp + 0x1a], rdx
movabs rdx, 0x5e501d566861495a
mov qword [rsp + 0x20], rdx
movabs rdx, 0x60c090805030703
mov qword [rsp + 0x28], rdx
movabs rdx, 0xb060d0a06030503
mov qword [rsp + 0x30], rdx
xor eax, eax
jmp 0x4a4eec
movzx r9d, byte [rsp + rsi + 0x1a]
lea edx, [r9 + rdx]
lea edx, [rdx - 5]
mov byte [rsp + rdi + 0x1a], dl
mov byte [rsp + rsi + 0x1a], r8b
add rax, 2
cmp rax, 0x10
jge 0x4a4f1e
movzx edx, byte [rsp + rax + 0x28]
movzx esi, byte [rsp + rax + 0x29]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0xe
jae 0x4a4f45
movzx r8d, byte [rsp + rdi + 0x1a]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 5]
cmp rsi, 0xe
jb 0x4a4ed2
jmp 0x4a4f35
xor eax, eax
lea rbx, [rsp + 0x1a]
mov ecx, 0xe
call fcn.00441380
add rsp, 0x38
pop rbp
ret
mov eax, esi
mov ecx, 0xe
nop dword [rax]
call fcn.00451880
mov eax, edi
mov ecx, 0xe
call fcn.00451880
nop
call fcn.0044f600
jmp fcn.004a4e80

Function at 0x4a5b20
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4a5c47
push rbp
mov rbp, rsp
sub rsp, 0x68
movabs rdx, 0xc83d746fffa8618e
mov qword [rsp + 0x1d], rdx
movabs rdx, 0x61ddfd1155c83d74
mov qword [rsp + 0x22], rdx
movabs rdx, 0x9c64657261e573dd
mov qword [rsp + 0x2a], rdx
movabs rdx, 0x40f976048b62696c
mov qword [rsp + 0x32], rdx
movabs rdx, 0xf26c9f0f0dee6964
mov qword [rsp + 0x3a], rdx
movabs rdx, 0x819180d0719001c
mov qword [rsp + 0x42], rdx
movabs rdx, 0x9061b21091a0819
mov qword [rsp + 0x48], rdx
movabs rdx, 0x7140009080b2008
mov qword [rsp + 0x50], rdx
movabs rdx, 0x190f221a0724061a
mov qword [rsp + 0x58], rdx
movabs rdx, 0x1f0a1a0314021424
mov qword [rsp + 0x60], rdx
xor eax, eax
jmp 0x4a5be9
movzx r9d, byte [rsp + rsi + 0x1d]
sub r9d, edx
lea edx, [r9 - 0x52]
mov byte [rsp + rdi + 0x1d], dl
lea edx, [r8 - 0x52]
mov byte [rsp + rsi + 0x1d], dl
add rax, 2
cmp rax, 0x26
jge 0x4a5c17
movzx edx, byte [rsp + rax + 0x42]
movzx esi, byte [rsp + rax + 0x43]
mov edi, edx
xor edx, esi
add edx, eax
nop
cmp rdi, 0x25
jae 0x4a5c3a
movzx r8d, byte [rsp + rdi + 0x1d]
sub r8d, edx
cmp rsi, 0x25
jb 0x4a5bcc
jmp 0x4a5c2e
xor eax, eax
lea rbx, [rsp + 0x1d]
mov ecx, 0x25
call fcn.00441380
add rsp, 0x68
pop rbp
ret
mov eax, esi
mov ecx, 0x25
call fcn.00451880
mov eax, edi
mov ecx, 0x25
call fcn.00451880
nop
call fcn.0044f600
jmp fcn.004a5b20