joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4d3d20
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4d3e08
sub rsp, 0x48
mov qword [rsp + 0x40], rbp
lea rbp, [rsp + 0x40]
movabs rdx, 0xe1fcf1700186f77c
mov qword [rsp + 0x1d], rdx
movabs rdx, 0x67d30080664fd4e1
mov qword [rsp + 0x24], rdx
movabs rdx, 0xb08070001060002
mov qword [rsp + 0x2c], rdx
movabs rdx, 0xc0803050b080700
mov qword [rsp + 0x30], rdx
movabs rdx, 0xd050302050e0305
mov qword [rsp + 0x38], rdx
xor eax, eax
jmp 0x4d3da1
movzx r9d, byte [rsp + rsi + 0x1d]
add r9d, 0x69
add edx, r9d
mov byte [rsp + rdi + 0x1d], dl
mov byte [rsp + rsi + 0x1d], r8b
add rax, 2
cmp rax, 0x14
jge 0x4d3dd2
movzx edx, byte [rsp + rax + 0x2c]
movzx esi, byte [rsp + rax + 0x2d]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0xf
jae 0x4d3dfb
movzx r8d, byte [rsp + rdi + 0x1d]
add r8d, 0x69
add r8d, edx
cmp rsi, 0xf
jb 0x4d3d87
jmp 0x4d3def
xor eax, eax
lea rbx, [rsp + 0x1d]
mov ecx, 0xf
nop
call fcn.0044a0a0
mov rbp, qword [rsp + 0x40]
add rsp, 0x48
ret
mov eax, esi
mov ecx, 0xf
call fcn.0045f380
mov eax, edi
mov ecx, 0xf
call fcn.0045f380
nop
call fcn.0045cd20
jmp fcn.004d3d20

Function at 0x4d4180
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4d425c
sub rsp, 0x40
mov qword [rsp + 0x38], rbp
lea rbp, [rsp + 0x38]
movabs rdx, 0x301d611c742c2056
mov qword [rsp + 0x1f], rdx
movabs rdx, 0x6b634c301d611c74
mov qword [rsp + 0x22], rdx
movabs rdx, 0x707010401010802
mov qword [rsp + 0x2a], rdx
movabs rdx, 0x708010108060707
mov qword [rsp + 0x30], rdx
xor eax, eax
jmp 0x4d41f5
movzx r9d, byte [rsp + rsi + 0x1f]
sub r9d, edx
lea edx, [r9 + 0x30]
mov byte [rsp + rdi + 0x1f], dl
lea edx, [r8 + 0x30]
mov byte [rsp + rsi + 0x1f], dl
add rax, 2
cmp rax, 0xe
jge 0x4d4228
movzx edx, byte [rsp + rax + 0x2a]
movzx esi, byte [rsp + rax + 0x2b]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0xb
jae 0x4d424f
movzx r8d, byte [rsp + rdi + 0x1f]
sub r8d, edx
nop word [rax + rax]
cmp rsi, 0xb
jb 0x4d41d8
jmp 0x4d4243
xor eax, eax
lea rbx, [rsp + 0x1f]
mov ecx, 0xb
call fcn.0044a0a0
mov rbp, qword [rsp + 0x38]
add rsp, 0x40
ret
mov eax, esi
mov ecx, 0xb
call fcn.0045f380
mov eax, edi
mov ecx, 0xb
call fcn.0045f380
nop
nop dword [rax]
call fcn.0045cd20
jmp fcn.004d4180
Function at 0x4d48e0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4d499c
sub rsp, 0x30
mov qword [rsp + 0x28], rbp
lea rbp, [rsp + 0x28]
movabs rdx, 0x7845613c6561736b
mov qword [rsp + 0x20], rdx
movabs rdx, 0x4010101050205
mov qword [rsp + 0x18], rdx
xor eax, eax
jmp 0x4d4934
movzx r9d, byte [rsp + rsi + 0x20]
add r9d, 0xfffffffb
add edx, r9d
mov byte [rsp + rdi + 0x20], dl
mov byte [rsp + rsi + 0x20], r8b
add rax, 2
cmp rax, 8
jge 0x4d4968
movzx edx, byte [rsp + rax + 0x18]
movzx esi, byte [rsp + rax + 0x19]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 8
jae 0x4d498f
movzx r8d, byte [rsp + rdi + 0x20]
add r8d, 0xfffffffb
add r8d, edx
nop dword [rax]
cmp rsi, 8
jb 0x4d491a
jmp 0x4d4983
xor eax, eax
lea rbx, [rsp + 0x20]
mov ecx, 8
call fcn.0044a0a0
mov rbp, qword [rsp + 0x28]
add rsp, 0x30
ret
mov eax, esi
mov ecx, 8
call fcn.0045f380
mov eax, edi
mov ecx, 8
call fcn.0045f380
nop
nop dword [rax]
call fcn.0045cd20
jmp fcn.004d48e0

Function at 0x4d4de0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4d4ec8
sub rsp, 0x48
mov qword [rsp + 0x40], rbp
lea rbp, [rsp + 0x40]
movabs rdx, 0x75326970504165fb
mov qword [rsp + 0x1a], rdx
movabs rdx, 0xe1320116e7af1066
mov qword [rsp + 0x22], rdx
movabs rdx, 0x30f0e0b0c02060b
mov qword [rsp + 0x2a], rdx
movabs rdx, 0xf0a0b0b0f0f030f
mov qword [rsp + 0x30], rdx
movabs rdx, 0xf0d0b090b0c000e
mov qword [rsp + 0x38], rdx
xor eax, eax
jmp 0x4d4e61
movzx r9d, byte [rsp + rsi + 0x1a]
add r9d, 0x4e
add edx, r9d
mov byte [rsp + rdi + 0x1a], dl
mov byte [rsp + rsi + 0x1a], r8b
add rax, 2
cmp rax, 0x16
jge 0x4d4e92
movzx edx, byte [rsp + rax + 0x2a]
movzx esi, byte [rsp + rax + 0x2b]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x10
jae 0x4d4ebb
movzx r8d, byte [rsp + rdi + 0x1a]
add r8d, 0x4e
add r8d, edx
cmp rsi, 0x10
jb 0x4d4e47
jmp 0x4d4eaf
xor eax, eax
lea rbx, [rsp + 0x1a]
mov ecx, 0x10
nop
call fcn.0044a0a0
mov rbp, qword [rsp + 0x40]
add rsp, 0x48
ret
mov eax, esi
mov ecx, 0x10
call fcn.0045f380
mov eax, edi
mov ecx, 0x10
call fcn.0045f380
nop
call fcn.0045cd20
jmp fcn.004d4de0
Function at 0x4d4ee0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4d4fe8
sub rsp, 0x58
mov qword [rsp + 0x50], rbp
lea rbp, [rsp + 0x50]
movabs rdx, 0x5b80746577abac72
mov qword [rsp + 0x1d], rdx
movabs rdx, 0x936e807fa65b8074
mov qword [rsp + 0x22], rdx
movabs rdx, 0x9b856673a59d6d4f
mov qword [rsp + 0x2a], rdx
movabs rdx, 0x2000d030a130e13
mov qword [rsp + 0x32], rdx
movabs rdx, 0x140c1008140f1101
mov qword [rsp + 0x3a], rdx
movabs rdx, 0x101112140012140c
mov qword [rsp + 0x40], rdx
movabs rdx, 0x100806071411090f
mov qword [rsp + 0x48], rdx
xor eax, eax
jmp 0x4d4f82
movzx r9d, byte [rsp + rsi + 0x1d]
sub r9d, edx
lea edx, [r9 + 0xa]
mov byte [rsp + rdi + 0x1d], dl
lea edx, [r8 + 0xa]
mov byte [rsp + rsi + 0x1d], dl
add rax, 2
cmp rax, 0x1e
jge 0x4d4faf
movzx edx, byte [rsp + rax + 0x32]
movzx esi, byte [rsp + rax + 0x33]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x15
jae 0x4d4fdb
movzx r8d, byte [rsp + rdi + 0x1d]
sub r8d, edx
cmp rsi, 0x15
jb 0x4d4f65
jmp 0x4d4fcf
xor eax, eax
lea rbx, [rsp + 0x1d]
mov ecx, 0x15
nop dword [rax + rax]
call fcn.0044a0a0
mov rbp, qword [rsp + 0x50]
add rsp, 0x58
ret
mov eax, esi
mov ecx, 0x15
call fcn.0045f380
mov eax, edi
mov ecx, 0x15
call fcn.0045f380
nop
call fcn.0045cd20
jmp fcn.004d4ee0

Function at 0x4d5360
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4d544b
sub rsp, 0x48
mov qword [rsp + 0x40], rbp
lea rbp, [rsp + 0x40]
movabs rdx, 0x4572657355444454
mov qword [rsp + 0x1e], rdx
movabs rdx, 0x5745614434614572
mov qword [rsp + 0x24], rdx
movabs rdx, 0x20a0b0d090d0a02
mov qword [rsp + 0x2c], rdx
movabs rdx, 0x902010b020a0b0d
mov qword [rsp + 0x30], rdx
movabs rdx, 0xa01070b000c000d
mov qword [rsp + 0x38], rdx
xor eax, eax
jmp 0x4d53e4
movzx r9d, byte [rsp + rsi + 0x1e]
sub r9d, edx
lea edx, [r9 + 0x1c]
mov byte [rsp + rdi + 0x1e], dl
lea edx, [r8 + 0x1c]
mov byte [rsp + rsi + 0x1e], dl
add rax, 2
cmp rax, 0x14
jge 0x4d5417
movzx edx, byte [rsp + rax + 0x2c]
movzx esi, byte [rsp + rax + 0x2d]
mov edi, edx
xor edx, esi
add edx, eax
nop word [rax + rax]
cmp rdi, 0xe
jae 0x4d543e
movzx r8d, byte [rsp + rdi + 0x1e]
sub r8d, edx
cmp rsi, 0xe
jb 0x4d53c7
jmp 0x4d5432
xor eax, eax
lea rbx, [rsp + 0x1e]
mov ecx, 0xe
call fcn.0044a0a0
mov rbp, qword [rsp + 0x40]
add rsp, 0x48
ret
mov eax, esi
mov ecx, 0xe
call fcn.0045f380
mov eax, edi
mov ecx, 0xe
call fcn.0045f380
nop
call fcn.0045cd20
jmp fcn.004d5360
Function at 0x4d6a80
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4d6b5c
sub rsp, 0x40
mov qword [rsp + 0x38], rbp
lea rbp, [rsp + 0x38]
movabs rdx, 0x8dd89d6fd6a0ae67
mov qword [rsp + 0x1b], rdx
movabs rdx, 0xaf6db3e61c8dd89d
mov qword [rsp + 0x20], rdx
movabs rdx, 0x20c070708060609
mov qword [rsp + 0x28], rdx
movabs rdx, 0x10901060a050305
mov qword [rsp + 0x30], rdx
xor eax, eax
jmp 0x4d6af5
movzx r9d, byte [rsp + rsi + 0x1b]
sub r9d, edx
lea edx, [r9 - 0x27]
mov byte [rsp + rdi + 0x1b], dl
lea edx, [r8 - 0x27]
mov byte [rsp + rsi + 0x1b], dl
add rax, 2
cmp rax, 0x10
jge 0x4d6b28
movzx edx, byte [rsp + rax + 0x28]
movzx esi, byte [rsp + rax + 0x29]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0xd
jae 0x4d6b4f
movzx r8d, byte [rsp + rdi + 0x1b]
sub r8d, edx
nop word [rax + rax]
cmp rsi, 0xd
jb 0x4d6ad8
jmp 0x4d6b43
xor eax, eax
lea rbx, [rsp + 0x1b]
mov ecx, 0xd
call fcn.0044a0a0
mov rbp, qword [rsp + 0x38]
add rsp, 0x40
ret
mov eax, esi
mov ecx, 0xd
call fcn.0045f380
mov eax, edi
mov ecx, 0xd
call fcn.0045f380
nop
nop dword [rax]
call fcn.0045cd20
jmp fcn.004d6a80

Function at 0x4d6b80
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4d6c5c
sub rsp, 0x40
mov qword [rsp + 0x38], rbp
lea rbp, [rsp + 0x38]
movabs rdx, 0x6e7218cc70c816c5
mov qword [rsp + 0x1f], rdx
movabs rdx, 0x636d7a6e7218cc70
mov qword [rsp + 0x22], rdx
movabs rdx, 0x2040a0404000408
mov qword [rsp + 0x2a], rdx
movabs rdx, 0x1080204050204
mov qword [rsp + 0x30], rdx
xor eax, eax
jmp 0x4d6bf2
movzx r9d, byte [rsp + rsi + 0x1f]
add r9d, 0x44
add edx, r9d
mov byte [rsp + rdi + 0x1f], dl
mov byte [rsp + rsi + 0x1f], r8b
add rax, 2
cmp rax, 0xe
jge 0x4d6c28
movzx edx, byte [rsp + rax + 0x2a]
movzx esi, byte [rsp + rax + 0x2b]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0xb
jae 0x4d6c4f
movzx r8d, byte [rsp + rdi + 0x1f]
add r8d, 0x44
add r8d, edx
nop dword [rax + rax]
cmp rsi, 0xb
jb 0x4d6bd8
jmp 0x4d6c43
xor eax, eax
lea rbx, [rsp + 0x1f]
mov ecx, 0xb
call fcn.0044a0a0
mov rbp, qword [rsp + 0x38]
add rsp, 0x40
ret
mov eax, esi
mov ecx, 0xb
call fcn.0045f380
mov eax, edi
mov ecx, 0xb
call fcn.0045f380
nop
nop dword [rax]
call fcn.0045cd20
jmp fcn.004d6b80
Function at 0x4d6ec0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4d6f9c
sub rsp, 0x40
mov qword [rsp + 0x38], rbp
lea rbp, [rsp + 0x38]
movabs rdx, 0x62b812021dc2650c
mov qword [rsp + 0x1d], rdx
movabs rdx, 0x65c3b0c8b262b812
mov qword [rsp + 0x22], rdx
movabs rdx, 0x80b0b0508040a00
mov qword [rsp + 0x2a], rdx
movabs rdx, 0xa0602090a03080b
mov qword [rsp + 0x30], rdx
xor eax, eax
jmp 0x4d6f35
movzx r9d, byte [rsp + rsi + 0x1d]
sub r9d, edx
lea edx, [r9 - 0x3f]
mov byte [rsp + rdi + 0x1d], dl
lea edx, [r8 - 0x3f]
mov byte [rsp + rsi + 0x1d], dl
add rax, 2
cmp rax, 0xe
jge 0x4d6f68
movzx edx, byte [rsp + rax + 0x2a]
movzx esi, byte [rsp + rax + 0x2b]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0xd
jae 0x4d6f8f
movzx r8d, byte [rsp + rdi + 0x1d]
sub r8d, edx
nop word [rax + rax]
cmp rsi, 0xd
jb 0x4d6f18
jmp 0x4d6f83
xor eax, eax
lea rbx, [rsp + 0x1d]
mov ecx, 0xd
call fcn.0044a0a0
mov rbp, qword [rsp + 0x38]
add rsp, 0x40
ret
mov eax, esi
mov ecx, 0xd
call fcn.0045f380
mov eax, edi
mov ecx, 0xd
call fcn.0045f380
nop
nop dword [rax]
call fcn.0045cd20
jmp fcn.004d6ec0

Function at 0x4d6fc0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4d7092
sub rsp, 0x38
mov qword [rsp + 0x30], rbp
lea rbp, [rsp + 0x30]
movabs rdx, 0xb9a963acc4a0af67
mov qword [rsp + 0x18], rdx
mov word [rsp + 0x20], 0x74b7
movabs rdx, 0x203020404020404
mov qword [rsp + 0x22], rdx
movabs rdx, 0x106070403080203
mov qword [rsp + 0x28], rdx
xor eax, eax
jmp 0x4d702a
movzx r9d, byte [rsp + rsi + 0x18]
add r9d, 0xffffffa9
add edx, r9d
mov byte [rsp + rdi + 0x18], dl
mov byte [rsp + rsi + 0x18], r8b
add rax, 2
cmp rax, 0xe
jge 0x4d705b
movzx edx, byte [rsp + rax + 0x22]
movzx esi, byte [rsp + rax + 0x23]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0xa
jae 0x4d7085
movzx r8d, byte [rsp + rdi + 0x18]
add r8d, 0xffffffa9
add r8d, edx
cmp rsi, 0xa
jb 0x4d7010
jmp 0x4d7076
xor eax, eax
lea rbx, [rsp + 0x18]
mov ecx, 0xa
call fcn.0044a0a0
mov rbp, qword [rsp + 0x30]
add rsp, 0x38
ret
mov eax, esi
mov ecx, 0xa
nop dword [rax]
call fcn.0045f380
mov eax, edi
mov ecx, 0xa
call fcn.0045f380
nop
call fcn.0045cd20
jmp fcn.004d6fc0
Function at 0x4d70a0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4d7168
sub rsp, 0x38
mov qword [rsp + 0x30], rbp
lea rbp, [rsp + 0x30]
movabs rdx, 0x6fd063fa93caa9ce
mov qword [rsp + 0x1a], rdx
mov word [rsp + 0x22], 0x748d
movabs rdx, 0x108020606040100
mov qword [rsp + 0x24], rdx
mov dword [rsp + 0x2c], 0x3060402
xor eax, eax
jmp 0x4d7103
movzx r9d, byte [rsp + rsi + 0x1a]
add r9d, 0xffffffc9
add edx, r9d
mov byte [rsp + rdi + 0x1a], dl
mov byte [rsp + rsi + 0x1a], r8b
add rax, 2
cmp rax, 0xc
jge 0x4d7134
movzx edx, byte [rsp + rax + 0x24]
movzx esi, byte [rsp + rax + 0x25]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0xa
jae 0x4d715b
movzx r8d, byte [rsp + rdi + 0x1a]
add r8d, 0xffffffc9
add r8d, edx
cmp rsi, 0xa
jb 0x4d70e9
jmp 0x4d714f
xor eax, eax
lea rbx, [rsp + 0x1a]
mov ecx, 0xa
call fcn.0044a0a0
mov rbp, qword [rsp + 0x30]
add rsp, 0x38
ret
mov eax, esi
mov ecx, 0xa
call fcn.0045f380
mov eax, edi
mov ecx, 0xa
call fcn.0045f380
nop
call fcn.0045cd20
jmp fcn.004d70a0

Function at 0x4e4ca0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4e4d8b
sub rsp, 0x48
mov qword [rsp + 0x40], rbp
lea rbp, [rsp + 0x40]
movabs rdx, 0x74616c5d44656fe5
mov qword [rsp + 0x1f], rdx
movabs rdx, 0xecf84cdaed56f374
mov qword [rsp + 0x26], rdx
movabs rdx, 0xe0102010c06040c
mov qword [rsp + 0x2e], rdx
movabs rdx, 0xc080e0102010c06
mov qword [rsp + 0x30], rdx
movabs rdx, 0xd020a0b0e0b0400
mov qword [rsp + 0x38], rdx
xor eax, eax
jmp 0x4e4d24
movzx r9d, byte [rsp + rsi + 0x1f]
sub r9d, edx
lea edx, [r9 - 0x72]
mov byte [rsp + rdi + 0x1f], dl
lea edx, [r8 - 0x72]
mov byte [rsp + rsi + 0x1f], dl
add rax, 2
cmp rax, 0x12
jge 0x4e4d57
movzx edx, byte [rsp + rax + 0x2e]
movzx esi, byte [rsp + rax + 0x2f]
mov edi, edx
xor edx, esi
add edx, eax
nop word [rax + rax]
cmp rdi, 0xf
jae 0x4e4d7e
movzx r8d, byte [rsp + rdi + 0x1f]
sub r8d, edx
cmp rsi, 0xf
jb 0x4e4d07
jmp 0x4e4d72
xor eax, eax
lea rbx, [rsp + 0x1f]
mov ecx, 0xf
call fcn.0044a0a0
mov rbp, qword [rsp + 0x40]
add rsp, 0x48
ret
mov eax, esi
mov ecx, 0xf
call fcn.0045f380
mov eax, edi
mov ecx, 0xf
call fcn.0045f380
nop
call fcn.0045cd20
jmp fcn.004e4ca0
Function at 0x4e4da0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4e4e7c
sub rsp, 0x40
mov qword [rsp + 0x38], rbp
lea rbp, [rsp + 0x38]
movabs rdx, 0x5649451c4c3165a1
mov qword [rsp + 0x1b], rdx
movabs rdx, 0x32650d6c30564945
mov qword [rsp + 0x20], rdx
movabs rdx, 0x80204030a030a00
mov qword [rsp + 0x28], rdx
movabs rdx, 0x60802050504000c
mov qword [rsp + 0x30], rdx
xor eax, eax
jmp 0x4e4e15
movzx r9d, byte [rsp + rsi + 0x1b]
sub r9d, edx
lea edx, [r9 + 0x34]
mov byte [rsp + rdi + 0x1b], dl
lea edx, [r8 + 0x34]
mov byte [rsp + rsi + 0x1b], dl
add rax, 2
cmp rax, 0x10
jge 0x4e4e48
movzx edx, byte [rsp + rax + 0x28]
movzx esi, byte [rsp + rax + 0x29]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0xd
jae 0x4e4e6f
movzx r8d, byte [rsp + rdi + 0x1b]
sub r8d, edx
nop word [rax + rax]
cmp rsi, 0xd
jb 0x4e4df8
jmp 0x4e4e63
xor eax, eax
lea rbx, [rsp + 0x1b]
mov ecx, 0xd
call fcn.0044a0a0
mov rbp, qword [rsp + 0x38]
add rsp, 0x40
ret
mov eax, esi
mov ecx, 0xd
call fcn.0045f380
mov eax, edi
mov ecx, 0xd
call fcn.0045f380
nop
nop dword [rax]
call fcn.0045cd20
jmp fcn.004e4da0
Function at 0x4e5f20
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4e5fe8
sub rsp, 0x38
mov qword [rsp + 0x30], rbp
lea rbp, [rsp + 0x30]
movabs rdx, 0x8ef5e91481ff6557
mov qword [rsp + 0x1b], rdx
mov byte [rsp + 0x23], 0x70
movabs rdx, 0x802060404030407
mov qword [rsp + 0x24], rdx
mov dword [rsp + 0x2c], 0x5020702
xor eax, eax
jmp 0x4e5f81
movzx r9d, byte [rsp + rsi + 0x1b]
add r9d, 0x6a
add edx, r9d
mov byte [rsp + rdi + 0x1b], dl
mov byte [rsp + rsi + 0x1b], r8b
add rax, 2
cmp rax, 0xc
jge 0x4e5fb2
movzx edx, byte [rsp + rax + 0x24]
movzx esi, byte [rsp + rax + 0x25]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 9
jae 0x4e5fdb
movzx r8d, byte [rsp + rdi + 0x1b]
add r8d, 0x6a
add r8d, edx
cmp rsi, 9
jb 0x4e5f67
jmp 0x4e5fcf
xor eax, eax
lea rbx, [rsp + 0x1b]
mov ecx, 9
nop
call fcn.0044a0a0
mov rbp, qword [rsp + 0x30]
add rsp, 0x38
ret
mov eax, esi
mov ecx, 9
call fcn.0045f380
mov eax, edi
mov ecx, 9
call fcn.0045f380
nop
call fcn.0045cd20
jmp fcn.004e5f20

Function at 0x4e6a60
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4e6b1c
sub rsp, 0x30
mov qword [rsp + 0x28], rbp
lea rbp, [rsp + 0x28]
movabs rdx, 0xdd4b476d44634644
mov qword [rsp + 0x20], rdx
movabs rdx, 0x100050306010706
mov qword [rsp + 0x18], rdx
xor eax, eax
jmp 0x4e6ab7
movzx r9d, byte [rsp + rsi + 0x20]
sub r9d, edx
lea edx, [r9 + 0x28]
mov byte [rsp + rdi + 0x20], dl
lea edx, [r8 + 0x28]
mov byte [rsp + rsi + 0x20], dl
add rax, 2
cmp rax, 8
jge 0x4e6ae8
movzx edx, byte [rsp + rax + 0x18]
movzx esi, byte [rsp + rax + 0x19]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 8
jae 0x4e6b0f
movzx r8d, byte [rsp + rdi + 0x20]
sub r8d, edx
nop dword [rax]
cmp rsi, 8
jb 0x4e6a9a
jmp 0x4e6b03
xor eax, eax
lea rbx, [rsp + 0x20]
mov ecx, 8
call fcn.0044a0a0
mov rbp, qword [rsp + 0x28]
add rsp, 0x30
ret
mov eax, esi
mov ecx, 8
call fcn.0045f380
mov eax, edi
mov ecx, 8
call fcn.0045f380
nop
nop dword [rax]
call fcn.0045cd20
jmp fcn.004e6a60
Function at 0x4e6e60
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4e6f68
sub rsp, 0x50
mov qword [rsp + 0x48], rbp
lea rbp, [rsp + 0x48]
movabs rdx, 0x260aa2fad2f261ec
mov qword [rsp + 0x19], rdx
movabs rdx, 0x1f36c4260aa2fad2
mov qword [rsp + 0x1c], rdx
movabs rdx, 0x646cab69ecd58624
mov qword [rsp + 0x24], rdx
movabs rdx, 0xa0303080a0c0a
mov qword [rsp + 0x2c], rdx
movabs rdx, 0xd0d0a0708100502
mov qword [rsp + 0x34], rdx
movabs rdx, 0xe0b08030d0d0a07
mov qword [rsp + 0x38], rdx
movabs rdx, 0x209050b04090609
mov qword [rsp + 0x40], rdx
xor eax, eax
jmp 0x4e6f02
movzx r9d, byte [rsp + rsi + 0x19]
sub r9d, edx
lea edx, [r9 + 0x59]
mov byte [rsp + rdi + 0x19], dl
lea edx, [r8 + 0x59]
mov byte [rsp + rsi + 0x19], dl
add rax, 2
cmp rax, 0x1c
jge 0x4e6f2f
movzx edx, byte [rsp + rax + 0x2c]
movzx esi, byte [rsp + rax + 0x2d]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x13
jae 0x4e6f5b
movzx r8d, byte [rsp + rdi + 0x19]
sub r8d, edx
cmp rsi, 0x13
jb 0x4e6ee5
jmp 0x4e6f4f
xor eax, eax
lea rbx, [rsp + 0x19]
mov ecx, 0x13
nop dword [rax + rax]
call fcn.0044a0a0
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
mov eax, esi
mov ecx, 0x13
call fcn.0045f380
mov eax, edi
mov ecx, 0x13
call fcn.0045f380
nop
call fcn.0045cd20
jmp fcn.004e6e60

Function at 0x4e7220
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4e7346
sub rsp, 0x60
mov qword [rsp + 0x58], rbp
lea rbp, [rsp + 0x58]
movabs rdx, 0xcd57593165e76974
mov qword [rsp + 0x19], rdx
movabs rdx, 0x8f0c2b9cc8e34076
mov qword [rsp + 0x21], rdx
movabs rdx, 0xe861918f0c2b9cc8
mov qword [rsp + 0x24], rdx
movabs rdx, 0x9c0461e1de04e2d2
mov qword [rsp + 0x2c], rdx
movabs rdx, 0x19090d0e0d1a060e
mov qword [rsp + 0x34], rdx
movabs rdx, 0x713090619090d0e
mov qword [rsp + 0x38], rdx
movabs rdx, 0xa170f160d100b1a
mov qword [rsp + 0x40], rdx
movabs rdx, 0x120e0510060c0c04
mov qword [rsp + 0x48], rdx
movabs rdx, 0x14190c1005021502
mov qword [rsp + 0x50], rdx
xor eax, eax
jmp 0x4e72e0
movzx r9d, byte [rsp + rsi + 0x19]
sub r9d, edx
lea edx, [r9 - 0x46]
mov byte [rsp + rdi + 0x19], dl
lea edx, [r8 - 0x46]
mov byte [rsp + rsi + 0x19], dl
add rax, 2
cmp rax, 0x24
jge 0x4e730d
movzx edx, byte [rsp + rax + 0x34]
movzx esi, byte [rsp + rax + 0x35]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x1b
jae 0x4e7334
movzx r8d, byte [rsp + rdi + 0x19]
sub r8d, edx
cmp rsi, 0x1b
jb 0x4e72c3
jmp 0x4e7328
xor eax, eax
lea rbx, [rsp + 0x19]
mov ecx, 0x1b
call fcn.0044a0a0
mov rbp, qword [rsp + 0x58]
add rsp, 0x60
ret
mov eax, esi
mov ecx, 0x1b
call fcn.0045f380
mov eax, edi
mov ecx, 0x1b
nop dword [rax + rax]
call fcn.0045f380
nop
call fcn.0045cd20
jmp fcn.004e7220
Function at 0x4e7360
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4e7468
sub rsp, 0x50
mov qword [rsp + 0x48], rbp
lea rbp, [rsp + 0x48]
movabs rdx, 0x74537c74247992f8
mov qword [rsp + 0x1b], rdx
movabs rdx, 0xb56ebb74537c7424
mov qword [rsp + 0x1e], rdx
movabs rdx, 0xc38ff04820c572cc
mov qword [rsp + 0x26], rdx
movabs rdx, 0x50f03120a031001
mov qword [rsp + 0x2e], rdx
movabs rdx, 0x80b0d031111000d
mov qword [rsp + 0x36], rdx
movabs rdx, 0x80a080b0d031111
mov qword [rsp + 0x38], rdx
movabs rdx, 0x3010b080801000a
mov qword [rsp + 0x40], rdx
xor eax, eax
jmp 0x4e7402
movzx r9d, byte [rsp + rsi + 0x1b]
sub r9d, edx
lea edx, [r9 - 0x18]
mov byte [rsp + rdi + 0x1b], dl
lea edx, [r8 - 0x18]
mov byte [rsp + rsi + 0x1b], dl
add rax, 2
cmp rax, 0x1a
jge 0x4e742f
movzx edx, byte [rsp + rax + 0x2e]
movzx esi, byte [rsp + rax + 0x2f]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x13
jae 0x4e745b
movzx r8d, byte [rsp + rdi + 0x1b]
sub r8d, edx
cmp rsi, 0x13
jb 0x4e73e5
jmp 0x4e744f
xor eax, eax
lea rbx, [rsp + 0x1b]
mov ecx, 0x13
nop dword [rax + rax]
call fcn.0044a0a0
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
mov eax, esi
mov ecx, 0x13
call fcn.0045f380
mov eax, edi
mov ecx, 0x13
call fcn.0045f380
nop
call fcn.0045cd20
jmp fcn.004e7360
Function at 0x4ec820
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4ec916
sub rsp, 0x50
mov qword [rsp + 0x48], rbp
lea rbp, [rsp + 0x48]
movabs rdx, 0x20637dcc49c88570
mov qword [rsp + 0x1b], rdx
movabs rdx, 0xab8c61819920637d
mov qword [rsp + 0x20], rdx
movabs rdx, 0x6591935470646b8d
mov qword [rsp + 0x28], rdx
movabs rdx, 0x30c080b0d04020b
mov qword [rsp + 0x30], rdx
movabs rdx, 0x903090d100c1212
mov qword [rsp + 0x38], rdx
movabs rdx, 0xd080e05010813
mov qword [rsp + 0x40], rdx
xor eax, eax
jmp 0x4ec8b0
movzx r9d, byte [rsp + rsi + 0x1b]
add r9d, 0xffffffce
add edx, r9d
mov byte [rsp + rdi + 0x1b], dl
mov byte [rsp + rsi + 0x1b], r8b
add rax, 2
cmp rax, 0x18
jge 0x4ec8e2
movzx edx, byte [rsp + rax + 0x30]
movzx esi, byte [rsp + rax + 0x31]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x15
jae 0x4ec909
movzx r8d, byte [rsp + rdi + 0x1b]
add r8d, 0xffffffce
add r8d, edx
cmp rsi, 0x15
jb 0x4ec896
nop
jmp 0x4ec8fd
xor eax, eax
lea rbx, [rsp + 0x1b]
mov ecx, 0x15
call fcn.0044a0a0
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
mov eax, esi
mov ecx, 0x15
call fcn.0045f380
mov eax, edi
mov ecx, 0x15
call fcn.0045f380
nop
call fcn.0045cd20
nop dword [rax + rax]
jmp fcn.004ec820

Function at 0x4ec940
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4eca66
sub rsp, 0x60
mov qword [rsp + 0x58], rbp
lea rbp, [rsp + 0x58]
movabs rdx, 0x6988cc150d706153
mov qword [rsp + 0x1c], rdx
movabs rdx, 0x6174536dfde0e065
mov qword [rsp + 0x24], rdx
movabs rdx, 0x576c6174536dfde0
mov qword [rsp + 0x26], rdx
movabs rdx, 0xd15769f0f61de0ea
mov qword [rsp + 0x2e], rdx
movabs rdx, 0xb03141116051819
mov qword [rsp + 0x36], rdx
movabs rdx, 0xa090b0314111605
mov qword [rsp + 0x38], rdx
movabs rdx, 0x1515041502191310
mov qword [rsp + 0x40], rdx
movabs rdx, 0x30b101406190b0c
mov qword [rsp + 0x48], rdx
movabs rdx, 0x111219140b131105
mov qword [rsp + 0x50], rdx
xor eax, eax
jmp 0x4eca00
movzx r9d, byte [rsp + rsi + 0x1c]
sub r9d, edx
lea edx, [r9 - 0x63]
mov byte [rsp + rdi + 0x1c], dl
lea edx, [r8 - 0x63]
mov byte [rsp + rsi + 0x1c], dl
add rax, 2
cmp rax, 0x22
jge 0x4eca2d
movzx edx, byte [rsp + rax + 0x36]
movzx esi, byte [rsp + rax + 0x37]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x1a
jae 0x4eca54
movzx r8d, byte [rsp + rdi + 0x1c]
sub r8d, edx
cmp rsi, 0x1a
jb 0x4ec9e3
jmp 0x4eca48
xor eax, eax
lea rbx, [rsp + 0x1c]
mov ecx, 0x1a
call fcn.0044a0a0
mov rbp, qword [rsp + 0x58]
add rsp, 0x60
ret
mov eax, esi
mov ecx, 0x1a
call fcn.0045f380
mov eax, edi
mov ecx, 0x1a
nop dword [rax + rax]
call fcn.0045f380
nop
call fcn.0045cd20
jmp fcn.004ec940