joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4ae9e0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4aea9d
push rbp
mov rbp, rsp
sub rsp, 0x30
movabs rdx, 0x3d12806e694bc574
mov qword [rsp + 0x26], rdx
mov word [rsp + 0x2e], 0x67af
movabs rdx, 0x901060805090605
mov qword [rsp + 0x1c], rdx
mov word [rsp + 0x24], 0x605
xor eax, eax
jmp 0x4aea40
movzx r9d, byte [rsp + rsi + 0x26]
sub r9d, edx
lea edx, [r9 + 0x69]
mov byte [rsp + rdi + 0x26], dl
lea edx, [r8 + 0x69]
mov byte [rsp + rsi + 0x26], dl
add rax, 2
nop
cmp rax, 0xa
jge 0x4aea6d
movzx edx, byte [rsp + rax + 0x1c]
movzx esi, byte [rsp + rax + 0x1d]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0xa
jae 0x4aea90
movzx r8d, byte [rsp + rdi + 0x26]
sub r8d, edx
cmp rsi, 0xa
jb 0x4aea22
jmp 0x4aea84
xor eax, eax
lea rbx, [rsp + 0x26]
mov ecx, 0xa
call fcn.0044bb20
add rsp, 0x30
pop rbp
ret
mov eax, esi
mov ecx, 0xa
call fcn.00461020
mov eax, edi
mov ecx, 0xa
call fcn.00461020
nop
nop dword [rax]
call fcn.0045eda0
jmp fcn.004ae9e0

Function at 0x4b0720
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4b081d
push rbp
mov rbp, rsp
sub rsp, 0x48
movabs rdx, 0xb3dd0474a0891b30
mov qword [rsp + 0x19], rdx
movabs rdx, 0x6320950d20b3dd04
mov qword [rsp + 0x1e], rdx
movabs rdx, 0x9d206522297d9b6f
mov qword [rsp + 0x26], rdx
movabs rdx, 0x5070611020e0f09
mov qword [rsp + 0x2e], rdx
movabs rdx, 0x91109140a10110e
mov qword [rsp + 0x36], rdx
movabs rdx, 0x310091109140a10
mov qword [rsp + 0x38], rdx
movabs rdx, 0x105001102130110
mov qword [rsp + 0x40], rdx
xor eax, eax
jmp 0x4b07c0
movzx r9d, byte [rsp + rsi + 0x19]
sub r9d, edx
lea edx, [r9 + 0x69]
mov byte [rsp + rdi + 0x19], dl
lea edx, [r8 + 0x69]
mov byte [rsp + rsi + 0x19], dl
add rax, 2
nop dword [rax]
cmp rax, 0x1a
jge 0x4b07ed
movzx edx, byte [rsp + rax + 0x2e]
movzx esi, byte [rsp + rax + 0x2f]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x15
jae 0x4b0810
movzx r8d, byte [rsp + rdi + 0x19]
sub r8d, edx
cmp rsi, 0x15
jb 0x4b079f
jmp 0x4b0804
xor eax, eax
lea rbx, [rsp + 0x19]
mov ecx, 0x15
call fcn.0044bb20
add rsp, 0x48
pop rbp
ret
mov eax, esi
mov ecx, 0x15
call fcn.00461020
mov eax, edi
mov ecx, 0x15
call fcn.00461020
nop
nop dword [rax]
call fcn.0045eda0
jmp fcn.004b0720
Function at 0x4b0a20
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4b0afd
push rbp
mov rbp, rsp
sub rsp, 0x40
movabs rdx, 0xc0261c6c6106c1bc
mov qword [rsp + 0x18], rdx
movabs rdx, 0xf6e17cc105bc361
mov qword [rsp + 0x20], rdx
movabs rdx, 0x10d0200050b0a07
mov qword [rsp + 0x28], rdx
movabs rdx, 0x6090f0a070c0e07
mov qword [rsp + 0x30], rdx
movabs rdx, 0xc0c060602020d0e
mov qword [rsp + 0x38], rdx
xor eax, eax
nop
jmp 0x4b0aa0
movzx r9d, byte [rsp + rsi + 0x18]
sub r9d, edx
lea edx, [r9 + 0x69]
mov byte [rsp + rdi + 0x18], dl
lea edx, [r8 + 0x69]
mov byte [rsp + rsi + 0x18], dl
add rax, 2
nop
cmp rax, 0x18
jge 0x4b0acd
movzx edx, byte [rsp + rax + 0x28]
movzx esi, byte [rsp + rax + 0x29]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x10
jae 0x4b0af0
movzx r8d, byte [rsp + rdi + 0x18]
sub r8d, edx
cmp rsi, 0x10
jb 0x4b0a82
jmp 0x4b0ae4
xor eax, eax
lea rbx, [rsp + 0x18]
mov ecx, 0x10
call fcn.0044bb20
add rsp, 0x40
pop rbp
ret
mov eax, esi
mov ecx, 0x10
call fcn.00461020
mov eax, edi
mov ecx, 0x10
call fcn.00461020
nop
nop dword [rax]
call fcn.0045eda0
jmp fcn.004b0a20

Function at 0x4b0b20
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4b0c0a
push rbp
mov rbp, rsp
sub rsp, 0x40
movabs rdx, 0x69cec5286d17d2c0
mov qword [rsp + 0x1d], rdx
movabs rdx, 0xf69cec5286d17d2
mov qword [rsp + 0x1e], rdx
movabs rdx, 0xddb2bd776521206e
mov qword [rsp + 0x26], rdx
movabs rdx, 0xe0402000f0b080e
mov qword [rsp + 0x2e], rdx
movabs rdx, 0xd0a0e0402000f0b
mov qword [rsp + 0x30], rdx
movabs rdx, 0x10d0f0506100e00
mov qword [rsp + 0x38], rdx
xor eax, eax
jmp 0x4b0bad
movzx r9d, byte [rsp + rsi + 0x1d]
sub r9d, edx
lea edx, [r9 - 0x48]
mov byte [rsp + rdi + 0x1d], dl
lea edx, [r8 - 0x48]
mov byte [rsp + rsi + 0x1d], dl
add rax, 2
cmp rax, 0x12
jge 0x4b0bda
movzx edx, byte [rsp + rax + 0x2e]
movzx esi, byte [rsp + rax + 0x2f]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x11
jae 0x4b0bfd
movzx r8d, byte [rsp + rdi + 0x1d]
sub r8d, edx
cmp rsi, 0x11
jb 0x4b0b90
jmp 0x4b0bf1
xor eax, eax
lea rbx, [rsp + 0x1d]
mov ecx, 0x11
call fcn.0044bb20
add rsp, 0x40
pop rbp
ret
mov eax, esi
mov ecx, 0x11
call fcn.00461020
mov eax, edi
mov ecx, 0x11
call fcn.00461020
nop
call fcn.0045eda0
jmp fcn.004b0b20
Function at 0x4b0ee0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4b0fcc
push rbp
mov rbp, rsp
sub rsp, 0x40
movabs rdx, 0x340a6459f66c69e0
mov qword [rsp + 0x19], rdx
movabs rdx, 0x32be3a340a6459f6
mov qword [rsp + 0x1c], rdx
movabs rdx, 0xeb3f14786539746f
mov qword [rsp + 0x24], rdx
movabs rdx, 0x6041009000a000d
mov qword [rsp + 0x2c], rdx
movabs rdx, 0xd10110006041009
mov qword [rsp + 0x30], rdx
movabs rdx, 0x30810070d030912
mov qword [rsp + 0x38], rdx
xor eax, eax
jmp 0x4b0f6a
movzx r9d, byte [rsp + rsi + 0x19]
lea edx, [r9 + rdx]
lea edx, [rdx + 0xe]
mov byte [rsp + rdi + 0x19], dl
mov byte [rsp + rsi + 0x19], r8b
add rax, 2
cmp rax, 0x14
jge 0x4b0f9c
movzx edx, byte [rsp + rax + 0x2c]
movzx esi, byte [rsp + rax + 0x2d]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x13
jae 0x4b0fbf
movzx r8d, byte [rsp + rdi + 0x19]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0xe]
cmp rsi, 0x13
jb 0x4b0f50
jmp 0x4b0fb3
xor eax, eax
lea rbx, [rsp + 0x19]
mov ecx, 0x13
call fcn.0044bb20
add rsp, 0x40
pop rbp
ret
mov eax, esi
mov ecx, 0x13
call fcn.00461020
mov eax, edi
mov ecx, 0x13
call fcn.00461020
nop
call fcn.0045eda0
jmp fcn.004b0ee0

Function at 0x4b2020
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4b20ea
push rbp
mov rbp, rsp
sub rsp, 0x48
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x58], rax
mov qword [rsp], rax
mov qword [rsp + 8], rbx
mov byte [rsp + 0x10], 0
call fcn.004030e0
xorps xmm15, xmm15
mov r14, qword [0x008aca00]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x18], 0xffffffffffffffff
jne 0x4b20cf
mov rcx, qword [rsp + 0x60]
lea rdx, [rcx + 1]
mov qword [rsp + 0x40], rdx
lea rax, [0x005b90a0]
xor ebx, ebx
mov rcx, rdx
call fcn.00447980
mov rbx, qword [rsp + 0x60]
mov rcx, rax
xor edi, edi
mov rsi, qword [rsp + 0x40]
mov rax, qword [rsp + 0x58]
nop dword [rax]
call fcn.004b4e60
inc rbx
cmp rcx, rbx
jae 0x4b20be
mov edi, 1
lea rsi, [0x005b90a0]
call fcn.00447a60
mov word [rax + rbx*2 - 2], 0
xor edi, edi
xor esi, esi
add rsp, 0x48
pop rbp
ret
xor eax, eax
xor ebx, ebx
mov rcx, rbx
lea rdi, [0x00745fa8]
lea rsi, [0x00745c38]
add rsp, 0x48
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.0045eda0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.004b2020
Function at 0x4b2a60
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4b2b46
push rbp
mov rbp, rsp
sub rsp, 0x40
movabs rdx, 0x586557225774651f
mov qword [rsp + 0x1a], rdx
movabs rdx, 0x3e375b6574ca3f3d
mov qword [rsp + 0x22], rdx
movabs rdx, 0xa000d0e0d040709
mov qword [rsp + 0x2a], rdx
movabs rdx, 0xa0e0803000e0a00
mov qword [rsp + 0x30], rdx
movabs rdx, 0xf030a0f050d0d0f
mov qword [rsp + 0x38], rdx
xor eax, eax
nop
jmp 0x4b2ae0
movzx r9d, byte [rsp + rsi + 0x1a]
lea edx, [r9 + rdx]
lea edx, [rdx + 3]
mov byte [rsp + rdi + 0x1a], dl
mov byte [rsp + rsi + 0x1a], r8b
add rax, 2
nop dword [rax]
cmp rax, 0x16
jge 0x4b2b12
movzx edx, byte [rsp + rax + 0x2a]
movzx esi, byte [rsp + rax + 0x2b]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x10
jae 0x4b2b37
movzx r8d, byte [rsp + rdi + 0x1a]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 3]
cmp rsi, 0x10
jb 0x4b2ac2
jmp 0x4b2b2b
xor eax, eax
lea rbx, [rsp + 0x1a]
mov ecx, 0x10
nop
call fcn.0044bb20
add rsp, 0x40
pop rbp
ret
mov eax, esi
mov ecx, 0x10
call fcn.00461020
mov eax, edi
mov ecx, 0x10
nop
call fcn.00461020
nop
call fcn.0045eda0
jmp fcn.004b2a60

Function at 0x4b2da0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4b2e66
push rbp
mov rbp, rsp
sub rsp, 0x30
movabs rdx, 0x7075729ddd4adf4b
mov qword [rsp + 0x1d], rdx
mov byte [rsp + 0x25], 0xca
movabs rdx, 0x201080304030200
mov qword [rsp + 0x26], rdx
mov word [rsp + 0x2e], 0x800
xor eax, eax
nop
jmp 0x4b2e00
movzx r9d, byte [rsp + rsi + 0x1d]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x74]
mov byte [rsp + rdi + 0x1d], dl
mov byte [rsp + rsi + 0x1d], r8b
add rax, 2
nop dword [rax]
cmp rax, 0xa
jge 0x4b2e32
movzx edx, byte [rsp + rax + 0x26]
movzx esi, byte [rsp + rax + 0x27]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 9
jae 0x4b2e57
movzx r8d, byte [rsp + rdi + 0x1d]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x74]
cmp rsi, 9
jb 0x4b2de2
jmp 0x4b2e4b
xor eax, eax
lea rbx, [rsp + 0x1d]
mov ecx, 9
nop
call fcn.0044bb20
add rsp, 0x30
pop rbp
ret
mov eax, esi
mov ecx, 9
call fcn.00461020
mov eax, edi
mov ecx, 9
nop
call fcn.00461020
nop
call fcn.0045eda0
jmp fcn.004b2da0
Function at 0x4b2e80
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4b2f6c
push rbp
mov rbp, rsp
sub rsp, 0x48
movabs rdx, 0x205f67675743ebd4
mov qword [rsp + 0x1d], rdx
movabs rdx, 0xf35e51205f676757
mov qword [rsp + 0x20], rdx
movabs rdx, 0xe06f69e259d75e74
mov qword [rsp + 0x28], rdx
movabs rdx, 0x212010c0a090605
mov qword [rsp + 0x30], rdx
movabs rdx, 0x8050e0a0a0e0301
mov qword [rsp + 0x38], rdx
movabs rdx, 0xa0f0d0612000105
mov qword [rsp + 0x40], rdx
xor eax, eax
jmp 0x4b2f0a
movzx r9d, byte [rsp + rsi + 0x1d]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x76]
mov byte [rsp + rdi + 0x1d], dl
mov byte [rsp + rsi + 0x1d], r8b
add rax, 2
cmp rax, 0x18
jge 0x4b2f3c
movzx edx, byte [rsp + rax + 0x30]
movzx esi, byte [rsp + rax + 0x31]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x13
jae 0x4b2f5f
movzx r8d, byte [rsp + rdi + 0x1d]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x76]
cmp rsi, 0x13
jb 0x4b2ef0
jmp 0x4b2f53
xor eax, eax
lea rbx, [rsp + 0x1d]
mov ecx, 0x13
call fcn.0044bb20
add rsp, 0x48
pop rbp
ret
mov eax, esi
mov ecx, 0x13
call fcn.00461020
mov eax, edi
mov ecx, 0x13
call fcn.00461020
nop
call fcn.0045eda0
jmp fcn.004b2e80

Function at 0x4b40c0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4b4187
push rbp
mov rbp, rsp
sub rsp, 0x30
movabs rdx, 0xfd20ff656b1a947f
mov qword [rsp + 0x19], rdx
movabs rdx, 0x65707efd20ff656b
mov qword [rsp + 0x1c], rdx
movabs rdx, 0x801010808020000
mov qword [rsp + 0x24], rdx
mov dword [rsp + 0x2c], 0x7050200
xor eax, eax
jmp 0x4b4128
movzx r9d, byte [rsp + rsi + 0x19]
sub r9d, edx
lea edx, [r9 + 0x7d]
mov byte [rsp + rdi + 0x19], dl
lea edx, [r8 + 0x7d]
mov byte [rsp + rsi + 0x19], dl
add rax, 2
cmp rax, 0xc
jge 0x4b4157
movzx edx, byte [rsp + rax + 0x24]
movzx esi, byte [rsp + rax + 0x25]
mov edi, edx
xor edx, esi
add edx, eax
nop
cmp rdi, 0xb
jae 0x4b417a
movzx r8d, byte [rsp + rdi + 0x19]
sub r8d, edx
cmp rsi, 0xb
jb 0x4b410b
jmp 0x4b416e
xor eax, eax
lea rbx, [rsp + 0x19]
mov ecx, 0xb
call fcn.0044bb20
add rsp, 0x30
pop rbp
ret
mov eax, esi
mov ecx, 0xb
call fcn.00461020
mov eax, edi
mov ecx, 0xb
call fcn.00461020
nop
call fcn.0045eda0
jmp fcn.004b40c0
Function at 0x4b53c0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4b54bd
push rbp
mov rbp, rsp
sub rsp, 0x50
movabs rdx, 0xd39e546d7567729a
mov qword [rsp + 0x1c], rdx
movabs rdx, 0x9934a9b3bb45d39e
mov qword [rsp + 0x22], rdx
movabs rdx, 0x75b985913d8e927f
mov qword [rsp + 0x2a], rdx
movabs rdx, 0x813000c1315070e
mov qword [rsp + 0x32], rdx
movabs rdx, 0x1311000f12101100
mov qword [rsp + 0x3a], rdx
movabs rdx, 0x11070e130f061311
mov qword [rsp + 0x40], rdx
movabs rdx, 0x70a0914060b050d
mov qword [rsp + 0x48], rdx
xor eax, eax
jmp 0x4b5460
movzx r9d, byte [rsp + rsi + 0x1c]
sub r9d, edx
lea edx, [r9 - 0x16]
mov byte [rsp + rdi + 0x1c], dl
lea edx, [r8 - 0x16]
mov byte [rsp + rsi + 0x1c], dl
add rax, 2
nop dword [rax]
cmp rax, 0x1e
jge 0x4b548d
movzx edx, byte [rsp + rax + 0x32]
movzx esi, byte [rsp + rax + 0x33]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x16
jae 0x4b54b0
movzx r8d, byte [rsp + rdi + 0x1c]
sub r8d, edx
cmp rsi, 0x16
jb 0x4b543f
jmp 0x4b54a4
xor eax, eax
lea rbx, [rsp + 0x1c]
mov ecx, 0x16
call fcn.0044bb20
add rsp, 0x50
pop rbp
ret
mov eax, esi
mov ecx, 0x16
call fcn.00461020
mov eax, edi
mov ecx, 0x16
call fcn.00461020
nop
nop dword [rax]
call fcn.0045eda0
jmp fcn.004b53c0

Function at 0x4b54e0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4b55ca
push rbp
mov rbp, rsp
sub rsp, 0x40
movabs rdx, 0x98f6786994f187f6
mov qword [rsp + 0x1d], rdx
movabs rdx, 0x6f98f6786994f187
mov qword [rsp + 0x1e], rdx
movabs rdx, 0x6404fe0df49120fe
mov qword [rsp + 0x26], rdx
movabs rdx, 0x300020b0c010501
mov qword [rsp + 0x2e], rdx
movabs rdx, 0x60f0300020b0c01
mov qword [rsp + 0x30], rdx
movabs rdx, 0xd00090e070e0502
mov qword [rsp + 0x38], rdx
xor eax, eax
jmp 0x4b556d
movzx r9d, byte [rsp + rsi + 0x1d]
sub r9d, edx
lea edx, [r9 - 0x80]
mov byte [rsp + rdi + 0x1d], dl
lea edx, [r8 - 0x80]
mov byte [rsp + rsi + 0x1d], dl
add rax, 2
cmp rax, 0x12
jge 0x4b559a
movzx edx, byte [rsp + rax + 0x2e]
movzx esi, byte [rsp + rax + 0x2f]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x11
jae 0x4b55bd
movzx r8d, byte [rsp + rdi + 0x1d]
sub r8d, edx
cmp rsi, 0x11
jb 0x4b5550
jmp 0x4b55b1
xor eax, eax
lea rbx, [rsp + 0x1d]
mov ecx, 0x11
call fcn.0044bb20
add rsp, 0x40
pop rbp
ret
mov eax, esi
mov ecx, 0x11
call fcn.00461020
mov eax, edi
mov ecx, 0x11
call fcn.00461020
nop
call fcn.0045eda0
jmp fcn.004b54e0
Function at 0x4b5940
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4b5a67
push rbp
mov rbp, rsp
sub rsp, 0x68
movabs rdx, 0x7b8d166f6ef46100
mov qword [rsp + 0x1b], rdx
movabs rdx, 0x9cde20f467a67f18
mov qword [rsp + 0x23], rdx
movabs rdx, 0xf045746c1bf0919c
mov qword [rsp + 0x2a], rdx
movabs rdx, 0x730afd2b64480903
mov qword [rsp + 0x32], rdx
movabs rdx, 0x1209101713051908
mov qword [rsp + 0x3a], rdx
movabs rdx, 0xe070f161c050913
mov qword [rsp + 0x42], rdx
movabs rdx, 0x60a0c02101b0e07
mov qword [rsp + 0x48], rdx
movabs rdx, 0xe1608161508100a
mov qword [rsp + 0x50], rdx
movabs rdx, 0xa1d111200151213
mov qword [rsp + 0x58], rdx
movabs rdx, 0x181118190018091b
mov qword [rsp + 0x60], rdx
xor eax, eax
jmp 0x4b5a09
movzx r9d, byte [rsp + rsi + 0x1b]
sub r9d, edx
lea edx, [r9 - 0x66]
mov byte [rsp + rdi + 0x1b], dl
lea edx, [r8 - 0x66]
mov byte [rsp + rsi + 0x1b], dl
add rax, 2
cmp rax, 0x2e
jge 0x4b5a37
movzx edx, byte [rsp + rax + 0x3a]
movzx esi, byte [rsp + rax + 0x3b]
mov edi, edx
xor edx, esi
add edx, eax
nop
cmp rdi, 0x1f
jae 0x4b5a5a
movzx r8d, byte [rsp + rdi + 0x1b]
sub r8d, edx
cmp rsi, 0x1f
jb 0x4b59ec
jmp 0x4b5a4e
xor eax, eax
lea rbx, [rsp + 0x1b]
mov ecx, 0x1f
call fcn.0044bb20
add rsp, 0x68
pop rbp
ret
mov eax, esi
mov ecx, 0x1f
call fcn.00461020
mov eax, edi
mov ecx, 0x1f
call fcn.00461020
nop
call fcn.0045eda0
jmp fcn.004b5940

Function at 0x4b7b00
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4b7bfd
push rbp
mov rbp, rsp
sub rsp, 0x50
movabs rdx, 0xe2eb65632b313976
mov qword [rsp + 0x19], rdx
movabs rdx, 0x32fadb1372ef72e2
mov qword [rsp + 0x20], rdx
movabs rdx, 0x38ff1ba93e082d35
mov qword [rsp + 0x28], rdx
movabs rdx, 0x14100600020e0d03
mov qword [rsp + 0x30], rdx
movabs rdx, 0x30c0b1616070c09
mov qword [rsp + 0x38], rdx
movabs rdx, 0x1101111506061300
mov qword [rsp + 0x40], rdx
movabs rdx, 0xb0f120612001516
mov qword [rsp + 0x48], rdx
xor eax, eax
jmp 0x4b7ba0
movzx r9d, byte [rsp + rsi + 0x19]
sub r9d, edx
lea edx, [r9 + 0x52]
mov byte [rsp + rdi + 0x19], dl
lea edx, [r8 + 0x52]
mov byte [rsp + rsi + 0x19], dl
add rax, 2
nop dword [rax]
cmp rax, 0x20
jge 0x4b7bcd
movzx edx, byte [rsp + rax + 0x30]
movzx esi, byte [rsp + rax + 0x31]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x17
jae 0x4b7bf0
movzx r8d, byte [rsp + rdi + 0x19]
sub r8d, edx
cmp rsi, 0x17
jb 0x4b7b7f
jmp 0x4b7be4
xor eax, eax
lea rbx, [rsp + 0x19]
mov ecx, 0x17
call fcn.0044bb20
add rsp, 0x50
pop rbp
ret
mov eax, esi
mov ecx, 0x17
call fcn.00461020
mov eax, edi
mov ecx, 0x17
call fcn.00461020
nop
nop dword [rax]
call fcn.0045eda0
jmp fcn.004b7b00
Function at 0x4b8820
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4b8932
push rbp
mov rbp, rsp
sub rsp, 0x60
movabs rdx, 0x4356194b40366f14
mov qword [rsp + 0x18], rdx
movabs rdx, 0x20643841752c4843
mov qword [rsp + 0x20], rdx
movabs rdx, 0x410b6365114a391f
mov qword [rsp + 0x28], rdx
movabs rdx, 0x4f2a59625020116f
mov qword [rsp + 0x30], rdx
movabs rdx, 0xe060d1f020a1205
mov qword [rsp + 0x38], rdx
movabs rdx, 0x1f0409131d11101b
mov qword [rsp + 0x40], rdx
movabs rdx, 0xa001707071d1b0a
mov qword [rsp + 0x48], rdx
movabs rdx, 0x916171608191216
mov qword [rsp + 0x50], rdx
movabs rdx, 0x9080c030a12021e
mov qword [rsp + 0x58], rdx
xor eax, eax
jmp 0x4b88d3
movzx r9d, byte [rsp + rsi + 0x18]
add edx, r9d
mov byte [rsp + rdi + 0x18], dl
mov byte [rsp + rsi + 0x18], r8b
add rax, 2
cmp rax, 0x28
jge 0x4b8902
movzx edx, byte [rsp + rax + 0x38]
movzx esi, byte [rsp + rax + 0x39]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x20
jae 0x4b8925
movzx r8d, byte [rsp + rdi + 0x18]
add r8d, edx
cmp rsi, 0x20
jb 0x4b88bd
nop
jmp 0x4b8919
xor eax, eax
lea rbx, [rsp + 0x18]
mov ecx, 0x20
call fcn.0044bb20
add rsp, 0x60
pop rbp
ret
mov eax, esi
mov ecx, 0x20
call fcn.00461020
mov eax, edi
mov ecx, 0x20
call fcn.00461020
nop
call fcn.0045eda0
jmp fcn.004b8820

Function at 0x4b8b60
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4b8c6c
push rbp
mov rbp, rsp
sub rsp, 0x58
movabs rdx, 0x658f6075fb03fef8
mov qword [rsp + 0x1f], rdx
movabs rdx, 0xeb836c781551851a
mov qword [rsp + 0x27], rdx
movabs rdx, 0xffeb836c78155185
mov qword [rsp + 0x28], rdx
movabs rdx, 0x3e79b2046f769020
mov qword [rsp + 0x30], rdx
movabs rdx, 0x1209080518160c05
mov qword [rsp + 0x38], rdx
movabs rdx, 0x20b15180c0a1601
mov qword [rsp + 0x40], rdx
movabs rdx, 0x1003170e0f120a0c
mov qword [rsp + 0x48], rdx
movabs rdx, 0x1090a000601170e
mov qword [rsp + 0x50], rdx
xor eax, eax
jmp 0x4b8c08
movzx r9d, byte [rsp + rsi + 0x1f]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x47]
mov byte [rsp + rdi + 0x1f], dl
mov byte [rsp + rsi + 0x1f], r8b
add rax, 2
cmp rax, 0x20
jge 0x4b8c3c
movzx edx, byte [rsp + rax + 0x38]
movzx esi, byte [rsp + rax + 0x39]
mov edi, edx
xor edx, esi
add edx, eax
nop
cmp rdi, 0x19
jae 0x4b8c5f
movzx r8d, byte [rsp + rdi + 0x1f]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x47]
cmp rsi, 0x19
jb 0x4b8bee
jmp 0x4b8c53
xor eax, eax
lea rbx, [rsp + 0x1f]
mov ecx, 0x19
call fcn.0044bb20
add rsp, 0x58
pop rbp
ret
mov eax, esi
mov ecx, 0x19
call fcn.00461020
mov eax, edi
mov ecx, 0x19
call fcn.00461020
nop
call fcn.0045eda0
jmp fcn.004b8b60
Function at 0x4b9140
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4b9267
push rbp
mov rbp, rsp
sub rsp, 0x68
movabs rdx, 0x618d11721123109c
mov qword [rsp + 0x1c], rdx
movabs rdx, 0x656ab36776de4686
mov qword [rsp + 0x24], rdx
movabs rdx, 0x21b4f2bacc501831
mov qword [rsp + 0x2c], rdx
movabs rdx, 0xd0351b6d43c42066
mov qword [rsp + 0x34], rdx
movabs rdx, 0x60a13170d171612
mov qword [rsp + 0x3c], rdx
movabs rdx, 0x30e111f0308161a
mov qword [rsp + 0x44], rdx
movabs rdx, 0xb000b030e111f
mov qword [rsp + 0x48], rdx
movabs rdx, 0x5050b0203050a01
mov qword [rsp + 0x50], rdx
movabs rdx, 0x111e1a1d170e1411
mov qword [rsp + 0x58], rdx
movabs rdx, 0x1b06100915011e
mov qword [rsp + 0x60], rdx
xor eax, eax
jmp 0x4b9209
movzx r9d, byte [rsp + rsi + 0x1c]
sub r9d, edx
lea edx, [r9 + 0x70]
mov byte [rsp + rdi + 0x1c], dl
lea edx, [r8 + 0x70]
mov byte [rsp + rsi + 0x1c], dl
add rax, 2
cmp rax, 0x2c
jge 0x4b9237
movzx edx, byte [rsp + rax + 0x3c]
movzx esi, byte [rsp + rax + 0x3d]
mov edi, edx
xor edx, esi
add edx, eax
nop
cmp rdi, 0x20
jae 0x4b925a
movzx r8d, byte [rsp + rdi + 0x1c]
sub r8d, edx
cmp rsi, 0x20
jb 0x4b91ec
jmp 0x4b924e
xor eax, eax
lea rbx, [rsp + 0x1c]
mov ecx, 0x20
call fcn.0044bb20
add rsp, 0x68
pop rbp
ret
mov eax, esi
mov ecx, 0x20
call fcn.00461020
mov eax, edi
mov ecx, 0x20
call fcn.00461020
nop
call fcn.0045eda0
jmp fcn.004b9140

Function at 0x4ba920
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4baa0a
push rbp
mov rbp, rsp
sub rsp, 0x48
movabs rdx, 0x70ef72f882741a69
mov qword [rsp + 0x19], rdx
movabs rdx, 0x64e9f12064f1fb70
mov qword [rsp + 0x20], rdx
movabs rdx, 0x6c0261d1206d89a3
mov qword [rsp + 0x28], rdx
movabs rdx, 0xe040c060e0d1313
mov qword [rsp + 0x30], rdx
movabs rdx, 0x30e100f10010d04
mov qword [rsp + 0x38], rdx
movabs rdx, 0xf0e090301151008
mov qword [rsp + 0x40], rdx
xor eax, eax
jmp 0x4ba9ad
movzx r9d, byte [rsp + rsi + 0x19]
sub r9d, edx
lea edx, [r9 - 0x6e]
mov byte [rsp + rdi + 0x19], dl
lea edx, [r8 - 0x6e]
mov byte [rsp + rsi + 0x19], dl
add rax, 2
cmp rax, 0x18
jge 0x4ba9da
movzx edx, byte [rsp + rax + 0x30]
movzx esi, byte [rsp + rax + 0x31]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x17
jae 0x4ba9fd
movzx r8d, byte [rsp + rdi + 0x19]
sub r8d, edx
cmp rsi, 0x17
jb 0x4ba990
jmp 0x4ba9f1
xor eax, eax
lea rbx, [rsp + 0x19]
mov ecx, 0x17
call fcn.0044bb20
add rsp, 0x48
pop rbp
ret
mov eax, esi
mov ecx, 0x17
call fcn.00461020
mov eax, edi
mov ecx, 0x17
call fcn.00461020
nop
call fcn.0045eda0
jmp fcn.004ba920
Function at 0x4bc340
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4bc40c
push rbp
mov rbp, rsp
sub rsp, 0x38
movabs rdx, 0xb36f606c65b265b7
mov qword [rsp + 0x1d], rdx
movabs rdx, 0x749f40e872b36f60
mov qword [rsp + 0x22], rdx
movabs rdx, 0xb0006060b0a0b09
mov qword [rsp + 0x2a], rdx
movabs rdx, 0x2000b0705050b00
mov qword [rsp + 0x30], rdx
xor eax, eax
jmp 0x4bc3af
movzx r9d, byte [rsp + rsi + 0x1d]
sub r9d, edx
lea edx, [r9 - 0x38]
mov byte [rsp + rdi + 0x1d], dl
lea edx, [r8 - 0x38]
mov byte [rsp + rsi + 0x1d], dl
add rax, 2
cmp rax, 0xe
jge 0x4bc3dc
movzx edx, byte [rsp + rax + 0x2a]
movzx esi, byte [rsp + rax + 0x2b]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0xd
jae 0x4bc3ff
movzx r8d, byte [rsp + rdi + 0x1d]
sub r8d, edx
cmp rsi, 0xd
jb 0x4bc392
jmp 0x4bc3f3
xor eax, eax
lea rbx, [rsp + 0x1d]
mov ecx, 0xd
call fcn.0044bb20
add rsp, 0x38
pop rbp
ret
mov eax, esi
mov ecx, 0xd
call fcn.00461020
mov eax, edi
mov ecx, 0xd
call fcn.00461020
nop
call fcn.0045eda0
jmp fcn.004bc340

Function at 0x4bc7c0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4bc8f8
push rbp
mov rbp, rsp
sub rsp, 0x68
movabs rdx, 0xdaa6966f6e6eda63
mov qword [rsp + 0x19], rdx
movabs rdx, 0x6120b68080daa696
mov qword [rsp + 0x1e], rdx
movabs rdx, 0xe764618997c573a8
mov qword [rsp + 0x26], rdx
movabs rdx, 0x9cb5feaaa4629a97
mov qword [rsp + 0x2e], rdx
movabs rdx, 0xde6cb2740272b198
mov qword [rsp + 0x36], rdx
movabs rdx, 0x20220a21011d1206
mov qword [rsp + 0x3e], rdx
movabs rdx, 0x240d052214120d07
mov qword [rsp + 0x46], rdx
movabs rdx, 0x512240d05221412
mov qword [rsp + 0x48], rdx
movabs rdx, 0x1e1d0f110d1e1e1a
mov qword [rsp + 0x50], rdx
movabs rdx, 0xa0d08101c1d1811
mov qword [rsp + 0x58], rdx
movabs rdx, 0x212119091615191b
mov qword [rsp + 0x60], rdx
xor eax, eax
jmp 0x4bc895
movzx r9d, byte [rsp + rsi + 0x19]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x55]
mov byte [rsp + rdi + 0x19], dl
mov byte [rsp + rsi + 0x19], r8b
add rax, 2
cmp rax, 0x2a
jge 0x4bc8c8
movzx edx, byte [rsp + rax + 0x3e]
movzx esi, byte [rsp + rax + 0x3f]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x25
jae 0x4bc8eb
movzx r8d, byte [rsp + rdi + 0x19]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x55]
nop
cmp rsi, 0x25
jb 0x4bc87b
jmp 0x4bc8df
xor eax, eax
lea rbx, [rsp + 0x19]
mov ecx, 0x25
call fcn.0044bb20
add rsp, 0x68
pop rbp
ret
mov eax, esi
mov ecx, 0x25
call fcn.00461020
mov eax, edi
mov ecx, 0x25
call fcn.00461020
nop
call fcn.0045eda0
nop dword [rax]
jmp fcn.004bc7c0