joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4bd8e0
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
push rbp
mov rbp, rsp
mov rcx, qword [rsp + 0x10]
mov rax, qword [rsp + 0x18]
mov rbx, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x28]
movups xmm0, xmmword [rax]
movups xmmword [rbx], xmm0
add rbx, 0x10
pxor xmm4, xmm4
cmp ecx, 0xc
je 0x4bd9b4
jb 0x4bda13
movups xmm2, xmmword [rax + 0x10]
movups xmmword [rbx], xmm2
add rbx, 0x10
aeskeygenassist xmm1, xmm2, 1
call fcn.004bd7c0
aeskeygenassist xmm1, xmm0, 1
call fcn.004bd7e0
aeskeygenassist xmm1, xmm2, 2
call fcn.004bd7c0
aeskeygenassist xmm1, xmm0, 2
call fcn.004bd7e0
aeskeygenassist xmm1, xmm2, 4
call fcn.004bd7c0
aeskeygenassist xmm1, xmm0, 4
call fcn.004bd7e0
aeskeygenassist xmm1, xmm2, 8
call fcn.004bd7c0
aeskeygenassist xmm1, xmm0, 8
call fcn.004bd7e0
aeskeygenassist xmm1, xmm2, 0x10
call fcn.004bd7c0
aeskeygenassist xmm1, xmm0, 0x10
call fcn.004bd7e0
aeskeygenassist xmm1, xmm2, 0x20
call fcn.004bd7c0
aeskeygenassist xmm1, xmm0, 0x20
call fcn.004bd7e0
aeskeygenassist xmm1, xmm2, 0x40
call fcn.004bd7c0
jmp 0x4bda81
movq xmm2, qword [rax + 0x10]
aeskeygenassist xmm1, xmm2, 1
call fcn.004bd720
aeskeygenassist xmm1, xmm2, 2
call fcn.004bd780
aeskeygenassist xmm1, xmm2, 4
call fcn.004bd720
aeskeygenassist xmm1, xmm2, 8
call fcn.004bd780
aeskeygenassist xmm1, xmm2, 0x10
call fcn.004bd720
aeskeygenassist xmm1, xmm2, 0x20
call fcn.004bd780
aeskeygenassist xmm1, xmm2, 0x40
call fcn.004bd720
aeskeygenassist xmm1, xmm2, 0x80
call fcn.004bd780
jmp 0x4bda81
aeskeygenassist xmm1, xmm0, 1
call fcn.004bd6e0
aeskeygenassist xmm1, xmm0, 2
call fcn.004bd6e0
aeskeygenassist xmm1, xmm0, 4
call fcn.004bd6e0
aeskeygenassist xmm1, xmm0, 8
call fcn.004bd6e0
aeskeygenassist xmm1, xmm0, 0x10
call fcn.004bd6e0
aeskeygenassist xmm1, xmm0, 0x20
call fcn.004bd6e0
aeskeygenassist xmm1, xmm0, 0x40
call fcn.004bd6e0
aeskeygenassist xmm1, xmm0, 0x80
call fcn.004bd6e0
aeskeygenassist xmm1, xmm0, 0x1b
call fcn.004bd6e0
aeskeygenassist xmm1, xmm0, 0x36
call fcn.004bd6e0
sub rbx, 0x10
movups xmm1, xmmword [rbx]
movups xmmword [rdx], xmm1
dec rcx
movups xmm1, xmmword [rbx - 0x10]
aesimc xmm0, xmm1
movups xmmword [rdx + 0x10], xmm0
sub rbx, 0x10
add rdx, 0x10
dec rcx
jne 0x4bda8e
movups xmm0, xmmword [rbx - 0x10]
movups xmmword [rdx + 0x10], xmm0
pop rbp
ret
Function at 0x4c11a0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
lea r12, [rsp - 0x10]
cmp r12, qword [r14 + 0x10]
jbe 0x4c1312
push rbp
mov rbp, rsp
sub rsp, 0x88
movabs rdx, 0x676e1b2645de4c30
mov qword [rsp + 0x5c], rdx
movabs rdx, 0x8fb16130406c4a20
mov qword [rsp + 0x64], rdx
movabs rdx, 0x4d0122ac8fb16130
mov qword [rsp + 0x68], rdx
movabs rdx, 0x15303d02e85b1b6e
mov qword [rsp + 0x70], rdx
movabs rdx, 0xd1e74c0b426ceb65
mov qword [rsp + 0x78], rdx
movabs rdx, 0xf065df0d61cfb569
mov qword [rsp + 0x80], rdx
movabs rdx, 0x1b11260115042917
mov qword [rsp + 0x1c], rdx
movabs rdx, 0x1f091b030e232415
mov qword [rsp + 0x24], rdx
movabs rdx, 0xf0113161d1b0f0e
mov qword [rsp + 0x2c], rdx
movabs rdx, 0x212105020c122304
mov qword [rsp + 0x34], rdx
movabs rdx, 0x190b05220e150029
mov qword [rsp + 0x3c], rdx
movabs rdx, 0x10022b22251b0303
mov qword [rsp + 0x44], rdx
movabs rdx, 0x281805020c01200f
mov qword [rsp + 0x4c], rdx
movabs rdx, 0x17041a0e1a15051b
mov qword [rsp + 0x54], rdx
xor eax, eax
jmp 0x4c12ad
movzx r9d, byte [rsp + rsi + 0x5c]
lea edx, [r9 + rdx]
lea edx, [rdx - 5]
mov byte [rsp + rdi + 0x5c], dl
mov byte [rsp + rsi + 0x5c], r8b
add rax, 2
cmp rax, 0x40
jge 0x4c12df
movzx edx, byte [rsp + rax + 0x1c]
movzx esi, byte [rsp + rax + 0x1d]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x2c
jae 0x4c1305
movzx r8d, byte [rsp + rdi + 0x5c]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 5]
cmp rsi, 0x2c
jb 0x4c1293
jmp 0x4c12f9
xor eax, eax
lea rbx, [rsp + 0x5c]
mov ecx, 0x2c
call fcn.00444780
add rsp, 0x88
pop rbp
ret
mov eax, esi
mov ecx, 0x2c
call fcn.004564a0
mov eax, edi
mov ecx, 0x2c
call fcn.004564a0
nop
call fcn.004541c0
jmp fcn.004c11a0

Function at 0x4c1320
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4c13f2
push rbp
mov rbp, rsp
sub rsp, 0x38
movabs rdx, 0x816469d361c9c229
mov qword [rsp + 0x29], rdx
movabs rdx, 0xc97cc4d3ccc9c081
mov qword [rsp + 0x30], rdx
movabs rdx, 0xc00010a0b0d0d00
mov qword [rsp + 0x19], rdx
movabs rdx, 0xe0807070204090c
mov qword [rsp + 0x21], rdx
xor eax, eax
jmp 0x4c138c
movzx r9d, byte [rsp + rsi + 0x29]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x6d]
mov byte [rsp + rdi + 0x29], dl
mov byte [rsp + rsi + 0x29], r8b
add rax, 2
cmp rax, 0x10
jge 0x4c13be
movzx edx, byte [rsp + rax + 0x19]
movzx esi, byte [rsp + rax + 0x1a]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0xf
jae 0x4c13e5
movzx r8d, byte [rsp + rdi + 0x29]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x6d]
cmp rsi, 0xf
jb 0x4c1372
jmp 0x4c13d5
xor eax, eax
lea rbx, [rsp + 0x29]
mov ecx, 0xf
call fcn.00444780
add rsp, 0x38
pop rbp
ret
mov eax, esi
mov ecx, 0xf
nop dword [rax]
call fcn.004564a0
mov eax, edi
mov ecx, 0xf
call fcn.004564a0
nop
call fcn.004541c0
jmp fcn.004c1320
Function at 0x4c4800
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4c48ec
push rbp
mov rbp, rsp
sub rsp, 0x40
movabs rdx, 0x6973735d6544655a
mov qword [rsp + 0x2f], rdx
movabs rdx, 0x4b6973735d654465
mov qword [rsp + 0x30], rdx
movabs rdx, 0xc565606e1c556d5d
mov qword [rsp + 0x38], rdx
movabs rdx, 0x100a03080a020c10
mov qword [rsp + 0x1b], rdx
movabs rdx, 0xb090e0c100a0308
mov qword [rsp + 0x1f], rdx
movabs rdx, 0x40a09000304030e
mov qword [rsp + 0x27], rdx
xor eax, eax
jmp 0x4c488a
movzx r9d, byte [rsp + rsi + 0x2f]
lea edx, [r9 + rdx]
lea edx, [rdx - 5]
mov byte [rsp + rdi + 0x2f], dl
mov byte [rsp + rsi + 0x2f], r8b
add rax, 2
cmp rax, 0x14
jge 0x4c48bc
movzx edx, byte [rsp + rax + 0x1b]
movzx esi, byte [rsp + rax + 0x1c]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x11
jae 0x4c48df
movzx r8d, byte [rsp + rdi + 0x2f]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 5]
cmp rsi, 0x11
jb 0x4c4870
jmp 0x4c48d3
xor eax, eax
lea rbx, [rsp + 0x2f]
mov ecx, 0x11
call fcn.00444780
add rsp, 0x40
pop rbp
ret
mov eax, esi
mov ecx, 0x11
call fcn.004564a0
mov eax, edi
mov ecx, 0x11
call fcn.004564a0
nop
call fcn.004541c0
jmp fcn.004c4800

Function at 0x4c4bc0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4c4caa
push rbp
mov rbp, rsp
sub rsp, 0x48
movabs rdx, 0x65fd6433eedbf714
mov qword [rsp + 0x35], rdx
movabs rdx, 0x6ee1f565fd6433ee
mov qword [rsp + 0x38], rdx
movabs rdx, 0x21386978f2f81c28
mov qword [rsp + 0x40], rdx
movabs rdx, 0xd0911080211000b
mov qword [rsp + 0x1d], rdx
movabs rdx, 0x120b0c0801060106
mov qword [rsp + 0x25], rdx
movabs rdx, 0xb080e0908110304
mov qword [rsp + 0x2d], rdx
xor eax, eax
jmp 0x4c4c4d
movzx r9d, byte [rsp + rsi + 0x35]
sub r9d, edx
lea edx, [r9 + 0x49]
mov byte [rsp + rdi + 0x35], dl
lea edx, [r8 + 0x49]
mov byte [rsp + rsi + 0x35], dl
add rax, 2
cmp rax, 0x18
jge 0x4c4c7a
movzx edx, byte [rsp + rax + 0x1d]
movzx esi, byte [rsp + rax + 0x1e]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x13
jae 0x4c4c9d
movzx r8d, byte [rsp + rdi + 0x35]
sub r8d, edx
cmp rsi, 0x13
jb 0x4c4c30
jmp 0x4c4c91
xor eax, eax
lea rbx, [rsp + 0x35]
mov ecx, 0x13
call fcn.00444780
add rsp, 0x48
pop rbp
ret
mov eax, esi
mov ecx, 0x13
call fcn.004564a0
mov eax, edi
mov ecx, 0x13
call fcn.004564a0
nop
call fcn.004541c0
jmp fcn.004c4bc0
Function at 0x4cf300
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4cf3fd
push rbp
mov rbp, rsp
sub rsp, 0x50
movabs rdx, 0x2e3f304e4565140a
mov qword [rsp + 0x3b], rdx
movabs rdx, 0x20fedc2e692e3f30
mov qword [rsp + 0x40], rdx
movabs rdx, 0xd1d36c442a2a0b73
mov qword [rsp + 0x48], rdx
movabs rdx, 0x911100e0b13130e
mov qword [rsp + 0x1f], rdx
movabs rdx, 0x130014000a10130f
mov qword [rsp + 0x27], rdx
movabs rdx, 0x10a070513001400
mov qword [rsp + 0x2b], rdx
movabs rdx, 0x30f110e0a061004
mov qword [rsp + 0x33], rdx
xor eax, eax
jmp 0x4cf3a0
movzx r9d, byte [rsp + rsi + 0x3b]
sub r9d, edx
lea edx, [r9 + 0x48]
mov byte [rsp + rdi + 0x3b], dl
lea edx, [r8 + 0x48]
mov byte [rsp + rsi + 0x3b], dl
add rax, 2
nop dword [rax]
cmp rax, 0x1c
jge 0x4cf3cd
movzx edx, byte [rsp + rax + 0x1f]
movzx esi, byte [rsp + rax + 0x20]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x15
jae 0x4cf3f0
movzx r8d, byte [rsp + rdi + 0x3b]
sub r8d, edx
cmp rsi, 0x15
jb 0x4cf37f
jmp 0x4cf3e4
xor eax, eax
lea rbx, [rsp + 0x3b]
mov ecx, 0x15
call fcn.00444780
add rsp, 0x50
pop rbp
ret
mov eax, esi
mov ecx, 0x15
call fcn.004564a0
mov eax, edi
mov ecx, 0x15
call fcn.004564a0
nop
nop dword [rax]
call fcn.004541c0
jmp fcn.004cf300

Function at 0x4cfb00
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4cfbfd
push rbp
mov rbp, rsp
sub rsp, 0x50
movabs rdx, 0x2e612e367133be31
mov qword [rsp + 0x39], rdx
movabs rdx, 0x258533b268be672e
mov qword [rsp + 0x40], rdx
movabs rdx, 0xbe2ebc79bdb074
mov qword [rsp + 0x48], rdx
movabs rdx, 0x612080a10130308
mov qword [rsp + 0x19], rdx
movabs rdx, 0x11150b0b0d12010a
mov qword [rsp + 0x21], rdx
movabs rdx, 0x13150e0d090f0e01
mov qword [rsp + 0x29], rdx
movabs rdx, 0x111001100a0e0b0f
mov qword [rsp + 0x31], rdx
xor eax, eax
jmp 0x4cfba0
movzx r9d, byte [rsp + rsi + 0x39]
sub r9d, edx
lea edx, [r9 - 0x2e]
mov byte [rsp + rdi + 0x39], dl
lea edx, [r8 - 0x2e]
mov byte [rsp + rsi + 0x39], dl
add rax, 2
nop dword [rax]
cmp rax, 0x20
jge 0x4cfbcd
movzx edx, byte [rsp + rax + 0x19]
movzx esi, byte [rsp + rax + 0x1a]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x17
jae 0x4cfbf0
movzx r8d, byte [rsp + rdi + 0x39]
sub r8d, edx
cmp rsi, 0x17
jb 0x4cfb7f
jmp 0x4cfbe4
xor eax, eax
lea rbx, [rsp + 0x39]
mov ecx, 0x17
call fcn.00444780
add rsp, 0x50
pop rbp
ret
mov eax, esi
mov ecx, 0x17
call fcn.004564a0
mov eax, edi
mov ecx, 0x17
call fcn.004564a0
nop
nop dword [rax]
call fcn.004541c0
jmp fcn.004cfb00
Function at 0x4d0600
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4d06ec
push rbp
mov rbp, rsp
sub rsp, 0x40
movabs rdx, 0x22c0c469bc16b3d8
mov qword [rsp + 0x2f], rdx
movabs rdx, 0x7c22c0c469bc16b3
mov qword [rsp + 0x30], rdx
movabs rdx, 0x640e726ec42ec7b7
mov qword [rsp + 0x38], rdx
movabs rdx, 0x7070a0b0c030000
mov qword [rsp + 0x19], rdx
movabs rdx, 0x10f0a08070e0707
mov qword [rsp + 0x1f], rdx
movabs rdx, 0x506060207060109
mov qword [rsp + 0x27], rdx
xor eax, eax
jmp 0x4d068a
movzx r9d, byte [rsp + rsi + 0x2f]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x68]
mov byte [rsp + rdi + 0x2f], dl
mov byte [rsp + rsi + 0x2f], r8b
add rax, 2
cmp rax, 0x16
jge 0x4d06bc
movzx edx, byte [rsp + rax + 0x19]
movzx esi, byte [rsp + rax + 0x1a]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x11
jae 0x4d06df
movzx r8d, byte [rsp + rdi + 0x2f]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x68]
cmp rsi, 0x11
jb 0x4d0670
jmp 0x4d06d3
xor eax, eax
lea rbx, [rsp + 0x2f]
mov ecx, 0x11
call fcn.00444780
add rsp, 0x40
pop rbp
ret
mov eax, esi
mov ecx, 0x11
call fcn.004564a0
mov eax, edi
mov ecx, 0x11
call fcn.004564a0
nop
call fcn.004541c0
jmp fcn.004d0600

Function at 0x4d0700
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4d0827
push rbp
mov rbp, rsp
sub rsp, 0x68
movabs rdx, 0x52615d96686e6170
mov qword [rsp + 0x49], rdx
movabs rdx, 0x80926d6e71698fad
mov qword [rsp + 0x51], rdx
movabs rdx, 0x78ac7d8568756880
mov qword [rsp + 0x58], rdx
movabs rdx, 0x1a7365894f646123
mov qword [rsp + 0x60], rdx
movabs rdx, 0x12031e0d100d0706
mov qword [rsp + 0x1b], rdx
movabs rdx, 0x1208151a07140515
mov qword [rsp + 0x23], rdx
movabs rdx, 0x6051b1e0b121208
mov qword [rsp + 0x29], rdx
movabs rdx, 0x1b15040008070b08
mov qword [rsp + 0x31], rdx
movabs rdx, 0x61b1e0917171610
mov qword [rsp + 0x39], rdx
movabs rdx, 0x130e0f0e1b1407
mov qword [rsp + 0x41], rdx
xor eax, eax
jmp 0x4d07c9
movzx r9d, byte [rsp + rsi + 0x49]
sub r9d, edx
lea edx, [r9 + 0x1d]
mov byte [rsp + rdi + 0x49], dl
lea edx, [r8 + 0x1d]
mov byte [rsp + rsi + 0x49], dl
add rax, 2
cmp rax, 0x2e
jge 0x4d07f7
movzx edx, byte [rsp + rax + 0x1b]
movzx esi, byte [rsp + rax + 0x1c]
mov edi, edx
xor edx, esi
add edx, eax
nop
cmp rdi, 0x1f
jae 0x4d081a
movzx r8d, byte [rsp + rdi + 0x49]
sub r8d, edx
cmp rsi, 0x1f
jb 0x4d07ac
jmp 0x4d080e
xor eax, eax
lea rbx, [rsp + 0x49]
mov ecx, 0x1f
call fcn.00444780
add rsp, 0x68
pop rbp
ret
mov eax, esi
mov ecx, 0x1f
call fcn.004564a0
mov eax, edi
mov ecx, 0x1f
call fcn.004564a0
nop
call fcn.004541c0
jmp fcn.004d0700
Function at 0x4d0f60
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4d107a
push rbp
mov rbp, rsp
sub rsp, 0x60
movabs rdx, 0x5d448dbe6f1dba72
mov qword [rsp + 0x40], rdx
movabs rdx, 0xb1729f8c92659bdd
mov qword [rsp + 0x48], rdx
movabs rdx, 0x61c3870479ac6972
mov qword [rsp + 0x50], rdx
movabs rdx, 0xc5a5a461a569b576
mov qword [rsp + 0x58], rdx
movabs rdx, 0x1d040201070f0714
mov qword [rsp + 0x1a], rdx
movabs rdx, 0x1612141f0d011d04
mov qword [rsp + 0x20], rdx
movabs rdx, 0xc1f19081b1e1907
mov qword [rsp + 0x28], rdx
movabs rdx, 0x121d071506141419
mov qword [rsp + 0x30], rdx
movabs rdx, 0xf150d090b050c09
mov qword [rsp + 0x38], rdx
xor eax, eax
jmp 0x4d1017
movzx r9d, byte [rsp + rsi + 0x40]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x4e]
mov byte [rsp + rdi + 0x40], dl
mov byte [rsp + rsi + 0x40], r8b
add rax, 2
cmp rax, 0x26
jge 0x4d1049
movzx edx, byte [rsp + rax + 0x1a]
movzx esi, byte [rsp + rax + 0x1b]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x20
jae 0x4d106d
movzx r8d, byte [rsp + rdi + 0x40]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x4e]
cmp rsi, 0x20
jb 0x4d0ffd
jmp 0x4d1061
xor eax, eax
lea rbx, [rsp + 0x40]
mov ecx, 0x20
call fcn.00444780
add rsp, 0x60
pop rbp
nop
ret
mov eax, esi
mov ecx, 0x20
call fcn.004564a0
mov eax, edi
mov ecx, 0x20
call fcn.004564a0
nop
call fcn.004541c0
nop
jmp fcn.004d0f60

Function at 0x4d2480
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4d254c
push rbp
mov rbp, rsp
sub rsp, 0x38
movabs rdx, 0xf5db36c61941c69
mov qword [rsp + 0x2c], rdx
mov dword [rsp + 0x34], 0xaefb6c73
movabs rdx, 0x20105020502060b
mov qword [rsp + 0x1e], rdx
movabs rdx, 0xa0606010b070201
mov qword [rsp + 0x24], rdx
xor eax, eax
jmp 0x4d24e5
movzx r9d, byte [rsp + rsi + 0x2c]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x51]
mov byte [rsp + rdi + 0x2c], dl
mov byte [rsp + rsi + 0x2c], r8b
add rax, 2
cmp rax, 0xe
jge 0x4d251c
movzx edx, byte [rsp + rax + 0x1e]
movzx esi, byte [rsp + rax + 0x1f]
mov edi, edx
xor edx, esi
add edx, eax
nop dword [rax + rax]
cmp rdi, 0xc
jae 0x4d253f
movzx r8d, byte [rsp + rdi + 0x2c]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x51]
cmp rsi, 0xc
jb 0x4d24cb
jmp 0x4d2533
xor eax, eax
lea rbx, [rsp + 0x2c]
mov ecx, 0xc
call fcn.00444780
add rsp, 0x38
pop rbp
ret
mov eax, esi
mov ecx, 0xc
call fcn.004564a0
mov eax, edi
mov ecx, 0xc
call fcn.004564a0
nop
call fcn.004541c0
jmp fcn.004d2480
Function at 0x4d2b00
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4d2c0c
push rbp
mov rbp, rsp
sub rsp, 0x58
movabs rdx, 0x2057656e6edd7b63
mov qword [rsp + 0x3d], rdx
movabs rdx, 0x6f5af4de7a19936e
mov qword [rsp + 0x45], rdx
movabs rdx, 0xe974756f5af4de7a
mov qword [rsp + 0x48], rdx
movabs rdx, 0xea052af990205deb
mov qword [rsp + 0x50], rdx
movabs rdx, 0xb180a0b19090b18
mov qword [rsp + 0x1f], rdx
movabs rdx, 0x120a180d0d01061a
mov qword [rsp + 0x27], rdx
movabs rdx, 0x1713021a1214120a
mov qword [rsp + 0x2d], rdx
movabs rdx, 0x14160e16120c190c
mov qword [rsp + 0x35], rdx
xor eax, eax
jmp 0x4d2ba8
movzx r9d, byte [rsp + rsi + 0x3d]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x5e]
mov byte [rsp + rdi + 0x3d], dl
mov byte [rsp + rsi + 0x3d], r8b
add rax, 2
cmp rax, 0x1e
jge 0x4d2bdc
movzx edx, byte [rsp + rax + 0x1f]
movzx esi, byte [rsp + rax + 0x20]
mov edi, edx
xor edx, esi
add edx, eax
nop
cmp rdi, 0x1b
jae 0x4d2bff
movzx r8d, byte [rsp + rdi + 0x3d]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x5e]
cmp rsi, 0x1b
jb 0x4d2b8e
jmp 0x4d2bf3
xor eax, eax
lea rbx, [rsp + 0x3d]
mov ecx, 0x1b
call fcn.00444780
add rsp, 0x58
pop rbp
ret
mov eax, esi
mov ecx, 0x1b
call fcn.004564a0
mov eax, edi
mov ecx, 0x1b
call fcn.004564a0
nop
call fcn.004541c0
jmp fcn.004d2b00

Function at 0x4d37e0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4d38fd
push rbp
mov rbp, rsp
sub rsp, 0x60
movabs rdx, 0x8b8f929186736564
mov qword [rsp + 0x44], rdx
movabs rdx, 0xac75a896626e7269
mov qword [rsp + 0x4c], rdx
movabs rdx, 0x6e257390ac75a896
mov qword [rsp + 0x50], rdx
movabs rdx, 0x976da069722d6555
mov qword [rsp + 0x58], rdx
movabs rdx, 0x1416100c0f0b0313
mov qword [rsp + 0x1e], rdx
movabs rdx, 0xc171a100b071416
mov qword [rsp + 0x24], rdx
movabs rdx, 0x6190b141a0d1016
mov qword [rsp + 0x2c], rdx
movabs rdx, 0x71a13121b060101
mov qword [rsp + 0x34], rdx
movabs rdx, 0x1a05060e090d0412
mov qword [rsp + 0x3c], rdx
xor eax, eax
jmp 0x4d38a0
movzx r9d, byte [rsp + rsi + 0x44]
sub r9d, edx
lea edx, [r9 + 0x16]
mov byte [rsp + rdi + 0x44], dl
lea edx, [r8 + 0x16]
mov byte [rsp + rsi + 0x44], dl
add rax, 2
nop word [rax + rax]
cmp rax, 0x26
jge 0x4d38cd
movzx edx, byte [rsp + rax + 0x1e]
movzx esi, byte [rsp + rax + 0x1f]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x1c
jae 0x4d38f0
movzx r8d, byte [rsp + rdi + 0x44]
sub r8d, edx
cmp rsi, 0x1c
jb 0x4d387d
jmp 0x4d38e4
xor eax, eax
lea rbx, [rsp + 0x44]
mov ecx, 0x1c
call fcn.00444780
add rsp, 0x60
pop rbp
ret
mov eax, esi
mov ecx, 0x1c
call fcn.004564a0
mov eax, edi
mov ecx, 0x1c
call fcn.004564a0
nop
nop dword [rax]
call fcn.004541c0
jmp fcn.004d37e0
Function at 0x4d44a0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4d4566
push rbp
mov rbp, rsp
sub rsp, 0x30
movabs rdx, 0x7272640907b6610b
mov qword [rsp + 0x25], rdx
mov dword [rsp + 0x2c], 0xc1ac0472
movabs rdx, 0x602030602080204
mov qword [rsp + 0x19], rdx
mov dword [rsp + 0x21], 0x90a0009
xor eax, eax
jmp 0x4d4500
movzx r9d, byte [rsp + rsi + 0x25]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x5b]
mov byte [rsp + rdi + 0x25], dl
mov byte [rsp + rsi + 0x25], r8b
add rax, 2
nop
cmp rax, 0xc
jge 0x4d4532
movzx edx, byte [rsp + rax + 0x19]
movzx esi, byte [rsp + rax + 0x1a]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0xb
jae 0x4d4557
movzx r8d, byte [rsp + rdi + 0x25]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x5b]
cmp rsi, 0xb
jb 0x4d44e4
jmp 0x4d454b
xor eax, eax
lea rbx, [rsp + 0x25]
mov ecx, 0xb
nop
call fcn.00444780
add rsp, 0x30
pop rbp
ret
mov eax, esi
mov ecx, 0xb
call fcn.004564a0
mov eax, edi
mov ecx, 0xb
nop
call fcn.004564a0
nop
call fcn.004541c0
jmp fcn.004d44a0

Function at 0x4da040
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4da112
push rbp
mov rbp, rsp
sub rsp, 0x38
movabs rdx, 0xc73320d892a194d2
mov qword [rsp + 0x2b], rdx
movabs rdx, 0x7bc1736597c73320
mov qword [rsp + 0x30], rdx
movabs rdx, 0xb0304080400020c
mov qword [rsp + 0x1d], rdx
movabs rdx, 0x200030102070b03
mov qword [rsp + 0x23], rdx
xor eax, eax
jmp 0x4da0ac
movzx r9d, byte [rsp + rsi + 0x2b]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x3b]
mov byte [rsp + rdi + 0x2b], dl
mov byte [rsp + rsi + 0x2b], r8b
add rax, 2
cmp rax, 0xe
jge 0x4da0de
movzx edx, byte [rsp + rax + 0x1d]
movzx esi, byte [rsp + rax + 0x1e]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0xd
jae 0x4da105
movzx r8d, byte [rsp + rdi + 0x2b]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x3b]
cmp rsi, 0xd
jb 0x4da092
jmp 0x4da0f5
xor eax, eax
lea rbx, [rsp + 0x2b]
mov ecx, 0xd
call fcn.00444780
add rsp, 0x38
pop rbp
ret
mov eax, esi
mov ecx, 0xd
nop dword [rax]
call fcn.004564a0
mov eax, edi
mov ecx, 0xd
call fcn.004564a0
nop
call fcn.004541c0
jmp fcn.004da040
Function at 0x4dc560
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4dc64a
push rbp
mov rbp, rsp
sub rsp, 0x40
movabs rdx, 0x3b46576d3ece6f74
mov qword [rsp + 0x2d], rdx
movabs rdx, 0xd76f203b46576d3e
mov qword [rsp + 0x30], rdx
movabs rdx, 0x48243ad966206e4b
mov qword [rsp + 0x38], rdx
movabs rdx, 0x30a0f0303020607
mov qword [rsp + 0x19], rdx
movabs rdx, 0xf0a1110030a0f03
mov qword [rsp + 0x1d], rdx
movabs rdx, 0xb0f03031210050a
mov qword [rsp + 0x25], rdx
xor eax, eax
jmp 0x4dc5ed
movzx r9d, byte [rsp + rsi + 0x2d]
sub r9d, edx
lea edx, [r9 + 0x34]
mov byte [rsp + rdi + 0x2d], dl
lea edx, [r8 + 0x34]
mov byte [rsp + rsi + 0x2d], dl
add rax, 2
cmp rax, 0x14
jge 0x4dc61a
movzx edx, byte [rsp + rax + 0x19]
movzx esi, byte [rsp + rax + 0x1a]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x13
jae 0x4dc63d
movzx r8d, byte [rsp + rdi + 0x2d]
sub r8d, edx
cmp rsi, 0x13
jb 0x4dc5d0
jmp 0x4dc631
xor eax, eax
lea rbx, [rsp + 0x2d]
mov ecx, 0x13
call fcn.00444780
add rsp, 0x40
pop rbp
ret
mov eax, esi
mov ecx, 0x13
call fcn.004564a0
mov eax, edi
mov ecx, 0x13
call fcn.004564a0
nop
call fcn.004541c0
jmp fcn.004dc560

Function at 0x4dc660
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4dc73d
push rbp
mov rbp, rsp
sub rsp, 0x38
movabs rdx, 0x117dfef8f1ef8407
mov qword [rsp + 0x2a], rdx
movabs rdx, 0x86cf9a8f820117d
mov qword [rsp + 0x30], rdx
movabs rdx, 0x1090a0306020c07
mov qword [rsp + 0x18], rdx
movabs rdx, 0x70501090a030602
mov qword [rsp + 0x1a], rdx
movabs rdx, 0xb0902040d000c04
mov qword [rsp + 0x22], rdx
xor eax, eax
nop
jmp 0x4dc6e0
movzx r9d, byte [rsp + rsi + 0x2a]
sub r9d, edx
lea edx, [r9 - 0x7b]
mov byte [rsp + rdi + 0x2a], dl
lea edx, [r8 - 0x7b]
mov byte [rsp + rsi + 0x2a], dl
add rax, 2
nop
cmp rax, 0x12
jge 0x4dc70d
movzx edx, byte [rsp + rax + 0x18]
movzx esi, byte [rsp + rax + 0x19]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0xe
jae 0x4dc730
movzx r8d, byte [rsp + rdi + 0x2a]
sub r8d, edx
cmp rsi, 0xe
jb 0x4dc6c2
jmp 0x4dc724
xor eax, eax
lea rbx, [rsp + 0x2a]
mov ecx, 0xe
call fcn.00444780
add rsp, 0x38
pop rbp
ret
mov eax, esi
mov ecx, 0xe
call fcn.004564a0
mov eax, edi
mov ecx, 0xe
call fcn.004564a0
nop
nop dword [rax]
call fcn.004541c0
jmp fcn.004dc660
Function at 0x4dc760
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4dc83d
push rbp
mov rbp, rsp
sub rsp, 0x40
movabs rdx, 0x3b9467612f73d26d
mov qword [rsp + 0x30], rdx
movabs rdx, 0x6741b26ce8586f74
mov qword [rsp + 0x38], rdx
movabs rdx, 0xa070d060306010e
mov qword [rsp + 0x1e], rdx
movabs rdx, 0xb030a070d060306
mov qword [rsp + 0x20], rdx
movabs rdx, 0xb030a010b060307
mov qword [rsp + 0x28], rdx
xor eax, eax
nop
jmp 0x4dc7e0
movzx r9d, byte [rsp + rsi + 0x30]
sub r9d, edx
lea edx, [r9 - 0x55]
mov byte [rsp + rdi + 0x30], dl
lea edx, [r8 - 0x55]
mov byte [rsp + rsi + 0x30], dl
add rax, 2
nop
cmp rax, 0x12
jge 0x4dc80d
movzx edx, byte [rsp + rax + 0x1e]
movzx esi, byte [rsp + rax + 0x1f]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x10
jae 0x4dc830
movzx r8d, byte [rsp + rdi + 0x30]
sub r8d, edx
cmp rsi, 0x10
jb 0x4dc7c2
jmp 0x4dc824
xor eax, eax
lea rbx, [rsp + 0x30]
mov ecx, 0x10
call fcn.00444780
add rsp, 0x40
pop rbp
ret
mov eax, esi
mov ecx, 0x10
call fcn.004564a0
mov eax, edi
mov ecx, 0x10
call fcn.004564a0
nop
nop dword [rax]
call fcn.004541c0
jmp fcn.004dc760

Function at 0x4e1a80
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4e1b6a
push rbp
mov rbp, rsp
sub rsp, 0x48
movabs rdx, 0x6e42692f3612ec3f
mov qword [rsp + 0x30], rdx
movabs rdx, 0x70022bbf7449da41
mov qword [rsp + 0x38], rdx
movabs rdx, 0xe665744a3eef146c
mov qword [rsp + 0x40], rdx
movabs rdx, 0x11091217090c1304
mov qword [rsp + 0x18], rdx
movabs rdx, 0x121703110a140d0e
mov qword [rsp + 0x20], rdx
movabs rdx, 0xd0d0206090801
mov qword [rsp + 0x28], rdx
xor eax, eax
jmp 0x4e1b0d
movzx r9d, byte [rsp + rsi + 0x30]
sub r9d, edx
lea edx, [r9 + 0x4d]
mov byte [rsp + rdi + 0x30], dl
lea edx, [r8 + 0x4d]
mov byte [rsp + rsi + 0x30], dl
add rax, 2
cmp rax, 0x18
jge 0x4e1b3a
movzx edx, byte [rsp + rax + 0x18]
movzx esi, byte [rsp + rax + 0x19]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x18
jae 0x4e1b5d
movzx r8d, byte [rsp + rdi + 0x30]
sub r8d, edx
cmp rsi, 0x18
jb 0x4e1af0
jmp 0x4e1b51
xor eax, eax
lea rbx, [rsp + 0x30]
mov ecx, 0x18
call fcn.00444780
add rsp, 0x48
pop rbp
ret
mov eax, esi
mov ecx, 0x18
call fcn.004564a0
mov eax, edi
mov ecx, 0x18
call fcn.004564a0
nop
call fcn.004541c0
jmp fcn.004e1a80