joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4bf0c0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4bf18c
push rbp
mov rbp, rsp
sub rsp, 0x38
movabs rdx, 0x8eac8465449f9052
mov qword [rsp + 0x1b], rdx
movabs rdx, 0x9b8f88a8658eac84
mov qword [rsp + 0x20], rdx
movabs rdx, 0x2060102070b060c
mov qword [rsp + 0x28], rdx
movabs rdx, 0x501020a09020b0c
mov qword [rsp + 0x30], rdx
xor eax, eax
jmp 0x4bf12f
movzx r9d, byte [rsp + rsi + 0x1b]
sub r9d, edx
lea edx, [r9 - 0xd]
mov byte [rsp + rdi + 0x1b], dl
lea edx, [r8 - 0xd]
mov byte [rsp + rsi + 0x1b], dl
add rax, 2
cmp rax, 0x10
jge 0x4bf15c
movzx edx, byte [rsp + rax + 0x28]
movzx esi, byte [rsp + rax + 0x29]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0xd
jae 0x4bf17f
movzx r8d, byte [rsp + rdi + 0x1b]
sub r8d, edx
cmp rsi, 0xd
jb 0x4bf112
jmp 0x4bf173
xor eax, eax
lea rbx, [rsp + 0x1b]
mov ecx, 0xd
call fcn.00444ce0
add rsp, 0x38
pop rbp
ret
mov eax, esi
mov ecx, 0xd
call fcn.00456b60
mov eax, edi
mov ecx, 0xd
call fcn.00456b60
nop
call fcn.004548e0
jmp fcn.004bf0c0

Function at 0x4c0880
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4c093d
push rbp
mov rbp, rsp
sub rsp, 0x30
movabs rdx, 0xb09caf748aac90bc
mov qword [rsp + 0x1b], rdx
mov byte [rsp + 0x23], 0x72
movabs rdx, 0x701010500040702
mov qword [rsp + 0x24], rdx
mov dword [rsp + 0x2c], 0x4020603
xor eax, eax
nop
jmp 0x4c08e0
movzx r9d, byte [rsp + rsi + 0x1b]
sub r9d, edx
lea edx, [r9 - 0x1b]
mov byte [rsp + rdi + 0x1b], dl
lea edx, [r8 - 0x1b]
mov byte [rsp + rsi + 0x1b], dl
add rax, 2
nop
cmp rax, 0xc
jge 0x4c090d
movzx edx, byte [rsp + rax + 0x24]
movzx esi, byte [rsp + rax + 0x25]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 9
jae 0x4c0930
movzx r8d, byte [rsp + rdi + 0x1b]
sub r8d, edx
cmp rsi, 9
jb 0x4c08c2
jmp 0x4c0924
xor eax, eax
lea rbx, [rsp + 0x1b]
mov ecx, 9
call fcn.00444ce0
add rsp, 0x30
pop rbp
ret
mov eax, esi
mov ecx, 9
call fcn.00456b60
mov eax, edi
mov ecx, 9
call fcn.00456b60
nop
nop dword [rax]
call fcn.004548e0
jmp fcn.004c0880
Function at 0x4c0c80
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4c0d7d
push rbp
mov rbp, rsp
sub rsp, 0x48
movabs rdx, 0x6e5ffa1995c8d874
mov qword [rsp + 0x18], rdx
movabs rdx, 0x696c05766e5ffa19
mov qword [rsp + 0x1c], rdx
movabs rdx, 0x212826ddd6e6549
mov qword [rsp + 0x24], rdx
movabs rdx, 0x205061311011112
mov qword [rsp + 0x2c], rdx
movabs rdx, 0x110305030c0c0d13
mov qword [rsp + 0x34], rdx
movabs rdx, 0x311041311030503
mov qword [rsp + 0x38], rdx
movabs rdx, 0x11120f04050c0109
mov qword [rsp + 0x40], rdx
xor eax, eax
jmp 0x4c0d20
movzx r9d, byte [rsp + rsi + 0x18]
sub r9d, edx
lea edx, [r9 - 0x80]
mov byte [rsp + rdi + 0x18], dl
lea edx, [r8 - 0x80]
mov byte [rsp + rsi + 0x18], dl
add rax, 2
nop dword [rax]
cmp rax, 0x1c
jge 0x4c0d4d
movzx edx, byte [rsp + rax + 0x2c]
movzx esi, byte [rsp + rax + 0x2d]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x14
jae 0x4c0d70
movzx r8d, byte [rsp + rdi + 0x18]
sub r8d, edx
cmp rsi, 0x14
jb 0x4c0cff
jmp 0x4c0d64
xor eax, eax
lea rbx, [rsp + 0x18]
mov ecx, 0x14
call fcn.00444ce0
add rsp, 0x48
pop rbp
ret
mov eax, esi
mov ecx, 0x14
call fcn.00456b60
mov eax, edi
mov ecx, 0x14
call fcn.00456b60
nop
nop dword [rax]
call fcn.004548e0
jmp fcn.004c0c80

Function at 0x4c1980
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4c1a7b
push rbp
mov rbp, rsp
sub rsp, 0x48
movabs rdx, 0x60eadde5da73f205
mov qword [rsp + 0x19], rdx
movabs rdx, 0xd9266260eadde5da
mov qword [rsp + 0x1c], rdx
movabs rdx, 0x73d0f054cc64e67d
mov qword [rsp + 0x24], rdx
movabs rdx, 0xa060b12020c0300
mov qword [rsp + 0x2c], rdx
movabs rdx, 0xb050b0911071004
mov qword [rsp + 0x34], rdx
movabs rdx, 0x121102080b050b09
mov qword [rsp + 0x38], rdx
movabs rdx, 0xe11020c08010701
mov qword [rsp + 0x40], rdx
xor eax, eax
jmp 0x4c1a19
movzx r9d, byte [rsp + rsi + 0x19]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x68]
mov byte [rsp + rdi + 0x19], dl
mov byte [rsp + rsi + 0x19], r8b
add rax, 2
cmp rax, 0x1c
jge 0x4c1a4b
movzx edx, byte [rsp + rax + 0x2c]
movzx esi, byte [rsp + rax + 0x2d]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x13
jae 0x4c1a6e
movzx r8d, byte [rsp + rdi + 0x19]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x68]
cmp rsi, 0x13
jb 0x4c19ff
jmp 0x4c1a62
xor eax, eax
lea rbx, [rsp + 0x19]
mov ecx, 0x13
call fcn.00444ce0
add rsp, 0x48
pop rbp
ret
mov eax, esi
mov ecx, 0x13
call fcn.00456b60
mov eax, edi
mov ecx, 0x13
call fcn.00456b60
nop
nop dword [rax + rax]
call fcn.004548e0
jmp fcn.004c1980
Function at 0x4c2080
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4c217d
push rbp
mov rbp, rsp
sub rsp, 0x50
movabs rdx, 0x61444ee41101481
mov qword [rsp + 0x19], rdx
movabs rdx, 0x89d405ce53206106
mov qword [rsp + 0x20], rdx
movabs rdx, 0xaa7fb121f01becb
mov qword [rsp + 0x28], rdx
movabs rdx, 0xd0b0a120e04000b
mov qword [rsp + 0x30], rdx
movabs rdx, 0x210140a0b051104
mov qword [rsp + 0x38], rdx
movabs rdx, 0x6150c13160f0f12
mov qword [rsp + 0x40], rdx
movabs rdx, 0x706011405010b01
mov qword [rsp + 0x48], rdx
xor eax, eax
jmp 0x4c2120
movzx r9d, byte [rsp + rsi + 0x19]
sub r9d, edx
lea edx, [r9 - 0x7e]
mov byte [rsp + rdi + 0x19], dl
lea edx, [r8 - 0x7e]
mov byte [rsp + rsi + 0x19], dl
add rax, 2
nop dword [rax]
cmp rax, 0x20
jge 0x4c214d
movzx edx, byte [rsp + rax + 0x30]
movzx esi, byte [rsp + rax + 0x31]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x17
jae 0x4c2170
movzx r8d, byte [rsp + rdi + 0x19]
sub r8d, edx
cmp rsi, 0x17
jb 0x4c20ff
jmp 0x4c2164
xor eax, eax
lea rbx, [rsp + 0x19]
mov ecx, 0x17
call fcn.00444ce0
add rsp, 0x50
pop rbp
ret
mov eax, esi
mov ecx, 0x17
call fcn.00456b60
mov eax, edi
mov ecx, 0x17
call fcn.00456b60
nop
nop dword [rax]
call fcn.004548e0
jmp fcn.004c2080

Function at 0x4c21a0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4c228c
push rbp
mov rbp, rsp
sub rsp, 0x48
movabs rdx, 0x7498dfda60e5734c
mov qword [rsp + 0x1d], rdx
movabs rdx, 0x4dffe67498dfda60
mov qword [rsp + 0x20], rdx
movabs rdx, 0x4fe969549358fbe1
mov qword [rsp + 0x28], rdx
movabs rdx, 0x31108021101090c
mov qword [rsp + 0x30], rdx
movabs rdx, 0x11120a0e0d05050e
mov qword [rsp + 0x38], rdx
movabs rdx, 0x50d0a0b060e1104
mov qword [rsp + 0x40], rdx
xor eax, eax
jmp 0x4c222a
movzx r9d, byte [rsp + rsi + 0x1d]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x6e]
mov byte [rsp + rdi + 0x1d], dl
mov byte [rsp + rsi + 0x1d], r8b
add rax, 2
cmp rax, 0x18
jge 0x4c225c
movzx edx, byte [rsp + rax + 0x30]
movzx esi, byte [rsp + rax + 0x31]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x13
jae 0x4c227f
movzx r8d, byte [rsp + rdi + 0x1d]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x6e]
cmp rsi, 0x13
jb 0x4c2210
jmp 0x4c2273
xor eax, eax
lea rbx, [rsp + 0x1d]
mov ecx, 0x13
call fcn.00444ce0
add rsp, 0x48
pop rbp
ret
mov eax, esi
mov ecx, 0x13
call fcn.00456b60
mov eax, edi
mov ecx, 0x13
call fcn.00456b60
nop
call fcn.004548e0
jmp fcn.004c21a0
Function at 0x4c2920
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4c2a1b
push rbp
mov rbp, rsp
sub rsp, 0x50
movabs rdx, 0xced4794061fc3b61
mov qword [rsp + 0x1a], rdx
movabs rdx, 0x646e618edf62ced4
mov qword [rsp + 0x20], rdx
movabs rdx, 0x6fd4d057f39dd6be
mov qword [rsp + 0x28], rdx
movabs rdx, 0xe12050213091511
mov qword [rsp + 0x30], rdx
movabs rdx, 0x2090a0214010006
mov qword [rsp + 0x38], rdx
movabs rdx, 0x606111002040408
mov qword [rsp + 0x40], rdx
movabs rdx, 0x14070f0e09081214
mov qword [rsp + 0x48], rdx
xor eax, eax
jmp 0x4c29b9
movzx r9d, byte [rsp + rsi + 0x1a]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x6e]
mov byte [rsp + rdi + 0x1a], dl
mov byte [rsp + rsi + 0x1a], r8b
add rax, 2
cmp rax, 0x20
jge 0x4c29eb
movzx edx, byte [rsp + rax + 0x30]
movzx esi, byte [rsp + rax + 0x31]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x16
jae 0x4c2a0e
movzx r8d, byte [rsp + rdi + 0x1a]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x6e]
cmp rsi, 0x16
jb 0x4c299f
jmp 0x4c2a02
xor eax, eax
lea rbx, [rsp + 0x1a]
mov ecx, 0x16
call fcn.00444ce0
add rsp, 0x50
pop rbp
ret
mov eax, esi
mov ecx, 0x16
call fcn.00456b60
mov eax, edi
mov ecx, 0x16
call fcn.00456b60
nop
nop dword [rax + rax]
call fcn.004548e0
jmp fcn.004c2920

Function at 0x4c2e20
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4c2f4c
push rbp
mov rbp, rsp
sub rsp, 0x60
movabs rdx, 0x316e72657a73ca9c
mov qword [rsp + 0x18], rdx
movabs rdx, 0xb348029a6eaf7453
mov qword [rsp + 0x20], rdx
movabs rdx, 0x50fedafadfaeb348
mov qword [rsp + 0x26], rdx
movabs rdx, 0x942d98910bb7fa31
mov qword [rsp + 0x2e], rdx
movabs rdx, 0xe00161c10010c18
mov qword [rsp + 0x36], rdx
movabs rdx, 0xc1c190317180d1b
mov qword [rsp + 0x3e], rdx
movabs rdx, 0xf150c1c19031718
mov qword [rsp + 0x40], rdx
movabs rdx, 0x70f0d1a18111100
mov qword [rsp + 0x48], rdx
movabs rdx, 0xa0d0d0f010e0a16
mov qword [rsp + 0x50], rdx
movabs rdx, 0x130c1911111d1214
mov qword [rsp + 0x58], rdx
xor eax, eax
jmp 0x4c2ee6
movzx r9d, byte [rsp + rsi + 0x18]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x43]
mov byte [rsp + rdi + 0x18], dl
mov byte [rsp + rsi + 0x18], r8b
add rax, 2
cmp rax, 0x2a
jge 0x4c2f1c
movzx edx, byte [rsp + rax + 0x36]
movzx esi, byte [rsp + rax + 0x37]
mov edi, edx
xor edx, esi
add edx, eax
nop dword [rax]
cmp rdi, 0x1e
jae 0x4c2f3f
movzx r8d, byte [rsp + rdi + 0x18]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x43]
cmp rsi, 0x1e
jb 0x4c2ecc
jmp 0x4c2f33
xor eax, eax
lea rbx, [rsp + 0x18]
mov ecx, 0x1e
call fcn.00444ce0
add rsp, 0x60
pop rbp
ret
mov eax, esi
mov ecx, 0x1e
call fcn.00456b60
mov eax, edi
mov ecx, 0x1e
call fcn.00456b60
nop
call fcn.004548e0
jmp fcn.004c2e20
Function at 0x4c4820
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4c491b
push rbp
mov rbp, rsp
sub rsp, 0x50
movabs rdx, 0x639699f2bda95a26
mov qword [rsp + 0x1e], rdx
movabs rdx, 0x64a1bba897206396
mov qword [rsp + 0x24], rdx
movabs rdx, 0xf6be69ff20a38cfa
mov qword [rsp + 0x2c], rdx
movabs rdx, 0x1000000104140110
mov qword [rsp + 0x34], rdx
movabs rdx, 0xe02120615010f00
mov qword [rsp + 0x3c], rdx
movabs rdx, 0x60103020e021206
mov qword [rsp + 0x40], rdx
movabs rdx, 0xa0b10050c140915
mov qword [rsp + 0x48], rdx
xor eax, eax
jmp 0x4c48b9
movzx r9d, byte [rsp + rsi + 0x1e]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x62]
mov byte [rsp + rdi + 0x1e], dl
mov byte [rsp + rsi + 0x1e], r8b
add rax, 2
cmp rax, 0x1c
jge 0x4c48eb
movzx edx, byte [rsp + rax + 0x34]
movzx esi, byte [rsp + rax + 0x35]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x16
jae 0x4c490e
movzx r8d, byte [rsp + rdi + 0x1e]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x62]
cmp rsi, 0x16
jb 0x4c489f
jmp 0x4c4902
xor eax, eax
lea rbx, [rsp + 0x1e]
mov ecx, 0x16
call fcn.00444ce0
add rsp, 0x50
pop rbp
ret
mov eax, esi
mov ecx, 0x16
call fcn.00456b60
mov eax, edi
mov ecx, 0x16
call fcn.00456b60
nop
nop dword [rax + rax]
call fcn.004548e0
jmp fcn.004c4820
Function at 0x4c6fe0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4c70fa
push rbp
mov rbp, rsp
sub rsp, 0x58
movabs rdx, 0x2063692a6955fe50
mov qword [rsp + 0x18], rdx
movabs rdx, 0x53f2af2726f02050
mov qword [rsp + 0x20], rdx
movabs rdx, 0x1e05d8222cd153f2
mov qword [rsp + 0x26], rdx
movabs rdx, 0x36f43692a454d28
mov qword [rsp + 0x2e], rdx
movabs rdx, 0x15010d08180a040f
mov qword [rsp + 0x36], rdx
movabs rdx, 0x100e15010d08180a
mov qword [rsp + 0x38], rdx
movabs rdx, 0x8140f010902180e
mov qword [rsp + 0x40], rdx
movabs rdx, 0xb14190218080e1b
mov qword [rsp + 0x48], rdx
movabs rdx, 0xb111d1d0c120b13
mov qword [rsp + 0x50], rdx
xor eax, eax
jmp 0x4c7097
movzx r9d, byte [rsp + rsi + 0x18]
lea edx, [r9 + rdx]
lea edx, [rdx + 8]
mov byte [rsp + rdi + 0x18], dl
mov byte [rsp + rsi + 0x18], r8b
add rax, 2
cmp rax, 0x22
jge 0x4c70c9
movzx edx, byte [rsp + rax + 0x36]
movzx esi, byte [rsp + rax + 0x37]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x1e
jae 0x4c70ed
movzx r8d, byte [rsp + rdi + 0x18]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 8]
cmp rsi, 0x1e
jb 0x4c707d
jmp 0x4c70e1
xor eax, eax
lea rbx, [rsp + 0x18]
mov ecx, 0x1e
call fcn.00444ce0
add rsp, 0x58
pop rbp
nop
ret
mov eax, esi
mov ecx, 0x1e
call fcn.00456b60
mov eax, edi
mov ecx, 0x1e
call fcn.00456b60
nop
call fcn.004548e0
nop
jmp fcn.004c6fe0

Function at 0x4c87e0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4c88fd
push rbp
mov rbp, rsp
sub rsp, 0x60
movabs rdx, 0xcf118381e1a0df4e
mov qword [rsp + 0x1d], rdx
movabs rdx, 0x86747361b4206192
mov qword [rsp + 0x25], rdx
movabs rdx, 0xc66e891153867473
mov qword [rsp + 0x2a], rdx
movabs rdx, 0x65c1a0cf74647cbd
mov qword [rsp + 0x32], rdx
movabs rdx, 0x141a031205040508
mov qword [rsp + 0x3a], rdx
movabs rdx, 0x110216120519141a
mov qword [rsp + 0x40], rdx
movabs rdx, 0x306181914151a02
mov qword [rsp + 0x48], rdx
movabs rdx, 0x10f07141a031b14
mov qword [rsp + 0x50], rdx
movabs rdx, 0xb141a160f070105
mov qword [rsp + 0x58], rdx
xor eax, eax
jmp 0x4c88a0
movzx r9d, byte [rsp + rsi + 0x1d]
sub r9d, edx
lea edx, [r9 - 0xd]
mov byte [rsp + rdi + 0x1d], dl
lea edx, [r8 - 0xd]
mov byte [rsp + rsi + 0x1d], dl
add rax, 2
nop word [rax + rax]
cmp rax, 0x26
jge 0x4c88cd
movzx edx, byte [rsp + rax + 0x3a]
movzx esi, byte [rsp + rax + 0x3b]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x1d
jae 0x4c88f0
movzx r8d, byte [rsp + rdi + 0x1d]
sub r8d, edx
cmp rsi, 0x1d
jb 0x4c887d
jmp 0x4c88e4
xor eax, eax
lea rbx, [rsp + 0x1d]
mov ecx, 0x1d
call fcn.00444ce0
add rsp, 0x60
pop rbp
ret
mov eax, esi
mov ecx, 0x1d
call fcn.00456b60
mov eax, edi
mov ecx, 0x1d
call fcn.00456b60
nop
nop dword [rax]
call fcn.004548e0
jmp fcn.004c87e0
Function at 0x4c9b60
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4c9c4a
push rbp
mov rbp, rsp
sub rsp, 0x40
movabs rdx, 0x7a5f647b70736d75
mov qword [rsp + 0x18], rdx
movabs rdx, 0x646e7a5f647b7073
mov qword [rsp + 0x1a], rdx
movabs rdx, 0x646d727d68647260
mov qword [rsp + 0x22], rdx
movabs rdx, 0x4110c0e0e000600
mov qword [rsp + 0x2a], rdx
movabs rdx, 0xa050e0d0c0411
mov qword [rsp + 0x30], rdx
movabs rdx, 0xd040d0403070f0f
mov qword [rsp + 0x38], rdx
xor eax, eax
jmp 0x4c9bed
movzx r9d, byte [rsp + rsi + 0x18]
sub r9d, edx
lea edx, [r9 + 5]
mov byte [rsp + rdi + 0x18], dl
lea edx, [r8 + 5]
mov byte [rsp + rsi + 0x18], dl
add rax, 2
cmp rax, 0x16
jge 0x4c9c1a
movzx edx, byte [rsp + rax + 0x2a]
movzx esi, byte [rsp + rax + 0x2b]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x12
jae 0x4c9c3d
movzx r8d, byte [rsp + rdi + 0x18]
sub r8d, edx
cmp rsi, 0x12
jb 0x4c9bd0
jmp 0x4c9c31
xor eax, eax
lea rbx, [rsp + 0x18]
mov ecx, 0x12
call fcn.00444ce0
add rsp, 0x40
pop rbp
ret
mov eax, esi
mov ecx, 0x12
call fcn.00456b60
mov eax, edi
mov ecx, 0x12
call fcn.00456b60
nop
call fcn.004548e0
jmp fcn.004c9b60

Function at 0x4cac20
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4cad1d
push rbp
mov rbp, rsp
sub rsp, 0x48
movabs rdx, 0x58e720396e696847
mov qword [rsp + 0x1b], rdx
movabs rdx, 0x64ecdf58e720396e
mov qword [rsp + 0x1e], rdx
movabs rdx, 0xe36d31fb0164ead7
mov qword [rsp + 0x26], rdx
movabs rdx, 0xe00120912120709
mov qword [rsp + 0x2e], rdx
movabs rdx, 0x12060b0806120b0e
mov qword [rsp + 0x36], rdx
movabs rdx, 0x120712060b080612
mov qword [rsp + 0x38], rdx
movabs rdx, 0x80b080c0f081004
mov qword [rsp + 0x40], rdx
xor eax, eax
jmp 0x4cacc0
movzx r9d, byte [rsp + rsi + 0x1b]
sub r9d, edx
lea edx, [r9 + 0x56]
mov byte [rsp + rdi + 0x1b], dl
lea edx, [r8 + 0x56]
mov byte [rsp + rsi + 0x1b], dl
add rax, 2
nop dword [rax]
cmp rax, 0x1a
jge 0x4caced
movzx edx, byte [rsp + rax + 0x2e]
movzx esi, byte [rsp + rax + 0x2f]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x13
jae 0x4cad10
movzx r8d, byte [rsp + rdi + 0x1b]
sub r8d, edx
cmp rsi, 0x13
jb 0x4cac9f
jmp 0x4cad04
xor eax, eax
lea rbx, [rsp + 0x1b]
mov ecx, 0x13
call fcn.00444ce0
add rsp, 0x48
pop rbp
ret
mov eax, esi
mov ecx, 0x13
call fcn.00456b60
mov eax, edi
mov ecx, 0x13
call fcn.00456b60
nop
nop dword [rax]
call fcn.004548e0
jmp fcn.004cac20
Function at 0x4cad40
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4cae3b
push rbp
mov rbp, rsp
sub rsp, 0x50
movabs rdx, 0xc4a1e6a5676ef653
mov qword [rsp + 0x1f], rdx
movabs rdx, 0x64e5eb84532058c4
mov qword [rsp + 0x26], rdx
movabs rdx, 0x6535699be320720e
mov qword [rsp + 0x2e], rdx
movabs rdx, 0x150708120c0d0f13
mov qword [rsp + 0x36], rdx
movabs rdx, 0x130b060807110507
mov qword [rsp + 0x3e], rdx
movabs rdx, 0x501130b06080711
mov qword [rsp + 0x40], rdx
movabs rdx, 0xc15040d0b050507
mov qword [rsp + 0x48], rdx
xor eax, eax
jmp 0x4cadd9
movzx r9d, byte [rsp + rsi + 0x1f]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x56]
mov byte [rsp + rdi + 0x1f], dl
mov byte [rsp + rsi + 0x1f], r8b
add rax, 2
cmp rax, 0x1a
jge 0x4cae0b
movzx edx, byte [rsp + rax + 0x36]
movzx esi, byte [rsp + rax + 0x37]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x17
jae 0x4cae2e
movzx r8d, byte [rsp + rdi + 0x1f]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x56]
cmp rsi, 0x17
jb 0x4cadbf
jmp 0x4cae22
xor eax, eax
lea rbx, [rsp + 0x1f]
mov ecx, 0x17
call fcn.00444ce0
add rsp, 0x50
pop rbp
ret
mov eax, esi
mov ecx, 0x17
call fcn.00456b60
mov eax, edi
mov ecx, 0x17
call fcn.00456b60
nop
nop dword [rax + rax]
call fcn.004548e0
jmp fcn.004cad40

Function at 0x4cc9a0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4cca9d
push rbp
mov rbp, rsp
sub rsp, 0x50
movabs rdx, 0x722f264b0f70614a
mov qword [rsp + 0x18], rdx
movabs rdx, 0x3e6e122259480807
mov qword [rsp + 0x20], rdx
movabs rdx, 0x73d4354cf643b30
mov qword [rsp + 0x28], rdx
movabs rdx, 0x9130d05000c1708
mov qword [rsp + 0x30], rdx
movabs rdx, 0x5060f080b151711
mov qword [rsp + 0x38], rdx
movabs rdx, 0xd040f0f090811
mov qword [rsp + 0x40], rdx
movabs rdx, 0x30a0016080a1008
mov qword [rsp + 0x48], rdx
xor eax, eax
jmp 0x4cca40
movzx r9d, byte [rsp + rsi + 0x18]
sub r9d, edx
lea edx, [r9 + 0x38]
mov byte [rsp + rdi + 0x18], dl
lea edx, [r8 + 0x38]
mov byte [rsp + rsi + 0x18], dl
add rax, 2
nop dword [rax]
cmp rax, 0x20
jge 0x4cca6d
movzx edx, byte [rsp + rax + 0x30]
movzx esi, byte [rsp + rax + 0x31]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x18
jae 0x4cca90
movzx r8d, byte [rsp + rdi + 0x18]
sub r8d, edx
cmp rsi, 0x18
jb 0x4cca1f
jmp 0x4cca84
xor eax, eax
lea rbx, [rsp + 0x18]
mov ecx, 0x18
call fcn.00444ce0
add rsp, 0x50
pop rbp
ret
mov eax, esi
mov ecx, 0x18
call fcn.00456b60
mov eax, edi
mov ecx, 0x18
call fcn.00456b60
nop
nop dword [rax]
call fcn.004548e0
jmp fcn.004cc9a0
Function at 0x4d0360
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4d044c
push rbp
mov rbp, rsp
sub rsp, 0x40
movabs rdx, 0x544d616954607507
mov qword [rsp + 0x1a], rdx
movabs rdx, 0x1920544d61695460
mov qword [rsp + 0x1c], rdx
movabs rdx, 0x3334652b18011458
mov qword [rsp + 0x24], rdx
movabs rdx, 0xe0010000d10090b
mov qword [rsp + 0x2c], rdx
movabs rdx, 0x80a0d030e001000
mov qword [rsp + 0x30], rdx
movabs rdx, 0xa060c02020609
mov qword [rsp + 0x38], rdx
xor eax, eax
jmp 0x4d03ea
movzx r9d, byte [rsp + rsi + 0x1a]
lea edx, [r9 + rdx]
lea edx, [rdx + 5]
mov byte [rsp + rdi + 0x1a], dl
mov byte [rsp + rsi + 0x1a], r8b
add rax, 2
cmp rax, 0x14
jge 0x4d041c
movzx edx, byte [rsp + rax + 0x2c]
movzx esi, byte [rsp + rax + 0x2d]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x12
jae 0x4d043f
movzx r8d, byte [rsp + rdi + 0x1a]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 5]
cmp rsi, 0x12
jb 0x4d03d0
jmp 0x4d0433
xor eax, eax
lea rbx, [rsp + 0x1a]
mov ecx, 0x12
call fcn.00444ce0
add rsp, 0x40
pop rbp
ret
mov eax, esi
mov ecx, 0x12
call fcn.00456b60
mov eax, edi
mov ecx, 0x12
call fcn.00456b60
nop
call fcn.004548e0
jmp fcn.004d0360

Function at 0x4d0460
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4d054a
push rbp
mov rbp, rsp
sub rsp, 0x48
movabs rdx, 0x206d4f7445726127
mov qword [rsp + 0x1b], rdx
movabs rdx, 0x3e6e4a4253206d4f
mov qword [rsp + 0x20], rdx
movabs rdx, 0x4f6d6407432b3910
mov qword [rsp + 0x28], rdx
movabs rdx, 0xc0c0f09030d0e0a
mov qword [rsp + 0x30], rdx
movabs rdx, 0x903121405120010
mov qword [rsp + 0x38], rdx
movabs rdx, 0x906091410110009
mov qword [rsp + 0x40], rdx
xor eax, eax
jmp 0x4d04ed
movzx r9d, byte [rsp + rsi + 0x1b]
sub r9d, edx
lea edx, [r9 + 0x2c]
mov byte [rsp + rdi + 0x1b], dl
lea edx, [r8 + 0x2c]
mov byte [rsp + rsi + 0x1b], dl
add rax, 2
cmp rax, 0x18
jge 0x4d051a
movzx edx, byte [rsp + rax + 0x30]
movzx esi, byte [rsp + rax + 0x31]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x15
jae 0x4d053d
movzx r8d, byte [rsp + rdi + 0x1b]
sub r8d, edx
cmp rsi, 0x15
jb 0x4d04d0
jmp 0x4d0531
xor eax, eax
lea rbx, [rsp + 0x1b]
mov ecx, 0x15
call fcn.00444ce0
add rsp, 0x48
pop rbp
ret
mov eax, esi
mov ecx, 0x15
call fcn.00456b60
mov eax, edi
mov ecx, 0x15
call fcn.00456b60
nop
call fcn.004548e0
jmp fcn.004d0460
Function at 0x4d1300
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4d141a
push rbp
mov rbp, rsp
sub rsp, 0x60
movabs rdx, 0xa56d2a68787b8ab5
mov qword [rsp + 0x1d], rdx
movabs rdx, 0x207364788b6c7198
mov qword [rsp + 0x25], rdx
movabs rdx, 0x926e61bf58207364
mov qword [rsp + 0x2a], rdx
movabs rdx, 0x789d6954b184fb4e
mov qword [rsp + 0x32], rdx
movabs rdx, 0x171417001b180016
mov qword [rsp + 0x3a], rdx
movabs rdx, 0x1516160708111714
mov qword [rsp + 0x40], rdx
movabs rdx, 0x1411100018050809
mov qword [rsp + 0x48], rdx
movabs rdx, 0x20c0109030b0c11
mov qword [rsp + 0x50], rdx
movabs rdx, 0x1c1c010907161b01
mov qword [rsp + 0x58], rdx
xor eax, eax
jmp 0x4d13b7
movzx r9d, byte [rsp + rsi + 0x1d]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x37]
mov byte [rsp + rdi + 0x1d], dl
mov byte [rsp + rsi + 0x1d], r8b
add rax, 2
cmp rax, 0x26
jge 0x4d13e9
movzx edx, byte [rsp + rax + 0x3a]
movzx esi, byte [rsp + rax + 0x3b]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x1d
jae 0x4d140d
movzx r8d, byte [rsp + rdi + 0x1d]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x37]
cmp rsi, 0x1d
jb 0x4d139d
jmp 0x4d1401
xor eax, eax
lea rbx, [rsp + 0x1d]
mov ecx, 0x1d
call fcn.00444ce0
add rsp, 0x60
pop rbp
nop
ret
mov eax, esi
mov ecx, 0x1d
call fcn.00456b60
mov eax, edi
mov ecx, 0x1d
call fcn.00456b60
nop
call fcn.004548e0
nop
jmp fcn.004d1300