joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4a9000
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
mov rcx, qword [rsp + 8]
mov rax, qword [rsp + 0x10]
mov rbx, qword [rsp + 0x18]
mov rdx, qword [rsp + 0x20]
movups xmm0, xmmword [rax]
movups xmmword [rbx], xmm0
add rbx, 0x10
pxor xmm4, xmm4
cmp ecx, 0xc
je 0x4a90d0
jb 0x4a912f
movups xmm2, xmmword [rax + 0x10]
movups xmmword [rbx], xmm2
add rbx, 0x10
aeskeygenassist xmm1, xmm2, 1
call fcn.004a8ee0
aeskeygenassist xmm1, xmm0, 1
call fcn.004a8f00
aeskeygenassist xmm1, xmm2, 2
call fcn.004a8ee0
aeskeygenassist xmm1, xmm0, 2
call fcn.004a8f00
aeskeygenassist xmm1, xmm2, 4
call fcn.004a8ee0
aeskeygenassist xmm1, xmm0, 4
call fcn.004a8f00
aeskeygenassist xmm1, xmm2, 8
call fcn.004a8ee0
aeskeygenassist xmm1, xmm0, 8
call fcn.004a8f00
aeskeygenassist xmm1, xmm2, 0x10
call fcn.004a8ee0
aeskeygenassist xmm1, xmm0, 0x10
call fcn.004a8f00
aeskeygenassist xmm1, xmm2, 0x20
call fcn.004a8ee0
aeskeygenassist xmm1, xmm0, 0x20
call fcn.004a8f00
aeskeygenassist xmm1, xmm2, 0x40
call fcn.004a8ee0
jmp 0x4a919d
movq xmm2, qword [rax + 0x10]
aeskeygenassist xmm1, xmm2, 1
call fcn.004a8e40
aeskeygenassist xmm1, xmm2, 2
call fcn.004a8ea0
aeskeygenassist xmm1, xmm2, 4
call fcn.004a8e40
aeskeygenassist xmm1, xmm2, 8
call fcn.004a8ea0
aeskeygenassist xmm1, xmm2, 0x10
call fcn.004a8e40
aeskeygenassist xmm1, xmm2, 0x20
call fcn.004a8ea0
aeskeygenassist xmm1, xmm2, 0x40
call fcn.004a8e40
aeskeygenassist xmm1, xmm2, 0x80
call fcn.004a8ea0
jmp 0x4a919d
aeskeygenassist xmm1, xmm0, 1
call fcn.004a8e00
aeskeygenassist xmm1, xmm0, 2
call fcn.004a8e00
aeskeygenassist xmm1, xmm0, 4
call fcn.004a8e00
aeskeygenassist xmm1, xmm0, 8
call fcn.004a8e00
aeskeygenassist xmm1, xmm0, 0x10
call fcn.004a8e00
aeskeygenassist xmm1, xmm0, 0x20
call fcn.004a8e00
aeskeygenassist xmm1, xmm0, 0x40
call fcn.004a8e00
aeskeygenassist xmm1, xmm0, 0x80
call fcn.004a8e00
aeskeygenassist xmm1, xmm0, 0x1b
call fcn.004a8e00
aeskeygenassist xmm1, xmm0, 0x36
call fcn.004a8e00
sub rbx, 0x10
movups xmm1, xmmword [rbx]
movups xmmword [rdx], xmm1
dec rcx
movups xmm1, xmmword [rbx - 0x10]
aesimc xmm0, xmm1
movups xmmword [rdx + 0x10], xmm0
sub rbx, 0x10
add rdx, 0x10
dec rcx
jne 0x4a91aa
movups xmm0, xmmword [rbx - 0x10]
movups xmmword [rdx + 0x10], xmm0
ret
Function at 0x4ac9c0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4acabc
sub rsp, 0x48
mov qword [rsp + 0x40], rbp
lea rbp, [rsp + 0x40]
movabs rdx, 0xa23a3169ae9a3670
mov qword [rsp + 0x19], rdx
movabs rdx, 0x6fa23a3169ae9a36
mov qword [rsp + 0x1a], rdx
movabs rdx, 0x29b444dd2a2b2c36
mov qword [rsp + 0x22], rdx
movabs rdx, 0x310030f0710060e
mov qword [rsp + 0x2a], rdx
movabs rdx, 0xc0b090503100310
mov qword [rsp + 0x30], rdx
movabs rdx, 0xa0d0201020f0d02
mov qword [rsp + 0x38], rdx
xor eax, eax
jmp 0x4aca50
movzx r9d, byte [rsp + rsi + 0x19]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x27]
mov byte [rsp + rdi + 0x19], dl
mov byte [rsp + rsi + 0x19], r8b
add rax, 2
cmp rax, 0x16
jge 0x4aca88
movzx edx, byte [rsp + rax + 0x2a]
movzx esi, byte [rsp + rax + 0x2b]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x11
jae 0x4acaaf
movzx r8d, byte [rsp + rdi + 0x19]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x27]
nop word [rax + rax]
cmp rsi, 0x11
jb 0x4aca36
jmp 0x4acaa3
xor eax, eax
lea rbx, [rsp + 0x19]
mov ecx, 0x11
call fcn.00444360
mov rbp, qword [rsp + 0x40]
add rsp, 0x48
ret
mov eax, esi
mov ecx, 0x11
call fcn.00456a60
mov eax, edi
mov ecx, 0x11
call fcn.00456a60
nop
nop dword [rax]
call fcn.00454400
jmp fcn.004ac9c0

Function at 0x4b1640
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4b172b
sub rsp, 0x48
mov qword [rsp + 0x40], rbp
lea rbp, [rsp + 0x40]
movabs rdx, 0x55653c384e11654e
mov qword [rsp + 0x1e], rdx
movabs rdx, 0x5b4572305f0d3d2f
mov qword [rsp + 0x26], rdx
movabs rdx, 0xc0303020807080a
mov qword [rsp + 0x2e], rdx
movabs rdx, 0xa050c0303020807
mov qword [rsp + 0x30], rdx
movabs rdx, 0xc0a0f0b04000c09
mov qword [rsp + 0x38], rdx
xor eax, eax
jmp 0x4b16c4
movzx r9d, byte [rsp + rsi + 0x1e]
sub r9d, edx
lea edx, [r9 + 0x2b]
mov byte [rsp + rdi + 0x1e], dl
lea edx, [r8 + 0x2b]
mov byte [rsp + rsi + 0x1e], dl
add rax, 2
cmp rax, 0x12
jge 0x4b16f7
movzx edx, byte [rsp + rax + 0x2e]
movzx esi, byte [rsp + rax + 0x2f]
mov edi, edx
xor edx, esi
add edx, eax
nop word [rax + rax]
cmp rdi, 0x10
jae 0x4b171e
movzx r8d, byte [rsp + rdi + 0x1e]
sub r8d, edx
cmp rsi, 0x10
jb 0x4b16a7
jmp 0x4b1712
xor eax, eax
lea rbx, [rsp + 0x1e]
mov ecx, 0x10
call fcn.00444360
mov rbp, qword [rsp + 0x40]
add rsp, 0x48
ret
mov eax, esi
mov ecx, 0x10
call fcn.00456a60
mov eax, edi
mov ecx, 0x10
call fcn.00456a60
nop
call fcn.00454400
jmp fcn.004b1640
Function at 0x4b1ba0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4b1c68
sub rsp, 0x38
mov qword [rsp + 0x30], rbp
lea rbp, [rsp + 0x30]
movabs rdx, 0xddcc2d80d4746e20
mov qword [rsp + 0x1b], rdx
mov byte [rsp + 0x23], 0x23
movabs rdx, 0x308060504080703
mov qword [rsp + 0x24], rdx
mov dword [rsp + 0x2c], 0x3050007
xor eax, eax
jmp 0x4b1c01
movzx r9d, byte [rsp + rsi + 0x1b]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x41]
mov byte [rsp + rdi + 0x1b], dl
mov byte [rsp + rsi + 0x1b], r8b
add rax, 2
cmp rax, 0xc
jge 0x4b1c33
movzx edx, byte [rsp + rax + 0x24]
movzx esi, byte [rsp + rax + 0x25]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 9
jae 0x4b1c5b
movzx r8d, byte [rsp + rdi + 0x1b]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x41]
cmp rsi, 9
jb 0x4b1be7
jmp 0x4b1c4f
xor eax, eax
lea rbx, [rsp + 0x1b]
mov ecx, 9
nop
call fcn.00444360
mov rbp, qword [rsp + 0x30]
add rsp, 0x38
ret
mov eax, esi
mov ecx, 9
call fcn.00456a60
mov eax, edi
mov ecx, 9
call fcn.00456a60
nop
call fcn.00454400
jmp fcn.004b1ba0

Function at 0x4b41c0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
sub rsp, 0x30
mov qword [rsp + 0x28], rbp
lea rbp, [rsp + 0x28]
mov qword [rsp + 0x38], 0
movabs rdx, 0x3e4f03c93568e98e
mov qword [rsp + 0x20], rdx
movabs rdx, 0x604030502050505
mov qword [rsp + 0x10], rdx
xor eax, eax
jmp 0x4b4213
movzx r8d, byte [rsp + rbx + 0x20]
lea edx, [r8 + rdx]
lea edx, [rdx + 0x35]
mov byte [rsp + rsi + 0x20], dl
mov byte [rsp + rbx + 0x20], dil
add rax, 2
cmp rax, 8
jge 0x4b4248
movzx edx, byte [rsp + rax + 0x10]
movzx ebx, byte [rsp + rax + 0x11]
mov esi, edx
xor edx, ebx
add edx, eax
cmp rsi, 8
jae 0x4b4287
movzx edi, byte [rsp + rsi + 0x20]
lea edi, [rdi + rdx]
lea edi, [rdi + 0x35]
nop word [rax + rax]
cmp rbx, 8
jb 0x4b41f9
jmp 0x4b427b
mov qword [rsp + 0x18], 0
xor eax, eax
jmp 0x4b4261
movzx ecx, byte [rsp + rax + 0x20]
mov byte [rsp + rax + 0x18], cl
inc rax
cmp rax, 8
jl 0x4b4255
mov rax, qword [rsp + 0x18]
mov qword [rsp + 0x38], rax
mov rbp, qword [rsp + 0x28]
add rsp, 0x30
ret
mov eax, ebx
mov ecx, 8
call fcn.00456a60
mov eax, esi
mov ecx, 8
call fcn.00456a60
nop
int3
Function at 0x4b42a0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4b43a8
sub rsp, 0x58
mov qword [rsp + 0x50], rbp
lea rbp, [rsp + 0x50]
movabs rdx, 0x74948d9e04087261
mov qword [rsp + 0x1e], rdx
movabs rdx, 0xfe410efeba047494
mov qword [rsp + 0x24], rdx
movabs rdx, 0x9513a46c203cfc11
mov qword [rsp + 0x2c], rdx
movabs rdx, 0xe130a040b140d15
mov qword [rsp + 0x34], rdx
movabs rdx, 0x50f06050d0c0210
mov qword [rsp + 0x3c], rdx
movabs rdx, 0x6060303050f0605
mov qword [rsp + 0x40], rdx
movabs rdx, 0x8090d0d0a0e0802
mov qword [rsp + 0x48], rdx
xor eax, eax
jmp 0x4b4342
movzx r9d, byte [rsp + rsi + 0x1e]
sub r9d, edx
lea edx, [r9 - 0x7f]
mov byte [rsp + rdi + 0x1e], dl
lea edx, [r8 - 0x7f]
mov byte [rsp + rsi + 0x1e], dl
add rax, 2
cmp rax, 0x1c
jge 0x4b436f
movzx edx, byte [rsp + rax + 0x34]
movzx esi, byte [rsp + rax + 0x35]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x16
jae 0x4b439b
movzx r8d, byte [rsp + rdi + 0x1e]
sub r8d, edx
cmp rsi, 0x16
jb 0x4b4325
jmp 0x4b438f
xor eax, eax
lea rbx, [rsp + 0x1e]
mov ecx, 0x16
nop dword [rax + rax]
call fcn.00444360
mov rbp, qword [rsp + 0x50]
add rsp, 0x58
ret
mov eax, esi
mov ecx, 0x16
call fcn.00456a60
mov eax, edi
mov ecx, 0x16
call fcn.00456a60
nop
call fcn.00454400
jmp fcn.004b42a0

Function at 0x4b43c0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4b44bc
sub rsp, 0x50
mov qword [rsp + 0x48], rbp
lea rbp, [rsp + 0x48]
movabs rdx, 0xd67373d81a72be31
mov qword [rsp + 0x1f], rdx
movabs rdx, 0x2ad67373d81a72be
mov qword [rsp + 0x20], rdx
movabs rdx, 0xae92e0dcc6ad36dc
mov qword [rsp + 0x28], rdx
movabs rdx, 0xa080d09000f0e07
mov qword [rsp + 0x30], rdx
movabs rdx, 0x100f0c0f0400010c
mov qword [rsp + 0x38], rdx
movabs rdx, 0x70a0804100b0308
mov qword [rsp + 0x40], rdx
xor eax, eax
jmp 0x4b4450
movzx r9d, byte [rsp + rsi + 0x1f]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x76]
mov byte [rsp + rdi + 0x1f], dl
mov byte [rsp + rsi + 0x1f], r8b
add rax, 2
cmp rax, 0x18
jge 0x4b4488
movzx edx, byte [rsp + rax + 0x30]
movzx esi, byte [rsp + rax + 0x31]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x11
jae 0x4b44af
movzx r8d, byte [rsp + rdi + 0x1f]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x76]
nop word [rax + rax]
cmp rsi, 0x11
jb 0x4b4436
jmp 0x4b44a3
xor eax, eax
lea rbx, [rsp + 0x1f]
mov ecx, 0x11
call fcn.00444360
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
mov eax, esi
mov ecx, 0x11
call fcn.00456a60
mov eax, edi
mov ecx, 0x11
call fcn.00456a60
nop
nop dword [rax]
call fcn.00454400
jmp fcn.004b43c0
Function at 0x4b57c0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4b58ab
sub rsp, 0x48
mov qword [rsp + 0x40], rbp
lea rbp, [rsp + 0x40]
movabs rdx, 0x200c69856183f796
mov qword [rsp + 0x1e], rdx
movabs rdx, 0x907e6e616823f87f
mov qword [rsp + 0x26], rdx
movabs rdx, 0xa010e08020e04
mov qword [rsp + 0x2e], rdx
movabs rdx, 0x609000a010e0802
mov qword [rsp + 0x30], rdx
movabs rdx, 0x8040a0208000f04
mov qword [rsp + 0x38], rdx
xor eax, eax
jmp 0x4b5844
movzx r9d, byte [rsp + rsi + 0x1e]
sub r9d, edx
lea edx, [r9 - 0x7d]
mov byte [rsp + rdi + 0x1e], dl
lea edx, [r8 - 0x7d]
mov byte [rsp + rsi + 0x1e], dl
add rax, 2
cmp rax, 0x12
jge 0x4b5877
movzx edx, byte [rsp + rax + 0x2e]
movzx esi, byte [rsp + rax + 0x2f]
mov edi, edx
xor edx, esi
add edx, eax
nop word [rax + rax]
cmp rdi, 0x10
jae 0x4b589e
movzx r8d, byte [rsp + rdi + 0x1e]
sub r8d, edx
cmp rsi, 0x10
jb 0x4b5827
jmp 0x4b5892
xor eax, eax
lea rbx, [rsp + 0x1e]
mov ecx, 0x10
call fcn.00444360
mov rbp, qword [rsp + 0x40]
add rsp, 0x48
ret
mov eax, esi
mov ecx, 0x10
call fcn.00456a60
mov eax, edi
mov ecx, 0x10
call fcn.00456a60
nop
call fcn.00454400
jmp fcn.004b57c0

Function at 0x4b5be0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4b5cf2
sub rsp, 0x58
mov qword [rsp + 0x50], rbp
lea rbp, [rsp + 0x50]
movabs rdx, 0x735e64123c356976
mov qword [rsp + 0x34], rdx
movabs rdx, 0x204d1d565b696863
mov qword [rsp + 0x3c], rdx
movabs rdx, 0x62726e69204d1d56
mov qword [rsp + 0x40], rdx
movabs rdx, 0x613e611e734c766e
mov qword [rsp + 0x48], rdx
movabs rdx, 0xc0e16040d1a0203
mov qword [rsp + 0x18], rdx
movabs rdx, 0x1a040915020b0d06
mov qword [rsp + 0x20], rdx
movabs rdx, 0x3061b1a1a040915
mov qword [rsp + 0x24], rdx
movabs rdx, 0xc00181203140c03
mov qword [rsp + 0x2c], rdx
xor eax, eax
jmp 0x4b5c91
movzx r9d, byte [rsp + rsi + 0x34]
sub r9d, edx
lea edx, [r9 + 0x24]
mov byte [rsp + rdi + 0x34], dl
lea edx, [r8 + 0x24]
mov byte [rsp + rsi + 0x34], dl
add rax, 2
cmp rax, 0x1c
jge 0x4b5cbe
movzx edx, byte [rsp + rax + 0x18]
movzx esi, byte [rsp + rax + 0x19]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x1c
jae 0x4b5ce5
movzx r8d, byte [rsp + rdi + 0x34]
sub r8d, edx
cmp rsi, 0x1c
jb 0x4b5c74
jmp 0x4b5cd9
xor eax, eax
lea rbx, [rsp + 0x34]
mov ecx, 0x1c
call fcn.00444360
mov rbp, qword [rsp + 0x50]
add rsp, 0x58
ret
mov eax, esi
mov ecx, 0x1c
call fcn.00456a60
mov eax, edi
mov ecx, 0x1c
call fcn.00456a60
nop
call fcn.00454400
jmp fcn.004b5be0
Function at 0x4b6760
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4b6868
sub rsp, 0x50
mov qword [rsp + 0x48], rbp
lea rbp, [rsp + 0x48]
movabs rdx, 0x9ac66fcc209f6162
mov qword [rsp + 0x1a], rdx
movabs rdx, 0xc22b8abe9ac66fcc
mov qword [rsp + 0x1e], rdx
movabs rdx, 0x2c616d72acc5201f
mov qword [rsp + 0x26], rdx
movabs rdx, 0xa0e0408080c0a04
mov qword [rsp + 0x2e], rdx
movabs rdx, 0x9040f020602080b
mov qword [rsp + 0x36], rdx
movabs rdx, 0x20c09040f020602
mov qword [rsp + 0x38], rdx
movabs rdx, 0x81307080b0b0a09
mov qword [rsp + 0x40], rdx
xor eax, eax
jmp 0x4b6800
movzx r9d, byte [rsp + rsi + 0x1a]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x3f]
mov byte [rsp + rdi + 0x1a], dl
mov byte [rsp + rsi + 0x1a], r8b
add rax, 2
nop
cmp rax, 0x1a
jge 0x4b6832
movzx edx, byte [rsp + rax + 0x2e]
movzx esi, byte [rsp + rax + 0x2f]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x14
jae 0x4b685b
movzx r8d, byte [rsp + rdi + 0x1a]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x3f]
cmp rsi, 0x14
jb 0x4b67e5
jmp 0x4b684f
xor eax, eax
lea rbx, [rsp + 0x1a]
mov ecx, 0x14
nop
call fcn.00444360
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
mov eax, esi
mov ecx, 0x14
call fcn.00456a60
mov eax, edi
mov ecx, 0x14
call fcn.00456a60
nop
call fcn.00454400
jmp fcn.004b6760
Function at 0x4b9f20
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4ba01c
sub rsp, 0x48
mov qword [rsp + 0x40], rbp
lea rbp, [rsp + 0x40]
movabs rdx, 0x69dc69c4d485d33c
mov qword [rsp + 0x2e], rdx
movabs rdx, 0x326569dc69c4d485
mov qword [rsp + 0x30], rdx
movabs rdx, 0xd5d03ed3dfd272ca
mov qword [rsp + 0x38], rdx
movabs rdx, 0x111006030c000910
mov qword [rsp + 0x1c], rdx
movabs rdx, 0x101111006030c00
mov qword [rsp + 0x1e], rdx
movabs rdx, 0x40c0d0e0f0d020a
mov qword [rsp + 0x26], rdx
xor eax, eax
jmp 0x4b9fb0
movzx r9d, byte [rsp + rsi + 0x2e]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x77]
mov byte [rsp + rdi + 0x2e], dl
mov byte [rsp + rsi + 0x2e], r8b
add rax, 2
cmp rax, 0x12
jge 0x4b9fe8
movzx edx, byte [rsp + rax + 0x1c]
movzx esi, byte [rsp + rax + 0x1d]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x12
jae 0x4ba00f
movzx r8d, byte [rsp + rdi + 0x2e]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x77]
nop word [rax + rax]
cmp rsi, 0x12
jb 0x4b9f96
jmp 0x4ba003
xor eax, eax
lea rbx, [rsp + 0x2e]
mov ecx, 0x12
call fcn.00444360
mov rbp, qword [rsp + 0x40]
add rsp, 0x48
ret
mov eax, esi
mov ecx, 0x12
call fcn.00456a60
mov eax, edi
mov ecx, 0x12
call fcn.00456a60
nop
nop dword [rax]
call fcn.00454400
jmp fcn.004b9f20

Function at 0x4ba760
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4ba886
sub rsp, 0x60
mov qword [rsp + 0x58], rbp
lea rbp, [rsp + 0x58]
movabs rdx, 0x5e6142555b6a766f
mov qword [rsp + 0x1b], rdx
movabs rdx, 0x5f78626f605d746e
mov qword [rsp + 0x23], rdx
movabs rdx, 0x675f78626f605d74
mov qword [rsp + 0x24], rdx
movabs rdx, 0x5b11232082507270
mov qword [rsp + 0x2c], rdx
movabs rdx, 0x1613150c030d0504
mov qword [rsp + 0x34], rdx
movabs rdx, 0x1404070f1613150c
mov qword [rsp + 0x38], rdx
movabs rdx, 0xb020a0e17141018
mov qword [rsp + 0x40], rdx
movabs rdx, 0x130d06060a0d0901
mov qword [rsp + 0x48], rdx
movabs rdx, 0x41701050c091014
mov qword [rsp + 0x50], rdx
xor eax, eax
jmp 0x4ba820
movzx r9d, byte [rsp + rsi + 0x1b]
sub r9d, edx
lea edx, [r9 + 0x20]
mov byte [rsp + rdi + 0x1b], dl
lea edx, [r8 + 0x20]
mov byte [rsp + rsi + 0x1b], dl
add rax, 2
cmp rax, 0x24
jge 0x4ba84d
movzx edx, byte [rsp + rax + 0x34]
movzx esi, byte [rsp + rax + 0x35]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x19
jae 0x4ba874
movzx r8d, byte [rsp + rdi + 0x1b]
sub r8d, edx
cmp rsi, 0x19
jb 0x4ba803
jmp 0x4ba868
xor eax, eax
lea rbx, [rsp + 0x1b]
mov ecx, 0x19
call fcn.00444360
mov rbp, qword [rsp + 0x58]
add rsp, 0x60
ret
mov eax, esi
mov ecx, 0x19
call fcn.00456a60
mov eax, edi
mov ecx, 0x19
nop dword [rax + rax]
call fcn.00456a60
nop
call fcn.00454400
jmp fcn.004ba760
Function at 0x4bcfe0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4bd132
add rsp, 0xffffffffffffff80
mov qword [rsp + 0x78], rbp
lea rbp, [rsp + 0x78]
movabs rdx, 0x60530fe20421c32
mov qword [rsp + 0x1e], rdx
movabs rdx, 0x606365405d280605
mov qword [rsp + 0x24], rdx
movabs rdx, 0x5e64435539206140
mov qword [rsp + 0x2c], rdx
movabs rdx, 0xdf4e725e6873201d
mov qword [rsp + 0x34], rdx
movabs rdx, 0x794b7354826d6c4c
mov qword [rsp + 0x3c], rdx
movabs rdx, 0x1e040a05001d1608
mov qword [rsp + 0x44], rdx
movabs rdx, 0x107081a1e040a05
mov qword [rsp + 0x48], rdx
movabs rdx, 0x11c0c2012080216
mov qword [rsp + 0x50], rdx
movabs rdx, 0x151307110e000d23
mov qword [rsp + 0x58], rdx
movabs rdx, 0x1c1d072407092300
mov qword [rsp + 0x60], rdx
movabs rdx, 0x11081c0607062222
mov qword [rsp + 0x68], rdx
movabs rdx, 0x1d0a0a1a13211221
mov qword [rsp + 0x70], rdx
xor eax, eax
jmp 0x4bd0cd
movzx r9d, byte [rsp + rsi + 0x1e]
sub r9d, edx
lea edx, [r9 + 0x42]
mov byte [rsp + rdi + 0x1e], dl
lea edx, [r8 + 0x42]
mov byte [rsp + rsi + 0x1e], dl
add rax, 2
cmp rax, 0x34
jge 0x4bd0fa
movzx edx, byte [rsp + rax + 0x44]
movzx esi, byte [rsp + rax + 0x45]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x26
jae 0x4bd125
movzx r8d, byte [rsp + rdi + 0x1e]
sub r8d, edx
cmp rsi, 0x26
jb 0x4bd0b0
jmp 0x4bd115
xor eax, eax
lea rbx, [rsp + 0x1e]
mov ecx, 0x26
call fcn.00444360
mov rbp, qword [rsp + 0x78]
sub rsp, 0xffffffffffffff80
ret
mov eax, esi
mov ecx, 0x26
nop dword [rax]
call fcn.00456a60
mov eax, edi
mov ecx, 0x26
call fcn.00456a60
nop
call fcn.00454400
jmp fcn.004bcfe0

Function at 0x4bde60
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4bdf68
sub rsp, 0x50
mov qword [rsp + 0x48], rbp
lea rbp, [rsp + 0x48]
movabs rdx, 0x799ad32e506f3127
mov qword [rsp + 0x19], rdx
movabs rdx, 0xe0f0e8799ad32e50
mov qword [rsp + 0x1c], rdx
movabs rdx, 0x1ce71ac90e203465
mov qword [rsp + 0x24], rdx
movabs rdx, 0x601110606090803
mov qword [rsp + 0x2c], rdx
movabs rdx, 0xa0809100c0c0509
mov qword [rsp + 0x34], rdx
movabs rdx, 0x40f050a080910
mov qword [rsp + 0x38], rdx
movabs rdx, 0x12030e051112030a
mov qword [rsp + 0x40], rdx
xor eax, eax
jmp 0x4bdf00
movzx r9d, byte [rsp + rsi + 0x19]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x30]
mov byte [rsp + rdi + 0x19], dl
mov byte [rsp + rsi + 0x19], r8b
add rax, 2
nop
cmp rax, 0x1c
jge 0x4bdf32
movzx edx, byte [rsp + rax + 0x2c]
movzx esi, byte [rsp + rax + 0x2d]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x13
jae 0x4bdf5b
movzx r8d, byte [rsp + rdi + 0x19]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x30]
cmp rsi, 0x13
jb 0x4bdee5
jmp 0x4bdf4f
xor eax, eax
lea rbx, [rsp + 0x19]
mov ecx, 0x13
nop
call fcn.00444360
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
mov eax, esi
mov ecx, 0x13
call fcn.00456a60
mov eax, edi
mov ecx, 0x13
call fcn.00456a60
nop
call fcn.00454400
jmp fcn.004bde60
Function at 0x4be4a0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4be596
sub rsp, 0x48
mov qword [rsp + 0x40], rbp
lea rbp, [rsp + 0x40]
movabs rdx, 0x70b0b2b486bfae17
mov qword [rsp + 0x1a], rdx
movabs rdx, 0x30770b0b2b486bf
mov qword [rsp + 0x1c], rdx
movabs rdx, 0xbfb87070adb27474
mov qword [rsp + 0x24], rdx
movabs rdx, 0x50d0410060c0306
mov qword [rsp + 0x2c], rdx
movabs rdx, 0x11080c050d0410
mov qword [rsp + 0x30], rdx
movabs rdx, 0x80f020101090c11
mov qword [rsp + 0x38], rdx
xor eax, eax
jmp 0x4be533
movzx r9d, byte [rsp + rsi + 0x1a]
sub r9d, edx
lea edx, [r9 - 0x37]
mov byte [rsp + rdi + 0x1a], dl
lea edx, [r8 - 0x37]
mov byte [rsp + rsi + 0x1a], dl
add rax, 2
cmp rax, 0x14
jge 0x4be562
movzx edx, byte [rsp + rax + 0x2c]
movzx esi, byte [rsp + rax + 0x2d]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x12
jae 0x4be589
movzx r8d, byte [rsp + rdi + 0x1a]
sub r8d, edx
cmp rsi, 0x12
jb 0x4be516
nop
jmp 0x4be57d
xor eax, eax
lea rbx, [rsp + 0x1a]
mov ecx, 0x12
call fcn.00444360
mov rbp, qword [rsp + 0x40]
add rsp, 0x48
ret
mov eax, esi
mov ecx, 0x12
call fcn.00456a60
mov eax, edi
mov ecx, 0x12
call fcn.00456a60
nop
call fcn.00454400
nop dword [rax + rax]
jmp fcn.004be4a0
Function at 0x4c1ba0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4c1ca8
sub rsp, 0x58
mov qword [rsp + 0x50], rbp
lea rbp, [rsp + 0x50]
movabs rdx, 0xdd20666f207449ce
mov qword [rsp + 0x1c], rdx
movabs rdx, 0xd920736d616572df
mov qword [rsp + 0x24], rdx
movabs rdx, 0xbf24c29f75ae94bb
mov qword [rsp + 0x2c], rdx
movabs rdx, 0x80f1000011015
mov qword [rsp + 0x34], rdx
movabs rdx, 0x1615081615000101
mov qword [rsp + 0x3c], rdx
movabs rdx, 0x712011516150816
mov qword [rsp + 0x40], rdx
movabs rdx, 0x1011170814120808
mov qword [rsp + 0x48], rdx
xor eax, eax
jmp 0x4c1c42
movzx r9d, byte [rsp + rsi + 0x1c]
sub r9d, edx
lea edx, [r9 - 0x14]
mov byte [rsp + rdi + 0x1c], dl
lea edx, [r8 - 0x14]
mov byte [rsp + rsi + 0x1c], dl
add rax, 2
cmp rax, 0x1c
jge 0x4c1c6f
movzx edx, byte [rsp + rax + 0x34]
movzx esi, byte [rsp + rax + 0x35]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x18
jae 0x4c1c9b
movzx r8d, byte [rsp + rdi + 0x1c]
sub r8d, edx
cmp rsi, 0x18
jb 0x4c1c25
jmp 0x4c1c8f
xor eax, eax
lea rbx, [rsp + 0x1c]
mov ecx, 0x18
nop dword [rax + rax]
call fcn.00444360
mov rbp, qword [rsp + 0x50]
add rsp, 0x58
ret
mov eax, esi
mov ecx, 0x18
call fcn.00456a60
mov eax, edi
mov ecx, 0x18
call fcn.00456a60
nop
call fcn.00454400
jmp fcn.004c1ba0

Function at 0x4c2d60
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4c2e72
sub rsp, 0x58
mov qword [rsp + 0x50], rbp
lea rbp, [rsp + 0x50]
movabs rdx, 0x5f5820ed204c6f62
mov qword [rsp + 0x19], rdx
movabs rdx, 0x412035662058494e
mov qword [rsp + 0x21], rdx
movabs rdx, 0x5923644120356620
mov qword [rsp + 0x24], rdx
movabs rdx, 0x656c696620747057
mov qword [rsp + 0x2c], rdx
movabs rdx, 0xd0f10110e020d0e
mov qword [rsp + 0x34], rdx
movabs rdx, 0x1312000c0412110e
mov qword [rsp + 0x3c], rdx
movabs rdx, 0x100715071312000c
mov qword [rsp + 0x40], rdx
movabs rdx, 0x100c1200100e1311
mov qword [rsp + 0x48], rdx
xor eax, eax
jmp 0x4c2e11
movzx r9d, byte [rsp + rsi + 0x19]
sub r9d, edx
lea edx, [r9 + 0x28]
mov byte [rsp + rdi + 0x19], dl
lea edx, [r8 + 0x28]
mov byte [rsp + rsi + 0x19], dl
add rax, 2
cmp rax, 0x1c
jge 0x4c2e3e
movzx edx, byte [rsp + rax + 0x34]
movzx esi, byte [rsp + rax + 0x35]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x1b
jae 0x4c2e65
movzx r8d, byte [rsp + rdi + 0x19]
sub r8d, edx
cmp rsi, 0x1b
jb 0x4c2df4
jmp 0x4c2e59
xor eax, eax
lea rbx, [rsp + 0x19]
mov ecx, 0x1b
call fcn.00444360
mov rbp, qword [rsp + 0x50]
add rsp, 0x58
ret
mov eax, esi
mov ecx, 0x1b
call fcn.00456a60
mov eax, edi
mov ecx, 0x1b
call fcn.00456a60
nop
call fcn.00454400
jmp fcn.004c2d60