joyce8/EMBER2024-capa huggingface dataset:
Function at 0x49aca0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
lea r12, [rsp - 0x20]
cmp r12, qword [r14 + 0x10]
jbe 0x49ae47
push rbp
mov rbp, rsp
sub rsp, 0x98
movabs rdx, 0x2e3b74abad4ed287
mov qword [rsp + 0x19], rdx
movabs rdx, 0x6d75a8617e2e3b74
mov qword [rsp + 0x1e], rdx
movabs rdx, 0xb6b56563aabd5897
mov qword [rsp + 0x26], rdx
movabs rdx, 0xa720cbabebab7d83
mov qword [rsp + 0x2e], rdx
movabs rdx, 0x97566f73c1afd89e
mov qword [rsp + 0x36], rdx
movabs rdx, 0x6f20db757fa3f365
mov qword [rsp + 0x3e], rdx
movabs rdx, 0x50808d7d129eb866
mov qword [rsp + 0x46], rdx
movabs rdx, 0x4082a0217302610
mov qword [rsp + 0x4e], rdx
movabs rdx, 0x3192e22141a0118
mov qword [rsp + 0x56], rdx
movabs rdx, 0x132303192e22141a
mov qword [rsp + 0x58], rdx
movabs rdx, 0x417150f15201d01
mov qword [rsp + 0x60], rdx
movabs rdx, 0x1f1e02100a1c171e
mov qword [rsp + 0x68], rdx
movabs rdx, 0x2432063334272314
mov qword [rsp + 0x70], rdx
movabs rdx, 0x2602170430143118
mov qword [rsp + 0x78], rdx
movabs rdx, 0x2a05142a0d0c2f0a
mov qword [rsp + 0x80], rdx
movabs rdx, 0x300e15003116160a
mov qword [rsp + 0x88], rdx
movabs rdx, 0x130d21333128040e
mov qword [rsp + 0x90], rdx
xor eax, eax
jmp 0x49ade0
movzx r9d, byte [rsp + rsi + 0x19]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x67]
mov byte [rsp + rdi + 0x19], dl
mov byte [rsp + rsi + 0x19], r8b
add rax, 2
cmp rax, 0x4a
jge 0x49ae12
movzx edx, byte [rsp + rax + 0x4e]
movzx esi, byte [rsp + rax + 0x4f]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x35
jae 0x49ae3a
movzx r8d, byte [rsp + rdi + 0x19]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x67]
cmp rsi, 0x35
jb 0x49adc6
jmp 0x49ae2e
xor eax, eax
lea rbx, [rsp + 0x19]
mov ecx, 0x35
nop
call fcn.00440c40
add rsp, 0x98
pop rbp
ret
mov eax, esi
mov ecx, 0x35
call fcn.00450f20
mov eax, edi
mov ecx, 0x35
call fcn.00450f20
nop
call fcn.0044eca0
jmp fcn.0049aca0
Function at 0x49de00
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x49df4c
push rbp
mov rbp, rsp
sub rsp, 0x78
movabs rdx, 0x465f65744961245a
mov qword [rsp + 0x1a], rdx
movabs rdx, 0x6ceb2a9c452eda4b
mov qword [rsp + 0x22], rdx
movabs rdx, 0x574c2b386f206b65
mov qword [rsp + 0x2a], rdx
movabs rdx, 0x97f816f3297537fb
mov qword [rsp + 0x32], rdx
movabs rdx, 0x4a6febce1165745c
mov qword [rsp + 0x3a], rdx
movabs rdx, 0x14092319251f1920
mov qword [rsp + 0x42], rdx
movabs rdx, 0xb23091825271409
mov qword [rsp + 0x48], rdx
movabs rdx, 0x206140b1d1c1711
mov qword [rsp + 0x50], rdx
movabs rdx, 0xa1f0e07091c1b
mov qword [rsp + 0x58], rdx
movabs rdx, 0xc0e151d1616241f
mov qword [rsp + 0x60], rdx
movabs rdx, 0x1c1d14271e011e0e
mov qword [rsp + 0x68], rdx
movabs rdx, 0xe140d011b192525
mov qword [rsp + 0x70], rdx
xor eax, eax
jmp 0x49dee4
movzx r9d, byte [rsp + rsi + 0x1a]
lea edx, [r9 + rdx]
lea edx, [rdx - 7]
mov byte [rsp + rdi + 0x1a], dl
mov byte [rsp + rsi + 0x1a], r8b
add rax, 2
cmp rax, 0x36
jge 0x49df1c
movzx edx, byte [rsp + rax + 0x42]
movzx esi, byte [rsp + rax + 0x43]
mov edi, edx
xor edx, esi
add edx, eax
nop word [rax + rax]
cmp rdi, 0x28
jae 0x49df3f
movzx r8d, byte [rsp + rdi + 0x1a]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 7]
cmp rsi, 0x28
jb 0x49deca
jmp 0x49df33
xor eax, eax
lea rbx, [rsp + 0x1a]
mov ecx, 0x28
call fcn.00440c40
add rsp, 0x78
pop rbp
ret
mov eax, esi
mov ecx, 0x28
call fcn.00450f20
mov eax, edi
mov ecx, 0x28
call fcn.00450f20
nop
call fcn.0044eca0
jmp fcn.0049de00

Function at 0x49fa20
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x49fae6
push rbp
mov rbp, rsp
sub rsp, 0x30
movabs rdx, 0xb94cbc800b728e76
mov qword [rsp + 0x1d], rdx
mov byte [rsp + 0x25], 0x13
movabs rdx, 0x102070000030508
mov qword [rsp + 0x26], rdx
mov word [rsp + 0x2e], 0x405
xor eax, eax
nop
jmp 0x49fa80
movzx r9d, byte [rsp + rsi + 0x1d]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x5b]
mov byte [rsp + rdi + 0x1d], dl
mov byte [rsp + rsi + 0x1d], r8b
add rax, 2
nop dword [rax]
cmp rax, 0xa
jge 0x49fab2
movzx edx, byte [rsp + rax + 0x26]
movzx esi, byte [rsp + rax + 0x27]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 9
jae 0x49fad7
movzx r8d, byte [rsp + rdi + 0x1d]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x5b]
cmp rsi, 9
jb 0x49fa62
jmp 0x49facb
xor eax, eax
lea rbx, [rsp + 0x1d]
mov ecx, 9
nop
call fcn.00440c40
add rsp, 0x30
pop rbp
ret
mov eax, esi
mov ecx, 9
call fcn.00450f20
mov eax, edi
mov ecx, 9
nop
call fcn.00450f20
nop
call fcn.0044eca0
jmp fcn.0049fa20
Function at 0x4a1be0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4a1cfd
push rbp
mov rbp, rsp
sub rsp, 0x60
movabs rdx, 0x6733d7470f4f6119
mov qword [rsp + 0x1e], rdx
movabs rdx, 0x6c3b3475406e6f6e
mov qword [rsp + 0x26], rdx
movabs rdx, 0x4a1507fc6c3b3475
mov qword [rsp + 0x2a], rdx
movabs rdx, 0x19da65ee265f7670
mov qword [rsp + 0x32], rdx
movabs rdx, 0x12121b0517060005
mov qword [rsp + 0x3a], rdx
movabs rdx, 0xb001a10050e1212
mov qword [rsp + 0x40], rdx
movabs rdx, 0x1018040d180d0617
mov qword [rsp + 0x48], rdx
movabs rdx, 0xc12001807120e02
mov qword [rsp + 0x50], rdx
movabs rdx, 0x7030014161a1311
mov qword [rsp + 0x58], rdx
xor eax, eax
jmp 0x4a1ca0
movzx r9d, byte [rsp + rsi + 0x1e]
sub r9d, edx
lea edx, [r9 + 0x39]
mov byte [rsp + rdi + 0x1e], dl
lea edx, [r8 + 0x39]
mov byte [rsp + rsi + 0x1e], dl
add rax, 2
nop word [rax + rax]
cmp rax, 0x26
jge 0x4a1ccd
movzx edx, byte [rsp + rax + 0x3a]
movzx esi, byte [rsp + rax + 0x3b]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x1c
jae 0x4a1cf0
movzx r8d, byte [rsp + rdi + 0x1e]
sub r8d, edx
cmp rsi, 0x1c
jb 0x4a1c7d
jmp 0x4a1ce4
xor eax, eax
lea rbx, [rsp + 0x1e]
mov ecx, 0x1c
call fcn.00440c40
add rsp, 0x60
pop rbp
ret
mov eax, esi
mov ecx, 0x1c
call fcn.00450f20
mov eax, edi
mov ecx, 0x1c
call fcn.00450f20
nop
nop dword [rax]
call fcn.0044eca0
jmp fcn.004a1be0

Function at 0x4a2ce0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4a2e18
push rbp
mov rbp, rsp
sub rsp, 0x70
movabs rdx, 0x2e4e93a75ea01d72
mov qword [rsp + 0x1f], rdx
movabs rdx, 0x65896799752e4e93
mov qword [rsp + 0x24], rdx
movabs rdx, 0x6d63566674963e7c
mov qword [rsp + 0x2c], rdx
movabs rdx, 0x7994b473776e2074
mov qword [rsp + 0x34], rdx
movabs rdx, 0x8163856c73836574
mov qword [rsp + 0x3c], rdx
movabs rdx, 0x1409190313010303
mov qword [rsp + 0x44], rdx
movabs rdx, 0x15020a0505140111
mov qword [rsp + 0x4c], rdx
movabs rdx, 0xb140d0615020a05
mov qword [rsp + 0x50], rdx
movabs rdx, 0x61b2422150f1a0e
mov qword [rsp + 0x58], rdx
movabs rdx, 0x8040d12080a0d0e
mov qword [rsp + 0x60], rdx
movabs rdx, 0x1f15081824221b15
mov qword [rsp + 0x68], rdx
xor eax, eax
jmp 0x4a2db8
movzx r9d, byte [rsp + rsi + 0x1f]
sub r9d, edx
lea edx, [r9 + 0x17]
mov byte [rsp + rdi + 0x1f], dl
lea edx, [r8 + 0x17]
mov byte [rsp + rsi + 0x1f], dl
add rax, 2
cmp rax, 0x2c
jge 0x4a2de8
movzx edx, byte [rsp + rax + 0x44]
movzx esi, byte [rsp + rax + 0x45]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x25
jae 0x4a2e0b
movzx r8d, byte [rsp + rdi + 0x1f]
sub r8d, edx
nop dword [rax]
cmp rsi, 0x25
jb 0x4a2d9b
jmp 0x4a2dff
xor eax, eax
lea rbx, [rsp + 0x1f]
mov ecx, 0x25
call fcn.00440c40
add rsp, 0x70
pop rbp
ret
mov eax, esi
mov ecx, 0x25
call fcn.00450f20
mov eax, edi
mov ecx, 0x25
call fcn.00450f20
nop
call fcn.0044eca0
nop dword [rax]
jmp fcn.004a2ce0
Function at 0x4a68e0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4a69ca
push rbp
mov rbp, rsp
sub rsp, 0x48
movabs rdx, 0x207f6e6e7574667b
mov qword [rsp + 0x1f], rdx
movabs rdx, 0x89207f6e6e757466
mov qword [rsp + 0x20], rdx
movabs rdx, 0x8367698520817071
mov qword [rsp + 0x28], rdx
movabs rdx, 0xd02040110080905
mov qword [rsp + 0x30], rdx
movabs rdx, 0xd0306000608000d
mov qword [rsp + 0x38], rdx
movabs rdx, 0x20810010f090f0b
mov qword [rsp + 0x40], rdx
xor eax, eax
jmp 0x4a696d
movzx r9d, byte [rsp + rsi + 0x1f]
sub r9d, edx
lea edx, [r9 + 0x12]
mov byte [rsp + rdi + 0x1f], dl
lea edx, [r8 + 0x12]
mov byte [rsp + rsi + 0x1f], dl
add rax, 2
cmp rax, 0x18
jge 0x4a699a
movzx edx, byte [rsp + rax + 0x30]
movzx esi, byte [rsp + rax + 0x31]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x11
jae 0x4a69bd
movzx r8d, byte [rsp + rdi + 0x1f]
sub r8d, edx
cmp rsi, 0x11
jb 0x4a6950
jmp 0x4a69b1
xor eax, eax
lea rbx, [rsp + 0x1f]
mov ecx, 0x11
call fcn.00440c40
add rsp, 0x48
pop rbp
ret
mov eax, esi
mov ecx, 0x11
call fcn.00450f20
mov eax, edi
mov ecx, 0x11
call fcn.00450f20
nop
call fcn.0044eca0
jmp fcn.004a68e0

Function at 0x4a9200
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4a92cc
push rbp
mov rbp, rsp
sub rsp, 0x38
movabs rdx, 0xb962e7b3be6fa2ad
mov qword [rsp + 0x1e], rdx
mov dword [rsp + 0x26], 0x216566fd
movabs rdx, 0x50803030108040b
mov qword [rsp + 0x2a], rdx
movabs rdx, 0x807000107040508
mov qword [rsp + 0x30], rdx
xor eax, eax
jmp 0x4a9265
movzx r9d, byte [rsp + rsi + 0x1e]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x50]
mov byte [rsp + rdi + 0x1e], dl
mov byte [rsp + rsi + 0x1e], r8b
add rax, 2
cmp rax, 0xe
jge 0x4a929c
movzx edx, byte [rsp + rax + 0x2a]
movzx esi, byte [rsp + rax + 0x2b]
mov edi, edx
xor edx, esi
add edx, eax
nop dword [rax + rax]
cmp rdi, 0xc
jae 0x4a92bf
movzx r8d, byte [rsp + rdi + 0x1e]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x50]
cmp rsi, 0xc
jb 0x4a924b
jmp 0x4a92b3
xor eax, eax
lea rbx, [rsp + 0x1e]
mov ecx, 0xc
call fcn.00440c40
add rsp, 0x38
pop rbp
ret
mov eax, esi
mov ecx, 0xc
call fcn.00450f20
mov eax, edi
mov ecx, 0xc
call fcn.00450f20
nop
call fcn.0044eca0
jmp fcn.004a9200
Function at 0x4ab8e0
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4ab9aa
push rbp
mov rbp, rsp
sub rsp, 0x48
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x58], rax
mov qword [rsp], rax
mov qword [rsp + 8], rbx
mov byte [rsp + 0x10], 0
call fcn.00403080
xorps xmm15, xmm15
mov r14, qword [0x0065e5b0]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x18], 0xffffffffffffffff
jne 0x4ab98f
mov rcx, qword [rsp + 0x60]
lea rdx, [rcx + 1]
mov qword [rsp + 0x40], rdx
lea rax, [0x00544980]
xor ebx, ebx
mov rcx, rdx
call fcn.0043d780
mov rbx, qword [rsp + 0x60]
mov rcx, rax
xor edi, edi
mov rsi, qword [rsp + 0x40]
mov rax, qword [rsp + 0x58]
nop dword [rax]
call fcn.004ae900
inc rbx
cmp rcx, rbx
jae 0x4ab97e
mov edi, 1
lea rsi, [0x00544980]
call fcn.0043d860
mov word [rax + rbx*2 - 2], 0
xor edi, edi
xor esi, esi
add rsp, 0x48
pop rbp
ret
xor eax, eax
xor ebx, ebx
mov rcx, rbx
lea rdi, [0x00581568]
lea rsi, [0x00581210]
add rsp, 0x48
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.0044eca0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.004ab8e0

Function at 0x4acc00
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4acd0c
push rbp
mov rbp, rsp
sub rsp, 0x58
movabs rdx, 0x6b649455887c6a66
mov qword [rsp + 0x1c], rdx
movabs rdx, 0x656974746355713c
mov qword [rsp + 0x24], rdx
movabs rdx, 0x6d6f17904f71352a
mov qword [rsp + 0x2c], rdx
movabs rdx, 0x112030910140503
mov qword [rsp + 0x34], rdx
movabs rdx, 0x8150e1301120309
mov qword [rsp + 0x38], rdx
movabs rdx, 0x140e0e000c0e1704
mov qword [rsp + 0x40], rdx
movabs rdx, 0x170a050402090502
mov qword [rsp + 0x48], rdx
movabs rdx, 0xb0c0607150c110c
mov qword [rsp + 0x50], rdx
xor eax, eax
jmp 0x4acca8
movzx r9d, byte [rsp + rsi + 0x1c]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x1e]
mov byte [rsp + rdi + 0x1c], dl
mov byte [rsp + rsi + 0x1c], r8b
add rax, 2
cmp rax, 0x24
jge 0x4accdc
movzx edx, byte [rsp + rax + 0x34]
movzx esi, byte [rsp + rax + 0x35]
mov edi, edx
xor edx, esi
add edx, eax
nop
cmp rdi, 0x18
jae 0x4accff
movzx r8d, byte [rsp + rdi + 0x1c]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x1e]
cmp rsi, 0x18
jb 0x4acc8e
jmp 0x4accf3
xor eax, eax
lea rbx, [rsp + 0x1c]
mov ecx, 0x18
call fcn.00440c40
add rsp, 0x58
pop rbp
ret
mov eax, esi
mov ecx, 0x18
call fcn.00450f20
mov eax, edi
mov ecx, 0x18
call fcn.00450f20
nop
call fcn.0044eca0
jmp fcn.004acc00
Function at 0x4acd20
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4ace1d
push rbp
mov rbp, rsp
sub rsp, 0x50
movabs rdx, 0x637364757233856b
mov qword [rsp + 0x1f], rdx
movabs rdx, 0x2064658469637364
mov qword [rsp + 0x24], rdx
movabs rdx, 0x5d68149273815161
mov qword [rsp + 0x2c], rdx
movabs rdx, 0x1306141310121301
mov qword [rsp + 0x34], rdx
movabs rdx, 0x100021404100d07
mov qword [rsp + 0x3c], rdx
movabs rdx, 0xe13021301000214
mov qword [rsp + 0x40], rdx
movabs rdx, 0xd1113140d0f1209
mov qword [rsp + 0x48], rdx
xor eax, eax
jmp 0x4acdc0
movzx r9d, byte [rsp + rsi + 0x1f]
sub r9d, edx
lea edx, [r9 + 0x17]
mov byte [rsp + rdi + 0x1f], dl
lea edx, [r8 + 0x17]
mov byte [rsp + rsi + 0x1f], dl
add rax, 2
nop dword [rax]
cmp rax, 0x1c
jge 0x4acded
movzx edx, byte [rsp + rax + 0x34]
movzx esi, byte [rsp + rax + 0x35]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x15
jae 0x4ace10
movzx r8d, byte [rsp + rdi + 0x1f]
sub r8d, edx
cmp rsi, 0x15
jb 0x4acd9f
jmp 0x4ace04
xor eax, eax
lea rbx, [rsp + 0x1f]
mov ecx, 0x15
call fcn.00440c40
add rsp, 0x50
pop rbp
ret
mov eax, esi
mov ecx, 0x15
call fcn.00450f20
mov eax, edi
mov ecx, 0x15
call fcn.00450f20
nop
nop dword [rax]
call fcn.0044eca0
jmp fcn.004acd20

Function at 0x4ad5c0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4ad6bd
push rbp
mov rbp, rsp
sub rsp, 0x50
movabs rdx, 0x81b464c7c9fc73d6
mov qword [rsp + 0x1f], rdx
movabs rdx, 0x63d0d56e6981b464
mov qword [rsp + 0x24], rdx
movabs rdx, 0xe2721619eb4e95d
mov qword [rsp + 0x2c], rdx
movabs rdx, 0xc0d0f0307140206
mov qword [rsp + 0x34], rdx
movabs rdx, 0xe1302100f12020d
mov qword [rsp + 0x3c], rdx
movabs rdx, 0x140200130e130210
mov qword [rsp + 0x40], rdx
movabs rdx, 0xa0b03020b0c040a
mov qword [rsp + 0x48], rdx
xor eax, eax
jmp 0x4ad660
movzx r9d, byte [rsp + rsi + 0x1f]
sub r9d, edx
lea edx, [r9 + 0x6d]
mov byte [rsp + rdi + 0x1f], dl
lea edx, [r8 + 0x6d]
mov byte [rsp + rsi + 0x1f], dl
add rax, 2
nop dword [rax]
cmp rax, 0x1c
jge 0x4ad68d
movzx edx, byte [rsp + rax + 0x34]
movzx esi, byte [rsp + rax + 0x35]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x15
jae 0x4ad6b0
movzx r8d, byte [rsp + rdi + 0x1f]
sub r8d, edx
cmp rsi, 0x15
jb 0x4ad63f
jmp 0x4ad6a4
xor eax, eax
lea rbx, [rsp + 0x1f]
mov ecx, 0x15
call fcn.00440c40
add rsp, 0x50
pop rbp
ret
mov eax, esi
mov ecx, 0x15
call fcn.00450f20
mov eax, edi
mov ecx, 0x15
call fcn.00450f20
nop
nop dword [rax]
call fcn.0044eca0
jmp fcn.004ad5c0
Function at 0x4b2800
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4b28ec
push rbp
mov rbp, rsp
sub rsp, 0x48
movabs rdx, 0xf7f26979f6b8fb62
mov qword [rsp + 0x1f], rdx
movabs rdx, 0xfa0900f7f26979f6
mov qword [rsp + 0x22], rdx
movabs rdx, 0xdfeaeb70f072f6fb
mov qword [rsp + 0x2a], rdx
movabs rdx, 0xe100208110c0804
mov qword [rsp + 0x32], rdx
movabs rdx, 0x30a0107020a0e10
mov qword [rsp + 0x38], rdx
movabs rdx, 0x61210061209090b
mov qword [rsp + 0x40], rdx
xor eax, eax
jmp 0x4b288a
movzx r9d, byte [rsp + rsi + 0x1f]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x5a]
mov byte [rsp + rdi + 0x1f], dl
mov byte [rsp + rsi + 0x1f], r8b
add rax, 2
cmp rax, 0x16
jge 0x4b28bc
movzx edx, byte [rsp + rax + 0x32]
movzx esi, byte [rsp + rax + 0x33]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x13
jae 0x4b28df
movzx r8d, byte [rsp + rdi + 0x1f]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x5a]
cmp rsi, 0x13
jb 0x4b2870
jmp 0x4b28d3
xor eax, eax
lea rbx, [rsp + 0x1f]
mov ecx, 0x13
call fcn.00440c40
add rsp, 0x48
pop rbp
ret
mov eax, esi
mov ecx, 0x13
call fcn.00450f20
mov eax, edi
mov ecx, 0x13
call fcn.00450f20
nop
call fcn.0044eca0
jmp fcn.004b2800

Function at 0x4b2900
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4b2a1d
push rbp
mov rbp, rsp
sub rsp, 0x60
movabs rdx, 0xe0654e1e65e76986
mov qword [rsp + 0x1e], rdx
movabs rdx, 0xff785ff41478fe63
mov qword [rsp + 0x26], rdx
movabs rdx, 0x209069ff785ff4
mov qword [rsp + 0x2a], rdx
movabs rdx, 0x30746174fb2064f8
mov qword [rsp + 0x32], rdx
movabs rdx, 0x51b0c13130e0702
mov qword [rsp + 0x3a], rdx
movabs rdx, 0x1b0c0d1b1b0b051b
mov qword [rsp + 0x40], rdx
movabs rdx, 0x14051b1100040a0b
mov qword [rsp + 0x48], rdx
movabs rdx, 0xd040c0d11170b1b
mov qword [rsp + 0x50], rdx
movabs rdx, 0x14170f0a09000017
mov qword [rsp + 0x58], rdx
xor eax, eax
jmp 0x4b29c0
movzx r9d, byte [rsp + rsi + 0x1e]
sub r9d, edx
lea edx, [r9 - 0x6f]
mov byte [rsp + rdi + 0x1e], dl
lea edx, [r8 - 0x6f]
mov byte [rsp + rsi + 0x1e], dl
add rax, 2
nop word [rax + rax]
cmp rax, 0x26
jge 0x4b29ed
movzx edx, byte [rsp + rax + 0x3a]
movzx esi, byte [rsp + rax + 0x3b]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x1c
jae 0x4b2a10
movzx r8d, byte [rsp + rdi + 0x1e]
sub r8d, edx
cmp rsi, 0x1c
jb 0x4b299d
jmp 0x4b2a04
xor eax, eax
lea rbx, [rsp + 0x1e]
mov ecx, 0x1c
call fcn.00440c40
add rsp, 0x60
pop rbp
ret
mov eax, esi
mov ecx, 0x1c
call fcn.00450f20
mov eax, edi
mov ecx, 0x1c
call fcn.00450f20
nop
nop dword [rax]
call fcn.0044eca0
jmp fcn.004b2900
Function at 0x4b4f80
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4b507b
push rbp
mov rbp, rsp
sub rsp, 0x50
movabs rdx, 0x695534456e6e4d63
mov qword [rsp + 0x1a], rdx
movabs rdx, 0x5b56614e544d414a
mov qword [rsp + 0x22], rdx
movabs rdx, 0x723e3b10202f5120
mov qword [rsp + 0x2a], rdx
movabs rdx, 0x904150a14151509
mov qword [rsp + 0x32], rdx
movabs rdx, 0xc1412050b05160c
mov qword [rsp + 0x3a], rdx
movabs rdx, 0x10e110b050e0c14
mov qword [rsp + 0x40], rdx
movabs rdx, 0xd0f08040f090605
mov qword [rsp + 0x48], rdx
xor eax, eax
jmp 0x4b5019
movzx r9d, byte [rsp + rsi + 0x1a]
lea edx, [r9 + rdx]
lea edx, [rdx - 0xb]
mov byte [rsp + rdi + 0x1a], dl
mov byte [rsp + rsi + 0x1a], r8b
add rax, 2
cmp rax, 0x1e
jge 0x4b504b
movzx edx, byte [rsp + rax + 0x32]
movzx esi, byte [rsp + rax + 0x33]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x18
jae 0x4b506e
movzx r8d, byte [rsp + rdi + 0x1a]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0xb]
cmp rsi, 0x18
jb 0x4b4fff
jmp 0x4b5062
xor eax, eax
lea rbx, [rsp + 0x1a]
mov ecx, 0x18
call fcn.00440c40
add rsp, 0x50
pop rbp
ret
mov eax, esi
mov ecx, 0x18
call fcn.00450f20
mov eax, edi
mov ecx, 0x18
call fcn.00450f20
nop
nop dword [rax + rax]
call fcn.0044eca0
jmp fcn.004b4f80

Function at 0x4b6e00
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4b6ecc
push rbp
mov rbp, rsp
sub rsp, 0x38
movabs rdx, 0x69780d2025cb6925
mov qword [rsp + 0x1f], rdx
movabs rdx, 0x1fb71869780d2025
mov qword [rsp + 0x22], rdx
movabs rdx, 0x905020205030909
mov qword [rsp + 0x2a], rdx
movabs rdx, 0xa020800090a0905
mov qword [rsp + 0x30], rdx
xor eax, eax
jmp 0x4b6e6f
movzx r9d, byte [rsp + rsi + 0x1f]
sub r9d, edx
lea edx, [r9 + 0x60]
mov byte [rsp + rdi + 0x1f], dl
lea edx, [r8 + 0x60]
mov byte [rsp + rsi + 0x1f], dl
add rax, 2
cmp rax, 0xe
jge 0x4b6e9c
movzx edx, byte [rsp + rax + 0x2a]
movzx esi, byte [rsp + rax + 0x2b]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0xb
jae 0x4b6ebf
movzx r8d, byte [rsp + rdi + 0x1f]
sub r8d, edx
cmp rsi, 0xb
jb 0x4b6e52
jmp 0x4b6eb3
xor eax, eax
lea rbx, [rsp + 0x1f]
mov ecx, 0xb
call fcn.00440c40
add rsp, 0x38
pop rbp
ret
mov eax, esi
mov ecx, 0xb
call fcn.00450f20
mov eax, edi
mov ecx, 0xb
call fcn.00450f20
nop
call fcn.0044eca0
jmp fcn.004b6e00
Function at 0x4b7140
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4b721d
push rbp
mov rbp, rsp
sub rsp, 0x40
movabs rdx, 0xe5e456205ce869ed
mov qword [rsp + 0x1e], rdx
movabs rdx, 0x6548d041fb5fe5e4
mov qword [rsp + 0x24], rdx
movabs rdx, 0x80c0b05080a090c
mov qword [rsp + 0x2c], rdx
movabs rdx, 0x90b0309080c0b05
mov qword [rsp + 0x30], rdx
movabs rdx, 0x60a0a02070a05
mov qword [rsp + 0x38], rdx
xor eax, eax
nop
jmp 0x4b71c0
movzx r9d, byte [rsp + rsi + 0x1e]
sub r9d, edx
lea edx, [r9 - 0x66]
mov byte [rsp + rdi + 0x1e], dl
lea edx, [r8 - 0x66]
mov byte [rsp + rsi + 0x1e], dl
add rax, 2
nop
cmp rax, 0x14
jge 0x4b71ed
movzx edx, byte [rsp + rax + 0x2c]
movzx esi, byte [rsp + rax + 0x2d]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0xe
jae 0x4b7210
movzx r8d, byte [rsp + rdi + 0x1e]
sub r8d, edx
cmp rsi, 0xe
jb 0x4b71a2
jmp 0x4b7204
xor eax, eax
lea rbx, [rsp + 0x1e]
mov ecx, 0xe
call fcn.00440c40
add rsp, 0x40
pop rbp
ret
mov eax, esi
mov ecx, 0xe
call fcn.00450f20
mov eax, edi
mov ecx, 0xe
call fcn.00450f20
nop
nop dword [rax]
call fcn.0044eca0
jmp fcn.004b7140

Function at 0x4b7a80
Capabilities:
Encrypt data using rc4 prga

Disassembly:
lea r12, [rsp - 0x10]
cmp r12, qword [r14 + 0x10]
jbe 0x4b7c00
push rbp
mov rbp, rsp
sub rsp, 0x88
movabs rdx, 0x503a6854616dab8a
mov qword [rsp + 0x1d], rdx
movabs rdx, 0x6f503a6854616dab
mov qword [rsp + 0x1e], rdx
movabs rdx, 0x3e6d7bbe9e9ec023
mov qword [rsp + 0x26], rdx
movabs rdx, 0x20665ca465746596
mov qword [rsp + 0x2e], rdx
movabs rdx, 0x7420655579926dfb
mov qword [rsp + 0x36], rdx
movabs rdx, 0x637e659ad4779299
mov qword [rsp + 0x3e], rdx
movabs rdx, 0xc28e74816972616d
mov qword [rsp + 0x46], rdx
movabs rdx, 0x21a1d16022f2c0b
mov qword [rsp + 0x4e], rdx
movabs rdx, 0x241b012019220704
mov qword [rsp + 0x56], rdx
movabs rdx, 0xa25241b01201922
mov qword [rsp + 0x58], rdx
movabs rdx, 0x70515300e100717
mov qword [rsp + 0x60], rdx
movabs rdx, 0x2706292407091815
mov qword [rsp + 0x68], rdx
movabs rdx, 0x18200d2c211b221b
mov qword [rsp + 0x70], rdx
movabs rdx, 0x2c001a002d201130
mov qword [rsp + 0x78], rdx
movabs rdx, 0xc250a0e050d2c22
mov qword [rsp + 0x80], rdx
xor eax, eax
jmp 0x4b7ba0
movzx r9d, byte [rsp + rsi + 0x1d]
sub r9d, edx
lea edx, [r9 + 0x27]
mov byte [rsp + rdi + 0x1d], dl
lea edx, [r8 + 0x27]
mov byte [rsp + rsi + 0x1d], dl
add rax, 2
nop
cmp rax, 0x3a
jge 0x4b7bcd
movzx edx, byte [rsp + rax + 0x4e]
movzx esi, byte [rsp + rax + 0x4f]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x31
jae 0x4b7bf3
movzx r8d, byte [rsp + rdi + 0x1d]
sub r8d, edx
cmp rsi, 0x31
jb 0x4b7b82
jmp 0x4b7be7
xor eax, eax
lea rbx, [rsp + 0x1d]
mov ecx, 0x31
call fcn.00440c40
add rsp, 0x88
pop rbp
ret
mov eax, esi
mov ecx, 0x31
call fcn.00450f20
mov eax, edi
mov ecx, 0x31
call fcn.00450f20
nop
call fcn.0044eca0
jmp fcn.004b7a80