joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4ae620
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4ae6ea
push rbp
mov rbp, rsp
sub rsp, 0x48
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x58], rax
mov qword [rsp], rax
mov qword [rsp + 8], rbx
mov byte [rsp + 0x10], 0
call fcn.00403b00
xorps xmm15, xmm15
mov r14, qword [0x006b3ec0]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x18], 0xffffffffffffffff
jne 0x4ae6cf
mov rcx, qword [rsp + 0x60]
lea rdx, [rcx + 1]
mov qword [rsp + 0x40], rdx
lea rax, [0x005605a0]
xor ebx, ebx
mov rcx, rdx
call fcn.004426a0
mov rbx, qword [rsp + 0x60]
mov rcx, rax
xor edi, edi
mov rsi, qword [rsp + 0x40]
mov rax, qword [rsp + 0x58]
nop dword [rax]
call fcn.004b11c0
inc rbx
cmp rcx, rbx
jae 0x4ae6be
mov edi, 1
lea rsi, [0x005605a0]
call fcn.00442780
mov word [rax + rbx*2 - 2], 0
xor edi, edi
xor esi, esi
add rsp, 0x48
pop rbp
ret
xor eax, eax
xor ebx, ebx
mov rcx, rbx
lea rdi, [0x005afc78]
lea rsi, [0x005af868]
add rsp, 0x48
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.00455c20
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.004ae620

Function at 0x4afd20
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4afe0a
push rbp
mov rbp, rsp
sub rsp, 0x48
movabs rdx, 0x726253655a36725a
mov qword [rsp + 0x1d], rdx
movabs rdx, 0x4e704f1b65726253
mov qword [rsp + 0x22], rdx
movabs rdx, 0x49610e5740744040
mov qword [rsp + 0x2a], rdx
movabs rdx, 0x5100c0302140e0d
mov qword [rsp + 0x32], rdx
movabs rdx, 0xd111409050510
mov qword [rsp + 0x38], rdx
movabs rdx, 0x1210070e07110a02
mov qword [rsp + 0x40], rdx
xor eax, eax
jmp 0x4afdad
movzx r9d, byte [rsp + rsi + 0x1d]
sub r9d, edx
lea edx, [r9 + 0x28]
mov byte [rsp + rdi + 0x1d], dl
lea edx, [r8 + 0x28]
mov byte [rsp + rsi + 0x1d], dl
add rax, 2
cmp rax, 0x16
jge 0x4afdda
movzx edx, byte [rsp + rax + 0x32]
movzx esi, byte [rsp + rax + 0x33]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x15
jae 0x4afdfd
movzx r8d, byte [rsp + rdi + 0x1d]
sub r8d, edx
cmp rsi, 0x15
jb 0x4afd90
jmp 0x4afdf1
xor eax, eax
lea rbx, [rsp + 0x1d]
mov ecx, 0x15
call fcn.00445b60
add rsp, 0x48
pop rbp
ret
mov eax, esi
mov ecx, 0x15
call fcn.00457ea0
mov eax, edi
mov ecx, 0x15
call fcn.00457ea0
nop
call fcn.00455c20
jmp fcn.004afd20
Function at 0x4afe20
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4afedd
push rbp
mov rbp, rsp
sub rsp, 0x30
movabs rdx, 0xc167b3a4b904b0a7
mov qword [rsp + 0x1d], rdx
mov byte [rsp + 0x25], 0xb9
movabs rdx, 0x807000408020501
mov qword [rsp + 0x26], rdx
mov word [rsp + 0x2e], 0x603
xor eax, eax
nop
jmp 0x4afe80
movzx r9d, byte [rsp + rsi + 0x1d]
sub r9d, edx
lea edx, [r9 - 0x3a]
mov byte [rsp + rdi + 0x1d], dl
lea edx, [r8 - 0x3a]
mov byte [rsp + rsi + 0x1d], dl
add rax, 2
nop
cmp rax, 0xa
jge 0x4afead
movzx edx, byte [rsp + rax + 0x26]
movzx esi, byte [rsp + rax + 0x27]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 9
jae 0x4afed0
movzx r8d, byte [rsp + rdi + 0x1d]
sub r8d, edx
cmp rsi, 9
jb 0x4afe62
jmp 0x4afec4
xor eax, eax
lea rbx, [rsp + 0x1d]
mov ecx, 9
call fcn.00445b60
add rsp, 0x30
pop rbp
ret
mov eax, esi
mov ecx, 9
call fcn.00457ea0
mov eax, edi
mov ecx, 9
call fcn.00457ea0
nop
nop dword [rax]
call fcn.00455c20
jmp fcn.004afe20

Function at 0x4b0220
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4b031b
push rbp
mov rbp, rsp
sub rsp, 0x48
movabs rdx, 0x8c6564207265660b
mov qword [rsp + 0x19], rdx
movabs rdx, 0x264bd0bea8c6564
mov qword [rsp + 0x1e], rdx
movabs rdx, 0x31786ce28981d773
mov qword [rsp + 0x26], rdx
movabs rdx, 0x10080c0a000f0808
mov qword [rsp + 0x2e], rdx
movabs rdx, 0xf11120710130907
mov qword [rsp + 0x36], rdx
movabs rdx, 0x11010f1112071013
mov qword [rsp + 0x38], rdx
movabs rdx, 0x1007001208090e11
mov qword [rsp + 0x40], rdx
xor eax, eax
jmp 0x4b02b9
movzx r9d, byte [rsp + rsi + 0x19]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x59]
mov byte [rsp + rdi + 0x19], dl
mov byte [rsp + rsi + 0x19], r8b
add rax, 2
cmp rax, 0x1a
jge 0x4b02eb
movzx edx, byte [rsp + rax + 0x2e]
movzx esi, byte [rsp + rax + 0x2f]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x15
jae 0x4b030e
movzx r8d, byte [rsp + rdi + 0x19]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x59]
cmp rsi, 0x15
jb 0x4b029f
jmp 0x4b0302
xor eax, eax
lea rbx, [rsp + 0x19]
mov ecx, 0x15
call fcn.00445b60
add rsp, 0x48
pop rbp
ret
mov eax, esi
mov ecx, 0x15
call fcn.00457ea0
mov eax, edi
mov ecx, 0x15
call fcn.00457ea0
nop
nop dword [rax + rax]
call fcn.00455c20
jmp fcn.004b0220
Function at 0x4b0fe0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4b109d
push rbp
mov rbp, rsp
sub rsp, 0x30
movabs rdx, 0x83b899699c7d6578
mov qword [rsp + 0x1a], rdx
mov word [rsp + 0x22], 0x6465
movabs rdx, 0x600030203050506
mov qword [rsp + 0x24], rdx
mov dword [rsp + 0x2c], 0x2020507
xor eax, eax
jmp 0x4b1040
movzx r9d, byte [rsp + rsi + 0x1a]
sub r9d, edx
lea edx, [r9 - 0xb]
mov byte [rsp + rdi + 0x1a], dl
lea edx, [r8 - 0xb]
mov byte [rsp + rsi + 0x1a], dl
add rax, 2
cmp rax, 0xc
jge 0x4b106d
movzx edx, byte [rsp + rax + 0x24]
movzx esi, byte [rsp + rax + 0x25]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0xa
jae 0x4b1090
movzx r8d, byte [rsp + rdi + 0x1a]
sub r8d, edx
cmp rsi, 0xa
jb 0x4b1023
jmp 0x4b1084
xor eax, eax
lea rbx, [rsp + 0x1a]
mov ecx, 0xa
call fcn.00445b60
add rsp, 0x30
pop rbp
ret
mov eax, esi
mov ecx, 0xa
call fcn.00457ea0
mov eax, edi
mov ecx, 0xa
call fcn.00457ea0
nop
nop dword [rax]
call fcn.00455c20
jmp fcn.004b0fe0

Function at 0x4b10c0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4b11ac
push rbp
mov rbp, rsp
sub rsp, 0x40
movabs rdx, 0xaaa32e0f2e332e1d
mov qword [rsp + 0x1a], rdx
movabs rdx, 0xb4b9aaa32e0f2e33
mov qword [rsp + 0x1c], rdx
movabs rdx, 0xb07fb1bbb4379835
mov qword [rsp + 0x24], rdx
movabs rdx, 0xf040b00090d0e08
mov qword [rsp + 0x2c], rdx
movabs rdx, 0xf000f040b00
mov qword [rsp + 0x30], rdx
movabs rdx, 0xb0707060f1110
mov qword [rsp + 0x38], rdx
xor eax, eax
jmp 0x4b114a
movzx r9d, byte [rsp + rsi + 0x1a]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x74]
mov byte [rsp + rdi + 0x1a], dl
mov byte [rsp + rsi + 0x1a], r8b
add rax, 2
cmp rax, 0x14
jge 0x4b117c
movzx edx, byte [rsp + rax + 0x2c]
movzx esi, byte [rsp + rax + 0x2d]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x12
jae 0x4b119f
movzx r8d, byte [rsp + rdi + 0x1a]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x74]
cmp rsi, 0x12
jb 0x4b1130
jmp 0x4b1193
xor eax, eax
lea rbx, [rsp + 0x1a]
mov ecx, 0x12
call fcn.00445b60
add rsp, 0x40
pop rbp
ret
mov eax, esi
mov ecx, 0x12
call fcn.00457ea0
mov eax, edi
mov ecx, 0x12
call fcn.00457ea0
nop
call fcn.00455c20
jmp fcn.004b10c0
Function at 0x4b3840
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4b392a
push rbp
mov rbp, rsp
sub rsp, 0x48
movabs rdx, 0x4b47336627644b62
mov qword [rsp + 0x1c], rdx
movabs rdx, 0x234551204b473366
mov qword [rsp + 0x20], rdx
movabs rdx, 0x59086d721d3ae498
mov qword [rsp + 0x28], rdx
movabs rdx, 0x12030d120a050c05
mov qword [rsp + 0x30], rdx
movabs rdx, 0x70b0e06060f0e0a
mov qword [rsp + 0x38], rdx
movabs rdx, 0x130e091312010706
mov qword [rsp + 0x40], rdx
xor eax, eax
jmp 0x4b38cd
movzx r9d, byte [rsp + rsi + 0x1c]
sub r9d, edx
lea edx, [r9 + 0x3b]
mov byte [rsp + rdi + 0x1c], dl
lea edx, [r8 + 0x3b]
mov byte [rsp + rsi + 0x1c], dl
add rax, 2
cmp rax, 0x18
jge 0x4b38fa
movzx edx, byte [rsp + rax + 0x30]
movzx esi, byte [rsp + rax + 0x31]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x14
jae 0x4b391d
movzx r8d, byte [rsp + rdi + 0x1c]
sub r8d, edx
cmp rsi, 0x14
jb 0x4b38b0
jmp 0x4b3911
xor eax, eax
lea rbx, [rsp + 0x1c]
mov ecx, 0x14
call fcn.00445b60
add rsp, 0x48
pop rbp
ret
mov eax, esi
mov ecx, 0x14
call fcn.00457ea0
mov eax, edi
mov ecx, 0x14
call fcn.00457ea0
nop
call fcn.00455c20
jmp fcn.004b3840

Function at 0x4b5120
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4b523a
push rbp
mov rbp, rsp
sub rsp, 0x60
movabs rdx, 0xaec86e942c95af64
mov qword [rsp + 0x1c], rdx
movabs rdx, 0x720364612091ec95
mov qword [rsp + 0x24], rdx
movabs rdx, 0xf173736572036461
mov qword [rsp + 0x28], rdx
movabs rdx, 0x4a99032a16b6515
mov qword [rsp + 0x30], rdx
movabs rdx, 0x1a17181914041919
mov qword [rsp + 0x38], rdx
movabs rdx, 0x70a030113031816
mov qword [rsp + 0x40], rdx
movabs rdx, 0x1081b0202061318
mov qword [rsp + 0x48], rdx
movabs rdx, 0xe0818060a071b07
mov qword [rsp + 0x50], rdx
movabs rdx, 0x114091a01191703
mov qword [rsp + 0x58], rdx
xor eax, eax
jmp 0x4b51d7
movzx r9d, byte [rsp + rsi + 0x1c]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x42]
mov byte [rsp + rdi + 0x1c], dl
mov byte [rsp + rsi + 0x1c], r8b
add rax, 2
cmp rax, 0x28
jge 0x4b5209
movzx edx, byte [rsp + rax + 0x38]
movzx esi, byte [rsp + rax + 0x39]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x1c
jae 0x4b522d
movzx r8d, byte [rsp + rdi + 0x1c]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x42]
cmp rsi, 0x1c
jb 0x4b51bd
jmp 0x4b5221
xor eax, eax
lea rbx, [rsp + 0x1c]
mov ecx, 0x1c
call fcn.00445b60
add rsp, 0x60
pop rbp
nop
ret
mov eax, esi
mov ecx, 0x1c
call fcn.00457ea0
mov eax, edi
mov ecx, 0x1c
call fcn.00457ea0
nop
call fcn.00455c20
nop
jmp fcn.004b5120
Function at 0x4b55e0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4b56ca
push rbp
mov rbp, rsp
sub rsp, 0x48
movabs rdx, 0x837478716b1e955c
mov qword [rsp + 0x1d], rdx
movabs rdx, 0x747bf0837478716b
mov qword [rsp + 0x20], rdx
movabs rdx, 0x7c8f648b6563708b
mov qword [rsp + 0x28], rdx
movabs rdx, 0x9070f0a070a0204
mov qword [rsp + 0x30], rdx
movabs rdx, 0x12010f11080605
mov qword [rsp + 0x38], rdx
movabs rdx, 0xb120a120a110c0f
mov qword [rsp + 0x40], rdx
xor eax, eax
jmp 0x4b566d
movzx r9d, byte [rsp + rsi + 0x1d]
sub r9d, edx
lea edx, [r9 + 8]
mov byte [rsp + rdi + 0x1d], dl
lea edx, [r8 + 8]
mov byte [rsp + rsi + 0x1d], dl
add rax, 2
cmp rax, 0x18
jge 0x4b569a
movzx edx, byte [rsp + rax + 0x30]
movzx esi, byte [rsp + rax + 0x31]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x13
jae 0x4b56bd
movzx r8d, byte [rsp + rdi + 0x1d]
sub r8d, edx
cmp rsi, 0x13
jb 0x4b5650
jmp 0x4b56b1
xor eax, eax
lea rbx, [rsp + 0x1d]
mov ecx, 0x13
call fcn.00445b60
add rsp, 0x48
pop rbp
ret
mov eax, esi
mov ecx, 0x13
call fcn.00457ea0
mov eax, edi
mov ecx, 0x13
call fcn.00457ea0
nop
call fcn.00455c20
jmp fcn.004b55e0

Function at 0x4b56e0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4b57b2
push rbp
mov rbp, rsp
sub rsp, 0x38
movabs rdx, 0xd7a04420d2d440e0
mov qword [rsp + 0x1d], rdx
movabs rdx, 0x38cdccd7a04420d2
mov qword [rsp + 0x20], rdx
movabs rdx, 0x7020a0a08050a06
mov qword [rsp + 0x28], rdx
movabs rdx, 0xa03080901090600
mov qword [rsp + 0x30], rdx
xor eax, eax
jmp 0x4b574c
movzx r9d, byte [rsp + rsi + 0x1d]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x76]
mov byte [rsp + rdi + 0x1d], dl
mov byte [rsp + rsi + 0x1d], r8b
add rax, 2
cmp rax, 0x10
jge 0x4b577e
movzx edx, byte [rsp + rax + 0x28]
movzx esi, byte [rsp + rax + 0x29]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0xb
jae 0x4b57a5
movzx r8d, byte [rsp + rdi + 0x1d]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x76]
cmp rsi, 0xb
jb 0x4b5732
jmp 0x4b5795
xor eax, eax
lea rbx, [rsp + 0x1d]
mov ecx, 0xb
call fcn.00445b60
add rsp, 0x38
pop rbp
ret
mov eax, esi
mov ecx, 0xb
nop dword [rax]
call fcn.00457ea0
mov eax, edi
mov ecx, 0xb
call fcn.00457ea0
nop
call fcn.00455c20
jmp fcn.004b56e0
Function at 0x4b57c0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4b588c
push rbp
mov rbp, rsp
sub rsp, 0x38
movabs rdx, 0xad8f8f0565036966
mov qword [rsp + 0x2a], rdx
movabs rdx, 0xf4678f0b9520ad8f
mov qword [rsp + 0x30], rdx
movabs rdx, 0x7040a050906040b
mov qword [rsp + 0x1c], rdx
movabs rdx, 0x20609090a0d0704
mov qword [rsp + 0x22], rdx
xor eax, eax
jmp 0x4b582f
movzx r9d, byte [rsp + rsi + 0x2a]
sub r9d, edx
lea edx, [r9 + 0x7c]
mov byte [rsp + rdi + 0x2a], dl
lea edx, [r8 + 0x7c]
mov byte [rsp + rsi + 0x2a], dl
add rax, 2
cmp rax, 0xe
jge 0x4b585c
movzx edx, byte [rsp + rax + 0x1c]
movzx esi, byte [rsp + rax + 0x1d]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0xe
jae 0x4b587f
movzx r8d, byte [rsp + rdi + 0x2a]
sub r8d, edx
cmp rsi, 0xe
jb 0x4b5812
jmp 0x4b5873
xor eax, eax
lea rbx, [rsp + 0x2a]
mov ecx, 0xe
call fcn.00445b60
add rsp, 0x38
pop rbp
ret
mov eax, esi
mov ecx, 0xe
call fcn.00457ea0
mov eax, edi
mov ecx, 0xe
call fcn.00457ea0
nop
call fcn.00455c20
jmp fcn.004b57c0

Function at 0x4b6ba0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4b6cd8
push rbp
mov rbp, rsp
sub rsp, 0x70
movabs rdx, 0x756f6165805d7761
mov qword [rsp + 0x1d], rdx
movabs rdx, 0x72ae716e65207475
mov qword [rsp + 0x24], rdx
movabs rdx, 0xa820826977748082
mov qword [rsp + 0x2c], rdx
movabs rdx, 0x5a2080646165726c
mov qword [rsp + 0x34], rdx
movabs rdx, 0x6d8149486578887c
mov qword [rsp + 0x3c], rdx
movabs rdx, 0x14251e02210d0d25
mov qword [rsp + 0x44], rdx
movabs rdx, 0x1210d2424261607
mov qword [rsp + 0x4c], rdx
movabs rdx, 0x16230d0501210d24
mov qword [rsp + 0x50], rdx
movabs rdx, 0x412000c07200416
mov qword [rsp + 0x58], rdx
movabs rdx, 0x161e2014051c0e04
mov qword [rsp + 0x60], rdx
movabs rdx, 0x1f0f202110032524
mov qword [rsp + 0x68], rdx
xor eax, eax
jmp 0x4b6c78
movzx r9d, byte [rsp + rsi + 0x1d]
sub r9d, edx
lea edx, [r9 + 0x27]
mov byte [rsp + rdi + 0x1d], dl
lea edx, [r8 + 0x27]
mov byte [rsp + rsi + 0x1d], dl
add rax, 2
cmp rax, 0x2c
jge 0x4b6ca8
movzx edx, byte [rsp + rax + 0x44]
movzx esi, byte [rsp + rax + 0x45]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x27
jae 0x4b6ccb
movzx r8d, byte [rsp + rdi + 0x1d]
sub r8d, edx
nop dword [rax]
cmp rsi, 0x27
jb 0x4b6c5b
jmp 0x4b6cbf
xor eax, eax
lea rbx, [rsp + 0x1d]
mov ecx, 0x27
call fcn.00445b60
add rsp, 0x70
pop rbp
ret
mov eax, esi
mov ecx, 0x27
call fcn.00457ea0
mov eax, edi
mov ecx, 0x27
call fcn.00457ea0
nop
call fcn.00455c20
nop dword [rax]
jmp fcn.004b6ba0
Function at 0x4b6fe0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4b70db
push rbp
mov rbp, rsp
sub rsp, 0x48
movabs rdx, 0xb2dda61589950d69
mov qword [rsp + 0x18], rdx
movabs rdx, 0xfd20de9ab2dda615
mov qword [rsp + 0x1c], rdx
movabs rdx, 0x65ad956683a870f9
mov qword [rsp + 0x24], rdx
movabs rdx, 0xb04010e0e0b120c
mov qword [rsp + 0x2c], rdx
movabs rdx, 0x608050712080b06
mov qword [rsp + 0x34], rdx
movabs rdx, 0xb0e030906080507
mov qword [rsp + 0x38], rdx
movabs rdx, 0x110f030b02090711
mov qword [rsp + 0x40], rdx
xor eax, eax
jmp 0x4b7079
movzx r9d, byte [rsp + rsi + 0x18]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x52]
mov byte [rsp + rdi + 0x18], dl
mov byte [rsp + rsi + 0x18], r8b
add rax, 2
cmp rax, 0x1c
jge 0x4b70ab
movzx edx, byte [rsp + rax + 0x2c]
movzx esi, byte [rsp + rax + 0x2d]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x14
jae 0x4b70ce
movzx r8d, byte [rsp + rdi + 0x18]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x52]
cmp rsi, 0x14
jb 0x4b705f
jmp 0x4b70c2
xor eax, eax
lea rbx, [rsp + 0x18]
mov ecx, 0x14
call fcn.00445b60
add rsp, 0x48
pop rbp
ret
mov eax, esi
mov ecx, 0x14
call fcn.00457ea0
mov eax, edi
mov ecx, 0x14
call fcn.00457ea0
nop
nop dword [rax + rax]
call fcn.00455c20
jmp fcn.004b6fe0
Function at 0x4b9fa0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4ba06c
push rbp
mov rbp, rsp
sub rsp, 0x38
movabs rdx, 0x49524c4057400917
mov qword [rsp + 0x1a], rdx
movabs rdx, 0x46b54696c3e4952
mov qword [rsp + 0x20], rdx
movabs rdx, 0xb02060700060d03
mov qword [rsp + 0x28], rdx
movabs rdx, 0xb070b0108010504
mov qword [rsp + 0x30], rdx
xor eax, eax
jmp 0x4ba00f
movzx r9d, byte [rsp + rsi + 0x1a]
sub r9d, edx
lea edx, [r9 + 0x2a]
mov byte [rsp + rdi + 0x1a], dl
lea edx, [r8 + 0x2a]
mov byte [rsp + rsi + 0x1a], dl
add rax, 2
cmp rax, 0x10
jge 0x4ba03c
movzx edx, byte [rsp + rax + 0x28]
movzx esi, byte [rsp + rax + 0x29]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0xe
jae 0x4ba05f
movzx r8d, byte [rsp + rdi + 0x1a]
sub r8d, edx
cmp rsi, 0xe
jb 0x4b9ff2
jmp 0x4ba053
xor eax, eax
lea rbx, [rsp + 0x1a]
mov ecx, 0xe
call fcn.00445b60
add rsp, 0x38
pop rbp
ret
mov eax, esi
mov ecx, 0xe
call fcn.00457ea0
mov eax, edi
mov ecx, 0xe
call fcn.00457ea0
nop
call fcn.00455c20
jmp fcn.004b9fa0

Function at 0x4ba820
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4ba958
push rbp
mov rbp, rsp
sub rsp, 0x70
movabs rdx, 0x20c90aec7700b13d
mov qword [rsp + 0x1d], rdx
movabs rdx, 0x6f1b6420c90aec77
mov qword [rsp + 0x20], rdx
movabs rdx, 0x6eeded1cdca1e370
mov qword [rsp + 0x28], rdx
movabs rdx, 0x206e6f199c3c9ce4
mov qword [rsp + 0x30], rdx
movabs rdx, 0x7492acb9728be799
mov qword [rsp + 0x38], rdx
movabs rdx, 0x90c060601020115
mov qword [rsp + 0x40], rdx
movabs rdx, 0x1713040f1f11050f
mov qword [rsp + 0x48], rdx
movabs rdx, 0x1140e1c1310170d
mov qword [rsp + 0x50], rdx
movabs rdx, 0x50e160c21091c20
mov qword [rsp + 0x58], rdx
movabs rdx, 0x21140f0d02200e13
mov qword [rsp + 0x60], rdx
movabs rdx, 0x1c160e101f1b1d00
mov qword [rsp + 0x68], rdx
xor eax, eax
jmp 0x4ba8f5
movzx r9d, byte [rsp + rsi + 0x1d]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x62]
mov byte [rsp + rdi + 0x1d], dl
mov byte [rsp + rsi + 0x1d], r8b
add rax, 2
cmp rax, 0x30
jge 0x4ba928
movzx edx, byte [rsp + rax + 0x40]
movzx esi, byte [rsp + rax + 0x41]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x23
jae 0x4ba94b
movzx r8d, byte [rsp + rdi + 0x1d]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x62]
nop
cmp rsi, 0x23
jb 0x4ba8db
jmp 0x4ba93f
xor eax, eax
lea rbx, [rsp + 0x1d]
mov ecx, 0x23
call fcn.00445b60
add rsp, 0x70
pop rbp
ret
mov eax, esi
mov ecx, 0x23
call fcn.00457ea0
mov eax, edi
mov ecx, 0x23
call fcn.00457ea0
nop
call fcn.00455c20
nop dword [rax]
jmp fcn.004ba820
Function at 0x4bac60
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4bad8c
push rbp
mov rbp, rsp
sub rsp, 0x60
movabs rdx, 0xbf0fba05b36dc574
mov qword [rsp + 0x19], rdx
movabs rdx, 0xd05b0cfd18158a0a
mov qword [rsp + 0x21], rdx
movabs rdx, 0x6905735c6cd05b0c
mov qword [rsp + 0x26], rdx
movabs rdx, 0xd00609c679c8191a
mov qword [rsp + 0x2e], rdx
movabs rdx, 0x160f110a1702031c
mov qword [rsp + 0x36], rdx
movabs rdx, 0x15010119050b0915
mov qword [rsp + 0x3e], rdx
movabs rdx, 0x10715010119050b
mov qword [rsp + 0x40], rdx
movabs rdx, 0x61a0b040e170a19
mov qword [rsp + 0x48], rdx
movabs rdx, 0xc1b1c08170d0b1c
mov qword [rsp + 0x50], rdx
movabs rdx, 0x1302040201190e0e
mov qword [rsp + 0x58], rdx
xor eax, eax
jmp 0x4bad26
movzx r9d, byte [rsp + rsi + 0x19]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x31]
mov byte [rsp + rdi + 0x19], dl
mov byte [rsp + rsi + 0x19], r8b
add rax, 2
cmp rax, 0x2a
jge 0x4bad5c
movzx edx, byte [rsp + rax + 0x36]
movzx esi, byte [rsp + rax + 0x37]
mov edi, edx
xor edx, esi
add edx, eax
nop dword [rax]
cmp rdi, 0x1d
jae 0x4bad7f
movzx r8d, byte [rsp + rdi + 0x19]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x31]
cmp rsi, 0x1d
jb 0x4bad0c
jmp 0x4bad73
xor eax, eax
lea rbx, [rsp + 0x19]
mov ecx, 0x1d
call fcn.00445b60
add rsp, 0x60
pop rbp
ret
mov eax, esi
mov ecx, 0x1d
call fcn.00457ea0
mov eax, edi
mov ecx, 0x1d
call fcn.00457ea0
nop
call fcn.00455c20
jmp fcn.004bac60

Function at 0x4bb5c0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4bb6aa
push rbp
mov rbp, rsp
sub rsp, 0x40
movabs rdx, 0xfcd8e5d7eb655898
mov qword [rsp + 0x19], rdx
movabs rdx, 0x6dfcd8e5d7eb6558
mov qword [rsp + 0x1a], rdx
movabs rdx, 0x726f537210626c61
mov qword [rsp + 0x22], rdx
movabs rdx, 0x506000b0c0e0a04
mov qword [rsp + 0x2a], rdx
movabs rdx, 0xc010a00010506
mov qword [rsp + 0x30], rdx
movabs rdx, 0x103070a0e040603
mov qword [rsp + 0x38], rdx
xor eax, eax
jmp 0x4bb64d
movzx r9d, byte [rsp + rsi + 0x19]
sub r9d, edx
lea edx, [r9 - 0x69]
mov byte [rsp + rdi + 0x19], dl
lea edx, [r8 - 0x69]
mov byte [rsp + rsi + 0x19], dl
add rax, 2
cmp rax, 0x16
jge 0x4bb67a
movzx edx, byte [rsp + rax + 0x2a]
movzx esi, byte [rsp + rax + 0x2b]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x11
jae 0x4bb69d
movzx r8d, byte [rsp + rdi + 0x19]
sub r8d, edx
cmp rsi, 0x11
jb 0x4bb630
jmp 0x4bb691
xor eax, eax
lea rbx, [rsp + 0x19]
mov ecx, 0x11
call fcn.00445b60
add rsp, 0x40
pop rbp
ret
mov eax, esi
mov ecx, 0x11
call fcn.00457ea0
mov eax, edi
mov ecx, 0x11
call fcn.00457ea0
nop
call fcn.00455c20
jmp fcn.004bb5c0
Function at 0x4bc220
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4bc347
push rbp
mov rbp, rsp
sub rsp, 0x60
movabs rdx, 0x4b90269c063080d
mov qword [rsp + 0x19], rdx
movabs rdx, 0xc220eaa2b4f1ff9e
mov qword [rsp + 0x21], rdx
movabs rdx, 0x29ce87206ec220ea
mov qword [rsp + 0x26], rdx
movabs rdx, 0x95a4c4777465944d
mov qword [rsp + 0x2e], rdx
movabs rdx, 0x1b120d1a061b050d
mov qword [rsp + 0x36], rdx
movabs rdx, 0x61b0d0813080c0a
mov qword [rsp + 0x3e], rdx
movabs rdx, 0xd16061b0d081308
mov qword [rsp + 0x40], rdx
movabs rdx, 0x90915030d011c1a
mov qword [rsp + 0x48], rdx
movabs rdx, 0xb0b13001213081a
mov qword [rsp + 0x50], rdx
movabs rdx, 0xb14070f0703161a
mov qword [rsp + 0x58], rdx
xor eax, eax
jmp 0x4bc2e9
movzx r9d, byte [rsp + rsi + 0x19]
sub r9d, edx
lea edx, [r9 - 0x74]
mov byte [rsp + rdi + 0x19], dl
lea edx, [r8 - 0x74]
mov byte [rsp + rsi + 0x19], dl
add rax, 2
cmp rax, 0x2a
jge 0x4bc317
movzx edx, byte [rsp + rax + 0x36]
movzx esi, byte [rsp + rax + 0x37]
mov edi, edx
xor edx, esi
add edx, eax
nop
cmp rdi, 0x1d
jae 0x4bc33a
movzx r8d, byte [rsp + rdi + 0x19]
sub r8d, edx
cmp rsi, 0x1d
jb 0x4bc2cc
jmp 0x4bc32e
xor eax, eax
lea rbx, [rsp + 0x19]
mov ecx, 0x1d
call fcn.00445b60
add rsp, 0x60
pop rbp
ret
mov eax, esi
mov ecx, 0x1d
call fcn.00457ea0
mov eax, edi
mov ecx, 0x1d
call fcn.00457ea0
nop
call fcn.00455c20
jmp fcn.004bc220

Function at 0x4bc360
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4bc44c
push rbp
mov rbp, rsp
sub rsp, 0x48
movabs rdx, 0x35dfbfde2ed46144
mov qword [rsp + 0x1d], rdx
movabs rdx, 0x6920c36fd135dfbf
mov qword [rsp + 0x22], rdx
movabs rdx, 0x91e6c82a61c373d3
mov qword [rsp + 0x2a], rdx
movabs rdx, 0xd0300070f140804
mov qword [rsp + 0x32], rdx
movabs rdx, 0x130506110f060d03
mov qword [rsp + 0x38], rdx
movabs rdx, 0x20a00120d060507
mov qword [rsp + 0x40], rdx
xor eax, eax
jmp 0x4bc3ea
movzx r9d, byte [rsp + rsi + 0x1d]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x7c]
mov byte [rsp + rdi + 0x1d], dl
mov byte [rsp + rsi + 0x1d], r8b
add rax, 2
cmp rax, 0x16
jge 0x4bc41c
movzx edx, byte [rsp + rax + 0x32]
movzx esi, byte [rsp + rax + 0x33]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x15
jae 0x4bc43f
movzx r8d, byte [rsp + rdi + 0x1d]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x7c]
cmp rsi, 0x15
jb 0x4bc3d0
jmp 0x4bc433
xor eax, eax
lea rbx, [rsp + 0x1d]
mov ecx, 0x15
call fcn.00445b60
add rsp, 0x48
pop rbp
ret
mov eax, esi
mov ecx, 0x15
call fcn.00457ea0
mov eax, edi
mov ecx, 0x15
call fcn.00457ea0
nop
call fcn.00455c20
jmp fcn.004bc360
Function at 0x4bddc0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4bdebb
push rbp
mov rbp, rsp
sub rsp, 0x48
movabs rdx, 0x95a87f63a1728764
mov qword [rsp + 0x19], rdx
movabs rdx, 0x9d844295a87f63a1
mov qword [rsp + 0x1c], rdx
movabs rdx, 0x56a4700065d5759b
mov qword [rsp + 0x24], rdx
movabs rdx, 0x7110d0a0b120a0f
mov qword [rsp + 0x2c], rdx
movabs rdx, 0x80d0603120b0a0a
mov qword [rsp + 0x34], rdx
movabs rdx, 0x11011209080d0603
mov qword [rsp + 0x38], rdx
movabs rdx, 0x60a0512030c0807
mov qword [rsp + 0x40], rdx
xor eax, eax
jmp 0x4bde59
movzx r9d, byte [rsp + rsi + 0x19]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x35]
mov byte [rsp + rdi + 0x19], dl
mov byte [rsp + rsi + 0x19], r8b
add rax, 2
cmp rax, 0x1c
jge 0x4bde8b
movzx edx, byte [rsp + rax + 0x2c]
movzx esi, byte [rsp + rax + 0x2d]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x13
jae 0x4bdeae
movzx r8d, byte [rsp + rdi + 0x19]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x35]
cmp rsi, 0x13
jb 0x4bde3f
jmp 0x4bdea2
xor eax, eax
lea rbx, [rsp + 0x19]
mov ecx, 0x13
call fcn.00445b60
add rsp, 0x48
pop rbp
ret
mov eax, esi
mov ecx, 0x13
call fcn.00457ea0
mov eax, edi
mov ecx, 0x13
call fcn.00457ea0
nop
nop dword [rax + rax]
call fcn.00455c20
jmp fcn.004bddc0