joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4b0400
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4b04fb
push rbp
mov rbp, rsp
sub rsp, 0x48
movabs rdx, 0x68743565f99c16cf
mov qword [rsp + 0x19], rdx
movabs rdx, 0x6c3ace68743565f9
mov qword [rsp + 0x1c], rdx
movabs rdx, 0x7aafeeafe6d79917
mov qword [rsp + 0x24], rdx
movabs rdx, 0x50b070c07091010
mov qword [rsp + 0x2c], rdx
movabs rdx, 0x3120f0e0b090802
mov qword [rsp + 0x34], rdx
movabs rdx, 0xb0d080303120f0e
mov qword [rsp + 0x38], rdx
movabs rdx, 0x1105081208010300
mov qword [rsp + 0x40], rdx
xor eax, eax
jmp 0x4b0499
movzx r9d, byte [rsp + rsi + 0x19]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x7a]
mov byte [rsp + rdi + 0x19], dl
mov byte [rsp + rsi + 0x19], r8b
add rax, 2
cmp rax, 0x1c
jge 0x4b04cb
movzx edx, byte [rsp + rax + 0x2c]
movzx esi, byte [rsp + rax + 0x2d]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x13
jae 0x4b04ee
movzx r8d, byte [rsp + rdi + 0x19]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x7a]
cmp rsi, 0x13
jb 0x4b047f
jmp 0x4b04e2
xor eax, eax
lea rbx, [rsp + 0x19]
mov ecx, 0x13
call fcn.0044c140
add rsp, 0x48
pop rbp
ret
mov eax, esi
mov ecx, 0x13
call fcn.00461b40
mov eax, edi
mov ecx, 0x13
call fcn.00461b40
nop
nop dword [rax + rax]
call fcn.0045f8c0
jmp fcn.004b0400

Function at 0x4b0f40
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4b0ffd
push rbp
mov rbp, rsp
sub rsp, 0x30
movabs rdx, 0xe8f28365fa45e866
mov qword [rsp + 0x1d], rdx
mov byte [rsp + 0x25], 0x20
movabs rdx, 0x507030602010002
mov qword [rsp + 0x26], rdx
mov word [rsp + 0x2e], 7
xor eax, eax
nop
jmp 0x4b0fa0
movzx r9d, byte [rsp + rsi + 0x1d]
sub r9d, edx
lea edx, [r9 - 0x7d]
mov byte [rsp + rdi + 0x1d], dl
lea edx, [r8 - 0x7d]
mov byte [rsp + rsi + 0x1d], dl
add rax, 2
nop
cmp rax, 0xa
jge 0x4b0fcd
movzx edx, byte [rsp + rax + 0x26]
movzx esi, byte [rsp + rax + 0x27]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 9
jae 0x4b0ff0
movzx r8d, byte [rsp + rdi + 0x1d]
sub r8d, edx
cmp rsi, 9
jb 0x4b0f82
jmp 0x4b0fe4
xor eax, eax
lea rbx, [rsp + 0x1d]
mov ecx, 9
call fcn.0044c140
add rsp, 0x30
pop rbp
ret
mov eax, esi
mov ecx, 9
call fcn.00461b40
mov eax, edi
mov ecx, 9
call fcn.00461b40
nop
nop dword [rax]
call fcn.0045f8c0
jmp fcn.004b0f40
Function at 0x4b13e0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4b149d
push rbp
mov rbp, rsp
sub rsp, 0x30
movabs rdx, 0x20b0926c93cab1b3
mov qword [rsp + 0x1b], rdx
mov byte [rsp + 0x23], 0x6e
movabs rdx, 0x306060301000302
mov qword [rsp + 0x24], rdx
mov dword [rsp + 0x2c], 0x1010005
xor eax, eax
nop
jmp 0x4b1440
movzx r9d, byte [rsp + rsi + 0x1b]
sub r9d, edx
lea edx, [r9 - 0x1c]
mov byte [rsp + rdi + 0x1b], dl
lea edx, [r8 - 0x1c]
mov byte [rsp + rsi + 0x1b], dl
add rax, 2
nop
cmp rax, 0xc
jge 0x4b146d
movzx edx, byte [rsp + rax + 0x24]
movzx esi, byte [rsp + rax + 0x25]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 9
jae 0x4b1490
movzx r8d, byte [rsp + rdi + 0x1b]
sub r8d, edx
cmp rsi, 9
jb 0x4b1422
jmp 0x4b1484
xor eax, eax
lea rbx, [rsp + 0x1b]
mov ecx, 9
call fcn.0044c140
add rsp, 0x30
pop rbp
ret
mov eax, esi
mov ecx, 9
call fcn.00461b40
mov eax, edi
mov ecx, 9
call fcn.00461b40
nop
nop dword [rax]
call fcn.0045f8c0
jmp fcn.004b13e0

Function at 0x4b42e0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4b43cc
push rbp
mov rbp, rsp
sub rsp, 0x48
movabs rdx, 0xaf73e8696b72b7a2
mov qword [rsp + 0x1f], rdx
movabs rdx, 0x23af73e8696b72b7
mov qword [rsp + 0x20], rdx
movabs rdx, 0x97f3569f96bc75ac
mov qword [rsp + 0x28], rdx
movabs rdx, 0xc100b080f07030a
mov qword [rsp + 0x30], rdx
movabs rdx, 0x10d0e0105010103
mov qword [rsp + 0x38], rdx
movabs rdx, 0x5090700090d0b05
mov qword [rsp + 0x40], rdx
xor eax, eax
jmp 0x4b436a
movzx r9d, byte [rsp + rsi + 0x1f]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x54]
mov byte [rsp + rdi + 0x1f], dl
mov byte [rsp + rsi + 0x1f], r8b
add rax, 2
cmp rax, 0x18
jge 0x4b439c
movzx edx, byte [rsp + rax + 0x30]
movzx esi, byte [rsp + rax + 0x31]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x11
jae 0x4b43bf
movzx r8d, byte [rsp + rdi + 0x1f]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x54]
cmp rsi, 0x11
jb 0x4b4350
jmp 0x4b43b3
xor eax, eax
lea rbx, [rsp + 0x1f]
mov ecx, 0x11
call fcn.0044c140
add rsp, 0x48
pop rbp
ret
mov eax, esi
mov ecx, 0x11
call fcn.00461b40
mov eax, edi
mov ecx, 0x11
call fcn.00461b40
nop
call fcn.0045f8c0
jmp fcn.004b42e0
Function at 0x4b5ac0
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4b5b8a
push rbp
mov rbp, rsp
sub rsp, 0x48
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x58], rax
mov qword [rsp], rax
mov qword [rsp + 8], rbx
mov byte [rsp + 0x10], 0
call fcn.004036c0
xorps xmm15, xmm15
mov r14, qword [0x007b9ae0]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x18], 0xffffffffffffffff
jne 0x4b5b6f
mov rcx, qword [rsp + 0x60]
lea rdx, [rcx + 1]
mov qword [rsp + 0x40], rdx
lea rax, [0x005d7aa0]
xor ebx, ebx
mov rcx, rdx
call fcn.00447fa0
mov rbx, qword [rsp + 0x60]
mov rcx, rax
xor edi, edi
mov rsi, qword [rsp + 0x40]
mov rax, qword [rsp + 0x58]
nop dword [rax]
call fcn.004b7ac0
inc rbx
cmp rcx, rbx
jae 0x4b5b5e
mov edi, 1
lea rsi, [0x005d7aa0]
call fcn.00448080
mov word [rax + rbx*2 - 2], 0
xor edi, edi
xor esi, esi
add rsp, 0x48
pop rbp
ret
xor eax, eax
xor ebx, ebx
mov rcx, rbx
lea rdi, [0x006438e8]
lea rsi, [0x00643578]
add rsp, 0x48
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.0045f8c0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.004b5ac0

Function at 0x4b7660
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4b775b
push rbp
mov rbp, rsp
sub rsp, 0x50
movabs rdx, 0xf7656420d8ac731b
mov qword [rsp + 0x1f], rdx
movabs rdx, 0x201aff6e69f76564
mov qword [rsp + 0x24], rdx
movabs rdx, 0x32f10914975f09ad
mov qword [rsp + 0x2c], rdx
movabs rdx, 0xf0d0d0a1003000d
mov qword [rsp + 0x34], rdx
movabs rdx, 0x10000a0f11120d0b
mov qword [rsp + 0x3c], rdx
movabs rdx, 0xe0f000f10000a0f
mov qword [rsp + 0x40], rdx
movabs rdx, 0x30a0213070b0b00
mov qword [rsp + 0x48], rdx
xor eax, eax
jmp 0x4b76f9
movzx r9d, byte [rsp + rsi + 0x1f]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x4b]
mov byte [rsp + rdi + 0x1f], dl
mov byte [rsp + rsi + 0x1f], r8b
add rax, 2
cmp rax, 0x1c
jge 0x4b772b
movzx edx, byte [rsp + rax + 0x34]
movzx esi, byte [rsp + rax + 0x35]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x15
jae 0x4b774e
movzx r8d, byte [rsp + rdi + 0x1f]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x4b]
cmp rsi, 0x15
jb 0x4b76df
jmp 0x4b7742
xor eax, eax
lea rbx, [rsp + 0x1f]
mov ecx, 0x15
call fcn.0044c140
add rsp, 0x50
pop rbp
ret
mov eax, esi
mov ecx, 0x15
call fcn.00461b40
mov eax, edi
mov ecx, 0x15
call fcn.00461b40
nop
nop dword [rax + rax]
call fcn.0045f8c0
jmp fcn.004b7660
Function at 0x4b79c0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4b7aaa
push rbp
mov rbp, rsp
sub rsp, 0x40
movabs rdx, 0xe311436cc3396e1
mov qword [rsp + 0x18], rdx
movabs rdx, 0x2c90e311436cc33
mov qword [rsp + 0x1a], rdx
movabs rdx, 0x3106df2e37e8d5
mov qword [rsp + 0x22], rdx
movabs rdx, 0xe0301090a0a0a08
mov qword [rsp + 0x2a], rdx
movabs rdx, 0xb0f090f03000e03
mov qword [rsp + 0x30], rdx
movabs rdx, 0x703080b050f050e
mov qword [rsp + 0x38], rdx
xor eax, eax
jmp 0x4b7a4d
movzx r9d, byte [rsp + rsi + 0x18]
sub r9d, edx
lea edx, [r9 + 0x38]
mov byte [rsp + rdi + 0x18], dl
lea edx, [r8 + 0x38]
mov byte [rsp + rsi + 0x18], dl
add rax, 2
cmp rax, 0x16
jge 0x4b7a7a
movzx edx, byte [rsp + rax + 0x2a]
movzx esi, byte [rsp + rax + 0x2b]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x12
jae 0x4b7a9d
movzx r8d, byte [rsp + rdi + 0x18]
sub r8d, edx
cmp rsi, 0x12
jb 0x4b7a30
jmp 0x4b7a91
xor eax, eax
lea rbx, [rsp + 0x18]
mov ecx, 0x12
call fcn.0044c140
add rsp, 0x40
pop rbp
ret
mov eax, esi
mov ecx, 0x12
call fcn.00461b40
mov eax, edi
mov ecx, 0x12
call fcn.00461b40
nop
call fcn.0045f8c0
jmp fcn.004b79c0

Function at 0x4b82c0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4b83aa
push rbp
mov rbp, rsp
sub rsp, 0x48
movabs rdx, 0x779c736572646661
mov qword [rsp + 0x1a], rdx
movabs rdx, 0x52557a3a7061779c
mov qword [rsp + 0x20], rdx
movabs rdx, 0x8e7326377561667a
mov qword [rsp + 0x28], rdx
movabs rdx, 0x7130d0c06091001
mov qword [rsp + 0x30], rdx
movabs rdx, 0xe1512090a0f130b
mov qword [rsp + 0x38], rdx
movabs rdx, 0x120a0f0a13110a09
mov qword [rsp + 0x40], rdx
xor eax, eax
jmp 0x4b834d
movzx r9d, byte [rsp + rsi + 0x1a]
sub r9d, edx
lea edx, [r9 + 0x14]
mov byte [rsp + rdi + 0x1a], dl
lea edx, [r8 + 0x14]
mov byte [rsp + rsi + 0x1a], dl
add rax, 2
cmp rax, 0x18
jge 0x4b837a
movzx edx, byte [rsp + rax + 0x30]
movzx esi, byte [rsp + rax + 0x31]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x16
jae 0x4b839d
movzx r8d, byte [rsp + rdi + 0x1a]
sub r8d, edx
cmp rsi, 0x16
jb 0x4b8330
jmp 0x4b8391
xor eax, eax
lea rbx, [rsp + 0x1a]
mov ecx, 0x16
call fcn.0044c140
add rsp, 0x48
pop rbp
ret
mov eax, esi
mov ecx, 0x16
call fcn.00461b40
mov eax, edi
mov ecx, 0x16
call fcn.00461b40
nop
call fcn.0045f8c0
jmp fcn.004b82c0
Function at 0x4ba9c0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4baae7
push rbp
mov rbp, rsp
sub rsp, 0x68
movabs rdx, 0x8202fef974669a9e
mov qword [rsp + 0x1a], rdx
movabs rdx, 0xd38db937756163a0
mov qword [rsp + 0x22], rdx
movabs rdx, 0x69848b6cd36ec963
mov qword [rsp + 0x2a], rdx
movabs rdx, 0xf77885e77494eb6f
mov qword [rsp + 0x32], rdx
movabs rdx, 0xd040714190e1e1d
mov qword [rsp + 0x3a], rdx
movabs rdx, 0x1f0e071a1f0d151e
mov qword [rsp + 0x42], rdx
movabs rdx, 0x1130f16161b1f0e
mov qword [rsp + 0x48], rdx
movabs rdx, 0x60c050c0d111601
mov qword [rsp + 0x50], rdx
movabs rdx, 0x81c0c0e0511050c
mov qword [rsp + 0x58], rdx
movabs rdx, 0xe1f040608000d00
mov qword [rsp + 0x60], rdx
xor eax, eax
jmp 0x4baa89
movzx r9d, byte [rsp + rsi + 0x1a]
sub r9d, edx
lea edx, [r9 - 6]
mov byte [rsp + rdi + 0x1a], dl
lea edx, [r8 - 6]
mov byte [rsp + rsi + 0x1a], dl
add rax, 2
cmp rax, 0x2e
jge 0x4baab7
movzx edx, byte [rsp + rax + 0x3a]
movzx esi, byte [rsp + rax + 0x3b]
mov edi, edx
xor edx, esi
add edx, eax
nop
cmp rdi, 0x20
jae 0x4baada
movzx r8d, byte [rsp + rdi + 0x1a]
sub r8d, edx
cmp rsi, 0x20
jb 0x4baa6c
jmp 0x4baace
xor eax, eax
lea rbx, [rsp + 0x1a]
mov ecx, 0x20
call fcn.0044c140
add rsp, 0x68
pop rbp
ret
mov eax, esi
mov ecx, 0x20
call fcn.00461b40
mov eax, edi
mov ecx, 0x20
call fcn.00461b40
nop
call fcn.0045f8c0
jmp fcn.004ba9c0

Function at 0x4bd400
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4bd4ec
push rbp
mov rbp, rsp
sub rsp, 0x40
movabs rdx, 0x716f7b7475796e69
mov qword [rsp + 0x1a], rdx
movabs rdx, 0x416f716f7b747579
mov qword [rsp + 0x1c], rdx
movabs rdx, 0x266974626e737475
mov qword [rsp + 0x24], rdx
movabs rdx, 0x208100e05080909
mov qword [rsp + 0x2c], rdx
movabs rdx, 0x11050e090208100e
mov qword [rsp + 0x30], rdx
movabs rdx, 0xc0e0e0e0f070d0d
mov qword [rsp + 0x38], rdx
xor eax, eax
jmp 0x4bd48a
movzx r9d, byte [rsp + rsi + 0x1a]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x15]
mov byte [rsp + rdi + 0x1a], dl
mov byte [rsp + rsi + 0x1a], r8b
add rax, 2
cmp rax, 0x14
jge 0x4bd4bc
movzx edx, byte [rsp + rax + 0x2c]
movzx esi, byte [rsp + rax + 0x2d]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x12
jae 0x4bd4df
movzx r8d, byte [rsp + rdi + 0x1a]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x15]
cmp rsi, 0x12
jb 0x4bd470
jmp 0x4bd4d3
xor eax, eax
lea rbx, [rsp + 0x1a]
mov ecx, 0x12
call fcn.0044c140
add rsp, 0x40
pop rbp
ret
mov eax, esi
mov ecx, 0x12
call fcn.00461b40
mov eax, edi
mov ecx, 0x12
call fcn.00461b40
nop
call fcn.0045f8c0
jmp fcn.004bd400
Function at 0x4bfa80
Capabilities:
Encrypt data using rc4 prga

Disassembly:
lea r12, [rsp - 0x10]
cmp r12, qword [r14 + 0x10]
jbe 0x4bfbf2
push rbp
mov rbp, rsp
sub rsp, 0x88
movabs rdx, 0xe57da16d656ec20c
mov qword [rsp + 0x1b], rdx
movabs rdx, 0xf2c0afce74af67f4
mov qword [rsp + 0x23], rdx
movabs rdx, 0xb8208618206be8f2
mov qword [rsp + 0x2a], rdx
movabs rdx, 0x23ed16b3c94a6f6f
mov qword [rsp + 0x32], rdx
movabs rdx, 0x6cc6e254b8b76873
mov qword [rsp + 0x3a], rdx
movabs rdx, 0xda2569e8b654628f
mov qword [rsp + 0x42], rdx
movabs rdx, 0x7071e0210070624
mov qword [rsp + 0x4a], rdx
movabs rdx, 0x2b001b2d2a130807
mov qword [rsp + 0x52], rdx
movabs rdx, 0xf22191c242e2b00
mov qword [rsp + 0x58], rdx
movabs rdx, 0x71e290d251b1d21
mov qword [rsp + 0x60], rdx
movabs rdx, 0x2e0d191b011a1923
mov qword [rsp + 0x68], rdx
movabs rdx, 0x160e0025251c022b
mov qword [rsp + 0x70], rdx
movabs rdx, 0x2a2e051b290a0c22
mov qword [rsp + 0x78], rdx
movabs rdx, 0x142707220d251421
mov qword [rsp + 0x80], rdx
xor eax, eax
jmp 0x4bfb8d
movzx r9d, byte [rsp + rsi + 0x1b]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x70]
mov byte [rsp + rdi + 0x1b], dl
mov byte [rsp + rsi + 0x1b], r8b
add rax, 2
cmp rax, 0x3e
jge 0x4bfbbf
movzx edx, byte [rsp + rax + 0x4a]
movzx esi, byte [rsp + rax + 0x4b]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x2f
jae 0x4bfbe5
movzx r8d, byte [rsp + rdi + 0x1b]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x70]
cmp rsi, 0x2f
jb 0x4bfb73
jmp 0x4bfbd9
xor eax, eax
lea rbx, [rsp + 0x1b]
mov ecx, 0x2f
call fcn.0044c140
add rsp, 0x88
pop rbp
ret
mov eax, esi
mov ecx, 0x2f
call fcn.00461b40
mov eax, edi
mov ecx, 0x2f
call fcn.00461b40
nop
call fcn.0045f8c0
jmp fcn.004bfa80

Function at 0x4c0ee0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4c0fcc
push rbp
mov rbp, rsp
sub rsp, 0x40
movabs rdx, 0x426f907c74a300c9
mov qword [rsp + 0x18], rdx
movabs rdx, 0xcf92426f907c74a3
mov qword [rsp + 0x1a], rdx
movabs rdx, 0xac657470950374b9
mov qword [rsp + 0x22], rdx
movabs rdx, 0x9050c0c0901
mov qword [rsp + 0x2a], rdx
movabs rdx, 0xc02050d0a020000
mov qword [rsp + 0x30], rdx
movabs rdx, 0x4041102010708
mov qword [rsp + 0x38], rdx
xor eax, eax
jmp 0x4c0f6a
movzx r9d, byte [rsp + rsi + 0x18]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x3f]
mov byte [rsp + rdi + 0x18], dl
mov byte [rsp + rsi + 0x18], r8b
add rax, 2
cmp rax, 0x16
jge 0x4c0f9c
movzx edx, byte [rsp + rax + 0x2a]
movzx esi, byte [rsp + rax + 0x2b]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x12
jae 0x4c0fbf
movzx r8d, byte [rsp + rdi + 0x18]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x3f]
cmp rsi, 0x12
jb 0x4c0f50
jmp 0x4c0fb3
xor eax, eax
lea rbx, [rsp + 0x18]
mov ecx, 0x12
call fcn.0044c140
add rsp, 0x40
pop rbp
ret
mov eax, esi
mov ecx, 0x12
call fcn.00461b40
mov eax, edi
mov ecx, 0x12
call fcn.00461b40
nop
call fcn.0045f8c0
jmp fcn.004c0ee0
Function at 0x4c1d80
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4c1e7d
push rbp
mov rbp, rsp
sub rsp, 0x48
movabs rdx, 0x20b9726fad74fdb2
mov qword [rsp + 0x18], rdx
movabs rdx, 0x72febfc4aaa120b9
mov qword [rsp + 0x1e], rdx
movabs rdx, 0xd06c97eb6af76165
mov qword [rsp + 0x26], rdx
movabs rdx, 0x108101301120312
mov qword [rsp + 0x2e], rdx
movabs rdx, 0x1200110c090808
mov qword [rsp + 0x36], rdx
movabs rdx, 0x306001200110c09
mov qword [rsp + 0x38], rdx
movabs rdx, 0x120b050a09150813
mov qword [rsp + 0x40], rdx
xor eax, eax
jmp 0x4c1e20
movzx r9d, byte [rsp + rsi + 0x18]
sub r9d, edx
lea edx, [r9 - 0x2d]
mov byte [rsp + rdi + 0x18], dl
lea edx, [r8 - 0x2d]
mov byte [rsp + rsi + 0x18], dl
add rax, 2
nop dword [rax]
cmp rax, 0x1a
jge 0x4c1e4d
movzx edx, byte [rsp + rax + 0x2e]
movzx esi, byte [rsp + rax + 0x2f]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x16
jae 0x4c1e70
movzx r8d, byte [rsp + rdi + 0x18]
sub r8d, edx
cmp rsi, 0x16
jb 0x4c1dff
jmp 0x4c1e64
xor eax, eax
lea rbx, [rsp + 0x18]
mov ecx, 0x16
call fcn.0044c140
add rsp, 0x48
pop rbp
ret
mov eax, esi
mov ecx, 0x16
call fcn.00461b40
mov eax, edi
mov ecx, 0x16
call fcn.00461b40
nop
nop dword [rax]
call fcn.0045f8c0
jmp fcn.004c1d80

Function at 0x4c3020
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4c311b
push rbp
mov rbp, rsp
sub rsp, 0x50
movabs rdx, 0x8e7a11206b109d47
mov qword [rsp + 0x1f], rdx
movabs rdx, 0x9c0cf362208e7a11
mov qword [rsp + 0x24], rdx
movabs rdx, 0x7265806576fb7c81
mov qword [rsp + 0x2c], rdx
movabs rdx, 0x60f120b0b020505
mov qword [rsp + 0x34], rdx
movabs rdx, 0xe0d0e000c070107
mov qword [rsp + 0x3c], rdx
movabs rdx, 0x140f120a0e0d0e00
mov qword [rsp + 0x40], rdx
movabs rdx, 0x10e0f0f0b000707
mov qword [rsp + 0x48], rdx
xor eax, eax
jmp 0x4c30b9
movzx r9d, byte [rsp + rsi + 0x1f]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x57]
mov byte [rsp + rdi + 0x1f], dl
mov byte [rsp + rsi + 0x1f], r8b
add rax, 2
cmp rax, 0x1c
jge 0x4c30eb
movzx edx, byte [rsp + rax + 0x34]
movzx esi, byte [rsp + rax + 0x35]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x15
jae 0x4c310e
movzx r8d, byte [rsp + rdi + 0x1f]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x57]
cmp rsi, 0x15
jb 0x4c309f
jmp 0x4c3102
xor eax, eax
lea rbx, [rsp + 0x1f]
mov ecx, 0x15
call fcn.0044c140
add rsp, 0x50
pop rbp
ret
mov eax, esi
mov ecx, 0x15
call fcn.00461b40
mov eax, edi
mov ecx, 0x15
call fcn.00461b40
nop
nop dword [rax + rax]
call fcn.0045f8c0
jmp fcn.004c3020
Function at 0x4c3140
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4c3212
push rbp
mov rbp, rsp
sub rsp, 0x38
movabs rdx, 0x2963647d6d7c706e
mov qword [rsp + 0x19], rdx
movabs rdx, 0x6e6e1d6f79966d29
mov qword [rsp + 0x20], rdx
movabs rdx, 0x704020e010a0907
mov qword [rsp + 0x28], rdx
movabs rdx, 0x60a0c0207040e02
mov qword [rsp + 0x30], rdx
xor eax, eax
jmp 0x4c31ac
movzx r9d, byte [rsp + rsi + 0x19]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x17]
mov byte [rsp + rdi + 0x19], dl
mov byte [rsp + rsi + 0x19], r8b
add rax, 2
cmp rax, 0x10
jge 0x4c31de
movzx edx, byte [rsp + rax + 0x28]
movzx esi, byte [rsp + rax + 0x29]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0xf
jae 0x4c3205
movzx r8d, byte [rsp + rdi + 0x19]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x17]
cmp rsi, 0xf
jb 0x4c3192
jmp 0x4c31f5
xor eax, eax
lea rbx, [rsp + 0x19]
mov ecx, 0xf
call fcn.0044c140
add rsp, 0x38
pop rbp
ret
mov eax, esi
mov ecx, 0xf
nop dword [rax]
call fcn.00461b40
mov eax, edi
mov ecx, 0xf
call fcn.00461b40
nop
call fcn.0045f8c0
jmp fcn.004c3140

Function at 0x4c3500
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4c361a
push rbp
mov rbp, rsp
sub rsp, 0x58
movabs rdx, 0x617306cc6d200e6e
mov qword [rsp + 0x1a], rdx
movabs rdx, 0x13d81c776f0b0a26
mov qword [rsp + 0x22], rdx
movabs rdx, 0xe13b13d81c776f0b
mov qword [rsp + 0x24], rdx
movabs rdx, 0x1630ab15ba021458
mov qword [rsp + 0x2c], rdx
movabs rdx, 0xc1610120815150c
mov qword [rsp + 0x34], rdx
movabs rdx, 0x181004160c161012
mov qword [rsp + 0x38], rdx
movabs rdx, 0x1704181519001115
mov qword [rsp + 0x40], rdx
movabs rdx, 0x161113050a190d0e
mov qword [rsp + 0x48], rdx
movabs rdx, 0x414091716010f08
mov qword [rsp + 0x50], rdx
xor eax, eax
jmp 0x4c35b7
movzx r9d, byte [rsp + rsi + 0x1a]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x31]
mov byte [rsp + rdi + 0x1a], dl
mov byte [rsp + rsi + 0x1a], r8b
add rax, 2
cmp rax, 0x24
jge 0x4c35e9
movzx edx, byte [rsp + rax + 0x34]
movzx esi, byte [rsp + rax + 0x35]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x1a
jae 0x4c360d
movzx r8d, byte [rsp + rdi + 0x1a]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x31]
cmp rsi, 0x1a
jb 0x4c359d
jmp 0x4c3601
xor eax, eax
lea rbx, [rsp + 0x1a]
mov ecx, 0x1a
call fcn.0044c140
add rsp, 0x58
pop rbp
nop
ret
mov eax, esi
mov ecx, 0x1a
call fcn.00461b40
mov eax, edi
mov ecx, 0x1a
call fcn.00461b40
nop
call fcn.0045f8c0
nop
jmp fcn.004c3500
Function at 0x4c3640
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4c375a
push rbp
mov rbp, rsp
sub rsp, 0x60
movabs rdx, 0x204f6e6949636106
mov qword [rsp + 0x1f], rdx
movabs rdx, 0x45e6673ee533730d
mov qword [rsp + 0x27], rdx
movabs rdx, 0x278e6f284845e667
mov qword [rsp + 0x2c], rdx
movabs rdx, 0x4404272574653a3a
mov qword [rsp + 0x34], rdx
movabs rdx, 0xc140b0d06121219
mov qword [rsp + 0x3c], rdx
movabs rdx, 0x130f1a120c140b0d
mov qword [rsp + 0x40], rdx
movabs rdx, 0xd1b1c000a1b0011
mov qword [rsp + 0x48], rdx
movabs rdx, 0x30c061b16140816
mov qword [rsp + 0x50], rdx
movabs rdx, 0x150e06120f151014
mov qword [rsp + 0x58], rdx
xor eax, eax
jmp 0x4c36f7
movzx r9d, byte [rsp + rsi + 0x1f]
lea edx, [r9 + rdx]
lea edx, [rdx - 3]
mov byte [rsp + rdi + 0x1f], dl
mov byte [rsp + rsi + 0x1f], r8b
add rax, 2
cmp rax, 0x24
jge 0x4c3729
movzx edx, byte [rsp + rax + 0x3c]
movzx esi, byte [rsp + rax + 0x3d]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x1d
jae 0x4c374d
movzx r8d, byte [rsp + rdi + 0x1f]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 3]
cmp rsi, 0x1d
jb 0x4c36dd
jmp 0x4c3741
xor eax, eax
lea rbx, [rsp + 0x1f]
mov ecx, 0x1d
call fcn.0044c140
add rsp, 0x60
pop rbp
nop
ret
mov eax, esi
mov ecx, 0x1d
call fcn.00461b40
mov eax, edi
mov ecx, 0x1d
call fcn.00461b40
nop
call fcn.0045f8c0
nop
jmp fcn.004c3640

Function at 0x4c5920
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4c5a28
push rbp
mov rbp, rsp
sub rsp, 0x50
movabs rdx, 0x7e6f6f596683616e
mov qword [rsp + 0x18], rdx
movabs rdx, 0x465796f6959660b
mov qword [rsp + 0x20], rdx
movabs rdx, 0x80470465796f6959
mov qword [rsp + 0x22], rdx
movabs rdx, 0x6a6719776c757c20
mov qword [rsp + 0x2a], rdx
movabs rdx, 0x171014090f170408
mov qword [rsp + 0x32], rdx
movabs rdx, 0x913030a18171008
mov qword [rsp + 0x3a], rdx
movabs rdx, 0x14071514110d0913
mov qword [rsp + 0x40], rdx
movabs rdx, 0xa0c140518191402
mov qword [rsp + 0x48], rdx
xor eax, eax
jmp 0x4c59cb
movzx r9d, byte [rsp + rsi + 0x18]
sub r9d, edx
lea edx, [r9 + 0x21]
mov byte [rsp + rdi + 0x18], dl
lea edx, [r8 + 0x21]
mov byte [rsp + rsi + 0x18], dl
add rax, 2
cmp rax, 0x1e
jge 0x4c59f8
movzx edx, byte [rsp + rax + 0x32]
movzx esi, byte [rsp + rax + 0x33]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x1a
jae 0x4c5a1b
movzx r8d, byte [rsp + rdi + 0x18]
sub r8d, edx
cmp rsi, 0x1a
jb 0x4c59ae
jmp 0x4c5a0f
xor eax, eax
lea rbx, [rsp + 0x18]
mov ecx, 0x1a
call fcn.0044c140
add rsp, 0x50
pop rbp
ret
mov eax, esi
mov ecx, 0x1a
call fcn.00461b40
mov eax, edi
mov ecx, 0x1a
call fcn.00461b40
nop
call fcn.0045f8c0
jmp fcn.004c5920