joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4da680
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4da79d
push rbp
mov rbp, rsp
sub rsp, 0x60
movabs rdx, 0x2b72ea6874276f07
mov qword [rsp + 0x1f], rdx
movabs rdx, 0xd7d1266145210f69
mov qword [rsp + 0x27], rdx
movabs rdx, 0x65db76cb53d7d126
mov qword [rsp + 0x2c], rdx
movabs rdx, 0x6ad9dbbcac6472ca
mov qword [rsp + 0x34], rdx
movabs rdx, 0x12091c130014060f
mov qword [rsp + 0x3c], rdx
movabs rdx, 0x500071312091c13
mov qword [rsp + 0x40], rdx
movabs rdx, 0x71315181b051909
mov qword [rsp + 0x48], rdx
movabs rdx, 0xf07020d19111515
mov qword [rsp + 0x50], rdx
movabs rdx, 0x9191c071a0a0a0e
mov qword [rsp + 0x58], rdx
xor eax, eax
jmp 0x4da740
movzx r9d, byte [rsp + rsi + 0x1f]
sub r9d, edx
lea edx, [r9 + 0x73]
mov byte [rsp + rdi + 0x1f], dl
lea edx, [r8 + 0x73]
mov byte [rsp + rsi + 0x1f], dl
add rax, 2
nop word [rax + rax]
cmp rax, 0x24
jge 0x4da76d
movzx edx, byte [rsp + rax + 0x3c]
movzx esi, byte [rsp + rax + 0x3d]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x1d
jae 0x4da790
movzx r8d, byte [rsp + rdi + 0x1f]
sub r8d, edx
cmp rsi, 0x1d
jb 0x4da71d
jmp 0x4da784
xor eax, eax
lea rbx, [rsp + 0x1f]
mov ecx, 0x1d
call fcn.00441380
add rsp, 0x60
pop rbp
ret
mov eax, esi
mov ecx, 0x1d
call fcn.00451880
mov eax, edi
mov ecx, 0x1d
call fcn.00451880
nop
nop dword [rax]
call fcn.0044f600
jmp fcn.004da680

Function at 0x4daa20
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4dab3a
push rbp
mov rbp, rsp
sub rsp, 0x58
movabs rdx, 0x73fe89610c11a941
mov qword [rsp + 0x1d], rdx
movabs rdx, 0xdfa328530d6eb311
mov qword [rsp + 0x25], rdx
movabs rdx, 0xeddfa328530d6eb3
mov qword [rsp + 0x26], rdx
movabs rdx, 0xae0d3b10fdba7361
mov qword [rsp + 0x2e], rdx
movabs rdx, 0x8020f0d03170508
mov qword [rsp + 0x36], rdx
movabs rdx, 0x160908020f0d0317
mov qword [rsp + 0x38], rdx
movabs rdx, 0x14090f0205181518
mov qword [rsp + 0x40], rdx
movabs rdx, 0x141209030e100b06
mov qword [rsp + 0x48], rdx
movabs rdx, 0x1317120b0806010e
mov qword [rsp + 0x50], rdx
xor eax, eax
jmp 0x4daad7
movzx r9d, byte [rsp + rsi + 0x1d]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x71]
mov byte [rsp + rdi + 0x1d], dl
mov byte [rsp + rsi + 0x1d], r8b
add rax, 2
cmp rax, 0x22
jge 0x4dab09
movzx edx, byte [rsp + rax + 0x36]
movzx esi, byte [rsp + rax + 0x37]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x19
jae 0x4dab2d
movzx r8d, byte [rsp + rdi + 0x1d]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x71]
cmp rsi, 0x19
jb 0x4daabd
jmp 0x4dab21
xor eax, eax
lea rbx, [rsp + 0x1d]
mov ecx, 0x19
call fcn.00441380
add rsp, 0x58
pop rbp
nop
ret
mov eax, esi
mov ecx, 0x19
call fcn.00451880
mov eax, edi
mov ecx, 0x19
call fcn.00451880
nop
call fcn.0044f600
nop
jmp fcn.004daa20
Function at 0x4db280
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4db3ac
push rbp
mov rbp, rsp
sub rsp, 0x60
movabs rdx, 0x7274e457d4ff2ea8
mov qword [rsp + 0x19], rdx
movabs rdx, 0x77dfce9cde5c6d65
mov qword [rsp + 0x21], rdx
movabs rdx, 0xd881b6605177dfce
mov qword [rsp + 0x26], rdx
movabs rdx, 0xe5ac9c64468477fb
mov qword [rsp + 0x2e], rdx
movabs rdx, 0x918161300141b0f
mov qword [rsp + 0x36], rdx
movabs rdx, 0x13041a02141b0205
mov qword [rsp + 0x3e], rdx
movabs rdx, 0x171013041a02141b
mov qword [rsp + 0x40], rdx
movabs rdx, 0x11100e1a16150d19
mov qword [rsp + 0x48], rdx
movabs rdx, 0xb080c0a12031c13
mov qword [rsp + 0x50], rdx
movabs rdx, 0xd0c1b181017090b
mov qword [rsp + 0x58], rdx
xor eax, eax
jmp 0x4db346
movzx r9d, byte [rsp + rsi + 0x19]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x60]
mov byte [rsp + rdi + 0x19], dl
mov byte [rsp + rsi + 0x19], r8b
add rax, 2
cmp rax, 0x2a
jge 0x4db37c
movzx edx, byte [rsp + rax + 0x36]
movzx esi, byte [rsp + rax + 0x37]
mov edi, edx
xor edx, esi
add edx, eax
nop dword [rax]
cmp rdi, 0x1d
jae 0x4db39f
movzx r8d, byte [rsp + rdi + 0x19]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x60]
cmp rsi, 0x1d
jb 0x4db32c
jmp 0x4db393
xor eax, eax
lea rbx, [rsp + 0x19]
mov ecx, 0x1d
call fcn.00441380
add rsp, 0x60
pop rbp
ret
mov eax, esi
mov ecx, 0x1d
call fcn.00451880
mov eax, edi
mov ecx, 0x1d
call fcn.00451880
nop
call fcn.0044f600
jmp fcn.004db280

Function at 0x4dbb60
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4dbc5b
push rbp
mov rbp, rsp
sub rsp, 0x50
movabs rdx, 0x8053716d6e747973
mov qword [rsp + 0x1f], rdx
movabs rdx, 0x6a77611a53805371
mov qword [rsp + 0x24], rdx
movabs rdx, 0x3d725d5460687282
mov qword [rsp + 0x2c], rdx
movabs rdx, 0x120d100c020b0614
mov qword [rsp + 0x34], rdx
movabs rdx, 0x91000130f050f10
mov qword [rsp + 0x3c], rdx
movabs rdx, 0x607121209100013
mov qword [rsp + 0x40], rdx
movabs rdx, 0xc0512131400000b
mov qword [rsp + 0x48], rdx
xor eax, eax
jmp 0x4dbbf9
movzx r9d, byte [rsp + rsi + 0x1f]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x21]
mov byte [rsp + rdi + 0x1f], dl
mov byte [rsp + rsi + 0x1f], r8b
add rax, 2
cmp rax, 0x1c
jge 0x4dbc2b
movzx edx, byte [rsp + rax + 0x34]
movzx esi, byte [rsp + rax + 0x35]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x15
jae 0x4dbc4e
movzx r8d, byte [rsp + rdi + 0x1f]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x21]
cmp rsi, 0x15
jb 0x4dbbdf
jmp 0x4dbc42
xor eax, eax
lea rbx, [rsp + 0x1f]
mov ecx, 0x15
call fcn.00441380
add rsp, 0x50
pop rbp
ret
mov eax, esi
mov ecx, 0x15
call fcn.00451880
mov eax, edi
mov ecx, 0x15
call fcn.00451880
nop
nop dword [rax + rax]
call fcn.0044f600
jmp fcn.004dbb60
Function at 0x4dce80
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4dcf6a
push rbp
mov rbp, rsp
sub rsp, 0x40
movabs rdx, 0x90657df179611f49
mov qword [rsp + 0x18], rdx
movabs rdx, 0x648090657df17961
mov qword [rsp + 0x1a], rdx
movabs rdx, 0x650859fd20e172f8
mov qword [rsp + 0x22], rdx
movabs rdx, 0x5030a010f0f0106
mov qword [rsp + 0x2a], rdx
movabs rdx, 0xf05030606040503
mov qword [rsp + 0x30], rdx
movabs rdx, 0xc0e080e03100307
mov qword [rsp + 0x38], rdx
xor eax, eax
jmp 0x4dcf0d
movzx r9d, byte [rsp + rsi + 0x18]
sub r9d, edx
lea edx, [r9 - 0x77]
mov byte [rsp + rdi + 0x18], dl
lea edx, [r8 - 0x77]
mov byte [rsp + rsi + 0x18], dl
add rax, 2
cmp rax, 0x16
jge 0x4dcf3a
movzx edx, byte [rsp + rax + 0x2a]
movzx esi, byte [rsp + rax + 0x2b]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x12
jae 0x4dcf5d
movzx r8d, byte [rsp + rdi + 0x18]
sub r8d, edx
cmp rsi, 0x12
jb 0x4dcef0
jmp 0x4dcf51
xor eax, eax
lea rbx, [rsp + 0x18]
mov ecx, 0x12
call fcn.00441380
add rsp, 0x40
pop rbp
ret
mov eax, esi
mov ecx, 0x12
call fcn.00451880
mov eax, edi
mov ecx, 0x12
call fcn.00451880
nop
call fcn.0044f600
jmp fcn.004dce80

Function at 0x4de3a0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4de49d
push rbp
mov rbp, rsp
sub rsp, 0x48
movabs rdx, 0x5320414becd87aa9
mov qword [rsp + 0x1a], rdx
movabs rdx, 0x6451b1df5320414b
mov qword [rsp + 0x1e], rdx
movabs rdx, 0x516d4fc020bddfb0
mov qword [rsp + 0x26], rdx
movabs rdx, 0x20511040e0c1310
mov qword [rsp + 0x2e], rdx
movabs rdx, 0x20a090a03080411
mov qword [rsp + 0x36], rdx
movabs rdx, 0x20a090a0308
mov qword [rsp + 0x38], rdx
movabs rdx, 0x902100d020e1008
mov qword [rsp + 0x40], rdx
xor eax, eax
jmp 0x4de440
movzx r9d, byte [rsp + rsi + 0x1a]
sub r9d, edx
lea edx, [r9 - 0x58]
mov byte [rsp + rdi + 0x1a], dl
lea edx, [r8 - 0x58]
mov byte [rsp + rsi + 0x1a], dl
add rax, 2
nop dword [rax]
cmp rax, 0x1a
jge 0x4de46d
movzx edx, byte [rsp + rax + 0x2e]
movzx esi, byte [rsp + rax + 0x2f]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x14
jae 0x4de490
movzx r8d, byte [rsp + rdi + 0x1a]
sub r8d, edx
cmp rsi, 0x14
jb 0x4de41f
jmp 0x4de484
xor eax, eax
lea rbx, [rsp + 0x1a]
mov ecx, 0x14
call fcn.00441380
add rsp, 0x48
pop rbp
ret
mov eax, esi
mov ecx, 0x14
call fcn.00451880
mov eax, edi
mov ecx, 0x14
call fcn.00451880
nop
nop dword [rax]
call fcn.0044f600
jmp fcn.004de3a0
Function at 0x4de860
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4de95d
push rbp
mov rbp, rsp
sub rsp, 0x50
movabs rdx, 0xb11b27c87b177219
mov qword [rsp + 0x19], rdx
movabs rdx, 0xd372e074530e27b1
mov qword [rsp + 0x20], rdx
movabs rdx, 0xca04b00c2020221d
mov qword [rsp + 0x28], rdx
movabs rdx, 0x1615020d07030705
mov qword [rsp + 0x30], rdx
movabs rdx, 0xc07081406110209
mov qword [rsp + 0x38], rdx
movabs rdx, 0xf03050407101508
mov qword [rsp + 0x40], rdx
movabs rdx, 0xf1500130c050e05
mov qword [rsp + 0x48], rdx
xor eax, eax
jmp 0x4de900
movzx r9d, byte [rsp + rsi + 0x19]
sub r9d, edx
lea edx, [r9 + 0x6a]
mov byte [rsp + rdi + 0x19], dl
lea edx, [r8 + 0x6a]
mov byte [rsp + rsi + 0x19], dl
add rax, 2
nop dword [rax]
cmp rax, 0x20
jge 0x4de92d
movzx edx, byte [rsp + rax + 0x30]
movzx esi, byte [rsp + rax + 0x31]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x17
jae 0x4de950
movzx r8d, byte [rsp + rdi + 0x19]
sub r8d, edx
cmp rsi, 0x17
jb 0x4de8df
jmp 0x4de944
xor eax, eax
lea rbx, [rsp + 0x19]
mov ecx, 0x17
call fcn.00441380
add rsp, 0x50
pop rbp
ret
mov eax, esi
mov ecx, 0x17
call fcn.00451880
mov eax, edi
mov ecx, 0x17
call fcn.00451880
nop
nop dword [rax]
call fcn.0044f600
jmp fcn.004de860

Function at 0x4de980
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4dea88
push rbp
mov rbp, rsp
sub rsp, 0x58
movabs rdx, 0xc3fb39224716654b
mov qword [rsp + 0x1c], rdx
movabs rdx, 0x532061fb33297264
mov qword [rsp + 0x24], rdx
movabs rdx, 0x38074564532061fb
mov qword [rsp + 0x28], rdx
movabs rdx, 0x3cf3134b501672fc
mov qword [rsp + 0x30], rdx
movabs rdx, 0x1902130a04140a0c
mov qword [rsp + 0x38], rdx
movabs rdx, 0x3121a0711021605
mov qword [rsp + 0x40], rdx
movabs rdx, 0x14071a1b0b180617
mov qword [rsp + 0x48], rdx
movabs rdx, 0x10080014191b041b
mov qword [rsp + 0x50], rdx
xor eax, eax
jmp 0x4dea2b
movzx r9d, byte [rsp + rsi + 0x1c]
sub r9d, edx
lea edx, [r9 + 0x46]
mov byte [rsp + rdi + 0x1c], dl
lea edx, [r8 + 0x46]
mov byte [rsp + rsi + 0x1c], dl
add rax, 2
cmp rax, 0x20
jge 0x4dea58
movzx edx, byte [rsp + rax + 0x38]
movzx esi, byte [rsp + rax + 0x39]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x1c
jae 0x4dea7b
movzx r8d, byte [rsp + rdi + 0x1c]
sub r8d, edx
cmp rsi, 0x1c
jb 0x4dea0e
jmp 0x4dea6f
xor eax, eax
lea rbx, [rsp + 0x1c]
mov ecx, 0x1c
call fcn.00441380
add rsp, 0x58
pop rbp
ret
mov eax, esi
mov ecx, 0x1c
call fcn.00451880
mov eax, edi
mov ecx, 0x1c
call fcn.00451880
nop
call fcn.0044f600
jmp fcn.004de980
Function at 0x4deaa0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4debac
push rbp
mov rbp, rsp
sub rsp, 0x50
movabs rdx, 0x721073979dfa2efe
mov qword [rsp + 0x1a], rdx
movabs rdx, 0x7b745320f2026c43
mov qword [rsp + 0x22], rdx
movabs rdx, 0x64fd7b745320f202
mov qword [rsp + 0x24], rdx
movabs rdx, 0x6d6d69e7d89e72fe
mov qword [rsp + 0x2c], rdx
movabs rdx, 0x15000b120806100a
mov qword [rsp + 0x34], rdx
movabs rdx, 0x403040b16080f02
mov qword [rsp + 0x3c], rdx
movabs rdx, 0x1915040b0403040b
mov qword [rsp + 0x40], rdx
movabs rdx, 0x140219160615150b
mov qword [rsp + 0x48], rdx
xor eax, eax
jmp 0x4deb48
movzx r9d, byte [rsp + rsi + 0x1a]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x52]
mov byte [rsp + rdi + 0x1a], dl
mov byte [rsp + rsi + 0x1a], r8b
add rax, 2
cmp rax, 0x1c
jge 0x4deb7c
movzx edx, byte [rsp + rax + 0x34]
movzx esi, byte [rsp + rax + 0x35]
mov edi, edx
xor edx, esi
add edx, eax
nop
cmp rdi, 0x1a
jae 0x4deb9f
movzx r8d, byte [rsp + rdi + 0x1a]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x52]
cmp rsi, 0x1a
jb 0x4deb2e
jmp 0x4deb93
xor eax, eax
lea rbx, [rsp + 0x1a]
mov ecx, 0x1a
call fcn.00441380
add rsp, 0x50
pop rbp
ret
mov eax, esi
mov ecx, 0x1a
call fcn.00451880
mov eax, edi
mov ecx, 0x1a
call fcn.00451880
nop
call fcn.0044f600
jmp fcn.004deaa0

Function at 0x4dfbc0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4dfcdd
push rbp
mov rbp, rsp
sub rsp, 0x58
movabs rdx, 0x74ab094920f15517
mov qword [rsp + 0x1d], rdx
movabs rdx, 0xc06161f0206e72f9
mov qword [rsp + 0x25], rdx
movabs rdx, 0xd2c06161f0206e72
mov qword [rsp + 0x26], rdx
movabs rdx, 0x50b85f5cd3dcf361
mov qword [rsp + 0x2e], rdx
movabs rdx, 0x120d05050c180d10
mov qword [rsp + 0x36], rdx
movabs rdx, 0x1715120d05050c18
mov qword [rsp + 0x38], rdx
movabs rdx, 0xc0f161406040600
mov qword [rsp + 0x40], rdx
movabs rdx, 0x1802180806060f14
mov qword [rsp + 0x48], rdx
movabs rdx, 0x514021310121708
mov qword [rsp + 0x50], rdx
xor eax, eax
jmp 0x4dfc80
movzx r9d, byte [rsp + rsi + 0x1d]
sub r9d, edx
lea edx, [r9 - 0x5a]
mov byte [rsp + rdi + 0x1d], dl
lea edx, [r8 - 0x5a]
mov byte [rsp + rsi + 0x1d], dl
add rax, 2
nop word [rax + rax]
cmp rax, 0x22
jge 0x4dfcad
movzx edx, byte [rsp + rax + 0x36]
movzx esi, byte [rsp + rax + 0x37]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x19
jae 0x4dfcd0
movzx r8d, byte [rsp + rdi + 0x1d]
sub r8d, edx
cmp rsi, 0x19
jb 0x4dfc5d
jmp 0x4dfcc4
xor eax, eax
lea rbx, [rsp + 0x1d]
mov ecx, 0x19
call fcn.00441380
add rsp, 0x58
pop rbp
ret
mov eax, esi
mov ecx, 0x19
call fcn.00451880
mov eax, edi
mov ecx, 0x19
call fcn.00451880
nop
nop dword [rax]
call fcn.0044f600
jmp fcn.004dfbc0
Function at 0x4e1140
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4e124c
push rbp
mov rbp, rsp
sub rsp, 0x58
movabs rdx, 0x67bc69f069b7613c
mov qword [rsp + 0x1f], rdx
movabs rdx, 0x85619e53bce01712
mov qword [rsp + 0x27], rdx
movabs rdx, 0xca85619e53bce017
mov qword [rsp + 0x28], rdx
movabs rdx, 0x96cf69de4b64d220
mov qword [rsp + 0x30], rdx
movabs rdx, 0x14040d150d0b120a
mov qword [rsp + 0x38], rdx
movabs rdx, 0xf04150218151408
mov qword [rsp + 0x40], rdx
movabs rdx, 0x1008170202000211
mov qword [rsp + 0x48], rdx
movabs rdx, 0x1402041414091006
mov qword [rsp + 0x50], rdx
xor eax, eax
jmp 0x4e11e8
movzx r9d, byte [rsp + rsi + 0x1f]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x7a]
mov byte [rsp + rdi + 0x1f], dl
mov byte [rsp + rsi + 0x1f], r8b
add rax, 2
cmp rax, 0x20
jge 0x4e121c
movzx edx, byte [rsp + rax + 0x38]
movzx esi, byte [rsp + rax + 0x39]
mov edi, edx
xor edx, esi
add edx, eax
nop
cmp rdi, 0x19
jae 0x4e123f
movzx r8d, byte [rsp + rdi + 0x1f]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x7a]
cmp rsi, 0x19
jb 0x4e11ce
jmp 0x4e1233
xor eax, eax
lea rbx, [rsp + 0x1f]
mov ecx, 0x19
call fcn.00441380
add rsp, 0x58
pop rbp
ret
mov eax, esi
mov ecx, 0x19
call fcn.00451880
mov eax, edi
mov ecx, 0x19
call fcn.00451880
nop
call fcn.0044f600
jmp fcn.004e1140

Function at 0x4e68c0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4e69dd
push rbp
mov rbp, rsp
sub rsp, 0x58
movabs rdx, 0x9af1732f6c93b345
mov qword [rsp + 0x1a], rdx
movabs rdx, 0xff1f59205e802ad4
mov qword [rsp + 0x22], rdx
movabs rdx, 0x6269f3f9ff1f5920
mov qword [rsp + 0x26], rdx
movabs rdx, 0xf420026e747a99f2
mov qword [rsp + 0x2e], rdx
movabs rdx, 0x41417130e0d0b04
mov qword [rsp + 0x36], rdx
movabs rdx, 0x908041417130e0d
mov qword [rsp + 0x38], rdx
movabs rdx, 0xe060d150a1b1704
mov qword [rsp + 0x40], rdx
movabs rdx, 0x100102100d131717
mov qword [rsp + 0x48], rdx
movabs rdx, 0x80f080719111b0b
mov qword [rsp + 0x50], rdx
xor eax, eax
jmp 0x4e6980
movzx r9d, byte [rsp + rsi + 0x1a]
sub r9d, edx
lea edx, [r9 - 0x6a]
mov byte [rsp + rdi + 0x1a], dl
lea edx, [r8 - 0x6a]
mov byte [rsp + rsi + 0x1a], dl
add rax, 2
nop word [rax + rax]
cmp rax, 0x22
jge 0x4e69ad
movzx edx, byte [rsp + rax + 0x36]
movzx esi, byte [rsp + rax + 0x37]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x1c
jae 0x4e69d0
movzx r8d, byte [rsp + rdi + 0x1a]
sub r8d, edx
cmp rsi, 0x1c
jb 0x4e695d
jmp 0x4e69c4
xor eax, eax
lea rbx, [rsp + 0x1a]
mov ecx, 0x1c
call fcn.00441380
add rsp, 0x58
pop rbp
ret
mov eax, esi
mov ecx, 0x1c
call fcn.00451880
mov eax, edi
mov ecx, 0x1c
call fcn.00451880
nop
nop dword [rax]
call fcn.0044f600
jmp fcn.004e68c0
Function at 0x4ecb00
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4ecbcc
push rbp
mov rbp, rsp
sub rsp, 0x38
movabs rdx, 0x8c7061d26ccdce86
mov qword [rsp + 0x1e], rdx
mov dword [rsp + 0x26], 0x90cad227
movabs rdx, 0x4010a0901070008
mov qword [rsp + 0x2a], rdx
movabs rdx, 0xb0004020b080401
mov qword [rsp + 0x30], rdx
xor eax, eax
jmp 0x4ecb65
movzx r9d, byte [rsp + rsi + 0x1e]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x6d]
mov byte [rsp + rdi + 0x1e], dl
mov byte [rsp + rsi + 0x1e], r8b
add rax, 2
cmp rax, 0xe
jge 0x4ecb9c
movzx edx, byte [rsp + rax + 0x2a]
movzx esi, byte [rsp + rax + 0x2b]
mov edi, edx
xor edx, esi
add edx, eax
nop dword [rax + rax]
cmp rdi, 0xc
jae 0x4ecbbf
movzx r8d, byte [rsp + rdi + 0x1e]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x6d]
cmp rsi, 0xc
jb 0x4ecb4b
jmp 0x4ecbb3
xor eax, eax
lea rbx, [rsp + 0x1e]
mov ecx, 0xc
call fcn.00441380
add rsp, 0x38
pop rbp
ret
mov eax, esi
mov ecx, 0xc
call fcn.00451880
mov eax, edi
mov ecx, 0xc
call fcn.00451880
nop
call fcn.0044f600
jmp fcn.004ecb00

Function at 0x4ef500
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4ef60c
push rbp
mov rbp, rsp
sub rsp, 0x58
movabs rdx, 0xdaf342e968f5edfe
mov qword [rsp + 0x1c], rdx
movabs rdx, 0x6951086d726f786e
mov qword [rsp + 0x24], rdx
movabs rdx, 0x795dc7fa6951086d
mov qword [rsp + 0x28], rdx
movabs rdx, 0xf8d10b6cc86e61e6
mov qword [rsp + 0x30], rdx
movabs rdx, 0x100e09000d02071a
mov qword [rsp + 0x38], rdx
movabs rdx, 0xe120010140e1a0e
mov qword [rsp + 0x40], rdx
movabs rdx, 0x1105100e1103191b
mov qword [rsp + 0x48], rdx
movabs rdx, 0xe06040117121a11
mov qword [rsp + 0x50], rdx
xor eax, eax
jmp 0x4ef5a8
movzx r9d, byte [rsp + rsi + 0x1c]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x5b]
mov byte [rsp + rdi + 0x1c], dl
mov byte [rsp + rsi + 0x1c], r8b
add rax, 2
cmp rax, 0x20
jge 0x4ef5dc
movzx edx, byte [rsp + rax + 0x38]
movzx esi, byte [rsp + rax + 0x39]
mov edi, edx
xor edx, esi
add edx, eax
nop
cmp rdi, 0x1c
jae 0x4ef5ff
movzx r8d, byte [rsp + rdi + 0x1c]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x5b]
cmp rsi, 0x1c
jb 0x4ef58e
jmp 0x4ef5f3
xor eax, eax
lea rbx, [rsp + 0x1c]
mov ecx, 0x1c
call fcn.00441380
add rsp, 0x58
pop rbp
ret
mov eax, esi
mov ecx, 0x1c
call fcn.00451880
mov eax, edi
mov ecx, 0x1c
call fcn.00451880
nop
call fcn.0044f600
jmp fcn.004ef500
Function at 0x4ef940
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4efa2c
push rbp
mov rbp, rsp
sub rsp, 0x40
movabs rdx, 0x6cebec6fa80f653c
mov qword [rsp + 0x1a], rdx
movabs rdx, 0x29316cebec6fa80f
mov qword [rsp + 0x1c], rdx
movabs rdx, 0x57a1e5d54e65f469
mov qword [rsp + 0x24], rdx
movabs rdx, 0x10050506030e0f0e
mov qword [rsp + 0x2c], rdx
movabs rdx, 0x2000b0510050506
mov qword [rsp + 0x30], rdx
movabs rdx, 0xf0905060e06080b
mov qword [rsp + 0x38], rdx
xor eax, eax
jmp 0x4ef9ca
movzx r9d, byte [rsp + rsi + 0x1a]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x2c]
mov byte [rsp + rdi + 0x1a], dl
mov byte [rsp + rsi + 0x1a], r8b
add rax, 2
cmp rax, 0x14
jge 0x4ef9fc
movzx edx, byte [rsp + rax + 0x2c]
movzx esi, byte [rsp + rax + 0x2d]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x12
jae 0x4efa1f
movzx r8d, byte [rsp + rdi + 0x1a]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x2c]
cmp rsi, 0x12
jb 0x4ef9b0
jmp 0x4efa13
xor eax, eax
lea rbx, [rsp + 0x1a]
mov ecx, 0x12
call fcn.00441380
add rsp, 0x40
pop rbp
ret
mov eax, esi
mov ecx, 0x12
call fcn.00451880
mov eax, edi
mov ecx, 0x12
call fcn.00451880
nop
call fcn.0044f600
jmp fcn.004ef940

Function at 0x4f0900
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4f09c7
push rbp
mov rbp, rsp
sub rsp, 0x38
movabs rdx, 0xae4607639b9c0075
mov qword [rsp + 0x1c], rdx
mov dword [rsp + 0x24], 0x40b296c
movabs rdx, 0x9010b070002030b
mov qword [rsp + 0x28], rdx
movabs rdx, 0x50b0b020a0501
mov qword [rsp + 0x30], rdx
xor eax, eax
jmp 0x4f0968
movzx r9d, byte [rsp + rsi + 0x1c]
sub r9d, edx
lea edx, [r9 + 0x73]
mov byte [rsp + rdi + 0x1c], dl
lea edx, [r8 + 0x73]
mov byte [rsp + rsi + 0x1c], dl
add rax, 2
cmp rax, 0x10
jge 0x4f0997
movzx edx, byte [rsp + rax + 0x28]
movzx esi, byte [rsp + rax + 0x29]
mov edi, edx
xor edx, esi
add edx, eax
nop
cmp rdi, 0xc
jae 0x4f09ba
movzx r8d, byte [rsp + rdi + 0x1c]
sub r8d, edx
cmp rsi, 0xc
jb 0x4f094b
jmp 0x4f09ae
xor eax, eax
lea rbx, [rsp + 0x1c]
mov ecx, 0xc
call fcn.00441380
add rsp, 0x38
pop rbp
ret
mov eax, esi
mov ecx, 0xc
call fcn.00451880
mov eax, edi
mov ecx, 0xc
call fcn.00451880
nop
call fcn.0044f600
jmp fcn.004f0900
Function at 0x4f0d20
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4f0e1b
push rbp
mov rbp, rsp
sub rsp, 0x48
movabs rdx, 0x6822651ef82c7243
mov qword [rsp + 0x18], rdx
movabs rdx, 0xd16e6f72eaa96822
mov qword [rsp + 0x1e], rdx
movabs rdx, 0x3d0e6fc26d0f6ec7
mov qword [rsp + 0x26], rdx
movabs rdx, 0xd0e041215060302
mov qword [rsp + 0x2e], rdx
movabs rdx, 0x908091106110207
mov qword [rsp + 0x36], rdx
movabs rdx, 0x210090809110611
mov qword [rsp + 0x38], rdx
movabs rdx, 0x90406090e10140d
mov qword [rsp + 0x40], rdx
xor eax, eax
jmp 0x4f0db9
movzx r9d, byte [rsp + rsi + 0x18]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x34]
mov byte [rsp + rdi + 0x18], dl
mov byte [rsp + rsi + 0x18], r8b
add rax, 2
cmp rax, 0x1a
jge 0x4f0deb
movzx edx, byte [rsp + rax + 0x2e]
movzx esi, byte [rsp + rax + 0x2f]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x16
jae 0x4f0e0e
movzx r8d, byte [rsp + rdi + 0x18]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x34]
cmp rsi, 0x16
jb 0x4f0d9f
jmp 0x4f0e02
xor eax, eax
lea rbx, [rsp + 0x18]
mov ecx, 0x16
call fcn.00441380
add rsp, 0x48
pop rbp
ret
mov eax, esi
mov ecx, 0x16
call fcn.00451880
mov eax, edi
mov ecx, 0x16
call fcn.00451880
nop
nop dword [rax + rax]
call fcn.0044f600
jmp fcn.004f0d20

Function at 0x4f69c0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4f6aa6
push rbp
mov rbp, rsp
sub rsp, 0x38
movabs rdx, 0x7a68b0a4ab72ac31
mov qword [rsp + 0x19], rdx
movabs rdx, 0xa93abeab3c7a68b0
mov qword [rsp + 0x1e], rdx
movabs rdx, 0x3080507000a0807
mov qword [rsp + 0x26], rdx
movabs rdx, 0xa0403080507000a
mov qword [rsp + 0x28], rdx
movabs rdx, 0x901040501030c08
mov qword [rsp + 0x30], rdx
xor eax, eax
nop
jmp 0x4f6a40
movzx r9d, byte [rsp + rsi + 0x19]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x55]
mov byte [rsp + rdi + 0x19], dl
mov byte [rsp + rsi + 0x19], r8b
add rax, 2
nop dword [rax]
cmp rax, 0x12
jge 0x4f6a72
movzx edx, byte [rsp + rax + 0x26]
movzx esi, byte [rsp + rax + 0x27]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0xd
jae 0x4f6a97
movzx r8d, byte [rsp + rdi + 0x19]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x55]
cmp rsi, 0xd
jb 0x4f6a22
jmp 0x4f6a8b
xor eax, eax
lea rbx, [rsp + 0x19]
mov ecx, 0xd
nop
call fcn.00441380
add rsp, 0x38
pop rbp
ret
mov eax, esi
mov ecx, 0xd
call fcn.00451880
mov eax, edi
mov ecx, 0xd
nop
call fcn.00451880
nop
call fcn.0044f600
jmp fcn.004f69c0
Function at 0x4f7240
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4f7306
push rbp
mov rbp, rsp
sub rsp, 0x30
movabs rdx, 0x6d60736764695c75
mov qword [rsp + 0x1a], rdx
mov word [rsp + 0x22], 0x6b68
movabs rdx, 0x706040709070608
mov qword [rsp + 0x24], rdx
mov dword [rsp + 0x2c], 0x1050305
xor eax, eax
jmp 0x4f72a0
movzx r9d, byte [rsp + rsi + 0x1a]
lea edx, [r9 + rdx]
lea edx, [rdx - 9]
mov byte [rsp + rdi + 0x1a], dl
mov byte [rsp + rsi + 0x1a], r8b
add rax, 2
nop dword [rax]
cmp rax, 0xc
jge 0x4f72d2
movzx edx, byte [rsp + rax + 0x24]
movzx esi, byte [rsp + rax + 0x25]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0xa
jae 0x4f72f7
movzx r8d, byte [rsp + rdi + 0x1a]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 9]
cmp rsi, 0xa
jb 0x4f7283
jmp 0x4f72eb
xor eax, eax
lea rbx, [rsp + 0x1a]
mov ecx, 0xa
nop
call fcn.00441380
add rsp, 0x30
pop rbp
ret
mov eax, esi
mov ecx, 0xa
call fcn.00451880
mov eax, edi
mov ecx, 0xa
nop
call fcn.00451880
nop
call fcn.0044f600
jmp fcn.004f7240