joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4df6e0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4df7dc
sub rsp, 0x50
mov qword [rsp + 0x48], rbp
lea rbp, [rsp + 0x48]
movabs rdx, 0x74b5c382798dc04c
mov qword [rsp + 0x1d], rdx
movabs rdx, 0x64b3b574b5c38279
mov qword [rsp + 0x20], rdx
movabs rdx, 0x596de58ed0fc96bf
mov qword [rsp + 0x28], rdx
movabs rdx, 0x8020f100d0b0504
mov qword [rsp + 0x30], rdx
movabs rdx, 0x120e0101080f100f
mov qword [rsp + 0x38], rdx
movabs rdx, 0xc06120b0b0f0809
mov qword [rsp + 0x40], rdx
xor eax, eax
jmp 0x4df770
movzx r9d, byte [rsp + rsi + 0x1d]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x63]
mov byte [rsp + rdi + 0x1d], dl
mov byte [rsp + rsi + 0x1d], r8b
add rax, 2
cmp rax, 0x18
jge 0x4df7a8
movzx edx, byte [rsp + rax + 0x30]
movzx esi, byte [rsp + rax + 0x31]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x13
jae 0x4df7cf
movzx r8d, byte [rsp + rdi + 0x1d]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x63]
nop word [rax + rax]
cmp rsi, 0x13
jb 0x4df756
jmp 0x4df7c3
xor eax, eax
lea rbx, [rsp + 0x1d]
mov ecx, 0x13
call fcn.004418e0
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
mov eax, esi
mov ecx, 0x13
call fcn.00453440
mov eax, edi
mov ecx, 0x13
call fcn.00453440
nop
nop dword [rax]
call fcn.00450de0
jmp fcn.004df6e0

Function at 0x4e0440
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4e0548
sub rsp, 0x58
mov qword [rsp + 0x50], rbp
lea rbp, [rsp + 0x50]
movabs rdx, 0x6969636150204153
mov qword [rsp + 0x1e], rdx
movabs rdx, 0x666b6168636b634c
mov qword [rsp + 0x26], rdx
movabs rdx, 0xf74a2d1f704b3f5f
mov qword [rsp + 0x2e], rdx
movabs rdx, 0x12161215110a1408
mov qword [rsp + 0x36], rdx
movabs rdx, 0xc07170c100f0e10
mov qword [rsp + 0x3e], rdx
movabs rdx, 0x8130c07170c100f
mov qword [rsp + 0x40], rdx
movabs rdx, 0x15160a0b0b0e070e
mov qword [rsp + 0x48], rdx
xor eax, eax
jmp 0x4e04e2
movzx r9d, byte [rsp + rsi + 0x1e]
sub r9d, edx
lea edx, [r9 + 0x24]
mov byte [rsp + rdi + 0x1e], dl
lea edx, [r8 + 0x24]
mov byte [rsp + rsi + 0x1e], dl
add rax, 2
cmp rax, 0x1a
jge 0x4e050f
movzx edx, byte [rsp + rax + 0x36]
movzx esi, byte [rsp + rax + 0x37]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x18
jae 0x4e053b
movzx r8d, byte [rsp + rdi + 0x1e]
sub r8d, edx
cmp rsi, 0x18
jb 0x4e04c5
jmp 0x4e052f
xor eax, eax
lea rbx, [rsp + 0x1e]
mov ecx, 0x18
nop dword [rax + rax]
call fcn.004418e0
mov rbp, qword [rsp + 0x50]
add rsp, 0x58
ret
mov eax, esi
mov ecx, 0x18
call fcn.00453440
mov eax, edi
mov ecx, 0x18
call fcn.00453440
nop
call fcn.00450de0
jmp fcn.004e0440
Function at 0x4e3040
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4e3148
sub rsp, 0x58
mov qword [rsp + 0x50], rbp
lea rbp, [rsp + 0x50]
movabs rdx, 0x6469c5c2c86ecde1
mov qword [rsp + 0x1a], rdx
movabs rdx, 0x58b8e24fd02093cc
mov qword [rsp + 0x22], rdx
movabs rdx, 0x65c5da22e2f97235
mov qword [rsp + 0x2a], rdx
movabs rdx, 0x9130103140f140e
mov qword [rsp + 0x32], rdx
movabs rdx, 0x150d04050b0e0f10
mov qword [rsp + 0x3a], rdx
movabs rdx, 0x120c0805080f150d
mov qword [rsp + 0x40], rdx
movabs rdx, 0x1416050800120f14
mov qword [rsp + 0x48], rdx
xor eax, eax
jmp 0x4e30e2
movzx r9d, byte [rsp + rsi + 0x1a]
sub r9d, edx
lea edx, [r9 - 0x53]
mov byte [rsp + rdi + 0x1a], dl
lea edx, [r8 - 0x53]
mov byte [rsp + rsi + 0x1a], dl
add rax, 2
cmp rax, 0x1e
jge 0x4e310f
movzx edx, byte [rsp + rax + 0x32]
movzx esi, byte [rsp + rax + 0x33]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x18
jae 0x4e313b
movzx r8d, byte [rsp + rdi + 0x1a]
sub r8d, edx
cmp rsi, 0x18
jb 0x4e30c5
jmp 0x4e312f
xor eax, eax
lea rbx, [rsp + 0x1a]
mov ecx, 0x18
nop dword [rax + rax]
call fcn.004418e0
mov rbp, qword [rsp + 0x50]
add rsp, 0x58
ret
mov eax, esi
mov ecx, 0x18
call fcn.00453440
mov eax, edi
mov ecx, 0x18
call fcn.00453440
nop
call fcn.00450de0
jmp fcn.004e3040

Function at 0x4e4320
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4e4436
sub rsp, 0x60
mov qword [rsp + 0x58], rbp
lea rbp, [rsp + 0x58]
movabs rdx, 0xfd221b6fb1059b3a
mov qword [rsp + 0x1e], rdx
movabs rdx, 0x61c3edf718b88d6c
mov qword [rsp + 0x26], rdx
movabs rdx, 0x166e61c3edf718b8
mov qword [rsp + 0x28], rdx
movabs rdx, 0x56d69f612a27283
mov qword [rsp + 0x30], rdx
movabs rdx, 0x160901011211000a
mov qword [rsp + 0x38], rdx
movabs rdx, 0xe0a191406051511
mov qword [rsp + 0x40], rdx
movabs rdx, 0x1190a190116020b
mov qword [rsp + 0x48], rdx
movabs rdx, 0x190d07010c030e00
mov qword [rsp + 0x50], rdx
xor eax, eax
jmp 0x4e43ce
movzx r9d, byte [rsp + rsi + 0x1e]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x46]
mov byte [rsp + rdi + 0x1e], dl
mov byte [rsp + rsi + 0x1e], r8b
add rax, 2
cmp rax, 0x20
jge 0x4e4402
movzx edx, byte [rsp + rax + 0x38]
movzx esi, byte [rsp + rax + 0x39]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x1a
jae 0x4e4429
movzx r8d, byte [rsp + rdi + 0x1e]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x46]
cmp rsi, 0x1a
jb 0x4e43b4
nop
jmp 0x4e441d
xor eax, eax
lea rbx, [rsp + 0x1e]
mov ecx, 0x1a
call fcn.004418e0
mov rbp, qword [rsp + 0x58]
add rsp, 0x60
ret
mov eax, esi
mov ecx, 0x1a
call fcn.00453440
mov eax, edi
mov ecx, 0x1a
call fcn.00453440
nop
call fcn.00450de0
nop dword [rax + rax]
jmp fcn.004e4320
Function at 0x4e45a0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4e469c
sub rsp, 0x48
mov qword [rsp + 0x40], rbp
lea rbp, [rsp + 0x40]
movabs rdx, 0xefc8f33c6f6b0659
mov qword [rsp + 0x19], rdx
movabs rdx, 0xf9ff90efc8f33c6f
mov qword [rsp + 0x1c], rdx
movabs rdx, 0xf27f697ee6640961
mov qword [rsp + 0x24], rdx
movabs rdx, 0x91109080c010f07
mov qword [rsp + 0x2c], rdx
movabs rdx, 0x904060e09110908
mov qword [rsp + 0x30], rdx
movabs rdx, 0x90512070a0a0e09
mov qword [rsp + 0x38], rdx
xor eax, eax
jmp 0x4e4630
movzx r9d, byte [rsp + rsi + 0x19]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x5d]
mov byte [rsp + rdi + 0x19], dl
mov byte [rsp + rsi + 0x19], r8b
add rax, 2
cmp rax, 0x14
jge 0x4e4668
movzx edx, byte [rsp + rax + 0x2c]
movzx esi, byte [rsp + rax + 0x2d]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x13
jae 0x4e468f
movzx r8d, byte [rsp + rdi + 0x19]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x5d]
nop word [rax + rax]
cmp rsi, 0x13
jb 0x4e4616
jmp 0x4e4683
xor eax, eax
lea rbx, [rsp + 0x19]
mov ecx, 0x13
call fcn.004418e0
mov rbp, qword [rsp + 0x40]
add rsp, 0x48
ret
mov eax, esi
mov ecx, 0x13
call fcn.00453440
mov eax, edi
mov ecx, 0x13
call fcn.00453440
nop
nop dword [rax]
call fcn.00450de0
jmp fcn.004e45a0

Function at 0x4e5cc0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4e5dc8
sub rsp, 0x58
mov qword [rsp + 0x50], rbp
lea rbp, [rsp + 0x50]
movabs rdx, 0x856e8e8fce0d7241
mov qword [rsp + 0x1d], rdx
movabs rdx, 0xcf1c0b7452856e8e
mov qword [rsp + 0x22], rdx
movabs rdx, 0xb0a6965476fd12d6
mov qword [rsp + 0x2a], rdx
movabs rdx, 0x3100c0d1408070d
mov qword [rsp + 0x32], rdx
movabs rdx, 0xc14020d0e030404
mov qword [rsp + 0x3a], rdx
movabs rdx, 0x407130813050c14
mov qword [rsp + 0x40], rdx
movabs rdx, 0x50f0a0c0b0e0f12
mov qword [rsp + 0x48], rdx
xor eax, eax
jmp 0x4e5d60
movzx r9d, byte [rsp + rsi + 0x1d]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x39]
mov byte [rsp + rdi + 0x1d], dl
mov byte [rsp + rsi + 0x1d], r8b
add rax, 2
nop
cmp rax, 0x1e
jge 0x4e5d92
movzx edx, byte [rsp + rax + 0x32]
movzx esi, byte [rsp + rax + 0x33]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x15
jae 0x4e5dbb
movzx r8d, byte [rsp + rdi + 0x1d]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x39]
cmp rsi, 0x15
jb 0x4e5d45
jmp 0x4e5daf
xor eax, eax
lea rbx, [rsp + 0x1d]
mov ecx, 0x15
nop
call fcn.004418e0
mov rbp, qword [rsp + 0x50]
add rsp, 0x58
ret
mov eax, esi
mov ecx, 0x15
call fcn.00453440
mov eax, edi
mov ecx, 0x15
call fcn.00453440
nop
call fcn.00450de0
jmp fcn.004e5cc0
Function at 0x4e6920
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4e6a32
sub rsp, 0x58
mov qword [rsp + 0x50], rbp
lea rbp, [rsp + 0x50]
movabs rdx, 0xaafc9761ce8c0c0c
mov qword [rsp + 0x1b], rdx
movabs rdx, 0xd157452200e1174
mov qword [rsp + 0x23], rdx
movabs rdx, 0xbc0d157452200e11
mov qword [rsp + 0x24], rdx
movabs rdx, 0x1609e4a9f01372a8
mov qword [rsp + 0x2c], rdx
movabs rdx, 0x605111515020c14
mov qword [rsp + 0x34], rdx
movabs rdx, 0x107180f170e1600
mov qword [rsp + 0x3c], rdx
movabs rdx, 0x140302100107180f
mov qword [rsp + 0x40], rdx
movabs rdx, 0x20a031513010609
mov qword [rsp + 0x48], rdx
xor eax, eax
jmp 0x4e69d1
movzx r9d, byte [rsp + rsi + 0x1b]
sub r9d, edx
lea edx, [r9 + 0x7b]
mov byte [rsp + rdi + 0x1b], dl
lea edx, [r8 + 0x7b]
mov byte [rsp + rsi + 0x1b], dl
add rax, 2
cmp rax, 0x1c
jge 0x4e69fe
movzx edx, byte [rsp + rax + 0x34]
movzx esi, byte [rsp + rax + 0x35]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x19
jae 0x4e6a25
movzx r8d, byte [rsp + rdi + 0x1b]
sub r8d, edx
cmp rsi, 0x19
jb 0x4e69b4
jmp 0x4e6a19
xor eax, eax
lea rbx, [rsp + 0x1b]
mov ecx, 0x19
call fcn.004418e0
mov rbp, qword [rsp + 0x50]
add rsp, 0x58
ret
mov eax, esi
mov ecx, 0x19
call fcn.00453440
mov eax, edi
mov ecx, 0x19
call fcn.00453440
nop
call fcn.00450de0
jmp fcn.004e6920

Function at 0x4e7020
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4e711c
sub rsp, 0x50
mov qword [rsp + 0x48], rbp
lea rbp, [rsp + 0x48]
movabs rdx, 0x74644a7461521b7e
mov qword [rsp + 0x1f], rdx
movabs rdx, 0x494f6174644a7461
mov qword [rsp + 0x22], rdx
movabs rdx, 0x6466695420647261
mov qword [rsp + 0x2a], rdx
movabs rdx, 0x12000100110d1201
mov qword [rsp + 0x32], rdx
movabs rdx, 0xa120d0604041200
mov qword [rsp + 0x38], rdx
movabs rdx, 0x5020612090401
mov qword [rsp + 0x40], rdx
xor eax, eax
jmp 0x4e70b0
movzx r9d, byte [rsp + rsi + 0x1f]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x15]
mov byte [rsp + rdi + 0x1f], dl
mov byte [rsp + rsi + 0x1f], r8b
add rax, 2
cmp rax, 0x16
jge 0x4e70e8
movzx edx, byte [rsp + rax + 0x32]
movzx esi, byte [rsp + rax + 0x33]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x13
jae 0x4e710f
movzx r8d, byte [rsp + rdi + 0x1f]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x15]
nop word [rax + rax]
cmp rsi, 0x13
jb 0x4e7096
jmp 0x4e7103
xor eax, eax
lea rbx, [rsp + 0x1f]
mov ecx, 0x13
call fcn.004418e0
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
mov eax, esi
mov ecx, 0x13
call fcn.00453440
mov eax, edi
mov ecx, 0x13
call fcn.00453440
nop
nop dword [rax]
call fcn.00450de0
jmp fcn.004e7020
Function at 0x4e7540
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4e7656
sub rsp, 0x58
mov qword [rsp + 0x50], rbp
lea rbp, [rsp + 0x50]
movabs rdx, 0xbb4bb568beaf6f4e
mov qword [rsp + 0x1d], rdx
movabs rdx, 0x6e61325315659f95
mov qword [rsp + 0x25], rdx
movabs rdx, 0x456e61325315659f
mov qword [rsp + 0x26], rdx
movabs rdx, 0xa96d9eab81649c61
mov qword [rsp + 0x2e], rdx
movabs rdx, 0x2070b0d09121009
mov qword [rsp + 0x36], rdx
movabs rdx, 0xa0b050716080b0d
mov qword [rsp + 0x3e], rdx
movabs rdx, 0x18180a0b05071608
mov qword [rsp + 0x40], rdx
movabs rdx, 0xd030a1412151203
mov qword [rsp + 0x48], rdx
xor eax, eax
jmp 0x4e75ee
movzx r9d, byte [rsp + rsi + 0x1d]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x54]
mov byte [rsp + rdi + 0x1d], dl
mov byte [rsp + rsi + 0x1d], r8b
add rax, 2
cmp rax, 0x1a
jge 0x4e7622
movzx edx, byte [rsp + rax + 0x36]
movzx esi, byte [rsp + rax + 0x37]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x19
jae 0x4e7649
movzx r8d, byte [rsp + rdi + 0x1d]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x54]
cmp rsi, 0x19
jb 0x4e75d4
nop
jmp 0x4e763d
xor eax, eax
lea rbx, [rsp + 0x1d]
mov ecx, 0x19
call fcn.004418e0
mov rbp, qword [rsp + 0x50]
add rsp, 0x58
ret
mov eax, esi
mov ecx, 0x19
call fcn.00453440
mov eax, edi
mov ecx, 0x19
call fcn.00453440
nop
call fcn.00450de0
nop dword [rax + rax]
jmp fcn.004e7540

Function at 0x4e8300
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4e83f6
sub rsp, 0x50
mov qword [rsp + 0x48], rbp
lea rbp, [rsp + 0x48]
movabs rdx, 0x7c7b20a6b39f6843
mov qword [rsp + 0x1f], rdx
movabs rdx, 0x8170997c7b20a6b3
mov qword [rsp + 0x22], rdx
movabs rdx, 0x809ca5542064b161
mov qword [rsp + 0x2a], rdx
movabs rdx, 0xa12020c10080906
mov qword [rsp + 0x32], rdx
movabs rdx, 0x100c100302100a12
mov qword [rsp + 0x38], rdx
movabs rdx, 0x1107060607040807
mov qword [rsp + 0x40], rdx
xor eax, eax
jmp 0x4e8393
movzx r9d, byte [rsp + rsi + 0x1f]
sub r9d, edx
lea edx, [r9 + 2]
mov byte [rsp + rdi + 0x1f], dl
lea edx, [r8 + 2]
mov byte [rsp + rsi + 0x1f], dl
add rax, 2
cmp rax, 0x16
jge 0x4e83c2
movzx edx, byte [rsp + rax + 0x32]
movzx esi, byte [rsp + rax + 0x33]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x13
jae 0x4e83e9
movzx r8d, byte [rsp + rdi + 0x1f]
sub r8d, edx
cmp rsi, 0x13
jb 0x4e8376
nop
jmp 0x4e83dd
xor eax, eax
lea rbx, [rsp + 0x1f]
mov ecx, 0x13
call fcn.004418e0
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
mov eax, esi
mov ecx, 0x13
call fcn.00453440
mov eax, edi
mov ecx, 0x13
call fcn.00453440
nop
call fcn.00450de0
nop dword [rax + rax]
jmp fcn.004e8300
Function at 0x4e8740
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4e883c
sub rsp, 0x50
mov qword [rsp + 0x48], rbp
lea rbp, [rsp + 0x48]
movabs rdx, 0x5320be4b9569159d
mov qword [rsp + 0x1e], rdx
movabs rdx, 0xd1ccafe45320be4b
mov qword [rsp + 0x22], rdx
movabs rdx, 0x656d8a54c494729c
mov qword [rsp + 0x2a], rdx
movabs rdx, 0x3110b11010e0b01
mov qword [rsp + 0x32], rdx
movabs rdx, 0x50f0a0f09080311
mov qword [rsp + 0x38], rdx
movabs rdx, 0x30009030a0c040f
mov qword [rsp + 0x40], rdx
xor eax, eax
jmp 0x4e87d0
movzx r9d, byte [rsp + rsi + 0x1e]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x44]
mov byte [rsp + rdi + 0x1e], dl
mov byte [rsp + rsi + 0x1e], r8b
add rax, 2
cmp rax, 0x16
jge 0x4e8808
movzx edx, byte [rsp + rax + 0x32]
movzx esi, byte [rsp + rax + 0x33]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x14
jae 0x4e882f
movzx r8d, byte [rsp + rdi + 0x1e]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x44]
nop word [rax + rax]
cmp rsi, 0x14
jb 0x4e87b6
jmp 0x4e8823
xor eax, eax
lea rbx, [rsp + 0x1e]
mov ecx, 0x14
call fcn.004418e0
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
mov eax, esi
mov ecx, 0x14
call fcn.00453440
mov eax, edi
mov ecx, 0x14
call fcn.00453440
nop
nop dword [rax]
call fcn.00450de0
jmp fcn.004e8740

Function at 0x4e9c00
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4e9d16
sub rsp, 0x58
mov qword [rsp + 0x50], rbp
lea rbp, [rsp + 0x50]
movabs rdx, 0xc754120f6b87807
mov qword [rsp + 0x34], rdx
movabs rdx, 0x5320a503cf6172ff
mov qword [rsp + 0x3c], rdx
movabs rdx, 0x640158745320a503
mov qword [rsp + 0x40], rdx
movabs rdx, 0x536d0aacd25f7261
mov qword [rsp + 0x48], rdx
movabs rdx, 0x30d160711020318
mov qword [rsp + 0x18], rdx
movabs rdx, 0x11207170717111b
mov qword [rsp + 0x20], rdx
movabs rdx, 0x1200110301120717
mov qword [rsp + 0x24], rdx
movabs rdx, 0x20c170219080b03
mov qword [rsp + 0x2c], rdx
xor eax, eax
jmp 0x4e9cae
movzx r9d, byte [rsp + rsi + 0x34]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x43]
mov byte [rsp + rdi + 0x34], dl
mov byte [rsp + rsi + 0x34], r8b
add rax, 2
cmp rax, 0x1c
jge 0x4e9ce2
movzx edx, byte [rsp + rax + 0x18]
movzx esi, byte [rsp + rax + 0x19]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x1c
jae 0x4e9d09
movzx r8d, byte [rsp + rdi + 0x34]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x43]
cmp rsi, 0x1c
jb 0x4e9c94
nop
jmp 0x4e9cfd
xor eax, eax
lea rbx, [rsp + 0x34]
mov ecx, 0x1c
call fcn.004418e0
mov rbp, qword [rsp + 0x50]
add rsp, 0x58
ret
mov eax, esi
mov ecx, 0x1c
call fcn.00453440
mov eax, edi
mov ecx, 0x1c
call fcn.00453440
nop
call fcn.00450de0
nop dword [rax + rax]
jmp fcn.004e9c00
Function at 0x4ec220
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4ec31c
sub rsp, 0x50
mov qword [rsp + 0x48], rbp
lea rbp, [rsp + 0x48]
movabs rdx, 0x538c79e2522e3140
mov qword [rsp + 0x1c], rdx
movabs rdx, 0x426eedd2538c79e2
mov qword [rsp + 0x20], rdx
movabs rdx, 0x656db4be20ae3cd2
mov qword [rsp + 0x28], rdx
movabs rdx, 0xd00030401090c01
mov qword [rsp + 0x30], rdx
movabs rdx, 0xb0004040e100b02
mov qword [rsp + 0x38], rdx
movabs rdx, 0x6060d020c110809
mov qword [rsp + 0x40], rdx
xor eax, eax
jmp 0x4ec2b0
movzx r9d, byte [rsp + rsi + 0x1c]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x7e]
mov byte [rsp + rdi + 0x1c], dl
mov byte [rsp + rsi + 0x1c], r8b
add rax, 2
cmp rax, 0x18
jge 0x4ec2e8
movzx edx, byte [rsp + rax + 0x30]
movzx esi, byte [rsp + rax + 0x31]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x14
jae 0x4ec30f
movzx r8d, byte [rsp + rdi + 0x1c]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x7e]
nop word [rax + rax]
cmp rsi, 0x14
jb 0x4ec296
jmp 0x4ec303
xor eax, eax
lea rbx, [rsp + 0x1c]
mov ecx, 0x14
call fcn.004418e0
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
mov eax, esi
mov ecx, 0x14
call fcn.00453440
mov eax, edi
mov ecx, 0x14
call fcn.00453440
nop
nop dword [rax]
call fcn.00450de0
jmp fcn.004ec220
Function at 0x4ef4c0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4ef5c8
sub rsp, 0x50
mov qword [rsp + 0x48], rbp
lea rbp, [rsp + 0x48]
movabs rdx, 0x6171e520696af146
mov qword [rsp + 0x1c], rdx
movabs rdx, 0xe8d96171e520696a
mov qword [rsp + 0x1e], rdx
movabs rdx, 0x2de4dc54208edfba
mov qword [rsp + 0x26], rdx
movabs rdx, 0x50f100c0f11060f
mov qword [rsp + 0x2e], rdx
movabs rdx, 0xf01080b11101109
mov qword [rsp + 0x36], rdx
movabs rdx, 0xf080f01080b1110
mov qword [rsp + 0x38], rdx
movabs rdx, 0xc050a060b090a11
mov qword [rsp + 0x40], rdx
xor eax, eax
jmp 0x4ef562
movzx r9d, byte [rsp + rsi + 0x1c]
sub r9d, edx
lea edx, [r9 - 0x28]
mov byte [rsp + rdi + 0x1c], dl
lea edx, [r8 - 0x28]
mov byte [rsp + rsi + 0x1c], dl
add rax, 2
cmp rax, 0x1a
jge 0x4ef58f
movzx edx, byte [rsp + rax + 0x2e]
movzx esi, byte [rsp + rax + 0x2f]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x12
jae 0x4ef5bb
movzx r8d, byte [rsp + rdi + 0x1c]
sub r8d, edx
cmp rsi, 0x12
jb 0x4ef545
jmp 0x4ef5af
xor eax, eax
lea rbx, [rsp + 0x1c]
mov ecx, 0x12
nop dword [rax + rax]
call fcn.004418e0
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
mov eax, esi
mov ecx, 0x12
call fcn.00453440
mov eax, edi
mov ecx, 0x12
call fcn.00453440
nop
call fcn.00450de0
jmp fcn.004ef4c0

Function at 0x4ef960
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4efa72
sub rsp, 0x58
mov qword [rsp + 0x50], rbp
lea rbp, [rsp + 0x50]
movabs rdx, 0xabd0493f1e9b6905
mov qword [rsp + 0x1a], rdx
movabs rdx, 0x61acd43fc5b49661
mov qword [rsp + 0x22], rdx
movabs rdx, 0x646e61acd43fc5b4
mov qword [rsp + 0x24], rdx
movabs rdx, 0x8aaa69db2064b3a3
mov qword [rsp + 0x2c], rdx
movabs rdx, 0xe020616040c030a
mov qword [rsp + 0x34], rdx
movabs rdx, 0x20d090b18070a00
mov qword [rsp + 0x3c], rdx
movabs rdx, 0x120a1900020d090b
mov qword [rsp + 0x40], rdx
movabs rdx, 0x1219160306130209
mov qword [rsp + 0x48], rdx
xor eax, eax
jmp 0x4efa11
movzx r9d, byte [rsp + rsi + 0x1a]
sub r9d, edx
lea edx, [r9 - 0x15]
mov byte [rsp + rdi + 0x1a], dl
lea edx, [r8 - 0x15]
mov byte [rsp + rsi + 0x1a], dl
add rax, 2
cmp rax, 0x1c
jge 0x4efa3e
movzx edx, byte [rsp + rax + 0x34]
movzx esi, byte [rsp + rax + 0x35]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x1a
jae 0x4efa65
movzx r8d, byte [rsp + rdi + 0x1a]
sub r8d, edx
cmp rsi, 0x1a
jb 0x4ef9f4
jmp 0x4efa59
xor eax, eax
lea rbx, [rsp + 0x1a]
mov ecx, 0x1a
call fcn.004418e0
mov rbp, qword [rsp + 0x50]
add rsp, 0x58
ret
mov eax, esi
mov ecx, 0x1a
call fcn.00453440
mov eax, edi
mov ecx, 0x1a
call fcn.00453440
nop
call fcn.00450de0
jmp fcn.004ef960
Function at 0x4f04a0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4f05c8
sub rsp, 0x68
mov qword [rsp + 0x60], rbp
lea rbp, [rsp + 0x60]
movabs rdx, 0x4ba8726fd26cb8b7
mov qword [rsp + 0x1b], rdx
movabs rdx, 0xeb20adc669ab2025
mov qword [rsp + 0x23], rdx
movabs rdx, 0xcb0c9df4b4a36feb
mov qword [rsp + 0x2a], rdx
movabs rdx, 0xf66f91c9a2129bf6
mov qword [rsp + 0x32], rdx
movabs rdx, 0x1407141201180c
mov qword [rsp + 0x3a], rdx
movabs rdx, 0x171e191b16150014
mov qword [rsp + 0x40], rdx
movabs rdx, 0x1b0f1b1a170d071a
mov qword [rsp + 0x48], rdx
movabs rdx, 0x3031308000616
mov qword [rsp + 0x50], rdx
movabs rdx, 0x111e130c1b0a1c03
mov qword [rsp + 0x58], rdx
xor eax, eax
jmp 0x4f0560
movzx r9d, byte [rsp + rsi + 0x1b]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x68]
mov byte [rsp + rdi + 0x1b], dl
mov byte [rsp + rsi + 0x1b], r8b
add rax, 2
nop dword [rax]
cmp rax, 0x26
jge 0x4f0592
movzx edx, byte [rsp + rax + 0x3a]
movzx esi, byte [rsp + rax + 0x3b]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x1f
jae 0x4f05bb
movzx r8d, byte [rsp + rdi + 0x1b]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x68]
cmp rsi, 0x1f
jb 0x4f0543
jmp 0x4f05af
xor eax, eax
lea rbx, [rsp + 0x1b]
mov ecx, 0x1f
nop
call fcn.004418e0
mov rbp, qword [rsp + 0x60]
add rsp, 0x68
ret
mov eax, esi
mov ecx, 0x1f
call fcn.00453440
mov eax, edi
mov ecx, 0x1f
call fcn.00453440
nop
call fcn.00450de0
jmp fcn.004f04a0

Function at 0x4f19c0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
lea r12, [rsp - 0x18]
cmp r12, qword [r14 + 0x10]
jbe 0x4f1b55
sub rsp, 0x98
mov qword [rsp + 0x90], rbp
lea rbp, [rsp + 0x90]
movabs rdx, 0x1d523257328b95ef
mov qword [rsp + 0x1d], rdx
movabs rdx, 0x736f1863d0975c1d
mov qword [rsp + 0x24], rdx
movabs rdx, 0x64d069d75c66ed28
mov qword [rsp + 0x2c], rdx
movabs rdx, 0x8eb854cddf8777c5
mov qword [rsp + 0x34], rdx
movabs rdx, 0x657dbfb0d47272bd
mov qword [rsp + 0x3c], rdx
movabs rdx, 0xb6b65cb2afc973a1
mov qword [rsp + 0x44], rdx
movabs rdx, 0xe2d4266f3d23c7fc
mov qword [rsp + 0x4c], rdx
movabs rdx, 0x2f2e15190c11291f
mov qword [rsp + 0x54], rdx
movabs rdx, 0x21e1a153010052f
mov qword [rsp + 0x5c], rdx
movabs rdx, 0x2f110c25021e1a15
mov qword [rsp + 0x60], rdx
movabs rdx, 0x232a032b2d30340c
mov qword [rsp + 0x68], rdx
movabs rdx, 0x90110310727360f
mov qword [rsp + 0x70], rdx
movabs rdx, 0x1032130c1719151d
mov qword [rsp + 0x78], rdx
movabs rdx, 0x100a343425362427
mov qword [rsp + 0x80], rdx
movabs rdx, 0x3522002b2e1b1b17
mov qword [rsp + 0x88], rdx
xor eax, eax
jmp 0x4f1aee
movzx r9d, byte [rsp + rsi + 0x1d]
sub r9d, edx
lea edx, [r9 - 0x1e]
mov byte [rsp + rdi + 0x1d], dl
lea edx, [r8 - 0x1e]
mov byte [rsp + rsi + 0x1d], dl
add rax, 2
cmp rax, 0x3c
jge 0x4f1b1b
movzx edx, byte [rsp + rax + 0x54]
movzx esi, byte [rsp + rax + 0x55]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x37
jae 0x4f1b48
movzx r8d, byte [rsp + rdi + 0x1d]
sub r8d, edx
cmp rsi, 0x37
jb 0x4f1ad1
jmp 0x4f1b3c
xor eax, eax
lea rbx, [rsp + 0x1d]
mov ecx, 0x37
call fcn.004418e0
mov rbp, qword [rsp + 0x90]
add rsp, 0x98
ret
mov eax, esi
mov ecx, 0x37
call fcn.00453440
mov eax, edi
mov ecx, 0x37
call fcn.00453440
nop
call fcn.00450de0
jmp fcn.004f19c0