joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4c5fc0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4c60ac
push rbp
mov rbp, rsp
sub rsp, 0x40
movabs rdx, 0x111010020f040902
mov qword [rsp + 0x18], rdx
movabs rdx, 0x80b010b09101110
mov qword [rsp + 0x1e], rdx
movabs rdx, 0x2040f100611080f
mov qword [rsp + 0x26], rdx
movabs rdx, 0x698165ec61044243
mov qword [rsp + 0x2e], rdx
movabs rdx, 0x3ba3698165ec6104
mov qword [rsp + 0x30], rdx
movabs rdx, 0xdfe6e0697070af4d
mov qword [rsp + 0x38], rdx
xor eax, eax
jmp 0x4c604a
movzx r9d, byte [rsp + rsi + 0x2e]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x51]
mov byte [rsp + rdi + 0x2e], dl
mov byte [rsp + rsi + 0x2e], r8b
add rax, 2
cmp rax, 0x16
jge 0x4c607c
movzx edx, byte [rsp + rax + 0x18]
movzx esi, byte [rsp + rax + 0x19]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x12
jae 0x4c609f
movzx r8d, byte [rsp + rdi + 0x2e]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x51]
cmp rsi, 0x12
jb 0x4c6030
jmp 0x4c6093
xor eax, eax
lea rbx, [rsp + 0x2e]
mov ecx, 0x12
call fcn.0044d280
add rsp, 0x40
pop rbp
ret
mov eax, esi
mov ecx, 0x12
call fcn.00462ca0
mov eax, edi
mov ecx, 0x12
call fcn.00462ca0
nop
call fcn.004609c0
jmp fcn.004c5fc0

Function at 0x4c67a0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4c6866
push rbp
mov rbp, rsp
sub rsp, 0x30
movabs rdx, 0x502070206040102
mov qword [rsp + 0x1c], rdx
mov word [rsp + 0x24], 0x809
movabs rdx, 0xd7341c106133e543
mov qword [rsp + 0x26], rdx
mov word [rsp + 0x2e], 0x2b20
xor eax, eax
jmp 0x4c6800
movzx r9d, byte [rsp + rsi + 0x26]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x3c]
mov byte [rsp + rdi + 0x26], dl
mov byte [rsp + rsi + 0x26], r8b
add rax, 2
nop dword [rax]
cmp rax, 0xa
jge 0x4c6832
movzx edx, byte [rsp + rax + 0x1c]
movzx esi, byte [rsp + rax + 0x1d]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0xa
jae 0x4c6857
movzx r8d, byte [rsp + rdi + 0x26]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x3c]
cmp rsi, 0xa
jb 0x4c67e2
jmp 0x4c684b
xor eax, eax
lea rbx, [rsp + 0x26]
mov ecx, 0xa
nop
call fcn.0044d280
add rsp, 0x30
pop rbp
ret
mov eax, esi
mov ecx, 0xa
call fcn.00462ca0
mov eax, edi
mov ecx, 0xa
nop
call fcn.00462ca0
nop
call fcn.004609c0
jmp fcn.004c67a0
Function at 0x4c82e0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4c83c6
push rbp
mov rbp, rsp
sub rsp, 0x40
movabs rdx, 0x20e050402060e07
mov qword [rsp + 0x1f], rdx
movabs rdx, 0x600020e05040206
mov qword [rsp + 0x21], rdx
movabs rdx, 0x4010e0b03030904
mov qword [rsp + 0x29], rdx
movabs rdx, 0xb345a215e48d070c
mov qword [rsp + 0x31], rdx
movabs rdx, 0x5656ef14c936eb3
mov qword [rsp + 0x38], rdx
xor eax, eax
nop
jmp 0x4c8360
movzx r9d, byte [rsp + rsi + 0x31]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x53]
mov byte [rsp + rdi + 0x31], dl
mov byte [rsp + rsi + 0x31], r8b
add rax, 2
nop dword [rax]
cmp rax, 0x12
jge 0x4c8392
movzx edx, byte [rsp + rax + 0x1f]
movzx esi, byte [rsp + rax + 0x20]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0xf
jae 0x4c83b7
movzx r8d, byte [rsp + rdi + 0x31]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x53]
cmp rsi, 0xf
jb 0x4c8342
jmp 0x4c83ab
xor eax, eax
lea rbx, [rsp + 0x31]
mov ecx, 0xf
nop
call fcn.0044d280
add rsp, 0x40
pop rbp
ret
mov eax, esi
mov ecx, 0xf
call fcn.00462ca0
mov eax, edi
mov ecx, 0xf
nop
call fcn.00462ca0
nop
call fcn.004609c0
jmp fcn.004c82e0

Function at 0x4c9440
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4c9548
push rbp
mov rbp, rsp
sub rsp, 0x50
movabs rdx, 0x80e0919110c000c
mov qword [rsp + 0x18], rdx
movabs rdx, 0x12120d0009010206
mov qword [rsp + 0x20], rdx
movabs rdx, 0x1904031405041212
mov qword [rsp + 0x26], rdx
movabs rdx, 0x1007041919190406
mov qword [rsp + 0x2e], rdx
movabs rdx, 0x5a38da3529e83009
mov qword [rsp + 0x36], rdx
movabs rdx, 0x693218f6726fea38
mov qword [rsp + 0x3e], rdx
movabs rdx, 0x4434693218f6726f
mov qword [rsp + 0x40], rdx
movabs rdx, 0xfb6c646e61277908
mov qword [rsp + 0x48], rdx
xor eax, eax
jmp 0x4c94eb
movzx r9d, byte [rsp + rsi + 0x36]
sub r9d, edx
lea edx, [r9 + 0x48]
mov byte [rsp + rdi + 0x36], dl
lea edx, [r8 + 0x48]
mov byte [rsp + rsi + 0x36], dl
add rax, 2
cmp rax, 0x1e
jge 0x4c9518
movzx edx, byte [rsp + rax + 0x18]
movzx esi, byte [rsp + rax + 0x19]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x1a
jae 0x4c953b
movzx r8d, byte [rsp + rdi + 0x36]
sub r8d, edx
cmp rsi, 0x1a
jb 0x4c94ce
jmp 0x4c952f
xor eax, eax
lea rbx, [rsp + 0x36]
mov ecx, 0x1a
call fcn.0044d280
add rsp, 0x50
pop rbp
ret
mov eax, esi
mov ecx, 0x1a
call fcn.00462ca0
mov eax, edi
mov ecx, 0x1a
call fcn.00462ca0
nop
call fcn.004609c0
jmp fcn.004c9440
Function at 0x4ca780
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4ca86c
push rbp
mov rbp, rsp
sub rsp, 0x40
movabs rdx, 0x8100c07070a0d04
mov qword [rsp + 0x19], rdx
movabs rdx, 0x5000b03020a0810
mov qword [rsp + 0x1f], rdx
movabs rdx, 0x2060f0e0e03060b
mov qword [rsp + 0x27], rdx
movabs rdx, 0x2c483153205f6559
mov qword [rsp + 0x2f], rdx
movabs rdx, 0x342c483153205f65
mov qword [rsp + 0x30], rdx
movabs rdx, 0x2d55315a60142661
mov qword [rsp + 0x38], rdx
xor eax, eax
jmp 0x4ca80a
movzx r9d, byte [rsp + rsi + 0x2f]
lea edx, [r9 + rdx]
lea edx, [rdx + 5]
mov byte [rsp + rdi + 0x2f], dl
mov byte [rsp + rsi + 0x2f], r8b
add rax, 2
cmp rax, 0x16
jge 0x4ca83c
movzx edx, byte [rsp + rax + 0x19]
movzx esi, byte [rsp + rax + 0x1a]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x11
jae 0x4ca85f
movzx r8d, byte [rsp + rdi + 0x2f]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 5]
cmp rsi, 0x11
jb 0x4ca7f0
jmp 0x4ca853
xor eax, eax
lea rbx, [rsp + 0x2f]
mov ecx, 0x11
call fcn.0044d280
add rsp, 0x40
pop rbp
ret
mov eax, esi
mov ecx, 0x11
call fcn.00462ca0
mov eax, edi
mov ecx, 0x11
call fcn.00462ca0
nop
call fcn.004609c0
jmp fcn.004ca780

Function at 0x4cbb40
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4cbc0c
push rbp
mov rbp, rsp
sub rsp, 0x38
movabs rdx, 0x509010a02010105
mov qword [rsp + 0x1c], rdx
movabs rdx, 0x70a0505000b0601
mov qword [rsp + 0x24], rdx
movabs rdx, 0xe8ea6c4c64e170cc
mov qword [rsp + 0x2c], rdx
mov dword [rsp + 0x34], 0xc1585f61
xor eax, eax
jmp 0x4cbba5
movzx r9d, byte [rsp + rsi + 0x2c]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x76]
mov byte [rsp + rdi + 0x2c], dl
mov byte [rsp + rsi + 0x2c], r8b
add rax, 2
cmp rax, 0x10
jge 0x4cbbdc
movzx edx, byte [rsp + rax + 0x1c]
movzx esi, byte [rsp + rax + 0x1d]
mov edi, edx
xor edx, esi
add edx, eax
nop dword [rax + rax]
cmp rdi, 0xc
jae 0x4cbbff
movzx r8d, byte [rsp + rdi + 0x2c]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x76]
cmp rsi, 0xc
jb 0x4cbb8b
jmp 0x4cbbf3
xor eax, eax
lea rbx, [rsp + 0x2c]
mov ecx, 0xc
call fcn.0044d280
add rsp, 0x38
pop rbp
ret
mov eax, esi
mov ecx, 0xc
call fcn.00462ca0
mov eax, edi
mov ecx, 0xc
call fcn.00462ca0
nop
call fcn.004609c0
jmp fcn.004cbb40
Function at 0x4cca00
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4ccacc
push rbp
mov rbp, rsp
sub rsp, 0x38
movabs rdx, 0x50206060808000a
mov qword [rsp + 0x1e], rdx
movabs rdx, 0x102060202000502
mov qword [rsp + 0x24], rdx
movabs rdx, 0x73af2d4364dbcbd4
mov qword [rsp + 0x2c], rdx
mov dword [rsp + 0x34], 0x57b76ce6
xor eax, eax
jmp 0x4cca65
movzx r9d, byte [rsp + rsi + 0x2c]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x79]
mov byte [rsp + rdi + 0x2c], dl
mov byte [rsp + rsi + 0x2c], r8b
add rax, 2
cmp rax, 0xe
jge 0x4cca9c
movzx edx, byte [rsp + rax + 0x1e]
movzx esi, byte [rsp + rax + 0x1f]
mov edi, edx
xor edx, esi
add edx, eax
nop dword [rax + rax]
cmp rdi, 0xc
jae 0x4ccabf
movzx r8d, byte [rsp + rdi + 0x2c]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x79]
cmp rsi, 0xc
jb 0x4cca4b
jmp 0x4ccab3
xor eax, eax
lea rbx, [rsp + 0x2c]
mov ecx, 0xc
call fcn.0044d280
add rsp, 0x38
pop rbp
ret
mov eax, esi
mov ecx, 0xc
call fcn.00462ca0
mov eax, edi
mov ecx, 0xc
call fcn.00462ca0
nop
call fcn.004609c0
jmp fcn.004cca00

Function at 0x4cd000
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4cd0c7
push rbp
mov rbp, rsp
sub rsp, 0x38
movabs rdx, 0x8030a0a0202050a
mov qword [rsp + 0x1c], rdx
movabs rdx, 0x4020509090a0708
mov qword [rsp + 0x24], rdx
movabs rdx, 0x914f6cbcf6ec6553
mov qword [rsp + 0x2c], rdx
mov dword [rsp + 0x34], 0x65f8ad8a
xor eax, eax
jmp 0x4cd068
movzx r9d, byte [rsp + rsi + 0x2c]
sub r9d, edx
lea edx, [r9 - 0x34]
mov byte [rsp + rdi + 0x2c], dl
lea edx, [r8 - 0x34]
mov byte [rsp + rsi + 0x2c], dl
add rax, 2
cmp rax, 0x10
jge 0x4cd097
movzx edx, byte [rsp + rax + 0x1c]
movzx esi, byte [rsp + rax + 0x1d]
mov edi, edx
xor edx, esi
add edx, eax
nop
cmp rdi, 0xc
jae 0x4cd0ba
movzx r8d, byte [rsp + rdi + 0x2c]
sub r8d, edx
cmp rsi, 0xc
jb 0x4cd04b
jmp 0x4cd0ae
xor eax, eax
lea rbx, [rsp + 0x2c]
mov ecx, 0xc
call fcn.0044d280
add rsp, 0x38
pop rbp
ret
mov eax, esi
mov ecx, 0xc
call fcn.00462ca0
mov eax, edi
mov ecx, 0xc
call fcn.00462ca0
nop
call fcn.004609c0
jmp fcn.004cd000
Function at 0x4cd9c0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4cdaa6
push rbp
mov rbp, rsp
sub rsp, 0x38
movabs rdx, 0xa000505000c0100
mov qword [rsp + 0x18], rdx
movabs rdx, 0xd050a000505000c
mov qword [rsp + 0x1a], rdx
movabs rdx, 0xa010d01010d0103
mov qword [rsp + 0x22], rdx
movabs rdx, 0x5065b4699d741afd
mov qword [rsp + 0x2a], rdx
movabs rdx, 0xbe5274a5696f5065
mov qword [rsp + 0x30], rdx
xor eax, eax
nop
jmp 0x4cda40
movzx r9d, byte [rsp + rsi + 0x2a]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x62]
mov byte [rsp + rdi + 0x2a], dl
mov byte [rsp + rsi + 0x2a], r8b
add rax, 2
nop dword [rax]
cmp rax, 0x12
jge 0x4cda72
movzx edx, byte [rsp + rax + 0x18]
movzx esi, byte [rsp + rax + 0x19]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0xe
jae 0x4cda97
movzx r8d, byte [rsp + rdi + 0x2a]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x62]
cmp rsi, 0xe
jb 0x4cda22
jmp 0x4cda8b
xor eax, eax
lea rbx, [rsp + 0x2a]
mov ecx, 0xe
nop
call fcn.0044d280
add rsp, 0x38
pop rbp
ret
mov eax, esi
mov ecx, 0xe
call fcn.00462ca0
mov eax, edi
mov ecx, 0xe
nop
call fcn.00462ca0
nop
call fcn.004609c0
jmp fcn.004cd9c0

Function at 0x4cdac0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4cdb8c
push rbp
mov rbp, rsp
sub rsp, 0x38
movabs rdx, 0x601040605090005
mov qword [rsp + 0x1f], rdx
movabs rdx, 0x8030906050a0601
mov qword [rsp + 0x25], rdx
movabs rdx, 0x5406f198f5748d22
mov qword [rsp + 0x2d], rdx
mov dword [rsp + 0x34], 0xf886d254
xor eax, eax
jmp 0x4cdb25
movzx r9d, byte [rsp + rsi + 0x2d]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x5d]
mov byte [rsp + rdi + 0x2d], dl
mov byte [rsp + rsi + 0x2d], r8b
add rax, 2
cmp rax, 0xe
jge 0x4cdb5c
movzx edx, byte [rsp + rax + 0x1f]
movzx esi, byte [rsp + rax + 0x20]
mov edi, edx
xor edx, esi
add edx, eax
nop dword [rax + rax]
cmp rdi, 0xb
jae 0x4cdb7f
movzx r8d, byte [rsp + rdi + 0x2d]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x5d]
cmp rsi, 0xb
jb 0x4cdb0b
jmp 0x4cdb73
xor eax, eax
lea rbx, [rsp + 0x2d]
mov ecx, 0xb
call fcn.0044d280
add rsp, 0x38
pop rbp
ret
mov eax, esi
mov ecx, 0xb
call fcn.00462ca0
mov eax, edi
mov ecx, 0xb
call fcn.00462ca0
nop
call fcn.004609c0
jmp fcn.004cdac0
Function at 0x4cf680
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4cf74c
push rbp
mov rbp, rsp
sub rsp, 0x38
movabs rdx, 0x101060c06010504
mov qword [rsp + 0x1a], rdx
movabs rdx, 0x1060a0801090102
mov qword [rsp + 0x22], rdx
movabs rdx, 0x479b231555efdb4e
mov qword [rsp + 0x2a], rdx
movabs rdx, 0x6fe66e22f706479b
mov qword [rsp + 0x30], rdx
xor eax, eax
jmp 0x4cf6ef
movzx r9d, byte [rsp + rsi + 0x2a]
sub r9d, edx
lea edx, [r9 + 0x51]
mov byte [rsp + rdi + 0x2a], dl
lea edx, [r8 + 0x51]
mov byte [rsp + rsi + 0x2a], dl
add rax, 2
cmp rax, 0x10
jge 0x4cf71c
movzx edx, byte [rsp + rax + 0x1a]
movzx esi, byte [rsp + rax + 0x1b]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0xe
jae 0x4cf73f
movzx r8d, byte [rsp + rdi + 0x2a]
sub r8d, edx
cmp rsi, 0xe
jb 0x4cf6d2
jmp 0x4cf733
xor eax, eax
lea rbx, [rsp + 0x2a]
mov ecx, 0xe
call fcn.0044d280
add rsp, 0x38
pop rbp
ret
mov eax, esi
mov ecx, 0xe
call fcn.00462ca0
mov eax, edi
mov ecx, 0xe
call fcn.00462ca0
nop
call fcn.004609c0
jmp fcn.004cf680

Function at 0x4cfa40
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4cfb26
push rbp
mov rbp, rsp
sub rsp, 0x38
movabs rdx, 0x90a0b090904030a
mov qword [rsp + 0x18], rdx
movabs rdx, 0xc03090a0b090904
mov qword [rsp + 0x1a], rdx
movabs rdx, 0x6070a0603070603
mov qword [rsp + 0x22], rdx
movabs rdx, 0xcad1653a65746547
mov qword [rsp + 0x2a], rdx
movabs rdx, 0x57b42862e961cad1
mov qword [rsp + 0x30], rdx
xor eax, eax
nop
jmp 0x4cfac0
movzx r9d, byte [rsp + rsi + 0x2a]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x7b]
mov byte [rsp + rdi + 0x2a], dl
mov byte [rsp + rsi + 0x2a], r8b
add rax, 2
nop dword [rax]
cmp rax, 0x12
jge 0x4cfaf2
movzx edx, byte [rsp + rax + 0x18]
movzx esi, byte [rsp + rax + 0x19]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0xe
jae 0x4cfb17
movzx r8d, byte [rsp + rdi + 0x2a]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x7b]
cmp rsi, 0xe
jb 0x4cfaa2
jmp 0x4cfb0b
xor eax, eax
lea rbx, [rsp + 0x2a]
mov ecx, 0xe
nop
call fcn.0044d280
add rsp, 0x38
pop rbp
ret
mov eax, esi
mov ecx, 0xe
call fcn.00462ca0
mov eax, edi
mov ecx, 0xe
nop
call fcn.00462ca0
nop
call fcn.004609c0
jmp fcn.004cfa40
Function at 0x4cfb40
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4cfc1d
push rbp
mov rbp, rsp
sub rsp, 0x38
movabs rdx, 0xd0c090302000a02
mov qword [rsp + 0x18], rdx
movabs rdx, 0x60c0d0c09030200
mov qword [rsp + 0x1a], rdx
movabs rdx, 0x2080b05020a0d0b
mov qword [rsp + 0x22], rdx
movabs rdx, 0x74b8ca739d5e72fb
mov qword [rsp + 0x2a], rdx
movabs rdx, 0xfc62a8e2bdbc74b8
mov qword [rsp + 0x30], rdx
xor eax, eax
nop
jmp 0x4cfbc0
movzx r9d, byte [rsp + rsi + 0x2a]
sub r9d, edx
lea edx, [r9 - 0x41]
mov byte [rsp + rdi + 0x2a], dl
lea edx, [r8 - 0x41]
mov byte [rsp + rsi + 0x2a], dl
add rax, 2
nop
cmp rax, 0x12
jge 0x4cfbed
movzx edx, byte [rsp + rax + 0x18]
movzx esi, byte [rsp + rax + 0x19]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0xe
jae 0x4cfc10
movzx r8d, byte [rsp + rdi + 0x2a]
sub r8d, edx
cmp rsi, 0xe
jb 0x4cfba2
jmp 0x4cfc04
xor eax, eax
lea rbx, [rsp + 0x2a]
mov ecx, 0xe
call fcn.0044d280
add rsp, 0x38
pop rbp
ret
mov eax, esi
mov ecx, 0xe
call fcn.00462ca0
mov eax, edi
mov ecx, 0xe
call fcn.00462ca0
nop
nop dword [rax]
call fcn.004609c0
jmp fcn.004cfb40

Function at 0x4cffc0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4d008c
push rbp
mov rbp, rsp
sub rsp, 0x38
movabs rdx, 0x60c0805060b0002
mov qword [rsp + 0x1d], rdx
movabs rdx, 0xc070202010c060c
mov qword [rsp + 0x23], rdx
movabs rdx, 0x788864416552b285
mov qword [rsp + 0x2b], rdx
movabs rdx, 0x7ec4666e7f788864
mov qword [rsp + 0x30], rdx
xor eax, eax
jmp 0x4d002f
movzx r9d, byte [rsp + rsi + 0x2b]
sub r9d, edx
lea edx, [r9 - 0xa]
mov byte [rsp + rdi + 0x2b], dl
lea edx, [r8 - 0xa]
mov byte [rsp + rsi + 0x2b], dl
add rax, 2
cmp rax, 0xe
jge 0x4d005c
movzx edx, byte [rsp + rax + 0x1d]
movzx esi, byte [rsp + rax + 0x1e]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0xd
jae 0x4d007f
movzx r8d, byte [rsp + rdi + 0x2b]
sub r8d, edx
cmp rsi, 0xd
jb 0x4d0012
jmp 0x4d0073
xor eax, eax
lea rbx, [rsp + 0x2b]
mov ecx, 0xd
call fcn.0044d280
add rsp, 0x38
pop rbp
ret
mov eax, esi
mov ecx, 0xd
call fcn.00462ca0
mov eax, edi
mov ecx, 0xd
call fcn.00462ca0
nop
call fcn.004609c0
jmp fcn.004cffc0

Function at 0x4d0700
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4d07c6
push rbp
mov rbp, rsp
sub rsp, 0x30
movabs rdx, 0x208070600060407
mov qword [rsp + 0x1b], rdx
mov dword [rsp + 0x23], 0x2060408
movabs rdx, 0xb07b6eaf5399539f
mov qword [rsp + 0x27], rdx
mov byte [rsp + 0x2f], 0x9e
xor eax, eax
nop
jmp 0x4d0760
movzx r9d, byte [rsp + rsi + 0x27]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x2c]
mov byte [rsp + rdi + 0x27], dl
mov byte [rsp + rsi + 0x27], r8b
add rax, 2
nop dword [rax]
cmp rax, 0xc
jge 0x4d0792
movzx edx, byte [rsp + rax + 0x1b]
movzx esi, byte [rsp + rax + 0x1c]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 9
jae 0x4d07b7
movzx r8d, byte [rsp + rdi + 0x27]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x2c]
cmp rsi, 9
jb 0x4d0742
jmp 0x4d07ab
xor eax, eax
lea rbx, [rsp + 0x27]
mov ecx, 9
nop
call fcn.0044d280
add rsp, 0x30
pop rbp
ret
mov eax, esi
mov ecx, 9
call fcn.00462ca0
mov eax, edi
mov ecx, 9
nop
call fcn.00462ca0
nop
call fcn.004609c0
jmp fcn.004d0700
Function at 0x4d0f80
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4d1052
push rbp
mov rbp, rsp
sub rsp, 0x38
movabs rdx, 0x70a080b0c020c04
mov qword [rsp + 0x1d], rdx
movabs rdx, 0x50b06090506070a
mov qword [rsp + 0x23], rdx
movabs rdx, 0x7ea8aabc68856567
mov qword [rsp + 0x2b], rdx
movabs rdx, 0x97a27f8bb27ea8aa
mov qword [rsp + 0x30], rdx
xor eax, eax
jmp 0x4d0fec
movzx r9d, byte [rsp + rsi + 0x2b]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x30]
mov byte [rsp + rdi + 0x2b], dl
mov byte [rsp + rsi + 0x2b], r8b
add rax, 2
cmp rax, 0xe
jge 0x4d101e
movzx edx, byte [rsp + rax + 0x1d]
movzx esi, byte [rsp + rax + 0x1e]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0xd
jae 0x4d1045
movzx r8d, byte [rsp + rdi + 0x2b]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x30]
cmp rsi, 0xd
jb 0x4d0fd2
jmp 0x4d1035
xor eax, eax
lea rbx, [rsp + 0x2b]
mov ecx, 0xd
call fcn.0044d280
add rsp, 0x38
pop rbp
ret
mov eax, esi
mov ecx, 0xd
nop dword [rax]
call fcn.00462ca0
mov eax, edi
mov ecx, 0xd
call fcn.00462ca0
nop
call fcn.004609c0
jmp fcn.004d0f80

Function at 0x4d12c0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4d1392
push rbp
mov rbp, rsp
sub rsp, 0x38
movabs rdx, 0xb0a040a030a0b09
mov qword [rsp + 0x1b], rdx
movabs rdx, 0x30a00030a07000c
mov qword [rsp + 0x23], rdx
movabs rdx, 0xd57672e4d8746519
mov qword [rsp + 0x2b], rdx
movabs rdx, 0x7f34dd9a79d57672
mov qword [rsp + 0x30], rdx
xor eax, eax
jmp 0x4d132c
movzx r9d, byte [rsp + rsi + 0x2b]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x38]
mov byte [rsp + rdi + 0x2b], dl
mov byte [rsp + rsi + 0x2b], r8b
add rax, 2
cmp rax, 0x10
jge 0x4d135e
movzx edx, byte [rsp + rax + 0x1b]
movzx esi, byte [rsp + rax + 0x1c]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0xd
jae 0x4d1385
movzx r8d, byte [rsp + rdi + 0x2b]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x38]
cmp rsi, 0xd
jb 0x4d1312
jmp 0x4d1375
xor eax, eax
lea rbx, [rsp + 0x2b]
mov ecx, 0xd
call fcn.0044d280
add rsp, 0x38
pop rbp
ret
mov eax, esi
mov ecx, 0xd
nop dword [rax]
call fcn.00462ca0
mov eax, edi
mov ecx, 0xd
call fcn.00462ca0
nop
call fcn.004609c0
jmp fcn.004d12c0
Function at 0x4d2360
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4d242a
push rbp
mov rbp, rsp
sub rsp, 0x48
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rbx
mov qword [rsp], rax
mov qword [rsp + 8], rbx
mov byte [rsp + 0x10], 0
call fcn.00403300
xorps xmm15, xmm15
mov r14, qword [0x006a8818]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x18], 0xffffffffffffffff
jne 0x4d240f
mov rcx, qword [rsp + 0x60]
lea rdx, [rcx + 1]
mov qword [rsp + 0x40], rdx
lea rax, [0x00513160]
xor ebx, ebx
mov rcx, rdx
call fcn.00449100
mov rbx, qword [rsp + 0x60]
mov rcx, rax
xor edi, edi
mov rsi, qword [rsp + 0x40]
mov rax, qword [rsp + 0x58]
nop dword [rax]
call fcn.004d2960
inc rbx
cmp rcx, rbx
jae 0x4d23fe
mov edi, 1
lea rsi, [0x00513160]
call fcn.004491e0
mov word [rax + rbx*2 - 2], 0
xor edi, edi
xor esi, esi
add rsp, 0x48
pop rbp
ret
xor eax, eax
xor ebx, ebx
mov rcx, rbx
lea rdi, [0x00559d88]
lea rsi, [0x00559a00]
add rsp, 0x48
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.004609c0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.004d2360

Function at 0x4d4220
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4d42fd
push rbp
mov rbp, rsp
sub rsp, 0x40
movabs rdx, 0xb0e0b0200010b0c
mov qword [rsp + 0x1b], rdx
movabs rdx, 0x508070b09020b0e
mov qword [rsp + 0x21], rdx
movabs rdx, 0x50d0e000d07090d
mov qword [rsp + 0x29], rdx
movabs rdx, 0x6e2077656c4b2153
mov qword [rsp + 0x31], rdx
movabs rdx, 0x77217264666b776e
mov qword [rsp + 0x38], rdx
xor eax, eax
nop
jmp 0x4d42a0
movzx r9d, byte [rsp + rsi + 0x31]
sub r9d, edx
lea edx, [r9 + 0x11]
mov byte [rsp + rdi + 0x31], dl
lea edx, [r8 + 0x11]
mov byte [rsp + rsi + 0x31], dl
add rax, 2
nop
cmp rax, 0x16
jge 0x4d42cd
movzx edx, byte [rsp + rax + 0x1b]
movzx esi, byte [rsp + rax + 0x1c]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0xf
jae 0x4d42f0
movzx r8d, byte [rsp + rdi + 0x31]
sub r8d, edx
cmp rsi, 0xf
jb 0x4d4282
jmp 0x4d42e4
xor eax, eax
lea rbx, [rsp + 0x31]
mov ecx, 0xf
call fcn.0044d280
add rsp, 0x40
pop rbp
ret
mov eax, esi
mov ecx, 0xf
call fcn.00462ca0
mov eax, edi
mov ecx, 0xf
call fcn.00462ca0
nop
nop dword [rax]
call fcn.004609c0
jmp fcn.004d4220
Function at 0x4d72c0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4d73dd
push rbp
mov rbp, rsp
sub rsp, 0x58
movabs rdx, 0x90f151506141700
mov qword [rsp + 0x1a], rdx
movabs rdx, 0x4010c0a090f1515
mov qword [rsp + 0x1e], rdx
movabs rdx, 0x1506111106160b0b
mov qword [rsp + 0x26], rdx
movabs rdx, 0x70d0616140e0e09
mov qword [rsp + 0x2e], rdx
movabs rdx, 0x5020a0313120400
mov qword [rsp + 0x36], rdx
movabs rdx, 0xab20d2b2c07deab4
mov qword [rsp + 0x3e], rdx
movabs rdx, 0x57b8be13a162a172
mov qword [rsp + 0x46], rdx
movabs rdx, 0xa86e57b8be13a162
mov qword [rsp + 0x48], rdx
movabs rdx, 0x656d07cb4137b4c5
mov qword [rsp + 0x50], rdx
xor eax, eax
jmp 0x4d7380
movzx r9d, byte [rsp + rsi + 0x3e]
sub r9d, edx
lea edx, [r9 - 0x34]
mov byte [rsp + rdi + 0x3e], dl
lea edx, [r8 - 0x34]
mov byte [rsp + rsi + 0x3e], dl
add rax, 2
nop word [rax + rax]
cmp rax, 0x24
jge 0x4d73ad
movzx edx, byte [rsp + rax + 0x1a]
movzx esi, byte [rsp + rax + 0x1b]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x1a
jae 0x4d73d0
movzx r8d, byte [rsp + rdi + 0x3e]
sub r8d, edx
cmp rsi, 0x1a
jb 0x4d735d
jmp 0x4d73c4
xor eax, eax
lea rbx, [rsp + 0x3e]
mov ecx, 0x1a
call fcn.0044d280
add rsp, 0x58
pop rbp
ret
mov eax, esi
mov ecx, 0x1a
call fcn.00462ca0
mov eax, edi
mov ecx, 0x1a
call fcn.00462ca0
nop
nop dword [rax]
call fcn.004609c0
jmp fcn.004d72c0

Function at 0x4d8580
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4d867b
push rbp
mov rbp, rsp
sub rsp, 0x50
movabs rdx, 0x31607020e07000c
mov qword [rsp + 0x1d], rdx
movabs rdx, 0x208111008060009
mov qword [rsp + 0x25], rdx
movabs rdx, 0x4080b0002081110
mov qword [rsp + 0x29], rdx
movabs rdx, 0x100d0b060b0f0212
mov qword [rsp + 0x31], rdx
movabs rdx, 0x242d742015306f20
mov qword [rsp + 0x39], rdx
movabs rdx, 0x50069904537ccd24
mov qword [rsp + 0x40], rdx
movabs rdx, 0x116d69540ac022c0
mov qword [rsp + 0x48], rdx
xor eax, eax
jmp 0x4d8619
movzx r9d, byte [rsp + rsi + 0x39]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x35]
mov byte [rsp + rdi + 0x39], dl
mov byte [rsp + rsi + 0x39], r8b
add rax, 2
cmp rax, 0x1c
jge 0x4d864b
movzx edx, byte [rsp + rax + 0x1d]
movzx esi, byte [rsp + rax + 0x1e]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x17
jae 0x4d866e
movzx r8d, byte [rsp + rdi + 0x39]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x35]
cmp rsi, 0x17
jb 0x4d85ff
jmp 0x4d8662
xor eax, eax
lea rbx, [rsp + 0x39]
mov ecx, 0x17
call fcn.0044d280
add rsp, 0x50
pop rbp
ret
mov eax, esi
mov ecx, 0x17
call fcn.00462ca0
mov eax, edi
mov ecx, 0x17
call fcn.00462ca0
nop
nop dword [rax + rax]
call fcn.004609c0
jmp fcn.004d8580