joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4ae900
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4ae9ea
push rbp
mov rbp, rsp
sub rsp, 0x40
movabs rdx, 0x20a2176f6ec66ea2
mov qword [rsp + 0x2f], rdx
movabs rdx, 0x7420a2176f6ec66e
mov qword [rsp + 0x30], rdx
movabs rdx, 0xdecca76baf9e9fc2
mov qword [rsp + 0x38], rdx
movabs rdx, 0xa0f0010050e0a09
mov qword [rsp + 0x1d], rdx
movabs rdx, 0x20a0a0f0010050e
mov qword [rsp + 0x1f], rdx
movabs rdx, 0x60e06100c0a0b
mov qword [rsp + 0x27], rdx
xor eax, eax
jmp 0x4ae98d
movzx r9d, byte [rsp + rsi + 0x2f]
sub r9d, edx
lea edx, [r9 - 0x23]
mov byte [rsp + rdi + 0x2f], dl
lea edx, [r8 - 0x23]
mov byte [rsp + rsi + 0x2f], dl
add rax, 2
cmp rax, 0x12
jge 0x4ae9ba
movzx edx, byte [rsp + rax + 0x1d]
movzx esi, byte [rsp + rax + 0x1e]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x11
jae 0x4ae9dd
movzx r8d, byte [rsp + rdi + 0x2f]
sub r8d, edx
cmp rsi, 0x11
jb 0x4ae970
jmp 0x4ae9d1
xor eax, eax
lea rbx, [rsp + 0x2f]
mov ecx, 0x11
call fcn.00449780
add rsp, 0x40
pop rbp
ret
mov eax, esi
mov ecx, 0x11
call fcn.0045cd80
mov eax, edi
mov ecx, 0x11
call fcn.0045cd80
nop
call fcn.0045aaa0
jmp fcn.004ae900

Function at 0x4b01a0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4b029b
push rbp
mov rbp, rsp
sub rsp, 0x50
movabs rdx, 0x3d2824ec201115d2
mov qword [rsp + 0x3b], rdx
movabs rdx, 0x871cf53b203d2824
mov qword [rsp + 0x40], rdx
movabs rdx, 0x720f65ca95cdee35
mov qword [rsp + 0x48], rdx
movabs rdx, 0xe0c04070a0e090d
mov qword [rsp + 0x1f], rdx
movabs rdx, 0x10020b110e140700
mov qword [rsp + 0x27], rdx
movabs rdx, 0xf050e1410020b11
mov qword [rsp + 0x2b], rdx
movabs rdx, 0x10706060a050213
mov qword [rsp + 0x33], rdx
xor eax, eax
jmp 0x4b0239
movzx r9d, byte [rsp + rsi + 0x3b]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x30]
mov byte [rsp + rdi + 0x3b], dl
mov byte [rsp + rsi + 0x3b], r8b
add rax, 2
cmp rax, 0x1c
jge 0x4b026b
movzx edx, byte [rsp + rax + 0x1f]
movzx esi, byte [rsp + rax + 0x20]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x15
jae 0x4b028e
movzx r8d, byte [rsp + rdi + 0x3b]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x30]
cmp rsi, 0x15
jb 0x4b021f
jmp 0x4b0282
xor eax, eax
lea rbx, [rsp + 0x3b]
mov ecx, 0x15
call fcn.00449780
add rsp, 0x50
pop rbp
ret
mov eax, esi
mov ecx, 0x15
call fcn.0045cd80
mov eax, edi
mov ecx, 0x15
call fcn.0045cd80
nop
nop dword [rax + rax]
call fcn.0045aaa0
jmp fcn.004b01a0
Function at 0x4b06c0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4b0786
push rbp
mov rbp, rsp
sub rsp, 0x30
movabs rdx, 0x7279fc7438f13837
mov qword [rsp + 0x25], rdx
mov dword [rsp + 0x2c], 0x35746972
movabs rdx, 0x105010202060a0a
mov qword [rsp + 0x19], rdx
mov dword [rsp + 0x21], 0x6010300
xor eax, eax
jmp 0x4b0720
movzx r9d, byte [rsp + rsi + 0x25]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x30]
mov byte [rsp + rdi + 0x25], dl
mov byte [rsp + rsi + 0x25], r8b
add rax, 2
nop
cmp rax, 0xc
jge 0x4b0752
movzx edx, byte [rsp + rax + 0x19]
movzx esi, byte [rsp + rax + 0x1a]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0xb
jae 0x4b0777
movzx r8d, byte [rsp + rdi + 0x25]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x30]
cmp rsi, 0xb
jb 0x4b0704
jmp 0x4b076b
xor eax, eax
lea rbx, [rsp + 0x25]
mov ecx, 0xb
nop
call fcn.00449780
add rsp, 0x30
pop rbp
ret
mov eax, esi
mov ecx, 0xb
call fcn.0045cd80
mov eax, edi
mov ecx, 0xb
nop
call fcn.0045cd80
nop
call fcn.0045aaa0
jmp fcn.004b06c0

Function at 0x4b07a0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4b089d
push rbp
mov rbp, rsp
sub rsp, 0x48
movabs rdx, 0x2b20b76c61765db9
mov qword [rsp + 0x34], rdx
movabs rdx, 0xacda72772b20b76c
mov qword [rsp + 0x38], rdx
movabs rdx, 0x6f11f3b665aa1d31
mov qword [rsp + 0x40], rdx
movabs rdx, 0x70d0c0d110a120d
mov qword [rsp + 0x18], rdx
movabs rdx, 0x10d070706071211
mov qword [rsp + 0x20], rdx
movabs rdx, 0xb050011010d0707
mov qword [rsp + 0x24], rdx
movabs rdx, 0xa0e0713060c0110
mov qword [rsp + 0x2c], rdx
xor eax, eax
jmp 0x4b0840
movzx r9d, byte [rsp + rsi + 0x34]
sub r9d, edx
lea edx, [r9 - 0x23]
mov byte [rsp + rdi + 0x34], dl
lea edx, [r8 - 0x23]
mov byte [rsp + rsi + 0x34], dl
add rax, 2
nop dword [rax]
cmp rax, 0x1c
jge 0x4b086d
movzx edx, byte [rsp + rax + 0x18]
movzx esi, byte [rsp + rax + 0x19]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x14
jae 0x4b0890
movzx r8d, byte [rsp + rdi + 0x34]
sub r8d, edx
cmp rsi, 0x14
jb 0x4b081f
jmp 0x4b0884
xor eax, eax
lea rbx, [rsp + 0x34]
mov ecx, 0x14
call fcn.00449780
add rsp, 0x48
pop rbp
ret
mov eax, esi
mov ecx, 0x14
call fcn.0045cd80
mov eax, edi
mov ecx, 0x14
call fcn.0045cd80
nop
nop dword [rax]
call fcn.0045aaa0
jmp fcn.004b07a0
Function at 0x4b1180
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4b127d
push rbp
mov rbp, rsp
sub rsp, 0x48
movabs rdx, 0xb2a6d23a6b65a40b
mov qword [rsp + 0x34], rdx
movabs rdx, 0x6a6cfe76b2a6d23a
mov qword [rsp + 0x38], rdx
movabs rdx, 0x267d7265684e6304
mov qword [rsp + 0x40], rdx
movabs rdx, 0x9010c070d070c0e
mov qword [rsp + 0x18], rdx
movabs rdx, 0xd1211050c0c0906
mov qword [rsp + 0x20], rdx
movabs rdx, 0xb0d0c090d121105
mov qword [rsp + 0x24], rdx
movabs rdx, 0xb13071109000d05
mov qword [rsp + 0x2c], rdx
xor eax, eax
jmp 0x4b1220
movzx r9d, byte [rsp + rsi + 0x34]
sub r9d, edx
lea edx, [r9 + 0x75]
mov byte [rsp + rdi + 0x34], dl
lea edx, [r8 + 0x75]
mov byte [rsp + rsi + 0x34], dl
add rax, 2
nop dword [rax]
cmp rax, 0x1c
jge 0x4b124d
movzx edx, byte [rsp + rax + 0x18]
movzx esi, byte [rsp + rax + 0x19]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x14
jae 0x4b1270
movzx r8d, byte [rsp + rdi + 0x34]
sub r8d, edx
cmp rsi, 0x14
jb 0x4b11ff
jmp 0x4b1264
xor eax, eax
lea rbx, [rsp + 0x34]
mov ecx, 0x14
call fcn.00449780
add rsp, 0x48
pop rbp
ret
mov eax, esi
mov ecx, 0x14
call fcn.0045cd80
mov eax, edi
mov ecx, 0x14
call fcn.0045cd80
nop
nop dword [rax]
call fcn.0045aaa0
jmp fcn.004b1180

Function at 0x4b2280
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4b2366
push rbp
mov rbp, rsp
sub rsp, 0x40
movabs rdx, 0x2030286c2e252a69
mov qword [rsp + 0x30], rdx
movabs rdx, 0xd76edb6d75a6edb1
mov qword [rsp + 0x38], rdx
movabs rdx, 0x50906060802050a
mov qword [rsp + 0x1e], rdx
movabs rdx, 0x20d050906060802
mov qword [rsp + 0x20], rdx
movabs rdx, 0x2050301010f0d09
mov qword [rsp + 0x28], rdx
xor eax, eax
nop
jmp 0x4b2300
movzx r9d, byte [rsp + rsi + 0x30]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x30]
mov byte [rsp + rdi + 0x30], dl
mov byte [rsp + rsi + 0x30], r8b
add rax, 2
nop dword [rax]
cmp rax, 0x12
jge 0x4b2332
movzx edx, byte [rsp + rax + 0x1e]
movzx esi, byte [rsp + rax + 0x1f]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x10
jae 0x4b2357
movzx r8d, byte [rsp + rdi + 0x30]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x30]
cmp rsi, 0x10
jb 0x4b22e2
jmp 0x4b234b
xor eax, eax
lea rbx, [rsp + 0x30]
mov ecx, 0x10
nop
call fcn.00449780
add rsp, 0x40
pop rbp
ret
mov eax, esi
mov ecx, 0x10
call fcn.0045cd80
mov eax, edi
mov ecx, 0x10
nop
call fcn.0045cd80
nop
call fcn.0045aaa0
jmp fcn.004b2280
Function at 0x4bf340
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4bf46c
push rbp
mov rbp, rsp
sub rsp, 0x60
movabs rdx, 0x7fb74b72a371a6f
mov qword [rsp + 0x43], rdx
movabs rdx, 0xc41954a56cf1c128
mov qword [rsp + 0x4b], rdx
movabs rdx, 0x20ac3fc0bcc41954
mov qword [rsp + 0x50], rdx
movabs rdx, 0x18471b72fd1cbc38
mov qword [rsp + 0x58], rdx
movabs rdx, 0x1b1b090d12151b11
mov qword [rsp + 0x19], rdx
movabs rdx, 0x1a040f1a0c0d1b0a
mov qword [rsp + 0x21], rdx
movabs rdx, 0x16091a040f1a0c0d
mov qword [rsp + 0x23], rdx
movabs rdx, 0x160916111b100302
mov qword [rsp + 0x2b], rdx
movabs rdx, 0xe0e080c090d1301
mov qword [rsp + 0x33], rdx
movabs rdx, 0x71b06181c17011a
mov qword [rsp + 0x3b], rdx
xor eax, eax
jmp 0x4bf406
movzx r9d, byte [rsp + rsi + 0x43]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x28]
mov byte [rsp + rdi + 0x43], dl
mov byte [rsp + rsi + 0x43], r8b
add rax, 2
cmp rax, 0x2a
jge 0x4bf43c
movzx edx, byte [rsp + rax + 0x19]
movzx esi, byte [rsp + rax + 0x1a]
mov edi, edx
xor edx, esi
add edx, eax
nop dword [rax]
cmp rdi, 0x1d
jae 0x4bf45f
movzx r8d, byte [rsp + rdi + 0x43]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x28]
cmp rsi, 0x1d
jb 0x4bf3ec
jmp 0x4bf453
xor eax, eax
lea rbx, [rsp + 0x43]
mov ecx, 0x1d
call fcn.00449780
add rsp, 0x60
pop rbp
ret
mov eax, esi
mov ecx, 0x1d
call fcn.0045cd80
mov eax, edi
mov ecx, 0x1d
call fcn.0045cd80
nop
call fcn.0045aaa0
jmp fcn.004bf340

Function at 0x4c3680
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4c376c
push rbp
mov rbp, rsp
sub rsp, 0x40
movabs rdx, 0x6365ecc02053d917
mov qword [rsp + 0x2e], rdx
movabs rdx, 0xe8696365ecc02053
mov qword [rsp + 0x30], rdx
movabs rdx, 0x72a17cd4b09ee894
mov qword [rsp + 0x38], rdx
movabs rdx, 0x1050a0e000a0d09
mov qword [rsp + 0x18], rdx
movabs rdx, 0x10040f010b0b0105
mov qword [rsp + 0x1e], rdx
movabs rdx, 0xd0c0d0a100e050b
mov qword [rsp + 0x26], rdx
xor eax, eax
jmp 0x4c370a
movzx r9d, byte [rsp + rsi + 0x2e]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x4e]
mov byte [rsp + rdi + 0x2e], dl
mov byte [rsp + rsi + 0x2e], r8b
add rax, 2
cmp rax, 0x16
jge 0x4c373c
movzx edx, byte [rsp + rax + 0x18]
movzx esi, byte [rsp + rax + 0x19]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x12
jae 0x4c375f
movzx r8d, byte [rsp + rdi + 0x2e]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x4e]
cmp rsi, 0x12
jb 0x4c36f0
jmp 0x4c3753
xor eax, eax
lea rbx, [rsp + 0x2e]
mov ecx, 0x12
call fcn.00449780
add rsp, 0x40
pop rbp
ret
mov eax, esi
mov ecx, 0x12
call fcn.0045cd80
mov eax, edi
mov ecx, 0x12
call fcn.0045cd80
nop
call fcn.0045aaa0
jmp fcn.004c3680
Function at 0x4c4a60
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4c4b4a
push rbp
mov rbp, rsp
sub rsp, 0x48
movabs rdx, 0x9c6d80b36e806469
mov qword [rsp + 0x36], rdx
movabs rdx, 0x8a659c6d80b36e80
mov qword [rsp + 0x38], rdx
movabs rdx, 0x877d9f667a5f7f20
mov qword [rsp + 0x40], rdx
movabs rdx, 0xe020c0c0e061003
mov qword [rsp + 0x1e], rdx
movabs rdx, 0x5110905110f0411
mov qword [rsp + 0x26], rdx
movabs rdx, 0xf0b0b070e0d0303
mov qword [rsp + 0x2e], rdx
xor eax, eax
jmp 0x4c4aed
movzx r9d, byte [rsp + rsi + 0x36]
sub r9d, edx
lea edx, [r9 + 0xa]
mov byte [rsp + rdi + 0x36], dl
lea edx, [r8 + 0xa]
mov byte [rsp + rsi + 0x36], dl
add rax, 2
cmp rax, 0x18
jge 0x4c4b1a
movzx edx, byte [rsp + rax + 0x1e]
movzx esi, byte [rsp + rax + 0x1f]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x12
jae 0x4c4b3d
movzx r8d, byte [rsp + rdi + 0x36]
sub r8d, edx
cmp rsi, 0x12
jb 0x4c4ad0
jmp 0x4c4b31
xor eax, eax
lea rbx, [rsp + 0x36]
mov ecx, 0x12
call fcn.00449780
add rsp, 0x48
pop rbp
ret
mov eax, esi
mov ecx, 0x12
call fcn.0045cd80
mov eax, edi
mov ecx, 0x12
call fcn.0045cd80
nop
call fcn.0045aaa0
jmp fcn.004c4a60

Function at 0x4c5300
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4c53fb
push rbp
mov rbp, rsp
sub rsp, 0x50
movabs rdx, 0x6a641c727d766e69
mov qword [rsp + 0x39], rdx
movabs rdx, 0x92799f6e7876726a
mov qword [rsp + 0x40], rdx
movabs rdx, 0x7d56696320748555
mov qword [rsp + 0x48], rdx
movabs rdx, 0x150c110210160a0c
mov qword [rsp + 0x1b], rdx
movabs rdx, 0x150007090a0e0803
mov qword [rsp + 0x23], rdx
movabs rdx, 0xc140a08140f1500
mov qword [rsp + 0x29], rdx
movabs rdx, 0x9020c1606050b
mov qword [rsp + 0x31], rdx
xor eax, eax
jmp 0x4c5399
movzx r9d, byte [rsp + rsi + 0x39]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x20]
mov byte [rsp + rdi + 0x39], dl
mov byte [rsp + rsi + 0x39], r8b
add rax, 2
cmp rax, 0x1e
jge 0x4c53cb
movzx edx, byte [rsp + rax + 0x1b]
movzx esi, byte [rsp + rax + 0x1c]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x17
jae 0x4c53ee
movzx r8d, byte [rsp + rdi + 0x39]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x20]
cmp rsi, 0x17
jb 0x4c537f
jmp 0x4c53e2
xor eax, eax
lea rbx, [rsp + 0x39]
mov ecx, 0x17
call fcn.00449780
add rsp, 0x50
pop rbp
ret
mov eax, esi
mov ecx, 0x17
call fcn.0045cd80
mov eax, edi
mov ecx, 0x17
call fcn.0045cd80
nop
nop dword [rax + rax]
call fcn.0045aaa0
jmp fcn.004c5300
Function at 0x4c5a60
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4c5b4a
push rbp
mov rbp, rsp
sub rsp, 0x40
movabs rdx, 0x756c767b777e6e77
mov qword [rsp + 0x2e], rdx
movabs rdx, 0x7881756c767b777e
mov qword [rsp + 0x30], rdx
movabs rdx, 0x6e38337c659b8775
mov qword [rsp + 0x38], rdx
movabs rdx, 0xf05030804060011
mov qword [rsp + 0x1c], rdx
movabs rdx, 0x100c0f0503080406
mov qword [rsp + 0x1e], rdx
movabs rdx, 0x309090b0e021006
mov qword [rsp + 0x26], rdx
xor eax, eax
jmp 0x4c5aed
movzx r9d, byte [rsp + rsi + 0x2e]
sub r9d, edx
lea edx, [r9 + 0xc]
mov byte [rsp + rdi + 0x2e], dl
lea edx, [r8 + 0xc]
mov byte [rsp + rsi + 0x2e], dl
add rax, 2
cmp rax, 0x12
jge 0x4c5b1a
movzx edx, byte [rsp + rax + 0x1c]
movzx esi, byte [rsp + rax + 0x1d]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x12
jae 0x4c5b3d
movzx r8d, byte [rsp + rdi + 0x2e]
sub r8d, edx
cmp rsi, 0x12
jb 0x4c5ad0
jmp 0x4c5b31
xor eax, eax
lea rbx, [rsp + 0x2e]
mov ecx, 0x12
call fcn.00449780
add rsp, 0x40
pop rbp
ret
mov eax, esi
mov ecx, 0x12
call fcn.0045cd80
mov eax, edi
mov ecx, 0x12
call fcn.0045cd80
nop
call fcn.0045aaa0
jmp fcn.004c5a60

Function at 0x4c8bc0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4c8cf8
push rbp
mov rbp, rsp
sub rsp, 0x68
movabs rdx, 0x1369a9736a26bf20
mov qword [rsp + 0x44], rdx
movabs rdx, 0x224a33671369a973
mov qword [rsp + 0x48], rdx
movabs rdx, 0x9a317030393329e4
mov qword [rsp + 0x50], rdx
movabs rdx, 0x5e65b530293b204a
mov qword [rsp + 0x58], rdx
movabs rdx, 0x4d9dfd17d3943938
mov qword [rsp + 0x60], rdx
movabs rdx, 0xd1b0a0f0e011f02
mov qword [rsp + 0x1a], rdx
movabs rdx, 0x1e210c0918171614
mov qword [rsp + 0x22], rdx
movabs rdx, 0x1d101e210c091817
mov qword [rsp + 0x24], rdx
movabs rdx, 0x5201c1913122303
mov qword [rsp + 0x2c], rdx
movabs rdx, 0x2003200d23090b12
mov qword [rsp + 0x34], rdx
movabs rdx, 0x7221c210e0220
mov qword [rsp + 0x3c], rdx
xor eax, eax
jmp 0x4c8c95
movzx r9d, byte [rsp + rsi + 0x44]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x1f]
mov byte [rsp + rdi + 0x44], dl
mov byte [rsp + rsi + 0x44], r8b
add rax, 2
cmp rax, 0x2a
jge 0x4c8cc8
movzx edx, byte [rsp + rax + 0x1a]
movzx esi, byte [rsp + rax + 0x1b]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x24
jae 0x4c8ceb
movzx r8d, byte [rsp + rdi + 0x44]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x1f]
nop
cmp rsi, 0x24
jb 0x4c8c7b
jmp 0x4c8cdf
xor eax, eax
lea rbx, [rsp + 0x44]
mov ecx, 0x24
call fcn.00449780
add rsp, 0x68
pop rbp
ret
mov eax, esi
mov ecx, 0x24
call fcn.0045cd80
mov eax, edi
mov ecx, 0x24
call fcn.0045cd80
nop
call fcn.0045aaa0
nop dword [rax]
jmp fcn.004c8bc0
Function at 0x4c9ba0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
lea r12, [rsp - 0x10]
cmp r12, qword [r14 + 0x10]
jbe 0x4c9d12
push rbp
mov rbp, rsp
sub rsp, 0x88
movabs rdx, 0xc611c2c1ecf0bd8b
mov qword [rsp + 0x59], rdx
movabs rdx, 0x698476c40fb267de
mov qword [rsp + 0x61], rdx
movabs rdx, 0xc0a236c62000bd69
mov qword [rsp + 0x68], rdx
movabs rdx, 0xc5ec44aac6776da8
mov qword [rsp + 0x70], rdx
movabs rdx, 0x6c2064e56061683a
mov qword [rsp + 0x78], rdx
movabs rdx, 0x8b8b3196d7262a8
mov qword [rsp + 0x80], rdx
movabs rdx, 0x41f2a2e220519
mov qword [rsp + 0x19], rdx
movabs rdx, 0x4002e140a0d0218
mov qword [rsp + 0x21], rdx
movabs rdx, 0x2b031e22082e0311
mov qword [rsp + 0x29], rdx
movabs rdx, 0x40a2a01061d2b16
mov qword [rsp + 0x31], rdx
movabs rdx, 0x19060e151b1c0205
mov qword [rsp + 0x39], rdx
movabs rdx, 0x160b2317060e0b1c
mov qword [rsp + 0x41], rdx
movabs rdx, 0xc1a062d0713061f
mov qword [rsp + 0x49], rdx
movabs rdx, 0x31c1b1017271d2c
mov qword [rsp + 0x51], rdx
xor eax, eax
jmp 0x4c9cad
movzx r9d, byte [rsp + rsi + 0x59]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x5d]
mov byte [rsp + rdi + 0x59], dl
mov byte [rsp + rsi + 0x59], r8b
add rax, 2
cmp rax, 0x40
jge 0x4c9cdf
movzx edx, byte [rsp + rax + 0x19]
movzx esi, byte [rsp + rax + 0x1a]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x2f
jae 0x4c9d05
movzx r8d, byte [rsp + rdi + 0x59]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x5d]
cmp rsi, 0x2f
jb 0x4c9c93
jmp 0x4c9cf9
xor eax, eax
lea rbx, [rsp + 0x59]
mov ecx, 0x2f
call fcn.00449780
add rsp, 0x88
pop rbp
ret
mov eax, esi
mov ecx, 0x2f
call fcn.0045cd80
mov eax, edi
mov ecx, 0x2f
call fcn.0045cd80
nop
call fcn.0045aaa0
jmp fcn.004c9ba0

Function at 0x4cb980
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4cba5d
push rbp
mov rbp, rsp
sub rsp, 0x40
movabs rdx, 0xaea6a9c397a32ac0
mov qword [rsp + 0x32], rdx
movabs rdx, 0x999a6ecf9e20aea6
mov qword [rsp + 0x38], rdx
movabs rdx, 0x9040d070300010d
mov qword [rsp + 0x1e], rdx
movabs rdx, 0xd06090a09040d07
mov qword [rsp + 0x22], rdx
movabs rdx, 0x50c070509020603
mov qword [rsp + 0x2a], rdx
xor eax, eax
nop
jmp 0x4cba00
movzx r9d, byte [rsp + rsi + 0x32]
sub r9d, edx
lea edx, [r9 - 0x1e]
mov byte [rsp + rdi + 0x32], dl
lea edx, [r8 - 0x1e]
mov byte [rsp + rsi + 0x32], dl
add rax, 2
nop
cmp rax, 0x14
jge 0x4cba2d
movzx edx, byte [rsp + rax + 0x1e]
movzx esi, byte [rsp + rax + 0x1f]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0xe
jae 0x4cba50
movzx r8d, byte [rsp + rdi + 0x32]
sub r8d, edx
cmp rsi, 0xe
jb 0x4cb9e2
jmp 0x4cba44
xor eax, eax
lea rbx, [rsp + 0x32]
mov ecx, 0xe
call fcn.00449780
add rsp, 0x40
pop rbp
ret
mov eax, esi
mov ecx, 0xe
call fcn.0045cd80
mov eax, edi
mov ecx, 0xe
call fcn.0045cd80
nop
nop dword [rax]
call fcn.0045aaa0
jmp fcn.004cb980
Function at 0x4cc9e0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4ccb18
push rbp
mov rbp, rsp
sub rsp, 0x70
movabs rdx, 0x1c070b0f7734f36e
mov qword [rsp + 0x4d], rdx
movabs rdx, 0xf828491c070b0f77
mov qword [rsp + 0x50], rdx
movabs rdx, 0x6eaaa4089a65190d
mov qword [rsp + 0x58], rdx
movabs rdx, 0x186e8609b46302b3
mov qword [rsp + 0x60], rdx
movabs rdx, 0x74160ee172206d6f
mov qword [rsp + 0x68], rdx
movabs rdx, 0x22108071c110204
mov qword [rsp + 0x1f], rdx
movabs rdx, 0xc09110e1310211a
mov qword [rsp + 0x27], rdx
movabs rdx, 0x201c1f0909090c09
mov qword [rsp + 0x2d], rdx
movabs rdx, 0x17060a141a180e1c
mov qword [rsp + 0x35], rdx
movabs rdx, 0x1f090b051a210f16
mov qword [rsp + 0x3d], rdx
movabs rdx, 0x130e1001111f071f
mov qword [rsp + 0x45], rdx
xor eax, eax
jmp 0x4ccab5
movzx r9d, byte [rsp + rsi + 0x4d]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x35]
mov byte [rsp + rdi + 0x4d], dl
mov byte [rsp + rsi + 0x4d], r8b
add rax, 2
cmp rax, 0x2e
jge 0x4ccae8
movzx edx, byte [rsp + rax + 0x1f]
movzx esi, byte [rsp + rax + 0x20]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x23
jae 0x4ccb0b
movzx r8d, byte [rsp + rdi + 0x4d]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x35]
nop
cmp rsi, 0x23
jb 0x4cca9b
jmp 0x4ccaff
xor eax, eax
lea rbx, [rsp + 0x4d]
mov ecx, 0x23
call fcn.00449780
add rsp, 0x70
pop rbp
ret
mov eax, esi
mov ecx, 0x23
call fcn.0045cd80
mov eax, edi
mov ecx, 0x23
call fcn.0045cd80
nop
call fcn.0045aaa0
nop dword [rax]
jmp fcn.004cc9e0

Function at 0x4cd660
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4cd718
push rbp
mov rbp, rsp
sub rsp, 0x30
movabs rdx, 0x827d7eba517f6f6e
mov qword [rsp + 0x28], rdx
movabs rdx, 0x207070305070504
mov qword [rsp + 0x1e], rdx
mov word [rsp + 0x26], 0x603
xor eax, eax
jmp 0x4cd6b8
movzx r9d, byte [rsp + rsi + 0x28]
sub r9d, edx
lea edx, [r9 - 0xf]
mov byte [rsp + rdi + 0x28], dl
lea edx, [r8 - 0xf]
mov byte [rsp + rsi + 0x28], dl
add rax, 2
cmp rax, 0xa
jge 0x4cd6e8
movzx edx, byte [rsp + rax + 0x1e]
movzx esi, byte [rsp + rax + 0x1f]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 8
jae 0x4cd70b
movzx r8d, byte [rsp + rdi + 0x28]
sub r8d, edx
nop dword [rax]
cmp rsi, 8
jb 0x4cd69b
jmp 0x4cd6ff
xor eax, eax
lea rbx, [rsp + 0x28]
mov ecx, 8
call fcn.00449780
add rsp, 0x30
pop rbp
ret
mov eax, esi
mov ecx, 8
call fcn.0045cd80
mov eax, edi
mov ecx, 8
call fcn.0045cd80
nop
call fcn.0045aaa0
nop dword [rax]
jmp fcn.004cd660
Function at 0x4cdb80
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4cdc66
push rbp
mov rbp, rsp
sub rsp, 0x40
movabs rdx, 0xce05180b47b4bd23
mov qword [rsp + 0x32], rdx
movabs rdx, 0x65c00ba26512ce05
mov qword [rsp + 0x38], rdx
movabs rdx, 0xc0b0c0802070100
mov qword [rsp + 0x1e], rdx
movabs rdx, 0x30500080c0b0c08
mov qword [rsp + 0x22], rdx
movabs rdx, 0x40a0605050a070b
mov qword [rsp + 0x2a], rdx
xor eax, eax
nop
jmp 0x4cdc00
movzx r9d, byte [rsp + rsi + 0x32]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x4b]
mov byte [rsp + rdi + 0x32], dl
mov byte [rsp + rsi + 0x32], r8b
add rax, 2
nop dword [rax]
cmp rax, 0x14
jge 0x4cdc32
movzx edx, byte [rsp + rax + 0x1e]
movzx esi, byte [rsp + rax + 0x1f]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0xe
jae 0x4cdc57
movzx r8d, byte [rsp + rdi + 0x32]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x4b]
cmp rsi, 0xe
jb 0x4cdbe2
jmp 0x4cdc4b
xor eax, eax
lea rbx, [rsp + 0x32]
mov ecx, 0xe
nop
call fcn.00449780
add rsp, 0x40
pop rbp
ret
mov eax, esi
mov ecx, 0xe
call fcn.0045cd80
mov eax, edi
mov ecx, 0xe
nop
call fcn.0045cd80
nop
call fcn.0045aaa0
jmp fcn.004cdb80

Function at 0x4ce440
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4ce55d
push rbp
mov rbp, rsp
sub rsp, 0x58
movabs rdx, 0xad73af50c7205160
mov qword [rsp + 0x3e], rdx
movabs rdx, 0x6564a0a6729ea68b
mov qword [rsp + 0x46], rdx
movabs rdx, 0xa6736564a0a6729e
mov qword [rsp + 0x48], rdx
movabs rdx, 0x657079fd8e64e472
mov qword [rsp + 0x50], rdx
movabs rdx, 0x10a13130b160516
mov qword [rsp + 0x1c], rdx
movabs rdx, 0xc03010a13130b16
mov qword [rsp + 0x1e], rdx
movabs rdx, 0x103080005070d16
mov qword [rsp + 0x26], rdx
movabs rdx, 0x415081507150a0a
mov qword [rsp + 0x2e], rdx
movabs rdx, 0x90504130c110413
mov qword [rsp + 0x36], rdx
xor eax, eax
jmp 0x4ce500
movzx r9d, byte [rsp + rsi + 0x3e]
sub r9d, edx
lea edx, [r9 - 7]
mov byte [rsp + rdi + 0x3e], dl
lea edx, [r8 - 7]
mov byte [rsp + rsi + 0x3e], dl
add rax, 2
nop word [rax + rax]
cmp rax, 0x22
jge 0x4ce52d
movzx edx, byte [rsp + rax + 0x1c]
movzx esi, byte [rsp + rax + 0x1d]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x1a
jae 0x4ce550
movzx r8d, byte [rsp + rdi + 0x3e]
sub r8d, edx
cmp rsi, 0x1a
jb 0x4ce4dd
jmp 0x4ce544
xor eax, eax
lea rbx, [rsp + 0x3e]
mov ecx, 0x1a
call fcn.00449780
add rsp, 0x58
pop rbp
ret
mov eax, esi
mov ecx, 0x1a
call fcn.0045cd80
mov eax, edi
mov ecx, 0x1a
call fcn.0045cd80
nop
nop dword [rax]
call fcn.0045aaa0
jmp fcn.004ce440