joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4ca0c0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4ca19d
push rbp
mov rbp, rsp
sub rsp, 0x40
movabs rdx, 0xe9c8203aaa6dddec
mov qword [rsp + 0x1a], rdx
movabs rdx, 0x932bdb2da2212114
mov qword [rsp + 0x22], rdx
movabs rdx, 0xd0f070b06060f0f
mov qword [rsp + 0x2a], rdx
movabs rdx, 0xa010a07000b0d0f
mov qword [rsp + 0x30], rdx
movabs rdx, 0xe0906060e03080a
mov qword [rsp + 0x38], rdx
xor eax, eax
nop
jmp 0x4ca140
movzx r9d, byte [rsp + rsi + 0x1a]
sub r9d, edx
lea edx, [r9 + 0x57]
mov byte [rsp + rdi + 0x1a], dl
lea edx, [r8 + 0x57]
mov byte [rsp + rsi + 0x1a], dl
add rax, 2
nop
cmp rax, 0x16
jge 0x4ca16d
movzx edx, byte [rsp + rax + 0x2a]
movzx esi, byte [rsp + rax + 0x2b]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x10
jae 0x4ca190
movzx r8d, byte [rsp + rdi + 0x1a]
sub r8d, edx
cmp rsi, 0x10
jb 0x4ca122
jmp 0x4ca184
xor eax, eax
lea rbx, [rsp + 0x1a]
mov ecx, 0x10
call fcn.00440c20
add rsp, 0x40
pop rbp
ret
mov eax, esi
mov ecx, 0x10
call fcn.00450f00
mov eax, edi
mov ecx, 0x10
call fcn.00450f00
nop
nop dword [rax]
call fcn.0044ec80
jmp fcn.004ca0c0

Function at 0x4ca920
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4caa1b
push rbp
mov rbp, rsp
sub rsp, 0x48
movabs rdx, 0x9cc441a8aa884b0d
mov qword [rsp + 0x19], rdx
movabs rdx, 0x94834774909cc441
mov qword [rsp + 0x1e], rdx
movabs rdx, 0x656d9e728864727d
mov qword [rsp + 0x26], rdx
movabs rdx, 0x205000a101206
mov qword [rsp + 0x2e], rdx
movabs rdx, 0x812031202030507
mov qword [rsp + 0x36], rdx
movabs rdx, 0xd12081203120203
mov qword [rsp + 0x38], rdx
movabs rdx, 0xc110b0c040b0701
mov qword [rsp + 0x40], rdx
xor eax, eax
jmp 0x4ca9b9
movzx r9d, byte [rsp + rsi + 0x19]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x43]
mov byte [rsp + rdi + 0x19], dl
mov byte [rsp + rsi + 0x19], r8b
add rax, 2
cmp rax, 0x1a
jge 0x4ca9eb
movzx edx, byte [rsp + rax + 0x2e]
movzx esi, byte [rsp + rax + 0x2f]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x15
jae 0x4caa0e
movzx r8d, byte [rsp + rdi + 0x19]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x43]
cmp rsi, 0x15
jb 0x4ca99f
jmp 0x4caa02
xor eax, eax
lea rbx, [rsp + 0x19]
mov ecx, 0x15
call fcn.00440c20
add rsp, 0x48
pop rbp
ret
mov eax, esi
mov ecx, 0x15
call fcn.00450f00
mov eax, edi
mov ecx, 0x15
call fcn.00450f00
nop
nop dword [rax + rax]
call fcn.0044ec80
jmp fcn.004ca920
Function at 0x4cb120
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4cb20a
push rbp
mov rbp, rsp
sub rsp, 0x48
movabs rdx, 0x6e1c584e61646d5b
mov qword [rsp + 0x1f], rdx
movabs rdx, 0x5f6e786e1c584e61
mov qword [rsp + 0x22], rdx
movabs rdx, 0x7e6f2a545f645151
mov qword [rsp + 0x2a], rdx
movabs rdx, 0x1205071100040a0c
mov qword [rsp + 0x32], rdx
movabs rdx, 0x7010b0600121205
mov qword [rsp + 0x38], rdx
movabs rdx, 0x12120e0b10080510
mov qword [rsp + 0x40], rdx
xor eax, eax
jmp 0x4cb1ad
movzx r9d, byte [rsp + rsi + 0x1f]
sub r9d, edx
lea edx, [r9 + 0x19]
mov byte [rsp + rdi + 0x1f], dl
lea edx, [r8 + 0x19]
mov byte [rsp + rsi + 0x1f], dl
add rax, 2
cmp rax, 0x16
jge 0x4cb1da
movzx edx, byte [rsp + rax + 0x32]
movzx esi, byte [rsp + rax + 0x33]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x13
jae 0x4cb1fd
movzx r8d, byte [rsp + rdi + 0x1f]
sub r8d, edx
cmp rsi, 0x13
jb 0x4cb190
jmp 0x4cb1f1
xor eax, eax
lea rbx, [rsp + 0x1f]
mov ecx, 0x13
call fcn.00440c20
add rsp, 0x48
pop rbp
ret
mov eax, esi
mov ecx, 0x13
call fcn.00450f00
mov eax, edi
mov ecx, 0x13
call fcn.00450f00
nop
call fcn.0044ec80
jmp fcn.004cb120

Function at 0x4cc0e0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4cc1ca
push rbp
mov rbp, rsp
sub rsp, 0x48
movabs rdx, 0x206e75425c6a6053
mov qword [rsp + 0x1d], rdx
movabs rdx, 0x6451616e74206e75
mov qword [rsp + 0x22], rdx
movabs rdx, 0x656d7e7c2064706f
mov qword [rsp + 0x2a], rdx
movabs rdx, 0x1001208090b0312
mov qword [rsp + 0x32], rdx
movabs rdx, 0x50b0e0b090e0100
mov qword [rsp + 0x38], rdx
movabs rdx, 0x30e0d1104000102
mov qword [rsp + 0x40], rdx
xor eax, eax
jmp 0x4cc16d
movzx r9d, byte [rsp + rsi + 0x1d]
sub r9d, edx
lea edx, [r9 + 0x13]
mov byte [rsp + rdi + 0x1d], dl
lea edx, [r8 + 0x13]
mov byte [rsp + rsi + 0x1d], dl
add rax, 2
cmp rax, 0x16
jge 0x4cc19a
movzx edx, byte [rsp + rax + 0x32]
movzx esi, byte [rsp + rax + 0x33]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x15
jae 0x4cc1bd
movzx r8d, byte [rsp + rdi + 0x1d]
sub r8d, edx
cmp rsi, 0x15
jb 0x4cc150
jmp 0x4cc1b1
xor eax, eax
lea rbx, [rsp + 0x1d]
mov ecx, 0x15
call fcn.00440c20
add rsp, 0x48
pop rbp
ret
mov eax, esi
mov ecx, 0x15
call fcn.00450f00
mov eax, edi
mov ecx, 0x15
call fcn.00450f00
nop
call fcn.0044ec80
jmp fcn.004cc0e0
Function at 0x4cc4e0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4cc5ca
push rbp
mov rbp, rsp
sub rsp, 0x48
movabs rdx, 0xac320b06968d842
mov qword [rsp + 0x1f], rdx
movabs rdx, 0xadb7f20ac320b069
mov qword [rsp + 0x22], rdx
movabs rdx, 0x6922d0a338ad7258
mov qword [rsp + 0x2a], rdx
movabs rdx, 0x801120912070b0e
mov qword [rsp + 0x32], rdx
movabs rdx, 0x6110b11080f0801
mov qword [rsp + 0x38], rdx
movabs rdx, 0xb100710040d010a
mov qword [rsp + 0x40], rdx
xor eax, eax
jmp 0x4cc56d
movzx r9d, byte [rsp + rsi + 0x1f]
sub r9d, edx
lea edx, [r9 - 0x33]
mov byte [rsp + rdi + 0x1f], dl
lea edx, [r8 - 0x33]
mov byte [rsp + rsi + 0x1f], dl
add rax, 2
cmp rax, 0x16
jge 0x4cc59a
movzx edx, byte [rsp + rax + 0x32]
movzx esi, byte [rsp + rax + 0x33]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x13
jae 0x4cc5bd
movzx r8d, byte [rsp + rdi + 0x1f]
sub r8d, edx
cmp rsi, 0x13
jb 0x4cc550
jmp 0x4cc5b1
xor eax, eax
lea rbx, [rsp + 0x1f]
mov ecx, 0x13
call fcn.00440c20
add rsp, 0x48
pop rbp
ret
mov eax, esi
mov ecx, 0x13
call fcn.00450f00
mov eax, edi
mov ecx, 0x13
call fcn.00450f00
nop
call fcn.0044ec80
jmp fcn.004cc4e0
Function at 0x4ccd60
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4cce5d
push rbp
mov rbp, rsp
sub rsp, 0x50
movabs rdx, 0xc16513c34fec65d2
mov qword [rsp + 0x1b], rdx
movabs rdx, 0x4264e6e44cc561c1
mov qword [rsp + 0x22], rdx
movabs rdx, 0x313cb154a7643761
mov qword [rsp + 0x2a], rdx
movabs rdx, 0xd160a1416160015
mov qword [rsp + 0x32], rdx
movabs rdx, 0x14030410090e030a
mov qword [rsp + 0x3a], rdx
movabs rdx, 0x70b1605091403
mov qword [rsp + 0x40], rdx
movabs rdx, 0x912020c0210040a
mov qword [rsp + 0x48], rdx
xor eax, eax
jmp 0x4cce00
movzx r9d, byte [rsp + rsi + 0x1b]
sub r9d, edx
lea edx, [r9 - 0x50]
mov byte [rsp + rdi + 0x1b], dl
lea edx, [r8 - 0x50]
mov byte [rsp + rsi + 0x1b], dl
add rax, 2
nop dword [rax]
cmp rax, 0x1e
jge 0x4cce2d
movzx edx, byte [rsp + rax + 0x32]
movzx esi, byte [rsp + rax + 0x33]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x17
jae 0x4cce50
movzx r8d, byte [rsp + rdi + 0x1b]
sub r8d, edx
cmp rsi, 0x17
jb 0x4ccddf
jmp 0x4cce44
xor eax, eax
lea rbx, [rsp + 0x1b]
mov ecx, 0x17
call fcn.00440c20
add rsp, 0x50
pop rbp
ret
mov eax, esi
mov ecx, 0x17
call fcn.00450f00
mov eax, edi
mov ecx, 0x17
call fcn.00450f00
nop
nop dword [rax]
call fcn.0044ec80
jmp fcn.004ccd60

Function at 0x4ce6e0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4ce7ca
push rbp
mov rbp, rsp
sub rsp, 0x48
movabs rdx, 0x20919dc0699d93ab
mov qword [rsp + 0x1b], rdx
movabs rdx, 0x446e6174f020919d
mov qword [rsp + 0x20], rdx
movabs rdx, 0x65b3dfb2cb64c4da
mov qword [rsp + 0x28], rdx
movabs rdx, 0x6010e0c0f10040d
mov qword [rsp + 0x30], rdx
movabs rdx, 0x2040412080f0e00
mov qword [rsp + 0x38], rdx
movabs rdx, 0xd0c000d11050f13
mov qword [rsp + 0x40], rdx
xor eax, eax
jmp 0x4ce76d
movzx r9d, byte [rsp + rsi + 0x1b]
sub r9d, edx
lea edx, [r9 - 0x23]
mov byte [rsp + rdi + 0x1b], dl
lea edx, [r8 - 0x23]
mov byte [rsp + rsi + 0x1b], dl
add rax, 2
cmp rax, 0x18
jge 0x4ce79a
movzx edx, byte [rsp + rax + 0x30]
movzx esi, byte [rsp + rax + 0x31]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x15
jae 0x4ce7bd
movzx r8d, byte [rsp + rdi + 0x1b]
sub r8d, edx
cmp rsi, 0x15
jb 0x4ce750
jmp 0x4ce7b1
xor eax, eax
lea rbx, [rsp + 0x1b]
mov ecx, 0x15
call fcn.00440c20
add rsp, 0x48
pop rbp
ret
mov eax, esi
mov ecx, 0x15
call fcn.00450f00
mov eax, edi
mov ecx, 0x15
call fcn.00450f00
nop
call fcn.0044ec80
jmp fcn.004ce6e0
Function at 0x4d2420
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4d250a
push rbp
mov rbp, rsp
sub rsp, 0x48
movabs rdx, 0x6a4c565b38604741
mov qword [rsp + 0x1d], rdx
movabs rdx, 0x3b6f61161c6a4c56
mov qword [rsp + 0x22], rdx
movabs rdx, 0x65706954613f4961
mov qword [rsp + 0x2a], rdx
movabs rdx, 0xf100501060c030f
mov qword [rsp + 0x32], rdx
movabs rdx, 0x7090e0510080f10
mov qword [rsp + 0x38], rdx
movabs rdx, 0x3050602040f130b
mov qword [rsp + 0x40], rdx
xor eax, eax
jmp 0x4d24ad
movzx r9d, byte [rsp + rsi + 0x1d]
sub r9d, edx
lea edx, [r9 + 0x24]
mov byte [rsp + rdi + 0x1d], dl
lea edx, [r8 + 0x24]
mov byte [rsp + rsi + 0x1d], dl
add rax, 2
cmp rax, 0x16
jge 0x4d24da
movzx edx, byte [rsp + rax + 0x32]
movzx esi, byte [rsp + rax + 0x33]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x15
jae 0x4d24fd
movzx r8d, byte [rsp + rdi + 0x1d]
sub r8d, edx
cmp rsi, 0x15
jb 0x4d2490
jmp 0x4d24f1
xor eax, eax
lea rbx, [rsp + 0x1d]
mov ecx, 0x15
call fcn.00440c20
add rsp, 0x48
pop rbp
ret
mov eax, esi
mov ecx, 0x15
call fcn.00450f00
mov eax, edi
mov ecx, 0x15
call fcn.00450f00
nop
call fcn.0044ec80
jmp fcn.004d2420

Function at 0x4d2940
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4d2a48
push rbp
mov rbp, rsp
sub rsp, 0x58
movabs rdx, 0x6f6781868ae62e57
mov qword [rsp + 0x1f], rdx
movabs rdx, 0x376174e8937769ec
mov qword [rsp + 0x27], rdx
movabs rdx, 0xa9376174e8937769
mov qword [rsp + 0x28], rdx
movabs rdx, 0x906d9acf7a487261
mov qword [rsp + 0x30], rdx
movabs rdx, 0x4040c14040f1002
mov qword [rsp + 0x38], rdx
movabs rdx, 0x181613020b040803
mov qword [rsp + 0x40], rdx
movabs rdx, 0x30a140305151818
mov qword [rsp + 0x48], rdx
movabs rdx, 0x10051418180b100b
mov qword [rsp + 0x50], rdx
xor eax, eax
jmp 0x4d29eb
movzx r9d, byte [rsp + rsi + 0x1f]
sub r9d, edx
lea edx, [r9 - 0xb]
mov byte [rsp + rdi + 0x1f], dl
lea edx, [r8 - 0xb]
mov byte [rsp + rsi + 0x1f], dl
add rax, 2
cmp rax, 0x20
jge 0x4d2a18
movzx edx, byte [rsp + rax + 0x38]
movzx esi, byte [rsp + rax + 0x39]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x19
jae 0x4d2a3b
movzx r8d, byte [rsp + rdi + 0x1f]
sub r8d, edx
cmp rsi, 0x19
jb 0x4d29ce
jmp 0x4d2a2f
xor eax, eax
lea rbx, [rsp + 0x1f]
mov ecx, 0x19
call fcn.00440c20
add rsp, 0x58
pop rbp
ret
mov eax, esi
mov ecx, 0x19
call fcn.00450f00
mov eax, edi
mov ecx, 0x19
call fcn.00450f00
nop
call fcn.0044ec80
jmp fcn.004d2940
Function at 0x4d3540
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4d362c
push rbp
mov rbp, rsp
sub rsp, 0x48
movabs rdx, 0xb0b661cf6167c828
mov qword [rsp + 0x1d], rdx
movabs rdx, 0x21cb25ce53b0b661
mov qword [rsp + 0x22], rdx
movabs rdx, 0x116d59c820217227
mov qword [rsp + 0x2a], rdx
movabs rdx, 0x120600010b110d04
mov qword [rsp + 0x32], rdx
movabs rdx, 0xf0c0d1211061206
mov qword [rsp + 0x38], rdx
movabs rdx, 0xb0a140909070011
mov qword [rsp + 0x40], rdx
xor eax, eax
jmp 0x4d35ca
movzx r9d, byte [rsp + rsi + 0x1d]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x34]
mov byte [rsp + rdi + 0x1d], dl
mov byte [rsp + rsi + 0x1d], r8b
add rax, 2
cmp rax, 0x16
jge 0x4d35fc
movzx edx, byte [rsp + rax + 0x32]
movzx esi, byte [rsp + rax + 0x33]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x15
jae 0x4d361f
movzx r8d, byte [rsp + rdi + 0x1d]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x34]
cmp rsi, 0x15
jb 0x4d35b0
jmp 0x4d3613
xor eax, eax
lea rbx, [rsp + 0x1d]
mov ecx, 0x15
call fcn.00440c20
add rsp, 0x48
pop rbp
ret
mov eax, esi
mov ecx, 0x15
call fcn.00450f00
mov eax, edi
mov ecx, 0x15
call fcn.00450f00
nop
call fcn.0044ec80
jmp fcn.004d3540

Function at 0x4d3a20
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4d3b1b
push rbp
mov rbp, rsp
sub rsp, 0x48
movabs rdx, 0x619ad3968a97b107
mov qword [rsp + 0x1c], rdx
movabs rdx, 0xbf6e619ad3968a97
mov qword [rsp + 0x1e], rdx
movabs rdx, 0x7f6d693e203c0c61
mov qword [rsp + 0x26], rdx
movabs rdx, 0x401040c0b030003
mov qword [rsp + 0x2e], rdx
movabs rdx, 0x909050301060105
mov qword [rsp + 0x36], rdx
movabs rdx, 0xb02090905030106
mov qword [rsp + 0x38], rdx
movabs rdx, 0x311040e04090504
mov qword [rsp + 0x40], rdx
xor eax, eax
jmp 0x4d3ab9
movzx r9d, byte [rsp + rsi + 0x1c]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x3e]
mov byte [rsp + rdi + 0x1c], dl
mov byte [rsp + rsi + 0x1c], r8b
add rax, 2
cmp rax, 0x1a
jge 0x4d3aeb
movzx edx, byte [rsp + rax + 0x2e]
movzx esi, byte [rsp + rax + 0x2f]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x12
jae 0x4d3b0e
movzx r8d, byte [rsp + rdi + 0x1c]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x3e]
cmp rsi, 0x12
jb 0x4d3a9f
jmp 0x4d3b02
xor eax, eax
lea rbx, [rsp + 0x1c]
mov ecx, 0x12
call fcn.00440c20
add rsp, 0x48
pop rbp
ret
mov eax, esi
mov ecx, 0x12
call fcn.00450f00
mov eax, edi
mov ecx, 0x12
call fcn.00450f00
nop
nop dword [rax + rax]
call fcn.0044ec80
jmp fcn.004d3a20
Function at 0x4d5c80
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4d5d7b
push rbp
mov rbp, rsp
sub rsp, 0x48
movabs rdx, 0x6136430b68337244
mov qword [rsp + 0x1c], rdx
movabs rdx, 0xf3406136430b6833
mov qword [rsp + 0x1e], rdx
movabs rdx, 0x2b46534b40456352
mov qword [rsp + 0x26], rdx
movabs rdx, 0x205100a0b09
mov qword [rsp + 0x2e], rdx
movabs rdx, 0xc0e03050d110306
mov qword [rsp + 0x36], rdx
movabs rdx, 0x30f0c0e03050d11
mov qword [rsp + 0x38], rdx
movabs rdx, 0x80204040c0d0c0b
mov qword [rsp + 0x40], rdx
xor eax, eax
jmp 0x4d5d19
movzx r9d, byte [rsp + rsi + 0x1c]
lea edx, [r9 + rdx]
lea edx, [rdx - 1]
mov byte [rsp + rdi + 0x1c], dl
mov byte [rsp + rsi + 0x1c], r8b
add rax, 2
cmp rax, 0x1a
jge 0x4d5d4b
movzx edx, byte [rsp + rax + 0x2e]
movzx esi, byte [rsp + rax + 0x2f]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x12
jae 0x4d5d6e
movzx r8d, byte [rsp + rdi + 0x1c]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 1]
cmp rsi, 0x12
jb 0x4d5cff
jmp 0x4d5d62
xor eax, eax
lea rbx, [rsp + 0x1c]
mov ecx, 0x12
call fcn.00440c20
add rsp, 0x48
pop rbp
ret
mov eax, esi
mov ecx, 0x12
call fcn.00450f00
mov eax, edi
mov ecx, 0x12
call fcn.00450f00
nop
nop dword [rax + rax]
call fcn.0044ec80
jmp fcn.004d5c80

Function at 0x4d6680
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4d679d
push rbp
mov rbp, rsp
sub rsp, 0x58
movabs rdx, 0x1e35762f29613856
mov qword [rsp + 0x1d], rdx
movabs rdx, 0x53611c4720be6fb3
mov qword [rsp + 0x25], rdx
movabs rdx, 0x9a53611c4720be6f
mov qword [rsp + 0x26], rdx
movabs rdx, 0x432b693d66644b14
mov qword [rsp + 0x2e], rdx
movabs rdx, 0x140d15071410110a
mov qword [rsp + 0x36], rdx
movabs rdx, 0xd10140d15071410
mov qword [rsp + 0x38], rdx
movabs rdx, 0x318060110170611
mov qword [rsp + 0x40], rdx
movabs rdx, 0x1201040d04180818
mov qword [rsp + 0x48], rdx
movabs rdx, 0xf110c0d14040a18
mov qword [rsp + 0x50], rdx
xor eax, eax
jmp 0x4d6740
movzx r9d, byte [rsp + rsi + 0x1d]
sub r9d, edx
lea edx, [r9 + 0x4c]
mov byte [rsp + rdi + 0x1d], dl
lea edx, [r8 + 0x4c]
mov byte [rsp + rsi + 0x1d], dl
add rax, 2
nop word [rax + rax]
cmp rax, 0x22
jge 0x4d676d
movzx edx, byte [rsp + rax + 0x36]
movzx esi, byte [rsp + rax + 0x37]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x19
jae 0x4d6790
movzx r8d, byte [rsp + rdi + 0x1d]
sub r8d, edx
cmp rsi, 0x19
jb 0x4d671d
jmp 0x4d6784
xor eax, eax
lea rbx, [rsp + 0x1d]
mov ecx, 0x19
call fcn.00440c20
add rsp, 0x58
pop rbp
ret
mov eax, esi
mov ecx, 0x19
call fcn.00450f00
mov eax, edi
mov ecx, 0x19
call fcn.00450f00
nop
nop dword [rax]
call fcn.0044ec80
jmp fcn.004d6680
Function at 0x4d9e40
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4d9f2c
push rbp
mov rbp, rsp
sub rsp, 0x48
movabs rdx, 0x7e6f72e9e23ddcdd
mov qword [rsp + 0x19], rdx
movabs rdx, 0x649be974c820657e
mov qword [rsp + 0x20], rdx
movabs rdx, 0x9d6db3f8da647299
mov qword [rsp + 0x28], rdx
movabs rdx, 0x120f13040c041307
mov qword [rsp + 0x30], rdx
movabs rdx, 0x160c0302140216
mov qword [rsp + 0x38], rdx
movabs rdx, 0x130d0114020d030a
mov qword [rsp + 0x40], rdx
xor eax, eax
jmp 0x4d9eca
movzx r9d, byte [rsp + rsi + 0x19]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x64]
mov byte [rsp + rdi + 0x19], dl
mov byte [rsp + rsi + 0x19], r8b
add rax, 2
cmp rax, 0x18
jge 0x4d9efc
movzx edx, byte [rsp + rax + 0x30]
movzx esi, byte [rsp + rax + 0x31]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x17
jae 0x4d9f1f
movzx r8d, byte [rsp + rdi + 0x19]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x64]
cmp rsi, 0x17
jb 0x4d9eb0
jmp 0x4d9f13
xor eax, eax
lea rbx, [rsp + 0x19]
mov ecx, 0x17
call fcn.00440c20
add rsp, 0x48
pop rbp
ret
mov eax, esi
mov ecx, 0x17
call fcn.00450f00
mov eax, edi
mov ecx, 0x17
call fcn.00450f00
nop
call fcn.0044ec80
jmp fcn.004d9e40

Function at 0x4d9f40
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4da038
push rbp
mov rbp, rsp
sub rsp, 0x48
movabs rdx, 0xc2048186b367566
mov qword [rsp + 0x18], rdx
movabs rdx, 0xfb1a610a0c204818
mov qword [rsp + 0x1c], rdx
movabs rdx, 0x4b6d5f4efe645461
mov qword [rsp + 0x24], rdx
movabs rdx, 0x8101104041102
mov qword [rsp + 0x2c], rdx
movabs rdx, 0x50b070f0a13040d
mov qword [rsp + 0x34], rdx
movabs rdx, 0x1105050d050b070f
mov qword [rsp + 0x38], rdx
movabs rdx, 0x70d000700071310
mov qword [rsp + 0x40], rdx
xor eax, eax
jmp 0x4d9fd5
movzx r9d, byte [rsp + rsi + 0x18]
add edx, r9d
mov byte [rsp + rdi + 0x18], dl
mov byte [rsp + rsi + 0x18], r8b
add rax, 2
cmp rax, 0x1c
jge 0x4da008
movzx edx, byte [rsp + rax + 0x2c]
movzx esi, byte [rsp + rax + 0x2d]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x14
jae 0x4da02b
movzx r8d, byte [rsp + rdi + 0x18]
add r8d, edx
nop word [rax + rax]
cmp rsi, 0x14
jb 0x4d9fbf
jmp 0x4da01f
xor eax, eax
lea rbx, [rsp + 0x18]
mov ecx, 0x14
call fcn.00440c20
add rsp, 0x48
pop rbp
ret
mov eax, esi
mov ecx, 0x14
call fcn.00450f00
mov eax, edi
mov ecx, 0x14
call fcn.00450f00
nop
call fcn.0044ec80
nop dword [rax]
jmp fcn.004d9f40
Function at 0x4db360
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4db45d
push rbp
mov rbp, rsp
sub rsp, 0x48
movabs rdx, 0x8d22516981eea79f
mov qword [rsp + 0x1c], rdx
movabs rdx, 0x6dca8d22516981ee
mov qword [rsp + 0x1e], rdx
movabs rdx, 0xada565716f0a1921
mov qword [rsp + 0x26], rdx
movabs rdx, 0x30711060611050b
mov qword [rsp + 0x2e], rdx
movabs rdx, 0x802100c08050a0a
mov qword [rsp + 0x36], rdx
movabs rdx, 0xe100802100c0805
mov qword [rsp + 0x38], rdx
movabs rdx, 0x60305000a060801
mov qword [rsp + 0x40], rdx
xor eax, eax
jmp 0x4db400
movzx r9d, byte [rsp + rsi + 0x1c]
sub r9d, edx
lea edx, [r9 - 0x23]
mov byte [rsp + rdi + 0x1c], dl
lea edx, [r8 - 0x23]
mov byte [rsp + rsi + 0x1c], dl
add rax, 2
nop dword [rax]
cmp rax, 0x1a
jge 0x4db42d
movzx edx, byte [rsp + rax + 0x2e]
movzx esi, byte [rsp + rax + 0x2f]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x12
jae 0x4db450
movzx r8d, byte [rsp + rdi + 0x1c]
sub r8d, edx
cmp rsi, 0x12
jb 0x4db3df
jmp 0x4db444
xor eax, eax
lea rbx, [rsp + 0x1c]
mov ecx, 0x12
call fcn.00440c20
add rsp, 0x48
pop rbp
ret
mov eax, esi
mov ecx, 0x12
call fcn.00450f00
mov eax, edi
mov ecx, 0x12
call fcn.00450f00
nop
nop dword [rax]
call fcn.0044ec80
jmp fcn.004db360

Function at 0x4dcba0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4dccac
push rbp
mov rbp, rsp
sub rsp, 0x58
movabs rdx, 0x556c61725a6e3643
mov qword [rsp + 0x1d], rdx
movabs rdx, 0x203b02574c3e486c
mov qword [rsp + 0x25], rdx
movabs rdx, 0x645f51416c203b02
mov qword [rsp + 0x2a], rdx
movabs rdx, 0x686d385420565e61
mov qword [rsp + 0x32], rdx
movabs rdx, 0x1701131c0c081012
mov qword [rsp + 0x3a], rdx
movabs rdx, 0xa071a1609031109
mov qword [rsp + 0x42], rdx
movabs rdx, 0x3110e170c0d0a07
mov qword [rsp + 0x48], rdx
movabs rdx, 0xc0710101717160b
mov qword [rsp + 0x50], rdx
xor eax, eax
jmp 0x4dcc48
movzx r9d, byte [rsp + rsi + 0x1d]
lea edx, [r9 + rdx]
lea edx, [rdx - 0xd]
mov byte [rsp + rdi + 0x1d], dl
mov byte [rsp + rsi + 0x1d], r8b
add rax, 2
cmp rax, 0x1e
jge 0x4dcc7c
movzx edx, byte [rsp + rax + 0x3a]
movzx esi, byte [rsp + rax + 0x3b]
mov edi, edx
xor edx, esi
add edx, eax
nop
cmp rdi, 0x1d
jae 0x4dcc9f
movzx r8d, byte [rsp + rdi + 0x1d]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0xd]
cmp rsi, 0x1d
jb 0x4dcc2e
jmp 0x4dcc93
xor eax, eax
lea rbx, [rsp + 0x1d]
mov ecx, 0x1d
call fcn.00440c20
add rsp, 0x58
pop rbp
ret
mov eax, esi
mov ecx, 0x1d
call fcn.00450f00
mov eax, edi
mov ecx, 0x1d
call fcn.00450f00
nop
call fcn.0044ec80
jmp fcn.004dcba0
Function at 0x4dd480
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4dd56c
push rbp
mov rbp, rsp
sub rsp, 0x48
movabs rdx, 0x6a55436b83656f4e
mov qword [rsp + 0x1d], rdx
movabs rdx, 0x716e8d74796a5543
mov qword [rsp + 0x22], rdx
movabs rdx, 0x616d715420267c61
mov qword [rsp + 0x2a], rdx
movabs rdx, 0x60c020308090a09
mov qword [rsp + 0x32], rdx
movabs rdx, 0xe0e08030f07060c
mov qword [rsp + 0x38], rdx
movabs rdx, 0x140c040914051212
mov qword [rsp + 0x40], rdx
xor eax, eax
jmp 0x4dd50a
movzx r9d, byte [rsp + rsi + 0x1d]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x16]
mov byte [rsp + rdi + 0x1d], dl
mov byte [rsp + rsi + 0x1d], r8b
add rax, 2
cmp rax, 0x16
jge 0x4dd53c
movzx edx, byte [rsp + rax + 0x32]
movzx esi, byte [rsp + rax + 0x33]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x15
jae 0x4dd55f
movzx r8d, byte [rsp + rdi + 0x1d]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x16]
cmp rsi, 0x15
jb 0x4dd4f0
jmp 0x4dd553
xor eax, eax
lea rbx, [rsp + 0x1d]
mov ecx, 0x15
call fcn.00440c20
add rsp, 0x48
pop rbp
ret
mov eax, esi
mov ecx, 0x15
call fcn.00450f00
mov eax, edi
mov ecx, 0x15
call fcn.00450f00
nop
call fcn.0044ec80
jmp fcn.004dd480

Function at 0x4e42c0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4e43bd
push rbp
mov rbp, rsp
sub rsp, 0x50
movabs rdx, 0x6fd5c9d8755d6444
mov qword [rsp + 0x1f], rdx
movabs rdx, 0x724ae5c46b6fd5c9
mov qword [rsp + 0x24], rdx
movabs rdx, 0x2beef765aaa04469
mov qword [rsp + 0x2c], rdx
movabs rdx, 0x140b0b0e00100f0f
mov qword [rsp + 0x34], rdx
movabs rdx, 0xf04040506090b0b
mov qword [rsp + 0x3c], rdx
movabs rdx, 0x4020a130f040405
mov qword [rsp + 0x40], rdx
movabs rdx, 0xf121010040e0414
mov qword [rsp + 0x48], rdx
xor eax, eax
jmp 0x4e4360
movzx r9d, byte [rsp + rsi + 0x1f]
sub r9d, edx
lea edx, [r9 - 0x57]
mov byte [rsp + rdi + 0x1f], dl
lea edx, [r8 - 0x57]
mov byte [rsp + rsi + 0x1f], dl
add rax, 2
nop dword [rax]
cmp rax, 0x1c
jge 0x4e438d
movzx edx, byte [rsp + rax + 0x34]
movzx esi, byte [rsp + rax + 0x35]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x15
jae 0x4e43b0
movzx r8d, byte [rsp + rdi + 0x1f]
sub r8d, edx
cmp rsi, 0x15
jb 0x4e433f
jmp 0x4e43a4
xor eax, eax
lea rbx, [rsp + 0x1f]
mov ecx, 0x15
call fcn.00440c20
add rsp, 0x50
pop rbp
ret
mov eax, esi
mov ecx, 0x15
call fcn.00450f00
mov eax, edi
mov ecx, 0x15
call fcn.00450f00
nop
nop dword [rax]
call fcn.0044ec80
jmp fcn.004e42c0