joyce8/EMBER2024-capa huggingface dataset:
Function at 0x48cb60
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x48cc4c
push rbp
mov rbp, rsp
sub rsp, 0x48
movabs rdx, 0x6c0c320b36cf975
mov qword [rsp + 0x1b], rdx
movabs rdx, 0x5eae65b26906c0c3
mov qword [rsp + 0x20], rdx
movabs rdx, 0x3120a10a4ec67373
mov qword [rsp + 0x28], rdx
movabs rdx, 0x70b0502110b100c
mov qword [rsp + 0x30], rdx
movabs rdx, 0xc05091010100f01
mov qword [rsp + 0x38], rdx
movabs rdx, 0x6030c0e120f050b
mov qword [rsp + 0x40], rdx
xor eax, eax
jmp 0x48cbea
movzx r9d, byte [rsp + rsi + 0x1b]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x69]
mov byte [rsp + rdi + 0x1b], dl
mov byte [rsp + rsi + 0x1b], r8b
add rax, 2
cmp rax, 0x18
jge 0x48cc1c
movzx edx, byte [rsp + rax + 0x30]
movzx esi, byte [rsp + rax + 0x31]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x15
jae 0x48cc3f
movzx r8d, byte [rsp + rdi + 0x1b]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x69]
cmp rsi, 0x15
jb 0x48cbd0
jmp 0x48cc33
xor eax, eax
lea rbx, [rsp + 0x1b]
mov ecx, 0x15
call fcn.00444ce0
add rsp, 0x48
pop rbp
ret
mov eax, esi
mov ecx, 0x15
call fcn.00456b60
mov eax, edi
mov ecx, 0x15
call fcn.00456b60
nop
call fcn.004548e0
jmp fcn.0048cb60

Function at 0x48d5e0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x48d6cc
push rbp
mov rbp, rsp
sub rsp, 0x40
movabs rdx, 0x2639ba36fe33aabf
mov qword [rsp + 0x18], rdx
movabs rdx, 0xbcd12639ba36fe33
mov qword [rsp + 0x1a], rdx
movabs rdx, 0xa6a32e952e37aab5
mov qword [rsp + 0x22], rdx
movabs rdx, 0x300050800060806
mov qword [rsp + 0x2a], rdx
movabs rdx, 0x90a05110e100300
mov qword [rsp + 0x30], rdx
movabs rdx, 0x111110010b070b
mov qword [rsp + 0x38], rdx
xor eax, eax
jmp 0x48d66a
movzx r9d, byte [rsp + rsi + 0x18]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x6a]
mov byte [rsp + rdi + 0x18], dl
mov byte [rsp + rsi + 0x18], r8b
add rax, 2
cmp rax, 0x16
jge 0x48d69c
movzx edx, byte [rsp + rax + 0x2a]
movzx esi, byte [rsp + rax + 0x2b]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x12
jae 0x48d6bf
movzx r8d, byte [rsp + rdi + 0x18]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x6a]
cmp rsi, 0x12
jb 0x48d650
jmp 0x48d6b3
xor eax, eax
lea rbx, [rsp + 0x18]
mov ecx, 0x12
call fcn.00444ce0
add rsp, 0x40
pop rbp
ret
mov eax, esi
mov ecx, 0x12
call fcn.00456b60
mov eax, edi
mov ecx, 0x12
call fcn.00456b60
nop
call fcn.004548e0
jmp fcn.0048d5e0
Function at 0x48ed00
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x48ede6
push rbp
mov rbp, rsp
sub rsp, 0x40
movabs rdx, 0xee697bf4ee7657a5
mov qword [rsp + 0x1f], rdx
movabs rdx, 0x726f69efe5e065ee
mov qword [rsp + 0x26], rdx
movabs rdx, 0x40c010a00090c05
mov qword [rsp + 0x2e], rdx
movabs rdx, 0xb07040c010a0009
mov qword [rsp + 0x30], rdx
movabs rdx, 0x5030505050a0500
mov qword [rsp + 0x38], rdx
xor eax, eax
nop
jmp 0x48ed80
movzx r9d, byte [rsp + rsi + 0x1f]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x70]
mov byte [rsp + rdi + 0x1f], dl
mov byte [rsp + rsi + 0x1f], r8b
add rax, 2
nop dword [rax]
cmp rax, 0x12
jge 0x48edb2
movzx edx, byte [rsp + rax + 0x2e]
movzx esi, byte [rsp + rax + 0x2f]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0xf
jae 0x48edd7
movzx r8d, byte [rsp + rdi + 0x1f]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x70]
cmp rsi, 0xf
jb 0x48ed62
jmp 0x48edcb
xor eax, eax
lea rbx, [rsp + 0x1f]
mov ecx, 0xf
nop
call fcn.00444ce0
add rsp, 0x40
pop rbp
ret
mov eax, esi
mov ecx, 0xf
call fcn.00456b60
mov eax, edi
mov ecx, 0xf
nop
call fcn.00456b60
nop
call fcn.004548e0
jmp fcn.0048ed00

Function at 0x490ec0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x490fbd
push rbp
mov rbp, rsp
sub rsp, 0x50
movabs rdx, 0xbefc1165da116f63
mov qword [rsp + 0x1c], rdx
movabs rdx, 0xb65a4d6b5c76e23
mov qword [rsp + 0x24], rdx
movabs rdx, 0x7265dc36cc3162cc
mov qword [rsp + 0x2c], rdx
movabs rdx, 0xd0b0f030f06070a
mov qword [rsp + 0x34], rdx
movabs rdx, 0xd1205030c0b0d06
mov qword [rsp + 0x3c], rdx
movabs rdx, 0xf1212150d120503
mov qword [rsp + 0x40], rdx
movabs rdx, 0x807131005020b14
mov qword [rsp + 0x48], rdx
xor eax, eax
jmp 0x490f60
movzx r9d, byte [rsp + rsi + 0x1c]
sub r9d, edx
lea edx, [r9 + 0x6f]
mov byte [rsp + rdi + 0x1c], dl
lea edx, [r8 + 0x6f]
mov byte [rsp + rsi + 0x1c], dl
add rax, 2
nop dword [rax]
cmp rax, 0x1c
jge 0x490f8d
movzx edx, byte [rsp + rax + 0x34]
movzx esi, byte [rsp + rax + 0x35]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x18
jae 0x490fb0
movzx r8d, byte [rsp + rdi + 0x1c]
sub r8d, edx
cmp rsi, 0x18
jb 0x490f3f
jmp 0x490fa4
xor eax, eax
lea rbx, [rsp + 0x1c]
mov ecx, 0x18
call fcn.00444ce0
add rsp, 0x50
pop rbp
ret
mov eax, esi
mov ecx, 0x18
call fcn.00456b60
mov eax, edi
mov ecx, 0x18
call fcn.00456b60
nop
nop dword [rax]
call fcn.004548e0
jmp fcn.00490ec0
Function at 0x490fe0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4910ec
push rbp
mov rbp, rsp
sub rsp, 0x58
movabs rdx, 0x65fbe527cbf4e66e
mov qword [rsp + 0x1f], rdx
movabs rdx, 0x636f6c64fbd0f320
mov qword [rsp + 0x27], rdx
movabs rdx, 0x8d636f6c64fbd0f3
mov qword [rsp + 0x28], rdx
movabs rdx, 0x6475e1edfcee03eb
mov qword [rsp + 0x30], rdx
movabs rdx, 0x1002160b17001214
mov qword [rsp + 0x38], rdx
movabs rdx, 0xa020401171500
mov qword [rsp + 0x40], rdx
movabs rdx, 0x1102050916130603
mov qword [rsp + 0x48], rdx
movabs rdx, 0x130a130613001413
mov qword [rsp + 0x50], rdx
xor eax, eax
jmp 0x491088
movzx r9d, byte [rsp + rsi + 0x1f]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x5f]
mov byte [rsp + rdi + 0x1f], dl
mov byte [rsp + rsi + 0x1f], r8b
add rax, 2
cmp rax, 0x20
jge 0x4910bc
movzx edx, byte [rsp + rax + 0x38]
movzx esi, byte [rsp + rax + 0x39]
mov edi, edx
xor edx, esi
add edx, eax
nop
cmp rdi, 0x19
jae 0x4910df
movzx r8d, byte [rsp + rdi + 0x1f]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x5f]
cmp rsi, 0x19
jb 0x49106e
jmp 0x4910d3
xor eax, eax
lea rbx, [rsp + 0x1f]
mov ecx, 0x19
call fcn.00444ce0
add rsp, 0x58
pop rbp
ret
mov eax, esi
mov ecx, 0x19
call fcn.00456b60
mov eax, edi
mov ecx, 0x19
call fcn.00456b60
nop
call fcn.004548e0
jmp fcn.00490fe0

Function at 0x491940
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x491a2a
push rbp
mov rbp, rsp
sub rsp, 0x40
movabs rdx, 0x635498555b5362b3
mov qword [rsp + 0x18], rdx
movabs rdx, 0x6669635498555b53
mov qword [rsp + 0x1a], rdx
movabs rdx, 0x72f3d563e680636f
mov qword [rsp + 0x22], rdx
movabs rdx, 0x103040c040a06
mov qword [rsp + 0x2a], rdx
movabs rdx, 0x3050c03040e0001
mov qword [rsp + 0x30], rdx
movabs rdx, 0x40506100a0d0f00
mov qword [rsp + 0x38], rdx
xor eax, eax
jmp 0x4919cd
movzx r9d, byte [rsp + rsi + 0x18]
sub r9d, edx
lea edx, [r9 - 0x66]
mov byte [rsp + rdi + 0x18], dl
lea edx, [r8 - 0x66]
mov byte [rsp + rsi + 0x18], dl
add rax, 2
cmp rax, 0x16
jge 0x4919fa
movzx edx, byte [rsp + rax + 0x2a]
movzx esi, byte [rsp + rax + 0x2b]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x12
jae 0x491a1d
movzx r8d, byte [rsp + rdi + 0x18]
sub r8d, edx
cmp rsi, 0x12
jb 0x4919b0
jmp 0x491a11
xor eax, eax
lea rbx, [rsp + 0x18]
mov ecx, 0x12
call fcn.00444ce0
add rsp, 0x40
pop rbp
ret
mov eax, esi
mov ecx, 0x12
call fcn.00456b60
mov eax, edi
mov ecx, 0x12
call fcn.00456b60
nop
call fcn.004548e0
jmp fcn.00491940
Function at 0x493ae0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x493bdb
push rbp
mov rbp, rsp
sub rsp, 0x48
movabs rdx, 0x19c36e9008b19104
mov qword [rsp + 0x1a], rdx
movabs rdx, 0xf4b2ff9f19c36e90
mov qword [rsp + 0x1e], rdx
movabs rdx, 0x6536ef0220659302
mov qword [rsp + 0x26], rdx
movabs rdx, 0x10004060a00100b
mov qword [rsp + 0x2e], rdx
movabs rdx, 0x809120a03070d07
mov qword [rsp + 0x36], rdx
movabs rdx, 0x20a0809120a0307
mov qword [rsp + 0x38], rdx
movabs rdx, 0xc090c0d06120011
mov qword [rsp + 0x40], rdx
xor eax, eax
jmp 0x493b79
movzx r9d, byte [rsp + rsi + 0x1a]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x57]
mov byte [rsp + rdi + 0x1a], dl
mov byte [rsp + rsi + 0x1a], r8b
add rax, 2
cmp rax, 0x1a
jge 0x493bab
movzx edx, byte [rsp + rax + 0x2e]
movzx esi, byte [rsp + rax + 0x2f]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x14
jae 0x493bce
movzx r8d, byte [rsp + rdi + 0x1a]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x57]
cmp rsi, 0x14
jb 0x493b5f
jmp 0x493bc2
xor eax, eax
lea rbx, [rsp + 0x1a]
mov ecx, 0x14
call fcn.00444ce0
add rsp, 0x48
pop rbp
ret
mov eax, esi
mov ecx, 0x14
call fcn.00456b60
mov eax, edi
mov ecx, 0x14
call fcn.00456b60
nop
nop dword [rax + rax]
call fcn.004548e0
jmp fcn.00493ae0

Function at 0x4942a0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4943ac
push rbp
mov rbp, rsp
sub rsp, 0x58
movabs rdx, 0x7927c76c1f767431
mov qword [rsp + 0x1c], rdx
movabs rdx, 0xd0da7973c53fcd6e
mov qword [rsp + 0x24], rdx
movabs rdx, 0x64cf9169d5bdbe7e
mov qword [rsp + 0x2c], rdx
movabs rdx, 0x5161500070a100f
mov qword [rsp + 0x34], rdx
movabs rdx, 0x9070f0305161500
mov qword [rsp + 0x38], rdx
movabs rdx, 0x1101110a0b0e0611
mov qword [rsp + 0x40], rdx
movabs rdx, 0xb0a06130511000b
mov qword [rsp + 0x48], rdx
movabs rdx, 0x16100e0310120907
mov qword [rsp + 0x50], rdx
xor eax, eax
jmp 0x494348
movzx r9d, byte [rsp + rsi + 0x1c]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x30]
mov byte [rsp + rdi + 0x1c], dl
mov byte [rsp + rsi + 0x1c], r8b
add rax, 2
cmp rax, 0x24
jge 0x49437c
movzx edx, byte [rsp + rax + 0x34]
movzx esi, byte [rsp + rax + 0x35]
mov edi, edx
xor edx, esi
add edx, eax
nop
cmp rdi, 0x18
jae 0x49439f
movzx r8d, byte [rsp + rdi + 0x1c]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x30]
cmp rsi, 0x18
jb 0x49432e
jmp 0x494393
xor eax, eax
lea rbx, [rsp + 0x1c]
mov ecx, 0x18
call fcn.00444ce0
add rsp, 0x58
pop rbp
ret
mov eax, esi
mov ecx, 0x18
call fcn.00456b60
mov eax, edi
mov ecx, 0x18
call fcn.00456b60
nop
call fcn.004548e0
jmp fcn.004942a0
Function at 0x495960
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x495a5b
push rbp
mov rbp, rsp
sub rsp, 0x50
movabs rdx, 0x9ead687dfc6eeffe
mov qword [rsp + 0x18], rdx
movabs rdx, 0x374756fb6dc309a
mov qword [rsp + 0x20], rdx
movabs rdx, 0xb767afac18d30b74
mov qword [rsp + 0x28], rdx
movabs rdx, 0x130f041013121304
mov qword [rsp + 0x30], rdx
movabs rdx, 0x15031300170a0914
mov qword [rsp + 0x38], rdx
movabs rdx, 0x50b031213011112
mov qword [rsp + 0x40], rdx
movabs rdx, 0x713071406150817
mov qword [rsp + 0x48], rdx
xor eax, eax
jmp 0x4959f9
movzx r9d, byte [rsp + rsi + 0x18]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x6c]
mov byte [rsp + rdi + 0x18], dl
mov byte [rsp + rsi + 0x18], r8b
add rax, 2
cmp rax, 0x20
jge 0x495a2b
movzx edx, byte [rsp + rax + 0x30]
movzx esi, byte [rsp + rax + 0x31]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x18
jae 0x495a4e
movzx r8d, byte [rsp + rdi + 0x18]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x6c]
cmp rsi, 0x18
jb 0x4959df
jmp 0x495a42
xor eax, eax
lea rbx, [rsp + 0x18]
mov ecx, 0x18
call fcn.00444ce0
add rsp, 0x50
pop rbp
ret
mov eax, esi
mov ecx, 0x18
call fcn.00456b60
mov eax, edi
mov ecx, 0x18
call fcn.00456b60
nop
nop dword [rax + rax]
call fcn.004548e0
jmp fcn.00495960

Function at 0x495d20
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x495e0c
push rbp
mov rbp, rsp
sub rsp, 0x48
movabs rdx, 0x7e896183746f6f84
mov qword [rsp + 0x1f], rdx
movabs rdx, 0x3981897e89618374
mov qword [rsp + 0x22], rdx
movabs rdx, 0x6b6567718d3e5565
mov qword [rsp + 0x2a], rdx
movabs rdx, 0xa080d090f12090c
mov qword [rsp + 0x32], rdx
movabs rdx, 0xc100e0e00040a08
mov qword [rsp + 0x38], rdx
movabs rdx, 0x1209030607040e
mov qword [rsp + 0x40], rdx
xor eax, eax
jmp 0x495daa
movzx r9d, byte [rsp + rsi + 0x1f]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x21]
mov byte [rsp + rdi + 0x1f], dl
mov byte [rsp + rsi + 0x1f], r8b
add rax, 2
cmp rax, 0x16
jge 0x495ddc
movzx edx, byte [rsp + rax + 0x32]
movzx esi, byte [rsp + rax + 0x33]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x13
jae 0x495dff
movzx r8d, byte [rsp + rdi + 0x1f]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x21]
cmp rsi, 0x13
jb 0x495d90
jmp 0x495df3
xor eax, eax
lea rbx, [rsp + 0x1f]
mov ecx, 0x13
call fcn.00444ce0
add rsp, 0x48
pop rbp
ret
mov eax, esi
mov ecx, 0x13
call fcn.00456b60
mov eax, edi
mov ecx, 0x13
call fcn.00456b60
nop
call fcn.004548e0
jmp fcn.00495d20
Function at 0x496540
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x49662c
push rbp
mov rbp, rsp
sub rsp, 0x48
movabs rdx, 0xc78aec59228b697c
mov qword [rsp + 0x1e], rdx
movabs rdx, 0x302c78aec59228b
mov qword [rsp + 0x20], rdx
movabs rdx, 0x956e6fe0b5b5f674
mov qword [rsp + 0x28], rdx
movabs rdx, 0x60b090707041100
mov qword [rsp + 0x30], rdx
movabs rdx, 0xb000300040d0802
mov qword [rsp + 0x38], rdx
movabs rdx, 0xb0c05080d0c110e
mov qword [rsp + 0x40], rdx
xor eax, eax
jmp 0x4965ca
movzx r9d, byte [rsp + rsi + 0x1e]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x58]
mov byte [rsp + rdi + 0x1e], dl
mov byte [rsp + rsi + 0x1e], r8b
add rax, 2
cmp rax, 0x18
jge 0x4965fc
movzx edx, byte [rsp + rax + 0x30]
movzx esi, byte [rsp + rax + 0x31]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x12
jae 0x49661f
movzx r8d, byte [rsp + rdi + 0x1e]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x58]
cmp rsi, 0x12
jb 0x4965b0
jmp 0x496613
xor eax, eax
lea rbx, [rsp + 0x1e]
mov ecx, 0x12
call fcn.00444ce0
add rsp, 0x48
pop rbp
ret
mov eax, esi
mov ecx, 0x12
call fcn.00456b60
mov eax, edi
mov ecx, 0x12
call fcn.00456b60
nop
call fcn.004548e0
jmp fcn.00496540

Function at 0x497060
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x497168
push rbp
mov rbp, rsp
sub rsp, 0x58
movabs rdx, 0xc96e28cb266f167b
mov qword [rsp + 0x1d], rdx
movabs rdx, 0xd466206e65156f20
mov qword [rsp + 0x25], rdx
movabs rdx, 0x6969212477d46620
mov qword [rsp + 0x2a], rdx
movabs rdx, 0x6dbde4d9237a186e
mov qword [rsp + 0x32], rdx
movabs rdx, 0x1604100f0713131b
mov qword [rsp + 0x3a], rdx
movabs rdx, 0x1a0f031719000a01
mov qword [rsp + 0x42], rdx
movabs rdx, 0x3031a1b12191a0f
mov qword [rsp + 0x48], rdx
movabs rdx, 0x1105181a000f1012
mov qword [rsp + 0x50], rdx
xor eax, eax
jmp 0x49710b
movzx r9d, byte [rsp + rsi + 0x1d]
sub r9d, edx
lea edx, [r9 + 0x6d]
mov byte [rsp + rdi + 0x1d], dl
lea edx, [r8 + 0x6d]
mov byte [rsp + rsi + 0x1d], dl
add rax, 2
cmp rax, 0x1e
jge 0x497138
movzx edx, byte [rsp + rax + 0x3a]
movzx esi, byte [rsp + rax + 0x3b]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x1d
jae 0x49715b
movzx r8d, byte [rsp + rdi + 0x1d]
sub r8d, edx
cmp rsi, 0x1d
jb 0x4970ee
jmp 0x49714f
xor eax, eax
lea rbx, [rsp + 0x1d]
mov ecx, 0x1d
call fcn.00444ce0
add rsp, 0x58
pop rbp
ret
mov eax, esi
mov ecx, 0x1d
call fcn.00456b60
mov eax, edi
mov ecx, 0x1d
call fcn.00456b60
nop
call fcn.004548e0
jmp fcn.00497060
Function at 0x498c80
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x498d8c
push rbp
mov rbp, rsp
sub rsp, 0x50
movabs rdx, 0x718589a96d209891
mov qword [rsp + 0x18], rdx
movabs rdx, 0x65c7209287be726b
mov qword [rsp + 0x20], rdx
movabs rdx, 0x69b965c7209287be
mov qword [rsp + 0x22], rdx
movabs rdx, 0x65708eb52064b327
mov qword [rsp + 0x2a], rdx
movabs rdx, 0xa0016100e100c04
mov qword [rsp + 0x32], rdx
movabs rdx, 0x1316060e00010517
mov qword [rsp + 0x3a], rdx
movabs rdx, 0xb06170c100c1316
mov qword [rsp + 0x40], rdx
movabs rdx, 0x80709121616120a
mov qword [rsp + 0x48], rdx
xor eax, eax
jmp 0x498d28
movzx r9d, byte [rsp + rsi + 0x18]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x35]
mov byte [rsp + rdi + 0x18], dl
mov byte [rsp + rsi + 0x18], r8b
add rax, 2
cmp rax, 0x1e
jge 0x498d5c
movzx edx, byte [rsp + rax + 0x32]
movzx esi, byte [rsp + rax + 0x33]
mov edi, edx
xor edx, esi
add edx, eax
nop
cmp rdi, 0x1a
jae 0x498d7f
movzx r8d, byte [rsp + rdi + 0x18]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x35]
cmp rsi, 0x1a
jb 0x498d0e
jmp 0x498d73
xor eax, eax
lea rbx, [rsp + 0x18]
mov ecx, 0x1a
call fcn.00444ce0
add rsp, 0x50
pop rbp
ret
mov eax, esi
mov ecx, 0x1a
call fcn.00456b60
mov eax, edi
mov ecx, 0x1a
call fcn.00456b60
nop
call fcn.004548e0
jmp fcn.00498c80

Function at 0x4993c0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4994aa
push rbp
mov rbp, rsp
sub rsp, 0x48
movabs rdx, 0x8c94b4835b206fa3
mov qword [rsp + 0x19], rdx
movabs rdx, 0x82207490f2a2208c
mov qword [rsp + 0x20], rdx
movabs rdx, 0x91639bab657fb56e
mov qword [rsp + 0x28], rdx
movabs rdx, 0xb16101405110600
mov qword [rsp + 0x30], rdx
movabs rdx, 0xa11070e13100003
mov qword [rsp + 0x38], rdx
movabs rdx, 0x406140911061000
mov qword [rsp + 0x40], rdx
xor eax, eax
jmp 0x49944d
movzx r9d, byte [rsp + rsi + 0x19]
sub r9d, edx
lea edx, [r9 - 8]
mov byte [rsp + rdi + 0x19], dl
lea edx, [r8 - 8]
mov byte [rsp + rsi + 0x19], dl
add rax, 2
cmp rax, 0x18
jge 0x49947a
movzx edx, byte [rsp + rax + 0x30]
movzx esi, byte [rsp + rax + 0x31]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x17
jae 0x49949d
movzx r8d, byte [rsp + rdi + 0x19]
sub r8d, edx
cmp rsi, 0x17
jb 0x499430
jmp 0x499491
xor eax, eax
lea rbx, [rsp + 0x19]
mov ecx, 0x17
call fcn.00444ce0
add rsp, 0x48
pop rbp
ret
mov eax, esi
mov ecx, 0x17
call fcn.00456b60
mov eax, edi
mov ecx, 0x17
call fcn.00456b60
nop
call fcn.004548e0
jmp fcn.004993c0
Function at 0x499a40
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x499b2c
push rbp
mov rbp, rsp
sub rsp, 0x48
movabs rdx, 0x6e726b636d7c8264
mov qword [rsp + 0x1f], rdx
movabs rdx, 0x7173856e726b636d
mov qword [rsp + 0x22], rdx
movabs rdx, 0x8d7470718320802a
mov qword [rsp + 0x2a], rdx
movabs rdx, 0xe0712120f0c0801
mov qword [rsp + 0x32], rdx
movabs rdx, 0xb09020907080e07
mov qword [rsp + 0x38], rdx
movabs rdx, 0x6020105030c020a
mov qword [rsp + 0x40], rdx
xor eax, eax
jmp 0x499aca
movzx r9d, byte [rsp + rsi + 0x1f]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x18]
mov byte [rsp + rdi + 0x1f], dl
mov byte [rsp + rsi + 0x1f], r8b
add rax, 2
cmp rax, 0x16
jge 0x499afc
movzx edx, byte [rsp + rax + 0x32]
movzx esi, byte [rsp + rax + 0x33]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x13
jae 0x499b1f
movzx r8d, byte [rsp + rdi + 0x1f]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x18]
cmp rsi, 0x13
jb 0x499ab0
jmp 0x499b13
xor eax, eax
lea rbx, [rsp + 0x1f]
mov ecx, 0x13
call fcn.00444ce0
add rsp, 0x48
pop rbp
ret
mov eax, esi
mov ecx, 0x13
call fcn.00456b60
mov eax, edi
mov ecx, 0x13
call fcn.00456b60
nop
call fcn.004548e0
jmp fcn.00499a40

Function at 0x49a940
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x49aa52
push rbp
mov rbp, rsp
sub rsp, 0x58
movabs rdx, 0x20688da8df86736e
mov qword [rsp + 0x1b], rdx
movabs rdx, 0xa57f8a639da58d90
mov qword [rsp + 0x23], rdx
movabs rdx, 0xc1a57f8a639da58d
mov qword [rsp + 0x24], rdx
movabs rdx, 0x7397c6bdc764b6bd
mov qword [rsp + 0x2c], rdx
movabs rdx, 0x8010a171212040e
mov qword [rsp + 0x34], rdx
movabs rdx, 0x120d0e1008010a17
mov qword [rsp + 0x38], rdx
movabs rdx, 0x20309150b171409
mov qword [rsp + 0x40], rdx
movabs rdx, 0x501020f1102100f
mov qword [rsp + 0x48], rdx
movabs rdx, 0x90d110b0e160916
mov qword [rsp + 0x50], rdx
xor eax, eax
jmp 0x49a9f4
movzx r9d, byte [rsp + rsi + 0x1b]
sub r9d, edx
mov byte [rsp + rdi + 0x1b], r9b
mov byte [rsp + rsi + 0x1b], r8b
add rax, 2
cmp rax, 0x24
jge 0x49aa22
movzx edx, byte [rsp + rax + 0x34]
movzx esi, byte [rsp + rax + 0x35]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x19
jae 0x49aa45
movzx r8d, byte [rsp + rdi + 0x1b]
sub r8d, edx
cmp rsi, 0x19
jb 0x49a9dd
nop
jmp 0x49aa39
xor eax, eax
lea rbx, [rsp + 0x1b]
mov ecx, 0x19
call fcn.00444ce0
add rsp, 0x58
pop rbp
ret
mov eax, esi
mov ecx, 0x19
call fcn.00456b60
mov eax, edi
mov ecx, 0x19
call fcn.00456b60
nop
call fcn.004548e0
jmp fcn.0049a940
Function at 0x49acc0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x49adc8
push rbp
mov rbp, rsp
sub rsp, 0x58
movabs rdx, 0xe1863d0ed6f7203
mov qword [rsp + 0x1d], rdx
movabs rdx, 0x8279cd5fc619741f
mov qword [rsp + 0x25], rdx
movabs rdx, 0x7320746fc98279cd
mov qword [rsp + 0x2a], rdx
movabs rdx, 0x64651ad46f5570d8
mov qword [rsp + 0x32], rdx
movabs rdx, 0x90d0d17100d0c00
mov qword [rsp + 0x3a], rdx
movabs rdx, 0xf190f190009150d
mov qword [rsp + 0x42], rdx
movabs rdx, 0x101a070a060b0f19
mov qword [rsp + 0x48], rdx
movabs rdx, 0x150d0d0309060804
mov qword [rsp + 0x50], rdx
xor eax, eax
jmp 0x49ad6b
movzx r9d, byte [rsp + rsi + 0x1d]
sub r9d, edx
lea edx, [r9 + 0x72]
mov byte [rsp + rdi + 0x1d], dl
lea edx, [r8 + 0x72]
mov byte [rsp + rsi + 0x1d], dl
add rax, 2
cmp rax, 0x1e
jge 0x49ad98
movzx edx, byte [rsp + rax + 0x3a]
movzx esi, byte [rsp + rax + 0x3b]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x1d
jae 0x49adbb
movzx r8d, byte [rsp + rdi + 0x1d]
sub r8d, edx
cmp rsi, 0x1d
jb 0x49ad4e
jmp 0x49adaf
xor eax, eax
lea rbx, [rsp + 0x1d]
mov ecx, 0x1d
call fcn.00444ce0
add rsp, 0x58
pop rbp
ret
mov eax, esi
mov ecx, 0x1d
call fcn.00456b60
mov eax, edi
mov ecx, 0x1d
call fcn.00456b60
nop
call fcn.004548e0
jmp fcn.0049acc0

Function at 0x49d160
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x49d26c
push rbp
mov rbp, rsp
sub rsp, 0x50
movabs rdx, 0x3f2950374549ec73
mov qword [rsp + 0x19], rdx
movabs rdx, 0x20746fde2d65702c
mov qword [rsp + 0x21], rdx
movabs rdx, 0xdd20746fde2d6570
mov qword [rsp + 0x22], rdx
movabs rdx, 0xd15974f9ee4e7075
mov qword [rsp + 0x2a], rdx
movabs rdx, 0x40b010410181804
mov qword [rsp + 0x32], rdx
movabs rdx, 0x40c031501141317
mov qword [rsp + 0x3a], rdx
movabs rdx, 0x40618060501040c
mov qword [rsp + 0x40], rdx
movabs rdx, 0x1408020504070203
mov qword [rsp + 0x48], rdx
xor eax, eax
jmp 0x49d208
movzx r9d, byte [rsp + rsi + 0x19]
lea edx, [r9 + rdx]
lea edx, [rdx + 0xb]
mov byte [rsp + rdi + 0x19], dl
mov byte [rsp + rsi + 0x19], r8b
add rax, 2
cmp rax, 0x1e
jge 0x49d23c
movzx edx, byte [rsp + rax + 0x32]
movzx esi, byte [rsp + rax + 0x33]
mov edi, edx
xor edx, esi
add edx, eax
nop
cmp rdi, 0x19
jae 0x49d25f
movzx r8d, byte [rsp + rdi + 0x19]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0xb]
cmp rsi, 0x19
jb 0x49d1ee
jmp 0x49d253
xor eax, eax
lea rbx, [rsp + 0x19]
mov ecx, 0x19
call fcn.00444ce0
add rsp, 0x50
pop rbp
ret
mov eax, esi
mov ecx, 0x19
call fcn.00456b60
mov eax, edi
mov ecx, 0x19
call fcn.00456b60
nop
call fcn.004548e0
jmp fcn.0049d160