joyce8/EMBER2024-capa huggingface dataset:
Function at 0x496340
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x49640c
push rbp
mov rbp, rsp
sub rsp, 0x30
movabs rdx, 0x838c7261b7a24cbd
mov qword [rsp + 0x19], rdx
movabs rdx, 0x657a9b838c7261b7
mov qword [rsp + 0x1c], rdx
movabs rdx, 0x602010302000808
mov qword [rsp + 0x24], rdx
mov dword [rsp + 0x2c], 0x70101
xor eax, eax
jmp 0x4963a5
movzx r9d, byte [rsp + rsi + 0x19]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x32]
mov byte [rsp + rdi + 0x19], dl
mov byte [rsp + rsi + 0x19], r8b
add rax, 2
cmp rax, 0xc
jge 0x4963dc
movzx edx, byte [rsp + rax + 0x24]
movzx esi, byte [rsp + rax + 0x25]
mov edi, edx
xor edx, esi
add edx, eax
nop dword [rax + rax]
cmp rdi, 0xb
jae 0x4963ff
movzx r8d, byte [rsp + rdi + 0x19]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x32]
cmp rsi, 0xb
jb 0x49638b
jmp 0x4963f3
xor eax, eax
lea rbx, [rsp + 0x19]
mov ecx, 0xb
call fcn.00441380
add rsp, 0x30
pop rbp
ret
mov eax, esi
mov ecx, 0xb
call fcn.00451880
mov eax, edi
mov ecx, 0xb
call fcn.00451880
nop
call fcn.0044f600
jmp fcn.00496340
Function at 0x499160
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x49922c
push rbp
mov rbp, rsp
sub rsp, 0x38
movabs rdx, 0x74af46af78659591
mov qword [rsp + 0x1a], rdx
movabs rdx, 0x46ba45ed64a074af
mov qword [rsp + 0x20], rdx
movabs rdx, 0x60c05000a050800
mov qword [rsp + 0x28], rdx
movabs rdx, 0x4060c0801000400
mov qword [rsp + 0x30], rdx
xor eax, eax
jmp 0x4991cf
movzx r9d, byte [rsp + rsi + 0x1a]
sub r9d, edx
lea edx, [r9 - 0x15]
mov byte [rsp + rdi + 0x1a], dl
lea edx, [r8 - 0x15]
mov byte [rsp + rsi + 0x1a], dl
add rax, 2
cmp rax, 0x10
jge 0x4991fc
movzx edx, byte [rsp + rax + 0x28]
movzx esi, byte [rsp + rax + 0x29]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0xe
jae 0x49921f
movzx r8d, byte [rsp + rdi + 0x1a]
sub r8d, edx
cmp rsi, 0xe
jb 0x4991b2
jmp 0x499213
xor eax, eax
lea rbx, [rsp + 0x1a]
mov ecx, 0xe
call fcn.00441380
add rsp, 0x38
pop rbp
ret
mov eax, esi
mov ecx, 0xe
call fcn.00451880
mov eax, edi
mov ecx, 0xe
call fcn.00451880
nop
call fcn.0044f600
jmp fcn.00499160

Function at 0x499240
Capabilities:
Encrypt data using rc4 prga

Disassembly:
lea r12, [rsp - 0x10]
cmp r12, qword [r14 + 0x10]
jbe 0x4993b2
push rbp
mov rbp, rsp
sub rsp, 0x88
movabs rdx, 0x1ff870cb81bbbe3d
mov qword [rsp + 0x1d], rdx
movabs rdx, 0xeee0f3c4619a5905
mov qword [rsp + 0x25], rdx
movabs rdx, 0xd3dfe6eee0f3c461
mov qword [rsp + 0x28], rdx
movabs rdx, 0x466e72ee5b8ec7d4
mov qword [rsp + 0x30], rdx
movabs rdx, 0x20d34261d02070e7
mov qword [rsp + 0x38], rdx
movabs rdx, 0x226f724dae32f7aa
mov qword [rsp + 0x40], rdx
movabs rdx, 0x11423231a201127
mov qword [rsp + 0x48], rdx
movabs rdx, 0x21042525030c0306
mov qword [rsp + 0x50], rdx
movabs rdx, 0x71a250a25161c25
mov qword [rsp + 0x58], rdx
movabs rdx, 0x111e090608151708
mov qword [rsp + 0x60], rdx
movabs rdx, 0x202414131e240212
mov qword [rsp + 0x68], rdx
movabs rdx, 0xe00260d131a2a13
mov qword [rsp + 0x70], rdx
movabs rdx, 0x101b121b15201312
mov qword [rsp + 0x78], rdx
movabs rdx, 0x61017130e090f15
mov qword [rsp + 0x80], rdx
xor eax, eax
jmp 0x499350
movzx r9d, byte [rsp + rsi + 0x1d]
sub r9d, edx
lea edx, [r9 - 0x37]
mov byte [rsp + rdi + 0x1d], dl
lea edx, [r8 - 0x37]
mov byte [rsp + rsi + 0x1d], dl
add rax, 2
cmp rax, 0x40
jge 0x49937d
movzx edx, byte [rsp + rax + 0x48]
movzx esi, byte [rsp + rax + 0x49]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x2b
jae 0x4993a5
movzx r8d, byte [rsp + rdi + 0x1d]
sub r8d, edx
cmp rsi, 0x2b
jb 0x499333
jmp 0x499397
xor eax, eax
lea rbx, [rsp + 0x1d]
mov ecx, 0x2b
call fcn.00441380
add rsp, 0x88
pop rbp
ret
mov eax, esi
mov ecx, 0x2b
nop
call fcn.00451880
mov eax, edi
mov ecx, 0x2b
call fcn.00451880
nop
call fcn.0044f600
jmp fcn.00499240
Function at 0x4993c0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4994bb
push rbp
mov rbp, rsp
sub rsp, 0x50
movabs rdx, 0x6e69393a35006575
mov qword [rsp + 0x1e], rdx
movabs rdx, 0x4a3f10366e69393a
mov qword [rsp + 0x22], rdx
movabs rdx, 0xed274759682c1421
mov qword [rsp + 0x2a], rdx
movabs rdx, 0x80d0c080d0c1013
mov qword [rsp + 0x32], rdx
movabs rdx, 0x1210090b0e000d02
mov qword [rsp + 0x3a], rdx
movabs rdx, 0x101103000e101210
mov qword [rsp + 0x40], rdx
movabs rdx, 0xb08120b05110c0a
mov qword [rsp + 0x48], rdx
xor eax, eax
jmp 0x499459
movzx r9d, byte [rsp + rsi + 0x1e]
lea edx, [r9 + rdx]
lea edx, [rdx + 9]
mov byte [rsp + rdi + 0x1e], dl
mov byte [rsp + rsi + 0x1e], r8b
add rax, 2
cmp rax, 0x1e
jge 0x49948b
movzx edx, byte [rsp + rax + 0x32]
movzx esi, byte [rsp + rax + 0x33]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x14
jae 0x4994ae
movzx r8d, byte [rsp + rdi + 0x1e]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 9]
cmp rsi, 0x14
jb 0x49943f
jmp 0x4994a2
xor eax, eax
lea rbx, [rsp + 0x1e]
mov ecx, 0x14
call fcn.00441380
add rsp, 0x50
pop rbp
ret
mov eax, esi
mov ecx, 0x14
call fcn.00451880
mov eax, edi
mov ecx, 0x14
call fcn.00451880
nop
nop dword [rax + rax]
call fcn.0044f600
jmp fcn.004993c0

Function at 0x49b9a0
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x49ba6a
push rbp
mov rbp, rsp
sub rsp, 0x48
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x58], rax
mov qword [rsp], rax
mov qword [rsp + 8], rbx
mov byte [rsp + 0x10], 0
call fcn.00403080
xorps xmm15, xmm15
mov r14, qword [0x00788990]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x18], 0xffffffffffffffff
jne 0x49ba4f
mov rcx, qword [rsp + 0x60]
lea rdx, [rcx + 1]
mov qword [rsp + 0x40], rdx
lea rax, [0x0051d5c0]
xor ebx, ebx
mov rcx, rdx
call fcn.0043dec0
mov rbx, qword [rsp + 0x60]
mov rcx, rax
xor edi, edi
mov rsi, qword [rsp + 0x40]
mov rax, qword [rsp + 0x58]
nop dword [rax]
call fcn.0049d580
inc rbx
cmp rcx, rbx
jae 0x49ba3e
mov edi, 1
lea rsi, [0x0051d5c0]
call fcn.0043dfa0
mov word [rax + rbx*2 - 2], 0
xor edi, edi
xor esi, esi
add rsp, 0x48
pop rbp
ret
xor eax, eax
xor ebx, ebx
mov rcx, rbx
lea rdi, [0x006a3358]
lea rsi, [0x006a2fc0]
add rsp, 0x48
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.0044f600
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.0049b9a0
Function at 0x49bfa0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x49c05d
push rbp
mov rbp, rsp
sub rsp, 0x30
movabs rdx, 0x70372b72338b3efd
mov qword [rsp + 0x1b], rdx
mov byte [rsp + 0x23], 0x30
movabs rdx, 0x106030502030808
mov qword [rsp + 0x24], rdx
mov dword [rsp + 0x2c], 0x50005
xor eax, eax
nop
jmp 0x49c000
movzx r9d, byte [rsp + rsi + 0x1b]
sub r9d, edx
lea edx, [r9 + 0x44]
mov byte [rsp + rdi + 0x1b], dl
lea edx, [r8 + 0x44]
mov byte [rsp + rsi + 0x1b], dl
add rax, 2
nop
cmp rax, 0xc
jge 0x49c02d
movzx edx, byte [rsp + rax + 0x24]
movzx esi, byte [rsp + rax + 0x25]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 9
jae 0x49c050
movzx r8d, byte [rsp + rdi + 0x1b]
sub r8d, edx
cmp rsi, 9
jb 0x49bfe2
jmp 0x49c044
xor eax, eax
lea rbx, [rsp + 0x1b]
mov ecx, 9
call fcn.00441380
add rsp, 0x30
pop rbp
ret
mov eax, esi
mov ecx, 9
call fcn.00451880
mov eax, edi
mov ecx, 9
call fcn.00451880
nop
nop dword [rax]
call fcn.0044f600
jmp fcn.0049bfa0

Function at 0x49c340
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x49c42c
push rbp
mov rbp, rsp
sub rsp, 0x48
movabs rdx, 0xcd622fd663493274
mov qword [rsp + 0x1b], rdx
movabs rdx, 0xcac8b4dd65cd622f
mov qword [rsp + 0x20], rdx
movabs rdx, 0x70287234c2be6ef9
mov qword [rsp + 0x28], rdx
movabs rdx, 0x11010f1302040d0d
mov qword [rsp + 0x30], rdx
movabs rdx, 0x1107100a090d0a0d
mov qword [rsp + 0x38], rdx
movabs rdx, 0xf010b090d10040c
mov qword [rsp + 0x40], rdx
xor eax, eax
jmp 0x49c3ca
movzx r9d, byte [rsp + rsi + 0x1b]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x7d]
mov byte [rsp + rdi + 0x1b], dl
mov byte [rsp + rsi + 0x1b], r8b
add rax, 2
cmp rax, 0x18
jge 0x49c3fc
movzx edx, byte [rsp + rax + 0x30]
movzx esi, byte [rsp + rax + 0x31]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x15
jae 0x49c41f
movzx r8d, byte [rsp + rdi + 0x1b]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x7d]
cmp rsi, 0x15
jb 0x49c3b0
jmp 0x49c413
xor eax, eax
lea rbx, [rsp + 0x1b]
mov ecx, 0x15
call fcn.00441380
add rsp, 0x48
pop rbp
ret
mov eax, esi
mov ecx, 0x15
call fcn.00451880
mov eax, edi
mov ecx, 0x15
call fcn.00451880
nop
call fcn.0044f600
jmp fcn.0049c340
Function at 0x49d0e0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x49d1a6
push rbp
mov rbp, rsp
sub rsp, 0x30
movabs rdx, 0xfd61f5086d7265fe
mov qword [rsp + 0x26], rdx
mov word [rsp + 0x2e], 0x9894
movabs rdx, 0x407090909090508
mov qword [rsp + 0x1c], rdx
mov word [rsp + 0x24], 0x500
xor eax, eax
jmp 0x49d140
movzx r9d, byte [rsp + rsi + 0x26]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x63]
mov byte [rsp + rdi + 0x26], dl
mov byte [rsp + rsi + 0x26], r8b
add rax, 2
nop dword [rax]
cmp rax, 0xa
jge 0x49d172
movzx edx, byte [rsp + rax + 0x1c]
movzx esi, byte [rsp + rax + 0x1d]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0xa
jae 0x49d197
movzx r8d, byte [rsp + rdi + 0x26]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x63]
cmp rsi, 0xa
jb 0x49d122
jmp 0x49d18b
xor eax, eax
lea rbx, [rsp + 0x26]
mov ecx, 0xa
nop
call fcn.00441380
add rsp, 0x30
pop rbp
ret
mov eax, esi
mov ecx, 0xa
call fcn.00451880
mov eax, edi
mov ecx, 0xa
nop
call fcn.00451880
nop
call fcn.0044f600
jmp fcn.0049d0e0

Function at 0x49d480
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x49d56c
push rbp
mov rbp, rsp
sub rsp, 0x48
movabs rdx, 0x5c34f72e3631fe32
mov qword [rsp + 0x1a], rdx
movabs rdx, 0x33b6ef9bbae65c34
mov qword [rsp + 0x20], rdx
movabs rdx, 0xf931aa34b102eadb
mov qword [rsp + 0x28], rdx
movabs rdx, 0x11113150a100109
mov qword [rsp + 0x30], rdx
movabs rdx, 0xc150e100b010a0c
mov qword [rsp + 0x38], rdx
movabs rdx, 0x5050f0a15080807
mov qword [rsp + 0x40], rdx
xor eax, eax
jmp 0x49d50a
movzx r9d, byte [rsp + rsi + 0x1a]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x2b]
mov byte [rsp + rdi + 0x1a], dl
mov byte [rsp + rsi + 0x1a], r8b
add rax, 2
cmp rax, 0x18
jge 0x49d53c
movzx edx, byte [rsp + rax + 0x30]
movzx esi, byte [rsp + rax + 0x31]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x16
jae 0x49d55f
movzx r8d, byte [rsp + rdi + 0x1a]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x2b]
cmp rsi, 0x16
jb 0x49d4f0
jmp 0x49d553
xor eax, eax
lea rbx, [rsp + 0x1a]
mov ecx, 0x16
call fcn.00441380
add rsp, 0x48
pop rbp
ret
mov eax, esi
mov ecx, 0x16
call fcn.00451880
mov eax, edi
mov ecx, 0x16
call fcn.00451880
nop
call fcn.0044f600
jmp fcn.0049d480
Function at 0x49e1a0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x49e2bd
push rbp
mov rbp, rsp
sub rsp, 0x60
movabs rdx, 0x6120747c5341584c
mov qword [rsp + 0x1d], rdx
movabs rdx, 0x6572206e4e6c4a51
mov qword [rsp + 0x25], rdx
movabs rdx, 0x8565585756406b65
mov qword [rsp + 0x2c], rdx
movabs rdx, 0x7373657a64516720
mov qword [rsp + 0x34], rdx
movabs rdx, 0xb181009130f1119
mov qword [rsp + 0x3c], rdx
movabs rdx, 0x100700020b181009
mov qword [rsp + 0x40], rdx
movabs rdx, 0x4120714041b0108
mov qword [rsp + 0x48], rdx
movabs rdx, 0x14160a16100b0314
mov qword [rsp + 0x50], rdx
movabs rdx, 0x1b090104100a0812
mov qword [rsp + 0x58], rdx
xor eax, eax
jmp 0x49e260
movzx r9d, byte [rsp + rsi + 0x1d]
sub r9d, edx
lea edx, [r9 + 0x2c]
mov byte [rsp + rdi + 0x1d], dl
lea edx, [r8 + 0x2c]
mov byte [rsp + rsi + 0x1d], dl
add rax, 2
nop word [rax + rax]
cmp rax, 0x24
jge 0x49e28d
movzx edx, byte [rsp + rax + 0x3c]
movzx esi, byte [rsp + rax + 0x3d]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x1f
jae 0x49e2b0
movzx r8d, byte [rsp + rdi + 0x1d]
sub r8d, edx
cmp rsi, 0x1f
jb 0x49e23d
jmp 0x49e2a4
xor eax, eax
lea rbx, [rsp + 0x1d]
mov ecx, 0x1f
call fcn.00441380
add rsp, 0x60
pop rbp
ret
mov eax, esi
mov ecx, 0x1f
call fcn.00451880
mov eax, edi
mov ecx, 0x1f
call fcn.00451880
nop
nop dword [rax]
call fcn.0044f600
jmp fcn.0049e1a0

Function at 0x49e2e0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x49e3b2
push rbp
mov rbp, rsp
sub rsp, 0x38
movabs rdx, 0xbe797472b8879361
mov qword [rsp + 0x19], rdx
movabs rdx, 0x786f72d16520ccbe
mov qword [rsp + 0x20], rdx
movabs rdx, 0xb010701030b0b08
mov qword [rsp + 0x28], rdx
movabs rdx, 0x601020b030e0b08
mov qword [rsp + 0x30], rdx
xor eax, eax
jmp 0x49e34c
movzx r9d, byte [rsp + rsi + 0x19]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x2a]
mov byte [rsp + rdi + 0x19], dl
mov byte [rsp + rsi + 0x19], r8b
add rax, 2
cmp rax, 0x10
jge 0x49e37e
movzx edx, byte [rsp + rax + 0x28]
movzx esi, byte [rsp + rax + 0x29]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0xf
jae 0x49e3a5
movzx r8d, byte [rsp + rdi + 0x19]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x2a]
cmp rsi, 0xf
jb 0x49e332
jmp 0x49e395
xor eax, eax
lea rbx, [rsp + 0x19]
mov ecx, 0xf
call fcn.00441380
add rsp, 0x38
pop rbp
ret
mov eax, esi
mov ecx, 0xf
nop dword [rax]
call fcn.00451880
mov eax, edi
mov ecx, 0xf
call fcn.00451880
nop
call fcn.0044f600
jmp fcn.0049e2e0
Function at 0x49fde0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x49feca
push rbp
mov rbp, rsp
sub rsp, 0x40
movabs rdx, 0xc76ccd2a63209319
mov qword [rsp + 0x1a], rdx
movabs rdx, 0x2020c76ccd2a6320
mov qword [rsp + 0x1c], rdx
movabs rdx, 0x3396e80923196f34
mov qword [rsp + 0x24], rdx
movabs rdx, 0x705110a0e0c1009
mov qword [rsp + 0x2c], rdx
movabs rdx, 0xf0405010705110a
mov qword [rsp + 0x30], rdx
movabs rdx, 0x904050d09050007
mov qword [rsp + 0x38], rdx
xor eax, eax
jmp 0x49fe6d
movzx r9d, byte [rsp + rsi + 0x1a]
sub r9d, edx
lea edx, [r9 + 0x5e]
mov byte [rsp + rdi + 0x1a], dl
lea edx, [r8 + 0x5e]
mov byte [rsp + rsi + 0x1a], dl
add rax, 2
cmp rax, 0x14
jge 0x49fe9a
movzx edx, byte [rsp + rax + 0x2c]
movzx esi, byte [rsp + rax + 0x2d]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x12
jae 0x49febd
movzx r8d, byte [rsp + rdi + 0x1a]
sub r8d, edx
cmp rsi, 0x12
jb 0x49fe50
jmp 0x49feb1
xor eax, eax
lea rbx, [rsp + 0x1a]
mov ecx, 0x12
call fcn.00441380
add rsp, 0x40
pop rbp
ret
mov eax, esi
mov ecx, 0x12
call fcn.00451880
mov eax, edi
mov ecx, 0x12
call fcn.00451880
nop
call fcn.0044f600
jmp fcn.0049fde0

Function at 0x4a0680
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4a079d
push rbp
mov rbp, rsp
sub rsp, 0x60
movabs rdx, 0x659a618a9a66b291
mov qword [rsp + 0x18], rdx
movabs rdx, 0x72bbaf7375ea51d4
mov qword [rsp + 0x20], rdx
movabs rdx, 0x348263af8d6e739a
mov qword [rsp + 0x28], rdx
movabs rdx, 0x42726f9d597d886f
mov qword [rsp + 0x30], rdx
movabs rdx, 0x140d131109011304
mov qword [rsp + 0x38], rdx
movabs rdx, 0x190e081f0f09171a
mov qword [rsp + 0x40], rdx
movabs rdx, 0xd0a1c00011c0d03
mov qword [rsp + 0x48], rdx
movabs rdx, 0x1f1914160d000d0d
mov qword [rsp + 0x50], rdx
movabs rdx, 0x1b0f101900060d00
mov qword [rsp + 0x58], rdx
xor eax, eax
jmp 0x4a0740
movzx r9d, byte [rsp + rsi + 0x18]
sub r9d, edx
lea edx, [r9 + 1]
mov byte [rsp + rdi + 0x18], dl
lea edx, [r8 + 1]
mov byte [rsp + rsi + 0x18], dl
add rax, 2
nop word [rax + rax]
cmp rax, 0x28
jge 0x4a076d
movzx edx, byte [rsp + rax + 0x38]
movzx esi, byte [rsp + rax + 0x39]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x20
jae 0x4a0790
movzx r8d, byte [rsp + rdi + 0x18]
sub r8d, edx
cmp rsi, 0x20
jb 0x4a071d
jmp 0x4a0784
xor eax, eax
lea rbx, [rsp + 0x18]
mov ecx, 0x20
call fcn.00441380
add rsp, 0x60
pop rbp
ret
mov eax, esi
mov ecx, 0x20
call fcn.00451880
mov eax, edi
mov ecx, 0x20
call fcn.00451880
nop
nop dword [rax]
call fcn.0044f600
jmp fcn.004a0680
Function at 0x4a07c0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4a08ac
push rbp
mov rbp, rsp
sub rsp, 0x40
movabs rdx, 0xf3da75e86e4f6fe8
mov qword [rsp + 0x1a], rdx
movabs rdx, 0x6e6bf3da75e86e4f
mov qword [rsp + 0x1c], rdx
movabs rdx, 0xd2535ce1ec657120
mov qword [rsp + 0x24], rdx
movabs rdx, 0x50e06100b070808
mov qword [rsp + 0x2c], rdx
movabs rdx, 0xe0f0702050e0610
mov qword [rsp + 0x30], rdx
movabs rdx, 0xe0407110800060d
mov qword [rsp + 0x38], rdx
xor eax, eax
jmp 0x4a084a
movzx r9d, byte [rsp + rsi + 0x1a]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x71]
mov byte [rsp + rdi + 0x1a], dl
mov byte [rsp + rsi + 0x1a], r8b
add rax, 2
cmp rax, 0x14
jge 0x4a087c
movzx edx, byte [rsp + rax + 0x2c]
movzx esi, byte [rsp + rax + 0x2d]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x12
jae 0x4a089f
movzx r8d, byte [rsp + rdi + 0x1a]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x71]
cmp rsi, 0x12
jb 0x4a0830
jmp 0x4a0893
xor eax, eax
lea rbx, [rsp + 0x1a]
mov ecx, 0x12
call fcn.00441380
add rsp, 0x40
pop rbp
ret
mov eax, esi
mov ecx, 0x12
call fcn.00451880
mov eax, edi
mov ecx, 0x12
call fcn.00451880
nop
call fcn.0044f600
jmp fcn.004a07c0

Function at 0x4a08c0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4a09cc
push rbp
mov rbp, rsp
sub rsp, 0x58
movabs rdx, 0x697463b47544ab63
mov qword [rsp + 0x1e], rdx
movabs rdx, 0xc45f14b4a203dd9
mov qword [rsp + 0x26], rdx
movabs rdx, 0x723de13d20d69ec8
mov qword [rsp + 0x2e], rdx
movabs rdx, 0x90d140e04110b15
mov qword [rsp + 0x36], rdx
movabs rdx, 0x301090d140e0411
mov qword [rsp + 0x38], rdx
movabs rdx, 0x1511020c0e160101
mov qword [rsp + 0x40], rdx
movabs rdx, 0x802120e03120c14
mov qword [rsp + 0x48], rdx
movabs rdx, 0x150d100c0415100f
mov qword [rsp + 0x50], rdx
xor eax, eax
jmp 0x4a0968
movzx r9d, byte [rsp + rsi + 0x1e]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x73]
mov byte [rsp + rdi + 0x1e], dl
mov byte [rsp + rsi + 0x1e], r8b
add rax, 2
cmp rax, 0x22
jge 0x4a099c
movzx edx, byte [rsp + rax + 0x36]
movzx esi, byte [rsp + rax + 0x37]
mov edi, edx
xor edx, esi
add edx, eax
nop
cmp rdi, 0x18
jae 0x4a09bf
movzx r8d, byte [rsp + rdi + 0x1e]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x73]
cmp rsi, 0x18
jb 0x4a094e
jmp 0x4a09b3
xor eax, eax
lea rbx, [rsp + 0x1e]
mov ecx, 0x18
call fcn.00441380
add rsp, 0x58
pop rbp
ret
mov eax, esi
mov ecx, 0x18
call fcn.00451880
mov eax, edi
mov ecx, 0x18
call fcn.00451880
nop
call fcn.0044f600
jmp fcn.004a08c0
Function at 0x4a1ec0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4a1fa6
push rbp
mov rbp, rsp
sub rsp, 0x40
movabs rdx, 0x65c921000fa20a01
mov qword [rsp + 0x18], rdx
movabs rdx, 0x96fc2668426ffd36
mov qword [rsp + 0x20], rdx
movabs rdx, 0xf0b0d0305030605
mov qword [rsp + 0x28], rdx
movabs rdx, 0x808000409060103
mov qword [rsp + 0x30], rdx
movabs rdx, 0x8020f0b0d0e0901
mov qword [rsp + 0x38], rdx
xor eax, eax
nop
jmp 0x4a1f40
movzx r9d, byte [rsp + rsi + 0x18]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x5e]
mov byte [rsp + rdi + 0x18], dl
mov byte [rsp + rsi + 0x18], r8b
add rax, 2
nop dword [rax]
cmp rax, 0x18
jge 0x4a1f72
movzx edx, byte [rsp + rax + 0x28]
movzx esi, byte [rsp + rax + 0x29]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x10
jae 0x4a1f97
movzx r8d, byte [rsp + rdi + 0x18]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x5e]
cmp rsi, 0x10
jb 0x4a1f22
jmp 0x4a1f8b
xor eax, eax
lea rbx, [rsp + 0x18]
mov ecx, 0x10
nop
call fcn.00441380
add rsp, 0x40
pop rbp
ret
mov eax, esi
mov ecx, 0x10
call fcn.00451880
mov eax, edi
mov ecx, 0x10
nop
call fcn.00451880
nop
call fcn.0044f600
jmp fcn.004a1ec0

Function at 0x4a29c0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4a2ac8
push rbp
mov rbp, rsp
sub rsp, 0x50
movabs rdx, 0x6f6990507a9b707d
mov qword [rsp + 0x1b], rdx
movabs rdx, 0xad9b26a36faa9a6e
mov qword [rsp + 0x23], rdx
movabs rdx, 0x9fad9b26a36faa9a
mov qword [rsp + 0x24], rdx
movabs rdx, 0x2d9b659667808494
mov qword [rsp + 0x2c], rdx
movabs rdx, 0x180c000f0f150918
mov qword [rsp + 0x34], rdx
movabs rdx, 0xa0a13150d0d0405
mov qword [rsp + 0x3c], rdx
movabs rdx, 0x1802110e0a0a1315
mov qword [rsp + 0x40], rdx
movabs rdx, 0x510121304030a17
mov qword [rsp + 0x48], rdx
xor eax, eax
jmp 0x4a2a6b
movzx r9d, byte [rsp + rsi + 0x1b]
sub r9d, edx
lea edx, [r9 + 4]
mov byte [rsp + rdi + 0x1b], dl
lea edx, [r8 + 4]
mov byte [rsp + rsi + 0x1b], dl
add rax, 2
cmp rax, 0x1c
jge 0x4a2a98
movzx edx, byte [rsp + rax + 0x34]
movzx esi, byte [rsp + rax + 0x35]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x19
jae 0x4a2abb
movzx r8d, byte [rsp + rdi + 0x1b]
sub r8d, edx
cmp rsi, 0x19
jb 0x4a2a4e
jmp 0x4a2aaf
xor eax, eax
lea rbx, [rsp + 0x1b]
mov ecx, 0x19
call fcn.00441380
add rsp, 0x50
pop rbp
ret
mov eax, esi
mov ecx, 0x19
call fcn.00451880
mov eax, edi
mov ecx, 0x19
call fcn.00451880
nop
call fcn.0044f600
jmp fcn.004a29c0
Function at 0x4a33a0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4a34d8
push rbp
mov rbp, rsp
sub rsp, 0x70
movabs rdx, 0x720243732e1afe22
mov qword [rsp + 0x1f], rdx
movabs rdx, 0x6f70286e65202a72
mov qword [rsp + 0x26], rdx
movabs rdx, 0x610fb369f5ecb727
mov qword [rsp + 0x2e], rdx
movabs rdx, 0x1d20052f61654591
mov qword [rsp + 0x36], rdx
movabs rdx, 0x381ef92739db0d6f
mov qword [rsp + 0x3e], rdx
movabs rdx, 0x1100220802172106
mov qword [rsp + 0x46], rdx
movabs rdx, 0x260323181e102018
mov qword [rsp + 0x4e], rdx
movabs rdx, 0x10f260323181e10
mov qword [rsp + 0x50], rdx
movabs rdx, 0xc06210f18232524
mov qword [rsp + 0x58], rdx
movabs rdx, 0x5141b0212021c05
mov qword [rsp + 0x60], rdx
movabs rdx, 0x525001e05151e1e
mov qword [rsp + 0x68], rdx
xor eax, eax
jmp 0x4a3478
movzx r9d, byte [rsp + rsi + 0x1f]
sub r9d, edx
lea edx, [r9 + 0x69]
mov byte [rsp + rdi + 0x1f], dl
lea edx, [r8 + 0x69]
mov byte [rsp + rsi + 0x1f], dl
add rax, 2
cmp rax, 0x2a
jge 0x4a34a8
movzx edx, byte [rsp + rax + 0x46]
movzx esi, byte [rsp + rax + 0x47]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x27
jae 0x4a34cb
movzx r8d, byte [rsp + rdi + 0x1f]
sub r8d, edx
nop dword [rax]
cmp rsi, 0x27
jb 0x4a345b
jmp 0x4a34bf
xor eax, eax
lea rbx, [rsp + 0x1f]
mov ecx, 0x27
call fcn.00441380
add rsp, 0x70
pop rbp
ret
mov eax, esi
mov ecx, 0x27
call fcn.00451880
mov eax, edi
mov ecx, 0x27
call fcn.00451880
nop
call fcn.0044f600
nop dword [rax]
jmp fcn.004a33a0
Function at 0x4a4d40
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4a4e78
push rbp
mov rbp, rsp
sub rsp, 0x70
movabs rdx, 0x30bd2457e3ce6307
mov qword [rsp + 0x1c], rdx
movabs rdx, 0x20b613e630bd2457
mov qword [rsp + 0x20], rdx
movabs rdx, 0x6774c4c00e721620
mov qword [rsp + 0x28], rdx
movabs rdx, 0xe0654c786873aec4
mov qword [rsp + 0x30], rdx
movabs rdx, 0xe5ebd372626e168f
mov qword [rsp + 0x38], rdx
movabs rdx, 0x1b22150f07100d11
mov qword [rsp + 0x40], rdx
movabs rdx, 0x605151b210c090a
mov qword [rsp + 0x48], rdx
movabs rdx, 0x14000f1011021d11
mov qword [rsp + 0x50], rdx
movabs rdx, 0x182209221c21130a
mov qword [rsp + 0x58], rdx
movabs rdx, 0x4191e030a231021
mov qword [rsp + 0x60], rdx
movabs rdx, 0x1409040608190322
mov qword [rsp + 0x68], rdx
xor eax, eax
jmp 0x4a4e18
movzx r9d, byte [rsp + rsi + 0x1c]
sub r9d, edx
lea edx, [r9 - 0x39]
mov byte [rsp + rdi + 0x1c], dl
lea edx, [r8 - 0x39]
mov byte [rsp + rsi + 0x1c], dl
add rax, 2
cmp rax, 0x30
jge 0x4a4e48
movzx edx, byte [rsp + rax + 0x40]
movzx esi, byte [rsp + rax + 0x41]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x24
jae 0x4a4e6b
movzx r8d, byte [rsp + rdi + 0x1c]
sub r8d, edx
nop dword [rax]
cmp rsi, 0x24
jb 0x4a4dfb
jmp 0x4a4e5f
xor eax, eax
lea rbx, [rsp + 0x1c]
mov ecx, 0x24
call fcn.00441380
add rsp, 0x70
pop rbp
ret
mov eax, esi
mov ecx, 0x24
call fcn.00451880
mov eax, edi
mov ecx, 0x24
call fcn.00451880
nop
call fcn.0044f600
nop dword [rax]
jmp fcn.004a4d40