joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4856a0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x48579d
push rbp
mov rbp, rsp
sub rsp, 0x50
movabs rdx, 0x530f631353fd4155
mov qword [rsp + 0x1f], rdx
movabs rdx, 0x3355ed756a615653
mov qword [rsp + 0x26], rdx
movabs rdx, 0x65303267203a746e
mov qword [rsp + 0x2e], rdx
movabs rdx, 0x60e120215140c0c
mov qword [rsp + 0x36], rdx
movabs rdx, 0x71202010c0e110d
mov qword [rsp + 0x3e], rdx
movabs rdx, 0x40d071202010c0e
mov qword [rsp + 0x40], rdx
movabs rdx, 0xc030c0a120613
mov qword [rsp + 0x48], rdx
xor eax, eax
jmp 0x485740
movzx r9d, byte [rsp + rsi + 0x1f]
sub r9d, edx
lea edx, [r9 + 0x34]
mov byte [rsp + rdi + 0x1f], dl
lea edx, [r8 + 0x34]
mov byte [rsp + rsi + 0x1f], dl
add rax, 2
nop dword [rax]
cmp rax, 0x1a
jge 0x48576d
movzx edx, byte [rsp + rax + 0x36]
movzx esi, byte [rsp + rax + 0x37]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x17
jae 0x485790
movzx r8d, byte [rsp + rdi + 0x1f]
sub r8d, edx
cmp rsi, 0x17
jb 0x48571f
jmp 0x485784
xor eax, eax
lea rbx, [rsp + 0x1f]
mov ecx, 0x17
call fcn.00441400
add rsp, 0x50
pop rbp
ret
mov eax, esi
mov ecx, 0x17
call fcn.00451920
mov eax, edi
mov ecx, 0x17
call fcn.00451920
nop
nop dword [rax]
call fcn.0044f6a0
jmp fcn.004856a0

Function at 0x486e60
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x486f4a
push rbp
mov rbp, rsp
sub rsp, 0x48
movabs rdx, 0x65bc6dbcbe717270
mov qword [rsp + 0x30], rdx
movabs rdx, 0xb361ad73d3c865c9
mov qword [rsp + 0x38], rdx
movabs rdx, 0x74bf801f78ce7a6b
mov qword [rsp + 0x40], rdx
movabs rdx, 0x150b120811020d03
mov qword [rsp + 0x18], rdx
movabs rdx, 0x414130402160407
mov qword [rsp + 0x20], rdx
movabs rdx, 0x14130f0f1604060a
mov qword [rsp + 0x28], rdx
xor eax, eax
jmp 0x486eed
movzx r9d, byte [rsp + rsi + 0x30]
sub r9d, edx
lea edx, [r9 - 0x3c]
mov byte [rsp + rdi + 0x30], dl
lea edx, [r8 - 0x3c]
mov byte [rsp + rsi + 0x30], dl
add rax, 2
cmp rax, 0x18
jge 0x486f1a
movzx edx, byte [rsp + rax + 0x18]
movzx esi, byte [rsp + rax + 0x19]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x18
jae 0x486f3d
movzx r8d, byte [rsp + rdi + 0x30]
sub r8d, edx
cmp rsi, 0x18
jb 0x486ed0
jmp 0x486f31
xor eax, eax
lea rbx, [rsp + 0x30]
mov ecx, 0x18
call fcn.00441400
add rsp, 0x48
pop rbp
ret
mov eax, esi
mov ecx, 0x18
call fcn.00451920
mov eax, edi
mov ecx, 0x18
call fcn.00451920
nop
call fcn.0044f6a0
jmp fcn.00486e60
Function at 0x4895a0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x489686
push rbp
mov rbp, rsp
sub rsp, 0x40
movabs rdx, 0x73761d866e6b795a
mov qword [rsp + 0x1e], rdx
movabs rdx, 0x5c6f7d827e6c7376
mov qword [rsp + 0x24], rdx
movabs rdx, 0x1070a090b0a0404
mov qword [rsp + 0x2c], rdx
movabs rdx, 0xb08040601070a09
mov qword [rsp + 0x30], rdx
movabs rdx, 0x5070800000d0c08
mov qword [rsp + 0x38], rdx
xor eax, eax
nop
jmp 0x489620
movzx r9d, byte [rsp + rsi + 0x1e]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x11]
mov byte [rsp + rdi + 0x1e], dl
mov byte [rsp + rsi + 0x1e], r8b
add rax, 2
nop dword [rax]
cmp rax, 0x14
jge 0x489652
movzx edx, byte [rsp + rax + 0x2c]
movzx esi, byte [rsp + rax + 0x2d]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0xe
jae 0x489677
movzx r8d, byte [rsp + rdi + 0x1e]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x11]
cmp rsi, 0xe
jb 0x489602
jmp 0x48966b
xor eax, eax
lea rbx, [rsp + 0x1e]
mov ecx, 0xe
nop
call fcn.00441400
add rsp, 0x40
pop rbp
ret
mov eax, esi
mov ecx, 0xe
call fcn.00451920
mov eax, edi
mov ecx, 0xe
nop
call fcn.00451920
nop
call fcn.0044f6a0
jmp fcn.004895a0

Function at 0x489c20
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x489cdd
push rbp
mov rbp, rsp
sub rsp, 0x30
movabs rdx, 0x693f1a3443644762
mov qword [rsp + 0x1b], rdx
mov byte [rsp + 0x23], 0xcb
movabs rdx, 0x106040406080405
mov qword [rsp + 0x24], rdx
mov dword [rsp + 0x2c], 0x1030508
xor eax, eax
nop
jmp 0x489c80
movzx r9d, byte [rsp + rsi + 0x1b]
sub r9d, edx
lea edx, [r9 + 0x2a]
mov byte [rsp + rdi + 0x1b], dl
lea edx, [r8 + 0x2a]
mov byte [rsp + rsi + 0x1b], dl
add rax, 2
nop
cmp rax, 0xc
jge 0x489cad
movzx edx, byte [rsp + rax + 0x24]
movzx esi, byte [rsp + rax + 0x25]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 9
jae 0x489cd0
movzx r8d, byte [rsp + rdi + 0x1b]
sub r8d, edx
cmp rsi, 9
jb 0x489c62
jmp 0x489cc4
xor eax, eax
lea rbx, [rsp + 0x1b]
mov ecx, 9
call fcn.00441400
add rsp, 0x30
pop rbp
ret
mov eax, esi
mov ecx, 9
call fcn.00451920
mov eax, edi
mov ecx, 9
call fcn.00451920
nop
nop dword [rax]
call fcn.0044f6a0
jmp fcn.00489c20
Function at 0x48aa40
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x48ab0c
push rbp
mov rbp, rsp
sub rsp, 0x38
movabs rdx, 0xaf7564c4ccbc6568
mov qword [rsp + 0x1d], rdx
movabs rdx, 0xbe5f73af7564c4cc
mov qword [rsp + 0x20], rdx
movabs rdx, 0x606080a0a000609
mov qword [rsp + 0x28], rdx
movabs rdx, 0x203080409030706
mov qword [rsp + 0x30], rdx
xor eax, eax
jmp 0x48aaaf
movzx r9d, byte [rsp + rsi + 0x1d]
sub r9d, edx
lea edx, [r9 - 0x45]
mov byte [rsp + rdi + 0x1d], dl
lea edx, [r8 - 0x45]
mov byte [rsp + rsi + 0x1d], dl
add rax, 2
cmp rax, 0x10
jge 0x48aadc
movzx edx, byte [rsp + rax + 0x28]
movzx esi, byte [rsp + rax + 0x29]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0xb
jae 0x48aaff
movzx r8d, byte [rsp + rdi + 0x1d]
sub r8d, edx
cmp rsi, 0xb
jb 0x48aa92
jmp 0x48aaf3
xor eax, eax
lea rbx, [rsp + 0x1d]
mov ecx, 0xb
call fcn.00441400
add rsp, 0x38
pop rbp
ret
mov eax, esi
mov ecx, 0xb
call fcn.00451920
mov eax, edi
mov ecx, 0xb
call fcn.00451920
nop
call fcn.0044f6a0
jmp fcn.0048aa40

Function at 0x48ab20
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x48abe6
push rbp
mov rbp, rsp
sub rsp, 0x30
movabs rdx, 0x67f355e7e7dad966
mov qword [rsp + 0x1d], rdx
mov byte [rsp + 0x25], 0x28
movabs rdx, 0x503050504020706
mov qword [rsp + 0x26], rdx
mov word [rsp + 0x2e], 0x601
xor eax, eax
nop
jmp 0x48ab80
movzx r9d, byte [rsp + rsi + 0x1d]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x7f]
mov byte [rsp + rdi + 0x1d], dl
mov byte [rsp + rsi + 0x1d], r8b
add rax, 2
nop dword [rax]
cmp rax, 0xa
jge 0x48abb2
movzx edx, byte [rsp + rax + 0x26]
movzx esi, byte [rsp + rax + 0x27]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 9
jae 0x48abd7
movzx r8d, byte [rsp + rdi + 0x1d]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x7f]
cmp rsi, 9
jb 0x48ab62
jmp 0x48abcb
xor eax, eax
lea rbx, [rsp + 0x1d]
mov ecx, 9
nop
call fcn.00441400
add rsp, 0x30
pop rbp
ret
mov eax, esi
mov ecx, 9
call fcn.00451920
mov eax, edi
mov ecx, 9
nop
call fcn.00451920
nop
call fcn.0044f6a0
jmp fcn.0048ab20
Function at 0x48c600
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x48c6fd
push rbp
mov rbp, rsp
sub rsp, 0x48
movabs rdx, 0x1c216370335d4c72
mov qword [rsp + 0x1b], rdx
movabs rdx, 0x6c61741c21637033
mov qword [rsp + 0x1e], rdx
movabs rdx, 0x6f635d4f534f5352
mov qword [rsp + 0x26], rdx
movabs rdx, 0xd0710060303010c
mov qword [rsp + 0x2e], rdx
movabs rdx, 0xb040c020b0b030c
mov qword [rsp + 0x36], rdx
movabs rdx, 0x1100b040c020b0b
mov qword [rsp + 0x38], rdx
movabs rdx, 0x701041208060f06
mov qword [rsp + 0x40], rdx
xor eax, eax
jmp 0x48c6a0
movzx r9d, byte [rsp + rsi + 0x1b]
sub r9d, edx
lea edx, [r9 + 0x22]
mov byte [rsp + rdi + 0x1b], dl
lea edx, [r8 + 0x22]
mov byte [rsp + rsi + 0x1b], dl
add rax, 2
nop dword [rax]
cmp rax, 0x1a
jge 0x48c6cd
movzx edx, byte [rsp + rax + 0x2e]
movzx esi, byte [rsp + rax + 0x2f]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x13
jae 0x48c6f0
movzx r8d, byte [rsp + rdi + 0x1b]
sub r8d, edx
cmp rsi, 0x13
jb 0x48c67f
jmp 0x48c6e4
xor eax, eax
lea rbx, [rsp + 0x1b]
mov ecx, 0x13
call fcn.00441400
add rsp, 0x48
pop rbp
ret
mov eax, esi
mov ecx, 0x13
call fcn.00451920
mov eax, edi
mov ecx, 0x13
call fcn.00451920
nop
nop dword [rax]
call fcn.0044f6a0
jmp fcn.0048c600

Function at 0x48e380
Capabilities:
Encrypt data using rc4 prga
Resolve function by parsing pe exports

Disassembly:
lea r12, [rsp - 0x20]
cmp r12, qword [r14 + 0x10]
jbe 0x48e527
push rbp
mov rbp, rsp
sub rsp, 0x98
movabs rdx, 0x87fc63d3b24bd079
mov qword [rsp + 0x18], rdx
movabs rdx, 0x66eb20cca3866356
mov qword [rsp + 0x20], rdx
movabs rdx, 0xa987ecd166eb20cc
mov qword [rsp + 0x24], rdx
movabs rdx, 0x5161562e3f84656c
mov qword [rsp + 0x2c], rdx
movabs rdx, 0x6b7aae359c1565b2
mov qword [rsp + 0x34], rdx
movabs rdx, 0x6f692f725ee6206e
mov qword [rsp + 0x3c], rdx
movabs rdx, 0x3ec0612e6e016e20
mov qword [rsp + 0x44], rdx
movabs rdx, 0x86e16c6130bd7982
mov qword [rsp + 0x4c], rdx
movabs rdx, 0x1e01303a3a20271c
mov qword [rsp + 0x54], rdx
movabs rdx, 0x323729371e01303a
mov qword [rsp + 0x58], rdx
movabs rdx, 0x3a17011c17170e11
mov qword [rsp + 0x60], rdx
movabs rdx, 0x30220604291b2a36
mov qword [rsp + 0x68], rdx
movabs rdx, 0xc100833231f2e26
mov qword [rsp + 0x70], rdx
movabs rdx, 0x3b002e01113a0b13
mov qword [rsp + 0x78], rdx
movabs rdx, 0x1b0e231234173403
mov qword [rsp + 0x80], rdx
movabs rdx, 0xa162e070e202621
mov qword [rsp + 0x88], rdx
movabs rdx, 0x331e040c01070210
mov qword [rsp + 0x90], rdx
xor eax, eax
jmp 0x48e4c0
movzx r9d, byte [rsp + rsi + 0x18]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x79]
mov byte [rsp + rdi + 0x18], dl
mov byte [rsp + rsi + 0x18], r8b
add rax, 2
cmp rax, 0x44
jge 0x48e4f2
movzx edx, byte [rsp + rax + 0x54]
movzx esi, byte [rsp + rax + 0x55]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x3c
jae 0x48e51a
movzx r8d, byte [rsp + rdi + 0x18]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x79]
cmp rsi, 0x3c
jb 0x48e4a6
jmp 0x48e50e
xor eax, eax
lea rbx, [rsp + 0x18]
mov ecx, 0x3c
nop
call fcn.00441400
add rsp, 0x98
pop rbp
ret
mov eax, esi
mov ecx, 0x3c
call fcn.00451920
mov eax, edi
mov ecx, 0x3c
call fcn.00451920
nop
call fcn.0044f6a0
jmp fcn.0048e380
Function at 0x4903e0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4904cc
push rbp
mov rbp, rsp
sub rsp, 0x48
movabs rdx, 0x5870d86500fa6572
mov qword [rsp + 0x1d], rdx
movabs rdx, 0xf590ff5870d86500
mov qword [rsp + 0x20], rdx
movabs rdx, 0xee616fea192e211e
mov qword [rsp + 0x28], rdx
movabs rdx, 0x120f07020c020e0f
mov qword [rsp + 0x30], rdx
movabs rdx, 0x90a08060b091202
mov qword [rsp + 0x38], rdx
movabs rdx, 0x8050a070b03120a
mov qword [rsp + 0x40], rdx
xor eax, eax
jmp 0x49046a
movzx r9d, byte [rsp + rsi + 0x1d]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x5b]
mov byte [rsp + rdi + 0x1d], dl
mov byte [rsp + rsi + 0x1d], r8b
add rax, 2
cmp rax, 0x18
jge 0x49049c
movzx edx, byte [rsp + rax + 0x30]
movzx esi, byte [rsp + rax + 0x31]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x13
jae 0x4904bf
movzx r8d, byte [rsp + rdi + 0x1d]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x5b]
cmp rsi, 0x13
jb 0x490450
jmp 0x4904b3
xor eax, eax
lea rbx, [rsp + 0x1d]
mov ecx, 0x13
call fcn.00441400
add rsp, 0x48
pop rbp
ret
mov eax, esi
mov ecx, 0x13
call fcn.00451920
mov eax, edi
mov ecx, 0x13
call fcn.00451920
nop
call fcn.0044f6a0
jmp fcn.004903e0
Function at 0x497720
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4977ea
push rbp
mov rbp, rsp
sub rsp, 0x48
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x58], rax
mov qword [rsp], rax
mov qword [rsp + 8], rbx
mov byte [rsp + 0x10], 0
call fcn.00403080
xorps xmm15, xmm15
mov r14, qword [0x00788970]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x18], 0xffffffffffffffff
jne 0x4977cf
mov rcx, qword [rsp + 0x60]
lea rdx, [rcx + 1]
mov qword [rsp + 0x40], rdx
lea rax, [0x0051c540]
xor ebx, ebx
mov rcx, rdx
call fcn.0043df00
mov rbx, qword [rsp + 0x60]
mov rcx, rax
xor edi, edi
mov rsi, qword [rsp + 0x40]
mov rax, qword [rsp + 0x58]
nop dword [rax]
call fcn.0049a640
inc rbx
cmp rcx, rbx
jae 0x4977be
mov edi, 1
lea rsi, [0x0051c540]
call fcn.0043dfe0
mov word [rax + rbx*2 - 2], 0
xor edi, edi
xor esi, esi
add rsp, 0x48
pop rbp
ret
xor eax, eax
xor ebx, ebx
mov rcx, rbx
lea rdi, [0x006a3138]
lea rsi, [0x006a2d90]
add rsp, 0x48
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.0044f6a0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.00497720

Function at 0x49a560
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov qword [rsp + 0x40], 0
movabs rdx, 0x5e0658e7b676bc3e
mov qword [rsp + 0x1e], rdx
movabs rdx, 0x303010104070404
mov qword [rsp + 0x26], rdx
mov word [rsp + 0x2e], 5
xor eax, eax
jmp 0x49a5b4
movzx r8d, byte [rsp + rbx + 0x1e]
lea edx, [r8 + rdx]
lea edx, [rdx + 0x29]
mov byte [rsp + rsi + 0x1e], dl
mov byte [rsp + rbx + 0x1e], dil
add rax, 2
cmp rax, 0xa
jge 0x49a5e8
movzx edx, byte [rsp + rax + 0x26]
movzx ebx, byte [rsp + rax + 0x27]
mov esi, edx
xor edx, ebx
add edx, eax
cmp rsi, 8
jae 0x49a625
movzx edi, byte [rsp + rsi + 0x1e]
lea edi, [rdi + rdx]
lea edi, [rdi + 0x29]
nop dword [rax + rax]
cmp rbx, 8
jb 0x49a59a
jmp 0x49a617
mov qword [rsp + 0x16], 0
xor eax, eax
jmp 0x49a601
movzx ecx, byte [rsp + rax + 0x1e]
mov byte [rsp + rax + 0x16], cl
inc rax
cmp rax, 8
jl 0x49a5f5
mov rax, qword [rsp + 0x16]
mov qword [rsp + 0x40], rax
add rsp, 0x30
pop rbp
ret
mov eax, ebx
mov ecx, 8
nop
call fcn.00451920
mov eax, esi
mov ecx, 8
call fcn.00451920
nop
int3
Function at 0x49b9e0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x49bb18
push rbp
mov rbp, rsp
sub rsp, 0x70
movabs rdx, 0xd8141ae71664faeb
mov qword [rsp + 0x1a], rdx
movabs rdx, 0x6ee3a86c236dccbb
mov qword [rsp + 0x22], rdx
movabs rdx, 0x6f174a257320150b
mov qword [rsp + 0x2a], rdx
movabs rdx, 0x22eeaa20c725d172
mov qword [rsp + 0x32], rdx
movabs rdx, 0x6c18a16f74ef3913
mov qword [rsp + 0x3a], rdx
movabs rdx, 0xd0e2125151e041a
mov qword [rsp + 0x42], rdx
movabs rdx, 0x2001000701071b1b
mov qword [rsp + 0x4a], rdx
movabs rdx, 0x260d110908212001
mov qword [rsp + 0x50], rdx
movabs rdx, 0x20141d192103190e
mov qword [rsp + 0x58], rdx
movabs rdx, 0x1505201b111a0b08
mov qword [rsp + 0x60], rdx
movabs rdx, 0x1b10160619221f14
mov qword [rsp + 0x68], rdx
xor eax, eax
jmp 0x49bab5
movzx r9d, byte [rsp + rsi + 0x1a]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x22]
mov byte [rsp + rdi + 0x1a], dl
mov byte [rsp + rsi + 0x1a], r8b
add rax, 2
cmp rax, 0x2e
jge 0x49bae8
movzx edx, byte [rsp + rax + 0x42]
movzx esi, byte [rsp + rax + 0x43]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x28
jae 0x49bb0b
movzx r8d, byte [rsp + rdi + 0x1a]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x22]
nop
cmp rsi, 0x28
jb 0x49ba9b
jmp 0x49baff
xor eax, eax
lea rbx, [rsp + 0x1a]
mov ecx, 0x28
call fcn.00441400
add rsp, 0x70
pop rbp
ret
mov eax, esi
mov ecx, 0x28
call fcn.00451920
mov eax, edi
mov ecx, 0x28
call fcn.00451920
nop
call fcn.0044f6a0
nop dword [rax]
jmp fcn.0049b9e0
Function at 0x49dfa0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x49e0ba
push rbp
mov rbp, rsp
sub rsp, 0x58
movabs rdx, 0x8fdfe8d66ef4c5f2
mov qword [rsp + 0x19], rdx
movabs rdx, 0x7083a6bc966d43da
mov qword [rsp + 0x21], rdx
movabs rdx, 0x9874987083a6bc96
mov qword [rsp + 0x24], rdx
movabs rdx, 0x65926ec6ac95036f
mov qword [rsp + 0x2c], rdx
movabs rdx, 0x100404140205000e
mov qword [rsp + 0x34], rdx
movabs rdx, 0x10d171610040414
mov qword [rsp + 0x38], rdx
movabs rdx, 0x140f150806080e04
mov qword [rsp + 0x40], rdx
movabs rdx, 0x1002140709120605
mov qword [rsp + 0x48], rdx
movabs rdx, 0x150d19160b0c0b
mov qword [rsp + 0x50], rdx
xor eax, eax
jmp 0x49e057
movzx r9d, byte [rsp + rsi + 0x19]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x54]
mov byte [rsp + rdi + 0x19], dl
mov byte [rsp + rsi + 0x19], r8b
add rax, 2
cmp rax, 0x24
jge 0x49e089
movzx edx, byte [rsp + rax + 0x34]
movzx esi, byte [rsp + rax + 0x35]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x1b
jae 0x49e0ad
movzx r8d, byte [rsp + rdi + 0x19]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x54]
cmp rsi, 0x1b
jb 0x49e03d
jmp 0x49e0a1
xor eax, eax
lea rbx, [rsp + 0x19]
mov ecx, 0x1b
call fcn.00441400
add rsp, 0x58
pop rbp
nop
ret
mov eax, esi
mov ecx, 0x1b
call fcn.00451920
mov eax, edi
mov ecx, 0x1b
call fcn.00451920
nop
call fcn.0044f6a0
nop
jmp fcn.0049dfa0

Function at 0x49e0e0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x49e1fd
push rbp
mov rbp, rsp
sub rsp, 0x58
movabs rdx, 0x425e5e496de6366d
mov qword [rsp + 0x19], rdx
movabs rdx, 0x3c3e206ee169744b
mov qword [rsp + 0x21], rdx
movabs rdx, 0x3b44523c3e206ee1
mov qword [rsp + 0x24], rdx
movabs rdx, 0x436668732c2b584d
mov qword [rsp + 0x2c], rdx
movabs rdx, 0x16120b12041a0701
mov qword [rsp + 0x34], rdx
movabs rdx, 0xe08020f16120b12
mov qword [rsp + 0x38], rdx
movabs rdx, 0x131a06140f0b1513
mov qword [rsp + 0x40], rdx
movabs rdx, 0x504101812110218
mov qword [rsp + 0x48], rdx
movabs rdx, 0x40e130b19041200
mov qword [rsp + 0x50], rdx
xor eax, eax
jmp 0x49e1a0
movzx r9d, byte [rsp + rsi + 0x19]
sub r9d, edx
lea edx, [r9 + 0x33]
mov byte [rsp + rdi + 0x19], dl
lea edx, [r8 + 0x33]
mov byte [rsp + rsi + 0x19], dl
add rax, 2
nop word [rax + rax]
cmp rax, 0x24
jge 0x49e1cd
movzx edx, byte [rsp + rax + 0x34]
movzx esi, byte [rsp + rax + 0x35]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x1b
jae 0x49e1f0
movzx r8d, byte [rsp + rdi + 0x19]
sub r8d, edx
cmp rsi, 0x1b
jb 0x49e17d
jmp 0x49e1e4
xor eax, eax
lea rbx, [rsp + 0x19]
mov ecx, 0x1b
call fcn.00441400
add rsp, 0x58
pop rbp
ret
mov eax, esi
mov ecx, 0x1b
call fcn.00451920
mov eax, edi
mov ecx, 0x1b
call fcn.00451920
nop
nop dword [rax]
call fcn.0044f6a0
jmp fcn.0049e0e0
Function at 0x49ea40
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x49eb48
push rbp
mov rbp, rsp
sub rsp, 0x50
movabs rdx, 0x6563cc8ac779650c
mov qword [rsp + 0x1b], rdx
movabs rdx, 0x576fa1fae81f6418
mov qword [rsp + 0x23], rdx
movabs rdx, 0x6b576fa1fae81f64
mov qword [rsp + 0x24], rdx
movabs rdx, 0x6412f7aec9761416
mov qword [rsp + 0x2c], rdx
movabs rdx, 0x16150f040b0b0204
mov qword [rsp + 0x34], rdx
movabs rdx, 0x170c02120f020d0c
mov qword [rsp + 0x3c], rdx
movabs rdx, 0x4081103170c0212
mov qword [rsp + 0x40], rdx
movabs rdx, 0xa16051405140012
mov qword [rsp + 0x48], rdx
xor eax, eax
jmp 0x49eaeb
movzx r9d, byte [rsp + rsi + 0x1b]
sub r9d, edx
lea edx, [r9 + 0x7b]
mov byte [rsp + rdi + 0x1b], dl
lea edx, [r8 + 0x7b]
mov byte [rsp + rsi + 0x1b], dl
add rax, 2
cmp rax, 0x1c
jge 0x49eb18
movzx edx, byte [rsp + rax + 0x34]
movzx esi, byte [rsp + rax + 0x35]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x19
jae 0x49eb3b
movzx r8d, byte [rsp + rdi + 0x1b]
sub r8d, edx
cmp rsi, 0x19
jb 0x49eace
jmp 0x49eb2f
xor eax, eax
lea rbx, [rsp + 0x1b]
mov ecx, 0x19
call fcn.00441400
add rsp, 0x50
pop rbp
ret
mov eax, esi
mov ecx, 0x19
call fcn.00451920
mov eax, edi
mov ecx, 0x19
call fcn.00451920
nop
call fcn.0044f6a0
jmp fcn.0049ea40
Function at 0x4a1fe0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4a20ac
push rbp
mov rbp, rsp
sub rsp, 0x38
movabs rdx, 0x203320928976a087
mov qword [rsp + 0x2a], rdx
movabs rdx, 0x89867592dd852033
mov qword [rsp + 0x30], rdx
movabs rdx, 0xc000c01090b0901
mov qword [rsp + 0x1c], rdx
movabs rdx, 0x80d0003040a0c00
mov qword [rsp + 0x22], rdx
xor eax, eax
jmp 0x4a204f
movzx r9d, byte [rsp + rsi + 0x2a]
sub r9d, edx
lea edx, [r9 - 0x10]
mov byte [rsp + rdi + 0x2a], dl
lea edx, [r8 - 0x10]
mov byte [rsp + rsi + 0x2a], dl
add rax, 2
cmp rax, 0xe
jge 0x4a207c
movzx edx, byte [rsp + rax + 0x1c]
movzx esi, byte [rsp + rax + 0x1d]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0xe
jae 0x4a209f
movzx r8d, byte [rsp + rdi + 0x2a]
sub r8d, edx
cmp rsi, 0xe
jb 0x4a2032
jmp 0x4a2093
xor eax, eax
lea rbx, [rsp + 0x2a]
mov ecx, 0xe
call fcn.00441400
add rsp, 0x38
pop rbp
ret
mov eax, esi
mov ecx, 0xe
call fcn.00451920
mov eax, edi
mov ecx, 0xe
call fcn.00451920
nop
call fcn.0044f6a0
jmp fcn.004a1fe0

Function at 0x4a37e0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4a38cc
push rbp
mov rbp, rsp
sub rsp, 0x40
movabs rdx, 0xc0bf615f20fe20af
mov qword [rsp + 0x19], rdx
movabs rdx, 0x706f20c0bf615f20
mov qword [rsp + 0x1c], rdx
movabs rdx, 0x73ff5fc8c7206e79
mov qword [rsp + 0x24], rdx
movabs rdx, 0xe060f0b040f0f01
mov qword [rsp + 0x2c], rdx
movabs rdx, 0x2080f070e060f0b
mov qword [rsp + 0x30], rdx
movabs rdx, 0xb00081007020b11
mov qword [rsp + 0x38], rdx
xor eax, eax
jmp 0x4a386a
movzx r9d, byte [rsp + rsi + 0x19]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x67]
mov byte [rsp + rdi + 0x19], dl
mov byte [rsp + rsi + 0x19], r8b
add rax, 2
cmp rax, 0x14
jge 0x4a389c
movzx edx, byte [rsp + rax + 0x2c]
movzx esi, byte [rsp + rax + 0x2d]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x13
jae 0x4a38bf
movzx r8d, byte [rsp + rdi + 0x19]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x67]
cmp rsi, 0x13
jb 0x4a3850
jmp 0x4a38b3
xor eax, eax
lea rbx, [rsp + 0x19]
mov ecx, 0x13
call fcn.00441400
add rsp, 0x40
pop rbp
ret
mov eax, esi
mov ecx, 0x13
call fcn.00451920
mov eax, edi
mov ecx, 0x13
call fcn.00451920
nop
call fcn.0044f6a0
jmp fcn.004a37e0
Function at 0x4a3aa0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4a3b86
push rbp
mov rbp, rsp
sub rsp, 0x40
movabs rdx, 0xf8aef14e9834656d
mov qword [rsp + 0x1a], rdx
movabs rdx, 0xc6e6fbed36f6f4a
mov qword [rsp + 0x22], rdx
movabs rdx, 0x30c0b0406020b07
mov qword [rsp + 0x2a], rdx
movabs rdx, 0x6050f030708030c
mov qword [rsp + 0x30], rdx
movabs rdx, 0x403050406030603
mov qword [rsp + 0x38], rdx
xor eax, eax
nop
jmp 0x4a3b20
movzx r9d, byte [rsp + rsi + 0x1a]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x41]
mov byte [rsp + rdi + 0x1a], dl
mov byte [rsp + rsi + 0x1a], r8b
add rax, 2
nop dword [rax]
cmp rax, 0x16
jge 0x4a3b52
movzx edx, byte [rsp + rax + 0x2a]
movzx esi, byte [rsp + rax + 0x2b]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x10
jae 0x4a3b77
movzx r8d, byte [rsp + rdi + 0x1a]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x41]
cmp rsi, 0x10
jb 0x4a3b02
jmp 0x4a3b6b
xor eax, eax
lea rbx, [rsp + 0x1a]
mov ecx, 0x10
nop
call fcn.00441400
add rsp, 0x40
pop rbp
ret
mov eax, esi
mov ecx, 0x10
call fcn.00451920
mov eax, edi
mov ecx, 0x10
nop
call fcn.00451920
nop
call fcn.0044f6a0
jmp fcn.004a3aa0

Function at 0x4a3fa0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4a4086
push rbp
mov rbp, rsp
sub rsp, 0x40
movabs rdx, 0x204d687b6279744d
mov qword [rsp + 0x1d], rdx
movabs rdx, 0x216e6f626f786920
mov qword [rsp + 0x24], rdx
movabs rdx, 0x10b0d0109030402
mov qword [rsp + 0x2c], rdx
movabs rdx, 0x90b0a0e010b0d01
mov qword [rsp + 0x30], rdx
movabs rdx, 0x40b0b0004060405
mov qword [rsp + 0x38], rdx
xor eax, eax
nop
jmp 0x4a4020
movzx r9d, byte [rsp + rsi + 0x1d]
lea edx, [r9 + rdx]
lea edx, [rdx - 0xd]
mov byte [rsp + rdi + 0x1d], dl
mov byte [rsp + rsi + 0x1d], r8b
add rax, 2
nop dword [rax]
cmp rax, 0x14
jge 0x4a4052
movzx edx, byte [rsp + rax + 0x2c]
movzx esi, byte [rsp + rax + 0x2d]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0xf
jae 0x4a4077
movzx r8d, byte [rsp + rdi + 0x1d]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0xd]
cmp rsi, 0xf
jb 0x4a4002
jmp 0x4a406b
xor eax, eax
lea rbx, [rsp + 0x1d]
mov ecx, 0xf
nop
call fcn.00441400
add rsp, 0x40
pop rbp
ret
mov eax, esi
mov ecx, 0xf
call fcn.00451920
mov eax, edi
mov ecx, 0xf
nop
call fcn.00451920
nop
call fcn.0044f6a0
jmp fcn.004a3fa0