joyce8/EMBER2024-capa huggingface dataset:
Function at 0x476840
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x47693d
push rbp
mov rbp, rsp
sub rsp, 0x48
movabs rdx, 0x3bda69113353c122
mov qword [rsp + 0x19], rdx
movabs rdx, 0xed1203bda691133
mov qword [rsp + 0x1c], rdx
movabs rdx, 0x7206203304a06c97
mov qword [rsp + 0x24], rdx
movabs rdx, 0x40a0d0a100f0d07
mov qword [rsp + 0x2c], rdx
movabs rdx, 0x11000b060b060c00
mov qword [rsp + 0x34], rdx
movabs rdx, 0x90b070111000b06
mov qword [rsp + 0x38], rdx
movabs rdx, 0xe0403081104070b
mov qword [rsp + 0x40], rdx
xor eax, eax
jmp 0x4768e0
movzx r9d, byte [rsp + rsi + 0x19]
sub r9d, edx
lea edx, [r9 + 0x62]
mov byte [rsp + rdi + 0x19], dl
lea edx, [r8 + 0x62]
mov byte [rsp + rsi + 0x19], dl
add rax, 2
nop dword [rax]
cmp rax, 0x1c
jge 0x47690d
movzx edx, byte [rsp + rax + 0x2c]
movzx esi, byte [rsp + rax + 0x2d]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x13
jae 0x476930
movzx r8d, byte [rsp + rdi + 0x19]
sub r8d, edx
cmp rsi, 0x13
jb 0x4768bf
jmp 0x476924
xor eax, eax
lea rbx, [rsp + 0x19]
mov ecx, 0x13
call fcn.00441380
add rsp, 0x48
pop rbp
ret
mov eax, esi
mov ecx, 0x13
call fcn.00451880
mov eax, edi
mov ecx, 0x13
call fcn.00451880
nop
nop dword [rax]
call fcn.0044f600
jmp fcn.00476840

Function at 0x477800
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x477938
push rbp
mov rbp, rsp
sub rsp, 0x70
movabs rdx, 0x9a44897265a3bcd1
mov qword [rsp + 0x1e], rdx
movabs rdx, 0xc7159a44897265a3
mov qword [rsp + 0x20], rdx
movabs rdx, 0x90fc6749e513ab1f
mov qword [rsp + 0x28], rdx
movabs rdx, 0xe1ae5f57dcde7e72
mov qword [rsp + 0x30], rdx
movabs rdx, 0x746f696ffe10b29d
mov qword [rsp + 0x38], rdx
movabs rdx, 0xd00141308201605
mov qword [rsp + 0x40], rdx
movabs rdx, 0x90d051118090019
mov qword [rsp + 0x48], rdx
movabs rdx, 0x191a1009080c02
mov qword [rsp + 0x50], rdx
movabs rdx, 0x18130702111a1a0a
mov qword [rsp + 0x58], rdx
movabs rdx, 0x11090b1c1d18071b
mov qword [rsp + 0x60], rdx
movabs rdx, 0xa181a01110b2015
mov qword [rsp + 0x68], rdx
xor eax, eax
jmp 0x4778d8
movzx r9d, byte [rsp + rsi + 0x1e]
sub r9d, edx
lea edx, [r9 - 0x11]
mov byte [rsp + rdi + 0x1e], dl
lea edx, [r8 - 0x11]
mov byte [rsp + rsi + 0x1e], dl
add rax, 2
cmp rax, 0x30
jge 0x477908
movzx edx, byte [rsp + rax + 0x40]
movzx esi, byte [rsp + rax + 0x41]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x22
jae 0x47792b
movzx r8d, byte [rsp + rdi + 0x1e]
sub r8d, edx
nop dword [rax]
cmp rsi, 0x22
jb 0x4778bb
jmp 0x47791f
xor eax, eax
lea rbx, [rsp + 0x1e]
mov ecx, 0x22
call fcn.00441380
add rsp, 0x70
pop rbp
ret
mov eax, esi
mov ecx, 0x22
call fcn.00451880
mov eax, edi
mov ecx, 0x22
call fcn.00451880
nop
call fcn.0044f600
nop dword [rax]
jmp fcn.00477800
Function at 0x478280
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x478346
push rbp
mov rbp, rsp
sub rsp, 0x30
movabs rdx, 0x924db47275aa808b
mov qword [rsp + 0x1a], rdx
mov word [rsp + 0x22], 0x68c5
movabs rdx, 0x205030002020807
mov qword [rsp + 0x24], rdx
mov dword [rsp + 0x2c], 0x2010107
xor eax, eax
jmp 0x4782e0
movzx r9d, byte [rsp + rsi + 0x1a]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x2d]
mov byte [rsp + rdi + 0x1a], dl
mov byte [rsp + rsi + 0x1a], r8b
add rax, 2
nop dword [rax]
cmp rax, 0xc
jge 0x478312
movzx edx, byte [rsp + rax + 0x24]
movzx esi, byte [rsp + rax + 0x25]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0xa
jae 0x478337
movzx r8d, byte [rsp + rdi + 0x1a]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x2d]
cmp rsi, 0xa
jb 0x4782c3
jmp 0x47832b
xor eax, eax
lea rbx, [rsp + 0x1a]
mov ecx, 0xa
nop
call fcn.00441380
add rsp, 0x30
pop rbp
ret
mov eax, esi
mov ecx, 0xa
call fcn.00451880
mov eax, edi
mov ecx, 0xa
nop
call fcn.00451880
nop
call fcn.0044f600
jmp fcn.00478280

Function at 0x478ec0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x478faa
push rbp
mov rbp, rsp
sub rsp, 0x40
movabs rdx, 0x96cb6e2ab9916543
mov qword [rsp + 0x1a], rdx
movabs rdx, 0x493696cb6e2ab991
mov qword [rsp + 0x1c], rdx
movabs rdx, 0x722e74c3446964c9
mov qword [rsp + 0x24], rdx
movabs rdx, 0x70d000400100710
mov qword [rsp + 0x2c], rdx
movabs rdx, 0x1007020a070d0004
mov qword [rsp + 0x30], rdx
movabs rdx, 0x300060e0a0e080e
mov qword [rsp + 0x38], rdx
xor eax, eax
jmp 0x478f4d
movzx r9d, byte [rsp + rsi + 0x1a]
sub r9d, edx
lea edx, [r9 - 0x52]
mov byte [rsp + rdi + 0x1a], dl
lea edx, [r8 - 0x52]
mov byte [rsp + rsi + 0x1a], dl
add rax, 2
cmp rax, 0x14
jge 0x478f7a
movzx edx, byte [rsp + rax + 0x2c]
movzx esi, byte [rsp + rax + 0x2d]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x12
jae 0x478f9d
movzx r8d, byte [rsp + rdi + 0x1a]
sub r8d, edx
cmp rsi, 0x12
jb 0x478f30
jmp 0x478f91
xor eax, eax
lea rbx, [rsp + 0x1a]
mov ecx, 0x12
call fcn.00441380
add rsp, 0x40
pop rbp
ret
mov eax, esi
mov ecx, 0x12
call fcn.00451880
mov eax, edi
mov ecx, 0x12
call fcn.00451880
nop
call fcn.0044f600
jmp fcn.00478ec0
Function at 0x479420
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x47951b
push rbp
mov rbp, rsp
sub rsp, 0x48
movabs rdx, 0x99de83e76debaac1
mov qword [rsp + 0x1a], rdx
movabs rdx, 0xc875f45f99de83e7
mov qword [rsp + 0x1e], rdx
movabs rdx, 0x6e6f69b6eb757463
mov qword [rsp + 0x26], rdx
movabs rdx, 0x1101009020b0f09
mov qword [rsp + 0x2e], rdx
movabs rdx, 0xb0905000609090f
mov qword [rsp + 0x36], rdx
movabs rdx, 0x4020b0905000609
mov qword [rsp + 0x38], rdx
movabs rdx, 0x70907050702100b
mov qword [rsp + 0x40], rdx
xor eax, eax
jmp 0x4794b9
movzx r9d, byte [rsp + rsi + 0x1a]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x40]
mov byte [rsp + rdi + 0x1a], dl
mov byte [rsp + rsi + 0x1a], r8b
add rax, 2
cmp rax, 0x1a
jge 0x4794eb
movzx edx, byte [rsp + rax + 0x2e]
movzx esi, byte [rsp + rax + 0x2f]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x14
jae 0x47950e
movzx r8d, byte [rsp + rdi + 0x1a]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x40]
cmp rsi, 0x14
jb 0x47949f
jmp 0x479502
xor eax, eax
lea rbx, [rsp + 0x1a]
mov ecx, 0x14
call fcn.00441380
add rsp, 0x48
pop rbp
ret
mov eax, esi
mov ecx, 0x14
call fcn.00451880
mov eax, edi
mov ecx, 0x14
call fcn.00451880
nop
nop dword [rax + rax]
call fcn.0044f600
jmp fcn.00479420
Function at 0x487e60
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x487f5b
push rbp
mov rbp, rsp
sub rsp, 0x50
movabs rdx, 0x3c656edb6ed5ca20
mov qword [rsp + 0x1f], rdx
movabs rdx, 0x2b62ebcfed3c656e
mov qword [rsp + 0x24], rdx
movabs rdx, 0xd335f17454bc20e1
mov qword [rsp + 0x2c], rdx
movabs rdx, 0x3020214100f130c
mov qword [rsp + 0x34], rdx
movabs rdx, 0x80a0b0b0f090910
mov qword [rsp + 0x3c], rdx
movabs rdx, 0xc130204080a0b0b
mov qword [rsp + 0x40], rdx
movabs rdx, 0x1030b0d01120b07
mov qword [rsp + 0x48], rdx
xor eax, eax
jmp 0x487ef9
movzx r9d, byte [rsp + rsi + 0x1f]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x75]
mov byte [rsp + rdi + 0x1f], dl
mov byte [rsp + rsi + 0x1f], r8b
add rax, 2
cmp rax, 0x1c
jge 0x487f2b
movzx edx, byte [rsp + rax + 0x34]
movzx esi, byte [rsp + rax + 0x35]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x15
jae 0x487f4e
movzx r8d, byte [rsp + rdi + 0x1f]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x75]
cmp rsi, 0x15
jb 0x487edf
jmp 0x487f42
xor eax, eax
lea rbx, [rsp + 0x1f]
mov ecx, 0x15
call fcn.00441380
add rsp, 0x50
pop rbp
ret
mov eax, esi
mov ecx, 0x15
call fcn.00451880
mov eax, edi
mov ecx, 0x15
call fcn.00451880
nop
nop dword [rax + rax]
call fcn.0044f600
jmp fcn.00487e60

Function at 0x489560
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x48964c
push rbp
mov rbp, rsp
sub rsp, 0x40
movabs rdx, 0xd27463c6c79365c7
mov qword [rsp + 0x19], rdx
movabs rdx, 0xfd27463c6c79365
mov qword [rsp + 0x1a], rdx
movabs rdx, 0xbd9b3e208f006734
mov qword [rsp + 0x22], rdx
movabs rdx, 0xe09070c080c090f
mov qword [rsp + 0x2a], rdx
movabs rdx, 0x1002040f09000e09
mov qword [rsp + 0x30], rdx
movabs rdx, 0xa100b100e03100b
mov qword [rsp + 0x38], rdx
xor eax, eax
jmp 0x4895ea
movzx r9d, byte [rsp + rsi + 0x19]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x75]
mov byte [rsp + rdi + 0x19], dl
mov byte [rsp + rsi + 0x19], r8b
add rax, 2
cmp rax, 0x16
jge 0x48961c
movzx edx, byte [rsp + rax + 0x2a]
movzx esi, byte [rsp + rax + 0x2b]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x11
jae 0x48963f
movzx r8d, byte [rsp + rdi + 0x19]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x75]
cmp rsi, 0x11
jb 0x4895d0
jmp 0x489633
xor eax, eax
lea rbx, [rsp + 0x19]
mov ecx, 0x11
call fcn.00441380
add rsp, 0x40
pop rbp
ret
mov eax, esi
mov ecx, 0x11
call fcn.00451880
mov eax, edi
mov ecx, 0x11
call fcn.00451880
nop
call fcn.0044f600
jmp fcn.00489560
Function at 0x489740
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x48982c
push rbp
mov rbp, rsp
sub rsp, 0x48
movabs rdx, 0x7d74716c18753272
mov qword [rsp + 0x1f], rdx
movabs rdx, 0x3b7d74716c187532
mov qword [rsp + 0x20], rdx
movabs rdx, 0x8266654981a7698f
mov qword [rsp + 0x28], rdx
movabs rdx, 0x10809020e10090b
mov qword [rsp + 0x30], rdx
movabs rdx, 0xb02010d0e0c0d07
mov qword [rsp + 0x38], rdx
movabs rdx, 0x1003050e0a010e04
mov qword [rsp + 0x40], rdx
xor eax, eax
jmp 0x4897ca
movzx r9d, byte [rsp + rsi + 0x1f]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x21]
mov byte [rsp + rdi + 0x1f], dl
mov byte [rsp + rsi + 0x1f], r8b
add rax, 2
cmp rax, 0x18
jge 0x4897fc
movzx edx, byte [rsp + rax + 0x30]
movzx esi, byte [rsp + rax + 0x31]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x11
jae 0x48981f
movzx r8d, byte [rsp + rdi + 0x1f]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x21]
cmp rsi, 0x11
jb 0x4897b0
jmp 0x489813
xor eax, eax
lea rbx, [rsp + 0x1f]
mov ecx, 0x11
call fcn.00441380
add rsp, 0x48
pop rbp
ret
mov eax, esi
mov ecx, 0x11
call fcn.00451880
mov eax, edi
mov ecx, 0x11
call fcn.00451880
nop
call fcn.0044f600
jmp fcn.00489740
Function at 0x48e100
Capabilities:
Encrypt data using rc4 prga

Disassembly:
lea r12, [rsp - 8]
cmp r12, qword [r14 + 0x10]
jbe 0x48e25d
push rbp
mov rbp, rsp
add rsp, 0xffffffffffffff80
movabs rdx, 0x2e749fdb6c66650e
mov qword [rsp + 0x1e], rdx
movabs rdx, 0x6c5398fb0762fcbd
mov qword [rsp + 0x26], rdx
movabs rdx, 0x73effd0daf006c53
mov qword [rsp + 0x2c], rdx
movabs rdx, 0x3d862119faec69ed
mov qword [rsp + 0x34], rdx
movabs rdx, 0x6f132dce23203165
mov qword [rsp + 0x3c], rdx
movabs rdx, 0x73646ef4c4622040
mov qword [rsp + 0x44], rdx
movabs rdx, 0x221f1c0c14050408
mov qword [rsp + 0x4c], rdx
movabs rdx, 0x4192a13221f1c0c
mov qword [rsp + 0x50], rdx
movabs rdx, 0x231d18111004040b
mov qword [rsp + 0x58], rdx
movabs rdx, 0x1800210c0c10090a
mov qword [rsp + 0x60], rdx
movabs rdx, 0x162a0b0d24290914
mov qword [rsp + 0x68], rdx
movabs rdx, 0x120d26102a101912
mov qword [rsp + 0x70], rdx
movabs rdx, 0x111a110b110b1f1b
mov qword [rsp + 0x78], rdx
xor eax, eax
jmp 0x48e200
movzx r9d, byte [rsp + rsi + 0x1e]
sub r9d, edx
lea edx, [r9 - 0x79]
mov byte [rsp + rdi + 0x1e], dl
lea edx, [r8 - 0x79]
mov byte [rsp + rsi + 0x1e], dl
add rax, 2
nop dword [rax + rax]
cmp rax, 0x34
jge 0x48e22d
movzx edx, byte [rsp + rax + 0x4c]
movzx esi, byte [rsp + rax + 0x4d]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x2e
jae 0x48e250
movzx r8d, byte [rsp + rdi + 0x1e]
sub r8d, edx
cmp rsi, 0x2e
jb 0x48e1de
jmp 0x48e244
xor eax, eax
lea rbx, [rsp + 0x1e]
mov ecx, 0x2e
call fcn.00441380
sub rsp, 0xffffffffffffff80
pop rbp
ret
mov eax, esi
mov ecx, 0x2e
call fcn.00451880
mov eax, edi
mov ecx, 0x2e
call fcn.00451880
nop
nop dword [rax]
call fcn.0044f600
jmp fcn.0048e100
Function at 0x48faa0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x48fbe7
push rbp
mov rbp, rsp
sub rsp, 0x78
movabs rdx, 0x2e43a80b7530d515
mov qword [rsp + 0x1f], rdx
movabs rdx, 0x6c94b0a4e6785a7e
mov qword [rsp + 0x27], rdx
movabs rdx, 0x446c94b0a4e6785a
mov qword [rsp + 0x28], rdx
movabs rdx, 0x6865e3f46f59e265
mov qword [rsp + 0x30], rdx
movabs rdx, 0x59647774d7756175
mov qword [rsp + 0x38], rdx
movabs rdx, 0x64e6e161f5494469
mov qword [rsp + 0x40], rdx
movabs rdx, 0xe13241006061e01
mov qword [rsp + 0x48], rdx
movabs rdx, 0x16020b220b180203
mov qword [rsp + 0x50], rdx
movabs rdx, 0x903120e230d2820
mov qword [rsp + 0x58], rdx
movabs rdx, 0x15060b030d202416
mov qword [rsp + 0x60], rdx
movabs rdx, 0x11c081c0c192627
mov qword [rsp + 0x68], rdx
movabs rdx, 0x50c231900280424
mov qword [rsp + 0x70], rdx
xor eax, eax
jmp 0x48fb87
movzx r9d, byte [rsp + rsi + 0x1f]
sub r9d, edx
lea edx, [r9 - 0x51]
mov byte [rsp + rdi + 0x1f], dl
lea edx, [r8 - 0x51]
mov byte [rsp + rsi + 0x1f], dl
add rax, 2
cmp rax, 0x30
jge 0x48fbb7
movzx edx, byte [rsp + rax + 0x48]
movzx esi, byte [rsp + rax + 0x49]
mov edi, edx
xor edx, esi
add edx, eax
nop dword [rax]
cmp rdi, 0x29
jae 0x48fbda
movzx r8d, byte [rsp + rdi + 0x1f]
sub r8d, edx
cmp rsi, 0x29
jb 0x48fb6a
jmp 0x48fbce
xor eax, eax
lea rbx, [rsp + 0x1f]
mov ecx, 0x29
call fcn.00441380
add rsp, 0x78
pop rbp
ret
mov eax, esi
mov ecx, 0x29
call fcn.00451880
mov eax, edi
mov ecx, 0x29
call fcn.00451880
nop
call fcn.0044f600
jmp fcn.0048faa0

Function at 0x490080
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4901d8
push rbp
mov rbp, rsp
sub rsp, 0x78
movabs rdx, 0x92b0717457bb9bab
mov qword [rsp + 0x1a], rdx
movabs rdx, 0x8398a784706c9080
mov qword [rsp + 0x22], rdx
movabs rdx, 0x74b58398a784706c
mov qword [rsp + 0x24], rdx
movabs rdx, 0x7893706e9bbb5c65
mov qword [rsp + 0x2c], rdx
movabs rdx, 0x206ca7749b853a97
mov qword [rsp + 0x34], rdx
movabs rdx, 0xa5767461d18a745f
mov qword [rsp + 0x3c], rdx
movabs rdx, 0x1d240f25021f1509
mov qword [rsp + 0x44], rdx
movabs rdx, 0x241003141d240f25
mov qword [rsp + 0x48], rdx
movabs rdx, 0x150e18220f012911
mov qword [rsp + 0x50], rdx
movabs rdx, 0x291c291c0d061307
mov qword [rsp + 0x58], rdx
movabs rdx, 0x1a1125032422
mov qword [rsp + 0x60], rdx
movabs rdx, 0x12000291b0d1f0c
mov qword [rsp + 0x68], rdx
movabs rdx, 0x280b0e1705081824
mov qword [rsp + 0x70], rdx
xor eax, eax
jmp 0x490173
movzx r9d, byte [rsp + rsi + 0x1a]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x56]
mov byte [rsp + rdi + 0x1a], dl
mov byte [rsp + rsi + 0x1a], r8b
add rax, 2
cmp rax, 0x34
jge 0x4901a8
movzx edx, byte [rsp + rax + 0x44]
movzx esi, byte [rsp + rax + 0x45]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x2a
jae 0x4901cb
movzx r8d, byte [rsp + rdi + 0x1a]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x56]
nop dword [rax]
cmp rsi, 0x2a
jb 0x490159
jmp 0x4901bf
xor eax, eax
lea rbx, [rsp + 0x1a]
mov ecx, 0x2a
call fcn.00441380
add rsp, 0x78
pop rbp
ret
mov eax, esi
mov ecx, 0x2a
call fcn.00451880
mov eax, edi
mov ecx, 0x2a
call fcn.00451880
nop
call fcn.0044f600
nop dword [rax]
jmp fcn.00490080
Function at 0x4912a0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4913a8
push rbp
mov rbp, rsp
sub rsp, 0x50
movabs rdx, 0x15f7bcc1d76665f5
mov qword [rsp + 0x18], rdx
movabs rdx, 0x1443351a751d0bd6
mov qword [rsp + 0x20], rdx
movabs rdx, 0xbd5b1443351a751d
mov qword [rsp + 0x22], rdx
movabs rdx, 0x65ef6166f9657411
mov qword [rsp + 0x2a], rdx
movabs rdx, 0x8100608110506
mov qword [rsp + 0x32], rdx
movabs rdx, 0xc030a060d030904
mov qword [rsp + 0x3a], rdx
movabs rdx, 0x70c0a1110120c03
mov qword [rsp + 0x40], rdx
movabs rdx, 0xf09091209151809
mov qword [rsp + 0x48], rdx
xor eax, eax
jmp 0x49134b
movzx r9d, byte [rsp + rsi + 0x18]
sub r9d, edx
lea edx, [r9 + 0x6f]
mov byte [rsp + rdi + 0x18], dl
lea edx, [r8 + 0x6f]
mov byte [rsp + rsi + 0x18], dl
add rax, 2
cmp rax, 0x1e
jge 0x491378
movzx edx, byte [rsp + rax + 0x32]
movzx esi, byte [rsp + rax + 0x33]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x1a
jae 0x49139b
movzx r8d, byte [rsp + rdi + 0x18]
sub r8d, edx
cmp rsi, 0x1a
jb 0x49132e
jmp 0x49138f
xor eax, eax
lea rbx, [rsp + 0x18]
mov ecx, 0x1a
call fcn.00441380
add rsp, 0x50
pop rbp
ret
mov eax, esi
mov ecx, 0x1a
call fcn.00451880
mov eax, edi
mov ecx, 0x1a
call fcn.00451880
nop
call fcn.0044f600
jmp fcn.004912a0

Function at 0x4913c0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4914aa
push rbp
mov rbp, rsp
sub rsp, 0x40
movabs rdx, 0x83ab916d7db6c065
mov qword [rsp + 0x19], rdx
movabs rdx, 0x7d83ab916d7db6c0
mov qword [rsp + 0x1a], rdx
movabs rdx, 0x7e6e49b76e756c9b
mov qword [rsp + 0x22], rdx
movabs rdx, 0xd09060900071001
mov qword [rsp + 0x2a], rdx
movabs rdx, 0x80c0210040d0d09
mov qword [rsp + 0x30], rdx
movabs rdx, 0xd07050609100302
mov qword [rsp + 0x38], rdx
xor eax, eax
jmp 0x49144d
movzx r9d, byte [rsp + rsi + 0x19]
sub r9d, edx
lea edx, [r9 - 8]
mov byte [rsp + rdi + 0x19], dl
lea edx, [r8 - 8]
mov byte [rsp + rsi + 0x19], dl
add rax, 2
cmp rax, 0x16
jge 0x49147a
movzx edx, byte [rsp + rax + 0x2a]
movzx esi, byte [rsp + rax + 0x2b]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x11
jae 0x49149d
movzx r8d, byte [rsp + rdi + 0x19]
sub r8d, edx
cmp rsi, 0x11
jb 0x491430
jmp 0x491491
xor eax, eax
lea rbx, [rsp + 0x19]
mov ecx, 0x11
call fcn.00441380
add rsp, 0x40
pop rbp
ret
mov eax, esi
mov ecx, 0x11
call fcn.00451880
mov eax, edi
mov ecx, 0x11
call fcn.00451880
nop
call fcn.0044f600
jmp fcn.004913c0
Function at 0x492dc0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x492ebb
push rbp
mov rbp, rsp
sub rsp, 0x48
movabs rdx, 0x3b74b7652366e4d2
mov qword [rsp + 0x1b], rdx
movabs rdx, 0x6c03563b74b76523
mov qword [rsp + 0x1e], rdx
movabs rdx, 0xcff964d6f5045193
mov qword [rsp + 0x26], rdx
movabs rdx, 0x110d090c0e110105
mov qword [rsp + 0x2e], rdx
movabs rdx, 0xe11000c120f0112
mov qword [rsp + 0x36], rdx
movabs rdx, 0x110e11000c120f
mov qword [rsp + 0x38], rdx
movabs rdx, 0x911000b070b0309
mov qword [rsp + 0x40], rdx
xor eax, eax
jmp 0x492e59
movzx r9d, byte [rsp + rsi + 0x1b]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x7b]
mov byte [rsp + rdi + 0x1b], dl
mov byte [rsp + rsi + 0x1b], r8b
add rax, 2
cmp rax, 0x1a
jge 0x492e8b
movzx edx, byte [rsp + rax + 0x2e]
movzx esi, byte [rsp + rax + 0x2f]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x13
jae 0x492eae
movzx r8d, byte [rsp + rdi + 0x1b]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x7b]
cmp rsi, 0x13
jb 0x492e3f
jmp 0x492ea2
xor eax, eax
lea rbx, [rsp + 0x1b]
mov ecx, 0x13
call fcn.00441380
add rsp, 0x48
pop rbp
ret
mov eax, esi
mov ecx, 0x13
call fcn.00451880
mov eax, edi
mov ecx, 0x13
call fcn.00451880
nop
nop dword [rax + rax]
call fcn.0044f600
jmp fcn.00492dc0
Function at 0x498c20
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x498d0c
push rbp
mov rbp, rsp
sub rsp, 0x48
movabs rdx, 0x756069666b76277a
mov qword [rsp + 0x1e], rdx
movabs rdx, 0x6b68727775606966
mov qword [rsp + 0x22], rdx
movabs rdx, 0x716c83676b722068
mov qword [rsp + 0x2a], rdx
movabs rdx, 0x813100603101108
mov qword [rsp + 0x32], rdx
movabs rdx, 0xf000b13130813
mov qword [rsp + 0x38], rdx
movabs rdx, 0x10040a0c000c0107
mov qword [rsp + 0x40], rdx
xor eax, eax
jmp 0x498caa
movzx r9d, byte [rsp + rsi + 0x1e]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x1b]
mov byte [rsp + rdi + 0x1e], dl
mov byte [rsp + rsi + 0x1e], r8b
add rax, 2
cmp rax, 0x16
jge 0x498cdc
movzx edx, byte [rsp + rax + 0x32]
movzx esi, byte [rsp + rax + 0x33]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x14
jae 0x498cff
movzx r8d, byte [rsp + rdi + 0x1e]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x1b]
cmp rsi, 0x14
jb 0x498c90
jmp 0x498cf3
xor eax, eax
lea rbx, [rsp + 0x1e]
mov ecx, 0x14
call fcn.00441380
add rsp, 0x48
pop rbp
ret
mov eax, esi
mov ecx, 0x14
call fcn.00451880
mov eax, edi
mov ecx, 0x14
call fcn.00451880
nop
call fcn.0044f600
jmp fcn.00498c20

Function at 0x498f80
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x49904c
push rbp
mov rbp, rsp
sub rsp, 0x38
movabs rdx, 0xd163657697d16ee1
mov qword [rsp + 0x1a], rdx
movabs rdx, 0xaea58cab6465d163
mov qword [rsp + 0x20], rdx
movabs rdx, 0xc0000070304020b
mov qword [rsp + 0x28], rdx
movabs rdx, 0xb0c070b0d030a03
mov qword [rsp + 0x30], rdx
xor eax, eax
jmp 0x498fef
movzx r9d, byte [rsp + rsi + 0x1a]
sub r9d, edx
lea edx, [r9 - 0x1e]
mov byte [rsp + rdi + 0x1a], dl
lea edx, [r8 - 0x1e]
mov byte [rsp + rsi + 0x1a], dl
add rax, 2
cmp rax, 0x10
jge 0x49901c
movzx edx, byte [rsp + rax + 0x28]
movzx esi, byte [rsp + rax + 0x29]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0xe
jae 0x49903f
movzx r8d, byte [rsp + rdi + 0x1a]
sub r8d, edx
cmp rsi, 0xe
jb 0x498fd2
jmp 0x499033
xor eax, eax
lea rbx, [rsp + 0x1a]
mov ecx, 0xe
call fcn.00441380
add rsp, 0x38
pop rbp
ret
mov eax, esi
mov ecx, 0xe
call fcn.00451880
mov eax, edi
mov ecx, 0xe
call fcn.00451880
nop
call fcn.0044f600
jmp fcn.00498f80
Function at 0x49b780
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x49b84a
push rbp
mov rbp, rsp
sub rsp, 0x48
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x58], rax
mov qword [rsp], rax
mov qword [rsp + 8], rbx
mov byte [rsp + 0x10], 0
call fcn.00403080
xorps xmm15, xmm15
mov r14, qword [0x0078a990]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x18], 0xffffffffffffffff
jne 0x49b82f
mov rcx, qword [rsp + 0x60]
lea rdx, [rcx + 1]
mov qword [rsp + 0x40], rdx
lea rax, [0x0051f6e0]
xor ebx, ebx
mov rcx, rdx
call fcn.0043dec0
mov rbx, qword [rsp + 0x60]
mov rcx, rax
xor edi, edi
mov rsi, qword [rsp + 0x40]
mov rax, qword [rsp + 0x58]
nop dword [rax]
call fcn.0049d8e0
inc rbx
cmp rcx, rbx
jae 0x49b81e
mov edi, 1
lea rsi, [0x0051f6e0]
call fcn.0043dfa0
mov word [rax + rbx*2 - 2], 0
xor edi, edi
xor esi, esi
add rsp, 0x48
pop rbp
ret
xor eax, eax
xor ebx, ebx
mov rcx, rbx
lea rdi, [0x006a5838]
lea rsi, [0x006a54a0]
add rsp, 0x48
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.0044f600
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.0049b780

Function at 0x49c9e0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x49caca
push rbp
mov rbp, rsp
sub rsp, 0x48
movabs rdx, 0xe7f1642023427375
mov qword [rsp + 0x1b], rdx
movabs rdx, 0x5ed381134e7f164
mov qword [rsp + 0x20], rdx
movabs rdx, 0xbe20166150fc2852
mov qword [rsp + 0x28], rdx
movabs rdx, 0xb0e060f07140312
mov qword [rsp + 0x30], rdx
movabs rdx, 0xd120c0714090f0e
mov qword [rsp + 0x38], rdx
movabs rdx, 0x6070a0803100902
mov qword [rsp + 0x40], rdx
xor eax, eax
jmp 0x49ca6d
movzx r9d, byte [rsp + rsi + 0x1b]
sub r9d, edx
lea edx, [r9 + 0x47]
mov byte [rsp + rdi + 0x1b], dl
lea edx, [r8 + 0x47]
mov byte [rsp + rsi + 0x1b], dl
add rax, 2
cmp rax, 0x18
jge 0x49ca9a
movzx edx, byte [rsp + rax + 0x30]
movzx esi, byte [rsp + rax + 0x31]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x15
jae 0x49cabd
movzx r8d, byte [rsp + rdi + 0x1b]
sub r8d, edx
cmp rsi, 0x15
jb 0x49ca50
jmp 0x49cab1
xor eax, eax
lea rbx, [rsp + 0x1b]
mov ecx, 0x15
call fcn.00441380
add rsp, 0x48
pop rbp
ret
mov eax, esi
mov ecx, 0x15
call fcn.00451880
mov eax, edi
mov ecx, 0x15
call fcn.00451880
nop
call fcn.0044f600
jmp fcn.0049c9e0