joyce8/EMBER2024-capa huggingface dataset:
Function at 0x487620
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x48771d
push rbp
mov rbp, rsp
sub rsp, 0x50
movabs rdx, 0xa1e56d7263799170
mov qword [rsp + 0x1a], rdx
movabs rdx, 0x37c87c828b6465b1
mov qword [rsp + 0x22], rdx
movabs rdx, 0xa2d28284cf9120bd
mov qword [rsp + 0x2a], rdx
movabs rdx, 0x413040206021208
mov qword [rsp + 0x32], rdx
movabs rdx, 0x160b0112040b0e10
mov qword [rsp + 0x3a], rdx
movabs rdx, 0xf0d14100f0b160b
mov qword [rsp + 0x40], rdx
movabs rdx, 0xc0e170714151413
mov qword [rsp + 0x48], rdx
xor eax, eax
jmp 0x4876c0
movzx r9d, byte [rsp + rsi + 0x1a]
sub r9d, edx
lea edx, [r9 - 3]
mov byte [rsp + rdi + 0x1a], dl
lea edx, [r8 - 3]
mov byte [rsp + rsi + 0x1a], dl
add rax, 2
nop dword [rax]
cmp rax, 0x1e
jge 0x4876ed
movzx edx, byte [rsp + rax + 0x32]
movzx esi, byte [rsp + rax + 0x33]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x18
jae 0x487710
movzx r8d, byte [rsp + rdi + 0x1a]
sub r8d, edx
cmp rsi, 0x18
jb 0x48769f
jmp 0x487704
xor eax, eax
lea rbx, [rsp + 0x1a]
mov ecx, 0x18
call fcn.00441380
add rsp, 0x50
pop rbp
ret
mov eax, esi
mov ecx, 0x18
call fcn.00451880
mov eax, edi
mov ecx, 0x18
call fcn.00451880
nop
nop dword [rax]
call fcn.0044f600
jmp fcn.00487620
Function at 0x488880
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x48898c
push rbp
mov rbp, rsp
sub rsp, 0x58
movabs rdx, 0x19572a659ba6c376
mov qword [rsp + 0x1b], rdx
movabs rdx, 0x7669b019ccadd46d
mov qword [rsp + 0x23], rdx
movabs rdx, 0x72d3ca208a7669b0
mov qword [rsp + 0x28], rdx
movabs rdx, 0x74f8f366e7b07465
mov qword [rsp + 0x30], rdx
movabs rdx, 0x503170702061306
mov qword [rsp + 0x38], rdx
movabs rdx, 0xa010710170d090c
mov qword [rsp + 0x40], rdx
movabs rdx, 0x12131a010a0d170f
mov qword [rsp + 0x48], rdx
movabs rdx, 0x61b0718120b0517
mov qword [rsp + 0x50], rdx
xor eax, eax
jmp 0x488928
movzx r9d, byte [rsp + rsi + 0x1b]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x3f]
mov byte [rsp + rdi + 0x1b], dl
mov byte [rsp + rsi + 0x1b], r8b
add rax, 2
cmp rax, 0x20
jge 0x48895c
movzx edx, byte [rsp + rax + 0x38]
movzx esi, byte [rsp + rax + 0x39]
mov edi, edx
xor edx, esi
add edx, eax
nop
cmp rdi, 0x1d
jae 0x48897f
movzx r8d, byte [rsp + rdi + 0x1b]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x3f]
cmp rsi, 0x1d
jb 0x48890e
jmp 0x488973
xor eax, eax
lea rbx, [rsp + 0x1b]
mov ecx, 0x1d
call fcn.00441380
add rsp, 0x58
pop rbp
ret
mov eax, esi
mov ecx, 0x1d
call fcn.00451880
mov eax, edi
mov ecx, 0x1d
call fcn.00451880
nop
call fcn.0044f600
jmp fcn.00488880
Function at 0x4897c0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4898a6
push rbp
mov rbp, rsp
sub rsp, 0x38
movabs rdx, 0x36e77f4f76b6e37
mov qword [rsp + 0x18], rdx
movabs rdx, 0xf9b482effd06036e
mov qword [rsp + 0x1e], rdx
movabs rdx, 0x7080c0c0008040b
mov qword [rsp + 0x26], rdx
movabs rdx, 0xc0807080c0c0008
mov qword [rsp + 0x28], rdx
movabs rdx, 0xd0c090a04030809
mov qword [rsp + 0x30], rdx
xor eax, eax
nop
jmp 0x489840
movzx r9d, byte [rsp + rsi + 0x18]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x65]
mov byte [rsp + rdi + 0x18], dl
mov byte [rsp + rsi + 0x18], r8b
add rax, 2
nop dword [rax]
cmp rax, 0x12
jge 0x489872
movzx edx, byte [rsp + rax + 0x26]
movzx esi, byte [rsp + rax + 0x27]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0xe
jae 0x489897
movzx r8d, byte [rsp + rdi + 0x18]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x65]
cmp rsi, 0xe
jb 0x489822
jmp 0x48988b
xor eax, eax
lea rbx, [rsp + 0x18]
mov ecx, 0xe
nop
call fcn.00441380
add rsp, 0x38
pop rbp
ret
mov eax, esi
mov ecx, 0xe
call fcn.00451880
mov eax, edi
mov ecx, 0xe
nop
call fcn.00451880
nop
call fcn.0044f600
jmp fcn.004897c0

Function at 0x48ab60
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x48ac2c
push rbp
mov rbp, rsp
sub rsp, 0x30
movabs rdx, 0x72b464ce22d52929
mov qword [rsp + 0x19], rdx
movabs rdx, 0x28066772b464ce22
mov qword [rsp + 0x1c], rdx
movabs rdx, 0x401020103030000
mov qword [rsp + 0x24], rdx
mov dword [rsp + 0x2c], 0x1090906
xor eax, eax
jmp 0x48abc5
movzx r9d, byte [rsp + rsi + 0x19]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x44]
mov byte [rsp + rdi + 0x19], dl
mov byte [rsp + rsi + 0x19], r8b
add rax, 2
cmp rax, 0xc
jge 0x48abfc
movzx edx, byte [rsp + rax + 0x24]
movzx esi, byte [rsp + rax + 0x25]
mov edi, edx
xor edx, esi
add edx, eax
nop dword [rax + rax]
cmp rdi, 0xb
jae 0x48ac1f
movzx r8d, byte [rsp + rdi + 0x19]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x44]
cmp rsi, 0xb
jb 0x48abab
jmp 0x48ac13
xor eax, eax
lea rbx, [rsp + 0x19]
mov ecx, 0xb
call fcn.00441380
add rsp, 0x30
pop rbp
ret
mov eax, esi
mov ecx, 0xb
call fcn.00451880
mov eax, edi
mov ecx, 0xb
call fcn.00451880
nop
call fcn.0044f600
jmp fcn.0048ab60
Function at 0x48c7c0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
lea r12, [rsp - 8]
cmp r12, qword [r14 + 0x10]
jbe 0x48c92c
push rbp
mov rbp, rsp
add rsp, 0xffffffffffffff80
movabs rdx, 0x1374bf37f0d6bdeb
mov qword [rsp + 0x19], rdx
movabs rdx, 0x616e72f866692353
mov qword [rsp + 0x21], rdx
movabs rdx, 0xe19865bbbe616e72
mov qword [rsp + 0x26], rdx
movabs rdx, 0xae76a6df4ced72c7
mov qword [rsp + 0x2e], rdx
movabs rdx, 0x50cc78cf20643701
mov qword [rsp + 0x36], rdx
movabs rdx, 0xd75a0f4ec7b75b6f
mov qword [rsp + 0x3e], rdx
movabs rdx, 0x181110262b041714
mov qword [rsp + 0x46], rdx
movabs rdx, 0x2822052604291c08
mov qword [rsp + 0x4e], rdx
movabs rdx, 0x2422282205260429
mov qword [rsp + 0x50], rdx
movabs rdx, 0xc0926110b141d
mov qword [rsp + 0x58], rdx
movabs rdx, 0x724210204231e10
mov qword [rsp + 0x60], rdx
movabs rdx, 0x1022030b19091d2b
mov qword [rsp + 0x68], rdx
movabs rdx, 0x11131a242a032601
mov qword [rsp + 0x70], rdx
movabs rdx, 0x2c281505270a1c03
mov qword [rsp + 0x78], rdx
xor eax, eax
jmp 0x48c8c7
movzx r9d, byte [rsp + rsi + 0x19]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x56]
mov byte [rsp + rdi + 0x19], dl
mov byte [rsp + rsi + 0x19], r8b
add rax, 2
cmp rax, 0x3a
jge 0x48c8fc
movzx edx, byte [rsp + rax + 0x46]
movzx esi, byte [rsp + rax + 0x47]
mov edi, edx
xor edx, esi
add edx, eax
nop dword [rax]
cmp rdi, 0x2d
jae 0x48c91f
movzx r8d, byte [rsp + rdi + 0x19]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x56]
cmp rsi, 0x2d
jb 0x48c8ad
jmp 0x48c913
xor eax, eax
lea rbx, [rsp + 0x19]
mov ecx, 0x2d
call fcn.00441380
sub rsp, 0xffffffffffffff80
pop rbp
ret
mov eax, esi
mov ecx, 0x2d
call fcn.00451880
mov eax, edi
mov ecx, 0x2d
call fcn.00451880
nop
call fcn.0044f600
jmp fcn.0048c7c0
Function at 0x48cca0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
lea r12, [rsp - 0x10]
cmp r12, qword [r14 + 0x10]
jbe 0x48ce27
push rbp
mov rbp, rsp
sub rsp, 0x88
movabs rdx, 0x2ea863f2541f3b72
mov qword [rsp + 0x1b], rdx
movabs rdx, 0xee2ea863f2541f3b
mov qword [rsp + 0x1c], rdx
movabs rdx, 0x1830532630d76c15
mov qword [rsp + 0x24], rdx
movabs rdx, 0xc7dc0e4a20ea6563
mov qword [rsp + 0x2c], rdx
movabs rdx, 0xeaea7520e1241365
mov qword [rsp + 0x34], rdx
movabs rdx, 0xf2ea019f45724631
mov qword [rsp + 0x3c], rdx
movabs rdx, 0x1261e9cd8e20276c
mov qword [rsp + 0x44], rdx
movabs rdx, 0x271f0c210b2e2d0b
mov qword [rsp + 0x4c], rdx
movabs rdx, 0x251b020413180430
mov qword [rsp + 0x54], rdx
movabs rdx, 0x1b2e1c15251b0204
mov qword [rsp + 0x58], rdx
movabs rdx, 0x162006032422280d
mov qword [rsp + 0x60], rdx
movabs rdx, 0x161b2e30170f041f
mov qword [rsp + 0x68], rdx
movabs rdx, 0x272a031618132c0b
mov qword [rsp + 0x70], rdx
movabs rdx, 0x100f0b1a1a080103
mov qword [rsp + 0x78], rdx
movabs rdx, 0x9181626012d1513
mov qword [rsp + 0x80], rdx
xor eax, eax
jmp 0x48cdc0
movzx r9d, byte [rsp + rsi + 0x1b]
lea edx, [r9 + rdx]
lea edx, [rdx + 3]
mov byte [rsp + rdi + 0x1b], dl
mov byte [rsp + rsi + 0x1b], r8b
add rax, 2
nop dword [rax]
cmp rax, 0x3c
jge 0x48cdf2
movzx edx, byte [rsp + rax + 0x4c]
movzx esi, byte [rsp + rax + 0x4d]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x31
jae 0x48ce1a
movzx r8d, byte [rsp + rdi + 0x1b]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 3]
cmp rsi, 0x31
jb 0x48cda2
jmp 0x48ce0e
xor eax, eax
lea rbx, [rsp + 0x1b]
mov ecx, 0x31
nop
call fcn.00441380
add rsp, 0x88
pop rbp
ret
mov eax, esi
mov ecx, 0x31
call fcn.00451880
mov eax, edi
mov ecx, 0x31
call fcn.00451880
nop
call fcn.0044f600
jmp fcn.0048cca0
Function at 0x48dee0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
lea r12, [rsp - 0x38]
cmp r12, qword [r14 + 0x10]
jbe 0x48e035
push rbp
mov rbp, rsp
sub rsp, 0xb0
movabs rdx, 0x6274637e18ab0f93
mov qword [rsp + 0x1a], rdx
movabs rdx, 0xe6636508d3657220
mov qword [rsp + 0x22], rdx
movabs rdx, 0xc516730a082ee663
mov qword [rsp + 0x28], rdx
movabs rdx, 0xfff874e0bd6f936b
mov qword [rsp + 0x30], rdx
movabs rdx, 0x92206ec1960ab11b
mov qword [rsp + 0x38], rdx
movabs rdx, 0x6e9616ead713870e
mov qword [rsp + 0x40], rdx
movabs rdx, 0x15c0f1bc560be530
mov qword [rsp + 0x48], rdx
movabs rdx, 0x1c37d57f1b631a39
mov qword [rsp + 0x50], rdx
movabs rdx, 0x31191f1919351a15
mov qword [rsp + 0x58], rdx
lea rdi, [rsp + 0x60]
lea rsi, [0x006c8b80]
nop word [rax + rax]
nop word [rax + rax]
nop
mov qword [rsp - 0x10], rbp
lea rbp, [rsp - 0x10]
call fcn.00451eba
mov rbp, qword [rbp]
xor eax, eax
jmp 0x48dfd4
movzx r9d, byte [rsp + rsi + 0x1a]
sub r9d, edx
lea edx, [r9 - 0x37]
mov byte [rsp + rdi + 0x1a], dl
lea edx, [r8 - 0x37]
mov byte [rsp + rsi + 0x1a], dl
add rax, 2
cmp rax, 0x58
jge 0x48e002
movzx edx, byte [rsp + rax + 0x58]
movzx esi, byte [rsp + rax + 0x59]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x3e
jae 0x48e028
movzx r8d, byte [rsp + rdi + 0x1a]
sub r8d, edx
cmp rsi, 0x3e
jb 0x48dfb7
nop
jmp 0x48e01c
xor eax, eax
lea rbx, [rsp + 0x1a]
mov ecx, 0x3e
call fcn.00441380
add rsp, 0xb0
pop rbp
ret
mov eax, esi
mov ecx, 0x3e
call fcn.00451880
mov eax, edi
mov ecx, 0x3e
call fcn.00451880
nop
call fcn.0044f600
jmp fcn.0048dee0

Function at 0x491b40
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x491c2a
push rbp
mov rbp, rsp
sub rsp, 0x48
movabs rdx, 0x4774dfc9c56688c2
mov qword [rsp + 0x1f], rdx
movabs rdx, 0xd0d0564774dfc9c5
mov qword [rsp + 0x22], rdx
movabs rdx, 0xd61c2c27cee6651e
mov qword [rsp + 0x2a], rdx
movabs rdx, 0x100a0f040d011100
mov qword [rsp + 0x32], rdx
movabs rdx, 0x70104000a0a100a
mov qword [rsp + 0x38], rdx
movabs rdx, 0x50e1201050b0903
mov qword [rsp + 0x40], rdx
xor eax, eax
jmp 0x491bcd
movzx r9d, byte [rsp + rsi + 0x1f]
sub r9d, edx
lea edx, [r9 - 0x4c]
mov byte [rsp + rdi + 0x1f], dl
lea edx, [r8 - 0x4c]
mov byte [rsp + rsi + 0x1f], dl
add rax, 2
cmp rax, 0x16
jge 0x491bfa
movzx edx, byte [rsp + rax + 0x32]
movzx esi, byte [rsp + rax + 0x33]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x13
jae 0x491c1d
movzx r8d, byte [rsp + rdi + 0x1f]
sub r8d, edx
cmp rsi, 0x13
jb 0x491bb0
jmp 0x491c11
xor eax, eax
lea rbx, [rsp + 0x1f]
mov ecx, 0x13
call fcn.00441380
add rsp, 0x48
pop rbp
ret
mov eax, esi
mov ecx, 0x13
call fcn.00451880
mov eax, edi
mov ecx, 0x13
call fcn.00451880
nop
call fcn.0044f600
jmp fcn.00491b40
Function at 0x491c40
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x491d2c
push rbp
mov rbp, rsp
sub rsp, 0x40
movabs rdx, 0x9da088de7c666972
mov qword [rsp + 0x19], rdx
movabs rdx, 0x6c61569da088de7c
mov qword [rsp + 0x1c], rdx
movabs rdx, 0x998665b1882eb1b3
mov qword [rsp + 0x24], rdx
movabs rdx, 0x10e070b0411030f
mov qword [rsp + 0x2c], rdx
movabs rdx, 0x6121112010e070b
mov qword [rsp + 0x30], rdx
movabs rdx, 0x120605030f07050c
mov qword [rsp + 0x38], rdx
xor eax, eax
jmp 0x491cca
movzx r9d, byte [rsp + rsi + 0x19]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x38]
mov byte [rsp + rdi + 0x19], dl
mov byte [rsp + rsi + 0x19], r8b
add rax, 2
cmp rax, 0x14
jge 0x491cfc
movzx edx, byte [rsp + rax + 0x2c]
movzx esi, byte [rsp + rax + 0x2d]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x13
jae 0x491d1f
movzx r8d, byte [rsp + rdi + 0x19]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x38]
cmp rsi, 0x13
jb 0x491cb0
jmp 0x491d13
xor eax, eax
lea rbx, [rsp + 0x19]
mov ecx, 0x13
call fcn.00441380
add rsp, 0x40
pop rbp
ret
mov eax, esi
mov ecx, 0x13
call fcn.00451880
mov eax, edi
mov ecx, 0x13
call fcn.00451880
nop
call fcn.0044f600
jmp fcn.00491c40

Function at 0x492c20
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x492d0c
push rbp
mov rbp, rsp
sub rsp, 0x40
movabs rdx, 0x2e4a63595b744672
mov qword [rsp + 0x1a], rdx
movabs rdx, 0x44672e4a63595b74
mov qword [rsp + 0x1c], rdx
movabs rdx, 0x406c51456356651d
mov qword [rsp + 0x24], rdx
movabs rdx, 0x80f09030111020b
mov qword [rsp + 0x2c], rdx
movabs rdx, 0x10c1011080f0903
mov qword [rsp + 0x30], rdx
movabs rdx, 0xa0d03100d06040c
mov qword [rsp + 0x38], rdx
xor eax, eax
jmp 0x492caa
movzx r9d, byte [rsp + rsi + 0x1a]
lea edx, [r9 + rdx]
lea edx, [rdx - 8]
mov byte [rsp + rdi + 0x1a], dl
mov byte [rsp + rsi + 0x1a], r8b
add rax, 2
cmp rax, 0x14
jge 0x492cdc
movzx edx, byte [rsp + rax + 0x2c]
movzx esi, byte [rsp + rax + 0x2d]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x12
jae 0x492cff
movzx r8d, byte [rsp + rdi + 0x1a]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 8]
cmp rsi, 0x12
jb 0x492c90
jmp 0x492cf3
xor eax, eax
lea rbx, [rsp + 0x1a]
mov ecx, 0x12
call fcn.00441380
add rsp, 0x40
pop rbp
ret
mov eax, esi
mov ecx, 0x12
call fcn.00451880
mov eax, edi
mov ecx, 0x12
call fcn.00451880
nop
call fcn.0044f600
jmp fcn.00492c20
Function at 0x4946e0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4947ac
push rbp
mov rbp, rsp
sub rsp, 0x38
movabs rdx, 0x53fc53021a206162
mov qword [rsp + 0x1d], rdx
movabs rdx, 0x257a0a53fc53021a
mov qword [rsp + 0x20], rdx
movabs rdx, 0x606020a03020204
mov qword [rsp + 0x28], rdx
movabs rdx, 0x505030804020602
mov qword [rsp + 0x30], rdx
xor eax, eax
jmp 0x49474f
movzx r9d, byte [rsp + rsi + 0x1d]
sub r9d, edx
lea edx, [r9 + 0x2d]
mov byte [rsp + rdi + 0x1d], dl
lea edx, [r8 + 0x2d]
mov byte [rsp + rsi + 0x1d], dl
add rax, 2
cmp rax, 0x10
jge 0x49477c
movzx edx, byte [rsp + rax + 0x28]
movzx esi, byte [rsp + rax + 0x29]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0xb
jae 0x49479f
movzx r8d, byte [rsp + rdi + 0x1d]
sub r8d, edx
cmp rsi, 0xb
jb 0x494732
jmp 0x494793
xor eax, eax
lea rbx, [rsp + 0x1d]
mov ecx, 0xb
call fcn.00441380
add rsp, 0x38
pop rbp
ret
mov eax, esi
mov ecx, 0xb
call fcn.00451880
mov eax, edi
mov ecx, 0xb
call fcn.00451880
nop
call fcn.0044f600
jmp fcn.004946e0

Function at 0x4947c0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x49488c
push rbp
mov rbp, rsp
sub rsp, 0x30
movabs rdx, 0xf415ee6120d72562
mov qword [rsp + 0x19], rdx
movabs rdx, 0x1bc81df415ee6120
mov qword [rsp + 0x1c], rdx
movabs rdx, 0x509060701080507
mov qword [rsp + 0x24], rdx
mov dword [rsp + 0x2c], 0xa05020a
xor eax, eax
jmp 0x494825
movzx r9d, byte [rsp + rsi + 0x19]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x39]
mov byte [rsp + rdi + 0x19], dl
mov byte [rsp + rsi + 0x19], r8b
add rax, 2
cmp rax, 0xc
jge 0x49485c
movzx edx, byte [rsp + rax + 0x24]
movzx esi, byte [rsp + rax + 0x25]
mov edi, edx
xor edx, esi
add edx, eax
nop dword [rax + rax]
cmp rdi, 0xb
jae 0x49487f
movzx r8d, byte [rsp + rdi + 0x19]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x39]
cmp rsi, 0xb
jb 0x49480b
jmp 0x494873
xor eax, eax
lea rbx, [rsp + 0x19]
mov ecx, 0xb
call fcn.00441380
add rsp, 0x30
pop rbp
ret
mov eax, esi
mov ecx, 0xb
call fcn.00451880
mov eax, edi
mov ecx, 0xb
call fcn.00451880
nop
call fcn.0044f600
jmp fcn.004947c0
Function at 0x494980
Capabilities:
Encrypt data using rc4 prga

Disassembly:
lea r12, [rsp - 0x28]
cmp r12, qword [r14 + 0x10]
jbe 0x494ab5
push rbp
mov rbp, rsp
sub rsp, 0xa0
movabs rdx, 0x6726576967395141
mov qword [rsp + 0x18], rdx
movabs rdx, 0x654b6e695fe43d5a
mov qword [rsp + 0x20], rdx
movabs rdx, 0xe83aff8961980eec
mov qword [rsp + 0x28], rdx
movabs rdx, 0xff7a6671465e4d0c
mov qword [rsp + 0x30], rdx
movabs rdx, 0x691f702d6e11548b
mov qword [rsp + 0x38], rdx
movabs rdx, 0x8b5d2872944e7451
mov qword [rsp + 0x40], rdx
movabs rdx, 0x4a657e9c5576ab3f
mov qword [rsp + 0x48], rdx
lea rdi, [rsp + 0x50]
lea rsi, [0x006c8290]
nop word [rax + rax]
nop dword [rax + rax]
mov qword [rsp - 0x10], rbp
lea rbp, [rsp - 0x10]
call fcn.00451eba
mov rbp, qword [rbp]
xor eax, eax
jmp 0x494a54
movzx r9d, byte [rsp + rsi + 0x18]
sub r9d, edx
lea edx, [r9 + 0x4f]
mov byte [rsp + rdi + 0x18], dl
lea edx, [r8 + 0x4f]
mov byte [rsp + rsi + 0x18], dl
add rax, 2
cmp rax, 0x50
jge 0x494a82
movzx edx, byte [rsp + rax + 0x50]
movzx esi, byte [rsp + rax + 0x51]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x38
jae 0x494aa8
movzx r8d, byte [rsp + rdi + 0x18]
sub r8d, edx
cmp rsi, 0x38
jb 0x494a37
nop
jmp 0x494a9c
xor eax, eax
lea rbx, [rsp + 0x18]
mov ecx, 0x38
call fcn.00441380
add rsp, 0xa0
pop rbp
ret
mov eax, esi
mov ecx, 0x38
call fcn.00451880
mov eax, edi
mov ecx, 0x38
call fcn.00451880
nop
call fcn.0044f600
jmp fcn.00494980

Function at 0x497260
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4973ac
push rbp
mov rbp, rsp
sub rsp, 0x78
movabs rdx, 0x6545f52d7458750a
mov qword [rsp + 0x1f], rdx
movabs rdx, 0x61263c2a61465a20
mov qword [rsp + 0x27], rdx
movabs rdx, 0x73301461263c2a61
mov qword [rsp + 0x2a], rdx
movabs rdx, 0x6b3e120d74be7220
mov qword [rsp + 0x32], rdx
movabs rdx, 0x574274535025442c
mov qword [rsp + 0x3a], rdx
movabs rdx, 0x52437203bd20db44
mov qword [rsp + 0x42], rdx
movabs rdx, 0x22a29100615231c
mov qword [rsp + 0x4a], rdx
movabs rdx, 0x240c0e1d1a112200
mov qword [rsp + 0x52], rdx
movabs rdx, 0x150a24061b26240c
mov qword [rsp + 0x58], rdx
movabs rdx, 0x241d1a1719090c29
mov qword [rsp + 0x60], rdx
movabs rdx, 0x1f1e040d0d272105
mov qword [rsp + 0x68], rdx
movabs rdx, 0x290e18211b0d0417
mov qword [rsp + 0x70], rdx
xor eax, eax
jmp 0x497344
movzx r9d, byte [rsp + rsi + 0x1f]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x14]
mov byte [rsp + rdi + 0x1f], dl
mov byte [rsp + rsi + 0x1f], r8b
add rax, 2
cmp rax, 0x2e
jge 0x49737c
movzx edx, byte [rsp + rax + 0x4a]
movzx esi, byte [rsp + rax + 0x4b]
mov edi, edx
xor edx, esi
add edx, eax
nop word [rax + rax]
cmp rdi, 0x2b
jae 0x49739f
movzx r8d, byte [rsp + rdi + 0x1f]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x14]
cmp rsi, 0x2b
jb 0x49732a
jmp 0x497393
xor eax, eax
lea rbx, [rsp + 0x1f]
mov ecx, 0x2b
call fcn.00441380
add rsp, 0x78
pop rbp
ret
mov eax, esi
mov ecx, 0x2b
call fcn.00451880
mov eax, edi
mov ecx, 0x2b
call fcn.00451880
nop
call fcn.0044f600
jmp fcn.00497260
Function at 0x499c60
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x499d2a
push rbp
mov rbp, rsp
sub rsp, 0x48
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x58], rax
mov qword [rsp], rax
mov qword [rsp + 8], rbx
mov byte [rsp + 0x10], 0
call fcn.00403080
xorps xmm15, xmm15
mov r14, qword [0x007aa990]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x18], 0xffffffffffffffff
jne 0x499d0f
mov rcx, qword [rsp + 0x60]
lea rdx, [rcx + 1]
mov qword [rsp + 0x40], rdx
lea rax, [0x0051c480]
xor ebx, ebx
mov rcx, rdx
call fcn.0043dec0
mov rbx, qword [rsp + 0x60]
mov rcx, rax
xor edi, edi
mov rsi, qword [rsp + 0x40]
mov rax, qword [rsp + 0x58]
nop dword [rax]
call fcn.0049be60
inc rbx
cmp rcx, rbx
jae 0x499cfe
mov edi, 1
lea rsi, [0x0051c480]
call fcn.0043dfa0
mov word [rax + rbx*2 - 2], 0
xor edi, edi
xor esi, esi
add rsp, 0x48
pop rbp
ret
xor eax, eax
xor ebx, ebx
mov rcx, rbx
lea rdi, [0x006c69a8]
lea rsi, [0x006c6610]
add rsp, 0x48
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.0044f600
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.00499c60

Function at 0x49b440
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x49b50c
push rbp
mov rbp, rsp
sub rsp, 0x38
movabs rdx, 0xcf216e65186fcfbc
mov qword [rsp + 0x1f], rdx
movabs rdx, 0x21c8c1cf216e6518
mov qword [rsp + 0x22], rdx
movabs rdx, 0xa0301060908070a
mov qword [rsp + 0x2a], rdx
movabs rdx, 0x809000000000a03
mov qword [rsp + 0x30], rdx
xor eax, eax
jmp 0x49b4af
movzx r9d, byte [rsp + rsi + 0x1f]
sub r9d, edx
lea edx, [r9 + 0x5c]
mov byte [rsp + rdi + 0x1f], dl
lea edx, [r8 + 0x5c]
mov byte [rsp + rsi + 0x1f], dl
add rax, 2
cmp rax, 0xe
jge 0x49b4dc
movzx edx, byte [rsp + rax + 0x2a]
movzx esi, byte [rsp + rax + 0x2b]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0xb
jae 0x49b4ff
movzx r8d, byte [rsp + rdi + 0x1f]
sub r8d, edx
cmp rsi, 0xb
jb 0x49b492
jmp 0x49b4f3
xor eax, eax
lea rbx, [rsp + 0x1f]
mov ecx, 0xb
call fcn.00441380
add rsp, 0x38
pop rbp
ret
mov eax, esi
mov ecx, 0xb
call fcn.00451880
mov eax, edi
mov ecx, 0xb
call fcn.00451880
nop
call fcn.0044f600
jmp fcn.0049b440
Function at 0x49b9e0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x49badb
push rbp
mov rbp, rsp
sub rsp, 0x48
movabs rdx, 0x7312e36c1c6d747
mov qword [rsp + 0x1c], rdx
movabs rdx, 0x138c07312e36c1c6
mov qword [rsp + 0x1e], rdx
movabs rdx, 0x526fd1bc2e4dd36f
mov qword [rsp + 0x26], rdx
movabs rdx, 0x70f000b00100909
mov qword [rsp + 0x2e], rdx
movabs rdx, 0x90208110a0f110c
mov qword [rsp + 0x36], rdx
movabs rdx, 0x20c090208110a0f
mov qword [rsp + 0x38], rdx
movabs rdx, 0x100f030e0f0a0a01
mov qword [rsp + 0x40], rdx
xor eax, eax
jmp 0x49ba79
movzx r9d, byte [rsp + rsi + 0x1c]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x4f]
mov byte [rsp + rdi + 0x1c], dl
mov byte [rsp + rsi + 0x1c], r8b
add rax, 2
cmp rax, 0x1a
jge 0x49baab
movzx edx, byte [rsp + rax + 0x2e]
movzx esi, byte [rsp + rax + 0x2f]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x12
jae 0x49bace
movzx r8d, byte [rsp + rdi + 0x1c]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x4f]
cmp rsi, 0x12
jb 0x49ba5f
jmp 0x49bac2
xor eax, eax
lea rbx, [rsp + 0x1c]
mov ecx, 0x12
call fcn.00441380
add rsp, 0x48
pop rbp
ret
mov eax, esi
mov ecx, 0x12
call fcn.00451880
mov eax, edi
mov ecx, 0x12
call fcn.00451880
nop
nop dword [rax + rax]
call fcn.0044f600
jmp fcn.0049b9e0
Function at 0x49e600
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x49e6ea
push rbp
mov rbp, rsp
sub rsp, 0x48
movabs rdx, 0xb978906f20a18e62
mov qword [rsp + 0x1d], rdx
movabs rdx, 0x787d7fb978906f20
mov qword [rsp + 0x20], rdx
movabs rdx, 0x7293744369907373
mov qword [rsp + 0x28], rdx
movabs rdx, 0x110d0f050c020709
mov qword [rsp + 0x30], rdx
movabs rdx, 0x901060c08050704
mov qword [rsp + 0x38], rdx
movabs rdx, 0x1060f0f0a090101
mov qword [rsp + 0x40], rdx
xor eax, eax
jmp 0x49e68d
movzx r9d, byte [rsp + rsi + 0x1d]
sub r9d, edx
lea edx, [r9 + 1]
mov byte [rsp + rdi + 0x1d], dl
lea edx, [r8 + 1]
mov byte [rsp + rsi + 0x1d], dl
add rax, 2
cmp rax, 0x18
jge 0x49e6ba
movzx edx, byte [rsp + rax + 0x30]
movzx esi, byte [rsp + rax + 0x31]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x13
jae 0x49e6dd
movzx r8d, byte [rsp + rdi + 0x1d]
sub r8d, edx
cmp rsi, 0x13
jb 0x49e670
jmp 0x49e6d1
xor eax, eax
lea rbx, [rsp + 0x1d]
mov ecx, 0x13
call fcn.00441380
add rsp, 0x48
pop rbp
ret
mov eax, esi
mov ecx, 0x13
call fcn.00451880
mov eax, edi
mov ecx, 0x13
call fcn.00451880
nop
call fcn.0044f600
jmp fcn.0049e600

Function at 0x49f5e0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x49f6dd
push rbp
mov rbp, rsp
sub rsp, 0x50
movabs rdx, 0x6f0e65f88bb7ee2b
mov qword [rsp + 0x19], rdx
movabs rdx, 0x91feed0ea4f7a06f
mov qword [rsp + 0x20], rdx
movabs rdx, 0x96b008cc8cb16372
mov qword [rsp + 0x28], rdx
movabs rdx, 0x1309140e00160a0c
mov qword [rsp + 0x30], rdx
movabs rdx, 0x10300150908040c
mov qword [rsp + 0x38], rdx
movabs rdx, 0x414080612021606
mov qword [rsp + 0x40], rdx
movabs rdx, 0xb0d0014110b0201
mov qword [rsp + 0x48], rdx
xor eax, eax
jmp 0x49f680
movzx r9d, byte [rsp + rsi + 0x19]
sub r9d, edx
lea edx, [r9 - 0x75]
mov byte [rsp + rdi + 0x19], dl
lea edx, [r8 - 0x75]
mov byte [rsp + rsi + 0x19], dl
add rax, 2
nop dword [rax]
cmp rax, 0x20
jge 0x49f6ad
movzx edx, byte [rsp + rax + 0x30]
movzx esi, byte [rsp + rax + 0x31]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x17
jae 0x49f6d0
movzx r8d, byte [rsp + rdi + 0x19]
sub r8d, edx
cmp rsi, 0x17
jb 0x49f65f
jmp 0x49f6c4
xor eax, eax
lea rbx, [rsp + 0x19]
mov ecx, 0x17
call fcn.00441380
add rsp, 0x50
pop rbp
ret
mov eax, esi
mov ecx, 0x17
call fcn.00451880
mov eax, edi
mov ecx, 0x17
call fcn.00451880
nop
nop dword [rax]
call fcn.0044f600
jmp fcn.0049f5e0