joyce8/EMBER2024-capa huggingface dataset:
Function at 0x493f20
Capabilities:
Encrypt data using rc4 prga

Disassembly:
lea r12, [rsp - 0x20]
cmp r12, qword [r14 + 0x10]
jbe 0x4940bb
push rbp
mov rbp, rsp
sub rsp, 0x98
movabs rdx, 0x3ac4638ef0a26512
mov qword [rsp + 0x1f], rdx
movabs rdx, 0xf31656c6665fcd3
mov qword [rsp + 0x27], rdx
movabs rdx, 0xc5a6d60f31656c66
mov qword [rsp + 0x2a], rdx
movabs rdx, 0x6d9d6ca94027756c
mov qword [rsp + 0x32], rdx
movabs rdx, 0xea276e6120f291d6
mov qword [rsp + 0x3a], rdx
movabs rdx, 0x54a8646996cc30bc
mov qword [rsp + 0x42], rdx
movabs rdx, 0x7079656880b76e9e
mov qword [rsp + 0x4a], rdx
movabs rdx, 0x72d126c4696fcf20
mov qword [rsp + 0x52], rdx
movabs rdx, 0x370e091d23210338
mov qword [rsp + 0x5a], rdx
movabs rdx, 0x23160f371b021116
mov qword [rsp + 0x62], rdx
movabs rdx, 0x2b2a381b241b2316
mov qword [rsp + 0x68], rdx
movabs rdx, 0x222a250323122c15
mov qword [rsp + 0x70], rdx
movabs rdx, 0x2d391d1d022d062b
mov qword [rsp + 0x78], rdx
movabs rdx, 0x172e151037000804
mov qword [rsp + 0x80], rdx
movabs rdx, 0x3110291d19263911
mov qword [rsp + 0x88], rdx
movabs rdx, 0x3734221c242c2909
mov qword [rsp + 0x90], rdx
xor eax, eax
jmp 0x494051
movzx r9d, byte [rsp + rsi + 0x1f]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x60]
mov byte [rsp + rdi + 0x1f], dl
mov byte [rsp + rsi + 0x1f], r8b
add rax, 2
cmp rax, 0x3e
jge 0x494088
movzx edx, byte [rsp + rax + 0x5a]
movzx esi, byte [rsp + rax + 0x5b]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x3b
jae 0x4940ae
movzx r8d, byte [rsp + rdi + 0x1f]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x60]
nop dword [rax + rax]
cmp rsi, 0x3b
jb 0x494037
jmp 0x4940a2
xor eax, eax
lea rbx, [rsp + 0x1f]
mov ecx, 0x3b
call fcn.00441380
add rsp, 0x98
pop rbp
ret
mov eax, esi
mov ecx, 0x3b
call fcn.00451880
mov eax, edi
mov ecx, 0x3b
call fcn.00451880
nop
nop dword [rax + rax]
call fcn.0044f600
jmp fcn.00493f20

Function at 0x4940e0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4941db
push rbp
mov rbp, rsp
sub rsp, 0x48
movabs rdx, 0xaf4e3a836cd00bed
mov qword [rsp + 0x1c], rdx
movabs rdx, 0x53ccaf4e3a836cd0
mov qword [rsp + 0x1e], rdx
movabs rdx, 0x6dac6cb0ba65ca64
mov qword [rsp + 0x26], rdx
movabs rdx, 0x20a0809100906
mov qword [rsp + 0x2e], rdx
movabs rdx, 0xb05080b060b0d04
mov qword [rsp + 0x36], rdx
movabs rdx, 0xe020b05080b060b
mov qword [rsp + 0x38], rdx
movabs rdx, 0x7060107100b0b0b
mov qword [rsp + 0x40], rdx
xor eax, eax
jmp 0x494179
movzx r9d, byte [rsp + rsi + 0x1c]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x66]
mov byte [rsp + rdi + 0x1c], dl
mov byte [rsp + rsi + 0x1c], r8b
add rax, 2
cmp rax, 0x1a
jge 0x4941ab
movzx edx, byte [rsp + rax + 0x2e]
movzx esi, byte [rsp + rax + 0x2f]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x12
jae 0x4941ce
movzx r8d, byte [rsp + rdi + 0x1c]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x66]
cmp rsi, 0x12
jb 0x49415f
jmp 0x4941c2
xor eax, eax
lea rbx, [rsp + 0x1c]
mov ecx, 0x12
call fcn.00441380
add rsp, 0x48
pop rbp
ret
mov eax, esi
mov ecx, 0x12
call fcn.00451880
mov eax, edi
mov ecx, 0x12
call fcn.00451880
nop
nop dword [rax + rax]
call fcn.0044f600
jmp fcn.004940e0
Function at 0x4948a0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
lea r12, [rsp - 0x18]
cmp r12, qword [r14 + 0x10]
jbe 0x494a27
push rbp
mov rbp, rsp
sub rsp, 0x90
movabs rdx, 0x2eac45ca03931272
mov qword [rsp + 0x1f], rdx
movabs rdx, 0xf2d2e4ca107b2ae
mov qword [rsp + 0x27], rdx
movabs rdx, 0xb7d96f38c1fa340f
mov qword [rsp + 0x2e], rdx
movabs rdx, 0x73656c9c64024a75
mov qword [rsp + 0x36], rdx
movabs rdx, 0xefdd0f65faa616cc
mov qword [rsp + 0x3e], rdx
movabs rdx, 0xfe617272c11dfec7
mov qword [rsp + 0x46], rdx
movabs rdx, 0x112a16292727132a
mov qword [rsp + 0x4e], rdx
movabs rdx, 0x120112a16292727
mov qword [rsp + 0x50], rdx
movabs rdx, 0x24041121101c1206
mov qword [rsp + 0x58], rdx
movabs rdx, 0x110c280a2e180528
mov qword [rsp + 0x60], rdx
movabs rdx, 0xe1015261b160911
mov qword [rsp + 0x68], rdx
movabs rdx, 0xa0b2e060f020e10
mov qword [rsp + 0x70], rdx
movabs rdx, 0x8090a22220f1103
mov qword [rsp + 0x78], rdx
movabs rdx, 0x16261f250b270e1b
mov qword [rsp + 0x80], rdx
movabs rdx, 0x121916090a270906
mov qword [rsp + 0x88], rdx
xor eax, eax
jmp 0x4949c0
movzx r9d, byte [rsp + rsi + 0x1f]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x26]
mov byte [rsp + rdi + 0x1f], dl
mov byte [rsp + rsi + 0x1f], r8b
add rax, 2
nop
cmp rax, 0x42
jge 0x4949f2
movzx edx, byte [rsp + rax + 0x4e]
movzx esi, byte [rsp + rax + 0x4f]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x2f
jae 0x494a1a
movzx r8d, byte [rsp + rdi + 0x1f]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x26]
cmp rsi, 0x2f
jb 0x4949a5
jmp 0x494a0e
xor eax, eax
lea rbx, [rsp + 0x1f]
mov ecx, 0x2f
nop
call fcn.00441380
add rsp, 0x90
pop rbp
ret
mov eax, esi
mov ecx, 0x2f
call fcn.00451880
mov eax, edi
mov ecx, 0x2f
call fcn.00451880
nop
call fcn.0044f600
jmp fcn.004948a0

Function at 0x495200
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4952c6
push rbp
mov rbp, rsp
sub rsp, 0x30
movabs rdx, 0x204e596c514c4d69
mov qword [rsp + 0x1d], rdx
mov byte [rsp + 0x25], 0x4b
movabs rdx, 0x502010505080201
mov qword [rsp + 0x26], rdx
mov word [rsp + 0x2e], 0x603
xor eax, eax
nop
jmp 0x495260
movzx r9d, byte [rsp + rsi + 0x1d]
lea edx, [r9 + rdx]
lea edx, [rdx + 6]
mov byte [rsp + rdi + 0x1d], dl
mov byte [rsp + rsi + 0x1d], r8b
add rax, 2
nop dword [rax]
cmp rax, 0xa
jge 0x495292
movzx edx, byte [rsp + rax + 0x26]
movzx esi, byte [rsp + rax + 0x27]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 9
jae 0x4952b7
movzx r8d, byte [rsp + rdi + 0x1d]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 6]
cmp rsi, 9
jb 0x495242
jmp 0x4952ab
xor eax, eax
lea rbx, [rsp + 0x1d]
mov ecx, 9
nop
call fcn.00441380
add rsp, 0x30
pop rbp
ret
mov eax, esi
mov ecx, 9
call fcn.00451880
mov eax, edi
mov ecx, 9
nop
call fcn.00451880
nop
call fcn.0044f600
jmp fcn.00495200
Function at 0x498480
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x498546
push rbp
mov rbp, rsp
sub rsp, 0x30
movabs rdx, 0x14622074bdb5ca07
mov qword [rsp + 0x24], rdx
mov dword [rsp + 0x2c], 0xc565c91d
movabs rdx, 0x1070b0008080903
mov qword [rsp + 0x18], rdx
mov dword [rsp + 0x20], 0x10b0802
xor eax, eax
jmp 0x4984e0
movzx r9d, byte [rsp + rsi + 0x24]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x61]
mov byte [rsp + rdi + 0x24], dl
mov byte [rsp + rsi + 0x24], r8b
add rax, 2
nop
cmp rax, 0xc
jge 0x498512
movzx edx, byte [rsp + rax + 0x18]
movzx esi, byte [rsp + rax + 0x19]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0xc
jae 0x498537
movzx r8d, byte [rsp + rdi + 0x24]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x61]
cmp rsi, 0xc
jb 0x4984c4
jmp 0x49852b
xor eax, eax
lea rbx, [rsp + 0x24]
mov ecx, 0xc
nop
call fcn.00441380
add rsp, 0x30
pop rbp
ret
mov eax, esi
mov ecx, 0xc
call fcn.00451880
mov eax, edi
mov ecx, 0xc
nop
call fcn.00451880
nop
call fcn.0044f600
jmp fcn.00498480

Function at 0x49b260
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x49b32a
push rbp
mov rbp, rsp
sub rsp, 0x48
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x58], rax
mov qword [rsp], rax
mov qword [rsp + 8], rbx
mov byte [rsp + 0x10], 0
call fcn.00403080
xorps xmm15, xmm15
mov r14, qword [0x0078d990]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x18], 0xffffffffffffffff
jne 0x49b30f
mov rcx, qword [rsp + 0x60]
lea rdx, [rcx + 1]
mov qword [rsp + 0x40], rdx
lea rax, [0x00521620]
xor ebx, ebx
mov rcx, rdx
call fcn.0043dec0
mov rbx, qword [rsp + 0x60]
mov rcx, rax
xor edi, edi
mov rsi, qword [rsp + 0x40]
mov rax, qword [rsp + 0x58]
nop dword [rax]
call fcn.0049d9c0
inc rbx
cmp rcx, rbx
jae 0x49b2fe
mov edi, 1
lea rsi, [0x00521620]
call fcn.0043dfa0
mov word [rax + rbx*2 - 2], 0
xor edi, edi
xor esi, esi
add rsp, 0x48
pop rbp
ret
xor eax, eax
xor ebx, ebx
mov rcx, rbx
lea rdi, [0x006a7448]
lea rsi, [0x006a70a8]
add rsp, 0x48
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.0044f600
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.0049b260
Function at 0x49b860
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x49b93d
push rbp
mov rbp, rsp
sub rsp, 0x40
movabs rdx, 0xa29097697774847f
mov qword [rsp + 0x1a], rdx
movabs rdx, 0x245b8659592a606
mov qword [rsp + 0x22], rdx
movabs rdx, 0x1000a05050f060d
mov qword [rsp + 0x2a], rdx
movabs rdx, 0x90a060808080100
mov qword [rsp + 0x30], rdx
movabs rdx, 0x70a090b0b060003
mov qword [rsp + 0x38], rdx
xor eax, eax
nop
jmp 0x49b8e0
movzx r9d, byte [rsp + rsi + 0x1a]
sub r9d, edx
lea edx, [r9 - 0x13]
mov byte [rsp + rdi + 0x1a], dl
lea edx, [r8 - 0x13]
mov byte [rsp + rsi + 0x1a], dl
add rax, 2
nop
cmp rax, 0x16
jge 0x49b90d
movzx edx, byte [rsp + rax + 0x2a]
movzx esi, byte [rsp + rax + 0x2b]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x10
jae 0x49b930
movzx r8d, byte [rsp + rdi + 0x1a]
sub r8d, edx
cmp rsi, 0x10
jb 0x49b8c2
jmp 0x49b924
xor eax, eax
lea rbx, [rsp + 0x1a]
mov ecx, 0x10
call fcn.00441380
add rsp, 0x40
pop rbp
ret
mov eax, esi
mov ecx, 0x10
call fcn.00451880
mov eax, edi
mov ecx, 0x10
call fcn.00451880
nop
nop dword [rax]
call fcn.0044f600
jmp fcn.0049b860

Function at 0x49d620
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x49d71b
push rbp
mov rbp, rsp
sub rsp, 0x50
movabs rdx, 0x6a4a535750317c32
mov qword [rsp + 0x1e], rdx
movabs rdx, 0x8fa9312e762e6a4a
mov qword [rsp + 0x24], rdx
movabs rdx, 0x5d4f34983b7176
mov qword [rsp + 0x2c], rdx
movabs rdx, 0xf01111407090d0c
mov qword [rsp + 0x34], rdx
movabs rdx, 0xf050c091409040e
mov qword [rsp + 0x3c], rdx
movabs rdx, 0x10d13070f050c09
mov qword [rsp + 0x40], rdx
movabs rdx, 0x4060e1307100103
mov qword [rsp + 0x48], rdx
xor eax, eax
jmp 0x49d6b9
movzx r9d, byte [rsp + rsi + 0x1e]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x38]
mov byte [rsp + rdi + 0x1e], dl
mov byte [rsp + rsi + 0x1e], r8b
add rax, 2
cmp rax, 0x1c
jge 0x49d6eb
movzx edx, byte [rsp + rax + 0x34]
movzx esi, byte [rsp + rax + 0x35]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x16
jae 0x49d70e
movzx r8d, byte [rsp + rdi + 0x1e]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x38]
cmp rsi, 0x16
jb 0x49d69f
jmp 0x49d702
xor eax, eax
lea rbx, [rsp + 0x1e]
mov ecx, 0x16
call fcn.00441380
add rsp, 0x50
pop rbp
ret
mov eax, esi
mov ecx, 0x16
call fcn.00451880
mov eax, edi
mov ecx, 0x16
call fcn.00451880
nop
nop dword [rax + rax]
call fcn.0044f600
jmp fcn.0049d620
Function at 0x49df20
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x49e047
push rbp
mov rbp, rsp
sub rsp, 0x68
movabs rdx, 0x61422cd00e3c1982
mov qword [rsp + 0x1d], rdx
movabs rdx, 0x3ee817ee67697307
mov qword [rsp + 0x25], rdx
movabs rdx, 0x646556be65f4713e
mov qword [rsp + 0x2c], rdx
movabs rdx, 0xd9362f2d3434453c
mov qword [rsp + 0x34], rdx
movabs rdx, 0xc17040013081c11
mov qword [rsp + 0x3c], rdx
movabs rdx, 0x81d141d13041e00
mov qword [rsp + 0x44], rdx
movabs rdx, 0x802031e081d141d
mov qword [rsp + 0x48], rdx
movabs rdx, 0x18130e0d00011c1b
mov qword [rsp + 0x50], rdx
movabs rdx, 0x10f1a1906050e1d
mov qword [rsp + 0x58], rdx
movabs rdx, 0x206000e061e180e
mov qword [rsp + 0x60], rdx
xor eax, eax
jmp 0x49dfe9
movzx r9d, byte [rsp + rsi + 0x1d]
sub r9d, edx
lea edx, [r9 + 0x53]
mov byte [rsp + rdi + 0x1d], dl
lea edx, [r8 + 0x53]
mov byte [rsp + rsi + 0x1d], dl
add rax, 2
cmp rax, 0x2c
jge 0x49e017
movzx edx, byte [rsp + rax + 0x3c]
movzx esi, byte [rsp + rax + 0x3d]
mov edi, edx
xor edx, esi
add edx, eax
nop
cmp rdi, 0x1f
jae 0x49e03a
movzx r8d, byte [rsp + rdi + 0x1d]
sub r8d, edx
cmp rsi, 0x1f
jb 0x49dfcc
jmp 0x49e02e
xor eax, eax
lea rbx, [rsp + 0x1d]
mov ecx, 0x1f
call fcn.00441380
add rsp, 0x68
pop rbp
ret
mov eax, esi
mov ecx, 0x1f
call fcn.00451880
mov eax, edi
mov ecx, 0x1f
call fcn.00451880
nop
call fcn.0044f600
jmp fcn.0049df20

Function at 0x49ea80
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x49eb6a
push rbp
mov rbp, rsp
sub rsp, 0x48
movabs rdx, 0x216c4d66142a61f3
mov qword [rsp + 0x1d], rdx
movabs rdx, 0x653a36216c4d6614
mov qword [rsp + 0x20], rdx
movabs rdx, 0x62404c3f69c15761
mov qword [rsp + 0x28], rdx
movabs rdx, 0x900070f03000d02
mov qword [rsp + 0x30], rdx
movabs rdx, 0x101108020f110b12
mov qword [rsp + 0x38], rdx
movabs rdx, 0xf0c020508080d00
mov qword [rsp + 0x40], rdx
xor eax, eax
jmp 0x49eb0d
movzx r9d, byte [rsp + rsi + 0x1d]
sub r9d, edx
lea edx, [r9 + 0x32]
mov byte [rsp + rdi + 0x1d], dl
lea edx, [r8 + 0x32]
mov byte [rsp + rsi + 0x1d], dl
add rax, 2
cmp rax, 0x18
jge 0x49eb3a
movzx edx, byte [rsp + rax + 0x30]
movzx esi, byte [rsp + rax + 0x31]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x13
jae 0x49eb5d
movzx r8d, byte [rsp + rdi + 0x1d]
sub r8d, edx
cmp rsi, 0x13
jb 0x49eaf0
jmp 0x49eb51
xor eax, eax
lea rbx, [rsp + 0x1d]
mov ecx, 0x13
call fcn.00441380
add rsp, 0x48
pop rbp
ret
mov eax, esi
mov ecx, 0x13
call fcn.00451880
mov eax, edi
mov ecx, 0x13
call fcn.00451880
nop
call fcn.0044f600
jmp fcn.0049ea80
Function at 0x49eb80
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x49ec4c
push rbp
mov rbp, rsp
sub rsp, 0x38
movabs rdx, 0xe2e29c2b20642234
mov qword [rsp + 0x1f], rdx
movabs rdx, 0xfa3b61e2e29c2b20
mov qword [rsp + 0x22], rdx
movabs rdx, 0x60005010a040407
mov qword [rsp + 0x2a], rdx
movabs rdx, 0x904000001030600
mov qword [rsp + 0x30], rdx
xor eax, eax
jmp 0x49ebef
movzx r9d, byte [rsp + rsi + 0x1f]
sub r9d, edx
lea edx, [r9 + 0x4b]
mov byte [rsp + rdi + 0x1f], dl
lea edx, [r8 + 0x4b]
mov byte [rsp + rsi + 0x1f], dl
add rax, 2
cmp rax, 0xe
jge 0x49ec1c
movzx edx, byte [rsp + rax + 0x2a]
movzx esi, byte [rsp + rax + 0x2b]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0xb
jae 0x49ec3f
movzx r8d, byte [rsp + rdi + 0x1f]
sub r8d, edx
cmp rsi, 0xb
jb 0x49ebd2
jmp 0x49ec33
xor eax, eax
lea rbx, [rsp + 0x1f]
mov ecx, 0xb
call fcn.00441380
add rsp, 0x38
pop rbp
ret
mov eax, esi
mov ecx, 0xb
call fcn.00451880
mov eax, edi
mov ecx, 0xb
call fcn.00451880
nop
call fcn.0044f600
jmp fcn.0049eb80

Function at 0x49ef80
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x49f07b
push rbp
mov rbp, rsp
sub rsp, 0x48
movabs rdx, 0xc543b672bea06069
mov qword [rsp + 0x18], rdx
movabs rdx, 0x75719472c543b672
mov qword [rsp + 0x1c], rdx
movabs rdx, 0x18aa53052274ed29
mov qword [rsp + 0x24], rdx
movabs rdx, 0x701060d130f120c
mov qword [rsp + 0x2c], rdx
movabs rdx, 0x4070f13100d0503
mov qword [rsp + 0x34], rdx
movabs rdx, 0xf110d1204070f13
mov qword [rsp + 0x38], rdx
movabs rdx, 0x61312090d041002
mov qword [rsp + 0x40], rdx
xor eax, eax
jmp 0x49f019
movzx r9d, byte [rsp + rsi + 0x18]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x63]
mov byte [rsp + rdi + 0x18], dl
mov byte [rsp + rsi + 0x18], r8b
add rax, 2
cmp rax, 0x1c
jge 0x49f04b
movzx edx, byte [rsp + rax + 0x2c]
movzx esi, byte [rsp + rax + 0x2d]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x14
jae 0x49f06e
movzx r8d, byte [rsp + rdi + 0x18]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x63]
cmp rsi, 0x14
jb 0x49efff
jmp 0x49f062
xor eax, eax
lea rbx, [rsp + 0x18]
mov ecx, 0x14
call fcn.00441380
add rsp, 0x48
pop rbp
ret
mov eax, esi
mov ecx, 0x14
call fcn.00451880
mov eax, edi
mov ecx, 0x14
call fcn.00451880
nop
nop dword [rax + rax]
call fcn.0044f600
jmp fcn.0049ef80
Function at 0x4a2040
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4a210c
push rbp
mov rbp, rsp
sub rsp, 0x38
movabs rdx, 0x69ae512065dea766
mov qword [rsp + 0x1f], rdx
movabs rdx, 0xaba42369ae512065
mov qword [rsp + 0x22], rdx
movabs rdx, 0x90a090509080805
mov qword [rsp + 0x2a], rdx
movabs rdx, 0x10501020606090a
mov qword [rsp + 0x30], rdx
xor eax, eax
jmp 0x4a20af
movzx r9d, byte [rsp + rsi + 0x1f]
sub r9d, edx
lea edx, [r9 - 0x2e]
mov byte [rsp + rdi + 0x1f], dl
lea edx, [r8 - 0x2e]
mov byte [rsp + rsi + 0x1f], dl
add rax, 2
cmp rax, 0xe
jge 0x4a20dc
movzx edx, byte [rsp + rax + 0x2a]
movzx esi, byte [rsp + rax + 0x2b]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0xb
jae 0x4a20ff
movzx r8d, byte [rsp + rdi + 0x1f]
sub r8d, edx
cmp rsi, 0xb
jb 0x4a2092
jmp 0x4a20f3
xor eax, eax
lea rbx, [rsp + 0x1f]
mov ecx, 0xb
call fcn.00441380
add rsp, 0x38
pop rbp
ret
mov eax, esi
mov ecx, 0xb
call fcn.00451880
mov eax, edi
mov ecx, 0xb
call fcn.00451880
nop
call fcn.0044f600
jmp fcn.004a2040

Function at 0x4a40a0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4a41a8
push rbp
mov rbp, rsp
sub rsp, 0x58
movabs rdx, 0x20ef975a20f97b6b
mov qword [rsp + 0x1f], rdx
movabs rdx, 0xd8d7747bf56a6558
mov qword [rsp + 0x27], rdx
movabs rdx, 0xd86200d8d7747bf5
mov qword [rsp + 0x2a], rdx
movabs rdx, 0x69f069687a88ef20
mov qword [rsp + 0x32], rdx
movabs rdx, 0x5170b160c081005
mov qword [rsp + 0x3a], rdx
movabs rdx, 0x1151215151a0614
mov qword [rsp + 0x42], rdx
movabs rdx, 0x5040b150e0f0115
mov qword [rsp + 0x48], rdx
movabs rdx, 0x1708021a01050c19
mov qword [rsp + 0x50], rdx
xor eax, eax
jmp 0x4a414b
movzx r9d, byte [rsp + rsi + 0x1f]
sub r9d, edx
lea edx, [r9 - 0x62]
mov byte [rsp + rdi + 0x1f], dl
lea edx, [r8 - 0x62]
mov byte [rsp + rsi + 0x1f], dl
add rax, 2
cmp rax, 0x1e
jge 0x4a4178
movzx edx, byte [rsp + rax + 0x3a]
movzx esi, byte [rsp + rax + 0x3b]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x1b
jae 0x4a419b
movzx r8d, byte [rsp + rdi + 0x1f]
sub r8d, edx
cmp rsi, 0x1b
jb 0x4a412e
jmp 0x4a418f
xor eax, eax
lea rbx, [rsp + 0x1f]
mov ecx, 0x1b
call fcn.00441380
add rsp, 0x58
pop rbp
ret
mov eax, esi
mov ecx, 0x1b
call fcn.00451880
mov eax, edi
mov ecx, 0x1b
call fcn.00451880
nop
call fcn.0044f600
jmp fcn.004a40a0
Function at 0x4a7ca0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4a7dd8
push rbp
mov rbp, rsp
sub rsp, 0x68
movabs rdx, 0x9a6b726f775f9c6e
mov qword [rsp + 0x19], rdx
movabs rdx, 0x99c4a49a6b726f77
mov qword [rsp + 0x1c], rdx
movabs rdx, 0xa6a4849a6480b470
mov qword [rsp + 0x24], rdx
movabs rdx, 0x99cd6066a363d477
mov qword [rsp + 0x2c], rdx
movabs rdx, 0x9a65738e9ea577a4
mov qword [rsp + 0x34], rdx
movabs rdx, 0x112221f18091214
mov qword [rsp + 0x3c], rdx
movabs rdx, 0x130c1d19080f111b
mov qword [rsp + 0x44], rdx
movabs rdx, 0xf020c1d130c1d19
mov qword [rsp + 0x48], rdx
movabs rdx, 0x22221f1f1a160a18
mov qword [rsp + 0x50], rdx
movabs rdx, 0x131e22170f1d0702
mov qword [rsp + 0x58], rdx
movabs rdx, 0x1018091a131e1c0d
mov qword [rsp + 0x60], rdx
xor eax, eax
jmp 0x4a7d75
movzx r9d, byte [rsp + rsi + 0x19]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x47]
mov byte [rsp + rdi + 0x19], dl
mov byte [rsp + rsi + 0x19], r8b
add rax, 2
cmp rax, 0x2c
jge 0x4a7da8
movzx edx, byte [rsp + rax + 0x3c]
movzx esi, byte [rsp + rax + 0x3d]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x23
jae 0x4a7dcb
movzx r8d, byte [rsp + rdi + 0x19]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x47]
nop
cmp rsi, 0x23
jb 0x4a7d5b
jmp 0x4a7dbf
xor eax, eax
lea rbx, [rsp + 0x19]
mov ecx, 0x23
call fcn.00441380
add rsp, 0x68
pop rbp
ret
mov eax, esi
mov ecx, 0x23
call fcn.00451880
mov eax, edi
mov ecx, 0x23
call fcn.00451880
nop
call fcn.0044f600
nop dword [rax]
jmp fcn.004a7ca0

Function at 0x4a80e0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4a8192
push rbp
mov rbp, rsp
sub rsp, 0x28
movabs rdx, 0x6564cf6eddde075c
mov qword [rsp + 0x20], rdx
movabs rdx, 0x200030501010001
mov qword [rsp + 0x18], rdx
xor eax, eax
jmp 0x4a812e
movzx r9d, byte [rsp + rsi + 0x20]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x78]
mov byte [rsp + rdi + 0x20], dl
mov byte [rsp + rsi + 0x20], r8b
add rax, 2
cmp rax, 8
jge 0x4a8162
movzx edx, byte [rsp + rax + 0x18]
movzx esi, byte [rsp + rax + 0x19]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 8
jae 0x4a8185
movzx r8d, byte [rsp + rdi + 0x20]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x78]
cmp rsi, 8
jb 0x4a8114
nop
jmp 0x4a8179
xor eax, eax
lea rbx, [rsp + 0x20]
mov ecx, 8
call fcn.00441380
add rsp, 0x28
pop rbp
ret
mov eax, esi
mov ecx, 8
call fcn.00451880
mov eax, edi
mov ecx, 8
call fcn.00451880
nop
call fcn.0044f600
jmp fcn.004a80e0
Function at 0x4a89e0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4a8acc
push rbp
mov rbp, rsp
sub rsp, 0x40
movabs rdx, 0xebf8f82063f37802
mov qword [rsp + 0x1d], rdx
movabs rdx, 0xf6ebf8f82063f378
mov qword [rsp + 0x1e], rdx
movabs rdx, 0x72fd72720d312064
mov qword [rsp + 0x26], rdx
movabs rdx, 0x20802090c0a0b0a
mov qword [rsp + 0x2e], rdx
movabs rdx, 0x600020802090c0a
mov qword [rsp + 0x30], rdx
movabs rdx, 0x70c0f050f0b0f08
mov qword [rsp + 0x38], rdx
xor eax, eax
jmp 0x4a8a6a
movzx r9d, byte [rsp + rsi + 0x1d]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x5f]
mov byte [rsp + rdi + 0x1d], dl
mov byte [rsp + rsi + 0x1d], r8b
add rax, 2
cmp rax, 0x12
jge 0x4a8a9c
movzx edx, byte [rsp + rax + 0x2e]
movzx esi, byte [rsp + rax + 0x2f]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x11
jae 0x4a8abf
movzx r8d, byte [rsp + rdi + 0x1d]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x5f]
cmp rsi, 0x11
jb 0x4a8a50
jmp 0x4a8ab3
xor eax, eax
lea rbx, [rsp + 0x1d]
mov ecx, 0x11
call fcn.00441380
add rsp, 0x40
pop rbp
ret
mov eax, esi
mov ecx, 0x11
call fcn.00451880
mov eax, edi
mov ecx, 0x11
call fcn.00451880
nop
call fcn.0044f600
jmp fcn.004a89e0

Function at 0x4a8ae0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4a8be8
push rbp
mov rbp, rsp
sub rsp, 0x58
movabs rdx, 0x6c6548564505552d
mov qword [rsp + 0x1e], rdx
movabs rdx, 0x2e48245c795d212e
mov qword [rsp + 0x26], rdx
movabs rdx, 0x41ed2e48245c795d
mov qword [rsp + 0x28], rdx
movabs rdx, 0x3a5659611056615d
mov qword [rsp + 0x30], rdx
movabs rdx, 0x101011090d030518
mov qword [rsp + 0x38], rdx
movabs rdx, 0x17010f0111190008
mov qword [rsp + 0x40], rdx
movabs rdx, 0x41408020e0e150c
mov qword [rsp + 0x48], rdx
movabs rdx, 0x11209000718030a
mov qword [rsp + 0x50], rdx
xor eax, eax
jmp 0x4a8b8b
movzx r9d, byte [rsp + rsi + 0x1e]
sub r9d, edx
lea edx, [r9 + 0x39]
mov byte [rsp + rdi + 0x1e], dl
lea edx, [r8 + 0x39]
mov byte [rsp + rsi + 0x1e], dl
add rax, 2
cmp rax, 0x20
jge 0x4a8bb8
movzx edx, byte [rsp + rax + 0x38]
movzx esi, byte [rsp + rax + 0x39]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x1a
jae 0x4a8bdb
movzx r8d, byte [rsp + rdi + 0x1e]
sub r8d, edx
cmp rsi, 0x1a
jb 0x4a8b6e
jmp 0x4a8bcf
xor eax, eax
lea rbx, [rsp + 0x1e]
mov ecx, 0x1a
call fcn.00441380
add rsp, 0x58
pop rbp
ret
mov eax, esi
mov ecx, 0x1a
call fcn.00451880
mov eax, edi
mov ecx, 0x1a
call fcn.00451880
nop
call fcn.0044f600
jmp fcn.004a8ae0