joyce8/EMBER2024-capa huggingface dataset:
Function at 0x474800
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4748dd
push rbp
mov rbp, rsp
sub rsp, 0x40
movabs rdx, 0x65566158493a3b39
mov qword [rsp + 0x1f], rdx
movabs rdx, 0x7466376944407265
mov qword [rsp + 0x26], rdx
movabs rdx, 0x3020d0106010409
mov qword [rsp + 0x2e], rdx
movabs rdx, 0xc0203020d010601
mov qword [rsp + 0x30], rdx
movabs rdx, 0x8080c0105090200
mov qword [rsp + 0x38], rdx
xor eax, eax
nop
jmp 0x474880
movzx r9d, byte [rsp + rsi + 0x1f]
sub r9d, edx
lea edx, [r9 + 0x16]
mov byte [rsp + rdi + 0x1f], dl
lea edx, [r8 + 0x16]
mov byte [rsp + rsi + 0x1f], dl
add rax, 2
nop
cmp rax, 0x12
jge 0x4748ad
movzx edx, byte [rsp + rax + 0x2e]
movzx esi, byte [rsp + rax + 0x2f]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0xf
jae 0x4748d0
movzx r8d, byte [rsp + rdi + 0x1f]
sub r8d, edx
cmp rsi, 0xf
jb 0x474862
jmp 0x4748c4
xor eax, eax
lea rbx, [rsp + 0x1f]
mov ecx, 0xf
call fcn.00440c20
add rsp, 0x40
pop rbp
ret
mov eax, esi
mov ecx, 0xf
call fcn.00450f00
mov eax, edi
mov ecx, 0xf
call fcn.00450f00
nop
nop dword [rax]
call fcn.0044ec80
jmp fcn.00474800

Function at 0x474e80
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x474f38
push rbp
mov rbp, rsp
sub rsp, 0x30
movabs rdx, 0x1525d215d2c51845
mov qword [rsp + 0x1e], rdx
movabs rdx, 0x607050606020304
mov qword [rsp + 0x26], rdx
mov word [rsp + 0x2e], 0x104
xor eax, eax
jmp 0x474ed5
movzx r9d, byte [rsp + rsi + 0x1e]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x49]
mov byte [rsp + rdi + 0x1e], dl
mov byte [rsp + rsi + 0x1e], r8b
add rax, 2
cmp rax, 0xa
jge 0x474f08
movzx edx, byte [rsp + rax + 0x26]
movzx esi, byte [rsp + rax + 0x27]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 8
jae 0x474f2b
movzx r8d, byte [rsp + rdi + 0x1e]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x49]
nop
cmp rsi, 8
jb 0x474ebb
jmp 0x474f1f
xor eax, eax
lea rbx, [rsp + 0x1e]
mov ecx, 8
call fcn.00440c20
add rsp, 0x30
pop rbp
ret
mov eax, esi
mov ecx, 8
call fcn.00450f00
mov eax, edi
mov ecx, 8
call fcn.00450f00
nop
call fcn.0044ec80
nop dword [rax]
jmp fcn.00474e80
Function at 0x4766a0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x47678a
push rbp
mov rbp, rsp
sub rsp, 0x48
movabs rdx, 0xf0045f9e65eacdfe
mov qword [rsp + 0x1f], rdx
movabs rdx, 0xaaf0045f9e65eacd
mov qword [rsp + 0x20], rdx
movabs rdx, 0xf0b2aa69a56ee88b
mov qword [rsp + 0x28], rdx
movabs rdx, 0x604070a0c040401
mov qword [rsp + 0x30], rdx
movabs rdx, 0x9000a0004021008
mov qword [rsp + 0x38], rdx
movabs rdx, 0x70e02080a0e040f
mov qword [rsp + 0x40], rdx
xor eax, eax
jmp 0x47672d
movzx r9d, byte [rsp + rsi + 0x1f]
sub r9d, edx
lea edx, [r9 - 0x25]
mov byte [rsp + rdi + 0x1f], dl
lea edx, [r8 - 0x25]
mov byte [rsp + rsi + 0x1f], dl
add rax, 2
cmp rax, 0x18
jge 0x47675a
movzx edx, byte [rsp + rax + 0x30]
movzx esi, byte [rsp + rax + 0x31]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x11
jae 0x47677d
movzx r8d, byte [rsp + rdi + 0x1f]
sub r8d, edx
cmp rsi, 0x11
jb 0x476710
jmp 0x476771
xor eax, eax
lea rbx, [rsp + 0x1f]
mov ecx, 0x11
call fcn.00440c20
add rsp, 0x48
pop rbp
ret
mov eax, esi
mov ecx, 0x11
call fcn.00450f00
mov eax, edi
mov ecx, 0x11
call fcn.00450f00
nop
call fcn.0044ec80
jmp fcn.004766a0

Function at 0x477720
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x47780a
push rbp
mov rbp, rsp
sub rsp, 0x40
movabs rdx, 0x9a59786f80756b52
mov qword [rsp + 0x1a], rdx
movabs rdx, 0x7c5f9a59786f8075
mov qword [rsp + 0x1c], rdx
movabs rdx, 0x847f754e6d7f646e
mov qword [rsp + 0x24], rdx
movabs rdx, 0xe090d01090c0606
mov qword [rsp + 0x2c], rdx
movabs rdx, 0x1107030f0e090d01
mov qword [rsp + 0x30], rdx
movabs rdx, 0x10110e02050c1110
mov qword [rsp + 0x38], rdx
xor eax, eax
jmp 0x4777ad
movzx r9d, byte [rsp + rsi + 0x1a]
sub r9d, edx
lea edx, [r9 + 8]
mov byte [rsp + rdi + 0x1a], dl
lea edx, [r8 + 8]
mov byte [rsp + rsi + 0x1a], dl
add rax, 2
cmp rax, 0x14
jge 0x4777da
movzx edx, byte [rsp + rax + 0x2c]
movzx esi, byte [rsp + rax + 0x2d]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x12
jae 0x4777fd
movzx r8d, byte [rsp + rdi + 0x1a]
sub r8d, edx
cmp rsi, 0x12
jb 0x477790
jmp 0x4777f1
xor eax, eax
lea rbx, [rsp + 0x1a]
mov ecx, 0x12
call fcn.00440c20
add rsp, 0x40
pop rbp
ret
mov eax, esi
mov ecx, 0x12
call fcn.00450f00
mov eax, edi
mov ecx, 0x12
call fcn.00450f00
nop
call fcn.0044ec80
jmp fcn.00477720
Function at 0x478240
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x47830c
push rbp
mov rbp, rsp
sub rsp, 0x30
movabs rdx, 0x460a2e5a2c693857
mov qword [rsp + 0x19], rdx
movabs rdx, 0x656330460a2e5a2c
mov qword [rsp + 0x1c], rdx
movabs rdx, 0x507060804030301
mov qword [rsp + 0x24], rdx
mov dword [rsp + 0x2c], 0x1070108
xor eax, eax
jmp 0x4782a5
movzx r9d, byte [rsp + rsi + 0x19]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x11]
mov byte [rsp + rdi + 0x19], dl
mov byte [rsp + rsi + 0x19], r8b
add rax, 2
cmp rax, 0xc
jge 0x4782dc
movzx edx, byte [rsp + rax + 0x24]
movzx esi, byte [rsp + rax + 0x25]
mov edi, edx
xor edx, esi
add edx, eax
nop dword [rax + rax]
cmp rdi, 0xb
jae 0x4782ff
movzx r8d, byte [rsp + rdi + 0x19]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x11]
cmp rsi, 0xb
jb 0x47828b
jmp 0x4782f3
xor eax, eax
lea rbx, [rsp + 0x19]
mov ecx, 0xb
call fcn.00440c20
add rsp, 0x30
pop rbp
ret
mov eax, esi
mov ecx, 0xb
call fcn.00450f00
mov eax, edi
mov ecx, 0xb
call fcn.00450f00
nop
call fcn.0044ec80
jmp fcn.00478240
Function at 0x4849e0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x484a9d
push rbp
mov rbp, rsp
sub rsp, 0x30
movabs rdx, 0x6361c190c68b6e49
mov qword [rsp + 0x1d], rdx
mov byte [rsp + 0x25], 0x86
movabs rdx, 0x208080508080803
mov qword [rsp + 0x26], rdx
mov word [rsp + 0x2e], 0x404
xor eax, eax
nop
jmp 0x484a40
movzx r9d, byte [rsp + rsi + 0x1d]
sub r9d, edx
lea edx, [r9 - 0x16]
mov byte [rsp + rdi + 0x1d], dl
lea edx, [r8 - 0x16]
mov byte [rsp + rsi + 0x1d], dl
add rax, 2
nop
cmp rax, 0xa
jge 0x484a6d
movzx edx, byte [rsp + rax + 0x26]
movzx esi, byte [rsp + rax + 0x27]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 9
jae 0x484a90
movzx r8d, byte [rsp + rdi + 0x1d]
sub r8d, edx
cmp rsi, 9
jb 0x484a22
jmp 0x484a84
xor eax, eax
lea rbx, [rsp + 0x1d]
mov ecx, 9
call fcn.00440c20
add rsp, 0x30
pop rbp
ret
mov eax, esi
mov ecx, 9
call fcn.00450f00
mov eax, edi
mov ecx, 9
call fcn.00450f00
nop
nop dword [rax]
call fcn.0044ec80
jmp fcn.004849e0

Function at 0x4862a0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4863d8
push rbp
mov rbp, rsp
sub rsp, 0x70
movabs rdx, 0x4d8e2648545e2f76
mov qword [rsp + 0x1c], rdx
movabs rdx, 0x882047634d8e2648
mov qword [rsp + 0x20], rdx
movabs rdx, 0x1fb66c7b6f7f646e
mov qword [rsp + 0x28], rdx
movabs rdx, 0x302a41617042819d
mov qword [rsp + 0x30], rdx
movabs rdx, 0x27374e0e61a57448
mov qword [rsp + 0x38], rdx
movabs rdx, 0xf14150e12140610
mov qword [rsp + 0x40], rdx
movabs rdx, 0xf0b13000b1e070b
mov qword [rsp + 0x48], rdx
movabs rdx, 0x1a090317141a1001
mov qword [rsp + 0x50], rdx
movabs rdx, 0x1723200210061c05
mov qword [rsp + 0x58], rdx
movabs rdx, 0x70518001a150819
mov qword [rsp + 0x60], rdx
movabs rdx, 0x221b21041814020e
mov qword [rsp + 0x68], rdx
xor eax, eax
jmp 0x486375
movzx r9d, byte [rsp + rsi + 0x1c]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x30]
mov byte [rsp + rdi + 0x1c], dl
mov byte [rsp + rsi + 0x1c], r8b
add rax, 2
cmp rax, 0x30
jge 0x4863a8
movzx edx, byte [rsp + rax + 0x40]
movzx esi, byte [rsp + rax + 0x41]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x24
jae 0x4863cb
movzx r8d, byte [rsp + rdi + 0x1c]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x30]
nop
cmp rsi, 0x24
jb 0x48635b
jmp 0x4863bf
xor eax, eax
lea rbx, [rsp + 0x1c]
mov ecx, 0x24
call fcn.00440c20
add rsp, 0x70
pop rbp
ret
mov eax, esi
mov ecx, 0x24
call fcn.00450f00
mov eax, edi
mov ecx, 0x24
call fcn.00450f00
nop
call fcn.0044ec80
nop dword [rax]
jmp fcn.004862a0
Function at 0x487bc0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x487cac
push rbp
mov rbp, rsp
sub rsp, 0x40
movabs rdx, 0x35391ab83d054472
mov qword [rsp + 0x1d], rdx
movabs rdx, 0xe835391ab83d0544
mov qword [rsp + 0x1e], rdx
movabs rdx, 0x666fe0fd392c63
mov qword [rsp + 0x26], rdx
movabs rdx, 0xb020c0d10080502
mov qword [rsp + 0x2e], rdx
movabs rdx, 0x3010b020c0d1008
mov qword [rsp + 0x30], rdx
movabs rdx, 0x806070c0604050a
mov qword [rsp + 0x38], rdx
xor eax, eax
jmp 0x487c4a
movzx r9d, byte [rsp + rsi + 0x1d]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x1e]
mov byte [rsp + rdi + 0x1d], dl
mov byte [rsp + rsi + 0x1d], r8b
add rax, 2
cmp rax, 0x12
jge 0x487c7c
movzx edx, byte [rsp + rax + 0x2e]
movzx esi, byte [rsp + rax + 0x2f]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x11
jae 0x487c9f
movzx r8d, byte [rsp + rdi + 0x1d]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x1e]
cmp rsi, 0x11
jb 0x487c30
jmp 0x487c93
xor eax, eax
lea rbx, [rsp + 0x1d]
mov ecx, 0x11
call fcn.00440c20
add rsp, 0x40
pop rbp
ret
mov eax, esi
mov ecx, 0x11
call fcn.00450f00
mov eax, edi
mov ecx, 0x11
call fcn.00450f00
nop
call fcn.0044ec80
jmp fcn.00487bc0
Function at 0x489d80
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x489e6a
push rbp
mov rbp, rsp
sub rsp, 0x40
movabs rdx, 0x361329274266654f
mov qword [rsp + 0x2e], rdx
movabs rdx, 0x61fc361329274266
mov qword [rsp + 0x30], rdx
movabs rdx, 0xb5523442465dc3c
mov qword [rsp + 0x38], rdx
movabs rdx, 0x7110b0305040706
mov qword [rsp + 0x1c], rdx
movabs rdx, 0xd0807110b030504
mov qword [rsp + 0x1e], rdx
movabs rdx, 0x1000100a0f0e030e
mov qword [rsp + 0x26], rdx
xor eax, eax
jmp 0x489e0d
movzx r9d, byte [rsp + rsi + 0x2e]
sub r9d, edx
lea edx, [r9 + 0x3f]
mov byte [rsp + rdi + 0x2e], dl
lea edx, [r8 + 0x3f]
mov byte [rsp + rsi + 0x2e], dl
add rax, 2
cmp rax, 0x12
jge 0x489e3a
movzx edx, byte [rsp + rax + 0x1c]
movzx esi, byte [rsp + rax + 0x1d]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x12
jae 0x489e5d
movzx r8d, byte [rsp + rdi + 0x2e]
sub r8d, edx
cmp rsi, 0x12
jb 0x489df0
jmp 0x489e51
xor eax, eax
lea rbx, [rsp + 0x2e]
mov ecx, 0x12
call fcn.00440c20
add rsp, 0x40
pop rbp
ret
mov eax, esi
mov ecx, 0x12
call fcn.00450f00
mov eax, edi
mov ecx, 0x12
call fcn.00450f00
nop
call fcn.0044ec80
jmp fcn.00489d80

Function at 0x48b860
Capabilities:
Encrypt data using rc4 prga

Disassembly:
lea r12, [rsp - 8]
cmp r12, qword [r14 + 0x10]
jbe 0x48b9c7
push rbp
mov rbp, rsp
add rsp, 0xffffffffffffff80
movabs rdx, 0xfcd147ffef45614d
mov qword [rsp + 0x1b], rdx
movabs rdx, 0x476c632074746538
mov qword [rsp + 0x23], rdx
movabs rdx, 0xfe476c6320747465
mov qword [rsp + 0x24], rdx
movabs rdx, 0x460b204f10341b35
mov qword [rsp + 0x2c], rdx
movabs rdx, 0xb36432747b75601f
mov qword [rsp + 0x34], rdx
movabs rdx, 0x727d549b5a4e4169
mov qword [rsp + 0x3c], rdx
movabs rdx, 0x714110405251c05
mov qword [rsp + 0x44], rdx
movabs rdx, 0xf23081003051426
mov qword [rsp + 0x4c], rdx
movabs rdx, 0x122217190f230810
mov qword [rsp + 0x50], rdx
movabs rdx, 0x6051a2508222520
mov qword [rsp + 0x58], rdx
movabs rdx, 0x1a13221420201905
mov qword [rsp + 0x60], rdx
movabs rdx, 0x18170e26081e1511
mov qword [rsp + 0x68], rdx
movabs rdx, 0x702270a03202811
mov qword [rsp + 0x70], rdx
movabs rdx, 0x14121907031c241c
mov qword [rsp + 0x78], rdx
xor eax, eax
jmp 0x48b96a
movzx r9d, byte [rsp + rsi + 0x1b]
sub r9d, edx
lea edx, [r9 + 0x58]
mov byte [rsp + rdi + 0x1b], dl
lea edx, [r8 + 0x58]
mov byte [rsp + rsi + 0x1b], dl
add rax, 2
cmp rax, 0x3c
jge 0x48b997
movzx edx, byte [rsp + rax + 0x44]
movzx esi, byte [rsp + rax + 0x45]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x29
jae 0x48b9ba
movzx r8d, byte [rsp + rdi + 0x1b]
sub r8d, edx
cmp rsi, 0x29
jb 0x48b94d
jmp 0x48b9ae
xor eax, eax
lea rbx, [rsp + 0x1b]
mov ecx, 0x29
call fcn.00440c20
sub rsp, 0xffffffffffffff80
pop rbp
ret
mov eax, esi
mov ecx, 0x29
call fcn.00450f00
mov eax, edi
mov ecx, 0x29
call fcn.00450f00
nop
call fcn.0044ec80
jmp fcn.0048b860
Function at 0x48d980
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x48daac
push rbp
mov rbp, rsp
sub rsp, 0x60
movabs rdx, 0xb107eabbc8b6f9ca
mov qword [rsp + 0x1b], rdx
movabs rdx, 0xf8b107eabbc8b6f9
mov qword [rsp + 0x1c], rdx
movabs rdx, 0x1cb1d6b163696c9a
mov qword [rsp + 0x24], rdx
movabs rdx, 0x2053a2ad20c52764
mov qword [rsp + 0x2c], rdx
movabs rdx, 0x6567cfb97220de6f
mov qword [rsp + 0x34], rdx
movabs rdx, 0x2150d1d100f1e13
mov qword [rsp + 0x3c], rdx
movabs rdx, 0x61a060102150d1d
mov qword [rsp + 0x40], rdx
movabs rdx, 0x120501160304120f
mov qword [rsp + 0x48], rdx
movabs rdx, 0x1212170e080d070f
mov qword [rsp + 0x50], rdx
movabs rdx, 0x40709170d061700
mov qword [rsp + 0x58], rdx
xor eax, eax
jmp 0x48da46
movzx r9d, byte [rsp + rsi + 0x1b]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x64]
mov byte [rsp + rdi + 0x1b], dl
mov byte [rsp + rsi + 0x1b], r8b
add rax, 2
cmp rax, 0x24
jge 0x48da7c
movzx edx, byte [rsp + rax + 0x3c]
movzx esi, byte [rsp + rax + 0x3d]
mov edi, edx
xor edx, esi
add edx, eax
nop dword [rax]
cmp rdi, 0x21
jae 0x48da9f
movzx r8d, byte [rsp + rdi + 0x1b]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x64]
cmp rsi, 0x21
jb 0x48da2c
jmp 0x48da93
xor eax, eax
lea rbx, [rsp + 0x1b]
mov ecx, 0x21
call fcn.00440c20
add rsp, 0x60
pop rbp
ret
mov eax, esi
mov ecx, 0x21
call fcn.00450f00
mov eax, edi
mov ecx, 0x21
call fcn.00450f00
nop
call fcn.0044ec80
jmp fcn.0048d980

Function at 0x48f960
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x48fa2c
push rbp
mov rbp, rsp
sub rsp, 0x38
movabs rdx, 0xaf8974aa20c78ff4
mov qword [rsp + 0x1f], rdx
movabs rdx, 0x9abf69af8974aa20
mov qword [rsp + 0x22], rdx
movabs rdx, 0x402040906010507
mov qword [rsp + 0x2a], rdx
movabs rdx, 0x40a050405000402
mov qword [rsp + 0x30], rdx
xor eax, eax
jmp 0x48f9cf
movzx r9d, byte [rsp + rsi + 0x1f]
sub r9d, edx
lea edx, [r9 - 0x1f]
mov byte [rsp + rdi + 0x1f], dl
lea edx, [r8 - 0x1f]
mov byte [rsp + rsi + 0x1f], dl
add rax, 2
cmp rax, 0xe
jge 0x48f9fc
movzx edx, byte [rsp + rax + 0x2a]
movzx esi, byte [rsp + rax + 0x2b]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0xb
jae 0x48fa1f
movzx r8d, byte [rsp + rdi + 0x1f]
sub r8d, edx
cmp rsi, 0xb
jb 0x48f9b2
jmp 0x48fa13
xor eax, eax
lea rbx, [rsp + 0x1f]
mov ecx, 0xb
call fcn.00440c20
add rsp, 0x38
pop rbp
ret
mov eax, esi
mov ecx, 0xb
call fcn.00450f00
mov eax, edi
mov ecx, 0xb
call fcn.00450f00
nop
call fcn.0044ec80
jmp fcn.0048f960
Function at 0x4907e0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4908a6
push rbp
mov rbp, rsp
sub rsp, 0x30
movabs rdx, 0x3dd61a8c15d62e04
mov qword [rsp + 0x1a], rdx
mov word [rsp + 0x22], 0xedd0
movabs rdx, 0x406050304040200
mov qword [rsp + 0x24], rdx
mov dword [rsp + 0x2c], 0x9080400
xor eax, eax
jmp 0x490840
movzx r9d, byte [rsp + rsi + 0x1a]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x45]
mov byte [rsp + rdi + 0x1a], dl
mov byte [rsp + rsi + 0x1a], r8b
add rax, 2
nop dword [rax]
cmp rax, 0xc
jge 0x490872
movzx edx, byte [rsp + rax + 0x24]
movzx esi, byte [rsp + rax + 0x25]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0xa
jae 0x490897
movzx r8d, byte [rsp + rdi + 0x1a]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x45]
cmp rsi, 0xa
jb 0x490823
jmp 0x49088b
xor eax, eax
lea rbx, [rsp + 0x1a]
mov ecx, 0xa
nop
call fcn.00440c20
add rsp, 0x30
pop rbp
ret
mov eax, esi
mov ecx, 0xa
call fcn.00450f00
mov eax, edi
mov ecx, 0xa
nop
call fcn.00450f00
nop
call fcn.0044ec80
jmp fcn.004907e0

Function at 0x493ee0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x493fc6
push rbp
mov rbp, rsp
sub rsp, 0x40
movabs rdx, 0xabf2b96c6176bc06
mov qword [rsp + 0x1e], rdx
movabs rdx, 0x74b143adf2b272fc
mov qword [rsp + 0x26], rdx
movabs rdx, 0xe0500050d060708
mov qword [rsp + 0x2e], rdx
movabs rdx, 0x10b0e0500050d06
mov qword [rsp + 0x30], rdx
movabs rdx, 0xc0d05070d060a01
mov qword [rsp + 0x38], rdx
xor eax, eax
nop
jmp 0x493f60
movzx r9d, byte [rsp + rsi + 0x1e]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x59]
mov byte [rsp + rdi + 0x1e], dl
mov byte [rsp + rsi + 0x1e], r8b
add rax, 2
nop dword [rax]
cmp rax, 0x12
jge 0x493f92
movzx edx, byte [rsp + rax + 0x2e]
movzx esi, byte [rsp + rax + 0x2f]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x10
jae 0x493fb7
movzx r8d, byte [rsp + rdi + 0x1e]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x59]
cmp rsi, 0x10
jb 0x493f42
jmp 0x493fab
xor eax, eax
lea rbx, [rsp + 0x1e]
mov ecx, 0x10
nop
call fcn.00440c20
add rsp, 0x40
pop rbp
ret
mov eax, esi
mov ecx, 0x10
call fcn.00450f00
mov eax, edi
mov ecx, 0x10
nop
call fcn.00450f00
nop
call fcn.0044ec80
jmp fcn.00493ee0
Function at 0x4955e0
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4956aa
push rbp
mov rbp, rsp
sub rsp, 0x48
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x58], rax
mov qword [rsp], rax
mov qword [rsp + 8], rbx
mov byte [rsp + 0x10], 0
call fcn.00403080
xorps xmm15, xmm15
mov r14, qword [0x006205b0]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x18], 0xffffffffffffffff
jne 0x49568f
mov rcx, qword [rsp + 0x60]
lea rdx, [rcx + 1]
mov qword [rsp + 0x40], rdx
lea rax, [0x00506b20]
xor ebx, ebx
mov rcx, rdx
call fcn.0043d760
mov rbx, qword [rsp + 0x60]
mov rcx, rax
xor edi, edi
mov rsi, qword [rsp + 0x40]
mov rax, qword [rsp + 0x58]
nop dword [rax]
call fcn.00498120
inc rbx
cmp rcx, rbx
jae 0x49567e
mov edi, 1
lea rsi, [0x00506b20]
call fcn.0043d840
mov word [rax + rbx*2 - 2], 0
xor edi, edi
xor esi, esi
add rsp, 0x48
pop rbp
ret
xor eax, eax
xor ebx, ebx
mov rcx, rbx
lea rdi, [0x00543d38]
lea rsi, [0x005439f0]
add rsp, 0x48
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.0044ec80
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.004955e0

Function at 0x496160
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x49625b
push rbp
mov rbp, rsp
sub rsp, 0x50
movabs rdx, 0x3291208463fb7274
mov qword [rsp + 0x1f], rdx
movabs rdx, 0xa404fe8c3e329120
mov qword [rsp + 0x24], rdx
movabs rdx, 0xf261bcac20b86e12
mov qword [rsp + 0x2c], rdx
movabs rdx, 0x11040807050f1207
mov qword [rsp + 0x34], rdx
movabs rdx, 0xd070c080b040912
mov qword [rsp + 0x3c], rdx
movabs rdx, 0xc0508060d070c08
mov qword [rsp + 0x40], rdx
movabs rdx, 0x110902080d140a12
mov qword [rsp + 0x48], rdx
xor eax, eax
jmp 0x4961f9
movzx r9d, byte [rsp + rsi + 0x1f]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x48]
mov byte [rsp + rdi + 0x1f], dl
mov byte [rsp + rsi + 0x1f], r8b
add rax, 2
cmp rax, 0x1c
jge 0x49622b
movzx edx, byte [rsp + rax + 0x34]
movzx esi, byte [rsp + rax + 0x35]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x15
jae 0x49624e
movzx r8d, byte [rsp + rdi + 0x1f]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x48]
cmp rsi, 0x15
jb 0x4961df
jmp 0x496242
xor eax, eax
lea rbx, [rsp + 0x1f]
mov ecx, 0x15
call fcn.00440c20
add rsp, 0x50
pop rbp
ret
mov eax, esi
mov ecx, 0x15
call fcn.00450f00
mov eax, edi
mov ecx, 0x15
call fcn.00450f00
nop
nop dword [rax + rax]
call fcn.0044ec80
jmp fcn.00496160
Function at 0x4996a0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4997bd
push rbp
mov rbp, rsp
sub rsp, 0x60
movabs rdx, 0x739c022065672577
mov qword [rsp + 0x1e], rdx
movabs rdx, 0xe1692a883f807213
mov qword [rsp + 0x26], rdx
movabs rdx, 0x20ded69e1692a88
mov qword [rsp + 0x2a], rdx
movabs rdx, 0xe477fd74732064f7
mov qword [rsp + 0x32], rdx
movabs rdx, 0x110a0e02130d1b00
mov qword [rsp + 0x3a], rdx
movabs rdx, 0xd1a0d120c11110a
mov qword [rsp + 0x40], rdx
movabs rdx, 0x1a080d1a060f0d13
mov qword [rsp + 0x48], rdx
movabs rdx, 0x1402081a190b0114
mov qword [rsp + 0x50], rdx
movabs rdx, 0x19120e051b081102
mov qword [rsp + 0x58], rdx
xor eax, eax
jmp 0x499760
movzx r9d, byte [rsp + rsi + 0x1e]
sub r9d, edx
lea edx, [r9 - 0x63]
mov byte [rsp + rdi + 0x1e], dl
lea edx, [r8 - 0x63]
mov byte [rsp + rsi + 0x1e], dl
add rax, 2
nop word [rax + rax]
cmp rax, 0x26
jge 0x49978d
movzx edx, byte [rsp + rax + 0x3a]
movzx esi, byte [rsp + rax + 0x3b]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x1c
jae 0x4997b0
movzx r8d, byte [rsp + rdi + 0x1e]
sub r8d, edx
cmp rsi, 0x1c
jb 0x49973d
jmp 0x4997a4
xor eax, eax
lea rbx, [rsp + 0x1e]
mov ecx, 0x1c
call fcn.00440c20
add rsp, 0x60
pop rbp
ret
mov eax, esi
mov ecx, 0x1c
call fcn.00450f00
mov eax, edi
mov ecx, 0x1c
call fcn.00450f00
nop
nop dword [rax]
call fcn.0044ec80
jmp fcn.004996a0

Function at 0x49a240
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x49a33d
push rbp
mov rbp, rsp
sub rsp, 0x50
movabs rdx, 0x79828aec2064f0f0
mov qword [rsp + 0x1e], rdx
movabs rdx, 0xd88d1f2079828aec
mov qword [rsp + 0x22], rdx
movabs rdx, 0x746107196fecf8f0
mov qword [rsp + 0x2a], rdx
movabs rdx, 0x110b100b110b00
mov qword [rsp + 0x32], rdx
movabs rdx, 0x1011040e06110c05
mov qword [rsp + 0x3a], rdx
movabs rdx, 0xb07090109071011
mov qword [rsp + 0x40], rdx
movabs rdx, 0xd0b0c070d0a060b
mov qword [rsp + 0x48], rdx
xor eax, eax
jmp 0x49a2e0
movzx r9d, byte [rsp + rsi + 0x1e]
sub r9d, edx
lea edx, [r9 - 0x70]
mov byte [rsp + rdi + 0x1e], dl
lea edx, [r8 - 0x70]
mov byte [rsp + rsi + 0x1e], dl
add rax, 2
nop dword [rax]
cmp rax, 0x1e
jge 0x49a30d
movzx edx, byte [rsp + rax + 0x32]
movzx esi, byte [rsp + rax + 0x33]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x14
jae 0x49a330
movzx r8d, byte [rsp + rdi + 0x1e]
sub r8d, edx
cmp rsi, 0x14
jb 0x49a2bf
jmp 0x49a324
xor eax, eax
lea rbx, [rsp + 0x1e]
mov ecx, 0x14
call fcn.00440c20
add rsp, 0x50
pop rbp
ret
mov eax, esi
mov ecx, 0x14
call fcn.00450f00
mov eax, edi
mov ecx, 0x14
call fcn.00450f00
nop
nop dword [rax]
call fcn.0044ec80
jmp fcn.0049a240
Function at 0x49a880
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x49a99a
push rbp
mov rbp, rsp
sub rsp, 0x58
movabs rdx, 0x11312fe1c6df963
mov qword [rsp + 0x19], rdx
movabs rdx, 0x4a4a29203b431f1b
mov qword [rsp + 0x21], rdx
movabs rdx, 0x16f724a4a29203b
mov qword [rsp + 0x24], rdx
movabs rdx, 0xb6ee441206e4048
mov qword [rsp + 0x2c], rdx
movabs rdx, 0x1207140e070b1a1a
mov qword [rsp + 0x34], rdx
movabs rdx, 0xa1a07081207140e
mov qword [rsp + 0x38], rdx
movabs rdx, 0xc05030f01130409
mov qword [rsp + 0x40], rdx
movabs rdx, 0x17040b0506090906
mov qword [rsp + 0x48], rdx
movabs rdx, 0x80c0d180f05070a
mov qword [rsp + 0x50], rdx
xor eax, eax
jmp 0x49a937
movzx r9d, byte [rsp + rsi + 0x19]
lea edx, [r9 + rdx]
lea edx, [rdx + 7]
mov byte [rsp + rdi + 0x19], dl
mov byte [rsp + rsi + 0x19], r8b
add rax, 2
cmp rax, 0x24
jge 0x49a969
movzx edx, byte [rsp + rax + 0x34]
movzx esi, byte [rsp + rax + 0x35]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x1b
jae 0x49a98d
movzx r8d, byte [rsp + rdi + 0x19]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 7]
cmp rsi, 0x1b
jb 0x49a91d
jmp 0x49a981
xor eax, eax
lea rbx, [rsp + 0x19]
mov ecx, 0x1b
call fcn.00440c20
add rsp, 0x58
pop rbp
nop
ret
mov eax, esi
mov ecx, 0x1b
call fcn.00450f00
mov eax, edi
mov ecx, 0x1b
call fcn.00450f00
nop
call fcn.0044ec80
nop
jmp fcn.0049a880