joyce8/EMBER2024-capa huggingface dataset:
Function at 0x48a040
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x48a13d
push rbp
mov rbp, rsp
sub rsp, 0x50
movabs rdx, 0x24dad8d739c73975
mov qword [rsp + 0x1d], rdx
movabs rdx, 0x87c720d0d124dad8
mov qword [rsp + 0x22], rdx
movabs rdx, 0xcb4446e820e7c135
mov qword [rsp + 0x2a], rdx
movabs rdx, 0xc07131301140c13
mov qword [rsp + 0x32], rdx
movabs rdx, 0xb050312030d0709
mov qword [rsp + 0x3a], rdx
movabs rdx, 0xc0209020e080b05
mov qword [rsp + 0x40], rdx
movabs rdx, 0x40d13060311140f
mov qword [rsp + 0x48], rdx
xor eax, eax
jmp 0x48a0e0
movzx r9d, byte [rsp + rsi + 0x1d]
sub r9d, edx
lea edx, [r9 - 0x46]
mov byte [rsp + rdi + 0x1d], dl
lea edx, [r8 - 0x46]
mov byte [rsp + rsi + 0x1d], dl
add rax, 2
nop dword [rax]
cmp rax, 0x1e
jge 0x48a10d
movzx edx, byte [rsp + rax + 0x32]
movzx esi, byte [rsp + rax + 0x33]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x15
jae 0x48a130
movzx r8d, byte [rsp + rdi + 0x1d]
sub r8d, edx
cmp rsi, 0x15
jb 0x48a0bf
jmp 0x48a124
xor eax, eax
lea rbx, [rsp + 0x1d]
mov ecx, 0x15
call fcn.00441380
add rsp, 0x50
pop rbp
ret
mov eax, esi
mov ecx, 0x15
call fcn.00451880
mov eax, edi
mov ecx, 0x15
call fcn.00451880
nop
nop dword [rax]
call fcn.0044f600
jmp fcn.0048a040

Function at 0x48b280
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x48b37b
push rbp
mov rbp, rsp
sub rsp, 0x48
movabs rdx, 0xd0b1aa7e20958e20
mov qword [rsp + 0x19], rdx
movabs rdx, 0x98748f9bc4d0b1aa
mov qword [rsp + 0x1e], rdx
movabs rdx, 0x906f8b819ea220ad
mov qword [rsp + 0x26], rdx
movabs rdx, 0xf050c0a0f070602
mov qword [rsp + 0x2e], rdx
movabs rdx, 0xd05101209090908
mov qword [rsp + 0x36], rdx
movabs rdx, 0x5010d0510120909
mov qword [rsp + 0x38], rdx
movabs rdx, 0x40f120a11021114
mov qword [rsp + 0x40], rdx
xor eax, eax
jmp 0x48b319
movzx r9d, byte [rsp + rsi + 0x19]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x34]
mov byte [rsp + rdi + 0x19], dl
mov byte [rsp + rsi + 0x19], r8b
add rax, 2
cmp rax, 0x1a
jge 0x48b34b
movzx edx, byte [rsp + rax + 0x2e]
movzx esi, byte [rsp + rax + 0x2f]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x15
jae 0x48b36e
movzx r8d, byte [rsp + rdi + 0x19]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x34]
cmp rsi, 0x15
jb 0x48b2ff
jmp 0x48b362
xor eax, eax
lea rbx, [rsp + 0x19]
mov ecx, 0x15
call fcn.00441380
add rsp, 0x48
pop rbp
ret
mov eax, esi
mov ecx, 0x15
call fcn.00451880
mov eax, edi
mov ecx, 0x15
call fcn.00451880
nop
nop dword [rax + rax]
call fcn.0044f600
jmp fcn.0048b280
Function at 0x48bac0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x48bbaa
push rbp
mov rbp, rsp
sub rsp, 0x48
movabs rdx, 0x90948d868f876f85
mov qword [rsp + 0x1d], rdx
movabs rdx, 0x6574915d9390948d
mov qword [rsp + 0x22], rdx
movabs rdx, 0xbe917b908e6d204b
mov qword [rsp + 0x2a], rdx
movabs rdx, 0x1111021200141213
mov qword [rsp + 0x32], rdx
movabs rdx, 0x504070007091111
mov qword [rsp + 0x38], rdx
movabs rdx, 0x80a0d0306071110
mov qword [rsp + 0x40], rdx
xor eax, eax
jmp 0x48bb4d
movzx r9d, byte [rsp + rsi + 0x1d]
sub r9d, edx
lea edx, [r9 - 0xb]
mov byte [rsp + rdi + 0x1d], dl
lea edx, [r8 - 0xb]
mov byte [rsp + rsi + 0x1d], dl
add rax, 2
cmp rax, 0x16
jge 0x48bb7a
movzx edx, byte [rsp + rax + 0x32]
movzx esi, byte [rsp + rax + 0x33]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x15
jae 0x48bb9d
movzx r8d, byte [rsp + rdi + 0x1d]
sub r8d, edx
cmp rsi, 0x15
jb 0x48bb30
jmp 0x48bb91
xor eax, eax
lea rbx, [rsp + 0x1d]
mov ecx, 0x15
call fcn.00441380
add rsp, 0x48
pop rbp
ret
mov eax, esi
mov ecx, 0x15
call fcn.00451880
mov eax, edi
mov ecx, 0x15
call fcn.00451880
nop
call fcn.0044f600
jmp fcn.0048bac0

Function at 0x48bec0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x48bfac
push rbp
mov rbp, rsp
sub rsp, 0x40
movabs rdx, 0xe4f36365d4029b72
mov qword [rsp + 0x1d], rdx
movabs rdx, 0x20e4f36365d4029b
mov qword [rsp + 0x1e], rdx
movabs rdx, 0xe7816ff3646c35e7
mov qword [rsp + 0x26], rdx
movabs rdx, 0x2060c0a0f060c03
mov qword [rsp + 0x2e], rdx
movabs rdx, 0xa0702060c0a0f06
mov qword [rsp + 0x30], rdx
movabs rdx, 0xc0d010901101003
mov qword [rsp + 0x38], rdx
xor eax, eax
jmp 0x48bf4a
movzx r9d, byte [rsp + rsi + 0x1d]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x68]
mov byte [rsp + rdi + 0x1d], dl
mov byte [rsp + rsi + 0x1d], r8b
add rax, 2
cmp rax, 0x12
jge 0x48bf7c
movzx edx, byte [rsp + rax + 0x2e]
movzx esi, byte [rsp + rax + 0x2f]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x11
jae 0x48bf9f
movzx r8d, byte [rsp + rdi + 0x1d]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x68]
cmp rsi, 0x11
jb 0x48bf30
jmp 0x48bf93
xor eax, eax
lea rbx, [rsp + 0x1d]
mov ecx, 0x11
call fcn.00441380
add rsp, 0x40
pop rbp
ret
mov eax, esi
mov ecx, 0x11
call fcn.00451880
mov eax, edi
mov ecx, 0x11
call fcn.00451880
nop
call fcn.0044f600
jmp fcn.0048bec0
Function at 0x48bfc0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x48c08c
push rbp
mov rbp, rsp
sub rsp, 0x38
movabs rdx, 0x7772b97ab364b820
mov qword [rsp + 0x1a], rdx
movabs rdx, 0x79750c61c50d7772
mov qword [rsp + 0x20], rdx
movabs rdx, 0x902070b05030105
mov qword [rsp + 0x28], rdx
movabs rdx, 0xd080907090b0908
mov qword [rsp + 0x30], rdx
xor eax, eax
jmp 0x48c02f
movzx r9d, byte [rsp + rsi + 0x1a]
sub r9d, edx
lea edx, [r9 - 0x46]
mov byte [rsp + rdi + 0x1a], dl
lea edx, [r8 - 0x46]
mov byte [rsp + rsi + 0x1a], dl
add rax, 2
cmp rax, 0x10
jge 0x48c05c
movzx edx, byte [rsp + rax + 0x28]
movzx esi, byte [rsp + rax + 0x29]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0xe
jae 0x48c07f
movzx r8d, byte [rsp + rdi + 0x1a]
sub r8d, edx
cmp rsi, 0xe
jb 0x48c012
jmp 0x48c073
xor eax, eax
lea rbx, [rsp + 0x1a]
mov ecx, 0xe
call fcn.00441380
add rsp, 0x38
pop rbp
ret
mov eax, esi
mov ecx, 0xe
call fcn.00451880
mov eax, edi
mov ecx, 0xe
call fcn.00451880
nop
call fcn.0044f600
jmp fcn.0048bfc0

Function at 0x48cfe0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x48d118
push rbp
mov rbp, rsp
sub rsp, 0x68
movabs rdx, 0x25742b5040664172
mov qword [rsp + 0x18], rdx
movabs rdx, 0x3af525742b504066
mov qword [rsp + 0x1a], rdx
movabs rdx, 0x496e6b53ee14141b
mov qword [rsp + 0x22], rdx
movabs rdx, 0x41256050000e785c
mov qword [rsp + 0x2a], rdx
movabs rdx, 0xe80e0c756f3e205e
mov qword [rsp + 0x32], rdx
movabs rdx, 0x141605080e212115
mov qword [rsp + 0x3a], rdx
movabs rdx, 0x1f081c090a0f120a
mov qword [rsp + 0x42], rdx
movabs rdx, 0x1c031917140b1f08
mov qword [rsp + 0x48], rdx
movabs rdx, 0x505171a12071509
mov qword [rsp + 0x50], rdx
movabs rdx, 0x416120120091618
mov qword [rsp + 0x58], rdx
movabs rdx, 0xc07140d1f110e05
mov qword [rsp + 0x60], rdx
xor eax, eax
jmp 0x48d0b5
movzx r9d, byte [rsp + rsi + 0x18]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x11]
mov byte [rsp + rdi + 0x18], dl
mov byte [rsp + rsi + 0x18], r8b
add rax, 2
cmp rax, 0x2e
jge 0x48d0e8
movzx edx, byte [rsp + rax + 0x3a]
movzx esi, byte [rsp + rax + 0x3b]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x22
jae 0x48d10b
movzx r8d, byte [rsp + rdi + 0x18]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x11]
nop
cmp rsi, 0x22
jb 0x48d09b
jmp 0x48d0ff
xor eax, eax
lea rbx, [rsp + 0x18]
mov ecx, 0x22
call fcn.00441380
add rsp, 0x68
pop rbp
ret
mov eax, esi
mov ecx, 0x22
call fcn.00451880
mov eax, edi
mov ecx, 0x22
call fcn.00451880
nop
call fcn.0044f600
nop dword [rax]
jmp fcn.0048cfe0
Function at 0x48fea0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
lea r12, [rsp - 0x28]
cmp r12, qword [r14 + 0x10]
jbe 0x490048
push rbp
mov rbp, rsp
sub rsp, 0xa0
movabs rdx, 0xdd7963656ce0513c
mov qword [rsp + 0x1c], rdx
movabs rdx, 0x32c9276cca4d2c20
mov qword [rsp + 0x24], rdx
movabs rdx, 0x51752810386832c9
mov qword [rsp + 0x2a], rdx
movabs rdx, 0x72655a2a29db5c47
mov qword [rsp + 0x32], rdx
movabs rdx, 0x5206e0d7d6e4d20
mov qword [rsp + 0x3a], rdx
movabs rdx, 0x5710cb726b61766e
mov qword [rsp + 0x42], rdx
movabs rdx, 0x3eea65686e0bf26f
mov qword [rsp + 0x4a], rdx
movabs rdx, 0x720274804d092d20
mov qword [rsp + 0x52], rdx
movabs rdx, 0xf290d063a3c2137
mov qword [rsp + 0x5a], rdx
movabs rdx, 0x1172f122c2a0f29
mov qword [rsp + 0x60], rdx
movabs rdx, 0x9102516062c290a
mov qword [rsp + 0x68], rdx
movabs rdx, 0x2a1038110b341b02
mov qword [rsp + 0x70], rdx
movabs rdx, 0xb01350019220730
mov qword [rsp + 0x78], rdx
movabs rdx, 0x2d112b2d0e1f3829
mov qword [rsp + 0x80], rdx
movabs rdx, 0x2c1812070a192f1f
mov qword [rsp + 0x88], rdx
movabs rdx, 0x150713391b153039
mov qword [rsp + 0x90], rdx
movabs rdx, 0x111a3411012f163a
mov qword [rsp + 0x98], rdx
xor eax, eax
jmp 0x48ffe3
movzx r9d, byte [rsp + rsi + 0x1c]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x23]
mov byte [rsp + rdi + 0x1c], dl
mov byte [rsp + rsi + 0x1c], r8b
add rax, 2
cmp rax, 0x46
jge 0x490015
movzx edx, byte [rsp + rax + 0x5a]
movzx esi, byte [rsp + rax + 0x5b]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x3e
jae 0x49003b
movzx r8d, byte [rsp + rdi + 0x1c]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x23]
cmp rsi, 0x3e
jb 0x48ffc9
jmp 0x49002f
xor eax, eax
lea rbx, [rsp + 0x1c]
mov ecx, 0x3e
call fcn.00441380
add rsp, 0xa0
pop rbp
ret
mov eax, esi
mov ecx, 0x3e
call fcn.00451880
mov eax, edi
mov ecx, 0x3e
call fcn.00451880
nop
call fcn.0044f600
jmp fcn.0048fea0
Function at 0x491180
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x49129d
push rbp
mov rbp, rsp
sub rsp, 0x60
movabs rdx, 0xc49a5ff4a0846191
mov qword [rsp + 0x1a], rdx
movabs rdx, 0xc8939b8375c8619e
mov qword [rsp + 0x22], rdx
movabs rdx, 0xb59f3eb064656cbc
mov qword [rsp + 0x2a], rdx
movabs rdx, 0x74789f628aa189a8
mov qword [rsp + 0x32], rdx
movabs rdx, 0x1806160204020a16
mov qword [rsp + 0x3a], rdx
movabs rdx, 0xf060a0c100f1806
mov qword [rsp + 0x40], rdx
movabs rdx, 0x160d1c07020e1719
mov qword [rsp + 0x48], rdx
movabs rdx, 0x50d051b08151514
mov qword [rsp + 0x50], rdx
movabs rdx, 0x101a191d001c0403
mov qword [rsp + 0x58], rdx
xor eax, eax
jmp 0x491240
movzx r9d, byte [rsp + rsi + 0x1a]
sub r9d, edx
lea edx, [r9 - 7]
mov byte [rsp + rdi + 0x1a], dl
lea edx, [r8 - 7]
mov byte [rsp + rsi + 0x1a], dl
add rax, 2
nop word [rax + rax]
cmp rax, 0x26
jge 0x49126d
movzx edx, byte [rsp + rax + 0x3a]
movzx esi, byte [rsp + rax + 0x3b]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x20
jae 0x491290
movzx r8d, byte [rsp + rdi + 0x1a]
sub r8d, edx
cmp rsi, 0x20
jb 0x49121d
jmp 0x491284
xor eax, eax
lea rbx, [rsp + 0x1a]
mov ecx, 0x20
call fcn.00441380
add rsp, 0x60
pop rbp
ret
mov eax, esi
mov ecx, 0x20
call fcn.00451880
mov eax, edi
mov ecx, 0x20
call fcn.00451880
nop
nop dword [rax]
call fcn.0044f600
jmp fcn.00491180

Function at 0x4924e0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x49260c
push rbp
mov rbp, rsp
sub rsp, 0x60
movabs rdx, 0xe17463e0fffccc0e
mov qword [rsp + 0x19], rdx
movabs rdx, 0xb5e17463e0fffccc
mov qword [rsp + 0x1a], rdx
movabs rdx, 0x6e69ccb75ae90561
mov qword [rsp + 0x22], rdx
movabs rdx, 0x20fa31f42078317d
mov qword [rsp + 0x2a], rdx
movabs rdx, 0x65676e61769e792c
mov qword [rsp + 0x32], rdx
movabs rdx, 0x161619070c0801
mov qword [rsp + 0x3a], rdx
movabs rdx, 0x20c01171b0d0016
mov qword [rsp + 0x40], rdx
movabs rdx, 0x1a121c0a110d020a
mov qword [rsp + 0x48], rdx
movabs rdx, 0xd190e071a19110b
mov qword [rsp + 0x50], rdx
movabs rdx, 0x4120a1a030b1500
mov qword [rsp + 0x58], rdx
xor eax, eax
jmp 0x4925a6
movzx r9d, byte [rsp + rsi + 0x19]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x4b]
mov byte [rsp + rdi + 0x19], dl
mov byte [rsp + rsi + 0x19], r8b
add rax, 2
cmp rax, 0x26
jge 0x4925dc
movzx edx, byte [rsp + rax + 0x3a]
movzx esi, byte [rsp + rax + 0x3b]
mov edi, edx
xor edx, esi
add edx, eax
nop dword [rax]
cmp rdi, 0x21
jae 0x4925ff
movzx r8d, byte [rsp + rdi + 0x19]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x4b]
cmp rsi, 0x21
jb 0x49258c
jmp 0x4925f3
xor eax, eax
lea rbx, [rsp + 0x19]
mov ecx, 0x21
call fcn.00441380
add rsp, 0x60
pop rbp
ret
mov eax, esi
mov ecx, 0x21
call fcn.00451880
mov eax, edi
mov ecx, 0x21
call fcn.00451880
nop
call fcn.0044f600
jmp fcn.004924e0
Function at 0x492620
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x492728
push rbp
mov rbp, rsp
sub rsp, 0x50
movabs rdx, 0x514a19e965fe6673
mov qword [rsp + 0x1b], rdx
movabs rdx, 0x690bf967355b7662
mov qword [rsp + 0x23], rdx
movabs rdx, 0x4a690bf967355b76
mov qword [rsp + 0x24], rdx
movabs rdx, 0x1042fe2e5e534b22
mov qword [rsp + 0x2c], rdx
movabs rdx, 0x16100e0d18040b04
mov qword [rsp + 0x34], rdx
movabs rdx, 0x13011708070b110d
mov qword [rsp + 0x3c], rdx
movabs rdx, 0x1814120513011708
mov qword [rsp + 0x40], rdx
movabs rdx, 0x50c060c0a080a02
mov qword [rsp + 0x48], rdx
xor eax, eax
jmp 0x4926cb
movzx r9d, byte [rsp + rsi + 0x1b]
sub r9d, edx
lea edx, [r9 + 0x2e]
mov byte [rsp + rdi + 0x1b], dl
lea edx, [r8 + 0x2e]
mov byte [rsp + rsi + 0x1b], dl
add rax, 2
cmp rax, 0x1c
jge 0x4926f8
movzx edx, byte [rsp + rax + 0x34]
movzx esi, byte [rsp + rax + 0x35]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x19
jae 0x49271b
movzx r8d, byte [rsp + rdi + 0x1b]
sub r8d, edx
cmp rsi, 0x19
jb 0x4926ae
jmp 0x49270f
xor eax, eax
lea rbx, [rsp + 0x1b]
mov ecx, 0x19
call fcn.00441380
add rsp, 0x50
pop rbp
ret
mov eax, esi
mov ecx, 0x19
call fcn.00451880
mov eax, edi
mov ecx, 0x19
call fcn.00451880
nop
call fcn.0044f600
jmp fcn.00492620
Function at 0x4931a0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x493258
push rbp
mov rbp, rsp
sub rsp, 0x30
movabs rdx, 0x5d4c0e7356302021
mov qword [rsp + 0x1d], rdx
mov byte [rsp + 0x25], 0x54
movabs rdx, 0x203020308070305
mov qword [rsp + 0x26], rdx
mov word [rsp + 0x2e], 5
xor eax, eax
nop
jmp 0x4931f8
movzx r9d, byte [rsp + rsi + 0x1d]
add edx, r9d
mov byte [rsp + rdi + 0x1d], dl
mov byte [rsp + rsi + 0x1d], r8b
add rax, 2
cmp rax, 0xa
jge 0x493228
movzx edx, byte [rsp + rax + 0x26]
movzx esi, byte [rsp + rax + 0x27]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 9
jae 0x49324b
movzx r8d, byte [rsp + rdi + 0x1d]
add r8d, edx
nop dword [rax]
cmp rsi, 9
jb 0x4931e2
jmp 0x49323f
xor eax, eax
lea rbx, [rsp + 0x1d]
mov ecx, 9
call fcn.00441380
add rsp, 0x30
pop rbp
ret
mov eax, esi
mov ecx, 9
call fcn.00451880
mov eax, edi
mov ecx, 9
call fcn.00451880
nop
call fcn.0044f600
nop dword [rax]
jmp fcn.004931a0

Function at 0x493d60
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x493e5d
push rbp
mov rbp, rsp
sub rsp, 0x50
movabs rdx, 0x75a9ab7c4694a7ae
mov qword [rsp + 0x1f], rdx
movabs rdx, 0x989b98c0a375a9ab
mov qword [rsp + 0x24], rdx
movabs rdx, 0x88c6b09ab091432e
mov qword [rsp + 0x2c], rdx
movabs rdx, 0x5070804090b0a
mov qword [rsp + 0x34], rdx
movabs rdx, 0x1140b0f14120307
mov qword [rsp + 0x3c], rdx
movabs rdx, 0x213050a01140b0f
mov qword [rsp + 0x40], rdx
movabs rdx, 0x6100c0200000411
mov qword [rsp + 0x48], rdx
xor eax, eax
jmp 0x493e00
movzx r9d, byte [rsp + rsi + 0x1f]
sub r9d, edx
lea edx, [r9 - 0xc]
mov byte [rsp + rdi + 0x1f], dl
lea edx, [r8 - 0xc]
mov byte [rsp + rsi + 0x1f], dl
add rax, 2
nop dword [rax]
cmp rax, 0x1c
jge 0x493e2d
movzx edx, byte [rsp + rax + 0x34]
movzx esi, byte [rsp + rax + 0x35]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x15
jae 0x493e50
movzx r8d, byte [rsp + rdi + 0x1f]
sub r8d, edx
cmp rsi, 0x15
jb 0x493ddf
jmp 0x493e44
xor eax, eax
lea rbx, [rsp + 0x1f]
mov ecx, 0x15
call fcn.00441380
add rsp, 0x50
pop rbp
ret
mov eax, esi
mov ecx, 0x15
call fcn.00451880
mov eax, edi
mov ecx, 0x15
call fcn.00451880
nop
nop dword [rax]
call fcn.0044f600
jmp fcn.00493d60
Function at 0x495c60
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x495d4a
push rbp
mov rbp, rsp
sub rsp, 0x40
movabs rdx, 0x207f776f6eb8a17e
mov qword [rsp + 0x1d], rdx
movabs rdx, 0x74207f776f6eb8a1
mov qword [rsp + 0x1e], rdx
movabs rdx, 0x647e698092968439
mov qword [rsp + 0x26], rdx
movabs rdx, 0x6010b0b020d0102
mov qword [rsp + 0x2e], rdx
movabs rdx, 0x60d06010b0b020d
mov qword [rsp + 0x30], rdx
movabs rdx, 0xc090d0a0f0f000b
mov qword [rsp + 0x38], rdx
xor eax, eax
jmp 0x495ced
movzx r9d, byte [rsp + rsi + 0x1d]
sub r9d, edx
lea edx, [r9 - 4]
mov byte [rsp + rdi + 0x1d], dl
lea edx, [r8 - 4]
mov byte [rsp + rsi + 0x1d], dl
add rax, 2
cmp rax, 0x12
jge 0x495d1a
movzx edx, byte [rsp + rax + 0x2e]
movzx esi, byte [rsp + rax + 0x2f]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x11
jae 0x495d3d
movzx r8d, byte [rsp + rdi + 0x1d]
sub r8d, edx
cmp rsi, 0x11
jb 0x495cd0
jmp 0x495d31
xor eax, eax
lea rbx, [rsp + 0x1d]
mov ecx, 0x11
call fcn.00441380
add rsp, 0x40
pop rbp
ret
mov eax, esi
mov ecx, 0x11
call fcn.00451880
mov eax, edi
mov ecx, 0x11
call fcn.00451880
nop
call fcn.0044f600
jmp fcn.00495c60

Function at 0x498940
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x498a3b
push rbp
mov rbp, rsp
sub rsp, 0x48
movabs rdx, 0x331d341553076553
mov qword [rsp + 0x18], rdx
movabs rdx, 0xbc6c4c76331d3415
mov qword [rsp + 0x1c], rdx
movabs rdx, 0x4a00144c226f1c50
mov qword [rsp + 0x24], rdx
movabs rdx, 0x2100504060d0709
mov qword [rsp + 0x2c], rdx
movabs rdx, 0xf1006070d0f0512
mov qword [rsp + 0x34], rdx
movabs rdx, 0xf0c03130f100607
mov qword [rsp + 0x38], rdx
movabs rdx, 0x70911090d12120b
mov qword [rsp + 0x40], rdx
xor eax, eax
jmp 0x4989d9
movzx r9d, byte [rsp + rsi + 0x18]
lea edx, [r9 + rdx]
lea edx, [rdx + 1]
mov byte [rsp + rdi + 0x18], dl
mov byte [rsp + rsi + 0x18], r8b
add rax, 2
cmp rax, 0x1c
jge 0x498a0b
movzx edx, byte [rsp + rax + 0x2c]
movzx esi, byte [rsp + rax + 0x2d]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x14
jae 0x498a2e
movzx r8d, byte [rsp + rdi + 0x18]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 1]
cmp rsi, 0x14
jb 0x4989bf
jmp 0x498a22
xor eax, eax
lea rbx, [rsp + 0x18]
mov ecx, 0x14
call fcn.00441380
add rsp, 0x48
pop rbp
ret
mov eax, esi
mov ecx, 0x14
call fcn.00451880
mov eax, edi
mov ecx, 0x14
call fcn.00451880
nop
nop dword [rax + rax]
call fcn.0044f600
jmp fcn.00498940
Function at 0x4994e0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4995bd
push rbp
mov rbp, rsp
sub rsp, 0x40
movabs rdx, 0xf3cd96c847b9a9c4
mov qword [rsp + 0x18], rdx
movabs rdx, 0xa591658f90d87b8c
mov qword [rsp + 0x20], rdx
movabs rdx, 0x10708090a020b04
mov qword [rsp + 0x28], rdx
movabs rdx, 0x703060c02000e05
mov qword [rsp + 0x30], rdx
movabs rdx, 0xc0f010f0a000b02
mov qword [rsp + 0x38], rdx
xor eax, eax
nop
jmp 0x499560
movzx r9d, byte [rsp + rsi + 0x18]
sub r9d, edx
lea edx, [r9 - 0x15]
mov byte [rsp + rdi + 0x18], dl
lea edx, [r8 - 0x15]
mov byte [rsp + rsi + 0x18], dl
add rax, 2
nop
cmp rax, 0x18
jge 0x49958d
movzx edx, byte [rsp + rax + 0x28]
movzx esi, byte [rsp + rax + 0x29]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x10
jae 0x4995b0
movzx r8d, byte [rsp + rdi + 0x18]
sub r8d, edx
cmp rsi, 0x10
jb 0x499542
jmp 0x4995a4
xor eax, eax
lea rbx, [rsp + 0x18]
mov ecx, 0x10
call fcn.00441380
add rsp, 0x40
pop rbp
ret
mov eax, esi
mov ecx, 0x10
call fcn.00451880
mov eax, edi
mov ecx, 0x10
call fcn.00451880
nop
nop dword [rax]
call fcn.0044f600
jmp fcn.004994e0

Function at 0x49ab00
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x49abca
push rbp
mov rbp, rsp
sub rsp, 0x48
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x58], rax
mov qword [rsp], rax
mov qword [rsp + 8], rbx
mov byte [rsp + 0x10], 0
call fcn.00403080
xorps xmm15, xmm15
mov r14, qword [0x00797990]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x18], 0xffffffffffffffff
jne 0x49abaf
mov rcx, qword [rsp + 0x60]
lea rdx, [rcx + 1]
mov qword [rsp + 0x40], rdx
lea rax, [0x0051e580]
xor ebx, ebx
mov rcx, rdx
call fcn.0043dec0
mov rbx, qword [rsp + 0x60]
mov rcx, rax
xor edi, edi
mov rsi, qword [rsp + 0x40]
mov rax, qword [rsp + 0x58]
nop dword [rax]
call fcn.0049d420
inc rbx
cmp rcx, rbx
jae 0x49ab9e
mov edi, 1
lea rsi, [0x0051e580]
call fcn.0043dfa0
mov word [rax + rbx*2 - 2], 0
xor edi, edi
xor esi, esi
add rsp, 0x48
pop rbp
ret
xor eax, eax
xor ebx, ebx
mov rcx, rbx
lea rdi, [0x006b1c98]
lea rsi, [0x006b18f8]
add rsp, 0x48
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.0044f600
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.0049ab00
Function at 0x49b3a0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x49b466
push rbp
mov rbp, rsp
sub rsp, 0x30
movabs rdx, 0xe1612725f106ebd
mov qword [rsp + 0x1d], rdx
mov byte [rsp + 0x25], 0x74
movabs rdx, 0x607070007070307
mov qword [rsp + 0x26], rdx
mov word [rsp + 0x2e], 0x502
xor eax, eax
nop
jmp 0x49b400
movzx r9d, byte [rsp + rsi + 0x1d]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x53]
mov byte [rsp + rdi + 0x1d], dl
mov byte [rsp + rsi + 0x1d], r8b
add rax, 2
nop dword [rax]
cmp rax, 0xa
jge 0x49b432
movzx edx, byte [rsp + rax + 0x26]
movzx esi, byte [rsp + rax + 0x27]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 9
jae 0x49b457
movzx r8d, byte [rsp + rdi + 0x1d]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x53]
cmp rsi, 9
jb 0x49b3e2
jmp 0x49b44b
xor eax, eax
lea rbx, [rsp + 0x1d]
mov ecx, 9
nop
call fcn.00441380
add rsp, 0x30
pop rbp
ret
mov eax, esi
mov ecx, 9
call fcn.00451880
mov eax, edi
mov ecx, 9
nop
call fcn.00451880
nop
call fcn.0044f600
jmp fcn.0049b3a0

Function at 0x49bac0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x49bb7d
push rbp
mov rbp, rsp
sub rsp, 0x30
movabs rdx, 0xce2816c820732562
mov qword [rsp + 0x1d], rdx
mov byte [rsp + 0x25], 0xd8
movabs rdx, 0x707060101080407
mov qword [rsp + 0x26], rdx
mov word [rsp + 0x2e], 0x504
xor eax, eax
nop
jmp 0x49bb20
movzx r9d, byte [rsp + rsi + 0x1d]
sub r9d, edx
lea edx, [r9 + 0x58]
mov byte [rsp + rdi + 0x1d], dl
lea edx, [r8 + 0x58]
mov byte [rsp + rsi + 0x1d], dl
add rax, 2
nop
cmp rax, 0xa
jge 0x49bb4d
movzx edx, byte [rsp + rax + 0x26]
movzx esi, byte [rsp + rax + 0x27]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 9
jae 0x49bb70
movzx r8d, byte [rsp + rdi + 0x1d]
sub r8d, edx
cmp rsi, 9
jb 0x49bb02
jmp 0x49bb64
xor eax, eax
lea rbx, [rsp + 0x1d]
mov ecx, 9
call fcn.00441380
add rsp, 0x30
pop rbp
ret
mov eax, esi
mov ecx, 9
call fcn.00451880
mov eax, edi
mov ecx, 9
call fcn.00451880
nop
nop dword [rax]
call fcn.0044f600
jmp fcn.0049bac0