joyce8/EMBER2024-capa huggingface dataset:
Function at 0x490e20
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x490ee7
push rbp
mov rbp, rsp
sub rsp, 0x38
movabs rdx, 0x4246cc6cc1651704
mov qword [rsp + 0x2d], rdx
mov dword [rsp + 0x34], 0x57651042
movabs rdx, 0x304070301000308
mov qword [rsp + 0x1f], rdx
movabs rdx, 0x501010300040304
mov qword [rsp + 0x25], rdx
xor eax, eax
jmp 0x490e88
movzx r9d, byte [rsp + rsi + 0x2d]
sub r9d, edx
lea edx, [r9 - 0x4a]
mov byte [rsp + rdi + 0x2d], dl
lea edx, [r8 - 0x4a]
mov byte [rsp + rsi + 0x2d], dl
add rax, 2
cmp rax, 0xe
jge 0x490eb7
movzx edx, byte [rsp + rax + 0x1f]
movzx esi, byte [rsp + rax + 0x20]
mov edi, edx
xor edx, esi
add edx, eax
nop
cmp rdi, 0xb
jae 0x490eda
movzx r8d, byte [rsp + rdi + 0x2d]
sub r8d, edx
cmp rsi, 0xb
jb 0x490e6b
jmp 0x490ece
xor eax, eax
lea rbx, [rsp + 0x2d]
mov ecx, 0xb
call fcn.00444780
add rsp, 0x38
pop rbp
ret
mov eax, esi
mov ecx, 0xb
call fcn.00456440
mov eax, edi
mov ecx, 0xb
call fcn.00456440
nop
call fcn.00454160
jmp fcn.00490e20

Function at 0x490f00
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x490fec
push rbp
mov rbp, rsp
sub rsp, 0x48
movabs rdx, 0x6fa96574618d5bae
mov qword [rsp + 0x32], rdx
movabs rdx, 0x7fa970906f436fa9
mov qword [rsp + 0x38], rdx
movabs rdx, 0x9ba5945172916974
mov qword [rsp + 0x40], rdx
movabs rdx, 0xa0c131414001506
mov qword [rsp + 0x1c], rdx
movabs rdx, 0x60d140d020a0a0c
mov qword [rsp + 0x22], rdx
movabs rdx, 0x110b120112001510
mov qword [rsp + 0x2a], rdx
xor eax, eax
jmp 0x490f8a
movzx r9d, byte [rsp + rsi + 0x32]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x30]
mov byte [rsp + rdi + 0x32], dl
mov byte [rsp + rsi + 0x32], r8b
add rax, 2
cmp rax, 0x16
jge 0x490fbc
movzx edx, byte [rsp + rax + 0x1c]
movzx esi, byte [rsp + rax + 0x1d]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x16
jae 0x490fdf
movzx r8d, byte [rsp + rdi + 0x32]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x30]
cmp rsi, 0x16
jb 0x490f70
jmp 0x490fd3
xor eax, eax
lea rbx, [rsp + 0x32]
mov ecx, 0x16
call fcn.00444780
add rsp, 0x48
pop rbp
ret
mov eax, esi
mov ecx, 0x16
call fcn.00456440
mov eax, edi
mov ecx, 0x16
call fcn.00456440
nop
call fcn.00454160
jmp fcn.00490f00
Function at 0x491000
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4910c7
push rbp
mov rbp, rsp
sub rsp, 0x30
movabs rdx, 0x5e9f6504afb5c496
mov qword [rsp + 0x26], rdx
mov word [rsp + 0x2e], 0x651d
movabs rdx, 0x308040102030702
mov qword [rsp + 0x18], rdx
movabs rdx, 0x30106060308
mov qword [rsp + 0x1e], rdx
xor eax, eax
jmp 0x491067
movzx r9d, byte [rsp + rsi + 0x26]
sub r9d, edx
lea edx, [r9 - 0x47]
mov byte [rsp + rdi + 0x26], dl
lea edx, [r8 - 0x47]
mov byte [rsp + rsi + 0x26], dl
add rax, 2
cmp rax, 0xe
jge 0x491097
movzx edx, byte [rsp + rax + 0x18]
movzx esi, byte [rsp + rax + 0x19]
mov edi, edx
xor edx, esi
add edx, eax
nop dword [rax]
cmp rdi, 0xa
jae 0x4910ba
movzx r8d, byte [rsp + rdi + 0x26]
sub r8d, edx
cmp rsi, 0xa
jb 0x49104a
jmp 0x4910ae
xor eax, eax
lea rbx, [rsp + 0x26]
mov ecx, 0xa
call fcn.00444780
add rsp, 0x30
pop rbp
ret
mov eax, esi
mov ecx, 0xa
call fcn.00456440
mov eax, edi
mov ecx, 0xa
call fcn.00456440
nop
call fcn.00454160
jmp fcn.00491000

Function at 0x492d80
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x492e47
push rbp
mov rbp, rsp
sub rsp, 0x38
movabs rdx, 0x546f3a9074b9781c
mov qword [rsp + 0x2d], rdx
mov dword [rsp + 0x34], 0x73bdc354
movabs rdx, 0x708050807070404
mov qword [rsp + 0x1f], rdx
movabs rdx, 0x709080200070708
mov qword [rsp + 0x25], rdx
xor eax, eax
jmp 0x492de8
movzx r9d, byte [rsp + rsi + 0x2d]
sub r9d, edx
lea edx, [r9 - 0x40]
mov byte [rsp + rdi + 0x2d], dl
lea edx, [r8 - 0x40]
mov byte [rsp + rsi + 0x2d], dl
add rax, 2
cmp rax, 0xe
jge 0x492e17
movzx edx, byte [rsp + rax + 0x1f]
movzx esi, byte [rsp + rax + 0x20]
mov edi, edx
xor edx, esi
add edx, eax
nop
cmp rdi, 0xb
jae 0x492e3a
movzx r8d, byte [rsp + rdi + 0x2d]
sub r8d, edx
cmp rsi, 0xb
jb 0x492dcb
jmp 0x492e2e
xor eax, eax
lea rbx, [rsp + 0x2d]
mov ecx, 0xb
call fcn.00444780
add rsp, 0x38
pop rbp
ret
mov eax, esi
mov ecx, 0xb
call fcn.00456440
mov eax, edi
mov ecx, 0xb
call fcn.00456440
nop
call fcn.00454160
jmp fcn.00492d80
Function at 0x493600
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4936e6
push rbp
mov rbp, rsp
sub rsp, 0x40
movabs rdx, 0x956a84686575b2bc
mov qword [rsp + 0x30], rdx
movabs rdx, 0x9872b1c166d391c3
mov qword [rsp + 0x38], rdx
movabs rdx, 0xf010a080f0c0906
mov qword [rsp + 0x1c], rdx
movabs rdx, 0x700080a0f010a08
mov qword [rsp + 0x20], rdx
movabs rdx, 0x5030d050000070f
mov qword [rsp + 0x28], rdx
xor eax, eax
nop
jmp 0x493680
movzx r9d, byte [rsp + rsi + 0x30]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x37]
mov byte [rsp + rdi + 0x30], dl
mov byte [rsp + rsi + 0x30], r8b
add rax, 2
nop dword [rax]
cmp rax, 0x14
jge 0x4936b2
movzx edx, byte [rsp + rax + 0x1c]
movzx esi, byte [rsp + rax + 0x1d]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x10
jae 0x4936d7
movzx r8d, byte [rsp + rdi + 0x30]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x37]
cmp rsi, 0x10
jb 0x493662
jmp 0x4936cb
xor eax, eax
lea rbx, [rsp + 0x30]
mov ecx, 0x10
nop
call fcn.00444780
add rsp, 0x40
pop rbp
ret
mov eax, esi
mov ecx, 0x10
call fcn.00456440
mov eax, edi
mov ecx, 0x10
nop
call fcn.00456440
nop
call fcn.00454160
jmp fcn.00493600

Function at 0x493700
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4937cc
push rbp
mov rbp, rsp
sub rsp, 0x38
movabs rdx, 0x226923146b796c46
mov qword [rsp + 0x29], rdx
movabs rdx, 0x65cbf84613c81722
mov qword [rsp + 0x30], rdx
movabs rdx, 0x203090c0d020209
mov qword [rsp + 0x19], rdx
movabs rdx, 0xa0504070c080702
mov qword [rsp + 0x21], rdx
xor eax, eax
jmp 0x49376f
movzx r9d, byte [rsp + rsi + 0x29]
sub r9d, edx
lea edx, [r9 + 0x60]
mov byte [rsp + rdi + 0x29], dl
lea edx, [r8 + 0x60]
mov byte [rsp + rsi + 0x29], dl
add rax, 2
cmp rax, 0x10
jge 0x49379c
movzx edx, byte [rsp + rax + 0x19]
movzx esi, byte [rsp + rax + 0x1a]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0xf
jae 0x4937bf
movzx r8d, byte [rsp + rdi + 0x29]
sub r8d, edx
cmp rsi, 0xf
jb 0x493752
jmp 0x4937b3
xor eax, eax
lea rbx, [rsp + 0x29]
mov ecx, 0xf
call fcn.00444780
add rsp, 0x38
pop rbp
ret
mov eax, esi
mov ecx, 0xf
call fcn.00456440
mov eax, edi
mov ecx, 0xf
call fcn.00456440
nop
call fcn.00454160
jmp fcn.00493700
Function at 0x495500
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4955ea
push rbp
mov rbp, rsp
sub rsp, 0x40
movabs rdx, 0x7272727543748e00
mov qword [rsp + 0x2f], rdx
movabs rdx, 0xbd7272727543748e
mov qword [rsp + 0x30], rdx
movabs rdx, 0x7321b50d0a18505d
mov qword [rsp + 0x38], rdx
movabs rdx, 0xd01080900010c0e
mov qword [rsp + 0x1b], rdx
movabs rdx, 0xf07080b0d010809
mov qword [rsp + 0x1f], rdx
movabs rdx, 0xe070b0801010f07
mov qword [rsp + 0x27], rdx
xor eax, eax
jmp 0x49558d
movzx r9d, byte [rsp + rsi + 0x2f]
sub r9d, edx
lea edx, [r9 - 0x44]
mov byte [rsp + rdi + 0x2f], dl
lea edx, [r8 - 0x44]
mov byte [rsp + rsi + 0x2f], dl
add rax, 2
cmp rax, 0x14
jge 0x4955ba
movzx edx, byte [rsp + rax + 0x1b]
movzx esi, byte [rsp + rax + 0x1c]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x11
jae 0x4955dd
movzx r8d, byte [rsp + rdi + 0x2f]
sub r8d, edx
cmp rsi, 0x11
jb 0x495570
jmp 0x4955d1
xor eax, eax
lea rbx, [rsp + 0x2f]
mov ecx, 0x11
call fcn.00444780
add rsp, 0x40
pop rbp
ret
mov eax, esi
mov ecx, 0x11
call fcn.00456440
mov eax, edi
mov ecx, 0x11
call fcn.00456440
nop
call fcn.00454160
jmp fcn.00495500

Function at 0x498b00
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x498bea
push rbp
mov rbp, rsp
sub rsp, 0x40
movabs rdx, 0x5c7a79524b747c63
mov qword [rsp + 0x2f], rdx
movabs rdx, 0x505c7a79524b747c
mov qword [rsp + 0x30], rdx
movabs rdx, 0x57656d647e807564
mov qword [rsp + 0x38], rdx
movabs rdx, 0x70c070a04000a07
mov qword [rsp + 0x1d], rdx
movabs rdx, 0x10a070c070a0400
mov qword [rsp + 0x1f], rdx
movabs rdx, 0x7060b0503000d09
mov qword [rsp + 0x27], rdx
xor eax, eax
jmp 0x498b8d
movzx r9d, byte [rsp + rsi + 0x2f]
sub r9d, edx
lea edx, [r9 + 0xb]
mov byte [rsp + rdi + 0x2f], dl
lea edx, [r8 + 0xb]
mov byte [rsp + rsi + 0x2f], dl
add rax, 2
cmp rax, 0x12
jge 0x498bba
movzx edx, byte [rsp + rax + 0x1d]
movzx esi, byte [rsp + rax + 0x1e]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x11
jae 0x498bdd
movzx r8d, byte [rsp + rdi + 0x2f]
sub r8d, edx
cmp rsi, 0x11
jb 0x498b70
jmp 0x498bd1
xor eax, eax
lea rbx, [rsp + 0x2f]
mov ecx, 0x11
call fcn.00444780
add rsp, 0x40
pop rbp
ret
mov eax, esi
mov ecx, 0x11
call fcn.00456440
mov eax, edi
mov ecx, 0x11
call fcn.00456440
nop
call fcn.00454160
jmp fcn.00498b00
Function at 0x4993a0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x49949b
push rbp
mov rbp, rsp
sub rsp, 0x50
movabs rdx, 0xd0f41d6953c65b3d
mov qword [rsp + 0x3a], rdx
movabs rdx, 0x66e85cdee757d0f4
mov qword [rsp + 0x40], rdx
movabs rdx, 0x4248c140b86d61e0
mov qword [rsp + 0x48], rdx
movabs rdx, 0x30f110b140e0604
mov qword [rsp + 0x1a], rdx
movabs rdx, 0x120e010011150a06
mov qword [rsp + 0x22], rdx
movabs rdx, 0x1090907130c08
mov qword [rsp + 0x2a], rdx
movabs rdx, 0x110f0c0e0203050f
mov qword [rsp + 0x32], rdx
xor eax, eax
jmp 0x499439
movzx r9d, byte [rsp + rsi + 0x3a]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x73]
mov byte [rsp + rdi + 0x3a], dl
mov byte [rsp + rsi + 0x3a], r8b
add rax, 2
cmp rax, 0x20
jge 0x49946b
movzx edx, byte [rsp + rax + 0x1a]
movzx esi, byte [rsp + rax + 0x1b]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x16
jae 0x49948e
movzx r8d, byte [rsp + rdi + 0x3a]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x73]
cmp rsi, 0x16
jb 0x49941f
jmp 0x499482
xor eax, eax
lea rbx, [rsp + 0x3a]
mov ecx, 0x16
call fcn.00444780
add rsp, 0x50
pop rbp
ret
mov eax, esi
mov ecx, 0x16
call fcn.00456440
mov eax, edi
mov ecx, 0x16
call fcn.00456440
nop
nop dword [rax + rax]
call fcn.00454160
jmp fcn.004993a0

Function at 0x499ae0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x499b9d
push rbp
mov rbp, rsp
sub rsp, 0x30
movabs rdx, 0x6530341b1b633553
mov qword [rsp + 0x27], rdx
mov byte [rsp + 0x2f], 0x5d
movabs rdx, 0x400030406050501
mov qword [rsp + 0x1b], rdx
mov dword [rsp + 0x23], 0x5030108
xor eax, eax
nop
jmp 0x499b40
movzx r9d, byte [rsp + rsi + 0x27]
sub r9d, edx
lea edx, [r9 + 0x23]
mov byte [rsp + rdi + 0x27], dl
lea edx, [r8 + 0x23]
mov byte [rsp + rsi + 0x27], dl
add rax, 2
nop
cmp rax, 0xc
jge 0x499b6d
movzx edx, byte [rsp + rax + 0x1b]
movzx esi, byte [rsp + rax + 0x1c]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 9
jae 0x499b90
movzx r8d, byte [rsp + rdi + 0x27]
sub r8d, edx
cmp rsi, 9
jb 0x499b22
jmp 0x499b84
xor eax, eax
lea rbx, [rsp + 0x27]
mov ecx, 9
call fcn.00444780
add rsp, 0x30
pop rbp
ret
mov eax, esi
mov ecx, 9
call fcn.00456440
mov eax, edi
mov ecx, 9
call fcn.00456440
nop
nop dword [rax]
call fcn.00454160
jmp fcn.00499ae0
Function at 0x499bc0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x499ca6
push rbp
mov rbp, rsp
sub rsp, 0x38
movabs rdx, 0x9377658af577b87a
mov qword [rsp + 0x2b], rdx
movabs rdx, 0xe17a69e6c9937765
mov qword [rsp + 0x30], rdx
movabs rdx, 0x7030b090701080c
mov qword [rsp + 0x19], rdx
movabs rdx, 0x70007030b090701
mov qword [rsp + 0x1b], rdx
movabs rdx, 0xc0402000c0b0408
mov qword [rsp + 0x23], rdx
xor eax, eax
nop
jmp 0x499c40
movzx r9d, byte [rsp + rsi + 0x2b]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x3a]
mov byte [rsp + rdi + 0x2b], dl
mov byte [rsp + rsi + 0x2b], r8b
add rax, 2
nop dword [rax]
cmp rax, 0x12
jge 0x499c72
movzx edx, byte [rsp + rax + 0x19]
movzx esi, byte [rsp + rax + 0x1a]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0xd
jae 0x499c97
movzx r8d, byte [rsp + rdi + 0x2b]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x3a]
cmp rsi, 0xd
jb 0x499c22
jmp 0x499c8b
xor eax, eax
lea rbx, [rsp + 0x2b]
mov ecx, 0xd
nop
call fcn.00444780
add rsp, 0x38
pop rbp
ret
mov eax, esi
mov ecx, 0xd
call fcn.00456440
mov eax, edi
mov ecx, 0xd
nop
call fcn.00456440
nop
call fcn.00454160
jmp fcn.00499bc0

Function at 0x49bfe0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x49c0cc
push rbp
mov rbp, rsp
sub rsp, 0x48
movabs rdx, 0x651702bc1ba4e3f8
mov qword [rsp + 0x34], rdx
movabs rdx, 0xd616743c651702bc
mov qword [rsp + 0x38], rdx
movabs rdx, 0x22797229ac63f472
mov qword [rsp + 0x40], rdx
movabs rdx, 0x10d0a000f08130b
mov qword [rsp + 0x1e], rdx
movabs rdx, 0x10410020a08010d
mov qword [rsp + 0x24], rdx
movabs rdx, 0xd06100305130a01
mov qword [rsp + 0x2c], rdx
xor eax, eax
jmp 0x49c06a
movzx r9d, byte [rsp + rsi + 0x34]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x2f]
mov byte [rsp + rdi + 0x34], dl
mov byte [rsp + rsi + 0x34], r8b
add rax, 2
cmp rax, 0x16
jge 0x49c09c
movzx edx, byte [rsp + rax + 0x1e]
movzx esi, byte [rsp + rax + 0x1f]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x14
jae 0x49c0bf
movzx r8d, byte [rsp + rdi + 0x34]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x2f]
cmp rsi, 0x14
jb 0x49c050
jmp 0x49c0b3
xor eax, eax
lea rbx, [rsp + 0x34]
mov ecx, 0x14
call fcn.00444780
add rsp, 0x48
pop rbp
ret
mov eax, esi
mov ecx, 0x14
call fcn.00456440
mov eax, edi
mov ecx, 0x14
call fcn.00456440
nop
call fcn.00454160
jmp fcn.0049bfe0
Function at 0x49ce80
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x49cfb8
push rbp
mov rbp, rsp
sub rsp, 0x68
movabs rdx, 0x4b526c6b37776353
mov qword [rsp + 0x46], rdx
movabs rdx, 0x4a614b526c6b3777
mov qword [rsp + 0x48], rdx
movabs rdx, 0x4e4b6f66743a6e65
mov qword [rsp + 0x50], rdx
movabs rdx, 0x5061635b7863445c
mov qword [rsp + 0x58], rdx
movabs rdx, 0x736560534d534f59
mov qword [rsp + 0x60], rdx
movabs rdx, 0x70c090610131f1b
mov qword [rsp + 0x1c], rdx
movabs rdx, 0x121c0b2008140e10
mov qword [rsp + 0x24], rdx
movabs rdx, 0xa1e121c0b200814
mov qword [rsp + 0x26], rdx
movabs rdx, 0x80b1f0212040816
mov qword [rsp + 0x2e], rdx
movabs rdx, 0xa0c030719190701
mov qword [rsp + 0x36], rdx
movabs rdx, 0x31a191f031b150e
mov qword [rsp + 0x3e], rdx
xor eax, eax
jmp 0x49cf58
movzx r9d, byte [rsp + rsi + 0x46]
sub r9d, edx
lea edx, [r9 + 0x2e]
mov byte [rsp + rdi + 0x46], dl
lea edx, [r8 + 0x2e]
mov byte [rsp + rsi + 0x46], dl
add rax, 2
cmp rax, 0x2a
jge 0x49cf88
movzx edx, byte [rsp + rax + 0x1c]
movzx esi, byte [rsp + rax + 0x1d]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x22
jae 0x49cfab
movzx r8d, byte [rsp + rdi + 0x46]
sub r8d, edx
nop dword [rax]
cmp rsi, 0x22
jb 0x49cf3b
jmp 0x49cf9f
xor eax, eax
lea rbx, [rsp + 0x46]
mov ecx, 0x22
call fcn.00444780
add rsp, 0x68
pop rbp
ret
mov eax, esi
mov ecx, 0x22
call fcn.00456440
mov eax, edi
mov ecx, 0x22
call fcn.00456440
nop
call fcn.00454160
nop dword [rax]
jmp fcn.0049ce80

Function at 0x49d260
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x49d32c
push rbp
mov rbp, rsp
sub rsp, 0x38
movabs rdx, 0xc16519690fbe6153
mov qword [rsp + 0x2d], rdx
mov dword [rsp + 0x34], 0xf92769c1
movabs rdx, 0x50505010a020309
mov qword [rsp + 0x1f], rdx
movabs rdx, 0x507090103020505
mov qword [rsp + 0x25], rdx
xor eax, eax
jmp 0x49d2c5
movzx r9d, byte [rsp + rsi + 0x2d]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x63]
mov byte [rsp + rdi + 0x2d], dl
mov byte [rsp + rsi + 0x2d], r8b
add rax, 2
cmp rax, 0xe
jge 0x49d2fc
movzx edx, byte [rsp + rax + 0x1f]
movzx esi, byte [rsp + rax + 0x20]
mov edi, edx
xor edx, esi
add edx, eax
nop dword [rax + rax]
cmp rdi, 0xb
jae 0x49d31f
movzx r8d, byte [rsp + rdi + 0x2d]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x63]
cmp rsi, 0xb
jb 0x49d2ab
jmp 0x49d313
xor eax, eax
lea rbx, [rsp + 0x2d]
mov ecx, 0xb
call fcn.00444780
add rsp, 0x38
pop rbp
ret
mov eax, esi
mov ecx, 0xb
call fcn.00456440
mov eax, edi
mov ecx, 0xb
call fcn.00456440
nop
call fcn.00454160
jmp fcn.0049d260
Function at 0x49d8c0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x49d992
push rbp
mov rbp, rsp
sub rsp, 0x38
movabs rdx, 0xa39c6b70919b909d
mov qword [rsp + 0x29], rdx
movabs rdx, 0x65d0f87ba64faea3
mov qword [rsp + 0x30], rdx
movabs rdx, 0x702060c00030d0a
mov qword [rsp + 0x19], rdx
movabs rdx, 0xb050a0108080a06
mov qword [rsp + 0x21], rdx
xor eax, eax
jmp 0x49d92c
movzx r9d, byte [rsp + rsi + 0x29]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x41]
mov byte [rsp + rdi + 0x29], dl
mov byte [rsp + rsi + 0x29], r8b
add rax, 2
cmp rax, 0x10
jge 0x49d95e
movzx edx, byte [rsp + rax + 0x19]
movzx esi, byte [rsp + rax + 0x1a]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0xf
jae 0x49d985
movzx r8d, byte [rsp + rdi + 0x29]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x41]
cmp rsi, 0xf
jb 0x49d912
jmp 0x49d975
xor eax, eax
lea rbx, [rsp + 0x29]
mov ecx, 0xf
call fcn.00444780
add rsp, 0x38
pop rbp
ret
mov eax, esi
mov ecx, 0xf
nop dword [rax]
call fcn.00456440
mov eax, edi
mov ecx, 0xf
call fcn.00456440
nop
call fcn.00454160
jmp fcn.0049d8c0

Function at 0x49e660
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x49e75d
push rbp
mov rbp, rsp
sub rsp, 0x48
movabs rdx, 0x70b8638041747647
mov qword [rsp + 0x34], rdx
movabs rdx, 0x7083459170b86380
mov qword [rsp + 0x38], rdx
movabs rdx, 0x98726cac7a6b63a0
mov qword [rsp + 0x40], rdx
movabs rdx, 0x10060b0b06061113
mov qword [rsp + 0x1a], rdx
movabs rdx, 0xa100b0611111108
mov qword [rsp + 0x22], rdx
movabs rdx, 0x10f0a100b061111
mov qword [rsp + 0x24], rdx
movabs rdx, 0x4080a08110b040c
mov qword [rsp + 0x2c], rdx
xor eax, eax
jmp 0x49e700
movzx r9d, byte [rsp + rsi + 0x34]
sub r9d, edx
lea edx, [r9 + 9]
mov byte [rsp + rdi + 0x34], dl
lea edx, [r8 + 9]
mov byte [rsp + rsi + 0x34], dl
add rax, 2
nop dword [rax]
cmp rax, 0x1a
jge 0x49e72d
movzx edx, byte [rsp + rax + 0x1a]
movzx esi, byte [rsp + rax + 0x1b]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x14
jae 0x49e750
movzx r8d, byte [rsp + rdi + 0x34]
sub r8d, edx
cmp rsi, 0x14
jb 0x49e6df
jmp 0x49e744
xor eax, eax
lea rbx, [rsp + 0x34]
mov ecx, 0x14
call fcn.00444780
add rsp, 0x48
pop rbp
ret
mov eax, esi
mov ecx, 0x14
call fcn.00456440
mov eax, edi
mov ecx, 0x14
call fcn.00456440
nop
nop dword [rax]
call fcn.00454160
jmp fcn.0049e660
Function at 0x49ea00
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x49eadd
push rbp
mov rbp, rsp
sub rsp, 0x40
movabs rdx, 0x75db0470038a8a4e
mov qword [rsp + 0x30], rdx
movabs rdx, 0x65ff234697369a33
mov qword [rsp + 0x38], rdx
movabs rdx, 0x2050a020e020901
mov qword [rsp + 0x18], rdx
movabs rdx, 0xd010d0b0e08080d
mov qword [rsp + 0x20], rdx
movabs rdx, 0x6060b050a030e09
mov qword [rsp + 0x28], rdx
xor eax, eax
nop
jmp 0x49ea80
movzx r9d, byte [rsp + rsi + 0x30]
sub r9d, edx
lea edx, [r9 + 0x7d]
mov byte [rsp + rdi + 0x30], dl
lea edx, [r8 + 0x7d]
mov byte [rsp + rsi + 0x30], dl
add rax, 2
nop
cmp rax, 0x18
jge 0x49eaad
movzx edx, byte [rsp + rax + 0x18]
movzx esi, byte [rsp + rax + 0x19]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x10
jae 0x49ead0
movzx r8d, byte [rsp + rdi + 0x30]
sub r8d, edx
cmp rsi, 0x10
jb 0x49ea62
jmp 0x49eac4
xor eax, eax
lea rbx, [rsp + 0x30]
mov ecx, 0x10
call fcn.00444780
add rsp, 0x40
pop rbp
ret
mov eax, esi
mov ecx, 0x10
call fcn.00456440
mov eax, edi
mov ecx, 0x10
call fcn.00456440
nop
nop dword [rax]
call fcn.00454160
jmp fcn.0049ea00

Function at 0x4a1680
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4a174c
push rbp
mov rbp, rsp
sub rsp, 0x38
movabs rdx, 0x62d48b3b73cbbcbb
mov qword [rsp + 0x2b], rdx
movabs rdx, 0x3b6d1420c362d48b
mov qword [rsp + 0x30], rdx
movabs rdx, 0x405010002090a00
mov qword [rsp + 0x1b], rdx
movabs rdx, 0x8050602080c0402
mov qword [rsp + 0x23], rdx
xor eax, eax
jmp 0x4a16ef
movzx r9d, byte [rsp + rsi + 0x2b]
sub r9d, edx
lea edx, [r9 - 0x50]
mov byte [rsp + rdi + 0x2b], dl
lea edx, [r8 - 0x50]
mov byte [rsp + rsi + 0x2b], dl
add rax, 2
cmp rax, 0x10
jge 0x4a171c
movzx edx, byte [rsp + rax + 0x1b]
movzx esi, byte [rsp + rax + 0x1c]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0xd
jae 0x4a173f
movzx r8d, byte [rsp + rdi + 0x2b]
sub r8d, edx
cmp rsi, 0xd
jb 0x4a16d2
jmp 0x4a1733
xor eax, eax
lea rbx, [rsp + 0x2b]
mov ecx, 0xd
call fcn.00444780
add rsp, 0x38
pop rbp
ret
mov eax, esi
mov ecx, 0xd
call fcn.00456440
mov eax, edi
mov ecx, 0xd
call fcn.00456440
nop
call fcn.00454160
jmp fcn.004a1680
Function at 0x4a1840
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4a190c
push rbp
mov rbp, rsp
sub rsp, 0x30
movabs rdx, 0xf9363332732cf2f5
mov qword [rsp + 0x26], rdx
mov word [rsp + 0x2e], 0x74e9
movabs rdx, 0x7010107010505
mov qword [rsp + 0x18], rdx
movabs rdx, 0x204020806070007
mov qword [rsp + 0x1e], rdx
xor eax, eax
jmp 0x4a18a4
movzx r9d, byte [rsp + rsi + 0x26]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x30]
mov byte [rsp + rdi + 0x26], dl
mov byte [rsp + rsi + 0x26], r8b
add rax, 2
cmp rax, 0xe
jge 0x4a18dc
movzx edx, byte [rsp + rax + 0x18]
movzx esi, byte [rsp + rax + 0x19]
mov edi, edx
xor edx, esi
add edx, eax
nop word [rax + rax]
cmp rdi, 0xa
jae 0x4a18ff
movzx r8d, byte [rsp + rdi + 0x26]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x30]
cmp rsi, 0xa
jb 0x4a188a
jmp 0x4a18f3
xor eax, eax
lea rbx, [rsp + 0x26]
mov ecx, 0xa
call fcn.00444780
add rsp, 0x30
pop rbp
ret
mov eax, esi
mov ecx, 0xa
call fcn.00456440
mov eax, edi
mov ecx, 0xa
call fcn.00456440
nop
call fcn.00454160
jmp fcn.004a1840

Function at 0x4a1cc0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4a1d72
push rbp
mov rbp, rsp
sub rsp, 0x28
movabs rdx, 0x6e0904bdb77568fc
mov qword [rsp + 0x20], rdx
movabs rdx, 0x304030004060503
mov qword [rsp + 0x18], rdx
xor eax, eax
jmp 0x4a1d11
movzx r9d, byte [rsp + rsi + 0x20]
sub r9d, edx
lea edx, [r9 - 0x42]
mov byte [rsp + rdi + 0x20], dl
lea edx, [r8 - 0x42]
mov byte [rsp + rsi + 0x20], dl
add rax, 2
cmp rax, 8
jge 0x4a1d3e
movzx edx, byte [rsp + rax + 0x18]
movzx esi, byte [rsp + rax + 0x19]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 8
jae 0x4a1d65
movzx r8d, byte [rsp + rdi + 0x20]
sub r8d, edx
cmp rsi, 8
jb 0x4a1cf4
jmp 0x4a1d55
xor eax, eax
lea rbx, [rsp + 0x20]
mov ecx, 8
call fcn.00444780
add rsp, 0x28
pop rbp
ret
mov eax, esi
mov ecx, 8
nop dword [rax]
call fcn.00456440
mov eax, edi
mov ecx, 8
call fcn.00456440
nop
call fcn.00454160
jmp fcn.004a1cc0

Function at 0x4a2840
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4a290a
push rbp
mov rbp, rsp
sub rsp, 0x48
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rbx
mov qword [rsp], rax
mov qword [rsp + 8], rbx
mov byte [rsp + 0x10], 0
call fcn.00403260
xorps xmm15, xmm15
mov r14, qword [0x007ed7d8]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x18], 0xffffffffffffffff
jne 0x4a28ef
mov rcx, qword [rsp + 0x60]
lea rdx, [rcx + 1]
mov qword [rsp + 0x40], rdx
lea rax, [0x005425c0]
xor ebx, ebx
mov rcx, rdx
call fcn.004412a0
mov rbx, qword [rsp + 0x60]
mov rcx, rax
xor edi, edi
mov rsi, qword [rsp + 0x40]
mov rax, qword [rsp + 0x58]
nop dword [rax]
call fcn.004a2ea0
inc rbx
cmp rcx, rbx
jae 0x4a28de
mov edi, 1
lea rsi, [0x005425c0]
call fcn.00441380
mov word [rax + rbx*2 - 2], 0
xor edi, edi
xor esi, esi
add rsp, 0x48
pop rbp
ret
xor eax, eax
xor ebx, ebx
mov rcx, rbx
lea rdi, [0x00587768]
lea rsi, [0x005873f0]
add rsp, 0x48
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.00454160
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.004a2840