joyce8/EMBER2024-capa huggingface dataset:
Function at 0x48b820
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x48b8dd
push rbp
mov rbp, rsp
sub rsp, 0x30
movabs rdx, 0x393e4d2a126e194f
mov qword [rsp + 0x1b], rdx
mov byte [rsp + 0x23], 0x5f
movabs rdx, 0x803070804060001
mov qword [rsp + 0x24], rdx
mov dword [rsp + 0x2c], 0x5060600
xor eax, eax
nop
jmp 0x48b880
movzx r9d, byte [rsp + rsi + 0x1b]
sub r9d, edx
lea edx, [r9 + 0x27]
mov byte [rsp + rdi + 0x1b], dl
lea edx, [r8 + 0x27]
mov byte [rsp + rsi + 0x1b], dl
add rax, 2
nop
cmp rax, 0xc
jge 0x48b8ad
movzx edx, byte [rsp + rax + 0x24]
movzx esi, byte [rsp + rax + 0x25]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 9
jae 0x48b8d0
movzx r8d, byte [rsp + rdi + 0x1b]
sub r8d, edx
cmp rsi, 9
jb 0x48b862
jmp 0x48b8c4
xor eax, eax
lea rbx, [rsp + 0x1b]
mov ecx, 9
call fcn.00441380
add rsp, 0x30
pop rbp
ret
mov eax, esi
mov ecx, 9
call fcn.00451880
mov eax, edi
mov ecx, 9
call fcn.00451880
nop
nop dword [rax]
call fcn.0044f600
jmp fcn.0048b820

Function at 0x48b900
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x48ba27
push rbp
mov rbp, rsp
sub rsp, 0x60
movabs rdx, 0x3a1d63c26c6665f0
mov qword [rsp + 0x18], rdx
movabs rdx, 0x33cb2ea6df6c45aa
mov qword [rsp + 0x20], rdx
movabs rdx, 0xc389acccfac733cb
mov qword [rsp + 0x26], rdx
movabs rdx, 0x7773c2d674208608
mov qword [rsp + 0x2e], rdx
movabs rdx, 0x110014000c1c1a06
mov qword [rsp + 0x36], rdx
movabs rdx, 0x1b1411141613100c
mov qword [rsp + 0x3e], rdx
movabs rdx, 0x141b1411141613
mov qword [rsp + 0x40], rdx
movabs rdx, 0x81713001d16120e
mov qword [rsp + 0x48], rdx
movabs rdx, 0x1a040d161704130f
mov qword [rsp + 0x50], rdx
movabs rdx, 0x151610060c0d0b13
mov qword [rsp + 0x58], rdx
xor eax, eax
jmp 0x48b9c9
movzx r9d, byte [rsp + rsi + 0x18]
sub r9d, edx
lea edx, [r9 - 0x2f]
mov byte [rsp + rdi + 0x18], dl
lea edx, [r8 - 0x2f]
mov byte [rsp + rsi + 0x18], dl
add rax, 2
cmp rax, 0x2a
jge 0x48b9f7
movzx edx, byte [rsp + rax + 0x36]
movzx esi, byte [rsp + rax + 0x37]
mov edi, edx
xor edx, esi
add edx, eax
nop
cmp rdi, 0x1e
jae 0x48ba1a
movzx r8d, byte [rsp + rdi + 0x18]
sub r8d, edx
cmp rsi, 0x1e
jb 0x48b9ac
jmp 0x48ba0e
xor eax, eax
lea rbx, [rsp + 0x18]
mov ecx, 0x1e
call fcn.00441380
add rsp, 0x60
pop rbp
ret
mov eax, esi
mov ecx, 0x1e
call fcn.00451880
mov eax, edi
mov ecx, 0x1e
call fcn.00451880
nop
call fcn.0044f600
jmp fcn.0048b900
Function at 0x48ba40
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x48bb78
push rbp
mov rbp, rsp
sub rsp, 0x68
movabs rdx, 0x4be463286cd72872
mov qword [rsp + 0x18], rdx
movabs rdx, 0xcf494be463286cd7
mov qword [rsp + 0x1a], rdx
movabs rdx, 0x546e152edb6c6511
mov qword [rsp + 0x22], rdx
movabs rdx, 0xd35c615e6fd7f623
mov qword [rsp + 0x2a], rdx
movabs rdx, 0xdf646e4b169fe666
mov qword [rsp + 0x32], rdx
movabs rdx, 0xd121217130d0d18
mov qword [rsp + 0x3a], rdx
movabs rdx, 0x1621060e0d1b1c02
mov qword [rsp + 0x42], rdx
movabs rdx, 0x19091b1c08161621
mov qword [rsp + 0x48], rdx
movabs rdx, 0x71d0e0f01041413
mov qword [rsp + 0x50], rdx
movabs rdx, 0xd1e0a021e130a14
mov qword [rsp + 0x58], rdx
movabs rdx, 0xa1b111e0e191409
mov qword [rsp + 0x60], rdx
xor eax, eax
jmp 0x48bb18
movzx r9d, byte [rsp + rsi + 0x18]
sub r9d, edx
lea edx, [r9 + 0x5a]
mov byte [rsp + rdi + 0x18], dl
lea edx, [r8 + 0x5a]
mov byte [rsp + rsi + 0x18], dl
add rax, 2
cmp rax, 0x2e
jge 0x48bb48
movzx edx, byte [rsp + rax + 0x3a]
movzx esi, byte [rsp + rax + 0x3b]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x22
jae 0x48bb6b
movzx r8d, byte [rsp + rdi + 0x18]
sub r8d, edx
nop dword [rax]
cmp rsi, 0x22
jb 0x48bafb
jmp 0x48bb5f
xor eax, eax
lea rbx, [rsp + 0x18]
mov ecx, 0x22
call fcn.00441380
add rsp, 0x68
pop rbp
ret
mov eax, esi
mov ecx, 0x22
call fcn.00451880
mov eax, edi
mov ecx, 0x22
call fcn.00451880
nop
call fcn.0044f600
nop dword [rax]
jmp fcn.0048ba40
Function at 0x48c860
Capabilities:
Encrypt data using rc4 prga

Disassembly:
lea r12, [rsp - 0x18]
cmp r12, qword [r14 + 0x10]
jbe 0x48c9e7
push rbp
mov rbp, rsp
sub rsp, 0x90
movabs rdx, 0x2eeb63d55066addd
mov qword [rsp + 0x1b], rdx
movabs rdx, 0xdf1b6c611e2eeb63
mov qword [rsp + 0x20], rdx
movabs rdx, 0x2ea6e8c3901c5342
mov qword [rsp + 0x28], rdx
movabs rdx, 0x2eb28dd3d8bd4ff8
mov qword [rsp + 0x30], rdx
movabs rdx, 0x3b6eb3264963b56c
mov qword [rsp + 0x38], rdx
movabs rdx, 0x4d2074756f247801
mov qword [rsp + 0x40], rdx
movabs rdx, 0x73ad23ca6f626eb0
mov qword [rsp + 0x48], rdx
movabs rdx, 0x1033180413042e18
mov qword [rsp + 0x50], rdx
movabs rdx, 0x222d173108251015
mov qword [rsp + 0x58], rdx
movabs rdx, 0x1e24161e0c27170f
mov qword [rsp + 0x60], rdx
movabs rdx, 0x1c1b122d221916
mov qword [rsp + 0x68], rdx
movabs rdx, 0x140606113204041a
mov qword [rsp + 0x70], rdx
movabs rdx, 0x21331c1c010b1b32
mov qword [rsp + 0x78], rdx
movabs rdx, 0x140b16081a31032c
mov qword [rsp + 0x80], rdx
movabs rdx, 0x420120d1a112421
mov qword [rsp + 0x88], rdx
xor eax, eax
jmp 0x48c982
movzx r9d, byte [rsp + rsi + 0x1b]
sub r9d, edx
lea edx, [r9 + 0x7e]
mov byte [rsp + rdi + 0x1b], dl
lea edx, [r8 + 0x7e]
mov byte [rsp + rsi + 0x1b], dl
add rax, 2
cmp rax, 0x40
jge 0x48c9af
movzx edx, byte [rsp + rax + 0x50]
movzx esi, byte [rsp + rax + 0x51]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x35
jae 0x48c9da
movzx r8d, byte [rsp + rdi + 0x1b]
sub r8d, edx
cmp rsi, 0x35
jb 0x48c965
jmp 0x48c9ce
xor eax, eax
lea rbx, [rsp + 0x1b]
mov ecx, 0x35
nop dword [rax + rax]
call fcn.00441380
add rsp, 0x90
pop rbp
ret
mov eax, esi
mov ecx, 0x35
call fcn.00451880
mov eax, edi
mov ecx, 0x35
call fcn.00451880
nop
call fcn.0044f600
jmp fcn.0048c860
Function at 0x48eee0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x48effa
push rbp
mov rbp, rsp
sub rsp, 0x58
movabs rdx, 0x2e72ed8e49558fe2
mov qword [rsp + 0x18], rdx
movabs rdx, 0x70f9f1ddd2e70162
mov qword [rsp + 0x20], rdx
movabs rdx, 0xfa656ccbe30770f9
mov qword [rsp + 0x26], rdx
movabs rdx, 0x74f9654e20ef69ed
mov qword [rsp + 0x2e], rdx
movabs rdx, 0x12080901091c0a15
mov qword [rsp + 0x36], rdx
movabs rdx, 0x131812080901091c
mov qword [rsp + 0x38], rdx
movabs rdx, 0x111601110d050209
mov qword [rsp + 0x40], rdx
movabs rdx, 0xc16170e17170f0e
mov qword [rsp + 0x48], rdx
movabs rdx, 0x180b181012040900
mov qword [rsp + 0x50], rdx
xor eax, eax
jmp 0x48ef97
movzx r9d, byte [rsp + rsi + 0x18]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x60]
mov byte [rsp + rdi + 0x18], dl
mov byte [rsp + rsi + 0x18], r8b
add rax, 2
cmp rax, 0x22
jge 0x48efc9
movzx edx, byte [rsp + rax + 0x36]
movzx esi, byte [rsp + rax + 0x37]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x1e
jae 0x48efed
movzx r8d, byte [rsp + rdi + 0x18]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x60]
cmp rsi, 0x1e
jb 0x48ef7d
jmp 0x48efe1
xor eax, eax
lea rbx, [rsp + 0x18]
mov ecx, 0x1e
call fcn.00441380
add rsp, 0x58
pop rbp
nop
ret
mov eax, esi
mov ecx, 0x1e
call fcn.00451880
mov eax, edi
mov ecx, 0x1e
call fcn.00451880
nop
call fcn.0044f600
nop
jmp fcn.0048eee0
Function at 0x493d20
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x493dec
push rbp
mov rbp, rsp
sub rsp, 0x30
movabs rdx, 0x432f0f4cdcd14462
mov qword [rsp + 0x19], rdx
movabs rdx, 0x657a69432f0f4cdc
mov qword [rsp + 0x1c], rdx
movabs rdx, 0x607010303010201
mov qword [rsp + 0x24], rdx
mov dword [rsp + 0x2c], 0x1040405
xor eax, eax
jmp 0x493d85
movzx r9d, byte [rsp + rsi + 0x19]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x1d]
mov byte [rsp + rdi + 0x19], dl
mov byte [rsp + rsi + 0x19], r8b
add rax, 2
cmp rax, 0xc
jge 0x493dbc
movzx edx, byte [rsp + rax + 0x24]
movzx esi, byte [rsp + rax + 0x25]
mov edi, edx
xor edx, esi
add edx, eax
nop dword [rax + rax]
cmp rdi, 0xb
jae 0x493ddf
movzx r8d, byte [rsp + rdi + 0x19]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x1d]
cmp rsi, 0xb
jb 0x493d6b
jmp 0x493dd3
xor eax, eax
lea rbx, [rsp + 0x19]
mov ecx, 0xb
call fcn.00441380
add rsp, 0x30
pop rbp
ret
mov eax, esi
mov ecx, 0xb
call fcn.00451880
mov eax, edi
mov ecx, 0xb
call fcn.00451880
nop
call fcn.0044f600
jmp fcn.00493d20

Function at 0x497020
Capabilities:
Encrypt data using rc4 prga

Disassembly:
lea r12, [rsp - 0x10]
cmp r12, qword [r14 + 0x10]
jbe 0x497192
push rbp
mov rbp, rsp
sub rsp, 0x88
movabs rdx, 0xd8d27000d66c3d6d
mov qword [rsp + 0x1f], rdx
movabs rdx, 0xe0b0d9cee8234120
mov qword [rsp + 0x27], rdx
movabs rdx, 0xe5416ce0b0d9cee8
mov qword [rsp + 0x2a], rdx
movabs rdx, 0xc0c77275c13fc220
mov qword [rsp + 0x32], rdx
movabs rdx, 0xcbd1d90a64016f6e
mov qword [rsp + 0x3a], rdx
movabs rdx, 0xa15172bc785c662f
mov qword [rsp + 0x42], rdx
movabs rdx, 0x2a0712231a231f29
mov qword [rsp + 0x4a], rdx
movabs rdx, 0x1a240e2707290e01
mov qword [rsp + 0x52], rdx
movabs rdx, 0x403232720121a24
mov qword [rsp + 0x58], rdx
movabs rdx, 0x210c220a07251124
mov qword [rsp + 0x60], rdx
movabs rdx, 0x201a0f241916140b
mov qword [rsp + 0x68], rdx
movabs rdx, 0x1f2a0d1415091129
mov qword [rsp + 0x70], rdx
movabs rdx, 0x7031d2422261f27
mov qword [rsp + 0x78], rdx
movabs rdx, 0x91f041d25031506
mov qword [rsp + 0x80], rdx
xor eax, eax
jmp 0x497130
movzx r9d, byte [rsp + rsi + 0x1f]
sub r9d, edx
lea edx, [r9 - 0x24]
mov byte [rsp + rdi + 0x1f], dl
lea edx, [r8 - 0x24]
mov byte [rsp + rsi + 0x1f], dl
add rax, 2
cmp rax, 0x3e
jge 0x49715d
movzx edx, byte [rsp + rax + 0x4a]
movzx esi, byte [rsp + rax + 0x4b]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x2b
jae 0x497185
movzx r8d, byte [rsp + rdi + 0x1f]
sub r8d, edx
cmp rsi, 0x2b
jb 0x497113
jmp 0x497177
xor eax, eax
lea rbx, [rsp + 0x1f]
mov ecx, 0x2b
call fcn.00441380
add rsp, 0x88
pop rbp
ret
mov eax, esi
mov ecx, 0x2b
nop
call fcn.00451880
mov eax, edi
mov ecx, 0x2b
call fcn.00451880
nop
call fcn.0044f600
jmp fcn.00497020
Function at 0x499a60
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x499b2a
push rbp
mov rbp, rsp
sub rsp, 0x48
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x58], rax
mov qword [rsp], rax
mov qword [rsp + 8], rbx
mov byte [rsp + 0x10], 0
call fcn.00403080
xorps xmm15, xmm15
mov r14, qword [0x00783990]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x18], 0xffffffffffffffff
jne 0x499b0f
mov rcx, qword [rsp + 0x60]
lea rdx, [rcx + 1]
mov qword [rsp + 0x40], rdx
lea rax, [0x0051e780]
xor ebx, ebx
mov rcx, rdx
call fcn.0043dec0
mov rbx, qword [rsp + 0x60]
mov rcx, rax
xor edi, edi
mov rsi, qword [rsp + 0x40]
mov rax, qword [rsp + 0x58]
nop dword [rax]
call fcn.0049af80
inc rbx
cmp rcx, rbx
jae 0x499afe
mov edi, 1
lea rsi, [0x0051e780]
call fcn.0043dfa0
mov word [rax + rbx*2 - 2], 0
xor edi, edi
xor esi, esi
add rsp, 0x48
pop rbp
ret
xor eax, eax
xor ebx, ebx
mov rcx, rbx
lea rdi, [0x0069e9e8]
lea rsi, [0x0069e648]
add rsp, 0x48
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.0044f600
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.00499a60

Function at 0x49a460
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x49a55d
push rbp
mov rbp, rsp
sub rsp, 0x50
movabs rdx, 0xf35df730e65f7220
mov qword [rsp + 0x1d], rdx
movabs rdx, 0x6f4f6b7841f35df7
mov qword [rsp + 0x22], rdx
movabs rdx, 0xccd672ffd9373869
mov qword [rsp + 0x2a], rdx
movabs rdx, 0x1008041306140805
mov qword [rsp + 0x32], rdx
movabs rdx, 0x2140e0f050b1300
mov qword [rsp + 0x3a], rdx
movabs rdx, 0x51305000f030214
mov qword [rsp + 0x40], rdx
movabs rdx, 0xe1107141402090e
mov qword [rsp + 0x48], rdx
xor eax, eax
jmp 0x49a500
movzx r9d, byte [rsp + rsi + 0x1d]
sub r9d, edx
lea edx, [r9 - 0x56]
mov byte [rsp + rdi + 0x1d], dl
lea edx, [r8 - 0x56]
mov byte [rsp + rsi + 0x1d], dl
add rax, 2
nop dword [rax]
cmp rax, 0x1e
jge 0x49a52d
movzx edx, byte [rsp + rax + 0x32]
movzx esi, byte [rsp + rax + 0x33]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x15
jae 0x49a550
movzx r8d, byte [rsp + rdi + 0x1d]
sub r8d, edx
cmp rsi, 0x15
jb 0x49a4df
jmp 0x49a544
xor eax, eax
lea rbx, [rsp + 0x1d]
mov ecx, 0x15
call fcn.00441380
add rsp, 0x50
pop rbp
ret
mov eax, esi
mov ecx, 0x15
call fcn.00451880
mov eax, edi
mov ecx, 0x15
call fcn.00451880
nop
nop dword [rax]
call fcn.0044f600
jmp fcn.0049a460
Function at 0x49a580
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x49a646
push rbp
mov rbp, rsp
sub rsp, 0x30
movabs rdx, 0x6f72cc7120731423
mov qword [rsp + 0x1d], rdx
mov byte [rsp + 0x25], 0x72
movabs rdx, 0x504010504000404
mov qword [rsp + 0x26], rdx
mov word [rsp + 0x2e], 0
xor eax, eax
nop
jmp 0x49a5e0
movzx r9d, byte [rsp + rsi + 0x1d]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x5f]
mov byte [rsp + rdi + 0x1d], dl
mov byte [rsp + rsi + 0x1d], r8b
add rax, 2
nop dword [rax]
cmp rax, 0xa
jge 0x49a612
movzx edx, byte [rsp + rax + 0x26]
movzx esi, byte [rsp + rax + 0x27]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 9
jae 0x49a637
movzx r8d, byte [rsp + rdi + 0x1d]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x5f]
cmp rsi, 9
jb 0x49a5c2
jmp 0x49a62b
xor eax, eax
lea rbx, [rsp + 0x1d]
mov ecx, 9
nop
call fcn.00441380
add rsp, 0x30
pop rbp
ret
mov eax, esi
mov ecx, 9
call fcn.00451880
mov eax, edi
mov ecx, 9
nop
call fcn.00451880
nop
call fcn.0044f600
jmp fcn.0049a580

Function at 0x49a900
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x49a9ec
push rbp
mov rbp, rsp
sub rsp, 0x48
movabs rdx, 0x4ebf11be6d67c673
mov qword [rsp + 0x1e], rdx
movabs rdx, 0x10ba4ebf11be6d67
mov qword [rsp + 0x20], rdx
movabs rdx, 0x131418c666ca0d19
mov qword [rsp + 0x28], rdx
movabs rdx, 0xb0f090107110610
mov qword [rsp + 0x30], rdx
movabs rdx, 0x6080e0b04110a0c
mov qword [rsp + 0x38], rdx
movabs rdx, 0x401070f0c06050c
mov qword [rsp + 0x40], rdx
xor eax, eax
jmp 0x49a98a
movzx r9d, byte [rsp + rsi + 0x1e]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x69]
mov byte [rsp + rdi + 0x1e], dl
mov byte [rsp + rsi + 0x1e], r8b
add rax, 2
cmp rax, 0x18
jge 0x49a9bc
movzx edx, byte [rsp + rax + 0x30]
movzx esi, byte [rsp + rax + 0x31]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x12
jae 0x49a9df
movzx r8d, byte [rsp + rdi + 0x1e]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x69]
cmp rsi, 0x12
jb 0x49a970
jmp 0x49a9d3
xor eax, eax
lea rbx, [rsp + 0x1e]
mov ecx, 0x12
call fcn.00441380
add rsp, 0x48
pop rbp
ret
mov eax, esi
mov ecx, 0x12
call fcn.00451880
mov eax, edi
mov ecx, 0x12
call fcn.00451880
nop
call fcn.0044f600
jmp fcn.0049a900
Function at 0x49ae60
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x49af5d
push rbp
mov rbp, rsp
sub rsp, 0x48
movabs rdx, 0x4565644855315c4d
mov qword [rsp + 0x18], rdx
movabs rdx, 0x4c315957557a4565
mov qword [rsp + 0x1e], rdx
movabs rdx, 0x66952334c4694c54
mov qword [rsp + 0x26], rdx
movabs rdx, 0x11090d0005071108
mov qword [rsp + 0x2e], rdx
movabs rdx, 0xf0807041407030e
mov qword [rsp + 0x36], rdx
movabs rdx, 0xf150f0807041407
mov qword [rsp + 0x38], rdx
movabs rdx, 0xb01100613150a04
mov qword [rsp + 0x40], rdx
xor eax, eax
jmp 0x49af00
movzx r9d, byte [rsp + rsi + 0x18]
sub r9d, edx
lea edx, [r9 - 9]
mov byte [rsp + rdi + 0x18], dl
lea edx, [r8 - 9]
mov byte [rsp + rsi + 0x18], dl
add rax, 2
nop dword [rax]
cmp rax, 0x1a
jge 0x49af2d
movzx edx, byte [rsp + rax + 0x2e]
movzx esi, byte [rsp + rax + 0x2f]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x16
jae 0x49af50
movzx r8d, byte [rsp + rdi + 0x18]
sub r8d, edx
cmp rsi, 0x16
jb 0x49aedf
jmp 0x49af44
xor eax, eax
lea rbx, [rsp + 0x18]
mov ecx, 0x16
call fcn.00441380
add rsp, 0x48
pop rbp
ret
mov eax, esi
mov ecx, 0x16
call fcn.00451880
mov eax, edi
mov ecx, 0x16
call fcn.00451880
nop
nop dword [rax]
call fcn.0044f600
jmp fcn.0049ae60

Function at 0x49b7c0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x49b8aa
push rbp
mov rbp, rsp
sub rsp, 0x40
movabs rdx, 0x69604b6297e9ec4d
mov qword [rsp + 0x1b], rdx
movabs rdx, 0x6f69604b6297e9ec
mov qword [rsp + 0x1c], rdx
movabs rdx, 0x64e73fe7d5dae4d8
mov qword [rsp + 0x24], rdx
movabs rdx, 0xb090e090005040c
mov qword [rsp + 0x2c], rdx
movabs rdx, 0xa03050d0b090e09
mov qword [rsp + 0x30], rdx
movabs rdx, 0xc02010f06010000
mov qword [rsp + 0x38], rdx
xor eax, eax
jmp 0x49b84d
movzx r9d, byte [rsp + rsi + 0x1b]
sub r9d, edx
lea edx, [r9 - 0x64]
mov byte [rsp + rdi + 0x1b], dl
lea edx, [r8 - 0x64]
mov byte [rsp + rsi + 0x1b], dl
add rax, 2
cmp rax, 0x14
jge 0x49b87a
movzx edx, byte [rsp + rax + 0x2c]
movzx esi, byte [rsp + rax + 0x2d]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x11
jae 0x49b89d
movzx r8d, byte [rsp + rdi + 0x1b]
sub r8d, edx
cmp rsi, 0x11
jb 0x49b830
jmp 0x49b891
xor eax, eax
lea rbx, [rsp + 0x1b]
mov ecx, 0x11
call fcn.00441380
add rsp, 0x40
pop rbp
ret
mov eax, esi
mov ecx, 0x11
call fcn.00451880
mov eax, edi
mov ecx, 0x11
call fcn.00451880
nop
call fcn.0044f600
jmp fcn.0049b7c0
Function at 0x49c8c0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x49c987
push rbp
mov rbp, rsp
sub rsp, 0x30
movabs rdx, 0x7373d047246413d4
mov qword [rsp + 0x19], rdx
movabs rdx, 0x18d7617373d04724
mov qword [rsp + 0x1c], rdx
movabs rdx, 0x904000a01050904
mov qword [rsp + 0x24], rdx
mov dword [rsp + 0x2c], 0x10a0304
xor eax, eax
jmp 0x49c928
movzx r9d, byte [rsp + rsi + 0x19]
sub r9d, edx
lea edx, [r9 + 0x58]
mov byte [rsp + rdi + 0x19], dl
lea edx, [r8 + 0x58]
mov byte [rsp + rsi + 0x19], dl
add rax, 2
cmp rax, 0xc
jge 0x49c957
movzx edx, byte [rsp + rax + 0x24]
movzx esi, byte [rsp + rax + 0x25]
mov edi, edx
xor edx, esi
add edx, eax
nop
cmp rdi, 0xb
jae 0x49c97a
movzx r8d, byte [rsp + rdi + 0x19]
sub r8d, edx
cmp rsi, 0xb
jb 0x49c90b
jmp 0x49c96e
xor eax, eax
lea rbx, [rsp + 0x19]
mov ecx, 0xb
call fcn.00441380
add rsp, 0x30
pop rbp
ret
mov eax, esi
mov ecx, 0xb
call fcn.00451880
mov eax, edi
mov ecx, 0xb
call fcn.00451880
nop
call fcn.0044f600
jmp fcn.0049c8c0

Function at 0x49d1e0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x49d2ca
push rbp
mov rbp, rsp
sub rsp, 0x48
movabs rdx, 0x6f7977656d935f77
mov qword [rsp + 0x1e], rdx
movabs rdx, 0x681e6f7977656d93
mov qword [rsp + 0x20], rdx
movabs rdx, 0x8465a28d7f6e7275
mov qword [rsp + 0x28], rdx
movabs rdx, 0x4011102040b
mov qword [rsp + 0x30], rdx
movabs rdx, 0x5000e110f110809
mov qword [rsp + 0x38], rdx
movabs rdx, 0xd0611110203080a
mov qword [rsp + 0x40], rdx
xor eax, eax
jmp 0x49d26d
movzx r9d, byte [rsp + rsi + 0x1e]
sub r9d, edx
lea edx, [r9 + 0xb]
mov byte [rsp + rdi + 0x1e], dl
lea edx, [r8 + 0xb]
mov byte [rsp + rsi + 0x1e], dl
add rax, 2
cmp rax, 0x18
jge 0x49d29a
movzx edx, byte [rsp + rax + 0x30]
movzx esi, byte [rsp + rax + 0x31]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x12
jae 0x49d2bd
movzx r8d, byte [rsp + rdi + 0x1e]
sub r8d, edx
cmp rsi, 0x12
jb 0x49d250
jmp 0x49d2b1
xor eax, eax
lea rbx, [rsp + 0x1e]
mov ecx, 0x12
call fcn.00441380
add rsp, 0x48
pop rbp
ret
mov eax, esi
mov ecx, 0x12
call fcn.00451880
mov eax, edi
mov ecx, 0x12
call fcn.00451880
nop
call fcn.0044f600
jmp fcn.0049d1e0
Function at 0x49d940
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x49da2a
push rbp
mov rbp, rsp
sub rsp, 0x48
movabs rdx, 0x716d7c6c58785268
mov qword [rsp + 0x1e], rdx
movabs rdx, 0x6e6f716d7c6c5878
mov qword [rsp + 0x20], rdx
movabs rdx, 0x84656a2099537274
mov qword [rsp + 0x28], rdx
movabs rdx, 0xe0f0003040c0001
mov qword [rsp + 0x30], rdx
movabs rdx, 0x6070a010f020404
mov qword [rsp + 0x38], rdx
movabs rdx, 0x11050d110c070a02
mov qword [rsp + 0x40], rdx
xor eax, eax
jmp 0x49d9cd
movzx r9d, byte [rsp + rsi + 0x1e]
sub r9d, edx
lea edx, [r9 + 0x12]
mov byte [rsp + rdi + 0x1e], dl
lea edx, [r8 + 0x12]
mov byte [rsp + rsi + 0x1e], dl
add rax, 2
cmp rax, 0x18
jge 0x49d9fa
movzx edx, byte [rsp + rax + 0x30]
movzx esi, byte [rsp + rax + 0x31]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x12
jae 0x49da1d
movzx r8d, byte [rsp + rdi + 0x1e]
sub r8d, edx
cmp rsi, 0x12
jb 0x49d9b0
jmp 0x49da11
xor eax, eax
lea rbx, [rsp + 0x1e]
mov ecx, 0x12
call fcn.00441380
add rsp, 0x48
pop rbp
ret
mov eax, esi
mov ecx, 0x12
call fcn.00451880
mov eax, edi
mov ecx, 0x12
call fcn.00451880
nop
call fcn.0044f600
jmp fcn.0049d940

Function at 0x49f280
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x49f358
push rbp
mov rbp, rsp
sub rsp, 0x38
movabs rdx, 0xb17337077b736f2f
mov qword [rsp + 0x1a], rdx
mov dword [rsp + 0x22], 0x329a9b1
movabs rdx, 0x9000a0b03000b07
mov qword [rsp + 0x26], rdx
movabs rdx, 0x90809000a0b0300
mov qword [rsp + 0x28], rdx
movabs rdx, 0x50809070a000004
mov qword [rsp + 0x30], rdx
xor eax, eax
jmp 0x49f2f7
movzx r9d, byte [rsp + rsi + 0x1a]
sub r9d, edx
lea edx, [r9 + 0x4a]
mov byte [rsp + rdi + 0x1a], dl
lea edx, [r8 + 0x4a]
mov byte [rsp + rsi + 0x1a], dl
add rax, 2
cmp rax, 0x12
jge 0x49f328
movzx edx, byte [rsp + rax + 0x26]
movzx esi, byte [rsp + rax + 0x27]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0xc
jae 0x49f34b
movzx r8d, byte [rsp + rdi + 0x1a]
sub r8d, edx
nop dword [rax]
cmp rsi, 0xc
jb 0x49f2da
jmp 0x49f33f
xor eax, eax
lea rbx, [rsp + 0x1a]
mov ecx, 0xc
call fcn.00441380
add rsp, 0x38
pop rbp
ret
mov eax, esi
mov ecx, 0xc
call fcn.00451880
mov eax, edi
mov ecx, 0xc
call fcn.00451880
nop
call fcn.0044f600
nop dword [rax]
jmp fcn.0049f280
Function at 0x4a4680
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4a477b
push rbp
mov rbp, rsp
sub rsp, 0x48
movabs rdx, 0xf0edeee3f4e8dbfb
mov qword [rsp + 0x1c], rdx
movabs rdx, 0x1901f0edeee3f4e8
mov qword [rsp + 0x1e], rdx
movabs rdx, 0x5e6e6f4fc8d36d33
mov qword [rsp + 0x26], rdx
movabs rdx, 0x2060600080a0c0b
mov qword [rsp + 0x2e], rdx
movabs rdx, 0x705071108090203
mov qword [rsp + 0x36], rdx
movabs rdx, 0x40e070507110809
mov qword [rsp + 0x38], rdx
movabs rdx, 0x10c0c0b110d0408
mov qword [rsp + 0x40], rdx
xor eax, eax
jmp 0x4a4719
movzx r9d, byte [rsp + rsi + 0x1c]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x6f]
mov byte [rsp + rdi + 0x1c], dl
mov byte [rsp + rsi + 0x1c], r8b
add rax, 2
cmp rax, 0x1a
jge 0x4a474b
movzx edx, byte [rsp + rax + 0x2e]
movzx esi, byte [rsp + rax + 0x2f]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x12
jae 0x4a476e
movzx r8d, byte [rsp + rdi + 0x1c]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x6f]
cmp rsi, 0x12
jb 0x4a46ff
jmp 0x4a4762
xor eax, eax
lea rbx, [rsp + 0x1c]
mov ecx, 0x12
call fcn.00441380
add rsp, 0x48
pop rbp
ret
mov eax, esi
mov ecx, 0x12
call fcn.00451880
mov eax, edi
mov ecx, 0x12
call fcn.00451880
nop
nop dword [rax + rax]
call fcn.0044f600
jmp fcn.004a4680

Function at 0x4a4ae0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4a4bbd
push rbp
mov rbp, rsp
sub rsp, 0x40
movabs rdx, 0x182a726f4131fecf
mov qword [rsp + 0x1f], rdx
movabs rdx, 0x6e77560d3173ba18
mov qword [rsp + 0x26], rdx
movabs rdx, 0x307010a0b080b
mov qword [rsp + 0x2e], rdx
movabs rdx, 0x108000307010a0b
mov qword [rsp + 0x30], rdx
movabs rdx, 0x60c030707060c02
mov qword [rsp + 0x38], rdx
xor eax, eax
nop
jmp 0x4a4b60
movzx r9d, byte [rsp + rsi + 0x1f]
sub r9d, edx
lea edx, [r9 + 0x36]
mov byte [rsp + rdi + 0x1f], dl
lea edx, [r8 + 0x36]
mov byte [rsp + rsi + 0x1f], dl
add rax, 2
nop
cmp rax, 0x12
jge 0x4a4b8d
movzx edx, byte [rsp + rax + 0x2e]
movzx esi, byte [rsp + rax + 0x2f]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0xf
jae 0x4a4bb0
movzx r8d, byte [rsp + rdi + 0x1f]
sub r8d, edx
cmp rsi, 0xf
jb 0x4a4b42
jmp 0x4a4ba4
xor eax, eax
lea rbx, [rsp + 0x1f]
mov ecx, 0xf
call fcn.00441380
add rsp, 0x40
pop rbp
ret
mov eax, esi
mov ecx, 0xf
call fcn.00451880
mov eax, edi
mov ecx, 0xf
call fcn.00451880
nop
nop dword [rax]
call fcn.0044f600
jmp fcn.004a4ae0