joyce8/EMBER2024-capa huggingface dataset:
Function at 0x490a20
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x490b0a
push rbp
mov rbp, rsp
sub rsp, 0x40
movabs rdx, 0x5d745ba5f466bf9e
mov qword [rsp + 0x19], rdx
movabs rdx, 0x6cdf9c5d745ba5f4
mov qword [rsp + 0x1c], rdx
movabs rdx, 0xc06597d1499dab95
mov qword [rsp + 0x24], rdx
movabs rdx, 0xd030b04120f0910
mov qword [rsp + 0x2c], rdx
movabs rdx, 0x80f0d070d030b04
mov qword [rsp + 0x30], rdx
movabs rdx, 0x1210000c05070107
mov qword [rsp + 0x38], rdx
xor eax, eax
jmp 0x490aad
movzx r9d, byte [rsp + rsi + 0x19]
sub r9d, edx
lea edx, [r9 - 0x1d]
mov byte [rsp + rdi + 0x19], dl
lea edx, [r8 - 0x1d]
mov byte [rsp + rsi + 0x19], dl
add rax, 2
cmp rax, 0x14
jge 0x490ada
movzx edx, byte [rsp + rax + 0x2c]
movzx esi, byte [rsp + rax + 0x2d]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x13
jae 0x490afd
movzx r8d, byte [rsp + rdi + 0x19]
sub r8d, edx
cmp rsi, 0x13
jb 0x490a90
jmp 0x490af1
xor eax, eax
lea rbx, [rsp + 0x19]
mov ecx, 0x13
call fcn.00440c20
add rsp, 0x40
pop rbp
ret
mov eax, esi
mov ecx, 0x13
call fcn.00450f00
mov eax, edi
mov ecx, 0x13
call fcn.00450f00
nop
call fcn.0044ec80
jmp fcn.00490a20

Function at 0x490da0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x490e9b
push rbp
mov rbp, rsp
sub rsp, 0x48
movabs rdx, 0x80469a65739e65a3
mov qword [rsp + 0x1b], rdx
movabs rdx, 0x86618d80469a6573
mov qword [rsp + 0x1e], rdx
movabs rdx, 0x8386796906898674
mov qword [rsp + 0x26], rdx
movabs rdx, 0xb0802080e0b110a
mov qword [rsp + 0x2e], rdx
movabs rdx, 0x120c0b0710050500
mov qword [rsp + 0x36], rdx
movabs rdx, 0x80d120c0b071005
mov qword [rsp + 0x38], rdx
movabs rdx, 0x30c08120b120d06
mov qword [rsp + 0x40], rdx
xor eax, eax
jmp 0x490e39
movzx r9d, byte [rsp + rsi + 0x1b]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x35]
mov byte [rsp + rdi + 0x1b], dl
mov byte [rsp + rsi + 0x1b], r8b
add rax, 2
cmp rax, 0x1a
jge 0x490e6b
movzx edx, byte [rsp + rax + 0x2e]
movzx esi, byte [rsp + rax + 0x2f]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x13
jae 0x490e8e
movzx r8d, byte [rsp + rdi + 0x1b]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x35]
cmp rsi, 0x13
jb 0x490e1f
jmp 0x490e82
xor eax, eax
lea rbx, [rsp + 0x1b]
mov ecx, 0x13
call fcn.00440c20
add rsp, 0x48
pop rbp
ret
mov eax, esi
mov ecx, 0x13
call fcn.00450f00
mov eax, edi
mov ecx, 0x13
call fcn.00450f00
nop
nop dword [rax + rax]
call fcn.0044ec80
jmp fcn.00490da0
Function at 0x491da0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x491e8a
push rbp
mov rbp, rsp
sub rsp, 0x48
movabs rdx, 0x75746371493c6572
mov qword [rsp + 0x1e], rdx
movabs rdx, 0x747e75746371493c
mov qword [rsp + 0x20], rdx
movabs rdx, 0x6d80427e78716574
mov qword [rsp + 0x28], rdx
movabs rdx, 0x40110070e0b030b
mov qword [rsp + 0x30], rdx
movabs rdx, 0xa0f0709010c090b
mov qword [rsp + 0x38], rdx
movabs rdx, 0xe0e070208030d0a
mov qword [rsp + 0x40], rdx
xor eax, eax
jmp 0x491e2d
movzx r9d, byte [rsp + rsi + 0x1e]
sub r9d, edx
lea edx, [r9 + 0xb]
mov byte [rsp + rdi + 0x1e], dl
lea edx, [r8 + 0xb]
mov byte [rsp + rsi + 0x1e], dl
add rax, 2
cmp rax, 0x18
jge 0x491e5a
movzx edx, byte [rsp + rax + 0x30]
movzx esi, byte [rsp + rax + 0x31]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x12
jae 0x491e7d
movzx r8d, byte [rsp + rdi + 0x1e]
sub r8d, edx
cmp rsi, 0x12
jb 0x491e10
jmp 0x491e71
xor eax, eax
lea rbx, [rsp + 0x1e]
mov ecx, 0x12
call fcn.00440c20
add rsp, 0x48
pop rbp
ret
mov eax, esi
mov ecx, 0x12
call fcn.00450f00
mov eax, edi
mov ecx, 0x12
call fcn.00450f00
nop
call fcn.0044ec80
jmp fcn.00491da0

Function at 0x491ea0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x491fd8
push rbp
mov rbp, rsp
sub rsp, 0x70
movabs rdx, 0x69d8bfd3108ff6ca
mov qword [rsp + 0x1d], rdx
movabs rdx, 0xd7f6bb517569d8bf
mov qword [rsp + 0x22], rdx
movabs rdx, 0x108737e2879eaff
mov qword [rsp + 0x2a], rdx
movabs rdx, 0xa9622d6eb06e2066
mov qword [rsp + 0x32], rdx
movabs rdx, 0xc5da696c73864b57
mov qword [rsp + 0x3a], rdx
movabs rdx, 0x131d02140e1e0902
mov qword [rsp + 0x42], rdx
movabs rdx, 0xd010311051c0b1e
mov qword [rsp + 0x4a], rdx
movabs rdx, 0x1e0414180e1f0d01
mov qword [rsp + 0x50], rdx
movabs rdx, 0x18080c1007072402
mov qword [rsp + 0x58], rdx
movabs rdx, 0x31d002318000d1e
mov qword [rsp + 0x60], rdx
movabs rdx, 0x1f10110c010a061d
mov qword [rsp + 0x68], rdx
xor eax, eax
jmp 0x491f78
movzx r9d, byte [rsp + rsi + 0x1d]
sub r9d, edx
lea edx, [r9 - 0x23]
mov byte [rsp + rdi + 0x1d], dl
lea edx, [r8 - 0x23]
mov byte [rsp + rsi + 0x1d], dl
add rax, 2
cmp rax, 0x2e
jge 0x491fa8
movzx edx, byte [rsp + rax + 0x42]
movzx esi, byte [rsp + rax + 0x43]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x25
jae 0x491fcb
movzx r8d, byte [rsp + rdi + 0x1d]
sub r8d, edx
nop dword [rax]
cmp rsi, 0x25
jb 0x491f5b
jmp 0x491fbf
xor eax, eax
lea rbx, [rsp + 0x1d]
mov ecx, 0x25
call fcn.00440c20
add rsp, 0x70
pop rbp
ret
mov eax, esi
mov ecx, 0x25
call fcn.00450f00
mov eax, edi
mov ecx, 0x25
call fcn.00450f00
nop
call fcn.0044ec80
nop dword [rax]
jmp fcn.00491ea0
Function at 0x493180
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x493246
push rbp
mov rbp, rsp
sub rsp, 0x30
movabs rdx, 0x595f6945244d0b69
mov qword [rsp + 0x1b], rdx
mov byte [rsp + 0x23], 6
movabs rdx, 0x308010703080308
mov qword [rsp + 0x24], rdx
mov dword [rsp + 0x2c], 0x3040602
xor eax, eax
nop
jmp 0x4931e0
movzx r9d, byte [rsp + rsi + 0x1b]
lea edx, [r9 + rdx]
lea edx, [rdx + 0xb]
mov byte [rsp + rdi + 0x1b], dl
mov byte [rsp + rsi + 0x1b], r8b
add rax, 2
nop dword [rax]
cmp rax, 0xc
jge 0x493212
movzx edx, byte [rsp + rax + 0x24]
movzx esi, byte [rsp + rax + 0x25]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 9
jae 0x493237
movzx r8d, byte [rsp + rdi + 0x1b]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0xb]
cmp rsi, 9
jb 0x4931c2
jmp 0x49322b
xor eax, eax
lea rbx, [rsp + 0x1b]
mov ecx, 9
nop
call fcn.00440c20
add rsp, 0x30
pop rbp
ret
mov eax, esi
mov ecx, 9
call fcn.00450f00
mov eax, edi
mov ecx, 9
nop
call fcn.00450f00
nop
call fcn.0044ec80
jmp fcn.00493180
Function at 0x497660
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x49774a
push rbp
mov rbp, rsp
sub rsp, 0x48
movabs rdx, 0x676f6420636c6381
mov qword [rsp + 0x1f], rdx
movabs rdx, 0x7c7a6c676f642063
mov qword [rsp + 0x22], rdx
movabs rdx, 0x74737a6a45207680
mov qword [rsp + 0x2a], rdx
movabs rdx, 0x10060e10100b0f06
mov qword [rsp + 0x32], rdx
movabs rdx, 0x300010708081006
mov qword [rsp + 0x38], rdx
movabs rdx, 0xc0a0f030f080906
mov qword [rsp + 0x40], rdx
xor eax, eax
jmp 0x4976ed
movzx r9d, byte [rsp + rsi + 0x1f]
sub r9d, edx
lea edx, [r9 + 0x12]
mov byte [rsp + rdi + 0x1f], dl
lea edx, [r8 + 0x12]
mov byte [rsp + rsi + 0x1f], dl
add rax, 2
cmp rax, 0x16
jge 0x49771a
movzx edx, byte [rsp + rax + 0x32]
movzx esi, byte [rsp + rax + 0x33]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x13
jae 0x49773d
movzx r8d, byte [rsp + rdi + 0x1f]
sub r8d, edx
cmp rsi, 0x13
jb 0x4976d0
jmp 0x497731
xor eax, eax
lea rbx, [rsp + 0x1f]
mov ecx, 0x13
call fcn.00440c20
add rsp, 0x48
pop rbp
ret
mov eax, esi
mov ecx, 0x13
call fcn.00450f00
mov eax, edi
mov ecx, 0x13
call fcn.00450f00
nop
call fcn.0044ec80
jmp fcn.00497660

Function at 0x498600
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4986ca
push rbp
mov rbp, rsp
sub rsp, 0x48
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x58], rax
mov qword [rsp], rax
mov qword [rsp + 8], rbx
mov byte [rsp + 0x10], 0
call fcn.00403080
xorps xmm15, xmm15
mov r14, qword [0x006245b0]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x18], 0xffffffffffffffff
jne 0x4986af
mov rcx, qword [rsp + 0x60]
lea rdx, [rcx + 1]
mov qword [rsp + 0x40], rdx
lea rax, [0x00509ec0]
xor ebx, ebx
mov rcx, rdx
call fcn.0043d760
mov rbx, qword [rsp + 0x60]
mov rcx, rax
xor edi, edi
mov rsi, qword [rsp + 0x40]
mov rax, qword [rsp + 0x58]
nop dword [rax]
call fcn.0049a940
inc rbx
cmp rcx, rbx
jae 0x49869e
mov edi, 1
lea rsi, [0x00509ec0]
call fcn.0043d840
mov word [rax + rbx*2 - 2], 0
xor edi, edi
xor esi, esi
add rsp, 0x48
pop rbp
ret
xor eax, eax
xor ebx, ebx
mov rcx, rbx
lea rdi, [0x005482a8]
lea rsi, [0x00547f58]
add rsp, 0x48
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.0044ec80
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.00498600
Function at 0x49c0e0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x49c1fd
push rbp
mov rbp, rsp
sub rsp, 0x60
movabs rdx, 0x6f3fec5e55525d6f
mov qword [rsp + 0x1d], rdx
movabs rdx, 0x6430576f61614950
mov qword [rsp + 0x25], rdx
movabs rdx, 0x6849642053643057
mov qword [rsp + 0x2a], rdx
movabs rdx, 0x5e31287221347170
mov qword [rsp + 0x32], rdx
movabs rdx, 0x1a1b0e0902130617
mov qword [rsp + 0x3a], rdx
movabs rdx, 0x10170305081a1a1b
mov qword [rsp + 0x40], rdx
movabs rdx, 0x1b0c160e09030406
mov qword [rsp + 0x48], rdx
movabs rdx, 0x1b06040c1204010b
mov qword [rsp + 0x50], rdx
movabs rdx, 0x18140e0d0e1c1203
mov qword [rsp + 0x58], rdx
xor eax, eax
jmp 0x49c1a0
movzx r9d, byte [rsp + rsi + 0x1d]
sub r9d, edx
lea edx, [r9 + 0x2f]
mov byte [rsp + rdi + 0x1d], dl
lea edx, [r8 + 0x2f]
mov byte [rsp + rsi + 0x1d], dl
add rax, 2
nop word [rax + rax]
cmp rax, 0x26
jge 0x49c1cd
movzx edx, byte [rsp + rax + 0x3a]
movzx esi, byte [rsp + rax + 0x3b]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x1d
jae 0x49c1f0
movzx r8d, byte [rsp + rdi + 0x1d]
sub r8d, edx
cmp rsi, 0x1d
jb 0x49c17d
jmp 0x49c1e4
xor eax, eax
lea rbx, [rsp + 0x1d]
mov ecx, 0x1d
call fcn.00440c20
add rsp, 0x60
pop rbp
ret
mov eax, esi
mov ecx, 0x1d
call fcn.00450f00
mov eax, edi
mov ecx, 0x1d
call fcn.00450f00
nop
nop dword [rax]
call fcn.0044ec80
jmp fcn.0049c0e0

Function at 0x49c7a0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x49c8a8
push rbp
mov rbp, rsp
sub rsp, 0x50
movabs rdx, 0x20643af20b2d1c37
mov qword [rsp + 0x1a], rdx
movabs rdx, 0x9c74e56575476572
mov qword [rsp + 0x22], rdx
movabs rdx, 0xc4369c74e5657547
mov qword [rsp + 0x24], rdx
movabs rdx, 0x7233127069c53f45
mov qword [rsp + 0x2c], rdx
movabs rdx, 0x1704120d0414170f
mov qword [rsp + 0x34], rdx
movabs rdx, 0x205120f14030110
mov qword [rsp + 0x3c], rdx
movabs rdx, 0x110004140205120f
mov qword [rsp + 0x40], rdx
movabs rdx, 0x100a14171318000f
mov qword [rsp + 0x48], rdx
xor eax, eax
jmp 0x49c84b
movzx r9d, byte [rsp + rsi + 0x1a]
sub r9d, edx
lea edx, [r9 + 0x51]
mov byte [rsp + rdi + 0x1a], dl
lea edx, [r8 + 0x51]
mov byte [rsp + rsi + 0x1a], dl
add rax, 2
cmp rax, 0x1c
jge 0x49c878
movzx edx, byte [rsp + rax + 0x34]
movzx esi, byte [rsp + rax + 0x35]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x1a
jae 0x49c89b
movzx r8d, byte [rsp + rdi + 0x1a]
sub r8d, edx
cmp rsi, 0x1a
jb 0x49c82e
jmp 0x49c88f
xor eax, eax
lea rbx, [rsp + 0x1a]
mov ecx, 0x1a
call fcn.00440c20
add rsp, 0x50
pop rbp
ret
mov eax, esi
mov ecx, 0x1a
call fcn.00450f00
mov eax, edi
mov ecx, 0x1a
call fcn.00450f00
nop
call fcn.0044ec80
jmp fcn.0049c7a0
Function at 0x49c8c0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x49c9ac
push rbp
mov rbp, rsp
sub rsp, 0x48
movabs rdx, 0x7db269b914cdcaa5
mov qword [rsp + 0x1c], rdx
movabs rdx, 0x75e765b37db269b9
mov qword [rsp + 0x20], rdx
movabs rdx, 0x9b646fa92068ba06
mov qword [rsp + 0x28], rdx
movabs rdx, 0xa060e0c0e070804
mov qword [rsp + 0x30], rdx
movabs rdx, 0x21000030e0d060c
mov qword [rsp + 0x38], rdx
movabs rdx, 0x1013011310000606
mov qword [rsp + 0x40], rdx
xor eax, eax
jmp 0x49c94a
movzx r9d, byte [rsp + rsi + 0x1c]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x53]
mov byte [rsp + rdi + 0x1c], dl
mov byte [rsp + rsi + 0x1c], r8b
add rax, 2
cmp rax, 0x18
jge 0x49c97c
movzx edx, byte [rsp + rax + 0x30]
movzx esi, byte [rsp + rax + 0x31]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x14
jae 0x49c99f
movzx r8d, byte [rsp + rdi + 0x1c]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x53]
cmp rsi, 0x14
jb 0x49c930
jmp 0x49c993
xor eax, eax
lea rbx, [rsp + 0x1c]
mov ecx, 0x14
call fcn.00440c20
add rsp, 0x48
pop rbp
ret
mov eax, esi
mov ecx, 0x14
call fcn.00450f00
mov eax, edi
mov ecx, 0x14
call fcn.00450f00
nop
call fcn.0044ec80
jmp fcn.0049c8c0

Function at 0x49d500
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x49d5ea
push rbp
mov rbp, rsp
sub rsp, 0x40
movabs rdx, 0xc3b364680910bec3
mov qword [rsp + 0x1a], rdx
movabs rdx, 0xe4adc3b364680910
mov qword [rsp + 0x1c], rdx
movabs rdx, 0xaec273b2bab26e0e
mov qword [rsp + 0x24], rdx
movabs rdx, 0xc0e0e0903110508
mov qword [rsp + 0x2c], rdx
movabs rdx, 0xa0111000c0e0e09
mov qword [rsp + 0x30], rdx
movabs rdx, 0xb0107100b020d06
mov qword [rsp + 0x38], rdx
xor eax, eax
jmp 0x49d58d
movzx r9d, byte [rsp + rsi + 0x1a]
sub r9d, edx
lea edx, [r9 - 0x37]
mov byte [rsp + rdi + 0x1a], dl
lea edx, [r8 - 0x37]
mov byte [rsp + rsi + 0x1a], dl
add rax, 2
cmp rax, 0x14
jge 0x49d5ba
movzx edx, byte [rsp + rax + 0x2c]
movzx esi, byte [rsp + rax + 0x2d]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x12
jae 0x49d5dd
movzx r8d, byte [rsp + rdi + 0x1a]
sub r8d, edx
cmp rsi, 0x12
jb 0x49d570
jmp 0x49d5d1
xor eax, eax
lea rbx, [rsp + 0x1a]
mov ecx, 0x12
call fcn.00440c20
add rsp, 0x40
pop rbp
ret
mov eax, esi
mov ecx, 0x12
call fcn.00450f00
mov eax, edi
mov ecx, 0x12
call fcn.00450f00
nop
call fcn.0044ec80
jmp fcn.0049d500
Function at 0x49f4e0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x49f5ca
push rbp
mov rbp, rsp
sub rsp, 0x40
movabs rdx, 0x25957b7310102052
mov qword [rsp + 0x1a], rdx
movabs rdx, 0xa6925957b731010
mov qword [rsp + 0x1c], rdx
movabs rdx, 0xbe6d7272fe172a0a
mov qword [rsp + 0x24], rdx
movabs rdx, 0x20d030505100906
mov qword [rsp + 0x2c], rdx
movabs rdx, 0x100b1101020d0305
mov qword [rsp + 0x30], rdx
movabs rdx, 0xa0c0a0b070b0109
mov qword [rsp + 0x38], rdx
xor eax, eax
jmp 0x49f56d
movzx r9d, byte [rsp + rsi + 0x1a]
sub r9d, edx
lea edx, [r9 + 0x6a]
mov byte [rsp + rdi + 0x1a], dl
lea edx, [r8 + 0x6a]
mov byte [rsp + rsi + 0x1a], dl
add rax, 2
cmp rax, 0x14
jge 0x49f59a
movzx edx, byte [rsp + rax + 0x2c]
movzx esi, byte [rsp + rax + 0x2d]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x12
jae 0x49f5bd
movzx r8d, byte [rsp + rdi + 0x1a]
sub r8d, edx
cmp rsi, 0x12
jb 0x49f550
jmp 0x49f5b1
xor eax, eax
lea rbx, [rsp + 0x1a]
mov ecx, 0x12
call fcn.00440c20
add rsp, 0x40
pop rbp
ret
mov eax, esi
mov ecx, 0x12
call fcn.00450f00
mov eax, edi
mov ecx, 0x12
call fcn.00450f00
nop
call fcn.0044ec80
jmp fcn.0049f4e0

Function at 0x49fc00
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x49fce6
push rbp
mov rbp, rsp
sub rsp, 0x40
movabs rdx, 0x3d74856f754480aa
mov qword [rsp + 0x1c], rdx
movabs rdx, 0x852d94a5807c986c
mov qword [rsp + 0x24], rdx
movabs rdx, 0xc0f0702090d
mov qword [rsp + 0x2c], rdx
movabs rdx, 0x10f000500000c0f
mov qword [rsp + 0x30], rdx
movabs rdx, 0xe0b030d0807010a
mov qword [rsp + 0x38], rdx
xor eax, eax
nop
jmp 0x49fc80
movzx r9d, byte [rsp + rsi + 0x1c]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x24]
mov byte [rsp + rdi + 0x1c], dl
mov byte [rsp + rsi + 0x1c], r8b
add rax, 2
nop dword [rax]
cmp rax, 0x14
jge 0x49fcb2
movzx edx, byte [rsp + rax + 0x2c]
movzx esi, byte [rsp + rax + 0x2d]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x10
jae 0x49fcd7
movzx r8d, byte [rsp + rdi + 0x1c]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x24]
cmp rsi, 0x10
jb 0x49fc62
jmp 0x49fccb
xor eax, eax
lea rbx, [rsp + 0x1c]
mov ecx, 0x10
nop
call fcn.00440c20
add rsp, 0x40
pop rbp
ret
mov eax, esi
mov ecx, 0x10
call fcn.00450f00
mov eax, edi
mov ecx, 0x10
nop
call fcn.00450f00
nop
call fcn.0044ec80
jmp fcn.0049fc00
Function at 0x4a0b20
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4a0c06
push rbp
mov rbp, rsp
sub rsp, 0x40
movabs rdx, 0x201e69c9d1df2069
mov qword [rsp + 0x1e], rdx
movabs rdx, 0xb4de29277567bb08
mov qword [rsp + 0x26], rdx
movabs rdx, 0xc0c0d020e0d0302
mov qword [rsp + 0x2e], rdx
movabs rdx, 0x30f0c0c0d020e0d
mov qword [rsp + 0x30], rdx
movabs rdx, 0x601080304060901
mov qword [rsp + 0x38], rdx
xor eax, eax
nop
jmp 0x4a0ba0
movzx r9d, byte [rsp + rsi + 0x1e]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x40]
mov byte [rsp + rdi + 0x1e], dl
mov byte [rsp + rsi + 0x1e], r8b
add rax, 2
nop dword [rax]
cmp rax, 0x12
jge 0x4a0bd2
movzx edx, byte [rsp + rax + 0x2e]
movzx esi, byte [rsp + rax + 0x2f]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x10
jae 0x4a0bf7
movzx r8d, byte [rsp + rdi + 0x1e]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x40]
cmp rsi, 0x10
jb 0x4a0b82
jmp 0x4a0beb
xor eax, eax
lea rbx, [rsp + 0x1e]
mov ecx, 0x10
nop
call fcn.00440c20
add rsp, 0x40
pop rbp
ret
mov eax, esi
mov ecx, 0x10
call fcn.00450f00
mov eax, edi
mov ecx, 0x10
nop
call fcn.00450f00
nop
call fcn.0044ec80
jmp fcn.004a0b20
Function at 0x4a3980
Capabilities:
Encrypt data using rc4 prga

Disassembly:
lea r12, [rsp - 8]
cmp r12, qword [r14 + 0x10]
jbe 0x4a3add
push rbp
mov rbp, rsp
add rsp, 0xffffffffffffff80
movabs rdx, 0x1274f55cbd749698
mov qword [rsp + 0x1d], rdx
movabs rdx, 0xa7969f6fc75e58b3
mov qword [rsp + 0x25], rdx
movabs rdx, 0x9620cdc4a8afd0a7
mov qword [rsp + 0x2c], rdx
movabs rdx, 0x88be6e61be2010ad
mov qword [rsp + 0x34], rdx
movabs rdx, 0xfb8b642012f0680a
mov qword [rsp + 0x3c], rdx
movabs rdx, 0xbaf376af6172499f
mov qword [rsp + 0x44], rdx
movabs rdx, 0x2e131f0e171e2307
mov qword [rsp + 0x4c], rdx
movabs rdx, 0xe1e21002e131f0e
mov qword [rsp + 0x50], rdx
movabs rdx, 0x2d0f2b0825280005
mov qword [rsp + 0x58], rdx
movabs rdx, 0xf1107162c1e0105
mov qword [rsp + 0x60], rdx
movabs rdx, 0x418040a22100712
mov qword [rsp + 0x68], rdx
movabs rdx, 0x27042318090d2726
mov qword [rsp + 0x70], rdx
movabs rdx, 0x1d00161a10030b14
mov qword [rsp + 0x78], rdx
xor eax, eax
jmp 0x4a3a80
movzx r9d, byte [rsp + rsi + 0x1d]
sub r9d, edx
lea edx, [r9 - 0xe]
mov byte [rsp + rdi + 0x1d], dl
lea edx, [r8 - 0xe]
mov byte [rsp + rsi + 0x1d], dl
add rax, 2
nop dword [rax + rax]
cmp rax, 0x34
jge 0x4a3aad
movzx edx, byte [rsp + rax + 0x4c]
movzx esi, byte [rsp + rax + 0x4d]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x2f
jae 0x4a3ad0
movzx r8d, byte [rsp + rdi + 0x1d]
sub r8d, edx
cmp rsi, 0x2f
jb 0x4a3a5e
jmp 0x4a3ac4
xor eax, eax
lea rbx, [rsp + 0x1d]
mov ecx, 0x2f
call fcn.00440c20
sub rsp, 0xffffffffffffff80
pop rbp
ret
mov eax, esi
mov ecx, 0x2f
call fcn.00450f00
mov eax, edi
mov ecx, 0x2f
call fcn.00450f00
nop
nop dword [rax]
call fcn.0044ec80
jmp fcn.004a3980

Function at 0x4a3f80
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4a407d
push rbp
mov rbp, rsp
sub rsp, 0x50
movabs rdx, 0x796d6e7661a0705f
mov qword [rsp + 0x1e], rdx
movabs rdx, 0x7125646f835b7c81
mov qword [rsp + 0x26], rdx
movabs rdx, 0x658e6e3072203d79
mov qword [rsp + 0x2e], rdx
movabs rdx, 0x140f04100003010d
mov qword [rsp + 0x36], rdx
movabs rdx, 0x200040e0216080a
mov qword [rsp + 0x3e], rdx
movabs rdx, 0x6070200040e0216
mov qword [rsp + 0x40], rdx
movabs rdx, 0x6000a160b11090e
mov qword [rsp + 0x48], rdx
xor eax, eax
jmp 0x4a4020
movzx r9d, byte [rsp + rsi + 0x1e]
sub r9d, edx
lea edx, [r9 + 0x11]
mov byte [rsp + rdi + 0x1e], dl
lea edx, [r8 + 0x11]
mov byte [rsp + rsi + 0x1e], dl
add rax, 2
nop dword [rax]
cmp rax, 0x1a
jge 0x4a404d
movzx edx, byte [rsp + rax + 0x36]
movzx esi, byte [rsp + rax + 0x37]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x18
jae 0x4a4070
movzx r8d, byte [rsp + rdi + 0x1e]
sub r8d, edx
cmp rsi, 0x18
jb 0x4a3fff
jmp 0x4a4064
xor eax, eax
lea rbx, [rsp + 0x1e]
mov ecx, 0x18
call fcn.00440c20
add rsp, 0x50
pop rbp
ret
mov eax, esi
mov ecx, 0x18
call fcn.00450f00
mov eax, edi
mov ecx, 0x18
call fcn.00450f00
nop
nop dword [rax]
call fcn.0044ec80
jmp fcn.004a3f80
Function at 0x4a50c0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4a51f8
push rbp
mov rbp, rsp
sub rsp, 0x68
movabs rdx, 0x206bc86f779500b0
mov qword [rsp + 0x1b], rdx
movabs rdx, 0xc5948e206bc86f77
mov qword [rsp + 0x1e], rdx
movabs rdx, 0x6eb1d6ca9a6b7070
mov qword [rsp + 0x26], rdx
movabs rdx, 0xa1e76f69ba6388b3
mov qword [rsp + 0x2e], rdx
movabs rdx, 0xe988ac8fbcc66e6f
mov qword [rsp + 0x36], rdx
movabs rdx, 0x51910221a0a1421
mov qword [rsp + 0x3e], rdx
movabs rdx, 0x1e1e010008220213
mov qword [rsp + 0x46], rdx
movabs rdx, 0x51e1e01000822
mov qword [rsp + 0x48], rdx
movabs rdx, 0xa0f081f1d13201a
mov qword [rsp + 0x50], rdx
movabs rdx, 0x19100a131a110e16
mov qword [rsp + 0x58], rdx
movabs rdx, 0xe1a0e0d1b220919
mov qword [rsp + 0x60], rdx
xor eax, eax
jmp 0x4a5195
movzx r9d, byte [rsp + rsi + 0x1b]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x58]
mov byte [rsp + rdi + 0x1b], dl
mov byte [rsp + rsi + 0x1b], r8b
add rax, 2
cmp rax, 0x2a
jge 0x4a51c8
movzx edx, byte [rsp + rax + 0x3e]
movzx esi, byte [rsp + rax + 0x3f]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x23
jae 0x4a51eb
movzx r8d, byte [rsp + rdi + 0x1b]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x58]
nop
cmp rsi, 0x23
jb 0x4a517b
jmp 0x4a51df
xor eax, eax
lea rbx, [rsp + 0x1b]
mov ecx, 0x23
call fcn.00440c20
add rsp, 0x68
pop rbp
ret
mov eax, esi
mov ecx, 0x23
call fcn.00450f00
mov eax, edi
mov ecx, 0x23
call fcn.00450f00
nop
call fcn.0044ec80
nop dword [rax]
jmp fcn.004a50c0

Function at 0x4a5220
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4a52d8
push rbp
mov rbp, rsp
sub rsp, 0x30
movabs rdx, 0x65876f898e4c7cc8
mov qword [rsp + 0x1e], rdx
movabs rdx, 0x400020002000601
mov qword [rsp + 0x26], rdx
mov word [rsp + 0x2e], 0x403
xor eax, eax
jmp 0x4a5278
movzx r9d, byte [rsp + rsi + 0x1e]
sub r9d, edx
lea edx, [r9 - 0x11]
mov byte [rsp + rdi + 0x1e], dl
lea edx, [r8 - 0x11]
mov byte [rsp + rsi + 0x1e], dl
add rax, 2
cmp rax, 0xa
jge 0x4a52a8
movzx edx, byte [rsp + rax + 0x26]
movzx esi, byte [rsp + rax + 0x27]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 8
jae 0x4a52cb
movzx r8d, byte [rsp + rdi + 0x1e]
sub r8d, edx
nop dword [rax]
cmp rsi, 8
jb 0x4a525b
jmp 0x4a52bf
xor eax, eax
lea rbx, [rsp + 0x1e]
mov ecx, 8
call fcn.00440c20
add rsp, 0x30
pop rbp
ret
mov eax, esi
mov ecx, 8
call fcn.00450f00
mov eax, edi
mov ecx, 8
call fcn.00450f00
nop
call fcn.0044ec80
nop dword [rax]
jmp fcn.004a5220