joyce8/EMBER2024-capa huggingface dataset:
Function at 0x49b2a0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x49b3ac
push rbp
mov rbp, rsp
sub rsp, 0x50
movabs rdx, 0x838aaa856c667586
mov qword [rsp + 0x18], rdx
movabs rdx, 0x61436a934d6c6172
mov qword [rsp + 0x20], rdx
movabs rdx, 0x966161436a934d6c
mov qword [rsp + 0x22], rdx
movabs rdx, 0x5ca67980728d6e74
mov qword [rsp + 0x2a], rdx
movabs rdx, 0x6140c0006050416
mov qword [rsp + 0x32], rdx
movabs rdx, 0x7180d0b0d181110
mov qword [rsp + 0x3a], rdx
movabs rdx, 0xc01170c11070718
mov qword [rsp + 0x40], rdx
movabs rdx, 0x1905080413081812
mov qword [rsp + 0x48], rdx
xor eax, eax
jmp 0x49b348
movzx r9d, byte [rsp + rsi + 0x18]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x31]
mov byte [rsp + rdi + 0x18], dl
mov byte [rsp + rsi + 0x18], r8b
add rax, 2
cmp rax, 0x1e
jge 0x49b37c
movzx edx, byte [rsp + rax + 0x32]
movzx esi, byte [rsp + rax + 0x33]
mov edi, edx
xor edx, esi
add edx, eax
nop
cmp rdi, 0x1a
jae 0x49b39f
movzx r8d, byte [rsp + rdi + 0x18]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x31]
cmp rsi, 0x1a
jb 0x49b32e
jmp 0x49b393
xor eax, eax
lea rbx, [rsp + 0x18]
mov ecx, 0x1a
call fcn.00441980
add rsp, 0x50
pop rbp
ret
mov eax, esi
mov ecx, 0x1a
call fcn.00452300
mov eax, edi
mov ecx, 0x1a
call fcn.00452300
nop
call fcn.00450080
jmp fcn.0049b2a0

Function at 0x49b3c0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x49b4aa
push rbp
mov rbp, rsp
sub rsp, 0x40
movabs rdx, 0x2ed7fd09470c6572
mov qword [rsp + 0x1b], rdx
movabs rdx, 0x982ed7fd09470c65
mov qword [rsp + 0x1c], rdx
movabs rdx, 0x74134961092515a6
mov qword [rsp + 0x24], rdx
movabs rdx, 0x803080908030d0d
mov qword [rsp + 0x2c], rdx
movabs rdx, 0x40c050508030809
mov qword [rsp + 0x30], rdx
movabs rdx, 0xb060f0a0209060d
mov qword [rsp + 0x38], rdx
xor eax, eax
jmp 0x49b44d
movzx r9d, byte [rsp + rsi + 0x1b]
sub r9d, edx
lea edx, [r9 + 0x6e]
mov byte [rsp + rdi + 0x1b], dl
lea edx, [r8 + 0x6e]
mov byte [rsp + rsi + 0x1b], dl
add rax, 2
cmp rax, 0x14
jge 0x49b47a
movzx edx, byte [rsp + rax + 0x2c]
movzx esi, byte [rsp + rax + 0x2d]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x11
jae 0x49b49d
movzx r8d, byte [rsp + rdi + 0x1b]
sub r8d, edx
cmp rsi, 0x11
jb 0x49b430
jmp 0x49b491
xor eax, eax
lea rbx, [rsp + 0x1b]
mov ecx, 0x11
call fcn.00441980
add rsp, 0x40
pop rbp
ret
mov eax, esi
mov ecx, 0x11
call fcn.00452300
mov eax, edi
mov ecx, 0x11
call fcn.00452300
nop
call fcn.00450080
jmp fcn.0049b3c0
Function at 0x49b4c0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x49b5e7
push rbp
mov rbp, rsp
sub rsp, 0x68
movabs rdx, 0xf98eafba9e1b8a72
mov qword [rsp + 0x1f], rdx
movabs rdx, 0xf4f98eafba9e1b8a
mov qword [rsp + 0x20], rdx
movabs rdx, 0x6ebb2c8a1b72da81
mov qword [rsp + 0x28], rdx
movabs rdx, 0x45ebf76fff09dffc
mov qword [rsp + 0x30], rdx
movabs rdx, 0x32ff6ef1727e666f
mov qword [rsp + 0x38], rdx
movabs rdx, 0xe0d06081d010d20
mov qword [rsp + 0x40], rdx
movabs rdx, 0x160c121b0c12090a
mov qword [rsp + 0x48], rdx
movabs rdx, 0x180f051f171d1b03
mov qword [rsp + 0x50], rdx
movabs rdx, 0x1f0a14040f07161b
mov qword [rsp + 0x58], rdx
movabs rdx, 0x11121302080d0720
mov qword [rsp + 0x60], rdx
xor eax, eax
jmp 0x49b589
movzx r9d, byte [rsp + rsi + 0x1f]
sub r9d, edx
lea edx, [r9 - 0x6e]
mov byte [rsp + rdi + 0x1f], dl
lea edx, [r8 - 0x6e]
mov byte [rsp + rsi + 0x1f], dl
add rax, 2
cmp rax, 0x28
jge 0x49b5b7
movzx edx, byte [rsp + rax + 0x40]
movzx esi, byte [rsp + rax + 0x41]
mov edi, edx
xor edx, esi
add edx, eax
nop
cmp rdi, 0x21
jae 0x49b5da
movzx r8d, byte [rsp + rdi + 0x1f]
sub r8d, edx
cmp rsi, 0x21
jb 0x49b56c
jmp 0x49b5ce
xor eax, eax
lea rbx, [rsp + 0x1f]
mov ecx, 0x21
call fcn.00441980
add rsp, 0x68
pop rbp
ret
mov eax, esi
mov ecx, 0x21
call fcn.00452300
mov eax, edi
mov ecx, 0x21
call fcn.00452300
nop
call fcn.00450080
jmp fcn.0049b4c0

Function at 0x49ca20
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x49cb1d
push rbp
mov rbp, rsp
sub rsp, 0x50
movabs rdx, 0xf1c6636518d465d7
mov qword [rsp + 0x1f], rdx
movabs rdx, 0xe756ccbdef1c663
mov qword [rsp + 0x24], rdx
movabs rdx, 0x2a65cfa0dcdc43d0
mov qword [rsp + 0x2c], rdx
movabs rdx, 0x140c0c070f0f090d
mov qword [rsp + 0x34], rdx
movabs rdx, 0xd0307090f030814
mov qword [rsp + 0x3c], rdx
movabs rdx, 0x120803120d030709
mov qword [rsp + 0x40], rdx
movabs rdx, 0x20610000f0c110d
mov qword [rsp + 0x48], rdx
xor eax, eax
jmp 0x49cac0
movzx r9d, byte [rsp + rsi + 0x1f]
sub r9d, edx
lea edx, [r9 - 0x42]
mov byte [rsp + rdi + 0x1f], dl
lea edx, [r8 - 0x42]
mov byte [rsp + rsi + 0x1f], dl
add rax, 2
nop dword [rax]
cmp rax, 0x1c
jge 0x49caed
movzx edx, byte [rsp + rax + 0x34]
movzx esi, byte [rsp + rax + 0x35]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x15
jae 0x49cb10
movzx r8d, byte [rsp + rdi + 0x1f]
sub r8d, edx
cmp rsi, 0x15
jb 0x49ca9f
jmp 0x49cb04
xor eax, eax
lea rbx, [rsp + 0x1f]
mov ecx, 0x15
call fcn.00441980
add rsp, 0x50
pop rbp
ret
mov eax, esi
mov ecx, 0x15
call fcn.00452300
mov eax, edi
mov ecx, 0x15
call fcn.00452300
nop
nop dword [rax]
call fcn.00450080
jmp fcn.0049ca20
Function at 0x49e360
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x49e42c
push rbp
mov rbp, rsp
sub rsp, 0x30
movabs rdx, 0xd85372cb206461c4
mov qword [rsp + 0x19], rdx
movabs rdx, 0x65449ed85372cb20
mov qword [rsp + 0x1c], rdx
movabs rdx, 0x409080404070700
mov qword [rsp + 0x24], rdx
mov dword [rsp + 0x2c], 0x4090406
xor eax, eax
jmp 0x49e3c5
movzx r9d, byte [rsp + rsi + 0x19]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x7d]
mov byte [rsp + rdi + 0x19], dl
mov byte [rsp + rsi + 0x19], r8b
add rax, 2
cmp rax, 0xc
jge 0x49e3fc
movzx edx, byte [rsp + rax + 0x24]
movzx esi, byte [rsp + rax + 0x25]
mov edi, edx
xor edx, esi
add edx, eax
nop dword [rax + rax]
cmp rdi, 0xb
jae 0x49e41f
movzx r8d, byte [rsp + rdi + 0x19]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x7d]
cmp rsi, 0xb
jb 0x49e3ab
jmp 0x49e413
xor eax, eax
lea rbx, [rsp + 0x19]
mov ecx, 0xb
call fcn.00441980
add rsp, 0x30
pop rbp
ret
mov eax, esi
mov ecx, 0xb
call fcn.00452300
mov eax, edi
mov ecx, 0xb
call fcn.00452300
nop
call fcn.00450080
jmp fcn.0049e360
Function at 0x4a02e0
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4a04eb
push rbp
mov rbp, rsp
sub rsp, 0x48
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x68], rcx
mov qword [rsp + 0x58], rax
add qword [rax + 0x58], rcx
mov rdx, qword [rax + 0x50]
test rdx, rdx
jle 0x4a0404
cmp rdx, 0x40
ja 0x4a04dd
mov qword [rsp + 0x70], rdi
mov qword [rsp + 0x60], rbx
lea rsi, [rdx - 0x40]
mov r8, rsi
neg rsi
sar r8, 0x3f
and r8, rdx
lea rdx, [rax + r8]
lea rdx, [rdx + 0x10]
cmp rcx, rsi
cmovl rsi, rcx
mov qword [rsp + 0x28], rsi
cmp rbx, rdx
je 0x4a0374
mov rax, rdx
mov rcx, rsi
call fcn.00452ca0
mov rax, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x68]
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x28]
mov rdi, qword [rsp + 0x70]
mov rdx, qword [rax + 0x50]
add rdx, rsi
mov qword [rax + 0x50], rdx
nop
cmp rdx, 0x40
jne 0x4a03e0
mov qword [rsp], rax
lea rcx, [rax + 0x10]
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], 0x40
mov qword [rsp + 0x18], 0x40
call fcn.004a0aa0
xorps xmm15, xmm15
mov r14, qword [0x006668c8]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x58]
mov qword [rax + 0x50], 0
mov rcx, qword [rsp + 0x68]
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x28]
mov rdi, qword [rsp + 0x70]
nop dword [rax]
cmp rcx, rsi
jb 0x4a04d5
sub rdi, rsi
mov rdx, rdi
neg rdx
sar rdx, 0x3f
and rdx, rsi
mov r8, rcx
sub r8, rsi
add rbx, rdx
jmp 0x4a0407
mov r8, rcx
cmp r8, 0x40
jl 0x4a0485
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x30], r8
mov qword [rsp + 0x40], rbx
mov qword [rsp], rax
mov qword [rsp + 8], rbx
and r8, 0xffffffffffffffc0
mov qword [rsp + 0x20], r8
mov qword [rsp + 0x10], r8
mov qword [rsp + 0x18], rdi
call fcn.004a0aa0
xorps xmm15, xmm15
mov r14, qword [0x006668c8]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x20]
mov rcx, qword [rsp + 0x38]
mov rdx, rax
sub rax, rcx
sar rax, 0x3f
mov r8, qword [rsp + 0x30]
and rax, r8
and rax, 0xffffffffffffffc0
mov rcx, qword [rsp + 0x40]
lea rbx, [rcx + rax]
sub r8, rdx
mov rax, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x68]
test r8, r8
je 0x4a04c8
lea rdx, [rax + 0x10]
cmp r8, 0x40
mov esi, 0x40
cmovl rsi, r8
nop dword [rax + rax]
cmp rbx, rdx
je 0x4a04c4
mov qword [rsp + 0x38], rsi
mov rax, rdx
mov rcx, rsi
call fcn.00452ca0
mov rax, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x38]
mov qword [rax + 0x50], rsi
mov rax, rcx
xor ebx, ebx
xor ecx, ecx
add rsp, 0x48
pop rbp
ret
mov rax, rsi
call fcn.004523c0
mov rax, rdx
mov ecx, 0x40
call fcn.004523c0
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
nop
call fcn.00450080
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
jmp fcn.004a02e0
Function at 0x4a5be0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4a5ccc
push rbp
mov rbp, rsp
sub rsp, 0x48
movabs rdx, 0x724c2edccf9569ef
mov qword [rsp + 0x1d], rdx
movabs rdx, 0x4c3965724c2edccf
mov qword [rsp + 0x20], rdx
movabs rdx, 0x28367b6978d03edc
mov qword [rsp + 0x28], rdx
movabs rdx, 0x110406090b000c02
mov qword [rsp + 0x30], rdx
movabs rdx, 0xc0509060c12090a
mov qword [rsp + 0x38], rdx
movabs rdx, 0x120c100412030d02
mov qword [rsp + 0x40], rdx
xor eax, eax
jmp 0x4a5c6a
movzx r9d, byte [rsp + rsi + 0x1d]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x7d]
mov byte [rsp + rdi + 0x1d], dl
mov byte [rsp + rsi + 0x1d], r8b
add rax, 2
cmp rax, 0x18
jge 0x4a5c9c
movzx edx, byte [rsp + rax + 0x30]
movzx esi, byte [rsp + rax + 0x31]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x13
jae 0x4a5cbf
movzx r8d, byte [rsp + rdi + 0x1d]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x7d]
cmp rsi, 0x13
jb 0x4a5c50
jmp 0x4a5cb3
xor eax, eax
lea rbx, [rsp + 0x1d]
mov ecx, 0x13
call fcn.00441980
add rsp, 0x48
pop rbp
ret
mov eax, esi
mov ecx, 0x13
call fcn.00452300
mov eax, edi
mov ecx, 0x13
call fcn.00452300
nop
call fcn.00450080
jmp fcn.004a5be0

Function at 0x4a5f40
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4a602a
push rbp
mov rbp, rsp
sub rsp, 0x48
movabs rdx, 0x4130525c65621d66
mov qword [rsp + 0x1f], rdx
movabs rdx, 0x6455654130525c65
mov qword [rsp + 0x22], rdx
movabs rdx, 0x5e63735150633e15
mov qword [rsp + 0x2a], rdx
movabs rdx, 0x90e041105070e06
mov qword [rsp + 0x32], rdx
movabs rdx, 0xf0c040b0912090e
mov qword [rsp + 0x38], rdx
movabs rdx, 0xc01110902090f09
mov qword [rsp + 0x40], rdx
xor eax, eax
jmp 0x4a5fcd
movzx r9d, byte [rsp + rsi + 0x1f]
sub r9d, edx
lea edx, [r9 + 0x24]
mov byte [rsp + rdi + 0x1f], dl
lea edx, [r8 + 0x24]
mov byte [rsp + rsi + 0x1f], dl
add rax, 2
cmp rax, 0x16
jge 0x4a5ffa
movzx edx, byte [rsp + rax + 0x32]
movzx esi, byte [rsp + rax + 0x33]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x13
jae 0x4a601d
movzx r8d, byte [rsp + rdi + 0x1f]
sub r8d, edx
cmp rsi, 0x13
jb 0x4a5fb0
jmp 0x4a6011
xor eax, eax
lea rbx, [rsp + 0x1f]
mov ecx, 0x13
call fcn.00441980
add rsp, 0x48
pop rbp
ret
mov eax, esi
mov ecx, 0x13
call fcn.00452300
mov eax, edi
mov ecx, 0x13
call fcn.00452300
nop
call fcn.00450080
jmp fcn.004a5f40
Function at 0x4a6ca0
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4a6d6a
push rbp
mov rbp, rsp
sub rsp, 0x48
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x58], rax
mov qword [rsp], rax
mov qword [rsp + 8], rbx
mov byte [rsp + 0x10], 0
call fcn.00403840
xorps xmm15, xmm15
mov r14, qword [0x006668c8]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x18], 0xffffffffffffffff
jne 0x4a6d4f
mov rcx, qword [rsp + 0x60]
lea rdx, [rcx + 1]
mov qword [rsp + 0x40], rdx
lea rax, [0x005347e0]
xor ebx, ebx
mov rcx, rdx
call fcn.0043e4c0
mov rbx, qword [rsp + 0x60]
mov rcx, rax
xor edi, edi
mov rsi, qword [rsp + 0x40]
mov rax, qword [rsp + 0x58]
nop dword [rax]
call fcn.004a8f00
inc rbx
cmp rcx, rbx
jae 0x4a6d3e
mov edi, 1
lea rsi, [0x005347e0]
call fcn.0043e5a0
mov word [rax + rbx*2 - 2], 0
xor edi, edi
xor esi, esi
add rsp, 0x48
pop rbp
ret
xor eax, eax
xor ebx, ebx
mov rcx, rbx
lea rdi, [0x00579ed8]
lea rsi, [0x00579ac8]
add rsp, 0x48
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.00450080
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.004a6ca0

Function at 0x4a75a0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4a7686
push rbp
mov rbp, rsp
sub rsp, 0x40
movabs rdx, 0xe0a583f546a5a553
mov qword [rsp + 0x1e], rdx
movabs rdx, 0xa8aab16574abeac1
mov qword [rsp + 0x26], rdx
movabs rdx, 0x90f06010e050404
mov qword [rsp + 0x2e], rdx
movabs rdx, 0x80f090f06010e05
mov qword [rsp + 0x30], rdx
movabs rdx, 0xd0f070f020a0404
mov qword [rsp + 0x38], rdx
xor eax, eax
nop
jmp 0x4a7620
movzx r9d, byte [rsp + rsi + 0x1e]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x4b]
mov byte [rsp + rdi + 0x1e], dl
mov byte [rsp + rsi + 0x1e], r8b
add rax, 2
nop dword [rax]
cmp rax, 0x12
jge 0x4a7652
movzx edx, byte [rsp + rax + 0x2e]
movzx esi, byte [rsp + rax + 0x2f]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x10
jae 0x4a7677
movzx r8d, byte [rsp + rdi + 0x1e]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x4b]
cmp rsi, 0x10
jb 0x4a7602
jmp 0x4a766b
xor eax, eax
lea rbx, [rsp + 0x1e]
mov ecx, 0x10
nop
call fcn.00441980
add rsp, 0x40
pop rbp
ret
mov eax, esi
mov ecx, 0x10
call fcn.00452300
mov eax, edi
mov ecx, 0x10
nop
call fcn.00452300
nop
call fcn.00450080
jmp fcn.004a75a0
Function at 0x4a7c40
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4a7d3d
push rbp
mov rbp, rsp
sub rsp, 0x50
movabs rdx, 0x826ea9fc616f6c66
mov qword [rsp + 0x1e], rdx
movabs rdx, 0x6585d38bb66f7094
mov qword [rsp + 0x26], rdx
movabs rdx, 0x587669a2afa8085b
mov qword [rsp + 0x2e], rdx
movabs rdx, 0x160b04141612110c
mov qword [rsp + 0x36], rdx
movabs rdx, 0x70405070c0e1316
mov qword [rsp + 0x3e], rdx
movabs rdx, 0xd08070405070c0e
mov qword [rsp + 0x40], rdx
movabs rdx, 0x10081416170e0e14
mov qword [rsp + 0x48], rdx
xor eax, eax
jmp 0x4a7ce0
movzx r9d, byte [rsp + rsi + 0x1e]
sub r9d, edx
lea edx, [r9 - 0xb]
mov byte [rsp + rdi + 0x1e], dl
lea edx, [r8 - 0xb]
mov byte [rsp + rsi + 0x1e], dl
add rax, 2
nop dword [rax]
cmp rax, 0x1a
jge 0x4a7d0d
movzx edx, byte [rsp + rax + 0x36]
movzx esi, byte [rsp + rax + 0x37]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x18
jae 0x4a7d30
movzx r8d, byte [rsp + rdi + 0x1e]
sub r8d, edx
cmp rsi, 0x18
jb 0x4a7cbf
jmp 0x4a7d24
xor eax, eax
lea rbx, [rsp + 0x1e]
mov ecx, 0x18
call fcn.00441980
add rsp, 0x50
pop rbp
ret
mov eax, esi
mov ecx, 0x18
call fcn.00452300
mov eax, edi
mov ecx, 0x18
call fcn.00452300
nop
nop dword [rax]
call fcn.00450080
jmp fcn.004a7c40

Function at 0x4a9560
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4a965d
push rbp
mov rbp, rsp
sub rsp, 0x50
movabs rdx, 0x2005d2157224e616
mov qword [rsp + 0x1c], rdx
movabs rdx, 0x40fd1edb99b32005
mov qword [rsp + 0x22], rdx
movabs rdx, 0x18d4752085cf2079
mov qword [rsp + 0x2a], rdx
movabs rdx, 0x50905060c080c
mov qword [rsp + 0x32], rdx
movabs rdx, 0x115091100150114
mov qword [rsp + 0x3a], rdx
movabs rdx, 0x1040a0201100115
mov qword [rsp + 0x40], rdx
movabs rdx, 0x140d0b0b0b091002
mov qword [rsp + 0x48], rdx
xor eax, eax
jmp 0x4a9600
movzx r9d, byte [rsp + rsi + 0x1c]
sub r9d, edx
lea edx, [r9 + 0x68]
mov byte [rsp + rdi + 0x1c], dl
lea edx, [r8 + 0x68]
mov byte [rsp + rsi + 0x1c], dl
add rax, 2
nop dword [rax]
cmp rax, 0x1e
jge 0x4a962d
movzx edx, byte [rsp + rax + 0x32]
movzx esi, byte [rsp + rax + 0x33]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x16
jae 0x4a9650
movzx r8d, byte [rsp + rdi + 0x1c]
sub r8d, edx
cmp rsi, 0x16
jb 0x4a95df
jmp 0x4a9644
xor eax, eax
lea rbx, [rsp + 0x1c]
mov ecx, 0x16
call fcn.00441980
add rsp, 0x50
pop rbp
ret
mov eax, esi
mov ecx, 0x16
call fcn.00452300
mov eax, edi
mov ecx, 0x16
call fcn.00452300
nop
nop dword [rax]
call fcn.00450080
jmp fcn.004a9560
Function at 0x4a9680
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4a978c
push rbp
mov rbp, rsp
sub rsp, 0x58
movabs rdx, 0xc938e3ce2f553cd9
mov qword [rsp + 0x19], rdx
movabs rdx, 0xdcd7916e673f7373
mov qword [rsp + 0x21], rdx
movabs rdx, 0x5465744265d6e6dc
mov qword [rsp + 0x28], rdx
movabs rdx, 0x81ce4772cd54cb20
mov qword [rsp + 0x30], rdx
movabs rdx, 0x10050a021619061c
mov qword [rsp + 0x38], rdx
movabs rdx, 0x1c07130e16190111
mov qword [rsp + 0x40], rdx
movabs rdx, 0x18021e061d0f0e03
mov qword [rsp + 0x48], rdx
movabs rdx, 0xe1a0d0d040a1100
mov qword [rsp + 0x50], rdx
xor eax, eax
jmp 0x4a9728
movzx r9d, byte [rsp + rsi + 0x19]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x73]
mov byte [rsp + rdi + 0x19], dl
mov byte [rsp + rsi + 0x19], r8b
add rax, 2
cmp rax, 0x20
jge 0x4a975c
movzx edx, byte [rsp + rax + 0x38]
movzx esi, byte [rsp + rax + 0x39]
mov edi, edx
xor edx, esi
add edx, eax
nop
cmp rdi, 0x1f
jae 0x4a977f
movzx r8d, byte [rsp + rdi + 0x19]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x73]
cmp rsi, 0x1f
jb 0x4a970e
jmp 0x4a9773
xor eax, eax
lea rbx, [rsp + 0x19]
mov ecx, 0x1f
call fcn.00441980
add rsp, 0x58
pop rbp
ret
mov eax, esi
mov ecx, 0x1f
call fcn.00452300
mov eax, edi
mov ecx, 0x1f
call fcn.00452300
nop
call fcn.00450080
jmp fcn.004a9680
Function at 0x4ac300
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4ac408
push rbp
mov rbp, rsp
sub rsp, 0x58
movabs rdx, 0x6369eea1ba666f63
mov qword [rsp + 0x1f], rdx
movabs rdx, 0xabdf20a86f8a3e98
mov qword [rsp + 0x27], rdx
movabs rdx, 0xa8edababdf20a86f
mov qword [rsp + 0x2a], rdx
movabs rdx, 0xa343cc73b86e05fe
mov qword [rsp + 0x32], rdx
movabs rdx, 0xc04111a080a1305
mov qword [rsp + 0x3a], rdx
movabs rdx, 0xa16140e12190e09
mov qword [rsp + 0x42], rdx
movabs rdx, 0xf0f120313020a16
mov qword [rsp + 0x48], rdx
movabs rdx, 0x1805090e101a0314
mov qword [rsp + 0x50], rdx
xor eax, eax
jmp 0x4ac3ab
movzx r9d, byte [rsp + rsi + 0x1f]
sub r9d, edx
lea edx, [r9 - 0x25]
mov byte [rsp + rdi + 0x1f], dl
lea edx, [r8 - 0x25]
mov byte [rsp + rsi + 0x1f], dl
add rax, 2
cmp rax, 0x1e
jge 0x4ac3d8
movzx edx, byte [rsp + rax + 0x3a]
movzx esi, byte [rsp + rax + 0x3b]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x1b
jae 0x4ac3fb
movzx r8d, byte [rsp + rdi + 0x1f]
sub r8d, edx
cmp rsi, 0x1b
jb 0x4ac38e
jmp 0x4ac3ef
xor eax, eax
lea rbx, [rsp + 0x1f]
mov ecx, 0x1b
call fcn.00441980
add rsp, 0x58
pop rbp
ret
mov eax, esi
mov ecx, 0x1b
call fcn.00452300
mov eax, edi
mov ecx, 0x1b
call fcn.00452300
nop
call fcn.00450080
jmp fcn.004ac300

Function at 0x4acfe0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4ad107
push rbp
mov rbp, rsp
sub rsp, 0x60
movabs rdx, 0xf0686e69742a52e1
mov qword [rsp + 0x1a], rdx
movabs rdx, 0xa53f8176f746f5b
mov qword [rsp + 0x22], rdx
movabs rdx, 0xcdd74b640a53f817
mov qword [rsp + 0x26], rdx
movabs rdx, 0xac017269d0e565e5
mov qword [rsp + 0x2e], rdx
movabs rdx, 0x1407020117001113
mov qword [rsp + 0x36], rdx
movabs rdx, 0x101000b12060800
mov qword [rsp + 0x3e], rdx
movabs rdx, 0xe0c0101000b1206
mov qword [rsp + 0x40], rdx
movabs rdx, 0xe131017120a0c16
mov qword [rsp + 0x48], rdx
movabs rdx, 0x12141a0217001416
mov qword [rsp + 0x50], rdx
movabs rdx, 0xf160d1b0b1b1008
mov qword [rsp + 0x58], rdx
xor eax, eax
jmp 0x4ad0a9
movzx r9d, byte [rsp + rsi + 0x1a]
sub r9d, edx
lea edx, [r9 - 0x58]
mov byte [rsp + rdi + 0x1a], dl
lea edx, [r8 - 0x58]
mov byte [rsp + rsi + 0x1a], dl
add rax, 2
cmp rax, 0x2a
jge 0x4ad0d7
movzx edx, byte [rsp + rax + 0x36]
movzx esi, byte [rsp + rax + 0x37]
mov edi, edx
xor edx, esi
add edx, eax
nop
cmp rdi, 0x1c
jae 0x4ad0fa
movzx r8d, byte [rsp + rdi + 0x1a]
sub r8d, edx
cmp rsi, 0x1c
jb 0x4ad08c
jmp 0x4ad0ee
xor eax, eax
lea rbx, [rsp + 0x1a]
mov ecx, 0x1c
call fcn.00441980
add rsp, 0x60
pop rbp
ret
mov eax, esi
mov ecx, 0x1c
call fcn.00452300
mov eax, edi
mov ecx, 0x1c
call fcn.00452300
nop
call fcn.00450080
jmp fcn.004acfe0
Function at 0x4ad120
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4ad247
push rbp
mov rbp, rsp
sub rsp, 0x68
movabs rdx, 0x9507a0728af8ddcd
mov qword [rsp + 0x1a], rdx
movabs rdx, 0x65f68a67728121fa
mov qword [rsp + 0x22], rdx
movabs rdx, 0xba9c917509630b96
mov qword [rsp + 0x2a], rdx
movabs rdx, 0xabe36180ba75099c
mov qword [rsp + 0x32], rdx
movabs rdx, 0xa1e0a01130e001c
mov qword [rsp + 0x3a], rdx
movabs rdx, 0x50e10091812161a
mov qword [rsp + 0x42], rdx
movabs rdx, 0xd0703151e18050e
mov qword [rsp + 0x48], rdx
movabs rdx, 0x6151f161c061005
mov qword [rsp + 0x50], rdx
movabs rdx, 0x19170308091b0111
mov qword [rsp + 0x58], rdx
movabs rdx, 0xd1a0702150e0500
mov qword [rsp + 0x60], rdx
xor eax, eax
jmp 0x4ad1e9
movzx r9d, byte [rsp + rsi + 0x1a]
sub r9d, edx
lea edx, [r9 - 0x68]
mov byte [rsp + rdi + 0x1a], dl
lea edx, [r8 - 0x68]
mov byte [rsp + rsi + 0x1a], dl
add rax, 2
cmp rax, 0x2e
jge 0x4ad217
movzx edx, byte [rsp + rax + 0x3a]
movzx esi, byte [rsp + rax + 0x3b]
mov edi, edx
xor edx, esi
add edx, eax
nop
cmp rdi, 0x20
jae 0x4ad23a
movzx r8d, byte [rsp + rdi + 0x1a]
sub r8d, edx
cmp rsi, 0x20
jb 0x4ad1cc
jmp 0x4ad22e
xor eax, eax
lea rbx, [rsp + 0x1a]
mov ecx, 0x20
call fcn.00441980
add rsp, 0x68
pop rbp
ret
mov eax, esi
mov ecx, 0x20
call fcn.00452300
mov eax, edi
mov ecx, 0x20
call fcn.00452300
nop
call fcn.00450080
jmp fcn.004ad120

Function at 0x4ad7e0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4ad8b2
push rbp
mov rbp, rsp
sub rsp, 0x38
movabs rdx, 0xc0ca7420cdbbbec3
mov qword [rsp + 0x1d], rdx
movabs rdx, 0x77c274c0ca7420cd
mov qword [rsp + 0x20], rdx
movabs rdx, 0x3070306060a0308
mov qword [rsp + 0x28], rdx
movabs rdx, 0x2060900010501
mov qword [rsp + 0x30], rdx
xor eax, eax
jmp 0x4ad84c
movzx r9d, byte [rsp + rsi + 0x1d]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x65]
mov byte [rsp + rdi + 0x1d], dl
mov byte [rsp + rsi + 0x1d], r8b
add rax, 2
cmp rax, 0x10
jge 0x4ad87e
movzx edx, byte [rsp + rax + 0x28]
movzx esi, byte [rsp + rax + 0x29]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0xb
jae 0x4ad8a5
movzx r8d, byte [rsp + rdi + 0x1d]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x65]
cmp rsi, 0xb
jb 0x4ad832
jmp 0x4ad895
xor eax, eax
lea rbx, [rsp + 0x1d]
mov ecx, 0xb
call fcn.00441980
add rsp, 0x38
pop rbp
ret
mov eax, esi
mov ecx, 0xb
nop dword [rax]
call fcn.00452300
mov eax, edi
mov ecx, 0xb
call fcn.00452300
nop
call fcn.00450080
jmp fcn.004ad7e0