joyce8/EMBER2024-capa huggingface dataset:
Function at 0x489800
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x489908
push rbp
mov rbp, rsp
sub rsp, 0x58
movabs rdx, 0x39b44434786cc5d0
mov qword [rsp + 0x1b], rdx
movabs rdx, 0x3bfbe01173d74a6d
mov qword [rsp + 0x23], rdx
movabs rdx, 0x72cd3ed5653bfbe0
mov qword [rsp + 0x28], rdx
movabs rdx, 0x30d935e5894f96e1
mov qword [rsp + 0x30], rdx
movabs rdx, 0xf0c01060e0a0313
mov qword [rsp + 0x38], rdx
movabs rdx, 0x1500111c09070f04
mov qword [rsp + 0x40], rdx
movabs rdx, 0xe0a0c161a0a0a05
mov qword [rsp + 0x48], rdx
movabs rdx, 0x19070f0d091b1118
mov qword [rsp + 0x50], rdx
xor eax, eax
jmp 0x4898ab
movzx r9d, byte [rsp + rsi + 0x1b]
sub r9d, edx
lea edx, [r9 - 0x48]
mov byte [rsp + rdi + 0x1b], dl
lea edx, [r8 - 0x48]
mov byte [rsp + rsi + 0x1b], dl
add rax, 2
cmp rax, 0x20
jge 0x4898d8
movzx edx, byte [rsp + rax + 0x38]
movzx esi, byte [rsp + rax + 0x39]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x1d
jae 0x4898fb
movzx r8d, byte [rsp + rdi + 0x1b]
sub r8d, edx
cmp rsi, 0x1d
jb 0x48988e
jmp 0x4898ef
xor eax, eax
lea rbx, [rsp + 0x1b]
mov ecx, 0x1d
call fcn.00441380
add rsp, 0x58
pop rbp
ret
mov eax, esi
mov ecx, 0x1d
call fcn.004518a0
mov eax, edi
mov ecx, 0x1d
call fcn.004518a0
nop
call fcn.0044f620
jmp fcn.00489800

Function at 0x489920
Capabilities:
Encrypt data using rc4 prga

Disassembly:
lea r12, [rsp - 8]
cmp r12, qword [r14 + 0x10]
jbe 0x489a87
push rbp
mov rbp, rsp
add rsp, 0xffffffffffffff80
movabs rdx, 0x3e5f6034340065b8
mov qword [rsp + 0x19], rdx
movabs rdx, 0x393540215a6e6966
mov qword [rsp + 0x21], rdx
movabs rdx, 0x72724d206c393540
mov qword [rsp + 0x26], rdx
movabs rdx, 0x100241694a0434f2
mov qword [rsp + 0x2e], rdx
movabs rdx, 0x61473b89125d660b
mov qword [rsp + 0x36], rdx
movabs rdx, 0x4668785127dd062c
mov qword [rsp + 0x3e], rdx
movabs rdx, 0x22031b0717001826
mov qword [rsp + 0x46], rdx
movabs rdx, 0x29001d040028150f
mov qword [rsp + 0x4e], rdx
movabs rdx, 0x1a1729001d040028
mov qword [rsp + 0x50], rdx
movabs rdx, 0x2a1a0220120d0f23
mov qword [rsp + 0x58], rdx
movabs rdx, 0x241c040e27251c16
mov qword [rsp + 0x60], rdx
movabs rdx, 0x2b1f2a1e02020825
mov qword [rsp + 0x68], rdx
movabs rdx, 0x1d06270c23171616
mov qword [rsp + 0x70], rdx
movabs rdx, 0x211a050b1e0b2b2c
mov qword [rsp + 0x78], rdx
xor eax, eax
jmp 0x489a2a
movzx r9d, byte [rsp + rsi + 0x19]
sub r9d, edx
lea edx, [r9 + 0x58]
mov byte [rsp + rdi + 0x19], dl
lea edx, [r8 + 0x58]
mov byte [rsp + rsi + 0x19], dl
add rax, 2
cmp rax, 0x3a
jge 0x489a57
movzx edx, byte [rsp + rax + 0x46]
movzx esi, byte [rsp + rax + 0x47]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x2d
jae 0x489a7a
movzx r8d, byte [rsp + rdi + 0x19]
sub r8d, edx
cmp rsi, 0x2d
jb 0x489a0d
jmp 0x489a6e
xor eax, eax
lea rbx, [rsp + 0x19]
mov ecx, 0x2d
call fcn.00441380
sub rsp, 0xffffffffffffff80
pop rbp
ret
mov eax, esi
mov ecx, 0x2d
call fcn.004518a0
mov eax, edi
mov ecx, 0x2d
call fcn.004518a0
nop
call fcn.0044f620
jmp fcn.00489920
Function at 0x489aa0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x489b5d
push rbp
mov rbp, rsp
sub rsp, 0x30
movabs rdx, 0x2708b7f16c667ff4
mov qword [rsp + 0x1b], rdx
mov byte [rsp + 0x23], 0xf7
movabs rdx, 0x705050801070804
mov qword [rsp + 0x24], rdx
mov dword [rsp + 0x2c], 0x60001
xor eax, eax
nop
jmp 0x489b00
movzx r9d, byte [rsp + rsi + 0x1b]
sub r9d, edx
lea edx, [r9 + 0x7a]
mov byte [rsp + rdi + 0x1b], dl
lea edx, [r8 + 0x7a]
mov byte [rsp + rsi + 0x1b], dl
add rax, 2
nop
cmp rax, 0xc
jge 0x489b2d
movzx edx, byte [rsp + rax + 0x24]
movzx esi, byte [rsp + rax + 0x25]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 9
jae 0x489b50
movzx r8d, byte [rsp + rdi + 0x1b]
sub r8d, edx
cmp rsi, 9
jb 0x489ae2
jmp 0x489b44
xor eax, eax
lea rbx, [rsp + 0x1b]
mov ecx, 9
call fcn.00441380
add rsp, 0x30
pop rbp
ret
mov eax, esi
mov ecx, 9
call fcn.004518a0
mov eax, edi
mov ecx, 9
call fcn.004518a0
nop
nop dword [rax]
call fcn.0044f620
jmp fcn.00489aa0
Function at 0x48ee80
Capabilities:
Encrypt data using rc4 prga

Disassembly:
lea r12, [rsp - 0x18]
cmp r12, qword [r14 + 0x10]
jbe 0x48f007
push rbp
mov rbp, rsp
sub rsp, 0x90
movabs rdx, 0x2eb6639199151dd8
mov qword [rsp + 0x1e], rdx
movabs rdx, 0x9b5336dc516cf600
mov qword [rsp + 0x26], rdx
movabs rdx, 0xbf20d365f3749b53
mov qword [rsp + 0x2c], rdx
movabs rdx, 0x552dfc20e663aec6
mov qword [rsp + 0x34], rdx
movabs rdx, 0x8a6cf28a3247842
mov qword [rsp + 0x3c], rdx
movabs rdx, 0x1a353319dd1a8eeb
mov qword [rsp + 0x44], rdx
movabs rdx, 0x24001e25031c1e0b
mov qword [rsp + 0x4c], rdx
movabs rdx, 0x2b150d0424001e25
mov qword [rsp + 0x50], rdx
movabs rdx, 0x232c0f2a17001623
mov qword [rsp + 0x58], rdx
movabs rdx, 0x1d1928201c011c13
mov qword [rsp + 0x60], rdx
movabs rdx, 0x212b261d22101716
mov qword [rsp + 0x68], rdx
movabs rdx, 0x152b130626270210
mov qword [rsp + 0x70], rdx
movabs rdx, 0x131b2d2b26270811
mov qword [rsp + 0x78], rdx
movabs rdx, 0x2919201922092613
mov qword [rsp + 0x80], rdx
movabs rdx, 0x260c2502130d002a
mov qword [rsp + 0x88], rdx
xor eax, eax
jmp 0x48efa0
movzx r9d, byte [rsp + rsi + 0x1e]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x1e]
mov byte [rsp + rdi + 0x1e], dl
mov byte [rsp + rsi + 0x1e], r8b
add rax, 2
nop
cmp rax, 0x44
jge 0x48efd2
movzx edx, byte [rsp + rax + 0x4c]
movzx esi, byte [rsp + rax + 0x4d]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x2e
jae 0x48effa
movzx r8d, byte [rsp + rdi + 0x1e]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x1e]
cmp rsi, 0x2e
jb 0x48ef85
jmp 0x48efee
xor eax, eax
lea rbx, [rsp + 0x1e]
mov ecx, 0x2e
nop
call fcn.00441380
add rsp, 0x90
pop rbp
ret
mov eax, esi
mov ecx, 0x2e
call fcn.004518a0
mov eax, edi
mov ecx, 0x2e
call fcn.004518a0
nop
call fcn.0044f620
jmp fcn.0048ee80

Function at 0x48f020
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x48f11d
push rbp
mov rbp, rsp
sub rsp, 0x50
movabs rdx, 0x147426296c0ddddf
mov qword [rsp + 0x1f], rdx
movabs rdx, 0x8e196c2e72147426
mov qword [rsp + 0x24], rdx
movabs rdx, 0x72242b7a6934f4d3
mov qword [rsp + 0x2c], rdx
movabs rdx, 0x513070108110b04
mov qword [rsp + 0x34], rdx
movabs rdx, 0xf020e0800110c
mov qword [rsp + 0x3c], rdx
movabs rdx, 0x1212110f000f020e
mov qword [rsp + 0x40], rdx
movabs rdx, 0xc0809020f020c0d
mov qword [rsp + 0x48], rdx
xor eax, eax
jmp 0x48f0c0
movzx r9d, byte [rsp + rsi + 0x1f]
sub r9d, edx
lea edx, [r9 + 0x5b]
mov byte [rsp + rdi + 0x1f], dl
lea edx, [r8 + 0x5b]
mov byte [rsp + rsi + 0x1f], dl
add rax, 2
nop dword [rax]
cmp rax, 0x1c
jge 0x48f0ed
movzx edx, byte [rsp + rax + 0x34]
movzx esi, byte [rsp + rax + 0x35]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x15
jae 0x48f110
movzx r8d, byte [rsp + rdi + 0x1f]
sub r8d, edx
cmp rsi, 0x15
jb 0x48f09f
jmp 0x48f104
xor eax, eax
lea rbx, [rsp + 0x1f]
mov ecx, 0x15
call fcn.00441380
add rsp, 0x50
pop rbp
ret
mov eax, esi
mov ecx, 0x15
call fcn.004518a0
mov eax, edi
mov ecx, 0x15
call fcn.004518a0
nop
nop dword [rax]
call fcn.0044f620
jmp fcn.0048f020
Function at 0x48f140
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x48f24c
push rbp
mov rbp, rsp
sub rsp, 0x58
movabs rdx, 0x3e740d659d861d72
mov qword [rsp + 0x1f], rdx
movabs rdx, 0x27e5de561fae563e
mov qword [rsp + 0x26], rdx
movabs rdx, 0x42a46874c14d17d5
mov qword [rsp + 0x2e], rdx
movabs rdx, 0x100a0c161607030d
mov qword [rsp + 0x36], rdx
movabs rdx, 0xb16100a0c161607
mov qword [rsp + 0x38], rdx
movabs rdx, 0xa120b070e030f0c
mov qword [rsp + 0x40], rdx
movabs rdx, 0x107090e0310160f
mov qword [rsp + 0x48], rdx
movabs rdx, 0x7020915160f1605
mov qword [rsp + 0x50], rdx
xor eax, eax
jmp 0x48f1e8
movzx r9d, byte [rsp + rsi + 0x1f]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x7d]
mov byte [rsp + rdi + 0x1f], dl
mov byte [rsp + rsi + 0x1f], r8b
add rax, 2
cmp rax, 0x22
jge 0x48f21c
movzx edx, byte [rsp + rax + 0x36]
movzx esi, byte [rsp + rax + 0x37]
mov edi, edx
xor edx, esi
add edx, eax
nop
cmp rdi, 0x17
jae 0x48f23f
movzx r8d, byte [rsp + rdi + 0x1f]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x7d]
cmp rsi, 0x17
jb 0x48f1ce
jmp 0x48f233
xor eax, eax
lea rbx, [rsp + 0x1f]
mov ecx, 0x17
call fcn.00441380
add rsp, 0x58
pop rbp
ret
mov eax, esi
mov ecx, 0x17
call fcn.004518a0
mov eax, edi
mov ecx, 0x17
call fcn.004518a0
nop
call fcn.0044f620
jmp fcn.0048f140

Function at 0x492160
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x49224c
push rbp
mov rbp, rsp
sub rsp, 0x40
movabs rdx, 0x2ed0638c9b66a5a2
mov qword [rsp + 0x1d], rdx
movabs rdx, 0x562ed0638c9b66a5
mov qword [rsp + 0x1e], rdx
movabs rdx, 0x9585492e93787c88
mov qword [rsp + 0x26], rdx
movabs rdx, 0xf0c0f100306010f
mov qword [rsp + 0x2e], rdx
movabs rdx, 0x3090f0c0f100306
mov qword [rsp + 0x30], rdx
movabs rdx, 0x90a100b0b040900
mov qword [rsp + 0x38], rdx
xor eax, eax
jmp 0x4921ea
movzx r9d, byte [rsp + rsi + 0x1d]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x2e]
mov byte [rsp + rdi + 0x1d], dl
mov byte [rsp + rsi + 0x1d], r8b
add rax, 2
cmp rax, 0x12
jge 0x49221c
movzx edx, byte [rsp + rax + 0x2e]
movzx esi, byte [rsp + rax + 0x2f]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x11
jae 0x49223f
movzx r8d, byte [rsp + rdi + 0x1d]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x2e]
cmp rsi, 0x11
jb 0x4921d0
jmp 0x492233
xor eax, eax
lea rbx, [rsp + 0x1d]
mov ecx, 0x11
call fcn.00441380
add rsp, 0x40
pop rbp
ret
mov eax, esi
mov ecx, 0x11
call fcn.004518a0
mov eax, edi
mov ecx, 0x11
call fcn.004518a0
nop
call fcn.0044f620
jmp fcn.00492160
Function at 0x4923a0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x492466
push rbp
mov rbp, rsp
sub rsp, 0x30
movabs rdx, 0xd74c87c8b30715cc
mov qword [rsp + 0x1d], rdx
mov byte [rsp + 0x25], 0x10
movabs rdx, 0x804050701000403
mov qword [rsp + 0x26], rdx
mov word [rsp + 0x2e], 0x702
xor eax, eax
nop
jmp 0x492400
movzx r9d, byte [rsp + rsi + 0x1d]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x51]
mov byte [rsp + rdi + 0x1d], dl
mov byte [rsp + rsi + 0x1d], r8b
add rax, 2
nop dword [rax]
cmp rax, 0xa
jge 0x492432
movzx edx, byte [rsp + rax + 0x26]
movzx esi, byte [rsp + rax + 0x27]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 9
jae 0x492457
movzx r8d, byte [rsp + rdi + 0x1d]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x51]
cmp rsi, 9
jb 0x4923e2
jmp 0x49244b
xor eax, eax
lea rbx, [rsp + 0x1d]
mov ecx, 9
nop
call fcn.00441380
add rsp, 0x30
pop rbp
ret
mov eax, esi
mov ecx, 9
call fcn.004518a0
mov eax, edi
mov ecx, 9
nop
call fcn.004518a0
nop
call fcn.0044f620
jmp fcn.004923a0

Function at 0x492c60
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x492d4a
push rbp
mov rbp, rsp
sub rsp, 0x48
movabs rdx, 0x4d917b017023ec2
mov qword [rsp + 0x1d], rdx
movabs rdx, 0x6c115604d917b017
mov qword [rsp + 0x20], rdx
movabs rdx, 0x2c283869222e35d0
mov qword [rsp + 0x28], rdx
movabs rdx, 0x612120b04070c0b
mov qword [rsp + 0x30], rdx
movabs rdx, 0x1203110c01090300
mov qword [rsp + 0x38], rdx
movabs rdx, 0x20e100605070905
mov qword [rsp + 0x40], rdx
xor eax, eax
jmp 0x492ced
movzx r9d, byte [rsp + rsi + 0x1d]
sub r9d, edx
lea edx, [r9 + 0x66]
mov byte [rsp + rdi + 0x1d], dl
lea edx, [r8 + 0x66]
mov byte [rsp + rsi + 0x1d], dl
add rax, 2
cmp rax, 0x18
jge 0x492d1a
movzx edx, byte [rsp + rax + 0x30]
movzx esi, byte [rsp + rax + 0x31]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x13
jae 0x492d3d
movzx r8d, byte [rsp + rdi + 0x1d]
sub r8d, edx
cmp rsi, 0x13
jb 0x492cd0
jmp 0x492d31
xor eax, eax
lea rbx, [rsp + 0x1d]
mov ecx, 0x13
call fcn.00441380
add rsp, 0x48
pop rbp
ret
mov eax, esi
mov ecx, 0x13
call fcn.004518a0
mov eax, edi
mov ecx, 0x13
call fcn.004518a0
nop
call fcn.0044f620
jmp fcn.00492c60
Function at 0x493640
Capabilities:
Encrypt data using rc4 prga

Disassembly:
lea r12, [rsp - 0x30]
cmp r12, qword [r14 + 0x10]
jbe 0x4937fb
push rbp
mov rbp, rsp
sub rsp, 0xa8
movabs rdx, 0x3f2063bc2f7cd615
mov qword [rsp + 0x1f], rdx
movabs rdx, 0x6623b45c6665725c
mov qword [rsp + 0x27], rdx
movabs rdx, 0xc3e62e6623b45c66
mov qword [rsp + 0x2a], rdx
movabs rdx, 0xc0b920453cc1756c
mov qword [rsp + 0x32], rdx
movabs rdx, 0x69ad6eff2dc86f20
mov qword [rsp + 0x3a], rdx
movabs rdx, 0x6e1acbd46c6176fe
mov qword [rsp + 0x42], rdx
movabs rdx, 0x256172d26e1d866f
mov qword [rsp + 0x4a], rdx
movabs rdx, 0x3d1f30275466fa17
mov qword [rsp + 0x52], rdx
movabs rdx, 0x123306080133061d
mov qword [rsp + 0x5a], rdx
movabs rdx, 0x15213416190e111a
mov qword [rsp + 0x62], rdx
movabs rdx, 0x40c043a3a0c1521
mov qword [rsp + 0x68], rdx
movabs rdx, 0x2071d1936003827
mov qword [rsp + 0x70], rdx
movabs rdx, 0x1350d2d1e0e1212
mov qword [rsp + 0x78], rdx
movabs rdx, 0x1f273807380f0830
mov qword [rsp + 0x80], rdx
movabs rdx, 0x35000c18231a0835
mov qword [rsp + 0x88], rdx
movabs rdx, 0x32d030004330121
mov qword [rsp + 0x90], rdx
movabs rdx, 0x1e1f2f2939393732
mov qword [rsp + 0x98], rdx
movabs rdx, 0x28113835153a2c3a
mov qword [rsp + 0xa0], rdx
xor eax, eax
jmp 0x493795
movzx r9d, byte [rsp + rsi + 0x1f]
lea edx, [r9 + rdx]
lea edx, [rdx + 6]
mov byte [rsp + rdi + 0x1f], dl
mov byte [rsp + rsi + 0x1f], r8b
add rax, 2
cmp rax, 0x4e
jge 0x4937c8
movzx edx, byte [rsp + rax + 0x5a]
movzx esi, byte [rsp + rax + 0x5b]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x3b
jae 0x4937ee
movzx r8d, byte [rsp + rdi + 0x1f]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 6]
nop
cmp rsi, 0x3b
jb 0x49377b
jmp 0x4937e2
xor eax, eax
lea rbx, [rsp + 0x1f]
mov ecx, 0x3b
call fcn.00441380
add rsp, 0xa8
pop rbp
ret
mov eax, esi
mov ecx, 0x3b
call fcn.004518a0
mov eax, edi
mov ecx, 0x3b
call fcn.004518a0
nop
nop dword [rax + rax]
call fcn.0044f620
jmp fcn.00493640
Function at 0x495080
Capabilities:
Encrypt data using rc4 prga

Disassembly:
lea r12, [rsp - 0x28]
cmp r12, qword [r14 + 0x10]
jbe 0x495228
push rbp
mov rbp, rsp
sub rsp, 0xa0
movabs rdx, 0x744511352d176f6e
mov qword [rsp + 0x1a], rdx
movabs rdx, 0xa874e269f870fbf6
mov qword [rsp + 0x22], rdx
movabs rdx, 0x6170e02a1774a808
mov qword [rsp + 0x2a], rdx
movabs rdx, 0x289ac36b64e2c973
mov qword [rsp + 0x32], rdx
movabs rdx, 0xc1cd0e6c3e6f6ef1
mov qword [rsp + 0x3a], rdx
movabs rdx, 0xcd4084ee3d58af53
mov qword [rsp + 0x42], rdx
movabs rdx, 0xe865792d281b20b7
mov qword [rsp + 0x4a], rdx
movabs rdx, 0x27112b2a34280232
mov qword [rsp + 0x52], rdx
movabs rdx, 0x240d2020250f0414
mov qword [rsp + 0x5a], rdx
movabs rdx, 0x1f1c05330d1d240d
mov qword [rsp + 0x60], rdx
movabs rdx, 0x13232d13102e2923
mov qword [rsp + 0x68], rdx
movabs rdx, 0x27300b3306102c12
mov qword [rsp + 0x70], rdx
movabs rdx, 0x332c3206272e3506
mov qword [rsp + 0x78], rdx
movabs rdx, 0x37062b09102c2935
mov qword [rsp + 0x80], rdx
movabs rdx, 0x50d2d1c081d1e24
mov qword [rsp + 0x88], rdx
movabs rdx, 0x1926091f1a2f1e27
mov qword [rsp + 0x90], rdx
movabs rdx, 0xd0b2d3515342925
mov qword [rsp + 0x98], rdx
xor eax, eax
jmp 0x4951c3
movzx r9d, byte [rsp + rsi + 0x1a]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x23]
mov byte [rsp + rdi + 0x1a], dl
mov byte [rsp + rsi + 0x1a], r8b
add rax, 2
cmp rax, 0x4e
jge 0x4951f5
movzx edx, byte [rsp + rax + 0x52]
movzx esi, byte [rsp + rax + 0x53]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x38
jae 0x49521b
movzx r8d, byte [rsp + rdi + 0x1a]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x23]
cmp rsi, 0x38
jb 0x4951a9
jmp 0x49520f
xor eax, eax
lea rbx, [rsp + 0x1a]
mov ecx, 0x38
call fcn.00441380
add rsp, 0xa0
pop rbp
ret
mov eax, esi
mov ecx, 0x38
call fcn.004518a0
mov eax, edi
mov ecx, 0x38
call fcn.004518a0
nop
call fcn.0044f620
jmp fcn.00495080

Function at 0x495240
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x49532a
push rbp
mov rbp, rsp
sub rsp, 0x40
movabs rdx, 0x752c7a6f896f8433
mov qword [rsp + 0x19], rdx
movabs rdx, 0x74752c7a6f896f84
mov qword [rsp + 0x1a], rdx
movabs rdx, 0x826c8b7979656a79
mov qword [rsp + 0x22], rdx
movabs rdx, 0x10000d00050c0a02
mov qword [rsp + 0x2a], rdx
movabs rdx, 0x30701030d0f1000
mov qword [rsp + 0x30], rdx
movabs rdx, 0x70601080f0c0e08
mov qword [rsp + 0x38], rdx
xor eax, eax
jmp 0x4952cd
movzx r9d, byte [rsp + rsi + 0x19]
sub r9d, edx
lea edx, [r9 + 9]
mov byte [rsp + rdi + 0x19], dl
lea edx, [r8 + 9]
mov byte [rsp + rsi + 0x19], dl
add rax, 2
cmp rax, 0x16
jge 0x4952fa
movzx edx, byte [rsp + rax + 0x2a]
movzx esi, byte [rsp + rax + 0x2b]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x11
jae 0x49531d
movzx r8d, byte [rsp + rdi + 0x19]
sub r8d, edx
cmp rsi, 0x11
jb 0x4952b0
jmp 0x495311
xor eax, eax
lea rbx, [rsp + 0x19]
mov ecx, 0x11
call fcn.00441380
add rsp, 0x40
pop rbp
ret
mov eax, esi
mov ecx, 0x11
call fcn.004518a0
mov eax, edi
mov ecx, 0x11
call fcn.004518a0
nop
call fcn.0044f620
jmp fcn.00495240
Function at 0x496d00
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x496dec
push rbp
mov rbp, rsp
sub rsp, 0x48
movabs rdx, 0x65bac421ca6f2562
mov qword [rsp + 0x1b], rdx
movabs rdx, 0x63c4f5692065bac4
mov qword [rsp + 0x20], rdx
movabs rdx, 0x7bb4e31361c66da0
mov qword [rsp + 0x28], rdx
movabs rdx, 0xd040d1205010212
mov qword [rsp + 0x30], rdx
movabs rdx, 0x1414030406110213
mov qword [rsp + 0x38], rdx
movabs rdx, 0xb1206050a0b0d0f
mov qword [rsp + 0x40], rdx
xor eax, eax
jmp 0x496d8a
movzx r9d, byte [rsp + rsi + 0x1b]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x69]
mov byte [rsp + rdi + 0x1b], dl
mov byte [rsp + rsi + 0x1b], r8b
add rax, 2
cmp rax, 0x18
jge 0x496dbc
movzx edx, byte [rsp + rax + 0x30]
movzx esi, byte [rsp + rax + 0x31]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x15
jae 0x496ddf
movzx r8d, byte [rsp + rdi + 0x1b]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x69]
cmp rsi, 0x15
jb 0x496d70
jmp 0x496dd3
xor eax, eax
lea rbx, [rsp + 0x1b]
mov ecx, 0x15
call fcn.00441380
add rsp, 0x48
pop rbp
ret
mov eax, esi
mov ecx, 0x15
call fcn.004518a0
mov eax, edi
mov ecx, 0x15
call fcn.004518a0
nop
call fcn.0044f620
jmp fcn.00496d00

Function at 0x497bc0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x497cbb
push rbp
mov rbp, rsp
sub rsp, 0x48
movabs rdx, 0x6f695877637c8353
mov qword [rsp + 0x18], rdx
movabs rdx, 0x6945715c6f695877
mov qword [rsp + 0x1c], rdx
movabs rdx, 0x5e388212757d885f
mov qword [rsp + 0x24], rdx
movabs rdx, 0xe0c0c1112020d01
mov qword [rsp + 0x2c], rdx
movabs rdx, 0xe01110e09130a04
mov qword [rsp + 0x34], rdx
movabs rdx, 0x70f08120e01110e
mov qword [rsp + 0x38], rdx
movabs rdx, 0x1005030f0d0b020b
mov qword [rsp + 0x40], rdx
xor eax, eax
jmp 0x497c59
movzx r9d, byte [rsp + rsi + 0x18]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x21]
mov byte [rsp + rdi + 0x18], dl
mov byte [rsp + rsi + 0x18], r8b
add rax, 2
cmp rax, 0x1c
jge 0x497c8b
movzx edx, byte [rsp + rax + 0x2c]
movzx esi, byte [rsp + rax + 0x2d]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x14
jae 0x497cae
movzx r8d, byte [rsp + rdi + 0x18]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x21]
cmp rsi, 0x14
jb 0x497c3f
jmp 0x497ca2
xor eax, eax
lea rbx, [rsp + 0x18]
mov ecx, 0x14
call fcn.00441380
add rsp, 0x48
pop rbp
ret
mov eax, esi
mov ecx, 0x14
call fcn.004518a0
mov eax, edi
mov ecx, 0x14
call fcn.004518a0
nop
nop dword [rax + rax]
call fcn.0044f620
jmp fcn.00497bc0
Function at 0x4987a0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x498886
push rbp
mov rbp, rsp
sub rsp, 0x40
movabs rdx, 0x20dbead8695ae569
mov qword [rsp + 0x1a], rdx
movabs rdx, 0xe46ee9ef75d45a61
mov qword [rsp + 0x22], rdx
movabs rdx, 0x1030c0c0a02040a
mov qword [rsp + 0x2a], rdx
movabs rdx, 0xa060d0209050103
mov qword [rsp + 0x30], rdx
movabs rdx, 0x5010f0c0c0c0401
mov qword [rsp + 0x38], rdx
xor eax, eax
nop
jmp 0x498820
movzx r9d, byte [rsp + rsi + 0x1a]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x74]
mov byte [rsp + rdi + 0x1a], dl
mov byte [rsp + rsi + 0x1a], r8b
add rax, 2
nop dword [rax]
cmp rax, 0x16
jge 0x498852
movzx edx, byte [rsp + rax + 0x2a]
movzx esi, byte [rsp + rax + 0x2b]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x10
jae 0x498877
movzx r8d, byte [rsp + rdi + 0x1a]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x74]
cmp rsi, 0x10
jb 0x498802
jmp 0x49886b
xor eax, eax
lea rbx, [rsp + 0x1a]
mov ecx, 0x10
nop
call fcn.00441380
add rsp, 0x40
pop rbp
ret
mov eax, esi
mov ecx, 0x10
call fcn.004518a0
mov eax, edi
mov ecx, 0x10
nop
call fcn.004518a0
nop
call fcn.0044f620
jmp fcn.004987a0

Function at 0x49a260
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x49a32a
push rbp
mov rbp, rsp
sub rsp, 0x48
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x58], rax
mov qword [rsp], rax
mov qword [rsp + 8], rbx
mov byte [rsp + 0x10], 0
call fcn.00403080
xorps xmm15, xmm15
mov r14, qword [0x007f2950]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x18], 0xffffffffffffffff
jne 0x49a30f
mov rcx, qword [rsp + 0x60]
lea rdx, [rcx + 1]
mov qword [rsp + 0x40], rdx
lea rax, [0x0051d1c0]
xor ebx, ebx
mov rcx, rdx
call fcn.0043dec0
mov rbx, qword [rsp + 0x60]
mov rcx, rax
xor edi, edi
mov rsi, qword [rsp + 0x40]
mov rax, qword [rsp + 0x58]
nop dword [rax]
call fcn.0049c940
inc rbx
cmp rcx, rbx
jae 0x49a2fe
mov edi, 1
lea rsi, [0x0051d1c0]
call fcn.0043dfa0
mov word [rax + rbx*2 - 2], 0
xor edi, edi
xor esi, esi
add rsp, 0x48
pop rbp
ret
xor eax, eax
xor ebx, ebx
mov rcx, rbx
lea rdi, [0x0070dda8]
lea rsi, [0x0070da08]
add rsp, 0x48
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.0044f620
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.0049a260
Function at 0x49ac80
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x49ad7b
push rbp
mov rbp, rsp
sub rsp, 0x50
movabs rdx, 0x72272fbded3e2c3e
mov qword [rsp + 0x1d], rdx
movabs rdx, 0xdd2ff161d272272f
mov qword [rsp + 0x22], rdx
movabs rdx, 0x7432723411292294
mov qword [rsp + 0x2a], rdx
movabs rdx, 0xa100d0411031410
mov qword [rsp + 0x32], rdx
movabs rdx, 0xb02100c1404000a
mov qword [rsp + 0x3a], rdx
movabs rdx, 0x130d0008140b02
mov qword [rsp + 0x40], rdx
movabs rdx, 0x614080f110e010d
mov qword [rsp + 0x48], rdx
xor eax, eax
jmp 0x49ad19
movzx r9d, byte [rsp + rsi + 0x1d]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x1b]
mov byte [rsp + rdi + 0x1d], dl
mov byte [rsp + rsi + 0x1d], r8b
add rax, 2
cmp rax, 0x1e
jge 0x49ad4b
movzx edx, byte [rsp + rax + 0x32]
movzx esi, byte [rsp + rax + 0x33]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x15
jae 0x49ad6e
movzx r8d, byte [rsp + rdi + 0x1d]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x1b]
cmp rsi, 0x15
jb 0x49acff
jmp 0x49ad62
xor eax, eax
lea rbx, [rsp + 0x1d]
mov ecx, 0x15
call fcn.00441380
add rsp, 0x50
pop rbp
ret
mov eax, esi
mov ecx, 0x15
call fcn.004518a0
mov eax, edi
mov ecx, 0x15
call fcn.004518a0
nop
nop dword [rax + rax]
call fcn.0044f620
jmp fcn.0049ac80

Function at 0x49c4c0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x49c5bb
push rbp
mov rbp, rsp
sub rsp, 0x50
movabs rdx, 0xe01860aa36b12f3f
mov qword [rsp + 0x1a], rdx
movabs rdx, 0x33314e753164e018
mov qword [rsp + 0x20], rdx
movabs rdx, 0xd0035f8c82306d68
mov qword [rsp + 0x28], rdx
movabs rdx, 0x4110a0715001411
mov qword [rsp + 0x30], rdx
movabs rdx, 0x13050a1304060104
mov qword [rsp + 0x38], rdx
movabs rdx, 0xf00060f0e040402
mov qword [rsp + 0x40], rdx
movabs rdx, 0x80f0b11020f1112
mov qword [rsp + 0x48], rdx
xor eax, eax
jmp 0x49c559
movzx r9d, byte [rsp + rsi + 0x1a]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x56]
mov byte [rsp + rdi + 0x1a], dl
mov byte [rsp + rsi + 0x1a], r8b
add rax, 2
cmp rax, 0x20
jge 0x49c58b
movzx edx, byte [rsp + rax + 0x30]
movzx esi, byte [rsp + rax + 0x31]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x16
jae 0x49c5ae
movzx r8d, byte [rsp + rdi + 0x1a]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x56]
cmp rsi, 0x16
jb 0x49c53f
jmp 0x49c5a2
xor eax, eax
lea rbx, [rsp + 0x1a]
mov ecx, 0x16
call fcn.00441380
add rsp, 0x50
pop rbp
ret
mov eax, esi
mov ecx, 0x16
call fcn.004518a0
mov eax, edi
mov ecx, 0x16
call fcn.004518a0
nop
nop dword [rax + rax]
call fcn.0044f620
jmp fcn.0049c4c0