joyce8/EMBER2024-capa huggingface dataset:
Function at 0x47fde0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x47fea6
push rbp
mov rbp, rsp
sub rsp, 0x30
movabs rdx, 0xec457be5615673e6
mov qword [rsp + 0x1b], rdx
mov byte [rsp + 0x23], 0x65
movabs rdx, 0x2020206010105
mov qword [rsp + 0x24], rdx
mov dword [rsp + 0x2c], 0x5010704
xor eax, eax
nop
jmp 0x47fe40
movzx r9d, byte [rsp + rsi + 0x1b]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x75]
mov byte [rsp + rdi + 0x1b], dl
mov byte [rsp + rsi + 0x1b], r8b
add rax, 2
nop dword [rax]
cmp rax, 0xc
jge 0x47fe72
movzx edx, byte [rsp + rax + 0x24]
movzx esi, byte [rsp + rax + 0x25]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 9
jae 0x47fe97
movzx r8d, byte [rsp + rdi + 0x1b]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x75]
cmp rsi, 9
jb 0x47fe22
jmp 0x47fe8b
xor eax, eax
lea rbx, [rsp + 0x1b]
mov ecx, 9
nop
call fcn.00443420
add rsp, 0x30
pop rbp
ret
mov eax, esi
mov ecx, 9
call fcn.00454ec0
mov eax, edi
mov ecx, 9
nop
call fcn.00454ec0
nop
call fcn.00452c40
jmp fcn.0047fde0

Function at 0x480100
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4801cc
push rbp
mov rbp, rsp
sub rsp, 0x30
movabs rdx, 0x63b6a9ba6eb6b5bd
mov qword [rsp + 0x19], rdx
movabs rdx, 0xe699b663b6a9ba6e
mov qword [rsp + 0x1c], rdx
movabs rdx, 0x404080800090a04
mov qword [rsp + 0x24], rdx
mov dword [rsp + 0x2c], 0x5020106
xor eax, eax
jmp 0x480165
movzx r9d, byte [rsp + rsi + 0x19]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x55]
mov byte [rsp + rdi + 0x19], dl
mov byte [rsp + rsi + 0x19], r8b
add rax, 2
cmp rax, 0xc
jge 0x48019c
movzx edx, byte [rsp + rax + 0x24]
movzx esi, byte [rsp + rax + 0x25]
mov edi, edx
xor edx, esi
add edx, eax
nop dword [rax + rax]
cmp rdi, 0xb
jae 0x4801bf
movzx r8d, byte [rsp + rdi + 0x19]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x55]
cmp rsi, 0xb
jb 0x48014b
jmp 0x4801b3
xor eax, eax
lea rbx, [rsp + 0x19]
mov ecx, 0xb
call fcn.00443420
add rsp, 0x30
pop rbp
ret
mov eax, esi
mov ecx, 0xb
call fcn.00454ec0
mov eax, edi
mov ecx, 0xb
call fcn.00454ec0
nop
call fcn.00452c40
jmp fcn.00480100

Function at 0x4801e0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4802a6
push rbp
mov rbp, rsp
sub rsp, 0x30
movabs rdx, 0x906ee3f764896500
mov qword [rsp + 0x24], rdx
mov dword [rsp + 0x2c], 0xea00ce6a
movabs rdx, 0x50009040a070207
mov qword [rsp + 0x18], rdx
mov dword [rsp + 0x20], 0xb020208
xor eax, eax
jmp 0x480240
movzx r9d, byte [rsp + rsi + 0x24]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x64]
mov byte [rsp + rdi + 0x24], dl
mov byte [rsp + rsi + 0x24], r8b
add rax, 2
nop
cmp rax, 0xc
jge 0x480272
movzx edx, byte [rsp + rax + 0x18]
movzx esi, byte [rsp + rax + 0x19]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0xc
jae 0x480297
movzx r8d, byte [rsp + rdi + 0x24]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x64]
cmp rsi, 0xc
jb 0x480224
jmp 0x48028b
xor eax, eax
lea rbx, [rsp + 0x24]
mov ecx, 0xc
nop
call fcn.00443420
add rsp, 0x30
pop rbp
ret
mov eax, esi
mov ecx, 0xc
call fcn.00454ec0
mov eax, edi
mov ecx, 0xc
nop
call fcn.00454ec0
nop
call fcn.00452c40
jmp fcn.004801e0
Function at 0x480560
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x480618
push rbp
mov rbp, rsp
sub rsp, 0x30
movabs rdx, 0xdce3a2466439653e
mov qword [rsp + 0x1e], rdx
movabs rdx, 0x2020707050606
mov qword [rsp + 0x26], rdx
mov word [rsp + 0x2e], 0x702
xor eax, eax
jmp 0x4805b5
movzx r9d, byte [rsp + rsi + 0x1e]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x77]
mov byte [rsp + rdi + 0x1e], dl
mov byte [rsp + rsi + 0x1e], r8b
add rax, 2
cmp rax, 0xa
jge 0x4805e8
movzx edx, byte [rsp + rax + 0x26]
movzx esi, byte [rsp + rax + 0x27]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 8
jae 0x48060b
movzx r8d, byte [rsp + rdi + 0x1e]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x77]
nop
cmp rsi, 8
jb 0x48059b
jmp 0x4805ff
xor eax, eax
lea rbx, [rsp + 0x1e]
mov ecx, 8
call fcn.00443420
add rsp, 0x30
pop rbp
ret
mov eax, esi
mov ecx, 8
call fcn.00454ec0
mov eax, edi
mov ecx, 8
call fcn.00454ec0
nop
call fcn.00452c40
nop dword [rax]
jmp fcn.00480560

Function at 0x4826a0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x48279d
push rbp
mov rbp, rsp
sub rsp, 0x48
movabs rdx, 0x716a8573747d5c85
mov qword [rsp + 0x1b], rdx
movabs rdx, 0xa0ba69716a857374
mov qword [rsp + 0x1e], rdx
movabs rdx, 0x79916592624f9c8e
mov qword [rsp + 0x26], rdx
movabs rdx, 0xc07020401040504
mov qword [rsp + 0x2e], rdx
movabs rdx, 0x20407120112050f
mov qword [rsp + 0x36], rdx
movabs rdx, 0x911020407120112
mov qword [rsp + 0x38], rdx
movabs rdx, 0x505110b050a0006
mov qword [rsp + 0x40], rdx
xor eax, eax
jmp 0x482740
movzx r9d, byte [rsp + rsi + 0x1b]
sub r9d, edx
lea edx, [r9 + 5]
mov byte [rsp + rdi + 0x1b], dl
lea edx, [r8 + 5]
mov byte [rsp + rsi + 0x1b], dl
add rax, 2
nop dword [rax]
cmp rax, 0x1a
jge 0x48276d
movzx edx, byte [rsp + rax + 0x2e]
movzx esi, byte [rsp + rax + 0x2f]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x13
jae 0x482790
movzx r8d, byte [rsp + rdi + 0x1b]
sub r8d, edx
cmp rsi, 0x13
jb 0x48271f
jmp 0x482784
xor eax, eax
lea rbx, [rsp + 0x1b]
mov ecx, 0x13
call fcn.00443420
add rsp, 0x48
pop rbp
ret
mov eax, esi
mov ecx, 0x13
call fcn.00454ec0
mov eax, edi
mov ecx, 0x13
call fcn.00454ec0
nop
nop dword [rax]
call fcn.00452c40
jmp fcn.004826a0
Function at 0x483b20
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x483c06
push rbp
mov rbp, rsp
sub rsp, 0x38
movabs rdx, 0xaedb7459f261f254
mov qword [rsp + 0x18], rdx
movabs rdx, 0x574b565ae4d7aedb
mov qword [rsp + 0x1e], rdx
movabs rdx, 0x6080a070b070105
mov qword [rsp + 0x26], rdx
movabs rdx, 0x10306080a070b07
mov qword [rsp + 0x28], rdx
movabs rdx, 0x40c0c0407090b07
mov qword [rsp + 0x30], rdx
xor eax, eax
nop
jmp 0x483ba0
movzx r9d, byte [rsp + rsi + 0x18]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x76]
mov byte [rsp + rdi + 0x18], dl
mov byte [rsp + rsi + 0x18], r8b
add rax, 2
nop dword [rax]
cmp rax, 0x12
jge 0x483bd2
movzx edx, byte [rsp + rax + 0x26]
movzx esi, byte [rsp + rax + 0x27]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0xe
jae 0x483bf7
movzx r8d, byte [rsp + rdi + 0x18]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x76]
cmp rsi, 0xe
jb 0x483b82
jmp 0x483beb
xor eax, eax
lea rbx, [rsp + 0x18]
mov ecx, 0xe
nop
call fcn.00443420
add rsp, 0x38
pop rbp
ret
mov eax, esi
mov ecx, 0xe
call fcn.00454ec0
mov eax, edi
mov ecx, 0xe
nop
call fcn.00454ec0
nop
call fcn.00452c40
jmp fcn.00483b20

Function at 0x484b00
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x484bb8
push rbp
mov rbp, rsp
sub rsp, 0x30
movabs rdx, 0x5c7463c649b72c57
mov qword [rsp + 0x1e], rdx
movabs rdx, 0x702010402020202
mov qword [rsp + 0x26], rdx
mov word [rsp + 0x2e], 0x402
xor eax, eax
jmp 0x484b58
movzx r9d, byte [rsp + rsi + 0x1e]
sub r9d, edx
lea edx, [r9 - 0x6a]
mov byte [rsp + rdi + 0x1e], dl
lea edx, [r8 - 0x6a]
mov byte [rsp + rsi + 0x1e], dl
add rax, 2
cmp rax, 0xa
jge 0x484b88
movzx edx, byte [rsp + rax + 0x26]
movzx esi, byte [rsp + rax + 0x27]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 8
jae 0x484bab
movzx r8d, byte [rsp + rdi + 0x1e]
sub r8d, edx
nop dword [rax]
cmp rsi, 8
jb 0x484b3b
jmp 0x484b9f
xor eax, eax
lea rbx, [rsp + 0x1e]
mov ecx, 8
call fcn.00443420
add rsp, 0x30
pop rbp
ret
mov eax, esi
mov ecx, 8
call fcn.00454ec0
mov eax, edi
mov ecx, 8
call fcn.00454ec0
nop
call fcn.00452c40
nop dword [rax]
jmp fcn.00484b00

Function at 0x484e40
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x484f06
push rbp
mov rbp, rsp
sub rsp, 0x30
movabs rdx, 0x547a9c6553df0457
mov qword [rsp + 0x1d], rdx
mov byte [rsp + 0x25], 0xdf
movabs rdx, 0x206080108080801
mov qword [rsp + 0x26], rdx
mov word [rsp + 0x2e], 0x506
xor eax, eax
nop
jmp 0x484ea0
movzx r9d, byte [rsp + rsi + 0x1d]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x43]
mov byte [rsp + rdi + 0x1d], dl
mov byte [rsp + rsi + 0x1d], r8b
add rax, 2
nop dword [rax]
cmp rax, 0xa
jge 0x484ed2
movzx edx, byte [rsp + rax + 0x26]
movzx esi, byte [rsp + rax + 0x27]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 9
jae 0x484ef7
movzx r8d, byte [rsp + rdi + 0x1d]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x43]
cmp rsi, 9
jb 0x484e82
jmp 0x484eeb
xor eax, eax
lea rbx, [rsp + 0x1d]
mov ecx, 9
nop
call fcn.00443420
add rsp, 0x30
pop rbp
ret
mov eax, esi
mov ecx, 9
call fcn.00454ec0
mov eax, edi
mov ecx, 9
nop
call fcn.00454ec0
nop
call fcn.00452c40
jmp fcn.00484e40
Function at 0x484f20
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x484fec
push rbp
mov rbp, rsp
sub rsp, 0x30
movabs rdx, 0x2ebf76c534153fb
mov qword [rsp + 0x18], rdx
mov word [rsp + 0x20], 0x6367
movabs rdx, 0x609090407000808
mov qword [rsp + 0x22], rdx
movabs rdx, 0x504080800080609
mov qword [rsp + 0x28], rdx
xor eax, eax
jmp 0x484f84
movzx r9d, byte [rsp + rsi + 0x18]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x70]
mov byte [rsp + rdi + 0x18], dl
mov byte [rsp + rsi + 0x18], r8b
add rax, 2
cmp rax, 0xe
jge 0x484fbc
movzx edx, byte [rsp + rax + 0x22]
movzx esi, byte [rsp + rax + 0x23]
mov edi, edx
xor edx, esi
add edx, eax
nop word [rax + rax]
cmp rdi, 0xa
jae 0x484fdf
movzx r8d, byte [rsp + rdi + 0x18]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x70]
cmp rsi, 0xa
jb 0x484f6a
jmp 0x484fd3
xor eax, eax
lea rbx, [rsp + 0x18]
mov ecx, 0xa
call fcn.00443420
add rsp, 0x30
pop rbp
ret
mov eax, esi
mov ecx, 0xa
call fcn.00454ec0
mov eax, edi
mov ecx, 0xa
call fcn.00454ec0
nop
call fcn.00452c40
jmp fcn.00484f20

Function at 0x492180
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x492258
push rbp
mov rbp, rsp
sub rsp, 0x38
movabs rdx, 0x321f1c7019286423
mov qword [rsp + 0x1a], rdx
mov dword [rsp + 0x22], 0x89e3bd2e
movabs rdx, 0x5060a0006060b
mov qword [rsp + 0x26], rdx
movabs rdx, 0x9000005060a0006
mov qword [rsp + 0x28], rdx
movabs rdx, 0x302020903030a
mov qword [rsp + 0x30], rdx
xor eax, eax
jmp 0x4921f4
movzx r9d, byte [rsp + rsi + 0x1a]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x40]
mov byte [rsp + rdi + 0x1a], dl
mov byte [rsp + rsi + 0x1a], r8b
add rax, 2
cmp rax, 0x12
jge 0x492228
movzx edx, byte [rsp + rax + 0x26]
movzx esi, byte [rsp + rax + 0x27]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0xc
jae 0x49224b
movzx r8d, byte [rsp + rdi + 0x1a]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x40]
nop
cmp rsi, 0xc
jb 0x4921da
jmp 0x49223f
xor eax, eax
lea rbx, [rsp + 0x1a]
mov ecx, 0xc
call fcn.00443420
add rsp, 0x38
pop rbp
ret
mov eax, esi
mov ecx, 0xc
call fcn.00454ec0
mov eax, edi
mov ecx, 0xc
call fcn.00454ec0
nop
call fcn.00452c40
nop dword [rax]
jmp fcn.00492180
Function at 0x4949a0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x494abd
push rbp
mov rbp, rsp
sub rsp, 0x58
movabs rdx, 0x6e691bf76534e8fa
mov qword [rsp + 0x19], rdx
movabs rdx, 0x295820d1df6cf776
mov qword [rsp + 0x21], rdx
movabs rdx, 0xb62be6295820d1df
mov qword [rsp + 0x24], rdx
movabs rdx, 0x651d17c5386e6fb2
mov qword [rsp + 0x2c], rdx
movabs rdx, 0x10120f190c0e0b19
mov qword [rsp + 0x34], rdx
movabs rdx, 0x180c0e1010120f19
mov qword [rsp + 0x38], rdx
movabs rdx, 0xe12110105010c05
mov qword [rsp + 0x40], rdx
movabs rdx, 0x4130216091711
mov qword [rsp + 0x48], rdx
movabs rdx, 0x11110002051800
mov qword [rsp + 0x50], rdx
xor eax, eax
jmp 0x494a60
movzx r9d, byte [rsp + rsi + 0x19]
sub r9d, edx
lea edx, [r9 + 0x5e]
mov byte [rsp + rdi + 0x19], dl
lea edx, [r8 + 0x5e]
mov byte [rsp + rsi + 0x19], dl
add rax, 2
nop word [rax + rax]
cmp rax, 0x24
jge 0x494a8d
movzx edx, byte [rsp + rax + 0x34]
movzx esi, byte [rsp + rax + 0x35]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x1b
jae 0x494ab0
movzx r8d, byte [rsp + rdi + 0x19]
sub r8d, edx
cmp rsi, 0x1b
jb 0x494a3d
jmp 0x494aa4
xor eax, eax
lea rbx, [rsp + 0x19]
mov ecx, 0x1b
call fcn.00443420
add rsp, 0x58
pop rbp
ret
mov eax, esi
mov ecx, 0x1b
call fcn.00454ec0
mov eax, edi
mov ecx, 0x1b
call fcn.00454ec0
nop
nop dword [rax]
call fcn.00452c40
jmp fcn.004949a0

Function at 0x498240
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x49832c
push rbp
mov rbp, rsp
sub rsp, 0x48
movabs rdx, 0x20f661cde86e78f3
mov qword [rsp + 0x1b], rdx
movabs rdx, 0x8985d5747420f661
mov qword [rsp + 0x20], rdx
movabs rdx, 0xed6dd8772078d78d
mov qword [rsp + 0x28], rdx
movabs rdx, 0x120d01060d0f000a
mov qword [rsp + 0x30], rdx
movabs rdx, 0x411030f080b0c0f
mov qword [rsp + 0x38], rdx
movabs rdx, 0x60b1414080e0404
mov qword [rsp + 0x40], rdx
xor eax, eax
jmp 0x4982ca
movzx r9d, byte [rsp + rsi + 0x1b]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x64]
mov byte [rsp + rdi + 0x1b], dl
mov byte [rsp + rsi + 0x1b], r8b
add rax, 2
cmp rax, 0x18
jge 0x4982fc
movzx edx, byte [rsp + rax + 0x30]
movzx esi, byte [rsp + rax + 0x31]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x15
jae 0x49831f
movzx r8d, byte [rsp + rdi + 0x1b]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x64]
cmp rsi, 0x15
jb 0x4982b0
jmp 0x498313
xor eax, eax
lea rbx, [rsp + 0x1b]
mov ecx, 0x15
call fcn.00443420
add rsp, 0x48
pop rbp
ret
mov eax, esi
mov ecx, 0x15
call fcn.00454ec0
mov eax, edi
mov ecx, 0x15
call fcn.00454ec0
nop
call fcn.00452c40
jmp fcn.00498240
Function at 0x498340
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x498448
push rbp
mov rbp, rsp
sub rsp, 0x58
movabs rdx, 0x20e76172746e6504
mov qword [rsp + 0x19], rdx
movabs rdx, 0x611b0a0d7a34a423
mov qword [rsp + 0x21], rdx
movabs rdx, 0x643c3b23c3dc6e61
mov qword [rsp + 0x28], rdx
movabs rdx, 0xf70269abd32a7261
mov qword [rsp + 0x30], rdx
movabs rdx, 0x1e0e1a1113060d0c
mov qword [rsp + 0x38], rdx
movabs rdx, 0x19081319130e1a09
mov qword [rsp + 0x40], rdx
movabs rdx, 0x1112111215111d0a
mov qword [rsp + 0x48], rdx
movabs rdx, 0x1a110a1400081b11
mov qword [rsp + 0x50], rdx
xor eax, eax
jmp 0x4983eb
movzx r9d, byte [rsp + rsi + 0x19]
sub r9d, edx
lea edx, [r9 + 0x60]
mov byte [rsp + rdi + 0x19], dl
lea edx, [r8 + 0x60]
mov byte [rsp + rsi + 0x19], dl
add rax, 2
cmp rax, 0x20
jge 0x498418
movzx edx, byte [rsp + rax + 0x38]
movzx esi, byte [rsp + rax + 0x39]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x1f
jae 0x49843b
movzx r8d, byte [rsp + rdi + 0x19]
sub r8d, edx
cmp rsi, 0x1f
jb 0x4983ce
jmp 0x49842f
xor eax, eax
lea rbx, [rsp + 0x19]
mov ecx, 0x1f
call fcn.00443420
add rsp, 0x58
pop rbp
ret
mov eax, esi
mov ecx, 0x1f
call fcn.00454ec0
mov eax, edi
mov ecx, 0x1f
call fcn.00454ec0
nop
call fcn.00452c40
jmp fcn.00498340

Function at 0x498740
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x49883d
push rbp
mov rbp, rsp
sub rsp, 0x50
movabs rdx, 0x6e612053e665d047
mov qword [rsp + 0x1d], rdx
movabs rdx, 0x645361e853f1fd6e
mov qword [rsp + 0x24], rdx
movabs rdx, 0xecee69ad203672c3
mov qword [rsp + 0x2c], rdx
movabs rdx, 0x105150d13111105
mov qword [rsp + 0x34], rdx
movabs rdx, 0x915080d110d0f0f
mov qword [rsp + 0x3c], rdx
movabs rdx, 0x416110b0915080d
mov qword [rsp + 0x40], rdx
movabs rdx, 0x30d03011616090d
mov qword [rsp + 0x48], rdx
xor eax, eax
jmp 0x4987e0
movzx r9d, byte [rsp + rsi + 0x1d]
sub r9d, edx
lea edx, [r9 - 0x5a]
mov byte [rsp + rdi + 0x1d], dl
lea edx, [r8 - 0x5a]
mov byte [rsp + rsi + 0x1d], dl
add rax, 2
nop dword [rax]
cmp rax, 0x1c
jge 0x49880d
movzx edx, byte [rsp + rax + 0x34]
movzx esi, byte [rsp + rax + 0x35]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x17
jae 0x498830
movzx r8d, byte [rsp + rdi + 0x1d]
sub r8d, edx
cmp rsi, 0x17
jb 0x4987bf
jmp 0x498824
xor eax, eax
lea rbx, [rsp + 0x1d]
mov ecx, 0x17
call fcn.00443420
add rsp, 0x50
pop rbp
ret
mov eax, esi
mov ecx, 0x17
call fcn.00454ec0
mov eax, edi
mov ecx, 0x17
call fcn.00454ec0
nop
nop dword [rax]
call fcn.00452c40
jmp fcn.00498740
Function at 0x49bac0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x49bbda
push rbp
mov rbp, rsp
sub rsp, 0x58
movabs rdx, 0x6fd8a0e6746e65d1
mov qword [rsp + 0x1a], rdx
movabs rdx, 0x58741f5a6ddfe5c1
mov qword [rsp + 0x22], rdx
movabs rdx, 0x26e58741f5a6ddf
mov qword [rsp + 0x24], rdx
movabs rdx, 0xcdf02f6769645061
mov qword [rsp + 0x2c], rdx
movabs rdx, 0xd0811110c150b18
mov qword [rsp + 0x34], rdx
movabs rdx, 0x8170d0d081111
mov qword [rsp + 0x38], rdx
movabs rdx, 0xc0d0006180f0613
mov qword [rsp + 0x40], rdx
movabs rdx, 0x1916071317151507
mov qword [rsp + 0x48], rdx
movabs rdx, 0x9040705180a1319
mov qword [rsp + 0x50], rdx
xor eax, eax
jmp 0x49bb77
movzx r9d, byte [rsp + rsi + 0x1a]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x5e]
mov byte [rsp + rdi + 0x1a], dl
mov byte [rsp + rsi + 0x1a], r8b
add rax, 2
cmp rax, 0x24
jge 0x49bba9
movzx edx, byte [rsp + rax + 0x34]
movzx esi, byte [rsp + rax + 0x35]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x1a
jae 0x49bbcd
movzx r8d, byte [rsp + rdi + 0x1a]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x5e]
cmp rsi, 0x1a
jb 0x49bb5d
jmp 0x49bbc1
xor eax, eax
lea rbx, [rsp + 0x1a]
mov ecx, 0x1a
call fcn.00443420
add rsp, 0x58
pop rbp
nop
ret
mov eax, esi
mov ecx, 0x1a
call fcn.00454ec0
mov eax, edi
mov ecx, 0x1a
call fcn.00454ec0
nop
call fcn.00452c40
nop
jmp fcn.0049bac0

Function at 0x49be60
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x49bf4a
push rbp
mov rbp, rsp
sub rsp, 0x48
movabs rdx, 0x535ad096bb617241
mov qword [rsp + 0x1e], rdx
movabs rdx, 0x6400617e535ad096
mov qword [rsp + 0x22], rdx
movabs rdx, 0xac9269e0209572be
mov qword [rsp + 0x2a], rdx
movabs rdx, 0xc080c0c06050412
mov qword [rsp + 0x32], rdx
movabs rdx, 0x60508030a030c08
mov qword [rsp + 0x38], rdx
movabs rdx, 0xe050a13100a0a08
mov qword [rsp + 0x40], rdx
xor eax, eax
jmp 0x49beed
movzx r9d, byte [rsp + rsi + 0x1e]
sub r9d, edx
lea edx, [r9 - 0x13]
mov byte [rsp + rdi + 0x1e], dl
lea edx, [r8 - 0x13]
mov byte [rsp + rsi + 0x1e], dl
add rax, 2
cmp rax, 0x16
jge 0x49bf1a
movzx edx, byte [rsp + rax + 0x32]
movzx esi, byte [rsp + rax + 0x33]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x14
jae 0x49bf3d
movzx r8d, byte [rsp + rdi + 0x1e]
sub r8d, edx
cmp rsi, 0x14
jb 0x49bed0
jmp 0x49bf31
xor eax, eax
lea rbx, [rsp + 0x1e]
mov ecx, 0x14
call fcn.00443420
add rsp, 0x48
pop rbp
ret
mov eax, esi
mov ecx, 0x14
call fcn.00454ec0
mov eax, edi
mov ecx, 0x14
call fcn.00454ec0
nop
call fcn.00452c40
jmp fcn.0049be60
Function at 0x49d140
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x49d22c
push rbp
mov rbp, rsp
sub rsp, 0x48
movabs rdx, 0x206ed769ea61213c
mov qword [rsp + 0x1b], rdx
movabs rdx, 0x50e613cd2206ed7
mov qword [rsp + 0x20], rdx
movabs rdx, 0xe5f597e02f64722a
mov qword [rsp + 0x28], rdx
movabs rdx, 0x3131011140d0500
mov qword [rsp + 0x30], rdx
movabs rdx, 0xb0c0c0d120d0b00
mov qword [rsp + 0x38], rdx
movabs rdx, 0x810010d1303090b
mov qword [rsp + 0x40], rdx
xor eax, eax
jmp 0x49d1ca
movzx r9d, byte [rsp + rsi + 0x1b]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x20]
mov byte [rsp + rdi + 0x1b], dl
mov byte [rsp + rsi + 0x1b], r8b
add rax, 2
cmp rax, 0x18
jge 0x49d1fc
movzx edx, byte [rsp + rax + 0x30]
movzx esi, byte [rsp + rax + 0x31]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x15
jae 0x49d21f
movzx r8d, byte [rsp + rdi + 0x1b]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x20]
cmp rsi, 0x15
jb 0x49d1b0
jmp 0x49d213
xor eax, eax
lea rbx, [rsp + 0x1b]
mov ecx, 0x15
call fcn.00443420
add rsp, 0x48
pop rbp
ret
mov eax, esi
mov ecx, 0x15
call fcn.00454ec0
mov eax, edi
mov ecx, 0x15
call fcn.00454ec0
nop
call fcn.00452c40
jmp fcn.0049d140

Function at 0x4a06c0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4a07bb
push rbp
mov rbp, rsp
sub rsp, 0x50
movabs rdx, 0x6973074a644c4725
mov qword [rsp + 0x19], rdx
movabs rdx, 0x642772793b6d4669
mov qword [rsp + 0x20], rdx
movabs rdx, 0x623a69545040c861
mov qword [rsp + 0x28], rdx
movabs rdx, 0x40211030b1201
mov qword [rsp + 0x30], rdx
movabs rdx, 0x10000d090b0c1116
mov qword [rsp + 0x38], rdx
movabs rdx, 0x120101150a021500
mov qword [rsp + 0x40], rdx
movabs rdx, 0x1110090516020800
mov qword [rsp + 0x48], rdx
xor eax, eax
jmp 0x4a0759
movzx r9d, byte [rsp + rsi + 0x19]
lea edx, [r9 + rdx]
lea edx, [rdx - 0xf]
mov byte [rsp + rdi + 0x19], dl
mov byte [rsp + rsi + 0x19], r8b
add rax, 2
cmp rax, 0x20
jge 0x4a078b
movzx edx, byte [rsp + rax + 0x30]
movzx esi, byte [rsp + rax + 0x31]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x17
jae 0x4a07ae
movzx r8d, byte [rsp + rdi + 0x19]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0xf]
cmp rsi, 0x17
jb 0x4a073f
jmp 0x4a07a2
xor eax, eax
lea rbx, [rsp + 0x19]
mov ecx, 0x17
call fcn.00443420
add rsp, 0x50
pop rbp
ret
mov eax, esi
mov ecx, 0x17
call fcn.00454ec0
mov eax, edi
mov ecx, 0x17
call fcn.00454ec0
nop
nop dword [rax + rax]
call fcn.00452c40
jmp fcn.004a06c0
Function at 0x4a0ac0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4a0baa
push rbp
mov rbp, rsp
sub rsp, 0x40
movabs rdx, 0x2231451eef190449
mov qword [rsp + 0x18], rdx
movabs rdx, 0xdd2b2231451eef19
mov qword [rsp + 0x1a], rdx
movabs rdx, 0xf56d6907202e413c
mov qword [rsp + 0x22], rdx
movabs rdx, 0x9080b010b110e04
mov qword [rsp + 0x2a], rdx
movabs rdx, 0x206050804030908
mov qword [rsp + 0x30], rdx
movabs rdx, 0xb0a050c01060a07
mov qword [rsp + 0x38], rdx
xor eax, eax
jmp 0x4a0b4d
movzx r9d, byte [rsp + rsi + 0x18]
sub r9d, edx
lea edx, [r9 + 0x40]
mov byte [rsp + rdi + 0x18], dl
lea edx, [r8 + 0x40]
mov byte [rsp + rsi + 0x18], dl
add rax, 2
cmp rax, 0x16
jge 0x4a0b7a
movzx edx, byte [rsp + rax + 0x2a]
movzx esi, byte [rsp + rax + 0x2b]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x12
jae 0x4a0b9d
movzx r8d, byte [rsp + rdi + 0x18]
sub r8d, edx
cmp rsi, 0x12
jb 0x4a0b30
jmp 0x4a0b91
xor eax, eax
lea rbx, [rsp + 0x18]
mov ecx, 0x12
call fcn.00443420
add rsp, 0x40
pop rbp
ret
mov eax, esi
mov ecx, 0x12
call fcn.00454ec0
mov eax, edi
mov ecx, 0x12
call fcn.00454ec0
nop
call fcn.00452c40
jmp fcn.004a0ac0

Function at 0x4a0fa0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4a109b
push rbp
mov rbp, rsp
sub rsp, 0x48
movabs rdx, 0x81bfb4a3affa6f28
mov qword [rsp + 0x1b], rdx
movabs rdx, 0x646c3481bfb4a3af
mov qword [rsp + 0x1e], rdx
movabs rdx, 0x656dc1540b64abc6
mov qword [rsp + 0x26], rdx
movabs rdx, 0x506040b06080700
mov qword [rsp + 0x2e], rdx
movabs rdx, 0x100600100b000210
mov qword [rsp + 0x36], rdx
movabs rdx, 0xc10100600100b00
mov qword [rsp + 0x38], rdx
movabs rdx, 0xb0305090c07050e
mov qword [rsp + 0x40], rdx
xor eax, eax
jmp 0x4a1039
movzx r9d, byte [rsp + rsi + 0x1b]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x6e]
mov byte [rsp + rdi + 0x1b], dl
mov byte [rsp + rsi + 0x1b], r8b
add rax, 2
cmp rax, 0x1a
jge 0x4a106b
movzx edx, byte [rsp + rax + 0x2e]
movzx esi, byte [rsp + rax + 0x2f]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x13
jae 0x4a108e
movzx r8d, byte [rsp + rdi + 0x1b]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x6e]
cmp rsi, 0x13
jb 0x4a101f
jmp 0x4a1082
xor eax, eax
lea rbx, [rsp + 0x1b]
mov ecx, 0x13
call fcn.00443420
add rsp, 0x48
pop rbp
ret
mov eax, esi
mov ecx, 0x13
call fcn.00454ec0
mov eax, edi
mov ecx, 0x13
call fcn.00454ec0
nop
nop dword [rax + rax]
call fcn.00452c40
jmp fcn.004a0fa0