joyce8/EMBER2024-capa huggingface dataset:
Function at 0x474ae0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x474ba6
push rbp
mov rbp, rsp
sub rsp, 0x30
movabs rdx, 0xa09c9f748f62dda2
mov qword [rsp + 0x1d], rdx
mov byte [rsp + 0x25], 0xae
movabs rdx, 0x505080805010003
mov qword [rsp + 0x26], rdx
mov word [rsp + 0x2e], 0x607
xor eax, eax
nop
jmp 0x474b40
movzx r9d, byte [rsp + rsi + 0x1d]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x44]
mov byte [rsp + rdi + 0x1d], dl
mov byte [rsp + rsi + 0x1d], r8b
add rax, 2
nop dword [rax]
cmp rax, 0xa
jge 0x474b72
movzx edx, byte [rsp + rax + 0x26]
movzx esi, byte [rsp + rax + 0x27]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 9
jae 0x474b97
movzx r8d, byte [rsp + rdi + 0x1d]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x44]
cmp rsi, 9
jb 0x474b22
jmp 0x474b8b
xor eax, eax
lea rbx, [rsp + 0x1d]
mov ecx, 9
nop
call fcn.00441b80
add rsp, 0x30
pop rbp
ret
mov eax, esi
mov ecx, 9
call fcn.004521e0
mov eax, edi
mov ecx, 9
nop
call fcn.004521e0
nop
call fcn.0044ff60
jmp fcn.00474ae0

Function at 0x474bc0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x474c87
push rbp
mov rbp, rsp
sub rsp, 0x30
movabs rdx, 0x64e04adae265ee4e
mov qword [rsp + 0x19], rdx
movabs rdx, 0x4a576164e04adae2
mov qword [rsp + 0x1c], rdx
movabs rdx, 0x90503060402060a
mov qword [rsp + 0x24], rdx
mov dword [rsp + 0x2c], 0x5010904
xor eax, eax
jmp 0x474c28
movzx r9d, byte [rsp + rsi + 0x19]
sub r9d, edx
lea edx, [r9 - 0x6b]
mov byte [rsp + rdi + 0x19], dl
lea edx, [r8 - 0x6b]
mov byte [rsp + rsi + 0x19], dl
add rax, 2
cmp rax, 0xc
jge 0x474c57
movzx edx, byte [rsp + rax + 0x24]
movzx esi, byte [rsp + rax + 0x25]
mov edi, edx
xor edx, esi
add edx, eax
nop
cmp rdi, 0xb
jae 0x474c7a
movzx r8d, byte [rsp + rdi + 0x19]
sub r8d, edx
cmp rsi, 0xb
jb 0x474c0b
jmp 0x474c6e
xor eax, eax
lea rbx, [rsp + 0x19]
mov ecx, 0xb
call fcn.00441b80
add rsp, 0x30
pop rbp
ret
mov eax, esi
mov ecx, 0xb
call fcn.004521e0
mov eax, edi
mov ecx, 0xb
call fcn.004521e0
nop
call fcn.0044ff60
jmp fcn.00474bc0

Function at 0x476300
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4763c7
push rbp
mov rbp, rsp
sub rsp, 0x30
movabs rdx, 0x64f5922aa7a290e5
mov qword [rsp + 0x19], rdx
movabs rdx, 0x6e61b564f5922aa7
mov qword [rsp + 0x1c], rdx
movabs rdx, 0x500010601000401
mov qword [rsp + 0x24], rdx
mov dword [rsp + 0x2c], 0x2030108
xor eax, eax
jmp 0x476368
movzx r9d, byte [rsp + rsi + 0x19]
sub r9d, edx
lea edx, [r9 - 0x38]
mov byte [rsp + rdi + 0x19], dl
lea edx, [r8 - 0x38]
mov byte [rsp + rsi + 0x19], dl
add rax, 2
cmp rax, 0xc
jge 0x476397
movzx edx, byte [rsp + rax + 0x24]
movzx esi, byte [rsp + rax + 0x25]
mov edi, edx
xor edx, esi
add edx, eax
nop
cmp rdi, 0xb
jae 0x4763ba
movzx r8d, byte [rsp + rdi + 0x19]
sub r8d, edx
cmp rsi, 0xb
jb 0x47634b
jmp 0x4763ae
xor eax, eax
lea rbx, [rsp + 0x19]
mov ecx, 0xb
call fcn.00441b80
add rsp, 0x30
pop rbp
ret
mov eax, esi
mov ecx, 0xb
call fcn.004521e0
mov eax, edi
mov ecx, 0xb
call fcn.004521e0
nop
call fcn.0044ff60
jmp fcn.00476300
Function at 0x476800
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4768bd
push rbp
mov rbp, rsp
sub rsp, 0x30
movabs rdx, 0x6867f655d4acdfb7
mov qword [rsp + 0x26], rdx
mov word [rsp + 0x2e], 0x72e6
movabs rdx, 0x201000800050803
mov qword [rsp + 0x1c], rdx
mov word [rsp + 0x24], 0x203
xor eax, eax
jmp 0x476860
movzx r9d, byte [rsp + rsi + 0x26]
sub r9d, edx
lea edx, [r9 - 0x37]
mov byte [rsp + rdi + 0x26], dl
lea edx, [r8 - 0x37]
mov byte [rsp + rsi + 0x26], dl
add rax, 2
nop
cmp rax, 0xa
jge 0x47688d
movzx edx, byte [rsp + rax + 0x1c]
movzx esi, byte [rsp + rax + 0x1d]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0xa
jae 0x4768b0
movzx r8d, byte [rsp + rdi + 0x26]
sub r8d, edx
cmp rsi, 0xa
jb 0x476842
jmp 0x4768a4
xor eax, eax
lea rbx, [rsp + 0x26]
mov ecx, 0xa
call fcn.00441b80
add rsp, 0x30
pop rbp
ret
mov eax, esi
mov ecx, 0xa
call fcn.004521e0
mov eax, edi
mov ecx, 0xa
call fcn.004521e0
nop
nop dword [rax]
call fcn.0044ff60
jmp fcn.00476800

Function at 0x478ec0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x478f86
push rbp
mov rbp, rsp
sub rsp, 0x30
movabs rdx, 0x3ed3636572cc1bca
mov qword [rsp + 0x26], rdx
mov word [rsp + 0x2e], 0x49dc
movabs rdx, 0x802080906010708
mov qword [rsp + 0x1c], rdx
mov word [rsp + 0x24], 6
xor eax, eax
jmp 0x478f20
movzx r9d, byte [rsp + rsi + 0x26]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x77]
mov byte [rsp + rdi + 0x26], dl
mov byte [rsp + rsi + 0x26], r8b
add rax, 2
nop dword [rax]
cmp rax, 0xa
jge 0x478f52
movzx edx, byte [rsp + rax + 0x1c]
movzx esi, byte [rsp + rax + 0x1d]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0xa
jae 0x478f77
movzx r8d, byte [rsp + rdi + 0x26]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x77]
cmp rsi, 0xa
jb 0x478f02
jmp 0x478f6b
xor eax, eax
lea rbx, [rsp + 0x26]
mov ecx, 0xa
nop
call fcn.00441b80
add rsp, 0x30
pop rbp
ret
mov eax, esi
mov ecx, 0xa
call fcn.004521e0
mov eax, edi
mov ecx, 0xa
nop
call fcn.004521e0
nop
call fcn.0044ff60
jmp fcn.00478ec0
Function at 0x479f60
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x47a05b
push rbp
mov rbp, rsp
sub rsp, 0x50
movabs rdx, 0x87bb61817ec36fe2
mov qword [rsp + 0x19], rdx
movabs rdx, 0x735a7265647b9687
mov qword [rsp + 0x20], rdx
movabs rdx, 0xab6f9e748696b48b
mov qword [rsp + 0x28], rdx
movabs rdx, 0x2060f0f11100006
mov qword [rsp + 0x30], rdx
movabs rdx, 0x414110c16091206
mov qword [rsp + 0x38], rdx
movabs rdx, 0xc07000904030212
mov qword [rsp + 0x40], rdx
movabs rdx, 0xd0e0e04000f0804
mov qword [rsp + 0x48], rdx
xor eax, eax
jmp 0x479ff9
movzx r9d, byte [rsp + rsi + 0x19]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x36]
mov byte [rsp + rdi + 0x19], dl
mov byte [rsp + rsi + 0x19], r8b
add rax, 2
cmp rax, 0x20
jge 0x47a02b
movzx edx, byte [rsp + rax + 0x30]
movzx esi, byte [rsp + rax + 0x31]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x17
jae 0x47a04e
movzx r8d, byte [rsp + rdi + 0x19]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x36]
cmp rsi, 0x17
jb 0x479fdf
jmp 0x47a042
xor eax, eax
lea rbx, [rsp + 0x19]
mov ecx, 0x17
call fcn.00441b80
add rsp, 0x50
pop rbp
ret
mov eax, esi
mov ecx, 0x17
call fcn.004521e0
mov eax, edi
mov ecx, 0x17
call fcn.004521e0
nop
nop dword [rax + rax]
call fcn.0044ff60
jmp fcn.00479f60

Function at 0x47a3c0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x47a49d
push rbp
mov rbp, rsp
sub rsp, 0x40
movabs rdx, 0x26415f60202b744e
mov qword [rsp + 0x1c], rdx
movabs rdx, 0xe1d4e2941616849
mov qword [rsp + 0x24], rdx
movabs rdx, 0x8030d02070f0e0b
mov qword [rsp + 0x2c], rdx
movabs rdx, 0xf00070008030d02
mov qword [rsp + 0x30], rdx
movabs rdx, 0x80d040d0b0d0c
mov qword [rsp + 0x38], rdx
xor eax, eax
nop
jmp 0x47a440
movzx r9d, byte [rsp + rsi + 0x1c]
sub r9d, edx
lea edx, [r9 + 0x2d]
mov byte [rsp + rdi + 0x1c], dl
lea edx, [r8 + 0x2d]
mov byte [rsp + rsi + 0x1c], dl
add rax, 2
nop
cmp rax, 0x14
jge 0x47a46d
movzx edx, byte [rsp + rax + 0x2c]
movzx esi, byte [rsp + rax + 0x2d]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x10
jae 0x47a490
movzx r8d, byte [rsp + rdi + 0x1c]
sub r8d, edx
cmp rsi, 0x10
jb 0x47a422
jmp 0x47a484
xor eax, eax
lea rbx, [rsp + 0x1c]
mov ecx, 0x10
call fcn.00441b80
add rsp, 0x40
pop rbp
ret
mov eax, esi
mov ecx, 0x10
call fcn.004521e0
mov eax, edi
mov ecx, 0x10
call fcn.004521e0
nop
nop dword [rax]
call fcn.0044ff60
jmp fcn.0047a3c0
Function at 0x47b360
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x47b45b
push rbp
mov rbp, rsp
sub rsp, 0x48
movabs rdx, 0x856ec27f88749b7e
mov qword [rsp + 0x1b], rdx
movabs rdx, 0xf06857856ec27f88
mov qword [rsp + 0x1e], rdx
movabs rdx, 0xb363618676d299ca
mov qword [rsp + 0x26], rdx
movabs rdx, 0xf0b120f0a0b050d
mov qword [rsp + 0x2e], rdx
movabs rdx, 0xd0f01030f05120e
mov qword [rsp + 0x36], rdx
movabs rdx, 0xc000d0f01030f05
mov qword [rsp + 0x38], rdx
movabs rdx, 0xe0e0e00000a0704
mov qword [rsp + 0x40], rdx
xor eax, eax
jmp 0x47b3f9
movzx r9d, byte [rsp + rsi + 0x1b]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x35]
mov byte [rsp + rdi + 0x1b], dl
mov byte [rsp + rsi + 0x1b], r8b
add rax, 2
cmp rax, 0x1a
jge 0x47b42b
movzx edx, byte [rsp + rax + 0x2e]
movzx esi, byte [rsp + rax + 0x2f]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x13
jae 0x47b44e
movzx r8d, byte [rsp + rdi + 0x1b]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x35]
cmp rsi, 0x13
jb 0x47b3df
jmp 0x47b442
xor eax, eax
lea rbx, [rsp + 0x1b]
mov ecx, 0x13
call fcn.00441b80
add rsp, 0x48
pop rbp
ret
mov eax, esi
mov ecx, 0x13
call fcn.004521e0
mov eax, edi
mov ecx, 0x13
call fcn.004521e0
nop
nop dword [rax + rax]
call fcn.0044ff60
jmp fcn.0047b360
Function at 0x488ac0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x488bcc
push rbp
mov rbp, rsp
sub rsp, 0x50
movabs rdx, 0x756e596f7c262740
mov qword [rsp + 0x36], rdx
movabs rdx, 0x6c1b65737c494274
mov qword [rsp + 0x3e], rdx
movabs rdx, 0x74566c1b65737c49
mov qword [rsp + 0x40], rdx
movabs rdx, 0x646e706e4a726074
mov qword [rsp + 0x48], rdx
movabs rdx, 0x20b171106030e0d
mov qword [rsp + 0x1c], rdx
movabs rdx, 0x80302130e0107
mov qword [rsp + 0x24], rdx
movabs rdx, 0x50c00080302130e
mov qword [rsp + 0x26], rdx
movabs rdx, 0x10020c0f0d151616
mov qword [rsp + 0x2e], rdx
xor eax, eax
jmp 0x488b68
movzx r9d, byte [rsp + rsi + 0x36]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x15]
mov byte [rsp + rdi + 0x36], dl
mov byte [rsp + rsi + 0x36], r8b
add rax, 2
cmp rax, 0x1a
jge 0x488b9c
movzx edx, byte [rsp + rax + 0x1c]
movzx esi, byte [rsp + rax + 0x1d]
mov edi, edx
xor edx, esi
add edx, eax
nop
cmp rdi, 0x1a
jae 0x488bbf
movzx r8d, byte [rsp + rdi + 0x36]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x15]
cmp rsi, 0x1a
jb 0x488b4e
jmp 0x488bb3
xor eax, eax
lea rbx, [rsp + 0x36]
mov ecx, 0x1a
call fcn.00441b80
add rsp, 0x50
pop rbp
ret
mov eax, esi
mov ecx, 0x1a
call fcn.004521e0
mov eax, edi
mov ecx, 0x1a
call fcn.004521e0
nop
call fcn.0044ff60
jmp fcn.00488ac0

Function at 0x48a540
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x48a648
push rbp
mov rbp, rsp
sub rsp, 0x58
movabs rdx, 0x6126092475a4ee76
mov qword [rsp + 0x1b], rdx
movabs rdx, 0xd0691320b666536d
mov qword [rsp + 0x23], rdx
movabs rdx, 0x72c85d1128d06913
mov qword [rsp + 0x28], rdx
movabs rdx, 0x8165d33066a37462
mov qword [rsp + 0x30], rdx
movabs rdx, 0x12130211130a1c09
mov qword [rsp + 0x38], rdx
movabs rdx, 0xa1a0b0d1c061115
mov qword [rsp + 0x40], rdx
movabs rdx, 0x1050612190f1706
mov qword [rsp + 0x48], rdx
movabs rdx, 0x10191009040d1311
mov qword [rsp + 0x50], rdx
xor eax, eax
jmp 0x48a5eb
movzx r9d, byte [rsp + rsi + 0x1b]
sub r9d, edx
lea edx, [r9 + 0x72]
mov byte [rsp + rdi + 0x1b], dl
lea edx, [r8 + 0x72]
mov byte [rsp + rsi + 0x1b], dl
add rax, 2
cmp rax, 0x20
jge 0x48a618
movzx edx, byte [rsp + rax + 0x38]
movzx esi, byte [rsp + rax + 0x39]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x1d
jae 0x48a63b
movzx r8d, byte [rsp + rdi + 0x1b]
sub r8d, edx
cmp rsi, 0x1d
jb 0x48a5ce
jmp 0x48a62f
xor eax, eax
lea rbx, [rsp + 0x1b]
mov ecx, 0x1d
call fcn.00441b80
add rsp, 0x58
pop rbp
ret
mov eax, esi
mov ecx, 0x1d
call fcn.004521e0
mov eax, edi
mov ecx, 0x1d
call fcn.004521e0
nop
call fcn.0044ff60
jmp fcn.0048a540
Function at 0x48ad20
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x48addd
push rbp
mov rbp, rsp
sub rsp, 0x30
movabs rdx, 0xce2763651eb2b172
mov qword [rsp + 0x1b], rdx
mov byte [rsp + 0x23], 0xbf
movabs rdx, 0x307010603080302
mov qword [rsp + 0x24], rdx
mov dword [rsp + 0x2c], 0x6080308
xor eax, eax
nop
jmp 0x48ad80
movzx r9d, byte [rsp + rsi + 0x1b]
sub r9d, edx
lea edx, [r9 + 0x49]
mov byte [rsp + rdi + 0x1b], dl
lea edx, [r8 + 0x49]
mov byte [rsp + rsi + 0x1b], dl
add rax, 2
nop
cmp rax, 0xc
jge 0x48adad
movzx edx, byte [rsp + rax + 0x24]
movzx esi, byte [rsp + rax + 0x25]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 9
jae 0x48add0
movzx r8d, byte [rsp + rdi + 0x1b]
sub r8d, edx
cmp rsi, 9
jb 0x48ad62
jmp 0x48adc4
xor eax, eax
lea rbx, [rsp + 0x1b]
mov ecx, 9
call fcn.00441b80
add rsp, 0x30
pop rbp
ret
mov eax, esi
mov ecx, 9
call fcn.004521e0
mov eax, edi
mov ecx, 9
call fcn.004521e0
nop
nop dword [rax]
call fcn.0044ff60
jmp fcn.0048ad20

Function at 0x48ae00
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x48af38
push rbp
mov rbp, rsp
sub rsp, 0x70
movabs rdx, 0xf042d06d5f5b6220
mov qword [rsp + 0x1f], rdx
movabs rdx, 0x6ff042d06d5f5b62
mov qword [rsp + 0x20], rdx
movabs rdx, 0xbae96ee4ececd2fe
mov qword [rsp + 0x28], rdx
movabs rdx, 0xf90ee1b674e413b4
mov qword [rsp + 0x30], rdx
movabs rdx, 0x60d26c14f2fc659f
mov qword [rsp + 0x38], rdx
movabs rdx, 0x201c1210110d1511
mov qword [rsp + 0x40], rdx
movabs rdx, 0x6051c1b17100a06
mov qword [rsp + 0x48], rdx
movabs rdx, 0x1b05130f1d050116
mov qword [rsp + 0x50], rdx
movabs rdx, 0x1f19071119030211
mov qword [rsp + 0x58], rdx
movabs rdx, 0x1c111f1109161d0a
mov qword [rsp + 0x60], rdx
movabs rdx, 0xb050c180d101f02
mov qword [rsp + 0x68], rdx
xor eax, eax
jmp 0x48aed8
movzx r9d, byte [rsp + rsi + 0x1f]
sub r9d, edx
lea edx, [r9 - 0x4b]
mov byte [rsp + rdi + 0x1f], dl
lea edx, [r8 - 0x4b]
mov byte [rsp + rsi + 0x1f], dl
add rax, 2
cmp rax, 0x30
jge 0x48af08
movzx edx, byte [rsp + rax + 0x40]
movzx esi, byte [rsp + rax + 0x41]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x21
jae 0x48af2b
movzx r8d, byte [rsp + rdi + 0x1f]
sub r8d, edx
nop dword [rax]
cmp rsi, 0x21
jb 0x48aebb
jmp 0x48af1f
xor eax, eax
lea rbx, [rsp + 0x1f]
mov ecx, 0x21
call fcn.00441b80
add rsp, 0x70
pop rbp
ret
mov eax, esi
mov ecx, 0x21
call fcn.004521e0
mov eax, edi
mov ecx, 0x21
call fcn.004521e0
nop
call fcn.0044ff60
nop dword [rax]
jmp fcn.0048ae00
Function at 0x48af60
Capabilities:
Encrypt data using rc4 prga

Disassembly:
lea r12, [rsp - 8]
cmp r12, qword [r14 + 0x10]
jbe 0x48b0bd
push rbp
mov rbp, rsp
add rsp, 0xffffffffffffff80
movabs rdx, 0x15236765a9afec2f
mov qword [rsp + 0x1b], rdx
movabs rdx, 0x9eca722aeb6e6932
mov qword [rsp + 0x23], rdx
movabs rdx, 0x72273978e69eca72
mov qword [rsp + 0x28], rdx
movabs rdx, 0x363b0b69ea67726f
mov qword [rsp + 0x30], rdx
movabs rdx, 0xfb74226d3f64696c
mov qword [rsp + 0x38], rdx
movabs rdx, 0x35f9221892885e04
mov qword [rsp + 0x40], rdx
movabs rdx, 0x52628260211170f
mov qword [rsp + 0x48], rdx
movabs rdx, 0x2b26030c29271828
mov qword [rsp + 0x50], rdx
movabs rdx, 0xc1a17240d032529
mov qword [rsp + 0x58], rdx
movabs rdx, 0xf0d0e030327012a
mov qword [rsp + 0x60], rdx
movabs rdx, 0x200b00280e13032a
mov qword [rsp + 0x68], rdx
movabs rdx, 0x1c061b2b12222c0d
mov qword [rsp + 0x70], rdx
movabs rdx, 0x24120810251b0207
mov qword [rsp + 0x78], rdx
xor eax, eax
jmp 0x48b060
movzx r9d, byte [rsp + rsi + 0x1b]
sub r9d, edx
lea edx, [r9 - 0x7a]
mov byte [rsp + rdi + 0x1b], dl
lea edx, [r8 - 0x7a]
mov byte [rsp + rsi + 0x1b], dl
add rax, 2
nop dword [rax + rax]
cmp rax, 0x38
jge 0x48b08d
movzx edx, byte [rsp + rax + 0x48]
movzx esi, byte [rsp + rax + 0x49]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x2d
jae 0x48b0b0
movzx r8d, byte [rsp + rdi + 0x1b]
sub r8d, edx
cmp rsi, 0x2d
jb 0x48b03e
jmp 0x48b0a4
xor eax, eax
lea rbx, [rsp + 0x1b]
mov ecx, 0x2d
call fcn.00441b80
sub rsp, 0xffffffffffffff80
pop rbp
ret
mov eax, esi
mov ecx, 0x2d
call fcn.004521e0
mov eax, edi
mov ecx, 0x2d
call fcn.004521e0
nop
nop dword [rax]
call fcn.0044ff60
jmp fcn.0048af60
Function at 0x494f80
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x49503d
push rbp
mov rbp, rsp
sub rsp, 0x30
movabs rdx, 0xa8b82e73a22620cc
mov qword [rsp + 0x1d], rdx
mov byte [rsp + 0x25], 0x6e
movabs rdx, 0x306020303060700
mov qword [rsp + 0x26], rdx
mov word [rsp + 0x2e], 0x706
xor eax, eax
nop
jmp 0x494fe0
movzx r9d, byte [rsp + rsi + 0x1d]
sub r9d, edx
lea edx, [r9 - 0x38]
mov byte [rsp + rdi + 0x1d], dl
lea edx, [r8 - 0x38]
mov byte [rsp + rsi + 0x1d], dl
add rax, 2
nop
cmp rax, 0xa
jge 0x49500d
movzx edx, byte [rsp + rax + 0x26]
movzx esi, byte [rsp + rax + 0x27]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 9
jae 0x495030
movzx r8d, byte [rsp + rdi + 0x1d]
sub r8d, edx
cmp rsi, 9
jb 0x494fc2
jmp 0x495024
xor eax, eax
lea rbx, [rsp + 0x1d]
mov ecx, 9
call fcn.00441b80
add rsp, 0x30
pop rbp
ret
mov eax, esi
mov ecx, 9
call fcn.004521e0
mov eax, edi
mov ecx, 9
call fcn.004521e0
nop
nop dword [rax]
call fcn.0044ff60
jmp fcn.00494f80

Function at 0x49b160
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x49b227
push rbp
mov rbp, rsp
sub rsp, 0x38
movabs rdx, 0x866283746a6f9b73
mov qword [rsp + 0x1c], rdx
mov dword [rsp + 0x24], 0xdc67ed65
movabs rdx, 0x90b0501050a0b08
mov qword [rsp + 0x28], rdx
movabs rdx, 0x30a09090a070309
mov qword [rsp + 0x30], rdx
xor eax, eax
jmp 0x49b1c8
movzx r9d, byte [rsp + rsi + 0x1c]
sub r9d, edx
lea edx, [r9 - 0x73]
mov byte [rsp + rdi + 0x1c], dl
lea edx, [r8 - 0x73]
mov byte [rsp + rsi + 0x1c], dl
add rax, 2
cmp rax, 0x10
jge 0x49b1f7
movzx edx, byte [rsp + rax + 0x28]
movzx esi, byte [rsp + rax + 0x29]
mov edi, edx
xor edx, esi
add edx, eax
nop
cmp rdi, 0xc
jae 0x49b21a
movzx r8d, byte [rsp + rdi + 0x1c]
sub r8d, edx
cmp rsi, 0xc
jb 0x49b1ab
jmp 0x49b20e
xor eax, eax
lea rbx, [rsp + 0x1c]
mov ecx, 0xc
call fcn.00441b80
add rsp, 0x38
pop rbp
ret
mov eax, esi
mov ecx, 0xc
call fcn.004521e0
mov eax, edi
mov ecx, 0xc
call fcn.004521e0
nop
call fcn.0044ff60
jmp fcn.0049b160

Function at 0x49b240
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x49b312
push rbp
mov rbp, rsp
sub rsp, 0x38
movabs rdx, 0x74bd65f501e96ef1
mov qword [rsp + 0x1a], rdx
movabs rdx, 0xccb888a4646574bd
mov qword [rsp + 0x20], rdx
movabs rdx, 0x6030003020a040c
mov qword [rsp + 0x28], rdx
movabs rdx, 0xc0b0c000a020b0d
mov qword [rsp + 0x30], rdx
xor eax, eax
jmp 0x49b2ac
movzx r9d, byte [rsp + rsi + 0x1a]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x50]
mov byte [rsp + rdi + 0x1a], dl
mov byte [rsp + rsi + 0x1a], r8b
add rax, 2
cmp rax, 0x10
jge 0x49b2de
movzx edx, byte [rsp + rax + 0x28]
movzx esi, byte [rsp + rax + 0x29]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0xe
jae 0x49b305
movzx r8d, byte [rsp + rdi + 0x1a]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x50]
cmp rsi, 0xe
jb 0x49b292
jmp 0x49b2f5
xor eax, eax
lea rbx, [rsp + 0x1a]
mov ecx, 0xe
call fcn.00441b80
add rsp, 0x38
pop rbp
ret
mov eax, esi
mov ecx, 0xe
nop dword [rax]
call fcn.004521e0
mov eax, edi
mov ecx, 0xe
call fcn.004521e0
nop
call fcn.0044ff60
jmp fcn.0049b240
Function at 0x49b320
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x49b40c
push rbp
mov rbp, rsp
sub rsp, 0x48
movabs rdx, 0x6eb06e136b556553
mov qword [rsp + 0x1e], rdx
movabs rdx, 0x697d617d6eb06e13
mov qword [rsp + 0x22], rdx
movabs rdx, 0xfff6e6585bc2064
mov qword [rsp + 0x2a], rdx
movabs rdx, 0x40a08060a021306
mov qword [rsp + 0x32], rdx
movabs rdx, 0xe0a0f041202040a
mov qword [rsp + 0x38], rdx
movabs rdx, 0x212050502120602
mov qword [rsp + 0x40], rdx
xor eax, eax
jmp 0x49b3aa
movzx r9d, byte [rsp + rsi + 0x1e]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x60]
mov byte [rsp + rdi + 0x1e], dl
mov byte [rsp + rsi + 0x1e], r8b
add rax, 2
cmp rax, 0x16
jge 0x49b3dc
movzx edx, byte [rsp + rax + 0x32]
movzx esi, byte [rsp + rax + 0x33]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x14
jae 0x49b3ff
movzx r8d, byte [rsp + rdi + 0x1e]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x60]
cmp rsi, 0x14
jb 0x49b390
jmp 0x49b3f3
xor eax, eax
lea rbx, [rsp + 0x1e]
mov ecx, 0x14
call fcn.00441b80
add rsp, 0x48
pop rbp
ret
mov eax, esi
mov ecx, 0x14
call fcn.004521e0
mov eax, edi
mov ecx, 0x14
call fcn.004521e0
nop
call fcn.0044ff60
jmp fcn.0049b320

Function at 0x49dbc0
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x49dc8a
push rbp
mov rbp, rsp
sub rsp, 0x48
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x58], rax
mov qword [rsp], rax
mov qword [rsp + 8], rbx
mov byte [rsp + 0x10], 0
call fcn.00403800
xorps xmm15, xmm15
mov r14, qword [0x007a7690]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x18], 0xffffffffffffffff
jne 0x49dc6f
mov rcx, qword [rsp + 0x60]
lea rdx, [rcx + 1]
mov qword [rsp + 0x40], rdx
lea rax, [0x0052ffe0]
xor ebx, ebx
mov rcx, rdx
call fcn.0043e6c0
mov rbx, qword [rsp + 0x60]
mov rcx, rax
xor edi, edi
mov rsi, qword [rsp + 0x40]
mov rax, qword [rsp + 0x58]
nop dword [rax]
call fcn.004a03e0
inc rbx
cmp rcx, rbx
jae 0x49dc5e
mov edi, 1
lea rsi, [0x0052ffe0]
call fcn.0043e7a0
mov word [rax + rbx*2 - 2], 0
xor edi, edi
xor esi, esi
add rsp, 0x48
pop rbp
ret
xor eax, eax
xor ebx, ebx
mov rcx, rbx
lea rdi, [0x006b94c8]
lea rsi, [0x006b9128]
add rsp, 0x48
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.0044ff60
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.0049dbc0
Function at 0x4a0040
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4a013d
push rbp
mov rbp, rsp
sub rsp, 0x48
movabs rdx, 0x31342f3734313324
mov qword [rsp + 0x18], rdx
movabs rdx, 0x42373d28386d3134
mov qword [rsp + 0x1e], rdx
movabs rdx, 0x362d2e2e493331
mov qword [rsp + 0x26], rdx
movabs rdx, 0xb050d0a08141200
mov qword [rsp + 0x2e], rdx
movabs rdx, 0x13121210100e0907
mov qword [rsp + 0x36], rdx
movabs rdx, 0x30413121210100e
mov qword [rsp + 0x38], rdx
movabs rdx, 0x50a0104140a070c
mov qword [rsp + 0x40], rdx
xor eax, eax
jmp 0x4a00e0
movzx r9d, byte [rsp + rsi + 0x18]
sub r9d, edx
lea edx, [r9 + 0x16]
mov byte [rsp + rdi + 0x18], dl
lea edx, [r8 + 0x16]
mov byte [rsp + rsi + 0x18], dl
add rax, 2
nop dword [rax]
cmp rax, 0x1a
jge 0x4a010d
movzx edx, byte [rsp + rax + 0x2e]
movzx esi, byte [rsp + rax + 0x2f]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x16
jae 0x4a0130
movzx r8d, byte [rsp + rdi + 0x18]
sub r8d, edx
cmp rsi, 0x16
jb 0x4a00bf
jmp 0x4a0124
xor eax, eax
lea rbx, [rsp + 0x18]
mov ecx, 0x16
call fcn.00441b80
add rsp, 0x48
pop rbp
ret
mov eax, esi
mov ecx, 0x16
call fcn.004521e0
mov eax, edi
mov ecx, 0x16
call fcn.004521e0
nop
nop dword [rax]
call fcn.0044ff60
jmp fcn.004a0040

Function at 0x4a3ca0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4a3dac
push rbp
mov rbp, rsp
sub rsp, 0x50
movabs rdx, 0x6593a5a5739b658b
mov qword [rsp + 0x1b], rdx
movabs rdx, 0x866f74996165857d
mov qword [rsp + 0x23], rdx
movabs rdx, 0xcd866f7499616585
mov qword [rsp + 0x24], rdx
movabs rdx, 0x895964697aa58c20
mov qword [rsp + 0x2c], rdx
movabs rdx, 0x20410170c05120d
mov qword [rsp + 0x34], rdx
movabs rdx, 0x131817180f091008
mov qword [rsp + 0x3c], rdx
movabs rdx, 0x1706020d13181718
mov qword [rsp + 0x40], rdx
movabs rdx, 0x171402000218030c
mov qword [rsp + 0x48], rdx
xor eax, eax
jmp 0x4a3d48
movzx r9d, byte [rsp + rsi + 0x1b]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x32]
mov byte [rsp + rdi + 0x1b], dl
mov byte [rsp + rsi + 0x1b], r8b
add rax, 2
cmp rax, 0x1c
jge 0x4a3d7c
movzx edx, byte [rsp + rax + 0x34]
movzx esi, byte [rsp + rax + 0x35]
mov edi, edx
xor edx, esi
add edx, eax
nop
cmp rdi, 0x19
jae 0x4a3d9f
movzx r8d, byte [rsp + rdi + 0x1b]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x32]
cmp rsi, 0x19
jb 0x4a3d2e
jmp 0x4a3d93
xor eax, eax
lea rbx, [rsp + 0x1b]
mov ecx, 0x19
call fcn.00441b80
add rsp, 0x50
pop rbp
ret
mov eax, esi
mov ecx, 0x19
call fcn.004521e0
mov eax, edi
mov ecx, 0x19
call fcn.004521e0
nop
call fcn.0044ff60
jmp fcn.004a3ca0