joyce8/EMBER2024-capa huggingface dataset:
Function at 0x43a040
Capabilities:
Encode data using base64

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x43a1a7
push rbp
mov rbp, rsp
sub rsp, 0x18
mov ecx, dword [rax + 0x190]
mov edx, dword [rax + 0x194]
mov rsi, qword [rax + 0x998]
mov edi, dword [rax + 0x194]
cmp edi, edx
jne 0x43a052
cmp edx, ecx
jne 0x43a195
nop word [rax + rax]
test rsi, rsi
jne 0x43a195
mov qword [rsp + 0x28], rax
test rbx, rbx
jne 0x43a0b4
nop
call fcn.00452780
xorps xmm15, xmm15
mov r14, qword [0x0065e5b0]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rbx, qword [rsp]
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0x10], rbx
call fcn.00439f60
mov rcx, qword [rsp + 0x28]
mov edx, dword [rcx]
mov ebx, edx
sar edx, 0x1f
shr edx, 0x1b
add edx, ebx
mov esi, edx
and edx, 0xffffffe0
sub ebx, edx
test ebx, ebx
jl 0x43a190
mov rdx, qword [0x0060ad28]
sar esi, 5
mov rax, rcx
mov ecx, ebx
mov edi, 1
shl edi, cl
movsxd rsi, esi
cmp ecx, 0x20
sbb r8d, r8d
and edi, r8d
cmp rdx, rsi
jbe 0x43a185
mov rcx, qword [0x0060ad20]
lea rcx, [rcx + rsi*4]
lock or dword [rcx], edi
mov rcx, qword [0x0060b7f0]
mov qword [rax + 8], rcx
mov rcx, rax
nop
mov qword [0x0060b7f0], rax
nop
mov edx, 1
lea rsi, [0x0060b7f8]
lock xadd dword [rsi], edx
mov rdx, qword [rcx + 0x1228]
shr rdx, 0x3d
test dl, dl
jne 0x43a173
mov rax, qword [rsp + 0x10]
movabs rdx, 0x1fffffffffffffff
and rdx, rax
bts rdx, 0x3f
nop
nop
xchg qword [rcx + 0x1228], rdx
add rsp, 0x18
pop rbp
ret
lea rax, [0x005660b1]
mov ebx, 0x28
nop
call fcn.0042d980
mov rax, rsi
mov rcx, rdx
call fcn.00450f20
call fcn.0042c3e0
lea rax, [0x005659e9]
mov ebx, 0x23
call fcn.0042d980
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.0044eca0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.0043a040
Function at 0x443260
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x10
mov qword [rsp + 0x20], rax
test rbx, rbx
jbe 0x4433d7
movzx edx, byte [rax]
test edx, edx
jne 0x443294
nop dword [rax]
test r8b, r8b
jne 0x443294
xor eax, eax
xor ebx, ebx
mov rcx, rbx
xor edi, edi
add rsp, 0x10
pop rbp
ret
bt edx, 7
jae 0x4432a7
xor edx, edx
xor r8d, r8d
xor r9d, r9d
jmp 0x443397
mov r8d, 1
mov r9d, edx
and edx, 1
neg edx
shr r9d, 1
xor edx, r9d
add dword [rsi], edx
nop dword [rax]
cmp rbx, r8
jb 0x443385
sub rbx, r8
sub rcx, r8
mov rdx, rcx
neg rdx
sar rdx, 0x3f
and r8, rdx
lea rdx, [rax + r8]
test rbx, rbx
jbe 0x443377
movzx esi, byte [rax + r8]
bt esi, 7
jae 0x4432fd
xor eax, eax
xor esi, esi
xor r8d, r8d
jmp 0x443340
mov eax, 1
cmp rax, rbx
ja 0x44332b
add qword [rdi], rsi
sub rcx, rax
sub rbx, rax
mov rsi, rcx
neg rsi
sar rsi, 0x3f
and rax, rsi
add rax, rdx
mov edi, 1
add rsp, 0x10
pop rbp
ret
mov rcx, rbx
call fcn.00450fe0
lea r8d, [rcx + 7]
mov rcx, r11
mov eax, r12d
nop dword [rax]
cmp rax, rbx
jae 0x44336f
movzx r9d, byte [rax + rdx]
mov r10d, r9d
and r9d, 0x7f
mov r11, rcx
mov ecx, r8d
shl r9d, cl
lea r12d, [rax + 1]
or esi, r9d
test r10b, 0x80
jne 0x443333
mov rcx, r11
mov eax, r12d
jmp 0x443302
mov rcx, rbx
call fcn.00450f20
xor eax, eax
mov rcx, rax
nop dword [rax]
call fcn.00450f20
mov eax, r8d
mov rcx, rbx
call fcn.00450fe0
lea r9d, [rcx + 7]
mov rcx, r12
cmp rbx, rdx
jbe 0x4433cd
movzx r10d, byte [rdx + rax]
mov r11d, r10d
and r10d, 0x7f
mov r12, rcx
mov ecx, r9d
shl r10d, cl
inc edx
or r8d, r10d
test r11b, 0x80
jne 0x443390
mov rcx, r12
mov r9d, edx
mov edx, r8d
mov r8d, r9d
jmp 0x4432ad
mov eax, edx
mov rcx, rbx
call fcn.00450f20
xor eax, eax
mov rcx, rax
nop dword [rax]
call fcn.00450f20
nop
int3

Function at 0x4489a0
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x448a4f
push rbp
mov rbp, rsp
sub rsp, 0x58
mov qword [rsp + 0x70], rbx
lea rdx, [rsp + 0x68]
mov qword [rsp + 8], 0
movups xmmword [rsp + 0x10], xmm15
movups xmmword [rsp + 0x18], xmm15
movups xmmword [rsp + 0x28], xmm15
movups xmmword [rsp + 0x38], xmm15
movups xmmword [rsp + 0x48], xmm15
lea rsi, [0x00448aa0]
mov qword [rsp + 0x10], rsi
mov rsi, qword [rsp + 0x60]
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdx
mov rdx, r14
mov qword [rsp + 0x28], rdx
lea rdx, [rsp + 8]
mov qword [rsp + 0x30], rdx
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x48], rcx
mov qword [rsp + 0x50], rdi
lea rax, [rsp + 0x10]
mov qword [rsp], rax
call fcn.0044eb60
xorps xmm15, xmm15
mov r14, qword [0x0065e5b0]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 8]
add rsp, 0x58
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
call fcn.0044eca0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
nop dword [rax]
jmp fcn.004489a0
Function at 0x450a80
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x403103
push rbp
mov rbp, rsp
sub rsp, 0x18
mov rdx, qword [rax]
mov rcx, qword [rax + 8]
mov rax, rdx
call fcn.004079c0
add rsp, 0x18
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.0044eca0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp 0x4030e0
cmp byte [0x0065e3ab], 0
je 0x450a95
mov rcx, qword [rax + 8]
mov rax, qword [rax]
jmp 0x44dce0
jmp 0x4030e0

Function at 0x450aa0
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
nop
mov eax, dword [rax]
movabs rcx, 0xe7037ed1a0b428db
xor rcx, rax
xor rax, rbx
xor rax, qword [0x0065e660]
movabs rdx, 0xa0761d6478bd642f
xor rdx, rax
mov rax, rcx
mul rdx
xor rax, rdx
mov rcx, rax
movabs rax, 0x1d8e4e27c47d124b
mul rcx
xor rax, rdx
nop
nop
ret
cmp byte [0x0065e3ab], 0
je 0x450ad5
movq xmm0, rbx
pinsrd xmm0, dword [rax], 2
aesenc xmm0, xmmword [0x0065e960]
aesenc xmm0, xmmword [0x0065e970]
aesenc xmm0, xmmword [0x0065e980]
movq rax, xmm0
ret
jmp 0x407be0

Function at 0x450ae0
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
nop
mov rax, qword [rax]
movabs rcx, 0xe7037ed1a0b428db
xor rcx, rax
xor rax, rbx
xor rax, qword [0x0065e660]
movabs rdx, 0xa0761d6478bd642f
xor rdx, rax
mov rax, rcx
mul rdx
xor rax, rdx
mov rcx, rax
movabs rax, 0x1d8e4e27c47d1247
mul rcx
xor rax, rdx
nop
nop
ret
cmp byte [0x0065e3ab], 0
je 0x450b16
movq xmm0, rbx
pinsrq xmm0, qword [rax], 1
aesenc xmm0, xmmword [0x0065e960]
aesenc xmm0, xmmword [0x0065e970]
aesenc xmm0, xmmword [0x0065e980]
movq rax, xmm0
ret
jmp 0x407c40

Function at 0x4527e0
Capabilities:
Allocate thread local storage

Disassembly:
push rbp
mov rbp, rsp
mov rax, rsp
and rsp, 0xfffffffffffffff0
sub rsp, 0x30
mov qword [rsp + 0x20], rax
mov rax, qword [sym.imp.kernel32.dll_TlsAlloc]
call rax
mov rsp, qword [rsp + 0x20]
mov rcx, rax
cmp rcx, 0x40
jb 0x452814
mov rcx, 0x28
jmp 0x45281f
shl rcx, 3
add rcx, 0x1480
mov qword [0x0065e5b0], rcx
pop rbp
ret

Function at 0x459cc0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x459d7d
push rbp
mov rbp, rsp
sub rsp, 0x30
movabs rdx, 0x1d12193730143231
mov qword [rsp + 0x26], rdx
mov word [rsp + 0x2e], 0xa2ad
movabs rdx, 0x209090705090602
mov qword [rsp + 0x1c], rdx
mov word [rsp + 0x24], 0x608
xor eax, eax
jmp 0x459d20
movzx r9d, byte [rsp + rsi + 0x26]
sub r9d, edx
lea edx, [r9 - 0x64]
mov byte [rsp + rdi + 0x26], dl
lea edx, [r8 - 0x64]
mov byte [rsp + rsi + 0x26], dl
add rax, 2
nop
cmp rax, 0xa
jge 0x459d4d
movzx edx, byte [rsp + rax + 0x1c]
movzx esi, byte [rsp + rax + 0x1d]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0xa
jae 0x459d70
movzx r8d, byte [rsp + rdi + 0x26]
sub r8d, edx
cmp rsi, 0xa
jb 0x459d02
jmp 0x459d64
xor eax, eax
lea rbx, [rsp + 0x26]
mov ecx, 0xa
call fcn.00440c40
add rsp, 0x30
pop rbp
ret
mov eax, esi
mov ecx, 0xa
call fcn.00450f20
mov eax, edi
mov ecx, 0xa
call fcn.00450f20
nop
nop dword [rax]
call fcn.0044eca0
jmp fcn.00459cc0
Function at 0x459e80
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x459f58
push rbp
mov rbp, rsp
sub rsp, 0x38
movabs rdx, 0xe09d584fe13235eb
mov qword [rsp + 0x1a], rdx
mov dword [rsp + 0x22], 0x994feceb
movabs rdx, 0x4080a050b050a05
mov qword [rsp + 0x26], rdx
movabs rdx, 0x80904080a050b05
mov qword [rsp + 0x28], rdx
movabs rdx, 0x9030b0705000605
mov qword [rsp + 0x30], rdx
xor eax, eax
jmp 0x459ef4
movzx r9d, byte [rsp + rsi + 0x1a]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x3b]
mov byte [rsp + rdi + 0x1a], dl
mov byte [rsp + rsi + 0x1a], r8b
add rax, 2
cmp rax, 0x12
jge 0x459f28
movzx edx, byte [rsp + rax + 0x26]
movzx esi, byte [rsp + rax + 0x27]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0xc
jae 0x459f4b
movzx r8d, byte [rsp + rdi + 0x1a]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x3b]
nop
cmp rsi, 0xc
jb 0x459eda
jmp 0x459f3f
xor eax, eax
lea rbx, [rsp + 0x1a]
mov ecx, 0xc
call fcn.00440c40
add rsp, 0x38
pop rbp
ret
mov eax, esi
mov ecx, 0xc
call fcn.00450f20
mov eax, edi
mov ecx, 0xc
call fcn.00450f20
nop
call fcn.0044eca0
nop dword [rax]
jmp fcn.00459e80

Function at 0x45a060
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x45a132
push rbp
mov rbp, rsp
sub rsp, 0x38
movabs rdx, 0x368a9389e1d7398c
mov qword [rsp + 0x1a], rdx
movabs rdx, 0x358d33888ae1368a
mov qword [rsp + 0x20], rdx
movabs rdx, 0xa02050304090b06
mov qword [rsp + 0x28], rdx
movabs rdx, 0xa0006050c080c
mov qword [rsp + 0x30], rdx
xor eax, eax
jmp 0x45a0cc
movzx r9d, byte [rsp + rsi + 0x1a]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x66]
mov byte [rsp + rdi + 0x1a], dl
mov byte [rsp + rsi + 0x1a], r8b
add rax, 2
cmp rax, 0x10
jge 0x45a0fe
movzx edx, byte [rsp + rax + 0x28]
movzx esi, byte [rsp + rax + 0x29]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0xe
jae 0x45a125
movzx r8d, byte [rsp + rdi + 0x1a]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x66]
cmp rsi, 0xe
jb 0x45a0b2
jmp 0x45a115
xor eax, eax
lea rbx, [rsp + 0x1a]
mov ecx, 0xe
call fcn.00440c40
add rsp, 0x38
pop rbp
ret
mov eax, esi
mov ecx, 0xe
nop dword [rax]
call fcn.00450f20
mov eax, edi
mov ecx, 0xe
call fcn.00450f20
nop
call fcn.0044eca0
jmp fcn.0045a060
Function at 0x45a140
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x45a20c
push rbp
mov rbp, rsp
sub rsp, 0x38
movabs rdx, 0x311834d636ddd839
mov qword [rsp + 0x2a], rdx
movabs rdx, 0xcd32d06fdc623118
mov qword [rsp + 0x30], rdx
movabs rdx, 0x40d060d0d0a080d
mov qword [rsp + 0x1c], rdx
movabs rdx, 0x90201040b0b040d
mov qword [rsp + 0x22], rdx
xor eax, eax
jmp 0x45a1af
movzx r9d, byte [rsp + rsi + 0x2a]
sub r9d, edx
lea edx, [r9 + 0x6e]
mov byte [rsp + rdi + 0x2a], dl
lea edx, [r8 + 0x6e]
mov byte [rsp + rsi + 0x2a], dl
add rax, 2
cmp rax, 0xe
jge 0x45a1dc
movzx edx, byte [rsp + rax + 0x1c]
movzx esi, byte [rsp + rax + 0x1d]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0xe
jae 0x45a1ff
movzx r8d, byte [rsp + rdi + 0x2a]
sub r8d, edx
cmp rsi, 0xe
jb 0x45a192
jmp 0x45a1f3
xor eax, eax
lea rbx, [rsp + 0x2a]
mov ecx, 0xe
call fcn.00440c40
add rsp, 0x38
pop rbp
ret
mov eax, esi
mov ecx, 0xe
call fcn.00450f20
mov eax, edi
mov ecx, 0xe
call fcn.00450f20
nop
call fcn.0044eca0
jmp fcn.0045a140

Function at 0x45a220
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x45a2fd
push rbp
mov rbp, rsp
sub rsp, 0x40
movabs rdx, 0x659bad31a6669a32
mov qword [rsp + 0x1c], rdx
movabs rdx, 0xa500369ff50231ac
mov qword [rsp + 0x24], rdx
movabs rdx, 0x2020a0e070e0b02
mov qword [rsp + 0x2c], rdx
movabs rdx, 0x106010b02020a0e
mov qword [rsp + 0x30], rdx
movabs rdx, 0xa0c05080f03070e
mov qword [rsp + 0x38], rdx
xor eax, eax
nop
jmp 0x45a2a0
movzx r9d, byte [rsp + rsi + 0x1c]
sub r9d, edx
lea edx, [r9 - 0x57]
mov byte [rsp + rdi + 0x1c], dl
lea edx, [r8 - 0x57]
mov byte [rsp + rsi + 0x1c], dl
add rax, 2
nop
cmp rax, 0x14
jge 0x45a2cd
movzx edx, byte [rsp + rax + 0x2c]
movzx esi, byte [rsp + rax + 0x2d]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x10
jae 0x45a2f0
movzx r8d, byte [rsp + rdi + 0x1c]
sub r8d, edx
cmp rsi, 0x10
jb 0x45a282
jmp 0x45a2e4
xor eax, eax
lea rbx, [rsp + 0x1c]
mov ecx, 0x10
call fcn.00440c40
add rsp, 0x40
pop rbp
ret
mov eax, esi
mov ecx, 0x10
call fcn.00450f20
mov eax, edi
mov ecx, 0x10
call fcn.00450f20
nop
nop dword [rax]
call fcn.0044eca0
jmp fcn.0045a220
Function at 0x45a420
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x45a50c
push rbp
mov rbp, rsp
sub rsp, 0x40
movabs rdx, 0x14c679cc3036c835
mov qword [rsp + 0x19], rdx
movabs rdx, 0x3714c679cc3036c8
mov qword [rsp + 0x1a], rdx
movabs rdx, 0x3580d2cf395e7377
mov qword [rsp + 0x22], rdx
movabs rdx, 0xf070e060d0b0104
mov qword [rsp + 0x2a], rdx
movabs rdx, 0x10b06060f0d0f07
mov qword [rsp + 0x30], rdx
movabs rdx, 0x4050e090d0a040f
mov qword [rsp + 0x38], rdx
xor eax, eax
jmp 0x45a4aa
movzx r9d, byte [rsp + rsi + 0x19]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x5a]
mov byte [rsp + rdi + 0x19], dl
mov byte [rsp + rsi + 0x19], r8b
add rax, 2
cmp rax, 0x16
jge 0x45a4dc
movzx edx, byte [rsp + rax + 0x2a]
movzx esi, byte [rsp + rax + 0x2b]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x11
jae 0x45a4ff
movzx r8d, byte [rsp + rdi + 0x19]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x5a]
cmp rsi, 0x11
jb 0x45a490
jmp 0x45a4f3
xor eax, eax
lea rbx, [rsp + 0x19]
mov ecx, 0x11
call fcn.00440c40
add rsp, 0x40
pop rbp
ret
mov eax, esi
mov ecx, 0x11
call fcn.00450f20
mov eax, edi
mov ecx, 0x11
call fcn.00450f20
nop
call fcn.0044eca0
jmp fcn.0045a420

Function at 0x45a520
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x45a60a
push rbp
mov rbp, rsp
sub rsp, 0x40
movabs rdx, 0xfcf5330e9fa339f5
mov qword [rsp + 0x18], rdx
movabs rdx, 0x38fefcf5330e9fa3
mov qword [rsp + 0x1a], rdx
movabs rdx, 0xa6329d333503c9f8
mov qword [rsp + 0x22], rdx
movabs rdx, 0x211080007060b00
mov qword [rsp + 0x2a], rdx
movabs rdx, 0xc0f08040b0a0211
mov qword [rsp + 0x30], rdx
movabs rdx, 0x70304000f0b0608
mov qword [rsp + 0x38], rdx
xor eax, eax
jmp 0x45a5ad
movzx r9d, byte [rsp + rsi + 0x18]
sub r9d, edx
lea edx, [r9 - 0x55]
mov byte [rsp + rdi + 0x18], dl
lea edx, [r8 - 0x55]
mov byte [rsp + rsi + 0x18], dl
add rax, 2
cmp rax, 0x16
jge 0x45a5da
movzx edx, byte [rsp + rax + 0x2a]
movzx esi, byte [rsp + rax + 0x2b]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x12
jae 0x45a5fd
movzx r8d, byte [rsp + rdi + 0x18]
sub r8d, edx
cmp rsi, 0x12
jb 0x45a590
jmp 0x45a5f1
xor eax, eax
lea rbx, [rsp + 0x18]
mov ecx, 0x12
call fcn.00440c40
add rsp, 0x40
pop rbp
ret
mov eax, esi
mov ecx, 0x12
call fcn.00450f20
mov eax, edi
mov ecx, 0x12
call fcn.00450f20
nop
call fcn.0044eca0
jmp fcn.0045a520
Function at 0x45caa0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x45cbac
push rbp
mov rbp, rsp
sub rsp, 0x50
movabs rdx, 0x35cb4d31bf35b131
mov qword [rsp + 0x18], rdx
movabs rdx, 0x53ce36c968b5cbd4
mov qword [rsp + 0x20], rdx
movabs rdx, 0xc77353ce36c968b5
mov qword [rsp + 0x22], rdx
movabs rdx, 0x356036b54d42445e
mov qword [rsp + 0x2a], rdx
movabs rdx, 0x100f06151218110c
mov qword [rsp + 0x32], rdx
movabs rdx, 0xb14080e0f0b1005
mov qword [rsp + 0x3a], rdx
movabs rdx, 0x1413090f100a0b14
mov qword [rsp + 0x40], rdx
movabs rdx, 0x614030b12180116
mov qword [rsp + 0x48], rdx
xor eax, eax
jmp 0x45cb48
movzx r9d, byte [rsp + rsi + 0x18]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x52]
mov byte [rsp + rdi + 0x18], dl
mov byte [rsp + rsi + 0x18], r8b
add rax, 2
cmp rax, 0x1e
jge 0x45cb7c
movzx edx, byte [rsp + rax + 0x32]
movzx esi, byte [rsp + rax + 0x33]
mov edi, edx
xor edx, esi
add edx, eax
nop
cmp rdi, 0x1a
jae 0x45cb9f
movzx r8d, byte [rsp + rdi + 0x18]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x52]
cmp rsi, 0x1a
jb 0x45cb2e
jmp 0x45cb93
xor eax, eax
lea rbx, [rsp + 0x18]
mov ecx, 0x1a
call fcn.00440c40
add rsp, 0x50
pop rbp
ret
mov eax, esi
mov ecx, 0x1a
call fcn.00450f20
mov eax, edi
mov ecx, 0x1a
call fcn.00450f20
nop
call fcn.0044eca0
jmp fcn.0045caa0

Function at 0x4637e0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x463907
push rbp
mov rbp, rsp
sub rsp, 0x68
movabs rdx, 0x9637353535033732
mov qword [rsp + 0x19], rdx
movabs rdx, 0xba8329e97d5af96
mov qword [rsp + 0x20], rdx
movabs rdx, 0x77398b0b31357491
mov qword [rsp + 0x28], rdx
movabs rdx, 0x3732d130a90cf437
mov qword [rsp + 0x30], rdx
movabs rdx, 0x132b3477b30fd37
mov qword [rsp + 0x38], rdx
movabs rdx, 0x2223260710161420
mov qword [rsp + 0x40], rdx
movabs rdx, 0x1909181f1c1f091f
mov qword [rsp + 0x48], rdx
movabs rdx, 0x19190e2422080e02
mov qword [rsp + 0x50], rdx
movabs rdx, 0x1a0d1f0713140f08
mov qword [rsp + 0x58], rdx
movabs rdx, 0xa0a14090b020220
mov qword [rsp + 0x60], rdx
xor eax, eax
jmp 0x4638a9
movzx r9d, byte [rsp + rsi + 0x19]
sub r9d, edx
lea edx, [r9 - 0x3c]
mov byte [rsp + rdi + 0x19], dl
lea edx, [r8 - 0x3c]
mov byte [rsp + rsi + 0x19], dl
add rax, 2
cmp rax, 0x28
jge 0x4638d7
movzx edx, byte [rsp + rax + 0x40]
movzx esi, byte [rsp + rax + 0x41]
mov edi, edx
xor edx, esi
add edx, eax
nop
cmp rdi, 0x27
jae 0x4638fa
movzx r8d, byte [rsp + rdi + 0x19]
sub r8d, edx
cmp rsi, 0x27
jb 0x46388c
jmp 0x4638ee
xor eax, eax
lea rbx, [rsp + 0x19]
mov ecx, 0x27
call fcn.00440c40
add rsp, 0x68
pop rbp
ret
mov eax, esi
mov ecx, 0x27
call fcn.00450f20
mov eax, edi
mov ecx, 0x27
call fcn.00450f20
nop
call fcn.0044eca0
jmp fcn.004637e0
Function at 0x46efa0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x46f0d8
push rbp
mov rbp, rsp
sub rsp, 0x70
movabs rdx, 0xc4d5cdc2de399c2b
mov qword [rsp + 0x1e], rdx
movabs rdx, 0x89ec3233afbfada3
mov qword [rsp + 0x26], rdx
movabs rdx, 0x6951cc64a2cf9bb2
mov qword [rsp + 0x2e], rdx
movabs rdx, 0xcd6167ec6ee76857
mov qword [rsp + 0x36], rdx
movabs rdx, 0x408972f89f65a810
mov qword [rsp + 0x3e], rdx
movabs rdx, 0x180321240e081a13
mov qword [rsp + 0x46], rdx
movabs rdx, 0xa241c160727150f
mov qword [rsp + 0x4e], rdx
movabs rdx, 0x2020a241c160727
mov qword [rsp + 0x50], rdx
movabs rdx, 0x10009070a050203
mov qword [rsp + 0x58], rdx
movabs rdx, 0x1c1f261112002001
mov qword [rsp + 0x60], rdx
movabs rdx, 0x60411231201100b
mov qword [rsp + 0x68], rdx
xor eax, eax
jmp 0x46f075
movzx r9d, byte [rsp + rsi + 0x1e]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x75]
mov byte [rsp + rdi + 0x1e], dl
mov byte [rsp + rsi + 0x1e], r8b
add rax, 2
cmp rax, 0x2a
jge 0x46f0a8
movzx edx, byte [rsp + rax + 0x46]
movzx esi, byte [rsp + rax + 0x47]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x28
jae 0x46f0cb
movzx r8d, byte [rsp + rdi + 0x1e]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x75]
nop
cmp rsi, 0x28
jb 0x46f05b
jmp 0x46f0bf
xor eax, eax
lea rbx, [rsp + 0x1e]
mov ecx, 0x28
call fcn.00440c40
add rsp, 0x70
pop rbp
ret
mov eax, esi
mov ecx, 0x28
call fcn.00450f20
mov eax, edi
mov ecx, 0x28
call fcn.00450f20
nop
call fcn.0044eca0
nop dword [rax]
jmp fcn.0046efa0

Function at 0x46f6a0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x46f77d
push rbp
mov rbp, rsp
sub rsp, 0x40
movabs rdx, 0xed6368a533b3a830
mov qword [rsp + 0x1a], rdx
movabs rdx, 0xb42c437b623c39e8
mov qword [rsp + 0x22], rdx
movabs rdx, 0xe060f0606020104
mov qword [rsp + 0x2a], rdx
movabs rdx, 0xd020d0a06050e06
mov qword [rsp + 0x30], rdx
movabs rdx, 0xf07060a0c07080e
mov qword [rsp + 0x38], rdx
xor eax, eax
nop
jmp 0x46f720
movzx r9d, byte [rsp + rsi + 0x1a]
sub r9d, edx
lea edx, [r9 - 0x6f]
mov byte [rsp + rdi + 0x1a], dl
lea edx, [r8 - 0x6f]
mov byte [rsp + rsi + 0x1a], dl
add rax, 2
nop
cmp rax, 0x16
jge 0x46f74d
movzx edx, byte [rsp + rax + 0x2a]
movzx esi, byte [rsp + rax + 0x2b]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x10
jae 0x46f770
movzx r8d, byte [rsp + rdi + 0x1a]
sub r8d, edx
cmp rsi, 0x10
jb 0x46f702
jmp 0x46f764
xor eax, eax
lea rbx, [rsp + 0x1a]
mov ecx, 0x10
call fcn.00440c40
add rsp, 0x40
pop rbp
ret
mov eax, esi
mov ecx, 0x10
call fcn.00450f20
mov eax, edi
mov ecx, 0x10
call fcn.00450f20
nop
nop dword [rax]
call fcn.0044eca0
jmp fcn.0046f6a0
Function at 0x474060
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x474118
push rbp
mov rbp, rsp
sub rsp, 0x30
movabs rdx, 0xd852656e69dae8ae
mov qword [rsp + 0x1c], rdx
movabs rdx, 0x102070606020701
mov qword [rsp + 0x24], rdx
mov dword [rsp + 0x2c], 0x1000100
xor eax, eax
jmp 0x4740b6
movzx r9d, byte [rsp + rsi + 0x1c]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x40]
mov byte [rsp + rdi + 0x1c], dl
mov byte [rsp + rsi + 0x1c], r8b
add rax, 2
cmp rax, 0xc
jge 0x4740e8
movzx edx, byte [rsp + rax + 0x24]
movzx esi, byte [rsp + rax + 0x25]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 8
jae 0x47410b
movzx r8d, byte [rsp + rdi + 0x1c]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x40]
cmp rsi, 8
jb 0x47409c
jmp 0x4740ff
xor eax, eax
lea rbx, [rsp + 0x1c]
mov ecx, 8
call fcn.00440c40
add rsp, 0x30
pop rbp
ret
mov eax, esi
mov ecx, 8
call fcn.00450f20
mov eax, edi
mov ecx, 8
call fcn.00450f20
nop
call fcn.0044eca0
nop dword [rax]
jmp fcn.00474060

Function at 0x474d00
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x474db8
push rbp
mov rbp, rsp
sub rsp, 0x30
movabs rdx, 0x63502c543d435b55
mov qword [rsp + 0x1e], rdx
movabs rdx, 0x406020105000306
mov qword [rsp + 0x26], rdx
mov word [rsp + 0x2e], 0x106
xor eax, eax
jmp 0x474d58
movzx r9d, byte [rsp + rsi + 0x1e]
sub r9d, edx
lea edx, [r9 + 0x1e]
mov byte [rsp + rdi + 0x1e], dl
lea edx, [r8 + 0x1e]
mov byte [rsp + rsi + 0x1e], dl
add rax, 2
cmp rax, 0xa
jge 0x474d88
movzx edx, byte [rsp + rax + 0x26]
movzx esi, byte [rsp + rax + 0x27]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 8
jae 0x474dab
movzx r8d, byte [rsp + rdi + 0x1e]
sub r8d, edx
nop dword [rax]
cmp rsi, 8
jb 0x474d3b
jmp 0x474d9f
xor eax, eax
lea rbx, [rsp + 0x1e]
mov ecx, 8
call fcn.00440c40
add rsp, 0x30
pop rbp
ret
mov eax, esi
mov ecx, 8
call fcn.00450f20
mov eax, edi
mov ecx, 8
call fcn.00450f20
nop
call fcn.0044eca0
nop dword [rax]
jmp fcn.00474d00

Function at 0x477e80
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x477f3d
push rbp
mov rbp, rsp
sub rsp, 0x30
movabs rdx, 0x988877619f70794b
mov qword [rsp + 0x1d], rdx
mov byte [rsp + 0x25], pe_nt_image_headers64
movabs rdx, 0x601020607080203
mov qword [rsp + 0x26], rdx
mov word [rsp + 0x2e], 0x808
xor eax, eax
nop
jmp 0x477ee0
movzx r9d, byte [rsp + rsi + 0x1d]
sub r9d, edx
lea edx, [r9 - 0xb]
mov byte [rsp + rdi + 0x1d], dl
lea edx, [r8 - 0xb]
mov byte [rsp + rsi + 0x1d], dl
add rax, 2
nop
cmp rax, 0xa
jge 0x477f0d
movzx edx, byte [rsp + rax + 0x26]
movzx esi, byte [rsp + rax + 0x27]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 9
jae 0x477f30
movzx r8d, byte [rsp + rdi + 0x1d]
sub r8d, edx
cmp rsi, 9
jb 0x477ec2
jmp 0x477f24
xor eax, eax
lea rbx, [rsp + 0x1d]
mov ecx, 9
call fcn.00440c40
add rsp, 0x30
pop rbp
ret
mov eax, esi
mov ecx, 9
call fcn.00450f20
mov eax, edi
mov ecx, 9
call fcn.00450f20
nop
nop dword [rax]
call fcn.0044eca0
jmp fcn.00477e80