joyce8/EMBER2024-capa huggingface dataset:
Function at 0x382346180
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x38234624a
push rbp
mov rbp, rsp
sub rsp, 0x48
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rbx
mov qword [rsp], rax
mov qword [rsp + 8], rbx
mov byte [rsp + 0x10], 0
call fcn.382253600
xorps xmm15, xmm15
mov r14, qword [0x3825062f8]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x18], 0xffffffffffffffff
jne 0x38234622f
mov rcx, qword [rsp + 0x60]
lea rdx, [rcx + 1]
mov qword [rsp + 0x40], rdx
lea rax, [0x3823b4500]
xor ebx, ebx
mov rcx, rdx
call fcn.3822916a0
mov rbx, qword [rsp + 0x60]
mov rcx, rax
xor edi, edi
mov rsi, qword [rsp + 0x40]
mov rax, qword [rsp + 0x58]
nop dword [rax]
call fcn.382346ac0
inc rbx
cmp rcx, rbx
jae 0x38234621e
mov edi, 1
lea rsi, [0x3823b4500]
call fcn.382291780
mov word [rax + rbx*2 - 2], 0
xor edi, edi
xor esi, esi
add rsp, 0x48
pop rbp
ret
xor eax, eax
xor ebx, ebx
mov rcx, rbx
lea rdi, [0x3823f9518]
lea rsi, [0x3823f9198]
add rsp, 0x48
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.3822a4520
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.382346180

Function at 0x382348300
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x3823483d2
push rbp
mov rbp, rsp
sub rsp, 0x38
movabs rdx, 0xd5da64852e696133
mov qword [rsp + 0x29], rdx
movabs rdx, 0xf22c4f6f6c206fd5
mov qword [rsp + 0x30], rdx
movabs rdx, 0xe0703060c0e0d00
mov qword [rsp + 0x19], rdx
movabs rdx, 0xc06000d0d040e04
mov qword [rsp + 0x21], rdx
xor eax, eax
jmp 0x38234836c
movzx r9d, byte [rsp + rsi + 0x29]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x77]
mov byte [rsp + rdi + 0x29], dl
mov byte [rsp + rsi + 0x29], r8b
add rax, 2
cmp rax, 0x10
jge 0x38234839e
movzx edx, byte [rsp + rax + 0x19]
movzx esi, byte [rsp + rax + 0x1a]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0xf
jae 0x3823483c5
movzx r8d, byte [rsp + rdi + 0x29]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x77]
cmp rsi, 0xf
jb 0x382348352
jmp 0x3823483b5
xor eax, eax
lea rbx, [rsp + 0x29]
mov ecx, 0xf
call fcn.382294b80
add rsp, 0x38
pop rbp
ret
mov eax, esi
mov ecx, 0xf
nop dword [rax]
call fcn.3822a6820
mov eax, edi
mov ecx, 0xf
call fcn.3822a6820
nop
call fcn.3822a4520
jmp fcn.382348300
Function at 0x382348680
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x38234874c
push rbp
mov rbp, rsp
sub rsp, 0x38
movabs rdx, 0x7540e3e729c670d4
mov qword [rsp + 0x2a], rdx
movabs rdx, 0xd1d2cd2179727540
mov qword [rsp + 0x30], rdx
movabs rdx, 0x2050409090a0d03
mov qword [rsp + 0x1a], rdx
movabs rdx, 0xb0c00020d090b06
mov qword [rsp + 0x22], rdx
xor eax, eax
jmp 0x3823486ef
movzx r9d, byte [rsp + rsi + 0x2a]
sub r9d, edx
lea edx, [r9 - 0x54]
mov byte [rsp + rdi + 0x2a], dl
lea edx, [r8 - 0x54]
mov byte [rsp + rsi + 0x2a], dl
add rax, 2
cmp rax, 0x10
jge 0x38234871c
movzx edx, byte [rsp + rax + 0x1a]
movzx esi, byte [rsp + rax + 0x1b]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0xe
jae 0x38234873f
movzx r8d, byte [rsp + rdi + 0x2a]
sub r8d, edx
cmp rsi, 0xe
jb 0x3823486d2
jmp 0x382348733
xor eax, eax
lea rbx, [rsp + 0x2a]
mov ecx, 0xe
call fcn.382294b80
add rsp, 0x38
pop rbp
ret
mov eax, esi
mov ecx, 0xe
call fcn.3822a6820
mov eax, edi
mov ecx, 0xe
call fcn.3822a6820
nop
call fcn.3822a4520
jmp fcn.382348680

Function at 0x382349f40
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x38234a01d
push rbp
mov rbp, rsp
sub rsp, 0x40
movabs rdx, 0xe80c1c252c1f65dd
mov qword [rsp + 0x31], rdx
movabs rdx, 0xcd6575049dd421e8
mov qword [rsp + 0x38], rdx
movabs rdx, 0x8020e070900000a
mov qword [rsp + 0x1f], rdx
movabs rdx, 0x70908020e070900
mov qword [rsp + 0x21], rdx
movabs rdx, 0xe05030b0a040006
mov qword [rsp + 0x29], rdx
xor eax, eax
nop
jmp 0x382349fc0
movzx r9d, byte [rsp + rsi + 0x31]
sub r9d, edx
lea edx, [r9 + 0x56]
mov byte [rsp + rdi + 0x31], dl
lea edx, [r8 + 0x56]
mov byte [rsp + rsi + 0x31], dl
add rax, 2
nop
cmp rax, 0x12
jge 0x382349fed
movzx edx, byte [rsp + rax + 0x1f]
movzx esi, byte [rsp + rax + 0x20]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0xf
jae 0x38234a010
movzx r8d, byte [rsp + rdi + 0x31]
sub r8d, edx
cmp rsi, 0xf
jb 0x382349fa2
jmp 0x38234a004
xor eax, eax
lea rbx, [rsp + 0x31]
mov ecx, 0xf
call fcn.382294b80
add rsp, 0x40
pop rbp
ret
mov eax, esi
mov ecx, 0xf
call fcn.3822a6820
mov eax, edi
mov ecx, 0xf
call fcn.3822a6820
nop
nop dword [rax]
call fcn.3822a4520
jmp fcn.382349f40
Function at 0x38234a040
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x38234a112
push rbp
mov rbp, rsp
sub rsp, 0x38
movabs rdx, 0x7a7c645f45777672
mov qword [rsp + 0x2b], rdx
movabs rdx, 0x57524e6f5e7a7c64
mov qword [rsp + 0x30], rdx
movabs rdx, 0x807020600070901
mov qword [rsp + 0x1b], rdx
movabs rdx, 0x5020a00070b0408
mov qword [rsp + 0x23], rdx
xor eax, eax
jmp 0x38234a0ac
movzx r9d, byte [rsp + rsi + 0x2b]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x12]
mov byte [rsp + rdi + 0x2b], dl
mov byte [rsp + rsi + 0x2b], r8b
add rax, 2
cmp rax, 0x10
jge 0x38234a0de
movzx edx, byte [rsp + rax + 0x1b]
movzx esi, byte [rsp + rax + 0x1c]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0xd
jae 0x38234a105
movzx r8d, byte [rsp + rdi + 0x2b]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x12]
cmp rsi, 0xd
jb 0x38234a092
jmp 0x38234a0f5
xor eax, eax
lea rbx, [rsp + 0x2b]
mov ecx, 0xd
call fcn.382294b80
add rsp, 0x38
pop rbp
ret
mov eax, esi
mov ecx, 0xd
nop dword [rax]
call fcn.3822a6820
mov eax, edi
mov ecx, 0xd
call fcn.3822a6820
nop
call fcn.3822a4520
jmp fcn.38234a040

Function at 0x38234b140
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x38234b1f8
push rbp
mov rbp, rsp
sub rsp, 0x30
movabs rdx, 0xd63d64baa975682d
mov qword [rsp + 0x28], rdx
movabs rdx, 0x407040600040603
mov qword [rsp + 0x1e], rdx
mov word [rsp + 0x26], 0x303
xor eax, eax
jmp 0x38234b195
movzx r9d, byte [rsp + rsi + 0x28]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x6c]
mov byte [rsp + rdi + 0x28], dl
mov byte [rsp + rsi + 0x28], r8b
add rax, 2
cmp rax, 0xa
jge 0x38234b1c8
movzx edx, byte [rsp + rax + 0x1e]
movzx esi, byte [rsp + rax + 0x1f]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 8
jae 0x38234b1eb
movzx r8d, byte [rsp + rdi + 0x28]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x6c]
nop
cmp rsi, 8
jb 0x38234b17b
jmp 0x38234b1df
xor eax, eax
lea rbx, [rsp + 0x28]
mov ecx, 8
call fcn.382294b80
add rsp, 0x30
pop rbp
ret
mov eax, esi
mov ecx, 8
call fcn.3822a6820
mov eax, edi
mov ecx, 8
call fcn.3822a6820
nop
call fcn.3822a4520
nop dword [rax]
jmp fcn.38234b140

Function at 0x38234b220
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x38234b2d8
push rbp
mov rbp, rsp
sub rsp, 0x30
movabs rdx, 0xa1cbb4727524e1b1
mov qword [rsp + 0x28], rdx
movabs rdx, 0x706010505010205
mov qword [rsp + 0x1e], rdx
mov word [rsp + 0x26], 0x700
xor eax, eax
jmp 0x38234b275
movzx r9d, byte [rsp + rsi + 0x28]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x47]
mov byte [rsp + rdi + 0x28], dl
mov byte [rsp + rsi + 0x28], r8b
add rax, 2
cmp rax, 0xa
jge 0x38234b2a8
movzx edx, byte [rsp + rax + 0x1e]
movzx esi, byte [rsp + rax + 0x1f]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 8
jae 0x38234b2cb
movzx r8d, byte [rsp + rdi + 0x28]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x47]
nop
cmp rsi, 8
jb 0x38234b25b
jmp 0x38234b2bf
xor eax, eax
lea rbx, [rsp + 0x28]
mov ecx, 8
call fcn.382294b80
add rsp, 0x30
pop rbp
ret
mov eax, esi
mov ecx, 8
call fcn.3822a6820
mov eax, edi
mov ecx, 8
call fcn.3822a6820
nop
call fcn.3822a4520
nop dword [rax]
jmp fcn.38234b220
Function at 0x38234b620
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x38234b6d8
push rbp
mov rbp, rsp
sub rsp, 0x30
movabs rdx, 0x72a88c26b2ac36f3
mov qword [rsp + 0x28], rdx
movabs rdx, 0x605040300050301
mov qword [rsp + 0x1c], rdx
mov dword [rsp + 0x24], 0x2040403
xor eax, eax
jmp 0x38234b676
movzx r9d, byte [rsp + rsi + 0x28]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x4f]
mov byte [rsp + rdi + 0x28], dl
mov byte [rsp + rsi + 0x28], r8b
add rax, 2
cmp rax, 0xc
jge 0x38234b6a8
movzx edx, byte [rsp + rax + 0x1c]
movzx esi, byte [rsp + rax + 0x1d]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 8
jae 0x38234b6cb
movzx r8d, byte [rsp + rdi + 0x28]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x4f]
cmp rsi, 8
jb 0x38234b65c
jmp 0x38234b6bf
xor eax, eax
lea rbx, [rsp + 0x28]
mov ecx, 8
call fcn.382294b80
add rsp, 0x30
pop rbp
ret
mov eax, esi
mov ecx, 8
call fcn.3822a6820
mov eax, edi
mov ecx, 8
call fcn.3822a6820
nop
call fcn.3822a4520
nop dword [rax]
jmp fcn.38234b620

Function at 0x38234c1a0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x38234c29b
push rbp
mov rbp, rsp
sub rsp, 0x50
movabs rdx, 0x848e63a06b607c4b
mov qword [rsp + 0x3b], rdx
movabs rdx, 0x646e878a47848e63
mov qword [rsp + 0x40], rdx
movabs rdx, 0x836d69845c766e4f
mov qword [rsp + 0x48], rdx
movabs rdx, 0x400021110080901
mov qword [rsp + 0x1f], rdx
movabs rdx, 0x407000214100a06
mov qword [rsp + 0x27], rdx
movabs rdx, 0xa0e0f0304070002
mov qword [rsp + 0x2b], rdx
movabs rdx, 0x606040914100d00
mov qword [rsp + 0x33], rdx
xor eax, eax
jmp 0x38234c239
movzx r9d, byte [rsp + rsi + 0x3b]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x23]
mov byte [rsp + rdi + 0x3b], dl
mov byte [rsp + rsi + 0x3b], r8b
add rax, 2
cmp rax, 0x1c
jge 0x38234c26b
movzx edx, byte [rsp + rax + 0x1f]
movzx esi, byte [rsp + rax + 0x20]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x15
jae 0x38234c28e
movzx r8d, byte [rsp + rdi + 0x3b]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x23]
cmp rsi, 0x15
jb 0x38234c21f
jmp 0x38234c282
xor eax, eax
lea rbx, [rsp + 0x3b]
mov ecx, 0x15
call fcn.382294b80
add rsp, 0x50
pop rbp
ret
mov eax, esi
mov ecx, 0x15
call fcn.3822a6820
mov eax, edi
mov ecx, 0x15
call fcn.3822a6820
nop
nop dword [rax + rax]
call fcn.3822a4520
jmp fcn.38234c1a0
Function at 0x38234c2c0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x38234c3cc
push rbp
mov rbp, rsp
sub rsp, 0x58
movabs rdx, 0x75acd090bd6c6fc3
mov qword [rsp + 0x3f], rdx
movabs rdx, 0x6e999923209a85a0
mov qword [rsp + 0x47], rdx
movabs rdx, 0x566e999923209a85
mov qword [rsp + 0x48], rdx
movabs rdx, 0x9900aacba6627286
mov qword [rsp + 0x50], rdx
movabs rdx, 0xd0c13141005160a
mov qword [rsp + 0x1f], rdx
movabs rdx, 0x40615080d06170e
mov qword [rsp + 0x27], rdx
movabs rdx, 0xe09030e09001810
mov qword [rsp + 0x2f], rdx
movabs rdx, 0x150215030a111508
mov qword [rsp + 0x37], rdx
xor eax, eax
jmp 0x38234c368
movzx r9d, byte [rsp + rsi + 0x3f]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x4d]
mov byte [rsp + rdi + 0x3f], dl
mov byte [rsp + rsi + 0x3f], r8b
add rax, 2
cmp rax, 0x20
jge 0x38234c39c
movzx edx, byte [rsp + rax + 0x1f]
movzx esi, byte [rsp + rax + 0x20]
mov edi, edx
xor edx, esi
add edx, eax
nop
cmp rdi, 0x19
jae 0x38234c3bf
movzx r8d, byte [rsp + rdi + 0x3f]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x4d]
cmp rsi, 0x19
jb 0x38234c34e
jmp 0x38234c3b3
xor eax, eax
lea rbx, [rsp + 0x3f]
mov ecx, 0x19
call fcn.382294b80
add rsp, 0x58
pop rbp
ret
mov eax, esi
mov ecx, 0x19
call fcn.3822a6820
mov eax, edi
mov ecx, 0x19
call fcn.3822a6820
nop
call fcn.3822a4520
jmp fcn.38234c2c0

Function at 0x38234f1a0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x38234f29b
push rbp
mov rbp, rsp
sub rsp, 0x48
movabs rdx, 0xe074206046eeb9e8
mov qword [rsp + 0x35], rdx
movabs rdx, 0xc5d2f3e074206046
mov qword [rsp + 0x38], rdx
movabs rdx, 0xfadad7d9ae36e054
mov qword [rsp + 0x40], rdx
movabs rdx, 0x3060807030c0d11
mov qword [rsp + 0x19], rdx
movabs rdx, 0xb06030200010f11
mov qword [rsp + 0x21], rdx
movabs rdx, 0x120009100b060302
mov qword [rsp + 0x25], rdx
movabs rdx, 0x120a0e000c060604
mov qword [rsp + 0x2d], rdx
xor eax, eax
jmp 0x38234f239
movzx r9d, byte [rsp + rsi + 0x35]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x6e]
mov byte [rsp + rdi + 0x35], dl
mov byte [rsp + rsi + 0x35], r8b
add rax, 2
cmp rax, 0x1c
jge 0x38234f26b
movzx edx, byte [rsp + rax + 0x19]
movzx esi, byte [rsp + rax + 0x1a]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x13
jae 0x38234f28e
movzx r8d, byte [rsp + rdi + 0x35]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x6e]
cmp rsi, 0x13
jb 0x38234f21f
jmp 0x38234f282
xor eax, eax
lea rbx, [rsp + 0x35]
mov ecx, 0x13
call fcn.382294b80
add rsp, 0x48
pop rbp
ret
mov eax, esi
mov ecx, 0x13
call fcn.3822a6820
mov eax, edi
mov ecx, 0x13
call fcn.3822a6820
nop
nop dword [rax + rax]
call fcn.3822a4520
jmp fcn.38234f1a0
Function at 0x382354200
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x3823542fb
push rbp
mov rbp, rsp
sub rsp, 0x48
movabs rdx, 0x206e7283648072fe
mov qword [rsp + 0x33], rdx
movabs rdx, 0x8f6e617421206e72
mov qword [rsp + 0x38], rdx
movabs rdx, 0x65ee1987f451ad9d
mov qword [rsp + 0x40], rdx
movabs rdx, 0xd00010f0e081212
mov qword [rsp + 0x19], rdx
movabs rdx, 0xe0310011102000c
mov qword [rsp + 0x21], rdx
movabs rdx, 0x4130e0310011102
mov qword [rsp + 0x23], rdx
movabs rdx, 0x2130e110308000f
mov qword [rsp + 0x2b], rdx
xor eax, eax
jmp 0x382354299
movzx r9d, byte [rsp + rsi + 0x33]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x50]
mov byte [rsp + rdi + 0x33], dl
mov byte [rsp + rsi + 0x33], r8b
add rax, 2
cmp rax, 0x1a
jge 0x3823542cb
movzx edx, byte [rsp + rax + 0x19]
movzx esi, byte [rsp + rax + 0x1a]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x15
jae 0x3823542ee
movzx r8d, byte [rsp + rdi + 0x33]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x50]
cmp rsi, 0x15
jb 0x38235427f
jmp 0x3823542e2
xor eax, eax
lea rbx, [rsp + 0x33]
mov ecx, 0x15
call fcn.382294b80
add rsp, 0x48
pop rbp
ret
mov eax, esi
mov ecx, 0x15
call fcn.3822a6820
mov eax, edi
mov ecx, 0x15
call fcn.3822a6820
nop
nop dword [rax + rax]
call fcn.3822a4520
jmp fcn.382354200

Function at 0x382357960
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x382357a68
push rbp
mov rbp, rsp
sub rsp, 0x50
movabs rdx, 0x690262d93fd713e3
mov qword [rsp + 0x37], rdx
movabs rdx, 0xc0b174c33d6c616b
mov qword [rsp + 0x3f], rdx
movabs rdx, 0xddc0b174c33d6c61
mov qword [rsp + 0x40], rdx
movabs rdx, 0x65b069545644df61
mov qword [rsp + 0x48], rdx
movabs rdx, 0xe0c0f0313030b01
mov qword [rsp + 0x1b], rdx
movabs rdx, 0xc02061006140102
mov qword [rsp + 0x23], rdx
movabs rdx, 0x1302030c020610
mov qword [rsp + 0x27], rdx
movabs rdx, 0x170b0402140b0c12
mov qword [rsp + 0x2f], rdx
xor eax, eax
jmp 0x382357a0b
movzx r9d, byte [rsp + rsi + 0x37]
sub r9d, edx
lea edx, [r9 - 0x5a]
mov byte [rsp + rdi + 0x37], dl
lea edx, [r8 - 0x5a]
mov byte [rsp + rsi + 0x37], dl
add rax, 2
cmp rax, 0x1c
jge 0x382357a38
movzx edx, byte [rsp + rax + 0x1b]
movzx esi, byte [rsp + rax + 0x1c]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x19
jae 0x382357a5b
movzx r8d, byte [rsp + rdi + 0x37]
sub r8d, edx
cmp rsi, 0x19
jb 0x3823579ee
jmp 0x382357a4f
xor eax, eax
lea rbx, [rsp + 0x37]
mov ecx, 0x19
call fcn.382294b80
add rsp, 0x50
pop rbp
ret
mov eax, esi
mov ecx, 0x19
call fcn.3822a6820
mov eax, edi
mov ecx, 0x19
call fcn.3822a6820
nop
call fcn.3822a4520
jmp fcn.382357960
Function at 0x3823593a0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x3823594a8
push rbp
mov rbp, rsp
sub rsp, 0x50
movabs rdx, 0x796771854d205d57
mov qword [rsp + 0x37], rdx
movabs rdx, 0x23856f5c20619b87
mov qword [rsp + 0x3f], rdx
movabs rdx, 0x6423856f5c20619b
mov qword [rsp + 0x40], rdx
movabs rdx, 0xa47c986d20647762
mov qword [rsp + 0x48], rdx
movabs rdx, 0xc090c0f110f0f01
mov qword [rsp + 0x19], rdx
movabs rdx, 0x1807160908170e05
mov qword [rsp + 0x21], rdx
movabs rdx, 0x917071217051807
mov qword [rsp + 0x27], rdx
movabs rdx, 0x150d0c150e071204
mov qword [rsp + 0x2f], rdx
xor eax, eax
jmp 0x38235944b
movzx r9d, byte [rsp + rsi + 0x37]
sub r9d, edx
lea edx, [r9 + 0x19]
mov byte [rsp + rdi + 0x37], dl
lea edx, [r8 + 0x19]
mov byte [rsp + rsi + 0x37], dl
add rax, 2
cmp rax, 0x1e
jge 0x382359478
movzx edx, byte [rsp + rax + 0x19]
movzx esi, byte [rsp + rax + 0x1a]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x19
jae 0x38235949b
movzx r8d, byte [rsp + rdi + 0x37]
sub r8d, edx
cmp rsi, 0x19
jb 0x38235942e
jmp 0x38235948f
xor eax, eax
lea rbx, [rsp + 0x37]
mov ecx, 0x19
call fcn.382294b80
add rsp, 0x50
pop rbp
ret
mov eax, esi
mov ecx, 0x19
call fcn.3822a6820
mov eax, edi
mov ecx, 0x19
call fcn.3822a6820
nop
call fcn.3822a4520
jmp fcn.3823593a0

Function at 0x382359fa0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x38235a09b
push rbp
mov rbp, rsp
sub rsp, 0x48
movabs rdx, 0x54c56176b7be3ddf
mov qword [rsp + 0x35], rdx
movabs rdx, 0xed96954c56176b7
mov qword [rsp + 0x38], rdx
movabs rdx, 0xb9c1d7654a47d8e4
mov qword [rsp + 0x40], rdx
movabs rdx, 0xc09090e0d0b0210
mov qword [rsp + 0x1b], rdx
movabs rdx, 0x3001004060a0b01
mov qword [rsp + 0x23], rdx
movabs rdx, 0x41203001004060a
mov qword [rsp + 0x25], rdx
movabs rdx, 0xc0603110b030d12
mov qword [rsp + 0x2d], rdx
xor eax, eax
jmp 0x38235a039
movzx r9d, byte [rsp + rsi + 0x35]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x76]
mov byte [rsp + rdi + 0x35], dl
mov byte [rsp + rsi + 0x35], r8b
add rax, 2
cmp rax, 0x1a
jge 0x38235a06b
movzx edx, byte [rsp + rax + 0x1b]
movzx esi, byte [rsp + rax + 0x1c]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x13
jae 0x38235a08e
movzx r8d, byte [rsp + rdi + 0x35]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x76]
cmp rsi, 0x13
jb 0x38235a01f
jmp 0x38235a082
xor eax, eax
lea rbx, [rsp + 0x35]
mov ecx, 0x13
call fcn.382294b80
add rsp, 0x48
pop rbp
ret
mov eax, esi
mov ecx, 0x13
call fcn.3822a6820
mov eax, edi
mov ecx, 0x13
call fcn.3822a6820
nop
nop dword [rax + rax]
call fcn.3822a4520
jmp fcn.382359fa0
Function at 0x38235cfa0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x38235d08c
push rbp
mov rbp, rsp
sub rsp, 0x48
movabs rdx, 0x136bb06d1d1dca41
mov qword [rsp + 0x33], rdx
movabs rdx, 0x266e617453136bb0
mov qword [rsp + 0x38], rdx
movabs rdx, 0x253169542064fb20
mov qword [rsp + 0x40], rdx
movabs rdx, 0x140c0e0606030e0e
mov qword [rsp + 0x1d], rdx
movabs rdx, 0x130300060601140c
mov qword [rsp + 0x23], rdx
movabs rdx, 0xd0207000500130d
mov qword [rsp + 0x2b], rdx
xor eax, eax
jmp 0x38235d02a
movzx r9d, byte [rsp + rsi + 0x33]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x21]
mov byte [rsp + rdi + 0x33], dl
mov byte [rsp + rsi + 0x33], r8b
add rax, 2
cmp rax, 0x16
jge 0x38235d05c
movzx edx, byte [rsp + rax + 0x1d]
movzx esi, byte [rsp + rax + 0x1e]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x15
jae 0x38235d07f
movzx r8d, byte [rsp + rdi + 0x33]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x21]
cmp rsi, 0x15
jb 0x38235d010
jmp 0x38235d073
xor eax, eax
lea rbx, [rsp + 0x33]
mov ecx, 0x15
call fcn.382294b80
add rsp, 0x48
pop rbp
ret
mov eax, esi
mov ecx, 0x15
call fcn.3822a6820
mov eax, edi
mov ecx, 0x15
call fcn.3822a6820
nop
call fcn.3822a4520
jmp fcn.38235cfa0

Function at 0x38235f500
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x38235f608
push rbp
mov rbp, rsp
sub rsp, 0x58
movabs rdx, 0xe019297274f61318
mov qword [rsp + 0x41], rdx
movabs rdx, 0xce6e61b4d820c1e0
mov qword [rsp + 0x48], rdx
movabs rdx, 0x94bf24dbce0672bc
mov qword [rsp + 0x50], rdx
movabs rdx, 0x20a000b09150408
mov qword [rsp + 0x1f], rdx
movabs rdx, 0x102020a000b0915
mov qword [rsp + 0x21], rdx
movabs rdx, 0x807081312160901
mov qword [rsp + 0x29], rdx
movabs rdx, 0x60e120e00130814
mov qword [rsp + 0x31], rdx
movabs rdx, 0x91609121105160f
mov qword [rsp + 0x39], rdx
xor eax, eax
jmp 0x38235f5ab
movzx r9d, byte [rsp + rsi + 0x41]
sub r9d, edx
lea edx, [r9 + 0x6b]
mov byte [rsp + rdi + 0x41], dl
lea edx, [r8 + 0x6b]
mov byte [rsp + rsi + 0x41], dl
add rax, 2
cmp rax, 0x22
jge 0x38235f5d8
movzx edx, byte [rsp + rax + 0x1f]
movzx esi, byte [rsp + rax + 0x20]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x17
jae 0x38235f5fb
movzx r8d, byte [rsp + rdi + 0x41]
sub r8d, edx
cmp rsi, 0x17
jb 0x38235f58e
jmp 0x38235f5ef
xor eax, eax
lea rbx, [rsp + 0x41]
mov ecx, 0x17
call fcn.382294b80
add rsp, 0x58
pop rbp
ret
mov eax, esi
mov ecx, 0x17
call fcn.3822a6820
mov eax, edi
mov ecx, 0x17
call fcn.3822a6820
nop
call fcn.3822a4520
jmp fcn.38235f500
Function at 0x382360660
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x38236076c
push rbp
mov rbp, rsp
sub rsp, 0x50
movabs rdx, 0x73df276914616c09
mov qword [rsp + 0x37], rdx
movabs rdx, 0x361f6cb22c96f74
mov qword [rsp + 0x3f], rdx
movabs rdx, 0xd10361f6cb22c96f
mov qword [rsp + 0x40], rdx
movabs rdx, 0x136d13b320fb2bcc
mov qword [rsp + 0x48], rdx
movabs rdx, 0x61103181205150c
mov qword [rsp + 0x1d], rdx
movabs rdx, 0xf1106160a16100b
mov qword [rsp + 0x25], rdx
movabs rdx, 0x100f0f1106160a16
mov qword [rsp + 0x27], rdx
movabs rdx, 0x100c00130d150f0b
mov qword [rsp + 0x2f], rdx
xor eax, eax
jmp 0x382360708
movzx r9d, byte [rsp + rsi + 0x37]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x32]
mov byte [rsp + rdi + 0x37], dl
mov byte [rsp + rsi + 0x37], r8b
add rax, 2
cmp rax, 0x1a
jge 0x38236073c
movzx edx, byte [rsp + rax + 0x1d]
movzx esi, byte [rsp + rax + 0x1e]
mov edi, edx
xor edx, esi
add edx, eax
nop
cmp rdi, 0x19
jae 0x38236075f
movzx r8d, byte [rsp + rdi + 0x37]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x32]
cmp rsi, 0x19
jb 0x3823606ee
jmp 0x382360753
xor eax, eax
lea rbx, [rsp + 0x37]
mov ecx, 0x19
call fcn.382294b80
add rsp, 0x50
pop rbp
ret
mov eax, esi
mov ecx, 0x19
call fcn.3822a6820
mov eax, edi
mov ecx, 0x19
call fcn.3822a6820
nop
call fcn.3822a4520
jmp fcn.382360660

Function at 0x382360780
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x38236086c
push rbp
mov rbp, rsp
sub rsp, 0x48
movabs rdx, 0x2035086e596b6159
mov qword [rsp + 0x33], rdx
movabs rdx, 0x311b617452203508
mov qword [rsp + 0x38], rdx
movabs rdx, 0x42260a620d645861
mov qword [rsp + 0x40], rdx
movabs rdx, 0x3130c11100c1411
mov qword [rsp + 0x1b], rdx
movabs rdx, 0xb11080810060404
mov qword [rsp + 0x23], rdx
movabs rdx, 0x12100e110e050803
mov qword [rsp + 0x2b], rdx
xor eax, eax
jmp 0x38236080a
movzx r9d, byte [rsp + rsi + 0x33]
lea edx, [r9 + rdx]
lea edx, [rdx - 2]
mov byte [rsp + rdi + 0x33], dl
mov byte [rsp + rsi + 0x33], r8b
add rax, 2
cmp rax, 0x18
jge 0x38236083c
movzx edx, byte [rsp + rax + 0x1b]
movzx esi, byte [rsp + rax + 0x1c]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x15
jae 0x38236085f
movzx r8d, byte [rsp + rdi + 0x33]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 2]
cmp rsi, 0x15
jb 0x3823607f0
jmp 0x382360853
xor eax, eax
lea rbx, [rsp + 0x33]
mov ecx, 0x15
call fcn.382294b80
add rsp, 0x48
pop rbp
ret
mov eax, esi
mov ecx, 0x15
call fcn.3822a6820
mov eax, edi
mov ecx, 0x15
call fcn.3822a6820
nop
call fcn.3822a4520
jmp fcn.382360780