joyce8/EMBER2024-capa huggingface dataset:
Function at 0x435680
Capabilities:
Encode data using base64

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4357ca
push rbp
mov rbp, rsp
sub rsp, 0x18
mov ecx, dword [rax + 0x190]
mov edx, dword [rax + 0x194]
mov rsi, qword [rax + 0x998]
mov edi, dword [rax + 0x194]
cmp edi, edx
jne 0x435692
cmp edx, ecx
jne 0x4357b8
nop word [rax + rax]
test rsi, rsi
jne 0x4357b8
mov qword [rsp + 0x28], rax
test rbx, rbx
jne 0x4356f4
nop
call fcn.0044d1e0
xorps xmm15, xmm15
mov r14, qword [0x005b2a88]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rbx, qword [rsp]
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0x10], rbx
call fcn.004355c0
mov rcx, qword [rsp + 0x28]
mov edx, dword [rcx]
mov ebx, edx
sar edx, 0x1f
shr edx, 0x1b
add edx, ebx
mov esi, edx
and edx, 0xffffffe0
sub ebx, edx
test ebx, ebx
jl 0x4357b3
mov rdx, qword [0x0052d5d0]
sar esi, 5
mov rax, rcx
mov ecx, ebx
mov edi, 1
shl edi, cl
movsxd rsi, esi
lea rdx, [rdx + rsi*4]
cmp ecx, 0x20
sbb esi, esi
and edi, esi
lock or dword [rdx], edi
mov rdx, qword [0x0052eeb0]
mov qword [rax + 8], rdx
mov rdx, rax
nop
mov qword [0x0052eeb0], rax
nop
mov esi, 1
lea rdi, [0x0052eeb8]
lock xadd dword [rdi], esi
mov rsi, qword [rdx + 0x1248]
shr rsi, 0x3d
test sil, sil
jne 0x4357a2
mov rax, qword [rsp + 0x10]
movabs rcx, 0x1fffffffffffffff
and rcx, rax
bts rcx, 0x3f
nop
nop
xchg qword [rdx + 0x1248], rcx
add rsp, 0x18
pop rbp
ret
lea rax, [0x004be5c9]
mov ebx, 0x28
call fcn.00428300
call fcn.00427400
lea rax, [0x004bdccf]
mov ebx, 0x23
call fcn.00428300
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.004497a0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.00435680

Function at 0x438940
Capabilities:
Access peb ldr_data

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x70
mov rcx, r14
test rcx, rcx
je 0x438988
mov rcx, qword [rcx + 0x30]
mov rcx, qword [rcx + 0x90]
nop dword [rax + rax]
test rcx, rcx
je 0x438988
mov qword [rsp + 0x68], rcx
nop
mov rax, qword [rdi + 0x28]
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x58], 0
mov qword [rsp + 0x50], 0
jmp 0x438998
mov eax, 1
add rsp, 0x70
pop rbp
ret
mov rax, qword [rsp + 0x60]
mov rcx, qword [sym.imp.kernel32.dll_RtlLookupFunctionEntry]
lea rdx, [rsp + 0x58]
mov rbx, qword [rax + 0xf8]
mov qword [rsp], rcx
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], 0
call fcn.004268a0
xorps xmm15, xmm15
mov r14, qword [0x005b2a88]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x20]
nop
test rax, rax
je 0x438a71
mov rcx, qword [rsp + 0x58]
mov rdx, qword [sym.imp.kernel32.dll_RtlVirtualUnwind]
mov rbx, qword [rsp + 0x60]
mov rsi, rbx
lea rdi, [rsp + 0x50]
mov r8, qword [rsi + 0xf8]
mov qword [rsp], rdx
mov qword [rsp + 8], 0
mov qword [rsp + 0x10], rcx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x40], 0
call fcn.00426b20
xorps xmm15, xmm15
mov r14, qword [0x005b2a88]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x68]
cmp qword [rcx], rax
ja 0x438a71
cmp qword [rcx + 8], rax
ja 0x438993
mov eax, 1
add rsp, 0x70
pop rbp
ret
Function at 0x43db00
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rax
movzx edx, byte [rax]
test edx, edx
jne 0x43db1b
test r8b, r8b
jne 0x43db1b
xor eax, eax
xor ebx, ebx
mov rcx, rbx
xor edi, edi
ret
bt edx, 7
nop
jae 0x43db2f
xor edx, edx
xor r8d, r8d
xor r9d, r9d
jmp 0x43dbcd
mov r8d, 1
mov r9d, edx
and edx, 1
neg edx
shr r9d, 1
xor edx, r9d
add dword [rsi], edx
sub rcx, r8
mov rdx, rcx
neg rdx
sar rdx, 0x3f
and rdx, r8
movzx esi, byte [rax + rdx]
sub rbx, r8
add rdx, rax
bt esi, 7
jae 0x43db6e
xor eax, eax
xor esi, esi
xor r8d, r8d
jmp 0x43db9c
mov eax, 1
add qword [rdi], rsi
sub rcx, rax
sub rbx, rax
mov rsi, rcx
neg rsi
sar rsi, 0x3f
and rax, rsi
add rax, rdx
mov edi, 1
ret
lea r8d, [rcx + 7]
mov rcx, rax
mov eax, r10d
movzx r9d, byte [rax + rdx]
lea r10d, [rax + 1]
mov r11d, r9d
and r9d, 0x7f
mov rax, rcx
mov ecx, r8d
shl r9d, cl
or esi, r9d
test r11b, 0x80
jne 0x43db92
mov rcx, rax
mov eax, r10d
jmp 0x43db73
lea r9d, [rcx + 7]
mov rcx, r12
movzx r10d, byte [rdx + rax]
inc edx
mov r11d, r10d
and r10d, 0x7f
mov r12, rcx
mov ecx, r9d
shl r10d, cl
or r8d, r10d
test r11b, 0x80
jne 0x43dbc6
mov rcx, r12
mov r9d, edx
mov edx, r8d
mov r8d, r9d
jmp 0x43db35

Function at 0x4433e0
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x443495
push rbp
mov rbp, rsp
sub rsp, 0x48
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x68], rcx
mov qword [rsp + 0x70], rdi
test byte [rax], al
lea rdx, [rax + 0x10]
mov rsi, qword [rsp + 0x68]
mov rcx, rdi
mov rax, rdx
mov rbx, rsi
call fcn.004411a0
nop
test bl, bl
je 0x44348f
mov qword [rsp + 0x18], rax
movups xmmword [rsp + 0x20], xmm15
movups xmmword [rsp + 0x28], xmm15
movups xmmword [rsp + 0x38], xmm15
lea rcx, [0x004434e0]
mov qword [rsp + 0x20], rcx
mov rcx, qword [rsp + 0x58]
mov qword [rsp + 0x28], rcx
mov rcx, qword [rsp + 0x60]
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x38], rax
lea rcx, [rsp + 0x68]
mov qword [rsp + 0x40], rcx
lea rcx, [rsp + 0x20]
mov qword [rsp], rcx
call fcn.00449680
xorps xmm15, xmm15
mov r14, qword [0x005b2a88]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x18]
add rsp, 0x48
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
call fcn.004497a0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
jmp fcn.004433e0
Function at 0x4444a0
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x44454f
push rbp
mov rbp, rsp
sub rsp, 0x58
mov qword [rsp + 0x70], rbx
lea rdx, [rsp + 0x68]
mov qword [rsp + 8], 0
movups xmmword [rsp + 0x10], xmm15
movups xmmword [rsp + 0x18], xmm15
movups xmmword [rsp + 0x28], xmm15
movups xmmword [rsp + 0x38], xmm15
movups xmmword [rsp + 0x48], xmm15
lea rsi, [0x004445a0]
mov qword [rsp + 0x10], rsi
mov rsi, qword [rsp + 0x60]
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdx
mov rdx, r14
mov qword [rsp + 0x28], rdx
lea rdx, [rsp + 8]
mov qword [rsp + 0x30], rdx
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x48], rcx
mov qword [rsp + 0x50], rdi
mov qword [rsp + 0x40], rbx
lea rax, [rsp + 0x10]
mov qword [rsp], rax
call fcn.00449680
xorps xmm15, xmm15
mov r14, qword [0x005b2a88]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 8]
add rsp, 0x58
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
call fcn.004497a0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
nop dword [rax]
jmp fcn.004444a0
Function at 0x44d220
Capabilities:
Allocate thread local storage

Disassembly:
push rbp
mov rbp, rsp
mov rax, rsp
and rsp, 0xfffffffffffffff0
sub rsp, 0x30
mov qword [rsp + 0x20], rax
mov rax, qword [sym.imp.kernel32.dll_TlsAlloc]
call rax
mov rsp, qword [rsp + 0x20]
mov rcx, rax
cmp rcx, 0x40
jb 0x44d254
mov rcx, 0x28
jmp 0x44d25f
shl rcx, 3
add rcx, 0x1480
mov qword [0x005b2a88], rcx
pop rbp
ret

Function at 0x45cb60
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x45cc25
push rbp
mov rbp, rsp
sub rsp, 0x48
movabs rdx, 0xd31fc4bb10c47201
mov qword [rsp + 0x33], rdx
movabs rdx, 0x4fa66b25aad31fc4
mov qword [rsp + 0x38], rdx
movabs rdx, 0xa661bc7420bab3ae
mov qword [rsp + 0x40], rdx
movabs rdx, 0x70c020205060904
mov qword [rsp + 0x1b], rdx
movabs rdx, 0x30d0004120e0712
mov qword [rsp + 0x23], rdx
movabs rdx, 0x8040f0d140b050c
mov qword [rsp + 0x2b], rdx
xor eax, eax
jmp 0x45cc08
movzx edx, byte [rsp + rax + 0x1b]
movzx esi, byte [rsp + rax + 0x1c]
mov edi, edx
xor edx, esi
add edx, eax
movzx r8d, byte [rsp + rsi + 0x33]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x67]
movzx r9d, byte [rsp + rdi + 0x33]
mov byte [rsp + rdi + 0x33], r8b
lea edx, [r9 + rdx]
lea edx, [rdx - 0x67]
mov byte [rsp + rsi + 0x33], dl
add rax, 2
cmp rax, 0x18
jl 0x45cbd0
xor eax, eax
lea rbx, [rsp + 0x33]
mov ecx, 0x15
call fcn.0043c360
add rsp, 0x48
pop rbp
ret
call fcn.004497a0
jmp fcn.0045cb60

Function at 0x45e260
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x45e324
push rbp
mov rbp, rsp
sub rsp, 0x40
movabs rdx, 0x6973737760726568
mov qword [rsp + 0x2f], rdx
movabs rdx, 0x7b69737377607265
mov qword [rsp + 0x30], rdx
movabs rdx, 0x7d656e24665d6178
mov qword [rsp + 0x38], rdx
movabs rdx, 0x40303080e0b0a0c
mov qword [rsp + 0x19], rdx
movabs rdx, 0xb00040a100a0403
mov qword [rsp + 0x1f], rdx
movabs rdx, 0x30d00090d0a0c08
mov qword [rsp + 0x27], rdx
xor eax, eax
jmp 0x45e307
movzx edx, byte [rsp + rax + 0x19]
movzx esi, byte [rsp + rax + 0x1a]
mov edi, edx
xor edx, esi
add edx, eax
movzx r8d, byte [rsp + rsi + 0x2f]
sub r8d, edx
add r8d, 0x13
movzx r9d, byte [rsp + rdi + 0x2f]
mov byte [rsp + rdi + 0x2f], r8b
sub r9d, edx
lea edx, [r9 + 0x13]
mov byte [rsp + rsi + 0x2f], dl
add rax, 2
cmp rax, 0x16
jl 0x45e2d0
xor eax, eax
lea rbx, [rsp + 0x2f]
mov ecx, 0x11
call fcn.0043c360
add rsp, 0x40
pop rbp
ret
call fcn.004497a0
jmp fcn.0045e260
Function at 0x45ec40
Capabilities:
Encrypt data using rc4 prga

Disassembly:
lea r12, [rsp - 8]
cmp r12, qword [r14 + 0x10]
jbe 0x45ed72
push rbp
mov rbp, rsp
add rsp, 0xffffffffffffff80
movabs rdx, 0x86b18e02966498a8
mov qword [rsp + 0x58], rdx
movabs rdx, 0x389eba0c96a58ef0
mov qword [rsp + 0x60], rdx
movabs rdx, 0x10c721094b7d4a6f
mov qword [rsp + 0x68], rdx
movabs rdx, 0x20babb20801f7b72
mov qword [rsp + 0x70], rdx
movabs rdx, 0x6c50db8dc4c4d461
mov qword [rsp + 0x78], rdx
movabs rdx, 0x240104040b0d0e0c
mov qword [rsp + 0x1e], rdx
movabs rdx, 0x1d1219090e260511
mov qword [rsp + 0x26], rdx
movabs rdx, 0x17251d1219090e26
mov qword [rsp + 0x28], rdx
movabs rdx, 0x12050c172204070f
mov qword [rsp + 0x30], rdx
movabs rdx, 0x3061e2504080621
mov qword [rsp + 0x38], rdx
movabs rdx, 0x1a201622000d140b
mov qword [rsp + 0x40], rdx
movabs rdx, 0xb2315231213231b
mov qword [rsp + 0x48], rdx
movabs rdx, 0x20042613150a0a1a
mov qword [rsp + 0x50], rdx
xor eax, eax
jmp 0x45ed55
movzx edx, byte [rsp + rax + 0x1e]
movzx esi, byte [rsp + rax + 0x1f]
mov edi, edx
xor edx, esi
add edx, eax
movzx r8d, byte [rsp + rsi + 0x58]
sub r8d, edx
add r8d, 2
movzx r9d, byte [rsp + rdi + 0x58]
mov byte [rsp + rdi + 0x58], r8b
sub r9d, edx
lea edx, [r9 + 2]
mov byte [rsp + rsi + 0x58], dl
add rax, 2
cmp rax, 0x3a
jl 0x45ed1e
xor eax, eax
lea rbx, [rsp + 0x58]
mov ecx, 0x28
call fcn.0043c360
sub rsp, 0xffffffffffffff80
pop rbp
ret
call fcn.004497a0
jmp fcn.0045ec40

Function at 0x45f7c0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x45f876
push rbp
mov rbp, rsp
sub rsp, 0x40
movabs rdx, 0x206451e76141d24b
mov qword [rsp + 0x30], rdx
movabs rdx, 0xe15bde6141e0be47
mov qword [rsp + 0x38], rdx
movabs rdx, 0x8040409010b0f02
mov qword [rsp + 0x1c], rdx
movabs rdx, 0xd040a08040409
mov qword [rsp + 0x20], rdx
movabs rdx, 0xf010e0f0d080105
mov qword [rsp + 0x28], rdx
xor eax, eax
nop
jmp 0x45f859
movzx edx, byte [rsp + rax + 0x1c]
movzx esi, byte [rsp + rax + 0x1d]
mov edi, edx
xor edx, esi
add edx, eax
movzx r8d, byte [rsp + rsi + 0x30]
sub r8d, edx
add r8d, 0xffffffa2
movzx r9d, byte [rsp + rdi + 0x30]
mov byte [rsp + rdi + 0x30], r8b
sub r9d, edx
lea edx, [r9 - 0x5e]
mov byte [rsp + rsi + 0x30], dl
add rax, 2
cmp rax, 0x14
jl 0x45f822
xor eax, eax
lea rbx, [rsp + 0x30]
mov ecx, 0x10
call fcn.0043c360
add rsp, 0x40
pop rbp
ret
call fcn.004497a0
nop dword [rax + rax]
jmp fcn.0045f7c0
Function at 0x460780
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x46081d
push rbp
mov rbp, rsp
sub rsp, 0x30
movabs rdx, 0x876b2f6c85767769
mov qword [rsp + 0x24], rdx
mov dword [rsp + 0x2c], 0x74a27973
movabs rdx, 0x3070606070a0901
mov qword [rsp + 0x18], rdx
mov dword [rsp + 0x20], 0x507030a
xor eax, eax
jmp 0x460800
movzx edx, byte [rsp + rax + 0x18]
movzx esi, byte [rsp + rax + 0x19]
mov edi, edx
xor edx, esi
add edx, eax
movzx r8d, byte [rsp + rsi + 0x24]
sub r8d, edx
add r8d, 0xfffffffd
movzx r9d, byte [rsp + rdi + 0x24]
mov byte [rsp + rdi + 0x24], r8b
sub r9d, edx
lea edx, [r9 - 3]
mov byte [rsp + rsi + 0x24], dl
add rax, 2
nop dword [rax + rax]
cmp rax, 0xc
jl 0x4607c4
xor eax, eax
lea rbx, [rsp + 0x24]
mov ecx, 0xc
call fcn.0043c360
add rsp, 0x30
pop rbp
ret
nop dword [rax]
call fcn.004497a0
jmp fcn.00460780

Function at 0x461bc0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x461ca2
push rbp
mov rbp, rsp
sub rsp, 0x50
movabs rdx, 0x44d7d9a7d159db72
mov qword [rsp + 0x37], rdx
movabs rdx, 0xe8d0ce643a65dbd9
mov qword [rsp + 0x3f], rdx
movabs rdx, 0x6be8d0ce643a65db
mov qword [rsp + 0x40], rdx
movabs rdx, 0x6246db69b2769873
mov qword [rsp + 0x48], rdx
movabs rdx, 0x120817070b021609
mov qword [rsp + 0x19], rdx
movabs rdx, 0x141702020e07060d
mov qword [rsp + 0x21], rdx
movabs rdx, 0x50f010317101417
mov qword [rsp + 0x27], rdx
movabs rdx, 0x41704110b101810
mov qword [rsp + 0x2f], rdx
xor eax, eax
jmp 0x461c85
movzx edx, byte [rsp + rax + 0x19]
movzx esi, byte [rsp + rax + 0x1a]
mov edi, edx
xor edx, esi
add edx, eax
movzx r8d, byte [rsp + rsi + 0x37]
sub r8d, edx
add r8d, 0xffffffa8
movzx r9d, byte [rsp + rdi + 0x37]
mov byte [rsp + rdi + 0x37], r8b
sub r9d, edx
lea edx, [r9 - 0x58]
mov byte [rsp + rsi + 0x37], dl
add rax, 2
cmp rax, 0x1e
jl 0x461c4e
xor eax, eax
lea rbx, [rsp + 0x37]
mov ecx, 0x19
call fcn.0043c360
add rsp, 0x50
pop rbp
ret
call fcn.004497a0
jmp fcn.00461bc0
Function at 0x462600
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4626f2
push rbp
mov rbp, rsp
sub rsp, 0x60
movabs rdx, 0x2664dc2f756d0c0f
mov qword [rsp + 0x40], rdx
movabs rdx, 0x226dcc2f722528f4
mov qword [rsp + 0x48], rdx
movabs rdx, 0x3e213e7527025dde
mov qword [rsp + 0x50], rdx
movabs rdx, 0x6e69616dee7b2891
mov qword [rsp + 0x58], rdx
movabs rdx, 0x318131517101306
mov qword [rsp + 0x1c], rdx
movabs rdx, 0xc05040303181315
mov qword [rsp + 0x20], rdx
movabs rdx, 0x160d070f191b1908
mov qword [rsp + 0x28], rdx
movabs rdx, 0xc110a04011a0418
mov qword [rsp + 0x30], rdx
movabs rdx, 0x1700120c09011519
mov qword [rsp + 0x38], rdx
xor eax, eax
jmp 0x4626d5
movzx edx, byte [rsp + rax + 0x1c]
movzx esi, byte [rsp + rax + 0x1d]
mov edi, edx
xor edx, esi
add edx, eax
movzx r8d, byte [rsp + rsi + 0x40]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x27]
movzx r9d, byte [rsp + rdi + 0x40]
mov byte [rsp + rdi + 0x40], r8b
lea edx, [r9 + rdx]
lea edx, [rdx + 0x27]
mov byte [rsp + rsi + 0x40], dl
add rax, 2
cmp rax, 0x24
jl 0x46269d
xor eax, eax
lea rbx, [rsp + 0x40]
mov ecx, 0x20
call fcn.0043c360
add rsp, 0x60
pop rbp
ret
call fcn.004497a0
jmp fcn.00462600

Function at 0x466b40
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x466c41
push rbp
mov rbp, rsp
sub rsp, 0x68
movabs rdx, 0xab6573e394b69267
mov qword [rsp + 0x49], rdx
movabs rdx, 0xa2ab69a26e674392
mov qword [rsp + 0x51], rdx
movabs rdx, 0x63017434339061a2
mov qword [rsp + 0x58], rdx
movabs rdx, 0xd38ca170ca8ad00b
mov qword [rsp + 0x60], rdx
movabs rdx, 0x18040a01131208
mov qword [rsp + 0x1d], rdx
movabs rdx, 0x81e0102180e120c
mov qword [rsp + 0x25], rdx
movabs rdx, 0x7020f13081e0102
mov qword [rsp + 0x29], rdx
movabs rdx, 0x9151e0e17151517
mov qword [rsp + 0x31], rdx
movabs rdx, 0x1a0a0317111e1d1c
mov qword [rsp + 0x39], rdx
movabs rdx, 0x111c0a08190e0900
mov qword [rsp + 0x41], rdx
xor eax, eax
jmp 0x466c24
movzx edx, byte [rsp + rax + 0x1d]
movzx esi, byte [rsp + rax + 0x1e]
mov edi, edx
xor edx, esi
add edx, eax
movzx r8d, byte [rsp + rsi + 0x49]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x59]
movzx r9d, byte [rsp + rdi + 0x49]
mov byte [rsp + rdi + 0x49], r8b
lea edx, [r9 + rdx]
lea edx, [rdx - 0x59]
mov byte [rsp + rsi + 0x49], dl
add rax, 2
cmp rax, 0x2c
jl 0x466bec
xor eax, eax
lea rbx, [rsp + 0x49]
mov ecx, 0x1f
call fcn.0043c360
add rsp, 0x68
pop rbp
ret
call fcn.004497a0
jmp fcn.00466b40
Function at 0x466f60
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x467070
push rbp
mov rbp, rsp
sub rsp, 0x68
movabs rdx, 0x79229db1c27a74c2
mov qword [rsp + 0x47], rdx
movabs rdx, 0xc879229db1c27a74
mov qword [rsp + 0x48], rdx
movabs rdx, 0x79a8734ab94ab263
mov qword [rsp + 0x50], rdx
movabs rdx, 0x676f076d79555466
mov qword [rsp + 0x58], rdx
movabs rdx, 0x73c216d038c90669
mov qword [rsp + 0x60], rdx
movabs rdx, 0x1f061e061008021b
mov qword [rsp + 0x1d], rdx
movabs rdx, 0x1e1d12010d0b1a18
mov qword [rsp + 0x25], rdx
movabs rdx, 0xd1a1e1d12010d0b
mov qword [rsp + 0x27], rdx
movabs rdx, 0x1040c1c161c1804
mov qword [rsp + 0x2f], rdx
movabs rdx, 0xa0403010b00051a
mov qword [rsp + 0x37], rdx
movabs rdx, 0xd0003091600130f
mov qword [rsp + 0x3f], rdx
xor eax, eax
jmp 0x467053
movzx edx, byte [rsp + rax + 0x1d]
movzx esi, byte [rsp + rax + 0x1e]
mov edi, edx
xor edx, esi
add edx, eax
movzx r8d, byte [rsp + rsi + 0x47]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x73]
movzx r9d, byte [rsp + rdi + 0x47]
mov byte [rsp + rdi + 0x47], r8b
lea edx, [r9 + rdx]
lea edx, [rdx - 0x73]
mov byte [rsp + rsi + 0x47], dl
add rax, 2
cmp rax, 0x2a
jl 0x46701b
xor eax, eax
lea rbx, [rsp + 0x47]
mov ecx, 0x21
call fcn.0043c360
add rsp, 0x68
pop rbp
ret
call fcn.004497a0
jmp fcn.00466f60

Function at 0x467340
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4673f6
push rbp
mov rbp, rsp
sub rsp, 0x40
movabs rdx, 0xba14671259ab1418
mov qword [rsp + 0x30], rdx
movabs rdx, 0xbc11bbbf812aa74
mov qword [rsp + 0x38], rdx
movabs rdx, 0x70c030209040b03
mov qword [rsp + 0x18], rdx
movabs rdx, 0x30c0a02070e0b
mov qword [rsp + 0x20], rdx
movabs rdx, 0xe0d010604040f0f
mov qword [rsp + 0x28], rdx
xor eax, eax
nop
jmp 0x4673d9
movzx edx, byte [rsp + rax + 0x18]
movzx esi, byte [rsp + rax + 0x19]
mov edi, edx
xor edx, esi
add edx, eax
movzx r8d, byte [rsp + rsi + 0x30]
sub r8d, edx
add r8d, 0x6c
movzx r9d, byte [rsp + rdi + 0x30]
mov byte [rsp + rdi + 0x30], r8b
sub r9d, edx
lea edx, [r9 + 0x6c]
mov byte [rsp + rsi + 0x30], dl
add rax, 2
cmp rax, 0x18
jl 0x4673a2
xor eax, eax
lea rbx, [rsp + 0x30]
mov ecx, 0x10
call fcn.0043c360
add rsp, 0x40
pop rbp
ret
call fcn.004497a0
nop dword [rax + rax]
jmp fcn.00467340
Function at 0x46b5a0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x46b682
push rbp
mov rbp, rsp
sub rsp, 0x58
movabs rdx, 0x3a16296f2074f70e
mov qword [rsp + 0x40], rdx
movabs rdx, 0x32c3735c226572da
mov qword [rsp + 0x48], rdx
movabs rdx, 0xbe2263be75eb44b2
mov qword [rsp + 0x50], rdx
movabs rdx, 0x1100b080e1700
mov qword [rsp + 0x1e], rdx
movabs rdx, 0xb050001100b080e
mov qword [rsp + 0x20], rdx
movabs rdx, 0x514100f0f080f12
mov qword [rsp + 0x28], rdx
movabs rdx, 0x816060516160700
mov qword [rsp + 0x30], rdx
movabs rdx, 0x1051417120c0c11
mov qword [rsp + 0x38], rdx
xor eax, eax
jmp 0x46b665
movzx edx, byte [rsp + rax + 0x1e]
movzx esi, byte [rsp + rax + 0x1f]
mov edi, edx
xor edx, esi
add edx, eax
movzx r8d, byte [rsp + rsi + 0x40]
sub r8d, edx
add r8d, 0x4e
movzx r9d, byte [rsp + rdi + 0x40]
mov byte [rsp + rdi + 0x40], r8b
sub r9d, edx
lea edx, [r9 + 0x4e]
mov byte [rsp + rsi + 0x40], dl
add rax, 2
cmp rax, 0x22
jl 0x46b62e
xor eax, eax
lea rbx, [rsp + 0x40]
mov ecx, 0x18
call fcn.0043c360
add rsp, 0x58
pop rbp
ret
call fcn.004497a0
jmp fcn.0046b5a0

Function at 0x46bc60
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x46bd24
push rbp
mov rbp, rsp
sub rsp, 0x48
movabs rdx, 0xad64af6b63316c62
mov qword [rsp + 0x33], rdx
movabs rdx, 0x20deaea676ad64af
mov qword [rsp + 0x38], rdx
movabs rdx, 0xab9b7235b9e9e272
mov qword [rsp + 0x40], rdx
movabs rdx, 0x11130b020e11100e
mov qword [rsp + 0x1b], rdx
movabs rdx, 0xf0a0e0213051014
mov qword [rsp + 0x23], rdx
movabs rdx, 0x90a07020b070e05
mov qword [rsp + 0x2b], rdx
xor eax, eax
jmp 0x46bd07
movzx edx, byte [rsp + rax + 0x1b]
movzx esi, byte [rsp + rax + 0x1c]
mov edi, edx
xor edx, esi
add edx, eax
movzx r8d, byte [rsp + rsi + 0x33]
sub r8d, edx
add r8d, 0xffffffd6
movzx r9d, byte [rsp + rdi + 0x33]
mov byte [rsp + rdi + 0x33], r8b
sub r9d, edx
lea edx, [r9 - 0x2a]
mov byte [rsp + rsi + 0x33], dl
add rax, 2
cmp rax, 0x18
jl 0x46bcd0
xor eax, eax
lea rbx, [rsp + 0x33]
mov ecx, 0x15
call fcn.0043c360
add rsp, 0x48
pop rbp
ret
call fcn.004497a0
jmp fcn.0046bc60

Function at 0x46c260
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x46c324
push rbp
mov rbp, rsp
sub rsp, 0x48
movabs rdx, 0x476ff85b657d5603
mov qword [rsp + 0x35], rdx
movabs rdx, 0x6a5469476ff85b65
mov qword [rsp + 0x38], rdx
movabs rdx, 0x7b746b5c65593d6f
mov qword [rsp + 0x40], rdx
movabs rdx, 0xa100407040c0d05
mov qword [rsp + 0x1f], rdx
movabs rdx, 0x20f00090f010a10
mov qword [rsp + 0x25], rdx
movabs rdx, 0x120f090d02080210
mov qword [rsp + 0x2d], rdx
xor eax, eax
jmp 0x46c307
movzx edx, byte [rsp + rax + 0x1f]
movzx esi, byte [rsp + rax + 0x20]
mov edi, edx
xor edx, esi
add edx, eax
movzx r8d, byte [rsp + rsi + 0x35]
sub r8d, edx
add r8d, 0x23
movzx r9d, byte [rsp + rdi + 0x35]
mov byte [rsp + rdi + 0x35], r8b
sub r9d, edx
lea edx, [r9 + 0x23]
mov byte [rsp + rsi + 0x35], dl
add rax, 2
cmp rax, 0x16
jl 0x46c2d0
xor eax, eax
lea rbx, [rsp + 0x35]
mov ecx, 0x13
call fcn.0043c360
add rsp, 0x48
pop rbp
ret
call fcn.004497a0
jmp fcn.0046c260
Function at 0x46cce0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x46cdc1
push rbp
mov rbp, rsp
sub rsp, 0x58
movabs rdx, 0x8668b5937a207e5f
mov qword [rsp + 0x3f], rdx
movabs rdx, 0x7e20d1aa69fe8b89
mov qword [rsp + 0x47], rdx
movabs rdx, 0xde7e20d1aa69fe8b
mov qword [rsp + 0x48], rdx
movabs rdx, 0xc7ab7db888648f20
mov qword [rsp + 0x50], rdx
movabs rdx, 0x16050a0c07150f01
mov qword [rsp + 0x1f], rdx
movabs rdx, 0x1209041708031516
mov qword [rsp + 0x27], rdx
movabs rdx, 0xd101514150c1807
mov qword [rsp + 0x2f], rdx
movabs rdx, 0x407140a100d0004
mov qword [rsp + 0x37], rdx
xor eax, eax
jmp 0x46cda4
movzx edx, byte [rsp + rax + 0x1f]
movzx esi, byte [rsp + rax + 0x20]
mov edi, edx
xor edx, esi
add edx, eax
movzx r8d, byte [rsp + rsi + 0x3f]
sub r8d, edx
dec r8d
movzx r9d, byte [rsp + rdi + 0x3f]
mov byte [rsp + rdi + 0x3f], r8b
sub r9d, edx
lea edx, [r9 - 1]
mov byte [rsp + rsi + 0x3f], dl
add rax, 2
cmp rax, 0x20
jl 0x46cd6e
xor eax, eax
lea rbx, [rsp + 0x3f]
mov ecx, 0x19
call fcn.0043c360
add rsp, 0x58
pop rbp
ret
call fcn.004497a0
jmp fcn.0046cce0

Function at 0x46d0e0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x46d1f0
push rbp
mov rbp, rsp
sub rsp, 0x70
movabs rdx, 0x667120dc75e96176
mov qword [rsp + 0x4b], rdx
movabs rdx, 0xb9a36cfdd8667120
mov qword [rsp + 0x50], rdx
movabs rdx, 0x6420626f66f15867
mov qword [rsp + 0x58], rdx
movabs rdx, 0x92b300cee8d4faa3
mov qword [rsp + 0x60], rdx
movabs rdx, 0x6570e6e85e182203
mov qword [rsp + 0x68], rdx
movabs rdx, 0x201222170915171b
mov qword [rsp + 0x1d], rdx
movabs rdx, 0xe2222040622200b
mov qword [rsp + 0x25], rdx
movabs rdx, 0x8211e221a1d0e22
mov qword [rsp + 0x2b], rdx
movabs rdx, 0xf061607090c0f1c
mov qword [rsp + 0x33], rdx
movabs rdx, 0x1f0f1b1b18020221
mov qword [rsp + 0x3b], rdx
movabs rdx, 0xf1b121f160e2219
mov qword [rsp + 0x43], rdx
xor eax, eax
jmp 0x46d1d3
movzx edx, byte [rsp + rax + 0x1d]
movzx esi, byte [rsp + rax + 0x1e]
mov edi, edx
xor edx, esi
add edx, eax
movzx r8d, byte [rsp + rsi + 0x4b]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x4a]
movzx r9d, byte [rsp + rdi + 0x4b]
mov byte [rsp + rdi + 0x4b], r8b
lea edx, [r9 + rdx]
lea edx, [rdx + 0x4a]
mov byte [rsp + rsi + 0x4b], dl
add rax, 2
cmp rax, 0x2e
jl 0x46d19b
xor eax, eax
lea rbx, [rsp + 0x4b]
mov ecx, 0x25
call fcn.0043c360
add rsp, 0x70
pop rbp
ret
call fcn.004497a0
jmp fcn.0046d0e0