joyce8/EMBER2024-capa huggingface dataset:
Function at 0x43fda0
Capabilities:
Access peb ldr_data

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x50
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], rbx
mov rcx, qword [0x006f36b0]
test rcx, rcx
jne 0x43fdc4
xor ecx, ecx
xor edx, edx
jmp 0x43fdd9
call fcn.00454200
mov rcx, rbx
mov rdx, rax
mov rax, qword [rsp + 0x60]
mov rbx, qword [rsp + 0x68]
mov qword [rsp + 0x10], rcx
mov qword [rsp + 0x18], rdx
mov qword [rsp + 0x20], r14
mov rsi, qword [r14 + 0x30]
inc dword [rsi + 0xd8]
mov qword [r14 + 0x10], 0xfffffffffffffade
mov byte [r14 + 0xb7], 1
call fcn.0043fd40
mov rcx, qword [rsp + 0x68]
mov rax, qword [rsp + 0x20]
mov qword [rax + 0x70], rcx
mov rdx, qword [rsp + 0x60]
mov qword [rax + 0x78], rdx
mov ebx, 2
mov ecx, 3
call fcn.00439660
mov rcx, qword [rsp + 0x20]
mov rdx, qword [rcx + 0x70]
cmp qword [rcx], rdx
ja 0x43fe46
nop dword [rax + rax]
cmp qword [rcx + 8], rdx
jae 0x43fe82
movups xmmword [rsp + 0x40], xmm15
lea rax, [0x004400a0]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x48], rcx
lea rax, [rsp + 0x40]
mov qword [rsp], rax
call fcn.00460b80
xorps xmm15, xmm15
mov r14, qword [0x006f38f0]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rcx, qword [rsp + 0x20]
mov rax, qword [rsp + 0x10]
test rax, rax
je 0x43feeb
movups xmmword [rsp + 0x28], xmm15
mov qword [rsp + 0x38], 0
lea rcx, [0x00440020]
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x18]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x28]
mov qword [rsp], rax
nop
call fcn.00460b80
xorps xmm15, xmm15
mov r14, qword [0x006f38f0]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x60]
mov rbx, qword [rsp + 0x68]
call fcn.0043fd40
mov rcx, qword [rsp + 0x20]
mov al, byte [0x0066fd98]
test al, al
je 0x43ff2b
lea rax, [0x0058bd68]
mov qword [rsp], rax
call fcn.00460b80
xorps xmm15, xmm15
mov r14, qword [0x006f38f0]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x60]
mov rbx, qword [rsp + 0x68]
call fcn.0043fd40
mov rcx, qword [rsp + 0x20]
mov rax, qword [rcx + 0x30]
mov rax, qword [rax + 0xa0]
test byte [rax], al
cmp dword [rax + 0x2298], 0
nop
je 0x43ff78
lea rax, fcn.0043aee0
mov qword [rsp], rax
call fcn.00460b80
xorps xmm15, xmm15
mov r14, qword [0x006f38f0]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x60]
mov rbx, qword [rsp + 0x68]
call fcn.0043fd40
mov rcx, qword [rsp + 0x20]
mov rax, qword [rcx + 0x30]
mov rdx, qword [rax + 0xa0]
mov edx, dword [rdx + 0x14]
mov dword [rax + 0x388], edx
mov rax, qword [rcx + 0x30]
mov rax, qword [rax + 0xa0]
mov qword [rax + 0x38], 0
mov rdx, qword [rcx + 0x30]
mov rbx, rax
mov qword [rdx + 0xb0], rax
mov rax, qword [rcx + 0x30]
mov qword [rax + 0xa0], 0
mov eax, 2
xchg dword [rbx + 4], eax
mov al, byte [0x0066fd88]
test al, al
je 0x440004
lea rax, [0x0058bd60]
mov qword [rsp], rax
call fcn.00460b80
xorps xmm15, xmm15
mov r14, qword [0x006f38f0]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x60]
mov rbx, qword [rsp + 0x68]
call fcn.0043fd40
mov rcx, qword [rsp + 0x20]
mov rax, qword [rcx + 0x30]
dec dword [rax + 0xd8]
add rsp, 0x50
pop rbp
ret
Function at 0x444ca0
Capabilities:
Encode data using base64

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x444e07
push rbp
mov rbp, rsp
sub rsp, 0x18
mov ecx, dword [rax + 0x190]
mov edx, dword [rax + 0x194]
mov rsi, qword [rax + 0x998]
mov edi, dword [rax + 0x194]
cmp edi, edx
jne 0x444cb2
cmp edx, ecx
jne 0x444df5
nop word [rax + rax]
test rsi, rsi
jne 0x444df5
mov qword [rsp + 0x28], rax
test rbx, rbx
jne 0x444d14
nop
call fcn.00464880
xorps xmm15, xmm15
mov r14, qword [0x006f38f0]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rbx, qword [rsp]
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0x10], rbx
call fcn.00444bc0
mov rcx, qword [rsp + 0x28]
mov edx, dword [rcx]
mov ebx, edx
sar edx, 0x1f
shr edx, 0x1b
add edx, ebx
mov esi, edx
and edx, 0xffffffe0
sub ebx, edx
test ebx, ebx
jl 0x444df0
mov rdx, qword [0x0066e3e8]
sar esi, 5
mov rax, rcx
mov ecx, ebx
mov edi, 1
shl edi, cl
movsxd rsi, esi
cmp ecx, 0x20
sbb r8d, r8d
and edi, r8d
cmp rdx, rsi
jbe 0x444de5
mov rcx, qword [0x0066e3e0]
lea rcx, [rcx + rsi*4]
lock or dword [rcx], edi
mov rcx, qword [0x0066fcf0]
mov qword [rax + 8], rcx
mov rcx, rax
nop
mov qword [0x0066fcf0], rax
nop
mov edx, 1
lea rsi, [0x0066fcf8]
lock xadd dword [rsi], edx
mov rdx, qword [rcx + 0x1248]
shr rdx, 0x3d
test dl, dl
jne 0x444dd3
mov rax, qword [rsp + 0x10]
movabs rdx, 0x1fffffffffffffff
and rdx, rax
bts rdx, 0x3f
nop
nop
xchg qword [rcx + 0x1248], rdx
add rsp, 0x18
pop rbp
ret
lea rax, [0x005888b4]
mov ebx, 0x28
nop
call fcn.00434ce0
mov rax, rsi
mov rcx, rdx
call fcn.00462f80
call fcn.004338c0
lea rax, [0x00587b2a]
mov ebx, 0x23
call fcn.00434ce0
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.00460ca0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.00444ca0
Function at 0x448860
Capabilities:
Access peb ldr_data

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x70
mov rcx, r14
test rcx, rcx
je 0x4488a8
mov rcx, qword [rcx + 0x30]
mov rcx, qword [rcx + 0x90]
nop dword [rax + rax]
test rcx, rcx
je 0x4488a8
mov qword [rsp + 0x68], rcx
nop
mov rax, qword [rdi + 0x28]
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x58], 0
mov qword [rsp + 0x50], 0
jmp 0x4488b8
mov eax, 1
add rsp, 0x70
pop rbp
ret
mov rax, qword [rsp + 0x60]
mov rcx, qword [sym.imp.kernel32.dll_RtlLookupFunctionEntry]
lea rdx, [rsp + 0x58]
mov rbx, qword [rax + 0xf8]
mov qword [rsp], rcx
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], 0
call fcn.004326e0
xorps xmm15, xmm15
mov r14, qword [0x006f38f0]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x20]
nop
test rax, rax
je 0x448991
mov rcx, qword [rsp + 0x58]
mov rdx, qword [sym.imp.kernel32.dll_RtlVirtualUnwind]
mov rbx, qword [rsp + 0x60]
mov rsi, rbx
lea rdi, [rsp + 0x50]
mov r8, qword [rsi + 0xf8]
mov qword [rsp], rdx
mov qword [rsp + 8], 0
mov qword [rsp + 0x10], rcx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x40], 0
call fcn.00432960
xorps xmm15, xmm15
mov r14, qword [0x006f38f0]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x68]
cmp qword [rcx], rax
ja 0x448991
cmp qword [rcx + 8], rax
ja 0x4488b3
mov eax, 1
add rsp, 0x70
pop rbp
ret
Function at 0x450320
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x10
mov qword [rsp + 0x20], rax
test rbx, rbx
jbe 0x450497
movzx edx, byte [rax]
test edx, edx
jne 0x450354
nop dword [rax]
test r8b, r8b
jne 0x450354
xor eax, eax
xor ebx, ebx
mov rcx, rbx
xor edi, edi
add rsp, 0x10
pop rbp
ret
bt edx, 7
jae 0x450367
xor edx, edx
xor r8d, r8d
xor r9d, r9d
jmp 0x450457
mov r8d, 1
mov r9d, edx
and edx, 1
neg edx
shr r9d, 1
xor edx, r9d
add dword [rsi], edx
nop dword [rax]
cmp rbx, r8
jb 0x450445
sub rbx, r8
sub rcx, r8
mov rdx, rcx
neg rdx
sar rdx, 0x3f
and r8, rdx
lea rdx, [rax + r8]
test rbx, rbx
jbe 0x450437
movzx esi, byte [rax + r8]
bt esi, 7
jae 0x4503bd
xor eax, eax
xor esi, esi
xor r8d, r8d
jmp 0x450400
mov eax, 1
cmp rax, rbx
ja 0x4503eb
add qword [rdi], rsi
sub rcx, rax
sub rbx, rax
mov rsi, rcx
neg rsi
sar rsi, 0x3f
and rax, rsi
add rax, rdx
mov edi, 1
add rsp, 0x10
pop rbp
ret
mov rcx, rbx
call fcn.00463040
lea r8d, [rcx + 7]
mov rcx, r11
mov eax, r12d
nop dword [rax]
cmp rax, rbx
jae 0x45042f
movzx r9d, byte [rax + rdx]
mov r10d, r9d
and r9d, 0x7f
mov r11, rcx
mov ecx, r8d
shl r9d, cl
lea r12d, [rax + 1]
or esi, r9d
test r10b, 0x80
jne 0x4503f3
mov rcx, r11
mov eax, r12d
jmp 0x4503c2
mov rcx, rbx
call fcn.00462f80
xor eax, eax
mov rcx, rax
nop dword [rax]
call fcn.00462f80
mov eax, r8d
mov rcx, rbx
call fcn.00463040
lea r9d, [rcx + 7]
mov rcx, r12
cmp rbx, rdx
jbe 0x45048d
movzx r10d, byte [rdx + rax]
mov r11d, r10d
and r10d, 0x7f
mov r12, rcx
mov ecx, r9d
shl r10d, cl
inc edx
or r8d, r10d
test r11b, 0x80
jne 0x450450
mov rcx, r12
mov r9d, edx
mov edx, r8d
mov r8d, r9d
jmp 0x45036d
mov eax, edx
mov rcx, rbx
call fcn.00462f80
xor eax, eax
mov rcx, rax
nop dword [rax]
call fcn.00462f80
nop
int3

Function at 0x456060
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x456115
push rbp
mov rbp, rsp
sub rsp, 0x48
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x68], rcx
mov qword [rsp + 0x70], rdi
test byte [rax], al
lea rdx, [rax + 0x10]
mov rsi, qword [rsp + 0x68]
mov rcx, rdi
mov rax, rdx
mov rbx, rsi
call fcn.00453ce0
nop
test bl, bl
je 0x45610f
mov qword [rsp + 0x18], rax
movups xmmword [rsp + 0x20], xmm15
movups xmmword [rsp + 0x28], xmm15
movups xmmword [rsp + 0x38], xmm15
lea rcx, [0x00456160]
mov qword [rsp + 0x20], rcx
mov rcx, qword [rsp + 0x58]
mov qword [rsp + 0x28], rcx
mov rcx, qword [rsp + 0x60]
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x38], rax
lea rcx, [rsp + 0x68]
mov qword [rsp + 0x40], rcx
lea rcx, [rsp + 0x20]
mov qword [rsp], rcx
call fcn.00460b80
xorps xmm15, xmm15
mov r14, qword [0x006f38f0]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x18]
add rsp, 0x48
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
call fcn.00460ca0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
jmp fcn.00456060
Function at 0x4590c0
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x45916f
push rbp
mov rbp, rsp
sub rsp, 0x58
mov qword [rsp + 0x70], rbx
lea rdx, [rsp + 0x68]
mov qword [rsp + 8], 0
movups xmmword [rsp + 0x10], xmm15
movups xmmword [rsp + 0x18], xmm15
movups xmmword [rsp + 0x28], xmm15
movups xmmword [rsp + 0x38], xmm15
movups xmmword [rsp + 0x48], xmm15
lea rsi, [0x004591c0]
mov qword [rsp + 0x10], rsi
mov rsi, qword [rsp + 0x60]
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdx
mov rdx, r14
mov qword [rsp + 0x28], rdx
lea rdx, [rsp + 8]
mov qword [rsp + 0x30], rdx
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x48], rcx
mov qword [rsp + 0x50], rdi
mov qword [rsp + 0x40], rbx
lea rax, [rsp + 0x10]
mov qword [rsp], rax
call fcn.00460b80
xorps xmm15, xmm15
mov r14, qword [0x006f38f0]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 8]
add rsp, 0x58
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
call fcn.00460ca0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
nop dword [rax]
jmp fcn.004590c0
Function at 0x462aa0
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x404043
push rbp
mov rbp, rsp
sub rsp, 0x18
mov rdx, qword [rax]
mov rcx, qword [rax + 8]
mov rax, rdx
call fcn.00409de0
add rsp, 0x18
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.00460ca0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp 0x404020
cmp byte [0x006f36eb], 0
je 0x462ab5
mov rcx, qword [rax + 8]
mov rax, qword [rax]
jmp 0x45fce0
jmp 0x404020

Function at 0x462ac0
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
nop
mov eax, dword [rax]
movabs rcx, 0xe7037ed1a0b428db
xor rcx, rax
xor rax, rbx
xor rax, qword [0x006f39c0]
movabs rdx, 0xa0761d6478bd642f
xor rdx, rax
mov rax, rcx
mul rdx
xor rax, rdx
mov rcx, rax
movabs rax, 0x1d8e4e27c47d124b
mul rcx
xor rax, rdx
nop
nop
ret
cmp byte [0x006f36eb], 0
je 0x462af5
movq xmm0, rbx
pinsrd xmm0, dword [rax], 2
aesenc xmm0, xmmword [0x006f3d40]
aesenc xmm0, xmmword [0x006f3d50]
aesenc xmm0, xmmword [0x006f3d60]
movq rax, xmm0
ret
jmp 0x40a000

Function at 0x462b00
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
nop
mov rax, qword [rax]
movabs rcx, 0xe7037ed1a0b428db
xor rcx, rax
xor rax, rbx
xor rax, qword [0x006f39c0]
movabs rdx, 0xa0761d6478bd642f
xor rdx, rax
mov rax, rcx
mul rdx
xor rax, rdx
mov rcx, rax
movabs rax, 0x1d8e4e27c47d1247
mul rcx
xor rax, rdx
nop
nop
ret
cmp byte [0x006f36eb], 0
je 0x462b36
movq xmm0, rbx
pinsrq xmm0, qword [rax], 1
aesenc xmm0, xmmword [0x006f3d40]
aesenc xmm0, xmmword [0x006f3d50]
aesenc xmm0, xmmword [0x006f3d60]
movq rax, xmm0
ret
jmp 0x40a060

Function at 0x4648c0
Capabilities:
Allocate thread local storage

Disassembly:
push rbp
mov rbp, rsp
mov rax, rsp
and rsp, 0xfffffffffffffff0
sub rsp, 0x30
mov qword [rsp + 0x20], rax
mov rax, qword [sym.imp.kernel32.dll_TlsAlloc]
call rax
mov rsp, qword [rsp + 0x20]
mov rcx, rax
cmp rcx, 0x40
jb 0x4648f4
mov rcx, 0x28
jmp 0x4648ff
shl rcx, 3
add rcx, 0x1480
mov qword [0x006f38f0], rcx
pop rbp
ret

Function at 0x46f260
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x46f338
push rbp
mov rbp, rsp
sub rsp, 0x38
movabs rdx, 0x1521390d08322611
mov qword [rsp + 0x2c], rdx
mov dword [rsp + 0x34], 0x1932200d
movabs rdx, 0x1070b0b0607080b
mov qword [rsp + 0x1a], rdx
movabs rdx, 0x401070b0b0607
mov qword [rsp + 0x1c], rdx
movabs rdx, 0x4080909030b06
mov qword [rsp + 0x24], rdx
xor eax, eax
jmp 0x46f2d4
movzx r9d, byte [rsp + rsi + 0x2c]
lea edx, [r9 + rdx]
lea edx, [rdx + 3]
mov byte [rsp + rdi + 0x2c], dl
mov byte [rsp + rsi + 0x2c], r8b
add rax, 2
cmp rax, 0x12
jge 0x46f308
movzx edx, byte [rsp + rax + 0x1a]
movzx esi, byte [rsp + rax + 0x1b]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0xc
jae 0x46f32b
movzx r8d, byte [rsp + rdi + 0x2c]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 3]
nop
cmp rsi, 0xc
jb 0x46f2ba
jmp 0x46f31f
xor eax, eax
lea rbx, [rsp + 0x2c]
mov ecx, 0xc
call fcn.0044d560
add rsp, 0x38
pop rbp
ret
mov eax, esi
mov ecx, 0xc
call fcn.00462f80
mov eax, edi
mov ecx, 0xc
call fcn.00462f80
nop
call fcn.00460ca0
nop dword [rax]
jmp fcn.0046f260
Function at 0x4700a0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x47017d
push rbp
mov rbp, rsp
sub rsp, 0x40
movabs rdx, 0x37b3a6bb34b8706a
mov qword [rsp + 0x30], rdx
movabs rdx, 0xc53236783125a764
mov qword [rsp + 0x38], rdx
movabs rdx, 0x8090a040d0a0a05
mov qword [rsp + 0x18], rdx
movabs rdx, 0xc060200010105
mov qword [rsp + 0x20], rdx
movabs rdx, 0x80a0402060f040f
mov qword [rsp + 0x28], rdx
xor eax, eax
nop
jmp 0x470120
movzx r9d, byte [rsp + rsi + 0x30]
sub r9d, edx
lea edx, [r9 - 0x2c]
mov byte [rsp + rdi + 0x30], dl
lea edx, [r8 - 0x2c]
mov byte [rsp + rsi + 0x30], dl
add rax, 2
nop
cmp rax, 0x18
jge 0x47014d
movzx edx, byte [rsp + rax + 0x18]
movzx esi, byte [rsp + rax + 0x19]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x10
jae 0x470170
movzx r8d, byte [rsp + rdi + 0x30]
sub r8d, edx
cmp rsi, 0x10
jb 0x470102
jmp 0x470164
xor eax, eax
lea rbx, [rsp + 0x30]
mov ecx, 0x10
call fcn.0044d560
add rsp, 0x40
pop rbp
ret
mov eax, esi
mov ecx, 0x10
call fcn.00462f80
mov eax, edi
mov ecx, 0x10
call fcn.00462f80
nop
nop dword [rax]
call fcn.00460ca0
jmp fcn.004700a0

Function at 0x4701a0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x47028a
push rbp
mov rbp, rsp
sub rsp, 0x40
movabs rdx, 0x38063926241f3121
mov qword [rsp + 0x2f], rdx
movabs rdx, 0x3938063926241f31
mov qword [rsp + 0x30], rdx
movabs rdx, 0x353222381d0c3035
mov qword [rsp + 0x38], rdx
movabs rdx, 0x402040b06060e00
mov qword [rsp + 0x1d], rdx
movabs rdx, 0x20e0402040b0606
mov qword [rsp + 0x1f], rdx
movabs rdx, 0xc0a0e030c0c0306
mov qword [rsp + 0x27], rdx
xor eax, eax
jmp 0x47022d
movzx r9d, byte [rsp + rsi + 0x2f]
sub r9d, edx
lea edx, [r9 + 0x1d]
mov byte [rsp + rdi + 0x2f], dl
lea edx, [r8 + 0x1d]
mov byte [rsp + rsi + 0x2f], dl
add rax, 2
cmp rax, 0x12
jge 0x47025a
movzx edx, byte [rsp + rax + 0x1d]
movzx esi, byte [rsp + rax + 0x1e]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x11
jae 0x47027d
movzx r8d, byte [rsp + rdi + 0x2f]
sub r8d, edx
cmp rsi, 0x11
jb 0x470210
jmp 0x470271
xor eax, eax
lea rbx, [rsp + 0x2f]
mov ecx, 0x11
call fcn.0044d560
add rsp, 0x40
pop rbp
ret
mov eax, esi
mov ecx, 0x11
call fcn.00462f80
mov eax, edi
mov ecx, 0x11
call fcn.00462f80
nop
call fcn.00460ca0
jmp fcn.004701a0
Function at 0x4757a0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4758c7
push rbp
mov rbp, rsp
sub rsp, 0x68
movabs rdx, 0xe31a72c73285f332
mov qword [rsp + 0x48], rdx
movabs rdx, 0x756f608634e15472
mov qword [rsp + 0x50], rdx
movabs rdx, 0x3951bf7c69333466
mov qword [rsp + 0x58], rdx
movabs rdx, 0x35746c82be743037
mov qword [rsp + 0x60], rdx
movabs rdx, 0x1507150c0416091c
mov qword [rsp + 0x1c], rdx
movabs rdx, 0x2010a1b0205020f
mov qword [rsp + 0x24], rdx
movabs rdx, 0x160a060a02010a1b
mov qword [rsp + 0x28], rdx
movabs rdx, 0x90c06130902150e
mov qword [rsp + 0x30], rdx
movabs rdx, 0xd0f0a1b1e081d10
mov qword [rsp + 0x38], rdx
movabs rdx, 0xc091a0a140e160c
mov qword [rsp + 0x40], rdx
xor eax, eax
jmp 0x475869
movzx r9d, byte [rsp + rsi + 0x48]
sub r9d, edx
lea edx, [r9 - 0xc]
mov byte [rsp + rdi + 0x48], dl
lea edx, [r8 - 0xc]
mov byte [rsp + rsi + 0x48], dl
add rax, 2
cmp rax, 0x2c
jge 0x475897
movzx edx, byte [rsp + rax + 0x1c]
movzx esi, byte [rsp + rax + 0x1d]
mov edi, edx
xor edx, esi
add edx, eax
nop
cmp rdi, 0x20
jae 0x4758ba
movzx r8d, byte [rsp + rdi + 0x48]
sub r8d, edx
cmp rsi, 0x20
jb 0x47584c
jmp 0x4758ae
xor eax, eax
lea rbx, [rsp + 0x48]
mov ecx, 0x20
call fcn.0044d560
add rsp, 0x68
pop rbp
ret
mov eax, esi
mov ecx, 0x20
call fcn.00462f80
mov eax, edi
mov ecx, 0x20
call fcn.00462f80
nop
call fcn.00460ca0
jmp fcn.004757a0

Function at 0x4758e0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x475a18
push rbp
mov rbp, rsp
sub rsp, 0x68
movabs rdx, 0x309fc53031bac1bb
mov qword [rsp + 0x47], rdx
movabs rdx, 0x37309fc53031bac1
mov qword [rsp + 0x48], rdx
movabs rdx, 0x4f30ca1a9dbac8d7
mov qword [rsp + 0x50], rdx
movabs rdx, 0x2da232251844af37
mov qword [rsp + 0x58], rdx
movabs rdx, 0xd3c1334031a0e69d
mov qword [rsp + 0x60], rdx
movabs rdx, 0xd19190d14181a19
mov qword [rsp + 0x19], rdx
movabs rdx, 0x191b060e0714171e
mov qword [rsp + 0x21], rdx
movabs rdx, 0x181a1a15180c191b
mov qword [rsp + 0x27], rdx
movabs rdx, 0x12131f0700141d1a
mov qword [rsp + 0x2f], rdx
movabs rdx, 0x20b101f01152009
mov qword [rsp + 0x37], rdx
movabs rdx, 0x171a1f121206050a
mov qword [rsp + 0x3f], rdx
xor eax, eax
jmp 0x4759b8
movzx r9d, byte [rsp + rsi + 0x47]
sub r9d, edx
lea edx, [r9 - 0x5b]
mov byte [rsp + rdi + 0x47], dl
lea edx, [r8 - 0x5b]
mov byte [rsp + rsi + 0x47], dl
add rax, 2
cmp rax, 0x2e
jge 0x4759e8
movzx edx, byte [rsp + rax + 0x19]
movzx esi, byte [rsp + rax + 0x1a]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x21
jae 0x475a0b
movzx r8d, byte [rsp + rdi + 0x47]
sub r8d, edx
nop dword [rax]
cmp rsi, 0x21
jb 0x47599b
jmp 0x4759ff
xor eax, eax
lea rbx, [rsp + 0x47]
mov ecx, 0x21
call fcn.0044d560
add rsp, 0x68
pop rbp
ret
mov eax, esi
mov ecx, 0x21
call fcn.00462f80
mov eax, edi
mov ecx, 0x21
call fcn.00462f80
nop
call fcn.00460ca0
nop dword [rax]
jmp fcn.004758e0
Function at 0x481480
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4815c7
push rbp
mov rbp, rsp
sub rsp, 0x70
movabs rdx, 0x3a116e5d6a725ef3
mov qword [rsp + 0x47], rdx
movabs rdx, 0xb6c67826c4b6954
mov qword [rsp + 0x4f], rdx
movabs rdx, 0x3e0b6c67826c4b69
mov qword [rsp + 0x50], rdx
movabs rdx, 0x6e35645f4c5e3d66
mov qword [rsp + 0x58], rdx
movabs rdx, 0x74606d2f554e4f59
mov qword [rsp + 0x60], rdx
movabs rdx, 0x65621f857f746e6e
mov qword [rsp + 0x68], rdx
movabs rdx, 0x8141d141b0f0f26
mov qword [rsp + 0x19], rdx
movabs rdx, 0x6100a1315001c01
mov qword [rsp + 0x21], rdx
movabs rdx, 0xe19150406210610
mov qword [rsp + 0x27], rdx
movabs rdx, 0xf01062413061f12
mov qword [rsp + 0x2f], rdx
movabs rdx, 0x11032727031f0408
mov qword [rsp + 0x37], rdx
movabs rdx, 0x171a250c1c152624
mov qword [rsp + 0x3f], rdx
xor eax, eax
jmp 0x481567
movzx r9d, byte [rsp + rsi + 0x47]
sub r9d, edx
lea edx, [r9 + 0x33]
mov byte [rsp + rdi + 0x47], dl
lea edx, [r8 + 0x33]
mov byte [rsp + rsi + 0x47], dl
add rax, 2
cmp rax, 0x2e
jge 0x481597
movzx edx, byte [rsp + rax + 0x19]
movzx esi, byte [rsp + rax + 0x1a]
mov edi, edx
xor edx, esi
add edx, eax
nop dword [rax]
cmp rdi, 0x29
jae 0x4815ba
movzx r8d, byte [rsp + rdi + 0x47]
sub r8d, edx
cmp rsi, 0x29
jb 0x48154a
jmp 0x4815ae
xor eax, eax
lea rbx, [rsp + 0x47]
mov ecx, 0x29
call fcn.0044d560
add rsp, 0x70
pop rbp
ret
mov eax, esi
mov ecx, 0x29
call fcn.00462f80
mov eax, edi
mov ecx, 0x29
call fcn.00462f80
nop
call fcn.00460ca0
jmp fcn.00481480
Function at 0x4815e0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
lea r12, [rsp - 0x10]
cmp r12, qword [r14 + 0x10]
jbe 0x481752
push rbp
mov rbp, rsp
sub rsp, 0x88
movabs rdx, 0xcc382f046442750c
mov qword [rsp + 0x5c], rdx
movabs rdx, 0xf2303136b88e32f5
mov qword [rsp + 0x64], rdx
movabs rdx, 0x7705392bf2303136
mov qword [rsp + 0x68], rdx
movabs rdx, 0x300620400733c4dd
mov qword [rsp + 0x70], rdx
movabs rdx, 0x953e2908c1e7eaa2
mov qword [rsp + 0x78], rdx
movabs rdx, 0x656713610116d198
mov qword [rsp + 0x80], rdx
movabs rdx, 0x101029290f261e22
mov qword [rsp + 0x1c], rdx
movabs rdx, 0x2114142714032411
mov qword [rsp + 0x24], rdx
movabs rdx, 0xc2300030c071f0a
mov qword [rsp + 0x2c], rdx
movabs rdx, 0x1704001c081f0a12
mov qword [rsp + 0x34], rdx
movabs rdx, 0xb110a2907021c00
mov qword [rsp + 0x3c], rdx
movabs rdx, 0x17170b170918251a
mov qword [rsp + 0x44], rdx
movabs rdx, 0x1c2711051d161526
mov qword [rsp + 0x4c], rdx
movabs rdx, 0x3221220081f0c10
mov qword [rsp + 0x54], rdx
xor eax, eax
jmp 0x4816ed
movzx r9d, byte [rsp + rsi + 0x5c]
lea edx, [r9 + rdx]
lea edx, [rdx - 7]
mov byte [rsp + rdi + 0x5c], dl
mov byte [rsp + rsi + 0x5c], r8b
add rax, 2
cmp rax, 0x40
jge 0x48171f
movzx edx, byte [rsp + rax + 0x1c]
movzx esi, byte [rsp + rax + 0x1d]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x2c
jae 0x481745
movzx r8d, byte [rsp + rdi + 0x5c]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 7]
cmp rsi, 0x2c
jb 0x4816d3
jmp 0x481739
xor eax, eax
lea rbx, [rsp + 0x5c]
mov ecx, 0x2c
call fcn.0044d560
add rsp, 0x88
pop rbp
ret
mov eax, esi
mov ecx, 0x2c
call fcn.00462f80
mov eax, edi
mov ecx, 0x2c
call fcn.00462f80
nop
call fcn.00460ca0
jmp fcn.004815e0

Function at 0x486440
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x48655a
push rbp
mov rbp, rsp
sub rsp, 0x60
movabs rdx, 0xbefccdab63b47915
mov qword [rsp + 0x42], rdx
movabs rdx, 0x52a80f697365d563
mov qword [rsp + 0x4a], rdx
movabs rdx, 0xa8b96dab5d7752a8
mov qword [rsp + 0x50], rdx
movabs rdx, 0xafba11bbd1db7565
mov qword [rsp + 0x58], rdx
movabs rdx, 0x517191800090d0a
mov qword [rsp + 0x1e], rdx
movabs rdx, 0xf12110605171918
mov qword [rsp + 0x22], rdx
movabs rdx, 0x1b1b1d141c121d06
mov qword [rsp + 0x2a], rdx
movabs rdx, 0x1812070d09111b0a
mov qword [rsp + 0x32], rdx
movabs rdx, 0x7021c1a0e150410
mov qword [rsp + 0x3a], rdx
xor eax, eax
jmp 0x4864f7
movzx r9d, byte [rsp + rsi + 0x42]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x6d]
mov byte [rsp + rdi + 0x42], dl
mov byte [rsp + rsi + 0x42], r8b
add rax, 2
cmp rax, 0x24
jge 0x486529
movzx edx, byte [rsp + rax + 0x1e]
movzx esi, byte [rsp + rax + 0x1f]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x1e
jae 0x48654d
movzx r8d, byte [rsp + rdi + 0x42]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x6d]
cmp rsi, 0x1e
jb 0x4864dd
jmp 0x486541
xor eax, eax
lea rbx, [rsp + 0x42]
mov ecx, 0x1e
call fcn.0044d560
add rsp, 0x60
pop rbp
nop
ret
mov eax, esi
mov ecx, 0x1e
call fcn.00462f80
mov eax, edi
mov ecx, 0x1e
call fcn.00462f80
nop
call fcn.00460ca0
nop
jmp fcn.00486440