joyce8/EMBER2024-capa huggingface dataset:
Function at 0x45a3e0
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x403ce3
push rbp
mov rbp, rsp
sub rsp, 0x18
mov rdx, qword [rax]
mov rcx, qword [rax + 8]
mov rax, rdx
call fcn.004088c0
add rsp, 0x18
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.004585e0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp 0x403cc0
cmp byte [0x0070480b], 0
je 0x45a3f5
mov rcx, qword [rax + 8]
mov rax, qword [rax]
jmp 0x457620
jmp 0x403cc0

Function at 0x45a400
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
nop
mov eax, dword [rax]
movabs rcx, 0xe7037ed1a0b428db
xor rcx, rax
xor rax, rbx
xor rax, qword [0x00704b00]
movabs rdx, 0xa0761d6478bd642f
xor rdx, rax
mov rax, rcx
mul rdx
xor rax, rdx
mov rcx, rax
movabs rax, 0x1d8e4e27c47d124b
mul rcx
xor rax, rdx
nop
nop
ret
cmp byte [0x0070480b], 0
je 0x45a435
movq xmm0, rbx
pinsrd xmm0, dword [rax], 2
aesenc xmm0, xmmword [0x00704e60]
aesenc xmm0, xmmword [0x00704e70]
aesenc xmm0, xmmword [0x00704e80]
movq rax, xmm0
ret
jmp 0x408ae0

Function at 0x45a440
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
nop
mov rax, qword [rax]
movabs rcx, 0xe7037ed1a0b428db
xor rcx, rax
xor rax, rbx
xor rax, qword [0x00704b00]
movabs rdx, 0xa0761d6478bd642f
xor rdx, rax
mov rax, rcx
mul rdx
xor rax, rdx
mov rcx, rax
movabs rax, 0x1d8e4e27c47d1247
mul rcx
xor rax, rdx
nop
nop
ret
cmp byte [0x0070480b], 0
je 0x45a476
movq xmm0, rbx
pinsrq xmm0, qword [rax], 1
aesenc xmm0, xmmword [0x00704e60]
aesenc xmm0, xmmword [0x00704e70]
aesenc xmm0, xmmword [0x00704e80]
movq rax, xmm0
ret
jmp 0x408b40

Function at 0x45c200
Capabilities:
Allocate thread local storage

Disassembly:
push rbp
mov rbp, rsp
mov rax, rsp
and rsp, 0xfffffffffffffff0
sub rsp, 0x30
mov qword [rsp + 0x20], rax
mov rax, qword [sym.imp.kernel32.dll_TlsAlloc]
call rax
mov rsp, qword [rsp + 0x20]
mov rcx, rax
cmp rcx, 0x40
jb 0x45c234
mov rcx, 0x28
jmp 0x45c23f
shl rcx, 3
add rcx, 0x1480
mov qword [0x00704a00], rcx
pop rbp
ret
Function at 0x466e60
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x466f4a
push rbp
mov rbp, rsp
sub rsp, 0x40
movabs rdx, 0x47072034526c3006
mov qword [rsp + 0x2e], rdx
movabs rdx, 0x3f3d47072034526c
mov qword [rsp + 0x30], rdx
movabs rdx, 0x65676e1c0cf34b6f
mov qword [rsp + 0x38], rdx
movabs rdx, 0xb08030d0c040d0c
mov qword [rsp + 0x1a], rdx
movabs rdx, 0x9060e030b08030d
mov qword [rsp + 0x1e], rdx
movabs rdx, 0x107060301030c00
mov qword [rsp + 0x26], rdx
xor eax, eax
jmp 0x466eed
movzx r9d, byte [rsp + rsi + 0x2e]
sub r9d, edx
lea edx, [r9 + 0x32]
mov byte [rsp + rdi + 0x2e], dl
lea edx, [r8 + 0x32]
mov byte [rsp + rsi + 0x2e], dl
add rax, 2
cmp rax, 0x14
jge 0x466f1a
movzx edx, byte [rsp + rax + 0x1a]
movzx esi, byte [rsp + rax + 0x1b]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x12
jae 0x466f3d
movzx r8d, byte [rsp + rdi + 0x2e]
sub r8d, edx
cmp rsi, 0x12
jb 0x466ed0
jmp 0x466f31
xor eax, eax
lea rbx, [rsp + 0x2e]
mov ecx, 0x12
call fcn.00447380
add rsp, 0x40
pop rbp
ret
mov eax, esi
mov ecx, 0x12
call fcn.0045a8c0
mov eax, edi
mov ecx, 0x12
call fcn.0045a8c0
nop
call fcn.004585e0
jmp fcn.00466e60

Function at 0x467260
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x467318
push rbp
mov rbp, rsp
sub rsp, 0x30
movabs rdx, 0x14f21238d1388734
mov qword [rsp + 0x28], rdx
movabs rdx, 0x507030503070701
mov qword [rsp + 0x1c], rdx
mov dword [rsp + 0x24], 0x7050706
xor eax, eax
jmp 0x4672b9
movzx r9d, byte [rsp + rsi + 0x28]
sub r9d, edx
lea edx, [r9 + 0x2a]
mov byte [rsp + rdi + 0x28], dl
lea edx, [r8 + 0x2a]
mov byte [rsp + rsi + 0x28], dl
add rax, 2
cmp rax, 0xc
jge 0x4672e8
movzx edx, byte [rsp + rax + 0x1c]
movzx esi, byte [rsp + rax + 0x1d]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 8
jae 0x46730b
movzx r8d, byte [rsp + rdi + 0x28]
sub r8d, edx
nop
cmp rsi, 8
jb 0x46729c
jmp 0x4672ff
xor eax, eax
lea rbx, [rsp + 0x28]
mov ecx, 8
call fcn.00447380
add rsp, 0x30
pop rbp
ret
mov eax, esi
mov ecx, 8
call fcn.0045a8c0
mov eax, edi
mov ecx, 8
call fcn.0045a8c0
nop
call fcn.004585e0
nop dword [rax]
jmp fcn.00467260

Function at 0x467580
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x46763d
push rbp
mov rbp, rsp
sub rsp, 0x30
movabs rdx, 0x3141e737c232bd43
mov qword [rsp + 0x26], rdx
mov word [rsp + 0x2e], 0x35c4
movabs rdx, 0x803060800060500
mov qword [rsp + 0x1a], rdx
mov dword [rsp + 0x22], 0x5010003
xor eax, eax
jmp 0x4675e0
movzx r9d, byte [rsp + rsi + 0x26]
sub r9d, edx
lea edx, [r9 - 0x7f]
mov byte [rsp + rdi + 0x26], dl
lea edx, [r8 - 0x7f]
mov byte [rsp + rsi + 0x26], dl
add rax, 2
cmp rax, 0xc
jge 0x46760d
movzx edx, byte [rsp + rax + 0x1a]
movzx esi, byte [rsp + rax + 0x1b]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0xa
jae 0x467630
movzx r8d, byte [rsp + rdi + 0x26]
sub r8d, edx
cmp rsi, 0xa
jb 0x4675c3
jmp 0x467624
xor eax, eax
lea rbx, [rsp + 0x26]
mov ecx, 0xa
call fcn.00447380
add rsp, 0x30
pop rbp
ret
mov eax, esi
mov ecx, 0xa
call fcn.0045a8c0
mov eax, edi
mov ecx, 0xa
call fcn.0045a8c0
nop
nop dword [rax]
call fcn.004585e0
jmp fcn.00467580
Function at 0x467660
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x467727
push rbp
mov rbp, rsp
sub rsp, 0x38
movabs rdx, 0x7652745031525959
mov qword [rsp + 0x2d], rdx
mov dword [rsp + 0x34], 0x567c5e76
movabs rdx, 0x601090508070204
mov qword [rsp + 0x1f], rdx
movabs rdx, 0xa0a000508090601
mov qword [rsp + 0x25], rdx
xor eax, eax
jmp 0x4676c8
movzx r9d, byte [rsp + rsi + 0x2d]
sub r9d, edx
lea edx, [r9 - 0x15]
mov byte [rsp + rdi + 0x2d], dl
lea edx, [r8 - 0x15]
mov byte [rsp + rsi + 0x2d], dl
add rax, 2
cmp rax, 0xe
jge 0x4676f7
movzx edx, byte [rsp + rax + 0x1f]
movzx esi, byte [rsp + rax + 0x20]
mov edi, edx
xor edx, esi
add edx, eax
nop
cmp rdi, 0xb
jae 0x46771a
movzx r8d, byte [rsp + rdi + 0x2d]
sub r8d, edx
cmp rsi, 0xb
jb 0x4676ab
jmp 0x46770e
xor eax, eax
lea rbx, [rsp + 0x2d]
mov ecx, 0xb
call fcn.00447380
add rsp, 0x38
pop rbp
ret
mov eax, esi
mov ecx, 0xb
call fcn.0045a8c0
mov eax, edi
mov ecx, 0xb
call fcn.0045a8c0
nop
call fcn.004585e0
jmp fcn.00467660

Function at 0x4679a0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x467a5e
push rbp
mov rbp, rsp
sub rsp, 0x30
movabs rdx, 0x493461464c32365a
mov qword [rsp + 0x24], rdx
mov dword [rsp + 0x2c], 0x45324664
movabs rdx, 0xb03080b05030004
mov qword [rsp + 0x18], rdx
mov dword [rsp + 0x20], 0x9090704
xor eax, eax
jmp 0x467a01
movzx r9d, byte [rsp + rsi + 0x24]
sub r9d, edx
lea edx, [r9 - 0xb]
mov byte [rsp + rdi + 0x24], dl
lea edx, [r8 - 0xb]
mov byte [rsp + rsi + 0x24], dl
add rax, 2
cmp rax, 0xc
jge 0x467a2e
movzx edx, byte [rsp + rax + 0x18]
movzx esi, byte [rsp + rax + 0x19]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0xc
jae 0x467a51
movzx r8d, byte [rsp + rdi + 0x24]
sub r8d, edx
cmp rsi, 0xc
jb 0x4679e4
jmp 0x467a45
xor eax, eax
lea rbx, [rsp + 0x24]
mov ecx, 0xc
call fcn.00447380
add rsp, 0x30
pop rbp
ret
mov eax, esi
mov ecx, 0xc
call fcn.0045a8c0
mov eax, edi
mov ecx, 0xc
call fcn.0045a8c0
nop
nop
call fcn.004585e0
jmp fcn.004679a0
Function at 0x4687e0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4688cc
push rbp
mov rbp, rsp
sub rsp, 0x40
movabs rdx, 0xb5f8bb34fc36f376
mov qword [rsp + 0x2f], rdx
movabs rdx, 0xe8b5f8bb34fc36f3
mov qword [rsp + 0x30], rdx
movabs rdx, 0x3532c2ffabbaf7fb
mov qword [rsp + 0x38], rdx
movabs rdx, 0x30600090d05000e
mov qword [rsp + 0x1b], rdx
movabs rdx, 0xa010c0703060009
mov qword [rsp + 0x1f], rdx
movabs rdx, 0xc0e07080d0b0e0b
mov qword [rsp + 0x27], rdx
xor eax, eax
jmp 0x46886a
movzx r9d, byte [rsp + rsi + 0x2f]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x2d]
mov byte [rsp + rdi + 0x2f], dl
mov byte [rsp + rsi + 0x2f], r8b
add rax, 2
cmp rax, 0x14
jge 0x46889c
movzx edx, byte [rsp + rax + 0x1b]
movzx esi, byte [rsp + rax + 0x1c]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x11
jae 0x4688bf
movzx r8d, byte [rsp + rdi + 0x2f]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x2d]
cmp rsi, 0x11
jb 0x468850
jmp 0x4688b3
xor eax, eax
lea rbx, [rsp + 0x2f]
mov ecx, 0x11
call fcn.00447380
add rsp, 0x40
pop rbp
ret
mov eax, esi
mov ecx, 0x11
call fcn.0045a8c0
mov eax, edi
mov ecx, 0x11
call fcn.0045a8c0
nop
call fcn.004585e0
jmp fcn.004687e0

Function at 0x4688e0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4689ca
push rbp
mov rbp, rsp
sub rsp, 0x40
movabs rdx, 0x3e2f45392e3a3935
mov qword [rsp + 0x2e], rdx
movabs rdx, 0x38203e2f45392e3a
mov qword [rsp + 0x30], rdx
movabs rdx, 0x3538313335323e30
mov qword [rsp + 0x38], rdx
movabs rdx, 0xa060605100608
mov qword [rsp + 0x1a], rdx
movabs rdx, 0x40c0210000a0606
mov qword [rsp + 0x1e], rdx
movabs rdx, 0x80703030707080b
mov qword [rsp + 0x26], rdx
xor eax, eax
jmp 0x46896d
movzx r9d, byte [rsp + rsi + 0x2e]
sub r9d, edx
lea edx, [r9 + 0x12]
mov byte [rsp + rdi + 0x2e], dl
lea edx, [r8 + 0x12]
mov byte [rsp + rsi + 0x2e], dl
add rax, 2
cmp rax, 0x14
jge 0x46899a
movzx edx, byte [rsp + rax + 0x1a]
movzx esi, byte [rsp + rax + 0x1b]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x12
jae 0x4689bd
movzx r8d, byte [rsp + rdi + 0x2e]
sub r8d, edx
cmp rsi, 0x12
jb 0x468950
jmp 0x4689b1
xor eax, eax
lea rbx, [rsp + 0x2e]
mov ecx, 0x12
call fcn.00447380
add rsp, 0x40
pop rbp
ret
mov eax, esi
mov ecx, 0x12
call fcn.0045a8c0
mov eax, edi
mov ecx, 0x12
call fcn.0045a8c0
nop
call fcn.004585e0
jmp fcn.004688e0
Function at 0x4689e0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x468aca
push rbp
mov rbp, rsp
sub rsp, 0x48
movabs rdx, 0xcc0931310d39ca31
mov qword [rsp + 0x35], rdx
movabs rdx, 0x1939fecc0931310d
mov qword [rsp + 0x38], rdx
movabs rdx, 0xb105cc337a238
mov qword [rsp + 0x40], rdx
movabs rdx, 0x807070e110c0f01
mov qword [rsp + 0x1f], rdx
movabs rdx, 0x10060f0111060807
mov qword [rsp + 0x25], rdx
movabs rdx, 0x120a030e10120f10
mov qword [rsp + 0x2d], rdx
xor eax, eax
jmp 0x468a6d
movzx r9d, byte [rsp + rsi + 0x35]
sub r9d, edx
lea edx, [r9 + 0x48]
mov byte [rsp + rdi + 0x35], dl
lea edx, [r8 + 0x48]
mov byte [rsp + rsi + 0x35], dl
add rax, 2
cmp rax, 0x16
jge 0x468a9a
movzx edx, byte [rsp + rax + 0x1f]
movzx esi, byte [rsp + rax + 0x20]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x13
jae 0x468abd
movzx r8d, byte [rsp + rdi + 0x35]
sub r8d, edx
cmp rsi, 0x13
jb 0x468a50
jmp 0x468ab1
xor eax, eax
lea rbx, [rsp + 0x35]
mov ecx, 0x13
call fcn.00447380
add rsp, 0x48
pop rbp
ret
mov eax, esi
mov ecx, 0x13
call fcn.0045a8c0
mov eax, edi
mov ecx, 0x13
call fcn.0045a8c0
nop
call fcn.004585e0
jmp fcn.004689e0

Function at 0x469940
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x469a4c
push rbp
mov rbp, rsp
sub rsp, 0x50
movabs rdx, 0xc0d391235fa3413
mov qword [rsp + 0x36], rdx
movabs rdx, 0x3538231320101732
mov qword [rsp + 0x3e], rdx
movabs rdx, 0x3812353823132010
mov qword [rsp + 0x40], rdx
movabs rdx, 0x2512361e34290f18
mov qword [rsp + 0x48], rdx
movabs rdx, 0x140c0713130a1602
mov qword [rsp + 0x18], rdx
movabs rdx, 0xd190a160d070b12
mov qword [rsp + 0x20], rdx
movabs rdx, 0x60a070b02140d19
mov qword [rsp + 0x26], rdx
movabs rdx, 0x10040a0600181309
mov qword [rsp + 0x2e], rdx
xor eax, eax
jmp 0x4699e8
movzx r9d, byte [rsp + rsi + 0x36]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x11]
mov byte [rsp + rdi + 0x36], dl
mov byte [rsp + rsi + 0x36], r8b
add rax, 2
cmp rax, 0x1e
jge 0x469a1c
movzx edx, byte [rsp + rax + 0x18]
movzx esi, byte [rsp + rax + 0x19]
mov edi, edx
xor edx, esi
add edx, eax
nop
cmp rdi, 0x1a
jae 0x469a3f
movzx r8d, byte [rsp + rdi + 0x36]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x11]
cmp rsi, 0x1a
jb 0x4699ce
jmp 0x469a33
xor eax, eax
lea rbx, [rsp + 0x36]
mov ecx, 0x1a
call fcn.00447380
add rsp, 0x50
pop rbp
ret
mov eax, esi
mov ecx, 0x1a
call fcn.0045a8c0
mov eax, edi
mov ecx, 0x1a
call fcn.0045a8c0
nop
call fcn.004585e0
jmp fcn.00469940
Function at 0x46d5a0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x46d6d8
push rbp
mov rbp, rsp
sub rsp, 0x70
movabs rdx, 0x758c346570323281
mov qword [rsp + 0x4b], rdx
movabs rdx, 0x7b8ce83934758c34
mov qword [rsp + 0x50], rdx
movabs rdx, 0x5ace6c38307c3133
mov qword [rsp + 0x58], rdx
movabs rdx, 0x31a570fd6ca05cb4
mov qword [rsp + 0x60], rdx
movabs rdx, 0x8f73b5c7eaac9e38
mov qword [rsp + 0x68], rdx
movabs rdx, 0x2422180622191506
mov qword [rsp + 0x1d], rdx
movabs rdx, 0x1b031f1f131e1704
mov qword [rsp + 0x25], rdx
movabs rdx, 0x240b1614130c1b03
mov qword [rsp + 0x2b], rdx
movabs rdx, 0x21001215191e200a
mov qword [rsp + 0x33], rdx
movabs rdx, 0x200a0300000f180f
mov qword [rsp + 0x3b], rdx
movabs rdx, 0x31f07042322191a
mov qword [rsp + 0x43], rdx
xor eax, eax
jmp 0x46d678
movzx r9d, byte [rsp + rsi + 0x4b]
sub r9d, edx
lea edx, [r9 - 0x14]
mov byte [rsp + rdi + 0x4b], dl
lea edx, [r8 - 0x14]
mov byte [rsp + rsi + 0x4b], dl
add rax, 2
cmp rax, 0x2e
jge 0x46d6a8
movzx edx, byte [rsp + rax + 0x1d]
movzx esi, byte [rsp + rax + 0x1e]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x25
jae 0x46d6cb
movzx r8d, byte [rsp + rdi + 0x4b]
sub r8d, edx
nop dword [rax]
cmp rsi, 0x25
jb 0x46d65b
jmp 0x46d6bf
xor eax, eax
lea rbx, [rsp + 0x4b]
mov ecx, 0x25
call fcn.00447380
add rsp, 0x70
pop rbp
ret
mov eax, esi
mov ecx, 0x25
call fcn.0045a8c0
mov eax, edi
mov ecx, 0x25
call fcn.0045a8c0
nop
call fcn.004585e0
nop dword [rax]
jmp fcn.0046d5a0

Function at 0x46d860
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x46d9a7
push rbp
mov rbp, rsp
sub rsp, 0x78
movabs rdx, 0x523136753f68396a
mov qword [rsp + 0x50], rdx
movabs rdx, 0x5759323730343a30
mov qword [rsp + 0x58], rdx
movabs rdx, 0x5f9f765f41415230
mov qword [rsp + 0x60], rdx
movabs rdx, 0x53534e3a35922243
mov qword [rsp + 0x68], rdx
movabs rdx, 0x3576313e807c7b32
mov qword [rsp + 0x70], rdx
movabs rdx, 0x151e1c051f192400
mov qword [rsp + 0x1e], rdx
movabs rdx, 0x1810151e1c051f19
mov qword [rsp + 0x20], rdx
movabs rdx, 0x4260e13060f211a
mov qword [rsp + 0x28], rdx
movabs rdx, 0x1814241519231103
mov qword [rsp + 0x30], rdx
movabs rdx, 0x10031e0712180a09
mov qword [rsp + 0x38], rdx
movabs rdx, 0x26060721121d0213
mov qword [rsp + 0x40], rdx
movabs rdx, 0x417221a161a1319
mov qword [rsp + 0x48], rdx
xor eax, eax
jmp 0x46d947
movzx r9d, byte [rsp + rsi + 0x50]
sub r9d, edx
lea edx, [r9 + 0x1c]
mov byte [rsp + rdi + 0x50], dl
lea edx, [r8 + 0x1c]
mov byte [rsp + rsi + 0x50], dl
add rax, 2
cmp rax, 0x32
jge 0x46d977
movzx edx, byte [rsp + rax + 0x1e]
movzx esi, byte [rsp + rax + 0x1f]
mov edi, edx
xor edx, esi
add edx, eax
nop dword [rax]
cmp rdi, 0x28
jae 0x46d99a
movzx r8d, byte [rsp + rdi + 0x50]
sub r8d, edx
cmp rsi, 0x28
jb 0x46d92a
jmp 0x46d98e
xor eax, eax
lea rbx, [rsp + 0x50]
mov ecx, 0x28
call fcn.00447380
add rsp, 0x78
pop rbp
ret
mov eax, esi
mov ecx, 0x28
call fcn.0045a8c0
mov eax, edi
mov ecx, 0x28
call fcn.0045a8c0
nop
call fcn.004585e0
jmp fcn.0046d860
Function at 0x478f80
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4790d8
push rbp
mov rbp, rsp
sub rsp, 0x78
movabs rdx, 0x4c3e5b98e16c296d
mov qword [rsp + 0x4c], rdx
movabs rdx, 0xe6306d366f217469
mov qword [rsp + 0x54], rdx
movabs rdx, 0x77009420e6306d36
mov qword [rsp + 0x58], rdx
movabs rdx, 0x10ff61ca1e3572e7
mov qword [rsp + 0x60], rdx
movabs rdx, 0xfef0b26f20275220
mov qword [rsp + 0x68], rdx
movabs rdx, 0xafbd661f220c2f5
mov qword [rsp + 0x70], rdx
movabs rdx, 0x17050c1e18210d01
mov qword [rsp + 0x1a], rdx
movabs rdx, 0x191817050c1e1821
mov qword [rsp + 0x1c], rdx
movabs rdx, 0x23041a1422070727
mov qword [rsp + 0x24], rdx
movabs rdx, 0x140c142a2106230f
mov qword [rsp + 0x2c], rdx
movabs rdx, 0xa110f241b0a0a25
mov qword [rsp + 0x34], rdx
movabs rdx, 0x2224191a0a1a1d1e
mov qword [rsp + 0x3c], rdx
movabs rdx, 0x2b1203161a29070a
mov qword [rsp + 0x44], rdx
xor eax, eax
jmp 0x479073
movzx r9d, byte [rsp + rsi + 0x4c]
lea edx, [r9 + rdx]
lea edx, [rdx - 4]
mov byte [rsp + rdi + 0x4c], dl
mov byte [rsp + rsi + 0x4c], r8b
add rax, 2
cmp rax, 0x32
jge 0x4790a8
movzx edx, byte [rsp + rax + 0x1a]
movzx esi, byte [rsp + rax + 0x1b]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x2c
jae 0x4790cb
movzx r8d, byte [rsp + rdi + 0x4c]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 4]
nop dword [rax]
cmp rsi, 0x2c
jb 0x479059
jmp 0x4790bf
xor eax, eax
lea rbx, [rsp + 0x4c]
mov ecx, 0x2c
call fcn.00447380
add rsp, 0x78
pop rbp
ret
mov eax, esi
mov ecx, 0x2c
call fcn.0045a8c0
mov eax, edi
mov ecx, 0x2c
call fcn.0045a8c0
nop
call fcn.004585e0
nop dword [rax]
jmp fcn.00478f80
Function at 0x47b220
Capabilities:
Encrypt data using rc4 prga

Disassembly:
lea r12, [rsp - 0x10]
cmp r12, qword [r14 + 0x10]
jbe 0x47b392
push rbp
mov rbp, rsp
sub rsp, 0x88
movabs rdx, 0x78ad6e89f8746f6e
mov qword [rsp + 0x57], rdx
movabs rdx, 0xb778ad6e89f8746f
mov qword [rsp + 0x58], rdx
movabs rdx, 0x66b36ed9c547a668
mov qword [rsp + 0x60], rdx
movabs rdx, 0xfd629aeb2cd49369
mov qword [rsp + 0x68], rdx
movabs rdx, 0x719492916120739a
mov qword [rsp + 0x70], rdx
movabs rdx, 0x38c0b27e6f919a20
mov qword [rsp + 0x78], rdx
movabs rdx, 0x30d57099e974b462
mov qword [rsp + 0x80], rdx
movabs rdx, 0x19190618120d1219
mov qword [rsp + 0x1f], rdx
movabs rdx, 0x6150d2d07032412
mov qword [rsp + 0x27], rdx
movabs rdx, 0x2c232f08130c2d1e
mov qword [rsp + 0x2f], rdx
movabs rdx, 0x2a231226081e2725
mov qword [rsp + 0x37], rdx
movabs rdx, 0x190c04220b160d0a
mov qword [rsp + 0x3f], rdx
movabs rdx, 0x1d131d0f1f2e0c1f
mov qword [rsp + 0x47], rdx
movabs rdx, 0x200407061214142f
mov qword [rsp + 0x4f], rdx
xor eax, eax
jmp 0x47b32d
movzx r9d, byte [rsp + rsi + 0x57]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x66]
mov byte [rsp + rdi + 0x57], dl
mov byte [rsp + rsi + 0x57], r8b
add rax, 2
cmp rax, 0x38
jge 0x47b35f
movzx edx, byte [rsp + rax + 0x1f]
movzx esi, byte [rsp + rax + 0x20]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x31
jae 0x47b385
movzx r8d, byte [rsp + rdi + 0x57]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x66]
cmp rsi, 0x31
jb 0x47b313
jmp 0x47b379
xor eax, eax
lea rbx, [rsp + 0x57]
mov ecx, 0x31
call fcn.00447380
add rsp, 0x88
pop rbp
ret
mov eax, esi
mov ecx, 0x31
call fcn.0045a8c0
mov eax, edi
mov ecx, 0x31
call fcn.0045a8c0
nop
call fcn.004585e0
jmp fcn.0047b220

Function at 0x47bf20
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x47bfec
push rbp
mov rbp, rsp
sub rsp, 0x38
movabs rdx, 0x4b363583aecb7930
mov qword [rsp + 0x28], rdx
movabs rdx, 0x5d6553628a617938
mov qword [rsp + 0x30], rdx
movabs rdx, 0x20307090d040107
mov qword [rsp + 0x18], rdx
movabs rdx, 0x20c0b0f030f0707
mov qword [rsp + 0x20], rdx
xor eax, eax
jmp 0x47bf8f
movzx r9d, byte [rsp + rsi + 0x28]
sub r9d, edx
lea edx, [r9 - 0x14]
mov byte [rsp + rdi + 0x28], dl
lea edx, [r8 - 0x14]
mov byte [rsp + rsi + 0x28], dl
add rax, 2
cmp rax, 0x10
jge 0x47bfbc
movzx edx, byte [rsp + rax + 0x18]
movzx esi, byte [rsp + rax + 0x19]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x10
jae 0x47bfdf
movzx r8d, byte [rsp + rdi + 0x28]
sub r8d, edx
cmp rsi, 0x10
jb 0x47bf72
jmp 0x47bfd3
xor eax, eax
lea rbx, [rsp + 0x28]
mov ecx, 0x10
call fcn.00447380
add rsp, 0x38
pop rbp
ret
mov eax, esi
mov ecx, 0x10
call fcn.0045a8c0
mov eax, edi
mov ecx, 0x10
call fcn.0045a8c0
nop
call fcn.004585e0
jmp fcn.0047bf20
Function at 0x47c720
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x47c7d8
push rbp
mov rbp, rsp
sub rsp, 0x30
movabs rdx, 0x97e065699a618c
mov qword [rsp + 0x28], rdx
movabs rdx, 0x207050006030602
mov qword [rsp + 0x1e], rdx
mov word [rsp + 0x26], 0x605
xor eax, eax
jmp 0x47c775
movzx r9d, byte [rsp + rsi + 0x28]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x67]
mov byte [rsp + rdi + 0x28], dl
mov byte [rsp + rsi + 0x28], r8b
add rax, 2
cmp rax, 0xa
jge 0x47c7a8
movzx edx, byte [rsp + rax + 0x1e]
movzx esi, byte [rsp + rax + 0x1f]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 8
jae 0x47c7cb
movzx r8d, byte [rsp + rdi + 0x28]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x67]
nop
cmp rsi, 8
jb 0x47c75b
jmp 0x47c7bf
xor eax, eax
lea rbx, [rsp + 0x28]
mov ecx, 8
call fcn.00447380
add rsp, 0x30
pop rbp
ret
mov eax, esi
mov ecx, 8
call fcn.0045a8c0
mov eax, edi
mov ecx, 8
call fcn.0045a8c0
nop
call fcn.004585e0
nop dword [rax]
jmp fcn.0047c720

Function at 0x47cd60
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x47ce26
push rbp
mov rbp, rsp
sub rsp, 0x30
movabs rdx, 0x1a25302e7372511c
mov qword [rsp + 0x27], rdx
mov byte [rsp + 0x2f], 0x3e
movabs rdx, 0x108000600050007
mov qword [rsp + 0x1b], rdx
mov dword [rsp + 0x23], 0x4000705
xor eax, eax
nop
jmp 0x47cdc0
movzx r9d, byte [rsp + rsi + 0x27]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x14]
mov byte [rsp + rdi + 0x27], dl
mov byte [rsp + rsi + 0x27], r8b
add rax, 2
nop dword [rax]
cmp rax, 0xc
jge 0x47cdf2
movzx edx, byte [rsp + rax + 0x1b]
movzx esi, byte [rsp + rax + 0x1c]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 9
jae 0x47ce17
movzx r8d, byte [rsp + rdi + 0x27]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x14]
cmp rsi, 9
jb 0x47cda2
jmp 0x47ce0b
xor eax, eax
lea rbx, [rsp + 0x27]
mov ecx, 9
nop
call fcn.00447380
add rsp, 0x30
pop rbp
ret
mov eax, esi
mov ecx, 9
call fcn.0045a8c0
mov eax, edi
mov ecx, 9
nop
call fcn.0045a8c0
nop
call fcn.004585e0
jmp fcn.0047cd60

Function at 0x47d160
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x47d21d
push rbp
mov rbp, rsp
sub rsp, 0x30
movabs rdx, 0xf9936065ab7261b1
mov qword [rsp + 0x27], rdx
mov byte [rsp + 0x2f], 0xa1
movabs rdx, 0x6000303070507
mov qword [rsp + 0x1d], rdx
mov word [rsp + 0x25], 0x508
xor eax, eax
nop
jmp 0x47d1c0
movzx r9d, byte [rsp + rsi + 0x27]
sub r9d, edx
lea edx, [r9 - 0x37]
mov byte [rsp + rdi + 0x27], dl
lea edx, [r8 - 0x37]
mov byte [rsp + rsi + 0x27], dl
add rax, 2
nop
cmp rax, 0xa
jge 0x47d1ed
movzx edx, byte [rsp + rax + 0x1d]
movzx esi, byte [rsp + rax + 0x1e]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 9
jae 0x47d210
movzx r8d, byte [rsp + rdi + 0x27]
sub r8d, edx
cmp rsi, 9
jb 0x47d1a2
jmp 0x47d204
xor eax, eax
lea rbx, [rsp + 0x27]
mov ecx, 9
call fcn.00447380
add rsp, 0x30
pop rbp
ret
mov eax, esi
mov ecx, 9
call fcn.0045a8c0
mov eax, edi
mov ecx, 9
call fcn.0045a8c0
nop
nop dword [rax]
call fcn.004585e0
jmp fcn.0047d160