joyce8/EMBER2024-capa huggingface dataset:
Function at 0x439b80
Capabilities:
Encode data using base64

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x439ce7
push rbp
mov rbp, rsp
sub rsp, 0x18
mov ecx, dword [rax + 0x190]
mov edx, dword [rax + 0x194]
mov rsi, qword [rax + 0x998]
mov edi, dword [rax + 0x194]
cmp edi, edx
jne 0x439b92
cmp edx, ecx
jne 0x439cd5
nop word [rax + rax]
test rsi, rsi
jne 0x439cd5
mov qword [rsp + 0x28], rax
test rbx, rbx
jne 0x439bf4
nop
call fcn.00452e00
xorps xmm15, xmm15
mov r14, qword [0x0062b238]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rbx, qword [rsp]
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0x10], rbx
call fcn.00439aa0
mov rcx, qword [rsp + 0x28]
mov edx, dword [rcx]
mov ebx, edx
sar edx, 0x1f
shr edx, 0x1b
add edx, ebx
mov esi, edx
and edx, 0xffffffe0
sub ebx, edx
test ebx, ebx
jl 0x439cd0
mov rdx, qword [0x005a5cb8]
sar esi, 5
mov rax, rcx
mov ecx, ebx
mov edi, 1
shl edi, cl
movsxd rsi, esi
cmp ecx, 0x20
sbb r8d, r8d
and edi, r8d
cmp rdx, rsi
jbe 0x439cc5
mov rcx, qword [0x005a5cb0]
lea rcx, [rcx + rsi*4]
lock or dword [rcx], edi
mov rcx, qword [0x005a7650]
mov qword [rax + 8], rcx
mov rcx, rax
nop
mov qword [0x005a7650], rax
nop
mov edx, 1
lea rsi, [0x005a7658]
lock xadd dword [rsi], edx
mov rdx, qword [rcx + 0x1248]
shr rdx, 0x3d
test dl, dl
jne 0x439cb3
mov rax, qword [rsp + 0x10]
movabs rdx, 0x1fffffffffffffff
and rdx, rax
bts rdx, 0x3f
nop
nop
xchg qword [rcx + 0x1248], rdx
add rsp, 0x18
pop rbp
ret
lea rax, [0x005196eb]
mov ebx, 0x28
nop
call fcn.0042c180
mov rax, rsi
mov rcx, rdx
call fcn.00451500
call fcn.0042b220
lea rax, [0x00518d58]
mov ebx, 0x23
call fcn.0042c180
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.0044f280
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.00439b80
Function at 0x43cf40
Capabilities:
Access peb ldr_data

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x70
mov rcx, r14
test rcx, rcx
je 0x43cf88
mov rcx, qword [rcx + 0x30]
mov rcx, qword [rcx + 0x90]
nop dword [rax + rax]
test rcx, rcx
je 0x43cf88
mov qword [rsp + 0x68], rcx
nop
mov rax, qword [rdi + 0x28]
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x58], 0
mov qword [rsp + 0x50], 0
jmp 0x43cf98
mov eax, 1
add rsp, 0x70
pop rbp
ret
mov rax, qword [rsp + 0x60]
mov rcx, qword [sym.imp.kernel32.dll_RtlLookupFunctionEntry]
lea rdx, [rsp + 0x58]
mov rbx, qword [rax + 0xf8]
mov qword [rsp], rcx
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], 0
call fcn.0042a080
xorps xmm15, xmm15
mov r14, qword [0x0062b238]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x20]
nop
test rax, rax
je 0x43d071
mov rcx, qword [rsp + 0x58]
mov rdx, qword [sym.imp.kernel32.dll_RtlVirtualUnwind]
mov rbx, qword [rsp + 0x60]
mov rsi, rbx
lea rdi, [rsp + 0x50]
mov r8, qword [rsi + 0xf8]
mov qword [rsp], rdx
mov qword [rsp + 8], 0
mov qword [rsp + 0x10], rcx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x40], 0
call fcn.0042a300
xorps xmm15, xmm15
mov r14, qword [0x0062b238]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x68]
cmp qword [rcx], rax
ja 0x43d071
cmp qword [rcx + 8], rax
ja 0x43cf93
mov eax, 1
add rsp, 0x70
pop rbp
ret
Function at 0x4428c0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x10
mov qword [rsp + 0x20], rax
test rbx, rbx
jbe 0x442a37
movzx edx, byte [rax]
test edx, edx
jne 0x4428f4
nop dword [rax]
test r8b, r8b
jne 0x4428f4
xor eax, eax
xor ebx, ebx
mov rcx, rbx
xor edi, edi
add rsp, 0x10
pop rbp
ret
bt edx, 7
jae 0x442907
xor edx, edx
xor r8d, r8d
xor r9d, r9d
jmp 0x4429f7
mov r8d, 1
mov r9d, edx
and edx, 1
neg edx
shr r9d, 1
xor edx, r9d
add dword [rsi], edx
nop dword [rax]
cmp rbx, r8
jb 0x4429e5
sub rbx, r8
sub rcx, r8
mov rdx, rcx
neg rdx
sar rdx, 0x3f
and r8, rdx
lea rdx, [rax + r8]
test rbx, rbx
jbe 0x4429d7
movzx esi, byte [rax + r8]
bt esi, 7
jae 0x44295d
xor eax, eax
xor esi, esi
xor r8d, r8d
jmp 0x4429a0
mov eax, 1
cmp rax, rbx
ja 0x44298b
add qword [rdi], rsi
sub rcx, rax
sub rbx, rax
mov rsi, rcx
neg rsi
sar rsi, 0x3f
and rax, rsi
add rax, rdx
mov edi, 1
add rsp, 0x10
pop rbp
ret
mov rcx, rbx
call fcn.004515c0
lea r8d, [rcx + 7]
mov rcx, r11
mov eax, r12d
nop dword [rax]
cmp rax, rbx
jae 0x4429cf
movzx r9d, byte [rax + rdx]
mov r10d, r9d
and r9d, 0x7f
mov r11, rcx
mov ecx, r8d
shl r9d, cl
lea r12d, [rax + 1]
or esi, r9d
test r10b, 0x80
jne 0x442993
mov rcx, r11
mov eax, r12d
jmp 0x442962
mov rcx, rbx
call fcn.00451500
xor eax, eax
mov rcx, rax
nop dword [rax]
call fcn.00451500
mov eax, r8d
mov rcx, rbx
call fcn.004515c0
lea r9d, [rcx + 7]
mov rcx, r12
cmp rbx, rdx
jbe 0x442a2d
movzx r10d, byte [rdx + rax]
mov r11d, r10d
and r10d, 0x7f
mov r12, rcx
mov ecx, r9d
shl r10d, cl
inc edx
or r8d, r10d
test r11b, 0x80
jne 0x4429f0
mov rcx, r12
mov r9d, edx
mov edx, r8d
mov r8d, r9d
jmp 0x44290d
mov eax, edx
mov rcx, rbx
call fcn.00451500
xor eax, eax
mov rcx, rax
nop dword [rax]
call fcn.00451500
nop
int3

Function at 0x448560
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x448615
push rbp
mov rbp, rsp
sub rsp, 0x48
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x68], rcx
mov qword [rsp + 0x70], rdi
test byte [rax], al
lea rdx, [rax + 0x10]
mov rsi, qword [rsp + 0x68]
mov rcx, rdi
mov rax, rdx
mov rbx, rsi
call fcn.00446280
nop
test bl, bl
je 0x44860f
mov qword [rsp + 0x18], rax
movups xmmword [rsp + 0x20], xmm15
movups xmmword [rsp + 0x28], xmm15
movups xmmword [rsp + 0x38], xmm15
lea rcx, [0x00448660]
mov qword [rsp + 0x20], rcx
mov rcx, qword [rsp + 0x58]
mov qword [rsp + 0x28], rcx
mov rcx, qword [rsp + 0x60]
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x38], rax
lea rcx, [rsp + 0x68]
mov qword [rsp + 0x40], rcx
lea rcx, [rsp + 0x20]
mov qword [rsp], rcx
call fcn.0044f160
xorps xmm15, xmm15
mov r14, qword [0x0062b238]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x18]
add rsp, 0x48
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
call fcn.0044f280
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
jmp fcn.00448560
Function at 0x449720
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4497cf
push rbp
mov rbp, rsp
sub rsp, 0x58
mov qword [rsp + 0x70], rbx
lea rdx, [rsp + 0x68]
mov qword [rsp + 8], 0
movups xmmword [rsp + 0x10], xmm15
movups xmmword [rsp + 0x18], xmm15
movups xmmword [rsp + 0x28], xmm15
movups xmmword [rsp + 0x38], xmm15
movups xmmword [rsp + 0x48], xmm15
lea rsi, [0x00449820]
mov qword [rsp + 0x10], rsi
mov rsi, qword [rsp + 0x60]
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdx
mov rdx, r14
mov qword [rsp + 0x28], rdx
lea rdx, [rsp + 8]
mov qword [rsp + 0x30], rdx
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x48], rcx
mov qword [rsp + 0x50], rdi
mov qword [rsp + 0x40], rbx
lea rax, [rsp + 0x10]
mov qword [rsp], rax
call fcn.0044f160
xorps xmm15, xmm15
mov r14, qword [0x0062b238]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 8]
add rsp, 0x58
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
call fcn.0044f280
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
nop dword [rax]
jmp fcn.00449720
Function at 0x452e40
Capabilities:
Allocate thread local storage

Disassembly:
push rbp
mov rbp, rsp
mov rax, rsp
and rsp, 0xfffffffffffffff0
sub rsp, 0x30
mov qword [rsp + 0x20], rax
mov rax, qword [sym.imp.kernel32.dll_TlsAlloc]
call rax
mov rsp, qword [rsp + 0x20]
mov rcx, rax
cmp rcx, 0x40
jb 0x452e74
mov rcx, 0x28
jmp 0x452e7f
shl rcx, 3
add rcx, 0x1480
mov qword [0x0062b238], rcx
pop rbp
ret

Function at 0x458380
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x458438
push rbp
mov rbp, rsp
sub rsp, 0x30
movabs rdx, 0x2ae16fd92d2427c8
mov qword [rsp + 0x28], rdx
movabs rdx, 0x607020104030300
mov qword [rsp + 0x1e], rdx
mov word [rsp + 0x26], 0x707
xor eax, eax
jmp 0x4583d5
movzx r9d, byte [rsp + rsi + 0x28]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x3e]
mov byte [rsp + rdi + 0x28], dl
mov byte [rsp + rsi + 0x28], r8b
add rax, 2
cmp rax, 0xa
jge 0x458408
movzx edx, byte [rsp + rax + 0x1e]
movzx esi, byte [rsp + rax + 0x1f]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 8
jae 0x45842b
movzx r8d, byte [rsp + rdi + 0x28]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x3e]
nop
cmp rsi, 8
jb 0x4583bb
jmp 0x45841f
xor eax, eax
lea rbx, [rsp + 0x28]
mov ecx, 8
call fcn.00440dc0
add rsp, 0x30
pop rbp
ret
mov eax, esi
mov ecx, 8
call fcn.00451500
mov eax, edi
mov ecx, 8
call fcn.00451500
nop
call fcn.0044f280
nop dword [rax]
jmp fcn.00458380

Function at 0x458460
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x45857a
push rbp
mov rbp, rsp
sub rsp, 0x60
movabs rdx, 0x4e752023636e04f8
mov qword [rsp + 0x42], rdx
movabs rdx, 0x10196f5feb456faf
mov qword [rsp + 0x4a], rdx
movabs rdx, 0x3c45560357241019
mov qword [rsp + 0x50], rdx
movabs rdx, 0x7fc1d32f3203444
mov qword [rsp + 0x58], rdx
movabs rdx, 0x16100e161d0c0f0e
mov qword [rsp + 0x1a], rdx
movabs rdx, 0x70407190710101c
mov qword [rsp + 0x22], rdx
movabs rdx, 0x70a1b1b160b1311
mov qword [rsp + 0x2a], rdx
movabs rdx, 0x1b011b0812011614
mov qword [rsp + 0x32], rdx
movabs rdx, 0x1171a1500171412
mov qword [rsp + 0x3a], rdx
xor eax, eax
jmp 0x458517
movzx r9d, byte [rsp + rsi + 0x42]
lea edx, [r9 + rdx]
lea edx, [rdx + 6]
mov byte [rsp + rdi + 0x42], dl
mov byte [rsp + rsi + 0x42], r8b
add rax, 2
cmp rax, 0x28
jge 0x458549
movzx edx, byte [rsp + rax + 0x1a]
movzx esi, byte [rsp + rax + 0x1b]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x1e
jae 0x45856d
movzx r8d, byte [rsp + rdi + 0x42]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 6]
cmp rsi, 0x1e
jb 0x4584fd
jmp 0x458561
xor eax, eax
lea rbx, [rsp + 0x42]
mov ecx, 0x1e
call fcn.00440dc0
add rsp, 0x60
pop rbp
nop
ret
mov eax, esi
mov ecx, 0x1e
call fcn.00451500
mov eax, edi
mov ecx, 0x1e
call fcn.00451500
nop
call fcn.0044f280
nop
jmp fcn.00458460
Function at 0x464aa0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x464b9b
push rbp
mov rbp, rsp
sub rsp, 0x48
movabs rdx, 0x66eb64d1da5bdf56
mov qword [rsp + 0x33], rdx
movabs rdx, 0x4b81aa6e6966eb64
mov qword [rsp + 0x38], rdx
movabs rdx, 0x93546c9be4679e8c
mov qword [rsp + 0x40], rdx
movabs rdx, 0xc0e0002000d130a
mov qword [rsp + 0x19], rdx
movabs rdx, 0xd0113140600030a
mov qword [rsp + 0x21], rdx
movabs rdx, 0x10100d0113140600
mov qword [rsp + 0x23], rdx
movabs rdx, 0x1411040b040e020e
mov qword [rsp + 0x2b], rdx
xor eax, eax
jmp 0x464b39
movzx r9d, byte [rsp + rsi + 0x33]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x7a]
mov byte [rsp + rdi + 0x33], dl
mov byte [rsp + rsi + 0x33], r8b
add rax, 2
cmp rax, 0x1a
jge 0x464b6b
movzx edx, byte [rsp + rax + 0x19]
movzx esi, byte [rsp + rax + 0x1a]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x15
jae 0x464b8e
movzx r8d, byte [rsp + rdi + 0x33]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x7a]
cmp rsi, 0x15
jb 0x464b1f
jmp 0x464b82
xor eax, eax
lea rbx, [rsp + 0x33]
mov ecx, 0x15
call fcn.00440dc0
add rsp, 0x48
pop rbp
ret
mov eax, esi
mov ecx, 0x15
call fcn.00451500
mov eax, edi
mov ecx, 0x15
call fcn.00451500
nop
nop dword [rax + rax]
call fcn.0044f280
jmp fcn.00464aa0

Function at 0x465920
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x465a1b
push rbp
mov rbp, rsp
sub rsp, 0x50
movabs rdx, 0x9a8a2e898de69031
mov qword [rsp + 0x39], rdx
movabs rdx, 0x9897809f312e2a9a
mov qword [rsp + 0x40], rdx
movabs rdx, 0xfef72eec96e0fb2e
mov qword [rsp + 0x48], rdx
movabs rdx, 0x15010d070b021613
mov qword [rsp + 0x1f], rdx
movabs rdx, 0x11120c1013040801
mov qword [rsp + 0x27], rdx
movabs rdx, 0xe0c11120c101304
mov qword [rsp + 0x29], rdx
movabs rdx, 0x160e030601160b12
mov qword [rsp + 0x31], rdx
xor eax, eax
jmp 0x4659b9
movzx r9d, byte [rsp + rsi + 0x39]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x77]
mov byte [rsp + rdi + 0x39], dl
mov byte [rsp + rsi + 0x39], r8b
add rax, 2
cmp rax, 0x1a
jge 0x4659eb
movzx edx, byte [rsp + rax + 0x1f]
movzx esi, byte [rsp + rax + 0x20]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x17
jae 0x465a0e
movzx r8d, byte [rsp + rdi + 0x39]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x77]
cmp rsi, 0x17
jb 0x46599f
jmp 0x465a02
xor eax, eax
lea rbx, [rsp + 0x39]
mov ecx, 0x17
call fcn.00440dc0
add rsp, 0x50
pop rbp
ret
mov eax, esi
mov ecx, 0x17
call fcn.00451500
mov eax, edi
mov ecx, 0x17
call fcn.00451500
nop
nop dword [rax + rax]
call fcn.0044f280
jmp fcn.00465920
Function at 0x466620
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x46670a
push rbp
mov rbp, rsp
sub rsp, 0x48
movabs rdx, 0xd3d93f6d7567dd61
mov qword [rsp + 0x32], rdx
movabs rdx, 0x2095734bcc44d3d9
mov qword [rsp + 0x38], rdx
movabs rdx, 0x67c451a541e18d58
mov qword [rsp + 0x40], rdx
movabs rdx, 0x805130a14120e11
mov qword [rsp + 0x1a], rdx
movabs rdx, 0x1100a131401110c
mov qword [rsp + 0x22], rdx
movabs rdx, 0x80f0607050e0909
mov qword [rsp + 0x2a], rdx
xor eax, eax
jmp 0x4666ad
movzx r9d, byte [rsp + rsi + 0x32]
sub r9d, edx
lea edx, [r9 - 0x50]
mov byte [rsp + rdi + 0x32], dl
lea edx, [r8 - 0x50]
mov byte [rsp + rsi + 0x32], dl
add rax, 2
cmp rax, 0x18
jge 0x4666da
movzx edx, byte [rsp + rax + 0x1a]
movzx esi, byte [rsp + rax + 0x1b]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x16
jae 0x4666fd
movzx r8d, byte [rsp + rdi + 0x32]
sub r8d, edx
cmp rsi, 0x16
jb 0x466690
jmp 0x4666f1
xor eax, eax
lea rbx, [rsp + 0x32]
mov ecx, 0x16
call fcn.00440dc0
add rsp, 0x48
pop rbp
ret
mov eax, esi
mov ecx, 0x16
call fcn.00451500
mov eax, edi
mov ecx, 0x16
call fcn.00451500
nop
call fcn.0044f280
jmp fcn.00466620

Function at 0x4692a0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x46939d
push rbp
mov rbp, rsp
sub rsp, 0x48
movabs rdx, 0x3e6c860b6320c6a3
mov qword [rsp + 0x36], rdx
movabs rdx, 0x70ef3e6c860b6320
mov qword [rsp + 0x38], rdx
movabs rdx, 0xc39cbb8fbaa49472
mov qword [rsp + 0x40], rdx
movabs rdx, 0x110d0c0107080411
mov qword [rsp + 0x1c], rdx
movabs rdx, 0x50e050d0001000c
mov qword [rsp + 0x24], rdx
movabs rdx, 0xb0f050e050d0001
mov qword [rsp + 0x26], rdx
movabs rdx, 0x1011040b10070c0c
mov qword [rsp + 0x2e], rdx
xor eax, eax
jmp 0x469340
movzx r9d, byte [rsp + rsi + 0x36]
sub r9d, edx
lea edx, [r9 - 0xd]
mov byte [rsp + rdi + 0x36], dl
lea edx, [r8 - 0xd]
mov byte [rsp + rsi + 0x36], dl
add rax, 2
nop dword [rax]
cmp rax, 0x1a
jge 0x46936d
movzx edx, byte [rsp + rax + 0x1c]
movzx esi, byte [rsp + rax + 0x1d]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x12
jae 0x469390
movzx r8d, byte [rsp + rdi + 0x36]
sub r8d, edx
cmp rsi, 0x12
jb 0x46931f
jmp 0x469384
xor eax, eax
lea rbx, [rsp + 0x36]
mov ecx, 0x12
call fcn.00440dc0
add rsp, 0x48
pop rbp
ret
mov eax, esi
mov ecx, 0x12
call fcn.00451500
mov eax, edi
mov ecx, 0x12
call fcn.00451500
nop
nop dword [rax]
call fcn.0044f280
jmp fcn.004692a0
Function at 0x46c1e0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x46c2ac
push rbp
mov rbp, rsp
sub rsp, 0x38
movabs rdx, 0x6f6fd220918abfcb
mov qword [rsp + 0x2a], rdx
movabs rdx, 0xf2d290978b206f6f
mov qword [rsp + 0x30], rdx
movabs rdx, 0xa09050102030d09
mov qword [rsp + 0x1a], rdx
movabs rdx, 0x5010a0b050c0005
mov qword [rsp + 0x22], rdx
xor eax, eax
jmp 0x46c24f
movzx r9d, byte [rsp + rsi + 0x2a]
sub r9d, edx
lea edx, [r9 - 0x22]
mov byte [rsp + rdi + 0x2a], dl
lea edx, [r8 - 0x22]
mov byte [rsp + rsi + 0x2a], dl
add rax, 2
cmp rax, 0x10
jge 0x46c27c
movzx edx, byte [rsp + rax + 0x1a]
movzx esi, byte [rsp + rax + 0x1b]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0xe
jae 0x46c29f
movzx r8d, byte [rsp + rdi + 0x2a]
sub r8d, edx
cmp rsi, 0xe
jb 0x46c232
jmp 0x46c293
xor eax, eax
lea rbx, [rsp + 0x2a]
mov ecx, 0xe
call fcn.00440dc0
add rsp, 0x38
pop rbp
ret
mov eax, esi
mov ecx, 0xe
call fcn.00451500
mov eax, edi
mov ecx, 0xe
call fcn.00451500
nop
call fcn.0044f280
jmp fcn.0046c1e0

Function at 0x46d100
Capabilities:
Encrypt data using rc4 prga

Disassembly:
lea r12, [rsp - 0x20]
cmp r12, qword [r14 + 0x10]
jbe 0x46d295
push rbp
mov rbp, rsp
sub rsp, 0x98
movabs rdx, 0xbe64d7f729a11c69
mov qword [rsp + 0x67], rdx
movabs rdx, 0x5fbe64d7f729a11c
mov qword [rsp + 0x68], rdx
movabs rdx, 0x704153636e694f72
mov qword [rsp + 0x70], rdx
movabs rdx, 0x51793f1c2f5d4856
mov qword [rsp + 0x78], rdx
movabs rdx, 0x192a4847e7e56964
mov qword [rsp + 0x80], rdx
movabs rdx, 0x4f0a37b69f772b51
mov qword [rsp + 0x88], rdx
movabs rdx, 0x72328d63512a5c78
mov qword [rsp + 0x90], rdx
movabs rdx, 0x1314020325200705
mov qword [rsp + 0x1f], rdx
movabs rdx, 0x1152220262b0816
mov qword [rsp + 0x27], rdx
movabs rdx, 0x1c1f051e2827182a
mov qword [rsp + 0x2f], rdx
movabs rdx, 0x28080f040e11051d
mov qword [rsp + 0x37], rdx
movabs rdx, 0x81b081e21222317
mov qword [rsp + 0x3f], rdx
movabs rdx, 0x80a0f27011c0312
mov qword [rsp + 0x47], rdx
movabs rdx, 0x2c29220715122814
mov qword [rsp + 0x4f], rdx
movabs rdx, 0x82c072f19161d2e
mov qword [rsp + 0x57], rdx
movabs rdx, 0x280f081c1e1c2419
mov qword [rsp + 0x5f], rdx
xor eax, eax
jmp 0x46d234
movzx r9d, byte [rsp + rsi + 0x67]
sub r9d, edx
lea edx, [r9 + 0x52]
mov byte [rsp + rdi + 0x67], dl
lea edx, [r8 + 0x52]
mov byte [rsp + rsi + 0x67], dl
add rax, 2
cmp rax, 0x48
jge 0x46d262
movzx edx, byte [rsp + rax + 0x1f]
movzx esi, byte [rsp + rax + 0x20]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x31
jae 0x46d288
movzx r8d, byte [rsp + rdi + 0x67]
sub r8d, edx
cmp rsi, 0x31
jb 0x46d217
nop
jmp 0x46d27c
xor eax, eax
lea rbx, [rsp + 0x67]
mov ecx, 0x31
call fcn.00440dc0
add rsp, 0x98
pop rbp
ret
mov eax, esi
mov ecx, 0x31
call fcn.00451500
mov eax, edi
mov ecx, 0x31
call fcn.00451500
nop
call fcn.0044f280
jmp fcn.0046d100
Function at 0x4706a0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x470786
push rbp
mov rbp, rsp
sub rsp, 0x38
movabs rdx, 0x601c61582e765d66
mov qword [rsp + 0x2b], rdx
movabs rdx, 0x746d63670e601c61
mov qword [rsp + 0x30], rdx
movabs rdx, 0x909050300090a01
mov qword [rsp + 0x19], rdx
movabs rdx, 0x4090905030009
mov qword [rsp + 0x1b], rdx
movabs rdx, 0x3000b0a08070506
mov qword [rsp + 0x23], rdx
xor eax, eax
nop
jmp 0x470720
movzx r9d, byte [rsp + rsi + 0x2b]
lea edx, [r9 + rdx]
lea edx, [rdx - 9]
mov byte [rsp + rdi + 0x2b], dl
mov byte [rsp + rsi + 0x2b], r8b
add rax, 2
nop dword [rax]
cmp rax, 0x12
jge 0x470752
movzx edx, byte [rsp + rax + 0x19]
movzx esi, byte [rsp + rax + 0x1a]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0xd
jae 0x470777
movzx r8d, byte [rsp + rdi + 0x2b]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 9]
cmp rsi, 0xd
jb 0x470702
jmp 0x47076b
xor eax, eax
lea rbx, [rsp + 0x2b]
mov ecx, 0xd
nop
call fcn.00440dc0
add rsp, 0x38
pop rbp
ret
mov eax, esi
mov ecx, 0xd
call fcn.00451500
mov eax, edi
mov ecx, 0xd
nop
call fcn.00451500
nop
call fcn.0044f280
jmp fcn.004706a0

Function at 0x475540
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x47565d
push rbp
mov rbp, rsp
sub rsp, 0x60
movabs rdx, 0x49403521cd6f9674
mov qword [rsp + 0x43], rdx
movabs rdx, 0x4a2cde6e37a919df
mov qword [rsp + 0x4b], rdx
movabs rdx, 0x5420f75d6c4a2cde
mov qword [rsp + 0x50], rdx
movabs rdx, 0xd865334332652047
mov qword [rsp + 0x58], rdx
movabs rdx, 0xd08121a03010404
mov qword [rsp + 0x1d], rdx
movabs rdx, 0xa0e03031a180d08
mov qword [rsp + 0x23], rdx
movabs rdx, 0x801090b0e050e0e
mov qword [rsp + 0x2b], rdx
movabs rdx, 0x1140711190b1c0f
mov qword [rsp + 0x33], rdx
movabs rdx, 0x170a05150f080606
mov qword [rsp + 0x3b], rdx
xor eax, eax
jmp 0x475600
movzx r9d, byte [rsp + rsi + 0x43]
sub r9d, edx
lea edx, [r9 + 0x4c]
mov byte [rsp + rdi + 0x43], dl
lea edx, [r8 + 0x4c]
mov byte [rsp + rsi + 0x43], dl
add rax, 2
nop word [rax + rax]
cmp rax, 0x26
jge 0x47562d
movzx edx, byte [rsp + rax + 0x1d]
movzx esi, byte [rsp + rax + 0x1e]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x1d
jae 0x475650
movzx r8d, byte [rsp + rdi + 0x43]
sub r8d, edx
cmp rsi, 0x1d
jb 0x4755dd
jmp 0x475644
xor eax, eax
lea rbx, [rsp + 0x43]
mov ecx, 0x1d
call fcn.00440dc0
add rsp, 0x60
pop rbp
ret
mov eax, esi
mov ecx, 0x1d
call fcn.00451500
mov eax, edi
mov ecx, 0x1d
call fcn.00451500
nop
nop dword [rax]
call fcn.0044f280
jmp fcn.00475540
Function at 0x475680
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x475738
push rbp
mov rbp, rsp
sub rsp, 0x30
movabs rdx, 0x43646fe0615a2f3a
mov qword [rsp + 0x28], rdx
movabs rdx, 0x401070100000101
mov qword [rsp + 0x1c], rdx
mov dword [rsp + 0x24], 0x2000100
xor eax, eax
jmp 0x4756d9
movzx r9d, byte [rsp + rsi + 0x28]
sub r9d, edx
lea edx, [r9 + 0x20]
mov byte [rsp + rdi + 0x28], dl
lea edx, [r8 + 0x20]
mov byte [rsp + rsi + 0x28], dl
add rax, 2
cmp rax, 0xc
jge 0x475708
movzx edx, byte [rsp + rax + 0x1c]
movzx esi, byte [rsp + rax + 0x1d]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 8
jae 0x47572b
movzx r8d, byte [rsp + rdi + 0x28]
sub r8d, edx
nop
cmp rsi, 8
jb 0x4756bc
jmp 0x47571f
xor eax, eax
lea rbx, [rsp + 0x28]
mov ecx, 8
call fcn.00440dc0
add rsp, 0x30
pop rbp
ret
mov eax, esi
mov ecx, 8
call fcn.00451500
mov eax, edi
mov ecx, 8
call fcn.00451500
nop
call fcn.0044f280
nop dword [rax]
jmp fcn.00475680

Function at 0x477b60
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x477c3d
push rbp
mov rbp, rsp
sub rsp, 0x40
movabs rdx, 0x9f55b0ac6d9b109b
mov qword [rsp + 0x31], rdx
movabs rdx, 0x4cd39ca57f0b6d9f
mov qword [rsp + 0x38], rdx
movabs rdx, 0xa01020d07090e
mov qword [rsp + 0x1b], rdx
movabs rdx, 0x206040c0200000a
mov qword [rsp + 0x21], rdx
movabs rdx, 0x70006070e07050b
mov qword [rsp + 0x29], rdx
xor eax, eax
nop
jmp 0x477be0
movzx r9d, byte [rsp + rsi + 0x31]
sub r9d, edx
lea edx, [r9 - 0x25]
mov byte [rsp + rdi + 0x31], dl
lea edx, [r8 - 0x25]
mov byte [rsp + rsi + 0x31], dl
add rax, 2
nop
cmp rax, 0x16
jge 0x477c0d
movzx edx, byte [rsp + rax + 0x1b]
movzx esi, byte [rsp + rax + 0x1c]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0xf
jae 0x477c30
movzx r8d, byte [rsp + rdi + 0x31]
sub r8d, edx
cmp rsi, 0xf
jb 0x477bc2
jmp 0x477c24
xor eax, eax
lea rbx, [rsp + 0x31]
mov ecx, 0xf
call fcn.00440dc0
add rsp, 0x40
pop rbp
ret
mov eax, esi
mov ecx, 0xf
call fcn.00451500
mov eax, edi
mov ecx, 0xf
call fcn.00451500
nop
nop dword [rax]
call fcn.0044f280
jmp fcn.00477b60