joyce8/EMBER2024-capa huggingface dataset:
Function at 0x42b320
Capabilities:
Access peb ldr_data

Disassembly:
lea r12, [rsp - 0x20]
cmp r12, qword [r14 + 0x10]
jbe 0x42b5d9
push rbp
mov rbp, rsp
sub rsp, 0x98
mov qword [rsp + 0x48], 0
mov rax, qword [sym.imp.kernel32.dll_DuplicateHandle]
lea rcx, [rsp + 0x48]
mov qword [rsp], rax
mov qword [rsp + 8], 0xffffffffffffffff
mov qword [rsp + 0x10], 0xfffffffffffffffe
mov qword [rsp + 0x18], 0xffffffffffffffff
mov qword [rsp + 0x20], rcx
movups xmmword [rsp + 0x28], xmm15
mov qword [rsp + 0x38], 2
call fcn.0042bb80
xorps xmm15, xmm15
mov r14, qword [0x0078d990]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x40], 0
nop
je 0x42b5b0
mov rax, qword [r14 + 0x30]
mov qword [rsp + 0x80], rax
test byte [rax], al
lea rcx, [rax + 0x310]
mov qword [rsp + 0x88], rcx
nop
mov rax, rcx
call fcn.004091e0
mov rcx, qword [rsp + 0x48]
mov rdx, qword [rsp + 0x80]
mov qword [rdx + 0x318], rcx
mov rax, qword [sym.imp.kernel32.dll_GetCurrentThreadId]
call fcn.0042b840
mov rcx, qword [rsp + 0x80]
mov qword [rcx + 0x48], rax
cmp qword [rcx + 0x330], 0
jne 0x42b469
cmp byte [0x0078d792], 0
je 0x42b469
mov rax, qword [sym.imp.kernel32.dll_CreateWaitableTimerExW]
mov qword [rsp], rax
movups xmmword [rsp + 8], xmm15
mov qword [rsp + 0x18], 2
mov qword [rsp + 0x20], 0x100003
call fcn.0042ba00
xorps xmm15, xmm15
mov r14, qword [0x0078d990]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x80]
mov qword [rcx + 0x330], rax
nop dword [rax]
test rax, rax
je 0x42b588
nop
nop
mov rax, qword [rsp + 0x88]
call fcn.00409400
movups xmmword [rsp + 0x50], xmm15
movups xmmword [rsp + 0x60], xmm15
movups xmmword [rsp + 0x70], xmm15
mov rcx, qword [sym.imp.kernel32.dll_VirtualQuery]
lea rdx, [rsp + 0x50]
mov qword [rsp], rcx
mov qword [rsp + 8], rdx
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], 0x30
call fcn.0042b980
xorps xmm15, xmm15
mov r14, qword [0x0078d990]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x20], 0
je 0x42b560
mov rcx, qword [rsp + 0x58]
lea rdx, [rcx + 0x4000]
mov qword [rsp + 0x90], r14
mov rsi, qword [r14 + 8]
cmp rsi, rdx
jb 0x42b541
sub rsi, rcx
add rsi, 0xffffffffffffc000
nop word [rax + rax]
cmp rsi, 0x4000000
ja 0x42b541
mov qword [r14], rdx
lea rax, [rcx + 0x53a0]
mov qword [r14 + 0x10], rax
mov qword [r14 + 0x18], rax
nop dword [rax + rax]
call fcn.00451340
xorps xmm15, xmm15
mov r14, qword [0x0078d990]
mov r14, qword gs:[r14]
mov r14, qword [r14]
add rsp, 0x98
pop rbp
nop
ret
mov rcx, qword [rsp + 0x90]
test byte [rcx], al
lea rax, [0x00543923]
mov ebx, 0xc
call fcn.0042e000
nop dword [rax]
call fcn.00452cc0
xorps xmm15, xmm15
mov r14, qword [0x0078d990]
mov r14, qword gs:[r14]
mov r14, qword [r14]
lea rax, [0x00545b3f]
mov ebx, 0x22
call fcn.0042e000
call fcn.00452cc0
xorps xmm15, xmm15
mov r14, qword [0x0078d990]
mov r14, qword gs:[r14]
mov r14, qword [r14]
lea rax, [0x00546e44]
mov ebx, 0x30
call fcn.0042e000
call fcn.00452cc0
xorps xmm15, xmm15
mov r14, qword [0x0078d990]
mov r14, qword gs:[r14]
mov r14, qword [r14]
lea rax, [0x00545f1f]
mov ebx, 0x25
call fcn.0042e000
nop
call fcn.0044f600
nop
jmp fcn.0042b320
Function at 0x43a780
Capabilities:
Encode data using base64

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x43a8e7
push rbp
mov rbp, rsp
sub rsp, 0x18
mov ecx, dword [rax + 0x190]
mov edx, dword [rax + 0x194]
mov rsi, qword [rax + 0x998]
mov edi, dword [rax + 0x194]
cmp edi, edx
jne 0x43a792
cmp edx, ecx
jne 0x43a8d5
nop word [rax + rax]
test rsi, rsi
jne 0x43a8d5
mov qword [rsp + 0x28], rax
test rbx, rbx
jne 0x43a7f4
nop
call fcn.004530e0
xorps xmm15, xmm15
mov r14, qword [0x0078d990]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rbx, qword [rsp]
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0x10], rbx
call fcn.0043a6a0
mov rcx, qword [rsp + 0x28]
mov edx, dword [rcx]
mov ebx, edx
sar edx, 0x1f
shr edx, 0x1b
add edx, ebx
mov esi, edx
and edx, 0xffffffe0
sub ebx, edx
test ebx, ebx
jl 0x43a8d0
mov rdx, qword [0x0073a078]
sar esi, 5
mov rax, rcx
mov ecx, ebx
mov edi, 1
shl edi, cl
movsxd rsi, esi
cmp ecx, 0x20
sbb r8d, r8d
and edi, r8d
cmp rdx, rsi
jbe 0x43a8c5
mov rcx, qword [0x0073a070]
lea rcx, [rcx + rsi*4]
lock or dword [rcx], edi
mov rcx, qword [0x0073abd0]
mov qword [rax + 8], rcx
mov rcx, rax
nop
mov qword [0x0073abd0], rax
nop
mov edx, 1
lea rsi, [0x0073abd8]
lock xadd dword [rsi], edx
mov rdx, qword [rcx + 0x1228]
shr rdx, 0x3d
test dl, dl
jne 0x43a8b3
mov rax, qword [rsp + 0x10]
movabs rdx, 0x1fffffffffffffff
and rdx, rax
bts rdx, 0x3f
nop
nop
xchg qword [rcx + 0x1228], rdx
add rsp, 0x18
pop rbp
ret
lea rax, [0x005463a6]
mov ebx, 0x28
nop
call fcn.0042e000
mov rax, rsi
mov rcx, rdx
call fcn.00451880
call fcn.0042ca60
lea rax, [0x00545cde]
mov ebx, 0x23
call fcn.0042e000
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.0044f600
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.0043a780
Function at 0x443b80
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x10
mov qword [rsp + 0x20], rax
test rbx, rbx
jbe 0x443cf7
movzx edx, byte [rax]
test edx, edx
jne 0x443bb4
nop dword [rax]
test r8b, r8b
jne 0x443bb4
xor eax, eax
xor ebx, ebx
mov rcx, rbx
xor edi, edi
add rsp, 0x10
pop rbp
ret
bt edx, 7
jae 0x443bc7
xor edx, edx
xor r8d, r8d
xor r9d, r9d
jmp 0x443cb7
mov r8d, 1
mov r9d, edx
and edx, 1
neg edx
shr r9d, 1
xor edx, r9d
add dword [rsi], edx
nop dword [rax]
cmp rbx, r8
jb 0x443ca5
sub rbx, r8
sub rcx, r8
mov rdx, rcx
neg rdx
sar rdx, 0x3f
and r8, rdx
lea rdx, [rax + r8]
test rbx, rbx
jbe 0x443c97
movzx esi, byte [rax + r8]
bt esi, 7
jae 0x443c1d
xor eax, eax
xor esi, esi
xor r8d, r8d
jmp 0x443c60
mov eax, 1
cmp rax, rbx
ja 0x443c4b
add qword [rdi], rsi
sub rcx, rax
sub rbx, rax
mov rsi, rcx
neg rsi
sar rsi, 0x3f
and rax, rsi
add rax, rdx
mov edi, 1
add rsp, 0x10
pop rbp
ret
mov rcx, rbx
call fcn.00451940
lea r8d, [rcx + 7]
mov rcx, r11
mov eax, r12d
nop dword [rax]
cmp rax, rbx
jae 0x443c8f
movzx r9d, byte [rax + rdx]
mov r10d, r9d
and r9d, 0x7f
mov r11, rcx
mov ecx, r8d
shl r9d, cl
lea r12d, [rax + 1]
or esi, r9d
test r10b, 0x80
jne 0x443c53
mov rcx, r11
mov eax, r12d
jmp 0x443c22
mov rcx, rbx
call fcn.00451880
xor eax, eax
mov rcx, rax
nop dword [rax]
call fcn.00451880
mov eax, r8d
mov rcx, rbx
call fcn.00451940
lea r9d, [rcx + 7]
mov rcx, r12
cmp rbx, rdx
jbe 0x443ced
movzx r10d, byte [rdx + rax]
mov r11d, r10d
and r10d, 0x7f
mov r12, rcx
mov ecx, r9d
shl r10d, cl
inc edx
or r8d, r10d
test r11b, 0x80
jne 0x443cb0
mov rcx, r12
mov r9d, edx
mov edx, r8d
mov r8d, r9d
jmp 0x443bcd
mov eax, edx
mov rcx, rbx
call fcn.00451880
xor eax, eax
mov rcx, rax
nop dword [rax]
call fcn.00451880
nop
int3

Function at 0x4492a0
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x44934f
push rbp
mov rbp, rsp
sub rsp, 0x58
mov qword [rsp + 0x70], rbx
lea rdx, [rsp + 0x68]
mov qword [rsp + 8], 0
movups xmmword [rsp + 0x10], xmm15
movups xmmword [rsp + 0x18], xmm15
movups xmmword [rsp + 0x28], xmm15
movups xmmword [rsp + 0x38], xmm15
movups xmmword [rsp + 0x48], xmm15
lea rsi, [0x004493a0]
mov qword [rsp + 0x10], rsi
mov rsi, qword [rsp + 0x60]
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdx
mov rdx, r14
mov qword [rsp + 0x28], rdx
lea rdx, [rsp + 8]
mov qword [rsp + 0x30], rdx
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x48], rcx
mov qword [rsp + 0x50], rdi
lea rax, [rsp + 0x10]
mov qword [rsp], rax
call fcn.0044f4c0
xorps xmm15, xmm15
mov r14, qword [0x0078d990]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 8]
add rsp, 0x58
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
call fcn.0044f600
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
nop dword [rax]
jmp fcn.004492a0
Function at 0x4513e0
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x403143
push rbp
mov rbp, rsp
sub rsp, 0x18
mov rdx, qword [rax]
mov rcx, qword [rax + 8]
mov rax, rdx
call fcn.00407be0
add rsp, 0x18
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.0044f600
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp 0x403120
cmp byte [0x0078d78a], 0
je 0x4513f5
mov rcx, qword [rax + 8]
mov rax, qword [rax]
jmp 0x44e640
jmp 0x403120

Function at 0x451400
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
nop
mov eax, dword [rax]
movabs rcx, 0xe7037ed1a0b428db
xor rcx, rax
xor rax, rbx
xor rax, qword [0x0078da40]
movabs rdx, 0xa0761d6478bd642f
xor rdx, rax
mov rax, rcx
mul rdx
xor rax, rdx
mov rcx, rax
movabs rax, 0x1d8e4e27c47d124b
mul rcx
xor rax, rdx
nop
nop
ret
cmp byte [0x0078d78a], 0
je 0x451435
movq xmm0, rbx
pinsrd xmm0, dword [rax], 2
aesenc xmm0, xmmword [0x0078dd60]
aesenc xmm0, xmmword [0x0078dd70]
aesenc xmm0, xmmword [0x0078dd80]
movq rax, xmm0
ret
jmp 0x407e00

Function at 0x451440
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
nop
mov rax, qword [rax]
movabs rcx, 0xe7037ed1a0b428db
xor rcx, rax
xor rax, rbx
xor rax, qword [0x0078da40]
movabs rdx, 0xa0761d6478bd642f
xor rdx, rax
mov rax, rcx
mul rdx
xor rax, rdx
mov rcx, rax
movabs rax, 0x1d8e4e27c47d1247
mul rcx
xor rax, rdx
nop
nop
ret
cmp byte [0x0078d78a], 0
je 0x451476
movq xmm0, rbx
pinsrq xmm0, qword [rax], 1
aesenc xmm0, xmmword [0x0078dd60]
aesenc xmm0, xmmword [0x0078dd70]
aesenc xmm0, xmmword [0x0078dd80]
movq rax, xmm0
ret
jmp 0x407e60

Function at 0x453140
Capabilities:
Allocate thread local storage

Disassembly:
push rbp
mov rbp, rsp
mov rax, rsp
and rsp, 0xfffffffffffffff0
sub rsp, 0x30
mov qword [rsp + 0x20], rax
mov rax, qword [sym.imp.kernel32.dll_TlsAlloc]
call rax
mov rsp, qword [rsp + 0x20]
mov rcx, rax
cmp rcx, 0x40
jb 0x453174
mov rcx, 0x28
jmp 0x45317f
shl rcx, 3
add rcx, 0x1480
mov qword [0x0078d990], rcx
pop rbp
ret
Function at 0x457060
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x45717d
push rbp
mov rbp, rsp
sub rsp, 0x60
movabs rdx, 0xa5dd637b6cdcc790
mov qword [rsp + 0x1e], rdx
movabs rdx, 0x666fcad3e5d5c5e2
mov qword [rsp + 0x26], rdx
movabs rdx, 0x6c61cded7b20666f
mov qword [rsp + 0x2c], rdx
movabs rdx, 0x20604ce274bfda69
mov qword [rsp + 0x34], rdx
movabs rdx, 0x11301000d04021b
mov qword [rsp + 0x3c], rdx
movabs rdx, 0x1c0a111101130100
mov qword [rsp + 0x40], rdx
movabs rdx, 0x17041108090b1302
mov qword [rsp + 0x48], rdx
movabs rdx, 0xf0c170607180809
mov qword [rsp + 0x50], rdx
movabs rdx, 0xc1b060a061b1a12
mov qword [rsp + 0x58], rdx
xor eax, eax
jmp 0x457120
movzx r9d, byte [rsp + rsi + 0x1e]
sub r9d, edx
lea edx, [r9 - 0x50]
mov byte [rsp + rdi + 0x1e], dl
lea edx, [r8 - 0x50]
mov byte [rsp + rsi + 0x1e], dl
add rax, 2
nop word [rax + rax]
cmp rax, 0x24
jge 0x45714d
movzx edx, byte [rsp + rax + 0x3c]
movzx esi, byte [rsp + rax + 0x3d]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x1e
jae 0x457170
movzx r8d, byte [rsp + rdi + 0x1e]
sub r8d, edx
cmp rsi, 0x1e
jb 0x4570fd
jmp 0x457164
xor eax, eax
lea rbx, [rsp + 0x1e]
mov ecx, 0x1e
call fcn.00441380
add rsp, 0x60
pop rbp
ret
mov eax, esi
mov ecx, 0x1e
call fcn.00451880
mov eax, edi
mov ecx, 0x1e
call fcn.00451880
nop
nop dword [rax]
call fcn.0044f600
jmp fcn.00457060
Function at 0x45ac60
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x45ad46
push rbp
mov rbp, rsp
sub rsp, 0x38
movabs rdx, 0x3e484e052e584969
mov qword [rsp + 0x18], rdx
movabs rdx, 0x5861270633583e48
mov qword [rsp + 0x1e], rdx
movabs rdx, 0x4070d0b0a080a07
mov qword [rsp + 0x26], rdx
movabs rdx, 0x40304070d0b0a08
mov qword [rsp + 0x28], rdx
movabs rdx, 0x609040d02020501
mov qword [rsp + 0x30], rdx
xor eax, eax
nop
jmp 0x45ace0
movzx r9d, byte [rsp + rsi + 0x18]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x12]
mov byte [rsp + rdi + 0x18], dl
mov byte [rsp + rsi + 0x18], r8b
add rax, 2
nop dword [rax]
cmp rax, 0x12
jge 0x45ad12
movzx edx, byte [rsp + rax + 0x26]
movzx esi, byte [rsp + rax + 0x27]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0xe
jae 0x45ad37
movzx r8d, byte [rsp + rdi + 0x18]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x12]
cmp rsi, 0xe
jb 0x45acc2
jmp 0x45ad2b
xor eax, eax
lea rbx, [rsp + 0x18]
mov ecx, 0xe
nop
call fcn.00441380
add rsp, 0x38
pop rbp
ret
mov eax, esi
mov ecx, 0xe
call fcn.00451880
mov eax, edi
mov ecx, 0xe
nop
call fcn.00451880
nop
call fcn.0044f600
jmp fcn.0045ac60

Function at 0x45cde0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x45ceca
push rbp
mov rbp, rsp
sub rsp, 0x48
movabs rdx, 0xde301e35e6ff3403
mov qword [rsp + 0x1d], rdx
movabs rdx, 0x390005de301e35e6
mov qword [rsp + 0x20], rdx
movabs rdx, 0x21100f0f32da1f24
mov qword [rsp + 0x28], rdx
movabs rdx, 0x900070f03000d02
mov qword [rsp + 0x30], rdx
movabs rdx, 0x101108020f110b12
mov qword [rsp + 0x38], rdx
movabs rdx, 0xf0c020508080d00
mov qword [rsp + 0x40], rdx
xor eax, eax
jmp 0x45ce6d
movzx r9d, byte [rsp + rsi + 0x1d]
sub r9d, edx
lea edx, [r9 + 0x32]
mov byte [rsp + rdi + 0x1d], dl
lea edx, [r8 + 0x32]
mov byte [rsp + rsi + 0x1d], dl
add rax, 2
cmp rax, 0x18
jge 0x45ce9a
movzx edx, byte [rsp + rax + 0x30]
movzx esi, byte [rsp + rax + 0x31]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x13
jae 0x45cebd
movzx r8d, byte [rsp + rdi + 0x1d]
sub r8d, edx
cmp rsi, 0x13
jb 0x45ce50
jmp 0x45ceb1
xor eax, eax
lea rbx, [rsp + 0x1d]
mov ecx, 0x13
call fcn.00441380
add rsp, 0x48
pop rbp
ret
mov eax, esi
mov ecx, 0x13
call fcn.00451880
mov eax, edi
mov ecx, 0x13
call fcn.00451880
nop
call fcn.0044f600
jmp fcn.0045cde0
Function at 0x45f400
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x45f527
push rbp
mov rbp, rsp
sub rsp, 0x60
movabs rdx, 0x9033843732357586
mov qword [rsp + 0x18], rdx
movabs rdx, 0xe88b903384373235
mov qword [rsp + 0x1a], rdx
movabs rdx, 0x957d86e7fbe530fd
mov qword [rsp + 0x22], rdx
movabs rdx, 0xd4df7f78353a3380
mov qword [rsp + 0x2a], rdx
movabs rdx, 0x35d8363083764133
mov qword [rsp + 0x32], rdx
movabs rdx, 0x20200c0d0d100f
mov qword [rsp + 0x3a], rdx
movabs rdx, 0x1408010c1c160020
mov qword [rsp + 0x40], rdx
movabs rdx, 0x191205080d1d171b
mov qword [rsp + 0x48], rdx
movabs rdx, 0x70918110e111d1d
mov qword [rsp + 0x50], rdx
movabs rdx, 0x12110a050717170a
mov qword [rsp + 0x58], rdx
xor eax, eax
jmp 0x45f4c9
movzx r9d, byte [rsp + rsi + 0x18]
sub r9d, edx
lea edx, [r9 - 0x2e]
mov byte [rsp + rdi + 0x18], dl
lea edx, [r8 - 0x2e]
mov byte [rsp + rsi + 0x18], dl
add rax, 2
cmp rax, 0x26
jge 0x45f4f7
movzx edx, byte [rsp + rax + 0x3a]
movzx esi, byte [rsp + rax + 0x3b]
mov edi, edx
xor edx, esi
add edx, eax
nop
cmp rdi, 0x22
jae 0x45f51a
movzx r8d, byte [rsp + rdi + 0x18]
sub r8d, edx
cmp rsi, 0x22
jb 0x45f4ac
jmp 0x45f50e
xor eax, eax
lea rbx, [rsp + 0x18]
mov ecx, 0x22
call fcn.00441380
add rsp, 0x60
pop rbp
ret
mov eax, esi
mov ecx, 0x22
call fcn.00451880
mov eax, edi
mov ecx, 0x22
call fcn.00451880
nop
call fcn.0044f600
jmp fcn.0045f400
Function at 0x460960
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x460a98
push rbp
mov rbp, rsp
sub rsp, 0x68
movabs rdx, 0x30fe873230317f31
mov qword [rsp + 0x18], rdx
movabs rdx, 0xd10b07ec340730fe
mov qword [rsp + 0x1e], rdx
movabs rdx, 0x1c32b59834e7190f
mov qword [rsp + 0x26], rdx
movabs rdx, 0xe1fe9ae136f5e619
mov qword [rsp + 0x2e], rdx
movabs rdx, 0x102031333032fbe4
mov qword [rsp + 0x36], rdx
movabs rdx, 0x10a13171a061205
mov qword [rsp + 0x3e], rdx
movabs rdx, 0x16241e05050a1010
mov qword [rsp + 0x46], rdx
movabs rdx, 0x121b16241e05050a
mov qword [rsp + 0x48], rdx
movabs rdx, 0xe1b1d1725051c0d
mov qword [rsp + 0x50], rdx
movabs rdx, 0x6181f1c121c170a
mov qword [rsp + 0x58], rdx
movabs rdx, 0x80b240e0c06150f
mov qword [rsp + 0x60], rdx
xor eax, eax
jmp 0x460a38
movzx r9d, byte [rsp + rsi + 0x18]
sub r9d, edx
lea edx, [r9 + 0x56]
mov byte [rsp + rdi + 0x18], dl
lea edx, [r8 + 0x56]
mov byte [rsp + rsi + 0x18], dl
add rax, 2
cmp rax, 0x2a
jge 0x460a68
movzx edx, byte [rsp + rax + 0x3e]
movzx esi, byte [rsp + rax + 0x3f]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x26
jae 0x460a8b
movzx r8d, byte [rsp + rdi + 0x18]
sub r8d, edx
nop dword [rax]
cmp rsi, 0x26
jb 0x460a1b
jmp 0x460a7f
xor eax, eax
lea rbx, [rsp + 0x18]
mov ecx, 0x26
call fcn.00441380
add rsp, 0x68
pop rbp
ret
mov eax, esi
mov ecx, 0x26
call fcn.00451880
mov eax, edi
mov ecx, 0x26
call fcn.00451880
nop
call fcn.0044f600
nop dword [rax]
jmp fcn.00460960
Function at 0x4681a0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
lea r12, [rsp - 8]
cmp r12, qword [r14 + 0x10]
jbe 0x46830c
push rbp
mov rbp, rsp
add rsp, 0xffffffffffffff80
movabs rdx, 0xae729b6f577fc327
mov qword [rsp + 0x1d], rdx
movabs rdx, 0x6ceadcdf6ce969f9
mov qword [rsp + 0x25], rdx
movabs rdx, 0x26ceadcdf6ce969
mov qword [rsp + 0x26], rdx
movabs rdx, 0x88076465f970eda3
mov qword [rsp + 0x2e], rdx
movabs rdx, 0x81b3f26bd24690db
mov qword [rsp + 0x36], rdx
movabs rdx, 0xd5a585c3203cee49
mov qword [rsp + 0x3e], rdx
movabs rdx, 0x17190e1e15112822
mov qword [rsp + 0x46], rdx
movabs rdx, 0x52810171d141514
mov qword [rsp + 0x4e], rdx
movabs rdx, 0x1903052810171d14
mov qword [rsp + 0x50], rdx
movabs rdx, 0x141f121c00141525
mov qword [rsp + 0x58], rdx
movabs rdx, 0x1080c0a171511
mov qword [rsp + 0x60], rdx
movabs rdx, 0x260d1c0c171e0d19
mov qword [rsp + 0x68], rdx
movabs rdx, 0x51a201227262308
mov qword [rsp + 0x70], rdx
movabs rdx, 0x706021f0e181519
mov qword [rsp + 0x78], rdx
xor eax, eax
jmp 0x4682a7
movzx r9d, byte [rsp + rsi + 0x1d]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x71]
mov byte [rsp + rdi + 0x1d], dl
mov byte [rsp + rsi + 0x1d], r8b
add rax, 2
cmp rax, 0x3a
jge 0x4682dc
movzx edx, byte [rsp + rax + 0x46]
movzx esi, byte [rsp + rax + 0x47]
mov edi, edx
xor edx, esi
add edx, eax
nop dword [rax]
cmp rdi, 0x29
jae 0x4682ff
movzx r8d, byte [rsp + rdi + 0x1d]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x71]
cmp rsi, 0x29
jb 0x46828d
jmp 0x4682f3
xor eax, eax
lea rbx, [rsp + 0x1d]
mov ecx, 0x29
call fcn.00441380
sub rsp, 0xffffffffffffff80
pop rbp
ret
mov eax, esi
mov ecx, 0x29
call fcn.00451880
mov eax, edi
mov ecx, 0x29
call fcn.00451880
nop
call fcn.0044f600
jmp fcn.004681a0

Function at 0x46d140
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x46d25d
push rbp
mov rbp, rsp
sub rsp, 0x58
movabs rdx, 0x6e75201c63d47973
mov qword [rsp + 0x18], rdx
movabs rdx, 0x2066c520b8db42d9
mov qword [rsp + 0x20], rdx
movabs rdx, 0xe4cce355de752066
mov qword [rsp + 0x26], rdx
movabs rdx, 0x78bab8bdd1427694
mov qword [rsp + 0x2e], rdx
movabs rdx, 0x161c1a1418171a13
mov qword [rsp + 0x36], rdx
movabs rdx, 0x412161c1a141817
mov qword [rsp + 0x38], rdx
movabs rdx, 0xd1408121c020b12
mov qword [rsp + 0x40], rdx
movabs rdx, 0x90d15080b11140b
mov qword [rsp + 0x48], rdx
movabs rdx, 0xa020d1719141b04
mov qword [rsp + 0x50], rdx
xor eax, eax
jmp 0x46d200
movzx r9d, byte [rsp + rsi + 0x18]
sub r9d, edx
lea edx, [r9 - 0x45]
mov byte [rsp + rdi + 0x18], dl
lea edx, [r8 - 0x45]
mov byte [rsp + rsi + 0x18], dl
add rax, 2
nop word [rax + rax]
cmp rax, 0x22
jge 0x46d22d
movzx edx, byte [rsp + rax + 0x36]
movzx esi, byte [rsp + rax + 0x37]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x1e
jae 0x46d250
movzx r8d, byte [rsp + rdi + 0x18]
sub r8d, edx
cmp rsi, 0x1e
jb 0x46d1dd
jmp 0x46d244
xor eax, eax
lea rbx, [rsp + 0x18]
mov ecx, 0x1e
call fcn.00441380
add rsp, 0x58
pop rbp
ret
mov eax, esi
mov ecx, 0x1e
call fcn.00451880
mov eax, edi
mov ecx, 0x1e
call fcn.00451880
nop
nop dword [rax]
call fcn.0044f600
jmp fcn.0046d140
Function at 0x46e8e0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x46e992
push rbp
mov rbp, rsp
sub rsp, 0x28
movabs rdx, 0x652d656e425f495e
mov qword [rsp + 0x20], rdx
movabs rdx, 0x201030306000301
mov qword [rsp + 0x18], rdx
xor eax, eax
jmp 0x46e92e
movzx r9d, byte [rsp + rsi + 0x20]
lea edx, [r9 + rdx]
lea edx, [rdx + 0xd]
mov byte [rsp + rdi + 0x20], dl
mov byte [rsp + rsi + 0x20], r8b
add rax, 2
cmp rax, 8
jge 0x46e962
movzx edx, byte [rsp + rax + 0x18]
movzx esi, byte [rsp + rax + 0x19]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 8
jae 0x46e985
movzx r8d, byte [rsp + rdi + 0x20]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0xd]
cmp rsi, 8
jb 0x46e914
nop
jmp 0x46e979
xor eax, eax
lea rbx, [rsp + 0x20]
mov ecx, 8
call fcn.00441380
add rsp, 0x28
pop rbp
ret
mov eax, esi
mov ecx, 8
call fcn.00451880
mov eax, edi
mov ecx, 8
call fcn.00451880
nop
call fcn.0044f600
jmp fcn.0046e8e0

Function at 0x46f340
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x46f406
push rbp
mov rbp, rsp
sub rsp, 0x30
movabs rdx, 0xced1cb3a38d2d143
mov qword [rsp + 0x1d], rdx
mov byte [rsp + 0x25], 0xc4
movabs rdx, 0x602040708050307
mov qword [rsp + 0x26], rdx
mov word [rsp + 0x2e], 0x107
xor eax, eax
nop
jmp 0x46f3a0
movzx r9d, byte [rsp + rsi + 0x1d]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x6d]
mov byte [rsp + rdi + 0x1d], dl
mov byte [rsp + rsi + 0x1d], r8b
add rax, 2
nop dword [rax]
cmp rax, 0xa
jge 0x46f3d2
movzx edx, byte [rsp + rax + 0x26]
movzx esi, byte [rsp + rax + 0x27]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 9
jae 0x46f3f7
movzx r8d, byte [rsp + rdi + 0x1d]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x6d]
cmp rsi, 9
jb 0x46f382
jmp 0x46f3eb
xor eax, eax
lea rbx, [rsp + 0x1d]
mov ecx, 9
nop
call fcn.00441380
add rsp, 0x30
pop rbp
ret
mov eax, esi
mov ecx, 9
call fcn.00451880
mov eax, edi
mov ecx, 9
nop
call fcn.00451880
nop
call fcn.0044f600
jmp fcn.0046f340

Function at 0x46fce0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x46fd92
push rbp
mov rbp, rsp
sub rsp, 0x28
movabs rdx, 0x6ec3cfeeb870c428
mov qword [rsp + 0x20], rdx
movabs rdx, 0x105010003060401
mov qword [rsp + 0x18], rdx
xor eax, eax
jmp 0x46fd31
movzx r9d, byte [rsp + rsi + 0x20]
sub r9d, edx
lea edx, [r9 - 0x50]
mov byte [rsp + rdi + 0x20], dl
lea edx, [r8 - 0x50]
mov byte [rsp + rsi + 0x20], dl
add rax, 2
cmp rax, 8
jge 0x46fd5e
movzx edx, byte [rsp + rax + 0x18]
movzx esi, byte [rsp + rax + 0x19]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 8
jae 0x46fd85
movzx r8d, byte [rsp + rdi + 0x20]
sub r8d, edx
cmp rsi, 8
jb 0x46fd14
jmp 0x46fd75
xor eax, eax
lea rbx, [rsp + 0x20]
mov ecx, 8
call fcn.00441380
add rsp, 0x28
pop rbp
ret
mov eax, esi
mov ecx, 8
nop dword [rax]
call fcn.00451880
mov eax, edi
mov ecx, 8
call fcn.00451880
nop
call fcn.0044f600
jmp fcn.0046fce0