joyce8/EMBER2024-capa huggingface dataset:
Function at 0x448880
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x10
mov qword [rsp + 0x20], rax
test rbx, rbx
jbe 0x4489f7
movzx edx, byte [rax]
test edx, edx
jne 0x4488b4
nop dword [rax]
test r8b, r8b
jne 0x4488b4
xor eax, eax
xor ebx, ebx
mov rcx, rbx
xor edi, edi
add rsp, 0x10
pop rbp
ret
bt edx, 7
jae 0x4488c7
xor edx, edx
xor r8d, r8d
xor r9d, r9d
jmp 0x4489b7
mov r8d, 1
mov r9d, edx
and edx, 1
neg edx
shr r9d, 1
xor edx, r9d
add dword [rsi], edx
nop dword [rax]
cmp rbx, r8
jb 0x4489a5
sub rbx, r8
sub rcx, r8
mov rdx, rcx
neg rdx
sar rdx, 0x3f
and r8, rdx
lea rdx, [rax + r8]
test rbx, rbx
jbe 0x448997
movzx esi, byte [rax + r8]
bt esi, 7
jae 0x44891d
xor eax, eax
xor esi, esi
xor r8d, r8d
jmp 0x448960
mov eax, 1
cmp rax, rbx
ja 0x44894b
add qword [rdi], rsi
sub rcx, rax
sub rbx, rax
mov rsi, rcx
neg rsi
sar rsi, 0x3f
and rax, rsi
add rax, rdx
mov edi, 1
add rsp, 0x10
pop rbp
ret
mov rcx, rbx
call fcn.00457f60
lea r8d, [rcx + 7]
mov rcx, r11
mov eax, r12d
nop dword [rax]
cmp rax, rbx
jae 0x44898f
movzx r9d, byte [rax + rdx]
mov r10d, r9d
and r9d, 0x7f
mov r11, rcx
mov ecx, r8d
shl r9d, cl
lea r12d, [rax + 1]
or esi, r9d
test r10b, 0x80
jne 0x448953
mov rcx, r11
mov eax, r12d
jmp 0x448922
mov rcx, rbx
call fcn.00457ea0
xor eax, eax
mov rcx, rax
nop dword [rax]
call fcn.00457ea0
mov eax, r8d
mov rcx, rbx
call fcn.00457f60
lea r9d, [rcx + 7]
mov rcx, r12
cmp rbx, rdx
jbe 0x4489ed
movzx r10d, byte [rdx + rax]
mov r11d, r10d
and r10d, 0x7f
mov r12, rcx
mov ecx, r9d
shl r10d, cl
inc edx
or r8d, r10d
test r11b, 0x80
jne 0x4489b0
mov rcx, r12
mov r9d, edx
mov edx, r8d
mov r8d, r9d
jmp 0x4488cd
mov eax, edx
mov rcx, rbx
call fcn.00457ea0
xor eax, eax
mov rcx, rax
nop dword [rax]
call fcn.00457ea0
nop
int3

Function at 0x44e3e0
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x44e48f
push rbp
mov rbp, rsp
sub rsp, 0x58
mov qword [rsp + 0x70], rbx
lea rdx, [rsp + 0x68]
mov qword [rsp + 8], 0
movups xmmword [rsp + 0x10], xmm15
movups xmmword [rsp + 0x18], xmm15
movups xmmword [rsp + 0x28], xmm15
movups xmmword [rsp + 0x38], xmm15
movups xmmword [rsp + 0x48], xmm15
lea rsi, [0x0044e4e0]
mov qword [rsp + 0x10], rsi
mov rsi, qword [rsp + 0x60]
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdx
mov rdx, r14
mov qword [rsp + 0x28], rdx
lea rdx, [rsp + 8]
mov qword [rsp + 0x30], rdx
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x48], rcx
mov qword [rsp + 0x50], rdi
lea rax, [rsp + 0x10]
mov qword [rsp], rax
call fcn.00455ae0
xorps xmm15, xmm15
mov r14, qword [0x006b3ec0]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 8]
add rsp, 0x58
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
call fcn.00455c20
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
nop dword [rax]
jmp fcn.0044e3e0
Function at 0x457a00
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x403bc3
push rbp
mov rbp, rsp
sub rsp, 0x18
mov rdx, qword [rax]
mov rcx, qword [rax + 8]
mov rax, rdx
call fcn.00408500
add rsp, 0x18
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.00455c20
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp 0x403ba0
cmp byte [0x006b3caa], 0
je 0x457a15
mov rcx, qword [rax + 8]
mov rax, qword [rax]
jmp 0x454c60
jmp 0x403ba0

Function at 0x457a20
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
nop
mov eax, dword [rax]
movabs rcx, 0xe7037ed1a0b428db
xor rcx, rax
xor rax, rbx
xor rax, qword [0x006b3fa0]
movabs rdx, 0xa0761d6478bd642f
xor rdx, rax
mov rax, rcx
mul rdx
xor rax, rdx
mov rcx, rax
movabs rax, 0x1d8e4e27c47d124b
mul rcx
xor rax, rdx
nop
nop
ret
cmp byte [0x006b3caa], 0
je 0x457a55
movq xmm0, rbx
pinsrd xmm0, dword [rax], 2
aesenc xmm0, xmmword [0x006b42c0]
aesenc xmm0, xmmword [0x006b42d0]
aesenc xmm0, xmmword [0x006b42e0]
movq rax, xmm0
ret
jmp 0x408720

Function at 0x457a60
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
nop
mov rax, qword [rax]
movabs rcx, 0xe7037ed1a0b428db
xor rcx, rax
xor rax, rbx
xor rax, qword [0x006b3fa0]
movabs rdx, 0xa0761d6478bd642f
xor rdx, rax
mov rax, rcx
mul rdx
xor rax, rdx
mov rcx, rax
movabs rax, 0x1d8e4e27c47d1247
mul rcx
xor rax, rdx
nop
nop
ret
cmp byte [0x006b3caa], 0
je 0x457a96
movq xmm0, rbx
pinsrq xmm0, qword [rax], 1
aesenc xmm0, xmmword [0x006b42c0]
aesenc xmm0, xmmword [0x006b42d0]
aesenc xmm0, xmmword [0x006b42e0]
movq rax, xmm0
ret
jmp 0x408780

Function at 0x459780
Capabilities:
Allocate thread local storage

Disassembly:
push rbp
mov rbp, rsp
mov rax, rsp
and rsp, 0xfffffffffffffff0
sub rsp, 0x30
mov qword [rsp + 0x20], rax
mov rax, qword [sym.imp.kernel32.dll_TlsAlloc]
call rax
mov rsp, qword [rsp + 0x20]
mov rcx, rax
cmp rcx, 0x40
jb 0x4597b4
mov rcx, 0x28
jmp 0x4597bf
shl rcx, 3
add rcx, 0x1480
mov qword [0x006b3ec0], rcx
pop rbp
ret
Function at 0x4612c0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
lea r12, [rsp - 0x10]
cmp r12, qword [r14 + 0x10]
jbe 0x461432
push rbp
mov rbp, rsp
sub rsp, 0x88
movabs rdx, 0x816c8d69746a8197
mov qword [rsp + 0x1f], rdx
movabs rdx, 0xf263258d5f7d4c4a
mov qword [rsp + 0x27], rdx
movabs rdx, 0x73616cf263258d5f
mov qword [rsp + 0x2a], rdx
movabs rdx, 0x9f6e72907c41565d
mov qword [rsp + 0x32], rdx
movabs rdx, 0x5cf77449647ff183
mov qword [rsp + 0x3a], rdx
movabs rdx, 0x8e22664b5a386714
mov qword [rsp + 0x42], rdx
movabs rdx, 0x80f272614292327
mov qword [rsp + 0x4a], rdx
movabs rdx, 0x21250d280522221c
mov qword [rsp + 0x52], rdx
movabs rdx, 0x5151c1f17222125
mov qword [rsp + 0x58], rdx
movabs rdx, 0x131529282616240f
mov qword [rsp + 0x60], rdx
movabs rdx, 0x50b1111140d021b
mov qword [rsp + 0x68], rdx
movabs rdx, 0x262a230c1f051727
mov qword [rsp + 0x70], rdx
movabs rdx, 0xa15220026011502
mov qword [rsp + 0x78], rdx
movabs rdx, 0x9221107291a291d
mov qword [rsp + 0x80], rdx
xor eax, eax
jmp 0x4613d0
movzx r9d, byte [rsp + rsi + 0x1f]
sub r9d, edx
lea edx, [r9 + 0x3b]
mov byte [rsp + rdi + 0x1f], dl
lea edx, [r8 + 0x3b]
mov byte [rsp + rsi + 0x1f], dl
add rax, 2
cmp rax, 0x3e
jge 0x4613fd
movzx edx, byte [rsp + rax + 0x4a]
movzx esi, byte [rsp + rax + 0x4b]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x2b
jae 0x461425
movzx r8d, byte [rsp + rdi + 0x1f]
sub r8d, edx
cmp rsi, 0x2b
jb 0x4613b3
jmp 0x461417
xor eax, eax
lea rbx, [rsp + 0x1f]
mov ecx, 0x2b
call fcn.00445b60
add rsp, 0x88
pop rbp
ret
mov eax, esi
mov ecx, 0x2b
nop
call fcn.00457ea0
mov eax, edi
mov ecx, 0x2b
call fcn.00457ea0
nop
call fcn.00455c20
jmp fcn.004612c0

Function at 0x461900
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4619ea
push rbp
mov rbp, rsp
sub rsp, 0x48
movabs rdx, 0x64170c20fe110e53
mov qword [rsp + 0x1e], rdx
movabs rdx, 0x696c614a64170c20
mov qword [rsp + 0x22], rdx
movabs rdx, 0x156503ca13ddc40a
mov qword [rsp + 0x2a], rdx
movabs rdx, 0x70c08010d100211
mov qword [rsp + 0x32], rdx
movabs rdx, 0x3011304130f070c
mov qword [rsp + 0x38], rdx
movabs rdx, 0x50c030e06100e04
mov qword [rsp + 0x40], rdx
xor eax, eax
jmp 0x46198d
movzx r9d, byte [rsp + rsi + 0x1e]
sub r9d, edx
lea edx, [r9 + 0x75]
mov byte [rsp + rdi + 0x1e], dl
lea edx, [r8 + 0x75]
mov byte [rsp + rsi + 0x1e], dl
add rax, 2
cmp rax, 0x16
jge 0x4619ba
movzx edx, byte [rsp + rax + 0x32]
movzx esi, byte [rsp + rax + 0x33]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x14
jae 0x4619dd
movzx r8d, byte [rsp + rdi + 0x1e]
sub r8d, edx
cmp rsi, 0x14
jb 0x461970
jmp 0x4619d1
xor eax, eax
lea rbx, [rsp + 0x1e]
mov ecx, 0x14
call fcn.00445b60
add rsp, 0x48
pop rbp
ret
mov eax, esi
mov ecx, 0x14
call fcn.00457ea0
mov eax, edi
mov ecx, 0x14
call fcn.00457ea0
nop
call fcn.00455c20
jmp fcn.00461900
Function at 0x463c20
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x463ce6
push rbp
mov rbp, rsp
sub rsp, 0x30
movabs rdx, 0x5cb7f7b32373b242
mov qword [rsp + 0x1b], rdx
mov byte [rsp + 0x23], 1
movabs rdx, 0x607050807030703
mov qword [rsp + 0x24], rdx
mov dword [rsp + 0x2c], 0x8010504
xor eax, eax
nop
jmp 0x463c80
movzx r9d, byte [rsp + rsi + 0x1b]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x5d]
mov byte [rsp + rdi + 0x1b], dl
mov byte [rsp + rsi + 0x1b], r8b
add rax, 2
nop dword [rax]
cmp rax, 0xc
jge 0x463cb2
movzx edx, byte [rsp + rax + 0x24]
movzx esi, byte [rsp + rax + 0x25]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 9
jae 0x463cd7
movzx r8d, byte [rsp + rdi + 0x1b]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x5d]
cmp rsi, 9
jb 0x463c62
jmp 0x463ccb
xor eax, eax
lea rbx, [rsp + 0x1b]
mov ecx, 9
nop
call fcn.00445b60
add rsp, 0x30
pop rbp
ret
mov eax, esi
mov ecx, 9
call fcn.00457ea0
mov eax, edi
mov ecx, 9
nop
call fcn.00457ea0
nop
call fcn.00455c20
jmp fcn.00463c20

Function at 0x465140
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x46520c
push rbp
mov rbp, rsp
sub rsp, 0x38
movabs rdx, 0xa1988766cedb7e89
mov qword [rsp + 0x1d], rdx
movabs rdx, 0x8a8d97a1988766ce
mov qword [rsp + 0x20], rdx
movabs rdx, 0x50105030802090a
mov qword [rsp + 0x28], rdx
movabs rdx, 0x406030007010708
mov qword [rsp + 0x30], rdx
xor eax, eax
jmp 0x4651af
movzx r9d, byte [rsp + rsi + 0x1d]
sub r9d, edx
lea edx, [r9 - 0x15]
mov byte [rsp + rdi + 0x1d], dl
lea edx, [r8 - 0x15]
mov byte [rsp + rsi + 0x1d], dl
add rax, 2
cmp rax, 0x10
jge 0x4651dc
movzx edx, byte [rsp + rax + 0x28]
movzx esi, byte [rsp + rax + 0x29]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0xb
jae 0x4651ff
movzx r8d, byte [rsp + rdi + 0x1d]
sub r8d, edx
cmp rsi, 0xb
jb 0x465192
jmp 0x4651f3
xor eax, eax
lea rbx, [rsp + 0x1d]
mov ecx, 0xb
call fcn.00445b60
add rsp, 0x38
pop rbp
ret
mov eax, esi
mov ecx, 0xb
call fcn.00457ea0
mov eax, edi
mov ecx, 0xb
call fcn.00457ea0
nop
call fcn.00455c20
jmp fcn.00465140

Function at 0x465a60
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x465b18
push rbp
mov rbp, rsp
sub rsp, 0x30
movabs rdx, 0x696c6d4f757a6f84
mov qword [rsp + 0x1e], rdx
movabs rdx, 0x102040400040605
mov qword [rsp + 0x26], rdx
mov word [rsp + 0x2e], 0x603
xor eax, eax
jmp 0x465ab5
movzx r9d, byte [rsp + rsi + 0x1e]
lea edx, [r9 + rdx]
lea edx, [rdx - 0xe]
mov byte [rsp + rdi + 0x1e], dl
mov byte [rsp + rsi + 0x1e], r8b
add rax, 2
cmp rax, 0xa
jge 0x465ae8
movzx edx, byte [rsp + rax + 0x26]
movzx esi, byte [rsp + rax + 0x27]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 8
jae 0x465b0b
movzx r8d, byte [rsp + rdi + 0x1e]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0xe]
nop
cmp rsi, 8
jb 0x465a9b
jmp 0x465aff
xor eax, eax
lea rbx, [rsp + 0x1e]
mov ecx, 8
call fcn.00445b60
add rsp, 0x30
pop rbp
ret
mov eax, esi
mov ecx, 8
call fcn.00457ea0
mov eax, edi
mov ecx, 8
call fcn.00457ea0
nop
call fcn.00455c20
nop dword [rax]
jmp fcn.00465a60
Function at 0x467000
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4670b8
push rbp
mov rbp, rsp
sub rsp, 0x30
movabs rdx, 0x61070902f87461b8
mov qword [rsp + 0x1e], rdx
movabs rdx, 0x503040606060504
mov qword [rsp + 0x26], rdx
mov word [rsp + 0x2e], 5
xor eax, eax
jmp 0x467058
movzx r9d, byte [rsp + rsi + 0x1e]
sub r9d, edx
lea edx, [r9 - 0x4a]
mov byte [rsp + rdi + 0x1e], dl
lea edx, [r8 - 0x4a]
mov byte [rsp + rsi + 0x1e], dl
add rax, 2
cmp rax, 0xa
jge 0x467088
movzx edx, byte [rsp + rax + 0x26]
movzx esi, byte [rsp + rax + 0x27]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 8
jae 0x4670ab
movzx r8d, byte [rsp + rdi + 0x1e]
sub r8d, edx
nop dword [rax]
cmp rsi, 8
jb 0x46703b
jmp 0x46709f
xor eax, eax
lea rbx, [rsp + 0x1e]
mov ecx, 8
call fcn.00445b60
add rsp, 0x30
pop rbp
ret
mov eax, esi
mov ecx, 8
call fcn.00457ea0
mov eax, edi
mov ecx, 8
call fcn.00457ea0
nop
call fcn.00455c20
nop dword [rax]
jmp fcn.00467000

Function at 0x4680a0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x46816c
push rbp
mov rbp, rsp
sub rsp, 0x38
movabs rdx, 0x506d59485273536d
mov qword [rsp + 0x1d], rdx
movabs rdx, 0x65666e6f47506d59
mov qword [rsp + 0x22], rdx
movabs rdx, 0xc030101030b0703
mov qword [rsp + 0x2a], rdx
movabs rdx, 0x501050504000c03
mov qword [rsp + 0x30], rdx
xor eax, eax
jmp 0x46810f
movzx r9d, byte [rsp + rsi + 0x1d]
sub r9d, edx
lea edx, [r9 + 0x11]
mov byte [rsp + rdi + 0x1d], dl
lea edx, [r8 + 0x11]
mov byte [rsp + rsi + 0x1d], dl
add rax, 2
cmp rax, 0xe
jge 0x46813c
movzx edx, byte [rsp + rax + 0x2a]
movzx esi, byte [rsp + rax + 0x2b]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0xd
jae 0x46815f
movzx r8d, byte [rsp + rdi + 0x1d]
sub r8d, edx
cmp rsi, 0xd
jb 0x4680f2
jmp 0x468153
xor eax, eax
lea rbx, [rsp + 0x1d]
mov ecx, 0xd
call fcn.00445b60
add rsp, 0x38
pop rbp
ret
mov eax, esi
mov ecx, 0xd
call fcn.00457ea0
mov eax, edi
mov ecx, 0xd
call fcn.00457ea0
nop
call fcn.00455c20
jmp fcn.004680a0

Function at 0x469120
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4691e7
push rbp
mov rbp, rsp
sub rsp, 0x30
movabs rdx, 0xbaae6eb06443b8c3
mov qword [rsp + 0x19], rdx
movabs rdx, 0xe2fb61baae6eb064
mov qword [rsp + 0x1c], rdx
movabs rdx, 0x6070a070a020a09
mov qword [rsp + 0x24], rdx
mov dword [rsp + 0x2c], 0x1040009
xor eax, eax
jmp 0x469188
movzx r9d, byte [rsp + rsi + 0x19]
sub r9d, edx
lea edx, [r9 - 0x40]
mov byte [rsp + rdi + 0x19], dl
lea edx, [r8 - 0x40]
mov byte [rsp + rsi + 0x19], dl
add rax, 2
cmp rax, 0xc
jge 0x4691b7
movzx edx, byte [rsp + rax + 0x24]
movzx esi, byte [rsp + rax + 0x25]
mov edi, edx
xor edx, esi
add edx, eax
nop
cmp rdi, 0xb
jae 0x4691da
movzx r8d, byte [rsp + rdi + 0x19]
sub r8d, edx
cmp rsi, 0xb
jb 0x46916b
jmp 0x4691ce
xor eax, eax
lea rbx, [rsp + 0x19]
mov ecx, 0xb
call fcn.00445b60
add rsp, 0x30
pop rbp
ret
mov eax, esi
mov ecx, 0xb
call fcn.00457ea0
mov eax, edi
mov ecx, 0xb
call fcn.00457ea0
nop
call fcn.00455c20
jmp fcn.00469120
Function at 0x46b980
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x46ba3d
push rbp
mov rbp, rsp
sub rsp, 0x30
movabs rdx, 0x61996972c17f6191
mov qword [rsp + 0x1b], rdx
mov byte [rsp + 0x23], 0xb0
movabs rdx, 0x8060603030806
mov qword [rsp + 0x24], rdx
mov dword [rsp + 0x2c], 0x2020203
xor eax, eax
nop
jmp 0x46b9e0
movzx r9d, byte [rsp + rsi + 0x1b]
sub r9d, edx
lea edx, [r9 - 0x15]
mov byte [rsp + rdi + 0x1b], dl
lea edx, [r8 - 0x15]
mov byte [rsp + rsi + 0x1b], dl
add rax, 2
nop
cmp rax, 0xc
jge 0x46ba0d
movzx edx, byte [rsp + rax + 0x24]
movzx esi, byte [rsp + rax + 0x25]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 9
jae 0x46ba30
movzx r8d, byte [rsp + rdi + 0x1b]
sub r8d, edx
cmp rsi, 9
jb 0x46b9c2
jmp 0x46ba24
xor eax, eax
lea rbx, [rsp + 0x1b]
mov ecx, 9
call fcn.00445b60
add rsp, 0x30
pop rbp
ret
mov eax, esi
mov ecx, 9
call fcn.00457ea0
mov eax, edi
mov ecx, 9
call fcn.00457ea0
nop
nop dword [rax]
call fcn.00455c20
jmp fcn.0046b980

Function at 0x46c3c0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x46c478
push rbp
mov rbp, rsp
sub rsp, 0x30
movabs rdx, 0x6da842afa49a3554
mov qword [rsp + 0x1e], rdx
movabs rdx, 0x506040206010501
mov qword [rsp + 0x26], rdx
mov word [rsp + 0x2e], 0x306
xor eax, eax
jmp 0x46c415
movzx r9d, byte [rsp + rsi + 0x1e]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x50]
mov byte [rsp + rdi + 0x1e], dl
mov byte [rsp + rsi + 0x1e], r8b
add rax, 2
cmp rax, 0xa
jge 0x46c448
movzx edx, byte [rsp + rax + 0x26]
movzx esi, byte [rsp + rax + 0x27]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 8
jae 0x46c46b
movzx r8d, byte [rsp + rdi + 0x1e]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x50]
nop
cmp rsi, 8
jb 0x46c3fb
jmp 0x46c45f
xor eax, eax
lea rbx, [rsp + 0x1e]
mov ecx, 8
call fcn.00445b60
add rsp, 0x30
pop rbp
ret
mov eax, esi
mov ecx, 8
call fcn.00457ea0
mov eax, edi
mov ecx, 8
call fcn.00457ea0
nop
call fcn.00455c20
nop dword [rax]
jmp fcn.0046c3c0

Function at 0x46cf60
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x46d046
push rbp
mov rbp, rsp
sub rsp, 0x40
movabs rdx, 0x65485f4949ec53f7
mov qword [rsp + 0x1f], rdx
movabs rdx, 0x3f9fd915bb33765
mov qword [rsp + 0x26], rdx
movabs rdx, 0xe0d0b0e080c0c09
mov qword [rsp + 0x2e], rdx
movabs rdx, 0xd0e0d0b0e080c
mov qword [rsp + 0x30], rdx
movabs rdx, 0x20c000a0a0e0c0a
mov qword [rsp + 0x38], rdx
xor eax, eax
nop
jmp 0x46cfe0
movzx r9d, byte [rsp + rsi + 0x1f]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x5d]
mov byte [rsp + rdi + 0x1f], dl
mov byte [rsp + rsi + 0x1f], r8b
add rax, 2
nop dword [rax]
cmp rax, 0x12
jge 0x46d012
movzx edx, byte [rsp + rax + 0x2e]
movzx esi, byte [rsp + rax + 0x2f]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0xf
jae 0x46d037
movzx r8d, byte [rsp + rdi + 0x1f]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x5d]
cmp rsi, 0xf
jb 0x46cfc2
jmp 0x46d02b
xor eax, eax
lea rbx, [rsp + 0x1f]
mov ecx, 0xf
nop
call fcn.00445b60
add rsp, 0x40
pop rbp
ret
mov eax, esi
mov ecx, 0xf
call fcn.00457ea0
mov eax, edi
mov ecx, 0xf
nop
call fcn.00457ea0
nop
call fcn.00455c20
jmp fcn.0046cf60
Function at 0x46e720
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x46e806
push rbp
mov rbp, rsp
sub rsp, 0x40
movabs rdx, 0x63776c5f6c76444f
mov qword [rsp + 0x1e], rdx
movabs rdx, 0x646974706d665d65
mov qword [rsp + 0x26], rdx
movabs rdx, 0x6010b040205020b
mov qword [rsp + 0x2e], rdx
movabs rdx, 0xf0a06010b040205
mov qword [rsp + 0x30], rdx
movabs rdx, 0x70203090c080203
mov qword [rsp + 0x38], rdx
xor eax, eax
nop
jmp 0x46e7a0
movzx r9d, byte [rsp + rsi + 0x1e]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x10]
mov byte [rsp + rdi + 0x1e], dl
mov byte [rsp + rsi + 0x1e], r8b
add rax, 2
nop dword [rax]
cmp rax, 0x12
jge 0x46e7d2
movzx edx, byte [rsp + rax + 0x2e]
movzx esi, byte [rsp + rax + 0x2f]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x10
jae 0x46e7f7
movzx r8d, byte [rsp + rdi + 0x1e]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x10]
cmp rsi, 0x10
jb 0x46e782
jmp 0x46e7eb
xor eax, eax
lea rbx, [rsp + 0x1e]
mov ecx, 0x10
nop
call fcn.00445b60
add rsp, 0x40
pop rbp
ret
mov eax, esi
mov ecx, 0x10
call fcn.00457ea0
mov eax, edi
mov ecx, 0x10
nop
call fcn.00457ea0
nop
call fcn.00455c20
jmp fcn.0046e720

Function at 0x46ff60
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x47007a
push rbp
mov rbp, rsp
sub rsp, 0x58
movabs rdx, 0x25646ee67065b846
mov qword [rsp + 0x1a], rdx
movabs rdx, 0x74f83c326f435fd7
mov qword [rsp + 0x22], rdx
movabs rdx, 0x2116bd6574f83c32
mov qword [rsp + 0x26], rdx
movabs rdx, 0xe72fd0b12e5f716
mov qword [rsp + 0x2e], rdx
movabs rdx, 0x1901110017141814
mov qword [rsp + 0x36], rdx
movabs rdx, 0x150d190111001714
mov qword [rsp + 0x38], rdx
movabs rdx, 0xe00131818081717
mov qword [rsp + 0x40], rdx
movabs rdx, 0x4140d161b001913
mov qword [rsp + 0x48], rdx
movabs rdx, 0x10c1407120e0d13
mov qword [rsp + 0x50], rdx
xor eax, eax
jmp 0x470017
movzx r9d, byte [rsp + rsi + 0x1a]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x13]
mov byte [rsp + rdi + 0x1a], dl
mov byte [rsp + rsi + 0x1a], r8b
add rax, 2
cmp rax, 0x22
jge 0x470049
movzx edx, byte [rsp + rax + 0x36]
movzx esi, byte [rsp + rax + 0x37]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x1c
jae 0x47006d
movzx r8d, byte [rsp + rdi + 0x1a]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x13]
cmp rsi, 0x1c
jb 0x46fffd
jmp 0x470061
xor eax, eax
lea rbx, [rsp + 0x1a]
mov ecx, 0x1c
call fcn.00445b60
add rsp, 0x58
pop rbp
nop
ret
mov eax, esi
mov ecx, 0x1c
call fcn.00457ea0
mov eax, edi
mov ecx, 0x1c
call fcn.00457ea0
nop
call fcn.00455c20
nop
jmp fcn.0046ff60
Function at 0x4772c0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
lea r12, [rsp - 8]
cmp r12, qword [r14 + 0x10]
jbe 0x47742c
push rbp
mov rbp, rsp
add rsp, 0xffffffffffffff80
movabs rdx, 0xcecef5738e21794c
mov qword [rsp + 0x1d], rdx
movabs rdx, 0x2c54f3ff0c8409d2
mov qword [rsp + 0x25], rdx
movabs rdx, 0x462c54f3ff0c8409
mov qword [rsp + 0x26], rdx
movabs rdx, 0x764e697235b0df65
mov qword [rsp + 0x2e], rdx
movabs rdx, 0xd20cf3206b69e961
mov qword [rsp + 0x36], rdx
movabs rdx, 0x888f75ad102065ff
mov qword [rsp + 0x3e], rdx
movabs rdx, 0xb1c150613021c00
mov qword [rsp + 0x46], rdx
movabs rdx, 0x9060e1010171a14
mov qword [rsp + 0x4e], rdx
movabs rdx, 0xe0609060e101017
mov qword [rsp + 0x50], rdx
movabs rdx, 0x31a1e0d090e0f1f
mov qword [rsp + 0x58], rdx
movabs rdx, 0x27280c101a090017
mov qword [rsp + 0x60], rdx
movabs rdx, 0x1f0b250524210a00
mov qword [rsp + 0x68], rdx
movabs rdx, 0x20b2825001a1720
mov qword [rsp + 0x70], rdx
movabs rdx, 0x2827120720080300
mov qword [rsp + 0x78], rdx
xor eax, eax
jmp 0x4773c7
movzx r9d, byte [rsp + rsi + 0x1d]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x3b]
mov byte [rsp + rdi + 0x1d], dl
mov byte [rsp + rsi + 0x1d], r8b
add rax, 2
cmp rax, 0x3a
jge 0x4773fc
movzx edx, byte [rsp + rax + 0x46]
movzx esi, byte [rsp + rax + 0x47]
mov edi, edx
xor edx, esi
add edx, eax
nop dword [rax]
cmp rdi, 0x29
jae 0x47741f
movzx r8d, byte [rsp + rdi + 0x1d]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x3b]
cmp rsi, 0x29
jb 0x4773ad
jmp 0x477413
xor eax, eax
lea rbx, [rsp + 0x1d]
mov ecx, 0x29
call fcn.00445b60
sub rsp, 0xffffffffffffff80
pop rbp
ret
mov eax, esi
mov ecx, 0x29
call fcn.00457ea0
mov eax, edi
mov ecx, 0x29
call fcn.00457ea0
nop
call fcn.00455c20
jmp fcn.004772c0
Function at 0x47bb60
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x47bc98
push rbp
mov rbp, rsp
sub rsp, 0x68
movabs rdx, 0x7c883b6e697a7473
mov qword [rsp + 0x1a], rdx
movabs rdx, 0x7cc799ae7c883b6e
mov qword [rsp + 0x1e], rdx
movabs rdx, 0x908c507f788b90da
mov qword [rsp + 0x26], rdx
movabs rdx, 0x69743a9ab5ab7ab7
mov qword [rsp + 0x2e], rdx
movabs rdx, 0x749c918161656591
mov qword [rsp + 0x36], rdx
movabs rdx, 0x16070b170f021e1f
mov qword [rsp + 0x3e], rdx
movabs rdx, 0x612050f1f1f0c10
mov qword [rsp + 0x46], rdx
movabs rdx, 0x220b0612050f1f1f
mov qword [rsp + 0x48], rdx
movabs rdx, 0xe09151f131c071e
mov qword [rsp + 0x50], rdx
movabs rdx, 0x20080715191e1411
mov qword [rsp + 0x58], rdx
movabs rdx, 0x1811110a0e0d2110
mov qword [rsp + 0x60], rdx
xor eax, eax
jmp 0x47bc38
movzx r9d, byte [rsp + rsi + 0x1a]
sub r9d, edx
lea edx, [r9 + 9]
mov byte [rsp + rdi + 0x1a], dl
lea edx, [r8 + 9]
mov byte [rsp + rsi + 0x1a], dl
add rax, 2
cmp rax, 0x2a
jge 0x47bc68
movzx edx, byte [rsp + rax + 0x3e]
movzx esi, byte [rsp + rax + 0x3f]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x24
jae 0x47bc8b
movzx r8d, byte [rsp + rdi + 0x1a]
sub r8d, edx
nop dword [rax]
cmp rsi, 0x24
jb 0x47bc1b
jmp 0x47bc7f
xor eax, eax
lea rbx, [rsp + 0x1a]
mov ecx, 0x24
call fcn.00445b60
add rsp, 0x68
pop rbp
ret
mov eax, esi
mov ecx, 0x24
call fcn.00457ea0
mov eax, edi
mov ecx, 0x24
call fcn.00457ea0
nop
call fcn.00455c20
nop dword [rax]
jmp fcn.0047bb60