joyce8/EMBER2024-capa huggingface dataset:
Function at 0x456ba0
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x456c4f
push rbp
mov rbp, rsp
sub rsp, 0x58
mov qword [rsp + 0x70], rbx
lea rdx, [rsp + 0x68]
mov qword [rsp + 8], 0
movups xmmword [rsp + 0x10], xmm15
movups xmmword [rsp + 0x18], xmm15
movups xmmword [rsp + 0x28], xmm15
movups xmmword [rsp + 0x38], xmm15
movups xmmword [rsp + 0x48], xmm15
lea rsi, [0x00456ca0]
mov qword [rsp + 0x10], rsi
mov rsi, qword [rsp + 0x60]
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdx
mov rdx, r14
mov qword [rsp + 0x28], rdx
lea rdx, [rsp + 8]
mov qword [rsp + 0x30], rdx
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x48], rcx
mov qword [rsp + 0x50], rdi
lea rax, [rsp + 0x10]
mov qword [rsp], rax
call fcn.0045f780
xorps xmm15, xmm15
mov r14, qword [0x007b9ae0]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 8]
add rsp, 0x58
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
call fcn.0045f8c0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
nop dword [rax]
jmp fcn.00456ba0
Function at 0x4616a0
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4037c3
push rbp
mov rbp, rsp
sub rsp, 0x18
mov rdx, qword [rax]
mov rcx, qword [rax + 8]
mov rax, rdx
call fcn.00409240
add rsp, 0x18
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.0045f8c0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp 0x4037a0
cmp byte [0x007b988e], 0
je 0x4616b5
mov rcx, qword [rax + 8]
mov rax, qword [rax]
jmp 0x45e900
jmp 0x4037a0

Function at 0x4616c0
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
nop
mov eax, dword [rax]
movabs rcx, 0xe7037ed1a0b428db
xor rcx, rax
xor rax, rbx
xor rax, qword [0x007b9bc0]
movabs rdx, 0xa0761d6478bd642f
xor rdx, rax
mov rax, rcx
mul rdx
xor rax, rdx
mov rcx, rax
movabs rax, 0x1d8e4e27c47d124b
mul rcx
xor rax, rdx
nop
nop
ret
cmp byte [0x007b988e], 0
je 0x4616f5
movq xmm0, rbx
pinsrd xmm0, dword [rax], 2
aesenc xmm0, xmmword [0x007b9ec0]
aesenc xmm0, xmmword [0x007b9ed0]
aesenc xmm0, xmmword [0x007b9ee0]
movq rax, xmm0
ret
jmp 0x409460

Function at 0x461700
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
nop
mov rax, qword [rax]
movabs rcx, 0xe7037ed1a0b428db
xor rcx, rax
xor rax, rbx
xor rax, qword [0x007b9bc0]
movabs rdx, 0xa0761d6478bd642f
xor rdx, rax
mov rax, rcx
mul rdx
xor rax, rdx
mov rcx, rax
movabs rax, 0x1d8e4e27c47d1247
mul rcx
xor rax, rdx
nop
nop
ret
cmp byte [0x007b988e], 0
je 0x461736
movq xmm0, rbx
pinsrq xmm0, qword [rax], 1
aesenc xmm0, xmmword [0x007b9ec0]
aesenc xmm0, xmmword [0x007b9ed0]
aesenc xmm0, xmmword [0x007b9ee0]
movq rax, xmm0
ret
jmp 0x4094c0

Function at 0x463400
Capabilities:
Allocate thread local storage

Disassembly:
push rbp
mov rbp, rsp
mov rax, rsp
and rsp, 0xfffffffffffffff0
sub rsp, 0x30
mov qword [rsp + 0x20], rax
mov rax, qword [sym.imp.kernel32.dll_TlsAlloc]
call rax
mov rsp, qword [rsp + 0x20]
mov rcx, rax
cmp rcx, 0x40
jb 0x463434
mov rcx, 0x28
jmp 0x46343f
shl rcx, 3
add rcx, 0x1480
mov qword [0x007b9ae0], rcx
pop rbp
ret
Function at 0x46aa00
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x46ab0c
push rbp
mov rbp, rsp
sub rsp, 0x58
movabs rdx, 0xaa9a209497c879dd
mov qword [rsp + 0x3a], rdx
movabs rdx, 0x65c2c3afc16e8f63
mov qword [rsp + 0x42], rdx
movabs rdx, 0xa375aae3a10365c2
mov qword [rsp + 0x48], rdx
movabs rdx, 0xdb869da673207865
mov qword [rsp + 0x50], rdx
movabs rdx, 0x10061d060e0d121a
mov qword [rsp + 0x1c], rdx
movabs rdx, 0x200110b061a0c07
mov qword [rsp + 0x24], rdx
movabs rdx, 0x1b091c03001a0200
mov qword [rsp + 0x2a], rdx
movabs rdx, 0x1102121215131a04
mov qword [rsp + 0x32], rdx
xor eax, eax
jmp 0x46aaa8
movzx r9d, byte [rsp + rsi + 0x3a]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x54]
mov byte [rsp + rdi + 0x3a], dl
mov byte [rsp + rsi + 0x3a], r8b
add rax, 2
cmp rax, 0x1e
jge 0x46aadc
movzx edx, byte [rsp + rax + 0x1c]
movzx esi, byte [rsp + rax + 0x1d]
mov edi, edx
xor edx, esi
add edx, eax
nop
cmp rdi, 0x1e
jae 0x46aaff
movzx r8d, byte [rsp + rdi + 0x3a]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x54]
cmp rsi, 0x1e
jb 0x46aa8e
jmp 0x46aaf3
xor eax, eax
lea rbx, [rsp + 0x3a]
mov ecx, 0x1e
call fcn.0044c140
add rsp, 0x58
pop rbp
ret
mov eax, esi
mov ecx, 0x1e
call fcn.00461b40
mov eax, edi
mov ecx, 0x1e
call fcn.00461b40
nop
call fcn.0045f8c0
jmp fcn.0046aa00

Function at 0x46ab20
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x46ac3d
push rbp
mov rbp, rsp
sub rsp, 0x60
movabs rdx, 0xdd05e83aefcb5de6
mov qword [rsp + 0x1c], rdx
movabs rdx, 0xcb74d5eb73730c63
mov qword [rsp + 0x24], rdx
movabs rdx, 0x497cf9d1fdebcb74
mov qword [rsp + 0x2a], rdx
movabs rdx, 0xe774d8d88d5ba3d4
mov qword [rsp + 0x32], rdx
movabs rdx, 0x1509150f020d1214
mov qword [rsp + 0x3a], rdx
movabs rdx, 0xf0a181801091509
mov qword [rsp + 0x40], rdx
movabs rdx, 0x19061000161b0515
mov qword [rsp + 0x48], rdx
movabs rdx, 0x61913090d031d1a
mov qword [rsp + 0x50], rdx
movabs rdx, 0x110f060c07031817
mov qword [rsp + 0x58], rdx
xor eax, eax
jmp 0x46abe0
movzx r9d, byte [rsp + rsi + 0x1c]
sub r9d, edx
lea edx, [r9 - 0x56]
mov byte [rsp + rdi + 0x1c], dl
lea edx, [r8 - 0x56]
mov byte [rsp + rsi + 0x1c], dl
add rax, 2
nop word [rax + rax]
cmp rax, 0x26
jge 0x46ac0d
movzx edx, byte [rsp + rax + 0x3a]
movzx esi, byte [rsp + rax + 0x3b]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x1e
jae 0x46ac30
movzx r8d, byte [rsp + rdi + 0x1c]
sub r8d, edx
cmp rsi, 0x1e
jb 0x46abbd
jmp 0x46ac24
xor eax, eax
lea rbx, [rsp + 0x1c]
mov ecx, 0x1e
call fcn.0044c140
add rsp, 0x60
pop rbp
ret
mov eax, esi
mov ecx, 0x1e
call fcn.00461b40
mov eax, edi
mov ecx, 0x1e
call fcn.00461b40
nop
nop dword [rax]
call fcn.0045f8c0
jmp fcn.0046ab20
Function at 0x46bfc0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x46c0bd
push rbp
mov rbp, rsp
sub rsp, 0x48
movabs rdx, 0x870f9df56b01bf02
mov qword [rsp + 0x18], rdx
movabs rdx, 0x690c0fc8870f9df5
mov qword [rsp + 0x1c], rdx
movabs rdx, 0xb0c50a64ef6f206a
mov qword [rsp + 0x24], rdx
movabs rdx, 0x12090f0013050c04
mov qword [rsp + 0x2c], rdx
movabs rdx, 0x60a080710131109
mov qword [rsp + 0x34], rdx
movabs rdx, 0x7110201060a0807
mov qword [rsp + 0x38], rdx
movabs rdx, 0x208130805070408
mov qword [rsp + 0x40], rdx
xor eax, eax
jmp 0x46c060
movzx r9d, byte [rsp + rsi + 0x18]
sub r9d, edx
lea edx, [r9 + 0x77]
mov byte [rsp + rdi + 0x18], dl
lea edx, [r8 + 0x77]
mov byte [rsp + rsi + 0x18], dl
add rax, 2
nop dword [rax]
cmp rax, 0x1c
jge 0x46c08d
movzx edx, byte [rsp + rax + 0x2c]
movzx esi, byte [rsp + rax + 0x2d]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x14
jae 0x46c0b0
movzx r8d, byte [rsp + rdi + 0x18]
sub r8d, edx
cmp rsi, 0x14
jb 0x46c03f
jmp 0x46c0a4
xor eax, eax
lea rbx, [rsp + 0x18]
mov ecx, 0x14
call fcn.0044c140
add rsp, 0x48
pop rbp
ret
mov eax, esi
mov ecx, 0x14
call fcn.00461b40
mov eax, edi
mov ecx, 0x14
call fcn.00461b40
nop
nop dword [rax]
call fcn.0045f8c0
jmp fcn.0046bfc0

Function at 0x46d5c0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x46d678
push rbp
mov rbp, rsp
sub rsp, 0x30
movabs rdx, 0x6ebaaa5149087241
mov qword [rsp + 0x1c], rdx
movabs rdx, 0x604030204030202
mov qword [rsp + 0x24], rdx
mov dword [rsp + 0x2c], 0x2020605
xor eax, eax
jmp 0x46d616
movzx r9d, byte [rsp + rsi + 0x1c]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x54]
mov byte [rsp + rdi + 0x1c], dl
mov byte [rsp + rsi + 0x1c], r8b
add rax, 2
cmp rax, 0xc
jge 0x46d648
movzx edx, byte [rsp + rax + 0x24]
movzx esi, byte [rsp + rax + 0x25]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 8
jae 0x46d66b
movzx r8d, byte [rsp + rdi + 0x1c]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x54]
cmp rsi, 8
jb 0x46d5fc
jmp 0x46d65f
xor eax, eax
lea rbx, [rsp + 0x1c]
mov ecx, 8
call fcn.0044c140
add rsp, 0x30
pop rbp
ret
mov eax, esi
mov ecx, 8
call fcn.00461b40
mov eax, edi
mov ecx, 8
call fcn.00461b40
nop
call fcn.0045f8c0
nop dword [rax]
jmp fcn.0046d5c0
Function at 0x46d6a0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x46d758
push rbp
mov rbp, rsp
sub rsp, 0x30
movabs rdx, 0xa573654affe2a548
mov qword [rsp + 0x1c], rdx
movabs rdx, 0x2010704010004
mov qword [rsp + 0x24], rdx
mov dword [rsp + 0x2c], 0x4020103
xor eax, eax
jmp 0x46d6f6
movzx r9d, byte [rsp + rsi + 0x1c]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x58]
mov byte [rsp + rdi + 0x1c], dl
mov byte [rsp + rsi + 0x1c], r8b
add rax, 2
cmp rax, 0xc
jge 0x46d728
movzx edx, byte [rsp + rax + 0x24]
movzx esi, byte [rsp + rax + 0x25]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 8
jae 0x46d74b
movzx r8d, byte [rsp + rdi + 0x1c]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x58]
cmp rsi, 8
jb 0x46d6dc
jmp 0x46d73f
xor eax, eax
lea rbx, [rsp + 0x1c]
mov ecx, 8
call fcn.0044c140
add rsp, 0x30
pop rbp
ret
mov eax, esi
mov ecx, 8
call fcn.00461b40
mov eax, edi
mov ecx, 8
call fcn.00461b40
nop
call fcn.0045f8c0
nop dword [rax]
jmp fcn.0046d6a0

Function at 0x46f740
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x46f7fd
push rbp
mov rbp, rsp
sub rsp, 0x30
movabs rdx, 0xa497086f67611075
mov qword [rsp + 0x1a], rdx
mov word [rsp + 0x22], 0x8cf4
movabs rdx, 0x6080809080006
mov qword [rsp + 0x24], rdx
mov dword [rsp + 0x2c], 0x5010701
xor eax, eax
jmp 0x46f7a0
movzx r9d, byte [rsp + rsi + 0x1a]
sub r9d, edx
lea edx, [r9 + 0x72]
mov byte [rsp + rdi + 0x1a], dl
lea edx, [r8 + 0x72]
mov byte [rsp + rsi + 0x1a], dl
add rax, 2
cmp rax, 0xc
jge 0x46f7cd
movzx edx, byte [rsp + rax + 0x24]
movzx esi, byte [rsp + rax + 0x25]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0xa
jae 0x46f7f0
movzx r8d, byte [rsp + rdi + 0x1a]
sub r8d, edx
cmp rsi, 0xa
jb 0x46f783
jmp 0x46f7e4
xor eax, eax
lea rbx, [rsp + 0x1a]
mov ecx, 0xa
call fcn.0044c140
add rsp, 0x30
pop rbp
ret
mov eax, esi
mov ecx, 0xa
call fcn.00461b40
mov eax, edi
mov ecx, 0xa
call fcn.00461b40
nop
nop dword [rax]
call fcn.0045f8c0
jmp fcn.0046f740

Function at 0x470480
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x47056a
push rbp
mov rbp, rsp
sub rsp, 0x48
movabs rdx, 0xe49dc272f6b1b7ba
mov qword [rsp + 0x1b], rdx
movabs rdx, 0x8dc6bdfc69e49dc2
mov qword [rsp + 0x20], rdx
movabs rdx, 0xf28d84bd9c61a95f
mov qword [rsp + 0x28], rdx
movabs rdx, 0x603071100131014
mov qword [rsp + 0x30], rdx
movabs rdx, 0x6020e0c06111211
mov qword [rsp + 0x38], rdx
movabs rdx, 0xa05100b01020209
mov qword [rsp + 0x40], rdx
xor eax, eax
jmp 0x47050d
movzx r9d, byte [rsp + rsi + 0x1b]
sub r9d, edx
lea edx, [r9 - 0x2f]
mov byte [rsp + rdi + 0x1b], dl
lea edx, [r8 - 0x2f]
mov byte [rsp + rsi + 0x1b], dl
add rax, 2
cmp rax, 0x18
jge 0x47053a
movzx edx, byte [rsp + rax + 0x30]
movzx esi, byte [rsp + rax + 0x31]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x15
jae 0x47055d
movzx r8d, byte [rsp + rdi + 0x1b]
sub r8d, edx
cmp rsi, 0x15
jb 0x4704f0
jmp 0x470551
xor eax, eax
lea rbx, [rsp + 0x1b]
mov ecx, 0x15
call fcn.0044c140
add rsp, 0x48
pop rbp
ret
mov eax, esi
mov ecx, 0x15
call fcn.00461b40
mov eax, edi
mov ecx, 0x15
call fcn.00461b40
nop
call fcn.0045f8c0
jmp fcn.00470480
Function at 0x472a80
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x472b3d
push rbp
mov rbp, rsp
sub rsp, 0x30
movabs rdx, 0xbcf86cb0670cbe4d
mov qword [rsp + 0x1d], rdx
mov byte [rsp + 0x25], 0xff
movabs rdx, 0x108060208020404
mov qword [rsp + 0x26], rdx
mov word [rsp + 0x2e], 0x207
xor eax, eax
nop
jmp 0x472ae0
movzx r9d, byte [rsp + rsi + 0x1d]
sub r9d, edx
lea edx, [r9 - 0x41]
mov byte [rsp + rdi + 0x1d], dl
lea edx, [r8 - 0x41]
mov byte [rsp + rsi + 0x1d], dl
add rax, 2
nop
cmp rax, 0xa
jge 0x472b0d
movzx edx, byte [rsp + rax + 0x26]
movzx esi, byte [rsp + rax + 0x27]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 9
jae 0x472b30
movzx r8d, byte [rsp + rdi + 0x1d]
sub r8d, edx
cmp rsi, 9
jb 0x472ac2
jmp 0x472b24
xor eax, eax
lea rbx, [rsp + 0x1d]
mov ecx, 9
call fcn.0044c140
add rsp, 0x30
pop rbp
ret
mov eax, esi
mov ecx, 9
call fcn.00461b40
mov eax, edi
mov ecx, 9
call fcn.00461b40
nop
nop dword [rax]
call fcn.0045f8c0
jmp fcn.00472a80

Function at 0x4738a0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x473967
push rbp
mov rbp, rsp
sub rsp, 0x30
movabs rdx, 0x727b7479634b6b4f
mov qword [rsp + 0x18], rdx
mov word [rsp + 0x20], 0x726c
movabs rdx, 0x602020408070608
mov qword [rsp + 0x22], rdx
movabs rdx, 0x303010601090602
mov qword [rsp + 0x28], rdx
xor eax, eax
jmp 0x473907
movzx r9d, byte [rsp + rsi + 0x18]
sub r9d, edx
lea edx, [r9 + 8]
mov byte [rsp + rdi + 0x18], dl
lea edx, [r8 + 8]
mov byte [rsp + rsi + 0x18], dl
add rax, 2
cmp rax, 0xe
jge 0x473937
movzx edx, byte [rsp + rax + 0x22]
movzx esi, byte [rsp + rax + 0x23]
mov edi, edx
xor edx, esi
add edx, eax
nop dword [rax]
cmp rdi, 0xa
jae 0x47395a
movzx r8d, byte [rsp + rdi + 0x18]
sub r8d, edx
cmp rsi, 0xa
jb 0x4738ea
jmp 0x47394e
xor eax, eax
lea rbx, [rsp + 0x18]
mov ecx, 0xa
call fcn.0044c140
add rsp, 0x30
pop rbp
ret
mov eax, esi
mov ecx, 0xa
call fcn.00461b40
mov eax, edi
mov ecx, 0xa
call fcn.00461b40
nop
call fcn.0045f8c0
jmp fcn.004738a0

Function at 0x475400
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4754dd
push rbp
mov rbp, rsp
sub rsp, 0x40
movabs rdx, 0xe6656564c1616162
mov qword [rsp + 0x1f], rdx
movabs rdx, 0x4e76556c68f750e6
mov qword [rsp + 0x26], rdx
movabs rdx, 0xc0c0e0400030e04
mov qword [rsp + 0x2e], rdx
movabs rdx, 0x1060c0c0e040003
mov qword [rsp + 0x30], rdx
movabs rdx, 0x103070c0e0c0906
mov qword [rsp + 0x38], rdx
xor eax, eax
nop
jmp 0x475480
movzx r9d, byte [rsp + rsi + 0x1f]
sub r9d, edx
lea edx, [r9 - 0x6c]
mov byte [rsp + rdi + 0x1f], dl
lea edx, [r8 - 0x6c]
mov byte [rsp + rsi + 0x1f], dl
add rax, 2
nop
cmp rax, 0x12
jge 0x4754ad
movzx edx, byte [rsp + rax + 0x2e]
movzx esi, byte [rsp + rax + 0x2f]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0xf
jae 0x4754d0
movzx r8d, byte [rsp + rdi + 0x1f]
sub r8d, edx
cmp rsi, 0xf
jb 0x475462
jmp 0x4754c4
xor eax, eax
lea rbx, [rsp + 0x1f]
mov ecx, 0xf
call fcn.0044c140
add rsp, 0x40
pop rbp
ret
mov eax, esi
mov ecx, 0xf
call fcn.00461b40
mov eax, edi
mov ecx, 0xf
call fcn.00461b40
nop
nop dword [rax]
call fcn.0045f8c0
jmp fcn.00475400
Function at 0x475ac0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x475b7d
push rbp
mov rbp, rsp
sub rsp, 0x30
movabs rdx, 0x91828d61646c7c53
mov qword [rsp + 0x1b], rdx
mov byte [rsp + 0x23], 0x6c
movabs rdx, 0x808050202060606
mov qword [rsp + 0x24], rdx
mov dword [rsp + 0x2c], 0x2010207
xor eax, eax
nop
jmp 0x475b20
movzx r9d, byte [rsp + rsi + 0x1b]
sub r9d, edx
lea edx, [r9 - 1]
mov byte [rsp + rdi + 0x1b], dl
lea edx, [r8 - 1]
mov byte [rsp + rsi + 0x1b], dl
add rax, 2
nop
cmp rax, 0xc
jge 0x475b4d
movzx edx, byte [rsp + rax + 0x24]
movzx esi, byte [rsp + rax + 0x25]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 9
jae 0x475b70
movzx r8d, byte [rsp + rdi + 0x1b]
sub r8d, edx
cmp rsi, 9
jb 0x475b02
jmp 0x475b64
xor eax, eax
lea rbx, [rsp + 0x1b]
mov ecx, 9
call fcn.0044c140
add rsp, 0x30
pop rbp
ret
mov eax, esi
mov ecx, 9
call fcn.00461b40
mov eax, edi
mov ecx, 9
call fcn.00461b40
nop
nop dword [rax]
call fcn.0045f8c0
jmp fcn.00475ac0

Function at 0x476c80
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x476d66
push rbp
mov rbp, rsp
sub rsp, 0x40
movabs rdx, 0x7c488bd349e41aad
mov qword [rsp + 0x1d], rdx
movabs rdx, 0x7a690fd106a6ac7c
mov qword [rsp + 0x24], rdx
movabs rdx, 0xc08020101040c0a
mov qword [rsp + 0x2c], rdx
movabs rdx, 0xa070e000c080201
mov qword [rsp + 0x30], rdx
movabs rdx, 0x907090b01050504
mov qword [rsp + 0x38], rdx
xor eax, eax
nop
jmp 0x476d00
movzx r9d, byte [rsp + rsi + 0x1d]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x4f]
mov byte [rsp + rdi + 0x1d], dl
mov byte [rsp + rsi + 0x1d], r8b
add rax, 2
nop dword [rax]
cmp rax, 0x14
jge 0x476d32
movzx edx, byte [rsp + rax + 0x2c]
movzx esi, byte [rsp + rax + 0x2d]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0xf
jae 0x476d57
movzx r8d, byte [rsp + rdi + 0x1d]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x4f]
cmp rsi, 0xf
jb 0x476ce2
jmp 0x476d4b
xor eax, eax
lea rbx, [rsp + 0x1d]
mov ecx, 0xf
nop
call fcn.0044c140
add rsp, 0x40
pop rbp
ret
mov eax, esi
mov ecx, 0xf
call fcn.00461b40
mov eax, edi
mov ecx, 0xf
nop
call fcn.00461b40
nop
call fcn.0045f8c0
jmp fcn.00476c80
Function at 0x479320
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4793fd
push rbp
mov rbp, rsp
sub rsp, 0x40
movabs rdx, 0x637a715e6c73747c
mov qword [rsp + 0x1f], rdx
movabs rdx, 0x767370516c607763
mov qword [rsp + 0x26], rdx
movabs rdx, 0xc030b09060b0709
mov qword [rsp + 0x2e], rdx
movabs rdx, 0x4050c030b09060b
mov qword [rsp + 0x30], rdx
movabs rdx, 0x7090a0e020e0e
mov qword [rsp + 0x38], rdx
xor eax, eax
nop
jmp 0x4793a0
movzx r9d, byte [rsp + rsi + 0x1f]
sub r9d, edx
lea edx, [r9 + 0xa]
mov byte [rsp + rdi + 0x1f], dl
lea edx, [r8 + 0xa]
mov byte [rsp + rsi + 0x1f], dl
add rax, 2
nop
cmp rax, 0x12
jge 0x4793cd
movzx edx, byte [rsp + rax + 0x2e]
movzx esi, byte [rsp + rax + 0x2f]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0xf
jae 0x4793f0
movzx r8d, byte [rsp + rdi + 0x1f]
sub r8d, edx
cmp rsi, 0xf
jb 0x479382
jmp 0x4793e4
xor eax, eax
lea rbx, [rsp + 0x1f]
mov ecx, 0xf
call fcn.0044c140
add rsp, 0x40
pop rbp
ret
mov eax, esi
mov ecx, 0xf
call fcn.00461b40
mov eax, edi
mov ecx, 0xf
call fcn.00461b40
nop
nop dword [rax]
call fcn.0045f8c0
jmp fcn.00479320

Function at 0x47adc0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x47ae92
push rbp
mov rbp, rsp
sub rsp, 0x38
movabs rdx, 0xa2bfa6ab7469a9f7
mov qword [rsp + 0x1f], rdx
movabs rdx, 0xa3e97da2bfa6ab74
mov qword [rsp + 0x22], rdx
movabs rdx, 0x70608050a04000a
mov qword [rsp + 0x2a], rdx
movabs rdx, 0x109090105010706
mov qword [rsp + 0x30], rdx
xor eax, eax
jmp 0x47ae2c
movzx r9d, byte [rsp + rsi + 0x1f]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x56]
mov byte [rsp + rdi + 0x1f], dl
mov byte [rsp + rsi + 0x1f], r8b
add rax, 2
cmp rax, 0xe
jge 0x47ae5e
movzx edx, byte [rsp + rax + 0x2a]
movzx esi, byte [rsp + rax + 0x2b]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0xb
jae 0x47ae85
movzx r8d, byte [rsp + rdi + 0x1f]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x56]
cmp rsi, 0xb
jb 0x47ae12
jmp 0x47ae75
xor eax, eax
lea rbx, [rsp + 0x1f]
mov ecx, 0xb
call fcn.0044c140
add rsp, 0x38
pop rbp
ret
mov eax, esi
mov ecx, 0xb
nop dword [rax]
call fcn.00461b40
mov eax, edi
mov ecx, 0xb
call fcn.00461b40
nop
call fcn.0045f8c0
jmp fcn.0047adc0
Function at 0x480200
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x480347
push rbp
mov rbp, rsp
sub rsp, 0x70
movabs rdx, 0x65522e2d60e61e99
mov qword [rsp + 0x18], rdx
movabs rdx, 0x7a34526165522e2d
mov qword [rsp + 0x1c], rdx
movabs rdx, 0x2a201b6b2860272e
mov qword [rsp + 0x24], rdx
movabs rdx, 0xe8321a69bc91030c
mov qword [rsp + 0x2c], rdx
movabs rdx, 0x6ef20103f7296fc5
mov qword [rsp + 0x34], rdx
movabs rdx, 0xb19141c0003161b
mov qword [rsp + 0x3c], rdx
movabs rdx, 0x41902020b19141c
mov qword [rsp + 0x40], rdx
movabs rdx, 0x16001e20011a0322
mov qword [rsp + 0x48], rdx
movabs rdx, 0x1e13110014042115
mov qword [rsp + 0x50], rdx
movabs rdx, 0x1f17111b160f210d
mov qword [rsp + 0x58], rdx
movabs rdx, 0x210322091f0a1521
mov qword [rsp + 0x60], rdx
movabs rdx, 0x221170f200e200a
mov qword [rsp + 0x68], rdx
xor eax, eax
jmp 0x4802e7
movzx r9d, byte [rsp + rsi + 0x18]
sub r9d, edx
lea edx, [r9 + 0x70]
mov byte [rsp + rdi + 0x18], dl
lea edx, [r8 + 0x70]
mov byte [rsp + rsi + 0x18], dl
add rax, 2
cmp rax, 0x34
jge 0x480317
movzx edx, byte [rsp + rax + 0x3c]
movzx esi, byte [rsp + rax + 0x3d]
mov edi, edx
xor edx, esi
add edx, eax
nop dword [rax]
cmp rdi, 0x24
jae 0x48033a
movzx r8d, byte [rsp + rdi + 0x18]
sub r8d, edx
cmp rsi, 0x24
jb 0x4802ca
jmp 0x48032e
xor eax, eax
lea rbx, [rsp + 0x18]
mov ecx, 0x24
call fcn.0044c140
add rsp, 0x70
pop rbp
ret
mov eax, esi
mov ecx, 0x24
call fcn.00461b40
mov eax, edi
mov ecx, 0x24
call fcn.00461b40
nop
call fcn.0045f8c0
jmp fcn.00480200

Function at 0x481880
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x481988
push rbp
mov rbp, rsp
sub rsp, 0x58
movabs rdx, 0xe18d0ed35ff175e5
mov qword [rsp + 0x1d], rdx
movabs rdx, 0x7420a194db6efe61
mov qword [rsp + 0x25], rdx
movabs rdx, 0xe843656bc97420a1
mov qword [rsp + 0x2a], rdx
movabs rdx, 0xe0da6f6c62d0d9f8
mov qword [rsp + 0x32], rdx
movabs rdx, 0x161b050604181310
mov qword [rsp + 0x3a], rdx
movabs rdx, 0x1403140b1c000c18
mov qword [rsp + 0x42], rdx
movabs rdx, 0x617060d140d1403
mov qword [rsp + 0x48], rdx
movabs rdx, 0x3070c0402101509
mov qword [rsp + 0x50], rdx
xor eax, eax
jmp 0x48192b
movzx r9d, byte [rsp + rsi + 0x1d]
sub r9d, edx
lea edx, [r9 - 0x58]
mov byte [rsp + rdi + 0x1d], dl
lea edx, [r8 - 0x58]
mov byte [rsp + rsi + 0x1d], dl
add rax, 2
cmp rax, 0x1e
jge 0x481958
movzx edx, byte [rsp + rax + 0x3a]
movzx esi, byte [rsp + rax + 0x3b]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x1d
jae 0x48197b
movzx r8d, byte [rsp + rdi + 0x1d]
sub r8d, edx
cmp rsi, 0x1d
jb 0x48190e
jmp 0x48196f
xor eax, eax
lea rbx, [rsp + 0x1d]
mov ecx, 0x1d
call fcn.0044c140
add rsp, 0x58
pop rbp
ret
mov eax, esi
mov ecx, 0x1d
call fcn.00461b40
mov eax, edi
mov ecx, 0x1d
call fcn.00461b40
nop
call fcn.0045f8c0
jmp fcn.00481880