joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4537c0
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x402f6f
sub rsp, 0x20
mov qword [rsp + 0x18], rbp
lea rbp, [rsp + 0x18]
mov rdx, qword [rax]
mov rcx, qword [rax + 8]
mov rax, rdx
nop
call fcn.00408360
mov rbp, qword [rsp + 0x18]
add rsp, 0x20
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.00451720
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp 0x402f40
cmp byte [0x0063904f], 0
je 0x4537d5
mov rcx, qword [rax + 8]
mov rax, qword [rax]
jmp 0x450820
jmp 0x402f40

Function at 0x4537e0
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
mov eax, dword [rax]
movabs rcx, 0xe7037ed1a0b428db
xor rcx, rax
xor rax, rbx
xor rax, qword [0x00639300]
movabs rdx, 0xa0761d6478bd642f
xor rdx, rax
mov rax, rcx
mul rdx
xor rax, rdx
mov rcx, rax
movabs rax, 0x1d8e4e27c47d124b
mul rcx
nop
nop
xor rax, rdx
ret
cmp byte [0x0063904f], 0
je 0x453815
movq xmm0, rbx
pinsrd xmm0, dword [rax], 2
aesenc xmm0, xmmword [0x00639680]
aesenc xmm0, xmmword [0x00639690]
aesenc xmm0, xmmword [0x006396a0]
movq rax, xmm0
ret
jmp 0x408560

Function at 0x453820
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
mov rax, qword [rax]
movabs rcx, 0xe7037ed1a0b428db
xor rcx, rax
xor rax, rbx
xor rax, qword [0x00639300]
movabs rdx, 0xa0761d6478bd642f
xor rdx, rax
mov rax, rcx
mul rdx
xor rax, rdx
mov rcx, rax
movabs rax, 0x1d8e4e27c47d1247
mul rcx
nop
nop
xor rax, rdx
ret
cmp byte [0x0063904f], 0
je 0x453856
movq xmm0, rbx
pinsrq xmm0, qword [rax], 1
aesenc xmm0, xmmword [0x00639680]
aesenc xmm0, xmmword [0x00639690]
aesenc xmm0, xmmword [0x006396a0]
movq rax, xmm0
ret
jmp 0x4085c0

Function at 0x455240
Capabilities:
Write file on windows

Disassembly:
sub rsp, 0x30
mov rcx, 0xfffffffffffffff4
mov qword [rsp], rcx
mov rax, qword [sym.imp.kernel32.dll_GetStdHandle]
call rax
mov rcx, rax
mov qword [rsp], rcx
lea rdx, [0x00639600]
mov qword [rsp + 8], rdx
lea r8d, [0x00639064]
mov qword [rsp + 0x10], r8
lea r9, [rsp + 0x28]
mov qword [r9], 0
mov qword [rsp + 0x18], r9
mov qword [rsp + 0x20], 0
mov rax, qword [sym.imp.kernel32.dll_WriteFile]
call rax
call fcn.00453700
add rsp, 0x30
ret

Function at 0x455780
Capabilities:
Allocate thread local storage

Disassembly:
mov rax, rsp
and rsp, 0xfffffffffffffff0
sub rsp, 0x30
mov qword [rsp + 0x20], rax
mov rax, qword [sym.imp.kernel32.dll_TlsAlloc]
call rax
mov rsp, qword [rsp + 0x20]
mov rcx, rax
cmp rcx, 0x40
jb 0x4557ac
call fcn.00453700
shl rcx, 3
add rcx, 0x1480
mov qword [0x00639228], rcx
ret
Function at 0x45a1a0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x45a268
sub rsp, 0x38
mov qword [rsp + 0x30], rbp
lea rbp, [rsp + 0x30]
movabs rdx, 0x3605656ccb68194d
mov qword [rsp + 0x1b], rdx
mov byte [rsp + 0x23], 9
movabs rdx, 0x802000601010002
mov qword [rsp + 0x24], rdx
mov dword [rsp + 0x2c], 0x8030606
xor eax, eax
jmp 0x45a201
movzx r9d, byte [rsp + rsi + 0x1b]
add r9d, 0x54
add edx, r9d
mov byte [rsp + rdi + 0x1b], dl
mov byte [rsp + rsi + 0x1b], r8b
add rax, 2
cmp rax, 0xc
jge 0x45a232
movzx edx, byte [rsp + rax + 0x24]
movzx esi, byte [rsp + rax + 0x25]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 9
jae 0x45a25b
movzx r8d, byte [rsp + rdi + 0x1b]
add r8d, 0x54
add r8d, edx
cmp rsi, 9
jb 0x45a1e7
jmp 0x45a24f
xor eax, eax
lea rbx, [rsp + 0x1b]
mov ecx, 9
nop
call fcn.00441e20
mov rbp, qword [rsp + 0x30]
add rsp, 0x38
ret
mov eax, esi
mov ecx, 9
call fcn.00453d80
mov eax, edi
mov ecx, 9
call fcn.00453d80
nop
call fcn.00451720
jmp fcn.0045a1a0

Function at 0x45bf00
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x45bfdc
sub rsp, 0x40
mov qword [rsp + 0x38], rbp
lea rbp, [rsp + 0x38]
movabs rdx, 0xaab5072d28b8c4ac
mov qword [rsp + 0x1d], rdx
movabs rdx, 0xa5ad69aab5072d28
mov qword [rsp + 0x20], rdx
movabs rdx, 0xa02040309030105
mov qword [rsp + 0x28], rdx
movabs rdx, 0x607070301000709
mov qword [rsp + 0x30], rdx
xor eax, eax
jmp 0x45bf72
movzx r9d, byte [rsp + rsi + 0x1d]
add r9d, 0xffffffae
add edx, r9d
mov byte [rsp + rdi + 0x1d], dl
mov byte [rsp + rsi + 0x1d], r8b
add rax, 2
cmp rax, 0x10
jge 0x45bfa8
movzx edx, byte [rsp + rax + 0x28]
movzx esi, byte [rsp + rax + 0x29]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0xb
jae 0x45bfcf
movzx r8d, byte [rsp + rdi + 0x1d]
add r8d, 0xffffffae
add r8d, edx
nop dword [rax + rax]
cmp rsi, 0xb
jb 0x45bf58
jmp 0x45bfc3
xor eax, eax
lea rbx, [rsp + 0x1d]
mov ecx, 0xb
call fcn.00441e20
mov rbp, qword [rsp + 0x38]
add rsp, 0x40
ret
mov eax, esi
mov ecx, 0xb
call fcn.00453d80
mov eax, edi
mov ecx, 0xb
call fcn.00453d80
nop
nop dword [rax]
call fcn.00451720
jmp fcn.0045bf00
Function at 0x45d1a0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x45d268
sub rsp, 0x38
mov qword [rsp + 0x30], rbp
lea rbp, [rsp + 0x30]
movabs rdx, 0x65c32e9eb33cb217
mov qword [rsp + 0x1d], rdx
mov byte [rsp + 0x25], 7
movabs rdx, 0x1040601080600
mov qword [rsp + 0x26], rdx
mov word [rsp + 0x2e], 0x308
xor eax, eax
jmp 0x45d200
movzx r9d, byte [rsp + rsi + 0x1d]
add r9d, 0xffffffa8
add edx, r9d
mov byte [rsp + rdi + 0x1d], dl
mov byte [rsp + rsi + 0x1d], r8b
add rax, 2
cmp rax, 0xa
jge 0x45d231
movzx edx, byte [rsp + rax + 0x26]
movzx esi, byte [rsp + rax + 0x27]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 9
jae 0x45d25b
movzx r8d, byte [rsp + rdi + 0x1d]
add r8d, 0xffffffa8
add r8d, edx
cmp rsi, 9
jb 0x45d1e6
jmp 0x45d24f
xor eax, eax
lea rbx, [rsp + 0x1d]
mov ecx, 9
nop dword [rax]
call fcn.00441e20
mov rbp, qword [rsp + 0x30]
add rsp, 0x38
ret
mov eax, esi
mov ecx, 9
call fcn.00453d80
mov eax, edi
mov ecx, 9
call fcn.00453d80
nop
call fcn.00451720
jmp fcn.0045d1a0

Function at 0x45d280
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x45d348
sub rsp, 0x38
mov qword [rsp + 0x30], rbp
lea rbp, [rsp + 0x30]
movabs rdx, 0x654c1c213f7b6f2f
mov qword [rsp + 0x1b], rdx
mov byte [rsp + 0x23], 0x72
movabs rdx, 0x808040100030102
mov qword [rsp + 0x24], rdx
mov dword [rsp + 0x2c], 0x2000305
xor eax, eax
jmp 0x45d2e1
movzx r9d, byte [rsp + rsi + 0x1b]
add r9d, 0xfffffff6
add edx, r9d
mov byte [rsp + rdi + 0x1b], dl
mov byte [rsp + rsi + 0x1b], r8b
add rax, 2
cmp rax, 0xc
jge 0x45d312
movzx edx, byte [rsp + rax + 0x24]
movzx esi, byte [rsp + rax + 0x25]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 9
jae 0x45d33b
movzx r8d, byte [rsp + rdi + 0x1b]
add r8d, 0xfffffff6
add r8d, edx
cmp rsi, 9
jb 0x45d2c7
jmp 0x45d32f
xor eax, eax
lea rbx, [rsp + 0x1b]
mov ecx, 9
nop
call fcn.00441e20
mov rbp, qword [rsp + 0x30]
add rsp, 0x38
ret
mov eax, esi
mov ecx, 9
call fcn.00453d80
mov eax, edi
mov ecx, 9
call fcn.00453d80
nop
call fcn.00451720
jmp fcn.0045d280
Function at 0x461480
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x461576
sub rsp, 0x50
mov qword [rsp + 0x48], rbp
lea rbp, [rsp + 0x48]
movabs rdx, 0xbaeab54f5f65bc53
mov qword [rsp + 0x1c], rdx
movabs rdx, 0xffa36148baeab54f
mov qword [rsp + 0x20], rdx
movabs rdx, 0xf1c6b1a9666fbd64
mov qword [rsp + 0x28], rdx
movabs rdx, 0x13040804070b1106
mov qword [rsp + 0x30], rdx
movabs rdx, 0x110712130808100a
mov qword [rsp + 0x38], rdx
movabs rdx, 0x70504030d030801
mov qword [rsp + 0x40], rdx
xor eax, eax
jmp 0x461510
movzx r9d, byte [rsp + rsi + 0x1c]
add r9d, 0xffffffa1
add edx, r9d
mov byte [rsp + rdi + 0x1c], dl
mov byte [rsp + rsi + 0x1c], r8b
add rax, 2
cmp rax, 0x18
jge 0x461542
movzx edx, byte [rsp + rax + 0x30]
movzx esi, byte [rsp + rax + 0x31]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x14
jae 0x461569
movzx r8d, byte [rsp + rdi + 0x1c]
add r8d, 0xffffffa1
add r8d, edx
cmp rsi, 0x14
jb 0x4614f6
nop
jmp 0x46155d
xor eax, eax
lea rbx, [rsp + 0x1c]
mov ecx, 0x14
call fcn.00441e20
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
mov eax, esi
mov ecx, 0x14
call fcn.00453d80
mov eax, edi
mov ecx, 0x14
call fcn.00453d80
nop
call fcn.00451720
nop dword [rax + rax]
jmp fcn.00461480
Function at 0x461ec0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x46201c
add rsp, 0xffffffffffffff80
mov qword [rsp + 0x78], rbp
lea rbp, [rsp + 0x78]
movups xmmword [rsp + 0x88], xmm15
movups xmmword [rsp + 0x98], xmm15
movabs rdx, 0xfb180c1d8d1ca200
mov qword [rsp + 0x34], rdx
movabs rdx, 0xb303b41911f7a51e
mov qword [rsp + 0x3c], rdx
movabs rdx, 0x710f615170d1bea
mov qword [rsp + 0x44], rdx
movabs rdx, 0x9aa050bddeebac8
mov qword [rsp + 0x4c], rdx
movabs rdx, 0x51007010d0b150f
mov qword [rsp + 0x54], rdx
movabs rdx, 0x1501191505100701
mov qword [rsp + 0x58], rdx
movabs rdx, 0xb18050a03181e07
mov qword [rsp + 0x60], rdx
movabs rdx, 0xe1b0b1a0e1e0e09
mov qword [rsp + 0x68], rdx
movabs rdx, 0x1a1e190118031e07
mov qword [rsp + 0x70], rdx
xor eax, eax
jmp 0x461f8f
movzx r8d, byte [rsp + rbx + 0x34]
add r8d, 0xfffffff8
add edx, r8d
mov byte [rsp + rsi + 0x34], dl
mov byte [rsp + rbx + 0x34], dil
add rax, 2
cmp rax, 0x24
jge 0x461fbd
movzx edx, byte [rsp + rax + 0x54]
movzx ebx, byte [rsp + rax + 0x55]
mov esi, edx
xor edx, ebx
add edx, eax
cmp rsi, 0x20
jae 0x46200f
movzx edi, byte [rsp + rsi + 0x34]
add edi, 0xfffffff8
add edi, edx
cmp rbx, 0x20
jb 0x461f75
jmp 0x462003
movups xmmword [rsp + 0x14], xmm15
movups xmmword [rsp + 0x24], xmm15
xor eax, eax
jmp 0x461fd9
movzx ecx, byte [rsp + rax + 0x34]
mov byte [rsp + rax + 0x14], cl
inc rax
cmp rax, 0x20
jl 0x461fcd
movups xmm0, xmmword [rsp + 0x14]
movups xmmword [rsp + 0x88], xmm0
movups xmm0, xmmword [rsp + 0x24]
movups xmmword [rsp + 0x98], xmm0
mov rbp, qword [rsp + 0x78]
sub rsp, 0xffffffffffffff80
ret
mov eax, ebx
mov ecx, 0x20
call fcn.00453d80
mov eax, esi
mov ecx, 0x20
call fcn.00453d80
nop
nop dword [rax]
call fcn.00451720
jmp fcn.00461ec0

Function at 0x463940
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x463a12
sub rsp, 0x38
mov qword [rsp + 0x30], rbp
lea rbp, [rsp + 0x30]
movabs rdx, 0x31cb6fda30deca12
mov qword [rsp + 0x18], rdx
mov word [rsp + 0x20], 0x8432
movabs rdx, 0x504050900020901
mov qword [rsp + 0x22], rdx
movabs rdx, 0x906020901040504
mov qword [rsp + 0x28], rdx
xor eax, eax
jmp 0x4639aa
movzx r9d, byte [rsp + rsi + 0x18]
add r9d, 0x4f
add edx, r9d
mov byte [rsp + rdi + 0x18], dl
mov byte [rsp + rsi + 0x18], r8b
add rax, 2
cmp rax, 0xe
jge 0x4639db
movzx edx, byte [rsp + rax + 0x22]
movzx esi, byte [rsp + rax + 0x23]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0xa
jae 0x463a05
movzx r8d, byte [rsp + rdi + 0x18]
add r8d, 0x4f
add r8d, edx
cmp rsi, 0xa
jb 0x463990
jmp 0x4639f6
xor eax, eax
lea rbx, [rsp + 0x18]
mov ecx, 0xa
call fcn.00441e20
mov rbp, qword [rsp + 0x30]
add rsp, 0x38
ret
mov eax, esi
mov ecx, 0xa
nop dword [rax]
call fcn.00453d80
mov eax, edi
mov ecx, 0xa
call fcn.00453d80
nop
call fcn.00451720
jmp fcn.00463940
Function at 0x463a20
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x463ae8
sub rsp, 0x38
mov qword [rsp + 0x30], rbp
lea rbp, [rsp + 0x30]
movabs rdx, 0xcb35c9d2ced231cc
mov qword [rsp + 0x1a], rdx
mov word [rsp + 0x22], 0x127a
movabs rdx, 0x909040505080908
mov qword [rsp + 0x24], rdx
mov dword [rsp + 0x2c], 0x7030002
xor eax, eax
jmp 0x463a83
movzx r9d, byte [rsp + rsi + 0x1a]
add r9d, 0x5a
add edx, r9d
mov byte [rsp + rdi + 0x1a], dl
mov byte [rsp + rsi + 0x1a], r8b
add rax, 2
cmp rax, 0xc
jge 0x463ab4
movzx edx, byte [rsp + rax + 0x24]
movzx esi, byte [rsp + rax + 0x25]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0xa
jae 0x463adb
movzx r8d, byte [rsp + rdi + 0x1a]
add r8d, 0x5a
add r8d, edx
cmp rsi, 0xa
jb 0x463a69
jmp 0x463acf
xor eax, eax
lea rbx, [rsp + 0x1a]
mov ecx, 0xa
call fcn.00441e20
mov rbp, qword [rsp + 0x30]
add rsp, 0x38
ret
mov eax, esi
mov ecx, 0xa
call fcn.00453d80
mov eax, edi
mov ecx, 0xa
call fcn.00453d80
nop
call fcn.00451720
jmp fcn.00463a20

Function at 0x463b00
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x463bdc
sub rsp, 0x40
mov qword [rsp + 0x38], rbp
lea rbp, [rsp + 0x38]
movabs rdx, 0x38b6c3c0bdb3bdb4
mov qword [rsp + 0x1f], rdx
movabs rdx, 0x3540c738b6c3c0bd
mov qword [rsp + 0x22], rdx
movabs rdx, 0x601040304030900
mov qword [rsp + 0x2a], rdx
movabs rdx, 0x805040002030601
mov qword [rsp + 0x30], rdx
xor eax, eax
jmp 0x463b75
movzx r9d, byte [rsp + rsi + 0x1f]
sub r9d, edx
lea edx, [r9 - 0x79]
mov byte [rsp + rdi + 0x1f], dl
lea edx, [r8 - 0x79]
mov byte [rsp + rsi + 0x1f], dl
add rax, 2
cmp rax, 0xe
jge 0x463ba8
movzx edx, byte [rsp + rax + 0x2a]
movzx esi, byte [rsp + rax + 0x2b]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0xb
jae 0x463bcf
movzx r8d, byte [rsp + rdi + 0x1f]
sub r8d, edx
nop word [rax + rax]
cmp rsi, 0xb
jb 0x463b58
jmp 0x463bc3
xor eax, eax
lea rbx, [rsp + 0x1f]
mov ecx, 0xb
call fcn.00441e20
mov rbp, qword [rsp + 0x38]
add rsp, 0x40
ret
mov eax, esi
mov ecx, 0xb
call fcn.00453d80
mov eax, edi
mov ecx, 0xb
call fcn.00453d80
nop
nop dword [rax]
call fcn.00451720
jmp fcn.00463b00
Function at 0x463c00
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x463cdc
sub rsp, 0x40
mov qword [rsp + 0x38], rbp
lea rbp, [rsp + 0x38]
movabs rdx, 0x180f3936171b1216
mov qword [rsp + 0x1d], rdx
movabs rdx, 0x11e636ead9180f39
mov qword [rsp + 0x22], rdx
movabs rdx, 0x107020300090308
mov qword [rsp + 0x2a], rdx
movabs rdx, 0x2000b0c060107
mov qword [rsp + 0x30], rdx
xor eax, eax
jmp 0x463c72
movzx r9d, byte [rsp + rsi + 0x1d]
add r9d, 0x14
add edx, r9d
mov byte [rsp + rdi + 0x1d], dl
mov byte [rsp + rsi + 0x1d], r8b
add rax, 2
cmp rax, 0xe
jge 0x463ca8
movzx edx, byte [rsp + rax + 0x2a]
movzx esi, byte [rsp + rax + 0x2b]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0xd
jae 0x463ccf
movzx r8d, byte [rsp + rdi + 0x1d]
add r8d, 0x14
add r8d, edx
nop dword [rax + rax]
cmp rsi, 0xd
jb 0x463c58
jmp 0x463cc3
xor eax, eax
lea rbx, [rsp + 0x1d]
mov ecx, 0xd
call fcn.00441e20
mov rbp, qword [rsp + 0x38]
add rsp, 0x40
ret
mov eax, esi
mov ecx, 0xd
call fcn.00453d80
mov eax, edi
mov ecx, 0xd
call fcn.00453d80
nop
nop dword [rax]
call fcn.00451720
jmp fcn.00463c00

Function at 0x464420
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x464516
sub rsp, 0x50
mov qword [rsp + 0x48], rbp
lea rbp, [rsp + 0x48]
movabs rdx, 0x7e321876d6bcdcc5
mov qword [rsp + 0x1e], rdx
movabs rdx, 0x38d17e321876d6bc
mov qword [rsp + 0x20], rdx
movabs rdx, 0x35787c81cb72c98d
mov qword [rsp + 0x28], rdx
movabs rdx, 0xa1001030a0d050b
mov qword [rsp + 0x30], rdx
movabs rdx, 0x70b030e010803
mov qword [rsp + 0x38], rdx
movabs rdx, 0xc070403050f020f
mov qword [rsp + 0x40], rdx
xor eax, eax
jmp 0x4644b0
movzx r9d, byte [rsp + rsi + 0x1e]
add r9d, 0xffffff9f
add edx, r9d
mov byte [rsp + rdi + 0x1e], dl
mov byte [rsp + rsi + 0x1e], r8b
add rax, 2
cmp rax, 0x18
jge 0x4644e2
movzx edx, byte [rsp + rax + 0x30]
movzx esi, byte [rsp + rax + 0x31]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x12
jae 0x464509
movzx r8d, byte [rsp + rdi + 0x1e]
add r8d, 0xffffff9f
add r8d, edx
cmp rsi, 0x12
jb 0x464496
nop
jmp 0x4644fd
xor eax, eax
lea rbx, [rsp + 0x1e]
mov ecx, 0x12
call fcn.00441e20
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
mov eax, esi
mov ecx, 0x12
call fcn.00453d80
mov eax, edi
mov ecx, 0x12
call fcn.00453d80
nop
call fcn.00451720
nop dword [rax + rax]
jmp fcn.00464420
Function at 0x464ec0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x464fb6
sub rsp, 0x50
mov qword [rsp + 0x48], rbp
lea rbp, [rsp + 0x48]
movabs rdx, 0x242f3232331d2c28
mov qword [rsp + 0x1b], rdx
movabs rdx, 0x4935310c34242f32
mov qword [rsp + 0x20], rdx
movabs rdx, 0x261a3635162b3837
mov qword [rsp + 0x28], rdx
movabs rdx, 0x13141002140d1002
mov qword [rsp + 0x30], rdx
movabs rdx, 0x107070610010609
mov qword [rsp + 0x38], rdx
movabs rdx, 0xc13141001000d0f
mov qword [rsp + 0x40], rdx
xor eax, eax
jmp 0x464f53
movzx r9d, byte [rsp + rsi + 0x1b]
sub r9d, edx
lea edx, [r9 + 0x1e]
mov byte [rsp + rdi + 0x1b], dl
lea edx, [r8 + 0x1e]
mov byte [rsp + rsi + 0x1b], dl
add rax, 2
cmp rax, 0x18
jge 0x464f82
movzx edx, byte [rsp + rax + 0x30]
movzx esi, byte [rsp + rax + 0x31]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x15
jae 0x464fa9
movzx r8d, byte [rsp + rdi + 0x1b]
sub r8d, edx
cmp rsi, 0x15
jb 0x464f36
nop
jmp 0x464f9d
xor eax, eax
lea rbx, [rsp + 0x1b]
mov ecx, 0x15
call fcn.00441e20
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
mov eax, esi
mov ecx, 0x15
call fcn.00453d80
mov eax, edi
mov ecx, 0x15
call fcn.00453d80
nop
call fcn.00451720
nop dword [rax + rax]
jmp fcn.00464ec0

Function at 0x464fe0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4650e8
sub rsp, 0x58
mov qword [rsp + 0x50], rbp
lea rbp, [rsp + 0x50]
movabs rdx, 0xaebaafb63602e1b1
mov qword [rsp + 0x1e], rdx
movabs rdx, 0x9e377bf9e7f7aeba
mov qword [rsp + 0x24], rdx
movabs rdx, 0xe5ec31dff73599fc
mov qword [rsp + 0x2c], rdx
movabs rdx, 0x915040e0b000602
mov qword [rsp + 0x34], rdx
movabs rdx, 0xd02070511141400
mov qword [rsp + 0x3c], rdx
movabs rdx, 0xf020e0a0d020705
mov qword [rsp + 0x40], rdx
movabs rdx, 0x20501120b070808
mov qword [rsp + 0x48], rdx
xor eax, eax
jmp 0x465080
movzx r9d, byte [rsp + rsi + 0x1e]
add r9d, 0x2c
add edx, r9d
mov byte [rsp + rdi + 0x1e], dl
mov byte [rsp + rsi + 0x1e], r8b
add rax, 2
nop
cmp rax, 0x1c
jge 0x4650b1
movzx edx, byte [rsp + rax + 0x34]
movzx esi, byte [rsp + rax + 0x35]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x16
jae 0x4650db
movzx r8d, byte [rsp + rdi + 0x1e]
add r8d, 0x2c
add r8d, edx
cmp rsi, 0x16
jb 0x465065
jmp 0x4650cf
xor eax, eax
lea rbx, [rsp + 0x1e]
mov ecx, 0x16
nop dword [rax]
call fcn.00441e20
mov rbp, qword [rsp + 0x50]
add rsp, 0x58
ret
mov eax, esi
mov ecx, 0x16
call fcn.00453d80
mov eax, edi
mov ecx, 0x16
call fcn.00453d80
nop
call fcn.00451720
jmp fcn.00464fe0
Function at 0x465100
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x465208
sub rsp, 0x58
mov qword [rsp + 0x50], rbp
lea rbp, [rsp + 0x50]
movabs rdx, 0x3205e7e734360431
mov qword [rsp + 0x1c], rdx
movabs rdx, 0xa00cfc0e0aa13831
mov qword [rsp + 0x24], rdx
movabs rdx, 0x911bc3f30d3434db
mov qword [rsp + 0x2c], rdx
movabs rdx, 0x170a160f10051615
mov qword [rsp + 0x34], rdx
movabs rdx, 0x13101706040f0d16
mov qword [rsp + 0x3c], rdx
movabs rdx, 0xe0b0a0113101706
mov qword [rsp + 0x40], rdx
movabs rdx, 0xd0d060514010c0f
mov qword [rsp + 0x48], rdx
xor eax, eax
jmp 0x4651a0
movzx r9d, byte [rsp + rsi + 0x1c]
add r9d, 0x13
add edx, r9d
mov byte [rsp + rdi + 0x1c], dl
mov byte [rsp + rsi + 0x1c], r8b
add rax, 2
nop
cmp rax, 0x1c
jge 0x4651d1
movzx edx, byte [rsp + rax + 0x34]
movzx esi, byte [rsp + rax + 0x35]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x18
jae 0x4651fb
movzx r8d, byte [rsp + rdi + 0x1c]
add r8d, 0x13
add r8d, edx
cmp rsi, 0x18
jb 0x465185
jmp 0x4651ef
xor eax, eax
lea rbx, [rsp + 0x1c]
mov ecx, 0x18
nop dword [rax]
call fcn.00441e20
mov rbp, qword [rsp + 0x50]
add rsp, 0x58
ret
mov eax, esi
mov ecx, 0x18
call fcn.00453d80
mov eax, edi
mov ecx, 0x18
call fcn.00453d80
nop
call fcn.00451720
jmp fcn.00465100
Function at 0x4668c0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4669f2
sub rsp, 0x68
mov qword [rsp + 0x60], rbp
lea rbp, [rsp + 0x60]
movabs rdx, 0xf815f13c00373290
mov qword [rsp + 0x18], rdx
movabs rdx, 0xb32d8e633e3a235
mov qword [rsp + 0x20], rdx
movabs rdx, 0x760900677ea70b32
mov qword [rsp + 0x26], rdx
movabs rdx, 0xf83236f31413de06
mov qword [rsp + 0x2e], rdx
movabs rdx, 0x151a151112150c04
mov qword [rsp + 0x36], rdx
movabs rdx, 0x121d03170509000c
mov qword [rsp + 0x3e], rdx
movabs rdx, 0x1d05121d03170509
mov qword [rsp + 0x40], rdx
movabs rdx, 0xd0c0f1613001000
mov qword [rsp + 0x48], rdx
movabs rdx, 0x319061d0a130707
mov qword [rsp + 0x50], rdx
movabs rdx, 0x10130c1814110d1a
mov qword [rsp + 0x58], rdx
xor eax, eax
jmp 0x46698f
movzx r9d, byte [rsp + rsi + 0x18]
sub r9d, edx
lea edx, [r9 + 0x59]
mov byte [rsp + rdi + 0x18], dl
lea edx, [r8 + 0x59]
mov byte [rsp + rsi + 0x18], dl
add rax, 2
cmp rax, 0x2a
jge 0x4669bc
movzx edx, byte [rsp + rax + 0x36]
movzx esi, byte [rsp + rax + 0x37]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x1e
jae 0x4669e5
movzx r8d, byte [rsp + rdi + 0x18]
sub r8d, edx
cmp rsi, 0x1e
jb 0x466972
jmp 0x4669d7
xor eax, eax
lea rbx, [rsp + 0x18]
mov ecx, 0x1e
call fcn.00441e20
mov rbp, qword [rsp + 0x60]
add rsp, 0x68
ret
mov eax, esi
mov ecx, 0x1e
nop
call fcn.00453d80
mov eax, edi
mov ecx, 0x1e
call fcn.00453d80
nop
call fcn.00451720
jmp fcn.004668c0

Function at 0x466f20
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x467046
sub rsp, 0x68
mov qword [rsp + 0x60], rbp
lea rbp, [rsp + 0x60]
movabs rdx, 0x39315a3338395346
mov qword [rsp + 0x1b], rdx
movabs rdx, 0x3f4c3830526f3b35
mov qword [rsp + 0x23], rdx
movabs rdx, 0x3738364f3738443f
mov qword [rsp + 0x2a], rdx
movabs rdx, 0x923a367b343f2739
mov qword [rsp + 0x32], rdx
movabs rdx, 0x13071d1305181810
mov qword [rsp + 0x3a], rdx
movabs rdx, 0x1916030802081307
mov qword [rsp + 0x40], rdx
movabs rdx, 0x30f12130a0a010a
mov qword [rsp + 0x48], rdx
movabs rdx, 0x1b0e011b1e09090b
mov qword [rsp + 0x50], rdx
movabs rdx, 0x11805001d0a0918
mov qword [rsp + 0x58], rdx
xor eax, eax
jmp 0x466fe0
movzx r9d, byte [rsp + rsi + 0x1b]
sub r9d, edx
lea edx, [r9 + 0x15]
mov byte [rsp + rdi + 0x1b], dl
lea edx, [r8 + 0x15]
mov byte [rsp + rsi + 0x1b], dl
add rax, 2
cmp rax, 0x26
jge 0x46700d
movzx edx, byte [rsp + rax + 0x3a]
movzx esi, byte [rsp + rax + 0x3b]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x1f
jae 0x467034
movzx r8d, byte [rsp + rdi + 0x1b]
sub r8d, edx
cmp rsi, 0x1f
jb 0x466fc3
jmp 0x467028
xor eax, eax
lea rbx, [rsp + 0x1b]
mov ecx, 0x1f
call fcn.00441e20
mov rbp, qword [rsp + 0x60]
add rsp, 0x68
ret
mov eax, esi
mov ecx, 0x1f
call fcn.00453d80
mov eax, edi
mov ecx, 0x1f
nop dword [rax + rax]
call fcn.00453d80
nop
call fcn.00451720
jmp fcn.00466f20
Function at 0x4701a0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4702f2
sub rsp, 0x78
mov qword [rsp + 0x70], rbp
lea rbp, [rsp + 0x70]
movabs rdx, 0x495542740aef7962
mov qword [rsp + 0x1a], rdx
movabs rdx, 0xd0651ed049554274
mov qword [rsp + 0x1e], rdx
movabs rdx, 0x2a6c5a5030490ef2
mov qword [rsp + 0x26], rdx
movabs rdx, 0x5a5be160e9772064
mov qword [rsp + 0x2e], rdx
movabs rdx, 0x3859492d4d4e2d2d
mov qword [rsp + 0x36], rdx
movabs rdx, 0xb1919031d1c1c08
mov qword [rsp + 0x3e], rdx
movabs rdx, 0x9210b1919031d1c
mov qword [rsp + 0x40], rdx
movabs rdx, 0x1902030c051e0d21
mov qword [rsp + 0x48], rdx
movabs rdx, 0x13071d20200d100d
mov qword [rsp + 0x50], rdx
movabs rdx, 0xf02180006170f22
mov qword [rsp + 0x58], rdx
movabs rdx, 0xf1a1b080e060917
mov qword [rsp + 0x60], rdx
movabs rdx, 0x190f1f191a031106
mov qword [rsp + 0x68], rdx
xor eax, eax
jmp 0x47028d
movzx r9d, byte [rsp + rsi + 0x1a]
sub r9d, edx
lea edx, [r9 + 0x48]
mov byte [rsp + rdi + 0x1a], dl
lea edx, [r8 + 0x48]
mov byte [rsp + rsi + 0x1a], dl
add rax, 2
cmp rax, 0x32
jge 0x4702ba
movzx edx, byte [rsp + rax + 0x3e]
movzx esi, byte [rsp + rax + 0x3f]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x24
jae 0x4702e5
movzx r8d, byte [rsp + rdi + 0x1a]
sub r8d, edx
cmp rsi, 0x24
jb 0x470270
jmp 0x4702d5
xor eax, eax
lea rbx, [rsp + 0x1a]
mov ecx, 0x24
call fcn.00441e20
mov rbp, qword [rsp + 0x70]
add rsp, 0x78
ret
mov eax, esi
mov ecx, 0x24
nop dword [rax]
call fcn.00453d80
mov eax, edi
mov ecx, 0x24
call fcn.00453d80
nop
call fcn.00451720
jmp fcn.004701a0