joyce8/EMBER2024-capa huggingface dataset:
Function at 0x43d500
Capabilities:
Encode data using base64

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x43d667
push rbp
mov rbp, rsp
sub rsp, 0x18
mov ecx, dword [rax + 0x190]
mov edx, dword [rax + 0x194]
mov rsi, qword [rax + 0x998]
mov edi, dword [rax + 0x194]
cmp edi, edx
jne 0x43d512
cmp edx, ecx
jne 0x43d655
nop word [rax + rax]
test rsi, rsi
jne 0x43d655
mov qword [rsp + 0x28], rax
test rbx, rbx
jne 0x43d574
nop
call fcn.00457f20
xorps xmm15, xmm15
mov r14, qword [0x006bb258]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rbx, qword [rsp]
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0x10], rbx
call fcn.0043d420
mov rcx, qword [rsp + 0x28]
mov edx, dword [rcx]
mov ebx, edx
sar edx, 0x1f
shr edx, 0x1b
add edx, ebx
mov esi, edx
and edx, 0xffffffe0
sub ebx, edx
test ebx, ebx
jl 0x43d650
mov rdx, qword [0x00635d08]
sar esi, 5
mov rax, rcx
mov ecx, ebx
mov edi, 1
shl edi, cl
movsxd rsi, esi
cmp ecx, 0x20
sbb r8d, r8d
and edi, r8d
cmp rdx, rsi
jbe 0x43d645
mov rcx, qword [0x00635d00]
lea rcx, [rcx + rsi*4]
lock or dword [rcx], edi
mov rcx, qword [0x00637670]
mov qword [rax + 8], rcx
mov rcx, rax
nop
mov qword [0x00637670], rax
nop
mov edx, 1
lea rsi, [0x00637678]
lock xadd dword [rsi], edx
mov rdx, qword [rcx + 0x1248]
shr rdx, 0x3d
test dl, dl
jne 0x43d633
mov rax, qword [rsp + 0x10]
movabs rdx, 0x1fffffffffffffff
and rdx, rax
bts rdx, 0x3f
nop
nop
xchg qword [rcx + 0x1248], rdx
add rsp, 0x18
pop rbp
ret
lea rax, [0x0057e2dc]
mov ebx, 0x28
nop
call fcn.0042f940
mov rax, rsi
mov rcx, rdx
call fcn.00456620
call fcn.0042e940
lea rax, [0x0057d7f6]
mov ebx, 0x23
call fcn.0042f940
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.00454340
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.0043d500
Function at 0x440900
Capabilities:
Access peb ldr_data

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x70
mov rcx, r14
test rcx, rcx
je 0x440948
mov rcx, qword [rcx + 0x30]
mov rcx, qword [rcx + 0x90]
nop dword [rax + rax]
test rcx, rcx
je 0x440948
mov qword [rsp + 0x68], rcx
nop
mov rax, qword [rdi + 0x28]
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x58], 0
mov qword [rsp + 0x50], 0
jmp 0x440958
mov eax, 1
add rsp, 0x70
pop rbp
ret
mov rax, qword [rsp + 0x60]
mov rcx, qword [sym.imp.kernel32.dll_RtlLookupFunctionEntry]
lea rdx, [rsp + 0x58]
mov rbx, qword [rax + 0xf8]
mov qword [rsp], rcx
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], 0
call fcn.0042d7a0
xorps xmm15, xmm15
mov r14, qword [0x006bb258]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x20]
nop
test rax, rax
je 0x440a31
mov rcx, qword [rsp + 0x58]
mov rdx, qword [sym.imp.kernel32.dll_RtlVirtualUnwind]
mov rbx, qword [rsp + 0x60]
mov rsi, rbx
lea rdi, [rsp + 0x50]
mov r8, qword [rsi + 0xf8]
mov qword [rsp], rdx
mov qword [rsp + 8], 0
mov qword [rsp + 0x10], rcx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x40], 0
call fcn.0042da20
xorps xmm15, xmm15
mov r14, qword [0x006bb258]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x68]
cmp qword [rcx], rax
ja 0x440a31
cmp qword [rcx + 8], rax
ja 0x440953
mov eax, 1
add rsp, 0x70
pop rbp
ret
Function at 0x446f20
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x10
mov qword [rsp + 0x20], rax
test rbx, rbx
jbe 0x447097
movzx edx, byte [rax]
test edx, edx
jne 0x446f54
nop dword [rax]
test r8b, r8b
jne 0x446f54
xor eax, eax
xor ebx, ebx
mov rcx, rbx
xor edi, edi
add rsp, 0x10
pop rbp
ret
bt edx, 7
jae 0x446f67
xor edx, edx
xor r8d, r8d
xor r9d, r9d
jmp 0x447057
mov r8d, 1
mov r9d, edx
and edx, 1
neg edx
shr r9d, 1
xor edx, r9d
add dword [rsi], edx
nop dword [rax]
cmp rbx, r8
jb 0x447045
sub rbx, r8
sub rcx, r8
mov rdx, rcx
neg rdx
sar rdx, 0x3f
and r8, rdx
lea rdx, [rax + r8]
test rbx, rbx
jbe 0x447037
movzx esi, byte [rax + r8]
bt esi, 7
jae 0x446fbd
xor eax, eax
xor esi, esi
xor r8d, r8d
jmp 0x447000
mov eax, 1
cmp rax, rbx
ja 0x446feb
add qword [rdi], rsi
sub rcx, rax
sub rbx, rax
mov rsi, rcx
neg rsi
sar rsi, 0x3f
and rax, rsi
add rax, rdx
mov edi, 1
add rsp, 0x10
pop rbp
ret
mov rcx, rbx
call fcn.004566e0
lea r8d, [rcx + 7]
mov rcx, r11
mov eax, r12d
nop dword [rax]
cmp rax, rbx
jae 0x44702f
movzx r9d, byte [rax + rdx]
mov r10d, r9d
and r9d, 0x7f
mov r11, rcx
mov ecx, r8d
shl r9d, cl
lea r12d, [rax + 1]
or esi, r9d
test r10b, 0x80
jne 0x446ff3
mov rcx, r11
mov eax, r12d
jmp 0x446fc2
mov rcx, rbx
call fcn.00456620
xor eax, eax
mov rcx, rax
nop dword [rax]
call fcn.00456620
mov eax, r8d
mov rcx, rbx
call fcn.004566e0
lea r9d, [rcx + 7]
mov rcx, r12
cmp rbx, rdx
jbe 0x44708d
movzx r10d, byte [rdx + rax]
mov r11d, r10d
and r10d, 0x7f
mov r12, rcx
mov ecx, r9d
shl r10d, cl
inc edx
or r8d, r10d
test r11b, 0x80
jne 0x447050
mov rcx, r12
mov r9d, edx
mov edx, r8d
mov r8d, r9d
jmp 0x446f6d
mov eax, edx
mov rcx, rbx
call fcn.00456620
xor eax, eax
mov rcx, rax
nop dword [rax]
call fcn.00456620
nop
int3

Function at 0x44cbc0
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x44cc75
push rbp
mov rbp, rsp
sub rsp, 0x48
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x68], rcx
mov qword [rsp + 0x70], rdi
test byte [rax], al
lea rdx, [rax + 0x10]
mov rsi, qword [rsp + 0x68]
mov rcx, rdi
mov rax, rdx
mov rbx, rsi
call fcn.0044a8e0
nop
test bl, bl
je 0x44cc6f
mov qword [rsp + 0x18], rax
movups xmmword [rsp + 0x20], xmm15
movups xmmword [rsp + 0x28], xmm15
movups xmmword [rsp + 0x38], xmm15
lea rcx, [0x0044ccc0]
mov qword [rsp + 0x20], rcx
mov rcx, qword [rsp + 0x58]
mov qword [rsp + 0x28], rcx
mov rcx, qword [rsp + 0x60]
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x38], rax
lea rcx, [rsp + 0x68]
mov qword [rsp + 0x40], rcx
lea rcx, [rsp + 0x20]
mov qword [rsp], rcx
call fcn.00454220
xorps xmm15, xmm15
mov r14, qword [0x006bb258]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x18]
add rsp, 0x48
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
call fcn.00454340
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
jmp fcn.0044cbc0
Function at 0x44dd80
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x44de2f
push rbp
mov rbp, rsp
sub rsp, 0x58
mov qword [rsp + 0x70], rbx
lea rdx, [rsp + 0x68]
mov qword [rsp + 8], 0
movups xmmword [rsp + 0x10], xmm15
movups xmmword [rsp + 0x18], xmm15
movups xmmword [rsp + 0x28], xmm15
movups xmmword [rsp + 0x38], xmm15
movups xmmword [rsp + 0x48], xmm15
lea rsi, [0x0044de80]
mov qword [rsp + 0x10], rsi
mov rsi, qword [rsp + 0x60]
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdx
mov rdx, r14
mov qword [rsp + 0x28], rdx
lea rdx, [rsp + 8]
mov qword [rsp + 0x30], rdx
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x48], rcx
mov qword [rsp + 0x50], rdi
mov qword [rsp + 0x40], rbx
lea rax, [rsp + 0x10]
mov qword [rsp], rax
call fcn.00454220
xorps xmm15, xmm15
mov r14, qword [0x006bb258]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 8]
add rsp, 0x58
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
call fcn.00454340
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
nop dword [rax]
jmp fcn.0044dd80
Function at 0x456140
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x403cc3
push rbp
mov rbp, rsp
sub rsp, 0x18
mov rdx, qword [rax]
mov rcx, qword [rax + 8]
mov rax, rdx
call fcn.004088a0
add rsp, 0x18
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.00454340
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp 0x403ca0
cmp byte [0x006bb06b], 0
je 0x456155
mov rcx, qword [rax + 8]
mov rax, qword [rax]
jmp 0x453380
jmp 0x403ca0

Function at 0x456160
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
nop
mov eax, dword [rax]
movabs rcx, 0xe7037ed1a0b428db
xor rcx, rax
xor rax, rbx
xor rax, qword [0x006bb340]
movabs rdx, 0xa0761d6478bd642f
xor rdx, rax
mov rax, rcx
mul rdx
xor rax, rdx
mov rcx, rax
movabs rax, 0x1d8e4e27c47d124b
mul rcx
xor rax, rdx
nop
nop
ret
cmp byte [0x006bb06b], 0
je 0x456195
movq xmm0, rbx
pinsrd xmm0, dword [rax], 2
aesenc xmm0, xmmword [0x006bb6a0]
aesenc xmm0, xmmword [0x006bb6b0]
aesenc xmm0, xmmword [0x006bb6c0]
movq rax, xmm0
ret
jmp 0x408ac0

Function at 0x4561a0
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
nop
mov rax, qword [rax]
movabs rcx, 0xe7037ed1a0b428db
xor rcx, rax
xor rax, rbx
xor rax, qword [0x006bb340]
movabs rdx, 0xa0761d6478bd642f
xor rdx, rax
mov rax, rcx
mul rdx
xor rax, rdx
mov rcx, rax
movabs rax, 0x1d8e4e27c47d1247
mul rcx
xor rax, rdx
nop
nop
ret
cmp byte [0x006bb06b], 0
je 0x4561d6
movq xmm0, rbx
pinsrq xmm0, qword [rax], 1
aesenc xmm0, xmmword [0x006bb6a0]
aesenc xmm0, xmmword [0x006bb6b0]
aesenc xmm0, xmmword [0x006bb6c0]
movq rax, xmm0
ret
jmp 0x408b20

Function at 0x457f60
Capabilities:
Allocate thread local storage

Disassembly:
push rbp
mov rbp, rsp
mov rax, rsp
and rsp, 0xfffffffffffffff0
sub rsp, 0x30
mov qword [rsp + 0x20], rax
mov rax, qword [sym.imp.kernel32.dll_TlsAlloc]
call rax
mov rsp, qword [rsp + 0x20]
mov rcx, rax
cmp rcx, 0x40
jb 0x457f94
mov rcx, 0x28
jmp 0x457f9f
shl rcx, 3
add rcx, 0x1480
mov qword [0x006bb258], rcx
pop rbp
ret
Function at 0x463220
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x46330a
push rbp
mov rbp, rsp
sub rsp, 0x48
movabs rdx, 0x313631bd0139341e
mov qword [rsp + 0x35], rdx
movabs rdx, 0x330008313631bd01
mov qword [rsp + 0x38], rdx
movabs rdx, 0x251c29f628c40038
mov qword [rsp + 0x40], rdx
movabs rdx, 0xc0d030809110304
mov qword [rsp + 0x1f], rdx
movabs rdx, 0x100f120c0f0f0c0d
mov qword [rsp + 0x25], rdx
movabs rdx, 0x100d1100080e0e12
mov qword [rsp + 0x2d], rdx
xor eax, eax
jmp 0x4632ad
movzx r9d, byte [rsp + rsi + 0x35]
sub r9d, edx
lea edx, [r9 + 0x37]
mov byte [rsp + rdi + 0x35], dl
lea edx, [r8 + 0x37]
mov byte [rsp + rsi + 0x35], dl
add rax, 2
cmp rax, 0x16
jge 0x4632da
movzx edx, byte [rsp + rax + 0x1f]
movzx esi, byte [rsp + rax + 0x20]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x13
jae 0x4632fd
movzx r8d, byte [rsp + rdi + 0x35]
sub r8d, edx
cmp rsi, 0x13
jb 0x463290
jmp 0x4632f1
xor eax, eax
lea rbx, [rsp + 0x35]
mov ecx, 0x13
call fcn.00444780
add rsp, 0x48
pop rbp
ret
mov eax, esi
mov ecx, 0x13
call fcn.00456620
mov eax, edi
mov ecx, 0x13
call fcn.00456620
nop
call fcn.00454340
jmp fcn.00463220

Function at 0x4651c0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4652da
push rbp
mov rbp, rsp
sub rsp, 0x58
movabs rdx, 0x931534a63c3930ab
mov qword [rsp + 0x3c], rdx
movabs rdx, 0x32aba79ea337a331
mov qword [rsp + 0x44], rdx
movabs rdx, 0xfdb4852532aba79e
mov qword [rsp + 0x48], rdx
movabs rdx, 0x949b3630392130b1
mov qword [rsp + 0x50], rdx
movabs rdx, 0x1a0703120e11161b
mov qword [rsp + 0x1a], rdx
movabs rdx, 0x141a1a0703120e11
mov qword [rsp + 0x1c], rdx
movabs rdx, 0x1604070613061210
mov qword [rsp + 0x24], rdx
movabs rdx, 0x140013040e000b12
mov qword [rsp + 0x2c], rdx
movabs rdx, 0xd0d1b0c070c0906
mov qword [rsp + 0x34], rdx
xor eax, eax
jmp 0x465277
movzx r9d, byte [rsp + rsi + 0x3c]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x6b]
mov byte [rsp + rdi + 0x3c], dl
mov byte [rsp + rsi + 0x3c], r8b
add rax, 2
cmp rax, 0x22
jge 0x4652a9
movzx edx, byte [rsp + rax + 0x1a]
movzx esi, byte [rsp + rax + 0x1b]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x1c
jae 0x4652cd
movzx r8d, byte [rsp + rdi + 0x3c]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x6b]
cmp rsi, 0x1c
jb 0x46525d
jmp 0x4652c1
xor eax, eax
lea rbx, [rsp + 0x3c]
mov ecx, 0x1c
call fcn.00444780
add rsp, 0x58
pop rbp
nop
ret
mov eax, esi
mov ecx, 0x1c
call fcn.00456620
mov eax, edi
mov ecx, 0x1c
call fcn.00456620
nop
call fcn.00454340
nop
jmp fcn.004651c0
Function at 0x4657a0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4658ac
push rbp
mov rbp, rsp
sub rsp, 0x58
movabs rdx, 0x1f2f36dc1f333116
mov qword [rsp + 0x39], rdx
movabs rdx, 0x1f3631b331320537
mov qword [rsp + 0x41], rdx
movabs rdx, 0x3733db331de1321f
mov qword [rsp + 0x48], rdx
movabs rdx, 0x191f103732370639
mov qword [rsp + 0x50], rdx
movabs rdx, 0x191b181d120c031d
mov qword [rsp + 0x19], rdx
movabs rdx, 0x121e041e07061d0f
mov qword [rsp + 0x21], rdx
movabs rdx, 0x140f1c11141e0f
mov qword [rsp + 0x29], rdx
movabs rdx, 0x1c090606111c1200
mov qword [rsp + 0x31], rdx
xor eax, eax
jmp 0x465848
movzx r9d, byte [rsp + rsi + 0x39]
lea edx, [r9 + rdx]
lea edx, [rdx - 7]
mov byte [rsp + rdi + 0x39], dl
mov byte [rsp + rsi + 0x39], r8b
add rax, 2
cmp rax, 0x20
jge 0x46587c
movzx edx, byte [rsp + rax + 0x19]
movzx esi, byte [rsp + rax + 0x1a]
mov edi, edx
xor edx, esi
add edx, eax
nop
cmp rdi, 0x1f
jae 0x46589f
movzx r8d, byte [rsp + rdi + 0x39]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 7]
cmp rsi, 0x1f
jb 0x46582e
jmp 0x465893
xor eax, eax
lea rbx, [rsp + 0x39]
mov ecx, 0x1f
call fcn.00444780
add rsp, 0x58
pop rbp
ret
mov eax, esi
mov ecx, 0x1f
call fcn.00456620
mov eax, edi
mov ecx, 0x1f
call fcn.00456620
nop
call fcn.00454340
jmp fcn.004657a0

Function at 0x467bc0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x467d07
push rbp
mov rbp, rsp
sub rsp, 0x78
movabs rdx, 0x633b4a2b30303b29
mov qword [rsp + 0x53], rdx
movabs rdx, 0x4c4f655b40633b4a
mov qword [rsp + 0x58], rdx
movabs rdx, 0x7152213b30485133
mov qword [rsp + 0x60], rdx
movabs rdx, 0x56333133582e5937
mov qword [rsp + 0x68], rdx
movabs rdx, 0x557d4c8a6c364038
mov qword [rsp + 0x70], rdx
movabs rdx, 0x21923090c231201
mov qword [rsp + 0x1d], rdx
movabs rdx, 0x1b0224131e020219
mov qword [rsp + 0x23], rdx
movabs rdx, 0xb221a1706110723
mov qword [rsp + 0x2b], rdx
movabs rdx, 0x1e1405040f060700
mov qword [rsp + 0x33], rdx
movabs rdx, 0x1b160b0b090f2304
mov qword [rsp + 0x3b], rdx
movabs rdx, 0x120e1b18061e06
mov qword [rsp + 0x43], rdx
movabs rdx, 0x200c1c0a08080a21
mov qword [rsp + 0x4b], rdx
xor eax, eax
jmp 0x467ca7
movzx r9d, byte [rsp + rsi + 0x53]
sub r9d, edx
lea edx, [r9 + 0x24]
mov byte [rsp + rdi + 0x53], dl
lea edx, [r8 + 0x24]
mov byte [rsp + rsi + 0x53], dl
add rax, 2
cmp rax, 0x36
jge 0x467cd7
movzx edx, byte [rsp + rax + 0x1d]
movzx esi, byte [rsp + rax + 0x1e]
mov edi, edx
xor edx, esi
add edx, eax
nop dword [rax]
cmp rdi, 0x25
jae 0x467cfa
movzx r8d, byte [rsp + rdi + 0x53]
sub r8d, edx
cmp rsi, 0x25
jb 0x467c8a
jmp 0x467cee
xor eax, eax
lea rbx, [rsp + 0x53]
mov ecx, 0x25
call fcn.00444780
add rsp, 0x78
pop rbp
ret
mov eax, esi
mov ecx, 0x25
call fcn.00456620
mov eax, edi
mov ecx, 0x25
call fcn.00456620
nop
call fcn.00454340
jmp fcn.00467bc0
Function at 0x475ea0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x475fd8
push rbp
mov rbp, rsp
sub rsp, 0x70
movabs rdx, 0x465d674b467579b7
mov qword [rsp + 0x48], rdx
movabs rdx, 0x632baa1a392f4f12
mov qword [rsp + 0x50], rdx
movabs rdx, 0xbe38c841656c6c21
mov qword [rsp + 0x58], rdx
movabs rdx, 0x40614efe203d2d74
mov qword [rsp + 0x60], rdx
movabs rdx, 0x3a291c385abd4f15
mov qword [rsp + 0x68], rdx
movabs rdx, 0x16191425270b1a08
mov qword [rsp + 0x1c], rdx
movabs rdx, 0x23221b260e0c0606
mov qword [rsp + 0x24], rdx
movabs rdx, 0x1914050423221b26
mov qword [rsp + 0x28], rdx
movabs rdx, 0x240009051f080e1c
mov qword [rsp + 0x30], rdx
movabs rdx, 0x1d162124171c240d
mov qword [rsp + 0x38], rdx
movabs rdx, 0xa20211015230a1c
mov qword [rsp + 0x40], rdx
xor eax, eax
jmp 0x475f75
movzx r9d, byte [rsp + rsi + 0x48]
lea edx, [r9 + rdx]
lea edx, [rdx - 4]
mov byte [rsp + rdi + 0x48], dl
mov byte [rsp + rsi + 0x48], r8b
add rax, 2
cmp rax, 0x2c
jge 0x475fa8
movzx edx, byte [rsp + rax + 0x1c]
movzx esi, byte [rsp + rax + 0x1d]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x28
jae 0x475fcb
movzx r8d, byte [rsp + rdi + 0x48]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 4]
nop
cmp rsi, 0x28
jb 0x475f5b
jmp 0x475fbf
xor eax, eax
lea rbx, [rsp + 0x48]
mov ecx, 0x28
call fcn.00444780
add rsp, 0x70
pop rbp
ret
mov eax, esi
mov ecx, 0x28
call fcn.00456620
mov eax, edi
mov ecx, 0x28
call fcn.00456620
nop
call fcn.00454340
nop dword [rax]
jmp fcn.00475ea0

Function at 0x478880
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x478938
push rbp
mov rbp, rsp
sub rsp, 0x30
movabs rdx, 0x91cd968563726873
mov qword [rsp + 0x28], rdx
movabs rdx, 0x107060701010404
mov qword [rsp + 0x1e], rdx
mov word [rsp + 0x26], 0x501
xor eax, eax
jmp 0x4788d8
movzx r9d, byte [rsp + rsi + 0x28]
sub r9d, edx
lea edx, [r9 - 0x16]
mov byte [rsp + rdi + 0x28], dl
lea edx, [r8 - 0x16]
mov byte [rsp + rsi + 0x28], dl
add rax, 2
cmp rax, 0xa
jge 0x478908
movzx edx, byte [rsp + rax + 0x1e]
movzx esi, byte [rsp + rax + 0x1f]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 8
jae 0x47892b
movzx r8d, byte [rsp + rdi + 0x28]
sub r8d, edx
nop dword [rax]
cmp rsi, 8
jb 0x4788bb
jmp 0x47891f
xor eax, eax
lea rbx, [rsp + 0x28]
mov ecx, 8
call fcn.00444780
add rsp, 0x30
pop rbp
ret
mov eax, esi
mov ecx, 8
call fcn.00456620
mov eax, edi
mov ecx, 8
call fcn.00456620
nop
call fcn.00454340
nop dword [rax]
jmp fcn.00478880
Function at 0x479100
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4791c6
push rbp
mov rbp, rsp
sub rsp, 0x30
movabs rdx, 0x926c877d98727fc4
mov qword [rsp + 0x26], rdx
mov word [rsp + 0x2e], 0x9781
movabs rdx, 0x501070109030100
mov qword [rsp + 0x1c], rdx
mov word [rsp + 0x24], 0x408
xor eax, eax
jmp 0x479160
movzx r9d, byte [rsp + rsi + 0x26]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x30]
mov byte [rsp + rdi + 0x26], dl
mov byte [rsp + rsi + 0x26], r8b
add rax, 2
nop dword [rax]
cmp rax, 0xa
jge 0x479192
movzx edx, byte [rsp + rax + 0x1c]
movzx esi, byte [rsp + rax + 0x1d]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0xa
jae 0x4791b7
movzx r8d, byte [rsp + rdi + 0x26]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x30]
cmp rsi, 0xa
jb 0x479142
jmp 0x4791ab
xor eax, eax
lea rbx, [rsp + 0x26]
mov ecx, 0xa
nop
call fcn.00444780
add rsp, 0x30
pop rbp
ret
mov eax, esi
mov ecx, 0xa
call fcn.00456620
mov eax, edi
mov ecx, 0xa
nop
call fcn.00456620
nop
call fcn.00454340
jmp fcn.00479100

Function at 0x47c0e0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x47c207
push rbp
mov rbp, rsp
sub rsp, 0x60
movabs rdx, 0x4b0b0b3a0ad57916
mov qword [rsp + 0x42], rdx
movabs rdx, 0x2066bcd5cc636f1a
mov qword [rsp + 0x4a], rdx
movabs rdx, 0xb3fe790205d52066
mov qword [rsp + 0x50], rdx
movabs rdx, 0x5765d6bf6da304e1
mov qword [rsp + 0x58], rdx
movabs rdx, 0x1816121c00170703
mov qword [rsp + 0x18], rdx
movabs rdx, 0x51d03061814001a
mov qword [rsp + 0x20], rdx
movabs rdx, 0x1d03051d03061814
mov qword [rsp + 0x22], rdx
movabs rdx, 0x1808151205120211
mov qword [rsp + 0x2a], rdx
movabs rdx, 0x1b0c02020d1c061b
mov qword [rsp + 0x32], rdx
movabs rdx, 0x511071013180b17
mov qword [rsp + 0x3a], rdx
xor eax, eax
jmp 0x47c1a9
movzx r9d, byte [rsp + rsi + 0x42]
sub r9d, edx
lea edx, [r9 - 0x2a]
mov byte [rsp + rdi + 0x42], dl
lea edx, [r8 - 0x2a]
mov byte [rsp + rsi + 0x42], dl
add rax, 2
cmp rax, 0x2a
jge 0x47c1d7
movzx edx, byte [rsp + rax + 0x18]
movzx esi, byte [rsp + rax + 0x19]
mov edi, edx
xor edx, esi
add edx, eax
nop
cmp rdi, 0x1e
jae 0x47c1fa
movzx r8d, byte [rsp + rdi + 0x42]
sub r8d, edx
cmp rsi, 0x1e
jb 0x47c18c
jmp 0x47c1ee
xor eax, eax
lea rbx, [rsp + 0x42]
mov ecx, 0x1e
call fcn.00444780
add rsp, 0x60
pop rbp
ret
mov eax, esi
mov ecx, 0x1e
call fcn.00456620
mov eax, edi
mov ecx, 0x1e
call fcn.00456620
nop
call fcn.00454340
jmp fcn.0047c0e0
Function at 0x47fce0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x47fd98
push rbp
mov rbp, rsp
sub rsp, 0x30
movabs rdx, 0xb4e0b775db72c756
mov qword [rsp + 0x28], rdx
movabs rdx, 0x7050103060001
mov qword [rsp + 0x1c], rdx
mov dword [rsp + 0x24], 0x7070107
xor eax, eax
jmp 0x47fd36
movzx r9d, byte [rsp + rsi + 0x28]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x7a]
mov byte [rsp + rdi + 0x28], dl
mov byte [rsp + rsi + 0x28], r8b
add rax, 2
cmp rax, 0xc
jge 0x47fd68
movzx edx, byte [rsp + rax + 0x1c]
movzx esi, byte [rsp + rax + 0x1d]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 8
jae 0x47fd8b
movzx r8d, byte [rsp + rdi + 0x28]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x7a]
cmp rsi, 8
jb 0x47fd1c
jmp 0x47fd7f
xor eax, eax
lea rbx, [rsp + 0x28]
mov ecx, 8
call fcn.00444780
add rsp, 0x30
pop rbp
ret
mov eax, esi
mov ecx, 8
call fcn.00456620
mov eax, edi
mov ecx, 8
call fcn.00456620
nop
call fcn.00454340
nop dword [rax]
jmp fcn.0047fce0

Function at 0x481720
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x48180a
push rbp
mov rbp, rsp
sub rsp, 0x40
movabs rdx, 0x28543337e96939df
mov qword [rsp + 0x2d], rdx
movabs rdx, 0xf42b6d28543337e9
mov qword [rsp + 0x30], rdx
movabs rdx, 0x744f693dff385f00
mov qword [rsp + 0x38], rdx
movabs rdx, 0xe090f11030f0b00
mov qword [rsp + 0x19], rdx
movabs rdx, 0xd0a0b000e090f11
mov qword [rsp + 0x1d], rdx
movabs rdx, 0x611070d09040501
mov qword [rsp + 0x25], rdx
xor eax, eax
jmp 0x4817ad
movzx r9d, byte [rsp + rsi + 0x2d]
sub r9d, edx
lea edx, [r9 + 0x45]
mov byte [rsp + rdi + 0x2d], dl
lea edx, [r8 + 0x45]
mov byte [rsp + rsi + 0x2d], dl
add rax, 2
cmp rax, 0x14
jge 0x4817da
movzx edx, byte [rsp + rax + 0x19]
movzx esi, byte [rsp + rax + 0x1a]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x13
jae 0x4817fd
movzx r8d, byte [rsp + rdi + 0x2d]
sub r8d, edx
cmp rsi, 0x13
jb 0x481790
jmp 0x4817f1
xor eax, eax
lea rbx, [rsp + 0x2d]
mov ecx, 0x13
call fcn.00444780
add rsp, 0x40
pop rbp
ret
mov eax, esi
mov ecx, 0x13
call fcn.00456620
mov eax, edi
mov ecx, 0x13
call fcn.00456620
nop
call fcn.00454340
jmp fcn.00481720

Function at 0x481de0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x481e98
push rbp
mov rbp, rsp
sub rsp, 0x30
movabs rdx, 0x42fd729065a6ba4c
mov qword [rsp + 0x28], rdx
movabs rdx, 0x601010104020106
mov qword [rsp + 0x1c], rdx
mov dword [rsp + 0x24], 0x4010601
xor eax, eax
jmp 0x481e36
movzx r9d, byte [rsp + rsi + 0x28]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x2a]
mov byte [rsp + rdi + 0x28], dl
mov byte [rsp + rsi + 0x28], r8b
add rax, 2
cmp rax, 0xc
jge 0x481e68
movzx edx, byte [rsp + rax + 0x1c]
movzx esi, byte [rsp + rax + 0x1d]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 8
jae 0x481e8b
movzx r8d, byte [rsp + rdi + 0x28]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x2a]
cmp rsi, 8
jb 0x481e1c
jmp 0x481e7f
xor eax, eax
lea rbx, [rsp + 0x28]
mov ecx, 8
call fcn.00444780
add rsp, 0x30
pop rbp
ret
mov eax, esi
mov ecx, 8
call fcn.00456620
mov eax, edi
mov ecx, 8
call fcn.00456620
nop
call fcn.00454340
nop dword [rax]
jmp fcn.00481de0