joyce8/EMBER2024-capa huggingface dataset:
Function at 0x326088b00
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x326088c1d
push rbp
mov rbp, rsp
sub rsp, 0x60
movabs rdx, 0x868572676249696d
mov qword [rsp + 0x43], rdx
movabs rdx, 0x9851464d5d544379
mov qword [rsp + 0x4b], rdx
movabs rdx, 0x696457745c985146
mov qword [rsp + 0x50], rdx
movabs rdx, 0x67856273541c752c
mov qword [rsp + 0x58], rdx
movabs rdx, 0x1a0e171502021c04
mov qword [rsp + 0x1b], rdx
movabs rdx, 0x13050c0c0c090b1a
mov qword [rsp + 0x23], rdx
movabs rdx, 0x191718180808060d
mov qword [rsp + 0x2b], rdx
movabs rdx, 0xe01071b10150f13
mov qword [rsp + 0x33], rdx
movabs rdx, 0x1213080303000d
mov qword [rsp + 0x3b], rdx
xor eax, eax
jmp 0x326088bc0
movzx r9d, byte [rsp + rsi + 0x43]
sub r9d, edx
lea edx, [r9 + 0x25]
mov byte [rsp + rdi + 0x43], dl
lea edx, [r8 + 0x25]
mov byte [rsp + rsi + 0x43], dl
add rax, 2
nop word [rax + rax]
cmp rax, 0x28
jge 0x326088bed
movzx edx, byte [rsp + rax + 0x1b]
movzx esi, byte [rsp + rax + 0x1c]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x1d
jae 0x326088c10
movzx r8d, byte [rsp + rdi + 0x43]
sub r8d, edx
cmp rsi, 0x1d
jb 0x326088b9d
jmp 0x326088c04
xor eax, eax
lea rbx, [rsp + 0x43]
mov ecx, 0x1d
call fcn.32601d600
add rsp, 0x60
pop rbp
ret
mov eax, esi
mov ecx, 0x1d
call fcn.326033020
mov eax, edi
mov ecx, 0x1d
call fcn.326033020
nop
nop dword [rax]
call fcn.326030d20
jmp fcn.326088b00

Function at 0x326088c40
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x326088d26
push rbp
mov rbp, rsp
sub rsp, 0x40
movabs rdx, 0x6f4a230baf762317
mov qword [rsp + 0x31], rdx
movabs rdx, 0xda297215a56fcf6f
mov qword [rsp + 0x38], rdx
movabs rdx, 0x3040d0e05010604
mov qword [rsp + 0x1f], rdx
movabs rdx, 0xa0303040d0e0501
mov qword [rsp + 0x21], rdx
movabs rdx, 0xb030d0a00040803
mov qword [rsp + 0x29], rdx
xor eax, eax
nop
jmp 0x326088cc0
movzx r9d, byte [rsp + rsi + 0x31]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x3c]
mov byte [rsp + rdi + 0x31], dl
mov byte [rsp + rsi + 0x31], r8b
add rax, 2
nop dword [rax]
cmp rax, 0x12
jge 0x326088cf2
movzx edx, byte [rsp + rax + 0x1f]
movzx esi, byte [rsp + rax + 0x20]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0xf
jae 0x326088d17
movzx r8d, byte [rsp + rdi + 0x31]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x3c]
cmp rsi, 0xf
jb 0x326088ca2
jmp 0x326088d0b
xor eax, eax
lea rbx, [rsp + 0x31]
mov ecx, 0xf
nop
call fcn.32601d600
add rsp, 0x40
pop rbp
ret
mov eax, esi
mov ecx, 0xf
call fcn.326033020
mov eax, edi
mov ecx, 0xf
nop
call fcn.326033020
nop
call fcn.326030d20
jmp fcn.326088c40
Function at 0x3260898c0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x326089992
push rbp
mov rbp, rsp
sub rsp, 0x38
movabs rdx, 0x653a5668f70934ff
mov qword [rsp + 0x29], rdx
movabs rdx, 0x650ab946044ff165
mov qword [rsp + 0x30], rdx
movabs rdx, 0x201030c0d010300
mov qword [rsp + 0x19], rdx
movabs rdx, 0xa060106030801
mov qword [rsp + 0x21], rdx
xor eax, eax
jmp 0x32608992c
movzx r9d, byte [rsp + rsi + 0x29]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x2a]
mov byte [rsp + rdi + 0x29], dl
mov byte [rsp + rsi + 0x29], r8b
add rax, 2
cmp rax, 0x10
jge 0x32608995e
movzx edx, byte [rsp + rax + 0x19]
movzx esi, byte [rsp + rax + 0x1a]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0xf
jae 0x326089985
movzx r8d, byte [rsp + rdi + 0x29]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x2a]
cmp rsi, 0xf
jb 0x326089912
jmp 0x326089975
xor eax, eax
lea rbx, [rsp + 0x29]
mov ecx, 0xf
call fcn.32601d600
add rsp, 0x38
pop rbp
ret
mov eax, esi
mov ecx, 0xf
nop dword [rax]
call fcn.326033020
mov eax, edi
mov ecx, 0xf
call fcn.326033020
nop
call fcn.326030d20
jmp fcn.3260898c0

Function at 0x3260899a0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x326089a86
push rbp
mov rbp, rsp
sub rsp, 0x40
movabs rdx, 0x755290b643745b47
mov qword [rsp + 0x30], rdx
movabs rdx, 0xb4066d610bac65b9
mov qword [rsp + 0x38], rdx
movabs rdx, 0x10b080e06010e0c
mov qword [rsp + 0x1e], rdx
movabs rdx, 0xc0f010b080e0601
mov qword [rsp + 0x20], rdx
movabs rdx, 0x408050b010a0106
mov qword [rsp + 0x28], rdx
xor eax, eax
nop
jmp 0x326089a20
movzx r9d, byte [rsp + rsi + 0x30]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x5e]
mov byte [rsp + rdi + 0x30], dl
mov byte [rsp + rsi + 0x30], r8b
add rax, 2
nop dword [rax]
cmp rax, 0x12
jge 0x326089a52
movzx edx, byte [rsp + rax + 0x1e]
movzx esi, byte [rsp + rax + 0x1f]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x10
jae 0x326089a77
movzx r8d, byte [rsp + rdi + 0x30]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x5e]
cmp rsi, 0x10
jb 0x326089a02
jmp 0x326089a6b
xor eax, eax
lea rbx, [rsp + 0x30]
mov ecx, 0x10
nop
call fcn.32601d600
add rsp, 0x40
pop rbp
ret
mov eax, esi
mov ecx, 0x10
call fcn.326033020
mov eax, edi
mov ecx, 0x10
nop
call fcn.326033020
nop
call fcn.326030d20
jmp fcn.3260899a0
Function at 0x326089ba0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x326089c9b
push rbp
mov rbp, rsp
sub rsp, 0x48
movabs rdx, 0x65ecc216432d65d0
mov qword [rsp + 0x34], rdx
movabs rdx, 0x42a2922165ecc216
mov qword [rsp + 0x38], rdx
movabs rdx, 0x203531202a3b35c6
mov qword [rsp + 0x40], rdx
movabs rdx, 0x4090c11050b040a
mov qword [rsp + 0x18], rdx
movabs rdx, 0xb0d061104121111
mov qword [rsp + 0x20], rdx
movabs rdx, 0x110200120b0d0611
mov qword [rsp + 0x24], rdx
movabs rdx, 0x13090f0e1008120d
mov qword [rsp + 0x2c], rdx
xor eax, eax
jmp 0x326089c39
movzx r9d, byte [rsp + rsi + 0x34]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x20]
mov byte [rsp + rdi + 0x34], dl
mov byte [rsp + rsi + 0x34], r8b
add rax, 2
cmp rax, 0x1c
jge 0x326089c6b
movzx edx, byte [rsp + rax + 0x18]
movzx esi, byte [rsp + rax + 0x19]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x14
jae 0x326089c8e
movzx r8d, byte [rsp + rdi + 0x34]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x20]
cmp rsi, 0x14
jb 0x326089c1f
jmp 0x326089c82
xor eax, eax
lea rbx, [rsp + 0x34]
mov ecx, 0x14
call fcn.32601d600
add rsp, 0x48
pop rbp
ret
mov eax, esi
mov ecx, 0x14
call fcn.326033020
mov eax, edi
mov ecx, 0x14
call fcn.326033020
nop
nop dword [rax + rax]
call fcn.326030d20
jmp fcn.326089ba0

Function at 0x32608ab20
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x32608ac06
push rbp
mov rbp, rsp
sub rsp, 0x40
movabs rdx, 0x50f46ca74640ea92
mov qword [rsp + 0x30], rdx
movabs rdx, 0xef2f6d61a1f7d8e9
mov qword [rsp + 0x38], rdx
movabs rdx, 0x6080b0f0902000b
mov qword [rsp + 0x18], rdx
movabs rdx, 0xa0e010001040806
mov qword [rsp + 0x20], rdx
movabs rdx, 0x10b040e0002000f
mov qword [rsp + 0x28], rdx
xor eax, eax
nop
jmp 0x32608aba0
movzx r9d, byte [rsp + rsi + 0x30]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x27]
mov byte [rsp + rdi + 0x30], dl
mov byte [rsp + rsi + 0x30], r8b
add rax, 2
nop dword [rax]
cmp rax, 0x18
jge 0x32608abd2
movzx edx, byte [rsp + rax + 0x18]
movzx esi, byte [rsp + rax + 0x19]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x10
jae 0x32608abf7
movzx r8d, byte [rsp + rdi + 0x30]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x27]
cmp rsi, 0x10
jb 0x32608ab82
jmp 0x32608abeb
xor eax, eax
lea rbx, [rsp + 0x30]
mov ecx, 0x10
nop
call fcn.32601d600
add rsp, 0x40
pop rbp
ret
mov eax, esi
mov ecx, 0x10
call fcn.326033020
mov eax, edi
mov ecx, 0x10
nop
call fcn.326033020
nop
call fcn.326030d20
jmp fcn.32608ab20
Function at 0x32608b9c0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x32608ba8c
push rbp
mov rbp, rsp
sub rsp, 0x38
movabs rdx, 0xf7938cae4274dca9
mov qword [rsp + 0x2c], rdx
mov dword [rsp + 0x34], 0xba689dfa
movabs rdx, 0x307040100080303
mov qword [rsp + 0x1c], rdx
movabs rdx, 0x6030407090b0005
mov qword [rsp + 0x24], rdx
xor eax, eax
jmp 0x32608ba25
movzx r9d, byte [rsp + rsi + 0x2c]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x52]
mov byte [rsp + rdi + 0x2c], dl
mov byte [rsp + rsi + 0x2c], r8b
add rax, 2
cmp rax, 0x10
jge 0x32608ba5c
movzx edx, byte [rsp + rax + 0x1c]
movzx esi, byte [rsp + rax + 0x1d]
mov edi, edx
xor edx, esi
add edx, eax
nop dword [rax + rax]
cmp rdi, 0xc
jae 0x32608ba7f
movzx r8d, byte [rsp + rdi + 0x2c]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x52]
cmp rsi, 0xc
jb 0x32608ba0b
jmp 0x32608ba73
xor eax, eax
lea rbx, [rsp + 0x2c]
mov ecx, 0xc
call fcn.32601d600
add rsp, 0x38
pop rbp
ret
mov eax, esi
mov ecx, 0xc
call fcn.326033020
mov eax, edi
mov ecx, 0xc
call fcn.326033020
nop
call fcn.326030d20
jmp fcn.32608b9c0

Function at 0x32608baa0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x32608bb9d
push rbp
mov rbp, rsp
sub rsp, 0x48
movabs rdx, 0xcd65afb59674349c
mov qword [rsp + 0x32], rdx
movabs rdx, 0xe06e49f06e74cd65
mov qword [rsp + 0x38], rdx
movabs rdx, 0x6e6f6caa89d7c601
mov qword [rsp + 0x40], rdx
movabs rdx, 0x8001103070f0a10
mov qword [rsp + 0x18], rdx
movabs rdx, 0xd070412130e1301
mov qword [rsp + 0x20], rdx
movabs rdx, 0x130e0d070412130e
mov qword [rsp + 0x22], rdx
movabs rdx, 0x70a05100f050f01
mov qword [rsp + 0x2a], rdx
xor eax, eax
jmp 0x32608bb40
movzx r9d, byte [rsp + rsi + 0x32]
sub r9d, edx
lea edx, [r9 - 0x1f]
mov byte [rsp + rdi + 0x32], dl
lea edx, [r8 - 0x1f]
mov byte [rsp + rsi + 0x32], dl
add rax, 2
nop dword [rax]
cmp rax, 0x1a
jge 0x32608bb6d
movzx edx, byte [rsp + rax + 0x18]
movzx esi, byte [rsp + rax + 0x19]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x16
jae 0x32608bb90
movzx r8d, byte [rsp + rdi + 0x32]
sub r8d, edx
cmp rsi, 0x16
jb 0x32608bb1f
jmp 0x32608bb84
xor eax, eax
lea rbx, [rsp + 0x32]
mov ecx, 0x16
call fcn.32601d600
add rsp, 0x48
pop rbp
ret
mov eax, esi
mov ecx, 0x16
call fcn.326033020
mov eax, edi
mov ecx, 0x16
call fcn.326033020
nop
nop dword [rax]
call fcn.326030d20
jmp fcn.32608baa0
Function at 0x32608c280
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x32608c352
push rbp
mov rbp, rsp
sub rsp, 0x38
movabs rdx, 0x4f9c7d9d8c94c74d
mov qword [rsp + 0x2b], rdx
movabs rdx, 0x7dd1699b664f9c7d
mov qword [rsp + 0x30], rdx
movabs rdx, 0x101020b06090406
mov qword [rsp + 0x1d], rdx
movabs rdx, 0x10c020103050101
mov qword [rsp + 0x23], rdx
xor eax, eax
jmp 0x32608c2ec
movzx r9d, byte [rsp + rsi + 0x2b]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x35]
mov byte [rsp + rdi + 0x2b], dl
mov byte [rsp + rsi + 0x2b], r8b
add rax, 2
cmp rax, 0xe
jge 0x32608c31e
movzx edx, byte [rsp + rax + 0x1d]
movzx esi, byte [rsp + rax + 0x1e]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0xd
jae 0x32608c345
movzx r8d, byte [rsp + rdi + 0x2b]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x35]
cmp rsi, 0xd
jb 0x32608c2d2
jmp 0x32608c335
xor eax, eax
lea rbx, [rsp + 0x2b]
mov ecx, 0xd
call fcn.32601d600
add rsp, 0x38
pop rbp
ret
mov eax, esi
mov ecx, 0xd
nop dword [rax]
call fcn.326033020
mov eax, edi
mov ecx, 0xd
call fcn.326033020
nop
call fcn.326030d20
jmp fcn.32608c280

Function at 0x32608c5a0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x32608c6bd
push rbp
mov rbp, rsp
sub rsp, 0x58
movabs rdx, 0x150349f80f372e3d
mov qword [rsp + 0x3e], rdx
movabs rdx, 0x915870206f21f009
mov qword [rsp + 0x46], rdx
movabs rdx, 0x38ed915870206f21
mov qword [rsp + 0x48], rdx
movabs rdx, 0xf0872961fb116ed5
mov qword [rsp + 0x50], rdx
movabs rdx, 0x19020218190f0117
mov qword [rsp + 0x18], rdx
movabs rdx, 0xa14071012151902
mov qword [rsp + 0x1e], rdx
movabs rdx, 0x80707090f020311
mov qword [rsp + 0x26], rdx
movabs rdx, 0x415120706041905
mov qword [rsp + 0x2e], rdx
movabs rdx, 0x110f100e0c000605
mov qword [rsp + 0x36], rdx
xor eax, eax
jmp 0x32608c660
movzx r9d, byte [rsp + rsi + 0x3e]
sub r9d, edx
lea edx, [r9 + 0x5c]
mov byte [rsp + rdi + 0x3e], dl
lea edx, [r8 + 0x5c]
mov byte [rsp + rsi + 0x3e], dl
add rax, 2
nop word [rax + rax]
cmp rax, 0x26
jge 0x32608c68d
movzx edx, byte [rsp + rax + 0x18]
movzx esi, byte [rsp + rax + 0x19]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x1a
jae 0x32608c6b0
movzx r8d, byte [rsp + rdi + 0x3e]
sub r8d, edx
cmp rsi, 0x1a
jb 0x32608c63d
jmp 0x32608c6a4
xor eax, eax
lea rbx, [rsp + 0x3e]
mov ecx, 0x1a
call fcn.32601d600
add rsp, 0x58
pop rbp
ret
mov eax, esi
mov ecx, 0x1a
call fcn.326033020
mov eax, edi
mov ecx, 0x1a
call fcn.326033020
nop
nop dword [rax]
call fcn.326030d20
jmp fcn.32608c5a0
Function at 0x32608cec0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x32608cf87
push rbp
mov rbp, rsp
sub rsp, 0x38
movabs rdx, 0x7762646e506b4946
mov qword [rsp + 0x2c], rdx
mov dword [rsp + 0x34], 0x656c764d
movabs rdx, 0x607080702090100
mov qword [rsp + 0x1e], rdx
movabs rdx, 0x801030603030607
mov qword [rsp + 0x24], rdx
xor eax, eax
jmp 0x32608cf28
movzx r9d, byte [rsp + rsi + 0x2c]
sub r9d, edx
lea edx, [r9 + 0xb]
mov byte [rsp + rdi + 0x2c], dl
lea edx, [r8 + 0xb]
mov byte [rsp + rsi + 0x2c], dl
add rax, 2
cmp rax, 0xe
jge 0x32608cf57
movzx edx, byte [rsp + rax + 0x1e]
movzx esi, byte [rsp + rax + 0x1f]
mov edi, edx
xor edx, esi
add edx, eax
nop
cmp rdi, 0xc
jae 0x32608cf7a
movzx r8d, byte [rsp + rdi + 0x2c]
sub r8d, edx
cmp rsi, 0xc
jb 0x32608cf0b
jmp 0x32608cf6e
xor eax, eax
lea rbx, [rsp + 0x2c]
mov ecx, 0xc
call fcn.32601d600
add rsp, 0x38
pop rbp
ret
mov eax, esi
mov ecx, 0xc
call fcn.326033020
mov eax, edi
mov ecx, 0xc
call fcn.326033020
nop
call fcn.326030d20
jmp fcn.32608cec0

Function at 0x32608e020
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x32608e0e7
push rbp
mov rbp, rsp
sub rsp, 0x38
movabs rdx, 0x516c685d573b4756
mov qword [rsp + 0x2d], rdx
mov dword [rsp + 0x34], 0x63715751
movabs rdx, 0x50a010307020808
mov qword [rsp + 0x1f], rdx
movabs rdx, 0x90203050504050a
mov qword [rsp + 0x25], rdx
xor eax, eax
jmp 0x32608e088
movzx r9d, byte [rsp + rsi + 0x2d]
sub r9d, edx
lea edx, [r9 + 0x18]
mov byte [rsp + rdi + 0x2d], dl
lea edx, [r8 + 0x18]
mov byte [rsp + rsi + 0x2d], dl
add rax, 2
cmp rax, 0xe
jge 0x32608e0b7
movzx edx, byte [rsp + rax + 0x1f]
movzx esi, byte [rsp + rax + 0x20]
mov edi, edx
xor edx, esi
add edx, eax
nop
cmp rdi, 0xb
jae 0x32608e0da
movzx r8d, byte [rsp + rdi + 0x2d]
sub r8d, edx
cmp rsi, 0xb
jb 0x32608e06b
jmp 0x32608e0ce
xor eax, eax
lea rbx, [rsp + 0x2d]
mov ecx, 0xb
call fcn.32601d600
add rsp, 0x38
pop rbp
ret
mov eax, esi
mov ecx, 0xb
call fcn.326033020
mov eax, edi
mov ecx, 0xb
call fcn.326033020
nop
call fcn.326030d20
jmp fcn.32608e020

Function at 0x3260902c0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x32609037d
push rbp
mov rbp, rsp
sub rsp, 0x30
movabs rdx, 0x5464a4dc53410ed9
mov qword [rsp + 0x27], rdx
mov byte [rsp + 0x2f], 0xed
movabs rdx, 0x405040800010500
mov qword [rsp + 0x1d], rdx
mov word [rsp + 0x25], 0x801
xor eax, eax
nop
jmp 0x326090320
movzx r9d, byte [rsp + rsi + 0x27]
sub r9d, edx
lea edx, [r9 + 0x4c]
mov byte [rsp + rdi + 0x27], dl
lea edx, [r8 + 0x4c]
mov byte [rsp + rsi + 0x27], dl
add rax, 2
nop
cmp rax, 0xa
jge 0x32609034d
movzx edx, byte [rsp + rax + 0x1d]
movzx esi, byte [rsp + rax + 0x1e]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 9
jae 0x326090370
movzx r8d, byte [rsp + rdi + 0x27]
sub r8d, edx
cmp rsi, 9
jb 0x326090302
jmp 0x326090364
xor eax, eax
lea rbx, [rsp + 0x27]
mov ecx, 9
call fcn.32601d600
add rsp, 0x30
pop rbp
ret
mov eax, esi
mov ecx, 9
call fcn.326033020
mov eax, edi
mov ecx, 9
call fcn.326033020
nop
nop dword [rax]
call fcn.326030d20
jmp fcn.3260902c0
Function at 0x326090f40
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x326090ff8
push rbp
mov rbp, rsp
sub rsp, 0x30
movabs rdx, 0x5f5f4c6028756853
mov qword [rsp + 0x28], rdx
movabs rdx, 0x6070705060003
mov qword [rsp + 0x1c], rdx
mov dword [rsp + 0x24], 0x4060303
xor eax, eax
jmp 0x326090f96
movzx r9d, byte [rsp + rsi + 0x28]
lea edx, [r9 + rdx]
lea edx, [rdx + 0xb]
mov byte [rsp + rdi + 0x28], dl
mov byte [rsp + rsi + 0x28], r8b
add rax, 2
cmp rax, 0xc
jge 0x326090fc8
movzx edx, byte [rsp + rax + 0x1c]
movzx esi, byte [rsp + rax + 0x1d]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 8
jae 0x326090feb
movzx r8d, byte [rsp + rdi + 0x28]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0xb]
cmp rsi, 8
jb 0x326090f7c
jmp 0x326090fdf
xor eax, eax
lea rbx, [rsp + 0x28]
mov ecx, 8
call fcn.32601d600
add rsp, 0x30
pop rbp
ret
mov eax, esi
mov ecx, 8
call fcn.326033020
mov eax, edi
mov ecx, 8
call fcn.326033020
nop
call fcn.326030d20
nop dword [rax]
jmp fcn.326090f40

Function at 0x326091a20
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x326091aea
push rbp
mov rbp, rsp
sub rsp, 0x48
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rbx
mov qword [rsp], rax
mov qword [rsp + 8], rbx
mov byte [rsp + 0x10], 0
call fcn.325fd3620
xorps xmm15, xmm15
mov r14, qword [0x326266318]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x18], 0xffffffffffffffff
jne 0x326091acf
mov rcx, qword [rsp + 0x60]
lea rdx, [rcx + 1]
mov qword [rsp + 0x40], rdx
lea rax, [0x3260e7da0]
xor ebx, ebx
mov rcx, rdx
call fcn.326019480
mov rbx, qword [rsp + 0x60]
mov rcx, rax
xor edi, edi
mov rsi, qword [rsp + 0x40]
mov rax, qword [rsp + 0x58]
nop dword [rax]
call fcn.326092080
inc rbx
cmp rcx, rbx
jae 0x326091abe
mov edi, 1
lea rsi, [0x3260e7da0]
call fcn.326019560
mov word [rax + rbx*2 - 2], 0
xor edi, edi
xor esi, esi
add rsp, 0x48
pop rbp
ret
xor eax, eax
xor ebx, ebx
mov rcx, rbx
lea rdi, [0x32612cfb8]
lea rsi, [0x32612cc38]
add rsp, 0x48
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.326030d20
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.326091a20
Function at 0x326094820
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x3260948f2
push rbp
mov rbp, rsp
sub rsp, 0x38
movabs rdx, 0x9205c050c670852
mov qword [rsp + 0x2b], rdx
movabs rdx, 0x970c0d4bb109205c
mov qword [rsp + 0x30], rdx
movabs rdx, 0xa050803060b0c04
mov qword [rsp + 0x1d], rdx
movabs rdx, 0x1070403010a0a05
mov qword [rsp + 0x23], rdx
xor eax, eax
jmp 0x32609488c
movzx r9d, byte [rsp + rsi + 0x2b]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x4a]
mov byte [rsp + rdi + 0x2b], dl
mov byte [rsp + rsi + 0x2b], r8b
add rax, 2
cmp rax, 0xe
jge 0x3260948be
movzx edx, byte [rsp + rax + 0x1d]
movzx esi, byte [rsp + rax + 0x1e]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0xd
jae 0x3260948e5
movzx r8d, byte [rsp + rdi + 0x2b]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x4a]
cmp rsi, 0xd
jb 0x326094872
jmp 0x3260948d5
xor eax, eax
lea rbx, [rsp + 0x2b]
mov ecx, 0xd
call fcn.32601d600
add rsp, 0x38
pop rbp
ret
mov eax, esi
mov ecx, 0xd
nop dword [rax]
call fcn.326033020
mov eax, edi
mov ecx, 0xd
call fcn.326033020
nop
call fcn.326030d20
jmp fcn.326094820

Function at 0x326094900
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x3260949ec
push rbp
mov rbp, rsp
sub rsp, 0x48
movabs rdx, 0x2b2c61240167653b
mov qword [rsp + 0x37], rdx
movabs rdx, 0x5f2b2c6124016765
mov qword [rsp + 0x38], rdx
movabs rdx, 0xd367107e1e740d7f
mov qword [rsp + 0x40], rdx
movabs rdx, 0xa08000e0d06100a
mov qword [rsp + 0x1f], rdx
movabs rdx, 0x309060c070e060a
mov qword [rsp + 0x27], rdx
movabs rdx, 0xc040a0303070303
mov qword [rsp + 0x2f], rdx
xor eax, eax
jmp 0x32609498a
movzx r9d, byte [rsp + rsi + 0x37]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x30]
mov byte [rsp + rdi + 0x37], dl
mov byte [rsp + rsi + 0x37], r8b
add rax, 2
cmp rax, 0x18
jge 0x3260949bc
movzx edx, byte [rsp + rax + 0x1f]
movzx esi, byte [rsp + rax + 0x20]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x11
jae 0x3260949df
movzx r8d, byte [rsp + rdi + 0x37]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x30]
cmp rsi, 0x11
jb 0x326094970
jmp 0x3260949d3
xor eax, eax
lea rbx, [rsp + 0x37]
mov ecx, 0x11
call fcn.32601d600
add rsp, 0x48
pop rbp
ret
mov eax, esi
mov ecx, 0x11
call fcn.326033020
mov eax, edi
mov ecx, 0x11
call fcn.326033020
nop
call fcn.326030d20
jmp fcn.326094900
Function at 0x3260960a0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x32609618a
push rbp
mov rbp, rsp
sub rsp, 0x48
movabs rdx, 0x206f3c5e3b04534d
mov qword [rsp + 0x33], rdx
movabs rdx, 0x5c481cd93a206f3c
mov qword [rsp + 0x38], rdx
movabs rdx, 0x5b6d59544cf5503e
mov qword [rsp + 0x40], rdx
movabs rdx, 0x100a080f0b020a09
mov qword [rsp + 0x1b], rdx
movabs rdx, 0x80301120e090d05
mov qword [rsp + 0x23], rdx
movabs rdx, 0xb04140c03080b0b
mov qword [rsp + 0x2b], rdx
xor eax, eax
jmp 0x32609612d
movzx r9d, byte [rsp + rsi + 0x33]
sub r9d, edx
lea edx, [r9 + 0x35]
mov byte [rsp + rdi + 0x33], dl
lea edx, [r8 + 0x35]
mov byte [rsp + rsi + 0x33], dl
add rax, 2
cmp rax, 0x18
jge 0x32609615a
movzx edx, byte [rsp + rax + 0x1b]
movzx esi, byte [rsp + rax + 0x1c]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x15
jae 0x32609617d
movzx r8d, byte [rsp + rdi + 0x33]
sub r8d, edx
cmp rsi, 0x15
jb 0x326096110
jmp 0x326096171
xor eax, eax
lea rbx, [rsp + 0x33]
mov ecx, 0x15
call fcn.32601d600
add rsp, 0x48
pop rbp
ret
mov eax, esi
mov ecx, 0x15
call fcn.326033020
mov eax, edi
mov ecx, 0x15
call fcn.326033020
nop
call fcn.326030d20
jmp fcn.3260960a0

Function at 0x326096920
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x326096a1d
push rbp
mov rbp, rsp
sub rsp, 0x48
movabs rdx, 0x922e0d6bca0ec31a
mov qword [rsp + 0x33], rdx
movabs rdx, 0x646e25ebd1922e0d
mov qword [rsp + 0x38], rdx
movabs rdx, 0x193269db369d9ce9
mov qword [rsp + 0x40], rdx
movabs rdx, 0x308110f0d140701
mov qword [rsp + 0x19], rdx
movabs rdx, 0x9060f0e03141105
mov qword [rsp + 0x21], rdx
movabs rdx, 0x10009060f0e0314
mov qword [rsp + 0x23], rdx
movabs rdx, 0xa050f1002081306
mov qword [rsp + 0x2b], rdx
xor eax, eax
jmp 0x3260969c0
movzx r9d, byte [rsp + rsi + 0x33]
sub r9d, edx
lea edx, [r9 + 0x63]
mov byte [rsp + rdi + 0x33], dl
lea edx, [r8 + 0x63]
mov byte [rsp + rsi + 0x33], dl
add rax, 2
nop dword [rax]
cmp rax, 0x1a
jge 0x3260969ed
movzx edx, byte [rsp + rax + 0x19]
movzx esi, byte [rsp + rax + 0x1a]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x15
jae 0x326096a10
movzx r8d, byte [rsp + rdi + 0x33]
sub r8d, edx
cmp rsi, 0x15
jb 0x32609699f
jmp 0x326096a04
xor eax, eax
lea rbx, [rsp + 0x33]
mov ecx, 0x15
call fcn.32601d600
add rsp, 0x48
pop rbp
ret
mov eax, esi
mov ecx, 0x15
call fcn.326033020
mov eax, edi
mov ecx, 0x15
call fcn.326033020
nop
nop dword [rax]
call fcn.326030d20
jmp fcn.326096920