joyce8/EMBER2024-capa huggingface dataset:
Function at 0x44dac0
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x44db79
sub rsp, 0x60
mov qword [rsp + 0x58], rbp
lea rbp, [rsp + 0x58]
mov qword [rsp + 0x70], rbx
mov qword [rsp + 8], 0
movups xmmword [rsp + 0x10], xmm15
movups xmmword [rsp + 0x18], xmm15
movups xmmword [rsp + 0x28], xmm15
movups xmmword [rsp + 0x38], xmm15
movups xmmword [rsp + 0x48], xmm15
lea rdx, [0x0044dbc0]
mov qword [rsp + 0x10], rdx
lea rdx, [rsp + 8]
mov qword [rsp + 0x18], rdx
mov rdx, qword [rsp + 0x60]
mov qword [rsp + 0x20], rdx
lea rdx, [rsp + 0x68]
mov qword [rsp + 0x28], rdx
mov rdx, r14
mov qword [rsp + 0x30], rdx
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x48], rcx
mov qword [rsp + 0x50], rdi
lea rax, [rsp + 0x10]
mov qword [rsp], rax
call fcn.00454c80
xorps xmm15, xmm15
mov r14, qword [0x00ce5578]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 8]
mov rbp, qword [rsp + 0x58]
add rsp, 0x60
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
call fcn.00454dc0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
jmp fcn.0044dac0
Function at 0x456e60
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x40342f
sub rsp, 0x20
mov qword [rsp + 0x18], rbp
lea rbp, [rsp + 0x18]
mov rdx, qword [rax]
mov rcx, qword [rax + 8]
mov rax, rdx
nop
call fcn.004088e0
mov rbp, qword [rsp + 0x18]
add rsp, 0x20
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.00454dc0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp 0x403400
cmp byte [0x00ce538f], 0
je 0x456e75
mov rcx, qword [rax + 8]
mov rax, qword [rax]
jmp 0x453ec0
jmp 0x403400

Function at 0x456e80
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
mov eax, dword [rax]
movabs rcx, 0xe7037ed1a0b428db
xor rcx, rax
xor rax, rbx
xor rax, qword [0x00ce56a0]
movabs rdx, 0xa0761d6478bd642f
xor rdx, rax
mov rax, rcx
mul rdx
xor rax, rdx
mov rcx, rax
movabs rax, 0x1d8e4e27c47d124b
mul rcx
nop
nop
xor rax, rdx
ret
cmp byte [0x00ce538f], 0
je 0x456eb5
movq xmm0, rbx
pinsrd xmm0, dword [rax], 2
aesenc xmm0, xmmword [0x00ce5a20]
aesenc xmm0, xmmword [0x00ce5a30]
aesenc xmm0, xmmword [0x00ce5a40]
movq rax, xmm0
ret
jmp 0x408ae0

Function at 0x456ec0
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
mov rax, qword [rax]
movabs rcx, 0xe7037ed1a0b428db
xor rcx, rax
xor rax, rbx
xor rax, qword [0x00ce56a0]
movabs rdx, 0xa0761d6478bd642f
xor rdx, rax
mov rax, rcx
mul rdx
xor rax, rdx
mov rcx, rax
movabs rax, 0x1d8e4e27c47d1247
mul rcx
nop
nop
xor rax, rdx
ret
cmp byte [0x00ce538f], 0
je 0x456ef6
movq xmm0, rbx
pinsrq xmm0, qword [rax], 1
aesenc xmm0, xmmword [0x00ce5a20]
aesenc xmm0, xmmword [0x00ce5a30]
aesenc xmm0, xmmword [0x00ce5a40]
movq rax, xmm0
ret
jmp 0x408b40

Function at 0x458900
Capabilities:
Write file on windows

Disassembly:
sub rsp, 0x30
mov rcx, 0xfffffffffffffff4
mov qword [rsp], rcx
mov rax, qword [sym.imp.kernel32.dll_GetStdHandle]
call rax
mov rcx, rax
mov qword [rsp], rcx
lea rdx, [0x00ce59a0]
mov qword [rsp + 8], rdx
lea r8d, [0x00ce53a8]
mov qword [rsp + 0x10], r8
lea r9, [rsp + 0x28]
mov qword [r9], 0
mov qword [rsp + 0x18], r9
mov qword [rsp + 0x20], 0
mov rax, qword [sym.imp.kernel32.dll_WriteFile]
call rax
call fcn.00456da0
add rsp, 0x30
ret

Function at 0x458e40
Capabilities:
Allocate thread local storage

Disassembly:
mov rax, rsp
and rsp, 0xfffffffffffffff0
sub rsp, 0x30
mov qword [rsp + 0x20], rax
mov rax, qword [sym.imp.kernel32.dll_TlsAlloc]
call rax
mov rsp, qword [rsp + 0x20]
mov rcx, rax
cmp rcx, 0x40
jb 0x458e6c
call fcn.00456da0
shl rcx, 3
add rcx, 0x1480
mov qword [0x00ce5578], rcx
ret
Function at 0x45f460
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x45f568
sub rsp, 0x58
mov qword [rsp + 0x50], rbp
lea rbp, [rsp + 0x50]
movabs rdx, 0x547e636a6a748f72
mov qword [rsp + 0x1a], rdx
movabs rdx, 0x615697658c53547e
mov qword [rsp + 0x20], rdx
movabs rdx, 0x78866b547271872d
mov qword [rsp + 0x28], rdx
movabs rdx, 0x704080f02111109
mov qword [rsp + 0x30], rdx
movabs rdx, 0x110b031015061513
mov qword [rsp + 0x38], rdx
movabs rdx, 0x11020e0b1407140f
mov qword [rsp + 0x40], rdx
movabs rdx, 0x113110713081502
mov qword [rsp + 0x48], rdx
xor eax, eax
jmp 0x45f502
movzx r9d, byte [rsp + rsi + 0x1a]
sub r9d, edx
lea edx, [r9 + 0x1a]
mov byte [rsp + rdi + 0x1a], dl
lea edx, [r8 + 0x1a]
mov byte [rsp + rsi + 0x1a], dl
add rax, 2
cmp rax, 0x20
jge 0x45f52f
movzx edx, byte [rsp + rax + 0x30]
movzx esi, byte [rsp + rax + 0x31]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x16
jae 0x45f55b
movzx r8d, byte [rsp + rdi + 0x1a]
sub r8d, edx
cmp rsi, 0x16
jb 0x45f4e5
jmp 0x45f54f
xor eax, eax
lea rbx, [rsp + 0x1a]
mov ecx, 0x16
nop dword [rax + rax]
call fcn.004446e0
mov rbp, qword [rsp + 0x50]
add rsp, 0x58
ret
mov eax, esi
mov ecx, 0x16
call fcn.00457420
mov eax, edi
mov ecx, 0x16
call fcn.00457420
nop
call fcn.00454dc0
jmp fcn.0045f460

Function at 0x45f580
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x45f676
sub rsp, 0x48
mov qword [rsp + 0x40], rbp
lea rbp, [rsp + 0x40]
movabs rdx, 0xdda363976cb10b72
mov qword [rsp + 0x19], rdx
movabs rdx, 0xecdda363976cb10b
mov qword [rsp + 0x1a], rdx
movabs rdx, 0xc365a12ea395cceb
mov qword [rsp + 0x22], rdx
movabs rdx, 0x90c09080e010909
mov qword [rsp + 0x2a], rdx
movabs rdx, 0x2060e0a0b10090c
mov qword [rsp + 0x30], rdx
movabs rdx, 0x40a0c0b0e100c07
mov qword [rsp + 0x38], rdx
xor eax, eax
jmp 0x45f610
movzx r9d, byte [rsp + rsi + 0x19]
add r9d, 0xffffffb3
add edx, r9d
mov byte [rsp + rdi + 0x19], dl
mov byte [rsp + rsi + 0x19], r8b
add rax, 2
cmp rax, 0x16
jge 0x45f642
movzx edx, byte [rsp + rax + 0x2a]
movzx esi, byte [rsp + rax + 0x2b]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x11
jae 0x45f669
movzx r8d, byte [rsp + rdi + 0x19]
add r8d, 0xffffffb3
add r8d, edx
cmp rsi, 0x11
jb 0x45f5f6
nop
jmp 0x45f65d
xor eax, eax
lea rbx, [rsp + 0x19]
mov ecx, 0x11
call fcn.004446e0
mov rbp, qword [rsp + 0x40]
add rsp, 0x48
ret
mov eax, esi
mov ecx, 0x11
call fcn.00457420
mov eax, edi
mov ecx, 0x11
call fcn.00457420
nop
call fcn.00454dc0
nop dword [rax + rax]
jmp fcn.0045f580
Function at 0x460500
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4605dc
sub rsp, 0x40
mov qword [rsp + 0x38], rbp
lea rbp, [rsp + 0x38]
movabs rdx, 0x7cf93500648d65f0
mov qword [rsp + 0x1d], rdx
movabs rdx, 0xfd6ef67cf9350064
mov qword [rsp + 0x20], rdx
movabs rdx, 0x507020206000008
mov qword [rsp + 0x28], rdx
movabs rdx, 0x20507040a0a0606
mov qword [rsp + 0x30], rdx
xor eax, eax
jmp 0x460575
movzx r9d, byte [rsp + rsi + 0x1d]
sub r9d, edx
lea edx, [r9 - 0x7f]
mov byte [rsp + rdi + 0x1d], dl
lea edx, [r8 - 0x7f]
mov byte [rsp + rsi + 0x1d], dl
add rax, 2
cmp rax, 0x10
jge 0x4605a8
movzx edx, byte [rsp + rax + 0x28]
movzx esi, byte [rsp + rax + 0x29]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0xb
jae 0x4605cf
movzx r8d, byte [rsp + rdi + 0x1d]
sub r8d, edx
nop word [rax + rax]
cmp rsi, 0xb
jb 0x460558
jmp 0x4605c3
xor eax, eax
lea rbx, [rsp + 0x1d]
mov ecx, 0xb
call fcn.004446e0
mov rbp, qword [rsp + 0x38]
add rsp, 0x40
ret
mov eax, esi
mov ecx, 0xb
call fcn.00457420
mov eax, edi
mov ecx, 0xb
call fcn.00457420
nop
nop dword [rax]
call fcn.00454dc0
jmp fcn.00460500
Function at 0x4693e0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4694c8
sub rsp, 0x48
mov qword [rsp + 0x40], rbp
lea rbp, [rsp + 0x40]
movabs rdx, 0x30b8a235aabab1ae
mov qword [rsp + 0x1e], rdx
movabs rdx, 0x35c1acb827ae30b8
mov qword [rsp + 0x24], rdx
movabs rdx, 0x509060a07040c04
mov qword [rsp + 0x2c], rdx
movabs rdx, 0xb05000c0509060a
mov qword [rsp + 0x30], rdx
movabs rdx, 0x704090403080102
mov qword [rsp + 0x38], rdx
xor eax, eax
jmp 0x469461
movzx r9d, byte [rsp + rsi + 0x1e]
add r9d, 0x70
add edx, r9d
mov byte [rsp + rdi + 0x1e], dl
mov byte [rsp + rsi + 0x1e], r8b
add rax, 2
cmp rax, 0x14
jge 0x469492
movzx edx, byte [rsp + rax + 0x2c]
movzx esi, byte [rsp + rax + 0x2d]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0xe
jae 0x4694bb
movzx r8d, byte [rsp + rdi + 0x1e]
add r8d, 0x70
add r8d, edx
cmp rsi, 0xe
jb 0x469447
jmp 0x4694af
xor eax, eax
lea rbx, [rsp + 0x1e]
mov ecx, 0xe
nop
call fcn.004446e0
mov rbp, qword [rsp + 0x40]
add rsp, 0x48
ret
mov eax, esi
mov ecx, 0xe
call fcn.00457420
mov eax, edi
mov ecx, 0xe
call fcn.00457420
nop
call fcn.00454dc0
jmp fcn.004693e0

Function at 0x4694e0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4695bc
sub rsp, 0x40
mov qword [rsp + 0x38], rbp
lea rbp, [rsp + 0x38]
movabs rdx, 0x31233437d28235d7
mov qword [rsp + 0x2a], rdx
movabs rdx, 0xd032da8834363123
mov qword [rsp + 0x30], rdx
movabs rdx, 0x20d060a0d06000b
mov qword [rsp + 0x1c], rdx
movabs rdx, 0xd060d0a0203020d
mov qword [rsp + 0x22], rdx
xor eax, eax
jmp 0x469555
movzx r9d, byte [rsp + rsi + 0x2a]
sub r9d, edx
lea edx, [r9 + 0x6a]
mov byte [rsp + rdi + 0x2a], dl
lea edx, [r8 + 0x6a]
mov byte [rsp + rsi + 0x2a], dl
add rax, 2
cmp rax, 0xe
jge 0x469588
movzx edx, byte [rsp + rax + 0x1c]
movzx esi, byte [rsp + rax + 0x1d]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0xe
jae 0x4695af
movzx r8d, byte [rsp + rdi + 0x2a]
sub r8d, edx
nop word [rax + rax]
cmp rsi, 0xe
jb 0x469538
jmp 0x4695a3
xor eax, eax
lea rbx, [rsp + 0x2a]
mov ecx, 0xe
call fcn.004446e0
mov rbp, qword [rsp + 0x38]
add rsp, 0x40
ret
mov eax, esi
mov ecx, 0xe
call fcn.00457420
mov eax, edi
mov ecx, 0xe
call fcn.00457420
nop
nop dword [rax]
call fcn.00454dc0
jmp fcn.004694e0
Function at 0x469bc0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x469cb6
sub rsp, 0x48
mov qword [rsp + 0x40], rbp
lea rbp, [rsp + 0x40]
movabs rdx, 0xb072b230c7728231
mov qword [rsp + 0x1d], rdx
movabs rdx, 0x68b072b230c77282
mov qword [rsp + 0x1e], rdx
movabs rdx, 0x3532653879303502
mov qword [rsp + 0x26], rdx
movabs rdx, 0x30c05060e0e0809
mov qword [rsp + 0x2e], rdx
movabs rdx, 0x707030c05060e0e
mov qword [rsp + 0x30], rdx
movabs rdx, 0x10c080107070602
mov qword [rsp + 0x38], rdx
xor eax, eax
jmp 0x469c53
movzx r9d, byte [rsp + rsi + 0x1d]
sub r9d, edx
lea edx, [r9 - 0x32]
mov byte [rsp + rdi + 0x1d], dl
lea edx, [r8 - 0x32]
mov byte [rsp + rsi + 0x1d], dl
add rax, 2
cmp rax, 0x12
jge 0x469c82
movzx edx, byte [rsp + rax + 0x2e]
movzx esi, byte [rsp + rax + 0x2f]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x11
jae 0x469ca9
movzx r8d, byte [rsp + rdi + 0x1d]
sub r8d, edx
cmp rsi, 0x11
jb 0x469c36
nop
jmp 0x469c9d
xor eax, eax
lea rbx, [rsp + 0x1d]
mov ecx, 0x11
call fcn.004446e0
mov rbp, qword [rsp + 0x40]
add rsp, 0x48
ret
mov eax, esi
mov ecx, 0x11
call fcn.00457420
mov eax, edi
mov ecx, 0x11
call fcn.00457420
nop
call fcn.00454dc0
nop dword [rax + rax]
jmp fcn.00469bc0
Function at 0x46c560
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x46c688
sub rsp, 0x60
mov qword [rsp + 0x58], rbp
lea rbp, [rsp + 0x58]
movabs rdx, 0x547dca9337f87072
mov qword [rsp + 0x1b], rdx
movabs rdx, 0x326573316e7a3730
mov qword [rsp + 0x23], rdx
movabs rdx, 0x8ccd18326573316e
mov qword [rsp + 0x26], rdx
movabs rdx, 0x975e6f8b84303b36
mov qword [rsp + 0x2e], rdx
movabs rdx, 0xb12171411121606
mov qword [rsp + 0x36], rdx
movabs rdx, 0x18000b1217141112
mov qword [rsp + 0x38], rdx
movabs rdx, 0x5021a0404171710
mov qword [rsp + 0x40], rdx
movabs rdx, 0xe1a02191a050a0d
mov qword [rsp + 0x48], rdx
movabs rdx, 0x401170e07190410
mov qword [rsp + 0x50], rdx
xor eax, eax
jmp 0x46c620
movzx r9d, byte [rsp + rsi + 0x1b]
add r9d, 0xffffffa4
add edx, r9d
mov byte [rsp + rdi + 0x1b], dl
mov byte [rsp + rsi + 0x1b], r8b
add rax, 2
nop dword [rax]
cmp rax, 0x22
jge 0x46c651
movzx edx, byte [rsp + rax + 0x36]
movzx esi, byte [rsp + rax + 0x37]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x1b
jae 0x46c67b
movzx r8d, byte [rsp + rdi + 0x1b]
add r8d, 0xffffffa4
add r8d, edx
cmp rsi, 0x1b
jb 0x46c603
jmp 0x46c66f
xor eax, eax
lea rbx, [rsp + 0x1b]
mov ecx, 0x1b
nop dword [rax]
call fcn.004446e0
mov rbp, qword [rsp + 0x58]
add rsp, 0x60
ret
mov eax, esi
mov ecx, 0x1b
call fcn.00457420
mov eax, edi
mov ecx, 0x1b
call fcn.00457420
nop
call fcn.00454dc0
jmp fcn.0046c560
Function at 0x46d600
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x46d732
sub rsp, 0x70
mov qword [rsp + 0x68], rbp
lea rbp, [rsp + 0x68]
movabs rdx, 0x51385c667033316f
mov qword [rsp + 0x1f], rdx
movabs rdx, 0x30be17becf323737
mov qword [rsp + 0x27], rdx
movabs rdx, 0xdfdb211adff4cd30
mov qword [rsp + 0x2e], rdx
movabs rdx, 0xdc32e5c3d6213829
mov qword [rsp + 0x36], rdx
movabs rdx, 0xb1b070513000b11
mov qword [rsp + 0x3e], rdx
movabs rdx, 0x170303040c0e0d14
mov qword [rsp + 0x46], rdx
movabs rdx, 0x515170303040c0e
mov qword [rsp + 0x48], rdx
movabs rdx, 0x1a1b1914101a0d
mov qword [rsp + 0x50], rdx
movabs rdx, 0x131e1004041c051c
mov qword [rsp + 0x58], rdx
movabs rdx, 0x12161b1a0703031b
mov qword [rsp + 0x60], rdx
xor eax, eax
jmp 0x46d6cf
movzx r9d, byte [rsp + rsi + 0x1f]
sub r9d, edx
lea edx, [r9 - 0x7c]
mov byte [rsp + rdi + 0x1f], dl
lea edx, [r8 - 0x7c]
mov byte [rsp + rsi + 0x1f], dl
add rax, 2
cmp rax, 0x2a
jge 0x46d6fc
movzx edx, byte [rsp + rax + 0x3e]
movzx esi, byte [rsp + rax + 0x3f]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x1f
jae 0x46d725
movzx r8d, byte [rsp + rdi + 0x1f]
sub r8d, edx
cmp rsi, 0x1f
jb 0x46d6b2
jmp 0x46d717
xor eax, eax
lea rbx, [rsp + 0x1f]
mov ecx, 0x1f
call fcn.004446e0
mov rbp, qword [rsp + 0x68]
add rsp, 0x70
ret
mov eax, esi
mov ecx, 0x1f
nop
call fcn.00457420
mov eax, edi
mov ecx, 0x1f
call fcn.00457420
nop
call fcn.00454dc0
jmp fcn.0046d600

Function at 0x46d740
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x46d866
sub rsp, 0x68
mov qword [rsp + 0x60], rbp
lea rbp, [rsp + 0x60]
movabs rdx, 0xcc313433c8383635
mov qword [rsp + 0x1f], rdx
movabs rdx, 0x6630707f75308a46
mov qword [rsp + 0x27], rdx
movabs rdx, 0x39386c64535d7f66
mov qword [rsp + 0x2e], rdx
movabs rdx, 0x3532535b34316e5e
mov qword [rsp + 0x36], rdx
movabs rdx, 0x80d0b03071b1b13
mov qword [rsp + 0x3e], rdx
movabs rdx, 0x110b080d0b03071b
mov qword [rsp + 0x40], rdx
movabs rdx, 0x101c1810101b1411
mov qword [rsp + 0x48], rdx
movabs rdx, 0x90c121318090f17
mov qword [rsp + 0x50], rdx
movabs rdx, 0x803111811141b09
mov qword [rsp + 0x58], rdx
xor eax, eax
jmp 0x46d800
movzx r9d, byte [rsp + rsi + 0x1f]
sub r9d, edx
lea edx, [r9 - 3]
mov byte [rsp + rdi + 0x1f], dl
lea edx, [r8 - 3]
mov byte [rsp + rsi + 0x1f], dl
add rax, 2
cmp rax, 0x22
jge 0x46d82d
movzx edx, byte [rsp + rax + 0x3e]
movzx esi, byte [rsp + rax + 0x3f]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x1f
jae 0x46d854
movzx r8d, byte [rsp + rdi + 0x1f]
sub r8d, edx
cmp rsi, 0x1f
jb 0x46d7e3
jmp 0x46d848
xor eax, eax
lea rbx, [rsp + 0x1f]
mov ecx, 0x1f
call fcn.004446e0
mov rbp, qword [rsp + 0x60]
add rsp, 0x68
ret
mov eax, esi
mov ecx, 0x1f
call fcn.00457420
mov eax, edi
mov ecx, 0x1f
nop dword [rax + rax]
call fcn.00457420
nop
call fcn.00454dc0
jmp fcn.0046d740
Function at 0x46e9a0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x46eae8
sub rsp, 0x78
mov qword [rsp + 0x70], rbp
lea rbp, [rsp + 0x70]
movabs rdx, 0x3633efc05cdf0533
mov qword [rsp + 0x1e], rdx
movabs rdx, 0x38ef3633efc05cdf
mov qword [rsp + 0x20], rdx
movabs rdx, 0x32ad09f135489cc6
mov qword [rsp + 0x28], rdx
movabs rdx, 0x31eefdfe35b3e1
mov qword [rsp + 0x30], rdx
movabs rdx, 0x9de836fbfba11f9a
mov qword [rsp + 0x38], rdx
movabs rdx, 0x31d1b0c190b1a1b
mov qword [rsp + 0x40], rdx
movabs rdx, 0x15012012010b0a15
mov qword [rsp + 0x48], rdx
movabs rdx, 0xf1315191b21040f
mov qword [rsp + 0x50], rdx
movabs rdx, 0x5171e151b16190e
mov qword [rsp + 0x58], rdx
movabs rdx, 0xb1c0f0e1d08101d
mov qword [rsp + 0x60], rdx
movabs rdx, 0xc100b0b2102021c
mov qword [rsp + 0x68], rdx
xor eax, eax
nop
jmp 0x46ea80
movzx r9d, byte [rsp + rsi + 0x1e]
add r9d, 0x13
add edx, r9d
mov byte [rsp + rdi + 0x1e], dl
mov byte [rsp + rsi + 0x1e], r8b
add rax, 2
nop dword [rax]
cmp rax, 0x30
jge 0x46eab1
movzx edx, byte [rsp + rax + 0x40]
movzx esi, byte [rsp + rax + 0x41]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x22
jae 0x46eadb
movzx r8d, byte [rsp + rdi + 0x1e]
add r8d, 0x13
add r8d, edx
cmp rsi, 0x22
jb 0x46ea62
jmp 0x46eacf
xor eax, eax
lea rbx, [rsp + 0x1e]
mov ecx, 0x22
nop dword [rax]
call fcn.004446e0
mov rbp, qword [rsp + 0x70]
add rsp, 0x78
ret
mov eax, esi
mov ecx, 0x22
call fcn.00457420
mov eax, edi
mov ecx, 0x22
call fcn.00457420
nop
call fcn.00454dc0
jmp fcn.0046e9a0
Function at 0x46fa80
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x46fbc8
sub rsp, 0x70
mov qword [rsp + 0x68], rbp
lea rbp, [rsp + 0x68]
movabs rdx, 0x31f8b525ba353513
mov qword [rsp + 0x18], rdx
movabs rdx, 0x37b312bd223231f8
mov qword [rsp + 0x1e], rdx
movabs rdx, 0xb030b411c137329e
mov qword [rsp + 0x26], rdx
movabs rdx, 0x35b695933338b348
mov qword [rsp + 0x2e], rdx
movabs rdx, 0x7a3289969c1731b4
mov qword [rsp + 0x36], rdx
movabs rdx, 0x1303061a1a20120c
mov qword [rsp + 0x3e], rdx
movabs rdx, 0x9211e110a031116
mov qword [rsp + 0x46], rdx
movabs rdx, 0xa0009211e110a03
mov qword [rsp + 0x48], rdx
movabs rdx, 0xe14140014040b22
mov qword [rsp + 0x50], rdx
movabs rdx, 0x251c230a1a210405
mov qword [rsp + 0x58], rdx
movabs rdx, 0xc1b22221a251715
mov qword [rsp + 0x60], rdx
xor eax, eax
nop
jmp 0x46fb60
movzx r9d, byte [rsp + rsi + 0x18]
add r9d, 0x61
add edx, r9d
mov byte [rsp + rdi + 0x18], dl
mov byte [rsp + rsi + 0x18], r8b
add rax, 2
nop dword [rax]
cmp rax, 0x2a
jge 0x46fb91
movzx edx, byte [rsp + rax + 0x3e]
movzx esi, byte [rsp + rax + 0x3f]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x26
jae 0x46fbbb
movzx r8d, byte [rsp + rdi + 0x18]
add r8d, 0x61
add r8d, edx
cmp rsi, 0x26
jb 0x46fb42
jmp 0x46fbaf
xor eax, eax
lea rbx, [rsp + 0x18]
mov ecx, 0x26
nop dword [rax]
call fcn.004446e0
mov rbp, qword [rsp + 0x68]
add rsp, 0x70
ret
mov eax, esi
mov ecx, 0x26
call fcn.00457420
mov eax, edi
mov ecx, 0x26
call fcn.00457420
nop
call fcn.00454dc0
jmp fcn.0046fa80
Function at 0x471240
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4713a6
add rsp, 0xffffffffffffff80
mov qword [rsp + 0x78], rbp
lea rbp, [rsp + 0x78]
movabs rdx, 0x5f6431363337c65b
mov qword [rsp + 0x1c], rdx
movabs rdx, 0x7f33715f2f655cdc
mov qword [rsp + 0x24], rdx
movabs rdx, 0xfabd7f33715f2f65
mov qword [rsp + 0x26], rdx
movabs rdx, 0x346b32779039d0a7
mov qword [rsp + 0x2e], rdx
movabs rdx, 0x33bd355962625797
mov qword [rsp + 0x36], rdx
movabs rdx, 0x7566a630796339c3
mov qword [rsp + 0x3e], rdx
movabs rdx, 0x1201240a28130d0b
mov qword [rsp + 0x46], rdx
movabs rdx, 0x12141201240a2813
mov qword [rsp + 0x48], rdx
movabs rdx, 0x1828112425242711
mov qword [rsp + 0x50], rdx
movabs rdx, 0x181009071e1022
mov qword [rsp + 0x58], rdx
movabs rdx, 0xc1a011a091d141b
mov qword [rsp + 0x60], rdx
movabs rdx, 0xf2708221b20290b
mov qword [rsp + 0x68], rdx
movabs rdx, 0x160f06011c1b2215
mov qword [rsp + 0x70], rdx
xor eax, eax
jmp 0x471340
movzx r9d, byte [rsp + rsi + 0x1c]
sub r9d, edx
lea edx, [r9 + 7]
mov byte [rsp + rdi + 0x1c], dl
lea edx, [r8 + 7]
mov byte [rsp + rsi + 0x1c], dl
add rax, 2
nop dword [rax]
cmp rax, 0x32
jge 0x47136d
movzx edx, byte [rsp + rax + 0x46]
movzx esi, byte [rsp + rax + 0x47]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x2a
jae 0x471394
movzx r8d, byte [rsp + rdi + 0x1c]
sub r8d, edx
cmp rsi, 0x2a
jb 0x47131f
jmp 0x471388
xor eax, eax
lea rbx, [rsp + 0x1c]
mov ecx, 0x2a
call fcn.004446e0
mov rbp, qword [rsp + 0x78]
sub rsp, 0xffffffffffffff80
ret
mov eax, esi
mov ecx, 0x2a
call fcn.00457420
mov eax, edi
mov ecx, 0x2a
nop dword [rax + rax]
call fcn.00457420
nop
call fcn.00454dc0
jmp fcn.00471240
Function at 0x476ac0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
lea r12, [rsp - 8]
cmp r12, qword [r14 + 0x10]
jbe 0x476c46
sub rsp, 0x88
mov qword [rsp + 0x80], rbp
lea rbp, [rsp + 0x80]
movabs rdx, 0x22746e947f72a897
mov qword [rsp + 0x1d], rdx
movabs rdx, 0x1bf95c8a78fbf3f4
mov qword [rsp + 0x25], rdx
movabs rdx, 0xbc1bf95c8a78fbf3
mov qword [rsp + 0x26], rdx
movabs rdx, 0x708d715b8707003
mov qword [rsp + 0x2e], rdx
movabs rdx, 0x13e00f72a9df2fe3
mov qword [rsp + 0x36], rdx
movabs rdx, 0x65732f62201d6890
mov qword [rsp + 0x3e], rdx
movabs rdx, 0xc2206231c202008
mov qword [rsp + 0x46], rdx
movabs rdx, 0x15080f030d15100c
mov qword [rsp + 0x4e], rdx
movabs rdx, 0x201115080f030d15
mov qword [rsp + 0x50], rdx
movabs rdx, 0x170b1e000a260f07
mov qword [rsp + 0x58], rdx
movabs rdx, 0x2209070a0401180c
mov qword [rsp + 0x60], rdx
movabs rdx, 0x231f111904211c08
mov qword [rsp + 0x68], rdx
movabs rdx, 0x1e141b1714211626
mov qword [rsp + 0x70], rdx
movabs rdx, 0x1160404190e1507
mov qword [rsp + 0x78], rdx
xor eax, eax
jmp 0x476bd6
movzx r9d, byte [rsp + rsi + 0x1d]
add r9d, 0x30
add edx, r9d
mov byte [rsp + rdi + 0x1d], dl
mov byte [rsp + rsi + 0x1d], r8b
add rax, 2
cmp rax, 0x3a
jge 0x476c08
movzx edx, byte [rsp + rax + 0x46]
movzx esi, byte [rsp + rax + 0x47]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x29
jae 0x476c35
movzx r8d, byte [rsp + rdi + 0x1d]
add r8d, 0x30
add r8d, edx
nop
cmp rsi, 0x29
jb 0x476bbc
jmp 0x476c29
xor eax, eax
lea rbx, [rsp + 0x1d]
mov ecx, 0x29
call fcn.004446e0
mov rbp, qword [rsp + 0x80]
add rsp, 0x88
ret
mov eax, esi
mov ecx, 0x29
call fcn.00457420
mov eax, edi
mov ecx, 0x29
nop dword [rax]
call fcn.00457420
nop
call fcn.00454dc0
jmp fcn.00476ac0
Function at 0x47b220
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x47b316
sub rsp, 0x50
mov qword [rsp + 0x48], rbp
lea rbp, [rsp + 0x48]
movabs rdx, 0x2564699461746eaf
mov qword [rsp + 0x1f], rdx
movabs rdx, 0x622564699461746e
mov qword [rsp + 0x20], rdx
movabs rdx, 0xd62f83f3c0927438
mov qword [rsp + 0x28], rdx
movabs rdx, 0x20f090204000f07
mov qword [rsp + 0x30], rdx
movabs rdx, 0x100c0d1009090b
mov qword [rsp + 0x38], rdx
movabs rdx, 0x100c0f0b04100e07
mov qword [rsp + 0x40], rdx
xor eax, eax
jmp 0x47b2b3
movzx r9d, byte [rsp + rsi + 0x1f]
sub r9d, edx
lea edx, [r9 - 0x4a]
mov byte [rsp + rdi + 0x1f], dl
lea edx, [r8 - 0x4a]
mov byte [rsp + rsi + 0x1f], dl
add rax, 2
cmp rax, 0x18
jge 0x47b2e2
movzx edx, byte [rsp + rax + 0x30]
movzx esi, byte [rsp + rax + 0x31]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x11
jae 0x47b309
movzx r8d, byte [rsp + rdi + 0x1f]
sub r8d, edx
cmp rsi, 0x11
jb 0x47b296
nop
jmp 0x47b2fd
xor eax, eax
lea rbx, [rsp + 0x1f]
mov ecx, 0x11
call fcn.004446e0
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
mov eax, esi
mov ecx, 0x11
call fcn.00457420
mov eax, edi
mov ecx, 0x11
call fcn.00457420
nop
call fcn.00454dc0
nop dword [rax + rax]
jmp fcn.0047b220

Function at 0x47f4c0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x47f5f2
sub rsp, 0x68
mov qword [rsp + 0x60], rbp
lea rbp, [rsp + 0x60]
movabs rdx, 0xe8eb023a63b47925
mov qword [rsp + 0x1d], rdx
movabs rdx, 0xfce8eb023a63b479
mov qword [rsp + 0x1e], rdx
movabs rdx, 0x207e6fa36b637609
mov qword [rsp + 0x26], rdx
movabs rdx, 0x64650bf06f6ce575
mov qword [rsp + 0x2e], rdx
movabs rdx, 0x220cb6acf6fcee20
mov qword [rsp + 0x36], rdx
movabs rdx, 0x1b120d0d1c161608
mov qword [rsp + 0x3e], rdx
movabs rdx, 0x1c1c1b120d0d1c16
mov qword [rsp + 0x40], rdx
movabs rdx, 0x151a02051d0f0a20
mov qword [rsp + 0x48], rdx
movabs rdx, 0x202006071d00151e
mov qword [rsp + 0x50], rdx
movabs rdx, 0x1f15090f1e152000
mov qword [rsp + 0x58], rdx
xor eax, eax
jmp 0x47f58f
movzx r9d, byte [rsp + rsi + 0x1d]
sub r9d, edx
lea edx, [r9 - 0x7f]
mov byte [rsp + rdi + 0x1d], dl
lea edx, [r8 - 0x7f]
mov byte [rsp + rsi + 0x1d], dl
add rax, 2
cmp rax, 0x22
jge 0x47f5bc
movzx edx, byte [rsp + rax + 0x3e]
movzx esi, byte [rsp + rax + 0x3f]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x21
jae 0x47f5e5
movzx r8d, byte [rsp + rdi + 0x1d]
sub r8d, edx
cmp rsi, 0x21
jb 0x47f572
jmp 0x47f5d7
xor eax, eax
lea rbx, [rsp + 0x1d]
mov ecx, 0x21
call fcn.004446e0
mov rbp, qword [rsp + 0x60]
add rsp, 0x68
ret
mov eax, esi
mov ecx, 0x21
nop
call fcn.00457420
mov eax, edi
mov ecx, 0x21
call fcn.00457420
nop
call fcn.00454dc0
jmp fcn.0047f4c0