joyce8/EMBER2024-capa huggingface dataset:
Function at 0x452ba0
Capabilities:
Allocate thread local storage

Disassembly:
push rbp
mov rbp, rsp
mov rax, rsp
and rsp, 0xfffffffffffffff0
sub rsp, 0x30
mov qword [rsp + 0x20], rax
mov rax, qword [sym.imp.kernel32.dll_TlsAlloc]
call rax
mov rsp, qword [rsp + 0x20]
mov rcx, rax
cmp rcx, 0x40
jb 0x452bd4
mov rcx, 0x28
jmp 0x452bdf
shl rcx, 3
add rcx, 0x1480
mov qword [0x006eea78], rcx
pop rbp
ret

Function at 0x45b100
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x45b1fd
push rbp
mov rbp, rsp
sub rsp, 0x48
movabs rdx, 0x30454a016b653c29
mov qword [rsp + 0x34], rdx
movabs rdx, 0x5529313430454a01
mov qword [rsp + 0x38], rdx
movabs rdx, 0x73656225356f2064
mov qword [rsp + 0x40], rdx
movabs rdx, 0x6090009050f0510
mov qword [rsp + 0x1a], rdx
movabs rdx, 0xb050b0708000101
mov qword [rsp + 0x22], rdx
movabs rdx, 0x110b0b050b070800
mov qword [rsp + 0x24], rdx
movabs rdx, 0x81108130a050a04
mov qword [rsp + 0x2c], rdx
xor eax, eax
jmp 0x45b1a0
movzx r9d, byte [rsp + rsi + 0x34]
sub r9d, edx
lea edx, [r9 + 0x31]
mov byte [rsp + rdi + 0x34], dl
lea edx, [r8 + 0x31]
mov byte [rsp + rsi + 0x34], dl
add rax, 2
nop dword [rax]
cmp rax, 0x1a
jge 0x45b1cd
movzx edx, byte [rsp + rax + 0x1a]
movzx esi, byte [rsp + rax + 0x1b]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x14
jae 0x45b1f0
movzx r8d, byte [rsp + rdi + 0x34]
sub r8d, edx
cmp rsi, 0x14
jb 0x45b17f
jmp 0x45b1e4
xor eax, eax
lea rbx, [rsp + 0x34]
mov ecx, 0x14
call fcn.00440b20
add rsp, 0x48
pop rbp
ret
mov eax, esi
mov ecx, 0x14
call fcn.00451260
mov eax, edi
mov ecx, 0x14
call fcn.00451260
nop
nop dword [rax]
call fcn.0044efe0
jmp fcn.0045b100

Function at 0x45e260
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x45e31d
push rbp
mov rbp, rsp
sub rsp, 0x30
movabs rdx, 0x3129311f332f2f36
mov qword [rsp + 0x26], rdx
mov word [rsp + 0x2e], 0x2b2a
movabs rdx, 0x207020401090807
mov qword [rsp + 0x1a], rdx
mov dword [rsp + 0x22], 0x7060607
xor eax, eax
jmp 0x45e2c0
movzx r9d, byte [rsp + rsi + 0x26]
sub r9d, edx
lea edx, [r9 + 0x10]
mov byte [rsp + rdi + 0x26], dl
lea edx, [r8 + 0x10]
mov byte [rsp + rsi + 0x26], dl
add rax, 2
cmp rax, 0xc
jge 0x45e2ed
movzx edx, byte [rsp + rax + 0x1a]
movzx esi, byte [rsp + rax + 0x1b]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0xa
jae 0x45e310
movzx r8d, byte [rsp + rdi + 0x26]
sub r8d, edx
cmp rsi, 0xa
jb 0x45e2a3
jmp 0x45e304
xor eax, eax
lea rbx, [rsp + 0x26]
mov ecx, 0xa
call fcn.00440b20
add rsp, 0x30
pop rbp
ret
mov eax, esi
mov ecx, 0xa
call fcn.00451260
mov eax, edi
mov ecx, 0xa
call fcn.00451260
nop
nop dword [rax]
call fcn.0044efe0
jmp fcn.0045e260
Function at 0x45e760
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x45e838
push rbp
mov rbp, rsp
sub rsp, 0x38
movabs rdx, 0x39381038a7d805a8
mov qword [rsp + 0x2c], rdx
mov dword [rsp + 0x34], 0x3969a30
movabs rdx, 0x202090003010005
mov qword [rsp + 0x1a], rdx
movabs rdx, 0x20b020209000301
mov qword [rsp + 0x1c], rdx
movabs rdx, 0xb0b0b0b0a030202
mov qword [rsp + 0x24], rdx
xor eax, eax
jmp 0x45e7d4
movzx r9d, byte [rsp + rsi + 0x2c]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x76]
mov byte [rsp + rdi + 0x2c], dl
mov byte [rsp + rsi + 0x2c], r8b
add rax, 2
cmp rax, 0x12
jge 0x45e808
movzx edx, byte [rsp + rax + 0x1a]
movzx esi, byte [rsp + rax + 0x1b]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0xc
jae 0x45e82b
movzx r8d, byte [rsp + rdi + 0x2c]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x76]
nop
cmp rsi, 0xc
jb 0x45e7ba
jmp 0x45e81f
xor eax, eax
lea rbx, [rsp + 0x2c]
mov ecx, 0xc
call fcn.00440b20
add rsp, 0x38
pop rbp
ret
mov eax, esi
mov ecx, 0xc
call fcn.00451260
mov eax, edi
mov ecx, 0xc
call fcn.00451260
nop
call fcn.0044efe0
nop dword [rax]
jmp fcn.0045e760

Function at 0x45f880
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x45f96a
push rbp
mov rbp, rsp
sub rsp, 0x40
movabs rdx, 0xe0db94979ed4e5e2
mov qword [rsp + 0x2f], rdx
movabs rdx, 0x39e0db94979ed4e5
mov qword [rsp + 0x30], rdx
movabs rdx, 0x353ee79537ec359b
mov qword [rsp + 0x38], rdx
movabs rdx, 0x500040d050f0602
mov qword [rsp + 0x1b], rdx
movabs rdx, 0x9040e070500040d
mov qword [rsp + 0x1f], rdx
movabs rdx, 0x4010d0b030d000f
mov qword [rsp + 0x27], rdx
xor eax, eax
jmp 0x45f90d
movzx r9d, byte [rsp + rsi + 0x2f]
sub r9d, edx
lea edx, [r9 + 0x62]
mov byte [rsp + rdi + 0x2f], dl
lea edx, [r8 + 0x62]
mov byte [rsp + rsi + 0x2f], dl
add rax, 2
cmp rax, 0x14
jge 0x45f93a
movzx edx, byte [rsp + rax + 0x1b]
movzx esi, byte [rsp + rax + 0x1c]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x11
jae 0x45f95d
movzx r8d, byte [rsp + rdi + 0x2f]
sub r8d, edx
cmp rsi, 0x11
jb 0x45f8f0
jmp 0x45f951
xor eax, eax
lea rbx, [rsp + 0x2f]
mov ecx, 0x11
call fcn.00440b20
add rsp, 0x40
pop rbp
ret
mov eax, esi
mov ecx, 0x11
call fcn.00451260
mov eax, edi
mov ecx, 0x11
call fcn.00451260
nop
call fcn.0044efe0
jmp fcn.0045f880
Function at 0x460020
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x46011b
push rbp
mov rbp, rsp
sub rsp, 0x48
movabs rdx, 0x32e96332c9b5b7b2
mov qword [rsp + 0x34], rdx
movabs rdx, 0xd444d2d132e96332
mov qword [rsp + 0x38], rdx
movabs rdx, 0x47b0363034543f31
mov qword [rsp + 0x40], rdx
movabs rdx, 0xa050b0906060505
mov qword [rsp + 0x18], rdx
movabs rdx, 0x606030513050e08
mov qword [rsp + 0x20], rdx
movabs rdx, 0x20e0e0106060305
mov qword [rsp + 0x24], rdx
movabs rdx, 0x60108080d1202
mov qword [rsp + 0x2c], rdx
xor eax, eax
jmp 0x4600b9
movzx r9d, byte [rsp + rsi + 0x34]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x5e]
mov byte [rsp + rdi + 0x34], dl
mov byte [rsp + rsi + 0x34], r8b
add rax, 2
cmp rax, 0x1c
jge 0x4600eb
movzx edx, byte [rsp + rax + 0x18]
movzx esi, byte [rsp + rax + 0x19]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x14
jae 0x46010e
movzx r8d, byte [rsp + rdi + 0x34]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x5e]
cmp rsi, 0x14
jb 0x46009f
jmp 0x460102
xor eax, eax
lea rbx, [rsp + 0x34]
mov ecx, 0x14
call fcn.00440b20
add rsp, 0x48
pop rbp
ret
mov eax, esi
mov ecx, 0x14
call fcn.00451260
mov eax, edi
mov ecx, 0x14
call fcn.00451260
nop
nop dword [rax + rax]
call fcn.0044efe0
jmp fcn.00460020

Function at 0x461a40
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x461b48
push rbp
mov rbp, rsp
sub rsp, 0x50
movabs rdx, 0x352a39313535341f
mov qword [rsp + 0x36], rdx
movabs rdx, 0x7381e0e2b3c1e32
mov qword [rsp + 0x3e], rdx
movabs rdx, 0x383f07381e0e2b3c
mov qword [rsp + 0x40], rdx
movabs rdx, 0x1f17293028131f30
mov qword [rsp + 0x48], rdx
movabs rdx, 0x14141519150c0f0b
mov qword [rsp + 0x18], rdx
movabs rdx, 0x131706150017150d
mov qword [rsp + 0x20], rdx
movabs rdx, 0x100f0b09180b1317
mov qword [rsp + 0x26], rdx
movabs rdx, 0x100d021202120a13
mov qword [rsp + 0x2e], rdx
xor eax, eax
jmp 0x461aeb
movzx r9d, byte [rsp + rsi + 0x36]
sub r9d, edx
lea edx, [r9 + 0x29]
mov byte [rsp + rdi + 0x36], dl
lea edx, [r8 + 0x29]
mov byte [rsp + rsi + 0x36], dl
add rax, 2
cmp rax, 0x1e
jge 0x461b18
movzx edx, byte [rsp + rax + 0x18]
movzx esi, byte [rsp + rax + 0x19]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x1a
jae 0x461b3b
movzx r8d, byte [rsp + rdi + 0x36]
sub r8d, edx
cmp rsi, 0x1a
jb 0x461ace
jmp 0x461b2f
xor eax, eax
lea rbx, [rsp + 0x36]
mov ecx, 0x1a
call fcn.00440b20
add rsp, 0x50
pop rbp
ret
mov eax, esi
mov ecx, 0x1a
call fcn.00451260
mov eax, edi
mov ecx, 0x1a
call fcn.00451260
nop
call fcn.0044efe0
jmp fcn.00461a40
Function at 0x4635c0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4636ec
push rbp
mov rbp, rsp
sub rsp, 0x60
movabs rdx, 0xc9367f7d333dd3d7
mov qword [rsp + 0x42], rdx
movabs rdx, 0x8e4ecd73e4d034c6
mov qword [rsp + 0x4a], rdx
movabs rdx, 0x44cae5b939608e4e
mov qword [rsp + 0x50], rdx
movabs rdx, 0xedce862283373935
mov qword [rsp + 0x58], rdx
movabs rdx, 0x1a04151b0e020d1d
mov qword [rsp + 0x18], rdx
movabs rdx, 0xb041d131b10100f
mov qword [rsp + 0x20], rdx
movabs rdx, 0x190b041d131b10
mov qword [rsp + 0x22], rdx
movabs rdx, 0x71c05000b140502
mov qword [rsp + 0x2a], rdx
movabs rdx, 0x13081a100e0e1501
mov qword [rsp + 0x32], rdx
movabs rdx, 0xa080c0a120f0e02
mov qword [rsp + 0x3a], rdx
xor eax, eax
jmp 0x463686
movzx r9d, byte [rsp + rsi + 0x42]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x36]
mov byte [rsp + rdi + 0x42], dl
mov byte [rsp + rsi + 0x42], r8b
add rax, 2
cmp rax, 0x2a
jge 0x4636bc
movzx edx, byte [rsp + rax + 0x18]
movzx esi, byte [rsp + rax + 0x19]
mov edi, edx
xor edx, esi
add edx, eax
nop dword [rax]
cmp rdi, 0x1e
jae 0x4636df
movzx r8d, byte [rsp + rdi + 0x42]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x36]
cmp rsi, 0x1e
jb 0x46366c
jmp 0x4636d3
xor eax, eax
lea rbx, [rsp + 0x42]
mov ecx, 0x1e
call fcn.00440b20
add rsp, 0x60
pop rbp
ret
mov eax, esi
mov ecx, 0x1e
call fcn.00451260
mov eax, edi
mov ecx, 0x1e
call fcn.00451260
nop
call fcn.0044efe0
jmp fcn.004635c0

Function at 0x4644c0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4645f8
push rbp
mov rbp, rsp
sub rsp, 0x70
movabs rdx, 0x5c3d41346b433557
mov qword [rsp + 0x4f], rdx
movabs rdx, 0x3f5c3d41346b4335
mov qword [rsp + 0x50], rdx
movabs rdx, 0x724e30304f323637
mov qword [rsp + 0x58], rdx
movabs rdx, 0x32524d404b37384b
mov qword [rsp + 0x60], rdx
movabs rdx, 0x3d6a78442b455a36
mov qword [rsp + 0x68], rdx
movabs rdx, 0x200b060b03200f1b
mov qword [rsp + 0x1f], rdx
movabs rdx, 0x17000114061c1d1c
mov qword [rsp + 0x27], rdx
movabs rdx, 0x1002081b1a011b15
mov qword [rsp + 0x2f], rdx
movabs rdx, 0x1706000c110007
mov qword [rsp + 0x37], rdx
movabs rdx, 0x1f0b0506021e0f16
mov qword [rsp + 0x3f], rdx
movabs rdx, 0x10715020b051e1d
mov qword [rsp + 0x47], rdx
xor eax, eax
jmp 0x464598
movzx r9d, byte [rsp + rsi + 0x4f]
sub r9d, edx
lea edx, [r9 + 0x1d]
mov byte [rsp + rdi + 0x4f], dl
lea edx, [r8 + 0x1d]
mov byte [rsp + rsi + 0x4f], dl
add rax, 2
cmp rax, 0x30
jge 0x4645c8
movzx edx, byte [rsp + rax + 0x1f]
movzx esi, byte [rsp + rax + 0x20]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x21
jae 0x4645eb
movzx r8d, byte [rsp + rdi + 0x4f]
sub r8d, edx
nop dword [rax]
cmp rsi, 0x21
jb 0x46457b
jmp 0x4645df
xor eax, eax
lea rbx, [rsp + 0x4f]
mov ecx, 0x21
call fcn.00440b20
add rsp, 0x70
pop rbp
ret
mov eax, esi
mov ecx, 0x21
call fcn.00451260
mov eax, edi
mov ecx, 0x21
call fcn.00451260
nop
call fcn.0044efe0
nop dword [rax]
jmp fcn.004644c0
Function at 0x464620
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x46476c
push rbp
mov rbp, rsp
sub rsp, 0x70
movabs rdx, 0xfb36ac338a785224
mov qword [rsp + 0x4d], rdx
movabs rdx, 0xdf3998fb36ac338a
mov qword [rsp + 0x50], rdx
movabs rdx, 0x34f7ebe83598e6a2
mov qword [rsp + 0x58], rdx
movabs rdx, 0x3636a731c890f6a5
mov qword [rsp + 0x60], rdx
movabs rdx, 0x1fa2a9f8f0267fd4
mov qword [rsp + 0x68], rdx
movabs rdx, 0x100500051f180808
mov qword [rsp + 0x1b], rdx
movabs rdx, 0x307100500051f18
mov qword [rsp + 0x1d], rdx
movabs rdx, 0x220b1f081114150d
mov qword [rsp + 0x25], rdx
movabs rdx, 0x1e1c0f0b1d15221d
mov qword [rsp + 0x2d], rdx
movabs rdx, 0xf160a010d0c0d0b
mov qword [rsp + 0x35], rdx
movabs rdx, 0x1e07151b1f210002
mov qword [rsp + 0x3d], rdx
movabs rdx, 0x22130a212010000c
mov qword [rsp + 0x45], rdx
xor eax, eax
jmp 0x464704
movzx r9d, byte [rsp + rsi + 0x4d]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x2f]
mov byte [rsp + rdi + 0x4d], dl
mov byte [rsp + rsi + 0x4d], r8b
add rax, 2
cmp rax, 0x32
jge 0x46473c
movzx edx, byte [rsp + rax + 0x1b]
movzx esi, byte [rsp + rax + 0x1c]
mov edi, edx
xor edx, esi
add edx, eax
nop word [rax + rax]
cmp rdi, 0x23
jae 0x46475f
movzx r8d, byte [rsp + rdi + 0x4d]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x2f]
cmp rsi, 0x23
jb 0x4646ea
jmp 0x464753
xor eax, eax
lea rbx, [rsp + 0x4d]
mov ecx, 0x23
call fcn.00440b20
add rsp, 0x70
pop rbp
ret
mov eax, esi
mov ecx, 0x23
call fcn.00451260
mov eax, edi
mov ecx, 0x23
call fcn.00451260
nop
call fcn.0044efe0
jmp fcn.00464620

Function at 0x46ae40
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x46af0c
push rbp
mov rbp, rsp
sub rsp, 0x38
movabs rdx, 0x698568517d70828e
mov qword [rsp + 0x2c], rdx
mov dword [rsp + 0x34], 0x6e916f8c
movabs rdx, 0x60308030108000a
mov qword [rsp + 0x1e], rdx
movabs rdx, 0x405050a050603
mov qword [rsp + 0x24], rdx
xor eax, eax
jmp 0x46aea5
movzx r9d, byte [rsp + rsi + 0x2c]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x1e]
mov byte [rsp + rdi + 0x2c], dl
mov byte [rsp + rsi + 0x2c], r8b
add rax, 2
cmp rax, 0xe
jge 0x46aedc
movzx edx, byte [rsp + rax + 0x1e]
movzx esi, byte [rsp + rax + 0x1f]
mov edi, edx
xor edx, esi
add edx, eax
nop dword [rax + rax]
cmp rdi, 0xc
jae 0x46aeff
movzx r8d, byte [rsp + rdi + 0x2c]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x1e]
cmp rsi, 0xc
jb 0x46ae8b
jmp 0x46aef3
xor eax, eax
lea rbx, [rsp + 0x2c]
mov ecx, 0xc
call fcn.00440b20
add rsp, 0x38
pop rbp
ret
mov eax, esi
mov ecx, 0xc
call fcn.00451260
mov eax, edi
mov ecx, 0xc
call fcn.00451260
nop
call fcn.0044efe0
jmp fcn.0046ae40
Function at 0x46ba20
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x46bad8
push rbp
mov rbp, rsp
sub rsp, 0x30
movabs rdx, 0x59224d545b507560
mov qword [rsp + 0x28], rdx
movabs rdx, 0x4070705060602
mov qword [rsp + 0x1c], rdx
mov dword [rsp + 0x24], 0x20303
xor eax, eax
jmp 0x46ba79
movzx r9d, byte [rsp + rsi + 0x28]
sub r9d, edx
lea edx, [r9 + 0x19]
mov byte [rsp + rdi + 0x28], dl
lea edx, [r8 + 0x19]
mov byte [rsp + rsi + 0x28], dl
add rax, 2
cmp rax, 0xc
jge 0x46baa8
movzx edx, byte [rsp + rax + 0x1c]
movzx esi, byte [rsp + rax + 0x1d]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 8
jae 0x46bacb
movzx r8d, byte [rsp + rdi + 0x28]
sub r8d, edx
nop
cmp rsi, 8
jb 0x46ba5c
jmp 0x46babf
xor eax, eax
lea rbx, [rsp + 0x28]
mov ecx, 8
call fcn.00440b20
add rsp, 0x30
pop rbp
ret
mov eax, esi
mov ecx, 8
call fcn.00451260
mov eax, edi
mov ecx, 8
call fcn.00451260
nop
call fcn.0044efe0
nop dword [rax]
jmp fcn.0046ba20

Function at 0x46dbe0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x46dcca
push rbp
mov rbp, rsp
sub rsp, 0x48
movabs rdx, 0x7472707463737b49
mov qword [rsp + 0x33], rdx
movabs rdx, 0x6c7a448b56747270
mov qword [rsp + 0x38], rdx
movabs rdx, 0x88797f6c76617780
mov qword [rsp + 0x40], rdx
movabs rdx, 0x8120610080b0e0a
mov qword [rsp + 0x1b], rdx
movabs rdx, 0x13120a1405130409
mov qword [rsp + 0x23], rdx
movabs rdx, 0x80804010d060d04
mov qword [rsp + 0x2b], rdx
xor eax, eax
jmp 0x46dc6d
movzx r9d, byte [rsp + rsi + 0x33]
sub r9d, edx
lea edx, [r9 + 0x10]
mov byte [rsp + rdi + 0x33], dl
lea edx, [r8 + 0x10]
mov byte [rsp + rsi + 0x33], dl
add rax, 2
cmp rax, 0x18
jge 0x46dc9a
movzx edx, byte [rsp + rax + 0x1b]
movzx esi, byte [rsp + rax + 0x1c]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x15
jae 0x46dcbd
movzx r8d, byte [rsp + rdi + 0x33]
sub r8d, edx
cmp rsi, 0x15
jb 0x46dc50
jmp 0x46dcb1
xor eax, eax
lea rbx, [rsp + 0x33]
mov ecx, 0x15
call fcn.00440b20
add rsp, 0x48
pop rbp
ret
mov eax, esi
mov ecx, 0x15
call fcn.00451260
mov eax, edi
mov ecx, 0x15
call fcn.00451260
nop
call fcn.0044efe0
jmp fcn.0046dbe0

Function at 0x470240
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x470306
push rbp
mov rbp, rsp
sub rsp, 0x30
movabs rdx, 0x8a7394bba96e6fea
mov qword [rsp + 0x27], rdx
mov byte [rsp + 0x2f], 0x6e
movabs rdx, 0x405060304040600
mov qword [rsp + 0x1b], rdx
mov dword [rsp + 0x23], 0x6070306
xor eax, eax
nop
jmp 0x4702a0
movzx r9d, byte [rsp + rsi + 0x27]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x2c]
mov byte [rsp + rdi + 0x27], dl
mov byte [rsp + rsi + 0x27], r8b
add rax, 2
nop dword [rax]
cmp rax, 0xc
jge 0x4702d2
movzx edx, byte [rsp + rax + 0x1b]
movzx esi, byte [rsp + rax + 0x1c]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 9
jae 0x4702f7
movzx r8d, byte [rsp + rdi + 0x27]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x2c]
cmp rsi, 9
jb 0x470282
jmp 0x4702eb
xor eax, eax
lea rbx, [rsp + 0x27]
mov ecx, 9
nop
call fcn.00440b20
add rsp, 0x30
pop rbp
ret
mov eax, esi
mov ecx, 9
call fcn.00451260
mov eax, edi
mov ecx, 9
nop
call fcn.00451260
nop
call fcn.0044efe0
jmp fcn.00470240
Function at 0x470b80
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x470c3e
push rbp
mov rbp, rsp
sub rsp, 0x30
movabs rdx, 0xcc6929415fe3bcd3
mov qword [rsp + 0x25], rdx
mov dword [rsp + 0x2c], 0x40e5cbcc
movabs rdx, 0x7050a0505040209
mov qword [rsp + 0x19], rdx
mov dword [rsp + 0x21], 0x1000408
xor eax, eax
jmp 0x470be1
movzx r9d, byte [rsp + rsi + 0x25]
sub r9d, edx
lea edx, [r9 - 0x63]
mov byte [rsp + rdi + 0x25], dl
lea edx, [r8 - 0x63]
mov byte [rsp + rsi + 0x25], dl
add rax, 2
cmp rax, 0xc
jge 0x470c0e
movzx edx, byte [rsp + rax + 0x19]
movzx esi, byte [rsp + rax + 0x1a]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0xb
jae 0x470c31
movzx r8d, byte [rsp + rdi + 0x25]
sub r8d, edx
cmp rsi, 0xb
jb 0x470bc4
jmp 0x470c25
xor eax, eax
lea rbx, [rsp + 0x25]
mov ecx, 0xb
call fcn.00440b20
add rsp, 0x30
pop rbp
ret
mov eax, esi
mov ecx, 0xb
call fcn.00451260
mov eax, edi
mov ecx, 0xb
call fcn.00451260
nop
nop
call fcn.0044efe0
jmp fcn.00470b80

Function at 0x470c60
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x470d5d
push rbp
mov rbp, rsp
sub rsp, 0x50
movabs rdx, 0x676e1f2cca03db4e
mov qword [rsp + 0x3a], rdx
movabs rdx, 0x1b19cf2250e6676e
mov qword [rsp + 0x40], rdx
movabs rdx, 0x3e6e1c247d5f1f75
mov qword [rsp + 0x48], rdx
movabs rdx, 0x150103020f0b0811
mov qword [rsp + 0x1e], rdx
movabs rdx, 0x2120a040b0b010f
mov qword [rsp + 0x26], rdx
movabs rdx, 0x15130b0802120a04
mov qword [rsp + 0x2a], rdx
movabs rdx, 0xc0d0b1105080c0f
mov qword [rsp + 0x32], rdx
xor eax, eax
jmp 0x470d00
movzx r9d, byte [rsp + rsi + 0x3a]
sub r9d, edx
lea edx, [r9 + 0x63]
mov byte [rsp + rdi + 0x3a], dl
lea edx, [r8 + 0x63]
mov byte [rsp + rsi + 0x3a], dl
add rax, 2
nop dword [rax]
cmp rax, 0x1c
jge 0x470d2d
movzx edx, byte [rsp + rax + 0x1e]
movzx esi, byte [rsp + rax + 0x1f]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x16
jae 0x470d50
movzx r8d, byte [rsp + rdi + 0x3a]
sub r8d, edx
cmp rsi, 0x16
jb 0x470cdf
jmp 0x470d44
xor eax, eax
lea rbx, [rsp + 0x3a]
mov ecx, 0x16
call fcn.00440b20
add rsp, 0x50
pop rbp
ret
mov eax, esi
mov ecx, 0x16
call fcn.00451260
mov eax, edi
mov ecx, 0x16
call fcn.00451260
nop
nop dword [rax]
call fcn.0044efe0
jmp fcn.00470c60
Function at 0x4714c0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x471586
push rbp
mov rbp, rsp
sub rsp, 0x30
movabs rdx, 0xa606b7c924bcc44f
mov qword [rsp + 0x26], rdx
mov word [rsp + 0x2e], 0xbeaf
movabs rdx, 0x205080603020704
mov qword [rsp + 0x1a], rdx
mov dword [rsp + 0x22], 0x9080101
xor eax, eax
jmp 0x471520
movzx r9d, byte [rsp + rsi + 0x26]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x60]
mov byte [rsp + rdi + 0x26], dl
mov byte [rsp + rsi + 0x26], r8b
add rax, 2
nop dword [rax]
cmp rax, 0xc
jge 0x471552
movzx edx, byte [rsp + rax + 0x1a]
movzx esi, byte [rsp + rax + 0x1b]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0xa
jae 0x471577
movzx r8d, byte [rsp + rdi + 0x26]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x60]
cmp rsi, 0xa
jb 0x471503
jmp 0x47156b
xor eax, eax
lea rbx, [rsp + 0x26]
mov ecx, 0xa
nop
call fcn.00440b20
add rsp, 0x30
pop rbp
ret
mov eax, esi
mov ecx, 0xa
call fcn.00451260
mov eax, edi
mov ecx, 0xa
nop
call fcn.00451260
nop
call fcn.0044efe0
jmp fcn.004714c0

Function at 0x472520
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x472606
push rbp
mov rbp, rsp
sub rsp, 0x40
movabs rdx, 0x90686584819c7c86
mov qword [rsp + 0x31], rdx
movabs rdx, 0x697690839577c390
mov qword [rsp + 0x38], rdx
movabs rdx, 0x208000a07090a04
mov qword [rsp + 0x1b], rdx
movabs rdx, 0xc090a0804020208
mov qword [rsp + 0x21], rdx
movabs rdx, 0x304060904040b01
mov qword [rsp + 0x29], rdx
xor eax, eax
nop
jmp 0x4725a0
movzx r9d, byte [rsp + rsi + 0x31]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x28]
mov byte [rsp + rdi + 0x31], dl
mov byte [rsp + rsi + 0x31], r8b
add rax, 2
nop dword [rax]
cmp rax, 0x16
jge 0x4725d2
movzx edx, byte [rsp + rax + 0x1b]
movzx esi, byte [rsp + rax + 0x1c]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0xf
jae 0x4725f7
movzx r8d, byte [rsp + rdi + 0x31]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x28]
cmp rsi, 0xf
jb 0x472582
jmp 0x4725eb
xor eax, eax
lea rbx, [rsp + 0x31]
mov ecx, 0xf
nop
call fcn.00440b20
add rsp, 0x40
pop rbp
ret
mov eax, esi
mov ecx, 0xf
call fcn.00451260
mov eax, edi
mov ecx, 0xf
nop
call fcn.00451260
nop
call fcn.0044efe0
jmp fcn.00472520

Function at 0x473000
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4730bd
push rbp
mov rbp, rsp
sub rsp, 0x30
movabs rdx, 0x73ed3212ea201fc9
mov qword [rsp + 0x27], rdx
mov byte [rsp + 0x2f], 0x2c
movabs rdx, 0x502000401030206
mov qword [rsp + 0x1b], rdx
mov dword [rsp + 0x23], 0x1080408
xor eax, eax
nop
jmp 0x473060
movzx r9d, byte [rsp + rsi + 0x27]
sub r9d, edx
lea edx, [r9 + 0x49]
mov byte [rsp + rdi + 0x27], dl
lea edx, [r8 + 0x49]
mov byte [rsp + rsi + 0x27], dl
add rax, 2
nop
cmp rax, 0xc
jge 0x47308d
movzx edx, byte [rsp + rax + 0x1b]
movzx esi, byte [rsp + rax + 0x1c]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 9
jae 0x4730b0
movzx r8d, byte [rsp + rdi + 0x27]
sub r8d, edx
cmp rsi, 9
jb 0x473042
jmp 0x4730a4
xor eax, eax
lea rbx, [rsp + 0x27]
mov ecx, 9
call fcn.00440b20
add rsp, 0x30
pop rbp
ret
mov eax, esi
mov ecx, 9
call fcn.00451260
mov eax, edi
mov ecx, 9
call fcn.00451260
nop
nop dword [rax]
call fcn.0044efe0
jmp fcn.00473000
Function at 0x474020
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4740d2
push rbp
mov rbp, rsp
sub rsp, 0x28
movabs rdx, 0x697147f768516959
mov qword [rsp + 0x20], rdx
movabs rdx, 0x50002020504
mov qword [rsp + 0x18], rdx
xor eax, eax
jmp 0x474071
movzx r9d, byte [rsp + rsi + 0x20]
sub r9d, edx
lea edx, [r9 + 0x25]
mov byte [rsp + rdi + 0x20], dl
lea edx, [r8 + 0x25]
mov byte [rsp + rsi + 0x20], dl
add rax, 2
cmp rax, 8
jge 0x47409e
movzx edx, byte [rsp + rax + 0x18]
movzx esi, byte [rsp + rax + 0x19]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 8
jae 0x4740c5
movzx r8d, byte [rsp + rdi + 0x20]
sub r8d, edx
cmp rsi, 8
jb 0x474054
jmp 0x4740b5
xor eax, eax
lea rbx, [rsp + 0x20]
mov ecx, 8
call fcn.00440b20
add rsp, 0x28
pop rbp
ret
mov eax, esi
mov ecx, 8
nop dword [rax]
call fcn.00451260
mov eax, edi
mov ecx, 8
call fcn.00451260
nop
call fcn.0044efe0
jmp fcn.00474020

Function at 0x4765a0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x47668c
push rbp
mov rbp, rsp
sub rsp, 0x48
movabs rdx, 0x4653dcb5496e6f4e
mov qword [rsp + 0x31], rdx
movabs rdx, 0x4e43f23a1d746346
mov qword [rsp + 0x38], rdx
movabs rdx, 0x516e3608f7216536
mov qword [rsp + 0x40], rdx
movabs rdx, 0xe050e1216060e0c
mov qword [rsp + 0x19], rdx
movabs rdx, 0x130f120a07050413
mov qword [rsp + 0x21], rdx
movabs rdx, 0xf111404030b140e
mov qword [rsp + 0x29], rdx
xor eax, eax
jmp 0x47662a
movzx r9d, byte [rsp + rsi + 0x31]
lea edx, [r9 + rdx]
lea edx, [rdx + 0xf]
mov byte [rsp + rdi + 0x31], dl
mov byte [rsp + rsi + 0x31], r8b
add rax, 2
cmp rax, 0x18
jge 0x47665c
movzx edx, byte [rsp + rax + 0x19]
movzx esi, byte [rsp + rax + 0x1a]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x17
jae 0x47667f
movzx r8d, byte [rsp + rdi + 0x31]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0xf]
cmp rsi, 0x17
jb 0x476610
jmp 0x476673
xor eax, eax
lea rbx, [rsp + 0x31]
mov ecx, 0x17
call fcn.00440b20
add rsp, 0x48
pop rbp
ret
mov eax, esi
mov ecx, 0x17
call fcn.00451260
mov eax, edi
mov ecx, 0x17
call fcn.00451260
nop
call fcn.0044efe0
jmp fcn.004765a0