joyce8/EMBER2024-capa huggingface dataset:
Function at 0x326018900
Capabilities:
Access peb ldr_data

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x70
mov rcx, r14
test rcx, rcx
je 0x326018948
mov rcx, qword [rcx + 0x30]
mov rcx, qword [rcx + 0x90]
nop dword [rax + rax]
test rcx, rcx
je 0x326018948
mov qword [rsp + 0x68], rcx
nop
mov rax, qword [rdi + 0x28]
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x58], 0
mov qword [rsp + 0x50], 0
jmp 0x326018958
mov eax, 1
add rsp, 0x70
pop rbp
ret
mov rax, qword [rsp + 0x60]
mov rcx, qword [0x3260d5720]
lea rdx, [rsp + 0x58]
mov rbx, qword [rax + 0xf8]
mov qword [rsp], rcx
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], 0
call fcn.326002780
xorps xmm15, xmm15
mov r14, qword [0x326266318]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x20]
nop
test rax, rax
je 0x326018a31
mov rcx, qword [rsp + 0x58]
mov rdx, qword [0x3260d5728]
mov rbx, qword [rsp + 0x60]
mov rsi, rbx
lea rdi, [rsp + 0x50]
mov r8, qword [rsi + 0xf8]
mov qword [rsp], rdx
mov qword [rsp + 8], 0
mov qword [rsp + 0x10], rcx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x40], 0
call fcn.326002a00
xorps xmm15, xmm15
mov r14, qword [0x326266318]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x68]
cmp qword [rcx], rax
ja 0x326018a31
cmp qword [rcx + 8], rax
ja 0x326018953
mov eax, 1
add rsp, 0x70
pop rbp
ret
Function at 0x3260203c0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x10
mov qword [rsp + 0x20], rax
test rbx, rbx
jbe 0x326020537
movzx edx, byte [rax]
test edx, edx
jne 0x3260203f4
nop dword [rax]
test r8b, r8b
jne 0x3260203f4
xor eax, eax
xor ebx, ebx
mov rcx, rbx
xor edi, edi
add rsp, 0x10
pop rbp
ret
bt edx, 7
jae 0x326020407
xor edx, edx
xor r8d, r8d
xor r9d, r9d
jmp 0x3260204f7
mov r8d, 1
mov r9d, edx
and edx, 1
neg edx
shr r9d, 1
xor edx, r9d
add dword [rsi], edx
nop dword [rax]
cmp rbx, r8
jb 0x3260204e5
sub rbx, r8
sub rcx, r8
mov rdx, rcx
neg rdx
sar rdx, 0x3f
and r8, rdx
lea rdx, [rax + r8]
test rbx, rbx
jbe 0x3260204d7
movzx esi, byte [rax + r8]
bt esi, 7
jae 0x32602045d
xor eax, eax
xor esi, esi
xor r8d, r8d
jmp 0x3260204a0
mov eax, 1
cmp rax, rbx
ja 0x32602048b
add qword [rdi], rsi
sub rcx, rax
sub rbx, rax
mov rsi, rcx
neg rsi
sar rsi, 0x3f
and rax, rsi
add rax, rdx
mov edi, 1
add rsp, 0x10
pop rbp
ret
mov rcx, rbx
call fcn.3260330e0
lea r8d, [rcx + 7]
mov rcx, r11
mov eax, r12d
nop dword [rax]
cmp rax, rbx
jae 0x3260204cf
movzx r9d, byte [rax + rdx]
mov r10d, r9d
and r9d, 0x7f
mov r11, rcx
mov ecx, r8d
shl r9d, cl
lea r12d, [rax + 1]
or esi, r9d
test r10b, 0x80
jne 0x326020493
mov rcx, r11
mov eax, r12d
jmp 0x326020462
mov rcx, rbx
call fcn.326033020
xor eax, eax
mov rcx, rax
nop dword [rax]
call fcn.326033020
mov eax, r8d
mov rcx, rbx
call fcn.3260330e0
lea r9d, [rcx + 7]
mov rcx, r12
cmp rbx, rdx
jbe 0x32602052d
movzx r10d, byte [rdx + rax]
mov r11d, r10d
and r10d, 0x7f
mov r12, rcx
mov ecx, r9d
shl r10d, cl
inc edx
or r8d, r10d
test r11b, 0x80
jne 0x3260204f0
mov rcx, r12
mov r9d, edx
mov edx, r8d
mov r8d, r9d
jmp 0x32602040d
mov eax, edx
mov rcx, rbx
call fcn.326033020
xor eax, eax
mov rcx, rax
nop dword [rax]
call fcn.326033020
nop
int3

Function at 0x326026100
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x3260261b5
push rbp
mov rbp, rsp
sub rsp, 0x48
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x68], rcx
mov qword [rsp + 0x70], rdi
test byte [rax], al
lea rdx, [rax + 0x10]
mov rsi, qword [rsp + 0x68]
mov rcx, rdi
mov rax, rdx
mov rbx, rsi
call fcn.326023d80
nop
test bl, bl
je 0x3260261af
mov qword [rsp + 0x18], rax
movups xmmword [rsp + 0x20], xmm15
movups xmmword [rsp + 0x28], xmm15
movups xmmword [rsp + 0x38], xmm15
lea rcx, [0x326026200]
mov qword [rsp + 0x20], rcx
mov rcx, qword [rsp + 0x58]
mov qword [rsp + 0x28], rcx
mov rcx, qword [rsp + 0x60]
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x38], rax
lea rcx, [rsp + 0x68]
mov qword [rsp + 0x40], rcx
lea rcx, [rsp + 0x20]
mov qword [rsp], rcx
call fcn.326030c00
xorps xmm15, xmm15
mov r14, qword [0x326266318]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x18]
add rsp, 0x48
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
call fcn.326030d20
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
jmp fcn.326026100
Function at 0x326029160
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x32602920f
push rbp
mov rbp, rsp
sub rsp, 0x58
mov qword [rsp + 0x70], rbx
lea rdx, [rsp + 0x68]
mov qword [rsp + 8], 0
movups xmmword [rsp + 0x10], xmm15
movups xmmword [rsp + 0x18], xmm15
movups xmmword [rsp + 0x28], xmm15
movups xmmword [rsp + 0x38], xmm15
movups xmmword [rsp + 0x48], xmm15
lea rsi, [0x326029260]
mov qword [rsp + 0x10], rsi
mov rsi, qword [rsp + 0x60]
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdx
mov rdx, r14
mov qword [rsp + 0x28], rdx
lea rdx, [rsp + 8]
mov qword [rsp + 0x30], rdx
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x48], rcx
mov qword [rsp + 0x50], rdi
mov qword [rsp + 0x40], rbx
lea rax, [rsp + 0x10]
mov qword [rsp], rax
call fcn.326030c00
xorps xmm15, xmm15
mov r14, qword [0x326266318]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 8]
add rsp, 0x58
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
call fcn.326030d20
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
nop dword [rax]
jmp fcn.326029160
Function at 0x326032b20
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x325fd4083
push rbp
mov rbp, rsp
sub rsp, 0x18
mov rdx, qword [rax]
mov rcx, qword [rax + 8]
mov rax, rdx
call fcn.325fd9e80
add rsp, 0x18
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.326030d20
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp 0x325fd4060
cmp byte [0x32626610b], 0
je 0x326032b35
mov rcx, qword [rax + 8]
mov rax, qword [rax]
jmp 0x32602fd80
jmp 0x325fd4060

Function at 0x326032b40
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
nop
mov eax, dword [rax]
movabs rcx, 0xe7037ed1a0b428db
xor rcx, rax
xor rax, rbx
xor rax, qword [0x3262663e0]
movabs rdx, 0xa0761d6478bd642f
xor rdx, rax
mov rax, rcx
mul rdx
xor rax, rdx
mov rcx, rax
movabs rax, 0x1d8e4e27c47d124b
mul rcx
xor rax, rdx
nop
nop
ret
cmp byte [0x32626610b], 0
je 0x326032b75
movq xmm0, rbx
pinsrd xmm0, dword [rax], 2
aesenc xmm0, xmmword [0x326266760]
aesenc xmm0, xmmword [0x326266770]
aesenc xmm0, xmmword [0x326266780]
movq rax, xmm0
ret
jmp 0x325fda0a0

Function at 0x326032b80
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
nop
mov rax, qword [rax]
movabs rcx, 0xe7037ed1a0b428db
xor rcx, rax
xor rax, rbx
xor rax, qword [0x3262663e0]
movabs rdx, 0xa0761d6478bd642f
xor rdx, rax
mov rax, rcx
mul rdx
xor rax, rdx
mov rcx, rax
movabs rax, 0x1d8e4e27c47d1247
mul rcx
xor rax, rdx
nop
nop
ret
cmp byte [0x32626610b], 0
je 0x326032bb6
movq xmm0, rbx
pinsrq xmm0, qword [rax], 1
aesenc xmm0, xmmword [0x326266760]
aesenc xmm0, xmmword [0x326266770]
aesenc xmm0, xmmword [0x326266780]
movq rax, xmm0
ret
jmp 0x325fda100

Function at 0x326038dc0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x326038eda
push rbp
mov rbp, rsp
sub rsp, 0x58
movabs rdx, 0x637e63fa65756f72
mov qword [rsp + 0x3a], rdx
movabs rdx, 0x1d666f427d654673
mov qword [rsp + 0x42], rdx
movabs rdx, 0xf73179566f6e1d66
mov qword [rsp + 0x48], rdx
movabs rdx, 0x556524678a470472
mov qword [rsp + 0x50], rdx
movabs rdx, 0x1818131c0b1a0206
mov qword [rsp + 0x18], rdx
movabs rdx, 0x12011818131c0b1a
mov qword [rsp + 0x1a], rdx
movabs rdx, 0x1d01130406101918
mov qword [rsp + 0x22], rdx
movabs rdx, 0x15081b070b081003
mov qword [rsp + 0x2a], rdx
movabs rdx, 0xf1708130f0c1409
mov qword [rsp + 0x32], rdx
xor eax, eax
jmp 0x326038e77
movzx r9d, byte [rsp + rsi + 0x3a]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x1c]
mov byte [rsp + rdi + 0x3a], dl
mov byte [rsp + rsi + 0x3a], r8b
add rax, 2
cmp rax, 0x22
jge 0x326038ea9
movzx edx, byte [rsp + rax + 0x18]
movzx esi, byte [rsp + rax + 0x19]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x1e
jae 0x326038ecd
movzx r8d, byte [rsp + rdi + 0x3a]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x1c]
cmp rsi, 0x1e
jb 0x326038e5d
jmp 0x326038ec1
xor eax, eax
lea rbx, [rsp + 0x3a]
mov ecx, 0x1e
call fcn.32601d600
add rsp, 0x58
pop rbp
nop
ret
mov eax, esi
mov ecx, 0x1e
call fcn.326033020
mov eax, edi
mov ecx, 0x1e
call fcn.326033020
nop
call fcn.326030d20
nop
jmp fcn.326038dc0
Function at 0x326039a20
Capabilities:
Encrypt data using rc4 prga

Disassembly:
lea r12, [rsp - 8]
cmp r12, qword [r14 + 0x10]
jbe 0x326039b8a
push rbp
mov rbp, rsp
add rsp, 0xffffffffffffff80
movups xmmword [rsp + 0x90], xmm15
movups xmmword [rsp + 0xa0], xmm15
movabs rdx, 0x4f189a2383490153
mov qword [rsp + 0x60], rdx
movabs rdx, 0x6c6767195177791e
mov qword [rsp + 0x68], rdx
movabs rdx, 0x3166c01117621b7e
mov qword [rsp + 0x70], rdx
movabs rdx, 0x670a313c46774d2a
mov qword [rsp + 0x78], rdx
movabs rdx, 0x90f070715071610
mov qword [rsp + 0x10], rdx
movabs rdx, 0x503000f0b0d0e12
mov qword [rsp + 0x18], rdx
movabs rdx, 0x1912041b191a050a
mov qword [rsp + 0x20], rdx
movabs rdx, 0x1c09021c1c1f0b1d
mov qword [rsp + 0x28], rdx
movabs rdx, 0x405170a04030710
mov qword [rsp + 0x30], rdx
movabs rdx, 0xa110f140e021816
mov qword [rsp + 0x38], rdx
xor eax, eax
jmp 0x326039b00
movzx r8d, byte [rsp + rbx + 0x60]
lea edx, [r8 + rdx]
lea edx, [rdx - 0x50]
mov byte [rsp + rsi + 0x60], dl
mov byte [rsp + rbx + 0x60], dil
add rax, 2
nop dword [rax]
cmp rax, 0x30
jge 0x326039b2f
movzx edx, byte [rsp + rax + 0x10]
movzx ebx, byte [rsp + rax + 0x11]
mov esi, edx
xor edx, ebx
add edx, eax
cmp rsi, 0x20
jae 0x326039b7d
movzx edi, byte [rsp + rsi + 0x60]
lea edi, [rdi + rdx]
lea edi, [rdi - 0x50]
cmp rbx, 0x20
jb 0x326039ae3
jmp 0x326039b71
movups xmmword [rsp + 0x40], xmm15
movups xmmword [rsp + 0x50], xmm15
xor eax, eax
jmp 0x326039b4b
movzx ecx, byte [rsp + rax + 0x60]
mov byte [rsp + rax + 0x40], cl
inc rax
cmp rax, 0x20
jl 0x326039b3f
movups xmm0, xmmword [rsp + 0x40]
movups xmmword [rsp + 0x90], xmm0
movups xmm0, xmmword [rsp + 0x50]
movups xmmword [rsp + 0xa0], xmm0
sub rsp, 0xffffffffffffff80
pop rbp
ret
mov eax, ebx
mov ecx, 0x20
call fcn.326033020
mov eax, esi
mov ecx, 0x20
call fcn.326033020
nop
call fcn.326030d20
jmp fcn.326039a20

Function at 0x32603be80
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x32603bf38
push rbp
mov rbp, rsp
sub rsp, 0x30
movabs rdx, 0x4947445732613834
mov qword [rsp + 0x28], rdx
movabs rdx, 0x706040602050402
mov qword [rsp + 0x1e], rdx
mov word [rsp + 0x26], 0x605
xor eax, eax
jmp 0x32603bed5
movzx r9d, byte [rsp + rsi + 0x28]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x15]
mov byte [rsp + rdi + 0x28], dl
mov byte [rsp + rsi + 0x28], r8b
add rax, 2
cmp rax, 0xa
jge 0x32603bf08
movzx edx, byte [rsp + rax + 0x1e]
movzx esi, byte [rsp + rax + 0x1f]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 8
jae 0x32603bf2b
movzx r8d, byte [rsp + rdi + 0x28]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x15]
nop
cmp rsi, 8
jb 0x32603bebb
jmp 0x32603bf1f
xor eax, eax
lea rbx, [rsp + 0x28]
mov ecx, 8
call fcn.32601d600
add rsp, 0x30
pop rbp
ret
mov eax, esi
mov ecx, 8
call fcn.326033020
mov eax, edi
mov ecx, 8
call fcn.326033020
nop
call fcn.326030d20
nop dword [rax]
jmp fcn.32603be80
Function at 0x32603cd60
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x32603ce4c
push rbp
mov rbp, rsp
sub rsp, 0x40
movabs rdx, 0x867dd8308239ced1
mov qword [rsp + 0x2f], rdx
movabs rdx, 0x87867dd8308239ce
mov qword [rsp + 0x30], rdx
movabs rdx, 0x6c8cded6ee88b735
mov qword [rsp + 0x38], rdx
movabs rdx, 0x7030e050e0c0e
mov qword [rsp + 0x19], rdx
movabs rdx, 0xf0d0c0b010c0007
mov qword [rsp + 0x1f], rdx
movabs rdx, 0x80810060f070a06
mov qword [rsp + 0x27], rdx
xor eax, eax
jmp 0x32603cdea
movzx r9d, byte [rsp + rsi + 0x2f]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x62]
mov byte [rsp + rdi + 0x2f], dl
mov byte [rsp + rsi + 0x2f], r8b
add rax, 2
cmp rax, 0x16
jge 0x32603ce1c
movzx edx, byte [rsp + rax + 0x19]
movzx esi, byte [rsp + rax + 0x1a]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x11
jae 0x32603ce3f
movzx r8d, byte [rsp + rdi + 0x2f]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x62]
cmp rsi, 0x11
jb 0x32603cdd0
jmp 0x32603ce33
xor eax, eax
lea rbx, [rsp + 0x2f]
mov ecx, 0x11
call fcn.32601d600
add rsp, 0x40
pop rbp
ret
mov eax, esi
mov ecx, 0x11
call fcn.326033020
mov eax, edi
mov ecx, 0x11
call fcn.326033020
nop
call fcn.326030d20
jmp fcn.32603cd60

Function at 0x32603ce60
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x32603cf5d
push rbp
mov rbp, rsp
sub rsp, 0x48
movabs rdx, 0xd5cdda3725d5d7cd
mov qword [rsp + 0x36], rdx
movabs rdx, 0x382fd5cdda3725d5
mov qword [rsp + 0x38], rdx
movabs rdx, 0xf02dafd7d59936e2
mov qword [rsp + 0x40], rdx
movabs rdx, 0x60008070308100c
mov qword [rsp + 0x1c], rdx
movabs rdx, 0x100402050c10040c
mov qword [rsp + 0x24], rdx
movabs rdx, 0xe0d100402050c10
mov qword [rsp + 0x26], rdx
movabs rdx, 0x11010301070a0f11
mov qword [rsp + 0x2e], rdx
xor eax, eax
jmp 0x32603cf00
movzx r9d, byte [rsp + rsi + 0x36]
sub r9d, edx
lea edx, [r9 + 0x71]
mov byte [rsp + rdi + 0x36], dl
lea edx, [r8 + 0x71]
mov byte [rsp + rsi + 0x36], dl
add rax, 2
nop dword [rax]
cmp rax, 0x1a
jge 0x32603cf2d
movzx edx, byte [rsp + rax + 0x1c]
movzx esi, byte [rsp + rax + 0x1d]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x12
jae 0x32603cf50
movzx r8d, byte [rsp + rdi + 0x36]
sub r8d, edx
cmp rsi, 0x12
jb 0x32603cedf
jmp 0x32603cf44
xor eax, eax
lea rbx, [rsp + 0x36]
mov ecx, 0x12
call fcn.32601d600
add rsp, 0x48
pop rbp
ret
mov eax, esi
mov ecx, 0x12
call fcn.326033020
mov eax, edi
mov ecx, 0x12
call fcn.326033020
nop
nop dword [rax]
call fcn.326030d20
jmp fcn.32603ce60
Function at 0x32603cf80
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x32603d07d
push rbp
mov rbp, rsp
sub rsp, 0x48
movabs rdx, 0x9530e835a7063437
mov qword [rsp + 0x35], rdx
movabs rdx, 0x9e36f99530e835a7
mov qword [rsp + 0x38], rdx
movabs rdx, 0xa0bb08a7f6d40807
mov qword [rsp + 0x40], rdx
movabs rdx, 0x100b0d030f0f0807
mov qword [rsp + 0x19], rdx
movabs rdx, 0x110a0212080a0f0e
mov qword [rsp + 0x21], rdx
movabs rdx, 0x30d020a110a0212
mov qword [rsp + 0x25], rdx
movabs rdx, 0x20c0c050c08030a
mov qword [rsp + 0x2d], rdx
xor eax, eax
jmp 0x32603d020
movzx r9d, byte [rsp + rsi + 0x35]
sub r9d, edx
lea edx, [r9 + 0x4b]
mov byte [rsp + rdi + 0x35], dl
lea edx, [r8 + 0x4b]
mov byte [rsp + rsi + 0x35], dl
add rax, 2
nop dword [rax]
cmp rax, 0x1c
jge 0x32603d04d
movzx edx, byte [rsp + rax + 0x19]
movzx esi, byte [rsp + rax + 0x1a]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x13
jae 0x32603d070
movzx r8d, byte [rsp + rdi + 0x35]
sub r8d, edx
cmp rsi, 0x13
jb 0x32603cfff
jmp 0x32603d064
xor eax, eax
lea rbx, [rsp + 0x35]
mov ecx, 0x13
call fcn.32601d600
add rsp, 0x48
pop rbp
ret
mov eax, esi
mov ecx, 0x13
call fcn.326033020
mov eax, edi
mov ecx, 0x13
call fcn.326033020
nop
nop dword [rax]
call fcn.326030d20
jmp fcn.32603cf80

Function at 0x32603da20
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x32603db1b
push rbp
mov rbp, rsp
sub rsp, 0x50
movabs rdx, 0xc1bcfc3730848435
mov qword [rsp + 0x38], rdx
movabs rdx, 0xb4f3fa36f033b7af
mov qword [rsp + 0x40], rdx
movabs rdx, 0xfc32fcf6c63232f4
mov qword [rsp + 0x48], rdx
movabs rdx, 0x15010e1309100213
mov qword [rsp + 0x1c], rdx
movabs rdx, 0x707061410021505
mov qword [rsp + 0x24], rdx
movabs rdx, 0xd0f050807070614
mov qword [rsp + 0x28], rdx
movabs rdx, 0x70d0e0e050b1714
mov qword [rsp + 0x30], rdx
xor eax, eax
jmp 0x32603dab9
movzx r9d, byte [rsp + rsi + 0x38]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x22]
mov byte [rsp + rdi + 0x38], dl
mov byte [rsp + rsi + 0x38], r8b
add rax, 2
cmp rax, 0x1c
jge 0x32603daeb
movzx edx, byte [rsp + rax + 0x1c]
movzx esi, byte [rsp + rax + 0x1d]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x18
jae 0x32603db0e
movzx r8d, byte [rsp + rdi + 0x38]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x22]
cmp rsi, 0x18
jb 0x32603da9f
jmp 0x32603db02
xor eax, eax
lea rbx, [rsp + 0x38]
mov ecx, 0x18
call fcn.32601d600
add rsp, 0x50
pop rbp
ret
mov eax, esi
mov ecx, 0x18
call fcn.326033020
mov eax, edi
mov ecx, 0x18
call fcn.326033020
nop
nop dword [rax + rax]
call fcn.326030d20
jmp fcn.32603da20
Function at 0x32603f220
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x32603f347
push rbp
mov rbp, rsp
sub rsp, 0x60
movabs rdx, 0xfb3515e7a10f34c4
mov qword [rsp + 0x3f], rdx
movabs rdx, 0x30fb3515e7a10f34
mov qword [rsp + 0x40], rdx
movabs rdx, 0x1f1a3008301c2d31
mov qword [rsp + 0x48], rdx
movabs rdx, 0x380832303416ea37
mov qword [rsp + 0x50], rdx
movabs rdx, 0x4732311231351f35
mov qword [rsp + 0x58], rdx
movabs rdx, 0x2120d0713050703
mov qword [rsp + 0x1b], rdx
movabs rdx, 0xf10170f02120d07
mov qword [rsp + 0x1f], rdx
movabs rdx, 0x4021a0d000b0004
mov qword [rsp + 0x27], rdx
movabs rdx, 0x1e0202150a1a1d
mov qword [rsp + 0x2f], rdx
movabs rdx, 0x820001a1e08120d
mov qword [rsp + 0x37], rdx
xor eax, eax
jmp 0x32603f2e9
movzx r9d, byte [rsp + rsi + 0x3f]
sub r9d, edx
lea edx, [r9 + 0x3a]
mov byte [rsp + rdi + 0x3f], dl
lea edx, [r8 + 0x3a]
mov byte [rsp + rsi + 0x3f], dl
add rax, 2
cmp rax, 0x24
jge 0x32603f317
movzx edx, byte [rsp + rax + 0x1b]
movzx esi, byte [rsp + rax + 0x1c]
mov edi, edx
xor edx, esi
add edx, eax
nop
cmp rdi, 0x21
jae 0x32603f33a
movzx r8d, byte [rsp + rdi + 0x3f]
sub r8d, edx
cmp rsi, 0x21
jb 0x32603f2cc
jmp 0x32603f32e
xor eax, eax
lea rbx, [rsp + 0x3f]
mov ecx, 0x21
call fcn.32601d600
add rsp, 0x60
pop rbp
ret
mov eax, esi
mov ecx, 0x21
call fcn.326033020
mov eax, edi
mov ecx, 0x21
call fcn.326033020
nop
call fcn.326030d20
jmp fcn.32603f220

Function at 0x32603f360
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x32603f498
push rbp
mov rbp, rsp
sub rsp, 0x68
movabs rdx, 0x8e37b03435787637
mov qword [rsp + 0x47], rdx
movabs rdx, 0x358e37b034357876
mov qword [rsp + 0x48], rdx
movabs rdx, 0x7b31b33031eb8374
mov qword [rsp + 0x50], rdx
movabs rdx, 0x3234323131375c7b
mov qword [rsp + 0x58], rdx
movabs rdx, 0x98af6d3873ae9fab
mov qword [rsp + 0x60], rdx
movabs rdx, 0x1b1b111a110b1f19
mov qword [rsp + 0x1d], rdx
movabs rdx, 0x1b1e1f110a090e05
mov qword [rsp + 0x25], rdx
movabs rdx, 0x20011b1e1f110a09
mov qword [rsp + 0x27], rdx
movabs rdx, 0x121c071001192009
mov qword [rsp + 0x2f], rdx
movabs rdx, 0x191a0705020e0e02
mov qword [rsp + 0x37], rdx
movabs rdx, 0x19120b0107091910
mov qword [rsp + 0x3f], rdx
xor eax, eax
jmp 0x32603f435
movzx r9d, byte [rsp + rsi + 0x47]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x4b]
mov byte [rsp + rdi + 0x47], dl
mov byte [rsp + rsi + 0x47], r8b
add rax, 2
cmp rax, 0x2a
jge 0x32603f468
movzx edx, byte [rsp + rax + 0x1d]
movzx esi, byte [rsp + rax + 0x1e]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x21
jae 0x32603f48b
movzx r8d, byte [rsp + rdi + 0x47]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x4b]
nop
cmp rsi, 0x21
jb 0x32603f41b
jmp 0x32603f47f
xor eax, eax
lea rbx, [rsp + 0x47]
mov ecx, 0x21
call fcn.32601d600
add rsp, 0x68
pop rbp
ret
mov eax, esi
mov ecx, 0x21
call fcn.326033020
mov eax, edi
mov ecx, 0x21
call fcn.326033020
nop
call fcn.326030d20
nop dword [rax]
jmp fcn.32603f360
Function at 0x326046ce0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x326046e2c
push rbp
mov rbp, rsp
sub rsp, 0x78
movabs rdx, 0x6281c9869c5c418c
mov qword [rsp + 0x4c], rdx
movabs rdx, 0x3a3030a770898969
mov qword [rsp + 0x54], rdx
movabs rdx, 0x4c9d78203a3030a7
mov qword [rsp + 0x58], rdx
movabs rdx, 0x309f2066f133b3a7
mov qword [rsp + 0x60], rdx
movabs rdx, 0x2d767584202394b2
mov qword [rsp + 0x68], rdx
movabs rdx, 0x23676e7b72d2666f
mov qword [rsp + 0x70], rdx
movabs rdx, 0x11201a1514122b16
mov qword [rsp + 0x1c], rdx
movabs rdx, 0x280b0c0300280422
mov qword [rsp + 0x24], rdx
movabs rdx, 0x1c17011a2b040513
mov qword [rsp + 0x2c], rdx
movabs rdx, 0x11021313061e011d
mov qword [rsp + 0x34], rdx
movabs rdx, 0x6230109030a1317
mov qword [rsp + 0x3c], rdx
movabs rdx, 0x1c261c261a0d0a11
mov qword [rsp + 0x44], rdx
xor eax, eax
jmp 0x326046dc4
movzx r9d, byte [rsp + rsi + 0x4c]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x40]
mov byte [rsp + rdi + 0x4c], dl
mov byte [rsp + rsi + 0x4c], r8b
add rax, 2
cmp rax, 0x30
jge 0x326046dfc
movzx edx, byte [rsp + rax + 0x1c]
movzx esi, byte [rsp + rax + 0x1d]
mov edi, edx
xor edx, esi
add edx, eax
nop word [rax + rax]
cmp rdi, 0x2c
jae 0x326046e1f
movzx r8d, byte [rsp + rdi + 0x4c]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x40]
cmp rsi, 0x2c
jb 0x326046daa
jmp 0x326046e13
xor eax, eax
lea rbx, [rsp + 0x4c]
mov ecx, 0x2c
call fcn.32601d600
add rsp, 0x78
pop rbp
ret
mov eax, esi
mov ecx, 0x2c
call fcn.326033020
mov eax, edi
mov ecx, 0x2c
call fcn.326033020
nop
call fcn.326030d20
jmp fcn.326046ce0

Function at 0x32604a440
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x32604a55d
push rbp
mov rbp, rsp
sub rsp, 0x60
movabs rdx, 0x8769b13a63b45a73
mov qword [rsp + 0x42], rdx
movabs rdx, 0x65061af6076e6f04
mov qword [rsp + 0x4a], rdx
movabs rdx, 0xd575b78bbe476506
mov qword [rsp + 0x50], rdx
movabs rdx, 0xc5b6167473057d65
mov qword [rsp + 0x58], rdx
movabs rdx, 0x51b080c12010812
mov qword [rsp + 0x1c], rdx
movabs rdx, 0x8100b02121b051b
mov qword [rsp + 0x22], rdx
movabs rdx, 0xd0e1711080c1718
mov qword [rsp + 0x2a], rdx
movabs rdx, 0x13130718150e020d
mov qword [rsp + 0x32], rdx
movabs rdx, 0x50c1d1c071b080c
mov qword [rsp + 0x3a], rdx
xor eax, eax
jmp 0x32604a500
movzx r9d, byte [rsp + rsi + 0x42]
sub r9d, edx
lea edx, [r9 - 0x2e]
mov byte [rsp + rdi + 0x42], dl
lea edx, [r8 - 0x2e]
mov byte [rsp + rsi + 0x42], dl
add rax, 2
nop word [rax + rax]
cmp rax, 0x26
jge 0x32604a52d
movzx edx, byte [rsp + rax + 0x1c]
movzx esi, byte [rsp + rax + 0x1d]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x1e
jae 0x32604a550
movzx r8d, byte [rsp + rdi + 0x42]
sub r8d, edx
cmp rsi, 0x1e
jb 0x32604a4dd
jmp 0x32604a544
xor eax, eax
lea rbx, [rsp + 0x42]
mov ecx, 0x1e
call fcn.32601d600
add rsp, 0x60
pop rbp
ret
mov eax, esi
mov ecx, 0x1e
call fcn.326033020
mov eax, edi
mov ecx, 0x1e
call fcn.326033020
nop
nop dword [rax]
call fcn.326030d20
jmp fcn.32604a440