joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4298e0
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4299f0
push rbp
mov rbp, rsp
sub rsp, 0x58
mov qword [rsp + 0x68], rax
mov byte [rsp + 0x80], dil
nop
test dil, dil
je 0x429935
mov qword [rsp + 0x78], rcx
mov qword [rsp + 0x68], rax
mov qword [rsp + 0x70], rbx
mov eax, 6
call fcn.004345a0
mov rax, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x78]
mov rbx, qword [rsp + 0x70]
movzx edi, byte [rsp + 0x80]
mov qword [rsp + 8], 0
nop
test rbx, rbx
jne 0x42994d
test dil, dil
jmp 0x4299db
lea rdx, [rsp + 0x68]
movups xmmword [rsp + 0x10], xmm15
movups xmmword [rsp + 0x18], xmm15
movups xmmword [rsp + 0x28], xmm15
movups xmmword [rsp + 0x38], xmm15
movups xmmword [rsp + 0x48], xmm15
lea rsi, [0x00429a40]
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rax
mov qword [rsp + 0x20], rbx
mov qword [rsp + 0x28], rcx
mov rax, r14
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x60]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x40], rdx
mov byte [rsp + 0x48], dil
lea rax, [rsp + 8]
mov qword [rsp + 0x50], rax
lea rax, [rsp + 0x10]
mov qword [rsp], rax
call fcn.00455ae0
xorps xmm15, xmm15
mov r14, qword [0x006b0ec0]
mov r14, qword gs:[r14]
mov r14, qword [r14]
movzx eax, byte [rsp + 0x80]
test al, al
je 0x4299e5
nop dword [rax]
call fcn.00434720
mov rax, qword [rsp + 8]
add rsp, 0x58
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov byte [rsp + 0x20], dil
call fcn.00455c20
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
movzx edi, byte [rsp + 0x20]
nop dword [rax]
jmp fcn.004298e0
Function at 0x42ac40
Capabilities:
Hash data using murmur3

Disassembly:
cmp rsp, qword [r14 + 0x18]
jbe 0x42aec6
push rbp
mov rbp, rsp
sub rsp, 0x38
test byte [rax], al
mov rcx, qword [rax + 0x1268]
lea rsi, [rax + 0x1278]
sub rcx, rsi
shr rcx, 3
cmp rcx, 0x200
ja 0x42aeba
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x30], rcx
mov qword [rax + 0x1268], 0
cmp byte [0x006b0cb1], 0
jne 0x42ac9a
xor edx, edx
xor ebx, ebx
jmp 0x42ace0
xor edx, edx
jmp 0x42acc5
mov qword [rsp + 0x28], rdx
mov rcx, qword [rax + rdx*8 + 0x1278]
mov rax, rcx
call fcn.0041c0a0
mov rdx, qword [rsp + 0x28]
inc rdx
mov rax, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x30]
cmp rdx, rcx
jl 0x42ac9e
add rax, 0x1268
call fcn.0042abc0
add rsp, 0x38
pop rbp
ret
inc rdx
nop
cmp rdx, rcx
jge 0x42ae54
mov rsi, qword [rax + rdx*8 + 0x1278]
cmp rsi, 0x1000
jb 0x42acdb
mov qword [rsp + 0x28], rdx
mov qword [rsp + 0x20], rbx
mov rax, rsi
xor ebx, ebx
mov rcx, rbx
call fcn.004112c0
test rax, rax
jne 0x42ad2c
mov rax, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x30]
mov rdx, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x20]
jmp 0x42acdb
mov rsi, qword [rbx + 0x50]
test byte [rsi], al
mov r8, rcx
shr r8, 3
movzx r9d, byte [rsi + r8]
and ecx, 7
mov r10d, 1
shl r10d, cl
nop
add rsi, r8
test r10b, r9b
je 0x42ad6c
mov rax, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x30]
mov rdx, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x20]
jmp 0x42acdb
nop
lock or byte [rsi], r10b
mov rcx, qword [rbx + 0x18]
movabs rsi, 0x800000000000
lea r8, [rsi + rcx]
mov r9, r8
shr r8, 0x2a
nop
nop
nop
cmp r8, 0x40
jae 0x42aead
lea r10, [0x00683098]
mov r8, qword [r10 + r8*8]
test byte [r8], al
mov r10, rcx
shr r10, 0x10
and r10d, 0x3f
shr rcx, 0xd
and ecx, 7
mov r11d, 1
shl r11d, cl
shr r9, 0x16
and r9d, 0xfffff
mov r8, qword [r8 + r9*8]
test byte [r8], al
movzx r9d, byte [r8 + r10 + 0x11440]
lea r8, [r8 + r10]
lea r8, [r8 + 0x11440]
test r11b, r9b
jne 0x42adef
lock or byte [r8], r11b
movzx r8d, byte [rbx + 0x6a]
test r8b, 1
je 0x42ae25
mov rax, qword [rsp + 0x48]
mov r8, qword [rax + 0x1250]
add r8, qword [rbx + 0x70]
mov qword [rax + 0x1250], r8
mov rcx, qword [rsp + 0x30]
mov rdx, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x20]
jmp 0x42acdb
mov r8, qword [rsp + 0x20]
mov rcx, qword [rsp + 0x30]
cmp r8, rcx
jae 0x42aea5
mov rbx, qword [rsp + 0x48]
mov qword [rbx + r8*8 + 0x1278], rax
inc r8
mov rax, rbx
mov rdx, qword [rsp + 0x28]
mov rbx, r8
jmp 0x42acdb
cmp rbx, 0x200
ja 0x42ae94
lea rdx, [rax + 0x1278]
lea rsi, [rax + 0x1240]
mov rcx, rbx
mov edi, 0x200
mov rbx, rdx
mov rax, rsi
call fcn.00421800
mov rax, qword [rsp + 0x48]
add rax, 0x1268
call fcn.0042abc0
add rsp, 0x38
pop rbp
ret
mov rcx, rbx
mov edx, 0x200
nop dword [rax]
call fcn.00457f20
mov rax, r8
call fcn.00457ea0
mov rax, r8
mov ecx, 0x40
call fcn.00457ec0
mov edx, 0x200
nop
call fcn.00457f00
nop
mov qword [rsp + 8], rax
call fcn.0045c780
mov rax, qword [rsp + 8]
jmp fcn.0042ac40
Function at 0x42dbe0
Capabilities:
Access peb ldr_data

Disassembly:
lea r12, [rsp - 0x20]
cmp r12, qword [r14 + 0x10]
jbe 0x42de99
push rbp
mov rbp, rsp
sub rsp, 0x98
mov qword [rsp + 0x48], 0
mov rax, qword [sym.imp.kernel32.dll_DuplicateHandle]
lea rcx, [rsp + 0x48]
mov qword [rsp], rax
mov qword [rsp + 8], 0xffffffffffffffff
mov qword [rsp + 0x10], 0xfffffffffffffffe
mov qword [rsp + 0x18], 0xffffffffffffffff
mov qword [rsp + 0x20], rcx
movups xmmword [rsp + 0x28], xmm15
mov qword [rsp + 0x38], 2
call fcn.0042e440
xorps xmm15, xmm15
mov r14, qword [0x006b0ec0]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x40], 0
nop
je 0x42de70
mov rax, qword [r14 + 0x30]
mov qword [rsp + 0x80], rax
test byte [rax], al
lea rcx, [rax + 0x310]
mov qword [rsp + 0x88], rcx
nop
mov rax, rcx
call fcn.00409ce0
mov rcx, qword [rsp + 0x48]
mov rdx, qword [rsp + 0x80]
mov qword [rdx + 0x318], rcx
mov rax, qword [sym.imp.kernel32.dll_GetCurrentThreadId]
call fcn.0042e100
mov rcx, qword [rsp + 0x80]
mov qword [rcx + 0x48], rax
cmp qword [rcx + 0x330], 0
jne 0x42dd29
cmp byte [0x006b0cb3], 0
je 0x42dd29
mov rax, qword [sym.imp.kernel32.dll_CreateWaitableTimerExW]
mov qword [rsp], rax
movups xmmword [rsp + 8], xmm15
mov qword [rsp + 0x18], 2
mov qword [rsp + 0x20], 0x100003
call fcn.0042e2c0
xorps xmm15, xmm15
mov r14, qword [0x006b0ec0]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x80]
mov qword [rcx + 0x330], rax
nop dword [rax]
test rax, rax
je 0x42de48
nop
nop
mov rax, qword [rsp + 0x88]
call fcn.00409f00
movups xmmword [rsp + 0x50], xmm15
movups xmmword [rsp + 0x60], xmm15
movups xmmword [rsp + 0x70], xmm15
mov rcx, qword [sym.imp.kernel32.dll_VirtualQuery]
lea rdx, [rsp + 0x50]
mov qword [rsp], rcx
mov qword [rsp + 8], rdx
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], 0x30
call fcn.0042e240
xorps xmm15, xmm15
mov r14, qword [0x006b0ec0]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x20], 0
je 0x42de20
mov rcx, qword [rsp + 0x58]
lea rdx, [rcx + 0x4000]
mov qword [rsp + 0x90], r14
mov rsi, qword [r14 + 8]
cmp rsi, rdx
jb 0x42de01
sub rsi, rcx
add rsi, 0xffffffffffffc000
nop word [rax + rax]
cmp rsi, 0x4000000
ja 0x42de01
mov qword [r14], rdx
lea rax, [rcx + 0x53a0]
mov qword [r14 + 0x10], rax
mov qword [r14 + 0x18], rax
nop dword [rax + rax]
call fcn.00457960
xorps xmm15, xmm15
mov r14, qword [0x006b0ec0]
mov r14, qword gs:[r14]
mov r14, qword [r14]
add rsp, 0x98
pop rbp
nop
ret
mov rcx, qword [rsp + 0x90]
test byte [rcx], al
lea rax, [0x005882b6]
mov ebx, 0xc
call fcn.00430a80
nop dword [rax]
call fcn.00459300
xorps xmm15, xmm15
mov r14, qword [0x006b0ec0]
mov r14, qword gs:[r14]
mov r14, qword [r14]
lea rax, [0x0058aa73]
mov ebx, 0x22
call fcn.00430a80
call fcn.00459300
xorps xmm15, xmm15
mov r14, qword [0x006b0ec0]
mov r14, qword gs:[r14]
mov r14, qword [r14]
lea rax, [0x0058bff9]
mov ebx, 0x30
call fcn.00430a80
call fcn.00459300
xorps xmm15, xmm15
mov r14, qword [0x006b0ec0]
mov r14, qword gs:[r14]
mov r14, qword [r14]
lea rax, [0x0058aebf]
mov ebx, 0x25
call fcn.00430a80
nop
call fcn.00455c20
nop
jmp fcn.0042dbe0
Function at 0x43d200
Capabilities:
Encode data using base64

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x43d367
push rbp
mov rbp, rsp
sub rsp, 0x18
mov ecx, dword [rax + 0x190]
mov edx, dword [rax + 0x194]
mov rsi, qword [rax + 0x998]
mov edi, dword [rax + 0x194]
cmp edi, edx
jne 0x43d212
cmp edx, ecx
jne 0x43d355
nop word [rax + rax]
test rsi, rsi
jne 0x43d355
mov qword [rsp + 0x28], rax
test rbx, rbx
jne 0x43d274
nop
call fcn.00459720
xorps xmm15, xmm15
mov r14, qword [0x006b0ec0]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rbx, qword [rsp]
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0x10], rbx
call fcn.0043d120
mov rcx, qword [rsp + 0x28]
mov edx, dword [rcx]
mov ebx, edx
sar edx, 0x1f
shr edx, 0x1b
add edx, ebx
mov esi, edx
and edx, 0xffffffe0
sub ebx, edx
test ebx, ebx
jl 0x43d350
mov rdx, qword [0x0065cbb8]
sar esi, 5
mov rax, rcx
mov ecx, ebx
mov edi, 1
shl edi, cl
movsxd rsi, esi
cmp ecx, 0x20
sbb r8d, r8d
and edi, r8d
cmp rdx, rsi
jbe 0x43d345
mov rcx, qword [0x0065cbb0]
lea rcx, [rcx + rsi*4]
lock or dword [rcx], edi
mov rcx, qword [0x0065d8b0]
mov qword [rax + 8], rcx
mov rcx, rax
nop
mov qword [0x0065d8b0], rax
nop
mov edx, 1
lea rsi, [0x0065d8b8]
lock xadd dword [rsi], edx
mov rdx, qword [rcx + 0x1228]
shr rdx, 0x3d
test dl, dl
jne 0x43d333
mov rax, qword [rsp + 0x10]
movabs rdx, 0x1fffffffffffffff
and rdx, rax
bts rdx, 0x3f
nop
nop
xchg qword [rcx + 0x1228], rdx
add rsp, 0x18
pop rbp
ret
lea rax, [0x0058b431]
mov ebx, 0x28
nop
call fcn.00430a80
mov rax, rsi
mov rcx, rdx
call fcn.00457ea0
call fcn.0042f3c0
lea rax, [0x0058ac35]
mov ebx, 0x23
call fcn.00430a80
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.00455c20
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.0043d200
Function at 0x448880
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x10
mov qword [rsp + 0x20], rax
test rbx, rbx
jbe 0x4489f7
movzx edx, byte [rax]
test edx, edx
jne 0x4488b4
nop dword [rax]
test r8b, r8b
jne 0x4488b4
xor eax, eax
xor ebx, ebx
mov rcx, rbx
xor edi, edi
add rsp, 0x10
pop rbp
ret
bt edx, 7
jae 0x4488c7
xor edx, edx
xor r8d, r8d
xor r9d, r9d
jmp 0x4489b7
mov r8d, 1
mov r9d, edx
and edx, 1
neg edx
shr r9d, 1
xor edx, r9d
add dword [rsi], edx
nop dword [rax]
cmp rbx, r8
jb 0x4489a5
sub rbx, r8
sub rcx, r8
mov rdx, rcx
neg rdx
sar rdx, 0x3f
and r8, rdx
lea rdx, [rax + r8]
test rbx, rbx
jbe 0x448997
movzx esi, byte [rax + r8]
bt esi, 7
jae 0x44891d
xor eax, eax
xor esi, esi
xor r8d, r8d
jmp 0x448960
mov eax, 1
cmp rax, rbx
ja 0x44894b
add qword [rdi], rsi
sub rcx, rax
sub rbx, rax
mov rsi, rcx
neg rsi
sar rsi, 0x3f
and rax, rsi
add rax, rdx
mov edi, 1
add rsp, 0x10
pop rbp
ret
mov rcx, rbx
call fcn.00457f60
lea r8d, [rcx + 7]
mov rcx, r11
mov eax, r12d
nop dword [rax]
cmp rax, rbx
jae 0x44898f
movzx r9d, byte [rax + rdx]
mov r10d, r9d
and r9d, 0x7f
mov r11, rcx
mov ecx, r8d
shl r9d, cl
lea r12d, [rax + 1]
or esi, r9d
test r10b, 0x80
jne 0x448953
mov rcx, r11
mov eax, r12d
jmp 0x448922
mov rcx, rbx
call fcn.00457ea0
xor eax, eax
mov rcx, rax
nop dword [rax]
call fcn.00457ea0
mov eax, r8d
mov rcx, rbx
call fcn.00457f60
lea r9d, [rcx + 7]
mov rcx, r12
cmp rbx, rdx
jbe 0x4489ed
movzx r10d, byte [rdx + rax]
mov r11d, r10d
and r10d, 0x7f
mov r12, rcx
mov ecx, r9d
shl r10d, cl
inc edx
or r8d, r10d
test r11b, 0x80
jne 0x4489b0
mov rcx, r12
mov r9d, edx
mov edx, r8d
mov r8d, r9d
jmp 0x4488cd
mov eax, edx
mov rcx, rbx
call fcn.00457ea0
xor eax, eax
mov rcx, rax
nop dword [rax]
call fcn.00457ea0
nop
int3

Function at 0x44e3e0
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x44e48f
push rbp
mov rbp, rsp
sub rsp, 0x58
mov qword [rsp + 0x70], rbx
lea rdx, [rsp + 0x68]
mov qword [rsp + 8], 0
movups xmmword [rsp + 0x10], xmm15
movups xmmword [rsp + 0x18], xmm15
movups xmmword [rsp + 0x28], xmm15
movups xmmword [rsp + 0x38], xmm15
movups xmmword [rsp + 0x48], xmm15
lea rsi, [0x0044e4e0]
mov qword [rsp + 0x10], rsi
mov rsi, qword [rsp + 0x60]
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdx
mov rdx, r14
mov qword [rsp + 0x28], rdx
lea rdx, [rsp + 8]
mov qword [rsp + 0x30], rdx
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x48], rcx
mov qword [rsp + 0x50], rdi
lea rax, [rsp + 0x10]
mov qword [rsp], rax
call fcn.00455ae0
xorps xmm15, xmm15
mov r14, qword [0x006b0ec0]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 8]
add rsp, 0x58
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
call fcn.00455c20
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
nop dword [rax]
jmp fcn.0044e3e0
Function at 0x457a00
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x403bc3
push rbp
mov rbp, rsp
sub rsp, 0x18
mov rdx, qword [rax]
mov rcx, qword [rax + 8]
mov rax, rdx
call fcn.00408500
add rsp, 0x18
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.00455c20
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp 0x403ba0
cmp byte [0x006b0caa], 0
je 0x457a15
mov rcx, qword [rax + 8]
mov rax, qword [rax]
jmp 0x454c60
jmp 0x403ba0

Function at 0x457a20
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
nop
mov eax, dword [rax]
movabs rcx, 0xe7037ed1a0b428db
xor rcx, rax
xor rax, rbx
xor rax, qword [0x006b0fa0]
movabs rdx, 0xa0761d6478bd642f
xor rdx, rax
mov rax, rcx
mul rdx
xor rax, rdx
mov rcx, rax
movabs rax, 0x1d8e4e27c47d124b
mul rcx
xor rax, rdx
nop
nop
ret
cmp byte [0x006b0caa], 0
je 0x457a55
movq xmm0, rbx
pinsrd xmm0, dword [rax], 2
aesenc xmm0, xmmword [0x006b12c0]
aesenc xmm0, xmmword [0x006b12d0]
aesenc xmm0, xmmword [0x006b12e0]
movq rax, xmm0
ret
jmp 0x408720

Function at 0x457a60
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
nop
mov rax, qword [rax]
movabs rcx, 0xe7037ed1a0b428db
xor rcx, rax
xor rax, rbx
xor rax, qword [0x006b0fa0]
movabs rdx, 0xa0761d6478bd642f
xor rdx, rax
mov rax, rcx
mul rdx
xor rax, rdx
mov rcx, rax
movabs rax, 0x1d8e4e27c47d1247
mul rcx
xor rax, rdx
nop
nop
ret
cmp byte [0x006b0caa], 0
je 0x457a96
movq xmm0, rbx
pinsrq xmm0, qword [rax], 1
aesenc xmm0, xmmword [0x006b12c0]
aesenc xmm0, xmmword [0x006b12d0]
aesenc xmm0, xmmword [0x006b12e0]
movq rax, xmm0
ret
jmp 0x408780

Function at 0x459780
Capabilities:
Allocate thread local storage

Disassembly:
push rbp
mov rbp, rsp
mov rax, rsp
and rsp, 0xfffffffffffffff0
sub rsp, 0x30
mov qword [rsp + 0x20], rax
mov rax, qword [sym.imp.kernel32.dll_TlsAlloc]
call rax
mov rsp, qword [rsp + 0x20]
mov rcx, rax
cmp rcx, 0x40
jb 0x4597b4
mov rcx, 0x28
jmp 0x4597bf
shl rcx, 3
add rcx, 0x1480
mov qword [0x006b0ec0], rcx
pop rbp
ret
Function at 0x460880
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x46099a
push rbp
mov rbp, rsp
sub rsp, 0x60
movabs rdx, 0x1c692014126e353b
mov qword [rsp + 0x1a], rdx
movabs rdx, 0x3cab73c2916e6bb6
mov qword [rsp + 0x22], rdx
movabs rdx, 0xaa5dd820c4ff3cab
mov qword [rsp + 0x28], rdx
movabs rdx, 0x6520ae521dacc9be
mov qword [rsp + 0x30], rdx
movabs rdx, 0x180e0001071a1c0c
mov qword [rsp + 0x38], rdx
movabs rdx, 0xf1c17161317141b
mov qword [rsp + 0x40], rdx
movabs rdx, 0x1807091714190814
mov qword [rsp + 0x48], rdx
movabs rdx, 0x1b10030e11180417
mov qword [rsp + 0x50], rdx
movabs rdx, 0x151c150b10131c15
mov qword [rsp + 0x58], rdx
xor eax, eax
jmp 0x460937
movzx r9d, byte [rsp + rsi + 0x1a]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x39]
mov byte [rsp + rdi + 0x1a], dl
mov byte [rsp + rsi + 0x1a], r8b
add rax, 2
cmp rax, 0x28
jge 0x460969
movzx edx, byte [rsp + rax + 0x38]
movzx esi, byte [rsp + rax + 0x39]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x1e
jae 0x46098d
movzx r8d, byte [rsp + rdi + 0x1a]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x39]
cmp rsi, 0x1e
jb 0x46091d
jmp 0x460981
xor eax, eax
lea rbx, [rsp + 0x1a]
mov ecx, 0x1e
call fcn.00445b60
add rsp, 0x60
pop rbp
nop
ret
mov eax, esi
mov ecx, 0x1e
call fcn.00457ea0
mov eax, edi
mov ecx, 0x1e
call fcn.00457ea0
nop
call fcn.00455c20
nop
jmp fcn.00460880

Function at 0x460d40
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x460e2a
push rbp
mov rbp, rsp
sub rsp, 0x40
movabs rdx, 0x206401ea0cf87bfe
mov qword [rsp + 0x2c], rdx
movabs rdx, 0xe669fcf0206401ea
mov qword [rsp + 0x30], rdx
movabs rdx, 0x746c99970d9820fb
mov qword [rsp + 0x38], rdx
movabs rdx, 0xf0b020905100401
mov qword [rsp + 0x18], rdx
movabs rdx, 0x110e08000f0b0209
mov qword [rsp + 0x1c], rdx
movabs rdx, 0x50c0b050311040e
mov qword [rsp + 0x24], rdx
xor eax, eax
jmp 0x460dcd
movzx r9d, byte [rsp + rsi + 0x2c]
sub r9d, edx
lea edx, [r9 - 0x77]
mov byte [rsp + rdi + 0x2c], dl
lea edx, [r8 - 0x77]
mov byte [rsp + rsi + 0x2c], dl
add rax, 2
cmp rax, 0x14
jge 0x460dfa
movzx edx, byte [rsp + rax + 0x18]
movzx esi, byte [rsp + rax + 0x19]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x14
jae 0x460e1d
movzx r8d, byte [rsp + rdi + 0x2c]
sub r8d, edx
cmp rsi, 0x14
jb 0x460db0
jmp 0x460e11
xor eax, eax
lea rbx, [rsp + 0x2c]
mov ecx, 0x14
call fcn.00445b60
add rsp, 0x40
pop rbp
ret
mov eax, esi
mov ecx, 0x14
call fcn.00457ea0
mov eax, edi
mov ecx, 0x14
call fcn.00457ea0
nop
call fcn.00455c20
jmp fcn.00460d40
Function at 0x461160
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4612b8
push rbp
mov rbp, rsp
sub rsp, 0x78
movabs rdx, 0x65e070292d6c756d
mov qword [rsp + 0x1b], rdx
movabs rdx, 0x614508a530fefec5
mov qword [rsp + 0x23], rdx
movabs rdx, 0x73c531614508a530
mov qword [rsp + 0x26], rdx
movabs rdx, 0xce6e9d5c7465fd20
mov qword [rsp + 0x2e], rdx
movabs rdx, 0xff717461c1426f6e
mov qword [rsp + 0x36], rdx
movabs rdx, 0x726f7207b9151e6f
mov qword [rsp + 0x3e], rdx
movabs rdx, 0x141a2721221e241d
mov qword [rsp + 0x46], rdx
movabs rdx, 0x2110141a2721221e
mov qword [rsp + 0x48], rdx
movabs rdx, 0x1e0a0b1e260a0d1a
mov qword [rsp + 0x50], rdx
movabs rdx, 0xb0c220c1e061017
mov qword [rsp + 0x58], rdx
movabs rdx, 0xe0b03041d1e2214
mov qword [rsp + 0x60], rdx
movabs rdx, 0x626030417180414
mov qword [rsp + 0x68], rdx
movabs rdx, 0x25171d0911250809
mov qword [rsp + 0x70], rdx
xor eax, eax
jmp 0x461253
movzx r9d, byte [rsp + rsi + 0x1b]
lea edx, [r9 + rdx]
lea edx, [rdx - 9]
mov byte [rsp + rdi + 0x1b], dl
mov byte [rsp + rsi + 0x1b], r8b
add rax, 2
cmp rax, 0x32
jge 0x461288
movzx edx, byte [rsp + rax + 0x46]
movzx esi, byte [rsp + rax + 0x47]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x2b
jae 0x4612ab
movzx r8d, byte [rsp + rdi + 0x1b]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 9]
nop dword [rax]
cmp rsi, 0x2b
jb 0x461239
jmp 0x46129f
xor eax, eax
lea rbx, [rsp + 0x1b]
mov ecx, 0x2b
call fcn.00445b60
add rsp, 0x78
pop rbp
ret
mov eax, esi
mov ecx, 0x2b
call fcn.00457ea0
mov eax, edi
mov ecx, 0x2b
call fcn.00457ea0
nop
call fcn.00455c20
nop dword [rax]
jmp fcn.00461160

Function at 0x465300
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4653c7
push rbp
mov rbp, rsp
sub rsp, 0x30
movabs rdx, 0x6bbc5f73d4fcab55
mov qword [rsp + 0x19], rdx
movabs rdx, 0x9672036bbc5f73d4
mov qword [rsp + 0x1c], rdx
movabs rdx, 0x103020608000800
mov qword [rsp + 0x24], rdx
mov dword [rsp + 0x2c], 0xa0601
xor eax, eax
jmp 0x465368
movzx r9d, byte [rsp + rsi + 0x19]
sub r9d, edx
lea edx, [r9 - 0x3e]
mov byte [rsp + rdi + 0x19], dl
lea edx, [r8 - 0x3e]
mov byte [rsp + rsi + 0x19], dl
add rax, 2
cmp rax, 0xc
jge 0x465397
movzx edx, byte [rsp + rax + 0x24]
movzx esi, byte [rsp + rax + 0x25]
mov edi, edx
xor edx, esi
add edx, eax
nop
cmp rdi, 0xb
jae 0x4653ba
movzx r8d, byte [rsp + rdi + 0x19]
sub r8d, edx
cmp rsi, 0xb
jb 0x46534b
jmp 0x4653ae
xor eax, eax
lea rbx, [rsp + 0x19]
mov ecx, 0xb
call fcn.00445b60
add rsp, 0x30
pop rbp
ret
mov eax, esi
mov ecx, 0xb
call fcn.00457ea0
mov eax, edi
mov ecx, 0xb
call fcn.00457ea0
nop
call fcn.00455c20
jmp fcn.00465300
Function at 0x465960
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x465a18
push rbp
mov rbp, rsp
sub rsp, 0x30
movabs rdx, 0xd16970cc3e98a6d5
mov qword [rsp + 0x1e], rdx
movabs rdx, 0x307030401000402
mov qword [rsp + 0x26], rdx
mov word [rsp + 0x2e], 0x404
xor eax, eax
jmp 0x4659b8
movzx r9d, byte [rsp + rsi + 0x1e]
sub r9d, edx
lea edx, [r9 - 0x5e]
mov byte [rsp + rdi + 0x1e], dl
lea edx, [r8 - 0x5e]
mov byte [rsp + rsi + 0x1e], dl
add rax, 2
cmp rax, 0xa
jge 0x4659e8
movzx edx, byte [rsp + rax + 0x26]
movzx esi, byte [rsp + rax + 0x27]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 8
jae 0x465a0b
movzx r8d, byte [rsp + rdi + 0x1e]
sub r8d, edx
nop dword [rax]
cmp rsi, 8
jb 0x46599b
jmp 0x4659ff
xor eax, eax
lea rbx, [rsp + 0x1e]
mov ecx, 8
call fcn.00445b60
add rsp, 0x30
pop rbp
ret
mov eax, esi
mov ecx, 8
call fcn.00457ea0
mov eax, edi
mov ecx, 8
call fcn.00457ea0
nop
call fcn.00455c20
nop dword [rax]
jmp fcn.00465960

Function at 0x465e20
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x465efd
push rbp
mov rbp, rsp
sub rsp, 0x38
movabs rdx, 0x36312a2a44c17547
mov qword [rsp + 0x19], rdx
movabs rdx, 0x8e64c44b4736312a
mov qword [rsp + 0x1e], rdx
movabs rdx, 0x6040a0705050c05
mov qword [rsp + 0x26], rdx
movabs rdx, 0x60206040a070505
mov qword [rsp + 0x28], rdx
movabs rdx, 0x40c050a0509030a
mov qword [rsp + 0x30], rdx
xor eax, eax
nop
jmp 0x465ea0
movzx r9d, byte [rsp + rsi + 0x19]
sub r9d, edx
lea edx, [r9 - 0x54]
mov byte [rsp + rdi + 0x19], dl
lea edx, [r8 - 0x54]
mov byte [rsp + rsi + 0x19], dl
add rax, 2
nop
cmp rax, 0x12
jge 0x465ecd
movzx edx, byte [rsp + rax + 0x26]
movzx esi, byte [rsp + rax + 0x27]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0xd
jae 0x465ef0
movzx r8d, byte [rsp + rdi + 0x19]
sub r8d, edx
cmp rsi, 0xd
jb 0x465e82
jmp 0x465ee4
xor eax, eax
lea rbx, [rsp + 0x19]
mov ecx, 0xd
call fcn.00445b60
add rsp, 0x38
pop rbp
ret
mov eax, esi
mov ecx, 0xd
call fcn.00457ea0
mov eax, edi
mov ecx, 0xd
call fcn.00457ea0
nop
nop dword [rax]
call fcn.00455c20
jmp fcn.00465e20
Function at 0x466fa0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x46708c
push rbp
mov rbp, rsp
sub rsp, 0x48
movabs rdx, 0x53f06eccc547e359
mov qword [rsp + 0x1f], rdx
movabs rdx, 0xd6ddcd53f06eccc5
mov qword [rsp + 0x22], rdx
movabs rdx, 0x743f69cfc9e5516c
mov qword [rsp + 0x2a], rdx
movabs rdx, 0x60c110104000f06
mov qword [rsp + 0x32], rdx
movabs rdx, 0x604080d0902060c
mov qword [rsp + 0x38], rdx
movabs rdx, 0x9010c030e0a0e0d
mov qword [rsp + 0x40], rdx
xor eax, eax
jmp 0x46702a
movzx r9d, byte [rsp + rsi + 0x1f]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x79]
mov byte [rsp + rdi + 0x1f], dl
mov byte [rsp + rsi + 0x1f], r8b
add rax, 2
cmp rax, 0x16
jge 0x46705c
movzx edx, byte [rsp + rax + 0x32]
movzx esi, byte [rsp + rax + 0x33]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x13
jae 0x46707f
movzx r8d, byte [rsp + rdi + 0x1f]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x79]
cmp rsi, 0x13
jb 0x467010
jmp 0x467073
xor eax, eax
lea rbx, [rsp + 0x1f]
mov ecx, 0x13
call fcn.00445b60
add rsp, 0x48
pop rbp
ret
mov eax, esi
mov ecx, 0x13
call fcn.00457ea0
mov eax, edi
mov ecx, 0x13
call fcn.00457ea0
nop
call fcn.00455c20
jmp fcn.00466fa0

Function at 0x467540
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4675f8
push rbp
mov rbp, rsp
sub rsp, 0x30
movabs rdx, 0xd5d2191c2968d54d
mov qword [rsp + 0x1e], rdx
movabs rdx, 0x306010506010407
mov qword [rsp + 0x26], rdx
mov word [rsp + 0x2e], 0x404
xor eax, eax
jmp 0x467598
movzx r9d, byte [rsp + rsi + 0x1e]
sub r9d, edx
lea edx, [r9 + 0x50]
mov byte [rsp + rdi + 0x1e], dl
lea edx, [r8 + 0x50]
mov byte [rsp + rsi + 0x1e], dl
add rax, 2
cmp rax, 0xa
jge 0x4675c8
movzx edx, byte [rsp + rax + 0x26]
movzx esi, byte [rsp + rax + 0x27]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 8
jae 0x4675eb
movzx r8d, byte [rsp + rdi + 0x1e]
sub r8d, edx
nop dword [rax]
cmp rsi, 8
jb 0x46757b
jmp 0x4675df
xor eax, eax
lea rbx, [rsp + 0x1e]
mov ecx, 8
call fcn.00445b60
add rsp, 0x30
pop rbp
ret
mov eax, esi
mov ecx, 8
call fcn.00457ea0
mov eax, edi
mov ecx, 8
call fcn.00457ea0
nop
call fcn.00455c20
nop dword [rax]
jmp fcn.00467540