joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4627c0
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x403d63
push rbp
mov rbp, rsp
sub rsp, 0x18
mov rdx, qword [rax]
mov rcx, qword [rax + 8]
mov rax, rdx
call fcn.00409b00
add rsp, 0x18
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.004609c0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp 0x403d40
cmp byte [0x006a860b], 0
je 0x4627d5
mov rcx, qword [rax + 8]
mov rax, qword [rax]
jmp 0x45fa00
jmp 0x403d40

Function at 0x4627e0
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
nop
mov eax, dword [rax]
movabs rcx, 0xe7037ed1a0b428db
xor rcx, rax
xor rax, rbx
xor rax, qword [0x006a88e0]
movabs rdx, 0xa0761d6478bd642f
xor rdx, rax
mov rax, rcx
mul rdx
xor rax, rdx
mov rcx, rax
movabs rax, 0x1d8e4e27c47d124b
mul rcx
xor rax, rdx
nop
nop
ret
cmp byte [0x006a860b], 0
je 0x462815
movq xmm0, rbx
pinsrd xmm0, dword [rax], 2
aesenc xmm0, xmmword [0x006a8c60]
aesenc xmm0, xmmword [0x006a8c70]
aesenc xmm0, xmmword [0x006a8c80]
movq rax, xmm0
ret
jmp 0x409d20

Function at 0x462820
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
nop
mov rax, qword [rax]
movabs rcx, 0xe7037ed1a0b428db
xor rcx, rax
xor rax, rbx
xor rax, qword [0x006a88e0]
movabs rdx, 0xa0761d6478bd642f
xor rdx, rax
mov rax, rcx
mul rdx
xor rax, rdx
mov rcx, rax
movabs rax, 0x1d8e4e27c47d1247
mul rcx
xor rax, rdx
nop
nop
ret
cmp byte [0x006a860b], 0
je 0x462856
movq xmm0, rbx
pinsrq xmm0, qword [rax], 1
aesenc xmm0, xmmword [0x006a8c60]
aesenc xmm0, xmmword [0x006a8c70]
aesenc xmm0, xmmword [0x006a8c80]
movq rax, xmm0
ret
jmp 0x409d80

Function at 0x4645e0
Capabilities:
Allocate thread local storage

Disassembly:
push rbp
mov rbp, rsp
mov rax, rsp
and rsp, 0xfffffffffffffff0
sub rsp, 0x30
mov qword [rsp + 0x20], rax
mov rax, qword [sym.imp.kernel32.dll_TlsAlloc]
call rax
mov rsp, qword [rsp + 0x20]
mov rcx, rax
cmp rcx, 0x40
jb 0x464614
mov rcx, 0x28
jmp 0x46461f
shl rcx, 3
add rcx, 0x1480
mov qword [0x006a8818], rcx
pop rbp
ret

Function at 0x46c4e0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x46c59e
push rbp
mov rbp, rsp
sub rsp, 0x30
movabs rdx, 0x5020001040a0a07
mov qword [rsp + 0x19], rdx
mov dword [rsp + 0x21], 0x9000103
movabs rdx, 0x1837a4a79ca40e04
mov qword [rsp + 0x25], rdx
mov dword [rsp + 0x2c], 0xa7a83118
xor eax, eax
jmp 0x46c541
movzx r9d, byte [rsp + rsi + 0x25]
sub r9d, edx
lea edx, [r9 - 0x62]
mov byte [rsp + rdi + 0x25], dl
lea edx, [r8 - 0x62]
mov byte [rsp + rsi + 0x25], dl
add rax, 2
cmp rax, 0xc
jge 0x46c56e
movzx edx, byte [rsp + rax + 0x19]
movzx esi, byte [rsp + rax + 0x1a]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0xb
jae 0x46c591
movzx r8d, byte [rsp + rdi + 0x25]
sub r8d, edx
cmp rsi, 0xb
jb 0x46c524
jmp 0x46c585
xor eax, eax
lea rbx, [rsp + 0x25]
mov ecx, 0xb
call fcn.0044d280
add rsp, 0x30
pop rbp
ret
mov eax, esi
mov ecx, 0xb
call fcn.00462ca0
mov eax, edi
mov ecx, 0xb
call fcn.00462ca0
nop
nop
call fcn.004609c0
jmp fcn.0046c4e0
Function at 0x46d020
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x46d10a
push rbp
mov rbp, rsp
sub rsp, 0x40
movabs rdx, 0x90c050f030b0f0e
mov qword [rsp + 0x1b], rdx
movabs rdx, 0x203070f090c050f
mov qword [rsp + 0x1f], rdx
movabs rdx, 0x602070310080a07
mov qword [rsp + 0x27], rdx
movabs rdx, 0x1926f13011053131
mov qword [rsp + 0x2f], rdx
movabs rdx, 0x321926f130110531
mov qword [rsp + 0x30], rdx
movabs rdx, 0x3609f63817e20d19
mov qword [rsp + 0x38], rdx
xor eax, eax
jmp 0x46d0ad
movzx r9d, byte [rsp + rsi + 0x2f]
sub r9d, edx
lea edx, [r9 + 0x29]
mov byte [rsp + rdi + 0x2f], dl
lea edx, [r8 + 0x29]
mov byte [rsp + rsi + 0x2f], dl
add rax, 2
cmp rax, 0x14
jge 0x46d0da
movzx edx, byte [rsp + rax + 0x1b]
movzx esi, byte [rsp + rax + 0x1c]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x11
jae 0x46d0fd
movzx r8d, byte [rsp + rdi + 0x2f]
sub r8d, edx
cmp rsi, 0x11
jb 0x46d090
jmp 0x46d0f1
xor eax, eax
lea rbx, [rsp + 0x2f]
mov ecx, 0x11
call fcn.0044d280
add rsp, 0x40
pop rbp
ret
mov eax, esi
mov ecx, 0x11
call fcn.00462ca0
mov eax, edi
mov ecx, 0x11
call fcn.00462ca0
nop
call fcn.004609c0
jmp fcn.0046d020

Function at 0x46da40
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x46db3b
push rbp
mov rbp, rsp
sub rsp, 0x50
movabs rdx, 0x1130d00090d0402
mov qword [rsp + 0x1d], rdx
movabs rdx, 0xf020d0712060c00
mov qword [rsp + 0x25], rdx
movabs rdx, 0x3030e130c060f02
mov qword [rsp + 0x2b], rdx
movabs rdx, 0x304140106110e02
mov qword [rsp + 0x33], rdx
movabs rdx, 0x413134523b452746
mov qword [rsp + 0x3b], rdx
movabs rdx, 0x3b33325534413134
mov qword [rsp + 0x40], rdx
movabs rdx, 0x272a342430342151
mov qword [rsp + 0x48], rdx
xor eax, eax
jmp 0x46dad9
movzx r9d, byte [rsp + rsi + 0x3b]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x1e]
mov byte [rsp + rdi + 0x3b], dl
mov byte [rsp + rsi + 0x3b], r8b
add rax, 2
cmp rax, 0x1e
jge 0x46db0b
movzx edx, byte [rsp + rax + 0x1d]
movzx esi, byte [rsp + rax + 0x1e]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x15
jae 0x46db2e
movzx r8d, byte [rsp + rdi + 0x3b]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x1e]
cmp rsi, 0x15
jb 0x46dabf
jmp 0x46db22
xor eax, eax
lea rbx, [rsp + 0x3b]
mov ecx, 0x15
call fcn.0044d280
add rsp, 0x50
pop rbp
ret
mov eax, esi
mov ecx, 0x15
call fcn.00462ca0
mov eax, edi
mov ecx, 0x15
call fcn.00462ca0
nop
nop dword [rax + rax]
call fcn.004609c0
jmp fcn.0046da40
Function at 0x46db60
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x46dc5b
push rbp
mov rbp, rsp
sub rsp, 0x48
movabs rdx, 0x120409070f090809
mov qword [rsp + 0x19], rdx
movabs rdx, 0xe11041010001300
mov qword [rsp + 0x21], rdx
movabs rdx, 0x30d0e1104101000
mov qword [rsp + 0x23], rdx
movabs rdx, 0x109090e07060e10
mov qword [rsp + 0x2b], rdx
movabs rdx, 0x2932322a29312627
mov qword [rsp + 0x33], rdx
movabs rdx, 0x343531434c293232
mov qword [rsp + 0x38], rdx
movabs rdx, 0x350ddaf42f361825
mov qword [rsp + 0x40], rdx
xor eax, eax
jmp 0x46dbf9
movzx r9d, byte [rsp + rsi + 0x33]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x10]
mov byte [rsp + rdi + 0x33], dl
mov byte [rsp + rsi + 0x33], r8b
add rax, 2
cmp rax, 0x1a
jge 0x46dc2b
movzx edx, byte [rsp + rax + 0x19]
movzx esi, byte [rsp + rax + 0x1a]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x15
jae 0x46dc4e
movzx r8d, byte [rsp + rdi + 0x33]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x10]
cmp rsi, 0x15
jb 0x46dbdf
jmp 0x46dc42
xor eax, eax
lea rbx, [rsp + 0x33]
mov ecx, 0x15
call fcn.0044d280
add rsp, 0x48
pop rbp
ret
mov eax, esi
mov ecx, 0x15
call fcn.00462ca0
mov eax, edi
mov ecx, 0x15
call fcn.00462ca0
nop
nop dword [rax + rax]
call fcn.004609c0
jmp fcn.0046db60

Function at 0x46ed20
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x46ee3d
push rbp
mov rbp, rsp
sub rsp, 0x60
movabs rdx, 0x2190a020101180f
mov qword [rsp + 0x1e], rdx
movabs rdx, 0x110b0d100b000219
mov qword [rsp + 0x24], rdx
movabs rdx, 0x1014070b0d0c0b11
mov qword [rsp + 0x2c], rdx
movabs rdx, 0xb15161919140907
mov qword [rsp + 0x34], rdx
movabs rdx, 0x1a0205120314110b
mov qword [rsp + 0x3c], rdx
movabs rdx, 0xb437883982594848
mov qword [rsp + 0x44], rdx
movabs rdx, 0x5d38185962156a31
mov qword [rsp + 0x4c], rdx
movabs rdx, 0x3183fa9d5d381859
mov qword [rsp + 0x50], rdx
movabs rdx, 0x358bbb5f3975d561
mov qword [rsp + 0x58], rdx
xor eax, eax
jmp 0x46ede0
movzx r9d, byte [rsp + rsi + 0x44]
sub r9d, edx
lea edx, [r9 - 0x16]
mov byte [rsp + rdi + 0x44], dl
lea edx, [r8 - 0x16]
mov byte [rsp + rsi + 0x44], dl
add rax, 2
nop word [rax + rax]
cmp rax, 0x26
jge 0x46ee0d
movzx edx, byte [rsp + rax + 0x1e]
movzx esi, byte [rsp + rax + 0x1f]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x1c
jae 0x46ee30
movzx r8d, byte [rsp + rdi + 0x44]
sub r8d, edx
cmp rsi, 0x1c
jb 0x46edbd
jmp 0x46ee24
xor eax, eax
lea rbx, [rsp + 0x44]
mov ecx, 0x1c
call fcn.0044d280
add rsp, 0x60
pop rbp
ret
mov eax, esi
mov ecx, 0x1c
call fcn.00462ca0
mov eax, edi
mov ecx, 0x1c
call fcn.00462ca0
nop
nop dword [rax]
call fcn.004609c0
jmp fcn.0046ed20
Function at 0x46f3a0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x46f4ac
push rbp
mov rbp, rsp
sub rsp, 0x58
movabs rdx, 0x1a18190b110b061a
mov qword [rsp + 0x1a], rdx
movabs rdx, 0x1a090302041b1409
mov qword [rsp + 0x22], rdx
movabs rdx, 0x1219110817170e1c
mov qword [rsp + 0x2a], rdx
movabs rdx, 0xd161701020d0b0e
mov qword [rsp + 0x32], rdx
movabs rdx, 0x37cd33ea5d03e432
mov qword [rsp + 0x3a], rdx
movabs rdx, 0x30edeb32a634f0e9
mov qword [rsp + 0x42], rdx
movabs rdx, 0x37a937f2783530ed
mov qword [rsp + 0x48], rdx
movabs rdx, 0x35aeebf7b9c5a8d7
mov qword [rsp + 0x50], rdx
xor eax, eax
jmp 0x46f448
movzx r9d, byte [rsp + rsi + 0x3a]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x23]
mov byte [rsp + rdi + 0x3a], dl
mov byte [rsp + rsi + 0x3a], r8b
add rax, 2
cmp rax, 0x20
jge 0x46f47c
movzx edx, byte [rsp + rax + 0x1a]
movzx esi, byte [rsp + rax + 0x1b]
mov edi, edx
xor edx, esi
add edx, eax
nop
cmp rdi, 0x1e
jae 0x46f49f
movzx r8d, byte [rsp + rdi + 0x3a]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x23]
cmp rsi, 0x1e
jb 0x46f42e
jmp 0x46f493
xor eax, eax
lea rbx, [rsp + 0x3a]
mov ecx, 0x1e
call fcn.0044d280
add rsp, 0x58
pop rbp
ret
mov eax, esi
mov ecx, 0x1e
call fcn.00462ca0
mov eax, edi
mov ecx, 0x1e
call fcn.00462ca0
nop
call fcn.004609c0
jmp fcn.0046f3a0

Function at 0x4700e0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x47020c
push rbp
mov rbp, rsp
sub rsp, 0x60
movabs rdx, 0xb031f1d111a121f
mov qword [rsp + 0x1b], rdx
movabs rdx, 0xf1320050b031f1d
mov qword [rsp + 0x1f], rdx
movabs rdx, 0x11000a040a111e14
mov qword [rsp + 0x27], rdx
movabs rdx, 0x1800151c0f1d0415
mov qword [rsp + 0x2f], rdx
movabs rdx, 0x80b19080d06011a
mov qword [rsp + 0x37], rdx
movabs rdx, 0x334d4e5e8e304658
mov qword [rsp + 0x3f], rdx
movabs rdx, 0x4b334d4e5e8e3046
mov qword [rsp + 0x40], rdx
movabs rdx, 0x38573054316d8637
mov qword [rsp + 0x48], rdx
movabs rdx, 0x4b3432556176c879
mov qword [rsp + 0x50], rdx
movabs rdx, 0x4b7161725635fb66
mov qword [rsp + 0x58], rdx
xor eax, eax
jmp 0x4701a6
movzx r9d, byte [rsp + rsi + 0x3f]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x46]
mov byte [rsp + rdi + 0x3f], dl
mov byte [rsp + rsi + 0x3f], r8b
add rax, 2
cmp rax, 0x24
jge 0x4701dc
movzx edx, byte [rsp + rax + 0x1b]
movzx esi, byte [rsp + rax + 0x1c]
mov edi, edx
xor edx, esi
add edx, eax
nop dword [rax]
cmp rdi, 0x21
jae 0x4701ff
movzx r8d, byte [rsp + rdi + 0x3f]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x46]
cmp rsi, 0x21
jb 0x47018c
jmp 0x4701f3
xor eax, eax
lea rbx, [rsp + 0x3f]
mov ecx, 0x21
call fcn.0044d280
add rsp, 0x60
pop rbp
ret
mov eax, esi
mov ecx, 0x21
call fcn.00462ca0
mov eax, edi
mov ecx, 0x21
call fcn.00462ca0
nop
call fcn.004609c0
jmp fcn.004700e0
Function at 0x4798e0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
lea r12, [rsp - 0x10]
cmp r12, qword [r14 + 0x10]
jbe 0x479a52
push rbp
mov rbp, rsp
sub rsp, 0x88
movabs rdx, 0x2123111a251a0a10
mov qword [rsp + 0x1a], rdx
movabs rdx, 0x1a15002b241c0b2a
mov qword [rsp + 0x22], rdx
movabs rdx, 0x2a121e1c23161a15
mov qword [rsp + 0x28], rdx
movabs rdx, 0xa03082c16071102
mov qword [rsp + 0x30], rdx
movabs rdx, 0xb1d2c19170d2a2b
mov qword [rsp + 0x38], rdx
movabs rdx, 0xa2a252e0a1a1c16
mov qword [rsp + 0x40], rdx
movabs rdx, 0x11b0f121517110f
mov qword [rsp + 0x48], rdx
movabs rdx, 0x122d182e23191c0c
mov qword [rsp + 0x50], rdx
movabs rdx, 0xec766e6fc8b288f0
mov qword [rsp + 0x58], rdx
movabs rdx, 0x5761c64bce686965
mov qword [rsp + 0x60], rdx
movabs rdx, 0x8f7cee6570cd0ee8
mov qword [rsp + 0x68], rdx
movabs rdx, 0x72e4948c88ac5e6c
mov qword [rsp + 0x70], rdx
movabs rdx, 0x74611fddbb74ea6d
mov qword [rsp + 0x78], rdx
movabs rdx, 0x659c57449ea76220
mov qword [rsp + 0x80], rdx
xor eax, eax
jmp 0x4799ed
movzx r9d, byte [rsp + rsi + 0x58]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x62]
mov byte [rsp + rdi + 0x58], dl
mov byte [rsp + rsi + 0x58], r8b
add rax, 2
cmp rax, 0x3e
jge 0x479a1f
movzx edx, byte [rsp + rax + 0x1a]
movzx esi, byte [rsp + rax + 0x1b]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x30
jae 0x479a45
movzx r8d, byte [rsp + rdi + 0x58]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x62]
cmp rsi, 0x30
jb 0x4799d3
jmp 0x479a39
xor eax, eax
lea rbx, [rsp + 0x58]
mov ecx, 0x30
call fcn.0044d280
add rsp, 0x88
pop rbp
ret
mov eax, esi
mov ecx, 0x30
call fcn.00462ca0
mov eax, edi
mov ecx, 0x30
call fcn.00462ca0
nop
call fcn.004609c0
jmp fcn.004798e0

Function at 0x47bde0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x47bf0c
push rbp
mov rbp, rsp
sub rsp, 0x60
movabs rdx, 0x180d0508070b1802
mov qword [rsp + 0x18], rdx
movabs rdx, 0x1406141c1d001c07
mov qword [rsp + 0x20], rdx
movabs rdx, 0x17161406141c1d00
mov qword [rsp + 0x22], rdx
movabs rdx, 0x414011a0518130a
mov qword [rsp + 0x2a], rdx
movabs rdx, 0x1a1601190f141106
mov qword [rsp + 0x32], rdx
movabs rdx, 0x10415050d061001
mov qword [rsp + 0x3a], rdx
movabs rdx, 0x9ba6887263a77474
mov qword [rsp + 0x42], rdx
movabs rdx, 0x74749469ec786f4a
mov qword [rsp + 0x4a], rdx
movabs rdx, 0x209679207f467474
mov qword [rsp + 0x50], rdx
movabs rdx, 0x82816178718aa39d
mov qword [rsp + 0x58], rdx
xor eax, eax
jmp 0x47bea6
movzx r9d, byte [rsp + rsi + 0x42]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x36]
mov byte [rsp + rdi + 0x42], dl
mov byte [rsp + rsi + 0x42], r8b
add rax, 2
cmp rax, 0x2a
jge 0x47bedc
movzx edx, byte [rsp + rax + 0x18]
movzx esi, byte [rsp + rax + 0x19]
mov edi, edx
xor edx, esi
add edx, eax
nop dword [rax]
cmp rdi, 0x1e
jae 0x47beff
movzx r8d, byte [rsp + rdi + 0x42]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x36]
cmp rsi, 0x1e
jb 0x47be8c
jmp 0x47bef3
xor eax, eax
lea rbx, [rsp + 0x42]
mov ecx, 0x1e
call fcn.0044d280
add rsp, 0x60
pop rbp
ret
mov eax, esi
mov ecx, 0x1e
call fcn.00462ca0
mov eax, edi
mov ecx, 0x1e
call fcn.00462ca0
nop
call fcn.004609c0
jmp fcn.0047bde0
Function at 0x47c960
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x47ca18
push rbp
mov rbp, rsp
sub rsp, 0x30
movabs rdx, 0x707060503060503
mov qword [rsp + 0x1e], rdx
mov word [rsp + 0x26], 0
movabs rdx, 0x7479946e926c6153
mov qword [rsp + 0x28], rdx
xor eax, eax
jmp 0x47c9b8
movzx r9d, byte [rsp + rsi + 0x28]
sub r9d, edx
lea edx, [r9 - 9]
mov byte [rsp + rdi + 0x28], dl
lea edx, [r8 - 9]
mov byte [rsp + rsi + 0x28], dl
add rax, 2
cmp rax, 0xa
jge 0x47c9e8
movzx edx, byte [rsp + rax + 0x1e]
movzx esi, byte [rsp + rax + 0x1f]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 8
jae 0x47ca0b
movzx r8d, byte [rsp + rdi + 0x28]
sub r8d, edx
nop dword [rax]
cmp rsi, 8
jb 0x47c99b
jmp 0x47c9ff
xor eax, eax
lea rbx, [rsp + 0x28]
mov ecx, 8
call fcn.0044d280
add rsp, 0x30
pop rbp
ret
mov eax, esi
mov ecx, 8
call fcn.00462ca0
mov eax, edi
mov ecx, 8
call fcn.00462ca0
nop
call fcn.004609c0
nop dword [rax]
jmp fcn.0047c960

Function at 0x47cec0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x47cf72
push rbp
mov rbp, rsp
sub rsp, 0x28
movabs rdx, 0x306050300000600
mov qword [rsp + 0x18], rdx
movabs rdx, 0x6fbcd36d26706fe0
mov qword [rsp + 0x20], rdx
xor eax, eax
jmp 0x47cf0e
movzx r9d, byte [rsp + rsi + 0x20]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x3f]
mov byte [rsp + rdi + 0x20], dl
mov byte [rsp + rsi + 0x20], r8b
add rax, 2
cmp rax, 8
jge 0x47cf42
movzx edx, byte [rsp + rax + 0x18]
movzx esi, byte [rsp + rax + 0x19]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 8
jae 0x47cf65
movzx r8d, byte [rsp + rdi + 0x20]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x3f]
cmp rsi, 8
jb 0x47cef4
nop
jmp 0x47cf59
xor eax, eax
lea rbx, [rsp + 0x20]
mov ecx, 8
call fcn.0044d280
add rsp, 0x28
pop rbp
ret
mov eax, esi
mov ecx, 8
call fcn.00462ca0
mov eax, edi
mov ecx, 8
call fcn.00462ca0
nop
call fcn.004609c0
jmp fcn.0047cec0

Function at 0x47d4c0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x47d57e
push rbp
mov rbp, rsp
sub rsp, 0x30
movabs rdx, 0x403030009010301
mov qword [rsp + 0x18], rdx
mov dword [rsp + 0x20], 0x3000000
movabs rdx, 0x694d5f4361705c69
mov qword [rsp + 0x24], rdx
mov dword [rsp + 0x2c], 0x6e61766e
xor eax, eax
jmp 0x47d521
movzx r9d, byte [rsp + rsi + 0x24]
sub r9d, edx
lea edx, [r9 + 0xd]
mov byte [rsp + rdi + 0x24], dl
lea edx, [r8 + 0xd]
mov byte [rsp + rsi + 0x24], dl
add rax, 2
cmp rax, 0xc
jge 0x47d54e
movzx edx, byte [rsp + rax + 0x18]
movzx esi, byte [rsp + rax + 0x19]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0xc
jae 0x47d571
movzx r8d, byte [rsp + rdi + 0x24]
sub r8d, edx
cmp rsi, 0xc
jb 0x47d504
jmp 0x47d565
xor eax, eax
lea rbx, [rsp + 0x24]
mov ecx, 0xc
call fcn.0044d280
add rsp, 0x30
pop rbp
ret
mov eax, esi
mov ecx, 0xc
call fcn.00462ca0
mov eax, edi
mov ecx, 0xc
call fcn.00462ca0
nop
nop
call fcn.004609c0
jmp fcn.0047d4c0
Function at 0x47de80
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x47df32
push rbp
mov rbp, rsp
sub rsp, 0x28
movabs rdx, 0x503030602030302
mov qword [rsp + 0x18], rdx
movabs rdx, 0x6e5e6e673e536547
mov qword [rsp + 0x20], rdx
xor eax, eax
jmp 0x47ded1
movzx r9d, byte [rsp + rsi + 0x20]
sub r9d, edx
lea edx, [r9 + 0x10]
mov byte [rsp + rdi + 0x20], dl
lea edx, [r8 + 0x10]
mov byte [rsp + rsi + 0x20], dl
add rax, 2
cmp rax, 8
jge 0x47defe
movzx edx, byte [rsp + rax + 0x18]
movzx esi, byte [rsp + rax + 0x19]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 8
jae 0x47df25
movzx r8d, byte [rsp + rdi + 0x20]
sub r8d, edx
cmp rsi, 8
jb 0x47deb4
jmp 0x47df15
xor eax, eax
lea rbx, [rsp + 0x20]
mov ecx, 8
call fcn.0044d280
add rsp, 0x28
pop rbp
ret
mov eax, esi
mov ecx, 8
nop dword [rax]
call fcn.00462ca0
mov eax, edi
mov ecx, 8
call fcn.00462ca0
nop
call fcn.004609c0
jmp fcn.0047de80

Function at 0x47df40
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x47dffd
push rbp
mov rbp, rsp
sub rsp, 0x30
movabs rdx, 0x805010901090707
mov qword [rsp + 0x1a], rdx
mov dword [rsp + 0x22], 0x6030207
movabs rdx, 0x30575d6f59624447
mov qword [rsp + 0x26], rdx
mov word [rsp + 0x2e], 0x3b60
xor eax, eax
jmp 0x47dfa0
movzx r9d, byte [rsp + rsi + 0x26]
sub r9d, edx
lea edx, [r9 + 0x1f]
mov byte [rsp + rdi + 0x26], dl
lea edx, [r8 + 0x1f]
mov byte [rsp + rsi + 0x26], dl
add rax, 2
cmp rax, 0xc
jge 0x47dfcd
movzx edx, byte [rsp + rax + 0x1a]
movzx esi, byte [rsp + rax + 0x1b]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0xa
jae 0x47dff0
movzx r8d, byte [rsp + rdi + 0x26]
sub r8d, edx
cmp rsi, 0xa
jb 0x47df83
jmp 0x47dfe4
xor eax, eax
lea rbx, [rsp + 0x26]
mov ecx, 0xa
call fcn.0044d280
add rsp, 0x30
pop rbp
ret
mov eax, esi
mov ecx, 0xa
call fcn.00462ca0
mov eax, edi
mov ecx, 0xa
call fcn.00462ca0
nop
nop dword [rax]
call fcn.004609c0
jmp fcn.0047df40

Function at 0x47e4e0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x47e598
push rbp
mov rbp, rsp
sub rsp, 0x30
movabs rdx, 0x407060101040203
mov qword [rsp + 0x1e], rdx
mov word [rsp + 0x26], 0x704
movabs rdx, 0xd72b6bd8322d9d47
mov qword [rsp + 0x28], rdx
xor eax, eax
jmp 0x47e535
movzx r9d, byte [rsp + rsi + 0x28]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x3f]
mov byte [rsp + rdi + 0x28], dl
mov byte [rsp + rsi + 0x28], r8b
add rax, 2
cmp rax, 0xa
jge 0x47e568
movzx edx, byte [rsp + rax + 0x1e]
movzx esi, byte [rsp + rax + 0x1f]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 8
jae 0x47e58b
movzx r8d, byte [rsp + rdi + 0x28]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x3f]
nop
cmp rsi, 8
jb 0x47e51b
jmp 0x47e57f
xor eax, eax
lea rbx, [rsp + 0x28]
mov ecx, 8
call fcn.0044d280
add rsp, 0x30
pop rbp
ret
mov eax, esi
mov ecx, 8
call fcn.00462ca0
mov eax, edi
mov ecx, 8
call fcn.00462ca0
nop
call fcn.004609c0
nop dword [rax]
jmp fcn.0047e4e0
Function at 0x47e880
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x47e966
push rbp
mov rbp, rsp
sub rsp, 0x40
movabs rdx, 0xb05090e0d09010d
mov qword [rsp + 0x1a], rdx
movabs rdx, 0x80a00040a020b05
mov qword [rsp + 0x20], rdx
movabs rdx, 0xd0b02080d070109
mov qword [rsp + 0x28], rdx
movabs rdx, 0xdf61e594654157bd
mov qword [rsp + 0x30], rdx
movabs rdx, 0x63fed16daee5febd
mov qword [rsp + 0x38], rdx
xor eax, eax
nop
jmp 0x47e900
movzx r9d, byte [rsp + rsi + 0x30]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x59]
mov byte [rsp + rdi + 0x30], dl
mov byte [rsp + rsi + 0x30], r8b
add rax, 2
nop dword [rax]
cmp rax, 0x16
jge 0x47e932
movzx edx, byte [rsp + rax + 0x1a]
movzx esi, byte [rsp + rax + 0x1b]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x10
jae 0x47e957
movzx r8d, byte [rsp + rdi + 0x30]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x59]
cmp rsi, 0x10
jb 0x47e8e2
jmp 0x47e94b
xor eax, eax
lea rbx, [rsp + 0x30]
mov ecx, 0x10
nop
call fcn.0044d280
add rsp, 0x40
pop rbp
ret
mov eax, esi
mov ecx, 0x10
call fcn.00462ca0
mov eax, edi
mov ecx, 0x10
nop
call fcn.00462ca0
nop
call fcn.004609c0
jmp fcn.0047e880

Function at 0x47e980
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x47ea46
push rbp
mov rbp, rsp
sub rsp, 0x30
movabs rdx, 0x207060501080005
mov qword [rsp + 0x1d], rdx
mov word [rsp + 0x25], 0x501
movabs rdx, 0x17cffe72651413dc
mov qword [rsp + 0x27], rdx
mov byte [rsp + 0x2f], 0xc6
xor eax, eax
nop
jmp 0x47e9e0
movzx r9d, byte [rsp + rsi + 0x27]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x46]
mov byte [rsp + rdi + 0x27], dl
mov byte [rsp + rsi + 0x27], r8b
add rax, 2
nop dword [rax]
cmp rax, 0xa
jge 0x47ea12
movzx edx, byte [rsp + rax + 0x1d]
movzx esi, byte [rsp + rax + 0x1e]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 9
jae 0x47ea37
movzx r8d, byte [rsp + rdi + 0x27]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x46]
cmp rsi, 9
jb 0x47e9c2
jmp 0x47ea2b
xor eax, eax
lea rbx, [rsp + 0x27]
mov ecx, 9
nop
call fcn.0044d280
add rsp, 0x30
pop rbp
ret
mov eax, esi
mov ecx, 9
call fcn.00462ca0
mov eax, edi
mov ecx, 9
nop
call fcn.00462ca0
nop
call fcn.004609c0
jmp fcn.0047e980