joyce8/EMBER2024-capa huggingface dataset:
Function at 0x42ce20
Capabilities:
Access peb ldr_data

Disassembly:
lea r12, [rsp - 0x20]
cmp r12, qword [r14 + 0x10]
jbe 0x42d0d9
push rbp
mov rbp, rsp
sub rsp, 0x98
mov qword [rsp + 0x48], 0
mov rax, qword [sym.imp.kernel32.dll_DuplicateHandle]
lea rcx, [rsp + 0x48]
mov qword [rsp], rax
mov qword [rsp + 8], 0xffffffffffffffff
mov qword [rsp + 0x10], 0xfffffffffffffffe
mov qword [rsp + 0x18], 0xffffffffffffffff
mov qword [rsp + 0x20], rcx
movups xmmword [rsp + 0x28], xmm15
mov qword [rsp + 0x38], 2
call fcn.0042d680
xorps xmm15, xmm15
mov r14, qword [0x006e7690]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x40], 0
nop
je 0x42d0b0
mov rax, qword [r14 + 0x30]
mov qword [rsp + 0x80], rax
test byte [rax], al
lea rcx, [rax + 0x310]
mov qword [rsp + 0x88], rcx
nop
mov rax, rcx
call fcn.00409160
mov rcx, qword [rsp + 0x48]
mov rdx, qword [rsp + 0x80]
mov qword [rdx + 0x318], rcx
mov rax, qword [sym.imp.kernel32.dll_GetCurrentThreadId]
call fcn.0042d340
mov rcx, qword [rsp + 0x80]
mov qword [rcx + 0x48], rax
cmp qword [rcx + 0x330], 0
jne 0x42cf69
cmp byte [0x006e7473], 0
je 0x42cf69
mov rax, qword [sym.imp.kernel32.dll_CreateWaitableTimerExW]
mov qword [rsp], rax
movups xmmword [rsp + 8], xmm15
mov qword [rsp + 0x18], 2
mov qword [rsp + 0x20], 0x100003
call fcn.0042d500
xorps xmm15, xmm15
mov r14, qword [0x006e7690]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x80]
mov qword [rcx + 0x330], rax
nop dword [rax]
test rax, rax
je 0x42d088
nop
nop
mov rax, qword [rsp + 0x88]
call fcn.00409380
movups xmmword [rsp + 0x50], xmm15
movups xmmword [rsp + 0x60], xmm15
movups xmmword [rsp + 0x70], xmm15
mov rcx, qword [sym.imp.kernel32.dll_VirtualQuery]
lea rdx, [rsp + 0x50]
mov qword [rsp], rcx
mov qword [rsp + 8], rdx
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], 0x30
call fcn.0042d480
xorps xmm15, xmm15
mov r14, qword [0x006e7690]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x20], 0
je 0x42d060
mov rcx, qword [rsp + 0x58]
lea rdx, [rcx + 0x4000]
mov qword [rsp + 0x90], r14
mov rsi, qword [r14 + 8]
cmp rsi, rdx
jb 0x42d041
sub rsi, rcx
add rsi, 0xffffffffffffc000
nop word [rax + rax]
cmp rsi, 0x4000000
ja 0x42d041
mov qword [r14], rdx
lea rax, [rcx + 0x53a0]
mov qword [r14 + 0x10], rax
mov qword [r14 + 0x18], rax
nop dword [rax + rax]
call fcn.00454980
xorps xmm15, xmm15
mov r14, qword [0x006e7690]
mov r14, qword gs:[r14]
mov r14, qword [r14]
add rsp, 0x98
pop rbp
nop
ret
mov rcx, qword [rsp + 0x90]
test byte [rcx], al
lea rax, [0x005b56c7]
mov ebx, 0xc
call fcn.0042fb00
nop dword [rax]
call fcn.00456300
xorps xmm15, xmm15
mov r14, qword [0x006e7690]
mov r14, qword gs:[r14]
mov r14, qword [r14]
lea rax, [0x005b7e1a]
mov ebx, 0x22
call fcn.0042fb00
call fcn.00456300
xorps xmm15, xmm15
mov r14, qword [0x006e7690]
mov r14, qword gs:[r14]
mov r14, qword [r14]
lea rax, [0x005b9352]
mov ebx, 0x30
call fcn.0042fb00
call fcn.00456300
xorps xmm15, xmm15
mov r14, qword [0x006e7690]
mov r14, qword gs:[r14]
mov r14, qword [r14]
lea rax, [0x005b8266]
mov ebx, 0x25
call fcn.0042fb00
nop
call fcn.00452c40
nop
jmp fcn.0042ce20
Function at 0x43c1c0
Capabilities:
Encode data using base64

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x43c327
push rbp
mov rbp, rsp
sub rsp, 0x18
mov ecx, dword [rax + 0x190]
mov edx, dword [rax + 0x194]
mov rsi, qword [rax + 0x998]
mov edi, dword [rax + 0x194]
cmp edi, edx
jne 0x43c1d2
cmp edx, ecx
jne 0x43c315
nop word [rax + rax]
test rsi, rsi
jne 0x43c315
mov qword [rsp + 0x28], rax
test rbx, rbx
jne 0x43c234
nop
call fcn.00456720
xorps xmm15, xmm15
mov r14, qword [0x006e7690]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rbx, qword [rsp]
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0x10], rbx
call fcn.0043c0e0
mov rcx, qword [rsp + 0x28]
mov edx, dword [rcx]
mov ebx, edx
sar edx, 0x1f
shr edx, 0x1b
add edx, ebx
mov esi, edx
and edx, 0xffffffe0
sub ebx, edx
test ebx, ebx
jl 0x43c310
mov rdx, qword [0x00693ad8]
sar esi, 5
mov rax, rcx
mov ecx, ebx
mov edi, 1
shl edi, cl
movsxd rsi, esi
cmp ecx, 0x20
sbb r8d, r8d
and edi, r8d
cmp rdx, rsi
jbe 0x43c305
mov rcx, qword [0x00693ad0]
lea rcx, [rcx + rsi*4]
lock or dword [rcx], edi
mov rcx, qword [0x006948b0]
mov qword [rax + 8], rcx
mov rcx, rax
nop
mov qword [0x006948b0], rax
nop
mov edx, 1
lea rsi, [0x006948b8]
lock xadd dword [rsi], edx
mov rdx, qword [rcx + 0x1228]
shr rdx, 0x3d
test dl, dl
jne 0x43c2f3
mov rax, qword [rsp + 0x10]
movabs rdx, 0x1fffffffffffffff
and rdx, rax
bts rdx, 0x3f
nop
nop
xchg qword [rcx + 0x1228], rdx
add rsp, 0x18
pop rbp
ret
lea rax, [0x005b878a]
mov ebx, 0x28
nop
call fcn.0042fb00
mov rax, rsi
mov rcx, rdx
call fcn.00454ec0
call fcn.0042e560
lea rax, [0x005b7fdc]
mov ebx, 0x23
call fcn.0042fb00
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.00452c40
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.0043c1c0
Function at 0x45a860
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x45a97a
push rbp
mov rbp, rsp
sub rsp, 0x58
movabs rdx, 0xe9f6ec6556662272
mov qword [rsp + 0x18], rdx
movabs rdx, 0x855ddeeae66c9020
mov qword [rsp + 0x20], rdx
movabs rdx, 0x6cce764f627c855d
mov qword [rsp + 0x26], rdx
movabs rdx, 0x20a6704a7440c42b
mov qword [rsp + 0x2e], rdx
movabs rdx, 0x10141a180e111814
mov qword [rsp + 0x36], rdx
movabs rdx, 0xf0310141a180e11
mov qword [rsp + 0x38], rdx
movabs rdx, 0x501071a0603120b
mov qword [rsp + 0x40], rdx
movabs rdx, 0xd05160b11140b1c
mov qword [rsp + 0x48], rdx
movabs rdx, 0x170b0e0c160f0918
mov qword [rsp + 0x50], rdx
xor eax, eax
jmp 0x45a917
movzx r9d, byte [rsp + rsi + 0x18]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x65]
mov byte [rsp + rdi + 0x18], dl
mov byte [rsp + rsi + 0x18], r8b
add rax, 2
cmp rax, 0x22
jge 0x45a949
movzx edx, byte [rsp + rax + 0x36]
movzx esi, byte [rsp + rax + 0x37]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x1e
jae 0x45a96d
movzx r8d, byte [rsp + rdi + 0x18]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x65]
cmp rsi, 0x1e
jb 0x45a8fd
jmp 0x45a961
xor eax, eax
lea rbx, [rsp + 0x18]
mov ecx, 0x1e
call fcn.00443420
add rsp, 0x58
pop rbp
nop
ret
mov eax, esi
mov ecx, 0x1e
call fcn.00454ec0
mov eax, edi
mov ecx, 0x1e
call fcn.00454ec0
nop
call fcn.00452c40
nop
jmp fcn.0045a860

Function at 0x4621e0
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4622aa
push rbp
mov rbp, rsp
sub rsp, 0x48
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x58], rax
mov qword [rsp], rax
mov qword [rsp + 8], rbx
mov byte [rsp + 0x10], 0
call fcn.00403080
xorps xmm15, xmm15
mov r14, qword [0x006e7690]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x18], 0xffffffffffffffff
jne 0x46228f
mov rcx, qword [rsp + 0x60]
lea rdx, [rcx + 1]
mov qword [rsp + 0x40], rdx
lea rax, [0x00586ae0]
xor ebx, ebx
mov rcx, rdx
call fcn.0043ff60
mov rbx, qword [rsp + 0x60]
mov rcx, rax
xor edi, edi
mov rsi, qword [rsp + 0x40]
mov rax, qword [rsp + 0x58]
nop dword [rax]
call fcn.00463d00
inc rbx
cmp rcx, rbx
jae 0x46227e
mov edi, 1
lea rsi, [0x00586ae0]
call fcn.00440040
mov word [rax + rbx*2 - 2], 0
xor edi, edi
xor esi, esi
add rsp, 0x48
pop rbp
ret
xor eax, eax
xor ebx, ebx
mov rcx, rbx
lea rdi, [0x005e3c18]
lea rsi, [0x005e38c0]
add rsp, 0x48
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.00452c40
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.004621e0
Function at 0x463c20
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x463cec
push rbp
mov rbp, rsp
sub rsp, 0x30
movabs rdx, 0x746b6e827880828e
mov qword [rsp + 0x18], rdx
mov word [rsp + 0x20], 0x6b6f
movabs rdx, 0x8080402030100
mov qword [rsp + 0x22], rdx
movabs rdx, 0x606020901090008
mov qword [rsp + 0x28], rdx
xor eax, eax
jmp 0x463c84
movzx r9d, byte [rsp + rsi + 0x18]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x16]
mov byte [rsp + rdi + 0x18], dl
mov byte [rsp + rsi + 0x18], r8b
add rax, 2
cmp rax, 0xe
jge 0x463cbc
movzx edx, byte [rsp + rax + 0x22]
movzx esi, byte [rsp + rax + 0x23]
mov edi, edx
xor edx, esi
add edx, eax
nop word [rax + rax]
cmp rdi, 0xa
jae 0x463cdf
movzx r8d, byte [rsp + rdi + 0x18]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x16]
cmp rsi, 0xa
jb 0x463c6a
jmp 0x463cd3
xor eax, eax
lea rbx, [rsp + 0x18]
mov ecx, 0xa
call fcn.00443420
add rsp, 0x30
pop rbp
ret
mov eax, esi
mov ecx, 0xa
call fcn.00454ec0
mov eax, edi
mov ecx, 0xa
call fcn.00454ec0
nop
call fcn.00452c40
jmp fcn.00463c20
Function at 0x465100
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4651c7
push rbp
mov rbp, rsp
sub rsp, 0x30
movabs rdx, 0xbdf76a6daf64610f
mov qword [rsp + 0x19], rdx
movabs rdx, 0xcc09c7bdf76a6daf
mov qword [rsp + 0x1c], rdx
movabs rdx, 0x907060803050606
mov qword [rsp + 0x24], rdx
mov dword [rsp + 0x2c], 0x70a0700
xor eax, eax
jmp 0x465168
movzx r9d, byte [rsp + rsi + 0x19]
sub r9d, edx
lea edx, [r9 - 0x42]
mov byte [rsp + rdi + 0x19], dl
lea edx, [r8 - 0x42]
mov byte [rsp + rsi + 0x19], dl
add rax, 2
cmp rax, 0xc
jge 0x465197
movzx edx, byte [rsp + rax + 0x24]
movzx esi, byte [rsp + rax + 0x25]
mov edi, edx
xor edx, esi
add edx, eax
nop
cmp rdi, 0xb
jae 0x4651ba
movzx r8d, byte [rsp + rdi + 0x19]
sub r8d, edx
cmp rsi, 0xb
jb 0x46514b
jmp 0x4651ae
xor eax, eax
lea rbx, [rsp + 0x19]
mov ecx, 0xb
call fcn.00443420
add rsp, 0x30
pop rbp
ret
mov eax, esi
mov ecx, 0xb
call fcn.00454ec0
mov eax, edi
mov ecx, 0xb
call fcn.00454ec0
nop
call fcn.00452c40
jmp fcn.00465100

Function at 0x4651e0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4652ca
push rbp
mov rbp, rsp
sub rsp, 0x48
movabs rdx, 0xd264697361ca6ece
mov qword [rsp + 0x1e], rdx
movabs rdx, 0xcc82cd16d2646973
mov qword [rsp + 0x22], rdx
movabs rdx, 0x2a2b6fda27c6bf65
mov qword [rsp + 0x2a], rdx
movabs rdx, 0x131308130e10120e
mov qword [rsp + 0x32], rdx
movabs rdx, 0xf0a07040a071313
mov qword [rsp + 0x38], rdx
movabs rdx, 0xa0b04020d090800
mov qword [rsp + 0x40], rdx
xor eax, eax
jmp 0x46526d
movzx r9d, byte [rsp + rsi + 0x1e]
sub r9d, edx
lea edx, [r9 - 0x46]
mov byte [rsp + rdi + 0x1e], dl
lea edx, [r8 - 0x46]
mov byte [rsp + rsi + 0x1e], dl
add rax, 2
cmp rax, 0x16
jge 0x46529a
movzx edx, byte [rsp + rax + 0x32]
movzx esi, byte [rsp + rax + 0x33]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x14
jae 0x4652bd
movzx r8d, byte [rsp + rdi + 0x1e]
sub r8d, edx
cmp rsi, 0x14
jb 0x465250
jmp 0x4652b1
xor eax, eax
lea rbx, [rsp + 0x1e]
mov ecx, 0x14
call fcn.00443420
add rsp, 0x48
pop rbp
ret
mov eax, esi
mov ecx, 0x14
call fcn.00454ec0
mov eax, edi
mov ecx, 0x14
call fcn.00454ec0
nop
call fcn.00452c40
jmp fcn.004651e0
Function at 0x4658c0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4659ac
push rbp
mov rbp, rsp
sub rsp, 0x48
movabs rdx, 0x6f181d6369a96564
mov qword [rsp + 0x19], rdx
movabs rdx, 0x5b3573611420726f
mov qword [rsp + 0x20], rdx
movabs rdx, 0x241a304b20fa635c
mov qword [rsp + 0x28], rdx
movabs rdx, 0x14020606160e0513
mov qword [rsp + 0x30], rdx
movabs rdx, 0xa150a140a150b02
mov qword [rsp + 0x38], rdx
movabs rdx, 0xd130f0e150e0d11
mov qword [rsp + 0x40], rdx
xor eax, eax
jmp 0x46594a
movzx r9d, byte [rsp + rsi + 0x19]
lea edx, [r9 + rdx]
lea edx, [rdx + 4]
mov byte [rsp + rdi + 0x19], dl
mov byte [rsp + rsi + 0x19], r8b
add rax, 2
cmp rax, 0x18
jge 0x46597c
movzx edx, byte [rsp + rax + 0x30]
movzx esi, byte [rsp + rax + 0x31]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x17
jae 0x46599f
movzx r8d, byte [rsp + rdi + 0x19]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 4]
cmp rsi, 0x17
jb 0x465930
jmp 0x465993
xor eax, eax
lea rbx, [rsp + 0x19]
mov ecx, 0x17
call fcn.00443420
add rsp, 0x48
pop rbp
ret
mov eax, esi
mov ecx, 0x17
call fcn.00454ec0
mov eax, edi
mov ecx, 0x17
call fcn.00454ec0
nop
call fcn.00452c40
jmp fcn.004658c0

Function at 0x467a80
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x467b4c
push rbp
mov rbp, rsp
sub rsp, 0x38
movabs rdx, 0xa73f65abfbfcbdc2
mov qword [rsp + 0x1d], rdx
movabs rdx, 0x3b2b5a73f65abfb
mov qword [rsp + 0x20], rdx
movabs rdx, 0x304060a060a0207
mov qword [rsp + 0x28], rdx
movabs rdx, 0x800060704020109
mov qword [rsp + 0x30], rdx
xor eax, eax
jmp 0x467aef
movzx r9d, byte [rsp + rsi + 0x1d]
sub r9d, edx
lea edx, [r9 - 0x39]
mov byte [rsp + rdi + 0x1d], dl
lea edx, [r8 - 0x39]
mov byte [rsp + rsi + 0x1d], dl
add rax, 2
cmp rax, 0x10
jge 0x467b1c
movzx edx, byte [rsp + rax + 0x28]
movzx esi, byte [rsp + rax + 0x29]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0xb
jae 0x467b3f
movzx r8d, byte [rsp + rdi + 0x1d]
sub r8d, edx
cmp rsi, 0xb
jb 0x467ad2
jmp 0x467b33
xor eax, eax
lea rbx, [rsp + 0x1d]
mov ecx, 0xb
call fcn.00443420
add rsp, 0x38
pop rbp
ret
mov eax, esi
mov ecx, 0xb
call fcn.00454ec0
mov eax, edi
mov ecx, 0xb
call fcn.00454ec0
nop
call fcn.00452c40
jmp fcn.00467a80
Function at 0x469040
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x46913b
push rbp
mov rbp, rsp
sub rsp, 0x48
movabs rdx, 0x75e24274b9fa3703
mov qword [rsp + 0x1c], rdx
movabs rdx, 0x512075e24274b9fa
mov qword [rsp + 0x1e], rdx
movabs rdx, 0x17483a52d0364375
mov qword [rsp + 0x26], rdx
movabs rdx, 0x90e01090d11100b
mov qword [rsp + 0x2e], rdx
movabs rdx, 0x110c030208060311
mov qword [rsp + 0x36], rdx
movabs rdx, 0x30d110c03020806
mov qword [rsp + 0x38], rdx
movabs rdx, 0xd0f000505080602
mov qword [rsp + 0x40], rdx
xor eax, eax
jmp 0x4690d9
movzx r9d, byte [rsp + rsi + 0x1c]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x11]
mov byte [rsp + rdi + 0x1c], dl
mov byte [rsp + rsi + 0x1c], r8b
add rax, 2
cmp rax, 0x1a
jge 0x46910b
movzx edx, byte [rsp + rax + 0x2e]
movzx esi, byte [rsp + rax + 0x2f]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x12
jae 0x46912e
movzx r8d, byte [rsp + rdi + 0x1c]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x11]
cmp rsi, 0x12
jb 0x4690bf
jmp 0x469122
xor eax, eax
lea rbx, [rsp + 0x1c]
mov ecx, 0x12
call fcn.00443420
add rsp, 0x48
pop rbp
ret
mov eax, esi
mov ecx, 0x12
call fcn.00454ec0
mov eax, edi
mov ecx, 0x12
call fcn.00454ec0
nop
nop dword [rax + rax]
call fcn.00452c40
jmp fcn.00469040

Function at 0x46aba0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x46acd8
push rbp
mov rbp, rsp
sub rsp, 0x70
movabs rdx, 0x5bcf70b1a26e1f63
mov qword [rsp + 0x1b], rdx
movabs rdx, 0x6104b22c2b5bcf70
mov qword [rsp + 0x20], rdx
movabs rdx, 0x20da65e161d7728a
mov qword [rsp + 0x28], rdx
movabs rdx, 0x292b373472dff0e7
mov qword [rsp + 0x30], rdx
movabs rdx, 0x79007463c8e7da64
mov qword [rsp + 0x38], rdx
movabs rdx, 0x1905010907171f20
mov qword [rsp + 0x40], rdx
movabs rdx, 0x1b0e0e0d0a0b051e
mov qword [rsp + 0x48], rdx
movabs rdx, 0x90e09080a041f1c
mov qword [rsp + 0x50], rdx
movabs rdx, 0x1f1b1a1b170f1f0a
mov qword [rsp + 0x58], rdx
movabs rdx, 0x607011319231c03
mov qword [rsp + 0x60], rdx
movabs rdx, 0x111516040b0f0b04
mov qword [rsp + 0x68], rdx
xor eax, eax
jmp 0x46ac78
movzx r9d, byte [rsp + rsi + 0x1b]
sub r9d, edx
lea edx, [r9 - 0x43]
mov byte [rsp + rdi + 0x1b], dl
lea edx, [r8 - 0x43]
mov byte [rsp + rsi + 0x1b], dl
add rax, 2
cmp rax, 0x30
jge 0x46aca8
movzx edx, byte [rsp + rax + 0x40]
movzx esi, byte [rsp + rax + 0x41]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x25
jae 0x46accb
movzx r8d, byte [rsp + rdi + 0x1b]
sub r8d, edx
nop dword [rax]
cmp rsi, 0x25
jb 0x46ac5b
jmp 0x46acbf
xor eax, eax
lea rbx, [rsp + 0x1b]
mov ecx, 0x25
call fcn.00443420
add rsp, 0x70
pop rbp
ret
mov eax, esi
mov ecx, 0x25
call fcn.00454ec0
mov eax, edi
mov ecx, 0x25
call fcn.00454ec0
nop
call fcn.00452c40
nop dword [rax]
jmp fcn.0046aba0
Function at 0x46b6c0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x46b7aa
push rbp
mov rbp, rsp
sub rsp, 0x48
movabs rdx, 0x3f75a196d4877f87
mov qword [rsp + 0x30], rdx
movabs rdx, 0x8f749772208b6562
mov qword [rsp + 0x38], rdx
movabs rdx, 0xb367d5617220669a
mov qword [rsp + 0x40], rdx
movabs rdx, 0x10503170d0f150f
mov qword [rsp + 0x18], rdx
movabs rdx, 0x170110040d030c10
mov qword [rsp + 0x20], rdx
movabs rdx, 0x102030a0a0f07
mov qword [rsp + 0x28], rdx
xor eax, eax
jmp 0x46b74d
movzx r9d, byte [rsp + rsi + 0x30]
sub r9d, edx
lea edx, [r9 - 7]
mov byte [rsp + rdi + 0x30], dl
lea edx, [r8 - 7]
mov byte [rsp + rsi + 0x30], dl
add rax, 2
cmp rax, 0x18
jge 0x46b77a
movzx edx, byte [rsp + rax + 0x18]
movzx esi, byte [rsp + rax + 0x19]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x18
jae 0x46b79d
movzx r8d, byte [rsp + rdi + 0x30]
sub r8d, edx
cmp rsi, 0x18
jb 0x46b730
jmp 0x46b791
xor eax, eax
lea rbx, [rsp + 0x30]
mov ecx, 0x18
call fcn.00443420
add rsp, 0x48
pop rbp
ret
mov eax, esi
mov ecx, 0x18
call fcn.00454ec0
mov eax, edi
mov ecx, 0x18
call fcn.00454ec0
nop
call fcn.00452c40
jmp fcn.0046b6c0

Function at 0x46c380
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x46c46a
push rbp
mov rbp, rsp
sub rsp, 0x40
movabs rdx, 0x70a8afb2b06cf26d
mov qword [rsp + 0x1a], rdx
movabs rdx, 0x619a70a8afb2b06c
mov qword [rsp + 0x1c], rdx
movabs rdx, 0xb4b2e8cdb7a48574
mov qword [rsp + 0x24], rdx
movabs rdx, 0xe0e0c0b0e0e0f0e
mov qword [rsp + 0x2c], rdx
movabs rdx, 0x11106100e0e0c0b
mov qword [rsp + 0x30], rdx
movabs rdx, 0x511030d0f04080c
mov qword [rsp + 0x38], rdx
xor eax, eax
jmp 0x46c40d
movzx r9d, byte [rsp + rsi + 0x1a]
sub r9d, edx
lea edx, [r9 - 0x25]
mov byte [rsp + rdi + 0x1a], dl
lea edx, [r8 - 0x25]
mov byte [rsp + rsi + 0x1a], dl
add rax, 2
cmp rax, 0x14
jge 0x46c43a
movzx edx, byte [rsp + rax + 0x2c]
movzx esi, byte [rsp + rax + 0x2d]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x12
jae 0x46c45d
movzx r8d, byte [rsp + rdi + 0x1a]
sub r8d, edx
cmp rsi, 0x12
jb 0x46c3f0
jmp 0x46c451
xor eax, eax
lea rbx, [rsp + 0x1a]
mov ecx, 0x12
call fcn.00443420
add rsp, 0x40
pop rbp
ret
mov eax, esi
mov ecx, 0x12
call fcn.00454ec0
mov eax, edi
mov ecx, 0x12
call fcn.00454ec0
nop
call fcn.00452c40
jmp fcn.0046c380
Function at 0x46c6a0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x46c7cc
push rbp
mov rbp, rsp
sub rsp, 0x60
movabs rdx, 0x4e4b6e454f5d6f52
mov qword [rsp + 0x19], rdx
movabs rdx, 0x6f5b0b622744730a
mov qword [rsp + 0x21], rdx
movabs rdx, 0x57626b68736f5b0b
mov qword [rsp + 0x26], rdx
movabs rdx, 0x5c20546b56753a32
mov qword [rsp + 0x2e], rdx
movabs rdx, 0xb110818140e1310
mov qword [rsp + 0x36], rdx
movabs rdx, 0xc1c0d190510161b
mov qword [rsp + 0x3e], rdx
movabs rdx, 0x2190c1c0d190510
mov qword [rsp + 0x40], rdx
movabs rdx, 0x151915141712071a
mov qword [rsp + 0x48], rdx
movabs rdx, 0x1b03061116130007
mov qword [rsp + 0x50], rdx
movabs rdx, 0x8180a0314060e0c
mov qword [rsp + 0x58], rdx
xor eax, eax
jmp 0x46c766
movzx r9d, byte [rsp + rsi + 0x19]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x1b]
mov byte [rsp + rdi + 0x19], dl
mov byte [rsp + rsi + 0x19], r8b
add rax, 2
cmp rax, 0x2a
jge 0x46c79c
movzx edx, byte [rsp + rax + 0x36]
movzx esi, byte [rsp + rax + 0x37]
mov edi, edx
xor edx, esi
add edx, eax
nop dword [rax]
cmp rdi, 0x1d
jae 0x46c7bf
movzx r8d, byte [rsp + rdi + 0x19]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x1b]
cmp rsi, 0x1d
jb 0x46c74c
jmp 0x46c7b3
xor eax, eax
lea rbx, [rsp + 0x19]
mov ecx, 0x1d
call fcn.00443420
add rsp, 0x60
pop rbp
ret
mov eax, esi
mov ecx, 0x1d
call fcn.00454ec0
mov eax, edi
mov ecx, 0x1d
call fcn.00454ec0
nop
call fcn.00452c40
jmp fcn.0046c6a0

Function at 0x46c7e0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x46c8bd
push rbp
mov rbp, rsp
sub rsp, 0x40
movabs rdx, 0xd230bc6f77c0d26e
mov qword [rsp + 0x1f], rdx
movabs rdx, 0x6e2ed364202f1fd2
mov qword [rsp + 0x26], rdx
movabs rdx, 0x105020608090108
mov qword [rsp + 0x2e], rdx
movabs rdx, 0x20d010502060809
mov qword [rsp + 0x30], rdx
movabs rdx, 0xc0c090c07020208
mov qword [rsp + 0x38], rdx
xor eax, eax
nop
jmp 0x46c860
movzx r9d, byte [rsp + rsi + 0x1f]
sub r9d, edx
lea edx, [r9 - 0x4d]
mov byte [rsp + rdi + 0x1f], dl
lea edx, [r8 - 0x4d]
mov byte [rsp + rsi + 0x1f], dl
add rax, 2
nop
cmp rax, 0x12
jge 0x46c88d
movzx edx, byte [rsp + rax + 0x2e]
movzx esi, byte [rsp + rax + 0x2f]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0xf
jae 0x46c8b0
movzx r8d, byte [rsp + rdi + 0x1f]
sub r8d, edx
cmp rsi, 0xf
jb 0x46c842
jmp 0x46c8a4
xor eax, eax
lea rbx, [rsp + 0x1f]
mov ecx, 0xf
call fcn.00443420
add rsp, 0x40
pop rbp
ret
mov eax, esi
mov ecx, 0xf
call fcn.00454ec0
mov eax, edi
mov ecx, 0xf
call fcn.00454ec0
nop
nop dword [rax]
call fcn.00452c40
jmp fcn.0046c7e0
Function at 0x46d100
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x46d1b2
push rbp
mov rbp, rsp
sub rsp, 0x28
movabs rdx, 0xc164c31e25206fbe
mov qword [rsp + 0x20], rdx
movabs rdx, 0x5070700040003
mov qword [rsp + 0x18], rdx
xor eax, eax
jmp 0x46d14e
movzx r9d, byte [rsp + rsi + 0x20]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x60]
mov byte [rsp + rdi + 0x20], dl
mov byte [rsp + rsi + 0x20], r8b
add rax, 2
cmp rax, 8
jge 0x46d182
movzx edx, byte [rsp + rax + 0x18]
movzx esi, byte [rsp + rax + 0x19]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 8
jae 0x46d1a5
movzx r8d, byte [rsp + rdi + 0x20]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x60]
cmp rsi, 8
jb 0x46d134
nop
jmp 0x46d199
xor eax, eax
lea rbx, [rsp + 0x20]
mov ecx, 8
call fcn.00443420
add rsp, 0x28
pop rbp
ret
mov eax, esi
mov ecx, 8
call fcn.00454ec0
mov eax, edi
mov ecx, 8
call fcn.00454ec0
nop
call fcn.00452c40
jmp fcn.0046d100

Function at 0x46d1c0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x46d2cc
push rbp
mov rbp, rsp
sub rsp, 0x50
movabs rdx, 0x42de662d523eec6e
mov qword [rsp + 0x1d], rdx
movabs rdx, 0x468363610b242072
mov qword [rsp + 0x25], rdx
movabs rdx, 0xb8468363610b2420
mov qword [rsp + 0x26], rdx
movabs rdx, 0x3d6ce9c16c696176
mov qword [rsp + 0x2e], rdx
movabs rdx, 0x70e0e100b030606
mov qword [rsp + 0x36], rdx
movabs rdx, 0x2070a10150a0418
mov qword [rsp + 0x3e], rdx
movabs rdx, 0x31602070a10150a
mov qword [rsp + 0x40], rdx
movabs rdx, 0x31002060a0f0110
mov qword [rsp + 0x48], rdx
xor eax, eax
jmp 0x46d268
movzx r9d, byte [rsp + rsi + 0x1d]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x14]
mov byte [rsp + rdi + 0x1d], dl
mov byte [rsp + rsi + 0x1d], r8b
add rax, 2
cmp rax, 0x1a
jge 0x46d29c
movzx edx, byte [rsp + rax + 0x36]
movzx esi, byte [rsp + rax + 0x37]
mov edi, edx
xor edx, esi
add edx, eax
nop
cmp rdi, 0x19
jae 0x46d2bf
movzx r8d, byte [rsp + rdi + 0x1d]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x14]
cmp rsi, 0x19
jb 0x46d24e
jmp 0x46d2b3
xor eax, eax
lea rbx, [rsp + 0x1d]
mov ecx, 0x19
call fcn.00443420
add rsp, 0x50
pop rbp
ret
mov eax, esi
mov ecx, 0x19
call fcn.00454ec0
mov eax, edi
mov ecx, 0x19
call fcn.00454ec0
nop
call fcn.00452c40
jmp fcn.0046d1c0