joyce8/EMBER2024-capa huggingface dataset:
Function at 0x460b80
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4031e3
push rbp
mov rbp, rsp
sub rsp, 0x18
mov rdx, qword [rax]
mov rcx, qword [rax + 8]
mov rax, rdx
call fcn.00408c60
add rsp, 0x18
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.0045eda0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp 0x4031c0
cmp byte [0x0082e86c], 0
je 0x460b95
mov rcx, qword [rax + 8]
mov rax, qword [rax]
jmp 0x45dde0
jmp 0x4031c0

Function at 0x460ba0
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
nop
mov eax, dword [rax]
movabs rcx, 0xe7037ed1a0b428db
xor rcx, rax
xor rax, rbx
xor rax, qword [0x0082eb80]
movabs rdx, 0xa0761d6478bd642f
xor rdx, rax
mov rax, rcx
mul rdx
xor rax, rdx
mov rcx, rax
movabs rax, 0x1d8e4e27c47d124b
mul rcx
xor rax, rdx
nop
nop
ret
cmp byte [0x0082e86c], 0
je 0x460bd5
movq xmm0, rbx
pinsrd xmm0, dword [rax], 2
aesenc xmm0, xmmword [0x0082eea0]
aesenc xmm0, xmmword [0x0082eeb0]
aesenc xmm0, xmmword [0x0082eec0]
movq rax, xmm0
ret
jmp 0x408e80

Function at 0x460be0
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
nop
mov rax, qword [rax]
movabs rcx, 0xe7037ed1a0b428db
xor rcx, rax
xor rax, rbx
xor rax, qword [0x0082eb80]
movabs rdx, 0xa0761d6478bd642f
xor rdx, rax
mov rax, rcx
mul rdx
xor rax, rdx
mov rcx, rax
movabs rax, 0x1d8e4e27c47d1247
mul rcx
xor rax, rdx
nop
nop
ret
cmp byte [0x0082e86c], 0
je 0x460c16
movq xmm0, rbx
pinsrq xmm0, qword [rax], 1
aesenc xmm0, xmmword [0x0082eea0]
aesenc xmm0, xmmword [0x0082eeb0]
aesenc xmm0, xmmword [0x0082eec0]
movq rax, xmm0
ret
jmp 0x408ee0

Function at 0x4628e0
Capabilities:
Allocate thread local storage

Disassembly:
push rbp
mov rbp, rsp
mov rax, rsp
and rsp, 0xfffffffffffffff0
sub rsp, 0x30
mov qword [rsp + 0x20], rax
mov rax, qword [sym.imp.kernel32.dll_TlsAlloc]
call rax
mov rsp, qword [rsp + 0x20]
mov rcx, rax
cmp rcx, 0x40
jb 0x462914
mov rcx, 0x28
jmp 0x46291f
shl rcx, 3
add rcx, 0x1480
mov qword [0x0082eac0], rcx
pop rbp
ret
Function at 0x466aa0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x466bcc
push rbp
mov rbp, rsp
sub rsp, 0x68
movabs rdx, 0x3ab60a11f08d0935
mov qword [rsp + 0x1e], rdx
movabs rdx, 0x666f8631f6de4524
mov qword [rsp + 0x26], rdx
movabs rdx, 0x6cdd4e9a698d666f
mov qword [rsp + 0x2c], rdx
movabs rdx, 0x1bf88f798af26969
mov qword [rsp + 0x34], rdx
movabs rdx, 0x1c020a0b04060d13
mov qword [rsp + 0x3c], rdx
movabs rdx, 0x100d1b0602000603
mov qword [rsp + 0x44], rdx
movabs rdx, 0x10180408100d1b06
mov qword [rsp + 0x48], rdx
movabs rdx, 0x190c10131012060c
mov qword [rsp + 0x50], rdx
movabs rdx, 0xa0c011714130d0c
mov qword [rsp + 0x58], rdx
movabs rdx, 0x13130b0510011c1d
mov qword [rsp + 0x60], rdx
xor eax, eax
jmp 0x466b66
movzx r9d, byte [rsp + rsi + 0x1e]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x25]
mov byte [rsp + rdi + 0x1e], dl
mov byte [rsp + rsi + 0x1e], r8b
add rax, 2
cmp rax, 0x2c
jge 0x466b9c
movzx edx, byte [rsp + rax + 0x3c]
movzx esi, byte [rsp + rax + 0x3d]
mov edi, edx
xor edx, esi
add edx, eax
nop dword [rax]
cmp rdi, 0x1e
jae 0x466bbf
movzx r8d, byte [rsp + rdi + 0x1e]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x25]
cmp rsi, 0x1e
jb 0x466b4c
jmp 0x466bb3
xor eax, eax
lea rbx, [rsp + 0x1e]
mov ecx, 0x1e
call fcn.0044bb20
add rsp, 0x68
pop rbp
ret
mov eax, esi
mov ecx, 0x1e
call fcn.00461020
mov eax, edi
mov ecx, 0x1e
call fcn.00461020
nop
call fcn.0045eda0
jmp fcn.00466aa0

Function at 0x469d00
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x469e0c
push rbp
mov rbp, rsp
sub rsp, 0x58
movabs rdx, 0x3c59205b636eaf3e
mov qword [rsp + 0x1a], rdx
movabs rdx, 0x5e4c1e366b256f29
mov qword [rsp + 0x22], rdx
movabs rdx, 0x23456f6c60205e4c
mov qword [rsp + 0x28], rdx
movabs rdx, 0x41f774756d20f665
mov qword [rsp + 0x30], rdx
movabs rdx, 0x81c0a150e071106
mov qword [rsp + 0x38], rdx
movabs rdx, 0xc0a0f081d0f1004
mov qword [rsp + 0x40], rdx
movabs rdx, 0x1701071c070d1701
mov qword [rsp + 0x48], rdx
movabs rdx, 0x14170e0a00150c01
mov qword [rsp + 0x50], rdx
xor eax, eax
jmp 0x469da8
movzx r9d, byte [rsp + rsi + 0x1a]
lea edx, [r9 + rdx]
lea edx, [rdx - 2]
mov byte [rsp + rdi + 0x1a], dl
mov byte [rsp + rsi + 0x1a], r8b
add rax, 2
cmp rax, 0x20
jge 0x469ddc
movzx edx, byte [rsp + rax + 0x38]
movzx esi, byte [rsp + rax + 0x39]
mov edi, edx
xor edx, esi
add edx, eax
nop
cmp rdi, 0x1e
jae 0x469dff
movzx r8d, byte [rsp + rdi + 0x1a]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 2]
cmp rsi, 0x1e
jb 0x469d8e
jmp 0x469df3
xor eax, eax
lea rbx, [rsp + 0x1a]
mov ecx, 0x1e
call fcn.0044bb20
add rsp, 0x58
pop rbp
ret
mov eax, esi
mov ecx, 0x1e
call fcn.00461020
mov eax, edi
mov ecx, 0x1e
call fcn.00461020
nop
call fcn.0045eda0
jmp fcn.00469d00
Function at 0x46bbe0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x46bccc
push rbp
mov rbp, rsp
sub rsp, 0x48
movabs rdx, 0x313550616b480326
mov qword [rsp + 0x1e], rdx
movabs rdx, 0x506c0f4f31355061
mov qword [rsp + 0x22], rdx
movabs rdx, 0x74425266416f5864
mov qword [rsp + 0x2a], rdx
movabs rdx, 0x6040808000b0411
mov qword [rsp + 0x32], rdx
movabs rdx, 0x2000f1209050604
mov qword [rsp + 0x38], rdx
movabs rdx, 0xd010708070d0d0b
mov qword [rsp + 0x40], rdx
xor eax, eax
jmp 0x46bc6a
movzx r9d, byte [rsp + rsi + 0x1e]
lea edx, [r9 + rdx]
lea edx, [rdx - 3]
mov byte [rsp + rdi + 0x1e], dl
mov byte [rsp + rsi + 0x1e], r8b
add rax, 2
cmp rax, 0x16
jge 0x46bc9c
movzx edx, byte [rsp + rax + 0x32]
movzx esi, byte [rsp + rax + 0x33]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x14
jae 0x46bcbf
movzx r8d, byte [rsp + rdi + 0x1e]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 3]
cmp rsi, 0x14
jb 0x46bc50
jmp 0x46bcb3
xor eax, eax
lea rbx, [rsp + 0x1e]
mov ecx, 0x14
call fcn.0044bb20
add rsp, 0x48
pop rbp
ret
mov eax, esi
mov ecx, 0x14
call fcn.00461020
mov eax, edi
mov ecx, 0x14
call fcn.00461020
nop
call fcn.0045eda0
jmp fcn.0046bbe0

Function at 0x46eee0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x46efa7
push rbp
mov rbp, rsp
sub rsp, 0x30
movabs rdx, 0x6b41e97365e9ed44
mov qword [rsp + 0x19], rdx
movabs rdx, 0x7572d26b41e97365
mov qword [rsp + 0x1c], rdx
movabs rdx, 0x4080001020208
mov qword [rsp + 0x24], rdx
mov dword [rsp + 0x2c], 0x1050008
xor eax, eax
jmp 0x46ef48
movzx r9d, byte [rsp + rsi + 0x19]
sub r9d, edx
lea edx, [r9 - 0x72]
mov byte [rsp + rdi + 0x19], dl
lea edx, [r8 - 0x72]
mov byte [rsp + rsi + 0x19], dl
add rax, 2
cmp rax, 0xc
jge 0x46ef77
movzx edx, byte [rsp + rax + 0x24]
movzx esi, byte [rsp + rax + 0x25]
mov edi, edx
xor edx, esi
add edx, eax
nop
cmp rdi, 0xb
jae 0x46ef9a
movzx r8d, byte [rsp + rdi + 0x19]
sub r8d, edx
cmp rsi, 0xb
jb 0x46ef2b
jmp 0x46ef8e
xor eax, eax
lea rbx, [rsp + 0x19]
mov ecx, 0xb
call fcn.0044bb20
add rsp, 0x30
pop rbp
ret
mov eax, esi
mov ecx, 0xb
call fcn.00461020
mov eax, edi
mov ecx, 0xb
call fcn.00461020
nop
call fcn.0045eda0
jmp fcn.0046eee0

Function at 0x470020
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4700d8
push rbp
mov rbp, rsp
sub rsp, 0x30
movabs rdx, 0xb76eb7baa372690e
mov qword [rsp + 0x1e], rdx
movabs rdx, 0x303050303070004
mov qword [rsp + 0x26], rdx
mov word [rsp + 0x2e], 7
xor eax, eax
jmp 0x470078
movzx r9d, byte [rsp + rsi + 0x1e]
sub r9d, edx
lea edx, [r9 + 0x5d]
mov byte [rsp + rdi + 0x1e], dl
lea edx, [r8 + 0x5d]
mov byte [rsp + rsi + 0x1e], dl
add rax, 2
cmp rax, 0xa
jge 0x4700a8
movzx edx, byte [rsp + rax + 0x26]
movzx esi, byte [rsp + rax + 0x27]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 8
jae 0x4700cb
movzx r8d, byte [rsp + rdi + 0x1e]
sub r8d, edx
nop dword [rax]
cmp rsi, 8
jb 0x47005b
jmp 0x4700bf
xor eax, eax
lea rbx, [rsp + 0x1e]
mov ecx, 8
call fcn.0044bb20
add rsp, 0x30
pop rbp
ret
mov eax, esi
mov ecx, 8
call fcn.00461020
mov eax, edi
mov ecx, 8
call fcn.00461020
nop
call fcn.0045eda0
nop dword [rax]
jmp fcn.00470020
Function at 0x4714e0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x471592
push rbp
mov rbp, rsp
sub rsp, 0x28
movabs rdx, 0xcf16722e656e26b7
mov qword [rsp + 0x20], rdx
movabs rdx, 0x6070001040700
mov qword [rsp + 0x18], rdx
xor eax, eax
jmp 0x471531
movzx r9d, byte [rsp + rsi + 0x20]
sub r9d, edx
lea edx, [r9 + 0x42]
mov byte [rsp + rdi + 0x20], dl
lea edx, [r8 + 0x42]
mov byte [rsp + rsi + 0x20], dl
add rax, 2
cmp rax, 8
jge 0x47155e
movzx edx, byte [rsp + rax + 0x18]
movzx esi, byte [rsp + rax + 0x19]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 8
jae 0x471585
movzx r8d, byte [rsp + rdi + 0x20]
sub r8d, edx
cmp rsi, 8
jb 0x471514
jmp 0x471575
xor eax, eax
lea rbx, [rsp + 0x20]
mov ecx, 8
call fcn.0044bb20
add rsp, 0x28
pop rbp
ret
mov eax, esi
mov ecx, 8
nop dword [rax]
call fcn.00461020
mov eax, edi
mov ecx, 8
call fcn.00461020
nop
call fcn.0045eda0
jmp fcn.004714e0

Function at 0x473f40
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x47402a
push rbp
mov rbp, rsp
sub rsp, 0x48
movabs rdx, 0x7472854eafa96c6d
mov qword [rsp + 0x1f], rdx
movabs rdx, 0x827472854eafa96c
mov qword [rsp + 0x20], rdx
movabs rdx, 0x6e61dba1a072efa4
mov qword [rsp + 0x28], rdx
movabs rdx, 0x20d090a0d0e0009
mov qword [rsp + 0x30], rdx
movabs rdx, 0x20c09030c090505
mov qword [rsp + 0x38], rdx
movabs rdx, 0xd0d0809000c020e
mov qword [rsp + 0x40], rdx
xor eax, eax
jmp 0x473fcd
movzx r9d, byte [rsp + rsi + 0x1f]
sub r9d, edx
lea edx, [r9 - 0xe]
mov byte [rsp + rdi + 0x1f], dl
lea edx, [r8 - 0xe]
mov byte [rsp + rsi + 0x1f], dl
add rax, 2
cmp rax, 0x18
jge 0x473ffa
movzx edx, byte [rsp + rax + 0x30]
movzx esi, byte [rsp + rax + 0x31]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x11
jae 0x47401d
movzx r8d, byte [rsp + rdi + 0x1f]
sub r8d, edx
cmp rsi, 0x11
jb 0x473fb0
jmp 0x474011
xor eax, eax
lea rbx, [rsp + 0x1f]
mov ecx, 0x11
call fcn.0044bb20
add rsp, 0x48
pop rbp
ret
mov eax, esi
mov ecx, 0x11
call fcn.00461020
mov eax, edi
mov ecx, 0x11
call fcn.00461020
nop
call fcn.0045eda0
jmp fcn.00473f40

Function at 0x474180
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x47424c
push rbp
mov rbp, rsp
sub rsp, 0x38
movabs rdx, 0x573a494b65646c52
mov qword [rsp + 0x1f], rdx
movabs rdx, 0x2b616a573a494b65
mov qword [rsp + 0x22], rdx
movabs rdx, 0xa03070506080604
mov qword [rsp + 0x2a], rdx
movabs rdx, 0x507000003000a03
mov qword [rsp + 0x30], rdx
xor eax, eax
jmp 0x4741ef
movzx r9d, byte [rsp + rsi + 0x1f]
sub r9d, edx
lea edx, [r9 + 0x18]
mov byte [rsp + rdi + 0x1f], dl
lea edx, [r8 + 0x18]
mov byte [rsp + rsi + 0x1f], dl
add rax, 2
cmp rax, 0xe
jge 0x47421c
movzx edx, byte [rsp + rax + 0x2a]
movzx esi, byte [rsp + rax + 0x2b]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0xb
jae 0x47423f
movzx r8d, byte [rsp + rdi + 0x1f]
sub r8d, edx
cmp rsi, 0xb
jb 0x4741d2
jmp 0x474233
xor eax, eax
lea rbx, [rsp + 0x1f]
mov ecx, 0xb
call fcn.0044bb20
add rsp, 0x38
pop rbp
ret
mov eax, esi
mov ecx, 0xb
call fcn.00461020
mov eax, edi
mov ecx, 0xb
call fcn.00461020
nop
call fcn.0045eda0
jmp fcn.00474180
Function at 0x474260
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x47432c
push rbp
mov rbp, rsp
sub rsp, 0x38
movabs rdx, 0x640d05f110023610
mov qword [rsp + 0x1f], rdx
movabs rdx, 0xa705bc640d05f110
mov qword [rsp + 0x22], rdx
movabs rdx, 0x6010a000902010a
mov qword [rsp + 0x2a], rdx
movabs rdx, 0x503000408030601
mov qword [rsp + 0x30], rdx
xor eax, eax
jmp 0x4742cf
movzx r9d, byte [rsp + rsi + 0x1f]
sub r9d, edx
lea edx, [r9 + 0x6c]
mov byte [rsp + rdi + 0x1f], dl
lea edx, [r8 + 0x6c]
mov byte [rsp + rsi + 0x1f], dl
add rax, 2
cmp rax, 0xe
jge 0x4742fc
movzx edx, byte [rsp + rax + 0x2a]
movzx esi, byte [rsp + rax + 0x2b]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0xb
jae 0x47431f
movzx r8d, byte [rsp + rdi + 0x1f]
sub r8d, edx
cmp rsi, 0xb
jb 0x4742b2
jmp 0x474313
xor eax, eax
lea rbx, [rsp + 0x1f]
mov ecx, 0xb
call fcn.0044bb20
add rsp, 0x38
pop rbp
ret
mov eax, esi
mov ecx, 0xb
call fcn.00461020
mov eax, edi
mov ecx, 0xb
call fcn.00461020
nop
call fcn.0045eda0
jmp fcn.00474260

Function at 0x474640
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x47470c
push rbp
mov rbp, rsp
sub rsp, 0x38
movabs rdx, 0x7c8da177938c8076
mov qword [rsp + 0x1c], rdx
mov dword [rsp + 0x24], 0x9e87837d
movabs rdx, 0xb01080305090602
mov qword [rsp + 0x28], rdx
movabs rdx, 0xa09060003070801
mov qword [rsp + 0x30], rdx
xor eax, eax
jmp 0x4746a5
movzx r9d, byte [rsp + rsi + 0x1c]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x29]
mov byte [rsp + rdi + 0x1c], dl
mov byte [rsp + rsi + 0x1c], r8b
add rax, 2
cmp rax, 0x10
jge 0x4746dc
movzx edx, byte [rsp + rax + 0x28]
movzx esi, byte [rsp + rax + 0x29]
mov edi, edx
xor edx, esi
add edx, eax
nop dword [rax + rax]
cmp rdi, 0xc
jae 0x4746ff
movzx r8d, byte [rsp + rdi + 0x1c]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x29]
cmp rsi, 0xc
jb 0x47468b
jmp 0x4746f3
xor eax, eax
lea rbx, [rsp + 0x1c]
mov ecx, 0xc
call fcn.0044bb20
add rsp, 0x38
pop rbp
ret
mov eax, esi
mov ecx, 0xc
call fcn.00461020
mov eax, edi
mov ecx, 0xc
call fcn.00461020
nop
call fcn.0045eda0
jmp fcn.00474640

Function at 0x475640
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x475707
push rbp
mov rbp, rsp
sub rsp, 0x38
movabs rdx, 0x6d6f17bca4121722
mov qword [rsp + 0x1e], rdx
mov dword [rsp + 0x26], 0x676e0505
movabs rdx, 0x501010204040403
mov qword [rsp + 0x2a], rdx
movabs rdx, 0x8030905090501
mov qword [rsp + 0x30], rdx
xor eax, eax
jmp 0x4756a8
movzx r9d, byte [rsp + rsi + 0x1e]
sub r9d, edx
lea edx, [r9 + 0x62]
mov byte [rsp + rdi + 0x1e], dl
lea edx, [r8 + 0x62]
mov byte [rsp + rsi + 0x1e], dl
add rax, 2
cmp rax, 0xe
jge 0x4756d7
movzx edx, byte [rsp + rax + 0x2a]
movzx esi, byte [rsp + rax + 0x2b]
mov edi, edx
xor edx, esi
add edx, eax
nop
cmp rdi, 0xc
jae 0x4756fa
movzx r8d, byte [rsp + rdi + 0x1e]
sub r8d, edx
cmp rsi, 0xc
jb 0x47568b
jmp 0x4756ee
xor eax, eax
lea rbx, [rsp + 0x1e]
mov ecx, 0xc
call fcn.0044bb20
add rsp, 0x38
pop rbp
ret
mov eax, esi
mov ecx, 0xc
call fcn.00461020
mov eax, edi
mov ecx, 0xc
call fcn.00461020
nop
call fcn.0045eda0
jmp fcn.00475640
Function at 0x475720
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4757e6
push rbp
mov rbp, rsp
sub rsp, 0x30
movabs rdx, 0x7365466164050b24
mov qword [rsp + 0x1d], rdx
mov byte [rsp + 0x25], 0xf
movabs rdx, 0x808010502080108
mov qword [rsp + 0x26], rdx
mov word [rsp + 0x2e], 0
xor eax, eax
nop
jmp 0x475780
movzx r9d, byte [rsp + rsi + 0x1d]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x27]
mov byte [rsp + rdi + 0x1d], dl
mov byte [rsp + rsi + 0x1d], r8b
add rax, 2
nop dword [rax]
cmp rax, 0xa
jge 0x4757b2
movzx edx, byte [rsp + rax + 0x26]
movzx esi, byte [rsp + rax + 0x27]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 9
jae 0x4757d7
movzx r8d, byte [rsp + rdi + 0x1d]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x27]
cmp rsi, 9
jb 0x475762
jmp 0x4757cb
xor eax, eax
lea rbx, [rsp + 0x1d]
mov ecx, 9
nop
call fcn.0044bb20
add rsp, 0x30
pop rbp
ret
mov eax, esi
mov ecx, 9
call fcn.00461020
mov eax, edi
mov ecx, 9
nop
call fcn.00461020
nop
call fcn.0045eda0
jmp fcn.00475720

Function at 0x475800
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4758c7
push rbp
mov rbp, rsp
sub rsp, 0x38
movabs rdx, 0x665f5c6c6f727972
mov qword [rsp + 0x1e], rdx
mov dword [rsp + 0x26], 0x696e6761
movabs rdx, 0x500000704000a02
mov qword [rsp + 0x2a], rdx
movabs rdx, 0x700020207050500
mov qword [rsp + 0x30], rdx
xor eax, eax
jmp 0x475868
movzx r9d, byte [rsp + rsi + 0x1e]
sub r9d, edx
lea edx, [r9 + 8]
mov byte [rsp + rdi + 0x1e], dl
lea edx, [r8 + 8]
mov byte [rsp + rsi + 0x1e], dl
add rax, 2
cmp rax, 0xe
jge 0x475897
movzx edx, byte [rsp + rax + 0x2a]
movzx esi, byte [rsp + rax + 0x2b]
mov edi, edx
xor edx, esi
add edx, eax
nop
cmp rdi, 0xc
jae 0x4758ba
movzx r8d, byte [rsp + rdi + 0x1e]
sub r8d, edx
cmp rsi, 0xc
jb 0x47584b
jmp 0x4758ae
xor eax, eax
lea rbx, [rsp + 0x1e]
mov ecx, 0xc
call fcn.0044bb20
add rsp, 0x38
pop rbp
ret
mov eax, esi
mov ecx, 0xc
call fcn.00461020
mov eax, edi
mov ecx, 0xc
call fcn.00461020
nop
call fcn.0045eda0
jmp fcn.00475800

Function at 0x475c80
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x475d38
push rbp
mov rbp, rsp
sub rsp, 0x30
movabs rdx, 0x7486698d689d8854
mov qword [rsp + 0x1e], rdx
movabs rdx, 0x203060701070304
mov qword [rsp + 0x26], rdx
mov word [rsp + 0x2e], 0x307
xor eax, eax
jmp 0x475cd8
movzx r9d, byte [rsp + rsi + 0x1e]
sub r9d, edx
lea edx, [r9 - 0xb]
mov byte [rsp + rdi + 0x1e], dl
lea edx, [r8 - 0xb]
mov byte [rsp + rsi + 0x1e], dl
add rax, 2
cmp rax, 0xa
jge 0x475d08
movzx edx, byte [rsp + rax + 0x26]
movzx esi, byte [rsp + rax + 0x27]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 8
jae 0x475d2b
movzx r8d, byte [rsp + rdi + 0x1e]
sub r8d, edx
nop dword [rax]
cmp rsi, 8
jb 0x475cbb
jmp 0x475d1f
xor eax, eax
lea rbx, [rsp + 0x1e]
mov ecx, 8
call fcn.0044bb20
add rsp, 0x30
pop rbp
ret
mov eax, esi
mov ecx, 8
call fcn.00461020
mov eax, edi
mov ecx, 8
call fcn.00461020
nop
call fcn.0045eda0
nop dword [rax]
jmp fcn.00475c80
Function at 0x476600
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4766c7
push rbp
mov rbp, rsp
sub rsp, 0x38
movabs rdx, 0x66f174f9e364f442
mov qword [rsp + 0x1e], rdx
mov dword [rsp + 0x26], 0x55027274
movabs rdx, 0x507010b040a0303
mov qword [rsp + 0x2a], rdx
movabs rdx, 0x105040507060507
mov qword [rsp + 0x30], rdx
xor eax, eax
jmp 0x476668
movzx r9d, byte [rsp + rsi + 0x1e]
sub r9d, edx
lea edx, [r9 - 0x7a]
mov byte [rsp + rdi + 0x1e], dl
lea edx, [r8 - 0x7a]
mov byte [rsp + rsi + 0x1e], dl
add rax, 2
cmp rax, 0xe
jge 0x476697
movzx edx, byte [rsp + rax + 0x2a]
movzx esi, byte [rsp + rax + 0x2b]
mov edi, edx
xor edx, esi
add edx, eax
nop
cmp rdi, 0xc
jae 0x4766ba
movzx r8d, byte [rsp + rdi + 0x1e]
sub r8d, edx
cmp rsi, 0xc
jb 0x47664b
jmp 0x4766ae
xor eax, eax
lea rbx, [rsp + 0x1e]
mov ecx, 0xc
call fcn.0044bb20
add rsp, 0x38
pop rbp
ret
mov eax, esi
mov ecx, 0xc
call fcn.00461020
mov eax, edi
mov ecx, 0xc
call fcn.00461020
nop
call fcn.0045eda0
jmp fcn.00476600

Function at 0x477360
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x477427
push rbp
mov rbp, rsp
sub rsp, 0x30
movabs rdx, 0xc7619967d66564d2
mov qword [rsp + 0x19], rdx
movabs rdx, 0xc969e2c7619967d6
mov qword [rsp + 0x1c], rdx
movabs rdx, 0x8050705000a0803
mov qword [rsp + 0x24], rdx
mov dword [rsp + 0x2c], 0xa0a03
xor eax, eax
jmp 0x4773c8
movzx r9d, byte [rsp + rsi + 0x19]
sub r9d, edx
lea edx, [r9 - 0x23]
mov byte [rsp + rdi + 0x19], dl
lea edx, [r8 - 0x23]
mov byte [rsp + rsi + 0x19], dl
add rax, 2
cmp rax, 0xc
jge 0x4773f7
movzx edx, byte [rsp + rax + 0x24]
movzx esi, byte [rsp + rax + 0x25]
mov edi, edx
xor edx, esi
add edx, eax
nop
cmp rdi, 0xb
jae 0x47741a
movzx r8d, byte [rsp + rdi + 0x19]
sub r8d, edx
cmp rsi, 0xb
jb 0x4773ab
jmp 0x47740e
xor eax, eax
lea rbx, [rsp + 0x19]
mov ecx, 0xb
call fcn.0044bb20
add rsp, 0x30
pop rbp
ret
mov eax, esi
mov ecx, 0xb
call fcn.00461020
mov eax, edi
mov ecx, 0xb
call fcn.00461020
nop
call fcn.0045eda0
jmp fcn.00477360

Function at 0x478b40
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x478c1d
push rbp
mov rbp, rsp
sub rsp, 0x40
movabs rdx, 0x6f085f7265c1ff01
mov qword [rsp + 0x1d], rdx
movabs rdx, 0xecf761a56f91776f
mov qword [rsp + 0x24], rdx
movabs rdx, 0x60e0e0b010a0d02
mov qword [rsp + 0x2c], rdx
movabs rdx, 0x606090e060e0e0b
mov qword [rsp + 0x30], rdx
movabs rdx, 0x109060e000e0d
mov qword [rsp + 0x38], rdx
xor eax, eax
nop
jmp 0x478bc0
movzx r9d, byte [rsp + rsi + 0x1d]
sub r9d, edx
lea edx, [r9 - 0x80]
mov byte [rsp + rdi + 0x1d], dl
lea edx, [r8 - 0x80]
mov byte [rsp + rsi + 0x1d], dl
add rax, 2
nop
cmp rax, 0x14
jge 0x478bed
movzx edx, byte [rsp + rax + 0x2c]
movzx esi, byte [rsp + rax + 0x2d]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0xf
jae 0x478c10
movzx r8d, byte [rsp + rdi + 0x1d]
sub r8d, edx
cmp rsi, 0xf
jb 0x478ba2
jmp 0x478c04
xor eax, eax
lea rbx, [rsp + 0x1d]
mov ecx, 0xf
call fcn.0044bb20
add rsp, 0x40
pop rbp
ret
mov eax, esi
mov ecx, 0xf
call fcn.00461020
mov eax, edi
mov ecx, 0xf
call fcn.00461020
nop
nop dword [rax]
call fcn.0045eda0
jmp fcn.00478b40
Function at 0x479400
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x47951d
push rbp
mov rbp, rsp
sub rsp, 0x60
movabs rdx, 0x97059397a6b3b350
mov qword [rsp + 0x1e], rdx
movabs rdx, 0xc2424de06fa95fc6
mov qword [rsp + 0x26], rdx
movabs rdx, 0xa9fc5f20c2424de0
mov qword [rsp + 0x2a], rdx
movabs rdx, 0xf072a64d09dbf7b4
mov qword [rsp + 0x32], rdx
movabs rdx, 0x1b0a19150c03050e
mov qword [rsp + 0x3a], rdx
movabs rdx, 0x1116010f07041b0a
mov qword [rsp + 0x40], rdx
movabs rdx, 0x31714130d03010a
mov qword [rsp + 0x48], rdx
movabs rdx, 0x1916061117021112
mov qword [rsp + 0x50], rdx
movabs rdx, 0x308190511101005
mov qword [rsp + 0x58], rdx
xor eax, eax
jmp 0x4794c0
movzx r9d, byte [rsp + rsi + 0x1e]
sub r9d, edx
lea edx, [r9 - 0x27]
mov byte [rsp + rdi + 0x1e], dl
lea edx, [r8 - 0x27]
mov byte [rsp + rsi + 0x1e], dl
add rax, 2
nop word [rax + rax]
cmp rax, 0x26
jge 0x4794ed
movzx edx, byte [rsp + rax + 0x3a]
movzx esi, byte [rsp + rax + 0x3b]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x1c
jae 0x479510
movzx r8d, byte [rsp + rdi + 0x1e]
sub r8d, edx
cmp rsi, 0x1c
jb 0x47949d
jmp 0x479504
xor eax, eax
lea rbx, [rsp + 0x1e]
mov ecx, 0x1c
call fcn.0044bb20
add rsp, 0x60
pop rbp
ret
mov eax, esi
mov ecx, 0x1c
call fcn.00461020
mov eax, edi
mov ecx, 0x1c
call fcn.00461020
nop
nop dword [rax]
call fcn.0045eda0
jmp fcn.00479400

Function at 0x47a020
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x47a10c
push rbp
mov rbp, rsp
sub rsp, 0x40
movabs rdx, 0xb9fe00060b07034a
mov qword [rsp + 0x19], rdx
movabs rdx, 0xedb9fe00060b0703
mov qword [rsp + 0x1a], rdx
movabs rdx, 0xceff9e72faaa0cfb
mov qword [rsp + 0x22], rdx
movabs rdx, 0xa01020b02070009
mov qword [rsp + 0x2a], rdx
movabs rdx, 0x2030e0609090a01
mov qword [rsp + 0x30], rdx
movabs rdx, 0x90c10080605040f
mov qword [rsp + 0x38], rdx
xor eax, eax
jmp 0x47a0aa
movzx r9d, byte [rsp + rsi + 0x19]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x51]
mov byte [rsp + rdi + 0x19], dl
mov byte [rsp + rsi + 0x19], r8b
add rax, 2
cmp rax, 0x16
jge 0x47a0dc
movzx edx, byte [rsp + rax + 0x2a]
movzx esi, byte [rsp + rax + 0x2b]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x11
jae 0x47a0ff
movzx r8d, byte [rsp + rdi + 0x19]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x51]
cmp rsi, 0x11
jb 0x47a090
jmp 0x47a0f3
xor eax, eax
lea rbx, [rsp + 0x19]
mov ecx, 0x11
call fcn.0044bb20
add rsp, 0x40
pop rbp
ret
mov eax, esi
mov ecx, 0x11
call fcn.00461020
mov eax, edi
mov ecx, 0x11
call fcn.00461020
nop
call fcn.0045eda0
jmp fcn.0047a020