joyce8/EMBER2024-capa huggingface dataset:
Function at 0x443240
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x10
mov qword [rsp + 0x20], rax
test rbx, rbx
jbe 0x4433b7
movzx edx, byte [rax]
test edx, edx
jne 0x443274
nop dword [rax]
test r8b, r8b
jne 0x443274
xor eax, eax
xor ebx, ebx
mov rcx, rbx
xor edi, edi
add rsp, 0x10
pop rbp
ret
bt edx, 7
jae 0x443287
xor edx, edx
xor r8d, r8d
xor r9d, r9d
jmp 0x443377
mov r8d, 1
mov r9d, edx
and edx, 1
neg edx
shr r9d, 1
xor edx, r9d
add dword [rsi], edx
nop dword [rax]
cmp rbx, r8
jb 0x443365
sub rbx, r8
sub rcx, r8
mov rdx, rcx
neg rdx
sar rdx, 0x3f
and r8, rdx
lea rdx, [rax + r8]
test rbx, rbx
jbe 0x443357
movzx esi, byte [rax + r8]
bt esi, 7
jae 0x4432dd
xor eax, eax
xor esi, esi
xor r8d, r8d
jmp 0x443320
mov eax, 1
cmp rax, rbx
ja 0x44330b
add qword [rdi], rsi
sub rcx, rax
sub rbx, rax
mov rsi, rcx
neg rsi
sar rsi, 0x3f
and rax, rsi
add rax, rdx
mov edi, 1
add rsp, 0x10
pop rbp
ret
mov rcx, rbx
call fcn.00450fc0
lea r8d, [rcx + 7]
mov rcx, r11
mov eax, r12d
nop dword [rax]
cmp rax, rbx
jae 0x44334f
movzx r9d, byte [rax + rdx]
mov r10d, r9d
and r9d, 0x7f
mov r11, rcx
mov ecx, r8d
shl r9d, cl
lea r12d, [rax + 1]
or esi, r9d
test r10b, 0x80
jne 0x443313
mov rcx, r11
mov eax, r12d
jmp 0x4432e2
mov rcx, rbx
call fcn.00450f00
xor eax, eax
mov rcx, rax
nop dword [rax]
call fcn.00450f00
mov eax, r8d
mov rcx, rbx
call fcn.00450fc0
lea r9d, [rcx + 7]
mov rcx, r12
cmp rbx, rdx
jbe 0x4433ad
movzx r10d, byte [rdx + rax]
mov r11d, r10d
and r10d, 0x7f
mov r12, rcx
mov ecx, r9d
shl r10d, cl
inc edx
or r8d, r10d
test r11b, 0x80
jne 0x443370
mov rcx, r12
mov r9d, edx
mov edx, r8d
mov r8d, r9d
jmp 0x44328d
mov eax, edx
mov rcx, rbx
call fcn.00450f00
xor eax, eax
mov rcx, rax
nop dword [rax]
call fcn.00450f00
nop
int3

Function at 0x448980
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x448a2f
push rbp
mov rbp, rsp
sub rsp, 0x58
mov qword [rsp + 0x70], rbx
lea rdx, [rsp + 0x68]
mov qword [rsp + 8], 0
movups xmmword [rsp + 0x10], xmm15
movups xmmword [rsp + 0x18], xmm15
movups xmmword [rsp + 0x28], xmm15
movups xmmword [rsp + 0x38], xmm15
movups xmmword [rsp + 0x48], xmm15
lea rsi, [0x00448a80]
mov qword [rsp + 0x10], rsi
mov rsi, qword [rsp + 0x60]
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdx
mov rdx, r14
mov qword [rsp + 0x28], rdx
lea rdx, [rsp + 8]
mov qword [rsp + 0x30], rdx
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x48], rcx
mov qword [rsp + 0x50], rdi
lea rax, [rsp + 0x10]
mov qword [rsp], rax
call fcn.0044eb40
xorps xmm15, xmm15
mov r14, qword [0x006205b0]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 8]
add rsp, 0x58
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
call fcn.0044ec80
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
nop dword [rax]
jmp fcn.00448980
Function at 0x450a60
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x403103
push rbp
mov rbp, rsp
sub rsp, 0x18
mov rdx, qword [rax]
mov rcx, qword [rax + 8]
mov rax, rdx
call fcn.004079c0
add rsp, 0x18
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.0044ec80
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp 0x4030e0
cmp byte [0x006203ab], 0
je 0x450a75
mov rcx, qword [rax + 8]
mov rax, qword [rax]
jmp 0x44dcc0
jmp 0x4030e0

Function at 0x450a80
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
nop
mov eax, dword [rax]
movabs rcx, 0xe7037ed1a0b428db
xor rcx, rax
xor rax, rbx
xor rax, qword [0x00620660]
movabs rdx, 0xa0761d6478bd642f
xor rdx, rax
mov rax, rcx
mul rdx
xor rax, rdx
mov rcx, rax
movabs rax, 0x1d8e4e27c47d124b
mul rcx
xor rax, rdx
nop
nop
ret
cmp byte [0x006203ab], 0
je 0x450ab5
movq xmm0, rbx
pinsrd xmm0, dword [rax], 2
aesenc xmm0, xmmword [0x00620960]
aesenc xmm0, xmmword [0x00620970]
aesenc xmm0, xmmword [0x00620980]
movq rax, xmm0
ret
jmp 0x407be0

Function at 0x450ac0
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
nop
mov rax, qword [rax]
movabs rcx, 0xe7037ed1a0b428db
xor rcx, rax
xor rax, rbx
xor rax, qword [0x00620660]
movabs rdx, 0xa0761d6478bd642f
xor rdx, rax
mov rax, rcx
mul rdx
xor rax, rdx
mov rcx, rax
movabs rax, 0x1d8e4e27c47d1247
mul rcx
xor rax, rdx
nop
nop
ret
cmp byte [0x006203ab], 0
je 0x450af6
movq xmm0, rbx
pinsrq xmm0, qword [rax], 1
aesenc xmm0, xmmword [0x00620960]
aesenc xmm0, xmmword [0x00620970]
aesenc xmm0, xmmword [0x00620980]
movq rax, xmm0
ret
jmp 0x407c40

Function at 0x4527c0
Capabilities:
Allocate thread local storage

Disassembly:
push rbp
mov rbp, rsp
mov rax, rsp
and rsp, 0xfffffffffffffff0
sub rsp, 0x30
mov qword [rsp + 0x20], rax
mov rax, qword [sym.imp.kernel32.dll_TlsAlloc]
call rax
mov rsp, qword [rsp + 0x20]
mov rcx, rax
cmp rcx, 0x40
jb 0x4527f4
mov rcx, 0x28
jmp 0x4527ff
shl rcx, 3
add rcx, 0x1480
mov qword [0x006205b0], rcx
pop rbp
ret
Function at 0x45a040
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x45a112
push rbp
mov rbp, rsp
sub rsp, 0x38
movabs rdx, 0x7bc98b7734bf77c5
mov qword [rsp + 0x1d], rdx
movabs rdx, 0x35327735867bc98b
mov qword [rsp + 0x22], rdx
movabs rdx, 0x20a080805050600
mov qword [rsp + 0x2a], rdx
movabs rdx, 0x7040006010a020a
mov qword [rsp + 0x30], rdx
xor eax, eax
jmp 0x45a0ac
movzx r9d, byte [rsp + rsi + 0x1d]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x54]
mov byte [rsp + rdi + 0x1d], dl
mov byte [rsp + rsi + 0x1d], r8b
add rax, 2
cmp rax, 0xe
jge 0x45a0de
movzx edx, byte [rsp + rax + 0x2a]
movzx esi, byte [rsp + rax + 0x2b]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0xd
jae 0x45a105
movzx r8d, byte [rsp + rdi + 0x1d]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x54]
cmp rsi, 0xd
jb 0x45a092
jmp 0x45a0f5
xor eax, eax
lea rbx, [rsp + 0x1d]
mov ecx, 0xd
call fcn.00440c20
add rsp, 0x38
pop rbp
ret
mov eax, esi
mov ecx, 0xd
nop dword [rax]
call fcn.00450f00
mov eax, edi
mov ecx, 0xd
call fcn.00450f00
nop
call fcn.0044ec80
jmp fcn.0045a040

Function at 0x45d8e0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x45da18
push rbp
mov rbp, rsp
sub rsp, 0x68
movabs rdx, 0x1a3be63a31320f10
mov qword [rsp + 0x1d], rdx
movabs rdx, 0x371a3be63a31320f
mov qword [rsp + 0x1e], rdx
movabs rdx, 0x1f3030311d013417
mov qword [rsp + 0x26], rdx
movabs rdx, 0x3832322a19202137
mov qword [rsp + 0x2e], rdx
movabs rdx, 0xc5321b14350e0019
mov qword [rsp + 0x36], rdx
movabs rdx, 0xb000a190d060414
mov qword [rsp + 0x3e], rdx
movabs rdx, 0x715051a1c170613
mov qword [rsp + 0x46], rdx
movabs rdx, 0x1d0715051a1c17
mov qword [rsp + 0x48], rdx
movabs rdx, 0x1a041a201b131501
mov qword [rsp + 0x50], rdx
movabs rdx, 0x91d0a040b130600
mov qword [rsp + 0x58], rdx
movabs rdx, 0x50c10121313151e
mov qword [rsp + 0x60], rdx
xor eax, eax
jmp 0x45d9b5
movzx r9d, byte [rsp + rsi + 0x1d]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x16]
mov byte [rsp + rdi + 0x1d], dl
mov byte [rsp + rsi + 0x1d], r8b
add rax, 2
cmp rax, 0x2a
jge 0x45d9e8
movzx edx, byte [rsp + rax + 0x3e]
movzx esi, byte [rsp + rax + 0x3f]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x21
jae 0x45da0b
movzx r8d, byte [rsp + rdi + 0x1d]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x16]
nop
cmp rsi, 0x21
jb 0x45d99b
jmp 0x45d9ff
xor eax, eax
lea rbx, [rsp + 0x1d]
mov ecx, 0x21
call fcn.00440c20
add rsp, 0x68
pop rbp
ret
mov eax, esi
mov ecx, 0x21
call fcn.00450f00
mov eax, edi
mov ecx, 0x21
call fcn.00450f00
nop
call fcn.0044ec80
nop dword [rax]
jmp fcn.0045d8e0
Function at 0x45dfe0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x45e118
push rbp
mov rbp, rsp
sub rsp, 0x68
movabs rdx, 0xdbdb0df5ab359a04
mov qword [rsp + 0x1c], rdx
movabs rdx, 0x38a1dbdb0df5ab35
mov qword [rsp + 0x1e], rdx
movabs rdx, 0x3239ccd935db6e38
mov qword [rsp + 0x26], rdx
movabs rdx, 0x8c31071a76db3339
mov qword [rsp + 0x2e], rdx
movabs rdx, 0xd632ca30e3986787
mov qword [rsp + 0x36], rdx
movabs rdx, 0x4011c1905211903
mov qword [rsp + 0x3e], rdx
movabs rdx, 0xe190c161b060821
mov qword [rsp + 0x46], rdx
movabs rdx, 0x8170e190c161b06
mov qword [rsp + 0x48], rdx
movabs rdx, 0xc0606211d1a0015
mov qword [rsp + 0x50], rdx
movabs rdx, 0x1d140c1f03080f15
mov qword [rsp + 0x58], rdx
movabs rdx, 0x30f060004070b06
mov qword [rsp + 0x60], rdx
xor eax, eax
jmp 0x45e0b5
movzx r9d, byte [rsp + rsi + 0x1c]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x35]
mov byte [rsp + rdi + 0x1c], dl
mov byte [rsp + rsi + 0x1c], r8b
add rax, 2
cmp rax, 0x2a
jge 0x45e0e8
movzx edx, byte [rsp + rax + 0x3e]
movzx esi, byte [rsp + rax + 0x3f]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x22
jae 0x45e10b
movzx r8d, byte [rsp + rdi + 0x1c]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x35]
nop
cmp rsi, 0x22
jb 0x45e09b
jmp 0x45e0ff
xor eax, eax
lea rbx, [rsp + 0x1c]
mov ecx, 0x22
call fcn.00440c20
add rsp, 0x68
pop rbp
ret
mov eax, esi
mov ecx, 0x22
call fcn.00450f00
mov eax, edi
mov ecx, 0x22
call fcn.00450f00
nop
call fcn.0044ec80
nop dword [rax]
jmp fcn.0045dfe0

Function at 0x45e6a0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x45e7d8
push rbp
mov rbp, rsp
sub rsp, 0x68
movabs rdx, 0x30c494ce303232d1
mov qword [rsp + 0x19], rdx
movabs rdx, 0x36e9cb393430c494
mov qword [rsp + 0x1e], rdx
movabs rdx, 0x12ccdbf06c8931e2
mov qword [rsp + 0x26], rdx
movabs rdx, 0xcb36d2da80d54201
mov qword [rsp + 0x2e], rdx
movabs rdx, 0x35c23630b4f28ced
mov qword [rsp + 0x36], rdx
movabs rdx, 0x1e1300060410050a
mov qword [rsp + 0x3e], rdx
movabs rdx, 0xc0416061a1c141a
mov qword [rsp + 0x46], rdx
movabs rdx, 0x15200c0416061a1c
mov qword [rsp + 0x48], rdx
movabs rdx, 0x171206150f0d180d
mov qword [rsp + 0x50], rdx
movabs rdx, 0x1504130a1c190a23
mov qword [rsp + 0x58], rdx
movabs rdx, 0xd0b151d1f111516
mov qword [rsp + 0x60], rdx
xor eax, eax
jmp 0x45e778
movzx r9d, byte [rsp + rsi + 0x19]
sub r9d, edx
lea edx, [r9 + 0x78]
mov byte [rsp + rdi + 0x19], dl
lea edx, [r8 + 0x78]
mov byte [rsp + rsi + 0x19], dl
add rax, 2
cmp rax, 0x2a
jge 0x45e7a8
movzx edx, byte [rsp + rax + 0x3e]
movzx esi, byte [rsp + rax + 0x3f]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x25
jae 0x45e7cb
movzx r8d, byte [rsp + rdi + 0x19]
sub r8d, edx
nop dword [rax]
cmp rsi, 0x25
jb 0x45e75b
jmp 0x45e7bf
xor eax, eax
lea rbx, [rsp + 0x19]
mov ecx, 0x25
call fcn.00440c20
add rsp, 0x68
pop rbp
ret
mov eax, esi
mov ecx, 0x25
call fcn.00450f00
mov eax, edi
mov ecx, 0x25
call fcn.00450f00
nop
call fcn.0044ec80
nop dword [rax]
jmp fcn.0045e6a0
Function at 0x45f720
Capabilities:
Encrypt data using rc4 prga

Disassembly:
lea r12, [rsp - 8]
cmp r12, qword [r14 + 0x10]
jbe 0x45f87d
push rbp
mov rbp, rsp
add rsp, 0xffffffffffffff80
movabs rdx, 0x12338c61787ab436
mov qword [rsp + 0x1e], rdx
movabs rdx, 0x9f85d06be7faaebe
mov qword [rsp + 0x26], rdx
movabs rdx, 0x8736a16a3689f4f2
mov qword [rsp + 0x2e], rdx
movabs rdx, 0x8abe36c90ebd1ed1
mov qword [rsp + 0x36], rdx
movabs rdx, 0xf23231334a39e956
mov qword [rsp + 0x3e], rdx
movabs rdx, 0x1b2720120401070a
mov qword [rsp + 0x46], rdx
movabs rdx, 0x140d1412181e1a07
mov qword [rsp + 0x4e], rdx
movabs rdx, 0xd11140d1412181e
mov qword [rsp + 0x50], rdx
movabs rdx, 0xa190a080c020c09
mov qword [rsp + 0x58], rdx
movabs rdx, 0x23210e1a1a0a0703
mov qword [rsp + 0x60], rdx
movabs rdx, 0x1f170d15210d100b
mov qword [rsp + 0x68], rdx
movabs rdx, 0x14100d27040b2308
mov qword [rsp + 0x70], rdx
movabs rdx, 0x271c1e0f181b0505
mov qword [rsp + 0x78], rdx
xor eax, eax
jmp 0x45f820
movzx r9d, byte [rsp + rsi + 0x1e]
sub r9d, edx
lea edx, [r9 - 0x21]
mov byte [rsp + rdi + 0x1e], dl
lea edx, [r8 - 0x21]
mov byte [rsp + rsi + 0x1e], dl
add rax, 2
nop dword [rax + rax]
cmp rax, 0x3a
jge 0x45f84d
movzx edx, byte [rsp + rax + 0x46]
movzx esi, byte [rsp + rax + 0x47]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x28
jae 0x45f870
movzx r8d, byte [rsp + rdi + 0x1e]
sub r8d, edx
cmp rsi, 0x28
jb 0x45f7fe
jmp 0x45f864
xor eax, eax
lea rbx, [rsp + 0x1e]
mov ecx, 0x28
call fcn.00440c20
sub rsp, 0xffffffffffffff80
pop rbp
ret
mov eax, esi
mov ecx, 0x28
call fcn.00450f00
mov eax, edi
mov ecx, 0x28
call fcn.00450f00
nop
nop dword [rax]
call fcn.0044ec80
jmp fcn.0045f720
Function at 0x467460
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x467587
push rbp
mov rbp, rsp
sub rsp, 0x68
movabs rdx, 0x23616f7499759501
mov qword [rsp + 0x1d], rdx
movabs rdx, 0xbc786a23616f7499
mov qword [rsp + 0x20], rdx
movabs rdx, 0x978a1b00160033ff
mov qword [rsp + 0x28], rdx
movabs rdx, 0xd468be69950da765
mov qword [rsp + 0x30], rdx
movabs rdx, 0xe56d251693b3f613
mov qword [rsp + 0x38], rdx
movabs rdx, 0x121e0b1c211a0d18
mov qword [rsp + 0x40], rdx
movabs rdx, 0x1f031c1f1111011f
mov qword [rsp + 0x48], rdx
movabs rdx, 0x1a220e1114001108
mov qword [rsp + 0x50], rdx
movabs rdx, 0x1e0a0f201d1f161b
mov qword [rsp + 0x58], rdx
movabs rdx, 0x15221e1210001b07
mov qword [rsp + 0x60], rdx
xor eax, eax
jmp 0x467529
movzx r9d, byte [rsp + rsi + 0x1d]
sub r9d, edx
lea edx, [r9 - 0x77]
mov byte [rsp + rdi + 0x1d], dl
lea edx, [r8 - 0x77]
mov byte [rsp + rsi + 0x1d], dl
add rax, 2
cmp rax, 0x28
jge 0x467557
movzx edx, byte [rsp + rax + 0x40]
movzx esi, byte [rsp + rax + 0x41]
mov edi, edx
xor edx, esi
add edx, eax
nop
cmp rdi, 0x23
jae 0x46757a
movzx r8d, byte [rsp + rdi + 0x1d]
sub r8d, edx
cmp rsi, 0x23
jb 0x46750c
jmp 0x46756e
xor eax, eax
lea rbx, [rsp + 0x1d]
mov ecx, 0x23
call fcn.00440c20
add rsp, 0x68
pop rbp
ret
mov eax, esi
mov ecx, 0x23
call fcn.00450f00
mov eax, edi
mov ecx, 0x23
call fcn.00450f00
nop
call fcn.0044ec80
jmp fcn.00467460

Function at 0x46cf40
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x46cff8
push rbp
mov rbp, rsp
sub rsp, 0x30
movabs rdx, 0xbee97077636c68f5
mov qword [rsp + 0x1c], rdx
movabs rdx, 0x606030002040405
mov qword [rsp + 0x24], rdx
mov dword [rsp + 0x2c], 0x4050700
xor eax, eax
jmp 0x46cf96
movzx r9d, byte [rsp + rsi + 0x1c]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x76]
mov byte [rsp + rdi + 0x1c], dl
mov byte [rsp + rsi + 0x1c], r8b
add rax, 2
cmp rax, 0xc
jge 0x46cfc8
movzx edx, byte [rsp + rax + 0x24]
movzx esi, byte [rsp + rax + 0x25]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 8
jae 0x46cfeb
movzx r8d, byte [rsp + rdi + 0x1c]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x76]
cmp rsi, 8
jb 0x46cf7c
jmp 0x46cfdf
xor eax, eax
lea rbx, [rsp + 0x1c]
mov ecx, 8
call fcn.00440c20
add rsp, 0x30
pop rbp
ret
mov eax, esi
mov ecx, 8
call fcn.00450f00
mov eax, edi
mov ecx, 8
call fcn.00450f00
nop
call fcn.0044ec80
nop dword [rax]
jmp fcn.0046cf40
Function at 0x46db60
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x46dc18
push rbp
mov rbp, rsp
sub rsp, 0x30
movabs rdx, 0xe7f1ebe36c67bff2
mov qword [rsp + 0x1e], rdx
movabs rdx, 0x500050702050406
mov qword [rsp + 0x26], rdx
mov word [rsp + 0x2e], 0x100
xor eax, eax
jmp 0x46dbb5
movzx r9d, byte [rsp + rsi + 0x1e]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x7c]
mov byte [rsp + rdi + 0x1e], dl
mov byte [rsp + rsi + 0x1e], r8b
add rax, 2
cmp rax, 0xa
jge 0x46dbe8
movzx edx, byte [rsp + rax + 0x26]
movzx esi, byte [rsp + rax + 0x27]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 8
jae 0x46dc0b
movzx r8d, byte [rsp + rdi + 0x1e]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x7c]
nop
cmp rsi, 8
jb 0x46db9b
jmp 0x46dbff
xor eax, eax
lea rbx, [rsp + 0x1e]
mov ecx, 8
call fcn.00440c20
add rsp, 0x30
pop rbp
ret
mov eax, esi
mov ecx, 8
call fcn.00450f00
mov eax, edi
mov ecx, 8
call fcn.00450f00
nop
call fcn.0044ec80
nop dword [rax]
jmp fcn.0046db60

Function at 0x471400
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4714c6
push rbp
mov rbp, rsp
sub rsp, 0x30
movabs rdx, 0x61eee37461d8e3fd
mov qword [rsp + 0x1d], rdx
mov byte [rsp + 0x25], 0x66
movabs rdx, 0x602020202000608
mov qword [rsp + 0x26], rdx
mov word [rsp + 0x2e], 0x105
xor eax, eax
nop
jmp 0x471460
movzx r9d, byte [rsp + rsi + 0x1d]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x72]
mov byte [rsp + rdi + 0x1d], dl
mov byte [rsp + rsi + 0x1d], r8b
add rax, 2
nop dword [rax]
cmp rax, 0xa
jge 0x471492
movzx edx, byte [rsp + rax + 0x26]
movzx esi, byte [rsp + rax + 0x27]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 9
jae 0x4714b7
movzx r8d, byte [rsp + rdi + 0x1d]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x72]
cmp rsi, 9
jb 0x471442
jmp 0x4714ab
xor eax, eax
lea rbx, [rsp + 0x1d]
mov ecx, 9
nop
call fcn.00440c20
add rsp, 0x30
pop rbp
ret
mov eax, esi
mov ecx, 9
call fcn.00450f00
mov eax, edi
mov ecx, 9
nop
call fcn.00450f00
nop
call fcn.0044ec80
jmp fcn.00471400

Function at 0x471740
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x47180c
push rbp
mov rbp, rsp
sub rsp, 0x38
movabs rdx, 0xab616e69e96e0c0a
mov qword [rsp + 0x1f], rdx
movabs rdx, 0x57ad0bab616e69e9
mov qword [rsp + 0x22], rdx
movabs rdx, 0x10a0a0a08010307
mov qword [rsp + 0x2a], rdx
movabs rdx, 0x10707000908010a
mov qword [rsp + 0x30], rdx
xor eax, eax
jmp 0x4717af
movzx r9d, byte [rsp + rsi + 0x1f]
sub r9d, edx
lea edx, [r9 - 0x43]
mov byte [rsp + rdi + 0x1f], dl
lea edx, [r8 - 0x43]
mov byte [rsp + rsi + 0x1f], dl
add rax, 2
cmp rax, 0xe
jge 0x4717dc
movzx edx, byte [rsp + rax + 0x2a]
movzx esi, byte [rsp + rax + 0x2b]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0xb
jae 0x4717ff
movzx r8d, byte [rsp + rdi + 0x1f]
sub r8d, edx
cmp rsi, 0xb
jb 0x471792
jmp 0x4717f3
xor eax, eax
lea rbx, [rsp + 0x1f]
mov ecx, 0xb
call fcn.00440c20
add rsp, 0x38
pop rbp
ret
mov eax, esi
mov ecx, 0xb
call fcn.00450f00
mov eax, edi
mov ecx, 0xb
call fcn.00450f00
nop
call fcn.0044ec80
jmp fcn.00471740
Function at 0x471820
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4718ec
push rbp
mov rbp, rsp
sub rsp, 0x30
movabs rdx, 0x61a271ae5f856595
mov qword [rsp + 0x19], rdx
movabs rdx, 0xa7757461a271ae5f
mov qword [rsp + 0x1c], rdx
movabs rdx, 0x20608070604020a
mov qword [rsp + 0x24], rdx
mov dword [rsp + 0x2c], 0x4050002
xor eax, eax
jmp 0x471885
movzx r9d, byte [rsp + rsi + 0x19]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x28]
mov byte [rsp + rdi + 0x19], dl
mov byte [rsp + rsi + 0x19], r8b
add rax, 2
cmp rax, 0xc
jge 0x4718bc
movzx edx, byte [rsp + rax + 0x24]
movzx esi, byte [rsp + rax + 0x25]
mov edi, edx
xor edx, esi
add edx, eax
nop dword [rax + rax]
cmp rdi, 0xb
jae 0x4718df
movzx r8d, byte [rsp + rdi + 0x19]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x28]
cmp rsi, 0xb
jb 0x47186b
jmp 0x4718d3
xor eax, eax
lea rbx, [rsp + 0x19]
mov ecx, 0xb
call fcn.00440c20
add rsp, 0x30
pop rbp
ret
mov eax, esi
mov ecx, 0xb
call fcn.00450f00
mov eax, edi
mov ecx, 0xb
call fcn.00450f00
nop
call fcn.0044ec80
jmp fcn.00471820

Function at 0x4720e0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4721ca
push rbp
mov rbp, rsp
sub rsp, 0x40
movabs rdx, 0x74eeebee2616e04f
mov qword [rsp + 0x19], rdx
movabs rdx, 0x6874eeebee2616e0
mov qword [rsp + 0x1a], rdx
movabs rdx, 0x372469ff8c722cd1
mov qword [rsp + 0x22], rdx
movabs rdx, 0xa01090506090904
mov qword [rsp + 0x2a], rdx
movabs rdx, 0x20c0f030a0d0a01
mov qword [rsp + 0x30], rdx
movabs rdx, 0x100c041010090902
mov qword [rsp + 0x38], rdx
xor eax, eax
jmp 0x47216d
movzx r9d, byte [rsp + rsi + 0x19]
sub r9d, edx
lea edx, [r9 + 0x51]
mov byte [rsp + rdi + 0x19], dl
lea edx, [r8 + 0x51]
mov byte [rsp + rsi + 0x19], dl
add rax, 2
cmp rax, 0x16
jge 0x47219a
movzx edx, byte [rsp + rax + 0x2a]
movzx esi, byte [rsp + rax + 0x2b]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x11
jae 0x4721bd
movzx r8d, byte [rsp + rdi + 0x19]
sub r8d, edx
cmp rsi, 0x11
jb 0x472150
jmp 0x4721b1
xor eax, eax
lea rbx, [rsp + 0x19]
mov ecx, 0x11
call fcn.00440c20
add rsp, 0x40
pop rbp
ret
mov eax, esi
mov ecx, 0x11
call fcn.00450f00
mov eax, edi
mov ecx, 0x11
call fcn.00450f00
nop
call fcn.0044ec80
jmp fcn.004720e0
Function at 0x472440
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x472512
push rbp
mov rbp, rsp
sub rsp, 0x38
movabs rdx, 0x325965f75f436c16
mov qword [rsp + 0x1f], rdx
movabs rdx, 0x260a69325965f75f
mov qword [rsp + 0x22], rdx
movabs rdx, 0xa0a0906060400
mov qword [rsp + 0x2a], rdx
movabs rdx, 0xa0209070404000a
mov qword [rsp + 0x30], rdx
xor eax, eax
jmp 0x4724ac
movzx r9d, byte [rsp + rsi + 0x1f]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x17]
mov byte [rsp + rdi + 0x1f], dl
mov byte [rsp + rsi + 0x1f], r8b
add rax, 2
cmp rax, 0xe
jge 0x4724de
movzx edx, byte [rsp + rax + 0x2a]
movzx esi, byte [rsp + rax + 0x2b]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0xb
jae 0x472505
movzx r8d, byte [rsp + rdi + 0x1f]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x17]
cmp rsi, 0xb
jb 0x472492
jmp 0x4724f5
xor eax, eax
lea rbx, [rsp + 0x1f]
mov ecx, 0xb
call fcn.00440c20
add rsp, 0x38
pop rbp
ret
mov eax, esi
mov ecx, 0xb
nop dword [rax]
call fcn.00450f00
mov eax, edi
mov ecx, 0xb
call fcn.00450f00
nop
call fcn.0044ec80
jmp fcn.00472440

Function at 0x472a20
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x472ae7
push rbp
mov rbp, rsp
sub rsp, 0x38
movabs rdx, 0x6a8a5467614a6c6c
mov qword [rsp + 0x1c], rdx
mov dword [rsp + 0x24], 0x67996fc6
movabs rdx, 0x806010405000702
mov qword [rsp + 0x28], rdx
movabs rdx, 0x4080a08040a0604
mov qword [rsp + 0x30], rdx
xor eax, eax
jmp 0x472a88
movzx r9d, byte [rsp + rsi + 0x1c]
sub r9d, edx
lea edx, [r9 + 3]
mov byte [rsp + rdi + 0x1c], dl
lea edx, [r8 + 3]
mov byte [rsp + rsi + 0x1c], dl
add rax, 2
cmp rax, 0x10
jge 0x472ab7
movzx edx, byte [rsp + rax + 0x28]
movzx esi, byte [rsp + rax + 0x29]
mov edi, edx
xor edx, esi
add edx, eax
nop
cmp rdi, 0xc
jae 0x472ada
movzx r8d, byte [rsp + rdi + 0x1c]
sub r8d, edx
cmp rsi, 0xc
jb 0x472a6b
jmp 0x472ace
xor eax, eax
lea rbx, [rsp + 0x1c]
mov ecx, 0xc
call fcn.00440c20
add rsp, 0x38
pop rbp
ret
mov eax, esi
mov ecx, 0xc
call fcn.00450f00
mov eax, edi
mov ecx, 0xc
call fcn.00450f00
nop
call fcn.0044ec80
jmp fcn.00472a20
Function at 0x472fa0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x473086
push rbp
mov rbp, rsp
sub rsp, 0x40
movabs rdx, 0x5ff3acbaa5ae7350
mov qword [rsp + 0x1f], rdx
movabs rdx, 0x4bbc0d820061505f
mov qword [rsp + 0x26], rdx
movabs rdx, 0xa060d060c0e0d0b
mov qword [rsp + 0x2e], rdx
movabs rdx, 0xa020a060d060c0e
mov qword [rsp + 0x30], rdx
movabs rdx, 0x3050d0e06040c0d
mov qword [rsp + 0x38], rdx
xor eax, eax
nop
jmp 0x473020
movzx r9d, byte [rsp + rsi + 0x1f]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x56]
mov byte [rsp + rdi + 0x1f], dl
mov byte [rsp + rsi + 0x1f], r8b
add rax, 2
nop dword [rax]
cmp rax, 0x12
jge 0x473052
movzx edx, byte [rsp + rax + 0x2e]
movzx esi, byte [rsp + rax + 0x2f]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0xf
jae 0x473077
movzx r8d, byte [rsp + rdi + 0x1f]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x56]
cmp rsi, 0xf
jb 0x473002
jmp 0x47306b
xor eax, eax
lea rbx, [rsp + 0x1f]
mov ecx, 0xf
nop
call fcn.00440c20
add rsp, 0x40
pop rbp
ret
mov eax, esi
mov ecx, 0xf
call fcn.00450f00
mov eax, edi
mov ecx, 0xf
nop
call fcn.00450f00
nop
call fcn.0044ec80
jmp fcn.00472fa0

Function at 0x473d60
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x473e12
push rbp
mov rbp, rsp
sub rsp, 0x28
movabs rdx, 0xa077c561620cb9ad
mov qword [rsp + 0x20], rdx
movabs rdx, 0x700010205050202
mov qword [rsp + 0x18], rdx
xor eax, eax
jmp 0x473dae
movzx r9d, byte [rsp + rsi + 0x20]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x59]
mov byte [rsp + rdi + 0x20], dl
mov byte [rsp + rsi + 0x20], r8b
add rax, 2
cmp rax, 8
jge 0x473de2
movzx edx, byte [rsp + rax + 0x18]
movzx esi, byte [rsp + rax + 0x19]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 8
jae 0x473e05
movzx r8d, byte [rsp + rdi + 0x20]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x59]
cmp rsi, 8
jb 0x473d94
nop
jmp 0x473df9
xor eax, eax
lea rbx, [rsp + 0x20]
mov ecx, 8
call fcn.00440c20
add rsp, 0x28
pop rbp
ret
mov eax, esi
mov ecx, 8
call fcn.00450f00
mov eax, edi
mov ecx, 8
call fcn.00450f00
nop
call fcn.0044ec80
jmp fcn.00473d60