joyce8/EMBER2024-capa huggingface dataset:
Function at 0x444440
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x10
mov qword [rsp + 0x20], rax
test rbx, rbx
jbe 0x4445b7
movzx edx, byte [rax]
test edx, edx
jne 0x444474
nop dword [rax]
test r8b, r8b
jne 0x444474
xor eax, eax
xor ebx, ebx
mov rcx, rbx
xor edi, edi
add rsp, 0x10
pop rbp
ret
bt edx, 7
jae 0x444487
xor edx, edx
xor r8d, r8d
xor r9d, r9d
jmp 0x444577
mov r8d, 1
mov r9d, edx
and edx, 1
neg edx
shr r9d, 1
xor edx, r9d
add dword [rsi], edx
nop dword [rax]
cmp rbx, r8
jb 0x444565
sub rbx, r8
sub rcx, r8
mov rdx, rcx
neg rdx
sar rdx, 0x3f
and r8, rdx
lea rdx, [rax + r8]
test rbx, rbx
jbe 0x444557
movzx esi, byte [rax + r8]
bt esi, 7
jae 0x4444dd
xor eax, eax
xor esi, esi
xor r8d, r8d
jmp 0x444520
mov eax, 1
cmp rax, rbx
ja 0x44450b
add qword [rdi], rsi
sub rcx, rax
sub rbx, rax
mov rsi, rcx
neg rsi
sar rsi, 0x3f
and rax, rsi
add rax, rdx
mov edi, 1
add rsp, 0x10
pop rbp
ret
mov rcx, rbx
call fcn.004522a0
lea r8d, [rcx + 7]
mov rcx, r11
mov eax, r12d
nop dword [rax]
cmp rax, rbx
jae 0x44454f
movzx r9d, byte [rax + rdx]
mov r10d, r9d
and r9d, 0x7f
mov r11, rcx
mov ecx, r8d
shl r9d, cl
lea r12d, [rax + 1]
or esi, r9d
test r10b, 0x80
jne 0x444513
mov rcx, r11
mov eax, r12d
jmp 0x4444e2
mov rcx, rbx
call fcn.004521e0
xor eax, eax
mov rcx, rax
nop dword [rax]
call fcn.004521e0
mov eax, r8d
mov rcx, rbx
call fcn.004522a0
lea r9d, [rcx + 7]
mov rcx, r12
cmp rbx, rdx
jbe 0x4445ad
movzx r10d, byte [rdx + rax]
mov r11d, r10d
and r10d, 0x7f
mov r12, rcx
mov ecx, r9d
shl r10d, cl
inc edx
or r8d, r10d
test r11b, 0x80
jne 0x444570
mov rcx, r12
mov r9d, edx
mov edx, r8d
mov r8d, r9d
jmp 0x44448d
mov eax, edx
mov rcx, rbx
call fcn.004521e0
xor eax, eax
mov rcx, rax
nop dword [rax]
call fcn.004521e0
nop
int3

Function at 0x449b60
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x449c0f
push rbp
mov rbp, rsp
sub rsp, 0x58
mov qword [rsp + 0x70], rbx
lea rdx, [rsp + 0x68]
mov qword [rsp + 8], 0
movups xmmword [rsp + 0x10], xmm15
movups xmmword [rsp + 0x18], xmm15
movups xmmword [rsp + 0x28], xmm15
movups xmmword [rsp + 0x38], xmm15
movups xmmword [rsp + 0x48], xmm15
lea rsi, [0x00449c60]
mov qword [rsp + 0x10], rsi
mov rsi, qword [rsp + 0x60]
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdx
mov rdx, r14
mov qword [rsp + 0x28], rdx
lea rdx, [rsp + 8]
mov qword [rsp + 0x30], rdx
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x48], rcx
mov qword [rsp + 0x50], rdi
lea rax, [rsp + 0x10]
mov qword [rsp], rax
call fcn.0044fe20
xorps xmm15, xmm15
mov r14, qword [0x007a7690]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 8]
add rsp, 0x58
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
call fcn.0044ff60
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
nop dword [rax]
jmp fcn.00449b60
Function at 0x451d40
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x403903
push rbp
mov rbp, rsp
sub rsp, 0x18
mov rdx, qword [rax]
mov rcx, qword [rax + 8]
mov rax, rdx
call fcn.004083a0
add rsp, 0x18
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.0044ff60
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp 0x4038e0
cmp byte [0x007a748a], 0
je 0x451d55
mov rcx, qword [rax + 8]
mov rax, qword [rax]
jmp 0x44efa0
jmp 0x4038e0

Function at 0x451d60
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
nop
mov eax, dword [rax]
movabs rcx, 0xe7037ed1a0b428db
xor rcx, rax
xor rax, rbx
xor rax, qword [0x007a7740]
movabs rdx, 0xa0761d6478bd642f
xor rdx, rax
mov rax, rcx
mul rdx
xor rax, rdx
mov rcx, rax
movabs rax, 0x1d8e4e27c47d124b
mul rcx
xor rax, rdx
nop
nop
ret
cmp byte [0x007a748a], 0
je 0x451d95
movq xmm0, rbx
pinsrd xmm0, dword [rax], 2
aesenc xmm0, xmmword [0x007a7a60]
aesenc xmm0, xmmword [0x007a7a70]
aesenc xmm0, xmmword [0x007a7a80]
movq rax, xmm0
ret
jmp 0x4085c0

Function at 0x451da0
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
nop
mov rax, qword [rax]
movabs rcx, 0xe7037ed1a0b428db
xor rcx, rax
xor rax, rbx
xor rax, qword [0x007a7740]
movabs rdx, 0xa0761d6478bd642f
xor rdx, rax
mov rax, rcx
mul rdx
xor rax, rdx
mov rcx, rax
movabs rax, 0x1d8e4e27c47d1247
mul rcx
xor rax, rdx
nop
nop
ret
cmp byte [0x007a748a], 0
je 0x451dd6
movq xmm0, rbx
pinsrq xmm0, qword [rax], 1
aesenc xmm0, xmmword [0x007a7a60]
aesenc xmm0, xmmword [0x007a7a70]
aesenc xmm0, xmmword [0x007a7a80]
movq rax, xmm0
ret
jmp 0x408620

Function at 0x453aa0
Capabilities:
Allocate thread local storage

Disassembly:
push rbp
mov rbp, rsp
mov rax, rsp
and rsp, 0xfffffffffffffff0
sub rsp, 0x30
mov qword [rsp + 0x20], rax
mov rax, qword [sym.imp.kernel32.dll_TlsAlloc]
call rax
mov rsp, qword [rsp + 0x20]
mov rcx, rax
cmp rcx, 0x40
jb 0x453ad4
mov rcx, 0x28
jmp 0x453adf
shl rcx, 3
add rcx, 0x1480
mov qword [0x007a7690], rcx
pop rbp
ret
Function at 0x458080
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x45816a
push rbp
mov rbp, rsp
sub rsp, 0x48
movabs rdx, 0x360f187075736e33
mov qword [rsp + 0x1d], rdx
movabs rdx, 0x6f0b642cc3360f18
mov qword [rsp + 0x22], rdx
movabs rdx, 0x2bd8697438f94efe
mov qword [rsp + 0x2a], rdx
movabs rdx, 0xb060700090d1306
mov qword [rsp + 0x32], rdx
movabs rdx, 0xe13080613050b06
mov qword [rsp + 0x38], rdx
movabs rdx, 0xf090b0614100f0f
mov qword [rsp + 0x40], rdx
xor eax, eax
jmp 0x45810d
movzx r9d, byte [rsp + rsi + 0x1d]
sub r9d, edx
lea edx, [r9 + 0x4a]
mov byte [rsp + rdi + 0x1d], dl
lea edx, [r8 + 0x4a]
mov byte [rsp + rsi + 0x1d], dl
add rax, 2
cmp rax, 0x16
jge 0x45813a
movzx edx, byte [rsp + rax + 0x32]
movzx esi, byte [rsp + rax + 0x33]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x15
jae 0x45815d
movzx r8d, byte [rsp + rdi + 0x1d]
sub r8d, edx
cmp rsi, 0x15
jb 0x4580f0
jmp 0x458151
xor eax, eax
lea rbx, [rsp + 0x1d]
mov ecx, 0x15
call fcn.00441b80
add rsp, 0x48
pop rbp
ret
mov eax, esi
mov ecx, 0x15
call fcn.004521e0
mov eax, edi
mov ecx, 0x15
call fcn.004521e0
nop
call fcn.0044ff60
jmp fcn.00458080

Function at 0x45bac0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x45bbac
push rbp
mov rbp, rsp
sub rsp, 0x40
movabs rdx, 0xfd7e2005156c61e9
mov qword [rsp + 0x18], rdx
movabs rdx, 0x974fd7e2005156c
mov qword [rsp + 0x1a], rdx
movabs rdx, 0x60d8f26172b4d983
mov qword [rsp + 0x22], rdx
movabs rdx, 0xc000c090a070611
mov qword [rsp + 0x2a], rdx
movabs rdx, 0x60c040711030c00
mov qword [rsp + 0x30], rdx
movabs rdx, 0x11060f000b100c11
mov qword [rsp + 0x38], rdx
xor eax, eax
jmp 0x45bb4a
movzx r9d, byte [rsp + rsi + 0x18]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x63]
mov byte [rsp + rdi + 0x18], dl
mov byte [rsp + rsi + 0x18], r8b
add rax, 2
cmp rax, 0x16
jge 0x45bb7c
movzx edx, byte [rsp + rax + 0x2a]
movzx esi, byte [rsp + rax + 0x2b]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x12
jae 0x45bb9f
movzx r8d, byte [rsp + rdi + 0x18]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x63]
cmp rsi, 0x12
jb 0x45bb30
jmp 0x45bb93
xor eax, eax
lea rbx, [rsp + 0x18]
mov ecx, 0x12
call fcn.00441b80
add rsp, 0x40
pop rbp
ret
mov eax, esi
mov ecx, 0x12
call fcn.004521e0
mov eax, edi
mov ecx, 0x12
call fcn.004521e0
nop
call fcn.0044ff60
jmp fcn.0045bac0
Function at 0x45c0c0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x45c186
push rbp
mov rbp, rsp
sub rsp, 0x30
movabs rdx, 0xef36b7edfbb0bdb3
mov qword [rsp + 0x1b], rdx
mov byte [rsp + 0x23], 0x35
movabs rdx, 0x2030300050103
mov qword [rsp + 0x24], rdx
mov dword [rsp + 0x2c], 0x40507
xor eax, eax
nop
jmp 0x45c120
movzx r9d, byte [rsp + rsi + 0x1b]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x37]
mov byte [rsp + rdi + 0x1b], dl
mov byte [rsp + rsi + 0x1b], r8b
add rax, 2
nop dword [rax]
cmp rax, 0xc
jge 0x45c152
movzx edx, byte [rsp + rax + 0x24]
movzx esi, byte [rsp + rax + 0x25]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 9
jae 0x45c177
movzx r8d, byte [rsp + rdi + 0x1b]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x37]
cmp rsi, 9
jb 0x45c102
jmp 0x45c16b
xor eax, eax
lea rbx, [rsp + 0x1b]
mov ecx, 9
nop
call fcn.00441b80
add rsp, 0x30
pop rbp
ret
mov eax, esi
mov ecx, 9
call fcn.004521e0
mov eax, edi
mov ecx, 9
nop
call fcn.004521e0
nop
call fcn.0044ff60
jmp fcn.0045c0c0

Function at 0x45d000
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x45d0cc
push rbp
mov rbp, rsp
sub rsp, 0x38
movabs rdx, 0x8f38e133616da569
mov qword [rsp + 0x1a], rdx
movabs rdx, 0x768643832338f38
mov qword [rsp + 0x20], rdx
movabs rdx, 0x5010c000d0b0307
mov qword [rsp + 0x28], rdx
movabs rdx, 0x50b03020201010b
mov qword [rsp + 0x30], rdx
xor eax, eax
jmp 0x45d06f
movzx r9d, byte [rsp + rsi + 0x1a]
sub r9d, edx
lea edx, [r9 - 0x27]
mov byte [rsp + rdi + 0x1a], dl
lea edx, [r8 - 0x27]
mov byte [rsp + rsi + 0x1a], dl
add rax, 2
cmp rax, 0x10
jge 0x45d09c
movzx edx, byte [rsp + rax + 0x28]
movzx esi, byte [rsp + rax + 0x29]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0xe
jae 0x45d0bf
movzx r8d, byte [rsp + rdi + 0x1a]
sub r8d, edx
cmp rsi, 0xe
jb 0x45d052
jmp 0x45d0b3
xor eax, eax
lea rbx, [rsp + 0x1a]
mov ecx, 0xe
call fcn.00441b80
add rsp, 0x38
pop rbp
ret
mov eax, esi
mov ecx, 0xe
call fcn.004521e0
mov eax, edi
mov ecx, 0xe
call fcn.004521e0
nop
call fcn.0044ff60
jmp fcn.0045d000

Function at 0x45d3c0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x45d48c
push rbp
mov rbp, rsp
sub rsp, 0x38
movabs rdx, 0xe0350f17f1e2d309
mov qword [rsp + 0x28], rdx
movabs rdx, 0x1a32361214183139
mov qword [rsp + 0x30], rdx
movabs rdx, 0x707050c02000102
mov qword [rsp + 0x18], rdx
movabs rdx, 0xf070a04010b0307
mov qword [rsp + 0x20], rdx
xor eax, eax
jmp 0x45d42f
movzx r9d, byte [rsp + rsi + 0x28]
sub r9d, edx
lea edx, [r9 + 0x33]
mov byte [rsp + rdi + 0x28], dl
lea edx, [r8 + 0x33]
mov byte [rsp + rsi + 0x28], dl
add rax, 2
cmp rax, 0x10
jge 0x45d45c
movzx edx, byte [rsp + rax + 0x18]
movzx esi, byte [rsp + rax + 0x19]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x10
jae 0x45d47f
movzx r8d, byte [rsp + rdi + 0x28]
sub r8d, edx
cmp rsi, 0x10
jb 0x45d412
jmp 0x45d473
xor eax, eax
lea rbx, [rsp + 0x28]
mov ecx, 0x10
call fcn.00441b80
add rsp, 0x38
pop rbp
ret
mov eax, esi
mov ecx, 0x10
call fcn.004521e0
mov eax, edi
mov ecx, 0x10
call fcn.004521e0
nop
call fcn.0044ff60
jmp fcn.0045d3c0
Function at 0x45d860
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x45d94c
push rbp
mov rbp, rsp
sub rsp, 0x40
movabs rdx, 0x3434282127303903
mov qword [rsp + 0x1d], rdx
movabs rdx, 0x734342821273039
mov qword [rsp + 0x1e], rdx
movabs rdx, 0x1e3236f4cd1d351e
mov qword [rsp + 0x26], rdx
movabs rdx, 0x8030200100d0c10
mov qword [rsp + 0x2e], rdx
movabs rdx, 0x20508030200100d
mov qword [rsp + 0x30], rdx
movabs rdx, 0x50b0b0d10030409
mov qword [rsp + 0x38], rdx
xor eax, eax
jmp 0x45d8ea
movzx r9d, byte [rsp + rsi + 0x1d]
lea edx, [r9 + rdx]
lea edx, [rdx - 1]
mov byte [rsp + rdi + 0x1d], dl
mov byte [rsp + rsi + 0x1d], r8b
add rax, 2
cmp rax, 0x12
jge 0x45d91c
movzx edx, byte [rsp + rax + 0x2e]
movzx esi, byte [rsp + rax + 0x2f]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x11
jae 0x45d93f
movzx r8d, byte [rsp + rdi + 0x1d]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 1]
cmp rsi, 0x11
jb 0x45d8d0
jmp 0x45d933
xor eax, eax
lea rbx, [rsp + 0x1d]
mov ecx, 0x11
call fcn.00441b80
add rsp, 0x40
pop rbp
ret
mov eax, esi
mov ecx, 0x11
call fcn.004521e0
mov eax, edi
mov ecx, 0x11
call fcn.004521e0
nop
call fcn.0044ff60
jmp fcn.0045d860

Function at 0x45e7c0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x45e8bb
push rbp
mov rbp, rsp
sub rsp, 0x50
movabs rdx, 0x2527353136342c1c
mov qword [rsp + 0x1c], rdx
movabs rdx, 0x2123343922302629
mov qword [rsp + 0x24], rdx
movabs rdx, 0x2e40313327342131
mov qword [rsp + 0x2c], rdx
movabs rdx, 0x30f17160a081302
mov qword [rsp + 0x34], rdx
movabs rdx, 0x9060d0b020a0106
mov qword [rsp + 0x3c], rdx
movabs rdx, 0xd0a0d0009060d0b
mov qword [rsp + 0x40], rdx
movabs rdx, 0x1116080201070e03
mov qword [rsp + 0x48], rdx
xor eax, eax
jmp 0x45e859
movzx r9d, byte [rsp + rsi + 0x1c]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x10]
mov byte [rsp + rdi + 0x1c], dl
mov byte [rsp + rsi + 0x1c], r8b
add rax, 2
cmp rax, 0x1c
jge 0x45e88b
movzx edx, byte [rsp + rax + 0x34]
movzx esi, byte [rsp + rax + 0x35]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x18
jae 0x45e8ae
movzx r8d, byte [rsp + rdi + 0x1c]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x10]
cmp rsi, 0x18
jb 0x45e83f
jmp 0x45e8a2
xor eax, eax
lea rbx, [rsp + 0x1c]
mov ecx, 0x18
call fcn.00441b80
add rsp, 0x50
pop rbp
ret
mov eax, esi
mov ecx, 0x18
call fcn.004521e0
mov eax, edi
mov ecx, 0x18
call fcn.004521e0
nop
nop dword [rax + rax]
call fcn.0044ff60
jmp fcn.0045e7c0
Function at 0x45e8e0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x45e9dd
push rbp
mov rbp, rsp
sub rsp, 0x50
movabs rdx, 0x3036bb3730aa3835
mov qword [rsp + 0x1e], rdx
movabs rdx, 0x17af9fb8343fc0a3
mov qword [rsp + 0x26], rdx
movabs rdx, 0x56c3b0af36b2cfbd
mov qword [rsp + 0x2e], rdx
movabs rdx, 0x802110a1509170e
mov qword [rsp + 0x36], rdx
movabs rdx, 0xa100f0d100e0c15
mov qword [rsp + 0x3e], rdx
movabs rdx, 0xd0d0a100f0d100e
mov qword [rsp + 0x40], rdx
movabs rdx, 0x100a12140511160c
mov qword [rsp + 0x48], rdx
xor eax, eax
jmp 0x45e980
movzx r9d, byte [rsp + rsi + 0x1e]
sub r9d, edx
lea edx, [r9 - 0x61]
mov byte [rsp + rdi + 0x1e], dl
lea edx, [r8 - 0x61]
mov byte [rsp + rsi + 0x1e], dl
add rax, 2
nop dword [rax]
cmp rax, 0x1a
jge 0x45e9ad
movzx edx, byte [rsp + rax + 0x36]
movzx esi, byte [rsp + rax + 0x37]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x18
jae 0x45e9d0
movzx r8d, byte [rsp + rdi + 0x1e]
sub r8d, edx
cmp rsi, 0x18
jb 0x45e95f
jmp 0x45e9c4
xor eax, eax
lea rbx, [rsp + 0x1e]
mov ecx, 0x18
call fcn.00441b80
add rsp, 0x50
pop rbp
ret
mov eax, esi
mov ecx, 0x18
call fcn.004521e0
mov eax, edi
mov ecx, 0x18
call fcn.004521e0
nop
nop dword [rax]
call fcn.0044ff60
jmp fcn.0045e8e0
Function at 0x46fcc0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x46fdbb
push rbp
mov rbp, rsp
sub rsp, 0x48
movabs rdx, 0x6169749023dd1341
mov qword [rsp + 0x19], rdx
movabs rdx, 0xc3ddd5da6e616974
mov qword [rsp + 0x1e], rdx
movabs rdx, 0x736823bfa2876f72
mov qword [rsp + 0x26], rdx
movabs rdx, 0x9020f0504120b02
mov qword [rsp + 0x2e], rdx
movabs rdx, 0xf0a0f1011030312
mov qword [rsp + 0x36], rdx
movabs rdx, 0xb0c0f0a0f101103
mov qword [rsp + 0x38], rdx
movabs rdx, 0xf03020b10010205
mov qword [rsp + 0x40], rdx
xor eax, eax
jmp 0x46fd59
movzx r9d, byte [rsp + rsi + 0x19]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x34]
mov byte [rsp + rdi + 0x19], dl
mov byte [rsp + rsi + 0x19], r8b
add rax, 2
cmp rax, 0x1a
jge 0x46fd8b
movzx edx, byte [rsp + rax + 0x2e]
movzx esi, byte [rsp + rax + 0x2f]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x15
jae 0x46fdae
movzx r8d, byte [rsp + rdi + 0x19]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x34]
cmp rsi, 0x15
jb 0x46fd3f
jmp 0x46fda2
xor eax, eax
lea rbx, [rsp + 0x19]
mov ecx, 0x15
call fcn.00441b80
add rsp, 0x48
pop rbp
ret
mov eax, esi
mov ecx, 0x15
call fcn.004521e0
mov eax, edi
mov ecx, 0x15
call fcn.004521e0
nop
nop dword [rax + rax]
call fcn.0044ff60
jmp fcn.0046fcc0

Function at 0x470120
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4701dd
push rbp
mov rbp, rsp
sub rsp, 0x30
movabs rdx, 0x9ca173916961026e
mov qword [rsp + 0x1d], rdx
mov byte [rsp + 0x25], 0xc
movabs rdx, 0x6010707040006
mov qword [rsp + 0x26], rdx
mov word [rsp + 0x2e], 0x408
xor eax, eax
nop
jmp 0x470180
movzx r9d, byte [rsp + rsi + 0x1d]
sub r9d, edx
lea edx, [r9 + 0x73]
mov byte [rsp + rdi + 0x1d], dl
lea edx, [r8 + 0x73]
mov byte [rsp + rsi + 0x1d], dl
add rax, 2
nop
cmp rax, 0xa
jge 0x4701ad
movzx edx, byte [rsp + rax + 0x26]
movzx esi, byte [rsp + rax + 0x27]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 9
jae 0x4701d0
movzx r8d, byte [rsp + rdi + 0x1d]
sub r8d, edx
cmp rsi, 9
jb 0x470162
jmp 0x4701c4
xor eax, eax
lea rbx, [rsp + 0x1d]
mov ecx, 9
call fcn.00441b80
add rsp, 0x30
pop rbp
ret
mov eax, esi
mov ecx, 9
call fcn.004521e0
mov eax, edi
mov ecx, 9
call fcn.004521e0
nop
nop dword [rax]
call fcn.0044ff60
jmp fcn.00470120
Function at 0x470840
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4708f8
push rbp
mov rbp, rsp
sub rsp, 0x30
movabs rdx, 0x65f28e6f8df21543
mov qword [rsp + 0x1e], rdx
movabs rdx, 0x606020302050102
mov qword [rsp + 0x26], rdx
mov word [rsp + 0x2e], 0x502
xor eax, eax
jmp 0x470898
movzx r9d, byte [rsp + rsi + 0x1e]
sub r9d, edx
lea edx, [r9 + 0x79]
mov byte [rsp + rdi + 0x1e], dl
lea edx, [r8 + 0x79]
mov byte [rsp + rsi + 0x1e], dl
add rax, 2
cmp rax, 0xa
jge 0x4708c8
movzx edx, byte [rsp + rax + 0x26]
movzx esi, byte [rsp + rax + 0x27]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 8
jae 0x4708eb
movzx r8d, byte [rsp + rdi + 0x1e]
sub r8d, edx
nop dword [rax]
cmp rsi, 8
jb 0x47087b
jmp 0x4708df
xor eax, eax
lea rbx, [rsp + 0x1e]
mov ecx, 8
call fcn.00441b80
add rsp, 0x30
pop rbp
ret
mov eax, esi
mov ecx, 8
call fcn.004521e0
mov eax, edi
mov ecx, 8
call fcn.004521e0
nop
call fcn.0044ff60
nop dword [rax]
jmp fcn.00470840

Function at 0x472080
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x472132
push rbp
mov rbp, rsp
sub rsp, 0x28
movabs rdx, 0x6968786e6d724c76
mov qword [rsp + 0x20], rdx
movabs rdx, 0x104050004000105
mov qword [rsp + 0x18], rdx
xor eax, eax
jmp 0x4720ce
movzx r9d, byte [rsp + rsi + 0x20]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x77]
mov byte [rsp + rdi + 0x20], dl
mov byte [rsp + rsi + 0x20], r8b
add rax, 2
cmp rax, 8
jge 0x472102
movzx edx, byte [rsp + rax + 0x18]
movzx esi, byte [rsp + rax + 0x19]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 8
jae 0x472125
movzx r8d, byte [rsp + rdi + 0x20]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x77]
cmp rsi, 8
jb 0x4720b4
nop
jmp 0x472119
xor eax, eax
lea rbx, [rsp + 0x20]
mov ecx, 8
call fcn.00441b80
add rsp, 0x28
pop rbp
ret
mov eax, esi
mov ecx, 8
call fcn.004521e0
mov eax, edi
mov ecx, 8
call fcn.004521e0
nop
call fcn.0044ff60
jmp fcn.00472080

Function at 0x473840
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4738f2
push rbp
mov rbp, rsp
sub rsp, 0x28
movabs rdx, 0x5a5f7256294b694c
mov qword [rsp + 0x20], rdx
movabs rdx, 0x404020703070302
mov qword [rsp + 0x18], rdx
xor eax, eax
jmp 0x473891
movzx r9d, byte [rsp + rsi + 0x20]
sub r9d, edx
lea edx, [r9 + 0x11]
mov byte [rsp + rdi + 0x20], dl
lea edx, [r8 + 0x11]
mov byte [rsp + rsi + 0x20], dl
add rax, 2
cmp rax, 8
jge 0x4738be
movzx edx, byte [rsp + rax + 0x18]
movzx esi, byte [rsp + rax + 0x19]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 8
jae 0x4738e5
movzx r8d, byte [rsp + rdi + 0x20]
sub r8d, edx
cmp rsi, 8
jb 0x473874
jmp 0x4738d5
xor eax, eax
lea rbx, [rsp + 0x20]
mov ecx, 8
call fcn.00441b80
add rsp, 0x28
pop rbp
ret
mov eax, esi
mov ecx, 8
nop dword [rax]
call fcn.004521e0
mov eax, edi
mov ecx, 8
call fcn.004521e0
nop
call fcn.0044ff60
jmp fcn.00473840
Function at 0x473e60
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x473f32
push rbp
mov rbp, rsp
sub rsp, 0x38
movabs rdx, 0xc392f0c78d776193
mov qword [rsp + 0x1d], rdx
movabs rdx, 0xc6906e6f47c392f0
mov qword [rsp + 0x22], rdx
movabs rdx, 0x5030607000c0705
mov qword [rsp + 0x2a], rdx
movabs rdx, 0x20000040b060503
mov qword [rsp + 0x30], rdx
xor eax, eax
jmp 0x473ecc
movzx r9d, byte [rsp + rsi + 0x1d]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x38]
mov byte [rsp + rdi + 0x1d], dl
mov byte [rsp + rsi + 0x1d], r8b
add rax, 2
cmp rax, 0xe
jge 0x473efe
movzx edx, byte [rsp + rax + 0x2a]
movzx esi, byte [rsp + rax + 0x2b]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0xd
jae 0x473f25
movzx r8d, byte [rsp + rdi + 0x1d]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x38]
cmp rsi, 0xd
jb 0x473eb2
jmp 0x473f15
xor eax, eax
lea rbx, [rsp + 0x1d]
mov ecx, 0xd
call fcn.00441b80
add rsp, 0x38
pop rbp
ret
mov eax, esi
mov ecx, 0xd
nop dword [rax]
call fcn.004521e0
mov eax, edi
mov ecx, 0xd
call fcn.004521e0
nop
call fcn.0044ff60
jmp fcn.00473e60

Function at 0x474680
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x47475d
push rbp
mov rbp, rsp
sub rsp, 0x38
movabs rdx, 0x365438652f525449
mov qword [rsp + 0x19], rdx
movabs rdx, 0x36441b5f2e365438
mov qword [rsp + 0x1e], rdx
movabs rdx, 0x80b0a010b050c08
mov qword [rsp + 0x26], rdx
movabs rdx, 0x3080b0a010b05
mov qword [rsp + 0x28], rdx
movabs rdx, 0x6070c0509020001
mov qword [rsp + 0x30], rdx
xor eax, eax
nop
jmp 0x474700
movzx r9d, byte [rsp + rsi + 0x19]
sub r9d, edx
lea edx, [r9 + 0x26]
mov byte [rsp + rdi + 0x19], dl
lea edx, [r8 + 0x26]
mov byte [rsp + rsi + 0x19], dl
add rax, 2
nop
cmp rax, 0x12
jge 0x47472d
movzx edx, byte [rsp + rax + 0x26]
movzx esi, byte [rsp + rax + 0x27]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0xd
jae 0x474750
movzx r8d, byte [rsp + rdi + 0x19]
sub r8d, edx
cmp rsi, 0xd
jb 0x4746e2
jmp 0x474744
xor eax, eax
lea rbx, [rsp + 0x19]
mov ecx, 0xd
call fcn.00441b80
add rsp, 0x38
pop rbp
ret
mov eax, esi
mov ecx, 0xd
call fcn.004521e0
mov eax, edi
mov ecx, 0xd
call fcn.004521e0
nop
nop dword [rax]
call fcn.0044ff60
jmp fcn.00474680