joyce8/EMBER2024-capa huggingface dataset:
Function at 0x3822897a0
Capabilities:
Access peb ldr_data

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x50
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], rbx
mov rcx, qword [0x3825060d0]
test rcx, rcx
jne 0x3822897c4
xor ecx, ecx
xor edx, edx
jmp 0x3822897d9
call fcn.38229b140
mov rcx, rbx
mov rdx, rax
mov rax, qword [rsp + 0x60]
mov rbx, qword [rsp + 0x68]
mov qword [rsp + 0x10], rcx
mov qword [rsp + 0x18], rdx
mov qword [rsp + 0x20], r14
mov rsi, qword [r14 + 0x30]
inc dword [rsi + 0xd8]
mov qword [r14 + 0x10], 0xfffffffffffffade
mov byte [r14 + 0xb7], 1
call fcn.382289740
mov rcx, qword [rsp + 0x68]
mov rax, qword [rsp + 0x20]
mov qword [rax + 0x70], rcx
mov rdx, qword [rsp + 0x60]
mov qword [rax + 0x78], rdx
mov ebx, 2
mov ecx, 3
call fcn.3822834a0
mov rcx, qword [rsp + 0x20]
mov rdx, qword [rcx + 0x70]
cmp qword [rcx], rdx
ja 0x382289846
nop dword [rax + rax]
cmp qword [rcx + 8], rdx
jae 0x382289882
movups xmmword [rsp + 0x40], xmm15
lea rax, [0x382289aa0]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x48], rcx
lea rax, [rsp + 0x40]
mov qword [rsp], rax
call fcn.3822a4400
xorps xmm15, xmm15
mov r14, qword [0x3825062f8]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rcx, qword [rsp + 0x20]
mov rax, qword [rsp + 0x10]
test rax, rax
je 0x3822898eb
movups xmmword [rsp + 0x28], xmm15
mov qword [rsp + 0x38], 0
lea rcx, [0x382289a20]
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x18]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x28]
mov qword [rsp], rax
nop
call fcn.3822a4400
xorps xmm15, xmm15
mov r14, qword [0x3825062f8]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x60]
mov rbx, qword [rsp + 0x68]
call fcn.382289740
mov rcx, qword [rsp + 0x20]
mov al, byte [0x3824827b8]
test al, al
je 0x38228992b
lea rax, [0x3823ddb10]
mov qword [rsp], rax
call fcn.3822a4400
xorps xmm15, xmm15
mov r14, qword [0x3825062f8]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x60]
mov rbx, qword [rsp + 0x68]
call fcn.382289740
mov rcx, qword [rsp + 0x20]
mov rax, qword [rcx + 0x30]
mov rax, qword [rax + 0xa0]
test byte [rax], al
cmp dword [rax + 0x2298], 0
nop
je 0x382289978
lea rax, fcn.382284cc0
mov qword [rsp], rax
call fcn.3822a4400
xorps xmm15, xmm15
mov r14, qword [0x3825062f8]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x60]
mov rbx, qword [rsp + 0x68]
call fcn.382289740
mov rcx, qword [rsp + 0x20]
mov rax, qword [rcx + 0x30]
mov rdx, qword [rax + 0xa0]
mov edx, dword [rdx + 0x14]
mov dword [rax + 0x388], edx
mov rax, qword [rcx + 0x30]
mov rax, qword [rax + 0xa0]
mov qword [rax + 0x38], 0
mov rdx, qword [rcx + 0x30]
mov rbx, rax
mov qword [rdx + 0xb0], rax
mov rax, qword [rcx + 0x30]
mov qword [rax + 0xa0], 0
mov eax, 2
xchg dword [rbx + 4], eax
mov al, byte [0x3824827a8]
test al, al
je 0x382289a04
lea rax, [0x3823ddb08]
mov qword [rsp], rax
call fcn.3822a4400
xorps xmm15, xmm15
mov r14, qword [0x3825062f8]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x60]
mov rbx, qword [rsp + 0x68]
call fcn.382289740
mov rcx, qword [rsp + 0x20]
mov rax, qword [rcx + 0x30]
dec dword [rax + 0xd8]
add rsp, 0x50
pop rbp
ret
Function at 0x38228d900
Capabilities:
Encode data using base64

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x38228da67
push rbp
mov rbp, rsp
sub rsp, 0x18
mov ecx, dword [rax + 0x190]
mov edx, dword [rax + 0x194]
mov rsi, qword [rax + 0x998]
mov edi, dword [rax + 0x194]
cmp edi, edx
jne 0x38228d912
cmp edx, ecx
jne 0x38228da55
nop word [rax + rax]
test rsi, rsi
jne 0x38228da55
mov qword [rsp + 0x28], rax
test rbx, rbx
jne 0x38228d974
nop
call fcn.3822a8160
xorps xmm15, xmm15
mov r14, qword [0x3825062f8]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rbx, qword [rsp]
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0x10], rbx
call fcn.38228d820
mov rcx, qword [rsp + 0x28]
mov edx, dword [rcx]
mov ebx, edx
sar edx, 0x1f
shr edx, 0x1b
add edx, ebx
mov esi, edx
and edx, 0xffffffe0
sub ebx, edx
test ebx, ebx
jl 0x38228da50
mov rdx, qword [0x382480d98]
sar esi, 5
mov rax, rcx
mov ecx, ebx
mov edi, 1
shl edi, cl
movsxd rsi, esi
cmp ecx, 0x20
sbb r8d, r8d
and edi, r8d
cmp rdx, rsi
jbe 0x38228da45
mov rcx, qword [0x382480d90]
lea rcx, [rcx + rsi*4]
lock or dword [rcx], edi
mov rcx, qword [0x382482710]
mov qword [rax + 8], rcx
mov rcx, rax
nop
mov qword [0x382482710], rax
nop
mov edx, 1
lea rsi, [0x382482718]
lock xadd dword [rsi], edx
mov rdx, qword [rcx + 0x1248]
shr rdx, 0x3d
test dl, dl
jne 0x38228da33
mov rax, qword [rsp + 0x10]
movabs rdx, 0x1fffffffffffffff
and rdx, rax
bts rdx, 0x3f
nop
nop
xchg qword [rcx + 0x1248], rdx
add rsp, 0x18
pop rbp
ret
lea rax, [0x3823dab56]
mov ebx, 0x28
nop
call fcn.38227fd40
mov rax, rsi
mov rcx, rdx
call fcn.3822a6820
call fcn.38227ed40
lea rax, [0x3823da106]
mov ebx, 0x23
call fcn.38227fd40
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.3822a4520
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.38228d900
Function at 0x382290d00
Capabilities:
Access peb ldr_data

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x70
mov rcx, r14
test rcx, rcx
je 0x382290d48
mov rcx, qword [rcx + 0x30]
mov rcx, qword [rcx + 0x90]
nop dword [rax + rax]
test rcx, rcx
je 0x382290d48
mov qword [rsp + 0x68], rcx
nop
mov rax, qword [rdi + 0x28]
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x58], 0
mov qword [rsp + 0x50], 0
jmp 0x382290d58
mov eax, 1
add rsp, 0x70
pop rbp
ret
mov rax, qword [rsp + 0x60]
mov rcx, qword [0x3823a2720]
lea rdx, [rsp + 0x58]
mov rbx, qword [rax + 0xf8]
mov qword [rsp], rcx
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], 0
call fcn.38227dba0
xorps xmm15, xmm15
mov r14, qword [0x3825062f8]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x20]
nop
test rax, rax
je 0x382290e31
mov rcx, qword [rsp + 0x58]
mov rdx, qword [0x3823a2728]
mov rbx, qword [rsp + 0x60]
mov rsi, rbx
lea rdi, [rsp + 0x50]
mov r8, qword [rsi + 0xf8]
mov qword [rsp], rdx
mov qword [rsp + 8], 0
mov qword [rsp + 0x10], rcx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x40], 0
call fcn.38227de20
xorps xmm15, xmm15
mov r14, qword [0x3825062f8]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x68]
cmp qword [rcx], rax
ja 0x382290e31
cmp qword [rcx + 8], rax
ja 0x382290d53
mov eax, 1
add rsp, 0x70
pop rbp
ret
Function at 0x382297260
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x10
mov qword [rsp + 0x20], rax
test rbx, rbx
jbe 0x3822973d7
movzx edx, byte [rax]
test edx, edx
jne 0x382297294
nop dword [rax]
test r8b, r8b
jne 0x382297294
xor eax, eax
xor ebx, ebx
mov rcx, rbx
xor edi, edi
add rsp, 0x10
pop rbp
ret
bt edx, 7
jae 0x3822972a7
xor edx, edx
xor r8d, r8d
xor r9d, r9d
jmp 0x382297397
mov r8d, 1
mov r9d, edx
and edx, 1
neg edx
shr r9d, 1
xor edx, r9d
add dword [rsi], edx
nop dword [rax]
cmp rbx, r8
jb 0x382297385
sub rbx, r8
sub rcx, r8
mov rdx, rcx
neg rdx
sar rdx, 0x3f
and r8, rdx
lea rdx, [rax + r8]
test rbx, rbx
jbe 0x382297377
movzx esi, byte [rax + r8]
bt esi, 7
jae 0x3822972fd
xor eax, eax
xor esi, esi
xor r8d, r8d
jmp 0x382297340
mov eax, 1
cmp rax, rbx
ja 0x38229732b
add qword [rdi], rsi
sub rcx, rax
sub rbx, rax
mov rsi, rcx
neg rsi
sar rsi, 0x3f
and rax, rsi
add rax, rdx
mov edi, 1
add rsp, 0x10
pop rbp
ret
mov rcx, rbx
call fcn.3822a68e0
lea r8d, [rcx + 7]
mov rcx, r11
mov eax, r12d
nop dword [rax]
cmp rax, rbx
jae 0x38229736f
movzx r9d, byte [rax + rdx]
mov r10d, r9d
and r9d, 0x7f
mov r11, rcx
mov ecx, r8d
shl r9d, cl
lea r12d, [rax + 1]
or esi, r9d
test r10b, 0x80
jne 0x382297333
mov rcx, r11
mov eax, r12d
jmp 0x382297302
mov rcx, rbx
call fcn.3822a6820
xor eax, eax
mov rcx, rax
nop dword [rax]
call fcn.3822a6820
mov eax, r8d
mov rcx, rbx
call fcn.3822a68e0
lea r9d, [rcx + 7]
mov rcx, r12
cmp rbx, rdx
jbe 0x3822973cd
movzx r10d, byte [rdx + rax]
mov r11d, r10d
and r10d, 0x7f
mov r12, rcx
mov ecx, r9d
shl r10d, cl
inc edx
or r8d, r10d
test r11b, 0x80
jne 0x382297390
mov rcx, r12
mov r9d, edx
mov edx, r8d
mov r8d, r9d
jmp 0x3822972ad
mov eax, edx
mov rcx, rbx
call fcn.3822a6820
xor eax, eax
mov rcx, rax
nop dword [rax]
call fcn.3822a6820
nop
int3

Function at 0x38229cf00
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x38229cfb5
push rbp
mov rbp, rsp
sub rsp, 0x48
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x68], rcx
mov qword [rsp + 0x70], rdi
test byte [rax], al
lea rdx, [rax + 0x10]
mov rsi, qword [rsp + 0x68]
mov rcx, rdi
mov rax, rdx
mov rbx, rsi
call fcn.38229ac20
nop
test bl, bl
je 0x38229cfaf
mov qword [rsp + 0x18], rax
movups xmmword [rsp + 0x20], xmm15
movups xmmword [rsp + 0x28], xmm15
movups xmmword [rsp + 0x38], xmm15
lea rcx, [0x38229d000]
mov qword [rsp + 0x20], rcx
mov rcx, qword [rsp + 0x58]
mov qword [rsp + 0x28], rcx
mov rcx, qword [rsp + 0x60]
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x38], rax
lea rcx, [rsp + 0x68]
mov qword [rsp + 0x40], rcx
lea rcx, [rsp + 0x20]
mov qword [rsp], rcx
call fcn.3822a4400
xorps xmm15, xmm15
mov r14, qword [0x3825062f8]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x18]
add rsp, 0x48
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
call fcn.3822a4520
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
jmp fcn.38229cf00
Function at 0x38229e0c0
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x38229e16f
push rbp
mov rbp, rsp
sub rsp, 0x58
mov qword [rsp + 0x70], rbx
lea rdx, [rsp + 0x68]
mov qword [rsp + 8], 0
movups xmmword [rsp + 0x10], xmm15
movups xmmword [rsp + 0x18], xmm15
movups xmmword [rsp + 0x28], xmm15
movups xmmword [rsp + 0x38], xmm15
movups xmmword [rsp + 0x48], xmm15
lea rsi, [0x38229e1c0]
mov qword [rsp + 0x10], rsi
mov rsi, qword [rsp + 0x60]
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdx
mov rdx, r14
mov qword [rsp + 0x28], rdx
lea rdx, [rsp + 8]
mov qword [rsp + 0x30], rdx
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x48], rcx
mov qword [rsp + 0x50], rdi
mov qword [rsp + 0x40], rbx
lea rax, [rsp + 0x10]
mov qword [rsp], rax
call fcn.3822a4400
xorps xmm15, xmm15
mov r14, qword [0x3825062f8]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 8]
add rsp, 0x58
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
call fcn.3822a4520
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
nop dword [rax]
jmp fcn.38229e0c0
Function at 0x3822a6320
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x382254063
push rbp
mov rbp, rsp
sub rsp, 0x18
mov rdx, qword [rax]
mov rcx, qword [rax + 8]
mov rax, rdx
call fcn.382258ca0
add rsp, 0x18
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.3822a4520
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp 0x382254040
cmp byte [0x38250610b], 0
je 0x3822a6335
mov rcx, qword [rax + 8]
mov rax, qword [rax]
jmp 0x3822a3580
jmp 0x382254040

Function at 0x3822a6340
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
nop
mov eax, dword [rax]
movabs rcx, 0xe7037ed1a0b428db
xor rcx, rax
xor rax, rbx
xor rax, qword [0x3825063c0]
movabs rdx, 0xa0761d6478bd642f
xor rdx, rax
mov rax, rcx
mul rdx
xor rax, rdx
mov rcx, rax
movabs rax, 0x1d8e4e27c47d124b
mul rcx
xor rax, rdx
nop
nop
ret
cmp byte [0x38250610b], 0
je 0x3822a6375
movq xmm0, rbx
pinsrd xmm0, dword [rax], 2
aesenc xmm0, xmmword [0x382506740]
aesenc xmm0, xmmword [0x382506750]
aesenc xmm0, xmmword [0x382506760]
movq rax, xmm0
ret
jmp 0x382258ec0

Function at 0x3822a6380
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
nop
mov rax, qword [rax]
movabs rcx, 0xe7037ed1a0b428db
xor rcx, rax
xor rax, rbx
xor rax, qword [0x3825063c0]
movabs rdx, 0xa0761d6478bd642f
xor rdx, rax
mov rax, rcx
mul rdx
xor rax, rdx
mov rcx, rax
movabs rax, 0x1d8e4e27c47d1247
mul rcx
xor rax, rdx
nop
nop
ret
cmp byte [0x38250610b], 0
je 0x3822a63b6
movq xmm0, rbx
pinsrq xmm0, qword [rax], 1
aesenc xmm0, xmmword [0x382506740]
aesenc xmm0, xmmword [0x382506750]
aesenc xmm0, xmmword [0x382506760]
movq rax, xmm0
ret
jmp 0x382258f20

Function at 0x3822b0ae0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x3822b0bb2
push rbp
mov rbp, rsp
sub rsp, 0x38
movabs rdx, 0x2064695e35605b69
mov qword [rsp + 0x2a], rdx
movabs rdx, 0x55613e303f4c2064
mov qword [rsp + 0x30], rdx
movabs rdx, 0xd030a0d020b0d08
mov qword [rsp + 0x1a], rdx
movabs rdx, 0x802080901010d04
mov qword [rsp + 0x22], rdx
xor eax, eax
jmp 0x3822b0b4c
movzx r9d, byte [rsp + rsi + 0x2a]
lea edx, [r9 + rdx]
lea edx, [rdx + 9]
mov byte [rsp + rdi + 0x2a], dl
mov byte [rsp + rsi + 0x2a], r8b
add rax, 2
cmp rax, 0x10
jge 0x3822b0b7e
movzx edx, byte [rsp + rax + 0x1a]
movzx esi, byte [rsp + rax + 0x1b]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0xe
jae 0x3822b0ba5
movzx r8d, byte [rsp + rdi + 0x2a]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 9]
cmp rsi, 0xe
jb 0x3822b0b32
jmp 0x3822b0b95
xor eax, eax
lea rbx, [rsp + 0x2a]
mov ecx, 0xe
call fcn.382294b80
add rsp, 0x38
pop rbp
ret
mov eax, esi
mov ecx, 0xe
nop dword [rax]
call fcn.3822a6820
mov eax, edi
mov ecx, 0xe
call fcn.3822a6820
nop
call fcn.3822a4520
jmp fcn.3822b0ae0
Function at 0x3822b1240
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x3822b1306
push rbp
mov rbp, rsp
sub rsp, 0x30
movabs rdx, 0xd0357d3533301736
mov qword [rsp + 0x26], rdx
mov word [rsp + 0x2e], 0x717c
movabs rdx, 0x801010905010108
mov qword [rsp + 0x1c], rdx
mov word [rsp + 0x24], 0x701
xor eax, eax
jmp 0x3822b12a0
movzx r9d, byte [rsp + rsi + 0x26]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x53]
mov byte [rsp + rdi + 0x26], dl
mov byte [rsp + rsi + 0x26], r8b
add rax, 2
nop dword [rax]
cmp rax, 0xa
jge 0x3822b12d2
movzx edx, byte [rsp + rax + 0x1c]
movzx esi, byte [rsp + rax + 0x1d]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0xa
jae 0x3822b12f7
movzx r8d, byte [rsp + rdi + 0x26]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x53]
cmp rsi, 0xa
jb 0x3822b1282
jmp 0x3822b12eb
xor eax, eax
lea rbx, [rsp + 0x26]
mov ecx, 0xa
nop
call fcn.382294b80
add rsp, 0x30
pop rbp
ret
mov eax, esi
mov ecx, 0xa
call fcn.3822a6820
mov eax, edi
mov ecx, 0xa
nop
call fcn.3822a6820
nop
call fcn.3822a4520
jmp fcn.3822b1240

Function at 0x3822b25a0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x3822b268a
push rbp
mov rbp, rsp
sub rsp, 0x48
movabs rdx, 0x243033323532371a
mov qword [rsp + 0x34], rdx
movabs rdx, 0x1341a3924303332
mov qword [rsp + 0x38], rdx
movabs rdx, 0x92a280c302b192f
mov qword [rsp + 0x40], rdx
movabs rdx, 0x13000e1209130b00
mov qword [rsp + 0x1e], rdx
movabs rdx, 0x1307100c0d071300
mov qword [rsp + 0x24], rdx
movabs rdx, 0x50f090c1105090c
mov qword [rsp + 0x2c], rdx
xor eax, eax
jmp 0x3822b262d
movzx r9d, byte [rsp + rsi + 0x34]
sub r9d, edx
lea edx, [r9 + 0x27]
mov byte [rsp + rdi + 0x34], dl
lea edx, [r8 + 0x27]
mov byte [rsp + rsi + 0x34], dl
add rax, 2
cmp rax, 0x16
jge 0x3822b265a
movzx edx, byte [rsp + rax + 0x1e]
movzx esi, byte [rsp + rax + 0x1f]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x14
jae 0x3822b267d
movzx r8d, byte [rsp + rdi + 0x34]
sub r8d, edx
cmp rsi, 0x14
jb 0x3822b2610
jmp 0x3822b2671
xor eax, eax
lea rbx, [rsp + 0x34]
mov ecx, 0x14
call fcn.382294b80
add rsp, 0x48
pop rbp
ret
mov eax, esi
mov ecx, 0x14
call fcn.3822a6820
mov eax, edi
mov ecx, 0x14
call fcn.3822a6820
nop
call fcn.3822a4520
jmp fcn.3822b25a0
Function at 0x3822b6d80
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x3822b6ecc
push rbp
mov rbp, rsp
sub rsp, 0x70
movabs rdx, 0x7c36968c30663232
mov qword [rsp + 0x4b], rdx
movabs rdx, 0x443582396b7c3696
mov qword [rsp + 0x50], rdx
movabs rdx, 0x659784788a8c6b33
mov qword [rsp + 0x58], rdx
movabs rdx, 0x3d41cda033363237
mov qword [rsp + 0x60], rdx
movabs rdx, 0x6b42ff7b528a52fb
mov qword [rsp + 0x68], rdx
movabs rdx, 0x1b1e1d0f22050a12
mov qword [rsp + 0x19], rdx
movabs rdx, 0x1a0f1b1e1d0f2205
mov qword [rsp + 0x1b], rdx
movabs rdx, 0x1b0514210724221e
mov qword [rsp + 0x23], rdx
movabs rdx, 0xe1122140f051920
mov qword [rsp + 0x2b], rdx
movabs rdx, 0x1c21081008131f1b
mov qword [rsp + 0x33], rdx
movabs rdx, 0x40f1b2314040220
mov qword [rsp + 0x3b], rdx
movabs rdx, 0x240e200c14081a02
mov qword [rsp + 0x43], rdx
xor eax, eax
jmp 0x3822b6e64
movzx r9d, byte [rsp + rsi + 0x4b]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x6a]
mov byte [rsp + rdi + 0x4b], dl
mov byte [rsp + rsi + 0x4b], r8b
add rax, 2
cmp rax, 0x32
jge 0x3822b6e9c
movzx edx, byte [rsp + rax + 0x19]
movzx esi, byte [rsp + rax + 0x1a]
mov edi, edx
xor edx, esi
add edx, eax
nop word [rax + rax]
cmp rdi, 0x25
jae 0x3822b6ebf
movzx r8d, byte [rsp + rdi + 0x4b]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x6a]
cmp rsi, 0x25
jb 0x3822b6e4a
jmp 0x3822b6eb3
xor eax, eax
lea rbx, [rsp + 0x4b]
mov ecx, 0x25
call fcn.382294b80
add rsp, 0x70
pop rbp
ret
mov eax, esi
mov ecx, 0x25
call fcn.3822a6820
mov eax, edi
mov ecx, 0x25
call fcn.3822a6820
nop
call fcn.3822a4520
jmp fcn.3822b6d80

Function at 0x3822b75e0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x3822b7718
push rbp
mov rbp, rsp
sub rsp, 0x70
movabs rdx, 0x2333b4fe6633bda3
mov qword [rsp + 0x48], rdx
movabs rdx, 0xa0069b37ca04b3b9
mov qword [rsp + 0x50], rdx
movabs rdx, 0x5ea9b834b07f376b
mov qword [rsp + 0x58], rdx
movabs rdx, 0xc4ff99350a9b87bf
mov qword [rsp + 0x60], rdx
movabs rdx, 0xb3884033243936bb
mov qword [rsp + 0x68], rdx
movabs rdx, 0x2712121d031d121b
mov qword [rsp + 0x18], rdx
movabs rdx, 0x150f152319101e04
mov qword [rsp + 0x20], rdx
movabs rdx, 0x25001a1726170019
mov qword [rsp + 0x28], rdx
movabs rdx, 0x71605200d0a0e1e
mov qword [rsp + 0x30], rdx
movabs rdx, 0x1a1e08161309040d
mov qword [rsp + 0x38], rdx
movabs rdx, 0x1f1801260b261d
mov qword [rsp + 0x40], rdx
xor eax, eax
jmp 0x3822b76b8
movzx r9d, byte [rsp + rsi + 0x48]
sub r9d, edx
lea edx, [r9 - 0x41]
mov byte [rsp + rdi + 0x48], dl
lea edx, [r8 - 0x41]
mov byte [rsp + rsi + 0x48], dl
add rax, 2
cmp rax, 0x30
jge 0x3822b76e8
movzx edx, byte [rsp + rax + 0x18]
movzx esi, byte [rsp + rax + 0x19]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x28
jae 0x3822b770b
movzx r8d, byte [rsp + rdi + 0x48]
sub r8d, edx
nop dword [rax]
cmp rsi, 0x28
jb 0x3822b769b
jmp 0x3822b76ff
xor eax, eax
lea rbx, [rsp + 0x48]
mov ecx, 0x28
call fcn.382294b80
add rsp, 0x70
pop rbp
ret
mov eax, esi
mov ecx, 0x28
call fcn.3822a6820
mov eax, edi
mov ecx, 0x28
call fcn.3822a6820
nop
call fcn.3822a4520
nop dword [rax]
jmp fcn.3822b75e0
Function at 0x3822c2020
Capabilities:
Encrypt data using rc4 prga

Disassembly:
lea r12, [rsp - 0x10]
cmp r12, qword [r14 + 0x10]
jbe 0x3822c2192
push rbp
mov rbp, rsp
sub rsp, 0x88
movabs rdx, 0x758f55cd20745984
mov qword [rsp + 0x58], rdx
movabs rdx, 0xa6b1696a66206856
mov qword [rsp + 0x60], rdx
movabs rdx, 0x6220746a6a8f70ed
mov qword [rsp + 0x68], rdx
movabs rdx, 0xb74bb6150ad7487
mov qword [rsp + 0x70], rdx
movabs rdx, 0x72d2b188756d20d2
mov qword [rsp + 0x78], rdx
movabs rdx, 0x868479648cac4362
mov qword [rsp + 0x80], rdx
movabs rdx, 0x2508062d18080c2c
mov qword [rsp + 0x1e], rdx
movabs rdx, 0xf201f1b0d13110b
mov qword [rsp + 0x26], rdx
movabs rdx, 0x5140f201f1b0d13
mov qword [rsp + 0x28], rdx
movabs rdx, 0x2e1014132b102e2e
mov qword [rsp + 0x30], rdx
movabs rdx, 0x2d0801252d04261d
mov qword [rsp + 0x38], rdx
movabs rdx, 0x2427252408202f0f
mov qword [rsp + 0x40], rdx
movabs rdx, 0x202b1a2a252d2f1d
mov qword [rsp + 0x48], rdx
movabs rdx, 0x26290e2000122f29
mov qword [rsp + 0x50], rdx
xor eax, eax
jmp 0x3822c2130
movzx r9d, byte [rsp + rsi + 0x58]
sub r9d, edx
lea edx, [r9 + 0x25]
mov byte [rsp + rdi + 0x58], dl
lea edx, [r8 + 0x25]
mov byte [rsp + rsi + 0x58], dl
add rax, 2
cmp rax, 0x3a
jge 0x3822c215d
movzx edx, byte [rsp + rax + 0x1e]
movzx esi, byte [rsp + rax + 0x1f]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x30
jae 0x3822c2185
movzx r8d, byte [rsp + rdi + 0x58]
sub r8d, edx
cmp rsi, 0x30
jb 0x3822c2113
jmp 0x3822c2177
xor eax, eax
lea rbx, [rsp + 0x58]
mov ecx, 0x30
call fcn.382294b80
add rsp, 0x88
pop rbp
ret
mov eax, esi
mov ecx, 0x30
nop
call fcn.3822a6820
mov eax, edi
mov ecx, 0x30
call fcn.3822a6820
nop
call fcn.3822a4520
jmp fcn.3822c2020

Function at 0x3822c52a0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x3822c5358
push rbp
mov rbp, rsp
sub rsp, 0x30
movabs rdx, 0x6c3f3f0afdec341d
mov qword [rsp + 0x28], rdx
movabs rdx, 0x203000000040605
mov qword [rsp + 0x1e], rdx
mov word [rsp + 0x26], 0x201
xor eax, eax
jmp 0x3822c52f5
movzx r9d, byte [rsp + rsi + 0x28]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x2d]
mov byte [rsp + rdi + 0x28], dl
mov byte [rsp + rsi + 0x28], r8b
add rax, 2
cmp rax, 0xa
jge 0x3822c5328
movzx edx, byte [rsp + rax + 0x1e]
movzx esi, byte [rsp + rax + 0x1f]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 8
jae 0x3822c534b
movzx r8d, byte [rsp + rdi + 0x28]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x2d]
nop
cmp rsi, 8
jb 0x3822c52db
jmp 0x3822c533f
xor eax, eax
lea rbx, [rsp + 0x28]
mov ecx, 8
call fcn.382294b80
add rsp, 0x30
pop rbp
ret
mov eax, esi
mov ecx, 8
call fcn.3822a6820
mov eax, edi
mov ecx, 8
call fcn.3822a6820
nop
call fcn.3822a4520
nop dword [rax]
jmp fcn.3822c52a0
Function at 0x3822c6b60
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x3822c6c4c
push rbp
mov rbp, rsp
sub rsp, 0x40
movabs rdx, 0x7b617b6c6f6e7276
mov qword [rsp + 0x2d], rdx
movabs rdx, 0x62415f7b617b6c6f
mov qword [rsp + 0x30], rdx
movabs rdx, 0x6c6176677b897254
mov qword [rsp + 0x38], rdx
movabs rdx, 0xd05100f0e01000b
mov qword [rsp + 0x19], rdx
movabs rdx, 0x4030f0f0d05100f
mov qword [rsp + 0x1d], rdx
movabs rdx, 0x70b0d05010b0705
mov qword [rsp + 0x25], rdx
xor eax, eax
jmp 0x3822c6bea
movzx r9d, byte [rsp + rsi + 0x2d]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x1c]
mov byte [rsp + rdi + 0x2d], dl
mov byte [rsp + rsi + 0x2d], r8b
add rax, 2
cmp rax, 0x14
jge 0x3822c6c1c
movzx edx, byte [rsp + rax + 0x19]
movzx esi, byte [rsp + rax + 0x1a]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x13
jae 0x3822c6c3f
movzx r8d, byte [rsp + rdi + 0x2d]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x1c]
cmp rsi, 0x13
jb 0x3822c6bd0
jmp 0x3822c6c33
xor eax, eax
lea rbx, [rsp + 0x2d]
mov ecx, 0x13
call fcn.382294b80
add rsp, 0x40
pop rbp
ret
mov eax, esi
mov ecx, 0x13
call fcn.3822a6820
mov eax, edi
mov ecx, 0x13
call fcn.3822a6820
nop
call fcn.3822a4520
jmp fcn.3822c6b60

Function at 0x3822c74a0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x3822c7552
push rbp
mov rbp, rsp
sub rsp, 0x28
movabs rdx, 0xd0ca6ce0aacc39d0
mov qword [rsp + 0x20], rdx
movabs rdx, 0x402060700030401
mov qword [rsp + 0x18], rdx
xor eax, eax
jmp 0x3822c74ee
movzx r9d, byte [rsp + rsi + 0x20]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x6c]
mov byte [rsp + rdi + 0x20], dl
mov byte [rsp + rsi + 0x20], r8b
add rax, 2
cmp rax, 8
jge 0x3822c7522
movzx edx, byte [rsp + rax + 0x18]
movzx esi, byte [rsp + rax + 0x19]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 8
jae 0x3822c7545
movzx r8d, byte [rsp + rdi + 0x20]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x6c]
cmp rsi, 8
jb 0x3822c74d4
nop
jmp 0x3822c7539
xor eax, eax
lea rbx, [rsp + 0x20]
mov ecx, 8
call fcn.382294b80
add rsp, 0x28
pop rbp
ret
mov eax, esi
mov ecx, 8
call fcn.3822a6820
mov eax, edi
mov ecx, 8
call fcn.3822a6820
nop
call fcn.3822a4520
jmp fcn.3822c74a0