joyce8/EMBER2024-capa huggingface dataset:
Function at 0x44d7a0
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x44d859
sub rsp, 0x60
mov qword [rsp + 0x58], rbp
lea rbp, [rsp + 0x58]
mov qword [rsp + 0x70], rbx
mov qword [rsp + 8], 0
movups xmmword [rsp + 0x10], xmm15
movups xmmword [rsp + 0x18], xmm15
movups xmmword [rsp + 0x28], xmm15
movups xmmword [rsp + 0x38], xmm15
movups xmmword [rsp + 0x48], xmm15
lea rdx, [0x0044d8a0]
mov qword [rsp + 0x10], rdx
lea rdx, [rsp + 8]
mov qword [rsp + 0x18], rdx
mov rdx, qword [rsp + 0x60]
mov qword [rsp + 0x20], rdx
lea rdx, [rsp + 0x68]
mov qword [rsp + 0x28], rdx
mov rdx, r14
mov qword [rsp + 0x30], rdx
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x48], rcx
mov qword [rsp + 0x50], rdi
lea rax, [rsp + 0x10]
mov qword [rsp], rax
call fcn.004542c0
xorps xmm15, xmm15
mov r14, qword [0x0069a958]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 8]
mov rbp, qword [rsp + 0x58]
add rsp, 0x60
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
call fcn.00454400
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
jmp fcn.0044d7a0
Function at 0x4564a0
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4032af
sub rsp, 0x20
mov qword [rsp + 0x18], rbp
lea rbp, [rsp + 0x18]
mov rdx, qword [rax]
mov rcx, qword [rax + 8]
mov rax, rdx
nop
call fcn.00408980
mov rbp, qword [rsp + 0x18]
add rsp, 0x20
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.00454400
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp 0x403280
cmp byte [0x0069a790], 0
je 0x4564b5
mov rcx, qword [rax + 8]
mov rax, qword [rax]
jmp 0x453500
jmp 0x403280

Function at 0x4564c0
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
mov eax, dword [rax]
movabs rcx, 0xe7037ed1a0b428db
xor rcx, rax
xor rax, rbx
xor rax, qword [0x0069aa60]
movabs rdx, 0xa0761d6478bd642f
xor rdx, rax
mov rax, rcx
mul rdx
xor rax, rdx
mov rcx, rax
movabs rax, 0x1d8e4e27c47d124b
mul rcx
nop
nop
xor rax, rdx
ret
cmp byte [0x0069a790], 0
je 0x4564f5
movq xmm0, rbx
pinsrd xmm0, dword [rax], 2
aesenc xmm0, xmmword [0x0069ade0]
aesenc xmm0, xmmword [0x0069adf0]
aesenc xmm0, xmmword [0x0069ae00]
movq rax, xmm0
ret
jmp 0x408b80

Function at 0x456500
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
mov rax, qword [rax]
movabs rcx, 0xe7037ed1a0b428db
xor rcx, rax
xor rax, rbx
xor rax, qword [0x0069aa60]
movabs rdx, 0xa0761d6478bd642f
xor rdx, rax
mov rax, rcx
mul rdx
xor rax, rdx
mov rcx, rax
movabs rax, 0x1d8e4e27c47d1247
mul rcx
nop
nop
xor rax, rdx
ret
cmp byte [0x0069a790], 0
je 0x456536
movq xmm0, rbx
pinsrq xmm0, qword [rax], 1
aesenc xmm0, xmmword [0x0069ade0]
aesenc xmm0, xmmword [0x0069adf0]
aesenc xmm0, xmmword [0x0069ae00]
movq rax, xmm0
ret
jmp 0x408be0

Function at 0x457f40
Capabilities:
Write file on windows

Disassembly:
sub rsp, 0x30
mov rcx, 0xfffffffffffffff4
mov qword [rsp], rcx
mov rax, qword [sym.imp.kernel32.dll_GetStdHandle]
call rax
mov rcx, rax
mov qword [rsp], rcx
lea rdx, [0x0069ad60]
mov qword [rsp + 8], rdx
lea r8d, [0x0069a7a8]
mov qword [rsp + 0x10], r8
lea r9, [rsp + 0x28]
mov qword [r9], 0
mov qword [rsp + 0x18], r9
mov qword [rsp + 0x20], 0
mov rax, qword [sym.imp.kernel32.dll_WriteFile]
call rax
call fcn.004563e0
add rsp, 0x30
ret

Function at 0x458480
Capabilities:
Allocate thread local storage

Disassembly:
mov rax, rsp
and rsp, 0xfffffffffffffff0
sub rsp, 0x30
mov qword [rsp + 0x20], rax
mov rax, qword [sym.imp.kernel32.dll_TlsAlloc]
call rax
mov rsp, qword [rsp + 0x20]
mov rcx, rax
cmp rcx, 0x40
jb 0x4584b0
mov rcx, 0x28
jmp 0x4584bb
shl rcx, 3
add rcx, 0x1480
mov qword [0x0069a958], rcx
ret
Function at 0x4608a0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4609b6
sub rsp, 0x60
mov qword [rsp + 0x58], rbp
lea rbp, [rsp + 0x58]
movabs rdx, 0x6e36203a426e79ed
mov qword [rsp + 0x1a], rdx
movabs rdx, 0x6574a269eb25251e
mov qword [rsp + 0x22], rdx
movabs rdx, 0xd1f12f1a96e6574
mov qword [rsp + 0x28], rdx
movabs rdx, 0x99ce9d320282c27
mov qword [rsp + 0x30], rdx
movabs rdx, 0xd1d1c11030b1d11
mov qword [rsp + 0x38], rdx
movabs rdx, 0x121b0914160d171d
mov qword [rsp + 0x40], rdx
movabs rdx, 0x171b0a1915080600
mov qword [rsp + 0x48], rdx
movabs rdx, 0x1a12111803130606
mov qword [rsp + 0x50], rdx
xor eax, eax
jmp 0x46094e
movzx r9d, byte [rsp + rsi + 0x1a]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x27]
mov byte [rsp + rdi + 0x1a], dl
mov byte [rsp + rsi + 0x1a], r8b
add rax, 2
cmp rax, 0x20
jge 0x460982
movzx edx, byte [rsp + rax + 0x38]
movzx esi, byte [rsp + rax + 0x39]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x1e
jae 0x4609a9
movzx r8d, byte [rsp + rdi + 0x1a]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x27]
cmp rsi, 0x1e
jb 0x460934
nop
jmp 0x46099d
xor eax, eax
lea rbx, [rsp + 0x1a]
mov ecx, 0x1e
call fcn.00444360
mov rbp, qword [rsp + 0x58]
add rsp, 0x60
ret
mov eax, esi
mov ecx, 0x1e
call fcn.00456a60
mov eax, edi
mov ecx, 0x1e
call fcn.00456a60
nop
call fcn.00454400
nop dword [rax + rax]
jmp fcn.004608a0

Function at 0x4613e0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4614e8
sub rsp, 0x50
mov qword [rsp + 0x48], rbp
lea rbp, [rsp + 0x48]
movabs rdx, 0xed1e296ca476f82e
mov qword [rsp + 0x18], rdx
movabs rdx, 0x1a690ce6ed1e296c
mov qword [rsp + 0x1c], rdx
movabs rdx, 0x22bde26572399f
mov qword [rsp + 0x24], rdx
movabs rdx, 0x30908070d011311
mov qword [rsp + 0x2c], rdx
movabs rdx, 0x81113000c030313
mov qword [rsp + 0x34], rdx
movabs rdx, 0xb12100008111300
mov qword [rsp + 0x38], rdx
movabs rdx, 0xd09100603070005
mov qword [rsp + 0x40], rdx
xor eax, eax
jmp 0x461480
movzx r9d, byte [rsp + rsi + 0x18]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x27]
mov byte [rsp + rdi + 0x18], dl
mov byte [rsp + rsi + 0x18], r8b
add rax, 2
nop
cmp rax, 0x1c
jge 0x4614b2
movzx edx, byte [rsp + rax + 0x2c]
movzx esi, byte [rsp + rax + 0x2d]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x14
jae 0x4614db
movzx r8d, byte [rsp + rdi + 0x18]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x27]
cmp rsi, 0x14
jb 0x461465
jmp 0x4614cf
xor eax, eax
lea rbx, [rsp + 0x18]
mov ecx, 0x14
nop
call fcn.00444360
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
mov eax, esi
mov ecx, 0x14
call fcn.00456a60
mov eax, edi
mov ecx, 0x14
call fcn.00456a60
nop
call fcn.00454400
jmp fcn.004613e0
Function at 0x461780
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x46186b
sub rsp, 0x48
mov qword [rsp + 0x40], rbp
lea rbp, [rsp + 0x40]
movabs rdx, 0x39563e7078f14e75
mov qword [rsp + 0x1e], rdx
movabs rdx, 0x4a2645d959433956
mov qword [rsp + 0x24], rdx
movabs rdx, 0x7060c07020d0a02
mov qword [rsp + 0x2c], rdx
movabs rdx, 0x5010d0a07060c07
mov qword [rsp + 0x30], rdx
movabs rdx, 0x201080d080d0609
mov qword [rsp + 0x38], rdx
xor eax, eax
jmp 0x461804
movzx r9d, byte [rsp + rsi + 0x1e]
sub r9d, edx
lea edx, [r9 + 0x25]
mov byte [rsp + rdi + 0x1e], dl
lea edx, [r8 + 0x25]
mov byte [rsp + rsi + 0x1e], dl
add rax, 2
cmp rax, 0x14
jge 0x461837
movzx edx, byte [rsp + rax + 0x2c]
movzx esi, byte [rsp + rax + 0x2d]
mov edi, edx
xor edx, esi
add edx, eax
nop word [rax + rax]
cmp rdi, 0xe
jae 0x46185e
movzx r8d, byte [rsp + rdi + 0x1e]
sub r8d, edx
cmp rsi, 0xe
jb 0x4617e7
jmp 0x461852
xor eax, eax
lea rbx, [rsp + 0x1e]
mov ecx, 0xe
call fcn.00444360
mov rbp, qword [rsp + 0x40]
add rsp, 0x48
ret
mov eax, esi
mov ecx, 0xe
call fcn.00456a60
mov eax, edi
mov ecx, 0xe
call fcn.00456a60
nop
call fcn.00454400
jmp fcn.00461780

Function at 0x463f40
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x464008
sub rsp, 0x38
mov qword [rsp + 0x30], rbp
lea rbp, [rsp + 0x30]
movabs rdx, 0x40610e0c186dd641
mov qword [rsp + 0x1e], rdx
movabs rdx, 0x705040705010305
mov qword [rsp + 0x26], rdx
mov word [rsp + 0x2e], 0x307
xor eax, eax
nop
jmp 0x463fa0
movzx r9d, byte [rsp + rsi + 0x1e]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x27]
mov byte [rsp + rdi + 0x1e], dl
mov byte [rsp + rsi + 0x1e], r8b
add rax, 2
nop dword [rax]
cmp rax, 0xa
jge 0x463fd2
movzx edx, byte [rsp + rax + 0x26]
movzx esi, byte [rsp + rax + 0x27]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 8
jae 0x463ffb
movzx r8d, byte [rsp + rdi + 0x1e]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x27]
cmp rsi, 8
jb 0x463f82
jmp 0x463fef
xor eax, eax
lea rbx, [rsp + 0x1e]
mov ecx, 8
nop
call fcn.00444360
mov rbp, qword [rsp + 0x30]
add rsp, 0x38
ret
mov eax, esi
mov ecx, 8
call fcn.00456a60
mov eax, edi
mov ecx, 8
call fcn.00456a60
nop
call fcn.00454400
jmp fcn.00463f40
Function at 0x464160
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x464228
sub rsp, 0x38
mov qword [rsp + 0x30], rbp
lea rbp, [rsp + 0x30]
movabs rdx, 0x79635f5e67465177
mov qword [rsp + 0x1d], rdx
mov byte [rsp + 0x25], 0x5a
movabs rdx, 0x406020007080307
mov qword [rsp + 0x26], rdx
mov word [rsp + 0x2e], 0x601
xor eax, eax
jmp 0x4641c0
movzx r9d, byte [rsp + rsi + 0x1d]
lea edx, [r9 + rdx]
lea edx, [rdx - 0xa]
mov byte [rsp + rdi + 0x1d], dl
mov byte [rsp + rsi + 0x1d], r8b
add rax, 2
cmp rax, 0xa
jge 0x4641f2
movzx edx, byte [rsp + rax + 0x26]
movzx esi, byte [rsp + rax + 0x27]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 9
jae 0x46421b
movzx r8d, byte [rsp + rdi + 0x1d]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0xa]
cmp rsi, 9
jb 0x4641a6
jmp 0x46420f
xor eax, eax
lea rbx, [rsp + 0x1d]
mov ecx, 9
nop
call fcn.00444360
mov rbp, qword [rsp + 0x30]
add rsp, 0x38
ret
mov eax, esi
mov ecx, 9
call fcn.00456a60
mov eax, edi
mov ecx, 9
call fcn.00456a60
nop
call fcn.00454400
jmp fcn.00464160

Function at 0x465880
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x465946
sub rsp, 0x38
mov qword [rsp + 0x30], rbp
lea rbp, [rsp + 0x30]
movabs rdx, 0x6e1c4941e7e1dfcb
mov qword [rsp + 0x1c], rdx
movabs rdx, 0x101050304050006
mov qword [rsp + 0x24], rdx
mov dword [rsp + 0x2c], 0x204
xor eax, eax
jmp 0x4658e0
movzx r9d, byte [rsp + rsi + 0x1c]
sub r9d, edx
lea edx, [r9 - 0x64]
mov byte [rsp + rdi + 0x1c], dl
lea edx, [r8 - 0x64]
mov byte [rsp + rsi + 0x1c], dl
add rax, 2
nop
cmp rax, 0xc
jge 0x46590d
movzx edx, byte [rsp + rax + 0x24]
movzx esi, byte [rsp + rax + 0x25]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 8
jae 0x465934
movzx r8d, byte [rsp + rdi + 0x1c]
sub r8d, edx
cmp rsi, 8
jb 0x4658c2
jmp 0x465928
xor eax, eax
lea rbx, [rsp + 0x1c]
mov ecx, 8
call fcn.00444360
mov rbp, qword [rsp + 0x30]
add rsp, 0x38
ret
mov eax, esi
mov ecx, 8
call fcn.00456a60
mov eax, edi
mov ecx, 8
nop dword [rax + rax]
call fcn.00456a60
nop
call fcn.00454400
jmp fcn.00465880

Function at 0x467a00
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x467ac8
sub rsp, 0x38
mov qword [rsp + 0x30], rbp
lea rbp, [rsp + 0x30]
movabs rdx, 0x641b7719a4b18e09
mov qword [rsp + 0x1d], rdx
mov byte [rsp + 0x25], 0x13
movabs rdx, 0x3010404020103
mov qword [rsp + 0x26], rdx
mov word [rsp + 0x2e], 0x806
xor eax, eax
jmp 0x467a63
movzx r9d, byte [rsp + rsi + 0x1d]
sub r9d, edx
lea edx, [r9 + 0x64]
mov byte [rsp + rdi + 0x1d], dl
lea edx, [r8 + 0x64]
mov byte [rsp + rsi + 0x1d], dl
add rax, 2
cmp rax, 0xa
jge 0x467a90
movzx edx, byte [rsp + rax + 0x26]
movzx esi, byte [rsp + rax + 0x27]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 9
jae 0x467abb
movzx r8d, byte [rsp + rdi + 0x1d]
sub r8d, edx
cmp rsi, 9
jb 0x467a46
jmp 0x467aaf
xor eax, eax
lea rbx, [rsp + 0x1d]
mov ecx, 9
nop dword [rax]
call fcn.00444360
mov rbp, qword [rsp + 0x30]
add rsp, 0x38
ret
mov eax, esi
mov ecx, 9
call fcn.00456a60
mov eax, edi
mov ecx, 9
call fcn.00456a60
nop
call fcn.00454400
jmp fcn.00467a00
Function at 0x46a100
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x46a1cb
sub rsp, 0x38
mov qword [rsp + 0x30], rbp
lea rbp, [rsp + 0x30]
movabs rdx, 0x6c6174edd77ee0ee
mov qword [rsp + 0x26], rdx
mov word [rsp + 0x2e], 0x6c69
movabs rdx, 0x409040201000301
mov qword [rsp + 0x1c], rdx
mov word [rsp + 0x24], 4
xor eax, eax
jmp 0x46a165
movzx r9d, byte [rsp + rsi + 0x26]
sub r9d, edx
lea edx, [r9 - 0x7f]
mov byte [rsp + rdi + 0x26], dl
lea edx, [r8 - 0x7f]
mov byte [rsp + rsi + 0x26], dl
add rax, 2
cmp rax, 0xa
jge 0x46a197
movzx edx, byte [rsp + rax + 0x1c]
movzx esi, byte [rsp + rax + 0x1d]
mov edi, edx
xor edx, esi
add edx, eax
nop dword [rax + rax]
cmp rdi, 0xa
jae 0x46a1be
movzx r8d, byte [rsp + rdi + 0x26]
sub r8d, edx
cmp rsi, 0xa
jb 0x46a148
jmp 0x46a1b2
xor eax, eax
lea rbx, [rsp + 0x26]
mov ecx, 0xa
call fcn.00444360
mov rbp, qword [rsp + 0x30]
add rsp, 0x38
ret
mov eax, esi
mov ecx, 0xa
call fcn.00456a60
mov eax, edi
mov ecx, 0xa
call fcn.00456a60
nop
call fcn.00454400
jmp fcn.0046a100

Function at 0x46b500
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x46b5d2
sub rsp, 0x38
mov qword [rsp + 0x30], rbp
lea rbp, [rsp + 0x30]
movabs rdx, 0x412f5b61722e6168
mov qword [rsp + 0x18], rdx
mov word [rsp + 0x20], 0x4972
movabs rdx, 0x605000709060205
mov qword [rsp + 0x22], rdx
movabs rdx, 0x600090002050605
mov qword [rsp + 0x28], rdx
xor eax, eax
jmp 0x46b56a
movzx r9d, byte [rsp + rsi + 0x18]
lea edx, [r9 + rdx]
lea edx, [rdx + 1]
mov byte [rsp + rdi + 0x18], dl
mov byte [rsp + rsi + 0x18], r8b
add rax, 2
cmp rax, 0xe
jge 0x46b59c
movzx edx, byte [rsp + rax + 0x22]
movzx esi, byte [rsp + rax + 0x23]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0xa
jae 0x46b5c5
movzx r8d, byte [rsp + rdi + 0x18]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 1]
cmp rsi, 0xa
jb 0x46b550
jmp 0x46b5b7
xor eax, eax
lea rbx, [rsp + 0x18]
mov ecx, 0xa
call fcn.00444360
mov rbp, qword [rsp + 0x30]
add rsp, 0x38
ret
mov eax, esi
mov ecx, 0xa
nop
call fcn.00456a60
mov eax, edi
mov ecx, 0xa
call fcn.00456a60
nop
call fcn.00454400
jmp fcn.0046b500
Function at 0x46bb60
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x46bc32
sub rsp, 0x40
mov qword [rsp + 0x38], rbp
lea rbp, [rsp + 0x38]
movabs rdx, 0x9a0a7f116f947995
mov qword [rsp + 0x1c], rdx
mov dword [rsp + 0x24], 0xc1a967a3
movabs rdx, 0x602080404040604
mov qword [rsp + 0x28], rdx
movabs rdx, 0x5000702020a000b
mov qword [rsp + 0x30], rdx
xor eax, eax
jmp 0x46bbcb
movzx r9d, byte [rsp + rsi + 0x1c]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x3f]
mov byte [rsp + rdi + 0x1c], dl
mov byte [rsp + rsi + 0x1c], r8b
add rax, 2
cmp rax, 0x10
jge 0x46bbfd
movzx edx, byte [rsp + rax + 0x28]
movzx esi, byte [rsp + rax + 0x29]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0xc
jae 0x46bc25
movzx r8d, byte [rsp + rdi + 0x1c]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x3f]
cmp rsi, 0xc
jb 0x46bbb1
jmp 0x46bc18
xor eax, eax
lea rbx, [rsp + 0x1c]
mov ecx, 0xc
call fcn.00444360
mov rbp, qword [rsp + 0x38]
add rsp, 0x40
ret
mov eax, esi
mov ecx, 0xc
nop
call fcn.00456a60
mov eax, edi
mov ecx, 0xc
call fcn.00456a60
nop
call fcn.00454400
jmp fcn.0046bb60

Function at 0x46d600
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x46d708
sub rsp, 0x58
mov qword [rsp + 0x50], rbp
lea rbp, [rsp + 0x50]
movabs rdx, 0x245661e36967e3d9
mov qword [rsp + 0x1b], rdx
movabs rdx, 0xda5f4eced9f9eb24
mov qword [rsp + 0x22], rdx
movabs rdx, 0xf830da55e1de5f4d
mov qword [rsp + 0x2a], rdx
movabs rdx, 0x6120f061307000c
mov qword [rsp + 0x32], rdx
movabs rdx, 0x11070f1610131504
mov qword [rsp + 0x3a], rdx
movabs rdx, 0x10010e0409131107
mov qword [rsp + 0x40], rdx
movabs rdx, 0xb000a0a08011414
mov qword [rsp + 0x48], rdx
xor eax, eax
jmp 0x46d6a2
movzx r9d, byte [rsp + rsi + 0x1b]
sub r9d, edx
lea edx, [r9 - 0x5b]
mov byte [rsp + rdi + 0x1b], dl
lea edx, [r8 - 0x5b]
mov byte [rsp + rsi + 0x1b], dl
add rax, 2
cmp rax, 0x1e
jge 0x46d6cf
movzx edx, byte [rsp + rax + 0x32]
movzx esi, byte [rsp + rax + 0x33]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x17
jae 0x46d6fb
movzx r8d, byte [rsp + rdi + 0x1b]
sub r8d, edx
cmp rsi, 0x17
jb 0x46d685
jmp 0x46d6ef
xor eax, eax
lea rbx, [rsp + 0x1b]
mov ecx, 0x17
nop dword [rax + rax]
call fcn.00444360
mov rbp, qword [rsp + 0x50]
add rsp, 0x58
ret
mov eax, esi
mov ecx, 0x17
call fcn.00456a60
mov eax, edi
mov ecx, 0x17
call fcn.00456a60
nop
call fcn.00454400
jmp fcn.0046d600
Function at 0x46e060
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x46e148
sub rsp, 0x40
mov qword [rsp + 0x38], rbp
lea rbp, [rsp + 0x38]
movabs rdx, 0x8c495f84da86d7a1
mov qword [rsp + 0x18], rdx
movabs rdx, 0xcc89d174a8978c49
mov qword [rsp + 0x1e], rdx
movabs rdx, 0xc090b0003030101
mov qword [rsp + 0x26], rdx
movabs rdx, 0x2000c090b000303
mov qword [rsp + 0x28], rdx
movabs rdx, 0x40801030d03070b
mov qword [rsp + 0x30], rdx
xor eax, eax
jmp 0x46e0e1
movzx r9d, byte [rsp + rsi + 0x18]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x41]
mov byte [rsp + rdi + 0x18], dl
mov byte [rsp + rsi + 0x18], r8b
add rax, 2
cmp rax, 0x12
jge 0x46e113
movzx edx, byte [rsp + rax + 0x26]
movzx esi, byte [rsp + rax + 0x27]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0xe
jae 0x46e13b
movzx r8d, byte [rsp + rdi + 0x18]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x41]
cmp rsi, 0xe
jb 0x46e0c7
jmp 0x46e12f
xor eax, eax
lea rbx, [rsp + 0x18]
mov ecx, 0xe
nop
call fcn.00444360
mov rbp, qword [rsp + 0x38]
add rsp, 0x40
ret
mov eax, esi
mov ecx, 0xe
call fcn.00456a60
mov eax, edi
mov ecx, 0xe
call fcn.00456a60
nop
call fcn.00454400
jmp fcn.0046e060

Function at 0x46e160
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x46e248
sub rsp, 0x48
mov qword [rsp + 0x40], rbp
lea rbp, [rsp + 0x40]
movabs rdx, 0x6f4cccf2afaab30b
mov qword [rsp + 0x1d], rdx
movabs rdx, 0x6521b2bf72a4be6f
mov qword [rsp + 0x24], rdx
movabs rdx, 0x8080503020b0d01
mov qword [rsp + 0x2c], rdx
movabs rdx, 0x9080308080503
mov qword [rsp + 0x30], rdx
movabs rdx, 0x40c000b05020d
mov qword [rsp + 0x38], rdx
xor eax, eax
jmp 0x46e1e1
movzx r9d, byte [rsp + rsi + 0x1d]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x47]
mov byte [rsp + rdi + 0x1d], dl
mov byte [rsp + rsi + 0x1d], r8b
add rax, 2
cmp rax, 0x14
jge 0x46e213
movzx edx, byte [rsp + rax + 0x2c]
movzx esi, byte [rsp + rax + 0x2d]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0xf
jae 0x46e23b
movzx r8d, byte [rsp + rdi + 0x1d]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x47]
cmp rsi, 0xf
jb 0x46e1c7
jmp 0x46e22f
xor eax, eax
lea rbx, [rsp + 0x1d]
mov ecx, 0xf
nop
call fcn.00444360
mov rbp, qword [rsp + 0x40]
add rsp, 0x48
ret
mov eax, esi
mov ecx, 0xf
call fcn.00456a60
mov eax, edi
mov ecx, 0xf
call fcn.00456a60
nop
call fcn.00454400
jmp fcn.0046e160
Function at 0x46e6c0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x46e7ab
sub rsp, 0x48
mov qword [rsp + 0x40], rbp
lea rbp, [rsp + 0x40]
movabs rdx, 0x493a4865587445da
mov qword [rsp + 0x1e], rdx
movabs rdx, 0xfc1574d82f53493a
mov qword [rsp + 0x24], rdx
movabs rdx, 0x30d000101000a01
mov qword [rsp + 0x2c], rdx
movabs rdx, 0x90c00030d0001
mov qword [rsp + 0x30], rdx
movabs rdx, 0x50c090c07060903
mov qword [rsp + 0x38], rdx
xor eax, eax
jmp 0x46e744
movzx r9d, byte [rsp + rsi + 0x1e]
sub r9d, edx
lea edx, [r9 + 0x34]
mov byte [rsp + rdi + 0x1e], dl
lea edx, [r8 + 0x34]
mov byte [rsp + rsi + 0x1e], dl
add rax, 2
cmp rax, 0x14
jge 0x46e777
movzx edx, byte [rsp + rax + 0x2c]
movzx esi, byte [rsp + rax + 0x2d]
mov edi, edx
xor edx, esi
add edx, eax
nop word [rax + rax]
cmp rdi, 0xe
jae 0x46e79e
movzx r8d, byte [rsp + rdi + 0x1e]
sub r8d, edx
cmp rsi, 0xe
jb 0x46e727
jmp 0x46e792
xor eax, eax
lea rbx, [rsp + 0x1e]
mov ecx, 0xe
call fcn.00444360
mov rbp, qword [rsp + 0x40]
add rsp, 0x48
ret
mov eax, esi
mov ecx, 0xe
call fcn.00456a60
mov eax, edi
mov ecx, 0xe
call fcn.00456a60
nop
call fcn.00454400
jmp fcn.0046e6c0

Function at 0x46e7c0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x46e8c8
sub rsp, 0x50
mov qword [rsp + 0x48], rbp
lea rbp, [rsp + 0x48]
movabs rdx, 0x586e385640d7ed50
mov qword [rsp + 0x19], rdx
movabs rdx, 0x3f6857586e385640
mov qword [rsp + 0x1c], rdx
movabs rdx, 0xb3e3d8d649d3b6b4
mov qword [rsp + 0x24], rdx
movabs rdx, 0xe0c05050a0b0312
mov qword [rsp + 0x2c], rdx
movabs rdx, 0x11040704030b0a0d
mov qword [rsp + 0x34], rdx
movabs rdx, 0xd11050c11040704
mov qword [rsp + 0x38], rdx
movabs rdx, 0xd0f070212100b01
mov qword [rsp + 0x40], rdx
xor eax, eax
jmp 0x46e862
movzx r9d, byte [rsp + rsi + 0x19]
sub r9d, edx
lea edx, [r9 - 0x5b]
mov byte [rsp + rdi + 0x19], dl
lea edx, [r8 - 0x5b]
mov byte [rsp + rsi + 0x19], dl
add rax, 2
cmp rax, 0x1c
jge 0x46e88f
movzx edx, byte [rsp + rax + 0x2c]
movzx esi, byte [rsp + rax + 0x2d]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x13
jae 0x46e8bb
movzx r8d, byte [rsp + rdi + 0x19]
sub r8d, edx
cmp rsi, 0x13
jb 0x46e845
jmp 0x46e8af
xor eax, eax
lea rbx, [rsp + 0x19]
mov ecx, 0x13
nop dword [rax + rax]
call fcn.00444360
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
mov eax, esi
mov ecx, 0x13
call fcn.00456a60
mov eax, edi
mov ecx, 0x13
call fcn.00456a60
nop
call fcn.00454400
jmp fcn.0046e7c0
Function at 0x46fb80
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x46fc88
sub rsp, 0x50
mov qword [rsp + 0x48], rbp
lea rbp, [rsp + 0x48]
movabs rdx, 0x1d35115b69535956
mov qword [rsp + 0x1c], rdx
movabs rdx, 0x500c1d35115b6953
mov qword [rsp + 0x1e], rdx
movabs rdx, 0x512d745e65382e53
mov qword [rsp + 0x26], rdx
movabs rdx, 0x71110090605060c
mov qword [rsp + 0x2e], rdx
movabs rdx, 0x90e060e050b0e08
mov qword [rsp + 0x36], rdx
movabs rdx, 0x602090e060e050b
mov qword [rsp + 0x38], rdx
movabs rdx, 0x909040501020c11
mov qword [rsp + 0x40], rdx
xor eax, eax
jmp 0x46fc20
movzx r9d, byte [rsp + rsi + 0x1c]
lea edx, [r9 + rdx]
lea edx, [rdx + 2]
mov byte [rsp + rdi + 0x1c], dl
mov byte [rsp + rsi + 0x1c], r8b
add rax, 2
nop
cmp rax, 0x1a
jge 0x46fc52
movzx edx, byte [rsp + rax + 0x2e]
movzx esi, byte [rsp + rax + 0x2f]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x12
jae 0x46fc7b
movzx r8d, byte [rsp + rdi + 0x1c]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 2]
cmp rsi, 0x12
jb 0x46fc05
jmp 0x46fc6f
xor eax, eax
lea rbx, [rsp + 0x1c]
mov ecx, 0x12
nop
call fcn.00444360
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
mov eax, esi
mov ecx, 0x12
call fcn.00456a60
mov eax, edi
mov ecx, 0x12
call fcn.00456a60
nop
call fcn.00454400
jmp fcn.0046fb80

Function at 0x474080
Capabilities:
Encrypt data using rc4 prga

Disassembly:
lea r12, [rsp - 0x20]
cmp r12, qword [r14 + 0x10]
jbe 0x474232
sub rsp, 0xa0
mov qword [rsp + 0x98], rbp
lea rbp, [rsp + 0x98]
movabs rdx, 0x89702be4da1be2d2
mov qword [rsp + 0x1a], rdx
movabs rdx, 0xd30f72b4976f8970
mov qword [rsp + 0x20], rdx
movabs rdx, 0x72aa6de099ffa851
mov qword [rsp + 0x28], rdx
movabs rdx, 0x2064fb6e0f751065
mov qword [rsp + 0x30], rdx
movabs rdx, 0xc4a677775967c435
mov qword [rsp + 0x38], rdx
movabs rdx, 0x7c20749e0f7c6320
mov qword [rsp + 0x40], rdx
movabs rdx, 0xde611952208b6f72
mov qword [rsp + 0x48], rdx
movabs rdx, 0x7230a0533112917
mov qword [rsp + 0x50], rdx
movabs rdx, 0x242d031404070505
mov qword [rsp + 0x58], rdx
movabs rdx, 0x509281909141e30
mov qword [rsp + 0x60], rdx
movabs rdx, 0x200230621190c24
mov qword [rsp + 0x68], rdx
movabs rdx, 0x322010c1e281328
mov qword [rsp + 0x70], rdx
movabs rdx, 0xd05032d0e332208
mov qword [rsp + 0x78], rdx
movabs rdx, 0xf141b1035300702
mov qword [rsp + 0x80], rdx
movabs rdx, 0x35220823052a1304
mov qword [rsp + 0x88], rdx
movabs rdx, 0x2a12301219331f25
mov qword [rsp + 0x90], rdx
xor eax, eax
jmp 0x4741c0
movzx r9d, byte [rsp + rsi + 0x1a]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x27]
mov byte [rsp + rdi + 0x1a], dl
mov byte [rsp + rsi + 0x1a], r8b
add rax, 2
nop dword [rax]
cmp rax, 0x48
jge 0x4741f2
movzx edx, byte [rsp + rax + 0x50]
movzx esi, byte [rsp + rax + 0x51]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x36
jae 0x474225
movzx r8d, byte [rsp + rdi + 0x1a]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x27]
cmp rsi, 0x36
jb 0x4741a3
jmp 0x474215
xor eax, eax
lea rbx, [rsp + 0x1a]
mov ecx, 0x36
nop
call fcn.00444360
mov rbp, qword [rsp + 0x98]
add rsp, 0xa0
ret
mov eax, esi
mov ecx, 0x36
nop dword [rax]
call fcn.00456a60
mov eax, edi
mov ecx, 0x36
call fcn.00456a60
nop
call fcn.00454400
jmp fcn.00474080