joyce8/EMBER2024-capa huggingface dataset:
Function at 0x43a3a0
Capabilities:
Encode data using base64

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x43a507
push rbp
mov rbp, rsp
sub rsp, 0x18
mov ecx, dword [rax + 0x190]
mov edx, dword [rax + 0x194]
mov rsi, qword [rax + 0x998]
mov edi, dword [rax + 0x194]
cmp edi, edx
jne 0x43a3b2
cmp edx, ecx
jne 0x43a4f5
nop word [rax + rax]
test rsi, rsi
jne 0x43a4f5
mov qword [rsp + 0x28], rax
test rbx, rbx
jne 0x43a414
nop
call fcn.00453700
xorps xmm15, xmm15
mov r14, qword [0x007abb98]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rbx, qword [rsp]
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0x10], rbx
call fcn.0043a2c0
mov rcx, qword [rsp + 0x28]
mov edx, dword [rcx]
mov ebx, edx
sar edx, 0x1f
shr edx, 0x1b
add edx, ebx
mov esi, edx
and edx, 0xffffffe0
sub ebx, edx
test ebx, ebx
jl 0x43a4f0
mov rdx, qword [0x00726688]
sar esi, 5
mov rax, rcx
mov ecx, ebx
mov edi, 1
shl edi, cl
movsxd rsi, esi
cmp ecx, 0x20
sbb r8d, r8d
and edi, r8d
cmp rdx, rsi
jbe 0x43a4e5
mov rcx, qword [0x00726680]
lea rcx, [rcx + rsi*4]
lock or dword [rcx], edi
mov rcx, qword [0x00727fb0]
mov qword [rax + 8], rcx
mov rcx, rax
nop
mov qword [0x00727fb0], rax
nop
mov edx, 1
lea rsi, [0x00727fb8]
lock xadd dword [rsi], edx
mov rdx, qword [rcx + 0x1248]
shr rdx, 0x3d
test dl, dl
jne 0x43a4d3
mov rax, qword [rsp + 0x10]
movabs rdx, 0x1fffffffffffffff
and rdx, rax
bts rdx, 0x3f
nop
nop
xchg qword [rcx + 0x1248], rdx
add rsp, 0x18
pop rbp
ret
lea rax, [0x00523d95]
mov ebx, 0x28
nop
call fcn.0042c9a0
mov rax, rsi
mov rcx, rdx
call fcn.00451e00
call fcn.0042ba20
lea rax, [0x0052344a]
mov ebx, 0x23
call fcn.0042c9a0
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.0044fb80
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.0043a3a0
Function at 0x43d760
Capabilities:
Access peb ldr_data

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x70
mov rcx, r14
test rcx, rcx
je 0x43d7a8
mov rcx, qword [rcx + 0x30]
mov rcx, qword [rcx + 0x90]
nop dword [rax + rax]
test rcx, rcx
je 0x43d7a8
mov qword [rsp + 0x68], rcx
nop
mov rax, qword [rdi + 0x28]
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x58], 0
mov qword [rsp + 0x50], 0
jmp 0x43d7b8
mov eax, 1
add rsp, 0x70
pop rbp
ret
mov rax, qword [rsp + 0x60]
mov rcx, qword [sym.imp.kernel32.dll_RtlLookupFunctionEntry]
lea rdx, [rsp + 0x58]
mov rbx, qword [rax + 0xf8]
mov qword [rsp], rcx
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], 0
call fcn.0042a880
xorps xmm15, xmm15
mov r14, qword [0x007abb98]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x20]
nop
test rax, rax
je 0x43d891
mov rcx, qword [rsp + 0x58]
mov rdx, qword [sym.imp.kernel32.dll_RtlVirtualUnwind]
mov rbx, qword [rsp + 0x60]
mov rsi, rbx
lea rdi, [rsp + 0x50]
mov r8, qword [rsi + 0xf8]
mov qword [rsp], rdx
mov qword [rsp + 8], 0
mov qword [rsp + 0x10], rcx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x40], 0
call fcn.0042ab00
xorps xmm15, xmm15
mov r14, qword [0x007abb98]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x68]
cmp qword [rcx], rax
ja 0x43d891
cmp qword [rcx + 8], rax
ja 0x43d7b3
mov eax, 1
add rsp, 0x70
pop rbp
ret
Function at 0x4430e0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x10
mov qword [rsp + 0x20], rax
test rbx, rbx
jbe 0x443257
movzx edx, byte [rax]
test edx, edx
jne 0x443114
nop dword [rax]
test r8b, r8b
jne 0x443114
xor eax, eax
xor ebx, ebx
mov rcx, rbx
xor edi, edi
add rsp, 0x10
pop rbp
ret
bt edx, 7
jae 0x443127
xor edx, edx
xor r8d, r8d
xor r9d, r9d
jmp 0x443217
mov r8d, 1
mov r9d, edx
and edx, 1
neg edx
shr r9d, 1
xor edx, r9d
add dword [rsi], edx
nop dword [rax]
cmp rbx, r8
jb 0x443205
sub rbx, r8
sub rcx, r8
mov rdx, rcx
neg rdx
sar rdx, 0x3f
and r8, rdx
lea rdx, [rax + r8]
test rbx, rbx
jbe 0x4431f7
movzx esi, byte [rax + r8]
bt esi, 7
jae 0x44317d
xor eax, eax
xor esi, esi
xor r8d, r8d
jmp 0x4431c0
mov eax, 1
cmp rax, rbx
ja 0x4431ab
add qword [rdi], rsi
sub rcx, rax
sub rbx, rax
mov rsi, rcx
neg rsi
sar rsi, 0x3f
and rax, rsi
add rax, rdx
mov edi, 1
add rsp, 0x10
pop rbp
ret
mov rcx, rbx
call fcn.00451ec0
lea r8d, [rcx + 7]
mov rcx, r11
mov eax, r12d
nop dword [rax]
cmp rax, rbx
jae 0x4431ef
movzx r9d, byte [rax + rdx]
mov r10d, r9d
and r9d, 0x7f
mov r11, rcx
mov ecx, r8d
shl r9d, cl
lea r12d, [rax + 1]
or esi, r9d
test r10b, 0x80
jne 0x4431b3
mov rcx, r11
mov eax, r12d
jmp 0x443182
mov rcx, rbx
call fcn.00451e00
xor eax, eax
mov rcx, rax
nop dword [rax]
call fcn.00451e00
mov eax, r8d
mov rcx, rbx
call fcn.00451ec0
lea r9d, [rcx + 7]
mov rcx, r12
cmp rbx, rdx
jbe 0x44324d
movzx r10d, byte [rdx + rax]
mov r11d, r10d
and r10d, 0x7f
mov r12, rcx
mov ecx, r9d
shl r10d, cl
inc edx
or r8d, r10d
test r11b, 0x80
jne 0x443210
mov rcx, r12
mov r9d, edx
mov edx, r8d
mov r8d, r9d
jmp 0x44312d
mov eax, edx
mov rcx, rbx
call fcn.00451e00
xor eax, eax
mov rcx, rax
nop dword [rax]
call fcn.00451e00
nop
int3

Function at 0x448d80
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x448e35
push rbp
mov rbp, rsp
sub rsp, 0x48
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x68], rcx
mov qword [rsp + 0x70], rdi
test byte [rax], al
lea rdx, [rax + 0x10]
mov rsi, qword [rsp + 0x68]
mov rcx, rdi
mov rax, rdx
mov rbx, rsi
call fcn.00446aa0
nop
test bl, bl
je 0x448e2f
mov qword [rsp + 0x18], rax
movups xmmword [rsp + 0x20], xmm15
movups xmmword [rsp + 0x28], xmm15
movups xmmword [rsp + 0x38], xmm15
lea rcx, [0x00448e80]
mov qword [rsp + 0x20], rcx
mov rcx, qword [rsp + 0x58]
mov qword [rsp + 0x28], rcx
mov rcx, qword [rsp + 0x60]
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x38], rax
lea rcx, [rsp + 0x68]
mov qword [rsp + 0x40], rcx
lea rcx, [rsp + 0x20]
mov qword [rsp], rcx
call fcn.0044fa60
xorps xmm15, xmm15
mov r14, qword [0x007abb98]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x18]
add rsp, 0x48
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
call fcn.0044fb80
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
jmp fcn.00448d80
Function at 0x449f40
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x449fef
push rbp
mov rbp, rsp
sub rsp, 0x58
mov qword [rsp + 0x70], rbx
lea rdx, [rsp + 0x68]
mov qword [rsp + 8], 0
movups xmmword [rsp + 0x10], xmm15
movups xmmword [rsp + 0x18], xmm15
movups xmmword [rsp + 0x28], xmm15
movups xmmword [rsp + 0x38], xmm15
movups xmmword [rsp + 0x48], xmm15
lea rsi, [0x0044a040]
mov qword [rsp + 0x10], rsi
mov rsi, qword [rsp + 0x60]
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdx
mov rdx, r14
mov qword [rsp + 0x28], rdx
lea rdx, [rsp + 8]
mov qword [rsp + 0x30], rdx
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x48], rcx
mov qword [rsp + 0x50], rdi
mov qword [rsp + 0x40], rbx
lea rax, [rsp + 0x10]
mov qword [rsp], rax
call fcn.0044fa60
xorps xmm15, xmm15
mov r14, qword [0x007abb98]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 8]
add rsp, 0x58
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
call fcn.0044fb80
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
nop dword [rax]
jmp fcn.00449f40
Function at 0x453740
Capabilities:
Allocate thread local storage

Disassembly:
push rbp
mov rbp, rsp
mov rax, rsp
and rsp, 0xfffffffffffffff0
sub rsp, 0x30
mov qword [rsp + 0x20], rax
mov rax, qword [sym.imp.kernel32.dll_TlsAlloc]
call rax
mov rsp, qword [rsp + 0x20]
mov rcx, rax
cmp rcx, 0x40
jb 0x453774
mov rcx, 0x28
jmp 0x45377f
shl rcx, 3
add rcx, 0x1480
mov qword [0x007abb98], rcx
pop rbp
ret

Function at 0x457260
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x45737a
push rbp
mov rbp, rsp
sub rsp, 0x60
movabs rdx, 0x1159720d6c2d0764
mov qword [rsp + 0x42], rdx
movabs rdx, 0x296f395268694e78
mov qword [rsp + 0x4a], rdx
movabs rdx, 0x2c61656e5420296f
mov qword [rsp + 0x50], rdx
movabs rdx, 0x4c65706e5952460c
mov qword [rsp + 0x58], rdx
movabs rdx, 0x1a08190b050a1a0c
mov qword [rsp + 0x1c], rdx
movabs rdx, 0x70715000d061a08
mov qword [rsp + 0x22], rdx
movabs rdx, 0x11d1807160d0b06
mov qword [rsp + 0x2a], rdx
movabs rdx, 0x1913170b060f0007
mov qword [rsp + 0x32], rdx
movabs rdx, 0x902111706110408
mov qword [rsp + 0x3a], rdx
xor eax, eax
jmp 0x457317
movzx r9d, byte [rsp + rsi + 0x42]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x17]
mov byte [rsp + rdi + 0x42], dl
mov byte [rsp + rsi + 0x42], r8b
add rax, 2
cmp rax, 0x26
jge 0x457349
movzx edx, byte [rsp + rax + 0x1c]
movzx esi, byte [rsp + rax + 0x1d]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x1e
jae 0x45736d
movzx r8d, byte [rsp + rdi + 0x42]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x17]
cmp rsi, 0x1e
jb 0x4572fd
jmp 0x457361
xor eax, eax
lea rbx, [rsp + 0x42]
mov ecx, 0x1e
call fcn.004415e0
add rsp, 0x60
pop rbp
nop
ret
mov eax, esi
mov ecx, 0x1e
call fcn.00451e00
mov eax, edi
mov ecx, 0x1e
call fcn.00451e00
nop
call fcn.0044fb80
nop
jmp fcn.00457260

Function at 0x458ec0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x458fe7
push rbp
mov rbp, rsp
sub rsp, 0x68
movabs rdx, 0x6e7ed0c7636ee820
mov qword [rsp + 0x4a], rdx
movabs rdx, 0x65eed867736edf47
mov qword [rsp + 0x52], rdx
movabs rdx, 0x33e8d972476e65ee
mov qword [rsp + 0x58], rdx
movabs rdx, 0x6b1fb3745e640a65
mov qword [rsp + 0x60], rdx
movabs rdx, 0x19181b1d1b080c17
mov qword [rsp + 0x1e], rdx
movabs rdx, 0x5181104001c1211
mov qword [rsp + 0x26], rdx
movabs rdx, 0xe14121205181104
mov qword [rsp + 0x2a], rdx
movabs rdx, 0x6110d0113131d17
mov qword [rsp + 0x32], rdx
movabs rdx, 0x191801151b081118
mov qword [rsp + 0x3a], rdx
movabs rdx, 0x140d1809130e081d
mov qword [rsp + 0x42], rdx
xor eax, eax
jmp 0x458f89
movzx r9d, byte [rsp + rsi + 0x4a]
sub r9d, edx
lea edx, [r9 + 0x7a]
mov byte [rsp + rdi + 0x4a], dl
lea edx, [r8 + 0x7a]
mov byte [rsp + rsi + 0x4a], dl
add rax, 2
cmp rax, 0x2c
jge 0x458fb7
movzx edx, byte [rsp + rax + 0x1e]
movzx esi, byte [rsp + rax + 0x1f]
mov edi, edx
xor edx, esi
add edx, eax
nop
cmp rdi, 0x1e
jae 0x458fda
movzx r8d, byte [rsp + rdi + 0x4a]
sub r8d, edx
cmp rsi, 0x1e
jb 0x458f6c
jmp 0x458fce
xor eax, eax
lea rbx, [rsp + 0x4a]
mov ecx, 0x1e
call fcn.004415e0
add rsp, 0x68
pop rbp
ret
mov eax, esi
mov ecx, 0x1e
call fcn.00451e00
mov eax, edi
mov ecx, 0x1e
call fcn.00451e00
nop
call fcn.0044fb80
jmp fcn.00458ec0
Function at 0x45a4e0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x45a5db
push rbp
mov rbp, rsp
sub rsp, 0x48
movabs rdx, 0xf769e69727f9043f
mov qword [rsp + 0x34], rdx
movabs rdx, 0xe76cefebf769e697
mov qword [rsp + 0x38], rdx
movabs rdx, 0x348f6e2368c2290f
mov qword [rsp + 0x40], rdx
movabs rdx, 0x3130810090c04
mov qword [rsp + 0x1a], rdx
movabs rdx, 0x120e0d07020d0105
mov qword [rsp + 0x22], rdx
movabs rdx, 0xb0d120e0d07020d
mov qword [rsp + 0x24], rdx
movabs rdx, 0x1120e05120c1310
mov qword [rsp + 0x2c], rdx
xor eax, eax
jmp 0x45a579
movzx r9d, byte [rsp + rsi + 0x34]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x23]
mov byte [rsp + rdi + 0x34], dl
mov byte [rsp + rsi + 0x34], r8b
add rax, 2
cmp rax, 0x1a
jge 0x45a5ab
movzx edx, byte [rsp + rax + 0x1a]
movzx esi, byte [rsp + rax + 0x1b]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x14
jae 0x45a5ce
movzx r8d, byte [rsp + rdi + 0x34]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x23]
cmp rsi, 0x14
jb 0x45a55f
jmp 0x45a5c2
xor eax, eax
lea rbx, [rsp + 0x34]
mov ecx, 0x14
call fcn.004415e0
add rsp, 0x48
pop rbp
ret
mov eax, esi
mov ecx, 0x14
call fcn.00451e00
mov eax, edi
mov ecx, 0x14
call fcn.00451e00
nop
nop dword [rax + rax]
call fcn.0044fb80
jmp fcn.0045a4e0

Function at 0x45db00
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x45dbb8
push rbp
mov rbp, rsp
sub rsp, 0x30
movabs rdx, 0x3580d538e1db27df
mov qword [rsp + 0x28], rdx
movabs rdx, 0x1020301060101
mov qword [rsp + 0x1e], rdx
mov word [rsp + 0x26], 0x605
xor eax, eax
jmp 0x45db55
movzx r9d, byte [rsp + rsi + 0x28]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x52]
mov byte [rsp + rdi + 0x28], dl
mov byte [rsp + rsi + 0x28], r8b
add rax, 2
cmp rax, 0xa
jge 0x45db88
movzx edx, byte [rsp + rax + 0x1e]
movzx esi, byte [rsp + rax + 0x1f]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 8
jae 0x45dbab
movzx r8d, byte [rsp + rdi + 0x28]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x52]
nop
cmp rsi, 8
jb 0x45db3b
jmp 0x45db9f
xor eax, eax
lea rbx, [rsp + 0x28]
mov ecx, 8
call fcn.004415e0
add rsp, 0x30
pop rbp
ret
mov eax, esi
mov ecx, 8
call fcn.00451e00
mov eax, edi
mov ecx, 8
call fcn.00451e00
nop
call fcn.0044fb80
nop dword [rax]
jmp fcn.0045db00
Function at 0x45de20
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x45dee7
push rbp
mov rbp, rsp
sub rsp, 0x30
movabs rdx, 0xc233bc37f932f2b6
mov qword [rsp + 0x26], rdx
mov word [rsp + 0x2e], 0x3fb1
movabs rdx, 0x907050808000009
mov qword [rsp + 0x18], rdx
movabs rdx, 0x1050903080907
mov qword [rsp + 0x1e], rdx
xor eax, eax
jmp 0x45de87
movzx r9d, byte [rsp + rsi + 0x26]
sub r9d, edx
lea edx, [r9 + 0x4c]
mov byte [rsp + rdi + 0x26], dl
lea edx, [r8 + 0x4c]
mov byte [rsp + rsi + 0x26], dl
add rax, 2
cmp rax, 0xe
jge 0x45deb7
movzx edx, byte [rsp + rax + 0x18]
movzx esi, byte [rsp + rax + 0x19]
mov edi, edx
xor edx, esi
add edx, eax
nop dword [rax]
cmp rdi, 0xa
jae 0x45deda
movzx r8d, byte [rsp + rdi + 0x26]
sub r8d, edx
cmp rsi, 0xa
jb 0x45de6a
jmp 0x45dece
xor eax, eax
lea rbx, [rsp + 0x26]
mov ecx, 0xa
call fcn.004415e0
add rsp, 0x30
pop rbp
ret
mov eax, esi
mov ecx, 0xa
call fcn.00451e00
mov eax, edi
mov ecx, 0xa
call fcn.00451e00
nop
call fcn.0044fb80
jmp fcn.0045de20

Function at 0x45e3c0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x45e48c
push rbp
mov rbp, rsp
sub rsp, 0x38
movabs rdx, 0x3547583342553c50
mov qword [rsp + 0x2c], rdx
mov dword [rsp + 0x34], 0x4f394733
movabs rdx, 0x306000b09020502
mov qword [rsp + 0x1c], rdx
movabs rdx, 0xa0902010b020500
mov qword [rsp + 0x24], rdx
xor eax, eax
jmp 0x45e425
movzx r9d, byte [rsp + rsi + 0x2c]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x19]
mov byte [rsp + rdi + 0x2c], dl
mov byte [rsp + rsi + 0x2c], r8b
add rax, 2
cmp rax, 0x10
jge 0x45e45c
movzx edx, byte [rsp + rax + 0x1c]
movzx esi, byte [rsp + rax + 0x1d]
mov edi, edx
xor edx, esi
add edx, eax
nop dword [rax + rax]
cmp rdi, 0xc
jae 0x45e47f
movzx r8d, byte [rsp + rdi + 0x2c]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x19]
cmp rsi, 0xc
jb 0x45e40b
jmp 0x45e473
xor eax, eax
lea rbx, [rsp + 0x2c]
mov ecx, 0xc
call fcn.004415e0
add rsp, 0x38
pop rbp
ret
mov eax, esi
mov ecx, 0xc
call fcn.00451e00
mov eax, edi
mov ecx, 0xc
call fcn.00451e00
nop
call fcn.0044fb80
jmp fcn.0045e3c0
Function at 0x45f4e0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x45f5cc
push rbp
mov rbp, rsp
sub rsp, 0x48
movabs rdx, 0x64365a425b393450
mov qword [rsp + 0x35], rdx
movabs rdx, 0x49394964365a425b
mov qword [rsp + 0x38], rdx
movabs rdx, 0x353b344536375b54
mov qword [rsp + 0x40], rdx
movabs rdx, 0x50f030f0c00070a
mov qword [rsp + 0x1f], rdx
movabs rdx, 0xa0a0f08000b050f
mov qword [rsp + 0x25], rdx
movabs rdx, 0x50c11050004100b
mov qword [rsp + 0x2d], rdx
xor eax, eax
jmp 0x45f56a
movzx r9d, byte [rsp + rsi + 0x35]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x25]
mov byte [rsp + rdi + 0x35], dl
mov byte [rsp + rsi + 0x35], r8b
add rax, 2
cmp rax, 0x16
jge 0x45f59c
movzx edx, byte [rsp + rax + 0x1f]
movzx esi, byte [rsp + rax + 0x20]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x13
jae 0x45f5bf
movzx r8d, byte [rsp + rdi + 0x35]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x25]
cmp rsi, 0x13
jb 0x45f550
jmp 0x45f5b3
xor eax, eax
lea rbx, [rsp + 0x35]
mov ecx, 0x13
call fcn.004415e0
add rsp, 0x48
pop rbp
ret
mov eax, esi
mov ecx, 0x13
call fcn.00451e00
mov eax, edi
mov ecx, 0x13
call fcn.00451e00
nop
call fcn.0044fb80
jmp fcn.0045f4e0

Function at 0x460060
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x46015b
push rbp
mov rbp, rsp
sub rsp, 0x50
movabs rdx, 0xa8b7a9af1036bd9a
mov qword [rsp + 0x3b], rdx
movabs rdx, 0xa8a8c33934a8b7a9
mov qword [rsp + 0x40], rdx
movabs rdx, 0x97101b333032ad26
mov qword [rsp + 0x48], rdx
movabs rdx, 0xc1400010d0e0a0f
mov qword [rsp + 0x1f], rdx
movabs rdx, 0x112130e040c060d
mov qword [rsp + 0x27], rdx
movabs rdx, 0xe050b040112130e
mov qword [rsp + 0x2b], rdx
movabs rdx, 0x707120103010a06
mov qword [rsp + 0x33], rdx
xor eax, eax
jmp 0x4600f9
movzx r9d, byte [rsp + rsi + 0x3b]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x6f]
mov byte [rsp + rdi + 0x3b], dl
mov byte [rsp + rsi + 0x3b], r8b
add rax, 2
cmp rax, 0x1c
jge 0x46012b
movzx edx, byte [rsp + rax + 0x1f]
movzx esi, byte [rsp + rax + 0x20]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x15
jae 0x46014e
movzx r8d, byte [rsp + rdi + 0x3b]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x6f]
cmp rsi, 0x15
jb 0x4600df
jmp 0x460142
xor eax, eax
lea rbx, [rsp + 0x3b]
mov ecx, 0x15
call fcn.004415e0
add rsp, 0x50
pop rbp
ret
mov eax, esi
mov ecx, 0x15
call fcn.00451e00
mov eax, edi
mov ecx, 0x15
call fcn.00451e00
nop
nop dword [rax + rax]
call fcn.0044fb80
jmp fcn.00460060
Function at 0x463460
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x46356c
push rbp
mov rbp, rsp
sub rsp, 0x58
movabs rdx, 0x84777f3934113039
mov qword [rsp + 0x3c], rdx
movabs rdx, 0xe238eb876cc3e643
mov qword [rsp + 0x44], rdx
movabs rdx, 0x313937a3e238eb87
mov qword [rsp + 0x48], rdx
movabs rdx, 0x7a323630e083e9e7
mov qword [rsp + 0x50], rdx
movabs rdx, 0xc08061610161405
mov qword [rsp + 0x1c], rdx
movabs rdx, 0x20f0d0902080c07
mov qword [rsp + 0x24], rdx
movabs rdx, 0xf071b0b15171608
mov qword [rsp + 0x2c], rdx
movabs rdx, 0x141b0c0b100a0716
mov qword [rsp + 0x34], rdx
xor eax, eax
jmp 0x463508
movzx r9d, byte [rsp + rsi + 0x3c]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x3c]
mov byte [rsp + rdi + 0x3c], dl
mov byte [rsp + rsi + 0x3c], r8b
add rax, 2
cmp rax, 0x20
jge 0x46353c
movzx edx, byte [rsp + rax + 0x1c]
movzx esi, byte [rsp + rax + 0x1d]
mov edi, edx
xor edx, esi
add edx, eax
nop
cmp rdi, 0x1c
jae 0x46355f
movzx r8d, byte [rsp + rdi + 0x3c]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x3c]
cmp rsi, 0x1c
jb 0x4634ee
jmp 0x463553
xor eax, eax
lea rbx, [rsp + 0x3c]
mov ecx, 0x1c
call fcn.004415e0
add rsp, 0x58
pop rbp
ret
mov eax, esi
mov ecx, 0x1c
call fcn.00451e00
mov eax, edi
mov ecx, 0x1c
call fcn.00451e00
nop
call fcn.0044fb80
jmp fcn.00463460

Function at 0x463580
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x46369a
push rbp
mov rbp, rsp
sub rsp, 0x60
movabs rdx, 0x3d35080d20f6350d
mov qword [rsp + 0x43], rdx
movabs rdx, 0x31ef3a29201e3730
mov qword [rsp + 0x4b], rdx
movabs rdx, 0x4227f0382231ef3a
mov qword [rsp + 0x50], rdx
movabs rdx, 0x28320c290c1d152c
mov qword [rsp + 0x58], rdx
movabs rdx, 0x70703090b061514
mov qword [rsp + 0x1f], rdx
movabs rdx, 0xc1c090d07070309
mov qword [rsp + 0x23], rdx
movabs rdx, 0x141a191310020a17
mov qword [rsp + 0x2b], rdx
movabs rdx, 0x4180d0605141612
mov qword [rsp + 0x33], rdx
movabs rdx, 0x10121416100e10
mov qword [rsp + 0x3b], rdx
xor eax, eax
jmp 0x463637
movzx r9d, byte [rsp + rsi + 0x43]
lea edx, [r9 + rdx]
lea edx, [rdx - 0xe]
mov byte [rsp + rdi + 0x43], dl
mov byte [rsp + rsi + 0x43], r8b
add rax, 2
cmp rax, 0x24
jge 0x463669
movzx edx, byte [rsp + rax + 0x1f]
movzx esi, byte [rsp + rax + 0x20]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x1d
jae 0x46368d
movzx r8d, byte [rsp + rdi + 0x43]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0xe]
cmp rsi, 0x1d
jb 0x46361d
jmp 0x463681
xor eax, eax
lea rbx, [rsp + 0x43]
mov ecx, 0x1d
call fcn.004415e0
add rsp, 0x60
pop rbp
nop
ret
mov eax, esi
mov ecx, 0x1d
call fcn.00451e00
mov eax, edi
mov ecx, 0x1d
call fcn.00451e00
nop
call fcn.0044fb80
nop
jmp fcn.00463580
Function at 0x465220
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x465358
push rbp
mov rbp, rsp
sub rsp, 0x68
movabs rdx, 0x333358371f30312c
mov qword [rsp + 0x47], rdx
movabs rdx, 0x35333358371f3031
mov qword [rsp + 0x48], rdx
movabs rdx, 0x381d3030382a4c26
mov qword [rsp + 0x50], rdx
movabs rdx, 0x2b2124313156584b
mov qword [rsp + 0x58], rdx
movabs rdx, 0x353210383e230f36
mov qword [rsp + 0x60], rdx
movabs rdx, 0x161a052004201b08
mov qword [rsp + 0x1d], rdx
movabs rdx, 0xf0b171e06030918
mov qword [rsp + 0x25], rdx
movabs rdx, 0x60c0f0b171e0603
mov qword [rsp + 0x27], rdx
movabs rdx, 0x131c0320000c1716
mov qword [rsp + 0x2f], rdx
movabs rdx, 0x120606060f00001b
mov qword [rsp + 0x37], rdx
movabs rdx, 0x1312030a0a1c1106
mov qword [rsp + 0x3f], rdx
xor eax, eax
jmp 0x4652f8
movzx r9d, byte [rsp + rsi + 0x47]
sub r9d, edx
lea edx, [r9 + 0x25]
mov byte [rsp + rdi + 0x47], dl
lea edx, [r8 + 0x25]
mov byte [rsp + rsi + 0x47], dl
add rax, 2
cmp rax, 0x2a
jge 0x465328
movzx edx, byte [rsp + rax + 0x1d]
movzx esi, byte [rsp + rax + 0x1e]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x21
jae 0x46534b
movzx r8d, byte [rsp + rdi + 0x47]
sub r8d, edx
nop dword [rax]
cmp rsi, 0x21
jb 0x4652db
jmp 0x46533f
xor eax, eax
lea rbx, [rsp + 0x47]
mov ecx, 0x21
call fcn.004415e0
add rsp, 0x68
pop rbp
ret
mov eax, esi
mov ecx, 0x21
call fcn.00451e00
mov eax, edi
mov ecx, 0x21
call fcn.00451e00
nop
call fcn.0044fb80
nop dword [rax]
jmp fcn.00465220

Function at 0x466e80
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x466fa7
push rbp
mov rbp, rsp
sub rsp, 0x68
movabs rdx, 0x8336703495328486
mov qword [rsp + 0x43], rdx
movabs rdx, 0x55355385bd833670
mov qword [rsp + 0x48], rdx
movabs rdx, 0x345d539398333133
mov qword [rsp + 0x50], rdx
movabs rdx, 0x87bb334e3322be2b
mov qword [rsp + 0x58], rdx
movabs rdx, 0x3532cd3093a28c8d
mov qword [rsp + 0x60], rdx
movabs rdx, 0x16160c0a19191b10
mov qword [rsp + 0x1b], rdx
movabs rdx, 0x1520011711131210
mov qword [rsp + 0x23], rdx
movabs rdx, 0x1f22081b22201205
mov qword [rsp + 0x2b], rdx
movabs rdx, 0x131620162017071b
mov qword [rsp + 0x33], rdx
movabs rdx, 0x1d03091e011e1c00
mov qword [rsp + 0x3b], rdx
xor eax, eax
jmp 0x466f49
movzx r9d, byte [rsp + rsi + 0x43]
sub r9d, edx
lea edx, [r9 - 0x19]
mov byte [rsp + rdi + 0x43], dl
lea edx, [r8 - 0x19]
mov byte [rsp + rsi + 0x43], dl
add rax, 2
cmp rax, 0x28
jge 0x466f77
movzx edx, byte [rsp + rax + 0x1b]
movzx esi, byte [rsp + rax + 0x1c]
mov edi, edx
xor edx, esi
add edx, eax
nop
cmp rdi, 0x25
jae 0x466f9a
movzx r8d, byte [rsp + rdi + 0x43]
sub r8d, edx
cmp rsi, 0x25
jb 0x466f2c
jmp 0x466f8e
xor eax, eax
lea rbx, [rsp + 0x43]
mov ecx, 0x25
call fcn.004415e0
add rsp, 0x68
pop rbp
ret
mov eax, esi
mov ecx, 0x25
call fcn.00451e00
mov eax, edi
mov ecx, 0x25
call fcn.00451e00
nop
call fcn.0044fb80
jmp fcn.00466e80