joyce8/EMBER2024-capa huggingface dataset:
Function at 0x43ab60
Capabilities:
Encode data using base64

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x43acaa
push rbp
mov rbp, rsp
sub rsp, 0x18
mov ecx, dword [rax + 0x190]
mov edx, dword [rax + 0x194]
mov rsi, qword [rax + 0x998]
mov edi, dword [rax + 0x194]
cmp edi, edx
jne 0x43ab72
cmp edx, ecx
jne 0x43ac98
nop word [rax + rax]
test rsi, rsi
jne 0x43ac98
mov qword [rsp + 0x28], rax
test rbx, rbx
jne 0x43abd4
nop
call fcn.00454140
xorps xmm15, xmm15
mov r14, qword [0x00668e78]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rbx, qword [rsp]
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0x10], rbx
call fcn.0043aaa0
mov rcx, qword [rsp + 0x28]
mov edx, dword [rcx]
mov ebx, edx
sar edx, 0x1f
shr edx, 0x1b
add edx, ebx
mov esi, edx
and edx, 0xffffffe0
sub ebx, edx
test ebx, ebx
jl 0x43ac93
mov rdx, qword [0x005e3920]
sar esi, 5
mov rax, rcx
mov ecx, ebx
mov edi, 1
shl edi, cl
movsxd rsi, esi
lea rdx, [rdx + rsi*4]
cmp ecx, 0x20
sbb esi, esi
and edi, esi
lock or dword [rdx], edi
mov rdx, qword [0x005e5290]
mov qword [rax + 8], rdx
mov rdx, rax
nop
mov qword [0x005e5290], rax
nop
mov esi, 1
lea rdi, [0x005e5298]
lock xadd dword [rdi], esi
mov rsi, qword [rdx + 0x1248]
shr rsi, 0x3d
test sil, sil
jne 0x43ac82
mov rax, qword [rsp + 0x10]
movabs rcx, 0x1fffffffffffffff
and rcx, rax
bts rcx, 0x3f
nop
nop
xchg qword [rdx + 0x1248], rcx
add rsp, 0x18
pop rbp
ret
lea rax, [0x00538db0]
mov ebx, 0x28
call fcn.0042d2c0
call fcn.0042c320
lea rax, [0x00538339]
mov ebx, 0x23
call fcn.0042d2c0
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.004506a0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.0043ab60

Function at 0x43de60
Capabilities:
Access peb ldr_data

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x70
mov rcx, r14
test rcx, rcx
je 0x43dea8
mov rcx, qword [rcx + 0x30]
mov rcx, qword [rcx + 0x90]
nop dword [rax + rax]
test rcx, rcx
je 0x43dea8
mov qword [rsp + 0x68], rcx
nop
mov rax, qword [rdi + 0x28]
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x58], 0
mov qword [rsp + 0x50], 0
jmp 0x43deb8
mov eax, 1
add rsp, 0x70
pop rbp
ret
mov rax, qword [rsp + 0x60]
mov rcx, qword [sym.imp.kernel32.dll_RtlLookupFunctionEntry]
lea rdx, [rsp + 0x58]
mov rbx, qword [rax + 0xf8]
mov qword [rsp], rcx
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], 0
call fcn.0042b7c0
xorps xmm15, xmm15
mov r14, qword [0x00668e78]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x20]
nop
test rax, rax
je 0x43df91
mov rcx, qword [rsp + 0x58]
mov rdx, qword [sym.imp.kernel32.dll_RtlVirtualUnwind]
mov rbx, qword [rsp + 0x60]
mov rsi, rbx
lea rdi, [rsp + 0x50]
mov r8, qword [rsi + 0xf8]
mov qword [rsp], rdx
mov qword [rsp + 8], 0
mov qword [rsp + 0x10], rcx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x40], 0
call fcn.0042ba40
xorps xmm15, xmm15
mov r14, qword [0x00668e78]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x68]
cmp qword [rcx], rax
ja 0x43df91
cmp qword [rcx + 8], rax
ja 0x43deb3
mov eax, 1
add rsp, 0x70
pop rbp
ret
Function at 0x443c80
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rax
movzx edx, byte [rax]
test edx, edx
jne 0x443c9b
test r8b, r8b
jne 0x443c9b
xor eax, eax
xor ebx, ebx
mov rcx, rbx
xor edi, edi
ret
bt edx, 7
nop
jae 0x443caf
xor edx, edx
xor r8d, r8d
xor r9d, r9d
jmp 0x443d4d
mov r8d, 1
mov r9d, edx
and edx, 1
neg edx
shr r9d, 1
xor edx, r9d
add dword [rsi], edx
sub rcx, r8
mov rdx, rcx
neg rdx
sar rdx, 0x3f
and rdx, r8
movzx esi, byte [rax + rdx]
sub rbx, r8
add rdx, rax
bt esi, 7
jae 0x443cee
xor eax, eax
xor esi, esi
xor r8d, r8d
jmp 0x443d1c
mov eax, 1
add qword [rdi], rsi
sub rcx, rax
sub rbx, rax
mov rsi, rcx
neg rsi
sar rsi, 0x3f
and rax, rsi
add rax, rdx
mov edi, 1
ret
lea r8d, [rcx + 7]
mov rcx, rax
mov eax, r10d
movzx r9d, byte [rax + rdx]
lea r10d, [rax + 1]
mov r11d, r9d
and r9d, 0x7f
mov rax, rcx
mov ecx, r8d
shl r9d, cl
or esi, r9d
test r11b, 0x80
jne 0x443d12
mov rcx, rax
mov eax, r10d
jmp 0x443cf3
lea r9d, [rcx + 7]
mov rcx, r12
movzx r10d, byte [rdx + rax]
inc edx
mov r11d, r10d
and r10d, 0x7f
mov r12, rcx
mov ecx, r9d
shl r10d, cl
or r8d, r10d
test r11b, 0x80
jne 0x443d46
mov rcx, r12
mov r9d, edx
mov edx, r8d
mov r8d, r9d
jmp 0x443cb5

Function at 0x449400
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4494b5
push rbp
mov rbp, rsp
sub rsp, 0x48
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x68], rcx
mov qword [rsp + 0x70], rdi
test byte [rax], al
lea rdx, [rax + 0x10]
mov rsi, qword [rsp + 0x68]
mov rcx, rdi
mov rax, rdx
mov rbx, rsi
call fcn.004471c0
nop
test bl, bl
je 0x4494af
mov qword [rsp + 0x18], rax
movups xmmword [rsp + 0x20], xmm15
movups xmmword [rsp + 0x28], xmm15
movups xmmword [rsp + 0x38], xmm15
lea rcx, [0x00449500]
mov qword [rsp + 0x20], rcx
mov rcx, qword [rsp + 0x58]
mov qword [rsp + 0x28], rcx
mov rcx, qword [rsp + 0x60]
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x38], rax
lea rcx, [rsp + 0x68]
mov qword [rsp + 0x40], rcx
lea rcx, [rsp + 0x20]
mov qword [rsp], rcx
call fcn.00450580
xorps xmm15, xmm15
mov r14, qword [0x00668e78]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x18]
add rsp, 0x48
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
call fcn.004506a0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
jmp fcn.00449400
Function at 0x44a4c0
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x44a56f
push rbp
mov rbp, rsp
sub rsp, 0x58
mov qword [rsp + 0x70], rbx
lea rdx, [rsp + 0x68]
mov qword [rsp + 8], 0
movups xmmword [rsp + 0x10], xmm15
movups xmmword [rsp + 0x18], xmm15
movups xmmword [rsp + 0x28], xmm15
movups xmmword [rsp + 0x38], xmm15
movups xmmword [rsp + 0x48], xmm15
lea rsi, [0x0044a5c0]
mov qword [rsp + 0x10], rsi
mov rsi, qword [rsp + 0x60]
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdx
mov rdx, r14
mov qword [rsp + 0x28], rdx
lea rdx, [rsp + 8]
mov qword [rsp + 0x30], rdx
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x48], rcx
mov qword [rsp + 0x50], rdi
mov qword [rsp + 0x40], rbx
lea rax, [rsp + 0x10]
mov qword [rsp], rax
call fcn.00450580
xorps xmm15, xmm15
mov r14, qword [0x00668e78]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 8]
add rsp, 0x58
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
call fcn.004506a0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
nop dword [rax]
jmp fcn.0044a4c0
Function at 0x4524a0
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x403ac3
push rbp
mov rbp, rsp
sub rsp, 0x18
mov rdx, qword [rax]
mov rcx, qword [rax + 8]
mov rax, rdx
call fcn.00407fe0
add rsp, 0x18
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.004506a0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp 0x403aa0
cmp byte [0x00668c8b], 0
je 0x4524b5
mov rcx, qword [rax + 8]
mov rax, qword [rax]
jmp 0x44f6e0
jmp 0x403aa0

Function at 0x4524c0
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
nop
mov eax, dword [rax]
movabs rcx, 0xe7037ed1a0b428db
xor rcx, rax
xor rax, rbx
xor rax, qword [0x00668f60]
movabs rdx, 0xa0761d6478bd642f
xor rdx, rax
mov rax, rcx
mul rdx
xor rax, rdx
mov rcx, rax
movabs rax, 0x1d8e4e27c47d124b
mul rcx
xor rax, rdx
nop
nop
ret
cmp byte [0x00668c8b], 0
je 0x4524f5
movq xmm0, rbx
pinsrd xmm0, dword [rax], 2
aesenc xmm0, xmmword [0x006692c0]
aesenc xmm0, xmmword [0x006692d0]
aesenc xmm0, xmmword [0x006692e0]
movq rax, xmm0
ret
jmp 0x408200

Function at 0x452500
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
nop
mov rax, qword [rax]
movabs rcx, 0xe7037ed1a0b428db
xor rcx, rax
xor rax, rbx
xor rax, qword [0x00668f60]
movabs rdx, 0xa0761d6478bd642f
xor rdx, rax
mov rax, rcx
mul rdx
xor rax, rdx
mov rcx, rax
movabs rax, 0x1d8e4e27c47d1247
mul rcx
xor rax, rdx
nop
nop
ret
cmp byte [0x00668c8b], 0
je 0x452536
movq xmm0, rbx
pinsrq xmm0, qword [rax], 1
aesenc xmm0, xmmword [0x006692c0]
aesenc xmm0, xmmword [0x006692d0]
aesenc xmm0, xmmword [0x006692e0]
movq rax, xmm0
ret
jmp 0x408260

Function at 0x454180
Capabilities:
Allocate thread local storage

Disassembly:
push rbp
mov rbp, rsp
mov rax, rsp
and rsp, 0xfffffffffffffff0
sub rsp, 0x30
mov qword [rsp + 0x20], rax
mov rax, qword [sym.imp.kernel32.dll_TlsAlloc]
call rax
mov rsp, qword [rsp + 0x20]
mov rcx, rax
cmp rcx, 0x40
jb 0x4541b4
mov rcx, 0x28
jmp 0x4541bf
shl rcx, 3
add rcx, 0x1480
mov qword [0x00668e78], rcx
pop rbp
ret

Function at 0x4586e0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4587a5
push rbp
mov rbp, rsp
sub rsp, 0x48
movabs rdx, 0x1f6f707034ed0399
mov qword [rsp + 0x33], rdx
movabs rdx, 0x53d5fc65741f6f70
mov qword [rsp + 0x38], rdx
movabs rdx, 0x6e0be4e5930686d7
mov qword [rsp + 0x40], rdx
movabs rdx, 0x30f0e1107001003
mov qword [rsp + 0x1b], rdx
movabs rdx, 0x10070113110010
mov qword [rsp + 0x23], rdx
movabs rdx, 0xd120b100a020c12
mov qword [rsp + 0x2b], rdx
xor eax, eax
jmp 0x458788
movzx edx, byte [rsp + rax + 0x1b]
movzx esi, byte [rsp + rax + 0x1c]
mov edi, edx
xor edx, esi
add edx, eax
movzx r8d, byte [rsp + rsi + 0x33]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x5d]
movzx r9d, byte [rsp + rdi + 0x33]
mov byte [rsp + rdi + 0x33], r8b
lea edx, [r9 + rdx]
lea edx, [rdx + 0x5d]
mov byte [rsp + rsi + 0x33], dl
add rax, 2
cmp rax, 0x18
jl 0x458750
xor eax, eax
lea rbx, [rsp + 0x33]
mov ecx, 0x15
call fcn.004419a0
add rsp, 0x48
pop rbp
ret
call fcn.004506a0
jmp fcn.004586e0
Function at 0x458cc0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x70
movups xmmword [rsp + 0x80], xmm15
movups xmmword [rsp + 0x90], xmm15
movabs rax, 0x807e9f751ba9a90c
mov qword [rsp + 0x50], rax
movabs rax, 0x80c73190f1a761e
mov qword [rsp + 0x58], rax
movabs rax, 0x7b108381750def12
mov qword [rsp + 0x60], rax
movabs rax, 0x811e05f090878587
mov qword [rsp + 0x68], rax
movabs rax, 0x20a0d00101e0503
mov qword [rsp + 2], rax
movabs rax, 0x1d110e1a1e070110
mov qword [rsp + 0xa], rax
movabs rax, 0x51e14071e001d11
mov qword [rsp + 0x10], rax
movabs rax, 0xd001d041b15051f
mov qword [rsp + 0x18], rax
movabs rax, 0x1c19111f1f041802
mov qword [rsp + 0x20], rax
movabs rax, 0x1a1a091314061917
mov qword [rsp + 0x28], rax
xor eax, eax
jmp 0x458da7
movzx ecx, byte [rsp + rax + 2]
movzx edx, byte [rsp + rax + 3]
mov ebx, ecx
xor ecx, edx
add ecx, eax
movzx esi, byte [rsp + rdx + 0x50]
lea esi, [rsi + rcx]
lea esi, [rsi + 0x5d]
movzx edi, byte [rsp + rbx + 0x50]
mov byte [rsp + rbx + 0x50], sil
lea ecx, [rdi + rcx]
lea ecx, [rcx + 0x5d]
mov byte [rsp + rdx + 0x50], cl
add rax, 2
cmp rax, 0x2e
jl 0x458d74
movups xmmword [rsp + 0x30], xmm15
movups xmmword [rsp + 0x40], xmm15
xor eax, eax
jmp 0x458dc9
movzx ecx, byte [rsp + rax + 0x50]
mov byte [rsp + rax + 0x30], cl
inc rax
cmp rax, 0x20
jl 0x458dbd
movups xmm0, xmmword [rsp + 0x30]
movups xmmword [rsp + 0x80], xmm0
movups xmm0, xmmword [rsp + 0x40]
movups xmmword [rsp + 0x90], xmm0
add rsp, 0x70
pop rbp
ret

Function at 0x45b960
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x45ba0b
push rbp
mov rbp, rsp
sub rsp, 0x38
movabs rdx, 0x20dc1bb1e8ab6eb8
mov qword [rsp + 0x2a], rdx
movabs rdx, 0xa5b2a16e9a7320dc
mov qword [rsp + 0x30], rdx
movabs rdx, 0x200030b0305060b
mov qword [rsp + 0x1c], rdx
movabs rdx, 0x90c050b0d040200
mov qword [rsp + 0x22], rdx
xor eax, eax
jmp 0x45b9ea
movzx edx, byte [rsp + rax + 0x1c]
movzx esi, byte [rsp + rax + 0x1d]
mov edi, edx
xor edx, esi
add edx, eax
movzx r8d, byte [rsp + rsi + 0x2a]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x4a]
movzx r9d, byte [rsp + rdi + 0x2a]
mov byte [rsp + rdi + 0x2a], r8b
lea edx, [r9 + rdx]
lea edx, [rdx - 0x4a]
mov byte [rsp + rsi + 0x2a], dl
add rax, 2
cmp rax, 0xe
jl 0x45b9b2
xor eax, eax
lea rbx, [rsp + 0x2a]
mov ecx, 0xe
nop dword [rax]
call fcn.004419a0
add rsp, 0x38
pop rbp
ret
call fcn.004506a0
jmp fcn.0045b960
Function at 0x4615e0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4616e1
push rbp
mov rbp, rsp
sub rsp, 0x68
movabs rdx, 0x956d99b636337173
mov qword [rsp + 0x49], rdx
movabs rdx, 0xc3d6316d7a693737
mov qword [rsp + 0x51], rdx
movabs rdx, 0x37d29c657fb5d0c3
mov qword [rsp + 0x58], rdx
movabs rdx, 0x35e43197235d740d
mov qword [rsp + 0x60], rdx
movabs rdx, 0x130613190b191d17
mov qword [rsp + 0x1d], rdx
movabs rdx, 0x120e001811001a0a
mov qword [rsp + 0x25], rdx
movabs rdx, 0x4151414120e0018
mov qword [rsp + 0x29], rdx
movabs rdx, 0x151714100b0c010f
mov qword [rsp + 0x31], rdx
movabs rdx, 0x6120a1d1d060115
mov qword [rsp + 0x39], rdx
movabs rdx, 0x1407140c1d04051b
mov qword [rsp + 0x41], rdx
xor eax, eax
jmp 0x4616c3
movzx edx, byte [rsp + rax + 0x1d]
movzx esi, byte [rsp + rax + 0x1e]
mov edi, edx
xor edx, esi
add edx, eax
movzx r8d, byte [rsp + rsi + 0x49]
sub r8d, edx
add r8d, 0xffffffe1
movzx r9d, byte [rsp + rdi + 0x49]
mov byte [rsp + rdi + 0x49], r8b
sub r9d, edx
lea edx, [r9 - 0x1f]
mov byte [rsp + rsi + 0x49], dl
add rax, 2
cmp rax, 0x2c
jl 0x46168c
xor eax, eax
lea rbx, [rsp + 0x49]
mov ecx, 0x1f
call fcn.004419a0
add rsp, 0x68
pop rbp
nop
ret
call fcn.004506a0
jmp fcn.004615e0

Function at 0x461700
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x461801
push rbp
mov rbp, rsp
sub rsp, 0x68
movabs rdx, 0x3831342335342b2a
mov qword [rsp + 0x49], rdx
movabs rdx, 0x313018131541fe38
mov qword [rsp + 0x51], rdx
movabs rdx, 0x1938f23d3c38f831
mov qword [rsp + 0x58], rdx
movabs rdx, 0xf418243038313c1a
mov qword [rsp + 0x60], rdx
movabs rdx, 0xb1c0c1e091d1410
mov qword [rsp + 0x1f], rdx
movabs rdx, 0x140c100d011e1701
mov qword [rsp + 0x27], rdx
movabs rdx, 0x1416140c100d011e
mov qword [rsp + 0x29], rdx
movabs rdx, 0x413000d14021d10
mov qword [rsp + 0x31], rdx
movabs rdx, 0x1a130a141a03101c
mov qword [rsp + 0x39], rdx
movabs rdx, 0x181a091804120217
mov qword [rsp + 0x41], rdx
xor eax, eax
jmp 0x4617e3
movzx edx, byte [rsp + rax + 0x1f]
movzx esi, byte [rsp + rax + 0x20]
mov edi, edx
xor edx, esi
add edx, eax
movzx r8d, byte [rsp + rsi + 0x49]
sub r8d, edx
add r8d, 0x31
movzx r9d, byte [rsp + rdi + 0x49]
mov byte [rsp + rdi + 0x49], r8b
sub r9d, edx
lea edx, [r9 + 0x31]
mov byte [rsp + rsi + 0x49], dl
add rax, 2
cmp rax, 0x2a
jl 0x4617ac
xor eax, eax
lea rbx, [rsp + 0x49]
mov ecx, 0x1f
call fcn.004419a0
add rsp, 0x68
pop rbp
nop
ret
call fcn.004506a0
jmp fcn.00461700
Function at 0x462220
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x46233f
push rbp
mov rbp, rsp
sub rsp, 0x70
movabs rdx, 0xb1363539363744cd
mov qword [rsp + 0x4d], rdx
movabs rdx, 0x89c0a6b136353936
mov qword [rsp + 0x50], rdx
movabs rdx, 0x91029830f2aac15a
mov qword [rsp + 0x58], rdx
movabs rdx, 0x361c30313850e2aa
mov qword [rsp + 0x60], rdx
movabs rdx, 0x1e32c93aa541ca38
mov qword [rsp + 0x68], rdx
movabs rdx, 0xa1d100f1415111d
mov qword [rsp + 0x1b], rdx
movabs rdx, 0x200d0a1d100f1415
mov qword [rsp + 0x1d], rdx
movabs rdx, 0x1d0c1d22010d0b0a
mov qword [rsp + 0x25], rdx
movabs rdx, 0x130d1e041c1f0000
mov qword [rsp + 0x2d], rdx
movabs rdx, 0x220e140f0b09190a
mov qword [rsp + 0x35], rdx
movabs rdx, 0x301041c10081222
mov qword [rsp + 0x3d], rdx
movabs rdx, 0x110901070a141c1e
mov qword [rsp + 0x45], rdx
xor eax, eax
jmp 0x462322
movzx edx, byte [rsp + rax + 0x1b]
movzx esi, byte [rsp + rax + 0x1c]
mov edi, edx
xor edx, esi
add edx, eax
movzx r8d, byte [rsp + rsi + 0x4d]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x52]
movzx r9d, byte [rsp + rdi + 0x4d]
mov byte [rsp + rdi + 0x4d], r8b
lea edx, [r9 + rdx]
lea edx, [rdx + 0x52]
mov byte [rsp + rsi + 0x4d], dl
add rax, 2
cmp rax, 0x32
jl 0x4622ea
xor eax, eax
lea rbx, [rsp + 0x4d]
mov ecx, 0x23
call fcn.004419a0
add rsp, 0x70
pop rbp
ret
nop
call fcn.004506a0
jmp fcn.00462220

Function at 0x462360
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x462461
push rbp
mov rbp, rsp
sub rsp, 0x68
movabs rdx, 0x3192389198389938
mov qword [rsp + 0x45], rdx
movabs rdx, 0xdb99c03192389198
mov qword [rsp + 0x48], rdx
movabs rdx, 0xd082d28fce32f230
mov qword [rsp + 0x50], rdx
movabs rdx, 0x349be09c303938e9
mov qword [rsp + 0x58], rdx
movabs rdx, 0xc432628b76e13734
mov qword [rsp + 0x60], rdx
movabs rdx, 0x61313090f111703
mov qword [rsp + 0x1f], rdx
movabs rdx, 0x4091e190c010613
mov qword [rsp + 0x25], rdx
movabs rdx, 0x20191f0c0f101103
mov qword [rsp + 0x2d], rdx
movabs rdx, 0x181d0822120e0417
mov qword [rsp + 0x35], rdx
movabs rdx, 0xa0a1713090c1e19
mov qword [rsp + 0x3d], rdx
xor eax, eax
jmp 0x462444
movzx edx, byte [rsp + rax + 0x1f]
movzx esi, byte [rsp + rax + 0x20]
mov edi, edx
xor edx, esi
add edx, eax
movzx r8d, byte [rsp + rsi + 0x45]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x31]
movzx r9d, byte [rsp + rdi + 0x45]
mov byte [rsp + rdi + 0x45], r8b
lea edx, [r9 + rdx]
lea edx, [rdx + 0x31]
mov byte [rsp + rsi + 0x45], dl
add rax, 2
cmp rax, 0x26
jl 0x46240c
xor eax, eax
lea rbx, [rsp + 0x45]
mov ecx, 0x23
call fcn.004419a0
add rsp, 0x68
pop rbp
ret
call fcn.004506a0
jmp fcn.00462360
Function at 0x4646a0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4647cd
push rbp
mov rbp, rsp
sub rsp, 0x78
movabs rdx, 0x4e342a7743653448
mov qword [rsp + 0x4f], rdx
movabs rdx, 0x474136336139a235
mov qword [rsp + 0x57], rdx
movabs rdx, 0x69474136336139a2
mov qword [rsp + 0x58], rdx
movabs rdx, 0x38343052323c3073
mov qword [rsp + 0x60], rdx
movabs rdx, 0x3075394f37423639
mov qword [rsp + 0x68], rdx
movabs rdx, 0xa8a0bb52362d6e63
mov qword [rsp + 0x70], rdx
movabs rdx, 0x40e112005100020
mov qword [rsp + 0x1b], rdx
movabs rdx, 0x2271e05040e1120
mov qword [rsp + 0x1f], rdx
movabs rdx, 0x1216262326032715
mov qword [rsp + 0x27], rdx
movabs rdx, 0x71d250015110002
mov qword [rsp + 0x2f], rdx
movabs rdx, 0x210b1b1303200606
mov qword [rsp + 0x37], rdx
movabs rdx, 0xe04091e04041f25
mov qword [rsp + 0x3f], rdx
movabs rdx, 0x4221e20090f2804
mov qword [rsp + 0x47], rdx
xor eax, eax
jmp 0x4647b0
movzx edx, byte [rsp + rax + 0x1b]
movzx esi, byte [rsp + rax + 0x1c]
mov edi, edx
xor edx, esi
add edx, eax
movzx r8d, byte [rsp + rsi + 0x4f]
sub r8d, edx
add r8d, 0x1e
movzx r9d, byte [rsp + rdi + 0x4f]
mov byte [rsp + rdi + 0x4f], r8b
sub r9d, edx
lea edx, [r9 + 0x1e]
mov byte [rsp + rsi + 0x4f], dl
add rax, 2
cmp rax, 0x34
jl 0x464779
xor eax, eax
lea rbx, [rsp + 0x4f]
mov ecx, 0x29
call fcn.004419a0
add rsp, 0x78
pop rbp
ret
call fcn.004506a0
jmp fcn.004646a0
Function at 0x46a2a0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
lea r12, [rsp - 0x10]
cmp r12, qword [r14 + 0x10]
jbe 0x46a3ee
push rbp
mov rbp, rsp
sub rsp, 0x88
movabs rdx, 0x62ca1c15746c75a0
mov qword [rsp + 0x5c], rdx
movabs rdx, 0xea30319f39ad4569
mov qword [rsp + 0x64], rdx
movabs rdx, 0x9fb905d5ea30319f
mov qword [rsp + 0x68], rdx
movabs rdx, 0x587a9e016f208320
mov qword [rsp + 0x70], rdx
movabs rdx, 0xe109a26cc673c3b7
mov qword [rsp + 0x78], rdx
movabs rdx, 0xb2cbcc8bfcd5bc9d
mov qword [rsp + 0x80], rdx
movabs rdx, 0x1b1b0b1c28110609
mov qword [rsp + 0x1c], rdx
movabs rdx, 0x221827241a050f1b
mov qword [rsp + 0x24], rdx
movabs rdx, 0x2a250c121a050423
mov qword [rsp + 0x2c], rdx
movabs rdx, 0x1020142b24281a11
mov qword [rsp + 0x34], rdx
movabs rdx, 0x1829110a27280922
mov qword [rsp + 0x3c], rdx
movabs rdx, 0x141904182b1d0b00
mov qword [rsp + 0x44], rdx
movabs rdx, 0x2527200515262421
mov qword [rsp + 0x4c], rdx
movabs rdx, 0x1f09230c1b2a0a13
mov qword [rsp + 0x54], rdx
xor eax, eax
jmp 0x46a3ca
movzx edx, byte [rsp + rax + 0x1c]
movzx esi, byte [rsp + rax + 0x1d]
mov edi, edx
xor edx, esi
add edx, eax
movzx r8d, byte [rsp + rsi + 0x5c]
sub r8d, edx
add r8d, 2
movzx r9d, byte [rsp + rdi + 0x5c]
mov byte [rsp + rdi + 0x5c], r8b
sub r9d, edx
lea edx, [r9 + 2]
mov byte [rsp + rsi + 0x5c], dl
add rax, 2
cmp rax, 0x40
jl 0x46a393
xor eax, eax
lea rbx, [rsp + 0x5c]
mov ecx, 0x2c
nop dword [rax]
call fcn.004419a0
add rsp, 0x88
pop rbp
ret
call fcn.004506a0
jmp fcn.0046a2a0

Function at 0x46bb60
Capabilities:
Encrypt data using rc4 prga

Disassembly:
lea r12, [rsp - 0x18]
cmp r12, qword [r14 + 0x10]
jbe 0x46bcc1
push rbp
mov rbp, rsp
sub rsp, 0x90
movabs rdx, 0x9d5a95db40a6f6e
mov qword [rsp + 0x60], rdx
movabs rdx, 0xfed99569d9b1688b
mov qword [rsp + 0x68], rdx
movabs rdx, 0x3f30746e54632e79
mov qword [rsp + 0x70], rdx
movabs rdx, 0x65ec71b9ebc405ad
mov qword [rsp + 0x78], rdx
movabs rdx, 0xc0e6746bfe6d8b3e
mov qword [rsp + 0x80], rdx
movabs rdx, 0xee3177ac6bed699e
mov qword [rsp + 0x88], rdx
movabs rdx, 0x24240e1d2c042727
mov qword [rsp + 0x1a], rdx
movabs rdx, 0x1611062b17112424
mov qword [rsp + 0x20], rdx
movabs rdx, 0xa1005192b2c2023
mov qword [rsp + 0x28], rdx
movabs rdx, 0x28211c2721182019
mov qword [rsp + 0x30], rdx
movabs rdx, 0x42a061613212808
mov qword [rsp + 0x38], rdx
movabs rdx, 0x28052f191e051a0a
mov qword [rsp + 0x40], rdx
movabs rdx, 0x82b0d061a1d1b03
mov qword [rsp + 0x48], rdx
movabs rdx, 0x2403260e211d1810
mov qword [rsp + 0x50], rdx
movabs rdx, 0x1e280f060702240b
mov qword [rsp + 0x58], rdx
xor eax, eax
jmp 0x46bca0
movzx edx, byte [rsp + rax + 0x1a]
movzx esi, byte [rsp + rax + 0x1b]
mov edi, edx
xor edx, esi
add edx, eax
movzx r8d, byte [rsp + rsi + 0x60]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x26]
movzx r9d, byte [rsp + rdi + 0x60]
mov byte [rsp + rdi + 0x60], r8b
lea edx, [r9 + rdx]
lea edx, [rdx + 0x26]
mov byte [rsp + rsi + 0x60], dl
add rax, 2
nop dword [rax]
cmp rax, 0x46
jl 0x46bc65
xor eax, eax
lea rbx, [rsp + 0x60]
mov ecx, 0x30
call fcn.004419a0
add rsp, 0x90
pop rbp
nop
ret
call fcn.004506a0
jmp fcn.0046bb60