joyce8/EMBER2024-capa huggingface dataset:
Function at 0x456020
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4560cf
push rbp
mov rbp, rsp
sub rsp, 0x58
mov qword [rsp + 0x70], rbx
lea rdx, [rsp + 0x68]
mov qword [rsp + 8], 0
movups xmmword [rsp + 0x10], xmm15
movups xmmword [rsp + 0x18], xmm15
movups xmmword [rsp + 0x28], xmm15
movups xmmword [rsp + 0x38], xmm15
movups xmmword [rsp + 0x48], xmm15
lea rsi, [0x00456120]
mov qword [rsp + 0x10], rsi
mov rsi, qword [rsp + 0x60]
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdx
mov rdx, r14
mov qword [rsp + 0x28], rdx
lea rdx, [rsp + 8]
mov qword [rsp + 0x30], rdx
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x48], rcx
mov qword [rsp + 0x50], rdi
lea rax, [rsp + 0x10]
mov qword [rsp], rax
call fcn.0045ec60
xorps xmm15, xmm15
mov r14, qword [0x00842ac0]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 8]
add rsp, 0x58
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
call fcn.0045eda0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
nop dword [rax]
jmp fcn.00456020
Function at 0x460b80
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4031e3
push rbp
mov rbp, rsp
sub rsp, 0x18
mov rdx, qword [rax]
mov rcx, qword [rax + 8]
mov rax, rdx
call fcn.00408c60
add rsp, 0x18
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.0045eda0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp 0x4031c0
cmp byte [0x0084286c], 0
je 0x460b95
mov rcx, qword [rax + 8]
mov rax, qword [rax]
jmp 0x45dde0
jmp 0x4031c0

Function at 0x460ba0
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
nop
mov eax, dword [rax]
movabs rcx, 0xe7037ed1a0b428db
xor rcx, rax
xor rax, rbx
xor rax, qword [0x00842b80]
movabs rdx, 0xa0761d6478bd642f
xor rdx, rax
mov rax, rcx
mul rdx
xor rax, rdx
mov rcx, rax
movabs rax, 0x1d8e4e27c47d124b
mul rcx
xor rax, rdx
nop
nop
ret
cmp byte [0x0084286c], 0
je 0x460bd5
movq xmm0, rbx
pinsrd xmm0, dword [rax], 2
aesenc xmm0, xmmword [0x00842ea0]
aesenc xmm0, xmmword [0x00842eb0]
aesenc xmm0, xmmword [0x00842ec0]
movq rax, xmm0
ret
jmp 0x408e80

Function at 0x460be0
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
nop
mov rax, qword [rax]
movabs rcx, 0xe7037ed1a0b428db
xor rcx, rax
xor rax, rbx
xor rax, qword [0x00842b80]
movabs rdx, 0xa0761d6478bd642f
xor rdx, rax
mov rax, rcx
mul rdx
xor rax, rdx
mov rcx, rax
movabs rax, 0x1d8e4e27c47d1247
mul rcx
xor rax, rdx
nop
nop
ret
cmp byte [0x0084286c], 0
je 0x460c16
movq xmm0, rbx
pinsrq xmm0, qword [rax], 1
aesenc xmm0, xmmword [0x00842ea0]
aesenc xmm0, xmmword [0x00842eb0]
aesenc xmm0, xmmword [0x00842ec0]
movq rax, xmm0
ret
jmp 0x408ee0

Function at 0x4628e0
Capabilities:
Allocate thread local storage

Disassembly:
push rbp
mov rbp, rsp
mov rax, rsp
and rsp, 0xfffffffffffffff0
sub rsp, 0x30
mov qword [rsp + 0x20], rax
mov rax, qword [sym.imp.kernel32.dll_TlsAlloc]
call rax
mov rsp, qword [rsp + 0x20]
mov rcx, rax
cmp rcx, 0x40
jb 0x462914
mov rcx, 0x28
jmp 0x46291f
shl rcx, 3
add rcx, 0x1480
mov qword [0x00842ac0], rcx
pop rbp
ret
Function at 0x46a2c0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x46a3dd
push rbp
mov rbp, rsp
sub rsp, 0x60
movabs rdx, 0xd3ca20dfd9dceb73
mov qword [rsp + 0x1e], rdx
movabs rdx, 0x65235e8e1f6e6f63
mov qword [rsp + 0x26], rdx
movabs rdx, 0x2f752c3829246523
mov qword [rsp + 0x2c], rdx
movabs rdx, 0xe07417d473a4201d
mov qword [rsp + 0x34], rdx
movabs rdx, 0xc0d1b060403100b
mov qword [rsp + 0x3c], rdx
movabs rdx, 0x20c0c060c0d1b06
mov qword [rsp + 0x40], rdx
movabs rdx, 0x1b1d120d16060717
mov qword [rsp + 0x48], rdx
movabs rdx, 0x1713120218021a11
mov qword [rsp + 0x50], rdx
movabs rdx, 0xc0e0315111b1801
mov qword [rsp + 0x58], rdx
xor eax, eax
jmp 0x46a380
movzx r9d, byte [rsp + rsi + 0x1e]
sub r9d, edx
lea edx, [r9 + 0x6a]
mov byte [rsp + rdi + 0x1e], dl
lea edx, [r8 + 0x6a]
mov byte [rsp + rsi + 0x1e], dl
add rax, 2
nop word [rax + rax]
cmp rax, 0x24
jge 0x46a3ad
movzx edx, byte [rsp + rax + 0x3c]
movzx esi, byte [rsp + rax + 0x3d]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x1e
jae 0x46a3d0
movzx r8d, byte [rsp + rdi + 0x1e]
sub r8d, edx
cmp rsi, 0x1e
jb 0x46a35d
jmp 0x46a3c4
xor eax, eax
lea rbx, [rsp + 0x1e]
mov ecx, 0x1e
call fcn.0044bb20
add rsp, 0x60
pop rbp
ret
mov eax, esi
mov ecx, 0x1e
call fcn.00461020
mov eax, edi
mov ecx, 0x1e
call fcn.00461020
nop
nop dword [rax]
call fcn.0045eda0
jmp fcn.0046a2c0

Function at 0x46d1e0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x46d29d
push rbp
mov rbp, rsp
sub rsp, 0x30
movabs rdx, 0x72d989bf737f61cf
mov qword [rsp + 0x1b], rdx
mov byte [rsp + 0x23], 0x68
movabs rdx, 0x206000006040006
mov qword [rsp + 0x24], rdx
mov dword [rsp + 0x2c], 0x7000405
xor eax, eax
nop
jmp 0x46d240
movzx r9d, byte [rsp + rsi + 0x1b]
sub r9d, edx
lea edx, [r9 - 0x1f]
mov byte [rsp + rdi + 0x1b], dl
lea edx, [r8 - 0x1f]
mov byte [rsp + rsi + 0x1b], dl
add rax, 2
nop
cmp rax, 0xc
jge 0x46d26d
movzx edx, byte [rsp + rax + 0x24]
movzx esi, byte [rsp + rax + 0x25]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 9
jae 0x46d290
movzx r8d, byte [rsp + rdi + 0x1b]
sub r8d, edx
cmp rsi, 9
jb 0x46d222
jmp 0x46d284
xor eax, eax
lea rbx, [rsp + 0x1b]
mov ecx, 9
call fcn.0044bb20
add rsp, 0x30
pop rbp
ret
mov eax, esi
mov ecx, 9
call fcn.00461020
mov eax, edi
mov ecx, 9
call fcn.00461020
nop
nop dword [rax]
call fcn.0045eda0
jmp fcn.0046d1e0
Function at 0x46d960
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x46da4a
push rbp
mov rbp, rsp
sub rsp, 0x40
movabs rdx, 0xad6fc064616561cd
mov qword [rsp + 0x19], rdx
movabs rdx, 0xd1da5fad6fc06461
mov qword [rsp + 0x1c], rdx
movabs rdx, 0x6c6131a72140726f
mov qword [rsp + 0x24], rdx
movabs rdx, 0xd050e0d0706020e
mov qword [rsp + 0x2c], rdx
movabs rdx, 0x10090e0e0d050e0d
mov qword [rsp + 0x30], rdx
movabs rdx, 0xa0202070e090f00
mov qword [rsp + 0x38], rdx
xor eax, eax
jmp 0x46d9ed
movzx r9d, byte [rsp + rsi + 0x19]
sub r9d, edx
lea edx, [r9 - 0x49]
mov byte [rsp + rdi + 0x19], dl
lea edx, [r8 - 0x49]
mov byte [rsp + rsi + 0x19], dl
add rax, 2
cmp rax, 0x14
jge 0x46da1a
movzx edx, byte [rsp + rax + 0x2c]
movzx esi, byte [rsp + rax + 0x2d]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x13
jae 0x46da3d
movzx r8d, byte [rsp + rdi + 0x19]
sub r8d, edx
cmp rsi, 0x13
jb 0x46d9d0
jmp 0x46da31
xor eax, eax
lea rbx, [rsp + 0x19]
mov ecx, 0x13
call fcn.0044bb20
add rsp, 0x40
pop rbp
ret
mov eax, esi
mov ecx, 0x13
call fcn.00461020
mov eax, edi
mov ecx, 0x13
call fcn.00461020
nop
call fcn.0045eda0
jmp fcn.0046d960

Function at 0x46eb60
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x46ec12
push rbp
mov rbp, rsp
sub rsp, 0x28
movabs rdx, 0x6e456957725f685c
mov qword [rsp + 0x20], rdx
movabs rdx, 0x104060001020400
mov qword [rsp + 0x18], rdx
xor eax, eax
jmp 0x46ebb1
movzx r9d, byte [rsp + rsi + 0x20]
sub r9d, edx
lea edx, [r9 + 0xc]
mov byte [rsp + rdi + 0x20], dl
lea edx, [r8 + 0xc]
mov byte [rsp + rsi + 0x20], dl
add rax, 2
cmp rax, 8
jge 0x46ebde
movzx edx, byte [rsp + rax + 0x18]
movzx esi, byte [rsp + rax + 0x19]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 8
jae 0x46ec05
movzx r8d, byte [rsp + rdi + 0x20]
sub r8d, edx
cmp rsi, 8
jb 0x46eb94
jmp 0x46ebf5
xor eax, eax
lea rbx, [rsp + 0x20]
mov ecx, 8
call fcn.0044bb20
add rsp, 0x28
pop rbp
ret
mov eax, esi
mov ecx, 8
nop dword [rax]
call fcn.00461020
mov eax, edi
mov ecx, 8
call fcn.00461020
nop
call fcn.0045eda0
jmp fcn.0046eb60

Function at 0x46f280
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x46f338
push rbp
mov rbp, rsp
sub rsp, 0x30
movabs rdx, 0xd2d63f4eb4446948
mov qword [rsp + 0x1c], rdx
movabs rdx, 0x604050205040305
mov qword [rsp + 0x24], rdx
mov dword [rsp + 0x2c], 0x3030507
xor eax, eax
jmp 0x46f2d9
movzx r9d, byte [rsp + rsi + 0x1c]
sub r9d, edx
lea edx, [r9 - 0x67]
mov byte [rsp + rdi + 0x1c], dl
lea edx, [r8 - 0x67]
mov byte [rsp + rsi + 0x1c], dl
add rax, 2
cmp rax, 0xc
jge 0x46f308
movzx edx, byte [rsp + rax + 0x24]
movzx esi, byte [rsp + rax + 0x25]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 8
jae 0x46f32b
movzx r8d, byte [rsp + rdi + 0x1c]
sub r8d, edx
nop
cmp rsi, 8
jb 0x46f2bc
jmp 0x46f31f
xor eax, eax
lea rbx, [rsp + 0x1c]
mov ecx, 8
call fcn.0044bb20
add rsp, 0x30
pop rbp
ret
mov eax, esi
mov ecx, 8
call fcn.00461020
mov eax, edi
mov ecx, 8
call fcn.00461020
nop
call fcn.0045eda0
nop dword [rax]
jmp fcn.0046f280
Function at 0x470440
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x470506
push rbp
mov rbp, rsp
sub rsp, 0x30
movabs rdx, 0x86ab8461b2698283
mov qword [rsp + 0x1d], rdx
mov byte [rsp + 0x25], 0x92
movabs rdx, 0x3010707060508
mov qword [rsp + 0x26], rdx
mov word [rsp + 0x2e], 2
xor eax, eax
nop
jmp 0x4704a0
movzx r9d, byte [rsp + rsi + 0x1d]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x28]
mov byte [rsp + rdi + 0x1d], dl
mov byte [rsp + rsi + 0x1d], r8b
add rax, 2
nop dword [rax]
cmp rax, 0xa
jge 0x4704d2
movzx edx, byte [rsp + rax + 0x26]
movzx esi, byte [rsp + rax + 0x27]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 9
jae 0x4704f7
movzx r8d, byte [rsp + rdi + 0x1d]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x28]
cmp rsi, 9
jb 0x470482
jmp 0x4704eb
xor eax, eax
lea rbx, [rsp + 0x1d]
mov ecx, 9
nop
call fcn.0044bb20
add rsp, 0x30
pop rbp
ret
mov eax, esi
mov ecx, 9
call fcn.00461020
mov eax, edi
mov ecx, 9
nop
call fcn.00461020
nop
call fcn.0045eda0
jmp fcn.00470440

Function at 0x470520
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4705d2
push rbp
mov rbp, rsp
sub rsp, 0x28
movabs rdx, 0x4102474e54413c42
mov qword [rsp + 0x20], rdx
movabs rdx, 0x305020401000106
mov qword [rsp + 0x18], rdx
xor eax, eax
jmp 0x470571
movzx r9d, byte [rsp + rsi + 0x20]
sub r9d, edx
lea edx, [r9 + 0x2a]
mov byte [rsp + rdi + 0x20], dl
lea edx, [r8 + 0x2a]
mov byte [rsp + rsi + 0x20], dl
add rax, 2
cmp rax, 8
jge 0x47059e
movzx edx, byte [rsp + rax + 0x18]
movzx esi, byte [rsp + rax + 0x19]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 8
jae 0x4705c5
movzx r8d, byte [rsp + rdi + 0x20]
sub r8d, edx
cmp rsi, 8
jb 0x470554
jmp 0x4705b5
xor eax, eax
lea rbx, [rsp + 0x20]
mov ecx, 8
call fcn.0044bb20
add rsp, 0x28
pop rbp
ret
mov eax, esi
mov ecx, 8
nop dword [rax]
call fcn.00461020
mov eax, edi
mov ecx, 8
call fcn.00461020
nop
call fcn.0045eda0
jmp fcn.00470520

Function at 0x4714e0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4715cc
push rbp
mov rbp, rsp
sub rsp, 0x48
movabs rdx, 0x38692a0e1e721130
mov qword [rsp + 0x1e], rdx
movabs rdx, 0xbf35245f38692a0e
mov qword [rsp + 0x22], rdx
movabs rdx, 0x73152b476c673d2a
mov qword [rsp + 0x2a], rdx
movabs rdx, 0x120004010d0b0103
mov qword [rsp + 0x32], rdx
movabs rdx, 0x7030710110d1200
mov qword [rsp + 0x38], rdx
movabs rdx, 0x91103110a05010c
mov qword [rsp + 0x40], rdx
xor eax, eax
jmp 0x47156a
movzx r9d, byte [rsp + rsi + 0x1e]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x20]
mov byte [rsp + rdi + 0x1e], dl
mov byte [rsp + rsi + 0x1e], r8b
add rax, 2
cmp rax, 0x16
jge 0x47159c
movzx edx, byte [rsp + rax + 0x32]
movzx esi, byte [rsp + rax + 0x33]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x14
jae 0x4715bf
movzx r8d, byte [rsp + rdi + 0x1e]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x20]
cmp rsi, 0x14
jb 0x471550
jmp 0x4715b3
xor eax, eax
lea rbx, [rsp + 0x1e]
mov ecx, 0x14
call fcn.0044bb20
add rsp, 0x48
pop rbp
ret
mov eax, esi
mov ecx, 0x14
call fcn.00461020
mov eax, edi
mov ecx, 0x14
call fcn.00461020
nop
call fcn.0045eda0
jmp fcn.004714e0
Function at 0x471cc0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x471d8c
push rbp
mov rbp, rsp
sub rsp, 0x30
movabs rdx, 0x5f382d373324f121
mov qword [rsp + 0x19], rdx
movabs rdx, 0x65754c5f382d3733
mov qword [rsp + 0x1c], rdx
movabs rdx, 0x103030200050304
mov qword [rsp + 0x24], rdx
mov dword [rsp + 0x2c], 0x6050603
xor eax, eax
jmp 0x471d25
movzx r9d, byte [rsp + rsi + 0x19]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x1a]
mov byte [rsp + rdi + 0x19], dl
mov byte [rsp + rsi + 0x19], r8b
add rax, 2
cmp rax, 0xc
jge 0x471d5c
movzx edx, byte [rsp + rax + 0x24]
movzx esi, byte [rsp + rax + 0x25]
mov edi, edx
xor edx, esi
add edx, eax
nop dword [rax + rax]
cmp rdi, 0xb
jae 0x471d7f
movzx r8d, byte [rsp + rdi + 0x19]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x1a]
cmp rsi, 0xb
jb 0x471d0b
jmp 0x471d73
xor eax, eax
lea rbx, [rsp + 0x19]
mov ecx, 0xb
call fcn.0044bb20
add rsp, 0x30
pop rbp
ret
mov eax, esi
mov ecx, 0xb
call fcn.00461020
mov eax, edi
mov ecx, 0xb
call fcn.00461020
nop
call fcn.0045eda0
jmp fcn.00471cc0

Function at 0x473480
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x473546
push rbp
mov rbp, rsp
sub rsp, 0x30
movabs rdx, 0x8ca1818e806c7a50
mov qword [rsp + 0x1b], rdx
mov byte [rsp + 0x23], 0x65
movabs rdx, 0x107050307040604
mov qword [rsp + 0x24], rdx
mov dword [rsp + 0x2c], 0x6010603
xor eax, eax
nop
jmp 0x4734e0
movzx r9d, byte [rsp + rsi + 0x1b]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x18]
mov byte [rsp + rdi + 0x1b], dl
mov byte [rsp + rsi + 0x1b], r8b
add rax, 2
nop dword [rax]
cmp rax, 0xc
jge 0x473512
movzx edx, byte [rsp + rax + 0x24]
movzx esi, byte [rsp + rax + 0x25]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 9
jae 0x473537
movzx r8d, byte [rsp + rdi + 0x1b]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x18]
cmp rsi, 9
jb 0x4734c2
jmp 0x47352b
xor eax, eax
lea rbx, [rsp + 0x1b]
mov ecx, 9
nop
call fcn.0044bb20
add rsp, 0x30
pop rbp
ret
mov eax, esi
mov ecx, 9
call fcn.00461020
mov eax, edi
mov ecx, 9
nop
call fcn.00461020
nop
call fcn.0045eda0
jmp fcn.00473480

Function at 0x474420
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4744d8
push rbp
mov rbp, rsp
sub rsp, 0x30
movabs rdx, 0xba256111145d0d
mov qword [rsp + 0x1e], rdx
movabs rdx, 0x205050105060007
mov qword [rsp + 0x26], rdx
mov word [rsp + 0x2e], 0x203
xor eax, eax
jmp 0x474475
movzx r9d, byte [rsp + rsi + 0x1e]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x4d]
mov byte [rsp + rdi + 0x1e], dl
mov byte [rsp + rsi + 0x1e], r8b
add rax, 2
cmp rax, 0xa
jge 0x4744a8
movzx edx, byte [rsp + rax + 0x26]
movzx esi, byte [rsp + rax + 0x27]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 8
jae 0x4744cb
movzx r8d, byte [rsp + rdi + 0x1e]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x4d]
nop
cmp rsi, 8
jb 0x47445b
jmp 0x4744bf
xor eax, eax
lea rbx, [rsp + 0x1e]
mov ecx, 8
call fcn.0044bb20
add rsp, 0x30
pop rbp
ret
mov eax, esi
mov ecx, 8
call fcn.00461020
mov eax, edi
mov ecx, 8
call fcn.00461020
nop
call fcn.0045eda0
nop dword [rax]
jmp fcn.00474420
Function at 0x474500
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4745b8
push rbp
mov rbp, rsp
sub rsp, 0x30
movabs rdx, 0xeb202a54f2eb2b54
mov qword [rsp + 0x1e], rdx
movabs rdx, 0x306020502030707
mov qword [rsp + 0x26], rdx
mov word [rsp + 0x2e], 0x701
xor eax, eax
jmp 0x474555
movzx r9d, byte [rsp + rsi + 0x1e]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x34]
mov byte [rsp + rdi + 0x1e], dl
mov byte [rsp + rsi + 0x1e], r8b
add rax, 2
cmp rax, 0xa
jge 0x474588
movzx edx, byte [rsp + rax + 0x26]
movzx esi, byte [rsp + rax + 0x27]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 8
jae 0x4745ab
movzx r8d, byte [rsp + rdi + 0x1e]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x34]
nop
cmp rsi, 8
jb 0x47453b
jmp 0x47459f
xor eax, eax
lea rbx, [rsp + 0x1e]
mov ecx, 8
call fcn.0044bb20
add rsp, 0x30
pop rbp
ret
mov eax, esi
mov ecx, 8
call fcn.00461020
mov eax, edi
mov ecx, 8
call fcn.00461020
nop
call fcn.0045eda0
nop dword [rax]
jmp fcn.00474500

Function at 0x474d60
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x474e46
push rbp
mov rbp, rsp
sub rsp, 0x40
movabs rdx, 0xf87ad9f461ceb526
mov qword [rsp + 0x18], rdx
movabs rdx, 0x2d3801d471532b2c
mov qword [rsp + 0x20], rdx
movabs rdx, 0xd08010d0f0e0d04
mov qword [rsp + 0x28], rdx
movabs rdx, 0x20905070e020408
mov qword [rsp + 0x30], rdx
movabs rdx, 0x9070e00050c0c09
mov qword [rsp + 0x38], rdx
xor eax, eax
nop
jmp 0x474de0
movzx r9d, byte [rsp + rsi + 0x18]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x2a]
mov byte [rsp + rdi + 0x18], dl
mov byte [rsp + rsi + 0x18], r8b
add rax, 2
nop dword [rax]
cmp rax, 0x18
jge 0x474e12
movzx edx, byte [rsp + rax + 0x28]
movzx esi, byte [rsp + rax + 0x29]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x10
jae 0x474e37
movzx r8d, byte [rsp + rdi + 0x18]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x2a]
cmp rsi, 0x10
jb 0x474dc2
jmp 0x474e2b
xor eax, eax
lea rbx, [rsp + 0x18]
mov ecx, 0x10
nop
call fcn.0044bb20
add rsp, 0x40
pop rbp
ret
mov eax, esi
mov ecx, 0x10
call fcn.00461020
mov eax, edi
mov ecx, 0x10
nop
call fcn.00461020
nop
call fcn.0045eda0
jmp fcn.00474d60

Function at 0x475160
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x475226
push rbp
mov rbp, rsp
sub rsp, 0x30
movabs rdx, 0xf935361172706519
mov qword [rsp + 0x1a], rdx
mov word [rsp + 0x22], 0x1c34
movabs rdx, 0x407050806090700
mov qword [rsp + 0x24], rdx
mov dword [rsp + 0x2c], 0x6070000
xor eax, eax
jmp 0x4751c0
movzx r9d, byte [rsp + rsi + 0x1a]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x1e]
mov byte [rsp + rdi + 0x1a], dl
mov byte [rsp + rsi + 0x1a], r8b
add rax, 2
nop dword [rax]
cmp rax, 0xc
jge 0x4751f2
movzx edx, byte [rsp + rax + 0x24]
movzx esi, byte [rsp + rax + 0x25]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0xa
jae 0x475217
movzx r8d, byte [rsp + rdi + 0x1a]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x1e]
cmp rsi, 0xa
jb 0x4751a3
jmp 0x47520b
xor eax, eax
lea rbx, [rsp + 0x1a]
mov ecx, 0xa
nop
call fcn.0044bb20
add rsp, 0x30
pop rbp
ret
mov eax, esi
mov ecx, 0xa
call fcn.00461020
mov eax, edi
mov ecx, 0xa
nop
call fcn.00461020
nop
call fcn.0045eda0
jmp fcn.00475160
Function at 0x476400
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4764fb
push rbp
mov rbp, rsp
sub rsp, 0x50
movabs rdx, 0x5f6c619a692188a7
mov qword [rsp + 0x1f], rdx
movabs rdx, 0xc15f7b6fb89b4f5f
mov qword [rsp + 0x26], rdx
movabs rdx, 0xb0d3cd747065b3e7
mov qword [rsp + 0x2e], rdx
movabs rdx, 0xa09020a16000f0e
mov qword [rsp + 0x36], rdx
movabs rdx, 0x1514151401100e0c
mov qword [rsp + 0x3e], rdx
movabs rdx, 0x401151415140110
mov qword [rsp + 0x40], rdx
movabs rdx, 0xf02160209160b00
mov qword [rsp + 0x48], rdx
xor eax, eax
jmp 0x476499
movzx r9d, byte [rsp + rsi + 0x1f]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x40]
mov byte [rsp + rdi + 0x1f], dl
mov byte [rsp + rsi + 0x1f], r8b
add rax, 2
cmp rax, 0x1a
jge 0x4764cb
movzx edx, byte [rsp + rax + 0x36]
movzx esi, byte [rsp + rax + 0x37]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x17
jae 0x4764ee
movzx r8d, byte [rsp + rdi + 0x1f]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x40]
cmp rsi, 0x17
jb 0x47647f
jmp 0x4764e2
xor eax, eax
lea rbx, [rsp + 0x1f]
mov ecx, 0x17
call fcn.0044bb20
add rsp, 0x50
pop rbp
ret
mov eax, esi
mov ecx, 0x17
call fcn.00461020
mov eax, edi
mov ecx, 0x17
call fcn.00461020
nop
nop dword [rax + rax]
call fcn.0045eda0
jmp fcn.00476400

Function at 0x477ec0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x477faa
push rbp
mov rbp, rsp
sub rsp, 0x40
movabs rdx, 0x5f6972747f8d8f73
mov qword [rsp + 0x19], rdx
movabs rdx, 0x6968575f6972747f
mov qword [rsp + 0x1c], rdx
movabs rdx, 0x659e627860736574
mov qword [rsp + 0x24], rdx
movabs rdx, 0xe0d010d0d11030d
mov qword [rsp + 0x2c], rdx
movabs rdx, 0x100006020e0d010d
mov qword [rsp + 0x30], rdx
movabs rdx, 0x103040f0e020604
mov qword [rsp + 0x38], rdx
xor eax, eax
jmp 0x477f4d
movzx r9d, byte [rsp + rsi + 0x19]
sub r9d, edx
lea edx, [r9 + 8]
mov byte [rsp + rdi + 0x19], dl
lea edx, [r8 + 8]
mov byte [rsp + rsi + 0x19], dl
add rax, 2
cmp rax, 0x14
jge 0x477f7a
movzx edx, byte [rsp + rax + 0x2c]
movzx esi, byte [rsp + rax + 0x2d]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x13
jae 0x477f9d
movzx r8d, byte [rsp + rdi + 0x19]
sub r8d, edx
cmp rsi, 0x13
jb 0x477f30
jmp 0x477f91
xor eax, eax
lea rbx, [rsp + 0x19]
mov ecx, 0x13
call fcn.0044bb20
add rsp, 0x40
pop rbp
ret
mov eax, esi
mov ecx, 0x13
call fcn.00461020
mov eax, edi
mov ecx, 0x13
call fcn.00461020
nop
call fcn.0045eda0
jmp fcn.00477ec0
Function at 0x47d0a0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
lea r12, [rsp - 0x10]
cmp r12, qword [r14 + 0x10]
jbe 0x47d212
push rbp
mov rbp, rsp
sub rsp, 0x88
movabs rdx, 0x7542f8732ac8460a
mov qword [rsp + 0x52], rdx
movabs rdx, 0x20e272d0e3667542
mov qword [rsp + 0x58], rdx
movabs rdx, 0x7215723b4d3df572
mov qword [rsp + 0x60], rdx
movabs rdx, 0x205a141efa0d474a
mov qword [rsp + 0x68], rdx
movabs rdx, 0x2361d216167281b
mov qword [rsp + 0x70], rdx
movabs rdx, 0x666c2d50756f632c
mov qword [rsp + 0x78], rdx
movabs rdx, 0x5b544c52016d6fc2
mov qword [rsp + 0x80], rdx
movabs rdx, 0x2b001b0a02181816
mov qword [rsp + 0x1c], rdx
movabs rdx, 0x2e22220f03262b00
mov qword [rsp + 0x22], rdx
movabs rdx, 0x3501091f140c221c
mov qword [rsp + 0x2a], rdx
movabs rdx, 0x2a1c0f3423251905
mov qword [rsp + 0x32], rdx
movabs rdx, 0x17021812242a1f1b
mov qword [rsp + 0x3a], rdx
movabs rdx, 0x1133170c19101231
mov qword [rsp + 0x42], rdx
movabs rdx, 0x2b23311e26122c1a
mov qword [rsp + 0x4a], rdx
xor eax, eax
jmp 0x47d1b0
movzx r9d, byte [rsp + rsi + 0x52]
sub r9d, edx
lea edx, [r9 + 0x66]
mov byte [rsp + rdi + 0x52], dl
lea edx, [r8 + 0x66]
mov byte [rsp + rsi + 0x52], dl
add rax, 2
cmp rax, 0x36
jge 0x47d1dd
movzx edx, byte [rsp + rax + 0x1c]
movzx esi, byte [rsp + rax + 0x1d]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x36
jae 0x47d205
movzx r8d, byte [rsp + rdi + 0x52]
sub r8d, edx
cmp rsi, 0x36
jb 0x47d193
jmp 0x47d1f7
xor eax, eax
lea rbx, [rsp + 0x52]
mov ecx, 0x36
call fcn.0044bb20
add rsp, 0x88
pop rbp
ret
mov eax, esi
mov ecx, 0x36
nop
call fcn.00461020
mov eax, edi
mov ecx, 0x36
call fcn.00461020
nop
call fcn.0045eda0
jmp fcn.0047d0a0