joyce8/EMBER2024-capa huggingface dataset:
Function at 0x452da0
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4027cf
sub rsp, 0x20
mov qword [rsp + 0x18], rbp
lea rbp, [rsp + 0x18]
mov rdx, qword [rax]
mov rcx, qword [rax + 8]
mov rax, rdx
nop
call fcn.00407de0
mov rbp, qword [rsp + 0x18]
add rsp, 0x20
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.00450d00
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp 0x4027a0
cmp byte [0x0078a6ae], 0
je 0x452db5
mov rcx, qword [rax + 8]
mov rax, qword [rax]
jmp 0x44fe00
jmp 0x4027a0

Function at 0x452dc0
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
mov eax, dword [rax]
movabs rcx, 0xe7037ed1a0b428db
xor rcx, rax
xor rax, rbx
xor rax, qword [0x0078a980]
movabs rdx, 0xa0761d6478bd642f
xor rdx, rax
mov rax, rcx
mul rdx
xor rax, rdx
mov rcx, rax
movabs rax, 0x1d8e4e27c47d124b
mul rcx
nop
nop
xor rax, rdx
ret
cmp byte [0x0078a6ae], 0
je 0x452df5
movq xmm0, rbx
pinsrd xmm0, dword [rax], 2
aesenc xmm0, xmmword [0x0078ad00]
aesenc xmm0, xmmword [0x0078ad10]
aesenc xmm0, xmmword [0x0078ad20]
movq rax, xmm0
ret
jmp 0x407fe0

Function at 0x452e00
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
mov rax, qword [rax]
movabs rcx, 0xe7037ed1a0b428db
xor rcx, rax
xor rax, rbx
xor rax, qword [0x0078a980]
movabs rdx, 0xa0761d6478bd642f
xor rdx, rax
mov rax, rcx
mul rdx
xor rax, rdx
mov rcx, rax
movabs rax, 0x1d8e4e27c47d1247
mul rcx
nop
nop
xor rax, rdx
ret
cmp byte [0x0078a6ae], 0
je 0x452e36
movq xmm0, rbx
pinsrq xmm0, qword [rax], 1
aesenc xmm0, xmmword [0x0078ad00]
aesenc xmm0, xmmword [0x0078ad10]
aesenc xmm0, xmmword [0x0078ad20]
movq rax, xmm0
ret
jmp 0x408040

Function at 0x454820
Capabilities:
Write file on windows

Disassembly:
sub rsp, 0x30
mov rcx, 0xfffffffffffffff4
mov qword [rsp], rcx
mov rax, qword [sym.imp.kernel32.dll_GetStdHandle]
call rax
mov rcx, rax
mov qword [rsp], rcx
lea rdx, [0x0078ac80]
mov qword [rsp + 8], rdx
lea r8d, [0x0078a6c4]
mov qword [rsp + 0x10], r8
lea r9, [rsp + 0x28]
mov qword [r9], 0
mov qword [rsp + 0x18], r9
mov qword [rsp + 0x20], 0
mov rax, qword [sym.imp.kernel32.dll_WriteFile]
call rax
call fcn.00452ce0
add rsp, 0x30
ret

Function at 0x454d60
Capabilities:
Allocate thread local storage

Disassembly:
mov rax, rsp
and rsp, 0xfffffffffffffff0
sub rsp, 0x30
mov qword [rsp + 0x20], rax
mov rax, qword [sym.imp.kernel32.dll_TlsAlloc]
call rax
mov rsp, qword [rsp + 0x20]
mov rcx, rax
cmp rcx, 0x40
jb 0x454d8c
call fcn.00452ce0
shl rcx, 3
add rcx, 0x1480
mov qword [0x0078a878], rcx
ret
Function at 0x459620
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4596fc
sub rsp, 0x40
mov qword [rsp + 0x38], rbp
lea rbp, [rsp + 0x38]
movabs rdx, 0xe02e65e3dd736e51
mov qword [rsp + 0x2a], rdx
movabs rdx, 0xd7c750d2d54de02e
mov qword [rsp + 0x30], rdx
movabs rdx, 0xb000a0a0807000b
mov qword [rsp + 0x1c], rdx
movabs rdx, 0xc0703090d040b00
mov qword [rsp + 0x22], rdx
xor eax, eax
jmp 0x459695
movzx r9d, byte [rsp + rsi + 0x2a]
sub r9d, edx
lea edx, [r9 - 0x60]
mov byte [rsp + rdi + 0x2a], dl
lea edx, [r8 - 0x60]
mov byte [rsp + rsi + 0x2a], dl
add rax, 2
cmp rax, 0xe
jge 0x4596c8
movzx edx, byte [rsp + rax + 0x1c]
movzx esi, byte [rsp + rax + 0x1d]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0xe
jae 0x4596ef
movzx r8d, byte [rsp + rdi + 0x2a]
sub r8d, edx
nop word [rax + rax]
cmp rsi, 0xe
jb 0x459678
jmp 0x4596e3
xor eax, eax
lea rbx, [rsp + 0x2a]
mov ecx, 0xe
call fcn.00441820
mov rbp, qword [rsp + 0x38]
add rsp, 0x40
ret
mov eax, esi
mov ecx, 0xe
call fcn.00453360
mov eax, edi
mov ecx, 0xe
call fcn.00453360
nop
nop dword [rax]
call fcn.00450d00
jmp fcn.00459620

Function at 0x45d220
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x45d316
sub rsp, 0x50
mov qword [rsp + 0x48], rbp
lea rbp, [rsp + 0x48]
movabs rdx, 0x326f59df0cc0c576
mov qword [rsp + 0x1e], rdx
movabs rdx, 0x2074326f59df0cc0
mov qword [rsp + 0x20], rdx
movabs rdx, 0xdeda6e61726ad56f
mov qword [rsp + 0x28], rdx
movabs rdx, 0x101104070302070c
mov qword [rsp + 0x30], rdx
movabs rdx, 0x4020b0705050111
mov qword [rsp + 0x38], rdx
movabs rdx, 0xb01100c0510010b
mov qword [rsp + 0x40], rdx
xor eax, eax
jmp 0x45d2b3
movzx r9d, byte [rsp + rsi + 0x1e]
sub r9d, edx
lea edx, [r9 - 0x48]
mov byte [rsp + rdi + 0x1e], dl
lea edx, [r8 - 0x48]
mov byte [rsp + rsi + 0x1e], dl
add rax, 2
cmp rax, 0x18
jge 0x45d2e2
movzx edx, byte [rsp + rax + 0x30]
movzx esi, byte [rsp + rax + 0x31]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x12
jae 0x45d309
movzx r8d, byte [rsp + rdi + 0x1e]
sub r8d, edx
cmp rsi, 0x12
jb 0x45d296
nop
jmp 0x45d2fd
xor eax, eax
lea rbx, [rsp + 0x1e]
mov ecx, 0x12
call fcn.00441820
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
mov eax, esi
mov ecx, 0x12
call fcn.00453360
mov eax, edi
mov ecx, 0x12
call fcn.00453360
nop
call fcn.00450d00
nop dword [rax + rax]
jmp fcn.0045d220
Function at 0x45d8c0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x45d986
sub rsp, 0x38
mov qword [rsp + 0x30], rbp
lea rbp, [rsp + 0x30]
movabs rdx, 0xc232fac6fefd388b
mov qword [rsp + 0x1e], rdx
movabs rdx, 0x205070204050700
mov qword [rsp + 0x26], rdx
mov word [rsp + 0x2e], 0x300
xor eax, eax
nop
jmp 0x45d920
movzx r9d, byte [rsp + rsi + 0x1e]
sub r9d, edx
lea edx, [r9 + 0x41]
mov byte [rsp + rdi + 0x1e], dl
lea edx, [r8 + 0x41]
mov byte [rsp + rsi + 0x1e], dl
add rax, 2
nop
cmp rax, 0xa
jge 0x45d94d
movzx edx, byte [rsp + rax + 0x26]
movzx esi, byte [rsp + rax + 0x27]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 8
jae 0x45d974
movzx r8d, byte [rsp + rdi + 0x1e]
sub r8d, edx
cmp rsi, 8
jb 0x45d902
jmp 0x45d968
xor eax, eax
lea rbx, [rsp + 0x1e]
mov ecx, 8
call fcn.00441820
mov rbp, qword [rsp + 0x30]
add rsp, 0x38
ret
mov eax, esi
mov ecx, 8
call fcn.00453360
mov eax, edi
mov ecx, 8
nop dword [rax + rax]
call fcn.00453360
nop
call fcn.00450d00
jmp fcn.0045d8c0

Function at 0x45dec0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x45df8b
sub rsp, 0x38
mov qword [rsp + 0x30], rbp
lea rbp, [rsp + 0x30]
movabs rdx, 0x365997639b886862
mov qword [rsp + 0x1a], rdx
mov word [rsp + 0x22], 0x6f61
movabs rdx, 0x400060302060805
mov qword [rsp + 0x24], rdx
mov dword [rsp + 0x2c], 0x8010906
xor eax, eax
jmp 0x45df26
movzx r9d, byte [rsp + rsi + 0x1a]
sub r9d, edx
lea edx, [r9 - 0x23]
mov byte [rsp + rdi + 0x1a], dl
lea edx, [r8 - 0x23]
mov byte [rsp + rsi + 0x1a], dl
add rax, 2
cmp rax, 0xc
jge 0x45df57
movzx edx, byte [rsp + rax + 0x24]
movzx esi, byte [rsp + rax + 0x25]
mov edi, edx
xor edx, esi
add edx, eax
nop dword [rax]
cmp rdi, 0xa
jae 0x45df7e
movzx r8d, byte [rsp + rdi + 0x1a]
sub r8d, edx
cmp rsi, 0xa
jb 0x45df09
jmp 0x45df72
xor eax, eax
lea rbx, [rsp + 0x1a]
mov ecx, 0xa
call fcn.00441820
mov rbp, qword [rsp + 0x30]
add rsp, 0x38
ret
mov eax, esi
mov ecx, 0xa
call fcn.00453360
mov eax, edi
mov ecx, 0xa
call fcn.00453360
nop
call fcn.00450d00
jmp fcn.0045dec0
Function at 0x45f2e0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x45f3d6
sub rsp, 0x48
mov qword [rsp + 0x40], rbp
lea rbp, [rsp + 0x40]
movabs rdx, 0xe02e338c308687dc
mov qword [rsp + 0x18], rdx
movabs rdx, 0x3884e02e338c3086
mov qword [rsp + 0x1a], rdx
movabs rdx, 0xe9929297353936e5
mov qword [rsp + 0x22], rdx
movabs rdx, 0x211000f06060108
mov qword [rsp + 0x2a], rdx
movabs rdx, 0x70e111006040211
mov qword [rsp + 0x30], rdx
movabs rdx, 0x806010411070a
mov qword [rsp + 0x38], rdx
xor eax, eax
jmp 0x45f373
movzx r9d, byte [rsp + rsi + 0x18]
sub r9d, edx
lea edx, [r9 + 0x68]
mov byte [rsp + rdi + 0x18], dl
lea edx, [r8 + 0x68]
mov byte [rsp + rsi + 0x18], dl
add rax, 2
cmp rax, 0x16
jge 0x45f3a2
movzx edx, byte [rsp + rax + 0x2a]
movzx esi, byte [rsp + rax + 0x2b]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x12
jae 0x45f3c9
movzx r8d, byte [rsp + rdi + 0x18]
sub r8d, edx
cmp rsi, 0x12
jb 0x45f356
nop
jmp 0x45f3bd
xor eax, eax
lea rbx, [rsp + 0x18]
mov ecx, 0x12
call fcn.00441820
mov rbp, qword [rsp + 0x40]
add rsp, 0x48
ret
mov eax, esi
mov ecx, 0x12
call fcn.00453360
mov eax, edi
mov ecx, 0x12
call fcn.00453360
nop
call fcn.00450d00
nop dword [rax + rax]
jmp fcn.0045f2e0

Function at 0x45f400
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x45f4f6
sub rsp, 0x50
mov qword [rsp + 0x48], rbp
lea rbp, [rsp + 0x48]
movabs rdx, 0x71433148308b3431
mov qword [rsp + 0x1f], rdx
movabs rdx, 0x4139317143314830
mov qword [rsp + 0x22], rdx
movabs rdx, 0x4161363844494735
mov qword [rsp + 0x2a], rdx
movabs rdx, 0xa0d0c020a0d0f0b
mov qword [rsp + 0x32], rdx
movabs rdx, 0xd070d0c070c0a0d
mov qword [rsp + 0x38], rdx
movabs rdx, 0x6040d111212070e
mov qword [rsp + 0x40], rdx
xor eax, eax
jmp 0x45f493
movzx r9d, byte [rsp + rsi + 0x1f]
sub r9d, edx
lea edx, [r9 + 4]
mov byte [rsp + rdi + 0x1f], dl
lea edx, [r8 + 4]
mov byte [rsp + rsi + 0x1f], dl
add rax, 2
cmp rax, 0x16
jge 0x45f4c2
movzx edx, byte [rsp + rax + 0x32]
movzx esi, byte [rsp + rax + 0x33]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x13
jae 0x45f4e9
movzx r8d, byte [rsp + rdi + 0x1f]
sub r8d, edx
cmp rsi, 0x13
jb 0x45f476
nop
jmp 0x45f4dd
xor eax, eax
lea rbx, [rsp + 0x1f]
mov ecx, 0x13
call fcn.00441820
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
mov eax, esi
mov ecx, 0x13
call fcn.00453360
mov eax, edi
mov ecx, 0x13
call fcn.00453360
nop
call fcn.00450d00
nop dword [rax + rax]
jmp fcn.0045f400
Function at 0x45fe40
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x45ff36
sub rsp, 0x50
mov qword [rsp + 0x48], rbp
lea rbp, [rsp + 0x48]
movabs rdx, 0xf6320a36f1df36d3
mov qword [rsp + 0x1a], rdx
movabs rdx, 0x3337edfcbd71f632
mov qword [rsp + 0x20], rdx
movabs rdx, 0x35f5cb38373585fc
mov qword [rsp + 0x28], rdx
movabs rdx, 0x205080f08020809
mov qword [rsp + 0x30], rdx
movabs rdx, 0xb13140313130009
mov qword [rsp + 0x38], rdx
movabs rdx, 0xa0708070e09000a
mov qword [rsp + 0x40], rdx
xor eax, eax
jmp 0x45fed0
movzx r9d, byte [rsp + rsi + 0x1a]
add r9d, 0x1e
add edx, r9d
mov byte [rsp + rdi + 0x1a], dl
mov byte [rsp + rsi + 0x1a], r8b
add rax, 2
cmp rax, 0x18
jge 0x45ff02
movzx edx, byte [rsp + rax + 0x30]
movzx esi, byte [rsp + rax + 0x31]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x16
jae 0x45ff29
movzx r8d, byte [rsp + rdi + 0x1a]
add r8d, 0x1e
add r8d, edx
cmp rsi, 0x16
jb 0x45feb6
nop
jmp 0x45ff1d
xor eax, eax
lea rbx, [rsp + 0x1a]
mov ecx, 0x16
call fcn.00441820
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
mov eax, esi
mov ecx, 0x16
call fcn.00453360
mov eax, edi
mov ecx, 0x16
call fcn.00453360
nop
call fcn.00450d00
nop dword [rax + rax]
jmp fcn.0045fe40
Function at 0x4616e0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4617f3
sub rsp, 0x58
mov qword [rsp + 0x50], rbp
lea rbp, [rsp + 0x50]
movabs rdx, 0x96393810a531a8a0
mov qword [rsp + 0x34], rdx
movabs rdx, 0xa78d9735a435a230
mov qword [rsp + 0x3c], rdx
movabs rdx, 0x9fc0a196a78d9735
mov qword [rsp + 0x40], rdx
movabs rdx, 0x93a331a29592b7b7
mov qword [rsp + 0x48], rdx
movabs rdx, 0xb11131218141b01
mov qword [rsp + 0x18], rdx
movabs rdx, 0xd150104091a1415
mov qword [rsp + 0x20], rdx
movabs rdx, 0x30f12000d150104
mov qword [rsp + 0x24], rdx
movabs rdx, 0x1170e1600041007
mov qword [rsp + 0x2c], rdx
xor eax, eax
jmp 0x46178e
movzx r9d, byte [rsp + rsi + 0x34]
add r9d, 0x73
add edx, r9d
mov byte [rsp + rdi + 0x34], dl
mov byte [rsp + rsi + 0x34], r8b
add rax, 2
cmp rax, 0x1c
jge 0x4617bf
movzx edx, byte [rsp + rax + 0x18]
movzx esi, byte [rsp + rax + 0x19]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x1c
jae 0x4617e6
movzx r8d, byte [rsp + rdi + 0x34]
add r8d, 0x73
add r8d, edx
cmp rsi, 0x1c
jb 0x461774
jmp 0x4617da
xor eax, eax
lea rbx, [rsp + 0x34]
mov ecx, 0x1c
call fcn.00441820
mov rbp, qword [rsp + 0x50]
add rsp, 0x58
ret
mov eax, esi
mov ecx, 0x1c
call fcn.00453360
mov eax, edi
mov ecx, 0x1c
call fcn.00453360
nop
call fcn.00450d00
jmp fcn.004616e0
Function at 0x462b00
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x462c32
sub rsp, 0x68
mov qword [rsp + 0x60], rbp
lea rbp, [rsp + 0x60]
movabs rdx, 0x6f35d230d37ddbc3
mov qword [rsp + 0x19], rdx
movabs rdx, 0x376f35d230d37ddb
mov qword [rsp + 0x1a], rdx
movabs rdx, 0xee6cd132dddb6831
mov qword [rsp + 0x22], rdx
movabs rdx, 0xc889ec62edb5b237
mov qword [rsp + 0x2a], rdx
movabs rdx, 0x6f32a13590d528d5
mov qword [rsp + 0x32], rdx
movabs rdx, 0x101a1c1e13122018
mov qword [rsp + 0x3a], rdx
movabs rdx, 0x16120b1c0217101a
mov qword [rsp + 0x40], rdx
movabs rdx, 0xf170c021b051413
mov qword [rsp + 0x48], rdx
movabs rdx, 0x151918100317170a
mov qword [rsp + 0x50], rdx
movabs rdx, 0x1918011e0e0701
mov qword [rsp + 0x58], rdx
xor eax, eax
jmp 0x462bcc
movzx r9d, byte [rsp + rsi + 0x19]
add r9d, 0x35
add edx, r9d
mov byte [rsp + rdi + 0x19], dl
mov byte [rsp + rsi + 0x19], r8b
add rax, 2
cmp rax, 0x26
jge 0x462bfd
movzx edx, byte [rsp + rax + 0x3a]
movzx esi, byte [rsp + rax + 0x3b]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x21
jae 0x462c25
movzx r8d, byte [rsp + rdi + 0x19]
add r8d, 0x35
add r8d, edx
cmp rsi, 0x21
jb 0x462bb2
jmp 0x462c18
xor eax, eax
lea rbx, [rsp + 0x19]
mov ecx, 0x21
call fcn.00441820
mov rbp, qword [rsp + 0x60]
add rsp, 0x68
ret
mov eax, esi
mov ecx, 0x21
nop
call fcn.00453360
mov eax, edi
mov ecx, 0x21
call fcn.00453360
nop
call fcn.00450d00
jmp fcn.00462b00

Function at 0x463880
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4639c6
sub rsp, 0x78
mov qword [rsp + 0x70], rbp
lea rbp, [rsp + 0x70]
movabs rdx, 0x31cd31e4e035a2d6
mov qword [rsp + 0x1e], rdx
movabs rdx, 0x37358baeaa3231cd
mov qword [rsp + 0x24], rdx
movabs rdx, 0x4231319d30c23204
mov qword [rsp + 0x2c], rdx
movabs rdx, 0xf7f9c6a1fd835b2
mov qword [rsp + 0x34], rdx
movabs rdx, 0x88921b9a31c18e34
mov qword [rsp + 0x3c], rdx
movabs rdx, 0x403101c001f1222
mov qword [rsp + 0x44], rdx
movabs rdx, 0x1c1f03251a06180b
mov qword [rsp + 0x4c], rdx
movabs rdx, 0x23010e0b1c1f0325
mov qword [rsp + 0x50], rdx
movabs rdx, 0x31906192416041b
mov qword [rsp + 0x58], rdx
movabs rdx, 0x9161d16161a1520
mov qword [rsp + 0x60], rdx
movabs rdx, 0xa1d1a011906200b
mov qword [rsp + 0x68], rdx
xor eax, eax
nop
jmp 0x463960
movzx r9d, byte [rsp + rsi + 0x1e]
sub r9d, edx
lea edx, [r9 - 0x38]
mov byte [rsp + rdi + 0x1e], dl
lea edx, [r8 - 0x38]
mov byte [rsp + rsi + 0x1e], dl
add rax, 2
nop
cmp rax, 0x2c
jge 0x46398d
movzx edx, byte [rsp + rax + 0x44]
movzx esi, byte [rsp + rax + 0x45]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x26
jae 0x4639b4
movzx r8d, byte [rsp + rdi + 0x1e]
sub r8d, edx
cmp rsi, 0x26
jb 0x463942
jmp 0x4639a8
xor eax, eax
lea rbx, [rsp + 0x1e]
mov ecx, 0x26
call fcn.00441820
mov rbp, qword [rsp + 0x70]
add rsp, 0x78
ret
mov eax, esi
mov ecx, 0x26
call fcn.00453360
mov eax, edi
mov ecx, 0x26
nop dword [rax + rax]
call fcn.00453360
nop
call fcn.00450d00
jmp fcn.00463880
Function at 0x464140
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x464292
add rsp, 0xffffffffffffff80
mov qword [rsp + 0x78], rbp
lea rbp, [rsp + 0x78]
movabs rdx, 0xa8728fc5347f37db
mov qword [rsp + 0x1e], rdx
movabs rdx, 0x3c5b38363db53537
mov qword [rsp + 0x26], rdx
movabs rdx, 0x83da3c5b38363db5
mov qword [rsp + 0x28], rdx
movabs rdx, 0x8e7e866431d1cdb5
mov qword [rsp + 0x30], rdx
movabs rdx, 0x404979813988b088
mov qword [rsp + 0x38], rdx
movabs rdx, 0x9c323138c8389540
mov qword [rsp + 0x40], rdx
movabs rdx, 0x1a040011141a1c29
mov qword [rsp + 0x48], rdx
movabs rdx, 0x2325021211191b10
mov qword [rsp + 0x50], rdx
movabs rdx, 0xa07181e021c1a13
mov qword [rsp + 0x58], rdx
movabs rdx, 0x102005170e291b1a
mov qword [rsp + 0x60], rdx
movabs rdx, 0x21231722211f0a16
mov qword [rsp + 0x68], rdx
movabs rdx, 0x250b0f2022050706
mov qword [rsp + 0x70], rdx
xor eax, eax
jmp 0x46422a
movzx r9d, byte [rsp + rsi + 0x1e]
add r9d, 0xffffff99
add edx, r9d
mov byte [rsp + rdi + 0x1e], dl
mov byte [rsp + rsi + 0x1e], r8b
add rax, 2
cmp rax, 0x30
jge 0x46425b
movzx edx, byte [rsp + rax + 0x48]
movzx esi, byte [rsp + rax + 0x49]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x2a
jae 0x464285
movzx r8d, byte [rsp + rdi + 0x1e]
add r8d, 0xffffff99
add r8d, edx
cmp rsi, 0x2a
jb 0x464210
jmp 0x464276
xor eax, eax
lea rbx, [rsp + 0x1e]
mov ecx, 0x2a
call fcn.00441820
mov rbp, qword [rsp + 0x78]
sub rsp, 0xffffffffffffff80
ret
mov eax, esi
mov ecx, 0x2a
nop dword [rax]
call fcn.00453360
mov eax, edi
mov ecx, 0x2a
call fcn.00453360
nop
call fcn.00450d00
jmp fcn.00464140
Function at 0x46cdc0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
lea r12, [rsp - 0x18]
cmp r12, qword [r14 + 0x10]
jbe 0x46cf55
sub rsp, 0x98
mov qword [rsp + 0x90], rbp
lea rbp, [rsp + 0x90]
movabs rdx, 0xb7596e94d2a9ee73
mov qword [rsp + 0x1e], rdx
movabs rdx, 0x8711d5fa8598699b
mov qword [rsp + 0x26], rdx
movabs rdx, 0x46fa368c701f8820
mov qword [rsp + 0x2e], rdx
movabs rdx, 0x94173e2ff0bf6f6c
mov qword [rsp + 0x36], rdx
movabs rdx, 0xd9610c6c46bca1c5
mov qword [rsp + 0x3e], rdx
movabs rdx, 0xd5a1d06674496220
mov qword [rsp + 0x46], rdx
movabs rdx, 0xc0e1f062d0e0a20
mov qword [rsp + 0x4e], rdx
movabs rdx, 0x8080c0e1f062d0e
mov qword [rsp + 0x50], rdx
movabs rdx, 0x120f2c1e2101041f
mov qword [rsp + 0x58], rdx
movabs rdx, 0x2c2c2d0d11122504
mov qword [rsp + 0x60], rdx
movabs rdx, 0x14222c1614150f1a
mov qword [rsp + 0x68], rdx
movabs rdx, 0x1d2a252d1a210f0f
mov qword [rsp + 0x70], rdx
movabs rdx, 0x1e270c0a2f1b080e
mov qword [rsp + 0x78], rdx
movabs rdx, 0x2c2f1f082e2d020d
mov qword [rsp + 0x80], rdx
movabs rdx, 0x42a0b070322271d
mov qword [rsp + 0x88], rdx
xor eax, eax
jmp 0x46ceee
movzx r9d, byte [rsp + rsi + 0x1e]
sub r9d, edx
lea edx, [r9 - 1]
mov byte [rsp + rdi + 0x1e], dl
lea edx, [r8 - 1]
mov byte [rsp + rsi + 0x1e], dl
add rax, 2
cmp rax, 0x42
jge 0x46cf1b
movzx edx, byte [rsp + rax + 0x4e]
movzx esi, byte [rsp + rax + 0x4f]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x30
jae 0x46cf48
movzx r8d, byte [rsp + rdi + 0x1e]
sub r8d, edx
cmp rsi, 0x30
jb 0x46ced1
jmp 0x46cf3c
xor eax, eax
lea rbx, [rsp + 0x1e]
mov ecx, 0x30
call fcn.00441820
mov rbp, qword [rsp + 0x90]
add rsp, 0x98
ret
mov eax, esi
mov ecx, 0x30
call fcn.00453360
mov eax, edi
mov ecx, 0x30
call fcn.00453360
nop
call fcn.00450d00
jmp fcn.0046cdc0

Function at 0x4712e0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4713e8
sub rsp, 0x58
mov qword [rsp + 0x50], rbp
lea rbp, [rsp + 0x50]
movabs rdx, 0xe0195a071010261a
mov qword [rsp + 0x1f], rdx
movabs rdx, 0xda0e2f1814e0195a
mov qword [rsp + 0x24], rdx
movabs rdx, 0x73f31e17f1676fe6
mov qword [rsp + 0x2c], rdx
movabs rdx, 0x608120c04081105
mov qword [rsp + 0x34], rdx
movabs rdx, 0x121102060d100013
mov qword [rsp + 0x3c], rdx
movabs rdx, 0x1001120a12110206
mov qword [rsp + 0x40], rdx
movabs rdx, 0x30d02020b090703
mov qword [rsp + 0x48], rdx
xor eax, eax
jmp 0x471382
movzx r9d, byte [rsp + rsi + 0x1f]
sub r9d, edx
lea edx, [r9 + 0x69]
mov byte [rsp + rdi + 0x1f], dl
lea edx, [r8 + 0x69]
mov byte [rsp + rsi + 0x1f], dl
add rax, 2
cmp rax, 0x1c
jge 0x4713af
movzx edx, byte [rsp + rax + 0x34]
movzx esi, byte [rsp + rax + 0x35]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x15
jae 0x4713db
movzx r8d, byte [rsp + rdi + 0x1f]
sub r8d, edx
cmp rsi, 0x15
jb 0x471365
jmp 0x4713cf
xor eax, eax
lea rbx, [rsp + 0x1f]
mov ecx, 0x15
nop dword [rax + rax]
call fcn.00441820
mov rbp, qword [rsp + 0x50]
add rsp, 0x58
ret
mov eax, esi
mov ecx, 0x15
call fcn.00453360
mov eax, edi
mov ecx, 0x15
call fcn.00453360
nop
call fcn.00450d00
jmp fcn.004712e0
Function at 0x471400
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4714c6
sub rsp, 0x38
mov qword [rsp + 0x30], rbp
lea rbp, [rsp + 0x30]
movabs rdx, 0x6e90c48887618c8d
mov qword [rsp + 0x1e], rdx
movabs rdx, 0x2030401010503
mov qword [rsp + 0x26], rdx
mov word [rsp + 0x2e], 0x406
xor eax, eax
nop
jmp 0x471460
movzx r9d, byte [rsp + rsi + 0x1e]
sub r9d, edx
lea edx, [r9 - 0x18]
mov byte [rsp + rdi + 0x1e], dl
lea edx, [r8 - 0x18]
mov byte [rsp + rsi + 0x1e], dl
add rax, 2
nop
cmp rax, 0xa
jge 0x47148d
movzx edx, byte [rsp + rax + 0x26]
movzx esi, byte [rsp + rax + 0x27]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 8
jae 0x4714b4
movzx r8d, byte [rsp + rdi + 0x1e]
sub r8d, edx
cmp rsi, 8
jb 0x471442
jmp 0x4714a8
xor eax, eax
lea rbx, [rsp + 0x1e]
mov ecx, 8
call fcn.00441820
mov rbp, qword [rsp + 0x30]
add rsp, 0x38
ret
mov eax, esi
mov ecx, 8
call fcn.00453360
mov eax, edi
mov ecx, 8
nop dword [rax + rax]
call fcn.00453360
nop
call fcn.00450d00
jmp fcn.00471400

Function at 0x472700
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4727c8
sub rsp, 0x38
mov qword [rsp + 0x30], rbp
lea rbp, [rsp + 0x30]
movabs rdx, 0x63c872cfc272ecc0
mov qword [rsp + 0x1e], rdx
movabs rdx, 0x303040106000506
mov qword [rsp + 0x26], rdx
mov word [rsp + 0x2e], 4
xor eax, eax
nop
jmp 0x472760
movzx r9d, byte [rsp + rsi + 0x1e]
add r9d, 0xffffffa1
add edx, r9d
mov byte [rsp + rdi + 0x1e], dl
mov byte [rsp + rsi + 0x1e], r8b
add rax, 2
nop dword [rax]
cmp rax, 0xa
jge 0x472791
movzx edx, byte [rsp + rax + 0x26]
movzx esi, byte [rsp + rax + 0x27]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 8
jae 0x4727bb
movzx r8d, byte [rsp + rdi + 0x1e]
add r8d, 0xffffffa1
add r8d, edx
cmp rsi, 8
jb 0x472742
jmp 0x4727af
xor eax, eax
lea rbx, [rsp + 0x1e]
mov ecx, 8
nop dword [rax]
call fcn.00441820
mov rbp, qword [rsp + 0x30]
add rsp, 0x38
ret
mov eax, esi
mov ecx, 8
call fcn.00453360
mov eax, edi
mov ecx, 8
call fcn.00453360
nop
call fcn.00450d00
jmp fcn.00472700

Function at 0x473ba0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x473c66
sub rsp, 0x38
mov qword [rsp + 0x30], rbp
lea rbp, [rsp + 0x30]
movabs rdx, 0x8068fa096df97547
mov qword [rsp + 0x1e], rdx
movabs rdx, 0x407070701050401
mov qword [rsp + 0x26], rdx
mov word [rsp + 0x2e], 0x502
xor eax, eax
nop
jmp 0x473c00
movzx r9d, byte [rsp + rsi + 0x1e]
sub r9d, edx
lea edx, [r9 - 0x7f]
mov byte [rsp + rdi + 0x1e], dl
lea edx, [r8 - 0x7f]
mov byte [rsp + rsi + 0x1e], dl
add rax, 2
nop
cmp rax, 0xa
jge 0x473c2d
movzx edx, byte [rsp + rax + 0x26]
movzx esi, byte [rsp + rax + 0x27]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 8
jae 0x473c54
movzx r8d, byte [rsp + rdi + 0x1e]
sub r8d, edx
cmp rsi, 8
jb 0x473be2
jmp 0x473c48
xor eax, eax
lea rbx, [rsp + 0x1e]
mov ecx, 8
call fcn.00441820
mov rbp, qword [rsp + 0x30]
add rsp, 0x38
ret
mov eax, esi
mov ecx, 8
call fcn.00453360
mov eax, edi
mov ecx, 8
nop dword [rax + rax]
call fcn.00453360
nop
call fcn.00450d00
jmp fcn.00473ba0