joyce8/EMBER2024-capa huggingface dataset:
Function at 0x45edc0
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x40284f
sub rsp, 0x20
mov qword [rsp + 0x18], rbp
lea rbp, [rsp + 0x18]
mov rdx, qword [rax]
mov rcx, qword [rax + 8]
mov rax, rdx
nop
call fcn.00408ee0
mov rbp, qword [rsp + 0x18]
add rsp, 0x20
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.0045cd20
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp 0x402820
cmp byte [0x007b6551], 0
je 0x45edd5
mov rcx, qword [rax + 8]
mov rax, qword [rax]
jmp 0x45be20
jmp 0x402820

Function at 0x45ede0
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
mov eax, dword [rax]
movabs rcx, 0xe7037ed1a0b428db
xor rcx, rax
xor rax, rbx
xor rax, qword [0x007b6880]
movabs rdx, 0xa0761d6478bd642f
xor rdx, rax
mov rax, rcx
mul rdx
xor rax, rdx
mov rcx, rax
movabs rax, 0x1d8e4e27c47d124b
mul rcx
nop
nop
xor rax, rdx
ret
cmp byte [0x007b6551], 0
je 0x45ee15
movq xmm0, rbx
pinsrd xmm0, dword [rax], 2
aesenc xmm0, xmmword [0x007b6c00]
aesenc xmm0, xmmword [0x007b6c10]
aesenc xmm0, xmmword [0x007b6c20]
movq rax, xmm0
ret
jmp 0x4090e0

Function at 0x45ee20
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
mov rax, qword [rax]
movabs rcx, 0xe7037ed1a0b428db
xor rcx, rax
xor rax, rbx
xor rax, qword [0x007b6880]
movabs rdx, 0xa0761d6478bd642f
xor rdx, rax
mov rax, rcx
mul rdx
xor rax, rdx
mov rcx, rax
movabs rax, 0x1d8e4e27c47d1247
mul rcx
nop
nop
xor rax, rdx
ret
cmp byte [0x007b6551], 0
je 0x45ee56
movq xmm0, rbx
pinsrq xmm0, qword [rax], 1
aesenc xmm0, xmmword [0x007b6c00]
aesenc xmm0, xmmword [0x007b6c10]
aesenc xmm0, xmmword [0x007b6c20]
movq rax, xmm0
ret
jmp 0x409140

Function at 0x460840
Capabilities:
Write file on windows

Disassembly:
sub rsp, 0x30
mov rcx, 0xfffffffffffffff4
mov qword [rsp], rcx
mov rax, qword [sym.imp.kernel32.dll_GetStdHandle]
call rax
mov rcx, rax
mov qword [rsp], rcx
lea rdx, [0x007b6b80]
mov qword [rsp + 8], rdx
lea r8d, [0x007b6568]
mov qword [rsp + 0x10], r8
lea r9, [rsp + 0x28]
mov qword [r9], 0
mov qword [rsp + 0x18], r9
mov qword [rsp + 0x20], 0
mov rax, qword [sym.imp.kernel32.dll_WriteFile]
call rax
call fcn.0045ed00
add rsp, 0x30
ret

Function at 0x460d80
Capabilities:
Allocate thread local storage

Disassembly:
mov rax, rsp
and rsp, 0xfffffffffffffff0
sub rsp, 0x30
mov qword [rsp + 0x20], rax
mov rax, qword [sym.imp.kernel32.dll_TlsAlloc]
call rax
mov rsp, qword [rsp + 0x20]
mov rcx, rax
cmp rcx, 0x40
jb 0x460dac
call fcn.0045ed00
shl rcx, 3
add rcx, 0x1480
mov qword [0x007b6758], rcx
ret
Function at 0x465e40
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x465f1c
sub rsp, 0x40
mov qword [rsp + 0x38], rbp
lea rbp, [rsp + 0x38]
movabs rdx, 0x1d747b7268646566
mov qword [rsp + 0x1f], rdx
movabs rdx, 0x746e691d747b7268
mov qword [rsp + 0x22], rdx
movabs rdx, 0x405000203070502
mov qword [rsp + 0x2a], rdx
movabs rdx, 0x304050007060405
mov qword [rsp + 0x30], rdx
xor eax, eax
jmp 0x465eb2
movzx r9d, byte [rsp + rsi + 0x1f]
add r9d, 0xfffffff5
add edx, r9d
mov byte [rsp + rdi + 0x1f], dl
mov byte [rsp + rsi + 0x1f], r8b
add rax, 2
cmp rax, 0xe
jge 0x465ee8
movzx edx, byte [rsp + rax + 0x2a]
movzx esi, byte [rsp + rax + 0x2b]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0xb
jae 0x465f0f
movzx r8d, byte [rsp + rdi + 0x1f]
add r8d, 0xfffffff5
add r8d, edx
nop dword [rax + rax]
cmp rsi, 0xb
jb 0x465e98
jmp 0x465f03
xor eax, eax
lea rbx, [rsp + 0x1f]
mov ecx, 0xb
call fcn.0044a0a0
mov rbp, qword [rsp + 0x38]
add rsp, 0x40
ret
mov eax, esi
mov ecx, 0xb
call fcn.0045f380
mov eax, edi
mov ecx, 0xb
call fcn.0045f380
nop
nop dword [rax]
call fcn.0045cd20
jmp fcn.00465e40

Function at 0x4688e0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x468a06
sub rsp, 0x68
mov qword [rsp + 0x60], rbp
lea rbp, [rsp + 0x60]
movabs rdx, 0xbe2c1ef926e7986
mov qword [rsp + 0x1c], rdx
movabs rdx, 0x6585ce90696ef963
mov qword [rsp + 0x24], rdx
movabs rdx, 0x3ada7b91ae916585
mov qword [rsp + 0x2a], rdx
movabs rdx, 0xa3748794b620e5e9
mov qword [rsp + 0x32], rdx
movabs rdx, 0x14000903111505
mov qword [rsp + 0x3a], rdx
movabs rdx, 0x1a0d1206131b0014
mov qword [rsp + 0x40], rdx
movabs rdx, 0x703171a0e0c1617
mov qword [rsp + 0x48], rdx
movabs rdx, 0x10161a151d030b04
mov qword [rsp + 0x50], rdx
movabs rdx, 0x101d140b00190d12
mov qword [rsp + 0x58], rdx
xor eax, eax
jmp 0x4689a0
movzx r9d, byte [rsp + rsi + 0x1c]
sub r9d, edx
lea edx, [r9 - 0xa]
mov byte [rsp + rdi + 0x1c], dl
lea edx, [r8 - 0xa]
mov byte [rsp + rsi + 0x1c], dl
add rax, 2
cmp rax, 0x26
jge 0x4689cd
movzx edx, byte [rsp + rax + 0x3a]
movzx esi, byte [rsp + rax + 0x3b]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x1e
jae 0x4689f4
movzx r8d, byte [rsp + rdi + 0x1c]
sub r8d, edx
cmp rsi, 0x1e
jb 0x468983
jmp 0x4689e8
xor eax, eax
lea rbx, [rsp + 0x1c]
mov ecx, 0x1e
call fcn.0044a0a0
mov rbp, qword [rsp + 0x60]
add rsp, 0x68
ret
mov eax, esi
mov ecx, 0x1e
call fcn.0045f380
mov eax, edi
mov ecx, 0x1e
nop dword [rax + rax]
call fcn.0045f380
nop
call fcn.0045cd20
jmp fcn.004688e0
Function at 0x469660
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4697be
add rsp, 0xffffffffffffff80
mov qword [rsp + 0x78], rbp
lea rbp, [rsp + 0x78]
movabs rdx, 0x6c7d71697478a76d
mov qword [rsp + 0x19], rdx
movabs rdx, 0x618220908a651f20
mov qword [rsp + 0x21], rdx
movabs rdx, 0x5e775a618220908a
mov qword [rsp + 0x24], rdx
movabs rdx, 0x5cf6387574651348
mov qword [rsp + 0x2c], rdx
movabs rdx, 0x20616e988cbd6f6e
mov qword [rsp + 0x34], rdx
movabs rdx, 0x706f690865905015
mov qword [rsp + 0x3c], rdx
movabs rdx, 0x1a231d1f141f2507
mov qword [rsp + 0x44], rdx
movabs rdx, 0x25231f1e1a231d1f
mov qword [rsp + 0x48], rdx
movabs rdx, 0x1d270c1228120b01
mov qword [rsp + 0x50], rdx
movabs rdx, 0xf240e01050b1207
mov qword [rsp + 0x58], rdx
movabs rdx, 0xc100c270c040207
mov qword [rsp + 0x60], rdx
movabs rdx, 0x1411251009230605
mov qword [rsp + 0x68], rdx
movabs rdx, 0x130e23182a200e19
mov qword [rsp + 0x70], rdx
xor eax, eax
jmp 0x469759
movzx r9d, byte [rsp + rsi + 0x19]
add r9d, 0xffffffcc
add edx, r9d
mov byte [rsp + rdi + 0x19], dl
mov byte [rsp + rsi + 0x19], r8b
add rax, 2
cmp rax, 0x34
jge 0x46978a
movzx edx, byte [rsp + rax + 0x44]
movzx esi, byte [rsp + rax + 0x45]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x2b
jae 0x4697b1
movzx r8d, byte [rsp + rdi + 0x19]
add r8d, 0xffffffcc
add r8d, edx
cmp rsi, 0x2b
jb 0x46973f
jmp 0x4697a5
xor eax, eax
lea rbx, [rsp + 0x19]
mov ecx, 0x2b
call fcn.0044a0a0
mov rbp, qword [rsp + 0x78]
sub rsp, 0xffffffffffffff80
ret
mov eax, esi
mov ecx, 0x2b
call fcn.0045f380
mov eax, edi
mov ecx, 0x2b
call fcn.0045f380
nop
nop
call fcn.0045cd20
jmp fcn.00469660

Function at 0x469be0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x469cf2
sub rsp, 0x60
mov qword [rsp + 0x58], rbp
lea rbp, [rsp + 0x58]
movabs rdx, 0xc6c6847220058769
mov qword [rsp + 0x1d], rdx
movabs rdx, 0x38065742c7285b8
mov qword [rsp + 0x25], rdx
movabs rdx, 0xb9106320c8038065
mov qword [rsp + 0x2a], rdx
movabs rdx, 0xb670adaab9436573
mov qword [rsp + 0x32], rdx
movabs rdx, 0x131c1c1a1a191917
mov qword [rsp + 0x3a], rdx
movabs rdx, 0x1307100b080f1a0e
mov qword [rsp + 0x42], rdx
movabs rdx, 0x1c14010208051307
mov qword [rsp + 0x48], rdx
movabs rdx, 0x180910070601181a
mov qword [rsp + 0x50], rdx
xor eax, eax
jmp 0x469c91
movzx r9d, byte [rsp + rsi + 0x1d]
sub r9d, edx
lea edx, [r9 - 0x38]
mov byte [rsp + rdi + 0x1d], dl
lea edx, [r8 - 0x38]
mov byte [rsp + rsi + 0x1d], dl
add rax, 2
cmp rax, 0x1e
jge 0x469cbe
movzx edx, byte [rsp + rax + 0x3a]
movzx esi, byte [rsp + rax + 0x3b]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x1d
jae 0x469ce5
movzx r8d, byte [rsp + rdi + 0x1d]
sub r8d, edx
cmp rsi, 0x1d
jb 0x469c74
jmp 0x469cd9
xor eax, eax
lea rbx, [rsp + 0x1d]
mov ecx, 0x1d
call fcn.0044a0a0
mov rbp, qword [rsp + 0x58]
add rsp, 0x60
ret
mov eax, esi
mov ecx, 0x1d
call fcn.0045f380
mov eax, edi
mov ecx, 0x1d
call fcn.0045f380
nop
call fcn.0045cd20
jmp fcn.00469be0
Function at 0x46b000
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x46b0c6
sub rsp, 0x38
mov qword [rsp + 0x30], rbp
lea rbp, [rsp + 0x30]
movabs rdx, 0x6e61957a7b958e69
mov qword [rsp + 0x1c], rdx
movabs rdx, 0x200040305030101
mov qword [rsp + 0x24], rdx
mov dword [rsp + 0x2c], 0x20101
xor eax, eax
jmp 0x46b060
movzx r9d, byte [rsp + rsi + 0x1c]
sub r9d, edx
lea edx, [r9 - 0xa]
mov byte [rsp + rdi + 0x1c], dl
lea edx, [r8 - 0xa]
mov byte [rsp + rsi + 0x1c], dl
add rax, 2
nop
cmp rax, 0xc
jge 0x46b08d
movzx edx, byte [rsp + rax + 0x24]
movzx esi, byte [rsp + rax + 0x25]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 8
jae 0x46b0b4
movzx r8d, byte [rsp + rdi + 0x1c]
sub r8d, edx
cmp rsi, 8
jb 0x46b042
jmp 0x46b0a8
xor eax, eax
lea rbx, [rsp + 0x1c]
mov ecx, 8
call fcn.0044a0a0
mov rbp, qword [rsp + 0x30]
add rsp, 0x38
ret
mov eax, esi
mov ecx, 8
call fcn.0045f380
mov eax, edi
mov ecx, 8
nop dword [rax + rax]
call fcn.0045f380
nop
call fcn.0045cd20
jmp fcn.0046b000

Function at 0x46b0e0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x46b19c
sub rsp, 0x30
mov qword [rsp + 0x28], rbp
lea rbp, [rsp + 0x28]
movabs rdx, 0x6573a3ba161b1819
mov qword [rsp + 0x20], rdx
movabs rdx, 0x300050301020204
mov qword [rsp + 0x18], rdx
xor eax, eax
jmp 0x46b137
movzx r9d, byte [rsp + rsi + 0x20]
sub r9d, edx
lea edx, [r9 + 0x59]
mov byte [rsp + rdi + 0x20], dl
lea edx, [r8 + 0x59]
mov byte [rsp + rsi + 0x20], dl
add rax, 2
cmp rax, 8
jge 0x46b168
movzx edx, byte [rsp + rax + 0x18]
movzx esi, byte [rsp + rax + 0x19]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 8
jae 0x46b18f
movzx r8d, byte [rsp + rdi + 0x20]
sub r8d, edx
nop dword [rax]
cmp rsi, 8
jb 0x46b11a
jmp 0x46b183
xor eax, eax
lea rbx, [rsp + 0x20]
mov ecx, 8
call fcn.0044a0a0
mov rbp, qword [rsp + 0x28]
add rsp, 0x30
ret
mov eax, esi
mov ecx, 8
call fcn.0045f380
mov eax, edi
mov ecx, 8
call fcn.0045f380
nop
nop dword [rax]
call fcn.0045cd20
jmp fcn.0046b0e0

Function at 0x46b1c0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x46b288
sub rsp, 0x38
mov qword [rsp + 0x30], rbp
lea rbp, [rsp + 0x30]
movabs rdx, 0x93f1f80073ee6142
mov qword [rsp + 0x1b], rdx
mov byte [rsp + 0x23], 0x70
movabs rdx, 0x802060404030407
mov qword [rsp + 0x24], rdx
mov dword [rsp + 0x2c], 0x5020702
xor eax, eax
jmp 0x46b221
movzx r9d, byte [rsp + rsi + 0x1b]
add r9d, 0x6a
add edx, r9d
mov byte [rsp + rdi + 0x1b], dl
mov byte [rsp + rsi + 0x1b], r8b
add rax, 2
cmp rax, 0xc
jge 0x46b252
movzx edx, byte [rsp + rax + 0x24]
movzx esi, byte [rsp + rax + 0x25]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 9
jae 0x46b27b
movzx r8d, byte [rsp + rdi + 0x1b]
add r8d, 0x6a
add r8d, edx
cmp rsi, 9
jb 0x46b207
jmp 0x46b26f
xor eax, eax
lea rbx, [rsp + 0x1b]
mov ecx, 9
nop
call fcn.0044a0a0
mov rbp, qword [rsp + 0x30]
add rsp, 0x38
ret
mov eax, esi
mov ecx, 9
call fcn.0045f380
mov eax, edi
mov ecx, 9
call fcn.0045f380
nop
call fcn.0045cd20
jmp fcn.0046b1c0
Function at 0x46ba80
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x46bb88
sub rsp, 0x50
mov qword [rsp + 0x48], rbp
lea rbp, [rsp + 0x48]
movabs rdx, 0xf0736964f56ea90f
mov qword [rsp + 0x1b], rdx
movabs rdx, 0x4c7e9f0736964f5
mov qword [rsp + 0x1e], rdx
movabs rdx, 0xa2611cab6767a69d
mov qword [rsp + 0x26], rdx
movabs rdx, 0x7060f0b0808120d
mov qword [rsp + 0x2e], rdx
movabs rdx, 0x120b0d0a03010f0d
mov qword [rsp + 0x36], rdx
movabs rdx, 0xc0b120b0d0a0301
mov qword [rsp + 0x38], rdx
movabs rdx, 0x100a030b0a090700
mov qword [rsp + 0x40], rdx
xor eax, eax
jmp 0x46bb22
movzx r9d, byte [rsp + rsi + 0x1b]
sub r9d, edx
lea edx, [r9 + 0x78]
mov byte [rsp + rdi + 0x1b], dl
lea edx, [r8 + 0x78]
mov byte [rsp + rsi + 0x1b], dl
add rax, 2
cmp rax, 0x1a
jge 0x46bb4f
movzx edx, byte [rsp + rax + 0x2e]
movzx esi, byte [rsp + rax + 0x2f]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x13
jae 0x46bb7b
movzx r8d, byte [rsp + rdi + 0x1b]
sub r8d, edx
cmp rsi, 0x13
jb 0x46bb05
jmp 0x46bb6f
xor eax, eax
lea rbx, [rsp + 0x1b]
mov ecx, 0x13
nop dword [rax + rax]
call fcn.0044a0a0
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
mov eax, esi
mov ecx, 0x13
call fcn.0045f380
mov eax, edi
mov ecx, 0x13
call fcn.0045f380
nop
call fcn.0045cd20
jmp fcn.0046ba80

Function at 0x46bd20
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x46bde8
sub rsp, 0x38
mov qword [rsp + 0x30], rbp
lea rbp, [rsp + 0x30]
movabs rdx, 0x69140961b3105fe4
mov qword [rsp + 0x1a], rdx
mov word [rsp + 0x22], 0xa861
movabs rdx, 0x306090506020102
mov qword [rsp + 0x24], rdx
mov dword [rsp + 0x2c], 0x605
xor eax, eax
jmp 0x46bd83
movzx r9d, byte [rsp + rsi + 0x1a]
add r9d, 0x55
add edx, r9d
mov byte [rsp + rdi + 0x1a], dl
mov byte [rsp + rsi + 0x1a], r8b
add rax, 2
cmp rax, 0xc
jge 0x46bdb4
movzx edx, byte [rsp + rax + 0x24]
movzx esi, byte [rsp + rax + 0x25]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0xa
jae 0x46bddb
movzx r8d, byte [rsp + rdi + 0x1a]
add r8d, 0x55
add r8d, edx
cmp rsi, 0xa
jb 0x46bd69
jmp 0x46bdcf
xor eax, eax
lea rbx, [rsp + 0x1a]
mov ecx, 0xa
call fcn.0044a0a0
mov rbp, qword [rsp + 0x30]
add rsp, 0x38
ret
mov eax, esi
mov ecx, 0xa
call fcn.0045f380
mov eax, edi
mov ecx, 0xa
call fcn.0045f380
nop
call fcn.0045cd20
jmp fcn.0046bd20
Function at 0x46be00
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x46becb
sub rsp, 0x38
mov qword [rsp + 0x30], rbp
lea rbp, [rsp + 0x30]
movabs rdx, 0xe103f6e9e86e75c3
mov qword [rsp + 0x1b], rdx
mov byte [rsp + 0x23], 0xf7
movabs rdx, 0x507080506080703
mov qword [rsp + 0x24], rdx
mov dword [rsp + 0x2c], 0x4050000
xor eax, eax
jmp 0x46be64
movzx r9d, byte [rsp + rsi + 0x1b]
sub r9d, edx
lea edx, [r9 - 0x78]
mov byte [rsp + rdi + 0x1b], dl
lea edx, [r8 - 0x78]
mov byte [rsp + rsi + 0x1b], dl
add rax, 2
cmp rax, 0xc
jge 0x46be97
movzx edx, byte [rsp + rax + 0x24]
movzx esi, byte [rsp + rax + 0x25]
mov edi, edx
xor edx, esi
add edx, eax
nop word [rax + rax]
cmp rdi, 9
jae 0x46bebe
movzx r8d, byte [rsp + rdi + 0x1b]
sub r8d, edx
cmp rsi, 9
jb 0x46be47
jmp 0x46beb2
xor eax, eax
lea rbx, [rsp + 0x1b]
mov ecx, 9
call fcn.0044a0a0
mov rbp, qword [rsp + 0x30]
add rsp, 0x38
ret
mov eax, esi
mov ecx, 9
call fcn.0045f380
mov eax, edi
mov ecx, 9
call fcn.0045f380
nop
call fcn.0045cd20
jmp fcn.0046be00

Function at 0x46d2c0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x46d37c
sub rsp, 0x30
mov qword [rsp + 0x28], rbp
lea rbp, [rsp + 0x28]
movabs rdx, 0xff74614344000147
mov qword [rsp + 0x20], rdx
movabs rdx, 0x403040102070702
mov qword [rsp + 0x18], rdx
xor eax, eax
jmp 0x46d317
movzx r9d, byte [rsp + rsi + 0x20]
sub r9d, edx
lea edx, [r9 + 0x3b]
mov byte [rsp + rdi + 0x20], dl
lea edx, [r8 + 0x3b]
mov byte [rsp + rsi + 0x20], dl
add rax, 2
cmp rax, 8
jge 0x46d348
movzx edx, byte [rsp + rax + 0x18]
movzx esi, byte [rsp + rax + 0x19]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 8
jae 0x46d36f
movzx r8d, byte [rsp + rdi + 0x20]
sub r8d, edx
nop dword [rax]
cmp rsi, 8
jb 0x46d2fa
jmp 0x46d363
xor eax, eax
lea rbx, [rsp + 0x20]
mov ecx, 8
call fcn.0044a0a0
mov rbp, qword [rsp + 0x28]
add rsp, 0x30
ret
mov eax, esi
mov ecx, 8
call fcn.0045f380
mov eax, edi
mov ecx, 8
call fcn.0045f380
nop
nop dword [rax]
call fcn.0045cd20
jmp fcn.0046d2c0
Function at 0x470840
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x470936
sub rsp, 0x50
mov qword [rsp + 0x48], rbp
lea rbp, [rsp + 0x48]
movabs rdx, 0xa3b4606b6169c44e
mov qword [rsp + 0x32], rdx
movabs rdx, 0x9d63613798cea3b4
mov qword [rsp + 0x38], rdx
movabs rdx, 0x67c46f6d8e5f6573
mov qword [rsp + 0x40], rdx
movabs rdx, 0x1060806080a0114
mov qword [rsp + 0x1c], rdx
movabs rdx, 0x10d0708110a0106
mov qword [rsp + 0x22], rdx
movabs rdx, 0xd08090e05110814
mov qword [rsp + 0x2a], rdx
xor eax, eax
jmp 0x4708d0
movzx r9d, byte [rsp + rsi + 0x32]
add r9d, 0xffffffc4
add edx, r9d
mov byte [rsp + rdi + 0x32], dl
mov byte [rsp + rsi + 0x32], r8b
add rax, 2
cmp rax, 0x16
jge 0x470902
movzx edx, byte [rsp + rax + 0x1c]
movzx esi, byte [rsp + rax + 0x1d]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x16
jae 0x470929
movzx r8d, byte [rsp + rdi + 0x32]
add r8d, 0xffffffc4
add r8d, edx
cmp rsi, 0x16
jb 0x4708b6
nop
jmp 0x47091d
xor eax, eax
lea rbx, [rsp + 0x32]
mov ecx, 0x16
call fcn.0044a0a0
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
mov eax, esi
mov ecx, 0x16
call fcn.0045f380
mov eax, edi
mov ecx, 0x16
call fcn.0045f380
nop
call fcn.0045cd20
nop dword [rax + rax]
jmp fcn.00470840

Function at 0x4714a0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x47156b
sub rsp, 0x38
mov qword [rsp + 0x30], rbp
lea rbp, [rsp + 0x30]
movabs rdx, 0x6e8917aa6d51619b
mov qword [rsp + 0x1b], rdx
mov byte [rsp + 0x23], 0xdf
movabs rdx, 0x6080508050200
mov qword [rsp + 0x24], rdx
mov dword [rsp + 0x2c], 0x5040605
xor eax, eax
jmp 0x471504
movzx r9d, byte [rsp + rsi + 0x1b]
sub r9d, edx
lea edx, [r9 - 0x2d]
mov byte [rsp + rdi + 0x1b], dl
lea edx, [r8 - 0x2d]
mov byte [rsp + rsi + 0x1b], dl
add rax, 2
cmp rax, 0xc
jge 0x471537
movzx edx, byte [rsp + rax + 0x24]
movzx esi, byte [rsp + rax + 0x25]
mov edi, edx
xor edx, esi
add edx, eax
nop word [rax + rax]
cmp rdi, 9
jae 0x47155e
movzx r8d, byte [rsp + rdi + 0x1b]
sub r8d, edx
cmp rsi, 9
jb 0x4714e7
jmp 0x471552
xor eax, eax
lea rbx, [rsp + 0x1b]
mov ecx, 9
call fcn.0044a0a0
mov rbp, qword [rsp + 0x30]
add rsp, 0x38
ret
mov eax, esi
mov ecx, 9
call fcn.0045f380
mov eax, edi
mov ecx, 9
call fcn.0045f380
nop
call fcn.0045cd20
jmp fcn.004714a0
Function at 0x4727e0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4728a8
sub rsp, 0x38
mov qword [rsp + 0x30], rbp
lea rbp, [rsp + 0x30]
movabs rdx, 0xda658da2a8af75a8
mov qword [rsp + 0x1d], rdx
mov byte [rsp + 0x25], 0xd1
movabs rdx, 0x702000504040408
mov qword [rsp + 0x26], rdx
mov word [rsp + 0x2e], 0x302
xor eax, eax
jmp 0x472843
movzx r9d, byte [rsp + rsi + 0x1d]
sub r9d, edx
lea edx, [r9 - 0x31]
mov byte [rsp + rdi + 0x1d], dl
lea edx, [r8 - 0x31]
mov byte [rsp + rsi + 0x1d], dl
add rax, 2
cmp rax, 0xa
jge 0x472870
movzx edx, byte [rsp + rax + 0x26]
movzx esi, byte [rsp + rax + 0x27]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 9
jae 0x47289b
movzx r8d, byte [rsp + rdi + 0x1d]
sub r8d, edx
cmp rsi, 9
jb 0x472826
jmp 0x47288f
xor eax, eax
lea rbx, [rsp + 0x1d]
mov ecx, 9
nop dword [rax]
call fcn.0044a0a0
mov rbp, qword [rsp + 0x30]
add rsp, 0x38
ret
mov eax, esi
mov ecx, 9
call fcn.0045f380
mov eax, edi
mov ecx, 9
call fcn.0045f380
nop
call fcn.0045cd20
jmp fcn.004727e0

Function at 0x473960
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x473a28
sub rsp, 0x38
mov qword [rsp + 0x30], rbp
lea rbp, [rsp + 0x30]
movabs rdx, 0x8761776578755d9f
mov qword [rsp + 0x26], rdx
mov word [rsp + 0x2e], 0x8185
movabs rdx, 0x107000102090803
mov qword [rsp + 0x1c], rdx
mov word [rsp + 0x24], 0x105
xor eax, eax
jmp 0x4739c2
movzx r9d, byte [rsp + rsi + 0x26]
add r9d, 0xffffffe2
add edx, r9d
mov byte [rsp + rdi + 0x26], dl
mov byte [rsp + rsi + 0x26], r8b
add rax, 2
cmp rax, 0xa
jge 0x4739f3
movzx edx, byte [rsp + rax + 0x1c]
movzx esi, byte [rsp + rax + 0x1d]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0xa
jae 0x473a1b
movzx r8d, byte [rsp + rdi + 0x26]
add r8d, 0xffffffe2
add r8d, edx
cmp rsi, 0xa
jb 0x4739a8
jmp 0x473a0f
xor eax, eax
lea rbx, [rsp + 0x26]
mov ecx, 0xa
nop
call fcn.0044a0a0
mov rbp, qword [rsp + 0x30]
add rsp, 0x38
ret
mov eax, esi
mov ecx, 0xa
call fcn.0045f380
mov eax, edi
mov ecx, 0xa
call fcn.0045f380
nop
call fcn.0045cd20
jmp fcn.00473960

Function at 0x473a40
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x473b08
sub rsp, 0x38
mov qword [rsp + 0x30], rbp
lea rbp, [rsp + 0x30]
movabs rdx, 0x1f6f1c46ee8696f
mov qword [rsp + 0x1b], rdx
mov byte [rsp + 0x23], 0x74
movabs rdx, 0x505080000030706
mov qword [rsp + 0x24], rdx
mov dword [rsp + 0x2c], 0x4000203
xor eax, eax
jmp 0x473aa1
movzx r9d, byte [rsp + rsi + 0x1b]
add r9d, 0x72
add edx, r9d
mov byte [rsp + rdi + 0x1b], dl
mov byte [rsp + rsi + 0x1b], r8b
add rax, 2
cmp rax, 0xc
jge 0x473ad2
movzx edx, byte [rsp + rax + 0x24]
movzx esi, byte [rsp + rax + 0x25]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 9
jae 0x473afb
movzx r8d, byte [rsp + rdi + 0x1b]
add r8d, 0x72
add r8d, edx
cmp rsi, 9
jb 0x473a87
jmp 0x473aef
xor eax, eax
lea rbx, [rsp + 0x1b]
mov ecx, 9
nop
call fcn.0044a0a0
mov rbp, qword [rsp + 0x30]
add rsp, 0x38
ret
mov eax, esi
mov ecx, 9
call fcn.0045f380
mov eax, edi
mov ecx, 9
call fcn.0045f380
nop
call fcn.0045cd20
jmp fcn.00473a40
Function at 0x4755c0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x475688
sub rsp, 0x38
mov qword [rsp + 0x30], rbp
lea rbp, [rsp + 0x30]
movabs rdx, 0x494d3d164a343b4c
mov qword [rsp + 0x26], rdx
mov word [rsp + 0x2e], 0x6827
movabs rdx, 0x407020504040800
mov qword [rsp + 0x1c], rdx
mov word [rsp + 0x24], 0x103
xor eax, eax
jmp 0x475622
movzx r9d, byte [rsp + rsi + 0x26]
add r9d, 0x20
add edx, r9d
mov byte [rsp + rdi + 0x26], dl
mov byte [rsp + rsi + 0x26], r8b
add rax, 2
cmp rax, 0xa
jge 0x475653
movzx edx, byte [rsp + rax + 0x1c]
movzx esi, byte [rsp + rax + 0x1d]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0xa
jae 0x47567b
movzx r8d, byte [rsp + rdi + 0x26]
add r8d, 0x20
add r8d, edx
cmp rsi, 0xa
jb 0x475608
jmp 0x47566f
xor eax, eax
lea rbx, [rsp + 0x26]
mov ecx, 0xa
nop
call fcn.0044a0a0
mov rbp, qword [rsp + 0x30]
add rsp, 0x38
ret
mov eax, esi
mov ecx, 0xa
call fcn.0045f380
mov eax, edi
mov ecx, 0xa
call fcn.0045f380
nop
call fcn.0045cd20
jmp fcn.004755c0

Function at 0x475c20
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x475d0b
sub rsp, 0x48
mov qword [rsp + 0x40], rbp
lea rbp, [rsp + 0x40]
movabs rdx, 0xc969741b745507ff
mov qword [rsp + 0x1e], rdx
movabs rdx, 0x35ac6114f153c969
mov qword [rsp + 0x24], rdx
movabs rdx, 0x2020d0c0900080d
mov qword [rsp + 0x2c], rdx
movabs rdx, 0x80d0a0202020d0c
mov qword [rsp + 0x30], rdx
movabs rdx, 0xc0c070c0d0a0401
mov qword [rsp + 0x38], rdx
xor eax, eax
jmp 0x475ca4
movzx r9d, byte [rsp + rsi + 0x1e]
sub r9d, edx
lea edx, [r9 + 0x6b]
mov byte [rsp + rdi + 0x1e], dl
lea edx, [r8 + 0x6b]
mov byte [rsp + rsi + 0x1e], dl
add rax, 2
cmp rax, 0x14
jge 0x475cd7
movzx edx, byte [rsp + rax + 0x2c]
movzx esi, byte [rsp + rax + 0x2d]
mov edi, edx
xor edx, esi
add edx, eax
nop word [rax + rax]
cmp rdi, 0xe
jae 0x475cfe
movzx r8d, byte [rsp + rdi + 0x1e]
sub r8d, edx
cmp rsi, 0xe
jb 0x475c87
jmp 0x475cf2
xor eax, eax
lea rbx, [rsp + 0x1e]
mov ecx, 0xe
call fcn.0044a0a0
mov rbp, qword [rsp + 0x40]
add rsp, 0x48
ret
mov eax, esi
mov ecx, 0xe
call fcn.0045f380
mov eax, edi
mov ecx, 0xe
call fcn.0045f380
nop
call fcn.0045cd20
jmp fcn.00475c20