joyce8/EMBER2024-capa huggingface dataset:
Function at 0x44e080
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x44e139
sub rsp, 0x60
mov qword [rsp + 0x58], rbp
lea rbp, [rsp + 0x58]
mov qword [rsp + 0x70], rbx
mov qword [rsp + 8], 0
movups xmmword [rsp + 0x10], xmm15
movups xmmword [rsp + 0x18], xmm15
movups xmmword [rsp + 0x28], xmm15
movups xmmword [rsp + 0x38], xmm15
movups xmmword [rsp + 0x48], xmm15
lea rdx, [0x0044e180]
mov qword [rsp + 0x10], rdx
lea rdx, [rsp + 8]
mov qword [rsp + 0x18], rdx
mov rdx, qword [rsp + 0x60]
mov qword [rsp + 0x20], rdx
lea rdx, [rsp + 0x68]
mov qword [rsp + 0x28], rdx
mov rdx, r14
mov qword [rsp + 0x30], rdx
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x48], rcx
mov qword [rsp + 0x50], rdi
lea rax, [rsp + 0x10]
mov qword [rsp], rax
call fcn.00455580
xorps xmm15, xmm15
mov r14, qword [0x008bb8e0]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 8]
mov rbp, qword [rsp + 0x58]
add rsp, 0x60
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
call fcn.004556c0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
jmp fcn.0044e080
Function at 0x457760
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x40304f
sub rsp, 0x20
mov qword [rsp + 0x18], rbp
lea rbp, [rsp + 0x18]
mov rdx, qword [rax]
mov rcx, qword [rax + 8]
mov rax, rdx
nop
call fcn.004086c0
mov rbp, qword [rsp + 0x18]
add rsp, 0x20
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.004556c0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp 0x403020
cmp byte [0x008bb6b3], 0
je 0x457775
mov rcx, qword [rax + 8]
mov rax, qword [rax]
jmp 0x4547c0
jmp 0x403020

Function at 0x457780
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
mov eax, dword [rax]
movabs rcx, 0xe7037ed1a0b428db
xor rcx, rax
xor rax, rbx
xor rax, qword [0x008bba40]
movabs rdx, 0xa0761d6478bd642f
xor rdx, rax
mov rax, rcx
mul rdx
xor rax, rdx
mov rcx, rax
movabs rax, 0x1d8e4e27c47d124b
mul rcx
nop
nop
xor rax, rdx
ret
cmp byte [0x008bb6b3], 0
je 0x4577b5
movq xmm0, rbx
pinsrd xmm0, dword [rax], 2
aesenc xmm0, xmmword [0x008bbdc0]
aesenc xmm0, xmmword [0x008bbdd0]
aesenc xmm0, xmmword [0x008bbde0]
movq rax, xmm0
ret
jmp 0x4088c0

Function at 0x4577c0
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
mov rax, qword [rax]
movabs rcx, 0xe7037ed1a0b428db
xor rcx, rax
xor rax, rbx
xor rax, qword [0x008bba40]
movabs rdx, 0xa0761d6478bd642f
xor rdx, rax
mov rax, rcx
mul rdx
xor rax, rdx
mov rcx, rax
movabs rax, 0x1d8e4e27c47d1247
mul rcx
nop
nop
xor rax, rdx
ret
cmp byte [0x008bb6b3], 0
je 0x4577f6
movq xmm0, rbx
pinsrq xmm0, qword [rax], 1
aesenc xmm0, xmmword [0x008bbdc0]
aesenc xmm0, xmmword [0x008bbdd0]
aesenc xmm0, xmmword [0x008bbde0]
movq rax, xmm0
ret
jmp 0x408920

Function at 0x459200
Capabilities:
Write file on windows

Disassembly:
sub rsp, 0x30
mov rcx, 0xfffffffffffffff4
mov qword [rsp], rcx
mov rax, qword [sym.imp.kernel32.dll_GetStdHandle]
call rax
mov rcx, rax
mov qword [rsp], rcx
lea rdx, [0x008bbd40]
mov qword [rsp + 8], rdx
lea r8d, [0x008bb6d8]
mov qword [rsp + 0x10], r8
lea r9, [rsp + 0x28]
mov qword [r9], 0
mov qword [rsp + 0x18], r9
mov qword [rsp + 0x20], 0
mov rax, qword [sym.imp.kernel32.dll_WriteFile]
call rax
call fcn.004576a0
add rsp, 0x30
ret

Function at 0x459740
Capabilities:
Allocate thread local storage

Disassembly:
mov rax, rsp
and rsp, 0xfffffffffffffff0
sub rsp, 0x30
mov qword [rsp + 0x20], rax
mov rax, qword [sym.imp.kernel32.dll_TlsAlloc]
call rax
mov rsp, qword [rsp + 0x20]
mov rcx, rax
cmp rcx, 0x40
jb 0x459770
mov rcx, 0x28
jmp 0x45977b
shl rcx, 3
add rcx, 0x1480
mov qword [0x008bb8e0], rcx
ret
Function at 0x45ea80
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x45eb48
sub rsp, 0x38
mov qword [rsp + 0x30], rbp
lea rbp, [rsp + 0x30]
movabs rdx, 0xab15656c816dc279
mov qword [rsp + 0x26], rdx
mov word [rsp + 0x2e], 0xb9b3
movabs rdx, 0x7010609030606
mov qword [rsp + 0x1c], rdx
mov word [rsp + 0x24], 0x108
xor eax, eax
jmp 0x45eae2
movzx r9d, byte [rsp + rsi + 0x26]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x55]
mov byte [rsp + rdi + 0x26], dl
mov byte [rsp + rsi + 0x26], r8b
add rax, 2
cmp rax, 0xa
jge 0x45eb14
movzx edx, byte [rsp + rax + 0x1c]
movzx esi, byte [rsp + rax + 0x1d]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0xa
jae 0x45eb3b
movzx r8d, byte [rsp + rdi + 0x26]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x55]
cmp rsi, 0xa
jb 0x45eac8
jmp 0x45eb2f
xor eax, eax
lea rbx, [rsp + 0x26]
mov ecx, 0xa
call fcn.00444d40
mov rbp, qword [rsp + 0x30]
add rsp, 0x38
ret
mov eax, esi
mov ecx, 0xa
call fcn.00457d20
mov eax, edi
mov ecx, 0xa
call fcn.00457d20
nop
call fcn.004556c0
jmp fcn.0045ea80

Function at 0x45fc40
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x45fd48
sub rsp, 0x50
mov qword [rsp + 0x48], rbp
lea rbp, [rsp + 0x48]
movabs rdx, 0x6c9763d453dc65d0
mov qword [rsp + 0x18], rdx
movabs rdx, 0xbccb356574eb6c97
mov qword [rsp + 0x1e], rdx
movabs rdx, 0x2b0d38407918b16c
mov qword [rsp + 0x26], rdx
movabs rdx, 0x120b031104150808
mov qword [rsp + 0x2e], rdx
movabs rdx, 0xd10060b1314120f
mov qword [rsp + 0x36], rdx
movabs rdx, 0x3140d10060b1314
mov qword [rsp + 0x38], rdx
movabs rdx, 0x140d02000c041311
mov qword [rsp + 0x40], rdx
xor eax, eax
jmp 0x45fce0
movzx r9d, byte [rsp + rsi + 0x18]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x7e]
mov byte [rsp + rdi + 0x18], dl
mov byte [rsp + rsi + 0x18], r8b
add rax, 2
nop
cmp rax, 0x1a
jge 0x45fd12
movzx edx, byte [rsp + rax + 0x2e]
movzx esi, byte [rsp + rax + 0x2f]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x16
jae 0x45fd3b
movzx r8d, byte [rsp + rdi + 0x18]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x7e]
cmp rsi, 0x16
jb 0x45fcc5
jmp 0x45fd2f
xor eax, eax
lea rbx, [rsp + 0x18]
mov ecx, 0x16
nop
call fcn.00444d40
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
mov eax, esi
mov ecx, 0x16
call fcn.00457d20
mov eax, edi
mov ecx, 0x16
call fcn.00457d20
nop
call fcn.004556c0
jmp fcn.0045fc40
Function at 0x4650c0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4651f2
sub rsp, 0x70
mov qword [rsp + 0x68], rbp
lea rbp, [rsp + 0x68]
movabs rdx, 0x997e63c7636e65ba
mov qword [rsp + 0x1c], rdx
movabs rdx, 0x6cdedb765dd7d34b
mov qword [rsp + 0x24], rdx
movabs rdx, 0x70756c4555d66dea
mov qword [rsp + 0x2c], rdx
movabs rdx, 0xf7fb745a75885fa4
mov qword [rsp + 0x34], rdx
movabs rdx, 0x121c13140d010408
mov qword [rsp + 0x3c], rdx
movabs rdx, 0x181e00131505100a
mov qword [rsp + 0x44], rdx
movabs rdx, 0x181a0416181e0013
mov qword [rsp + 0x48], rdx
movabs rdx, 0x1a1e190f110f0f0b
mov qword [rsp + 0x50], rdx
movabs rdx, 0xf091506041a0e07
mov qword [rsp + 0x58], rdx
movabs rdx, 0x51e15121f0b140d
mov qword [rsp + 0x60], rdx
xor eax, eax
jmp 0x46518f
movzx r9d, byte [rsp + rsi + 0x1c]
sub r9d, edx
lea edx, [r9 - 0x54]
mov byte [rsp + rdi + 0x1c], dl
lea edx, [r8 - 0x54]
mov byte [rsp + rsi + 0x1c], dl
add rax, 2
cmp rax, 0x2c
jge 0x4651bc
movzx edx, byte [rsp + rax + 0x3c]
movzx esi, byte [rsp + rax + 0x3d]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x20
jae 0x4651e5
movzx r8d, byte [rsp + rdi + 0x1c]
sub r8d, edx
cmp rsi, 0x20
jb 0x465172
jmp 0x4651d7
xor eax, eax
lea rbx, [rsp + 0x1c]
mov ecx, 0x20
call fcn.00444d40
mov rbp, qword [rsp + 0x68]
add rsp, 0x70
ret
mov eax, esi
mov ecx, 0x20
nop
call fcn.00457d20
mov eax, edi
mov ecx, 0x20
call fcn.00457d20
nop
call fcn.004556c0
jmp fcn.004650c0
Function at 0x467560
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x467668
sub rsp, 0x50
mov qword [rsp + 0x48], rbp
lea rbp, [rsp + 0x48]
movabs rdx, 0x201d696c33c86eed
mov qword [rsp + 0x18], rdx
movabs rdx, 0xd314ff36201d696c
mov qword [rsp + 0x1c], rdx
movabs rdx, 0xef4edf7305459457
mov qword [rsp + 0x24], rdx
movabs rdx, 0xd0a0a0c0813110f
mov qword [rsp + 0x2c], rdx
movabs rdx, 0xb0b110e0f060208
mov qword [rsp + 0x34], rdx
movabs rdx, 0xb030d000b0b110e
mov qword [rsp + 0x38], rdx
movabs rdx, 0x1208120a0d0009
mov qword [rsp + 0x40], rdx
xor eax, eax
jmp 0x467602
movzx r9d, byte [rsp + rsi + 0x18]
sub r9d, edx
lea edx, [r9 + 0x5b]
mov byte [rsp + rdi + 0x18], dl
lea edx, [r8 + 0x5b]
mov byte [rsp + rsi + 0x18], dl
add rax, 2
cmp rax, 0x1c
jge 0x46762f
movzx edx, byte [rsp + rax + 0x2c]
movzx esi, byte [rsp + rax + 0x2d]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x14
jae 0x46765b
movzx r8d, byte [rsp + rdi + 0x18]
sub r8d, edx
cmp rsi, 0x14
jb 0x4675e5
jmp 0x46764f
xor eax, eax
lea rbx, [rsp + 0x18]
mov ecx, 0x14
nop dword [rax + rax]
call fcn.00444d40
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
mov eax, esi
mov ecx, 0x14
call fcn.00457d20
mov eax, edi
mov ecx, 0x14
call fcn.00457d20
nop
call fcn.004556c0
jmp fcn.00467560
Function at 0x46afe0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x46b0a8
sub rsp, 0x38
mov qword [rsp + 0x30], rbp
lea rbp, [rsp + 0x30]
movabs rdx, 0x6f66d194ad70d0a2
mov qword [rsp + 0x1c], rdx
movabs rdx, 0x403040005000104
mov qword [rsp + 0x24], rdx
mov dword [rsp + 0x2c], 0x40504
xor eax, eax
jmp 0x46b040
movzx r9d, byte [rsp + rsi + 0x1c]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x2a]
mov byte [rsp + rdi + 0x1c], dl
mov byte [rsp + rsi + 0x1c], r8b
add rax, 2
nop dword [rax]
cmp rax, 0xc
jge 0x46b072
movzx edx, byte [rsp + rax + 0x24]
movzx esi, byte [rsp + rax + 0x25]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 8
jae 0x46b09b
movzx r8d, byte [rsp + rdi + 0x1c]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x2a]
cmp rsi, 8
jb 0x46b022
jmp 0x46b08f
xor eax, eax
lea rbx, [rsp + 0x1c]
mov ecx, 8
nop
call fcn.00444d40
mov rbp, qword [rsp + 0x30]
add rsp, 0x38
ret
mov eax, esi
mov ecx, 8
call fcn.00457d20
mov eax, edi
mov ecx, 8
call fcn.00457d20
nop
call fcn.004556c0
jmp fcn.0046afe0

Function at 0x46b0c0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x46b17c
sub rsp, 0x30
mov qword [rsp + 0x28], rbp
lea rbp, [rsp + 0x28]
movabs rdx, 0x537365f6695c2f4f
mov qword [rsp + 0x20], rdx
movabs rdx, 0x2020104070401
mov qword [rsp + 0x18], rdx
xor eax, eax
jmp 0x46b117
movzx r9d, byte [rsp + rsi + 0x20]
sub r9d, edx
lea edx, [r9 + 0x20]
mov byte [rsp + rdi + 0x20], dl
lea edx, [r8 + 0x20]
mov byte [rsp + rsi + 0x20], dl
add rax, 2
cmp rax, 8
jge 0x46b148
movzx edx, byte [rsp + rax + 0x18]
movzx esi, byte [rsp + rax + 0x19]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 8
jae 0x46b16f
movzx r8d, byte [rsp + rdi + 0x20]
sub r8d, edx
nop dword [rax]
cmp rsi, 8
jb 0x46b0fa
jmp 0x46b163
xor eax, eax
lea rbx, [rsp + 0x20]
mov ecx, 8
call fcn.00444d40
mov rbp, qword [rsp + 0x28]
add rsp, 0x30
ret
mov eax, esi
mov ecx, 8
call fcn.00457d20
mov eax, edi
mov ecx, 8
call fcn.00457d20
nop
nop dword [rax]
call fcn.004556c0
jmp fcn.0046b0c0

Function at 0x46b9e0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x46baa8
sub rsp, 0x38
mov qword [rsp + 0x30], rbp
lea rbp, [rsp + 0x30]
movabs rdx, 0xb2acfff386aaabf6
mov qword [rsp + 0x1c], rdx
movabs rdx, 0x104000304050706
mov qword [rsp + 0x24], rdx
mov dword [rsp + 0x2c], 0x5050302
xor eax, eax
jmp 0x46ba40
movzx r9d, byte [rsp + rsi + 0x1c]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x4a]
mov byte [rsp + rdi + 0x1c], dl
mov byte [rsp + rsi + 0x1c], r8b
add rax, 2
nop dword [rax]
cmp rax, 0xc
jge 0x46ba72
movzx edx, byte [rsp + rax + 0x24]
movzx esi, byte [rsp + rax + 0x25]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 8
jae 0x46ba9b
movzx r8d, byte [rsp + rdi + 0x1c]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x4a]
cmp rsi, 8
jb 0x46ba22
jmp 0x46ba8f
xor eax, eax
lea rbx, [rsp + 0x1c]
mov ecx, 8
nop
call fcn.00444d40
mov rbp, qword [rsp + 0x30]
add rsp, 0x38
ret
mov eax, esi
mov ecx, 8
call fcn.00457d20
mov eax, edi
mov ecx, 8
call fcn.00457d20
nop
call fcn.004556c0
jmp fcn.0046b9e0
Function at 0x46d2e0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x46d3cb
sub rsp, 0x48
mov qword [rsp + 0x40], rbp
lea rbp, [rsp + 0x40]
movabs rdx, 0xb288699765a29149
mov qword [rsp + 0x1a], rdx
movabs rdx, 0xa469e4b69672ca88
mov qword [rsp + 0x22], rdx
movabs rdx, 0x20206080d070f0d
mov qword [rsp + 0x2a], rdx
movabs rdx, 0xc080908020b0202
mov qword [rsp + 0x30], rdx
movabs rdx, 0x801080f04040c0d
mov qword [rsp + 0x38], rdx
xor eax, eax
jmp 0x46d364
movzx r9d, byte [rsp + rsi + 0x1a]
sub r9d, edx
lea edx, [r9 - 0x15]
mov byte [rsp + rdi + 0x1a], dl
lea edx, [r8 - 0x15]
mov byte [rsp + rsi + 0x1a], dl
add rax, 2
cmp rax, 0x16
jge 0x46d397
movzx edx, byte [rsp + rax + 0x2a]
movzx esi, byte [rsp + rax + 0x2b]
mov edi, edx
xor edx, esi
add edx, eax
nop word [rax + rax]
cmp rdi, 0x10
jae 0x46d3be
movzx r8d, byte [rsp + rdi + 0x1a]
sub r8d, edx
cmp rsi, 0x10
jb 0x46d347
jmp 0x46d3b2
xor eax, eax
lea rbx, [rsp + 0x1a]
mov ecx, 0x10
call fcn.00444d40
mov rbp, qword [rsp + 0x40]
add rsp, 0x48
ret
mov eax, esi
mov ecx, 0x10
call fcn.00457d20
mov eax, edi
mov ecx, 0x10
call fcn.00457d20
nop
call fcn.004556c0
jmp fcn.0046d2e0

Function at 0x46e3a0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x46e496
sub rsp, 0x50
mov qword [rsp + 0x48], rbp
lea rbp, [rsp + 0x48]
movabs rdx, 0x9c90f86174690ba9
mov qword [rsp + 0x1f], rdx
movabs rdx, 0xcb0fa59c90f86174
mov qword [rsp + 0x22], rdx
movabs rdx, 0x7cacfb7290a05f0a
mov qword [rsp + 0x2a], rdx
movabs rdx, 0xe0d080805001101
mov qword [rsp + 0x32], rdx
movabs rdx, 0x110a090b06070e0d
mov qword [rsp + 0x38], rdx
movabs rdx, 0x1009000b0b100b12
mov qword [rsp + 0x40], rdx
xor eax, eax
jmp 0x46e433
movzx r9d, byte [rsp + rsi + 0x1f]
sub r9d, edx
lea edx, [r9 - 0x34]
mov byte [rsp + rdi + 0x1f], dl
lea edx, [r8 - 0x34]
mov byte [rsp + rsi + 0x1f], dl
add rax, 2
cmp rax, 0x16
jge 0x46e462
movzx edx, byte [rsp + rax + 0x32]
movzx esi, byte [rsp + rax + 0x33]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x13
jae 0x46e489
movzx r8d, byte [rsp + rdi + 0x1f]
sub r8d, edx
cmp rsi, 0x13
jb 0x46e416
nop
jmp 0x46e47d
xor eax, eax
lea rbx, [rsp + 0x1f]
mov ecx, 0x13
call fcn.00444d40
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
mov eax, esi
mov ecx, 0x13
call fcn.00457d20
mov eax, edi
mov ecx, 0x13
call fcn.00457d20
nop
call fcn.004556c0
nop dword [rax + rax]
jmp fcn.0046e3a0
Function at 0x46eb40
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x46ec09
sub rsp, 0x38
mov qword [rsp + 0x30], rbp
lea rbp, [rsp + 0x30]
movabs rdx, 0x2b4fa6369af96aa
mov qword [rsp + 0x1a], rdx
mov word [rsp + 0x22], 0xf400
movabs rdx, 0x605060709080509
mov qword [rsp + 0x24], rdx
mov dword [rsp + 0x2c], 0x1000209
xor eax, eax
jmp 0x46eba3
movzx r9d, byte [rsp + rsi + 0x1a]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x54]
mov byte [rsp + rdi + 0x1a], dl
mov byte [rsp + rsi + 0x1a], r8b
add rax, 2
cmp rax, 0xc
jge 0x46ebd5
movzx edx, byte [rsp + rax + 0x24]
movzx esi, byte [rsp + rax + 0x25]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0xa
jae 0x46ebfc
movzx r8d, byte [rsp + rdi + 0x1a]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x54]
cmp rsi, 0xa
jb 0x46eb89
jmp 0x46ebf0
xor eax, eax
lea rbx, [rsp + 0x1a]
mov ecx, 0xa
call fcn.00444d40
mov rbp, qword [rsp + 0x30]
add rsp, 0x38
ret
mov eax, esi
mov ecx, 0xa
call fcn.00457d20
mov eax, edi
mov ecx, 0xa
call fcn.00457d20
nop
call fcn.004556c0
jmp fcn.0046eb40

Function at 0x46f060
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x46f132
sub rsp, 0x40
mov qword [rsp + 0x38], rbp
lea rbp, [rsp + 0x38]
movabs rdx, 0x4de869e2745f385d
mov qword [rsp + 0x1e], rdx
mov dword [rsp + 0x26], 0x6bdb79d8
movabs rdx, 0x406000208000608
mov qword [rsp + 0x2a], rdx
movabs rdx, 0xa010a08040406
mov qword [rsp + 0x30], rdx
xor eax, eax
jmp 0x46f0cb
movzx r9d, byte [rsp + rsi + 0x1e]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x75]
mov byte [rsp + rdi + 0x1e], dl
mov byte [rsp + rsi + 0x1e], r8b
add rax, 2
cmp rax, 0xe
jge 0x46f0fd
movzx edx, byte [rsp + rax + 0x2a]
movzx esi, byte [rsp + rax + 0x2b]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0xc
jae 0x46f125
movzx r8d, byte [rsp + rdi + 0x1e]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x75]
cmp rsi, 0xc
jb 0x46f0b1
jmp 0x46f118
xor eax, eax
lea rbx, [rsp + 0x1e]
mov ecx, 0xc
call fcn.00444d40
mov rbp, qword [rsp + 0x38]
add rsp, 0x40
ret
mov eax, esi
mov ecx, 0xc
nop
call fcn.00457d20
mov eax, edi
mov ecx, 0xc
call fcn.00457d20
nop
call fcn.004556c0
jmp fcn.0046f060
Function at 0x46f340
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x46f42b
sub rsp, 0x48
mov qword [rsp + 0x40], rbp
lea rbp, [rsp + 0x40]
movabs rdx, 0xe635e8162d9c1a1e
mov qword [rsp + 0x1c], rdx
movabs rdx, 0xc1760a2b0f1343dd
mov qword [rsp + 0x24], rdx
movabs rdx, 0x10402000b070b0f
mov qword [rsp + 0x2c], rdx
movabs rdx, 0xd00050c01040200
mov qword [rsp + 0x30], rdx
movabs rdx, 0xb0c0d03060a0a08
mov qword [rsp + 0x38], rdx
xor eax, eax
jmp 0x46f3c4
movzx r9d, byte [rsp + rsi + 0x1c]
sub r9d, edx
lea edx, [r9 + 0x5a]
mov byte [rsp + rdi + 0x1c], dl
lea edx, [r8 + 0x5a]
mov byte [rsp + rsi + 0x1c], dl
add rax, 2
cmp rax, 0x14
jge 0x46f3f7
movzx edx, byte [rsp + rax + 0x2c]
movzx esi, byte [rsp + rax + 0x2d]
mov edi, edx
xor edx, esi
add edx, eax
nop word [rax + rax]
cmp rdi, 0x10
jae 0x46f41e
movzx r8d, byte [rsp + rdi + 0x1c]
sub r8d, edx
cmp rsi, 0x10
jb 0x46f3a7
jmp 0x46f412
xor eax, eax
lea rbx, [rsp + 0x1c]
mov ecx, 0x10
call fcn.00444d40
mov rbp, qword [rsp + 0x40]
add rsp, 0x48
ret
mov eax, esi
mov ecx, 0x10
call fcn.00457d20
mov eax, edi
mov ecx, 0x10
call fcn.00457d20
nop
call fcn.004556c0
jmp fcn.0046f340

Function at 0x46f880
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x46f948
sub rsp, 0x38
mov qword [rsp + 0x30], rbp
lea rbp, [rsp + 0x30]
movabs rdx, 0x61075649475b464e
mov qword [rsp + 0x1d], rdx
mov byte [rsp + 0x25], 0x49
movabs rdx, 0x402030306030508
mov qword [rsp + 0x26], rdx
mov word [rsp + 0x2e], 0x301
xor eax, eax
jmp 0x46f8e3
movzx r9d, byte [rsp + rsi + 0x1d]
sub r9d, edx
lea edx, [r9 + 0x25]
mov byte [rsp + rdi + 0x1d], dl
lea edx, [r8 + 0x25]
mov byte [rsp + rsi + 0x1d], dl
add rax, 2
cmp rax, 0xa
jge 0x46f910
movzx edx, byte [rsp + rax + 0x26]
movzx esi, byte [rsp + rax + 0x27]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 9
jae 0x46f93b
movzx r8d, byte [rsp + rdi + 0x1d]
sub r8d, edx
cmp rsi, 9
jb 0x46f8c6
jmp 0x46f92f
xor eax, eax
lea rbx, [rsp + 0x1d]
mov ecx, 9
nop dword [rax]
call fcn.00444d40
mov rbp, qword [rsp + 0x30]
add rsp, 0x38
ret
mov eax, esi
mov ecx, 9
call fcn.00457d20
mov eax, edi
mov ecx, 9
call fcn.00457d20
nop
call fcn.004556c0
jmp fcn.0046f880
Function at 0x471000
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4710f6
sub rsp, 0x48
mov qword [rsp + 0x40], rbp
lea rbp, [rsp + 0x40]
movabs rdx, 0xc275f2fcf4146c4f
mov qword [rsp + 0x19], rdx
movabs rdx, 0x93c275f2fcf4146c
mov qword [rsp + 0x1a], rdx
movabs rdx, 0x6e26aaed61cdf546
mov qword [rsp + 0x22], rdx
movabs rdx, 0xb0a0a02030f0202
mov qword [rsp + 0x2a], rdx
movabs rdx, 0xd04080903050b0a
mov qword [rsp + 0x30], rdx
movabs rdx, 0x807070805090e09
mov qword [rsp + 0x38], rdx
xor eax, eax
jmp 0x471093
movzx r9d, byte [rsp + rsi + 0x19]
sub r9d, edx
lea edx, [r9 + 0x7b]
mov byte [rsp + rdi + 0x19], dl
lea edx, [r8 + 0x7b]
mov byte [rsp + rsi + 0x19], dl
add rax, 2
cmp rax, 0x16
jge 0x4710c2
movzx edx, byte [rsp + rax + 0x2a]
movzx esi, byte [rsp + rax + 0x2b]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x11
jae 0x4710e9
movzx r8d, byte [rsp + rdi + 0x19]
sub r8d, edx
cmp rsi, 0x11
jb 0x471076
nop
jmp 0x4710dd
xor eax, eax
lea rbx, [rsp + 0x19]
mov ecx, 0x11
call fcn.00444d40
mov rbp, qword [rsp + 0x40]
add rsp, 0x48
ret
mov eax, esi
mov ecx, 0x11
call fcn.00457d20
mov eax, edi
mov ecx, 0x11
call fcn.00457d20
nop
call fcn.004556c0
nop dword [rax + rax]
jmp fcn.00471000

Function at 0x471a40
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x471b1c
sub rsp, 0x40
mov qword [rsp + 0x38], rbp
lea rbp, [rsp + 0x38]
movabs rdx, 0x5e6e39435e4e4837
mov qword [rsp + 0x1d], rdx
movabs rdx, 0x7562495e6e39435e
mov qword [rsp + 0x20], rdx
movabs rdx, 0x503070008080800
mov qword [rsp + 0x28], rdx
movabs rdx, 0x1090700020308
mov qword [rsp + 0x30], rdx
xor eax, eax
jmp 0x471ab5
movzx r9d, byte [rsp + rsi + 0x1d]
sub r9d, edx
lea edx, [r9 + 0x17]
mov byte [rsp + rdi + 0x1d], dl
lea edx, [r8 + 0x17]
mov byte [rsp + rsi + 0x1d], dl
add rax, 2
cmp rax, 0x10
jge 0x471ae8
movzx edx, byte [rsp + rax + 0x28]
movzx esi, byte [rsp + rax + 0x29]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0xb
jae 0x471b0f
movzx r8d, byte [rsp + rdi + 0x1d]
sub r8d, edx
nop word [rax + rax]
cmp rsi, 0xb
jb 0x471a98
jmp 0x471b03
xor eax, eax
lea rbx, [rsp + 0x1d]
mov ecx, 0xb
call fcn.00444d40
mov rbp, qword [rsp + 0x38]
add rsp, 0x40
ret
mov eax, esi
mov ecx, 0xb
call fcn.00457d20
mov eax, edi
mov ecx, 0xb
call fcn.00457d20
nop
nop dword [rax]
call fcn.004556c0
jmp fcn.00471a40
Function at 0x4732e0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4733a8
sub rsp, 0x38
mov qword [rsp + 0x30], rbp
lea rbp, [rsp + 0x30]
movabs rdx, 0xb1c708f55f5ab2f7
mov qword [rsp + 0x1c], rdx
movabs rdx, 0x605050107020206
mov qword [rsp + 0x24], rdx
mov dword [rsp + 0x2c], 0x4000502
xor eax, eax
jmp 0x473340
movzx r9d, byte [rsp + rsi + 0x1c]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x51]
mov byte [rsp + rdi + 0x1c], dl
mov byte [rsp + rsi + 0x1c], r8b
add rax, 2
nop dword [rax]
cmp rax, 0xc
jge 0x473372
movzx edx, byte [rsp + rax + 0x24]
movzx esi, byte [rsp + rax + 0x25]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 8
jae 0x47339b
movzx r8d, byte [rsp + rdi + 0x1c]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x51]
cmp rsi, 8
jb 0x473322
jmp 0x47338f
xor eax, eax
lea rbx, [rsp + 0x1c]
mov ecx, 8
nop
call fcn.00444d40
mov rbp, qword [rsp + 0x30]
add rsp, 0x38
ret
mov eax, esi
mov ecx, 8
call fcn.00457d20
mov eax, edi
mov ecx, 8
call fcn.00457d20
nop
call fcn.004556c0
jmp fcn.004732e0

Function at 0x473600
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4736bc
sub rsp, 0x30
mov qword [rsp + 0x28], rbp
lea rbp, [rsp + 0x28]
movabs rdx, 0xf569f0fb7e61f161
mov qword [rsp + 0x20], rdx
movabs rdx, 0x107040500030300
mov qword [rsp + 0x18], rdx
xor eax, eax
jmp 0x473657
movzx r9d, byte [rsp + rsi + 0x20]
sub r9d, edx
lea edx, [r9 + 0x7e]
mov byte [rsp + rdi + 0x20], dl
lea edx, [r8 + 0x7e]
mov byte [rsp + rsi + 0x20], dl
add rax, 2
cmp rax, 8
jge 0x473688
movzx edx, byte [rsp + rax + 0x18]
movzx esi, byte [rsp + rax + 0x19]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 8
jae 0x4736af
movzx r8d, byte [rsp + rdi + 0x20]
sub r8d, edx
nop dword [rax]
cmp rsi, 8
jb 0x47363a
jmp 0x4736a3
xor eax, eax
lea rbx, [rsp + 0x20]
mov ecx, 8
call fcn.00444d40
mov rbp, qword [rsp + 0x28]
add rsp, 0x30
ret
mov eax, esi
mov ecx, 8
call fcn.00457d20
mov eax, edi
mov ecx, 8
call fcn.00457d20
nop
nop dword [rax]
call fcn.004556c0
jmp fcn.00473600

Function at 0x473be0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x473cc6
sub rsp, 0x40
mov qword [rsp + 0x38], rbp
lea rbp, [rsp + 0x38]
movabs rdx, 0x6e113518f3df1bd9
mov qword [rsp + 0x1a], rdx
mov dword [rsp + 0x22], 0x796f7204
movabs rdx, 0x20b04040b0403
mov qword [rsp + 0x26], rdx
movabs rdx, 0x40600020b04040b
mov qword [rsp + 0x28], rdx
movabs rdx, 0xb00060208050101
mov qword [rsp + 0x30], rdx
xor eax, eax
nop
jmp 0x473c60
movzx r9d, byte [rsp + rsi + 0x1a]
sub r9d, edx
lea edx, [r9 + 0x58]
mov byte [rsp + rdi + 0x1a], dl
lea edx, [r8 + 0x58]
mov byte [rsp + rsi + 0x1a], dl
add rax, 2
nop
cmp rax, 0x12
jge 0x473c8d
movzx edx, byte [rsp + rax + 0x26]
movzx esi, byte [rsp + rax + 0x27]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0xc
jae 0x473cb4
movzx r8d, byte [rsp + rdi + 0x1a]
sub r8d, edx
cmp rsi, 0xc
jb 0x473c42
jmp 0x473ca8
xor eax, eax
lea rbx, [rsp + 0x1a]
mov ecx, 0xc
call fcn.00444d40
mov rbp, qword [rsp + 0x38]
add rsp, 0x40
ret
mov eax, esi
mov ecx, 0xc
call fcn.00457d20
mov eax, edi
mov ecx, 0xc
nop dword [rax + rax]
call fcn.00457d20
nop
call fcn.004556c0
jmp fcn.00473be0