joyce8/EMBER2024-capa huggingface dataset:
Function at 0x452e80
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4027ef
sub rsp, 0x20
mov qword [rsp + 0x18], rbp
lea rbp, [rsp + 0x18]
mov rdx, qword [rax]
mov rcx, qword [rax + 8]
mov rax, rdx
nop
call fcn.00407e00
mov rbp, qword [rsp + 0x18]
add rsp, 0x20
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.00450de0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp 0x4027c0
cmp byte [0x006546af], 0
je 0x452e95
mov rcx, qword [rax + 8]
mov rax, qword [rax]
jmp 0x44fee0
jmp 0x4027c0

Function at 0x452ea0
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
mov eax, dword [rax]
movabs rcx, 0xe7037ed1a0b428db
xor rcx, rax
xor rax, rbx
xor rax, qword [0x00654980]
movabs rdx, 0xa0761d6478bd642f
xor rdx, rax
mov rax, rcx
mul rdx
xor rax, rdx
mov rcx, rax
movabs rax, 0x1d8e4e27c47d124b
mul rcx
nop
nop
xor rax, rdx
ret
cmp byte [0x006546af], 0
je 0x452ed5
movq xmm0, rbx
pinsrd xmm0, dword [rax], 2
aesenc xmm0, xmmword [0x00654d00]
aesenc xmm0, xmmword [0x00654d10]
aesenc xmm0, xmmword [0x00654d20]
movq rax, xmm0
ret
jmp 0x408000

Function at 0x452ee0
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
mov rax, qword [rax]
movabs rcx, 0xe7037ed1a0b428db
xor rcx, rax
xor rax, rbx
xor rax, qword [0x00654980]
movabs rdx, 0xa0761d6478bd642f
xor rdx, rax
mov rax, rcx
mul rdx
xor rax, rdx
mov rcx, rax
movabs rax, 0x1d8e4e27c47d1247
mul rcx
nop
nop
xor rax, rdx
ret
cmp byte [0x006546af], 0
je 0x452f16
movq xmm0, rbx
pinsrq xmm0, qword [rax], 1
aesenc xmm0, xmmword [0x00654d00]
aesenc xmm0, xmmword [0x00654d10]
aesenc xmm0, xmmword [0x00654d20]
movq rax, xmm0
ret
jmp 0x408060

Function at 0x454900
Capabilities:
Write file on windows

Disassembly:
sub rsp, 0x30
mov rcx, 0xfffffffffffffff4
mov qword [rsp], rcx
mov rax, qword [sym.imp.kernel32.dll_GetStdHandle]
call rax
mov rcx, rax
mov qword [rsp], rcx
lea rdx, [0x00654c80]
mov qword [rsp + 8], rdx
lea r8d, [0x006546c4]
mov qword [rsp + 0x10], r8
lea r9, [rsp + 0x28]
mov qword [r9], 0
mov qword [rsp + 0x18], r9
mov qword [rsp + 0x20], 0
mov rax, qword [sym.imp.kernel32.dll_WriteFile]
call rax
call fcn.00452dc0
add rsp, 0x30
ret

Function at 0x454e40
Capabilities:
Allocate thread local storage

Disassembly:
mov rax, rsp
and rsp, 0xfffffffffffffff0
sub rsp, 0x30
mov qword [rsp + 0x20], rax
mov rax, qword [sym.imp.kernel32.dll_TlsAlloc]
call rax
mov rsp, qword [rsp + 0x20]
mov rcx, rax
cmp rcx, 0x40
jb 0x454e70
mov rcx, 0x28
jmp 0x454e7b
shl rcx, 3
add rcx, 0x1480
mov qword [0x00654890], rcx
ret
Function at 0x459780
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x459892
sub rsp, 0x60
mov qword [rsp + 0x58], rbp
lea rbp, [rsp + 0x58]
movabs rdx, 0x69142a65640b655e
mov qword [rsp + 0x1d], rdx
movabs rdx, 0x576f6d542d6c4541
mov qword [rsp + 0x25], rdx
movabs rdx, 0x615b6e694c576f6d
mov qword [rsp + 0x2a], rdx
movabs rdx, 0x582d3d74293c0137
mov qword [rsp + 0x32], rdx
movabs rdx, 0xb081018170c171a
mov qword [rsp + 0x3a], rdx
movabs rdx, 0x2081c0f1a0d1610
mov qword [rsp + 0x42], rdx
movabs rdx, 0x13131313131b0208
mov qword [rsp + 0x48], rdx
movabs rdx, 0x305181507060d
mov qword [rsp + 0x50], rdx
xor eax, eax
jmp 0x459831
movzx r9d, byte [rsp + rsi + 0x1d]
sub r9d, edx
lea edx, [r9 + 0x2d]
mov byte [rsp + rdi + 0x1d], dl
lea edx, [r8 + 0x2d]
mov byte [rsp + rsi + 0x1d], dl
add rax, 2
cmp rax, 0x1e
jge 0x45985e
movzx edx, byte [rsp + rax + 0x3a]
movzx esi, byte [rsp + rax + 0x3b]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x1d
jae 0x459885
movzx r8d, byte [rsp + rdi + 0x1d]
sub r8d, edx
cmp rsi, 0x1d
jb 0x459814
jmp 0x459879
xor eax, eax
lea rbx, [rsp + 0x1d]
mov ecx, 0x1d
call fcn.004418e0
mov rbp, qword [rsp + 0x58]
add rsp, 0x60
ret
mov eax, esi
mov ecx, 0x1d
call fcn.00453440
mov eax, edi
mov ecx, 0x1d
call fcn.00453440
nop
call fcn.00450de0
jmp fcn.00459780

Function at 0x4598a0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x45997c
sub rsp, 0x40
mov qword [rsp + 0x38], rbp
lea rbp, [rsp + 0x38]
movabs rdx, 0xd2ee6deae06eee6e
mov qword [rsp + 0x28], rdx
movabs rdx, 0xef6ea4eb60ffe2d6
mov qword [rsp + 0x30], rdx
movabs rdx, 0xf07030d060b0c01
mov qword [rsp + 0x18], rdx
movabs rdx, 0x90604080a060f09
mov qword [rsp + 0x20], rdx
xor eax, eax
jmp 0x459912
movzx r9d, byte [rsp + rsi + 0x28]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x77]
mov byte [rsp + rdi + 0x28], dl
mov byte [rsp + rsi + 0x28], r8b
add rax, 2
cmp rax, 0x10
jge 0x459948
movzx edx, byte [rsp + rax + 0x18]
movzx esi, byte [rsp + rax + 0x19]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x10
jae 0x45996f
movzx r8d, byte [rsp + rdi + 0x28]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x77]
nop dword [rax]
cmp rsi, 0x10
jb 0x4598f8
jmp 0x459963
xor eax, eax
lea rbx, [rsp + 0x28]
mov ecx, 0x10
call fcn.004418e0
mov rbp, qword [rsp + 0x38]
add rsp, 0x40
ret
mov eax, esi
mov ecx, 0x10
call fcn.00453440
mov eax, edi
mov ecx, 0x10
call fcn.00453440
nop
nop dword [rax]
call fcn.00450de0
jmp fcn.004598a0
Function at 0x45a440
Capabilities:
Encrypt data using rc4 prga

Disassembly:
lea r12, [rsp - 0x68]
cmp r12, qword [r14 + 0x10]
jbe 0x45a6a8
sub rsp, 0xe8
mov qword [rsp + 0xe0], rbp
lea rbp, [rsp + 0xe0]
movups xmmword [rsp + 0xf0], xmm15
movups xmmword [rsp + 0x100], xmm15
movups xmmword [rsp + 0x110], xmm15
movups xmmword [rsp + 0x120], xmm15
movabs rdx, 0x563d31cf4b9c60ac
mov qword [rsp + 0x52], rdx
movabs rdx, 0x19b61d9a2b3cb3d
mov qword [rsp + 0x5a], rdx
movabs rdx, 0x8bb2b2d7b3b8d5a
mov qword [rsp + 0x62], rdx
movabs rdx, 0x50c6e601e212735
mov qword [rsp + 0x6a], rdx
movabs rdx, 0xe3d6d5d2e80bd7b3
mov qword [rsp + 0x72], rdx
movabs rdx, 0xbe12056d45c67c0
mov qword [rsp + 0x7a], rdx
movabs rdx, 0xe0fee722e3b0e6b4
mov qword [rsp + 0x82], rdx
movabs rdx, 0xfed714da09130eca
mov qword [rsp + 0x8a], rdx
movabs rdx, 0x2c222c271d3c0a01
mov qword [rsp + 0x92], rdx
movabs rdx, 0x10230211272a2a38
mov qword [rsp + 0x9a], rdx
movabs rdx, 0x32125383e021023
mov qword [rsp + 0xa0], rdx
movabs rdx, 0x407130d063d2635
mov qword [rsp + 0xa8], rdx
movabs rdx, 0xc111c0628160f09
mov qword [rsp + 0xb0], rdx
movabs rdx, 0x24310d1c2e252436
mov qword [rsp + 0xb8], rdx
movabs rdx, 0x20333d172a13043e
mov qword [rsp + 0xc0], rdx
movabs rdx, 0x3f0a37302b29033d
mov qword [rsp + 0xc8], rdx
movabs rdx, 0x27310e00010b0432
mov qword [rsp + 0xd0], rdx
movabs rdx, 0x3c3d2106232b310a
mov qword [rsp + 0xd8], rdx
xor eax, eax
nop
jmp 0x45a5e0
movzx r8d, byte [rsp + rbx + 0x52]
lea edx, [r8 + rdx]
lea edx, [rdx + 0x15]
mov byte [rsp + rsi + 0x52], dl
mov byte [rsp + rbx + 0x52], dil
add rax, 2
nop dword [rax]
cmp rax, 0x4e
jge 0x45a61d
movzx edx, byte [rsp + rax + 0x92]
movzx ebx, byte [rsp + rax + 0x93]
mov esi, edx
xor edx, ebx
add edx, eax
nop dword [rax]
cmp rsi, 0x40
jae 0x45a69b
movzx edi, byte [rsp + rsi + 0x52]
lea edi, [rdi + rdx]
lea edi, [rdi + 0x15]
cmp rbx, 0x40
jb 0x45a5c2
jmp 0x45a68f
movups xmmword [rsp + 0x12], xmm15
movups xmmword [rsp + 0x22], xmm15
movups xmmword [rsp + 0x32], xmm15
movups xmmword [rsp + 0x42], xmm15
xor eax, eax
jmp 0x45a645
movzx ecx, byte [rsp + rax + 0x52]
mov byte [rsp + rax + 0x12], cl
inc rax
cmp rax, 0x40
jl 0x45a639
movups xmm0, xmmword [rsp + 0x12]
movups xmmword [rsp + 0xf0], xmm0
movups xmm0, xmmword [rsp + 0x22]
movups xmmword [rsp + 0x100], xmm0
movups xmm0, xmmword [rsp + 0x32]
movups xmmword [rsp + 0x110], xmm0
movups xmm0, xmmword [rsp + 0x42]
movups xmmword [rsp + 0x120], xmm0
mov rbp, qword [rsp + 0xe0]
add rsp, 0xe8
ret
mov eax, ebx
mov ecx, 0x40
call fcn.00453440
mov eax, esi
mov ecx, 0x40
call fcn.00453440
nop
call fcn.00450de0
jmp fcn.0045a440
Function at 0x45e820
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x45e916
sub rsp, 0x48
mov qword [rsp + 0x40], rbp
lea rbp, [rsp + 0x40]
movabs rdx, 0x5032cfc4ee39ca0a
mov qword [rsp + 0x1b], rdx
movabs rdx, 0xce5032cfc4ee39ca
mov qword [rsp + 0x1c], rdx
movabs rdx, 0x3548d7386fc03552
mov qword [rsp + 0x24], rdx
movabs rdx, 0xf0c0b09090f070c
mov qword [rsp + 0x2c], rdx
movabs rdx, 0x40000030f0c0b09
mov qword [rsp + 0x30], rdx
movabs rdx, 0x70804010e050308
mov qword [rsp + 0x38], rdx
xor eax, eax
jmp 0x45e8b3
movzx r9d, byte [rsp + rsi + 0x1b]
sub r9d, edx
lea edx, [r9 + 0x7b]
mov byte [rsp + rdi + 0x1b], dl
lea edx, [r8 + 0x7b]
mov byte [rsp + rsi + 0x1b], dl
add rax, 2
cmp rax, 0x14
jge 0x45e8e2
movzx edx, byte [rsp + rax + 0x2c]
movzx esi, byte [rsp + rax + 0x2d]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x11
jae 0x45e909
movzx r8d, byte [rsp + rdi + 0x1b]
sub r8d, edx
cmp rsi, 0x11
jb 0x45e896
nop
jmp 0x45e8fd
xor eax, eax
lea rbx, [rsp + 0x1b]
mov ecx, 0x11
call fcn.004418e0
mov rbp, qword [rsp + 0x40]
add rsp, 0x48
ret
mov eax, esi
mov ecx, 0x11
call fcn.00453440
mov eax, edi
mov ecx, 0x11
call fcn.00453440
nop
call fcn.00450de0
nop dword [rax + rax]
jmp fcn.0045e820
Function at 0x461ec0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x461ff2
sub rsp, 0x70
mov qword [rsp + 0x68], rbp
lea rbp, [rsp + 0x68]
movabs rdx, 0xe04bdf30e143807
mov qword [rsp + 0x1c], rdx
movabs rdx, 0x1c2acc3022223334
mov qword [rsp + 0x24], rdx
movabs rdx, 0x25e4dbeb083311d2
mov qword [rsp + 0x2c], rdx
movabs rdx, 0x322002171530af
mov qword [rsp + 0x34], rdx
movabs rdx, 0xd0016151f180710
mov qword [rsp + 0x3c], rdx
movabs rdx, 0x61302161f1c1400
mov qword [rsp + 0x44], rdx
movabs rdx, 0x170f050406130216
mov qword [rsp + 0x48], rdx
movabs rdx, 0x300061b04030b11
mov qword [rsp + 0x50], rdx
movabs rdx, 0x1413050b070b1a1c
mov qword [rsp + 0x58], rdx
movabs rdx, 0xf17050e060a151d
mov qword [rsp + 0x60], rdx
xor eax, eax
jmp 0x461f8f
movzx r9d, byte [rsp + rsi + 0x1c]
sub r9d, edx
lea edx, [r9 + 0x40]
mov byte [rsp + rdi + 0x1c], dl
lea edx, [r8 + 0x40]
mov byte [rsp + rsi + 0x1c], dl
add rax, 2
cmp rax, 0x2c
jge 0x461fbc
movzx edx, byte [rsp + rax + 0x3c]
movzx esi, byte [rsp + rax + 0x3d]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x20
jae 0x461fe5
movzx r8d, byte [rsp + rdi + 0x1c]
sub r8d, edx
cmp rsi, 0x20
jb 0x461f72
jmp 0x461fd7
xor eax, eax
lea rbx, [rsp + 0x1c]
mov ecx, 0x20
call fcn.004418e0
mov rbp, qword [rsp + 0x68]
add rsp, 0x70
ret
mov eax, esi
mov ecx, 0x20
nop
call fcn.00453440
mov eax, edi
mov ecx, 0x20
call fcn.00453440
nop
call fcn.00450de0
jmp fcn.00461ec0
Function at 0x463140
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x463288
sub rsp, 0x70
mov qword [rsp + 0x68], rbp
lea rbp, [rsp + 0x68]
movabs rdx, 0x317456378b5a3f57
mov qword [rsp + 0x1b], rdx
movabs rdx, 0x569943317456378b
mov qword [rsp + 0x1e], rdx
movabs rdx, 0x338a7254355a3195
mov qword [rsp + 0x26], rdx
movabs rdx, 0xa0b333357743bb83
mov qword [rsp + 0x2e], rdx
movabs rdx, 0x357136695c3237b7
mov qword [rsp + 0x36], rdx
movabs rdx, 0x3141909101b1a0b
mov qword [rsp + 0x3e], rdx
movabs rdx, 0x1a031114160121
mov qword [rsp + 0x46], rdx
movabs rdx, 0x211001a03111416
mov qword [rsp + 0x48], rdx
movabs rdx, 0x9061e0b101e1913
mov qword [rsp + 0x50], rdx
movabs rdx, 0x50319091f0f0d06
mov qword [rsp + 0x58], rdx
movabs rdx, 0x21160f1e08150a01
mov qword [rsp + 0x60], rdx
xor eax, eax
nop
jmp 0x463220
movzx r9d, byte [rsp + rsi + 0x1b]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x4b]
mov byte [rsp + rdi + 0x1b], dl
mov byte [rsp + rsi + 0x1b], r8b
add rax, 2
nop dword [rax]
cmp rax, 0x2a
jge 0x463252
movzx edx, byte [rsp + rax + 0x3e]
movzx esi, byte [rsp + rax + 0x3f]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x23
jae 0x46327b
movzx r8d, byte [rsp + rdi + 0x1b]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x4b]
cmp rsi, 0x23
jb 0x463202
jmp 0x46326f
xor eax, eax
lea rbx, [rsp + 0x1b]
mov ecx, 0x23
nop
call fcn.004418e0
mov rbp, qword [rsp + 0x68]
add rsp, 0x70
ret
mov eax, esi
mov ecx, 0x23
call fcn.00453440
mov eax, edi
mov ecx, 0x23
call fcn.00453440
nop
call fcn.00450de0
jmp fcn.00463140
Function at 0x465d00
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x465e5f
add rsp, 0xffffffffffffff80
mov qword [rsp + 0x78], rbp
lea rbp, [rsp + 0x78]
movabs rdx, 0x34334b2e34836dae
mov qword [rsp + 0x1a], rdx
movabs rdx, 0x508e4b352d395f4b
mov qword [rsp + 0x22], rdx
movabs rdx, 0x3952508e4b352d39
mov qword [rsp + 0x24], rdx
movabs rdx, 0x9068aa4b31314455
mov qword [rsp + 0x2c], rdx
movabs rdx, 0x5c30853139543238
mov qword [rsp + 0x34], rdx
movabs rdx, 0x355a4d3838385e7b
mov qword [rsp + 0x3c], rdx
movabs rdx, 0x17190e1f02000825
mov qword [rsp + 0x44], rdx
movabs rdx, 0x1912100e17190e1f
mov qword [rsp + 0x48], rdx
movabs rdx, 0x10201221718091f
mov qword [rsp + 0x50], rdx
movabs rdx, 0x160d1c0f130d2821
mov qword [rsp + 0x58], rdx
movabs rdx, 0x2508222328270528
mov qword [rsp + 0x60], rdx
movabs rdx, 0x2516130c230b2119
mov qword [rsp + 0x68], rdx
movabs rdx, 0x418171b1912001b
mov qword [rsp + 0x70], rdx
xor eax, eax
jmp 0x465df9
movzx r9d, byte [rsp + rsi + 0x1a]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x48]
mov byte [rsp + rdi + 0x1a], dl
mov byte [rsp + rsi + 0x1a], r8b
add rax, 2
cmp rax, 0x34
jge 0x465e2b
movzx edx, byte [rsp + rax + 0x44]
movzx esi, byte [rsp + rax + 0x45]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x2a
jae 0x465e52
movzx r8d, byte [rsp + rdi + 0x1a]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x48]
cmp rsi, 0x2a
jb 0x465ddf
jmp 0x465e46
xor eax, eax
lea rbx, [rsp + 0x1a]
mov ecx, 0x2a
call fcn.004418e0
mov rbp, qword [rsp + 0x78]
sub rsp, 0xffffffffffffff80
ret
mov eax, esi
mov ecx, 0x2a
call fcn.00453440
mov eax, edi
mov ecx, 0x2a
call fcn.00453440
nop
nop
call fcn.00450de0
jmp fcn.00465d00
Function at 0x46bce0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
lea r12, [rsp - 8]
cmp r12, qword [r14 + 0x10]
jbe 0x46be66
sub rsp, 0x88
mov qword [rsp + 0x80], rbp
lea rbp, [rsp + 0x80]
movabs rdx, 0x58c25f1ec66c5270
mov qword [rsp + 0x19], rdx
movabs rdx, 0xf4753b3177c103f1
mov qword [rsp + 0x21], rdx
movabs rdx, 0xd16f26f4753b3177
mov qword [rsp + 0x24], rdx
movabs rdx, 0x30e4e7366f42c8ce
mov qword [rsp + 0x2c], rdx
movabs rdx, 0x2070a33a1b73c920
mov qword [rsp + 0x34], rdx
movabs rdx, 0x6e16e615eba9a4b
mov qword [rsp + 0x3c], rdx
movabs rdx, 0x1e121e240e19151f
mov qword [rsp + 0x44], rdx
movabs rdx, 0x2024100a09231517
mov qword [rsp + 0x4c], rdx
movabs rdx, 0x140317002024100a
mov qword [rsp + 0x50], rdx
movabs rdx, 0x51e1c29171f1308
mov qword [rsp + 0x58], rdx
movabs rdx, 0x11326090d130423
mov qword [rsp + 0x60], rdx
movabs rdx, 0xe25231e1f0a0f00
mov qword [rsp + 0x68], rdx
movabs rdx, 0x929171315212a12
mov qword [rsp + 0x70], rdx
movabs rdx, 0x1718060915001807
mov qword [rsp + 0x78], rdx
xor eax, eax
jmp 0x46bdf9
movzx r9d, byte [rsp + rsi + 0x19]
sub r9d, edx
lea edx, [r9 - 0x2b]
mov byte [rsp + rdi + 0x19], dl
lea edx, [r8 - 0x2b]
mov byte [rsp + rsi + 0x19], dl
add rax, 2
cmp rax, 0x3c
jge 0x46be28
movzx edx, byte [rsp + rax + 0x44]
movzx esi, byte [rsp + rax + 0x45]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x2b
jae 0x46be55
movzx r8d, byte [rsp + rdi + 0x19]
sub r8d, edx
nop
cmp rsi, 0x2b
jb 0x46bddc
jmp 0x46be49
xor eax, eax
lea rbx, [rsp + 0x19]
mov ecx, 0x2b
call fcn.004418e0
mov rbp, qword [rsp + 0x80]
add rsp, 0x88
ret
mov eax, esi
mov ecx, 0x2b
call fcn.00453440
mov eax, edi
mov ecx, 0x2b
nop dword [rax]
call fcn.00453440
nop
call fcn.00450de0
jmp fcn.0046bce0
Function at 0x46be80
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x46bfd2
sub rsp, 0x78
mov qword [rsp + 0x70], rbp
lea rbp, [rsp + 0x70]
movabs rdx, 0x912cc574aba7b3ab
mov qword [rsp + 0x18], rdx
movabs rdx, 0x6400ca99912cc574
mov qword [rsp + 0x1c], rdx
movabs rdx, 0xf6986c49b0af34e9
mov qword [rsp + 0x24], rdx
movabs rdx, 0x70e6d7c1aa829064
mov qword [rsp + 0x2c], rdx
movabs rdx, 0x389ece55ceb00bea
mov qword [rsp + 0x34], rdx
movabs rdx, 0x80900161506101f
mov qword [rsp + 0x3c], rdx
movabs rdx, 0x11c071308090016
mov qword [rsp + 0x40], rdx
movabs rdx, 0xc1d08020a18001d
mov qword [rsp + 0x48], rdx
movabs rdx, 0x21201a1301011921
mov qword [rsp + 0x50], rdx
movabs rdx, 0x1820130a030815
mov qword [rsp + 0x58], rdx
movabs rdx, 0xc1210220f081e17
mov qword [rsp + 0x60], rdx
movabs rdx, 0x1d07130507100a0e
mov qword [rsp + 0x68], rdx
xor eax, eax
jmp 0x46bf6d
movzx r9d, byte [rsp + rsi + 0x18]
sub r9d, edx
lea edx, [r9 - 0x1a]
mov byte [rsp + rdi + 0x18], dl
lea edx, [r8 - 0x1a]
mov byte [rsp + rsi + 0x18], dl
add rax, 2
cmp rax, 0x34
jge 0x46bf9a
movzx edx, byte [rsp + rax + 0x3c]
movzx esi, byte [rsp + rax + 0x3d]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x24
jae 0x46bfc5
movzx r8d, byte [rsp + rdi + 0x18]
sub r8d, edx
cmp rsi, 0x24
jb 0x46bf50
jmp 0x46bfb5
xor eax, eax
lea rbx, [rsp + 0x18]
mov ecx, 0x24
call fcn.004418e0
mov rbp, qword [rsp + 0x70]
add rsp, 0x78
ret
mov eax, esi
mov ecx, 0x24
nop dword [rax]
call fcn.00453440
mov eax, edi
mov ecx, 0x24
call fcn.00453440
nop
call fcn.00450de0
jmp fcn.0046be80

Function at 0x472c00
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x472ccb
sub rsp, 0x38
mov qword [rsp + 0x30], rbp
lea rbp, [rsp + 0x30]
movabs rdx, 0x5e3e5a545a57685b
mov qword [rsp + 0x1a], rdx
mov word [rsp + 0x22], 0x2772
movabs rdx, 0x102040706040900
mov qword [rsp + 0x24], rdx
mov dword [rsp + 0x2c], 0x5030000
xor eax, eax
jmp 0x472c66
movzx r9d, byte [rsp + rsi + 0x1a]
sub r9d, edx
lea edx, [r9 + 0x17]
mov byte [rsp + rdi + 0x1a], dl
lea edx, [r8 + 0x17]
mov byte [rsp + rsi + 0x1a], dl
add rax, 2
cmp rax, 0xc
jge 0x472c97
movzx edx, byte [rsp + rax + 0x24]
movzx esi, byte [rsp + rax + 0x25]
mov edi, edx
xor edx, esi
add edx, eax
nop dword [rax]
cmp rdi, 0xa
jae 0x472cbe
movzx r8d, byte [rsp + rdi + 0x1a]
sub r8d, edx
cmp rsi, 0xa
jb 0x472c49
jmp 0x472cb2
xor eax, eax
lea rbx, [rsp + 0x1a]
mov ecx, 0xa
call fcn.004418e0
mov rbp, qword [rsp + 0x30]
add rsp, 0x38
ret
mov eax, esi
mov ecx, 0xa
call fcn.00453440
mov eax, edi
mov ecx, 0xa
call fcn.00453440
nop
call fcn.00450de0
jmp fcn.00472c00
Function at 0x473720
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4737fc
sub rsp, 0x40
mov qword [rsp + 0x38], rbp
lea rbp, [rsp + 0x38]
movabs rdx, 0x53dae4614cd3c0ee
mov qword [rsp + 0x1d], rdx
movabs rdx, 0xe8dd47e24753dae4
mov qword [rsp + 0x22], rdx
movabs rdx, 0x1000706090c0503
mov qword [rsp + 0x2a], rdx
movabs rdx, 0x5060a060b020100
mov qword [rsp + 0x30], rdx
xor eax, eax
jmp 0x473792
movzx r9d, byte [rsp + rsi + 0x1d]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x80]
mov byte [rsp + rdi + 0x1d], dl
mov byte [rsp + rsi + 0x1d], r8b
add rax, 2
cmp rax, 0xe
jge 0x4737c8
movzx edx, byte [rsp + rax + 0x2a]
movzx esi, byte [rsp + rax + 0x2b]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0xd
jae 0x4737ef
movzx r8d, byte [rsp + rdi + 0x1d]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x80]
nop dword [rax]
cmp rsi, 0xd
jb 0x473778
jmp 0x4737e3
xor eax, eax
lea rbx, [rsp + 0x1d]
mov ecx, 0xd
call fcn.004418e0
mov rbp, qword [rsp + 0x38]
add rsp, 0x40
ret
mov eax, esi
mov ecx, 0xd
call fcn.00453440
mov eax, edi
mov ecx, 0xd
call fcn.00453440
nop
nop dword [rax]
call fcn.00450de0
jmp fcn.00473720

Function at 0x475f40
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x476012
sub rsp, 0x40
mov qword [rsp + 0x38], rbp
lea rbp, [rsp + 0x38]
movabs rdx, 0x1a620965c2aa1a4d
mov qword [rsp + 0x1c], rdx
mov dword [rsp + 0x24], 0x465eeb9
movabs rdx, 0x303060301010803
mov qword [rsp + 0x28], rdx
movabs rdx, 0x50b020503080709
mov qword [rsp + 0x30], rdx
xor eax, eax
jmp 0x475fab
movzx r9d, byte [rsp + rsi + 0x1c]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x49]
mov byte [rsp + rdi + 0x1c], dl
mov byte [rsp + rsi + 0x1c], r8b
add rax, 2
cmp rax, 0x10
jge 0x475fdd
movzx edx, byte [rsp + rax + 0x28]
movzx esi, byte [rsp + rax + 0x29]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0xc
jae 0x476005
movzx r8d, byte [rsp + rdi + 0x1c]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x49]
cmp rsi, 0xc
jb 0x475f91
jmp 0x475ff8
xor eax, eax
lea rbx, [rsp + 0x1c]
mov ecx, 0xc
call fcn.004418e0
mov rbp, qword [rsp + 0x38]
add rsp, 0x40
ret
mov eax, esi
mov ecx, 0xc
nop
call fcn.00453440
mov eax, edi
mov ecx, 0xc
call fcn.00453440
nop
call fcn.00450de0
jmp fcn.00475f40
Function at 0x477a40
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x477b3c
sub rsp, 0x50
mov qword [rsp + 0x48], rbp
lea rbp, [rsp + 0x48]
movabs rdx, 0xc27222f6453d003a
mov qword [rsp + 0x1f], rdx
movabs rdx, 0x40c27222f6453d00
mov qword [rsp + 0x20], rdx
movabs rdx, 0x6e0902123c172936
mov qword [rsp + 0x28], rdx
movabs rdx, 0x2020c0d08010707
mov qword [rsp + 0x30], rdx
movabs rdx, 0xe0c0b0003070909
mov qword [rsp + 0x38], rdx
movabs rdx, 0x50303040a0f080c
mov qword [rsp + 0x40], rdx
xor eax, eax
jmp 0x477ad0
movzx r9d, byte [rsp + rsi + 0x1f]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x21]
mov byte [rsp + rdi + 0x1f], dl
mov byte [rsp + rsi + 0x1f], r8b
add rax, 2
cmp rax, 0x18
jge 0x477b08
movzx edx, byte [rsp + rax + 0x30]
movzx esi, byte [rsp + rax + 0x31]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x11
jae 0x477b2f
movzx r8d, byte [rsp + rdi + 0x1f]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x21]
nop word [rax + rax]
cmp rsi, 0x11
jb 0x477ab6
jmp 0x477b23
xor eax, eax
lea rbx, [rsp + 0x1f]
mov ecx, 0x11
call fcn.004418e0
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
mov eax, esi
mov ecx, 0x11
call fcn.00453440
mov eax, edi
mov ecx, 0x11
call fcn.00453440
nop
nop dword [rax]
call fcn.00450de0
jmp fcn.00477a40

Function at 0x477e60
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x477f32
sub rsp, 0x38
mov qword [rsp + 0x30], rbp
lea rbp, [rsp + 0x30]
movabs rdx, 0x965014530e0b17aa
mov qword [rsp + 0x19], rdx
movabs rdx, 0x6e6169965014530e
mov qword [rsp + 0x1c], rdx
movabs rdx, 0x60207000600
mov qword [rsp + 0x24], rdx
mov dword [rsp + 0x2c], 0x7030105
xor eax, eax
jmp 0x477ece
movzx r9d, byte [rsp + rsi + 0x19]
sub r9d, edx
lea edx, [r9 + 0x64]
mov byte [rsp + rdi + 0x19], dl
lea edx, [r8 + 0x64]
mov byte [rsp + rsi + 0x19], dl
add rax, 2
cmp rax, 0xc
jge 0x477efb
movzx edx, byte [rsp + rax + 0x24]
movzx esi, byte [rsp + rax + 0x25]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0xb
jae 0x477f25
movzx r8d, byte [rsp + rdi + 0x19]
sub r8d, edx
cmp rsi, 0xb
jb 0x477eb1
jmp 0x477f16
xor eax, eax
lea rbx, [rsp + 0x19]
mov ecx, 0xb
call fcn.004418e0
mov rbp, qword [rsp + 0x30]
add rsp, 0x38
ret
mov eax, esi
mov ecx, 0xb
nop dword [rax]
call fcn.00453440
mov eax, edi
mov ecx, 0xb
call fcn.00453440
nop
call fcn.00450de0
jmp fcn.00477e60