joyce8/EMBER2024-capa huggingface dataset:
Function at 0x495220
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x495306
push rbp
mov rbp, rsp
sub rsp, 0x38
movabs rdx, 0xba3db0e63730cabd
mov qword [rsp + 0x2a], rdx
movabs rdx, 0x3579c2c24c33ba3d
mov qword [rsp + 0x30], rdx
movabs rdx, 0x60b0a090c0a040a
mov qword [rsp + 0x18], rdx
movabs rdx, 0x90c060b0a090c0a
mov qword [rsp + 0x1a], rdx
movabs rdx, 0xb050a000101070c
mov qword [rsp + 0x22], rdx
xor eax, eax
nop
jmp 0x4952a0
movzx r9d, byte [rsp + rsi + 0x2a]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x63]
mov byte [rsp + rdi + 0x2a], dl
mov byte [rsp + rsi + 0x2a], r8b
add rax, 2
nop dword [rax]
cmp rax, 0x12
jge 0x4952d2
movzx edx, byte [rsp + rax + 0x18]
movzx esi, byte [rsp + rax + 0x19]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0xe
jae 0x4952f7
movzx r8d, byte [rsp + rdi + 0x2a]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x63]
cmp rsi, 0xe
jb 0x495282
jmp 0x4952eb
xor eax, eax
lea rbx, [rsp + 0x2a]
mov ecx, 0xe
nop
call fcn.004669c0
add rsp, 0x38
pop rbp
ret
mov eax, esi
mov ecx, 0xe
call fcn.0046c880
mov eax, edi
mov ecx, 0xe
nop
call fcn.0046c880
nop
call fcn.0046a5a0
jmp fcn.00495220

Function at 0x497440
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x49753d
push rbp
mov rbp, rsp
sub rsp, 0x50
movabs rdx, 0x539535787d369a68
mov qword [rsp + 0x38], rdx
movabs rdx, 0x9056a039365b38b7
mov qword [rsp + 0x40], rdx
movabs rdx, 0x5532d09335347631
mov qword [rsp + 0x48], rdx
movabs rdx, 0x10d11000300170e
mov qword [rsp + 0x18], rdx
movabs rdx, 0x70d031501110814
mov qword [rsp + 0x20], rdx
movabs rdx, 0xa03061411080304
mov qword [rsp + 0x28], rdx
movabs rdx, 0x60004001407070f
mov qword [rsp + 0x30], rdx
xor eax, eax
jmp 0x4974e0
movzx r9d, byte [rsp + rsi + 0x38]
sub r9d, edx
lea edx, [r9 - 8]
mov byte [rsp + rdi + 0x38], dl
lea edx, [r8 - 8]
mov byte [rsp + rsi + 0x38], dl
add rax, 2
nop dword [rax]
cmp rax, 0x20
jge 0x49750d
movzx edx, byte [rsp + rax + 0x18]
movzx esi, byte [rsp + rax + 0x19]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x18
jae 0x497530
movzx r8d, byte [rsp + rdi + 0x38]
sub r8d, edx
cmp rsi, 0x18
jb 0x4974bf
jmp 0x497524
xor eax, eax
lea rbx, [rsp + 0x38]
mov ecx, 0x18
call fcn.004669c0
add rsp, 0x50
pop rbp
ret
mov eax, esi
mov ecx, 0x18
call fcn.0046c880
mov eax, edi
mov ecx, 0x18
call fcn.0046c880
nop
nop dword [rax]
call fcn.0046a5a0
jmp fcn.00497440
Function at 0x497560
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x49765b
push rbp
mov rbp, rsp
sub rsp, 0x50
movabs rdx, 0x6aa580ad303238ac
mov qword [rsp + 0x38], rdx
movabs rdx, 0x300e373673a96139
mov qword [rsp + 0x40], rdx
movabs rdx, 0x35707f765ccd2a70
mov qword [rsp + 0x48], rdx
movabs rdx, 0x50400140e051104
mov qword [rsp + 0x1c], rdx
movabs rdx, 0xb04071205100a11
mov qword [rsp + 0x24], rdx
movabs rdx, 0x61415150b040712
mov qword [rsp + 0x28], rdx
movabs rdx, 0x1016100711141309
mov qword [rsp + 0x30], rdx
xor eax, eax
jmp 0x4975f9
movzx r9d, byte [rsp + rsi + 0x38]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x59]
mov byte [rsp + rdi + 0x38], dl
mov byte [rsp + rsi + 0x38], r8b
add rax, 2
cmp rax, 0x1c
jge 0x49762b
movzx edx, byte [rsp + rax + 0x1c]
movzx esi, byte [rsp + rax + 0x1d]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x18
jae 0x49764e
movzx r8d, byte [rsp + rdi + 0x38]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x59]
cmp rsi, 0x18
jb 0x4975df
jmp 0x497642
xor eax, eax
lea rbx, [rsp + 0x38]
mov ecx, 0x18
call fcn.004669c0
add rsp, 0x50
pop rbp
ret
mov eax, esi
mov ecx, 0x18
call fcn.0046c880
mov eax, edi
mov ecx, 0x18
call fcn.0046c880
nop
nop dword [rax + rax]
call fcn.0046a5a0
jmp fcn.00497560

Function at 0x49aae0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x49ac0c
push rbp
mov rbp, rsp
sub rsp, 0x68
movabs rdx, 0x3c363c343c332347
mov qword [rsp + 0x4a], rdx
movabs rdx, 0x3532331c3324393a
mov qword [rsp + 0x52], rdx
movabs rdx, 0x19191f3427393532
mov qword [rsp + 0x58], rdx
movabs rdx, 0x443d2b3439374821
mov qword [rsp + 0x60], rdx
movabs rdx, 0x7001c081705141d
mov qword [rsp + 0x1e], rdx
movabs rdx, 0x11b131b050f14
mov qword [rsp + 0x26], rdx
movabs rdx, 0x101b030900011b13
mov qword [rsp + 0x2a], rdx
movabs rdx, 0x16011a1709021319
mov qword [rsp + 0x32], rdx
movabs rdx, 0x111d040700101d00
mov qword [rsp + 0x3a], rdx
movabs rdx, 0xa0a0c0a16101500
mov qword [rsp + 0x42], rdx
xor eax, eax
jmp 0x49aba6
movzx r9d, byte [rsp + rsi + 0x4a]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x20]
mov byte [rsp + rdi + 0x4a], dl
mov byte [rsp + rsi + 0x4a], r8b
add rax, 2
cmp rax, 0x2c
jge 0x49abdc
movzx edx, byte [rsp + rax + 0x1e]
movzx esi, byte [rsp + rax + 0x1f]
mov edi, edx
xor edx, esi
add edx, eax
nop dword [rax]
cmp rdi, 0x1e
jae 0x49abff
movzx r8d, byte [rsp + rdi + 0x4a]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x20]
cmp rsi, 0x1e
jb 0x49ab8c
jmp 0x49abf3
xor eax, eax
lea rbx, [rsp + 0x4a]
mov ecx, 0x1e
call fcn.004669c0
add rsp, 0x68
pop rbp
ret
mov eax, esi
mov ecx, 0x1e
call fcn.0046c880
mov eax, edi
mov ecx, 0x1e
call fcn.0046c880
nop
call fcn.0046a5a0
jmp fcn.0049aae0
Function at 0x49dfc0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x49e0e7
push rbp
mov rbp, rsp
sub rsp, 0x68
movabs rdx, 0x532739333c348534
mov qword [rsp + 0x44], rdx
movabs rdx, 0x3935489153273933
mov qword [rsp + 0x48], rdx
movabs rdx, 0x4c1725425324362e
mov qword [rsp + 0x50], rdx
movabs rdx, 0x2f89363632294150
mov qword [rsp + 0x58], rdx
movabs rdx, 0x3532315e40338733
mov qword [rsp + 0x60], rdx
movabs rdx, 0x71b081b1112160c
mov qword [rsp + 0x1c], rdx
movabs rdx, 0x201a0e07110b1209
mov qword [rsp + 0x24], rdx
movabs rdx, 0x1f06120904061d20
mov qword [rsp + 0x2c], rdx
movabs rdx, 0x403200e15011b01
mov qword [rsp + 0x34], rdx
movabs rdx, 0x101b1b131b20140f
mov qword [rsp + 0x3c], rdx
xor eax, eax
jmp 0x49e089
movzx r9d, byte [rsp + rsi + 0x44]
sub r9d, edx
lea edx, [r9 + 0x21]
mov byte [rsp + rdi + 0x44], dl
lea edx, [r8 + 0x21]
mov byte [rsp + rsi + 0x44], dl
add rax, 2
cmp rax, 0x28
jge 0x49e0b7
movzx edx, byte [rsp + rax + 0x1c]
movzx esi, byte [rsp + rax + 0x1d]
mov edi, edx
xor edx, esi
add edx, eax
nop
cmp rdi, 0x24
jae 0x49e0da
movzx r8d, byte [rsp + rdi + 0x44]
sub r8d, edx
cmp rsi, 0x24
jb 0x49e06c
jmp 0x49e0ce
xor eax, eax
lea rbx, [rsp + 0x44]
mov ecx, 0x24
call fcn.004669c0
add rsp, 0x68
pop rbp
ret
mov eax, esi
mov ecx, 0x24
call fcn.0046c880
mov eax, edi
mov ecx, 0x24
call fcn.0046c880
nop
call fcn.0046a5a0
jmp fcn.0049dfc0

Function at 0x49e6a0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x49e7ec
push rbp
mov rbp, rsp
sub rsp, 0x78
movabs rdx, 0x619553bf3b723124
mov qword [rsp + 0x52], rdx
movabs rdx, 0x503732505de76195
mov qword [rsp + 0x58], rdx
movabs rdx, 0x3353549a4da73635
mov qword [rsp + 0x60], rdx
movabs rdx, 0x9a9b38363ea1a54b
mov qword [rsp + 0x68], rdx
movabs rdx, 0x356222593b755d66
mov qword [rsp + 0x70], rdx
movabs rdx, 0x61202200608021d
mov qword [rsp + 0x1e], rdx
movabs rdx, 0x41e171806120220
mov qword [rsp + 0x22], rdx
movabs rdx, 0x61c091217221007
mov qword [rsp + 0x2a], rdx
movabs rdx, 0x21170607081f1624
mov qword [rsp + 0x32], rdx
movabs rdx, 0xa160d11181e0022
mov qword [rsp + 0x3a], rdx
movabs rdx, 0x1813240305140c21
mov qword [rsp + 0x42], rdx
movabs rdx, 0x231f021910201f22
mov qword [rsp + 0x4a], rdx
xor eax, eax
jmp 0x49e784
movzx r9d, byte [rsp + rsi + 0x52]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x58]
mov byte [rsp + rdi + 0x52], dl
mov byte [rsp + rsi + 0x52], r8b
add rax, 2
cmp rax, 0x34
jge 0x49e7bc
movzx edx, byte [rsp + rax + 0x1e]
movzx esi, byte [rsp + rax + 0x1f]
mov edi, edx
xor edx, esi
add edx, eax
nop word [rax + rax]
cmp rdi, 0x26
jae 0x49e7df
movzx r8d, byte [rsp + rdi + 0x52]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x58]
cmp rsi, 0x26
jb 0x49e76a
jmp 0x49e7d3
xor eax, eax
lea rbx, [rsp + 0x52]
mov ecx, 0x26
call fcn.004669c0
add rsp, 0x78
pop rbp
ret
mov eax, esi
mov ecx, 0x26
call fcn.0046c880
mov eax, edi
mov ecx, 0x26
call fcn.0046c880
nop
call fcn.0046a5a0
jmp fcn.0049e6a0
Function at 0x4a01e0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4a032c
push rbp
mov rbp, rsp
sub rsp, 0x78
movabs rdx, 0x3b51d018419d3936
mov qword [rsp + 0x50], rdx
movabs rdx, 0x4d327737ca39ac08
mov qword [rsp + 0x58], rdx
movabs rdx, 0x47f33756dc3790df
mov qword [rsp + 0x60], rdx
movabs rdx, 0x36cebc9360240acc
mov qword [rsp + 0x68], rdx
movabs rdx, 0xa332b7940b17c032
mov qword [rsp + 0x70], rdx
movabs rdx, 0x21031804021b2106
mov qword [rsp + 0x1c], rdx
movabs rdx, 0x2109131021031804
mov qword [rsp + 0x20], rdx
movabs rdx, 0x705141e0d051921
mov qword [rsp + 0x28], rdx
movabs rdx, 0x171a1a0f2716020b
mov qword [rsp + 0x30], rdx
movabs rdx, 0x24112308250f221c
mov qword [rsp + 0x38], rdx
movabs rdx, 0x191e05232718210f
mov qword [rsp + 0x40], rdx
movabs rdx, 0x81a1a211a1b1c1d
mov qword [rsp + 0x48], rdx
xor eax, eax
jmp 0x4a02c4
movzx r9d, byte [rsp + rsi + 0x50]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x4c]
mov byte [rsp + rdi + 0x50], dl
mov byte [rsp + rsi + 0x50], r8b
add rax, 2
cmp rax, 0x34
jge 0x4a02fc
movzx edx, byte [rsp + rax + 0x1c]
movzx esi, byte [rsp + rax + 0x1d]
mov edi, edx
xor edx, esi
add edx, eax
nop word [rax + rax]
cmp rdi, 0x28
jae 0x4a031f
movzx r8d, byte [rsp + rdi + 0x50]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x4c]
cmp rsi, 0x28
jb 0x4a02aa
jmp 0x4a0313
xor eax, eax
lea rbx, [rsp + 0x50]
mov ecx, 0x28
call fcn.004669c0
add rsp, 0x78
pop rbp
ret
mov eax, esi
mov ecx, 0x28
call fcn.0046c880
mov eax, edi
mov ecx, 0x28
call fcn.0046c880
nop
call fcn.0046a5a0
jmp fcn.004a01e0
Function at 0x4b2620
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4b2728
push rbp
mov rbp, rsp
sub rsp, 0x58
movabs rdx, 0x8b2f0e74e67972cc
mov qword [rsp + 0x3b], rdx
movabs rdx, 0x1f486e69202315d1
mov qword [rsp + 0x43], rdx
movabs rdx, 0xc720cfcd6c1f486e
mov qword [rsp + 0x48], rdx
movabs rdx, 0x20f1d9bc73ccb3b2
mov qword [rsp + 0x50], rdx
movabs rdx, 0x503160f0f0a1b09
mov qword [rsp + 0x1d], rdx
movabs rdx, 0xf1208111515051a
mov qword [rsp + 0x25], rdx
movabs rdx, 0x121a191b120e0f12
mov qword [rsp + 0x2b], rdx
movabs rdx, 0xa09121407170300
mov qword [rsp + 0x33], rdx
xor eax, eax
jmp 0x4b26cb
movzx r9d, byte [rsp + rsi + 0x3b]
sub r9d, edx
lea edx, [r9 - 0x43]
mov byte [rsp + rdi + 0x3b], dl
lea edx, [r8 - 0x43]
mov byte [rsp + rsi + 0x3b], dl
add rax, 2
cmp rax, 0x1e
jge 0x4b26f8
movzx edx, byte [rsp + rax + 0x1d]
movzx esi, byte [rsp + rax + 0x1e]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x1d
jae 0x4b271b
movzx r8d, byte [rsp + rdi + 0x3b]
sub r8d, edx
cmp rsi, 0x1d
jb 0x4b26ae
jmp 0x4b270f
xor eax, eax
lea rbx, [rsp + 0x3b]
mov ecx, 0x1d
call fcn.004669c0
add rsp, 0x58
pop rbp
ret
mov eax, esi
mov ecx, 0x1d
call fcn.0046c880
mov eax, edi
mov ecx, 0x1d
call fcn.0046c880
nop
call fcn.0046a5a0
jmp fcn.004b2620

Function at 0x4b4900
Capabilities:
Decrypt data using aes via x86 extensions

Disassembly:
mov rcx, qword [rsp + 8]
mov rax, qword [rsp + 0x10]
mov rdx, qword [rsp + 0x18]
mov rbx, qword [rsp + 0x20]
movups xmm1, xmmword [rax]
movups xmm0, xmmword [rbx]
add rax, 0x10
pxor xmm0, xmm1
sub rcx, 0xc
je 0x4b493f
jb 0x4b4954
movups xmm1, xmmword [rax]
aesdec xmm0, xmm1
movups xmm1, xmmword [rax + 0x10]
aesdec xmm0, xmm1
add rax, 0x20
movups xmm1, xmmword [rax]
aesdec xmm0, xmm1
movups xmm1, xmmword [rax + 0x10]
aesdec xmm0, xmm1
add rax, 0x20
movups xmm1, xmmword [rax]
aesdec xmm0, xmm1
movups xmm1, xmmword [rax + 0x10]
aesdec xmm0, xmm1
movups xmm1, xmmword [rax + 0x20]
aesdec xmm0, xmm1
movups xmm1, xmmword [rax + 0x30]
aesdec xmm0, xmm1
movups xmm1, xmmword [rax + 0x40]
aesdec xmm0, xmm1
movups xmm1, xmmword [rax + 0x50]
aesdec xmm0, xmm1
movups xmm1, xmmword [rax + 0x60]
aesdec xmm0, xmm1
movups xmm1, xmmword [rax + 0x70]
aesdec xmm0, xmm1
movups xmm1, xmmword [rax + 0x80]
aesdec xmm0, xmm1
movups xmm1, xmmword [rax + 0x90]
aesdeclast xmm0, xmm1
movups xmmword [rdx], xmm0
ret
Function at 0x4b49c0
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
push rbp
mov rbp, rsp
mov rcx, qword [rsp + 0x10]
mov rax, qword [rsp + 0x18]
mov rbx, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x28]
movups xmm0, xmmword [rax]
movups xmmword [rbx], xmm0
add rbx, 0x10
pxor xmm4, xmm4
cmp ecx, 0xc
je 0x4b4a94
jb 0x4b4af3
movups xmm2, xmmword [rax + 0x10]
movups xmmword [rbx], xmm2
add rbx, 0x10
aeskeygenassist xmm1, xmm2, 1
call fcn.004b48a0
aeskeygenassist xmm1, xmm0, 1
call fcn.004b48c0
aeskeygenassist xmm1, xmm2, 2
call fcn.004b48a0
aeskeygenassist xmm1, xmm0, 2
call fcn.004b48c0
aeskeygenassist xmm1, xmm2, 4
call fcn.004b48a0
aeskeygenassist xmm1, xmm0, 4
call fcn.004b48c0
aeskeygenassist xmm1, xmm2, 8
call fcn.004b48a0
aeskeygenassist xmm1, xmm0, 8
call fcn.004b48c0
aeskeygenassist xmm1, xmm2, 0x10
call fcn.004b48a0
aeskeygenassist xmm1, xmm0, 0x10
call fcn.004b48c0
aeskeygenassist xmm1, xmm2, 0x20
call fcn.004b48a0
aeskeygenassist xmm1, xmm0, 0x20
call fcn.004b48c0
aeskeygenassist xmm1, xmm2, 0x40
call fcn.004b48a0
jmp 0x4b4b61
movq xmm2, qword [rax + 0x10]
aeskeygenassist xmm1, xmm2, 1
call fcn.004b4800
aeskeygenassist xmm1, xmm2, 2
call fcn.004b4860
aeskeygenassist xmm1, xmm2, 4
call fcn.004b4800
aeskeygenassist xmm1, xmm2, 8
call fcn.004b4860
aeskeygenassist xmm1, xmm2, 0x10
call fcn.004b4800
aeskeygenassist xmm1, xmm2, 0x20
call fcn.004b4860
aeskeygenassist xmm1, xmm2, 0x40
call fcn.004b4800
aeskeygenassist xmm1, xmm2, 0x80
call fcn.004b4860
jmp 0x4b4b61
aeskeygenassist xmm1, xmm0, 1
call fcn.004b47c0
aeskeygenassist xmm1, xmm0, 2
call fcn.004b47c0
aeskeygenassist xmm1, xmm0, 4
call fcn.004b47c0
aeskeygenassist xmm1, xmm0, 8
call fcn.004b47c0
aeskeygenassist xmm1, xmm0, 0x10
call fcn.004b47c0
aeskeygenassist xmm1, xmm0, 0x20
call fcn.004b47c0
aeskeygenassist xmm1, xmm0, 0x40
call fcn.004b47c0
aeskeygenassist xmm1, xmm0, 0x80
call fcn.004b47c0
aeskeygenassist xmm1, xmm0, 0x1b
call fcn.004b47c0
aeskeygenassist xmm1, xmm0, 0x36
call fcn.004b47c0
sub rbx, 0x10
movups xmm1, xmmword [rbx]
movups xmmword [rdx], xmm1
dec rcx
movups xmm1, xmmword [rbx - 0x10]
aesimc xmm0, xmm1
movups xmmword [rdx + 0x10], xmm0
sub rbx, 0x10
add rdx, 0x10
dec rcx
jne 0x4b4b6e
movups xmm0, xmmword [rbx - 0x10]
movups xmmword [rdx + 0x10], xmm0
pop rbp
ret
Function at 0x4b4ea0
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4b50ab
push rbp
mov rbp, rsp
sub rsp, 0x48
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x68], rcx
add qword [rax + 0x58], rcx
mov rdx, qword [rax + 0x50]
test rdx, rdx
jle 0x4b4fc4
cmp rdx, 0x40
ja 0x4b509d
mov qword [rsp + 0x70], rdi
mov qword [rsp + 0x60], rbx
lea rsi, [rdx - 0x40]
mov r8, rsi
neg rsi
sar r8, 0x3f
and r8, rdx
lea rdx, [rax + r8]
lea rdx, [rdx + 0x10]
cmp rcx, rsi
cmovl rsi, rcx
mov qword [rsp + 0x28], rsi
cmp rbx, rdx
je 0x4b4f34
mov rax, rdx
mov rcx, rsi
call fcn.0046d200
mov rax, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x68]
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x28]
mov rdi, qword [rsp + 0x70]
mov rdx, qword [rax + 0x50]
add rdx, rsi
mov qword [rax + 0x50], rdx
nop
cmp rdx, 0x40
jne 0x4b4fa0
mov qword [rsp], rax
lea rcx, [rax + 0x10]
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], 0x40
mov qword [rsp + 0x18], 0x40
call fcn.004b5440
xorps xmm15, xmm15
mov r14, qword [0x00717b90]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x58]
mov qword [rax + 0x50], 0
mov rcx, qword [rsp + 0x68]
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x28]
mov rdi, qword [rsp + 0x70]
nop dword [rax]
cmp rcx, rsi
jb 0x4b5095
sub rdi, rsi
mov rdx, rdi
neg rdx
sar rdx, 0x3f
and rdx, rsi
mov r8, rcx
sub r8, rsi
add rbx, rdx
jmp 0x4b4fc7
mov r8, rcx
cmp r8, 0x40
jl 0x4b5045
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x38], r8
mov qword [rsp + 0x30], rdi
mov qword [rsp], rax
mov qword [rsp + 8], rbx
and r8, 0xffffffffffffffc0
mov qword [rsp + 0x20], r8
mov qword [rsp + 0x10], r8
mov qword [rsp + 0x18], rdi
call fcn.004b5440
xorps xmm15, xmm15
mov r14, qword [0x00717b90]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x20]
mov rcx, qword [rsp + 0x30]
mov rdx, rax
sub rax, rcx
sar rax, 0x3f
mov r8, qword [rsp + 0x38]
and rax, r8
and rax, 0xffffffffffffffc0
mov rcx, qword [rsp + 0x40]
lea rbx, [rcx + rax]
sub r8, rdx
mov rax, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x68]
test r8, r8
je 0x4b5088
lea rdx, [rax + 0x10]
cmp r8, 0x40
mov esi, 0x40
cmovl rsi, r8
nop dword [rax + rax]
cmp rbx, rdx
je 0x4b5084
mov qword [rsp + 0x38], rsi
mov rax, rdx
mov rcx, rsi
call fcn.0046d200
mov rax, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x38]
mov qword [rax + 0x50], rsi
mov rax, rcx
xor ebx, ebx
xor ecx, ecx
add rsp, 0x48
pop rbp
ret
mov rax, rsi
call fcn.0046c940
mov rax, rdx
mov ecx, 0x40
call fcn.0046c940
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
nop
call fcn.0046a5a0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
jmp fcn.004b4ea0
Function at 0x4b6840
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4b691d
push rbp
mov rbp, rsp
sub rsp, 0x40
movabs rdx, 0x91cca5c78cd3bb2e
mov qword [rsp + 0x32], rdx
movabs rdx, 0x1935d5c2c46f91cc
mov qword [rsp + 0x38], rdx
movabs rdx, 0x5070904060d0101
mov qword [rsp + 0x1e], rdx
movabs rdx, 0xc0a000b05070904
mov qword [rsp + 0x22], rdx
movabs rdx, 0xb0b020a0b050603
mov qword [rsp + 0x2a], rdx
xor eax, eax
nop
jmp 0x4b68c0
movzx r9d, byte [rsp + rsi + 0x32]
sub r9d, edx
lea edx, [r9 - 0x4d]
mov byte [rsp + rdi + 0x32], dl
lea edx, [r8 - 0x4d]
mov byte [rsp + rsi + 0x32], dl
add rax, 2
nop
cmp rax, 0x14
jge 0x4b68ed
movzx edx, byte [rsp + rax + 0x1e]
movzx esi, byte [rsp + rax + 0x1f]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0xe
jae 0x4b6910
movzx r8d, byte [rsp + rdi + 0x32]
sub r8d, edx
cmp rsi, 0xe
jb 0x4b68a2
jmp 0x4b6904
xor eax, eax
lea rbx, [rsp + 0x32]
mov ecx, 0xe
call fcn.004669c0
add rsp, 0x40
pop rbp
ret
mov eax, esi
mov ecx, 0xe
call fcn.0046c880
mov eax, edi
mov ecx, 0xe
call fcn.0046c880
nop
nop dword [rax]
call fcn.0046a5a0
jmp fcn.004b6840
Function at 0x4bf180
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4bf27d
push rbp
mov rbp, rsp
sub rsp, 0x50
movabs rdx, 0xfc16b48f638aa2b9
mov qword [rsp + 0x38], rdx
movabs rdx, 0x636195a29515b251
mov qword [rsp + 0x40], rdx
movabs rdx, 0xff251366196f0e6b
mov qword [rsp + 0x48], rdx
movabs rdx, 0xd0b0408040b0517
mov qword [rsp + 0x1a], rdx
movabs rdx, 0xb1101090c020c
mov qword [rsp + 0x22], rdx
movabs rdx, 0xc1702070615000b
mov qword [rsp + 0x28], rdx
movabs rdx, 0x130a1116040a0d16
mov qword [rsp + 0x30], rdx
xor eax, eax
jmp 0x4bf220
movzx r9d, byte [rsp + rsi + 0x38]
sub r9d, edx
lea edx, [r9 - 0x80]
mov byte [rsp + rdi + 0x38], dl
lea edx, [r8 - 0x80]
mov byte [rsp + rsi + 0x38], dl
add rax, 2
nop dword [rax]
cmp rax, 0x1e
jge 0x4bf24d
movzx edx, byte [rsp + rax + 0x1a]
movzx esi, byte [rsp + rax + 0x1b]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x18
jae 0x4bf270
movzx r8d, byte [rsp + rdi + 0x38]
sub r8d, edx
cmp rsi, 0x18
jb 0x4bf1ff
jmp 0x4bf264
xor eax, eax
lea rbx, [rsp + 0x38]
mov ecx, 0x18
call fcn.004669c0
add rsp, 0x50
pop rbp
ret
mov eax, esi
mov ecx, 0x18
call fcn.0046c880
mov eax, edi
mov ecx, 0x18
call fcn.0046c880
nop
nop dword [rax]
call fcn.0046a5a0
jmp fcn.004bf180

Function at 0x4bf2a0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4bf39d
push rbp
mov rbp, rsp
sub rsp, 0x50
movabs rdx, 0x741765d678386e2f
mov qword [rsp + 0x3b], rdx
movabs rdx, 0xc31a786451741765
mov qword [rsp + 0x40], rdx
movabs rdx, 0x701a177320e58939
mov qword [rsp + 0x48], rdx
movabs rdx, 0x12040e060d121312
mov qword [rsp + 0x1f], rdx
movabs rdx, 0xe13020f08130a0b
mov qword [rsp + 0x27], rdx
movabs rdx, 0xf130c060e13020f
mov qword [rsp + 0x2b], rdx
movabs rdx, 0xf0c0a02000f0b0c
mov qword [rsp + 0x33], rdx
xor eax, eax
jmp 0x4bf340
movzx r9d, byte [rsp + rsi + 0x3b]
sub r9d, edx
lea edx, [r9 - 0x46]
mov byte [rsp + rdi + 0x3b], dl
lea edx, [r8 - 0x46]
mov byte [rsp + rsi + 0x3b], dl
add rax, 2
nop dword [rax]
cmp rax, 0x1c
jge 0x4bf36d
movzx edx, byte [rsp + rax + 0x1f]
movzx esi, byte [rsp + rax + 0x20]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x15
jae 0x4bf390
movzx r8d, byte [rsp + rdi + 0x3b]
sub r8d, edx
cmp rsi, 0x15
jb 0x4bf31f
jmp 0x4bf384
xor eax, eax
lea rbx, [rsp + 0x3b]
mov ecx, 0x15
call fcn.004669c0
add rsp, 0x50
pop rbp
ret
mov eax, esi
mov ecx, 0x15
call fcn.0046c880
mov eax, edi
mov ecx, 0x15
call fcn.0046c880
nop
nop dword [rax]
call fcn.0046a5a0
jmp fcn.004bf2a0
Function at 0x4c1380
Capabilities:
Encrypt data using rc4 prga

Disassembly:
lea r12, [rsp - 8]
cmp r12, qword [r14 + 0x10]
jbe 0x4c14dd
push rbp
mov rbp, rsp
add rsp, 0xffffffffffffff80
movabs rdx, 0xa3e8928baa967d88
mov qword [rsp + 0x53], rdx
movabs rdx, 0x7dc071c9746e69b6
mov qword [rsp + 0x5b], rdx
movabs rdx, 0xfc727cd39a7dc071
mov qword [rsp + 0x60], rdx
movabs rdx, 0x8f6e6e7ce13adc73
mov qword [rsp + 0x68], rdx
movabs rdx, 0xa3ba656df364698c
mov qword [rsp + 0x70], rdx
movabs rdx, 0xca65728f8165648e
mov qword [rsp + 0x78], rdx
movabs rdx, 0x3102c0f06122c2a
mov qword [rsp + 0x1b], rdx
movabs rdx, 0x121b242a122a0115
mov qword [rsp + 0x23], rdx
movabs rdx, 0xd1d0d0514242a03
mov qword [rsp + 0x2b], rdx
movabs rdx, 0x182c1118000e080d
mov qword [rsp + 0x33], rdx
movabs rdx, 0x1420082729251c04
mov qword [rsp + 0x3b], rdx
movabs rdx, 0x7161b100d142400
mov qword [rsp + 0x43], rdx
movabs rdx, 0x28110c2319070200
mov qword [rsp + 0x4b], rdx
xor eax, eax
jmp 0x4c1480
movzx r9d, byte [rsp + rsi + 0x53]
sub r9d, edx
lea edx, [r9 + 0xe]
mov byte [rsp + rdi + 0x53], dl
lea edx, [r8 + 0xe]
mov byte [rsp + rsi + 0x53], dl
add rax, 2
nop dword [rax + rax]
cmp rax, 0x38
jge 0x4c14ad
movzx edx, byte [rsp + rax + 0x1b]
movzx esi, byte [rsp + rax + 0x1c]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x2d
jae 0x4c14d0
movzx r8d, byte [rsp + rdi + 0x53]
sub r8d, edx
cmp rsi, 0x2d
jb 0x4c145e
jmp 0x4c14c4
xor eax, eax
lea rbx, [rsp + 0x53]
mov ecx, 0x2d
call fcn.004669c0
sub rsp, 0xffffffffffffff80
pop rbp
ret
mov eax, esi
mov ecx, 0x2d
call fcn.0046c880
mov eax, edi
mov ecx, 0x2d
call fcn.0046c880
nop
nop dword [rax]
call fcn.0046a5a0
jmp fcn.004c1380

Function at 0x4c2420
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4c250c
push rbp
mov rbp, rsp
sub rsp, 0x48
movabs rdx, 0xdc7416d5e9c01420
mov qword [rsp + 0x37], rdx
movabs rdx, 0x20dc7416d5e9c014
mov qword [rsp + 0x38], rdx
movabs rdx, 0x926691106c52e3dd
mov qword [rsp + 0x40], rdx
movabs rdx, 0xa040e090b0a0410
mov qword [rsp + 0x1f], rdx
movabs rdx, 0xe000a0b00040707
mov qword [rsp + 0x27], rdx
movabs rdx, 0x30701050d09020d
mov qword [rsp + 0x2f], rdx
xor eax, eax
jmp 0x4c24aa
movzx r9d, byte [rsp + rsi + 0x37]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x37]
mov byte [rsp + rdi + 0x37], dl
mov byte [rsp + rsi + 0x37], r8b
add rax, 2
cmp rax, 0x18
jge 0x4c24dc
movzx edx, byte [rsp + rax + 0x1f]
movzx esi, byte [rsp + rax + 0x20]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x11
jae 0x4c24ff
movzx r8d, byte [rsp + rdi + 0x37]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x37]
cmp rsi, 0x11
jb 0x4c2490
jmp 0x4c24f3
xor eax, eax
lea rbx, [rsp + 0x37]
mov ecx, 0x11
call fcn.004669c0
add rsp, 0x48
pop rbp
ret
mov eax, esi
mov ecx, 0x11
call fcn.0046c880
mov eax, edi
mov ecx, 0x11
call fcn.0046c880
nop
call fcn.0046a5a0
jmp fcn.004c2420