joyce8/EMBER2024-capa huggingface dataset:
Function at 0x46b354
Capabilities:
Parse pe header

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x20
cmp rdx, 0x200
mov rdi, r8
mov rsi, rdx
mov rbx, rcx
mov dword [r8], 0
mov dword [r8 + 4], 0
jb 0x46b3d7
cmp word [rcx], 0x5a4d
jne 0x46b3d7
mov r9d, dword [rcx + 0x3c]
cmp r9d, 0x1000
jae 0x46b3d7
lea ecx, [r9 + 0x200]
cmp rcx, rdx
ja 0x46b3d7
test r9b, 7
jne 0x46b3d7
lea rdx, [rbx + r9]
cmp dword [rdx], 0x4550
jne 0x46b3d7
movzx ecx, word [rdx + 4]
sub ecx, 0x14c
je 0x46b411
sub ecx, 0x74
je 0x46b40a
sub ecx, 2
je 0x46b40a
sub ecx, 2
je 0x46b403
sub ecx, 0x3c
je 0x46b3fc
cmp ecx, 0x8464
je 0x46b411
mov rdx, rsi
mov rcx, rbx
call fcn.0046b118
test eax, eax
jne 0x46b3f5
mov rdx, rsi
mov rcx, rbx
call fcn.0046b1d4
test eax, eax
je 0x46b437
mov eax, 1
jmp 0x46b445
mov eax, 0x3030401
jmp 0x46b416
mov eax, 0x3030701
jmp 0x46b416
mov eax, 0x3030501
jmp 0x46b416
mov eax, 0x3030103
cmp word [rdx + 0x14], 0x400
ja 0x46b3d7
movzx ecx, word [rdx + 0x18]
cmp ecx, 0x10b
je 0x46b432
cmp ecx, 0x20b
jne 0x46b3d7
mov dword [r8], eax
jmp 0x46b3f5
mov r8, rdi
mov rdx, rsi
mov rcx, rbx
call fcn.0046b298
add rsp, 0x20
pop rdi
pop rsi
pop rbx
ret
Function at 0x47287c
Capabilities:
Encode data using xor

Disassembly:
xor r8d, r8d
cmp edx, 8
mov r9, rcx
jb 0x4728a3
mov ecx, edx
shr rcx, 3
mov eax, dword [r9 + 4]
add edx, 0xfffffff8
xor eax, dword [r9]
add r9, 8
xor r8d, eax
dec rcx
jne 0x47288d
cmp edx, 4
jb 0x4728af
xor r8d, dword [r9]
add r9, 4
and edx, 3
cmp edx, 2
jbe 0x4728c4
movzx eax, byte [r9]
shl eax, 0x10
xor r8d, eax
inc r9
cmp edx, 1
jbe 0x4728d6
movzx ecx, byte [r9]
shl ecx, 8
xor r8d, ecx
inc r9
test edx, edx
je 0x4728e1
movzx ecx, byte [r9]
xor r8d, ecx
mov eax, r8d
ret
Function at 0x4874f0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
movzx eax, word [rcx + 2]
cmp ax, word [rdx + 2]
je 0x4874fd
xor al, al
ret
movzx r10d, word [rdx]
cmp word [rcx], r10w
jne 0x48750a
mov al, 1
ret
cmp ax, 8
mov r8d, 0xffff
je 0x487524
cmp ax, 6
ja 0x48752a
mov r8d, 0x7fff
jmp 0x48752a
mov r8d, 0x7ff9
movzx eax, r10w
xor r9d, r9d
xor ax, word [rcx]
bt ax, 0xb
jae 0x48757d
cmp dword [rcx + 0x30], r9d
mov rax, qword [rcx + 0x28]
mov r11d, r9d
jbe 0x487559
cmp byte [rax], 0x80
jae 0x48757d
inc r11d
inc rax
cmp r11d, dword [rcx + 0x30]
jb 0x487548
mov r11d, dword [rdx + 0x30]
mov rax, qword [rdx + 0x28]
mov edx, r9d
cmp r11d, r9d
jbe 0x487578
cmp byte [rax], 0x80
jae 0x48757d
inc edx
inc rax
cmp edx, r11d
jb 0x487569
btr r8d, 0xb
movzx ecx, word [rcx]
movzx edx, r10w
and ecx, r8d
and edx, r8d
cmp ecx, edx
sete al
ret

Function at 0x496640
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp dword [rcx + 0x40], 0xa
mov r8, rcx
jae 0x4966b3
nop
nop
mov r9d, dword [r8]
cmp r9d, 8
jae 0x496688
mov r10, qword [r8 + 8]
cmp r10, qword [r8 + 0x10]
je 0x496784
movzx edx, byte [r10]
lea eax, [r9 + 8]
mov ecx, 0x18
sub ecx, r9d
mov dword [r8], eax
lea rax, [r10 + 1]
shl edx, cl
mov qword [r8 + 8], rax
or dword [r8 + 4], edx
mov eax, dword [r8 + 4]
add dword [r8], 0xfffffff8
mov ecx, eax
shl eax, 8
mov dword [r8 + 4], eax
mov eax, dword [r8 + 0x40]
shr ecx, 0x18
mov byte [rax + r8 + 0x70de], cl
inc dword [r8 + 0x40]
cmp dword [r8 + 0x40], 0xa
jb 0x496650
mov dword [r8 + 0x70e8], 0
movzx eax, byte [r8 + 0x70e4]
shl eax, 8
mov dword [r8 + 0x70e8], eax
movzx ecx, byte [r8 + 0x70e5]
or ecx, eax
shl ecx, 8
mov dword [r8 + 0x70e8], ecx
movzx edx, byte [r8 + 0x70e6]
or edx, ecx
shl edx, 8
mov dword [r8 + 0x70e8], edx
movzx eax, byte [r8 + 0x70e7]
or eax, edx
mov dword [r8 + 0x70e8], eax
cmp byte [r8 + 0x70de], 0x31
jne 0x496787
cmp byte [r8 + 0x70df], 0x41
jne 0x496787
cmp byte [r8 + 0x70e0], 0x59
jne 0x496787
cmp byte [r8 + 0x70e1], 0x26
jne 0x496787
cmp byte [r8 + 0x70e2], 0x53
jne 0x496787
cmp byte [r8 + 0x70e3], 0x59
jne 0x496787
cmp byte [r8 + 0x70f0], 0
jne 0x496756
inc qword [r8 + 0x70f8]
inc qword [r8 + 0x7100]
mov byte [r8 + 0x70f0], 1
mov eax, dword [r8 + 0x70ec]
rol eax, 1
xor eax, dword [r8 + 0x70e8]
mov dword [r8 + 0x70ec], eax
mov dword [r8 + 0x3c], 2
xor eax, eax
ret
cmp byte [r8 + 0x70de], 0x17
jne 0x49682b
cmp byte [r8 + 0x70df], 0x72
jne 0x49682b
cmp byte [r8 + 0x70e0], 0x45
jne 0x49682b
cmp byte [r8 + 0x70e1], 0x38
jne 0x49682b
cmp byte [r8 + 0x70e2], 0x50
jne 0x49682b
cmp byte [r8 + 0x70e3], 0x90
jne 0x49682b
cmp byte [r8 + 0x70f0], 0
jne 0x4967dc
inc qword [r8 + 0x70f8]
mov edx, dword [r8 + 4]
mov byte [r8 + 0x70f0], 1
test edx, edx
je 0x4967f4
mov byte [r8 + 0x70f2], 1
mov eax, dword [r8]
mov dword [r8 + 0x3c], 0xb
mov ecx, eax
and ecx, 7
sub eax, ecx
shl edx, cl
mov dword [r8], eax
mov eax, dword [r8 + 0x70ec]
mov dword [r8 + 4], edx
cmp dword [r8 + 0x70e8], eax
je 0x496784
mov byte [r8 + 0x70f1], 1
mov eax, 1
ret
Function at 0x49aad0
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x48
mov rax, qword [rcx + 0x10]
mov qword [rsp + 0x50], rbx
mov dword [rsp + 0x2c], 8
mov qword [rsp + 0x38], rax
lea rax, [rsp + 0x28]
mov r8d, edx
mov rdx, qword [rcx]
mov qword [rcx + 0x20], rax
mov rax, qword [rcx + 0x8cf8]
mov qword [rsp + 0x60], rsi
xor esi, esi
mov rbx, rcx
mov dword [rsp + 0x28], esi
mov byte [rsp + 0x30], sil
mov dword [rcx + 0x8ce8], esi
mov r9d, dword [rax + 0x19c]
call fcn.0049a2f0
mov rcx, qword [rbx + 0x8cf8]
cmp byte [rcx + 0x1e4], sil
je 0x49ab56
mov eax, dword [rbx + 0x8cec]
mov rcx, qword [rcx + 0x1a8]
imul rax, rax, 0x8e28
mov rcx, qword [rax + rcx + 0x8d18]
call fcn.004c50c0
cmp dword [rbx + 0x8ce8], esi
mov edx, esi
jbe 0x49ab97
lea r8, [rbx + 0x7ce8]
nop
nop
nop
mov rcx, qword [rbx + 0x8cf8]
inc edx
add r8, 4
mov eax, dword [rcx + 0x1a0]
rol eax, 1
xor eax, dword [r8 - 4]
mov dword [rcx + 0x1a0], eax
cmp edx, dword [rbx + 0x8ce8]
jb 0x49ab70
mov eax, dword [rsp + 0x28]
movzx r9d, byte [rsp + 0x30]
mov rdx, qword [rbx + 0x10]
mov rcx, qword [rbx + 0x8cf8]
lea r8d, [rax*8 + 8]
mov qword [rsp + 0x58], rbp
sub r8d, dword [rsp + 0x2c]
call fcn.0049a580
mov rbp, qword [rbx + 0x8cf8]
cmp byte [rbp + 0x1e4], sil
je 0x49ac66
mov qword [rsp + 0x68], rdi
mov edi, dword [rbx + 0x8cec]
inc edi
cmp edi, dword [rbp + 0x1e0]
cmove edi, esi
cmp qword [rbp + 0x200], rsi
je 0x49ac3c
lea rcx, [rbp + 0x160]
call fcn.00410b8c
mov ecx, 0xf
lea rdx, [rbx + 0x8d20]
sub ecx, dword [rbp + 0x158]
lea r8, [rsp + 0x20]
shr rcx, 3
lea r11, [rcx + rax]
mov rax, qword [rbx + 0x8cf8]
mov qword [rsp + 0x20], r11
mov rcx, qword [rax + 0x200]
mov rax, qword [rcx]
call qword [rax + 0x18]
mov esi, eax
mov rcx, qword [rbx + 0x8cf8]
mov r8d, edi
mov rdx, qword [rcx + 0x1a8]
imul r8, r8, 0x8e28
lea rcx, [r8 + rdx + 0x8d18]
call fcn.004c5130
mov rdi, qword [rsp + 0x68]
mov rbp, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x50]
mov eax, esi
mov rsi, qword [rsp + 0x60]
add rsp, 0x48
ret
Function at 0x4aaf40
Capabilities:
Encode data using xor

Disassembly:
mov rax, rsp
sub rsp, 0x68
mov qword [rax + 8], rbx
xor ebx, ebx
cmp r8, 0x40
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov rdi, r8
mov qword [rax - 0x48], rbx
mov qword [rax - 0x40], rbx
mov qword [rax - 0x38], rbx
mov qword [rax - 0x30], rbx
mov qword [rax - 0x28], rbx
mov qword [rax - 0x20], rbx
mov qword [rax - 0x18], rbx
mov qword [rax - 0x10], rbx
mov rbp, rdx
mov rsi, rcx
jbe 0x4aafaa
call fcn.004c3740
mov r8, rdi
mov rdx, rbp
mov rcx, rsi
call fcn.004c3df0
lea rdx, [rsp + 0x20]
mov rcx, rsi
call fcn.004c3f80
jmp 0x4aafb9
test r8, r8
je 0x4aafb9
lea rcx, [rsp + 0x20]
call sub.msvcrt.dll_memcpy
mov rdi, qword [rsp + 0x88]
mov rbp, qword [rsp + 0x78]
mov rax, rbx
nop
nop
xor byte [rsp + rax + 0x20], 0x36
xor byte [rsp + rax + 0x21], 0x36
add rax, 2
cmp rax, 0x40
jb 0x4aafd0
mov rcx, rsi
call fcn.004c3740
lea rdx, [rsp + 0x20]
mov r8d, 0x40
mov rcx, rsi
call fcn.004c3df0
nop
xor byte [rsp + rbx + 0x20], 0x6a
xor byte [rsp + rbx + 0x21], 0x6a
add rbx, 2
cmp rbx, 0x40
jb 0x4ab000
lea rcx, [rsi + 0x60]
call fcn.004c3740
lea rdx, [rsp + 0x20]
lea rcx, [rsi + 0x60]
mov r8d, 0x40
call fcn.004c3df0
mov rsi, qword [rsp + 0x80]
mov rbx, qword [rsp + 0x70]
add rsp, 0x68
ret

Function at 0x4ab0d0
Capabilities:
Encode data using xor

Disassembly:
mov rax, rsp
sub rsp, 0xe8
mov qword [rax + 8], rbx
xor ebx, ebx
cmp r8, 0x40
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov rdi, r8
mov qword [rsp + 0x20], rbx
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x48], rbx
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x58], rbx
mov rsi, rdx
mov rbp, rcx
jbe 0x4ab178
lea rcx, [rax - 0x68]
call fcn.004c3740
lea rcx, [rsp + 0x80]
mov r8, rdi
mov rdx, rsi
call fcn.004c3df0
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0x80]
call fcn.004c3f80
mov r11, rbx
nop
nop
nop
mov eax, dword [rsp + r11 + 0x60]
add r11, 4
cmp r11, 0x14
bswap eax
mov dword [rsp + r11 + 0x1c], eax
jb 0x4ab160
jmp 0x4ab1ab
test rdi, rdi
mov r8, rbx
je 0x4ab1ab
mov eax, r8d
mov rdx, r8
mov ecx, 3
and eax, 3
shr rdx, 2
inc r8
sub ecx, eax
movzx eax, byte [r8 + rsi - 1]
shl ecx, 3
shl eax, cl
or dword [rsp + rdx*4 + 0x20], eax
cmp r8, rdi
jb 0x4ab180
mov rdi, qword [rsp + 0x108]
mov rsi, qword [rsp + 0x100]
mov rax, rbx
nop
xor dword [rsp + rax*4 + 0x20], 0x36363636
inc rax
cmp rax, 0x10
jb 0x4ab1c0
mov rcx, rbp
call fcn.004c3740
lea rdx, [rsp + 0x20]
mov r8d, 0x10
mov rcx, rbp
call fcn.004c40d0
nop
xor dword [rsp + rbx*4 + 0x20], 0x6a6a6a6a
inc rbx
cmp rbx, 0x10
jb 0x4ab1f0
lea rcx, [rbp + 0x60]
call fcn.004c3740
lea rdx, [rsp + 0x20]
lea rcx, [rbp + 0x60]
mov r8d, 0x10
call fcn.004c40d0
mov rbp, qword [rsp + 0xf8]
mov rbx, qword [rsp + 0xf0]
add rsp, 0xe8
ret
Function at 0x4ab2c0
Capabilities:
Encode data using xor

Disassembly:
mov rax, rsp
sub rsp, 0xa8
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov rbx, rdx
mov qword [rax + 0x20], rdi
mov edi, r8d
lea rdx, [rsp + 0x20]
mov r8d, 5
mov rsi, rcx
call fcn.004c4070
lea rdx, [rsp + 0x60]
lea rcx, [rsi + 0x60]
mov r8d, 5
call fcn.004c4070
test edi, edi
mov rax, qword [rbx]
mov qword [rsp + 0x20], rax
mov rax, qword [rbx + 8]
mov qword [rsp + 0x28], rax
mov eax, dword [rbx + 0x10]
mov dword [rsp + 0x30], eax
je 0x4ab371
lea r8, [rsp + 0x60]
lea rdx, [rsp + 0x20]
mov rcx, rsi
call fcn.004c3770
lea r8, [rsp + 0x20]
lea rdx, [rsp + 0x60]
lea rcx, [rsi + 0x60]
call fcn.004c3770
mov eax, dword [rsp + 0x24]
mov r11d, dword [rsp + 0x20]
xor dword [rbx + 4], eax
mov eax, dword [rsp + 0x28]
xor dword [rbx], r11d
xor dword [rbx + 8], eax
mov eax, dword [rsp + 0x2c]
xor dword [rbx + 0xc], eax
mov eax, dword [rsp + 0x30]
xor dword [rbx + 0x10], eax
dec rdi
jne 0x4ab323
mov rdi, qword [rsp + 0xc8]
mov rsi, qword [rsp + 0xc0]
mov rbp, qword [rsp + 0xb8]
mov rbx, qword [rsp + 0xb0]
add rsp, 0xa8
ret

Function at 0x4ab8b0
Capabilities:
Generate random numbers via rtlgenrandom

Disassembly:
mov rax, rsp
sub rsp, 0xc8
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov rdi, rcx
lea rcx, [rsp + 0x30]
call fcn.004c4220
mov esi, 0x3e8
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
lea rdx, [rsp + 0xd0]
lea rcx, [rsp + 0x30]
mov r8d, 4
mov dword [rsp + 0xd0], eax
call fcn.004c4d80
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
lea rdx, [rsp + 0xd0]
lea rcx, [rsp + 0x30]
mov r8d, 4
mov dword [rsp + 0xd0], eax
call fcn.004c4d80
lea rcx, [rsp + 0xa0]
mov edx, 0x20
call sub.ADVAPI32.dll_SystemFunction036
test al, al
je 0x4ab94f
mov esi, 0x64
lea rdx, [rsp + 0xa0]
lea rcx, [rsp + 0x30]
lea r8d, [rsi - 0x44]
call fcn.004c4d80
mov qword [rsp + 0xd8], rbx
nop
nop
nop
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
test eax, eax
je 0x4ab984
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x30]
mov r8d, 8
call fcn.004c4d80
call qword [sym.imp.KERNEL32.dll_GetTickCount]
lea rdx, [rsp + 0xd0]
lea rcx, [rsp + 0x30]
mov r8d, 4
mov dword [rsp + 0xd0], eax
call fcn.004c4d80
mov ebx, 0x64
nop
lea rcx, [rsp + 0x30]
mov rdx, rdi
call fcn.004c4e80
lea rcx, [rsp + 0x30]
call fcn.004c4220
lea rcx, [rsp + 0x30]
mov r8d, 0x20
mov rdx, rdi
call fcn.004c4d80
dec rbx
jne 0x4ab9b0
add esi, 0xffffffff
jne 0x4ab960
lea rcx, [rsp + 0x30]
mov rdx, rdi
call fcn.004c4e80
mov rbx, qword [rsp + 0xd8]
mov byte [rdi + 0x20], sil
mov rdi, qword [rsp + 0xe8]
mov rsi, qword [rsp + 0xe0]
add rsp, 0xc8
ret
Function at 0x4abcd0
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x28
test r8, r8
mov eax, dword [rcx + 4]
mov qword [rsp + 0x30], rbx
movsxd rbx, dword [rcx]
mov qword [rsp + 0x38], rbp
mov qword [rsp + 0x40], rsi
mov qword [rsp + 0x48], rdi
mov qword [rsp + 0x20], r12
lea rbp, [rcx + rax*4 + 8]
mov rsi, r8
mov rdi, rdx
mov r12, rcx
je 0x4abda8
cmp ebx, 0x10
je 0x4abd38
lea rdx, [rbp + rbx]
nop
nop
nop
movzx eax, byte [rdx]
inc rdi
inc ebx
xor byte [rdi - 1], al
inc rdx
dec rsi
je 0x4abd38
cmp ebx, 0x10
jne 0x4abd20
cmp rsi, 0x10
jb 0x4abd64
mov rbx, rsi
lea rcx, [rbp + 0x10]
mov rdx, rdi
shr rbx, 4
mov r8, rbx
call qword [0x00510830]
shl rbx, 4
add rdi, rbx
sub rsi, rbx
mov ebx, 0x10
test rsi, rsi
je 0x4abda4
xor ebx, ebx
lea rcx, [rbp + 0x10]
mov rdx, rbp
mov qword [rbp], rbx
lea r8d, [rbx + 1]
mov qword [rbp + 8], rbx
call qword [0x00510830]
nop
nop
nop
movzx eax, byte [rbp]
inc rdi
inc ebx
xor byte [rdi - 1], al
inc rbp
dec rsi
jne 0x4abd90
mov dword [r12], ebx
mov r12, qword [rsp + 0x20]
mov rdi, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x30]
add rsp, 0x28
ret
Function at 0x4ac4d0
Capabilities:
Encode data using xor

Disassembly:
mov rax, rsp
sub rsp, 0x108
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov rsi, rdx
lea rdx, [rsp + 0x60]
mov qword [rax + 0x20], rdi
call fcn.004c3f80
movabs r11, 0x3636363636363636
xor ebx, ebx
mov edi, 4
mov qword [rsp + 0x20], r11
mov qword [rsp + 0x28], r11
mov qword [rsp + 0x30], r11
mov qword [rsp + 0x38], r11
mov qword [rsp + 0x40], r11
mov qword [rsp + 0x48], r11
mov qword [rsp + 0x50], r11
mov qword [rsp + 0x58], r11
mov rcx, rbx
mov rdx, rdi
movzx eax, byte [rsp + rcx + 0x60]
add rcx, 5
xor byte [rsp + rcx + 0x1b], al
movzx eax, byte [rsp + rcx + 0x5c]
xor byte [rsp + rcx + 0x1c], al
movzx eax, byte [rsp + rcx + 0x5d]
xor byte [rsp + rcx + 0x1d], al
movzx eax, byte [rsp + rcx + 0x5e]
xor byte [rsp + rcx + 0x1e], al
movzx eax, byte [rsp + rcx + 0x5f]
xor byte [rsp + rcx + 0x1f], al
dec rdx
jne 0x4ac532
lea rcx, [rsp + 0xa0]
call fcn.004c3740
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0xa0]
mov r8d, 0x40
call fcn.004c3df0
lea rdx, [rsp + 0x78]
lea rcx, [rsp + 0xa0]
call fcn.004c3f80
movabs r11, 0x5c5c5c5c5c5c5c5c
mov qword [rsp + 0x20], r11
mov qword [rsp + 0x28], r11
mov qword [rsp + 0x30], r11
mov qword [rsp + 0x38], r11
mov qword [rsp + 0x40], r11
mov qword [rsp + 0x48], r11
mov qword [rsp + 0x50], r11
mov qword [rsp + 0x58], r11
movzx eax, byte [rsp + rbx + 0x60]
add rbx, 5
xor byte [rsp + rbx + 0x1b], al
movzx eax, byte [rsp + rbx + 0x5c]
xor byte [rsp + rbx + 0x1c], al
movzx eax, byte [rsp + rbx + 0x5d]
xor byte [rsp + rbx + 0x1d], al
movzx eax, byte [rsp + rbx + 0x5e]
xor byte [rsp + rbx + 0x1e], al
movzx eax, byte [rsp + rbx + 0x5f]
xor byte [rsp + rbx + 0x1f], al
dec rdi
jne 0x4ac5d1
lea rcx, [rsp + 0xa0]
call fcn.004c3740
lea r8d, [rdi + 0x40]
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0xa0]
call fcn.004c3df0
lea rdx, [rsp + 0x8c]
lea rcx, [rsp + 0xa0]
call fcn.004c3f80
mov rdi, qword [rsp + 0x128]
mov rbx, qword [rsp + 0x118]
lea rcx, [rsp + 0x78]
mov rax, qword [rcx]
mov qword [rsi], rax
mov rax, qword [rcx + 8]
mov qword [rsi + 8], rax
mov rax, qword [rcx + 0x10]
mov qword [rsi + 0x10], rax
mov rax, qword [rcx + 0x18]
mov qword [rsi + 0x18], rax
mov rsi, qword [rsp + 0x120]
add rsp, 0x108
ret
Function at 0x4aded0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
sub rsp, 0x38
mov r10d, dword [r9]
mov qword [rsp + 0x20], rsi
mov qword [rsp + 0x18], rdi
xor esi, esi
mov qword [rsp + 0x10], r12
and r10d, 7
cmp rdx, 5
mov qword [rsp + 8], r13
mov r13, r9
mov r12d, r8d
mov rdi, rcx
mov r11, rsi
jae 0x4adf0a
xor eax, eax
jmp 0x4ae06d
mov qword [rsp + 0x28], rbp
mov ebp, dword [rsp + 0x60]
lea r9, [rcx + rdx - 4]
mov qword [rsp + 0x30], rbx
nop
lea rdx, [r11 + rdi]
cmp rdx, r9
jae 0x4adf41
nop
nop
movzx eax, byte [rdx]
and al, 0xfe
cmp al, 0xe8
je 0x4adf41
inc rdx
cmp rdx, r9
jb 0x4adf30
mov rax, rdx
sub rax, r11
mov r11, rdx
sub r11, rdi
sub rax, rdi
cmp rdx, r9
jae 0x4ae04e
cmp rax, 2
jbe 0x4adfa6
mov r10d, esi
movzx r8d, byte [rdx + 4]
lea eax, [r8 + 1]
test al, 0xfe
jne 0x4ae03f
movzx eax, byte [rdx + 3]
shl r8d, 8
lea ebx, [r11 + r12 + 5]
or r8d, eax
movzx eax, byte [rdx + 2]
add r11, 5
shl r8d, 8
or r8d, eax
movzx eax, byte [rdx + 1]
shl r8d, 8
or r8d, eax
test ebp, ebp
je 0x4adfdc
add r8d, ebx
jmp 0x4adfdf
mov ecx, eax
shr r10d, cl
test r10d, r10d
je 0x4adf62
cmp r10d, 4
ja 0x4adfcd
cmp r10d, 3
je 0x4adfcd
mov eax, r10d
shr rax, 1
mov cl, byte [rax + rdx + 1]
inc ecx
test cl, 0xfe
jne 0x4adf62
or r10d, 8
shr r10d, 1
inc r11
jmp 0x4adf20
sub r8d, ebx
test r10d, r10d
je 0x4ae015
and r10d, 6
mov eax, r8d
shl r10d, 2
mov ecx, r10d
shr eax, cl
inc eax
test al, 0xfe
jne 0x4ae012
mov eax, 0x100
shl eax, cl
dec eax
xor r8d, eax
test ebp, ebp
je 0x4ae00f
add r8d, ebx
jmp 0x4ae012
sub r8d, ebx
mov r10d, esi
mov eax, r8d
mov byte [rdx + 1], r8b
shr eax, 8
mov byte [rdx + 2], al
mov eax, r8d
shr r8d, 0x18
shr eax, 0x10
and r8b, 1
neg r8b
mov byte [rdx + 3], al
mov byte [rdx + 4], r8b
jmp 0x4adf20
or r10d, 8
shr r10d, 1
inc r11
jmp 0x4adf20
cmp rax, 2
mov rbp, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x30]
ja 0x4ae066
mov ecx, eax
shr r10d, cl
mov esi, r10d
mov dword [r13], esi
mov rax, r11
mov r13, qword [rsp + 8]
mov r12, qword [rsp + 0x10]
mov rdi, qword [rsp + 0x18]
mov rsi, qword [rsp + 0x20]
add rsp, 0x38
ret

Function at 0x4af590
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
xor edx, edx
mov qword [rcx + 0x480], 0xffffffffffffffff
mov dword [rcx + 0x3c], 0x20
mov byte [rcx + 0x21], 1
mov dword [rcx + 0x5c], 4
lea r8, [rcx + 0x78]
mov qword [rcx + 0x40], rdx
mov byte [rcx + 0x23], dl
mov qword [rcx + 0x28], rdx
mov byte [rcx + 0x22], dl
mov ecx, edx
mov eax, edx
inc edx
shr eax, 1
and ecx, 1
add r8, 4
neg ecx
and ecx, 0xedb88320
xor ecx, eax
mov eax, ecx
shr ecx, 1
and eax, 1
neg eax
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
shr eax, 1
and ecx, 1
neg ecx
and ecx, 0xedb88320
xor ecx, eax
mov eax, ecx
shr ecx, 1
and eax, 1
neg eax
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
shr eax, 1
and ecx, 1
neg ecx
and ecx, 0xedb88320
xor ecx, eax
mov eax, ecx
shr ecx, 1
and eax, 1
neg eax
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
shr eax, 1
and ecx, 1
neg ecx
and ecx, 0xedb88320
xor ecx, eax
mov eax, ecx
shr ecx, 1
and eax, 1
neg eax
and eax, 0xedb88320
xor eax, ecx
cmp edx, 0x100
mov dword [r8 - 4], eax
jb 0x4af5c1
ret
Function at 0x4b0d00
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 0x10], rdx
sub rsp, 0x58
mov r9d, dword [rcx + 0x14]
mov r10, rdx
mov r8, rcx
cmp r9d, 3
jae 0x4b0d36
inc dword [rcx + 8]
mov eax, dword [rcx + 8]
inc dword [rcx + 0x18]
inc qword [rcx]
cmp eax, dword [rcx + 0xc]
jne 0x4b0d2f
call fcn.004afc10
xor eax, eax
add rsp, 0x58
ret
mov rcx, qword [rcx]
mov qword [rsp + 0x70], rbx
mov qword [rsp + 0x78], rbp
movzx edx, byte [rcx]
movzx eax, byte [rcx + 2]
mov qword [rsp + 0x50], rsi
mov qword [rsp + 0x48], rdi
mov qword [rsp + 0x40], r12
shl edx, 8
or edx, eax
movzx eax, byte [rcx + 1]
mov rcx, qword [r8 + 0x28]
xor edx, dword [r8 + rax*4 + 0x78]
mov qword [rsp + 0x38], r13
mov qword [rsp + 0x30], r14
movzx eax, dx
mov qword [rsp + 0x28], r15
mov rbx, r10
mov r12d, dword [rcx + rax*4]
mov rdx, rax
mov eax, dword [r8 + 8]
mov dword [rcx + rdx*4], eax
mov rdi, qword [r8]
mov rcx, qword [r8 + 0x30]
mov r15d, dword [r8 + 0x18]
mov r14d, dword [r8 + 8]
mov r13d, dword [r8 + 0x1c]
mov ebp, dword [r8 + 0x3c]
lea r11, [rdi + r9]
mov qword [rsp + 0x60], rcx
mov dword [rcx + r15*4], r12d
mov esi, 2
nop
nop
nop
mov r10d, r14d
sub r10d, r12d
cmp r10d, r13d
jae 0x4b0e44
xor eax, eax
cmp r10d, r15d
mov edx, esi
cmova eax, r13d
mov r9d, r10d
sub eax, r10d
neg r9
add eax, r15d
mov r12d, dword [rcx + rax*4]
lea rax, [rdx + r9]
movzx ecx, byte [rax + rdi]
cmp byte [rdx + rdi], cl
jne 0x4b0e26
movzx eax, byte [r9 + rdi]
mov rcx, rdi
cmp byte [rdi], al
jne 0x4b0e11
nop
inc rcx
cmp rcx, r11
je 0x4b0e32
movzx eax, byte [rcx + r9]
cmp byte [rcx], al
je 0x4b0e00
sub ecx, edi
cmp esi, ecx
jae 0x4b0e26
lea eax, [r10 - 1]
mov dword [rbx], ecx
add rbx, 8
mov dword [rbx - 4], eax
mov esi, ecx
add ebp, 0xffffffff
je 0x4b0e44
mov rcx, qword [rsp + 0x60]
jmp 0x4b0dc0
sub r11d, edi
lea eax, [r10 - 1]
add rbx, 8
mov dword [rbx - 4], eax
mov dword [rbx - 8], r11d
sub rbx, qword [rsp + 0x68]
inc dword [r8 + 8]
mov ecx, dword [r8 + 8]
inc dword [r8 + 0x18]
inc qword [r8]
mov r15, qword [rsp + 0x28]
mov r14, qword [rsp + 0x30]
mov r13, qword [rsp + 0x38]
mov r12, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x78]
sar rbx, 2
cmp ecx, dword [r8 + 0xc]
jne 0x4b0e8d
mov rcx, r8
call fcn.004afc10
mov eax, ebx
mov rbx, qword [rsp + 0x70]
add rsp, 0x58
ret
Function at 0x4b0f60
Capabilities:
Encrypt data using rc4 prga

Disassembly:
sub rsp, 0x48
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x68], rdi
mov edi, edx
mov rbx, rcx
mov r10d, dword [rbx + 0x14]
cmp r10d, 3
jae 0x4b0f98
inc dword [rbx + 8]
mov eax, dword [rbx + 8]
inc dword [rbx + 0x18]
inc qword [rbx]
cmp eax, dword [rbx + 0xc]
jne 0x4b100a
mov rcx, rbx
call fcn.004afc10
jmp 0x4b100a
mov rcx, qword [rbx]
mov r8, qword [rbx + 0x28]
movzx eax, byte [rcx + 2]
movzx edx, byte [rcx]
shl edx, 8
or edx, eax
movzx eax, byte [rcx + 1]
mov ecx, r10d
xor edx, dword [rbx + rax*4 + 0x78]
movzx eax, dx
mov r9, rax
mov edx, dword [r8 + rax*4]
mov eax, dword [rbx + 8]
mov dword [r8 + r9*4], eax
mov eax, dword [rbx + 0x3c]
mov r9, qword [rbx]
mov r8d, dword [rbx + 8]
mov dword [rsp + 0x38], eax
mov eax, dword [rbx + 0x1c]
mov dword [rsp + 0x30], eax
mov eax, dword [rbx + 0x18]
mov dword [rsp + 0x28], eax
mov rax, qword [rbx + 0x30]
mov qword [rsp + 0x20], rax
call fcn.004afcf0
inc dword [rbx + 8]
mov eax, dword [rbx + 8]
inc dword [rbx + 0x18]
inc qword [rbx]
cmp eax, dword [rbx + 0xc]
jne 0x4b100a
mov rcx, rbx
call fcn.004afc10
add edi, 0xffffffff
jne 0x4b0f73
mov rdi, qword [rsp + 0x68]
mov rbx, qword [rsp + 0x60]
add rsp, 0x48
ret

Function at 0x4b1300
Capabilities:
Encrypt data using rc4 prga

Disassembly:
sub rsp, 0x28
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x48], rdi
mov edi, edx
mov rbx, rcx
cmp dword [rbx + 0x14], 3
jae 0x4b1334
inc dword [rbx + 8]
mov eax, dword [rbx + 8]
inc dword [rbx + 0x18]
inc qword [rbx]
cmp eax, dword [rbx + 0xc]
jne 0x4b1383
mov rcx, rbx
call fcn.004afc10
jmp 0x4b1383
mov rcx, qword [rbx]
movzx edx, byte [rcx]
movzx eax, byte [rcx + 2]
shl edx, 8
or edx, eax
movzx eax, byte [rcx + 1]
mov rcx, qword [rbx + 0x28]
xor edx, dword [rbx + rax*4 + 0x78]
movzx eax, dx
mov rdx, rax
mov r8d, dword [rcx + rax*4]
mov eax, dword [rbx + 8]
mov dword [rcx + rdx*4], eax
mov ecx, dword [rbx + 0x18]
mov rax, qword [rbx + 0x30]
mov dword [rax + rcx*4], r8d
inc dword [rbx + 8]
mov eax, dword [rbx + 8]
inc dword [rbx + 0x18]
inc qword [rbx]
cmp eax, dword [rbx + 0xc]
jne 0x4b1383
mov rcx, rbx
call fcn.004afc10
add edi, 0xffffffff
jne 0x4b1313
mov rdi, qword [rsp + 0x48]
mov rbx, qword [rsp + 0x40]
add rsp, 0x28
ret