joyce8/EMBER2024-capa huggingface dataset:
Function at 0x427ee0
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x427fe6
push rbp
mov rbp, rsp
sub rsp, 0x48
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x68], rcx
mov byte [rsp + 0x70], dil
mov qword [rsp + 0x10], 0
jmp 0x427f23
mov rax, qword [rsp + 0x58]
mov rcx, rdx
mov rbx, qword [rsp + 0x60]
movzx edi, byte [rsp + 0x70]
cmp qword [rsp + 0x10], rbx
jae 0x427fdb
test byte [rax], al
lea rcx, [rax + 0x100b8]
mov ebx, edi
mov rax, rcx
nop dword [rax]
call fcn.00428c00
test rax, rax
je 0x427fdb
movups xmmword [rsp + 0x18], xmm15
movups xmmword [rsp + 0x28], xmm15
movups xmmword [rsp + 0x38], xmm15
lea rcx, [0x00428020]
mov qword [rsp + 0x18], rcx
lea rdx, [rsp + 0x10]
mov qword [rsp + 0x20], rdx
mov rdx, qword [rsp + 0x58]
mov qword [rsp + 0x28], rdx
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x38], rbx
mov rax, qword [rsp + 0x60]
mov qword [rsp + 0x40], rax
lea rbx, [rsp + 0x18]
mov qword [rsp], rbx
nop dword [rax]
call fcn.0046d1a0
xorps xmm15, xmm15
mov r14, qword [0x007c9d40]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rdx, qword [rsp + 0x68]
nop dword [rax]
test rdx, rdx
jne 0x427fc9
xor eax, eax
jmp 0x427fd3
mov rax, qword [rdx]
call rax
mov rdx, qword [rsp + 0x68]
test al, al
je 0x427f11
mov rax, qword [rsp + 0x10]
add rsp, 0x48
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov byte [rsp + 0x20], dil
call fcn.0046d2c0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
movzx edi, byte [rsp + 0x20]
jmp fcn.00427ee0
Function at 0x435d20
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x435e68
push rbp
mov rbp, rsp
sub rsp, 0x70
mov qword [rsp + 0x80], rax
mov byte [rsp + 0x98], dil
test dil, dil
jne 0x435d4d
xor edx, edx
xor esi, esi
jmp 0x435d94
mov qword [rsp + 0x88], rbx
mov qword [rsp + 0x90], rcx
mov qword [rsp + 0x80], rax
mov eax, 6
call fcn.00442a40
mov rcx, qword [rsp + 0x90]
movzx edi, byte [rsp + 0x98]
mov edx, eax
mov rsi, rbx
mov rax, qword [rsp + 0x80]
mov rbx, qword [rsp + 0x88]
mov qword [rsp + 0x20], 0
nop dword [rax]
test rbx, rbx
jne 0x435dad
test dil, dil
jmp 0x435e51
mov qword [rsp + 0x18], rsi
mov byte [rsp + 0x17], dl
lea rdx, [rsp + 0x80]
movups xmmword [rsp + 0x28], xmm15
movups xmmword [rsp + 0x30], xmm15
movups xmmword [rsp + 0x40], xmm15
movups xmmword [rsp + 0x50], xmm15
movups xmmword [rsp + 0x60], xmm15
lea rsi, [0x00435ea0]
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x40], rcx
mov qword [rsp + 0x30], rax
mov rax, r14
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x78]
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], rdx
mov byte [rsp + 0x60], dil
lea rax, [rsp + 0x20]
mov qword [rsp + 0x68], rax
lea rax, [rsp + 0x28]
mov qword [rsp], rax
call fcn.0046d1a0
xorps xmm15, xmm15
mov r14, qword [0x007c9d40]
mov r14, qword gs:[r14]
mov r14, qword [r14]
movzx eax, byte [rsp + 0x98]
test al, al
movzx edx, byte [rsp + 0x17]
mov rsi, qword [rsp + 0x18]
je 0x435e5d
mov eax, edx
mov rbx, rsi
call fcn.00442ba0
mov rax, qword [rsp + 0x20]
add rsp, 0x70
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov byte [rsp + 0x20], dil
nop dword [rax]
call fcn.0046d2c0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
movzx edi, byte [rsp + 0x20]
jmp fcn.00435d20
Function at 0x4528c0
Capabilities:
Access peb ldr_data

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x78
mov rcx, r14
test rcx, rcx
je 0x45290b
mov rcx, qword [rcx + 0x30]
mov rcx, qword [rcx + 0x90]
nop dword [rax + rax]
test rcx, rcx
je 0x45290b
mov qword [rsp + 0x70], rcx
mov rax, rdi
call fcn.00409ac0
mov qword [rsp + 0x68], rax
mov qword [rsp + 0x60], 0
mov qword [rsp + 0x50], 0
jmp 0x45291b
mov eax, 1
add rsp, 0x78
pop rbp
ret
mov rax, qword [rsp + 0x68]
nop dword [rax + rax]
call fcn.00409480
mov rcx, qword [sym.imp.kernel32.dll_RtlLookupFunctionEntry]
lea rdx, [rsp + 0x60]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], 0
call fcn.0043b9c0
xorps xmm15, xmm15
mov r14, qword [0x007c9d40]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rcx, qword [rsp + 0x20]
test rcx, rcx
je 0x4529ff
mov qword [rsp + 0x58], rcx
mov rax, qword [rsp + 0x68]
call fcn.00409480
mov rcx, qword [rsp + 0x60]
mov rdx, qword [sym.imp.kernel32.dll_RtlVirtualUnwind]
mov rbx, qword [rsp + 0x68]
lea rdi, [rsp + 0x50]
mov qword [rsp], rdx
mov qword [rsp + 8], 0
mov qword [rsp + 0x10], rcx
mov qword [rsp + 0x18], rax
mov rcx, qword [rsp + 0x58]
mov qword [rsp + 0x20], rcx
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x40], 0
call fcn.0043bce0
xorps xmm15, xmm15
mov r14, qword [0x007c9d40]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rcx, qword [rsp + 0x50]
mov rdx, qword [rsp + 0x70]
cmp qword [rdx], rcx
ja 0x4529ff
cmp qword [rdx + 8], rcx
ja 0x452916
mov eax, 1
add rsp, 0x78
pop rbp
ret

Function at 0x4610a0
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x461162
push rbp
mov rbp, rsp
sub rsp, 0x48
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x68], rcx
mov qword [rsp + 0x70], rdi
lea rax, [rsp + 0x68]
call fcn.004578a0
mov rcx, qword [rsp + 0x58]
test byte [rcx], al
lea rdx, [rcx + 0x10]
mov rbx, qword [rax]
mov rsi, qword [rax + 8]
mov rax, rdx
mov rcx, rsi
call fcn.0045e700
test bl, bl
je 0x46115c
mov qword [rsp + 0x18], rax
movups xmmword [rsp + 0x20], xmm15
movups xmmword [rsp + 0x28], xmm15
movups xmmword [rsp + 0x38], xmm15
lea rcx, [0x004611a0]
mov qword [rsp + 0x20], rcx
mov rcx, qword [rsp + 0x58]
mov qword [rsp + 0x28], rcx
mov rcx, qword [rsp + 0x60]
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x38], rax
lea rcx, [rsp + 0x68]
mov qword [rsp + 0x40], rcx
lea rcx, [rsp + 0x20]
mov qword [rsp], rcx
call fcn.0046d1a0
xorps xmm15, xmm15
mov r14, qword [0x007c9d40]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x18]
add rsp, 0x48
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
call fcn.0046d2c0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
jmp fcn.004610a0
Function at 0x464060
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x46410f
push rbp
mov rbp, rsp
sub rsp, 0x58
mov qword [rsp + 0x70], rbx
lea rdx, [rsp + 0x68]
mov qword [rsp + 8], 0
movups xmmword [rsp + 0x10], xmm15
movups xmmword [rsp + 0x18], xmm15
movups xmmword [rsp + 0x28], xmm15
movups xmmword [rsp + 0x38], xmm15
movups xmmword [rsp + 0x48], xmm15
lea rsi, [0x00464160]
mov qword [rsp + 0x10], rsi
mov rsi, qword [rsp + 0x60]
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdx
mov rdx, r14
mov qword [rsp + 0x28], rdx
lea rdx, [rsp + 8]
mov qword [rsp + 0x30], rdx
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x48], rcx
mov qword [rsp + 0x50], rdi
mov qword [rsp + 0x40], rbx
lea rax, [rsp + 0x10]
mov qword [rsp], rax
call fcn.0046d1a0
xorps xmm15, xmm15
mov r14, qword [0x007c9d40]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 8]
add rsp, 0x58
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
call fcn.0046d2c0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
nop dword [rax]
jmp fcn.00464060
Function at 0x46f0c0
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x405863
push rbp
mov rbp, rsp
sub rsp, 0x18
mov rdx, qword [rax]
mov rcx, qword [rax + 8]
mov rax, rdx
call fcn.0040b560
add rsp, 0x18
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.0046d2c0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp 0x405840
cmp byte [0x007c9af1], 0
je 0x46f0d5
mov rcx, qword [rax + 8]
mov rax, qword [rax]
jmp 0x46c300
jmp 0x405840

Function at 0x46f0e0
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x40b9c1
push rbp
mov rbp, rsp
sub rsp, 0x10
mov qword [rsp + 0x28], rbx
call fcn.0040ba80
movabs rcx, 0xe7037ed1a0b428db
xor rcx, rax
mov rbx, qword [rsp + 0x28]
xor rbx, rax
xor rbx, qword [0x007c9ec0]
movabs rdx, 0xa0761d6478bd642f
xor rbx, rdx
mov rax, rcx
call fcn.0040ba60
mov rbx, rax
movabs rax, 0x1d8e4e27c47d124b
call fcn.0040ba60
add rsp, 0x10
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.0046d2c0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp 0x40b960
cmp byte [0x007c9af1], 0
je 0x46f115
movq xmm0, rbx
pinsrd xmm0, dword [rax], 2
aesenc xmm0, xmmword [0x007ca240]
aesenc xmm0, xmmword [0x007ca250]
aesenc xmm0, xmmword [0x007ca260]
movq rax, xmm0
ret
jmp 0x40b960

Function at 0x46f120
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x40ba41
push rbp
mov rbp, rsp
sub rsp, 0x10
mov qword [rsp + 0x28], rbx
call fcn.0040bac0
movabs rcx, 0xe7037ed1a0b428db
xor rcx, rax
mov rbx, qword [rsp + 0x28]
xor rbx, rax
xor rbx, qword [0x007c9ec0]
movabs rdx, 0xa0761d6478bd642f
xor rbx, rdx
mov rax, rcx
call fcn.0040ba60
mov rbx, rax
movabs rax, 0x1d8e4e27c47d1247
call fcn.0040ba60
add rsp, 0x10
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.0046d2c0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp 0x40b9e0
cmp byte [0x007c9af1], 0
je 0x46f156
movq xmm0, rbx
pinsrq xmm0, qword [rax], 1
aesenc xmm0, xmmword [0x007ca240]
aesenc xmm0, xmmword [0x007ca250]
aesenc xmm0, xmmword [0x007ca260]
movq rax, xmm0
ret
jmp 0x40b9e0

Function at 0x470da0
Capabilities:
Allocate thread local storage

Disassembly:
push rbp
mov rbp, rsp
mov rax, rsp
and rsp, 0xfffffffffffffff0
sub rsp, 0x30
mov qword [rsp + 0x20], rax
mov rax, qword [sym.imp.kernel32.dll_TlsAlloc]
call rax
mov rsp, qword [rsp + 0x20]
mov rcx, rax
cmp rcx, 0x40
jb 0x470dd4
mov rcx, 0x28
jmp 0x470ddf
shl rcx, 3
add rcx, 0x1480
mov qword [0x007c9d40], rcx
pop rbp
ret
Function at 0x491c20
Capabilities:
Hash data using fnv

Disassembly:
mov qword [rsp + 0x10], rbx
xor edx, edx
jmp 0x491c38
movzx esi, byte [rbx + rdx]
imul eax, eax, 0x1000193
inc rdx
xor eax, esi
cmp rcx, rdx
jg 0x491c29
ret

Function at 0x49e340
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x49e40a
push rbp
mov rbp, rsp
sub rsp, 0x48
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rbx
mov qword [rsp], rax
mov qword [rsp + 8], rbx
mov byte [rsp + 0x10], 0
call fcn.00404c60
xorps xmm15, xmm15
mov r14, qword [0x007c9d40]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x18], 0xffffffffffffffff
jne 0x49e3ef
mov rcx, qword [rsp + 0x60]
lea rdx, [rcx + 1]
mov qword [rsp + 0x40], rdx
lea rax, [0x00563d20]
xor ebx, ebx
mov rcx, rdx
call fcn.004533c0
mov rbx, qword [rsp + 0x60]
mov rcx, rax
xor edi, edi
mov rsi, qword [rsp + 0x40]
mov rax, qword [rsp + 0x58]
nop dword [rax]
call fcn.0049ffa0
inc rbx
cmp rcx, rbx
jae 0x49e3de
mov edi, 1
lea rsi, [0x00563d20]
call fcn.00453480
mov word [rax + rbx*2 - 2], 0
xor edi, edi
xor esi, esi
add rsp, 0x48
pop rbp
ret
xor eax, eax
xor ebx, ebx
mov rcx, rbx
lea rdi, [0x005d3a40]
lea rsi, [0x005d2920]
add rsp, 0x48
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.0046d2c0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.0049e340
Function at 0x4b3f60
Capabilities:
Encode data using base64

Disassembly:
lea r12, [rsp - 0x18]
cmp r12, qword [r14 + 0x10]
jbe 0x4b40cb
push rbp
mov rbp, rsp
sub rsp, 0x90
mov qword [rsp + 0xa8], rbx
mov rcx, qword [rax]
mov qword [rsp + 0x30], rcx
movups xmm0, xmmword [rax + 8]
movups xmmword [rsp + 0x38], xmm0
movups xmm0, xmmword [rax + 0x18]
movups xmmword [rsp + 0x48], xmm0
lea rax, [rsp + 0x30]
call fcn.004b3ac0
mov qword [rsp + 0x20], 0
movups xmmword [rsp + 0x68], xmm15
movups xmmword [rsp + 0x70], xmm15
movups xmmword [rsp + 0x80], xmm15
mov rcx, qword [rsp + 0x30]
mov qword [rsp + 0x68], rcx
mov rcx, qword [rsp + 0x38]
mov qword [rsp + 0x70], rcx
mov rcx, qword [rsp + 0x40]
mov qword [rsp + 0x78], rcx
mov rcx, qword [rsp + 0x48]
mov qword [rsp + 0x80], rcx
mov rcx, qword [rsp + 0x50]
mov qword [rsp + 0x88], rcx
xor eax, eax
nop
jmp 0x4b400a
mov rax, qword [rsp + 0x58]
inc rax
cmp rax, 5
jge 0x4b4072
mov qword [rsp + 0x58], rax
mov rdi, qword [rsp + rax*8 + 0x68]
imul rcx, rax, 0x33
mov rdx, rcx
sar rdx, 0x3f
shr rdx, 0x3d
add rdx, rcx
mov qword [rsp + 0x60], rdx
and rdx, 0xfffffffffffffff8
sub rcx, rdx
shl rdi, cl
cmp rcx, 0x40
sbb rdx, rdx
and rdi, rdx
mov ebx, 8
mov rcx, rbx
lea rax, [rsp + 0x20]
call fcn.004989c0
mov rdx, qword [rsp + 0x20]
mov qword [rsp + 0x28], rdx
mov rdx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0xa8]
xor eax, eax
jmp 0x4b40a7
mov rax, qword [rsp + 0xa8]
test byte [rax], al
mov ebx, 0x20
mov rcx, rbx
add rsp, 0x90
pop rbp
ret
test byte [rsi], al
movzx r9d, byte [rsi + rdx]
movzx r10d, byte [rsp + rax + 0x28]
or r9d, r10d
mov byte [rsi + rdx], r9b
inc rax
mov rdx, r8
cmp rax, 8
jge 0x4b4002
mov r8, rdx
sar rdx, 3
add rdx, rax
nop dword [rax + rax]
cmp rdx, 0x20
jl 0x4b408d
jmp 0x4b4002
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.0046d2c0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.004b3f60
Function at 0x4bd140
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4bd375
push rbp
mov rbp, rsp
sub rsp, 0x60
mov qword [rsp + 0x70], rax
xor ecx, ecx
xor edx, edx
xor esi, esi
xor edi, edi
xor r8d, r8d
jmp 0x4bd180
dec rbx
mov r10, rbx
neg r10
sar r10, 0x3f
and r10d, 1
add rax, r10
mov rcx, r9
nop dword [rax + rax]
test rbx, rbx
je 0x4bd35a
mov qword [rsp + 0x58], rax
mov byte [rsp + 0x46], r8b
mov qword [rsp + 0x50], rbx
movzx r9d, byte [rax]
mov byte [rsp + 0x47], r9b
cmp r9b, 0x20
jbe 0x4bd2b6
cmp r9b, 0x22
je 0x4bd1c2
cmp r9b, 0x5c
jne 0x4bd2cb
lea r9, [rcx + 1]
nop
jmp 0x4bd164
mov qword [rsp + 0x48], rcx
mov r8, rcx
shr rcx, 0x3f
lea r9, [rcx + r8]
sar r9, 1
mov rax, rdi
mov rbx, rsi
mov rcx, rdx
mov rdi, r9
call fcn.004bd0a0
mov rdx, qword [rsp + 0x48]
bt edx, 0
jb 0x4bd26a
movzx edx, byte [rsp + 0x46]
test dl, dl
je 0x4bd25b
mov r8, qword [rsp + 0x50]
nop
cmp r8, 1
jle 0x4bd251
mov r9, qword [rsp + 0x58]
cmp byte [r9 + 1], 0x22
jne 0x4bd249
inc rbx
cmp rcx, rbx
jae 0x4bd23a
mov edi, 1
lea rsi, [0x00563ca0]
call fcn.00453480
movzx edx, byte [rsp + 0x46]
mov r8, qword [rsp + 0x50]
mov r9, qword [rsp + 0x58]
mov byte [rbx + rax - 1], 0x22
lea rsi, [r8 - 1]
lea r8, [r9 + 1]
jmp 0x4bd265
mov rsi, r8
mov r8, r9
jmp 0x4bd265
mov rsi, r8
mov r8, qword [rsp + 0x58]
jmp 0x4bd265
mov rsi, qword [rsp + 0x50]
mov r8, qword [rsp + 0x58]
xor edx, 1
jmp 0x4bd299
inc rbx
cmp rcx, rbx
jae 0x4bd285
mov edi, 1
lea rsi, [0x00563ca0]
nop
call fcn.00453480
mov byte [rbx + rax - 1], 0x22
mov rsi, qword [rsp + 0x50]
mov r8, qword [rsp + 0x58]
movzx edx, byte [rsp + 0x46]
xor r9d, r9d
mov rdi, rax
mov rax, r8
mov r8d, edx
mov rdx, rcx
mov r10, rbx
mov rbx, rsi
mov rsi, r10
jmp 0x4bd164
cmp r9b, 9
je 0x4bd2c6
nop dword [rax]
cmp r9b, 0x20
jne 0x4bd2cb
test r8b, r8b
je 0x4bd325
mov rax, rdi
mov rbx, rsi
mov rdi, rcx
mov rcx, rdx
call fcn.004bd0a0
inc rbx
nop
cmp rcx, rbx
jae 0x4bd2f6
mov edi, 1
lea rsi, [0x00563ca0]
call fcn.00453480
movzx r10d, byte [rsp + 0x47]
mov byte [rbx + rax - 1], r10b
mov rdx, rcx
mov rsi, rbx
xor r9d, r9d
mov rdi, rax
movzx r8d, byte [rsp + 0x46]
mov rbx, qword [rsp + 0x50]
mov rax, qword [rsp + 0x58]
nop dword [rax]
jmp 0x4bd164
mov rax, rdi
mov rbx, rsi
mov rdi, rcx
mov rcx, rdx
call fcn.004bd0a0
mov rsi, qword [rsp + 0x50]
dec rsi
mov rdx, rsi
neg rdx
sar rdx, 0x3f
and edx, 1
mov r8, qword [rsp + 0x58]
lea rdi, [rdx + r8]
add rsp, 0x60
pop rbp
ret
mov rax, rdi
mov rbx, rsi
mov rdi, rcx
mov rcx, rdx
call fcn.004bd0a0
xor edi, edi
xor esi, esi
add rsp, 0x60
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
nop
call fcn.0046d2c0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.004bd140
Function at 0x4beac0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4bec4c
push rbp
mov rbp, rsp
sub rsp, 0x10
mov qword [rsp + 0x20], rax
nop word [rax + rax]
cmp rbx, 2
jl 0x4beb93
movzx ecx, byte [rax]
cmp byte [rax + 1], 0x3a
jne 0x4beb18
lea edx, [rcx - 0x30]
cmp dl, 9
jbe 0x4beb0d
lea edx, [rcx - 0x61]
nop
cmp dl, 0x19
jbe 0x4beb0d
lea edx, [rcx - 0x41]
cmp dl, 0x19
ja 0x4beb18
mov ebx, 2
add rsp, 0x10
pop rbp
ret
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], rax
cmp rbx, 5
jge 0x4beb2c
xor ecx, ecx
jmp 0x4beb40
mov eax, ecx
call fcn.004be980
mov rbx, qword [rsp + 0x28]
mov ecx, eax
mov rax, qword [rsp + 0x20]
nop
test cl, cl
jne 0x4beb48
xor ecx, ecx
jmp 0x4beb82
movzx ecx, byte [rax + 1]
mov eax, ecx
call fcn.004be980
test al, al
jne 0x4beb65
mov rax, qword [rsp + 0x20]
mov rbx, qword [rsp + 0x28]
xor ecx, ecx
jmp 0x4beb82
mov rcx, qword [rsp + 0x20]
movzx eax, byte [rcx + 2]
call fcn.004be980
xor eax, 1
mov rbx, qword [rsp + 0x28]
mov ecx, eax
mov rax, qword [rsp + 0x20]
test cl, cl
je 0x4beb9d
cmp byte [rax + 2], 0x2e
je 0x4beb9d
mov ecx, 3
jmp 0x4bebb9
xor eax, eax
xor ebx, ebx
add rsp, 0x10
pop rbp
ret
xor eax, eax
xor ebx, ebx
add rsp, 0x10
pop rbp
ret
mov rcx, qword [rsp + 8]
inc rcx
mov rax, qword [rsp + 0x20]
mov rbx, qword [rsp + 0x28]
lea rdx, [rbx - 1]
nop dword [rax]
cmp rcx, rdx
jge 0x4beb9d
mov qword [rsp + 8], rcx
movzx edx, byte [rcx + rax]
mov eax, edx
call fcn.004be980
test al, al
je 0x4beba7
mov rcx, qword [rsp + 0x20]
mov rdx, qword [rsp + 8]
movzx eax, byte [rdx + rcx + 1]
call fcn.004be980
test al, al
jne 0x4beb9d
mov rax, qword [rsp + 0x20]
mov rcx, qword [rsp + 8]
movzx edx, byte [rcx + rax + 1]
cmp dl, 0x2e
je 0x4beb9d
inc rcx
jmp 0x4bec17
mov rcx, qword [rsp + 8]
inc rcx
mov rax, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x28]
nop dword [rax]
cmp rdx, rcx
jle 0x4bec43
mov qword [rsp + 8], rcx
movzx edx, byte [rcx + rax]
mov eax, edx
call fcn.004be980
test al, al
je 0x4bec0a
mov rax, qword [rsp + 0x20]
mov rcx, qword [rsp + 8]
mov rbx, rcx
add rsp, 0x10
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.0046d2c0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.004beac0

Function at 0x4ca4c0
Capabilities:
Hash data using fnv

Disassembly:
movzx ecx, bl
xor rax, rcx
movabs rcx, 0x100000001b3
imul rax, rcx
ret

Function at 0x4ca4e0
Capabilities:
Hash data using fnv

Disassembly:
mov qword [rsp + 0x10], rbx
xor edx, edx
jmp 0x4ca501
movzx esi, byte [rbx + rdx]
xor rax, rsi
movabs rsi, 0x100000001b3
imul rax, rsi
inc rdx
cmp rcx, rdx
jg 0x4ca4e9
ret

Function at 0x4ca520
Capabilities:
Hash data using fnv

Disassembly:
xor ecx, ecx
jmp 0x4ca540
movzx edx, bl
xor rax, rdx
inc rcx
shr rbx, 8
movabs rdx, 0x100000001b3
imul rax, rdx
nop
cmp rcx, 8
jl 0x4ca524
ret

Function at 0x4ca560
Capabilities:
Hash data using fnv

Disassembly:
xor ecx, ecx
jmp 0x4ca580
movzx edx, bl
xor rax, rdx
shr ebx, 8
movabs rdx, 0x100000001b3
imul rax, rdx
inc rcx
nop
cmp rcx, 4
jl 0x4ca564
ret
Function at 0x4cfde0
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4cfff0
push rbp
mov rbp, rsp
sub rsp, 0x68
mov qword [rsp + 0x78], rax
mov qword [rsp + 0x90], rdi
mov qword [rsp + 0xa8], r9
cmp r10, rsi
jg 0x4cffca
test rsi, rsi
je 0x4cffc2
nop dword [rax]
test r10, r10
je 0x4cffb7
mov qword [rsp + 0x98], rsi
mov qword [rsp + 0xb0], r10
mov qword [rsp + 0x90], rdi
mov qword [rsp + 0xa0], r8
mov qword [rsp + 0xa8], r9
mov qword [rsp + 0xb8], r11
lea rdi, [rsi + 1]
nop dword [rax]
call fcn.004cfb80
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x58], rcx
mov qword [rsp + 0x50], rbx
mov qword [rsp], rax
mov rdx, qword [rsp + 0xb0]
mov qword [rsp + 8], rdx
mov qword [rsp + 0x10], rcx
mov rsi, qword [rsp + 0x90]
mov qword [rsp + 0x18], rsi
mov r8, qword [rsp + 0x98]
mov qword [rsp + 0x20], r8
mov r9, qword [rsp + 0xa0]
mov qword [rsp + 0x28], r9
mov r10, qword [rsp + 0xa8]
mov qword [rsp + 0x30], r10
mov qword [rsp + 0x38], rdx
mov r10, qword [rsp + 0xb8]
mov qword [rsp + 0x40], r10
call fcn.004d8de0
xorps xmm15, xmm15
mov r14, qword [0x007c9d40]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rdx, qword [rsp + 0x48]
mov rsi, qword [rsp + 0xb0]
mov r8, qword [rsp + 0x98]
nop dword [rax]
cmp rsi, r8
jge 0x4cff99
sub r8, rsi
mov rcx, qword [rsp + 0x58]
sub rcx, rsi
mov rdi, rsi
shl rsi, 3
mov r9, rcx
neg rcx
sar rcx, 0x3f
and rcx, rsi
mov r10, qword [rsp + 0x60]
add rcx, r10
mov qword [rsp], rcx
mov qword [rsp + 8], r8
mov qword [rsp + 0x10], r9
mov rcx, qword [rsp + 0xa0]
sub rcx, rdi
mov rdi, rcx
neg rcx
sar rcx, 0x3f
and rcx, rsi
mov rsi, qword [rsp + 0x90]
add rcx, rsi
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], r8
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x30], rdx
call fcn.004d8f20
xorps xmm15, xmm15
mov r14, qword [0x007c9d40]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rdx, qword [rsp + 0x38]
mov r8, qword [rsp + 0x98]
mov rax, qword [rsp + 0x60]
mov qword [rax + r8*8], rdx
mov rbx, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x58]
call fcn.004cfb60
add rsp, 0x68
pop rbp
ret
call fcn.004cfd20
add rsp, 0x68
pop rbp
ret
xor ebx, ebx
add rsp, 0x68
pop rbp
ret
mov rdx, rdi
mov rdi, r9
mov r12, rsi
mov rsi, r10
mov r13, r8
mov r8, r11
mov r9, rdx
mov r10, r12
mov r11, r13
call fcn.004cfde0
add rsp, 0x68
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x30], r8
mov qword [rsp + 0x38], r9
mov qword [rsp + 0x40], r10
mov qword [rsp + 0x48], r11
nop dword [rax]
call fcn.0046d2c0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x28]
mov r8, qword [rsp + 0x30]
mov r9, qword [rsp + 0x38]
mov r10, qword [rsp + 0x40]
mov r11, qword [rsp + 0x48]
jmp fcn.004cfde0