joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4896a0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
lea r12, [rsp - 8]
cmp r12, qword [r14 + 0x10]
jbe 0x489807
push rbp
mov rbp, rsp
add rsp, 0xffffffffffffff80
movabs rdx, 0x75c444ae20b96fbf
mov qword [rsp + 0x4f], rdx
movabs rdx, 0xb575c444ae20b96f
mov qword [rsp + 0x50], rdx
movabs rdx, 0x91fbcb0bb8a42097
mov qword [rsp + 0x58], rdx
movabs rdx, 0xaa622074f76156d8
mov qword [rsp + 0x60], rdx
movabs rdx, 0x7eea746661209948
mov qword [rsp + 0x68], rdx
movabs rdx, 0x38e200f980756de5
mov qword [rsp + 0x70], rdx
movabs rdx, 0xd6b77789cc150cf9
mov qword [rsp + 0x78], rdx
movabs rdx, 0x906122f12240f26
mov qword [rsp + 0x19], rdx
movabs rdx, 0x14102a2f0c250906
mov qword [rsp + 0x1f], rdx
movabs rdx, 0x90e102b2d29240d
mov qword [rsp + 0x27], rdx
movabs rdx, 0x2400112d1f0b1804
mov qword [rsp + 0x2f], rdx
movabs rdx, 0x1927271e30052a0d
mov qword [rsp + 0x37], rdx
movabs rdx, 0x1a3027090c0b2119
mov qword [rsp + 0x3f], rdx
movabs rdx, 0x26202f10020f082c
mov qword [rsp + 0x47], rdx
xor eax, eax
jmp 0x4897aa
movzx r9d, byte [rsp + rsi + 0x4f]
sub r9d, edx
lea edx, [r9 - 0x13]
mov byte [rsp + rdi + 0x4f], dl
lea edx, [r8 - 0x13]
mov byte [rsp + rsi + 0x4f], dl
add rax, 2
cmp rax, 0x36
jge 0x4897d7
movzx edx, byte [rsp + rax + 0x19]
movzx esi, byte [rsp + rax + 0x1a]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x31
jae 0x4897fa
movzx r8d, byte [rsp + rdi + 0x4f]
sub r8d, edx
cmp rsi, 0x31
jb 0x48978d
jmp 0x4897ee
xor eax, eax
lea rbx, [rsp + 0x4f]
mov ecx, 0x31
call fcn.00444780
sub rsp, 0xffffffffffffff80
pop rbp
ret
mov eax, esi
mov ecx, 0x31
call fcn.004564a0
mov eax, edi
mov ecx, 0x31
call fcn.004564a0
nop
call fcn.004541c0
jmp fcn.004896a0
Function at 0x489820
Capabilities:
Encrypt data using rc4 prga

Disassembly:
lea r12, [rsp - 0x20]
cmp r12, qword [r14 + 0x10]
jbe 0x4899b5
push rbp
mov rbp, rsp
sub rsp, 0x98
movabs rdx, 0x4413b852c44a276e
mov qword [rsp + 0x67], rdx
movabs rdx, 0x194413b852c44a27
mov qword [rsp + 0x68], rdx
movabs rdx, 0x6639276713c10f33
mov qword [rsp + 0x70], rdx
movabs rdx, 0x2c6047412616969
mov qword [rsp + 0x78], rdx
movabs rdx, 0xdd130c128163139
mov qword [rsp + 0x80], rdx
movabs rdx, 0x38bb0ba06c1340dd
mov qword [rsp + 0x88], rdx
movabs rdx, 0xeb04733b32f3974
mov qword [rsp + 0x90], rdx
movabs rdx, 0x305302c30291922
mov qword [rsp + 0x1f], rdx
movabs rdx, 0x17171418212f271d
mov qword [rsp + 0x27], rdx
movabs rdx, 0x2e022b0816260b26
mov qword [rsp + 0x2f], rdx
movabs rdx, 0x30031f1b0f2a2725
mov qword [rsp + 0x37], rdx
movabs rdx, 0x2d0e2b062f200a1d
mov qword [rsp + 0x3f], rdx
movabs rdx, 0xc2f2504171c1e1a
mov qword [rsp + 0x47], rdx
movabs rdx, 0x2c2c072b2312050b
mov qword [rsp + 0x4f], rdx
movabs rdx, 0x2721301207012b09
mov qword [rsp + 0x57], rdx
movabs rdx, 0xb071d122b2d140e
mov qword [rsp + 0x5f], rdx
xor eax, eax
jmp 0x489954
movzx r9d, byte [rsp + rsi + 0x67]
sub r9d, edx
lea edx, [r9 + 0x6f]
mov byte [rsp + rdi + 0x67], dl
lea edx, [r8 + 0x6f]
mov byte [rsp + rsi + 0x67], dl
add rax, 2
cmp rax, 0x48
jge 0x489982
movzx edx, byte [rsp + rax + 0x1f]
movzx esi, byte [rsp + rax + 0x20]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x31
jae 0x4899a8
movzx r8d, byte [rsp + rdi + 0x67]
sub r8d, edx
cmp rsi, 0x31
jb 0x489937
nop
jmp 0x48999c
xor eax, eax
lea rbx, [rsp + 0x67]
mov ecx, 0x31
call fcn.00444780
add rsp, 0x98
pop rbp
ret
mov eax, esi
mov ecx, 0x31
call fcn.004564a0
mov eax, edi
mov ecx, 0x31
call fcn.004564a0
nop
call fcn.004541c0
jmp fcn.00489820
Function at 0x4899c0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x489af8
push rbp
mov rbp, rsp
sub rsp, 0x70
movabs rdx, 0xea612975b5b314bf
mov qword [rsp + 0x48], rdx
movabs rdx, 0xb72032108a657825
mov qword [rsp + 0x50], rdx
movabs rdx, 0xe89220b5f6cdb27b
mov qword [rsp + 0x58], rdx
movabs rdx, 0x744967e7abc2aea6
mov qword [rsp + 0x60], rdx
movabs rdx, 0xed652e7033c6d169
mov qword [rsp + 0x68], rdx
movabs rdx, 0x131c121601170710
mov qword [rsp + 0x1c], rdx
movabs rdx, 0x180f220105272508
mov qword [rsp + 0x24], rdx
movabs rdx, 0x21c0500180f2201
mov qword [rsp + 0x28], rdx
movabs rdx, 0x141b001a11162117
mov qword [rsp + 0x30], rdx
movabs rdx, 0x305231e08250c04
mov qword [rsp + 0x38], rdx
movabs rdx, 0x27041e1319100b23
mov qword [rsp + 0x40], rdx
xor eax, eax
jmp 0x489a98
movzx r9d, byte [rsp + rsi + 0x48]
sub r9d, edx
lea edx, [r9 - 0x1e]
mov byte [rsp + rdi + 0x48], dl
lea edx, [r8 - 0x1e]
mov byte [rsp + rsi + 0x48], dl
add rax, 2
cmp rax, 0x2c
jge 0x489ac8
movzx edx, byte [rsp + rax + 0x1c]
movzx esi, byte [rsp + rax + 0x1d]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x28
jae 0x489aeb
movzx r8d, byte [rsp + rdi + 0x48]
sub r8d, edx
nop dword [rax]
cmp rsi, 0x28
jb 0x489a7b
jmp 0x489adf
xor eax, eax
lea rbx, [rsp + 0x48]
mov ecx, 0x28
call fcn.00444780
add rsp, 0x70
pop rbp
ret
mov eax, esi
mov ecx, 0x28
call fcn.004564a0
mov eax, edi
mov ecx, 0x28
call fcn.004564a0
nop
call fcn.004541c0
nop dword [rax]
jmp fcn.004899c0

Function at 0x48b2e0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x48b3bd
push rbp
mov rbp, rsp
sub rsp, 0x40
movabs rdx, 0x4f3624342829392b
mov qword [rsp + 0x30], rdx
movabs rdx, 0x663064542a594c38
mov qword [rsp + 0x38], rdx
movabs rdx, 0xb0e090b0c0a0705
mov qword [rsp + 0x1c], rdx
movabs rdx, 0x3020c010b0e090b
mov qword [rsp + 0x20], rdx
movabs rdx, 0xc000b0b01000b05
mov qword [rsp + 0x28], rdx
xor eax, eax
nop
jmp 0x48b360
movzx r9d, byte [rsp + rsi + 0x30]
sub r9d, edx
lea edx, [r9 + 0x15]
mov byte [rsp + rdi + 0x30], dl
lea edx, [r8 + 0x15]
mov byte [rsp + rsi + 0x30], dl
add rax, 2
nop
cmp rax, 0x14
jge 0x48b38d
movzx edx, byte [rsp + rax + 0x1c]
movzx esi, byte [rsp + rax + 0x1d]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x10
jae 0x48b3b0
movzx r8d, byte [rsp + rdi + 0x30]
sub r8d, edx
cmp rsi, 0x10
jb 0x48b342
jmp 0x48b3a4
xor eax, eax
lea rbx, [rsp + 0x30]
mov ecx, 0x10
call fcn.00444780
add rsp, 0x40
pop rbp
ret
mov eax, esi
mov ecx, 0x10
call fcn.004564a0
mov eax, edi
mov ecx, 0x10
call fcn.004564a0
nop
nop dword [rax]
call fcn.004541c0
jmp fcn.0048b2e0
Function at 0x4963a0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x49649d
push rbp
mov rbp, rsp
sub rsp, 0x50
movabs rdx, 0xdcc3366ffdde3132
mov qword [rsp + 0x38], rdx
movabs rdx, 0x63f40a7326472dfc
mov qword [rsp + 0x40], rdx
movabs rdx, 0x3765734148384097
mov qword [rsp + 0x48], rdx
movabs rdx, 0xd0e020b07000917
mov qword [rsp + 0x18], rdx
movabs rdx, 0x6010503100008
mov qword [rsp + 0x20], rdx
movabs rdx, 0xe131708100b0312
mov qword [rsp + 0x28], rdx
movabs rdx, 0x10140b0011120d0a
mov qword [rsp + 0x30], rdx
xor eax, eax
jmp 0x496440
movzx r9d, byte [rsp + rsi + 0x38]
sub r9d, edx
lea edx, [r9 + 0x4c]
mov byte [rsp + rdi + 0x38], dl
lea edx, [r8 + 0x4c]
mov byte [rsp + rsi + 0x38], dl
add rax, 2
nop dword [rax]
cmp rax, 0x20
jge 0x49646d
movzx edx, byte [rsp + rax + 0x18]
movzx esi, byte [rsp + rax + 0x19]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x18
jae 0x496490
movzx r8d, byte [rsp + rdi + 0x38]
sub r8d, edx
cmp rsi, 0x18
jb 0x49641f
jmp 0x496484
xor eax, eax
lea rbx, [rsp + 0x38]
mov ecx, 0x18
call fcn.00444780
add rsp, 0x50
pop rbp
ret
mov eax, esi
mov ecx, 0x18
call fcn.004564a0
mov eax, edi
mov ecx, 0x18
call fcn.004564a0
nop
nop dword [rax]
call fcn.004541c0
jmp fcn.004963a0

Function at 0x49b860
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x49b94a
push rbp
mov rbp, rsp
sub rsp, 0x40
movabs rdx, 0x3aaa26a26ced659e
mov qword [rsp + 0x2f], rdx
movabs rdx, 0xa13aaa26a26ced65
mov qword [rsp + 0x30], rdx
movabs rdx, 0xf666a8b79bbb6163
mov qword [rsp + 0x38], rdx
movabs rdx, 0x81002050806040c
mov qword [rsp + 0x1d], rdx
movabs rdx, 0x200081002050806
mov qword [rsp + 0x1f], rdx
movabs rdx, 0xb08010e050d06
mov qword [rsp + 0x27], rdx
xor eax, eax
jmp 0x49b8ed
movzx r9d, byte [rsp + rsi + 0x2f]
sub r9d, edx
lea edx, [r9 - 0x2e]
mov byte [rsp + rdi + 0x2f], dl
lea edx, [r8 - 0x2e]
mov byte [rsp + rsi + 0x2f], dl
add rax, 2
cmp rax, 0x12
jge 0x49b91a
movzx edx, byte [rsp + rax + 0x1d]
movzx esi, byte [rsp + rax + 0x1e]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x11
jae 0x49b93d
movzx r8d, byte [rsp + rdi + 0x2f]
sub r8d, edx
cmp rsi, 0x11
jb 0x49b8d0
jmp 0x49b931
xor eax, eax
lea rbx, [rsp + 0x2f]
mov ecx, 0x11
call fcn.00444780
add rsp, 0x40
pop rbp
ret
mov eax, esi
mov ecx, 0x11
call fcn.004564a0
mov eax, edi
mov ecx, 0x11
call fcn.004564a0
nop
call fcn.004541c0
jmp fcn.0049b860
Function at 0x49b960
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x49ba26
push rbp
mov rbp, rsp
sub rsp, 0x30
movabs rdx, 0x50b56e08201816bd
mov qword [rsp + 0x27], rdx
mov byte [rsp + 0x2f], 0xaf
movabs rdx, 0x108040207010102
mov qword [rsp + 0x1b], rdx
mov dword [rsp + 0x23], 0x80206
xor eax, eax
nop
jmp 0x49b9c0
movzx r9d, byte [rsp + rsi + 0x27]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x5d]
mov byte [rsp + rdi + 0x27], dl
mov byte [rsp + rsi + 0x27], r8b
add rax, 2
nop dword [rax]
cmp rax, 0xc
jge 0x49b9f2
movzx edx, byte [rsp + rax + 0x1b]
movzx esi, byte [rsp + rax + 0x1c]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 9
jae 0x49ba17
movzx r8d, byte [rsp + rdi + 0x27]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x5d]
cmp rsi, 9
jb 0x49b9a2
jmp 0x49ba0b
xor eax, eax
lea rbx, [rsp + 0x27]
mov ecx, 9
nop
call fcn.00444780
add rsp, 0x30
pop rbp
ret
mov eax, esi
mov ecx, 9
call fcn.004564a0
mov eax, edi
mov ecx, 9
nop
call fcn.004564a0
nop
call fcn.004541c0
jmp fcn.0049b960

Function at 0x49be00
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x49bf4c
push rbp
mov rbp, rsp
sub rsp, 0x78
movabs rdx, 0x3a7463558a666572
mov qword [rsp + 0x4c], rdx
movabs rdx, 0x79574cb86e75605d
mov qword [rsp + 0x54], rdx
movabs rdx, 0x757d6a5079574cb8
mov qword [rsp + 0x58], rdx
movabs rdx, 0x84bda220684f69b7
mov qword [rsp + 0x60], rdx
movabs rdx, 0xa23078634a8b72a8
mov qword [rsp + 0x68], rdx
movabs rdx, 0x2072258939652856
mov qword [rsp + 0x70], rdx
movabs rdx, 0x141c232921101329
mov qword [rsp + 0x1e], rdx
movabs rdx, 0x191c1c0c2508191a
mov qword [rsp + 0x26], rdx
movabs rdx, 0x111c1b04271c191c
mov qword [rsp + 0x2c], rdx
movabs rdx, 0x121e292803111f22
mov qword [rsp + 0x34], rdx
movabs rdx, 0x410211f0e251b24
mov qword [rsp + 0x3c], rdx
movabs rdx, 0x322091f28161c23
mov qword [rsp + 0x44], rdx
xor eax, eax
jmp 0x49bee4
movzx r9d, byte [rsp + rsi + 0x4c]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x3f]
mov byte [rsp + rdi + 0x4c], dl
mov byte [rsp + rsi + 0x4c], r8b
add rax, 2
cmp rax, 0x2e
jge 0x49bf1c
movzx edx, byte [rsp + rax + 0x1e]
movzx esi, byte [rsp + rax + 0x1f]
mov edi, edx
xor edx, esi
add edx, eax
nop word [rax + rax]
cmp rdi, 0x2c
jae 0x49bf3f
movzx r8d, byte [rsp + rdi + 0x4c]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x3f]
cmp rsi, 0x2c
jb 0x49beca
jmp 0x49bf33
xor eax, eax
lea rbx, [rsp + 0x4c]
mov ecx, 0x2c
call fcn.00444780
add rsp, 0x78
pop rbp
ret
mov eax, esi
mov ecx, 0x2c
call fcn.004564a0
mov eax, edi
mov ecx, 0x2c
call fcn.004564a0
nop
call fcn.004541c0
jmp fcn.0049be00
Function at 0x4abd60
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4abe1d
push rbp
mov rbp, rsp
sub rsp, 0x30
movabs rdx, 0x1ea2316c612d2ce4
mov qword [rsp + 0x27], rdx
mov byte [rsp + 0x2f], 0x6e
movabs rdx, 0x7070707060202
mov qword [rsp + 0x1d], rdx
mov word [rsp + 0x25], 0x105
xor eax, eax
nop
jmp 0x4abdc0
movzx r9d, byte [rsp + rsi + 0x27]
sub r9d, edx
lea edx, [r9 + 0x49]
mov byte [rsp + rdi + 0x27], dl
lea edx, [r8 + 0x49]
mov byte [rsp + rsi + 0x27], dl
add rax, 2
nop
cmp rax, 0xa
jge 0x4abded
movzx edx, byte [rsp + rax + 0x1d]
movzx esi, byte [rsp + rax + 0x1e]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 9
jae 0x4abe10
movzx r8d, byte [rsp + rdi + 0x27]
sub r8d, edx
cmp rsi, 9
jb 0x4abda2
jmp 0x4abe04
xor eax, eax
lea rbx, [rsp + 0x27]
mov ecx, 9
call fcn.00444780
add rsp, 0x30
pop rbp
ret
mov eax, esi
mov ecx, 9
call fcn.004564a0
mov eax, edi
mov ecx, 9
call fcn.004564a0
nop
nop dword [rax]
call fcn.004541c0
jmp fcn.004abd60

Function at 0x4abe40
Capabilities:
Encrypt data using rc4 prga

Disassembly:
lea r12, [rsp - 0x28]
cmp r12, qword [r14 + 0x10]
jbe 0x4abfea
push rbp
mov rbp, rsp
sub rsp, 0xa0
movabs rdx, 0xe1bd310c7822cc02
mov qword [rsp + 0x68], rdx
movabs rdx, 0x3d276e99fb336979
mov qword [rsp + 0x70], rdx
movabs rdx, 0x13539708b6df80d
mov qword [rsp + 0x78], rdx
movabs rdx, 0x726f662040454037
mov qword [rsp + 0x80], rdx
movabs rdx, 0x562aadaf7e41e39
mov qword [rsp + 0x88], rdx
movabs rdx, 0x7a69cadf72340ddc
mov qword [rsp + 0x90], rdx
movabs rdx, 0x526575644114222e
mov qword [rsp + 0x98], rdx
movabs rdx, 0x33032070e250713
mov qword [rsp + 0x1c], rdx
movabs rdx, 0x1b0c0c2d0a300100
mov qword [rsp + 0x24], rdx
movabs rdx, 0x220e11291b0c0c2d
mov qword [rsp + 0x28], rdx
movabs rdx, 0xc2028320f330c06
mov qword [rsp + 0x30], rdx
movabs rdx, 0x2229242c0b0e0527
mov qword [rsp + 0x38], rdx
movabs rdx, 0x2d2c1732330e0737
mov qword [rsp + 0x40], rdx
movabs rdx, 0x11002a3132090615
mov qword [rsp + 0x48], rdx
movabs rdx, 0x90a162602340419
mov qword [rsp + 0x50], rdx
movabs rdx, 0x1031170503341913
mov qword [rsp + 0x58], rdx
movabs rdx, 0x2023262a181a1121
mov qword [rsp + 0x60], rdx
xor eax, eax
jmp 0x4abf86
movzx r9d, byte [rsp + rsi + 0x68]
sub r9d, edx
lea edx, [r9 + 0x76]
mov byte [rsp + rdi + 0x68], dl
lea edx, [r8 + 0x76]
mov byte [rsp + rsi + 0x68], dl
add rax, 2
cmp rax, 0x4c
jge 0x4abfb7
movzx edx, byte [rsp + rax + 0x1c]
movzx esi, byte [rsp + rax + 0x1d]
mov edi, edx
xor edx, esi
add edx, eax
nop dword [rax]
cmp rdi, 0x38
jae 0x4abfdd
movzx r8d, byte [rsp + rdi + 0x68]
sub r8d, edx
cmp rsi, 0x38
jb 0x4abf69
jmp 0x4abfd1
xor eax, eax
lea rbx, [rsp + 0x68]
mov ecx, 0x38
call fcn.00444780
add rsp, 0xa0
pop rbp
ret
mov eax, esi
mov ecx, 0x38
call fcn.004564a0
mov eax, edi
mov ecx, 0x38
call fcn.004564a0
nop
call fcn.004541c0
jmp fcn.004abe40
Function at 0x4ac240
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4ac32c
push rbp
mov rbp, rsp
sub rsp, 0x40
movabs rdx, 0x206e775e6a446e65
mov qword [rsp + 0x2f], rdx
movabs rdx, 0x4b206e775e6a446e
mov qword [rsp + 0x30], rdx
movabs rdx, 0x156e1b6b225a665e
mov qword [rsp + 0x38], rdx
movabs rdx, 0x100a03080a020c10
mov qword [rsp + 0x1b], rdx
movabs rdx, 0xb090e0c100a0308
mov qword [rsp + 0x1f], rdx
movabs rdx, 0x40a09000304030e
mov qword [rsp + 0x27], rdx
xor eax, eax
jmp 0x4ac2ca
movzx r9d, byte [rsp + rsi + 0x2f]
lea edx, [r9 + rdx]
lea edx, [rdx - 5]
mov byte [rsp + rdi + 0x2f], dl
mov byte [rsp + rsi + 0x2f], r8b
add rax, 2
cmp rax, 0x14
jge 0x4ac2fc
movzx edx, byte [rsp + rax + 0x1b]
movzx esi, byte [rsp + rax + 0x1c]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x11
jae 0x4ac31f
movzx r8d, byte [rsp + rdi + 0x2f]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 5]
cmp rsi, 0x11
jb 0x4ac2b0
jmp 0x4ac313
xor eax, eax
lea rbx, [rsp + 0x2f]
mov ecx, 0x11
call fcn.00444780
add rsp, 0x40
pop rbp
ret
mov eax, esi
mov ecx, 0x11
call fcn.004564a0
mov eax, edi
mov ecx, 0x11
call fcn.004564a0
nop
call fcn.004541c0
jmp fcn.004ac240

Function at 0x4ae740
Capabilities:
Encrypt data using rc4 prga

Disassembly:
lea r12, [rsp - 0x28]
cmp r12, qword [r14 + 0x10]
jbe 0x4ae8e8
push rbp
mov rbp, rsp
sub rsp, 0xa0
movabs rdx, 0x4eb4375130f96963
mov qword [rsp + 0x69], rdx
movabs rdx, 0x2c4942433b504e
mov qword [rsp + 0x70], rdx
movabs rdx, 0xfb48653c70ff6b63
mov qword [rsp + 0x78], rdx
movabs rdx, 0x676ef14a146e5949
mov qword [rsp + 0x80], rdx
movabs rdx, 0xec74734721381918
mov qword [rsp + 0x88], rdx
movabs rdx, 0xee1b65326661459d
mov qword [rsp + 0x90], rdx
movabs rdx, 0xc52c6973286bf50e
mov qword [rsp + 0x98], rdx
movabs rdx, 0x193520291c363627
mov qword [rsp + 0x1b], rdx
movabs rdx, 0x62d13161a320436
mov qword [rsp + 0x23], rdx
movabs rdx, 0x15222b0d0e29062d
mov qword [rsp + 0x29], rdx
movabs rdx, 0x192a2a2105102815
mov qword [rsp + 0x31], rdx
movabs rdx, 0x282819181020082f
mov qword [rsp + 0x39], rdx
movabs rdx, 0xe1b1a2e2c302c2b
mov qword [rsp + 0x41], rdx
movabs rdx, 0x1c2913182c292113
mov qword [rsp + 0x49], rdx
movabs rdx, 0x2611181117022d08
mov qword [rsp + 0x51], rdx
movabs rdx, 0x18231a2927230c1f
mov qword [rsp + 0x59], rdx
movabs rdx, 0x1109031b04181608
mov qword [rsp + 0x61], rdx
xor eax, eax
jmp 0x4ae883
movzx r9d, byte [rsp + rsi + 0x69]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x26]
mov byte [rsp + rdi + 0x69], dl
mov byte [rsp + rsi + 0x69], r8b
add rax, 2
cmp rax, 0x4e
jge 0x4ae8b5
movzx edx, byte [rsp + rax + 0x1b]
movzx esi, byte [rsp + rax + 0x1c]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x37
jae 0x4ae8db
movzx r8d, byte [rsp + rdi + 0x69]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x26]
cmp rsi, 0x37
jb 0x4ae869
jmp 0x4ae8cf
xor eax, eax
lea rbx, [rsp + 0x69]
mov ecx, 0x37
call fcn.00444780
add rsp, 0xa0
pop rbp
ret
mov eax, esi
mov ecx, 0x37
call fcn.004564a0
mov eax, edi
mov ecx, 0x37
call fcn.004564a0
nop
call fcn.004541c0
jmp fcn.004ae740
Function at 0x4af700
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4af838
push rbp
mov rbp, rsp
sub rsp, 0x70
movabs rdx, 0xe0e6ffbfa797201
mov qword [rsp + 0x4b], rdx
movabs rdx, 0xdec4c6d4180e0e6f
mov qword [rsp + 0x50], rdx
movabs rdx, 0x26cccdc7cb27da4
mov qword [rsp + 0x58], rdx
movabs rdx, 0xe18cabb5f9afc578
mov qword [rsp + 0x60], rdx
movabs rdx, 0xba616c97abb02ad1
mov qword [rsp + 0x68], rdx
movabs rdx, 0xe1015110d1e0d06
mov qword [rsp + 0x1b], rdx
movabs rdx, 0x1d1b1e1c2014120c
mov qword [rsp + 0x23], rdx
movabs rdx, 0x1c0a0b000d100918
mov qword [rsp + 0x2b], rdx
movabs rdx, 0x190f0d0924041612
mov qword [rsp + 0x33], rdx
movabs rdx, 0x7211103081f0807
mov qword [rsp + 0x3b], rdx
movabs rdx, 0x110320241a17210b
mov qword [rsp + 0x43], rdx
xor eax, eax
jmp 0x4af7d5
movzx r9d, byte [rsp + rsi + 0x4b]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x80]
mov byte [rsp + rdi + 0x4b], dl
mov byte [rsp + rsi + 0x4b], r8b
add rax, 2
cmp rax, 0x30
jge 0x4af808
movzx edx, byte [rsp + rax + 0x1b]
movzx esi, byte [rsp + rax + 0x1c]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x25
jae 0x4af82b
movzx r8d, byte [rsp + rdi + 0x4b]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x80]
nop
cmp rsi, 0x25
jb 0x4af7bb
jmp 0x4af81f
xor eax, eax
lea rbx, [rsp + 0x4b]
mov ecx, 0x25
call fcn.00444780
add rsp, 0x70
pop rbp
ret
mov eax, esi
mov ecx, 0x25
call fcn.004564a0
mov eax, edi
mov ecx, 0x25
call fcn.004564a0
nop
call fcn.004541c0
nop dword [rax]
jmp fcn.004af700

Function at 0x4afe00
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x48
movups xmmword [rsp + 0x58], xmm15
movabs rdx, 0x80fec410c3550049
mov qword [rsp + 0x38], rdx
movabs rdx, 0xd68af4ae3dd3b468
mov qword [rsp + 0x40], rdx
movabs rdx, 0xf0909080e0d0105
mov qword [rsp + 0x10], rdx
movabs rdx, 0x10300030e0b0c02
mov qword [rsp + 0x18], rdx
movabs rdx, 0xa0b03060d050a
mov qword [rsp + 0x20], rdx
xor eax, eax
jmp 0x4afe79
movzx r8d, byte [rsp + rbx + 0x38]
sub r8d, edx
lea edx, [r8 + 0x6c]
mov byte [rsp + rsi + 0x38], dl
lea edx, [rdi + 0x6c]
mov byte [rsp + rbx + 0x38], dl
add rax, 2
cmp rax, 0x18
jge 0x4afea8
movzx edx, byte [rsp + rax + 0x10]
movzx ebx, byte [rsp + rax + 0x11]
mov esi, edx
xor edx, ebx
add edx, eax
cmp rsi, 0x10
jae 0x4afee5
movzx edi, byte [rsp + rsi + 0x38]
sub edi, edx
nop dword [rax]
cmp rbx, 0x10
jb 0x4afe5d
jmp 0x4afed6
movups xmmword [rsp + 0x28], xmm15
xor eax, eax
jmp 0x4afec0
movzx ecx, byte [rsp + rax + 0x38]
mov byte [rsp + rax + 0x28], cl
inc rax
nop
cmp rax, 0x10
jl 0x4afeb2
movups xmm0, xmmword [rsp + 0x28]
movups xmmword [rsp + 0x58], xmm0
add rsp, 0x48
pop rbp
ret
mov eax, ebx
mov ecx, 0x10
nop dword [rax]
call fcn.004564a0
mov eax, esi
mov ecx, 0x10
call fcn.004564a0
nop
int3
Function at 0x4ba880
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4ba988
push rbp
mov rbp, rsp
sub rsp, 0x58
movabs rdx, 0x452f4c2f31790dfe
mov qword [rsp + 0x3b], rdx
movabs rdx, 0x56d7de69505c4654
mov qword [rsp + 0x43], rdx
movabs rdx, 0x6b4c64696256d7de
mov qword [rsp + 0x48], rdx
movabs rdx, 0x20390ade73473eed
mov qword [rsp + 0x50], rdx
movabs rdx, 0x151b160f151a130d
mov qword [rsp + 0x1d], rdx
movabs rdx, 0x40709030e010004
mov qword [rsp + 0x25], rdx
movabs rdx, 0x10b0a1a19170407
mov qword [rsp + 0x2b], rdx
movabs rdx, 0x171308050e080910
mov qword [rsp + 0x33], rdx
xor eax, eax
jmp 0x4ba92b
movzx r9d, byte [rsp + rsi + 0x3b]
sub r9d, edx
lea edx, [r9 + 0x40]
mov byte [rsp + rdi + 0x3b], dl
lea edx, [r8 + 0x40]
mov byte [rsp + rsi + 0x3b], dl
add rax, 2
cmp rax, 0x1e
jge 0x4ba958
movzx edx, byte [rsp + rax + 0x1d]
movzx esi, byte [rsp + rax + 0x1e]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x1d
jae 0x4ba97b
movzx r8d, byte [rsp + rdi + 0x3b]
sub r8d, edx
cmp rsi, 0x1d
jb 0x4ba90e
jmp 0x4ba96f
xor eax, eax
lea rbx, [rsp + 0x3b]
mov ecx, 0x1d
call fcn.00444780
add rsp, 0x58
pop rbp
ret
mov eax, esi
mov ecx, 0x1d
call fcn.004564a0
mov eax, edi
mov ecx, 0x1d
call fcn.004564a0
nop
call fcn.004541c0
jmp fcn.004ba880

Function at 0x4bd040
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4bd15d
push rbp
mov rbp, rsp
sub rsp, 0x60
movabs rdx, 0x20375d7d8b78726d
mov qword [rsp + 0x40], rdx
movabs rdx, 0x9b68587a4b3a8887
mov qword [rsp + 0x48], rdx
movabs rdx, 0x8574a76f87982074
mov qword [rsp + 0x50], rdx
movabs rdx, 0x86675d6c8f9e806b
mov qword [rsp + 0x58], rdx
movabs rdx, 0x1f02140c161d0d1e
mov qword [rsp + 0x18], rdx
movabs rdx, 0xe0e0f13070b0d00
mov qword [rsp + 0x20], rdx
movabs rdx, 0x121d1d171b040507
mov qword [rsp + 0x28], rdx
movabs rdx, 0x61806151e18
mov qword [rsp + 0x30], rdx
movabs rdx, 0x51a0903131d0819
mov qword [rsp + 0x38], rdx
xor eax, eax
jmp 0x4bd100
movzx r9d, byte [rsp + rsi + 0x40]
sub r9d, edx
lea edx, [r9 + 0x16]
mov byte [rsp + rdi + 0x40], dl
lea edx, [r8 + 0x16]
mov byte [rsp + rsi + 0x40], dl
add rax, 2
nop word [rax + rax]
cmp rax, 0x28
jge 0x4bd12d
movzx edx, byte [rsp + rax + 0x18]
movzx esi, byte [rsp + rax + 0x19]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x20
jae 0x4bd150
movzx r8d, byte [rsp + rdi + 0x40]
sub r8d, edx
cmp rsi, 0x20
jb 0x4bd0dd
jmp 0x4bd144
xor eax, eax
lea rbx, [rsp + 0x40]
mov ecx, 0x20
call fcn.00444780
add rsp, 0x60
pop rbp
ret
mov eax, esi
mov ecx, 0x20
call fcn.004564a0
mov eax, edi
mov ecx, 0x20
call fcn.004564a0
nop
nop dword [rax]
call fcn.004541c0
jmp fcn.004bd040
Function at 0x4bd820
Capabilities:
Decrypt data using aes via x86 extensions

Disassembly:
mov rcx, qword [rsp + 8]
mov rax, qword [rsp + 0x10]
mov rdx, qword [rsp + 0x18]
mov rbx, qword [rsp + 0x20]
movups xmm1, xmmword [rax]
movups xmm0, xmmword [rbx]
add rax, 0x10
pxor xmm0, xmm1
sub rcx, 0xc
je 0x4bd85f
jb 0x4bd874
movups xmm1, xmmword [rax]
aesdec xmm0, xmm1
movups xmm1, xmmword [rax + 0x10]
aesdec xmm0, xmm1
add rax, 0x20
movups xmm1, xmmword [rax]
aesdec xmm0, xmm1
movups xmm1, xmmword [rax + 0x10]
aesdec xmm0, xmm1
add rax, 0x20
movups xmm1, xmmword [rax]
aesdec xmm0, xmm1
movups xmm1, xmmword [rax + 0x10]
aesdec xmm0, xmm1
movups xmm1, xmmword [rax + 0x20]
aesdec xmm0, xmm1
movups xmm1, xmmword [rax + 0x30]
aesdec xmm0, xmm1
movups xmm1, xmmword [rax + 0x40]
aesdec xmm0, xmm1
movups xmm1, xmmword [rax + 0x50]
aesdec xmm0, xmm1
movups xmm1, xmmword [rax + 0x60]
aesdec xmm0, xmm1
movups xmm1, xmmword [rax + 0x70]
aesdec xmm0, xmm1
movups xmm1, xmmword [rax + 0x80]
aesdec xmm0, xmm1
movups xmm1, xmmword [rax + 0x90]
aesdeclast xmm0, xmm1
movups xmmword [rdx], xmm0
ret