joyce8/EMBER2024-capa huggingface dataset:
Function at 0x49cb20
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x49cbe6
push rbp
mov rbp, rsp
sub rsp, 0x30
movabs rdx, 0x998763954c66658c
mov qword [rsp + 0x27], rdx
mov byte [rsp + 0x2f], 0x3a
movabs rdx, 0x606070300080407
mov qword [rsp + 0x1b], rdx
mov dword [rsp + 0x23], 0x6040008
xor eax, eax
nop
jmp 0x49cb80
movzx r9d, byte [rsp + rsi + 0x27]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x1a]
mov byte [rsp + rdi + 0x27], dl
mov byte [rsp + rsi + 0x27], r8b
add rax, 2
nop dword [rax]
cmp rax, 0xc
jge 0x49cbb2
movzx edx, byte [rsp + rax + 0x1b]
movzx esi, byte [rsp + rax + 0x1c]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 9
jae 0x49cbd7
movzx r8d, byte [rsp + rdi + 0x27]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x1a]
cmp rsi, 9
jb 0x49cb62
jmp 0x49cbcb
xor eax, eax
lea rbx, [rsp + 0x27]
mov ecx, 9
nop
call fcn.00444780
add rsp, 0x30
pop rbp
ret
mov eax, esi
mov ecx, 9
call fcn.00456420
mov eax, edi
mov ecx, 9
nop
call fcn.00456420
nop
call fcn.00454140
jmp fcn.0049cb20

Function at 0x49d600
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x49d6bd
push rbp
mov rbp, rsp
sub rsp, 0x30
movabs rdx, 0xa1263c46cb85770
mov qword [rsp + 0x27], rdx
mov byte [rsp + 0x2f], 0xdd
movabs rdx, 0x7060108000601
mov qword [rsp + 0x1b], rdx
mov dword [rsp + 0x23], 0x2010004
xor eax, eax
nop
jmp 0x49d660
movzx r9d, byte [rsp + rsi + 0x27]
sub r9d, edx
lea edx, [r9 - 0x46]
mov byte [rsp + rdi + 0x27], dl
lea edx, [r8 - 0x46]
mov byte [rsp + rsi + 0x27], dl
add rax, 2
nop
cmp rax, 0xc
jge 0x49d68d
movzx edx, byte [rsp + rax + 0x1b]
movzx esi, byte [rsp + rax + 0x1c]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 9
jae 0x49d6b0
movzx r8d, byte [rsp + rdi + 0x27]
sub r8d, edx
cmp rsi, 9
jb 0x49d642
jmp 0x49d6a4
xor eax, eax
lea rbx, [rsp + 0x27]
mov ecx, 9
call fcn.00444780
add rsp, 0x30
pop rbp
ret
mov eax, esi
mov ecx, 9
call fcn.00456420
mov eax, edi
mov ecx, 9
call fcn.00456420
nop
nop dword [rax]
call fcn.00454140
jmp fcn.0049d600
Function at 0x49d6e0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x49d7db
push rbp
mov rbp, rsp
sub rsp, 0x50
movabs rdx, 0x2b656e75eb513f20
mov qword [rsp + 0x3b], rdx
movabs rdx, 0x53ea5930142b656e
mov qword [rsp + 0x40], rdx
movabs rdx, 0x642746f0f807fa54
mov qword [rsp + 0x48], rdx
movabs rdx, 0xf0b0b0e0d0c0810
mov qword [rsp + 0x1d], rdx
movabs rdx, 0x9100b0a02071201
mov qword [rsp + 0x25], rdx
movabs rdx, 0x711110e08020910
mov qword [rsp + 0x2b], rdx
movabs rdx, 0x130f030e0e110a02
mov qword [rsp + 0x33], rdx
xor eax, eax
jmp 0x49d779
movzx r9d, byte [rsp + rsi + 0x3b]
lea edx, [r9 + rdx]
lea edx, [rdx + 0xe]
mov byte [rsp + rdi + 0x3b], dl
mov byte [rsp + rsi + 0x3b], r8b
add rax, 2
cmp rax, 0x1e
jge 0x49d7ab
movzx edx, byte [rsp + rax + 0x1d]
movzx esi, byte [rsp + rax + 0x1e]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x15
jae 0x49d7ce
movzx r8d, byte [rsp + rdi + 0x3b]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0xe]
cmp rsi, 0x15
jb 0x49d75f
jmp 0x49d7c2
xor eax, eax
lea rbx, [rsp + 0x3b]
mov ecx, 0x15
call fcn.00444780
add rsp, 0x50
pop rbp
ret
mov eax, esi
mov ecx, 0x15
call fcn.00456420
mov eax, edi
mov ecx, 0x15
call fcn.00456420
nop
nop dword [rax + rax]
call fcn.00454140
jmp fcn.0049d6e0

Function at 0x49e9e0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x49eaca
push rbp
mov rbp, rsp
sub rsp, 0x48
movabs rdx, 0xe79cfb656c66b6a9
mov qword [rsp + 0x37], rdx
movabs rdx, 0x80e79cfb656c66b6
mov qword [rsp + 0x38], rdx
movabs rdx, 0xf0d696206cdcb4bd
mov qword [rsp + 0x40], rdx
movabs rdx, 0x510090b0e0f090b
mov qword [rsp + 0x1f], rdx
movabs rdx, 0x1005050908070706
mov qword [rsp + 0x27], rdx
movabs rdx, 0x1000a0e100b0606
mov qword [rsp + 0x2f], rdx
xor eax, eax
jmp 0x49ea6d
movzx r9d, byte [rsp + rsi + 0x37]
sub r9d, edx
lea edx, [r9 - 0x2d]
mov byte [rsp + rdi + 0x37], dl
lea edx, [r8 - 0x2d]
mov byte [rsp + rsi + 0x37], dl
add rax, 2
cmp rax, 0x18
jge 0x49ea9a
movzx edx, byte [rsp + rax + 0x1f]
movzx esi, byte [rsp + rax + 0x20]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x11
jae 0x49eabd
movzx r8d, byte [rsp + rdi + 0x37]
sub r8d, edx
cmp rsi, 0x11
jb 0x49ea50
jmp 0x49eab1
xor eax, eax
lea rbx, [rsp + 0x37]
mov ecx, 0x11
call fcn.00444780
add rsp, 0x48
pop rbp
ret
mov eax, esi
mov ecx, 0x11
call fcn.00456420
mov eax, edi
mov ecx, 0x11
call fcn.00456420
nop
call fcn.00454140
jmp fcn.0049e9e0
Function at 0x49fcc0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
lea r12, [rsp - 0x10]
cmp r12, qword [r14 + 0x10]
jbe 0x49fe40
push rbp
mov rbp, rsp
sub rsp, 0x88
movabs rdx, 0xc96016dcdf026572
mov qword [rsp + 0x5c], rdx
movabs rdx, 0x790adc5d6ed71520
mov qword [rsp + 0x64], rdx
movabs rdx, 0x10a6bd3c790adc5d
mov qword [rsp + 0x68], rdx
movabs rdx, 0xc3edd45bb6ec1277
mov qword [rsp + 0x70], rdx
movabs rdx, 0x128c246f619d19b9
mov qword [rsp + 0x78], rdx
movabs rdx, 0xe3e080ce6165b2c3
mov qword [rsp + 0x80], rdx
movabs rdx, 0x1e2b171c11021316
mov qword [rsp + 0x1a], rdx
movabs rdx, 0x21251e2b171c1102
mov qword [rsp + 0x1c], rdx
movabs rdx, 0x1b0a2504240d2718
mov qword [rsp + 0x24], rdx
movabs rdx, 0x1229112203250607
mov qword [rsp + 0x2c], rdx
movabs rdx, 0x211615180c0a1910
mov qword [rsp + 0x34], rdx
movabs rdx, 0xc12031a27201129
mov qword [rsp + 0x3c], rdx
movabs rdx, 0x7210a1d1d282a07
mov qword [rsp + 0x44], rdx
movabs rdx, 0x18130e270e21230a
mov qword [rsp + 0x4c], rdx
movabs rdx, 0x1609160705231922
mov qword [rsp + 0x54], rdx
xor eax, eax
jmp 0x49fde0
movzx r9d, byte [rsp + rsi + 0x5c]
sub r9d, edx
lea edx, [r9 - 0x42]
mov byte [rsp + rdi + 0x5c], dl
lea edx, [r8 - 0x42]
mov byte [rsp + rsi + 0x5c], dl
add rax, 2
nop
cmp rax, 0x42
jge 0x49fe0d
movzx edx, byte [rsp + rax + 0x1a]
movzx esi, byte [rsp + rax + 0x1b]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x2c
jae 0x49fe33
movzx r8d, byte [rsp + rdi + 0x5c]
sub r8d, edx
cmp rsi, 0x2c
jb 0x49fdc2
jmp 0x49fe27
xor eax, eax
lea rbx, [rsp + 0x5c]
mov ecx, 0x2c
call fcn.00444780
add rsp, 0x88
pop rbp
ret
mov eax, esi
mov ecx, 0x2c
call fcn.00456420
mov eax, edi
mov ecx, 0x2c
call fcn.00456420
nop
call fcn.00454140
jmp fcn.0049fcc0
Function at 0x4a1000
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4a1138
push rbp
mov rbp, rsp
sub rsp, 0x70
movabs rdx, 0x427404510b666518
mov qword [rsp + 0x4e], rdx
movabs rdx, 0x310f427404510b66
mov qword [rsp + 0x50], rdx
movabs rdx, 0x20bd069e64e66969
mov qword [rsp + 0x58], rdx
movabs rdx, 0x7522bf494af42509
mov qword [rsp + 0x60], rdx
movabs rdx, 0xe0e7bfbc9f206a63
mov qword [rsp + 0x68], rdx
movabs rdx, 0xb0f0f0909141b16
mov qword [rsp + 0x1e], rdx
movabs rdx, 0x416181315170704
mov qword [rsp + 0x26], rdx
movabs rdx, 0xe10081f0f00150b
mov qword [rsp + 0x2e], rdx
movabs rdx, 0x1e0e031207171717
mov qword [rsp + 0x36], rdx
movabs rdx, 0x41e211b051d1620
mov qword [rsp + 0x3e], rdx
movabs rdx, 0xc10141017040005
mov qword [rsp + 0x46], rdx
xor eax, eax
jmp 0x4a10d5
movzx r9d, byte [rsp + rsi + 0x4e]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x36]
mov byte [rsp + rdi + 0x4e], dl
mov byte [rsp + rsi + 0x4e], r8b
add rax, 2
cmp rax, 0x30
jge 0x4a1108
movzx edx, byte [rsp + rax + 0x1e]
movzx esi, byte [rsp + rax + 0x1f]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x22
jae 0x4a112b
movzx r8d, byte [rsp + rdi + 0x4e]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x36]
nop
cmp rsi, 0x22
jb 0x4a10bb
jmp 0x4a111f
xor eax, eax
lea rbx, [rsp + 0x4e]
mov ecx, 0x22
call fcn.00444780
add rsp, 0x70
pop rbp
ret
mov eax, esi
mov ecx, 0x22
call fcn.00456420
mov eax, edi
mov ecx, 0x22
call fcn.00456420
nop
call fcn.00454140
nop dword [rax]
jmp fcn.004a1000
Function at 0x4a1160
Capabilities:
Encrypt data using rc4 prga

Disassembly:
lea r12, [rsp - 0x20]
cmp r12, qword [r14 + 0x10]
jbe 0x4a12f5
push rbp
mov rbp, rsp
sub rsp, 0x98
movabs rdx, 0x201eff6543664fde
mov qword [rsp + 0x61], rdx
movabs rdx, 0x6e010c406e694a20
mov qword [rsp + 0x68], rdx
movabs rdx, 0x986f277265204125
mov qword [rsp + 0x70], rdx
movabs rdx, 0x4404613e27e2093a
mov qword [rsp + 0x78], rdx
movabs rdx, 0x661aa86573755364
mov qword [rsp + 0x80], rdx
movabs rdx, 0x62f299656b3dc62d
mov qword [rsp + 0x88], rdx
movabs rdx, 0xfe2e5761563192f3
mov qword [rsp + 0x90], rdx
movabs rdx, 0x19250024351d1a31
mov qword [rsp + 0x1f], rdx
movabs rdx, 0x362819250024351d
mov qword [rsp + 0x21], rdx
movabs rdx, 0x3008000624361928
mov qword [rsp + 0x29], rdx
movabs rdx, 0x718162414051608
mov qword [rsp + 0x31], rdx
movabs rdx, 0x2d2f0630200d2c25
mov qword [rsp + 0x39], rdx
movabs rdx, 0x934240827250b1b
mov qword [rsp + 0x41], rdx
movabs rdx, 0x11424240f0f192e
mov qword [rsp + 0x49], rdx
movabs rdx, 0x9033035092f1e10
mov qword [rsp + 0x51], rdx
movabs rdx, 0x180c35062d293605
mov qword [rsp + 0x59], rdx
xor eax, eax
jmp 0x4a1294
movzx r9d, byte [rsp + rsi + 0x61]
sub r9d, edx
lea edx, [r9 + 0x68]
mov byte [rsp + rdi + 0x61], dl
lea edx, [r8 + 0x68]
mov byte [rsp + rsi + 0x61], dl
add rax, 2
cmp rax, 0x42
jge 0x4a12c2
movzx edx, byte [rsp + rax + 0x1f]
movzx esi, byte [rsp + rax + 0x20]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x37
jae 0x4a12e8
movzx r8d, byte [rsp + rdi + 0x61]
sub r8d, edx
cmp rsi, 0x37
jb 0x4a1277
nop
jmp 0x4a12dc
xor eax, eax
lea rbx, [rsp + 0x61]
mov ecx, 0x37
call fcn.00444780
add rsp, 0x98
pop rbp
ret
mov eax, esi
mov ecx, 0x37
call fcn.00456420
mov eax, edi
mov ecx, 0x37
call fcn.00456420
nop
call fcn.00454140
jmp fcn.004a1160
Function at 0x4a1300
Capabilities:
Encrypt data using rc4 prga
Resolve function by parsing pe exports

Disassembly:
lea r12, [rsp - 0x28]
cmp r12, qword [r14 + 0x10]
jbe 0x4a14bb
push rbp
mov rbp, rsp
sub rsp, 0xa0
movabs rdx, 0x3a03e4afee661c84
mov qword [rsp + 0x5c], rdx
movabs rdx, 0xe4e505203a03e4af
mov qword [rsp + 0x60], rdx
movabs rdx, 0xce54c2aa748c6567
mov qword [rsp + 0x68], rdx
movabs rdx, 0x666aa1d32c2e6575
mov qword [rsp + 0x70], rdx
movabs rdx, 0xa6f9ec6efe6fcfe1
mov qword [rsp + 0x78], rdx
movabs rdx, 0x8f40d0a086e6fb8
mov qword [rsp + 0x80], rdx
movabs rdx, 0x3320e695ce61b257
mov qword [rsp + 0x88], rdx
movabs rdx, 0xf7ce36b7b569746f
mov qword [rsp + 0x90], rdx
movabs rdx, 0xa2328ad0e46f70b4
mov qword [rsp + 0x98], rdx
movabs rdx, 0x1a2c102400280e37
mov qword [rsp + 0x18], rdx
movabs rdx, 0x120c1c221a2c1024
mov qword [rsp + 0x1c], rdx
movabs rdx, 0x33033b1f2a192b37
mov qword [rsp + 0x24], rdx
movabs rdx, 0x17172c0540011c31
mov qword [rsp + 0x2c], rdx
movabs rdx, 0x609390e292c173a
mov qword [rsp + 0x34], rdx
movabs rdx, 0x3121283f272d2f13
mov qword [rsp + 0x3c], rdx
movabs rdx, 0x423c3041183a291a
mov qword [rsp + 0x44], rdx
movabs rdx, 0x3400c39381d4218
mov qword [rsp + 0x4c], rdx
movabs rdx, 0xa0b112343040e12
mov qword [rsp + 0x54], rdx
xor eax, eax
jmp 0x4a1452
movzx r9d, byte [rsp + rsi + 0x5c]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x3e]
mov byte [rsp + rdi + 0x5c], dl
mov byte [rsp + rsi + 0x5c], r8b
add rax, 2
cmp rax, 0x44
jge 0x4a1488
movzx edx, byte [rsp + rax + 0x18]
movzx esi, byte [rsp + rax + 0x19]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x44
jae 0x4a14ae
movzx r8d, byte [rsp + rdi + 0x5c]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x3e]
nop dword [rax]
cmp rsi, 0x44
jb 0x4a1438
jmp 0x4a14a2
xor eax, eax
lea rbx, [rsp + 0x5c]
mov ecx, 0x44
call fcn.00444780
add rsp, 0xa0
pop rbp
ret
mov eax, esi
mov ecx, 0x44
call fcn.00456420
mov eax, edi
mov ecx, 0x44
call fcn.00456420
nop
nop dword [rax + rax]
call fcn.00454140
jmp fcn.004a1300
Function at 0x4a8e00
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4a8f38
push rbp
mov rbp, rsp
sub rsp, 0x68
movabs rdx, 0x77696b6589667865
mov qword [rsp + 0x47], rdx
movabs rdx, 0x6b77696b65896678
mov qword [rsp + 0x48], rdx
movabs rdx, 0x5b39622c2a958286
mov qword [rsp + 0x50], rdx
movabs rdx, 0x9077755f2278647d
mov qword [rsp + 0x58], rdx
movabs rdx, 0xa65912944fa37c71
mov qword [rsp + 0x60], rdx
movabs rdx, 0x100201b191f0e1e
mov qword [rsp + 0x1d], rdx
movabs rdx, 0x1a0a0715050b06
mov qword [rsp + 0x25], rdx
movabs rdx, 0x141e001a0a071505
mov qword [rsp + 0x27], rdx
movabs rdx, 0x1c0720090d1b1210
mov qword [rsp + 0x2f], rdx
movabs rdx, 0xf180a1f1806141e
mov qword [rsp + 0x37], rdx
movabs rdx, 0x1d030111080c1a17
mov qword [rsp + 0x3f], rdx
xor eax, eax
jmp 0x4a8ed8
movzx r9d, byte [rsp + rsi + 0x47]
sub r9d, edx
lea edx, [r9 + 0x1e]
mov byte [rsp + rdi + 0x47], dl
lea edx, [r8 + 0x1e]
mov byte [rsp + rsi + 0x47], dl
add rax, 2
cmp rax, 0x2a
jge 0x4a8f08
movzx edx, byte [rsp + rax + 0x1d]
movzx esi, byte [rsp + rax + 0x1e]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x21
jae 0x4a8f2b
movzx r8d, byte [rsp + rdi + 0x47]
sub r8d, edx
nop dword [rax]
cmp rsi, 0x21
jb 0x4a8ebb
jmp 0x4a8f1f
xor eax, eax
lea rbx, [rsp + 0x47]
mov ecx, 0x21
call fcn.00444780
add rsp, 0x68
pop rbp
ret
mov eax, esi
mov ecx, 0x21
call fcn.00456420
mov eax, edi
mov ecx, 0x21
call fcn.00456420
nop
call fcn.00454140
nop dword [rax]
jmp fcn.004a8e00

Function at 0x4ac2c0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4ac3ac
push rbp
mov rbp, rsp
sub rsp, 0x48
movabs rdx, 0x2574d765c496e0a9
mov qword [rsp + 0x36], rdx
movabs rdx, 0xbfda2574d765c496
mov qword [rsp + 0x38], rdx
movabs rdx, 0xec6539db3bb9db54
mov qword [rsp + 0x40], rdx
movabs rdx, 0xd0b0c0b0a01090e
mov qword [rsp + 0x1e], rdx
movabs rdx, 0x110b050f0d020803
mov qword [rsp + 0x26], rdx
movabs rdx, 0x50b01050100070b
mov qword [rsp + 0x2e], rdx
xor eax, eax
jmp 0x4ac34a
movzx r9d, byte [rsp + rsi + 0x36]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x7f]
mov byte [rsp + rdi + 0x36], dl
mov byte [rsp + rsi + 0x36], r8b
add rax, 2
cmp rax, 0x18
jge 0x4ac37c
movzx edx, byte [rsp + rax + 0x1e]
movzx esi, byte [rsp + rax + 0x1f]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x12
jae 0x4ac39f
movzx r8d, byte [rsp + rdi + 0x36]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x7f]
cmp rsi, 0x12
jb 0x4ac330
jmp 0x4ac393
xor eax, eax
lea rbx, [rsp + 0x36]
mov ecx, 0x12
call fcn.00444780
add rsp, 0x48
pop rbp
ret
mov eax, esi
mov ecx, 0x12
call fcn.00456420
mov eax, edi
mov ecx, 0x12
call fcn.00456420
nop
call fcn.00454140
jmp fcn.004ac2c0
Function at 0x4ac3c0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4ac4ac
push rbp
mov rbp, rsp
sub rsp, 0x48
movabs rdx, 0xf2916365ed78c810
mov qword [rsp + 0x33], rdx
movabs rdx, 0x65756c386df29163
mov qword [rsp + 0x38], rdx
movabs rdx, 0x8af9d66bf8ef8c2e
mov qword [rsp + 0x40], rdx
movabs rdx, 0x110e06001002130f
mov qword [rsp + 0x1d], rdx
movabs rdx, 0x81210071009110e
mov qword [rsp + 0x23], rdx
movabs rdx, 0x12030e0111001114
mov qword [rsp + 0x2b], rdx
xor eax, eax
jmp 0x4ac44a
movzx r9d, byte [rsp + rsi + 0x33]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x5a]
mov byte [rsp + rdi + 0x33], dl
mov byte [rsp + rsi + 0x33], r8b
add rax, 2
cmp rax, 0x16
jge 0x4ac47c
movzx edx, byte [rsp + rax + 0x1d]
movzx esi, byte [rsp + rax + 0x1e]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x15
jae 0x4ac49f
movzx r8d, byte [rsp + rdi + 0x33]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x5a]
cmp rsi, 0x15
jb 0x4ac430
jmp 0x4ac493
xor eax, eax
lea rbx, [rsp + 0x33]
mov ecx, 0x15
call fcn.00444780
add rsp, 0x48
pop rbp
ret
mov eax, esi
mov ecx, 0x15
call fcn.00456420
mov eax, edi
mov ecx, 0x15
call fcn.00456420
nop
call fcn.00454140
jmp fcn.004ac3c0

Function at 0x4ac4c0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4ac5f8
push rbp
mov rbp, rsp
sub rsp, 0x70
movabs rdx, 0xdadc58cb9a41b9ec
mov qword [rsp + 0x4b], rdx
movabs rdx, 0x95756d6156dadc58
mov qword [rsp + 0x50], rdx
movabs rdx, 0x6fae73533eb4767d
mov qword [rsp + 0x58], rdx
movabs rdx, 0x696222c26f6e84ec
mov qword [rsp + 0x60], rdx
movabs rdx, 0x6563707673b6f37f
mov qword [rsp + 0x68], rdx
movabs rdx, 0x191e151907191303
mov qword [rsp + 0x1d], rdx
movabs rdx, 0x10f060005001a05
mov qword [rsp + 0x25], rdx
movabs rdx, 0x130719190401010f
mov qword [rsp + 0x2b], rdx
movabs rdx, 0x11d0c04211c041f
mov qword [rsp + 0x33], rdx
movabs rdx, 0x100f110e02131605
mov qword [rsp + 0x3b], rdx
movabs rdx, 0xd020f1600000a22
mov qword [rsp + 0x43], rdx
xor eax, eax
jmp 0x4ac595
movzx r9d, byte [rsp + rsi + 0x4b]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x52]
mov byte [rsp + rdi + 0x4b], dl
mov byte [rsp + rsi + 0x4b], r8b
add rax, 2
cmp rax, 0x2e
jge 0x4ac5c8
movzx edx, byte [rsp + rax + 0x1d]
movzx esi, byte [rsp + rax + 0x1e]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x25
jae 0x4ac5eb
movzx r8d, byte [rsp + rdi + 0x4b]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x52]
nop
cmp rsi, 0x25
jb 0x4ac57b
jmp 0x4ac5df
xor eax, eax
lea rbx, [rsp + 0x4b]
mov ecx, 0x25
call fcn.00444780
add rsp, 0x70
pop rbp
ret
mov eax, esi
mov ecx, 0x25
call fcn.00456420
mov eax, edi
mov ecx, 0x25
call fcn.00456420
nop
call fcn.00454140
nop dword [rax]
jmp fcn.004ac4c0
Function at 0x4b1e40
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4b1f67
push rbp
mov rbp, rsp
sub rsp, 0x68
movabs rdx, 0x200f07fb68260763
mov qword [rsp + 0x43], rdx
movabs rdx, 0x20edfbda06200f07
mov qword [rsp + 0x48], rdx
movabs rdx, 0x39574e7610a14f6
mov qword [rsp + 0x50], rdx
movabs rdx, 0x3169740df20cfc96
mov qword [rsp + 0x58], rdx
movabs rdx, 0x3caf6c69181a20a7
mov qword [rsp + 0x60], rdx
movabs rdx, 0xb040d020f1d111f
mov qword [rsp + 0x1d], rdx
movabs rdx, 0x1d180c1815080b04
mov qword [rsp + 0x23], rdx
movabs rdx, 0xa1906230d180520
mov qword [rsp + 0x2b], rdx
movabs rdx, 0x1316011408181411
mov qword [rsp + 0x33], rdx
movabs rdx, 0x1617241c0e1d0609
mov qword [rsp + 0x3b], rdx
xor eax, eax
jmp 0x4b1f09
movzx r9d, byte [rsp + rsi + 0x43]
sub r9d, edx
lea edx, [r9 - 0x73]
mov byte [rsp + rdi + 0x43], dl
lea edx, [r8 - 0x73]
mov byte [rsp + rsi + 0x43], dl
add rax, 2
cmp rax, 0x26
jge 0x4b1f37
movzx edx, byte [rsp + rax + 0x1d]
movzx esi, byte [rsp + rax + 0x1e]
mov edi, edx
xor edx, esi
add edx, eax
nop
cmp rdi, 0x25
jae 0x4b1f5a
movzx r8d, byte [rsp + rdi + 0x43]
sub r8d, edx
cmp rsi, 0x25
jb 0x4b1eec
jmp 0x4b1f4e
xor eax, eax
lea rbx, [rsp + 0x43]
mov ecx, 0x25
call fcn.00444780
add rsp, 0x68
pop rbp
ret
mov eax, esi
mov ecx, 0x25
call fcn.00456420
mov eax, edi
mov ecx, 0x25
call fcn.00456420
nop
call fcn.00454140
jmp fcn.004b1e40

Function at 0x4b49e0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x48
movups xmmword [rsp + 0x58], xmm15
movabs rdx, 0x8c482072ca040239
mov qword [rsp + 0x38], rdx
movabs rdx, 0x2f1a4de7d86c721b
mov qword [rsp + 0x40], rdx
movabs rdx, 0x70000030700000e
mov qword [rsp + 0x14], rdx
movabs rdx, 0xe0c0907000003
mov qword [rsp + 0x18], rdx
movabs rdx, 0x306090c04030603
mov qword [rsp + 0x20], rdx
xor eax, eax
jmp 0x4b4a57
movzx r8d, byte [rsp + rbx + 0x38]
lea edx, [r8 + rdx]
lea edx, [rdx - 0x2f]
mov byte [rsp + rsi + 0x38], dl
mov byte [rsp + rbx + 0x38], dil
add rax, 2
cmp rax, 0x14
jge 0x4b4a88
movzx edx, byte [rsp + rax + 0x14]
movzx ebx, byte [rsp + rax + 0x15]
mov esi, edx
xor edx, ebx
add edx, eax
cmp rsi, 0x10
jae 0x4b4ac5
movzx edi, byte [rsp + rsi + 0x38]
lea edi, [rdi + rdx]
lea edi, [rdi - 0x2f]
nop
cmp rbx, 0x10
jb 0x4b4a3d
jmp 0x4b4ab6
movups xmmword [rsp + 0x28], xmm15
xor eax, eax
jmp 0x4b4aa0
movzx ecx, byte [rsp + rax + 0x38]
mov byte [rsp + rax + 0x28], cl
inc rax
nop
cmp rax, 0x10
jl 0x4b4a92
movups xmm0, xmmword [rsp + 0x28]
movups xmmword [rsp + 0x58], xmm0
add rsp, 0x48
pop rbp
ret
mov eax, ebx
mov ecx, 0x10
nop dword [rax]
call fcn.00456420
mov eax, esi
mov ecx, 0x10
call fcn.00456420
nop
int3
Function at 0x4c08e0
Capabilities:
Decrypt data using aes via x86 extensions

Disassembly:
mov rcx, qword [rsp + 8]
mov rax, qword [rsp + 0x10]
mov rdx, qword [rsp + 0x18]
mov rbx, qword [rsp + 0x20]
movups xmm1, xmmword [rax]
movups xmm0, xmmword [rbx]
add rax, 0x10
pxor xmm0, xmm1
sub rcx, 0xc
je 0x4c091f
jb 0x4c0934
movups xmm1, xmmword [rax]
aesdec xmm0, xmm1
movups xmm1, xmmword [rax + 0x10]
aesdec xmm0, xmm1
add rax, 0x20
movups xmm1, xmmword [rax]
aesdec xmm0, xmm1
movups xmm1, xmmword [rax + 0x10]
aesdec xmm0, xmm1
add rax, 0x20
movups xmm1, xmmword [rax]
aesdec xmm0, xmm1
movups xmm1, xmmword [rax + 0x10]
aesdec xmm0, xmm1
movups xmm1, xmmword [rax + 0x20]
aesdec xmm0, xmm1
movups xmm1, xmmword [rax + 0x30]
aesdec xmm0, xmm1
movups xmm1, xmmword [rax + 0x40]
aesdec xmm0, xmm1
movups xmm1, xmmword [rax + 0x50]
aesdec xmm0, xmm1
movups xmm1, xmmword [rax + 0x60]
aesdec xmm0, xmm1
movups xmm1, xmmword [rax + 0x70]
aesdec xmm0, xmm1
movups xmm1, xmmword [rax + 0x80]
aesdec xmm0, xmm1
movups xmm1, xmmword [rax + 0x90]
aesdeclast xmm0, xmm1
movups xmmword [rdx], xmm0
ret
Function at 0x4c09a0
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
push rbp
mov rbp, rsp
mov rcx, qword [rsp + 0x10]
mov rax, qword [rsp + 0x18]
mov rbx, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x28]
movups xmm0, xmmword [rax]
movups xmmword [rbx], xmm0
add rbx, 0x10
pxor xmm4, xmm4
cmp ecx, 0xc
je 0x4c0a74
jb 0x4c0ad3
movups xmm2, xmmword [rax + 0x10]
movups xmmword [rbx], xmm2
add rbx, 0x10
aeskeygenassist xmm1, xmm2, 1
call fcn.004c0880
aeskeygenassist xmm1, xmm0, 1
call fcn.004c08a0
aeskeygenassist xmm1, xmm2, 2
call fcn.004c0880
aeskeygenassist xmm1, xmm0, 2
call fcn.004c08a0
aeskeygenassist xmm1, xmm2, 4
call fcn.004c0880
aeskeygenassist xmm1, xmm0, 4
call fcn.004c08a0
aeskeygenassist xmm1, xmm2, 8
call fcn.004c0880
aeskeygenassist xmm1, xmm0, 8
call fcn.004c08a0
aeskeygenassist xmm1, xmm2, 0x10
call fcn.004c0880
aeskeygenassist xmm1, xmm0, 0x10
call fcn.004c08a0
aeskeygenassist xmm1, xmm2, 0x20
call fcn.004c0880
aeskeygenassist xmm1, xmm0, 0x20
call fcn.004c08a0
aeskeygenassist xmm1, xmm2, 0x40
call fcn.004c0880
jmp 0x4c0b41
movq xmm2, qword [rax + 0x10]
aeskeygenassist xmm1, xmm2, 1
call fcn.004c07e0
aeskeygenassist xmm1, xmm2, 2
call fcn.004c0840
aeskeygenassist xmm1, xmm2, 4
call fcn.004c07e0
aeskeygenassist xmm1, xmm2, 8
call fcn.004c0840
aeskeygenassist xmm1, xmm2, 0x10
call fcn.004c07e0
aeskeygenassist xmm1, xmm2, 0x20
call fcn.004c0840
aeskeygenassist xmm1, xmm2, 0x40
call fcn.004c07e0
aeskeygenassist xmm1, xmm2, 0x80
call fcn.004c0840
jmp 0x4c0b41
aeskeygenassist xmm1, xmm0, 1
call fcn.004c07a0
aeskeygenassist xmm1, xmm0, 2
call fcn.004c07a0
aeskeygenassist xmm1, xmm0, 4
call fcn.004c07a0
aeskeygenassist xmm1, xmm0, 8
call fcn.004c07a0
aeskeygenassist xmm1, xmm0, 0x10
call fcn.004c07a0
aeskeygenassist xmm1, xmm0, 0x20
call fcn.004c07a0
aeskeygenassist xmm1, xmm0, 0x40
call fcn.004c07a0
aeskeygenassist xmm1, xmm0, 0x80
call fcn.004c07a0
aeskeygenassist xmm1, xmm0, 0x1b
call fcn.004c07a0
aeskeygenassist xmm1, xmm0, 0x36
call fcn.004c07a0
sub rbx, 0x10
movups xmm1, xmmword [rbx]
movups xmmword [rdx], xmm1
dec rcx
movups xmm1, xmmword [rbx - 0x10]
aesimc xmm0, xmm1
movups xmmword [rdx + 0x10], xmm0
sub rbx, 0x10
add rdx, 0x10
dec rcx
jne 0x4c0b4e
movups xmm0, xmmword [rbx - 0x10]
movups xmmword [rdx + 0x10], xmm0
pop rbp
ret