joyce8/EMBER2024-capa huggingface dataset:
Function at 0x494800
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4948dc
sub rsp, 0x40
mov qword [rsp + 0x38], rbp
lea rbp, [rsp + 0x38]
movabs rdx, 0x4e4b641d44742d47
mov qword [rsp + 0x1d], rdx
movabs rdx, 0x5929624e4b641d44
mov qword [rsp + 0x20], rdx
movabs rdx, 0xa040307090a0001
mov qword [rsp + 0x28], rdx
movabs rdx, 0x307000804060006
mov qword [rsp + 0x30], rdx
xor eax, eax
jmp 0x494875
movzx r9d, byte [rsp + rsi + 0x1d]
sub r9d, edx
lea edx, [r9 + 0x1f]
mov byte [rsp + rdi + 0x1d], dl
lea edx, [r8 + 0x1f]
mov byte [rsp + rsi + 0x1d], dl
add rax, 2
cmp rax, 0x10
jge 0x4948a8
movzx edx, byte [rsp + rax + 0x28]
movzx esi, byte [rsp + rax + 0x29]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0xb
jae 0x4948cf
movzx r8d, byte [rsp + rdi + 0x1d]
sub r8d, edx
nop word [rax + rax]
cmp rsi, 0xb
jb 0x494858
jmp 0x4948c3
xor eax, eax
lea rbx, [rsp + 0x1d]
mov ecx, 0xb
call fcn.00444360
mov rbp, qword [rsp + 0x38]
add rsp, 0x40
ret
mov eax, esi
mov ecx, 0xb
call fcn.00456a60
mov eax, edi
mov ecx, 0xb
call fcn.00456a60
nop
nop dword [rax]
call fcn.00454400
jmp fcn.00494800

Function at 0x494b60
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x494c92
sub rsp, 0x68
mov qword [rsp + 0x60], rbp
lea rbp, [rsp + 0x60]
movabs rdx, 0x2e94ff65ddcb5972
mov qword [rsp + 0x1b], rdx
movabs rdx, 0x6e2e94ff65ddcb59
mov qword [rsp + 0x1c], rdx
movabs rdx, 0xa7c6f672b0655a61
mov qword [rsp + 0x24], rdx
movabs rdx, 0x6fba0cb96d769e20
mov qword [rsp + 0x2c], rdx
movabs rdx, 0x7fba11e16f752099
mov qword [rsp + 0x34], rdx
movabs rdx, 0x1513020320030517
mov qword [rsp + 0x3c], rdx
movabs rdx, 0x120170215130203
mov qword [rsp + 0x40], rdx
movabs rdx, 0x1d1f1f1e160a0f0e
mov qword [rsp + 0x48], rdx
movabs rdx, 0x170a150c120f0c15
mov qword [rsp + 0x50], rdx
movabs rdx, 0x15171906101b1f05
mov qword [rsp + 0x58], rdx
xor eax, eax
jmp 0x494c2c
movzx r9d, byte [rsp + rsi + 0x1b]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x64]
mov byte [rsp + rdi + 0x1b], dl
mov byte [rsp + rsi + 0x1b], r8b
add rax, 2
cmp rax, 0x24
jge 0x494c5e
movzx edx, byte [rsp + rax + 0x3c]
movzx esi, byte [rsp + rax + 0x3d]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x21
jae 0x494c85
movzx r8d, byte [rsp + rdi + 0x1b]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x64]
cmp rsi, 0x21
jb 0x494c12
jmp 0x494c79
xor eax, eax
lea rbx, [rsp + 0x1b]
mov ecx, 0x21
call fcn.00444360
mov rbp, qword [rsp + 0x60]
add rsp, 0x68
ret
mov eax, esi
mov ecx, 0x21
call fcn.00456a60
mov eax, edi
mov ecx, 0x21
call fcn.00456a60
nop
call fcn.00454400
jmp fcn.00494b60
Function at 0x496080
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x49617c
sub rsp, 0x48
mov qword [rsp + 0x40], rbp
lea rbp, [rsp + 0x40]
movabs rdx, 0xa23a3c6fb7ea2f75
mov qword [rsp + 0x19], rdx
movabs rdx, 0x74a23a3c6fb7ea2f
mov qword [rsp + 0x1a], rdx
movabs rdx, 0xe0b53fe62be6293a
mov qword [rsp + 0x22], rdx
movabs rdx, 0x310030f0710060e
mov qword [rsp + 0x2a], rdx
movabs rdx, 0xc0b090503100310
mov qword [rsp + 0x30], rdx
movabs rdx, 0xa0d0201020f0d02
mov qword [rsp + 0x38], rdx
xor eax, eax
jmp 0x496110
movzx r9d, byte [rsp + rsi + 0x19]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x27]
mov byte [rsp + rdi + 0x19], dl
mov byte [rsp + rsi + 0x19], r8b
add rax, 2
cmp rax, 0x16
jge 0x496148
movzx edx, byte [rsp + rax + 0x2a]
movzx esi, byte [rsp + rax + 0x2b]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x11
jae 0x49616f
movzx r8d, byte [rsp + rdi + 0x19]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x27]
nop word [rax + rax]
cmp rsi, 0x11
jb 0x4960f6
jmp 0x496163
xor eax, eax
lea rbx, [rsp + 0x19]
mov ecx, 0x11
call fcn.00444360
mov rbp, qword [rsp + 0x40]
add rsp, 0x48
ret
mov eax, esi
mov ecx, 0x11
call fcn.00456a60
mov eax, edi
mov ecx, 0x11
call fcn.00456a60
nop
nop dword [rax]
call fcn.00454400
jmp fcn.00496080

Function at 0x4961a0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4962c8
sub rsp, 0x68
mov qword [rsp + 0x60], rbp
lea rbp, [rsp + 0x60]
movabs rdx, 0x3a748cd782667e72
mov qword [rsp + 0x1d], rdx
movabs rdx, 0x8a666fd36ea6ab20
mov qword [rsp + 0x25], rdx
movabs rdx, 0x2d768d2d6e8a758a
mov qword [rsp + 0x2c], rdx
movabs rdx, 0x83a33a31a2207961
mov qword [rsp + 0x34], rdx
movabs rdx, 0x1e031a091a041a0c
mov qword [rsp + 0x3c], rdx
movabs rdx, 0x1c0a041c1e031a09
mov qword [rsp + 0x40], rdx
movabs rdx, 0xc1605050903091d
mov qword [rsp + 0x48], rdx
movabs rdx, 0x1a1c011011141b0f
mov qword [rsp + 0x50], rdx
movabs rdx, 0x414151d1e041e03
mov qword [rsp + 0x58], rdx
xor eax, eax
jmp 0x496260
movzx r9d, byte [rsp + rsi + 0x1d]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x39]
mov byte [rsp + rdi + 0x1d], dl
mov byte [rsp + rsi + 0x1d], r8b
add rax, 2
nop dword [rax]
cmp rax, 0x24
jge 0x496292
movzx edx, byte [rsp + rax + 0x3c]
movzx esi, byte [rsp + rax + 0x3d]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x1f
jae 0x4962bb
movzx r8d, byte [rsp + rdi + 0x1d]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x39]
cmp rsi, 0x1f
jb 0x496243
jmp 0x4962af
xor eax, eax
lea rbx, [rsp + 0x1d]
mov ecx, 0x1f
nop
call fcn.00444360
mov rbp, qword [rsp + 0x60]
add rsp, 0x68
ret
mov eax, esi
mov ecx, 0x1f
call fcn.00456a60
mov eax, edi
mov ecx, 0x1f
call fcn.00456a60
nop
call fcn.00454400
jmp fcn.004961a0
Function at 0x497120
Capabilities:
Encrypt data using rc4 prga

Disassembly:
lea r12, [rsp - 0x10]
cmp r12, qword [r14 + 0x10]
jbe 0x4972b6
sub rsp, 0x90
mov qword [rsp + 0x88], rbp
lea rbp, [rsp + 0x88]
movabs rdx, 0x3a1fbf936c66c472
mov qword [rsp + 0x19], rdx
movabs rdx, 0x611db72874e52a00
mov qword [rsp + 0x21], rdx
movabs rdx, 0x2d7b0f0c06611db7
mov qword [rsp + 0x26], rdx
movabs rdx, 0xb876ed694cff2e90
mov qword [rsp + 0x2e], rdx
movabs rdx, 0x5ba065d3fcdf69b2
mov qword [rsp + 0x36], rdx
movabs rdx, 0x6ad724531d201770
mov qword [rsp + 0x3e], rdx
movabs rdx, 0x122a180805182923
mov qword [rsp + 0x46], rdx
movabs rdx, 0x1c1a122a18080518
mov qword [rsp + 0x48], rdx
movabs rdx, 0xe251f040d291d04
mov qword [rsp + 0x50], rdx
movabs rdx, 0xa2815291a0a2614
mov qword [rsp + 0x58], rdx
movabs rdx, 0x240d16241d0c1f0e
mov qword [rsp + 0x60], rdx
movabs rdx, 0x15041a1209061816
mov qword [rsp + 0x68], rdx
movabs rdx, 0x2721042001181f2c
mov qword [rsp + 0x70], rdx
movabs rdx, 0x1f101f26170c0c05
mov qword [rsp + 0x78], rdx
movabs rdx, 0x1a110d292b1c1c13
mov qword [rsp + 0x80], rdx
xor eax, eax
jmp 0x497248
movzx r9d, byte [rsp + rsi + 0x19]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x17]
mov byte [rsp + rdi + 0x19], dl
mov byte [rsp + rsi + 0x19], r8b
add rax, 2
cmp rax, 0x42
jge 0x49727c
movzx edx, byte [rsp + rax + 0x46]
movzx esi, byte [rsp + rax + 0x47]
mov edi, edx
xor edx, esi
add edx, eax
nop
cmp rdi, 0x2d
jae 0x4972a9
movzx r8d, byte [rsp + rdi + 0x19]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x17]
cmp rsi, 0x2d
jb 0x49722e
jmp 0x49729d
xor eax, eax
lea rbx, [rsp + 0x19]
mov ecx, 0x2d
call fcn.00444360
mov rbp, qword [rsp + 0x88]
add rsp, 0x90
ret
mov eax, esi
mov ecx, 0x2d
call fcn.00456a60
mov eax, edi
mov ecx, 0x2d
call fcn.00456a60
nop
call fcn.00454400
nop dword [rax + rax]
jmp fcn.00497120
Function at 0x498360
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x498428
sub rsp, 0x38
mov qword [rsp + 0x30], rbp
lea rbp, [rsp + 0x30]
movabs rdx, 0xc74c767384b5b76f
mov qword [rsp + 0x1d], rdx
mov byte [rsp + 0x25], 0x8e
movabs rdx, 0x1010707080802
mov qword [rsp + 0x26], rdx
mov word [rsp + 0x2e], 0x503
xor eax, eax
jmp 0x4983c3
movzx r9d, byte [rsp + rsi + 0x1d]
sub r9d, edx
lea edx, [r9 - 0x48]
mov byte [rsp + rdi + 0x1d], dl
lea edx, [r8 - 0x48]
mov byte [rsp + rsi + 0x1d], dl
add rax, 2
cmp rax, 0xa
jge 0x4983f0
movzx edx, byte [rsp + rax + 0x26]
movzx esi, byte [rsp + rax + 0x27]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 9
jae 0x49841b
movzx r8d, byte [rsp + rdi + 0x1d]
sub r8d, edx
cmp rsi, 9
jb 0x4983a6
jmp 0x49840f
xor eax, eax
lea rbx, [rsp + 0x1d]
mov ecx, 9
nop dword [rax]
call fcn.00444360
mov rbp, qword [rsp + 0x30]
add rsp, 0x38
ret
mov eax, esi
mov ecx, 9
call fcn.00456a60
mov eax, edi
mov ecx, 9
call fcn.00456a60
nop
call fcn.00454400
jmp fcn.00498360

Function at 0x4990a0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4991d2
sub rsp, 0x70
mov qword [rsp + 0x68], rbp
lea rbp, [rsp + 0x68]
movabs rdx, 0x2ed4aff0c9e4e14d
mov qword [rsp + 0x1a], rdx
movabs rdx, 0xb1c6d5c2aab7d5a3
mov qword [rsp + 0x22], rdx
movabs rdx, 0xe6562e8b553bfcc
mov qword [rsp + 0x2a], rdx
movabs rdx, 0xdd1e15aa0165f0d7
mov qword [rsp + 0x32], rdx
movabs rdx, 0x1091f100b1e1f0e
mov qword [rsp + 0x3a], rdx
movabs rdx, 0x208190c170a0211
mov qword [rsp + 0x42], rdx
movabs rdx, 0xf1212140d0b0208
mov qword [rsp + 0x48], rdx
movabs rdx, 0x9041b0f191c0c13
mov qword [rsp + 0x50], rdx
movabs rdx, 0xf0b1d11170d1f03
mov qword [rsp + 0x58], rdx
movabs rdx, 0x6180a110901050e
mov qword [rsp + 0x60], rdx
xor eax, eax
jmp 0x49916f
movzx r9d, byte [rsp + rsi + 0x1a]
sub r9d, edx
lea edx, [r9 - 0x1b]
mov byte [rsp + rdi + 0x1a], dl
lea edx, [r8 - 0x1b]
mov byte [rsp + rsi + 0x1a], dl
add rax, 2
cmp rax, 0x2e
jge 0x49919c
movzx edx, byte [rsp + rax + 0x3a]
movzx esi, byte [rsp + rax + 0x3b]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x20
jae 0x4991c5
movzx r8d, byte [rsp + rdi + 0x1a]
sub r8d, edx
cmp rsi, 0x20
jb 0x499152
jmp 0x4991b7
xor eax, eax
lea rbx, [rsp + 0x1a]
mov ecx, 0x20
call fcn.00444360
mov rbp, qword [rsp + 0x68]
add rsp, 0x70
ret
mov eax, esi
mov ecx, 0x20
nop
call fcn.00456a60
mov eax, edi
mov ecx, 0x20
call fcn.00456a60
nop
call fcn.00454400
jmp fcn.004990a0
Function at 0x49c940
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x49ca36
sub rsp, 0x50
mov qword [rsp + 0x48], rbp
lea rbp, [rsp + 0x48]
movabs rdx, 0x14156365011c0a72
mov qword [rsp + 0x1d], rdx
movabs rdx, 0xcc74e11415636501
mov qword [rsp + 0x20], rdx
movabs rdx, 0x2061b86b462e72eb
mov qword [rsp + 0x28], rdx
movabs rdx, 0xc010309100a080b
mov qword [rsp + 0x30], rdx
movabs rdx, 0xf070b020a12010a
mov qword [rsp + 0x38], rdx
movabs rdx, 0x710021003060703
mov qword [rsp + 0x40], rdx
xor eax, eax
jmp 0x49c9d3
movzx r9d, byte [rsp + rsi + 0x1d]
sub r9d, edx
lea edx, [r9 + 0x6e]
mov byte [rsp + rdi + 0x1d], dl
lea edx, [r8 + 0x6e]
mov byte [rsp + rsi + 0x1d], dl
add rax, 2
cmp rax, 0x18
jge 0x49ca02
movzx edx, byte [rsp + rax + 0x30]
movzx esi, byte [rsp + rax + 0x31]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x13
jae 0x49ca29
movzx r8d, byte [rsp + rdi + 0x1d]
sub r8d, edx
cmp rsi, 0x13
jb 0x49c9b6
nop
jmp 0x49ca1d
xor eax, eax
lea rbx, [rsp + 0x1d]
mov ecx, 0x13
call fcn.00444360
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
mov eax, esi
mov ecx, 0x13
call fcn.00456a60
mov eax, edi
mov ecx, 0x13
call fcn.00456a60
nop
call fcn.00454400
nop dword [rax + rax]
jmp fcn.0049c940

Function at 0x49ce00
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x49cf26
sub rsp, 0x68
mov qword [rsp + 0x60], rbp
lea rbp, [rsp + 0x60]
movabs rdx, 0x9d548b2065a68a73
mov qword [rsp + 0x1e], rdx
movabs rdx, 0xda6610ac8bf54995
mov qword [rsp + 0x26], rdx
movabs rdx, 0x72c86065da6610ac
mov qword [rsp + 0x2a], rdx
movabs rdx, 0xab6ca769fe2e8db4
mov qword [rsp + 0x32], rdx
movabs rdx, 0x170c171706131508
mov qword [rsp + 0x3a], rdx
movabs rdx, 0x14131b010705170c
mov qword [rsp + 0x40], rdx
movabs rdx, 0x5170a051101120c
mov qword [rsp + 0x48], rdx
movabs rdx, 0xf12130d090b0107
mov qword [rsp + 0x50], rdx
movabs rdx, 0x61713061202190c
mov qword [rsp + 0x58], rdx
xor eax, eax
jmp 0x49cec0
movzx r9d, byte [rsp + rsi + 0x1e]
sub r9d, edx
lea edx, [r9 - 2]
mov byte [rsp + rdi + 0x1e], dl
lea edx, [r8 - 2]
mov byte [rsp + rsi + 0x1e], dl
add rax, 2
cmp rax, 0x26
jge 0x49ceed
movzx edx, byte [rsp + rax + 0x3a]
movzx esi, byte [rsp + rax + 0x3b]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x1c
jae 0x49cf14
movzx r8d, byte [rsp + rdi + 0x1e]
sub r8d, edx
cmp rsi, 0x1c
jb 0x49cea3
jmp 0x49cf08
xor eax, eax
lea rbx, [rsp + 0x1e]
mov ecx, 0x1c
call fcn.00444360
mov rbp, qword [rsp + 0x60]
add rsp, 0x68
ret
mov eax, esi
mov ecx, 0x1c
call fcn.00456a60
mov eax, edi
mov ecx, 0x1c
nop dword [rax + rax]
call fcn.00456a60
nop
call fcn.00454400
jmp fcn.0049ce00
Function at 0x49d9c0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x49db06
sub rsp, 0x78
mov qword [rsp + 0x70], rbp
lea rbp, [rsp + 0x70]
movabs rdx, 0x2ee91b2f3d74e93a
mov qword [rsp + 0x1f], rdx
movabs rdx, 0xecb2d84cf82ee91b
mov qword [rsp + 0x24], rdx
movabs rdx, 0x20c1736505790ef4
mov qword [rsp + 0x2c], rdx
movabs rdx, 0x79c6986e6f48ab66
mov qword [rsp + 0x34], rdx
movabs rdx, 0x83833ade614c6574
mov qword [rsp + 0x3c], rdx
movabs rdx, 0x16240d21241a0302
mov qword [rsp + 0x44], rdx
movabs rdx, 0x2306100408010309
mov qword [rsp + 0x4c], rdx
movabs rdx, 0x510030223061004
mov qword [rsp + 0x50], rdx
movabs rdx, 0x131a1f24140a0b0e
mov qword [rsp + 0x58], rdx
movabs rdx, 0x1b0e211714061a05
mov qword [rsp + 0x60], rdx
movabs rdx, 0x23030c0e22001402
mov qword [rsp + 0x68], rdx
xor eax, eax
nop
jmp 0x49daa0
movzx r9d, byte [rsp + rsi + 0x1f]
sub r9d, edx
lea edx, [r9 - 0x80]
mov byte [rsp + rdi + 0x1f], dl
lea edx, [r8 - 0x80]
mov byte [rsp + rsi + 0x1f], dl
add rax, 2
nop
cmp rax, 0x2c
jge 0x49dacd
movzx edx, byte [rsp + rax + 0x44]
movzx esi, byte [rsp + rax + 0x45]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x25
jae 0x49daf4
movzx r8d, byte [rsp + rdi + 0x1f]
sub r8d, edx
cmp rsi, 0x25
jb 0x49da82
jmp 0x49dae8
xor eax, eax
lea rbx, [rsp + 0x1f]
mov ecx, 0x25
call fcn.00444360
mov rbp, qword [rsp + 0x70]
add rsp, 0x78
ret
mov eax, esi
mov ecx, 0x25
call fcn.00456a60
mov eax, edi
mov ecx, 0x25
nop dword [rax + rax]
call fcn.00456a60
nop
call fcn.00454400
jmp fcn.0049d9c0
Function at 0x49e420
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x49e528
sub rsp, 0x50
mov qword [rsp + 0x48], rbp
lea rbp, [rsp + 0x48]
movabs rdx, 0xb374ee40087e6504
mov qword [rsp + 0x19], rdx
movabs rdx, 0xffad56b374ee4008
mov qword [rsp + 0x1c], rdx
movabs rdx, 0x73abed88ef99b875
mov qword [rsp + 0x24], rdx
movabs rdx, 0x70c020e0d071010
mov qword [rsp + 0x2c], rdx
movabs rdx, 0xc0e0e0a000a0905
mov qword [rsp + 0x34], rdx
movabs rdx, 0xf0511050c0e0e0a
mov qword [rsp + 0x38], rdx
movabs rdx, 0x50e110305110405
mov qword [rsp + 0x40], rdx
xor eax, eax
jmp 0x49e4c2
movzx r9d, byte [rsp + rsi + 0x19]
sub r9d, edx
lea edx, [r9 - 0x79]
mov byte [rsp + rdi + 0x19], dl
lea edx, [r8 - 0x79]
mov byte [rsp + rsi + 0x19], dl
add rax, 2
cmp rax, 0x1c
jge 0x49e4ef
movzx edx, byte [rsp + rax + 0x2c]
movzx esi, byte [rsp + rax + 0x2d]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x13
jae 0x49e51b
movzx r8d, byte [rsp + rdi + 0x19]
sub r8d, edx
cmp rsi, 0x13
jb 0x49e4a5
jmp 0x49e50f
xor eax, eax
lea rbx, [rsp + 0x19]
mov ecx, 0x13
nop dword [rax + rax]
call fcn.00444360
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
mov eax, esi
mov ecx, 0x13
call fcn.00456a60
mov eax, edi
mov ecx, 0x13
call fcn.00456a60
nop
call fcn.00454400
jmp fcn.0049e420
Function at 0x49ef80
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x49f05c
sub rsp, 0x40
mov qword [rsp + 0x38], rbp
lea rbp, [rsp + 0x38]
movabs rdx, 0x7292829b648c65b1
mov qword [rsp + 0x1f], rdx
movabs rdx, 0xb7cc587292829b64
mov qword [rsp + 0x22], rdx
movabs rdx, 0x40909080a060904
mov qword [rsp + 0x2a], rdx
movabs rdx, 0x906050200020409
mov qword [rsp + 0x30], rdx
xor eax, eax
jmp 0x49eff5
movzx r9d, byte [rsp + rsi + 0x1f]
sub r9d, edx
lea edx, [r9 - 0x10]
mov byte [rsp + rdi + 0x1f], dl
lea edx, [r8 - 0x10]
mov byte [rsp + rsi + 0x1f], dl
add rax, 2
cmp rax, 0xe
jge 0x49f028
movzx edx, byte [rsp + rax + 0x2a]
movzx esi, byte [rsp + rax + 0x2b]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0xb
jae 0x49f04f
movzx r8d, byte [rsp + rdi + 0x1f]
sub r8d, edx
nop word [rax + rax]
cmp rsi, 0xb
jb 0x49efd8
jmp 0x49f043
xor eax, eax
lea rbx, [rsp + 0x1f]
mov ecx, 0xb
call fcn.00444360
mov rbp, qword [rsp + 0x38]
add rsp, 0x40
ret
mov eax, esi
mov ecx, 0xb
call fcn.00456a60
mov eax, edi
mov ecx, 0xb
call fcn.00456a60
nop
nop dword [rax]
call fcn.00454400
jmp fcn.0049ef80

Function at 0x4a1700
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4a1846
sub rsp, 0x78
mov qword [rsp + 0x70], rbp
lea rbp, [rsp + 0x70]
movabs rdx, 0xbd3ae26504dc6963
mov qword [rsp + 0x19], rdx
movabs rdx, 0x93a7a8e9f76eeabd
mov qword [rsp + 0x20], rdx
movabs rdx, 0xcddeedb6e6f0ec77
mov qword [rsp + 0x28], rdx
movabs rdx, 0xdb766663d02ba5fc
mov qword [rsp + 0x30], rdx
movabs rdx, 0x4dfea7cece1e6bf4
mov qword [rsp + 0x38], rdx
movabs rdx, 0x19200a151f05210a
mov qword [rsp + 0x40], rdx
movabs rdx, 0x191c2011110d1e16
mov qword [rsp + 0x48], rdx
movabs rdx, 0x250e020f14051b1a
mov qword [rsp + 0x50], rdx
movabs rdx, 0x72017080c1a0802
mov qword [rsp + 0x58], rdx
movabs rdx, 0x101918110b0b1217
mov qword [rsp + 0x60], rdx
movabs rdx, 0x1403252207132324
mov qword [rsp + 0x68], rdx
xor eax, eax
nop
jmp 0x4a17e0
movzx r9d, byte [rsp + rsi + 0x19]
sub r9d, edx
lea edx, [r9 - 0x58]
mov byte [rsp + rdi + 0x19], dl
lea edx, [r8 - 0x58]
mov byte [rsp + rsi + 0x19], dl
add rax, 2
nop
cmp rax, 0x30
jge 0x4a180d
movzx edx, byte [rsp + rax + 0x40]
movzx esi, byte [rsp + rax + 0x41]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x27
jae 0x4a1834
movzx r8d, byte [rsp + rdi + 0x19]
sub r8d, edx
cmp rsi, 0x27
jb 0x4a17c2
jmp 0x4a1828
xor eax, eax
lea rbx, [rsp + 0x19]
mov ecx, 0x27
call fcn.00444360
mov rbp, qword [rsp + 0x70]
add rsp, 0x78
ret
mov eax, esi
mov ecx, 0x27
call fcn.00456a60
mov eax, edi
mov ecx, 0x27
nop dword [rax + rax]
call fcn.00456a60
nop
call fcn.00454400
jmp fcn.004a1700
Function at 0x4a1860
Capabilities:
Encrypt data using rc4 prga

Disassembly:
lea r12, [rsp - 0x70]
cmp r12, qword [r14 + 0x10]
jbe 0x4a1986
sub rsp, 0xf0
mov qword [rsp + 0xe8], rbp
lea rbp, [rsp + 0xe8]
movabs rdx, 0x21267265f93d2931
mov qword [rsp + 0x18], rdx
lea rdi, [rsp + 0x1c]
lea rsi, str.er_98_rnonc
mov qword [rsp - 0x10], rbp
lea rbp, [rsp - 0x10]
call fcn.0045708c
mov rbp, qword [rbp]
movabs rdx, 0x5f2d390211402c4e
mov qword [rsp + 0x7c], rdx
movabs rdx, 0x22453d215412580b
mov qword [rsp + 0x84], rdx
lea rdi, [rsp + 0x88]
lea rsi, [0x005a2654]
mov qword [rsp - 0x10], rbp
lea rbp, [rsp - 0x10]
call fcn.0045708c
mov rbp, qword [rbp]
xor eax, eax
jmp 0x4a1918
movzx r9d, byte [rsp + rsi + 0x18]
sub r9d, edx
lea edx, [r9 + 0x6e]
mov byte [rsp + rdi + 0x18], dl
lea edx, [r8 + 0x6e]
mov byte [rsp + rsi + 0x18], dl
add rax, 2
cmp rax, 0x6c
jge 0x4a1948
movzx edx, byte [rsp + rax + 0x7c]
movzx esi, byte [rsp + rax + 0x7d]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x64
jae 0x4a1975
movzx r8d, byte [rsp + rdi + 0x18]
sub r8d, edx
nop dword [rax]
cmp rsi, 0x64
jb 0x4a18fb
jmp 0x4a1969
xor eax, eax
lea rbx, [rsp + 0x18]
mov ecx, 0x64
call fcn.00444360
mov rbp, qword [rsp + 0xe8]
add rsp, 0xf0
ret
mov eax, esi
mov ecx, 0x64
call fcn.00456a60
mov eax, edi
mov ecx, 0x64
nop dword [rax]
call fcn.00456a60
nop
call fcn.00454400
jmp fcn.004a1860
Function at 0x4a7d20
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4a7e52
sub rsp, 0x70
mov qword [rsp + 0x68], rbp
lea rbp, [rsp + 0x68]
movabs rdx, 0x95b7867491798fb0
mov qword [rsp + 0x1a], rdx
movabs rdx, 0xa7706e7a3cdbc0b0
mov qword [rsp + 0x22], rdx
movabs rdx, 0x75a0367451c82074
mov qword [rsp + 0x2a], rdx
movabs rdx, 0x6b4b722c7ec573af
mov qword [rsp + 0x32], rdx
movabs rdx, 0x1500150a120a0807
mov qword [rsp + 0x3a], rdx
movabs rdx, 0x909120f160f0518
mov qword [rsp + 0x42], rdx
movabs rdx, 0x1d071a0b05060909
mov qword [rsp + 0x48], rdx
movabs rdx, 0x131516160b0f0c1e
mov qword [rsp + 0x50], rdx
movabs rdx, 0xc0b0f1b09050301
mov qword [rsp + 0x58], rdx
movabs rdx, 0x191b0905061c150a
mov qword [rsp + 0x60], rdx
xor eax, eax
jmp 0x4a7dec
movzx r9d, byte [rsp + rsi + 0x1a]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x3f]
mov byte [rsp + rdi + 0x1a], dl
mov byte [rsp + rsi + 0x1a], r8b
add rax, 2
cmp rax, 0x2e
jge 0x4a7e1e
movzx edx, byte [rsp + rax + 0x3a]
movzx esi, byte [rsp + rax + 0x3b]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x20
jae 0x4a7e45
movzx r8d, byte [rsp + rdi + 0x1a]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x3f]
cmp rsi, 0x20
jb 0x4a7dd2
jmp 0x4a7e39
xor eax, eax
lea rbx, [rsp + 0x1a]
mov ecx, 0x20
call fcn.00444360
mov rbp, qword [rsp + 0x68]
add rsp, 0x70
ret
mov eax, esi
mov ecx, 0x20
call fcn.00456a60
mov eax, edi
mov ecx, 0x20
call fcn.00456a60
nop
call fcn.00454400
jmp fcn.004a7d20
Function at 0x4a8460
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4a85a8
sub rsp, 0x78
mov qword [rsp + 0x70], rbp
lea rbp, [rsp + 0x70]
movabs rdx, 0xa44a6f9bbf31376f
mov qword [rsp + 0x1f], rdx
movabs rdx, 0xe6a44a6f9bbf3137
mov qword [rsp + 0x20], rdx
movabs rdx, 0x7586d96fa720759a
mov qword [rsp + 0x28], rdx
movabs rdx, 0x63ad20824573767a
mov qword [rsp + 0x30], rdx
movabs rdx, 0x57cb2b42ed8b7574
mov qword [rsp + 0x38], rdx
movabs rdx, 0xf0708090f171c1f
mov qword [rsp + 0x40], rdx
movabs rdx, 0x1b1f09040e090304
mov qword [rsp + 0x48], rdx
movabs rdx, 0x140a1e200c04021b
mov qword [rsp + 0x50], rdx
movabs rdx, 0x60a1c0d15020f19
mov qword [rsp + 0x58], rdx
movabs rdx, 0x201d0d0e12040104
mov qword [rsp + 0x60], rdx
movabs rdx, 0x111118131a0f19
mov qword [rsp + 0x68], rdx
xor eax, eax
nop
jmp 0x4a8540
movzx r9d, byte [rsp + rsi + 0x1f]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x3a]
mov byte [rsp + rdi + 0x1f], dl
mov byte [rsp + rsi + 0x1f], r8b
add rax, 2
nop dword [rax]
cmp rax, 0x30
jge 0x4a8572
movzx edx, byte [rsp + rax + 0x40]
movzx esi, byte [rsp + rax + 0x41]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x21
jae 0x4a859b
movzx r8d, byte [rsp + rdi + 0x1f]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x3a]
cmp rsi, 0x21
jb 0x4a8522
jmp 0x4a858f
xor eax, eax
lea rbx, [rsp + 0x1f]
mov ecx, 0x21
nop
call fcn.00444360
mov rbp, qword [rsp + 0x70]
add rsp, 0x78
ret
mov eax, esi
mov ecx, 0x21
call fcn.00456a60
mov eax, edi
mov ecx, 0x21
call fcn.00456a60
nop
call fcn.00454400
jmp fcn.004a8460

Function at 0x4a8f40
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
mov rcx, qword [rsp + 8]
mov rax, qword [rsp + 0x10]
mov rdx, qword [rsp + 0x18]
mov rbx, qword [rsp + 0x20]
movups xmm1, xmmword [rax]
movups xmm0, xmmword [rbx]
add rax, 0x10
pxor xmm0, xmm1
sub rcx, 0xc
je 0x4a8f7f
jb 0x4a8f94
movups xmm1, xmmword [rax]
aesenc xmm0, xmm1
movups xmm1, xmmword [rax + 0x10]
aesenc xmm0, xmm1
add rax, 0x20
movups xmm1, xmmword [rax]
aesenc xmm0, xmm1
movups xmm1, xmmword [rax + 0x10]
aesenc xmm0, xmm1
add rax, 0x20
movups xmm1, xmmword [rax]
aesenc xmm0, xmm1
movups xmm1, xmmword [rax + 0x10]
aesenc xmm0, xmm1
movups xmm1, xmmword [rax + 0x20]
aesenc xmm0, xmm1
movups xmm1, xmmword [rax + 0x30]
aesenc xmm0, xmm1
movups xmm1, xmmword [rax + 0x40]
aesenc xmm0, xmm1
movups xmm1, xmmword [rax + 0x50]
aesenc xmm0, xmm1
movups xmm1, xmmword [rax + 0x60]
aesenc xmm0, xmm1
movups xmm1, xmmword [rax + 0x70]
aesenc xmm0, xmm1
movups xmm1, xmmword [rax + 0x80]
aesenc xmm0, xmm1
movups xmm1, xmmword [rax + 0x90]
aesenclast xmm0, xmm1
movups xmmword [rdx], xmm0
ret