joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140115690
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rdi
push r14
sub rsp, 0x20
mov eax, dword [rcx + 0x18]
mov rbx, rcx
mov ebp, r8d
mov r14, rdx
lea ecx, [rax + rax]
mov eax, dword [rbx + 0x20]
add rax, 0x18
add rcx, rax
call qword [sub.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov rdi, rax
test rax, rax
jne 0x1401156d2
mov rbx, qword [rsp + 0x50]
add rsp, 0x20
pop r14
pop rdi
pop rbp
ret
lea rcx, [rax + 0x18]
mov qword [rax], rbx
mov qword [rax + 8], rcx
mov eax, dword [rbx + 0x18]
add rax, rcx
mov qword [rsp + 0x48], rsi
mov qword [rdi + 0x10], rax
cmp ebp, dword [rbx + 0x1c]
jbe 0x140115719
call qword [rbx]
mov rcx, qword [rdi + 8]
mov r8d, ebp
mov rdx, r14
call qword [rbx + reloc.WS2_32.dll_htonl]
mov r14d, dword [rbx + 0x18]
add r14, qword [rdi + 0x10]
mov rdx, qword [rdi + 8]
mov rcx, r14
call qword [rbx + reloc.WS2_32.dll_recv]
mov rcx, qword [rdi + 8]
mov ebp, dword [rbx + 0x20]
call qword [rbx]
mov rcx, qword [rdi + 0x10]
call qword [rbx]
xor esi, esi
test rbp, rbp
je 0x140115772
mov rsi, rbp
nop dword [rax + rax]
movzx eax, byte [r14]
lea rdx, [rsp + 0x40]
xor al, 0x36
mov r8d, 1
mov byte [rsp + 0x40], al
mov rcx, qword [rdi + 8]
call qword [rbx + reloc.WS2_32.dll_htonl]
movzx eax, byte [r14]
lea rdx, [rsp + 0x40]
xor al, 0x5c
lea r14, [r14 + 1]
mov byte [rsp + 0x40], al
mov r8d, 1
mov rcx, qword [rdi + 0x10]
call qword [rbx + reloc.WS2_32.dll_htonl]
sub rbp, 1
jne 0x140115730
mov eax, dword [rbx + 0x1c]
cmp rsi, rax
jae 0x1401157b3
nop word [rax + rax]
mov rcx, qword [rdi + 8]
lea rdx, [0x1401435a2]
mov r8d, 1
call qword [rbx + reloc.WS2_32.dll_htonl]
mov rcx, qword [rdi + 0x10]
lea rdx, [0x1401435a3]
mov r8d, 1
call qword [rbx + reloc.WS2_32.dll_htonl]
mov eax, dword [rbx + 0x1c]
inc rsi
cmp rsi, rax
jb 0x140115780
mov rsi, qword [rsp + 0x48]
mov rax, rdi
mov rbx, qword [rsp + 0x50]
add rsp, 0x20
pop r14
pop rdi
pop rbp
ret

Function at 0x140116838
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140116882
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140116882
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140116882
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140116882
cmp dword [rcx + 0x84], 0xe
jbe 0x140116882
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140116884
xor al, al
add rsp, 0x28
ret
Function at 0x417aa0
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x417c30
push rbp
mov rbp, rsp
sub rsp, 0x48
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rbx
mov rcx, qword [sym.imp.kernel32.dll_VirtualFree]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x4000
call fcn.00437600
xorps xmm15, xmm15
mov r14, qword [0x0060a418]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x20], 0
jne 0x417b05
mov rax, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x60]
jmp 0x417b20
add rsp, 0x48
pop rbp
ret
call fcn.004514e0
mov rbx, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x38]
sub rbx, rcx
nop dword [rax]
test rbx, rbx
jbe 0x417b3f
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x40], rax
mov rcx, rbx
jmp 0x417b4f
cmp rbx, 0x1000
jae 0x417b0b
jmp 0x417bba
add rsp, 0x48
pop rbp
ret
shr rbx, 1
and rbx, 0xfffffffffffff000
mov qword [rsp + 0x38], rbx
cmp rbx, 0x1000
jae 0x417b62
xor edx, edx
nop
jmp 0x417bb1
mov rcx, qword [sym.imp.kernel32.dll_VirtualFree]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x4000
call fcn.00437600
xorps xmm15, xmm15
mov r14, qword [0x0060a418]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x20], 0
sete al
mov rcx, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x38]
mov edx, eax
mov rax, qword [rsp + 0x40]
test dl, dl
jne 0x417b45
jmp 0x417b34
call fcn.004673e0
xorps xmm15, xmm15
mov r14, qword [0x0060a418]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov eax, dword [rsp]
mov qword [rsp + 0x30], rax
call fcn.0043b580
lea rax, [0x004fbb68]
mov ebx, 0x18
call fcn.0043bdc0
mov rax, qword [rsp + 0x38]
call fcn.0043bb20
lea rax, [0x004fc2a7]
mov ebx, 0x19
call fcn.0043bdc0
mov rax, qword [rsp + 0x30]
call fcn.0043bb20
call fcn.0043b7a0
call fcn.0043b5e0
lea rax, [0x004fed31]
mov ebx, 0x21
call fcn.00439d40
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.00463e80
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.00417aa0
Function at 0x417c60
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x417e8a
push rbp
mov rbp, rsp
sub rsp, 0x50
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], rbx
mov rcx, qword [sym.imp.kernel32.dll_VirtualAlloc]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x1000
mov qword [rsp + 0x20], 4
call fcn.004376a0
xorps xmm15, xmm15
mov r14, qword [0x0060a418]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x60]
mov rcx, rax
cmp qword [rsp + 0x28], rax
je 0x417cd3
mov rbx, qword [rsp + 0x68]
mov rax, rbx
jmp 0x417cfa
add rsp, 0x50
pop rbp
ret
mov rax, rcx
nop dword [rax]
call fcn.004514e0
mov rbx, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x38]
sub rbx, rcx
mov rcx, rax
mov rax, qword [rsp + 0x68]
test rbx, rbx
jbe 0x417d1c
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x48], rcx
mov rdx, rbx
jmp 0x417d2c
cmp rbx, 0x1000
jae 0x417cd9
jmp 0x417dae
add rsp, 0x50
pop rbp
ret
shr rbx, 1
and rbx, 0xfffffffffffff000
mov qword [rsp + 0x38], rbx
cmp rbx, 0x1000
jae 0x417d3e
xor esi, esi
jmp 0x417da0
mov rax, qword [sym.imp.kernel32.dll_VirtualAlloc]
mov qword [rsp], rax
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x1000
mov qword [rsp + 0x20], 4
call fcn.004376a0
xorps xmm15, xmm15
mov r14, qword [0x0060a418]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x28], 0
sete al
mov rcx, qword [rsp + 0x48]
mov rdx, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x38]
mov esi, eax
mov rax, qword [rsp + 0x68]
nop dword [rax + rax]
test sil, sil
jne 0x417d22
jmp 0x417d0e
call fcn.004673e0
xorps xmm15, xmm15
mov r14, qword [0x0060a418]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov eax, dword [rsp]
mov dword [rsp + 0x34], eax
cmp eax, 8
jne 0x417e29
call fcn.0043b580
lea rax, [0x004fc2c0]
mov ebx, 0x19
call fcn.0043bdc0
mov rax, qword [rsp + 0x68]
call fcn.0043bb20
lea rax, [0x004fc2a7]
mov ebx, 0x19
nop dword [rax]
call fcn.0043bdc0
mov eax, dword [rsp + 0x34]
call fcn.0043bb20
call fcn.0043b7a0
call fcn.0043b5e0
lea rax, [0x004f72ec]
mov ebx, 0xd
call fcn.00439d40
cmp eax, 0x5af
je 0x417dd1
call fcn.0043b580
lea rax, [0x004fc2c0]
mov ebx, 0x19
call fcn.0043bdc0
mov rax, qword [rsp + 0x38]
call fcn.0043bb20
lea rax, [0x004fc2a7]
mov ebx, 0x19
nop dword [rax]
call fcn.0043bdc0
mov eax, dword [rsp + 0x34]
call fcn.0043bb20
call fcn.0043b7a0
call fcn.0043b5e0
lea rax, [0x004fe56b]
mov ebx, 0x1f
call fcn.00439d40
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.00463e80
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.00417c60
Function at 0x4242a0
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4243a6
push rbp
mov rbp, rsp
sub rsp, 0x50
mov qword [rsp + 0x70], rcx
mov byte [rsp + 0x17], dil
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], rbx
mov qword [rsp + 0x18], 0
jmp 0x4242e3
mov rax, qword [rsp + 0x60]
mov rcx, rdx
mov rbx, qword [rsp + 0x68]
movzx edi, byte [rsp + 0x17]
cmp qword [rsp + 0x18], rbx
jae 0x42439b
test byte [rax], al
lea rcx, [rax + 0x100b8]
mov ebx, edi
mov rax, rcx
nop dword [rax]
call fcn.00425020
test rax, rax
je 0x42439b
movups xmmword [rsp + 0x20], xmm15
movups xmmword [rsp + 0x30], xmm15
movups xmmword [rsp + 0x40], xmm15
lea rcx, [0x004243e0]
mov qword [rsp + 0x20], rcx
lea rdx, [rsp + 0x18]
mov qword [rsp + 0x28], rdx
mov rdx, qword [rsp + 0x60]
mov qword [rsp + 0x30], rdx
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x40], rbx
mov rax, qword [rsp + 0x68]
mov qword [rsp + 0x48], rax
lea rbx, [rsp + 0x20]
mov qword [rsp], rbx
nop dword [rax]
call fcn.00463d40
xorps xmm15, xmm15
mov r14, qword [0x0060a418]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rdx, qword [rsp + 0x70]
nop dword [rax]
test rdx, rdx
jne 0x424389
xor eax, eax
jmp 0x424393
mov rax, qword [rdx]
call rax
mov rdx, qword [rsp + 0x70]
test al, al
je 0x4242d1
mov rax, qword [rsp + 0x18]
add rsp, 0x50
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov byte [rsp + 0x20], dil
call fcn.00463e80
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
movzx edi, byte [rsp + 0x20]
jmp fcn.004242a0

Function at 0x45b720
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x45b7cf
push rbp
mov rbp, rsp
sub rsp, 0x58
mov qword [rsp + 0x70], rbx
lea rdx, [rsp + 0x68]
mov qword [rsp + 8], 0
movups xmmword [rsp + 0x10], xmm15
movups xmmword [rsp + 0x18], xmm15
movups xmmword [rsp + 0x28], xmm15
movups xmmword [rsp + 0x38], xmm15
movups xmmword [rsp + 0x48], xmm15
lea rsi, [0x0045b820]
mov qword [rsp + 0x10], rsi
mov rsi, qword [rsp + 0x60]
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdx
mov rdx, r14
mov qword [rsp + 0x28], rdx
lea rdx, [rsp + 8]
mov qword [rsp + 0x30], rdx
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x48], rcx
mov qword [rsp + 0x50], rdi
lea rax, [rsp + 0x10]
mov qword [rsp], rax
call fcn.00463d40
xorps xmm15, xmm15
mov r14, qword [0x0060a418]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 8]
add rsp, 0x58
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
call fcn.00463e80
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
nop dword [rax]
jmp fcn.0045b720
Function at 0x465c60
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x403ec3
push rbp
mov rbp, rsp
sub rsp, 0x18
mov rdx, qword [rax]
mov rcx, qword [rax + 8]
mov rax, rdx
call fcn.00409680
add rsp, 0x18
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.00463e80
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp 0x403ea0
cmp byte [0x0060a1d0], 0
je 0x465c75
mov rcx, qword [rax + 8]
mov rax, qword [rax]
jmp 0x462ec0
jmp 0x403ea0

Function at 0x465c80
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x409ade
push rbp
mov rbp, rsp
sub rsp, 0x10
mov qword [rsp + 0x28], rbx
call fcn.00409ba0
mov rbx, qword [rsp + 0x28]
xor rbx, rax
xor rbx, qword [0x0060a4e0]
movabs rcx, 0xe7037ed1a0b428db
xor rax, rcx
movabs rcx, 0xa0761d6478bd642f
xor rbx, rcx
call fcn.00409b80
mov rbx, rax
movabs rax, 0x1d8e4e27c47d124b
call fcn.00409b80
add rsp, 0x10
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.00463e80
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp 0x409a80
cmp byte [0x0060a1d0], 0
je 0x465cb5
movq xmm0, rbx
pinsrd xmm0, dword [rax], 2
aesenc xmm0, xmmword [0x0060a7e0]
aesenc xmm0, xmmword [0x0060a7f0]
aesenc xmm0, xmmword [0x0060a800]
movq rax, xmm0
ret
jmp 0x409a80

Function at 0x465cc0
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x409b5e
push rbp
mov rbp, rsp
sub rsp, 0x10
mov qword [rsp + 0x28], rbx
call fcn.00409be0
mov rbx, qword [rsp + 0x28]
xor rbx, rax
xor rbx, qword [0x0060a4e0]
movabs rcx, 0xe7037ed1a0b428db
xor rax, rcx
movabs rcx, 0xa0761d6478bd642f
xor rbx, rcx
call fcn.00409b80
mov rbx, rax
movabs rax, 0x1d8e4e27c47d1247
call fcn.00409b80
add rsp, 0x10
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.00463e80
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp 0x409b00
cmp byte [0x0060a1d0], 0
je 0x465cf6
movq xmm0, rbx
pinsrq xmm0, qword [rax], 1
aesenc xmm0, xmmword [0x0060a7e0]
aesenc xmm0, xmmword [0x0060a7f0]
aesenc xmm0, xmmword [0x0060a800]
movq rax, xmm0
ret
jmp 0x409b00

Function at 0x467860
Capabilities:
Allocate thread local storage

Disassembly:
push rbp
mov rbp, rsp
mov rax, rsp
and rsp, 0xfffffffffffffff0
sub rsp, 0x30
mov qword [rsp + 0x20], rax
mov rax, qword [sym.imp.kernel32.dll_TlsAlloc]
call rax
mov rsp, qword [rsp + 0x20]
mov rcx, rax
cmp rcx, 0x40
jb 0x467894
mov rcx, 0x28
jmp 0x46789f
shl rcx, 3
add rcx, 0x1480
mov qword [0x0060a418], rcx
pop rbp
ret
Function at 0x47dde0
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x47deaa
push rbp
mov rbp, rsp
sub rsp, 0x48
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x58], rax
mov qword [rsp], rax
mov qword [rsp + 8], rbx
mov byte [rsp + 0x10], 0
call fcn.00403dc0
xorps xmm15, xmm15
mov r14, qword [0x0060a418]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x18], 0xffffffffffffffff
jne 0x47de8f
mov rcx, qword [rsp + 0x60]
lea rdx, [rcx + 1]
mov qword [rsp + 0x40], rdx
lea rax, [0x004d9a00]
xor ebx, ebx
mov rcx, rdx
call fcn.0044c580
mov rbx, qword [rsp + 0x60]
mov rcx, rax
xor edi, edi
mov rsi, qword [rsp + 0x40]
mov rax, qword [rsp + 0x58]
nop dword [rax]
call fcn.0047e9e0
inc rbx
cmp rcx, rbx
jae 0x47de7e
mov edi, 1
lea rsi, [0x004d9a00]
call fcn.0044c640
mov word [rax + rbx*2 - 2], 0
xor edi, edi
xor esi, esi
add rsp, 0x48
pop rbp
ret
xor eax, eax
xor ebx, ebx
mov rcx, rbx
lea rdi, [0x0051f280]
lea rsi, [0x0051e8e8]
add rsp, 0x48
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.00463e80
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.0047dde0
Function at 0x4917e0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x491a0f
push rbp
mov rbp, rsp
sub rsp, 0x60
mov qword [rsp + 0x70], rax
xor ecx, ecx
xor edx, edx
xor esi, esi
xor edi, edi
xor r8d, r8d
jmp 0x491820
dec rbx
mov r10, rbx
neg r10
sar r10, 0x3f
and r10d, 1
add rax, r10
mov rcx, r9
nop dword [rax + rax]
test rbx, rbx
je 0x4919f0
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x58], rax
mov byte [rsp + 0x46], r8b
movzx r9d, byte [rax]
mov byte [rsp + 0x47], r9b
cmp r9b, 0x20
jbe 0x491953
cmp r9b, 0x22
je 0x491862
cmp r9b, 0x5c
jne 0x491965
lea r9, [rcx + 1]
nop
jmp 0x491804
mov qword [rsp + 0x48], rcx
mov r8, rcx
shr rcx, 0x3f
lea r9, [rcx + r8]
sar r9, 1
mov rax, rdi
mov rbx, rdx
mov rcx, rsi
mov rdi, r9
call fcn.00491740
mov rdx, qword [rsp + 0x48]
bt edx, 0
jb 0x49190a
movzx edx, byte [rsp + 0x46]
test dl, dl
je 0x4918fb
mov r8, qword [rsp + 0x50]
nop
cmp r8, 1
jle 0x4918f1
mov r9, qword [rsp + 0x58]
cmp byte [r9 + 1], 0x22
jne 0x4918e9
inc rbx
cmp rcx, rbx
jae 0x4918da
mov edi, 1
lea rsi, [0x004d98c0]
call fcn.0044c640
movzx edx, byte [rsp + 0x46]
mov r8, qword [rsp + 0x50]
mov r9, qword [rsp + 0x58]
mov byte [rbx + rax - 1], 0x22
lea rsi, [r8 - 1]
lea r8, [r9 + 1]
jmp 0x491905
mov rsi, r8
mov r8, r9
jmp 0x491905
mov rsi, r8
mov r8, qword [rsp + 0x58]
jmp 0x491905
mov rsi, qword [rsp + 0x50]
mov r8, qword [rsp + 0x58]
xor edx, 1
jmp 0x491939
inc rbx
cmp rcx, rbx
jae 0x491925
mov edi, 1
lea rsi, [0x004d98c0]
nop
call fcn.0044c640
mov byte [rbx + rax - 1], 0x22
mov rsi, qword [rsp + 0x50]
mov r8, qword [rsp + 0x58]
movzx edx, byte [rsp + 0x46]
xor r9d, r9d
mov rdi, rax
mov rax, r8
mov r8d, edx
mov rdx, rbx
mov rbx, rsi
mov rsi, rcx
jmp 0x491804
cmp r9b, 9
je 0x491960
cmp r9b, 0x20
jne 0x491965
nop
test r8b, r8b
je 0x4919bb
mov rax, rdi
mov rbx, rdx
mov rdi, rcx
mov rcx, rsi
call fcn.00491740
inc rbx
cmp rcx, rbx
jae 0x49198f
mov edi, 1
lea rsi, [0x004d98c0]
call fcn.0044c640
movzx r10d, byte [rsp + 0x47]
mov byte [rbx + rax - 1], r10b
mov rsi, rcx
mov rdx, rbx
xor r9d, r9d
mov rdi, rax
movzx r8d, byte [rsp + 0x46]
mov rbx, qword [rsp + 0x50]
mov rax, qword [rsp + 0x58]
jmp 0x491804
mov rax, rdi
mov rbx, rdx
mov rdi, rcx
mov rcx, rsi
call fcn.00491740
mov rsi, qword [rsp + 0x50]
dec rsi
mov rdx, rsi
neg rdx
sar rdx, 0x3f
and edx, 1
mov r8, qword [rsp + 0x58]
lea rdi, [rdx + r8]
add rsp, 0x60
pop rbp
ret
mov rax, rdi
mov rbx, rdx
mov rdi, rcx
mov rcx, rsi
nop dword [rax]
call fcn.00491740
xor edi, edi
xor esi, esi
add rsp, 0x60
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.00463e80
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.004917e0
Function at 0x492b20
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x492cac
push rbp
mov rbp, rsp
sub rsp, 0x10
mov qword [rsp + 0x20], rax
nop word [rax + rax]
cmp rbx, 2
jl 0x492bf3
movzx ecx, byte [rax]
cmp byte [rax + 1], 0x3a
jne 0x492b78
lea edx, [rcx - 0x30]
cmp dl, 9
jbe 0x492b6d
lea edx, [rcx - 0x61]
nop
cmp dl, 0x19
jbe 0x492b6d
lea edx, [rcx - 0x41]
cmp dl, 0x19
ja 0x492b78
mov ebx, 2
add rsp, 0x10
pop rbp
ret
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], rax
cmp rbx, 5
jge 0x492b8c
xor ecx, ecx
jmp 0x492ba0
mov eax, ecx
call fcn.00492a80
mov rbx, qword [rsp + 0x28]
mov ecx, eax
mov rax, qword [rsp + 0x20]
nop
test cl, cl
jne 0x492ba8
xor ecx, ecx
jmp 0x492be2
movzx ecx, byte [rax + 1]
mov eax, ecx
call fcn.00492a80
test al, al
jne 0x492bc5
mov rax, qword [rsp + 0x20]
mov rbx, qword [rsp + 0x28]
xor ecx, ecx
jmp 0x492be2
mov rcx, qword [rsp + 0x20]
movzx eax, byte [rcx + 2]
call fcn.00492a80
xor eax, 1
mov rbx, qword [rsp + 0x28]
mov ecx, eax
mov rax, qword [rsp + 0x20]
test cl, cl
je 0x492bfd
cmp byte [rax + 2], 0x2e
je 0x492bfd
mov ecx, 3
jmp 0x492c19
xor eax, eax
xor ebx, ebx
add rsp, 0x10
pop rbp
ret
xor eax, eax
xor ebx, ebx
add rsp, 0x10
pop rbp
ret
mov rcx, qword [rsp + 8]
inc rcx
mov rax, qword [rsp + 0x20]
mov rbx, qword [rsp + 0x28]
lea rdx, [rbx - 1]
nop dword [rax]
cmp rcx, rdx
jge 0x492bfd
mov qword [rsp + 8], rcx
movzx edx, byte [rcx + rax]
mov eax, edx
call fcn.00492a80
test al, al
je 0x492c07
mov rcx, qword [rsp + 0x20]
mov rdx, qword [rsp + 8]
movzx eax, byte [rdx + rcx + 1]
call fcn.00492a80
test al, al
jne 0x492bfd
mov rax, qword [rsp + 0x20]
mov rcx, qword [rsp + 8]
movzx edx, byte [rcx + rax + 1]
cmp dl, 0x2e
je 0x492bfd
inc rcx
jmp 0x492c77
mov rcx, qword [rsp + 8]
inc rcx
mov rax, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x28]
nop dword [rax]
cmp rdx, rcx
jle 0x492ca3
mov qword [rsp + 8], rcx
movzx edx, byte [rcx + rax]
mov eax, edx
call fcn.00492a80
test al, al
je 0x492c6a
mov rax, qword [rsp + 0x20]
mov rcx, qword [rsp + 8]
mov rbx, rcx
add rsp, 0x10
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.00463e80
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.00492b20

Function at 0x49bde0
Capabilities:
Hash data using fnv

Disassembly:
movzx ecx, bl
xor rax, rcx
movabs rcx, 0x100000001b3
imul rax, rcx
ret

Function at 0x49be00
Capabilities:
Hash data using fnv

Disassembly:
mov qword [rsp + 0x10], rbx
xor edx, edx
jmp 0x49be21
movzx esi, byte [rbx + rdx]
xor rax, rsi
inc rdx
movabs rsi, 0x100000001b3
imul rax, rsi
cmp rcx, rdx
jg 0x49be09
ret

Function at 0x49be40
Capabilities:
Hash data using fnv

Disassembly:
xor ecx, ecx
jmp 0x49be60
movzx edx, bl
xor rax, rdx
inc rcx
shr rbx, 8
movabs rdx, 0x100000001b3
imul rax, rdx
nop
cmp rcx, 8
jl 0x49be44
ret

Function at 0x49be80
Capabilities:
Hash data using fnv

Disassembly:
xor ecx, ecx
jmp 0x49bea0
movzx edx, bl
xor rax, rdx
inc rcx
shr ebx, 8
movabs rdx, 0x100000001b3
imul rax, rdx
nop
cmp rcx, 4
jl 0x49be84
ret
Function at 0x49fea0
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4a00a4
push rbp
mov rbp, rsp
sub rsp, 0x70
mov qword [rsp + 0x80], rax
mov qword [rsp + 0x98], rdi
mov qword [rsp + 0xb0], r9
cmp rsi, r10
jl 0x4a007e
test rsi, rsi
je 0x4a0076
nop dword [rax]
test r10, r10
je 0x4a006b
mov qword [rsp + 0xc0], r11
mov qword [rsp + 0xb8], r10
mov qword [rsp + 0xb0], r9
mov qword [rsp + 0xa0], rsi
mov qword [rsp + 0x60], rdi
mov qword [rsp + 0xa8], r8
lea rdi, [rsi + 1]
call fcn.0049fc40
mov qword [rsp + 0x68], rax
mov qword [rsp + 0x58], rcx
mov qword [rsp + 0x50], rbx
mov qword [rsp], rax
mov rdx, qword [rsp + 0xb8]
mov qword [rsp + 8], rdx
mov qword [rsp + 0x10], rcx
mov rsi, qword [rsp + 0x60]
mov qword [rsp + 0x18], rsi
mov r8, qword [rsp + 0xa0]
mov qword [rsp + 0x20], r8
mov r9, qword [rsp + 0xa8]
mov qword [rsp + 0x28], r9
mov r10, qword [rsp + 0xb0]
mov qword [rsp + 0x30], r10
mov qword [rsp + 0x38], rdx
mov r10, qword [rsp + 0xc0]
mov qword [rsp + 0x40], r10
call fcn.004a8ac0
xorps xmm15, xmm15
mov r14, qword [0x0060a418]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rdx, qword [rsp + 0x48]
mov rsi, qword [rsp + 0xa0]
mov r8, qword [rsp + 0xb8]
cmp rsi, r8
jle 0x4a0049
sub rsi, r8
mov rcx, qword [rsp + 0x58]
sub rcx, r8
mov rdi, r8
shl r8, 3
mov r9, rcx
neg rcx
sar rcx, 0x3f
and rcx, r8
mov r10, qword [rsp + 0x68]
add rcx, r10
mov qword [rsp], rcx
mov qword [rsp + 8], rsi
mov qword [rsp + 0x10], r9
mov rcx, qword [rsp + 0xa8]
sub rcx, rdi
mov rdi, rcx
neg rcx
sar rcx, 0x3f
and rcx, r8
mov r8, qword [rsp + 0x60]
add rcx, r8
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rsi
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x30], rdx
call fcn.004a8c00
xorps xmm15, xmm15
mov r14, qword [0x0060a418]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rdx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0xa0]
mov rax, qword [rsp + 0x68]
mov qword [rax + rsi*8], rdx
mov rbx, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x58]
nop dword [rax]
call fcn.0049fc20
add rsp, 0x70
pop rbp
ret
call fcn.0049fde0
add rsp, 0x70
pop rbp
ret
xor ebx, ebx
add rsp, 0x70
pop rbp
ret
mov rdx, rdi
mov rdi, r9
mov r12, rsi
mov rsi, r10
mov r13, r8
mov r8, r11
mov r9, rdx
mov r10, r12
mov r11, r13
call fcn.0049fea0
add rsp, 0x70
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x30], r8
mov qword [rsp + 0x38], r9
mov qword [rsp + 0x40], r10
mov qword [rsp + 0x48], r11
call fcn.00463e80
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x28]
mov r8, qword [rsp + 0x30]
mov r9, qword [rsp + 0x38]
mov r10, qword [rsp + 0x40]
mov r11, qword [rsp + 0x48]
jmp fcn.0049fea0