joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4e2f00
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4e2fea
push rbp
mov rbp, rsp
sub rsp, 0x40
movabs rdx, 0x6ed2c41a6e42b4fb
mov qword [rsp + 0x2f], rdx
movabs rdx, 0xcc6ed2c41a6e42b4
mov qword [rsp + 0x30], rdx
movabs rdx, 0x65c6011c20acd561
mov qword [rsp + 0x38], rdx
movabs rdx, 0xe050a0403000d0e
mov qword [rsp + 0x1b], rdx
movabs rdx, 0xd0104030e050a04
mov qword [rsp + 0x1f], rdx
movabs rdx, 0xf060b000a080000
mov qword [rsp + 0x27], rdx
xor eax, eax
jmp 0x4e2f8d
movzx r9d, byte [rsp + rsi + 0x2f]
sub r9d, edx
lea edx, [r9 - 0x4a]
mov byte [rsp + rdi + 0x2f], dl
lea edx, [r8 - 0x4a]
mov byte [rsp + rsi + 0x2f], dl
add rax, 2
cmp rax, 0x14
jge 0x4e2fba
movzx edx, byte [rsp + rax + 0x1b]
movzx esi, byte [rsp + rax + 0x1c]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x11
jae 0x4e2fdd
movzx r8d, byte [rsp + rdi + 0x2f]
sub r8d, edx
cmp rsi, 0x11
jb 0x4e2f70
jmp 0x4e2fd1
xor eax, eax
lea rbx, [rsp + 0x2f]
mov ecx, 0x11
call fcn.00440b20
add rsp, 0x40
pop rbp
ret
mov eax, esi
mov ecx, 0x11
call fcn.00451260
mov eax, edi
mov ecx, 0x11
call fcn.00451260
nop
call fcn.0044efe0
jmp fcn.004e2f00

Function at 0x4e3000
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4e310c
push rbp
mov rbp, rsp
sub rsp, 0x58
movabs rdx, 0x20789ebec6c40b14
mov qword [rsp + 0x3c], rdx
movabs rdx, 0x5320a4706fba87da
mov qword [rsp + 0x44], rdx
movabs rdx, 0xce6e0def5320a470
mov qword [rsp + 0x48], rdx
movabs rdx, 0x65b125542064ff61
mov qword [rsp + 0x50], rdx
movabs rdx, 0x611090809060315
mov qword [rsp + 0x1e], rdx
movabs rdx, 0x319041005000102
mov qword [rsp + 0x26], rdx
movabs rdx, 0x31a13040a060319
mov qword [rsp + 0x2c], rdx
movabs rdx, 0xd1a1a1105020408
mov qword [rsp + 0x34], rdx
xor eax, eax
jmp 0x4e30a8
movzx r9d, byte [rsp + rsi + 0x3c]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x6a]
mov byte [rsp + rdi + 0x3c], dl
mov byte [rsp + rsi + 0x3c], r8b
add rax, 2
cmp rax, 0x1e
jge 0x4e30dc
movzx edx, byte [rsp + rax + 0x1e]
movzx esi, byte [rsp + rax + 0x1f]
mov edi, edx
xor edx, esi
add edx, eax
nop
cmp rdi, 0x1c
jae 0x4e30ff
movzx r8d, byte [rsp + rdi + 0x3c]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x6a]
cmp rsi, 0x1c
jb 0x4e308e
jmp 0x4e30f3
xor eax, eax
lea rbx, [rsp + 0x3c]
mov ecx, 0x1c
call fcn.00440b20
add rsp, 0x58
pop rbp
ret
mov eax, esi
mov ecx, 0x1c
call fcn.00451260
mov eax, edi
mov ecx, 0x1c
call fcn.00451260
nop
call fcn.0044efe0
jmp fcn.004e3000
Function at 0x4e3420
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4e350a
push rbp
mov rbp, rsp
sub rsp, 0x48
movabs rdx, 0xbf2579656b961f54
mov qword [rsp + 0x34], rdx
movabs rdx, 0xc3ca61cfbf257965
mov qword [rsp + 0x38], rdx
movabs rdx, 0xd3d6798fc59dffbd
mov qword [rsp + 0x40], rdx
movabs rdx, 0x12080f020b010611
mov qword [rsp + 0x1e], rdx
movabs rdx, 0x110b130a0d0c1208
mov qword [rsp + 0x24], rdx
movabs rdx, 0xc070710100e100f
mov qword [rsp + 0x2c], rdx
xor eax, eax
jmp 0x4e34ad
movzx r9d, byte [rsp + rsi + 0x34]
sub r9d, edx
lea edx, [r9 - 0x42]
mov byte [rsp + rdi + 0x34], dl
lea edx, [r8 - 0x42]
mov byte [rsp + rsi + 0x34], dl
add rax, 2
cmp rax, 0x16
jge 0x4e34da
movzx edx, byte [rsp + rax + 0x1e]
movzx esi, byte [rsp + rax + 0x1f]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x14
jae 0x4e34fd
movzx r8d, byte [rsp + rdi + 0x34]
sub r8d, edx
cmp rsi, 0x14
jb 0x4e3490
jmp 0x4e34f1
xor eax, eax
lea rbx, [rsp + 0x34]
mov ecx, 0x14
call fcn.00440b20
add rsp, 0x48
pop rbp
ret
mov eax, esi
mov ecx, 0x14
call fcn.00451260
mov eax, edi
mov ecx, 0x14
call fcn.00451260
nop
call fcn.0044efe0
jmp fcn.004e3420

Function at 0x4e5480
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4e55ac
push rbp
mov rbp, rsp
sub rsp, 0x68
movabs rdx, 0x20ae6172e711c9f8
mov qword [rsp + 0x4a], rdx
movabs rdx, 0x6e3a1a46f904e9b4
mov qword [rsp + 0x52], rdx
movabs rdx, 0xf26edb1902076e3a
mov qword [rsp + 0x58], rdx
movabs rdx, 0x68ec6954ccb87915
mov qword [rsp + 0x60], rdx
movabs rdx, 0xa160119121d0013
mov qword [rsp + 0x1e], rdx
movabs rdx, 0x121713180d020618
mov qword [rsp + 0x26], rdx
movabs rdx, 0xc10060e12171318
mov qword [rsp + 0x2a], rdx
movabs rdx, 0x1709080309000810
mov qword [rsp + 0x32], rdx
movabs rdx, 0x170b061111181210
mov qword [rsp + 0x3a], rdx
movabs rdx, 0x1c110e1c15110115
mov qword [rsp + 0x42], rdx
xor eax, eax
jmp 0x4e5546
movzx r9d, byte [rsp + rsi + 0x4a]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x3b]
mov byte [rsp + rdi + 0x4a], dl
mov byte [rsp + rsi + 0x4a], r8b
add rax, 2
cmp rax, 0x2c
jge 0x4e557c
movzx edx, byte [rsp + rax + 0x1e]
movzx esi, byte [rsp + rax + 0x1f]
mov edi, edx
xor edx, esi
add edx, eax
nop dword [rax]
cmp rdi, 0x1e
jae 0x4e559f
movzx r8d, byte [rsp + rdi + 0x4a]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x3b]
cmp rsi, 0x1e
jb 0x4e552c
jmp 0x4e5593
xor eax, eax
lea rbx, [rsp + 0x4a]
mov ecx, 0x1e
call fcn.00440b20
add rsp, 0x68
pop rbp
ret
mov eax, esi
mov ecx, 0x1e
call fcn.00451260
mov eax, edi
mov ecx, 0x1e
call fcn.00451260
nop
call fcn.0044efe0
jmp fcn.004e5480
Function at 0x4e6ec0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4e6fdd
push rbp
mov rbp, rsp
sub rsp, 0x60
movabs rdx, 0x45bf02c974eb3c45
mov qword [rsp + 0x45], rdx
movabs rdx, 0xa6b6a8e536ea9b51
mov qword [rsp + 0x4d], rdx
movabs rdx, 0xe76eb6a6b6a8e536
mov qword [rsp + 0x50], rdx
movabs rdx, 0x65a3645be1647242
mov qword [rsp + 0x58], rdx
movabs rdx, 0xe0f0e0c0d040813
mov qword [rsp + 0x1d], rdx
movabs rdx, 0x617041610070b01
mov qword [rsp + 0x25], rdx
movabs rdx, 0x18040f0802050916
mov qword [rsp + 0x2d], rdx
movabs rdx, 0x18050b0801101906
mov qword [rsp + 0x35], rdx
movabs rdx, 0x1802130a0d020412
mov qword [rsp + 0x3d], rdx
xor eax, eax
jmp 0x4e6f80
movzx r9d, byte [rsp + rsi + 0x45]
sub r9d, edx
lea edx, [r9 - 0x4c]
mov byte [rsp + rdi + 0x45], dl
lea edx, [r8 - 0x4c]
mov byte [rsp + rsi + 0x45], dl
add rax, 2
nop word [rax + rax]
cmp rax, 0x28
jge 0x4e6fad
movzx edx, byte [rsp + rax + 0x1d]
movzx esi, byte [rsp + rax + 0x1e]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x1b
jae 0x4e6fd0
movzx r8d, byte [rsp + rdi + 0x45]
sub r8d, edx
cmp rsi, 0x1b
jb 0x4e6f5d
jmp 0x4e6fc4
xor eax, eax
lea rbx, [rsp + 0x45]
mov ecx, 0x1b
call fcn.00440b20
add rsp, 0x60
pop rbp
ret
mov eax, esi
mov ecx, 0x1b
call fcn.00451260
mov eax, edi
mov ecx, 0x1b
call fcn.00451260
nop
nop dword [rax]
call fcn.0044efe0
jmp fcn.004e6ec0

Function at 0x4e7000
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4e70fb
push rbp
mov rbp, rsp
sub rsp, 0x48
movabs rdx, 0xaa6fb4c369b6690d
mov qword [rsp + 0x36], rdx
movabs rdx, 0x5963aa6fb4c369b6
mov qword [rsp + 0x38], rdx
movabs rdx, 0x5956907a0fcaef0
mov qword [rsp + 0x40], rdx
movabs rdx, 0x1109090c0a00080c
mov qword [rsp + 0x1c], rdx
movabs rdx, 0x90a10050c050e09
mov qword [rsp + 0x24], rdx
movabs rdx, 0x90a10050c05
mov qword [rsp + 0x26], rdx
movabs rdx, 0x807020b0e0d0604
mov qword [rsp + 0x2e], rdx
xor eax, eax
jmp 0x4e7099
movzx r9d, byte [rsp + rsi + 0x36]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x63]
mov byte [rsp + rdi + 0x36], dl
mov byte [rsp + rsi + 0x36], r8b
add rax, 2
cmp rax, 0x1a
jge 0x4e70cb
movzx edx, byte [rsp + rax + 0x1c]
movzx esi, byte [rsp + rax + 0x1d]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x12
jae 0x4e70ee
movzx r8d, byte [rsp + rdi + 0x36]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x63]
cmp rsi, 0x12
jb 0x4e707f
jmp 0x4e70e2
xor eax, eax
lea rbx, [rsp + 0x36]
mov ecx, 0x12
call fcn.00440b20
add rsp, 0x48
pop rbp
ret
mov eax, esi
mov ecx, 0x12
call fcn.00451260
mov eax, edi
mov ecx, 0x12
call fcn.00451260
nop
nop dword [rax + rax]
call fcn.0044efe0
jmp fcn.004e7000
Function at 0x4f2700
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4f27cc
push rbp
mov rbp, rsp
sub rsp, 0x38
movabs rdx, 0xadc952aba4be6555
mov qword [rsp + 0x2c], rdx
mov dword [rsp + 0x34], 0x96caa53
movabs rdx, 0x3050b04060005
mov qword [rsp + 0x1e], rdx
movabs rdx, 0x90302050b070003
mov qword [rsp + 0x24], rdx
xor eax, eax
jmp 0x4f2765
movzx r9d, byte [rsp + rsi + 0x2c]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x5b]
mov byte [rsp + rdi + 0x2c], dl
mov byte [rsp + rsi + 0x2c], r8b
add rax, 2
cmp rax, 0xe
jge 0x4f279c
movzx edx, byte [rsp + rax + 0x1e]
movzx esi, byte [rsp + rax + 0x1f]
mov edi, edx
xor edx, esi
add edx, eax
nop dword [rax + rax]
cmp rdi, 0xc
jae 0x4f27bf
movzx r8d, byte [rsp + rdi + 0x2c]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x5b]
cmp rsi, 0xc
jb 0x4f274b
jmp 0x4f27b3
xor eax, eax
lea rbx, [rsp + 0x2c]
mov ecx, 0xc
call fcn.00440b20
add rsp, 0x38
pop rbp
ret
mov eax, esi
mov ecx, 0xc
call fcn.00451260
mov eax, edi
mov ecx, 0xc
call fcn.00451260
nop
call fcn.0044efe0
jmp fcn.004f2700

Function at 0x4f3be0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4f3cec
push rbp
mov rbp, rsp
sub rsp, 0x50
movabs rdx, 0xc2b36e6946a565c2
mov qword [rsp + 0x37], rdx
movabs rdx, 0x650b614e9c1f1cbb
mov qword [rsp + 0x3f], rdx
movabs rdx, 0xc3650b614e9c1f1c
mov qword [rsp + 0x40], rdx
movabs rdx, 0x2ed0bcb0c0611ee2
mov qword [rsp + 0x48], rdx
movabs rdx, 0x140a1816100b0a10
mov qword [rsp + 0x19], rdx
movabs rdx, 0x1602080802120e0a
mov qword [rsp + 0x21], rdx
movabs rdx, 0xe110e14071602
mov qword [rsp + 0x27], rdx
movabs rdx, 0x150a111707060906
mov qword [rsp + 0x2f], rdx
xor eax, eax
jmp 0x4f3c88
movzx r9d, byte [rsp + rsi + 0x37]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x77]
mov byte [rsp + rdi + 0x37], dl
mov byte [rsp + rsi + 0x37], r8b
add rax, 2
cmp rax, 0x1e
jge 0x4f3cbc
movzx edx, byte [rsp + rax + 0x19]
movzx esi, byte [rsp + rax + 0x1a]
mov edi, edx
xor edx, esi
add edx, eax
nop
cmp rdi, 0x19
jae 0x4f3cdf
movzx r8d, byte [rsp + rdi + 0x37]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x77]
cmp rsi, 0x19
jb 0x4f3c6e
jmp 0x4f3cd3
xor eax, eax
lea rbx, [rsp + 0x37]
mov ecx, 0x19
call fcn.00440b20
add rsp, 0x50
pop rbp
ret
mov eax, esi
mov ecx, 0x19
call fcn.00451260
mov eax, edi
mov ecx, 0x19
call fcn.00451260
nop
call fcn.0044efe0
jmp fcn.004f3be0
Function at 0x4f6c00
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4f6cc6
push rbp
mov rbp, rsp
sub rsp, 0x30
movabs rdx, 0x281f1c6896a1654e
mov qword [rsp + 0x25], rdx
mov dword [rsp + 0x2c], 0xea104428
movabs rdx, 0x90509020309070a
mov qword [rsp + 0x19], rdx
mov dword [rsp + 0x21], 0x7020506
xor eax, eax
jmp 0x4f6c60
movzx r9d, byte [rsp + rsi + 0x25]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x37]
mov byte [rsp + rdi + 0x25], dl
mov byte [rsp + rsi + 0x25], r8b
add rax, 2
nop
cmp rax, 0xc
jge 0x4f6c92
movzx edx, byte [rsp + rax + 0x19]
movzx esi, byte [rsp + rax + 0x1a]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0xb
jae 0x4f6cb7
movzx r8d, byte [rsp + rdi + 0x25]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x37]
cmp rsi, 0xb
jb 0x4f6c44
jmp 0x4f6cab
xor eax, eax
lea rbx, [rsp + 0x25]
mov ecx, 0xb
nop
call fcn.00440b20
add rsp, 0x30
pop rbp
ret
mov eax, esi
mov ecx, 0xb
call fcn.00451260
mov eax, edi
mov ecx, 0xb
nop
call fcn.00451260
nop
call fcn.0044efe0
jmp fcn.004f6c00

Function at 0x4f7700
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4f77cc
push rbp
mov rbp, rsp
sub rsp, 0x30
movabs rdx, 0x31f12514532cbe37
mov qword [rsp + 0x26], rdx
mov word [rsp + 0x2e], 0x9e74
movabs rdx, 0x205060006090501
mov qword [rsp + 0x18], rdx
movabs rdx, 0x904070702000205
mov qword [rsp + 0x1e], rdx
xor eax, eax
jmp 0x4f7764
movzx r9d, byte [rsp + rsi + 0x26]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x2a]
mov byte [rsp + rdi + 0x26], dl
mov byte [rsp + rsi + 0x26], r8b
add rax, 2
cmp rax, 0xe
jge 0x4f779c
movzx edx, byte [rsp + rax + 0x18]
movzx esi, byte [rsp + rax + 0x19]
mov edi, edx
xor edx, esi
add edx, eax
nop word [rax + rax]
cmp rdi, 0xa
jae 0x4f77bf
movzx r8d, byte [rsp + rdi + 0x26]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x2a]
cmp rsi, 0xa
jb 0x4f774a
jmp 0x4f77b3
xor eax, eax
lea rbx, [rsp + 0x26]
mov ecx, 0xa
call fcn.00440b20
add rsp, 0x30
pop rbp
ret
mov eax, esi
mov ecx, 0xa
call fcn.00451260
mov eax, edi
mov ecx, 0xa
call fcn.00451260
nop
call fcn.0044efe0
jmp fcn.004f7700

Function at 0x4fa6a0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4fa758
push rbp
mov rbp, rsp
sub rsp, 0x30
movabs rdx, 0xe2745c6269dbdd77
mov qword [rsp + 0x28], rdx
movabs rdx, 0x104020204040105
mov qword [rsp + 0x1e], rdx
mov word [rsp + 0x26], 0x707
xor eax, eax
jmp 0x4fa6f5
movzx r9d, byte [rsp + rsi + 0x28]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x7e]
mov byte [rsp + rdi + 0x28], dl
mov byte [rsp + rsi + 0x28], r8b
add rax, 2
cmp rax, 0xa
jge 0x4fa728
movzx edx, byte [rsp + rax + 0x1e]
movzx esi, byte [rsp + rax + 0x1f]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 8
jae 0x4fa74b
movzx r8d, byte [rsp + rdi + 0x28]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x7e]
nop
cmp rsi, 8
jb 0x4fa6db
jmp 0x4fa73f
xor eax, eax
lea rbx, [rsp + 0x28]
mov ecx, 8
call fcn.00440b20
add rsp, 0x30
pop rbp
ret
mov eax, esi
mov ecx, 8
call fcn.00451260
mov eax, edi
mov ecx, 8
call fcn.00451260
nop
call fcn.0044efe0
nop dword [rax]
jmp fcn.004fa6a0
Function at 0x4fa780
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4fa88c
push rbp
mov rbp, rsp
sub rsp, 0x50
movabs rdx, 0x146990196f266eea
mov qword [rsp + 0x37], rdx
movabs rdx, 0x1d2f2f6306f1a074
mov qword [rsp + 0x3f], rdx
movabs rdx, 0x581d2f2f6306f1a0
mov qword [rsp + 0x40], rdx
movabs rdx, 0x14651375a300cb14
mov qword [rsp + 0x48], rdx
movabs rdx, 0xd0e0e0a0f02120c
mov qword [rsp + 0x1b], rdx
movabs rdx, 0x1104040504000410
mov qword [rsp + 0x23], rdx
movabs rdx, 0x1400120b11040405
mov qword [rsp + 0x27], rdx
movabs rdx, 0x130716180b0913
mov qword [rsp + 0x2f], rdx
xor eax, eax
jmp 0x4fa828
movzx r9d, byte [rsp + rsi + 0x37]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x37]
mov byte [rsp + rdi + 0x37], dl
mov byte [rsp + rsi + 0x37], r8b
add rax, 2
cmp rax, 0x1c
jge 0x4fa85c
movzx edx, byte [rsp + rax + 0x1b]
movzx esi, byte [rsp + rax + 0x1c]
mov edi, edx
xor edx, esi
add edx, eax
nop
cmp rdi, 0x19
jae 0x4fa87f
movzx r8d, byte [rsp + rdi + 0x37]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x37]
cmp rsi, 0x19
jb 0x4fa80e
jmp 0x4fa873
xor eax, eax
lea rbx, [rsp + 0x37]
mov ecx, 0x19
call fcn.00440b20
add rsp, 0x50
pop rbp
ret
mov eax, esi
mov ecx, 0x19
call fcn.00451260
mov eax, edi
mov ecx, 0x19
call fcn.00451260
nop
call fcn.0044efe0
jmp fcn.004fa780

Function at 0x4feb80
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4fec7d
push rbp
mov rbp, rsp
sub rsp, 0x48
movabs rdx, 0x7987706f86516e67
mov qword [rsp + 0x34], rdx
movabs rdx, 0x65687b567987706f
mov qword [rsp + 0x38], rdx
movabs rdx, 0x6a7b7a87654f5a39
mov qword [rsp + 0x40], rdx
movabs rdx, 0xc020d050e110610
mov qword [rsp + 0x18], rdx
movabs rdx, 0x20d020007070a08
mov qword [rsp + 0x20], rdx
movabs rdx, 0xd090d0d020d0200
mov qword [rsp + 0x24], rdx
movabs rdx, 0xd07130410061203
mov qword [rsp + 0x2c], rdx
xor eax, eax
jmp 0x4fec20
movzx r9d, byte [rsp + rsi + 0x34]
sub r9d, edx
lea edx, [r9 + 0x17]
mov byte [rsp + rdi + 0x34], dl
lea edx, [r8 + 0x17]
mov byte [rsp + rsi + 0x34], dl
add rax, 2
nop dword [rax]
cmp rax, 0x1c
jge 0x4fec4d
movzx edx, byte [rsp + rax + 0x18]
movzx esi, byte [rsp + rax + 0x19]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x14
jae 0x4fec70
movzx r8d, byte [rsp + rdi + 0x34]
sub r8d, edx
cmp rsi, 0x14
jb 0x4febff
jmp 0x4fec64
xor eax, eax
lea rbx, [rsp + 0x34]
mov ecx, 0x14
call fcn.00440b20
add rsp, 0x48
pop rbp
ret
mov eax, esi
mov ecx, 0x14
call fcn.00451260
mov eax, edi
mov ecx, 0x14
call fcn.00451260
nop
nop dword [rax]
call fcn.0044efe0
jmp fcn.004feb80
Function at 0x4ff560
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4ff620
push rbp
mov rbp, rsp
sub rsp, 0x20
lea rax, [0x00509900]
call fcn.00409f40
movabs rcx, 0x5a4ec04aa368021f
mov qword [rax], rcx
mov word [rax + 8], 0xb4db
movabs rcx, 0x9030803010902
mov qword [rsp + 0x12], rcx
movabs rcx, 0x509090003000009
mov qword [rsp + 0x18], rcx
xor ecx, ecx
jmp 0x4ff5cd
movzx r9d, byte [rsi + rax]
sub r9d, edx
lea edx, [r9 - 0x53]
mov byte [rax + rdi], dl
lea edx, [r8 - 0x53]
mov byte [rax + rsi], dl
add rcx, 2
cmp rcx, 0xe
jge 0x4ff5f9
movzx edx, byte [rsp + rcx + 0x12]
movzx esi, byte [rsp + rcx + 0x13]
mov edi, edx
xor edx, esi
add edx, ecx
cmp rdi, 0xa
jae 0x4ff613
movzx r8d, byte [rdi + rax]
sub r8d, edx
cmp rsi, 0xa
jb 0x4ff5b3
jmp 0x4ff607
mov ebx, 0xa
mov rcx, rbx
add rsp, 0x20
pop rbp
ret
mov eax, esi
mov ecx, 0xa
call fcn.00451260
mov eax, edi
mov ecx, 0xa
call fcn.00451260
nop
call fcn.0044efe0
jmp fcn.004ff560
Function at 0x14001be40
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x14001bfcb
push rbp
mov rbp, rsp
sub rsp, 0x48
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rbx
mov rcx, qword [str._EC_]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x4000
call fcn.14003b7c0
xorps xmm15, xmm15
mov r14, qword [0x140a60c98]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x20], 0
jne 0x14001bea5
mov rax, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x60]
jmp 0x14001beb4
add rsp, 0x48
pop rbp
ret
sub rcx, rbx
add rax, rbx
mov rbx, rcx
test rbx, rbx
jbe 0x14001bed3
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x40], rax
mov rcx, rbx
jmp 0x14001bee3
cmp rbx, 0x1000
jae 0x14001beab
jmp 0x14001bf4d
add rsp, 0x48
pop rbp
ret
shr rbx, 1
and rbx, 0xfffffffffffff000
mov qword [rsp + 0x38], rbx
cmp rbx, 0x1000
jae 0x14001bef5
xor edx, edx
jmp 0x14001bf44
mov rcx, qword [str._EC_]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x4000
call fcn.14003b7c0
xorps xmm15, xmm15
mov r14, qword [0x140a60c98]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x20], 0
sete al
mov rcx, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x38]
mov edx, eax
mov rax, qword [rsp + 0x40]
test dl, dl
jne 0x14001bed9
jmp 0x14001bec8
call fcn.140072c00
xorps xmm15, xmm15
mov r14, qword [0x140a60c98]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov eax, dword [rsp]
mov qword [rsp + 0x30], rax
call fcn.14003fd20
lea rax, [0x1405b586f]
mov ebx, 0x18
nop dword [rax]
call fcn.1400405a0
mov rax, qword [rsp + 0x38]
call fcn.1400402e0
lea rax, [0x1405b6635]
mov ebx, 0x19
nop dword [rax + rax]
call fcn.1400405a0
mov rax, qword [rsp + 0x30]
call fcn.1400402e0
call fcn.14003ff60
call fcn.14003fd80
lea rax, [0x1405bc6ba]
mov ebx, 0x21
call fcn.14003e280
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.14006f4a0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.14001be40
Function at 0x14001c000
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x14001c226
push rbp
mov rbp, rsp
sub rsp, 0x50
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], rbx
mov rcx, qword [str.0EC_]
mov qword [rsp], rcx
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x1000
mov qword [rsp + 0x20], 4
call fcn.14003b840
xorps xmm15, xmm15
mov r14, qword [0x140a60c98]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x60]
mov rcx, rax
cmp qword [rsp + 0x28], rax
je 0x14001c073
mov rbx, qword [rsp + 0x68]
mov rax, rbx
jmp 0x14001c082
add rsp, 0x50
pop rbp
ret
sub rdx, rbx
add rcx, rbx
mov rbx, rdx
test rbx, rbx
jbe 0x14001c0a5
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x48], rcx
mov rdx, rbx
jmp 0x14001c0b5
cmp rbx, 0x1000
jae 0x14001c079
nop
jmp 0x14001c138
add rsp, 0x50
pop rbp
ret
shr rbx, 1
and rbx, 0xfffffffffffff000
mov qword [rsp + 0x38], rbx
nop word [rax + rax]
cmp rbx, 0x1000
jae 0x14001c0cd
xor esi, esi
jmp 0x14001c12a
mov rax, qword [str.0EC_]
mov qword [rsp], rax
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], 0x1000
mov qword [rsp + 0x20], 4
call fcn.14003b840
xorps xmm15, xmm15
mov r14, qword [0x140a60c98]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x28], 0
sete al
mov rcx, qword [rsp + 0x48]
mov rdx, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x38]
mov esi, eax
mov rax, qword [rsp + 0x68]
test sil, sil
jne 0x14001c0ab
jmp 0x14001c096
call fcn.140072c00
xorps xmm15, xmm15
mov r14, qword [0x140a60c98]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov eax, dword [rsp]
mov dword [rsp + 0x34], eax
cmp eax, 8
jne 0x14001c1c0
nop dword [rax + rax]
call fcn.14003fd20
lea rax, [0x1405b664e]
mov ebx, 0x19
call fcn.1400405a0
mov rax, qword [rsp + 0x68]
nop dword [rax + rax]
call fcn.1400402e0
lea rax, [0x1405b6635]
mov ebx, 0x19
call fcn.1400405a0
mov eax, dword [rsp + 0x34]
call fcn.1400402e0
nop
call fcn.14003ff60
call fcn.14003fd80
lea rax, [0x1405acb13]
mov ebx, 0xd
call fcn.14003e280
nop dword [rax + rax]
cmp eax, 0x5af
je 0x14001c160
call fcn.14003fd20
lea rax, [0x1405b664e]
mov ebx, 0x19
call fcn.1400405a0
mov rax, qword [rsp + 0x38]
call fcn.1400402e0
lea rax, [0x1405b6635]
mov ebx, 0x19
call fcn.1400405a0
mov eax, dword [rsp + 0x34]
nop dword [rax]
call fcn.1400402e0
call fcn.14003ff60
call fcn.14003fd80
lea rax, [0x1405bb013]
mov ebx, 0x1f
nop dword [rax + rax]
call fcn.14003e280
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.14006f4a0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
nop
jmp fcn.14001c000
Function at 0x140026200
Capabilities:
Hash data using murmur3

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x10
cmp byte [0x140a60996], 0
jne 0x1400262f0
sub rbx, qword [rax + 0x18]
mov rdx, qword [rax + 0x48]
test byte [rdx], al
mov ecx, dword [rax + 0x5c]
imul rcx, rbx
mov rbx, rcx
shr rbx, 0x20
shr rcx, 0x23
and ebx, 7
mov rsi, rcx
mov rcx, rbx
mov edi, 1
shl edi, cl
add rdx, rsi
nop
nop
nop
nop
lock or byte [rdx], dil
mov rcx, qword [rax + 0x18]
movabs rdx, 0x800000000000
add rdx, rcx
mov rbx, rdx
shr rdx, 0x2a
nop
nop
nop
cmp rdx, 0x40
jae 0x1400262e3
lea rsi, [0x1409f2a98]
mov rdx, qword [rsi + rdx*8]
test byte [rdx], al
mov rsi, rcx
shr rsi, 0x10
and esi, 0x3f
shr rcx, 0xd
and ecx, 7
mov edi, 1
shl edi, cl
shr rbx, 0x16
and ebx, 0xfffff
mov rdx, qword [rdx + rbx*8]
test byte [rdx], al
movzx ebx, byte [rdx + rsi + 0x1040]
lea rdx, [rdx + rsi]
lea rdx, [rdx + 0x1040]
test dil, bl
jne 0x1400262be
lock or byte [rdx], dil
mov rcx, qword [r14 + 0x30]
mov rcx, qword [rcx + 0xa0]
test byte [rcx], al
mov rdx, qword [rcx + 0x1270]
add rdx, qword [rax + 0x68]
mov qword [rcx + 0x1270], rdx
add rsp, 0x10
pop rbp
ret
mov rax, rdx
mov ecx, 0x40
call fcn.1400717c0
lea rax, [0x1405c22b0]
mov ebx, 0x2c
nop dword [rax]
call fcn.14003e280
nop
int3

Function at 0x140028740
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x140028846
push rbp
mov rbp, rsp
sub rsp, 0x48
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x68], rcx
mov byte [rsp + 0x70], dil
mov qword [rsp + 0x10], 0
jmp 0x140028783
mov rax, qword [rsp + 0x58]
mov rcx, rdx
mov rbx, qword [rsp + 0x60]
movzx edi, byte [rsp + 0x70]
cmp qword [rsp + 0x10], rbx
jae 0x14002883b
test byte [rax], al
lea rcx, [rax + 0x100b8]
mov ebx, edi
mov rax, rcx
nop dword [rax]
call fcn.140029520
test rax, rax
je 0x14002883b
movups xmmword [rsp + 0x18], xmm15
movups xmmword [rsp + 0x28], xmm15
movups xmmword [rsp + 0x38], xmm15
lea rcx, [0x140028880]
mov qword [rsp + 0x18], rcx
lea rdx, [rsp + 0x10]
mov qword [rsp + 0x20], rdx
mov rdx, qword [rsp + 0x58]
mov qword [rsp + 0x28], rdx
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x38], rbx
mov rax, qword [rsp + 0x60]
mov qword [rsp + 0x40], rax
lea rbx, [rsp + 0x18]
mov qword [rsp], rbx
nop dword [rax]
call fcn.14006f380
xorps xmm15, xmm15
mov r14, qword [0x140a60c98]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rdx, qword [rsp + 0x68]
nop dword [rax]
test rdx, rdx
jne 0x140028829
xor eax, eax
jmp 0x140028833
mov rax, qword [rdx]
call rax
mov rdx, qword [rsp + 0x68]
test al, al
je 0x140028771
mov rax, qword [rsp + 0x10]
add rsp, 0x48
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov byte [rsp + 0x20], dil
call fcn.14006f4a0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
movzx edi, byte [rsp + 0x20]
jmp fcn.140028740