joyce8/EMBER2024-capa huggingface dataset:
Function at 0x49d240
Capabilities:
Encrypt data using rc4 prga

Disassembly:
lea r12, [rsp - 8]
cmp r12, qword [r14 + 0x10]
jbe 0x49d3ac
push rbp
mov rbp, rsp
add rsp, 0xffffffffffffff80
movabs rdx, 0x2e263519ee694672
mov qword [rsp + 0x18], rdx
movabs rdx, 0x747b2e3b5666117b
mov qword [rsp + 0x20], rdx
movabs rdx, 0x3a203a65560f747b
mov qword [rsp + 0x26], rdx
movabs rdx, 0x645b24563b263c4c
mov qword [rsp + 0x2e], rdx
movabs rdx, 0xee52ffda6f204265
mov qword [rsp + 0x36], rdx
movabs rdx, 0xb27e6342216200e
mov qword [rsp + 0x3e], rdx
movabs rdx, 0x22422160f092b16
mov qword [rsp + 0x46], rdx
movabs rdx, 0xe0e23160a08021c
mov qword [rsp + 0x4e], rdx
movabs rdx, 0x24220e0e23160a08
mov qword [rsp + 0x50], rdx
movabs rdx, 0x172d230e1f0e2a06
mov qword [rsp + 0x58], rdx
movabs rdx, 0x261b1a040f1a0815
mov qword [rsp + 0x60], rdx
movabs rdx, 0x1172916111b042c
mov qword [rsp + 0x68], rdx
movabs rdx, 0x190c050e060b0404
mov qword [rsp + 0x70], rdx
movabs rdx, 0x182a2810031a2a25
mov qword [rsp + 0x78], rdx
xor eax, eax
jmp 0x49d347
movzx r9d, byte [rsp + rsi + 0x18]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x1b]
mov byte [rsp + rdi + 0x18], dl
mov byte [rsp + rsi + 0x18], r8b
add rax, 2
cmp rax, 0x3a
jge 0x49d37c
movzx edx, byte [rsp + rax + 0x46]
movzx esi, byte [rsp + rax + 0x47]
mov edi, edx
xor edx, esi
add edx, eax
nop dword [rax]
cmp rdi, 0x2e
jae 0x49d39f
movzx r8d, byte [rsp + rdi + 0x18]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x1b]
cmp rsi, 0x2e
jb 0x49d32d
jmp 0x49d393
xor eax, eax
lea rbx, [rsp + 0x18]
mov ecx, 0x2e
call fcn.0044c4e0
sub rsp, 0xffffffffffffff80
pop rbp
ret
mov eax, esi
mov ecx, 0x2e
call fcn.004617c0
mov eax, edi
mov ecx, 0x2e
call fcn.004617c0
nop
call fcn.0045f540
jmp fcn.0049d240

Function at 0x49d8c0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x49d9ac
push rbp
mov rbp, rsp
sub rsp, 0x48
movabs rdx, 0xb5b463796cc2a3ee
mov qword [rsp + 0x1d], rdx
movabs rdx, 0xac336b956b5b463
mov qword [rsp + 0x22], rdx
movabs rdx, 0x7165c5a4696fa96f
mov qword [rsp + 0x2a], rdx
movabs rdx, 0xb0a1112110c0a0d
mov qword [rsp + 0x32], rdx
movabs rdx, 0x2060d0407140b0a
mov qword [rsp + 0x38], rdx
movabs rdx, 0x1090b0b040e0009
mov qword [rsp + 0x40], rdx
xor eax, eax
jmp 0x49d94a
movzx r9d, byte [rsp + rsi + 0x1d]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x5e]
mov byte [rsp + rdi + 0x1d], dl
mov byte [rsp + rsi + 0x1d], r8b
add rax, 2
cmp rax, 0x16
jge 0x49d97c
movzx edx, byte [rsp + rax + 0x32]
movzx esi, byte [rsp + rax + 0x33]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x15
jae 0x49d99f
movzx r8d, byte [rsp + rdi + 0x1d]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x5e]
cmp rsi, 0x15
jb 0x49d930
jmp 0x49d993
xor eax, eax
lea rbx, [rsp + 0x1d]
mov ecx, 0x15
call fcn.0044c4e0
add rsp, 0x48
pop rbp
ret
mov eax, esi
mov ecx, 0x15
call fcn.004617c0
mov eax, edi
mov ecx, 0x15
call fcn.004617c0
nop
call fcn.0045f540
jmp fcn.0049d8c0
Function at 0x49e3a0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x49e4f8
push rbp
mov rbp, rsp
sub rsp, 0x78
movabs rdx, 0xdc6d8974d8f0514d
mov qword [rsp + 0x19], rdx
movabs rdx, 0xfad5fc544934654e
mov qword [rsp + 0x21], rdx
movabs rdx, 0x6cfad5fc54493465
mov qword [rsp + 0x22], rdx
movabs rdx, 0x99652057f941aa4e
mov qword [rsp + 0x2a], rdx
movabs rdx, 0xd67fe2f2c6de616d
mov qword [rsp + 0x32], rdx
movabs rdx, 0x72093161ea6580df
mov qword [rsp + 0x3a], rdx
movabs rdx, 0x2227222614191f0b
mov qword [rsp + 0x42], rdx
movabs rdx, 0x1c0d0c110f1d2227
mov qword [rsp + 0x48], rdx
movabs rdx, 0x21c0520031f1e0d
mov qword [rsp + 0x50], rdx
movabs rdx, 0x1318150205140605
mov qword [rsp + 0x58], rdx
movabs rdx, 0xb0a1e1b1507011e
mov qword [rsp + 0x60], rdx
movabs rdx, 0xe0e212124260206
mov qword [rsp + 0x68], rdx
movabs rdx, 0x18110b1212270c1c
mov qword [rsp + 0x70], rdx
xor eax, eax
jmp 0x49e493
movzx r9d, byte [rsp + rsi + 0x19]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x60]
mov byte [rsp + rdi + 0x19], dl
mov byte [rsp + rsi + 0x19], r8b
add rax, 2
cmp rax, 0x36
jge 0x49e4c8
movzx edx, byte [rsp + rax + 0x42]
movzx esi, byte [rsp + rax + 0x43]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x29
jae 0x49e4eb
movzx r8d, byte [rsp + rdi + 0x19]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x60]
nop dword [rax]
cmp rsi, 0x29
jb 0x49e479
jmp 0x49e4df
xor eax, eax
lea rbx, [rsp + 0x19]
mov ecx, 0x29
call fcn.0044c4e0
add rsp, 0x78
pop rbp
ret
mov eax, esi
mov ecx, 0x29
call fcn.004617c0
mov eax, edi
mov ecx, 0x29
call fcn.004617c0
nop
call fcn.0045f540
nop dword [rax]
jmp fcn.0049e3a0
Function at 0x4a14a0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4a15d8
push rbp
mov rbp, rsp
sub rsp, 0x68
movabs rdx, 0x983463746c666598
mov qword [rsp + 0x19], rdx
movabs rdx, 0x61983463746c6665
mov qword [rsp + 0x1a], rdx
movabs rdx, 0x9965209182856a78
mov qword [rsp + 0x22], rdx
movabs rdx, 0xd58475873b616564
mov qword [rsp + 0x2a], rdx
movabs rdx, 0x5a9a6e79718f8281
mov qword [rsp + 0x32], rdx
movabs rdx, 0x9151a1b0a1f0614
mov qword [rsp + 0x3a], rdx
movabs rdx, 0x13131a0b0c0f1504
mov qword [rsp + 0x42], rdx
movabs rdx, 0x1b061d0b09091313
mov qword [rsp + 0x48], rdx
movabs rdx, 0xa2000100f1c2018
mov qword [rsp + 0x50], rdx
movabs rdx, 0x1717090f13071019
mov qword [rsp + 0x58], rdx
movabs rdx, 0x70814141d1a0d00
mov qword [rsp + 0x60], rdx
xor eax, eax
jmp 0x4a1578
movzx r9d, byte [rsp + rsi + 0x19]
sub r9d, edx
lea edx, [r9 + 0x14]
mov byte [rsp + rdi + 0x19], dl
lea edx, [r8 + 0x14]
mov byte [rsp + rsi + 0x19], dl
add rax, 2
cmp rax, 0x2e
jge 0x4a15a8
movzx edx, byte [rsp + rax + 0x3a]
movzx esi, byte [rsp + rax + 0x3b]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x21
jae 0x4a15cb
movzx r8d, byte [rsp + rdi + 0x19]
sub r8d, edx
nop dword [rax]
cmp rsi, 0x21
jb 0x4a155b
jmp 0x4a15bf
xor eax, eax
lea rbx, [rsp + 0x19]
mov ecx, 0x21
call fcn.0044c4e0
add rsp, 0x68
pop rbp
ret
mov eax, esi
mov ecx, 0x21
call fcn.004617c0
mov eax, edi
mov ecx, 0x21
call fcn.004617c0
nop
call fcn.0045f540
nop dword [rax]
jmp fcn.004a14a0
Function at 0x4a1a20
Capabilities:
Encrypt data using rc4 prga

Disassembly:
lea r12, [rsp - 0x28]
cmp r12, qword [r14 + 0x10]
jbe 0x4a1bca
push rbp
mov rbp, rsp
sub rsp, 0xa0
movabs rdx, 0xec74a2185ec56537
mov qword [rsp + 0x1d], rdx
movabs rdx, 0xb763e1d275fb7232
mov qword [rsp + 0x25], rdx
movabs rdx, 0x1063e0b763e1d275
mov qword [rsp + 0x28], rdx
movabs rdx, 0xd3226c45abdeb93a
mov qword [rsp + 0x30], rdx
movabs rdx, 0x64206e2af4d8b753
mov qword [rsp + 0x38], rdx
movabs rdx, 0x547b669a661c88a
mov qword [rsp + 0x40], rdx
movabs rdx, 0xf96165686e694730
mov qword [rsp + 0x48], rdx
movabs rdx, 0x727574c9d66fd82f
mov qword [rsp + 0x50], rdx
movabs rdx, 0x2634193603071307
mov qword [rsp + 0x58], rdx
movabs rdx, 0x16141e1e1b1d2805
mov qword [rsp + 0x60], rdx
movabs rdx, 0x240c1a222a041611
mov qword [rsp + 0x68], rdx
movabs rdx, 0x1c13372c1d363314
mov qword [rsp + 0x70], rdx
movabs rdx, 0xf0204041b121026
mov qword [rsp + 0x78], rdx
movabs rdx, 0x14003200390d321f
mov qword [rsp + 0x80], rdx
movabs rdx, 0x2a28080b0a373236
mov qword [rsp + 0x88], rdx
movabs rdx, 0x2a1a150b14032b29
mov qword [rsp + 0x90], rdx
movabs rdx, 0x2b0d1b1f23291e19
mov qword [rsp + 0x98], rdx
xor eax, eax
jmp 0x4a1b66
movzx r9d, byte [rsp + rsi + 0x1d]
sub r9d, edx
lea edx, [r9 - 0x1e]
mov byte [rsp + rdi + 0x1d], dl
lea edx, [r8 - 0x1e]
mov byte [rsp + rsi + 0x1d], dl
add rax, 2
cmp rax, 0x48
jge 0x4a1b97
movzx edx, byte [rsp + rax + 0x58]
movzx esi, byte [rsp + rax + 0x59]
mov edi, edx
xor edx, esi
add edx, eax
nop dword [rax]
cmp rdi, 0x3b
jae 0x4a1bbd
movzx r8d, byte [rsp + rdi + 0x1d]
sub r8d, edx
cmp rsi, 0x3b
jb 0x4a1b49
jmp 0x4a1bb1
xor eax, eax
lea rbx, [rsp + 0x1d]
mov ecx, 0x3b
call fcn.0044c4e0
add rsp, 0xa0
pop rbp
ret
mov eax, esi
mov ecx, 0x3b
call fcn.004617c0
mov eax, edi
mov ecx, 0x3b
call fcn.004617c0
nop
call fcn.0045f540
jmp fcn.004a1a20
Function at 0x4a6400
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4a654c
push rbp
mov rbp, rsp
sub rsp, 0x78
movabs rdx, 0x2027fa6532d1bdee
mov qword [rsp + 0x1e], rdx
movabs rdx, 0x17314d04e0771638
mov qword [rsp + 0x26], rdx
movabs rdx, 0x693f71b917314d04
mov qword [rsp + 0x2a], rdx
movabs rdx, 0x2d3832bf20732f72
mov qword [rsp + 0x32], rdx
movabs rdx, 0x365cdb624115e952
mov qword [rsp + 0x3a], rdx
movabs rdx, 0x72fc0ca53649571e
mov qword [rsp + 0x42], rdx
movabs rdx, 0x1f01030b2322280b
mov qword [rsp + 0x4a], rdx
movabs rdx, 0x62a211f021d2825
mov qword [rsp + 0x52], rdx
movabs rdx, 0x3121c1d1809062a
mov qword [rsp + 0x58], rdx
movabs rdx, 0x29100c1c241e0518
mov qword [rsp + 0x60], rdx
movabs rdx, 0x1229091f0e002622
mov qword [rsp + 0x68], rdx
movabs rdx, 0x272108020b0f151c
mov qword [rsp + 0x70], rdx
xor eax, eax
jmp 0x4a64e4
movzx r9d, byte [rsp + rsi + 0x1e]
lea edx, [r9 + rdx]
lea edx, [rdx + 4]
mov byte [rsp + rdi + 0x1e], dl
mov byte [rsp + rsi + 0x1e], r8b
add rax, 2
cmp rax, 0x2e
jge 0x4a651c
movzx edx, byte [rsp + rax + 0x4a]
movzx esi, byte [rsp + rax + 0x4b]
mov edi, edx
xor edx, esi
add edx, eax
nop word [rax + rax]
cmp rdi, 0x2c
jae 0x4a653f
movzx r8d, byte [rsp + rdi + 0x1e]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 4]
cmp rsi, 0x2c
jb 0x4a64ca
jmp 0x4a6533
xor eax, eax
lea rbx, [rsp + 0x1e]
mov ecx, 0x2c
call fcn.0044c4e0
add rsp, 0x78
pop rbp
ret
mov eax, esi
mov ecx, 0x2c
call fcn.004617c0
mov eax, edi
mov ecx, 0x2c
call fcn.004617c0
nop
call fcn.0045f540
jmp fcn.004a6400
Function at 0x4aca20
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4acb3d
push rbp
mov rbp, rsp
sub rsp, 0x60
movabs rdx, 0x6806104470e6ce0c
mov qword [rsp + 0x1b], rdx
movabs rdx, 0xda760869203a2865
mov qword [rsp + 0x23], rdx
movabs rdx, 0x7fdda8696cda7608
mov qword [rsp + 0x28], rdx
movabs rdx, 0x4682e569b00cc25d
mov qword [rsp + 0x30], rdx
movabs rdx, 0x6070914171b1c17
mov qword [rsp + 0x38], rdx
movabs rdx, 0x1c12001c1215051c
mov qword [rsp + 0x40], rdx
movabs rdx, 0xf1618041c0e090d
mov qword [rsp + 0x48], rdx
movabs rdx, 0x90d0114071b1705
mov qword [rsp + 0x50], rdx
movabs rdx, 0x91318051a020413
mov qword [rsp + 0x58], rdx
xor eax, eax
jmp 0x4acae0
movzx r9d, byte [rsp + rsi + 0x1b]
sub r9d, edx
lea edx, [r9 - 0x32]
mov byte [rsp + rdi + 0x1b], dl
lea edx, [r8 - 0x32]
mov byte [rsp + rsi + 0x1b], dl
add rax, 2
nop word [rax + rax]
cmp rax, 0x28
jge 0x4acb0d
movzx edx, byte [rsp + rax + 0x38]
movzx esi, byte [rsp + rax + 0x39]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x1d
jae 0x4acb30
movzx r8d, byte [rsp + rdi + 0x1b]
sub r8d, edx
cmp rsi, 0x1d
jb 0x4acabd
jmp 0x4acb24
xor eax, eax
lea rbx, [rsp + 0x1b]
mov ecx, 0x1d
call fcn.0044c4e0
add rsp, 0x60
pop rbp
ret
mov eax, esi
mov ecx, 0x1d
call fcn.004617c0
mov eax, edi
mov ecx, 0x1d
call fcn.004617c0
nop
nop dword [rax]
call fcn.0045f540
jmp fcn.004aca20
Function at 0x4ae960
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
mov rcx, qword [rsp + 8]
mov rax, qword [rsp + 0x10]
mov rdx, qword [rsp + 0x18]
mov rbx, qword [rsp + 0x20]
movups xmm1, xmmword [rax]
movups xmm0, xmmword [rbx]
add rax, 0x10
pxor xmm0, xmm1
sub rcx, 0xc
je 0x4ae99f
jb 0x4ae9b4
movups xmm1, xmmword [rax]
aesenc xmm0, xmm1
movups xmm1, xmmword [rax + 0x10]
aesenc xmm0, xmm1
add rax, 0x20
movups xmm1, xmmword [rax]
aesenc xmm0, xmm1
movups xmm1, xmmword [rax + 0x10]
aesenc xmm0, xmm1
add rax, 0x20
movups xmm1, xmmword [rax]
aesenc xmm0, xmm1
movups xmm1, xmmword [rax + 0x10]
aesenc xmm0, xmm1
movups xmm1, xmmword [rax + 0x20]
aesenc xmm0, xmm1
movups xmm1, xmmword [rax + 0x30]
aesenc xmm0, xmm1
movups xmm1, xmmword [rax + 0x40]
aesenc xmm0, xmm1
movups xmm1, xmmword [rax + 0x50]
aesenc xmm0, xmm1
movups xmm1, xmmword [rax + 0x60]
aesenc xmm0, xmm1
movups xmm1, xmmword [rax + 0x70]
aesenc xmm0, xmm1
movups xmm1, xmmword [rax + 0x80]
aesenc xmm0, xmm1
movups xmm1, xmmword [rax + 0x90]
aesenclast xmm0, xmm1
movups xmmword [rdx], xmm0
ret
Function at 0x4aea20
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
push rbp
mov rbp, rsp
mov rcx, qword [rsp + 0x10]
mov rax, qword [rsp + 0x18]
mov rbx, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x28]
movups xmm0, xmmword [rax]
movups xmmword [rbx], xmm0
add rbx, 0x10
pxor xmm4, xmm4
cmp ecx, 0xc
je 0x4aeaf4
jb 0x4aeb53
movups xmm2, xmmword [rax + 0x10]
movups xmmword [rbx], xmm2
add rbx, 0x10
aeskeygenassist xmm1, xmm2, 1
call fcn.004ae900
aeskeygenassist xmm1, xmm0, 1
call fcn.004ae920
aeskeygenassist xmm1, xmm2, 2
call fcn.004ae900
aeskeygenassist xmm1, xmm0, 2
call fcn.004ae920
aeskeygenassist xmm1, xmm2, 4
call fcn.004ae900
aeskeygenassist xmm1, xmm0, 4
call fcn.004ae920
aeskeygenassist xmm1, xmm2, 8
call fcn.004ae900
aeskeygenassist xmm1, xmm0, 8
call fcn.004ae920
aeskeygenassist xmm1, xmm2, 0x10
call fcn.004ae900
aeskeygenassist xmm1, xmm0, 0x10
call fcn.004ae920
aeskeygenassist xmm1, xmm2, 0x20
call fcn.004ae900
aeskeygenassist xmm1, xmm0, 0x20
call fcn.004ae920
aeskeygenassist xmm1, xmm2, 0x40
call fcn.004ae900
jmp 0x4aebc1
movq xmm2, qword [rax + 0x10]
aeskeygenassist xmm1, xmm2, 1
call fcn.004ae860
aeskeygenassist xmm1, xmm2, 2
call fcn.004ae8c0
aeskeygenassist xmm1, xmm2, 4
call fcn.004ae860
aeskeygenassist xmm1, xmm2, 8
call fcn.004ae8c0
aeskeygenassist xmm1, xmm2, 0x10
call fcn.004ae860
aeskeygenassist xmm1, xmm2, 0x20
call fcn.004ae8c0
aeskeygenassist xmm1, xmm2, 0x40
call fcn.004ae860
aeskeygenassist xmm1, xmm2, 0x80
call fcn.004ae8c0
jmp 0x4aebc1
aeskeygenassist xmm1, xmm0, 1
call fcn.004ae820
aeskeygenassist xmm1, xmm0, 2
call fcn.004ae820
aeskeygenassist xmm1, xmm0, 4
call fcn.004ae820
aeskeygenassist xmm1, xmm0, 8
call fcn.004ae820
aeskeygenassist xmm1, xmm0, 0x10
call fcn.004ae820
aeskeygenassist xmm1, xmm0, 0x20
call fcn.004ae820
aeskeygenassist xmm1, xmm0, 0x40
call fcn.004ae820
aeskeygenassist xmm1, xmm0, 0x80
call fcn.004ae820
aeskeygenassist xmm1, xmm0, 0x1b
call fcn.004ae820
aeskeygenassist xmm1, xmm0, 0x36
call fcn.004ae820
sub rbx, 0x10
movups xmm1, xmmword [rbx]
movups xmmword [rdx], xmm1
dec rcx
movups xmm1, xmmword [rbx - 0x10]
aesimc xmm0, xmm1
movups xmmword [rdx + 0x10], xmm0
sub rbx, 0x10
add rdx, 0x10
dec rcx
jne 0x4aebce
movups xmm0, xmmword [rbx - 0x10]
movups xmmword [rdx + 0x10], xmm0
pop rbp
ret
Function at 0x4aed00
Capabilities:
Encode data using xor
Encrypt data using aes via x86 extensions

Disassembly:
mov rdi, qword [rsp + 8]
mov rsi, qword [rsp + 0x10]
mov rdx, qword [rsp + 0x18]
shr rdx, 2
dec rdx
movdqu xmm15, xmmword [0x0059b400]
movdqu xmm14, xmmword [0x0059b410]
movdqu xmm0, xmmword [rsi]
movdqu xmm11, xmmword [rsi + 0x10]
aesenc xmm0, xmm11
movdqu xmm11, xmmword [rsi + 0x20]
aesenc xmm0, xmm11
movdqu xmm11, xmmword [rsi + 0x30]
aesenc xmm0, xmm11
movdqu xmm11, xmmword [rsi + 0x40]
aesenc xmm0, xmm11
movdqu xmm11, xmmword [rsi + 0x50]
aesenc xmm0, xmm11
movdqu xmm11, xmmword [rsi + 0x60]
aesenc xmm0, xmm11
movdqu xmm11, xmmword [rsi + 0x70]
aesenc xmm0, xmm11
movdqu xmm11, xmmword [rsi + 0x80]
aesenc xmm0, xmm11
movdqu xmm11, xmmword [rsi + 0x90]
aesenc xmm0, xmm11
movdqu xmm11, xmmword [rsi + 0xa0]
cmp rdx, 0xc
jb 0x4aedeb
aesenc xmm0, xmm11
movdqu xmm11, xmmword [rsi + 0xb0]
aesenc xmm0, xmm11
movdqu xmm11, xmmword [rsi + 0xc0]
je 0x4aedeb
aesenc xmm0, xmm11
movdqu xmm11, xmmword [rsi + 0xd0]
aesenc xmm0, xmm11
movdqu xmm11, xmmword [rsi + 0xe0]
aesenclast xmm0, xmm11
pshufb xmm0, xmm15
pshufd xmm11, xmm0, 0xff
movdqu xmm12, xmm0
psrad xmm11, 0x1f
pand xmm11, xmm14
psrld xmm12, 0x1f
pslldq xmm12, 4
pslld xmm0, 1
pxor xmm0, xmm11
pxor xmm0, xmm12
movdqu xmmword [rdi + 0xe0], xmm0
pshufd xmm1, xmm0, 0x4e
pxor xmm1, xmm0
movdqu xmmword [rdi + 0xf0], xmm1
movdqu xmm2, xmm0
movdqu xmm3, xmm1
mov rax, 7
movdqu xmm11, xmm2
movdqu xmm12, xmm2
movdqu xmm13, xmm3
pclmulqdq xmm11, xmm0, 0
pclmulqdq xmm12, xmm0, 0x11
pclmulqdq xmm13, xmm1, 0
pxor xmm13, xmm11
pxor xmm13, xmm12
movdqu xmm4, xmm13
pslldq xmm4, 8
psrldq xmm13, 8
pxor xmm11, xmm4
pxor xmm12, xmm13
movdqu xmm2, xmm14
pclmulqdq xmm2, xmm11, 1
pshufd xmm11, xmm11, 0x4e
pxor xmm11, xmm2
movdqu xmm2, xmm14
pclmulqdq xmm2, xmm11, 1
pshufd xmm11, xmm11, 0x4e
pxor xmm2, xmm11
pxor xmm2, xmm12
movdqu xmmword [rdi + 0xc0], xmm2
pshufd xmm3, xmm2, 0x4e
pxor xmm3, xmm2
movdqu xmmword [rdi + 0xd0], xmm3
dec rax
lea rdi, [rdi - 0x20]
jne 0x4aee50
ret
Function at 0x4b0ca0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4b0d8c
push rbp
mov rbp, rsp
sub rsp, 0x40
movabs rdx, 0x6906b36918611512
mov qword [rsp + 0x19], rdx
movabs rdx, 0x1e6906b369186115
mov qword [rsp + 0x1a], rdx
movabs rdx, 0xf3f2699d65c72068
mov qword [rsp + 0x22], rdx
movabs rdx, 0x9050d080d02000b
mov qword [rsp + 0x2a], rdx
movabs rdx, 0xf10010905020905
mov qword [rsp + 0x30], rdx
movabs rdx, 0x806030800020305
mov qword [rsp + 0x38], rdx
xor eax, eax
jmp 0x4b0d2a
movzx r9d, byte [rsp + rsi + 0x19]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x47]
mov byte [rsp + rdi + 0x19], dl
mov byte [rsp + rsi + 0x19], r8b
add rax, 2
cmp rax, 0x16
jge 0x4b0d5c
movzx edx, byte [rsp + rax + 0x2a]
movzx esi, byte [rsp + rax + 0x2b]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x11
jae 0x4b0d7f
movzx r8d, byte [rsp + rdi + 0x19]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x47]
cmp rsi, 0x11
jb 0x4b0d10
jmp 0x4b0d73
xor eax, eax
lea rbx, [rsp + 0x19]
mov ecx, 0x11
call fcn.0044c4e0
add rsp, 0x40
pop rbp
ret
mov eax, esi
mov ecx, 0x11
call fcn.004617c0
mov eax, edi
mov ecx, 0x11
call fcn.004617c0
nop
call fcn.0045f540
jmp fcn.004b0ca0

Function at 0x4b1000
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4b10ea
push rbp
mov rbp, rsp
sub rsp, 0x40
movabs rdx, 0x729281b665b769ce
mov qword [rsp + 0x19], rdx
movabs rdx, 0x48db88729281b665
mov qword [rsp + 0x1c], rdx
movabs rdx, 0x9a91736f92997a79
mov qword [rsp + 0x24], rdx
movabs rdx, 0x1206110905000409
mov qword [rsp + 0x2c], rdx
movabs rdx, 0xd02050412061109
mov qword [rsp + 0x30], rdx
movabs rdx, 0xe05040a0c0a080d
mov qword [rsp + 0x38], rdx
xor eax, eax
jmp 0x4b108d
movzx r9d, byte [rsp + rsi + 0x19]
sub r9d, edx
lea edx, [r9 - 0x14]
mov byte [rsp + rdi + 0x19], dl
lea edx, [r8 - 0x14]
mov byte [rsp + rsi + 0x19], dl
add rax, 2
cmp rax, 0x14
jge 0x4b10ba
movzx edx, byte [rsp + rax + 0x2c]
movzx esi, byte [rsp + rax + 0x2d]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x13
jae 0x4b10dd
movzx r8d, byte [rsp + rdi + 0x19]
sub r8d, edx
cmp rsi, 0x13
jb 0x4b1070
jmp 0x4b10d1
xor eax, eax
lea rbx, [rsp + 0x19]
mov ecx, 0x13
call fcn.0044c4e0
add rsp, 0x40
pop rbp
ret
mov eax, esi
mov ecx, 0x13
call fcn.004617c0
mov eax, edi
mov ecx, 0x13
call fcn.004617c0
nop
call fcn.0045f540
jmp fcn.004b1000
Function at 0x4b2800
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4b28ca
push rbp
mov rbp, rsp
sub rsp, 0x48
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x58], rax
mov qword [rsp], rax
mov qword [rsp + 8], rbx
mov byte [rsp + 0x10], 0
call fcn.00403800
xorps xmm15, xmm15
mov r14, qword [0x006d58b8]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x18], 0xffffffffffffffff
jne 0x4b28af
mov rcx, qword [rsp + 0x60]
lea rdx, [rcx + 1]
mov qword [rsp + 0x40], rdx
lea rax, [0x00550080]
xor ebx, ebx
mov rcx, rdx
call fcn.00448320
mov rbx, qword [rsp + 0x60]
mov rcx, rax
xor edi, edi
mov rsi, qword [rsp + 0x40]
mov rax, qword [rsp + 0x58]
nop dword [rax]
call fcn.004b5000
inc rbx
cmp rcx, rbx
jae 0x4b289e
mov edi, 1
lea rsi, [0x00550080]
call fcn.00448400
mov word [rax + rbx*2 - 2], 0
xor edi, edi
xor esi, esi
add rsp, 0x48
pop rbp
ret
xor eax, eax
xor ebx, ebx
mov rcx, rbx
lea rdi, [0x0059b728]
lea rsi, [0x0059b2a0]
add rsp, 0x48
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.0045f540
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.004b2800

Function at 0x4b5560
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4b565d
push rbp
mov rbp, rsp
sub rsp, 0x48
movabs rdx, 0xed7b76dc6209b1d
mov qword [rsp + 0x18], rdx
movabs rdx, 0x25747c6912240ed7
mov qword [rsp + 0x1e], rdx
movabs rdx, 0xdbd41520d46f15d0
mov qword [rsp + 0x26], rdx
movabs rdx, 0x1203070507010f15
mov qword [rsp + 0x2e], rdx
movabs rdx, 0x130f1314070b110b
mov qword [rsp + 0x36], rdx
movabs rdx, 0x1202130f1314070b
mov qword [rsp + 0x38], rdx
movabs rdx, 0x60d080e09001111
mov qword [rsp + 0x40], rdx
xor eax, eax
jmp 0x4b5600
movzx r9d, byte [rsp + rsi + 0x18]
sub r9d, edx
lea edx, [r9 + 0x6c]
mov byte [rsp + rdi + 0x18], dl
lea edx, [r8 + 0x6c]
mov byte [rsp + rsi + 0x18], dl
add rax, 2
nop dword [rax]
cmp rax, 0x1a
jge 0x4b562d
movzx edx, byte [rsp + rax + 0x2e]
movzx esi, byte [rsp + rax + 0x2f]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x16
jae 0x4b5650
movzx r8d, byte [rsp + rdi + 0x18]
sub r8d, edx
cmp rsi, 0x16
jb 0x4b55df
jmp 0x4b5644
xor eax, eax
lea rbx, [rsp + 0x18]
mov ecx, 0x16
call fcn.0044c4e0
add rsp, 0x48
pop rbp
ret
mov eax, esi
mov ecx, 0x16
call fcn.004617c0
mov eax, edi
mov ecx, 0x16
call fcn.004617c0
nop
nop dword [rax]
call fcn.0045f540
jmp fcn.004b5560
Function at 0x4b5680
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4b576c
push rbp
mov rbp, rsp
sub rsp, 0x40
movabs rdx, 0xa38473b96d7a6570
mov qword [rsp + 0x1d], rdx
movabs rdx, 0x94a38473b96d7a65
mov qword [rsp + 0x1e], rdx
movabs rdx, 0x64a0c0a147648c89
mov qword [rsp + 0x26], rdx
movabs rdx, 0xf07070e080d0c0a
mov qword [rsp + 0x2e], rdx
movabs rdx, 0x6090f07070e080d
mov qword [rsp + 0x30], rdx
movabs rdx, 0x20e0e0f0807040f
mov qword [rsp + 0x38], rdx
xor eax, eax
jmp 0x4b570a
movzx r9d, byte [rsp + rsi + 0x1d]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x2d]
mov byte [rsp + rdi + 0x1d], dl
mov byte [rsp + rsi + 0x1d], r8b
add rax, 2
cmp rax, 0x12
jge 0x4b573c
movzx edx, byte [rsp + rax + 0x2e]
movzx esi, byte [rsp + rax + 0x2f]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x11
jae 0x4b575f
movzx r8d, byte [rsp + rdi + 0x1d]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x2d]
cmp rsi, 0x11
jb 0x4b56f0
jmp 0x4b5753
xor eax, eax
lea rbx, [rsp + 0x1d]
mov ecx, 0x11
call fcn.0044c4e0
add rsp, 0x40
pop rbp
ret
mov eax, esi
mov ecx, 0x11
call fcn.004617c0
mov eax, edi
mov ecx, 0x11
call fcn.004617c0
nop
call fcn.0045f540
jmp fcn.004b5680