joyce8/EMBER2024-capa huggingface dataset:
Function at 0x48c840
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x48c93d
push rbp
mov rbp, rsp
sub rsp, 0x48
movabs rdx, 0x9f30da3591906988
mov qword [rsp + 0x35], rdx
movabs rdx, 0x327d9e9f30da3591
mov qword [rsp + 0x38], rdx
movabs rdx, 0xaea5938b32d8d58d
mov qword [rsp + 0x40], rdx
movabs rdx, 0xb0f0509090a0d
mov qword [rsp + 0x19], rdx
movabs rdx, 0x11080f0c0a020d01
mov qword [rsp + 0x21], rdx
movabs rdx, 0x710100f11080f0c
mov qword [rsp + 0x25], rdx
movabs rdx, 0x7120d0703010f12
mov qword [rsp + 0x2d], rdx
xor eax, eax
jmp 0x48c8e0
movzx r9d, byte [rsp + rsi + 0x35]
sub r9d, edx
lea edx, [r9 - 0x45]
mov byte [rsp + rdi + 0x35], dl
lea edx, [r8 - 0x45]
mov byte [rsp + rsi + 0x35], dl
add rax, 2
nop dword [rax]
cmp rax, 0x1c
jge 0x48c90d
movzx edx, byte [rsp + rax + 0x19]
movzx esi, byte [rsp + rax + 0x1a]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x13
jae 0x48c930
movzx r8d, byte [rsp + rdi + 0x35]
sub r8d, edx
cmp rsi, 0x13
jb 0x48c8bf
jmp 0x48c924
xor eax, eax
lea rbx, [rsp + 0x35]
mov ecx, 0x13
call fcn.0045b080
add rsp, 0x48
pop rbp
ret
mov eax, esi
mov ecx, 0x13
call fcn.004607e0
mov eax, edi
mov ecx, 0x13
call fcn.004607e0
nop
nop dword [rax]
call fcn.0045e500
jmp fcn.0048c840

Function at 0x48dd00
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x48de1a
push rbp
mov rbp, rsp
sub rsp, 0x58
movabs rdx, 0x3d2e38704f314b2f
mov qword [rsp + 0x3f], rdx
movabs rdx, 0x57193b3d373c2b26
mov qword [rsp + 0x47], rdx
movabs rdx, 0x3057193b3d373c2b
mov qword [rsp + 0x48], rdx
movabs rdx, 0x4a224e27303a4856
mov qword [rsp + 0x50], rdx
movabs rdx, 0x917040311131816
mov qword [rsp + 0x1b], rdx
movabs rdx, 0x103071409170403
mov qword [rsp + 0x1f], rdx
movabs rdx, 0xd07121009140f0c
mov qword [rsp + 0x27], rdx
movabs rdx, 0xf110c0a00140817
mov qword [rsp + 0x2f], rdx
movabs rdx, 0xf000d1215060e15
mov qword [rsp + 0x37], rdx
xor eax, eax
jmp 0x48ddb7
movzx r9d, byte [rsp + rsi + 0x3f]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x27]
mov byte [rsp + rdi + 0x3f], dl
mov byte [rsp + rsi + 0x3f], r8b
add rax, 2
cmp rax, 0x24
jge 0x48dde9
movzx edx, byte [rsp + rax + 0x1b]
movzx esi, byte [rsp + rax + 0x1c]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x19
jae 0x48de0d
movzx r8d, byte [rsp + rdi + 0x3f]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x27]
cmp rsi, 0x19
jb 0x48dd9d
jmp 0x48de01
xor eax, eax
lea rbx, [rsp + 0x3f]
mov ecx, 0x19
call fcn.0045b080
add rsp, 0x58
pop rbp
nop
ret
mov eax, esi
mov ecx, 0x19
call fcn.004607e0
mov eax, edi
mov ecx, 0x19
call fcn.004607e0
nop
call fcn.0045e500
nop
jmp fcn.0048dd00
Function at 0x48f7a0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x48f8ba
push rbp
mov rbp, rsp
sub rsp, 0x60
movabs rdx, 0x8638368678483131
mov qword [rsp + 0x41], rdx
movabs rdx, 0x3036da043dede98f
mov qword [rsp + 0x49], rdx
movabs rdx, 0x82d39f3337398630
mov qword [rsp + 0x50], rdx
movabs rdx, 0xa3df81cc8c763439
mov qword [rsp + 0x58], rdx
movabs rdx, 0xc0b0d1a141e0902
mov qword [rsp + 0x1b], rdx
movabs rdx, 0xa0b181d091c0c0b
mov qword [rsp + 0x21], rdx
movabs rdx, 0x100415040c1d091d
mov qword [rsp + 0x29], rdx
movabs rdx, 0x3191b0b0c1c1607
mov qword [rsp + 0x31], rdx
movabs rdx, 0x9181d1a0b020808
mov qword [rsp + 0x39], rdx
xor eax, eax
jmp 0x48f857
movzx r9d, byte [rsp + rsi + 0x41]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x76]
mov byte [rsp + rdi + 0x41], dl
mov byte [rsp + rsi + 0x41], r8b
add rax, 2
cmp rax, 0x26
jge 0x48f889
movzx edx, byte [rsp + rax + 0x1b]
movzx esi, byte [rsp + rax + 0x1c]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x1f
jae 0x48f8ad
movzx r8d, byte [rsp + rdi + 0x41]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x76]
cmp rsi, 0x1f
jb 0x48f83d
jmp 0x48f8a1
xor eax, eax
lea rbx, [rsp + 0x41]
mov ecx, 0x1f
call fcn.0045b080
add rsp, 0x60
pop rbp
nop
ret
mov eax, esi
mov ecx, 0x1f
call fcn.004607e0
mov eax, edi
mov ecx, 0x1f
call fcn.004607e0
nop
call fcn.0045e500
nop
jmp fcn.0048f7a0

Function at 0x492960
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x492a87
push rbp
mov rbp, rsp
sub rsp, 0x68
movabs rdx, 0x3134384a413c4d38
mov qword [rsp + 0x45], rdx
movabs rdx, 0x501b193134384a41
mov qword [rsp + 0x48], rdx
movabs rdx, 0x2d2a34293532311c
mov qword [rsp + 0x50], rdx
movabs rdx, 0x19333b4b682e953e
mov qword [rsp + 0x58], rdx
movabs rdx, 0x3932293a3625382e
mov qword [rsp + 0x60], rdx
movabs rdx, 0x12141422091a080b
mov qword [rsp + 0x1d], rdx
movabs rdx, 0xb1b090f1d1a0418
mov qword [rsp + 0x25], rdx
movabs rdx, 0x10111d1522200313
mov qword [rsp + 0x2d], rdx
movabs rdx, 0xa17162003110213
mov qword [rsp + 0x35], rdx
movabs rdx, 0x16011b1b14181c1f
mov qword [rsp + 0x3d], rdx
xor eax, eax
jmp 0x492a29
movzx r9d, byte [rsp + rsi + 0x45]
sub r9d, edx
lea edx, [r9 + 0x20]
mov byte [rsp + rdi + 0x45], dl
lea edx, [r8 + 0x20]
mov byte [rsp + rsi + 0x45], dl
add rax, 2
cmp rax, 0x28
jge 0x492a57
movzx edx, byte [rsp + rax + 0x1d]
movzx esi, byte [rsp + rax + 0x1e]
mov edi, edx
xor edx, esi
add edx, eax
nop
cmp rdi, 0x23
jae 0x492a7a
movzx r8d, byte [rsp + rdi + 0x45]
sub r8d, edx
cmp rsi, 0x23
jb 0x492a0c
jmp 0x492a6e
xor eax, eax
lea rbx, [rsp + 0x45]
mov ecx, 0x23
call fcn.0045b080
add rsp, 0x68
pop rbp
ret
mov eax, esi
mov ecx, 0x23
call fcn.004607e0
mov eax, edi
mov ecx, 0x23
call fcn.004607e0
nop
call fcn.0045e500
jmp fcn.00492960
Function at 0x49e140
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x49e278
push rbp
mov rbp, rsp
sub rsp, 0x68
movabs rdx, 0xfc375c3e46b2b172
mov qword [rsp + 0x44], rdx
movabs rdx, 0x4e657825fc375c3e
mov qword [rsp + 0x48], rdx
movabs rdx, 0x4156436135246249
mov qword [rsp + 0x50], rdx
movabs rdx, 0x70649f74750d203d
mov qword [rsp + 0x58], rdx
movabs rdx, 0x3877163ef8256524
mov qword [rsp + 0x60], rdx
movabs rdx, 0x2111a2117190416
mov qword [rsp + 0x18], rdx
movabs rdx, 0x111911011a070817
mov qword [rsp + 0x20], rdx
movabs rdx, 0x1f0e110411191101
mov qword [rsp + 0x24], rdx
movabs rdx, 0x1913040c060f170b
mov qword [rsp + 0x2c], rdx
movabs rdx, 0x11e1f0112081413
mov qword [rsp + 0x34], rdx
movabs rdx, 0x1c0d210522011205
mov qword [rsp + 0x3c], rdx
xor eax, eax
jmp 0x49e218
movzx r9d, byte [rsp + rsi + 0x44]
sub r9d, edx
lea edx, [r9 + 0x4b]
mov byte [rsp + rdi + 0x44], dl
lea edx, [r8 + 0x4b]
mov byte [rsp + rsi + 0x44], dl
add rax, 2
cmp rax, 0x2c
jge 0x49e248
movzx edx, byte [rsp + rax + 0x18]
movzx esi, byte [rsp + rax + 0x19]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x24
jae 0x49e26b
movzx r8d, byte [rsp + rdi + 0x44]
sub r8d, edx
nop dword [rax]
cmp rsi, 0x24
jb 0x49e1fb
jmp 0x49e25f
xor eax, eax
lea rbx, [rsp + 0x44]
mov ecx, 0x24
call fcn.0045b080
add rsp, 0x68
pop rbp
ret
mov eax, esi
mov ecx, 0x24
call fcn.004607e0
mov eax, edi
mov ecx, 0x24
call fcn.004607e0
nop
call fcn.0045e500
nop dword [rax]
jmp fcn.0049e140
Function at 0x49e2a0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
lea r12, [rsp - 0x18]
cmp r12, qword [r14 + 0x10]
jbe 0x49e427
push rbp
mov rbp, rsp
sub rsp, 0x90
movabs rdx, 0x6e6d7062b05e0244
mov qword [rsp + 0x5f], rdx
movabs rdx, 0xbe6e6d7062b05e02
mov qword [rsp + 0x60], rdx
movabs rdx, 0xa75c6e6966a88d00
mov qword [rsp + 0x68], rdx
movabs rdx, 0x696274536e616353
mov qword [rsp + 0x70], rdx
movabs rdx, 0x4d5b5c668820315c
mov qword [rsp + 0x78], rdx
movabs rdx, 0x6d5e597f2a75624f
mov qword [rsp + 0x80], rdx
movabs rdx, 0xaf31aa6f246580a0
mov qword [rsp + 0x88], rdx
movabs rdx, 0x28091c2b220c2701
mov qword [rsp + 0x1f], rdx
movabs rdx, 0x1a302c032a112d20
mov qword [rsp + 0x27], rdx
movabs rdx, 0x52c15040f022c26
mov qword [rsp + 0x2f], rdx
movabs rdx, 0x212821270d291e19
mov qword [rsp + 0x37], rdx
movabs rdx, 0xd112b0a2b00162a
mov qword [rsp + 0x3f], rdx
movabs rdx, 0x60727240b20261f
mov qword [rsp + 0x47], rdx
movabs rdx, 0x6092b2508202c2a
mov qword [rsp + 0x4f], rdx
movabs rdx, 0xf1110201a2e0f1f
mov qword [rsp + 0x57], rdx
xor eax, eax
jmp 0x49e3c2
movzx r9d, byte [rsp + rsi + 0x5f]
sub r9d, edx
lea edx, [r9 + 0x37]
mov byte [rsp + rdi + 0x5f], dl
lea edx, [r8 + 0x37]
mov byte [rsp + rsi + 0x5f], dl
add rax, 2
cmp rax, 0x40
jge 0x49e3ef
movzx edx, byte [rsp + rax + 0x1f]
movzx esi, byte [rsp + rax + 0x20]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x31
jae 0x49e41a
movzx r8d, byte [rsp + rdi + 0x5f]
sub r8d, edx
cmp rsi, 0x31
jb 0x49e3a5
jmp 0x49e40e
xor eax, eax
lea rbx, [rsp + 0x5f]
mov ecx, 0x31
nop dword [rax + rax]
call fcn.0045b080
add rsp, 0x90
pop rbp
ret
mov eax, esi
mov ecx, 0x31
call fcn.004607e0
mov eax, edi
mov ecx, 0x31
call fcn.004607e0
nop
call fcn.0045e500
jmp fcn.0049e2a0
Function at 0x49f960
Capabilities:
Encrypt data using rc4 prga

Disassembly:
lea r12, [rsp - 0x18]
cmp r12, qword [r14 + 0x10]
jbe 0x49fae7
push rbp
mov rbp, rsp
sub rsp, 0x90
movabs rdx, 0xe36f6ef4dea16fcf
mov qword [rsp + 0x60], rdx
movabs rdx, 0x69b5de35b063b79f
mov qword [rsp + 0x68], rdx
movabs rdx, 0xaf883c6ee5ec19ab
mov qword [rsp + 0x70], rdx
movabs rdx, 0x90bcc1dcf5f67363
mov qword [rsp + 0x78], rdx
movabs rdx, 0x10fa746c0ea20a87
mov qword [rsp + 0x80], rdx
movabs rdx, 0x986f776f4f74f8fc
mov qword [rsp + 0x88], rdx
movabs rdx, 0x161910172b2b0720
mov qword [rsp + 0x1a], rdx
movabs rdx, 0xc0e20120b081619
mov qword [rsp + 0x20], rdx
movabs rdx, 0x1c0015291e26090b
mov qword [rsp + 0x28], rdx
movabs rdx, 0xa2207281c041f03
mov qword [rsp + 0x30], rdx
movabs rdx, 0xb15222e2719120b
mov qword [rsp + 0x38], rdx
movabs rdx, 0xe12021b2e2f1523
mov qword [rsp + 0x40], rdx
movabs rdx, 0x2821092218041c21
mov qword [rsp + 0x48], rdx
movabs rdx, 0x131d29111d27131f
mov qword [rsp + 0x50], rdx
movabs rdx, 0x1a11270d042f2b0b
mov qword [rsp + 0x58], rdx
xor eax, eax
jmp 0x49fa82
movzx r9d, byte [rsp + rsi + 0x60]
sub r9d, edx
lea edx, [r9 - 0x3e]
mov byte [rsp + rdi + 0x60], dl
lea edx, [r8 - 0x3e]
mov byte [rsp + rsi + 0x60], dl
add rax, 2
cmp rax, 0x46
jge 0x49faaf
movzx edx, byte [rsp + rax + 0x1a]
movzx esi, byte [rsp + rax + 0x1b]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x30
jae 0x49fada
movzx r8d, byte [rsp + rdi + 0x60]
sub r8d, edx
cmp rsi, 0x30
jb 0x49fa65
jmp 0x49face
xor eax, eax
lea rbx, [rsp + 0x60]
mov ecx, 0x30
nop dword [rax + rax]
call fcn.0045b080
add rsp, 0x90
pop rbp
ret
mov eax, esi
mov ecx, 0x30
call fcn.004607e0
mov eax, edi
mov ecx, 0x30
call fcn.004607e0
nop
call fcn.0045e500
jmp fcn.0049f960
Function at 0x4a05c0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4a0707
push rbp
mov rbp, rsp
sub rsp, 0x78
movabs rdx, 0x20eb45576b35693f
mov qword [rsp + 0x53], rdx
movabs rdx, 0x473473656d20eb45
mov qword [rsp + 0x58], rdx
movabs rdx, 0xe1675f143a20654f
mov qword [rsp + 0x60], rdx
movabs rdx, 0x6ffdfc537c332c34
mov qword [rsp + 0x68], rdx
movabs rdx, 0x645f6c56610b406e
mov qword [rsp + 0x70], rdx
movabs rdx, 0xc10171b00150214
mov qword [rsp + 0x1f], rdx
movabs rdx, 0x211016170c10171b
mov qword [rsp + 0x23], rdx
movabs rdx, 0x1a110d2311021106
mov qword [rsp + 0x2b], rdx
movabs rdx, 0x1106231302231e06
mov qword [rsp + 0x33], rdx
movabs rdx, 0xb05211813131902
mov qword [rsp + 0x3b], rdx
movabs rdx, 0x5040b110c121a03
mov qword [rsp + 0x43], rdx
movabs rdx, 0x16021e1f12111902
mov qword [rsp + 0x4b], rdx
xor eax, eax
jmp 0x4a06a7
movzx r9d, byte [rsp + rsi + 0x53]
sub r9d, edx
lea edx, [r9 + 0x46]
mov byte [rsp + rdi + 0x53], dl
lea edx, [r8 + 0x46]
mov byte [rsp + rsi + 0x53], dl
add rax, 2
cmp rax, 0x34
jge 0x4a06d7
movzx edx, byte [rsp + rax + 0x1f]
movzx esi, byte [rsp + rax + 0x20]
mov edi, edx
xor edx, esi
add edx, eax
nop dword [rax]
cmp rdi, 0x25
jae 0x4a06fa
movzx r8d, byte [rsp + rdi + 0x53]
sub r8d, edx
cmp rsi, 0x25
jb 0x4a068a
jmp 0x4a06ee
xor eax, eax
lea rbx, [rsp + 0x53]
mov ecx, 0x25
call fcn.0045b080
add rsp, 0x78
pop rbp
ret
mov eax, esi
mov ecx, 0x25
call fcn.004607e0
mov eax, edi
mov ecx, 0x25
call fcn.004607e0
nop
call fcn.0045e500
jmp fcn.004a05c0
Function at 0x4a3840
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4a396c
push rbp
mov rbp, rsp
sub rsp, 0x68
movabs rdx, 0x612ff1f770d3e171
mov qword [rsp + 0x48], rdx
movabs rdx, 0xe97dfdc2203a5539
mov qword [rsp + 0x50], rdx
movabs rdx, 0xe1dd207479602008
mov qword [rsp + 0x58], rdx
movabs rdx, 0xcf7af7e462fa6ce5
mov qword [rsp + 0x60], rdx
movabs rdx, 0x10131e130c000e1e
mov qword [rsp + 0x1e], rdx
movabs rdx, 0x1f1d1a160d041a13
mov qword [rsp + 0x26], rdx
movabs rdx, 0x1a091f1d1a160d04
mov qword [rsp + 0x28], rdx
movabs rdx, 0x1c120810181e081d
mov qword [rsp + 0x30], rdx
movabs rdx, 0x1d051d001c17101c
mov qword [rsp + 0x38], rdx
movabs rdx, 0x1d1a0901020c0f0e
mov qword [rsp + 0x40], rdx
xor eax, eax
jmp 0x4a3906
movzx r9d, byte [rsp + rsi + 0x48]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x64]
mov byte [rsp + rdi + 0x48], dl
mov byte [rsp + rsi + 0x48], r8b
add rax, 2
cmp rax, 0x2a
jge 0x4a393c
movzx edx, byte [rsp + rax + 0x1e]
movzx esi, byte [rsp + rax + 0x1f]
mov edi, edx
xor edx, esi
add edx, eax
nop dword [rax]
cmp rdi, 0x20
jae 0x4a395f
movzx r8d, byte [rsp + rdi + 0x48]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x64]
cmp rsi, 0x20
jb 0x4a38ec
jmp 0x4a3953
xor eax, eax
lea rbx, [rsp + 0x48]
mov ecx, 0x20
call fcn.0045b080
add rsp, 0x68
pop rbp
ret
mov eax, esi
mov ecx, 0x20
call fcn.004607e0
mov eax, edi
mov ecx, 0x20
call fcn.004607e0
nop
call fcn.0045e500
jmp fcn.004a3840

Function at 0x4a3980
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4a3aa7
push rbp
mov rbp, rsp
sub rsp, 0x60
movabs rdx, 0x2b2f03bcb5e5ae63
mov qword [rsp + 0x3f], rdx
movabs rdx, 0xba2b2f03bcb5e5ae
mov qword [rsp + 0x40], rdx
movabs rdx, 0xaa9ab7956f20b573
mov qword [rsp + 0x48], rdx
movabs rdx, 0x92eeb2989ceeb974
mov qword [rsp + 0x50], rdx
movabs rdx, 0xb463c1b362208366
mov qword [rsp + 0x58], rdx
movabs rdx, 0xe0513021718050e
mov qword [rsp + 0x1d], rdx
movabs rdx, 0xf0d0e0513021718
mov qword [rsp + 0x1f], rdx
movabs rdx, 0x3150e1208200715
mov qword [rsp + 0x27], rdx
movabs rdx, 0x1e041d1002181414
mov qword [rsp + 0x2f], rdx
movabs rdx, 0x1050a1a16191303
mov qword [rsp + 0x37], rdx
xor eax, eax
jmp 0x4a3a49
movzx r9d, byte [rsp + rsi + 0x3f]
sub r9d, edx
lea edx, [r9 - 0x1b]
mov byte [rsp + rdi + 0x3f], dl
lea edx, [r8 - 0x1b]
mov byte [rsp + rsi + 0x3f], dl
add rax, 2
cmp rax, 0x22
jge 0x4a3a77
movzx edx, byte [rsp + rax + 0x1d]
movzx esi, byte [rsp + rax + 0x1e]
mov edi, edx
xor edx, esi
add edx, eax
nop
cmp rdi, 0x21
jae 0x4a3a9a
movzx r8d, byte [rsp + rdi + 0x3f]
sub r8d, edx
cmp rsi, 0x21
jb 0x4a3a2c
jmp 0x4a3a8e
xor eax, eax
lea rbx, [rsp + 0x3f]
mov ecx, 0x21
call fcn.0045b080
add rsp, 0x60
pop rbp
ret
mov eax, esi
mov ecx, 0x21
call fcn.004607e0
mov eax, edi
mov ecx, 0x21
call fcn.004607e0
nop
call fcn.0045e500
jmp fcn.004a3980
Function at 0x4a3c00
Capabilities:
Decrypt data using aes via x86 extensions

Disassembly:
mov rcx, qword [rsp + 8]
mov rax, qword [rsp + 0x10]
mov rdx, qword [rsp + 0x18]
mov rbx, qword [rsp + 0x20]
movups xmm1, xmmword [rax]
movups xmm0, xmmword [rbx]
add rax, 0x10
pxor xmm0, xmm1
sub rcx, 0xc
je 0x4a3c3f
jb 0x4a3c54
movups xmm1, xmmword [rax]
aesdec xmm0, xmm1
movups xmm1, xmmword [rax + 0x10]
aesdec xmm0, xmm1
add rax, 0x20
movups xmm1, xmmword [rax]
aesdec xmm0, xmm1
movups xmm1, xmmword [rax + 0x10]
aesdec xmm0, xmm1
add rax, 0x20
movups xmm1, xmmword [rax]
aesdec xmm0, xmm1
movups xmm1, xmmword [rax + 0x10]
aesdec xmm0, xmm1
movups xmm1, xmmword [rax + 0x20]
aesdec xmm0, xmm1
movups xmm1, xmmword [rax + 0x30]
aesdec xmm0, xmm1
movups xmm1, xmmword [rax + 0x40]
aesdec xmm0, xmm1
movups xmm1, xmmword [rax + 0x50]
aesdec xmm0, xmm1
movups xmm1, xmmword [rax + 0x60]
aesdec xmm0, xmm1
movups xmm1, xmmword [rax + 0x70]
aesdec xmm0, xmm1
movups xmm1, xmmword [rax + 0x80]
aesdec xmm0, xmm1
movups xmm1, xmmword [rax + 0x90]
aesdeclast xmm0, xmm1
movups xmmword [rdx], xmm0
ret
Function at 0x4a3cc0
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
push rbp
mov rbp, rsp
mov rcx, qword [rsp + 0x10]
mov rax, qword [rsp + 0x18]
mov rbx, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x28]
movups xmm0, xmmword [rax]
movups xmmword [rbx], xmm0
add rbx, 0x10
pxor xmm4, xmm4
cmp ecx, 0xc
je 0x4a3d94
jb 0x4a3df3
movups xmm2, xmmword [rax + 0x10]
movups xmmword [rbx], xmm2
add rbx, 0x10
aeskeygenassist xmm1, xmm2, 1
call fcn.004a3ba0
aeskeygenassist xmm1, xmm0, 1
call fcn.004a3bc0
aeskeygenassist xmm1, xmm2, 2
call fcn.004a3ba0
aeskeygenassist xmm1, xmm0, 2
call fcn.004a3bc0
aeskeygenassist xmm1, xmm2, 4
call fcn.004a3ba0
aeskeygenassist xmm1, xmm0, 4
call fcn.004a3bc0
aeskeygenassist xmm1, xmm2, 8
call fcn.004a3ba0
aeskeygenassist xmm1, xmm0, 8
call fcn.004a3bc0
aeskeygenassist xmm1, xmm2, 0x10
call fcn.004a3ba0
aeskeygenassist xmm1, xmm0, 0x10
call fcn.004a3bc0
aeskeygenassist xmm1, xmm2, 0x20
call fcn.004a3ba0
aeskeygenassist xmm1, xmm0, 0x20
call fcn.004a3bc0
aeskeygenassist xmm1, xmm2, 0x40
call fcn.004a3ba0
jmp 0x4a3e61
movq xmm2, qword [rax + 0x10]
aeskeygenassist xmm1, xmm2, 1
call fcn.004a3b00
aeskeygenassist xmm1, xmm2, 2
call fcn.004a3b60
aeskeygenassist xmm1, xmm2, 4
call fcn.004a3b00
aeskeygenassist xmm1, xmm2, 8
call fcn.004a3b60
aeskeygenassist xmm1, xmm2, 0x10
call fcn.004a3b00
aeskeygenassist xmm1, xmm2, 0x20
call fcn.004a3b60
aeskeygenassist xmm1, xmm2, 0x40
call fcn.004a3b00
aeskeygenassist xmm1, xmm2, 0x80
call fcn.004a3b60
jmp 0x4a3e61
aeskeygenassist xmm1, xmm0, 1
call fcn.004a3ac0
aeskeygenassist xmm1, xmm0, 2
call fcn.004a3ac0
aeskeygenassist xmm1, xmm0, 4
call fcn.004a3ac0
aeskeygenassist xmm1, xmm0, 8
call fcn.004a3ac0
aeskeygenassist xmm1, xmm0, 0x10
call fcn.004a3ac0
aeskeygenassist xmm1, xmm0, 0x20
call fcn.004a3ac0
aeskeygenassist xmm1, xmm0, 0x40
call fcn.004a3ac0
aeskeygenassist xmm1, xmm0, 0x80
call fcn.004a3ac0
aeskeygenassist xmm1, xmm0, 0x1b
call fcn.004a3ac0
aeskeygenassist xmm1, xmm0, 0x36
call fcn.004a3ac0
sub rbx, 0x10
movups xmm1, xmmword [rbx]
movups xmmword [rdx], xmm1
dec rcx
movups xmm1, xmmword [rbx - 0x10]
aesimc xmm0, xmm1
movups xmmword [rdx + 0x10], xmm0
sub rbx, 0x10
add rdx, 0x10
dec rcx
jne 0x4a3e6e
movups xmm0, xmmword [rbx - 0x10]
movups xmmword [rdx + 0x10], xmm0
pop rbp
ret
Function at 0x4a4180
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4a438b
push rbp
mov rbp, rsp
sub rsp, 0x48
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x68], rcx
add qword [rax + 0x58], rcx
mov rdx, qword [rax + 0x50]
test rdx, rdx
jle 0x4a42a4
cmp rdx, 0x40
ja 0x4a437d
mov qword [rsp + 0x70], rdi
mov qword [rsp + 0x60], rbx
lea rsi, [rdx - 0x40]
mov r8, rsi
neg rsi
sar r8, 0x3f
and r8, rdx
lea rdx, [rax + r8]
lea rdx, [rdx + 0x10]
cmp rcx, rsi
cmovl rsi, rcx
mov qword [rsp + 0x28], rsi
cmp rbx, rdx
je 0x4a4214
mov rax, rdx
mov rcx, rsi
call fcn.00461160
mov rax, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x68]
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x28]
mov rdi, qword [rsp + 0x70]
mov rdx, qword [rax + 0x50]
add rdx, rsi
mov qword [rax + 0x50], rdx
nop
cmp rdx, 0x40
jne 0x4a4280
mov qword [rsp], rax
lea rcx, [rax + 0x10]
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], 0x40
mov qword [rsp + 0x18], 0x40
call fcn.004a4860
xorps xmm15, xmm15
mov r14, qword [0x006c7ac0]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x58]
mov qword [rax + 0x50], 0
mov rcx, qword [rsp + 0x68]
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x28]
mov rdi, qword [rsp + 0x70]
nop dword [rax]
cmp rcx, rsi
jb 0x4a4375
sub rdi, rsi
mov rdx, rdi
neg rdx
sar rdx, 0x3f
and rdx, rsi
mov r8, rcx
sub r8, rsi
add rbx, rdx
jmp 0x4a42a7
mov r8, rcx
cmp r8, 0x40
jl 0x4a4325
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x38], r8
mov qword [rsp + 0x30], rdi
mov qword [rsp], rax
mov qword [rsp + 8], rbx
and r8, 0xffffffffffffffc0
mov qword [rsp + 0x20], r8
mov qword [rsp + 0x10], r8
mov qword [rsp + 0x18], rdi
call fcn.004a4860
xorps xmm15, xmm15
mov r14, qword [0x006c7ac0]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x20]
mov rcx, qword [rsp + 0x30]
mov rdx, rax
sub rax, rcx
sar rax, 0x3f
mov r8, qword [rsp + 0x38]
and rax, r8
and rax, 0xffffffffffffffc0
mov rcx, qword [rsp + 0x40]
lea rbx, [rcx + rax]
sub r8, rdx
mov rax, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x68]
test r8, r8
je 0x4a4368
lea rdx, [rax + 0x10]
cmp r8, 0x40
mov esi, 0x40
cmovl rsi, r8
nop dword [rax + rax]
cmp rbx, rdx
je 0x4a4364
mov qword [rsp + 0x38], rsi
mov rax, rdx
mov rcx, rsi
call fcn.00461160
mov rax, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x38]
mov qword [rax + 0x50], rsi
mov rax, rcx
xor ebx, ebx
xor ecx, ecx
add rsp, 0x48
pop rbp
ret
mov rax, rsi
call fcn.004608a0
mov rax, rdx
mov ecx, 0x40
call fcn.004608a0
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
nop
call fcn.0045e500
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
jmp fcn.004a4180
Function at 0x4a5940
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4a5a07
push rbp
mov rbp, rsp
sub rsp, 0x30
movabs rdx, 0x314a3f0770394a57
mov qword [rsp + 0x26], rdx
mov word [rsp + 0x2e], 0x3873
movabs rdx, 0x101040004020105
mov qword [rsp + 0x18], rdx
movabs rdx, 0x502060806020101
mov qword [rsp + 0x1e], rdx
xor eax, eax
jmp 0x4a59a7
movzx r9d, byte [rsp + rsi + 0x26]
sub r9d, edx
lea edx, [r9 + 0x1d]
mov byte [rsp + rdi + 0x26], dl
lea edx, [r8 + 0x1d]
mov byte [rsp + rsi + 0x26], dl
add rax, 2
cmp rax, 0xe
jge 0x4a59d7
movzx edx, byte [rsp + rax + 0x18]
movzx esi, byte [rsp + rax + 0x19]
mov edi, edx
xor edx, esi
add edx, eax
nop dword [rax]
cmp rdi, 0xa
jae 0x4a59fa
movzx r8d, byte [rsp + rdi + 0x26]
sub r8d, edx
cmp rsi, 0xa
jb 0x4a598a
jmp 0x4a59ee
xor eax, eax
lea rbx, [rsp + 0x26]
mov ecx, 0xa
call fcn.0045b080
add rsp, 0x30
pop rbp
ret
mov eax, esi
mov ecx, 0xa
call fcn.004607e0
mov eax, edi
mov ecx, 0xa
call fcn.004607e0
nop
call fcn.0045e500
jmp fcn.004a5940
Function at 0x4b0340
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4b042a
push rbp
mov rbp, rsp
sub rsp, 0x48
movabs rdx, 0x74c6927078656ec8
mov qword [rsp + 0x33], rdx
movabs rdx, 0x616520090b74c692
mov qword [rsp + 0x38], rdx
movabs rdx, 0xb79ce173fe8aa2a0
mov qword [rsp + 0x40], rdx
movabs rdx, 0x5090e13060f0813
mov qword [rsp + 0x1d], rdx
movabs rdx, 0xe0d121205000509
mov qword [rsp + 0x23], rdx
movabs rdx, 0xf0514000b12100b
mov qword [rsp + 0x2b], rdx
xor eax, eax
jmp 0x4b03cd
movzx r9d, byte [rsp + rsi + 0x33]
sub r9d, edx
lea edx, [r9 - 0x1c]
mov byte [rsp + rdi + 0x33], dl
lea edx, [r8 - 0x1c]
mov byte [rsp + rsi + 0x33], dl
add rax, 2
cmp rax, 0x16
jge 0x4b03fa
movzx edx, byte [rsp + rax + 0x1d]
movzx esi, byte [rsp + rax + 0x1e]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x15
jae 0x4b041d
movzx r8d, byte [rsp + rdi + 0x33]
sub r8d, edx
cmp rsi, 0x15
jb 0x4b03b0
jmp 0x4b0411
xor eax, eax
lea rbx, [rsp + 0x33]
mov ecx, 0x15
call fcn.0045b080
add rsp, 0x48
pop rbp
ret
mov eax, esi
mov ecx, 0x15
call fcn.004607e0
mov eax, edi
mov ecx, 0x15
call fcn.004607e0
nop
call fcn.0045e500
jmp fcn.004b0340

Function at 0x4b60e0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4b619d
push rbp
mov rbp, rsp
sub rsp, 0x30
movabs rdx, 0x7367fe61fb42e966
mov qword [rsp + 0x27], rdx
mov byte [rsp + 0x2f], 0x28
movabs rdx, 0x205010105030205
mov qword [rsp + 0x1d], rdx
mov word [rsp + 0x25], 0x103
xor eax, eax
nop
jmp 0x4b6140
movzx r9d, byte [rsp + rsi + 0x27]
sub r9d, edx
lea edx, [r9 - 0x3c]
mov byte [rsp + rdi + 0x27], dl
lea edx, [r8 - 0x3c]
mov byte [rsp + rsi + 0x27], dl
add rax, 2
nop
cmp rax, 0xa
jge 0x4b616d
movzx edx, byte [rsp + rax + 0x1d]
movzx esi, byte [rsp + rax + 0x1e]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 9
jae 0x4b6190
movzx r8d, byte [rsp + rdi + 0x27]
sub r8d, edx
cmp rsi, 9
jb 0x4b6122
jmp 0x4b6184
xor eax, eax
lea rbx, [rsp + 0x27]
mov ecx, 9
call fcn.0045b080
add rsp, 0x30
pop rbp
ret
mov eax, esi
mov ecx, 9
call fcn.004607e0
mov eax, edi
mov ecx, 9
call fcn.004607e0
nop
nop dword [rax]
call fcn.0045e500
jmp fcn.004b60e0