joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4d73c0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4d74bd
push rbp
mov rbp, rsp
sub rsp, 0x50
movabs rdx, 0xf3daf5a0ff70ef05
mov qword [rsp + 0x3b], rdx
movabs rdx, 0x9f6e612153f3daf5
mov qword [rsp + 0x40], rdx
movabs rdx, 0x656da2c920588b61
mov qword [rsp + 0x48], rdx
movabs rdx, 0x1209070b0c090206
mov qword [rsp + 0x1f], rdx
movabs rdx, 0xf0e1112110e0407
mov qword [rsp + 0x27], rdx
movabs rdx, 0xf11000e0f0e1112
mov qword [rsp + 0x2b], rdx
movabs rdx, 0x60911050301060c
mov qword [rsp + 0x33], rdx
xor eax, eax
jmp 0x4d7460
movzx r9d, byte [rsp + rsi + 0x3b]
sub r9d, edx
lea edx, [r9 - 0x75]
mov byte [rsp + rdi + 0x3b], dl
lea edx, [r8 - 0x75]
mov byte [rsp + rsi + 0x3b], dl
add rax, 2
nop dword [rax]
cmp rax, 0x1c
jge 0x4d748d
movzx edx, byte [rsp + rax + 0x1f]
movzx esi, byte [rsp + rax + 0x20]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x15
jae 0x4d74b0
movzx r8d, byte [rsp + rdi + 0x3b]
sub r8d, edx
cmp rsi, 0x15
jb 0x4d743f
jmp 0x4d74a4
xor eax, eax
lea rbx, [rsp + 0x3b]
mov ecx, 0x15
call fcn.00448840
add rsp, 0x50
pop rbp
ret
mov eax, esi
mov ecx, 0x15
call fcn.0045b700
mov eax, edi
mov ecx, 0x15
call fcn.0045b700
nop
nop dword [rax]
call fcn.00459420
jmp fcn.004d73c0

Function at 0x4d8560
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4d8668
push rbp
mov rbp, rsp
sub rsp, 0x50
movabs rdx, 0xac4b20ee74b93f6a
mov qword [rsp + 0x37], rdx
movabs rdx, 0x6b65ce5320ecf872
mov qword [rsp + 0x3f], rdx
movabs rdx, 0x646b65ce5320ecf8
mov qword [rsp + 0x40], rdx
movabs rdx, 0xd86dd8544b64ebd4
mov qword [rsp + 0x48], rdx
movabs rdx, 0xd14161811140001
mov qword [rsp + 0x19], rdx
movabs rdx, 0xf0a010e09120200
mov qword [rsp + 0x21], rdx
movabs rdx, 0x40f111616140f0a
mov qword [rsp + 0x27], rdx
movabs rdx, 0xa01040d07140e14
mov qword [rsp + 0x2f], rdx
xor eax, eax
jmp 0x4d860b
movzx r9d, byte [rsp + rsi + 0x37]
sub r9d, edx
lea edx, [r9 - 0x61]
mov byte [rsp + rdi + 0x37], dl
lea edx, [r8 - 0x61]
mov byte [rsp + rsi + 0x37], dl
add rax, 2
cmp rax, 0x1e
jge 0x4d8638
movzx edx, byte [rsp + rax + 0x19]
movzx esi, byte [rsp + rax + 0x1a]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x19
jae 0x4d865b
movzx r8d, byte [rsp + rdi + 0x37]
sub r8d, edx
cmp rsi, 0x19
jb 0x4d85ee
jmp 0x4d864f
xor eax, eax
lea rbx, [rsp + 0x37]
mov ecx, 0x19
call fcn.00448840
add rsp, 0x50
pop rbp
ret
mov eax, esi
mov ecx, 0x19
call fcn.0045b700
mov eax, edi
mov ecx, 0x19
call fcn.0045b700
nop
call fcn.00459420
jmp fcn.004d8560
Function at 0x4db1a0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4db28a
push rbp
mov rbp, rsp
sub rsp, 0x40
movabs rdx, 0x28d7fb2023611749
mov qword [rsp + 0x2e], rdx
movabs rdx, 0x52828d7fb202361
mov qword [rsp + 0x30], rdx
movabs rdx, 0x2cf1f21509c21f61
mov qword [rsp + 0x38], rdx
movabs rdx, 0x90e050506080d0c
mov qword [rsp + 0x1c], rdx
movabs rdx, 0x1103090e05050608
mov qword [rsp + 0x1e], rdx
movabs rdx, 0xd100f0d0107080b
mov qword [rsp + 0x26], rdx
xor eax, eax
jmp 0x4db22d
movzx r9d, byte [rsp + rsi + 0x2e]
sub r9d, edx
lea edx, [r9 + 0x5c]
mov byte [rsp + rdi + 0x2e], dl
lea edx, [r8 + 0x5c]
mov byte [rsp + rsi + 0x2e], dl
add rax, 2
cmp rax, 0x12
jge 0x4db25a
movzx edx, byte [rsp + rax + 0x1c]
movzx esi, byte [rsp + rax + 0x1d]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x12
jae 0x4db27d
movzx r8d, byte [rsp + rdi + 0x2e]
sub r8d, edx
cmp rsi, 0x12
jb 0x4db210
jmp 0x4db271
xor eax, eax
lea rbx, [rsp + 0x2e]
mov ecx, 0x12
call fcn.00448840
add rsp, 0x40
pop rbp
ret
mov eax, esi
mov ecx, 0x12
call fcn.0045b700
mov eax, edi
mov ecx, 0x12
call fcn.0045b700
nop
call fcn.00459420
jmp fcn.004db1a0

Function at 0x4e1580
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4e166a
push rbp
mov rbp, rsp
sub rsp, 0x48
movabs rdx, 0x3c1c23df45202e45
mov qword [rsp + 0x31], rdx
movabs rdx, 0x2f9761d35323b53c
mov qword [rsp + 0x38], rdx
movabs rdx, 0xe826185420237a61
mov qword [rsp + 0x40], rdx
movabs rdx, 0x60b04110d141407
mov qword [rsp + 0x19], rdx
movabs rdx, 0x1006080d0d100914
mov qword [rsp + 0x21], rdx
movabs rdx, 0x5111609150e0d08
mov qword [rsp + 0x29], rdx
xor eax, eax
jmp 0x4e160d
movzx r9d, byte [rsp + rsi + 0x31]
sub r9d, edx
lea edx, [r9 + 0x6b]
mov byte [rsp + rdi + 0x31], dl
lea edx, [r8 + 0x6b]
mov byte [rsp + rsi + 0x31], dl
add rax, 2
cmp rax, 0x18
jge 0x4e163a
movzx edx, byte [rsp + rax + 0x19]
movzx esi, byte [rsp + rax + 0x1a]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x17
jae 0x4e165d
movzx r8d, byte [rsp + rdi + 0x31]
sub r8d, edx
cmp rsi, 0x17
jb 0x4e15f0
jmp 0x4e1651
xor eax, eax
lea rbx, [rsp + 0x31]
mov ecx, 0x17
call fcn.00448840
add rsp, 0x48
pop rbp
ret
mov eax, esi
mov ecx, 0x17
call fcn.0045b700
mov eax, edi
mov ecx, 0x17
call fcn.0045b700
nop
call fcn.00459420
jmp fcn.004e1580
Function at 0x4e2680
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4e277d
push rbp
mov rbp, rsp
sub rsp, 0x50
movabs rdx, 0xa66e6169aeba212b
mov qword [rsp + 0x3b], rdx
movabs rdx, 0xc6a361c025a66e61
mov qword [rsp + 0x40], rdx
movabs rdx, 0x1b2917e7f57f1b61
mov qword [rsp + 0x48], rdx
movabs rdx, 0xb0e0e030b0b0907
mov qword [rsp + 0x1d], rdx
movabs rdx, 0x1110110c090f0c03
mov qword [rsp + 0x25], rdx
movabs rdx, 0x209091001131110
mov qword [rsp + 0x2b], rdx
movabs rdx, 0x90014120c030208
mov qword [rsp + 0x33], rdx
xor eax, eax
jmp 0x4e2720
movzx r9d, byte [rsp + rsi + 0x3b]
sub r9d, edx
lea edx, [r9 + 0x6e]
mov byte [rsp + rdi + 0x3b], dl
lea edx, [r8 + 0x6e]
mov byte [rsp + rsi + 0x3b], dl
add rax, 2
nop dword [rax]
cmp rax, 0x1e
jge 0x4e274d
movzx edx, byte [rsp + rax + 0x1d]
movzx esi, byte [rsp + rax + 0x1e]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x15
jae 0x4e2770
movzx r8d, byte [rsp + rdi + 0x3b]
sub r8d, edx
cmp rsi, 0x15
jb 0x4e26ff
jmp 0x4e2764
xor eax, eax
lea rbx, [rsp + 0x3b]
mov ecx, 0x15
call fcn.00448840
add rsp, 0x50
pop rbp
ret
mov eax, esi
mov ecx, 0x15
call fcn.0045b700
mov eax, edi
mov ecx, 0x15
call fcn.0045b700
nop
nop dword [rax]
call fcn.00459420
jmp fcn.004e2680

Function at 0x4e2b00
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4e2bea
push rbp
mov rbp, rsp
sub rsp, 0x40
movabs rdx, 0x49205d4073601657
mov qword [rsp + 0x2e], rdx
movabs rdx, 0x525449205d407360
mov qword [rsp + 0x30], rdx
movabs rdx, 0x3320486e4e0a2026
mov qword [rsp + 0x38], rdx
movabs rdx, 0xd080a0f010a0c01
mov qword [rsp + 0x18], rdx
movabs rdx, 0x107070c010c0d08
mov qword [rsp + 0x1e], rdx
movabs rdx, 0x50f020804000209
mov qword [rsp + 0x26], rdx
xor eax, eax
jmp 0x4e2b8d
movzx r9d, byte [rsp + rsi + 0x2e]
sub r9d, edx
lea edx, [r9 + 0x26]
mov byte [rsp + rdi + 0x2e], dl
lea edx, [r8 + 0x26]
mov byte [rsp + rsi + 0x2e], dl
add rax, 2
cmp rax, 0x16
jge 0x4e2bba
movzx edx, byte [rsp + rax + 0x18]
movzx esi, byte [rsp + rax + 0x19]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x12
jae 0x4e2bdd
movzx r8d, byte [rsp + rdi + 0x2e]
sub r8d, edx
cmp rsi, 0x12
jb 0x4e2b70
jmp 0x4e2bd1
xor eax, eax
lea rbx, [rsp + 0x2e]
mov ecx, 0x12
call fcn.00448840
add rsp, 0x40
pop rbp
ret
mov eax, esi
mov ecx, 0x12
call fcn.0045b700
mov eax, edi
mov ecx, 0x12
call fcn.0045b700
nop
call fcn.00459420
jmp fcn.004e2b00
Function at 0x4e2c00
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4e2cfb
push rbp
mov rbp, rsp
sub rsp, 0x50
movabs rdx, 0x20d050f637115e43
mov qword [rsp + 0x3b], rdx
movabs rdx, 0x323e614e3320d050
mov qword [rsp + 0x40], rdx
movabs rdx, 0x1e435454274c44a8
mov qword [rsp + 0x48], rdx
movabs rdx, 0xb0e010514120d02
mov qword [rsp + 0x1d], rdx
movabs rdx, 0x20d000c0b130b06
mov qword [rsp + 0x25], rdx
movabs rdx, 0xd100e090409020d
mov qword [rsp + 0x2b], rdx
movabs rdx, 0xf0e020212031308
mov qword [rsp + 0x33], rdx
xor eax, eax
jmp 0x4e2c99
movzx r9d, byte [rsp + rsi + 0x3b]
lea edx, [r9 + rdx]
lea edx, [rdx + 9]
mov byte [rsp + rdi + 0x3b], dl
mov byte [rsp + rsi + 0x3b], r8b
add rax, 2
cmp rax, 0x1e
jge 0x4e2ccb
movzx edx, byte [rsp + rax + 0x1d]
movzx esi, byte [rsp + rax + 0x1e]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x15
jae 0x4e2cee
movzx r8d, byte [rsp + rdi + 0x3b]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 9]
cmp rsi, 0x15
jb 0x4e2c7f
jmp 0x4e2ce2
xor eax, eax
lea rbx, [rsp + 0x3b]
mov ecx, 0x15
call fcn.00448840
add rsp, 0x50
pop rbp
ret
mov eax, esi
mov ecx, 0x15
call fcn.0045b700
mov eax, edi
mov ecx, 0x15
call fcn.0045b700
nop
nop dword [rax + rax]
call fcn.00459420
jmp fcn.004e2c00

Function at 0x4e58c0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4e59dd
push rbp
mov rbp, rsp
sub rsp, 0x60
movabs rdx, 0x7047535a6161f743
mov qword [rsp + 0x43], rdx
movabs rdx, 0x565b51396d1b1249
mov qword [rsp + 0x4b], rdx
movabs rdx, 0x5c07733c30565b51
mov qword [rsp + 0x50], rdx
movabs rdx, 0x65590a6567557261
mov qword [rsp + 0x58], rdx
movabs rdx, 0x1090f1a0a130a09
mov qword [rsp + 0x1b], rdx
movabs rdx, 0x1a03170d05100c1b
mov qword [rsp + 0x23], rdx
movabs rdx, 0x1314061206051117
mov qword [rsp + 0x2b], rdx
movabs rdx, 0x11060d04101b180a
mov qword [rsp + 0x33], rdx
movabs rdx, 0xc070e0b19170c09
mov qword [rsp + 0x3b], rdx
xor eax, eax
jmp 0x4e5980
movzx r9d, byte [rsp + rsi + 0x43]
sub r9d, edx
lea edx, [r9 + 0x2f]
mov byte [rsp + rdi + 0x43], dl
lea edx, [r8 + 0x2f]
mov byte [rsp + rsi + 0x43], dl
add rax, 2
nop word [rax + rax]
cmp rax, 0x28
jge 0x4e59ad
movzx edx, byte [rsp + rax + 0x1b]
movzx esi, byte [rsp + rax + 0x1c]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x1d
jae 0x4e59d0
movzx r8d, byte [rsp + rdi + 0x43]
sub r8d, edx
cmp rsi, 0x1d
jb 0x4e595d
jmp 0x4e59c4
xor eax, eax
lea rbx, [rsp + 0x43]
mov ecx, 0x1d
call fcn.00448840
add rsp, 0x60
pop rbp
ret
mov eax, esi
mov ecx, 0x1d
call fcn.0045b700
mov eax, edi
mov ecx, 0x1d
call fcn.0045b700
nop
nop dword [rax]
call fcn.00459420
jmp fcn.004e58c0
Function at 0x4e8aa0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4e8b8c
push rbp
mov rbp, rsp
sub rsp, 0x48
movabs rdx, 0xb9bc20aec7c987cd
mov qword [rsp + 0x35], rdx
movabs rdx, 0x641ab2b9bc20aec7
mov qword [rsp + 0x38], rdx
movabs rdx, 0xc9c86582d264ba61
mov qword [rsp + 0x40], rdx
movabs rdx, 0xc10081001010312
mov qword [rsp + 0x1d], rdx
movabs rdx, 0x20c080711010e09
mov qword [rsp + 0x25], rdx
movabs rdx, 0x406071100020f0e
mov qword [rsp + 0x2d], rdx
xor eax, eax
jmp 0x4e8b2a
movzx r9d, byte [rsp + rsi + 0x35]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x73]
mov byte [rsp + rdi + 0x35], dl
mov byte [rsp + rsi + 0x35], r8b
add rax, 2
cmp rax, 0x18
jge 0x4e8b5c
movzx edx, byte [rsp + rax + 0x1d]
movzx esi, byte [rsp + rax + 0x1e]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x13
jae 0x4e8b7f
movzx r8d, byte [rsp + rdi + 0x35]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x73]
cmp rsi, 0x13
jb 0x4e8b10
jmp 0x4e8b73
xor eax, eax
lea rbx, [rsp + 0x35]
mov ecx, 0x13
call fcn.00448840
add rsp, 0x48
pop rbp
ret
mov eax, esi
mov ecx, 0x13
call fcn.0045b700
mov eax, edi
mov ecx, 0x13
call fcn.0045b700
nop
call fcn.00459420
jmp fcn.004e8aa0

Function at 0x4ef2e0
Capabilities:
Hash data using fnv

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4efa34
push rbp
mov rbp, rsp
sub rsp, 0x10
mov qword [rsp + 0x20], rax
movabs rcx, 0xcbf29ce484222325
jmp 0x4ef30d
lea rax, [rdx + 0x10]
dec rbx
mov rcx, rsi
test rbx, rbx
jle 0x4ef591
mov rdx, rax
mov rsi, qword [rax]
nop dword [rax]
test rsi, rsi
je 0x4ef5bd
mov edi, dword [rsi + 0x10]
shr edi, 1
mov r8, qword [rax + 8]
and edi, 0x3f
lea rax, [0x005976a0]
jmp qword [rax + rdi*8]
mov rax, rcx
add rsp, 0x10
pop rbp
ret
nop dword [rax]
call fcn.004efc40
call fcn.00409c00
mov rbx, rax
lea rax, [0x0054bbe0]
call fcn.004312c0
inc rax
nop dword [rax]
cmp rax, r8
jge 0x4ef5ee
mov r9, qword [rsi + rax*8]
xor r10d, r10d
jmp 0x4ef623
lea rdi, [0x0054bc60]
mov rsi, rcx
movabs rcx, 0x100000001b3
jmp 0x4ef303
movzx r11d, r9b
xor rcx, r11
inc r10
shr r9, 8
movabs r11, 0x100000001b3
imul rcx, r11
cmp r10, 8
jl 0x4ef607
jmp 0x4ef5d9
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
call fcn.00459420
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
jmp fcn.004ef2e0

Function at 0x4efbc0
Capabilities:
Hash data using fnv

Disassembly:
test byte [rax], al
mov rcx, rbx
and ebx, 0x7f
shl rbx, 5
lea rdx, [rax + rbx]
xor eax, eax
jmp 0x4efbd7
inc rax
cmp rax, 4
jge 0x4efbef
lea rbx, [rdx + rax*8]
mov rbx, qword [rbx]
cmp rbx, rcx
jne 0x4efbd4
mov eax, 1
ret
xor eax, eax
movabs rbx, 0xcbf29ce484222325
jmp 0x4efc00
inc rax
cmp rax, 4
jge 0x4efc0e
mov rsi, qword [rdx + rax*8]
xor edi, edi
jmp 0x4efc37
and ebx, 3
lea rdx, [rdx + rbx*8]
xchg qword [rdx], rcx
xor eax, eax
ret
movzx r8d, sil
xor rbx, r8
inc rdi
shr rsi, 8
movabs r8, 0x100000001b3
imul rbx, r8
cmp rdi, 8
jl 0x4efc1b
jmp 0x4efbfd
Function at 0x4efc40
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4efd8c
push rbp
mov rbp, rsp
sub rsp, 0x78
movabs rdx, 0x8f86f4c7d073620b
mov qword [rsp + 0x53], rdx
movabs rdx, 0x853ae473f48f86f4
mov qword [rsp + 0x58], rdx
movabs rdx, 0xb863d9dd58654ca9
mov qword [rsp + 0x60], rdx
movabs rdx, 0x9c756772c5d964cc
mov qword [rsp + 0x68], rdx
movabs rdx, 0x8f22f1740ac67065
mov qword [rsp + 0x70], rdx
movabs rdx, 0x1517180707230005
mov qword [rsp + 0x1f], rdx
movabs rdx, 0xc06010015171807
mov qword [rsp + 0x23], rdx
movabs rdx, 0xc0d0e08201e0a11
mov qword [rsp + 0x2b], rdx
movabs rdx, 0x240422110018061c
mov qword [rsp + 0x33], rdx
movabs rdx, 0x171c01231f040717
mov qword [rsp + 0x3b], rdx
movabs rdx, 0x121f101510150322
mov qword [rsp + 0x43], rdx
movabs rdx, 0x314000807111e01
mov qword [rsp + 0x4b], rdx
xor eax, eax
jmp 0x4efd24
movzx r9d, byte [rsp + rsi + 0x53]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x64]
mov byte [rsp + rdi + 0x53], dl
mov byte [rsp + rsi + 0x53], r8b
add rax, 2
cmp rax, 0x34
jge 0x4efd5c
movzx edx, byte [rsp + rax + 0x1f]
movzx esi, byte [rsp + rax + 0x20]
mov edi, edx
xor edx, esi
add edx, eax
nop word [rax + rax]
cmp rdi, 0x25
jae 0x4efd7f
movzx r8d, byte [rsp + rdi + 0x53]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x64]
cmp rsi, 0x25
jb 0x4efd0a
jmp 0x4efd73
xor eax, eax
lea rbx, [rsp + 0x53]
mov ecx, 0x25
call fcn.00448840
add rsp, 0x78
pop rbp
ret
mov eax, esi
mov ecx, 0x25
call fcn.0045b700
mov eax, edi
mov ecx, 0x25
call fcn.0045b700
nop
call fcn.00459420
jmp fcn.004efc40

Function at 0x4f21c0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4f22bb
push rbp
mov rbp, rsp
sub rsp, 0x50
movabs rdx, 0x3bdf224fcebc5270
mov qword [rsp + 0x39], rdx
movabs rdx, 0x6f74336e74d3623b
mov qword [rsp + 0x40], rdx
movabs rdx, 0x193c046e6f6c5145
mov qword [rsp + 0x48], rdx
movabs rdx, 0x40f050710020109
mov qword [rsp + 0x1f], rdx
movabs rdx, 0x140706050b150c06
mov qword [rsp + 0x27], rdx
movabs rdx, 0x116140706050b15
mov qword [rsp + 0x29], rdx
movabs rdx, 0x107100c01030c15
mov qword [rsp + 0x31], rdx
xor eax, eax
jmp 0x4f2259
movzx r9d, byte [rsp + rsi + 0x39]
lea edx, [r9 + rdx]
lea edx, [rdx + 0xf]
mov byte [rsp + rdi + 0x39], dl
mov byte [rsp + rsi + 0x39], r8b
add rax, 2
cmp rax, 0x1a
jge 0x4f228b
movzx edx, byte [rsp + rax + 0x1f]
movzx esi, byte [rsp + rax + 0x20]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x17
jae 0x4f22ae
movzx r8d, byte [rsp + rdi + 0x39]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0xf]
cmp rsi, 0x17
jb 0x4f223f
jmp 0x4f22a2
xor eax, eax
lea rbx, [rsp + 0x39]
mov ecx, 0x17
call fcn.00448840
add rsp, 0x50
pop rbp
ret
mov eax, esi
mov ecx, 0x17
call fcn.0045b700
mov eax, edi
mov ecx, 0x17
call fcn.0045b700
nop
nop dword [rax + rax]
call fcn.00459420
jmp fcn.004f21c0
Function at 0x4f7e20
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4f7f1d
push rbp
mov rbp, rsp
sub rsp, 0x50
movabs rdx, 0x72c39d10d7093f51
mov qword [rsp + 0x3c], rdx
movabs rdx, 0xa769515072c39d10
mov qword [rsp + 0x40], rdx
movabs rdx, 0x1051564573dc7654
mov qword [rsp + 0x48], rdx
movabs rdx, 0x20603130e0b0502
mov qword [rsp + 0x1e], rdx
movabs rdx, 0x120c06010e0b020b
mov qword [rsp + 0x26], rdx
movabs rdx, 0x40105110308120c
mov qword [rsp + 0x2c], rdx
movabs rdx, 0x10013100209000b
mov qword [rsp + 0x34], rdx
xor eax, eax
jmp 0x4f7ec0
movzx r9d, byte [rsp + rsi + 0x3c]
sub r9d, edx
lea edx, [r9 + 0x44]
mov byte [rsp + rdi + 0x3c], dl
lea edx, [r8 + 0x44]
mov byte [rsp + rsi + 0x3c], dl
add rax, 2
nop dword [rax]
cmp rax, 0x1e
jge 0x4f7eed
movzx edx, byte [rsp + rax + 0x1e]
movzx esi, byte [rsp + rax + 0x1f]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x14
jae 0x4f7f10
movzx r8d, byte [rsp + rdi + 0x3c]
sub r8d, edx
cmp rsi, 0x14
jb 0x4f7e9f
jmp 0x4f7f04
xor eax, eax
lea rbx, [rsp + 0x3c]
mov ecx, 0x14
call fcn.00448840
add rsp, 0x50
pop rbp
ret
mov eax, esi
mov ecx, 0x14
call fcn.0045b700
mov eax, edi
mov ecx, 0x14
call fcn.0045b700
nop
nop dword [rax]
call fcn.00459420
jmp fcn.004f7e20

Function at 0x4f8b00
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4f8bc7
push rbp
mov rbp, rsp
sub rsp, 0x38
movabs rdx, 0x463204655a657346
mov qword [rsp + 0x2d], rdx
mov dword [rsp + 0x34], 0x4c6c5546
movabs rdx, 0xa07030507000306
mov qword [rsp + 0x1f], rdx
movabs rdx, 0x5030708070a07
mov qword [rsp + 0x25], rdx
xor eax, eax
jmp 0x4f8b68
movzx r9d, byte [rsp + rsi + 0x2d]
sub r9d, edx
lea edx, [r9 + 0x21]
mov byte [rsp + rdi + 0x2d], dl
lea edx, [r8 + 0x21]
mov byte [rsp + rsi + 0x2d], dl
add rax, 2
cmp rax, 0xe
jge 0x4f8b97
movzx edx, byte [rsp + rax + 0x1f]
movzx esi, byte [rsp + rax + 0x20]
mov edi, edx
xor edx, esi
add edx, eax
nop
cmp rdi, 0xb
jae 0x4f8bba
movzx r8d, byte [rsp + rdi + 0x2d]
sub r8d, edx
cmp rsi, 0xb
jb 0x4f8b4b
jmp 0x4f8bae
xor eax, eax
lea rbx, [rsp + 0x2d]
mov ecx, 0xb
call fcn.00448840
add rsp, 0x38
pop rbp
ret
mov eax, esi
mov ecx, 0xb
call fcn.0045b700
mov eax, edi
mov ecx, 0xb
call fcn.0045b700
nop
call fcn.00459420
jmp fcn.004f8b00
Function at 0x4fa660
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4fa75d
push rbp
mov rbp, rsp
sub rsp, 0x48
movabs rdx, 0x12076bc6d87465f7
mov qword [rsp + 0x35], rdx
movabs rdx, 0x30a31e12076bc6d8
mov qword [rsp + 0x38], rdx
movabs rdx, 0x6e7a69d16ec41f6f
mov qword [rsp + 0x40], rdx
movabs rdx, 0x903090008060711
mov qword [rsp + 0x1b], rdx
movabs rdx, 0xc0d0a080e080409
mov qword [rsp + 0x23], rdx
movabs rdx, 0x4070c0d0a080e08
mov qword [rsp + 0x25], rdx
movabs rdx, 0xf07060a11080d04
mov qword [rsp + 0x2d], rdx
xor eax, eax
jmp 0x4fa700
movzx r9d, byte [rsp + rsi + 0x35]
sub r9d, edx
lea edx, [r9 - 0x43]
mov byte [rsp + rdi + 0x35], dl
lea edx, [r8 - 0x43]
mov byte [rsp + rsi + 0x35], dl
add rax, 2
nop dword [rax]
cmp rax, 0x1a
jge 0x4fa72d
movzx edx, byte [rsp + rax + 0x1b]
movzx esi, byte [rsp + rax + 0x1c]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x13
jae 0x4fa750
movzx r8d, byte [rsp + rdi + 0x35]
sub r8d, edx
cmp rsi, 0x13
jb 0x4fa6df
jmp 0x4fa744
xor eax, eax
lea rbx, [rsp + 0x35]
mov ecx, 0x13
call fcn.00448840
add rsp, 0x48
pop rbp
ret
mov eax, esi
mov ecx, 0x13
call fcn.0045b700
mov eax, edi
mov ecx, 0x13
call fcn.0045b700
nop
nop dword [rax]
call fcn.00459420
jmp fcn.004fa660

Function at 0x4fc4c0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4fc5c8
push rbp
mov rbp, rsp
sub rsp, 0x58
movabs rdx, 0x6d323f2df82e65e2
mov qword [rsp + 0x3b], rdx
movabs rdx, 0xea14726f666e71f1
mov qword [rsp + 0x43], rdx
movabs rdx, 0x42c31d6974ea1472
mov qword [rsp + 0x48], rdx
movabs rdx, 0x5721fb22236131d8
mov qword [rsp + 0x50], rdx
movabs rdx, 0xf00080912001504
mov qword [rsp + 0x1d], rdx
movabs rdx, 0xe0313021318180f
mov qword [rsp + 0x25], rdx
movabs rdx, 0x1a12181608040e03
mov qword [rsp + 0x2b], rdx
movabs rdx, 0x40e06191b1205
mov qword [rsp + 0x33], rdx
xor eax, eax
jmp 0x4fc56b
movzx r9d, byte [rsp + rsi + 0x3b]
sub r9d, edx
lea edx, [r9 + 0x5d]
mov byte [rsp + rdi + 0x3b], dl
lea edx, [r8 + 0x5d]
mov byte [rsp + rsi + 0x3b], dl
add rax, 2
cmp rax, 0x1e
jge 0x4fc598
movzx edx, byte [rsp + rax + 0x1d]
movzx esi, byte [rsp + rax + 0x1e]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x1d
jae 0x4fc5bb
movzx r8d, byte [rsp + rdi + 0x3b]
sub r8d, edx
cmp rsi, 0x1d
jb 0x4fc54e
jmp 0x4fc5af
xor eax, eax
lea rbx, [rsp + 0x3b]
mov ecx, 0x1d
call fcn.00448840
add rsp, 0x58
pop rbp
ret
mov eax, esi
mov ecx, 0x1d
call fcn.0045b700
mov eax, edi
mov ecx, 0x1d
call fcn.0045b700
nop
call fcn.00459420
jmp fcn.004fc4c0
Function at 0x4fdf20
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4fdffd
push rbp
mov rbp, rsp
sub rsp, 0x40
movabs rdx, 0x758081ad957f909b
mov qword [rsp + 0x30], rdx
movabs rdx, 0x649876777c55ae93
mov qword [rsp + 0x38], rdx
movabs rdx, 0x90b020b020e0103
mov qword [rsp + 0x1a], rdx
movabs rdx, 0x5050b040b00090b
mov qword [rsp + 0x20], rdx
movabs rdx, 0xd030b010b0608
mov qword [rsp + 0x28], rdx
xor eax, eax
nop
jmp 0x4fdfa0
movzx r9d, byte [rsp + rsi + 0x30]
sub r9d, edx
lea edx, [r9 - 3]
mov byte [rsp + rdi + 0x30], dl
lea edx, [r8 - 3]
mov byte [rsp + rsi + 0x30], dl
add rax, 2
nop
cmp rax, 0x16
jge 0x4fdfcd
movzx edx, byte [rsp + rax + 0x1a]
movzx esi, byte [rsp + rax + 0x1b]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x10
jae 0x4fdff0
movzx r8d, byte [rsp + rdi + 0x30]
sub r8d, edx
cmp rsi, 0x10
jb 0x4fdf82
jmp 0x4fdfe4
xor eax, eax
lea rbx, [rsp + 0x30]
mov ecx, 0x10
call fcn.00448840
add rsp, 0x40
pop rbp
ret
mov eax, esi
mov ecx, 0x10
call fcn.0045b700
mov eax, edi
mov ecx, 0x10
call fcn.0045b700
nop
nop dword [rax]
call fcn.00459420
jmp fcn.004fdf20

Function at 0x5003c0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x500487
push rbp
mov rbp, rsp
sub rsp, 0x30
movabs rdx, 0xc9c145cde941d444
mov qword [rsp + 0x26], rdx
mov word [rsp + 0x2e], 0xcb74
movabs rdx, 0x506070606050900
mov qword [rsp + 0x18], rdx
movabs rdx, 0x605010904030506
mov qword [rsp + 0x1e], rdx
xor eax, eax
jmp 0x500427
movzx r9d, byte [rsp + rsi + 0x26]
sub r9d, edx
lea edx, [r9 - 0x6b]
mov byte [rsp + rdi + 0x26], dl
lea edx, [r8 - 0x6b]
mov byte [rsp + rsi + 0x26], dl
add rax, 2
cmp rax, 0xe
jge 0x500457
movzx edx, byte [rsp + rax + 0x18]
movzx esi, byte [rsp + rax + 0x19]
mov edi, edx
xor edx, esi
add edx, eax
nop dword [rax]
cmp rdi, 0xa
jae 0x50047a
movzx r8d, byte [rsp + rdi + 0x26]
sub r8d, edx
cmp rsi, 0xa
jb 0x50040a
jmp 0x50046e
xor eax, eax
lea rbx, [rsp + 0x26]
mov ecx, 0xa
call fcn.00448840
add rsp, 0x30
pop rbp
ret
mov eax, esi
mov ecx, 0xa
call fcn.0045b700
mov eax, edi
mov ecx, 0xa
call fcn.0045b700
nop
call fcn.00459420
jmp fcn.005003c0