joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4d9680
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x28
mov qword [rsp + 0x38], 0
movabs rax, 0xe485e92a5f7c58e0
mov qword [rsp + 0x18], rax
movabs rax, 0x24f22c3c6d4197f8
mov qword [rsp + 0x20], rax
mov qword [rsp + 0xf], 0
mov qword [rsp + 0x10], 0
movzx eax, byte [rsp + 0x25]
movzx ecx, byte [rsp + 0x19]
add eax, ecx
movzx ecx, byte [rsp + 0x1b]
movzx edx, byte [rsp + 0x20]
xor ecx, edx
movzx edx, byte [rsp + 0x1d]
movzx ebx, byte [rsp + 0x27]
add edx, ebx
movzx ebx, byte [rsp + 0x18]
movzx esi, byte [rsp + 0x26]
sub ebx, esi
movzx esi, byte [rsp + 0x1e]
movzx edi, byte [rsp + 0x22]
sub esi, edi
movzx edi, byte [rsp + 0x24]
movzx r8d, byte [rsp + 0x23]
sub edi, r8d
movzx r8d, byte [rsp + 0x1a]
movzx r9d, byte [rsp + 0x1f]
add r8d, r9d
movzx r9d, byte [rsp + 0x21]
movzx r10d, byte [rsp + 0x1c]
mov byte [rsp + 0xf], al
mov byte [rsp + 0x10], cl
mov byte [rsp + 0x11], dl
mov byte [rsp + 0x12], bl
mov byte [rsp + 0x13], sil
mov byte [rsp + 0x14], dil
mov byte [rsp + 0x15], r8b
sub r9d, r10d
mov byte [rsp + 0x16], r9b
mov qword [rsp + 7], 0
xor eax, eax
jmp 0x4d9766
movzx ecx, byte [rsp + rax + 0xf]
mov byte [rsp + rax + 7], cl
inc rax
cmp rax, 8
jl 0x4d975a
mov rax, qword [rsp + 7]
mov qword [rsp + 0x38], rax
add rsp, 0x28
pop rbp
ret

Function at 0x4dcdc0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4dcea6
push rbp
mov rbp, rsp
sub rsp, 0x38
movabs rdx, 0xc516cb6cbd93ae92
mov qword [rsp + 0x19], rdx
movabs rdx, 0xd77b7802ebc516cb
mov qword [rsp + 0x1e], rdx
movabs rdx, 0x8000c0b09060600
mov qword [rsp + 0x26], rdx
movabs rdx, 0x20708000c0b0906
mov qword [rsp + 0x28], rdx
movabs rdx, 0x6050109030c01
mov qword [rsp + 0x30], rdx
xor eax, eax
nop
jmp 0x4dce40
movzx r9d, byte [rsp + rsi + 0x19]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x6e]
mov byte [rsp + rdi + 0x19], dl
mov byte [rsp + rsi + 0x19], r8b
add rax, 2
nop dword [rax]
cmp rax, 0x12
jge 0x4dce72
movzx edx, byte [rsp + rax + 0x26]
movzx esi, byte [rsp + rax + 0x27]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0xd
jae 0x4dce97
movzx r8d, byte [rsp + rdi + 0x19]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x6e]
cmp rsi, 0xd
jb 0x4dce22
jmp 0x4dce8b
xor eax, eax
lea rbx, [rsp + 0x19]
mov ecx, 0xd
nop
call fcn.00444ce0
add rsp, 0x38
pop rbp
ret
mov eax, esi
mov ecx, 0xd
call fcn.00456b60
mov eax, edi
mov ecx, 0xd
nop
call fcn.00456b60
nop
call fcn.004548e0
jmp fcn.004dcdc0
Function at 0x4dd3e0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4dd4dd
push rbp
mov rbp, rsp
sub rsp, 0x50
movabs rdx, 0x181489b26b6c1a07
mov qword [rsp + 0x1a], rdx
movabs rdx, 0x74b24a75be701814
mov qword [rsp + 0x20], rdx
movabs rdx, 0x4accbd6e83a9be69
mov qword [rsp + 0x28], rdx
movabs rdx, 0x9140b0c11031506
mov qword [rsp + 0x30], rdx
movabs rdx, 0x614011304051103
mov qword [rsp + 0x38], rdx
movabs rdx, 0x70b10050f010c00
mov qword [rsp + 0x40], rdx
movabs rdx, 0x509031401010004
mov qword [rsp + 0x48], rdx
xor eax, eax
jmp 0x4dd480
movzx r9d, byte [rsp + rsi + 0x1a]
sub r9d, edx
lea edx, [r9 + 0x78]
mov byte [rsp + rdi + 0x1a], dl
lea edx, [r8 + 0x78]
mov byte [rsp + rsi + 0x1a], dl
add rax, 2
nop dword [rax]
cmp rax, 0x20
jge 0x4dd4ad
movzx edx, byte [rsp + rax + 0x30]
movzx esi, byte [rsp + rax + 0x31]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x16
jae 0x4dd4d0
movzx r8d, byte [rsp + rdi + 0x1a]
sub r8d, edx
cmp rsi, 0x16
jb 0x4dd45f
jmp 0x4dd4c4
xor eax, eax
lea rbx, [rsp + 0x1a]
mov ecx, 0x16
call fcn.00444ce0
add rsp, 0x50
pop rbp
ret
mov eax, esi
mov ecx, 0x16
call fcn.00456b60
mov eax, edi
mov ecx, 0x16
call fcn.00456b60
nop
nop dword [rax]
call fcn.004548e0
jmp fcn.004dd3e0

Function at 0x4dde20
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4ddeec
push rbp
mov rbp, rsp
sub rsp, 0x30
movabs rdx, 0xbad4cd6863f065d0
mov qword [rsp + 0x19], rdx
movabs rdx, 0x6464debad4cd6863
mov qword [rsp + 0x1c], rdx
movabs rdx, 0x602050003060708
mov qword [rsp + 0x24], rdx
mov dword [rsp + 0x2c], 0x2050205
xor eax, eax
jmp 0x4dde85
movzx r9d, byte [rsp + rsi + 0x19]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x78]
mov byte [rsp + rdi + 0x19], dl
mov byte [rsp + rsi + 0x19], r8b
add rax, 2
cmp rax, 0xc
jge 0x4ddebc
movzx edx, byte [rsp + rax + 0x24]
movzx esi, byte [rsp + rax + 0x25]
mov edi, edx
xor edx, esi
add edx, eax
nop dword [rax + rax]
cmp rdi, 0xb
jae 0x4ddedf
movzx r8d, byte [rsp + rdi + 0x19]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x78]
cmp rsi, 0xb
jb 0x4dde6b
jmp 0x4dded3
xor eax, eax
lea rbx, [rsp + 0x19]
mov ecx, 0xb
call fcn.00444ce0
add rsp, 0x30
pop rbp
ret
mov eax, esi
mov ecx, 0xb
call fcn.00456b60
mov eax, edi
mov ecx, 0xb
call fcn.00456b60
nop
call fcn.004548e0
jmp fcn.004dde20
Function at 0x4de6e0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4de7db
push rbp
mov rbp, rsp
sub rsp, 0x48
movabs rdx, 0x6e45050c611a72c7
mov qword [rsp + 0x18], rdx
movabs rdx, 0x6da8164dc5766e45
mov qword [rsp + 0x1e], rdx
movabs rdx, 0x6b63a56c50f27cbe
mov qword [rsp + 0x26], rdx
movabs rdx, 0xc1100021105040a
mov qword [rsp + 0x2e], rdx
movabs rdx, 0x90b050a09041104
mov qword [rsp + 0x36], rdx
movabs rdx, 0xf11090b050a0904
mov qword [rsp + 0x38], rdx
movabs rdx, 0xa0e001310000913
mov qword [rsp + 0x40], rdx
xor eax, eax
jmp 0x4de779
movzx r9d, byte [rsp + rsi + 0x18]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x68]
mov byte [rsp + rdi + 0x18], dl
mov byte [rsp + rsi + 0x18], r8b
add rax, 2
cmp rax, 0x1a
jge 0x4de7ab
movzx edx, byte [rsp + rax + 0x2e]
movzx esi, byte [rsp + rax + 0x2f]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x16
jae 0x4de7ce
movzx r8d, byte [rsp + rdi + 0x18]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x68]
cmp rsi, 0x16
jb 0x4de75f
jmp 0x4de7c2
xor eax, eax
lea rbx, [rsp + 0x18]
mov ecx, 0x16
call fcn.00444ce0
add rsp, 0x48
pop rbp
ret
mov eax, esi
mov ecx, 0x16
call fcn.00456b60
mov eax, edi
mov ecx, 0x16
call fcn.00456b60
nop
nop dword [rax + rax]
call fcn.004548e0
jmp fcn.004de6e0

Function at 0x4e1a60
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4e1b5d
push rbp
mov rbp, rsp
sub rsp, 0x48
movabs rdx, 0x6b8499786f702375
mov qword [rsp + 0x1c], rdx
movabs rdx, 0x6f776b8499786f70
mov qword [rsp + 0x1e], rdx
movabs rdx, 0x666f21387a648b73
mov qword [rsp + 0x26], rdx
movabs rdx, 0x1021011030d0710
mov qword [rsp + 0x2e], rdx
movabs rdx, 0x30306020f0d0801
mov qword [rsp + 0x36], rdx
movabs rdx, 0x30b030306020f0d
mov qword [rsp + 0x38], rdx
movabs rdx, 0x4020e0302010501
mov qword [rsp + 0x40], rdx
xor eax, eax
jmp 0x4e1b00
movzx r9d, byte [rsp + rsi + 0x1c]
sub r9d, edx
lea edx, [r9 + 0xb]
mov byte [rsp + rdi + 0x1c], dl
lea edx, [r8 + 0xb]
mov byte [rsp + rsi + 0x1c], dl
add rax, 2
nop dword [rax]
cmp rax, 0x1a
jge 0x4e1b2d
movzx edx, byte [rsp + rax + 0x2e]
movzx esi, byte [rsp + rax + 0x2f]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x12
jae 0x4e1b50
movzx r8d, byte [rsp + rdi + 0x1c]
sub r8d, edx
cmp rsi, 0x12
jb 0x4e1adf
jmp 0x4e1b44
xor eax, eax
lea rbx, [rsp + 0x1c]
mov ecx, 0x12
call fcn.00444ce0
add rsp, 0x48
pop rbp
ret
mov eax, esi
mov ecx, 0x12
call fcn.00456b60
mov eax, edi
mov ecx, 0x12
call fcn.00456b60
nop
nop dword [rax]
call fcn.004548e0
jmp fcn.004e1a60
Function at 0x4e5360
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4e542c
push rbp
mov rbp, rsp
sub rsp, 0x38
movabs rdx, 0x2959455149094323
mov qword [rsp + 0x1f], rdx
movabs rdx, 0x6529622959455149
mov qword [rsp + 0x22], rdx
movabs rdx, 0x305040903020009
mov qword [rsp + 0x2a], rdx
movabs rdx, 0x501000607010305
mov qword [rsp + 0x30], rdx
xor eax, eax
jmp 0x4e53cf
movzx r9d, byte [rsp + rsi + 0x1f]
sub r9d, edx
lea edx, [r9 + 0x2c]
mov byte [rsp + rdi + 0x1f], dl
lea edx, [r8 + 0x2c]
mov byte [rsp + rsi + 0x1f], dl
add rax, 2
cmp rax, 0xe
jge 0x4e53fc
movzx edx, byte [rsp + rax + 0x2a]
movzx esi, byte [rsp + rax + 0x2b]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0xb
jae 0x4e541f
movzx r8d, byte [rsp + rdi + 0x1f]
sub r8d, edx
cmp rsi, 0xb
jb 0x4e53b2
jmp 0x4e5413
xor eax, eax
lea rbx, [rsp + 0x1f]
mov ecx, 0xb
call fcn.00444ce0
add rsp, 0x38
pop rbp
ret
mov eax, esi
mov ecx, 0xb
call fcn.00456b60
mov eax, edi
mov ecx, 0xb
call fcn.00456b60
nop
call fcn.004548e0
jmp fcn.004e5360
Function at 0x4e5ea0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4e5f58
push rbp
mov rbp, rsp
sub rsp, 0x30
movabs rdx, 0x6c002d6f4438c583
mov qword [rsp + 0x1c], rdx
movabs rdx, 0x601010603000100
mov qword [rsp + 0x24], rdx
mov dword [rsp + 0x2c], 0x2010503
xor eax, eax
jmp 0x4e5ef6
movzx r9d, byte [rsp + rsi + 0x1c]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x2e]
mov byte [rsp + rdi + 0x1c], dl
mov byte [rsp + rsi + 0x1c], r8b
add rax, 2
cmp rax, 0xc
jge 0x4e5f28
movzx edx, byte [rsp + rax + 0x24]
movzx esi, byte [rsp + rax + 0x25]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 8
jae 0x4e5f4b
movzx r8d, byte [rsp + rdi + 0x1c]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x2e]
cmp rsi, 8
jb 0x4e5edc
jmp 0x4e5f3f
xor eax, eax
lea rbx, [rsp + 0x1c]
mov ecx, 8
call fcn.00444ce0
add rsp, 0x30
pop rbp
ret
mov eax, esi
mov ecx, 8
call fcn.00456b60
mov eax, edi
mov ecx, 8
call fcn.00456b60
nop
call fcn.004548e0
nop dword [rax]
jmp fcn.004e5ea0

Function at 0x4e6440
Capabilities:
Encrypt data using rc4 prga

Disassembly:
lea r12, [rsp - 0x50]
cmp r12, qword [r14 + 0x10]
jbe 0x4e659b
push rbp
mov rbp, rsp
sub rsp, 0xc8
movabs rdx, 0x5a500f6ddfb56fd5
mov qword [rsp + 0x1b], rdx
movabs rdx, 0x1f48736ef09fd65a
mov qword [rsp + 0x22], rdx
movabs rdx, 0xd5706242606eb1db
mov qword [rsp + 0x2a], rdx
movabs rdx, 0xd31b21d8727461c8
mov qword [rsp + 0x32], rdx
movabs rdx, 0x636921f161154a6f
mov qword [rsp + 0x3a], rdx
movabs rdx, 0x1230696620db8208
mov qword [rsp + 0x42], rdx
movabs rdx, 0x23dbdf5015626f60
mov qword [rsp + 0x4a], rdx
movabs rdx, 0x3678d33228207465
mov qword [rsp + 0x52], rdx
movabs rdx, 0xb078be638f93031
mov qword [rsp + 0x5a], rdx
movabs rdx, 0x3b241c260c200336
mov qword [rsp + 0x62], rdx
lea rdi, [rsp + 0x68]
lea rsi, str.__5D_a5_
nop dword [rax]
mov qword [rsp - 0x10], rbp
lea rbp, [rsp - 0x10]
call fcn.004571ac
mov rbp, qword [rbp]
xor eax, eax
jmp 0x4e6531
movzx r9d, byte [rsp + rsi + 0x1b]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x33]
mov byte [rsp + rdi + 0x1b], dl
mov byte [rsp + rsi + 0x1b], r8b
add rax, 2
cmp rax, 0x66
jge 0x4e6568
movzx edx, byte [rsp + rax + 0x62]
movzx esi, byte [rsp + rax + 0x63]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x47
jae 0x4e658e
movzx r8d, byte [rsp + rdi + 0x1b]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x33]
nop dword [rax + rax]
cmp rsi, 0x47
jb 0x4e6517
jmp 0x4e6582
xor eax, eax
lea rbx, [rsp + 0x1b]
mov ecx, 0x47
call fcn.00444ce0
add rsp, 0xc8
pop rbp
ret
mov eax, esi
mov ecx, 0x47
call fcn.00456b60
mov eax, edi
mov ecx, 0x47
call fcn.00456b60
nop
nop dword [rax + rax]
call fcn.004548e0
jmp fcn.004e6440
Function at 0x4ea5c0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
lea r12, [rsp - 0x20]
cmp r12, qword [r14 + 0x10]
jbe 0x4ea75b
push rbp
mov rbp, rsp
sub rsp, 0x98
movabs rdx, 0xeb2e6e69cb62eb10
mov qword [rsp + 0x1b], rdx
movabs rdx, 0x650c5b20acef20eb
mov qword [rsp + 0x22], rdx
movabs rdx, 0x166926a520d56faf
mov qword [rsp + 0x2a], rdx
movabs rdx, 0xdd20707b200bc065
mov qword [rsp + 0x32], rdx
movabs rdx, 0xf00b5b0e0d656c3b
mov qword [rsp + 0x3a], rdx
movabs rdx, 0x3e4e741e06386b65
mov qword [rsp + 0x42], rdx
movabs rdx, 0x584e218e98eee4df
mov qword [rsp + 0x4a], rdx
movabs rdx, 0xa22191b322b1119
mov qword [rsp + 0x52], rdx
movabs rdx, 0x3431160602280a22
mov qword [rsp + 0x58], rdx
movabs rdx, 0x16141f28000d1e30
mov qword [rsp + 0x60], rdx
movabs rdx, 0x2e362a23161c0126
mov qword [rsp + 0x68], rdx
movabs rdx, 0x91c25180c2d320f
mov qword [rsp + 0x70], rdx
movabs rdx, 0xc2d110208032b14
mov qword [rsp + 0x78], rdx
movabs rdx, 0x361316070331082e
mov qword [rsp + 0x80], rdx
movabs rdx, 0x24240214282f290a
mov qword [rsp + 0x88], rdx
movabs rdx, 0xa1933182b2e1824
mov qword [rsp + 0x90], rdx
xor eax, eax
jmp 0x4ea6f1
movzx r9d, byte [rsp + rsi + 0x1b]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x46]
mov byte [rsp + rdi + 0x1b], dl
mov byte [rsp + rsi + 0x1b], r8b
add rax, 2
cmp rax, 0x46
jge 0x4ea728
movzx edx, byte [rsp + rax + 0x52]
movzx esi, byte [rsp + rax + 0x53]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x37
jae 0x4ea74e
movzx r8d, byte [rsp + rdi + 0x1b]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x46]
nop dword [rax + rax]
cmp rsi, 0x37
jb 0x4ea6d7
jmp 0x4ea742
xor eax, eax
lea rbx, [rsp + 0x1b]
mov ecx, 0x37
call fcn.00444ce0
add rsp, 0x98
pop rbp
ret
mov eax, esi
mov ecx, 0x37
call fcn.00456b60
mov eax, edi
mov ecx, 0x37
call fcn.00456b60
nop
nop dword [rax + rax]
call fcn.004548e0
jmp fcn.004ea5c0

Function at 0x4ee4e0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4ee5ac
push rbp
mov rbp, rsp
sub rsp, 0x38
movabs rdx, 0x737269b4e91e9b12
mov qword [rsp + 0x1d], rdx
movabs rdx, 0x656cbe9d74737269
mov qword [rsp + 0x22], rdx
movabs rdx, 0x4010900090403
mov qword [rsp + 0x2a], rdx
movabs rdx, 0xa0a020404020004
mov qword [rsp + 0x30], rdx
xor eax, eax
jmp 0x4ee54f
movzx r9d, byte [rsp + rsi + 0x1d]
sub r9d, edx
lea edx, [r9 - 0x49]
mov byte [rsp + rdi + 0x1d], dl
lea edx, [r8 - 0x49]
mov byte [rsp + rsi + 0x1d], dl
add rax, 2
cmp rax, 0xe
jge 0x4ee57c
movzx edx, byte [rsp + rax + 0x2a]
movzx esi, byte [rsp + rax + 0x2b]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0xd
jae 0x4ee59f
movzx r8d, byte [rsp + rdi + 0x1d]
sub r8d, edx
cmp rsi, 0xd
jb 0x4ee532
jmp 0x4ee593
xor eax, eax
lea rbx, [rsp + 0x1d]
mov ecx, 0xd
call fcn.00444ce0
add rsp, 0x38
pop rbp
ret
mov eax, esi
mov ecx, 0xd
call fcn.00456b60
mov eax, edi
mov ecx, 0xd
call fcn.00456b60
nop
call fcn.004548e0
jmp fcn.004ee4e0
Function at 0x4ee5c0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4ee686
push rbp
mov rbp, rsp
sub rsp, 0x30
movabs rdx, 0x16463714ef657212
mov qword [rsp + 0x26], rdx
mov word [rsp + 0x2e], 0x6540
movabs rdx, 0x7050300040403
mov qword [rsp + 0x1c], rdx
mov word [rsp + 0x24], 0x804
xor eax, eax
jmp 0x4ee620
movzx r9d, byte [rsp + rsi + 0x26]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x20]
mov byte [rsp + rdi + 0x26], dl
mov byte [rsp + rsi + 0x26], r8b
add rax, 2
nop dword [rax]
cmp rax, 0xa
jge 0x4ee652
movzx edx, byte [rsp + rax + 0x1c]
movzx esi, byte [rsp + rax + 0x1d]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0xa
jae 0x4ee677
movzx r8d, byte [rsp + rdi + 0x26]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x20]
cmp rsi, 0xa
jb 0x4ee602
jmp 0x4ee66b
xor eax, eax
lea rbx, [rsp + 0x26]
mov ecx, 0xa
nop
call fcn.00444ce0
add rsp, 0x30
pop rbp
ret
mov eax, esi
mov ecx, 0xa
call fcn.00456b60
mov eax, edi
mov ecx, 0xa
nop
call fcn.00456b60
nop
call fcn.004548e0
jmp fcn.004ee5c0
Function at 0x4f1380
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4f14b8
push rbp
mov rbp, rsp
sub rsp, 0x70
movabs rdx, 0x696f626174487d73
mov qword [rsp + 0x1c], rdx
movabs rdx, 0x88677287696f6261
mov qword [rsp + 0x20], rdx
movabs rdx, 0x6e82535761638b7b
mov qword [rsp + 0x28], rdx
movabs rdx, 0x668d309a77416081
mov qword [rsp + 0x30], rdx
movabs rdx, 0x671644106da82078
mov qword [rsp + 0x38], rdx
movabs rdx, 0x81223150b140d1e
mov qword [rsp + 0x40], rdx
movabs rdx, 0x181a1b061f01221b
mov qword [rsp + 0x48], rdx
movabs rdx, 0x11b0d0a150c190c
mov qword [rsp + 0x50], rdx
movabs rdx, 0x100720021214171a
mov qword [rsp + 0x58], rdx
movabs rdx, 0x2016020c2021200d
mov qword [rsp + 0x60], rdx
movabs rdx, 0xa05110723220a01
mov qword [rsp + 0x68], rdx
xor eax, eax
jmp 0x4f1455
movzx r9d, byte [rsp + rsi + 0x1c]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x30]
mov byte [rsp + rdi + 0x1c], dl
mov byte [rsp + rsi + 0x1c], r8b
add rax, 2
cmp rax, 0x30
jge 0x4f1488
movzx edx, byte [rsp + rax + 0x40]
movzx esi, byte [rsp + rax + 0x41]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x24
jae 0x4f14ab
movzx r8d, byte [rsp + rdi + 0x1c]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x30]
nop
cmp rsi, 0x24
jb 0x4f143b
jmp 0x4f149f
xor eax, eax
lea rbx, [rsp + 0x1c]
mov ecx, 0x24
call fcn.00444ce0
add rsp, 0x70
pop rbp
ret
mov eax, esi
mov ecx, 0x24
call fcn.00456b60
mov eax, edi
mov ecx, 0x24
call fcn.00456b60
nop
call fcn.004548e0
nop dword [rax]
jmp fcn.004f1380

Function at 0x4f5c80
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4f5dac
push rbp
mov rbp, rsp
sub rsp, 0x60
movabs rdx, 0xae5bfc657461fea8
mov qword [rsp + 0x19], rdx
movabs rdx, 0xc1d6fae5bfc6574
mov qword [rsp + 0x1c], rdx
movabs rdx, 0x75b41426f5a87075
mov qword [rsp + 0x24], rdx
movabs rdx, 0xa6f8a576656220a1
mov qword [rsp + 0x2c], rdx
movabs rdx, 0x2074a60266ad6fe2
mov qword [rsp + 0x34], rdx
movabs rdx, 0x70a111b0f090520
mov qword [rsp + 0x3c], rdx
movabs rdx, 0x11000d06070a111b
mov qword [rsp + 0x40], rdx
movabs rdx, 0x617181d00050a11
mov qword [rsp + 0x48], rdx
movabs rdx, 0x1a06190110101b0d
mov qword [rsp + 0x50], rdx
movabs rdx, 0x181f051d0e131d1a
mov qword [rsp + 0x58], rdx
xor eax, eax
jmp 0x4f5d46
movzx r9d, byte [rsp + rsi + 0x19]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x44]
mov byte [rsp + rdi + 0x19], dl
mov byte [rsp + rsi + 0x19], r8b
add rax, 2
cmp rax, 0x24
jge 0x4f5d7c
movzx edx, byte [rsp + rax + 0x3c]
movzx esi, byte [rsp + rax + 0x3d]
mov edi, edx
xor edx, esi
add edx, eax
nop dword [rax]
cmp rdi, 0x23
jae 0x4f5d9f
movzx r8d, byte [rsp + rdi + 0x19]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x44]
cmp rsi, 0x23
jb 0x4f5d2c
jmp 0x4f5d93
xor eax, eax
lea rbx, [rsp + 0x19]
mov ecx, 0x23
call fcn.00444ce0
add rsp, 0x60
pop rbp
ret
mov eax, esi
mov ecx, 0x23
call fcn.00456b60
mov eax, edi
mov ecx, 0x23
call fcn.00456b60
nop
call fcn.004548e0
jmp fcn.004f5c80
Function at 0x4f7c20
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
movd xmm0, dword [rsp + 8]
mov rsi, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
movdqu xmm1, xmmword [rsi]
movdqu xmm2, xmmword [rsi + 0x10]
movdqu xmm3, xmmword [rsi + 0x20]
movdqu xmm4, xmmword [rsi + 0x30]
pxor xmm1, xmm0
add rsi, 0x40
sub rcx, 0x40
cmp rcx, 0x40
jb 0x4f7cf5
movdqa xmm0, xmmword [0x0055d2f0]
movdqa xmm5, xmm1
movdqa xmm6, xmm2
movdqa xmm7, xmm3
movdqa xmm8, xmm4
pclmulqdq xmm1, xmm0, 0
pclmulqdq xmm2, xmm0, 0
pclmulqdq xmm3, xmm0, 0
pclmulqdq xmm4, xmm0, 0
movdqu xmm11, xmmword [rsi]
movdqu xmm12, xmmword [rsi + 0x10]
movdqu xmm13, xmmword [rsi + 0x20]
movdqu xmm14, xmmword [rsi + 0x30]
pclmulqdq xmm5, xmm0, 0x11
pclmulqdq xmm6, xmm0, 0x11
pclmulqdq xmm7, xmm0, 0x11
pclmulqdq xmm8, xmm0, 0x11
pxor xmm1, xmm5
pxor xmm2, xmm6
pxor xmm3, xmm7
pxor xmm4, xmm8
pxor xmm1, xmm11
pxor xmm2, xmm12
pxor xmm3, xmm13
pxor xmm4, xmm14
add rdi, 0x40
add rsi, 0x40
sub rcx, 0x40
cmp rcx, 0x40
jge 0x4f7c61
movdqa xmm0, xmmword [0x0055d300]
movdqa xmm5, xmm1
pclmulqdq xmm1, xmm0, 0
pclmulqdq xmm5, xmm0, 0x11
pxor xmm1, xmm5
pxor xmm1, xmm2
movdqa xmm5, xmm1
pclmulqdq xmm1, xmm0, 0
pclmulqdq xmm5, xmm0, 0x11
pxor xmm1, xmm5
pxor xmm1, xmm3
movdqa xmm5, xmm1
pclmulqdq xmm1, xmm0, 0
pclmulqdq xmm5, xmm0, 0x11
pxor xmm1, xmm5
pxor xmm1, xmm4
cmp rcx, 0x10
jb 0x4f7d77
movdqu xmm10, xmmword [rsi]
movdqa xmm5, xmm1
pclmulqdq xmm1, xmm0, 0
pclmulqdq xmm5, xmm0, 0x11
pxor xmm1, xmm5
pxor xmm1, xmm10
sub rcx, 0x10
add rsi, 0x10
cmp rcx, 0x10
jge 0x4f7d4b
pcmpeqb xmm3, xmm3
pclmulqdq xmm0, xmm1, 1
psrldq xmm1, 8
pxor xmm1, xmm0
movdqa xmm2, xmm1
movq xmm0, qword [0x0055d188]
psrlq xmm3, 0x20
psrldq xmm2, 4
pand xmm1, xmm3
pclmulqdq xmm1, xmm0, 0
pxor xmm1, xmm2
movdqa xmm0, xmmword [0x0055d310]
movdqa xmm2, xmm1
pand xmm1, xmm3
pclmulqdq xmm1, xmm0, 0x10
pand xmm1, xmm3
pclmulqdq xmm1, xmm0, 0
pxor xmm1, xmm2
pextrd eax, xmm1, 1
mov dword [rsp + 0x28], eax
ret

Function at 0x4fb540
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4fb61d
push rbp
mov rbp, rsp
sub rsp, 0x40
movabs rdx, 0x201c7865483b6f36
mov qword [rsp + 0x1a], rdx
movabs rdx, 0x34656cfc2a6e0b47
mov qword [rsp + 0x22], rdx
movabs rdx, 0xc0c090806060b
mov qword [rsp + 0x2a], rdx
movabs rdx, 0x3020f0903000c
mov qword [rsp + 0x30], rdx
movabs rdx, 0x3060f0c0c0b0002
mov qword [rsp + 0x38], rdx
xor eax, eax
nop
jmp 0x4fb5c0
movzx r9d, byte [rsp + rsi + 0x1a]
sub r9d, edx
lea edx, [r9 + 0x2b]
mov byte [rsp + rdi + 0x1a], dl
lea edx, [r8 + 0x2b]
mov byte [rsp + rsi + 0x1a], dl
add rax, 2
nop
cmp rax, 0x16
jge 0x4fb5ed
movzx edx, byte [rsp + rax + 0x2a]
movzx esi, byte [rsp + rax + 0x2b]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x10
jae 0x4fb610
movzx r8d, byte [rsp + rdi + 0x1a]
sub r8d, edx
cmp rsi, 0x10
jb 0x4fb5a2
jmp 0x4fb604
xor eax, eax
lea rbx, [rsp + 0x1a]
mov ecx, 0x10
call fcn.00444ce0
add rsp, 0x40
pop rbp
ret
mov eax, esi
mov ecx, 0x10
call fcn.00456b60
mov eax, edi
mov ecx, 0x10
call fcn.00456b60
nop
nop dword [rax]
call fcn.004548e0
jmp fcn.004fb540
Function at 0x4fdb80
Capabilities:
Hash data using fnv

Disassembly:
test byte [rax], al
mov rcx, rbx
and ebx, 0x7f
shl rbx, 5
lea rdx, [rax + rbx]
xor eax, eax
jmp 0x4fdb97
inc rax
cmp rax, 4
jge 0x4fdbaf
lea rbx, [rdx + rax*8]
mov rbx, qword [rbx]
cmp rbx, rcx
jne 0x4fdb94
mov eax, 1
ret
xor eax, eax
movabs rbx, 0xcbf29ce484222325
jmp 0x4fdbc0
inc rax
cmp rax, 4
jge 0x4fdbce
mov rsi, qword [rdx + rax*8]
xor edi, edi
jmp 0x4fdbf7
and ebx, 3
lea rdx, [rdx + rbx*8]
xchg qword [rdx], rcx
xor eax, eax
ret
movzx r8d, sil
xor rbx, r8
inc rdi
shr rsi, 8
movabs r8, 0x100000001b3
imul rbx, r8
cmp rdi, 8
jl 0x4fdbdb
jmp 0x4fdbbd

Function at 0x4fdc00
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4fdd4c
push rbp
mov rbp, rsp
sub rsp, 0x78
movabs rdx, 0x48e5cc47cb7315ca
mov qword [rsp + 0x1f], rdx
movabs rdx, 0xd2d434733048e5cc
mov qword [rsp + 0x24], rdx
movabs rdx, 0x5f5065b378c6d6cf
mov qword [rsp + 0x2c], rdx
movabs rdx, 0xbfaec98af6adbf65
mov qword [rsp + 0x34], rdx
movabs rdx, 0xa46279745fcbb406
mov qword [rsp + 0x3c], rdx
movabs rdx, 0x1f011a03140b1f08
mov qword [rsp + 0x44], rdx
movabs rdx, 0x4041c001f011a03
mov qword [rsp + 0x48], rdx
movabs rdx, 0x240d0d19050a2311
mov qword [rsp + 0x50], rdx
movabs rdx, 0xf041811200c0e05
mov qword [rsp + 0x58], rdx
movabs rdx, 0x180d0b0620131124
mov qword [rsp + 0x60], rdx
movabs rdx, 0x1b16181e0b240417
mov qword [rsp + 0x68], rdx
movabs rdx, 0x60f1f111e1e1d1f
mov qword [rsp + 0x70], rdx
xor eax, eax
jmp 0x4fdce4
movzx r9d, byte [rsp + rsi + 0x1f]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x7f]
mov byte [rsp + rdi + 0x1f], dl
mov byte [rsp + rsi + 0x1f], r8b
add rax, 2
cmp rax, 0x34
jge 0x4fdd1c
movzx edx, byte [rsp + rax + 0x44]
movzx esi, byte [rsp + rax + 0x45]
mov edi, edx
xor edx, esi
add edx, eax
nop word [rax + rax]
cmp rdi, 0x25
jae 0x4fdd3f
movzx r8d, byte [rsp + rdi + 0x1f]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x7f]
cmp rsi, 0x25
jb 0x4fdcca
jmp 0x4fdd33
xor eax, eax
lea rbx, [rsp + 0x1f]
mov ecx, 0x25
call fcn.00444ce0
add rsp, 0x78
pop rbp
ret
mov eax, esi
mov ecx, 0x25
call fcn.00456b60
mov eax, edi
mov ecx, 0x25
call fcn.00456b60
nop
call fcn.004548e0
jmp fcn.004fdc00