joyce8/EMBER2024-capa huggingface dataset:
Function at 0x545540
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x545607
push rbp
mov rbp, rsp
sub rsp, 0x38
movabs rdx, 0x2b59440c27724644
mov qword [rsp + 0x2d], rdx
mov dword [rsp + 0x34], 0x3d4f4b2b
movabs rdx, 0x300040301010a07
mov qword [rsp + 0x1d], rdx
movabs rdx, 0x80a050409070600
mov qword [rsp + 0x25], rdx
xor eax, eax
jmp 0x5455a8
movzx r9d, byte [rsp + rsi + 0x2d]
sub r9d, edx
lea edx, [r9 + 0x2a]
mov byte [rsp + rdi + 0x2d], dl
lea edx, [r8 + 0x2a]
mov byte [rsp + rsi + 0x2d], dl
add rax, 2
cmp rax, 0x10
jge 0x5455d7
movzx edx, byte [rsp + rax + 0x1d]
movzx esi, byte [rsp + rax + 0x1e]
mov edi, edx
xor edx, esi
add edx, eax
nop
cmp rdi, 0xb
jae 0x5455fa
movzx r8d, byte [rsp + rdi + 0x2d]
sub r8d, edx
cmp rsi, 0xb
jb 0x54558b
jmp 0x5455ee
xor eax, eax
lea rbx, [rsp + 0x2d]
mov ecx, 0xb
call fcn.00447380
add rsp, 0x38
pop rbp
ret
mov eax, esi
mov ecx, 0xb
call fcn.0045a8c0
mov eax, edi
mov ecx, 0xb
call fcn.0045a8c0
nop
call fcn.004585e0
jmp fcn.00545540

Function at 0x5456e0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x545792
push rbp
mov rbp, rsp
sub rsp, 0x28
movabs rdx, 0x5a56726778696e45
mov qword [rsp + 0x20], rdx
movabs rdx, 0x606000707070600
mov qword [rsp + 0x18], rdx
xor eax, eax
jmp 0x545731
movzx r9d, byte [rsp + rsi + 0x20]
sub r9d, edx
lea edx, [r9 - 0x6c]
mov byte [rsp + rdi + 0x20], dl
lea edx, [r8 - 0x6c]
mov byte [rsp + rsi + 0x20], dl
add rax, 2
cmp rax, 8
jge 0x54575e
movzx edx, byte [rsp + rax + 0x18]
movzx esi, byte [rsp + rax + 0x19]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 8
jae 0x545785
movzx r8d, byte [rsp + rdi + 0x20]
sub r8d, edx
cmp rsi, 8
jb 0x545714
jmp 0x545775
xor eax, eax
lea rbx, [rsp + 0x20]
mov ecx, 8
call fcn.00447380
add rsp, 0x28
pop rbp
ret
mov eax, esi
mov ecx, 8
nop dword [rax]
call fcn.0045a8c0
mov eax, edi
mov ecx, 8
call fcn.0045a8c0
nop
call fcn.004585e0
jmp fcn.005456e0

Function at 0x5457a0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x54586c
push rbp
mov rbp, rsp
sub rsp, 0x30
movabs rdx, 0xc9ff613c3469eef1
mov qword [rsp + 0x26], rdx
mov word [rsp + 0x2e], 0xf73c
movabs rdx, 0x9090606070901
mov qword [rsp + 0x18], rdx
movabs rdx, 0x107080903040009
mov qword [rsp + 0x1e], rdx
xor eax, eax
jmp 0x545804
movzx r9d, byte [rsp + rsi + 0x26]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x2d]
mov byte [rsp + rdi + 0x26], dl
mov byte [rsp + rsi + 0x26], r8b
add rax, 2
cmp rax, 0xe
jge 0x54583c
movzx edx, byte [rsp + rax + 0x18]
movzx esi, byte [rsp + rax + 0x19]
mov edi, edx
xor edx, esi
add edx, eax
nop word [rax + rax]
cmp rdi, 0xa
jae 0x54585f
movzx r8d, byte [rsp + rdi + 0x26]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x2d]
cmp rsi, 0xa
jb 0x5457ea
jmp 0x545853
xor eax, eax
lea rbx, [rsp + 0x26]
mov ecx, 0xa
call fcn.00447380
add rsp, 0x30
pop rbp
ret
mov eax, esi
mov ecx, 0xa
call fcn.0045a8c0
mov eax, edi
mov ecx, 0xa
call fcn.0045a8c0
nop
call fcn.004585e0
jmp fcn.005457a0
Function at 0x55c320
Capabilities:
Encrypt data using rc4 prga

Disassembly:
lea r12, [rsp - 0x10]
cmp r12, qword [r14 + 0x10]
jbe 0x55c492
push rbp
mov rbp, rsp
sub rsp, 0x88
movabs rdx, 0xb34d73d5c9746d65
mov qword [rsp + 0x52], rdx
movabs rdx, 0x2010c8696e2db34d
mov qword [rsp + 0x58], rdx
movabs rdx, 0x662064653d7057c6
mov qword [rsp + 0x60], rdx
movabs rdx, 0x6e7552b33d4a72ff
mov qword [rsp + 0x68], rdx
movabs rdx, 0x6e20dd47dc0620aa
mov qword [rsp + 0x70], rdx
movabs rdx, 0x613e659675dfaf6f
mov qword [rsp + 0x78], rdx
movabs rdx, 0x656cb66101275ca4
mov qword [rsp + 0x80], rdx
movabs rdx, 0xf2118212c270f2e
mov qword [rsp + 0x1a], rdx
movabs rdx, 0x42a062c281e110b
mov qword [rsp + 0x22], rdx
movabs rdx, 0x15101028222f3330
mov qword [rsp + 0x2a], rdx
movabs rdx, 0x2819271a0f190707
mov qword [rsp + 0x32], rdx
movabs rdx, 0x3080f2f0b232e
mov qword [rsp + 0x3a], rdx
movabs rdx, 0x2106232c0f0e212a
mov qword [rsp + 0x42], rdx
movabs rdx, 0x333220c31161020
mov qword [rsp + 0x4a], rdx
xor eax, eax
jmp 0x55c430
movzx r9d, byte [rsp + rsi + 0x52]
sub r9d, edx
lea edx, [r9 - 0x3a]
mov byte [rsp + rdi + 0x52], dl
lea edx, [r8 - 0x3a]
mov byte [rsp + rsi + 0x52], dl
add rax, 2
cmp rax, 0x38
jge 0x55c45d
movzx edx, byte [rsp + rax + 0x1a]
movzx esi, byte [rsp + rax + 0x1b]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x36
jae 0x55c485
movzx r8d, byte [rsp + rdi + 0x52]
sub r8d, edx
cmp rsi, 0x36
jb 0x55c413
jmp 0x55c477
xor eax, eax
lea rbx, [rsp + 0x52]
mov ecx, 0x36
call fcn.00447380
add rsp, 0x88
pop rbp
ret
mov eax, esi
mov ecx, 0x36
nop
call fcn.0045a8c0
mov eax, edi
mov ecx, 0x36
call fcn.0045a8c0
nop
call fcn.004585e0
jmp fcn.0055c320
Function at 0x55da80
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x55dbcc
push rbp
mov rbp, rsp
sub rsp, 0x78
movabs rdx, 0xeec282f66c776625
mov qword [rsp + 0x52], rdx
movabs rdx, 0xf76efec59069eec2
mov qword [rsp + 0x58], rdx
movabs rdx, 0xdbfb43a1d8f025e8
mov qword [rsp + 0x60], rdx
movabs rdx, 0xf9e4ba29eb33ee9d
mov qword [rsp + 0x68], rdx
movabs rdx, 0xedbea53c5de4e0f7
mov qword [rsp + 0x70], rdx
movabs rdx, 0xa062210211c220f
mov qword [rsp + 0x1a], rdx
movabs rdx, 0x1f252018091a1a11
mov qword [rsp + 0x22], rdx
movabs rdx, 0x1f1b111a1d131106
mov qword [rsp + 0x2a], rdx
movabs rdx, 0x1c051e0504141a
mov qword [rsp + 0x32], rdx
movabs rdx, 0x9070506170e0b0d
mov qword [rsp + 0x3a], rdx
movabs rdx, 0x406151215011916
mov qword [rsp + 0x42], rdx
movabs rdx, 0xf201d231c241e1b
mov qword [rsp + 0x4a], rdx
xor eax, eax
jmp 0x55db64
movzx r9d, byte [rsp + rsi + 0x52]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x4c]
mov byte [rsp + rdi + 0x52], dl
mov byte [rsp + rsi + 0x52], r8b
add rax, 2
cmp rax, 0x38
jge 0x55db9c
movzx edx, byte [rsp + rax + 0x1a]
movzx esi, byte [rsp + rax + 0x1b]
mov edi, edx
xor edx, esi
add edx, eax
nop word [rax + rax]
cmp rdi, 0x26
jae 0x55dbbf
movzx r8d, byte [rsp + rdi + 0x52]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x4c]
cmp rsi, 0x26
jb 0x55db4a
jmp 0x55dbb3
xor eax, eax
lea rbx, [rsp + 0x52]
mov ecx, 0x26
call fcn.00447380
add rsp, 0x78
pop rbp
ret
mov eax, esi
mov ecx, 0x26
call fcn.0045a8c0
mov eax, edi
mov ecx, 0x26
call fcn.0045a8c0
nop
call fcn.004585e0
jmp fcn.0055da80

Function at 0x55ef40
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x55f006
push rbp
mov rbp, rsp
sub rsp, 0x30
movabs rdx, 0x390eccbb5b323130
mov qword [rsp + 0x25], rdx
mov dword [rsp + 0x2c], 0xbd39b939
movabs rdx, 0xa03030503030506
mov qword [rsp + 0x19], rdx
mov dword [rsp + 0x21], 0x4080807
xor eax, eax
jmp 0x55efa0
movzx r9d, byte [rsp + rsi + 0x25]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x67]
mov byte [rsp + rdi + 0x25], dl
mov byte [rsp + rsi + 0x25], r8b
add rax, 2
nop
cmp rax, 0xc
jge 0x55efd2
movzx edx, byte [rsp + rax + 0x19]
movzx esi, byte [rsp + rax + 0x1a]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0xb
jae 0x55eff7
movzx r8d, byte [rsp + rdi + 0x25]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x67]
cmp rsi, 0xb
jb 0x55ef84
jmp 0x55efeb
xor eax, eax
lea rbx, [rsp + 0x25]
mov ecx, 0xb
nop
call fcn.00447380
add rsp, 0x30
pop rbp
ret
mov eax, esi
mov ecx, 0xb
call fcn.0045a8c0
mov eax, edi
mov ecx, 0xb
nop
call fcn.0045a8c0
nop
call fcn.004585e0
jmp fcn.0055ef40
Function at 0x560000
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x560108
push rbp
mov rbp, rsp
sub rsp, 0x58
movabs rdx, 0xcf72e5675ea05d92
mov qword [rsp + 0x3e], rdx
movabs rdx, 0xb16f3c667265c8e6
mov qword [rsp + 0x46], rdx
movabs rdx, 0x9ed1b16f3c667265
mov qword [rsp + 0x48], rdx
movabs rdx, 0x9e9b6594bb479b85
mov qword [rsp + 0x50], rdx
movabs rdx, 0x81801190919110d
mov qword [rsp + 0x1e], rdx
movabs rdx, 0x319161213140211
mov qword [rsp + 0x26], rdx
movabs rdx, 0x180f070205001005
mov qword [rsp + 0x2e], rdx
movabs rdx, 0x1015031002150716
mov qword [rsp + 0x36], rdx
xor eax, eax
jmp 0x5600ab
movzx r9d, byte [rsp + rsi + 0x3e]
sub r9d, edx
lea edx, [r9 - 0x16]
mov byte [rsp + rdi + 0x3e], dl
lea edx, [r8 - 0x16]
mov byte [rsp + rsi + 0x3e], dl
add rax, 2
cmp rax, 0x20
jge 0x5600d8
movzx edx, byte [rsp + rax + 0x1e]
movzx esi, byte [rsp + rax + 0x1f]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x1a
jae 0x5600fb
movzx r8d, byte [rsp + rdi + 0x3e]
sub r8d, edx
cmp rsi, 0x1a
jb 0x56008e
jmp 0x5600ef
xor eax, eax
lea rbx, [rsp + 0x3e]
mov ecx, 0x1a
call fcn.00447380
add rsp, 0x58
pop rbp
ret
mov eax, esi
mov ecx, 0x1a
call fcn.0045a8c0
mov eax, edi
mov ecx, 0x1a
call fcn.0045a8c0
nop
call fcn.004585e0
jmp fcn.00560000

Function at 0x5654c0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x5655aa
push rbp
mov rbp, rsp
sub rsp, 0x40
movabs rdx, 0x7d2e3534dcbe3130
mov qword [rsp + 0x2f], rdx
movabs rdx, 0x997d2e3534dcbe31
mov qword [rsp + 0x30], rdx
movabs rdx, 0x8e2194443d50939
mov qword [rsp + 0x38], rdx
movabs rdx, 0x3080e020b070a0b
mov qword [rsp + 0x1b], rdx
movabs rdx, 0x706020203080e02
mov qword [rsp + 0x1f], rdx
movabs rdx, 0xe10030f0b020207
mov qword [rsp + 0x27], rdx
xor eax, eax
jmp 0x56554d
movzx r9d, byte [rsp + rsi + 0x2f]
sub r9d, edx
lea edx, [r9 + 0x6d]
mov byte [rsp + rdi + 0x2f], dl
lea edx, [r8 + 0x6d]
mov byte [rsp + rsi + 0x2f], dl
add rax, 2
cmp rax, 0x14
jge 0x56557a
movzx edx, byte [rsp + rax + 0x1b]
movzx esi, byte [rsp + rax + 0x1c]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x11
jae 0x56559d
movzx r8d, byte [rsp + rdi + 0x2f]
sub r8d, edx
cmp rsi, 0x11
jb 0x565530
jmp 0x565591
xor eax, eax
lea rbx, [rsp + 0x2f]
mov ecx, 0x11
call fcn.00447380
add rsp, 0x40
pop rbp
ret
mov eax, esi
mov ecx, 0x11
call fcn.0045a8c0
mov eax, edi
mov ecx, 0x11
call fcn.0045a8c0
nop
call fcn.004585e0
jmp fcn.005654c0
Function at 0x569180
Capabilities:
Hash data using fnv

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x5698d4
push rbp
mov rbp, rsp
sub rsp, 0x10
mov qword [rsp + 0x20], rax
movabs rcx, 0xcbf29ce484222325
jmp 0x5691ad
lea rax, [rdx + 0x10]
dec rbx
mov rcx, rsi
test rbx, rbx
jle 0x569431
mov rdx, rax
mov rsi, qword [rax]
nop dword [rax]
test rsi, rsi
je 0x56945d
mov edi, dword [rsi + 0x10]
shr edi, 1
mov r8, qword [rax + 8]
and edi, 0x3f
lea rax, [0x005d8c80]
jmp qword [rax + rdi*8]
mov rax, rcx
add rsp, 0x10
pop rbp
ret
nop dword [rax]
call fcn.00569ae0
call fcn.00409cc0
mov rbx, rax
lea rax, [0x00582220]
call fcn.004313a0
inc rax
nop dword [rax]
cmp rax, r8
jge 0x56948e
mov r9, qword [rsi + rax*8]
xor r10d, r10d
jmp 0x5694c3
lea rdi, [0x005822a0]
mov rsi, rcx
movabs rcx, 0x100000001b3
jmp 0x5691a3
movzx r11d, r9b
xor rcx, r11
inc r10
shr r9, 8
movabs r11, 0x100000001b3
imul rcx, r11
cmp r10, 8
jl 0x5694a7
jmp 0x569479
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
call fcn.004585e0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
jmp fcn.00569180

Function at 0x569a60
Capabilities:
Hash data using fnv

Disassembly:
test byte [rax], al
mov rcx, rbx
and ebx, 0x7f
shl rbx, 5
lea rdx, [rax + rbx]
xor eax, eax
jmp 0x569a77
inc rax
cmp rax, 4
jge 0x569a8f
lea rbx, [rdx + rax*8]
mov rbx, qword [rbx]
cmp rbx, rcx
jne 0x569a74
mov eax, 1
ret
xor eax, eax
movabs rbx, 0xcbf29ce484222325
jmp 0x569aa0
inc rax
cmp rax, 4
jge 0x569aae
mov rsi, qword [rdx + rax*8]
xor edi, edi
jmp 0x569ad7
and ebx, 3
lea rdx, [rdx + rbx*8]
xchg qword [rdx], rcx
xor eax, eax
ret
movzx r8d, sil
xor rbx, r8
inc rdi
shr rsi, 8
movabs r8, 0x100000001b3
imul rbx, r8
cmp rdi, 8
jl 0x569abb
jmp 0x569a9d

Function at 0x56cee0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x56cfdb
push rbp
mov rbp, rsp
sub rsp, 0x50
movabs rdx, 0x2dcf30c7d2bf6ec9
mov qword [rsp + 0x38], rdx
movabs rdx, 0x8300b665c174d1b4
mov qword [rsp + 0x40], rdx
movabs rdx, 0xb73ace6132c715cb
mov qword [rsp + 0x48], rdx
movabs rdx, 0xf070e1005030009
mov qword [rsp + 0x1e], rdx
movabs rdx, 0x30d060413110b10
mov qword [rsp + 0x26], rdx
movabs rdx, 0x212030d06041311
mov qword [rsp + 0x28], rdx
movabs rdx, 0x111508130e0f0b17
mov qword [rsp + 0x30], rdx
xor eax, eax
jmp 0x56cf79
movzx r9d, byte [rsp + rsi + 0x38]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x71]
mov byte [rsp + rdi + 0x38], dl
mov byte [rsp + rsi + 0x38], r8b
add rax, 2
cmp rax, 0x1a
jge 0x56cfab
movzx edx, byte [rsp + rax + 0x1e]
movzx esi, byte [rsp + rax + 0x1f]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x18
jae 0x56cfce
movzx r8d, byte [rsp + rdi + 0x38]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x71]
cmp rsi, 0x18
jb 0x56cf5f
jmp 0x56cfc2
xor eax, eax
lea rbx, [rsp + 0x38]
mov ecx, 0x18
call fcn.00447380
add rsp, 0x50
pop rbp
ret
mov eax, esi
mov ecx, 0x18
call fcn.0045a8c0
mov eax, edi
mov ecx, 0x18
call fcn.0045a8c0
nop
nop dword [rax + rax]
call fcn.004585e0
jmp fcn.0056cee0
Function at 0x571040
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x571148
push rbp
mov rbp, rsp
sub rsp, 0x50
movabs rdx, 0x20551ce96112be69
mov qword [rsp + 0x35], rdx
movabs rdx, 0x74086526d967a761
mov qword [rsp + 0x3d], rdx
movabs rdx, 0x6f741274086526d9
mov qword [rsp + 0x40], rdx
movabs rdx, 0x65c62dd9256847ae
mov qword [rsp + 0x48], rdx
movabs rdx, 0x140e060602170109
mov qword [rsp + 0x19], rdx
movabs rdx, 0x50e130b01061910
mov qword [rsp + 0x21], rdx
movabs rdx, 0x416180b050e130b
mov qword [rsp + 0x25], rdx
movabs rdx, 0x90c180216010105
mov qword [rsp + 0x2d], rdx
xor eax, eax
jmp 0x5710eb
movzx r9d, byte [rsp + rsi + 0x35]
sub r9d, edx
lea edx, [r9 + 0x6b]
mov byte [rsp + rdi + 0x35], dl
lea edx, [r8 + 0x6b]
mov byte [rsp + rsi + 0x35], dl
add rax, 2
cmp rax, 0x1c
jge 0x571118
movzx edx, byte [rsp + rax + 0x19]
movzx esi, byte [rsp + rax + 0x1a]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x1b
jae 0x57113b
movzx r8d, byte [rsp + rdi + 0x35]
sub r8d, edx
cmp rsi, 0x1b
jb 0x5710ce
jmp 0x57112f
xor eax, eax
lea rbx, [rsp + 0x35]
mov ecx, 0x1b
call fcn.00447380
add rsp, 0x50
pop rbp
ret
mov eax, esi
mov ecx, 0x1b
call fcn.0045a8c0
mov eax, edi
mov ecx, 0x1b
call fcn.0045a8c0
nop
call fcn.004585e0
jmp fcn.00571040

Function at 0x573720
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x57380c
push rbp
mov rbp, rsp
sub rsp, 0x40
movabs rdx, 0x2dc0201f7025b71c
mov qword [rsp + 0x2c], rdx
movabs rdx, 0x69e11f702dc0201f
mov qword [rsp + 0x30], rdx
movabs rdx, 0x17fd2512d2c31c61
mov qword [rsp + 0x38], rdx
movabs rdx, 0x100e130602070b02
mov qword [rsp + 0x18], rdx
movabs rdx, 0x90a1301100e1306
mov qword [rsp + 0x1c], rdx
movabs rdx, 0x7040d09070f0012
mov qword [rsp + 0x24], rdx
xor eax, eax
jmp 0x5737aa
movzx r9d, byte [rsp + rsi + 0x2c]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x39]
mov byte [rsp + rdi + 0x2c], dl
mov byte [rsp + rsi + 0x2c], r8b
add rax, 2
cmp rax, 0x14
jge 0x5737dc
movzx edx, byte [rsp + rax + 0x18]
movzx esi, byte [rsp + rax + 0x19]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x14
jae 0x5737ff
movzx r8d, byte [rsp + rdi + 0x2c]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x39]
cmp rsi, 0x14
jb 0x573790
jmp 0x5737f3
xor eax, eax
lea rbx, [rsp + 0x2c]
mov ecx, 0x14
call fcn.00447380
add rsp, 0x40
pop rbp
ret
mov eax, esi
mov ecx, 0x14
call fcn.0045a8c0
mov eax, edi
mov ecx, 0x14
call fcn.0045a8c0
nop
call fcn.004585e0
jmp fcn.00573720
Function at 0x5738c0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x5739aa
push rbp
mov rbp, rsp
sub rsp, 0x48
movabs rdx, 0x65723c766f63d552
mov qword [rsp + 0x33], rdx
movabs rdx, 0x4e3b33d7cd65723c
mov qword [rsp + 0x38], rdx
movabs rdx, 0x2e63692f61701623
mov qword [rsp + 0x40], rdx
movabs rdx, 0x140c14050e0f0a0a
mov qword [rsp + 0x1d], rdx
movabs rdx, 0x10b0f0d0b0d140c
mov qword [rsp + 0x23], rdx
movabs rdx, 0xf09140a0a110805
mov qword [rsp + 0x2b], rdx
xor eax, eax
jmp 0x57394d
movzx r9d, byte [rsp + rsi + 0x33]
sub r9d, edx
lea edx, [r9 - 0x4d]
mov byte [rsp + rdi + 0x33], dl
lea edx, [r8 - 0x4d]
mov byte [rsp + rsi + 0x33], dl
add rax, 2
cmp rax, 0x16
jge 0x57397a
movzx edx, byte [rsp + rax + 0x1d]
movzx esi, byte [rsp + rax + 0x1e]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x15
jae 0x57399d
movzx r8d, byte [rsp + rdi + 0x33]
sub r8d, edx
cmp rsi, 0x15
jb 0x573930
jmp 0x573991
xor eax, eax
lea rbx, [rsp + 0x33]
mov ecx, 0x15
call fcn.00447380
add rsp, 0x48
pop rbp
ret
mov eax, esi
mov ecx, 0x15
call fcn.0045a8c0
mov eax, edi
mov ecx, 0x15
call fcn.0045a8c0
nop
call fcn.004585e0
jmp fcn.005738c0
Function at 0x140024920
Capabilities:
Terminate process

Disassembly:
jmp 0x14004f030
push rsi
push rdi
sub rsp, 0x38
mov rdi, qword [rcx + 0x30]
mov rcx, rdi
mov edx, 1
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
test eax, eax
je 0x14004f050
xor esi, esi
jmp 0x14004f0bc
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
cmp eax, 5
jne 0x14004f0b4
mov rcx, rdi
xor edx, edx
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x14004f075
cmp eax, 0x102
je 0x14004f04c
jmp 0x14004f08f
mov dword [rsp + 0x24], 0
lea rdx, [rsp + 0x24]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
test eax, eax
jne 0x14004f04c
call qword [sym.imp.KERNEL32.dll_GetLastError]
shl rax, 0x20
or rax, 2
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], 1
lea rcx, [rsp + 0x30]
call fcn.140043040
shl rsi, 0x20
or rsi, 2
mov rax, rsi
add rsp, 0x38
pop rdi
pop rsi
ret

Function at 0x1400250e0
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x28
mov rax, qword [rcx]
nop word [rax + rax]
mov rdx, rax
xor rdx, 3
lock cmpxchg qword [rcx], rdx
jne 0x1400250f0
test al, 1
je 0x14002510f
test al, 2
jne 0x140025129
xor rax, 3
add rsp, 0x28
ret
lea rcx, str.assertion_failed:_prev.is_running__
lea r8, [0x1409925e8]
mov edx, 0x23
call fcn.140072050
ud2
lea rcx, str.assertion_failed:__prev.is_complete__
lea r8, [0x140992628]
mov edx, 0x25
call fcn.140072050
ud2
Function at 0x1400362f0
Capabilities:
Encode data using xor

Disassembly:
push rbp
sub rsp, 0xb0
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x28], 0xfffffffffffffffe
mov qword [rbp + 0x18], rcx
mov rax, qword [rcx]
nop
mov rdx, rax
xor rdx, 3
lock cmpxchg qword [rcx], rdx
jne 0x140036310
test al, 1
je 0x1400363d9
test al, 2
jne 0x1400363f3
xor rax, 3
mov qword [rbp], rax
mov rcx, rbp
lea rdx, [rbp + 0x18]
call fcn.14003bd40
test rax, rax
je 0x14003636e
mov qword [rbp + 0x10], rax
mov rcx, rax
mov qword [rbp + 0x20], rdx
call qword [rdx]
mov rax, qword [rbp + 0x20]
mov rdx, qword [rax + 8]
test rdx, rdx
mov rcx, qword [rbp + 0x10]
je 0x14003636e
mov r8, qword [rax + 0x10]
call fcn.140017b20
mov rcx, qword [rbp + 0x18]
mov qword [rbp + 8], 1
mov rax, 0xffffffffffffffc0
lock xadd qword [rcx], rax
shr rax, 6
cmp rax, qword [rbp + 8]
jb 0x14003640d
jne 0x1400363cf
mov rax, qword [rbp + 0x18]
mov qword [rbp + 0x20], rax
lea rcx, [rax + 0x28]
call fcn.14001d4d0
mov rax, qword [rbp + 0x20]
mov rax, qword [rax + 0x58]
test rax, rax
je 0x1400363bb
mov rcx, qword [rbp + 0x20]
mov rcx, qword [rcx + 0x60]
call qword [rax + 0x18]
mov edx, 0x80
mov r8d, 0x80
mov rcx, qword [rbp + 0x20]
call fcn.140017b20
nop
add rsp, 0xb0
pop rbp
ret
lea rcx, str.assertion_failed:_prev.is_running__
lea r8, [0x1409925e8]
mov edx, 0x23
call fcn.140072050
ud2
lea rcx, str.assertion_failed:__prev.is_complete__
lea r8, [0x140992628]
mov edx, 0x25
call fcn.140072050
ud2
mov qword [rbp - 8], rax
lea rax, [rbp - 8]
mov qword [rbp - 0x28], rax
lea rax, [fcn.14006dbe0]
mov qword [rbp - 0x20], rax
lea rcx, [rbp + 8]
mov qword [rbp - 0x18], rcx
mov qword [rbp - 0x10], rax
lea rax, str.current:___sub:__
mov qword [rbp - 0x58], rax
mov qword [rbp - 0x50], 2
mov qword [rbp - 0x38], 0
lea rax, [rbp - 0x28]
mov qword [rbp - 0x48], rax
mov qword [rbp - 0x40], 2
lea rdx, [0x140992670]
lea rcx, [rbp - 0x58]
call fcn.140071fa0
ud2

Function at 0x14003d740
Capabilities:
Get system information on windows

Disassembly:
sub rsp, 0x58
xorps xmm0, xmm0
movaps xmmword [rsp + 0x40], xmm0
movaps xmmword [rsp + 0x30], xmm0
movaps xmmword [rsp + 0x20], xmm0
lea rcx, [rsp + 0x20]
call sub.KERNEL32.dll_GetSystemInfo
mov eax, dword [rsp + 0x40]
add rsp, 0x58
ret
Function at 0x140048e60
Capabilities:
Get common file path

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x478
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x3f0], 0xfffffffffffffffe
mov qword [rbp + 0x3e0], rcx
mov qword [rbp + 0x3c8], 2
xorps xmm0, xmm0
movups xmmword [rbp + 0x3d0], xmm0
mov r8d, 0x200
mov eax, 2
mov qword [rbp + 0x3e8], rax
xor edi, edi
xor ebx, ebx
xor r12d, r12d
cmp r8, 0x201
jae 0x140048ef0
jmp 0x140048edf
jae 0x140048fb0
cmp r8, 0x201
jae 0x140048ef0
mov esi, 0x200
lea r13, [rbp - 0x58]
mov r15, r8
jmp 0x140048f48
sub r8, r12
sub rbx, r12
cmp rbx, r8
jae 0x140048f1f
lea rcx, [rbp + 0x3c8]
mov rdx, r12
call fcn.140071500
mov rax, qword [rbp + 0x3c8]
mov qword [rbp + 0x3e8], rax
mov rdi, qword [rbp + 0x3d0]
mov eax, 0xffffffff
cmp rdi, rax
mov r12d, 0xffffffff
cmovb r12, rdi
mov qword [rbp + 0x3d8], r12
mov rbx, rdi
mov rsi, r12
mov r13, qword [rbp + 0x3e8]
mov r15, r12
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov ecx, r15d
mov rdx, r13
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
mov r14d, eax
test eax, eax
jne 0x140048f71
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x140049018
mov r8d, r14d
cmp r15, r8
jne 0x140048ed0
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x14004903b
add r15, r15
mov eax, 0xffffffff
cmp r15, rax
cmovae r15, rax
mov r8, r15
cmp r8, 0x201
jb 0x140048edf
jmp 0x140048ef0
cmp rsi, r8
jb 0x140049055
lea rcx, [rbp + 0x3a8]
mov rdx, r13
call fcn.14004c520
movups xmm0, xmmword [rbp + 0x3a8]
movups xmm1, xmmword [rbp + 0x3b8]
mov rsi, qword [rbp + 0x3e0]
movups xmmword [rsi + 0x10], xmm1
movups xmmword [rsi], xmm0
test rdi, rdi
je 0x140049001
add rdi, rdi
mov r8d, 2
mov rcx, qword [rbp + 0x3e8]
mov rdx, rdi
call fcn.140017b20
mov rax, rsi
add rsp, 0x478
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
shl rax, 0x20
or rax, 2
mov rsi, qword [rbp + 0x3e0]
mov qword [rsi], rax
mov byte [rsi + 0x18], 2
test rdi, rdi
jne 0x140048fe9
jmp 0x140049001
lea rcx, str.internal_error:_entered_unreachable_code_bi
lea r8, str.library_std_src_syswindowsmod.rs
mov edx, 0x28
call fcn.140072050
jmp 0x14004906a
lea rax, str.library_std_src_syswindowsmod.rs
mov rcx, r8
mov rdx, rsi
mov r8, rax
call fcn.140072540
ud2