joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5427a0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x54287d
push rbp
mov rbp, rsp
sub rsp, 0x40
movabs rdx, 0xbf51b1ad57b6c747
mov qword [rsp + 0x30], rdx
movabs rdx, 0xbe611806caeea5b6
mov qword [rsp + 0x38], rdx
movabs rdx, 0x80706020f040d03
mov qword [rsp + 0x1a], rdx
movabs rdx, 0x10c02050d050807
mov qword [rsp + 0x20], rdx
movabs rdx, 0x9030a090101050b
mov qword [rsp + 0x28], rdx
xor eax, eax
nop
jmp 0x542820
movzx r9d, byte [rsp + rsi + 0x30]
sub r9d, edx
lea edx, [r9 - 0x3c]
mov byte [rsp + rdi + 0x30], dl
lea edx, [r8 - 0x3c]
mov byte [rsp + rsi + 0x30], dl
add rax, 2
nop
cmp rax, 0x16
jge 0x54284d
movzx edx, byte [rsp + rax + 0x1a]
movzx esi, byte [rsp + rax + 0x1b]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x10
jae 0x542870
movzx r8d, byte [rsp + rdi + 0x30]
sub r8d, edx
cmp rsi, 0x10
jb 0x542802
jmp 0x542864
xor eax, eax
lea rbx, [rsp + 0x30]
mov ecx, 0x10
call fcn.0045b080
add rsp, 0x40
pop rbp
ret
mov eax, esi
mov ecx, 0x10
call fcn.004607e0
mov eax, edi
mov ecx, 0x10
call fcn.004607e0
nop
nop dword [rax]
call fcn.0045e500
jmp fcn.005427a0

Function at 0x543260
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x54336c
push rbp
mov rbp, rsp
sub rsp, 0x58
movabs rdx, 0x11a46ce9bd0d6526
mov qword [rsp + 0x3b], rdx
movabs rdx, 0x17ba726f16ffd165
mov qword [rsp + 0x43], rdx
movabs rdx, 0x420dec1ed217ba72
mov qword [rsp + 0x48], rdx
movabs rdx, 0x81650bfac56148ee
mov qword [rsp + 0x50], rdx
movabs rdx, 0x121009120f180a00
mov qword [rsp + 0x1d], rdx
movabs rdx, 0x1307030e070f0b0f
mov qword [rsp + 0x25], rdx
movabs rdx, 0x315130611121307
mov qword [rsp + 0x2b], rdx
movabs rdx, 0x1a1304191c04020e
mov qword [rsp + 0x33], rdx
xor eax, eax
jmp 0x543308
movzx r9d, byte [rsp + rsi + 0x3b]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x3e]
mov byte [rsp + rdi + 0x3b], dl
mov byte [rsp + rsi + 0x3b], r8b
add rax, 2
cmp rax, 0x1e
jge 0x54333c
movzx edx, byte [rsp + rax + 0x1d]
movzx esi, byte [rsp + rax + 0x1e]
mov edi, edx
xor edx, esi
add edx, eax
nop
cmp rdi, 0x1d
jae 0x54335f
movzx r8d, byte [rsp + rdi + 0x3b]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x3e]
cmp rsi, 0x1d
jb 0x5432ee
jmp 0x543353
xor eax, eax
lea rbx, [rsp + 0x3b]
mov ecx, 0x1d
call fcn.0045b080
add rsp, 0x58
pop rbp
ret
mov eax, esi
mov ecx, 0x1d
call fcn.004607e0
mov eax, edi
mov ecx, 0x1d
call fcn.004607e0
nop
call fcn.0045e500
jmp fcn.00543260
Function at 0x545960
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x545a27
push rbp
mov rbp, rsp
sub rsp, 0x38
movabs rdx, 0xd7d2bd75c5b0b56a
mov qword [rsp + 0x2c], rdx
mov dword [rsp + 0x34], 0x29728275
movabs rdx, 0x9030909070b0105
mov qword [rsp + 0x1c], rdx
movabs rdx, 0x706060203030002
mov qword [rsp + 0x24], rdx
xor eax, eax
jmp 0x5459c8
movzx r9d, byte [rsp + rsi + 0x2c]
sub r9d, edx
lea edx, [r9 - 0x50]
mov byte [rsp + rdi + 0x2c], dl
lea edx, [r8 - 0x50]
mov byte [rsp + rsi + 0x2c], dl
add rax, 2
cmp rax, 0x10
jge 0x5459f7
movzx edx, byte [rsp + rax + 0x1c]
movzx esi, byte [rsp + rax + 0x1d]
mov edi, edx
xor edx, esi
add edx, eax
nop
cmp rdi, 0xc
jae 0x545a1a
movzx r8d, byte [rsp + rdi + 0x2c]
sub r8d, edx
cmp rsi, 0xc
jb 0x5459ab
jmp 0x545a0e
xor eax, eax
lea rbx, [rsp + 0x2c]
mov ecx, 0xc
call fcn.0045b080
add rsp, 0x38
pop rbp
ret
mov eax, esi
mov ecx, 0xc
call fcn.004607e0
mov eax, edi
mov ecx, 0xc
call fcn.004607e0
nop
call fcn.0045e500
jmp fcn.00545960

Function at 0x547080
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x54717b
push rbp
mov rbp, rsp
sub rsp, 0x48
movabs rdx, 0xf94fef6cfeda5357
mov qword [rsp + 0x32], rdx
movabs rdx, 0xfcfb6159e665f94f
mov qword [rsp + 0x38], rdx
movabs rdx, 0x666ce5738c00601d
mov qword [rsp + 0x40], rdx
movabs rdx, 0xa070d031105040d
mov qword [rsp + 0x18], rdx
movabs rdx, 0x5020c130c020c0e
mov qword [rsp + 0x20], rdx
movabs rdx, 0x70205020c130c02
mov qword [rsp + 0x22], rdx
movabs rdx, 0xf0915070f151013
mov qword [rsp + 0x2a], rdx
xor eax, eax
jmp 0x547119
movzx r9d, byte [rsp + rsi + 0x32]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x60]
mov byte [rsp + rdi + 0x32], dl
mov byte [rsp + rsi + 0x32], r8b
add rax, 2
cmp rax, 0x1a
jge 0x54714b
movzx edx, byte [rsp + rax + 0x18]
movzx esi, byte [rsp + rax + 0x19]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x16
jae 0x54716e
movzx r8d, byte [rsp + rdi + 0x32]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x60]
cmp rsi, 0x16
jb 0x5470ff
jmp 0x547162
xor eax, eax
lea rbx, [rsp + 0x32]
mov ecx, 0x16
call fcn.0045b080
add rsp, 0x48
pop rbp
ret
mov eax, esi
mov ecx, 0x16
call fcn.004607e0
mov eax, edi
mov ecx, 0x16
call fcn.004607e0
nop
nop dword [rax + rax]
call fcn.0045e500
jmp fcn.00547080
Function at 0x54e220
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x54e328
push rbp
mov rbp, rsp
sub rsp, 0x50
movabs rdx, 0x73692030bf2c6e2a
mov qword [rsp + 0x37], rdx
movabs rdx, 0xa56fd0b4af306574
mov qword [rsp + 0x3f], rdx
movabs rdx, 0x6ca56fd0b4af3065
mov qword [rsp + 0x40], rdx
movabs rdx, 0xf13e1bf94d64fa2e
mov qword [rsp + 0x48], rdx
movabs rdx, 0x318050d150c1602
mov qword [rsp + 0x1d], rdx
movabs rdx, 0x50b030c18180f
mov qword [rsp + 0x25], rdx
movabs rdx, 0x40a00050b030c18
mov qword [rsp + 0x27], rdx
movabs rdx, 0x1512170f15031512
mov qword [rsp + 0x2f], rdx
xor eax, eax
jmp 0x54e2cb
movzx r9d, byte [rsp + rsi + 0x37]
sub r9d, edx
lea edx, [r9 + 0x5c]
mov byte [rsp + rdi + 0x37], dl
lea edx, [r8 + 0x5c]
mov byte [rsp + rsi + 0x37], dl
add rax, 2
cmp rax, 0x1a
jge 0x54e2f8
movzx edx, byte [rsp + rax + 0x1d]
movzx esi, byte [rsp + rax + 0x1e]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x19
jae 0x54e31b
movzx r8d, byte [rsp + rdi + 0x37]
sub r8d, edx
cmp rsi, 0x19
jb 0x54e2ae
jmp 0x54e30f
xor eax, eax
lea rbx, [rsp + 0x37]
mov ecx, 0x19
call fcn.0045b080
add rsp, 0x50
pop rbp
ret
mov eax, esi
mov ecx, 0x19
call fcn.004607e0
mov eax, edi
mov ecx, 0x19
call fcn.004607e0
nop
call fcn.0045e500
jmp fcn.0054e220
Function at 0x54e340
Capabilities:
Encrypt data using rc4 prga

Disassembly:
lea r12, [rsp - 0x38]
cmp r12, qword [r14 + 0x10]
jbe 0x54e50a
push rbp
mov rbp, rsp
sub rsp, 0xb0
movabs rdx, 0x533e82a48c7f3b4f
mov qword [rsp + 0x69], rdx
movabs rdx, 0x724b636ebc862053
mov qword [rsp + 0x70], rdx
movabs rdx, 0x65706482756e655f
mov qword [rsp + 0x78], rdx
movabs rdx, 0x7578be3b564b715a
mov qword [rsp + 0x80], rdx
movabs rdx, 0x5f6993650348756f
mov qword [rsp + 0x88], rdx
movabs rdx, 0x8dc9706620b27d3d
mov qword [rsp + 0x90], rdx
movabs rdx, 0x6b636f73205a6f20
mov qword [rsp + 0x98], rdx
movabs rdx, 0x6f616122288a2165
mov qword [rsp + 0xa0], rdx
movabs rdx, 0x7c95a46ddc34835d
mov qword [rsp + 0xa8], rdx
movabs rdx, 0x71723370d00203f
mov qword [rsp + 0x1f], rdx
movabs rdx, 0xf451200121b2126
mov qword [rsp + 0x27], rdx
movabs rdx, 0x1e380f451200121b
mov qword [rsp + 0x29], rdx
movabs rdx, 0x139421d191a2731
mov qword [rsp + 0x31], rdx
movabs rdx, 0x2e071c372c3d1b24
mov qword [rsp + 0x39], rdx
movabs rdx, 0x518002202444323
mov qword [rsp + 0x41], rdx
movabs rdx, 0x13280918144621
mov qword [rsp + 0x49], rdx
movabs rdx, 0x12290a12132d3e3b
mov qword [rsp + 0x51], rdx
movabs rdx, 0x3f31061345402020
mov qword [rsp + 0x59], rdx
movabs rdx, 0x444445032d041d37
mov qword [rsp + 0x61], rdx
xor eax, eax
jmp 0x54e4aa
movzx r9d, byte [rsp + rsi + 0x69]
sub r9d, edx
lea edx, [r9 + 0x35]
mov byte [rsp + rdi + 0x69], dl
lea edx, [r8 + 0x35]
mov byte [rsp + rsi + 0x69], dl
add rax, 2
cmp rax, 0x4a
jge 0x54e4d7
movzx edx, byte [rsp + rax + 0x1f]
movzx esi, byte [rsp + rax + 0x20]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x47
jae 0x54e4fd
movzx r8d, byte [rsp + rdi + 0x69]
sub r8d, edx
cmp rsi, 0x47
jb 0x54e48d
jmp 0x54e4f1
xor eax, eax
lea rbx, [rsp + 0x69]
mov ecx, 0x47
call fcn.0045b080
add rsp, 0xb0
pop rbp
ret
mov eax, esi
mov ecx, 0x47
call fcn.004607e0
mov eax, edi
mov ecx, 0x47
call fcn.004607e0
nop
call fcn.0045e500
jmp fcn.0054e340

Function at 0x54e8c0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x54e97e
push rbp
mov rbp, rsp
sub rsp, 0x30
movabs rdx, 0x6d6d697420402f66
mov qword [rsp + 0x25], rdx
mov dword [rsp + 0x2c], 0x43585f6d
movabs rdx, 0x809070a000208
mov qword [rsp + 0x19], rdx
mov dword [rsp + 0x21], 0x70808
xor eax, eax
jmp 0x54e921
movzx r9d, byte [rsp + rsi + 0x25]
sub r9d, edx
lea edx, [r9 + 0x1a]
mov byte [rsp + rdi + 0x25], dl
lea edx, [r8 + 0x1a]
mov byte [rsp + rsi + 0x25], dl
add rax, 2
cmp rax, 0xc
jge 0x54e94e
movzx edx, byte [rsp + rax + 0x19]
movzx esi, byte [rsp + rax + 0x1a]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0xb
jae 0x54e971
movzx r8d, byte [rsp + rdi + 0x25]
sub r8d, edx
cmp rsi, 0xb
jb 0x54e904
jmp 0x54e965
xor eax, eax
lea rbx, [rsp + 0x25]
mov ecx, 0xb
call fcn.0045b080
add rsp, 0x30
pop rbp
ret
mov eax, esi
mov ecx, 0xb
call fcn.004607e0
mov eax, edi
mov ecx, 0xb
call fcn.004607e0
nop
nop
call fcn.0045e500
jmp fcn.0054e8c0
Function at 0x550540
Capabilities:
Encrypt data using rc4 prga

Disassembly:
lea r12, [rsp - 0x28]
cmp r12, qword [r14 + 0x10]
jbe 0x550675
push rbp
mov rbp, rsp
sub rsp, 0xa0
movabs rdx, 0x9eaeb87c423a7bd6
mov qword [rsp + 0x69], rdx
movabs rdx, 0x66e23020bb6a899e
mov qword [rsp + 0x70], rdx
movabs rdx, 0x742360579743a020
mov qword [rsp + 0x78], rdx
movabs rdx, 0xd9b51a6fe61588fe
mov qword [rsp + 0x80], rdx
movabs rdx, 0x22a4706f09656d96
mov qword [rsp + 0x88], rdx
movabs rdx, 0x2013ea2f644df665
mov qword [rsp + 0x90], rdx
movabs rdx, 0xa16c9894f8c55fcf
mov qword [rsp + 0x98], rdx
lea rdi, [rsp + 0x19]
lea rsi, [0x005dce70]
nop dword [rax + rax]
mov qword [rsp - 0x10], rbp
lea rbp, [rsp - 0x10]
call fcn.00460dfa
mov rbp, qword [rbp]
xor eax, eax
jmp 0x550614
movzx r9d, byte [rsp + rsi + 0x69]
sub r9d, edx
lea edx, [r9 - 0x4c]
mov byte [rsp + rdi + 0x69], dl
lea edx, [r8 - 0x4c]
mov byte [rsp + rsi + 0x69], dl
add rax, 2
cmp rax, 0x50
jge 0x550642
movzx edx, byte [rsp + rax + 0x19]
movzx esi, byte [rsp + rax + 0x1a]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x37
jae 0x550668
movzx r8d, byte [rsp + rdi + 0x69]
sub r8d, edx
cmp rsi, 0x37
jb 0x5505f7
nop
jmp 0x55065c
xor eax, eax
lea rbx, [rsp + 0x69]
mov ecx, 0x37
call fcn.0045b080
add rsp, 0xa0
pop rbp
ret
mov eax, esi
mov ecx, 0x37
call fcn.004607e0
mov eax, edi
mov ecx, 0x37
call fcn.004607e0
nop
call fcn.0045e500
jmp fcn.00550540

Function at 0x550d20
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x550ddd
push rbp
mov rbp, rsp
sub rsp, 0x30
movabs rdx, 0x69906dd273a10b94
mov qword [rsp + 0x26], rdx
mov word [rsp + 0x2e], 0x6ba5
movabs rdx, 0x204010601010401
mov qword [rsp + 0x1a], rdx
mov dword [rsp + 0x22], 0x80200
xor eax, eax
jmp 0x550d80
movzx r9d, byte [rsp + rsi + 0x26]
sub r9d, edx
lea edx, [r9 - 0x1c]
mov byte [rsp + rdi + 0x26], dl
lea edx, [r8 - 0x1c]
mov byte [rsp + rsi + 0x26], dl
add rax, 2
cmp rax, 0xc
jge 0x550dad
movzx edx, byte [rsp + rax + 0x1a]
movzx esi, byte [rsp + rax + 0x1b]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0xa
jae 0x550dd0
movzx r8d, byte [rsp + rdi + 0x26]
sub r8d, edx
cmp rsi, 0xa
jb 0x550d63
jmp 0x550dc4
xor eax, eax
lea rbx, [rsp + 0x26]
mov ecx, 0xa
call fcn.0045b080
add rsp, 0x30
pop rbp
ret
mov eax, esi
mov ecx, 0xa
call fcn.004607e0
mov eax, edi
mov ecx, 0xa
call fcn.004607e0
nop
nop dword [rax]
call fcn.0045e500
jmp fcn.00550d20
Function at 0x55cc00
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x55ccc6
push rbp
mov rbp, rsp
sub rsp, 0x30
movabs rdx, 0x26ec4eda272a42f7
mov qword [rsp + 0x26], rdx
mov word [rsp + 0x2e], 0x1e04
movabs rdx, 0x408070309020602
mov qword [rsp + 0x1a], rdx
mov dword [rsp + 0x22], 0x4080008
xor eax, eax
jmp 0x55cc60
movzx r9d, byte [rsp + rsi + 0x26]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x16]
mov byte [rsp + rdi + 0x26], dl
mov byte [rsp + rsi + 0x26], r8b
add rax, 2
nop dword [rax]
cmp rax, 0xc
jge 0x55cc92
movzx edx, byte [rsp + rax + 0x1a]
movzx esi, byte [rsp + rax + 0x1b]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0xa
jae 0x55ccb7
movzx r8d, byte [rsp + rdi + 0x26]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x16]
cmp rsi, 0xa
jb 0x55cc43
jmp 0x55ccab
xor eax, eax
lea rbx, [rsp + 0x26]
mov ecx, 0xa
nop
call fcn.0045b080
add rsp, 0x30
pop rbp
ret
mov eax, esi
mov ecx, 0xa
call fcn.004607e0
mov eax, edi
mov ecx, 0xa
nop
call fcn.004607e0
nop
call fcn.0045e500
jmp fcn.0055cc00

Function at 0x55d3c0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x55d4ac
push rbp
mov rbp, rsp
sub rsp, 0x40
movabs rdx, 0x37368ec53332e7b6
mov qword [rsp + 0x2f], rdx
movabs rdx, 0x3837368ec53332e7
mov qword [rsp + 0x30], rdx
movabs rdx, 0x7866926799626806
mov qword [rsp + 0x38], rdx
movabs rdx, 0xd040e00090a010a
mov qword [rsp + 0x1d], rdx
movabs rdx, 0x9090d040e00090a
mov qword [rsp + 0x1f], rdx
movabs rdx, 0x5000e050c0d0d0a
mov qword [rsp + 0x27], rdx
xor eax, eax
jmp 0x55d44a
movzx r9d, byte [rsp + rsi + 0x2f]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x42]
mov byte [rsp + rdi + 0x2f], dl
mov byte [rsp + rsi + 0x2f], r8b
add rax, 2
cmp rax, 0x12
jge 0x55d47c
movzx edx, byte [rsp + rax + 0x1d]
movzx esi, byte [rsp + rax + 0x1e]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x11
jae 0x55d49f
movzx r8d, byte [rsp + rdi + 0x2f]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x42]
cmp rsi, 0x11
jb 0x55d430
jmp 0x55d493
xor eax, eax
lea rbx, [rsp + 0x2f]
mov ecx, 0x11
call fcn.0045b080
add rsp, 0x40
pop rbp
ret
mov eax, esi
mov ecx, 0x11
call fcn.004607e0
mov eax, edi
mov ecx, 0x11
call fcn.004607e0
nop
call fcn.0045e500
jmp fcn.0055d3c0
Function at 0x55db60
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x55dc4c
push rbp
mov rbp, rsp
sub rsp, 0x40
movabs rdx, 0x2c36353f33323022
mov qword [rsp + 0x2f], rdx
movabs rdx, 0x282c36353f333230
mov qword [rsp + 0x30], rdx
movabs rdx, 0xf32263a3443102f
mov qword [rsp + 0x38], rdx
movabs rdx, 0xa010e040b100e0c
mov qword [rsp + 0x19], rdx
movabs rdx, 0xd0a0b0d01080a01
mov qword [rsp + 0x1f], rdx
movabs rdx, 0xc070a0f08090008
mov qword [rsp + 0x27], rdx
xor eax, eax
jmp 0x55dbea
movzx r9d, byte [rsp + rsi + 0x2f]
lea edx, [r9 + rdx]
lea edx, [rdx - 8]
mov byte [rsp + rdi + 0x2f], dl
mov byte [rsp + rsi + 0x2f], r8b
add rax, 2
cmp rax, 0x16
jge 0x55dc1c
movzx edx, byte [rsp + rax + 0x19]
movzx esi, byte [rsp + rax + 0x1a]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x11
jae 0x55dc3f
movzx r8d, byte [rsp + rdi + 0x2f]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 8]
cmp rsi, 0x11
jb 0x55dbd0
jmp 0x55dc33
xor eax, eax
lea rbx, [rsp + 0x2f]
mov ecx, 0x11
call fcn.0045b080
add rsp, 0x40
pop rbp
ret
mov eax, esi
mov ecx, 0x11
call fcn.004607e0
mov eax, edi
mov ecx, 0x11
call fcn.004607e0
nop
call fcn.0045e500
jmp fcn.0055db60

Function at 0x55f560
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x55f64c
push rbp
mov rbp, rsp
sub rsp, 0x40
movabs rdx, 0x372c35da2be8d730
mov qword [rsp + 0x2f], rdx
movabs rdx, 0xa7372c35da2be8d7
mov qword [rsp + 0x30], rdx
movabs rdx, 0x780c6564ffe701e1
mov qword [rsp + 0x38], rdx
movabs rdx, 0x90802090b070b09
mov qword [rsp + 0x1b], rdx
movabs rdx, 0x90f010409080209
mov qword [rsp + 0x1f], rdx
movabs rdx, 0xf03070c04010a06
mov qword [rsp + 0x27], rdx
xor eax, eax
jmp 0x55f5ea
movzx r9d, byte [rsp + rsi + 0x2f]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x1d]
mov byte [rsp + rdi + 0x2f], dl
mov byte [rsp + rsi + 0x2f], r8b
add rax, 2
cmp rax, 0x14
jge 0x55f61c
movzx edx, byte [rsp + rax + 0x1b]
movzx esi, byte [rsp + rax + 0x1c]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x11
jae 0x55f63f
movzx r8d, byte [rsp + rdi + 0x2f]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x1d]
cmp rsi, 0x11
jb 0x55f5d0
jmp 0x55f633
xor eax, eax
lea rbx, [rsp + 0x2f]
mov ecx, 0x11
call fcn.0045b080
add rsp, 0x40
pop rbp
ret
mov eax, esi
mov ecx, 0x11
call fcn.004607e0
mov eax, edi
mov ecx, 0x11
call fcn.004607e0
nop
call fcn.0045e500
jmp fcn.0055f560
Function at 0x55f660
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x55f77a
push rbp
mov rbp, rsp
sub rsp, 0x60
movabs rdx, 0x960e75b33a976d66
mov qword [rsp + 0x41], rdx
movabs rdx, 0x4f6162206e776de4
mov qword [rsp + 0x49], rdx
movabs rdx, 0xeee4a09afcc9984f
mov qword [rsp + 0x50], rdx
movabs rdx, 0x9e659a7d7568c9ff
mov qword [rsp + 0x58], rdx
movabs rdx, 0x161a1b1811121e17
mov qword [rsp + 0x1d], rdx
movabs rdx, 0x15041218161a1b18
mov qword [rsp + 0x21], rdx
movabs rdx, 0x612081e071a1017
mov qword [rsp + 0x29], rdx
movabs rdx, 0x1c060f1e1109120f
mov qword [rsp + 0x31], rdx
movabs rdx, 0x1704131402141002
mov qword [rsp + 0x39], rdx
xor eax, eax
jmp 0x55f717
movzx r9d, byte [rsp + rsi + 0x41]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x60]
mov byte [rsp + rdi + 0x41], dl
mov byte [rsp + rsi + 0x41], r8b
add rax, 2
cmp rax, 0x24
jge 0x55f749
movzx edx, byte [rsp + rax + 0x1d]
movzx esi, byte [rsp + rax + 0x1e]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x1f
jae 0x55f76d
movzx r8d, byte [rsp + rdi + 0x41]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x60]
cmp rsi, 0x1f
jb 0x55f6fd
jmp 0x55f761
xor eax, eax
lea rbx, [rsp + 0x41]
mov ecx, 0x1f
call fcn.0045b080
add rsp, 0x60
pop rbp
nop
ret
mov eax, esi
mov ecx, 0x1f
call fcn.004607e0
mov eax, edi
mov ecx, 0x1f
call fcn.004607e0
nop
call fcn.0045e500
nop
jmp fcn.0055f660

Function at 0x565960
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x565a27
push rbp
mov rbp, rsp
sub rsp, 0x30
movabs rdx, 0x323b6c737d307375
mov qword [rsp + 0x26], rdx
mov word [rsp + 0x2e], 0x7a77
movabs rdx, 0x206070403080304
mov qword [rsp + 0x18], rdx
movabs rdx, 0x807090802050206
mov qword [rsp + 0x1e], rdx
xor eax, eax
jmp 0x5659c7
movzx r9d, byte [rsp + rsi + 0x26]
sub r9d, edx
lea edx, [r9 + 8]
mov byte [rsp + rdi + 0x26], dl
lea edx, [r8 + 8]
mov byte [rsp + rsi + 0x26], dl
add rax, 2
cmp rax, 0xe
jge 0x5659f7
movzx edx, byte [rsp + rax + 0x18]
movzx esi, byte [rsp + rax + 0x19]
mov edi, edx
xor edx, esi
add edx, eax
nop dword [rax]
cmp rdi, 0xa
jae 0x565a1a
movzx r8d, byte [rsp + rdi + 0x26]
sub r8d, edx
cmp rsi, 0xa
jb 0x5659aa
jmp 0x565a0e
xor eax, eax
lea rbx, [rsp + 0x26]
mov ecx, 0xa
call fcn.0045b080
add rsp, 0x30
pop rbp
ret
mov eax, esi
mov ecx, 0xa
call fcn.004607e0
mov eax, edi
mov ecx, 0xa
call fcn.004607e0
nop
call fcn.0045e500
jmp fcn.00565960
Function at 0x1400028a0
Capabilities:
Enumerate pe sections

Disassembly:
mov qword [rsp + 0x20], rbp
push rsi
push r14
mov r14, rcx
mov rsi, r8
mov rbp, rdx
sub r14, qword [r8 + 0x30]
je 0x140002a22
test byte [r8 + 0x5e], 0x40
jne 0x1400028cd
xor eax, eax
mov rbp, qword [rsp + 0x30]
pop r14
pop rsi
ret
movzx eax, word [rsi + 0x14]
lea rdx, [rsi + 0x18]
mov r8d, dword [r8 + 0xb0]
add rdx, rax
movzx eax, word [rsi + 6]
lea rcx, [rax + rax*4]
lea r9, [rdx + rcx*8]
cmp rdx, r9
jae 0x140002a22
mov ecx, dword [rdx + 0xc]
cmp r8, rcx
jb 0x140002906
mov eax, dword [rdx + 8]
add eax, ecx
cmp r8, rax
jb 0x14000291d
add rdx, 0x28
cmp rdx, r9
jb 0x1400028f4
mov eax, 1
mov rbp, qword [rsp + 0x30]
pop r14
pop rsi
ret
mov qword [rsp + 0x18], rbx
mov ebx, dword [rdx + 0x14]
sub rbx, rcx
mov qword [rsp + 0x28], r15
mov r15d, dword [rsi + 0xb4]
add rbx, r8
add rbx, rbp
add r15, rbx
test rbx, rbx
je 0x140002a18
cmp rbx, r15
jae 0x140002a18
mov qword [rsp + 0x20], rdi
mov eax, dword [rbx + 4]
test eax, eax
je 0x140002a13
lea ecx, [rax - 8]
shr ecx, 1
je 0x140002a07
lea r11, [rbx + 8]
mov edi, ecx
movzx r8d, word [r11]
movzx eax, r8w
shr ax, 0xc
and r8d, 0x80000fff
jge 0x140002992
dec r8d
or r8d, 0xfffff000
inc r8d
cmp ax, 3
je 0x14000299e
cmp ax, 0xa
jne 0x1400029f6
movzx eax, word [rsi + 0x14]
movzx ecx, word [rsi + 6]
add rax, 0x18
mov r9d, dword [rbx]
add rax, rsi
lea rdx, [rcx + rcx*4]
lea r10, [rax + rdx*8]
cmp rax, r10
jae 0x1400029eb
nop dword [rax]
mov edx, dword [rax + 0xc]
cmp r9, rdx
jb 0x1400029d2
mov ecx, dword [rax + 8]
add ecx, edx
cmp r9, rcx
jb 0x1400029dd
add rax, 0x28
cmp rax, r10
jb 0x1400029c0
jmp 0x1400029eb
mov ecx, dword [rax + 0x14]
sub rcx, rdx
add rcx, r9
add rcx, rbp
jne 0x1400029ee
mov rcx, rbp
movzx eax, r8w
add qword [rax + rcx], r14
add r11, 2
sub rdi, 1
jne 0x140002970
mov eax, dword [rbx + 4]
add rbx, rax
cmp rbx, r15
jb 0x140002954
mov rdi, qword [rsp + 0x20]
mov rbx, qword [rsp + 0x18]
mov r15, qword [rsp + 0x28]
mov rbp, qword [rsp + 0x30]
mov eax, 1
pop r14
pop rsi
ret
Function at 0x140009270
Capabilities:
Enumerate pe sections

Disassembly:
push rbx
push rbp
push r13
push r14
mov eax, 0x10b8
call fcn.140198960
sub rsp, rax
mov rax, qword [0x140267660]
xor rax, rsp
mov qword [rsp + 0x1090], rax
mov r14, rdx
mov qword [rsp + 0x48], r9
mov rdx, qword [rsp + 0x1100]
xor ebp, ebp
mov qword [rsp + 0x40], rdx
mov r13, r8
mov qword [rsp + 0x50], rcx
test r8, r8
je 0x140009348
mov qword [rsp + 0x38], rbp
lea rax, [rsp + 0x90]
mov qword [rsp + 0x78], rax
lea r9d, [rbp + 0x28]
lea rax, [rsp + 0x58]
mov qword [rsp + 0x70], r8
mov qword [rsp + 0x30], rax
lea r8, [rsp + 0x60]
mov dword [rsp + 0x28], ebp
mov edx, 0x80862007
mov qword [rsp + 0x20], rbp
mov qword [rsp + 0x68], rbp
mov qword [rsp + 0x60], 0x33
mov qword [rsp + 0x80], 0x1000
mov dword [rsp + 0x58], ebp
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
jne 0x140009350
lea rdx, [0x140232378]
lea rcx, [0x140273a80]
call fcn.14000e490
mov rcx, rax
lea rdx, str.____Cant_read_module_headers
call fcn.14000e7c0
mov rcx, rax
call fcn.14000ea50
mov rdx, rbp
jmp 0x140009439
mov qword [rsp + 0x10e8], rsi
mov qword [rsp + 0x10b0], rdi
mov rdi, 0xffffffffffffffff
mov qword [rsp + 0x10a8], r12
mov qword [rsp + 0x10a0], r15
inc rdi
cmp byte [r14 + rdi], bpl
jne 0x140009377
movsxd rax, dword [rsp + 0xcc]
lea rcx, [rsp + 0x90]
add rcx, rax
mov esi, ebp
movzx eax, word [rcx + 0x14]
lea r12, [rcx + 0x18]
movzx r15d, word [rcx + 6]
add r12, rax
test r15d, r15d
je 0x1400093ec
nop word [rax + rax]
mov eax, esi
mov r8, rdi
mov rdx, r14
lea rcx, [rax + rax*4]
lea rbx, [r12 + rcx*8]
mov rcx, rbx
call fcn.14019dc00
test eax, eax
jne 0x1400093e5
mov rax, 0xffffffffffffffff
inc rax
cmp byte [rbx + rax], bpl
jne 0x1400093d3
cmp rdi, rax
je 0x140009473
inc esi
cmp esi, r15d
jb 0x1400093b0
lea rdx, [0x140232378]
lea rcx, [0x140273a80]
call fcn.14000e490
mov rcx, rax
lea rdx, str.____Cant_find_section
call fcn.14000e7c0
mov rcx, rax
call fcn.14000ea50
mov rdx, rbp
mov r12, qword [rsp + 0x10a8]
mov rdi, qword [rsp + 0x10b0]
mov rsi, qword [rsp + 0x10e8]
mov r15, qword [rsp + 0x10a0]
mov rax, qword [rsp + 0x40]
mov r9, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x50]
mov r8d, ebp
mov qword [rsp + 0x20], rax
call fcn.140009060
mov rcx, qword [rsp + 0x1090]
xor rcx, rsp
call fcn.140197d80
add rsp, 0x10b8
pop r14
pop r13
pop rbp
pop rbx
ret
mov eax, dword [rbx + 0xc]
test eax, eax
je 0x1400093ec
mov ecx, dword [rbx + 8]
mov edx, eax
lea rax, [rsp + 0x90]
add rax, rdx
je 0x1400093ec
test ecx, ecx
je 0x1400093ec
mov ebp, ecx
add rdx, r13
jmp 0x140009419