joyce8/EMBER2024-capa huggingface dataset:
Function at 0x44a7d0
Capabilities:
Accept command line arguments
Query environment variable

Disassembly:
sub rsp, 0x28
xor rcx, rcx
call sub.KERNEL32_GetModuleHandleA
mov qword [0x004540a0], rax
call fcn.00438470
call fcn.00434030
call fcn.00438480
lea rax, [section..data]
lea rcx, [0x00401490]
mov qword [rax + 0x30], rcx
lea rcx, section..text
mov qword [rax], rcx
lea rcx, [0x004012dc]
mov qword [rax + 8], rcx
lea rcx, [0x004012dc]
mov qword [rax + 0x10], rcx
lea rcx, [0x0040133c]
mov qword [rax + 0x18], rcx
lea rcx, [0x004492d0]
mov qword [rax + 0x68], rcx
lea rcx, [0x004496d0]
mov qword [rax + 0x70], rcx
lea rcx, [0x00449700]
mov qword [rax + 0x78], rcx
lea rcx, [0x00449cb0]
mov qword [rax + 0x80], rcx
lea rcx, [0x00462200]
mov qword [rax + 0x50], rcx
mov rcx, rax
push 0
jmp 0x44a7d0
push rbp
push r14
push rsi
push rdi
push rbx
sub rsp, 0x20
lea rbp, [rsp + 0x20]
mov rsi, r9
mov r14d, r8d
mov ebx, edx
mov edi, ecx
call fcn.0044a770
test edi, edi
je 0x448e65
test ebx, ebx
jne 0x448e7c
test edi, edi
jne 0x448e56
call qword [0x00462df8]
call qword [0x00462e00]
call fcn.0044a790
mov ecx, r14d
call fcn.0044a520
jmp 0x448e7c
mov rcx, rsi
call fcn.00448c10
call fcn.0044a640
call qword [0x00462df0]
test ebx, ebx
je 0x448e46
add rsp, 0x20
pop rbx
pop rdi
pop rsi
pop r14
pop rbp
jmp fcn.0044a790
push rbp
push rsi
push rdi
push rbx
sub rsp, 0x88
lea rbp, [rsp + 0x80]
mov rsi, rcx
mov eax, dword [rsi + 0x20]
and eax, 1
mov dword [0x00462e50], eax
mov rcx, qword [rsi + 0x50]
call fcn.0043a800
mov rcx, qword [rsi + 0x88]
call fcn.0043a810
mov dword [0x00476e60], 1
lea rdi, [0x00476e60]
mov qword [0x00476e68], rsi
call sub.KERNEL32_GetEnvironmentStrings
mov qword [0x00476e00], rax
call sub.KERNEL32_GetCommandLineA
mov qword [0x00476e10], rax
mov rcx, qword [rsi + 0x68]
mov rdx, qword [rsi + 0x70]
mov r8, qword [rsi + 0x78]
mov r9, qword [rsi + 0x80]
call fcn.00449090
xor edx, edx
mov rcx, rdi
call fcn.0044a540
test byte [rsi + 0x20], 1
jne 0x44a894
mov ecx, dword [0x00476e2c]
mov rdx, qword [0x00476e30]
mov r8, qword [0x00476e38]
call qword [rsi + 0x30]
xor ecx, ecx
xor edx, edx
mov r9, 0xffffffffffffffff
mov r8d, eax
add rsp, 0x88
pop rbx
pop rdi
pop rsi
pop rbp
jmp 0x448e20
mov rax, qword [0x00476e10]
nop dword [rax + rax]
inc rax
mov cl, byte [rax - 1]
cmp cl, 9
je 0x44a8a0
cmp cl, 0x20
je 0x44a8a0
cmp cl, 0x22
jne 0x44a8be
mov cl, byte [rax]
mov edx, 0x22
jmp 0x44a8c6
dec rax
mov edx, 0x20
movsx edi, cl
cmp edx, edi
je 0x44a8e4
nop dword [rax]
test cl, cl
je 0x44a8e4
cmp cl, 9
je 0x44a8e4
movsx ecx, byte [rax + 1]
inc rax
cmp edx, ecx
jne 0x44a8d0
lea rdi, [rax + 1]
cmp cl, 0x22
cmovne rdi, rax
jmp 0x44a903
inc rdi
movzx eax, byte [rdi]
cmp al, 0x20
je 0x44a900
cmp al, 9
je 0x44a900
mov rbx, qword [rsi + 0x30]
xor ecx, ecx
call sub.KERNEL32_GetModuleHandleA
mov rsi, rax
lea rcx, [rbp - 0x60]
call sub.KERNEL32_GetStartupInfoA
mov eax, dword [rbp - 0x24]
test al, 1
movzx eax, word [rbp - 0x20]
mov r9d, 0xa
cmovne r9d, eax
xor edx, edx
mov rcx, rsi
mov r8, rdi
call rbx
xor ecx, ecx
xor edx, edx
mov r9, 0xffffffffffffffff
mov r8d, eax
call 0x448e20
nop
add rsp, 0x88
pop rbx
pop rdi
pop rsi
pop rbp
ret
Function at 0x44abc0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push rbp
push rsi
push rdi
sub rsp, 0x20
lea rbp, [rsp + 0x20]
mov esi, ecx
cmp byte [0x004540b4], 0
je 0x44ac22
mov ecx, dword [0x00476e90]
call sub.KERNEL32_TlsGetValue
test rax, rax
jne 0x44ac2e
call fcn.0044aa10
mov edi, eax
test edi, edi
je 0x44ac15
call sub.KERNEL32_GetProcessHeap
movsxd r8, edi
mov edx, 8
mov rcx, rax
call sub.KERNEL32_HeapAlloc
mov ecx, dword [0x00476e90]
mov rdx, rax
call sub.KERNEL32_TlsSetValue
mov ecx, dword [0x00476e90]
call sub.KERNEL32_TlsGetValue
jmp 0x44ac2e
mov rax, qword gs:[0x58]
mov rax, qword [rax]
movsxd rcx, esi
add rcx, rax
mov rax, rcx
add rsp, 0x20
pop rdi
pop rsi
pop rbp
ret
Function at 0x1400069c0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x48
mov edi, edx
mov rsi, rcx
test edx, edx
je 0x140006a27
mov eax, edi
shr eax, 5
imul rax, rax, 0xa7c5ac5
shr rax, 0x27
xor ecx, ecx
cmp edi, 0x186a0
setae cl
cmovb eax, edi
lea ecx, [rcx + rcx*4]
lea edx, [rax + 0x5fff6]
lea r8d, [rax + 0x7ff9c]
and r8d, edx
lea edx, [rax + 0xdfc18]
add eax, 0x7d8f0
and eax, edx
xor eax, r8d
shr eax, 0x11
add eax, ecx
inc al
cmp al, 6
jbe 0x140006a29
xor r15d, r15d
jmp 0x140006a62
mov al, 1
mov cl, 7
sub cl, al
movzx r12d, cl
xor r15d, r15d
lea r14, [0x14020ad38]
mov ebx, 1
mov r8d, 1
mov rcx, rsi
mov rdx, r14
call fcn.140001940
test rax, rax
jne 0x140006b53
inc r15
cmp r15, r12
jb 0x140006a40
mov eax, 0xa
cmp edi, 0x270f
ja 0x140006a8e
mov ecx, edi
cmp edi, 0x63
ja 0x140006adf
cmp ecx, 0xa
jae 0x140006b19
or cl, 0x30
mov byte [rsp + rax + 0x1f], cl
dec rax
jmp 0x140006b2d
mov eax, edi
mov ecx, 0xd1b71759
imul rcx, rax
shr rcx, 0x2d
imul eax, ecx, 0x2710
sub edi, eax
imul eax, edi, 0x147b
shr eax, 0x13
imul edx, eax, 0x64
sub edi, edx
movzx edx, di
lea r8, str.00010203040506070809101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899amAMpmPMMondayTuesdayWednesdayThursdayFridaySaturdaySunday
movzx eax, word [r8 + rax*2]
mov word [rsp + 0x26], ax
movzx eax, word [r8 + rdx*2]
mov word [rsp + 0x28], ax
mov eax, 6
mov edi, ecx
mov ecx, edi
cmp edi, 0x63
jbe 0x140006a76
movzx edx, cx
shr edx, 2
imul edx, edx, 0x147b
shr edx, 0x11
imul r8d, edx, 0x64
sub ecx, r8d
movzx ecx, cx
lea r8, str.00010203040506070809101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899amAMpmPMMondayTuesdayWednesdayThursdayFridaySaturdaySunday
movzx ecx, word [r8 + rcx*2]
mov word [rsp + rax + 0x1e], cx
add rax, 0xfffffffffffffffe
mov rcx, rdx
cmp ecx, 0xa
jb 0x140006a7f
lea rdx, str.00010203040506070809101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899amAMpmPMMondayTuesdayWednesdayThursdayFridaySaturdaySunday
movzx ecx, word [rdx + rcx*2]
mov word [rsp + rax + 0x1e], cx
add rax, 0xfffffffffffffffe
mov r8d, 0xa
sub r8, rax
lea rdx, [rsp + rax]
add rdx, 0x20
mov rcx, rsi
mov rsi, r8
call fcn.140001940
test rax, rax
je 0x140006b58
mov ebx, 1
mov rsi, rax
jmp 0x140006b5d
add rsi, r15
xor ebx, ebx
mov rax, rbx
mov rdx, rsi
add rsp, 0x48
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
Function at 0x140006b80
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x48
mov edi, edx
mov rsi, rcx
test edx, edx
je 0x140006be7
mov eax, edi
shr eax, 5
imul rax, rax, 0xa7c5ac5
shr rax, 0x27
xor ecx, ecx
cmp edi, 0x186a0
setae cl
cmovb eax, edi
lea ecx, [rcx + rcx*4]
lea edx, [rax + 0x5fff6]
lea r8d, [rax + 0x7ff9c]
and r8d, edx
lea edx, [rax + 0xdfc18]
add eax, 0x7d8f0
and eax, edx
xor eax, r8d
shr eax, 0x11
add eax, ecx
inc al
cmp al, 7
jbe 0x140006be9
xor r15d, r15d
jmp 0x140006c22
mov al, 1
mov cl, 8
sub cl, al
movzx r12d, cl
xor r15d, r15d
lea r14, [0x14020ad38]
mov ebx, 1
mov r8d, 1
mov rcx, rsi
mov rdx, r14
call fcn.140001940
test rax, rax
jne 0x140006d13
inc r15
cmp r15, r12
jb 0x140006c00
mov eax, 0xa
cmp edi, 0x270f
ja 0x140006c4e
mov ecx, edi
cmp edi, 0x63
ja 0x140006c9f
cmp ecx, 0xa
jae 0x140006cd9
or cl, 0x30
mov byte [rsp + rax + 0x1f], cl
dec rax
jmp 0x140006ced
mov eax, edi
mov ecx, 0xd1b71759
imul rcx, rax
shr rcx, 0x2d
imul eax, ecx, 0x2710
sub edi, eax
imul eax, edi, 0x147b
shr eax, 0x13
imul edx, eax, 0x64
sub edi, edx
movzx edx, di
lea r8, str.00010203040506070809101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899amAMpmPMMondayTuesdayWednesdayThursdayFridaySaturdaySunday
movzx eax, word [r8 + rax*2]
mov word [rsp + 0x26], ax
movzx eax, word [r8 + rdx*2]
mov word [rsp + 0x28], ax
mov eax, 6
mov edi, ecx
mov ecx, edi
cmp edi, 0x63
jbe 0x140006c36
movzx edx, cx
shr edx, 2
imul edx, edx, 0x147b
shr edx, 0x11
imul r8d, edx, 0x64
sub ecx, r8d
movzx ecx, cx
lea r8, str.00010203040506070809101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899amAMpmPMMondayTuesdayWednesdayThursdayFridaySaturdaySunday
movzx ecx, word [r8 + rcx*2]
mov word [rsp + rax + 0x1e], cx
add rax, 0xfffffffffffffffe
mov rcx, rdx
cmp ecx, 0xa
jb 0x140006c3f
lea rdx, str.00010203040506070809101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899amAMpmPMMondayTuesdayWednesdayThursdayFridaySaturdaySunday
movzx ecx, word [rdx + rcx*2]
mov word [rsp + rax + 0x1e], cx
add rax, 0xfffffffffffffffe
mov r8d, 0xa
sub r8, rax
lea rdx, [rsp + rax]
add rdx, 0x20
mov rcx, rsi
mov rsi, r8
call fcn.140001940
test rax, rax
je 0x140006d18
mov ebx, 1
mov rsi, rax
jmp 0x140006d1d
add rsi, r15
xor ebx, ebx
mov rax, rbx
mov rdx, rsi
add rsp, 0x48
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
Function at 0x140006d40
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x48
mov edi, edx
mov rsi, rcx
test edx, edx
je 0x140006da7
mov eax, edi
shr eax, 5
imul rax, rax, 0xa7c5ac5
shr rax, 0x27
xor ecx, ecx
cmp edi, 0x186a0
setae cl
cmovb eax, edi
lea ecx, [rcx + rcx*4]
lea edx, [rax + 0x5fff6]
lea r8d, [rax + 0x7ff9c]
and r8d, edx
lea edx, [rax + 0xdfc18]
add eax, 0x7d8f0
and eax, edx
xor eax, r8d
shr eax, 0x11
add eax, ecx
inc al
cmp al, 5
jbe 0x140006da9
xor r15d, r15d
jmp 0x140006df2
mov al, 1
xor r15d, r15d
mov cl, 6
sub cl, al
movzx eax, cl
cmovb eax, r15d
movzx r12d, al
lea r14, [0x14020ad38]
mov ebx, 1
nop word [rax + rax]
mov r8d, 1
mov rcx, rsi
mov rdx, r14
call fcn.140001940
test rax, rax
jne 0x140006ee3
inc r15
cmp r15, r12
jb 0x140006dd0
mov eax, 0xa
cmp edi, 0x270f
ja 0x140006e1e
mov ecx, edi
cmp edi, 0x63
ja 0x140006e6f
cmp ecx, 0xa
jae 0x140006ea9
or cl, 0x30
mov byte [rsp + rax + 0x1f], cl
dec rax
jmp 0x140006ebd
mov eax, edi
mov ecx, 0xd1b71759
imul rcx, rax
shr rcx, 0x2d
imul eax, ecx, 0x2710
sub edi, eax
imul eax, edi, 0x147b
shr eax, 0x13
imul edx, eax, 0x64
sub edi, edx
movzx edx, di
lea r8, str.00010203040506070809101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899amAMpmPMMondayTuesdayWednesdayThursdayFridaySaturdaySunday
movzx eax, word [r8 + rax*2]
mov word [rsp + 0x26], ax
movzx eax, word [r8 + rdx*2]
mov word [rsp + 0x28], ax
mov eax, 6
mov edi, ecx
mov ecx, edi
cmp edi, 0x63
jbe 0x140006e06
movzx edx, cx
shr edx, 2
imul edx, edx, 0x147b
shr edx, 0x11
imul r8d, edx, 0x64
sub ecx, r8d
movzx ecx, cx
lea r8, str.00010203040506070809101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899amAMpmPMMondayTuesdayWednesdayThursdayFridaySaturdaySunday
movzx ecx, word [r8 + rcx*2]
mov word [rsp + rax + 0x1e], cx
add rax, 0xfffffffffffffffe
mov rcx, rdx
cmp ecx, 0xa
jb 0x140006e0f
lea rdx, str.00010203040506070809101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899amAMpmPMMondayTuesdayWednesdayThursdayFridaySaturdaySunday
movzx ecx, word [rdx + rcx*2]
mov word [rsp + rax + 0x1e], cx
add rax, 0xfffffffffffffffe
mov r8d, 0xa
sub r8, rax
lea rdx, [rsp + rax]
add rdx, 0x20
mov rcx, rsi
mov rsi, r8
call fcn.140001940
test rax, rax
je 0x140006ee8
mov ebx, 1
mov rsi, rax
jmp 0x140006eed
add rsi, r15
xor ebx, ebx
mov rax, rbx
mov rdx, rsi
add rsp, 0x48
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
Function at 0x140006f10
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x48
mov edi, edx
mov rsi, rcx
test edx, edx
je 0x140006f77
mov eax, edi
shr eax, 5
imul rax, rax, 0xa7c5ac5
shr rax, 0x27
xor ecx, ecx
cmp edi, 0x186a0
setae cl
cmovb eax, edi
lea ecx, [rcx + rcx*4]
lea edx, [rax + 0x5fff6]
lea r8d, [rax + 0x7ff9c]
and r8d, edx
lea edx, [rax + 0xdfc18]
add eax, 0x7d8f0
and eax, edx
xor eax, r8d
shr eax, 0x11
add eax, ecx
inc al
cmp al, 8
jbe 0x140006f79
xor r15d, r15d
jmp 0x140006fc2
mov al, 1
xor r15d, r15d
mov cl, 9
sub cl, al
movzx eax, cl
cmovb eax, r15d
movzx r12d, al
lea r14, [0x14020ad38]
mov ebx, 1
nop word [rax + rax]
mov r8d, 1
mov rcx, rsi
mov rdx, r14
call fcn.140001940
test rax, rax
jne 0x1400070ce
inc r15
cmp r15, r12
jb 0x140006fa0
mov ecx, 0xa
lea rax, str.00010203040506070809101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899amAMpmPMMondayTuesdayWednesdayThursdayFridaySaturdaySunday
cmp edi, 0x2710
jb 0x14000708d
mov r9d, 0xa
mov edx, 0xd1b71759
nop word cs:[rax + rax]
mov r8d, edi
imul r8, rdx
shr r8, 0x2d
imul ecx, r8d, 0x2710
mov r10d, edi
sub r10d, ecx
imul r11d, r10d, 0x147b
shr r11d, 0x13
imul ecx, r11d, 0x64
sub r10d, ecx
movzx r10d, r10w
lea rcx, [r9 - 4]
movzx r11d, word [rax + r11*2]
mov word [rsp + r9 + 0x1c], r11w
movzx r10d, word [rax + r10*2]
mov word [rsp + r9 + 0x1e], r10w
mov r9, rcx
cmp edi, 0x5f5e0ff
mov edi, r8d
ja 0x140006ff0
mov edx, r8d
cmp r8d, 0x63
jbe 0x14000707c
movzx r8d, dx
shr r8d, 2
imul r8d, r8d, 0x147b
shr r8d, 0x11
imul r9d, r8d, 0x64
sub edx, r9d
movzx edx, dx
movzx edx, word [rax + rdx*2]
mov word [rsp + rcx + 0x1e], dx
add rcx, 0xfffffffffffffffe
mov rdx, r8
cmp edx, 0xa
jae 0x14000709b
or dl, 0x30
mov byte [rsp + rcx + 0x1f], dl
dec rcx
jmp 0x1400070a8
mov r8d, edi
mov edx, r8d
cmp r8d, 0x63
ja 0x14000704f
jmp 0x14000707c
movzx eax, word [rax + rdx*2]
mov word [rsp + rcx + 0x1e], ax
add rcx, 0xfffffffffffffffe
mov r8d, 0xa
sub r8, rcx
lea rdx, [rsp + rcx]
add rdx, 0x20
mov rcx, rsi
mov rsi, r8
call fcn.140001940
test rax, rax
je 0x1400070d3
mov ebx, 1
mov rsi, rax
jmp 0x1400070d8
add rsi, r15
xor ebx, ebx
mov rax, rbx
mov rdx, rsi
add rsp, 0x48
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
Function at 0x1400070f0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x48
mov ebx, edx
mov rsi, rcx
test edx, edx
je 0x14000714e
mov eax, ebx
shr eax, 5
imul rax, rax, 0xa7c5ac5
shr rax, 0x27
xor ecx, ecx
cmp ebx, 0x186a0
setae cl
cmovb eax, ebx
lea ecx, [rcx + rcx*4]
lea edx, [rax + 0x5fff6]
lea r8d, [rax + 0x7ff9c]
and r8d, edx
lea edx, [rax + 0xdfc18]
add eax, 0x7d8f0
and eax, edx
xor eax, r8d
shr eax, 0x11
add cl, al
je 0x14000714e
xor edi, edi
jmp 0x140007174
lea rdx, [0x14020ad38]
mov edi, 1
mov r8d, 1
mov rcx, rsi
call fcn.140001940
mov r14, rax
test rax, rax
jne 0x140007288
mov ecx, 0xa
lea rax, str.00010203040506070809101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899amAMpmPMMondayTuesdayWednesdayThursdayFridaySaturdaySunday
cmp ebx, 0x2710
jb 0x14000723d
mov r9d, 0xa
mov edx, 0xd1b71759
nop word [rax + rax]
mov r8d, ebx
imul r8, rdx
shr r8, 0x2d
imul ecx, r8d, 0x2710
mov r10d, ebx
sub r10d, ecx
imul r11d, r10d, 0x147b
shr r11d, 0x13
imul ecx, r11d, 0x64
sub r10d, ecx
movzx r10d, r10w
lea rcx, [r9 - 4]
movzx r11d, word [rax + r11*2]
mov word [rsp + r9 + 0x1c], r11w
movzx r10d, word [rax + r10*2]
mov word [rsp + r9 + 0x1e], r10w
mov r9, rcx
cmp ebx, 0x5f5e0ff
mov ebx, r8d
ja 0x1400071a0
mov edx, r8d
cmp r8d, 0x63
jbe 0x14000722c
movzx r8d, dx
shr r8d, 2
imul r8d, r8d, 0x147b
shr r8d, 0x11
imul r9d, r8d, 0x64
sub edx, r9d
movzx edx, dx
movzx edx, word [rax + rdx*2]
mov word [rsp + rcx + 0x1e], dx
add rcx, 0xfffffffffffffffe
mov rdx, r8
cmp edx, 0xa
jae 0x14000724b
or dl, 0x30
mov byte [rsp + rcx + 0x1f], dl
dec rcx
jmp 0x140007258
mov r8d, ebx
mov edx, r8d
cmp r8d, 0x63
ja 0x1400071ff
jmp 0x14000722c
movzx eax, word [rax + rdx*2]
mov word [rsp + rcx + 0x1e], ax
add rcx, 0xfffffffffffffffe
mov r14d, 0xa
sub r14, rcx
lea rdx, [rsp + rcx]
add rdx, 0x20
mov rcx, rsi
mov r8, r14
call fcn.140001940
test rax, rax
je 0x140007283
mov edi, 1
mov r14, rax
jmp 0x140007288
add r14, rdi
xor edi, edi
mov rax, rdi
mov rdx, r14
add rsp, 0x48
pop rbx
pop rdi
pop rsi
pop r14
ret
Function at 0x1400072a0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x48
mov edi, edx
mov rsi, rcx
test edx, edx
je 0x140007307
mov eax, edi
shr eax, 5
imul rax, rax, 0xa7c5ac5
shr rax, 0x27
xor ecx, ecx
cmp edi, 0x186a0
setae cl
cmovb eax, edi
lea ecx, [rcx + rcx*4]
lea edx, [rax + 0x5fff6]
lea r8d, [rax + 0x7ff9c]
and r8d, edx
lea edx, [rax + 0xdfc18]
add eax, 0x7d8f0
and eax, edx
xor eax, r8d
shr eax, 0x11
add eax, ecx
inc al
cmp al, 3
jbe 0x140007309
xor r15d, r15d
jmp 0x140007342
mov al, 1
mov cl, 4
sub cl, al
movzx r12d, cl
xor r15d, r15d
lea r14, [0x14020ad38]
mov ebx, 1
mov r8d, 1
mov rcx, rsi
mov rdx, r14
call fcn.140001940
test rax, rax
jne 0x14000744e
inc r15
cmp r15, r12
jb 0x140007320
mov ecx, 0xa
lea rax, str.00010203040506070809101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899amAMpmPMMondayTuesdayWednesdayThursdayFridaySaturdaySunday
cmp edi, 0x2710
jb 0x14000740d
mov r9d, 0xa
mov edx, 0xd1b71759
nop word cs:[rax + rax]
mov r8d, edi
imul r8, rdx
shr r8, 0x2d
imul ecx, r8d, 0x2710
mov r10d, edi
sub r10d, ecx
imul r11d, r10d, 0x147b
shr r11d, 0x13
imul ecx, r11d, 0x64
sub r10d, ecx
movzx r10d, r10w
lea rcx, [r9 - 4]
movzx r11d, word [rax + r11*2]
mov word [rsp + r9 + 0x1c], r11w
movzx r10d, word [rax + r10*2]
mov word [rsp + r9 + 0x1e], r10w
mov r9, rcx
cmp edi, 0x5f5e0ff
mov edi, r8d
ja 0x140007370
mov edx, r8d
cmp r8d, 0x63
jbe 0x1400073fc
movzx r8d, dx
shr r8d, 2
imul r8d, r8d, 0x147b
shr r8d, 0x11
imul r9d, r8d, 0x64
sub edx, r9d
movzx edx, dx
movzx edx, word [rax + rdx*2]
mov word [rsp + rcx + 0x1e], dx
add rcx, 0xfffffffffffffffe
mov rdx, r8
cmp edx, 0xa
jae 0x14000741b
or dl, 0x30
mov byte [rsp + rcx + 0x1f], dl
dec rcx
jmp 0x140007428
mov r8d, edi
mov edx, r8d
cmp r8d, 0x63
ja 0x1400073cf
jmp 0x1400073fc
movzx eax, word [rax + rdx*2]
mov word [rsp + rcx + 0x1e], ax
add rcx, 0xfffffffffffffffe
mov r8d, 0xa
sub r8, rcx
lea rdx, [rsp + rcx]
add rdx, 0x20
mov rcx, rsi
mov rsi, r8
call fcn.140001940
test rax, rax
je 0x140007453
mov ebx, 1
mov rsi, rax
jmp 0x140007458
add rsi, r15
xor ebx, ebx
mov rax, rbx
mov rdx, rsi
add rsp, 0x48
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
Function at 0x140007470
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x50
mov ebx, edx
mov rdi, rcx
test dl, dl
je 0x1400074a5
movzx eax, bl
lea ecx, [rax + 0x2f6]
add eax, 0x19c
and eax, ecx
shr eax, 8
inc al
cmp al, 1
jbe 0x14000749d
xor esi, esi
jmp 0x1400074c8
test al, al
je 0x140007550
lea rdx, [0x14020ad38]
mov esi, 1
mov r8d, 1
mov rcx, rdi
call fcn.140001940
test rax, rax
jne 0x140007576
cmp bl, 0x64
jb 0x1400074f8
movzx eax, bl
lea ecx, [rax + rax*4]
lea eax, [rax + rcx*8]
shr eax, 0xc
imul ecx, eax, 0x64
sub bl, cl
movzx ecx, bl
lea rdx, str.00010203040506070809101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899amAMpmPMMondayTuesdayWednesdayThursdayFridaySaturdaySunday
movzx ecx, word [rdx + rcx*2]
mov word [rsp + 0x29], cx
xor r8d, r8d
mov ebx, eax
jmp 0x140007503
mov r8d, 2
cmp bl, 0xa
jae 0x14000750d
or bl, 0x30
mov byte [rsp + r8 + 0x28], bl
jmp 0x140007526
movzx eax, bl
lea rcx, str.00010203040506070809101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899amAMpmPMMondayTuesdayWednesdayThursdayFridaySaturdaySunday
movzx eax, word [rcx + rax*2]
mov word [rsp + 0x29], ax
mov r8d, 1
lea rdx, [rsp + r8]
add rdx, 0x28
xor r8, 3
mov rcx, rdi
mov rdi, r8
call fcn.140001940
test rax, rax
je 0x140007549
mov esi, 1
jmp 0x140007576
add rdi, rsi
xor esi, esi
jmp 0x140007579
lea rbx, [0x14020ad38]
mov esi, 1
nop dword [rax]
mov r8d, 1
mov rcx, rdi
mov rdx, rbx
call fcn.140001940
test rax, rax
je 0x140007560
mov rdi, rax
mov rax, rsi
mov rdx, rdi
add rsp, 0x50
pop rbx
pop rdi
pop rsi
ret
Function at 0x140007590
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x48
mov edi, edx
mov rsi, rcx
test edx, edx
je 0x1400075f7
mov eax, edi
shr eax, 5
imul rax, rax, 0xa7c5ac5
shr rax, 0x27
xor ecx, ecx
cmp edi, 0x186a0
setae cl
cmovb eax, edi
lea ecx, [rcx + rcx*4]
lea edx, [rax + 0x5fff6]
lea r8d, [rax + 0x7ff9c]
and r8d, edx
lea edx, [rax + 0xdfc18]
add eax, 0x7d8f0
and eax, edx
xor eax, r8d
shr eax, 0x11
add eax, ecx
inc al
cmp al, 4
jbe 0x1400075f9
xor r15d, r15d
jmp 0x140007642
mov al, 1
xor r15d, r15d
mov cl, 5
sub cl, al
movzx eax, cl
cmovb eax, r15d
movzx r12d, al
lea r14, [0x14020ad38]
mov ebx, 1
nop word [rax + rax]
mov r8d, 1
mov rcx, rsi
mov rdx, r14
call fcn.140001940
test rax, rax
jne 0x140007733
inc r15
cmp r15, r12
jb 0x140007620
mov eax, 0xa
cmp edi, 0x270f
ja 0x14000766e
mov ecx, edi
cmp edi, 0x63
ja 0x1400076bf
cmp ecx, 0xa
jae 0x1400076f9
or cl, 0x30
mov byte [rsp + rax + 0x1f], cl
dec rax
jmp 0x14000770d
mov eax, edi
mov ecx, 0xd1b71759
imul rcx, rax
shr rcx, 0x2d
imul eax, ecx, 0x2710
sub edi, eax
imul eax, edi, 0x147b
shr eax, 0x13
imul edx, eax, 0x64
sub edi, edx
movzx edx, di
lea r8, str.00010203040506070809101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899amAMpmPMMondayTuesdayWednesdayThursdayFridaySaturdaySunday
movzx eax, word [r8 + rax*2]
mov word [rsp + 0x26], ax
movzx eax, word [r8 + rdx*2]
mov word [rsp + 0x28], ax
mov eax, 6
mov edi, ecx
mov ecx, edi
cmp edi, 0x63
jbe 0x140007656
movzx edx, cx
shr edx, 2
imul edx, edx, 0x147b
shr edx, 0x11
imul r8d, edx, 0x64
sub ecx, r8d
movzx ecx, cx
lea r8, str.00010203040506070809101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899amAMpmPMMondayTuesdayWednesdayThursdayFridaySaturdaySunday
movzx ecx, word [r8 + rcx*2]
mov word [rsp + rax + 0x1e], cx
add rax, 0xfffffffffffffffe
mov rcx, rdx
cmp ecx, 0xa
jb 0x14000765f
lea rdx, str.00010203040506070809101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899amAMpmPMMondayTuesdayWednesdayThursdayFridaySaturdaySunday
movzx ecx, word [rdx + rcx*2]
mov word [rsp + rax + 0x1e], cx
add rax, 0xfffffffffffffffe
mov r8d, 0xa
sub r8, rax
lea rdx, [rsp + rax]
add rdx, 0x20
mov rcx, rsi
mov rsi, r8
call fcn.140001940
test rax, rax
je 0x140007738
mov ebx, 1
mov rsi, rax
jmp 0x14000773d
add rsi, r15
xor ebx, ebx
mov rax, rbx
mov rdx, rsi
add rsp, 0x48
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret