joyce8/EMBER2024-capa huggingface dataset:
Function at 0x628b40
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x628c66
sub rsp, 0x60
mov qword [rsp + 0x58], rbp
lea rbp, [rsp + 0x58]
movabs rdx, 0xc7790a65df519ddd
mov qword [rsp + 0x1d], rdx
movabs rdx, 0xcd6616d1c9c66f8
mov qword [rsp + 0x25], rdx
movabs rdx, 0xd0cd6616d1c9c66
mov qword [rsp + 0x26], rdx
movabs rdx, 0x9002ec0c577204b6
mov qword [rsp + 0x2e], rdx
movabs rdx, 0x12030b0b000e0a18
mov qword [rsp + 0x36], rdx
movabs rdx, 0x71412030b0b000e
mov qword [rsp + 0x38], rdx
movabs rdx, 0xe181005010b0114
mov qword [rsp + 0x40], rdx
movabs rdx, 0x1714150b18150808
mov qword [rsp + 0x48], rdx
movabs rdx, 0xf0a011611011607
mov qword [rsp + 0x50], rdx
xor eax, eax
jmp 0x628c00
movzx r9d, byte [rsp + rsi + 0x1d]
sub r9d, edx
lea edx, [r9 - 0x78]
mov byte [rsp + rdi + 0x1d], dl
lea edx, [r8 - 0x78]
mov byte [rsp + rsi + 0x1d], dl
add rax, 2
cmp rax, 0x22
jge 0x628c2d
movzx edx, byte [rsp + rax + 0x36]
movzx esi, byte [rsp + rax + 0x37]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x19
jae 0x628c54
movzx r8d, byte [rsp + rdi + 0x1d]
sub r8d, edx
cmp rsi, 0x19
jb 0x628be3
jmp 0x628c48
xor eax, eax
lea rbx, [rsp + 0x1d]
mov ecx, 0x19
call fcn.0044ba20
mov rbp, qword [rsp + 0x58]
add rsp, 0x60
ret
mov eax, esi
mov ecx, 0x19
call fcn.00461e80
mov eax, edi
mov ecx, 0x19
nop dword [rax + rax]
call fcn.00461e80
nop
call fcn.0045f820
jmp fcn.00628b40
Function at 0x62ca00
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x62cacb
sub rsp, 0x38
mov qword [rsp + 0x30], rbp
lea rbp, [rsp + 0x30]
movabs rdx, 0xa56955744975e763
mov qword [rsp + 0x1b], rdx
mov byte [rsp + 0x23], 0x56
movabs rdx, 0x108080603050503
mov qword [rsp + 0x24], rdx
mov dword [rsp + 0x2c], 0x6070307
xor eax, eax
jmp 0x62ca64
movzx r9d, byte [rsp + rsi + 0x1b]
sub r9d, edx
lea edx, [r9 - 0x6c]
mov byte [rsp + rdi + 0x1b], dl
lea edx, [r8 - 0x6c]
mov byte [rsp + rsi + 0x1b], dl
add rax, 2
cmp rax, 0xc
jge 0x62ca97
movzx edx, byte [rsp + rax + 0x24]
movzx esi, byte [rsp + rax + 0x25]
mov edi, edx
xor edx, esi
add edx, eax
nop word [rax + rax]
cmp rdi, 9
jae 0x62cabe
movzx r8d, byte [rsp + rdi + 0x1b]
sub r8d, edx
cmp rsi, 9
jb 0x62ca47
jmp 0x62cab2
xor eax, eax
lea rbx, [rsp + 0x1b]
mov ecx, 9
call fcn.0044ba20
mov rbp, qword [rsp + 0x30]
add rsp, 0x38
ret
mov eax, esi
mov ecx, 9
call fcn.00461e80
mov eax, edi
mov ecx, 9
call fcn.00461e80
nop
call fcn.0045f820
jmp fcn.0062ca00

Function at 0x62d700
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x62d808
sub rsp, 0x50
mov qword [rsp + 0x48], rbp
lea rbp, [rsp + 0x48]
movabs rdx, 0x6e9c74acd57400a4
mov qword [rsp + 0x19], rdx
movabs rdx, 0x6465906e9c74acd5
mov qword [rsp + 0x1c], rdx
movabs rdx, 0x818870aa87020b7
mov qword [rsp + 0x24], rdx
movabs rdx, 0x12060e0e00030010
mov qword [rsp + 0x2c], rdx
movabs rdx, 0xc110110080b0f01
mov qword [rsp + 0x34], rdx
movabs rdx, 0xe1003100c110110
mov qword [rsp + 0x38], rdx
movabs rdx, 0x12030e0b08080804
mov qword [rsp + 0x40], rdx
xor eax, eax
jmp 0x62d7a2
movzx r9d, byte [rsp + rsi + 0x19]
sub r9d, edx
lea edx, [r9 + 0x77]
mov byte [rsp + rdi + 0x19], dl
lea edx, [r8 + 0x77]
mov byte [rsp + rsi + 0x19], dl
add rax, 2
cmp rax, 0x1c
jge 0x62d7cf
movzx edx, byte [rsp + rax + 0x2c]
movzx esi, byte [rsp + rax + 0x2d]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x13
jae 0x62d7fb
movzx r8d, byte [rsp + rdi + 0x19]
sub r8d, edx
cmp rsi, 0x13
jb 0x62d785
jmp 0x62d7ef
xor eax, eax
lea rbx, [rsp + 0x19]
mov ecx, 0x13
nop dword [rax + rax]
call fcn.0044ba20
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
mov eax, esi
mov ecx, 0x13
call fcn.00461e80
mov eax, edi
mov ecx, 0x13
call fcn.00461e80
nop
call fcn.0045f820
jmp fcn.0062d700
Function at 0x62db40
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x62dc1c
sub rsp, 0x40
mov qword [rsp + 0x38], rbp
lea rbp, [rsp + 0x38]
movabs rdx, 0xa54925fe415453b4
mov qword [rsp + 0x1f], rdx
movabs rdx, 0xfe9ca54925fe41
mov qword [rsp + 0x22], rdx
movabs rdx, 0x40000000a0a05
mov qword [rsp + 0x2a], rdx
movabs rdx, 0xa08090707080004
mov qword [rsp + 0x30], rdx
xor eax, eax
jmp 0x62dbb2
movzx r9d, byte [rsp + rsi + 0x1f]
add r9d, 0x3d
add edx, r9d
mov byte [rsp + rdi + 0x1f], dl
mov byte [rsp + rsi + 0x1f], r8b
add rax, 2
cmp rax, 0xe
jge 0x62dbe8
movzx edx, byte [rsp + rax + 0x2a]
movzx esi, byte [rsp + rax + 0x2b]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0xb
jae 0x62dc0f
movzx r8d, byte [rsp + rdi + 0x1f]
add r8d, 0x3d
add r8d, edx
nop dword [rax + rax]
cmp rsi, 0xb
jb 0x62db98
jmp 0x62dc03
xor eax, eax
lea rbx, [rsp + 0x1f]
mov ecx, 0xb
call fcn.0044ba20
mov rbp, qword [rsp + 0x38]
add rsp, 0x40
ret
mov eax, esi
mov ecx, 0xb
call fcn.00461e80
mov eax, edi
mov ecx, 0xb
call fcn.00461e80
nop
nop dword [rax]
call fcn.0045f820
jmp fcn.0062db40

Function at 0x62df40
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x62e008
sub rsp, 0x38
mov qword [rsp + 0x30], rbp
lea rbp, [rsp + 0x30]
movabs rdx, 0x242c2e2645163c08
mov qword [rsp + 0x1d], rdx
mov byte [rsp + 0x25], 0x2a
movabs rdx, 0x104070600050502
mov qword [rsp + 0x26], rdx
mov word [rsp + 0x2e], 0x508
xor eax, eax
jmp 0x62dfa0
movzx r9d, byte [rsp + rsi + 0x1d]
add r9d, 0x18
add edx, r9d
mov byte [rsp + rdi + 0x1d], dl
mov byte [rsp + rsi + 0x1d], r8b
add rax, 2
cmp rax, 0xa
jge 0x62dfd1
movzx edx, byte [rsp + rax + 0x26]
movzx esi, byte [rsp + rax + 0x27]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 9
jae 0x62dffb
movzx r8d, byte [rsp + rdi + 0x1d]
add r8d, 0x18
add r8d, edx
cmp rsi, 9
jb 0x62df86
jmp 0x62dfef
xor eax, eax
lea rbx, [rsp + 0x1d]
mov ecx, 9
nop dword [rax]
call fcn.0044ba20
mov rbp, qword [rsp + 0x30]
add rsp, 0x38
ret
mov eax, esi
mov ecx, 9
call fcn.00461e80
mov eax, edi
mov ecx, 9
call fcn.00461e80
nop
call fcn.0045f820
jmp fcn.0062df40
Function at 0x630a00
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x630af6
sub rsp, 0x50
mov qword [rsp + 0x48], rbp
lea rbp, [rsp + 0x48]
movabs rdx, 0x6fc4746669d36f41
mov qword [rsp + 0x1b], rdx
movabs rdx, 0x60c8f1c3df6fc474
mov qword [rsp + 0x20], rdx
movabs rdx, 0x735e67656cf55469
mov qword [rsp + 0x28], rdx
movabs rdx, 0x2080913060b090e
mov qword [rsp + 0x30], rdx
movabs rdx, 0x9010e090809030c
mov qword [rsp + 0x38], rdx
movabs rdx, 0xf0f0c0a040f0309
mov qword [rsp + 0x40], rdx
xor eax, eax
jmp 0x630a93
movzx r9d, byte [rsp + rsi + 0x1b]
sub r9d, edx
lea edx, [r9 - 0x65]
mov byte [rsp + rdi + 0x1b], dl
lea edx, [r8 - 0x65]
mov byte [rsp + rsi + 0x1b], dl
add rax, 2
cmp rax, 0x18
jge 0x630ac2
movzx edx, byte [rsp + rax + 0x30]
movzx esi, byte [rsp + rax + 0x31]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x15
jae 0x630ae9
movzx r8d, byte [rsp + rdi + 0x1b]
sub r8d, edx
cmp rsi, 0x15
jb 0x630a76
nop
jmp 0x630add
xor eax, eax
lea rbx, [rsp + 0x1b]
mov ecx, 0x15
call fcn.0044ba20
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
mov eax, esi
mov ecx, 0x15
call fcn.00461e80
mov eax, edi
mov ecx, 0x15
call fcn.00461e80
nop
call fcn.0045f820
nop dword [rax + rax]
jmp fcn.00630a00

Function at 0x635a00
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x635b08
sub rsp, 0x58
mov qword [rsp + 0x50], rbp
lea rbp, [rsp + 0x50]
movabs rdx, 0x74a57d897f75d563
mov qword [rsp + 0x1f], rdx
movabs rdx, 0x644a693d6974a57d
mov qword [rsp + 0x24], rdx
movabs rdx, 0x3840682f64998990
mov qword [rsp + 0x2c], rdx
movabs rdx, 0x11060e010f04080b
mov qword [rsp + 0x34], rdx
movabs rdx, 0x110b0d090e0d1404
mov qword [rsp + 0x3c], rdx
movabs rdx, 0x13120912110b0d09
mov qword [rsp + 0x40], rdx
movabs rdx, 0x120604130503030b
mov qword [rsp + 0x48], rdx
xor eax, eax
jmp 0x635aa0
movzx r9d, byte [rsp + rsi + 0x1f]
add r9d, 0xffffffd3
add edx, r9d
mov byte [rsp + rdi + 0x1f], dl
mov byte [rsp + rsi + 0x1f], r8b
add rax, 2
nop
cmp rax, 0x1c
jge 0x635ad1
movzx edx, byte [rsp + rax + 0x34]
movzx esi, byte [rsp + rax + 0x35]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x15
jae 0x635afb
movzx r8d, byte [rsp + rdi + 0x1f]
add r8d, 0xffffffd3
add r8d, edx
cmp rsi, 0x15
jb 0x635a85
jmp 0x635aef
xor eax, eax
lea rbx, [rsp + 0x1f]
mov ecx, 0x15
nop dword [rax]
call fcn.0044ba20
mov rbp, qword [rsp + 0x50]
add rsp, 0x58
ret
mov eax, esi
mov ecx, 0x15
call fcn.00461e80
mov eax, edi
mov ecx, 0x15
call fcn.00461e80
nop
call fcn.0045f820
jmp fcn.00635a00
Function at 0x636ba0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x636ca8
sub rsp, 0x58
mov qword [rsp + 0x50], rbp
lea rbp, [rsp + 0x50]
movabs rdx, 0xb3f2ddff6c75fa6b
mov qword [rsp + 0x1c], rdx
movabs rdx, 0x66b4f3f93e0bb3f2
mov qword [rsp + 0x22], rdx
movabs rdx, 0x731b48f06550604e
mov qword [rsp + 0x2a], rdx
movabs rdx, 0xb0005091210060a
mov qword [rsp + 0x32], rdx
movabs rdx, 0x807010f070d0d13
mov qword [rsp + 0x3a], rdx
movabs rdx, 0x1212050c090c0807
mov qword [rsp + 0x40], rdx
movabs rdx, 0x404010c0b141301
mov qword [rsp + 0x48], rdx
xor eax, eax
jmp 0x636c42
movzx r9d, byte [rsp + rsi + 0x1c]
sub r9d, edx
lea edx, [r9 - 0x7f]
mov byte [rsp + rdi + 0x1c], dl
lea edx, [r8 - 0x7f]
mov byte [rsp + rsi + 0x1c], dl
add rax, 2
cmp rax, 0x1e
jge 0x636c6f
movzx edx, byte [rsp + rax + 0x32]
movzx esi, byte [rsp + rax + 0x33]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x16
jae 0x636c9b
movzx r8d, byte [rsp + rdi + 0x1c]
sub r8d, edx
cmp rsi, 0x16
jb 0x636c25
jmp 0x636c8f
xor eax, eax
lea rbx, [rsp + 0x1c]
mov ecx, 0x16
nop dword [rax + rax]
call fcn.0044ba20
mov rbp, qword [rsp + 0x50]
add rsp, 0x58
ret
mov eax, esi
mov ecx, 0x16
call fcn.00461e80
mov eax, edi
mov ecx, 0x16
call fcn.00461e80
nop
call fcn.0045f820
jmp fcn.00636ba0

Function at 0x63b240
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x63b336
sub rsp, 0x48
mov qword [rsp + 0x40], rbp
lea rbp, [rsp + 0x40]
movabs rdx, 0x2d20380f2c36de3f
mov qword [rsp + 0x2e], rdx
movabs rdx, 0x653a2d20380f2c36
mov qword [rsp + 0x30], rdx
movabs rdx, 0x424943cc6f475e
mov qword [rsp + 0x38], rdx
movabs rdx, 0x110a040e03050811
mov qword [rsp + 0x1c], rdx
movabs rdx, 0xb0d110a040e0305
mov qword [rsp + 0x1e], rdx
movabs rdx, 0x1002020b0f0001
mov qword [rsp + 0x26], rdx
xor eax, eax
jmp 0x63b2d3
movzx r9d, byte [rsp + rsi + 0x2e]
sub r9d, edx
lea edx, [r9 + 0x39]
mov byte [rsp + rdi + 0x2e], dl
lea edx, [r8 + 0x39]
mov byte [rsp + rsi + 0x2e], dl
add rax, 2
cmp rax, 0x12
jge 0x63b302
movzx edx, byte [rsp + rax + 0x1c]
movzx esi, byte [rsp + rax + 0x1d]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x12
jae 0x63b329
movzx r8d, byte [rsp + rdi + 0x2e]
sub r8d, edx
cmp rsi, 0x12
jb 0x63b2b6
nop
jmp 0x63b31d
xor eax, eax
lea rbx, [rsp + 0x2e]
mov ecx, 0x12
call fcn.0044ba20
mov rbp, qword [rsp + 0x40]
add rsp, 0x48
ret
mov eax, esi
mov ecx, 0x12
call fcn.00461e80
mov eax, edi
mov ecx, 0x12
call fcn.00461e80
nop
call fcn.0045f820
nop dword [rax + rax]
jmp fcn.0063b240
Function at 0x63b800
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x63b8c8
sub rsp, 0x38
mov qword [rsp + 0x30], rbp
lea rbp, [rsp + 0x30]
movabs rdx, 0xbc2e2b65232a7789
mov qword [rsp + 0x1a], rdx
mov word [rsp + 0x22], 0x1507
movabs rdx, 0x2010205070309
mov qword [rsp + 0x24], rdx
mov dword [rsp + 0x2c], 0x8050200
xor eax, eax
jmp 0x63b863
movzx r9d, byte [rsp + rsi + 0x1a]
add r9d, 0x45
add edx, r9d
mov byte [rsp + rdi + 0x1a], dl
mov byte [rsp + rsi + 0x1a], r8b
add rax, 2
cmp rax, 0xc
jge 0x63b894
movzx edx, byte [rsp + rax + 0x24]
movzx esi, byte [rsp + rax + 0x25]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0xa
jae 0x63b8bb
movzx r8d, byte [rsp + rdi + 0x1a]
add r8d, 0x45
add r8d, edx
cmp rsi, 0xa
jb 0x63b849
jmp 0x63b8af
xor eax, eax
lea rbx, [rsp + 0x1a]
mov ecx, 0xa
call fcn.0044ba20
mov rbp, qword [rsp + 0x30]
add rsp, 0x38
ret
mov eax, esi
mov ecx, 0xa
call fcn.00461e80
mov eax, edi
mov ecx, 0xa
call fcn.00461e80
nop
call fcn.0045f820
jmp fcn.0063b800
Function at 0x63c060
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x63c13c
sub rsp, 0x40
mov qword [rsp + 0x38], rbp
lea rbp, [rsp + 0x38]
movabs rdx, 0x4a45197933476e54
mov qword [rsp + 0x1d], rdx
movabs rdx, 0x3e522146644a4519
mov qword [rsp + 0x22], rdx
movabs rdx, 0xb0c02020a020600
mov qword [rsp + 0x2a], rdx
movabs rdx, 0x707050703090b0c
mov qword [rsp + 0x30], rdx
xor eax, eax
jmp 0x63c0d2
movzx r9d, byte [rsp + rsi + 0x1d]
add r9d, 0x1a
add edx, r9d
mov byte [rsp + rdi + 0x1d], dl
mov byte [rsp + rsi + 0x1d], r8b
add rax, 2
cmp rax, 0xe
jge 0x63c108
movzx edx, byte [rsp + rax + 0x2a]
movzx esi, byte [rsp + rax + 0x2b]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0xd
jae 0x63c12f
movzx r8d, byte [rsp + rdi + 0x1d]
add r8d, 0x1a
add r8d, edx
nop dword [rax + rax]
cmp rsi, 0xd
jb 0x63c0b8
jmp 0x63c123
xor eax, eax
lea rbx, [rsp + 0x1d]
mov ecx, 0xd
call fcn.0044ba20
mov rbp, qword [rsp + 0x38]
add rsp, 0x40
ret
mov eax, esi
mov ecx, 0xd
call fcn.00461e80
mov eax, edi
mov ecx, 0xd
call fcn.00461e80
nop
nop dword [rax]
call fcn.0045f820
jmp fcn.0063c060

Function at 0x63cc40
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x63cd88
sub rsp, 0x78
mov qword [rsp + 0x70], rbp
lea rbp, [rsp + 0x70]
movabs rdx, 0x69316c9a9b73afb3
mov qword [rsp + 0x1e], rdx
movabs rdx, 0x96b454e069316c9a
mov qword [rsp + 0x22], rdx
movabs rdx, 0x73cf612055be5d6a
mov qword [rsp + 0x2a], rdx
movabs rdx, 0xb0b37a626cc966b7
mov qword [rsp + 0x32], rdx
movabs rdx, 0xb773b4adaf73b17d
mov qword [rsp + 0x3a], rdx
movabs rdx, 0x161a1f1214131201
mov qword [rsp + 0x42], rdx
movabs rdx, 0x221c19192323081f
mov qword [rsp + 0x4a], rdx
movabs rdx, 0xa08200f0c0e221c
mov qword [rsp + 0x50], rdx
movabs rdx, 0x1f1d19211b04000b
mov qword [rsp + 0x58], rdx
movabs rdx, 0x302180123040a0a
mov qword [rsp + 0x60], rdx
movabs rdx, 0x6220a0f1a030319
mov qword [rsp + 0x68], rdx
xor eax, eax
nop
jmp 0x63cd20
movzx r9d, byte [rsp + rsi + 0x1e]
add r9d, 0xffffffa4
add edx, r9d
mov byte [rsp + rdi + 0x1e], dl
mov byte [rsp + rsi + 0x1e], r8b
add rax, 2
nop dword [rax]
cmp rax, 0x2e
jge 0x63cd51
movzx edx, byte [rsp + rax + 0x42]
movzx esi, byte [rsp + rax + 0x43]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x24
jae 0x63cd7b
movzx r8d, byte [rsp + rdi + 0x1e]
add r8d, 0xffffffa4
add r8d, edx
cmp rsi, 0x24
jb 0x63cd02
jmp 0x63cd6f
xor eax, eax
lea rbx, [rsp + 0x1e]
mov ecx, 0x24
nop dword [rax]
call fcn.0044ba20
mov rbp, qword [rsp + 0x70]
add rsp, 0x78
ret
mov eax, esi
mov ecx, 0x24
call fcn.00461e80
mov eax, edi
mov ecx, 0x24
call fcn.00461e80
nop
call fcn.0045f820
jmp fcn.0063cc40
Function at 0x63e100
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x63e1e8
sub rsp, 0x48
mov qword [rsp + 0x40], rbp
lea rbp, [rsp + 0x40]
movabs rdx, 0xb6c5d617a5d097e3
mov qword [rsp + 0x18], rdx
movabs rdx, 0x3ae391c41206cef
mov qword [rsp + 0x20], rdx
movabs rdx, 0x2080b0b04030c08
mov qword [rsp + 0x28], rdx
movabs rdx, 0xf030001020f0d
mov qword [rsp + 0x30], rdx
movabs rdx, 0xf060d010e050b07
mov qword [rsp + 0x38], rdx
xor eax, eax
jmp 0x63e181
movzx r9d, byte [rsp + rsi + 0x18]
add r9d, 0xffffff81
add edx, r9d
mov byte [rsp + rdi + 0x18], dl
mov byte [rsp + rsi + 0x18], r8b
add rax, 2
cmp rax, 0x18
jge 0x63e1b2
movzx edx, byte [rsp + rax + 0x28]
movzx esi, byte [rsp + rax + 0x29]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x10
jae 0x63e1db
movzx r8d, byte [rsp + rdi + 0x18]
add r8d, 0xffffff81
add r8d, edx
cmp rsi, 0x10
jb 0x63e167
jmp 0x63e1cf
xor eax, eax
lea rbx, [rsp + 0x18]
mov ecx, 0x10
nop
call fcn.0044ba20
mov rbp, qword [rsp + 0x40]
add rsp, 0x48
ret
mov eax, esi
mov ecx, 0x10
call fcn.00461e80
mov eax, edi
mov ecx, 0x10
call fcn.00461e80
nop
call fcn.0045f820
jmp fcn.0063e100
Function at 0x63ec00
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x63ecc8
sub rsp, 0x38
mov qword [rsp + 0x30], rbp
lea rbp, [rsp + 0x30]
movabs rdx, 0xb1a4a76cfd2fafa1
mov qword [rsp + 0x1d], rdx
mov byte [rsp + 0x25], 0x65
movabs rdx, 0x1050306070200
mov qword [rsp + 0x26], rdx
mov word [rsp + 0x2e], 0x105
xor eax, eax
jmp 0x63ec63
movzx r9d, byte [rsp + rsi + 0x1d]
sub r9d, edx
lea edx, [r9 - 0x3c]
mov byte [rsp + rdi + 0x1d], dl
lea edx, [r8 - 0x3c]
mov byte [rsp + rsi + 0x1d], dl
add rax, 2
cmp rax, 0xa
jge 0x63ec90
movzx edx, byte [rsp + rax + 0x26]
movzx esi, byte [rsp + rax + 0x27]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 9
jae 0x63ecbb
movzx r8d, byte [rsp + rdi + 0x1d]
sub r8d, edx
cmp rsi, 9
jb 0x63ec46
jmp 0x63ecaf
xor eax, eax
lea rbx, [rsp + 0x1d]
mov ecx, 9
nop dword [rax]
call fcn.0044ba20
mov rbp, qword [rsp + 0x30]
add rsp, 0x38
ret
mov eax, esi
mov ecx, 9
call fcn.00461e80
mov eax, edi
mov ecx, 9
call fcn.00461e80
nop
call fcn.0045f820
jmp fcn.0063ec00
Function at 0x14000d3b0
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x28
mov dword [rsp + 4], 0
mov dword [rsp], 0xffffffff
movsxd rax, dword [rsp + 4]
mov rcx, qword [rsp + 0x30]
movzx eax, byte [rcx + rax]
test eax, eax
je 0x14000d443
movsxd rax, dword [rsp + 4]
mov rcx, qword [rsp + 0x30]
movzx eax, byte [rcx + rax]
mov dword [rsp + 0xc], eax
mov eax, dword [rsp + 0xc]
mov ecx, dword [rsp]
xor ecx, eax
mov eax, ecx
mov dword [rsp], eax
mov dword [rsp + 8], 7
jmp 0x14000d40e
mov eax, dword [rsp + 8]
dec eax
mov dword [rsp + 8], eax
cmp dword [rsp + 8], 0
jl 0x14000d437
mov eax, dword [rsp]
and eax, 1
neg eax
mov dword [rsp + 0x10], eax
mov eax, dword [rsp]
shr eax, 1
mov ecx, dword [rsp + 0x10]
and ecx, 0xedb88320
xor eax, ecx
mov dword [rsp], eax
jmp 0x14000d404
mov eax, dword [rsp + 4]
inc eax
mov dword [rsp + 4], eax
jmp 0x14000d3c8
mov eax, dword [rsp]
not eax
add rsp, 0x28
ret
Function at 0x1400176b0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rdi
sub rsp, 0x290
mov dword [rsp + 0x38], 0
mov byte [0x1401ddfa0], 1
lea rax, [rsp + 0x70]
mov rdi, rax
xor eax, eax
mov ecx, 0x104
rep stosb byte [rdi], al
mov r8d, 0x104
lea rdx, [rsp + 0x70]
xor ecx, ecx
call fcn.140086590
mov r8d, 4
xor edx, edx
lea rcx, [rsp + 0x70]
call fcn.1400864a0
lea rax, [rsp + 0x180]
mov rdi, rax
xor eax, eax
mov ecx, 0x104
rep stosb byte [rdi], al
lea rcx, [rsp + 0x70]
call fcn.1400855e0
mov r8, rax
mov edx, 0x104
lea rcx, [rsp + 0x180]
call fcn.14015444c
lea rcx, [rsp + 0x180]
call fcn.140085ee0
mov eax, 1
imul rax, rax, 4
mov byte [rsp + rax + 0x20], 0x65
mov eax, 1
imul rax, rax, 3
mov byte [rsp + rax + 0x20], 0x64
mov eax, 1
imul rax, rax, 8
mov byte [rsp + rax + 0x20], 0x65
mov eax, 1
imul rax, rax, 6
mov byte [rsp + rax + 0x20], 0x65
mov eax, 1
imul rax, rax, 5
mov byte [rsp + rax + 0x20], WSASetLastError
mov eax, 1
imul rax, rax, 2
mov byte [rsp + rax + 0x20], 0x20
mov eax, 1
imul rax, rax, 0
mov byte [rsp + rax + 0x20], reloc.WS2_32.dll_WSAStartup
mov eax, 1
imul rax, rax, 0xa
mov byte [rsp + rax + 0x20], 0
mov eax, 1
imul rax, rax, 7
mov byte [rsp + rax + 0x20], reloc.WS2_32.dll_WSACleanup
mov eax, 1
imul rax, rax, 9
mov byte [rsp + rax + 0x20], 0x20
mov eax, 1
imul rax, rax, 1
mov byte [rsp + rax + 0x20], 0x63
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x50]
call fcn.140029200
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x48], rax
lea r8, [rsp + 0x180]
mov rdx, qword [rsp + 0x48]
lea rcx, [rsp + 0x30]
call fcn.14002b880
nop
mov rax, qword [rsp + 0x50]
sub rax, 0x18
mov qword [rsp + 0x58], rax
mov rcx, qword [rsp + 0x58]
call fcn.14007cf20
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x60], rax
xor edx, edx
mov rcx, qword [rsp + 0x60]
call fcn.1400880f0
nop
mov rax, qword [rsp + 0x30]
sub rax, 0x18
mov qword [rsp + 0x68], rax
mov rcx, qword [rsp + 0x68]
call fcn.14007cf20
add rsp, 0x290
pop rdi
ret
Function at 0x14007ad00
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x48
mov dword [rsp + 0x20], 0
mov eax, 1
imul rax, rax, 0x10
mov byte [rsp + rax + 0x28], WSACleanup
mov eax, 1
imul rax, rax, 0xb
mov byte [rsp + rax + 0x28], reloc.WS2_32.dll_WSACleanup
mov eax, 1
imul rax, rax, 3
mov byte [rsp + rax + 0x28], 0x62
mov eax, 1
imul rax, rax, 8
mov byte [rsp + rax + 0x28], 0x49
mov eax, 1
imul rax, rax, 6
mov byte [rsp + rax + 0x28], 0x5c
mov eax, 1
imul rax, rax, 0xe
mov byte [rsp + rax + 0x28], WSASetLastError
mov eax, 1
imul rax, rax, 0x16
mov byte [rsp + rax + 0x28], 0
mov eax, 1
imul rax, rax, 5
mov byte [rsp + rax + 0x28], WSASetLastError
mov eax, 1
imul rax, rax, 0x13
mov byte [rsp + rax + 0x28], reloc.WS2_32.dll_WSACleanup
mov eax, 1
imul rax, rax, 0xa
mov byte [rsp + rax + 0x28], reloc.WS2_32.dll_WSAStartup
mov eax, 1
imul rax, rax, 0x12
mov byte [rsp + rax + 0x28], 0x75
mov eax, 1
imul rax, rax, 9
mov byte [rsp + rax + 0x28], WSASetLastError
mov eax, 1
imul rax, rax, 7
mov byte [rsp + rax + 0x28], 0x43
mov eax, 1
imul rax, rax, 1
mov byte [rsp + rax + 0x28], WSASetLastError
mov eax, 1
imul rax, rax, 0xc
mov byte [rsp + rax + 0x28], 0x61
mov eax, 1
imul rax, rax, 0xf
mov byte [rsp + rax + 0x28], 0x65
mov eax, 1
imul rax, rax, 0xd
mov byte [rsp + rax + 0x28], WSASetLastError
mov eax, 1
imul rax, rax, 2
mov byte [rsp + rax + 0x28], reloc.WS2_32.dll_WSAGetLastError
mov eax, 1
imul rax, rax, 0
mov byte [rsp + rax + 0x28], 0x47
mov eax, 1
imul rax, rax, 0x15
mov byte [rsp + rax + 0x28], 0x78
mov eax, 1
imul rax, rax, 0x11
mov byte [rsp + rax + 0x28], 0x4d
mov eax, 1
imul rax, rax, 0x14
mov byte [rsp + rax + 0x28], 0x65
mov eax, 1
imul rax, rax, 4
mov byte [rsp + rax + 0x28], 0x61
lea rdx, [rsp + 0x28]
mov rcx, qword [rsp + 0x50]
call fcn.140029200
mov eax, dword [rsp + 0x20]
or eax, 1
mov dword [rsp + 0x20], eax
mov rax, qword [rsp + 0x50]
add rsp, 0x48
ret
Function at 0x14007ae80
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x48
mov dword [rsp + 0x20], 0
mov eax, 1
imul rax, rax, 0xb
mov byte [rsp + rax + 0x28], reloc.WS2_32.dll_WSAStartup
mov eax, 1
imul rax, rax, 9
mov byte [rsp + rax + 0x28], 0x49
mov eax, 1
imul rax, rax, 2
mov byte [rsp + rax + 0x28], reloc.WS2_32.dll_WSAGetLastError
mov eax, 1
imul rax, rax, 0xd
mov byte [rsp + rax + 0x28], 0x61
mov eax, 1
imul rax, rax, 1
mov byte [rsp + rax + 0x28], WSASetLastError
mov eax, 1
imul rax, rax, 0x13
mov byte [rsp + rax + 0x28], 0x75
mov eax, 1
imul rax, rax, 0xf
mov byte [rsp + rax + 0x28], WSASetLastError
mov eax, 1
imul rax, rax, 0x17
mov byte [rsp + rax + 0x28], 0
mov eax, 1
imul rax, rax, 0xa
mov byte [rsp + rax + 0x28], WSASetLastError
mov eax, 1
imul rax, rax, 4
mov byte [rsp + rax + 0x28], 0x61
mov eax, 1
imul rax, rax, 6
mov byte [rsp + rax + 0x28], 0x5c
mov eax, 1
imul rax, rax, 0x10
mov byte [rsp + rax + 0x28], 0x65
mov eax, 1
imul rax, rax, 0x11
mov byte [rsp + rax + 0x28], WSACleanup
mov eax, 1
imul rax, rax, 3
mov byte [rsp + rax + 0x28], 0x62
mov eax, 1
imul rax, rax, 7
mov byte [rsp + rax + 0x28], 0x46
mov eax, 1
imul rax, rax, 0x12
mov byte [rsp + rax + 0x28], 0x4d
mov eax, 1
imul rax, rax, 0x14
mov byte [rsp + rax + 0x28], reloc.WS2_32.dll_WSACleanup
mov eax, 1
imul rax, rax, 5
mov byte [rsp + rax + 0x28], WSASetLastError
mov eax, 1
imul rax, rax, 0xc
mov byte [rsp + rax + 0x28], reloc.WS2_32.dll_WSACleanup
mov eax, 1
imul rax, rax, 0x15
mov byte [rsp + rax + 0x28], 0x65
mov eax, 1
imul rax, rax, 0x16
mov byte [rsp + rax + 0x28], 0x78
mov eax, 1
imul rax, rax, 0
mov byte [rsp + rax + 0x28], 0x47
mov eax, 1
imul rax, rax, 0xe
mov byte [rsp + rax + 0x28], WSASetLastError
mov eax, 1
imul rax, rax, 8
mov byte [rsp + rax + 0x28], 0x46
lea rdx, [rsp + 0x28]
mov rcx, qword [rsp + 0x50]
call fcn.140029200
mov eax, dword [rsp + 0x20]
or eax, 1
mov dword [rsp + 0x20], eax
mov rax, qword [rsp + 0x50]
add rsp, 0x48
ret