joyce8/EMBER2024-capa huggingface dataset:
Function at 0x58cec0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x58cfd3
sub rsp, 0x60
mov qword [rsp + 0x58], rbp
lea rbp, [rsp + 0x58]
movabs rdx, 0x43fd7e8b7574a653
mov qword [rsp + 0x1c], rdx
movabs rdx, 0x64a7bd47738661f0
mov qword [rsp + 0x24], rdx
movabs rdx, 0x6fc0dba764a7bd47
mov qword [rsp + 0x28], rdx
movabs rdx, 0xafba45d17f984ea3
mov qword [rsp + 0x30], rdx
movabs rdx, 0xe1a051b101b1818
mov qword [rsp + 0x38], rdx
movabs rdx, 0x1218061817110a16
mov qword [rsp + 0x40], rdx
movabs rdx, 0x8180e0112141708
mov qword [rsp + 0x48], rdx
movabs rdx, 0xd040e140d041704
mov qword [rsp + 0x50], rdx
xor eax, eax
jmp 0x58cf6e
movzx r9d, byte [rsp + rsi + 0x1c]
add r9d, 0xffffffb7
add edx, r9d
mov byte [rsp + rdi + 0x1c], dl
mov byte [rsp + rsi + 0x1c], r8b
add rax, 2
cmp rax, 0x20
jge 0x58cf9f
movzx edx, byte [rsp + rax + 0x38]
movzx esi, byte [rsp + rax + 0x39]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x1c
jae 0x58cfc6
movzx r8d, byte [rsp + rdi + 0x1c]
add r8d, 0xffffffb7
add r8d, edx
cmp rsi, 0x1c
jb 0x58cf54
jmp 0x58cfba
xor eax, eax
lea rbx, [rsp + 0x1c]
mov ecx, 0x1c
call fcn.0044a0a0
mov rbp, qword [rsp + 0x58]
add rsp, 0x60
ret
mov eax, esi
mov ecx, 0x1c
call fcn.0045f380
mov eax, edi
mov ecx, 0x1c
call fcn.0045f380
nop
call fcn.0045cd20
jmp fcn.0058cec0

Function at 0x58cfe0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x58d0f3
sub rsp, 0x60
mov qword [rsp + 0x58], rbp
lea rbp, [rsp + 0x58]
movabs rdx, 0x43041cea687465f9
mov qword [rsp + 0x1f], rdx
movabs rdx, 0xd5174e48253c4d2b
mov qword [rsp + 0x27], rdx
movabs rdx, 0x3c7237d5174e4825
mov qword [rsp + 0x2a], rdx
movabs rdx, 0x57783fbf6975f12d
mov qword [rsp + 0x32], rdx
movabs rdx, 0xa0d0f131405180e
mov qword [rsp + 0x3a], rdx
movabs rdx, 0x17100b090c0b040c
mov qword [rsp + 0x42], rdx
movabs rdx, 0x1006131203121710
mov qword [rsp + 0x48], rdx
movabs rdx, 0x1312000508061300
mov qword [rsp + 0x50], rdx
xor eax, eax
jmp 0x58d08e
movzx r9d, byte [rsp + rsi + 0x1f]
add r9d, 0x18
add edx, r9d
mov byte [rsp + rdi + 0x1f], dl
mov byte [rsp + rsi + 0x1f], r8b
add rax, 2
cmp rax, 0x1e
jge 0x58d0bf
movzx edx, byte [rsp + rax + 0x3a]
movzx esi, byte [rsp + rax + 0x3b]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x1b
jae 0x58d0e6
movzx r8d, byte [rsp + rdi + 0x1f]
add r8d, 0x18
add r8d, edx
cmp rsi, 0x1b
jb 0x58d074
jmp 0x58d0da
xor eax, eax
lea rbx, [rsp + 0x1f]
mov ecx, 0x1b
call fcn.0044a0a0
mov rbp, qword [rsp + 0x58]
add rsp, 0x60
ret
mov eax, esi
mov ecx, 0x1b
call fcn.0045f380
mov eax, edi
mov ecx, 0x1b
call fcn.0045f380
nop
call fcn.0045cd20
jmp fcn.0058cfe0
Function at 0x58dfa0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x58e0a8
sub rsp, 0x58
mov qword [rsp + 0x50], rbp
lea rbp, [rsp + 0x50]
movabs rdx, 0x5b596a7025285053
mov qword [rsp + 0x1c], rdx
movabs rdx, 0x4a3d586d674d5b59
mov qword [rsp + 0x22], rdx
movabs rdx, 0x576f414066775d71
mov qword [rsp + 0x2a], rdx
movabs rdx, 0x1080c130d010313
mov qword [rsp + 0x32], rdx
movabs rdx, 0x1309051202030b07
mov qword [rsp + 0x3a], rdx
movabs rdx, 0x709060f03111309
mov qword [rsp + 0x40], rdx
movabs rdx, 0xc0b0e090810030e
mov qword [rsp + 0x48], rdx
xor eax, eax
jmp 0x58e042
movzx r9d, byte [rsp + rsi + 0x1c]
sub r9d, edx
lea edx, [r9 + 0x27]
mov byte [rsp + rdi + 0x1c], dl
lea edx, [r8 + 0x27]
mov byte [rsp + rsi + 0x1c], dl
add rax, 2
cmp rax, 0x1e
jge 0x58e06f
movzx edx, byte [rsp + rax + 0x32]
movzx esi, byte [rsp + rax + 0x33]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x16
jae 0x58e09b
movzx r8d, byte [rsp + rdi + 0x1c]
sub r8d, edx
cmp rsi, 0x16
jb 0x58e025
jmp 0x58e08f
xor eax, eax
lea rbx, [rsp + 0x1c]
mov ecx, 0x16
nop dword [rax + rax]
call fcn.0044a0a0
mov rbp, qword [rsp + 0x50]
add rsp, 0x58
ret
mov eax, esi
mov ecx, 0x16
call fcn.0045f380
mov eax, edi
mov ecx, 0x16
call fcn.0045f380
nop
call fcn.0045cd20
jmp fcn.0058dfa0

Function at 0x58e0c0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x58e1c8
sub rsp, 0x58
mov qword [rsp + 0x50], rbp
lea rbp, [rsp + 0x50]
movabs rdx, 0x47f2440175f512ba
mov qword [rsp + 0x1e], rdx
movabs rdx, 0x73ff193dca6547f2
mov qword [rsp + 0x24], rdx
movabs rdx, 0xec0f4521354da103
mov qword [rsp + 0x2c], rdx
movabs rdx, 0x11040f010f090e0b
mov qword [rsp + 0x34], rdx
movabs rdx, 0x1000c060e021110
mov qword [rsp + 0x3c], rdx
movabs rdx, 0x120b010c01000c06
mov qword [rsp + 0x40], rdx
movabs rdx, 0x140c0a15060e090a
mov qword [rsp + 0x48], rdx
xor eax, eax
jmp 0x58e160
movzx r9d, byte [rsp + rsi + 0x1e]
add r9d, 0x20
add edx, r9d
mov byte [rsp + rdi + 0x1e], dl
mov byte [rsp + rsi + 0x1e], r8b
add rax, 2
nop
cmp rax, 0x1c
jge 0x58e191
movzx edx, byte [rsp + rax + 0x34]
movzx esi, byte [rsp + rax + 0x35]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x16
jae 0x58e1bb
movzx r8d, byte [rsp + rdi + 0x1e]
add r8d, 0x20
add r8d, edx
cmp rsi, 0x16
jb 0x58e145
jmp 0x58e1af
xor eax, eax
lea rbx, [rsp + 0x1e]
mov ecx, 0x16
nop dword [rax]
call fcn.0044a0a0
mov rbp, qword [rsp + 0x50]
add rsp, 0x58
ret
mov eax, esi
mov ecx, 0x16
call fcn.0045f380
mov eax, edi
mov ecx, 0x16
call fcn.0045f380
nop
call fcn.0045cd20
jmp fcn.0058e0c0
Function at 0x58e1e0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x58e2f3
sub rsp, 0x60
mov qword [rsp + 0x58], rbp
lea rbp, [rsp + 0x58]
movabs rdx, 0x27b3ab70b770650e
mov qword [rsp + 0x1b], rdx
movabs rdx, 0x259bce616cc1746a
mov qword [rsp + 0x23], rdx
movabs rdx, 0xc882743750259bce
mov qword [rsp + 0x28], rdx
movabs rdx, 0xc5a86dbf72612098
mov qword [rsp + 0x30], rdx
movabs rdx, 0x150a061c10160f03
mov qword [rsp + 0x38], rdx
movabs rdx, 0x7020d081b001116
mov qword [rsp + 0x40], rdx
movabs rdx, 0x1610050713070214
mov qword [rsp + 0x48], rdx
movabs rdx, 0x1b031319190d050e
mov qword [rsp + 0x50], rdx
xor eax, eax
jmp 0x58e28e
movzx r9d, byte [rsp + rsi + 0x1b]
add r9d, 0xffffff86
add edx, r9d
mov byte [rsp + rdi + 0x1b], dl
mov byte [rsp + rsi + 0x1b], r8b
add rax, 2
cmp rax, 0x20
jge 0x58e2bf
movzx edx, byte [rsp + rax + 0x38]
movzx esi, byte [rsp + rax + 0x39]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x1d
jae 0x58e2e6
movzx r8d, byte [rsp + rdi + 0x1b]
add r8d, 0xffffff86
add r8d, edx
cmp rsi, 0x1d
jb 0x58e274
jmp 0x58e2da
xor eax, eax
lea rbx, [rsp + 0x1b]
mov ecx, 0x1d
call fcn.0044a0a0
mov rbp, qword [rsp + 0x58]
add rsp, 0x60
ret
mov eax, esi
mov ecx, 0x1d
call fcn.0045f380
mov eax, edi
mov ecx, 0x1d
call fcn.0045f380
nop
call fcn.0045cd20
jmp fcn.0058e1e0
Function at 0x590720
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x590833
sub rsp, 0x58
mov qword [rsp + 0x50], rbp
lea rbp, [rsp + 0x50]
movabs rdx, 0x53c8b8ed0874c2cd
mov qword [rsp + 0x1b], rdx
movabs rdx, 0x7421656c680a695d
mov qword [rsp + 0x23], rdx
movabs rdx, 0x187421656c680a69
mov qword [rsp + 0x24], rdx
movabs rdx, 0xb1726504690e4464
mov qword [rsp + 0x2c], rdx
movabs rdx, 0x5010b09060e1800
mov qword [rsp + 0x34], rdx
movabs rdx, 0x1309100308091518
mov qword [rsp + 0x3c], rdx
movabs rdx, 0xb0e091313091003
mov qword [rsp + 0x40], rdx
movabs rdx, 0x40a0008010e1305
mov qword [rsp + 0x48], rdx
xor eax, eax
jmp 0x5907ce
movzx r9d, byte [rsp + rsi + 0x1b]
add r9d, 0x3e
add edx, r9d
mov byte [rsp + rdi + 0x1b], dl
mov byte [rsp + rsi + 0x1b], r8b
add rax, 2
cmp rax, 0x1c
jge 0x5907ff
movzx edx, byte [rsp + rax + 0x34]
movzx esi, byte [rsp + rax + 0x35]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x19
jae 0x590826
movzx r8d, byte [rsp + rdi + 0x1b]
add r8d, 0x3e
add r8d, edx
cmp rsi, 0x19
jb 0x5907b4
jmp 0x59081a
xor eax, eax
lea rbx, [rsp + 0x1b]
mov ecx, 0x19
call fcn.0044a0a0
mov rbp, qword [rsp + 0x50]
add rsp, 0x58
ret
mov eax, esi
mov ecx, 0x19
call fcn.0045f380
mov eax, edi
mov ecx, 0x19
call fcn.0045f380
nop
call fcn.0045cd20
jmp fcn.00590720

Function at 0x591cc0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x591dc8
sub rsp, 0x58
mov qword [rsp + 0x50], rbp
lea rbp, [rsp + 0x50]
movabs rdx, 0x5646ef4c4746547
mov qword [rsp + 0x1e], rdx
movabs rdx, 0x60f0616572a1d19a
mov qword [rsp + 0x26], rdx
movabs rdx, 0x6485737308057ffc
mov qword [rsp + 0x2e], rdx
movabs rdx, 0x70a0813090b0903
mov qword [rsp + 0x36], rdx
movabs rdx, 0x121204030f0f160f
mov qword [rsp + 0x3e], rdx
movabs rdx, 0xe11121204030f0f
mov qword [rsp + 0x40], rdx
movabs rdx, 0x70e101309160407
mov qword [rsp + 0x48], rdx
xor eax, eax
jmp 0x591d60
movzx r9d, byte [rsp + rsi + 0x1e]
add r9d, 0x50
add edx, r9d
mov byte [rsp + rdi + 0x1e], dl
mov byte [rsp + rsi + 0x1e], r8b
add rax, 2
nop
cmp rax, 0x1a
jge 0x591d91
movzx edx, byte [rsp + rax + 0x36]
movzx esi, byte [rsp + rax + 0x37]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x18
jae 0x591dbb
movzx r8d, byte [rsp + rdi + 0x1e]
add r8d, 0x50
add r8d, edx
cmp rsi, 0x18
jb 0x591d45
jmp 0x591daf
xor eax, eax
lea rbx, [rsp + 0x1e]
mov ecx, 0x18
nop dword [rax]
call fcn.0044a0a0
mov rbp, qword [rsp + 0x50]
add rsp, 0x58
ret
mov eax, esi
mov ecx, 0x18
call fcn.0045f380
mov eax, edi
mov ecx, 0x18
call fcn.0045f380
nop
call fcn.0045cd20
jmp fcn.00591cc0
Function at 0x593be0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x593ca8
sub rsp, 0x38
mov qword [rsp + 0x30], rbp
lea rbp, [rsp + 0x30]
movabs rdx, 0x6474496f50785370
mov qword [rsp + 0x1e], rdx
movabs rdx, 0x70005050205
mov qword [rsp + 0x26], rdx
mov word [rsp + 0x2e], 0x303
xor eax, eax
nop
jmp 0x593c40
movzx r9d, byte [rsp + rsi + 0x1e]
add r9d, 0xfffffff1
add edx, r9d
mov byte [rsp + rdi + 0x1e], dl
mov byte [rsp + rsi + 0x1e], r8b
add rax, 2
nop dword [rax]
cmp rax, 0xa
jge 0x593c71
movzx edx, byte [rsp + rax + 0x26]
movzx esi, byte [rsp + rax + 0x27]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 8
jae 0x593c9b
movzx r8d, byte [rsp + rdi + 0x1e]
add r8d, 0xfffffff1
add r8d, edx
cmp rsi, 8
jb 0x593c22
jmp 0x593c8f
xor eax, eax
lea rbx, [rsp + 0x1e]
mov ecx, 8
nop dword [rax]
call fcn.0044a0a0
mov rbp, qword [rsp + 0x30]
add rsp, 0x38
ret
mov eax, esi
mov ecx, 8
call fcn.0045f380
mov eax, edi
mov ecx, 8
call fcn.0045f380
nop
call fcn.0045cd20
jmp fcn.00593be0

Function at 0x5944a0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x59457c
sub rsp, 0x40
mov qword [rsp + 0x38], rbp
lea rbp, [rsp + 0x38]
movabs rdx, 0x8cd0e665524153a6
mov qword [rsp + 0x1f], rdx
movabs rdx, 0xd4d4ac8cd0e66552
mov qword [rsp + 0x22], rdx
movabs rdx, 0x700080005080608
mov qword [rsp + 0x2a], rdx
movabs rdx, 0xa0a0909090a0700
mov qword [rsp + 0x30], rdx
xor eax, eax
jmp 0x594515
movzx r9d, byte [rsp + rsi + 0x1f]
sub r9d, edx
lea edx, [r9 - 0x28]
mov byte [rsp + rdi + 0x1f], dl
lea edx, [r8 - 0x28]
mov byte [rsp + rsi + 0x1f], dl
add rax, 2
cmp rax, 0xe
jge 0x594548
movzx edx, byte [rsp + rax + 0x2a]
movzx esi, byte [rsp + rax + 0x2b]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0xb
jae 0x59456f
movzx r8d, byte [rsp + rdi + 0x1f]
sub r8d, edx
nop word [rax + rax]
cmp rsi, 0xb
jb 0x5944f8
jmp 0x594563
xor eax, eax
lea rbx, [rsp + 0x1f]
mov ecx, 0xb
call fcn.0044a0a0
mov rbp, qword [rsp + 0x38]
add rsp, 0x40
ret
mov eax, esi
mov ecx, 0xb
call fcn.0045f380
mov eax, edi
mov ecx, 0xb
call fcn.0045f380
nop
nop dword [rax]
call fcn.0045cd20
jmp fcn.005944a0
Function at 0x596740
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x59680b
sub rsp, 0x38
mov qword [rsp + 0x30], rbp
lea rbp, [rsp + 0x30]
movabs rdx, 0xf6334e65200f654f
mov qword [rsp + 0x24], rdx
mov dword [rsp + 0x2c], 0x6c6c572e
movabs rdx, 0x500090302090702
mov qword [rsp + 0x18], rdx
mov dword [rsp + 0x20], 0x3030903
xor eax, eax
jmp 0x5967a7
movzx r9d, byte [rsp + rsi + 0x24]
sub r9d, edx
lea edx, [r9 + 0x28]
mov byte [rsp + rdi + 0x24], dl
lea edx, [r8 + 0x28]
mov byte [rsp + rsi + 0x24], dl
add rax, 2
cmp rax, 0xc
jge 0x5967d7
movzx edx, byte [rsp + rax + 0x18]
movzx esi, byte [rsp + rax + 0x19]
mov edi, edx
xor edx, esi
add edx, eax
nop dword [rax]
cmp rdi, 0xc
jae 0x5967fe
movzx r8d, byte [rsp + rdi + 0x24]
sub r8d, edx
cmp rsi, 0xc
jb 0x59678a
jmp 0x5967f2
xor eax, eax
lea rbx, [rsp + 0x24]
mov ecx, 0xc
call fcn.0044a0a0
mov rbp, qword [rsp + 0x30]
add rsp, 0x38
ret
mov eax, esi
mov ecx, 0xc
call fcn.0045f380
mov eax, edi
mov ecx, 0xc
call fcn.0045f380
nop
call fcn.0045cd20
jmp fcn.00596740

Function at 0x5a9900
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x5a99cb
sub rsp, 0x38
mov qword [rsp + 0x30], rbp
lea rbp, [rsp + 0x30]
movabs rdx, 0x71b9bcd701c3746e
mov qword [rsp + 0x1b], rdx
mov byte [rsp + 0x23], 0x17
movabs rdx, 0x702080206040403
mov qword [rsp + 0x24], rdx
mov dword [rsp + 0x2c], 0x5030502
xor eax, eax
jmp 0x5a9964
movzx r9d, byte [rsp + rsi + 0x1b]
sub r9d, edx
lea edx, [r9 - 0x49]
mov byte [rsp + rdi + 0x1b], dl
lea edx, [r8 - 0x49]
mov byte [rsp + rsi + 0x1b], dl
add rax, 2
cmp rax, 0xc
jge 0x5a9997
movzx edx, byte [rsp + rax + 0x24]
movzx esi, byte [rsp + rax + 0x25]
mov edi, edx
xor edx, esi
add edx, eax
nop word [rax + rax]
cmp rdi, 9
jae 0x5a99be
movzx r8d, byte [rsp + rdi + 0x1b]
sub r8d, edx
cmp rsi, 9
jb 0x5a9947
jmp 0x5a99b2
xor eax, eax
lea rbx, [rsp + 0x1b]
mov ecx, 9
call fcn.0044a0a0
mov rbp, qword [rsp + 0x30]
add rsp, 0x38
ret
mov eax, esi
mov ecx, 9
call fcn.0045f380
mov eax, edi
mov ecx, 9
call fcn.0045f380
nop
call fcn.0045cd20
jmp fcn.005a9900
Function at 0x5aa440
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x5aa533
sub rsp, 0x30
mov qword [rsp + 0x28], rbp
lea rbp, [rsp + 0x28]
lea rax, [0x005b9900]
nop
call fcn.0040c900
movabs rcx, 0x54838146c411bf7
mov qword [rax], rcx
movabs rcx, 0x7544453856657405
mov qword [rax + 7], rcx
movabs rcx, 0x79071722504d6c61
mov qword [rax + 0xf], rcx
movabs rcx, 0x504011114060007
mov qword [rsp + 0x10], rcx
movabs rcx, 0x131107000715050c
mov qword [rsp + 0x18], rcx
movabs rcx, 0x6060d1215120b0d
mov qword [rsp + 0x20], rcx
xor ecx, ecx
jmp 0x5aa4d9
movzx r9d, byte [rsi + rax]
sub r9d, edx
lea edx, [r9 + 0x3b]
mov byte [rax + rdi], dl
lea edx, [r8 + 0x3b]
mov byte [rax + rsi], dl
add rcx, 2
cmp rcx, 0x18
jge 0x5aa508
movzx edx, byte [rsp + rcx + 0x10]
movzx esi, byte [rsp + rcx + 0x11]
mov edi, edx
xor edx, esi
add edx, ecx
cmp rdi, 0x17
jae 0x5aa526
movzx r8d, byte [rdi + rax]
sub r8d, edx
nop dword [rax]
cmp rsi, 0x17
jb 0x5aa4bf
jmp 0x5aa51a
mov ebx, 0x17
mov rcx, rbx
mov rbp, qword [rsp + 0x28]
add rsp, 0x30
ret
mov eax, esi
mov ecx, 0x17
call fcn.0045f380
mov eax, edi
mov ecx, 0x17
call fcn.0045f380
nop
call fcn.0045cd20
jmp fcn.005aa440

Function at 0x5aa8c0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x5aa9b3
sub rsp, 0x30
mov qword [rsp + 0x28], rbp
lea rbp, [rsp + 0x28]
lea rax, [0x005b9660]
nop
call fcn.0040c900
movabs rcx, 0x5cc965b745c0c045
mov qword [rax], rcx
movabs rcx, 0x575cc965b745c0c0
mov qword [rax + 1], rcx
movabs rcx, 0x6cc88facb9d79908
mov qword [rax + 9], rcx
movabs rcx, 0xd070c0e0d0d0d0e
mov qword [rsp + 0x12], rcx
movabs rcx, 0xc040d0901070d07
mov qword [rsp + 0x18], rcx
movabs rcx, 0x40b090f06020d0a
mov qword [rsp + 0x20], rcx
xor ecx, ecx
jmp 0x5aa959
movzx r9d, byte [rsi + rax]
sub r9d, edx
lea edx, [r9 - 0x3e]
mov byte [rax + rdi], dl
lea edx, [r8 - 0x3e]
mov byte [rax + rsi], dl
add rcx, 2
cmp rcx, 0x16
jge 0x5aa988
movzx edx, byte [rsp + rcx + 0x12]
movzx esi, byte [rsp + rcx + 0x13]
mov edi, edx
xor edx, esi
add edx, ecx
cmp rdi, 0x11
jae 0x5aa9a6
movzx r8d, byte [rdi + rax]
sub r8d, edx
nop dword [rax]
cmp rsi, 0x11
jb 0x5aa93f
jmp 0x5aa99a
mov ebx, 0x11
mov rcx, rbx
mov rbp, qword [rsp + 0x28]
add rsp, 0x30
ret
mov eax, esi
mov ecx, 0x11
call fcn.0045f380
mov eax, edi
mov ecx, 0x11
call fcn.0045f380
nop
call fcn.0045cd20
jmp fcn.005aa8c0
Function at 0x5ac580
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x5ac6a8
sub rsp, 0x60
mov qword [rsp + 0x58], rbp
lea rbp, [rsp + 0x58]
movabs rdx, 0x6f166e4c1b134e43
mov qword [rsp + 0x19], rdx
movabs rdx, 0x43304079495c233d
mov qword [rsp + 0x21], rdx
movabs rdx, 0x6e08483f4c433040
mov qword [rsp + 0x26], rdx
movabs rdx, 0xd7656448654d574d
mov qword [rsp + 0x2e], rdx
movabs rdx, 0x113131c0b04190f
mov qword [rsp + 0x36], rdx
movabs rdx, 0x2100113131c0b04
mov qword [rsp + 0x38], rdx
movabs rdx, 0x11031b180816170f
mov qword [rsp + 0x40], rdx
movabs rdx, 0x190e1c0110090612
mov qword [rsp + 0x48], rdx
movabs rdx, 0x9041516191c0d10
mov qword [rsp + 0x50], rdx
xor eax, eax
jmp 0x5ac640
movzx r9d, byte [rsp + rsi + 0x19]
add r9d, 0xfffffff6
add edx, r9d
mov byte [rsp + rdi + 0x19], dl
mov byte [rsp + rsi + 0x19], r8b
add rax, 2
nop dword [rax]
cmp rax, 0x22
jge 0x5ac671
movzx edx, byte [rsp + rax + 0x36]
movzx esi, byte [rsp + rax + 0x37]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x1d
jae 0x5ac69b
movzx r8d, byte [rsp + rdi + 0x19]
add r8d, 0xfffffff6
add r8d, edx
cmp rsi, 0x1d
jb 0x5ac623
jmp 0x5ac68f
xor eax, eax
lea rbx, [rsp + 0x19]
mov ecx, 0x1d
nop dword [rax]
call fcn.0044a0a0
mov rbp, qword [rsp + 0x58]
add rsp, 0x60
ret
mov eax, esi
mov ecx, 0x1d
call fcn.0045f380
mov eax, edi
mov ecx, 0x1d
call fcn.0045f380
nop
call fcn.0045cd20
jmp fcn.005ac580
Function at 0x140006170
Capabilities:
Allocate thread local storage

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x40
call qword [sym.imp.KERNEL32.dll_TlsAlloc]
mov edi, eax
cmp eax, 0xffffffff
jne 0x1400061ff
mov qword [rsp + 0x50], rsi
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rdx, qword [0x1401c1020]
lea rsi, [0x1401c1018]
mov ebx, eax
mov dword [rsp + 0x24], 0
movabs rax, 0x4d54ee85da812030
add rdx, rax
cmp rdx, 1
jbe 0x1400061d2
mov rcx, qword [0x1401c1018]
mov edx, ebx
mov r8, qword [rcx + 0x30]
mov rcx, rsi
call r8
jmp 0x1400061d7
test ebx, ebx
setne al
movzx eax, al
add rax, 2
mov qword [rsp + 0x28], rsi
mov rsi, qword [rsp + 0x50]
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x20], ebx
test al, 1
je 0x1400061ff
cmp rax, 1
jne 0x14000620c
test ebx, ebx
jne 0x14000620c
mov rbx, qword [rsp + 0x58]
mov eax, edi
add rsp, 0x40
pop rdi
ret
lea rdx, [0x140173c0c]
lea rcx, [rsp + 0x20]
call fcn.140004d40
int3
Function at 0x140007c00
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x40
mov r12, r9
mov rdi, r8
mov rbx, rdx
mov r14, rcx
xor eax, eax
lock xadd dword [rcx + 0x3c], eax
test eax, eax
je 0x140007c3c
xor eax, eax
jmp 0x140007e12
lea r13, [rcx + 0x60]
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
xor edx, edx
mov r15d, edx
mov esi, edx
mov ebp, edx
cmp qword [rdi + 0x20], rdx
jne 0x140007c62
cmp rdi, qword [rbx + 0x10]
jne 0x140007d45
movabs r14, 0x4d54ee85da812030
lea r13, [0x1401c1018]
cmp rbp, r12
je 0x140007d23
mov rbx, qword [rdi]
test rbx, rbx
je 0x140007d23
mov dword [rsp + 0x24], edx
mov rcx, qword [0x1401c1020]
add rcx, r14
cmp rcx, 1
jbe 0x140007cb2
mov rax, qword [0x1401c1018]
mov edx, 0x3e3
mov rcx, r13
call qword [rax + 0x30]
xor edx, edx
jmp 0x140007cb4
mov al, 1
movzx eax, al
add rax, 2
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x20], 0x3e3
mov qword [rsp + 0x28], r13
movups xmm0, xmmword [rsp + 0x20]
movups xmmword [rbx + 0x38], xmm0
movsd xmm1, qword [rsp + 0x30]
movsd qword [rbx + 0x48], xmm1
mov rcx, qword [rdi]
test rcx, rcx
je 0x140007cfd
mov rax, qword [rcx + 0x20]
mov qword [rdi], rax
test rax, rax
jne 0x140007cf9
mov qword [rdi + 8], rdx
mov qword [rcx + 0x20], rdx
mov qword [rbx + 0x20], rdx
test rsi, rsi
je 0x140007d15
mov qword [rsi + 0x20], rbx
inc rbp
mov rsi, rbx
jmp 0x140007c73
mov r15, rbx
inc rbp
mov rsi, rbx
jmp 0x140007c73
cmp qword [rdi], 0
mov r14, qword [rsp + 0x80]
lea r13, [r14 + 0x60]
jne 0x140007d45
mov rdx, rdi
mov rcx, qword [rsp + 0x88]
call fcn.14000b0b0
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov rbx, r15
test r15, r15
je 0x140007e0f
mov rdi, r15
mov r12d, 1
nop dword [rax]
nop word [rax + rax]
mov rcx, qword [r15 + 0x20]
mov r15, rcx
mov qword [rdi + 0x20], 0
mov rdi, rcx
xor eax, eax
test rcx, rcx
cmovne rax, rsi
mov rsi, rax
mov dword [rbx + 0x30], r12d
mov r9, rbx
xor r8d, r8d
xor edx, edx
mov rcx, qword [r14 + 0x28]
call qword [sym.imp.KERNEL32.dll_PostQueuedCompletionStatus]
test eax, eax
je 0x140007db2
mov rbx, rdi
test rdi, rdi
je 0x140007e0f
jmp 0x140007d70
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov qword [rbx + 0x20], 0
mov rax, qword [r14 + 0x98]
test rax, rax
je 0x140007dd5
mov qword [rax + 0x20], rbx
jmp 0x140007ddc
mov qword [r14 + 0x90], rbx
mov qword [r14 + 0x98], rbx
test r15, r15
je 0x140007e01
test rbx, rbx
je 0x140007df3
mov qword [rbx + 0x20], r15
jmp 0x140007dfa
mov qword [r14 + 0x90], r15
mov qword [r14 + 0x98], rsi
xchg dword [r14 + 0x58], r12d
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
nop
mov rax, rbp
mov rbx, qword [rsp + 0x90]
add rsp, 0x40
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x140009870
Capabilities:
Set socket configuration

Disassembly:
push rbp
push rsi
push rdi
push r12
push r15
mov rbp, rsp
sub rsp, 0x80
xor r12d, r12d
mov r15, r9
mov rsi, rdx
mov rdi, rcx
cmp rcx, 0xffffffffffffffff
je 0x140009a57
mov qword [rsp + 0xb8], rbx
test r8b, r8b
je 0x1400098ea
movzx eax, byte [rdx]
test al, 8
je 0x1400098ea
or al, 8
mov dword [rbp + 0x30], r12d
mov byte [rdx], al
lea r9, [rbp + 0x30]
xorps xmm0, xmm0
mov qword [rbp - 0x40], r12
mov edx, 0xffff
mov dword [rsp + 0x20], 4
mov r8d, 0x80
movups xmmword [rbp - 0x50], xmm0
call qword [sym.imp.WS2_32.dll_setsockopt]
test eax, eax
lea rcx, [rbp - 0x50]
setne dl
call fcn.14000a290
mov rcx, rdi
call qword [sym.imp.WS2_32.dll_closesocket]
test eax, eax
mov rcx, r15
mov ebx, eax
setne dl
call fcn.14000a290
test ebx, ebx
je 0x140009a53
mov qword [rsp + 0xc0], r13
movabs rcx, 0x4d54ee85da812030
mov qword [rsp + 0xc8], r14
lea r13, [0x1401c1018]
mov r14, qword [0x1401c1020]
add rcx, r14
mov dword [rbp - 0x4c], r12d
cmp rcx, 1
jbe 0x14000995a
mov rax, qword [0x1401c1018]
mov edx, 0x2733
mov rcx, r13
call qword [rax + 0x30]
mov r14, qword [0x1401c1020]
jmp 0x14000995c
mov al, 1
movzx eax, al
lea rdx, [rbp - 0x38]
add rax, 2
mov dword [rbp - 0x50], 0x2733
mov qword [rbp - 0x40], rax
mov rcx, r15
movsd xmm1, qword [rbp - 0x40]
mov qword [rbp - 0x48], r13
movups xmm0, xmmword [rbp - 0x50]
movsd qword [rbp - 0x28], xmm1
movups xmmword [rbp - 0x38], xmm0
call fcn.140008770
test al, al
jne 0x1400099f9
movabs rax, 0x4d54ee85da812030
mov dword [rbp - 0x4c], r12d
add rax, r14
cmp rax, 1
jbe 0x1400099bf
mov rax, qword [0x1401c1018]
mov edx, 0x4d5
mov rcx, r13
call qword [rax + 0x30]
jmp 0x1400099c1
mov al, 1
movzx eax, al
lea rdx, [rbp - 0x20]
add rax, 2
mov dword [rbp - 0x50], 0x4d5
mov qword [rbp - 0x40], rax
mov rcx, r15
movsd xmm1, qword [rbp - 0x40]
mov qword [rbp - 0x48], r13
movups xmm0, xmmword [rbp - 0x50]
movsd qword [rbp - 0x10], xmm1
movups xmmword [rbp - 0x20], xmm0
call fcn.140008770
test al, al
je 0x140009a2a
lea r8, [rbp + 0x30]
mov dword [rbp + 0x30], r12d
mov edx, 0x8004667e
mov rcx, rdi
call qword [sym.imp.WS2_32.dll_ioctlsocket]
and byte [rsi], 0xfc
mov rcx, rdi
call qword [sym.imp.WS2_32.dll_closesocket]
test eax, eax
mov rcx, r15
mov ebx, eax
setne dl
call fcn.14000a290
mov r13, qword [rsp + 0xc0]
mov eax, ebx
mov r14, qword [rsp + 0xc8]
mov rbx, qword [rsp + 0xb8]
add rsp, 0x80
pop r15
pop r12
pop rdi
pop rsi
pop rbp
ret
mov eax, ebx
jmp 0x140009a3c
mov eax, r12d
add rsp, 0x80
pop r15
pop r12
pop rdi
pop rsi
pop rbp
ret