joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4ee3e0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4ee4db
push rbp
mov rbp, rsp
sub rsp, 0x48
movabs rdx, 0x130a030c0a100a12
mov qword [rsp + 0x18], rdx
movabs rdx, 0x710040a01060504
mov qword [rsp + 0x20], rdx
movabs rdx, 0xb0f050a0710040a
mov qword [rsp + 0x24], rdx
movabs rdx, 0x10f03100601060c
mov qword [rsp + 0x2c], rdx
movabs rdx, 0xbfd813d72972d062
mov qword [rsp + 0x34], rdx
movabs rdx, 0xbb9f6d69bfd813d7
mov qword [rsp + 0x38], rdx
movabs rdx, 0xcdfa64c7a9657686
mov qword [rsp + 0x40], rdx
xor eax, eax
jmp 0x4ee479
movzx r9d, byte [rsp + rsi + 0x34]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x4b]
mov byte [rsp + rdi + 0x34], dl
mov byte [rsp + rsi + 0x34], r8b
add rax, 2
cmp rax, 0x1c
jge 0x4ee4ab
movzx edx, byte [rsp + rax + 0x18]
movzx esi, byte [rsp + rax + 0x19]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x14
jae 0x4ee4ce
movzx r8d, byte [rsp + rdi + 0x34]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x4b]
cmp rsi, 0x14
jb 0x4ee45f
jmp 0x4ee4c2
xor eax, eax
lea rbx, [rsp + 0x34]
mov ecx, 0x14
call fcn.0044d280
add rsp, 0x48
pop rbp
ret
mov eax, esi
mov ecx, 0x14
call fcn.00462ca0
mov eax, edi
mov ecx, 0x14
call fcn.00462ca0
nop
nop dword [rax + rax]
call fcn.004609c0
jmp fcn.004ee3e0

Function at 0x4eec00
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4eecbd
push rbp
mov rbp, rsp
sub rsp, 0x30
movabs rdx, 0x301070300050702
mov qword [rsp + 0x1d], rdx
mov word [rsp + 0x25], 0x805
movabs rdx, 0xb764c869c57bc92a
mov qword [rsp + 0x27], rdx
mov byte [rsp + 0x2f], 0x94
xor eax, eax
nop
jmp 0x4eec60
movzx r9d, byte [rsp + rsi + 0x27]
sub r9d, edx
lea edx, [r9 - 0x51]
mov byte [rsp + rdi + 0x27], dl
lea edx, [r8 - 0x51]
mov byte [rsp + rsi + 0x27], dl
add rax, 2
nop
cmp rax, 0xa
jge 0x4eec8d
movzx edx, byte [rsp + rax + 0x1d]
movzx esi, byte [rsp + rax + 0x1e]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 9
jae 0x4eecb0
movzx r8d, byte [rsp + rdi + 0x27]
sub r8d, edx
cmp rsi, 9
jb 0x4eec42
jmp 0x4eeca4
xor eax, eax
lea rbx, [rsp + 0x27]
mov ecx, 9
call fcn.0044d280
add rsp, 0x30
pop rbp
ret
mov eax, esi
mov ecx, 9
call fcn.00462ca0
mov eax, edi
mov ecx, 9
call fcn.00462ca0
nop
nop dword [rax]
call fcn.004609c0
jmp fcn.004eec00
Function at 0x4efac0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4efbbd
push rbp
mov rbp, rsp
sub rsp, 0x48
movabs rdx, 0x13030a070a1407
mov qword [rsp + 0x19], rdx
movabs rdx, 0x131302140f031110
mov qword [rsp + 0x21], rdx
movabs rdx, 0x314131302140f03
mov qword [rsp + 0x23], rdx
movabs rdx, 0x40c03130412010f
mov qword [rsp + 0x2b], rdx
movabs rdx, 0xfe5070cca35ba33f
mov qword [rsp + 0x33], rdx
movabs rdx, 0xc26cae7669fe5070
mov qword [rsp + 0x38], rdx
movabs rdx, 0xb5920997a2ee6567
mov qword [rsp + 0x40], rdx
xor eax, eax
jmp 0x4efb60
movzx r9d, byte [rsp + rsi + 0x33]
sub r9d, edx
lea edx, [r9 - 0x2d]
mov byte [rsp + rdi + 0x33], dl
lea edx, [r8 - 0x2d]
mov byte [rsp + rsi + 0x33], dl
add rax, 2
nop dword [rax]
cmp rax, 0x1a
jge 0x4efb8d
movzx edx, byte [rsp + rax + 0x19]
movzx esi, byte [rsp + rax + 0x1a]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x15
jae 0x4efbb0
movzx r8d, byte [rsp + rdi + 0x33]
sub r8d, edx
cmp rsi, 0x15
jb 0x4efb3f
jmp 0x4efba4
xor eax, eax
lea rbx, [rsp + 0x33]
mov ecx, 0x15
call fcn.0044d280
add rsp, 0x48
pop rbp
ret
mov eax, esi
mov ecx, 0x15
call fcn.00462ca0
mov eax, edi
mov ecx, 0x15
call fcn.00462ca0
nop
nop dword [rax]
call fcn.004609c0
jmp fcn.004efac0

Function at 0x4efbe0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4efcc6
push rbp
mov rbp, rsp
sub rsp, 0x40
movabs rdx, 0x107030b03070b09
mov qword [rsp + 0x1e], rdx
movabs rdx, 0x50307080107030b
mov qword [rsp + 0x22], rdx
movabs rdx, 0x1090004060a0a0a
mov qword [rsp + 0x2a], rdx
movabs rdx, 0x775f704d6b656f51
mov qword [rsp + 0x32], rdx
movabs rdx, 0x5772784b5b5c775f
mov qword [rsp + 0x38], rdx
xor eax, eax
nop
jmp 0x4efc60
movzx r9d, byte [rsp + rsi + 0x32]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x12]
mov byte [rsp + rdi + 0x32], dl
mov byte [rsp + rsi + 0x32], r8b
add rax, 2
nop dword [rax]
cmp rax, 0x14
jge 0x4efc92
movzx edx, byte [rsp + rax + 0x1e]
movzx esi, byte [rsp + rax + 0x1f]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0xe
jae 0x4efcb7
movzx r8d, byte [rsp + rdi + 0x32]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x12]
cmp rsi, 0xe
jb 0x4efc42
jmp 0x4efcab
xor eax, eax
lea rbx, [rsp + 0x32]
mov ecx, 0xe
nop
call fcn.0044d280
add rsp, 0x40
pop rbp
ret
mov eax, esi
mov ecx, 0xe
call fcn.00462ca0
mov eax, edi
mov ecx, 0xe
nop
call fcn.00462ca0
nop
call fcn.004609c0
jmp fcn.004efbe0
Function at 0x4f1460
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4f154a
push rbp
mov rbp, rsp
sub rsp, 0x40
movabs rdx, 0x110d01090f05000e
mov qword [rsp + 0x18], rdx
movabs rdx, 0x10d100b070e110d
mov qword [rsp + 0x1e], rdx
movabs rdx, 0xb07020106040606
mov qword [rsp + 0x26], rdx
movabs rdx, 0x483b4f5d4d50282d
mov qword [rsp + 0x2e], rdx
movabs rdx, 0x1e65483b4f5d4d50
mov qword [rsp + 0x30], rdx
movabs rdx, 0x455d462b4f656069
mov qword [rsp + 0x38], rdx
xor eax, eax
jmp 0x4f14ed
movzx r9d, byte [rsp + rsi + 0x2e]
sub r9d, edx
lea edx, [r9 + 0x2a]
mov byte [rsp + rdi + 0x2e], dl
lea edx, [r8 + 0x2a]
mov byte [rsp + rsi + 0x2e], dl
add rax, 2
cmp rax, 0x16
jge 0x4f151a
movzx edx, byte [rsp + rax + 0x18]
movzx esi, byte [rsp + rax + 0x19]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x12
jae 0x4f153d
movzx r8d, byte [rsp + rdi + 0x2e]
sub r8d, edx
cmp rsi, 0x12
jb 0x4f14d0
jmp 0x4f1531
xor eax, eax
lea rbx, [rsp + 0x2e]
mov ecx, 0x12
call fcn.0044d280
add rsp, 0x40
pop rbp
ret
mov eax, esi
mov ecx, 0x12
call fcn.00462ca0
mov eax, edi
mov ecx, 0x12
call fcn.00462ca0
nop
call fcn.004609c0
jmp fcn.004f1460

Function at 0x4f28e0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4f29a6
push rbp
mov rbp, rsp
sub rsp, 0x30
movabs rdx, 0x404040307070607
mov qword [rsp + 0x19], rdx
mov dword [rsp + 0x21], 0x805050a
movabs rdx, 0xf972d5d06774654e
mov qword [rsp + 0x25], rdx
mov dword [rsp + 0x2c], 0x2364d2f9
xor eax, eax
jmp 0x4f2940
movzx r9d, byte [rsp + rsi + 0x25]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x78]
mov byte [rsp + rdi + 0x25], dl
mov byte [rsp + rsi + 0x25], r8b
add rax, 2
nop
cmp rax, 0xc
jge 0x4f2972
movzx edx, byte [rsp + rax + 0x19]
movzx esi, byte [rsp + rax + 0x1a]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0xb
jae 0x4f2997
movzx r8d, byte [rsp + rdi + 0x25]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x78]
cmp rsi, 0xb
jb 0x4f2924
jmp 0x4f298b
xor eax, eax
lea rbx, [rsp + 0x25]
mov ecx, 0xb
nop
call fcn.0044d280
add rsp, 0x30
pop rbp
ret
mov eax, esi
mov ecx, 0xb
call fcn.00462ca0
mov eax, edi
mov ecx, 0xb
nop
call fcn.00462ca0
nop
call fcn.004609c0
jmp fcn.004f28e0
Function at 0x4f7d80
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4f7e8c
push rbp
mov rbp, rsp
sub rsp, 0x50
movabs rdx, 0x4180d0312040e10
mov qword [rsp + 0x1d], rdx
movabs rdx, 0x110b0e0d09110c0f
mov qword [rsp + 0x25], rdx
movabs rdx, 0x130b110b0e0d0911
mov qword [rsp + 0x27], rdx
movabs rdx, 0x302010605121211
mov qword [rsp + 0x2f], rdx
movabs rdx, 0x733620cb183b3169
mov qword [rsp + 0x37], rdx
movabs rdx, 0xfa330246ba6ea174
mov qword [rsp + 0x3f], rdx
movabs rdx, 0xdfa330246ba6ea1
mov qword [rsp + 0x40], rdx
movabs rdx, 0x316574754d310828
mov qword [rsp + 0x48], rdx
xor eax, eax
jmp 0x4f7e28
movzx r9d, byte [rsp + rsi + 0x37]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x1b]
mov byte [rsp + rdi + 0x37], dl
mov byte [rsp + rsi + 0x37], r8b
add rax, 2
cmp rax, 0x1a
jge 0x4f7e5c
movzx edx, byte [rsp + rax + 0x1d]
movzx esi, byte [rsp + rax + 0x1e]
mov edi, edx
xor edx, esi
add edx, eax
nop
cmp rdi, 0x19
jae 0x4f7e7f
movzx r8d, byte [rsp + rdi + 0x37]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x1b]
cmp rsi, 0x19
jb 0x4f7e0e
jmp 0x4f7e73
xor eax, eax
lea rbx, [rsp + 0x37]
mov ecx, 0x19
call fcn.0044d280
add rsp, 0x50
pop rbp
ret
mov eax, esi
mov ecx, 0x19
call fcn.00462ca0
mov eax, edi
mov ecx, 0x19
call fcn.00462ca0
nop
call fcn.004609c0
jmp fcn.004f7d80

Function at 0x5057a0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x50585e
push rbp
mov rbp, rsp
sub rsp, 0x30
movabs rdx, 0x4000a08000a0a08
mov qword [rsp + 0x19], rdx
mov dword [rsp + 0x21], 0xa020205
movabs rdx, 0x5250e87e42a221f5
mov qword [rsp + 0x25], rdx
mov dword [rsp + 0x2c], 0x2f434652
xor eax, eax
jmp 0x505801
movzx r9d, byte [rsp + rsi + 0x25]
sub r9d, edx
lea edx, [r9 - 0x4f]
mov byte [rsp + rdi + 0x25], dl
lea edx, [r8 - 0x4f]
mov byte [rsp + rsi + 0x25], dl
add rax, 2
cmp rax, 0xc
jge 0x50582e
movzx edx, byte [rsp + rax + 0x19]
movzx esi, byte [rsp + rax + 0x1a]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0xb
jae 0x505851
movzx r8d, byte [rsp + rdi + 0x25]
sub r8d, edx
cmp rsi, 0xb
jb 0x5057e4
jmp 0x505845
xor eax, eax
lea rbx, [rsp + 0x25]
mov ecx, 0xb
call fcn.0044d280
add rsp, 0x30
pop rbp
ret
mov eax, esi
mov ecx, 0xb
call fcn.00462ca0
mov eax, edi
mov ecx, 0xb
call fcn.00462ca0
nop
nop
call fcn.004609c0
jmp fcn.005057a0
Function at 0x505ae0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x505ba6
push rbp
mov rbp, rsp
sub rsp, 0x30
movabs rdx, 0x102070605010800
mov qword [rsp + 0x1b], rdx
mov dword [rsp + 0x23], 0x1010305
movabs rdx, 0x140dd05306d0d5ec
mov qword [rsp + 0x27], rdx
mov byte [rsp + 0x2f], 0xeb
xor eax, eax
nop
jmp 0x505b40
movzx r9d, byte [rsp + rsi + 0x27]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x35]
mov byte [rsp + rdi + 0x27], dl
mov byte [rsp + rsi + 0x27], r8b
add rax, 2
nop dword [rax]
cmp rax, 0xc
jge 0x505b72
movzx edx, byte [rsp + rax + 0x1b]
movzx esi, byte [rsp + rax + 0x1c]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 9
jae 0x505b97
movzx r8d, byte [rsp + rdi + 0x27]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x35]
cmp rsi, 9
jb 0x505b22
jmp 0x505b8b
xor eax, eax
lea rbx, [rsp + 0x27]
mov ecx, 9
nop
call fcn.0044d280
add rsp, 0x30
pop rbp
ret
mov eax, esi
mov ecx, 9
call fcn.00462ca0
mov eax, edi
mov ecx, 9
nop
call fcn.00462ca0
nop
call fcn.004609c0
jmp fcn.00505ae0

Function at 0x505e20
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x505f28
push rbp
mov rbp, rsp
sub rsp, 0x58
movabs rdx, 0xd0c110d110a0d13
mov qword [rsp + 0x1f], rdx
movabs rdx, 0x1130d0c110d110a
mov qword [rsp + 0x21], rdx
movabs rdx, 0x12060506080d0414
mov qword [rsp + 0x29], rdx
movabs rdx, 0xb0104000c0d0812
mov qword [rsp + 0x31], rdx
movabs rdx, 0x409070e0511120c
mov qword [rsp + 0x39], rdx
movabs rdx, 0xf66fc5fb766ef291
mov qword [rsp + 0x41], rdx
movabs rdx, 0xf70498f76efa03f6
mov qword [rsp + 0x48], rdx
movabs rdx, 0x3e65481ef9ee2e74
mov qword [rsp + 0x50], rdx
xor eax, eax
jmp 0x505ecb
movzx r9d, byte [rsp + rsi + 0x41]
sub r9d, edx
lea edx, [r9 - 0x6c]
mov byte [rsp + rdi + 0x41], dl
lea edx, [r8 - 0x6c]
mov byte [rsp + rsi + 0x41], dl
add rax, 2
cmp rax, 0x22
jge 0x505ef8
movzx edx, byte [rsp + rax + 0x1f]
movzx esi, byte [rsp + rax + 0x20]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x17
jae 0x505f1b
movzx r8d, byte [rsp + rdi + 0x41]
sub r8d, edx
cmp rsi, 0x17
jb 0x505eae
jmp 0x505f0f
xor eax, eax
lea rbx, [rsp + 0x41]
mov ecx, 0x17
call fcn.0044d280
add rsp, 0x58
pop rbp
ret
mov eax, esi
mov ecx, 0x17
call fcn.00462ca0
mov eax, edi
mov ecx, 0x17
call fcn.00462ca0
nop
call fcn.004609c0
jmp fcn.00505e20
Function at 0x506180
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x50623d
push rbp
mov rbp, rsp
sub rsp, 0x30
movabs rdx, 0x308070004000401
mov qword [rsp + 0x1d], rdx
mov word [rsp + 0x25], 0x806
movabs rdx, 0xaeb96ff59165d9f1
mov qword [rsp + 0x27], rdx
mov byte [rsp + 0x2f], 8
xor eax, eax
nop
jmp 0x5061e0
movzx r9d, byte [rsp + rsi + 0x27]
sub r9d, edx
lea edx, [r9 + 0x7d]
mov byte [rsp + rdi + 0x27], dl
lea edx, [r8 + 0x7d]
mov byte [rsp + rsi + 0x27], dl
add rax, 2
nop
cmp rax, 0xa
jge 0x50620d
movzx edx, byte [rsp + rax + 0x1d]
movzx esi, byte [rsp + rax + 0x1e]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 9
jae 0x506230
movzx r8d, byte [rsp + rdi + 0x27]
sub r8d, edx
cmp rsi, 9
jb 0x5061c2
jmp 0x506224
xor eax, eax
lea rbx, [rsp + 0x27]
mov ecx, 9
call fcn.0044d280
add rsp, 0x30
pop rbp
ret
mov eax, esi
mov ecx, 9
call fcn.00462ca0
mov eax, edi
mov ecx, 9
call fcn.00462ca0
nop
nop dword [rax]
call fcn.004609c0
jmp fcn.00506180

Function at 0x506260
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x50634c
push rbp
mov rbp, rsp
sub rsp, 0x48
movabs rdx, 0x500020f0603010e
mov qword [rsp + 0x1f], rdx
movabs rdx, 0x50c1004040c0200
mov qword [rsp + 0x27], rdx
movabs rdx, 0x80007090f0f0102
mov qword [rsp + 0x2f], rdx
movabs rdx, 0x162b060a2e41553f
mov qword [rsp + 0x37], rdx
movabs rdx, 0x11162b060a2e4155
mov qword [rsp + 0x38], rdx
movabs rdx, 0x13fc0e6444626114
mov qword [rsp + 0x40], rdx
xor eax, eax
jmp 0x5062ea
movzx r9d, byte [rsp + rsi + 0x37]
lea edx, [r9 + rdx]
lea edx, [rdx + 1]
mov byte [rsp + rdi + 0x37], dl
mov byte [rsp + rsi + 0x37], r8b
add rax, 2
cmp rax, 0x18
jge 0x50631c
movzx edx, byte [rsp + rax + 0x1f]
movzx esi, byte [rsp + rax + 0x20]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x11
jae 0x50633f
movzx r8d, byte [rsp + rdi + 0x37]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 1]
cmp rsi, 0x11
jb 0x5062d0
jmp 0x506333
xor eax, eax
lea rbx, [rsp + 0x37]
mov ecx, 0x11
call fcn.0044d280
add rsp, 0x48
pop rbp
ret
mov eax, esi
mov ecx, 0x11
call fcn.00462ca0
mov eax, edi
mov ecx, 0x11
call fcn.00462ca0
nop
call fcn.004609c0
jmp fcn.00506260
Function at 0x506900
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x5069ec
push rbp
mov rbp, rsp
sub rsp, 0x48
movabs rdx, 0xa0e040502090808
mov qword [rsp + 0x1f], rdx
movabs rdx, 0x60f07080a0f0f
mov qword [rsp + 0x27], rdx
movabs rdx, 0xa0b0e0d0f10020c
mov qword [rsp + 0x2f], rdx
movabs rdx, 0xa163767733733169
mov qword [rsp + 0x37], rdx
movabs rdx, 0xf4a1637677337331
mov qword [rsp + 0x38], rdx
movabs rdx, 0x5ca9b0755b71b1a6
mov qword [rsp + 0x40], rdx
xor eax, eax
jmp 0x50698a
movzx r9d, byte [rsp + rsi + 0x37]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x47]
mov byte [rsp + rdi + 0x37], dl
mov byte [rsp + rsi + 0x37], r8b
add rax, 2
cmp rax, 0x18
jge 0x5069bc
movzx edx, byte [rsp + rax + 0x1f]
movzx esi, byte [rsp + rax + 0x20]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x11
jae 0x5069df
movzx r8d, byte [rsp + rdi + 0x37]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x47]
cmp rsi, 0x11
jb 0x506970
jmp 0x5069d3
xor eax, eax
lea rbx, [rsp + 0x37]
mov ecx, 0x11
call fcn.0044d280
add rsp, 0x48
pop rbp
ret
mov eax, esi
mov ecx, 0x11
call fcn.00462ca0
mov eax, edi
mov ecx, 0x11
call fcn.00462ca0
nop
call fcn.004609c0
jmp fcn.00506900

Function at 0x506a00
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x506aea
push rbp
mov rbp, rsp
sub rsp, 0x40
movabs rdx, 0x6070603010f040f
mov qword [rsp + 0x1b], rdx
movabs rdx, 0x2030d0006070603
mov qword [rsp + 0x1f], rdx
movabs rdx, 0x10050c0b09030d10
mov qword [rsp + 0x27], rdx
movabs rdx, 0xeca44eaaa5ba25a7
mov qword [rsp + 0x2f], rdx
movabs rdx, 0x38eca44eaaa5ba25
mov qword [rsp + 0x30], rdx
movabs rdx, 0x3cee65f4282961fa
mov qword [rsp + 0x38], rdx
xor eax, eax
jmp 0x506a8d
movzx r9d, byte [rsp + rsi + 0x2f]
sub r9d, edx
lea edx, [r9 + 0x51]
mov byte [rsp + rdi + 0x2f], dl
lea edx, [r8 + 0x51]
mov byte [rsp + rsi + 0x2f], dl
add rax, 2
cmp rax, 0x14
jge 0x506aba
movzx edx, byte [rsp + rax + 0x1b]
movzx esi, byte [rsp + rax + 0x1c]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x11
jae 0x506add
movzx r8d, byte [rsp + rdi + 0x2f]
sub r8d, edx
cmp rsi, 0x11
jb 0x506a70
jmp 0x506ad1
xor eax, eax
lea rbx, [rsp + 0x2f]
mov ecx, 0x11
call fcn.0044d280
add rsp, 0x40
pop rbp
ret
mov eax, esi
mov ecx, 0x11
call fcn.00462ca0
mov eax, edi
mov ecx, 0x11
call fcn.00462ca0
nop
call fcn.004609c0
jmp fcn.00506a00
Function at 0x506b00
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x506bec
push rbp
mov rbp, rsp
sub rsp, 0x40
movabs rdx, 0x907100402010a0c
mov qword [rsp + 0x19], rdx
movabs rdx, 0x100f000609060907
mov qword [rsp + 0x1f], rdx
movabs rdx, 0x20d030c0e070e0c
mov qword [rsp + 0x27], rdx
movabs rdx, 0xc2113501311b1a15
mov qword [rsp + 0x2f], rdx
movabs rdx, 0x38c2113501311b1a
mov qword [rsp + 0x30], rdx
movabs rdx, 0xb3ce0fe4a62d516
mov qword [rsp + 0x38], rdx
xor eax, eax
jmp 0x506b8a
movzx r9d, byte [rsp + rsi + 0x2f]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x11]
mov byte [rsp + rdi + 0x2f], dl
mov byte [rsp + rsi + 0x2f], r8b
add rax, 2
cmp rax, 0x16
jge 0x506bbc
movzx edx, byte [rsp + rax + 0x19]
movzx esi, byte [rsp + rax + 0x1a]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x11
jae 0x506bdf
movzx r8d, byte [rsp + rdi + 0x2f]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x11]
cmp rsi, 0x11
jb 0x506b70
jmp 0x506bd3
xor eax, eax
lea rbx, [rsp + 0x2f]
mov ecx, 0x11
call fcn.0044d280
add rsp, 0x40
pop rbp
ret
mov eax, esi
mov ecx, 0x11
call fcn.00462ca0
mov eax, edi
mov ecx, 0x11
call fcn.00462ca0
nop
call fcn.004609c0
jmp fcn.00506b00

Function at 0x506c00
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x506cec
push rbp
mov rbp, rsp
sub rsp, 0x40
movabs rdx, 0xe10060410040a0f
mov qword [rsp + 0x19], rdx
movabs rdx, 0xc01040409060e10
mov qword [rsp + 0x1f], rdx
movabs rdx, 0x3010a0f09000a0f
mov qword [rsp + 0x27], rdx
movabs rdx, 0x3796359dd43203d9
mov qword [rsp + 0x2f], rdx
movabs rdx, 0x383796359dd43203
mov qword [rsp + 0x30], rdx
movabs rdx, 0xc85d0d64766262d8
mov qword [rsp + 0x38], rdx
xor eax, eax
jmp 0x506c8a
movzx r9d, byte [rsp + rsi + 0x2f]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x47]
mov byte [rsp + rdi + 0x2f], dl
mov byte [rsp + rsi + 0x2f], r8b
add rax, 2
cmp rax, 0x16
jge 0x506cbc
movzx edx, byte [rsp + rax + 0x19]
movzx esi, byte [rsp + rax + 0x1a]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x11
jae 0x506cdf
movzx r8d, byte [rsp + rdi + 0x2f]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x47]
cmp rsi, 0x11
jb 0x506c70
jmp 0x506cd3
xor eax, eax
lea rbx, [rsp + 0x2f]
mov ecx, 0x11
call fcn.0044d280
add rsp, 0x40
pop rbp
ret
mov eax, esi
mov ecx, 0x11
call fcn.00462ca0
mov eax, edi
mov ecx, 0x11
call fcn.00462ca0
nop
call fcn.004609c0
jmp fcn.00506c00

Function at 0x140001be0
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140001c2a
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140001c2a
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140001c2a
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140001c2a
cmp dword [rcx + 0x84], 0xe
jbe 0x140001c2a
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140001c2c
xor al, al
add rsp, 0x28
ret
Function at 0x1c410b0
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.01c41237
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, pe_nt_image_headers64
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x1c410e1
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1c410c7
add dl, dl
jne 0x1c410ee
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1c4114e
xor eax, eax
add dl, dl
jne 0x1c410fd
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1c41205
add dl, dl
jne 0x1c4110e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1c4111b
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1c41128
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1c41135
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x1c41142
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x1c410d6
mov eax, 1
add dl, dl
jne 0x1c4115e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1c4116b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1c41153
sub eax, ebx
mov ebx, 1
jne 0x1c411a4
mov ecx, 1
add dl, dl
jne 0x1c41186
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x1c41193
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1c4117b
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x1c410d6
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x1c411c0
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x1c411cd
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1c411b5
cmp eax, 0x7d00
jae 0x1c411f3
cmp eax, 0x500
jb 0x1c411ee
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x1c410d6
cmp eax, 0x7f
ja 0x1c411f6
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x1c410d6
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x1c4122a
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x1c410d6
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x1406c1a10
Capabilities:
Decompress data using aplib

Disassembly:
call 0x1406c1b97
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x1406c1a41
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1406c1a27
add dl, dl
jne 0x1406c1a4e
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1406c1aae
xor eax, eax
add dl, dl
jne 0x1406c1a5d
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1406c1b65
add dl, dl
jne 0x1406c1a6e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1406c1a7b
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1406c1a88
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1406c1a95
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x1406c1aa2
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x1406c1a36
mov eax, 1
add dl, dl
jne 0x1406c1abe
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1406c1acb
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1406c1ab3
sub eax, ebx
mov ebx, 1
jne 0x1406c1b04
mov ecx, 1
add dl, dl
jne 0x1406c1ae6
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x1406c1af3
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1406c1adb
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x1406c1a36
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x1406c1b20
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x1406c1b2d
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1406c1b15
cmp eax, 0x7d00
jae 0x1406c1b53
cmp eax, 0x500
jb 0x1406c1b4e
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x1406c1a36
cmp eax, 0x7f
ja 0x1406c1b56
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x1406c1a36
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x1406c1b8a
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x1406c1a36
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20