joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5a4100
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x5a41fc
sub rsp, 0x48
mov qword [rsp + 0x40], rbp
lea rbp, [rsp + 0x40]
movabs rdx, 0x8e64752ecf6df043
mov qword [rsp + 0x18], rdx
movabs rdx, 0xa8698e64752ecf6d
mov qword [rsp + 0x1a], rdx
movabs rdx, 0x577667fb96950975
mov qword [rsp + 0x22], rdx
movabs rdx, 0x50d040d0e0b010b
mov qword [rsp + 0x2a], rdx
movabs rdx, 0x70a0b050909050d
mov qword [rsp + 0x30], rdx
movabs rdx, 0xb0e050c01030103
mov qword [rsp + 0x38], rdx
xor eax, eax
jmp 0x5a4190
movzx r9d, byte [rsp + rsi + 0x18]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x42]
mov byte [rsp + rdi + 0x18], dl
mov byte [rsp + rsi + 0x18], r8b
add rax, 2
cmp rax, 0x16
jge 0x5a41c8
movzx edx, byte [rsp + rax + 0x2a]
movzx esi, byte [rsp + rax + 0x2b]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x12
jae 0x5a41ef
movzx r8d, byte [rsp + rdi + 0x18]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x42]
nop word [rax + rax]
cmp rsi, 0x12
jb 0x5a4176
jmp 0x5a41e3
xor eax, eax
lea rbx, [rsp + 0x18]
mov ecx, 0x12
call fcn.0044a200
mov rbp, qword [rsp + 0x40]
add rsp, 0x48
ret
mov eax, esi
mov ecx, 0x12
call fcn.0045f5c0
mov eax, edi
mov ecx, 0x12
call fcn.0045f5c0
nop
nop dword [rax]
call fcn.0045cf60
jmp fcn.005a4100

Function at 0x5a4220
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x5a4316
sub rsp, 0x48
mov qword [rsp + 0x40], rbp
lea rbp, [rsp + 0x40]
movabs rdx, 0x4a6e0b746547334c
mov qword [rsp + 0x2c], rdx
movabs rdx, 0x6f2d481a4a6e0b74
mov qword [rsp + 0x30], rdx
movabs rdx, 0x7274275f72512533
mov qword [rsp + 0x38], rdx
movabs rdx, 0x807080d0c000d05
mov qword [rsp + 0x18], rdx
movabs rdx, 0x90e0a010807080d
mov qword [rsp + 0x1c], rdx
movabs rdx, 0x100a101108130d10
mov qword [rsp + 0x24], rdx
xor eax, eax
jmp 0x5a42b3
movzx r9d, byte [rsp + rsi + 0x2c]
sub r9d, edx
lea edx, [r9 + 0x2e]
mov byte [rsp + rdi + 0x2c], dl
lea edx, [r8 + 0x2e]
mov byte [rsp + rsi + 0x2c], dl
add rax, 2
cmp rax, 0x14
jge 0x5a42e2
movzx edx, byte [rsp + rax + 0x18]
movzx esi, byte [rsp + rax + 0x19]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x14
jae 0x5a4309
movzx r8d, byte [rsp + rdi + 0x2c]
sub r8d, edx
cmp rsi, 0x14
jb 0x5a4296
nop
jmp 0x5a42fd
xor eax, eax
lea rbx, [rsp + 0x2c]
mov ecx, 0x14
call fcn.0044a200
mov rbp, qword [rsp + 0x40]
add rsp, 0x48
ret
mov eax, esi
mov ecx, 0x14
call fcn.0045f5c0
mov eax, edi
mov ecx, 0x14
call fcn.0045f5c0
nop
call fcn.0045cf60
nop dword [rax + rax]
jmp fcn.005a4220
Function at 0x5a4f00
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x5a4fe8
sub rsp, 0x48
mov qword [rsp + 0x40], rbp
lea rbp, [rsp + 0x40]
movabs rdx, 0xb542bf547746547
mov qword [rsp + 0x1e], rdx
movabs rdx, 0x6b98834640f0f72
mov qword [rsp + 0x26], rdx
movabs rdx, 0xd070f070d04040d
mov qword [rsp + 0x2e], rdx
movabs rdx, 0x9050d070f070d04
mov qword [rsp + 0x30], rdx
movabs rdx, 0xa070a0c0f0f0e0c
mov qword [rsp + 0x38], rdx
xor eax, eax
jmp 0x5a4f81
movzx r9d, byte [rsp + rsi + 0x1e]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x26]
mov byte [rsp + rdi + 0x1e], dl
mov byte [rsp + rsi + 0x1e], r8b
add rax, 2
cmp rax, 0x12
jge 0x5a4fb3
movzx edx, byte [rsp + rax + 0x2e]
movzx esi, byte [rsp + rax + 0x2f]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x10
jae 0x5a4fdb
movzx r8d, byte [rsp + rdi + 0x1e]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x26]
cmp rsi, 0x10
jb 0x5a4f67
jmp 0x5a4fcf
xor eax, eax
lea rbx, [rsp + 0x1e]
mov ecx, 0x10
nop
call fcn.0044a200
mov rbp, qword [rsp + 0x40]
add rsp, 0x48
ret
mov eax, esi
mov ecx, 0x10
call fcn.0045f5c0
mov eax, edi
mov ecx, 0x10
call fcn.0045f5c0
nop
call fcn.0045cf60
jmp fcn.005a4f00

Function at 0x5a5100
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x5a5208
sub rsp, 0x58
mov qword [rsp + 0x50], rbp
lea rbp, [rsp + 0x50]
movabs rdx, 0x3f314069f61a65d1
mov qword [rsp + 0x1c], rdx
movabs rdx, 0xca2661654f680b77
mov qword [rsp + 0x24], rdx
movabs rdx, 0xd06734f31120172
mov qword [rsp + 0x2c], rdx
movabs rdx, 0x612111109000316
mov qword [rsp + 0x34], rdx
movabs rdx, 0x602130f1617090f
mov qword [rsp + 0x3c], rdx
movabs rdx, 0xe0911060602130f
mov qword [rsp + 0x40], rdx
movabs rdx, 0xb120e140705030e
mov qword [rsp + 0x48], rdx
xor eax, eax
jmp 0x5a51a2
movzx r9d, byte [rsp + rsi + 0x1c]
sub r9d, edx
lea edx, [r9 + 0x47]
mov byte [rsp + rdi + 0x1c], dl
lea edx, [r8 + 0x47]
mov byte [rsp + rsi + 0x1c], dl
add rax, 2
cmp rax, 0x1c
jge 0x5a51cf
movzx edx, byte [rsp + rax + 0x34]
movzx esi, byte [rsp + rax + 0x35]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x18
jae 0x5a51fb
movzx r8d, byte [rsp + rdi + 0x1c]
sub r8d, edx
cmp rsi, 0x18
jb 0x5a5185
jmp 0x5a51ef
xor eax, eax
lea rbx, [rsp + 0x1c]
mov ecx, 0x18
nop dword [rax + rax]
call fcn.0044a200
mov rbp, qword [rsp + 0x50]
add rsp, 0x58
ret
mov eax, esi
mov ecx, 0x18
call fcn.0045f5c0
mov eax, edi
mov ecx, 0x18
call fcn.0045f5c0
nop
call fcn.0045cf60
jmp fcn.005a5100
Function at 0x5a7480
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x5a7552
sub rsp, 0x40
mov qword [rsp + 0x38], rbp
lea rbp, [rsp + 0x38]
movabs rdx, 0x7f5a647841656571
mov qword [rsp + 0x1c], rdx
mov dword [rsp + 0x24], 0x56596675
movabs rdx, 0x8000407080b0608
mov qword [rsp + 0x28], rdx
movabs rdx, 0xb0a070704020b07
mov qword [rsp + 0x30], rdx
xor eax, eax
jmp 0x5a74eb
movzx r9d, byte [rsp + rsi + 0x1c]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x11]
mov byte [rsp + rdi + 0x1c], dl
mov byte [rsp + rsi + 0x1c], r8b
add rax, 2
cmp rax, 0x10
jge 0x5a751d
movzx edx, byte [rsp + rax + 0x28]
movzx esi, byte [rsp + rax + 0x29]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0xc
jae 0x5a7545
movzx r8d, byte [rsp + rdi + 0x1c]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x11]
cmp rsi, 0xc
jb 0x5a74d1
jmp 0x5a7538
xor eax, eax
lea rbx, [rsp + 0x1c]
mov ecx, 0xc
call fcn.0044a200
mov rbp, qword [rsp + 0x38]
add rsp, 0x40
ret
mov eax, esi
mov ecx, 0xc
nop
call fcn.0045f5c0
mov eax, edi
mov ecx, 0xc
call fcn.0045f5c0
nop
call fcn.0045cf60
jmp fcn.005a7480

Function at 0x5a7560
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x5a7628
sub rsp, 0x38
mov qword [rsp + 0x30], rbp
lea rbp, [rsp + 0x30]
movabs rdx, 0x55465b3f432e494a
mov qword [rsp + 0x26], rdx
mov word [rsp + 0x2e], 0x7075
movabs rdx, 0x507010400010706
mov qword [rsp + 0x1c], rdx
mov word [rsp + 0x24], 0x202
xor eax, eax
jmp 0x5a75c2
movzx r9d, byte [rsp + rsi + 0x26]
lea edx, [r9 + rdx]
lea edx, [rdx + 0xb]
mov byte [rsp + rdi + 0x26], dl
mov byte [rsp + rsi + 0x26], r8b
add rax, 2
cmp rax, 0xa
jge 0x5a75f4
movzx edx, byte [rsp + rax + 0x1c]
movzx esi, byte [rsp + rax + 0x1d]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0xa
jae 0x5a761b
movzx r8d, byte [rsp + rdi + 0x26]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0xb]
cmp rsi, 0xa
jb 0x5a75a8
jmp 0x5a760f
xor eax, eax
lea rbx, [rsp + 0x26]
mov ecx, 0xa
call fcn.0044a200
mov rbp, qword [rsp + 0x30]
add rsp, 0x38
ret
mov eax, esi
mov ecx, 0xa
call fcn.0045f5c0
mov eax, edi
mov ecx, 0xa
call fcn.0045f5c0
nop
call fcn.0045cf60
jmp fcn.005a7560
Function at 0x5a7920
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x5a7a28
sub rsp, 0x58
mov qword [rsp + 0x50], rbp
lea rbp, [rsp + 0x50]
movabs rdx, 0x424f746525ff5346
mov qword [rsp + 0x1a], rdx
movabs rdx, 0x7011616c2235424f
mov qword [rsp + 0x20], rdx
movabs rdx, 0x3c6c7b524b3f2f04
mov qword [rsp + 0x28], rdx
movabs rdx, 0xe11000212131002
mov qword [rsp + 0x30], rdx
movabs rdx, 0xf0c150310090713
mov qword [rsp + 0x38], rdx
movabs rdx, 0x110f070908030911
mov qword [rsp + 0x40], rdx
movabs rdx, 0xc11101507131000
mov qword [rsp + 0x48], rdx
xor eax, eax
jmp 0x5a79c0
movzx r9d, byte [rsp + rsi + 0x1a]
lea edx, [r9 + rdx]
lea edx, [rdx - 0xb]
mov byte [rsp + rdi + 0x1a], dl
mov byte [rsp + rsi + 0x1a], r8b
add rax, 2
nop
cmp rax, 0x20
jge 0x5a79f2
movzx edx, byte [rsp + rax + 0x30]
movzx esi, byte [rsp + rax + 0x31]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x16
jae 0x5a7a1b
movzx r8d, byte [rsp + rdi + 0x1a]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0xb]
cmp rsi, 0x16
jb 0x5a79a5
jmp 0x5a7a0f
xor eax, eax
lea rbx, [rsp + 0x1a]
mov ecx, 0x16
nop
call fcn.0044a200
mov rbp, qword [rsp + 0x50]
add rsp, 0x58
ret
mov eax, esi
mov ecx, 0x16
call fcn.0045f5c0
mov eax, edi
mov ecx, 0x16
call fcn.0045f5c0
nop
call fcn.0045cf60
jmp fcn.005a7920

Function at 0x5a7be0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x5a7ce8
sub rsp, 0x50
mov qword [rsp + 0x48], rbp
lea rbp, [rsp + 0x48]
movabs rdx, 0xe96b6fd7d89153c3
mov qword [rsp + 0x1b], rdx
movabs rdx, 0xb21bf0e96b6fd7d8
mov qword [rsp + 0x1e], rdx
movabs rdx, 0x9b38d565632a76a1
mov qword [rsp + 0x26], rdx
movabs rdx, 0x4111209070010
mov qword [rsp + 0x2e], rdx
movabs rdx, 0x9120d0b070a0712
mov qword [rsp + 0x36], rdx
movabs rdx, 0x30a09120d0b070a
mov qword [rsp + 0x38], rdx
movabs rdx, 0xb080b0802100a00
mov qword [rsp + 0x40], rdx
xor eax, eax
jmp 0x5a7c82
movzx r9d, byte [rsp + rsi + 0x1b]
sub r9d, edx
lea edx, [r9 - 0x26]
mov byte [rsp + rdi + 0x1b], dl
lea edx, [r8 - 0x26]
mov byte [rsp + rsi + 0x1b], dl
add rax, 2
cmp rax, 0x1a
jge 0x5a7caf
movzx edx, byte [rsp + rax + 0x2e]
movzx esi, byte [rsp + rax + 0x2f]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x13
jae 0x5a7cdb
movzx r8d, byte [rsp + rdi + 0x1b]
sub r8d, edx
cmp rsi, 0x13
jb 0x5a7c65
jmp 0x5a7ccf
xor eax, eax
lea rbx, [rsp + 0x1b]
mov ecx, 0x13
nop dword [rax + rax]
call fcn.0044a200
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
mov eax, esi
mov ecx, 0x13
call fcn.0045f5c0
mov eax, edi
mov ecx, 0x13
call fcn.0045f5c0
nop
call fcn.0045cf60
jmp fcn.005a7be0
Function at 0x5a96e0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x5a97ab
sub rsp, 0x38
mov qword [rsp + 0x30], rbp
lea rbp, [rsp + 0x30]
movabs rdx, 0xe36b4a6fb5ad65ba
mov qword [rsp + 0x26], rdx
mov word [rsp + 0x2e], 0xc370
movabs rdx, 0x200030705050705
mov qword [rsp + 0x1c], rdx
mov word [rsp + 0x24], 0x903
xor eax, eax
jmp 0x5a9745
movzx r9d, byte [rsp + rsi + 0x26]
sub r9d, edx
lea edx, [r9 - 0x3e]
mov byte [rsp + rdi + 0x26], dl
lea edx, [r8 - 0x3e]
mov byte [rsp + rsi + 0x26], dl
add rax, 2
cmp rax, 0xa
jge 0x5a9777
movzx edx, byte [rsp + rax + 0x1c]
movzx esi, byte [rsp + rax + 0x1d]
mov edi, edx
xor edx, esi
add edx, eax
nop dword [rax + rax]
cmp rdi, 0xa
jae 0x5a979e
movzx r8d, byte [rsp + rdi + 0x26]
sub r8d, edx
cmp rsi, 0xa
jb 0x5a9728
jmp 0x5a9792
xor eax, eax
lea rbx, [rsp + 0x26]
mov ecx, 0xa
call fcn.0044a200
mov rbp, qword [rsp + 0x30]
add rsp, 0x38
ret
mov eax, esi
mov ecx, 0xa
call fcn.0045f5c0
mov eax, edi
mov ecx, 0xa
call fcn.0045f5c0
nop
call fcn.0045cf60
jmp fcn.005a96e0

Function at 0x5ab140
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x5ab22b
sub rsp, 0x48
mov qword [rsp + 0x40], rbp
lea rbp, [rsp + 0x40]
movabs rdx, 0xc2202e65120cb727
mov qword [rsp + 0x1f], rdx
movabs rdx, 0xf646e694043a1c2
mov qword [rsp + 0x26], rdx
movabs rdx, 0xe08010007020108
mov qword [rsp + 0x2e], rdx
movabs rdx, 0x30e0801000702
mov qword [rsp + 0x30], rdx
movabs rdx, 0xa070902050a0803
mov qword [rsp + 0x38], rdx
xor eax, eax
jmp 0x5ab1c4
movzx r9d, byte [rsp + rsi + 0x1f]
sub r9d, edx
lea edx, [r9 + 0x3f]
mov byte [rsp + rdi + 0x1f], dl
lea edx, [r8 + 0x3f]
mov byte [rsp + rsi + 0x1f], dl
add rax, 2
cmp rax, 0x12
jge 0x5ab1f7
movzx edx, byte [rsp + rax + 0x2e]
movzx esi, byte [rsp + rax + 0x2f]
mov edi, edx
xor edx, esi
add edx, eax
nop word [rax + rax]
cmp rdi, 0xf
jae 0x5ab21e
movzx r8d, byte [rsp + rdi + 0x1f]
sub r8d, edx
cmp rsi, 0xf
jb 0x5ab1a7
jmp 0x5ab212
xor eax, eax
lea rbx, [rsp + 0x1f]
mov ecx, 0xf
call fcn.0044a200
mov rbp, qword [rsp + 0x40]
add rsp, 0x48
ret
mov eax, esi
mov ecx, 0xf
call fcn.0045f5c0
mov eax, edi
mov ecx, 0xf
call fcn.0045f5c0
nop
call fcn.0045cf60
jmp fcn.005ab140
Function at 0x5ab540
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x5ab668
sub rsp, 0x60
mov qword [rsp + 0x58], rbp
lea rbp, [rsp + 0x58]
movabs rdx, 0x6f26057e74c5066f
mov qword [rsp + 0x1b], rdx
movabs rdx, 0x111a1d33ec242de6
mov qword [rsp + 0x23], rdx
movabs rdx, 0x6e111a1d33ec242d
mov qword [rsp + 0x24], rdx
movabs rdx, 0xe5fc13718d67567
mov qword [rsp + 0x2c], rdx
movabs rdx, 0x130e06100c0c090b
mov qword [rsp + 0x34], rdx
movabs rdx, 0xd171615130e0610
mov qword [rsp + 0x38], rdx
movabs rdx, 0x2040c0e130f080e
mov qword [rsp + 0x40], rdx
movabs rdx, 0xe02011418060f00
mov qword [rsp + 0x48], rdx
movabs rdx, 0x2150f05040a0d0a
mov qword [rsp + 0x50], rdx
xor eax, eax
jmp 0x5ab600
movzx r9d, byte [rsp + rsi + 0x1b]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x32]
mov byte [rsp + rdi + 0x1b], dl
mov byte [rsp + rsi + 0x1b], r8b
add rax, 2
nop dword [rax]
cmp rax, 0x24
jge 0x5ab632
movzx edx, byte [rsp + rax + 0x34]
movzx esi, byte [rsp + rax + 0x35]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x19
jae 0x5ab65b
movzx r8d, byte [rsp + rdi + 0x1b]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x32]
cmp rsi, 0x19
jb 0x5ab5e3
jmp 0x5ab64f
xor eax, eax
lea rbx, [rsp + 0x1b]
mov ecx, 0x19
nop
call fcn.0044a200
mov rbp, qword [rsp + 0x58]
add rsp, 0x60
ret
mov eax, esi
mov ecx, 0x19
call fcn.0045f5c0
mov eax, edi
mov ecx, 0x19
call fcn.0045f5c0
nop
call fcn.0045cf60
jmp fcn.005ab540

Function at 0x5beb80
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x5bec4b
sub rsp, 0x38
mov qword [rsp + 0x30], rbp
lea rbp, [rsp + 0x30]
movabs rdx, 0x211ed06c6c1874db
mov qword [rsp + 0x1b], rdx
mov byte [rsp + 0x23], 0xbe
movabs rdx, 0x5070805020508
mov qword [rsp + 0x24], rdx
mov dword [rsp + 0x2c], 0x6060600
xor eax, eax
jmp 0x5bebe4
movzx r9d, byte [rsp + rsi + 0x1b]
sub r9d, edx
lea edx, [r9 + 0x5e]
mov byte [rsp + rdi + 0x1b], dl
lea edx, [r8 + 0x5e]
mov byte [rsp + rsi + 0x1b], dl
add rax, 2
cmp rax, 0xc
jge 0x5bec17
movzx edx, byte [rsp + rax + 0x24]
movzx esi, byte [rsp + rax + 0x25]
mov edi, edx
xor edx, esi
add edx, eax
nop word [rax + rax]
cmp rdi, 9
jae 0x5bec3e
movzx r8d, byte [rsp + rdi + 0x1b]
sub r8d, edx
cmp rsi, 9
jb 0x5bebc7
jmp 0x5bec32
xor eax, eax
lea rbx, [rsp + 0x1b]
mov ecx, 9
call fcn.0044a200
mov rbp, qword [rsp + 0x30]
add rsp, 0x38
ret
mov eax, esi
mov ecx, 9
call fcn.0045f5c0
mov eax, edi
mov ecx, 9
call fcn.0045f5c0
nop
call fcn.0045cf60
jmp fcn.005beb80
Function at 0x5bec60
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x5bed56
sub rsp, 0x50
mov qword [rsp + 0x48], rbp
lea rbp, [rsp + 0x48]
movabs rdx, 0x1eadad5ac452e84e
mov qword [rsp + 0x1f], rdx
movabs rdx, 0xa874721eadad5ac4
mov qword [rsp + 0x22], rdx
movabs rdx, 0x79c25cae9e4d03f5
mov qword [rsp + 0x2a], rdx
movabs rdx, 0xf0a0a07100b100b
mov qword [rsp + 0x32], rdx
movabs rdx, 0xf040c05010c0f0a
mov qword [rsp + 0x38], rdx
movabs rdx, 0x310060e01110f10
mov qword [rsp + 0x40], rdx
xor eax, eax
jmp 0x5becf3
movzx r9d, byte [rsp + rsi + 0x1f]
sub r9d, edx
lea edx, [r9 - 0x2e]
mov byte [rsp + rdi + 0x1f], dl
lea edx, [r8 - 0x2e]
mov byte [rsp + rsi + 0x1f], dl
add rax, 2
cmp rax, 0x16
jge 0x5bed22
movzx edx, byte [rsp + rax + 0x32]
movzx esi, byte [rsp + rax + 0x33]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x13
jae 0x5bed49
movzx r8d, byte [rsp + rdi + 0x1f]
sub r8d, edx
cmp rsi, 0x13
jb 0x5becd6
nop
jmp 0x5bed3d
xor eax, eax
lea rbx, [rsp + 0x1f]
mov ecx, 0x13
call fcn.0044a200
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
mov eax, esi
mov ecx, 0x13
call fcn.0045f5c0
mov eax, edi
mov ecx, 0x13
call fcn.0045f5c0
nop
call fcn.0045cf60
nop dword [rax + rax]
jmp fcn.005bec60

Function at 0x5bf200
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x5bf2f6
sub rsp, 0x48
mov qword [rsp + 0x40], rbp
lea rbp, [rsp + 0x40]
movabs rdx, 0x53ff213f642ee452
mov qword [rsp + 0x19], rdx
movabs rdx, 0x6553ff213f642ee4
mov qword [rsp + 0x1a], rdx
movabs rdx, 0xf376cb6d654d4173
mov qword [rsp + 0x22], rdx
movabs rdx, 0xa010405100f020e
mov qword [rsp + 0x2a], rdx
movabs rdx, 0x701070e040e0a01
mov qword [rsp + 0x30], rdx
movabs rdx, 0x70e020510060702
mov qword [rsp + 0x38], rdx
xor eax, eax
jmp 0x5bf293
movzx r9d, byte [rsp + rsi + 0x19]
sub r9d, edx
lea edx, [r9 - 0x60]
mov byte [rsp + rdi + 0x19], dl
lea edx, [r8 - 0x60]
mov byte [rsp + rsi + 0x19], dl
add rax, 2
cmp rax, 0x16
jge 0x5bf2c2
movzx edx, byte [rsp + rax + 0x2a]
movzx esi, byte [rsp + rax + 0x2b]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x11
jae 0x5bf2e9
movzx r8d, byte [rsp + rdi + 0x19]
sub r8d, edx
cmp rsi, 0x11
jb 0x5bf276
nop
jmp 0x5bf2dd
xor eax, eax
lea rbx, [rsp + 0x19]
mov ecx, 0x11
call fcn.0044a200
mov rbp, qword [rsp + 0x40]
add rsp, 0x48
ret
mov eax, esi
mov ecx, 0x11
call fcn.0045f5c0
mov eax, edi
mov ecx, 0x11
call fcn.0045f5c0
nop
call fcn.0045cf60
nop dword [rax + rax]
jmp fcn.005bf200
Function at 0x5bf6c0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x5bf7a6
sub rsp, 0x30
mov qword [rsp + 0x28], rbp
lea rbp, [rsp + 0x28]
lea rax, [0x005d4a40]
nop
call fcn.0040c940
movabs rcx, 0x746e1ac4b7a443b1
mov qword [rax], rcx
movabs rcx, 0x727d1e7376d36512
mov qword [rax + 8], rcx
movabs rcx, 0x40b0a00050e000a
mov qword [rsp + 0x12], rcx
movabs rcx, 0x10d02040508040b
mov qword [rsp + 0x18], rcx
movabs rcx, 0x2080b04020d0304
mov qword [rsp + 0x20], rcx
xor ecx, ecx
jmp 0x5bf748
movzx r9d, byte [rsi + rax]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x3e]
mov byte [rax + rdi], dl
mov byte [rax + rsi], r8b
add rcx, 2
cmp rcx, 0x16
jge 0x5bf77b
movzx edx, byte [rsp + rcx + 0x12]
movzx esi, byte [rsp + rcx + 0x13]
mov edi, edx
xor edx, esi
add edx, ecx
nop
cmp rdi, 0x10
jae 0x5bf799
movzx r8d, byte [rdi + rax]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x3e]
cmp rsi, 0x10
jb 0x5bf731
jmp 0x5bf78d
mov ebx, 0x10
mov rcx, rbx
mov rbp, qword [rsp + 0x28]
add rsp, 0x30
ret
mov eax, esi
mov ecx, 0x10
call fcn.0045f5c0
mov eax, edi
mov ecx, 0x10
call fcn.0045f5c0
nop
call fcn.0045cf60
jmp fcn.005bf6c0
Function at 0x5c2020
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x5c20e8
sub rsp, 0x38
mov qword [rsp + 0x30], rbp
lea rbp, [rsp + 0x30]
movabs rdx, 0xb6449476c4a1f05
mov qword [rsp + 0x1d], rdx
mov byte [rsp + 0x25], 0x47
movabs rdx, 0x208020400040201
mov qword [rsp + 0x26], rdx
mov word [rsp + 0x2e], 0x507
xor eax, eax
jmp 0x5c2083
movzx r9d, byte [rsp + rsi + 0x1d]
sub r9d, edx
lea edx, [r9 + 0x2d]
mov byte [rsp + rdi + 0x1d], dl
lea edx, [r8 + 0x2d]
mov byte [rsp + rsi + 0x1d], dl
add rax, 2
cmp rax, 0xa
jge 0x5c20b0
movzx edx, byte [rsp + rax + 0x26]
movzx esi, byte [rsp + rax + 0x27]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 9
jae 0x5c20db
movzx r8d, byte [rsp + rdi + 0x1d]
sub r8d, edx
cmp rsi, 9
jb 0x5c2066
jmp 0x5c20cf
xor eax, eax
lea rbx, [rsp + 0x1d]
mov ecx, 9
nop dword [rax]
call fcn.0044a200
mov rbp, qword [rsp + 0x30]
add rsp, 0x38
ret
mov eax, esi
mov ecx, 9
call fcn.0045f5c0
mov eax, edi
mov ecx, 9
call fcn.0045f5c0
nop
call fcn.0045cf60
jmp fcn.005c2020

Function at 0x5c23e0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x5c24cb
sub rsp, 0x48
mov qword [rsp + 0x40], rbp
lea rbp, [rsp + 0x40]
movabs rdx, 0x35fc0417e4c63c47
mov qword [rsp + 0x1e], rdx
movabs rdx, 0x77194d336940656c
mov qword [rsp + 0x26], rdx
movabs rdx, 0x203050705060c01
mov qword [rsp + 0x2e], rdx
movabs rdx, 0x30e020305070506
mov qword [rsp + 0x30], rdx
movabs rdx, 0x4020d060e0a0402
mov qword [rsp + 0x38], rdx
xor eax, eax
jmp 0x5c2464
movzx r9d, byte [rsp + rsi + 0x1e]
sub r9d, edx
lea edx, [r9 + 0x3f]
mov byte [rsp + rdi + 0x1e], dl
lea edx, [r8 + 0x3f]
mov byte [rsp + rsi + 0x1e], dl
add rax, 2
cmp rax, 0x12
jge 0x5c2497
movzx edx, byte [rsp + rax + 0x2e]
movzx esi, byte [rsp + rax + 0x2f]
mov edi, edx
xor edx, esi
add edx, eax
nop word [rax + rax]
cmp rdi, 0x10
jae 0x5c24be
movzx r8d, byte [rsp + rdi + 0x1e]
sub r8d, edx
cmp rsi, 0x10
jb 0x5c2447
jmp 0x5c24b2
xor eax, eax
lea rbx, [rsp + 0x1e]
mov ecx, 0x10
call fcn.0044a200
mov rbp, qword [rsp + 0x40]
add rsp, 0x48
ret
mov eax, esi
mov ecx, 0x10
call fcn.0045f5c0
mov eax, edi
mov ecx, 0x10
call fcn.0045f5c0
nop
call fcn.0045cf60
jmp fcn.005c23e0
Function at 0x40bed0
Capabilities:
Query environment variable

Disassembly:
push r13
push r12
push rsi
push rbx
sub rsp, 0x148
mov qword [rsp + 0x40], 0
mov rbx, rcx
mov r13, rdx
mov qword [rsp + 0x48], 0
mov qword [rsp + 0x50], 0
mov qword [rsp + 0x58], 0
mov qword [rsp + 0x60], 0
mov qword [rsp + 0x68], 0
mov qword [rsp + 0x70], 0
mov qword [rsp + 0x78], 0
mov qword [rsp + 0x80], 0
mov qword [rsp + 0x88], 0
mov qword [rsp + 0x90], 0
mov qword [rsp + 0x98], 0
mov qword [rsp + 0xa0], 0
mov qword [rsp + 0xa8], 0
mov qword [rsp + 0xb0], 0
mov qword [rsp + 0xb8], 0
mov qword [rsp + 0xc0], 0
mov qword [rsp + 0xc8], 0
mov qword [rsp + 0xd0], 0
mov qword [rsp + 0xd8], 0
mov qword [rsp + 0xe0], 0
mov qword [rsp + 0xe8], 0
mov qword [rsp + 0xf0], 0
mov qword [rsp + 0xf8], 0
mov qword [rsp + 0x100], 0
mov qword [rsp + 0x108], 0
mov qword [rsp + 0x110], 0
mov qword [rsp + 0x118], 0
mov qword [rsp + 0x120], 0
mov qword [rsp + 0x128], 0
mov qword [rsp + 0x130], 0
mov qword [rsp + 0x138], 0
mov qword [rsp + 0x20], 0
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x38], 0
call qword [sym.imp.libcurl_4.dll_curl_easy_init]
mov r12, rax
test rax, rax
je 0x40c210
lea rsi, [rsp + 0x40]
mov r8, rbx
mov edx, 0x2712
mov rcx, rax
mov rbx, qword [sym.imp.libcurl_4.dll_curl_easy_setopt]
call rbx
mov r8d, 1
mov edx, 0x4a
mov rcx, r12
call rbx
mov r8d, 0xf
mov edx, 0x4e
mov rcx, r12
call rbx
mov r8, rsi
mov edx, 0x271a
mov rcx, r12
call rbx
mov r8d, 1
mov edx, 0x63
mov rcx, r12
call rbx
mov r8d, 1
mov edx, 0x79
mov rcx, r12
call rbx
lea r8, [0x0040a4d0]
mov edx, 0x4e2b
mov rcx, r12
call rbx
lea r8, [rsp + 0x20]
mov edx, 0x2711
mov rcx, r12
call rbx
mov rax, qword [0x0063f800]
mov r8, qword [rax]
test r8, r8
je 0x40c1a0
mov edx, 0x2714
mov rcx, r12
call rbx
mov rax, qword [0x0063f810]
mov edx, 0x65
mov rcx, r12
mov r8d, dword [rax]
call rbx
mov rcx, r12
call qword [sym.imp.libcurl_4.dll_curl_easy_perform]
test eax, eax
jne 0x40c1f0
mov rcx, qword [rsp + 0x20]
test rcx, rcx
je 0x40c15b
cmp qword [rsp + 0x28], 0
jne 0x40c190
lea rdx, str.Empty_data_received_for_config
mov ecx, 1
xor r13d, r13d
call fcn.0040a6c0
mov rcx, r12
call qword [sym.imp.libcurl_4.dll_curl_easy_cleanup]
mov rax, r13
add rsp, 0x148
pop rbx
pop rsi
pop r12
pop r13
ret
mov r8, r13
xor edx, edx
call fcn.005a7b50
mov r13, rax
jmp 0x40c16f
lea rcx, str.http_proxy
call sub.msvcrt.dll_getenv
test rax, rax
je 0x40c138
lea rcx, str.all_proxy
call sub.msvcrt.dll_getenv
lea rcx, str.all_proxy
test rax, rax
je 0x40c230
call sub.msvcrt.dll_getenv
mov rcx, r12
mov edx, 0x2714
mov r8, rax
call rbx
mov rcx, r12
call qword [sym.imp.libcurl_4.dll_curl_easy_perform]
test eax, eax
je 0x40c149
nop dword [rax]
mov r8, rsi
lea rdx, str.Remote_config_read_failed:__s
mov ecx, 1
xor r13d, r13d
call fcn.0040a6c0
jmp 0x40c16f
lea rdx, str.Remote_config_init_failed_
mov ecx, 1
xor r13d, r13d
call fcn.0040a6c0
jmp 0x40c178
lea rcx, str.ALL_PROXY
call sub.msvcrt.dll_getenv
test rax, rax
je 0x40c250
lea rcx, str.ALL_PROXY
jmp 0x40c1c9
lea r8, [0x005e6bc3]
mov edx, 0x2714
mov rcx, r12
call rbx
jmp 0x40c138