joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4e1860
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4e196c
push rbp
mov rbp, rsp
sub rsp, 0x50
movabs rdx, 0x72742dfe37202eaf
mov qword [rsp + 0x1a], rdx
movabs rdx, 0x6bc53539f690a2b
mov qword [rsp + 0x22], rdx
movabs rdx, 0x272406bc53539f69
mov qword [rsp + 0x24], rdx
movabs rdx, 0x278f2b3df764722b
mov qword [rsp + 0x2c], rdx
movabs rdx, 0x110b0f030812040c
mov qword [rsp + 0x34], rdx
movabs rdx, 0x17160e0903001618
mov qword [rsp + 0x3c], rdx
movabs rdx, 0x1105051717160e09
mov qword [rsp + 0x40], rdx
movabs rdx, 0x3150e1005190e09
mov qword [rsp + 0x48], rdx
xor eax, eax
jmp 0x4e1908
movzx r9d, byte [rsp + rsi + 0x1a]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x1a]
mov byte [rsp + rdi + 0x1a], dl
mov byte [rsp + rsi + 0x1a], r8b
add rax, 2
cmp rax, 0x1c
jge 0x4e193c
movzx edx, byte [rsp + rax + 0x34]
movzx esi, byte [rsp + rax + 0x35]
mov edi, edx
xor edx, esi
add edx, eax
nop
cmp rdi, 0x1a
jae 0x4e195f
movzx r8d, byte [rsp + rdi + 0x1a]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x1a]
cmp rsi, 0x1a
jb 0x4e18ee
jmp 0x4e1953
xor eax, eax
lea rbx, [rsp + 0x1a]
mov ecx, 0x1a
call fcn.00441380
add rsp, 0x50
pop rbp
ret
mov eax, esi
mov ecx, 0x1a
call fcn.00451880
mov eax, edi
mov ecx, 0x1a
call fcn.00451880
nop
call fcn.0044f600
jmp fcn.004e1860

Function at 0x4e2bc0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4e2cbd
push rbp
mov rbp, rsp
sub rsp, 0x48
movabs rdx, 0x532016bbaa72b6bb
mov qword [rsp + 0x1a], rdx
movabs rdx, 0xcf0a61a3532016bb
mov qword [rsp + 0x1e], rdx
movabs rdx, 0xa81e6954b5b1afce
mov qword [rsp + 0x26], rdx
movabs rdx, 0x120b00050513030e
mov qword [rsp + 0x2e], rdx
movabs rdx, 0x8000f04120c0104
mov qword [rsp + 0x36], rdx
movabs rdx, 0xb1308000f04120c
mov qword [rsp + 0x38], rdx
movabs rdx, 0xa0a080d0d0c0a0a
mov qword [rsp + 0x40], rdx
xor eax, eax
jmp 0x4e2c60
movzx r9d, byte [rsp + rsi + 0x1a]
sub r9d, edx
lea edx, [r9 - 0x39]
mov byte [rsp + rdi + 0x1a], dl
lea edx, [r8 - 0x39]
mov byte [rsp + rsi + 0x1a], dl
add rax, 2
nop dword [rax]
cmp rax, 0x1a
jge 0x4e2c8d
movzx edx, byte [rsp + rax + 0x2e]
movzx esi, byte [rsp + rax + 0x2f]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x14
jae 0x4e2cb0
movzx r8d, byte [rsp + rdi + 0x1a]
sub r8d, edx
cmp rsi, 0x14
jb 0x4e2c3f
jmp 0x4e2ca4
xor eax, eax
lea rbx, [rsp + 0x1a]
mov ecx, 0x14
call fcn.00441380
add rsp, 0x48
pop rbp
ret
mov eax, esi
mov ecx, 0x14
call fcn.00451880
mov eax, edi
mov ecx, 0x14
call fcn.00451880
nop
nop dword [rax]
call fcn.0044f600
jmp fcn.004e2bc0
Function at 0x4e47c0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4e48bb
push rbp
mov rbp, rsp
sub rsp, 0x48
movabs rdx, 0x74869e94ad888753
mov qword [rsp + 0x1b], rdx
movabs rdx, 0x909ed574869e94ad
mov qword [rsp + 0x1e], rdx
movabs rdx, 0x90b8998020ad559b
mov qword [rsp + 0x26], rdx
movabs rdx, 0xd01080209040305
mov qword [rsp + 0x2e], rdx
movabs rdx, 0x4061210020a1011
mov qword [rsp + 0x36], rdx
movabs rdx, 0xc0104061210020a
mov qword [rsp + 0x38], rdx
movabs rdx, 0xf0a0a0a01050f0b
mov qword [rsp + 0x40], rdx
xor eax, eax
jmp 0x4e4859
movzx r9d, byte [rsp + rsi + 0x1b]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x35]
mov byte [rsp + rdi + 0x1b], dl
mov byte [rsp + rsi + 0x1b], r8b
add rax, 2
cmp rax, 0x1a
jge 0x4e488b
movzx edx, byte [rsp + rax + 0x2e]
movzx esi, byte [rsp + rax + 0x2f]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x13
jae 0x4e48ae
movzx r8d, byte [rsp + rdi + 0x1b]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x35]
cmp rsi, 0x13
jb 0x4e483f
jmp 0x4e48a2
xor eax, eax
lea rbx, [rsp + 0x1b]
mov ecx, 0x13
call fcn.00441380
add rsp, 0x48
pop rbp
ret
mov eax, esi
mov ecx, 0x13
call fcn.00451880
mov eax, edi
mov ecx, 0x13
call fcn.00451880
nop
nop dword [rax + rax]
call fcn.0044f600
jmp fcn.004e47c0

Function at 0x4e5820
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4e590c
push rbp
mov rbp, rsp
sub rsp, 0x48
movabs rdx, 0xa7fe539fe3aea034
mov qword [rsp + 0x1e], rdx
movabs rdx, 0xd69ca7fe539fe3ae
mov qword [rsp + 0x20], rdx
movabs rdx, 0xe59c9fbcb16b72a8
mov qword [rsp + 0x28], rdx
movabs rdx, 0xe06110d0002030d
mov qword [rsp + 0x30], rdx
movabs rdx, 0x409010a0c0d0e08
mov qword [rsp + 0x38], rdx
movabs rdx, 0x400041002100f07
mov qword [rsp + 0x40], rdx
xor eax, eax
jmp 0x4e58aa
movzx r9d, byte [rsp + rsi + 0x1e]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x56]
mov byte [rsp + rdi + 0x1e], dl
mov byte [rsp + rsi + 0x1e], r8b
add rax, 2
cmp rax, 0x18
jge 0x4e58dc
movzx edx, byte [rsp + rax + 0x30]
movzx esi, byte [rsp + rax + 0x31]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x12
jae 0x4e58ff
movzx r8d, byte [rsp + rdi + 0x1e]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x56]
cmp rsi, 0x12
jb 0x4e5890
jmp 0x4e58f3
xor eax, eax
lea rbx, [rsp + 0x1e]
mov ecx, 0x12
call fcn.00441380
add rsp, 0x48
pop rbp
ret
mov eax, esi
mov ecx, 0x12
call fcn.00451880
mov eax, edi
mov ecx, 0x12
call fcn.00451880
nop
call fcn.0044f600
jmp fcn.004e5820
Function at 0x4e6820
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4e693a
push rbp
mov rbp, rsp
sub rsp, 0x58
movabs rdx, 0xb78e010b62828257
mov qword [rsp + 0x18], rdx
movabs rdx, 0x148e537e8f987131
mov qword [rsp + 0x20], rdx
movabs rdx, 0x946e148e537e8f98
mov qword [rsp + 0x22], rdx
movabs rdx, 0x65ac694e82649eac
mov qword [rsp + 0x2a], rdx
movabs rdx, 0xf120f080f050304
mov qword [rsp + 0x32], rdx
movabs rdx, 0xa18051203190f12
mov qword [rsp + 0x38], rdx
movabs rdx, 0x130b111902050c12
mov qword [rsp + 0x40], rdx
movabs rdx, 0x30c0f0115160608
mov qword [rsp + 0x48], rdx
movabs rdx, 0x911130b0a0e0a07
mov qword [rsp + 0x50], rdx
xor eax, eax
jmp 0x4e68d7
movzx r9d, byte [rsp + rsi + 0x18]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x49]
mov byte [rsp + rdi + 0x18], dl
mov byte [rsp + rsi + 0x18], r8b
add rax, 2
cmp rax, 0x26
jge 0x4e6909
movzx edx, byte [rsp + rax + 0x32]
movzx esi, byte [rsp + rax + 0x33]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x1a
jae 0x4e692d
movzx r8d, byte [rsp + rdi + 0x18]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x49]
cmp rsi, 0x1a
jb 0x4e68bd
jmp 0x4e6921
xor eax, eax
lea rbx, [rsp + 0x18]
mov ecx, 0x1a
call fcn.00441380
add rsp, 0x58
pop rbp
nop
ret
mov eax, esi
mov ecx, 0x1a
call fcn.00451880
mov eax, edi
mov ecx, 0x1a
call fcn.00451880
nop
call fcn.0044f600
nop
jmp fcn.004e6820
Function at 0x4eeac0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4eeb8c
push rbp
mov rbp, rsp
sub rsp, 0x38
movabs rdx, 0x667061556e647069
mov qword [rsp + 0x1e], rdx
mov dword [rsp + 0x26], 0x6c2d5c43
movabs rdx, 0xa08020803040407
mov qword [rsp + 0x2a], rdx
movabs rdx, 0x907030209020a08
mov qword [rsp + 0x30], rdx
xor eax, eax
jmp 0x4eeb25
movzx r9d, byte [rsp + rsi + 0x1e]
lea edx, [r9 + rdx]
lea edx, [rdx - 7]
mov byte [rsp + rdi + 0x1e], dl
mov byte [rsp + rsi + 0x1e], r8b
add rax, 2
cmp rax, 0xe
jge 0x4eeb5c
movzx edx, byte [rsp + rax + 0x2a]
movzx esi, byte [rsp + rax + 0x2b]
mov edi, edx
xor edx, esi
add edx, eax
nop dword [rax + rax]
cmp rdi, 0xc
jae 0x4eeb7f
movzx r8d, byte [rsp + rdi + 0x1e]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 7]
cmp rsi, 0xc
jb 0x4eeb0b
jmp 0x4eeb73
xor eax, eax
lea rbx, [rsp + 0x1e]
mov ecx, 0xc
call fcn.00441380
add rsp, 0x38
pop rbp
ret
mov eax, esi
mov ecx, 0xc
call fcn.00451880
mov eax, edi
mov ecx, 0xc
call fcn.00451880
nop
call fcn.0044f600
jmp fcn.004eeac0

Function at 0x4ef060
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4ef11d
push rbp
mov rbp, rsp
sub rsp, 0x30
movabs rdx, 0xc9e347d6703b9d70
mov qword [rsp + 0x1d], rdx
mov byte [rsp + 0x25], 0xdb
movabs rdx, 0x608070405050702
mov qword [rsp + 0x26], rdx
mov word [rsp + 0x2e], 0x501
xor eax, eax
nop
jmp 0x4ef0c0
movzx r9d, byte [rsp + rsi + 0x1d]
sub r9d, edx
lea edx, [r9 - 0x63]
mov byte [rsp + rdi + 0x1d], dl
lea edx, [r8 - 0x63]
mov byte [rsp + rsi + 0x1d], dl
add rax, 2
nop
cmp rax, 0xa
jge 0x4ef0ed
movzx edx, byte [rsp + rax + 0x26]
movzx esi, byte [rsp + rax + 0x27]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 9
jae 0x4ef110
movzx r8d, byte [rsp + rdi + 0x1d]
sub r8d, edx
cmp rsi, 9
jb 0x4ef0a2
jmp 0x4ef104
xor eax, eax
lea rbx, [rsp + 0x1d]
mov ecx, 9
call fcn.00441380
add rsp, 0x30
pop rbp
ret
mov eax, esi
mov ecx, 9
call fcn.00451880
mov eax, edi
mov ecx, 9
call fcn.00451880
nop
nop dword [rax]
call fcn.0044f600
jmp fcn.004ef060
Function at 0x4ef4e0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4ef5c6
push rbp
mov rbp, rsp
sub rsp, 0x40
movabs rdx, 0x742295175ab3cead
mov qword [rsp + 0x1a], rdx
movabs rdx, 0x784511b76b6f546a
mov qword [rsp + 0x22], rdx
movabs rdx, 0x1060c0208010101
mov qword [rsp + 0x2a], rdx
movabs rdx, 0x6050d0204030106
mov qword [rsp + 0x30], rdx
movabs rdx, 0x6060c0c0c040006
mov qword [rsp + 0x38], rdx
xor eax, eax
nop
jmp 0x4ef560
movzx r9d, byte [rsp + rsi + 0x1a]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x46]
mov byte [rsp + rdi + 0x1a], dl
mov byte [rsp + rsi + 0x1a], r8b
add rax, 2
nop dword [rax]
cmp rax, 0x16
jge 0x4ef592
movzx edx, byte [rsp + rax + 0x2a]
movzx esi, byte [rsp + rax + 0x2b]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x10
jae 0x4ef5b7
movzx r8d, byte [rsp + rdi + 0x1a]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x46]
cmp rsi, 0x10
jb 0x4ef542
jmp 0x4ef5ab
xor eax, eax
lea rbx, [rsp + 0x1a]
mov ecx, 0x10
nop
call fcn.00441380
add rsp, 0x40
pop rbp
ret
mov eax, esi
mov ecx, 0x10
call fcn.00451880
mov eax, edi
mov ecx, 0x10
nop
call fcn.00451880
nop
call fcn.0044f600
jmp fcn.004ef4e0

Function at 0x4f2da0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4f2e9d
push rbp
mov rbp, rsp
sub rsp, 0x50
movabs rdx, 0x65636f9ead9303a7
mov qword [rsp + 0x1e], rdx
movabs rdx, 0xde3edf9465636f9e
mov qword [rsp + 0x22], rdx
movabs rdx, 0x6fa3b549bfc0146d
mov qword [rsp + 0x2a], rdx
movabs rdx, 0x10b08020f000a01
mov qword [rsp + 0x32], rdx
movabs rdx, 0x900090a0e0b1209
mov qword [rsp + 0x3a], rdx
movabs rdx, 0x1101110e12040900
mov qword [rsp + 0x40], rdx
movabs rdx, 0x1100000b0b0d0f03
mov qword [rsp + 0x48], rdx
xor eax, eax
jmp 0x4f2e40
movzx r9d, byte [rsp + rsi + 0x1e]
sub r9d, edx
lea edx, [r9 - 0x12]
mov byte [rsp + rdi + 0x1e], dl
lea edx, [r8 - 0x12]
mov byte [rsp + rsi + 0x1e], dl
add rax, 2
nop dword [rax]
cmp rax, 0x1e
jge 0x4f2e6d
movzx edx, byte [rsp + rax + 0x32]
movzx esi, byte [rsp + rax + 0x33]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x14
jae 0x4f2e90
movzx r8d, byte [rsp + rdi + 0x1e]
sub r8d, edx
cmp rsi, 0x14
jb 0x4f2e1f
jmp 0x4f2e84
xor eax, eax
lea rbx, [rsp + 0x1e]
mov ecx, 0x14
call fcn.00441380
add rsp, 0x50
pop rbp
ret
mov eax, esi
mov ecx, 0x14
call fcn.00451880
mov eax, edi
mov ecx, 0x14
call fcn.00451880
nop
nop dword [rax]
call fcn.0044f600
jmp fcn.004f2da0
Function at 0x4f38a0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4f396c
push rbp
mov rbp, rsp
sub rsp, 0x30
movabs rdx, 0xf93e37293941e82e
mov qword [rsp + 0x18], rdx
mov word [rsp + 0x20], 0x818
movabs rdx, 0x400060906070100
mov qword [rsp + 0x22], rdx
movabs rdx, 0x803060405050400
mov qword [rsp + 0x28], rdx
xor eax, eax
jmp 0x4f3904
movzx r9d, byte [rsp + rsi + 0x18]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x24]
mov byte [rsp + rdi + 0x18], dl
mov byte [rsp + rsi + 0x18], r8b
add rax, 2
cmp rax, 0xe
jge 0x4f393c
movzx edx, byte [rsp + rax + 0x22]
movzx esi, byte [rsp + rax + 0x23]
mov edi, edx
xor edx, esi
add edx, eax
nop word [rax + rax]
cmp rdi, 0xa
jae 0x4f395f
movzx r8d, byte [rsp + rdi + 0x18]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x24]
cmp rsi, 0xa
jb 0x4f38ea
jmp 0x4f3953
xor eax, eax
lea rbx, [rsp + 0x18]
mov ecx, 0xa
call fcn.00441380
add rsp, 0x30
pop rbp
ret
mov eax, esi
mov ecx, 0xa
call fcn.00451880
mov eax, edi
mov ecx, 0xa
call fcn.00451880
nop
call fcn.0044f600
jmp fcn.004f38a0
Function at 0x509680
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x5097cc
push rbp
mov rbp, rsp
sub rsp, 0x70
movabs rdx, 0x65f9b5cdccedf0c5
mov qword [rsp + 0x1a], rdx
movabs rdx, 0xc36faecb65f9b5cd
mov qword [rsp + 0x1e], rdx
movabs rdx, 0xc7ac6e6eb5f9b79f
mov qword [rsp + 0x26], rdx
movabs rdx, 0xcdd4706dd163bb67
mov qword [rsp + 0x2e], rdx
movabs rdx, 0xcc782ab3750df05a
mov qword [rsp + 0x36], rdx
movabs rdx, 0x813171a1e021d21
mov qword [rsp + 0x3e], rdx
movabs rdx, 0x11b0813171a1e02
mov qword [rsp + 0x40], rdx
movabs rdx, 0xf0b061d09201e22
mov qword [rsp + 0x48], rdx
movabs rdx, 0xe0204030b032100
mov qword [rsp + 0x50], rdx
movabs rdx, 0x211c151e041b0c23
mov qword [rsp + 0x58], rdx
movabs rdx, 0x2120d1c1c150c05
mov qword [rsp + 0x60], rdx
movabs rdx, 0x211321060c0c051d
mov qword [rsp + 0x68], rdx
xor eax, eax
jmp 0x509764
movzx r9d, byte [rsp + rsi + 0x1a]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x76]
mov byte [rsp + rdi + 0x1a], dl
mov byte [rsp + rsi + 0x1a], r8b
add rax, 2
cmp rax, 0x32
jge 0x50979c
movzx edx, byte [rsp + rax + 0x3e]
movzx esi, byte [rsp + rax + 0x3f]
mov edi, edx
xor edx, esi
add edx, eax
nop word [rax + rax]
cmp rdi, 0x24
jae 0x5097bf
movzx r8d, byte [rsp + rdi + 0x1a]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x76]
cmp rsi, 0x24
jb 0x50974a
jmp 0x5097b3
xor eax, eax
lea rbx, [rsp + 0x1a]
mov ecx, 0x24
call fcn.00441380
add rsp, 0x70
pop rbp
ret
mov eax, esi
mov ecx, 0x24
call fcn.00451880
mov eax, edi
mov ecx, 0x24
call fcn.00451880
nop
call fcn.0044f600
jmp fcn.00509680

Function at 0x50b440
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x50b52c
push rbp
mov rbp, rsp
sub rsp, 0x40
movabs rdx, 0xdf2df12933241130
mov qword [rsp + 0x19], rdx
movabs rdx, 0x1bdf2df129332411
mov qword [rsp + 0x1a], rdx
movabs rdx, 0xeb37fc3918424139
mov qword [rsp + 0x22], rdx
movabs rdx, 0xe0705100c040e10
mov qword [rsp + 0x2a], rdx
movabs rdx, 0x4080d0f04010e07
mov qword [rsp + 0x30], rdx
movabs rdx, 0x100607020c020e0c
mov qword [rsp + 0x38], rdx
xor eax, eax
jmp 0x50b4ca
movzx r9d, byte [rsp + rsi + 0x19]
lea edx, [r9 + rdx]
lea edx, [rdx + 1]
mov byte [rsp + rdi + 0x19], dl
mov byte [rsp + rsi + 0x19], r8b
add rax, 2
cmp rax, 0x16
jge 0x50b4fc
movzx edx, byte [rsp + rax + 0x2a]
movzx esi, byte [rsp + rax + 0x2b]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x11
jae 0x50b51f
movzx r8d, byte [rsp + rdi + 0x19]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 1]
cmp rsi, 0x11
jb 0x50b4b0
jmp 0x50b513
xor eax, eax
lea rbx, [rsp + 0x19]
mov ecx, 0x11
call fcn.00441380
add rsp, 0x40
pop rbp
ret
mov eax, esi
mov ecx, 0x11
call fcn.00451880
mov eax, edi
mov ecx, 0x11
call fcn.00451880
nop
call fcn.0044f600
jmp fcn.0050b440
Function at 0x50bc00
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x50bcea
push rbp
mov rbp, rsp
sub rsp, 0x48
movabs rdx, 0x354a65697eabb04c
mov qword [rsp + 0x1f], rdx
movabs rdx, 0xcb354a65697eabb0
mov qword [rsp + 0x20], rdx
movabs rdx, 0x7866656463cc54ac
mov qword [rsp + 0x28], rdx
movabs rdx, 0x909020201040909
mov qword [rsp + 0x30], rdx
movabs rdx, 0x9000a0103060706
mov qword [rsp + 0x38], rdx
movabs rdx, 0x60b050b09010807
mov qword [rsp + 0x40], rdx
xor eax, eax
jmp 0x50bc8d
movzx r9d, byte [rsp + rsi + 0x1f]
sub r9d, edx
lea edx, [r9 - 0x75]
mov byte [rsp + rdi + 0x1f], dl
lea edx, [r8 - 0x75]
mov byte [rsp + rsi + 0x1f], dl
add rax, 2
cmp rax, 0x18
jge 0x50bcba
movzx edx, byte [rsp + rax + 0x30]
movzx esi, byte [rsp + rax + 0x31]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x11
jae 0x50bcdd
movzx r8d, byte [rsp + rdi + 0x1f]
sub r8d, edx
cmp rsi, 0x11
jb 0x50bc70
jmp 0x50bcd1
xor eax, eax
lea rbx, [rsp + 0x1f]
mov ecx, 0x11
call fcn.00441380
add rsp, 0x48
pop rbp
ret
mov eax, esi
mov ecx, 0x11
call fcn.00451880
mov eax, edi
mov ecx, 0x11
call fcn.00451880
nop
call fcn.0044f600
jmp fcn.0050bc00

Function at 0x511180
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x511247
push rbp
mov rbp, rsp
sub rsp, 0x30
movabs rdx, 0x8867736b4d476573
mov qword [rsp + 0x19], rdx
movabs rdx, 0x9265768867736b4d
mov qword [rsp + 0x1c], rdx
movabs rdx, 0x207020806040200
mov qword [rsp + 0x24], rdx
mov dword [rsp + 0x2c], 0x206060a
xor eax, eax
jmp 0x5111e8
movzx r9d, byte [rsp + rsi + 0x19]
sub r9d, edx
lea edx, [r9 + 2]
mov byte [rsp + rdi + 0x19], dl
lea edx, [r8 + 2]
mov byte [rsp + rsi + 0x19], dl
add rax, 2
cmp rax, 0xc
jge 0x511217
movzx edx, byte [rsp + rax + 0x24]
movzx esi, byte [rsp + rax + 0x25]
mov edi, edx
xor edx, esi
add edx, eax
nop
cmp rdi, 0xb
jae 0x51123a
movzx r8d, byte [rsp + rdi + 0x19]
sub r8d, edx
cmp rsi, 0xb
jb 0x5111cb
jmp 0x51122e
xor eax, eax
lea rbx, [rsp + 0x19]
mov ecx, 0xb
call fcn.00441380
add rsp, 0x30
pop rbp
ret
mov eax, esi
mov ecx, 0xb
call fcn.00451880
mov eax, edi
mov ecx, 0xb
call fcn.00451880
nop
call fcn.0044f600
jmp fcn.00511180
Function at 0x511c40
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x511d07
push rbp
mov rbp, rsp
sub rsp, 0x38
movabs rdx, 0x7380eef76460d4d9
mov qword [rsp + 0x1c], rdx
mov dword [rsp + 0x24], 0x5780f5e1
movabs rdx, 0x6080a0502000800
mov qword [rsp + 0x28], rdx
movabs rdx, 0x509040600010802
mov qword [rsp + 0x30], rdx
xor eax, eax
jmp 0x511ca8
movzx r9d, byte [rsp + rsi + 0x1c]
sub r9d, edx
lea edx, [r9 - 0x76]
mov byte [rsp + rdi + 0x1c], dl
lea edx, [r8 - 0x76]
mov byte [rsp + rsi + 0x1c], dl
add rax, 2
cmp rax, 0x10
jge 0x511cd7
movzx edx, byte [rsp + rax + 0x28]
movzx esi, byte [rsp + rax + 0x29]
mov edi, edx
xor edx, esi
add edx, eax
nop
cmp rdi, 0xc
jae 0x511cfa
movzx r8d, byte [rsp + rdi + 0x1c]
sub r8d, edx
cmp rsi, 0xc
jb 0x511c8b
jmp 0x511cee
xor eax, eax
lea rbx, [rsp + 0x1c]
mov ecx, 0xc
call fcn.00441380
add rsp, 0x38
pop rbp
ret
mov eax, esi
mov ecx, 0xc
call fcn.00451880
mov eax, edi
mov ecx, 0xc
call fcn.00451880
nop
call fcn.0044f600
jmp fcn.00511c40

Function at 0x512700
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x5127ea
push rbp
mov rbp, rsp
sub rsp, 0x48
movabs rdx, 0x4e41654f454c4546
mov qword [rsp + 0x19], rdx
movabs rdx, 0x506b72342942444e
mov qword [rsp + 0x20], rdx
movabs rdx, 0x3b654f6b61455a6f
mov qword [rsp + 0x28], rdx
movabs rdx, 0x9080d100e13030b
mov qword [rsp + 0x30], rdx
movabs rdx, 0x1314020701001611
mov qword [rsp + 0x38], rdx
movabs rdx, 0x1010a04001603
mov qword [rsp + 0x40], rdx
xor eax, eax
jmp 0x51278d
movzx r9d, byte [rsp + rsi + 0x19]
sub r9d, edx
lea edx, [r9 + 0x28]
mov byte [rsp + rdi + 0x19], dl
lea edx, [r8 + 0x28]
mov byte [rsp + rsi + 0x19], dl
add rax, 2
cmp rax, 0x18
jge 0x5127ba
movzx edx, byte [rsp + rax + 0x30]
movzx esi, byte [rsp + rax + 0x31]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x17
jae 0x5127dd
movzx r8d, byte [rsp + rdi + 0x19]
sub r8d, edx
cmp rsi, 0x17
jb 0x512770
jmp 0x5127d1
xor eax, eax
lea rbx, [rsp + 0x19]
mov ecx, 0x17
call fcn.00441380
add rsp, 0x48
pop rbp
ret
mov eax, esi
mov ecx, 0x17
call fcn.00451880
mov eax, edi
mov ecx, 0x17
call fcn.00451880
nop
call fcn.0044f600
jmp fcn.00512700
Function at 0x514f20
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x514fec
push rbp
mov rbp, rsp
sub rsp, 0x38
movabs rdx, 0xafc7706f43481cec
mov qword [rsp + 0x1b], rdx
movabs rdx, 0xc79b17bcffafc770
mov qword [rsp + 0x20], rdx
movabs rdx, 0xc060b0700080702
mov qword [rsp + 0x28], rdx
movabs rdx, 0x10a0008090b010a
mov qword [rsp + 0x30], rdx
xor eax, eax
jmp 0x514f8f
movzx r9d, byte [rsp + rsi + 0x1b]
sub r9d, edx
lea edx, [r9 - 0x3e]
mov byte [rsp + rdi + 0x1b], dl
lea edx, [r8 - 0x3e]
mov byte [rsp + rsi + 0x1b], dl
add rax, 2
cmp rax, 0x10
jge 0x514fbc
movzx edx, byte [rsp + rax + 0x28]
movzx esi, byte [rsp + rax + 0x29]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0xd
jae 0x514fdf
movzx r8d, byte [rsp + rdi + 0x1b]
sub r8d, edx
cmp rsi, 0xd
jb 0x514f72
jmp 0x514fd3
xor eax, eax
lea rbx, [rsp + 0x1b]
mov ecx, 0xd
call fcn.00441380
add rsp, 0x38
pop rbp
ret
mov eax, esi
mov ecx, 0xd
call fcn.00451880
mov eax, edi
mov ecx, 0xd
call fcn.00451880
nop
call fcn.0044f600
jmp fcn.00514f20
Function at 0x1400118d0
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x10], rbx
push rsi
push rdi
push r14
sub rsp, 0x50
mov r14, r8
mov rdi, rdx
test rcx, rcx
jne 0x1400118f0
mov rdx, qword [rdx]
jmp 0x140011985
test r14, r14
jne 0x1400118fd
mov rdx, qword [rdx]
jmp 0x140011985
xor esi, esi
xor eax, eax
mov qword [r8], rax
mov rdx, 0xffffffff80000002
mov qword [r8 + 8], rax
mov qword [r8 + 0x10], rax
mov r8, rcx
lea rcx, [rsp + 0x38]
mov qword [rsp + 0x38], rsi
lea r9d, [rsi + 1]
mov dword [rsp + 0x40], esi
mov qword [rsp + 0x48], rsi
mov dword [rsp + 0x70], esi
call fcn.14000ddf0
test eax, eax
je 0x140011946
mov rcx, qword [rsp + 0x38]
test rcx, rcx
je 0x140011982
jmp 0x14001197c
mov rbx, qword [rsp + 0x38]
lea r9, [rsp + 0x70]
mov rdx, qword [rdi]
mov rcx, rbx
mov qword [rsp + 0x28], rsi
xor r8d, r8d
mov qword [rsp + 0x20], rsi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x140011974
cmp dword [rsp + 0x70], 4
je 0x1400119b1
test rbx, rbx
je 0x140011982
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rdx, qword [rdi]
sub rdx, 0x18
mov eax, 0xffffffff
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x1400119a1
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
xor eax, eax
mov rbx, qword [rsp + 0x78]
add rsp, 0x50
pop r14
pop rdi
pop rsi
ret
mov eax, SafeArrayUnaccessData
mov dword [rsp + 0x88], 4
mov word [r14], ax
lea rcx, [rsp + 0x88]
mov rdx, qword [rdi]
lea rax, [r14 + 8]
mov qword [rsp + 0x28], rcx
lea r9, [rsp + 0x30]
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x140011a04
cmp dword [rsp + 0x30], 4
mov eax, esi
mov ecx, SafeArrayGetDim
cmovne eax, ecx
test eax, eax
sete sil
test rbx, rbx
je 0x140011a16
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rdx, qword [rdi]
mov eax, 0xffffffff
sub rdx, 0x18
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140011a36
mov rcx, qword [rdx]
mov r8, qword [rcx]
call qword [rreloc.OLEAUT32.dll_VariantClear + 8]
mov rbx, qword [rsp + 0x78]
mov eax, esi
add rsp, 0x50
pop r14
pop rdi
pop rsi
ret