joyce8/EMBER2024-capa huggingface dataset:
Function at 0x52ff00
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
movd xmm0, dword [rsp + 8]
mov rsi, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
movdqu xmm1, xmmword [rsi]
movdqu xmm2, xmmword [rsi + 0x10]
movdqu xmm3, xmmword [rsi + 0x20]
movdqu xmm4, xmmword [rsi + 0x30]
pxor xmm1, xmm0
add rsi, 0x40
sub rcx, 0x40
cmp rcx, 0x40
jb 0x52ffd5
movdqa xmm0, xmmword [0x005ac780]
movdqa xmm5, xmm1
movdqa xmm6, xmm2
movdqa xmm7, xmm3
movdqa xmm8, xmm4
pclmulqdq xmm1, xmm0, 0
pclmulqdq xmm2, xmm0, 0
pclmulqdq xmm3, xmm0, 0
pclmulqdq xmm4, xmm0, 0
movdqu xmm11, xmmword [rsi]
movdqu xmm12, xmmword [rsi + 0x10]
movdqu xmm13, xmmword [rsi + 0x20]
movdqu xmm14, xmmword [rsi + 0x30]
pclmulqdq xmm5, xmm0, 0x11
pclmulqdq xmm6, xmm0, 0x11
pclmulqdq xmm7, xmm0, 0x11
pclmulqdq xmm8, xmm0, 0x11
pxor xmm1, xmm5
pxor xmm2, xmm6
pxor xmm3, xmm7
pxor xmm4, xmm8
pxor xmm1, xmm11
pxor xmm2, xmm12
pxor xmm3, xmm13
pxor xmm4, xmm14
add rdi, 0x40
add rsi, 0x40
sub rcx, 0x40
cmp rcx, 0x40
jge 0x52ff41
movdqa xmm0, xmmword [0x005ac790]
movdqa xmm5, xmm1
pclmulqdq xmm1, xmm0, 0
pclmulqdq xmm5, xmm0, 0x11
pxor xmm1, xmm5
pxor xmm1, xmm2
movdqa xmm5, xmm1
pclmulqdq xmm1, xmm0, 0
pclmulqdq xmm5, xmm0, 0x11
pxor xmm1, xmm5
pxor xmm1, xmm3
movdqa xmm5, xmm1
pclmulqdq xmm1, xmm0, 0
pclmulqdq xmm5, xmm0, 0x11
pxor xmm1, xmm5
pxor xmm1, xmm4
cmp rcx, 0x10
jb 0x530057
movdqu xmm10, xmmword [rsi]
movdqa xmm5, xmm1
pclmulqdq xmm1, xmm0, 0
pclmulqdq xmm5, xmm0, 0x11
pxor xmm1, xmm5
pxor xmm1, xmm10
sub rcx, 0x10
add rsi, 0x10
cmp rcx, 0x10
jge 0x53002b
pcmpeqb xmm3, xmm3
pclmulqdq xmm0, xmm1, 1
psrldq xmm1, 8
pxor xmm1, xmm0
movdqa xmm2, xmm1
movq xmm0, qword [0x005ac618]
psrlq xmm3, 0x20
psrldq xmm2, 4
pand xmm1, xmm3
pclmulqdq xmm1, xmm0, 0
pxor xmm1, xmm2
movdqa xmm0, xmmword [0x005ac7a0]
movdqa xmm2, xmm1
pand xmm1, xmm3
pclmulqdq xmm1, xmm0, 0x10
pand xmm1, xmm3
pclmulqdq xmm1, xmm0, 0
pxor xmm1, xmm2
pextrd eax, xmm1, 1
mov dword [rsp + 0x28], eax
ret
Function at 0x5318e0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
lea r12, [rsp - 0x30]
cmp r12, qword [r14 + 0x10]
jbe 0x531a9b
push rbp
mov rbp, rsp
sub rsp, 0xa8
movabs rdx, 0xba47de71db43c841
mov qword [rsp + 0x1e], rdx
movabs rdx, 0xbe77d04d1e0fe4d7
mov qword [rsp + 0x26], rdx
movabs rdx, 0xe65aa3554a53cc7f
mov qword [rsp + 0x2e], rdx
movabs rdx, 0x6665d8ff62615aa2
mov qword [rsp + 0x36], rdx
movabs rdx, 0xd4d56c7f3ef1daeb
mov qword [rsp + 0x3e], rdx
movabs rdx, 0x767bd6f91c09927f
mov qword [rsp + 0x46], rdx
movabs rdx, 0x28aa315333ed78a1
mov qword [rsp + 0x4e], rdx
movabs rdx, 0x2f2b10c737a6bd0f
mov qword [rsp + 0x56], rdx
movabs rdx, 0x152d33273c132808
mov qword [rsp + 0x5e], rdx
movabs rdx, 0x92a0f1618390e34
mov qword [rsp + 0x66], rdx
movabs rdx, 0x524092a0f161839
mov qword [rsp + 0x68], rdx
movabs rdx, 0x3c08043718012d23
mov qword [rsp + 0x70], rdx
movabs rdx, 0xd11100e09371c30
mov qword [rsp + 0x78], rdx
movabs rdx, 0x2d0e3a3626213d03
mov qword [rsp + 0x80], rdx
movabs rdx, 0x43707323c292837
mov qword [rsp + 0x88], rdx
movabs rdx, 0x3723171d031d1c29
mov qword [rsp + 0x90], rdx
movabs rdx, 0x2c2e20050a220134
mov qword [rsp + 0x98], rdx
movabs rdx, 0x2b320f383c270b2c
mov qword [rsp + 0xa0], rdx
xor eax, eax
jmp 0x531a38
movzx r9d, byte [rsp + rsi + 0x1e]
sub r9d, edx
lea edx, [r9 - 0x42]
mov byte [rsp + rdi + 0x1e], dl
lea edx, [r8 - 0x42]
mov byte [rsp + rsi + 0x1e], dl
add rax, 2
cmp rax, 0x4a
jge 0x531a68
movzx edx, byte [rsp + rax + 0x5e]
movzx esi, byte [rsp + rax + 0x5f]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x40
jae 0x531a8e
movzx r8d, byte [rsp + rdi + 0x1e]
sub r8d, edx
nop dword [rax]
cmp rsi, 0x40
jb 0x531a1b
jmp 0x531a82
xor eax, eax
lea rbx, [rsp + 0x1e]
mov ecx, 0x40
call fcn.00445b60
add rsp, 0xa8
pop rbp
ret
mov eax, esi
mov ecx, 0x40
call fcn.00457ea0
mov eax, edi
mov ecx, 0x40
call fcn.00457ea0
nop
nop dword [rax + rax]
call fcn.00455c20
jmp fcn.005318e0
Function at 0x531ac0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
lea r12, [rsp - 0x38]
cmp r12, qword [r14 + 0x10]
jbe 0x531c1b
push rbp
mov rbp, rsp
sub rsp, 0xb0
movabs rdx, 0xbcd3741712094209
mov qword [rsp + 0x18], rdx
movabs rdx, 0x3c4ffa71dc4b4a49
mov qword [rsp + 0x20], rdx
movabs rdx, 0x7d575655a0535251
mov qword [rsp + 0x28], rdx
movabs rdx, 0xf865b16322e70d0f
mov qword [rsp + 0x30], rdx
movabs rdx, 0x6ecff6bb172cb167
mov qword [rsp + 0x38], rdx
movabs rdx, 0x2c3df5738c67c66f
mov qword [rsp + 0x40], rdx
movabs rdx, 0xa632e409525b8aeb
mov qword [rsp + 0x48], rdx
movabs rdx, 0x412d396b187ce491
mov qword [rsp + 0x50], rdx
movabs rdx, 0x30331b222e1b1322
mov qword [rsp + 0x58], rdx
lea rdi, [rsp + 0x60]
lea rsi, [0x005ae900]
nop word [rax + rax]
nop word [rax + rax]
nop
mov qword [rsp - 0x10], rbp
lea rbp, [rsp - 0x10]
call fcn.004584fa
mov rbp, qword [rbp]
xor eax, eax
jmp 0x531bb1
movzx r9d, byte [rsp + rsi + 0x18]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x1c]
mov byte [rsp + rdi + 0x18], dl
mov byte [rsp + rsi + 0x18], r8b
add rax, 2
cmp rax, 0x58
jge 0x531be8
movzx edx, byte [rsp + rax + 0x58]
movzx esi, byte [rsp + rax + 0x59]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x40
jae 0x531c0e
movzx r8d, byte [rsp + rdi + 0x18]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x1c]
nop dword [rax + rax]
cmp rsi, 0x40
jb 0x531b97
jmp 0x531c02
xor eax, eax
lea rbx, [rsp + 0x18]
mov ecx, 0x40
call fcn.00445b60
add rsp, 0xb0
pop rbp
ret
mov eax, esi
mov ecx, 0x40
call fcn.00457ea0
mov eax, edi
mov ecx, 0x40
call fcn.00457ea0
nop
nop dword [rax + rax]
call fcn.00455c20
jmp fcn.00531ac0
Function at 0x5368a0
Capabilities:
Hash data using fnv

Disassembly:
test byte [rax], al
mov rcx, rbx
and ebx, 0x7f
shl rbx, 5
lea rdx, [rax + rbx]
xor eax, eax
jmp 0x5368b7
inc rax
cmp rax, 4
jge 0x5368cf
lea rbx, [rdx + rax*8]
mov rbx, qword [rbx]
cmp rbx, rcx
jne 0x5368b4
mov eax, 1
ret
xor eax, eax
movabs rbx, 0xcbf29ce484222325
jmp 0x5368e0
inc rax
cmp rax, 4
jge 0x5368ee
mov rsi, qword [rdx + rax*8]
xor edi, edi
jmp 0x536917
and ebx, 3
lea rdx, [rdx + rbx*8]
xchg qword [rdx], rcx
xor eax, eax
ret
movzx r8d, sil
xor rbx, r8
inc rdi
shr rsi, 8
movabs r8, 0x100000001b3
imul rbx, r8
cmp rdi, 8
jl 0x5368fb
jmp 0x5368dd

Function at 0x536920
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x536a4c
push rbp
mov rbp, rsp
sub rsp, 0x68
movabs rdx, 0x262274146573691f
mov qword [rsp + 0x1b], rdx
movabs rdx, 0x2039467350262274
mov qword [rsp + 0x20], rdx
movabs rdx, 0x4a6365fd2b605968
mov qword [rsp + 0x28], rdx
movabs rdx, 0x6d5967723b441b27
mov qword [rsp + 0x30], rdx
movabs rdx, 0x65701a2d20746e60
mov qword [rsp + 0x38], rdx
movabs rdx, 0x1d0f160a140a060a
mov qword [rsp + 0x40], rdx
movabs rdx, 0x821170410180b15
mov qword [rsp + 0x48], rdx
movabs rdx, 0x4220e141807110a
mov qword [rsp + 0x50], rdx
movabs rdx, 0x1b0a0006150e1b18
mov qword [rsp + 0x58], rdx
movabs rdx, 0x1b04110008100d0d
mov qword [rsp + 0x60], rdx
xor eax, eax
jmp 0x5369e6
movzx r9d, byte [rsp + rsi + 0x1b]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x13]
mov byte [rsp + rdi + 0x1b], dl
mov byte [rsp + rsi + 0x1b], r8b
add rax, 2
cmp rax, 0x28
jge 0x536a1c
movzx edx, byte [rsp + rax + 0x40]
movzx esi, byte [rsp + rax + 0x41]
mov edi, edx
xor edx, esi
add edx, eax
nop dword [rax]
cmp rdi, 0x25
jae 0x536a3f
movzx r8d, byte [rsp + rdi + 0x1b]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x13]
cmp rsi, 0x25
jb 0x5369cc
jmp 0x536a33
xor eax, eax
lea rbx, [rsp + 0x1b]
mov ecx, 0x25
call fcn.00445b60
add rsp, 0x68
pop rbp
ret
mov eax, esi
mov ecx, 0x25
call fcn.00457ea0
mov eax, edi
mov ecx, 0x25
call fcn.00457ea0
nop
call fcn.00455c20
jmp fcn.00536920
Function at 0x543160
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x54322c
push rbp
mov rbp, rsp
sub rsp, 0x38
movabs rdx, 0xe8d6a291749aed20
mov qword [rsp + 0x1f], rdx
movabs rdx, 0xa20e0e8d6a29174
mov qword [rsp + 0x22], rdx
movabs rdx, 0x705010204060909
mov qword [rsp + 0x2a], rdx
movabs rdx, 0x809090701080705
mov qword [rsp + 0x30], rdx
xor eax, eax
jmp 0x5431cf
movzx r9d, byte [rsp + rsi + 0x1f]
sub r9d, edx
lea edx, [r9 - 0x6d]
mov byte [rsp + rdi + 0x1f], dl
lea edx, [r8 - 0x6d]
mov byte [rsp + rsi + 0x1f], dl
add rax, 2
cmp rax, 0xe
jge 0x5431fc
movzx edx, byte [rsp + rax + 0x2a]
movzx esi, byte [rsp + rax + 0x2b]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0xb
jae 0x54321f
movzx r8d, byte [rsp + rdi + 0x1f]
sub r8d, edx
cmp rsi, 0xb
jb 0x5431b2
jmp 0x543213
xor eax, eax
lea rbx, [rsp + 0x1f]
mov ecx, 0xb
call fcn.00445b60
add rsp, 0x38
pop rbp
ret
mov eax, esi
mov ecx, 0xb
call fcn.00457ea0
mov eax, edi
mov ecx, 0xb
call fcn.00457ea0
nop
call fcn.00455c20
jmp fcn.00543160

Function at 0x543280
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x54336c
push rbp
mov rbp, rsp
sub rsp, 0x48
movabs rdx, 0x69148d60b4736fc3
mov qword [rsp + 0x1f], rdx
movabs rdx, 0xc469148d60b4736f
mov qword [rsp + 0x20], rdx
movabs rdx, 0x9d4db58dfa1af1ab
mov qword [rsp + 0x28], rdx
movabs rdx, 0x60e080b0f0b000a
mov qword [rsp + 0x30], rdx
movabs rdx, 0x303030e0f05030c
mov qword [rsp + 0x38], rdx
movabs rdx, 0xf0007080410090d
mov qword [rsp + 0x40], rdx
xor eax, eax
jmp 0x54330a
movzx r9d, byte [rsp + rsi + 0x1f]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x5e]
mov byte [rsp + rdi + 0x1f], dl
mov byte [rsp + rsi + 0x1f], r8b
add rax, 2
cmp rax, 0x18
jge 0x54333c
movzx edx, byte [rsp + rax + 0x30]
movzx esi, byte [rsp + rax + 0x31]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x11
jae 0x54335f
movzx r8d, byte [rsp + rdi + 0x1f]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x5e]
cmp rsi, 0x11
jb 0x5432f0
jmp 0x543353
xor eax, eax
lea rbx, [rsp + 0x1f]
mov ecx, 0x11
call fcn.00445b60
add rsp, 0x48
pop rbp
ret
mov eax, esi
mov ecx, 0x11
call fcn.00457ea0
mov eax, edi
mov ecx, 0x11
call fcn.00457ea0
nop
call fcn.00455c20
jmp fcn.00543280
Function at 0x544400
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x5444ea
push rbp
mov rbp, rsp
sub rsp, 0x48
movabs rdx, 0x64e2ad6d636978b3
mov qword [rsp + 0x1f], rdx
movabs rdx, 0x6c64e2ad6d636978
mov qword [rsp + 0x20], rdx
movabs rdx, 0xbf6d43146f04edd1
mov qword [rsp + 0x28], rdx
movabs rdx, 0x100a050710040610
mov qword [rsp + 0x30], rdx
movabs rdx, 0x2021010020b0b
mov qword [rsp + 0x38], rdx
movabs rdx, 0x10090a0a0c0b0c0d
mov qword [rsp + 0x40], rdx
xor eax, eax
jmp 0x54448d
movzx r9d, byte [rsp + rsi + 0x1f]
sub r9d, edx
lea edx, [r9 - 0x3e]
mov byte [rsp + rdi + 0x1f], dl
lea edx, [r8 - 0x3e]
mov byte [rsp + rsi + 0x1f], dl
add rax, 2
cmp rax, 0x18
jge 0x5444ba
movzx edx, byte [rsp + rax + 0x30]
movzx esi, byte [rsp + rax + 0x31]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x11
jae 0x5444dd
movzx r8d, byte [rsp + rdi + 0x1f]
sub r8d, edx
cmp rsi, 0x11
jb 0x544470
jmp 0x5444d1
xor eax, eax
lea rbx, [rsp + 0x1f]
mov ecx, 0x11
call fcn.00445b60
add rsp, 0x48
pop rbp
ret
mov eax, esi
mov ecx, 0x11
call fcn.00457ea0
mov eax, edi
mov ecx, 0x11
call fcn.00457ea0
nop
call fcn.00455c20
jmp fcn.00544400

Function at 0x544500
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x5445ec
push rbp
mov rbp, rsp
sub rsp, 0x48
movabs rdx, 0xe04720f32065bb65
mov qword [rsp + 0x1b], rdx
movabs rdx, 0x792222e159e04720
mov qword [rsp + 0x20], rdx
movabs rdx, 0x646591a361ec7341
mov qword [rsp + 0x28], rdx
movabs rdx, 0xf06120d0d080601
mov qword [rsp + 0x30], rdx
movabs rdx, 0xa030d0704090b06
mov qword [rsp + 0x38], rdx
movabs rdx, 0x40707110412090f
mov qword [rsp + 0x40], rdx
xor eax, eax
jmp 0x54458a
movzx r9d, byte [rsp + rsi + 0x1b]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x2a]
mov byte [rsp + rdi + 0x1b], dl
mov byte [rsp + rsi + 0x1b], r8b
add rax, 2
cmp rax, 0x18
jge 0x5445bc
movzx edx, byte [rsp + rax + 0x30]
movzx esi, byte [rsp + rax + 0x31]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x15
jae 0x5445df
movzx r8d, byte [rsp + rdi + 0x1b]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x2a]
cmp rsi, 0x15
jb 0x544570
jmp 0x5445d3
xor eax, eax
lea rbx, [rsp + 0x1b]
mov ecx, 0x15
call fcn.00445b60
add rsp, 0x48
pop rbp
ret
mov eax, esi
mov ecx, 0x15
call fcn.00457ea0
mov eax, edi
mov ecx, 0x15
call fcn.00457ea0
nop
call fcn.00455c20
jmp fcn.00544500
Function at 0x544600
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x5446e6
push rbp
mov rbp, rsp
sub rsp, 0x40
movabs rdx, 0x356e20dd82659ec5
mov qword [rsp + 0x1e], rdx
movabs rdx, 0xcecfd16d6d9a48a2
mov qword [rsp + 0x26], rdx
movabs rdx, 0xf0d0407090e0a09
mov qword [rsp + 0x2e], rdx
movabs rdx, 0x3080f0d0407090e
mov qword [rsp + 0x30], rdx
movabs rdx, 0xe0a0a04010403
mov qword [rsp + 0x38], rdx
xor eax, eax
nop
jmp 0x544680
movzx r9d, byte [rsp + rsi + 0x1e]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x75]
mov byte [rsp + rdi + 0x1e], dl
mov byte [rsp + rsi + 0x1e], r8b
add rax, 2
nop dword [rax]
cmp rax, 0x12
jge 0x5446b2
movzx edx, byte [rsp + rax + 0x2e]
movzx esi, byte [rsp + rax + 0x2f]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x10
jae 0x5446d7
movzx r8d, byte [rsp + rdi + 0x1e]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x75]
cmp rsi, 0x10
jb 0x544662
jmp 0x5446cb
xor eax, eax
lea rbx, [rsp + 0x1e]
mov ecx, 0x10
nop
call fcn.00445b60
add rsp, 0x40
pop rbp
ret
mov eax, esi
mov ecx, 0x10
call fcn.00457ea0
mov eax, edi
mov ecx, 0x10
nop
call fcn.00457ea0
nop
call fcn.00455c20
jmp fcn.00544600

Function at 0x544700
Capabilities:
Encrypt data using rc4 prga

Disassembly:
lea r12, [rsp - 0x30]
cmp r12, qword [r14 + 0x10]
jbe 0x5448bb
push rbp
mov rbp, rsp
sub rsp, 0xa8
movabs rdx, 0x6f8d202d633f3221
mov qword [rsp + 0x19], rdx
movabs rdx, 0x77205d516c6dc86f
mov qword [rsp + 0x20], rdx
movabs rdx, 0xd96e20612068746c
mov qword [rsp + 0x28], rdx
movabs rdx, 0xc74320b03b6ed922
mov qword [rsp + 0x30], rdx
movabs rdx, 0x4e0f5a2064746310
mov qword [rsp + 0x38], rdx
movabs rdx, 0x5b866357526f3120
mov qword [rsp + 0x40], rdx
movabs rdx, 0xeccc3e185e657461
mov qword [rsp + 0x48], rdx
movabs rdx, 0x84656c6d09439568
mov qword [rsp + 0x50], rdx
movabs rdx, 0xee542f684ac60f1c
mov qword [rsp + 0x58], rdx
movabs rdx, 0x420b060035104301
mov qword [rsp + 0x60], rdx
movabs rdx, 0x213c2e1732253438
mov qword [rsp + 0x68], rdx
movabs rdx, 0x1844401043081b44
mov qword [rsp + 0x70], rdx
movabs rdx, 0x260c4045242d2e10
mov qword [rsp + 0x78], rdx
movabs rdx, 0x3f1606332833100a
mov qword [rsp + 0x80], rdx
movabs rdx, 0x3622441f3d2a3e41
mov qword [rsp + 0x88], rdx
movabs rdx, 0x3a28324604430b0f
mov qword [rsp + 0x90], rdx
movabs rdx, 0x281e163a3f453e25
mov qword [rsp + 0x98], rdx
movabs rdx, 0x282b021a41222d25
mov qword [rsp + 0xa0], rdx
xor eax, eax
jmp 0x544855
movzx r9d, byte [rsp + rsi + 0x19]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x32]
mov byte [rsp + rdi + 0x19], dl
mov byte [rsp + rsi + 0x19], r8b
add rax, 2
cmp rax, 0x48
jge 0x544888
movzx edx, byte [rsp + rax + 0x60]
movzx esi, byte [rsp + rax + 0x61]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x47
jae 0x5448ae
movzx r8d, byte [rsp + rdi + 0x19]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x32]
nop
cmp rsi, 0x47
jb 0x54483b
jmp 0x5448a2
xor eax, eax
lea rbx, [rsp + 0x19]
mov ecx, 0x47
call fcn.00445b60
add rsp, 0xa8
pop rbp
ret
mov eax, esi
mov ecx, 0x47
call fcn.00457ea0
mov eax, edi
mov ecx, 0x47
call fcn.00457ea0
nop
nop dword [rax + rax]
call fcn.00455c20
jmp fcn.00544700
Function at 0x549560
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x549632
push rbp
mov rbp, rsp
sub rsp, 0x38
movabs rdx, 0x2573664f696d642e
mov qword [rsp + 0x2a], rdx
movabs rdx, 0x6c77756439672573
mov qword [rsp + 0x30], rdx
movabs rdx, 0x900050700000a0a
mov qword [rsp + 0x1c], rdx
movabs rdx, 0x909000400090900
mov qword [rsp + 0x22], rdx
xor eax, eax
jmp 0x5495cc
movzx r9d, byte [rsp + rsi + 0x2a]
lea edx, [r9 + rdx]
lea edx, [rdx + 4]
mov byte [rsp + rdi + 0x2a], dl
mov byte [rsp + rsi + 0x2a], r8b
add rax, 2
cmp rax, 0xe
jge 0x5495fe
movzx edx, byte [rsp + rax + 0x1c]
movzx esi, byte [rsp + rax + 0x1d]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0xe
jae 0x549625
movzx r8d, byte [rsp + rdi + 0x2a]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 4]
cmp rsi, 0xe
jb 0x5495b2
jmp 0x549615
xor eax, eax
lea rbx, [rsp + 0x2a]
mov ecx, 0xe
call fcn.00445b60
add rsp, 0x38
pop rbp
ret
mov eax, esi
mov ecx, 0xe
nop dword [rax]
call fcn.00457ea0
mov eax, edi
mov ecx, 0xe
call fcn.00457ea0
nop
call fcn.00455c20
jmp fcn.00549560

Function at 0x549640
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x54972c
push rbp
mov rbp, rsp
sub rsp, 0x48
movabs rdx, 0xed412faf3361c166
mov qword [rsp + 0x1b], rdx
movabs rdx, 0x70252dd452ed412f
mov qword [rsp + 0x20], rdx
movabs rdx, 0x6d6458d431f76442
mov qword [rsp + 0x28], rdx
movabs rdx, 0xf06120d0d080601
mov qword [rsp + 0x30], rdx
movabs rdx, 0xa030d0704090b06
mov qword [rsp + 0x38], rdx
movabs rdx, 0x40707110412090f
mov qword [rsp + 0x40], rdx
xor eax, eax
jmp 0x5496ca
movzx r9d, byte [rsp + rsi + 0x1b]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x2a]
mov byte [rsp + rdi + 0x1b], dl
mov byte [rsp + rsi + 0x1b], r8b
add rax, 2
cmp rax, 0x18
jge 0x5496fc
movzx edx, byte [rsp + rax + 0x30]
movzx esi, byte [rsp + rax + 0x31]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x15
jae 0x54971f
movzx r8d, byte [rsp + rdi + 0x1b]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x2a]
cmp rsi, 0x15
jb 0x5496b0
jmp 0x549713
xor eax, eax
lea rbx, [rsp + 0x1b]
mov ecx, 0x15
call fcn.00445b60
add rsp, 0x48
pop rbp
ret
mov eax, esi
mov ecx, 0x15
call fcn.00457ea0
mov eax, edi
mov ecx, 0x15
call fcn.00457ea0
nop
call fcn.00455c20
jmp fcn.00549640
Function at 0x549740
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x54983b
push rbp
mov rbp, rsp
sub rsp, 0x48
movabs rdx, 0x23d1ce64dd14896a
mov qword [rsp + 0x1b], rdx
movabs rdx, 0xdfa1a423d1ce64dd
mov qword [rsp + 0x1e], rdx
movabs rdx, 0x10707548bc37df98
mov qword [rsp + 0x26], rdx
movabs rdx, 0x1002030b0f12090c
mov qword [rsp + 0x2e], rdx
movabs rdx, 0x602120e020a080a
mov qword [rsp + 0x36], rdx
movabs rdx, 0x5070602120e020a
mov qword [rsp + 0x38], rdx
movabs rdx, 0xb110a050e10010f
mov qword [rsp + 0x40], rdx
xor eax, eax
jmp 0x5497d9
movzx r9d, byte [rsp + rsi + 0x1b]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x75]
mov byte [rsp + rdi + 0x1b], dl
mov byte [rsp + rsi + 0x1b], r8b
add rax, 2
cmp rax, 0x1a
jge 0x54980b
movzx edx, byte [rsp + rax + 0x2e]
movzx esi, byte [rsp + rax + 0x2f]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x13
jae 0x54982e
movzx r8d, byte [rsp + rdi + 0x1b]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x75]
cmp rsi, 0x13
jb 0x5497bf
jmp 0x549822
xor eax, eax
lea rbx, [rsp + 0x1b]
mov ecx, 0x13
call fcn.00445b60
add rsp, 0x48
pop rbp
ret
mov eax, esi
mov ecx, 0x13
call fcn.00457ea0
mov eax, edi
mov ecx, 0x13
call fcn.00457ea0
nop
nop dword [rax + rax]
call fcn.00455c20
jmp fcn.00549740

Function at 0x549940
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x549a67
push rbp
mov rbp, rsp
sub rsp, 0x60
movabs rdx, 0xebc7f479ca6ed1c4
mov qword [rsp + 0x19], rdx
movabs rdx, 0x6361fe1d32732577
mov qword [rsp + 0x21], rdx
movabs rdx, 0x67bf4322306361fe
mov qword [rsp + 0x26], rdx
movabs rdx, 0x6fcfe9e1e176fafd
mov qword [rsp + 0x2e], rdx
movabs rdx, 0x703100f03090b0b
mov qword [rsp + 0x36], rdx
movabs rdx, 0x190c140b03060c06
mov qword [rsp + 0x3e], rdx
movabs rdx, 0x106190c140b0306
mov qword [rsp + 0x40], rdx
movabs rdx, 0x121903191a110001
mov qword [rsp + 0x48], rdx
movabs rdx, 0x810160b1002191b
mov qword [rsp + 0x50], rdx
movabs rdx, 0x1018150f1a05130d
mov qword [rsp + 0x58], rdx
xor eax, eax
jmp 0x549a09
movzx r9d, byte [rsp + rsi + 0x19]
sub r9d, edx
lea edx, [r9 - 0x50]
mov byte [rsp + rdi + 0x19], dl
lea edx, [r8 - 0x50]
mov byte [rsp + rsi + 0x19], dl
add rax, 2
cmp rax, 0x2a
jge 0x549a37
movzx edx, byte [rsp + rax + 0x36]
movzx esi, byte [rsp + rax + 0x37]
mov edi, edx
xor edx, esi
add edx, eax
nop
cmp rdi, 0x1d
jae 0x549a5a
movzx r8d, byte [rsp + rdi + 0x19]
sub r8d, edx
cmp rsi, 0x1d
jb 0x5499ec
jmp 0x549a4e
xor eax, eax
lea rbx, [rsp + 0x19]
mov ecx, 0x1d
call fcn.00445b60
add rsp, 0x60
pop rbp
ret
mov eax, esi
mov ecx, 0x1d
call fcn.00457ea0
mov eax, edi
mov ecx, 0x1d
call fcn.00457ea0
nop
call fcn.00455c20
jmp fcn.00549940

Function at 0x40534e
Capabilities:
Encode data using xor

Disassembly:
push rdx
xor esi, dword [rbx]
xor edi, dword [rbx + rsi]
xor esi, dword [rbx]
xchg byte [rbx], dh
invalid
Function at 0x10007510
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0xa0
mov dword [rsp + 0x20], 0
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetStartupInfoA]
nop
mov rax, qword gs:[0x30]
mov rbx, qword [rax + 8]
xor edi, edi
xor eax, eax
lock cmpxchg qword [0x10015150], rbx
je 0x10007566
cmp rax, rbx
jne 0x10007559
mov edi, 1
jmp 0x10007566
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x10007540
mov eax, dword [0x10015148]
cmp eax, 1
jne 0x1000757b
lea ecx, [rax + 0x1e]
call fcn.1017e000
jmp 0x100075ba
mov eax, dword [0x10015148]
test eax, eax
jne 0x100075b0
mov dword [0x10015148], 1
lea rdx, [0x100014d0]
lea rcx, [0x100014b8]
call sub.MSVCR80.dll__initterm_e
test eax, eax
je 0x100075ba
mov eax, 0xff
jmp 0x10007714
mov dword [0x10014314], 1
mov eax, dword [0x10015148]
cmp eax, 1
jne 0x100075e2
lea rdx, [0x100014b0]
lea rcx, [0x10001470]
call sub.MSVCR80.dll__initterm
mov dword [0x10015148], 2
test edi, edi
jne 0x100075ef
xor eax, eax
xchg qword [0x10015150], rax
cmp qword [0x10015168], 0
je 0x10007618
lea rcx, [0x10015168]
call fcn.10007b90
test eax, eax
je 0x10007618
xor r8d, r8d
lea edx, [r8 + 2]
xor ecx, ecx
call qword [0x10015168]
mov rax, qword [sym.imp.MSVCR80.dll__acmdln]
mov rbx, qword [rax]
mov qword [rsp + 0x28], rbx
mov edi, dword [rsp + 0x20]
nop
nop
movzx ecx, byte [rbx]
cmp cl, 0x20
ja 0x100076aa
test cl, cl
je 0x10007640
test edi, edi
jne 0x100076aa
movzx eax, byte [rbx]
test al, al
je 0x10007656
cmp al, 0x20
ja 0x10007656
add rbx, 1
mov qword [rsp + 0x28], rbx
jmp 0x10007640
test byte [rsp + 0x6c], 1
je 0x10007665
movzx r9d, word [rsp + 0x70]
jmp 0x1000766b
mov r9d, 0xa
mov r8, rbx
xor edx, edx
lea rcx, [0x10000000]
call fcn.10005300
mov dword [0x10014310], eax
cmp dword [0x100142f4], 0
jne 0x10007693
mov ecx, eax
call qword [sym.imp.MSVCR80.dll_exit]
cmp dword [0x10014314], 0
jne 0x100076a8
call qword [sym.imp.MSVCR80.dll__cexit]
mov eax, dword [0x10014310]
jmp 0x1000770d
cmp cl, 0x22
jne 0x100076bc
xor eax, eax
test edi, edi
sete al
mov edi, eax
mov dword [rsp + 0x20], eax
movzx ecx, cl
call qword [sym.imp.MSVCR80.dll__ismbblead]
test eax, eax
je 0x100076d2
add rbx, 1
mov qword [rsp + 0x28], rbx
add rbx, 1
mov qword [rsp + 0x28], rbx
jmp 0x10007630
jmp 0x10007714
mov rbx, qword [rsp + 0xb0]
add rsp, 0xa0
pop rdi
ret
sub rsp, 0x28
call fcn.10007c10
add rsp, 0x28
jmp 0x10007510