joyce8/EMBER2024-capa huggingface dataset:
Function at 0x2fc4d7430
Capabilities:
Write file on windows

Disassembly:
push rbp
push rbx
sub rsp, 0x38
lea rbp, [rsp + 0x30]
mov qword [rbp + 0x20], rcx
mov qword [rbp + 0x28], rdx
mov qword [rbp + 0x30], r8
mov qword [rbp + 0x38], r9
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov ecx, 2
call sub.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func
mov r9, rax
mov r8d, 0x1b
mov edx, 1
lea rax, str.Mingw_w64_runtime_failure:_n
mov rcx, rax
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fwrite
mov rbx, qword [rbp - 8]
mov ecx, 2
call sub.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func
mov rcx, rax
mov rax, qword [rbp + 0x20]
mov r8, rbx
mov rdx, rax
call fcn.2fc4d8510
call sub.api_ms_win_crt_runtime_l1_1_0.dll_abort
nop

Function at 0x2fc4d7e32
Capabilities:
Get thread local storage value

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov eax, dword [0x2fc4fa108]
test eax, eax
je 0x2fc4d7eca
lea rax, [0x2fc4fa0e0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
call rax
mov rax, qword [0x2fc4fa110]
mov qword [rbp - 8], rax
jmp 0x2fc4d7eae
mov rax, qword [rbp - 8]
mov eax, dword [rax]
mov ecx, eax
mov rax, qword [sym.imp.KERNEL32.dll_TlsGetValue]
call rax
mov qword [rbp - 0x10], rax
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
test eax, eax
jne 0x2fc4d7ea2
cmp qword [rbp - 0x10], 0
je 0x2fc4d7ea2
mov rax, qword [rbp - 8]
mov rdx, qword [rax + 8]
mov rax, qword [rbp - 0x10]
mov rcx, rax
call rdx
mov rax, qword [rbp - 8]
mov rax, qword [rax + 0x10]
mov qword [rbp - 8], rax
cmp qword [rbp - 8], 0
jne 0x2fc4d7e68
lea rax, [0x2fc4fa0e0]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
call rax
jmp 0x2fc4d7ecb
nop
add rsp, 0x30
pop rbp
ret

Function at 0x2fc4d7fd0
Capabilities:
Parse pe header

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov rax, qword [rbp + 0x10]
mov qword [rbp - 8], rax
mov rax, qword [rbp - 8]
movzx eax, word [rax]
cmp ax, 0x5a4d
je 0x2fc4d7ff8
mov eax, 0
jmp 0x2fc4d8046
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp - 8]
add rax, rdx
mov qword [rbp - 0x10], rax
mov rax, qword [rbp - 0x10]
mov eax, dword [rax]
cmp eax, 0x4550
je 0x2fc4d8021
mov eax, 0
jmp 0x2fc4d8046
mov rax, qword [rbp - 0x10]
add rax, 0x18
mov qword [rbp - 0x18], rax
mov rax, qword [rbp - 0x18]
movzx eax, word [rax]
cmp ax, 0x20b
je 0x2fc4d8041
mov eax, 0
jmp 0x2fc4d8046
mov eax, 1
add rsp, 0x20
pop rbp
ret
Function at 0x2fc4d804c
Capabilities:
Enumerate pe sections

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov rax, qword [rbp + 0x10]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp + 0x10]
add rax, rdx
mov qword [rbp - 0x18], rax
mov dword [rbp - 0xc], 0
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 0x14]
movzx edx, ax
mov rax, qword [rbp - 0x18]
add rax, rdx
add rax, 0x18
mov qword [rbp - 8], rax
jmp 0x2fc4d80ca
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0xc]
mov eax, eax
cmp qword [rbp + 0x18], rax
jb 0x2fc4d80c1
mov rax, qword [rbp - 8]
mov edx, dword [rax + 0xc]
mov rax, qword [rbp - 8]
mov eax, dword [rax + 8]
add eax, edx
mov eax, eax
cmp qword [rbp + 0x18], rax
jae 0x2fc4d80c1
mov rax, qword [rbp - 8]
jmp 0x2fc4d80df
add dword [rbp - 0xc], 1
add qword [rbp - 8], 0x28
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 6]
movzx eax, ax
cmp dword [rbp - 0xc], eax
jb 0x2fc4d8094
mov eax, 0
add rsp, 0x20
pop rbp
ret
Function at 0x1405fbdba
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov word [rbp + riz], cx
jmp 0x140649759
push 0x25a337a2
push 0xffffffffa32c6e07
lea rsp, [rsp + 0x30]
jmp 0x14063ce93

Function at 0x1405fc80b
Capabilities:
Encrypt data using rc4 prga

Disassembly:
lea rsp, [rsp + 0x30]
jmp 0x14063ce93

Function at 0x1405fe81a
Capabilities:
Encrypt data using rc4 prga

Disassembly:
lea rsp, [rsp + 0x28]
jmp 0x14063ce93

Function at 0x1405fe84a
Capabilities:
Encrypt data using rc4 prga

Disassembly:
call fcn.1406429f5
mov r9, rax
call fcn.14062bb6e
mov r11d, 0x8f8f640d
mov rdx, qword [rbp + riz]
imul r11w, r11w
or r11w, 0x7328
mov r11d, dword [rbp + riz + 8]
push 0xffffffffa017552c
adc rbp, 0xc
mov dword [rdx], r11d
push 0xffffffff95893e26
jmp 0x140646bce
lea rsp, [rsp + 0x10]
jmp 0x14063ce93
jmp 0x14060d775

Function at 0x1405feba5
Capabilities:
Encrypt data using rc4 prga

Disassembly:
jmp 0x14062bd2e
lea rsp, [rsp + 0x18]
jmp 0x14063ce93
mov word [rbp + riz], ax
jmp 0x14060efdd

Function at 0x1405fee29
Capabilities:
Encrypt data using rc4 prga

Disassembly:
lea rsp, [rsp + 0x10]
jmp 0x14063ce93

Function at 0x1406004d9
Capabilities:
Encrypt data using rc4 prga

Disassembly:
lea rsp, [rsp + 0x10]
jmp 0x14063ce93

Function at 0x1406011f0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [r8], r11
lea rsp, [rsp + 0x18]
jp 0x14063ce93

Function at 0x140601834
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push 0xffffffffe4078ca5
mov word [rbp + riz], r8w
lea rsp, [rsp + 0x18]
jmp 0x14063ce93

Function at 0x140601da3
Capabilities:
Encrypt data using rc4 prga

Disassembly:
lea rsp, [rsp + 0x28]
jmp 0x14063ce93

Function at 0x140602a42
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rbp + riz], r11
lea rsp, [rsp + 0x18]
jmp 0x14063ce93

Function at 0x140602cb8
Capabilities:
Encrypt data using rc4 prga

Disassembly:
add rbp, 2
mov qword [rsp], 0xffffffff8d3b6303
not qword [rsp]
sal byte [rsp + 7], 0xe2
adc r8w, cx
mov word [rbp + riz], r8w
push 0xffffffffbf8f800a
lea rsp, [rsp + 0x10]
jmp 0x14063ce93

Function at 0x1406072f3
Capabilities:
Encrypt data using rc4 prga

Disassembly:
lea rsp, [rsp + 0x18]
jmp 0x14063ce93

Function at 0x140608cc1
Capabilities:
Encrypt data using rc4 prga

Disassembly:
jmp 0x140629625
lea rsp, [rsp + 0x18]
jmp 0x14063ce93

Function at 0x14060b33e
Capabilities:
Encode data using base64

Disassembly:
call fcn.140636a59
mov edx, 0xe0b65098
mov rax, qword [rbx + riz]
movzx r9d, dl
movzx ebp, r9w
or r9d, ebp
lea rbx, [r9 + rbx - 0x90]
movzx esi, r9w
movzx r11d, r9b
mov r11, rax
mov r10, rbx
mov ebx, 0x5b30369d
jne 0x140639542
Function at 0x14060b373
Capabilities:
Encode data using base64

Disassembly:
dec bp
push 0x6a34afa2
dec qword [rsp]
push 0xffffffffcdb2a3b8
rol bp, 1
xor bp, 0x113
shr qword [rsp + 3], 0x5d
mov byte [rsp + 3], 4
xor bx, bp
lea rbp, [rsp + rbp + 0x10]
jmp 0x1406217d8
sar byte [rsp + 6], 0x24
neg byte [rsp]
and r11b, bl
push 0x14204a18
call fcn.14062badd
jmp 0x140601c28
xor bx, 0x5c3a
sub bx, 0x6fb4
btr r8, r8
mov qword [rsp], r8
pop r8
xor si, bx
xchg qword [rsp], r8
rol r8d, 0xea
lea rbx, [rsp + rbx + 8]
adc r8d, r8d
or r8w, r8w
jb 0x14063066e
mov r8d, dword [rbx + riz]
call fcn.140610f3a
jle 0x140624961
mov word [rbp + riz], cx
push 0xffffffffb88770a0
jmp 0x14063c6cf
jbe 0x14064222b
movzx edi, byte [rbx + riz]
add rbx, 1
xor dil, r9b
not r11
dec r11
xor dil, 0x81
neg dil
bt r11w, 0x3f
and r11w, r11w
inc dil
btc r11, r11
xor dil, 0x1e
btc r11w, r11w
sub r11d, r11d
not dil
xor r9b, dil
inc r11w
setp r11b
add rdi, rsp
add r11, 0x6d977927
mov r11d, dword [rdi + r11 - 0x6d977927]
push 0xfffffffffda3e51a
push 0x55878d99
sbb rbp, 4
mov dword [rbp + riz], r11d
call fcn.1406454fb
mov ebp, 0x619c05a0
sub ebp, ebp
mov ecx, ebp
add cx, word [r10 + rbp]
lea r10, [r10 + rbp*4 + 2]
not rbp
add ebp, 0xb9b9cda7
sbb r11, 1
ror bp, 0x45
rol rbp, 0x3d
ror bp, 0xa8
movzx ebp, word [r11 + riz]
xor bp, bx
not bp
jmp 0x14060749d
lea rsp, [rsp + 0x18]
jmp fcn.1406252ed
push 0xffffffffceaa42b6
not bl
jmp 0x1406028b0
adc r9, 1
not r11b
jmp 0x1406404d3

Function at 0x14060c1c1
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push 0xffffffffbb1d360d
lea rsp, [rsp + 0x20]
jmp 0x14063ce93

Function at 0x14060c29a
Capabilities:
Encrypt data using rc4 prga

Disassembly:
lea rsp, [rsp + 0x10]
jmp 0x14063ce93

Function at 0x14060e247
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp], 0x7395960d
push qword [rsp + 8]
popfq
push 0xa378d83
lea rsp, [rsp + 0x18]
jmp 0x14063ce93

Function at 0x14060eb9b
Capabilities:
Encrypt data using rc4 prga

Disassembly:
shr r11b, cl
push 0xffffffffeca15e80
push 0x21bbf94
mov word [rbp], r11w
not word [rsp + 0xa]
lea rsp, [rsp + 0x20]
jmp 0x14063ce93
adc rbp, 2
jmp 0x14060a11c

Function at 0x14060fa1f
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push 0xfffffffff329a5aa
adc rbp, 0xa
jmp 0x140647de0

Function at 0x14060fd61
Capabilities:
Encrypt data using rc4 prga

Disassembly:
lea rsp, [rsp + 0x10]
jmp 0x14063ce93
jmp 0x1406008aa

Function at 0x140611ebb
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push 0xffffffffc9a28827
lea rsp, [rsp + 0x20]
jmp 0x14063ce93

Function at 0x1406126ef
Capabilities:
Encrypt data using rc4 prga

Disassembly:
lea rsp, [rsp + 0x20]
jmp 0x14063ce93

Function at 0x140612882
Capabilities:
Encrypt data using rc4 prga

Disassembly:
lea rsp, [rsp + 0x20]
jmp 0x14063ce93

Function at 0x14061336f
Capabilities:
Encrypt data using rc4 prga

Disassembly:
not word [rsp + 8]
mov edi, dword [rsp + 0xa]
mov rdi, qword gs:[rdx + rdi*4 - 0x10edc]
mov qword [rbp + riz], rdi
lea rsp, [rsp + 0x18]
jmp 0x14063ce93

Function at 0x1406146ff
Capabilities:
Encrypt data using rc4 prga

Disassembly:
jmp 0x14061e9d9
mov dword ss:[rdi], edx
jmp 0x14062355c
Function at 0x1406150de
Capabilities:
Encrypt data using rc4 prga

Disassembly:
call fcn.14063001d
mov r8d, 0x268a8d80
mov ecx, r8d
mov r8d, dword [r8 + rbp - 0x268a8d80]
bt rcx, 0x14
mov cl, byte [rcx + rbp - 0x268a8d7c]
adc rbp, 2
shr r8d, cl
mov dword [rbp], r8d
jmp 0x14063ce93

Function at 0x1406155b3
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push 0x370068ba
mov byte [rdx], dil
lea rsp, [rsp + 0x10]
jmp 0x14063ce93

Function at 0x1406156b5
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov word [rbp + riz], dx
jmp 0x140649c77
lea rsp, [rsp + 0x20]
jmp 0x14063ce93
jmp 0x140649ac2

Function at 0x140615a62
Capabilities:
Encrypt data using rc4 prga

Disassembly:
or di, bx
jmp 0x140615a5d
call fcn.140623089
mov ebx, 0x72bd9c9a
mov rbx, qword [rdi + rbx - 0x72bd9c9a]
mov eax, 0x969c5604
cwde
or eax, eax
lea rdi, [rdi + rax - 0x55fc]
shl al, 0x44
dec al
movzx eax, byte [rax + r10 - 0x563f]
call fcn.140647142

Function at 0x1406173ac
Capabilities:
Encrypt data using rc4 prga

Disassembly:
lea rsp, [rsp + 0x10]
jmp 0x14063ce93
mov rdx, qword [rbp + riz]
push 0xf0a0404
mov ecx, 0x2e89b833
bswap rcx
mov rcx, qword [rbp + riz + 8]
add rbp, 0x10
mov qword ss:[rdx], rcx
jmp 0x14060ace8

Function at 0x140617f00
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push 0xffffffffbbb2a03e
push 0x4caaeeb8
lea rsp, [rsp + 0x20]
jmp 0x14063ce93

Function at 0x1406196a8
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov dword ss:[r11], ecx
jmp 0x1406375ab
lea rsp, [rsp + 8]
jmp 0x14063ce93

Function at 0x140619b44
Capabilities:
Encrypt data using rc4 prga

Disassembly:
lea rsp, [rsp + 0x20]
jmp 0x14063ce93

Function at 0x14061b039
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rbp], rbx
lea rsp, [rsp + 0x10]
jmp 0x14063ce93

Function at 0x14061b1c9
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rbp + riz], rbx
lea rsp, [rsp + 8]
jmp 0x14063ce93

Function at 0x14061b24a
Capabilities:
Encrypt data using rc4 prga

Disassembly:
not r11b
mov qword [rsp], 0x68282c34
not dil
shl qword [rsp], 9
or r11b, dil
mov qword [rsp], 0x5cb3a9bc
mov word [rbp + riz], r11w
not word [rsp + 1]
not byte [rsp + 5]
push 0xffffffffcc15aa18
lea rsp, [rsp + 0x10]
jmp 0x14063ce93

Function at 0x14061bbbb
Capabilities:
Encrypt data using rc4 prga

Disassembly:
add r9d, edx
mov dword [rdi], r9d
jmp 0x14061cd96
add rdi, 4
inc word [rsp + 0xb]
jl 0x14060351d
jmp 0x140609a1b

Function at 0x14061c0be
Capabilities:
Encrypt data using rc4 prga

Disassembly:
lea rsp, [rsp + 0x18]
jmp 0x14063ce93

Function at 0x14061c1de
Capabilities:
Encrypt data using rc4 prga

Disassembly:
jmp 0x14063bad9
push 0xfffffffff58470b1
lea rsp, [rsp + 0x20]
jmp 0x14063ce93

Function at 0x14061cfcb
Capabilities:
Encrypt data using rc4 prga

Disassembly:
lea rsp, [rsp + 0x20]
jmp 0x14063ce93
Function at 0x14061dcb2
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp], 0x4a06079d
xor r8w, 0x1216
jmp 0x14064ba7b
jbe 0x14062be39
setnp byte [rsp + 0xb]
neg r8w
jmp 0x1406393e2
lea r8, [rsp + r8 + 0x10]
jbe 0x140609d90
mov edx, 0x621a73bb
movzx ecx, dx
mov esi, dword [rdx + r10 - 0x621a73bb]
mov edx, dword [r10 + rcx*4 - 0x1cee8]
dec cx
mov cl, byte [rcx + r10 - 0x73b2]
jge 0x140621904
call fcn.14064a71e
call fcn.14061184e
or byte [rsp + 3], dh
mov edx, ebx
rol word [rsp + 5], 0x6f
xor ecx, ecx
ror byte [rsp + 4], 0x67
sar dword [rsp + 2], 0x62
rol dword [rsp + 1], 0xa7
cmp ebx, 4
push 0xffffffffa0216abd
push 0xffffffff8eb61807
jmp 0x14064717e
jmp 0x140607ce5
lea rsp, [rsp + 0x18]
jbe 0x140620862
mov ecx, 0x20132fbf
call fcn.140620850
lea rcx, [rbx*4 - 0x15eb5bd9]
mov qword [rsp], r13
push rbp
call fcn.1405fbcb5
rol dword [rsp + 7], 0x5b
inc r8w
sub qword [rsp + 7], 0x678d7a34
xor si, r8w
sal byte [rsp + 0xc], 0x21
js 0x14061dca7
mov ebp, 0x29219e21
shl rbp, 0xe5
movzx r8d, byte [r10 + riz]
movzx ebx, bpl
sal bp, 0xea
mov edx, ebx
lea r10, [r10 + rbx + 1]
xadd dl, dh
shr dx, 8
xor r8b, r9b
xadd bp, bx
ror r8b, 1
lea rbp, [rbx*4 + 0x36bee23c]
sar bpl, 0x41
add bl, 0xd
xor r8b, 0x31
not dx
shr bp, 0x43
ror r8b, 1
sub ebp, ebx
xor r8b, dl
sar rbx, 0xa3
adc r8b, 0x8b
xor r9b, r8b
push r10
push rsi
bswap ebx
push r9
push rbx
mov rbp, rdi
xor word [rsp + rbx*2 + 5], bx
shl edx, 0x79
add ebx, r8d
jmp 0x14062e842

Function at 0x14061e1a2
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rbp + riz], r8
jmp 0x1406281e8
lea rsp, [rsp + 0x18]
jmp 0x14063ce93

Function at 0x14061fd0d
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push 0x46a98bb6
dec byte [rsp + 3]
adc rbp, 9
mov byte [rsp + 1], 0xa5
mov byte ss:[rdi], r8b
lea rsp, [rsp + 0x10]
jmp 0x14063ce93

Function at 0x14061ff6a
Capabilities:
Encrypt data using rc4 prga

Disassembly:
shr rax, cl
mov qword [rbp], rax
jmp 0x14063b3a7
lea rsp, [rsp + 0x28]
jmp 0x14063ce93

Function at 0x140620a6c
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp], 0x1d2af68c
mov word [rbp + riz], bx
push 0x182953b9
lea rsp, [rsp + 0x20]
jmp 0x14063ce93
not bl
jmp 0x140603aa9
jmp 0x14060eee9

Function at 0x140622dc3
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + rcx - 0x20bb6bad], rcx
mov rax, qword [rbp + rcx*2 - 0x4176d75a]
btc rcx, 0x95
shr rcx, 0xe8
sbb rcx, rcx
adc cl, byte [rbp + rcx + 8]
push 0xfffffffff524a811
add rbp, 2
rol byte [rsp + 0xd], 0x21
sal rax, cl
jmp 0x140628ef3
mov qword [rbp], rax
not qword [rsp + 8]
not word [rsp + 5]
lea rsp, [rsp + 0x10]
jmp 0x14063ce93

Function at 0x140623440
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push 0x24255dad
mov word [rbp + riz], dx
jmp 0x14062c812
jmp 0x1406135a0
adc rbp, 6
jmp 0x14061833f
lea rsp, [rsp + 0x10]
jmp 0x14063ce93
Function at 0x1406234c4
Capabilities:
Encrypt data using rc4 prga

Disassembly:
lea rsp, [rsp + 0x20]
jmp fcn.140646802
mov r11d, 0x98445be
lea rcx, [r11*8 + 0x11bf25b1]
mov r11, qword [rbp + r11 - 0x98445be]
not rcx
push rcx
mov rcx, qword ss:[rcx + r11 + 0x5de153a2]
jmp 0x14061aa5c
mov qword [rbp + riz], rcx
push 0xffffffffa128dc2a
jmp 0x14063cd39
jmp 0x140617c51
lea rsp, [rsp + 0x10]
jmp 0x14063ce93
lea r11, [rsp + r11 + 0x30]
jae 0x14064a7e6
jmp 0x1406166f3
push 0x2e3f5299
jb 0x1406234c4
mov qword [r11], rax
call fcn.14064bd87

Function at 0x140624246
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push 0xffffffff90a97eaf
mov ecx, 0xc5199b05
mov cl, byte [rbp + riz + 8]
add rbp, 2
sal r11, cl
push 0xffffffffa3034688
jmp 0x14063d8d2
mov qword [rbp], r11
lea rsp, [rsp + 0x18]
jmp 0x14063ce93

Function at 0x140624bb0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
lea rsp, [rsp + 0x68]
jmp 0x14063ce93

Function at 0x140628285
Capabilities:
Encrypt data using rc4 prga

Disassembly:
lea rsp, [rsp + 0x30]
jmp 0x14063ce93

Function at 0x14062d0c4
Capabilities:
Encrypt data using rc4 prga

Disassembly:
lea rsp, [rsp + 0x40]
jmp 0x14063ce93

Function at 0x14062e8c0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push 0x71205fa3
lea rsp, [rsp + 0x18]
jmp 0x14063ce93

Function at 0x14062eae9
Capabilities:
Encrypt data using rc4 prga

Disassembly:
lea rsp, [rsp + 0x18]
jmp 0x14063ce93

Function at 0x14062edb9
Capabilities:
Encrypt data using rc4 prga

Disassembly:
not dword [rsp + 0x19]
lea rsp, [rsp + 0x20]
jmp 0x14063ce93

Function at 0x14062ef9d
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push 0x4f374bb0
lea rsp, [rsp + 0x18]
jmp 0x14063ce93

Function at 0x14062fc19
Capabilities:
Encrypt data using rc4 prga

Disassembly:
lea rsp, [rsp + 0x10]
jmp 0x14063ce93

Function at 0x140630652
Capabilities:
Encode data using base64

Disassembly:
mov qword [rsp], 0x6b26ec16
and byte [rsp + 5], 0xbd
mul rbp
call fcn.14063511c
mov r11d, 0xbc9eaf0d

Function at 0x14063079d
Capabilities:
Encrypt data using rc4 prga

Disassembly:
lea rsp, [rsp + 0x10]
jmp 0x14063ce93

Function at 0x140630b75
Capabilities:
Encrypt data using rc4 prga

Disassembly:
jmp 0x140645315
lea rsp, [rsp + 0x20]
jmp 0x14063ce93
push 0xffffffff96884021
mov qword [rdx], r11
jmp 0x14064a176
jmp 0x14063b70d

Function at 0x1406314ff
Capabilities:
Encrypt data using rc4 prga

Disassembly:
lea rsp, [rsp + 0x28]
jmp 0x14063ce93
push 0x34a44620
jmp 0x14060e6da

Function at 0x14063151e
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push 0x32bc4723
lea rsp, [rsp + 0x50]
jmp 0x14063ce93

Function at 0x14063226f
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push 0xffffffffac957d30
jmp 0x140647d6c
lea rsp, [rsp + 0x20]
jmp 0x14063ce93

Function at 0x140633679
Capabilities:
Encrypt data using rc4 prga

Disassembly:
lea rsp, [rsp + 0x20]
jmp 0x14063ce93
mov dx, word [rbp + riz]
mov cl, byte [rbp + 2]
jmp 0x1406402b8
add rbp, 2
sal dx, cl
push 0x4793c896
mov word [rbp], dx
push 0xffffffff82047309
push 0xfffffffffb0dbf90
jmp 0x140623ad5

Function at 0x140635266
Capabilities:
Encrypt data using rc4 prga

Disassembly:
lea rsp, [rsp + 0x30]
jmp 0x14063ce93
Function at 0x1406353be
Capabilities:
Encrypt data using rc4 prga

Disassembly:
jmp 0x1406462e8
lea rsp, [rsp + 0x28]
jmp 0x14063ce93

Function at 0x140635f68
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov word [rbp + riz], r8w
lea rsp, [rsp + 0x20]
jmp 0x14063ce93

Function at 0x1406381ac
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push 0xffffffff9fb7022f
mov qword [rsp + 8], 0x47b78a8f
mov dword [rbp + riz], edx
jmp 0x14063b7b7
lea rsp, [rsp + 0x18]
jmp 0x14063ce93

Function at 0x1406386bc
Capabilities:
Encrypt data using rc4 prga

Disassembly:
lea rsp, [rsp + 0x20]
jmp 0x14063ce93

Function at 0x140639151
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov dword [rdi], ebx
push 0x2430803a
push 0xffffffffee27f725
push 0xffffffffa5013a17
lea rsp, [rsp + 0x20]
jmp 0x14063ce93
mov qword [rsp], 0xffffffffcc87e708
ror byte [rsp + 7], 0x87
adc rbp, 0xb
jmp 0x14062e891

Function at 0x14063a111
Capabilities:
Encrypt data using rc4 prga

Disassembly:
jmp 0x14063a10c
call fcn.14062e0e2
mov rsi, qword [r10]
mov ebx, 0x44993010
lea r10, [rbx + r10 - 0x44993008]
lea rdi, [rbx + rbx*4 + 0x38123009]
mov rdi, rsi
lea rdx, [rbx + rbx - 0x2a447941]
ror rbx, 0x94
ror rbx, 0x49
mov rbx, r10
movzx ebp, dl
push rdx
pop r11
jae 0x140606ad3
call fcn.140642218

Function at 0x14063a7db
Capabilities:
Encrypt data using rc4 prga

Disassembly:
adc rbp, 5
push 0xffffffffe59e180e
push 0x312f9686
mov word [rbp + riz], di
push 0x721fee23
lea rsp, [rsp + 0x20]
jmp 0x14063ce93

Function at 0x14063bb77
Capabilities:
Encrypt data using rc4 prga

Disassembly:
lea rsp, [rsp + 0x28]
jmp 0x14063ce93
jmp 0x14060c237

Function at 0x14063bf5c
Capabilities:
Encrypt data using rc4 prga

Disassembly:
not r8
jmp 0x1406336b5
jmp 0x1406292d3
mov qword [rbp + riz], r8
jmp 0x140633aa9
lea rsp, [rsp + 0x10]
jmp 0x14063ce93
jmp 0x140630367

Function at 0x14063bffe
Capabilities:
Encrypt data using rc4 prga

Disassembly:
not r11d
mov qword [rsp], 0x3bb89da3
mov dword [rbp + riz], r11d
lea rsp, [rsp + 8]
jmp 0x14063ce93
jmp 0x140614b9d

Function at 0x14063d955
Capabilities:
Encrypt data using rc4 prga

Disassembly:
add rbp, 0xa
push 0xffffffffc28d1701
mov word ss:[rdi], cx
push 0x722ae108
mov qword [rsp + 0x10], 0x62841285
push 0xffffffffb4337611
lea rsp, [rsp + 0x28]
jmp 0x14063ce93

Function at 0x14063e030
Capabilities:
Encrypt data using rc4 prga

Disassembly:
add rbp, 4
push 0x329bd2bc
push 0x5a25c316
jmp 0x140640a32
mov dword [rbp + riz], ebx
lea rsp, [rsp + 0x18]
jmp 0x14063ce93

Function at 0x14063f5c1
Capabilities:
Encrypt data using rc4 prga

Disassembly:
lea rsp, [rsp + 0x28]
jmp 0x14063ce93
jmp 0x14061709f

Function at 0x14063f898
Capabilities:
Encrypt data using rc4 prga

Disassembly:
adc rbp, 2
mov qword [rsp], 0x4c2efbbc
push 0x43b1c6a7
shl r11b, cl
jmp 0x140612472

Function at 0x14063fef8
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov dword [rbp + riz], edx
lea rsp, [rsp + 0x38]
jmp 0x14063ce93

Function at 0x140640232
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push 0xffffffffd6b5e893
sal dl, cl
jmp 0x14061a90f
mov word [rbp], dx
lea rsp, [rsp + 0x18]
jmp 0x14063ce93
jmp 0x14061052a
Function at 0x140641dbe
Capabilities:
Encrypt data using rc4 prga

Disassembly:
sub rbp, 2
call fcn.14063189a

Function at 0x14064244e
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push 0xffffffff938ee70f
lea rsp, [rsp + 0x38]
jmp 0x14063ce93
mov word [rbp], r11w
jmp 0x14064a9f3
jmp 0x140630cf3

Function at 0x140642eaa
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov word [rbp + riz], cx
push 0x62b9e82a
lea rsp, [rsp + 0x20]
jmp 0x14063ce93
jmp 0x140602ea2

Function at 0x140643546
Capabilities:
Encrypt data using rc4 prga

Disassembly:
lea rsp, [rsp + 0x10]
jmp 0x14063ce93

Function at 0x140643707
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push 0xffffffff96a04d19
mov dword [rbp + riz], ecx
lea rsp, [rsp + 0x18]
jmp 0x14063ce93
adc rbp, 3
jmp 0x14060a1d9

Function at 0x140643a38
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rbx], rcx
lea rsp, [rsp + 8]
jmp 0x14063ce93
add rbp, 0x10
mov qword [rsp], 0x13b17d81
mov byte [rsp], 0xae
jmp 0x140628558

Function at 0x140643ee2
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push 0xffffffffad880899
lea rsp, [rsp + 0x28]
jmp 0x14063ce93

Function at 0x14064420c
Capabilities:
Encrypt data using rc4 prga

Disassembly:
or r11w, dx
jmp 0x14062f1e7

Function at 0x140644bce
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rbp + riz], rdx
not dword [rsp + 1]
lea rsp, [rsp + 8]
jmp 0x14063ce93
push 0xffffffffb7087b00
jmp 0x140614437
push 0xfffffffffe835500
sbb rsi, 1
jmp 0x1406167d4
neg dx
or r11b, r11b
setp r11b
xor bx, dx
xor r11b, 0
imul r11d, r11d
lea rdx, [rsp + rdx + 8]
movzx r11w, byte [rdx + riz]
jb 0x14063de7a
mov edi, 0xc593ffaf
mov rdi, qword [rbp + riz]
mov edx, 0x66bafb2b
mov rdx, qword gs:[rdi + rdx - 0x66bafb2b]
jmp 0x14063b265

Function at 0x140645edc
Capabilities:
Encrypt data using rc4 prga

Disassembly:
lea rsp, [rsp + 8]
jmp 0x14063ce93

Function at 0x140645f50
Capabilities:
Encrypt data using rc4 prga

Disassembly:
adc rbp, 0xa
jmp 0x140636017

Function at 0x14064698f
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov word [rbp], dx
lea rsp, [rsp + 0x10]
jmp 0x14063ce93

Function at 0x140646af9
Capabilities:
Encrypt data using rc4 prga

Disassembly:
lea rsp, [rsp + 0x38]
jmp 0x14063ce93

Function at 0x140647366
Capabilities:
Encrypt data using rc4 prga

Disassembly:
lea rsp, [rsp + 0x20]
jmp 0x14063ce93

Function at 0x14064760b
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp], 0xffffffffcb08533b
add ax, cx
push 0x7b8684a3
jmp 0x1406244c6