joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5830a0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
lea r12, [rsp - 8]
cmp r12, qword [r14 + 0x10]
jbe 0x5831fd
push rbp
mov rbp, rsp
add rsp, 0xffffffffffffff80
movabs rdx, 0xf000b56f446cdc52
mov qword [rsp + 0x1d], rdx
movabs rdx, 0x6f54ec6d61ff68d4
mov qword [rsp + 0x25], rdx
movabs rdx, 0xe4013a61f9da076f
mov qword [rsp + 0x2c], rdx
movabs rdx, 0xba5f37d8f2b2c1d4
mov qword [rsp + 0x34], rdx
movabs rdx, 0x69575e2b0b656ddc
mov qword [rsp + 0x3c], rdx
movabs rdx, 0x6aa174228084d88b
mov qword [rsp + 0x44], rdx
movabs rdx, 0x51f19181f27052e
mov qword [rsp + 0x4c], rdx
movabs rdx, 0x2a271b17051f1918
mov qword [rsp + 0x50], rdx
movabs rdx, 0x1d162b1e24281522
mov qword [rsp + 0x58], rdx
movabs rdx, 0x2d08292a280a2312
mov qword [rsp + 0x60], rdx
movabs rdx, 0xd072b08111e191a
mov qword [rsp + 0x68], rdx
movabs rdx, 0x2a272e1101061211
mov qword [rsp + 0x70], rdx
movabs rdx, 0x2d1c1a1a142e1016
mov qword [rsp + 0x78], rdx
xor eax, eax
jmp 0x5831a0
movzx r9d, byte [rsp + rsi + 0x1d]
sub r9d, edx
lea edx, [r9 - 0x5f]
mov byte [rsp + rdi + 0x1d], dl
lea edx, [r8 - 0x5f]
mov byte [rsp + rsi + 0x1d], dl
add rax, 2
nop dword [rax + rax]
cmp rax, 0x34
jge 0x5831cd
movzx edx, byte [rsp + rax + 0x4c]
movzx esi, byte [rsp + rax + 0x4d]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x2f
jae 0x5831f0
movzx r8d, byte [rsp + rdi + 0x1d]
sub r8d, edx
cmp rsi, 0x2f
jb 0x58317e
jmp 0x5831e4
xor eax, eax
lea rbx, [rsp + 0x1d]
mov ecx, 0x2f
call fcn.0044bb20
sub rsp, 0xffffffffffffff80
pop rbp
ret
mov eax, esi
mov ecx, 0x2f
call fcn.00461020
mov eax, edi
mov ecx, 0x2f
call fcn.00461020
nop
nop dword [rax]
call fcn.0045eda0
jmp fcn.005830a0

Function at 0x583220
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x5832fd
push rbp
mov rbp, rsp
sub rsp, 0x40
movabs rdx, 0x1ece746574d374d4
mov qword [rsp + 0x1e], rdx
movabs rdx, 0x6297ce07da1472ac
mov qword [rsp + 0x26], rdx
movabs rdx, 0xd08030e0703020c
mov qword [rsp + 0x2e], rdx
movabs rdx, 0x70b0d08030e0703
mov qword [rsp + 0x30], rdx
movabs rdx, 0x2060306060a0b00
mov qword [rsp + 0x38], rdx
xor eax, eax
nop
jmp 0x5832a0
movzx r9d, byte [rsp + rsi + 0x1e]
sub r9d, edx
lea edx, [r9 - 0x51]
mov byte [rsp + rdi + 0x1e], dl
lea edx, [r8 - 0x51]
mov byte [rsp + rsi + 0x1e], dl
add rax, 2
nop
cmp rax, 0x12
jge 0x5832cd
movzx edx, byte [rsp + rax + 0x2e]
movzx esi, byte [rsp + rax + 0x2f]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x10
jae 0x5832f0
movzx r8d, byte [rsp + rdi + 0x1e]
sub r8d, edx
cmp rsi, 0x10
jb 0x583282
jmp 0x5832e4
xor eax, eax
lea rbx, [rsp + 0x1e]
mov ecx, 0x10
call fcn.0044bb20
add rsp, 0x40
pop rbp
ret
mov eax, esi
mov ecx, 0x10
call fcn.00461020
mov eax, edi
mov ecx, 0x10
call fcn.00461020
nop
nop dword [rax]
call fcn.0045eda0
jmp fcn.00583220
Function at 0x584260
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x584332
push rbp
mov rbp, rsp
sub rsp, 0x38
movabs rdx, 0x6a62c7b465c67bb1
mov qword [rsp + 0x1f], rdx
movabs rdx, 0x99946d6a62c7b465
mov qword [rsp + 0x22], rdx
movabs rdx, 0x40400050a010102
mov qword [rsp + 0x2a], rdx
movabs rdx, 0x50804090a000404
mov qword [rsp + 0x30], rdx
xor eax, eax
jmp 0x5842cc
movzx r9d, byte [rsp + rsi + 0x1f]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x37]
mov byte [rsp + rdi + 0x1f], dl
mov byte [rsp + rsi + 0x1f], r8b
add rax, 2
cmp rax, 0xe
jge 0x5842fe
movzx edx, byte [rsp + rax + 0x2a]
movzx esi, byte [rsp + rax + 0x2b]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0xb
jae 0x584325
movzx r8d, byte [rsp + rdi + 0x1f]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x37]
cmp rsi, 0xb
jb 0x5842b2
jmp 0x584315
xor eax, eax
lea rbx, [rsp + 0x1f]
mov ecx, 0xb
call fcn.0044bb20
add rsp, 0x38
pop rbp
ret
mov eax, esi
mov ecx, 0xb
nop dword [rax]
call fcn.00461020
mov eax, edi
mov ecx, 0xb
call fcn.00461020
nop
call fcn.0045eda0
jmp fcn.00584260

Function at 0x585fe0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x586118
push rbp
mov rbp, rsp
sub rsp, 0x70
movabs rdx, 0xdea8af36f5c3de55
mov qword [rsp + 0x1f], rdx
movabs rdx, 0x81df6545abdea8af
mov qword [rsp + 0x24], rdx
movabs rdx, 0x61c3c85f6369c866
mov qword [rsp + 0x2c], rdx
movabs rdx, 0xe169ac40e46524f2
mov qword [rsp + 0x34], rdx
movabs rdx, 0xf76e6fe734ce63e3
mov qword [rsp + 0x3c], rdx
movabs rdx, 0xd2009131a040c05
mov qword [rsp + 0x44], rdx
movabs rdx, 0x210718081102160e
mov qword [rsp + 0x4c], rdx
movabs rdx, 0x2009120621071808
mov qword [rsp + 0x50], rdx
movabs rdx, 0x24031d010e041c05
mov qword [rsp + 0x58], rdx
movabs rdx, 0x191a150e20080920
mov qword [rsp + 0x60], rdx
movabs rdx, 0x2002131a0d0b1c1f
mov qword [rsp + 0x68], rdx
xor eax, eax
jmp 0x5860b8
movzx r9d, byte [rsp + rsi + 0x1f]
sub r9d, edx
lea edx, [r9 - 0x41]
mov byte [rsp + rdi + 0x1f], dl
lea edx, [r8 - 0x41]
mov byte [rsp + rsi + 0x1f], dl
add rax, 2
cmp rax, 0x2c
jge 0x5860e8
movzx edx, byte [rsp + rax + 0x44]
movzx esi, byte [rsp + rax + 0x45]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x25
jae 0x58610b
movzx r8d, byte [rsp + rdi + 0x1f]
sub r8d, edx
nop dword [rax]
cmp rsi, 0x25
jb 0x58609b
jmp 0x5860ff
xor eax, eax
lea rbx, [rsp + 0x1f]
mov ecx, 0x25
call fcn.0044bb20
add rsp, 0x70
pop rbp
ret
mov eax, esi
mov ecx, 0x25
call fcn.00461020
mov eax, edi
mov ecx, 0x25
call fcn.00461020
nop
call fcn.0045eda0
nop dword [rax]
jmp fcn.00585fe0
Function at 0x5863a0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x5864ac
push rbp
mov rbp, rsp
sub rsp, 0x50
movabs rdx, 0xd95a4470d8d6e1f3
mov qword [rsp + 0x18], rdx
movabs rdx, 0xe37372f2066c69e1
mov qword [rsp + 0x20], rdx
movabs rdx, 0x7271e37372f2066c
mov qword [rsp + 0x22], rdx
movabs rdx, 0xf573f170d7d52d83
mov qword [rsp + 0x2a], rdx
movabs rdx, 0x7070015020b1202
mov qword [rsp + 0x32], rdx
movabs rdx, 0x60f131917100e13
mov qword [rsp + 0x3a], rdx
movabs rdx, 0x140314161706060f
mov qword [rsp + 0x40], rdx
movabs rdx, 0x80c170f0801010e
mov qword [rsp + 0x48], rdx
xor eax, eax
jmp 0x586448
movzx r9d, byte [rsp + rsi + 0x18]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x63]
mov byte [rsp + rdi + 0x18], dl
mov byte [rsp + rsi + 0x18], r8b
add rax, 2
cmp rax, 0x1e
jge 0x58647c
movzx edx, byte [rsp + rax + 0x32]
movzx esi, byte [rsp + rax + 0x33]
mov edi, edx
xor edx, esi
add edx, eax
nop
cmp rdi, 0x1a
jae 0x58649f
movzx r8d, byte [rsp + rdi + 0x18]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x63]
cmp rsi, 0x1a
jb 0x58642e
jmp 0x586493
xor eax, eax
lea rbx, [rsp + 0x18]
mov ecx, 0x1a
call fcn.0044bb20
add rsp, 0x50
pop rbp
ret
mov eax, esi
mov ecx, 0x1a
call fcn.00461020
mov eax, edi
mov ecx, 0x1a
call fcn.00461020
nop
call fcn.0045eda0
jmp fcn.005863a0

Function at 0x586c60
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x586d68
push rbp
mov rbp, rsp
sub rsp, 0x58
movabs rdx, 0x4356447066756753
mov qword [rsp + 0x1e], rdx
movabs rdx, 0x636275777851786c
mov qword [rsp + 0x26], rdx
movabs rdx, 0x4f725a8f63627577
mov qword [rsp + 0x2a], rdx
movabs rdx, 0x5f8f45706d55784b
mov qword [rsp + 0x32], rdx
movabs rdx, 0xe0a130c06060114
mov qword [rsp + 0x3a], rdx
movabs rdx, 0x30f161b1a0b1502
mov qword [rsp + 0x42], rdx
movabs rdx, 0x90311180806030f
mov qword [rsp + 0x48], rdx
movabs rdx, 0xb1018150f0e0111
mov qword [rsp + 0x50], rdx
xor eax, eax
jmp 0x586d0b
movzx r9d, byte [rsp + rsi + 0x1e]
sub r9d, edx
lea edx, [r9 + 0x1b]
mov byte [rsp + rdi + 0x1e], dl
lea edx, [r8 + 0x1b]
mov byte [rsp + rsi + 0x1e], dl
add rax, 2
cmp rax, 0x1e
jge 0x586d38
movzx edx, byte [rsp + rax + 0x3a]
movzx esi, byte [rsp + rax + 0x3b]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x1c
jae 0x586d5b
movzx r8d, byte [rsp + rdi + 0x1e]
sub r8d, edx
cmp rsi, 0x1c
jb 0x586cee
jmp 0x586d4f
xor eax, eax
lea rbx, [rsp + 0x1e]
mov ecx, 0x1c
call fcn.0044bb20
add rsp, 0x58
pop rbp
ret
mov eax, esi
mov ecx, 0x1c
call fcn.00461020
mov eax, edi
mov ecx, 0x1c
call fcn.00461020
nop
call fcn.0045eda0
jmp fcn.00586c60
Function at 0x588440
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x58855d
push rbp
mov rbp, rsp
sub rsp, 0x60
movabs rdx, 0x1d69365214740919
mov qword [rsp + 0x1b], rdx
movabs rdx, 0xb073611d2c06e2
mov qword [rsp + 0x23], rdx
movabs rdx, 0xf8b0042a2200b073
mov qword [rsp + 0x28], rdx
movabs rdx, 0x112028e5b615dfa3
mov qword [rsp + 0x30], rdx
movabs rdx, 0x14071c1504151813
mov qword [rsp + 0x38], rdx
movabs rdx, 0x1c0e0101160b03
mov qword [rsp + 0x40], rdx
movabs rdx, 0x40a110808081319
mov qword [rsp + 0x48], rdx
movabs rdx, 0x5090f17001b120a
mov qword [rsp + 0x50], rdx
movabs rdx, 0x10130113171a180a
mov qword [rsp + 0x58], rdx
xor eax, eax
jmp 0x588500
movzx r9d, byte [rsp + rsi + 0x1b]
sub r9d, edx
lea edx, [r9 + 0x68]
mov byte [rsp + rdi + 0x1b], dl
lea edx, [r8 + 0x68]
mov byte [rsp + rsi + 0x1b], dl
add rax, 2
nop word [rax + rax]
cmp rax, 0x28
jge 0x58852d
movzx edx, byte [rsp + rax + 0x38]
movzx esi, byte [rsp + rax + 0x39]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x1d
jae 0x588550
movzx r8d, byte [rsp + rdi + 0x1b]
sub r8d, edx
cmp rsi, 0x1d
jb 0x5884dd
jmp 0x588544
xor eax, eax
lea rbx, [rsp + 0x1b]
mov ecx, 0x1d
call fcn.0044bb20
add rsp, 0x60
pop rbp
ret
mov eax, esi
mov ecx, 0x1d
call fcn.00461020
mov eax, edi
mov ecx, 0x1d
call fcn.00461020
nop
nop dword [rax]
call fcn.0045eda0
jmp fcn.00588440

Function at 0x589760
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x58986c
push rbp
mov rbp, rsp
sub rsp, 0x50
movabs rdx, 0xce694470e4015c3f
mov qword [rsp + 0x1b], rdx
movabs rdx, 0x74de656cd4ae44c9
mov qword [rsp + 0x23], rdx
movabs rdx, 0xd474de656cd4ae44
mov qword [rsp + 0x24], rdx
movabs rdx, 0x59dd65deeb7244ed
mov qword [rsp + 0x2c], rdx
movabs rdx, 0x3090b1002110e03
mov qword [rsp + 0x34], rdx
movabs rdx, 0x900010903010018
mov qword [rsp + 0x3c], rdx
movabs rdx, 0x317081109000109
mov qword [rsp + 0x40], rdx
movabs rdx, 0x70a151408071818
mov qword [rsp + 0x48], rdx
xor eax, eax
jmp 0x589808
movzx r9d, byte [rsp + rsi + 0x1b]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x72]
mov byte [rsp + rdi + 0x1b], dl
mov byte [rsp + rsi + 0x1b], r8b
add rax, 2
cmp rax, 0x1c
jge 0x58983c
movzx edx, byte [rsp + rax + 0x34]
movzx esi, byte [rsp + rax + 0x35]
mov edi, edx
xor edx, esi
add edx, eax
nop
cmp rdi, 0x19
jae 0x58985f
movzx r8d, byte [rsp + rdi + 0x1b]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x72]
cmp rsi, 0x19
jb 0x5897ee
jmp 0x589853
xor eax, eax
lea rbx, [rsp + 0x1b]
mov ecx, 0x19
call fcn.0044bb20
add rsp, 0x50
pop rbp
ret
mov eax, esi
mov ecx, 0x19
call fcn.00461020
mov eax, edi
mov ecx, 0x19
call fcn.00461020
nop
call fcn.0045eda0
jmp fcn.00589760
Function at 0x58b640
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x58b712
push rbp
mov rbp, rsp
sub rsp, 0x38
movabs rdx, 0x641ac857cb73c6c3
mov qword [rsp + 0x1d], rdx
movabs rdx, 0x78f7cb7799641ac8
mov qword [rsp + 0x22], rdx
movabs rdx, 0x10a020b06030b02
mov qword [rsp + 0x2a], rdx
movabs rdx, 0x20205030008010a
mov qword [rsp + 0x30], rdx
xor eax, eax
jmp 0x58b6ac
movzx r9d, byte [rsp + rsi + 0x1d]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x64]
mov byte [rsp + rdi + 0x1d], dl
mov byte [rsp + rsi + 0x1d], r8b
add rax, 2
cmp rax, 0xe
jge 0x58b6de
movzx edx, byte [rsp + rax + 0x2a]
movzx esi, byte [rsp + rax + 0x2b]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0xd
jae 0x58b705
movzx r8d, byte [rsp + rdi + 0x1d]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x64]
cmp rsi, 0xd
jb 0x58b692
jmp 0x58b6f5
xor eax, eax
lea rbx, [rsp + 0x1d]
mov ecx, 0xd
call fcn.0044bb20
add rsp, 0x38
pop rbp
ret
mov eax, esi
mov ecx, 0xd
nop dword [rax]
call fcn.00461020
mov eax, edi
mov ecx, 0xd
call fcn.00461020
nop
call fcn.0045eda0
jmp fcn.0058b640

Function at 0x58c2a0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x58c358
push rbp
mov rbp, rsp
sub rsp, 0x30
movabs rdx, 0x786f787586836c49
mov qword [rsp + 0x1e], rdx
movabs rdx, 0x307040504040101
mov qword [rsp + 0x26], rdx
mov word [rsp + 0x2e], 0x102
xor eax, eax
jmp 0x58c2f8
movzx r9d, byte [rsp + rsi + 0x1e]
sub r9d, edx
lea edx, [r9 - 5]
mov byte [rsp + rdi + 0x1e], dl
lea edx, [r8 - 5]
mov byte [rsp + rsi + 0x1e], dl
add rax, 2
cmp rax, 0xa
jge 0x58c328
movzx edx, byte [rsp + rax + 0x26]
movzx esi, byte [rsp + rax + 0x27]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 8
jae 0x58c34b
movzx r8d, byte [rsp + rdi + 0x1e]
sub r8d, edx
nop dword [rax]
cmp rsi, 8
jb 0x58c2db
jmp 0x58c33f
xor eax, eax
lea rbx, [rsp + 0x1e]
mov ecx, 8
call fcn.0044bb20
add rsp, 0x30
pop rbp
ret
mov eax, esi
mov ecx, 8
call fcn.00461020
mov eax, edi
mov ecx, 8
call fcn.00461020
nop
call fcn.0045eda0
nop dword [rax]
jmp fcn.0058c2a0
Function at 0x58cb80
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x58cc6c
push rbp
mov rbp, rsp
sub rsp, 0x48
movabs rdx, 0x5130672b21d3344
mov qword [rsp + 0x19], rdx
movabs rdx, 0xa7046f03de046e05
mov qword [rsp + 0x20], rdx
movabs rdx, 0x6b486f068e856e0c
mov qword [rsp + 0x28], rdx
movabs rdx, 0x1111309120a0e13
mov qword [rsp + 0x30], rdx
movabs rdx, 0x20a02030d110a15
mov qword [rsp + 0x38], rdx
movabs rdx, 0xf0d0b0506020701
mov qword [rsp + 0x40], rdx
xor eax, eax
jmp 0x58cc0a
movzx r9d, byte [rsp + rsi + 0x19]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x4a]
mov byte [rsp + rdi + 0x19], dl
mov byte [rsp + rsi + 0x19], r8b
add rax, 2
cmp rax, 0x18
jge 0x58cc3c
movzx edx, byte [rsp + rax + 0x30]
movzx esi, byte [rsp + rax + 0x31]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x17
jae 0x58cc5f
movzx r8d, byte [rsp + rdi + 0x19]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x4a]
cmp rsi, 0x17
jb 0x58cbf0
jmp 0x58cc53
xor eax, eax
lea rbx, [rsp + 0x19]
mov ecx, 0x17
call fcn.0044bb20
add rsp, 0x48
pop rbp
ret
mov eax, esi
mov ecx, 0x17
call fcn.00461020
mov eax, edi
mov ecx, 0x17
call fcn.00461020
nop
call fcn.0045eda0
jmp fcn.0058cb80

Function at 0x58cc80
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x58cd7b
push rbp
mov rbp, rsp
sub rsp, 0x50
movabs rdx, 0x1609827355cc60d6
mov qword [rsp + 0x1c], rdx
movabs rdx, 0x144401a2f9f16f72
mov qword [rsp + 0x24], rdx
movabs rdx, 0x5272f774701909
mov qword [rsp + 0x2c], rdx
movabs rdx, 0xb00160c12020500
mov qword [rsp + 0x34], rdx
movabs rdx, 0x50c170a11120b10
mov qword [rsp + 0x3c], rdx
movabs rdx, 0x1020705050c170a
mov qword [rsp + 0x40], rdx
movabs rdx, 0xf060d14020f1601
mov qword [rsp + 0x48], rdx
xor eax, eax
jmp 0x58cd19
movzx r9d, byte [rsp + rsi + 0x1c]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x3d]
mov byte [rsp + rdi + 0x1c], dl
mov byte [rsp + rsi + 0x1c], r8b
add rax, 2
cmp rax, 0x1c
jge 0x58cd4b
movzx edx, byte [rsp + rax + 0x34]
movzx esi, byte [rsp + rax + 0x35]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x18
jae 0x58cd6e
movzx r8d, byte [rsp + rdi + 0x1c]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x3d]
cmp rsi, 0x18
jb 0x58ccff
jmp 0x58cd62
xor eax, eax
lea rbx, [rsp + 0x1c]
mov ecx, 0x18
call fcn.0044bb20
add rsp, 0x50
pop rbp
ret
mov eax, esi
mov ecx, 0x18
call fcn.00461020
mov eax, edi
mov ecx, 0x18
call fcn.00461020
nop
nop dword [rax + rax]
call fcn.0045eda0
jmp fcn.0058cc80
Function at 0x58cda0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x58ce9b
push rbp
mov rbp, rsp
sub rsp, 0x50
movabs rdx, 0x2cc66fa2fa74cfbe
mov qword [rsp + 0x1f], rdx
movabs rdx, 0x496e6f0fb7c2a02c
mov qword [rsp + 0x26], rdx
movabs rdx, 0xc36fb669bdde336e
mov qword [rsp + 0x2e], rdx
movabs rdx, 0xb12101014050714
mov qword [rsp + 0x36], rdx
movabs rdx, 0x90103151114100a
mov qword [rsp + 0x3e], rdx
movabs rdx, 0x304090103151114
mov qword [rsp + 0x40], rdx
movabs rdx, 0x1116121506040008
mov qword [rsp + 0x48], rdx
xor eax, eax
jmp 0x58ce39
movzx r9d, byte [rsp + rsi + 0x1f]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x73]
mov byte [rsp + rdi + 0x1f], dl
mov byte [rsp + rsi + 0x1f], r8b
add rax, 2
cmp rax, 0x1a
jge 0x58ce6b
movzx edx, byte [rsp + rax + 0x36]
movzx esi, byte [rsp + rax + 0x37]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x17
jae 0x58ce8e
movzx r8d, byte [rsp + rdi + 0x1f]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x73]
cmp rsi, 0x17
jb 0x58ce1f
jmp 0x58ce82
xor eax, eax
lea rbx, [rsp + 0x1f]
mov ecx, 0x17
call fcn.0044bb20
add rsp, 0x50
pop rbp
ret
mov eax, esi
mov ecx, 0x17
call fcn.00461020
mov eax, edi
mov ecx, 0x17
call fcn.00461020
nop
nop dword [rax + rax]
call fcn.0045eda0
jmp fcn.0058cda0

Function at 0x58d400
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x58d4dd
push rbp
mov rbp, rsp
sub rsp, 0x40
movabs rdx, 0x936fb3b5898f88b3
mov qword [rsp + 0x18], rdx
movabs rdx, 0x808a7473ace354c7
mov qword [rsp + 0x20], rdx
movabs rdx, 0x800040f0801080a
mov qword [rsp + 0x28], rdx
movabs rdx, 0x80f0b0202050a0e
mov qword [rsp + 0x30], rdx
movabs rdx, 0x60e020703010e01
mov qword [rsp + 0x38], rdx
xor eax, eax
nop
jmp 0x58d480
movzx r9d, byte [rsp + rsi + 0x18]
sub r9d, edx
lea edx, [r9 - 0xc]
mov byte [rsp + rdi + 0x18], dl
lea edx, [r8 - 0xc]
mov byte [rsp + rsi + 0x18], dl
add rax, 2
nop
cmp rax, 0x18
jge 0x58d4ad
movzx edx, byte [rsp + rax + 0x28]
movzx esi, byte [rsp + rax + 0x29]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x10
jae 0x58d4d0
movzx r8d, byte [rsp + rdi + 0x18]
sub r8d, edx
cmp rsi, 0x10
jb 0x58d462
jmp 0x58d4c4
xor eax, eax
lea rbx, [rsp + 0x18]
mov ecx, 0x10
call fcn.0044bb20
add rsp, 0x40
pop rbp
ret
mov eax, esi
mov ecx, 0x10
call fcn.00461020
mov eax, edi
mov ecx, 0x10
call fcn.00461020
nop
nop dword [rax]
call fcn.0045eda0
jmp fcn.0058d400
Function at 0x58df00
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x58dffb
push rbp
mov rbp, rsp
sub rsp, 0x50
movabs rdx, 0x726a8b74024153af
mov qword [rsp + 0x1d], rdx
movabs rdx, 0xbd72ecf3ed726a8b
mov qword [rsp + 0x22], rdx
movabs rdx, 0x5777d26565f82065
mov qword [rsp + 0x2a], rdx
movabs rdx, 0xe0505090407000e
mov qword [rsp + 0x32], rdx
movabs rdx, 0x907131010000305
mov qword [rsp + 0x3a], rdx
movabs rdx, 0x60a080f04030907
mov qword [rsp + 0x40], rdx
movabs rdx, 0x120a0a0d000e0c10
mov qword [rsp + 0x48], rdx
xor eax, eax
jmp 0x58df99
movzx r9d, byte [rsp + rsi + 0x1d]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x5f]
mov byte [rsp + rdi + 0x1d], dl
mov byte [rsp + rsi + 0x1d], r8b
add rax, 2
cmp rax, 0x1e
jge 0x58dfcb
movzx edx, byte [rsp + rax + 0x32]
movzx esi, byte [rsp + rax + 0x33]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x15
jae 0x58dfee
movzx r8d, byte [rsp + rdi + 0x1d]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x5f]
cmp rsi, 0x15
jb 0x58df7f
jmp 0x58dfe2
xor eax, eax
lea rbx, [rsp + 0x1d]
mov ecx, 0x15
call fcn.0044bb20
add rsp, 0x50
pop rbp
ret
mov eax, esi
mov ecx, 0x15
call fcn.00461020
mov eax, edi
mov ecx, 0x15
call fcn.00461020
nop
nop dword [rax + rax]
call fcn.0045eda0
jmp fcn.0058df00

Function at 0x140003a30
Capabilities:
Parse pe header

Disassembly:
push rbx
sub rsp, 0x40
mov qword [rsp + 0x58], rdx
mov rbx, r8
xor edx, edx
test rcx, rcx
je 0x140003a64
cmp word [rcx], 0x5a4d
jne 0x140003a64
movsxd rax, dword [rcx + 0x3c]
cmp eax, 0x400
jg 0x140003a64
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140003a64
mov edx, dword [rcx + 0x28]
add rdx, qword [rsp + 0x58]
mov rcx, rbx
call fcn.140003970
test eax, eax
jne 0x140003a80
xor eax, eax
add rsp, 0x40
pop rbx
ret
mov rcx, rbx
call fcn.1400039e0
test rax, rax
je 0x140003a75
lea rdx, [rax + 0x10]
lea rax, [rsp + 0x38]
mov rcx, qword [rbx]
mov r9d, 8
mov qword [rsp + 0x20], rax
lea r8, [rsp + 0x58]
mov qword [rsp + 0x38], 0
call fcn.140004235
not eax
shr eax, 0x1f
add rsp, 0x40
pop rbx
ret

Function at 0x140004130
Capabilities:
Execute syscall

Disassembly:
pop rax
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], r9
sub rsp, 0x28
mov rcx, r10
call fcn.1400040d0
add rsp, 0x28
mov rcx, qword [rsp + 8]
mov rdx, qword [rsp + 0x10]
mov r8, qword [rsp + 0x18]
mov r9, qword [rsp + 0x20]
mov r10, rcx
syscall
ret

Function at 0x140004cf0
Capabilities:
Parse pe header

Disassembly:
xor eax, eax
cmp word [rcx], 0x5a4d
jne 0x140004d13
movsxd rdx, dword [rcx + 0x3c]
add rcx, rdx
cmp dword [rcx], 0x4550
jne 0x140004d13
xor eax, eax
cmp word [rcx + 0x18], 0x20b
sete al
ret

Function at 0x140004dc1
Capabilities:
Enumerate pe sections

Disassembly:
sub rsp, 0x28
mov r9, qword [0x140535330]
mov r8, rcx
mov rcx, r9
call fcn.140004cf0
test eax, eax
je 0x140004ded
mov rdx, r8
mov rcx, r9
sub rdx, r9
add rsp, 0x28
jmp fcn.140004d14
xor eax, eax
add rsp, 0x28
ret
Function at 0x140004000
Capabilities:
Access peb ldr_data
Resolve function by parsing pe exports

Disassembly:
cld
and rsp, 0xfffffffffffffff0
call fcn.1400040d6
push r9
push r8
push rdx
push rcx
xor rdx, rdx
mov rdx, qword gs:[rdx + 0x60]
push rsi
mov rdx, qword [rdx + 0x18]
mov rdx, qword [rdx + 0x20]
xor r9, r9
mov rsi, qword [rdx + 0x50]
movzx rcx, word [rdx + 0x4a]
xor rax, rax
lodsb al, byte [rsi]
cmp al, 0x61
jl 0x140004037
sub al, 0x20
ror r9d, 0xd
add r9d, eax
loop 0x14000402d
push rdx
push r9
mov rdx, qword [rdx + 0x20]
mov eax, dword [rdx + 0x3c]
add rax, rdx
cmp word [rax + 0x18], 0x20b
jne 0x1400040cb
mov eax, dword [rax + 0x88]
test rax, rax
je 0x1400040cb
add rax, rdx
mov ecx, dword [rax + 0x18]
mov r8d, dword [rax + 0x20]
add r8, rdx
push rax
jrcxz 0x1400040ca
xor r9, r9
dec rcx
mov esi, dword [r8 + rcx*4]
add rsi, rdx
xor rax, rax
ror r9d, 0xd
lodsb al, byte [rsi]
add r9d, eax
cmp al, ah
jne 0x140004081
add r9, qword [rsp + 8]
cmp r9d, r10d
jne 0x140004072
pop rax
mov r8d, dword [rax + 0x24]
add r8, rdx
mov cx, word [r8 + rcx*2]
mov r8d, dword [rax + 0x1c]
add r8, rdx
mov eax, dword [r8 + rcx*4]
pop r8
add rax, rdx
pop r8
pop rsi
pop rcx
pop rdx
pop r8
pop r9
pop r10
sub rsp, 0x20
push r10
jmp rax
pop rax
pop r9
pop rdx
mov rdx, qword [rdx]
jmp 0x140004021