joyce8/EMBER2024-capa huggingface dataset:
Function at 0x588380
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x58849d
push rbp
mov rbp, rsp
sub rsp, 0x58
movabs rdx, 0x597d786071776053
mov qword [rsp + 0x1c], rdx
movabs rdx, 0x5f5d5fa854735174
mov qword [rsp + 0x24], rdx
movabs rdx, 0x726c5f5d5fa85473
mov qword [rsp + 0x26], rdx
movabs rdx, 0x6665548067726372
mov qword [rsp + 0x2e], rdx
movabs rdx, 0x7150e01040210
mov qword [rsp + 0x36], rdx
movabs rdx, 0x16030007150e0104
mov qword [rsp + 0x38], rdx
movabs rdx, 0xc100200000d000f
mov qword [rsp + 0x40], rdx
movabs rdx, 0x150d090b06131913
mov qword [rsp + 0x48], rdx
movabs rdx, 0xf10000e05060903
mov qword [rsp + 0x50], rdx
xor eax, eax
jmp 0x588440
movzx r9d, byte [rsp + rsi + 0x1c]
sub r9d, edx
lea edx, [r9 + 0x1b]
mov byte [rsp + rdi + 0x1c], dl
lea edx, [r8 + 0x1b]
mov byte [rsp + rsi + 0x1c], dl
add rax, 2
nop word [rax + rax]
cmp rax, 0x22
jge 0x58846d
movzx edx, byte [rsp + rax + 0x36]
movzx esi, byte [rsp + rax + 0x37]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x1a
jae 0x588490
movzx r8d, byte [rsp + rdi + 0x1c]
sub r8d, edx
cmp rsi, 0x1a
jb 0x58841d
jmp 0x588484
xor eax, eax
lea rbx, [rsp + 0x1c]
mov ecx, 0x1a
call fcn.0044bb20
add rsp, 0x58
pop rbp
ret
mov eax, esi
mov ecx, 0x1a
call fcn.00461020
mov eax, edi
mov ecx, 0x1a
call fcn.00461020
nop
nop dword [rax]
call fcn.0045eda0
jmp fcn.00588380

Function at 0x5892a0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x58938a
push rbp
mov rbp, rsp
sub rsp, 0x40
movabs rdx, 0x8b75646f94b91e9a
mov qword [rsp + 0x1a], rdx
movabs rdx, 0xcc058b75646f94b9
mov qword [rsp + 0x1c], rdx
movabs rdx, 0x6eb5c1ccc76573bd
mov qword [rsp + 0x24], rdx
movabs rdx, 0x1010010f020e0300
mov qword [rsp + 0x2c], rdx
movabs rdx, 0xd1109071010010f
mov qword [rsp + 0x30], rdx
movabs rdx, 0xa0f0a090d0a080a
mov qword [rsp + 0x38], rdx
xor eax, eax
jmp 0x58932d
movzx r9d, byte [rsp + rsi + 0x1a]
sub r9d, edx
lea edx, [r9 - 0x4a]
mov byte [rsp + rdi + 0x1a], dl
lea edx, [r8 - 0x4a]
mov byte [rsp + rsi + 0x1a], dl
add rax, 2
cmp rax, 0x14
jge 0x58935a
movzx edx, byte [rsp + rax + 0x2c]
movzx esi, byte [rsp + rax + 0x2d]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x12
jae 0x58937d
movzx r8d, byte [rsp + rdi + 0x1a]
sub r8d, edx
cmp rsi, 0x12
jb 0x589310
jmp 0x589371
xor eax, eax
lea rbx, [rsp + 0x1a]
mov ecx, 0x12
call fcn.0044bb20
add rsp, 0x40
pop rbp
ret
mov eax, esi
mov ecx, 0x12
call fcn.00461020
mov eax, edi
mov ecx, 0x12
call fcn.00461020
nop
call fcn.0045eda0
jmp fcn.005892a0
Function at 0x58a580
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x58a688
push rbp
mov rbp, rsp
sub rsp, 0x50
movabs rdx, 0x42d644cea98a03c1
mov qword [rsp + 0x18], rdx
movabs rdx, 0xfaeb7208646cc89f
mov qword [rsp + 0x20], rdx
movabs rdx, 0x72c4faeb7208646c
mov qword [rsp + 0x22], rdx
movabs rdx, 0xa2dead70becbc730
mov qword [rsp + 0x2a], rdx
movabs rdx, 0x10c0e0f1719180c
mov qword [rsp + 0x32], rdx
movabs rdx, 0x810081615021202
mov qword [rsp + 0x3a], rdx
movabs rdx, 0x15000306100f0810
mov qword [rsp + 0x40], rdx
movabs rdx, 0x914030c130e1804
mov qword [rsp + 0x48], rdx
xor eax, eax
jmp 0x58a62b
movzx r9d, byte [rsp + rsi + 0x18]
sub r9d, edx
lea edx, [r9 - 0x29]
mov byte [rsp + rdi + 0x18], dl
lea edx, [r8 - 0x29]
mov byte [rsp + rsi + 0x18], dl
add rax, 2
cmp rax, 0x1e
jge 0x58a658
movzx edx, byte [rsp + rax + 0x32]
movzx esi, byte [rsp + rax + 0x33]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x1a
jae 0x58a67b
movzx r8d, byte [rsp + rdi + 0x18]
sub r8d, edx
cmp rsi, 0x1a
jb 0x58a60e
jmp 0x58a66f
xor eax, eax
lea rbx, [rsp + 0x18]
mov ecx, 0x1a
call fcn.0044bb20
add rsp, 0x50
pop rbp
ret
mov eax, esi
mov ecx, 0x1a
call fcn.00461020
mov eax, edi
mov ecx, 0x1a
call fcn.00461020
nop
call fcn.0045eda0
jmp fcn.0058a580

Function at 0x58aae0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x58abfa
push rbp
mov rbp, rsp
sub rsp, 0x60
movabs rdx, 0x3a1a6e53ec4d2847
mov qword [rsp + 0x1c], rdx
movabs rdx, 0x7861673e1d73606c
mov qword [rsp + 0x24], rdx
movabs rdx, 0x5b5260737861673e
mov qword [rsp + 0x28], rdx
movabs rdx, 0x494d80546d2f014a
mov qword [rsp + 0x30], rdx
movabs rdx, 0x1a19011b0e131b00
mov qword [rsp + 0x38], rdx
movabs rdx, 0x11070d0f110b0306
mov qword [rsp + 0x40], rdx
movabs rdx, 0x1106141503051618
mov qword [rsp + 0x48], rdx
movabs rdx, 0x40105050902111b
mov qword [rsp + 0x50], rdx
movabs rdx, 0x1214180c1b051418
mov qword [rsp + 0x58], rdx
xor eax, eax
jmp 0x58ab97
movzx r9d, byte [rsp + rsi + 0x1c]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x11]
mov byte [rsp + rdi + 0x1c], dl
mov byte [rsp + rsi + 0x1c], r8b
add rax, 2
cmp rax, 0x28
jge 0x58abc9
movzx edx, byte [rsp + rax + 0x38]
movzx esi, byte [rsp + rax + 0x39]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x1c
jae 0x58abed
movzx r8d, byte [rsp + rdi + 0x1c]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x11]
cmp rsi, 0x1c
jb 0x58ab7d
jmp 0x58abe1
xor eax, eax
lea rbx, [rsp + 0x1c]
mov ecx, 0x1c
call fcn.0044bb20
add rsp, 0x60
pop rbp
nop
ret
mov eax, esi
mov ecx, 0x1c
call fcn.00461020
mov eax, edi
mov ecx, 0x1c
call fcn.00461020
nop
call fcn.0045eda0
nop
jmp fcn.0058aae0
Function at 0x58c100
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x58c1fd
push rbp
mov rbp, rsp
sub rsp, 0x50
movabs rdx, 0xfe909f70fd74658a
mov qword [rsp + 0x1c], rdx
movabs rdx, 0x7a72956d016bfe90
mov qword [rsp + 0x22], rdx
movabs rdx, 0x39cc661ba5e96574
mov qword [rsp + 0x2a], rdx
movabs rdx, 0x120e091515060b08
mov qword [rsp + 0x32], rdx
movabs rdx, 0x706070e050d0915
mov qword [rsp + 0x3a], rdx
movabs rdx, 0x311070311120706
mov qword [rsp + 0x40], rdx
movabs rdx, 0x150307000e141007
mov qword [rsp + 0x48], rdx
xor eax, eax
jmp 0x58c1a0
movzx r9d, byte [rsp + rsi + 0x1c]
sub r9d, edx
lea edx, [r9 - 0x24]
mov byte [rsp + rdi + 0x1c], dl
lea edx, [r8 - 0x24]
mov byte [rsp + rsi + 0x1c], dl
add rax, 2
nop dword [rax]
cmp rax, 0x1e
jge 0x58c1cd
movzx edx, byte [rsp + rax + 0x32]
movzx esi, byte [rsp + rax + 0x33]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x16
jae 0x58c1f0
movzx r8d, byte [rsp + rdi + 0x1c]
sub r8d, edx
cmp rsi, 0x16
jb 0x58c17f
jmp 0x58c1e4
xor eax, eax
lea rbx, [rsp + 0x1c]
mov ecx, 0x16
call fcn.0044bb20
add rsp, 0x50
pop rbp
ret
mov eax, esi
mov ecx, 0x16
call fcn.00461020
mov eax, edi
mov ecx, 0x16
call fcn.00461020
nop
nop dword [rax]
call fcn.0045eda0
jmp fcn.0058c100
Function at 0x58fc20
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x58fcfd
push rbp
mov rbp, rsp
sub rsp, 0x40
movabs rdx, 0x1b6bc70ff474855d
mov qword [rsp + 0x1c], rdx
movabs rdx, 0x77a8646e26028a6f
mov qword [rsp + 0x24], rdx
movabs rdx, 0x709070a040301
mov qword [rsp + 0x2c], rdx
movabs rdx, 0x401070000070907
mov qword [rsp + 0x30], rdx
movabs rdx, 0x7000b000e0a0905
mov qword [rsp + 0x38], rdx
xor eax, eax
nop
jmp 0x58fca0
movzx r9d, byte [rsp + rsi + 0x1c]
sub r9d, edx
lea edx, [r9 - 0x3f]
mov byte [rsp + rdi + 0x1c], dl
lea edx, [r8 - 0x3f]
mov byte [rsp + rsi + 0x1c], dl
add rax, 2
nop
cmp rax, 0x14
jge 0x58fccd
movzx edx, byte [rsp + rax + 0x2c]
movzx esi, byte [rsp + rax + 0x2d]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x10
jae 0x58fcf0
movzx r8d, byte [rsp + rdi + 0x1c]
sub r8d, edx
cmp rsi, 0x10
jb 0x58fc82
jmp 0x58fce4
xor eax, eax
lea rbx, [rsp + 0x1c]
mov ecx, 0x10
call fcn.0044bb20
add rsp, 0x40
pop rbp
ret
mov eax, esi
mov ecx, 0x10
call fcn.00461020
mov eax, edi
mov ecx, 0x10
call fcn.00461020
nop
nop dword [rax]
call fcn.0045eda0
jmp fcn.0058fc20

Function at 0x591f60
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x592046
push rbp
mov rbp, rsp
sub rsp, 0x40
movabs rdx, 0x66e2d86556c2ecd5
mov qword [rsp + 0x1e], rdx
movabs rdx, 0x784d744030d6bac9
mov qword [rsp + 0x26], rdx
movabs rdx, 0xb060e0901050e02
mov qword [rsp + 0x2e], rdx
movabs rdx, 0x1090b060e090105
mov qword [rsp + 0x30], rdx
movabs rdx, 0xa020006020c0908
mov qword [rsp + 0x38], rdx
xor eax, eax
nop
jmp 0x591fe0
movzx r9d, byte [rsp + rsi + 0x1e]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x80]
mov byte [rsp + rdi + 0x1e], dl
mov byte [rsp + rsi + 0x1e], r8b
add rax, 2
nop dword [rax]
cmp rax, 0x12
jge 0x592012
movzx edx, byte [rsp + rax + 0x2e]
movzx esi, byte [rsp + rax + 0x2f]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x10
jae 0x592037
movzx r8d, byte [rsp + rdi + 0x1e]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x80]
cmp rsi, 0x10
jb 0x591fc2
jmp 0x59202b
xor eax, eax
lea rbx, [rsp + 0x1e]
mov ecx, 0x10
nop
call fcn.0044bb20
add rsp, 0x40
pop rbp
ret
mov eax, esi
mov ecx, 0x10
call fcn.00461020
mov eax, edi
mov ecx, 0x10
nop
call fcn.00461020
nop
call fcn.0045eda0
jmp fcn.00591f60
Function at 0x593780
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x593847
push rbp
mov rbp, rsp
sub rsp, 0x30
movabs rdx, 0x46e2630584fa9357
mov qword [rsp + 0x19], rdx
movabs rdx, 0xce6f0346e2630584
mov qword [rsp + 0x1c], rdx
movabs rdx, 0x603010404080a02
mov qword [rsp + 0x24], rdx
mov dword [rsp + 0x2c], 0x1010604
xor eax, eax
jmp 0x5937e8
movzx r9d, byte [rsp + rsi + 0x19]
sub r9d, edx
lea edx, [r9 + 0x7b]
mov byte [rsp + rdi + 0x19], dl
lea edx, [r8 + 0x7b]
mov byte [rsp + rsi + 0x19], dl
add rax, 2
cmp rax, 0xc
jge 0x593817
movzx edx, byte [rsp + rax + 0x24]
movzx esi, byte [rsp + rax + 0x25]
mov edi, edx
xor edx, esi
add edx, eax
nop
cmp rdi, 0xb
jae 0x59383a
movzx r8d, byte [rsp + rdi + 0x19]
sub r8d, edx
cmp rsi, 0xb
jb 0x5937cb
jmp 0x59382e
xor eax, eax
lea rbx, [rsp + 0x19]
mov ecx, 0xb
call fcn.0044bb20
add rsp, 0x30
pop rbp
ret
mov eax, esi
mov ecx, 0xb
call fcn.00461020
mov eax, edi
mov ecx, 0xb
call fcn.00461020
nop
call fcn.0045eda0
jmp fcn.00593780

Function at 0x5938e0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x5939ac
push rbp
mov rbp, rsp
sub rsp, 0x30
movabs rdx, 0x706b736f616c5068
mov qword [rsp + 0x18], rdx
mov word [rsp + 0x20], 0x895c
movabs rdx, 0x307010809030507
mov qword [rsp + 0x22], rdx
movabs rdx, 0x5020707080307
mov qword [rsp + 0x28], rdx
xor eax, eax
jmp 0x593944
movzx r9d, byte [rsp + rsi + 0x18]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x16]
mov byte [rsp + rdi + 0x18], dl
mov byte [rsp + rsi + 0x18], r8b
add rax, 2
cmp rax, 0xe
jge 0x59397c
movzx edx, byte [rsp + rax + 0x22]
movzx esi, byte [rsp + rax + 0x23]
mov edi, edx
xor edx, esi
add edx, eax
nop word [rax + rax]
cmp rdi, 0xa
jae 0x59399f
movzx r8d, byte [rsp + rdi + 0x18]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x16]
cmp rsi, 0xa
jb 0x59392a
jmp 0x593993
xor eax, eax
lea rbx, [rsp + 0x18]
mov ecx, 0xa
call fcn.0044bb20
add rsp, 0x30
pop rbp
ret
mov eax, esi
mov ecx, 0xa
call fcn.00461020
mov eax, edi
mov ecx, 0xa
call fcn.00461020
nop
call fcn.0045eda0
jmp fcn.005938e0

Function at 0x5939c0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x593a87
push rbp
mov rbp, rsp
sub rsp, 0x30
movabs rdx, 0x39433784bf0753b1
mov qword [rsp + 0x18], rdx
mov word [rsp + 0x20], 0x7075
movabs rdx, 0x204070200000305
mov qword [rsp + 0x22], rdx
movabs rdx, 0x703030602070204
mov qword [rsp + 0x28], rdx
xor eax, eax
jmp 0x593a27
movzx r9d, byte [rsp + rsi + 0x18]
sub r9d, edx
lea edx, [r9 - 0x58]
mov byte [rsp + rdi + 0x18], dl
lea edx, [r8 - 0x58]
mov byte [rsp + rsi + 0x18], dl
add rax, 2
cmp rax, 0xe
jge 0x593a57
movzx edx, byte [rsp + rax + 0x22]
movzx esi, byte [rsp + rax + 0x23]
mov edi, edx
xor edx, esi
add edx, eax
nop dword [rax]
cmp rdi, 0xa
jae 0x593a7a
movzx r8d, byte [rsp + rdi + 0x18]
sub r8d, edx
cmp rsi, 0xa
jb 0x593a0a
jmp 0x593a6e
xor eax, eax
lea rbx, [rsp + 0x18]
mov ecx, 0xa
call fcn.0044bb20
add rsp, 0x30
pop rbp
ret
mov eax, esi
mov ecx, 0xa
call fcn.00461020
mov eax, edi
mov ecx, 0xa
call fcn.00461020
nop
call fcn.0045eda0
jmp fcn.005939c0
Function at 0x593d00
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x593ddd
push rbp
mov rbp, rsp
sub rsp, 0x38
movabs rdx, 0x374362f68a7b267
mov qword [rsp + 0x19], rdx
movabs rdx, 0xe86dadafdf037436
mov qword [rsp + 0x1e], rdx
movabs rdx, 0xc0c0404080a0509
mov qword [rsp + 0x26], rdx
movabs rdx, 0x9040c0c0404080a
mov qword [rsp + 0x28], rdx
movabs rdx, 0x10c020a0a070409
mov qword [rsp + 0x30], rdx
xor eax, eax
nop
jmp 0x593d80
movzx r9d, byte [rsp + rsi + 0x19]
sub r9d, edx
lea edx, [r9 - 0x30]
mov byte [rsp + rdi + 0x19], dl
lea edx, [r8 - 0x30]
mov byte [rsp + rsi + 0x19], dl
add rax, 2
nop
cmp rax, 0x12
jge 0x593dad
movzx edx, byte [rsp + rax + 0x26]
movzx esi, byte [rsp + rax + 0x27]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0xd
jae 0x593dd0
movzx r8d, byte [rsp + rdi + 0x19]
sub r8d, edx
cmp rsi, 0xd
jb 0x593d62
jmp 0x593dc4
xor eax, eax
lea rbx, [rsp + 0x19]
mov ecx, 0xd
call fcn.0044bb20
add rsp, 0x38
pop rbp
ret
mov eax, esi
mov ecx, 0xd
call fcn.00461020
mov eax, edi
mov ecx, 0xd
call fcn.00461020
nop
nop dword [rax]
call fcn.0045eda0
jmp fcn.00593d00

Function at 0x594300
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x5943cc
push rbp
mov rbp, rsp
sub rsp, 0x30
movabs rdx, 0x9febad21b0d4a267
mov qword [rsp + 0x18], rdx
mov word [rsp + 0x20], 0xe997
movabs rdx, 0x405040604060209
mov qword [rsp + 0x22], rdx
movabs rdx, 0x907080103020405
mov qword [rsp + 0x28], rdx
xor eax, eax
jmp 0x594364
movzx r9d, byte [rsp + rsi + 0x18]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x45]
mov byte [rsp + rdi + 0x18], dl
mov byte [rsp + rsi + 0x18], r8b
add rax, 2
cmp rax, 0xe
jge 0x59439c
movzx edx, byte [rsp + rax + 0x22]
movzx esi, byte [rsp + rax + 0x23]
mov edi, edx
xor edx, esi
add edx, eax
nop word [rax + rax]
cmp rdi, 0xa
jae 0x5943bf
movzx r8d, byte [rsp + rdi + 0x18]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x45]
cmp rsi, 0xa
jb 0x59434a
jmp 0x5943b3
xor eax, eax
lea rbx, [rsp + 0x18]
mov ecx, 0xa
call fcn.0044bb20
add rsp, 0x30
pop rbp
ret
mov eax, esi
mov ecx, 0xa
call fcn.00461020
mov eax, edi
mov ecx, 0xa
call fcn.00461020
nop
call fcn.0045eda0
jmp fcn.00594300
Function at 0x594460
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x594527
push rbp
mov rbp, rsp
sub rsp, 0x30
movabs rdx, 0x6f5d63b5c46e65c0
mov qword [rsp + 0x18], rdx
mov word [rsp + 0x20], 0xba62
movabs rdx, 0x604090902080806
mov qword [rsp + 0x22], rdx
movabs rdx, 0x304040802000604
mov qword [rsp + 0x28], rdx
xor eax, eax
jmp 0x5944c7
movzx r9d, byte [rsp + rsi + 0x18]
sub r9d, edx
lea edx, [r9 - 0x42]
mov byte [rsp + rdi + 0x18], dl
lea edx, [r8 - 0x42]
mov byte [rsp + rsi + 0x18], dl
add rax, 2
cmp rax, 0xe
jge 0x5944f7
movzx edx, byte [rsp + rax + 0x22]
movzx esi, byte [rsp + rax + 0x23]
mov edi, edx
xor edx, esi
add edx, eax
nop dword [rax]
cmp rdi, 0xa
jae 0x59451a
movzx r8d, byte [rsp + rdi + 0x18]
sub r8d, edx
cmp rsi, 0xa
jb 0x5944aa
jmp 0x59450e
xor eax, eax
lea rbx, [rsp + 0x18]
mov ecx, 0xa
call fcn.0044bb20
add rsp, 0x30
pop rbp
ret
mov eax, esi
mov ecx, 0xa
call fcn.00461020
mov eax, edi
mov ecx, 0xa
call fcn.00461020
nop
call fcn.0045eda0
jmp fcn.00594460

Function at 0x595840
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x595926
push rbp
mov rbp, rsp
sub rsp, 0x40
movabs rdx, 0xa63db5906fbc9681
mov qword [rsp + 0x1e], rdx
movabs rdx, 0xa6067e466547a63d
mov qword [rsp + 0x24], rdx
movabs rdx, 0xd01070705050c01
mov qword [rsp + 0x2c], rdx
movabs rdx, 0xa020a0d0d010707
mov qword [rsp + 0x30], rdx
movabs rdx, 0x60001040b050a08
mov qword [rsp + 0x38], rdx
xor eax, eax
nop
jmp 0x5958c0
movzx r9d, byte [rsp + rsi + 0x1e]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x35]
mov byte [rsp + rdi + 0x1e], dl
mov byte [rsp + rsi + 0x1e], r8b
add rax, 2
nop dword [rax]
cmp rax, 0x14
jge 0x5958f2
movzx edx, byte [rsp + rax + 0x2c]
movzx esi, byte [rsp + rax + 0x2d]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0xe
jae 0x595917
movzx r8d, byte [rsp + rdi + 0x1e]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x35]
cmp rsi, 0xe
jb 0x5958a2
jmp 0x59590b
xor eax, eax
lea rbx, [rsp + 0x1e]
mov ecx, 0xe
nop
call fcn.0044bb20
add rsp, 0x40
pop rbp
ret
mov eax, esi
mov ecx, 0xe
call fcn.00461020
mov eax, edi
mov ecx, 0xe
nop
call fcn.00461020
nop
call fcn.0045eda0
jmp fcn.00595840
Function at 0x595940
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x595a4c
push rbp
mov rbp, rsp
sub rsp, 0x50
movabs rdx, 0x6fd0bf68d0e4691a
mov qword [rsp + 0x1b], rdx
movabs rdx, 0xc7c2b5ae61c12073
mov qword [rsp + 0x23], rdx
movabs rdx, 0xa6c7c2b5ae61c120
mov qword [rsp + 0x24], rdx
movabs rdx, 0x55d3746e656dd167
mov qword [rsp + 0x2c], rdx
movabs rdx, 0x1800000503061712
mov qword [rsp + 0x34], rdx
movabs rdx, 0x10090909080e0008
mov qword [rsp + 0x3c], rdx
movabs rdx, 0x90e0c0210090909
mov qword [rsp + 0x40], rdx
movabs rdx, 0xc10100f01050a0d
mov qword [rsp + 0x48], rdx
xor eax, eax
jmp 0x5959e8
movzx r9d, byte [rsp + rsi + 0x1b]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x63]
mov byte [rsp + rdi + 0x1b], dl
mov byte [rsp + rsi + 0x1b], r8b
add rax, 2
cmp rax, 0x1c
jge 0x595a1c
movzx edx, byte [rsp + rax + 0x34]
movzx esi, byte [rsp + rax + 0x35]
mov edi, edx
xor edx, esi
add edx, eax
nop
cmp rdi, 0x19
jae 0x595a3f
movzx r8d, byte [rsp + rdi + 0x1b]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x63]
cmp rsi, 0x19
jb 0x5959ce
jmp 0x595a33
xor eax, eax
lea rbx, [rsp + 0x1b]
mov ecx, 0x19
call fcn.0044bb20
add rsp, 0x50
pop rbp
ret
mov eax, esi
mov ecx, 0x19
call fcn.00461020
mov eax, edi
mov ecx, 0x19
call fcn.00461020
nop
call fcn.0045eda0
jmp fcn.00595940

Function at 0x5a8ec0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x5a8f86
push rbp
mov rbp, rsp
sub rsp, 0x30
movabs rdx, 0x8287725d9f896599
mov qword [rsp + 0x24], rdx
mov dword [rsp + 0x2c], 0x486c7a2e
movabs rdx, 0x40203060002070b
mov qword [rsp + 0x18], rdx
mov dword [rsp + 0x20], 0x2060905
xor eax, eax
jmp 0x5a8f20
movzx r9d, byte [rsp + rsi + 0x24]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x22]
mov byte [rsp + rdi + 0x24], dl
mov byte [rsp + rsi + 0x24], r8b
add rax, 2
nop
cmp rax, 0xc
jge 0x5a8f52
movzx edx, byte [rsp + rax + 0x18]
movzx esi, byte [rsp + rax + 0x19]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0xc
jae 0x5a8f77
movzx r8d, byte [rsp + rdi + 0x24]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x22]
cmp rsi, 0xc
jb 0x5a8f04
jmp 0x5a8f6b
xor eax, eax
lea rbx, [rsp + 0x24]
mov ecx, 0xc
nop
call fcn.0044bb20
add rsp, 0x30
pop rbp
ret
mov eax, esi
mov ecx, 0xc
call fcn.00461020
mov eax, edi
mov ecx, 0xc
nop
call fcn.00461020
nop
call fcn.0045eda0
jmp fcn.005a8ec0
Function at 0x5ac6c0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x5ac78c
push rbp
mov rbp, rsp
sub rsp, 0x30
movabs rdx, 0xc97869e2c57aba93
mov qword [rsp + 0x18], rdx
mov word [rsp + 0x20], 0xb86f
movabs rdx, 0x903070309030409
mov qword [rsp + 0x22], rdx
movabs rdx, 0x402000604010903
mov qword [rsp + 0x28], rdx
xor eax, eax
jmp 0x5ac724
movzx r9d, byte [rsp + rsi + 0x18]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x35]
mov byte [rsp + rdi + 0x18], dl
mov byte [rsp + rsi + 0x18], r8b
add rax, 2
cmp rax, 0xe
jge 0x5ac75c
movzx edx, byte [rsp + rax + 0x22]
movzx esi, byte [rsp + rax + 0x23]
mov edi, edx
xor edx, esi
add edx, eax
nop word [rax + rax]
cmp rdi, 0xa
jae 0x5ac77f
movzx r8d, byte [rsp + rdi + 0x18]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x35]
cmp rsi, 0xa
jb 0x5ac70a
jmp 0x5ac773
xor eax, eax
lea rbx, [rsp + 0x18]
mov ecx, 0xa
call fcn.0044bb20
add rsp, 0x30
pop rbp
ret
mov eax, esi
mov ecx, 0xa
call fcn.00461020
mov eax, edi
mov ecx, 0xa
call fcn.00461020
nop
call fcn.0045eda0
jmp fcn.005ac6c0
Function at 0x140b0aed0
Capabilities:
Terminate process

Disassembly:
cld
pop r11
jmp 0x140b0aedd
inc rsi
mov byte [rdi], dl
inc rdi
mov dl, byte [rsi]
add ebx, ebx
jne 0x140b0aeed
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jb 0x140b0aed5
lea eax, [rcx + 1]
jmp 0x140b0aefb
dec eax
call r11
adc eax, eax
call r11
adc eax, eax
add ebx, ebx
jne 0x140b0af0e
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jae 0x140b0aef4
sub eax, 3
jb 0x140b0af2e
shl eax, 8
movzx edx, dl
or eax, edx
inc rsi
xor eax, 0xffffffff
je 0x140b0af7d
sar eax, 1
movsxd rbp, eax
jb 0x140b0af64
jmp 0x140b0af3c
add ebx, ebx
jne 0x140b0af3a
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jb 0x140b0af64
inc ecx
add ebx, ebx
jne 0x140b0af4a
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jb 0x140b0af64
call r11
adc ecx, ecx
add ebx, ebx
jne 0x140b0af5d
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jae 0x140b0af4c
add ecx, 2
jmp 0x140b0af69
call r11
adc ecx, ecx
cmp rbp, 0xfffffffffffffb00
adc ecx, 2
call fcn.140b0ae92
jmp 0x140b0aedd
pop rsi
pop rdi
pop rax
mov dword [rdi], eax
sub rsp, 0x28
lea rdi, [rsi + 0xb02000]
mov eax, dword [rdi]
or eax, eax
je 0x140b0afdd
mov ebx, dword [rdi + 4]
lea rcx, [rax + rsi + 0xb10cec]
add rbx, rsi
add rdi, 8
call qword [sym.imp.KERNEL32.DLL_LoadLibraryA]
xchg rbp, rax
mov al, byte [rdi]
inc rdi
or al, al
je 0x140b0af8d
mov rcx, rdi
mov rdx, rdi
dec eax
repne scasb al, byte [rdi]
mov rcx, rbp
call qword [sym.imp.KERNEL32.DLL_GetProcAddress]
or rax, rax
je 0x140b0afd7
mov qword [rbx], rax
add rbx, 8
jmp 0x140b0afad
jmp qword [sym.imp.KERNEL32.DLL_ExitProcess]
add rsp, 0x28
add rdi, 4
lea rbx, [rsi - 4]
xor eax, eax
mov al, byte [rdi]
inc rdi
or eax, eax
je 0x140b0b021
cmp al, 0xef
ja 0x140b0b009
add rbx, rax
mov rax, qword [rbx]
bswap rax
add rax, rsi
mov qword [rbx], rax
jmp 0x140b0afe9
and al, 0xf
shl eax, 0x10
mov ax, word [rdi]
add rdi, 2
or eax, eax
jne 0x140b0aff8
mov eax, dword [rdi]
add rdi, 4
jmp 0x140b0aff8
mov rbp, qword [sym.imp.KERNEL32.DLL_VirtualProtect]
lea rdi, [rsi - 0x1000]
mov ebx, 0x1000
push rax
mov r9, rsp
mov r8d, 4
mov rdx, rbx
mov rcx, rdi
sub rsp, 0x20
call rbp
lea rax, [rdi + 0x1af]
and byte [rax], 0x7f
and byte [rax + 0x28], 0x7f
lea r9, [rsp + 0x20]
mov r8, qword [r9]
mov rdx, rbx
mov rcx, rdi
call rbp
add rsp, 0x28
mov byte [fcn.140b0b0a0], 0xfc
lea rcx, [rsi - 0x1000]
push 1
pop rdx
xor r8, r8
push rax
call fcn.140b0b0a0
pop rax
pop rbp
pop rdi
pop rsi
pop rbx
lea rax, [rsp - 0x80]
push 0
cmp rsp, rax
jne 0x140b0b090
sub rsp, 0xffffffffffffff80
jmp 0x1400014d0