joyce8/EMBER2024-capa huggingface dataset:
Function at 0x536bc0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x536ca6
push rbp
mov rbp, rsp
sub rsp, 0x40
movabs rdx, 0x9d742e69d42fc452
mov qword [rsp + 0x30], rdx
movabs rdx, 0x43b24ee0d8d66c61
mov qword [rsp + 0x38], rdx
movabs rdx, 0xc0102050101020e
mov qword [rsp + 0x1a], rdx
movabs rdx, 0xe030d0b0f0a0c01
mov qword [rsp + 0x20], rdx
movabs rdx, 0x50b020a0b0c070c
mov qword [rsp + 0x28], rdx
xor eax, eax
nop
jmp 0x536c40
movzx r9d, byte [rsp + rsi + 0x30]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x7f]
mov byte [rsp + rdi + 0x30], dl
mov byte [rsp + rsi + 0x30], r8b
add rax, 2
nop dword [rax]
cmp rax, 0x16
jge 0x536c72
movzx edx, byte [rsp + rax + 0x1a]
movzx esi, byte [rsp + rax + 0x1b]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x10
jae 0x536c97
movzx r8d, byte [rsp + rdi + 0x30]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x7f]
cmp rsi, 0x10
jb 0x536c22
jmp 0x536c8b
xor eax, eax
lea rbx, [rsp + 0x30]
mov ecx, 0x10
nop
call fcn.0044d560
add rsp, 0x40
pop rbp
ret
mov eax, esi
mov ecx, 0x10
call fcn.00462f80
mov eax, edi
mov ecx, 0x10
nop
call fcn.00462f80
nop
call fcn.00460ca0
jmp fcn.00536bc0

Function at 0x536f20
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x536fe7
push rbp
mov rbp, rsp
sub rsp, 0x38
movabs rdx, 0x5112610ae734692d
mov qword [rsp + 0x2c], rdx
mov dword [rsp + 0x34], 0xa0c1a0e
movabs rdx, 0x60a080b03020300
mov qword [rsp + 0x1e], rdx
movabs rdx, 0x20209040302060a
mov qword [rsp + 0x24], rdx
xor eax, eax
jmp 0x536f88
movzx r9d, byte [rsp + rsi + 0x2c]
sub r9d, edx
lea edx, [r9 + 0x72]
mov byte [rsp + rdi + 0x2c], dl
lea edx, [r8 + 0x72]
mov byte [rsp + rsi + 0x2c], dl
add rax, 2
cmp rax, 0xe
jge 0x536fb7
movzx edx, byte [rsp + rax + 0x1e]
movzx esi, byte [rsp + rax + 0x1f]
mov edi, edx
xor edx, esi
add edx, eax
nop
cmp rdi, 0xc
jae 0x536fda
movzx r8d, byte [rsp + rdi + 0x2c]
sub r8d, edx
cmp rsi, 0xc
jb 0x536f6b
jmp 0x536fce
xor eax, eax
lea rbx, [rsp + 0x2c]
mov ecx, 0xc
call fcn.0044d560
add rsp, 0x38
pop rbp
ret
mov eax, esi
mov ecx, 0xc
call fcn.00462f80
mov eax, edi
mov ecx, 0xc
call fcn.00462f80
nop
call fcn.00460ca0
jmp fcn.00536f20
Function at 0x53ecc0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
lea r12, [rsp - 0x48]
cmp r12, qword [r14 + 0x10]
jbe 0x53ee3b
push rbp
mov rbp, rsp
sub rsp, 0xc0
movabs rdx, 0x799e25fb204f9e74
mov qword [rsp + 0x79], rdx
movabs rdx, 0xa8d3a36ecf4dd979
mov qword [rsp + 0x80], rdx
movabs rdx, 0x65ef6fe9c2b65ab5
mov qword [rsp + 0x88], rdx
movabs rdx, 0xcf736e35ba0dc3d7
mov qword [rsp + 0x90], rdx
movabs rdx, 0xdec8bf2061201c6f
mov qword [rsp + 0x98], rdx
movabs rdx, 0x8eeb9f660d655d43
mov qword [rsp + 0xa0], rdx
movabs rdx, 0x6ba60047d3723920
mov qword [rsp + 0xa8], rdx
movabs rdx, 0x6661616dfe207165
mov qword [rsp + 0xb0], rdx
movabs rdx, 0x8f354314df340655
mov qword [rsp + 0xb8], rdx
movabs rdx, 0x3f3e083042020c04
mov qword [rsp + 0x1f], rdx
movabs rdx, 0x4625092410052c2c
mov qword [rsp + 0x27], rdx
lea rdi, [rsp + 0x29]
lea rsi, [0x005aab02]
mov qword [rsp - 0x10], rbp
lea rbp, [rsp - 0x10]
call fcn.0046359a
mov rbp, qword [rbp]
xor eax, eax
jmp 0x53edd7
movzx r9d, byte [rsp + rsi + 0x79]
sub r9d, edx
lea edx, [r9 - 0x2e]
mov byte [rsp + rdi + 0x79], dl
lea edx, [r8 - 0x2e]
mov byte [rsp + rsi + 0x79], dl
add rax, 2
cmp rax, 0x5a
jge 0x53ee08
movzx edx, byte [rsp + rax + 0x1f]
movzx esi, byte [rsp + rax + 0x20]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x47
jae 0x53ee2e
movzx r8d, byte [rsp + rdi + 0x79]
sub r8d, edx
nop dword [rax]
cmp rsi, 0x47
jb 0x53edba
jmp 0x53ee22
xor eax, eax
lea rbx, [rsp + 0x79]
mov ecx, 0x47
call fcn.0044d560
add rsp, 0xc0
pop rbp
ret
mov eax, esi
mov ecx, 0x47
call fcn.00462f80
mov eax, edi
mov ecx, 0x47
call fcn.00462f80
nop
nop dword [rax + rax]
call fcn.00460ca0
jmp fcn.0053ecc0
Function at 0x541c80
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x541d4c
push rbp
mov rbp, rsp
sub rsp, 0x38
movabs rdx, 0x4703436c411c1a27
mov qword [rsp + 0x2c], rdx
mov dword [rsp + 0x34], 0x6838390c
movabs rdx, 0x109070600020009
mov qword [rsp + 0x1c], rdx
movabs rdx, 0x30308030a050900
mov qword [rsp + 0x24], rdx
xor eax, eax
jmp 0x541ce5
movzx r9d, byte [rsp + rsi + 0x2c]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x18]
mov byte [rsp + rdi + 0x2c], dl
mov byte [rsp + rsi + 0x2c], r8b
add rax, 2
cmp rax, 0x10
jge 0x541d1c
movzx edx, byte [rsp + rax + 0x1c]
movzx esi, byte [rsp + rax + 0x1d]
mov edi, edx
xor edx, esi
add edx, eax
nop dword [rax + rax]
cmp rdi, 0xc
jae 0x541d3f
movzx r8d, byte [rsp + rdi + 0x2c]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x18]
cmp rsi, 0xc
jb 0x541ccb
jmp 0x541d33
xor eax, eax
lea rbx, [rsp + 0x2c]
mov ecx, 0xc
call fcn.0044d560
add rsp, 0x38
pop rbp
ret
mov eax, esi
mov ecx, 0xc
call fcn.00462f80
mov eax, edi
mov ecx, 0xc
call fcn.00462f80
nop
call fcn.00460ca0
jmp fcn.00541c80

Function at 0x542560
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x54262c
push rbp
mov rbp, rsp
sub rsp, 0x30
movabs rdx, 0x64b573ba2fac232f
mov qword [rsp + 0x26], rdx
mov word [rsp + 0x2e], 0xa8e1
movabs rdx, 0x202080403040601
mov qword [rsp + 0x18], rdx
movabs rdx, 0x908090601040202
mov qword [rsp + 0x1e], rdx
xor eax, eax
jmp 0x5425c4
movzx r9d, byte [rsp + rsi + 0x26]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x4d]
mov byte [rsp + rdi + 0x26], dl
mov byte [rsp + rsi + 0x26], r8b
add rax, 2
cmp rax, 0xe
jge 0x5425fc
movzx edx, byte [rsp + rax + 0x18]
movzx esi, byte [rsp + rax + 0x19]
mov edi, edx
xor edx, esi
add edx, eax
nop word [rax + rax]
cmp rdi, 0xa
jae 0x54261f
movzx r8d, byte [rsp + rdi + 0x26]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x4d]
cmp rsi, 0xa
jb 0x5425aa
jmp 0x542613
xor eax, eax
lea rbx, [rsp + 0x26]
mov ecx, 0xa
call fcn.0044d560
add rsp, 0x30
pop rbp
ret
mov eax, esi
mov ecx, 0xa
call fcn.00462f80
mov eax, edi
mov ecx, 0xa
call fcn.00462f80
nop
call fcn.00460ca0
jmp fcn.00542560

Function at 0x54fb40
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x54fbf8
push rbp
mov rbp, rsp
sub rsp, 0x30
movabs rdx, 0x6760d4e474ea6f47
mov qword [rsp + 0x28], rdx
movabs rdx, 0x502040407000604
mov qword [rsp + 0x1e], rdx
mov word [rsp + 0x26], 7
xor eax, eax
jmp 0x54fb98
movzx r9d, byte [rsp + rsi + 0x28]
sub r9d, edx
lea edx, [r9 - 0x74]
mov byte [rsp + rdi + 0x28], dl
lea edx, [r8 - 0x74]
mov byte [rsp + rsi + 0x28], dl
add rax, 2
cmp rax, 0xa
jge 0x54fbc8
movzx edx, byte [rsp + rax + 0x1e]
movzx esi, byte [rsp + rax + 0x1f]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 8
jae 0x54fbeb
movzx r8d, byte [rsp + rdi + 0x28]
sub r8d, edx
nop dword [rax]
cmp rsi, 8
jb 0x54fb7b
jmp 0x54fbdf
xor eax, eax
lea rbx, [rsp + 0x28]
mov ecx, 8
call fcn.0044d560
add rsp, 0x30
pop rbp
ret
mov eax, esi
mov ecx, 8
call fcn.00462f80
mov eax, edi
mov ecx, 8
call fcn.00462f80
nop
call fcn.00460ca0
nop dword [rax]
jmp fcn.0054fb40
Function at 0x555a20
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x555b2c
push rbp
mov rbp, rsp
sub rsp, 0x50
movabs rdx, 0x214374742a4d0b57
mov qword [rsp + 0x37], rdx
movabs rdx, 0x612d13b179721975
mov qword [rsp + 0x3f], rdx
movabs rdx, 0x41612d13b1797219
mov qword [rsp + 0x40], rdx
movabs rdx, 0x656ce52e02cb6176
mov qword [rsp + 0x48], rdx
movabs rdx, 0x60d090c14090d13
mov qword [rsp + 0x1d], rdx
movabs rdx, 0x1509130101091606
mov qword [rsp + 0x25], rdx
movabs rdx, 0x1413150913010109
mov qword [rsp + 0x27], rdx
movabs rdx, 0x140e030716020602
mov qword [rsp + 0x2f], rdx
xor eax, eax
jmp 0x555ac8
movzx r9d, byte [rsp + rsi + 0x37]
lea edx, [r9 + rdx]
lea edx, [rdx + 0xd]
mov byte [rsp + rdi + 0x37], dl
mov byte [rsp + rsi + 0x37], r8b
add rax, 2
cmp rax, 0x1a
jge 0x555afc
movzx edx, byte [rsp + rax + 0x1d]
movzx esi, byte [rsp + rax + 0x1e]
mov edi, edx
xor edx, esi
add edx, eax
nop
cmp rdi, 0x19
jae 0x555b1f
movzx r8d, byte [rsp + rdi + 0x37]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0xd]
cmp rsi, 0x19
jb 0x555aae
jmp 0x555b13
xor eax, eax
lea rbx, [rsp + 0x37]
mov ecx, 0x19
call fcn.0044d560
add rsp, 0x50
pop rbp
ret
mov eax, esi
mov ecx, 0x19
call fcn.00462f80
mov eax, edi
mov ecx, 0x19
call fcn.00462f80
nop
call fcn.00460ca0
jmp fcn.00555a20

Function at 0x555dc0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x555eac
push rbp
mov rbp, rsp
sub rsp, 0x48
movabs rdx, 0x1d61abd6b30c6992
mov qword [rsp + 0x36], rdx
movabs rdx, 0x6fbe1d61abd6b30c
mov qword [rsp + 0x38], rdx
movabs rdx, 0x89a3ab8d082cd616
mov qword [rsp + 0x40], rdx
movabs rdx, 0x4040b0a07020d0c
mov qword [rsp + 0x1e], rdx
movabs rdx, 0x80211070f100d06
mov qword [rsp + 0x26], rdx
movabs rdx, 0xe03050b0c000b0d
mov qword [rsp + 0x2e], rdx
xor eax, eax
jmp 0x555e4a
movzx r9d, byte [rsp + rsi + 0x36]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x68]
mov byte [rsp + rdi + 0x36], dl
mov byte [rsp + rsi + 0x36], r8b
add rax, 2
cmp rax, 0x18
jge 0x555e7c
movzx edx, byte [rsp + rax + 0x1e]
movzx esi, byte [rsp + rax + 0x1f]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x12
jae 0x555e9f
movzx r8d, byte [rsp + rdi + 0x36]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x68]
cmp rsi, 0x12
jb 0x555e30
jmp 0x555e93
xor eax, eax
lea rbx, [rsp + 0x36]
mov ecx, 0x12
call fcn.0044d560
add rsp, 0x48
pop rbp
ret
mov eax, esi
mov ecx, 0x12
call fcn.00462f80
mov eax, edi
mov ecx, 0x12
call fcn.00462f80
nop
call fcn.00460ca0
jmp fcn.00555dc0
Function at 0x140044bb0
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
push rbx
mov rax, rcx
add qword [rcx + 0x30], r8
mov r11, qword [rcx + 0x40]
test r11, r11
je 0x140044bf2
mov r10d, 8
sub r10, r11
cmp r10, r8
mov rdi, r8
cmovb rdi, r10
cmp rdi, 4
jb 0x140044bfa
mov esi, dword [rdx]
mov r9d, 4
mov rcx, r9
or rcx, 1
cmp rcx, rdi
jb 0x140044c0b
jmp 0x140044c22
xor r10d, r10d
jmp 0x140044cad
xor esi, esi
xor r9d, r9d
mov rcx, r9
or rcx, 1
cmp rcx, rdi
jae 0x140044c22
movzx ebx, word [rdx + r9]
lea ecx, [r9*8]
shl rbx, cl
or rsi, rbx
or r9, 2
cmp r9, rdi
jae 0x140044c39
movzx edi, byte [rdx + r9]
shl r9d, 3
mov ecx, r9d
shl rdi, cl
or rsi, rdi
lea ecx, [r11*8]
shl rsi, cl
or rsi, qword [rax + 0x38]
mov qword [rax + 0x38], rsi
cmp r10, r8
jbe 0x140044c59
add r11, r8
jmp 0x140044d8a
mov rcx, qword [rax + 0x18]
xor rcx, rsi
mov r11, qword [rax + 0x10]
mov r9, qword [rax]
add r9, r11
mov rdi, qword [rax + 8]
add rdi, rcx
rol r11, 0xd
xor r11, r9
rol rcx, 0x10
rol r9, 0x20
xor rcx, rdi
add rdi, r11
rol r11, 0x11
add r9, rcx
xor r11, rdi
rol rcx, 0x15
mov qword [rax + 0x10], r11
xor rcx, r9
rol rdi, 0x20
mov qword [rax + 0x18], rcx
mov qword [rax + 8], rdi
xor r9, rsi
mov qword [rax], r9
sub r8, r10
mov r11d, r8d
and r11d, 7
and r8, 0xfffffffffffffff8
cmp r10, r8
jae 0x140044d22
mov rcx, qword [rax]
mov r9, qword [rax + 8]
mov rdi, qword [rax + 0x18]
mov rsi, qword [rax + 0x10]
nop
mov rbx, qword [rdx + r10]
xor rdi, rbx
add rcx, rsi
rol rsi, 0xd
add r9, rdi
xor rsi, rcx
rol rdi, 0x10
xor rdi, r9
rol rcx, 0x20
add r9, rsi
add rcx, rdi
rol rsi, 0x11
xor rsi, r9
rol rdi, 0x15
rol r9, 0x20
xor rdi, rcx
xor rcx, rbx
add r10, 8
cmp r10, r8
jb 0x140044cd0
mov qword [rax + 0x18], rdi
mov qword [rax + 0x10], rsi
mov qword [rax + 8], r9
mov qword [rax], rcx
cmp r11d, 4
jb 0x140044d40
mov r9d, dword [rdx + r10]
mov r8d, 4
mov rcx, r8
or rcx, 1
cmp rcx, r11
jb 0x140044d52
jmp 0x140044d6c
xor r9d, r9d
xor r8d, r8d
mov rcx, r8
or rcx, 1
cmp rcx, r11
jae 0x140044d6c
lea rcx, [r8 + r10]
movzx esi, word [rdx + rcx]
lea ecx, [r8*8]
shl rsi, cl
or r9, rsi
or r8, 2
cmp r8, r11
jae 0x140044d86
add r10, r8
movzx edx, byte [rdx + r10]
shl r8d, 3
mov ecx, r8d
shl rdx, cl
or r9, rdx
mov qword [rax + 0x38], r9
mov qword [rax + 0x40], r11
pop rbx
pop rdi
pop rsi
ret
Function at 0x14004e220
Capabilities:
Parse pe header

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbp
push rbx
movzx eax, word [rdx]
cmp eax, 0x5a4d
jne 0x14004e2ac
movsxd rax, dword [rdx + 0x3c]
test rax, rax
je 0x14004e2b1
cmp eax, 0x40
jb 0x14004e3a1
cmp rax, r8
ja 0x14004e3a1
movzx r9d, word [rax + rdx + 0x18]
cmp r9d, 0x10b
je 0x14004e2b6
mov r10b, 5
cmp r9d, 0x20b
jne 0x14004e2e1
mov r10b, 2
cmp dword [rdx + rax], 0x4550
jne 0x14004e2e1
lea r9, [rdx + rax]
movzx r11d, word [r9 + 4]
mov r10b, 3
cmp r11d, 0x8664
jne 0x14004e2e1
mov r10b, 4
test byte [r9 + 0x16], 2
je 0x14004e2e1
lea r10, [rax + 0x108]
mov r11d, 1
cmp r10, r8
jbe 0x14004e314
jmp 0x14004e3a1
xor r10d, r10d
jmp 0x14004e2e1
mov r10b, 1
jmp 0x14004e2e1
mov r10b, 2
cmp dword [rdx + rax], 0x4550
jne 0x14004e2e1
lea r9, [rdx + rax]
movzx r11d, word [r9 + 4]
mov r10b, 3
cmp r11d, 0x14c
jne 0x14004e2e1
mov r10b, 4
test byte [r9 + 0x16], 2
jne 0x14004e301
mov byte [rcx], r10b
mov r8d, 2
mov eax, 0x18
mov qword [rcx + rax], r8
mov rax, rcx
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
lea r10, [rax + 0xf8]
cmp r10, r8
ja 0x14004e3a1
xor r11d, r11d
mov rsi, r8
sub rsi, r10
movzx ebx, word [rdx + rax + 6]
lea rdi, [rbx*8]
lea rdi, [rdi + rdi*4]
sub rsi, rdi
jb 0x14004e3a1
add rax, 0xffffffffffffffc0
lea r14, [rdx + 0x40]
add r10, rdx
mov r15, rdx
shr r15, 8
add rdi, r10
mov ebp, ebx
shr ebp, 8
mov byte [rcx], dl
mov r12, rdx
shr r12, 0x38
mov byte [rcx + 7], r12b
mov r12, rdx
shr r12, 0x28
mov word [rcx + 5], r12w
mov dword [rcx + 1], r15d
mov qword [rcx + 8], r14
mov qword [rcx + 0x10], rax
mov qword [rcx + 0x18], r11
mov qword [rcx + 0x20], r9
mov qword [rcx + 0x28], r10
mov byte [rcx + 0x30], bl
mov dword [rcx + 0x31], ebp
mov byte [rcx + 0x37], 0
mov word [rcx + 0x35], 0
mov qword [rcx + 0x38], rdi
mov qword [rcx + 0x40], rsi
mov qword [rcx + 0x48], rdx
mov eax, 0x50
jmp 0x14004e2ef
ud2
Function at 0x140057a00
Capabilities:
Encode data using xor

Disassembly:
mov rax, qword [rcx]
nop word cs:[rax + rax]
mov rdx, rax
xor rdx, 3
lock cmpxchg qword [rcx], rdx
jne 0x140057a10
test al, 1
je 0x140057a2b
test al, 2
jne 0x140057a2b
xor rax, 3
ret
ud2

Function at 0x14005a030
Capabilities:
Encrypt data using rc4 prga

Disassembly:
jmp 0x140062130
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x38
mov rsi, r8
mov rdi, rdx
mov rbx, rcx
cmp qword [rcx + 0x18], 0xffffffffffffffff
je 0x14006217a
mov r15, qword [rbx + 0x10]
lea rcx, [rsp + 0x20]
mov rdx, r15
mov r8, rdi
xor r9d, r9d
call fcn.140057620
movzx eax, byte [rsp + 0x29]
cmp al, 3
jne 0x1400621a5
mov eax, 1
jmp 0x140062313
mov rdx, qword [rbx + 0x10]
lea rcx, [rsp + 0x20]
mov r8, rdi
xor r9d, r9d
call fcn.140057620
movzx eax, byte [rsp + 0x29]
cmp al, 3
jne 0x1400622dc
mov eax, 1
jmp 0x140062313
add rbx, 0x18
lea r13, [rsp + 0x20]
mov qword [rsp + 0x30], rdi
jmp 0x1400621ff
dec r13
mov edx, 0x18
mov r8d, 8
mov rcx, r13
call fcn.14004d6b0
mov r13, rbx
mov rcx, rbx
mov rdx, r15
mov r8, qword [rsp + 0x30]
xor r9d, r9d
call fcn.140057620
movzx eax, byte [rsp + 0x29]
cmp al, 3
mov rbx, rsi
mov rsi, r14
je 0x140062170
mov rbp, qword [rsp + 0x20]
cmp al, 2
je 0x1400622e5
mov r8, qword [rsi + 8]
mov r12, qword [rsi + 0x10]
sub r8, r12
jb 0x14006232f
movzx edi, byte [rsp + 0x28]
mov r14, rsi
mov rdx, qword [rsi]
add rdx, r12
mov rsi, rbx
mov qword [rsp + 0x20], rbx
mov rbx, r13
mov rcx, r13
call fcn.14006bb80
mov r13, rdx
test rax, rax
je 0x1400622e9
mov rcx, r13
call fcn.140061dd0
cmp al, 0xd
jne 0x14006230e
and ebp, 0x23
mov rax, qword [r15 + 0x90]
xor rbp, 0x2f
mov rcx, rdi
shl rcx, 0x10
nop
mov edx, eax
shr edx, 0x10
cmp dil, dl
jne 0x14006228c
mov edx, eax
and edx, ebp
or rdx, rcx
lock cmpxchg qword [r15 + 0x90], rdx
jne 0x140062270
mov eax, r13d
and eax, 3
lea rcx, [rax - 2]
cmp rcx, 2
jb 0x1400621d6
test rax, rax
je 0x1400621d6
mov rbp, qword [r13 - 1]
mov rdi, qword [r13 + 7]
mov rax, qword [rdi]
test rax, rax
je 0x1400622be
mov rcx, rbp
call rax
mov rdx, qword [rdi + 8]
test rdx, rdx
je 0x1400621c0
mov r8, qword [rdi + 0x10]
mov rcx, rbp
call fcn.14004d6b0
jmp 0x1400621c0
cmp al, 2
jne 0x140062327
mov rbp, qword [rsp + 0x20]
xor eax, eax
jmp 0x140062313
lea rax, [r12 + r13]
mov rcx, qword [r14 + 0x18]
cmp rax, rcx
jbe 0x1400622fd
mov qword [r14 + 0x18], rax
mov rcx, rax
add r12, r13
jb 0x14006232f
cmp rax, rcx
ja 0x14006232f
mov qword [r14 + 0x10], rax
xor r13d, r13d
xor eax, eax
mov rbp, r13
mov rdx, rbp
add rsp, 0x38
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov rax, qword [rsi + 0x10]
cmp rax, qword [rsi + 8]
ud2

Function at 0x14005b160
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov rcx, qword [rcx]
add rcx, 0x10
jmp 0x140062130
Function at 0x14005b200
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov rcx, qword [rcx]
add rcx, 0x10
jmp 0x140062340
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x48
mov qword [rsp + 0x40], r9
mov qword [rsp + 0x38], r8
mov rdi, rdx
mov r15, rcx
cmp qword [rcx + 0x18], 0xffffffffffffffff
je 0x140062391
mov r12, qword [r15 + 0x10]
lea rcx, [rsp + 0x28]
mov rdx, r12
mov r8, rdi
mov r9b, 1
call fcn.140057620
movzx eax, byte [rsp + 0x31]
cmp al, 3
jne 0x1400623bc
mov eax, 2
jmp 0x1400624f6
mov rdx, qword [r15 + 0x10]
lea rcx, [rsp + 0x28]
mov r8, rdi
mov r9b, 1
call fcn.140057620
movzx eax, byte [rsp + 0x31]
cmp al, 3
jne 0x1400624dc
mov eax, 2
jmp 0x1400624f6
add r15, 0x18
lea rsi, [rsp + 0x28]
jmp 0x140062403
dec r13
mov edx, 0x18
mov r8d, 8
mov rcx, r13
call fcn.14004d6b0
mov rsi, r14
mov rcx, r14
mov rdx, r12
mov r8, rdi
mov r9b, 1
call fcn.140057620
movzx eax, byte [rsp + 0x31]
cmp al, 3
je 0x140062387
mov rbp, qword [rsp + 0x28]
cmp al, 2
je 0x1400624f1
movzx ebx, byte [rsp + 0x30]
mov qword [rsp + 0x28], r15
mov r14, rsi
mov rcx, rsi
mov rdx, qword [rsp + 0x38]
mov r8, qword [rsp + 0x40]
call fcn.14006bb90
mov rsi, rax
mov r13, rdx
test rax, rax
je 0x1400624ec
mov rcx, r13
call fcn.140061dd0
cmp al, 0xd
jne 0x1400624ec
and ebp, 0x23
mov rax, qword [r12 + 0x90]
xor rbp, 0x2f
mov rcx, rbx
shl rcx, 0x10
nop word cs:[rax + rax]
mov edx, eax
shr edx, 0x10
cmp bl, dl
jne 0x14006248c
mov edx, eax
and edx, ebp
or rdx, rcx
lock cmpxchg qword [r12 + 0x90], rdx
jne 0x140062470
mov eax, r13d
and eax, 3
lea rcx, [rax - 2]
cmp rcx, 2
jb 0x1400623e6
test rax, rax
je 0x1400623e6
mov rsi, qword [r13 - 1]
mov rbx, qword [r13 + 7]
mov rax, qword [rbx]
test rax, rax
je 0x1400624be
mov rcx, rsi
call rax
mov rdx, qword [rbx + 8]
test rdx, rdx
je 0x1400623d0
mov r8, qword [rbx + 0x10]
mov rcx, rsi
call fcn.14004d6b0
jmp 0x1400623d0
cmp al, 2
jne 0x14006250d
mov r13, qword [rsp + 0x28]
mov eax, 1
jmp 0x1400624f9
mov rax, rsi
jmp 0x1400624f9
mov eax, 1
mov r13, rbp
mov rdx, r13
add rsp, 0x48
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
ud2
Function at 0x140062130
Capabilities:
Encrypt data using rc4 prga

Disassembly:
jmp 0x140062130
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x38
mov rsi, r8
mov rdi, rdx
mov rbx, rcx
cmp qword [rcx + 0x18], 0xffffffffffffffff
je 0x14006217a
mov r15, qword [rbx + 0x10]
lea rcx, [rsp + 0x20]
mov rdx, r15
mov r8, rdi
xor r9d, r9d
call fcn.140057620
movzx eax, byte [rsp + 0x29]
cmp al, 3
jne 0x1400621a5
mov eax, 1
jmp 0x140062313
mov rdx, qword [rbx + 0x10]
lea rcx, [rsp + 0x20]
mov r8, rdi
xor r9d, r9d
call fcn.140057620
movzx eax, byte [rsp + 0x29]
cmp al, 3
jne 0x1400622dc
mov eax, 1
jmp 0x140062313
add rbx, 0x18
lea r13, [rsp + 0x20]
mov qword [rsp + 0x30], rdi
jmp 0x1400621ff
dec r13
mov edx, 0x18
mov r8d, 8
mov rcx, r13
call fcn.14004d6b0
mov r13, rbx
mov rcx, rbx
mov rdx, r15
mov r8, qword [rsp + 0x30]
xor r9d, r9d
call fcn.140057620
movzx eax, byte [rsp + 0x29]
cmp al, 3
mov rbx, rsi
mov rsi, r14
je 0x140062170
mov rbp, qword [rsp + 0x20]
cmp al, 2
je 0x1400622e5
mov r8, qword [rsi + 8]
mov r12, qword [rsi + 0x10]
sub r8, r12
jb 0x14006232f
movzx edi, byte [rsp + 0x28]
mov r14, rsi
mov rdx, qword [rsi]
add rdx, r12
mov rsi, rbx
mov qword [rsp + 0x20], rbx
mov rbx, r13
mov rcx, r13
call fcn.14006bb80
mov r13, rdx
test rax, rax
je 0x1400622e9
mov rcx, r13
call fcn.140061dd0
cmp al, 0xd
jne 0x14006230e
and ebp, 0x23
mov rax, qword [r15 + 0x90]
xor rbp, 0x2f
mov rcx, rdi
shl rcx, 0x10
nop
mov edx, eax
shr edx, 0x10
cmp dil, dl
jne 0x14006228c
mov edx, eax
and edx, ebp
or rdx, rcx
lock cmpxchg qword [r15 + 0x90], rdx
jne 0x140062270
mov eax, r13d
and eax, 3
lea rcx, [rax - 2]
cmp rcx, 2
jb 0x1400621d6
test rax, rax
je 0x1400621d6
mov rbp, qword [r13 - 1]
mov rdi, qword [r13 + 7]
mov rax, qword [rdi]
test rax, rax
je 0x1400622be
mov rcx, rbp
call rax
mov rdx, qword [rdi + 8]
test rdx, rdx
je 0x1400621c0
mov r8, qword [rdi + 0x10]
mov rcx, rbp
call fcn.14004d6b0
jmp 0x1400621c0
cmp al, 2
jne 0x140062327
mov rbp, qword [rsp + 0x20]
xor eax, eax
jmp 0x140062313
lea rax, [r12 + r13]
mov rcx, qword [r14 + 0x18]
cmp rax, rcx
jbe 0x1400622fd
mov qword [r14 + 0x18], rax
mov rcx, rax
add r12, r13
jb 0x14006232f
cmp rax, rcx
ja 0x14006232f
mov qword [r14 + 0x10], rax
xor r13d, r13d
xor eax, eax
mov rbp, r13
mov rdx, rbp
add rsp, 0x38
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov rax, qword [rsi + 0x10]
cmp rax, qword [rsi + 8]
ud2
Function at 0x140062340
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov rcx, qword [rcx]
add rcx, 0x10
jmp 0x140062340
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x48
mov qword [rsp + 0x40], r9
mov qword [rsp + 0x38], r8
mov rdi, rdx
mov r15, rcx
cmp qword [rcx + 0x18], 0xffffffffffffffff
je 0x140062391
mov r12, qword [r15 + 0x10]
lea rcx, [rsp + 0x28]
mov rdx, r12
mov r8, rdi
mov r9b, 1
call fcn.140057620
movzx eax, byte [rsp + 0x31]
cmp al, 3
jne 0x1400623bc
mov eax, 2
jmp 0x1400624f6
mov rdx, qword [r15 + 0x10]
lea rcx, [rsp + 0x28]
mov r8, rdi
mov r9b, 1
call fcn.140057620
movzx eax, byte [rsp + 0x31]
cmp al, 3
jne 0x1400624dc
mov eax, 2
jmp 0x1400624f6
add r15, 0x18
lea rsi, [rsp + 0x28]
jmp 0x140062403
dec r13
mov edx, 0x18
mov r8d, 8
mov rcx, r13
call fcn.14004d6b0
mov rsi, r14
mov rcx, r14
mov rdx, r12
mov r8, rdi
mov r9b, 1
call fcn.140057620
movzx eax, byte [rsp + 0x31]
cmp al, 3
je 0x140062387
mov rbp, qword [rsp + 0x28]
cmp al, 2
je 0x1400624f1
movzx ebx, byte [rsp + 0x30]
mov qword [rsp + 0x28], r15
mov r14, rsi
mov rcx, rsi
mov rdx, qword [rsp + 0x38]
mov r8, qword [rsp + 0x40]
call fcn.14006bb90
mov rsi, rax
mov r13, rdx
test rax, rax
je 0x1400624ec
mov rcx, r13
call fcn.140061dd0
cmp al, 0xd
jne 0x1400624ec
and ebp, 0x23
mov rax, qword [r12 + 0x90]
xor rbp, 0x2f
mov rcx, rbx
shl rcx, 0x10
nop word cs:[rax + rax]
mov edx, eax
shr edx, 0x10
cmp bl, dl
jne 0x14006248c
mov edx, eax
and edx, ebp
or rdx, rcx
lock cmpxchg qword [r12 + 0x90], rdx
jne 0x140062470
mov eax, r13d
and eax, 3
lea rcx, [rax - 2]
cmp rcx, 2
jb 0x1400623e6
test rax, rax
je 0x1400623e6
mov rsi, qword [r13 - 1]
mov rbx, qword [r13 + 7]
mov rax, qword [rbx]
test rax, rax
je 0x1400624be
mov rcx, rsi
call rax
mov rdx, qword [rbx + 8]
test rdx, rdx
je 0x1400623d0
mov r8, qword [rbx + 0x10]
mov rcx, rsi
call fcn.14004d6b0
jmp 0x1400623d0
cmp al, 2
jne 0x14006250d
mov r13, qword [rsp + 0x28]
mov eax, 1
jmp 0x1400624f9
mov rax, rsi
jmp 0x1400624f9
mov eax, 1
mov r13, rbp
mov rdx, r13
add rsp, 0x48
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
ud2