joyce8/EMBER2024-capa huggingface dataset:
Function at 0x51f520
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x51f5f2
push rbp
mov rbp, rsp
sub rsp, 0x38
movabs rdx, 0x6474e830f271c0a7
mov qword [rsp + 0x1f], rdx
movabs rdx, 0x72e8a56474e830f2
mov qword [rsp + 0x22], rdx
movabs rdx, 0x309010803040301
mov qword [rsp + 0x2a], rdx
movabs rdx, 0x903000205090309
mov qword [rsp + 0x30], rdx
xor eax, eax
jmp 0x51f58c
movzx r9d, byte [rsp + rsi + 0x1f]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x4e]
mov byte [rsp + rdi + 0x1f], dl
mov byte [rsp + rsi + 0x1f], r8b
add rax, 2
cmp rax, 0xe
jge 0x51f5be
movzx edx, byte [rsp + rax + 0x2a]
movzx esi, byte [rsp + rax + 0x2b]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0xb
jae 0x51f5e5
movzx r8d, byte [rsp + rdi + 0x1f]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x4e]
cmp rsi, 0xb
jb 0x51f572
jmp 0x51f5d5
xor eax, eax
lea rbx, [rsp + 0x1f]
mov ecx, 0xb
call fcn.0044c4e0
add rsp, 0x38
pop rbp
ret
mov eax, esi
mov ecx, 0xb
nop dword [rax]
call fcn.004617c0
mov eax, edi
mov ecx, 0xb
call fcn.004617c0
nop
call fcn.0045f540
jmp fcn.0051f520

Function at 0x527da0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
lea r12, [rsp - 0x18]
cmp r12, qword [r14 + 0x10]
jbe 0x527eaa
push rbp
mov rbp, rsp
sub rsp, 0x90
movzx edx, byte [rax + 0x4c]
mov byte [rax + 0x4c], cl
nop
movabs rsi, 0x84dc1402708983ed
mov qword [rsp + 0x57], rsi
movabs rsi, 0x884dc1402708983
mov qword [rsp + 0x58], rsi
movabs rsi, 0xe10f42700a4438ef
mov qword [rsp + 0x60], rsi
movabs rsi, 0xb3ea213643bbb2dd
mov qword [rsp + 0x46], rsi
movabs rsi, 0x30b3ea213643bbb2
mov qword [rsp + 0x47], rsi
movabs rsi, 0x99692714692659d6
mov qword [rsp + 0x4f], rsi
xor ecx, ecx
nop
jmp 0x527e36
movzx esi, byte [rsp + rcx + 0x57]
movzx edi, byte [rsp + rcx + 0x46]
xor edi, esi
mov byte [rsp + rcx + 0x46], dil
inc rcx
cmp rcx, 0x11
jl 0x527e22
mov qword [rsp + 0xa0], rax
mov byte [rsp + 0x37], dl
mov qword [rsp + 0x38], rbx
lea rdx, [rax + 0x40]
mov qword [rsp + 0x88], rdx
lea rbx, [rsp + 0x46]
mov ecx, 0x11
lea rax, [rsp + 0x68]
call fcn.0044c4e0
mov ecx, 0x10
xor edi, edi
mov esi, 0x76
mov r8, rax
mov r9, rbx
mov rax, qword [rsp + 0x88]
mov rbx, qword [rsp + 0x38]
call fcn.00525540
movzx edx, byte [rsp + 0x37]
mov rsi, qword [rsp + 0xa0]
mov byte [rsi + 0x4c], dl
add rsp, 0x90
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov byte [rsp + 0x18], cl
call fcn.0045f540
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
movzx ecx, byte [rsp + 0x18]
jmp fcn.00527da0
Function at 0x52e5a0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x52e6d8
push rbp
mov rbp, rsp
sub rsp, 0x68
movabs rdx, 0x652078231316001f
mov qword [rsp + 0x1a], rdx
movabs rdx, 0x72d41dab65207823
mov qword [rsp + 0x1e], rdx
movabs rdx, 0x16fb16262370fd20
mov qword [rsp + 0x26], rdx
movabs rdx, 0xa8c0fb6d9c09f809
mov qword [rsp + 0x2e], rdx
movabs rdx, 0x3432cce975d2ea38
mov qword [rsp + 0x36], rdx
movabs rdx, 0xd1417010816151c
mov qword [rsp + 0x3e], rdx
movabs rdx, 0xf231e230e191b1d
mov qword [rsp + 0x46], rdx
movabs rdx, 0x1e200f231e230e19
mov qword [rsp + 0x48], rdx
movabs rdx, 0x321110112102010
mov qword [rsp + 0x50], rdx
movabs rdx, 0x21316191e001a15
mov qword [rsp + 0x58], rdx
movabs rdx, 0x9030a1d2216041a
mov qword [rsp + 0x60], rdx
xor eax, eax
jmp 0x52e678
movzx r9d, byte [rsp + rsi + 0x1a]
sub r9d, edx
lea edx, [r9 - 0x77]
mov byte [rsp + rdi + 0x1a], dl
lea edx, [r8 - 0x77]
mov byte [rsp + rsi + 0x1a], dl
add rax, 2
cmp rax, 0x2a
jge 0x52e6a8
movzx edx, byte [rsp + rax + 0x3e]
movzx esi, byte [rsp + rax + 0x3f]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x24
jae 0x52e6cb
movzx r8d, byte [rsp + rdi + 0x1a]
sub r8d, edx
nop dword [rax]
cmp rsi, 0x24
jb 0x52e65b
jmp 0x52e6bf
xor eax, eax
lea rbx, [rsp + 0x1a]
mov ecx, 0x24
call fcn.0044c4e0
add rsp, 0x68
pop rbp
ret
mov eax, esi
mov ecx, 0x24
call fcn.004617c0
mov eax, edi
mov ecx, 0x24
call fcn.004617c0
nop
call fcn.0045f540
nop dword [rax]
jmp fcn.0052e5a0

Function at 0x52e700
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x52e81d
push rbp
mov rbp, rsp
sub rsp, 0x60
movabs rdx, 0xfa20781946d654d6
mov qword [rsp + 0x1d], rdx
movabs rdx, 0x5a0f2c2072172d47
mov qword [rsp + 0x25], rdx
movabs rdx, 0x2d4d6413de5a0f2c
mov qword [rsp + 0x2a], rdx
movabs rdx, 0x6e3a65f76fec1e3f
mov qword [rsp + 0x32], rdx
movabs rdx, 0x702110016040d09
mov qword [rsp + 0x3a], rdx
movabs rdx, 0x11100e0a11190702
mov qword [rsp + 0x40], rdx
movabs rdx, 0x20e0e07110e1b14
mov qword [rsp + 0x48], rdx
movabs rdx, 0x417130f0a03001b
mov qword [rsp + 0x50], rdx
movabs rdx, 0x804120115041916
mov qword [rsp + 0x58], rdx
xor eax, eax
jmp 0x52e7c0
movzx r9d, byte [rsp + rsi + 0x1d]
sub r9d, edx
lea edx, [r9 + 0x4a]
mov byte [rsp + rdi + 0x1d], dl
lea edx, [r8 + 0x4a]
mov byte [rsp + rsi + 0x1d], dl
add rax, 2
nop word [rax + rax]
cmp rax, 0x26
jge 0x52e7ed
movzx edx, byte [rsp + rax + 0x3a]
movzx esi, byte [rsp + rax + 0x3b]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x1d
jae 0x52e810
movzx r8d, byte [rsp + rdi + 0x1d]
sub r8d, edx
cmp rsi, 0x1d
jb 0x52e79d
jmp 0x52e804
xor eax, eax
lea rbx, [rsp + 0x1d]
mov ecx, 0x1d
call fcn.0044c4e0
add rsp, 0x60
pop rbp
ret
mov eax, esi
mov ecx, 0x1d
call fcn.004617c0
mov eax, edi
mov ecx, 0x1d
call fcn.004617c0
nop
nop dword [rax]
call fcn.0045f540
jmp fcn.0052e700
Function at 0x52ed40
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x52ee06
push rbp
mov rbp, rsp
sub rsp, 0x30
movabs rdx, 0xf52542045282054
mov qword [rsp + 0x1d], rdx
mov byte [rsp + 0x25], 0x12
movabs rdx, 0x708000408020401
mov qword [rsp + 0x26], rdx
mov word [rsp + 0x2e], 0x102
xor eax, eax
nop
jmp 0x52eda0
movzx r9d, byte [rsp + rsi + 0x1d]
lea edx, [r9 + rdx]
lea edx, [rdx - 4]
mov byte [rsp + rdi + 0x1d], dl
mov byte [rsp + rsi + 0x1d], r8b
add rax, 2
nop dword [rax]
cmp rax, 0xa
jge 0x52edd2
movzx edx, byte [rsp + rax + 0x26]
movzx esi, byte [rsp + rax + 0x27]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 9
jae 0x52edf7
movzx r8d, byte [rsp + rdi + 0x1d]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 4]
cmp rsi, 9
jb 0x52ed82
jmp 0x52edeb
xor eax, eax
lea rbx, [rsp + 0x1d]
mov ecx, 9
nop
call fcn.0044c4e0
add rsp, 0x30
pop rbp
ret
mov eax, esi
mov ecx, 9
call fcn.004617c0
mov eax, edi
mov ecx, 9
nop
call fcn.004617c0
nop
call fcn.0045f540
jmp fcn.0052ed40

Function at 0x52f4c0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x52f586
push rbp
mov rbp, rsp
sub rsp, 0x30
movabs rdx, 0x89648c3944b68698
mov qword [rsp + 0x1d], rdx
mov byte [rsp + 0x25], 0x81
movabs rdx, 0x408000302070102
mov qword [rsp + 0x26], rdx
mov word [rsp + 0x2e], 0x501
xor eax, eax
nop
jmp 0x52f520
movzx r9d, byte [rsp + rsi + 0x1d]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x2b]
mov byte [rsp + rdi + 0x1d], dl
mov byte [rsp + rsi + 0x1d], r8b
add rax, 2
nop dword [rax]
cmp rax, 0xa
jge 0x52f552
movzx edx, byte [rsp + rax + 0x26]
movzx esi, byte [rsp + rax + 0x27]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 9
jae 0x52f577
movzx r8d, byte [rsp + rdi + 0x1d]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x2b]
cmp rsi, 9
jb 0x52f502
jmp 0x52f56b
xor eax, eax
lea rbx, [rsp + 0x1d]
mov ecx, 9
nop
call fcn.0044c4e0
add rsp, 0x30
pop rbp
ret
mov eax, esi
mov ecx, 9
call fcn.004617c0
mov eax, edi
mov ecx, 9
nop
call fcn.004617c0
nop
call fcn.0045f540
jmp fcn.0052f4c0

Function at 0x5305c0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x5306aa
push rbp
mov rbp, rsp
sub rsp, 0x40
movabs rdx, 0x3775585f45323130
mov qword [rsp + 0x1b], rdx
movabs rdx, 0x5e3775585f453231
mov qword [rsp + 0x1c], rdx
movabs rdx, 0x6b74625882514c45
mov qword [rsp + 0x24], rdx
movabs rdx, 0xa05100f080c0c0f
mov qword [rsp + 0x2c], rdx
movabs rdx, 0x80903060a05100f
mov qword [rsp + 0x30], rdx
movabs rdx, 0x30c090d0e0d0b04
mov qword [rsp + 0x38], rdx
xor eax, eax
jmp 0x53064d
movzx r9d, byte [rsp + rsi + 0x1b]
sub r9d, edx
lea edx, [r9 - 2]
mov byte [rsp + rdi + 0x1b], dl
lea edx, [r8 - 2]
mov byte [rsp + rsi + 0x1b], dl
add rax, 2
cmp rax, 0x14
jge 0x53067a
movzx edx, byte [rsp + rax + 0x2c]
movzx esi, byte [rsp + rax + 0x2d]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x11
jae 0x53069d
movzx r8d, byte [rsp + rdi + 0x1b]
sub r8d, edx
cmp rsi, 0x11
jb 0x530630
jmp 0x530691
xor eax, eax
lea rbx, [rsp + 0x1b]
mov ecx, 0x11
call fcn.0044c4e0
add rsp, 0x40
pop rbp
ret
mov eax, esi
mov ecx, 0x11
call fcn.004617c0
mov eax, edi
mov ecx, 0x11
call fcn.004617c0
nop
call fcn.0045f540
jmp fcn.005305c0
Function at 0x5306c0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x5307dd
push rbp
mov rbp, rsp
sub rsp, 0x60
movabs rdx, 0x4d5175074168702e
mov qword [rsp + 0x1b], rdx
movabs rdx, 0x734b62186e75196e
mov qword [rsp + 0x23], rdx
movabs rdx, 0x56fd300d314c5773
mov qword [rsp + 0x2a], rdx
movabs rdx, 0xdd65706d503e1874
mov qword [rsp + 0x32], rdx
movabs rdx, 0x1a0013030e191214
mov qword [rsp + 0x3a], rdx
movabs rdx, 0x15071a161a1e1a00
mov qword [rsp + 0x40], rdx
movabs rdx, 0x21e060415090e10
mov qword [rsp + 0x48], rdx
movabs rdx, 0x11b0c1803110712
mov qword [rsp + 0x50], rdx
movabs rdx, 0xa04061a06030a15
mov qword [rsp + 0x58], rdx
xor eax, eax
jmp 0x530780
movzx r9d, byte [rsp + rsi + 0x1b]
sub r9d, edx
lea edx, [r9 + 0x36]
mov byte [rsp + rdi + 0x1b], dl
lea edx, [r8 + 0x36]
mov byte [rsp + rsi + 0x1b], dl
add rax, 2
nop word [rax + rax]
cmp rax, 0x26
jge 0x5307ad
movzx edx, byte [rsp + rax + 0x3a]
movzx esi, byte [rsp + rax + 0x3b]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x1f
jae 0x5307d0
movzx r8d, byte [rsp + rdi + 0x1b]
sub r8d, edx
cmp rsi, 0x1f
jb 0x53075d
jmp 0x5307c4
xor eax, eax
lea rbx, [rsp + 0x1b]
mov ecx, 0x1f
call fcn.0044c4e0
add rsp, 0x60
pop rbp
ret
mov eax, esi
mov ecx, 0x1f
call fcn.004617c0
mov eax, edi
mov ecx, 0x1f
call fcn.004617c0
nop
nop dword [rax]
call fcn.0045f540
jmp fcn.005306c0
Function at 0x533840
Capabilities:
Hash data using fnv

Disassembly:
test byte [rax], al
mov rcx, rbx
and ebx, 0x7f
shl rbx, 5
lea rdx, [rax + rbx]
xor eax, eax
jmp 0x533857
inc rax
cmp rax, 4
jge 0x53386f
lea rbx, [rdx + rax*8]
mov rbx, qword [rbx]
cmp rbx, rcx
jne 0x533854
mov eax, 1
ret
xor eax, eax
movabs rbx, 0xcbf29ce484222325
jmp 0x533880
inc rax
cmp rax, 4
jge 0x53388e
mov rsi, qword [rdx + rax*8]
xor edi, edi
jmp 0x5338b7
and ebx, 3
lea rdx, [rdx + rbx*8]
xchg qword [rdx], rcx
xor eax, eax
ret
movzx r8d, sil
xor rbx, r8
inc rdi
shr rsi, 8
movabs r8, 0x100000001b3
imul rbx, r8
cmp rdi, 8
jl 0x53389b
jmp 0x53387d

Function at 0x534060
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x53415b
push rbp
mov rbp, rsp
sub rsp, 0x50
movabs rdx, 0x567669a7b0838c82
mov qword [rsp + 0x1c], rdx
movabs rdx, 0x20977265b074a970
mov qword [rsp + 0x24], rdx
movabs rdx, 0xbcb5785c336e7873
mov qword [rsp + 0x2c], rdx
movabs rdx, 0x140b071617160b04
mov qword [rsp + 0x34], rdx
movabs rdx, 0x203010406140e0e
mov qword [rsp + 0x3c], rdx
movabs rdx, 0x907090b02030104
mov qword [rsp + 0x40], rdx
movabs rdx, 0x1317000b0b110b02
mov qword [rsp + 0x48], rdx
xor eax, eax
jmp 0x5340f9
movzx r9d, byte [rsp + rsi + 0x1c]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x31]
mov byte [rsp + rdi + 0x1c], dl
mov byte [rsp + rsi + 0x1c], r8b
add rax, 2
cmp rax, 0x1c
jge 0x53412b
movzx edx, byte [rsp + rax + 0x34]
movzx esi, byte [rsp + rax + 0x35]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x18
jae 0x53414e
movzx r8d, byte [rsp + rdi + 0x1c]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x31]
cmp rsi, 0x18
jb 0x5340df
jmp 0x534142
xor eax, eax
lea rbx, [rsp + 0x1c]
mov ecx, 0x18
call fcn.0044c4e0
add rsp, 0x50
pop rbp
ret
mov eax, esi
mov ecx, 0x18
call fcn.004617c0
mov eax, edi
mov ecx, 0x18
call fcn.004617c0
nop
nop dword [rax + rax]
call fcn.0045f540
jmp fcn.00534060

Function at 0x534de0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x534edd
push rbp
mov rbp, rsp
sub rsp, 0x50
movabs rdx, 0x201dd19db170b8a1
mov qword [rsp + 0x1c], rdx
movabs rdx, 0x206ed265a3f061c7
mov qword [rsp + 0x24], rdx
movabs rdx, 0xdac543d6816e7973
mov qword [rsp + 0x2c], rdx
movabs rdx, 0x160b051613050300
mov qword [rsp + 0x34], rdx
movabs rdx, 0x114041602170601
mov qword [rsp + 0x3c], rdx
movabs rdx, 0x1503170b01140416
mov qword [rsp + 0x40], rdx
movabs rdx, 0x170b0d0403080a15
mov qword [rsp + 0x48], rdx
xor eax, eax
jmp 0x534e80
movzx r9d, byte [rsp + rsi + 0x1c]
sub r9d, edx
lea edx, [r9 - 0x45]
mov byte [rsp + rdi + 0x1c], dl
lea edx, [r8 - 0x45]
mov byte [rsp + rsi + 0x1c], dl
add rax, 2
nop dword [rax]
cmp rax, 0x1c
jge 0x534ead
movzx edx, byte [rsp + rax + 0x34]
movzx esi, byte [rsp + rax + 0x35]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x18
jae 0x534ed0
movzx r8d, byte [rsp + rdi + 0x1c]
sub r8d, edx
cmp rsi, 0x18
jb 0x534e5f
jmp 0x534ec4
xor eax, eax
lea rbx, [rsp + 0x1c]
mov ecx, 0x18
call fcn.0044c4e0
add rsp, 0x50
pop rbp
ret
mov eax, esi
mov ecx, 0x18
call fcn.004617c0
mov eax, edi
mov ecx, 0x18
call fcn.004617c0
nop
nop dword [rax]
call fcn.0045f540
jmp fcn.00534de0
Function at 0x538660
Capabilities:
Resolve function by parsing pe exports

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x53884e
push rbp
mov rbp, rsp
sub rsp, 0x78
mov qword [rsp + 0x88], rax
nop word [rax + rax]
cmp rbx, 0x40
jne 0x538834
xor ecx, ecx
jmp 0x538691
inc rcx
cmp rcx, 0x40
jge 0x538765
movzx edx, byte [rax + rcx]
nop
cmp dl, 0xa
je 0x5386aa
cmp dl, 0xd
jne 0x53868e
movabs rdx, 0x55a38117c21805
mov qword [rsp + 0x44], rdx
movabs rdx, 0xc94a5053b5b1f6c3
mov qword [rsp + 0x4c], rdx
movabs rdx, 0x73048241c94a5053
mov qword [rsp + 0x50], rdx
movabs rdx, 0x6cfa1c4d06963ba2
mov qword [rsp + 0x58], rdx
movabs rdx, 0x24d4ed7157f682b6
mov qword [rsp + 0x60], rdx
movabs rdx, 0x84f7b51a20412d41
mov qword [rsp + 0x68], rdx
movabs rdx, 0x673bcae578a17660
mov qword [rsp + 0x18], rdx
movabs rdx, 0xac28313bc5dd97e3
mov qword [rsp + 0x20], rdx
movabs rdx, 0x1c67a235ac28313b
mov qword [rsp + 0x24], rdx
movabs rdx, 0x2da6f236ff74fcc
mov qword [rsp + 0x2c], rdx
movabs rdx, 0x47f4881f3e9af5d3
mov qword [rsp + 0x34], rdx
movabs rdx, 0xf692c17941334c29
mov qword [rsp + 0x3c], rdx
xor eax, eax
jmp 0x538808
mov qword [rsp + 0x88], rax
lea rax, [0x0056d6e0]
call fcn.0040cea0
mov qword [rsp + 0x70], rax
mov dword [rax + 0x140], 0x3d
mov rbx, qword [rsp + 0x88]
cmp rax, rbx
je 0x5387ac
mov ecx, 0x40
call fcn.00462160
mov rax, qword [rsp + 0x70]
mov rbx, qword [rsp + 0x88]
lea rdx, [rax + 0x40]
lea rsi, [0x0057cee2]
cmp rsi, rdx
je 0x5387d9
mov rax, rdx
mov rbx, rsi
mov ecx, 0x100
call fcn.00462160
mov rax, qword [rsp + 0x70]
mov rbx, qword [rsp + 0x88]
xor ecx, ecx
jmp 0x5387e8
movzx edx, byte [rbx + rcx]
mov byte [rax + rdx + 0x40], cl
inc rcx
cmp rcx, 0x40
jl 0x5387dd
add rsp, 0x78
pop rbp
ret
movzx edx, byte [rsp + rax + 0x44]
movzx esi, byte [rsp + rax + 0x18]
xor esi, edx
mov byte [rsp + rax + 0x18], sil
inc rax
cmp rax, 0x2c
jl 0x5387f4
xor eax, eax
lea rbx, [rsp + 0x18]
mov ecx, 0x2c
call fcn.0044c4e0
nop
call fcn.0040a740
mov rbx, rax
lea rax, [0x0054fc00]
call fcn.00434d20
call fcn.00538ac0
call fcn.0040a740
mov rbx, rax
lea rax, [0x0054fc00]
call fcn.00434d20
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.0045f540
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.00538660
Function at 0x538e80
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x538f5d
push rbp
mov rbp, rsp
sub rsp, 0x40
movabs rdx, 0x208284896d6d6069
mov qword [rsp + 0x1f], rdx
movabs rdx, 0x6c78796f9f7e6120
mov qword [rsp + 0x26], rdx
movabs rdx, 0x20a090801030409
mov qword [rsp + 0x2e], rdx
movabs rdx, 0xe0b020a09080103
mov qword [rsp + 0x30], rdx
movabs rdx, 0x5080d060502040c
mov qword [rsp + 0x38], rdx
xor eax, eax
nop
jmp 0x538f00
movzx r9d, byte [rsp + rsi + 0x1f]
sub r9d, edx
lea edx, [r9 + 5]
mov byte [rsp + rdi + 0x1f], dl
lea edx, [r8 + 5]
mov byte [rsp + rsi + 0x1f], dl
add rax, 2
nop
cmp rax, 0x12
jge 0x538f2d
movzx edx, byte [rsp + rax + 0x2e]
movzx esi, byte [rsp + rax + 0x2f]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0xf
jae 0x538f50
movzx r8d, byte [rsp + rdi + 0x1f]
sub r8d, edx
cmp rsi, 0xf
jb 0x538ee2
jmp 0x538f44
xor eax, eax
lea rbx, [rsp + 0x1f]
mov ecx, 0xf
call fcn.0044c4e0
add rsp, 0x40
pop rbp
ret
mov eax, esi
mov ecx, 0xf
call fcn.004617c0
mov eax, edi
mov ecx, 0xf
call fcn.004617c0
nop
nop dword [rax]
call fcn.0045f540
jmp fcn.00538e80

Function at 0x53be60
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x53bf68
push rbp
mov rbp, rsp
sub rsp, 0x58
movabs rdx, 0x30a50468516e7973
mov qword [rsp + 0x1f], rdx
movabs rdx, 0x5180cd72cc989830
mov qword [rsp + 0x26], rdx
movabs rdx, 0xb4c99bd0dd61cdad
mov qword [rsp + 0x2e], rdx
movabs rdx, 0x70d0910160c1615
mov qword [rsp + 0x36], rdx
movabs rdx, 0x1512070d0910160c
mov qword [rsp + 0x38], rdx
movabs rdx, 0x16050d1315090a04
mov qword [rsp + 0x40], rdx
movabs rdx, 0x90d12140a0c0f13
mov qword [rsp + 0x48], rdx
movabs rdx, 0x408060e1606030f
mov qword [rsp + 0x50], rdx
xor eax, eax
jmp 0x53bf0b
movzx r9d, byte [rsp + rsi + 0x1f]
sub r9d, edx
lea edx, [r9 - 0xb]
mov byte [rsp + rdi + 0x1f], dl
lea edx, [r8 - 0xb]
mov byte [rsp + rsi + 0x1f], dl
add rax, 2
cmp rax, 0x22
jge 0x53bf38
movzx edx, byte [rsp + rax + 0x36]
movzx esi, byte [rsp + rax + 0x37]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x17
jae 0x53bf5b
movzx r8d, byte [rsp + rdi + 0x1f]
sub r8d, edx
cmp rsi, 0x17
jb 0x53beee
jmp 0x53bf4f
xor eax, eax
lea rbx, [rsp + 0x1f]
mov ecx, 0x17
call fcn.0044c4e0
add rsp, 0x58
pop rbp
ret
mov eax, esi
mov ecx, 0x17
call fcn.004617c0
mov eax, edi
mov ecx, 0x17
call fcn.004617c0
nop
call fcn.0045f540
jmp fcn.0053be60
Function at 0x53c9a0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x53ca67
push rbp
mov rbp, rsp
sub rsp, 0x30
movabs rdx, 0xf2017273fae76765
mov qword [rsp + 0x18], rdx
mov word [rsp + 0x20], 0x8e8a
movabs rdx, 0x303030109060402
mov qword [rsp + 0x22], rdx
movabs rdx, 0x207060606080303
mov qword [rsp + 0x28], rdx
xor eax, eax
jmp 0x53ca07
movzx r9d, byte [rsp + rsi + 0x18]
sub r9d, edx
lea edx, [r9 - 0x7c]
mov byte [rsp + rdi + 0x18], dl
lea edx, [r8 - 0x7c]
mov byte [rsp + rsi + 0x18], dl
add rax, 2
cmp rax, 0xe
jge 0x53ca37
movzx edx, byte [rsp + rax + 0x22]
movzx esi, byte [rsp + rax + 0x23]
mov edi, edx
xor edx, esi
add edx, eax
nop dword [rax]
cmp rdi, 0xa
jae 0x53ca5a
movzx r8d, byte [rsp + rdi + 0x18]
sub r8d, edx
cmp rsi, 0xa
jb 0x53c9ea
jmp 0x53ca4e
xor eax, eax
lea rbx, [rsp + 0x18]
mov ecx, 0xa
call fcn.0044c4e0
add rsp, 0x30
pop rbp
ret
mov eax, esi
mov ecx, 0xa
call fcn.004617c0
mov eax, edi
mov ecx, 0xa
call fcn.004617c0
nop
call fcn.0045f540
jmp fcn.0053c9a0

Function at 0x53ca80
Capabilities:
Encrypt data using rc4 prga

Disassembly:
lea r12, [rsp - 0x18]
cmp r12, qword [r14 + 0x10]
jbe 0x53cc15
push rbp
mov rbp, rsp
sub rsp, 0x90
movabs rdx, 0xb795d0fd65febda7
mov qword [rsp + 0x1d], rdx
movabs rdx, 0x87be8e28b320df25
mov qword [rsp + 0x25], rdx
movabs rdx, 0x187be8e28b320df
mov qword [rsp + 0x26], rdx
movabs rdx, 0x756fa920339abfbc
mov qword [rsp + 0x2e], rdx
movabs rdx, 0x74616c0b7220646e
mov qword [rsp + 0x36], rdx
movabs rdx, 0x528fdc74b3bdc069
mov qword [rsp + 0x3e], rdx
movabs rdx, 0xaaa3a86e659dcadf
mov qword [rsp + 0x46], rdx
movabs rdx, 0x799c6f7463fe7238
mov qword [rsp + 0x4e], rdx
movabs rdx, 0x1291d30162b1031
mov qword [rsp + 0x56], rdx
movabs rdx, 0x3323001124030509
mov qword [rsp + 0x5e], rdx
movabs rdx, 0x80c332300112403
mov qword [rsp + 0x60], rdx
movabs rdx, 0x23040628300f2711
mov qword [rsp + 0x68], rdx
movabs rdx, 0x222a100e07370e02
mov qword [rsp + 0x70], rdx
movabs rdx, 0x142f3712080c2301
mov qword [rsp + 0x78], rdx
movabs rdx, 0x220d3105260d3713
mov qword [rsp + 0x80], rdx
movabs rdx, 0x2e220e050b0f1401
mov qword [rsp + 0x88], rdx
xor eax, eax
jmp 0x53cbae
movzx r9d, byte [rsp + rsi + 0x1d]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x76]
mov byte [rsp + rdi + 0x1d], dl
mov byte [rsp + rsi + 0x1d], r8b
add rax, 2
cmp rax, 0x3a
jge 0x53cbe2
movzx edx, byte [rsp + rax + 0x56]
movzx esi, byte [rsp + rax + 0x57]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x39
jae 0x53cc08
movzx r8d, byte [rsp + rdi + 0x1d]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x76]
cmp rsi, 0x39
jb 0x53cb94
nop
jmp 0x53cbfc
xor eax, eax
lea rbx, [rsp + 0x1d]
mov ecx, 0x39
call fcn.0044c4e0
add rsp, 0x90
pop rbp
ret
mov eax, esi
mov ecx, 0x39
call fcn.004617c0
mov eax, edi
mov ecx, 0x39
call fcn.004617c0
nop
call fcn.0045f540
jmp fcn.0053ca80
Function at 0x140004420
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rax, qword [0x14000aed0]
xor edi, edi
mov ebx, ecx
mov esi, 1
test rax, rax
jne 0x140004470
cmp byte [0x14000aed8], dil
jne 0x140004470
xor edx, edx
xor ecx, ecx
call fcn.140003b4c
movzx ecx, byte [0x14000aed8]
test rax, rax
mov qword [0x14000aed0], rax
cmove ecx, esi
mov byte [0x14000aed8], cl
mov ecx, ebx
xor r9d, r9d
sar ecx, 4
add cx, si
movzx r8d, cx
mov rcx, rax
lea edx, [r9 + 6]
call qword [sym.imp.KERNEL32.dll_FindResourceExW]
test rax, rax
je 0x1400044d4
mov rcx, qword [0x14000aed0]
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov rcx, rax
test rax, rax
je 0x1400044d4
and ebx, 0x8000000f
jge 0x1400044b8
sub ebx, esi
or ebx, 0xfffffff0
add ebx, esi
test ebx, ebx
je 0x1400044cb
movzx eax, word [rcx]
lea rcx, [rcx + rax*2]
add rcx, 2
sub ebx, esi
jne 0x1400044bc
lea rax, [rcx + 2]
cmp word [rcx], di
jne 0x1400044db
lea rax, [0x1400066e4]
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret

Function at 0x140004588
Capabilities:
Query environment variable

Disassembly:
push rbx
sub rsp, 0xb0
mov rax, qword [0x140009010]
xor rax, rsp
mov qword [rsp + 0xa0], rax
mov rbx, rcx
xor r8d, r8d
lea rcx, str.VS_UNICODE_OUTPUT
xor edx, edx
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
test eax, eax
je 0x1400045e9
mov r8d, 0x40
lea rdx, [rsp + 0x20]
lea rcx, str.VS_UNICODE_OUTPUT
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
lea rcx, [rsp + 0x20]
call qword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll__wtoi64]
mov qword [rbx], rax
mov eax, 1
jmp 0x1400045eb
xor eax, eax
mov rcx, qword [rsp + 0xa0]
xor rcx, rsp
call fcn.140002180
add rsp, 0xb0
pop rbx
ret

Function at 0x140004604
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x170
mov rax, qword [0x140009010]
xor rax, rsp
mov qword [rsp + 0x160], rax
mov rbp, rdx
lea rsi, [rsp + 0x60]
mov r14, rcx
call qword [sym.imp.KERNEL32.dll_GetConsoleOutputCP]
mov ecx, eax
lea rdx, [rsp + 0x40]
mov r15d, eax
call qword [sym.imp.KERNEL32.dll_GetCPInfo]
or rdi, 0xffffffffffffffff
mov rbx, rdi
xor r12d, r12d
inc rbx
cmp word [rbp + rbx*2], r12w
jne 0x14000465a
imul ebx, dword [rsp + 0x40]
inc ebx
cmp ebx, 0x100
jle 0x1400046a5
invalid
Function at 0x140004728
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r15
sub rsp, 0x30
movsxd rdi, edx
mov rbx, rcx
cmp edi, 1
ja 0x1400047f5
lea r15, [0x140000000]
xor ebp, ebp
cmp dword [r15 + rdi*4 + 0xaee0], ebp
jne 0x140004788
lea ecx, [rbp + 1]
test edx, edx
je 0x140004766
lea ecx, [rbp + 2]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov rcx, rax
call fcn.14000453c
mov dword [r15 + rdi*4 + 0xaee8], eax
mov dword [r15 + rdi*4 + 0xaee0], 1
cmp dword [r15 + rdi*4 + 0xaee8], ebp
je 0x14000479d
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_conio_l1_1_0.dll__cputws]
jmp 0x1400047f5
lea rcx, [rsp + 0x60]
call fcn.140004588
test eax, eax
je 0x1400047d6
or rax, 0xffffffffffffffff
inc rax
cmp word [rbx + rax*2], bp
jne 0x1400047af
mov rcx, qword [rsp + 0x60]
lea r8d, [rax + rax]
lea r9, [rsp + 0x58]
mov qword [rsp + 0x20], rbp
mov rdx, rbx
call qword [sym.imp.KERNEL32.dll_WriteFile]
jmp 0x1400047f5
mov ecx, 1
test edi, edi
je 0x1400047e4
mov ecx, 2
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll___acrt_iob_func]
mov rcx, rax
mov rdx, rbx
call fcn.140004604
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x68]
add rsp, 0x30
pop r15
pop rdi
pop rsi
ret