joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400309b0
Capabilities:
Encode data using xor

Disassembly:
push rsi
sub rsp, 0x20
mov r8, rdx
add r8, 8
mov rax, qword [rdx + 8]
cmp rax, 0
je 0x1400309e8
mov r9, qword [rdx]
mov r11, r9
add r11, 1
mov rsi, rax
add rsi, 0xffffffffffffffff
mov r10b, byte [r9]
mov qword [rdx], r11
mov qword [r8], rsi
cmp r10b, 0xfb
jb 0x140030a16
jmp 0x1400309f8
mov byte [rcx], 0
mov qword [rcx + 8], 1
jmp 0x140030b06
add r10b, 5
movzx esi, r10b
sub r10b, 3
ja 0x140030a6f
lea r10, [0x1400a6388]
movsxd rsi, dword [r10 + rsi*4]
add rsi, r10
jmp rsi
mov eax, dword [0x1400c56b8]
sub eax, dword [0x1400c56bc]
or eax, 0x9650eec3
xor eax, 0xa67c02ff
sub eax, 0xd9d82dad
cmp eax, 0x98c53f6e
je 0x140030b0c
jmp 0x140030a3e
mov eax, dword [0x1400c56c0]
add eax, dword [0x1400c56c4]
xor eax, 0xa95c7d5a
and eax, 0x17c0dbec
xor eax, 0x6d831f25
movzx edx, r10b
mov dword [rcx + 4], edx
mov byte [rcx], 0x11
cmp eax, 0xc388ce3b
jae 0x140030a3e
jmp 0x140030b06
mov edx, 0xc
call fcn.14009fc40
jmp 0x140030b06
cmp rax, 3
jb 0x140030ac9
jmp 0x140030aa6
cmp rax, 5
jb 0x140030af7
jmp 0x140030ada
mov edx, 3
call fcn.14009fc40
jmp 0x140030b06
mov edx, 4
call fcn.14009fc40
jmp 0x140030b06
add r9, 3
add rax, 0xfffffffffffffffd
mov r10w, word [r11]
mov qword [rdx], r9
mov qword [r8], rax
rol r10w, 8
movzx eax, r10w
mov dword [rcx + 4], eax
mov byte [rcx], 0x11
jmp 0x140030b06
mov edx, 3
sub rdx, rax
mov byte [rcx], 0
mov qword [rcx + 8], rdx
jmp 0x140030b06
add r9, 5
add rax, 0xfffffffffffffffb
mov r10d, dword [r11]
mov qword [rdx], r9
mov qword [r8], rax
bswap r10d
mov dword [rcx + 4], r10d
mov byte [rcx], 0x11
jmp 0x140030b06
mov edx, 5
sub rdx, rax
mov byte [rcx], 0
mov qword [rcx + 8], rdx
add rsp, 0x20
pop rsi
ret
push 0x14d6fdaf
jae 0x140030b50
adc ecx, dword [rsi + rbx*8]
ja 0x140030ac9
jmp 0x140030a3c
mov ecx, edi
call fcn.1400500e0
lea rdi, [rsi + 0x18]
mov r15, qword [rsi + 0x18]
mov rax, qword [r15 + 0x18]
lea rbx, [r15 + 0x20]
movabs r12, 0xffffffff00000000
jmp 0x140030b97
mov eax, eax
mov rcx, rax
shl rcx, 0x20
or rcx, rax
mov rax, r14
lock cmpxchg qword [r15 + 0x18], rcx
je 0x140030bd5
mov r14, rax
mov rcx, rbx
call fcn.1400596d0
cmp eax, r14d
je 0x140030beb
mov rcx, r14
shr rcx, 0x20
lea eax, [r14 + 1]
cmp ecx, r14d
je 0x140030b80
cmp eax, ecx
je 0x140030c43
mov eax, eax
mov rcx, r14
and rcx, r12
or rcx, rax
mov rax, r14
lock cmpxchg qword [r15 + 0x18], rcx
jne 0x140030b97
movzx eax, r14b
mov rcx, qword [r15 + 0x10]
mov rax, qword [rcx + rax*8]
mov qword [rsp + 0x20], rax
test rax, rax
jne 0x140030c45
mov rax, qword [rdi]
lock dec qword [rax]
jne 0x140030bfc
mov rcx, rdi
call fcn.140037090
mov rax, qword [rsi + 8]
test rax, rax
je 0x140030c14
lock dec qword [rax]
jne 0x140030c14
lea rcx, [rsi + 8]
call fcn.140036d60
mov edx, 0x50
mov r8d, 8
mov rcx, rsi
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
jmp fcn.140044c20
ud2
lea rcx, [rsp + 0x20]
call fcn.140031730
ud2
Function at 0x140036b60
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rsi, qword [rcx]
mov rdi, rsi
add rdi, 0x10
mov rbx, qword [rsi + 0x10]
cmp rbx, 0
je 0x140036c13
mov rcx, rbx
add rcx, 0x30
call fcn.14004f960
and rax, 5
cmp rax, 1
jne 0x140036ba0
mov rax, qword [rbx + 0x20]
mov rcx, qword [rbx + 0x28]
call qword [rax + 0x10]
mov rax, qword [rdi]
cmp rax, 0
je 0x140036c13
mov ecx, dword [0x1400c57f0]
xor ecx, dword [0x1400c57f4]
imul ecx, ecx, 0xd0fb3524
imul ecx, ecx, 0xf22b6346
add ecx, 0x9b6e0a9f
cmp ecx, 0x421fe1ad
je 0x140036c93
mov edx, dword [0x1400c57f8]
sub edx, dword [0x1400c57fc]
or edx, 0x6e6ae89f
sub edx, 0xd5bd42
or edx, 0xd2c515d2
lock dec qword [rax]
sete cl
cmp edx, 0xe74e0f8c
jb 0x140036c93
test cl, 1
jne 0x140036c0b
jmp 0x140036c13
mov rcx, qword [rdi]
call fcn.140037020
mov rax, 0xffffffffffffffff
cmp rsi, rax
je 0x140036c44
mov rax, rsi
add rax, 8
lock dec qword [rax]
sete al
test al, 1
je 0x140036c44
mov rcx, rsi
mov edx, 0x18
mov r8d, 8
call fcn.140044c20
mov eax, dword [0x1400c5800]
imul eax, dword [0x1400c5804]
xor eax, 0x74b7e197
add eax, 0xf96146dd
add eax, 0x1b9d27ee
cmp eax, 0x9c7246c1
je 0x140036ca4
jmp 0x140036c69
mov eax, dword [0x1400c5808]
add eax, dword [0x1400c580c]
xor eax, 0x8d96106d
sub eax, 0xbadc321f
xor eax, 0xce79c56d
cmp eax, 0xd31c28a
je 0x140036c69
add rsp, 0x20
pop rbx
pop rdi
pop rsi
ret
out 0xb5, eax
call 0x150a37f14
and esi, dword [rax - 0x169c7032]
invalid
scasd eax, dword [rdi]
mov ebx, 0xdf9628a7
bnd ret
Function at 0x14003af40
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
push rbx
mov rax, rcx
add qword [rcx + 0x30], r8
mov r11, qword [rcx + 0x40]
test r11, r11
je 0x14003af82
mov r10d, 8
sub r10, r11
cmp r10, r8
mov rdi, r8
cmovb rdi, r10
cmp rdi, 4
jb 0x14003af8a
mov esi, dword [rdx]
mov r9d, 4
mov rcx, r9
or rcx, 1
cmp rcx, rdi
jb 0x14003af9b
jmp 0x14003afb2
xor r10d, r10d
jmp 0x14003b03d
xor esi, esi
xor r9d, r9d
mov rcx, r9
or rcx, 1
cmp rcx, rdi
jae 0x14003afb2
movzx ebx, word [rdx + r9]
lea ecx, [r9*8]
shl rbx, cl
or rsi, rbx
or r9, 2
cmp r9, rdi
jae 0x14003afc9
movzx edi, byte [rdx + r9]
shl r9d, 3
mov ecx, r9d
shl rdi, cl
or rsi, rdi
lea ecx, [r11*8]
shl rsi, cl
or rsi, qword [rax + 0x38]
mov qword [rax + 0x38], rsi
cmp r10, r8
jbe 0x14003afe9
add r11, r8
jmp 0x14003b11a
mov rcx, qword [rax + 0x18]
xor rcx, rsi
mov r11, qword [rax + 0x10]
mov r9, qword [rax]
add r9, r11
mov rdi, qword [rax + 8]
add rdi, rcx
rol r11, 0xd
xor r11, r9
rol rcx, 0x10
rol r9, 0x20
xor rcx, rdi
add rdi, r11
rol r11, 0x11
add r9, rcx
xor r11, rdi
rol rcx, 0x15
mov qword [rax + 0x10], r11
xor rcx, r9
rol rdi, 0x20
mov qword [rax + 0x18], rcx
mov qword [rax + 8], rdi
xor r9, rsi
mov qword [rax], r9
sub r8, r10
mov r11d, r8d
and r11d, 7
and r8, 0xfffffffffffffff8
cmp r10, r8
jae 0x14003b0b2
mov rcx, qword [rax]
mov r9, qword [rax + 8]
mov rdi, qword [rax + 0x18]
mov rsi, qword [rax + 0x10]
nop
mov rbx, qword [rdx + r10]
xor rdi, rbx
add rcx, rsi
rol rsi, 0xd
add r9, rdi
xor rsi, rcx
rol rdi, 0x10
xor rdi, r9
rol rcx, 0x20
add r9, rsi
add rcx, rdi
rol rsi, 0x11
xor rsi, r9
rol rdi, 0x15
rol r9, 0x20
xor rdi, rcx
xor rcx, rbx
add r10, 8
cmp r10, r8
jb 0x14003b060
mov qword [rax + 0x18], rdi
mov qword [rax + 0x10], rsi
mov qword [rax + 8], r9
mov qword [rax], rcx
cmp r11d, 4
jb 0x14003b0d0
mov r9d, dword [rdx + r10]
mov r8d, 4
mov rcx, r8
or rcx, 1
cmp rcx, r11
jb 0x14003b0e2
jmp 0x14003b0fc
xor r9d, r9d
xor r8d, r8d
mov rcx, r8
or rcx, 1
cmp rcx, r11
jae 0x14003b0fc
lea rcx, [r8 + r10]
movzx esi, word [rdx + rcx]
lea ecx, [r8*8]
shl rsi, cl
or r9, rsi
or r8, 2
cmp r8, r11
jae 0x14003b116
add r10, r8
movzx edx, byte [rdx + r10]
shl r8d, 3
mov ecx, r8d
shl rdx, cl
or r9, rdx
mov qword [rax + 0x38], r9
mov qword [rax + 0x40], r11
pop rbx
pop rdi
pop rsi
ret
Function at 0x14003f130
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rdi, r9
mov rbx, r8
mov rsi, rdx
mov r14, rcx
mov r12, rsi
add r12, 0x29
mov r13, rsi
add r13, 8
mov al, byte [rsi + 0x29]
add al, 0xfe
movzx edx, al
inc rdx
xor ecx, ecx
sub al, 2
cmovb rcx, rdx
test rcx, rcx
je 0x14003f1e4
jmp 0x14003f173
mov rax, rcx
sub rax, 1
je 0x14003f20a
jmp 0x14003f182
sub rcx, 2
je 0x14003f22f
jmp 0x14003f18e
mov eax, dword [0x1400c5a20]
imul eax, dword [0x1400c5a24]
mov ecx, 0x59ef603e
xor edx, edx
div ecx
or eax, 0x80594ea5
xor eax, 0x8177906e
cmp eax, 0x7ba9618c
jae 0x14003f310
jmp 0x14003f1bb
mov eax, dword [0x1400c5a28]
sub eax, dword [0x1400c5a2c]
imul eax, eax, 0x746300f5
xor eax, 0x7e3128e3
mov ecx, 0xc306e4ad
xor edx, edx
div ecx
cmp eax, 0xae4c8736
je 0x14003f1bb
ud2
mov rcx, rsi
mov rdx, r14
mov r8, rbx
mov r9, rdi
call fcn.140031c00
mov r15, rdx
mov rcx, rax
add rcx, 0xffffffffffffffff
cmp rcx, 2
jae 0x14003f239
jmp 0x14003f2c2
mov rcx, rdi
mov rdx, r14
call fcn.140051690
mov rcx, rax
mov r15, rdx
mov eax, 2
cmp rcx, 0
je 0x14003f2d5
jmp 0x14003f2c2
mov r15, qword [rsi]
xor eax, eax
jmp 0x14003f2c2
mov al, 2
cmp byte [r12], 2
jb 0x14003f244
jmp 0x14003f2b6
mov eax, dword [0x1400c5a30]
xor eax, dword [0x1400c5a34]
xor eax, 0x6aba0df5
sub eax, 0x34ae4ab
add eax, 0xa32bb0ae
cmp eax, 0xe1b274bf
je 0x14003f31d
jmp 0x14003f26c
mov eax, dword [0x1400c5a38]
xor eax, dword [0x1400c5a3c]
xor eax, 0xdbafe042
or eax, 0x1571524b
mov ecx, 0xcf84f5a
xor edx, edx
div ecx
mov rdx, qword [r13]
cmp rdx, 0
sete cl
cmp eax, 0xe679bbf
jae 0x14003f26c
mov al, 2
test cl, 1
je 0x14003f2a6
jmp 0x14003f2b6
mov rcx, qword [rsi]
mov r8d, 1
call fcn.140044c20
mov al, 2
mov qword [rsi], r15
mov byte [r12], al
jmp 0x14003f15c
mov rdx, r15
add rsp, 0x20
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov eax, 1
cmp r15, 0
jne 0x14003f2c2
mov r15, qword [rsi]
mov cl, byte [r12]
mov al, 3
cmp cl, 2
jb 0x14003f2f0
jmp 0x14003f2b6
mov rdx, qword [r13]
mov al, 3
cmp rdx, 0
jne 0x14003f2fe
jmp 0x14003f2b6
mov rcx, r15
mov r8d, 1
call fcn.140044c20
mov al, 3
jmp 0x14003f2b6
xchg dword [rdi + 0xca59a65], edi
iretd
sub esp, dword [0x17bc7ab27]
sbb dh, byte [rdi - 0xbf17]
dec esp
int3

Function at 0x140040a50
Capabilities:
Encode data using xor

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x28
mov rsi, rcx
mov r8, qword [rsi]
movabs rax, 0x8000000000000001
mov rcx, r8
ror dword [rax + 1], 0xc1
Function at 0x140044320
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x38
mov rdi, rcx
mov rcx, qword [rdi + 0x18]
mov rax, qword [rdi + 0x20]
mov qword [rdi + 0x18], 0xffffffffffffffff
cmp rcx, 0xffffffffffffffff
je 0x1400445cd
mov qword [rsp + 0x28], rcx
lea r15, [rsp + 0x28]
add r15, 8
mov qword [rsp + 0x30], rax
mov rcx, rdi
call fcn.14004ee60
mov rsi, rax
add rdi, 0x10
lea rcx, [rsp + 0x28]
mov rdx, rsi
call fcn.140063310
cmp rax, 0
jne 0x140044408
mov r14, rsi
add r14, 0x18
mov rbx, rsi
add rbx, 0x20
mov cl, 1
xor eax, eax
lock cmpxchg byte [rsi + 0x20], cl
sete al
test al, 1
jne 0x1400443ae
mov rcx, rbx
mov r8d, 0x3b9aca00
call fcn.1400a1840
mov rdx, rsi
add rdx, 0x28
mov rcx, r14
mov r8, rdi
call fcn.14005dcb0
mov cl, al
xor edx, edx
mov al, 1
lock cmpxchg byte [rbx], dl
sete al
test cl, 1
jne 0x1400443eb
test al, 1
jne case.0x14004441b.0
jmp 0x1400443dc
mov rcx, rbx
xor edx, edx
call fcn.1400a1e90
jmp case.0x14004441b.0
test al, 1
jne 0x1400443fb
jmp 0x1400443f1
mov rcx, rbx
xor edx, edx
call fcn.1400a1e90
mov rcx, rsi
call fcn.14005a130
jmp case.0x14004441b.0
mov ecx, eax
and ecx, 3
lea rdx, [0x1400a76f0]
movsxd rcx, dword [rdx + rcx*4]
add rcx, rdx
jmp rcx
mov eax, dword [0x1400c5b70]
add eax, dword [0x1400c5b74]
and eax, 0xa0369698
sub eax, 0xd04bd322
and eax, 0x3dc88b24
cmp eax, 0xd7c0a05e
jae 0x1400445f5
jmp 0x140044540
mov ecx, dword [0x1400c5b78]
and ecx, dword [0x1400c5b7c]
add ecx, 0x143181fa
sub ecx, 0x87f2384d
xor ecx, 0x169c4249
mov rsi, qword [r15]
cmp rsi, 0
sete al
cmp ecx, 0xb34dfb14
jae 0x140044540
test al, 1
jne 0x1400445c2
jmp 0x140044576
mov rcx, rsi
call fcn.140062b50
mov rax, qword [rsi]
lock dec qword [rax]
sete al
test al, 1
je 0x140044594
mov rcx, rsi
call fcn.140036db0
mov rcx, rsi
add rcx, 8
mov rax, qword [rsi + 8]
lock dec qword [rax]
sete al
test al, 1
je 0x1400445af
call fcn.140037300
mov rcx, qword [r15]
mov edx, 0x20
mov r8d, 8
call fcn.140044c20
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.ws2_32.dll_closesocket]
nop
add rsp, 0x38
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
pop r15
ret
out 0xa5, al
mov ebx, 0x784042fa
mov esp, 0x8505842a
jmp 0x14004453e
Function at 0x140045790
Capabilities:
Parse pe header

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbp
push rbx
movzx eax, word [rdx]
cmp eax, 0x5a4d
jne 0x14004581c
movsxd rax, dword [rdx + 0x3c]
test rax, rax
je 0x140045821
cmp eax, 0x40
jb 0x140045911
cmp rax, r8
ja 0x140045911
movzx r9d, word [rax + rdx + 0x18]
cmp r9d, 0x10b
je 0x140045826
mov r10b, 5
cmp r9d, 0x20b
jne 0x140045851
mov r10b, 2
cmp dword [rdx + rax], 0x4550
jne 0x140045851
lea r9, [rdx + rax]
movzx r11d, word [r9 + 4]
mov r10b, 3
cmp r11d, 0x8664
jne 0x140045851
mov r10b, 4
test byte [r9 + 0x16], 2
je 0x140045851
lea r10, [rax + 0x108]
mov r11d, 1
cmp r10, r8
jbe 0x140045884
jmp 0x140045911
xor r10d, r10d
jmp 0x140045851
mov r10b, 1
jmp 0x140045851
mov r10b, 2
cmp dword [rdx + rax], 0x4550
jne 0x140045851
lea r9, [rdx + rax]
movzx r11d, word [r9 + 4]
mov r10b, 3
cmp r11d, 0x14c
jne 0x140045851
mov r10b, 4
test byte [r9 + 0x16], 2
jne 0x140045871
mov byte [rcx], r10b
mov r8d, 2
mov eax, 0x18
mov qword [rcx + rax], r8
mov rax, rcx
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
lea r10, [rax + 0xf8]
cmp r10, r8
ja 0x140045911
xor r11d, r11d
mov rsi, r8
sub rsi, r10
movzx ebx, word [rdx + rax + 6]
lea rdi, [rbx*8]
lea rdi, [rdi + rdi*4]
sub rsi, rdi
jb 0x140045911
add rax, 0xffffffffffffffc0
lea r14, [rdx + 0x40]
add r10, rdx
mov r15, rdx
shr r15, 8
add rdi, r10
mov ebp, ebx
shr ebp, 8
mov byte [rcx], dl
mov r12, rdx
shr r12, 0x38
mov byte [rcx + 7], r12b
mov r12, rdx
shr r12, 0x28
mov word [rcx + 5], r12w
mov dword [rcx + 1], r15d
mov qword [rcx + 8], r14
mov qword [rcx + 0x10], rax
mov qword [rcx + 0x18], r11
mov qword [rcx + 0x20], r9
mov qword [rcx + 0x28], r10
mov byte [rcx + 0x30], bl
mov dword [rcx + 0x31], ebp
mov byte [rcx + 0x37], 0
mov word [rcx + 0x35], 0
mov qword [rcx + 0x38], rdi
mov qword [rcx + 0x40], rsi
mov qword [rcx + 0x48], rdx
mov eax, 0x50
jmp 0x14004585f
ud2
Function at 0x14004f040
Capabilities:
Encode data using xor

Disassembly:
mov rax, qword [rcx]
nop word cs:[rax + rax]
mov rdx, rax
xor rdx, 3
lock cmpxchg qword [rcx], rdx
jne 0x14004f050
test al, 1
je 0x14004f06b
test al, 2
jne 0x14004f06b
xor rax, 3
ret
ud2

Function at 0x1400515d0
Capabilities:
Set socket configuration

Disassembly:
cmp qword [rcx + 0x18], 0xffffffffffffffff
je 0x1400515e0
add rcx, 0x18
jmp 0x140063230
ud2
jmp 0x14006a5c0
sub rsp, 0x38
movzx eax, dl
mov rcx, qword [rcx]
mov dword [rsp + 0x34], eax
mov dword [rsp + 0x20], 4
lea r9, [rsp + 0x34]
mov edx, 6
mov r8d, 1
call qword [sym.imp.ws2_32.dll_setsockopt]
cmp eax, 0xffffffff
je 0x14006a5f8
xor eax, eax
add rsp, 0x38
ret
call qword [sym.imp.ws2_32.dll_WSAGetLastError]
shl rax, 0x20
or rax, 2
add rsp, 0x38
ret
Function at 0x140051670
Capabilities:
Encrypt data using rc4 prga

Disassembly:
jmp 0x140059800
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x38
mov rsi, r8
mov rdi, rdx
mov rbx, rcx
cmp qword [rcx + 0x18], 0xffffffffffffffff
je 0x14005984a
mov r15, qword [rbx + 0x10]
lea rcx, [rsp + 0x20]
mov rdx, r15
mov r8, rdi
xor r9d, r9d
call fcn.14004ec60
movzx eax, byte [rsp + 0x29]
cmp al, 3
jne 0x140059875
mov eax, 1
jmp 0x1400599e3
mov rdx, qword [rbx + 0x10]
lea rcx, [rsp + 0x20]
mov r8, rdi
xor r9d, r9d
call fcn.14004ec60
movzx eax, byte [rsp + 0x29]
cmp al, 3
jne 0x1400599ac
mov eax, 1
jmp 0x1400599e3
add rbx, 0x18
lea r13, [rsp + 0x20]
mov qword [rsp + 0x30], rdi
jmp 0x1400598cf
dec r13
mov edx, 0x18
mov r8d, 8
mov rcx, r13
call fcn.140044c20
mov r13, rbx
mov rcx, rbx
mov rdx, r15
mov r8, qword [rsp + 0x30]
xor r9d, r9d
call fcn.14004ec60
movzx eax, byte [rsp + 0x29]
cmp al, 3
mov rbx, rsi
mov rsi, r14
je 0x140059840
mov rbp, qword [rsp + 0x20]
cmp al, 2
je 0x1400599b5
mov r8, qword [rsi + 8]
mov r12, qword [rsi + 0x10]
sub r8, r12
jb 0x1400599ff
movzx edi, byte [rsp + 0x28]
mov r14, rsi
mov rdx, qword [rsi]
add rdx, r12
mov rsi, rbx
mov qword [rsp + 0x20], rbx
mov rbx, r13
mov rcx, r13
call fcn.140063250
mov r13, rdx
test rax, rax
je 0x1400599b9
mov rcx, r13
call fcn.1400594a0
cmp al, 0xd
jne 0x1400599de
and ebp, 0x23
mov rax, qword [r15 + 0x90]
xor rbp, 0x2f
mov rcx, rdi
shl rcx, 0x10
nop
mov edx, eax
shr edx, 0x10
cmp dil, dl
jne 0x14005995c
mov edx, eax
and edx, ebp
or rdx, rcx
lock cmpxchg qword [r15 + 0x90], rdx
jne 0x140059940
mov eax, r13d
and eax, 3
lea rcx, [rax - 2]
cmp rcx, 2
jb 0x1400598a6
test rax, rax
je 0x1400598a6
mov rbp, qword [r13 - 1]
mov rdi, qword [r13 + 7]
mov rax, qword [rdi]
test rax, rax
je 0x14005998e
mov rcx, rbp
call rax
mov rdx, qword [rdi + 8]
test rdx, rdx
je 0x140059890
mov r8, qword [rdi + 0x10]
mov rcx, rbp
call fcn.140044c20
jmp 0x140059890
cmp al, 2
jne 0x1400599f7
mov rbp, qword [rsp + 0x20]
xor eax, eax
jmp 0x1400599e3
lea rax, [r12 + r13]
mov rcx, qword [r14 + 0x18]
cmp rax, rcx
jbe 0x1400599cd
mov qword [r14 + 0x18], rax
mov rcx, rax
add r12, r13
jb 0x1400599ff
cmp rax, rcx
ja 0x1400599ff
mov qword [r14 + 0x10], rax
xor r13d, r13d
xor eax, eax
mov rbp, r13
mov rdx, rbp
add rsp, 0x38
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov rax, qword [rsi + 0x10]
cmp rax, qword [rsi + 8]
ud2

Function at 0x1400527a0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov rcx, qword [rcx]
add rcx, 0x10
jmp 0x140059800
Function at 0x140052840
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov rcx, qword [rcx]
add rcx, 0x10
jmp 0x140059a10
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x48
mov qword [rsp + 0x40], r9
mov qword [rsp + 0x38], r8
mov rdi, rdx
mov r15, rcx
cmp qword [rcx + 0x18], 0xffffffffffffffff
je 0x140059a61
mov r12, qword [r15 + 0x10]
lea rcx, [rsp + 0x28]
mov rdx, r12
mov r8, rdi
mov r9b, 1
call fcn.14004ec60
movzx eax, byte [rsp + 0x31]
cmp al, 3
jne 0x140059a8c
mov eax, 2
jmp 0x140059bc6
mov rdx, qword [r15 + 0x10]
lea rcx, [rsp + 0x28]
mov r8, rdi
mov r9b, 1
call fcn.14004ec60
movzx eax, byte [rsp + 0x31]
cmp al, 3
jne 0x140059bac
mov eax, 2
jmp 0x140059bc6
add r15, 0x18
lea rsi, [rsp + 0x28]
jmp 0x140059ad3
dec r13
mov edx, 0x18
mov r8d, 8
mov rcx, r13
call fcn.140044c20
mov rsi, r14
mov rcx, r14
mov rdx, r12
mov r8, rdi
mov r9b, 1
call fcn.14004ec60
movzx eax, byte [rsp + 0x31]
cmp al, 3
je 0x140059a57
mov rbp, qword [rsp + 0x28]
cmp al, 2
je 0x140059bc1
movzx ebx, byte [rsp + 0x30]
mov qword [rsp + 0x28], r15
mov r14, rsi
mov rcx, rsi
mov rdx, qword [rsp + 0x38]
mov r8, qword [rsp + 0x40]
call fcn.140063260
mov rsi, rax
mov r13, rdx
test rax, rax
je 0x140059bbc
mov rcx, r13
call fcn.1400594a0
cmp al, 0xd
jne 0x140059bbc
and ebp, 0x23
mov rax, qword [r12 + 0x90]
xor rbp, 0x2f
mov rcx, rbx
shl rcx, 0x10
nop word cs:[rax + rax]
mov edx, eax
shr edx, 0x10
cmp bl, dl
jne 0x140059b5c
mov edx, eax
and edx, ebp
or rdx, rcx
lock cmpxchg qword [r12 + 0x90], rdx
jne 0x140059b40
mov eax, r13d
and eax, 3
lea rcx, [rax - 2]
cmp rcx, 2
jb 0x140059ab6
test rax, rax
je 0x140059ab6
mov rsi, qword [r13 - 1]
mov rbx, qword [r13 + 7]
mov rax, qword [rbx]
test rax, rax
je 0x140059b8e
mov rcx, rsi
call rax
mov rdx, qword [rbx + 8]
test rdx, rdx
je 0x140059aa0
mov r8, qword [rbx + 0x10]
mov rcx, rsi
call fcn.140044c20
jmp 0x140059aa0
cmp al, 2
jne 0x140059bdd
mov r13, qword [rsp + 0x28]
mov eax, 1
jmp 0x140059bc9
mov rax, rsi
jmp 0x140059bc9
mov eax, 1
mov r13, rbp
mov rdx, r13
add rsp, 0x48
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
ud2
Function at 0x140059800
Capabilities:
Encrypt data using rc4 prga

Disassembly:
jmp 0x140059800
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x38
mov rsi, r8
mov rdi, rdx
mov rbx, rcx
cmp qword [rcx + 0x18], 0xffffffffffffffff
je 0x14005984a
mov r15, qword [rbx + 0x10]
lea rcx, [rsp + 0x20]
mov rdx, r15
mov r8, rdi
xor r9d, r9d
call fcn.14004ec60
movzx eax, byte [rsp + 0x29]
cmp al, 3
jne 0x140059875
mov eax, 1
jmp 0x1400599e3
mov rdx, qword [rbx + 0x10]
lea rcx, [rsp + 0x20]
mov r8, rdi
xor r9d, r9d
call fcn.14004ec60
movzx eax, byte [rsp + 0x29]
cmp al, 3
jne 0x1400599ac
mov eax, 1
jmp 0x1400599e3
add rbx, 0x18
lea r13, [rsp + 0x20]
mov qword [rsp + 0x30], rdi
jmp 0x1400598cf
dec r13
mov edx, 0x18
mov r8d, 8
mov rcx, r13
call fcn.140044c20
mov r13, rbx
mov rcx, rbx
mov rdx, r15
mov r8, qword [rsp + 0x30]
xor r9d, r9d
call fcn.14004ec60
movzx eax, byte [rsp + 0x29]
cmp al, 3
mov rbx, rsi
mov rsi, r14
je 0x140059840
mov rbp, qword [rsp + 0x20]
cmp al, 2
je 0x1400599b5
mov r8, qword [rsi + 8]
mov r12, qword [rsi + 0x10]
sub r8, r12
jb 0x1400599ff
movzx edi, byte [rsp + 0x28]
mov r14, rsi
mov rdx, qword [rsi]
add rdx, r12
mov rsi, rbx
mov qword [rsp + 0x20], rbx
mov rbx, r13
mov rcx, r13
call fcn.140063250
mov r13, rdx
test rax, rax
je 0x1400599b9
mov rcx, r13
call fcn.1400594a0
cmp al, 0xd
jne 0x1400599de
and ebp, 0x23
mov rax, qword [r15 + 0x90]
xor rbp, 0x2f
mov rcx, rdi
shl rcx, 0x10
nop
mov edx, eax
shr edx, 0x10
cmp dil, dl
jne 0x14005995c
mov edx, eax
and edx, ebp
or rdx, rcx
lock cmpxchg qword [r15 + 0x90], rdx
jne 0x140059940
mov eax, r13d
and eax, 3
lea rcx, [rax - 2]
cmp rcx, 2
jb 0x1400598a6
test rax, rax
je 0x1400598a6
mov rbp, qword [r13 - 1]
mov rdi, qword [r13 + 7]
mov rax, qword [rdi]
test rax, rax
je 0x14005998e
mov rcx, rbp
call rax
mov rdx, qword [rdi + 8]
test rdx, rdx
je 0x140059890
mov r8, qword [rdi + 0x10]
mov rcx, rbp
call fcn.140044c20
jmp 0x140059890
cmp al, 2
jne 0x1400599f7
mov rbp, qword [rsp + 0x20]
xor eax, eax
jmp 0x1400599e3
lea rax, [r12 + r13]
mov rcx, qword [r14 + 0x18]
cmp rax, rcx
jbe 0x1400599cd
mov qword [r14 + 0x18], rax
mov rcx, rax
add r12, r13
jb 0x1400599ff
cmp rax, rcx
ja 0x1400599ff
mov qword [r14 + 0x10], rax
xor r13d, r13d
xor eax, eax
mov rbp, r13
mov rdx, rbp
add rsp, 0x38
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov rax, qword [rsi + 0x10]
cmp rax, qword [rsi + 8]
ud2
Function at 0x140059a10
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov rcx, qword [rcx]
add rcx, 0x10
jmp 0x140059a10
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x48
mov qword [rsp + 0x40], r9
mov qword [rsp + 0x38], r8
mov rdi, rdx
mov r15, rcx
cmp qword [rcx + 0x18], 0xffffffffffffffff
je 0x140059a61
mov r12, qword [r15 + 0x10]
lea rcx, [rsp + 0x28]
mov rdx, r12
mov r8, rdi
mov r9b, 1
call fcn.14004ec60
movzx eax, byte [rsp + 0x31]
cmp al, 3
jne 0x140059a8c
mov eax, 2
jmp 0x140059bc6
mov rdx, qword [r15 + 0x10]
lea rcx, [rsp + 0x28]
mov r8, rdi
mov r9b, 1
call fcn.14004ec60
movzx eax, byte [rsp + 0x31]
cmp al, 3
jne 0x140059bac
mov eax, 2
jmp 0x140059bc6
add r15, 0x18
lea rsi, [rsp + 0x28]
jmp 0x140059ad3
dec r13
mov edx, 0x18
mov r8d, 8
mov rcx, r13
call fcn.140044c20
mov rsi, r14
mov rcx, r14
mov rdx, r12
mov r8, rdi
mov r9b, 1
call fcn.14004ec60
movzx eax, byte [rsp + 0x31]
cmp al, 3
je 0x140059a57
mov rbp, qword [rsp + 0x28]
cmp al, 2
je 0x140059bc1
movzx ebx, byte [rsp + 0x30]
mov qword [rsp + 0x28], r15
mov r14, rsi
mov rcx, rsi
mov rdx, qword [rsp + 0x38]
mov r8, qword [rsp + 0x40]
call fcn.140063260
mov rsi, rax
mov r13, rdx
test rax, rax
je 0x140059bbc
mov rcx, r13
call fcn.1400594a0
cmp al, 0xd
jne 0x140059bbc
and ebp, 0x23
mov rax, qword [r12 + 0x90]
xor rbp, 0x2f
mov rcx, rbx
shl rcx, 0x10
nop word cs:[rax + rax]
mov edx, eax
shr edx, 0x10
cmp bl, dl
jne 0x140059b5c
mov edx, eax
and edx, ebp
or rdx, rcx
lock cmpxchg qword [r12 + 0x90], rdx
jne 0x140059b40
mov eax, r13d
and eax, 3
lea rcx, [rax - 2]
cmp rcx, 2
jb 0x140059ab6
test rax, rax
je 0x140059ab6
mov rsi, qword [r13 - 1]
mov rbx, qword [r13 + 7]
mov rax, qword [rbx]
test rax, rax
je 0x140059b8e
mov rcx, rsi
call rax
mov rdx, qword [rbx + 8]
test rdx, rdx
je 0x140059aa0
mov r8, qword [rbx + 0x10]
mov rcx, rsi
call fcn.140044c20
jmp 0x140059aa0
cmp al, 2
jne 0x140059bdd
mov r13, qword [rsp + 0x28]
mov eax, 1
jmp 0x140059bc9
mov rax, rsi
jmp 0x140059bc9
mov eax, 1
mov r13, rbp
mov rdx, r13
add rsp, 0x48
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
ud2