joyce8/EMBER2024-capa huggingface dataset:
Function at 0x525120
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x5251fd
push rbp
mov rbp, rsp
sub rsp, 0x40
movabs rdx, 0xf906a269b2f59091
mov qword [rsp + 0x30], rdx
movabs rdx, 0x788d6eb6fefa11a3
mov qword [rsp + 0x38], rdx
movabs rdx, 0xb0a060801060c03
mov qword [rsp + 0x1a], rdx
movabs rdx, 0x507000e03000b0a
mov qword [rsp + 0x20], rdx
movabs rdx, 0x70c000e03060902
mov qword [rsp + 0x28], rdx
xor eax, eax
nop
jmp 0x5251a0
movzx r9d, byte [rsp + rsi + 0x30]
sub r9d, edx
lea edx, [r9 + 0x78]
mov byte [rsp + rdi + 0x30], dl
lea edx, [r8 + 0x78]
mov byte [rsp + rsi + 0x30], dl
add rax, 2
nop
cmp rax, 0x16
jge 0x5251cd
movzx edx, byte [rsp + rax + 0x1a]
movzx esi, byte [rsp + rax + 0x1b]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x10
jae 0x5251f0
movzx r8d, byte [rsp + rdi + 0x30]
sub r8d, edx
cmp rsi, 0x10
jb 0x525182
jmp 0x5251e4
xor eax, eax
lea rbx, [rsp + 0x30]
mov ecx, 0x10
call fcn.00444780
add rsp, 0x40
pop rbp
ret
mov eax, esi
mov ecx, 0x10
call fcn.00456620
mov eax, edi
mov ecx, 0x10
call fcn.00456620
nop
nop dword [rax]
call fcn.00454340
jmp fcn.00525120

Function at 0x525500
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x5255cc
push rbp
mov rbp, rsp
sub rsp, 0x38
movabs rdx, 0x989de208f9659b4f
mov qword [rsp + 0x2a], rdx
movabs rdx, 0x57727c67e58e989d
mov qword [rsp + 0x30], rdx
movabs rdx, 0x4070408030b070b
mov qword [rsp + 0x1c], rdx
movabs rdx, 0x905050105060407
mov qword [rsp + 0x22], rdx
xor eax, eax
jmp 0x52556f
movzx r9d, byte [rsp + rsi + 0x2a]
sub r9d, edx
lea edx, [r9 + 0x76]
mov byte [rsp + rdi + 0x2a], dl
lea edx, [r8 + 0x76]
mov byte [rsp + rsi + 0x2a], dl
add rax, 2
cmp rax, 0xe
jge 0x52559c
movzx edx, byte [rsp + rax + 0x1c]
movzx esi, byte [rsp + rax + 0x1d]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0xe
jae 0x5255bf
movzx r8d, byte [rsp + rdi + 0x2a]
sub r8d, edx
cmp rsi, 0xe
jb 0x525552
jmp 0x5255b3
xor eax, eax
lea rbx, [rsp + 0x2a]
mov ecx, 0xe
call fcn.00444780
add rsp, 0x38
pop rbp
ret
mov eax, esi
mov ecx, 0xe
call fcn.00456620
mov eax, edi
mov ecx, 0xe
call fcn.00456620
nop
call fcn.00454340
jmp fcn.00525500
Function at 0x526020
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x5260e7
push rbp
mov rbp, rsp
sub rsp, 0x38
movabs rdx, 0x2b2799ada6f8aab5
mov qword [rsp + 0x2c], rdx
mov dword [rsp + 0x34], 0xae6c9aba
movabs rdx, 0x904080509060107
mov qword [rsp + 0x1c], rdx
movabs rdx, 0x4000b0301030200
mov qword [rsp + 0x24], rdx
xor eax, eax
jmp 0x526088
movzx r9d, byte [rsp + rsi + 0x2c]
sub r9d, edx
lea edx, [r9 - 0x35]
mov byte [rsp + rdi + 0x2c], dl
lea edx, [r8 - 0x35]
mov byte [rsp + rsi + 0x2c], dl
add rax, 2
cmp rax, 0x10
jge 0x5260b7
movzx edx, byte [rsp + rax + 0x1c]
movzx esi, byte [rsp + rax + 0x1d]
mov edi, edx
xor edx, esi
add edx, eax
nop
cmp rdi, 0xc
jae 0x5260da
movzx r8d, byte [rsp + rdi + 0x2c]
sub r8d, edx
cmp rsi, 0xc
jb 0x52606b
jmp 0x5260ce
xor eax, eax
lea rbx, [rsp + 0x2c]
mov ecx, 0xc
call fcn.00444780
add rsp, 0x38
pop rbp
ret
mov eax, esi
mov ecx, 0xc
call fcn.00456620
mov eax, edi
mov ecx, 0xc
call fcn.00456620
nop
call fcn.00454340
jmp fcn.00526020

Function at 0x527da0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x527e78
push rbp
mov rbp, rsp
sub rsp, 0x40
movabs rdx, 0x7f33b35f7b5fa976
mov qword [rsp + 0x32], rdx
movabs rdx, 0x817489724d787f33
mov qword [rsp + 0x38], rdx
movabs rdx, 0x9080d0705070708
mov qword [rsp + 0x1e], rdx
movabs rdx, 0x301040d09080d07
mov qword [rsp + 0x22], rdx
movabs rdx, 0xd0700020b04030b
mov qword [rsp + 0x2a], rdx
xor eax, eax
nop
jmp 0x527e19
movzx r9d, byte [rsp + rsi + 0x32]
sub r9d, edx
mov byte [rsp + rdi + 0x32], r9b
mov byte [rsp + rsi + 0x32], r8b
add rax, 2
cmp rax, 0x14
jge 0x527e48
movzx edx, byte [rsp + rax + 0x1e]
movzx esi, byte [rsp + rax + 0x1f]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0xe
jae 0x527e6b
movzx r8d, byte [rsp + rdi + 0x32]
sub r8d, edx
nop
cmp rsi, 0xe
jb 0x527e02
jmp 0x527e5f
xor eax, eax
lea rbx, [rsp + 0x32]
mov ecx, 0xe
call fcn.00444780
add rsp, 0x40
pop rbp
ret
mov eax, esi
mov ecx, 0xe
call fcn.00456620
mov eax, edi
mov ecx, 0xe
call fcn.00456620
nop
call fcn.00454340
nop dword [rax]
jmp fcn.00527da0
Function at 0x5282a0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x52839b
push rbp
mov rbp, rsp
sub rsp, 0x50
movabs rdx, 0x75a4a46f1b117406
mov qword [rsp + 0x3a], rdx
movabs rdx, 0x9b816efd469775a4
mov qword [rsp + 0x40], rdx
movabs rdx, 0xf17267e6a220f713
mov qword [rsp + 0x48], rdx
movabs rdx, 0x20d12110e060305
mov qword [rsp + 0x1c], rdx
movabs rdx, 0x30c0f02100f0e12
mov qword [rsp + 0x24], rdx
movabs rdx, 0x80303130a030c
mov qword [rsp + 0x2a], rdx
movabs rdx, 0xa0f110f111502
mov qword [rsp + 0x32], rdx
xor eax, eax
jmp 0x528339
movzx r9d, byte [rsp + rsi + 0x3a]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x4e]
mov byte [rsp + rdi + 0x3a], dl
mov byte [rsp + rsi + 0x3a], r8b
add rax, 2
cmp rax, 0x1e
jge 0x52836b
movzx edx, byte [rsp + rax + 0x1c]
movzx esi, byte [rsp + rax + 0x1d]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x16
jae 0x52838e
movzx r8d, byte [rsp + rdi + 0x3a]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x4e]
cmp rsi, 0x16
jb 0x52831f
jmp 0x528382
xor eax, eax
lea rbx, [rsp + 0x3a]
mov ecx, 0x16
call fcn.00444780
add rsp, 0x50
pop rbp
ret
mov eax, esi
mov ecx, 0x16
call fcn.00456620
mov eax, edi
mov ecx, 0x16
call fcn.00456620
nop
nop dword [rax + rax]
call fcn.00454340
jmp fcn.005282a0

Function at 0x529fc0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x52a0aa
push rbp
mov rbp, rsp
sub rsp, 0x48
movabs rdx, 0x6ef1a07461de7243
mov qword [rsp + 0x32], rdx
movabs rdx, 0xe58bee8c8d766ef1
mov qword [rsp + 0x38], rdx
movabs rdx, 0x6ba278b2c274b5d6
mov qword [rsp + 0x40], rdx
movabs rdx, 0x613090d0d020d11
mov qword [rsp + 0x1c], rdx
movabs rdx, 0xc0e0b13090a0613
mov qword [rsp + 0x22], rdx
movabs rdx, 0x514130f0b110c12
mov qword [rsp + 0x2a], rdx
xor eax, eax
jmp 0x52a04d
movzx r9d, byte [rsp + rsi + 0x32]
sub r9d, edx
lea edx, [r9 - 0x18]
mov byte [rsp + rdi + 0x32], dl
lea edx, [r8 - 0x18]
mov byte [rsp + rsi + 0x32], dl
add rax, 2
cmp rax, 0x16
jge 0x52a07a
movzx edx, byte [rsp + rax + 0x1c]
movzx esi, byte [rsp + rax + 0x1d]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x16
jae 0x52a09d
movzx r8d, byte [rsp + rdi + 0x32]
sub r8d, edx
cmp rsi, 0x16
jb 0x52a030
jmp 0x52a091
xor eax, eax
lea rbx, [rsp + 0x32]
mov ecx, 0x16
call fcn.00444780
add rsp, 0x48
pop rbp
ret
mov eax, esi
mov ecx, 0x16
call fcn.00456620
mov eax, edi
mov ecx, 0x16
call fcn.00456620
nop
call fcn.00454340
jmp fcn.00529fc0
Function at 0x52efa0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
lea r12, [rsp - 0x18]
cmp r12, qword [r14 + 0x10]
jbe 0x52f127
push rbp
mov rbp, rsp
sub rsp, 0x90
movabs rdx, 0xfa079e7211746e69
mov qword [rsp + 0x5a], rdx
movabs rdx, 0x726f6c966820fa07
mov qword [rsp + 0x60], rdx
movabs rdx, 0x6eda7ac7b479f8f9
mov qword [rsp + 0x68], rdx
movabs rdx, 0x6bad75c687aca32b
mov qword [rsp + 0x70], rdx
movabs rdx, 0x386574949c70dc75
mov qword [rsp + 0x78], rdx
movabs rdx, 0x8faae1b073c59643
mov qword [rsp + 0x80], rdx
movabs rdx, 0xac7079747b83c274
mov qword [rsp + 0x88], rdx
movabs rdx, 0x270935111a13060e
mov qword [rsp + 0x1c], rdx
movabs rdx, 0x1203062d14072b0b
mov qword [rsp + 0x24], rdx
movabs rdx, 0xb12280a1f0f1203
mov qword [rsp + 0x2a], rdx
movabs rdx, 0x2f10172b2c2a1814
mov qword [rsp + 0x32], rdx
movabs rdx, 0x10220a2b211f0e05
mov qword [rsp + 0x3a], rdx
movabs rdx, 0x190726162122071c
mov qword [rsp + 0x42], rdx
movabs rdx, 0x160f103035191f0b
mov qword [rsp + 0x4a], rdx
movabs rdx, 0x250e2d1d31271603
mov qword [rsp + 0x52], rdx
xor eax, eax
jmp 0x52f0c0
movzx r9d, byte [rsp + rsi + 0x5a]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x65]
mov byte [rsp + rdi + 0x5a], dl
mov byte [rsp + rsi + 0x5a], r8b
add rax, 2
nop
cmp rax, 0x3e
jge 0x52f0f2
movzx edx, byte [rsp + rax + 0x1c]
movzx esi, byte [rsp + rax + 0x1d]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x36
jae 0x52f11a
movzx r8d, byte [rsp + rdi + 0x5a]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x65]
cmp rsi, 0x36
jb 0x52f0a5
jmp 0x52f10e
xor eax, eax
lea rbx, [rsp + 0x5a]
mov ecx, 0x36
nop
call fcn.00444780
add rsp, 0x90
pop rbp
ret
mov eax, esi
mov ecx, 0x36
call fcn.00456620
mov eax, edi
mov ecx, 0x36
call fcn.00456620
nop
call fcn.00454340
jmp fcn.0052efa0

Function at 0x52f4c0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x52f58c
push rbp
mov rbp, rsp
sub rsp, 0x38
movabs rdx, 0x1f1616ca17729c75
mov qword [rsp + 0x2b], rdx
movabs rdx, 0xc228c14171f1616
mov qword [rsp + 0x30], rdx
movabs rdx, 0x80509070c040601
mov qword [rsp + 0x1d], rdx
movabs rdx, 0xb06030c030a0805
mov qword [rsp + 0x23], rdx
xor eax, eax
jmp 0x52f52f
movzx r9d, byte [rsp + rsi + 0x2b]
sub r9d, edx
lea edx, [r9 + 0x5f]
mov byte [rsp + rdi + 0x2b], dl
lea edx, [r8 + 0x5f]
mov byte [rsp + rsi + 0x2b], dl
add rax, 2
cmp rax, 0xe
jge 0x52f55c
movzx edx, byte [rsp + rax + 0x1d]
movzx esi, byte [rsp + rax + 0x1e]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0xd
jae 0x52f57f
movzx r8d, byte [rsp + rdi + 0x2b]
sub r8d, edx
cmp rsi, 0xd
jb 0x52f512
jmp 0x52f573
xor eax, eax
lea rbx, [rsp + 0x2b]
mov ecx, 0xd
call fcn.00444780
add rsp, 0x38
pop rbp
ret
mov eax, esi
mov ecx, 0xd
call fcn.00456620
mov eax, edi
mov ecx, 0xd
call fcn.00456620
nop
call fcn.00454340
jmp fcn.0052f4c0
Function at 0x5330e0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x5331ac
push rbp
mov rbp, rsp
sub rsp, 0x38
movabs rdx, 0x202f3cb561ab6ef8
mov qword [rsp + 0x2c], rdx
mov dword [rsp + 0x34], 0x39b46170
movabs rdx, 0xa040605050b000a
mov qword [rsp + 0x1e], rdx
movabs rdx, 0x205060b050b0a04
mov qword [rsp + 0x24], rdx
xor eax, eax
jmp 0x533145
movzx r9d, byte [rsp + rsi + 0x2c]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x55]
mov byte [rsp + rdi + 0x2c], dl
mov byte [rsp + rsi + 0x2c], r8b
add rax, 2
cmp rax, 0xe
jge 0x53317c
movzx edx, byte [rsp + rax + 0x1e]
movzx esi, byte [rsp + rax + 0x1f]
mov edi, edx
xor edx, esi
add edx, eax
nop dword [rax + rax]
cmp rdi, 0xc
jae 0x53319f
movzx r8d, byte [rsp + rdi + 0x2c]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x55]
cmp rsi, 0xc
jb 0x53312b
jmp 0x533193
xor eax, eax
lea rbx, [rsp + 0x2c]
mov ecx, 0xc
call fcn.00444780
add rsp, 0x38
pop rbp
ret
mov eax, esi
mov ecx, 0xc
call fcn.00456620
mov eax, edi
mov ecx, 0xc
call fcn.00456620
nop
call fcn.00454340
jmp fcn.005330e0

Function at 0x534780
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x53484c
push rbp
mov rbp, rsp
sub rsp, 0x38
movabs rdx, 0x6de39fab9d9c9df2
mov qword [rsp + 0x2d], rdx
mov dword [rsp + 0x34], 0x68dfae6d
movabs rdx, 0x60703080007040a
mov qword [rsp + 0x1f], rdx
movabs rdx, 0x102070509070607
mov qword [rsp + 0x25], rdx
xor eax, eax
jmp 0x5347e5
movzx r9d, byte [rsp + rsi + 0x2d]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x47]
mov byte [rsp + rdi + 0x2d], dl
mov byte [rsp + rsi + 0x2d], r8b
add rax, 2
cmp rax, 0xe
jge 0x53481c
movzx edx, byte [rsp + rax + 0x1f]
movzx esi, byte [rsp + rax + 0x20]
mov edi, edx
xor edx, esi
add edx, eax
nop dword [rax + rax]
cmp rdi, 0xb
jae 0x53483f
movzx r8d, byte [rsp + rdi + 0x2d]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x47]
cmp rsi, 0xb
jb 0x5347cb
jmp 0x534833
xor eax, eax
lea rbx, [rsp + 0x2d]
mov ecx, 0xb
call fcn.00444780
add rsp, 0x38
pop rbp
ret
mov eax, esi
mov ecx, 0xb
call fcn.00456620
mov eax, edi
mov ecx, 0xb
call fcn.00456620
nop
call fcn.00454340
jmp fcn.00534780
Function at 0x544780
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x54486a
push rbp
mov rbp, rsp
sub rsp, 0x48
movabs rdx, 0x74676e5b0d11794c
mov qword [rsp + 0x34], rdx
movabs rdx, 0x706a612074676e5b
mov qword [rsp + 0x38], rdx
movabs rdx, 0x240a4d4f506e496f
mov qword [rsp + 0x40], rdx
movabs rdx, 0x131210110f0d0004
mov qword [rsp + 0x1e], rdx
movabs rdx, 0xa06030604021312
mov qword [rsp + 0x24], rdx
movabs rdx, 0xf021111020f030f
mov qword [rsp + 0x2c], rdx
xor eax, eax
jmp 0x54480d
movzx r9d, byte [rsp + rsi + 0x34]
sub r9d, edx
lea edx, [r9 + 0x1d]
mov byte [rsp + rdi + 0x34], dl
lea edx, [r8 + 0x1d]
mov byte [rsp + rsi + 0x34], dl
add rax, 2
cmp rax, 0x16
jge 0x54483a
movzx edx, byte [rsp + rax + 0x1e]
movzx esi, byte [rsp + rax + 0x1f]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x14
jae 0x54485d
movzx r8d, byte [rsp + rdi + 0x34]
sub r8d, edx
cmp rsi, 0x14
jb 0x5447f0
jmp 0x544851
xor eax, eax
lea rbx, [rsp + 0x34]
mov ecx, 0x14
call fcn.00444780
add rsp, 0x48
pop rbp
ret
mov eax, esi
mov ecx, 0x14
call fcn.00456620
mov eax, edi
mov ecx, 0x14
call fcn.00456620
nop
call fcn.00454340
jmp fcn.00544780

Function at 0x5465a0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x54669d
push rbp
mov rbp, rsp
sub rsp, 0x50
movabs rdx, 0xc36c76347bc13530
mov qword [rsp + 0x39], rdx
movabs rdx, 0x56aef141610c44c3
mov qword [rsp + 0x40], rdx
movabs rdx, 0x5fff56dd65c664b3
mov qword [rsp + 0x48], rdx
movabs rdx, 0x91108060d010613
mov qword [rsp + 0x19], rdx
movabs rdx, 0x305081114150d07
mov qword [rsp + 0x21], rdx
movabs rdx, 0x205030e14050814
mov qword [rsp + 0x29], rdx
movabs rdx, 0xc130603130f1508
mov qword [rsp + 0x31], rdx
xor eax, eax
jmp 0x546640
movzx r9d, byte [rsp + rsi + 0x39]
sub r9d, edx
lea edx, [r9 - 0x6f]
mov byte [rsp + rdi + 0x39], dl
lea edx, [r8 - 0x6f]
mov byte [rsp + rsi + 0x39], dl
add rax, 2
nop dword [rax]
cmp rax, 0x20
jge 0x54666d
movzx edx, byte [rsp + rax + 0x19]
movzx esi, byte [rsp + rax + 0x1a]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x17
jae 0x546690
movzx r8d, byte [rsp + rdi + 0x39]
sub r8d, edx
cmp rsi, 0x17
jb 0x54661f
jmp 0x546684
xor eax, eax
lea rbx, [rsp + 0x39]
mov ecx, 0x17
call fcn.00444780
add rsp, 0x50
pop rbp
ret
mov eax, esi
mov ecx, 0x17
call fcn.00456620
mov eax, edi
mov ecx, 0x17
call fcn.00456620
nop
nop dword [rax]
call fcn.00454340
jmp fcn.005465a0
Function at 0x547c00
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x547cfd
push rbp
mov rbp, rsp
sub rsp, 0x48
movabs rdx, 0xf2d46e75e2d8e262
mov qword [rsp + 0x35], rdx
movabs rdx, 0x1e649bf2d46e75e2
mov qword [rsp + 0x38], rdx
movabs rdx, 0x2074d2fdd66f24cb
mov qword [rsp + 0x40], rdx
movabs rdx, 0x80807080f01100f
mov qword [rsp + 0x1b], rdx
movabs rdx, 0x70a0e030b0b060a
mov qword [rsp + 0x23], rdx
movabs rdx, 0x100f070a0e030b0b
mov qword [rsp + 0x25], rdx
movabs rdx, 0xa0c02030e0a080e
mov qword [rsp + 0x2d], rdx
xor eax, eax
jmp 0x547ca0
movzx r9d, byte [rsp + rsi + 0x35]
sub r9d, edx
lea edx, [r9 + 0x5f]
mov byte [rsp + rdi + 0x35], dl
lea edx, [r8 + 0x5f]
mov byte [rsp + rsi + 0x35], dl
add rax, 2
nop dword [rax]
cmp rax, 0x1a
jge 0x547ccd
movzx edx, byte [rsp + rax + 0x1b]
movzx esi, byte [rsp + rax + 0x1c]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x13
jae 0x547cf0
movzx r8d, byte [rsp + rdi + 0x35]
sub r8d, edx
cmp rsi, 0x13
jb 0x547c7f
jmp 0x547ce4
xor eax, eax
lea rbx, [rsp + 0x35]
mov ecx, 0x13
call fcn.00444780
add rsp, 0x48
pop rbp
ret
mov eax, esi
mov ecx, 0x13
call fcn.00456620
mov eax, edi
mov ecx, 0x13
call fcn.00456620
nop
nop dword [rax]
call fcn.00454340
jmp fcn.00547c00

Function at 0x549020
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x5490dd
push rbp
mov rbp, rsp
sub rsp, 0x30
movabs rdx, 0xcf7e6fd83332d7ce
mov qword [rsp + 0x26], rdx
mov word [rsp + 0x2e], 0xd512
movabs rdx, 0x601070008000500
mov qword [rsp + 0x1a], rdx
mov dword [rsp + 0x22], 0x7040901
xor eax, eax
jmp 0x549080
movzx r9d, byte [rsp + rsi + 0x26]
sub r9d, edx
lea edx, [r9 + 0x6c]
mov byte [rsp + rdi + 0x26], dl
lea edx, [r8 + 0x6c]
mov byte [rsp + rsi + 0x26], dl
add rax, 2
cmp rax, 0xc
jge 0x5490ad
movzx edx, byte [rsp + rax + 0x1a]
movzx esi, byte [rsp + rax + 0x1b]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0xa
jae 0x5490d0
movzx r8d, byte [rsp + rdi + 0x26]
sub r8d, edx
cmp rsi, 0xa
jb 0x549063
jmp 0x5490c4
xor eax, eax
lea rbx, [rsp + 0x26]
mov ecx, 0xa
call fcn.00444780
add rsp, 0x30
pop rbp
ret
mov eax, esi
mov ecx, 0xa
call fcn.00456620
mov eax, edi
mov ecx, 0xa
call fcn.00456620
nop
nop dword [rax]
call fcn.00454340
jmp fcn.00549020
Function at 0x54a020
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x54a10a
push rbp
mov rbp, rsp
sub rsp, 0x40
movabs rdx, 0xabb8ceb4cc322b34
mov qword [rsp + 0x2f], rdx
movabs rdx, 0xbcabb8ceb4cc322b
mov qword [rsp + 0x30], rdx
movabs rdx, 0x584642be4342ca2b
mov qword [rsp + 0x38], rdx
movabs rdx, 0xd0a010709010004
mov qword [rsp + 0x1b], rdx
movabs rdx, 0xd0309000d0a0107
mov qword [rsp + 0x1f], rdx
movabs rdx, 0x30906050e050408
mov qword [rsp + 0x27], rdx
xor eax, eax
jmp 0x54a0ad
movzx r9d, byte [rsp + rsi + 0x2f]
sub r9d, edx
lea edx, [r9 - 0x70]
mov byte [rsp + rdi + 0x2f], dl
lea edx, [r8 - 0x70]
mov byte [rsp + rsi + 0x2f], dl
add rax, 2
cmp rax, 0x14
jge 0x54a0da
movzx edx, byte [rsp + rax + 0x1b]
movzx esi, byte [rsp + rax + 0x1c]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x11
jae 0x54a0fd
movzx r8d, byte [rsp + rdi + 0x2f]
sub r8d, edx
cmp rsi, 0x11
jb 0x54a090
jmp 0x54a0f1
xor eax, eax
lea rbx, [rsp + 0x2f]
mov ecx, 0x11
call fcn.00444780
add rsp, 0x40
pop rbp
ret
mov eax, esi
mov ecx, 0x11
call fcn.00456620
mov eax, edi
mov ecx, 0x11
call fcn.00456620
nop
call fcn.00454340
jmp fcn.0054a020

Function at 0x54a7c0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x54a8ac
push rbp
mov rbp, rsp
sub rsp, 0x40
movabs rdx, 0x3704354e9c323139
mov qword [rsp + 0x2f], rdx
movabs rdx, 0x383704354e9c3231
mov qword [rsp + 0x30], rdx
movabs rdx, 0x9c6698d6d3136195
mov qword [rsp + 0x38], rdx
movabs rdx, 0xe10040d0b1003
mov qword [rsp + 0x1d], rdx
movabs rdx, 0xd04000e10040d0b
mov qword [rsp + 0x1f], rdx
movabs rdx, 0x90906090c0e1010
mov qword [rsp + 0x27], rdx
xor eax, eax
jmp 0x54a84a
movzx r9d, byte [rsp + rsi + 0x2f]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x7c]
mov byte [rsp + rdi + 0x2f], dl
mov byte [rsp + rsi + 0x2f], r8b
add rax, 2
cmp rax, 0x12
jge 0x54a87c
movzx edx, byte [rsp + rax + 0x1d]
movzx esi, byte [rsp + rax + 0x1e]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x11
jae 0x54a89f
movzx r8d, byte [rsp + rdi + 0x2f]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x7c]
cmp rsi, 0x11
jb 0x54a830
jmp 0x54a893
xor eax, eax
lea rbx, [rsp + 0x2f]
mov ecx, 0x11
call fcn.00444780
add rsp, 0x40
pop rbp
ret
mov eax, esi
mov ecx, 0x11
call fcn.00456620
mov eax, edi
mov ecx, 0x11
call fcn.00456620
nop
call fcn.00454340
jmp fcn.0054a7c0
Function at 0x54ac60
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x54ad4a
push rbp
mov rbp, rsp
sub rsp, 0x48
movabs rdx, 0x9403fe34bd32c792
mov qword [rsp + 0x37], rdx
movabs rdx, 0x389403fe34bd32c7
mov qword [rsp + 0x38], rdx
movabs rdx, 0xfc9887bf34d58f92
mov qword [rsp + 0x40], rdx
movabs rdx, 0xb05060e0b0b0605
mov qword [rsp + 0x1f], rdx
movabs rdx, 0xa0310100c100907
mov qword [rsp + 0x27], rdx
movabs rdx, 0xd0d010f0c010c00
mov qword [rsp + 0x2f], rdx
xor eax, eax
jmp 0x54aced
movzx r9d, byte [rsp + rsi + 0x37]
sub r9d, edx
lea edx, [r9 - 0x45]
mov byte [rsp + rdi + 0x37], dl
lea edx, [r8 - 0x45]
mov byte [rsp + rsi + 0x37], dl
add rax, 2
cmp rax, 0x18
jge 0x54ad1a
movzx edx, byte [rsp + rax + 0x1f]
movzx esi, byte [rsp + rax + 0x20]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x11
jae 0x54ad3d
movzx r8d, byte [rsp + rdi + 0x37]
sub r8d, edx
cmp rsi, 0x11
jb 0x54acd0
jmp 0x54ad31
xor eax, eax
lea rbx, [rsp + 0x37]
mov ecx, 0x11
call fcn.00444780
add rsp, 0x48
pop rbp
ret
mov eax, esi
mov ecx, 0x11
call fcn.00456620
mov eax, edi
mov ecx, 0x11
call fcn.00456620
nop
call fcn.00454340
jmp fcn.0054ac60
Function at 0x140009140
Capabilities:
Create directory

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rdi, rcx
mov dx, 0x2f
call fcn.1400172d0
test rax, rax
je 0x140009175
mov rsi, rax
mov word [rax], 0
mov rcx, rdi
call fcn.140009140
mov ebx, eax
test eax, eax
je 0x140009181
mov word [rsi], 0x2f
jmp 0x140009177
xor ebx, ebx
mov eax, ebx
add rsp, 0x20
pop rbx
pop rdi
pop rsi
ret
xor ebx, ebx
cmp word [rdi], 0
je 0x14000916e
mov rcx, rdi
call fcn.140025190
test eax, eax
jns 0x14000916e
call fcn.1400204f4
cmp dword [rax], 0x11
je 0x14000916e
mov eax, dword [0x140055e98]
mov ecx, dword [0x140052e00]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x1400091de
call fcn.1400204f4
mov r9d, dword [rax]
lea rdx, str.ensure_parent_dir:_failed_to_create_directory:__S__err:__d
mov r8, rdi
call fcn.140013a80
mov ebx, 7
jmp 0x14000916e
lea rcx, [0x140055e98]
call fcn.1400157d4
cmp dword [0x140055e98], 0xffffffff
jne 0x1400091c0
mov qword [0x140055c88], 0
lea rcx, [0x1400087f0]
call fcn.1400158b8
lea rcx, [0x140055e98]
call fcn.14001584c
jmp 0x1400091c0
Function at 0x14000c6f0
Capabilities:
Copy file

Disassembly:
push rsi
sub rsp, 0x660
mov rax, qword [0x140052040]
xor rax, rsp
mov qword [rsp + 0x658], rax
mov eax, dword [0x140055e98]
mov ecx, dword [0x140052e00]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 4]
jg 0x14000c8d5
mov rcx, qword [0x140055c88]
test rcx, rcx
je 0x14000c74b
call fcn.14002667c
mov qword [0x140055c88], 0
cmp byte [0x140054a49], 1
jne 0x14000c7f3
lea rsi, [rsp + 0x230]
mov r8d, 0x20a
mov rcx, rsi
xor edx, edx
call fcn.14003cdd0
mov rcx, rsi
call fcn.1400136a0
test eax, eax
je 0x14000c7a7
lea rsi, [rsp + 0x440]
mov r8d, 0x20a
mov rcx, rsi
xor edx, edx
call fcn.14003cdd0
lea rcx, [0x1400496f0]
mov rdx, rsi
call fcn.1400137a0
test eax, eax
jne 0x14000c80d
lea rsi, [rsp + 0x20]
mov r8d, 0x20a
mov rcx, rsi
xor edx, edx
call fcn.14003cdd0
mov rcx, rsi
call fcn.1400136a0
test eax, eax
je 0x14000c7f3
lea rsi, [rsp + 0x440]
mov r8d, 0x20a
mov rcx, rsi
xor edx, edx
call fcn.14003cdd0
lea rcx, [0x140049c90]
mov rdx, rsi
call fcn.1400137a0
test eax, eax
jne 0x14000c872
mov rcx, qword [rsp + 0x658]
xor rcx, rsp
call fcn.14002cd90
nop
add rsp, 0x660
pop rsi
ret
lea rcx, [rsp + 0x230]
lea rdx, [rsp + 0x440]
call fcn.14003dcc0
test eax, eax
je 0x14000c7a7
lea rsi, [rsp + 0x440]
mov r8d, 0x20a
mov rcx, rsi
xor edx, edx
call fcn.14003cdd0
lea r8, str._supdate.status
lea r9, [0x140054210]
mov edx, 0x105
mov rcx, rsi
call fcn.140006290
lea rcx, [rsp + 0x230]
mov rdx, rsi
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_CopyFileW]
jmp 0x14000c7a7
lea rcx, [rsp + 0x20]
lea rdx, [rsp + 0x440]
call fcn.14003dcc0
test eax, eax
je 0x14000c7f3
lea rsi, [rsp + 0x440]
mov r8d, 0x20a
mov rcx, rsi
xor edx, edx
call fcn.14003cdd0
lea r8, str._supdate_elevated.log
lea r9, [0x140054210]
mov edx, 0x105
mov rcx, rsi
call fcn.140006290
lea rcx, [rsp + 0x20]
mov rdx, rsi
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_CopyFileW]
jmp 0x14000c7f3
lea rcx, [0x140055e98]
call fcn.1400157d4
cmp dword [0x140055e98], 0xffffffff
jne 0x14000c72f
mov qword [0x140055c88], 0
lea rcx, [0x1400087f0]
call fcn.1400158b8
lea rcx, [0x140055e98]
call fcn.14001584c
jmp 0x14000c72f