joyce8/EMBER2024-capa huggingface dataset:
Function at 0x620040
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x620129
sub rsp, 0x40
mov qword [rsp + 0x38], rbp
lea rbp, [rsp + 0x38]
movabs rdx, 0x760b0b8b46466a52
mov qword [rsp + 0x1c], rdx
mov dword [rsp + 0x24], 0x2553307c
movabs rdx, 0x90b040b0b0b0605
mov qword [rsp + 0x28], rdx
movabs rdx, 0x10a0b070907080a
mov qword [rsp + 0x30], rdx
xor eax, eax
jmp 0x6200ae
movzx r9d, byte [rsp + rsi + 0x1c]
sub r9d, edx
lea edx, [r9 - 8]
mov byte [rsp + rdi + 0x1c], dl
lea edx, [r8 - 8]
mov byte [rsp + rsi + 0x1c], dl
add rax, 2
cmp rax, 0x10
jge 0x6200e8
movzx edx, byte [rsp + rax + 0x28]
lea rsi, [rax + 1]
nop dword [rax]
cmp rsi, 0x10
jae 0x62011b
movzx esi, byte [rsp + rax + 0x29]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0xc
jae 0x62010f
movzx r8d, byte [rsp + rdi + 0x1c]
sub r8d, edx
cmp rsi, 0xc
jb 0x620091
jmp 0x620103
xor eax, eax
lea rbx, [rsp + 0x1c]
mov ecx, 0xc
call fcn.00446000
mov rbp, qword [rsp + 0x38]
add rsp, 0x40
ret
mov eax, esi
mov ecx, 0xc
call fcn.00457f40
mov eax, edi
mov ecx, 0xc
call fcn.00457f40
mov rax, rsi
mov ecx, 0x10
call fcn.00457f40
nop
call fcn.00455860
jmp fcn.00620040

Function at 0x620140
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x62021f
sub rsp, 0x38
mov qword [rsp + 0x30], rbp
lea rbp, [rsp + 0x30]
movabs rdx, 0x766122d1659f9876
mov qword [rsp + 0x1b], rdx
mov byte [rsp + 0x23], 0x35
movabs rdx, 0x404040208020805
mov qword [rsp + 0x24], rdx
mov dword [rsp + 0x2c], 0x5010508
xor eax, eax
jmp 0x6201a1
movzx r9d, byte [rsp + rsi + 0x1b]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x77]
mov byte [rsp + rdi + 0x1b], dl
mov byte [rsp + rsi + 0x1b], r8b
add rax, 2
cmp rax, 0xc
jge 0x6201dd
movzx edx, byte [rsp + rax + 0x24]
lea rsi, [rax + 1]
cmp rsi, 0xc
jae 0x620211
movzx esi, byte [rsp + rax + 0x25]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 9
jae 0x620205
movzx r8d, byte [rsp + rdi + 0x1b]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x77]
cmp rsi, 9
jb 0x620187
jmp 0x6201f8
xor eax, eax
lea rbx, [rsp + 0x1b]
mov ecx, 9
call fcn.00446000
mov rbp, qword [rsp + 0x30]
add rsp, 0x38
ret
mov eax, esi
mov ecx, 9
nop
call fcn.00457f40
mov eax, edi
mov ecx, 9
call fcn.00457f40
mov rax, rsi
mov ecx, 0xc
call fcn.00457f40
nop
nop
call fcn.00455860
jmp fcn.00620140
Function at 0x6207c0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x620929
sub rsp, 0x78
mov qword [rsp + 0x70], rbp
lea rbp, [rsp + 0x70]
movabs rdx, 0x291d00444600ea
mov qword [rsp + 0x18], rdx
movabs rdx, 0xff00434f00291d00
mov qword [rsp + 0x1c], rdx
movabs rdx, 0xa7d2ff6275005c62
mov qword [rsp + 0x24], rdx
movabs rdx, 0x884f0045f14d4ed1
mov qword [rsp + 0x2c], rdx
movabs rdx, 0x504c8e19f3494400
mov qword [rsp + 0x34], rdx
movabs rdx, 0x21101305180c1f0b
mov qword [rsp + 0x3c], rdx
movabs rdx, 0xc11131121101305
mov qword [rsp + 0x40], rdx
movabs rdx, 0x17000b1408130017
mov qword [rsp + 0x48], rdx
movabs rdx, 0xf0d0b1b1d031e05
mov qword [rsp + 0x50], rdx
movabs rdx, 0x1a091f151a110214
mov qword [rsp + 0x58], rdx
movabs rdx, 0x1617210615101221
mov qword [rsp + 0x60], rdx
movabs rdx, 0xd201b0b08000600
mov qword [rsp + 0x68], rdx
xor eax, eax
jmp 0x6208aa
movzx r9d, byte [rsp + rsi + 0x18]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x78]
mov byte [rsp + rdi + 0x18], dl
mov byte [rsp + rsi + 0x18], r8b
add rax, 2
cmp rax, 0x34
jge 0x6208e8
movzx edx, byte [rsp + rax + 0x3c]
lea rsi, [rax + 1]
cmp rsi, 0x34
jae 0x62091b
movzx esi, byte [rsp + rax + 0x3d]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x24
jae 0x62090f
movzx r8d, byte [rsp + rdi + 0x18]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x78]
nop
cmp rsi, 0x24
jb 0x620890
jmp 0x620903
xor eax, eax
lea rbx, [rsp + 0x18]
mov ecx, 0x24
call fcn.00446000
mov rbp, qword [rsp + 0x70]
add rsp, 0x78
ret
mov eax, esi
mov ecx, 0x24
call fcn.00457f40
mov eax, edi
mov ecx, 0x24
call fcn.00457f40
mov rax, rsi
mov ecx, 0x34
call fcn.00457f40
nop
call fcn.00455860
jmp fcn.006207c0
Function at 0x620fa0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x6210e9
sub rsp, 0x68
mov qword [rsp + 0x60], rbp
lea rbp, [rsp + 0x60]
movabs rdx, 0x546063dff9405b47
mov qword [rsp + 0x19], rdx
movabs rdx, 0x2e3cfc7638046f42
mov qword [rsp + 0x21], rdx
movabs rdx, 0x27d446003b2e3cfc
mov qword [rsp + 0x26], rdx
movabs rdx, 0x3363651a400c0f6e
mov qword [rsp + 0x2e], rdx
movabs rdx, 0x180a0b14190b1413
mov qword [rsp + 0x36], rdx
movabs rdx, 0xe170e110e040b03
mov qword [rsp + 0x3e], rdx
movabs rdx, 0x100e170e110e04
mov qword [rsp + 0x40], rdx
movabs rdx, 0xd1102021612171c
mov qword [rsp + 0x48], rdx
movabs rdx, 0x80d0e0817011812
mov qword [rsp + 0x50], rdx
movabs rdx, 0x41c180611120708
mov qword [rsp + 0x58], rdx
xor eax, eax
jmp 0x62106f
movzx r9d, byte [rsp + rsi + 0x19]
sub r9d, edx
lea edx, [r9 + 0x46]
mov byte [rsp + rdi + 0x19], dl
lea edx, [r8 + 0x46]
mov byte [rsp + rsi + 0x19], dl
add rax, 2
cmp rax, 0x2a
jge 0x6210a8
movzx edx, byte [rsp + rax + 0x36]
lea rsi, [rax + 1]
nop
cmp rsi, 0x2a
jae 0x6210db
movzx esi, byte [rsp + rax + 0x37]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x1d
jae 0x6210cf
movzx r8d, byte [rsp + rdi + 0x19]
sub r8d, edx
cmp rsi, 0x1d
jb 0x621052
jmp 0x6210c3
xor eax, eax
lea rbx, [rsp + 0x19]
mov ecx, 0x1d
call fcn.00446000
mov rbp, qword [rsp + 0x60]
add rsp, 0x68
ret
mov eax, esi
mov ecx, 0x1d
call fcn.00457f40
mov eax, edi
mov ecx, 0x1d
call fcn.00457f40
mov rax, rsi
mov ecx, 0x2a
call fcn.00457f40
nop
call fcn.00455860
jmp fcn.00620fa0

Function at 0x621800
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x621913
sub rsp, 0x48
mov qword [rsp + 0x40], rbp
lea rbp, [rsp + 0x40]
movabs rdx, 0x74e66369c9312a31
mov qword [rsp + 0x18], rdx
movabs rdx, 0x6ffd74e66369c931
mov qword [rsp + 0x1a], rdx
movabs rdx, 0x7c2a7a2fea1b816e
mov qword [rsp + 0x22], rdx
movabs rdx, 0x11030803080b0d
mov qword [rsp + 0x2a], rdx
movabs rdx, 0xd000c10000d0011
mov qword [rsp + 0x30], rdx
movabs rdx, 0xb0602030e0e0100
mov qword [rsp + 0x38], rdx
xor eax, eax
jmp 0x621890
movzx r9d, byte [rsp + rsi + 0x18]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x28]
mov byte [rsp + rdi + 0x18], dl
mov byte [rsp + rsi + 0x18], r8b
add rax, 2
cmp rax, 0x16
jge 0x6218cd
movzx edx, byte [rsp + rax + 0x2a]
lea rsi, [rax + 1]
nop
cmp rsi, 0x16
jae 0x621905
movzx esi, byte [rsp + rax + 0x2b]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x12
jae 0x6218f4
movzx r8d, byte [rsp + rdi + 0x18]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x28]
cmp rsi, 0x12
jb 0x621876
jmp 0x6218e8
xor eax, eax
lea rbx, [rsp + 0x18]
mov ecx, 0x12
call fcn.00446000
mov rbp, qword [rsp + 0x40]
add rsp, 0x48
ret
mov eax, esi
mov ecx, 0x12
call fcn.00457f40
mov eax, edi
mov ecx, 0x12
nop dword [rax + rax]
call fcn.00457f40
mov rax, rsi
mov ecx, 0x16
call fcn.00457f40
nop
call fcn.00455860
jmp fcn.00621800
Function at 0x622e20
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x622f2b
sub rsp, 0x50
mov qword [rsp + 0x48], rbp
lea rbp, [rsp + 0x48]
movabs rdx, 0x724b3c733b4f723d
mov qword [rsp + 0x1f], rdx
movabs rdx, 0x2d724b3c733b4f72
mov qword [rsp + 0x20], rdx
movabs rdx, 0x5f434d3d6f524d3d
mov qword [rsp + 0x28], rdx
movabs rdx, 0xd0a00000910050e
mov qword [rsp + 0x30], rdx
movabs rdx, 0xa0b09100206030a
mov qword [rsp + 0x38], rdx
movabs rdx, 0x50a03050f0e0e
mov qword [rsp + 0x40], rdx
xor eax, eax
jmp 0x622eb3
movzx r9d, byte [rsp + rsi + 0x1f]
sub r9d, edx
lea edx, [r9 + 0x24]
mov byte [rsp + rdi + 0x1f], dl
lea edx, [r8 + 0x24]
mov byte [rsp + rsi + 0x1f], dl
add rax, 2
cmp rax, 0x18
jge 0x622eea
movzx edx, byte [rsp + rax + 0x30]
lea rsi, [rax + 1]
cmp rsi, 0x18
jae 0x622f1d
movzx esi, byte [rsp + rax + 0x31]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x11
jae 0x622f11
movzx r8d, byte [rsp + rdi + 0x1f]
sub r8d, edx
cmp rsi, 0x11
jb 0x622e96
jmp 0x622f05
xor eax, eax
lea rbx, [rsp + 0x1f]
mov ecx, 0x11
call fcn.00446000
mov rbp, qword [rsp + 0x48]
add rsp, 0x50
ret
mov eax, esi
mov ecx, 0x11
call fcn.00457f40
mov eax, edi
mov ecx, 0x11
call fcn.00457f40
mov rax, rsi
mov ecx, 0x18
call fcn.00457f40
nop
call fcn.00455860
jmp fcn.00622e20
Function at 0x624d80
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x624ec9
sub rsp, 0x70
mov qword [rsp + 0x68], rbp
lea rbp, [rsp + 0x68]
movabs rdx, 0x75d9c4dc223765d6
mov qword [rsp + 0x19], rdx
movabs rdx, 0x6f4365faeb49df75
mov qword [rsp + 0x20], rdx
movabs rdx, 0x826587d3d21c6e6e
mov qword [rsp + 0x28], rdx
movabs rdx, 0x2073024bd96cc7f5
mov qword [rsp + 0x30], rdx
movabs rdx, 0xee6575625a736964
mov qword [rsp + 0x38], rdx
movabs rdx, 0x3051a031b141411
mov qword [rsp + 0x40], rdx
movabs rdx, 0x1424220b2308020b
mov qword [rsp + 0x48], rdx
movabs rdx, 0x12160426181a0013
mov qword [rsp + 0x50], rdx
movabs rdx, 0x114261c041a060b
mov qword [rsp + 0x58], rdx
movabs rdx, 0x1c040217081a0a14
mov qword [rsp + 0x60], rdx
xor eax, eax
jmp 0x624e4f
movzx r9d, byte [rsp + rsi + 0x19]
sub r9d, edx
lea edx, [r9 - 0x48]
mov byte [rsp + rdi + 0x19], dl
lea edx, [r8 - 0x48]
mov byte [rsp + rsi + 0x19], dl
add rax, 2
cmp rax, 0x28
jge 0x624e88
movzx edx, byte [rsp + rax + 0x40]
lea rsi, [rax + 1]
nop
cmp rsi, 0x28
jae 0x624ebb
movzx esi, byte [rsp + rax + 0x41]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x27
jae 0x624eaf
movzx r8d, byte [rsp + rdi + 0x19]
sub r8d, edx
cmp rsi, 0x27
jb 0x624e32
jmp 0x624ea3
xor eax, eax
lea rbx, [rsp + 0x19]
mov ecx, 0x27
call fcn.00446000
mov rbp, qword [rsp + 0x68]
add rsp, 0x70
ret
mov eax, esi
mov ecx, 0x27
call fcn.00457f40
mov eax, edi
mov ecx, 0x27
call fcn.00457f40
mov rax, rsi
mov ecx, 0x28
call fcn.00457f40
nop
call fcn.00455860
jmp fcn.00624d80
Function at 0x624ee0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
lea r12, [rsp - 0x10]
cmp r12, qword [r14 + 0x10]
jbe 0x62507f
sub rsp, 0x90
mov qword [rsp + 0x88], rbp
lea rbp, [rsp + 0x88]
movabs rdx, 0x75dfe6ea74967468
mov qword [rsp + 0x1b], rdx
movabs rdx, 0x6e07501f07d9491a
mov qword [rsp + 0x23], rdx
movabs rdx, 0x27cfa629346e0750
mov qword [rsp + 0x28], rdx
movabs rdx, 0x6e878cdc63e06ee8
mov qword [rsp + 0x30], rdx
movabs rdx, 0x4026ed1f0feabb33
mov qword [rsp + 0x38], rdx
movabs rdx, 0x657420ba201d5027
mov qword [rsp + 0x40], rdx
movabs rdx, 0x1e1f121e14031f1a
mov qword [rsp + 0x48], rdx
movabs rdx, 0x30e1b0b1d222a02
mov qword [rsp + 0x50], rdx
movabs rdx, 0x2920232926110a27
mov qword [rsp + 0x58], rdx
movabs rdx, 0x1e062a0c1f131511
mov qword [rsp + 0x60], rdx
movabs rdx, 0x81f111724100608
mov qword [rsp + 0x68], rdx
movabs rdx, 0xc1304152004120e
mov qword [rsp + 0x70], rdx
movabs rdx, 0xc1d1d1914050c17
mov qword [rsp + 0x78], rdx
movabs rdx, 0x2125280d120b1e14
mov qword [rsp + 0x80], rdx
xor eax, eax
jmp 0x625000
movzx r9d, byte [rsp + rsi + 0x1b]
sub r9d, edx
lea edx, [r9 - 0x7c]
mov byte [rsp + rdi + 0x1b], dl
lea edx, [r8 - 0x7c]
mov byte [rsp + rsi + 0x1b], dl
add rax, 2
nop dword [rax]
cmp rax, 0x40
jge 0x625037
movzx edx, byte [rsp + rax + 0x48]
lea rsi, [rax + 1]
cmp rsi, 0x40
jae 0x625071
movzx esi, byte [rsp + rax + 0x49]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x2d
jae 0x625065
movzx r8d, byte [rsp + rdi + 0x1b]
sub r8d, edx
cmp rsi, 0x2d
jb 0x624fdf
jmp 0x625058
xor eax, eax
lea rbx, [rsp + 0x1b]
mov ecx, 0x2d
call fcn.00446000
mov rbp, qword [rsp + 0x88]
add rsp, 0x90
ret
mov eax, esi
mov ecx, 0x2d
nop
call fcn.00457f40
mov eax, edi
mov ecx, 0x2d
call fcn.00457f40
mov rax, rsi
mov ecx, 0x40
call fcn.00457f40
nop
nop
call fcn.00455860
jmp fcn.00624ee0
Function at 0x6257e0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
lea r12, [rsp - 8]
cmp r12, qword [r14 + 0x10]
jbe 0x625973
sub rsp, 0x88
mov qword [rsp + 0x80], rbp
lea rbp, [rsp + 0x80]
movabs rdx, 0x2235c07dc8827468
mov qword [rsp + 0x1c], rdx
movabs rdx, 0x656f43d6566438e0
mov qword [rsp + 0x24], rdx
movabs rdx, 0xa2e63a5f656f43d6
mov qword [rsp + 0x28], rdx
movabs rdx, 0x52e2edda8910dc75
mov qword [rsp + 0x30], rdx
movabs rdx, 0xb26f6e8ff0867a69
mov qword [rsp + 0x38], rdx
movabs rdx, 0x736e276974631137
mov qword [rsp + 0x40], rdx
movabs rdx, 0x25070304161e2409
mov qword [rsp + 0x48], rdx
movabs rdx, 0x1f1f0f0310161d12
mov qword [rsp + 0x50], rdx
movabs rdx, 0x201b16210b16180c
mov qword [rsp + 0x58], rdx
movabs rdx, 0x308290520210714
mov qword [rsp + 0x60], rdx
movabs rdx, 0x2513171b1a190914
mov qword [rsp + 0x68], rdx
movabs rdx, 0x9211e1209071517
mov qword [rsp + 0x70], rdx
movabs rdx, 0x241e232406230205
mov qword [rsp + 0x78], rdx
xor eax, eax
jmp 0x6258e7
movzx r9d, byte [rsp + rsi + 0x1c]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x67]
mov byte [rsp + rdi + 0x1c], dl
mov byte [rsp + rsi + 0x1c], r8b
add rax, 2
cmp rax, 0x38
jge 0x625928
movzx edx, byte [rsp + rax + 0x48]
lea rsi, [rax + 1]
cmp rsi, 0x38
jae 0x625965
movzx esi, byte [rsp + rax + 0x49]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x2c
jae 0x625955
movzx r8d, byte [rsp + rdi + 0x1c]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x67]
nop dword [rax + rax]
cmp rsi, 0x2c
jb 0x6258cd
jmp 0x625949
xor eax, eax
lea rbx, [rsp + 0x1c]
mov ecx, 0x2c
call fcn.00446000
mov rbp, qword [rsp + 0x80]
add rsp, 0x88
ret
mov eax, esi
mov ecx, 0x2c
call fcn.00457f40
mov eax, edi
mov ecx, 0x2c
nop dword [rax]
call fcn.00457f40
mov rax, rsi
mov ecx, 0x38
call fcn.00457f40
nop
call fcn.00455860
jmp fcn.006257e0
Function at 0x634080
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x6341b3
sub rsp, 0x60
mov qword [rsp + 0x58], rbp
lea rbp, [rsp + 0x58]
movabs rdx, 0x2d786b48787c796f
mov qword [rsp + 0x1a], rdx
movabs rdx, 0x9469346420808371
mov qword [rsp + 0x22], rdx
movabs rdx, 0x6963207b6e559469
mov qword [rsp + 0x28], rdx
movabs rdx, 0x5c25815a8a5c6371
mov qword [rsp + 0x30], rdx
movabs rdx, 0x120e160d1a091912
mov qword [rsp + 0x38], rdx
movabs rdx, 0xf020f0f0305161b
mov qword [rsp + 0x40], rdx
movabs rdx, 0xc1000080c1d0a09
mov qword [rsp + 0x48], rdx
movabs rdx, 0x1d0503191d041800
mov qword [rsp + 0x50], rdx
xor eax, eax
jmp 0x63412e
movzx r9d, byte [rsp + rsi + 0x1a]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x24]
mov byte [rsp + rdi + 0x1a], dl
mov byte [rsp + rsi + 0x1a], r8b
add rax, 2
cmp rax, 0x20
jge 0x63416d
movzx edx, byte [rsp + rax + 0x38]
lea rsi, [rax + 1]
nop dword [rax]
cmp rsi, 0x20
jae 0x6341a5
movzx esi, byte [rsp + rax + 0x39]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x1e
jae 0x634194
movzx r8d, byte [rsp + rdi + 0x1a]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x24]
cmp rsi, 0x1e
jb 0x634114
jmp 0x634188
xor eax, eax
lea rbx, [rsp + 0x1a]
mov ecx, 0x1e
call fcn.00446000
mov rbp, qword [rsp + 0x58]
add rsp, 0x60
ret
mov eax, esi
mov ecx, 0x1e
call fcn.00457f40
mov eax, edi
mov ecx, 0x1e
nop dword [rax + rax]
call fcn.00457f40
mov rax, rsi
mov ecx, 0x20
call fcn.00457f40
nop
call fcn.00455860
jmp fcn.00634080

Function at 0x634ee0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x634fbf
sub rsp, 0x38
mov qword [rsp + 0x30], rbp
lea rbp, [rsp + 0x30]
movabs rdx, 0x3a18635a4c735156
mov qword [rsp + 0x1d], rdx
mov byte [rsp + 0x25], 0x70
movabs rdx, 0x10308060301
mov qword [rsp + 0x26], rdx
mov word [rsp + 0x2e], 0x504
xor eax, eax
jmp 0x634f43
movzx r9d, byte [rsp + rsi + 0x1d]
sub r9d, edx
lea edx, [r9 + 0x18]
mov byte [rsp + rdi + 0x1d], dl
lea edx, [r8 + 0x18]
mov byte [rsp + rsi + 0x1d], dl
add rax, 2
cmp rax, 0xa
jge 0x634f7a
movzx edx, byte [rsp + rax + 0x26]
lea rsi, [rax + 1]
cmp rsi, 0xa
jae 0x634fb1
movzx esi, byte [rsp + rax + 0x27]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 9
jae 0x634fa5
movzx r8d, byte [rsp + rdi + 0x1d]
sub r8d, edx
cmp rsi, 9
jb 0x634f26
jmp 0x634f95
xor eax, eax
lea rbx, [rsp + 0x1d]
mov ecx, 9
call fcn.00446000
mov rbp, qword [rsp + 0x30]
add rsp, 0x38
ret
mov eax, esi
mov ecx, 9
nop dword [rax]
call fcn.00457f40
mov eax, edi
mov ecx, 9
call fcn.00457f40
mov rax, rsi
mov ecx, 0xa
call fcn.00457f40
nop
nop
call fcn.00455860
jmp fcn.00634ee0
Function at 0x637020
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x637149
sub rsp, 0x60
mov qword [rsp + 0x58], rbp
lea rbp, [rsp + 0x58]
movabs rdx, 0xb974f5655f0c6f34
mov qword [rsp + 0x1f], rdx
movabs rdx, 0x19fafda464b16583
mov qword [rsp + 0x27], rdx
movabs rdx, 0xfa19fafda464b165
mov qword [rsp + 0x28], rdx
movabs rdx, 0xafffeaa065a3e165
mov qword [rsp + 0x30], rdx
movabs rdx, 0x13181210160d0a15
mov qword [rsp + 0x38], rdx
movabs rdx, 0xc000a03080c050d
mov qword [rsp + 0x40], rdx
movabs rdx, 0xe17170718020c0e
mov qword [rsp + 0x48], rdx
movabs rdx, 0x130f15080a151305
mov qword [rsp + 0x50], rdx
xor eax, eax
jmp 0x6370d1
movzx r9d, byte [rsp + rsi + 0x1f]
sub r9d, edx
lea edx, [r9 - 0x7c]
mov byte [rsp + rdi + 0x1f], dl
lea edx, [r8 - 0x7c]
mov byte [rsp + rsi + 0x1f], dl
add rax, 2
cmp rax, 0x20
jge 0x637108
movzx edx, byte [rsp + rax + 0x38]
lea rsi, [rax + 1]
cmp rsi, 0x20
jae 0x63713b
movzx esi, byte [rsp + rax + 0x39]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x19
jae 0x63712f
movzx r8d, byte [rsp + rdi + 0x1f]
sub r8d, edx
cmp rsi, 0x19
jb 0x6370b4
jmp 0x637123
xor eax, eax
lea rbx, [rsp + 0x1f]
mov ecx, 0x19
call fcn.00446000
mov rbp, qword [rsp + 0x58]
add rsp, 0x60
ret
mov eax, esi
mov ecx, 0x19
call fcn.00457f40
mov eax, edi
mov ecx, 0x19
call fcn.00457f40
mov rax, rsi
mov ecx, 0x20
call fcn.00457f40
nop
call fcn.00455860
jmp fcn.00637020
Function at 0x140001080
Capabilities:
Execute command

Disassembly:
mov qword [rsp + 0x20], rbp
push r14
sub rsp, 0x30
mov rax, qword [0x14001b040]
xor rax, rsp
mov qword [rsp + 0x28], rax
xorps xmm0, xmm0
mov ebp, 0xdeadb00b
movups xmmword [0x14001ba10], xmm0
xor r14d, r14d
movups xmmword [0x14001ba20], xmm0
movups xmmword [0x14001ba30], xmm0
movups xmmword [0x14001ba40], xmm0
movups xmmword [0x14001ba50], xmm0
mov qword [0x14001ba10], rbp
mov dword [0x14001ba18], r14d
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov ecx, eax
lea rdx, [0x14001ba10]
call fcn.140001860
test al, al
jne 0x140001103
lea rcx, str.Failed_to_load_driver
call fcn.140001020
lea eax, [r14 - 1]
jmp 0x1400012a7
mov qword [rsp + 0x40], rbx
mov ebx, 0xa
mov qword [rsp + 0x50], rdi
call fcn.1400013a0
mov qword [0x14001ba10], rbp
mov dword [0x14001ba18], 3
sub rbx, 1
jne 0x140001112
mov qword [rsp + 0x48], rsi
call fcn.1400022f0
mov rdx, rax
lea rcx, str.Notepad_pid:__i_n
mov rdi, rax
call fcn.140001020
test rdi, rdi
je 0x140001293
mov rdx, rdi
call fcn.1400023a0
mov rdx, rax
lea rcx, str.Notepad_base:_0x_p_n
mov rsi, rax
call fcn.140001020
test rsi, rsi
je 0x140001293
mov qword [rsp + 0x20], r14
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov ebx, eax
call fcn.1400013a0
mov qword [0x14001ba10], rbp
lea rax, [rsp + 0x20]
mov dword [0x14001ba58], 0xffffffff
mov qword [0x14001ba30], rdi
mov qword [0x14001ba40], rsi
mov qword [0x14001ba38], rbx
mov qword [0x14001ba48], rax
mov qword [0x14001ba50], 8
mov dword [0x14001ba18], 5
call fcn.1400013a0
mov eax, dword [0x14001ba58]
lea rcx, str.read_physical:_0x_x_n
mov rdx, qword [rsp + 0x20]
test eax, eax
cmovs rdx, r14
call fcn.140001020
mov qword [rsp + 0x20], r14
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov ebx, eax
call fcn.1400013a0
mov qword [0x14001ba10], rbp
lea rax, [rsp + 0x20]
mov dword [0x14001ba58], 0xffffffff
mov qword [0x14001ba30], rdi
mov qword [0x14001ba40], rsi
mov qword [0x14001ba38], rbx
mov qword [0x14001ba48], rax
mov qword [0x14001ba50], 8
mov dword [0x14001ba18], 4
call fcn.1400013a0
mov eax, dword [0x14001ba58]
lea rcx, str.read_virtual:_0x_x
mov rdx, qword [rsp + 0x20]
test eax, eax
cmovs rdx, r14
call fcn.140001020
call fcn.1400013a0
mov qword [0x14001ba10], rbp
lea rcx, str.pause
mov dword [0x14001ba18], 1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
xor eax, eax
jmp 0x140001298
mov eax, 0xffffffff
mov rsi, qword [rsp + 0x48]
mov rbx, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.14000a9a0
mov rbp, qword [rsp + 0x58]
add rsp, 0x30
pop r14
ret
Function at 0x1400023a0
Capabilities:
Enumerate process modules

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x270
mov rax, qword [0x14001b040]
xor rax, rsp
mov qword [rsp + 0x260], rax
xor edi, edi
lea ecx, [rdi + 0x18]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x140002428
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x238
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Module32First]
test eax, eax
je 0x14000241f
nop dword [rax]
lea rdx, str.notepad.exe
lea rcx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
je 0x14000241a
lea rdx, [rsp + 0x20]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Module32Next]
test eax, eax
jne 0x1400023f0
jmp 0x14000241f
mov rdi, qword [rsp + 0x38]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rax, rdi
mov rcx, qword [rsp + 0x260]
xor rcx, rsp
call fcn.14000a9a0
mov rbx, qword [rsp + 0x280]
add rsp, 0x270
pop rdi
ret
Function at 0x1400048b0
Capabilities:
Enumerate pe sections

Disassembly:
push rbx
push rbp
push r13
push r14
mov eax, 0x1078
call fcn.14000ba30
sub rsp, rax
mov rax, qword [0x14001b040]
xor rax, rsp
mov qword [rsp + 0x1050], rax
mov r14, rdx
mov qword [rsp + 0x38], r9
mov rdx, qword [rsp + 0x10c0]
xor ebp, ebp
mov qword [rsp + 0x30], rdx
mov r13, r8
mov qword [rsp + 0x40], rcx
test r8, r8
jne 0x140004902
mov rdx, rbp
jmp 0x1400049cb
mov r9d, 0x1000
lea rdx, [rsp + 0x50]
call fcn.140003570
test al, al
je 0x1400048fa
mov qword [rsp + 0x10a8], rsi
mov qword [rsp + 0x1070], rdi
mov rdi, 0xffffffffffffffff
mov qword [rsp + 0x1068], r12
mov qword [rsp + 0x1060], r15
nop dword [rax]
inc rdi
cmp byte [r14 + rdi], bpl
jne 0x140004940
movsxd rax, dword [rsp + 0x8c]
lea rcx, [rsp + 0x50]
add rcx, rax
mov esi, ebp
movzx eax, word [rcx + 0x14]
lea r12, [rcx + 0x18]
movzx r15d, word [rcx + 6]
add r12, rax
test r15d, r15d
je 0x1400049a8
mov eax, esi
mov r8, rdi
mov rdx, r14
lea rcx, [rax + rax*4]
lea rbx, [r12 + rcx*8]
mov rcx, rbx
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
jne 0x1400049a1
mov rax, 0xffffffffffffffff
inc rax
cmp byte [rbx + rax], bpl
jne 0x140004993
cmp rdi, rax
je 0x140004a05
inc esi
cmp esi, r15d
jb 0x140004970
mov rdx, rbp
mov r12, qword [rsp + 0x1068]
mov rdi, qword [rsp + 0x1070]
mov rsi, qword [rsp + 0x10a8]
mov r15, qword [rsp + 0x1060]
mov rax, qword [rsp + 0x30]
mov r9, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x40]
mov r8d, ebp
mov qword [rsp + 0x20], rax
call fcn.1400047a0
mov rcx, qword [rsp + 0x1050]
xor rcx, rsp
call fcn.14000a9a0
add rsp, 0x1078
pop r14
pop r13
pop rbp
pop rbx
ret
mov eax, dword [rbx + 0xc]
test eax, eax
je 0x1400049a8
mov ecx, dword [rbx + 8]
lea rdx, [rsp + 0x50]
add rdx, rax
je 0x1400049a8
test ecx, ecx
je 0x1400049a8
lea rax, [rsp + 0x50]
mov ebp, ecx
sub rdx, rax
add rdx, r13
jmp 0x1400049ab

Function at 0x1400053d0
Capabilities:
Write file on windows

Disassembly:
push rbx
push rdi
push r15
sub rsp, 0x20
cmp qword [rcx + 0x68], 0
mov rbx, r8
mov r15, rdx
mov rdi, rcx
je 0x1400053f8
add rsp, 0x20
pop r15
pop rdi
pop rbx
jmp qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsputn_char_const____ptr64__long_long___int64_____ptr64]
mov rax, qword [rcx + 0x40]
mov qword [rsp + 0x40], rbp
mov qword [rsp + 0x48], rsi
mov rsi, rbx
mov qword [rsp + 0x58], r14
mov r9, qword [rax]
test r9, r9
je 0x14000541e
mov rax, qword [rcx + 0x58]
mov ecx, dword [rax]
jmp 0x140005420
xor ecx, ecx
movsxd rbp, ecx
test rbx, rbx
jle 0x140005479
test ecx, ecx
jle 0x140005459
cmp rbx, rbp
mov rcx, r9
cmovl rbp, rbx
mov r8, rbp
call sub.VCRUNTIME140.dll_memcpy
mov rax, qword [rdi + 0x58]
add r15, rbp
sub rbx, rbp
sub dword [rax], ebp
mov rcx, qword [rdi + 0x40]
movsxd rax, ebp
add qword [rcx], rax
test rbx, rbx
jle 0x140005479
mov r9, qword [rdi + 0x80]
test r9, r9
je 0x140005479
mov r8, rbx
mov edx, 1
mov rcx, r15
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
sub rbx, rax
mov r14, qword [rsp + 0x58]
sub rsi, rbx
mov rbp, qword [rsp + 0x40]
mov rax, rsi
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop r15
pop rdi
pop rbx
ret