joyce8/EMBER2024-capa huggingface dataset:
Function at 0x556b40
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x556c26
push rbp
mov rbp, rsp
sub rsp, 0x38
movabs rdx, 0x5e476f73615c4757
mov qword [rsp + 0x19], rdx
movabs rdx, 0x65593961725e476f
mov qword [rsp + 0x1e], rdx
movabs rdx, 0x8010600050a0b02
mov qword [rsp + 0x26], rdx
movabs rdx, 0x60608010600050a
mov qword [rsp + 0x28], rdx
movabs rdx, 0x70b070809050101
mov qword [rsp + 0x30], rdx
xor eax, eax
nop
jmp 0x556bc0
movzx r9d, byte [rsp + rsi + 0x19]
lea edx, [r9 + rdx]
lea edx, [rdx - 0xe]
mov byte [rsp + rdi + 0x19], dl
mov byte [rsp + rsi + 0x19], r8b
add rax, 2
nop dword [rax]
cmp rax, 0x12
jge 0x556bf2
movzx edx, byte [rsp + rax + 0x26]
movzx esi, byte [rsp + rax + 0x27]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0xd
jae 0x556c17
movzx r8d, byte [rsp + rdi + 0x19]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0xe]
cmp rsi, 0xd
jb 0x556ba2
jmp 0x556c0b
xor eax, eax
lea rbx, [rsp + 0x19]
mov ecx, 0xd
nop
call fcn.00443420
add rsp, 0x38
pop rbp
ret
mov eax, esi
mov ecx, 0xd
call fcn.00454ec0
mov eax, edi
mov ecx, 0xd
nop
call fcn.00454ec0
nop
call fcn.00452c40
jmp fcn.00556b40

Function at 0x557360
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x557432
push rbp
mov rbp, rsp
sub rsp, 0x38
movabs rdx, 0x3064725e7a725548
mov qword [rsp + 0x1d], rdx
movabs rdx, 0x735e736053306472
mov qword [rsp + 0x22], rdx
movabs rdx, 0x906000807000302
mov qword [rsp + 0x2a], rdx
movabs rdx, 0xb01080004070906
mov qword [rsp + 0x30], rdx
xor eax, eax
jmp 0x5573cc
movzx r9d, byte [rsp + rsi + 0x1d]
lea edx, [r9 + rdx]
lea edx, [rdx - 6]
mov byte [rsp + rdi + 0x1d], dl
mov byte [rsp + rsi + 0x1d], r8b
add rax, 2
cmp rax, 0xe
jge 0x5573fe
movzx edx, byte [rsp + rax + 0x2a]
movzx esi, byte [rsp + rax + 0x2b]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0xd
jae 0x557425
movzx r8d, byte [rsp + rdi + 0x1d]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 6]
cmp rsi, 0xd
jb 0x5573b2
jmp 0x557415
xor eax, eax
lea rbx, [rsp + 0x1d]
mov ecx, 0xd
call fcn.00443420
add rsp, 0x38
pop rbp
ret
mov eax, esi
mov ecx, 0xd
nop dword [rax]
call fcn.00454ec0
mov eax, edi
mov ecx, 0xd
call fcn.00454ec0
nop
call fcn.00452c40
jmp fcn.00557360
Function at 0x559720
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x55980a
push rbp
mov rbp, rsp
sub rsp, 0x48
movabs rdx, 0xeee25b375b4658c
mov qword [rsp + 0x30], rdx
movabs rdx, 0xbd6544c1c361180b
mov qword [rsp + 0x38], rdx
movabs rdx, 0x576f18c549b10fef
mov qword [rsp + 0x40], rdx
movabs rdx, 0xf15140c06111408
mov qword [rsp + 0x18], rdx
movabs rdx, 0x1107050004090510
mov qword [rsp + 0x20], rdx
movabs rdx, 0x41012110f0b0602
mov qword [rsp + 0x28], rdx
xor eax, eax
jmp 0x5597ad
movzx r9d, byte [rsp + rsi + 0x30]
sub r9d, edx
lea edx, [r9 - 0x37]
mov byte [rsp + rdi + 0x30], dl
lea edx, [r8 - 0x37]
mov byte [rsp + rsi + 0x30], dl
add rax, 2
cmp rax, 0x18
jge 0x5597da
movzx edx, byte [rsp + rax + 0x18]
movzx esi, byte [rsp + rax + 0x19]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x18
jae 0x5597fd
movzx r8d, byte [rsp + rdi + 0x30]
sub r8d, edx
cmp rsi, 0x18
jb 0x559790
jmp 0x5597f1
xor eax, eax
lea rbx, [rsp + 0x30]
mov ecx, 0x18
call fcn.00443420
add rsp, 0x48
pop rbp
ret
mov eax, esi
mov ecx, 0x18
call fcn.00454ec0
mov eax, edi
mov ecx, 0x18
call fcn.00454ec0
nop
call fcn.00452c40
jmp fcn.00559720

Function at 0x559820
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x55992c
push rbp
mov rbp, rsp
sub rsp, 0x58
movabs rdx, 0x494444fd75f42e53
mov qword [rsp + 0x1e], rdx
movabs rdx, 0xb54793672393a65
mov qword [rsp + 0x26], rdx
movabs rdx, 0x5f63364e0b547936
mov qword [rsp + 0x2a], rdx
movabs rdx, 0x4d73551b0f66f51e
mov qword [rsp + 0x32], rdx
movabs rdx, 0xa190f0113110417
mov qword [rsp + 0x3a], rdx
movabs rdx, 0x2100e04130c0f15
mov qword [rsp + 0x42], rdx
movabs rdx, 0x1b19070107100210
mov qword [rsp + 0x48], rdx
movabs rdx, 0x181409061707070f
mov qword [rsp + 0x50], rdx
xor eax, eax
jmp 0x5598c8
movzx r9d, byte [rsp + rsi + 0x1e]
lea edx, [r9 + rdx]
lea edx, [rdx + 6]
mov byte [rsp + rdi + 0x1e], dl
mov byte [rsp + rsi + 0x1e], r8b
add rax, 2
cmp rax, 0x1e
jge 0x5598fc
movzx edx, byte [rsp + rax + 0x3a]
movzx esi, byte [rsp + rax + 0x3b]
mov edi, edx
xor edx, esi
add edx, eax
nop
cmp rdi, 0x1c
jae 0x55991f
movzx r8d, byte [rsp + rdi + 0x1e]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 6]
cmp rsi, 0x1c
jb 0x5598ae
jmp 0x559913
xor eax, eax
lea rbx, [rsp + 0x1e]
mov ecx, 0x1c
call fcn.00443420
add rsp, 0x58
pop rbp
ret
mov eax, esi
mov ecx, 0x1c
call fcn.00454ec0
mov eax, edi
mov ecx, 0x1c
call fcn.00454ec0
nop
call fcn.00452c40
jmp fcn.00559820
Function at 0x559fe0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x55a0ec
push rbp
mov rbp, rsp
sub rsp, 0x58
movabs rdx, 0xb6694470757410fd
mov qword [rsp + 0x1d], rdx
movabs rdx, 0xd4730efd6c437465
mov qword [rsp + 0x25], rdx
movabs rdx, 0x9d6143c8e7d4730e
mov qword [rsp + 0x2a], rdx
movabs rdx, 0x57223f1a5761161f
mov qword [rsp + 0x32], rdx
movabs rdx, 0x150c1018180710
mov qword [rsp + 0x3a], rdx
movabs rdx, 0x121b0f140707161b
mov qword [rsp + 0x42], rdx
movabs rdx, 0x1a15010f111a121b
mov qword [rsp + 0x48], rdx
movabs rdx, 0x140c190115100d07
mov qword [rsp + 0x50], rdx
xor eax, eax
jmp 0x55a088
movzx r9d, byte [rsp + rsi + 0x1d]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x19]
mov byte [rsp + rdi + 0x1d], dl
mov byte [rsp + rsi + 0x1d], r8b
add rax, 2
cmp rax, 0x1e
jge 0x55a0bc
movzx edx, byte [rsp + rax + 0x3a]
movzx esi, byte [rsp + rax + 0x3b]
mov edi, edx
xor edx, esi
add edx, eax
nop
cmp rdi, 0x1d
jae 0x55a0df
movzx r8d, byte [rsp + rdi + 0x1d]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x19]
cmp rsi, 0x1d
jb 0x55a06e
jmp 0x55a0d3
xor eax, eax
lea rbx, [rsp + 0x1d]
mov ecx, 0x1d
call fcn.00443420
add rsp, 0x58
pop rbp
ret
mov eax, esi
mov ecx, 0x1d
call fcn.00454ec0
mov eax, edi
mov ecx, 0x1d
call fcn.00454ec0
nop
call fcn.00452c40
jmp fcn.00559fe0

Function at 0x55a5a0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x55a6a8
push rbp
mov rbp, rsp
sub rsp, 0x50
movabs rdx, 0xea69f2dd84fd6502
mov qword [rsp + 0x19], rdx
movabs rdx, 0x1294690c65330e65
mov qword [rsp + 0x21], rdx
movabs rdx, 0x3f6491294690c65
mov qword [rsp + 0x24], rdx
movabs rdx, 0x570d04db986ed0f4
mov qword [rsp + 0x2c], rdx
movabs rdx, 0x41807140e130509
mov qword [rsp + 0x34], rdx
movabs rdx, 0x31719020516170a
mov qword [rsp + 0x3c], rdx
movabs rdx, 0x12030f1303171902
mov qword [rsp + 0x40], rdx
movabs rdx, 0x1116050c030c1700
mov qword [rsp + 0x48], rdx
xor eax, eax
jmp 0x55a64b
movzx r9d, byte [rsp + rsi + 0x19]
sub r9d, edx
lea edx, [r9 - 0x72]
mov byte [rsp + rdi + 0x19], dl
lea edx, [r8 - 0x72]
mov byte [rsp + rsi + 0x19], dl
add rax, 2
cmp rax, 0x1c
jge 0x55a678
movzx edx, byte [rsp + rax + 0x34]
movzx esi, byte [rsp + rax + 0x35]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x1b
jae 0x55a69b
movzx r8d, byte [rsp + rdi + 0x19]
sub r8d, edx
cmp rsi, 0x1b
jb 0x55a62e
jmp 0x55a68f
xor eax, eax
lea rbx, [rsp + 0x19]
mov ecx, 0x1b
call fcn.00443420
add rsp, 0x50
pop rbp
ret
mov eax, esi
mov ecx, 0x1b
call fcn.00454ec0
mov eax, edi
mov ecx, 0x1b
call fcn.00454ec0
nop
call fcn.00452c40
jmp fcn.0055a5a0
Function at 0x55ac80
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x55ad88
push rbp
mov rbp, rsp
sub rsp, 0x50
movabs rdx, 0x8e00ce70a2f6e7fb
mov qword [rsp + 0x19], rdx
movabs rdx, 0x720e76d47b448de8
mov qword [rsp + 0x21], rdx
movabs rdx, 0x666ee3720e76d47b
mov qword [rsp + 0x24], rdx
movabs rdx, 0xf5f869cbda824499
mov qword [rsp + 0x2c], rdx
movabs rdx, 0x715011a0b081600
mov qword [rsp + 0x34], rdx
movabs rdx, 0x1913090610170707
mov qword [rsp + 0x3c], rdx
movabs rdx, 0x1508031919130906
mov qword [rsp + 0x40], rdx
movabs rdx, 0x190e02060c050705
mov qword [rsp + 0x48], rdx
xor eax, eax
jmp 0x55ad2b
movzx r9d, byte [rsp + rsi + 0x19]
sub r9d, edx
lea edx, [r9 - 0x71]
mov byte [rsp + rdi + 0x19], dl
lea edx, [r8 - 0x71]
mov byte [rsp + rsi + 0x19], dl
add rax, 2
cmp rax, 0x1c
jge 0x55ad58
movzx edx, byte [rsp + rax + 0x34]
movzx esi, byte [rsp + rax + 0x35]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x1b
jae 0x55ad7b
movzx r8d, byte [rsp + rdi + 0x19]
sub r8d, edx
cmp rsi, 0x1b
jb 0x55ad0e
jmp 0x55ad6f
xor eax, eax
lea rbx, [rsp + 0x19]
mov ecx, 0x1b
call fcn.00443420
add rsp, 0x50
pop rbp
ret
mov eax, esi
mov ecx, 0x1b
call fcn.00454ec0
mov eax, edi
mov ecx, 0x1b
call fcn.00454ec0
nop
call fcn.00452c40
jmp fcn.0055ac80

Function at 0x55c400
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x55c4fb
push rbp
mov rbp, rsp
sub rsp, 0x48
movabs rdx, 0xf22bf874653948ed
mov qword [rsp + 0x18], rdx
movabs rdx, 0x6fa06ee2f22bf874
mov qword [rsp + 0x1c], rdx
movabs rdx, 0xc37461f0e7890f32
mov qword [rsp + 0x24], rdx
movabs rdx, 0xc0e101307101013
mov qword [rsp + 0x2c], rdx
movabs rdx, 0x208000d070f020a
mov qword [rsp + 0x34], rdx
movabs rdx, 0x70c0c0a0208000d
mov qword [rsp + 0x38], rdx
movabs rdx, 0x20706060d080a05
mov qword [rsp + 0x40], rdx
xor eax, eax
jmp 0x55c499
movzx r9d, byte [rsp + rsi + 0x18]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x2b]
mov byte [rsp + rdi + 0x18], dl
mov byte [rsp + rsi + 0x18], r8b
add rax, 2
cmp rax, 0x1c
jge 0x55c4cb
movzx edx, byte [rsp + rax + 0x2c]
movzx esi, byte [rsp + rax + 0x2d]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x14
jae 0x55c4ee
movzx r8d, byte [rsp + rdi + 0x18]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x2b]
cmp rsi, 0x14
jb 0x55c47f
jmp 0x55c4e2
xor eax, eax
lea rbx, [rsp + 0x18]
mov ecx, 0x14
call fcn.00443420
add rsp, 0x48
pop rbp
ret
mov eax, esi
mov ecx, 0x14
call fcn.00454ec0
mov eax, edi
mov ecx, 0x14
call fcn.00454ec0
nop
nop dword [rax + rax]
call fcn.00452c40
jmp fcn.0055c400
Function at 0x55d280
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x55d366
push rbp
mov rbp, rsp
sub rsp, 0x40
movabs rdx, 0xf8512a4b7b20406
mov qword [rsp + 0x1e], rdx
movabs rdx, 0x776fa96e6f570f85
mov qword [rsp + 0x24], rdx
movabs rdx, 0x707030304040907
mov qword [rsp + 0x2c], rdx
movabs rdx, 0xb01070207070303
mov qword [rsp + 0x30], rdx
movabs rdx, 0x100060103040705
mov qword [rsp + 0x38], rdx
xor eax, eax
nop
jmp 0x55d300
movzx r9d, byte [rsp + rsi + 0x1e]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x4c]
mov byte [rsp + rdi + 0x1e], dl
mov byte [rsp + rsi + 0x1e], r8b
add rax, 2
nop dword [rax]
cmp rax, 0x14
jge 0x55d332
movzx edx, byte [rsp + rax + 0x2c]
movzx esi, byte [rsp + rax + 0x2d]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0xe
jae 0x55d357
movzx r8d, byte [rsp + rdi + 0x1e]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x4c]
cmp rsi, 0xe
jb 0x55d2e2
jmp 0x55d34b
xor eax, eax
lea rbx, [rsp + 0x1e]
mov ecx, 0xe
nop
call fcn.00443420
add rsp, 0x40
pop rbp
ret
mov eax, esi
mov ecx, 0xe
call fcn.00454ec0
mov eax, edi
mov ecx, 0xe
nop
call fcn.00454ec0
nop
call fcn.00452c40
jmp fcn.0055d280

Function at 0x55d800
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x55d8e6
push rbp
mov rbp, rsp
sub rsp, 0x40
movabs rdx, 0x77c7646eb75773e2
mov qword [rsp + 0x1d], rdx
movabs rdx, 0x234062ee73d05477
mov qword [rsp + 0x24], rdx
movabs rdx, 0x6030003000d0b0b
mov qword [rsp + 0x2c], rdx
movabs rdx, 0x809080006030003
mov qword [rsp + 0x30], rdx
movabs rdx, 0x6000e0600090003
mov qword [rsp + 0x38], rdx
xor eax, eax
nop
jmp 0x55d880
movzx r9d, byte [rsp + rsi + 0x1d]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x7b]
mov byte [rsp + rdi + 0x1d], dl
mov byte [rsp + rsi + 0x1d], r8b
add rax, 2
nop dword [rax]
cmp rax, 0x14
jge 0x55d8b2
movzx edx, byte [rsp + rax + 0x2c]
movzx esi, byte [rsp + rax + 0x2d]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0xf
jae 0x55d8d7
movzx r8d, byte [rsp + rdi + 0x1d]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x7b]
cmp rsi, 0xf
jb 0x55d862
jmp 0x55d8cb
xor eax, eax
lea rbx, [rsp + 0x1d]
mov ecx, 0xf
nop
call fcn.00443420
add rsp, 0x40
pop rbp
ret
mov eax, esi
mov ecx, 0xf
call fcn.00454ec0
mov eax, edi
mov ecx, 0xf
nop
call fcn.00454ec0
nop
call fcn.00452c40
jmp fcn.0055d800
Function at 0x5601e0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x5602ac
push rbp
mov rbp, rsp
sub rsp, 0x38
movabs rdx, 0x6276725673f5652c
mov qword [rsp + 0x1b], rdx
movabs rdx, 0x65fee59089627672
mov qword [rsp + 0x20], rdx
movabs rdx, 0x90400090a0a080b
mov qword [rsp + 0x28], rdx
movabs rdx, 0xb04020402000900
mov qword [rsp + 0x30], rdx
xor eax, eax
jmp 0x56024f
movzx r9d, byte [rsp + rsi + 0x1b]
sub r9d, edx
lea edx, [r9 + 0x7e]
mov byte [rsp + rdi + 0x1b], dl
lea edx, [r8 + 0x7e]
mov byte [rsp + rsi + 0x1b], dl
add rax, 2
cmp rax, 0x10
jge 0x56027c
movzx edx, byte [rsp + rax + 0x28]
movzx esi, byte [rsp + rax + 0x29]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0xd
jae 0x56029f
movzx r8d, byte [rsp + rdi + 0x1b]
sub r8d, edx
cmp rsi, 0xd
jb 0x560232
jmp 0x560293
xor eax, eax
lea rbx, [rsp + 0x1b]
mov ecx, 0xd
call fcn.00443420
add rsp, 0x38
pop rbp
ret
mov eax, esi
mov ecx, 0xd
call fcn.00454ec0
mov eax, edi
mov ecx, 0xd
call fcn.00454ec0
nop
call fcn.00452c40
jmp fcn.005601e0

Function at 0x5610a0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x56118c
push rbp
mov rbp, rsp
sub rsp, 0x48
movabs rdx, 0x2e374375fbbde957
mov qword [rsp + 0x1f], rdx
movabs rdx, 0xe72e374375fbbde9
mov qword [rsp + 0x20], rdx
movabs rdx, 0x16652a6fdf72082f
mov qword [rsp + 0x28], rdx
movabs rdx, 0x100c0e0302060103
mov qword [rsp + 0x30], rdx
movabs rdx, 0x10a0a060c090606
mov qword [rsp + 0x38], rdx
movabs rdx, 0x5060a07100e0810
mov qword [rsp + 0x40], rdx
xor eax, eax
jmp 0x56112a
movzx r9d, byte [rsp + rsi + 0x1f]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x16]
mov byte [rsp + rdi + 0x1f], dl
mov byte [rsp + rsi + 0x1f], r8b
add rax, 2
cmp rax, 0x18
jge 0x56115c
movzx edx, byte [rsp + rax + 0x30]
movzx esi, byte [rsp + rax + 0x31]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x11
jae 0x56117f
movzx r8d, byte [rsp + rdi + 0x1f]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x16]
cmp rsi, 0x11
jb 0x561110
jmp 0x561173
xor eax, eax
lea rbx, [rsp + 0x1f]
mov ecx, 0x11
call fcn.00443420
add rsp, 0x48
pop rbp
ret
mov eax, esi
mov ecx, 0x11
call fcn.00454ec0
mov eax, edi
mov ecx, 0x11
call fcn.00454ec0
nop
call fcn.00452c40
jmp fcn.005610a0
Function at 0x574b20
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x574bf8
push rbp
mov rbp, rsp
sub rsp, 0x38
movabs rdx, 0x321f1c7019286423
mov qword [rsp + 0x1a], rdx
mov dword [rsp + 0x22], 0x89e3bd2e
movabs rdx, 0x5060a0006060b
mov qword [rsp + 0x26], rdx
movabs rdx, 0x9000005060a0006
mov qword [rsp + 0x28], rdx
movabs rdx, 0x302020903030a
mov qword [rsp + 0x30], rdx
xor eax, eax
jmp 0x574b94
movzx r9d, byte [rsp + rsi + 0x1a]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x40]
mov byte [rsp + rdi + 0x1a], dl
mov byte [rsp + rsi + 0x1a], r8b
add rax, 2
cmp rax, 0x12
jge 0x574bc8
movzx edx, byte [rsp + rax + 0x26]
movzx esi, byte [rsp + rax + 0x27]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0xc
jae 0x574beb
movzx r8d, byte [rsp + rdi + 0x1a]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x40]
nop
cmp rsi, 0xc
jb 0x574b7a
jmp 0x574bdf
xor eax, eax
lea rbx, [rsp + 0x1a]
mov ecx, 0xc
call fcn.00443420
add rsp, 0x38
pop rbp
ret
mov eax, esi
mov ecx, 0xc
call fcn.00454ec0
mov eax, edi
mov ecx, 0xc
call fcn.00454ec0
nop
call fcn.00452c40
nop dword [rax]
jmp fcn.00574b20
Function at 0x1400138c0
Capabilities:
Terminate process

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
mov edx, 0xc0000409
add rsp, 0x20
pop rbx
jmp qword [sym.imp.KERNEL32.dll_TerminateProcess]
Function at 0x1416cf000
Capabilities:
Decompress data using aplib

Disassembly:
jmp 0x1416cf00a
jmp 0x1416d100f
jmp fcn.140f8f058
Function at 0x140006060
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov edi, r8d
mov rsi, rdx
mov rbp, rcx
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
jne 0x140006093
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
mov rcx, rax
mov qword [rsp + 0x30], rbx
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rbx, rax
test rax, rax
je 0x1400060da
mov rdx, rsi
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, eax
add rcx, rbx
and edi, 0xf
jbe 0x1400060d5
nop
cmp rbx, rcx
jae 0x1400060da
movzx eax, word [rbx]
lea rbx, [rbx + rax*2]
add rbx, 2
add edi, 0xffffffff
jne 0x1400060c0
cmp rbx, rcx
jb 0x1400060de
xor eax, eax
jmp 0x1400060ea
xor eax, eax
cmp word [rbx], ax
cmove rbx, rax
mov rax, rbx
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret

Function at 0x140007880
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x58
cmp byte [rcx + 8], 0
mov r9, rcx
je 0x1400078bb
xor ecx, ecx
cmp dword [r9 + 0x3d0], ecx
jle 0x1400078b6
sub r8, rdx
nop dword [rax + rax]
movzx eax, byte [r8 + rdx]
inc ecx
xor byte [rdx], al
lea rdx, [rdx + 1]
cmp ecx, dword [r9 + 0x3d0]
jl 0x1400078a0
add rsp, 0x58
ret
lea rax, vtable.std::exception.0
mov byte [rsp + 0x28], 1
mov qword [rsp + 0x30], rax
lea rdx, [rsp + 0x38]
xor eax, eax
lea rcx, [rsp + 0x20]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x40], rax
lea rax, str.Object_not_Initialized
mov qword [rsp + 0x20], rax
call fcn.14004ea70
lea rdx, [0x1400b17f8]
lea rcx, [rsp + 0x30]
call fcn.14004efe4
int3

Function at 0x1400088c0
Capabilities:
Initialize winsock library

Disassembly:
sub rsp, 0x1d8
mov rax, qword [0x1400bfbc8]
xor rax, rsp
mov qword [rsp + 0x1c0], rax
mov ecx, 0x202
lea rdx, [rsp + 0x20]
call qword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
jne 0x140008921
movzx eax, word [rsp + 0x20]
cmp al, 2
jne 0x14000891b
shr ax, 8
cmp al, 2
jne 0x14000891b
call fcn.14000de80
mov rcx, qword [rsp + 0x1c0]
xor rcx, rsp
call fcn.14004bcc0
add rsp, 0x1d8
ret
call qword [sym.imp.WS2_32.dll_WSACleanup]
mov eax, 2
mov rcx, qword [rsp + 0x1c0]
xor rcx, rsp
call fcn.14004bcc0
add rsp, 0x1d8
ret

Function at 0x14000ede0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp dword [rcx + 4], 2
mov rax, rdx
je 0x14000edec
xor eax, eax
ret
mov rdx, qword [rcx + 0x20]
mov r9, r8
add rdx, 4
mov r8, rax
mov ecx, 2
jmp fcn.140029530
Function at 0x140010290
Capabilities:
Generate random numbers via winapi

Disassembly:
mov rcx, rdx
mov rdx, r8
jmp 0x140029a30
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
mov rbx, rdx
mov qword [rsp + 0x50], 0
mov rdi, rcx
mov dword [rsp + 0x20], 0xf0000040
xor edx, edx
lea rcx, [rsp + 0x50]
mov r9d, 1
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
test eax, eax
je 0x140029a8c
mov rcx, qword [rsp + 0x50]
mov r8, rdi
mov edx, ebx
call qword [sym.imp.ADVAPI32.dll_CryptGenRandom]
mov rcx, qword [rsp + 0x50]
xor edx, edx
test eax, eax
jne 0x140029a9c
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov eax, 2
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov rbx, qword [rsp + 0x40]
xor eax, eax
add rsp, 0x30
pop rdi
ret
Function at 0x1400195b0
Capabilities:
Receive data
Receive data on socket

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, r9
xor r9d, r9d
call qword [sym.imp.WS2_32.dll_recv]
movsxd rcx, eax
cmp rcx, 0xffffffffffffffff
jne 0x1400195eb
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov ecx, gethostname
mov edx, 0x51
cmp eax, 0x2733
cmove ecx, edx
mov eax, ecx
add rsp, 0x20
pop rbx
ret
mov qword [rbx], rcx
xor eax, eax
add rsp, 0x20
pop rbx
ret

Function at 0x1400196d0
Capabilities:
Send data
Send data on socket

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push r14
sub rsp, 0x20
movsxd rax, edx
mov rdi, r9
mov rsi, r8
mov r14, rcx
mov rbx, qword [rcx + rax*8 + 0x238]
call fcn.140019aa0
xor r9d, r9d
mov r8d, edi
mov rdx, rsi
mov rcx, rbx
call qword [sym.imp.WS2_32.dll_send]
mov rsi, qword [rsp + 0x50]
movsxd rdi, eax
mov dword [rsi], 0
cmp rdi, 0xffffffffffffffff
jne 0x140019768
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov ebx, eax
cmp eax, 0x2733
jne 0x14001973d
mov dword [rsi], 0x51
xor eax, eax
jmp 0x14001976b
mov edx, ebx
mov rcx, r14
call fcn.140028640
mov rcx, qword [r14]
lea rdx, str.Send_failure:__s
mov r8, rax
call fcn.1400192a0
mov rcx, qword [r14]
mov dword [rcx + 0x4ac4], ebx
mov dword [rsi], gethostname
mov rax, rdi
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x40]
add rsp, 0x20
pop r14
ret

Function at 0x140019aa0
Capabilities:
Receive data
Receive data on socket

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov rsi, rcx
movsxd rcx, edx
mov rax, qword [rsi + 0x598]
lea rbx, [rcx + 0x14]
mov rbp, qword [rsi + rcx*8 + 0x238]
shl rbx, 5
add rbx, rsi
mov rdi, qword [rbx + 8]
sub rdi, qword [rbx + 0x10]
test byte [rax + 0x7c], 3
je 0x140019b7c
lea rax, [0x140019600]
cmp qword [rsi + rcx*8 + 0x260], rax
jne 0x140019b7c
cmp qword [rbx], 0
je 0x140019b06
test rdi, rdi
je 0x140019b7c
or r8, 0xffffffffffffffff
xor r9d, r9d
or rdx, r8
mov rcx, rbp
call fcn.1400188e0
cmp eax, 0xffffffff
je 0x140019b7c
test al, 1
je 0x140019b7c
cmp qword [rbx], 0
jne 0x140019b5b
mov rax, qword [rsi]
mov ecx, dword [rax + 0x540]
add ecx, ecx
movsxd rcx, ecx
mov qword [rbx + 8], rcx
call qword [section..data]
mov rdi, qword [rbx + 8]
xor ecx, ecx
mov qword [rbx], rax
mov qword [rbx + 0x10], rcx
mov qword [rbx + 0x18], rcx
test rax, rax
jne 0x140019b5b
mov qword [rbx + 8], rcx
jmp 0x140019b7c
mov rdx, qword [rbx]
xor r9d, r9d
add rdx, qword [rbx + 0x10]
mov r8d, edi
mov rcx, rbp
call qword [sym.imp.WS2_32.dll_recv]
movsxd rcx, eax
test eax, eax
jle 0x140019b7c
add qword [rbx + 0x10], rcx
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x140019d70
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
mov r10, qword [rcx + 0x2b8]
mov rdi, r9
mov rsi, r8
mov rbx, rcx
test r10, r10
je 0x140019db3
mov rax, qword [rcx + 0x208]
mov qword [rsp + 0x20], rax
call r10
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
cmp edx, 2
ja 0x140019df6
mov r9, qword [rbx + 0x200]
movsxd rcx, edx
lea rdx, [0x14008dad8]
lea rcx, [rcx + rcx*2]
add rcx, rdx
mov edx, 2
lea r8d, [rdx - 1]
call fcn.1400543a8
mov r9, qword [rbx + 0x200]
mov r8d, 1
mov rdx, rdi
mov rcx, rsi
call fcn.1400543a8
mov rbx, qword [rsp + 0x40]
xor eax, eax
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret

Function at 0x14001a560
Capabilities:
Receive data
Receive data on socket

Disassembly:
sub rsp, 0x28
cmp byte [rcx + 0x2c0], 0
je 0x14001a57d
call fcn.14000fb10
test eax, eax
jne 0x14001a5a8
xor al, al
add rsp, 0x28
ret
mov rcx, qword [rcx + 0x238]
cmp rcx, 0xffffffffffffffff
je 0x14001a576
mov r9d, 2
lea rdx, [rsp + 0x30]
lea r8d, [r9 - 1]
call qword [sym.imp.WS2_32.dll_recv]
test eax, eax
jne 0x14001a5a8
add rsp, 0x28
ret
mov al, 1
add rsp, 0x28
ret