joyce8/EMBER2024-capa huggingface dataset:
Function at 0x45fd60
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x10
mov qword [rsp + 0x20], rax
test rbx, rbx
jbe 0x45fed7
movzx edx, byte [rax]
test edx, edx
jne 0x45fd94
nop dword [rax]
test r8b, r8b
jne 0x45fd94
xor eax, eax
xor ebx, ebx
mov rcx, rbx
xor edi, edi
add rsp, 0x10
pop rbp
ret
bt edx, 7
jae 0x45fda7
xor edx, edx
xor r8d, r8d
xor r9d, r9d
jmp 0x45fe97
mov r8d, 1
mov r9d, edx
and edx, 1
neg edx
shr r9d, 1
xor edx, r9d
add dword [rsi], edx
nop dword [rax]
cmp rbx, r8
jb 0x45fe85
sub rbx, r8
sub rcx, r8
mov rdx, rcx
neg rdx
sar rdx, 0x3f
and r8, rdx
lea rdx, [rax + r8]
test rbx, rbx
jbe 0x45fe77
movzx esi, byte [rax + r8]
bt esi, 7
jae 0x45fdfd
xor eax, eax
xor esi, esi
xor r8d, r8d
jmp 0x45fe40
mov eax, 1
cmp rax, rbx
ja 0x45fe2b
add qword [rdi], rsi
sub rcx, rax
sub rbx, rax
mov rsi, rcx
neg rsi
sar rsi, 0x3f
and rax, rsi
add rax, rdx
mov edi, 1
add rsp, 0x10
pop rbp
ret
mov rcx, rbx
call fcn.00464d60
lea r8d, [rcx + 7]
mov rcx, r11
mov eax, r12d
nop dword [rax]
cmp rax, rbx
jae 0x45fe6f
movzx r9d, byte [rax + rdx]
mov r10d, r9d
and r9d, 0x7f
mov r11, rcx
mov ecx, r8d
shl r9d, cl
lea r12d, [rax + 1]
or esi, r9d
test r10b, 0x80
jne 0x45fe33
mov rcx, r11
mov eax, r12d
jmp 0x45fe02
mov rcx, rbx
call fcn.00464ca0
xor eax, eax
mov rcx, rax
nop dword [rax]
call fcn.00464ca0
mov eax, r8d
mov rcx, rbx
call fcn.00464d60
lea r9d, [rcx + 7]
mov rcx, r12
cmp rbx, rdx
jbe 0x45fecd
movzx r10d, byte [rdx + rax]
mov r11d, r10d
and r10d, 0x7f
mov r12, rcx
mov ecx, r9d
shl r10d, cl
inc edx
or r8d, r10d
test r11b, 0x80
jne 0x45fe90
mov rcx, r12
mov r9d, edx
mov edx, r8d
mov r8d, r9d
jmp 0x45fdad
mov eax, edx
mov rcx, rbx
call fcn.00464ca0
xor eax, eax
mov rcx, rax
nop dword [rax]
call fcn.00464ca0
nop
int3

Function at 0x461320
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4613cf
push rbp
mov rbp, rsp
sub rsp, 0x58
mov qword [rsp + 0x70], rbx
lea rdx, [rsp + 0x68]
mov qword [rsp + 8], 0
movups xmmword [rsp + 0x10], xmm15
movups xmmword [rsp + 0x18], xmm15
movups xmmword [rsp + 0x28], xmm15
movups xmmword [rsp + 0x38], xmm15
movups xmmword [rsp + 0x48], xmm15
lea rsi, [0x00451420]
mov qword [rsp + 0x10], rsi
mov rsi, qword [rsp + 0x60]
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdx
mov rdx, r14
mov qword [rsp + 0x28], rdx
lea rdx, [rsp + 8]
mov qword [rsp + 0x30], rdx
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x48], rcx
mov qword [rsp + 0x50], rdi
mov qword [rsp + 0x40], rbx
lea rax, [rsp + 0x10]
mov qword [rsp], rax
call fcn.00462900
xorps xmm15, xmm15
mov r14, qword [0x00545dd0]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 8]
add rsp, 0x58
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
call fcn.00462a20
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
nop dword [rax]
jmp fcn.00461320
Function at 0x4665e0
Capabilities:
Allocate thread local storage

Disassembly:
push rbp
mov rbp, rsp
mov rax, rsp
and rsp, 0xfffffffffffffff0
sub rsp, 0x30
mov qword [rsp + 0x20], rax
mov rax, qword [sym.imp.kernel32.dll_TlsAlloc]
call rax
mov rsp, qword [rsp + 0x20]
mov rcx, rax
cmp rcx, 0x40
jb 0x466614
mov rcx, 0x28
jmp 0x46661f
shl rcx, 3
add rcx, 0x1480
mov qword [0x00545dd0], rcx
pop rbp
ret

Function at 0x46d9a0
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x46da6a
push rbp
mov rbp, rsp
sub rsp, 0x48
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rbx
mov qword [rsp], rax
mov qword [rsp + 8], rbx
mov byte [rsp + 0x10], 0
call fcn.00402940
xorps xmm15, xmm15
mov r14, qword [0x00545dd0]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x18], 0xffffffffffffffff
jne 0x46da4f
mov rcx, qword [rsp + 0x60]
lea rdx, [rcx + 1]
mov qword [rsp + 0x40], rdx
lea rax, [0x00475a40]
xor ebx, ebx
mov rcx, rdx
call fcn.0045e7c0
mov rbx, qword [rsp + 0x60]
mov rcx, rax
xor edi, edi
mov rsi, qword [rsp + 0x40]
mov rax, qword [rsp + 0x58]
nop dword [rax]
call fcn.0046dd00
inc rbx
cmp rcx, rbx
jae 0x46da3e
mov edi, 1
lea rsi, [0x00475a40]
call fcn.0045e8a0
mov word [rax + rbx*2 - 2], 0
xor edi, edi
xor esi, esi
add rsp, 0x48
pop rbp
ret
xor eax, eax
xor ebx, ebx
mov rcx, rbx
lea rdi, [0x004a22a8]
lea rsi, [0x004a2058]
add rsp, 0x48
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.00462a20
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.0046d9a0
Function at 0x18000c710
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x20
lea rdx, [0x180019fa4]
lea rcx, str.C:WindowsFontsArial.ttf
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fopen]
xor edx, edx
mov r8d, 2
mov rcx, rax
mov rbx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
xor r8d, r8d
xor edx, edx
mov rcx, rbx
movsxd rdi, eax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
test edi, edi
jg 0x18000c776
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
xor eax, eax
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
mov qword [rsp + 0x30], rsi
mov rcx, rdi
mov rsi, rdi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov rdi, rax
test rax, rax
je 0x18000c7c4
mov r9, rbx
mov r8, rsi
mov edx, 1
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
cmp rax, rsi
jne 0x18000c7c4
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov rsi, qword [rsp + 0x30]
mov rax, rdi
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov rsi, qword [rsp + 0x30]
xor eax, eax
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x180013fc0
Capabilities:
Create thread

Disassembly:
sub rsp, 0x38
cmp edx, 1
jne 0x180013fe8
xor eax, eax
lea r8, [0x180012d70]
mov qword [rsp + 0x28], rax
xor r9d, r9d
xor edx, edx
mov dword [rsp + 0x20], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov eax, 1
add rsp, 0x38
ret
Function at 0x140002640
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14000268a
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14000268a
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14000268a
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14000268a
cmp dword [rcx + 0x84], 0xe
jbe 0x14000268a
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x14000268c
xor al, al
add rsp, 0x28
ret
Function at 0x140002128
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140002172
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140002172
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140002172
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140002172
cmp dword [rcx + 0x84], 0xe
jbe 0x140002172
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140002174
xor al, al
add rsp, 0x28
ret
Function at 0x140004390
Capabilities:
Get common file path

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x478
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x3f0], 0xfffffffffffffffe
mov qword [rbp + 0x3d0], rcx
mov qword [rbp + 0x3d8], 0
mov qword [rbp + 0x3e0], 2
mov qword [rbp + 0x3e8], 0
mov r8d, 0x200
mov eax, 2
mov qword [rbp + 0x3c8], rax
xor esi, esi
xor edi, edi
xor ebx, ebx
cmp r8, 0x201
jae 0x140004430
jmp 0x14000441f
jae 0x1400044fe
cmp r8, 0x201
jae 0x140004430
mov r14d, 0x200
lea r15, [rbp - 0x58]
mov r12, r8
jmp 0x140004496
sub r8, rbx
sub rdi, rbx
cmp rdi, r8
jae 0x14000446e
mov qword [rsp + 0x20], 2
mov r9d, 2
lea rcx, [rbp + 0x3d8]
mov rdx, rbx
call fcn.14001d020
mov rsi, qword [rbp + 0x3d8]
mov rax, qword [rbp + 0x3e0]
mov qword [rbp + 0x3c8], rax
mov eax, 0xffffffff
cmp rsi, rax
mov ebx, 0xffffffff
cmovb rbx, rsi
mov qword [rbp + 0x3e8], rbx
mov rdi, rsi
mov r14, rbx
mov r15, qword [rbp + 0x3c8]
mov r12, rbx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov ecx, r12d
mov rdx, r15
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
mov r13d, eax
test eax, eax
jne 0x1400044bf
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x14000456a
mov r8d, r13d
cmp r12, r8
jne 0x140004410
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x14000459e
add r12, r12
mov eax, 0xffffffff
cmp r12, rax
cmovae r12, rax
mov r8, r12
cmp r8, 0x201
jb 0x14000441f
jmp 0x140004430
cmp r14, r8
jb 0x1400045b8
lea rcx, [rbp + 0x3a8]
mov rdx, r15
call fcn.140007160
movups xmm0, xmmword [rbp + 0x3a8]
movups xmm1, xmmword [rbp + 0x3b8]
mov rsi, qword [rbp + 0x3d0]
movups xmmword [rsi + 0x10], xmm1
movups xmmword [rsi], xmm0
mov rdx, qword [rbp + 0x3d8]
test rdx, rdx
je 0x140004553
mov rcx, qword [rbp + 0x3e0]
add rdx, rdx
mov r8d, 2
call fcn.140001f70
mov rax, rsi
add rsp, 0x478
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
shl rax, 0x20
or rax, 2
mov rsi, qword [rbp + 0x3d0]
mov qword [rsi + 8], rax
movabs rax, 0x8000000000000000
mov qword [rsi], rax
mov rdx, qword [rbp + 0x3d8]
test rdx, rdx
jne 0x14000453e
jmp 0x140004553
lea rcx, [0x145cbf0e0]
lea r8, [0x145cc0ee0]
mov edx, 0x28
call fcn.14001dac0
jmp 0x1400045cd
lea rax, [0x145cc0ec8]
mov rcx, r8
mov rdx, r14
mov r8, rax
call fcn.14001de70
ud2
Function at 0x140004dd0
Capabilities:
Create directory

Disassembly:
push rbp
mov rbp, rsp
cmp byte [rcx], 0
je 0x140004de5
mov rcx, rdx
mov rdx, r8
pop rbp
jmp fcn.140004e00
mov rcx, rdx
mov rdx, r8
pop rbp
jmp fcn.14000ce10

Function at 0x14000ce10
Capabilities:
Create directory

Disassembly:
push rbp
push rsi
push rdi
sub rsp, 0x70
lea rbp, [rsp + 0x70]
mov r8, rdx
mov rdx, rcx
lea rcx, [rbp - 0x18]
call fcn.14000dfd0
mov rax, qword [rbp - 0x18]
mov rsi, qword [rbp - 0x10]
mov rcx, rax
neg rcx
jo 0x14000ce6b
mov rcx, qword [rbp - 8]
mov qword [rbp - 0x30], rax
mov qword [rbp - 0x28], rsi
mov qword [rbp - 0x20], rcx
lea rcx, [rbp - 0x48]
lea rdx, [rbp - 0x30]
mov r8b, 1
call fcn.14000eca0
mov rdi, qword [rbp - 0x48]
mov rsi, qword [rbp - 0x40]
mov rax, rdi
neg rax
jno 0x14000ce76
mov rax, rsi
add rsp, 0x70
pop rdi
pop rsi
pop rbp
ret
mov rcx, rsi
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
je 0x14000cea2
test rdi, rdi
je 0x14000cece
add rdi, rdi
mov r8d, 2
mov rcx, rsi
mov rdx, rdi
call fcn.140001f70
xor eax, eax
jmp 0x14000ce6e
call qword [sym.imp.KERNEL32.dll_GetLastError]
shl rax, 0x20
or rax, 2
test rdi, rdi
je 0x14000ce6e
add rdi, rdi
mov r8d, 2
mov rcx, rsi
mov rdx, rdi
mov rsi, rax
call fcn.140001f70
jmp 0x14000ce6b
xor eax, eax
jmp 0x14000ce6e

Function at 0x14000d370
Capabilities:
Write file on windows

Disassembly:
push rbp
push rsi
sub rsp, 0xb8
lea rbp, [rsp + 0x80]
mov rsi, rcx
mov rax, qword [rbp + 0x70]
mov qword [rbp - 8], r9
lea rcx, [rbp]
mov qword [rbp], rax
movups xmm0, xmmword [0x145cc09d8]
movaps xmmword [rbp + 0x10], xmm0
mov eax, 0xffffffff
cmp r8, rax
cmovb rax, r8
xor r8d, r8d
test r9b, 1
cmove rcx, r8
mov qword [rsp + 0x38], rcx
mov dword [rsp + 0x30], eax
mov qword [rsp + 0x28], rdx
lea rax, [rbp + 0x10]
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x40], 0
mov rcx, rsi
xor edx, edx
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.ntdll.dll_NtWriteFile]
cmp eax, 0x103
jne 0x14000d406
mov rcx, rsi
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, dword [rbp + 0x10]
cmp eax, 0x103
je 0x14000d433
test eax, eax
js 0x14000d412
mov rdx, qword [rbp + 0x18]
xor eax, eax
jmp 0x14000d429
mov ecx, eax
call qword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
mov edx, eax
shl rdx, 0x20
or rdx, 2
mov eax, 1
add rsp, 0xb8
pop rsi
pop rbp
ret
mov dword [rbp + 0x28], 0
mov byte [rbp + 0x2c], 0
lea rax, [0x145cc0a38]
mov qword [rbp - 0x38], rax
mov qword [rbp - 0x30], 1
lea rax, [rbp + 0x30]
mov qword [rbp - 0x28], rax
xorps xmm0, xmm0
movups xmmword [rbp - 0x20], xmm0
lea rcx, [rbp + 0x28]
lea rdx, [rbp - 0x38]
call fcn.140006c80
mov qword [rbp + 8], rax
lea rcx, [rbp + 8]
call fcn.140002a20
mov ecx, 7
int 0x29
ud2
Function at 0x14000e520
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x28
lea rbp, [rsp + 0x20]
mov rdi, r8
mov rsi, rcx
mov rcx, qword [rcx + 8]
mov rbx, qword [rsi + 0x10]
xor r14d, r14d
mov eax, 0
cmp rbx, 3
jb 0x14000e58c
movzx r8d, byte [rbx + rcx - 2]
mov r9d, r8d
and r9b, 0xf0
xor r14d, r14d
cmp r9b, 0xa0
jne 0x14000e58c
xor r14d, r14d
cmp byte [rbx + rcx - 3], 0xed
jne 0x14000e58c
movzx r14d, byte [rbx + rcx - 1]
and r8d, 0xf
and r14d, 0x3f
shl r8d, 0x10
shl r14d, 0xa
or r14d, r8d
mov al, 1
cmp rdi, 3
jb 0x14000e638
cmp byte [rdx], 0xed
jne 0x14000e641
movzx r12d, byte [rdx + 1]
mov r8d, r12d
and r8b, 0xf0
cmp r8b, 0xb0
setne r8b
xor al, 1
or al, r8b
jne 0x14000e641
movzx r13d, byte [rdx + 2]
cmp rbx, 3
jb 0x14000e5d1
add rbx, 0xfffffffffffffffd
mov qword [rsi + 0x10], rbx
and r13d, 0x3f
shl r12d, 6
lea r8, [rdi + 1]
mov rax, qword [rsi]
sub rax, rbx
cmp rax, r8
jb 0x14000e72b
add rdx, 3
mov r15, rdx
and r12d, 0x3c0
or r14d, r13d
or r14d, r12d
add r14d, 0x10000
mov rcx, rsi
mov edx, r14d
call fcn.14000a650
add rdi, 0xfffffffffffffffd
mov rax, qword [rsi]
mov rbx, qword [rsi + 0x10]
sub rax, rbx
cmp rax, rdi
jb 0x14000e750
mov rcx, qword [rsi + 8]
add rcx, rbx
mov rdx, r15
jmp 0x14000e6de
test rdi, rdi
je 0x14000e6d0
lea rax, [rdx + rdi]
mov r9, rdx
jmp 0x14000e668
add r9, 2
cmp r8, rax
cmovne r8, r9
nop word cs:[rax + rax]
mov r9, r8
cmp r8, rax
je 0x14000e6d0
lea r8, [r9 + 1]
movzx r10d, byte [r9]
test r10b, r10b
jns 0x14000e660
cmp r10b, 0xe0
jb 0x14000e64a
cmp r10b, 0xed
jne 0x14000e69f
cmp r8, rax
je 0x14000e6d0
lea r8, [r9 + 2]
cmp r8, rax
je 0x14000e6d0
cmp byte [r9 + 1], 0x9f
ja 0x14000e6cc
add r9, 3
mov r8, r9
jmp 0x14000e660
add r9, 2
cmp r8, rax
cmove r9, r8
xor r8d, r8d
cmp r9, rax
setne r8b
add r8, r9
cmp r10b, 0xf0
jb 0x14000e660
xor r9d, r9d
cmp r8, rax
setne r9b
add r8, r9
jmp 0x14000e660
mov byte [rsi + 0x18], 0
mov rax, qword [rsi]
sub rax, rbx
cmp rax, rdi
jb 0x14000e6fe
add rcx, rbx
mov r8, rdi
call sub.VCRUNTIME140.dll_memcpy
add rbx, rdi
mov qword [rsi + 0x10], rbx
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
mov qword [rsp + 0x20], 1
mov r9d, 1
mov rcx, rsi
mov r14, rdx
mov rdx, rbx
mov r8, rdi
call fcn.14001d020
mov rdx, r14
mov rcx, qword [rsi + 8]
mov rbx, qword [rsi + 0x10]
jmp 0x14000e6db
mov qword [rsp + 0x20], 1
mov r9d, 1
mov rcx, rsi
mov r15, rdx
mov rdx, rbx
call fcn.14001d020
mov rdx, r15
jmp 0x14000e5ec
mov qword [rsp + 0x20], 1
mov r9d, 1
mov rcx, rsi
mov rdx, rbx
mov r8, rdi
call fcn.14001d020
mov rbx, qword [rsi + 0x10]
jmp 0x14000e629
Function at 0x14001c7d4
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14001c81e
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14001c81e
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14001c81e
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14001c81e
cmp dword [rcx + 0x84], 0xe
jbe 0x14001c81e
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x14001c820
xor al, al
add rsp, 0x28
ret
Function at 0x14003ded0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push rsi
push rdi
sub rsp, 0x78
mov rsi, rdx
cmp dword [rcx], 2
jne 0x14003df66
movdqu xmm0, xmmword [rcx + 8]
pshufd xmm1, xmm0, 0x44
pxor xmm1, xmmword [str.uespemosarenegylmodnarodsetybdet]
movdqa xmmword [rsp + 0x30], xmm1
pshufd xmm1, xmm0, 0xee
pxor xmm1, xmmword [0x1401c0400]
movdqa xmmword [rsp + 0x40], xmm1
movdqa xmmword [rsp + 0x50], xmm0
pxor xmm0, xmm0
movdqa xmmword [rsp + 0x60], xmm0
mov qword [rsp + 0x70], 0
mov rdi, qword [rsi]
xor eax, eax
test rdi, rdi
setne al
mov qword [rsp + 0x28], rax
lea rcx, [rsp + 0x30]
lea rdx, [rsp + 0x28]
mov r8d, 8
call fcn.140040540
test rdi, rdi
je 0x14003dff5
mov rdx, qword [rsi + 8]
mov r8, qword [rsi + 0x10]
lea rcx, [rsp + 0x30]
jmp 0x14003e00e
mov rdx, qword [rsi]
xor ecx, ecx
test rdx, rdx
setne cl
movabs rax, 0xcbf29ce484222325
xor rax, rcx
movabs rcx, 0x1efac7090aef4a21
imul rax, rcx
test rdx, rdx
je 0x14003e106
mov r9, qword [rsi + 0x10]
test r9, r9
je 0x14003e188
mov rcx, qword [rsi + 8]
movabs rdx, 0x100000001b3
mov r10, r9
and r10, 7
je 0x14003e113
mov r11, rax
mov r8, rcx
nop word cs:[rax + rax]
movzx eax, byte [r8]
inc r8
xor rax, r11
imul rax, rdx
mov r11, rax
dec r10
jne 0x14003dfd0
cmp r9, 8
jae 0x14003e11c
jmp 0x14003e188
movzx eax, byte [rsi + 8]
mov qword [rsp + 0x28], rax
lea rcx, [rsp + 0x30]
lea rdx, [rsp + 0x28]
mov r8d, 8
call fcn.140040540
mov rax, qword [rsp + 0x40]
mov r9, qword [rsp + 0x60]
shl r9, 0x38
or r9, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x48]
xor rcx, r9
mov r8, qword [rsp + 0x30]
add r8, rax
mov rdx, qword [rsp + 0x38]
add rdx, rcx
rol rax, 0xd
xor rax, r8
rol rcx, 0x10
rol r8, 0x20
xor rcx, rdx
add rdx, rax
rol rax, 0x11
add r8, rcx
xor rax, rdx
rol rcx, 0x15
xor rcx, r8
rol rdx, 0x20
xor r8, r9
xor rdx, 0xff
add r8, rax
rol rax, 0xd
add rdx, rcx
xor rax, r8
rol rcx, 0x10
xor rcx, rdx
rol r8, 0x20
add rdx, rax
add r8, rcx
rol rax, 0x11
xor rax, rdx
rol rcx, 0x15
rol rdx, 0x20
xor rcx, r8
add r8, rax
rol rax, 0xd
add rdx, rcx
xor rax, r8
rol rcx, 0x10
xor rcx, rdx
rol r8, 0x20
add rdx, rax
add r8, rcx
rol rax, 0x11
xor rax, rdx
rol rcx, 0x15
rol rdx, 0x20
xor rcx, r8
add r8, rax
rol rax, 0xd
add rdx, rcx
xor rax, r8
shl rcx, 0x10
xor rcx, rdx
add rdx, rax
shr rax, 0x2f
shr rcx, 0x2b
xor rcx, rax
mov rax, rdx
shr rax, 0x20
xor rax, rdx
xor rax, rcx
jmp 0x14003e188
movzx edx, byte [rsi + 8]
xor rax, rdx
imul rax, rcx
jmp 0x14003e188
mov r8, rcx
cmp r9, 8
jb 0x14003e188
add rcx, r9
nop
movzx r9d, byte [r8]
xor r9, rax
imul r9, rdx
movzx eax, byte [r8 + 1]
xor rax, r9
imul rax, rdx
movzx r9d, byte [r8 + 2]
xor r9, rax
imul r9, rdx
movzx eax, byte [r8 + 3]
xor rax, r9
imul rax, rdx
movzx r9d, byte [r8 + 4]
xor r9, rax
imul r9, rdx
movzx eax, byte [r8 + 5]
xor rax, r9
imul rax, rdx
movzx r9d, byte [r8 + 6]
xor r9, rax
imul r9, rdx
movzx eax, byte [r8 + 7]
add r8, 8
xor rax, r9
imul rax, rdx
cmp r8, rcx
jne 0x14003e120
and eax, 0x7fff
add rsp, 0x78
pop rdi
pop rsi
ret
Function at 0x140040540
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
push rbx
mov rax, rcx
add qword [rcx + 0x30], r8
mov r11, qword [rcx + 0x40]
test r11, r11
je 0x140040582
mov r10d, 8
sub r10, r11
cmp r8, r10
mov rdi, r10
cmovb rdi, r8
cmp rdi, 4
jb 0x14004058a
mov esi, dword [rdx]
mov r9d, 4
mov rcx, r9
or rcx, 1
cmp rcx, rdi
jb 0x14004059b
jmp 0x1400405b2
xor r10d, r10d
jmp 0x14004063d
xor esi, esi
xor r9d, r9d
mov rcx, r9
or rcx, 1
cmp rcx, rdi
jae 0x1400405b2
movzx ebx, word [rdx + r9]
lea ecx, [r9*8]
shl rbx, cl
or rsi, rbx
or r9, 2
cmp r9, rdi
jae 0x1400405c9
movzx edi, byte [rdx + r9]
shl r9d, 3
mov ecx, r9d
shl rdi, cl
or rsi, rdi
lea ecx, [r11*8]
shl rsi, cl
or rsi, qword [rax + 0x38]
mov qword [rax + 0x38], rsi
cmp r10, r8
jbe 0x1400405e9
add r11, r8
jmp 0x140040719
mov rcx, qword [rax + 0x18]
xor rcx, rsi
mov rdi, qword [rax + 0x10]
mov r9, qword [rax]
add r9, rdi
mov r11, qword [rax + 8]
add r11, rcx
rol rdi, 0xd
xor rdi, r9
rol rcx, 0x10
rol r9, 0x20
xor rcx, r11
add r11, rdi
rol rdi, 0x11
add r9, rcx
xor rdi, r11
rol rcx, 0x15
mov qword [rax + 0x10], rdi
xor rcx, r9
rol r11, 0x20
mov qword [rax + 0x18], rcx
mov qword [rax + 8], r11
xor r9, rsi
mov qword [rax], r9
sub r8, r10
mov r11d, r8d
and r11d, 7
and r8, 0xfffffffffffffff8
cmp r10, r8
jae 0x1400406b2
mov rcx, qword [rax]
mov r9, qword [rax + 8]
mov rdi, qword [rax + 0x18]
mov rsi, qword [rax + 0x10]
nop
mov rbx, qword [rdx + r10]
xor rdi, rbx
add rcx, rsi
rol rsi, 0xd
add r9, rdi
xor rsi, rcx
rol rdi, 0x10
xor rdi, r9
rol rcx, 0x20
add r9, rsi
add rcx, rdi
rol rsi, 0x11
xor rsi, r9
rol rdi, 0x15
rol r9, 0x20
xor rdi, rcx
xor rcx, rbx
add r10, 8
cmp r10, r8
jb 0x140040660
mov qword [rax + 0x18], rdi
mov qword [rax + 0x10], rsi
mov qword [rax + 8], r9
mov qword [rax], rcx
cmp r11d, 4
jb 0x1400406cf
mov r9d, dword [rdx + r10]
mov r8d, 4
mov ecx, r8d
or ecx, 1
cmp ecx, r11d
jb 0x1400406e0
jmp 0x1400406fb
xor r9d, r9d
xor r8d, r8d
mov ecx, r8d
or ecx, 1
cmp ecx, r11d
jae 0x1400406fb
lea rcx, [rdx + r8]
movzx esi, word [r10 + rcx]
lea ecx, [r8*8]
shl rsi, cl
or r9, rsi
or r8, 2
cmp r8d, r11d
jae 0x140040715
add r10, r8
movzx edx, byte [rdx + r10]
shl r8d, 3
mov ecx, r8d
shl rdx, cl
or r9, rdx
mov qword [rax + 0x38], r9
mov qword [rax + 0x40], r11
pop rbx
pop rdi
pop rsi
ret
Function at 0x140096570
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x38
test byte [rdx], 1
je 0x1400965b0
lea rax, [rdx + 8]
cmp qword [rdx + 0x38], 0xffffffffffffffff
mov r8, qword [rdx + 0x48]
mov r9, qword [rdx + 0x50]
mov r10, qword [rdx + 0x58]
mov rdx, qword [rdx + 0x60]
je 0x1400966d2
mov qword [rsp + 0x28], rdx
mov qword [rsp + 0x20], r10
mov byte [rsp + 0x30], 0
jmp 0x1400966e1
cmp byte [rdx + 0x1a], 0
jne 0x140096708
mov r8, qword [rdx + 8]
mov rax, qword [rdx + 0x48]
mov r9, qword [rdx + 0x50]
movzx r10d, byte [rdx + 0x18]
jmp 0x1400965d7
add r8, r11
mov qword [rdx + 8], r8
mov r11d, r10d
xor r10b, 1
test r8, r8
je 0x140096606
cmp r8, r9
jae 0x140096600
cmp byte [rax + r8], 0xbf
jg 0x140096606
jmp 0x140096716
jne 0x140096716
cmp r8, r9
je 0x1400966eb
movzx ebx, byte [rax + r8]
movzx esi, bl
test sil, sil
js 0x140096660
test r11b, 1
jne 0x1400966c9
mov r11d, 1
cmp esi, 0x80
jb 0x1400965d0
mov r11d, 2
cmp esi, 0x800
jb 0x1400965d0
cmp esi, 0x10000
mov r11d, 4
sbb r11, 0
jmp 0x1400965d0
mov edi, esi
and edi, 0x1f
movzx ebp, byte [rax + r8 + 1]
and ebp, 0x3f
cmp sil, 0xdf
jbe 0x1400966a7
movzx esi, byte [rax + r8 + 2]
shl ebp, 6
and esi, 0x3f
or esi, ebp
cmp bl, 0xf0
jb 0x1400966ba
movzx ebx, byte [rax + r8 + 3]
and edi, 7
shl edi, 0x12
shl esi, 6
and ebx, 0x3f
or ebx, esi
or ebx, edi
mov esi, ebx
test r11b, 1
je 0x140096626
jmp 0x1400966c9
shl edi, 6
or edi, ebp
mov esi, edi
test r11b, 1
je 0x140096626
jmp 0x1400966c9
shl edi, 0xc
or esi, edi
test r11b, 1
je 0x140096626
mov byte [rdx + 0x18], r10b
mov r9, r8
jmp 0x1400966f5
mov qword [rsp + 0x28], rdx
mov qword [rsp + 0x20], r10
mov byte [rsp + 0x30], 1
mov rdx, rax
call fcn.1400953f0
jmp 0x14009670d
mov byte [rdx + 0x18], r10b
test r11b, 1
je 0x140096704
mov qword [rcx + 8], r9
mov qword [rcx + 0x10], r9
mov eax, 1
jmp 0x14009670a
mov byte [rdx + 0x1a], 1
xor eax, eax
mov qword [rcx], rax
add rsp, 0x38
pop rbx
pop rbp
pop rdi
pop rsi
ret
mov byte [rdx + 0x18], r10b
lea rcx, [0x1401c9558]
mov qword [rsp + 0x20], rcx
mov rcx, rax
mov rdx, r9
call fcn.1401ba580
int3