joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14011d810
Capabilities:
Encode data using xor
Generate random numbers using the delphi lcg

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x40
mov rax, qword [0x140276168]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov rbx, rcx
mov qword [rsp + 0x20], rcx
mov qword [rsp + 0x30], rcx
lea rax, [rcx + 0x128]
mov qword [rsp + 0x28], rax
cmp qword [rax], 0
jne 0x14011d863
mov edx, 0xa4
lea rcx, str...LinkNodesWzStdDecrypt.c
call fcn.140015ac0
nop
jmp 0x14011d86a
cmp byte [rbx + 0x168], 0
jne 0x14011d885
mov edx, 0xa5
lea rcx, str...LinkNodesWzStdDecrypt.c
call fcn.140015ac0
nop
jmp 0x14011d88c
mov rdx, qword [rsp + 0x28]
mov rdx, qword [rdx]
lea rcx, [rbx + 0x140]
call fcn.140123200
nop
mov r15, qword [rsp + 0x30]
nop word [rax + rax]
xor r9d, r9d
mov r8d, 0x7fffffff
lea rdx, [rsp + 0x30]
lea rcx, [rbx + 0x140]
call fcn.140123030
mov rdi, rax
test rax, rax
je 0x14011d9b1
xor esi, esi
nop dword [rax + rax]
movzx r10d, word [rbx + 0x174]
movzx ecx, r10w
or cx, 2
mov r11, qword [rsp + 0x30]
movzx eax, cx
xor ax, 1
movzx ecx, cx
movzx edx, ax
imul edx, ecx
movzx ecx, dx
shr ecx, 8
movzx eax, byte [r11 + rsi]
xor ecx, eax
movzx r9d, cl
mov r8, qword [rbx + 0x158]
mov ecx, r9d
movzx eax, byte [rbx + 0x16c]
xor rcx, rax
mov eax, dword [rbx + 0x16c]
shr eax, 8
xor eax, dword [r8 + rcx*4]
mov dword [rbx + 0x16c], eax
movzx eax, al
add eax, dword [rbx + 0x170]
imul edx, eax, 0x8088405
inc edx
mov dword [rbx + 0x170], edx
shr rdx, 0x18
movzx eax, r10b
xor rdx, rax
mov eax, dword [rbx + 0x174]
shr eax, 8
xor eax, dword [r8 + rdx*4]
mov dword [rbx + 0x174], eax
mov byte [r11 + rsi], r9b
inc rsi
cmp rsi, rdi
jb 0x14011d8e0
mov rdx, rdi
lea rcx, [rbx + 0x140]
call fcn.140123100
mov rcx, rbx
call fcn.140126740
lea rcx, [r15 + 0x130]
call fcn.140122e30
add qword [rbx + 0x150], rdi
jmp 0x14011d8b0
lea rcx, [r15 + 0x130]
call fcn.140122e00
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.1400c3d30
mov rbx, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
add rsp, 0x40
pop r15
pop r14
pop rdi
ret
Function at 0x1401229b0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x20
mov esi, dword [r8 + 0x208]
mov rdi, r8
mov ebp, edx
mov r14, rcx
test edx, edx
je 0x140122b31
mov qword [rsp + 0x30], rbx
mov ecx, 0x104
mov edx, esi
sub ecx, esi
mov eax, ebp
cmp ebp, ecx
cmovae eax, ecx
add rdx, 0x104
add rdx, rdi
mov r8d, eax
mov rcx, r14
mov ebx, eax
call fcn.1400c7640
add r14, rbx
add esi, ebx
sub ebp, ebx
cmp esi, 0x104
jne 0x140122b1c
xor ebx, ebx
lea rcx, [rdi + 0x104]
mov rax, rdi
lea edx, [rbx + 2]
nop word [rax + rax]
lea rcx, [rcx + 0x80]
movups xmm0, xmmword [rax]
movups xmm1, xmmword [rax + 0x10]
lea rax, [rax + 0x80]
movups xmmword [rcx - 0x80], xmm0
movups xmm0, xmmword [rax - 0x60]
movups xmmword [rcx - 0x70], xmm1
movups xmm1, xmmword [rax - 0x50]
movups xmmword [rcx - 0x60], xmm0
movups xmm0, xmmword [rax - 0x40]
movups xmmword [rcx - 0x50], xmm1
movups xmm1, xmmword [rax - 0x30]
movups xmmword [rcx - 0x40], xmm0
movups xmm0, xmmword [rax - 0x20]
movups xmmword [rcx - 0x30], xmm1
movups xmm1, xmmword [rax - 0x10]
movups xmmword [rcx - 0x20], xmm0
movups xmmword [rcx - 0x10], xmm1
sub rdx, 1
jne 0x140122a30
mov eax, dword [rax]
mov dword [rcx], eax
nop word [rax + rax]
mov rcx, qword [rdi + 0x218]
mov r8d, 0x104
mov edx, ebx
sub r8d, ebx
add rdx, rdi
call qword [rdi + 0x210]
add ebx, eax
cmp ebx, 0x104
jb 0x140122a90
lea rax, [rdi + 1]
mov r8d, 0x34
nop
movzx ecx, byte [rax + 0x103]
movzx edx, byte [rax + 0x106]
lea rax, [rax + 5]
not cl
not dl
xor byte [rax - 6], cl
xor byte [rax - 3], dl
movzx ecx, byte [rax + 0xff]
movzx edx, byte [rax + 0x102]
not cl
xor byte [rax - 5], cl
not dl
movzx ecx, byte [rax + 0x100]
xor byte [rax - 2], dl
not cl
xor byte [rax - 4], cl
sub r8, 1
jne 0x140122ac0
mov rcx, rdi
call fcn.1401228d0
lea rcx, [rdi + 0x104]
call fcn.1401228d0
xor esi, esi
test ebp, ebp
jne 0x1401229e1
mov rbx, qword [rsp + 0x30]
mov dword [rdi + 0x208], esi
jmp 0x140122b38
mov dword [r8 + 0x208], esi
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
Function at 0x140122b50
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rsi, r8
mov rdi, rdx
mov rbx, rcx
xor edx, edx
mov rcx, rsi
mov r8d, 0x210
call fcn.1400c7cf0
mov rcx, rsi
mov qword [rsi + 0x210], rbx
mov qword [rsi + 0x218], rdi
call 0x140122b50
mov ebx, 0x14
mov rcx, rsi
call fcn.1401228d0
sub rbx, 1
jne 0x1401228a3
mov rcx, rsi
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
jmp 0x140122b50
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r14
push r15
sub rsp, 0xa0
mov rax, qword [0x140276168]
xor rax, rsp
mov qword [rsp + 0x90], rax
xor ebx, ebx
lea rdx, [rcx + 0x104]
mov rdi, rcx
mov rax, rcx
mov esi, ebx
lea ecx, [rbx + 2]
lea rdx, [rdx + 0x80]
movups xmm0, xmmword [rax]
movups xmm1, xmmword [rax + 0x10]
lea rax, [rax + 0x80]
movups xmmword [rdx - 0x80], xmm0
movups xmm0, xmmword [rax - 0x60]
movups xmmword [rdx - 0x70], xmm1
movups xmm1, xmmword [rax - 0x50]
movups xmmword [rdx - 0x60], xmm0
movups xmm0, xmmword [rax - 0x40]
movups xmmword [rdx - 0x50], xmm1
movups xmm1, xmmword [rax - 0x30]
movups xmmword [rdx - 0x40], xmm0
movups xmm0, xmmword [rax - 0x20]
movups xmmword [rdx - 0x30], xmm1
movups xmm1, xmmword [rax - 0x10]
movups xmmword [rdx - 0x20], xmm0
movups xmmword [rdx - 0x10], xmm1
sub rcx, 1
jne 0x140122b91
mov eax, dword [rax]
mov dword [rdx], eax
nop dword [rax + rax]
mov rcx, qword [rdi + 0x218]
mov r8d, 0x104
mov edx, esi
sub r8d, esi
add rdx, rdi
call qword [rdi + 0x210]
add esi, eax
cmp esi, 0x104
jb 0x140122bf0
lea rax, [rdi + 1]
mov edx, 0x34
nop
movzx ecx, byte [rax + 0x103]
lea rax, [rax + 5]
not cl
xor byte [rax - 6], cl
movzx ecx, byte [rax + 0xff]
not cl
xor byte [rax - 5], cl
movzx ecx, byte [rax + 0x100]
not cl
xor byte [rax - 4], cl
movzx ecx, byte [rax + 0x101]
not cl
xor byte [rax - 3], cl
movzx ecx, byte [rax + 0x102]
not cl
xor byte [rax - 2], cl
sub rdx, 1
jne 0x140122c20
lea r15d, [rdx + 0x40]
nop word [rax + rax]
mov eax, 0x104
mov ebp, ebx
test ebx, ebx
lea rcx, [rsp + 0x3c]
mov esi, 0x104
cmovne eax, ebx
sub esi, ebx
add rbp, rdi
mov r8d, esi
cmp esi, r15d
mov rdx, rbp
movups xmm0, xmmword [rax + rdi - 0x14]
mov eax, dword [rax + rdi - 4]
cmova r8d, r15d
mov dword [rsp + 0x38], eax
movups xmmword [rsp + 0x28], xmm0
call fcn.1400c7640
cmp esi, r15d
jae 0x140122ccd
mov eax, esi
lea rcx, [rsp + 0x3c]
add rcx, rax
lea r8d, [rbx - 0xc4]
mov rdx, rdi
call fcn.1400c7640
lea rcx, [rsp + 0x20]
call fcn.140132260
movups xmm0, xmmword [rsp + 0x28]
mov eax, dword [rsp + 0x38]
add ebx, 0x14
movups xmmword [rbp], xmm0
mov dword [rbp + 0x10], eax
cmp ebx, 0x104
jb 0x140122c70
lea rcx, [rdi + 0x104]
call fcn.1401228d0
mov rcx, qword [rsp + 0x90]
xor rcx, rsp
call fcn.1400c3d30
lea r11, [rsp + 0xa0]
mov rbx, qword [r11 + 0x28]
mov rbp, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rdi
ret
Function at 0x1401320f0
Capabilities:
Hash data using sha1

Disassembly:
mov r11, rsp
push rbx
push rbp
push rsi
push r14
sub rsp, 0xa8
mov rax, qword [0x140276168]
xor rax, rsp
mov qword [rsp + 0x90], rax
xor eax, eax
mov esi, r9d
xorps xmm0, xmm0
mov dword [rsp + 0x7c], eax
test cl, 1
lea r14, [fcn.140132260]
mov rax, r14
lea rcx, [0x140001cc0]
cmovne rax, rcx
mov rbx, r8
mov rbp, rdx
movups xmmword [rsp + 0x3c], xmm0
movups xmmword [rsp + 0x4c], xmm0
movups xmmword [rsp + 0x5c], xmm0
movups xmmword [rsp + 0x6c], xmm0
mov qword [r11 - 0x48], rax
mov dword [rsp + 0x24], 0
mov dword [rsp + 0x28], 0x67452301
mov dword [rsp + 0x2c], 0xefcdab89
mov dword [rsp + 0x30], 0x98badcfe
mov dword [rsp + 0x34], 0x10325476
mov dword [rsp + 0x38], 0xc3d2e1f0
mov dword [rsp + 0x20], esi
cmp r9d, 0x40
jb 0x1401321f5
mov qword [r11 - 0x28], rdi
mov edi, esi
shr rdi, 6
nop word [rax + rax]
movups xmm0, xmmword [rbx]
add esi, 0xffffffc0
lea rcx, [rsp + 0x20]
movups xmmword [rsp + 0x3c], xmm0
movups xmm1, xmmword [rbx + 0x10]
movups xmmword [rsp + 0x4c], xmm1
movups xmm0, xmmword [rbx + 0x20]
movups xmmword [rsp + 0x5c], xmm0
movups xmm1, xmmword [rbx + 0x30]
add rbx, 0x40
movups xmmword [rsp + 0x6c], xmm1
cmp rax, r14
jne 0x1401321db
call fcn.140132260
jmp 0x1401321dd
call rax
sub rdi, 1
je 0x1401321ed
mov rax, qword [rsp + 0x80]
jmp 0x1401321a0
mov rdi, qword [rsp + 0xa0]
mov r8d, esi
lea rcx, [rsp + 0x3c]
mov rdx, rbx
call fcn.1400c7640
lea rdx, [rsp + 0x20]
mov rcx, rbp
call fcn.140132630
mov rcx, qword [rsp + 0x90]
xor rcx, rsp
call fcn.1400c3d30
add rsp, 0xa8
pop r14
pop rsi
pop rbp
pop rbx
ret
Function at 0x14013b5f0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
test dx, dx
lea rdi, [rcx + 0x10]
mov rsi, rcx
mov rbx, r8
cmovne rcx, rdi
movzx ebp, dx
call fcn.14013b670
xor eax, eax
lea r8, [rbx + 0x80]
test bp, bp
lea rcx, [rsi + 8]
sete al
movzx edx, ax
call fcn.14013b670
test bp, bp
lea r8, [rbx + 0x100]
movzx edx, bp
cmovne rdi, rsi
mov rcx, rdi
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
jmp fcn.14013b670
Function at 0x14013bd20
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x50
mov rax, qword [0x140276168]
xor rax, rsp
mov qword [rsp + 0x30], rax
mov rbx, r8
mov rsi, rdx
mov rdi, rcx
test rcx, rcx
jne 0x14013bd4a
lea eax, [rcx + 2]
jmp 0x14013bd9d
test rsi, rsi
je 0x14013bde6
test rbx, rbx
je 0x14013bde6
mov qword [rsp + 0x48], rbp
mov qword [rsp + 0x40], r14
mov r14d, dword [rcx + 0x18]
lea rcx, [rsp + 0x20]
mov r8d, r14d
call fcn.1400c7640
mov rax, qword [rdi + 0x1d8]
lea r8, [rdi + 0x4c]
mov rdx, rbx
mov rcx, rsi
call rax
test eax, eax
jne 0x14013bdb2
mov eax, 7
mov rbp, qword [rsp + 0x48]
mov r14, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.1400c3d30
add rsp, 0x50
pop rdi
pop rsi
pop rbx
ret
test r14d, r14d
je 0x14013bdd1
mov rax, rdi
mov rdx, r14
sub rax, rbx
movzx ecx, byte [rax + rbx + 8]
xor byte [rbx], cl
lea rbx, [rbx + 1]
sub rdx, 1
jne 0x14013bdc0
lea rcx, [rdi + 8]
mov r8, r14
lea rdx, [rsp + 0x20]
call fcn.1400c7640
xor eax, eax
jmp 0x14013bd93
mov eax, 3
jmp 0x14013bd9d
Function at 0x14013bdf0
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
lea rbp, [rsp - 0x57]
sub rsp, 0xf0
mov rax, qword [0x140276168]
xor rax, rsp
mov qword [rbp + 0x47], rax
mov rbx, rcx
test rcx, rcx
jne 0x14013be20
lea eax, [rcx + 2]
jmp 0x14013bfc5
test rdx, rdx
jne 0x14013be2d
lea eax, [rdx + 3]
jmp 0x14013bfc5
mov ecx, dword [rcx + 0x1cc]
mov r9d, r8d
mov r8, rdx
lea rdx, [rbp + 7]
call fcn.1401320f0
cmp dword [rbx + 4], 3
jbe 0x14013be52
mov eax, 4
jmp 0x14013bfc5
movdqu xmm2, xmmword [rbp + 7]
mov dword [rbp - 0x39], 0x5c5c5c5c
xor ecx, ecx
mov dword [rbp - 0x35], 0x5c5c5c5c
mov dword [rbp - 0x31], 0x5c5c5c5c
movdqa xmm0, xmm2
mov dword [rbp - 0x2d], 0x5c5c5c5c
movdqu xmm1, xmmword [rbp - 0x39]
lea edx, [rcx + 4]
mov dword [rbp - 0x79], 0x36363636
pxor xmm1, xmm2
mov dword [rbp - 0x75], 0x36363636
mov dword [rbp - 0x71], 0x36363636
mov dword [rbp - 0x6d], 0x36363636
pxor xmm0, xmmword [rbp - 0x79]
movdqu xmmword [rbp - 0x79], xmm0
mov dword [rbp - 0x69], 0x36363636
mov dword [rbp - 0x29], 0x5c5c5c5c
mov dword [rbp - 0x65], 0x36363636
mov dword [rbp - 0x25], 0x5c5c5c5c
mov dword [rbp - 0x61], 0x36363636
mov dword [rbp - 0x21], 0x5c5c5c5c
mov dword [rbp - 0x5d], 0x36363636
mov dword [rbp - 0x1d], 0x5c5c5c5c
mov dword [rbp - 0x59], 0x36363636
mov dword [rbp - 0x19], 0x5c5c5c5c
mov dword [rbp - 0x55], 0x36363636
mov dword [rbp - 0x15], 0x5c5c5c5c
mov dword [rbp - 0x51], 0x36363636
mov dword [rbp - 0x11], 0x5c5c5c5c
mov dword [rbp - 0x4d], 0x36363636
mov dword [rbp - 0xd], 0x5c5c5c5c
mov dword [rbp - 0x49], 0x36363636
mov dword [rbp - 9], 0x5c5c5c5c
mov dword [rbp - 0x45], 0x36363636
mov dword [rbp - 5], 0x5c5c5c5c
mov dword [rbp - 0x41], 0x36363636
mov dword [rbp - 1], 0x5c5c5c5c
mov dword [rbp - 0x3d], 0x36363636
mov dword [rbp + 3], 0x5c5c5c5c
movdqu xmmword [rbp - 0x39], xmm1
nop dword [rax + rax]
movzx eax, byte [rbp + rcx + 0x17]
xor byte [rbp + rcx - 0x69], al
xor byte [rbp + rcx - 0x29], al
lea rcx, [rcx + 1]
sub rdx, 1
jne 0x14013bf60
mov ecx, dword [rbx + 0x1cc]
lea r9d, [rdx + 0x40]
lea rdx, [rbp + 0x1f]
lea r8, [rbp - 0x79]
call fcn.1401320f0
mov ecx, dword [rbx + 0x1cc]
lea r8, [rbp - 0x39]
mov r9d, 0x40
lea rdx, [rbp + 0x33]
call fcn.1401320f0
mov eax, dword [rbx + 4]
test eax, eax
jne 0x14013bfe2
cmp dword [rbx], eax
lea r8, [rbx + 0x4c]
lea rcx, [rbp + 0x1f]
setne al
movzx edx, ax
call fcn.14013b5f0
xor eax, eax
mov rcx, qword [rbp + 0x47]
xor rcx, rsp
call fcn.1400c3d30
mov rbx, qword [rsp + 0x118]
add rsp, 0xf0
pop rbp
ret
cmp eax, 1
jne 0x14013bfec
lea edx, [rax + 0xf]
jmp 0x14013bffc
cmp eax, 2
mov edx, 0x20
mov ecx, 0x18
cmove edx, ecx
cmp dword [rbx], 0
lea r8, [rbx + 0x4c]
lea rcx, [rbp + 0x1f]
jne 0x14013c019
call fcn.140134820
test eax, eax
jne 0x14013bfc3
mov eax, 6
jmp 0x14013bfc5
call fcn.1401328f0
test eax, eax
jne 0x14013bfc3
mov eax, 6
jmp 0x14013bfc5
Function at 0x14013c030
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
push rsi
sub rsp, 0x20
mov rsi, r8
mov r9, rdx
mov rbx, rcx
test rcx, rcx
jne 0x14013c056
lea eax, [rcx + 2]
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rsi
ret
test r9, r9
je 0x14013c0df
test rsi, rsi
je 0x14013c0df
mov eax, dword [rcx + 0x18]
mov qword [rsp + 0x30], rdi
mov edi, eax
test eax, eax
je 0x14013c092
mov r8, rbx
mov rcx, r9
sub r8, r9
mov edx, eax
nop dword [rax]
movzx eax, byte [r8 + rcx + 8]
xor byte [rcx], al
lea rcx, [rcx + 1]
sub rdx, 1
jne 0x14013c080
mov rax, qword [rbx + 0x1d0]
lea r8, [rbx + 0x4c]
mov rdx, rsi
mov rcx, r9
call rax
test eax, eax
jne 0x14013c0be
mov rdi, qword [rsp + 0x30]
mov eax, 8
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rsi
ret
lea rcx, [rbx + 8]
mov r8, rdi
mov rdx, rsi
call fcn.1400c7640
mov rdi, qword [rsp + 0x30]
xor eax, eax
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rsi
ret
mov rbx, qword [rsp + 0x38]
mov eax, 3
add rsp, 0x20
pop rsi
ret

Function at 0x14014cc80
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
xor ebx, ebx
lea rdi, [rcx + 0x31e1c]
nop dword [rax]
nop word [rax + rax]
movzx eax, word [rcx + 0x324c6]
lea rdi, [rdi + 4]
shr rax, 4
mov r9d, ebx
and r9d, 1
mov r11d, ebx
mov edx, r9d
shr r11d, 1
neg edx
or r9d, 2
sar rdx, 4
mov r8d, r11d
and edx, 0x7f
shr r11d, 1
xor rdx, rax
and r8d, 1
mov eax, r8d
inc ebx
neg eax
sar rax, 4
mov r10d, dword [rcx + rdx*4 + 0x3076c]
and eax, 0x7f
movzx edx, word [rcx + r9*2 + 0x324c4]
add r9d, r9d
shr rdx, 4
or r9d, r8d
xor rdx, rax
mov r8d, r11d
and r8d, 1
shr r11d, 1
mov eax, r8d
and r11d, 1
neg eax
add r10d, dword [rcx + rdx*4 + 0x3076c]
movzx edx, word [rcx + r9*2 + 0x324c4]
sar rax, 4
and eax, 0x7f
shr rdx, 4
xor rdx, rax
lea eax, [r9 + r9]
or eax, r8d
add r10d, dword [rcx + rdx*4 + 0x3076c]
movzx edx, word [rcx + rax*2 + 0x324c4]
mov eax, r11d
neg eax
shr rdx, 4
sar rax, 4
and eax, 0x7f
xor rdx, rax
add r10d, dword [rcx + rdx*4 + 0x3076c]
mov dword [rdi - 4], r10d
cmp ebx, 0x10
jb 0x14014cca0
mov rbx, qword [rsp + 8]
mov rdi, qword [rsp + 0x10]
mov dword [rcx + 0x31e5c], 0
ret
Function at 0x14014f700
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r12
push r13
push r14
push r15
mov r11, qword [rsp + 0x48]
mov ebp, r8d
movzx r10d, word [rcx]
mov r13, r9
movzx r8d, word [rcx + 2]
mov eax, r10d
shr rax, 4
xor r10, 0x7f0
shr r10, 4
mov r15d, edx
mov rbx, rcx
mov rsi, r13
mov r14d, dword [r11 + rax*4]
mov eax, r8d
shr rax, 4
xor r8, 0x7f0
shr r8, 4
mov r12d, dword [r11 + rax*4]
mov eax, dword [r11 + r8*4]
add eax, dword [r11 + r10*4]
add r12d, dword [r11 + r10*4]
mov dword [rsp + 0x48], eax
xor r9d, r9d
nop dword [rax + rax]
cmp r9d, ebp
jae 0x14014f8c0
xor r10d, r10d
lea edi, [r15*8]
mov r8d, r9d
or r8d, 8
nop dword [rax + rax]
mov ecx, r8d
mov eax, r8d
and ecx, 1
shr rax, 1
neg ecx
shr r8d, 1
sar rcx, 4
add rax, rdi
and ecx, 0x7f
movzx edx, word [rbx + rax*2 + 4]
shr rdx, 4
xor rdx, rcx
add r10d, dword [r11 + rdx*4]
cmp r8d, 1
jne 0x14014f7a0
lea eax, [r10 + r14]
inc r9d
mov dword [rsi], eax
add rsi, 4
cmp r9d, 8
jb 0x14014f780
cmp r9d, 0x10
jae 0x14014f857
lea rsi, [r9*4]
add rsi, r13
cmp r9d, ebp
jae 0x14014f8c0
xor r10d, r10d
lea r8d, [r9 - 8]
or r8d, 8
nop dword [rax]
mov ecx, r8d
mov eax, r8d
and ecx, 1
shr rax, 1
neg ecx
shr r8d, 1
sar rcx, 4
add rax, rdi
and ecx, 0x7f
movzx edx, word [rbx + rax*2 + 0x104]
shr rdx, 4
xor rdx, rcx
add r10d, dword [r11 + rdx*4]
cmp r8d, 1
jne 0x14014f810
lea eax, [r10 + r12]
inc r9d
mov dword [rsi], eax
add rsi, 4
cmp r9d, 0x10
jb 0x14014f7f5
cmp r9d, ebp
jae 0x14014f8c0
mov esi, dword [rsp + 0x48]
lea rdi, [r9*4]
add rdi, r13
nop dword [rax + rax]
xor r10d, r10d
lea eax, [r9 - 0x10]
bts eax, 8
nop dword [rax + rax]
mov edx, eax
mov ecx, eax
and edx, 1
shr rcx, 1
neg edx
shr eax, 1
sar rdx, 4
and edx, 0x7f
movzx r8d, word [rbx + rcx*2 + 0x204]
shr r8, 4
xor r8, rdx
add r10d, dword [r11 + r8*4]
cmp eax, 1
jne 0x14014f880
lea eax, [r10 + rsi]
inc r9d
mov dword [rdi], eax
add rdi, 4
cmp r9d, ebp
jb 0x14014f870
mov rbx, qword [rsp + 0x28]
mov rbp, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x40]
pop r15
pop r14
pop r13
pop r12
ret

Function at 0x14014fa10
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
xor r11d, r11d
mov rbx, rcx
bts edx, 8
nop
mov ecx, edx
mov eax, edx
shr ecx, 7
add edx, edx
and ecx, 1
shr rax, 8
neg ecx
sar rcx, 4
and ecx, 0x7f
movzx r10d, word [rbx + rax*2]
shr r10, 4
xor r10, rcx
add r11d, dword [r8 + r10*4]
cmp edx, 0x10000
jb 0x14014fa20
mov rbx, qword [rsp + 8]
mov eax, r11d
ret

Function at 0x14014fa60
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
xor ebx, ebx
mov r10d, 0x100
or edx, r10d
mov r11d, r8d
mov rdi, rcx
nop dword [rax + rax]
add r11d, r11d
mov r8d, edx
shr r8d, 8
mov ecx, edx
shr ecx, 7
mov eax, r10d
and ecx, 1
and eax, r11d
neg ecx
add eax, r10d
sar rcx, 4
add r8d, eax
and ecx, 0x7f
add edx, edx
movzx r8d, word [rdi + r8*2]
shr r8, 4
xor r8, rcx
mov ecx, edx
xor ecx, r11d
not ecx
and r10d, ecx
add ebx, dword [r9 + r8*4]
cmp edx, 0x10000
jb 0x14014fa80
mov rdi, qword [rsp + 0x10]
mov eax, ebx
mov rbx, qword [rsp + 8]
ret
Function at 0x140159450
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbx
push r12
push r13
push r15
mov r10d, dword [r9]
xor r12d, r12d
and r10d, 7
mov r13, r9
mov ebx, r8d
mov r15, rcx
mov r11d, r12d
cmp rdx, 5
jae 0x14015947e
xor eax, eax
pop r15
pop r13
pop r12
pop rbx
ret
mov qword [rsp + 0x28], rbp
add ebx, 5
mov qword [rsp + 0x30], rsi
mov rbp, 0xffffffffffffffff
mov qword [rsp + 0x38], rdi
lea rdi, [rdx - 4]
mov qword [rsp + 0x40], r14
add rdi, r15
mov r14d, dword [rsp + 0x48]
lea r9, [0x140000000]
nop
lea r8, [r11 + r15]
cmp r8, rdi
jae 0x1401594d2
nop dword [rax]
movzx eax, byte [r8]
and al, 0xfe
cmp al, 0xe8
je 0x1401594d2
inc r8
cmp r8, rdi
jb 0x1401594c0
mov r11, r8
sub r11, r15
mov rax, r11
sub rax, rbp
cmp r8, rdi
jae 0x1401595f7
cmp rax, 3
jbe 0x14015950f
mov r10d, r12d
movzx ecx, byte [r8 + 4]
mov rbp, r11
lea eax, [rcx - 1]
cmp al, 0xfd
ja 0x140159554
and r10d, 3
add r10d, r10d
or r10d, 1
inc r11
jmp 0x1401594b0
lea ecx, [rax - 1]
shl r10d, cl
and r10d, 7
je 0x1401594f0
cmp byte [r10 + r9 + 0x21db70], r12b
je 0x14015953e
movzx eax, byte [r10 + r9 + 0x21db78]
mov rcx, r8
sub rcx, rax
movzx eax, byte [rcx + 4]
inc al
test al, 0xfe
jne 0x1401594f0
and r10d, 3
mov rbp, r11
add r10d, r10d
or r10d, 1
inc r11
jmp 0x1401594b0
movzx eax, byte [r8 + 3]
mov edx, ecx
shl edx, 8
or edx, eax
movzx eax, byte [r8 + 2]
shl edx, 8
or edx, eax
movzx eax, byte [r8 + 1]
shl edx, 8
or edx, eax
mov eax, r10d
lea rsi, [rax + 0x21db78]
add rsi, r9
test r14d, r14d
je 0x14015958e
lea eax, [r11 + rdx]
add eax, ebx
jmp 0x140159595
mov eax, edx
sub eax, r11d
sub eax, ebx
test r10d, r10d
je 0x1401595ca
movzx r9d, byte [rsi]
mov ecx, 0x18
shl r9d, 3
mov edx, eax
sub ecx, r9d
shr edx, cl
inc dl
test dl, 0xfe
jne 0x1401595ca
mov ecx, 0x20
mov edx, 1
sub ecx, r9d
shl edx, cl
dec edx
xor edx, eax
jmp 0x140159581
mov ecx, eax
mov byte [r8 + 1], al
shr ecx, 0x18
and cl, 1
neg cl
mov byte [r8 + 4], cl
mov ecx, eax
shr ecx, 0x10
mov byte [r8 + 3], cl
mov ecx, eax
shr ecx, 8
mov byte [r8 + 2], cl
add r11, 5
jmp 0x1401594a8
mov r14, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x28]
cmp rax, 3
ja 0x14015961e
lea ecx, [rax - 1]
shl r10d, cl
and r10d, 7
mov r12d, r10d
mov dword [r13], r12d
mov rax, r11
pop r15
pop r13
pop r12
pop rbx
ret
Function at 0x14015aee0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
mov edi, edx
mov rbx, rcx
nop
mov r10d, dword [rbx + 0x14]
mov r8, qword [rbx]
cmp r10d, 3
jae 0x14015af06
lea rax, [r8 + 1]
mov qword [rbx], rax
jmp 0x14015af6a
movzx eax, byte [r8 + 2]
movzx ecx, byte [r8]
shl rcx, 8
or rcx, rax
movzx eax, byte [r8 + 1]
movzx edx, cx
movzx ecx, word [rbx + rax*4 + 0x8c]
mov rax, qword [rbx + 0x28]
xor rdx, rcx
mov ecx, r10d
lea r8, [rax + rdx*4]
mov eax, dword [rbx + 8]
mov edx, dword [r8]
mov dword [r8], eax
mov eax, dword [rbx + 0x3c]
mov r9, qword [rbx]
mov r8d, dword [rbx + 8]
mov dword [rsp + 0x38], eax
mov eax, dword [rbx + 0x1c]
mov dword [rsp + 0x30], eax
mov eax, dword [rbx + 0x18]
mov dword [rsp + 0x28], eax
mov rax, qword [rbx + 0x30]
mov qword [rsp + 0x20], rax
call fcn.14015acd0
inc qword [rbx]
inc dword [rbx + 8]
inc dword [rbx + 0x18]
mov eax, dword [rbx + 8]
cmp eax, dword [rbx + 0xc]
jne 0x14015af80
mov rcx, rbx
call fcn.14015aac0
add edi, 0xffffffff
jne 0x14015aef0
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rdi
ret

Function at 0x14015b1f0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov edi, edx
mov rbx, rcx
nop
cmp dword [rbx + 0x14], 3
mov r8, qword [rbx]
jae 0x14015b212
lea rax, [r8 + 1]
mov qword [rbx], rax
jmp 0x14015b251
movzx eax, byte [r8 + 2]
movzx ecx, byte [r8]
shl rcx, 8
or rcx, rax
movzx eax, byte [r8 + 1]
movzx edx, cx
movzx ecx, word [rbx + rax*4 + 0x8c]
mov rax, qword [rbx + 0x28]
xor rdx, rcx
lea rcx, [rax + rdx*4]
mov eax, dword [rbx + 8]
mov edx, dword [rcx]
mov dword [rcx], eax
mov ecx, dword [rbx + 0x18]
mov rax, qword [rbx + 0x30]
mov dword [rax + rcx*4], edx
inc qword [rbx]
inc dword [rbx + 8]
inc dword [rbx + 0x18]
mov eax, dword [rbx + 8]
cmp eax, dword [rbx + 0xc]
jne 0x14015b267
mov rcx, rbx
call fcn.14015aac0
add edi, 0xffffffff
jne 0x14015b200
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x14015b280
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
xor eax, eax
mov qword [rcx + 0x60], 4
mov qword [rcx + 0x40], rax
lea r8, [rcx + 0x8c]
mov qword [rcx + 0x28], rax
mov dword [rcx + 0x3c], 0x20
mov qword [rcx + 0x70], 1
nop dword [rax + rax]
mov edx, eax
lea r8, [r8 + 4]
and edx, 1
mov ecx, eax
shr ecx, 1
neg edx
and edx, 0xedb88320
inc eax
xor edx, ecx
mov ecx, edx
shr edx, 1
and ecx, 1
neg ecx
and ecx, 0xedb88320
xor ecx, edx
mov edx, ecx
shr ecx, 1
and edx, 1
neg edx
and edx, 0xedb88320
xor edx, ecx
mov ecx, edx
shr edx, 1
and ecx, 1
neg ecx
and ecx, 0xedb88320
xor ecx, edx
mov edx, ecx
shr ecx, 1
and edx, 1
neg edx
and edx, 0xedb88320
xor edx, ecx
mov ecx, edx
shr edx, 1
and ecx, 1
neg ecx
and ecx, 0xedb88320
xor ecx, edx
mov edx, ecx
shr ecx, 1
and edx, 1
neg edx
and edx, 0xedb88320
xor edx, ecx
mov ecx, edx
shr edx, 1
and ecx, 1
neg ecx
and ecx, 0xedb88320
xor ecx, edx
mov dword [r8 - 4], ecx
cmp eax, 0x100
jb 0x14015b2b0
ret