joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14035ea00
Capabilities:
Encode data using xor

Disassembly:
mov r8d, dword [rsp + 0x28]
test ecx, ecx
je 0x14035eaa1
test edx, edx
je 0x14035ead4
movzx eax, byte [0x14064ba95]
nop dword [rax]
cmp al, 0xa3
je 0x14035eb10
movzx ecx, byte [0x14064bb44]
mov edx, r8d
not dl
mov r9d, r8d
xor r9b, 0xba
and r9b, dl
mov eax, r8d
and al, 0x45
or al, r9b
add al, cl
and dl, 0xa7
mov r9d, r8d
and r9b, 0x58
or r9b, dl
add r9b, cl
lock cmpxchg byte [0x14064ba95], r9b
jne 0x14035ea20
xor eax, eax
lea rcx, [0x14064ba90]
lea rdx, [0x1405480e0]
xor r8d, 0x49ae8b73
nop word [rax + rax]
movzx r9d, byte [rax + rdx]
add byte [rax + rcx], r9b
lea r9d, [rax + 1]
mov r10d, dword [0x14064bb40]
add r10d, r8d
cmp r9d, r10d
jge 0x14035eb08
inc rax
jmp 0x14035ea80
movzx eax, byte [0x14064b930]
cmp al, 3
je 0x14035eacc
mov cl, 0x80
nop
mov al, 0x47
lock cmpxchg byte [0x14064b930], cl
je 0x14035eb18
mov edx, r8d
xor dl, 0x8a
add dl, byte [0x14064bb44]
cmp al, dl
jne 0x14035eab0
lea rax, [0x14064b830]
ret
movzx eax, byte [0x14064baf2]
cmp al, 0x7f
je 0x14035eb00
mov cl, 0x37
nop word cs:[rax + rax]
mov al, 0x38
lock cmpxchg byte [0x14064baf2], cl
je 0x14035eb79
cmp al, 0x7f
jne 0x14035eaf0
lea rax, [0x14064baf0]
ret
mov al, 0xa3
xchg byte [0x14064ba95], al
lea rax, [0x14064ba90]
ret
xor edx, edx
lea rax, [0x14064b830]
lea rcx, [0x140547ea0]
nop dword [rax + rax]
movsxd rdx, edx
movzx r8d, byte [rdx + rax]
movzx r9d, byte [rdx + rcx]
not r8b
mov r10d, r8d
and r10b, r9b
or r8b, r9b
not r8b
or r8b, r10b
mov byte [rdx + rax], r8b
mov r8d, edx
xor r8d, 1
and edx, 1
lea edx, [r8 + rdx*2]
cmp edx, 0x100
jl 0x14035eb30
mov al, 3
xchg byte [0x14064b930], al
lea rax, [0x14064b830]
ret
xor eax, eax
lea rcx, [0x14064baf0]
lea rdx, [0x140548140]
nop dword [rax]
movzx r8d, byte [rax + rdx]
add byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 1
jg 0x14035eba8
inc rax
jmp 0x14035eb90
mov al, 0x7f
xchg byte [0x14064baf2], al
lea rax, [0x14064baf0]
ret
Function at 0x140413cb0
Capabilities:
Encode data using xor

Disassembly:
mov r8d, dword [rsp + 0x28]
test ecx, ecx
je 0x140413cec
test edx, edx
je 0x140413d1c
movzx eax, byte [0x14066bcb3]
cmp al, 0x10
je 0x140413ce4
mov cl, 0x14
nop word [rax + rax]
mov al, 0xcb
lock cmpxchg byte [0x14066bcb3], cl
je 0x140413daa
cmp al, 0x10
jne 0x140413cd0
lea rax, [0x14066bcb0]
ret
test edx, edx
je 0x140413d5c
movzx eax, byte [0x14066bc0d]
cmp al, 0xbe
je 0x140413d14
mov cl, 0xc
nop dword [rax]
mov al, 0x71
lock cmpxchg byte [0x14066bc0d], cl
je 0x140413de8
cmp al, 0xbe
jne 0x140413d00
lea rax, [0x14066bc00]
ret
movzx eax, byte [0x14066bc20]
xor r8b, 0xb5
add r8b, byte [0x14066bfec]
cmp al, r8b
je 0x140413d54
mov cl, 0xc2
nop word cs:[rax + rax]
mov al, 0x3b
lock cmpxchg byte [0x14066bc20], cl
je 0x140413e38
cmp al, 0x1b
jne 0x140413d40
lea rax, [0x14066bc10]
ret
movzx eax, byte [0x14066bd91]
cmp al, 0x2f
je 0x140413da2
mov cl, 0x11
nop dword [rax]
mov al, 0x4c
lock cmpxchg byte [0x14066bd91], cl
je 0x140413e78
movzx edx, byte [0x14066bfec]
mov r9d, r8d
xor r9b, 0xa9
mov r10d, r9d
xor r10b, dl
and r9b, dl
add r9b, r9b
add r9b, r10b
cmp al, r9b
jne 0x140413d70
lea rax, [0x14066bd80]
ret
xor eax, eax
lea rcx, [0x14066bcb0]
lea rdx, [0x140557380]
nop word [rax + rax]
movzx r8d, byte [rax + rdx]
add byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 2
jg 0x140413dd8
inc rax
jmp 0x140413dc0
mov al, 0x10
xchg byte [0x14066bcb3], al
lea rax, [0x14066bcb0]
ret
xor edx, edx
lea rax, [0x14066bc00]
lea rcx, [0x1405572e0]
xor r8d, 0xba11d79a
nop
movsxd rdx, edx
movzx r9d, byte [rdx + rcx]
xor byte [rdx + rax], r9b
mov r9d, dword [0x14066bfe8]
add r9d, r8d
mov r10d, edx
xor r10d, r9d
and r9d, edx
lea edx, [r10 + r9*2]
cmp edx, 0xd
jl 0x140413e00
mov al, 0xbe
xchg byte [0x14066bc0d], al
lea rax, [0x14066bc00]
ret
xor eax, eax
lea rcx, [0x14066bc10]
lea rdx, [0x1405572f0]
nop dword [rax + rax]
movzx r8d, byte [rax + rdx]
add byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0xf
jg 0x140413e68
inc rax
jmp 0x140413e50
mov al, 0x1b
xchg byte [0x14066bc20], al
lea rax, [0x14066bc10]
ret
xor eax, eax
lea rcx, [0x14066bd80]
lea rdx, [0x140557450]
nop dword [rax + rax]
movzx r8d, byte [rax + rdx]
mov r9d, r8d
xor r9b, r8b
not r9b
and r9b, byte [rax + rcx]
xor r9b, r8b
mov byte [rax + rcx], r9b
lea r8d, [rax + 1]
cmp r8d, 0x10
jg 0x140413eb8
inc rax
jmp 0x140413e90
mov al, 0x2f
xchg byte [0x14066bd91], al
lea rax, [0x14066bd80]
ret
Function at 0x14041b4d0
Capabilities:
Hash data using fnv

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x30
movabs rax, 0x800000000000001
cmp rdx, rax
jae 0x14041b6b8
mov rsi, rcx
dec rdx
or rdx, 1
bsr rcx, rdx
xor ecx, 0x3f
neg cl
mov ebx, 1
shl rbx, cl
lea rax, [rsi + 0x18]
mov rdi, qword [rsi + 8]
mov edx, 2
shl rdx, cl
mov rcx, rax
mov r8, rdi
call fcn.140418f60
lea rax, [rbx - 1]
mov qword [rsi + 0x30], rax
mov qword [rsi + 0x38], rbx
mov rax, qword [rsi + 8]
mov rax, qword [rax]
cmp rax, rdi
je 0x14041b6a9
movabs rcx, 0x5a36990cddc6c7b0
movabs rdx, 0x100000001b3
movabs r8, 0x8e43fd2859a4a63e
jmp 0x14041b581
mov qword [r10 + r11*8], r9
mov qword [r10 + r14*8], r9
cmp rax, rdi
je 0x14041b6a9
mov r9, rax
mov rax, qword [rax]
movzx r10d, byte [r9 + 0x10]
mov r11, qword [0x14066ca00]
lea rbx, [r11 + rcx]
xor rbx, r10
imul rbx, rdx
movzx r10d, byte [r9 + 0x11]
xor r10, rbx
imul r10, rdx
movzx ebx, byte [r9 + 0x12]
xor rbx, r10
add r11, r8
imul r11, rbx
movzx r10d, byte [r9 + 0x13]
xor r10, r11
imul r10, rdx
mov rbx, qword [rsi + 0x30]
xor rbx, r10
not rbx
and rbx, r10
mov r10, qword [rsi + 0x18]
lea r11, [rbx + rbx]
lea r14, [rbx + rbx]
inc r14
shl rbx, 4
mov r15, qword [r10 + rbx]
cmp r15, rdi
je 0x14041b570
mov rbx, qword [r10 + r14*8]
mov ebp, dword [0x140694264]
add ebp, dword [r9 + 0x10]
cmp ebp, dword [rbx + 0x10]
jne 0x14041b640
mov r11, qword [rbx]
cmp r11, r9
je 0x14041b574
mov rbx, qword [r9 + 8]
mov qword [rbx], rax
mov r15, qword [rax + 8]
mov qword [r15], r11
mov r12, qword [r11 + 8]
mov qword [r12], r9
mov qword [r11 + 8], r15
mov qword [rax + 8], rbx
mov qword [r9 + 8], r12
jmp 0x14041b574
cmp r15, rbx
je 0x14041b677
mov rbx, qword [rbx + 8]
cmp ebp, dword [rbx + 0x10]
jne 0x14041b640
mov r10, qword [rbx]
mov r11, qword [r9 + 8]
mov qword [r11], rax
mov rbx, qword [rax + 8]
mov qword [rbx], r10
mov r14, qword [r10 + 8]
mov qword [r14], r9
mov qword [r10 + 8], rbx
mov qword [rax + 8], r11
mov qword [r9 + 8], r14
jmp 0x14041b578
mov r14, qword [r9 + 8]
mov qword [r14], rax
mov r15, qword [rax + 8]
mov qword [r15], rbx
mov r12, qword [rbx + 8]
mov qword [r12], r9
mov qword [rbx + 8], r15
mov qword [rax + 8], r14
mov qword [r9 + 8], r12
add r9, qword [0x140696c00]
mov qword [r10 + r11*8], r9
jmp 0x14041b578
add rsp, 0x30
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
mov dword [rsp + 0x20], 0xf17865b9
mov ecx, 1
mov edx, 1
mov r8d, 0xaa1e2772
mov r9d, 0x6bcc5c6b
call fcn.14041fa20
mov rcx, rax
call fcn.1404eb9b4
int3
Function at 0x1404287a0
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
test ecx, ecx
je 0x1404287dc
test edx, edx
je 0x14042880c
movzx eax, byte [0x14066d980]
cmp al, 0xbc
je 0x1404287d4
mov cl, 0x89
nop word cs:[rax + rax]
mov al, 0x1a
lock cmpxchg byte [0x14066d980], cl
je 0x140428876
cmp al, 0xbc
jne 0x1404287c0
lea rax, [0x14066d970]
ret
test edx, edx
je 0x14042883c
movzx eax, byte [0x14066d962]
cmp al, 1
je 0x140428804
mov cl, 0xbc
nop dword [rax]
mov al, 0xc1
lock cmpxchg byte [0x14066d962], cl
je 0x1404288c8
cmp al, 1
jne 0x1404287f0
lea rax, [0x14066d950]
ret
movzx eax, byte [0x14066d920]
cmp al, 0xc3
je 0x140428834
mov cl, 0xcf
nop dword [rax]
mov al, 0x75
lock cmpxchg byte [0x14066d920], cl
je 0x140428911
cmp al, 0xc3
jne 0x140428820
lea rax, [0x14066d910]
ret
movzx eax, byte [0x14066da86]
cmp al, 0x86
je 0x14042886e
mov cl, 0xc0
nop dword [rax]
mov al, 0xa5
lock cmpxchg byte [0x14066da86], cl
je 0x140428958
movzx edx, byte [0x14066e1b0]
add dl, 0x8d
cmp al, dl
jne 0x140428850
lea rax, [0x14066da60]
ret
xor eax, eax
lea rcx, [0x14066d970]
lea rdx, [0x140557c20]
mov r8d, 0x2e70441e
nop dword [rax]
movzx r9d, byte [rax + rdx]
add byte [rax + rcx], r9b
lea r9d, [rax + 1]
mov r10d, dword [0x14066e1c0]
add r10d, r8d
cmp r9d, r10d
jge 0x1404288b1
inc rax
jmp 0x140428890
movzx eax, byte [0x14066e1b0]
add al, 0xc3
xchg byte [0x14066d980], al
lea rax, [0x14066d970]
ret
xor edx, edx
lea rax, [0x14066d950]
lea rcx, [0x140557c00]
nop dword [rax + rax]
movsxd rdx, edx
movzx r8d, byte [rdx + rcx]
xor byte [rdx + rax], r8b
mov r8d, dword [0x14066e1c0]
add edx, r8d
add edx, 0x2e70440f
cmp edx, 0x12
jl 0x1404288e0
mov al, 1
xchg byte [0x14066d962], al
lea rax, [0x14066d950]
ret
xor eax, eax
lea rcx, [0x14066d910]
lea rdx, [0x140557bd0]
nop word cs:[rax + rax]
movzx r8d, byte [rax + rdx]
add byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0xf
jg 0x140428948
inc rax
jmp 0x140428930
mov al, 0xc3
xchg byte [0x14066d920], al
lea rax, [0x14066d910]
ret
xor eax, eax
lea rcx, [0x14066da60]
lea rdx, [0x140557d00]
nop dword [rax + rax]
movzx r8d, byte [rax + rdx]
add byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0x25
jg 0x140428988
inc rax
jmp 0x140428970
mov al, 0x86
xchg byte [0x14066da86], al
lea rax, [0x14066da60]
ret
Function at 0x14042a650
Capabilities:
Encode data using xor

Disassembly:
test ecx, ecx
je 0x14042a68c
test edx, edx
je 0x14042a6cc
movzx eax, byte [0x14066e422]
cmp al, 0xae
je 0x14042a684
mov cl, 0x75
nop word cs:[rax + rax]
mov al, 0xb8
lock cmpxchg byte [0x14066e422], cl
je 0x14042a75c
cmp al, 0xae
jne 0x14042a670
lea rax, [0x14066e420]
ret
mov ecx, dword [rsp + 0x28]
test edx, edx
je 0x14042a6fc
movzx eax, byte [0x14066e45d]
cmp al, 0x8d
je 0x14042a6c4
mov dl, 0xdf
nop word cs:[rax + rax]
mov al, 0x64
lock cmpxchg byte [0x14066e45d], dl
je 0x14042a7be
cmp al, 0x8d
jne 0x14042a6b0
lea rax, [0x14066e450]
ret
movzx eax, byte [0x14066e335]
cmp al, 0xbb
je 0x14042a6f4
mov cl, 0x25
nop dword [rax]
mov al, 0x65
lock cmpxchg byte [0x14066e335], cl
je 0x14042a7e8
cmp al, 0xbb
jne 0x14042a6e0
lea rax, [0x14066e320]
ret
movzx eax, byte [0x14066e2f4]
movzx edx, byte [0x14066e7b0]
mov r8d, ecx
not r8b
xor cl, 0x5c
and r8b, 0xa3
or cl, r8b
not cl
or cl, r8b
mov r8d, ecx
xor r8b, dl
and cl, dl
add cl, cl
add cl, r8b
cmp al, cl
je 0x14042a754
mov cl, 0x7a
nop word cs:[rax + rax]
mov al, 0xc8
lock cmpxchg byte [0x14066e2f4], cl
je 0x14042a83f
cmp al, 0xbd
jne 0x14042a740
lea rax, [0x14066e2f0]
ret
xor edx, edx
lea rax, [0x14066e420]
lea rcx, [0x140557ef0]
nop dword [rax]
movsxd rdx, edx
movzx r8d, byte [rdx + rcx]
add byte [rdx + rax], r8b
mov r8d, edx
not r8d
mov r9d, edx
mov r10d, edx
xor edx, 0x7ffffffe
and edx, r8d
and r8d, 1
and r9d, 0xfffffffe
or r9d, r8d
xor r10d, 1
or edx, r10d
not edx
lea edx, [r9 + rdx*2]
cmp edx, 2
jl 0x14042a770
mov al, 0xae
xchg byte [0x14066e422], al
lea rax, [0x14066e420]
ret
xor eax, eax
lea rdx, [0x14066e450]
lea r8, [0x140557f20]
nop
movzx r9d, byte [rax + r8]
add byte [rax + rdx], r9b
lea r9d, [rax + 1]
cmp r9d, 0xc
jg 0x14042a818
inc rax
jmp 0x14042a7d0
xor eax, eax
lea rcx, [0x14066e320]
lea rdx, [0x140557df0]
nop dword [rax + rax]
movzx r8d, byte [rax + rdx]
xor byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0x14
jg 0x14042a82f
inc rax
jmp 0x14042a800
xor cl, 0x73
add cl, byte [0x14066e7b0]
xchg byte [0x14066e45d], cl
lea rax, [0x14066e450]
ret
mov al, 0xbb
xchg byte [0x14066e335], al
lea rax, [0x14066e320]
ret
xor eax, eax
lea rcx, [0x14066e2f0]
lea rdx, [0x140557dd0]
nop
movzx r8d, byte [rax + rcx]
movzx r9d, byte [rax + rdx]
not r9b
mov r10d, r9d
xor r10b, r8b
and r9b, r10b
or r9b, r8b
not r9b
not r10b
and r10b, r8b
or r10b, r9b
mov byte [rax + rcx], r10b
lea r8d, [rax + 1]
cmp r8d, 3
jg 0x14042a888
inc rax
jmp 0x14042a850
mov al, 0xbd
xchg byte [0x14066e2f4], al
lea rax, [0x14066e2f0]
ret
Function at 0x14042ee70
Capabilities:
Encode data using xor

Disassembly:
mov r8d, dword [rsp + 0x28]
test ecx, ecx
je 0x14042eeac
test edx, edx
je 0x14042ef10
movzx eax, byte [0x14066ea12]
cmp al, 0x91
je 0x14042eea4
mov cl, 0x80
nop
mov al, 0x21
lock cmpxchg byte [0x14066ea12], cl
je 0x14042ef6c
cmp al, 0x91
jne 0x14042ee90
lea rax, [0x14066ea10]
ret
mov eax, r8d
xor eax, 0xfcfb3e09
add eax, dword [0x14066eaa4]
cmp edx, eax
jne 0x14042ef3c
movzx eax, byte [0x14066e8da]
mov ecx, r8d
xor cl, 0x6b
add cl, byte [0x14066eaa0]
cmp al, cl
je 0x14042ef08
nop word cs:[rax + rax]
movzx ecx, byte [0x14066eaa0]
mov eax, r8d
xor al, 0xce
add al, cl
mov edx, r8d
xor dl, 0x86
add dl, cl
lock cmpxchg byte [0x14066e8da], dl
je 0x14042f02f
cmp al, 0x60
jne 0x14042eee0
lea rax, [0x14066e8d0]
ret
movzx eax, byte [0x14066ea7f]
cmp al, 0x44
je 0x14042ef34
mov cl, 0x5d
nop dword [rax]
mov al, 0xad
lock cmpxchg byte [0x14066ea7f], cl
je 0x14042efd1
cmp al, 0x44
jne 0x14042ef20
lea rax, [0x14066ea70]
ret
movzx eax, byte [0x14066e8cc]
cmp al, 0x2f
je 0x14042ef64
mov cl, 0xc3
nop dword [rax]
mov al, 0xc7
lock cmpxchg byte [0x14066e8cc], cl
je 0x14042f07d
cmp al, 0x2f
jne 0x14042ef50
lea rax, [0x14066e8c0]
ret
xor edx, edx
lea rax, [0x14066ea10]
lea rcx, [0x140558200]
xor r8d, 0xfcfb3e16
nop word cs:[rax + rax]
movsxd rdx, edx
movzx r9d, byte [rdx + rcx]
xor byte [rdx + rax], r9b
mov r9d, dword [0x14066eaa4]
add r9d, r8d
mov r10d, r9d
xor r10d, r10d
not r10d
and r10d, edx
xor r10d, r9d
and r9d, edx
lea edx, [r10 + r9*2]
cmp edx, 2
jl 0x14042ef90
mov al, 0x91
xchg byte [0x14066ea12], al
lea rax, [0x14066ea10]
ret
xor eax, eax
lea rcx, [0x14066ea70]
lea rdx, [0x140558260]
nop word cs:[rax + rax]
movzx r8d, byte [rax + rcx]
movzx r9d, byte [rax + rdx]
not r8b
mov r10d, r8d
and r10b, r9b
or r8b, r9b
not r8b
or r8b, r10b
mov byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0xe
jg 0x14042f01f
inc rax
jmp 0x14042eff0
mov al, 0x44
xchg byte [0x14066ea7f], al
lea rax, [0x14066ea70]
ret
xor eax, eax
lea rcx, [0x14066e8d0]
lea rdx, [0x1405580d0]
xor r8d, 0xfcfb3e16
nop word cs:[rax + rax]
cdqe
movzx r9d, byte [rax + rdx]
add byte [rax + rcx], r9b
mov r9d, dword [0x14066eaa4]
add r9d, r8d
add eax, r9d
cmp eax, 0xa
jl 0x14042f050
mov al, 0x60
xchg byte [0x14066e8da], al
lea rax, [0x14066e8d0]
ret
xor eax, eax
lea rcx, [0x14066e8c0]
lea rdx, [0x1405580c0]
nop dword [rax]
movzx r9d, byte [rax + rdx]
add byte [rax + rcx], r9b
lea r9d, [rax + 1]
cmp r9d, 0xb
jg 0x14042f0a8
inc rax
jmp 0x14042f090
movzx eax, byte [0x14066eaa0]
xor r8b, 0xba
mov ecx, r8d
xor cl, al
and r8b, al
add r8b, r8b
add r8b, cl
xchg byte [0x14066e8cc], r8b
lea rax, [0x14066e8c0]
ret

Function at 0x1404316c0
Capabilities:
Parse pe header
Resolve function by parsing pe exports

Disassembly:
mov r8d, 0xd34f698
jmp fcn.140431780
Function at 0x140435670
Capabilities:
Encode data using xor

Disassembly:
mov r8d, dword [rsp + 0x28]
test ecx, ecx
je 0x1404356bc
test edx, edx
je 0x1404356ec
movzx eax, byte [0x140670afd]
xor r8b, 0xfe
add r8b, byte [0x140670b48]
cmp al, r8b
je 0x1404356b4
mov cl, 0x91
nop word cs:[rax + rax]
mov al, 2
lock cmpxchg byte [0x140670afd], cl
je 0x14043574c
cmp al, 0x84
jne 0x1404356a0
lea rax, [0x140670af0]
ret
test edx, edx
je 0x14043571c
movzx eax, byte [0x14067092c]
cmp al, 0x6f
je 0x1404356e4
mov cl, 0xed
nop dword [rax]
mov al, 0x83
lock cmpxchg byte [0x14067092c], cl
je 0x140435788
cmp al, 0x6f
jne 0x1404356d0
lea rax, [0x140670920]
ret
movzx eax, byte [0x140670a9d]
cmp al, 0x67
je 0x140435714
mov cl, 0x68
nop dword [rax]
mov al, 0xbd
lock cmpxchg byte [0x140670a9d], cl
je 0x1404357cf
cmp al, 0x67
jne 0x140435700
lea rax, [0x140670a90]
ret
movzx eax, byte [0x1406709ac]
cmp al, 3
je 0x140435744
mov cl, 0xb1
nop dword [rax]
mov al, 0x49
lock cmpxchg byte [0x1406709ac], cl
je 0x140435818
cmp al, 3
jne 0x140435730
lea rax, [0x140670990]
ret
xor eax, eax
lea rcx, [0x140670af0]
lea rdx, [0x140558a30]
nop dword [rax]
movzx r8d, byte [rax + rdx]
xor byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0xc
jg 0x140435778
inc rax
jmp 0x140435760
mov al, 0x84
xchg byte [0x140670afd], al
lea rax, [0x140670af0]
ret
xor edx, edx
lea rax, [0x140670920]
lea rcx, [0x140558870]
nop dword [rax + rax]
movsxd rdx, edx
movzx r8d, byte [rdx + rcx]
xor byte [rdx + rax], r8b
mov r8d, edx
xor r8d, 1
and edx, 1
lea edx, [r8 + rdx*2]
cmp edx, 0xc
jl 0x1404357a0
mov al, 0x6f
xchg byte [0x14067092c], al
lea rax, [0x140670920]
ret
xor eax, eax
lea rcx, [0x140670a90]
lea rdx, [0x1405589d0]
nop
movzx r8d, byte [rax + rdx]
mov r9d, r8d
xor r9b, r8b
not r9b
and r9b, byte [rax + rcx]
xor r9b, r8b
mov byte [rax + rcx], r9b
lea r8d, [rax + 1]
cmp r8d, 0xc
jg 0x140435808
inc rax
jmp 0x1404357e0
mov al, 0x67
xchg byte [0x140670a9d], al
lea rax, [0x140670a90]
ret
xor eax, eax
lea rcx, [0x140670990]
lea rdx, [0x1405588d0]
nop dword [rax + rax]
movzx r9d, byte [rax + rdx]
add byte [rax + rcx], r9b
lea r9d, [rax + 1]
cmp r9d, 0x1b
jg 0x140435848
inc rax
jmp 0x140435830
xor r8b, 0x7d
add r8b, byte [0x140670b48]
xchg byte [0x1406709ac], r8b
lea rax, [0x140670990]
ret
Function at 0x14043bff0
Capabilities:
Encode data using xor

Disassembly:
push rsi
mov r8d, dword [rsp + 0x30]
mov r9d, dword [0x1406713a0]
mov eax, r8d
xor eax, 0xe1ad52f8
mov r10d, r8d
xor r10d, 0x1e52ad07
mov r11d, r9d
not r11d
mov esi, eax
and esi, r11d
and r11d, r10d
and r10d, r9d
or esi, r10d
xor r9d, eax
or r11d, r9d
not r11d
lea r9d, [rsi + r11*2]
cmp ecx, r9d
jne 0x14043c089
test edx, edx
je 0x14043c0f9
movzx eax, byte [0x14067119d]
movzx ecx, byte [0x1406713b0]
mov edx, r8d
xor dl, 0xe2
xor r8b, dl
xor r8b, 0x1d
and r8b, cl
xor r8b, dl
and dl, cl
add dl, dl
add dl, r8b
cmp al, dl
je 0x14043c175
mov cl, 0xe1
nop
mov al, 0x4b
lock cmpxchg byte [0x14067119d], cl
je 0x14043c129
cmp al, 0x5f
jne 0x14043c070
jmp 0x14043c175
add eax, dword [0x1406713a0]
cmp edx, eax
jne 0x14043c0c9
movzx eax, byte [0x140671152]
cmp al, 0x83
je 0x14043c1cc
mov cl, 0xdf
nop word cs:[rax + rax]
mov al, 0xa7
lock cmpxchg byte [0x140671152], cl
je 0x14043c17e
cmp al, 0x83
jne 0x14043c0b0
jmp 0x14043c1cc
movzx eax, byte [0x14067109c]
cmp al, 0x17
je 0x14043c223
mov cl, 0x46
nop word [rax + rax]
mov al, 0x7c
lock cmpxchg byte [0x14067109c], cl
je 0x14043c1d5
cmp al, 0x17
jne 0x14043c0e0
jmp 0x14043c223
movzx eax, byte [0x14067116b]
cmp al, 0x12
je 0x14043c260
mov cl, 0xc4
nop word [rax + rax]
mov al, 0x15
lock cmpxchg byte [0x14067116b], cl
je 0x14043c22c
cmp al, 0x12
jne 0x14043c110
jmp 0x14043c260
xor edx, edx
lea rax, [0x140671190]
lea rcx, [0x140559310]
nop dword [rax]
movsxd r8, edx
movzx edx, byte [r8 + rax]
movzx r9d, byte [r8 + rcx]
mov r10d, edx
xor r10b, r9b
and dl, r9b
add dl, dl
add dl, r10b
mov byte [r8 + rax], dl
lea edx, [r8 + r8]
sub edx, r8d
inc edx
cmp edx, 0xd
jl 0x14043c140
mov al, 0x5f
xchg byte [0x14067119d], al
lea rax, [0x140671190]
pop rsi
ret
xor edx, edx
lea rax, [0x140671150]
lea rcx, [0x1405592d0]
xor r8d, 0xe1ad52c6
nop word cs:[rax + rax]
movsxd r9, edx
movzx edx, byte [r9 + rcx]
xor byte [r9 + rax], dl
lea edx, [r9 + r9]
sub edx, r9d
inc edx
mov r9d, dword [0x1406713a0]
add r9d, r8d
cmp edx, r9d
jl 0x14043c1a0
mov al, 0x83
xchg byte [0x140671152], al
lea rax, [0x140671150]
pop rsi
ret
xor edx, edx
lea rax, [0x140671080]
lea rcx, [0x140559200]
nop word cs:[rax + rax]
movsxd rdx, edx
movzx r8d, byte [rdx + rcx]
add byte [rdx + rax], r8b
add edx, 0xd2ef246
mov r8d, edx
xor r8d, 1
and edx, 1
lea edx, [r8 + rdx*2]
add edx, 0xf2d10dba
cmp edx, 0x1c
jl 0x14043c1f0
mov al, 0x17
xchg byte [0x14067109c], al
lea rax, [0x140671080]
pop rsi
ret
xor eax, eax
lea rcx, [0x140671160]
lea rdx, [0x1405592e0]
nop dword [rax]
movzx r8d, byte [rax + rdx]
add byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0xa
jg 0x14043c258
inc rax
jmp 0x14043c240
mov al, 0x12
xchg byte [0x14067116b], al
lea rax, [0x140671160]
pop rsi
ret
Function at 0x14043c270
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
mov eax, dword [0x1406713a0]
mov edx, r9d
xor edx, 0x663c45a8
lea r8d, [rdx - 0x3dc01c5f]
xor r8d, eax
mov r10d, 0x3dc01c5e
sub r10d, edx
not eax
and eax, r10d
or eax, r8d
not eax
add eax, eax
mov edx, r8d
xor edx, eax
and eax, r8d
lea eax, [rdx + rax*2]
mov edx, eax
xor edx, 0x356a396
and eax, 0x356a396
lea eax, [rdx + rax*2]
add eax, 0x3a6978c9
cmp ecx, eax
jne 0x14043c2f5
movzx eax, byte [0x140671136]
cmp al, 0xca
je 0x14043c396
mov cl, 0xc2
nop word cs:[rax + rax]
mov al, 0xb8
lock cmpxchg byte [0x140671136], cl
je 0x14043c329
cmp al, 0xca
jne 0x14043c2e0
jmp 0x14043c396
movzx eax, byte [0x140671211]
cmp al, 0xe2
je 0x14043c3d0
mov cl, 0x16
nop word cs:[rax + rax]
mov al, 0x56
lock cmpxchg byte [0x140671211], cl
je 0x14043c39f
cmp al, 0xe2
jne 0x14043c310
jmp 0x14043c3d0
xor eax, eax
lea rcx, [0x140671110]
lea rdx, [0x140559290]
mov r8d, r9d
xor r8d, 0x663c4597
xor r9d, 0x99c3ba68
nop word [rax + rax]
cdqe
movzx r10d, byte [rax + rdx]
add byte [rax + rcx], r10b
mov r10d, dword [0x1406713a0]
mov r11d, r10d
not r11d
mov esi, r9d
and esi, r10d
mov edi, r8d
and edi, r11d
or edi, esi
xor r10d, r8d
and r11d, r9d
or r11d, r10d
not r11d
lea r10d, [rdi + r11*2]
add eax, r10d
cmp eax, 0x26
jl 0x14043c350
mov al, 0xca
xchg byte [0x140671136], al
lea rax, [0x140671110]
jmp 0x14043c3d7
xor eax, eax
lea rcx, [0x140671200]
lea rdx, [0x140559380]
nop
movzx r8d, byte [rax + rdx]
add byte [rax + rcx], r8b
lea r8d, [rax + 1]
cmp r8d, 0x10
jg 0x14043c3c8
inc rax
jmp 0x14043c3b0
mov al, 0xe2
xchg byte [0x140671211], al
lea rax, [0x140671200]
pop rdi
pop rsi
ret
Function at 0x140448a60
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x58
mov ebp, dword [0x140693a6c]
test rcx, rcx
je 0x140448b4a
mov rsi, rdx
mov rdi, rcx
xor r14d, r14d
nop dword [rax + rax]
mov eax, r14d
mov ecx, r14d
add rcx, qword [0x140693e30]
movzx edx, word [0x1406973a8]
xor r14d, r14d
add dx, word [rdi + rcx*2]
setne r14b
add r14d, eax
cmp word [rdi + r14*2], 0
jne 0x140448a90
test r14d, r14d
je 0x140448b88
mov eax, dword [0x140673c70]
sub eax, ebp
add eax, 0xa858
cdqe
add rax, qword [0x140673c88]
mov dword [rsp + 0x38], 0x54d28185
mov dword [rsp + 0x30], 0xa085943c
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor ebx, ebx
mov ecx, 1
xor edx, edx
xor r8d, r8d
xor r9d, r9d
call qword [0x1405fc400]
test rax, rax
je 0x140448b8a
mov rcx, qword [rax + 0x10]
xor ebx, ebx
test rcx, rcx
je 0x140448b8a
mov rdx, qword [rax + 0x18]
test rdx, rdx
je 0x140448b8a
inc r14d
mov r8d, r14d
mov qword [rsp + 0x50], r8
xor ebx, ebx
mov r15d, 1
mov r8, rcx
xor r13d, r13d
mov qword [rsp + 0x48], rsi
jmp 0x140448bdc
or ebp, dword [0x140673c74]
add ebp, 0xa858
movsxd rax, ebp
add rax, qword [0x140673c80]
mov dword [rsp + 0x20], 0xfe0029fc
xor ebx, ebx
xor ecx, ecx
xor edx, edx
xor r8d, r8d
mov r9d, 0x38a9eafb
call qword [0x1405fc400]
test rax, rax
je 0x140448b8a
mov rbx, qword [rax + 0x10]
jmp 0x140448b8a
xor ebx, ebx
mov rax, rbx
add rsp, 0x58
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov r15d, 1
nop word cs:[rax + rax]
mov r10, qword [r8]
test r10, r10
cmovne r8, r10
movzx r13d, r9b
cmove r13d, r15d
mov r9d, r13d
not r9b
mov r10d, r13d
xor r10b, 1
and r9b, 0xfe
or r9b, r10b
cmp r9b, 0xff
jne 0x140448b8a
cmp rcx, qword [rax + 0x10]
je 0x140448c3f
mov eax, dword [0x140673c70]
or eax, ebp
add eax, 0xa858
cdqe
add rax, qword [0x140673c88]
mov dword [rsp + 0x38], 0x54d28185
mov dword [rsp + 0x30], 0xa085943c
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
mov ecx, 1
xor edx, edx
xor r8d, r8d
xor r9d, r9d
call qword [0x1405fc400]
test rax, rax
je 0x140448b8a
mov rcx, qword [rax + 0x10]
mov rdx, qword [rax + 0x18]
mov r8, rcx
mov r9d, r13d
and r9b, 1
add r9b, byte [0x1406952d8]
jne 0x140448bc2
cmp r8, rdx
movzx r9d, r13b
cmove r9d, r15d
add r9b, byte [0x140697388]
movzx r10d, word [r8 + 0x58]
add r10d, dword [0x140693a6c]
cmp r14d, r10d
ja 0x140448bb0
mov r10, qword [r8 + 0x60]
test r10, r10
je 0x140448bb0
cmp r10, 0xffff
je 0x140448bb0
test r14d, r14d
je 0x140448cf1
xor r11d, r11d
jmp 0x140448cb4
mov rsi, qword [0x140695670]
add r11, rsi
inc r11
cmp r11, qword [rsp + 0x50]
je 0x140448cf1
movzx esi, word [rdi + r11*2]
lea r12d, [rsi - 0x61]
lea r13d, [rsi - 0x20]
cmp r12w, 0x1a
cmovae r13d, esi
test r13w, r13w
je 0x140448ca0
movzx esi, word [r10 + r11*2]
lea r12d, [rsi - 0x61]
lea r15d, [rsi - 0x20]
cmp r12w, 0x1a
cmovae r15d, esi
cmp r13w, r15w
je 0x140448ca0
jmp 0x140448b9e
mov rbx, qword [r8 + 0x30]
mov r9b, 1
mov rsi, qword [rsp + 0x48]
test rsi, rsi
mov r15d, 1
je 0x140448bb0
mov qword [rsi], r8
jmp 0x140448bb0