joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140185870
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r14
mov eax, 0x13f0
call fcn.1402807a0
sub rsp, rax
mov rax, qword [0x1403b9868]
xor rax, rsp
mov qword [rsp + 0x13e0], rax
mov r14, rdx
mov rsi, rcx
mov qword [rsp + 0x28], rcx
xor edi, edi
mov dword [rsp + 0x20], edi
mov r8b, 0x30
call fcn.1400b9c60
mov ebx, 1
mov dword [rsp + 0x20], ebx
xorps xmm0, xmm0
movups xmmword [rsp + 0x30], xmm0
lea edx, [rdi + 0x40]
lea rcx, [rsp + 0x30]
call fcn.1400626a0
mov rbp, rax
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x40], 0x3e
mov qword [rsp + 0x48], 0x3f
movups xmm0, xmmword [str.abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ1234567890]
movups xmmword [rax], xmm0
movups xmm1, xmmword [0x1402cd180]
movups xmmword [rax + 0x10], xmm1
movups xmm0, xmmword [0x1402cd190]
movups xmmword [rax + 0x20], xmm0
movsd xmm0, qword [0x1402cd1a0]
movsd qword [rax + 0x30], xmm0
mov eax, dword [0x1402cd1a8]
mov dword [rbp + 0x38], eax
movzx eax, word [0x1402cd1ac]
mov word [rbp + 0x3c], ax
mov byte [rbp + 0x3e], dil
mov rdx, r14
mov rcx, rsi
call fcn.140068570
call fcn.14025b890
mov ecx, eax
mov dword [rsp + 0x13d4], 0xffffffff
mov dword [rsp + 0x54], eax
nop dword [rax]
nop dword [rax + rax]
mov eax, ecx
shr eax, 0x1e
xor eax, ecx
imul ecx, eax, 0x6c078965
add ecx, ebx
mov dword [rsp + rbx*4 + 0x54], ecx
inc rbx
cmp rbx, 0x270
jb 0x140185960
mov dword [rsp + 0x50], 0x270
test r14, r14
je 0x1401859ea
lea rax, [rsp + 0x50]
mov qword [rsp + 0x28], rax
lea rcx, [rsp + 0x28]
call fcn.14016e4f0
mov ecx, eax
imul rax, rcx, 0x3e
cmp eax, 3
ja 0x1401859c5
nop dword [rax + rax]
lea rcx, [rsp + 0x28]
call fcn.14016e4f0
mov ecx, eax
imul rax, rcx, 0x3e
cmp eax, 4
jb 0x1401859b0
shr rax, 0x20
movsxd r8, eax
mov rax, rsi
cmp qword [rsi + 0x18], 0x10
jb 0x1401859d9
mov rax, qword [rsi]
movzx r8d, byte [r8 + rbp]
mov byte [rax + rdi], r8b
inc rdi
cmp rdi, r14
jb 0x140185996
mov edx, 0x40
mov rcx, rbp
call fcn.140280300
mov rax, rsi
mov rcx, qword [rsp + 0x13e0]
xor rcx, rsp
call fcn.1402806f0
lea r11, [rsp + 0x13f0]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret
Function at 0x140189030
Capabilities:
Parse credit card information

Disassembly:
mov rax, qword [rdx]
mov r9, rdx
cmp rax, qword [rcx + 0x10]
jae 0x140189208
mov rdx, qword [rcx + 0x18]
mov r8, rcx
cmp rdx, 0x10
jb 0x140189050
mov r8, qword [rcx]
cmp byte [rax + r8], 0x28
je 0x140189208
mov r8, rcx
cmp rdx, 0x10
jb 0x140189067
mov r8, qword [rcx]
cmp byte [rax + r8], 0x29
je 0x140189208
mov r8, rcx
cmp rdx, 0x10
jb 0x14018907e
mov r8, qword [rcx]
cmp byte [rax + r8], 0x3c
je 0x140189208
mov r8, rcx
cmp rdx, 0x10
jb 0x140189095
mov r8, qword [rcx]
cmp byte [rax + r8], 0x3e
je 0x140189208
mov r8, rcx
cmp rdx, 0x10
jb 0x1401890ac
mov r8, qword [rcx]
cmp byte [rax + r8], 0x40
je 0x140189208
mov r8, rcx
cmp rdx, 0x10
jb 0x1401890c3
mov r8, qword [rcx]
cmp byte [rax + r8], 0x2c
je 0x140189208
mov r8, rcx
cmp rdx, 0x10
jb 0x1401890da
mov r8, qword [rcx]
cmp byte [r8 + rax], 0x3b
je 0x140189208
mov r8, rcx
cmp rdx, 0x10
jb 0x1401890f1
mov r8, qword [rcx]
cmp byte [r8 + rax], 0x3a
je 0x140189208
mov r8, rcx
cmp rdx, 0x10
jb 0x140189108
mov r8, qword [rcx]
cmp byte [r8 + rax], 0x5c
je 0x140189208
mov r8, rcx
cmp rdx, 0x10
jb 0x14018911f
mov r8, qword [rcx]
cmp byte [r8 + rax], 0x22
je 0x140189208
mov r8, rcx
cmp rdx, 0x10
jb 0x140189136
mov r8, qword [rcx]
cmp byte [r8 + rax], 0x2f
je 0x140189208
mov r8, rcx
cmp rdx, 0x10
jb 0x14018914d
mov r8, qword [rcx]
cmp byte [r8 + rax], 0x5b
je 0x140189208
mov r8, rcx
cmp rdx, 0x10
jb 0x140189164
mov r8, qword [rcx]
cmp byte [r8 + rax], 0x5d
je 0x140189208
mov r8, rcx
cmp rdx, 0x10
jb 0x14018917b
mov r8, qword [rcx]
cmp byte [r8 + rax], 0x3f
je 0x140189208
mov r8, rcx
cmp rdx, 0x10
jb 0x140189192
mov r8, qword [rcx]
cmp byte [r8 + rax], 0x3d
je 0x140189208
mov r8, rcx
cmp rdx, 0x10
jb 0x1401891a5
mov r8, qword [rcx]
cmp byte [r8 + rax], 0x7b
je 0x140189208
mov r8, rcx
cmp rdx, 0x10
jb 0x1401891b8
mov r8, qword [rcx]
cmp byte [r8 + rax], 0x7d
je 0x140189208
mov r8, rcx
cmp rdx, 0x10
jb 0x1401891cb
mov r8, qword [rcx]
cmp byte [r8 + rax], 0x3d
je 0x140189208
mov r8, rcx
cmp rdx, 0x10
jb 0x1401891de
mov r8, qword [rcx]
cmp byte [r8 + rax], 0x20
je 0x140189208
mov r8, rcx
cmp rdx, 0x10
jb 0x1401891f1
mov r8, qword [rcx]
cmp byte [r8 + rax], 9
je 0x140189208
inc rax
mov qword [r9], rax
cmp rax, qword [rcx + 0x10]
jb 0x140189040
ret
Function at 0x1401b8970
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push r14
mov eax, 0x20
call fcn.1402807a0
sub rsp, rax
mov rax, qword [rcx + 8]
lea r14d, [r9 + 1]
mov rbx, rdx
mov r9, qword [rax + 0xc8]
mov rsi, rcx
test byte [r9 + 0x70], 1
je 0x1401b89c7
mov ecx, dword [rdx + 4]
lea eax, [r14 + r8]
cmp eax, ecx
jbe 0x1401b89b4
xor eax, eax
add rsp, 0x20
pop r14
pop rsi
pop rbx
ret
mov eax, r8d
add qword [rdx + 0x10], rax
add qword [rdx + 0x18], rax
sub ecx, r8d
mov dword [rdx + 4], ecx
jmp 0x1401b89cd
cmp r14d, dword [rdx + 4]
ja 0x1401b89a9
mov ecx, dword [rdx + 4]
mov rax, qword [rdx + 0x10]
mov qword [rsp + 0x48], rbp
dec ecx
or ebp, 0xffffffff
test dword [rsi + 0x19c], 0x200
mov qword [rsp + 0x50], rdi
movzx edi, byte [rcx + rax]
je 0x1401b8a40
cmp qword [rsi + 0xe0], 0
jne 0x1401b8a40
mov rcx, qword [rsi + 0x80]
lea rdx, [0x1403e8690]
mov r8d, 8
add rcx, 8
call fcn.1401c1bb0
test eax, eax
jne 0x1401b8a2e
test dil, 1
jne 0x1401b8a2e
mov rax, qword [rsi + 0x80]
or dword [rax], 8
mov rax, qword [rsi + 0x80]
test byte [rax], 8
je 0x1401b8a40
test edi, edi
je 0x1401b8a40
add edi, ebp
mov rcx, qword [rsi + 0xd0]
mov rcx, qword [rcx]
call fcn.1401e2db0
bt eax, 0x15
jae 0x1401b8a64
sub ebp, edi
mov eax, 1
add dword [rbx + 4], ebp
jmp 0x1401b8b2b
mov r11d, dword [rbx + 4]
lea ecx, [rdi + r14]
mov esi, 0xff
mov r8d, r11d
mov eax, r11d
sub r8d, ecx
xor eax, ecx
xor r8d, ecx
or r8d, eax
lea eax, [r11 - 1]
xor r8d, r11d
shr r8d, 0x1f
dec r8d
cmp eax, esi
cmovb esi, eax
xor r9d, r9d
test esi, esi
je 0x1401b8aed
mov rbp, qword [rbx + 0x10]
mov r10d, edi
shr r10d, 0x1f
nop word [rax + rax]
movzx eax, r10b
mov ecx, r9d
mov edx, edi
sub edx, r9d
shr ecx, 0x1f
shr edx, 0x1f
xor al, cl
xor dl, cl
or dl, al
mov eax, r11d
xor dl, r10b
sub eax, r9d
inc r9d
dec dl
dec eax
movzx ecx, byte [rax + rbp]
movzx edx, dl
xor ecx, edi
and edx, ecx
not edx
and r8d, edx
cmp r9d, esi
jb 0x1401b8ab0
not r8d
movzx eax, r8b
lea ecx, [rax - 1]
not eax
shr eax, 0x1f
shr ecx, 0x1f
and ecx, eax
lea eax, [rdi + 1]
neg ecx
and eax, ecx
sub r11d, eax
shl eax, 8
or dword [rbx], eax
mov dword [rbx + 4], r11d
mov dword [rsp + 0x58], ecx
not ecx
mov dword [rsp + 0x40], ecx
mov eax, dword [rsp + 0x58]
mov ecx, dword [rsp + 0x40]
and eax, 1
or eax, ecx
mov rbp, qword [rsp + 0x48]
mov rdi, qword [rsp + 0x50]
add rsp, 0x20
pop r14
pop rsi
pop rbx
ret
Function at 0x1401bd2b0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rbx
push rdi
mov eax, 0x20
call fcn.1402807a0
sub rsp, rax
mov edi, edx
mov rbx, rcx
test edx, edx
jle 0x1401bd2dc
mov eax, 1
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
call fcn.1401c0650
test eax, eax
je 0x1401bd312
mov rcx, rbx
call fcn.140193280
test eax, 0x3000
jne 0x1401bd31f
cmp dword [rbx + 0x284], 0
jne 0x1401bd31f
mov rcx, rbx
call fcn.14018a5d0
mov edx, 1
mov rcx, rax
call fcn.1401c4b90
mov eax, edi
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
mov rcx, rbx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp fcn.1401c0560

Function at 0x1401c0560
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push rbx
mov eax, 0x20
call fcn.1402807a0
sub rsp, rax
lea rdx, [rsp + 0x38]
mov rbx, rcx
call fcn.1401c0450
test rax, rax
je 0x1401c0646
cmp dword [rsp + 0x38], 0
jg 0x1401c0646
cmp dword [rsp + 0x3c], 0
jg 0x1401c0646
mov rcx, qword [rbx + 0x88]
movzx eax, word [rcx + 0x31c]
add ax, ax
mov word [rcx + 0x31c], ax
mov rax, qword [rbx + 0x88]
cmp word [rax + 0x31c], 0x3c
jbe 0x1401c05d0
mov ecx, 0x3c
mov word [rax + 0x31c], cx
mov rcx, rbx
call fcn.1401c0880
mov rcx, rbx
call fcn.1401bfcd0
test eax, eax
jns 0x1401c05ed
or eax, 0xffffffff
add rsp, 0x20
pop rbx
ret
mov rax, qword [rbx + 0x88]
inc dword [rax + 0x308]
mov rax, qword [rbx + 0x88]
cmp dword [rax + 0x308], 2
jbe 0x1401c0614
mov dword [rax + 0x308], 1
cmp dword [rbx + 0x284], 0
mov rcx, rbx
je 0x1401c0634
mov dword [rbx + 0x284], 0
add rsp, 0x20
pop rbx
jmp fcn.1401bc8c0
call fcn.1401c0880
mov rcx, rbx
add rsp, 0x20
pop rbx
jmp fcn.1401bd680
xor eax, eax
add rsp, 0x20
pop rbx
ret

Function at 0x1401c1bb0
Capabilities:
Encode data using xor

Disassembly:
xor r9b, r9b
mov r10, rdx
test r8, r8
je 0x1401c1bd6
sub r10, rcx
nop
movzx edx, byte [r10 + rcx]
movzx eax, byte [rcx]
lea rcx, [rcx + 1]
xor dl, al
or r9b, dl
dec r8
jne 0x1401c1bc0
movzx eax, r9b
ret
Function at 0x1401c5e70
Capabilities:
Check if file exists

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
mov eax, 0x30
call fcn.1402807a0
sub rsp, rax
mov rbx, rdx
mov rsi, rcx
call fcn.1401c5fc0
mov rdi, rax
test rax, rax
jne 0x1401c5f49
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea r9, [0x140382bf0]
lea edx, [rdi + 1]
lea ecx, [rdi + 2]
mov r8d, eax
mov dword [rsp + 0x20], 0xaf
call fcn.1401c3730
lea rax, [0x140382c08]
lea r9, [0x140382c0c]
mov qword [rsp + 0x28], rax
lea rdx, [0x140382c10]
lea ecx, [rdi + 5]
mov r8, rsi
mov qword [rsp + 0x20], rbx
call fcn.1401c2db0
call fcn.14028cdb8
cmp dword [rax], 2
je 0x1401c5f15
call fcn.14028cdb8
cmp dword [rax], 6
je 0x1401c5f15
mov dword [rsp + 0x20], 0xb8
lea r9, [0x140382c30]
lea r8d, [rdi + 2]
jmp 0x1401c5f2a
mov dword [rsp + 0x20], 0xb6
lea r9, [0x140382c18]
mov r8d, 0x80
mov edx, WSASetLastError
lea ecx, [rdx - 0x4d]
call fcn.1401c3730
xor eax, eax
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
lea rcx, [0x140382b90]
call fcn.1401c4720
mov rbx, rax
test rax, rax
jne 0x1401c5f77
mov rcx, rdi
call fcn.14028bae0
xor eax, eax
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
xor edx, edx
mov rcx, rax
call fcn.1401c4190
mov edx, 0x6a
mov r9, rdi
lea r8d, [rdx - 0x69]
mov rcx, rbx
call fcn.1401c41c0
mov rsi, qword [rsp + 0x48]
mov rax, rbx
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret

Function at 0x1401ccae0
Capabilities:
Hash data with md5

Disassembly:
push rbx
mov eax, 0x20
call fcn.1402807a0
sub rsp, rax
lea r8d, [rax + 0x3c]
xor edx, edx
mov rbx, rcx
call fcn.140283160
mov dword [rbx], 0x67452301
mov dword [rbx + 4], 0xefcdab89
mov dword [rbx + 8], 0x98badcfe
mov dword [rbx + 0xc], 0x10325476
mov eax, 1
add rsp, 0x20
pop rbx
ret

Function at 0x1401d7ad0
Capabilities:
Encode data using xor

Disassembly:
xor edx, edx
mov r9, rcx
test rcx, rcx
je 0x1401d7b2a
movzx eax, byte [rcx]
test al, al
je 0x1401d7b2a
mov r10d, 0x100
nop word [rax + rax]
movsx r8d, al
lea r9, [r9 + 1]
or r8d, r10d
add r10d, 0x100
mov eax, r8d
shr eax, 2
xor eax, r8d
and eax, 0xf
movzx ecx, al
movzx eax, byte [r9]
imul r8d, r8d
rol edx, cl
xor edx, r8d
test al, al
jne 0x1401d7af0
mov eax, edx
shr eax, 0x10
xor eax, edx
ret
xor eax, eax
ret
Function at 0x1401e73d0
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r14
mov eax, 0xb8
call fcn.1402807a0
sub rsp, rax
mov rax, qword [0x1403b9868]
xor rax, rsp
mov qword [rsp + 0xa0], rax
mov r12, qword [rsp + 0x110]
xor ebx, ebx
mov rbp, r9
movsxd rsi, r8d
mov r14, rdx
mov rdi, rcx
mov eax, ebx
test r9, r9
je 0x1401e7436
cmp r9, qword [rcx]
je 0x1401e742c
test rdx, rdx
je 0x1401e7629
test r8d, r8d
js 0x1401e7629
mov eax, 1
mov qword [rcx], r9
jmp 0x1401e7442
mov rbp, qword [rcx]
test rbp, rbp
je 0x1401e7629
mov qword [rsp + 0xb0], r15
test rdx, rdx
je 0x1401e7525
mov rcx, rbp
call fcn.1401e3260
mov r15d, eax
cmp eax, 0x80
jle 0x1401e747d
lea r8, str.j____int_sizeof_ctx__key_
lea rcx, str..cryptohmachmac.c
mov edx, reloc.WS2_32.dll_WSACleanup
call fcn.1401c21f0
cmp r15d, esi
jge 0x1401e74d4
lea rcx, [rdi + 8]
mov r8, r12
mov rdx, rbp
call fcn.1401d8bd0
test eax, eax
je 0x1401e7618
lea rcx, [rdi + 8]
mov r8, rsi
mov rdx, r14
call fcn.1401d8e30
test eax, eax
je 0x1401e7618
lea r14, [rdi + 0x98]
lea rdx, [rdi + 0x9c]
lea rcx, [rdi + 8]
mov r8, r14
call fcn.1401d8af0
test eax, eax
je 0x1401e7618
jmp 0x1401e74fc
cmp esi, 0x80
ja 0x1401e7618
lea rcx, [rdi + 0x9c]
mov r8, rsi
mov rdx, r14
call fcn.140282ac0
lea r14, [rdi + 0x98]
mov dword [r14], esi
mov ecx, dword [r14]
cmp ecx, 0x80
je 0x1401e752d
mov eax, ecx
mov r8d, 0x80
xor edx, edx
sub r8d, ecx
lea rcx, [rdi + 0x9c]
add rcx, rax
call fcn.140283160
jmp 0x1401e752d
test eax, eax
je 0x1401e7607
lea rcx, [rsp + 0x20]
mov rax, rdi
mov rdx, rbx
sub rax, rcx
lea rsi, [rax + 0x9c]
lea r14, [rax + 0x9d]
nop dword [rax]
lea rcx, [rsp + 0x20]
add rcx, rdx
add rdx, 2
movzx eax, byte [rsi + rcx]
xor al, 0x36
mov byte [rcx], al
movzx eax, byte [r14 + rcx]
xor al, 0x36
mov byte [rcx + 1], al
cmp rdx, 0x80
jl 0x1401e7550
lea rcx, [rdi + 0x38]
mov r8, r12
mov rdx, rbp
call fcn.1401d8bd0
test eax, eax
je 0x1401e7618
mov rcx, rbp
call fcn.1401e3260
lea rdx, [rsp + 0x20]
lea rcx, [rdi + 0x38]
movsxd r8, eax
call fcn.1401d8e30
test eax, eax
je 0x1401e7618
nop dword [rax + rax]
lea rcx, [rsp + 0x20]
add rcx, rbx
add rbx, 2
movzx eax, byte [rsi + rcx]
xor al, 0x5c
mov byte [rcx], al
movzx eax, byte [r14 + rcx]
xor al, 0x5c
mov byte [rcx + 1], al
cmp rbx, 0x80
jl 0x1401e75b0
lea rcx, [rdi + 0x68]
mov r8, r12
mov rdx, rbp
call fcn.1401d8bd0
test eax, eax
je 0x1401e7618
mov rcx, rbp
call fcn.1401e3260
lea rdx, [rsp + 0x20]
lea rcx, [rdi + 0x68]
movsxd r8, eax
call fcn.1401d8e30
test eax, eax
je 0x1401e7618
lea rdx, [rdi + 0x38]
lea rcx, [rdi + 8]
call fcn.1401d8f40
test eax, eax
jne 0x1401e761c
xor eax, eax
jmp 0x1401e7621
mov eax, 1
mov r15, qword [rsp + 0xb0]
mov rcx, qword [rsp + 0xa0]
xor rcx, rsp
call fcn.1402806f0
add rsp, 0xb8
pop r14
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x1401ec040
Capabilities:
Hash data using sha1

Disassembly:
push rbx
mov eax, 0x20
call fcn.1402807a0
sub rsp, rax
lea r8d, [rax + 0x40]
xor edx, edx
mov rbx, rcx
call fcn.140283160
mov dword [rbx], 0x67452301
mov dword [rbx + 4], 0xefcdab89
mov dword [rbx + 8], 0x98badcfe
mov dword [rbx + 0xc], 0x10325476
mov dword [rbx + 0x10], 0xc3d2e1f0
mov eax, 1
add rsp, 0x20
pop rbx
ret

Function at 0x1401ec1e0
Capabilities:
Hash data using sha224

Disassembly:
push rbx
mov eax, 0x20
call fcn.1402807a0
sub rsp, rax
lea r8d, [rax + 0x50]
xor edx, edx
mov rbx, rcx
call fcn.140283160
mov dword [rbx], 0xc1059ed8
mov dword [rbx + 4], 0x367cd507
mov dword [rbx + 8], 0x3070dd17
mov dword [rbx + 0xc], 0xf70e5939
mov dword [rbx + 0x10], 0xffc00b31
mov dword [rbx + 0x14], 0x68581511
mov dword [rbx + 0x18], 0x64f98fa7
mov dword [rbx + 0x1c], 0xbefa4fa4
mov dword [rbx + 0x6c], 0x1c
mov eax, 1
add rsp, 0x20
pop rbx
ret

Function at 0x1401ec570
Capabilities:
Hash data using sha256

Disassembly:
push rbx
mov eax, 0x20
call fcn.1402807a0
sub rsp, rax
lea r8d, [rax + 0x50]
xor edx, edx
mov rbx, rcx
call fcn.140283160
mov dword [rbx], 0x6a09e667
mov dword [rbx + 4], 0xbb67ae85
mov dword [rbx + 8], 0x3c6ef372
mov dword [rbx + 0xc], 0xa54ff53a
mov dword [rbx + 0x10], 0x510e527f
mov dword [rbx + 0x14], 0x9b05688c
mov dword [rbx + 0x18], 0x1f83d9ab
mov dword [rbx + 0x1c], 0x5be0cd19
mov dword [rbx + 0x6c], 0x20
mov eax, 1
add rsp, 0x20
pop rbx
ret
Function at 0x140202e20
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov rbp, rsp
mov eax, 0x50
call fcn.1402807a0
sub rsp, rax
mov rax, qword [0x1403b9868]
xor rax, rsp
mov qword [rbp - 8], rax
mov rax, qword [rbp + 0x60]
mov r13, qword [rbp + 0x68]
mov r14d, r8d
movzx r10d, byte [rax]
movzx r8d, byte [rax + 4]
mov ebx, dword [r13]
lea rdi, [rax + 1]
mov qword [rbp - 0x18], rax
shl r10d, 0x18
movzx eax, byte [rdi]
mov rsi, rcx
movzx ecx, byte [rdi + 5]
shl eax, 0x10
shl r8d, 0x18
shl ecx, 8
or r10d, eax
movzx eax, byte [rdi + 1]
mov r12, rdx
shl eax, 8
lea rdx, [rdi + 5]
xor r15d, r15d
or r10d, eax
movzx eax, byte [rdi + 2]
mov qword [rbp - 0x28], r9
or r10d, eax
movzx eax, byte [rdi + 4]
mov qword [rbp - 0x20], r13
shl eax, 0x10
mov dword [rbp - 0x30], r10d
mov byte [rbp - 0xd], r10b
or r8d, eax
movzx eax, byte [rdx + 1]
or ecx, eax
mov eax, r10d
shr eax, 0x18
or r8d, ecx
mov byte [rbp - 0x10], al
mov eax, r10d
mov dword [rbp - 0x2c], r8d
shr eax, 0x10
mov byte [rbp - 9], r8b
mov byte [rbp - 0xf], al
mov eax, r10d
shr eax, 8
mov byte [rbp - 0xe], al
mov eax, r8d
shr eax, 0x18
mov byte [rbp - 0xc], al
mov eax, r8d
shr eax, 0x10
mov byte [rbp - 0xb], al
mov eax, r8d
shr eax, 8
mov byte [rbp - 0xa], al
test r14d, r14d
je 0x140202fe6
mov r13, qword [rbp - 0x28]
sub r12, rsi
movzx edx, r8b
movzx r9d, r10b
nop dword [rax]
dec r14d
test ebx, ebx
jne 0x140202f83
lea rcx, [rbp - 0x30]
mov rdx, r13
call fcn.140202400
mov r10d, dword [rbp - 0x30]
mov r8d, dword [rbp - 0x2c]
mov eax, r10d
movzx edx, r8b
movzx r9d, r10b
shr eax, 0x18
mov byte [rbp - 0xd], r10b
mov byte [rbp - 9], dl
mov byte [rbp - 0x10], al
mov eax, r10d
shr eax, 0x10
mov byte [rbp - 0xf], al
mov eax, r10d
shr eax, 8
mov byte [rbp - 0xe], al
mov eax, r8d
shr eax, 0x18
mov byte [rbp - 0xc], al
mov eax, r8d
shr eax, 0x10
mov byte [rbp - 0xb], al
mov eax, r8d
shr eax, 8
inc r15d
mov byte [rbp - 0xa], al
movsxd rax, ebx
inc rsi
movzx ecx, byte [rbp + rax - 0x10]
xor cl, byte [rsi - 1]
inc ebx
mov byte [r12 + rsi - 1], cl
and ebx, 7
test r14d, r14d
jne 0x140202f20
mov r13, qword [rbp - 0x20]
test r15d, r15d
je 0x140202fe6
mov rcx, qword [rbp - 0x18]
mov eax, r10d
shr eax, 0x18
mov byte [rcx], al
mov eax, r10d
shr r10d, 8
shr eax, 0x10
mov byte [rdi], al
mov byte [rdi + 1], r10b
mov byte [rdi + 2], r9b
mov eax, r8d
shr eax, 0x18
mov byte [rdi + 3], al
mov eax, r8d
shr eax, 0x10
shr r8d, 8
mov byte [rdi + 4], al
mov byte [rdi + 5], r8b
mov byte [rdi + 6], dl
mov dword [r13], ebx
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.1402806f0
mov rbx, qword [rsp + 0x90]
add rsp, 0x50
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x1402033f0
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
mov eax, 8
call fcn.1402807a0
sub rsp, rax
mov qword [rsp + 0x18], rsi
mov qword [rsp], rdi
mov edi, 0x80
cmp edx, edi
mov r10, rcx
mov byte [rcx], 0
cmovg edx, edi
mov r11d, 0x400
test r9d, r9d
jle 0x14020342b
cmp r9d, r11d
cmovg r9d, r11d
mov r11d, r9d
movsxd r9, edx
test edx, edx
jle 0x140203451
sub r8, rcx
mov rdx, r9
nop dword [rax + rax]
movzx eax, byte [r8 + rcx]
lea rcx, [rcx + 1]
mov byte [rcx - 1], al
dec rdx
jne 0x140203440
movzx ecx, byte [r9 + r10 - 1]
lea rdx, [r9 + r10]
lea rsi, [0x1402eb8c0]
cmp r9, rdi
jge 0x14020349e
mov qword [rsp + 0x10], rbx
mov rbx, r9
mov r8, rdi
neg rbx
sub r8, r9
nop dword [rax + rax]
movzx eax, byte [rdx + rbx]
lea rdx, [rdx + 1]
add eax, ecx
movzx ecx, al
movzx ecx, byte [rcx + rsi]
mov byte [rdx - 1], cl
dec r8
jne 0x140203480
mov rbx, qword [rsp + 0x10]
lea r9d, [r11 + 7]
neg r11d
mov eax, 0xff
sar r9d, 3
and r11d, 7
sub edi, r9d
movzx ecx, r11b
sar eax, cl
movsxd r8, edi
mov rdi, qword [rsp]
mov ecx, eax
movzx eax, byte [r8 + r10]
lea rdx, [r8 + r10]
and rcx, rax
movzx eax, byte [rcx + rsi]
mov byte [rdx], al
test r8, r8
je 0x1402034f8
movsxd r9, r9d
nop
movzx ecx, byte [rdx + r9 - 1]
lea rdx, [rdx - 1]
xor rcx, rax
movzx eax, byte [rcx + rsi]
mov byte [rdx], al
dec r8
jne 0x1402034e0
mov rsi, qword [rsp + 0x18]
lea r8, [r10 + 0xfc]
lea rdx, [r10 + 0x7e]
mov r9d, 0x40
nop
movzx eax, byte [rdx]
movzx ecx, byte [rdx + 1]
lea r8, [r8 - 4]
shl ecx, 8
lea rdx, [rdx - 2]
or ecx, eax
movzx eax, cx
mov dword [r8 + 4], eax
dec r9
jne 0x140203510
add rsp, 8
ret
Function at 0x140204210
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rdi
mov qword [rsp + 0x10], rsi
mov rax, rsp
mov rdi, rcx
mov rsi, rdx
mov rdx, r8
push rbx
push rbp
push r12
push r13
push r14
push r15
push rdx
call fcn.140003200
mov r8, qword [rsp]
cmp eax, 0
jne 0x14000369d
mov r14d, dword [r8 + 0xf0]
xor rdi, rdi
lea rcx, [rdi + r14*4]
mov rsi, r8
lea rdi, [r8 + rcx*4]
mov rax, qword [rsi]
mov rbx, qword [rsi + 8]
mov rcx, qword [rdi]
mov rdx, qword [rdi + 8]
mov qword [rdi], rax
mov qword [rdi + 8], rbx
mov qword [rsi], rcx
mov qword [rsi + 8], rdx
lea rsi, [rsi + 0x10]
lea rdi, [rdi - 0x10]
cmp rdi, rsi
jne 0x1400034d8
lea rax, [0x140004880]
mov rsi, qword [rax + 0x28]
mov rdi, qword [rax + 0x30]
mov rbp, qword [rax + 0x38]
mov r15, r8
sub r14d, 1
nop
lea r15, [r15 + 0x10]
mov rax, qword [r15]
mov rcx, qword [r15 + 8]
mov r9, rsi
mov r12, rsi
and r9, rax
and r12, rcx
mov rbx, r9
mov rdx, r12
shr r9, 7
lea r8, [rax + rax]
shr r12, 7
lea r11, [rcx + rcx]
sub rbx, r9
sub rdx, r12
and r8, rdi
and r11, rdi
and rbx, rbp
and rdx, rbp
xor r8, rbx
xor r11, rdx
mov r10, rsi
mov r13, rsi
and r10, r8
and r13, r11
mov rbx, r10
mov rdx, r13
shr r10, 7
lea r9, [r8 + r8]
shr r13, 7
lea r12, [r11 + r11]
sub rbx, r10
sub rdx, r13
and r9, rdi
and r12, rdi
and rbx, rbp
and rdx, rbp
xor r9, rbx
xor r12, rdx
mov r10, rsi
mov r13, rsi
and r10, r9
and r13, r12
mov rbx, r10
mov rdx, r13
shr r10, 7
xor r8, rax
shr r13, 7
xor r11, rcx
sub rbx, r10
sub rdx, r13
lea r10, [r9 + r9]
lea r13, [r12 + r12]
xor r9, rax
xor r12, rcx
and r10, rdi
and r13, rdi
and rbx, rbp
and rdx, rbp
xor r10, rbx
xor r13, rdx
xor rax, r10
xor rcx, r13
xor r8, r10
xor r11, r13
mov rbx, rax
mov rdx, rcx
xor r9, r10
shr rbx, 0x20
xor r12, r13
shr rdx, 0x20
xor r10, r8
rol eax, 8
xor r13, r11
rol ecx, 8
xor r10, r9
rol ebx, 8
xor r13, r12
rol edx, 8
xor eax, r10d
shr r10, 0x20
xor ecx, r13d
shr r13, 0x20
xor ebx, r10d
xor edx, r13d
mov r10, r8
rol r8d, 0x18
mov r13, r11
rol r11d, 0x18
shr r10, 0x20
xor eax, r8d
shr r13, 0x20
xor ecx, r11d
rol r10d, 0x18
mov r8, r9
rol r13d, 0x18
mov r11, r12
shr r8, 0x20
xor ebx, r10d
shr r11, 0x20
xor edx, r13d
rol r9d, 0x10
rol r12d, 0x10
rol r8d, 0x10
xor eax, r9d
rol r11d, 0x10
xor ecx, r12d
xor ebx, r8d
xor edx, r11d
mov dword [r15], eax
mov dword [r15 + 4], ebx
mov dword [r15 + 8], ecx
mov dword [r15 + 0xc], edx
sub r14d, 1
jne 0x14000351c
xor rax, rax
mov r15, qword [rsp + 8]
mov r14, qword [rsp + 0x10]
mov r13, qword [rsp + 0x18]
mov r12, qword [rsp + 0x20]
mov rbp, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x30]
add rsp, 0x38
mov rdi, qword [rsp + 8]
mov rsi, qword [rsp + 0x10]
repz ret
mov eax, 0x28
call fcn.1402807a0
sub rsp, rax
add rsp, 0x28
jmp 0x140003490