joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14030e5d0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov r9, rcx
mov r11b, 0x7f
cmp byte [rdx], r11b
ja 0x14030e601
movzx r8d, byte [rdx]
mov ecx, 0x800
mov rax, qword [r9 + 8]
test word [rax + r8*2], cx
jne 0x14030e6f2
movzx ecx, byte [rdx]
test byte [rax + rcx*2], 0x10
je 0x14030e601
inc rdx
jmp 0x14030e5d6
movzx r8d, byte [rdx]
cmp r8b, r11b
ja 0x14030e6b3
mov rax, qword [r9 + 8]
test byte [rax + r8*2], 0x80
jne 0x14030e6f2
mov r10d, 0x400
test word [rax + r8*2], r10w
je 0x14030e662
inc rdx
cmp byte [rdx], r11b
ja 0x14030e63f
movzx ecx, byte [rdx]
mov rax, qword [r9 + 8]
test byte [rax + rcx*2], 8
jne 0x14030e655
cmp byte [rdx], r8b
jne 0x14030e650
lea rax, [rdx + 1]
cmp byte [rax], r8b
jne 0x14030e659
mov rdx, rax
inc rdx
jmp 0x14030e62d
lea rax, [rdx + 1]
cmp byte [rdx], r8b
cmove rdx, rax
jmp 0x14030e601
test byte [rax + r8*2], 0x40
mov rcx, rax
je 0x14030e6bb
inc rdx
cmp byte [rdx], r11b
ja 0x14030e67d
movzx eax, byte [rdx]
test byte [rcx + rax*2], 8
jne 0x14030e6aa
cmp byte [rdx], r8b
je 0x14030e6b3
cmp byte [rdx], r11b
ja 0x14030e6a5
movzx eax, byte [rdx]
test byte [rcx + rax*2], 0x20
je 0x14030e6a5
inc rdx
cmp byte [rdx], r11b
ja 0x14030e6a5
movzx eax, byte [rdx]
test byte [rcx + rax*2], 8
jne 0x14030e601
inc rdx
jmp 0x14030e66f
cmp byte [rdx], r8b
jne 0x14030e601
inc rdx
jmp 0x14030e601
test byte [rax + r8*2], 0x20
je 0x14030e6e9
cmp byte [rdx + 1], r11b
jbe 0x14030e6cc
xor eax, eax
jmp 0x14030e6da
movzx eax, byte [rdx + 1]
movzx eax, word [rcx + rax*2]
shr eax, 3
and eax, 1
xor rax, 1
inc rdx
add rdx, rax
jmp 0x14030e601
test byte [rax + r8*2], 8
jne 0x14030e6f5
jmp 0x14030e6b3
mov byte [rdx], 0
ret

Function at 0x14030e750
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov r8, rcx
mov r10b, 0x7f
cmp byte [rdx], r10b
ja 0x14030e7a0
mov rcx, qword [r8 + 8]
movzx eax, byte [rdx]
test byte [rcx + rax*2], 0x20
je 0x14030e78c
cmp byte [rdx + 1], r10b
jbe 0x14030e772
xor eax, eax
jmp 0x14030e780
movzx eax, byte [rdx + 1]
movzx eax, word [rcx + rax*2]
shr eax, 3
and eax, 1
xor rax, 1
inc rdx
add rdx, rax
jmp 0x14030e756
movzx ecx, byte [rdx]
mov r9d, 0x307
mov rax, qword [r8 + 8]
test word [rax + rcx*2], r9w
jne 0x14030e7c0
cmp dword [r8 + 0x18], 0
je 0x14030e7c5
cmp byte [rdx], r10b
ja 0x14030e7c5
movzx ecx, byte [rdx]
mov r9d, 0x1000
mov rax, qword [r8 + 8]
test word [rax + rcx*2], r9w
je 0x14030e7c5
inc rdx
jmp 0x14030e756
mov rax, rdx
ret
Function at 0x140313190
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
mov eax, 0x20
call fcn.1403cb200
sub rsp, rax
lea eax, [rdx + 0x3f]
mov rsi, r8
sar eax, 6
mov edi, edx
mov rbx, rcx
test eax, eax
jle 0x1403131c8
movsxd r8, eax
xor edx, edx
shl r8, 3
call fcn.1403ccc50
mov ecx, 7
cmp edi, 0x68
jl 0x140313206
mov eax, 0x4ec4ec4f
mul edi
shr edx, 5
imul eax, edx, 0xffffff98
mov r8d, edx
add edi, eax
mov rax, qword [rsi]
mov qword [rbx], rax
add rbx, 6
mov rax, qword [rsi + 8]
add rsi, 0x10
shl rax, 4
xor qword [rbx], rax
add rbx, rcx
sub r8, 1
jne 0x1403131e4
cmp edi, 0x34
jle 0x14031324f
mov rax, qword [rsi]
mov rdx, rbx
mov byte [rdx], al
dec ecx
inc rdx
shr rax, 8
test ecx, ecx
jg 0x140313211
mov rax, qword [rsi]
add rbx, 6
mov rcx, qword [rsi + 8]
add edi, 0xffffffd3
shl rcx, 4
shr rax, 0x30
or rcx, rax
sar edi, 3
jmp 0x140313249
mov byte [rbx], cl
inc rbx
shr rcx, 8
dec edi
test edi, edi
jg 0x14031323e
jmp 0x14031326c
test edi, edi
je 0x14031326c
mov rax, qword [rsi]
add edi, ecx
sar edi, 3
jmp 0x140313268
mov byte [rbx], al
inc rbx
shr rax, 8
dec edi
test edi, edi
jg 0x14031325d
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x14031f180
Capabilities:
Check for software breakpoints

Disassembly:
push rbx
mov eax, 0x20
call fcn.1403cb200
sub rsp, rax
mov r10, rcx
cmp dword [rsp + 0x50], r9d
jne 0x14031f237
mov al, byte [r8]
sub al, 0x6a
cmp al, 1
ja 0x14031f237
cmp byte [r8], 0x6b
lea rdx, [r8 + 1]
jne 0x14031f1fa
lea ebx, [r9 - 3]
xor eax, eax
test ebx, ebx
jle 0x14031f1d3
mov cl, byte [rdx]
inc rdx
cmp cl, 0xba
je 0x14031f1d3
cmp cl, 0xbb
jne 0x14031f1d9
inc eax
cmp eax, ebx
jl 0x14031f1be
sub ebx, eax
test eax, eax
jne 0x14031f1fe
call fcn.140273ec0
lea r8, [0x1404635f8]
xor edx, edx
lea rcx, [0x1404c05a8]
call fcn.140273fd0
mov edx, 0x8a
jmp 0x14031f256
lea ebx, [r9 - 2]
movsxd rax, ebx
cmp byte [rax + rdx], 0xcc
je 0x14031f228
call fcn.140273ec0
lea r8, [0x1404635f8]
xor edx, edx
lea rcx, [0x1404c05a8]
call fcn.140273fd0
mov edx, 0x8b
jmp 0x14031f256
mov r8d, ebx
mov rcx, r10
call fcn.1403cc5a0
mov eax, ebx
jmp 0x14031f265
call fcn.140273ec0
lea r8, [0x1404635f8]
xor edx, edx
lea rcx, [0x1404c05a8]
call fcn.140273fd0
mov edx, 0x89
xor r8d, r8d
lea ecx, [r8 + 4]
call fcn.1402740c0
or eax, 0xffffffff
add rsp, 0x20
pop rbx
ret
Function at 0x1403259a0
Capabilities:
Encrypt data using curve25519

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r13
push r14
push r15
mov eax, 0x30
call fcn.1403cb200
sub rsp, rax
cmp dword [rsp + 0x70], 2
lea esi, [rax - 0x10]
mov ebx, r9d
movsxd r15, r8d
mov r14, rdx
mov rdi, rcx
mov r13d, 0x40a
je 0x140325a75
test rcx, rcx
je 0x140325a12
mov r9, rcx
lea rdx, [rsp + 0x20]
xor ecx, ecx
xor r8d, r8d
call fcn.1402ee760
cmp dword [rsp + 0x20], 0xffffffff
jne 0x140325a3c
mov rcx, qword [rdi]
call fcn.140271dc0
test ebx, ebx
jne 0x140325a38
mov ebx, eax
test r14, r14
je 0x140325a3c
test ebx, ebx
je 0x140325a3c
cmp ebx, r13d
je 0x140325a6e
cmp ebx, 0x43f
je 0x140325a6e
xor eax, eax
cmp ebx, 0x40b
setne al
add eax, 0x38
jmp 0x140325a70
cmp ebx, eax
je 0x140325a12
call fcn.140273ec0
lea r8, [0x140463ec8]
xor edx, edx
lea rcx, [0x1404c05a8]
call fcn.140273fd0
mov edx, 0x66
xor r8d, r8d
lea ecx, [r8 + 0x10]
call fcn.1402740c0
xor eax, eax
jmp 0x140325afb
mov eax, esi
cmp r15d, eax
jne 0x140325a3c
mov r8d, 1
cmp ebx, r13d
je 0x140325a98
cmp ebx, 0x43f
je 0x140325a98
cmp ebx, 0x40b
lea edx, [r8 + 2]
cmove edx, r8d
jmp 0x140325aa4
mov eax, ebx
sub eax, r13d
neg eax
sbb edx, edx
and edx, 2
mov r9, qword [rsp + 0x80]
mov rcx, qword [rsp + 0x78]
call fcn.1402dd430
mov rbp, rax
test rax, rax
jne 0x140325ae2
call fcn.140273ec0
lea r8, [0x140463ec8]
xor edx, edx
lea rcx, [0x1404c05a8]
call fcn.140273fd0
mov edx, 0xc0100
jmp 0x140325a5b
cmp dword [rsp + 0x70], 0
jne 0x140325b1a
mov r8, r15
lea rcx, [rax + 0x14]
mov rdx, r14
call fcn.1403cc5a0
mov rax, rbp
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x30
pop r15
pop r14
pop r13
ret
mov rcx, rbp
call fcn.1402dd390
mov rdi, rax
test rax, rax
jne 0x140325b4e
call fcn.140273ec0
lea r8, [0x140463ec8]
xor edx, edx
lea rcx, [0x1404c05a8]
call fcn.140273fd0
mov edx, 0xc0100
jmp 0x140325c12
cmp dword [rsp + 0x70], 2
jne 0x140325bb8
test ebx, ebx
je 0x140325be3
cmp ebx, r13d
je 0x140325b7a
cmp ebx, 0x43f
je 0x140325b7a
xor esi, esi
cmp ebx, 0x40b
setne sil
add rsi, 0x38
mov rcx, qword [rsp + 0x78]
xor r9d, r9d
mov r8, rsi
mov rdx, rdi
call fcn.1402748f0
test eax, eax
jle 0x140325c1e
cmp ebx, r13d
jne 0x140325ba7
and byte [rdi], 0xf8
and byte [rdi + 0x1f], 0x3f
or byte [rdi + 0x1f], 0x40
jmp 0x140325be3
cmp ebx, 0x40b
jne 0x140325be3
and byte [rdi], 0xfc
or byte [rdi + 0x37], 0x80
jmp 0x140325be3
cmp ebx, r13d
je 0x140325bd5
cmp ebx, 0x43f
je 0x140325bd5
xor esi, esi
cmp ebx, 0x40b
setne sil
add rsi, 0x38
mov r8, rsi
mov rdx, r14
mov rcx, rdi
call fcn.1403cc5a0
mov rcx, rbp
call fcn.140325c30
test eax, eax
jne 0x140325af8
call fcn.140273ec0
lea r8, [0x140463ec8]
xor edx, edx
lea rcx, [0x1404c05a8]
call fcn.140273fd0
mov edx, 0xa6
xor r8d, r8d
lea ecx, [r8 + 0x10]
call fcn.1402740c0
mov rcx, rbp
call fcn.1402dd3c0
jmp 0x140325a67
Function at 0x140325ce0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
movzx r9d, r8b
mov r11, rcx
mov r8, rcx
neg r9d
mov rcx, rdx
mov r10d, 0xa
sub rcx, r8
mov ebx, r10d
mov eax, dword [r8]
xor eax, dword [rcx + r8]
and eax, r9d
xor dword [r8], eax
lea r8, [r8 + 4]
sub rbx, 1
jne 0x140325d01
lea rcx, [r11 + 0x28]
mov r8, rdx
sub r8, rcx
mov rbx, r10
mov eax, dword [rcx]
xor eax, dword [r8 + rcx + 0x28]
and eax, r9d
xor dword [rcx], eax
lea rcx, [rcx + 4]
sub rbx, 1
jne 0x140325d25
lea rcx, [r11 + 0x50]
sub rdx, rcx
mov eax, dword [rcx]
xor eax, dword [rdx + rcx + 0x50]
and eax, r9d
xor dword [rcx], eax
lea rcx, [rcx + 4]
sub r10, 1
jne 0x140325d42
mov rbx, qword [rsp + 8]
ret

Function at 0x1403291e0
Capabilities:
Encrypt data using curve25519

Disassembly:
push rbx
push rbp
push rsi
push rdi
mov eax, 0x128
call fcn.1403cb200
sub rsp, rax
mov rax, qword [0x1404f2b48]
xor rax, rsp
mov qword [rsp + 0x110], rax
mov rbx, r8
mov rbp, rdx
mov r8, r9
lea rdx, [0x1404397c0]
call fcn.1402c5ce0
xor edi, edi
mov rsi, rax
test rax, rax
je 0x1403292a8
xor r9d, r9d
mov qword [rsp + 0x28], rdi
lea r8, [rsp + 0xd0]
mov qword [rsp + 0x20], rsi
mov rcx, rbx
lea edx, [r9 + 0x20]
call fcn.1402c5260
mov rcx, rsi
mov ebx, eax
call fcn.1402c5d30
test ebx, ebx
je 0x140329294
mov al, byte [rsp + 0xef]
lea rdx, [rsp + 0xd0]
and byte [rsp + 0xd0], 0xf8
lea rcx, [rsp + 0x30]
and al, 0x3f
or al, 0x40
mov byte [rsp + 0xef], al
call fcn.140328fe0
lea rdx, [rsp + 0x30]
mov rcx, rbp
call fcn.140328f50
mov edi, 1
mov edx, 0x40
lea rcx, [rsp + 0xd0]
call fcn.140010240
mov eax, edi
mov rcx, qword [rsp + 0x110]
xor rcx, rsp
call fcn.1403cb150
add rsp, 0x128
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x1403292d0
Capabilities:
Encrypt data using curve25519

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0xa8]
mov eax, 0x1a8
call fcn.1403cb200
sub rsp, rax
mov rax, qword [0x1404f2b48]
xor rax, rsp
mov qword [rbp + 0x90], rax
mov r13, qword [rbp + 0x110]
mov r12, r8
mov r8, qword [rbp + 0x120]
mov r15, rdx
mov r14, rcx
mov qword [rsp + 0x28], r9
mov rcx, qword [rbp + 0x118]
lea rdx, [0x1404397c0]
call fcn.1402c5ce0
mov rsi, rax
call fcn.1402c5be0
xor ebx, ebx
mov rdi, rax
test rsi, rsi
je 0x1403294aa
test rax, rax
je 0x1403294aa
xor r8d, r8d
mov rdx, rsi
mov rcx, rax
call fcn.1402c56a0
test eax, eax
je 0x1403294aa
lea r8d, [rbx + 0x20]
mov rdx, r13
mov rcx, rdi
call fcn.1402c56e0
test eax, eax
je 0x1403294aa
lea r8, [rsp + 0x20]
mov rcx, rdi
lea rdx, [rbp - 0x30]
call fcn.1402c5520
test eax, eax
je 0x1403294aa
mov al, byte [rbp - 0x11]
xor r8d, r8d
and byte [rbp - 0x30], 0xf8
and al, 0x3f
or al, 0x40
mov rdx, rsi
mov rcx, rdi
mov byte [rbp - 0x11], al
call fcn.1402c56a0
test eax, eax
je 0x1403294aa
lea r13d, [rbx + 0x20]
mov rcx, rdi
mov r8d, r13d
lea rdx, [rbp - 0x10]
call fcn.1402c56e0
test eax, eax
je 0x1403294aa
mov r8, r12
mov rdx, r15
mov rcx, rdi
call fcn.1402c56e0
test eax, eax
je 0x1403294aa
lea r8, [rsp + 0x20]
mov rcx, rdi
lea rdx, [rbp + 0x10]
call fcn.1402c5520
test eax, eax
je 0x1403294aa
lea rcx, [rbp + 0x10]
call fcn.14032b8b0
lea rdx, [rbp + 0x10]
lea rcx, [rsp + 0x30]
call fcn.140328fe0
lea rdx, [rsp + 0x30]
mov rcx, r14
call fcn.140328f50
xor r8d, r8d
mov rdx, rsi
mov rcx, rdi
call fcn.1402c56a0
test eax, eax
je 0x1403294aa
mov r8d, r13d
mov rdx, r14
mov rcx, rdi
call fcn.1402c56e0
test eax, eax
je 0x1403294aa
mov rdx, qword [rsp + 0x28]
mov r8d, r13d
mov rcx, rdi
call fcn.1402c56e0
test eax, eax
je 0x1403294aa
mov r8, r12
mov rdx, r15
mov rcx, rdi
call fcn.1402c56e0
test eax, eax
je 0x1403294aa
lea r8, [rsp + 0x20]
mov rcx, rdi
lea rdx, [rbp + 0x50]
call fcn.1402c5520
test eax, eax
je 0x1403294aa
lea rcx, [rbp + 0x50]
call fcn.14032b8b0
lea rcx, [r14 + 0x20]
lea r9, [rbp + 0x10]
lea r8, [rbp - 0x30]
lea rdx, [rbp + 0x50]
call fcn.1403298e0
lea ebx, [r13 - 0x1f]
mov r14d, 0x40
lea rcx, [rbp + 0x10]
mov edx, r14d
call fcn.140010240
mov edx, r14d
lea rcx, [rbp - 0x30]
call fcn.140010240
mov rcx, rsi
call fcn.1402c5d30
mov rcx, rdi
call fcn.1402c5b30
mov eax, ebx
mov rcx, qword [rbp + 0x90]
xor rcx, rsp
call fcn.1403cb150
add rsp, 0x1a8
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
Function at 0x140329800
Capabilities:
Encrypt data using curve25519

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
lea rbp, [rsp - 0x70]
mov eax, 0x170
call fcn.1403cb200
sub rsp, rax
mov rax, qword [0x1404f2b48]
xor rax, rsp
mov qword [rbp + 0x60], rax
mov rbx, rcx
mov r8d, 0x20
lea rcx, [rbp + 0x40]
call fcn.1403cc5a0
mov al, byte [rbp + 0x5f]
lea rdx, [rbp + 0x40]
and byte [rbp + 0x40], 0xf8
lea rcx, [rsp + 0x50]
and al, 0x3f
or al, 0x40
mov byte [rbp + 0x5f], al
call fcn.140328fe0
xor r8d, r8d
lea r9d, [r8 + 0xa]
mov edx, dword [rbp + r8 - 0x60]
mov ecx, dword [rsp + r8 + 0x78]
lea r8, [r8 + 4]
lea eax, [rdx + rcx]
sub edx, ecx
mov dword [rbp + r8 + 0x14], edx
mov dword [rbp + r8 - 0x14], eax
sub r9, 1
jne 0x14032985b
lea rdx, [rbp + 0x18]
lea rcx, [rsp + 0x20]
call fcn.1403266f0
lea r8, [rsp + 0x20]
lea rdx, [rbp - 0x10]
lea rcx, [rbp - 0x10]
call fcn.1403269a0
lea rdx, [rbp - 0x10]
mov rcx, rbx
call fcn.140327fc0
lea rcx, [rbp + 0x40]
mov edx, 0x20
call fcn.140010240
mov rcx, qword [rbp + 0x60]
xor rcx, rsp
call fcn.1403cb150
mov rbx, qword [rsp + 0x190]
add rsp, 0x170
pop rbp
ret
Function at 0x14032e9a0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x30]
mov eax, pe_nt_image_headers64
call fcn.1403cb200
sub rsp, rax
mov rax, qword [0x1404f2b48]
xor rax, rsp
mov qword [rbp + 0x20], rax
mov rax, r8
mov r13, rdx
mov r15, rcx
lea r8, [0x14046bdf0]
mov rdx, rax
lea rcx, [rsp + 0x28]
call fcn.140387990
lea rdx, [rsp + 0x28]
lea rcx, [rsp + 0x28]
call fcn.140387c80
mov edi, 0x12
cmp edi, 0x12
je 0x14032ea14
xor r8d, r8d
mov rdx, r15
mov rcx, r15
call fcn.14032f240
xor ebx, ebx
xor r10d, r10d
lea r11d, [rbx + rbx*4]
xor r8d, r8d
lea eax, [r11 + r8]
lea ecx, [rax + rax*8]
lea r9d, [rcx*2 - 1]
add r9d, edi
cmp r9d, 0x1be
jae 0x14032ea5a
mov eax, r9d
and r9d, 0x1f
shr rax, 5
mov cl, r9b
mov edx, dword [rsp + rax*4 + 0x28]
shr edx, cl
mov ecx, r8d
and edx, 1
shl edx, cl
or r10d, edx
inc r8d
cmp r8d, 5
jb 0x14032ea20
mov eax, r10d
lea rcx, [rsp + 0x60]
mov r12d, r10d
xor edx, edx
sar r12d, 4
mov r8d, 0xc0
dec r12d
mov esi, r12d
xor rsi, rax
mov eax, ebx
shl eax, 4
and esi, 0xf
lea r14, [rax + rax*2]
shl r14, 6
add r14, r13
call fcn.1403ccc50
lea r8, [rsi - 1]
mov r9d, 0x10
mov rax, rsi
mov rcx, r8
shr rcx, 0x3f
not rax
shr rax, 0x3f
and cl, al
neg cl
movzx r11d, cl
xor edx, edx
mov r10d, r11d
not r10d
mov cl, byte [r14]
inc r14
mov dword [rsp + 0x24], r11d
mov dword [rsp + 0x20], r10d
mov eax, dword [rsp + 0x20]
mov eax, dword [rsp + 0x24]
and al, cl
or byte [rsp + rdx + 0x60], al
inc rdx
cmp rdx, 0xc0
jb 0x14032eac6
dec rsi
dec r8
sub r9, 1
jne 0x14032eaa5
xor r8d, r8d
mov ecx, dword [rsp + r8*4 + 0x60]
mov eax, ecx
xor eax, dword [rbp + r8*4 - 0x60]
and eax, r12d
xor ecx, eax
mov dword [rsp + r8*4 + 0x60], ecx
xor dword [rbp + r8*4 - 0x60], eax
inc r8
cmp r8, 0x10
jb 0x14032eaff
mov edx, r12d
lea rcx, [rbp - 0x20]
call fcn.14032dc40
cmp edi, 0x12
jne 0x14032eb47
test ebx, ebx
jne 0x14032eb47
lea rdx, [rsp + 0x60]
mov rcx, r15
call fcn.14032dec0
jmp 0x14032eb67
cmp ebx, 4
jne 0x14032eb57
cmp edi, 1
je 0x14032eb57
lea r8d, [rbx - 3]
jmp 0x14032eb5a
xor r8d, r8d
lea rdx, [rsp + 0x60]
mov rcx, r15
call fcn.14032da10
inc ebx
cmp ebx, 5
jb 0x14032ea16
add edi, 0xffffffff
jne 0x14032ea01
mov edx, 0xc0
lea rcx, [rsp + 0x60]
call fcn.140010240
lea edx, [rdi + 0x38]
lea rcx, [rsp + 0x28]
call fcn.140010240
mov rcx, qword [rbp + 0x20]
xor rcx, rsp
call fcn.1403cb150
mov rbx, qword [rsp + 0x178]
add rsp, 0x130
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x140337240
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rdi
push r14
sub rsp, 0x20
mov eax, dword [rcx + 0x18]
mov rbx, rcx
mov ebp, r8d
mov r14, rdx
lea ecx, [rax + rax]
mov eax, dword [rbx + 0x20]
add rax, 0x18
add rcx, rax
call qword [section._________1]
mov rdi, rax
test rax, rax
jne 0x140337282
mov rbx, qword [rsp + 0x50]
add rsp, 0x20
pop r14
pop rdi
pop rbp
ret
lea rcx, [rax + 0x18]
mov qword [rax], rbx
mov qword [rax + 8], rcx
mov eax, dword [rbx + 0x18]
add rax, rcx
mov qword [rsp + 0x48], rsi
mov qword [rdi + 0x10], rax
cmp ebp, dword [rbx + 0x1c]
jbe 0x1403372c9
call qword [rbx]
mov rcx, qword [rdi + 8]
mov r8d, ebp
mov rdx, r14
call qword [rbx + 8]
mov r14d, dword [rbx + 0x18]
add r14, qword [rdi + 0x10]
mov rdx, qword [rdi + 8]
mov rcx, r14
call qword [rbx + 0x10]
mov rcx, qword [rdi + 8]
mov ebp, dword [rbx + 0x20]
call qword [rbx]
mov rcx, qword [rdi + 0x10]
call qword [rbx]
xor esi, esi
test rbp, rbp
je 0x140337322
mov rsi, rbp
nop dword [rax + rax]
movzx eax, byte [r14]
lea rdx, [rsp + 0x40]
xor al, 0x36
mov r8d, 1
mov byte [rsp + 0x40], al
mov rcx, qword [rdi + 8]
call qword [rbx + 8]
movzx eax, byte [r14]
lea rdx, [rsp + 0x40]
xor al, 0x5c
lea r14, [r14 + 1]
mov byte [rsp + 0x40], al
mov r8d, 1
mov rcx, qword [rdi + 0x10]
call qword [rbx + 8]
sub rbp, 1
jne 0x1403372e0
mov eax, dword [rbx + 0x1c]
cmp rsi, rax
jae 0x140337363
nop word [rax + rax]
mov rcx, qword [rdi + 8]
lea rdx, [0x14046ef46]
mov r8d, 1
call qword [rbx + 8]
mov rcx, qword [rdi + 0x10]
lea rdx, [0x14046ef47]
mov r8d, 1
call qword [rbx + 8]
mov eax, dword [rbx + 0x1c]
inc rsi
cmp rsi, rax
jb 0x140337330
mov rsi, qword [rsp + 0x48]
mov rax, rdi
mov rbx, qword [rsp + 0x50]
add rsp, 0x20
pop r14
pop rdi
pop rbp
ret
Function at 0x140340fd0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
mov eax, 0x40
call fcn.1403cb200
sub rsp, rax
mov rdi, qword [rcx + 0x78]
mov rsi, r8
mov rbp, r9
mov r14, rdx
lea r12, [rdi + 0x70]
mov r8d, dword [r12]
mov qword [rsp + 0x30], r12
test r8d, r8d
je 0x14034105b
test r9, r9
je 0x14034103a
cmp r8d, 0x40
jae 0x14034103a
mov eax, r8d
inc r8d
mov cl, byte [rax + rdi + 0x30]
xor cl, byte [rsi]
inc rsi
mov byte [r14], cl
inc r14
sub rbp, 1
jne 0x140341019
mov dword [r12], r8d
test rbp, rbp
je 0x14034113d
cmp r8d, 0x40
jne 0x14034105b
and dword [r12], 0
add dword [rdi + 0x20], 1
jne 0x14034105b
inc dword [rdi + 0x24]
mov ecx, dword [rdi + 0x20]
mov r15d, ebp
and r15d, 0x3f
mov r13d, r15d
sub rbp, r13
cmp rbp, 0x40
jb 0x1403410e7
mov r13d, 0x10000000
lea r12, [rdi + 0x20]
mov rdx, rbp
mov qword [rsp + 0x20], r12
shr rdx, 6
mov r9, rdi
cmp rdx, r13
cmova rdx, r13
xor r8d, r8d
add ecx, edx
mov rbx, rdx
cmp rcx, rdx
cmovae r8d, ecx
sub rbx, rcx
cmp rcx, rdx
mov dword [rsp + 0x70], r8d
mov rcx, r14
cmovae rbx, rdx
mov rdx, rsi
shl rbx, 6
mov r8, rbx
call fcn.14007e600
mov ecx, dword [rsp + 0x70]
sub rbp, rbx
add rsi, rbx
mov dword [r12], ecx
add r14, rbx
test ecx, ecx
jne 0x1403410d9
inc dword [rdi + 0x24]
cmp rbp, 0x40
jae 0x14034107b
mov r12, qword [rsp + 0x30]
mov r13d, r15d
test r15d, r15d
je 0x14034113d
xor edx, edx
lea rbx, [rdi + 0x30]
mov rcx, rbx
lea r8d, [rdx + 0x40]
call fcn.1403ccc50
lea rax, [rdi + 0x20]
mov r9, rdi
mov r8d, 0x40
mov qword [rsp + 0x20], rax
mov rdx, rbx
mov rcx, rbx
call fcn.14007e600
test r15d, r15d
je 0x140341139
sub rdi, rsi
sub r14, rsi
mov cl, byte [rdi + rsi + 0x30]
xor cl, byte [rsi]
mov byte [r14 + rsi], cl
inc rsi
sub r13, 1
jne 0x140341126
mov dword [r12], r15d
lea r11, [rsp + 0x40]
mov eax, 1
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x1403452a0
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov eax, 0xe8
call fcn.1403cb200
sub rsp, rax
mov rax, qword [0x1404f2b48]
xor rax, rsp
mov qword [rsp + 0xd0], rax
mov r13, qword [rsp + 0x168]
mov r14, r9
mov r15, qword [rsp + 0x150]
xor ebx, ebx
mov rdi, qword [rsp + 0x158]
mov r12, qword [rsp + 0x178]
mov esi, dword [r13]
mov qword [rsp + 0x38], r8
mov qword [rsp + 0x40], rdx
mov qword [rsp + 0x48], rcx
call fcn.14027b030
mov r8d, esi
mov qword [rsp + 0x30], rax
xor edx, edx
mov rcx, r12
call fcn.1403857a0
test eax, eax
je 0x140345444
mov ebp, dword [rsp + 0x160]
inc esi
test ebp, ebp
je 0x14034534b
mov rcx, qword [rsp + 0x30]
xor r9d, r9d
mov r8, rdi
mov rdx, r15
call fcn.140274470
test eax, eax
jle 0x140345446
mov r8, rdi
mov rdx, r15
mov rcx, r14
call fcn.1403cc5a0
mov r8, rdi
lea rcx, [rsp + 0x90]
mov rdx, r15
call fcn.1403cc5a0
movsxd rax, edi
sub rax, 1
js 0x140345386
lea rcx, [rax + r14]
add byte [rcx], 1
jne 0x140345386
dec rcx
cmp rcx, r14
jns 0x140345379
mov rbp, qword [rsp + 0x38]
lea r8, [rsp + 0x50]
mov qword [rsp + 0x28], rbx
xor r9d, r9d
mov rdx, rdi
mov qword [rsp + 0x20], rbp
mov rcx, r15
call fcn.1402c5260
test eax, eax
je 0x140345446
mov qword [rsp + 0x28], rbx
lea r8, [rsp + 0x90]
xor r9d, r9d
mov qword [rsp + 0x20], rbp
mov rdx, rdi
mov rcx, r14
call fcn.1402c5260
test eax, eax
je 0x140345446
test edi, edi
jle 0x1403453f1
mov rcx, rbx
mov edx, edi
mov al, byte [rsp + rcx + 0x90]
xor byte [rsp + rcx + 0x50], al
inc rcx
sub rdx, 1
jne 0x1403453dd
or byte [rsp + 0x50], 0x80
lea rcx, [rsp + 0x50]
mov rbp, qword [rsp + 0x40]
mov edx, edi
or byte [rsp + rdi + 0x4f], 1
mov r8, rbp
call fcn.140279950
test rax, rax
je 0x140345446
mov rdx, qword [rsp + 0x48]
mov r8, r12
mov rcx, rbp
call fcn.140385800
test eax, eax
jg 0x140345470
jne 0x140345446
mov r8d, esi
xor edx, edx
mov rcx, r12
mov ebp, 1
call fcn.1403857a0
test eax, eax
jne 0x14034532a
inc esi
mov dword [r13], esi
mov eax, ebx
mov rcx, qword [rsp + 0xd0]
xor rcx, rsp
call fcn.1403cb150
add rsp, 0xe8
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
mov ebx, 1
jmp 0x140345446