joyce8/EMBER2024-capa huggingface dataset:
Function at 0x200a5c60
Capabilities:
Encode data using xor

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x28
movzx eax, byte [0x20502798]
cmp al, 0x26
je 0x200a5c90
mov cl, 0xe0
nop word cs:[rax + rax]
mov al, 0x1b
lock cmpxchg byte [0x20502798], cl
je 0x200a5c95
cmp al, 0x26
jne 0x200a5c80
call fcn.200a9b40
mov ecx, 0x981c932e
lea r10, [0x204136a0]
mov r11d, 0x981c9330
add r11, r10
lea r8, [rcx + 2]
xor esi, esi
movabs rdi, 0xaaaaaaaaaaaaaaab
lea rbx, [0x20502780]
mov r14d, 0x981c932f
nop word [rax + rax]
mov rax, r8
mul rdi
mov r9, rdx
shr r9, 1
and r9, 0xfffffffffffffff8
mov rax, rcx
mul rdi
shr rdx, 1
and rdx, 0xfffffffffffffff8
lea rax, [rdx + rdx*2]
mov rdx, r10
sub rdx, rax
add rdx, rsi
movzx eax, byte [r14 + rdx]
xor al, 0x59
add byte [rsi + rbx], al
lea rax, [r9 + r9*2]
neg rax
movzx eax, byte [r11 + rax]
xor al, 0x59
add byte [rsi + rbx + 1], al
add rsi, 2
add r11, 2
add r8, 2
add rcx, 2
cmp rsi, 0x18
jne 0x200a5cd0
mov al, 0x26
xchg byte [0x20502798], al
call fcn.200a9b40
int3
Function at 0x200ca890
Capabilities:
Encode data using xor

Disassembly:
push rbp
push r14
push rsi
push rdi
push rbx
sub rsp, 0x30
lea rbp, [rsp + 0x30]
mov qword [rbp - 8], 0xfffffffffffffffe
mov rsi, rdx
mov rdi, rcx
nop
mov eax, dword [0x2050aad8]
mov ecx, 0x9f5007c1
xor rcx, rax
mov edx, 0xdafcbbe3
mov r8, rdi
xor r9d, r9d
call fcn.200cbf30
mov qword [rdi + 8], 0
mov byte [rdi + 0x10], 0
mov qword [rdi + 0x18], 0
mov byte [rdi + 0x20], 0
mov qword [rdi + 0x28], 0
mov word [rdi + 0x30], 0
mov qword [rdi + 0x38], 0
mov word [rdi + 0x40], 0
mov qword [rdi + 0x48], 0
mov byte [rdi + 0x50], 0
mov qword [rdi + 0x58], 0
mov byte [rdi + 0x60], 0
test rsi, rsi
nop
mov qword [rbp - 0x10], rdi
je 0x200ca93c
mov rcx, rdi
mov rdx, rsi
call fcn.20077dd0
mov rax, qword [rbp - 0x10]
add rsp, 0x30
pop rbx
pop rdi
pop rsi
pop r14
pop rbp
ret
nop
movzx eax, byte [0x20509bc0]
cmp al, 0x68
je 0x200ca9fc
mov cl, 0xe6
nop
mov al, 0x89
lock cmpxchg byte [0x20509bc0], cl
je 0x200ca965
cmp al, 0x68
jne 0x200ca950
jmp 0x200ca9fc
lea r8, [0x204140e0]
mov r9d, 0xf61d4c2e
lea r10, [r8 + r9]
mov r11d, 0xf61d4c2c
xor esi, esi
movabs rdi, 0x4924924924924925
lea rbx, [0x20509bb0]
mov r14d, 0xf61d4c2d
nop word cs:[rax + rax]
mov rax, r9
shr rax, 1
mul rdi
mov rcx, rdx
mov rax, r11
shr rax, 1
mul rdi
shr rdx, 1
imul rax, rdx, 0xfffffffffffffff2
add rax, r8
add rax, rsi
movzx eax, byte [r14 + rax]
xor al, 0x72
add byte [rsi + rbx], al
shr rcx, 1
imul rax, rcx, 0xfffffffffffffff2
movzx eax, byte [r10 + rax]
xor al, 0x72
add byte [rsi + rbx + 1], al
add rsi, 2
add r10, 2
add r9, 2
add r11, 2
cmp rsi, 0x10
jne 0x200ca9a0
mov al, 0x68
xchg byte [0x20509bc0], al
call fcn.200ca610
int3
Function at 0x20106a80
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x48
mov r9, r8
mov rsi, rdx
mov rdi, rcx
nop
mov r8, qword [rcx]
mov r10, qword [r8 + 8]
xor ebp, ebp
cmp byte [r10 + 0x19], 0
je 0x20106ab5
mov rbx, r10
mov rax, r8
jmp 0x20106b4e
nop
cmp qword [r9 + 0x20], 0x10
jb 0x20106ac3
mov rcx, qword [r9 + 8]
jmp 0x20106ac7
lea rcx, [r9 + 8]
nop
mov rdx, qword [r9 + 0x18]
mov rax, r8
jmp 0x20106b00
cmp r11, rdx
setb r11b
lea r10, [rbx + 0x10]
test r11b, r11b
cmove rax, rbx
cmove r10, rbx
mov r10, qword [r10]
cmp byte [r10 + 0x19], 0
jne 0x20106b46
mov rbx, r10
cmp qword [r10 + 0x40], 0x10
jb 0x20106b10
mov r10, qword [rbx + 0x28]
jmp 0x20106b14
lea r10, [rbx + 0x28]
mov r11, qword [rbx + 0x38]
cmp rdx, r11
mov r14, r11
cmovb r14, rdx
test r14, r14
je 0x20106ae0
xor r15d, r15d
nop word [rax + rax]
nop
movzx ebp, byte [rcx + r15]
cmp byte [r10 + r15], bpl
jne 0x20106ae3
inc r15
cmp r14, r15
jne 0x20106b30
jmp 0x20106ae0
xor r11b, 1
movzx ebp, r11b
nop
cmp byte [rax + 0x19], 0
je 0x20106bae
movabs rax, 0x38e38e38e38e38e
cmp qword [rdi + 8], rax
je 0x20106c20
lea rcx, [rsp + 0x38]
mov rdx, rdi
call fcn.200b4580
mov r8, qword [rsp + 0x40]
mov qword [rsp + 0x28], rbx
mov dword [rsp + 0x30], ebp
lea rdx, [rsp + 0x28]
mov rcx, rdi
call fcn.200b4760
mov cl, 1
nop
mov qword [rsi], rax
mov byte [rsi + 8], cl
mov rax, rsi
add rsp, 0x48
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
nop
cmp qword [rax + 0x40], 0x10
jb 0x20106bbc
mov rcx, qword [rax + 0x28]
jmp 0x20106bc0
lea rcx, [rax + 0x28]
mov rdx, qword [rax + 0x38]
mov r10, qword [r9 + 0x18]
cmp qword [r9 + 0x20], 0x10
jb 0x20106bd5
mov r11, qword [r9 + 8]
jmp 0x20106bd9
lea r11, [r9 + 8]
cmp rdx, r10
mov r14, r10
cmovb r14, rdx
test r14, r14
je 0x20106c08
xor r15d, r15d
nop dword [rax + rax]
nop
movzx r12d, byte [r11 + r15]
movzx r13d, byte [rcx + r15]
cmp r12b, r13b
jne 0x20106c13
inc r15
cmp r14, r15
jne 0x20106bf0
cmp r10, rdx
jb 0x20106b55
jmp 0x20106c19
jb 0x20106b55
xor ecx, ecx
jmp 0x20106b93
call fcn.20076e20
int3
Function at 0x201363e0
Capabilities:
Encode data using xor

Disassembly:
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x20
cmp qword [0x205728c8], 0
jne 0x201365ad
movzx eax, byte [0x20519dad]
cmp al, 0xbf
je 0x201364bd
mov dl, 0xef
nop dword [rax]
mov al, 0xda
lock cmpxchg byte [0x20519dad], dl
je 0x20136425
cmp al, 0xbf
jne 0x20136410
jmp 0x201364bd
mov r8d, 0xc700fb2e
lea r9, [r8 + 1]
xor r11d, r11d
movabs rsi, 0x4ec4ec4ec4ec4ec5
lea rax, [0x20416f00]
mov edi, 0xc700fb26
add rdi, rax
lea rbx, [0x20519da0]
nop word cs:[rax + rax]
mov rax, r9
mul rsi
mov r10, rdx
mov rax, r8
mul rsi
shr rdx, 2
imul rax, rdx, 0xfffffffffffffff3
add rax, rdi
movzx eax, byte [r11 + rax + 8]
xor al, 0x57
add byte [r11 + rbx], al
cmp r11, 0xc
je 0x201364b5
shr r10, 2
imul rax, r10, 0xfffffffffffffff3
add rax, rdi
add rax, 9
movzx eax, byte [rax + r11]
xor al, 0x57
add byte [r11 + rbx + 1], al
add r11, 2
add r9, 2
add r8, 2
jmp 0x20136460
mov al, 0xbf
xchg byte [0x20519dad], al
movzx eax, byte [0x20519dc4]
cmp al, 0x67
je 0x2013657c
mov dl, 0x1f
nop
mov al, 0x72
lock cmpxchg byte [0x20519dc4], dl
je 0x201364e5
cmp al, 0x67
jne 0x201364d0
jmp 0x2013657c
mov eax, 0x270220cf
mov edx, 0xd8fddf44
mov r8d, 1
mov r9d, 0x270220d0
mov r10d, 0xd8fddf42
mov r11d, 0xcccccccd
lea rsi, [0x20519db0]
lea rdi, [0x20416f10]
nop word cs:[rax + rax]
mov ebx, edx
imul rbx, r11
shr rbx, 0x24
lea ebx, [rbx + rbx*4]
lea ebx, [rax + rbx*4]
mov r14d, r10d
imul r14, r11
shr r14, 0x24
lea r14d, [r14 + r14*4]
lea r14d, [r9 + r14*4]
movzx ebp, byte [r14 + rdi]
xor bpl, 0x5c
add byte [r8 + rsi - 1], bpl
movzx ebx, byte [rbx + rdi]
xor bl, 0x5c
add byte [r8 + rsi], bl
add eax, 0xfffffffe
add edx, 2
add r8, 2
add r9d, 0xfffffffe
add r10d, 2
cmp r8, 0x15
jne 0x20136520
mov al, 0x67
xchg byte [0x20519dc4], al
mov rsi, rcx
lea rcx, [0x20519da0]
call sub.KERNEL32.dll_LoadLibraryA
test rax, rax
je 0x201365a1
lea rdx, [0x20519db0]
mov rcx, rax
call sub.KERNEL32.dll_GetProcAddress
jmp 0x201365a3
xor eax, eax
mov rcx, rsi
mov qword [0x205728c8], rax
add rsp, 0x20
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
jmp qword [0x205728c8]
Function at 0x20137a70
Capabilities:
Encode data using xor

Disassembly:
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x20
cmp qword [0x205728d8], 0
jne 0x20137c4c
movzx eax, byte [0x20519e0d]
cmp al, 0xf9
je 0x20137b4d
mov dl, 0xe2
nop dword [rax]
mov al, 0xa0
lock cmpxchg byte [0x20519e0d], dl
je 0x20137ab5
cmp al, 0xf9
jne 0x20137aa0
jmp 0x20137b4d
mov r8d, 0xf97111ad
lea r9, [r8 + 1]
xor r11d, r11d
movabs rsi, 0x4ec4ec4ec4ec4ec5
lea rax, [0x20416f60]
mov edi, 0xf97111a9
add rdi, rax
lea rbx, [0x20519e00]
nop word cs:[rax + rax]
mov rax, r9
mul rsi
mov r10, rdx
mov rax, r8
mul rsi
shr rdx, 2
imul rax, rdx, 0xfffffffffffffff3
add rax, rdi
movzx eax, byte [r11 + rax + 4]
xor al, 0xf2
add byte [r11 + rbx], al
cmp r11, 0xc
je 0x20137b45
shr r10, 2
imul rax, r10, 0xfffffffffffffff3
add rax, rdi
add rax, 5
movzx eax, byte [rax + r11]
xor al, 0xf2
add byte [r11 + rbx + 1], al
add r11, 2
add r9, 2
add r8, 2
jmp 0x20137af0
mov al, 0xf9
xchg byte [0x20519e0d], al
movzx eax, byte [0x20519e1e]
cmp al, 0xb9
je 0x20137c1b
mov dl, 0xae
nop
mov al, 0x19
lock cmpxchg byte [0x20519e1e], dl
je 0x20137b75
cmp al, 0xb9
jne 0x20137b60
jmp 0x20137c1b
mov eax, 0xb34ea20b
mov edx, 0x4cb15e02
mov r8d, 1
mov r9d, 0xb34ea20c
mov r10d, 0x4cb15e00
mov r11d, 0x92492493
lea rsi, [0x20519e10]
lea rdi, [0x20416f70]
nop word cs:[rax + rax]
mov ebx, edx
shr ebx, 1
imul rbx, r11
shr rbx, 0x22
lea ebp, [rbx + rbx]
shl ebx, 4
sub ebx, ebp
add ebx, eax
mov r14d, r10d
shr r14d, 1
imul r14, r11
shr r14, 0x22
lea ebp, [r14 + r14]
shl r14d, 4
sub r14d, ebp
add r14d, r9d
movzx ebp, byte [r14 + rdi]
xor bpl, 0x26
add byte [r8 + rsi - 1], bpl
movzx ebx, byte [rbx + rdi]
xor bl, 0x26
add byte [r8 + rsi], bl
add eax, 0xfffffffe
add edx, 2
add r8, 2
add r9d, 0xfffffffe
add r10d, 2
cmp r8, 0xf
jne 0x20137bb0
mov al, 0xb9
xchg byte [0x20519e1e], al
mov rsi, rcx
lea rcx, [0x20519e00]
call sub.KERNEL32.dll_LoadLibraryA
test rax, rax
je 0x20137c40
lea rdx, [0x20519e10]
mov rcx, rax
call sub.KERNEL32.dll_GetProcAddress
jmp 0x20137c42
xor eax, eax
mov rcx, rsi
mov qword [0x205728d8], rax
add rsp, 0x20
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
jmp qword [0x205728d8]
Function at 0x2013bf70
Capabilities:
Encode data using xor

Disassembly:
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x20
cmp qword [0x205728e8], 0
jne 0x2013c138
movzx eax, byte [0x20572911]
cmp al, 0x38
je 0x2013c04c
mov r8b, 0xac
nop word [rax + rax]
xor eax, eax
lock cmpxchg byte [0x20572911], r8b
je 0x2013bfb6
cmp al, 0x38
jne 0x2013bfa0
jmp 0x2013c04c
mov eax, 1
mov r8d, 0x7489247a
mov r9d, 0x8b76db90
mov r10d, 0x7489247b
mov r11d, 0xaaaaaaab
lea rsi, [0x20519e50]
lea rdi, [0x20416fb0]
nop word cs:[rax + rax]
mov ebx, r9d
imul rbx, r11
shr rbx, 0x23
shl ebx, 2
lea ebx, [rbx + rbx*2]
lea r14d, [r10 + rbx]
movzx ebp, byte [rax + rsi - 1]
xor bpl, byte [r14 + rdi]
xor bpl, 0x74
mov byte [rax + rsi - 1], bpl
cmp rax, 0xd
je 0x2013c044
add ebx, r8d
movzx ebp, byte [rax + rsi]
mov ebx, ebx
xor bpl, byte [rbx + rdi]
xor bpl, 0x74
mov byte [rax + rsi], bpl
add rax, 2
add r8d, 0xfffffffe
add r9d, 2
add r10d, 0xfffffffe
jmp 0x2013bff0
mov al, 0x38
xchg byte [0x20572911], al
movzx eax, byte [0x20519e74]
cmp al, 0xe7
je 0x2013c103
mov r8b, 0x26
nop
mov al, 0x6f
lock cmpxchg byte [0x20519e74], r8b
je 0x2013c076
cmp al, 0xe7
jne 0x2013c060
jmp 0x2013c103
mov eax, 0x2e299908
mov r8d, 0xd1d6670c
mov r9d, 1
mov r10d, 0x2e299909
mov r11d, 0xba2e8ba3
lea rsi, [0x20519e60]
lea rdi, [0x20416fc0]
nop word cs:[rax + rax]
mov ebx, r8d
imul rbx, r11
shr rbx, 0x24
lea r14d, [rbx + rbx*4]
lea r14d, [rbx + r14*4]
add r14d, ebx
lea ebx, [rax + r14]
add r14d, r10d
movzx ebp, byte [r14 + rdi]
xor bpl, 0x53
add byte [r9 + rsi - 1], bpl
movzx ebx, byte [rbx + rdi]
xor bl, 0x53
add byte [r9 + rsi], bl
add eax, 0xfffffffe
add r8d, 2
add r9, 2
add r10d, 0xfffffffe
cmp r9, 0x15
jne 0x2013c0b0
mov al, 0xe7
xchg byte [0x20519e74], al
mov rsi, rcx
mov edi, edx
lea rcx, [0x20519e50]
call sub.KERNEL32.dll_LoadLibraryA
test rax, rax
je 0x2013c12a
lea rdx, [0x20519e60]
mov rcx, rax
call sub.KERNEL32.dll_GetProcAddress
jmp 0x2013c12c
xor eax, eax
mov edx, edi
mov rcx, rsi
mov qword [0x205728e8], rax
mov rax, qword [0x205728e8]
add rsp, 0x20
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
jmp rax
Function at 0x2014b440
Capabilities:
Encode data using xor

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x58
lea rbp, [rsp + 0x50]
mov qword [rbp], 0xfffffffffffffffe
mov rdi, r8
mov rsi, rdx
mov r14, rcx
lea rax, [0x204148d8]
mov qword [rbp - 0x28], rax
mov dword [rbp - 0x20], 0
xorps xmm0, xmm0
movups xmmword [rbp - 0x18], xmm0
mov byte [rbp - 8], 0
lea rcx, [rbp - 0x28]
call fcn.200e3060
mov ebx, eax
test al, al
je 0x2014b4f4
movabs rax, 0x555555555555555
cmp qword [r14 + 0x48], rax
je 0x2014b535
nop
mov r13, qword [rsi]
mov r15, qword [rdi + 0x30]
mov r12, qword [r14 + 0x40]
mov ecx, 0x30
call fcn.20077cb0
lea rcx, [0x20417148]
mov qword [rax + 0x10], rcx
mov qword [rax + 0x18], r15
mov qword [rax + 0x20], r13
mov qword [rax + 0x28], rsi
inc qword [r14 + 0x48]
mov rcx, qword [r12 + 8]
mov qword [rax], r12
mov qword [rax + 8], rcx
mov qword [r12 + 8], rax
mov qword [rcx], rax
mov rax, qword [rdi + 0x30]
mov qword [rsi], rax
jmp 0x2014b4fe
mov ecx, 6
call fcn.20128ab0
lea rax, [0x204148d8]
mov qword [rbp - 0x28], rax
cmp byte [0x205726c8], 0
jne 0x2014b522
nop
cmp byte [rbp - 8], 0
je 0x2014b522
lea rcx, [rbp - 0x28]
call fcn.200d1ec0
mov eax, ebx
add rsp, 0x58
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
nop
movzx eax, byte [0x2051ce7e]
cmp al, 0xcf
je 0x2014b5f0
mov cl, 0x51
mov al, 0x97
lock cmpxchg byte [0x2051ce7e], cl
je 0x2014b55c
cmp al, 0xcf
jne 0x2014b547
jmp 0x2014b5f0
lea rcx, [0x20417200]
mov r8d, 0xd989adfe
lea r9, [rcx + r8]
mov r10d, 0xd989adfc
xor r11d, r11d
movabs rsi, 0x4924924924924925
lea rdi, [0x2051ce70]
mov ebx, 0xd989adfd
mov rax, r8
shr rax, 1
mul rsi
shr rdx, 1
imul r14, rdx, 0xfffffffffffffff2
mov rax, r10
shr rax, 1
mul rsi
shr rdx, 1
imul rax, rdx, 0xfffffffffffffff2
add rax, rcx
add rax, r11
movzx edx, byte [r11 + rdi]
xor dl, byte [rbx + rax]
movzx eax, byte [r11 + rdi + 1]
xor dl, 0x49
xor al, byte [r9 + r14]
mov byte [r11 + rdi], dl
xor al, 0x49
mov byte [r11 + rdi + 1], al
add r11, 2
add r9, 2
add r8, 2
add r10, 2
cmp r11, 0xe
jne 0x2014b58c
mov al, 0xcf
xchg byte [0x2051ce7e], al
lea rcx, [0x2051ce70]
call fcn.20078170
int3
Function at 0x20166a50
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x48
mov r9, r8
mov rsi, rdx
mov rdi, rcx
nop
mov r8, qword [rcx]
mov r10, qword [r8 + 8]
cmp byte [0x20572768], 0
jne 0x20166a8e
xor ebp, ebp
cmp byte [r10 + 0x19], 0
je 0x20166a8e
mov rbx, r10
mov rax, r8
jmp 0x20166b1e
nop
cmp qword [r9 + 0x28], 0x10
jb 0x20166a9c
mov rcx, qword [r9 + 0x10]
jmp 0x20166aa0
lea rcx, [r9 + 0x10]
nop
mov rdx, qword [r9 + 0x20]
mov rax, r8
jmp 0x20166ad0
cmp r11, rdx
setb r11b
lea r10, [rbx + 0x10]
test r11b, r11b
cmove rax, rbx
cmove r10, rbx
mov r10, qword [r10]
cmp byte [r10 + 0x19], 0
jne 0x20166b16
mov rbx, r10
cmp qword [r10 + 0x48], 0x10
jb 0x20166ae0
mov r10, qword [rbx + 0x30]
jmp 0x20166ae4
lea r10, [rbx + 0x30]
mov r11, qword [rbx + 0x40]
cmp rdx, r11
mov r14, r11
cmovb r14, rdx
test r14, r14
je 0x20166ab0
xor r15d, r15d
nop word [rax + rax]
nop
movzx ebp, byte [rcx + r15]
cmp byte [r10 + r15], bpl
jne 0x20166ab3
inc r15
cmp r14, r15
jne 0x20166b00
jmp 0x20166ab0
xor r11b, 1
movzx ebp, r11b
nop
cmp byte [rax + 0x19], 0
je 0x20166b7e
movabs rax, 0x2aaaaaaaaaaaaaa
cmp qword [rdi + 8], rax
je 0x20166bf0
lea rcx, [rsp + 0x38]
mov rdx, rdi
call fcn.20166c00
mov r8, qword [rsp + 0x40]
mov qword [rsp + 0x28], rbx
mov dword [rsp + 0x30], ebp
lea rdx, [rsp + 0x28]
mov rcx, rdi
call fcn.20166f40
mov cl, 1
nop
mov qword [rsi], rax
mov byte [rsi + 8], cl
mov rax, rsi
add rsp, 0x48
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
nop
cmp qword [rax + 0x48], 0x10
jb 0x20166b8c
mov rcx, qword [rax + 0x30]
jmp 0x20166b90
lea rcx, [rax + 0x30]
mov rdx, qword [rax + 0x40]
mov r10, qword [r9 + 0x20]
cmp qword [r9 + 0x28], 0x10
jb 0x20166ba5
mov r11, qword [r9 + 0x10]
jmp 0x20166ba9
lea r11, [r9 + 0x10]
cmp rdx, r10
mov r14, r10
cmovb r14, rdx
test r14, r14
je 0x20166bd8
xor r15d, r15d
nop dword [rax + rax]
nop
movzx r12d, byte [r11 + r15]
movzx r13d, byte [rcx + r15]
cmp r12b, r13b
jne 0x20166be3
inc r15
cmp r14, r15
jne 0x20166bc0
cmp r10, rdx
jb 0x20166b25
jmp 0x20166be9
jb 0x20166b25
xor ecx, ecx
jmp 0x20166b63
call fcn.20076e20
int3
Function at 0x20176510
Capabilities:
Encode data using xor

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x28
movzx eax, byte [0x2051f060]
cmp al, 0x93
je 0x20176540
mov cl, 0x3f
nop word cs:[rax + rax]
mov al, 0xfe
lock cmpxchg byte [0x2051f060], cl
je 0x2017654c
cmp al, 0x93
jne 0x20176530
lea rcx, [0x2051f050]
call fcn.20078170
mov r9d, 0xd668c75d
lea r10, [0x204179a0]
mov r11d, 0xd668c75e
add r11, r10
lea rcx, [r9 + 1]
xor esi, esi
movabs rdi, 0x4ec4ec4ec4ec4ec5
lea rbx, [0x2051f050]
mov r8d, 0xd668c75d
nop
mov rax, rcx
mul rdi
shr rdx, 2
imul r14, rdx, 0xfffffffffffffff3
mov rax, r8
mul rdi
shr rdx, 2
imul rax, rdx, 0xfffffffffffffff3
add rax, r10
add rax, rsi
movzx edx, byte [rsi + rbx]
xor dl, byte [r9 + rax]
movzx eax, byte [rsi + rbx + 1]
xor dl, 0xe2
xor al, byte [r11 + r14]
mov byte [rsi + rbx], dl
xor al, 0xe2
mov byte [rsi + rbx + 1], al
add rsi, 2
add r11, 2
add rcx, 2
add r8, 2
cmp rsi, 0x10
jne 0x20176580
mov al, 0x93
xchg byte [0x2051f060], al
lea rcx, [0x2051f050]
call fcn.20078170
int3
Function at 0x2018cf40
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbp
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x50
lea rbp, [rsp + 0x50]
mov qword [rbp - 8], 0xfffffffffffffffe
mov rsi, rdx
mov rdi, rcx
nop
mov qword [rbp - 0x18], 0
movsxd rbx, dword [0x20418910]
mov r14d, dword [0x204188f8]
movsxd r12, dword [0x204188e8]
mov rax, qword [rcx + 8]
test byte [rax + 0xd], 4
jne 0x2018cfa2
mov ecx, 8
call fcn.20077cb0
mov r15, rax
lea rax, [0x204183c8]
mov qword [r15], rax
jmp 0x2018cfdd
mov ecx, 0x10
call fcn.20077cb0
mov rcx, rax
mov qword [rbp - 0x10], rax
call fcn.2018d300
nop
mov rcx, qword [rbp - 0x18]
mov r15, qword [rbp - 0x10]
cmp rcx, r15
je 0x2018cfdd
test rcx, rcx
je 0x2018cfdd
nop
mov rax, qword [rcx]
mov rax, qword [rax]
mov edx, 1
call qword [case.0x200c7fcc.0]
nop
mov qword [rbp - 0x18], r15
mov ecx, 0x40
call fcn.20077cb0
nop
mov rdx, qword [rdi + 8]
mov rcx, qword [rdi + 0x10]
movzx r9d, word [rdx + 8]
movzx r8d, word [rdi + 0x3c]
mov edx, dword [rdx]
lea r10, [rbp - 0x18]
mov qword [rsp + 0x28], r10
mov qword [rsp + 0x20], rcx
mov qword [rbp - 0x10], rax
mov rcx, rax
call fcn.2018d310
nop
mov edi, dword [0x20521b28]
lea r15d, [rdi + 1]
mov dword [0x20521b28], r15d
test r15d, edi
je 0x2018d0ee
xor r12d, r12d
mov edx, 1
cmp dword [0x20521b34], 0x83f22307
jne 0x2018d05a
nop
mov dword [0x20521b34], 0xbe7e6574
mov edx, 0xa
nop
mov rax, qword [rbp - 0x10]
mov qword [rsi], rax
mov rcx, qword [rbp - 0x18]
test rcx, rcx
je 0x2018d078
nop
mov rax, qword [rcx]
mov rax, qword [rax]
call qword [case.0x200c7fcc.0]
nop
mov ecx, dword [0x20521b38]
movzx eax, byte [0x204188e4]
cmp dword [0x20521b40], 0x564c88bd
jne 0x2018d0af
movzx eax, al
imul edx, eax, 0x69
add dl, 0x86
mov eax, r12d
sub al, dl
mul r12b
add al, dl
movzx eax, al
imul eax, eax, 0x69
add al, 0x58
jmp 0x2018d0b2
sub al, r12b
test r15d, edi
sete dl
mov r8b, 0xfe
sub r8b, dl
neg dl
cmp ecx, 0x98c2d3f3
movzx ecx, r8b
movzx edx, dl
cmove edx, ecx
and dl, al
movzx eax, dl
add qword [0x20572a68], rax
mov rax, rsi
add rsp, 0x50
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
pop rbp
ret
lea rax, [0x204188e8]
add rax, r12
cmp dword [0x20521b34], 0x3c99e135
mov rcx, rax
jne 0x2018d116
nop
mov dword [0x20521b3c], 0x8a06bf82
lea rcx, [rax - 0x18]
nop
movsxd r8, dword [rcx]
xor edx, edx
test r14d, r14d
jle 0x2018d036
lea r9, [0x20418910]
add rbx, r9
add rcx, r8
mov r8d, dword [0x20521b3c]
xor r12d, r12d
xor r9d, r9d
jmp 0x2018d15e
xor r12b, r11b
inc edx
cmp edx, r14d
jge 0x2018d039
movsxd r11, edx
add r11, rbx
cmp r8d, 0xbf996027
jne 0x2018d180
mov r10, rcx
neg r10
mov dword [0x20521b24], 0xa6e7810b
jmp 0x2018d186
mov r10, rcx
sub r10, r11
test r10, r10
movzx r11d, byte [r11]
jg 0x2018d150
inc r9d
add edx, r10d
add edx, 7
movsxd rcx, r9d
lea r10, [rax + rcx*4]
movsxd rcx, dword [rax + rcx*4]
add rcx, r10
xor r11d, r11d
jmp 0x2018d150
Function at 0x201b1f20
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x48
cmp qword [0x20572b60], 0
jne 0x201b2113
movzx eax, byte [0x2052479d]
cmp al, 2
je 0x201b2008
mov r8b, 0x6f
nop dword [rax]
mov al, 0x81
lock cmpxchg byte [0x2052479d], r8b
je 0x201b1f66
cmp al, 2
jne 0x201b1f50
jmp 0x201b2008
mov eax, 1
mov r8d, 0xc5dec045
mov r9d, 0x3a213fc4
mov r10d, 0xc5dec046
mov r11d, 0x3a213fc2
mov esi, 0xcccccccd
lea rdi, [0x20524790]
lea rbx, [0x2041a340]
nop word cs:[rax + rax]
mov r14d, r11d
imul r14, rsi
shr r14, 0x23
lea r14d, [r14 + r14*4]
lea r14d, [r10 + r14*2]
movzx ebp, byte [r14 + rbx]
xor bpl, 0x1f
add byte [rax + rdi - 1], bpl
cmp rax, 0xd
je 0x201b2000
mov r14d, r9d
imul r14, rsi
shr r14, 0x23
lea r14d, [r14 + r14*4]
lea ebp, [r8 + r14*2]
mov r14d, ebp
movzx ebp, byte [r14 + rbx]
xor bpl, 0x1f
add byte [rax + rdi], bpl
add rax, 2
add r8d, 0xfffffffe
add r9d, 2
add r10d, 0xfffffffe
add r11d, 2
jmp 0x201b1fa0
mov al, 2
xchg byte [0x2052479d], al
mov rsi, rcx
mov rdi, rdx
movzx eax, byte [0x205247ae]
cmp al, 0xbc
je 0x201b20e3
mov cl, 0xb0
nop
mov al, 0xbb
lock cmpxchg byte [0x205247ae], cl
je 0x201b2035
cmp al, 0xbc
jne 0x201b2020
jmp 0x201b20e3
mov eax, 0xa546c331
mov ecx, 0x5ab93cdc
mov edx, 1
mov r8d, 0xa546c332
mov r9d, 0x5ab93cda
mov r10d, 0x92492493
lea r11, [0x205247a0]
lea rbx, [0x2041a350]
nop word cs:[rax + rax]
mov r14d, ecx
shr r14d, 1
imul r14, r10
shr r14, 0x22
lea ebp, [r14 + r14]
shl r14d, 4
sub r14d, ebp
add r14d, eax
mov r15d, r9d
shr r15d, 1
imul r15, r10
shr r15, 0x22
lea ebp, [r15 + r15]
shl r15d, 4
sub r15d, ebp
add r15d, r8d
movzx ebp, byte [r15 + rbx]
xor bpl, 1
add byte [rdx + r11 - 1], bpl
movzx ebp, byte [r14 + rbx]
xor bpl, 1
add byte [rdx + r11], bpl
add eax, 0xfffffffe
add ecx, 2
add rdx, 2
add r8d, 0xfffffffe
add r9d, 2
cmp rdx, 0xf
jne 0x201b2070
mov al, 0xbc
xchg byte [0x205247ae], al
lea rax, [0x205247a0]
mov qword [rsp + 0x28], rax
lea rax, [0x20524790]
mov qword [rsp + 0x20], rax
mov r8d, 0x832d00c1
call fcn.201bc090
mov qword [0x20572b60], rax
mov rdx, rdi
mov rcx, rsi
mov rax, qword [0x20572b60]
add rsp, 0x48
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
pop r15
jmp rax
Function at 0x201b42e0
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x48
cmp qword [0x20572bb8], 0
jne 0x201b44d6
movzx eax, byte [0x2052495d]
cmp al, 0xc7
je 0x201b43b7
mov r10b, 0xe3
mov al, 0xaf
lock cmpxchg byte [0x2052495d], r10b
je 0x201b4326
cmp al, 0xc7
jne 0x201b4310
jmp 0x201b43b7
mov r10d, edx
mov r11d, 0xb3c1a906
xor esi, esi
movabs rdi, 0x4924924924924925
lea rbx, [0x2041a4b0]
mov r14d, 0xb3c1a907
lea r15, [0x20524950]
mov r12d, 0xb3c1a906
nop word cs:[rax + rax]
mov rax, r12
shr rax, 1
mul rdi
shr rdx, 1
imul rax, rdx, 0xfffffffffffffff2
add rax, rbx
lea rdx, [rax + rsi]
movzx ebp, byte [rsi + r15]
xor bpl, byte [r11 + rdx]
xor bpl, 0x6e
mov byte [rsi + r15], bpl
cmp rsi, 0xc
je 0x201b43ac
add rax, r14
movzx edx, byte [rsi + r15 + 1]
xor dl, byte [rax + rsi]
xor dl, 0x6e
mov byte [rsi + r15 + 1], dl
add rsi, 2
add r12, 2
jmp 0x201b4360
mov al, 0xc7
xchg byte [0x2052495d], al
mov edx, r10d
mov rsi, rcx
mov edi, edx
mov rbx, r8
mov ebp, r9d
movzx eax, byte [0x2052497a]
cmp al, 0x25
je 0x201b44a1
mov cl, 0x94
nop word cs:[rax + rax]
mov al, 0xc3
lock cmpxchg byte [0x2052497a], cl
je 0x201b43f5
cmp al, 0x25
jne 0x201b43e0
jmp 0x201b44a1
mov ecx, 0xb3c1a906
lea r8, [rcx + 0x4bf21ec4]
lea r9, [0x2041a4c0]
mov r10d, 0xffb3c7cc
add r10, r9
add rcx, 0x4bf21ec6
xor r11d, r11d
movabs r14, 0x4ec4ec4ec4ec4ec5
lea r15, [0x20524960]
mov r12d, 0xffb3c7cb
nop word cs:[rax + rax]
mov rax, rcx
mul r14
shr rdx, 3
imul r13, rdx, 0xffffffffffffffe6
mov rax, r8
mul r14
shr rdx, 3
imul rax, rdx, 0xffffffffffffffe6
add rax, r9
add rax, r11
movzx edx, byte [r11 + r15]
xor dl, byte [r12 + rax]
movzx eax, byte [r11 + r15 + 1]
xor dl, 0x67
xor al, byte [r10 + r13]
mov byte [r11 + r15], dl
xor al, 0x67
mov byte [r11 + r15 + 1], al
add r11, 2
add r10, 2
add rcx, 2
add r8, 2
cmp r11, 0x1a
jne 0x201b4440
mov al, 0x25
xchg byte [0x2052497a], al
lea rax, [0x20524960]
mov qword [rsp + 0x28], rax
lea rax, [0x20524950]
mov qword [rsp + 0x20], rax
mov r8d, 0x832d00c1
call fcn.201bc090
mov qword [0x20572bb8], rax
mov r9d, ebp
mov r8, rbx
mov edx, edi
mov rcx, rsi
mov rax, qword [0x20572bb8]
add rsp, 0x48
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
jmp rax