joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1401376c0
Capabilities:
Encode data using xor

Disassembly:
mov r11, rsp
mov dword [r11 + 0x18], r8d
mov qword [r11 + 0x10], rdx
mov qword [r11 + 8], rcx
push rdi
sub rsp, 0x60
mov rax, qword [rcx + 0x18]
mov r10d, r8d
mov qword [r11 - 0x30], r13
mov r13, rcx
mov qword [r11 - 0x40], r15
mov r9d, dword [rax + 8]
mov edi, r9d
shr edi, 0x18
mov dword [r11 + 0x20], r9d
cmp edi, 0xff
jae 0x140137757
test edi, edi
jne 0x14013770b
mov word [r11 + 0x20], di
mov byte [r11 + 0x22], dil
jmp 0x14013774f
movzx eax, r9b
imul eax, edi
add eax, 0x7f
shr eax, 8
mov byte [rsp + 0x88], al
movzx eax, byte [rsp + 0x89]
imul eax, edi
add eax, 0x7f
shr eax, 8
mov byte [rsp + 0x89], al
movzx eax, byte [rsp + 0x8a]
imul eax, edi
add eax, 0x7f
shr eax, 8
mov byte [rsp + 0x8a], al
mov r9d, dword [rsp + 0x88]
xor r8d, r8d
mov r15d, 1
cmp dword [rcx + 0x28], r15d
jle 0x14013790e
mov qword [rsp + 0x58], rbx
lea eax, [r10 - 1]
mov qword [rsp + 0x50], rbp
mov ebp, 0x10
mov qword [rsp + 0x48], rsi
mov qword [rsp + 0x40], r12
xor r12d, r12d
movd xmm1, eax
mov qword [rsp + 0x30], r14
cvtdq2pd xmm1, xmm1
nop word [rax + rax]
mov rcx, qword [r13 + 0x18]
movaps xmm0, xmm1
mulsd xmm0, qword [rcx + rbp]
call fcn.14010b9a0
mov ecx, dword [rcx + rbp + 8]
mov r11d, eax
mov edx, ecx
mov dword [rsp + 0x88], ecx
sub r11d, r8d
shr edx, 0x18
mov edi, eax
cmp edx, 0xff
jae 0x140137830
test edx, edx
jne 0x1401377e6
mov word [rsp + 0x88], dx
mov byte [rsp + 0x8a], dl
jmp 0x140137829
movzx eax, cl
imul eax, edx
add eax, 0x7f
shr eax, 8
mov byte [rsp + 0x88], al
movzx eax, byte [rsp + 0x89]
imul eax, edx
add eax, 0x7f
shr eax, 8
mov byte [rsp + 0x89], al
movzx eax, byte [rsp + 0x8a]
imul eax, edx
add eax, 0x7f
shr eax, 8
mov byte [rsp + 0x8a], al
mov ecx, dword [rsp + 0x88]
xor ebx, ebx
test r11d, r11d
jle 0x1401378d4
mov r13, qword [rsp + 0x78]
mov r14d, r9d
shr r9d, 8
mov r10d, ecx
shr r10d, 8
and r9d, 0xff00ff
and r10d, 0xff00ff
mov dword [rsp + 0x88], edi
sub r10d, r9d
mov esi, ecx
shl r9d, 8
and r14d, 0xff00ff
and esi, 0xff00ff
sub esi, r14d
nop dword [rax]
mov eax, ebx
mov r8d, esi
shl eax, 8
inc ebx
cdq
idiv r11d
mov edx, r10d
imul r8d, eax
mov edi, eax
imul edx, eax
mov eax, r10d
imul eax, edi
shr r8d, 8
add r8d, r14d
add edx, r9d
xor r8d, edx
add eax, r9d
and r8d, 0xff00ff
xor r8d, eax
mov dword [r13 + r12*4], r8d
inc r12
cmp ebx, r11d
jl 0x140137880
mov r13, qword [rsp + 0x70]
mov r8d, dword [rsp + 0x88]
inc r15d
add rbp, 0x10
mov r9d, ecx
cmp r15d, dword [r13 + 0x28]
jl 0x1401377a0
mov rdx, qword [rsp + 0x78]
mov r10d, dword [rsp + 0x80]
mov r14, qword [rsp + 0x30]
mov r12, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
mov rbp, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x58]
mov r15, qword [rsp + 0x28]
mov r13, qword [rsp + 0x38]
cmp r8d, r10d
jge 0x14013792f
movsxd rax, r8d
sub r10d, r8d
movsxd rcx, r10d
lea rdi, [rdx + rax*4]
mov eax, r9d
rep stosd dword [rdi], eax
add rsp, 0x60
pop rdi
ret
Function at 0x14014c160
Capabilities:
Check for software breakpoints

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
sub rsp, 0x20
xor ebp, ebp
mov rbx, rcx
cmp dword [rcx + 0x24], 0xcc
je 0x14014c18e
mov rax, qword [rcx + 0x200]
call qword [rax]
mov dword [rbx + 0x98], ebp
mov dword [rbx + 0x24], 0xcc
mov rax, qword [rbx + 0x200]
mov qword [rsp + 0x30], rsi
mov qword [rsp + 0x38], rdi
cmp byte [rax + 0x10], bpl
je 0x14014c235
mov ecx, dword [rbx + 0x98]
nop
cmp ecx, dword [rbx + 0x78]
jae 0x14014c204
mov rax, qword [rbx + 0x10]
mov edi, ecx
test rax, rax
je 0x14014c1dc
mov dword [rax + 8], ecx
mov rcx, qword [rbx + 0x10]
mov eax, dword [rbx + 0x78]
mov dword [rcx + 0xc], eax
mov rcx, rbx
mov rax, qword [rbx + 0x10]
call qword [rax]
mov edi, dword [rbx + 0x98]
mov rax, qword [rbx + 0x208]
lea r8, [rbx + 0x98]
xor r9d, r9d
xor edx, edx
mov rcx, rbx
call qword [rax + 8]
mov ecx, dword [rbx + 0x98]
cmp ecx, edi
je 0x14014c25d
cmp ecx, dword [rbx + 0x78]
jb 0x14014c1b5
mov rax, qword [rbx + 0x200]
mov rcx, rbx
call qword [rax + 8]
mov rax, qword [rbx + 0x200]
mov rcx, rbx
call qword [rax]
mov dword [rbx + 0x98], ebp
mov ecx, ebp
mov rax, qword [rbx + 0x200]
cmp byte [rax + 0x10], cl
jne 0x14014c1b0
cmp byte [rbx + 0x59], bpl
mov al, 1
setne bpl
add ebp, 0xcd
mov dword [rbx + 0x24], ebp
mov rdi, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop rbp
ret
xor al, al
jmp 0x14014c248
Function at 0x140158f20
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x20
xor esi, esi
mov rdi, rcx
mov qword [rcx + 8], rsi
mov ecx, 0x98
mov dword [rsp + 0x38], esi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov rbx, rax
test rax, rax
jne 0x140158f67
mov rdx, qword [rdi]
mov dword [rdx + 0x28], 0x36
mov rcx, qword [rdi]
mov dword [rcx + 0x2c], esi
mov rcx, rdi
mov rdx, qword [rdi]
call qword [rdx]
mov dword [rbx + 0x5c], 0x3b9aca00
lea rax, [fcn.140158160]
mov qword [rbx], rax
lea rcx, str.JPEGMEM
lea rax, [fcn.1401582f0]
mov qword [rdi + 8], rbx
mov qword [rbx + 8], rax
lea rax, [fcn.1401583e0]
mov qword [rbx + 0x10], rax
lea rax, [fcn.1401584d0]
mov qword [rbx + 0x18], rax
lea rax, [0x1401585c0]
mov qword [rbx + 0x20], rax
lea rax, [0x140158670]
mov qword [rbx + 0x28], rax
lea rax, [0x140158720]
mov qword [rbx + 0x30], rax
lea rax, [0x1401588c0]
mov qword [rbx + 0x38], rax
lea rax, [0x140158b30]
mov qword [rbx + 0x40], rax
lea rax, [fcn.140158da0]
mov qword [rbx + 0x48], rax
lea rax, [0x140158ee0]
mov qword [rbx + 0x50], rax
mov eax, dword [rsp + 0x38]
mov dword [rbx + 0x58], eax
mov qword [rbx + 0x68], rsi
mov qword [rbx + 0x78], rsi
mov qword [rbx + 0x60], rsi
mov qword [rbx + 0x70], rsi
mov qword [rbx + 0x80], rsi
mov qword [rbx + 0x88], rsi
mov dword [rbx + 0x90], 0x98
call qword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll_getenv]
test rax, rax
je 0x14015906f
lea r9, [rsp + 0x30]
mov byte [rsp + 0x30], 0x78
lea r8, [rsp + 0x38]
mov rcx, rax
lea rdx, str._ld_c
call fcn.1401359f0
test eax, eax
jle 0x14015906f
movzx eax, byte [rsp + 0x30]
sub al, 0x4d
test al, 0xdf
jne 0x140159062
imul eax, dword [rsp + 0x38], 0x3e8
jmp 0x140159066
mov eax, dword [rsp + 0x38]
imul eax, eax, 0x3e8
mov dword [rbx + 0x58], eax
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret
Function at 0x140159310
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
mov qword [rsp + 8], rcx
push rbx
push rbp
push rdi
push r13
push r15
sub rsp, 0x30
mov r13d, dword [rcx + 0x64]
mov r8d, 0x2fe
mov rbx, qword [rcx + 0x250]
cmp r13d, 1
mov edx, 1
mov qword [rsp + 0x68], rbx
sete al
mov rdi, rcx
mov byte [rbx + 0x38], al
mov rax, qword [rcx + 8]
mov r9d, dword [rcx + 0x7c]
mov r10, qword [rax + 0x10]
mov eax, 0x100
cmovne r8d, eax
call r10
mov ebp, dword [rbx + 0x28]
xor r15d, r15d
mov qword [rbx + 0x30], rax
cmp dword [rdi + 0x7c], r15d
jle 0x140159491
mov qword [rsp + 0x70], rsi
mov qword [rsp + 0x28], r12
lea r12, [rbx + 0x3c]
mov qword [rsp + 0x20], r14
xor r14d, r14d
nop word [rax + rax]
mov esi, dword [r12]
mov eax, ebp
cdq
idiv esi
mov ebp, eax
cmp r13d, 1
jne 0x1401593ad
mov rax, qword [rbx + 0x30]
add qword [r14 + rax], 0xff
mov rax, qword [rbx + 0x30]
lea r11d, [rsi*2 - 2]
xor r8d, r8d
xor r10d, r10d
mov rdi, qword [r14 + rax]
lea eax, [rsi + 0xfe]
cdq
idiv r11d
xor ebx, ebx
mov r9d, eax
cmp r10d, r9d
jle 0x140159407
imul eax, r8d, 0x1fe
lea ecx, [rsi + 0xfe]
add ecx, eax
nop word [rax + rax]
add ecx, 0x1fe
inc r8d
mov eax, ecx
cdq
idiv r11d
mov r9d, eax
cmp r10d, eax
jg 0x1401593f0
movzx eax, r8b
inc r10d
movzx ecx, bpl
imul ecx, eax
mov byte [rbx + rdi], cl
inc rbx
cmp rbx, 0xff
jle 0x1401593d2
cmp r13d, 1
jne 0x140159463
mov ecx, r13d
lea rdx, [rdi - 1]
nop dword [rax]
nop word [rax + rax]
movzx eax, byte [rdi]
mov byte [rdx], al
lea rdx, [rdx - 1]
movzx eax, byte [rdi + 0xff]
mov byte [rdi + rcx + 0xff], al
inc rcx
cmp rcx, 0xff
jle 0x140159440
mov rax, qword [rsp + 0x60]
inc r15d
mov rbx, qword [rsp + 0x68]
add r12, 4
add r14, 8
cmp r15d, dword [rax + 0x7c]
jl 0x140159390
mov r14, qword [rsp + 0x20]
mov r12, qword [rsp + 0x28]
mov rsi, qword [rsp + 0x70]
add rsp, 0x30
pop r15
pop r13
pop rdi
pop rbp
pop rbx
ret
Function at 0x1401594a0
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push rbx
sub rsp, 0x20
mov rax, qword [rcx + 8]
mov ebx, edx
mov edx, 1
mov r8d, 0x400
mov r9, qword [rax]
call r9
shl ebx, 9
lea r11, [0x140276280]
add ebx, 0xfffffe00
mov r10, rax
xor ecx, ecx
lea r9, [rax + 8]
movzx edx, byte [rcx + r11]
mov eax, 0xfe01
imul r8d, edx, 0x1fe
sub eax, r8d
cdq
idiv ebx
mov dword [r9 - 8], eax
movzx eax, byte [rcx + r11 + 1]
imul edx, eax, 0x1fe
mov eax, 0xfe01
sub eax, edx
cdq
idiv ebx
mov dword [r9 - 4], eax
movzx eax, byte [rcx + r11 + 2]
imul edx, eax, 0x1fe
mov eax, 0xfe01
sub eax, edx
cdq
idiv ebx
mov dword [r9], eax
movzx eax, byte [rcx + r11 + 3]
imul edx, eax, 0x1fe
mov eax, 0xfe01
sub eax, edx
cdq
idiv ebx
mov dword [r9 + 4], eax
movzx eax, byte [rcx + r11 + 4]
imul edx, eax, 0x1fe
mov eax, 0xfe01
sub eax, edx
cdq
idiv ebx
mov dword [r9 + 8], eax
movzx eax, byte [rcx + r11 + 5]
imul edx, eax, 0x1fe
mov eax, 0xfe01
sub eax, edx
cdq
idiv ebx
mov dword [r9 + 0xc], eax
movzx eax, byte [rcx + r11 + 6]
imul edx, eax, 0x1fe
mov eax, 0xfe01
sub eax, edx
cdq
idiv ebx
mov dword [r9 + 0x10], eax
movzx eax, byte [rcx + r11 + 7]
imul edx, eax, 0x1fe
mov eax, 0xfe01
sub eax, edx
cdq
idiv ebx
mov dword [r9 + 0x14], eax
movzx eax, byte [rcx + r11 + 8]
imul edx, eax, 0x1fe
mov eax, 0xfe01
sub eax, edx
cdq
idiv ebx
mov dword [r9 + 0x18], eax
movzx eax, byte [rcx + r11 + 9]
imul edx, eax, 0x1fe
mov eax, 0xfe01
sub eax, edx
cdq
idiv ebx
mov dword [r9 + 0x1c], eax
movzx eax, byte [rcx + r11 + 0xa]
imul edx, eax, 0x1fe
mov eax, 0xfe01
sub eax, edx
cdq
idiv ebx
mov dword [r9 + 0x20], eax
movzx eax, byte [rcx + r11 + 0xb]
imul edx, eax, 0x1fe
mov eax, 0xfe01
sub eax, edx
cdq
lea r9, [r9 + 0x40]
idiv ebx
mov dword [r9 - 0x1c], eax
movzx eax, byte [rcx + r11 + 0xc]
imul edx, eax, 0x1fe
mov eax, 0xfe01
sub eax, edx
cdq
idiv ebx
mov dword [r9 - 0x18], eax
movzx eax, byte [rcx + r11 + 0xd]
imul edx, eax, 0x1fe
mov eax, 0xfe01
sub eax, edx
cdq
idiv ebx
mov dword [r9 - 0x14], eax
movzx eax, byte [rcx + r11 + 0xe]
imul edx, eax, 0x1fe
mov eax, 0xfe01
sub eax, edx
cdq
idiv ebx
mov dword [r9 - 0x10], eax
movzx eax, byte [rcx + r11 + 0xf]
add rcx, 0x10
imul edx, eax, 0x1fe
mov eax, 0xfe01
sub eax, edx
cdq
idiv ebx
mov dword [r9 - 0xc], eax
cmp rcx, 0x100
jl 0x1401594d6
mov rax, r10
add rsp, 0x20
pop rbx
ret
Function at 0x140177f90
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push r14
sub rsp, 0x50
cmp dword [rcx + 0x10], 0
mov ebp, r8d
movaps xmmword [rsp + 0x40], xmm6
mov rsi, rcx
movaps xmm6, xmm3
movsxd r14, edx
jle 0x140178144
test r8d, r8d
jle 0x140178144
mov r9d, r8d
mov qword [rsp + 0x60], rbx
mov rbx, qword [rsp + 0x98]
lea rdx, [rsp + 0x30]
mov r8d, r14d
test byte [rbx], 0x44
sete al
mov byte [rsp + 0x20], al
call fcn.140177e70
mov ecx, dword [rbx]
mov eax, ecx
movss xmm2, dword [0x1402c29f0]
movss xmm4, dword [rsp + 0x88]
shr eax, 6
test al, 1
jne 0x140178024
mov eax, ecx
shr eax, 2
test al, 1
je 0x14017803e
movaps xmm0, xmm4
subss xmm0, dword [rsp + 0x38]
mulss xmm0, xmm2
addss xmm0, xmm6
movaps xmm6, xmm0
subss xmm6, dword [rsp + 0x30]
mov eax, ecx
shr eax, 3
test al, 1
je 0x14017805c
movss xmm1, dword [rsp + 0x80]
jmp 0x1401780a4
mov eax, ecx
shr eax, 1
test al, 1
je 0x140178024
movss xmm0, dword [rsp + 0x30]
addss xmm6, xmm4
addss xmm0, dword [rsp + 0x38]
subss xmm6, xmm0
jmp 0x14017802a
shr ecx, 4
test cl, 1
je 0x140178088
movss xmm1, dword [rsp + 0x80]
movss xmm0, dword [rsp + 0x34]
addss xmm1, dword [rsp + 0x90]
addss xmm0, dword [rsp + 0x3c]
subss xmm1, xmm0
jmp 0x1401780aa
movss xmm1, dword [rsp + 0x90]
subss xmm1, dword [rsp + 0x3c]
mulss xmm1, xmm2
addss xmm1, dword [rsp + 0x80]
subss xmm1, dword [rsp + 0x34]
movaps xmm3, xmm6
movss dword [rsp + 0x20], xmm1
mov r8d, ebp
mov edx, r14d
mov rcx, rsi
call fcn.1401778a0
mov eax, dword [rbx]
shr eax, 6
test al, 1
je 0x14017813f
mov rax, qword [rsi]
xor ecx, ecx
mov qword [rsp + 0x68], rdi
mov ebx, ecx
mov rdi, r14
shl rdi, 5
movss xmm0, dword [rdi + rax + 0x14]
nop dword [rax]
nop word [rax + rax]
mov rax, qword [rsi]
movss xmm2, dword [rdi + rax + 0x14]
ucomiss xmm2, xmm0
je 0x140178118
mov r8d, ebx
lea edx, [rcx + r14]
sub r8d, ecx
movaps xmm3, xmm4
mov rcx, rsi
call fcn.140178160
mov ecx, ebx
movaps xmm0, xmm2
inc ebx
add rdi, 0x20
cmp ebx, ebp
jl 0x1401780f0
mov rdi, qword [rsp + 0x68]
cmp ebx, ecx
jle 0x14017813f
sub ebx, ecx
lea edx, [rcx + r14]
mov r8d, ebx
movaps xmm3, xmm4
mov rcx, rsi
call fcn.140178160
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
movaps xmm6, xmmword [rsp + 0x40]
add rsp, 0x50
pop r14
ret
Function at 0x140194300
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push rsi
push r12
sub rsp, 0x38
mov r12, qword [rcx + 0x10]
mov rsi, rdx
movsxd rax, dword [rcx + 0x20]
shl rax, 4
add rax, r12
mov qword [rsp], r12
mov qword [rsp + 8], rax
cmp r12, rax
je 0x140194532
mov qword [rsp + 0x58], rbx
mov qword [rsp + 0x30], rbp
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], r13
mov qword [rsp + 0x18], r14
mov qword [rsp + 0x10], r15
nop word [rax + rax]
mov r14d, dword [r12 + 4]
mov eax, dword [r12 + 0xc]
mov r10d, dword [r12 + 8]
add eax, r14d
mov r13d, dword [r12]
mov dword [rsp + 0x68], r10d
cmp r14d, eax
jge 0x140194501
mov r12d, eax
nop word [rax + rax]
mov rcx, qword [rsi + 8]
mov edi, r13d
mov r9, qword [rsi]
mov ebp, r10d
sub edi, dword [rsi + 0x14]
mov eax, dword [r9 + 0xc]
imul eax, r14d
movsxd r8, eax
mov eax, r14d
sub eax, dword [rsi + 0x18]
add r8, qword [r9]
cdq
mov qword [rsi + 0x20], r8
idiv dword [rcx + 0x18]
imul edx, dword [rcx + 0xc]
movsxd rax, edx
add rax, qword [rcx]
mov qword [rsi + 0x28], rax
movsxd rdx, dword [r9 + 0x10]
mov eax, edx
imul eax, r13d
movsxd rcx, eax
add rcx, r8
cmp dword [rsi + 0x10], 0xfe
jge 0x1401944af
mov r15, rdx
nop word [rax + rax]
mov r8, qword [rsi + 8]
mov eax, edi
movzx ebx, byte [rcx + 1]
cdq
mov r9d, 0x100
inc edi
dec ebp
idiv dword [r8 + 0x14]
mov eax, dword [r8 + 0x10]
imul eax, edx
movsxd r8, eax
add r8, qword [rsi + 0x28]
movzx edx, byte [r8 + 1]
movzx r10d, byte [r8 + 2]
or edx, 0xff0000
imul edx, dword [rsi + 0x10]
shl r10d, 0x10
shr edx, 8
and edx, 0xff00ff
mov eax, edx
shr eax, 0x10
sub r9d, eax
movzx eax, byte [r8]
or r10d, eax
imul ebx, r9d
imul r10d, dword [rsi + 0x10]
movzx eax, byte [rcx]
shr ebx, 8
add ebx, edx
shr r10d, 8
movzx edx, byte [rcx + 2]
and r10d, 0xff00ff
shl edx, 0x10
or edx, eax
imul edx, r9d
shr edx, 8
and edx, 0xff00ff
add r10d, edx
mov edx, 0x100
mov eax, r10d
shr eax, 8
and eax, 0xff00ff
sub edx, eax
mov eax, ebx
shr eax, 8
or edx, r10d
neg al
and edx, 0xff00ff
or al, bl
mov byte [rcx], dl
mov byte [rcx + 1], al
mov eax, edx
shr eax, 0x10
mov byte [rcx + 2], al
add rcx, r15
test ebp, ebp
jg 0x1401943e0
mov r10d, dword [rsp + 0x68]
jmp 0x1401944f1
mov r9, rdx
mov r8, qword [rsi + 8]
mov eax, edi
cdq
inc edi
dec ebp
idiv dword [r8 + 0x14]
mov eax, dword [r8 + 0x10]
imul eax, edx
movsxd r8, eax
add r8, qword [rsi + 0x28]
movzx eax, word [r8]
movzx edx, byte [r8 + 2]
mov byte [rcx], al
mov word [rsp + 0x50], ax
movzx eax, byte [rsp + 0x51]
mov byte [rcx + 1], al
mov byte [rcx + 2], dl
add rcx, r9
test ebp, ebp
jg 0x1401944b2
inc r14d
cmp r14d, r12d
jl 0x140194380
mov r12, qword [rsp]
add r12, 0x10
mov qword [rsp], r12
cmp r12, qword [rsp + 8]
jne 0x140194350
mov r15, qword [rsp + 0x10]
mov r14, qword [rsp + 0x18]
mov r13, qword [rsp + 0x20]
mov rdi, qword [rsp + 0x28]
mov rbp, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x58]
add rsp, 0x38
pop r12
pop rsi
ret
Function at 0x140194540
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push rsi
push r14
sub rsp, 8
mov rsi, qword [rcx + 0x10]
mov r11, rdx
movsxd r14, dword [rcx + 0x20]
shl r14, 4
add r14, rsi
cmp rsi, r14
je 0x1401946d3
mov qword [rsp + 0x20], rbx
mov qword [rsp + 0x28], rbp
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x38], r12
mov qword [rsp], r15
nop dword [rax + rax]
mov ebx, dword [rsi + 4]
mov ebp, dword [rsi + 0xc]
mov r15d, dword [rsi]
add ebp, ebx
mov r12d, dword [rsi + 8]
cmp ebx, ebp
jge 0x1401946ae
nop word [rax + rax]
mov r9, qword [r11]
mov r10d, r12d
mov rcx, qword [r11 + 8]
mov eax, dword [r9 + 0xc]
imul eax, ebx
movsxd r8, eax
mov eax, ebx
sub eax, dword [r11 + 0x18]
add r8, qword [r9]
cdq
mov qword [r11 + 0x20], r8
idiv dword [rcx + 0x18]
imul edx, dword [rcx + 0xc]
movsxd rax, edx
add rax, qword [rcx]
mov qword [r11 + 0x28], rax
movsxd rdx, dword [r9 + 0x10]
mov r9d, r15d
sub r9d, dword [r11 + 0x14]
mov eax, edx
imul eax, r15d
mov rdi, rdx
movsxd rcx, eax
add rcx, r8
cmp dword [r11 + 0x10], 0xfe
jge 0x140194660
nop word [rax + rax]
mov r8, qword [r11 + 8]
mov eax, r9d
cdq
inc r9d
dec r10d
idiv dword [r8 + 0x14]
mov eax, dword [r8 + 0x10]
imul eax, edx
movsxd rdx, eax
mov rax, qword [r11 + 0x28]
movzx r8d, byte [rdx + rax + 3]
mov edx, 0x100
mov eax, dword [r11 + 0x10]
inc eax
imul r8d, eax
movzx eax, byte [rcx]
shr r8d, 8
sub edx, r8d
imul edx, eax
sar edx, 8
add dl, r8b
mov byte [rcx], dl
add rcx, rdi
test r10d, r10d
jg 0x140194600
jmp 0x1401946a4
mov r8, qword [r11 + 8]
mov eax, r9d
cdq
inc r9d
dec r10d
idiv dword [r8 + 0x14]
mov eax, dword [r8 + 0x10]
imul eax, edx
movsxd rdx, eax
mov rax, qword [r11 + 0x28]
movzx r8d, byte [rdx + rax + 3]
mov edx, 0x100
movzx eax, byte [rcx]
sub edx, r8d
imul edx, eax
sar edx, 8
add dl, r8b
mov byte [rcx], dl
add rcx, rdi
test r10d, r10d
jg 0x140194660
inc ebx
cmp ebx, ebp
jl 0x1401945a0
add rsi, 0x10
cmp rsi, r14
jne 0x140194580
mov r15, qword [rsp]
mov r12, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x20]
add rsp, 8
pop r14
pop rsi
ret
Function at 0x140194a40
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push rsi
push r14
sub rsp, 8
mov rsi, qword [rcx + 0x10]
mov r11, rdx
movsxd r14, dword [rcx + 0x20]
shl r14, 4
add r14, rsi
cmp rsi, r14
je 0x140194bd2
mov qword [rsp + 0x20], rbx
mov qword [rsp + 0x28], rbp
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x38], r12
mov qword [rsp], r15
nop dword [rax + rax]
mov ebx, dword [rsi + 4]
mov ebp, dword [rsi + 0xc]
mov r15d, dword [rsi]
add ebp, ebx
mov r12d, dword [rsi + 8]
cmp ebx, ebp
jge 0x140194bad
nop word [rax + rax]
mov r9, qword [r11]
mov r10d, r12d
mov rcx, qword [r11 + 8]
mov eax, dword [r9 + 0xc]
imul eax, ebx
movsxd r8, eax
mov eax, ebx
sub eax, dword [r11 + 0x18]
add r8, qword [r9]
cdq
mov qword [r11 + 0x20], r8
idiv dword [rcx + 0x18]
imul edx, dword [rcx + 0xc]
movsxd rax, edx
add rax, qword [rcx]
mov qword [r11 + 0x28], rax
movsxd rdx, dword [r9 + 0x10]
mov r9d, r15d
sub r9d, dword [r11 + 0x14]
mov eax, edx
imul eax, r15d
mov rdi, rdx
movsxd rcx, eax
add rcx, r8
cmp dword [r11 + 0x10], 0xfe
jge 0x140194b60
nop word [rax + rax]
mov r8, qword [r11 + 8]
mov eax, r9d
cdq
inc r9d
dec r10d
idiv dword [r8 + 0x14]
mov eax, dword [r8 + 0x10]
imul eax, edx
movsxd rdx, eax
mov rax, qword [r11 + 0x28]
movzx r8d, byte [rdx + rax]
mov edx, 0x100
mov eax, dword [r11 + 0x10]
inc eax
imul r8d, eax
movzx eax, byte [rcx]
shr r8d, 8
sub edx, r8d
imul edx, eax
sar edx, 8
add dl, r8b
mov byte [rcx], dl
add rcx, rdi
test r10d, r10d
jg 0x140194b00
jmp 0x140194ba3
mov r8, qword [r11 + 8]
mov eax, r9d
cdq
inc r9d
dec r10d
idiv dword [r8 + 0x14]
mov eax, dword [r8 + 0x10]
imul eax, edx
movsxd rdx, eax
mov rax, qword [r11 + 0x28]
movzx r8d, byte [rdx + rax]
mov edx, 0x100
movzx eax, byte [rcx]
sub edx, r8d
imul edx, eax
sar edx, 8
add dl, r8b
mov byte [rcx], dl
add rcx, rdi
test r10d, r10d
jg 0x140194b60
inc ebx
cmp ebx, ebp
jl 0x140194aa0
add rsi, 0x10
cmp rsi, r14
jne 0x140194a80
mov r15, qword [rsp]
mov r12, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x20]
add rsp, 8
pop r14
pop rsi
ret
Function at 0x140195b30
Capabilities:
Encode data using xor

Disassembly:
push rsi
push r15
sub rsp, 0x28
mov r15, qword [rcx + 0x10]
mov rsi, rdx
movsxd rax, dword [rcx + 0x20]
shl rax, 4
add rax, r15
mov qword [rsp + 0x50], rax
cmp r15, rax
je 0x140195cf9
mov qword [rsp + 0x48], rbx
mov qword [rsp + 0x20], rbp
mov qword [rsp + 0x18], rdi
mov qword [rsp + 0x10], r12
mov qword [rsp + 8], r13
mov qword [rsp], r14
nop word [rax + rax]
mov edi, dword [r15 + 4]
mov r13d, dword [r15 + 0xc]
mov r10d, dword [r15]
add r13d, edi
mov r12d, dword [r15 + 8]
mov dword [rsp + 0x40], r10d
cmp edi, r13d
jge 0x140195ccd
mov r8, qword [rsi]
mov eax, dword [r8 + 0xc]
imul eax, edi
movsxd rdx, eax
add rdx, qword [r8]
mov qword [rsi + 8], rdx
movsxd r9, dword [r8 + 0x10]
mov eax, r9d
imul eax, r10d
movsxd rcx, eax
mov eax, dword [rsi + 0x10]
add rcx, rdx
cmp byte [rsi + 0x13], 0xff
jb 0x140195be1
mov edx, r12d
mov dword [rcx], eax
dec edx
add rcx, r9
test edx, edx
jg 0x140195bd1
jmp 0x140195cc2
mov ebx, eax
mov ebp, r12d
shr ebx, 8
mov r14, r9
and ebx, 0xff00ff
and eax, 0xff00ff
nop word [rax + rax]
mov edx, ebx
mov r8d, 0x100
shr edx, 0x10
mov r9d, 0x100
sub r8d, edx
dec ebp
mov edx, dword [rcx]
mov r10d, edx
shr edx, 8
and r10d, 0xff00ff
and edx, 0xff00ff
imul r10d, r8d
imul edx, r8d
mov r8d, 0x100
shr r10d, 8
shr edx, 8
and r10d, 0xff00ff
and edx, 0xff00ff
add r10d, eax
lea r11d, [rdx + rbx]
mov edx, r11d
shr edx, 8
and edx, 0xff00ff
sub r9d, edx
mov edx, r11d
shl edx, 8
shl r9d, 8
or r9d, edx
mov edx, r10d
shr edx, 8
and edx, 0xff00ff
sub r8d, edx
mov edx, r11d
or r8d, r10d
shr edx, 8
xor r9d, r8d
shl r11d, 8
and edx, 0xff00ff
and r9d, 0xff00ff
mov r8d, 0x100
sub r8d, edx
shl r8d, 8
or r8d, r11d
xor r9d, r8d
mov dword [rcx], r9d
add rcx, r14
test ebp, ebp
jg 0x140195c00
mov r10d, dword [rsp + 0x40]
inc edi
cmp edi, r13d
jl 0x140195ba0
add r15, 0x10
cmp r15, qword [rsp + 0x50]
jne 0x140195b80
mov r14, qword [rsp]
mov r13, qword [rsp + 8]
mov r12, qword [rsp + 0x10]
mov rdi, qword [rsp + 0x18]
mov rbp, qword [rsp + 0x20]
mov rbx, qword [rsp + 0x48]
add rsp, 0x28
pop r15
pop rsi
ret