joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400e5250
Capabilities:
Enumerate files on windows

Disassembly:
push rbp
sub rsp, 0x20
lea rbp, [rsp + 0x20]
mov qword [rbp + 0x10], rbx
mov rbx, rdx
mov qword [rbp + 0x18], rsi
mov qword [rbp + 0x20], rdi
mov rdi, rcx
test rcx, rcx
je 0x1400e539f
test rdx, rdx
je 0x1400e539f
call fcn.140174cc4
mov dword [rax], 0
mov rcx, qword [rdi]
test rcx, rcx
jne 0x1400e53ca
xor eax, eax
mov rcx, rbx
cmp byte [rbx], al
je 0x1400e52b1
nop
cmp eax, 0x80000000
jae 0x1400e52b1
inc rcx
inc eax
cmp byte [rcx], 0
jne 0x1400e52a0
mov esi, eax
btr esi, 0x1f
lea rax, [rsi - 1]
cmp rax, 0x7ffffffb
ja 0x1400e53bd
mov ecx, 0x248
call fcn.140180118
mov qword [rdi], rax
test rax, rax
jne 0x1400e52e9
call fcn.140174cc4
mov dword [rax], recvfrom
jmp 0x1400e53aa
xor edx, edx
mov r8d, 0x248
mov rcx, rax
call fcn.140173680
cmp byte [rsi + rbx - 1], 0x2a
je 0x1400e5370
lea rax, [rsi + 3]
lea rcx, [rax + 0xf]
cmp rcx, rax
ja 0x1400e5317
movabs rcx, 0xffffffffffffff0
and rcx, 0xfffffffffffffff0
mov rax, rcx
call fcn.140172dd0
sub rsp, rcx
lea rdx, [rsp + 0x20]
mov rcx, rdx
sub rcx, rbx
movzx eax, byte [rbx]
mov byte [rcx + rbx], al
lea rbx, [rbx + 1]
test al, al
jne 0x1400e5331
movzx eax, byte [rdx + rsi - 1]
cmp al, 0x2f
je 0x1400e5364
cmp al, 0x5c
je 0x1400e5364
movzx eax, word [0x1401eefa8]
mov word [rdx + rsi], ax
movzx eax, byte [0x1401eefaa]
mov byte [rdx + rsi + 2], al
jmp 0x1400e536d
mov eax, 0x2a
mov word [rdx + rsi], ax
mov rbx, rdx
mov rdx, qword [rdi]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov rcx, qword [rdi]
mov qword [rcx + 0x140], rax
mov rcx, qword [rdi]
cmp qword [rcx + 0x140], 0xffffffffffffffff
jne 0x1400e53de
call fcn.140174cec
mov qword [rdi], 0
call fcn.140174cc4
mov dword [rax], reloc.WS2_32.dll_shutdown
xor eax, eax
mov rbx, qword [rbp + 0x10]
mov rsi, qword [rbp + 0x18]
mov rdi, qword [rbp + 0x20]
mov rsp, rbp
pop rbp
ret
call fcn.140174cc4
mov dword [rax], 2
jmp 0x1400e53aa
mov rdx, rcx
mov rcx, qword [rcx + 0x140]
call qword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
je 0x1400e53aa
mov rcx, qword [rdi]
mov r8d, 0xff
lea rdx, [rcx + 0x2c]
add rcx, 0x148
call fcn.140183270
mov rax, qword [rdi]
mov rbx, qword [rbp + 0x10]
mov rsi, qword [rbp + 0x18]
mov byte [rax + 0x247], 0
mov rax, qword [rdi]
mov rdi, qword [rbp + 0x20]
add rax, 0x148
mov rsp, rbp
pop rbp
ret
Function at 0x1400e6960
Capabilities:
Encode data using xor

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rcx
push rbp
push rsi
push rdi
push r12
push r13
push r15
sub rsp, 0xa8
mov rax, qword [rdx + 8]
xor esi, esi
mov r15, qword [rdx + 0x10]
sub rax, r8
mov qword [rsp + 0xe8], rax
mov rdi, r8
mov r13, rdx
mov r12, rcx
mov ebp, esi
cmp r15, r8
jb 0x1400e6b18
cmp r8, 0x40
ja 0x1400e6b18
lea rax, [rsp + 0x20]
mov qword [r11 + 0x20], rbx
neg rax
mov qword [r11 - 0x38], r14
and eax, 0x3f
lea r14, [rsp + 0x20]
add r14, rax
lea rax, [r8 + 0x100]
cmp r15, rax
jbe 0x1400e69de
mov rbp, r15
sub rbp, r8
sub rbp, 0x100
xor edx, edx
mov rcx, r14
mov rbx, rsi
call fcn.140173680
mov r9, rsi
cmp rbp, r15
jae 0x1400e6aae
mov rcx, qword [r13 + 0x20]
mov r12, rsi
mov r10, qword [r13 + 8]
mov r11, qword [rsp + 0xe8]
mov qword [rsp + 0xf0], rcx
lea r13, [rcx + r10]
nop word [rax + rax]
add rcx, rbp
mov rax, rbp
xor rax, r11
mov rdx, rcx
sub rdx, r13
xor rdx, r10
lea r8, [rax - 1]
not rax
shr rax, 0x3f
shr r8, 0x3f
and r8, rax
mov rax, rbp
xor rax, r10
neg r8
or rdx, rax
or r12, r8
xor rdx, rbp
and r8, r9
shr rdx, 0x3f
or rbx, r8
neg rdx
inc rbp
and r12, rdx
movzx eax, r12b
and al, byte [rcx]
or byte [r9 + r14], al
inc r9
mov rcx, r9
mov rax, r9
sub rcx, rdi
xor rax, rdi
xor rcx, rdi
or rcx, rax
xor rcx, r9
shr rcx, 0x3f
neg rcx
and r9, rcx
mov rcx, qword [rsp + 0xf0]
cmp rbp, r15
jb 0x1400e6a20
mov r12, qword [rsp + 0xe0]
test rdi, rdi
je 0x1400e6af2
mov rax, rbx
xor rax, 0x20
movzx eax, byte [rax + r14]
movzx eax, byte [rbx + r14]
inc rbx
mov byte [rsi + r12], al
mov rcx, rbx
sub rcx, rdi
mov rax, rbx
xor rcx, rdi
xor rax, rdi
or rcx, rax
inc rsi
xor rcx, rbx
shr rcx, 0x3f
neg rcx
and rbx, rcx
cmp rsi, rdi
jb 0x1400e6ab3
mov r14, qword [rsp + 0xa0]
mov eax, 1
mov rbx, qword [rsp + 0xf8]
add rsp, 0xa8
pop r15
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
mov r8d, 0x612
lea rdx, str.c:_cygwin_home_shachar_zon_new_pkg_lib_openssl_ssl_record_ssl3_record.c
lea rcx, str.Assertion_failed:_rec__orig_len___md_size__md_size___EVP_MAX_MD_SIZE
call fcn.14006a910
xor eax, eax
add rsp, 0xa8
pop r15
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x1400e7d40
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x20], rbx
push rsi
sub rsp, 0x20
mov rax, qword [rcx + 8]
lea rsi, [r9 + 1]
mov rbx, rdx
mov rdx, qword [rdx + 8]
mov r9, qword [rax + 0xc0]
test byte [r9 + 0x60], 1
je 0x1400e7d92
lea rax, [rsi + r8]
cmp rax, rdx
jbe 0x1400e7d7d
xor eax, eax
mov rbx, qword [rsp + 0x48]
add rsp, 0x20
pop rsi
ret
add qword [rbx + 0x20], r8
sub rdx, r8
add qword [rbx + 0x28], r8
sub qword [rbx + 0x10], r8
mov qword [rbx + 8], rdx
jmp 0x1400e7d97
cmp rsi, rdx
ja 0x1400e7d70
mov rax, qword [rbx + 0x20]
mov rcx, qword [rcx + 0x430]
mov qword [rsp + 0x40], rdi
movzx edi, byte [rax + rdx - 1]
call fcn.14005e4e0
mov rcx, rax
call fcn.14005e6c0
mov r8, qword [rbx + 8]
and eax, 0x200000
je 0x1400e7dd4
sub r8, rdi
mov eax, 1
dec r8
jmp 0x1400e7e86
lea rcx, [rdi + rsi]
mov qword [rsp + 0x38], rbp
mov ebp, 0x100
mov r9, r8
sub r9, rcx
mov rax, r8
xor r9, rcx
xor rax, rcx
or r9, rax
xor r9, r8
shr r9, 0x3f
dec r9
cmp r8, rbp
cmovb rbp, r8
xor r10d, r10d
test rbp, rbp
je 0x1400e7e5d
mov r11, qword [rbx + 0x20]
mov rsi, rdi
shr rsi, 0x3f
dec r11
add r11, r8
nop
mov rax, r10
lea r11, [r11 - 1]
shr rax, 0x3f
mov rcx, rdi
sub rcx, r10
inc r10
shr rcx, 0x3f
xor cl, al
xor al, sil
or cl, al
movzx eax, byte [r11 + 1]
dec cl
movzx edx, cl
mov rcx, rdi
xor rcx, rax
and rdx, rcx
not rdx
and r9, rdx
cmp r10, rbp
jb 0x1400e7e20
mov rbp, qword [rsp + 0x38]
lea rax, [rdi + 1]
not r9
movzx ecx, r9b
dec rcx
shr rcx, 0x3f
neg rcx
and rax, rcx
sub r8, rax
mov eax, ecx
and eax, 1
not ecx
or eax, ecx
mov rdi, qword [rsp + 0x40]
mov qword [rbx + 8], r8
mov rbx, qword [rsp + 0x48]
add rsp, 0x20
pop rsi
ret
Function at 0x1400ec6f0
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0xb0
mov rax, qword [rcx]
xor r14d, r14d
movsxd rdi, r8d
mov rbp, r9
mov rsi, rdx
mov rbx, rcx
mov r13d, r14d
lea r12d, [r14 + 1]
test r9, r9
je 0x1400ec745
cmp r9, rax
je 0x1400ec73d
test rdx, rdx
je 0x1400ec736
test r8d, r8d
jns 0x1400ec73d
xor eax, eax
jmp 0x1400ec948
mov r13d, r12d
mov qword [rcx], r9
jmp 0x1400ec74d
test rax, rax
je 0x1400ec736
mov rbp, rax
mov qword [rsp + 0xe0], r15
mov r15, qword [rsp + 0x100]
test rsi, rsi
je 0x1400ec964
mov rcx, rbp
mov r13d, r12d
call fcn.14005ec50
cmp eax, 0x90
mov r12d, r14d
mov r15d, eax
setle r12b
jle 0x1400ec79b
mov r8d, 0x29
lea rdx, str.c:_cygwin_home_shachar_zon_new_pkg_lib_openssl_crypto_hmac_hmac.c
lea rcx, str.Assertion_failed:_j____int_sizeof_ctx__key_
call fcn.14006a910
test r12d, r12d
je 0x1400ec7eb
cmp r15d, edi
jge 0x1400ec7f2
mov r15, qword [rsp + 0x100]
mov rdx, rbp
mov rcx, qword [rbx + 8]
mov r8, r15
call fcn.140073db0
test eax, eax
je 0x1400ec7eb
mov rcx, qword [rbx + 8]
mov r8, rdi
mov rdx, rsi
call fcn.140074000
test eax, eax
je 0x1400ec7eb
mov rcx, qword [rbx + 8]
lea rsi, [rbx + 0x20]
mov r8, rsi
lea rdx, [rbx + 0x24]
call fcn.140073ce0
test eax, eax
jne 0x1400ec817
xor eax, eax
jmp 0x1400ec940
cmp edi, 0x90
ja 0x1400ec7eb
mov r8, rdi
lea rcx, [rbx + 0x24]
mov rdx, rsi
call fcn.140173e20
mov r15, qword [rsp + 0x100]
lea rsi, [rbx + 0x20]
mov dword [rsi], edi
mov ecx, dword [rsi]
cmp ecx, 0x90
je 0x1400ec83a
mov eax, ecx
mov r8d, 0x90
sub r8d, ecx
xor edx, edx
lea rcx, [rbx + 0x24]
add rcx, rax
call fcn.140173680
mov r12d, r13d
lea rcx, [rsp + 0x20]
mov rax, rbx
sub rax, rcx
mov rdx, r14
lea rdi, [rax + 0x24]
lea rsi, [rax + 0x25]
nop dword [rax]
nop word [rax + rax]
lea rcx, [rsp + 0x20]
add rcx, rdx
add rdx, 2
movzx eax, byte [rdi + rcx]
xor al, 0x36
mov byte [rcx], al
movzx eax, byte [rsi + rcx]
xor al, 0x36
mov byte [rcx + 1], al
cmp rdx, 0x90
jl 0x1400ec860
mov rcx, qword [rbx + 0x10]
mov r8, r15
mov rdx, rbp
call fcn.140073db0
test eax, eax
je 0x1400ec929
mov rcx, rbp
call fcn.14005ec50
mov rcx, qword [rbx + 0x10]
lea rdx, [rsp + 0x20]
movsxd r8, eax
call fcn.140074000
test eax, eax
je 0x1400ec929
mov rdx, r14
nop dword [rax]
lea rcx, [rsp + 0x20]
add rcx, rdx
add rdx, 2
movzx eax, byte [rdi + rcx]
xor al, 0x5c
mov byte [rcx], al
movzx eax, byte [rsi + rcx]
xor al, 0x5c
mov byte [rcx + 1], al
cmp rdx, 0x90
jl 0x1400ec8c0
mov rcx, qword [rbx + 0x18]
mov r8, r15
mov rdx, rbp
call fcn.140073db0
test eax, eax
je 0x1400ec929
mov rcx, rbp
call fcn.14005ec50
mov rcx, qword [rbx + 0x18]
lea rdx, [rsp + 0x20]
movsxd r8, eax
call fcn.140074000
test eax, eax
je 0x1400ec929
mov rdx, qword [rbx + 0x10]
mov rcx, qword [rbx + 8]
call fcn.140074040
test eax, eax
cmovne r14d, r12d
test r13d, r13d
je 0x1400ec93d
mov edx, 0x90
lea rcx, [rsp + 0x20]
call fcn.140073b20
mov eax, r14d
mov r15, qword [rsp + 0xe0]
lea r11, [rsp + 0xb0]
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsp, r11
pop r14
pop r13
pop r12
pop rdi
pop rsi
ret
test r13d, r13d
je 0x1400ec916
jmp 0x1400ec83d
Function at 0x1400fb2b0
Capabilities:
Encode data using base64

Disassembly:
sub rsp, 8
xor r11d, r11d
test rcx, rcx
je 0x1400fb2c9
test byte [rcx + 0x5c], 2
lea r10, str.0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz._
jne 0x1400fb2d0
lea r10, [0x1401f9950]
test r9d, r9d
jle 0x1400fb3bf
inc r8
mov qword [rsp], rbx
movzx eax, byte [r8 - 1]
cmp r9d, 3
jl 0x1400fb341
movzx ecx, al
movzx eax, byte [r8]
shl rcx, 8
or rcx, rax
movzx eax, byte [r8 + 1]
shl rcx, 8
or rcx, rax
mov rax, rcx
shr rax, 0x12
movzx eax, byte [rax + r10]
mov byte [rdx], al
mov rax, rcx
shr rax, 0xc
and eax, 0x3f
movzx eax, byte [rax + r10]
mov byte [rdx + 1], al
mov rax, rcx
shr rax, 6
and eax, 0x3f
and ecx, 0x3f
movzx eax, byte [rax + r10]
mov byte [rdx + 2], al
movzx ecx, byte [rcx + r10]
jmp 0x1400fb391
movzx ecx, al
shl ecx, 0x10
cmp r9d, 2
jne 0x1400fb356
movzx eax, byte [r8]
shl eax, 8
or ecx, eax
mov rax, rcx
shr rax, 0x12
movzx eax, byte [rax + r10]
mov byte [rdx], al
mov rax, rcx
shr rax, 0xc
and eax, 0x3f
movzx eax, byte [rax + r10]
mov byte [rdx + 1], al
cmp r9d, 1
jne 0x1400fb380
mov al, 0x3d
jmp 0x1400fb38c
shr rcx, 6
and ecx, 0x3f
movzx eax, byte [rcx + r10]
mov byte [rdx + 2], al
mov cl, 0x3d
lea rax, [rdx + 3]
add r11d, 4
lea rdx, [rax + 1]
mov byte [rax], cl
add r8, 3
sub r9d, 3
test r9d, r9d
jg 0x1400fb2e0
mov rbx, qword [rsp]
mov eax, r11d
mov byte [rdx], 0
add rsp, 8
ret
mov byte [rdx], r11b
mov eax, r11d
add rsp, 8
ret

Function at 0x140100e70
Capabilities:
Hash data using sha512

Disassembly:
push rbx
sub rsp, 0x100
test r8, r8
mov dword [rsp + 0xf4], 0x40
movabs rax, 0x6a09e667f3bcc908
lea rbx, [0x14026fa70]
mov qword [rsp + 0x20], rax
cmovne rbx, r8
movabs rax, 0xbb67ae8584caa73b
mov r8, rdx
mov qword [rsp + 0x28], rax
mov rdx, rcx
movabs rax, 0x3c6ef372fe94f82b
lea rcx, [rsp + 0x20]
mov qword [rsp + 0x30], rax
movabs rax, 0xa54ff53a5f1d36f1
mov qword [rsp + 0x38], rax
movabs rax, 0x510e527fade682d1
mov qword [rsp + 0x40], rax
movabs rax, 0x9b05688c2b3e6c1f
mov qword [rsp + 0x48], rax
movabs rax, 0x1f83d9abfb41bd6b
mov qword [rsp + 0x50], rax
movabs rax, 0x5be0cd19137e2179
mov qword [rsp + 0x58], rax
xor eax, eax
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], rax
mov dword [rsp + 0xf0], eax
call fcn.1401017e0
lea rdx, [rsp + 0x20]
mov rcx, rbx
call fcn.140100f60
mov edx, 0xd8
lea rcx, [rsp + 0x20]
call fcn.140073b20
mov rax, rbx
add rsp, 0x100
pop rbx
ret
Function at 0x140105c10
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
mov qword [rsp + 0x20], r9
push rbp
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x30
mov rax, qword [rbp + 0x50]
mov r12, rcx
movzx ecx, byte [rax + 7]
lea rdi, [rax + 1]
mov r13, qword [rbp + 0x58]
mov rsi, rdx
movzx edx, byte [rdi + 3]
xor r15d, r15d
movzx r11d, byte [rax]
mov r14d, r8d
movzx eax, byte [rdi]
mov ebx, dword [r13]
shl eax, 8
or r11d, eax
shl ecx, 8
movzx eax, byte [rdi + 1]
shl eax, 0x10
or r11d, eax
movzx eax, byte [rdi + 2]
shl eax, 0x18
or r11d, eax
movzx eax, byte [rdi + 4]
shl eax, 8
or edx, eax
mov dword [rbp - 8], r11d
movzx eax, byte [rdi + 5]
or ecx, eax
mov byte [rbp - 0x10], r11b
shl ecx, 0x10
mov eax, r11d
shr eax, 8
or edx, ecx
mov byte [rbp - 0xf], al
mov eax, r11d
shr eax, 0x10
mov byte [rbp - 0xe], al
mov eax, r11d
shr eax, 0x18
mov byte [rbp - 0xd], al
mov eax, edx
shr eax, 8
mov byte [rbp - 0xb], al
mov eax, edx
shr eax, 0x10
mov byte [rbp - 0xa], al
mov eax, edx
shr eax, 0x18
mov dword [rbp - 4], edx
mov byte [rbp - 0xc], dl
mov byte [rbp - 9], al
test r8d, r8d
je 0x140105db8
mov r13, qword [rbp + 0x48]
sub r12, rsi
movzx r8d, dl
movzx r9d, r11b
nop dword [rax]
dec r14d
test ebx, ebx
jne 0x140105d56
lea r8d, [rbx + 1]
mov rdx, r13
lea rcx, [rbp - 8]
call fcn.140102080
mov r11d, dword [rbp - 8]
mov eax, r11d
mov edx, dword [rbp - 4]
movzx r9d, byte [rbp - 8]
movzx r8d, byte [rbp - 4]
shr eax, 8
mov byte [rbp - 0xf], al
mov eax, r11d
shr eax, 0x10
mov byte [rbp - 0xe], al
mov eax, r11d
shr eax, 0x18
mov byte [rbp - 0xd], al
mov eax, edx
shr eax, 8
mov byte [rbp - 0xb], al
mov eax, edx
shr eax, 0x10
mov byte [rbp - 0xa], al
mov eax, edx
shr eax, 0x18
mov byte [rbp - 9], al
inc r15d
mov byte [rbp - 0x10], r9b
mov byte [rbp - 0xc], r8b
movsxd rax, ebx
movzx ecx, byte [rbp + rax - 0x10]
xor cl, byte [r12 + rsi]
mov byte [rsi], cl
inc rsi
inc ebx
and ebx, 7
test r14d, r14d
jne 0x140105cf0
mov r13, qword [rbp + 0x58]
test r15d, r15d
je 0x140105db8
mov rax, qword [rbp + 0x50]
mov byte [rax], r9b
mov eax, r11d
shr eax, 8
mov byte [rdi], al
mov eax, r11d
shr eax, 0x10
mov byte [rdi + 1], al
mov eax, edx
shr eax, 8
shr r11d, 0x18
mov byte [rdi + 2], r11b
mov byte [rdi + 3], r8b
mov byte [rdi + 4], al
mov eax, edx
shr eax, 0x10
shr edx, 0x18
mov byte [rdi + 5], al
mov byte [rdi + 6], dl
mov rsi, qword [rsp + 0x68]
mov rdi, qword [rsp + 0x70]
mov dword [r13], ebx
mov rbx, qword [rsp + 0x60]
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
Function at 0x140106970
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], r9
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x30
mov rax, qword [rsp + 0x90]
mov r15, rcx
movzx ecx, byte [rax + 7]
lea rdi, [rax + 1]
mov r12, qword [rsp + 0x98]
mov rsi, rdx
movzx edx, byte [rdi + 3]
xor r14d, r14d
movzx r11d, byte [rax]
mov ebp, r8d
movzx eax, byte [rdi]
mov ebx, dword [r12]
shl eax, 8
or r11d, eax
shl ecx, 8
movzx eax, byte [rdi + 1]
shl eax, 0x10
or r11d, eax
movzx eax, byte [rdi + 2]
shl eax, 0x18
or r11d, eax
movzx eax, byte [rdi + 4]
shl eax, 8
or edx, eax
mov dword [rsp + 0x28], r11d
movzx eax, byte [rdi + 5]
or ecx, eax
mov byte [rsp + 0x20], r11b
shl ecx, 0x10
mov eax, r11d
shr eax, 8
or edx, ecx
mov byte [rsp + 0x21], al
mov eax, r11d
shr eax, 0x10
mov byte [rsp + 0x22], al
mov eax, r11d
shr eax, 0x18
mov byte [rsp + 0x23], al
mov eax, edx
shr eax, 8
mov byte [rsp + 0x25], al
mov eax, edx
shr eax, 0x10
mov byte [rsp + 0x26], al
mov eax, edx
shr eax, 0x18
mov dword [rsp + 0x2c], edx
mov byte [rsp + 0x24], dl
mov byte [rsp + 0x27], al
test r8d, r8d
je 0x140106b31
mov r12, qword [rsp + 0x78]
sub r15, rsi
mov qword [rsp + 0x60], r13
mov r13, qword [rsp + 0x88]
dec ebp
test ebx, ebx
jne 0x140106ac4
mov r8, qword [rsp + 0x80]
lea rcx, [rsp + 0x28]
mov r9, r13
mov rdx, r12
call fcn.140104540
mov r11d, dword [rsp + 0x28]
mov eax, r11d
mov edx, dword [rsp + 0x2c]
shr eax, 8
mov byte [rsp + 0x21], al
mov eax, r11d
shr eax, 0x10
mov byte [rsp + 0x22], al
mov eax, r11d
shr eax, 0x18
mov byte [rsp + 0x23], al
mov eax, edx
shr eax, 8
mov byte [rsp + 0x25], al
mov eax, edx
shr eax, 0x10
mov byte [rsp + 0x26], al
mov eax, edx
shr eax, 0x18
mov byte [rsp + 0x27], al
inc r14d
mov byte [rsp + 0x20], r11b
mov byte [rsp + 0x24], dl
movsxd rax, ebx
movzx ecx, byte [rsp + rax + 0x20]
xor cl, byte [r15 + rsi]
mov byte [rsi], cl
inc rsi
inc ebx
and ebx, 7
test ebp, ebp
jne 0x140106a58
mov r13, qword [rsp + 0x60]
mov r12, qword [rsp + 0x98]
test r14d, r14d
je 0x140106b31
mov rax, qword [rsp + 0x90]
mov byte [rax], r11b
mov eax, r11d
shr eax, 8
mov byte [rdi], al
mov eax, r11d
shr eax, 0x10
mov byte [rdi + 1], al
mov eax, edx
shr eax, 8
shr r11d, 0x18
mov byte [rdi + 2], r11b
mov byte [rdi + 3], dl
mov byte [rdi + 4], al
mov eax, edx
shr eax, 0x10
shr edx, 0x18
mov byte [rdi + 5], al
mov byte [rdi + 6], dl
mov rbp, qword [rsp + 0x70]
mov dword [r12], ebx
mov rbx, qword [rsp + 0x68]
add rsp, 0x30
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret
Function at 0x140107e90
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
mov qword [rsp + 0x20], r9
push rbp
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x30
mov rax, qword [rbp + 0x50]
mov rsi, rdx
movzx edx, byte [rax + 4]
lea rdi, [rax + 1]
mov r13, qword [rbp + 0x58]
lea r9, [rdi + 5]
mov r12, rcx
shl edx, 0x18
movzx r10d, byte [rax]
xor r15d, r15d
movzx eax, byte [rdi]
mov r14d, r8d
movzx ecx, byte [r9]
mov ebx, dword [r13]
shl eax, 0x10
shl r10d, 0x18
or r10d, eax
shl ecx, 8
movzx eax, byte [rdi + 1]
shl eax, 8
or r10d, eax
movzx eax, byte [rdi + 2]
or r10d, eax
movzx eax, byte [rdi + 4]
shl eax, 0x10
or edx, eax
mov dword [rbp - 8], r10d
movzx eax, byte [r9 + 1]
or ecx, eax
mov byte [rbp - 0xd], r10b
or edx, ecx
mov eax, r10d
shr eax, 0x18
mov byte [rbp - 0x10], al
mov eax, r10d
shr eax, 0x10
mov byte [rbp - 0xf], al
mov eax, r10d
shr eax, 8
mov byte [rbp - 0xe], al
mov eax, edx
shr eax, 0x18
mov byte [rbp - 0xc], al
mov eax, edx
shr eax, 0x10
mov byte [rbp - 0xb], al
mov eax, edx
shr eax, 8
mov dword [rbp - 4], edx
mov byte [rbp - 0xa], al
mov byte [rbp - 9], dl
test r8d, r8d
je 0x14010802d
mov r13, qword [rbp + 0x48]
sub r12, rsi
movzx r8d, dl
movzx r9d, r10b
nop
dec r14d
test ebx, ebx
jne 0x140107fcf
mov rdx, r13
lea rcx, [rbp - 8]
call fcn.140107480
mov r10d, dword [rbp - 8]
mov eax, r10d
mov edx, dword [rbp - 4]
movzx r9d, r10b
shr eax, 0x18
movzx r8d, dl
mov byte [rbp - 0x10], al
mov eax, r10d
shr eax, 0x10
mov byte [rbp - 0xf], al
mov eax, r10d
shr eax, 8
mov byte [rbp - 0xe], al
mov eax, edx
shr eax, 0x18
mov byte [rbp - 0xc], al
mov eax, edx
shr eax, 0x10
mov byte [rbp - 0xb], al
mov eax, edx
shr eax, 8
mov byte [rbp - 0xa], al
inc r15d
mov byte [rbp - 0xd], r10b
mov byte [rbp - 9], dl
movsxd rax, ebx
movzx ecx, byte [rbp + rax - 0x10]
xor cl, byte [r12 + rsi]
mov byte [rsi], cl
inc rsi
inc ebx
and ebx, 7
test r14d, r14d
jne 0x140107f70
mov r13, qword [rbp + 0x58]
test r15d, r15d
je 0x14010802d
mov rcx, qword [rbp + 0x50]
mov eax, r10d
shr eax, 0x18
mov byte [rcx], al
mov eax, r10d
shr eax, 0x10
mov byte [rdi], al
mov eax, edx
shr eax, 0x18
shr r10d, 8
mov byte [rdi + 1], r10b
mov byte [rdi + 2], r9b
mov byte [rdi + 3], al
mov eax, edx
shr eax, 0x10
mov byte [rdi + 4], al
shr edx, 8
mov byte [rdi + 5], dl
mov byte [rdi + 6], r8b
mov rsi, qword [rsp + 0x68]
mov rdi, qword [rsp + 0x70]
mov dword [r13], ebx
mov rbx, qword [rsp + 0x60]
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
Function at 0x140108e40
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
mov qword [rsp + 0x20], r9
push rbp
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x30
mov rax, qword [rbp + 0x50]
mov r12, rcx
movzx ecx, byte [rax + 7]
lea rdi, [rax + 1]
mov r13, qword [rbp + 0x58]
mov rsi, rdx
movzx edx, byte [rdi + 3]
xor r15d, r15d
movzx r11d, byte [rax]
mov r14d, r8d
movzx eax, byte [rdi]
mov ebx, dword [r13]
shl eax, 8
or r11d, eax
shl ecx, 8
movzx eax, byte [rdi + 1]
shl eax, 0x10
or r11d, eax
movzx eax, byte [rdi + 2]
shl eax, 0x18
or r11d, eax
movzx eax, byte [rdi + 4]
shl eax, 8
or edx, eax
mov dword [rbp - 8], r11d
movzx eax, byte [rdi + 5]
or ecx, eax
mov byte [rbp - 0x10], r11b
shl ecx, 0x10
mov eax, r11d
shr eax, 8
or edx, ecx
mov byte [rbp - 0xf], al
mov eax, r11d
shr eax, 0x10
mov byte [rbp - 0xe], al
mov eax, r11d
shr eax, 0x18
mov byte [rbp - 0xd], al
mov eax, edx
shr eax, 8
mov byte [rbp - 0xb], al
mov eax, edx
shr eax, 0x10
mov byte [rbp - 0xa], al
mov eax, edx
shr eax, 0x18
mov dword [rbp - 4], edx
mov byte [rbp - 0xc], dl
mov byte [rbp - 9], al
test r8d, r8d
je 0x140108fe0
mov r13, qword [rbp + 0x48]
sub r12, rsi
movzx r8d, dl
movzx r9d, r11b
nop dword [rax]
dec r14d
test ebx, ebx
jne 0x140108f82
mov rdx, r13
lea rcx, [rbp - 8]
call fcn.140108ae0
mov r11d, dword [rbp - 8]
mov eax, r11d
mov edx, dword [rbp - 4]
movzx r9d, byte [rbp - 8]
movzx r8d, byte [rbp - 4]
shr eax, 8
mov byte [rbp - 0xf], al
mov eax, r11d
shr eax, 0x10
mov byte [rbp - 0xe], al
mov eax, r11d
shr eax, 0x18
mov byte [rbp - 0xd], al
mov eax, edx
shr eax, 8
mov byte [rbp - 0xb], al
mov eax, edx
shr eax, 0x10
mov byte [rbp - 0xa], al
mov eax, edx
shr eax, 0x18
mov byte [rbp - 9], al
inc r15d
mov byte [rbp - 0x10], r9b
mov byte [rbp - 0xc], r8b
movsxd rax, ebx
movzx ecx, byte [rbp + rax - 0x10]
xor cl, byte [r12 + rsi]
mov byte [rsi], cl
inc rsi
inc ebx
and ebx, 7
test r14d, r14d
jne 0x140108f20
mov r13, qword [rbp + 0x58]
test r15d, r15d
je 0x140108fe0
mov rax, qword [rbp + 0x50]
mov byte [rax], r9b
mov eax, r11d
shr eax, 8
mov byte [rdi], al
mov eax, r11d
shr eax, 0x10
mov byte [rdi + 1], al
mov eax, edx
shr eax, 8
shr r11d, 0x18
mov byte [rdi + 2], r11b
mov byte [rdi + 3], r8b
mov byte [rdi + 4], al
mov eax, edx
shr eax, 0x10
shr edx, 0x18
mov byte [rdi + 5], al
mov byte [rdi + 6], dl
mov rsi, qword [rsp + 0x68]
mov rdi, qword [rsp + 0x70]
mov dword [r13], ebx
mov rbx, qword [rsp + 0x60]
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rbp
ret