joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140004e60
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rbx, rcx
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov edx, 8
mov rcx, rax
lea r8d, [rdx + 4]
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
xor r11d, r11d
lea rsi, str.Imagesfinanzen_tdisney_tpsql_texec_tens_taspxgrid_tmaillists_topeninviter_temailit_tcronjob_tmodalfiles_tartistas_tdokumenty_tpical_tremoto_tdevbin_tjob_twebmaster_tajaxstarrater_tsklad_tbannerads_tinfinite_tvbpro_tgraphx_tsuperstage_tcareerservices_till_thotlink_tdt_tdadmin_tteam_tlivros_tvticnf_tdtp_twbb_tgopher_tpopwin_tcms_tsanfrancisco_tproductimages
mov r10, rax
sub rbx, rax
movabs rdi, 0x66b893a954436921
lea r9, [rax + 2]
nop dword [rax + rax]
movsxd r8, r11d
lea r9, [r9 + 0xc]
mov rax, rdi
mov rcx, r8
mul r8
add r11d, 6
shr rdx, 7
imul rax, rdx, 0x13f
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 1]
xor al, byte [rbx + r9 - 0xe]
movsx eax, al
mov word [r9 - 0xe], ax
mov rax, rdi
mul rcx
shr rdx, 7
imul rax, rdx, 0x13f
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 2]
xor al, byte [r9 + rbx - 0xc]
movsx eax, al
mov word [r9 - 0xc], ax
mov rax, rdi
mul rcx
shr rdx, 7
imul rax, rdx, 0x13f
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 3]
xor al, byte [rbx + r9 - 0xa]
movsx eax, al
mov word [r9 - 0xa], ax
mov rax, rdi
mul rcx
shr rdx, 7
imul rax, rdx, 0x13f
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 4]
xor al, byte [rbx + r9 - 8]
movsx eax, al
mov word [r9 - 8], ax
mov rax, rdi
mul rcx
shr rdx, 7
imul rax, rdx, 0x13f
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 5]
xor al, byte [rbx + r9 - 6]
movsx eax, al
mov word [r9 - 6], ax
mov rax, rdi
mul rcx
shr rdx, 7
imul rax, rdx, 0x13f
sub rcx, rax
movzx eax, byte [rcx + rsi]
xor al, byte [rbx + r9 - 4]
movsx eax, al
mov word [r9 - 4], ax
cmp r11d, 6
jb 0x140004eb0
mov rbx, qword [rsp + 0x30]
mov rax, r10
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x140004fd0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rbx, rcx
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov edx, 8
mov rcx, rax
lea r8d, [rdx + 0xe]
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
xor r11d, r11d
lea rsi, str.Imagesfinanzen_tdisney_tpsql_texec_tens_taspxgrid_tmaillists_topeninviter_temailit_tcronjob_tmodalfiles_tartistas_tdokumenty_tpical_tremoto_tdevbin_tjob_twebmaster_tajaxstarrater_tsklad_tbannerads_tinfinite_tvbpro_tgraphx_tsuperstage_tcareerservices_till_thotlink_tdt_tdadmin_tteam_tlivros_tvticnf_tdtp_twbb_tgopher_tpopwin_tcms_tsanfrancisco_tproductimages
mov r10, rax
sub rbx, rax
movabs rdi, 0x66b893a954436921
lea r9, [rax + 2]
nop dword [rax + rax]
movsxd r8, r11d
mov rax, rdi
mul r8
mov rcx, r8
shr rdx, 7
imul rax, rdx, 0x13f
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 1]
xor al, byte [rbx + r9 - 2]
movsx eax, al
mov word [r9 - 2], ax
mov rax, rdi
mul rcx
shr rdx, 7
imul rax, rdx, 0x13f
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 2]
xor al, byte [rbx + r9]
movsx eax, al
mov word [r9], ax
mov rax, rdi
mul rcx
shr rdx, 7
imul rax, rdx, 0x13f
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 3]
xor al, byte [rbx + r9 + 2]
movsx eax, al
mov word [r9 + 2], ax
mov rax, rdi
mul rcx
shr rdx, 7
imul rax, rdx, 0x13f
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 4]
xor al, byte [rbx + r9 + 4]
movsx eax, al
mov word [r9 + 4], ax
mov rax, rdi
mul rcx
shr rdx, 7
imul rax, rdx, 0x13f
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 5]
xor al, byte [rbx + r9 + 6]
movsx eax, al
mov word [r9 + 6], ax
mov rax, rdi
mul rcx
shr rdx, 7
imul rax, rdx, 0x13f
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 6]
xor al, byte [rbx + r9 + 8]
movsx eax, al
mov word [r9 + 8], ax
mov rax, rdi
mul rcx
shr rdx, 7
imul rax, rdx, 0x13f
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 7]
xor al, byte [rbx + r9 + 0xa]
movsx eax, al
mov word [r9 + 0xa], ax
mov rax, rdi
mul rcx
shr rdx, 7
imul rax, rdx, 0x13f
sub rcx, rax
movzx eax, byte [rcx + rsi]
xor al, byte [rbx + r9 + 0xc]
movsx eax, al
mov word [r9 + 0xc], ax
lea rcx, [r8 + 8]
mov rax, rdi
mul rcx
add r11d, 0xb
lea r9, [r9 + 0x16]
shr rdx, 7
imul rax, rdx, 0x13f
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 9]
xor al, byte [rbx + r9 - 8]
movsx eax, al
mov word [r9 - 8], ax
mov rax, rdi
mul rcx
shr rdx, 7
imul rax, rdx, 0x13f
sub rcx, rax
movzx eax, byte [rcx + rsi]
lea rcx, [r8 + 0xa]
xor al, byte [rbx + r9 - 6]
movsx eax, al
mov word [r9 - 6], ax
mov rax, rdi
mul rcx
shr rdx, 7
imul rax, rdx, 0x13f
sub rcx, rax
movzx eax, byte [rcx + rsi]
xor al, byte [rbx + r9 - 4]
movsx eax, al
mov word [r9 - 4], ax
cmp r11d, 0xb
jb 0x140005020
mov rbx, qword [rsp + 0x30]
mov rax, r10
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x140008fd0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x40
mov rbx, qword [0x1400141c0]
lea rcx, [rbp - 0x20]
mov dword [rbp - 0x20], 0x5001a
mov dword [rbp - 0x1c], 0xb0004
mov dword [rbp - 0x18], 0x400009
mov dword [rbp - 0x14], 0x470054
mov dword [rbp - 0x10], 0xd000a
mov dword [rbp - 0xc], 0x7a0002
call fcn.1400029c0
mov rcx, rax
call rbx
mov rbx, qword [0x1400141c0]
lea rcx, [rbp - 0x20]
mov qword [0x1400141a0], rax
mov dword [rbp - 0x20], 0x4001e
mov dword [rbp - 0x1c], 0xe000f
mov dword [rbp - 0x18], 0x16000b
mov dword [rbp - 0x14], 0x470012
mov dword [rbp - 0x10], 0xd000a
mov dword [rbp - 0xc], 0x7a0002
call fcn.1400029c0
mov rcx, rax
call rbx
movdqa xmm0, xmmword [0x1400131d0]
lea rcx, [rbp - 0x20]
mov rbx, qword [0x140014130]
movdqu xmmword [rbp - 0x20], xmm0
mov qword [0x1400141b0], rax
mov word [rbp - 0x10], 0x241f
mov byte [rbp - 0xe], 0x6e
call fcn.140004620
mov rcx, qword [0x1400141a0]
mov rdx, rax
call rbx
mov rbx, qword [0x140014130]
lea rcx, [rbp - 0x20]
mov dword [rbp - 0x20], 0xb04051a
mov dword [rbp - 0x1c], 0xc1e3609
mov dword [rbp - 0x18], 0x1f1a140d
mov word [rbp - 0x14], 0x6e32
call fcn.140001180
mov rcx, qword [0x1400141a0]
mov rdx, rax
call rbx
mov rbx, qword [0x140014130]
lea rcx, [rbp - 0x20]
mov dword [rbp - 0x20], 0x2150300
mov dword [rbp - 0x1c], 0x1d031d17
mov dword [rbp - 0x18], 0x140b1121
mov word [rbp - 0x14], 0x6e24
call fcn.140001180
mov rcx, qword [0x1400141b0]
mov rdx, rax
call rbx
movdqa xmm0, xmmword [0x1400132b0]
lea rcx, [rbp - 0x20]
mov rbx, qword [0x140014130]
movdqu xmmword [rbp - 0x20], xmm0
mov qword [0x1400140e8], rax
mov byte [rbp - 0x10], 0x69
call fcn.140004330
mov rcx, qword [0x1400141b0]
mov rdx, rax
call rbx
movdqa xmm0, xmmword [0x140013210]
lea rcx, [rbp - 0x20]
mov rbx, qword [0x140014130]
movdqu xmmword [rbp - 0x20], xmm0
mov qword [0x1400140f0], rax
mov dword [rbp - 0x10], 0x650b1f0d
call fcn.140002660
mov rcx, qword [0x1400141b0]
mov rdx, rax
call rbx
movdqa xmm0, xmmword [0x1400131b0]
lea rcx, [rbp - 0x20]
mov rbx, qword [0x140014130]
movdqu xmmword [rbp - 0x20], xmm0
mov qword [0x1400140e0], rax
mov byte [rbp - 0x10], 0x69
call fcn.140004330
mov rcx, qword [0x1400141b0]
mov rdx, rax
call rbx
movdqa xmm0, xmmword [0x140013260]
lea rcx, [rbp - 0x20]
mov rbx, qword [0x140014130]
movdqu xmmword [rbp - 0x20], xmm0
mov qword [0x1400140d8], rax
mov dword [rbp - 0x10], 0x24001c00
mov byte [rbp - 0xc], 0x79
call fcn.140003130
mov rcx, qword [0x1400141b0]
mov rdx, rax
call rbx
movdqa xmm0, xmmword [0x140013220]
lea rcx, [rbp - 0x20]
mov rbx, qword [0x140014130]
movdqu xmmword [rbp - 0x20], xmm0
mov word [rbp - 0x10], 0x3207
mov byte [rbp - 0xe], 0x6e
call fcn.140004620
mov rcx, qword [0x1400141b0]
mov rdx, rax
mov rax, rbx
mov rbx, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
mov rdi, qword [rsp + 0x80]
add rsp, 0x40
pop r15
pop r14
pop r13
pop r12
pop rbp
jmp rax
Function at 0x14000bec0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x40
mov ebx, 0x6e
mov dword [rbp - 0x20], 0x280002
lea rcx, [rbp - 0x20]
mov word [rbp - 0xc], bx
mov dword [rbp - 0x1c], 0x290033
mov dword [rbp - 0x18], 0x3f0020
mov dword [rbp - 0x14], 0x280024
mov dword [rbp - 0x10], 0x24003d
call fcn.140004fd0
mov rcx, rax
call 0x14000bfa0
lea rcx, [rbp - 0x20]
mov qword [0x1400141b8], rax
mov dword [rbp - 0x20], 0x280002
mov dword [rbp - 0x1c], 0x290033
mov dword [rbp - 0x18], 0x3f0020
mov dword [rbp - 0x14], 0x5b0055
mov word [rbp - 0x10], bx
call fcn.1400022a0
mov rcx, rax
call 0x14000bfa0
lea rcx, [rbp - 0x20]
mov qword [0x1400141a8], rax
mov dword [rbp - 0x20], 0x190027
mov dword [rbp - 0x1c], 0xb0005
mov dword [rbp - 0x18], 0x730009
call fcn.140004e60
mov rcx, rax
mov rbx, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
mov rdi, qword [rsp + 0x80]
add rsp, 0x40
pop r15
pop r14
pop r13
pop r12
pop rbp
jmp 0x14000bfa0
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rax, qword gs:[0x60]
mov rsi, rcx
mov rdi, qword [rax + 0x18]
add rdi, 0x20
mov rbx, qword [rdi]
cmp rbx, rdi
je 0x14000c002
nop dword [rax + rax]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov edx, 8
mov rcx, rax
mov r8d, edx
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rcx, qword [rbx + 0x40]
mov rdx, rsi
mov r8, rax
call fcn.14000db70
test al, al
jne 0x14000c014
mov rbx, qword [rbx]
cmp rbx, rdi
jne 0x14000bfd0
xor eax, eax
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
mov rax, qword [rbx + 0x20]
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x14000bfa0
Capabilities:
Access peb ldr_data

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x40
mov ebx, 0x6e
mov dword [rbp - 0x20], 0x280002
lea rcx, [rbp - 0x20]
mov word [rbp - 0xc], bx
mov dword [rbp - 0x1c], 0x290033
mov dword [rbp - 0x18], 0x3f0020
mov dword [rbp - 0x14], 0x280024
mov dword [rbp - 0x10], 0x24003d
call fcn.140004fd0
mov rcx, rax
call 0x14000bfa0
lea rcx, [rbp - 0x20]
mov qword [0x1400141b8], rax
mov dword [rbp - 0x20], 0x280002
mov dword [rbp - 0x1c], 0x290033
mov dword [rbp - 0x18], 0x3f0020
mov dword [rbp - 0x14], 0x5b0055
mov word [rbp - 0x10], bx
call fcn.1400022a0
mov rcx, rax
call 0x14000bfa0
lea rcx, [rbp - 0x20]
mov qword [0x1400141a8], rax
mov dword [rbp - 0x20], 0x190027
mov dword [rbp - 0x1c], 0xb0005
mov dword [rbp - 0x18], 0x730009
call fcn.140004e60
mov rcx, rax
mov rbx, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
mov rdi, qword [rsp + 0x80]
add rsp, 0x40
pop r15
pop r14
pop r13
pop r12
pop rbp
jmp 0x14000bfa0
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rax, qword gs:[0x60]
mov rsi, rcx
mov rdi, qword [rax + 0x18]
add rdi, 0x20
mov rbx, qword [rdi]
cmp rbx, rdi
je 0x14000c002
nop dword [rax + rax]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov edx, 8
mov rcx, rax
mov r8d, edx
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rcx, qword [rbx + 0x40]
mov rdx, rsi
mov r8, rax
call fcn.14000db70
test al, al
jne 0x14000c014
mov rbx, qword [rbx]
cmp rbx, rdi
jne 0x14000bfd0
xor eax, eax
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
mov rax, qword [rbx + 0x20]
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x14000c210
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 8], rcx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x70
movsxd rax, dword [rcx + 0x3c]
mov r12, rdx
mov rdx, rcx
mov ecx, dword [rax + rcx + 0x88]
xor eax, eax
add rcx, rdx
mov dword [rbp - 0x2c], eax
mov qword [rbp - 0x28], rcx
mov r8d, dword [rcx + 0x1c]
mov r9d, dword [rcx + 0x20]
add r8, rdx
mov r10d, dword [rcx + 0x24]
add r9, rdx
add r10, rdx
mov qword [rbp - 0x20], r8
mov qword [rbp - 0x18], r9
mov qword [rbp - 0x10], r10
cmp dword [rcx + 0x18], eax
jbe 0x14000c43e
mov word [rbp + 0x50], 0x6d49
mov word [rbp + 0x58], 0x6d49
nop
mov esi, dword [r9 + rax*4]
lea rcx, [rbp + 0x50]
movzx eax, word [r10 + rax*2]
add rsi, rdx
xor edi, edi
mov r15d, dword [r8 + rax*4]
add r15, rdx
mov qword [rbp - 8], r15
call fcn.140001770
movzx ecx, byte [rax]
cmp byte [rsi], cl
je 0x14000c2c4
nop dword [rax]
lea rcx, [rbp + 0x50]
inc rdi
call fcn.140001770
movzx ecx, byte [rax]
cmp byte [rdi + rsi], cl
jne 0x14000c2b0
lea rcx, [rbp + 0x58]
xor ebx, ebx
call fcn.140001770
movzx ecx, byte [rax]
cmp byte [r12], cl
je 0x14000c2f5
nop dword [rax + rax]
lea rcx, [rbp + 0x58]
inc rbx
call fcn.140001770
movzx ecx, byte [rax]
cmp byte [rbx + r12], cl
jne 0x14000c2e0
cmp rdi, rbx
jne 0x14000c412
mov r13, rsi
mov word [rbp - 0x50], 0x6d49
sub r13, r12
mov r14, r12
nop dword [rax]
lea rcx, [rbp - 0x50]
xor ebx, ebx
call fcn.140001770
movzx ecx, byte [rax]
cmp byte [rsi], cl
je 0x14000c336
lea rcx, [rbp - 0x50]
inc rbx
call fcn.140001770
movzx ecx, byte [rax]
cmp byte [rbx + rsi], cl
jne 0x14000c322
mov rax, r14
sub rax, r12
dec rbx
cmp rax, rbx
jae 0x14000c438
movsx r15d, byte [r14 + r13]
lea rcx, [rbp - 0x4e]
mov dword [rbp - 0x4e], 0x6d0028
call fcn.140002490
movzx eax, word [rax]
cmp r15d, eax
jl 0x14000c3a8
lea rcx, [rbp - 0x4a]
mov dword [rbp - 0x4a], 0x6d0033
call fcn.140002490
movzx ecx, word [rax]
cmp r15d, ecx
jg 0x14000c3a8
lea rcx, [rbp - 0x46]
mov dword [rbp - 0x46], 0x6d0028
mov dword [rbp - 0x42], 0x6d0008
call fcn.140002490
lea rcx, [rbp - 0x42]
movzx ebx, byte [rax]
call fcn.140002490
movzx ecx, byte [rax]
sub cl, bl
add r15b, cl
movsx edi, byte [r14]
lea rcx, [rbp - 0x3e]
mov dword [rbp - 0x3e], 0x6d0028
call fcn.140002490
movzx eax, word [rax]
cmp edi, eax
jl 0x14000c405
lea rcx, [rbp - 0x3a]
mov dword [rbp - 0x3a], 0x6d0033
call fcn.140002490
movzx ecx, word [rax]
cmp edi, ecx
jg 0x14000c405
lea rcx, [rbp - 0x36]
mov dword [rbp - 0x36], 0x6d0028
mov dword [rbp - 0x32], 0x6d0008
call fcn.140002490
lea rcx, [rbp - 0x32]
movzx ebx, byte [rax]
call fcn.140002490
movzx ecx, byte [rax]
sub cl, bl
add dil, cl
cmp r15b, dil
jne 0x14000c412
inc r14
jmp 0x14000c310
mov eax, dword [rbp - 0x2c]
mov rcx, qword [rbp - 0x28]
inc eax
mov dword [rbp - 0x2c], eax
cmp eax, dword [rcx + 0x18]
jae 0x14000c43e
mov rdx, qword [rbp + 0x40]
mov r8, qword [rbp - 0x20]
mov r9, qword [rbp - 0x18]
mov r10, qword [rbp - 0x10]
jmp 0x14000c280
mov rax, qword [rbp - 8]
jmp 0x14000c440
xor eax, eax
mov rbx, qword [rsp + 0xb8]
add rsp, 0x70
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x140002190
Capabilities:
Hash data with crc32

Disassembly:
push rbp
sub rsp, 0x30
lea rbp, [rsp + 0x30]
mov dword [rbp - 4], 0
mov dword [rbp - 8], 0
mov ecx, dword [rbp - 8]
mov edx, 0x100
call fcn.14001cf00
test eax, 1
je 0x140002248
mov eax, dword [rbp - 8]
mov dword [rbp - 4], eax
mov dword [rbp - 0xc], 8
mov ecx, dword [rbp - 0xc]
xor edx, edx
call fcn.140016ab0
test eax, 1
je 0x140002229
mov ecx, dword [rbp - 4]
and ecx, 1
xor edx, edx
call fcn.1400096e0
test eax, 1
je 0x140002202
mov eax, dword [rbp - 4]
shr eax, 1
xor eax, 0xedb88320
mov dword [rbp - 4], eax
jmp 0x14000221c
mov eax, dword [rbp - 4]
mov dword [rbp - 0x10], eax
mov ecx, 0x5eb98e63
call fcn.14001cd30
mov ecx, eax
mov eax, dword [rbp - 0x10]
shr eax, cl
mov dword [rbp - 4], eax
jmp 0x14000221e
mov eax, dword [rbp - 0xc]
add eax, 0xffffffff
mov dword [rbp - 0xc], eax
jmp 0x1400021cd
mov edx, dword [rbp - 4]
movsxd rcx, dword [rbp - 8]
lea rax, [0x1400266b0]
mov dword [rax + rcx*4], edx
mov eax, dword [rbp - 8]
add eax, 1
mov dword [rbp - 8], eax
jmp 0x1400021a8
mov dword [0x1400266a8], 0
add rsp, 0x30
pop rbp
ret
Function at 0x140012dc0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbp
sub rsp, 0x40
lea rbp, [rsp + 0x40]
mov dword [rbp - 4], edx
mov qword [rbp - 0x10], rcx
mov dword [rbp - 0x14], 0xffffffff
mov dword [rbp - 0x18], 0
mov ecx, dword [rbp - 0x18]
mov edx, dword [rbp - 4]
call fcn.1400055d0
test eax, 1
je 0x140012e3d
mov ecx, dword [rbp - 0x14]
shr ecx, 8
mov rax, qword [rbp - 0x10]
movsxd rdx, dword [rbp - 0x18]
movzx eax, byte [rax + rdx]
xor eax, dword [rbp - 0x14]
and eax, 0xff
mov eax, eax
mov edx, eax
lea rax, [0x1400266b0]
mov edx, dword [rax + rdx*4]
call fcn.14001c470
mov dword [rbp - 0x14], eax
mov eax, dword [rbp - 0x18]
mov dword [rbp - 0x1c], eax
mov ecx, 0x5eb98e63
call fcn.14001cd30
mov ecx, eax
mov eax, dword [rbp - 0x1c]
add eax, ecx
mov dword [rbp - 0x18], eax
jmp 0x140012ddf
mov eax, dword [rbp - 0x14]
xor eax, 0xffffffff
add rsp, 0x40
pop rbp
ret

Function at 0x1400132b0
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
push rbp
sub rsp, 0x40
lea rbp, [rsp + 0x40]
mov dword [rbp - 4], ecx
mov eax, dword [rbp - 4]
xor eax, 0xffffffff
mov ecx, 0xffffffff
xor ecx, 0xffffffff
mov edx, 0xffffffff
xor edx, 0x69e3f6cf
mov dword [rbp - 0xc], edx
or eax, ecx
mov dword [rbp - 8], eax
mov ecx, 0x375a78ad
call fcn.14001cd30
mov edx, dword [rbp - 0xc]
mov ecx, eax
mov eax, dword [rbp - 8]
or ecx, edx
xor eax, 0xffffffff
and eax, ecx
mov dword [0x140028bb0], eax
mov dword [0x140027850], 1
mov eax, dword [0x140027850]
mov dword [rbp - 0x10], eax
mov ecx, 0x5eb98c12
call fcn.14001cd30
mov ecx, eax
mov eax, dword [rbp - 0x10]
cmp eax, ecx
jge 0x1400133e9
mov eax, dword [0x140027850]
mov dword [rbp - 0x1c], eax
mov ecx, 0x5eb98e63
call fcn.14001cd30
mov ecx, eax
mov eax, dword [rbp - 0x1c]
sub eax, ecx
movsxd rcx, eax
lea rax, [0x140028bb0]
mov eax, dword [rax + rcx*4]
mov dword [rbp - 0x18], eax
mov eax, dword [0x140027850]
mov dword [rbp - 0x14], eax
mov ecx, 0x5eb98e63
call fcn.14001cd30
mov ecx, dword [rbp - 0x18]
mov edx, eax
mov eax, dword [rbp - 0x14]
sub eax, edx
movsxd rdx, eax
lea rax, [0x140028bb0]
mov edx, dword [rax + rdx*4]
shr edx, 0x1e
call fcn.14001c470
imul edx, eax, 0x6c078965
add edx, dword [0x140027850]
movsxd rcx, dword [0x140027850]
lea rax, [0x140028bb0]
mov dword [rax + rcx*4], edx
movsxd rcx, dword [0x140027850]
lea rax, [0x140028bb0]
mov edx, dword [rax + rcx*4]
and edx, 0xffffffff
lea rax, [0x140028bb0]
mov dword [rax + rcx*4], edx
mov eax, dword [0x140027850]
mov dword [rbp - 0x20], eax
mov ecx, 0x5eb98e63
call fcn.14001cd30
mov ecx, dword [rbp - 0x20]
mov edx, eax
call fcn.1400080a0
mov dword [0x140027850], eax
jmp 0x14001330a
add rsp, 0x40
pop rbp
ret
Function at 0x14001b290
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbp
sub rsp, 0x60
lea rbp, [rsp + 0x60]
mov qword [rbp - 8], r8
mov dword [rbp - 0xc], edx
mov qword [rbp - 0x18], rcx
cmp qword [rbp - 8], 0
jne 0x14001b2b1
jmp 0x14001b3de
mov rax, qword [rbp - 8]
mov al, byte [rax + 0x100]
mov byte [rbp - 0x1a], al
mov rax, qword [rbp - 8]
mov al, byte [rax + 0x101]
mov byte [rbp - 0x1b], al
mov rax, qword [rbp - 8]
mov qword [rbp - 0x28], rax
mov dword [rbp - 0x2c], 0
mov eax, dword [rbp - 0x2c]
cmp eax, dword [rbp - 0xc]
jae 0x14001b3c4
movzx ecx, byte [rbp - 0x1a]
mov dword [rbp - 0x34], ecx
xor eax, eax
sub eax, ecx
mov dword [rbp - 0x38], eax
xor ecx, ecx
mov edx, 1
call fcn.140014a50
mov ecx, dword [rbp - 0x38]
add ecx, eax
xor eax, eax
sub eax, ecx
mov dword [rbp - 0x30], eax
mov ecx, 0x5eb98e63
call fcn.14001cd30
mov ecx, dword [rbp - 0x34]
mov edx, eax
call fcn.1400080a0
mov eax, dword [rbp - 0x30]
and eax, 0xff
mov byte [rbp - 0x1a], al
mov rax, qword [rbp - 0x28]
movzx ecx, byte [rbp - 0x1a]
movzx eax, byte [rax + rcx]
movzx ecx, byte [rbp - 0x1b]
add eax, ecx
and eax, 0xff
mov byte [rbp - 0x1b], al
mov rax, qword [rbp - 0x28]
movzx ecx, byte [rbp - 0x1a]
mov al, byte [rax + rcx]
mov byte [rbp - 0x19], al
mov rax, qword [rbp - 0x28]
movzx ecx, byte [rbp - 0x1b]
mov dl, byte [rax + rcx]
mov rax, qword [rbp - 0x28]
movzx ecx, byte [rbp - 0x1a]
mov byte [rax + rcx], dl
mov dl, byte [rbp - 0x19]
mov rax, qword [rbp - 0x28]
movzx ecx, byte [rbp - 0x1b]
mov byte [rax + rcx], dl
mov rax, qword [rbp - 0x28]
mov rcx, qword [rbp - 0x28]
movzx edx, byte [rbp - 0x1a]
movzx ecx, byte [rcx + rdx]
mov rdx, qword [rbp - 0x28]
movzx r8d, byte [rbp - 0x1b]
movzx edx, byte [rdx + r8]
add ecx, edx
and ecx, 0xff
movsxd rcx, ecx
movzx r8d, byte [rax + rcx]
mov rax, qword [rbp - 0x18]
mov ecx, dword [rbp - 0x2c]
movzx edx, byte [rax + rcx]
xor edx, r8d
mov byte [rax + rcx], dl
mov eax, dword [rbp - 0x2c]
add eax, 1
mov dword [rbp - 0x2c], eax
jmp 0x14001b2da
mov cl, byte [rbp - 0x1a]
mov rax, qword [rbp - 8]
mov byte [rax + 0x100], cl
mov cl, byte [rbp - 0x1b]
mov rax, qword [rbp - 8]
mov byte [rax + 0x101], cl
add rsp, 0x60
pop rbp
ret
Function at 0x18000a630
Capabilities:
Hash data using sha1

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], r8
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x60
lea r13d, [rcx + 0x90]
mov r11, r8
mov r12, rdx
mov r14d, ecx
cmp ecx, r13d
jae case.0x18000a690.1
lea r15d, [rcx - 0x36]
xor r8d, r8d
lea rdx, [0x180000000]
cmp r15d, 0xa9
ja case.0x18000a690.11
movzx eax, byte [rdx + r15 + 0xa8a4]
mov ecx, dword [rdx + rax*4 + 0xa874]
add rcx, rdx
jmp rcx
xor r9d, r9d
xor r8d, r8d
mov rdx, r11
lea ecx, [r9 + 0x36]
call fcn.180034720
mov dword [r12 + 0x28], 1
mov dword [r12 + 0x170], 2
jmp case.0x18000a690.11
mov dword [r12], 0x67452301
jmp case.0x18000a690.11
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0xb8], rax
jmp case.0x18000a690.11
mov r10, qword [r11]
mov rbp, qword [r11 + 8]
cmp r10, rbp
je 0x18000a756
mov r11, qword [r12 + 8]
mov rsi, qword [r12]
mov r9, rsi
cmp rsi, r11
je 0x18000a744
mov rbx, qword [r10 + 0x18]
mov rdi, qword [r10 + 0x10]
mov rax, r10
cmp rbx, 8
jb 0x18000a70e
mov rax, qword [r10]
cmp qword [r9 + 0x18], 8
mov r8, r9
jb 0x18000a71b
mov r8, qword [r9]
mov rdx, qword [r9 + 0x10]
cmp rdx, rdi
jne 0x18000a763
test rdx, rdx
je 0x18000a744
sub r8, rax
nop dword [rax]
movzx ecx, word [rax]
cmp word [r8 + rax], cx
jne 0x18000a763
add rax, 2
sub rdx, 1
jne 0x18000a730
cmp r9, r11
jne 0x18000a849
add r10, 0x20
cmp r10, rbp
jne 0x18000a6f2
mov byte [rsp + 0xb8], 0
jmp case.0x18000a690.11
add r9, 0x20
cmp r9, r11
jne 0x18000a702
jmp 0x18000a74d
xor r9d, r9d
mov dword [rsp + 0x20], 0x17
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call fcn.180033740
jmp case.0x18000a690.11
mov qword [rsp + 0x28], r8
lea rcx, [rsp + 0x48]
mov qword [rsp + 0x20], r8
mov r9, r12
mov r8d, 0x96
xor edx, edx
call fcn.180051cf0
jmp case.0x18000a690.11
mov qword [r12 + 0x14], 0
jmp case.0x18000a690.11
mov qword [rsp + 0x30], r8
mov r9, r12
mov qword [rsp + 0x28], r8
mov edx, 0xd4
mov qword [rsp + 0x20], r8
xor ecx, ecx
xor r8d, r8d
call fcn.180058890
jmp case.0x18000a690.11
mov qword [rsp + 0x20], r8
lea rdx, [rsp + 0xa0]
xor r8d, r8d
mov dword [rsp + 0xa0], 0x1a
mov r9d, 0xc6
xor ecx, ecx
call fcn.18005b620
mov qword [rsp + 0x40], rax
jmp case.0x18000a690.11
mov dword [r12 + 4], 0xefcdab89
mov dword [r12 + 8], 0x98badcfe
mov dword [r12 + 0xc], 0x10325476
mov dword [r12 + 0x10], 0xc3d2e1f0
add r14d, 0xc
add r15d, 0xc
cmp r14d, r13d
jae case.0x18000a690.1
mov r11, qword [rsp + 0xb0]
jmp 0x18000a666
mov byte [rsp + 0xb8], 1
mov rax, qword [rsp + 0xb8]
mov rbx, qword [rsp + 0xa8]
add rsp, 0x60
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret