joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400d6cb0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rdi
push r14
xor r10d, r10d
xor bl, bl
mov r14, r9
mov rdi, rcx
test rcx, rcx
je 0x1400d6dc6
test rdx, rdx
je 0x1400d6dc6
movzx eax, byte [rcx]
test r8d, r8d
jne 0x1400d6cfa
cmp al, 0x7f
jbe 0x1400d6dbe
mov r10d, 1
mov eax, r10d
add rax, rdx
jmp 0x1400d6dce
mov bl, 0xff
cmp al, 0x80
jbe 0x1400d6d11
mov r10d, 1
mov eax, r10d
add rax, rdx
jmp 0x1400d6dce
jne 0x1400d6dbe
mov eax, 1
lea rcx, [rdx - 1]
cmp rdx, rax
jbe 0x1400d6daf
cmp rcx, 8
jb 0x1400d6d9a
and ecx, 7
mov r8, rdx
sub r8, rcx
xorps xmm3, xmm3
xorps xmm2, xmm2
nop
movd xmm1, dword [rdi + rax]
xorps xmm0, xmm0
punpcklbw xmm1, xmm0
punpcklwd xmm1, xmm0
por xmm1, xmm3
movdqa xmm3, xmm1
movd xmm1, dword [rdi + rax + 4]
punpcklbw xmm1, xmm0
add rax, 8
punpcklwd xmm1, xmm0
por xmm1, xmm2
movdqa xmm2, xmm1
cmp rax, r8
jb 0x1400d6d40
por xmm2, xmm3
movdqa xmm0, xmm2
psrldq xmm0, 8
por xmm2, xmm0
movdqa xmm0, xmm2
psrldq xmm0, 4
por xmm2, xmm0
movd r10d, xmm2
cmp rax, rdx
jae 0x1400d6daf
nop
movzx ecx, byte [rax + rdi]
inc rax
or r10d, ecx
cmp rax, rdx
jb 0x1400d6da0
neg r10d
sbb bl, bl
movzx ebx, bl
mov r10d, ebx
and r10d, 1
mov eax, r10d
add rax, rdx
jmp 0x1400d6dce
mov eax, 1
mov rdx, r10
mov qword [rsp + 0x10], rsi
test r14, r14
je 0x1400d6e24
mov rsi, qword [r9]
test rsi, rsi
je 0x1400d6e24
movzx r8d, bl
lea r11, [rdi + rdx]
and r8d, 1
mov byte [rsi], bl
test rdx, rdx
je 0x1400d6e21
mov r9, r11
mov r10d, r10d
sub r9, rdi
add r10, rsi
nop
movzx edx, byte [r11 - 1]
lea r11, [r11 - 1]
dec r9
movzx ecx, bl
xor edx, ecx
add r8d, edx
mov byte [r10 + r9], r8b
shr r8d, 8
test r9, r9
jne 0x1400d6e00
add qword [r14], rax
mov rsi, qword [rsp + 0x10]
mov rbx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
pop r14
ret
Function at 0x1400e4fe0
Capabilities:
Enumerate files on windows

Disassembly:
push rbp
sub rsp, 0x20
lea rbp, [rsp + 0x20]
mov qword [rbp + 0x10], rbx
mov rbx, rdx
mov qword [rbp + 0x18], rsi
mov qword [rbp + 0x20], rdi
mov rdi, rcx
test rcx, rcx
je 0x1400e512f
test rdx, rdx
je 0x1400e512f
call fcn.140176084
mov dword [rax], 0
mov rcx, qword [rdi]
test rcx, rcx
jne 0x1400e515a
xor eax, eax
mov rcx, rbx
cmp byte [rbx], al
je 0x1400e5041
nop
cmp eax, 0x80000000
jae 0x1400e5041
inc rcx
inc eax
cmp byte [rcx], 0
jne 0x1400e5030
mov esi, eax
btr esi, 0x1f
lea rax, [rsi - 1]
cmp rax, 0x7ffffffb
ja 0x1400e514d
mov ecx, 0x248
call fcn.1401760b4
mov qword [rdi], rax
test rax, rax
jne 0x1400e5079
call fcn.140176084
mov dword [rax], listen
jmp 0x1400e513a
xor edx, edx
mov r8d, 0x248
mov rcx, rax
call fcn.140174ac0
cmp byte [rsi + rbx - 1], 0x2a
je 0x1400e5100
lea rax, [rsi + 3]
lea rcx, [rax + 0xf]
cmp rcx, rax
ja 0x1400e50a7
movabs rcx, 0xffffffffffffff0
and rcx, 0xfffffffffffffff0
mov rax, rcx
call fcn.140173f00
sub rsp, rcx
lea rdx, [rsp + 0x20]
mov rcx, rdx
sub rcx, rbx
movzx eax, byte [rbx]
mov byte [rcx + rbx], al
lea rbx, [rbx + 1]
test al, al
jne 0x1400e50c1
movzx eax, byte [rdx + rsi - 1]
cmp al, 0x2f
je 0x1400e50f4
cmp al, 0x5c
je 0x1400e50f4
movzx eax, word [0x1401fe9e8]
mov word [rdx + rsi], ax
movzx eax, byte [0x1401fe9ea]
mov byte [rdx + rsi + 2], al
jmp 0x1400e50fd
mov eax, 0x2a
mov word [rdx + rsi], ax
mov rbx, rdx
mov rdx, qword [rdi]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov rcx, qword [rdi]
mov qword [rcx + 0x140], rax
mov rcx, qword [rdi]
cmp qword [rcx + 0x140], 0xffffffffffffffff
jne 0x1400e516e
call fcn.1401760ac
mov qword [rdi], 0
call fcn.140176084
mov dword [rax], reloc.WS2_32.dll_shutdown
xor eax, eax
mov rbx, qword [rbp + 0x10]
mov rsi, qword [rbp + 0x18]
mov rdi, qword [rbp + 0x20]
mov rsp, rbp
pop rbp
ret
call fcn.140176084
mov dword [rax], 2
jmp 0x1400e513a
mov rdx, rcx
mov rcx, qword [rcx + 0x140]
call qword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
je 0x1400e513a
mov rcx, qword [rdi]
mov r8d, 0xff
lea rdx, [rcx + 0x2c]
add rcx, 0x148
call fcn.140187de0
mov rax, qword [rdi]
mov rbx, qword [rbp + 0x10]
mov rsi, qword [rbp + 0x18]
mov byte [rax + 0x247], 0
mov rax, qword [rdi]
mov rdi, qword [rbp + 0x20]
add rax, 0x148
mov rsp, rbp
pop rbp
ret
Function at 0x1400e66f0
Capabilities:
Encode data using xor

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rcx
push rbp
push rsi
push rdi
push r12
push r13
push r15
sub rsp, 0xa8
mov rax, qword [rdx + 8]
xor esi, esi
mov r15, qword [rdx + 0x10]
sub rax, r8
mov qword [rsp + 0xe8], rax
mov rdi, r8
mov r13, rdx
mov r12, rcx
mov ebp, esi
cmp r15, r8
jb 0x1400e68a8
cmp r8, 0x40
ja 0x1400e68a8
lea rax, [rsp + 0x20]
mov qword [r11 + 0x20], rbx
neg rax
mov qword [r11 - 0x38], r14
and eax, 0x3f
lea r14, [rsp + 0x20]
add r14, rax
lea rax, [r8 + 0x100]
cmp r15, rax
jbe 0x1400e676e
mov rbp, r15
sub rbp, r8
sub rbp, 0x100
xor edx, edx
mov rcx, r14
mov rbx, rsi
call fcn.140174ac0
mov r9, rsi
cmp rbp, r15
jae 0x1400e683e
mov rcx, qword [r13 + 0x20]
mov r12, rsi
mov r10, qword [r13 + 8]
mov r11, qword [rsp + 0xe8]
mov qword [rsp + 0xf0], rcx
lea r13, [rcx + r10]
nop word [rax + rax]
add rcx, rbp
mov rax, rbp
xor rax, r11
mov rdx, rcx
sub rdx, r13
xor rdx, r10
lea r8, [rax - 1]
not rax
shr rax, 0x3f
shr r8, 0x3f
and r8, rax
mov rax, rbp
xor rax, r10
neg r8
or rdx, rax
or r12, r8
xor rdx, rbp
and r8, r9
shr rdx, 0x3f
or rbx, r8
neg rdx
inc rbp
and r12, rdx
movzx eax, r12b
and al, byte [rcx]
or byte [r9 + r14], al
inc r9
mov rcx, r9
mov rax, r9
sub rcx, rdi
xor rax, rdi
xor rcx, rdi
or rcx, rax
xor rcx, r9
shr rcx, 0x3f
neg rcx
and r9, rcx
mov rcx, qword [rsp + 0xf0]
cmp rbp, r15
jb 0x1400e67b0
mov r12, qword [rsp + 0xe0]
test rdi, rdi
je 0x1400e6882
mov rax, rbx
xor rax, 0x20
movzx eax, byte [rax + r14]
movzx eax, byte [rbx + r14]
inc rbx
mov byte [rsi + r12], al
mov rcx, rbx
sub rcx, rdi
mov rax, rbx
xor rcx, rdi
xor rax, rdi
or rcx, rax
inc rsi
xor rcx, rbx
shr rcx, 0x3f
neg rcx
and rbx, rcx
cmp rsi, rdi
jb 0x1400e6843
mov r14, qword [rsp + 0xa0]
mov eax, 1
mov rbx, qword [rsp + 0xf8]
add rsp, 0xa8
pop r15
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
mov r8d, 0x612
lea rdx, str.c:_cygwin_home_shachar_zon_new_pkg_lib_openssl_ssl_record_ssl3_record.c
lea rcx, str.Assertion_failed:_rec__orig_len___md_size__md_size___EVP_MAX_MD_SIZE
call fcn.14006e830
xor eax, eax
add rsp, 0xa8
pop r15
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x1400e7ad0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x20], rbx
push rsi
sub rsp, 0x20
mov rax, qword [rcx + 8]
lea rsi, [r9 + 1]
mov rbx, rdx
mov rdx, qword [rdx + 8]
mov r9, qword [rax + 0xc0]
test byte [r9 + 0x60], 1
je 0x1400e7b22
lea rax, [rsi + r8]
cmp rax, rdx
jbe 0x1400e7b0d
xor eax, eax
mov rbx, qword [rsp + 0x48]
add rsp, 0x20
pop rsi
ret
add qword [rbx + 0x20], r8
sub rdx, r8
add qword [rbx + 0x28], r8
sub qword [rbx + 0x10], r8
mov qword [rbx + 8], rdx
jmp 0x1400e7b27
cmp rsi, rdx
ja 0x1400e7b00
mov rax, qword [rbx + 0x20]
mov rcx, qword [rcx + 0x430]
mov qword [rsp + 0x40], rdi
movzx edi, byte [rax + rdx - 1]
call fcn.140060f80
mov rcx, rax
call fcn.140061160
mov r8, qword [rbx + 8]
and eax, 0x200000
je 0x1400e7b64
sub r8, rdi
mov eax, 1
dec r8
jmp 0x1400e7c16
lea rcx, [rdi + rsi]
mov qword [rsp + 0x38], rbp
mov ebp, 0x100
mov r9, r8
sub r9, rcx
mov rax, r8
xor r9, rcx
xor rax, rcx
or r9, rax
xor r9, r8
shr r9, 0x3f
dec r9
cmp r8, rbp
cmovb rbp, r8
xor r10d, r10d
test rbp, rbp
je 0x1400e7bed
mov r11, qword [rbx + 0x20]
mov rsi, rdi
shr rsi, 0x3f
dec r11
add r11, r8
nop
mov rax, r10
lea r11, [r11 - 1]
shr rax, 0x3f
mov rcx, rdi
sub rcx, r10
inc r10
shr rcx, 0x3f
xor cl, al
xor al, sil
or cl, al
movzx eax, byte [r11 + 1]
dec cl
movzx edx, cl
mov rcx, rdi
xor rcx, rax
and rdx, rcx
not rdx
and r9, rdx
cmp r10, rbp
jb 0x1400e7bb0
mov rbp, qword [rsp + 0x38]
lea rax, [rdi + 1]
not r9
movzx ecx, r9b
dec rcx
shr rcx, 0x3f
neg rcx
and rax, rcx
sub r8, rax
mov eax, ecx
and eax, 1
not ecx
or eax, ecx
mov rdi, qword [rsp + 0x40]
mov qword [rbx + 8], r8
mov rbx, qword [rsp + 0x48]
add rsp, 0x20
pop rsi
ret
Function at 0x1400ec480
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0xb0
mov rax, qword [rcx]
xor r14d, r14d
movsxd rdi, r8d
mov rbp, r9
mov rsi, rdx
mov rbx, rcx
mov r13d, r14d
lea r12d, [r14 + 1]
test r9, r9
je 0x1400ec4d5
cmp r9, rax
je 0x1400ec4cd
test rdx, rdx
je 0x1400ec4c6
test r8d, r8d
jns 0x1400ec4cd
xor eax, eax
jmp 0x1400ec6d8
mov r13d, r12d
mov qword [rcx], r9
jmp 0x1400ec4dd
test rax, rax
je 0x1400ec4c6
mov rbp, rax
mov qword [rsp + 0xe0], r15
mov r15, qword [rsp + 0x100]
test rsi, rsi
je 0x1400ec6f4
mov rcx, rbp
mov r13d, r12d
call fcn.1400616f0
cmp eax, 0x90
mov r12d, r14d
mov r15d, eax
setle r12b
jle 0x1400ec52b
mov r8d, 0x29
lea rdx, str.c:_cygwin_home_shachar_zon_new_pkg_lib_openssl_crypto_hmac_hmac.c
lea rcx, str.Assertion_failed:_j____int_sizeof_ctx__key_
call fcn.14006e830
test r12d, r12d
je 0x1400ec57b
cmp r15d, edi
jge 0x1400ec582
mov r15, qword [rsp + 0x100]
mov rdx, rbp
mov rcx, qword [rbx + 8]
mov r8, r15
call fcn.1400793a0
test eax, eax
je 0x1400ec57b
mov rcx, qword [rbx + 8]
mov r8, rdi
mov rdx, rsi
call fcn.1400795f0
test eax, eax
je 0x1400ec57b
mov rcx, qword [rbx + 8]
lea rsi, [rbx + 0x20]
mov r8, rsi
lea rdx, [rbx + 0x24]
call fcn.1400792d0
test eax, eax
jne 0x1400ec5a7
xor eax, eax
jmp 0x1400ec6d0
cmp edi, 0x90
ja 0x1400ec57b
mov r8, rdi
lea rcx, [rbx + 0x24]
mov rdx, rsi
call fcn.140174c80
mov r15, qword [rsp + 0x100]
lea rsi, [rbx + 0x20]
mov dword [rsi], edi
mov ecx, dword [rsi]
cmp ecx, 0x90
je 0x1400ec5ca
mov eax, ecx
mov r8d, 0x90
sub r8d, ecx
xor edx, edx
lea rcx, [rbx + 0x24]
add rcx, rax
call fcn.140174ac0
mov r12d, r13d
lea rcx, [rsp + 0x20]
mov rax, rbx
sub rax, rcx
mov rdx, r14
lea rdi, [rax + 0x24]
lea rsi, [rax + 0x25]
nop dword [rax]
nop word [rax + rax]
lea rcx, [rsp + 0x20]
add rcx, rdx
add rdx, 2
movzx eax, byte [rdi + rcx]
xor al, 0x36
mov byte [rcx], al
movzx eax, byte [rsi + rcx]
xor al, 0x36
mov byte [rcx + 1], al
cmp rdx, 0x90
jl 0x1400ec5f0
mov rcx, qword [rbx + 0x10]
mov r8, r15
mov rdx, rbp
call fcn.1400793a0
test eax, eax
je 0x1400ec6b9
mov rcx, rbp
call fcn.1400616f0
mov rcx, qword [rbx + 0x10]
lea rdx, [rsp + 0x20]
movsxd r8, eax
call fcn.1400795f0
test eax, eax
je 0x1400ec6b9
mov rdx, r14
nop dword [rax]
lea rcx, [rsp + 0x20]
add rcx, rdx
add rdx, 2
movzx eax, byte [rdi + rcx]
xor al, 0x5c
mov byte [rcx], al
movzx eax, byte [rsi + rcx]
xor al, 0x5c
mov byte [rcx + 1], al
cmp rdx, 0x90
jl 0x1400ec650
mov rcx, qword [rbx + 0x18]
mov r8, r15
mov rdx, rbp
call fcn.1400793a0
test eax, eax
je 0x1400ec6b9
mov rcx, rbp
call fcn.1400616f0
mov rcx, qword [rbx + 0x18]
lea rdx, [rsp + 0x20]
movsxd r8, eax
call fcn.1400795f0
test eax, eax
je 0x1400ec6b9
mov rdx, qword [rbx + 0x10]
mov rcx, qword [rbx + 8]
call fcn.140079630
test eax, eax
cmovne r14d, r12d
test r13d, r13d
je 0x1400ec6cd
mov edx, 0x90
lea rcx, [rsp + 0x20]
call fcn.14006c630
mov eax, r14d
mov r15, qword [rsp + 0xe0]
lea r11, [rsp + 0xb0]
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsp, r11
pop r14
pop r13
pop r12
pop rdi
pop rsi
ret
test r13d, r13d
je 0x1400ec6a6
jmp 0x1400ec5cd
Function at 0x1400fb3e0
Capabilities:
Encode data using base64

Disassembly:
sub rsp, 8
xor r11d, r11d
test rcx, rcx
je 0x1400fb3f9
test byte [rcx + 0x5c], 2
lea r10, str.0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz._
jne 0x1400fb400
lea r10, [0x140209440]
test r9d, r9d
jle 0x1400fb4ef
inc r8
mov qword [rsp], rbx
movzx eax, byte [r8 - 1]
cmp r9d, 3
jl 0x1400fb471
movzx ecx, al
movzx eax, byte [r8]
shl rcx, 8
or rcx, rax
movzx eax, byte [r8 + 1]
shl rcx, 8
or rcx, rax
mov rax, rcx
shr rax, 0x12
movzx eax, byte [rax + r10]
mov byte [rdx], al
mov rax, rcx
shr rax, 0xc
and eax, 0x3f
movzx eax, byte [rax + r10]
mov byte [rdx + 1], al
mov rax, rcx
shr rax, 6
and eax, 0x3f
and ecx, 0x3f
movzx eax, byte [rax + r10]
mov byte [rdx + 2], al
movzx ecx, byte [rcx + r10]
jmp 0x1400fb4c1
movzx ecx, al
shl ecx, 0x10
cmp r9d, 2
jne 0x1400fb486
movzx eax, byte [r8]
shl eax, 8
or ecx, eax
mov rax, rcx
shr rax, 0x12
movzx eax, byte [rax + r10]
mov byte [rdx], al
mov rax, rcx
shr rax, 0xc
and eax, 0x3f
movzx eax, byte [rax + r10]
mov byte [rdx + 1], al
cmp r9d, 1
jne 0x1400fb4b0
mov al, 0x3d
jmp 0x1400fb4bc
shr rcx, 6
and ecx, 0x3f
movzx eax, byte [rcx + r10]
mov byte [rdx + 2], al
mov cl, 0x3d
lea rax, [rdx + 3]
add r11d, 4
lea rdx, [rax + 1]
mov byte [rax], cl
add r8, 3
sub r9d, 3
test r9d, r9d
jg 0x1400fb410
mov rbx, qword [rsp]
mov eax, r11d
mov byte [rdx], 0
add rsp, 8
ret
mov byte [rdx], r11b
mov eax, r11d
add rsp, 8
ret

Function at 0x140100f90
Capabilities:
Hash data using sha512

Disassembly:
push rbx
sub rsp, 0x100
test r8, r8
mov dword [rsp + 0xf4], 0x40
movabs rax, 0x6a09e667f3bcc908
lea rbx, [0x14027c680]
mov qword [rsp + 0x20], rax
cmovne rbx, r8
movabs rax, 0xbb67ae8584caa73b
mov r8, rdx
mov qword [rsp + 0x28], rax
mov rdx, rcx
movabs rax, 0x3c6ef372fe94f82b
lea rcx, [rsp + 0x20]
mov qword [rsp + 0x30], rax
movabs rax, 0xa54ff53a5f1d36f1
mov qword [rsp + 0x38], rax
movabs rax, 0x510e527fade682d1
mov qword [rsp + 0x40], rax
movabs rax, 0x9b05688c2b3e6c1f
mov qword [rsp + 0x48], rax
movabs rax, 0x1f83d9abfb41bd6b
mov qword [rsp + 0x50], rax
movabs rax, 0x5be0cd19137e2179
mov qword [rsp + 0x58], rax
xor eax, eax
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], rax
mov dword [rsp + 0xf0], eax
call fcn.140101900
lea rdx, [rsp + 0x20]
mov rcx, rbx
call fcn.140101080
mov edx, 0xd8
lea rcx, [rsp + 0x20]
call fcn.14006c630
mov rax, rbx
add rsp, 0x100
pop rbx
ret
Function at 0x140105d30
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
mov qword [rsp + 0x20], r9
push rbp
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x30
mov rax, qword [rbp + 0x50]
mov r12, rcx
movzx ecx, byte [rax + 7]
lea rdi, [rax + 1]
mov r13, qword [rbp + 0x58]
mov rsi, rdx
movzx edx, byte [rdi + 3]
xor r15d, r15d
movzx r11d, byte [rax]
mov r14d, r8d
movzx eax, byte [rdi]
mov ebx, dword [r13]
shl eax, 8
or r11d, eax
shl ecx, 8
movzx eax, byte [rdi + 1]
shl eax, 0x10
or r11d, eax
movzx eax, byte [rdi + 2]
shl eax, 0x18
or r11d, eax
movzx eax, byte [rdi + 4]
shl eax, 8
or edx, eax
mov dword [rbp - 8], r11d
movzx eax, byte [rdi + 5]
or ecx, eax
mov byte [rbp - 0x10], r11b
shl ecx, 0x10
mov eax, r11d
shr eax, 8
or edx, ecx
mov byte [rbp - 0xf], al
mov eax, r11d
shr eax, 0x10
mov byte [rbp - 0xe], al
mov eax, r11d
shr eax, 0x18
mov byte [rbp - 0xd], al
mov eax, edx
shr eax, 8
mov byte [rbp - 0xb], al
mov eax, edx
shr eax, 0x10
mov byte [rbp - 0xa], al
mov eax, edx
shr eax, 0x18
mov dword [rbp - 4], edx
mov byte [rbp - 0xc], dl
mov byte [rbp - 9], al
test r8d, r8d
je 0x140105ed8
mov r13, qword [rbp + 0x48]
sub r12, rsi
movzx r8d, dl
movzx r9d, r11b
nop dword [rax]
dec r14d
test ebx, ebx
jne 0x140105e76
lea r8d, [rbx + 1]
mov rdx, r13
lea rcx, [rbp - 8]
call fcn.1401021a0
mov r11d, dword [rbp - 8]
mov eax, r11d
mov edx, dword [rbp - 4]
movzx r9d, byte [rbp - 8]
movzx r8d, byte [rbp - 4]
shr eax, 8
mov byte [rbp - 0xf], al
mov eax, r11d
shr eax, 0x10
mov byte [rbp - 0xe], al
mov eax, r11d
shr eax, 0x18
mov byte [rbp - 0xd], al
mov eax, edx
shr eax, 8
mov byte [rbp - 0xb], al
mov eax, edx
shr eax, 0x10
mov byte [rbp - 0xa], al
mov eax, edx
shr eax, 0x18
mov byte [rbp - 9], al
inc r15d
mov byte [rbp - 0x10], r9b
mov byte [rbp - 0xc], r8b
movsxd rax, ebx
movzx ecx, byte [rbp + rax - 0x10]
xor cl, byte [r12 + rsi]
mov byte [rsi], cl
inc rsi
inc ebx
and ebx, 7
test r14d, r14d
jne 0x140105e10
mov r13, qword [rbp + 0x58]
test r15d, r15d
je 0x140105ed8
mov rax, qword [rbp + 0x50]
mov byte [rax], r9b
mov eax, r11d
shr eax, 8
mov byte [rdi], al
mov eax, r11d
shr eax, 0x10
mov byte [rdi + 1], al
mov eax, edx
shr eax, 8
shr r11d, 0x18
mov byte [rdi + 2], r11b
mov byte [rdi + 3], r8b
mov byte [rdi + 4], al
mov eax, edx
shr eax, 0x10
shr edx, 0x18
mov byte [rdi + 5], al
mov byte [rdi + 6], dl
mov rsi, qword [rsp + 0x68]
mov rdi, qword [rsp + 0x70]
mov dword [r13], ebx
mov rbx, qword [rsp + 0x60]
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
Function at 0x140106a90
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], r9
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x30
mov rax, qword [rsp + 0x90]
mov r15, rcx
movzx ecx, byte [rax + 7]
lea rdi, [rax + 1]
mov r12, qword [rsp + 0x98]
mov rsi, rdx
movzx edx, byte [rdi + 3]
xor r14d, r14d
movzx r11d, byte [rax]
mov ebp, r8d
movzx eax, byte [rdi]
mov ebx, dword [r12]
shl eax, 8
or r11d, eax
shl ecx, 8
movzx eax, byte [rdi + 1]
shl eax, 0x10
or r11d, eax
movzx eax, byte [rdi + 2]
shl eax, 0x18
or r11d, eax
movzx eax, byte [rdi + 4]
shl eax, 8
or edx, eax
mov dword [rsp + 0x28], r11d
movzx eax, byte [rdi + 5]
or ecx, eax
mov byte [rsp + 0x20], r11b
shl ecx, 0x10
mov eax, r11d
shr eax, 8
or edx, ecx
mov byte [rsp + 0x21], al
mov eax, r11d
shr eax, 0x10
mov byte [rsp + 0x22], al
mov eax, r11d
shr eax, 0x18
mov byte [rsp + 0x23], al
mov eax, edx
shr eax, 8
mov byte [rsp + 0x25], al
mov eax, edx
shr eax, 0x10
mov byte [rsp + 0x26], al
mov eax, edx
shr eax, 0x18
mov dword [rsp + 0x2c], edx
mov byte [rsp + 0x24], dl
mov byte [rsp + 0x27], al
test r8d, r8d
je 0x140106c51
mov r12, qword [rsp + 0x78]
sub r15, rsi
mov qword [rsp + 0x60], r13
mov r13, qword [rsp + 0x88]
dec ebp
test ebx, ebx
jne 0x140106be4
mov r8, qword [rsp + 0x80]
lea rcx, [rsp + 0x28]
mov r9, r13
mov rdx, r12
call fcn.140104660
mov r11d, dword [rsp + 0x28]
mov eax, r11d
mov edx, dword [rsp + 0x2c]
shr eax, 8
mov byte [rsp + 0x21], al
mov eax, r11d
shr eax, 0x10
mov byte [rsp + 0x22], al
mov eax, r11d
shr eax, 0x18
mov byte [rsp + 0x23], al
mov eax, edx
shr eax, 8
mov byte [rsp + 0x25], al
mov eax, edx
shr eax, 0x10
mov byte [rsp + 0x26], al
mov eax, edx
shr eax, 0x18
mov byte [rsp + 0x27], al
inc r14d
mov byte [rsp + 0x20], r11b
mov byte [rsp + 0x24], dl
movsxd rax, ebx
movzx ecx, byte [rsp + rax + 0x20]
xor cl, byte [r15 + rsi]
mov byte [rsi], cl
inc rsi
inc ebx
and ebx, 7
test ebp, ebp
jne 0x140106b78
mov r13, qword [rsp + 0x60]
mov r12, qword [rsp + 0x98]
test r14d, r14d
je 0x140106c51
mov rax, qword [rsp + 0x90]
mov byte [rax], r11b
mov eax, r11d
shr eax, 8
mov byte [rdi], al
mov eax, r11d
shr eax, 0x10
mov byte [rdi + 1], al
mov eax, edx
shr eax, 8
shr r11d, 0x18
mov byte [rdi + 2], r11b
mov byte [rdi + 3], dl
mov byte [rdi + 4], al
mov eax, edx
shr eax, 0x10
shr edx, 0x18
mov byte [rdi + 5], al
mov byte [rdi + 6], dl
mov rbp, qword [rsp + 0x70]
mov dword [r12], ebx
mov rbx, qword [rsp + 0x68]
add rsp, 0x30
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret
Function at 0x140107fb0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
mov qword [rsp + 0x20], r9
push rbp
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x30
mov rax, qword [rbp + 0x50]
mov rsi, rdx
movzx edx, byte [rax + 4]
lea rdi, [rax + 1]
mov r13, qword [rbp + 0x58]
lea r9, [rdi + 5]
mov r12, rcx
shl edx, 0x18
movzx r10d, byte [rax]
xor r15d, r15d
movzx eax, byte [rdi]
mov r14d, r8d
movzx ecx, byte [r9]
mov ebx, dword [r13]
shl eax, 0x10
shl r10d, 0x18
or r10d, eax
shl ecx, 8
movzx eax, byte [rdi + 1]
shl eax, 8
or r10d, eax
movzx eax, byte [rdi + 2]
or r10d, eax
movzx eax, byte [rdi + 4]
shl eax, 0x10
or edx, eax
mov dword [rbp - 8], r10d
movzx eax, byte [r9 + 1]
or ecx, eax
mov byte [rbp - 0xd], r10b
or edx, ecx
mov eax, r10d
shr eax, 0x18
mov byte [rbp - 0x10], al
mov eax, r10d
shr eax, 0x10
mov byte [rbp - 0xf], al
mov eax, r10d
shr eax, 8
mov byte [rbp - 0xe], al
mov eax, edx
shr eax, 0x18
mov byte [rbp - 0xc], al
mov eax, edx
shr eax, 0x10
mov byte [rbp - 0xb], al
mov eax, edx
shr eax, 8
mov dword [rbp - 4], edx
mov byte [rbp - 0xa], al
mov byte [rbp - 9], dl
test r8d, r8d
je 0x14010814d
mov r13, qword [rbp + 0x48]
sub r12, rsi
movzx r8d, dl
movzx r9d, r10b
nop
dec r14d
test ebx, ebx
jne 0x1401080ef
mov rdx, r13
lea rcx, [rbp - 8]
call fcn.1401075a0
mov r10d, dword [rbp - 8]
mov eax, r10d
mov edx, dword [rbp - 4]
movzx r9d, r10b
shr eax, 0x18
movzx r8d, dl
mov byte [rbp - 0x10], al
mov eax, r10d
shr eax, 0x10
mov byte [rbp - 0xf], al
mov eax, r10d
shr eax, 8
mov byte [rbp - 0xe], al
mov eax, edx
shr eax, 0x18
mov byte [rbp - 0xc], al
mov eax, edx
shr eax, 0x10
mov byte [rbp - 0xb], al
mov eax, edx
shr eax, 8
mov byte [rbp - 0xa], al
inc r15d
mov byte [rbp - 0xd], r10b
mov byte [rbp - 9], dl
movsxd rax, ebx
movzx ecx, byte [rbp + rax - 0x10]
xor cl, byte [r12 + rsi]
mov byte [rsi], cl
inc rsi
inc ebx
and ebx, 7
test r14d, r14d
jne 0x140108090
mov r13, qword [rbp + 0x58]
test r15d, r15d
je 0x14010814d
mov rcx, qword [rbp + 0x50]
mov eax, r10d
shr eax, 0x18
mov byte [rcx], al
mov eax, r10d
shr eax, 0x10
mov byte [rdi], al
mov eax, edx
shr eax, 0x18
shr r10d, 8
mov byte [rdi + 1], r10b
mov byte [rdi + 2], r9b
mov byte [rdi + 3], al
mov eax, edx
shr eax, 0x10
mov byte [rdi + 4], al
shr edx, 8
mov byte [rdi + 5], dl
mov byte [rdi + 6], r8b
mov rsi, qword [rsp + 0x68]
mov rdi, qword [rsp + 0x70]
mov dword [r13], ebx
mov rbx, qword [rsp + 0x60]
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
Function at 0x140108f60
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
mov qword [rsp + 0x20], r9
push rbp
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x30
mov rax, qword [rbp + 0x50]
mov r12, rcx
movzx ecx, byte [rax + 7]
lea rdi, [rax + 1]
mov r13, qword [rbp + 0x58]
mov rsi, rdx
movzx edx, byte [rdi + 3]
xor r15d, r15d
movzx r11d, byte [rax]
mov r14d, r8d
movzx eax, byte [rdi]
mov ebx, dword [r13]
shl eax, 8
or r11d, eax
shl ecx, 8
movzx eax, byte [rdi + 1]
shl eax, 0x10
or r11d, eax
movzx eax, byte [rdi + 2]
shl eax, 0x18
or r11d, eax
movzx eax, byte [rdi + 4]
shl eax, 8
or edx, eax
mov dword [rbp - 8], r11d
movzx eax, byte [rdi + 5]
or ecx, eax
mov byte [rbp - 0x10], r11b
shl ecx, 0x10
mov eax, r11d
shr eax, 8
or edx, ecx
mov byte [rbp - 0xf], al
mov eax, r11d
shr eax, 0x10
mov byte [rbp - 0xe], al
mov eax, r11d
shr eax, 0x18
mov byte [rbp - 0xd], al
mov eax, edx
shr eax, 8
mov byte [rbp - 0xb], al
mov eax, edx
shr eax, 0x10
mov byte [rbp - 0xa], al
mov eax, edx
shr eax, 0x18
mov dword [rbp - 4], edx
mov byte [rbp - 0xc], dl
mov byte [rbp - 9], al
test r8d, r8d
je 0x140109100
mov r13, qword [rbp + 0x48]
sub r12, rsi
movzx r8d, dl
movzx r9d, r11b
nop dword [rax]
dec r14d
test ebx, ebx
jne 0x1401090a2
mov rdx, r13
lea rcx, [rbp - 8]
call fcn.140108c00
mov r11d, dword [rbp - 8]
mov eax, r11d
mov edx, dword [rbp - 4]
movzx r9d, byte [rbp - 8]
movzx r8d, byte [rbp - 4]
shr eax, 8
mov byte [rbp - 0xf], al
mov eax, r11d
shr eax, 0x10
mov byte [rbp - 0xe], al
mov eax, r11d
shr eax, 0x18
mov byte [rbp - 0xd], al
mov eax, edx
shr eax, 8
mov byte [rbp - 0xb], al
mov eax, edx
shr eax, 0x10
mov byte [rbp - 0xa], al
mov eax, edx
shr eax, 0x18
mov byte [rbp - 9], al
inc r15d
mov byte [rbp - 0x10], r9b
mov byte [rbp - 0xc], r8b
movsxd rax, ebx
movzx ecx, byte [rbp + rax - 0x10]
xor cl, byte [r12 + rsi]
mov byte [rsi], cl
inc rsi
inc ebx
and ebx, 7
test r14d, r14d
jne 0x140109040
mov r13, qword [rbp + 0x58]
test r15d, r15d
je 0x140109100
mov rax, qword [rbp + 0x50]
mov byte [rax], r9b
mov eax, r11d
shr eax, 8
mov byte [rdi], al
mov eax, r11d
shr eax, 0x10
mov byte [rdi + 1], al
mov eax, edx
shr eax, 8
shr r11d, 0x18
mov byte [rdi + 2], r11b
mov byte [rdi + 3], r8b
mov byte [rdi + 4], al
mov eax, edx
shr eax, 0x10
shr edx, 0x18
mov byte [rdi + 5], al
mov byte [rdi + 6], dl
mov rsi, qword [rsp + 0x68]
mov rdi, qword [rsp + 0x70]
mov dword [r13], ebx
mov rbx, qword [rsp + 0x60]
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rbp
ret