joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1401b5330
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x20
mov rbp, qword [rdx]
mov r14, rcx
mov rdx, rbp
call fcn.140176c00
mov rsi, qword [r14 + 0x18]
mov r11, rax
imul r11, qword [r14 + 8]
mov r15d, dword [r14 + 0x38]
mov rax, r11
shr rax, 0x21
xor r11, rax
mov eax, dword [r14 + 0x3c]
mov rdx, r11
shr r11, 5
and r11, qword [r14 + 0x28]
and edx, 0x1f
shrx rbx, rdx, rax
mov rdi, r11
add ebx, r15d
shl rdi, 4
movzx eax, byte [rsi + r11]
cmp ebx, eax
jne 0x1401b53ff
mov rax, qword [r14 + 0x10]
movzx r8d, byte [rbp + 6]
mov rcx, qword [rdi + rax]
cmp r8b, byte [rcx + 6]
jne 0x1401b53ff
xor dl, dl
test r8b, r8b
je 0x1401b53f7
mov eax, dword [rcx]
movzx r9d, word [rcx + 4]
movzx r10d, word [rbp + 4]
shl r9, 0x20
or r9, rax
shl r10, 0x20
mov eax, dword [rbp]
or r10, rax
movzx eax, dl
lea rcx, [rax + rax*8]
mov rax, qword [r10 + rcx*2]
cmp rax, qword [r9 + rcx*2]
jne 0x1401b53ff
movzx eax, word [r10 + rcx*2 + 8]
cmp ax, word [r9 + rcx*2 + 8]
jne 0x1401b53ff
inc dl
cmp dl, r8b
jb 0x1401b53d1
mov rax, r11
jmp 0x1401b54ab
movzx eax, byte [rsi + r11 + 1]
add ebx, r15d
cmp ebx, eax
jne 0x1401b547c
mov rax, qword [r14 + 0x10]
movzx r8d, byte [rbp + 6]
mov rcx, qword [rdi + rax + 0x10]
cmp r8b, byte [rcx + 6]
jne 0x1401b547c
xor al, al
test r8b, r8b
je 0x1401b5476
movzx r9d, word [rcx + 4]
mov ecx, dword [rcx]
movzx r10d, word [rbp + 4]
shl r9, 0x20
or r9, rcx
shl r10, 0x20
mov ecx, dword [rbp]
or r10, rcx
nop dword [rax]
nop dword [rax + rax]
movzx ecx, al
lea rdx, [rcx + rcx*8]
mov rcx, qword [r10 + rdx*2]
cmp rcx, qword [r9 + rdx*2]
jne 0x1401b547c
movzx ecx, word [r10 + rdx*2 + 8]
cmp cx, word [r9 + rdx*2 + 8]
jne 0x1401b547c
inc al
cmp al, r8b
jb 0x1401b5450
lea rax, [r11 + 1]
jmp 0x1401b54ab
movzx eax, byte [rsi + r11 + 2]
add r11, 2
add rdi, 0x20
add ebx, r15d
cmp ebx, eax
jbe 0x1401b5398
cmp qword [r14 + 0x28], 0
jne 0x1401b54a0
xor esi, esi
jmp 0x1401b54a8
sub rsi, qword [r14 + 0x10]
sar rsi, 4
mov rax, rsi
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop rdi
ret
Function at 0x1401b5580
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x20
mov r14, qword [rdx]
mov r15, rcx
mov rbp, qword [rcx + 0x18]
mov r12d, dword [rcx + 0x38]
mov r13d, dword [r14 + 2]
mov ebx, r13d
imul rbx, qword [rcx + 8]
mov rax, rbx
shr rax, 0x21
xor rbx, rax
mov eax, dword [rcx + 0x3c]
mov rdx, rbx
shr rbx, 5
and rbx, qword [rcx + 0x28]
and edx, 0x1f
shrx rdi, rdx, rax
mov rsi, rbx
add edi, r12d
shl rsi, 4
movzx eax, byte [rbx + rbp]
cmp edi, eax
jne 0x1401b562d
mov rax, qword [r15 + 0x10]
mov rcx, qword [rsi + rax]
movzx eax, word [r14]
cmp ax, word [rcx]
jne 0x1401b562d
cmp r13d, dword [rcx + 2]
jne 0x1401b562d
movzx edx, word [rcx + 0xa]
mov r8d, eax
mov eax, dword [rcx + 6]
movzx ecx, word [r14 + 0xa]
shl rdx, 0x20
or rdx, rax
shl rcx, 0x20
mov eax, dword [r14 + 6]
or rcx, rax
shl r8, 3
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
je 0x1401b56a2
movzx eax, byte [rbx + rbp + 1]
add edi, r12d
cmp edi, eax
jne 0x1401b567f
mov rax, qword [r15 + 0x10]
mov rcx, qword [rsi + rax + 0x10]
movzx eax, word [r14]
cmp ax, word [rcx]
jne 0x1401b567f
cmp r13d, dword [rcx + 2]
jne 0x1401b567f
movzx edx, word [rcx + 0xa]
mov r8d, eax
mov eax, dword [rcx + 6]
movzx ecx, word [r14 + 0xa]
shl rdx, 0x20
or rdx, rax
shl rcx, 0x20
mov eax, dword [r14 + 6]
or rcx, rax
shl r8, 3
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
je 0x1401b56a7
movzx eax, byte [rbx + rbp + 2]
add rbx, 2
add rsi, 0x20
add edi, r12d
cmp edi, eax
jbe 0x1401b55e6
cmp qword [r15 + 0x28], 0
jne 0x1401b56ad
xor ebp, ebp
jmp 0x1401b56b5
mov rax, rbx
jmp 0x1401b56b8
lea rax, [rbx + 1]
jmp 0x1401b56b8
sub rbp, qword [r15 + 0x10]
sar rbp, 4
mov rax, rbp
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x20
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x1401b6120
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x20
mov r15, rdx
mov rsi, rcx
mov rcx, qword [r8]
mov rdx, 0xffffffffffffffff
mov r14, r8
inc rdx
cmp byte [rcx + rdx], 0
jne 0x1401b6151
call fcn.140025020
mov r12, qword [rsi + 0x28]
mov r8, rax
imul r8, qword [rsi + 8]
mov rdi, qword [rsi + 0x18]
mov ebp, dword [rsi + 0x38]
mov rcx, r8
shr rcx, 0x21
xor r8, rcx
mov ecx, dword [rsi + 0x3c]
mov rdx, r8
shr r8, 5
and r8, r12
and edx, 0x1f
shrx r11, rdx, rcx
add r11d, ebp
mov rbx, r8
shl rbx, 4
movzx eax, byte [rdi + r8]
mov r9, qword [rsi + 0x10]
cmp r11d, eax
jne 0x1401b61ca
mov rax, qword [r14]
mov r10, qword [rbx + r9]
sub r10, rax
movzx edx, byte [rax]
movzx ecx, byte [rax + r10]
sub edx, ecx
jne 0x1401b61c6
inc rax
test ecx, ecx
jne 0x1401b61b3
test edx, edx
je 0x1401b623c
movzx eax, byte [rdi + r8 + 1]
inc r8
add r11d, ebp
mov r10, r9
cmp r11d, eax
jne 0x1401b6209
mov rax, qword [r14]
mov r9, qword [rbx + r9 + 0x10]
sub r9, rax
nop dword [rax]
movzx edx, byte [rax]
movzx ecx, byte [rax + r9]
sub edx, ecx
jne 0x1401b6203
inc rax
test ecx, ecx
jne 0x1401b61f0
test edx, edx
je 0x1401b6239
jmp 0x1401b620c
mov r10, r9
movzx eax, byte [rdi + r8 + 1]
inc r8
add rbx, 0x20
add r11d, ebp
cmp r11d, eax
jbe 0x1401b61a0
test r12, r12
jne 0x1401b622f
xor r8d, r8d
jmp 0x1401b6239
mov r8, rdi
sub r8, r10
sar r8, 4
mov r9, r10
mov rbx, qword [rsp + 0x40]
mov rax, r8
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
shl rax, 4
add rax, r9
mov qword [r15], rax
lea rax, [rdi + r8]
mov rdi, qword [rsp + 0x58]
mov qword [r15 + 8], rax
mov rax, r15
add rsp, 0x20
pop r15
pop r14
pop r12
ret
Function at 0x1401b6450
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], r8
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x20
xor esi, esi
mov r15, r8
mov dword [rsp + 0x78], esi
mov r13, rdx
mov r14, rcx
nop dword [rax + rax]
mov rcx, qword [r15]
mov edx, 0x23
call fcn.1401767f0
mov rbp, qword [r14 + 0x18]
mov rbx, rax
imul rbx, qword [r14 + 8]
mov r12d, dword [r14 + 0x38]
mov rax, rbx
shr rax, 0x21
xor rbx, rax
mov eax, dword [r14 + 0x3c]
mov rcx, rbx
shr rbx, 5
and rbx, qword [r14 + 0x28]
and ecx, 0x1f
shrx rdi, rcx, rax
add edi, r12d
movzx eax, byte [rbx + rbp]
cmp edi, eax
jae 0x1401b64df
nop dword [rax]
movzx eax, byte [rbx + rbp + 1]
inc rbx
add edi, r12d
cmp edi, eax
jb 0x1401b64d0
movzx eax, byte [rbx + rbp]
cmp edi, eax
jne 0x1401b6531
mov r15, qword [r15]
mov rsi, rbx
shl rsi, 4
add rsi, qword [r14 + 0x10]
nop word [rax + rax]
mov rdx, qword [rsi]
mov r8d, 0x23
mov rcx, r15
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
je 0x1401b6565
movzx eax, byte [rbx + rbp + 1]
inc rbx
add rsi, 0x10
add edi, r12d
cmp edi, eax
je 0x1401b6500
mov esi, dword [rsp + 0x78]
mov r15, qword [rsp + 0x70]
mov rax, qword [r14 + 0x30]
cmp qword [r14 + 0x20], rax
jb 0x1401b6573
mov rcx, r14
call fcn.1401c0fa0
test al, al
je 0x1401b6559
inc esi
mov dword [rsp + 0x78], esi
cmp esi, 0x100
jl 0x1401b6480
xor eax, eax
mov qword [r13], rax
mov dword [r13 + 8], eax
jmp 0x1401b65cf
mov qword [r13], rbx
mov dword [r13 + 8], 1
jmp 0x1401b65cf
lea eax, [r12 + rdi]
mov r11, rbx
cmp eax, 0xff
jbe 0x1401b6587
xor eax, eax
mov qword [r14 + 0x30], rax
cmp byte [rbx + rbp], 0
je 0x1401b65ac
nop dword [rax]
inc rbx
cmp byte [rbx + rbp], 0
jne 0x1401b6590
cmp rbx, r11
je 0x1401b65ac
mov r8, r11
mov rdx, rbx
mov rcx, r14
call fcn.140059150
mov rax, qword [r14 + 0x18]
mov esi, 0
mov qword [r13], r11
mov byte [r11 + rax], dil
inc qword [r14 + 0x20]
cmp rbx, r11
setne sil
add esi, 2
mov dword [r13 + 8], esi
mov rbx, qword [rsp + 0x60]
mov rax, r13
add rsp, 0x20
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x1401b6c00
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x20
xor esi, esi
mov r12, r8
mov dword [rsp + 0x68], esi
mov r13, rdx
mov r14, rcx
nop dword [rax + rax]
mov rdx, qword [r12 + 8]
mov rcx, qword [r12]
call fcn.1401767f0
mov rbp, qword [r14 + 0x18]
mov rbx, rax
imul rbx, qword [r14 + 8]
mov edx, dword [r14 + 0x38]
mov rax, rbx
shr rax, 0x21
xor rbx, rax
mov eax, dword [r14 + 0x3c]
mov rcx, rbx
shr rbx, 5
and rbx, qword [r14 + 0x28]
and ecx, 0x1f
shrx rdi, rcx, rax
add edi, edx
movzx eax, byte [rbx + rbp]
cmp edi, eax
jae 0x1401b6c8e
nop dword [rax]
movzx eax, byte [rbx + rbp + 1]
inc rbx
add edi, edx
cmp edi, eax
jb 0x1401b6c80
movzx eax, byte [rbx + rbp]
cmp edi, eax
jne 0x1401b6cdb
mov rax, qword [r14 + 0x10]
lea rcx, [rbx + rbx*2]
mov r15, qword [r12 + 8]
lea rsi, [rax + rcx*8]
cmp r15, qword [rsi + 8]
jne 0x1401b6cc0
mov rdx, qword [rsi]
mov r8, r15
mov rcx, qword [r12]
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
je 0x1401b6d11
mov ecx, dword [r14 + 0x38]
inc rbx
add rsi, 0x18
add edi, ecx
movzx eax, byte [rbx + rbp]
cmp edi, eax
je 0x1401b6ca7
mov esi, dword [rsp + 0x68]
jmp 0x1401b6cdd
mov ecx, edx
mov rax, qword [r14 + 0x30]
cmp qword [r14 + 0x20], rax
jb 0x1401b6d1f
mov rcx, r14
call fcn.1401c1490
test al, al
je 0x1401b6d05
inc esi
mov dword [rsp + 0x68], esi
cmp esi, 0x100
jl 0x1401b6c30
xor eax, eax
mov qword [r13], rax
mov dword [r13 + 8], eax
jmp 0x1401b6d7f
mov qword [r13], rbx
mov dword [r13 + 8], 1
jmp 0x1401b6d7f
lea eax, [rcx + rdi]
mov r11, rbx
cmp eax, 0xff
jbe 0x1401b6d32
xor eax, eax
mov qword [r14 + 0x30], rax
cmp byte [rbx + rbp], 0
je 0x1401b6d5c
nop dword [rax + rax]
inc rbx
cmp byte [rbx + rbp], 0
jne 0x1401b6d40
cmp rbx, r11
je 0x1401b6d5c
mov r8, r11
mov rdx, rbx
mov rcx, r14
call fcn.140059310
mov rax, qword [r14 + 0x18]
mov esi, 0
mov qword [r13], r11
mov byte [r11 + rax], dil
inc qword [r14 + 0x20]
cmp rbx, r11
setne sil
add esi, 2
mov dword [r13 + 8], esi
mov rbx, qword [rsp + 0x50]
mov rax, r13
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x20
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x1401b7770
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x20
xor ebp, ebp
mov r15, r8
mov esi, ebp
mov r14, rdx
mov rdi, rcx
nop word [rax + rax]
mov r8, qword [r15]
mov rdx, qword [rdi + 0x18]
mov r11, r8
imul r11, qword [rdi + 8]
mov r9d, dword [rdi + 0x38]
mov rax, r11
shr rax, 0x21
xor r11, rax
mov eax, dword [rdi + 0x3c]
mov rcx, r11
shr r11, 5
and r11, qword [rdi + 0x28]
and ecx, 0x1f
shrx rbx, rcx, rax
add ebx, r9d
movzx eax, byte [rdx + r11]
cmp ebx, eax
jae 0x1401b77f0
nop
movzx eax, byte [rdx + r11 + 1]
inc r11
add ebx, r9d
cmp ebx, eax
jb 0x1401b77e0
movzx eax, byte [rdx + r11]
cmp ebx, eax
jne 0x1401b781d
mov rcx, r11
shl rcx, 4
add rcx, qword [rdi + 0x10]
cmp r8, qword [rcx]
je 0x1401b7846
movzx eax, byte [rdx + r11 + 1]
inc r11
add rcx, 0x10
add ebx, r9d
cmp ebx, eax
je 0x1401b7804
mov rax, qword [rdi + 0x30]
cmp qword [rdi + 0x20], rax
jb 0x1401b7853
mov rcx, rdi
call fcn.1401c09c0
test al, al
je 0x1401b7841
inc esi
cmp esi, 0x100
jl 0x1401b77a0
mov qword [r14], rbp
jmp 0x1401b78a4
mov qword [r14], r11
mov dword [r14 + 8], 1
jmp 0x1401b78a8
lea eax, [r9 + rbx]
mov rsi, r11
cmp eax, 0xff
jbe 0x1401b7865
mov qword [rdi + 0x30], rbp
cmp byte [rdx + r11], bpl
je 0x1401b788c
nop dword [rax + rax]
inc r11
cmp byte [rdx + r11], bpl
jne 0x1401b7870
cmp r11, rsi
je 0x1401b788c
mov r8, rsi
mov rdx, r11
mov rcx, rdi
call fcn.140059150
mov rax, qword [rdi + 0x18]
mov qword [r14], rsi
mov byte [rsi + rax], bl
inc qword [rdi + 0x20]
cmp r11, rsi
setne bpl
add ebp, 2
mov dword [r14 + 8], ebp
mov rbx, qword [rsp + 0x40]
mov rax, r14
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop rdi
ret
Function at 0x1401b8140
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x20
xor r12d, r12d
mov r13, r8
mov ebp, r12d
mov r15, rdx
mov rsi, rcx
nop dword [rax + rax]
mov rcx, qword [r13]
mov rdx, 0xffffffffffffffff
nop dword [rax + rax]
inc rdx
cmp byte [rcx + rdx], r12b
jne 0x1401b8180
call fcn.140025020
mov r10, qword [rsi + 0x18]
mov r11, rax
imul r11, qword [rsi + 8]
mov r14d, dword [rsi + 0x38]
mov rcx, r11
shr rcx, 0x21
xor r11, rcx
mov ecx, dword [rsi + 0x3c]
mov rdx, r11
shr r11, 5
and r11, qword [rsi + 0x28]
and edx, 0x1f
shrx rbx, rdx, rcx
add ebx, r14d
movzx eax, byte [r10 + r11]
cmp ebx, eax
jae 0x1401b81e0
nop word [rax + rax]
movzx eax, byte [r10 + r11 + 1]
inc r11
add ebx, r14d
cmp ebx, eax
jb 0x1401b81d0
movzx eax, byte [r10 + r11]
cmp ebx, eax
jne 0x1401b823b
mov rax, qword [rsi + 0x10]
lea rcx, [r11 + r11*2]
mov rdi, qword [r13]
lea r9, [rax + rcx*8]
nop dword [rax]
mov r8, qword [r9]
mov rax, rdi
sub r8, rdi
nop dword [rax]
movzx edx, byte [rax]
movzx ecx, byte [rax + r8]
sub edx, ecx
jne 0x1401b8223
inc rax
test ecx, ecx
jne 0x1401b8210
test edx, edx
je 0x1401b8264
movzx eax, byte [r10 + r11 + 1]
inc r11
add r9, 0x18
add ebx, r14d
cmp ebx, eax
je 0x1401b8200
mov rax, qword [rsi + 0x30]
cmp qword [rsi + 0x20], rax
jb 0x1401b8271
mov rcx, rsi
call fcn.1401bf740
test al, al
je 0x1401b825f
inc ebp
cmp ebp, 0x100
jl 0x1401b8170
mov qword [r15], r12
jmp 0x1401b82c5
mov qword [r15], r11
mov dword [r15 + 8], 1
jmp 0x1401b82c9
lea eax, [r14 + rbx]
mov rdi, r11
cmp eax, 0xff
jbe 0x1401b8283
mov qword [rsi + 0x30], r12
cmp byte [r10 + r11], r12b
je 0x1401b82ac
nop dword [rax]
inc r11
cmp byte [r10 + r11], r12b
jne 0x1401b8290
cmp r11, rdi
je 0x1401b82ac
mov r8, rdi
mov rdx, r11
mov rcx, rsi
call fcn.140059310
mov rax, qword [rsi + 0x18]
mov qword [r15], rdi
mov byte [rdi + rax], bl
inc qword [rsi + 0x20]
cmp r11, rdi
setne r12b
add r12d, 2
mov dword [r15 + 8], r12d
mov rbx, qword [rsp + 0x50]
mov rax, r15
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x20
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x1401b8640
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x20
xor r12d, r12d
mov r14, r8
mov ebp, r12d
mov r15, rdx
mov rsi, rcx
nop dword [rax]
mov r9, qword [r14]
mov r8, qword [rsi + 0x18]
mov rbx, r9
imul rbx, qword [rsi + 8]
mov r10d, dword [rsi + 0x38]
mov rax, rbx
shr rax, 0x21
xor rbx, rax
mov eax, dword [rsi + 0x3c]
mov rcx, rbx
shr rbx, 5
and rbx, qword [rsi + 0x28]
and ecx, 0x1f
shrx rdi, rcx, rax
add edi, r10d
movzx eax, byte [r8 + rbx]
cmp edi, eax
jae 0x1401b86c0
nop
movzx eax, byte [r8 + rbx + 1]
inc rbx
add edi, r10d
cmp edi, eax
jb 0x1401b86b0
movzx eax, byte [r8 + rbx]
cmp edi, eax
jne 0x1401b86ee
mov rax, qword [rsi + 0x10]
lea rcx, [rbx + rbx*2]
lea rdx, [rax + rcx*4]
cmp r9, qword [rdx]
je 0x1401b8717
movzx eax, byte [r8 + rbx + 1]
inc rbx
add rdx, 0xc
add edi, r10d
cmp edi, eax
je 0x1401b86d5
mov rax, qword [rsi + 0x30]
cmp qword [rsi + 0x20], rax
jb 0x1401b8724
mov rcx, rsi
call fcn.1401c0500
test al, al
je 0x1401b8712
inc ebp
cmp ebp, 0x100
jl 0x1401b8670
mov qword [r15], r12
jmp 0x1401b8776
mov qword [r15], rbx
mov dword [r15 + 8], 1
jmp 0x1401b877a
lea eax, [r10 + rdi]
mov r14, rbx
cmp eax, 0xff
jbe 0x1401b8736
mov qword [rsi + 0x30], r12
cmp byte [r8 + rbx], r12b
je 0x1401b875c
nop dword [rax]
inc rbx
cmp byte [r8 + rbx], r12b
jne 0x1401b8740
cmp rbx, r14
je 0x1401b875c
mov r8, r14
mov rdx, rbx
mov rcx, rsi
call fcn.1401bf9a0
mov rax, qword [rsi + 0x18]
mov qword [r15], r14
mov byte [r14 + rax], dil
inc qword [rsi + 0x20]
cmp rbx, r14
setne r12b
add r12d, 2
mov dword [r15 + 8], r12d
mov rbx, qword [rsp + 0x40]
mov rax, r15
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x20
pop r15
pop r14
pop r12
ret

Function at 0x1401bb520
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x30
mov rbx, rdx
mov rdi, rcx
mov ecx, reloc.WS2_32.dll_recv
call fcn.1403f4d70
vmovups xmm0, xmmword [rbx]
vmovups xmmword [rax], xmm0
mov qword [rsp + 0x40], rax
lea rbx, [rdi + 8]
mov qword [rsp + 0x28], rbx
mov dword [rsp + 0x20], 0
mov r9, rax
lea r8, [0x1401c50a0]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rdi], rax
test rax, rax
je 0x1401bb57f
mov rbx, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
mov dword [rbx], 0
mov ecx, 6
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
int3
Function at 0x1401bb5a0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x20
xor r12d, r12d
mov r14, r8
mov ebp, r12d
mov r15, rdx
mov rsi, rcx
nop dword [rax]
mov edx, 9
mov rcx, r14
call fcn.1401767f0
mov rdx, qword [rsi + 0x18]
mov rbx, rax
imul rbx, qword [rsi + 8]
mov r8d, dword [rsi + 0x38]
mov rax, rbx
shr rax, 0x21
xor rbx, rax
mov eax, dword [rsi + 0x3c]
mov rcx, rbx
shr rbx, 5
and rbx, qword [rsi + 0x28]
and ecx, 0x1f
shrx rdi, rcx, rax
add edi, r8d
movzx eax, byte [rdx + rbx]
cmp edi, eax
jae 0x1401bb62f
nop dword [rax + rax]
movzx eax, byte [rdx + rbx + 1]
inc rbx
add edi, r8d
cmp edi, eax
jb 0x1401bb620
movzx eax, byte [rdx + rbx]
cmp edi, eax
jne 0x1401bb665
lea rcx, [rbx + rbx*8]
add rcx, qword [rsi + 0x10]
nop
mov rax, qword [r14]
cmp rax, qword [rcx]
jne 0x1401bb652
movzx eax, byte [r14 + 8]
cmp al, byte [rcx + 8]
je 0x1401bb68e
movzx eax, byte [rdx + rbx + 1]
inc rbx
add rcx, 9
add edi, r8d
cmp edi, eax
je 0x1401bb640
mov rax, qword [rsi + 0x30]
cmp qword [rsi + 0x20], rax
jb 0x1401bb69b
mov rcx, rsi
call fcn.1401bf430
test al, al
je 0x1401bb689
inc ebp
cmp ebp, 0x100
jl 0x1401bb5d0
mov qword [r15], r12
jmp 0x1401bb6e9
mov qword [r15], rbx
mov dword [r15 + 8], 1
jmp 0x1401bb6ed
lea eax, [r8 + rdi]
mov r14, rbx
cmp eax, 0xff
jbe 0x1401bb6ad
mov qword [rsi + 0x30], r12
cmp byte [rdx + rbx], r12b
je 0x1401bb6cf
inc rbx
cmp byte [rdx + rbx], r12b
jne 0x1401bb6b3
cmp rbx, r14
je 0x1401bb6cf
mov r8, r14
mov rdx, rbx
mov rcx, rsi
call fcn.1401bf560
mov rax, qword [rsi + 0x18]
mov qword [r15], r14
mov byte [r14 + rax], dil
inc qword [rsi + 0x20]
cmp rbx, r14
setne r12b
add r12d, 2
mov dword [r15 + 8], r12d
mov rbx, qword [rsp + 0x40]
mov rax, r15
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x20
pop r15
pop r14
pop r12
ret
Function at 0x1401bb710
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x20
mov r14, rcx
xor r13d, r13d
nop dword [rax]
nop dword [rax + rax]
mov rax, qword [r8]
mov rbp, qword [r14 + 0x18]
mov edx, dword [r14 + 0x38]
mov ebx, dword [rax + 2]
imul rbx, qword [r14 + 8]
mov rax, rbx
shr rax, 0x21
xor rbx, rax
mov eax, dword [r14 + 0x3c]
mov rcx, rbx
shr rbx, 5
and rbx, qword [r14 + 0x28]
and ecx, 0x1f
shrx rdi, rcx, rax
add edi, edx
movzx eax, byte [rbx + rbp]
cmp edi, eax
jae 0x1401bb78e
nop
movzx eax, byte [rbx + rbp + 1]
inc rbx
add edi, edx
cmp edi, eax
jb 0x1401bb780
movzx eax, byte [rbx + rbp]
cmp edi, eax
jne 0x1401bb804
mov r15, qword [r8]
mov rsi, rbx
shl rsi, 4
add rsi, qword [r14 + 0x10]
movzx r12d, word [r15]
nop dword [rax + rax]
mov rcx, qword [rsi]
cmp r12w, word [rcx]
jne 0x1401bb7f0
mov eax, dword [rcx + 2]
cmp dword [r15 + 2], eax
jne 0x1401bb7f0
mov eax, dword [rcx + 6]
mov r8, r12
movzx edx, word [rcx + 0xa]
movzx ecx, word [r15 + 0xa]
shl rdx, 0x20
or rdx, rax
shl rcx, 0x20
mov eax, dword [r15 + 6]
or rcx, rax
shl r8, 3
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
je 0x1401bb830
movzx eax, byte [rbx + rbp + 1]
inc rbx
add edi, dword [r14 + 0x38]
add rsi, 0x10
cmp edi, eax
je 0x1401bb7b0
mov rax, qword [r14 + 0x30]
cmp qword [r14 + 0x20], rax
jb 0x1401bb850
mov rcx, r14
call fcn.1401c0af0
test al, al
je 0x1401bb841
inc r13d
cmp r13d, 0x100
jge 0x1401bb841
mov r8, qword [rsp + 0x70]
jmp 0x1401bb740
mov rax, qword [rsp + 0x68]
mov qword [rax], rbx
mov dword [rax + 8], 1
jmp 0x1401bb8b2
mov rax, qword [rsp + 0x68]
xor ecx, ecx
mov qword [rax], rcx
mov dword [rax + 8], ecx
jmp 0x1401bb8b2
mov ecx, dword [r14 + 0x38]
mov r11, rbx
add ecx, edi
cmp ecx, 0xff
jbe 0x1401bb867
xor ecx, ecx
mov qword [r14 + 0x30], rcx
cmp byte [rbx + rbp], 0
je 0x1401bb88c
nop dword [rax]
inc rbx
cmp byte [rbx + rbp], 0
jne 0x1401bb870
cmp rbx, r11
je 0x1401bb88c
mov r8, r11
mov rdx, rbx
mov rcx, r14
call fcn.140059150
mov rax, qword [r14 + 0x18]
mov esi, 0
mov byte [r11 + rax], dil
inc qword [r14 + 0x20]
mov rax, qword [rsp + 0x68]
cmp rbx, r11
setne sil
add esi, 2
mov dword [rax + 8], esi
mov qword [rax], r11
mov rbx, qword [rsp + 0x60]
add rsp, 0x20
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x1401bb8d0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x20], rsi
mov qword [rsp + 0x18], r8
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x20
xor r13d, r13d
mov rax, r8
mov r15d, r13d
mov r12, rdx
mov rbp, rcx
mov r14, qword [rax]
mov rdx, r14
call fcn.140176c00
mov rsi, qword [rbp + 0x18]
mov r11, rax
imul r11, qword [rbp + 8]
mov r8d, dword [rbp + 0x38]
mov rcx, r11
shr rcx, 0x21
xor r11, rcx
mov ecx, dword [rbp + 0x3c]
mov rdx, r11
shr r11, 5
and r11, qword [rbp + 0x28]
and edx, 0x1f
shrx rbx, rdx, rcx
add ebx, r8d
movzx eax, byte [rsi + r11]
cmp ebx, eax
jae 0x1401bb960
nop word [rax + rax]
movzx eax, byte [rsi + r11 + 1]
inc r11
add ebx, r8d
cmp ebx, eax
jb 0x1401bb950
movzx eax, byte [rsi + r11]
cmp ebx, eax
jne 0x1401bb9fc
movzx r8d, byte [r14 + 6]
mov rdi, r11
shl rdi, 4
add rdi, qword [rbp + 0x10]
nop dword [rax]
mov rcx, qword [rdi]
cmp r8b, byte [rcx + 6]
jne 0x1401bb9e8
xor al, al
test r8b, r8b
je 0x1401bb9d6
movzx r9d, word [rcx + 4]
mov ecx, dword [rcx]
movzx r10d, word [r14 + 4]
shl r9, 0x20
or r9, rcx
shl r10, 0x20
mov ecx, dword [r14]
or r10, rcx
nop dword [rax]
movzx ecx, al
lea rdx, [rcx + rcx*8]
mov rcx, qword [r10 + rdx*2]
cmp rcx, qword [r9 + rdx*2]
jne 0x1401bb9e8
movzx ecx, word [r10 + rdx*2 + 8]
cmp cx, word [r9 + rdx*2 + 8]
jne 0x1401bb9e8
inc al
cmp al, r8b
jb 0x1401bb9b0
mov qword [r12], r11
mov dword [r12 + 8], 1
jmp 0x1401bba8b
movzx eax, byte [rsi + r11 + 1]
inc r11
add ebx, dword [rbp + 0x38]
add rdi, 0x10
cmp ebx, eax
je 0x1401bb980
mov rax, qword [rbp + 0x30]
cmp qword [rbp + 0x20], rax
jb 0x1401bba2e
mov rcx, rbp
call fcn.1401c0890
test al, al
je 0x1401bba28
inc r15d
cmp r15d, 0x100
jge 0x1401bba28
mov rax, qword [rsp + 0x60]
jmp 0x1401bb900
mov qword [r12], r13
jmp 0x1401bba86
mov ecx, dword [rbp + 0x38]
mov rdi, r11
add ecx, ebx
cmp ecx, 0xff
jbe 0x1401bba42
mov qword [rbp + 0x30], r13
cmp byte [rsi + r11], r13b
je 0x1401bba6c
nop dword [rax + rax]
inc r11
cmp byte [rsi + r11], r13b
jne 0x1401bba50
cmp r11, rdi
je 0x1401bba6c
mov r8, rdi
mov rdx, r11
mov rcx, rbp
call fcn.140059150
mov rax, qword [rbp + 0x18]
mov qword [r12], rdi
mov byte [rdi + rax], bl
inc qword [rbp + 0x20]
cmp r11, rdi
setne r13b
add r13d, 2
mov dword [r12 + 8], r13d
mov rbx, qword [rsp + 0x50]
mov rax, r12
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x68]
add rsp, 0x20
pop r15
pop r14
pop r13
pop r12
pop rdi
ret