joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140020104
Capabilities:
Encode data using xor

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r14
xor esi, esi
xor edi, edi
mov r11, r8
mov rbx, rcx
test r8, r8
je 0x140020193
lea r14, [rdx - 8]
sub rbx, rdx
lea r14, [r14 + r8*8]
mov r9, qword [r14]
mov r10, qword [r14 + rbx]
mov r8, r9
xor r8, r10
lea r14, [r14 - 8]
mov rax, r10
mov rcx, r9
sub rcx, r10
shr rax, 0x3f
shr rcx, 0x3f
sub r10, r9
shr r10, 0x3f
mov rdx, r8
shr r8, 0x3f
not rdx
shr rdx, 0x3f
and eax, r8d
and ecx, edx
shr r9, 0x3f
or ecx, eax
and r10d, edx
or esi, ecx
and r9d, r8d
or r10d, r9d
mov ecx, 1
sub ecx, esi
or esi, r10d
and ecx, r10d
or edi, ecx
sub r11, 1
jne 0x140020131
mov rbx, qword [rsp + 8]
mov eax, edi
mov rdi, qword [rsp + 0x18]
mov rsi, qword [rsp + 0x10]
mov r14, qword [rsp + 0x20]
ret

Function at 0x1400201ac
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], r8
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x20
mov r10, r9
lea rdi, [rdx - 0xb]
xor ebp, ebp
mov r12, r9
xor bl, bl
mov r11, rcx
cmp r9, rdi
mov r15, r8
movzx r9d, byte [rcx + 1]
mov rsi, rdx
cmova r10, rdi
lea ecx, [rbp + 2]
movzx eax, byte [r11]
xor r9d, ecx
or r9d, eax
cmp rcx, rdx
jae 0x140020225
mov al, byte [r11 + rcx]
neg al
or al, byte [r11 + rcx]
inc rcx
not al
shr al, 7
or bl, al
mov al, bl
neg al
or al, bl
not al
movzx eax, al
shr rax, 7
add rbp, rax
cmp rcx, rsi
jb 0x1400201fa
lea rax, [rbp - 8]
movzx ecx, bl
neg ecx
shr rax, 0x3f
shr ecx, 0x1f
mov r14d, esi
sub r14d, ebp
dec ecx
and ecx, 1
sub r14d, 3
or ecx, eax
or r9d, ecx
mov rcx, r10
mov r8d, r9d
neg r8d
shr r8d, 0x1f
neg r8d
mov edx, r8d
mov eax, r8d
not edx
and eax, r10d
and r14d, edx
and r8d, 0x4100
or r14d, eax
sub rcx, r14
shr rcx, 0x3f
mov ebx, ecx
or ecx, r9d
neg ecx
neg ebx
shr ebx, 0x1f
shr ecx, 0x1f
mov ebp, ebx
neg ebp
neg ecx
and ebp, edx
and ebp, 0x4400
or ebp, r8d
neg ebp
mov dword [rsp + 0x60], ebp
cmp rsi, 0xb
jbe 0x1400202b5
not cl
lea rax, [r11 + 0xb]
and byte [rax], cl
inc rax
sub rdi, 1
jne 0x1400202aa
neg ebx
mov eax, r10d
mov ecx, ebx
sub r11, r10
not ebx
and rcx, rax
and rbx, r14
or rbx, rcx
lea rdi, [r11 + rsi]
test r10, r10
je 0x140020344
xor r11d, r11d
test r10, r10
je 0x140020344
lea r15, [r10 - 1]
mov r9, r11
sub r9, rbx
shr r9, 0x3f
neg r9d
shr r9d, 0x1f
test r15, r15
je 0x140020322
mov esi, r9d
mov r14, rdi
neg esi
mov r13, r15
mov ebp, esi
not ebp
mov dl, byte [r14]
mov al, bpl
mov cl, byte [r14 + 1]
and dl, sil
and al, cl
or dl, al
mov byte [r14], dl
lea r14, [r14 + 1]
sub r13, 1
jne 0x140020304
movzx eax, byte [rdi + r10 - 1]
neg r9b
and r9b, al
inc r11
mov byte [rdi + r10 - 1], r9b
cmp r11, r10
jb 0x1400202df
mov ebp, dword [rsp + 0x60]
mov r15, qword [rsp + 0x70]
test r12, r12
je 0x140020357
mov r8, r10
mov rdx, rdi
mov rcx, r15
call fcn.140150d9b
mov rcx, qword [rsp + 0x80]
mov eax, ebp
mov qword [rcx], rbx
mov rbx, qword [rsp + 0x68]
add rsp, 0x20
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x1400204ce
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x250]
sub rsp, 0x350
mov rax, qword [0x140250040]
xor rax, rsp
mov qword [rbp + 0x240], rax
mov rdi, r8
mov rbx, rdx
mov r15, rcx
cmp r8, 0x180
jbe 0x14002042c
mov eax, 0xffffffc8
jmp 0x1400205e7
xor edx, edx
lea rcx, [rbp + 0xa0]
mov r8d, 0x1a0
call fcn.140150b0c
xor edx, edx
lea rcx, [rsp + 0x20]
mov r8d, 0x120
call fcn.140150b0c
mov eax, edi
mov byte [rbp + 0xb7], 0x30
bswap eax
mov r8, rdi
mov dword [rbp + 0xb0], eax
mov rdx, rbx
lea rcx, [rbp + 0xb8]
call fcn.140150d9b
xor eax, eax
mov byte [rbp + rdi + 0xb8], pe_nt_image_headers64
lea rcx, [rbp + 0x80]
lea r12, [rdi + 0x19]
mov byte [rcx], al
inc eax
inc rcx
cmp eax, 0x20
jl 0x14002048a
mov r8d, 0x100
lea rdx, [rbp + 0x80]
lea rcx, [rsp + 0x20]
call fcn.140015b04
mov edx, eax
mov r13d, 0x10
test eax, eax
jne 0x14002059b
mov r14b, byte [rbp + 0xa3]
xor edi, edi
xorps xmm0, xmm0
mov rsi, r12
movups xmmword [rbp + 0x40], xmm0
test r12, r12
je 0x14002052f
lea rbx, [rbp + 0xa0]
lea rax, [rbp + 0x40]
sub rbx, rax
xor edx, edx
lea rcx, [rbp + 0x40]
add rcx, rdx
inc rdx
mov al, byte [rbx + rcx]
xor byte [rcx], al
cmp rdx, r13
jb 0x1400204e5
mov rax, rsi
lea r9, [rbp + 0x40]
add rbx, r13
lea r8, [rbp + 0x40]
cmp rsi, r13
lea rcx, [rsp + 0x20]
mov edx, 1
cmovae rax, r13
sub rsi, rax
call fcn.140016ba0
mov edx, eax
test eax, eax
jne 0x14002059b
test rsi, rsi
jne 0x1400204e3
movups xmm0, xmmword [rbp + 0x40]
inc r14b
movdqu xmmword [rbp + rdi + 0x50], xmm0
add rdi, r13
mov byte [rbp + 0xa3], r14b
cmp rdi, 0x30
jl 0x1400204c6
mov r8d, 0x100
lea rdx, [rbp + 0x50]
lea rcx, [rsp + 0x20]
call fcn.140015b04
mov edx, eax
test eax, eax
jne 0x14002059b
mov rdi, r15
xor ebx, ebx
lea r9, [rbp + 0x70]
mov edx, 1
lea r8, [rbp + 0x70]
lea rcx, [rsp + 0x20]
call fcn.140016ba0
mov edx, eax
test eax, eax
jne 0x14002059b
movups xmm0, xmmword [rbp + 0x70]
add ebx, r13d
movdqu xmmword [rdi], xmm0
add rdi, r13
cmp ebx, 0x30
jl 0x14002056b
xor eax, eax
lea rdi, [rsp + 0x20]
mov ecx, 0x120
rep stosb byte [rdi], al
lea rdi, [rbp + 0xa0]
mov ecx, 0x1a0
lea r8d, [rax + 0x30]
rep stosb byte [rdi], al
lea rdi, [rbp + 0x50]
mov ecx, r8d
rep stosb byte [rdi], al
lea rdi, [rbp + 0x80]
lea ecx, [rax + 0x20]
rep stosb byte [rdi], al
lea rdi, [rbp + 0x40]
mov rcx, r13
rep stosb byte [rdi], al
test edx, edx
je 0x1400205e5
mov rdi, r15
mov ecx, r8d
rep stosb byte [rdi], al
mov eax, edx
mov rcx, qword [rbp + 0x240]
xor rcx, rsp
call fcn.14014f050
mov rbx, qword [rsp + 0x3a8]
add rsp, 0x350
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x140020614
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r14
sub rsp, 0x60
mov rax, qword [0x140250040]
xor rax, rsp
mov qword [rsp + 0x50], rax
xorps xmm0, xmm0
lea rsi, [rsp + 0x20]
movups xmmword [rsp + 0x20], xmm0
mov rbp, rdx
mov rdi, rcx
movups xmmword [rsp + 0x30], xmm0
xor ebx, ebx
movups xmmword [rsp + 0x40], xmm0
mov eax, 0x10
add byte [rdi + rax - 1], 1
jne 0x140020668
dec rax
test rax, rax
jg 0x140020659
mov r9, rsi
lea rcx, [rdi + 0x28]
mov r8, rdi
mov edx, 1
call fcn.140016ba0
mov edx, eax
test eax, eax
jne 0x1400206dd
add rsi, 0x10
add ebx, 0x10
cmp ebx, 0x30
jl 0x140020654
xor edx, edx
lea rax, [rsp + 0x20]
sub rbp, rax
lea rax, [rsp + 0x20]
add rax, rdx
add rdx, 0x10
movdqu xmm0, xmmword [rax]
movdqu xmm1, xmmword [rax + rbp]
xorps xmm1, xmm0
movdqu xmmword [rax], xmm1
cmp rdx, 0x30
jl 0x140020698
mov r8d, 0x100
lea rdx, [rsp + 0x20]
lea rcx, [rdi + 0x28]
call fcn.140015b04
mov edx, eax
test eax, eax
jne 0x1400206dd
movups xmm0, xmmword [rsp + 0x40]
movdqu xmmword [rdi], xmm0
xor eax, eax
lea rdi, [rsp + 0x20]
lea ecx, [rax + 0x30]
rep stosb byte [rdi], al
mov eax, edx
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.14014f050
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x28]
mov rbp, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret
Function at 0x140021ad8
Capabilities:
Encode data using xor
Encrypt data using des

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov r10d, dword [rdx]
mov ebp, 0xf0f0f0f
mov r9d, dword [rdx + 4]
mov rdi, rcx
bswap r10d
mov eax, r10d
mov rbx, r8
shr eax, 4
mov esi, 8
bswap r9d
xor eax, r9d
and eax, ebp
lea rbp, sym.MZ_KYX__nCiq_dRpf_LPp:j::J6hH:2AMD_t54D_hAaa
xor r9d, eax
shl eax, 4
xor r10d, eax
mov eax, r10d
shr eax, 0x10
xor eax, r9d
movzx ecx, ax
xor r9d, ecx
shl ecx, 0x10
xor r10d, ecx
mov eax, r9d
shr eax, 2
xor eax, r10d
and eax, 0x33333333
xor r10d, eax
shl eax, 2
xor r9d, eax
mov eax, r9d
shr eax, 8
xor eax, r10d
and eax, 0xff00ff
xor r10d, eax
shl eax, 8
xor r9d, eax
mov r11d, r9d
shr r11d, 0x1f
lea eax, [r9 + r9]
or r11d, eax
mov eax, r11d
xor eax, r10d
and eax, 0xaaaaaaaa
xor r11d, eax
xor r10d, eax
ror r10d, 0x1f
mov r9d, r11d
mov eax, r11d
xor r9d, dword [rdi]
lea rdi, [rdi + 0x10]
ror eax, 4
xor eax, dword [rdi - 0xc]
mov r8d, eax
mov ecx, eax
shr rax, 0x10
and eax, 0x3f
shr rcx, 0x18
and ecx, 0x3f
mov edx, dword [rbp + rcx*4 + 0x182f30]
xor edx, dword [rbp + rax*4 + 0x183680]
mov eax, r8d
shr rax, 8
and r8d, 0x3f
and eax, 0x3f
xor edx, dword [rbp + rax*4 + 0x182e10]
mov eax, r9d
shr rax, 0x18
and eax, 0x3f
xor edx, dword [rbp + rax*4 + 0x183030]
mov eax, r9d
shr rax, 0x10
and eax, 0x3f
xor edx, dword [rbp + rax*4 + 0x183580]
mov eax, r9d
shr rax, 8
and r9d, 0x3f
and eax, 0x3f
xor edx, dword [rbp + rax*4 + 0x183260]
xor edx, dword [rbp + r8*4 + 0x183480]
xor edx, dword [rbp + r9*4 + 0x183360]
xor r10d, edx
mov r9d, r10d
mov eax, r10d
xor r9d, dword [rdi - 8]
ror eax, 4
xor eax, dword [rdi - 4]
mov r8d, eax
mov ecx, eax
shr rax, 0x10
and eax, 0x3f
shr rcx, 0x18
and ecx, 0x3f
mov edx, dword [rbp + rcx*4 + 0x182f30]
xor edx, dword [rbp + rax*4 + 0x183680]
mov eax, r8d
shr rax, 8
and r8d, 0x3f
and eax, 0x3f
xor edx, dword [rbp + rax*4 + 0x182e10]
mov eax, r9d
shr rax, 0x18
and eax, 0x3f
xor edx, dword [rbp + rax*4 + 0x183030]
mov eax, r9d
shr rax, 0x10
and eax, 0x3f
xor edx, dword [rbp + rax*4 + 0x183580]
mov eax, r9d
shr rax, 8
and r9d, 0x3f
and eax, 0x3f
xor edx, dword [rbp + rax*4 + 0x183260]
xor edx, dword [rbp + r8*4 + 0x183480]
xor edx, dword [rbp + r9*4 + 0x183360]
xor r11d, edx
sub rsi, 1
jne 0x140021b89
mov rsi, qword [rsp + 0x18]
mov r8d, r11d
mov rdi, qword [rsp + 0x20]
mov ebp, 0xf0f0f0f
shl r8d, 0x1f
shr r11d, 1
or r8d, r11d
mov eax, r8d
xor eax, r10d
and eax, 0xaaaaaaaa
xor r8d, eax
xor r10d, eax
mov edx, r10d
shr r10d, 1
shl edx, 0x1f
or edx, r10d
mov eax, edx
shr eax, 8
xor eax, r8d
and eax, 0xff00ff
xor r8d, eax
shl eax, 8
xor edx, eax
mov eax, edx
shr eax, 2
xor eax, r8d
and eax, 0x33333333
xor r8d, eax
shl eax, 2
xor edx, eax
mov eax, r8d
shr eax, 0x10
xor eax, edx
movzx ecx, ax
xor edx, ecx
shl ecx, 0x10
xor r8d, ecx
mov eax, r8d
shr eax, 4
xor eax, edx
and eax, ebp
mov rbp, qword [rsp + 0x10]
xor edx, eax
shl eax, 4
xor r8d, eax
xor eax, eax
bswap r8d
bswap edx
mov dword [rbx], r8d
mov dword [rbx + 4], edx
mov rbx, qword [rsp + 8]
ret
Function at 0x140029398
Capabilities:
Encode data using xor

Disassembly:
mov r11, rsp
mov qword [r11 + 0x10], rbx
mov qword [r11 + 0x18], rsi
push rdi
sub rsp, 0x50
mov rax, qword [0x140250040]
xor rax, rsp
mov qword [rsp + 0x48], rax
and qword [r11 - 0x28], 0
lea rax, [r11 - 0x28]
xorps xmm0, xmm0
mov qword [r11 - 0x38], rax
lea r9, [r11 - 0x20]
mov r8d, 0x10
lea rdx, [r11 - 0x20]
mov rbx, rcx
movups xmmword [rsp + 0x38], xmm0
call fcn.14001e7c0
test eax, eax
jne 0x1400294e4
mov edi, dword [rsp + 0x38]
lea r11d, [rax + 2]
mov ecx, dword [rsp + 0x3c]
mov esi, dword [rsp + 0x40]
bswap ecx
mov ecx, ecx
bswap edi
bswap esi
mov edi, edi
mov esi, esi
shl rdi, 0x20
or rdi, rcx
shl rsi, 0x20
mov ecx, dword [rsp + 0x44]
bswap ecx
mov ecx, ecx
or rsi, rcx
mov qword [rbx + 0x120], rdi
mov ecx, r11d
mov qword [rbx + 0xa0], rsi
call fcn.1400172e0
test eax, eax
jne 0x1400294e2
and qword [rbx + 0xe0], 0
and qword [rbx + 0x60], 0
mov r8d, 4
mov eax, esi
mov rcx, rdi
and eax, 1
shl rcx, 0x3f
imul edx, eax, 0xe1000000
mov rax, rsi
shr rax, 1
mov rsi, rcx
or rsi, rax
mov rax, rdi
shr rax, 1
mov qword [rbx + r8*8 + 0x60], rsi
mov ecx, edx
shl rcx, 0x20
mov rdi, rcx
xor rdi, rax
mov qword [rbx + r8*8 + 0xe0], rdi
shr r8d, 1
jne 0x14002944d
mov rcx, r11
mov r9, qword [rbx + rcx*8 + 0xe0]
mov r10, qword [rbx + rcx*8 + 0x60]
cmp rcx, 1
jle 0x1400294d3
lea rdx, [rbx + 0x68]
lea r8, [rcx - 1]
mov rax, r9
xor rax, qword [rdx + 0x80]
mov qword [rdx + rcx*8 + 0x80], rax
mov rax, r10
xor rax, qword [rdx]
mov qword [rdx + rcx*8], rax
lea rdx, [rdx + 8]
sub r8, 1
jne 0x1400294ad
lea eax, [r11 + r11]
add rcx, rcx
mov r11d, eax
cmp eax, 8
jle 0x140029492
xor eax, eax
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.14014f050
mov rbx, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
add rsp, 0x50
pop rdi
ret
Function at 0x14002971c
Capabilities:
Encode data using xor

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
push rdi
push r12
push r14
sub rsp, 0x40
and qword [rax + 0x20], 0
mov rdi, rcx
lea rax, [r9 - 1]
movabs rcx, 0x1ffffffffffffffe
mov rsi, r9
mov r14, r8
cmp rax, rcx
ja 0x140029853
xorps xmm0, xmm0
lea rbx, [rdi + 0x180]
movups xmmword [rbx], xmm0
mov r12d, 0x10
movups xmmword [rdi + 0x190], xmm0
and qword [rdi + 0x160], 0
and qword [rdi + 0x168], 0
mov dword [rdi + 0x1a0], edx
cmp r9, 0xc
jne 0x1400297ab
movsd xmm0, qword [r8]
movsd qword [rbx], xmm0
mov eax, dword [r8 + 8]
mov dword [rbx + 8], eax
mov byte [rdi + 0x18f], 1
jmp 0x140029832
and qword [rsp + 0x30], 0
lea rax, [r9*8]
bswap rax
mov qword [rsp + 0x38], rax
cmp rsi, r12
mov rbp, r12
cmovb rbp, rsi
test rbp, rbp
je 0x1400297ee
mov rdx, r14
mov rcx, rbx
sub rdx, rdi
mov r8, rbp
mov al, byte [rdx + rcx - 0x180]
xor byte [rcx], al
inc rcx
sub r8, 1
jne 0x1400297dc
mov r8, rbx
mov rdx, rbx
mov rcx, rdi
call fcn.1400295a0
add r14, rbp
sub rsi, rbp
jne 0x1400297c1
lea rdx, [rsp + 0x30]
mov rcx, rbx
sub rdx, rdi
mov r9, r12
mov al, byte [rdx + rcx - 0x180]
xor byte [rcx], al
inc rcx
sub r9, 1
jne 0x140029812
mov r8, rbx
mov rdx, rbx
mov rcx, rdi
call fcn.1400295a0
lea rax, [rsp + 0x78]
mov r8, r12
lea r9, [rdi + 0x170]
mov qword [rsp + 0x20], rax
mov rdx, rbx
mov rcx, rdi
call fcn.14001e7c0
jmp 0x140029858
mov eax, 0xffffffec
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
add rsp, 0x40
pop r14
pop r12
pop rdi
ret

Function at 0x140029874
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x20
movabs rax, 0x2000000000000000
mov rbx, r8
mov rbp, rdx
mov rdi, rcx
cmp r8, rax
jb 0x1400298ae
mov eax, 0xffffffec
jmp 0x1400299b3
mov rax, qword [rcx + 0x168]
mov rcx, rax
and ecx, 0xf
je 0x140029926
mov esi, 0x10
sub rsi, rcx
cmp rsi, rbx
cmova rsi, rbx
test rsi, rsi
je 0x1400298fa
lea rdx, [rdi + 0x190]
mov r8, rbp
add rdx, rcx
sub r8, rcx
sub r8, rdi
mov r9, rsi
mov al, byte [r8 + rdx - 0x190]
xor byte [rdx], al
inc rdx
sub r9, 1
jne 0x1400298e7
lea rax, [rsi + rcx]
cmp rax, 0x10
jne 0x140029916
lea rdx, [rdi + 0x190]
mov rcx, rdi
mov r8, rdx
call fcn.1400295a0
mov rax, qword [rdi + 0x168]
sub rbx, rsi
add rbp, rsi
add rax, rsi
add rax, rbx
mov qword [rdi + 0x168], rax
cmp rbx, 0x10
jb 0x140029990
mov r14, rbx
lea r15, [rdi + 0x190]
shr r14, 4
mov rsi, rbp
imul rax, r14, 0xfffffffffffffff0
sub rsi, rdi
add rbx, rax
sub rsi, 0x190
mov rax, r14
shl rax, 4
add rbp, rax
mov rcx, r15
mov edx, 0x10
mov al, byte [rsi + rcx]
xor byte [rcx], al
inc rcx
sub rdx, 1
jne 0x14002996a
mov r8, r15
mov rdx, r15
mov rcx, rdi
call fcn.1400295a0
add rsi, 0x10
sub r14, 1
jne 0x140029962
test rbx, rbx
je 0x1400299b1
lea rcx, [rdi + 0x190]
sub rbp, rdi
mov al, byte [rcx + rbp - 0x190]
xor byte [rcx], al
inc rcx
sub rbx, 1
jne 0x14002999f
xor eax, eax
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop rdi
ret
Function at 0x1400299cc
Capabilities:
Encode data using xor

Disassembly:
mov r11, rsp
mov qword [r11 + 0x20], rbx
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x40
mov rax, qword [0x140250040]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov rbp, qword [rsp + 0x98]
lea rax, [r11 - 0x38]
and qword [r11 - 0x38], 0
mov r15, rdx
mov rbx, r9
mov qword [r11 - 0x48], rax
mov r14, r8
lea rdx, [rcx + 0x180]
mov r9, r15
mov r8d, 0x10
mov rsi, rcx
call fcn.14001e7c0
mov edx, eax
test eax, eax
je 0x140029a3a
xor eax, eax
mov rdi, r15
lea ecx, [rax + 0x10]
rep stosb byte [rdi], al
mov eax, edx
jmp 0x140029ad4
cmp dword [rsi + 0x1a0], 0
mov rcx, qword [rsp + 0x90]
jne 0x140029a7a
test rbx, rbx
je 0x140029aa2
lea rdx, [rsi + 0x190]
mov rdi, rcx
add rdx, r14
sub rdi, r14
sub rdi, rsi
mov r8, rbx
mov al, byte [rdi + rdx - 0x190]
xor byte [rdx], al
inc rdx
sub r8, 1
jne 0x140029a66
jmp 0x140029a7f
test rbx, rbx
je 0x140029aa2
mov rdx, r14
mov rdi, rbp
sub rdx, rcx
mov r8, rbx
add rdx, r15
sub rdi, rcx
mov al, byte [rcx + rdx]
xor al, byte [rcx]
mov byte [rdi + rcx], al
inc rcx
sub r8, 1
jne 0x140029a91
cmp dword [rsi + 0x1a0], 1
jne 0x140029ad2
test rbx, rbx
je 0x140029ad2
lea rcx, [rsi + 0x190]
sub rbp, r14
add rcx, r14
sub rbp, rsi
mov al, byte [rcx + rbp - 0x190]
xor byte [rcx], al
inc rcx
sub rbx, 1
jne 0x140029ac0
xor eax, eax
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.14014f050
mov rbx, qword [rsp + 0x88]
add rsp, 0x40
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret

Function at 0x140029ef4
Capabilities:
Encode data using xor

Disassembly:
mov r11, rsp
push rbx
push rsi
push rdi
sub rsp, 0x80
mov rax, qword [0x140250040]
xor rax, rsp
mov qword [rsp + 0x70], rax
mov rax, qword [rsp + 0xe0]
lea rdi, [r11 - 0x38]
mov rsi, qword [rsp + 0xe8]
mov rbx, rdx
mov rdx, qword [rsp + 0xc0]
mov qword [r11 - 0x48], rdi
mov rdi, qword [rsp + 0xd8]
mov qword [r11 - 0x50], rdi
mov qword [r11 - 0x58], rsi
mov qword [r11 - 0x60], rax
mov rax, qword [rsp + 0xc8]
mov qword [r11 - 0x68], rax
mov qword [r11 - 0x70], rdx
xor edx, edx
mov qword [r11 - 0x78], r9
mov r9, r8
mov r8, rbx
call fcn.140029e54
test eax, eax
jne 0x140029fc1
xor r9d, r9d
xor r8d, r8d
test rdi, rdi
je 0x140029fbf
mov r10, qword [rsp + 0xd0]
lea rax, [rsp + 0x60]
sub r10, rax
lea rax, [rsp + 0x60]
add rax, r8
inc r8
movzx edx, byte [rax + r10]
movzx eax, byte [rax]
xor edx, eax
or r9d, edx
cmp r8, rdi
jb 0x140029f87
test r9d, r9d
je 0x140029fbf
test rbx, rbx
je 0x140029fb8
mov rdi, rsi
xor eax, eax
mov rcx, rbx
rep stosb byte [rdi], al
mov eax, 0xffffffee
jmp 0x140029fc1
xor eax, eax
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.14014f050
add rsp, 0x80
pop rdi
pop rsi
pop rbx
ret
Function at 0x14002a714
Capabilities:
Hash data using sha1
Hash data using sha224
Hash data using sha256
Hash data using sha512

Disassembly:
xor r8d, r8d
test rcx, rcx
je 0x14002a82a
mov rdx, qword [rcx]
test rdx, rdx
je 0x14002a82a
mov edx, dword [rdx + 8]
sub edx, 1
je 0x14002a803
sub edx, 1
je 0x14002a75a
sub edx, 1
je 0x14002a7be
sub edx, 1
je 0x14002a77c
sub edx, 1
je 0x14002a76e
sub edx, 1
je 0x14002a76a
cmp edx, 1
jne 0x14002a82a
mov rax, qword [rcx + 8]
mov dword [rax + 0x18], 0xc3d2e1f0
jmp 0x14002a807
xor edx, edx
jmp 0x14002a773
mov edx, 1
mov rcx, qword [rcx + 8]
jmp fcn.1400356fc
mov rax, qword [rcx + 8]
mov dword [rax + 8], 0x6a09e667
mov dword [rax + 0xc], 0xbb67ae85
mov dword [rax + 0x10], 0x3c6ef372
mov dword [rax + 0x14], 0xa54ff53a
mov dword [rax + 0x18], 0x510e527f
mov dword [rax + 0x1c], 0x9b05688c
mov dword [rax + 0x20], 0x1f83d9ab
mov dword [rax + 0x24], 0x5be0cd19
mov dword [rax + 0x68], r8d
jmp 0x14002a823
mov rax, qword [rcx + 8]
mov dword [rax + 8], 0xc1059ed8
mov dword [rax + 0xc], 0x367cd507
mov dword [rax + 0x10], 0x3070dd17
mov dword [rax + 0x14], 0xf70e5939
mov dword [rax + 0x18], 0xffc00b31
mov dword [rax + 0x1c], 0x68581511
mov dword [rax + 0x20], 0x64f98fa7
mov dword [rax + 0x24], 0xbefa4fa4
mov dword [rax + 0x68], 1
jmp 0x14002a823
mov rax, qword [rcx + 8]
mov dword [rax + 0x14], 0x10325476
mov dword [rax + 0x10], 0x98badcfe
mov dword [rax + 0xc], 0xefcdab89
mov dword [rax + 8], 0x67452301
mov qword [rax], r8
xor eax, eax
jmp 0x14002a82f
mov eax, 0xffffaf00
ret
Function at 0x14002bd0c
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x60
mov rax, qword [0x140250040]
xor rax, rsp
mov qword [rbp - 0x10], rax
mov r14, qword [rbp + 0x68]
lea rax, [r9 - 8]
mov r15, qword [rbp + 0x60]
mov rsi, r9
mov rdi, r8
and qword [r14], 0
cmp qword [rbp + 0x70], rax
jb 0x14002bf59
mov r13d, 1
test edx, edx
jne 0x14002bde0
lea rax, [r9 - 0x18]
movabs rdx, 0x1ffffffffffffe8
cmp rax, rdx
ja 0x14002bf59
test sil, 7
jne 0x14002bf59
shr rsi, 3
lea r9, [rbp - 0x28]
mov r8, rsi
mov qword [rsp + 0x28], r14
mov rdx, rdi
mov qword [rsp + 0x20], r15
call fcn.14002bba0
mov ebx, eax
test eax, eax
jne 0x14002bf27
xor eax, eax
lea r8, sym.MZ_KYX__nCiq_dRpf_LPp:j::J6hH:2AMD_t54D_hAaa
xor edi, edi
movzx ecx, byte [rax + r8 + 0x18f428]
movzx edx, byte [rbp + rax - 0x28]
add rax, r13
xor edx, ecx
or edi, edx
cmp rax, 8
jb 0x14002bdb2
test dil, dil
je 0x14002bf38
mov ebx, 0xffff9d00
jmp 0x14002bf27
cmp edx, r13d
jne 0x14002bf22
lea rax, [r9 - 0x10]
mov edx, 0xfffffff0
cmp rax, rdx
ja 0x14002bf59
test sil, 7
jne 0x14002bf59
mov r12d, 0x10
mov rdx, rdi
cmp rsi, r12
jne 0x14002be55
lea rax, [rbp - 0x28]
mov r8d, r12d
lea r9, [rbp - 0x20]
mov qword [rsp + 0x20], rax
call fcn.14001e7c0
mov ebx, eax
test eax, eax
jne 0x14002bf27
mov rax, qword [rbp - 0x20]
lea rdi, [rbp - 0x20]
mov qword [rbp - 0x28], rax
mov ecx, r12d
mov rax, qword [rbp - 0x18]
mov qword [r15], rax
xor eax, eax
rep stosb byte [rdi], al
mov qword [r14], 8
jmp 0x14002be79
mov r8, rsi
mov qword [rsp + 0x28], r14
shr r8, 3
lea r9, [rbp - 0x28]
mov qword [rsp + 0x20], r15
call fcn.14002bba0
mov ebx, eax
test eax, eax
jne 0x14002bf27
xor edx, edx
lea r8, sym.MZ_KYX__nCiq_dRpf_LPp:j::J6hH:2AMD_t54D_hAaa
xor r9d, r9d
movzx eax, byte [rdx + r8 + 0x18f3a0]
movzx ecx, byte [rbp + rdx - 0x28]
add rdx, r13
xor ecx, eax
or r9d, ecx
cmp rdx, 4
jb 0x14002be85
mov r12d, dword [rbp - 0x24]
test r9b, r9b
mov rdx, qword [r14]
mov edi, ebx
mov ebx, 0xffff9d00
cmovne edi, ebx
bswap r12d
mov eax, r12d
sub rsi, rax
lea rax, [rsi - 8]
cmp rax, 7
mov r9, rax
cmova edi, ebx
and r9d, 7
cmp rax, 7
cmovbe r9, rax
xor ecx, ecx
xor r8b, r8b
add rdx, 0xfffffffffffffff8
lea r10d, [rcx + 8]
sub r10, r9
add rdx, r15
cmp rcx, r10
jb 0x14002bef3
or r8b, byte [rdx]
add rcx, r13
add rdx, r13
cmp rcx, 8
jb 0x14002beeb
test r8b, r8b
jne 0x14002bf27
mov ebx, edi
test edi, edi
jne 0x14002bf27
mov ecx, r12d
mov r8, r9
add rcx, r15
xor edx, edx
call fcn.140150b0c
mov eax, r12d
mov qword [r14], rax
jmp 0x14002bf38
mov ebx, 0xffff9f80
mov r8, qword [r14]
xor edx, edx
mov rcx, r15
call fcn.140150b0c
and qword [r14], 0
xor eax, eax
lea rdi, [rbp - 0x30]
mov rcx, r13
rep stosb byte [rdi], al
lea rdi, [rbp - 0x2f]
mov rcx, r13
rep stosb byte [rdi], al
lea ecx, [rax + 8]
lea rdi, [rbp - 0x28]
rep stosb byte [rdi], al
mov eax, ebx
jmp 0x14002bf5e
mov eax, 0xffff9f00
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.14014f050
mov rbx, qword [rsp + 0xa8]
add rsp, 0x60
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x14002c00c
Capabilities:
Encrypt data using openssl rsa

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rdi, rcx
lea rbx, [0x14018f890]
mov rcx, rbx
test rdi, rdi
je 0x14002c061
cmp qword [0x14018f890], 0
je 0x14002c061
mov rsi, qword [rdi + 8]
cmp qword [rcx + 8], rsi
jne 0x14002c054
mov rdx, qword [rdi + 0x10]
mov r8, rsi
mov rcx, qword [rcx]
call fcn.140150d95
test eax, eax
je 0x14002c073
add rbx, 0x28
mov rcx, rbx
cmp qword [rbx], 0
jne 0x14002c03b
xor eax, eax
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
mov rax, rbx
jmp 0x14002c063

Function at 0x14002d1a0
Capabilities:
Encrypt data using openssl rsa

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rsi
mov qword [r11 + 0x18], rdi
push r14
sub rsp, 0x40
mov r14, r8
xor eax, eax
xorps xmm0, xmm0
lea r8, [r11 - 0x28]
movups xmmword [r9], xmm0
mov qword [r9 + 0x10], rax
mov rdi, r9
call fcn.140018c80
test eax, eax
je 0x14002d1dc
add eax, 0xffffc580
jmp 0x14002d221
cmp qword [0x14018fe50], 0
lea rbx, [0x14018fe50]
mov rcx, rbx
je 0x14002d21c
mov rsi, qword [rsp + 0x28]
cmp qword [rcx + 8], rsi
jne 0x14002d20f
mov rdx, qword [rsp + 0x30]
mov r8, rsi
mov rcx, qword [rcx]
call fcn.140150d95
test eax, eax
je 0x14002d237
add rbx, 0x28
mov rcx, rbx
cmp qword [rbx], 0
jne 0x14002d1f5
mov eax, 0xffffc380
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
mov rdi, qword [rsp + 0x60]
add rsp, 0x40
pop r14
ret
test rbx, rbx
je 0x14002d21c
mov eax, dword [rbx + 0x20]
mov dword [r14], eax
cmp eax, 1
jne 0x14002d268
cmp dword [rdi], 5
je 0x14002d258
cmp dword [rdi], 0
je 0x14002d258
mov eax, 0xffffc580
jmp 0x14002d221
mov rax, qword [rdi + 8]
neg rax
sbb eax, eax
and eax, 0xffffc580
jmp 0x14002d221
xor eax, eax
jmp 0x14002d221