joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140072220
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
mov rax, qword [rcx]
mov rdi, rcx
mov ebx, edx
mov esi, r8d
movsxd rcx, dword [rax + 0x10]
mov ebp, dword [rdi + 0x10]
mov eax, ecx
sub ebx, dword [rdi + 0x14]
imul eax, edx
imul ebp, r9d
movsxd r10, eax
add r10, qword [rdi + 0x20]
sar ebp, 8
cmp ebp, 0xfe
jge 0x14007234e
mov qword [rsp + 0x20], r14
mov r14, rcx
nop dword [rax + rax]
mov rcx, qword [rdi + 8]
mov eax, ebx
movzx r11d, byte [r10 + 1]
cdq
mov r8d, 0x100
inc ebx
dec esi
idiv dword [rcx + 0x14]
mov eax, dword [rcx + 0x10]
imul eax, edx
movsxd rdx, eax
add rdx, qword [rdi + 0x28]
movzx ecx, byte [rdx + 1]
movzx r9d, byte [rdx + 2]
or ecx, 0xff0000
imul ecx, ebp
shl r9d, 0x10
shr ecx, 8
and ecx, 0xff00ff
mov eax, ecx
shr eax, 0x10
sub r8d, eax
movzx eax, byte [rdx]
or r9d, eax
imul r11d, r8d
movzx eax, byte [r10]
imul r9d, ebp
shr r11d, 8
add r11d, ecx
movzx ecx, byte [r10 + 2]
shl ecx, 0x10
or ecx, eax
shr r9d, 8
imul ecx, r8d
and r9d, 0xff00ff
shr ecx, 8
and ecx, 0xff00ff
add r9d, ecx
mov ecx, 0x100
mov eax, r9d
shr eax, 8
and eax, 0xff00ff
sub ecx, eax
mov eax, r11d
shr eax, 8
or ecx, r9d
neg al
and ecx, 0xff00ff
or al, r11b
mov byte [r10], cl
mov byte [r10 + 1], al
mov eax, ecx
shr eax, 0x10
mov byte [r10 + 2], al
add r10, r14
test esi, esi
jg 0x140072270
mov r14, qword [rsp + 0x20]
mov rbx, qword [rsp + 0x28]
mov rbp, qword [rsp + 0x30]
pop rdi
pop rsi
ret
mov r8, rcx
mov rcx, qword [rdi + 8]
mov eax, ebx
cdq
inc ebx
dec esi
idiv dword [rcx + 0x14]
mov eax, dword [rcx + 0x10]
imul eax, edx
movsxd rdx, eax
add rdx, qword [rdi + 0x28]
movzx eax, word [rdx]
movzx ecx, byte [rdx + 2]
mov byte [r10], al
mov word [rsp + 0x18], ax
movzx eax, byte [rsp + 0x19]
mov byte [r10 + 1], al
mov byte [r10 + 2], cl
add r10, r8
test esi, esi
jg 0x140072351
mov rbx, qword [rsp + 0x28]
mov rbp, qword [rsp + 0x30]
pop rdi
pop rsi
ret
Function at 0x140072bc0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov ebx, edx
mov edi, r8d
mov r8, qword [rcx]
mov r11, rcx
movsxd rdx, dword [r8 + 0x10]
mov eax, edx
imul eax, ebx
sub ebx, dword [rcx + 0x14]
movsxd r10, eax
add r10, qword [rcx + 0x20]
cmp dword [rcx + 0x10], 0xfe
jge 0x140072ce9
mov rsi, rdx
nop dword [rax]
mov rax, qword [r11 + 8]
mov edx, 0x100
dec edi
mov eax, dword [rax + 0x10]
imul eax, ebx
inc ebx
cdqe
add rax, qword [r11 + 0x28]
movzx ecx, byte [rax]
mov r9d, ecx
shl r9d, 0x10
or r9d, ecx
mov ecx, 0x100
imul r9d, dword [r11 + 0x10]
shr r9d, 8
and r9d, 0xff00ff
mov eax, r9d
shr eax, 0x10
sub ecx, eax
mov eax, dword [r10]
mov r8d, eax
shr eax, 8
and eax, 0xff00ff
and r8d, 0xff00ff
imul eax, ecx
imul r8d, ecx
mov ecx, 0x100
shr eax, 8
and eax, 0xff00ff
shr r8d, 8
and r8d, 0xff00ff
add r8d, r9d
add r9d, eax
mov eax, r9d
shr eax, 8
and eax, 0xff00ff
sub edx, eax
mov eax, r9d
shl eax, 8
shl edx, 8
or edx, eax
mov eax, r8d
shr eax, 8
and eax, 0xff00ff
sub ecx, eax
mov eax, r9d
or ecx, r8d
shr eax, 8
xor edx, ecx
shl r9d, 8
and eax, 0xff00ff
and edx, 0xff00ff
mov ecx, 0x100
sub ecx, eax
shl ecx, 8
or ecx, r9d
xor edx, ecx
mov dword [r10], edx
add r10, rsi
test edi, edi
jg 0x140072c00
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
mov r9, qword [rcx + 8]
movsxd rcx, dword [r9 + 0x10]
mov eax, ecx
imul eax, ebx
movsxd rbx, eax
add rbx, qword [r11 + 0x28]
cmp edx, ecx
jne 0x140072d30
cmp dword [r9 + 8], 1
jne 0x140072d30
cmp dword [r8 + 8], 1
jne 0x140072d30
imul ecx, edi
mov rdx, rbx
movsxd r8, ecx
mov rcx, r10
call fcn.1400c0020
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
mov r11, rdx
mov rsi, rcx
nop word [rax + rax]
movzx eax, byte [rbx]
mov ecx, 0x100
mov r9d, eax
mov edx, 0x100
shl r9d, 0x10
add rbx, rsi
or r9d, eax
dec edi
mov eax, r9d
shr eax, 0x10
sub ecx, eax
mov eax, dword [r10]
mov r8d, eax
shr eax, 8
and eax, 0xff00ff
and r8d, 0xff00ff
imul eax, ecx
imul r8d, ecx
mov ecx, 0x100
shr eax, 8
and eax, 0xff00ff
shr r8d, 8
and r8d, 0xff00ff
add r8d, r9d
add r9d, eax
mov eax, r9d
shr eax, 8
and eax, 0xff00ff
sub edx, eax
mov eax, r9d
shl eax, 8
shl edx, 8
or edx, eax
mov eax, r8d
shr eax, 8
and eax, 0xff00ff
sub ecx, eax
mov eax, r9d
or ecx, r8d
shr eax, 8
xor edx, ecx
shl r9d, 8
and eax, 0xff00ff
and edx, 0xff00ff
mov ecx, 0x100
sub ecx, eax
shl ecx, 8
or ecx, r9d
xor edx, ecx
mov dword [r10], edx
add r10, r11
test edi, edi
jg 0x140072d40
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x140072e10
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov rbp, qword [rcx]
mov esi, edx
mov r11d, dword [rcx + 0x10]
mov edi, r8d
imul r11d, r9d
mov rbx, rcx
movsxd rdx, dword [rbp + 0x10]
mov eax, edx
imul eax, esi
sub esi, dword [rcx + 0x14]
sar r11d, 8
movsxd r10, eax
add r10, qword [rcx + 0x20]
cmp r11d, 0xfe
jge 0x140072f3d
mov rbp, rdx
nop
mov rax, qword [rbx + 8]
mov edx, 0x100
dec edi
mov eax, dword [rax + 0x10]
imul eax, esi
inc esi
cdqe
add rax, qword [rbx + 0x28]
movzx ecx, byte [rax]
mov r9d, ecx
shl r9d, 0x10
or r9d, ecx
mov ecx, 0x100
imul r9d, r11d
shr r9d, 8
and r9d, 0xff00ff
mov eax, r9d
shr eax, 0x10
sub ecx, eax
mov eax, dword [r10]
mov r8d, eax
shr eax, 8
and eax, 0xff00ff
and r8d, 0xff00ff
imul eax, ecx
imul r8d, ecx
mov ecx, 0x100
shr eax, 8
and eax, 0xff00ff
shr r8d, 8
and r8d, 0xff00ff
add r8d, r9d
add r9d, eax
mov eax, r9d
shr eax, 8
and eax, 0xff00ff
sub edx, eax
mov eax, r9d
shl eax, 8
shl edx, 8
or edx, eax
mov eax, r8d
shr eax, 8
and eax, 0xff00ff
sub ecx, eax
mov eax, r9d
or ecx, r8d
shr eax, 8
xor edx, ecx
shl r9d, 8
and eax, 0xff00ff
and edx, 0xff00ff
mov ecx, 0x100
sub ecx, eax
shl ecx, 8
or ecx, r9d
xor edx, ecx
mov dword [r10], edx
add r10, rbp
test edi, edi
jg 0x140072e60
jmp 0x14007303b
mov r8, qword [rcx + 8]
movsxd rcx, dword [r8 + 0x10]
mov eax, ecx
imul eax, esi
movsxd r11, eax
add r11, qword [rbx + 0x28]
cmp edx, ecx
jne 0x140072f78
cmp dword [r8 + 8], 1
jne 0x140072f78
cmp dword [rbp + 8], 1
jne 0x140072f78
imul ecx, edi
mov rdx, r11
movsxd r8, ecx
mov rcx, r10
call fcn.1400c0020
jmp 0x14007303b
mov rbx, rdx
mov rsi, rcx
nop
movzx eax, byte [r11]
mov ecx, 0x100
mov r9d, eax
mov edx, 0x100
shl r9d, 0x10
add r11, rsi
or r9d, eax
dec edi
mov eax, r9d
shr eax, 0x10
sub ecx, eax
mov eax, dword [r10]
mov r8d, eax
shr eax, 8
and eax, 0xff00ff
and r8d, 0xff00ff
imul eax, ecx
imul r8d, ecx
mov ecx, 0x100
shr eax, 8
and eax, 0xff00ff
shr r8d, 8
and r8d, 0xff00ff
add r8d, r9d
add r9d, eax
mov eax, r9d
shr eax, 8
and eax, 0xff00ff
sub edx, eax
mov eax, r9d
shl eax, 8
shl edx, 8
or edx, eax
mov eax, r8d
shr eax, 8
and eax, 0xff00ff
sub ecx, eax
mov eax, r9d
or ecx, r8d
shr eax, 8
xor edx, ecx
shl r9d, 8
and eax, 0xff00ff
and edx, 0xff00ff
mov ecx, 0x100
sub ecx, eax
shl ecx, 8
or ecx, r9d
xor edx, ecx
mov dword [r10], edx
add r10, rbx
test edi, edi
jg 0x140072f80
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x140073050
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
mov rax, qword [rcx]
mov r10, rcx
mov r11d, edx
mov edi, r8d
movsxd rcx, dword [rax + 0x10]
sub r11d, dword [r10 + 0x14]
mov eax, ecx
imul eax, edx
mov rsi, rcx
movsxd rbx, eax
add rbx, qword [r10 + 0x20]
cmp dword [r10 + 0x10], 0xfe
jge 0x140073180
mov rcx, qword [r10 + 8]
mov eax, r11d
cdq
inc r11d
dec edi
idiv dword [rcx + 0x14]
mov eax, dword [rcx + 0x10]
imul eax, edx
mov edx, 0x100
movsxd rcx, eax
add rcx, qword [r10 + 0x28]
movzx eax, byte [rcx]
mov ecx, 0x100
mov r9d, eax
shl r9d, 0x10
or r9d, eax
imul r9d, dword [r10 + 0x10]
shr r9d, 8
and r9d, 0xff00ff
mov eax, r9d
shr eax, 0x10
sub ecx, eax
mov eax, dword [rbx]
mov r8d, eax
shr eax, 8
and eax, 0xff00ff
and r8d, 0xff00ff
imul eax, ecx
imul r8d, ecx
mov ecx, 0x100
shr eax, 8
and eax, 0xff00ff
shr r8d, 8
and r8d, 0xff00ff
add r8d, r9d
add r9d, eax
mov eax, r9d
shr eax, 8
and eax, 0xff00ff
sub edx, eax
mov eax, r9d
shl eax, 8
shl edx, 8
or edx, eax
mov eax, r8d
shr eax, 8
and eax, 0xff00ff
sub ecx, eax
mov eax, r9d
or ecx, r8d
shr eax, 8
xor edx, ecx
shl r9d, 8
and eax, 0xff00ff
and edx, 0xff00ff
mov ecx, 0x100
sub ecx, eax
shl ecx, 8
or ecx, r9d
xor edx, ecx
mov dword [rbx], edx
add rbx, rsi
test edi, edi
jg 0x140073090
mov rbx, qword [rsp + 8]
mov rsi, qword [rsp + 0x10]
mov rdi, qword [rsp + 0x18]
ret
mov rcx, qword [r10 + 8]
mov eax, r11d
cdq
inc r11d
dec edi
idiv dword [rcx + 0x14]
mov eax, dword [rcx + 0x10]
imul eax, edx
mov edx, 0x100
movsxd rcx, eax
add rcx, qword [r10 + 0x28]
movzx eax, byte [rcx]
mov ecx, 0x100
mov r9d, eax
shl r9d, 0x10
or r9d, eax
mov eax, r9d
shr eax, 0x10
sub ecx, eax
mov eax, dword [rbx]
mov r8d, eax
shr eax, 8
and eax, 0xff00ff
and r8d, 0xff00ff
imul eax, ecx
imul r8d, ecx
mov ecx, 0x100
shr eax, 8
and eax, 0xff00ff
shr r8d, 8
and r8d, 0xff00ff
add r8d, r9d
add r9d, eax
mov eax, r9d
shr eax, 8
and eax, 0xff00ff
sub edx, eax
mov eax, r9d
shl eax, 8
shl edx, 8
or edx, eax
mov eax, r8d
shr eax, 8
and eax, 0xff00ff
sub ecx, eax
mov eax, r9d
or ecx, r8d
shr eax, 8
xor edx, ecx
shl r9d, 8
and eax, 0xff00ff
and edx, 0xff00ff
mov ecx, 0x100
sub ecx, eax
shl ecx, 8
or ecx, r9d
xor edx, ecx
mov dword [rbx], edx
add rbx, rsi
test edi, edi
jg 0x140073180
mov rbx, qword [rsp + 8]
mov rsi, qword [rsp + 0x10]
mov rdi, qword [rsp + 0x18]
ret
Function at 0x140073260
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
mov rax, qword [rcx]
mov r11, rcx
mov r10d, edx
mov esi, r8d
movsxd rcx, dword [rax + 0x10]
mov edi, dword [r11 + 0x10]
mov eax, ecx
sub r10d, dword [r11 + 0x14]
imul eax, edx
imul edi, r9d
movsxd rbx, eax
add rbx, qword [r11 + 0x20]
sar edi, 8
cmp edi, 0xfe
jge 0x1400733a0
mov qword [rsp + 0x10], rbp
mov rbp, rcx
nop word [rax + rax]
mov rcx, qword [r11 + 8]
mov eax, r10d
cdq
inc r10d
dec esi
idiv dword [rcx + 0x14]
mov eax, dword [rcx + 0x10]
imul eax, edx
mov edx, 0x100
movsxd rcx, eax
add rcx, qword [r11 + 0x28]
movzx eax, byte [rcx]
mov ecx, 0x100
mov r9d, eax
shl r9d, 0x10
or r9d, eax
imul r9d, edi
shr r9d, 8
and r9d, 0xff00ff
mov eax, r9d
shr eax, 0x10
sub ecx, eax
mov eax, dword [rbx]
mov r8d, eax
shr eax, 8
and eax, 0xff00ff
and r8d, 0xff00ff
imul eax, ecx
imul r8d, ecx
mov ecx, 0x100
shr eax, 8
and eax, 0xff00ff
shr r8d, 8
and r8d, 0xff00ff
add r8d, r9d
add r9d, eax
mov eax, r9d
shr eax, 8
and eax, 0xff00ff
sub edx, eax
mov eax, r9d
shl eax, 8
shl edx, 8
or edx, eax
mov eax, r8d
shr eax, 8
and eax, 0xff00ff
sub ecx, eax
mov eax, r9d
or ecx, r8d
shr eax, 8
xor edx, ecx
shl r9d, 8
and eax, 0xff00ff
and edx, 0xff00ff
mov ecx, 0x100
sub ecx, eax
shl ecx, 8
or ecx, r9d
xor edx, ecx
mov dword [rbx], edx
add rbx, rbp
test esi, esi
jg 0x1400732b0
mov rbp, qword [rsp + 0x10]
mov rbx, qword [rsp + 0x18]
mov rsi, qword [rsp + 0x20]
pop rdi
ret
mov rdi, rcx
mov rcx, qword [r11 + 8]
mov eax, r10d
cdq
inc r10d
dec esi
idiv dword [rcx + 0x14]
mov eax, dword [rcx + 0x10]
imul eax, edx
mov edx, 0x100
movsxd rcx, eax
add rcx, qword [r11 + 0x28]
movzx eax, byte [rcx]
mov ecx, 0x100
mov r9d, eax
shl r9d, 0x10
or r9d, eax
mov eax, r9d
shr eax, 0x10
sub ecx, eax
mov eax, dword [rbx]
mov r8d, eax
shr eax, 8
and eax, 0xff00ff
and r8d, 0xff00ff
imul eax, ecx
imul r8d, ecx
mov ecx, 0x100
shr eax, 8
and eax, 0xff00ff
shr r8d, 8
and r8d, 0xff00ff
add r8d, r9d
add r9d, eax
mov eax, r9d
shr eax, 8
and eax, 0xff00ff
sub edx, eax
mov eax, r9d
shl eax, 8
shl edx, 8
or edx, eax
mov eax, r8d
shr eax, 8
and eax, 0xff00ff
sub ecx, eax
mov eax, r9d
or ecx, r8d
shr eax, 8
xor edx, ecx
shl r9d, 8
and eax, 0xff00ff
and edx, 0xff00ff
mov ecx, 0x100
sub ecx, eax
shl ecx, 8
or ecx, r9d
xor edx, ecx
mov dword [rbx], edx
add rbx, rdi
test esi, esi
jg 0x1400733a3
mov rbx, qword [rsp + 0x18]
mov rsi, qword [rsp + 0x20]
pop rdi
ret
Function at 0x140073480
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
sub rsp, 0x20
mov ebp, edx
mov edi, r8d
mov r8, qword [rcx]
mov rsi, rcx
movsxd rdx, dword [r8 + 0x10]
mov eax, edx
imul eax, ebp
sub ebp, dword [rcx + 0x14]
movsxd rbx, eax
add rbx, qword [rcx + 0x20]
cmp dword [rcx + 0x10], 0xfe
jge 0x1400735cd
mov qword [rsp + 0x48], r14
mov r14, rdx
nop
mov rax, qword [rsi + 8]
mov r8d, 0x100
mov r9d, dword [rbx]
dec edi
mov ecx, dword [rax + 0x10]
imul ecx, ebp
inc ebp
movsxd rdx, ecx
mov ecx, 0x100
add rdx, qword [rsi + 0x28]
movzx r11d, byte [rdx + 1]
movzx r10d, byte [rdx + 2]
or r11d, 0xff0000
imul r11d, dword [rsi + 0x10]
shl r10d, 0x10
shr r11d, 8
and r11d, 0xff00ff
mov eax, r11d
shr eax, 0x10
sub r8d, eax
movzx eax, byte [rdx]
or r10d, eax
mov edx, 0x100
imul r10d, dword [rsi + 0x10]
mov eax, r9d
and eax, 0xff00ff
shr r9d, 8
imul eax, r8d
and r9d, 0xff00ff
imul r9d, r8d
shr r10d, 8
and r10d, 0xff00ff
shr eax, 8
and eax, 0xff00ff
shr r9d, 8
add r10d, eax
and r9d, 0xff00ff
add r11d, r9d
mov eax, r11d
shr eax, 8
and eax, 0xff00ff
sub edx, eax
mov eax, r11d
shl eax, 8
shl edx, 8
or edx, eax
mov eax, r10d
shr eax, 8
and eax, 0xff00ff
sub ecx, eax
mov eax, r11d
or ecx, r10d
shr eax, 8
xor edx, ecx
shl r11d, 8
and eax, 0xff00ff
and edx, 0xff00ff
mov ecx, 0x100
sub ecx, eax
shl ecx, 8
or ecx, r11d
xor edx, ecx
mov dword [rbx], edx
add rbx, r14
test edi, edi
jg 0x1400734c0
mov r14, qword [rsp + 0x48]
mov rbx, qword [rsp + 0x50]
add rsp, 0x20
pop rdi
pop rsi
pop rbp
ret
mov r9, qword [rcx + 8]
movsxd rcx, dword [r9 + 0x10]
mov eax, ecx
imul eax, ebp
cdqe
add rax, qword [rsi + 0x28]
cmp edx, ecx
jne 0x140073610
cmp dword [r9 + 8], 1
jne 0x140073610
cmp dword [r8 + 8], 1
jne 0x140073610
imul ecx, edi
mov rdx, rax
movsxd r8, ecx
mov rcx, rbx
call fcn.1400c0020
mov rbx, qword [rsp + 0x50]
add rsp, 0x20
pop rdi
pop rsi
pop rbp
ret
mov r8, rdx
mov r9, rcx
nop word [rax + rax]
movzx ecx, word [rax]
dec edi
movzx edx, byte [rax + 2]
add rax, r9
shl edx, 8
mov word [rsp + 0x40], cx
movzx ecx, byte [rsp + 0x41]
or edx, ecx
movzx ecx, byte [rsp + 0x40]
shl edx, 8
or edx, ecx
or edx, 0xff000000
mov dword [rbx], edx
add rbx, r8
test edi, edi
jg 0x140073620
mov rbx, qword [rsp + 0x50]
add rsp, 0x20
pop rdi
pop rsi
pop rbp
ret
Function at 0x140073670
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
sub rsp, 0x20
mov r10, qword [rcx]
mov ebp, edx
mov esi, dword [rcx + 0x10]
mov ebx, r8d
imul esi, r9d
mov rdi, rcx
movsxd rdx, dword [r10 + 0x10]
mov eax, edx
imul eax, ebp
sub ebp, dword [rcx + 0x14]
sar esi, 8
movsxd r11, eax
add r11, qword [rcx + 0x20]
cmp esi, 0xfe
jge 0x1400737c9
mov qword [rsp + 0x48], r14
mov r14, rdx
nop dword [rax + rax]
mov rax, qword [rdi + 8]
dec ebx
mov r8d, dword [r11]
mov ecx, dword [rax + 0x10]
imul ecx, ebp
inc ebp
movsxd rdx, ecx
mov ecx, 0x100
add rdx, qword [rdi + 0x28]
movzx r10d, byte [rdx + 1]
movzx r9d, byte [rdx + 2]
or r10d, 0xff0000
shl r9d, 0x10
imul r10d, esi
shr r10d, 8
and r10d, 0xff00ff
mov eax, r10d
shr eax, 0x10
sub ecx, eax
movzx eax, byte [rdx]
or r9d, eax
mov edx, 0x100
mov eax, r8d
imul r9d, esi
and eax, 0xff00ff
shr r8d, 8
imul eax, ecx
and r8d, 0xff00ff
imul r8d, ecx
mov ecx, 0x100
shr r9d, 8
and r9d, 0xff00ff
shr eax, 8
and eax, 0xff00ff
shr r8d, 8
add r9d, eax
and r8d, 0xff00ff
add r10d, r8d
mov eax, r10d
shr eax, 8
and eax, 0xff00ff
sub edx, eax
mov eax, r10d
shl eax, 8
shl edx, 8
or edx, eax
mov eax, r9d
shr eax, 8
and eax, 0xff00ff
sub ecx, eax
mov eax, r10d
or ecx, r9d
shr eax, 8
xor edx, ecx
shl r10d, 8
and eax, 0xff00ff
and edx, 0xff00ff
mov ecx, 0x100
sub ecx, eax
shl ecx, 8
or ecx, r10d
xor edx, ecx
mov dword [r11], edx
add r11, r14
test ebx, ebx
jg 0x1400736c0
mov r14, qword [rsp + 0x48]
mov rbx, qword [rsp + 0x50]
add rsp, 0x20
pop rdi
pop rsi
pop rbp
ret
mov r8, qword [rcx + 8]
movsxd rcx, dword [r8 + 0x10]
mov eax, ecx
imul eax, ebp
cdqe
add rax, qword [rdi + 0x28]
cmp edx, ecx
jne 0x14007380c
cmp dword [r8 + 8], 1
jne 0x14007380c
cmp dword [r10 + 8], 1
jne 0x14007380c
imul ecx, ebx
mov rdx, rax
movsxd r8, ecx
mov rcx, r11
call fcn.1400c0020
mov rbx, qword [rsp + 0x50]
add rsp, 0x20
pop rdi
pop rsi
pop rbp
ret
mov r8, rdx
mov r9, rcx
nop dword [rax]
nop word [rax + rax]
movzx ecx, word [rax]
dec ebx
movzx edx, byte [rax + 2]
add rax, r9
shl edx, 8
mov word [rsp + 0x40], cx
movzx ecx, byte [rsp + 0x41]
or edx, ecx
movzx ecx, byte [rsp + 0x40]
shl edx, 8
or edx, ecx
or edx, 0xff000000
mov dword [r11], edx
add r11, r8
test ebx, ebx
jg 0x140073820
mov rbx, qword [rsp + 0x50]
add rsp, 0x20
pop rdi
pop rsi
pop rbp
ret
Function at 0x140073870
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x20], rbp
push rsi
push rdi
mov rax, qword [rcx]
mov rsi, rcx
mov r9d, edx
mov ebp, r8d
movsxd rcx, dword [rax + 0x10]
sub r9d, dword [rsi + 0x14]
mov eax, ecx
imul eax, edx
movsxd rdi, eax
add rdi, qword [rsi + 0x20]
cmp dword [rsi + 0x10], 0xfe
jge 0x1400739bb
mov qword [rsp + 0x20], rbx
mov qword [rsp + 0x28], r14
mov r14, rcx
mov rcx, qword [rsi + 8]
mov eax, r9d
mov r10d, dword [rdi]
cdq
mov r8d, 0x100
inc r9d
dec ebp
idiv dword [rcx + 0x14]
mov eax, dword [rcx + 0x10]
imul eax, edx
mov edx, 0x100
movsxd rcx, eax
add rcx, qword [rsi + 0x28]
movzx ebx, byte [rcx + 1]
movzx r11d, byte [rcx + 2]
or ebx, 0xff0000
imul ebx, dword [rsi + 0x10]
shl r11d, 0x10
shr ebx, 8
and ebx, 0xff00ff
mov eax, ebx
shr eax, 0x10
sub r8d, eax
movzx eax, byte [rcx]
or r11d, eax
mov ecx, 0x100
imul r11d, dword [rsi + 0x10]
mov eax, r10d
and eax, 0xff00ff
shr r10d, 8
imul eax, r8d
and r10d, 0xff00ff
imul r10d, r8d
shr r11d, 8
and r11d, 0xff00ff
shr eax, 8
and eax, 0xff00ff
shr r10d, 8
add r11d, eax
and r10d, 0xff00ff
add ebx, r10d
mov eax, ebx
shr eax, 8
and eax, 0xff00ff
sub edx, eax
mov eax, ebx
shl eax, 8
shl edx, 8
or edx, eax
mov eax, r11d
shr eax, 8
and eax, 0xff00ff
sub ecx, eax
mov eax, ebx
or ecx, r11d
shr eax, 8
xor edx, ecx
shl ebx, 8
and eax, 0xff00ff
and edx, 0xff00ff
mov ecx, 0x100
sub ecx, eax
shl ecx, 8
or ecx, ebx
xor edx, ecx
mov dword [rdi], edx
add rdi, r14
test ebp, ebp
jg 0x1400738b1
mov r14, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x20]
mov rbp, qword [rsp + 0x30]
pop rdi
pop rsi
ret
mov r8, rcx
nop
mov rcx, qword [rsi + 8]
mov eax, r9d
cdq
inc r9d
dec ebp
idiv dword [rcx + 0x14]
mov eax, dword [rcx + 0x10]
imul eax, edx
movsxd rdx, eax
add rdx, qword [rsi + 0x28]
movzx eax, word [rdx]
movzx ecx, byte [rdx + 2]
shl ecx, 8
mov word [rsp + 0x18], ax
movzx eax, byte [rsp + 0x19]
or ecx, eax
movzx eax, byte [rsp + 0x18]
shl ecx, 8
or ecx, eax
or ecx, 0xff000000
mov dword [rdi], ecx
add rdi, r8
test ebp, ebp
jg 0x1400739c0
mov rbp, qword [rsp + 0x30]
pop rdi
pop rsi
ret
Function at 0x140073a20
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
mov rax, qword [rcx]
mov rdi, rcx
mov r10d, edx
mov esi, r8d
movsxd rcx, dword [rax + 0x10]
mov ebp, dword [rdi + 0x10]
mov eax, ecx
sub r10d, dword [rdi + 0x14]
imul eax, edx
imul ebp, r9d
movsxd rbx, eax
add rbx, qword [rdi + 0x20]
sar ebp, 8
cmp ebp, 0xfe
jge 0x140073b80
mov qword [rsp + 0x20], r14
mov r14, rcx
nop word [rax + rax]
mov rcx, qword [rdi + 8]
mov eax, r10d
mov r8d, dword [rbx]
cdq
inc r10d
dec esi
idiv dword [rcx + 0x14]
mov eax, dword [rcx + 0x10]
imul eax, edx
mov edx, 0x100
movsxd rcx, eax
add rcx, qword [rdi + 0x28]
movzx r11d, byte [rcx + 1]
movzx r9d, byte [rcx + 2]
or r11d, 0xff0000
shl r9d, 0x10
imul r11d, ebp
shr r11d, 8
and r11d, 0xff00ff
mov eax, r11d
shr eax, 0x10
sub edx, eax
movzx eax, byte [rcx]
or r9d, eax
mov ecx, 0x100
mov eax, r8d
imul r9d, ebp
and eax, 0xff00ff
shr r8d, 8
imul eax, edx
and r8d, 0xff00ff
imul r8d, edx
mov edx, 0x100
shr r9d, 8
and r9d, 0xff00ff
shr eax, 8
and eax, 0xff00ff
shr r8d, 8
add r9d, eax
and r8d, 0xff00ff
add r11d, r8d
mov eax, r11d
shr eax, 8
and eax, 0xff00ff
sub edx, eax
mov eax, r11d
shl eax, 8
shl edx, 8
or edx, eax
mov eax, r9d
shr eax, 8
and eax, 0xff00ff
sub ecx, eax
mov eax, r11d
or ecx, r9d
shr eax, 8
xor edx, ecx
shl r11d, 8
and eax, 0xff00ff
and edx, 0xff00ff
mov ecx, 0x100
sub ecx, eax
shl ecx, 8
or ecx, r11d
xor edx, ecx
mov dword [rbx], edx
add rbx, r14
test esi, esi
jg 0x140073a70
mov r14, qword [rsp + 0x20]
mov rbx, qword [rsp + 0x28]
mov rbp, qword [rsp + 0x30]
pop rdi
pop rsi
ret
mov r8, rcx
mov rcx, qword [rdi + 8]
mov eax, r10d
cdq
inc r10d
dec esi
idiv dword [rcx + 0x14]
mov eax, dword [rcx + 0x10]
imul eax, edx
movsxd rdx, eax
add rdx, qword [rdi + 0x28]
movzx eax, word [rdx]
movzx ecx, byte [rdx + 2]
shl ecx, 8
mov word [rsp + 0x18], ax
movzx eax, byte [rsp + 0x19]
or ecx, eax
movzx eax, byte [rsp + 0x18]
shl ecx, 8
or ecx, eax
or ecx, 0xff000000
mov dword [rbx], ecx
add rbx, r8
test esi, esi
jg 0x140073b83
mov rbx, qword [rsp + 0x28]
mov rbp, qword [rsp + 0x30]
pop rdi
pop rsi
ret
Function at 0x140073be0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
mov rax, qword [rcx]
mov r11, rcx
mov edi, edx
mov esi, r8d
movsxd rcx, dword [rax + 0x10]
sub edi, dword [r11 + 0x14]
mov eax, ecx
imul eax, edx
movsxd rbx, eax
add rbx, qword [r11 + 0x20]
cmp dword [r11 + 0x10], 0xfe
jge 0x140073d2a
mov qword [rsp + 0x10], rbp
mov rbp, rcx
mov rcx, qword [r11 + 8]
mov eax, edi
cdq
inc edi
dec esi
idiv dword [rcx + 0x14]
mov eax, dword [rcx + 0x10]
imul eax, edx
mov edx, 0x100
movsxd rcx, eax
add rcx, qword [r11 + 0x28]
mov r8d, dword [rcx]
mov r10d, r8d
shr r10d, 8
and r8d, 0xff00ff
imul r8d, dword [r11 + 0x10]
and r10d, 0xff00ff
imul r10d, dword [r11 + 0x10]
mov ecx, 0x100
shr r8d, 8
shr r10d, 8
and r8d, 0xff00ff
and r10d, 0xff00ff
mov eax, r10d
shr eax, 0x10
sub ecx, eax
mov eax, dword [rbx]
mov r9d, eax
shr eax, 8
and eax, 0xff00ff
and r9d, 0xff00ff
imul eax, ecx
imul r9d, ecx
mov ecx, 0x100
shr eax, 8
and eax, 0xff00ff
shr r9d, 8
add r10d, eax
and r9d, 0xff00ff
add r9d, r8d
mov eax, r10d
shr eax, 8
and eax, 0xff00ff
sub edx, eax
mov eax, r10d
shl eax, 8
shl edx, 8
or edx, eax
mov eax, r9d
shr eax, 8
and eax, 0xff00ff
sub ecx, eax
mov eax, r10d
or ecx, r9d
shr eax, 8
xor edx, ecx
shl r10d, 8
and eax, 0xff00ff
and edx, 0xff00ff
mov ecx, 0x100
sub ecx, eax
shl ecx, 8
or ecx, r10d
xor edx, ecx
mov dword [rbx], edx
add rbx, rbp
test esi, esi
jg 0x140073c20
mov rbp, qword [rsp + 0x10]
mov rbx, qword [rsp + 0x18]
mov rsi, qword [rsp + 0x20]
pop rdi
ret
mov r10, rcx
nop dword [rax]
mov rcx, qword [r11 + 8]
mov eax, edi
cdq
inc edi
dec esi
idiv dword [rcx + 0x14]
mov eax, dword [rcx + 0x10]
imul eax, edx
movsxd rcx, eax
add rcx, qword [r11 + 0x28]
mov edx, dword [rcx]
mov r9d, edx
and edx, 0xff00ff
shr r9d, 8
and r9d, 0xff00ff
mov ecx, 0x100
mov eax, r9d
shr eax, 0x10
sub ecx, eax
mov eax, dword [rbx]
mov r8d, eax
shr eax, 8
and eax, 0xff00ff
and r8d, 0xff00ff
imul eax, ecx
imul r8d, ecx
mov ecx, 0x100
shr eax, 8
and eax, 0xff00ff
shr r8d, 8
add r9d, eax
and r8d, 0xff00ff
add r8d, edx
mov eax, r9d
shr eax, 8
mov edx, 0x100
and eax, 0xff00ff
sub edx, eax
mov eax, r9d
shl eax, 8
shl edx, 8
or edx, eax
mov eax, r8d
shr eax, 8
and eax, 0xff00ff
sub ecx, eax
mov eax, r9d
or ecx, r8d
shr eax, 8
xor edx, ecx
shl r9d, 8
and eax, 0xff00ff
and edx, 0xff00ff
mov ecx, 0x100
sub ecx, eax
shl ecx, 8
or ecx, r9d
xor edx, ecx
mov dword [rbx], edx
add rbx, r10
test esi, esi
jg 0x140073d30
mov rbx, qword [rsp + 0x18]
mov rsi, qword [rsp + 0x20]
pop rdi
ret