joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1401ec81d
Capabilities:
Execute anti-debugging instructions

Disassembly:
rdtsc
add rsp, 5
not ecx
rcl r11d, cl
call fcn.1401ec7de
sahf
jmp 0x1bde1724c
rdtsc
mov r11, rsp
mov byte [rsp + 0x10], r12b
std
stc
xchg cl, r11b
jmp 0x1401ec72e
rdtsc
std
jmp 0x1401ec744

Function at 0x1401ec950
Capabilities:
Execute anti-debugging instructions

Disassembly:
pop word [rsp + 8]
lea rdi, [rsi + rdi]
lea r12, [rdi + riz + 9]
jmp 0x1401ec95f
cld
mov rbx, r13
xchg dword [rsp + 2], r10d
xchg bx, r9w
jmp 0x1401ec93a
pop word [rsp + 5]
sub rsp, 0xb
rdtsc
not bp
mov byte [rsp + 0x10], r12b
neg cx
jmp 0x1401ec9ac
push r12w
ror bl, cl
bsr r9, r15
xchg r14, r10
jmp 0x1401ec9c3
push r8w
mov edi, ebp
mov sil, 0xf3
rdtsc
xchg byte [rsp + 0x18], r9b
mov r14w, 0x6aae
jmp 0x1401ec996
mov r10, qword [rsp + 0x15]
mov bpl, 0xa6
pop rbx
bswap ebp
dec r11b
std
jmp 0x1401ecc6d
sub rsp, 7
call fcn.1401eca16
mov bx, word [rsp + 0x13]
sub rsp, 2
lea r12, [rdx + riz]
cmc
cpuid
xchg edx, r9d
jmp 0x1401eca8a
xchg r12b, r11b
xchg byte [rsp + 4], bl
xchg byte [rsp + 1], dl
xchg rsi, r13
jmp 0x1401ecb11
mov r12d, dword [rsp + 0x17]
lea r11, [r13 + r13]
xchg dword [rsp + 7], edi
or bp, 0xd959
jmp 0x1401eca74
mov bl, 0x42
mov word [rsp + 0xc], dx
xchg bp, ax
setno bl
xchg dword [rsp + 3], edi
mov r15, r13
jmp 0x1401eca2e
lea rdi, [rbp*4]
neg ebx
call 0x1401ecacb
mov word fs:[rsp + 1], r12w
mov si, 0x50b2
bswap r9d
xchg rdi, r8
jmp 0x1401ecba4
pop word [rsp + 3]
mov r13b, 0x6f
dec r9d
lea r14, [rbp*4]
xchg edx, r14d
xchg bp, r13w
jmp 0x1401ecabb
mov r15w, 0xd490
cpuid
mov sil, byte [rsp + 8]
mov dx, word [rsp + 0x18]
add rsp, 0x13
xor al, sil
jmp 0x1401ecae4
mov rcx, 0xffffffff83a3b74e
mov dword [rsp], r15d
cld
rdtsc
neg r13d
sub rsp, 9
jmp 0x1401ecaa3
mov r8, qword [rsp + 9]
lea rsp, [rsp + 0xa]
mov dil, 0xdc
bswap ebp
jmp 0x1401ecb8b
xchg cx, ax
xchg word [rsp], dx
mov r13d, 0xebd7479b
pop word [rsp + 2]
mov dl, 4
mov r14d, 0x55d751be
jmp 0x1401ecb5a
push di
mov word [rsp + 2], dx
mov bpl, sil
mov r13d, dword [rsp + 4]
call fcn.1401ecbd1
sub eax, 0xfc960f3c
cld
lea rcx, [rdi + r10]
sub rsp, 9
cpuid
push qword [rsp + 0xe]
lea rsp, [rsp + 0x10]
jmp 0x1401ecb70
xchg r9, r11
mov r14, rsp
xchg r13d, r10d
lea rsp, [rsp + 0xd]
xchg dword [rsp], r11d
lea r11, [rbx + r11]
jmp 0x1401ecb40
Function at 0x1401ecf95
Capabilities:
Execute anti-debugging instructions

Disassembly:
neg r8b
mov cl, byte [rsp + 5]
mov r15d, 0xc7c7d357
inc rcx
sub rsp, 3
mov r13d, r15d
jmp 0x1401ecfc4
lea rsp, [rsp + 9]
mov r15d, dword [rsp + 6]
sub rsp, 0x1a
xchg r13d, eax
mov word [rsp + 0x1c], r14w
jmp 0x1401ecf72
mov r9d, 0xfc014
mov r13b, 9
xchg word [rsp], ax
bswap ebx
jmp 0x1401ecff4
lea rsp, [rsp + 0x21]
mov r8d, dword [rsp + 1]
add rsp, 2
xchg bl, r12b
mov r15b, r10b
mov bx, 0x72f6
jmp 0x1401ecfae
xchg ecx, r11d
mov word [rsp], cx
mov r11b, 0x23
lea rdi, [rdi + riz - 0x27]
jmp 0x1401ed03b
mov r15, qword [rsp]
btc bx, r10w
xchg r14, r8
add rsp, 0
bsf rcx, r8
lea rcx, [r8 + r14]
jmp 0x1401ecfde
rdtsc
xchg r14, r9
mov r12d, r14d
clc
xchg byte [rsp + 1], al
clc
jmp 0x1401ed0c8
mov r15b, byte [rsp + 0x11]
add rsp, 0
mov cl, r9b
xchg bx, di
jmp 0x1401ed0a6
mov r10w, 0xa955
mov dx, bx
adc r8w, 0xa7b5
mov cx, word [rsp + 0xc]
mov r11b, 0x46
mov edi, r12d
jmp 0x1401ed075
mov r13, r12
xchg word [rsp + 9], dx
mov r15, 0xfffffffff511ba44
btc rbp, r13
rol rdi, 0x3a
xchg r15w, dx
jmp 0x1401ed0f6
mov byte [rsp], r8b
mov al, byte [rsp]
mov r9w, word [rsp + 2]
push dx
rdtsc
sub rsp, 0xf
jmp 0x1401ed08b
lea rsp, [rsp + 0xd]
neg r15d
sub rsp, 4
jmp 0x1401ed112
mov r15b, 0x3a
mov r8w, word [rsp + 0x12]
bswap rbp
mov r14, 0xffffffff9ec8a658
mov r12w, sp
inc r8d
jmp 0x1401ed0e0
mov rsi, 0x2e265bd3
xchg r11, r8
lea r14, [r8 + r11]
mov dword [rsp + 3], r11d
cmc
jmp 0x1401ed1c5
btr r15, rcx
xor bpl, 0x5a
pushfq
pop qword [rsp + 5]
jmp 0x1401ed17a
neg rbp
mov byte [rsp + 1], sil
mov ax, 0x655
mov dword [rsp + 2], r10d
xchg bx, r10w
mov al, 0x8b
jmp 0x1401ed14b
btr rdx, r9
mov rdx, 0x10bb6a68
mov rbx, qword [rsp + 4]
lea rbx, [rbp + rbp]
jmp 0x1401ed1ad
mov r15d, ebp
bts r10d, r12d
pop rax
sub rsp, 9
sub rsp, 6
bt r10, rsi
jmp 0x1401ed161
mov bp, r13w
xchg cl, bpl
xchg qword [rsp + 3], rbx
add rsp, 0xb
xchg ebx, ebp
jmp 0x1401ed1f7
cpuid
mov byte [rsp + 4], r10b
xchg word [rsp + 4], bp
mov edi, r9d
neg edx
mov rbx, qword [rsp + 3]
jmp 0x1401ed197
xchg r12w, r9w
xchg r12, rax
cpuid
lea rsp, [rsp + 7]
bts rdi, rdx
call fcn.1401ed225
xchg esp, eax
invalid
mov r14, qword [rsp]
ror r8b, 4
mov rbx, rsi
mov r14w, 0xe59a
bsr bx, bp
cpuid
jmp 0x1401ed1dd
Function at 0x1401eec4e
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov r10b, dil
lea rcx, [rsi + rbp]
pop qword [rsp + 3]
xchg r14w, r15w
jmp 0x1401eec5a
lea rcx, [rdi + r13]
mov r8d, 0x6e04bf3e
jmp 0x1401eec38
rdtsc
lea rsp, [rsp + 7]
lea rsi, [rbp*8]
bswap rax
mov r9b, dl
rdtsc
jmp 0x1401eedd9
mov r11b, 0xd
not rsi
mov rbx, 0xffffffff8a4dc9b7
jmp 0x1401eecc7
cpuid
rdtsc
mov rdx, qword [rsp + 0x26]
mov r14w, 0xba08
lea rdi, [rcx + rcx]
mov r9, r10
jmp 0x1401eec9a
mov r8b, 0x37
mov r9, qword [rsp + 0x38]
mov rdi, 0x315c5cfe
mov rsi, qword [rsp]
mov r15w, 0x24ac
mov bp, 0xc02c
jmp 0x1401eed8c
mov r15d, dword [rsp]
mov rax, rbp
mov dl, r11b
mov rbp, r9
mov rcx, qword [rsp]
bswap r11
jmp 0x1401eecb0
lea rdi, [r8 + riz]
not r15d
mov ecx, 0xc1cf53f3
mov r15, qword [rsp]
mov al, byte [rsp]
lea r12, [r14*4]
jmp 0x1401eed58
setne bpl
mov bx, 0x5030
xchg r8w, r15w
mov r12, 0x6320ba6c
not rbp
mov r8, qword [rsp + 0x48]
jmp 0x1401eed02
xchg cl, sil
not r14b
bswap ebp
mov r14d, 0x995a7ed8
jmp 0x1401eed75
xchg di, r14w
mov r15, qword [rsp + 0x50]
mov r14b, byte [rsp]
mov ecx, 0xb0f260bf
mov rbx, rsi
mov r14d, 0xf8d0c263
jmp 0x1401eed42
mov r12, qword [rsp + 0x58]
push r9w
mov rbp, r15
xchg rdi, rax
call fcn.1401eedc0
mov ecx, 0xf41fb98
pushfq
ret
setl r11b
mov r11, qword [rsp + 0x40]
mov edi, 0xec2edaec
mov r10d, dword [rsp]
lea rcx, [r9 + r15]
xchg bl, bpl
jmp 0x1401eed25
lea rcx, [rbp + riz + 0xdc]
pushfq
mov bp, word [rsp + 4]
lea r15, [0x3188f649]
mov cl, r11b
mov r13, qword [rsp + 0x18]
jmp 0x1401eecec

Function at 0x1401f3451
Capabilities:
Check for peb beingdebugged flag

Disassembly:
call fcn.1401f20ea
mov dword [rsp + 0x21], r13d
jmp 0x1401f349b
mov word [rsp + 5], cx
mov word [rsp + 1], ax
lea rsp, [rsp + 0xb]
mov dword [rsp + 1], esp
pushfq
mov dword [rsp + 1], r12d
jmp 0x1401f34ba
mov qword [rsp + 0xe], rbp
push qword [rsp + 0x22]
lea rsp, [rsp + 5]
mov dword [rsp + 0x1c], edx
lea rsp, [rsp + 0x23]
push qword [rsp + 5]
jmp 0x1401f3476
lea rsp, [rsp + 2]
lea rsp, [rsp + 0x10]
mov rax, qword gs:[0x60]
jmp 0x1401f36e6
mov rax, qword [rax + riz + 0x10]
push rax
jmp 0x1401f20e5
mov rax, qword [rax + riz + 0x18]
mov rax, qword [rax + riz + 0x30]
mov rax, qword [rax + riz]
jmp 0x1401f35d4
Function at 0x10007510
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0xa0
mov dword [rsp + 0x20], 0
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetStartupInfoA]
nop
mov rax, qword gs:[0x30]
mov rbx, qword [rax + 8]
xor edi, edi
xor eax, eax
lock cmpxchg qword [0x10015150], rbx
je 0x10007566
cmp rax, rbx
jne 0x10007559
mov edi, 1
jmp 0x10007566
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x10007540
mov eax, dword [0x10015148]
cmp eax, 1
jne 0x1000757b
lea ecx, [rax + 0x1e]
call fcn.10195000
jmp 0x100075ba
mov eax, dword [0x10015148]
test eax, eax
jne 0x100075b0
mov dword [0x10015148], 1
lea rdx, [0x100014d0]
lea rcx, [0x100014b8]
call sub.MSVCR80.dll__initterm_e
test eax, eax
je 0x100075ba
mov eax, 0xff
jmp 0x10007714
mov dword [0x10014314], 1
mov eax, dword [0x10015148]
cmp eax, 1
jne 0x100075e2
lea rdx, [0x100014b0]
lea rcx, [0x10001470]
call sub.MSVCR80.dll__initterm
mov dword [0x10015148], 2
test edi, edi
jne 0x100075ef
xor eax, eax
xchg qword [0x10015150], rax
cmp qword [0x10015168], 0
je 0x10007618
lea rcx, [0x10015168]
call fcn.10007b90
test eax, eax
je 0x10007618
xor r8d, r8d
lea edx, [r8 + 2]
xor ecx, ecx
call qword [0x10015168]
mov rax, qword [sym.imp.MSVCR80.dll__acmdln]
mov rbx, qword [rax]
mov qword [rsp + 0x28], rbx
mov edi, dword [rsp + 0x20]
nop
nop
movzx ecx, byte [rbx]
cmp cl, 0x20
ja 0x100076aa
test cl, cl
je 0x10007640
test edi, edi
jne 0x100076aa
movzx eax, byte [rbx]
test al, al
je 0x10007656
cmp al, 0x20
ja 0x10007656
add rbx, 1
mov qword [rsp + 0x28], rbx
jmp 0x10007640
test byte [rsp + 0x6c], 1
je 0x10007665
movzx r9d, word [rsp + 0x70]
jmp 0x1000766b
mov r9d, 0xa
mov r8, rbx
xor edx, edx
lea rcx, [0x10000000]
call fcn.10005300
mov dword [0x10014310], eax
cmp dword [0x100142f4], 0
jne 0x10007693
mov ecx, eax
call qword [sym.imp.MSVCR80.dll_exit]
cmp dword [0x10014314], 0
jne 0x100076a8
call qword [sym.imp.MSVCR80.dll__cexit]
mov eax, dword [0x10014310]
jmp 0x1000770d
cmp cl, 0x22
jne 0x100076bc
xor eax, eax
test edi, edi
sete al
mov edi, eax
mov dword [rsp + 0x20], eax
movzx ecx, cl
call qword [sym.imp.MSVCR80.dll__ismbblead]
test eax, eax
je 0x100076d2
add rbx, 1
mov qword [rsp + 0x28], rbx
add rbx, 1
mov qword [rsp + 0x28], rbx
jmp 0x10007630
jmp 0x10007714
mov rbx, qword [rsp + 0xb0]
add rsp, 0xa0
pop rdi
ret
sub rsp, 0x28
call fcn.10007c10
add rsp, 0x28
jmp 0x10007510
Function at 0x14000b7c0
Capabilities:
Compute adler32 checksum

Disassembly:
mov qword [rsp + 8], rbx
mov r10, rdx
movzx r9d, cx
movabs rax, 0x79baa6bb6398b6f7
shr ecx, 0x10
mul r8
mov rax, r8
mov rbx, r8
sub rax, rdx
shr rax, 1
add rax, rdx
shr rax, 0xc
imul rax, rax, 0x15b0
sub r8, rax
test r10, r10
jne 0x14000b808
lea eax, [r10 + 1]
mov rbx, qword [rsp + 8]
ret
test rbx, rbx
je 0x14000b8dc
xor edx, edx
cmp r8, 7
jbe 0x14000b88a
lea r11d, [rdx + 7]
nop dword [rax]
movzx eax, byte [r10]
add r11d, 8
add r9d, eax
add edx, 8
movzx eax, byte [r10 + 1]
add ecx, r9d
add r9d, eax
movzx eax, byte [r10 + 2]
add ecx, r9d
add r9d, eax
movzx eax, byte [r10 + 3]
add ecx, r9d
add r9d, eax
movzx eax, byte [r10 + 4]
add ecx, r9d
add r9d, eax
movzx eax, byte [r10 + 5]
add ecx, r9d
add r9d, eax
movzx eax, byte [r10 + 6]
add ecx, r9d
add r9d, eax
movzx eax, byte [r10 + 7]
add ecx, r9d
add r9d, eax
add r10, 8
add ecx, r9d
mov eax, r11d
cmp rax, r8
jb 0x14000b820
mov eax, edx
cmp rax, r8
jae 0x14000b8a7
movzx eax, byte [r10]
inc edx
add r9d, eax
inc r10
add ecx, r9d
mov eax, edx
cmp rax, r8
jb 0x14000b891
mov eax, 0x80078071
mul r9d
shr edx, 0xf
imul eax, edx, 0xffff000f
add r9d, eax
mov eax, 0x80078071
mul ecx
shr edx, 0xf
imul eax, edx, 0xffff000f
add ecx, eax
sub rbx, r8
mov r8d, 0x15b0
jne 0x14000b811
mov rbx, qword [rsp + 8]
shl ecx, 0x10
lea eax, [r9 + rcx]
ret

Function at 0x14000b9c0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
lea r11, [0x140104e00]
mov r9, rdx
not ecx
cmp r8, 4
jb 0x14000ba39
mov r10, r8
shr r10, 2
imul rax, r10, 0xfffffffffffffffc
add r8, rax
movzx edx, byte [r9]
mov eax, ecx
xor rdx, rax
shr ecx, 8
movzx eax, dl
movzx edx, byte [r9 + 1]
xor ecx, dword [r11 + rax*4]
mov eax, ecx
shr ecx, 8
xor rdx, rax
movzx eax, dl
movzx edx, byte [r9 + 2]
xor ecx, dword [r11 + rax*4]
mov eax, ecx
shr ecx, 8
xor rdx, rax
movzx eax, dl
movzx edx, byte [r9 + 3]
add r9, 4
xor ecx, dword [r11 + rax*4]
mov eax, ecx
shr ecx, 8
xor rdx, rax
movzx eax, dl
xor ecx, dword [r11 + rax*4]
sub r10, 1
jne 0x14000b9e0
test r8, r8
je 0x14000ba5d
nop
movzx edx, byte [r9]
lea r9, [r9 + 1]
mov eax, ecx
shr ecx, 8
xor rdx, rax
movzx eax, dl
xor ecx, dword [r11 + rax*4]
sub r8, 1
jne 0x14000ba40
not ecx
mov eax, ecx
ret
Function at 0x140047790
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbx
push rdi
push r14
sub rsp, 0x20
movzx r11d, word [rdx + 2]
mov r14, rcx
movzx r9d, word [r8 + 2]
cmp rdx, r8
je 0x1400478e3
mov r10, qword [rcx + 0x20]
cmp byte [r10 + r11*8 + 5], 0x1e
lea rbx, [r10 + r11*8]
jne 0x1400477c7
movzx r11d, word [rbx]
lea rbx, [r10 + r11*8]
cmp byte [r10 + r9*8 + 5], 0x1e
lea rcx, [r10 + r9*8]
jne 0x1400477db
movzx r9d, word [rcx]
lea rcx, [r10 + r9*8]
movzx edi, byte [rdx + 5]
lea eax, [rdi - 0x38]
cmp al, 1
jbe 0x1400477eb
movzx eax, word [rdx]
jmp 0x1400477f3
movzx eax, word [rdx]
movzx eax, word [r10 + rax*8]
movzx edx, ax
movzx eax, byte [r8 + 5]
sub al, 0x38
cmp al, 1
jbe 0x140047807
movzx eax, word [r8]
jmp 0x140047810
movzx eax, word [r8]
movzx eax, word [r10 + rax*8]
movzx r8d, ax
cmp r11d, r9d
jne 0x140047832
cmp edx, r8d
je 0x1400478e3
mov rcx, r14
add rsp, 0x20
pop r14
pop rdi
pop rbx
jmp fcn.140047990
mov qword [rsp + 0x40], rbp
mov qword [rsp + 0x48], rsi
mov qword [rsp + 0x50], r15
mov r15d, 0x8000
cmp r11d, r15d
jae 0x140047851
cmp r9d, r15d
jb 0x1400478b3
cmp dil, 0x38
jne 0x1400478a8
xor esi, esi
mov ebp, r11d
cmp byte [rbx + 5], 0x29
mov edi, esi
jne 0x14004787e
movzx eax, word [rbx + 2]
cmp ax, r15w
jae 0x14004787e
movzx ebp, word [rbx]
mov esi, dword [r10 + rax*8]
cmp ebp, r9d
jne 0x14004787e
test esi, esi
jne 0x1400478b3
cmp byte [rcx + 5], 0x29
jne 0x14004789f
movzx eax, word [rcx + 2]
cmp ax, r15w
jae 0x14004789f
movzx r9d, word [rcx]
mov edi, dword [r10 + rax*8]
cmp r11d, r9d
jne 0x14004789f
test edi, edi
jne 0x1400478b3
cmp ebp, r9d
jne 0x1400478cd
cmp esi, edi
jmp 0x1400478b1
movzx eax, byte [rcx + 4]
xor al, byte [rbx + 4]
test al, 0x1f
je 0x1400478cd
xor eax, eax
mov rsi, qword [rsp + 0x48]
mov rbp, qword [rsp + 0x40]
mov r15, qword [rsp + 0x50]
add rsp, 0x20
pop r14
pop rdi
pop rbx
ret
cmp edx, r8d
jne 0x1400478d9
mov eax, 1
jmp 0x1400478b5
mov rcx, r14
call fcn.140047990
jmp 0x1400478b5
mov eax, 2
add rsp, 0x20
pop r14
pop rdi
pop rbx
ret
Function at 0x14005bf80
Capabilities:
Parse credit card information

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
inc dword [rcx + 0x6c]
mov esi, r8d
cmp dword [rcx + 0x6c], 0x14
mov rdi, rdx
mov rbx, rcx
jg 0x14005bfd1
call fcn.14005bb50
mov rdx, rdi
mov rcx, rbx
call fcn.14005b7f0
dec dword [rbx + 0x6c]
mov r8d, esi
mov rdx, rdi
mov rcx, rbx
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
jmp fcn.14005a9d0
mov edx, 0x8d0
call fcn.14005a7f0
int3
Function at 0x14006d020
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r14
sub rsp, 0x20
movzx r14d, byte [rcx + 0x20]
mov ebp, r8d
mov rbx, qword [rdx]
xor r14d, 3
mov rdi, rdx
mov rsi, rcx
test rbx, rbx
je 0x14006d0e8
mov qword [rsp + 0x40], r15
lea r15, str.0A_b_
nop dword [rax]
mov eax, ebp
dec ebp
test eax, eax
je 0x14006d0cd
cmp byte [rbx + 9], 6
jne 0x14006d080
lea rdx, [rbx + 0x40]
mov r8d, 0xffffffff
mov rcx, rsi
call fcn.14006d020
movzx ecx, byte [rbx + 8]
mov eax, ecx
xor eax, 3
test r14d, eax
je 0x14006d0a1
movzx eax, byte [rsi + 0x20]
and cl, 0xf8
and al, 3
mov rdi, rbx
or cl, al
mov byte [rbx + 8], cl
jmp 0x14006d0c5
mov rax, qword [rbx]
mov qword [rdi], rax
cmp rbx, qword [rsi + 0x28]
jne 0x14006d0b4
mov rax, qword [rbx]
mov qword [rsi + 0x28], rax
movzx eax, byte [rbx + 9]
mov rdx, rbx
sub eax, 4
mov rcx, rsi
call qword [r15 + rax*8]
mov rbx, qword [rdi]
test rbx, rbx
jne 0x14006d060
mov r15, qword [rsp + 0x40]
mov rax, rdi
mov rbx, qword [rsp + 0x48]
mov rbp, qword [rsp + 0x50]
add rsp, 0x20
pop r14
pop rdi
pop rsi
ret
mov rax, rdx
jmp 0x14006d0d5

Function at 0x14006daa0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov r10, rcx
mov rbx, r8
shr r10, 0x20
mov r11d, edx
xor r10d, edx
rol r10d, 4
bswap r10d
cmp r9d, 0xc
jbe 0x14006db33
mov eax, r9d
lea r9, [r8 - 0xc]
add r9, rax
mov r8, r9
nop
add r10d, dword [r8 + 4]
add r11d, dword [r8 + 8]
mov edx, r10d
add ecx, dword [r8]
xor r11d, r10d
rol edx, 0xe
mov r8, rbx
sub r11d, edx
add rbx, 0xc
xor ecx, r11d
mov eax, r11d
rol eax, 0xb
sub ecx, eax
mov edx, ecx
mov eax, ecx
xor eax, r10d
ror edx, 7
sub eax, edx
mov r10d, eax
cmp r8, r9
jb 0x14006dad0
rol eax, 0x10
mov edx, r10d
xor edx, r11d
sub edx, eax
xor ecx, edx
mov eax, edx
rol eax, 4
sub ecx, eax
mov eax, ecx
xor ecx, r10d
rol eax, 0xe
sub ecx, eax
mov eax, ecx
mov rbx, qword [rsp + 8]
ret
mov rbx, qword [rsp + 8]
mov eax, r10d
ret
Function at 0x140073940
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
mov qword [rsp + 0x20], r14
mov esi, r9d
mov r10, rdx
mov r14, rcx
test r9b, 1
jne 0x140073a6a
cmp r10, r8
je 0x140073a6a
mov rdi, qword [r14]
xor r9d, r9d
movzx eax, word [r10]
xor r11d, r11d
lea rcx, [rax + rax*2]
mov ebx, dword [rdi + rcx*8]
lea r10, [rdi + rcx*8]
mov edx, ebx
mov ecx, ebx
shr edx, 0x1c
cmp edx, 8
jne 0x1400739a6
mov eax, ecx
shr eax, 0x10
cmp al, 1
jne 0x1400739ab
or r9d, dword [r10 + 4]
movzx eax, cx
jmp 0x14007397d
cmp edx, 5
jne 0x1400739b0
movzx eax, cx
jmp 0x14007397d
and ecx, 0x3000000
or r9d, ecx
mov ecx, dword [r8]
mov eax, ecx
and eax, 0xf0000000
cmp eax, 0x10000000
je 0x1400739ff
movzx eax, cx
lea rcx, [rax + rax*2]
lea r8, [rdi + rcx*8]
mov ecx, dword [rdi + rcx*8]
mov eax, ecx
shr eax, 0x1c
cmp eax, 8
jne 0x1400739f1
mov eax, ecx
shr eax, 0x10
cmp al, 1
jne 0x1400739ca
or r11d, dword [r8 + 4]
jmp 0x1400739ca
cmp eax, 5
je 0x1400739ca
and ecx, 0x3000000
or r11d, ecx
test sil, 4
je 0x140073a10
cmp r9d, r11d
jne 0x140073a98
jmp 0x140073a35
test sil, 8
jne 0x140073a35
mov eax, r11d
and eax, r9d
cmp eax, r11d
jne 0x140073a98
cmp edx, 4
je 0x140073a6a
mov eax, dword [r8]
and eax, 0xf0000000
cmp eax, 0x40000000
je 0x140073a6a
mov ecx, dword [r8]
mov eax, ecx
shr eax, 0x1c
cmp edx, eax
jne 0x140073a98
mov eax, dword [r8 + 4]
cmp dword [r10 + 4], eax
jne 0x140073a98
test edx, edx
je 0x140073a8e
and ebx, 0xe0000000
cmp ebx, 0x20000000
jne 0x140073a84
or esi, 4
test sil, 1
je 0x140073967
mov eax, 1
mov rbx, qword [rsp + 8]
mov rsi, qword [rsp + 0x10]
mov rdi, qword [rsp + 0x18]
mov r14, qword [rsp + 0x20]
ret
cmp edx, 1
jne 0x140073a6a
cmp r10, r8
jmp 0x140073a96
xor ecx, ebx
test ecx, 0xc000000
je 0x140073a6a
xor eax, eax
jmp 0x140073a6f
Function at 0x140077240
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rax, qword [rcx + 0x38]
mov rsi, r8
add rax, 8
mov rbx, rcx
cmp rdx, rax
jbe 0x140077354
mov r9, qword [rdx]
movzx eax, r9b
and al, 7
cmp al, 3
jne 0x14007727d
and r9, 0xfffffffffffffff8
sub rdx, r9
mov r9, qword [rdx]
mov rcx, rdx
test r9b, 3
jne 0x140077298
movzx eax, byte [r9 - 3]
lea rax, [rax*8 + 0x10]
sub rcx, rax
jmp 0x14007729f
and r9, 0xfffffffffffffff8
sub rcx, r9
mov rdi, qword [rcx - 8]
movabs rax, 0x7fffffffffff
and rdi, rax
mov r8, rdx
mov rdx, rdi
mov rcx, rbx
call fcn.1400624f0
cmp eax, 0xffffffff
je 0x140077354
mov rcx, qword [rdi + 0x20]
lea r8, [0x140110590]
mov eax, eax
sub rcx, 0x68
add rax, 0x1a
mov r10d, dword [rcx + rax*4]
lea rdx, [rcx + rax*4]
movzx eax, r10b
movzx r8d, word [r8 + rax*2]
shr r8d, 0xb
cmp r8d, 9
jne 0x140077324
mov eax, r10d
shr eax, 8
movzx r9d, al
cmp r10b, 0x45
lea r8d, [r9 - 3]
cmovne r8d, r9d
mov r9, rsi
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
jmp fcn.140077b10
cmp r8d, 0x16
je 0x140077354
mov rax, qword [rbx + 0x10]
mov rdx, qword [rax + r8*8 + 0x1a8]
lea rax, str.metamethod
add rdx, 0x18
mov qword [rsi], rdx
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
mov rbx, qword [rsp + 0x30]
xor eax, eax
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x140077b10
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x20
mov rbx, rdx
mov r14, r9
sub rdx, rcx
mov edi, r8d
sub rdx, 0x68
mov rbp, rcx
sar rdx, 2
call fcn.140062a10
test rax, rax
jne 0x140077bc2
lea rsi, [rbp + 0x68]
lea r15, [0x140110590]
sub rbx, 4
cmp rbx, rsi
jbe 0x140077b8b
mov eax, dword [rbx]
movzx edx, al
mov ecx, eax
shr ecx, 8
movzx r8d, cl
movzx ecx, word [r15 + rdx*2]
and cx, 7
cmp cx, 2
jne 0x140077b8f
cmp edi, r8d
jb 0x140077b54
cmp edx, 0x2c
jne 0x140077b8b
shr eax, 0x10
cmp edi, eax
ja 0x140077b54
xor eax, eax
jmp 0x140077bcc
cmp cx, 1
jne 0x140077b54
cmp r8d, edi
jne 0x140077b54
cmp edx, 0x12
jne 0x140077be5
mov edi, eax
mov rdx, rbx
sub rdx, rbp
shr edi, 0x10
sub rdx, 0x68
mov r8d, edi
sar rdx, 2
mov rcx, rbp
call fcn.140062a10
test rax, rax
je 0x140077b54
mov qword [r14], rax
lea rax, str.local
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop rdi
ret
cmp edx, 0x2d
je 0x140077c75
cmp edx, 0x36
je 0x140077c50
cmp edx, 0x39
jne 0x140077b8b
mov ecx, eax
shr rcx, 0x10
movzx edx, cl
mov rcx, qword [rbp + 0x20]
not rdx
mov rdx, qword [rcx + rdx*8]
add rdx, 0x18
mov qword [r14], rdx
mov r9d, dword [rbx - 4]
cmp r9b, 0x12
jne 0x140077c44
mov ecx, r9d
shr ecx, 8
movzx edx, cl
lea ecx, [r8 + 2]
cmp edx, ecx
jne 0x140077c44
shr eax, 8
xor eax, r9d
test eax, 0xffff0000
jne 0x140077c44
lea rax, str.method
jmp 0x140077bcc
lea rax, str.field
jmp 0x140077bcc
mov rcx, rax
mov rax, qword [rbp + 0x20]
shr rcx, 0x10
not rcx
mov rcx, qword [rax + rcx*8]
lea rax, str.global
add rcx, 0x18
mov qword [r14], rcx
jmp 0x140077bcc
mov rdx, qword [rbp + 0x58]
shr eax, 0x10
test rdx, rdx
jne 0x140077c97
lea rdx, [0x140103e0d]
mov qword [r14], rdx
lea rax, str.upvalue
jmp 0x140077bcc
test eax, eax
je 0x140077caf
nop dword [rax + rax]
movzx ecx, byte [rdx]
inc rdx
test cl, cl
jne 0x140077ca0
add eax, 0xffffffff
jne 0x140077ca0
mov qword [r14], rdx
lea rax, str.upvalue
jmp 0x140077bcc
Function at 0x14007c1c0
Capabilities:
Allocate or change rwx memory

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov r10, rdx
mov rdi, rcx
test r8d, r8d
je 0x14007c24e
mov rcx, qword [rcx + 0xbe8]
cmp rcx, rdx
jne 0x14007c221
cmp dword [rdi + 0xbe4], 0x20
je 0x14007c241
mov rdx, qword [rdi + 0xc00]
lea r9, [rsp + 0x40]
mov r8d, 0x20
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x14007c2d0
mov dword [rdi + 0xbe4], 0x20
xor eax, eax
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
mov rdx, qword [rdx + 8]
lea r9, [rsp + 0x40]
mov r8d, 0x20
mov rcx, r10
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x14007c2d0
xor eax, eax
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
mov rbx, qword [rcx + 0xbe8]
cmp r10, rbx
jb 0x14007c2a3
mov rdx, qword [rcx + 0xc00]
lea rax, [rdx + rbx]
cmp r10, rax
jae 0x14007c2a3
cmp dword [rcx + 0xbe4], 4
je 0x14007c295
lea r9, [rsp + 0x40]
mov r8d, 4
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x14007c2d0
mov dword [rdi + 0xbe4], 4
mov rax, rbx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
mov rbx, qword [rbx]
cmp r10, rbx
jb 0x14007c2a3
mov rdx, qword [rbx + 8]
lea rax, [rdx + rbx]
cmp r10, rax
jae 0x14007c2a3
lea r9, [rsp + 0x40]
mov r8d, 4
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x14007c295
mov rcx, rdi
call fcn.140090620
int3