joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140147e70
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push rbp
push r14
push r15
sub rsp, 0x50
mov r15, rcx
movaps xmmword [rsp + 0x40], xmm6
mov rcx, qword [rcx + 0x54860]
mov r14d, 2
mov ebp, edx
movaps xmmword [rsp + 0x30], xmm7
xorps xmm0, xmm0
lea rdx, [rsp + 0x70]
mov r9d, r14d
mov r8d, r14d
mov rax, qword [rcx]
movups xmmword [rsp + 0x20], xmm0
call qword [rax + 0x10]
movsd xmm6, qword [rsp + 0x28]
movsd xmm7, qword [rsp + 0x20]
sub ebp, r14d
je 0x140147f90
mov qword [rsp + 0x78], rbx
mov qword [rsp + 0x80], rsi
mov qword [rsp + 0x88], rdi
nop dword [rax]
mov rcx, qword [r15 + 0x54860]
lea rbx, [rsp + 0x70]
mov r9d, 1
mov esi, r14d
mov rax, qword [rcx]
lea rdi, [rsi + rsi]
add rbx, rdi
lea r8d, [r9 + 1]
mov rdx, rbx
call qword [rax + 0x10]
movzx r8d, byte [rbx]
xor rsi, 2
movzx edx, byte [rsp + rdi + 0x71]
mov eax, r8d
shl eax, 8
or edx, eax
movzx r9d, byte [rsp + rsi*2 + 0x70]
movzx ecx, byte [rsp + rsi*2 + 0x71]
mov eax, r9d
shl eax, 8
or ecx, eax
movzx eax, byte [rsp + rsi*2 + 0x71]
sub ecx, edx
shl eax, 8
or eax, r9d
movd xmm0, ecx
movzx ecx, byte [rsp + rdi + 0x71]
cvtdq2pd xmm0, xmm0
shl ecx, 8
or ecx, r8d
sub eax, ecx
inc r14d
and r14d, 3
mulsd xmm0, xmm0
addsd xmm7, xmm0
movd xmm0, eax
cvtdq2pd xmm0, xmm0
mulsd xmm0, xmm0
addsd xmm6, xmm0
sub ebp, 1
jne 0x140147ee0
mov rdi, qword [rsp + 0x88]
mov rsi, qword [rsp + 0x80]
mov rbx, qword [rsp + 0x78]
comisd xmm6, xmm7
mov eax, 0x4949
mov ecx, 0x4d4d
movaps xmm6, xmmword [rsp + 0x40]
movaps xmm7, xmmword [rsp + 0x30]
cmova ax, cx
add rsp, 0x50
pop r15
pop r14
pop rbp
ret
Function at 0x14015f330
Capabilities:
Hash data using murmur3

Disassembly:
movaps xmm1, xmm0
movss dword [rsp + 8], xmm0
ucomiss xmm1, xmm1
jnp 0x14015f34c
movzx eax, word [rsp + 8]
mov ecx, 0x7fff
or ax, cx
ret
movss xmm0, dword [0x14038a34c]
comiss xmm0, xmm1
jbe 0x14015f35f
mov eax, 0xfbff
ret
comiss xmm1, dword [0x14038a340]
jbe 0x14015f36e
mov eax, 0x7bff
ret
comiss xmm1, dword [0x14038a348]
jbe 0x14015f394
movss xmm0, dword [0x14038a328]
comiss xmm0, xmm1
jbe 0x14015f394
mov eax, dword [rsp + 8]
mov ecx, 0x8000
shr eax, 0x10
and ax, cx
ret
mov r8d, dword [rsp + 8]
mov eax, 0x400
mov ecx, r8d
shr ecx, 0x17
add cx, 0x10
movzx edx, cx
mov ecx, r8d
imul edx, eax
mov eax, 0x3ff
shr ecx, 0xd
and ax, cx
shr r8d, 0x10
mov ecx, 0x8000
and r8w, cx
or ax, dx
or ax, r8w
ret
Function at 0x140164020
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push rdi
xor eax, eax
mov rdi, rdx
mov r11, rcx
lea r10d, [rax + 1]
test r8d, r8d
je 0x14016407d
mov qword [rsp + 0x10], rbx
mov ebx, r8d
nop dword [rax + rax]
movzx r9d, byte [rax + rdi]
lea ecx, [rax + 1]
test r10d, r10d
lea r11, [r11 + 1]
cmove eax, ecx
movzx ecx, r9b
and cl, 0xf
shr r9b, 4
test r10d, r10d
movzx edx, r9b
movzx ecx, cl
cmove edx, ecx
xor r10d, 1
mov byte [r11 - 1], dl
sub rbx, 1
jne 0x140164040
mov rbx, qword [rsp + 0x10]
pop rdi
ret
Function at 0x1401654e0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
test r8d, r8d
jle 0x140165562
mov qword [rsp + 0x10], rbx
push rdi
xor r11d, r11d
movsxd rbx, r8d
mov qword [rsp + 0x10], rsi
mov r8d, r11d
mov r10, rdx
mov rdi, rcx
mov esi, 0xfff8
movzx eax, byte [r10]
test r11d, r11d
je 0x140165515
inc r10
and eax, 0xf
jmp 0x140165519
shr rax, 4
movzx edx, byte [r9 + rax*4 + 2]
lea rcx, [r9 + rax*4]
movzx eax, byte [r9 + rax*4 + 1]
and dx, si
shl dx, 5
xor r11d, 1
or dx, ax
movzx eax, byte [rcx]
and dx, si
shr al, 3
shl dx, 2
movzx ecx, al
or dx, cx
mov word [rdi + r8*2], dx
inc r8
cmp r8, rbx
jl 0x140165504
mov rsi, qword [rsp + 0x10]
mov rbx, qword [rsp + 0x18]
pop rdi
ret

Function at 0x140166200
Capabilities:
Encrypt data using rc4 prga

Disassembly:
test r8d, r8d
jle 0x140166293
mov qword [rsp + 0x18], rbx
push rdi
mov qword [rsp + 0x10], rbp
xor r11d, r11d
mov qword [rsp + 0x18], rsi
mov r10, rdx
mov esi, 0xfff8
movsxd rbx, r8d
mov rdi, rcx
mov r8d, r11d
lea ebp, [rsi + 4]
movzx eax, byte [r10]
test r11d, r11d
je 0x140166241
inc r10
and eax, 0xf
jmp 0x140166245
shr rax, 4
movzx edx, byte [r9 + rax*4 + 2]
lea rcx, [r9 + rax*4]
movzx eax, byte [r9 + rax*4 + 1]
and dx, si
shl dx, 5
xor r11d, 1
or dx, ax
movzx eax, byte [rcx]
and dx, bp
shr al, 3
shl dx, 3
movzx ecx, al
or dx, cx
mov word [rdi + r8*2], dx
inc r8
cmp r8, rbx
jl 0x140166230
mov rsi, qword [rsp + 0x18]
mov rbp, qword [rsp + 0x10]
mov rbx, qword [rsp + 0x20]
pop rdi
ret
Function at 0x140172e80
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push rbx
sub rsp, 0x20
inc dword [rcx + 0x234]
mov rbx, rcx
mov eax, dword [rcx + 0x234]
cmp eax, dword [rcx + 0x220]
jb 0x140172ff8
cmp byte [rcx + 0x284], 0
je 0x140172fe0
test byte [rcx + 0x16c], 2
mov dword [rcx + 0x234], 0
je 0x140172ed3
inc byte [rcx + 0x285]
movzx ecx, byte [rcx + 0x285]
jmp 0x140172f74
movzx eax, byte [rcx + 0x285]
mov qword [rsp + 0x30], rdi
lea rdi, [0x140000000]
nop word [rax + rax]
lea ecx, [rax + 1]
mov byte [rbx + 0x285], cl
cmp cl, 7
jae 0x140172f6f
movzx r11d, cl
movzx r8d, byte [r11 + rdi + 0x38b0d8]
movzx eax, byte [r11 + rdi + 0x38b0d0]
mov edx, r8d
movzx r9d, byte [r11 + rdi + 0x38b0e8]
sub edx, eax
mov eax, dword [rbx + 0x218]
dec eax
add eax, edx
xor edx, edx
div r8d
movzx edx, byte [r11 + rdi + 0x38b0e0]
mov r8d, r9d
mov r10d, eax
mov dword [rbx + 0x224], eax
mov eax, dword [rbx + 0x21c]
sub r8d, edx
dec eax
xor edx, edx
add eax, r8d
div r9d
mov dword [rbx + 0x220], eax
mov r8d, eax
movzx eax, cl
test r10d, r10d
je 0x140172ef0
test r8d, r8d
je 0x140172ef0
mov rdi, qword [rsp + 0x30]
cmp cl, 7
jae 0x140172fe0
mov r9, qword [rbx + 0x240]
test r9, r9
je 0x140172ff8
movzx eax, byte [rbx + 0x289]
movzx ecx, byte [rbx + 0x28c]
mov r8d, eax
mov edx, dword [rbx + 0x218]
imul eax, ecx
imul r8, rcx
cmp eax, 8
jb 0x140172fc2
shr r8, 3
mov rcx, r9
imul r8, rdx
xor edx, edx
inc r8
add rsp, 0x20
pop rbx
jmp fcn.1402d1c50
imul r8, rdx
xor edx, edx
mov rcx, r9
add r8, 7
shr r8, 3
inc r8
add rsp, 0x20
pop rbx
jmp fcn.1402d1c50
mov r9d, 4
xor r8d, r8d
xor edx, edx
mov rcx, rbx
add rsp, 0x20
pop rbx
jmp fcn.140170fa0
add rsp, 0x20
pop rbx
ret
Function at 0x1401df6e0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
sub rsp, 0x20
mov rdi, rcx
xor r8d, r8d
mov rcx, qword [rcx + 0x78]
mov esi, edx
movzx ebp, word [rcx + 0x1e]
call fcn.1401e3980
mov rcx, qword [rdi + 0x78]
mov ebx, eax
and ebx, 1
mov edx, esi
mov r8d, ebx
call fcn.1401e3980
xor ebx, 1
cmp ebx, ebp
jae 0x1401df82b
movsxd rdx, dword [rdi + 4]
movsxd r10, eax
mov qword [rsp + 0x40], r12
mov r9, r10
xor r9, 2
mov qword [rsp + 0x48], r14
lea rcx, [rdx + rdx*2]
mov qword [rsp + 0x50], r15
mov rax, r9
lea r12d, [rsi + 4]
sub rax, rcx
lea r14, [rax + rax]
lea rax, [r9 + rcx]
lea r15, [rax + rax]
lea rax, [rdx + rdx*2]
lea rsi, [rax + rax]
nop
mov r8, qword [rdi + 8]
mov eax, r12d
imul eax, dword [rdi + 4]
add eax, ebx
cdqe
add rax, 4
lea rax, [rax + rax*2]
lea r11, [rax + rax]
add r8, r11
movzx ecx, word [r8 + r10*2 - 6]
movzx eax, word [r8 + r10*2 + 6]
add eax, ecx
movzx ecx, word [r8 + 8]
sub eax, ecx
movzx ecx, word [r8 - 4]
sub eax, ecx
movzx ecx, word [rdi + r10*2 + 0x40]
cdq
sub eax, edx
movzx edx, word [r8 + 2]
sar eax, 1
add edx, eax
cmp edx, ecx
jg 0x1401df7bd
movzx eax, word [rdi + r10*2 + 0x48]
mov ecx, edx
cmp edx, eax
cmovl ecx, eax
mov word [r8 + r10*2], cx
mov r8, qword [rdi + 0x10]
add r8, r11
mov rax, r8
sub rax, rsi
movzx ecx, word [rax + 2]
movzx eax, word [r15 + r8]
sub eax, ecx
movzx ecx, word [rsi + r8 + 2]
sub eax, ecx
movzx ecx, word [r14 + r8]
add eax, ecx
movzx ecx, word [rdi + r9*2 + 0x40]
cdq
sub eax, edx
movzx edx, word [r8 + 2]
sar eax, 1
add edx, eax
cmp edx, ecx
jg 0x1401df80c
movzx eax, word [rdi + r9*2 + 0x48]
mov ecx, edx
cmp edx, eax
cmovl ecx, eax
add ebx, 2
mov word [r8 + r9*2], cx
cmp ebx, ebp
jl 0x1401df760
mov r15, qword [rsp + 0x50]
mov r14, qword [rsp + 0x48]
mov r12, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x58]
add rsp, 0x20
pop rdi
pop rsi
pop rbp
ret
Function at 0x1401f4e80
Capabilities:
Encode data using xor

Disassembly:
movsxd rax, edx
mov r10, rcx
lea r11, [rcx + rax*4]
cmp rcx, r11
jae 0x1401f4ed9
nop
mov r9d, dword [r10]
lea r8, [r8 + 2]
mov edx, r9d
mov eax, r9d
shr eax, 0xd
mov ecx, r9d
shr edx, 0x10
add r10, 4
xor dl, al
shr ecx, 5
mov eax, r9d
and dl, 7
shr eax, 0x10
xor dl, al
mov eax, r9d
shr eax, 3
xor cl, al
shr r9d, 5
and cl, 0x1f
mov byte [r8 - 2], dl
xor cl, r9b
mov byte [r8 - 1], cl
cmp r10, r11
jb 0x1401f4e90
ret
Function at 0x1401f66b0
Capabilities:
Encode data using xor

Disassembly:
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x50
movsxd r14, dword [rcx + 8]
mov r12, r9
mov rdi, qword [rsp + 0xb0]
mov esi, edx
mov rbp, rcx
test edx, edx
jne 0x1401f677f
mov eax, dword [r9]
lea ecx, [r14 - 1]
add eax, 0xff000000
movsxd r11, ecx
mov dword [rdi], eax
lea r10, [rdi + 4]
test ecx, ecx
jle 0x1401f6765
mov rbx, r9
sub rbx, r10
nop dword [rax]
nop word [rax + rax]
mov r9d, dword [rbx + r10 + 4]
lea r10, [r10 + 4]
movzx r8d, ax
mov ecx, r9d
and ecx, 0xff00
mov edx, r9d
add r8d, ecx
and edx, 0xffff00ff
mov ecx, eax
and r9d, 0xff00ff00
and eax, 0xff00ffff
and ecx, 0xffff00ff
add edx, ecx
xor r8d, edx
and r8d, 0xff00ff
lea ecx, [r9 + rax]
mov eax, r8d
xor eax, ecx
mov dword [r10 - 4], eax
sub r11, 1
jne 0x1401f6710
lea rax, [r14*4]
mov esi, 1
add r12, rax
mov dword [rsp + 0x98], esi
add rdi, rax
mov ecx, dword [rbp + 4]
lea edx, [r14 - 1]
mov eax, 1
mov r13, r14
shl eax, cl
add edx, eax
mov dword [rsp + 0x90], eax
shr edx, cl
mov dword [rsp + 0x24], edx
lea ebx, [rax - 1]
mov eax, esi
sar eax, cl
imul eax, edx
mov dword [rsp + 0x20], ebx
movsxd rcx, eax
mov rax, qword [rbp + 0x10]
mov ebp, dword [rsp + 0xa0]
lea r10, [rax + rcx*4]
mov qword [rsp + 0x28], r10
cmp esi, ebp
jge 0x1401f690b
mov rax, r14
mov qword [rsp + 0x48], r15
neg rax
shl rax, 2
sub r12, rdi
mov qword [rsp + 0x30], rax
mov qword [rsp + 0xa8], r12
nop dword [rax + rax]
mov r9d, dword [rax + rdi]
add r12, rdi
movzx r8d, r9w
mov r11d, 1
mov r15, r10
mov edx, dword [r12]
mov eax, edx
and eax, 0xff00
mov ecx, edx
add r8d, eax
and ecx, 0xffff00ff
mov eax, r9d
and edx, 0xff00ff00
and eax, 0xffff00ff
and r9d, 0xff00ffff
add ecx, eax
add r9d, edx
xor r8d, ecx
and r8d, 0xff00ff
xor r8d, r9d
mov dword [rdi], r8d
cmp r14d, r11d
jle 0x1401f68cb
mov esi, dword [rsp + 0x90]
mov ebp, ebx
not ebp
nop dword [rax + rax]
mov eax, dword [r15]
lea rcx, [0x140813b40]
shr rax, 8
lea r15, [r15 + 4]
and eax, 0xf
mov ebx, r14d
mov r10, qword [rcx + rax*8]
mov ecx, ebp
and ecx, r11d
add ecx, esi
cmp ecx, r14d
cmovle ebx, ecx
movsxd rcx, r11d
mov r8d, ebx
sub r8d, r11d
lea rax, [rcx*4]
sub rcx, r13
lea r9, [rax + rdi]
lea rdx, [rdi + rcx*4]
lea rcx, [r12 + rax]
call r10
mov r11d, ebx
cmp ebx, r14d
jl 0x1401f6860
mov esi, dword [rsp + 0x98]
mov r10, qword [rsp + 0x28]
mov ebx, dword [rsp + 0x20]
mov ebp, dword [rsp + 0xa0]
inc esi
lea rax, [r13*4]
add rdi, rax
mov dword [rsp + 0x98], esi
test esi, ebx
jne 0x1401f68f1
movsxd rax, dword [rsp + 0x24]
lea r10, [r10 + rax*4]
mov qword [rsp + 0x28], r10
mov r12, qword [rsp + 0xa8]
mov rax, qword [rsp + 0x30]
cmp esi, ebp
jl 0x1401f67f0
mov r15, qword [rsp + 0x48]
add rsp, 0x50
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x1401ff5e0
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x60
mov rax, qword [0x1404b0028]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov edi, dword [rcx + 0x34]
mov rbx, rcx
movsxd rsi, dword [rcx + 0x30]
mov eax, edi
imul eax, esi
mov edx, 1
movsxd rcx, eax
call fcn.1401e4960
mov qword [rsp + 0x30], rax
mov rdx, rax
test rax, rax
je 0x1401ff80e
lea eax, [rdi - 1]
cmp eax, 1
jle 0x1401ff806
mov qword [rsp + 0x88], rbp
lea edi, [rsi + 1]
mov qword [rsp + 0x90], r12
dec eax
mov qword [rsp + 0x98], r13
lea r13d, [rsi - 1]
mov qword [rsp + 0x58], r14
movsxd rcx, edi
mov qword [rsp + 0x50], r15
mov r15, rsi
mov r12d, eax
mov qword [rsp + 0x28], rax
lea rsi, [rcx + rdx]
lea r14, [r15*8]
lea rbp, [rcx*8]
nop dword [rax]
cmp r13d, 1
jle 0x1401ff770
mov r10, rbp
lea r11d, [r13 - 1]
mov r8, rsi
nop dword [rax]
nop dword [rax + rax]
mov rdx, qword [rbx + 0x5c60]
xorps xmm0, xmm0
add rdx, r10
movups xmmword [rsp + 0x38], xmm0
mov rcx, rdx
sub rcx, r14
mov r9d, dword [rdx]
shr r9d, 5
and r9d, 3
mov eax, dword [rcx - 8]
shr rax, 5
and eax, 3
inc dword [rsp + rax*4 + 0x38]
mov eax, dword [rcx]
shr rax, 5
and eax, 3
inc dword [rsp + rax*4 + 0x38]
mov eax, dword [rcx + 8]
xor ecx, ecx
shr rax, 5
and eax, 3
inc dword [rsp + rax*4 + 0x38]
mov eax, dword [rdx - 8]
shr rax, 5
and eax, 3
inc dword [rsp + rax*4 + 0x38]
mov eax, dword [rdx + 8]
shr rax, 5
and eax, 3
inc dword [rsp + rax*4 + 0x38]
mov eax, dword [r14 + rdx - 8]
shr rax, 5
and eax, 3
inc dword [rsp + rax*4 + 0x38]
mov eax, dword [r14 + rdx]
shr rax, 5
and eax, 3
inc dword [rsp + rax*4 + 0x38]
mov eax, dword [r14 + rdx + 8]
shr rax, 5
and eax, 3
inc dword [rsp + rax*4 + 0x38]
xor eax, eax
nop dword [rax + rax]
cmp dword [rsp + rax*4 + 0x38], 5
jge 0x1401ff754
inc ecx
inc rax
cmp rax, 4
jl 0x1401ff740
jmp 0x1401ff757
mov r9d, ecx
mov byte [r8], r9b
add r10, 8
inc r8
sub r11, 1
jne 0x1401ff6a0
mov rax, qword [rsp + 0x28]
add rbp, r14
add rsi, r15
sub rax, 1
mov qword [rsp + 0x28], rax
jne 0x1401ff680
mov r10, qword [rsp + 0x30]
mov r14, qword [rsp + 0x58]
add r10, r15
mov rbp, qword [rsp + 0x88]
movsxd r11, r13d
mov r13, qword [rsp + 0x98]
cmp r11, 1
jle 0x1401ff7e8
mov r8d, 1
mov r9d, edi
nop dword [rax]
nop dword [rax + rax]
mov rax, qword [rbx + 0x5c60]
movsxd rcx, r9d
inc r9d
lea rdx, [rax + rcx*8]
movzx eax, byte [r10 + r8]
shl eax, 5
inc r8
xor eax, dword [rdx]
and eax, 0x60
xor dword [rdx], eax
cmp r8, r11
jl 0x1401ff7c0
add edi, r15d
add r10, r15
sub r12, 1
jne 0x1401ff7a5
mov rdx, qword [rsp + 0x30]
mov r15, qword [rsp + 0x50]
mov r12, qword [rsp + 0x90]
mov rcx, rdx
call fcn.1401e49d0
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.140048b40
add rsp, 0x60
pop rdi
pop rsi
pop rbx
ret
Function at 0x1402016e0
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rbp
push rdi
sub rsp, 0x20
mov ebp, edx
mov rbx, r9
mov rdx, r8
mov rdi, r8
call fcn.1401e4ae0
cmp eax, 0x100
jle 0x14020170f
xor r10d, r10d
mov dword [rbx], r10d
xor eax, eax
add rsp, 0x20
pop rdi
pop rbp
pop rbx
ret
mov qword [rsp + 0x40], rsi
lea r9, [0x140200c70]
movsxd rsi, eax
mov r8d, 4
mov rdx, rsi
mov dword [rbx], eax
mov rcx, rdi
call fcn.1402f4b90
test ebp, ebp
jne 0x140201936
xor r10d, r10d
mov qword [rsp + 0x48], r14
xor r8b, r8b
mov r9d, r10d
test rsi, rsi
jle 0x140201801
mov r11d, r10d
lea ebp, [r10 + 0x40]
lea r14d, [r10 + 8]
nop dword [rax + rax]
mov ebx, dword [rdi + r11*4]
mov ecx, r9d
and ecx, 0xff00ff00
mov eax, ebx
and eax, 0xff00
mov edx, ebx
sub eax, ecx
and edx, 0xffff00ff
sub eax, 0xff01
mov ecx, r9d
and ecx, 0xff00ff
and r9d, 0xff00ff00
sub edx, ecx
mov ecx, ebx
and ecx, 0xff00ff00
add edx, 0xff00
xor eax, edx
sub ecx, r9d
add ecx, 0xff00ff
and eax, 0xff00ff
xor eax, ecx
mov ecx, eax
mov edx, eax
shr ecx, 0x10
shr edx, 8
test cl, cl
je 0x1402017ce
cmp cl, 0x80
setae cl
inc cl
or r8b, cl
test dl, dl
je 0x1402017e1
cmp dl, 0x80
mov ecx, 0x10
cmovb ecx, r14d
or r8b, cl
test al, al
je 0x1402017f2
mov ecx, 0x80
cmp al, cl
cmovb ecx, ebp
or r8b, cl
inc r11
mov r9d, ebx
cmp r11, rsi
jl 0x140201760
movzx ecx, r8b
lea eax, [rcx + rcx]
test ecx, eax
je 0x140201931
test rsi, rsi
jle 0x140201931
mov qword [rsp + 0x50], r15
mov r11, r10
mov ebx, r10d
mov r14, r11
and ebx, 0xff00ff00
mov r15d, 0xffffffff
and r10d, 0xff00ff
mov rbp, r11
nop dword [rax]
mov ecx, dword [rdi + rbp*4]
mov eax, ecx
and eax, 0xff00
mov r9d, ecx
sub eax, ebx
and r9d, 0xffff00ff
sub eax, 0xff01
sub r9d, r10d
add r9d, 0xff00
and ecx, 0xff00ff00
xor r9d, eax
sub ecx, ebx
and r9d, 0xff00ff
add ecx, 0xff00ff
xor r9d, ecx
movzx r8d, r9b
mov eax, r9d
shr eax, 8
movzx ecx, al
mov eax, r9d
shr eax, 0x10
movzx edx, al
mov eax, 0x100
sub eax, edx
shr r9d, 0x18
cmp edx, 0x80
cmova edx, eax
mov eax, 0x100
sub eax, ecx
cmp ecx, 0x80
cmova ecx, eax
mov eax, 0x100
sub eax, r8d
add edx, ecx
cmp r8d, 0x80
cmova r8d, eax
mov eax, 0x100
sub eax, r9d
add edx, r8d
cmp r9d, 0x80
cmova r9d, eax
mov rax, rbp
lea edx, [rdx + rdx*8]
add edx, r9d
cmp r15d, edx
cmovbe rax, r14
inc rbp
cmp r15d, edx
mov r14, rax
cmovbe edx, r15d
mov r15d, edx
cmp rbp, rsi
jl 0x140201840
mov ecx, dword [rdi + rax*4]
mov r10d, ecx
mov eax, dword [rdi + r11*4]
mov dword [rdi + r14*4], eax
mov dword [rdi + r11*4], ecx
inc r11
cmp r11, rsi
jl 0x140201821
mov r15, qword [rsp + 0x50]
mov r14, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x40]
mov eax, 1
add rsp, 0x20
pop rdi
pop rbp
pop rbx
ret
Function at 0x140202e60
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r12
push r15
sub rsp, 0x460
mov rax, qword [0x1404b0028]
xor rax, rsp
mov qword [rsp + 0x450], rax
mov ebp, dword [r8 + 0x60]
lea r15, [r8 + 0x64]
mov rbx, rcx
mov rdi, r8
mov ecx, dword [rcx + 8]
mov r12d, edx
cmp ecx, 0x20
jl 0x140202ea9
mov rcx, rbx
call fcn.1402692e0
mov ecx, dword [rbx + 8]
mov r8, qword [rbx]
movsxd rax, ecx
bts r8, rax
inc ecx
mov qword [rbx], r8
mov dword [rbx + 8], ecx
cmp ecx, 0x20
jl 0x140202ece
mov rcx, rbx
call fcn.1402692e0
mov r8, qword [rbx]
mov ecx, dword [rbx + 8]
mov edx, 3
lea esi, [rbp - 1]
shl rdx, cl
add ecx, 2
or rdx, r8
mov dword [rbx + 8], ecx
mov qword [rbx], rdx
cmp ecx, 0x20
jl 0x140202ef8
mov rcx, rbx
call fcn.1402692e0
mov rdx, qword [rbx]
mov ecx, dword [rbx + 8]
mov eax, esi
shl rax, cl
or rax, rdx
mov qword [rbx], rax
lea eax, [rcx + 8]
mov dword [rbx + 8], eax
lea eax, [rbp - 1]
movsxd r11, eax
cmp r11, 1
jl 0x140202fa5
mov r10d, dword [r15 + r11*4]
lea rsi, [r15 + r11*4]
mov qword [rsp + 0x498], r14
lea r14, [rsp + 0x50]
sub r14, r15
mov r9d, dword [rsi - 4]
lea rsi, [rsi - 4]
mov edx, r10d
mov ecx, r10d
and edx, 0xff00
and r10d, 0xff00ff00
and ecx, 0xffff00ff
mov eax, r9d
and eax, 0xff00ff00
sub edx, eax
mov eax, r9d
and eax, 0xff00ff
sub edx, 0xff01
sub ecx, eax
mov eax, r9d
and eax, 0xff00ff00
add ecx, 0xff00
sub r10d, eax
xor edx, ecx
add r10d, 0xff00ff
and edx, 0xff00ff
xor edx, r10d
mov r10d, r9d
mov dword [r14 + rsi + 4], edx
sub r11, 1
jne 0x140202f31
mov r14, qword [rsp + 0x498]
mov eax, dword [r15]
lea r9, [rdi + 0x468]
mov dword [rsp + 0x40], r12d
lea r8, [rdi + 0x4e0]
mov dword [rsp + 0x38], 0x14
lea rdx, [rsp + 0x50]
mov dword [rsp + 0x50], eax
mov rcx, rbx
lea rax, [rdi + 0x490]
mov dword [rsp + 0x30], 1
mov dword [rsp + 0x28], ebp
mov qword [rsp + 0x20], rax
call fcn.140202c00
mov rcx, qword [rsp + 0x450]
xor rcx, rsp
call fcn.140048b40
mov rbx, qword [rsp + 0x4a8]
add rsp, 0x460
pop r15
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x140207900
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x140
mov rax, qword [0x1404b0028]
xor rax, rsp
mov qword [rsp + 0x130], rax
xor edi, edi
mov rbx, rcx
cmp dword [rcx + 0x9c], edi
jne 0x14020793c
mov eax, dword [rcx + 0x40cc]
add eax, dword [rcx + 0xc8]
mov eax, edi
je 0x140207941
mov eax, 1
mov qword [rsp + 0x158], rsi
mov dword [rcx + 0x85c0], eax
call fcn.1402056e0
test eax, eax
jne 0x140207b0c
mov rdx, qword [rbx + 0xb8]
mov rcx, qword [rbx + 0x8648]
call fcn.140205a30
mov rcx, qword [rbx + 0x86a0]
test rcx, rcx
je 0x140207b08
lea rcx, [rcx*8]
call fcn.1402d83ac
mov qword [rbx + 0x8b48], rax
test rax, rax
je 0x140207b0c
mov r8, qword [rbx + 0x86a0]
xor edx, edx
shl r8, 3
mov rcx, rax
call fcn.1402d1c50
mov rax, qword [rbx + 0x86e8]
imul rax, qword [rbx + 0xa0]
imul rax, qword [rbx + 0x86e0]
cmp rax, 0x4000000
jb 0x140207a05
mov rcx, qword [rbx + 0x86a0]
shl rcx, 3
call fcn.1402d83ac
mov qword [rbx + 0x8b50], rax
test rax, rax
je 0x140207b0c
mov r8, qword [rbx + 0x86a0]
xor edx, edx
shl r8, 3
mov rcx, rax
call fcn.1402d1c50
cmp qword [rbx + 0x86a0], rdi
jbe 0x140207b08
nop dword [rax]
nop word [rax + rax]
mov rax, qword [rbx + 0x86e8]
imul rax, qword [rbx + 0xa0]
imul rax, qword [rbx + 0x86e0]
cmp rax, 0x4000000
jb 0x140207ac9
mov ecx, 0x104
call fcn.1402d83ac
mov rcx, qword [rbx + 0x8b50]
mov qword [rcx + rdi*8], rax
mov rax, qword [rbx + 0x8b50]
mov rsi, qword [rax + rdi*8]
test rsi, rsi
je 0x140207b0c
lea rdx, [rsp + 0x20]
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetTempPathA]
dec eax
cmp eax, 0x102
ja 0x140207b0c
mov r9, qword [rbx + 0x8b50]
lea rdx, [0x14063eaa0]
xor r8d, r8d
lea rcx, [rsp + 0x20]
mov r9, qword [r9 + rdi*8]
call qword [sym.imp.KERNEL32.dll_GetTempFileNameA]
test eax, eax
je 0x140207b0c
mov rax, qword [rbx + 0x8b48]
lea r8, [0x14063eaa4]
mov rdx, rsi
lea rcx, [rax + rdi*8]
call fcn.140205130
jmp 0x140207ad9
mov rax, qword [rbx + 0x8b48]
lea rcx, [rax + rdi*8]
call fcn.1402051f0
test eax, eax
jne 0x140207b0c
mov rdx, qword [rbx + 0x8b48]
mov rcx, qword [rbx + 0x8698]
mov rdx, qword [rdx + rdi*8]
mov rcx, qword [rcx + rdi*8]
call fcn.140205a30
inc rdi
cmp rdi, qword [rbx + 0x86a0]
jb 0x140207a20
xor eax, eax
jmp 0x140207b11
mov eax, 0xffffffff
mov rsi, qword [rsp + 0x158]
mov rcx, qword [rsp + 0x130]
xor rcx, rsp
call fcn.140048b40
mov rbx, qword [rsp + 0x160]
add rsp, 0x140
pop rdi
ret
Function at 0x14022dd40
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
mov qword [rsp + 8], rcx
push rbx
push rbp
push rdi
push r13
push r15
sub rsp, 0x30
mov r13d, dword [rcx + 0x64]
mov rdi, rcx
mov rbx, qword [rcx + 0x270]
cmp r13d, 1
mov r8d, 0x2fe
mov qword [rsp + 0x68], rbx
sete al
mov edx, 1
mov byte [rbx + 0x38], al
mov rax, qword [rcx + 8]
mov ecx, 0x100
mov r9d, dword [rdi + 0x7c]
cmovne r8d, ecx
mov rcx, rdi
call qword [rax + 0x10]
mov ebp, dword [rbx + 0x28]
xor r15d, r15d
mov qword [rbx + 0x30], rax
cmp dword [rdi + 0x7c], r15d
jle 0x14022dec1
mov qword [rsp + 0x70], rsi
mov qword [rsp + 0x28], r12
lea r12, [rbx + 0x3c]
mov qword [rsp + 0x20], r14
xor r14d, r14d
nop dword [rax]
mov esi, dword [r12]
mov eax, ebp
cdq
idiv esi
mov ebp, eax
cmp r13d, 1
jne 0x14022dddd
mov rax, qword [rbx + 0x30]
add qword [r14 + rax], 0xff
mov rax, qword [rbx + 0x30]
lea r11d, [rsi*2 - 2]
xor r8d, r8d
xor r10d, r10d
mov rdi, qword [r14 + rax]
lea eax, [rsi + 0xfe]
cdq
idiv r11d
xor ebx, ebx
mov r9d, eax
cmp r10d, r9d
jle 0x14022de37
imul eax, r8d, 0x1fe
lea ecx, [rsi + 0xfe]
add ecx, eax
nop word [rax + rax]
add ecx, 0x1fe
inc r8d
mov eax, ecx
cdq
idiv r11d
mov r9d, eax
cmp r10d, eax
jg 0x14022de20
movzx eax, r8b
inc r10d
movzx ecx, bpl
imul ecx, eax
mov byte [rbx + rdi], cl
inc rbx
cmp rbx, 0xff
jle 0x14022de02
cmp r13d, 1
jne 0x14022de93
mov ecx, r13d
lea rdx, [rdi - 1]
nop dword [rax]
nop word [rax + rax]
movzx eax, byte [rdi]
mov byte [rdx], al
lea rdx, [rdx - 1]
movzx eax, byte [rdi + 0xff]
mov byte [rdi + rcx + 0xff], al
inc rcx
cmp rcx, 0xff
jle 0x14022de70
mov rax, qword [rsp + 0x60]
inc r15d
mov rbx, qword [rsp + 0x68]
add r12, 4
add r14, 8
cmp r15d, dword [rax + 0x7c]
jl 0x14022ddc0
mov r14, qword [rsp + 0x20]
mov r12, qword [rsp + 0x28]
mov rsi, qword [rsp + 0x70]
add rsp, 0x30
pop r15
pop r13
pop rdi
pop rbp
pop rbx
ret