joyce8/EMBER2024-capa huggingface dataset:
Function at 0x6ec550
Capabilities:
Encode data using xor

Disassembly:
push rbp
push r14
push r13
push rdi
push rsi
push rbx
sub rsp, 0x58
mov rbp, rsp
mov qword [rbp + 0x20], rcx
mov qword [rbp + 0x98], rdx
mov rsi, qword [rbp + 0x98]
lea rdi, [rbp + 0x40]
movsq qword [rdi], qword [rsi]
movsq qword [rdi], qword [rsi]
lea rbx, [rbp + 0x40]
xor eax, eax
mov dword [rbp + 0x2c], eax
mov r13b, 0x80
mov r14d, 8
mov eax, dword [rbp + 0x2c]
movsxd rax, eax
shl rax, 9
mov rcx, qword [rbp + 0x20]
lea rax, [rcx + rax*8 + 0x18]
movzx rcx, r13b
add rcx, rcx
lea rdi, [rax + rcx*8]
lea rsi, [rbp + 0x40]
movsq qword [rdi], qword [rsi]
movsq qword [rdi], qword [rsi]
movzx rax, byte [rbx + 0xf]
test al, 1
jne 0x6ec5ca
mov rcx, qword [rbp + 0x20]
lea rdx, [rbp + 0x40]
call fcn.006ec700
jmp 0x6ec5da
mov rcx, qword [rbp + 0x20]
lea rdx, [rbp + 0x40]
call fcn.006ec700
xor byte [rbx], 0xe1
movzx r13, r13b
shr r13d, 1
sub r14d, 1
test r14d, r14d
jne 0x6ec58b
nop
mov eax, dword [rbp + 0x2c]
add eax, 1
mov dword [rbp + 0x2c], eax
mov eax, dword [rbp + 0x2c]
cmp eax, 0x10
jne 0x6ec582
nop
xor eax, eax
mov dword [rbp + 0x2c], eax
mov eax, 2
mov edx, 1
mov ebx, eax
sub ebx, 1
mov ecx, edx
cmp ecx, ebx
jg 0x6ec6ad
sub ebx, edx
add ebx, 1
mov rdx, qword [rbp + 0x20]
mov r11d, dword [rbp + 0x2c]
movsxd r11, r11d
mov rdx, r11
movsxd r8, eax
mov r9, r11
movsxd r10, ecx
shl rdx, 9
add r8, r8
shl r9, 9
add r10, r10
mov rdi, qword [rbp + 0x20]
lea rsi, [rdi + rdx*8 + 0x18]
lea rdi, [rdi + r9*8 + 0x18]
mov rsi, qword [rsi + r8*8]
xor rsi, qword [rdi + r10*8]
mov qword [rbp + 0x30], rsi
mov rsi, qword [rbp + 0x20]
lea rdx, [rsi + rdx*8 + 0x20]
lea r9, [rsi + r9*8 + 0x20]
mov rdx, qword [rdx + r8*8]
xor rdx, qword [r9 + r10*8]
mov qword [rbp + 0x38], rdx
shl r11, 9
mov rdx, qword [rbp + 0x20]
lea rdx, [rdx + r11*8 + 0x18]
mov r8d, eax
add r8d, ecx
movsxd r8, r8d
add r8, r8
lea rdi, [rdx + r8*8]
lea rsi, [rbp + 0x30]
movsq qword [rdi], qword [rsi]
movsq qword [rdi], qword [rsi]
add ecx, 1
sub ebx, 1
test ebx, ebx
jne 0x6ec621
nop
add eax, eax
cmp eax, 0x80
jle 0x6ec608
nop
mov eax, dword [rbp + 0x2c]
movsxd rax, eax
shl rax, 9
mov rcx, qword [rbp + 0x20]
lea rdi, [rcx + rax*8 + 0x18]
lea rsi, [rcx + 8]
movsq qword [rdi], qword [rsi]
movsq qword [rdi], qword [rsi]
mov eax, dword [rbp + 0x2c]
add eax, 1
mov dword [rbp + 0x2c], eax
mov eax, dword [rbp + 0x2c]
cmp eax, 0x10
jne 0x6ec603
nop
lea rsp, [rbp + 0x58]
pop rbx
pop rsi
pop rdi
pop r13
pop r14
pop rbp
ret
Function at 0x6ecd80
Capabilities:
Encode data using xor

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x78
mov rbp, rsp
mov qword [rbp + 0x28], rdx
mov qword [rbp + 0xa0], rcx
mov qword [rbp + 0xb0], r8
mov qword [rbp + 0xb8], r9
mov rcx, qword [rbp + 0xb0]
call fcn.00415230
mov rcx, qword [rbp + 0xb8]
call fcn.00415230
nop
mov rax, qword [rbp + 0xa0]
lea rdi, [rbp + 0x58]
lea rsi, [rax + 8]
movsq qword [rdi], qword [rsi]
movsq qword [rdi], qword [rsi]
mov rbx, qword [rbp + 0xb0]
mov rax, rbx
test rax, rax
je 0x6ecde3
mov rax, qword [rax - 8]
mov rcx, rbp
mov rdx, qword [rbp + 0xb0]
mov r8d, eax
call fcn.006ecaf0
mov rax, qword [rbp + 0xb8]
test rax, rax
je 0x6ece05
mov rax, qword [rax - 8]
movsxd rcx, dword [rbp + 0xc0]
cmp rax, rcx
jge 0x6ece2a
lea rcx, [0x006ecfc4]
lea rdx, [0x006ecff4]
mov r8d, 0x244
call fcn.004107d0
mov rcx, rbp
mov rdx, qword [rbp + 0xb8]
mov r8d, dword [rbp + 0xc0]
call fcn.006ecaf0
mov rax, rbx
test rax, rax
je 0x6ece4c
mov rax, qword [rax - 8]
add rax, rax
add rax, rax
add rax, rax
mov ecx, dword [rbp + 0xc0]
add ecx, ecx
add ecx, ecx
add ecx, ecx
movsxd rcx, ecx
lea r8, [rbp + 0x48]
mov rdx, qword [rbp + 0xa0]
lea rdi, [rbp + 0x48]
lea rsi, [rdx + 8]
movsq qword [rdi], qword [rsi]
movsq qword [rdi], qword [rsi]
mov edx, 7
movsxd r9, edx
mov r10, rax
and r10, 0xff
mov byte [r8 + r9], r10b
shr rax, 8
sub edx, 1
test rax, rax
jne 0x6ece80
mov edx, 0xf
movsxd rax, edx
mov r9, rcx
and r9, 0xff
mov byte [r8 + rax], r9b
shr rcx, 8
sub edx, 1
test rcx, rcx
jne 0x6ecea2
mov rax, qword [rbp + 0x48]
xor rax, qword [rbp + 0x58]
mov qword [rbp + 0x38], rax
mov rax, qword [rbp + 0x50]
xor rax, qword [rbp + 0x60]
mov qword [rbp + 0x40], rax
lea rax, [rbp + 0x38]
mov qword [rbp + 0x30], rax
mov rcx, qword [rbp + 0x30]
mov rax, qword [rbp + 0xa0]
movzx rdx, byte [rcx]
add rdx, rdx
mov rdi, qword [rbp + 0x28]
lea rsi, [rax + rdx*8 + 0x18]
movsq qword [rdi], qword [rsi]
movsq qword [rdi], qword [rsi]
mov eax, 1
movsxd rdx, eax
mov r8, qword [rbp + 0xa0]
mov r9, rdx
shl r9, 9
lea r8, [r8 + r9*8 + 0x18]
movzx r9, byte [rcx + rdx]
add r9, r9
mov r8, qword [r8 + r9*8]
mov r9, qword [rbp + 0x28]
xor qword [r9], r8
mov r8, qword [rbp + 0xa0]
mov r9, rdx
shl r9, 9
lea r8, [r8 + r9*8 + 0x20]
movzx rdx, byte [rcx + rdx]
add rdx, rdx
mov rdx, qword [r8 + rdx*8]
mov r8, qword [rbp + 0x28]
xor qword [r8 + 8], rdx
add eax, 1
cmp eax, 0x10
jne 0x6ecf03
nop
nop
lea rcx, [rbp + 0xb0]
mov rdx, qword [0x00406570]
mov r8d, 2
call fcn.004132f0
mov rax, qword [rbp + 0x28]
lea rsp, [rbp + 0x78]
pop rbx
pop rsi
pop rdi
pop rbp
ret
Function at 0x6ed0b0
Capabilities:
Encode data using xor

Disassembly:
push rbp
push r13
push rdi
push rsi
push rbx
sub rsp, 0x90
mov rbp, rsp
mov qword [rbp + 0x30], rcx
mov dword [rbp + 0x3c], r9d
mov qword [rbp + 0xc8], rdx
mov qword [rbp + 0xd0], r8
mov rcx, qword [rbp + 0xc8]
call fcn.00415230
mov rcx, qword [rbp + 0xd0]
call fcn.00415230
nop
xor ebx, ebx
mov r13d, dword [rbp + 0x3c]
test r13d, r13d
jns 0x6ed0fe
add r13d, 0xf
sar r13d, 4
movsxd r13, r13d
mov ecx, 1
mov rax, rcx
cmp rax, r13
ja 0x6ed18a
sub r13, rcx
add r13, 1
mov rax, qword [rbp + 0x30]
mov rcx, rax
lea rdx, [rax + 0x10028]
call fcn.006ec780
mov rax, qword [rbp + 0x30]
mov rax, qword [rbp + 0xc8]
lea rsi, [rax + rbx]
mov rcx, qword [rbp + 0x30]
lea rdx, [rbp + 0x70]
mov rax, qword [rbp + 0x30]
lea r8, [rax + 0x10028]
call fcn.006ed590
mov rax, qword [rsi]
xor rax, qword [rbp + 0x70]
mov qword [rbp + 0x60], rax
mov rax, qword [rsi + 8]
xor rax, qword [rbp + 0x78]
mov qword [rbp + 0x68], rax
mov rax, qword [rbp + 0xd0]
lea rdi, [rax + rbx]
lea rsi, [rbp + 0x60]
movsq qword [rdi], qword [rsi]
movsq qword [rdi], qword [rsi]
add rbx, 0x10
sub r13, 1
test r13, r13
jne 0x6ed119
nop
mov eax, dword [rbp + 0x3c]
movsxd rax, eax
test rax, rax
jl 0x6ed19f
cmp rbx, rax
jae 0x6ed19f
mov al, 1
jmp 0x6ed1a1
xor eax, eax
test al, al
je 0x6ed22c
mov rax, qword [rbp + 0x30]
mov rcx, rax
lea rdx, [rax + 0x10028]
call fcn.006ec780
mov rax, qword [rbp + 0x30]
mov rsi, rbx
mov rcx, qword [rbp + 0x30]
lea rdx, [rbp + 0x50]
mov rax, qword [rbp + 0x30]
lea r8, [rax + 0x10028]
call fcn.006ed590
lea rcx, [rbp + 0x50]
xor edx, edx
mov r8d, dword [rbp + 0x3c]
movsxd r8, r8d
sub r8, rbx
sub r8d, 1
mov eax, edx
cmp eax, r8d
jg 0x6ed22b
sub r8d, edx
add r8d, 1
mov rdx, qword [rbp + 0xd0]
mov r9, qword [rbp + 0xc8]
movsxd r10, eax
movzx r9, byte [r9 + rsi]
xor r9b, byte [rcx + r10]
mov byte [rdx + rsi], r9b
add rsi, 1
add eax, 1
sub r8d, 1
test r8d, r8d
jne 0x6ed1fd
nop
mov rcx, qword [rbp + 0x30]
lea rdx, [rbp + 0x40]
mov rax, qword [rbp + 0x30]
mov r8, qword [rax + 0x10048]
mov r9, qword [rbp + 0xc8]
mov eax, dword [rbp + 0x3c]
mov dword [rsp + 0x20], eax
call fcn.006ecd80
mov rax, qword [rbp + 0x30]
lea rax, [rax + 0x10038]
mov rcx, qword [rbp + 0x40]
xor rcx, qword [rax]
mov qword [rbp + 0x80], rcx
mov rcx, qword [rbp + 0x48]
xor rcx, qword [rax + 8]
mov qword [rbp + 0x88], rcx
mov rax, qword [rbp + 0x30]
lea rcx, [rax + 0x10058]
mov rdx, qword [0x00406570]
mov r8d, 1
mov rax, qword [rbp + 0x30]
mov r9d, dword [rax + 0x10050]
call fcn.00414f90
lea rcx, [rbp + 0x80]
mov rax, qword [rbp + 0x30]
mov rdx, qword [rax + 0x10058]
mov rax, qword [rbp + 0x30]
mov r8d, dword [rax + 0x10050]
call fcn.00409690
nop
lea rcx, [rbp + 0xc8]
mov rdx, qword [0x00406570]
mov r8d, 2
call fcn.004132f0
lea rsp, [rbp + 0x90]
pop rbx
pop rsi
pop rdi
pop r13
pop rbp
ret
Function at 0x6ed320
Capabilities:
Encode data using xor

Disassembly:
push rbp
push r13
push rdi
push rsi
push rbx
sub rsp, 0x90
mov rbp, rsp
mov qword [rbp + 0x30], rcx
mov dword [rbp + 0x3c], r9d
mov qword [rbp + 0xc8], rdx
mov qword [rbp + 0xd0], r8
mov rcx, qword [rbp + 0xc8]
call fcn.00415230
mov rcx, qword [rbp + 0xd0]
call fcn.00415230
nop
xor ebx, ebx
mov r13d, dword [rbp + 0x3c]
test r13d, r13d
jns 0x6ed36e
add r13d, 0xf
sar r13d, 4
movsxd r13, r13d
mov ecx, 1
mov rax, rcx
cmp rax, r13
ja 0x6ed3fa
sub r13, rcx
add r13, 1
mov rax, qword [rbp + 0x30]
mov rcx, rax
lea rdx, [rax + 0x10028]
call fcn.006ec780
mov rax, qword [rbp + 0x30]
mov rax, qword [rbp + 0xc8]
lea rsi, [rax + rbx]
mov rcx, qword [rbp + 0x30]
lea rdx, [rbp + 0x70]
mov rax, qword [rbp + 0x30]
lea r8, [rax + 0x10028]
call fcn.006ed590
mov rax, qword [rsi]
xor rax, qword [rbp + 0x70]
mov qword [rbp + 0x60], rax
mov rax, qword [rsi + 8]
xor rax, qword [rbp + 0x78]
mov qword [rbp + 0x68], rax
mov rax, qword [rbp + 0xd0]
lea rdi, [rax + rbx]
lea rsi, [rbp + 0x60]
movsq qword [rdi], qword [rsi]
movsq qword [rdi], qword [rsi]
add rbx, 0x10
sub r13, 1
test r13, r13
jne 0x6ed389
nop
mov eax, dword [rbp + 0x3c]
movsxd rax, eax
test rax, rax
jl 0x6ed40f
cmp rbx, rax
jae 0x6ed40f
mov al, 1
jmp 0x6ed411
xor eax, eax
test al, al
je 0x6ed49c
mov rax, qword [rbp + 0x30]
mov rcx, rax
lea rdx, [rax + 0x10028]
call fcn.006ec780
mov rax, qword [rbp + 0x30]
mov rsi, rbx
mov rcx, qword [rbp + 0x30]
lea rdx, [rbp + 0x50]
mov rax, qword [rbp + 0x30]
lea r8, [rax + 0x10028]
call fcn.006ed590
lea rcx, [rbp + 0x50]
xor edx, edx
mov r8d, dword [rbp + 0x3c]
movsxd r8, r8d
sub r8, rbx
sub r8d, 1
mov eax, edx
cmp eax, r8d
jg 0x6ed49b
sub r8d, edx
add r8d, 1
mov rdx, qword [rbp + 0xd0]
mov r9, qword [rbp + 0xc8]
movsxd r10, eax
movzx r9, byte [r9 + rsi]
xor r9b, byte [rcx + r10]
mov byte [rdx + rsi], r9b
add rsi, 1
add eax, 1
sub r8d, 1
test r8d, r8d
jne 0x6ed46d
nop
mov rcx, qword [rbp + 0x30]
lea rdx, [rbp + 0x40]
mov rax, qword [rbp + 0x30]
mov r8, qword [rax + 0x10048]
mov r9, qword [rbp + 0xd0]
mov eax, dword [rbp + 0x3c]
mov dword [rsp + 0x20], eax
call fcn.006ecd80
mov rax, qword [rbp + 0x30]
lea rax, [rax + 0x10038]
mov rcx, qword [rbp + 0x40]
xor rcx, qword [rax]
mov qword [rbp + 0x80], rcx
mov rcx, qword [rbp + 0x48]
xor rcx, qword [rax + 8]
mov qword [rbp + 0x88], rcx
mov rax, qword [rbp + 0x30]
lea rcx, [rax + 0x10058]
mov rdx, qword [0x00406570]
mov r8d, 1
mov rax, qword [rbp + 0x30]
mov r9d, dword [rax + 0x10050]
call fcn.00414f90
lea rcx, [rbp + 0x80]
mov rax, qword [rbp + 0x30]
mov rdx, qword [rax + 0x10058]
mov rax, qword [rbp + 0x30]
mov r8d, dword [rax + 0x10050]
call fcn.00409690
nop
lea rcx, [rbp + 0xc8]
mov rdx, qword [0x00406570]
mov r8d, 2
call fcn.004132f0
lea rsp, [rbp + 0x90]
pop rbx
pop rsi
pop rdi
pop r13
pop rbp
ret
Function at 0x6f8ca0
Capabilities:
Encode data using xor

Disassembly:
mov eax, r9d
and eax, 0xff
imul eax, eax, 0x1010101
xor ecx, ecx
mov r9d, ecx
mov r10d, dword [r8 + r9*4]
xor r10d, eax
mov dword [rdx + r9*4], r10d
add ecx, 1
cmp ecx, 0x40
jne 0x6f8cb1
nop
ret

Function at 0x6f8cd0
Capabilities:
Encode data using xor
Encrypt data using twofish

Disassembly:
push rbp
push rsi
push rbx
sub rsp, 0x120
mov rbp, rsp
mov rbx, rcx
mov rcx, rbx
lea rdx, [rbp + 0x20]
mov r8, qword [0x0078ef20]
mov r9d, dword [rbx + 0x34]
call fcn.006f8ca0
movzx rax, byte [rbx + 0x30]
xor ecx, ecx
lea rdx, [rbp + 0x20]
mov r8, qword [rbx + 0x20]
movsxd r9, ecx
mov r10, qword [0x0078f938]
mov r11, qword [0x0078ef20]
movzx rsi, byte [rdx]
movzx r11, byte [r11 + rsi]
xor r11d, eax
movsxd r11, r11d
mov r10d, dword [r10 + r11*4]
mov dword [r8 + r9*4], r10d
add ecx, 1
add rdx, 1
cmp ecx, 0x100
jne 0x6f8d02
nop
mov rcx, rbx
lea rdx, [rbp + 0x20]
mov rax, qword [0x0078ef20]
lea r8, [rax + 0x100]
mov r9d, dword [rbx + 0x34]
shr r9d, 8
call fcn.006f8ca0
movzx rax, byte [rbx + 0x31]
xor ecx, ecx
lea rdx, [rbp + 0x20]
mov r8, qword [rbx + 0x20]
movsxd r9, ecx
mov r10, qword [0x0078f938]
mov r11, qword [0x0078ef20]
movzx rsi, byte [rdx]
movzx r11, byte [r11 + rsi]
xor r11d, eax
movsxd r11, r11d
mov r10d, dword [r10 + r11*4 + 0x400]
mov dword [r8 + r9*4 + 0x400], r10d
add ecx, 1
add rdx, 1
cmp ecx, 0x100
jne 0x6f8d6b
nop
mov rcx, rbx
lea rdx, [rbp + 0x20]
mov r8, qword [0x0078ef20]
mov r9d, dword [rbx + 0x34]
shr r9d, 0x10
call fcn.006f8ca0
movzx rax, byte [rbx + 0x32]
xor ecx, ecx
lea rdx, [rbp + 0x20]
mov r8, qword [rbx + 0x20]
movsxd r9, ecx
mov r10, qword [0x0078f938]
mov r11, qword [0x0078ef20]
movzx rsi, byte [rdx]
movzx r11, byte [r11 + rsi + 0x100]
xor r11d, eax
movsxd r11, r11d
mov r10d, dword [r10 + r11*4 + 0x800]
mov dword [r8 + r9*4 + 0x800], r10d
add ecx, 1
add rdx, 1
cmp ecx, 0x100
jne 0x6f8dd5
nop
mov rcx, rbx
lea rdx, [rbp + 0x20]
mov rax, qword [0x0078ef20]
lea r8, [rax + 0x100]
mov r9d, dword [rbx + 0x34]
shr r9d, 0x18
call fcn.006f8ca0
movzx rax, byte [rbx + 0x33]
xor ecx, ecx
lea rdx, [rbp + 0x20]
mov r8, qword [rbx + 0x20]
movsxd r9, ecx
mov r10, qword [0x0078f938]
mov r11, qword [0x0078ef20]
movzx rsi, byte [rdx]
movzx r11, byte [r11 + rsi + 0x100]
xor r11d, eax
movsxd r11, r11d
mov r10d, dword [r10 + r11*4 + 0xc00]
mov dword [r8 + r9*4 + 0xc00], r10d
add ecx, 1
add rdx, 1
cmp ecx, 0x100
jne 0x6f8e4a
nop
lea rsp, [rbp + 0x120]
pop rbx
pop rsi
pop rbp
ret
Function at 0x6f8ea0
Capabilities:
Encode data using xor
Encrypt data using twofish

Disassembly:
push rbp
push r13
push rdi
push rsi
push rbx
sub rsp, 0x120
mov rbp, rsp
mov rbx, rcx
mov rcx, rbx
lea rdx, [rbp + 0x20]
mov rax, qword [0x0078ef20]
lea r8, [rax + 0x100]
mov r9d, dword [rbx + 0x38]
call fcn.006f8ca0
movzx rax, byte [rbx + 0x30]
movzx rcx, byte [rbx + 0x34]
xor edx, edx
lea r8, [rbp + 0x20]
mov r9, qword [rbx + 0x20]
movsxd r10, edx
mov r11, qword [0x0078f938]
mov rsi, qword [0x0078ef20]
mov rdi, qword [0x0078ef20]
movzx r13, byte [r8]
movzx rdi, byte [rdi + r13]
xor edi, ecx
movsxd rdi, edi
movzx rsi, byte [rsi + rdi]
xor esi, eax
movsxd rsi, esi
mov r11d, dword [r11 + rsi*4]
mov dword [r9 + r10*4], r11d
add edx, 1
add r8, 1
cmp edx, 0x100
jne 0x6f8ee1
nop
mov rcx, rbx
lea rdx, [rbp + 0x20]
mov rax, qword [0x0078ef20]
lea r8, [rax + 0x100]
mov r9d, dword [rbx + 0x38]
shr r9d, 8
call fcn.006f8ca0
movzx rax, byte [rbx + 0x31]
movzx rcx, byte [rbx + 0x35]
xor edx, edx
lea r8, [rbp + 0x20]
mov r9, qword [rbx + 0x20]
movsxd r10, edx
mov r11, qword [0x0078f938]
mov rsi, qword [0x0078ef20]
mov rdi, qword [0x0078ef20]
movzx r13, byte [r8]
movzx rdi, byte [rdi + r13 + 0x100]
xor edi, ecx
movsxd rdi, edi
movzx rsi, byte [rsi + rdi]
xor esi, eax
movsxd rsi, esi
mov r11d, dword [r11 + rsi*4 + 0x400]
mov dword [r9 + r10*4 + 0x400], r11d
add edx, 1
add r8, 1
cmp edx, 0x100
jne 0x6f8f5f
nop
mov rcx, rbx
lea rdx, [rbp + 0x20]
mov r8, qword [0x0078ef20]
mov r9d, dword [rbx + 0x38]
shr r9d, 0x10
call fcn.006f8ca0
movzx rax, byte [rbx + 0x32]
movzx rcx, byte [rbx + 0x36]
xor edx, edx
lea r8, [rbp + 0x20]
mov r9, qword [rbx + 0x20]
movsxd r10, edx
mov r11, qword [0x0078f938]
mov rsi, qword [0x0078ef20]
mov rdi, qword [0x0078ef20]
movzx r13, byte [r8]
movzx rdi, byte [rdi + r13]
xor edi, ecx
movsxd rdi, edi
movzx rsi, byte [rsi + rdi + 0x100]
xor esi, eax
movsxd rsi, esi
mov r11d, dword [r11 + rsi*4 + 0x800]
mov dword [r9 + r10*4 + 0x800], r11d
add edx, 1
add r8, 1
cmp edx, 0x100
jne 0x6f8fe2
nop
mov rcx, rbx
lea rdx, [rbp + 0x20]
mov r8, qword [0x0078ef20]
mov r9d, dword [rbx + 0x38]
shr r9d, 0x18
call fcn.006f8ca0
movzx rax, byte [rbx + 0x33]
movzx rcx, byte [rbx + 0x37]
xor edx, edx
lea r8, [rbp + 0x20]
mov r9, qword [rbx + 0x20]
movsxd r10, edx
mov r11, qword [0x0078f938]
mov rsi, qword [0x0078ef20]
mov rdi, qword [0x0078ef20]
movzx r13, byte [r8]
movzx rdi, byte [rdi + r13 + 0x100]
xor edi, ecx
movsxd rdi, edi
movzx rsi, byte [rsi + rdi + 0x100]
xor esi, eax
movsxd rsi, esi
mov r11d, dword [r11 + rsi*4 + 0xc00]
mov dword [r9 + r10*4 + 0xc00], r11d
add edx, 1
add r8, 1
cmp edx, 0x100
jne 0x6f9065
nop
lea rsp, [rbp + 0x120]
pop rbx
pop rsi
pop rdi
pop r13
pop rbp
ret
Function at 0x6f9db0
Capabilities:
Encode data using xor

Disassembly:
push r14
push r13
push rdi
push rsi
push rbx
sub rsp, 0x40
mov rbx, rcx
mov qword [rsp + 0x28], rdx
mov qword [rsp + 0x30], r8
mov ecx, dword [rbx]
call fcn.006e8bc0
mov esi, eax
shr esi, 0x10
mov edi, eax
and edi, 0xffff
mov ecx, dword [rbx + 4]
call fcn.006e8bc0
mov ebx, eax
shr ebx, 0x10
mov r13d, eax
and r13d, 0xffff
mov r14d, 8
mov ecx, esi
mov rax, qword [rsp + 0x30]
movzx edx, word [rax]
call fcn.006f9d70
mov esi, eax
mov rax, qword [rsp + 0x30]
movzx eax, word [rax + 2]
add edi, eax
mov rax, qword [rsp + 0x30]
movzx eax, word [rax + 4]
add ebx, eax
mov ecx, r13d
mov rax, qword [rsp + 0x30]
movzx edx, word [rax + 6]
call fcn.006f9d70
mov r13d, eax
mov eax, ebx
xor eax, esi
mov ecx, eax
mov rax, qword [rsp + 0x30]
movzx edx, word [rax + 8]
call fcn.006f9d70
mov dword [rsp + 0x3c], eax
mov eax, edi
xor eax, r13d
mov ecx, dword [rsp + 0x3c]
add eax, ecx
mov ecx, eax
mov rax, qword [rsp + 0x30]
movzx edx, word [rax + 0xa]
call fcn.006f9d70
mov ecx, dword [rsp + 0x3c]
add ecx, eax
mov dword [rsp + 0x3c], ecx
xor esi, eax
mov ecx, dword [rsp + 0x3c]
xor r13d, ecx
xor ecx, edi
mov dword [rsp + 0x3c], ecx
mov edi, ebx
xor edi, eax
mov ebx, dword [rsp + 0x3c]
mov rax, qword [rsp + 0x30]
add rax, 0xc
mov qword [rsp + 0x30], rax
sub r14d, 1
test r14d, r14d
jne 0x6f9df9
nop
mov ecx, esi
mov rax, qword [rsp + 0x30]
movzx edx, word [rax]
call fcn.006f9d70
mov ecx, eax
shl ecx, 0x10
mov rax, qword [rsp + 0x30]
movzx eax, word [rax + 2]
add ebx, eax
and ebx, 0xffff
or ecx, ebx
call fcn.006e8bc0
mov rcx, qword [rsp + 0x28]
mov dword [rcx], eax
mov ecx, r13d
mov rax, qword [rsp + 0x30]
movzx edx, word [rax + 6]
call fcn.006f9d70
mov rcx, qword [rsp + 0x30]
movzx ecx, word [rcx + 4]
add edi, ecx
shl edi, 0x10
and eax, 0xffff
or edi, eax
mov ecx, edi
call fcn.006e8bc0
mov rcx, qword [rsp + 0x28]
mov dword [rcx + 4], eax
add rsp, 0x40
pop rbx
pop rsi
pop rdi
pop r13
pop r14
ret
Function at 0x6fd430
Capabilities:
Encode data using add xor sub operations
Encode data using xor
Encrypt data using aes
Reference aes constants

Disassembly:
push rsi
push rbx
sub rsp, 0x28
mov rbx, rcx
mov rax, qword [rbx + 0x58]
mov ecx, dword [rbx + 0x50]
shr ecx, 1
movsxd rdx, ecx
lea rsi, [rax + rdx]
mov rdx, rsi
movsxd r8, ecx
mov rcx, rax
call fcn.00409690
add rsi, 0x10
xor ecx, ecx
mov edx, dword [rbx + 0x80]
add edx, edx
add edx, edx
sub edx, 5
mov eax, ecx
cmp eax, edx
jg 0x6fd52d
sub edx, ecx
add edx, 1
mov eax, dword [rsi]
mov rcx, qword [0x0078fbb0]
mov r8, qword [0x0078f1c8]
mov r9d, eax
and r9d, 0xff
mov r9d, r9d
movzx r8, byte [r8 + r9]
mov r9, qword [0x0078fbb0]
mov r10, qword [0x0078f1c8]
mov r11d, eax
shr r11d, 8
and r11d, 0xff
mov r11d, r11d
movzx r10, byte [r10 + r11]
mov ecx, dword [rcx + r8*4 + 0x1000]
xor ecx, dword [r9 + r10*4 + 0x1400]
mov r8, qword [0x0078fbb0]
mov r9, qword [0x0078f1c8]
mov r10d, eax
shr r10d, 0x10
and r10d, 0xff
mov r10d, r10d
movzx r9, byte [r9 + r10]
xor ecx, dword [r8 + r9*4 + 0x1800]
mov r8, qword [0x0078fbb0]
mov r9, qword [0x0078f1c8]
shr eax, 0x18
mov eax, eax
movzx rax, byte [r9 + rax]
xor ecx, dword [r8 + rax*4 + 0x1c00]
mov dword [rsi], ecx
add rsi, 4
sub edx, 1
test edx, edx
jne 0x6fd47a
nop
add rsp, 0x28
pop rbx
pop rsi
ret
Function at 0x7007c0
Capabilities:
Encrypt data using des

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x118
mov rbp, rsp
mov rbx, rdx
mov rsi, r9
lea rcx, [rbp + 0x20]
mov edx, 0x80
xor r8, r8
call fcn.0040c190
mov r8d, 0x38
mov rax, qword [0x0078f838]
lea rdx, [rbp + 0xd8]
movzx rcx, byte [rax]
movzx r9, cl
shr r9d, 3
mov r9d, r9d
movzx r9, byte [rbx + r9]
mov r10d, 0x80
and cl, 7
shr r10d, cl
test r10d, r9d
je 0x700823
mov byte [rdx], 1
jmp 0x700826
mov byte [rdx], 0
add rdx, 1
add rax, 1
sub r8d, 1
test r8d, r8d
jne 0x7007f9
nop
xor eax, eax
lea r10, [0x0078c66c]
cmp byte [rbp + 0x160], 0
je 0x700858
mov r8d, 0xf
sub r8d, eax
add r8d, r8d
jmp 0x70085e
mov r8d, eax
add r8d, r8d
mov r9d, r8d
add r9d, 1
xor ecx, ecx
lea r11, [rbp + 0xa0]
movzx rdx, byte [r10]
mov ebx, ecx
add ebx, edx
mov edx, ebx
cmp edx, 0x1c
jae 0x70088d
mov edx, edx
movzx rdx, byte [rdx + rbp + 0xd8]
mov byte [r11], dl
jmp 0x70089e
sub edx, 0x1c
mov edx, edx
movzx rdx, byte [rdx + rbp + 0xd8]
mov byte [r11], dl
add ecx, 1
add r11, 1
cmp ecx, 0x1c
jne 0x70086e
nop
mov ecx, 0x1c
lea r11, [rbp + 0xbc]
movzx rdx, byte [r10]
mov ebx, ecx
add ebx, edx
mov edx, ebx
cmp edx, 0x38
jae 0x7008d6
mov edx, edx
movzx rdx, byte [rdx + rbp + 0xd8]
mov byte [r11], dl
jmp 0x7008e7
sub edx, 0x1c
mov edx, edx
movzx rdx, byte [rdx + rbp + 0xd8]
mov byte [r11], dl
add ecx, 1
add r11, 1
cmp ecx, 0x38
jne 0x7008b7
nop
mov edx, 0x1000000
xor ecx, ecx
mov r11, qword [0x0078f8e8]
shr edx, 1
movzx rbx, byte [r11]
cmp byte [rbx + rbp + 0xa0], 0
je 0x70091d
mov ebx, r8d
lea rbx, [rbp + rbx*4 + 0x20]
or dword [rbx], edx
mov rbx, qword [0x0078f8e8]
mov edi, ecx
add edi, 0x18
mov edi, edi
movzx rbx, byte [rbx + rdi]
cmp byte [rbx + rbp + 0xa0], 0
je 0x700944
mov ebx, r9d
lea rbx, [rbp + rbx*4 + 0x20]
or dword [rbx], edx
add ecx, 1
add r11, 1
cmp ecx, 0x18
jne 0x700902
nop
add eax, 1
add r10, 1
cmp eax, 0x10
jne 0x700841
nop
xor eax, eax
mov r8d, eax
add r8d, r8d
mov r9d, r8d
add r9d, 1
mov r8d, r8d
mov ecx, dword [rbp + r8*4 + 0x20]
mov r9d, r9d
mov edx, dword [rbp + r9*4 + 0x20]
mov r10d, ecx
and r10d, 0xfc0000
shl r10d, 6
and ecx, 0xfc0
shl ecx, 0xa
or r10d, ecx
mov ecx, edx
and ecx, 0xfc0000
shr ecx, 0xa
or r10d, ecx
and edx, 0xfc0
shr edx, 6
or r10d, edx
mov dword [rsi], r10d
mov ecx, dword [rbp + r8*4 + 0x20]
mov edx, dword [rbp + r9*4 + 0x20]
mov r8d, ecx
and r8d, 0x3f000
shl r8d, 0xc
and ecx, 0x3f
shl ecx, 0x10
or r8d, ecx
mov ecx, edx
and ecx, 0x3f000
shr ecx, 4
or r8d, ecx
and edx, 0x3f
or r8d, edx
mov dword [rsi + 4], r8d
add rsi, 8
add eax, 1
cmp eax, 0x10
jne 0x700964
nop
lea rcx, [rbp + 0x20]
mov edx, 0x80
call fcn.006e8c90
lea rcx, [rbp + 0xd8]
mov edx, 0x38
call fcn.006e8c90
lea rcx, [rbp + 0xa0]
mov edx, 0x38
call fcn.006e8c90
lea rsp, [rbp + 0x118]
pop rbx
pop rsi
pop rdi
pop rbp
ret
Function at 0x7054e0
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
push r14
push r13
push rdi
push rsi
push rbx
sub rsp, 0x10
mov qword [rsp + 8], rdx
movzx rax, byte [rcx]
movzx rdx, byte [rcx + 1]
movzx r9, byte [rcx + 2]
movzx r10, byte [rcx + 3]
movzx r11, byte [rcx + 4]
movzx rbx, byte [rcx + 5]
movzx rsi, byte [rcx + 6]
movzx rcx, byte [rcx + 7]
mov edi, 8
mov r13, qword [0x0078f7d8]
mov r14d, eax
xor r14b, byte [r8]
movzx r14, r14b
xor r11b, byte [r13 + r14]
mov r13, qword [0x0078f7d8]
mov r14d, edx
xor r14b, byte [r8 + 1]
movzx r14, r14b
xor bl, byte [r13 + r14]
mov r13, qword [0x0078f7d8]
mov r14d, r9d
xor r14b, byte [r8 + 2]
movzx r14, r14b
xor sil, byte [r13 + r14]
mov r13, qword [0x0078f7d8]
mov r14d, r10d
xor r14b, byte [r8 + 3]
movzx r14, r14b
xor cl, byte [r13 + r14]
mov r13, qword [0x0078f7d8]
mov r14d, r11d
xor r14b, byte [r8 + 4]
movzx r14, r14b
xor dl, byte [r13 + r14]
mov r13, qword [0x0078f7d8]
mov r14d, ebx
xor r14b, r11b
movzx r14, r14b
xor r9b, byte [r13 + r14]
mov r13, qword [0x0078f7d8]
mov r14d, esi
xor r14b, byte [r8 + 5]
movzx r14, r14b
xor r10b, byte [r13 + r14]
mov r13, qword [0x0078f7d8]
mov r14d, ecx
xor r14b, byte [r8 + 6]
movzx r14, r14b
xor al, byte [r13 + r14]
add r8, 7
sub edi, 1
test edi, edi
jne 0x70551c
nop
mov rdi, qword [0x0078f7d8]
mov r13d, eax
xor r13b, byte [r8]
movzx r13, r13b
xor r11b, byte [rdi + r13]
mov rdi, qword [0x0078f7d8]
mov r13d, edx
xor r13b, byte [r8 + 1]
movzx r13, r13b
xor bl, byte [rdi + r13]
mov rdi, qword [0x0078f7d8]
mov r13d, r9d
xor r13b, byte [r8 + 2]
movzx r13, r13b
xor sil, byte [rdi + r13]
mov rdi, qword [0x0078f7d8]
mov r13d, r10d
xor r13b, byte [r8 + 3]
movzx r13, r13b
xor cl, byte [rdi + r13]
mov r8, qword [rsp + 8]
mov byte [r8], al
mov byte [r8 + 1], dl
mov byte [r8 + 2], r9b
mov byte [r8 + 3], r10b
mov byte [r8 + 4], r11b
mov byte [r8 + 5], bl
mov byte [r8 + 6], sil
mov byte [r8 + 7], cl
add rsp, 0x10
pop rbx
pop rsi
pop rdi
pop r13
pop r14
ret

Function at 0x706ee0
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push rbp
mov rbp, rsp
mov rax, qword [rcx + 0x30]
mov r8, qword [rax + 0x58]
lea r9, [r8 + 0x100]
mov eax, 1
xor ecx, ecx
movsxd rdx, ecx
mov r10d, eax
and r10b, 0xff
mov byte [r8 + rdx], r10b
mov edx, eax
and edx, 0xff
movsxd rdx, edx
mov byte [r9 + rdx], cl
lea rax, [rax + rax*4]
lea rax, [rax + rax*8]
mov r10d, 0x101
cdq
idiv r10d
mov rax, rdx
add ecx, 1
cmp ecx, 0x100
jne 0x706efa
nop
mov rsp, rbp
pop rbp
ret