joyce8/EMBER2024-capa huggingface dataset:
Function at 0x7ff6d49a2b40
Capabilities:
Hash data with crc32

Disassembly:
mov r11, rsp
mov qword [r11 + 0x10], rbx
mov qword [r11 + 8], rcx
push rdi
sub rsp, 0x20
mov rax, qword [0x7ff6d4c707f8]
lea rdx, [0x7ff6d4a71180]
mov r8, rcx
mov rbx, qword [rax + 0x1c10]
add rbx, 0xc8
movsxd r9, dword [rbx]
mov rax, qword [rbx + 8]
mov edi, dword [rax + r9*4 - 4]
not edi
movzx eax, r8b
mov r8d, dword [rbx + 4]
movzx ecx, dil
xor rcx, rax
shr edi, 8
movzx eax, byte [r11 + 9]
xor edi, dword [rdx + rcx*4]
movzx ecx, dil
xor rcx, rax
shr edi, 8
movzx eax, byte [r11 + 0xa]
xor edi, dword [rdx + rcx*4]
movzx ecx, dil
xor rcx, rax
shr edi, 8
movzx eax, byte [r11 + 0xb]
xor edi, dword [rdx + rcx*4]
movzx ecx, dil
xor rcx, rax
shr edi, 8
movzx eax, byte [r11 + 0xc]
xor edi, dword [rdx + rcx*4]
movzx ecx, dil
xor rcx, rax
shr edi, 8
movzx eax, byte [r11 + 0xd]
xor edi, dword [rdx + rcx*4]
movzx ecx, dil
xor rcx, rax
shr edi, 8
movzx eax, byte [r11 + 0xe]
xor edi, dword [rdx + rcx*4]
movzx ecx, dil
xor rcx, rax
shr edi, 8
movzx eax, byte [r11 + 0xf]
xor edi, dword [rdx + rcx*4]
movzx ecx, dil
shr edi, 8
xor rcx, rax
xor edi, dword [rdx + rcx*4]
not edi
cmp r9d, r8d
jne 0x7ff6d49a2c41
lea ecx, [r9 + 1]
test r8d, r8d
je 0x7ff6d49a2c2d
mov eax, r8d
cdq
sub eax, edx
sar eax, 1
add eax, r8d
jmp 0x7ff6d49a2c32
mov eax, 8
cmp eax, ecx
cmovg ecx, eax
mov edx, ecx
mov rcx, rbx
call fcn.7ff6d49b4f00
movsxd rcx, dword [rbx]
mov rax, qword [rbx + 8]
mov dword [rax + rcx*4], edi
inc dword [rbx]
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret

Function at 0x7ff6d49a2c60
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 0x10], rbx
mov dword [rsp + 8], ecx
push rdi
sub rsp, 0x20
mov rax, qword [0x7ff6d4c707f8]
lea rdx, [0x7ff6d4a71180]
mov r8d, ecx
mov rbx, qword [rax + 0x1c10]
add rbx, 0xc8
movsxd r9, dword [rbx]
mov rax, qword [rbx + 8]
mov edi, dword [rax + r9*4 - 4]
not edi
movzx eax, r8b
mov r8d, dword [rbx + 4]
movzx ecx, dil
xor rcx, rax
shr edi, 8
movzx eax, byte [rsp + 0x31]
xor edi, dword [rdx + rcx*4]
movzx ecx, dil
xor rcx, rax
shr edi, 8
movzx eax, byte [rsp + 0x32]
xor edi, dword [rdx + rcx*4]
movzx ecx, dil
xor rcx, rax
shr edi, 8
movzx eax, byte [rsp + 0x33]
xor edi, dword [rdx + rcx*4]
movzx ecx, dil
shr edi, 8
xor rcx, rax
xor edi, dword [rdx + rcx*4]
not edi
cmp r9d, r8d
jne 0x7ff6d49a2d17
lea ecx, [r9 + 1]
test r8d, r8d
je 0x7ff6d49a2d03
mov eax, r8d
cdq
sub eax, edx
sar eax, 1
add eax, r8d
jmp 0x7ff6d49a2d08
mov eax, 8
cmp eax, ecx
cmovg ecx, eax
mov edx, ecx
mov rcx, rbx
call fcn.7ff6d49b4f00
movsxd rcx, dword [rbx]
mov rax, qword [rbx + 8]
mov dword [rax + rcx*4], edi
inc dword [rbx]
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x7ff6d49a4d60
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
mov rax, qword [0x7ff6d4c6b040]
xor rax, rsp
mov qword [rsp + 0x30], rax
mov rbx, qword [0x7ff6d4c707f8]
mov edi, edx
cmp byte [rbx + 0x1f7d], 0
jne 0x7ff6d49a4dc0
cmp byte [rbx + 0x1f7e], 0
jne 0x7ff6d49a4dc0
mov r9d, dword [rbx + 0x305c]
lea r8, str.Tooltip__02d
mov edx, 0x10
lea rcx, [rsp + 0x20]
call fcn.7ff6d49908a0
test dil, 1
je 0x7ff6d49a4ede
jmp 0x7ff6d49a4e48
movss xmm1, dword [rbx + 0x1618]
lea r8, str.Tooltip__02d
mov r9d, dword [rbx + 0x305c]
lea rcx, [rsp + 0x20]
movaps xmm0, xmm1
xor eax, eax
mulss xmm0, dword [0x7ff6d4c567b0]
mulss xmm1, dword [0x7ff6d4c5678c]
lea edx, [rax + 0x10]
addss xmm0, dword [rbx + 0x128]
addss xmm1, dword [rbx + 0x12c]
mov qword [rbx + 0x1d20], rax
mov dword [rbx + 0x1d0c], 1
movss dword [rbx + 0x1d18], xmm0
movss dword [rbx + 0x1d1c], xmm1
movss xmm0, dword [rbx + 0x1674]
mulss xmm0, dword [0x7ff6d4c5665c]
or dword [rbx + 0x1d08], 0x41
movss dword [rbx + 0x1d68], xmm0
call fcn.7ff6d49908a0
movzx r9d, byte [rsp + 0x20]
lea r8, [rsp + 0x21]
mov r10d, 0xffffffff
mov ecx, r10d
test r9b, r9b
je 0x7ff6d49a4e98
lea r11, [0x7ff6d4a71180]
cmp r9b, 0x23
jne 0x7ff6d49a4e7b
cmp byte [r8], r9b
jne 0x7ff6d49a4e7b
cmp byte [r8 + 1], r9b
cmove ecx, r10d
movzx edx, cl
movzx eax, r9b
movzx r9d, byte [r8]
xor rdx, rax
shr ecx, 8
inc r8
xor ecx, dword [r11 + rdx*4]
test r9b, r9b
jne 0x7ff6d49a4e68
not ecx
call fcn.7ff6d499c400
test rax, rax
je 0x7ff6d49a4ede
cmp byte [rax + 0x8e], 0
je 0x7ff6d49a4ede
mov byte [rax + 0x95], 1
lea r8, str.Tooltip__02d
mov byte [rax + 0xb0], 1
lea rcx, [rsp + 0x20]
inc dword [rbx + 0x305c]
mov edx, 0x10
mov r9d, dword [rbx + 0x305c]
call fcn.7ff6d49908a0
xor edx, edx
lea rcx, [rsp + 0x20]
mov r8d, 0x20c0347
call fcn.7ff6d499eed0
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.7ff6d4a69a50
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rdi
ret
Function at 0x7ff6d49f4c90
Capabilities:
Compute adler32 checksum

Disassembly:
mov qword [rsp + 0x20], rbx
push rsi
mov r10, rdx
mov eax, 0x5e6ea9af
mul r8d
mov ebx, r8d
xor r9d, r9d
shr edx, 0xb
mov esi, r8d
imul eax, edx, 0x15b0
mov ecx, 1
sub ebx, eax
test r8d, r8d
je 0x7ff6d49f4ddc
mov qword [rsp + 0x20], rdi
xor r11d, r11d
cmp ebx, 7
jbe 0x7ff6d49f4d3e
lea edx, [r11 + 7]
nop dword [rax]
nop dword [rax + rax]
movzx eax, byte [r10]
add r11d, 8
add ecx, eax
add edx, 8
movzx eax, byte [r10 + 1]
add r9d, ecx
add ecx, eax
movzx eax, byte [r10 + 2]
add r9d, ecx
add ecx, eax
movzx eax, byte [r10 + 3]
add r9d, ecx
add ecx, eax
movzx eax, byte [r10 + 4]
add r9d, ecx
add ecx, eax
movzx eax, byte [r10 + 5]
add r9d, ecx
add ecx, eax
movzx eax, byte [r10 + 6]
add r9d, ecx
add ecx, eax
movzx eax, byte [r10 + 7]
add r9d, ecx
add ecx, eax
add r10, 8
add r9d, ecx
cmp edx, ebx
jb 0x7ff6d49f4ce0
xor edx, edx
xor r8d, r8d
cmp r11d, ebx
jae 0x7ff6d49f4da4
mov eax, ebx
sub eax, r11d
cmp eax, 2
jb 0x7ff6d49f4d91
mov eax, ebx
sub eax, r11d
sub eax, 2
shr eax, 1
inc eax
mov edi, eax
lea r11d, [r11 + rax*2]
nop dword [rax]
nop dword [rax + rax]
movzx eax, byte [r10]
add ecx, eax
movzx eax, byte [r10 + 1]
add edx, ecx
add r10, 2
add ecx, eax
add r8d, ecx
sub rdi, 1
jne 0x7ff6d49f4d70
cmp r11d, ebx
jae 0x7ff6d49f4d9d
movzx eax, byte [r10]
add ecx, eax
add r9d, ecx
inc r10
lea eax, [r8 + rdx]
add r9d, eax
mov eax, 0x80078071
mul ecx
shr edx, 0xf
imul eax, edx, 0xffff000f
add ecx, eax
mov eax, 0x80078071
mul r9d
shr edx, 0xf
imul edx, edx, 0xffff000f
add r9d, edx
sub esi, ebx
mov ebx, 0x15b0
jne 0x7ff6d49f4cc8
mov rdi, qword [rsp + 0x20]
mov rbx, qword [rsp + 0x28]
shl r9d, 0x10
lea eax, [rcx + r9]
pop rsi
ret
Function at 0x7ff6d49fd650
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
mov r9, qword [rcx + 0x190]
mov r10, rcx
movsxd rax, edx
imul rbx, rax, 0x68
add rbx, qword [rcx + 0x18]
mov dword [rcx + 0x7c], edx
test dword [rbx], 0x10000
movss xmm0, dword [rbx + 0x34]
je 0x7ff6d49fd68c
addss xmm0, dword [rcx + 0x94]
lea rsi, [r9 + 0xd8]
movss dword [rsi], xmm0
movss xmm1, dword [rcx + 0xc8]
addss xmm1, dword [rcx + 0x84]
movss dword [r9 + 0xf0], xmm0
subss xmm0, dword [r9 + 0x10]
movss dword [r9 + 0xdc], xmm1
subss xmm0, dword [r9 + 0x118]
movss dword [r9 + 0x11c], xmm0
mov eax, dword [rcx + 0x90]
mov dword [r9 + 0x110], eax
movsx eax, byte [rbx + 0x62]
mov dword [r9 + 0x124], eax
movss dword [r9 + 0x204], xmm1
mov eax, dword [rbx + 0x34]
mov dword [r9 + 0x200], eax
mov eax, dword [rbx + 0x38]
mov dword [r9 + 0x208], eax
mov eax, dword [rbx + 0x3c]
mov dword [r9 + 0x194], eax
cmp byte [rbx + 0x5a], 0
jne 0x7ff6d49fd727
maxss xmm1, dword [rcx + 0x88]
movss dword [r9 + 0xdc], xmm1
movzx eax, byte [rbx + 0x60]
mov byte [r9 + 0x93], al
cmp byte [rbx + 0x60], 0
je 0x7ff6d49fd74d
mov rax, qword [0x7ff6d4c707f8]
xor ecx, ecx
mov dword [rax + 0x1cc8], ecx
mov dword [rax + 0x1cd0], ecx
test dword [r10 + 4], 0x100000
je 0x7ff6d49fd762
mov r8d, 2
jmp 0x7ff6d49fd7e2
movups xmm0, xmmword [rbx + 0x20]
mov rax, qword [r9 + 0x280]
movss xmm4, dword [rbx + 0x20]
movss xmm3, dword [rbx + 0x24]
movss xmm2, dword [rbx + 0x28]
movss xmm1, dword [rbx + 0x2c]
movups xmmword [r9 + 0x220], xmm0
movss dword [rsp + 0x20], xmm4
movss dword [rsp + 0x24], xmm3
movss dword [rsp + 0x28], xmm2
movss dword [rsp + 0x2c], xmm1
movss dword [rax + 0x88], xmm4
movss dword [rax + 0x8c], xmm3
movss dword [rax + 0x90], xmm2
movss dword [rax + 0x94], xmm1
mov rax, qword [r9 + 0x280]
movups xmm0, xmmword [rsp + 0x20]
movsxd rdx, dword [rax + 0x58]
mov rcx, qword [rax + 0x60]
add rdx, rdx
movups xmmword [rcx + rdx*8 - 0x10], xmm0
movzx r8d, byte [rbx + 0x57]
mov rdx, qword [r9 + 0x280]
mov rcx, qword [r10 + 0x1a8]
call fcn.7ff6d49ec860
mov rdi, qword [0x7ff6d4c707f8]
cmp byte [rdi + 0x30f4], 0
je 0x7ff6d49fd827
cmp byte [rbx + 0x60], 0
jne 0x7ff6d49fd827
xor r8d, r8d
lea rdx, [0x7ff6d4c54668]
mov rcx, rsi
call fcn.7ff6d49aa9c0
mov dword [rdi + 0x3128], 0x7f7fffff
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
Function at 0x7ff6d4a00380
Capabilities:
Hash data with crc32

Disassembly:
mov rax, qword [0x7ff6d4c707f8]
mov rdx, qword [rax + 0x2020]
cmp ecx, 0xffffffff
jne 0x7ff6d4a0039a
cmp dword [rdx + 0x7c], ecx
cmovne ecx, dword [rdx + 0x7c]
cmp ecx, dword [rdx + 0x74]
mov eax, 0xffffffff
cmove ecx, eax
test byte [rdx + 4], 7
je 0x7ff6d4a00419
mov r10d, dword [rdx]
lea r8, [0x7ff6d4c54659]
movzx eax, word [rdx + 0x80]
lea r11, [0x7ff6d4a71180]
not r10d
mov byte [rdx + 0x1f0], cl
mov ecx, r10d
mov byte [rdx + 0x1fe], 1
mov word [rdx + 0x82], ax
mov r9b, 0x23
cmp r9b, 0x23
jne 0x7ff6d4a003f3
cmp byte [r8], r9b
jne 0x7ff6d4a003f3
cmp byte [r8 + 1], r9b
cmove ecx, r10d
movzx edx, cl
movzx eax, r9b
movzx r9d, byte [r8]
xor rdx, rax
shr ecx, 8
inc r8
xor ecx, dword [r11 + rdx*4]
test r9b, r9b
jne 0x7ff6d4a003e0
not ecx
xor edx, edx
jmp fcn.7ff6d49a5160
ret
Function at 0x7ff6d4a1c980
Capabilities:
Hash data with crc32

Disassembly:
push rbx
push rbp
push rsi
sub rsp, 0x60
mov rbx, qword [0x7ff6d4c707f8]
mov rsi, rdx
mov rbp, rcx
mov rax, qword [rbx + 0x1c10]
mov byte [rax + 0x90], 1
mov r8, qword [rbx + 0x1c10]
cmp byte [r8 + 0x93], 0
jne 0x7ff6d4a1cb9b
test rdx, rdx
je 0x7ff6d4a1c9c6
cmp byte [rdx], 0
je 0x7ff6d4a1cb9b
movsxd rax, dword [r8 + 0xc8]
xor edx, edx
mov r8, qword [r8 + 0xd0]
mov qword [rsp + 0x80], rdi
mov r8d, dword [r8 + rax*4 - 4]
call fcn.7ff6d49909f0
mov edi, eax
cmp dword [rbx + 0x1c58], eax
jne 0x7ff6d4a1c9f8
mov dword [rbx + 0x1c5c], eax
cmp dword [rbx + 0x1c98], edi
jne 0x7ff6d4a1ca07
mov byte [rbx + 0x1c9c], 1
mov edx, 0x10001e
mov eax, 0x1a
test rsi, rsi
mov r8, rbp
mov ecx, edi
cmove edx, eax
xor r9d, r9d
call fcn.7ff6d4a1bac0
movzx ebp, al
test rsi, rsi
je 0x7ff6d4a1cb87
mov rbx, qword [0x7ff6d4c707f8]
lea rdx, [0x7ff6d4a6f765]
mov qword [rsp + 0x88], r14
lea r10, [0x7ff6d4a71180]
movaps xmmword [rsp + 0x50], xmm6
not edi
movaps xmmword [rsp + 0x40], xmm7
mov r8d, edi
movss xmm0, dword [rbx + 0x159c]
mov r9b, 0x23
movss xmm1, dword [rbx + 0x1cdc]
addss xmm0, xmm0
movups xmm6, xmmword [rbx + 0x1cc8]
mov r14d, dword [rbx + 0x1d00]
movups xmm7, xmmword [rbx + 0x1cd8]
movss xmm2, dword [rbx + 0x1cd8]
subss xmm1, xmm0
movss xmm0, dword [rbx + 0x1cd4]
movaps xmmword [rsp + 0x30], xmm8
movups xmm8, xmmword [rbx + 0x1ce8]
subss xmm1, dword [rbx + 0x1980]
movaps xmmword [rsp + 0x20], xmm9
movsd xmm9, qword [rbx + 0x1cf8]
maxss xmm0, xmm1
cmp r9b, 0x23
jne 0x7ff6d4a1cad8
cmp byte [rdx], r9b
jne 0x7ff6d4a1cad8
cmp byte [rdx + 1], r9b
cmove r8d, edi
movzx ecx, r8b
movzx eax, r9b
movzx r9d, byte [rdx]
xor rcx, rax
shr r8d, 8
inc rdx
xor r8d, dword [r10 + rcx*4]
test r9b, r9b
jne 0x7ff6d4a1cac5
not r8d
cmp dword [rbx + 0x1c58], r8d
jne 0x7ff6d4a1cb0a
mov dword [rbx + 0x1c5c], r8d
cmp dword [rbx + 0x1c98], r8d
jne 0x7ff6d4a1cb1a
mov byte [rbx + 0x1c9c], 1
lea rdx, [rsp + 0x98]
movss dword [rsp + 0x98], xmm0
mov ecx, r8d
movss dword [rsp + 0x9c], xmm2
call fcn.7ff6d4a07230
test al, al
je 0x7ff6d4a1cb43
mov byte [rsi], 0
movups xmmword [rbx + 0x1cc8], xmm6
movaps xmm6, xmmword [rsp + 0x50]
movups xmmword [rbx + 0x1cd8], xmm7
movaps xmm7, xmmword [rsp + 0x40]
movups xmmword [rbx + 0x1ce8], xmm8
movaps xmm8, xmmword [rsp + 0x30]
movsd qword [rbx + 0x1cf8], xmm9
movaps xmm9, xmmword [rsp + 0x20]
mov dword [rbx + 0x1d00], r14d
mov r14, qword [rsp + 0x88]
mov rdi, qword [rsp + 0x80]
movzx eax, bpl
add rsp, 0x60
pop rsi
pop rbp
pop rbx
ret
xor al, al
add rsp, 0x60
pop rsi
pop rbp
pop rbx
ret
Function at 0x7ff6d4a21a00
Capabilities:
Hash data with crc32

Disassembly:
sub rsp, 0x28
test dword [rcx + 0x10], 0x100000
mov r10, rdx
je 0x7ff6d4a21a8b
movzx r9d, byte [rdx]
lea r8, [rdx + 1]
mov r11d, 0xffffffff
mov eax, r11d
test r9b, r9b
je 0x7ff6d4a21a60
lea r10, [0x7ff6d4a71180]
nop dword [rax]
cmp r9b, 0x23
jne 0x7ff6d4a21a43
cmp byte [r8], r9b
jne 0x7ff6d4a21a43
cmp byte [r8 + 1], r9b
cmove eax, r11d
movzx edx, al
movzx ecx, r9b
movzx r9d, byte [r8]
xor rdx, rcx
shr eax, 8
inc r8
xor eax, dword [r10 + rdx*4]
test r9b, r9b
jne 0x7ff6d4a21a30
mov rcx, qword [0x7ff6d4c707f8]
not eax
cmp dword [rcx + 0x1c58], eax
jne 0x7ff6d4a21a77
mov dword [rcx + 0x1c5c], eax
cmp dword [rcx + 0x1c98], eax
jne 0x7ff6d4a21add
mov byte [rcx + 0x1c9c], 1
add rsp, 0x28
ret
mov qword [rsp + 0x20], rbx
xor edx, edx
mov rbx, qword [0x7ff6d4c707f8]
mov rcx, r10
mov r8, qword [rbx + 0x1c10]
movsxd rax, dword [r8 + 0xc8]
mov r8, qword [r8 + 0xd0]
mov r8d, dword [r8 + rax*4 - 4]
call fcn.7ff6d49909f0
cmp dword [rbx + 0x1c58], eax
jne 0x7ff6d4a21ac9
mov dword [rbx + 0x1c5c], eax
cmp dword [rbx + 0x1c98], eax
jne 0x7ff6d4a21ad8
mov byte [rbx + 0x1c9c], 1
mov rbx, qword [rsp + 0x20]
add rsp, 0x28
ret
Function at 0x7ff6d4a2b650
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbx
sub rsp, 0x90
mov rax, qword [0x7ff6d4c6b040]
xor rax, rsp
mov qword [rsp + 0x80], rax
movzx eax, byte [rcx]
mov ebx, edx
mov r8, rcx
test al, al
je 0x7ff6d4a2b690
cmp al, 0x25
jne 0x7ff6d4a2b684
cmp byte [r8 + 1], al
jne 0x7ff6d4a2b690
inc r8
movzx eax, byte [r8 + 1]
inc r8
test al, al
jne 0x7ff6d4a2b677
movzx edx, byte [r8]
cmp dl, 0x25
jne 0x7ff6d4a2b7fa
cmp byte [r8 + 1], dl
je 0x7ff6d4a2b7fa
lea r11, [rsp + 0x20]
mov r9, r8
nop
lea eax, [rdx - 0x41]
movsx r10d, dl
cmp al, 0x19
ja 0x7ff6d4a2b6cd
lea ecx, [r10 - 0x41]
mov eax, 1
shl eax, cl
test eax, 0x900
je 0x7ff6d4a2b6f5
sub dl, 0x61
cmp dl, 0x19
ja 0x7ff6d4a2b6e7
lea ecx, [r10 - 0x61]
mov eax, 1
shl eax, cl
test eax, 0x2480a80
je 0x7ff6d4a2b6f5
movzx edx, byte [r9 + 1]
inc r9
test dl, dl
jne 0x7ff6d4a2b6b0
jmp 0x7ff6d4a2b6f8
inc r9
cmp r8, r9
jae 0x7ff6d4a2b72f
movabs rdx, 0x800000000000009
nop word [rax + rax]
movzx ecx, byte [r8]
inc r8
lea eax, [rcx - 0x24]
cmp al, 0x3b
ja 0x7ff6d4a2b724
bt rdx, rax
jb 0x7ff6d4a2b72a
mov byte [r11], cl
inc r11
cmp r8, r9
jb 0x7ff6d4a2b710
xorps xmm3, xmm3
mov byte [r11], 0
cvtss2sd xmm3, xmm2
lea r8, [rsp + 0x20]
mov edx, 0x40
lea rcx, [rsp + 0x40]
movq r9, xmm3
call fcn.7ff6d49908a0
cmp byte [rsp + 0x40], 0x20
lea rcx, [rsp + 0x40]
jne 0x7ff6d4a2b768
nop
inc rcx
cmp byte [rcx], 0x20
je 0x7ff6d4a2b760
lea eax, [rbx - 8]
cmp eax, 1
jbe 0x7ff6d4a2b7e8
movzx r9d, byte [rcx]
movzx r8d, r9b
cmp r9b, 0x2d
jne 0x7ff6d4a2b78a
movzx r8d, byte [rcx + 1]
lea rax, [rcx + 1]
mov rcx, rax
movzx eax, r8b
cmp r8b, 0x2b
jne 0x7ff6d4a2b798
movzx eax, byte [rcx + 1]
lea rdx, [rcx + 1]
xorps xmm1, xmm1
cmovne rdx, rcx
cmp al, 0x30
jl 0x7ff6d4a2b7d6
movss xmm2, dword [0x7ff6d4c56794]
nop
cmp al, 0x39
ja 0x7ff6d4a2b7d6
movzx eax, al
inc rdx
sub eax, 0x30
mulss xmm1, xmm2
movd xmm0, eax
movzx eax, byte [rdx]
cvtdq2ps xmm0, xmm0
addss xmm0, xmm1
movaps xmm1, xmm0
cmp al, 0x30
jge 0x7ff6d4a2b7b0
cmp r9b, 0x2d
jne 0x7ff6d4a2b7f5
xorps xmm1, xmmword [0x7ff6d4c56f40]
movaps xmm0, xmm1
jmp 0x7ff6d4a2b7fd
call qword [0x7ff6d4a6e860]
xorps xmm1, xmm1
cvtsd2ss xmm1, xmm0
movaps xmm0, xmm1
jmp 0x7ff6d4a2b7fd
movaps xmm0, xmm2
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.7ff6d4a69a50
add rsp, 0x90
pop rbx
ret
Function at 0x7ff6d4a2be40
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbx
sub rsp, 0x90
mov rax, qword [0x7ff6d4c6b040]
xor rax, rsp
mov qword [rsp + 0x80], rax
movzx eax, byte [rcx]
mov ebx, edx
mov r8, rcx
test al, al
je 0x7ff6d4a2be80
cmp al, 0x25
jne 0x7ff6d4a2be74
cmp byte [r8 + 1], al
jne 0x7ff6d4a2be80
inc r8
movzx eax, byte [r8 + 1]
inc r8
test al, al
jne 0x7ff6d4a2be67
movzx edx, byte [r8]
cmp dl, 0x25
jne 0x7ff6d4a2bfe4
cmp byte [r8 + 1], dl
je 0x7ff6d4a2bfe4
lea r11, [rsp + 0x20]
mov r9, r8
nop
lea eax, [rdx - 0x41]
movsx r10d, dl
cmp al, 0x19
ja 0x7ff6d4a2bebd
lea ecx, [r10 - 0x41]
mov eax, 1
shl eax, cl
test eax, 0x900
je 0x7ff6d4a2bee5
sub dl, 0x61
cmp dl, 0x19
ja 0x7ff6d4a2bed7
lea ecx, [r10 - 0x61]
mov eax, 1
shl eax, cl
test eax, 0x2480a80
je 0x7ff6d4a2bee5
movzx edx, byte [r9 + 1]
inc r9
test dl, dl
jne 0x7ff6d4a2bea0
jmp 0x7ff6d4a2bee8
inc r9
cmp r8, r9
jae 0x7ff6d4a2bf1f
movabs rdx, 0x800000000000009
nop word [rax + rax]
movzx ecx, byte [r8]
inc r8
lea eax, [rcx - 0x24]
cmp al, 0x3b
ja 0x7ff6d4a2bf14
bt rdx, rax
jb 0x7ff6d4a2bf1a
mov byte [r11], cl
inc r11
cmp r8, r9
jb 0x7ff6d4a2bf00
movaps xmm3, xmm2
mov byte [r11], 0
movq r9, xmm2
lea r8, [rsp + 0x20]
mov edx, 0x40
lea rcx, [rsp + 0x40]
call fcn.7ff6d49908a0
cmp byte [rsp + 0x40], 0x20
lea rcx, [rsp + 0x40]
jne 0x7ff6d4a2bf58
nop dword [rax + rax]
inc rcx
cmp byte [rcx], 0x20
je 0x7ff6d4a2bf50
lea eax, [rbx - 8]
cmp eax, 1
jbe 0x7ff6d4a2bfd6
movzx r9d, byte [rcx]
movzx r8d, r9b
cmp r9b, 0x2d
jne 0x7ff6d4a2bf7a
movzx r8d, byte [rcx + 1]
lea rax, [rcx + 1]
mov rcx, rax
movzx eax, r8b
cmp r8b, 0x2b
jne 0x7ff6d4a2bf88
movzx eax, byte [rcx + 1]
lea rdx, [rcx + 1]
xorps xmm1, xmm1
cmovne rdx, rcx
cmp al, 0x30
jl 0x7ff6d4a2bfc4
movsd xmm2, qword [0x7ff6d4c56720]
nop
cmp al, 0x39
ja 0x7ff6d4a2bfc4
movzx eax, al
inc rdx
sub eax, 0x30
mulsd xmm1, xmm2
movd xmm0, eax
movzx eax, byte [rdx]
cvtdq2pd xmm0, xmm0
addsd xmm1, xmm0
cmp al, 0x30
jge 0x7ff6d4a2bfa0
cmp r9b, 0x2d
jne 0x7ff6d4a2bfdf
xorps xmm1, xmmword [0x7ff6d4c56f30]
movaps xmm0, xmm1
jmp 0x7ff6d4a2bfe7
call qword [0x7ff6d4a6e860]
movaps xmm1, xmm0
movaps xmm0, xmm1
jmp 0x7ff6d4a2bfe7
movaps xmm0, xmm2
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.7ff6d4a69a50
add rsp, 0x90
pop rbx
ret
Function at 0x7ff6d4a4cbd0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
mov ecx, dword [rcx + 0x10]
mov r10d, ecx
and r10d, 7
je 0x7ff6d4a4cc04
cmp ecx, r10d
jge 0x7ff6d4a4cbf2
mov rcx, rbx
call fcn.7ff6d4a4c330
mov eax, dword [rbx + 0x14]
mov ecx, r10d
shr eax, cl
sub dword [rbx + 0x10], r10d
mov ecx, dword [rbx + 0x10]
mov dword [rbx + 0x14], eax
xor r8d, r8d
mov eax, ecx
test ecx, ecx
jle 0x7ff6d4a4cc3e
mov ecx, dword [rbx + 0x14]
lea rdx, [rsp + 0x30]
movzx r9d, cl
nop dword [rax]
shr ecx, 8
inc r8d
mov byte [rdx], r9b
lea rdx, [rdx + 1]
sub eax, 8
mov dword [rbx + 0x14], ecx
movzx r9d, cl
test eax, eax
jg 0x7ff6d4a4cc20
mov dword [rbx + 0x10], eax
test eax, eax
jns 0x7ff6d4a4cc66
mov rax, qword gs:[0x58]
mov edx, 0x28
mov rcx, qword [rax]
lea rax, str.zlib_corrupt
mov qword [rdx + rcx], rax
xor eax, eax
add rsp, 0x20
pop rbx
ret
movsxd rcx, r8d
cmp rcx, 4
jge 0x7ff6d4a4cc95
mov r8, qword [rbx + 8]
mov rax, qword [rbx]
cmp rax, r8
jb 0x7ff6d4a4cc7f
xor dl, dl
jmp 0x7ff6d4a4cc88
movzx edx, byte [rax]
inc rax
mov qword [rbx], rax
mov byte [rsp + rcx + 0x30], dl
inc rcx
cmp rcx, 4
jl 0x7ff6d4a4cc76
movzx eax, byte [rsp + 0x30]
movzx r8d, byte [rsp + 0x31]
movzx ecx, byte [rsp + 0x33]
shl r8d, 8
add r8d, eax
shl ecx, 8
movzx eax, byte [rsp + 0x32]
add ecx, eax
mov eax, r8d
xor eax, 0xffff
cmp ecx, eax
jne 0x7ff6d4a4cc42
mov rcx, qword [rbx]
mov qword [rsp + 0x38], rdi
mov edi, r8d
add rcx, rdi
cmp rcx, qword [rbx + 8]
jbe 0x7ff6d4a4ccff
mov rax, qword gs:[0x58]
mov edx, 0x28
mov rcx, qword [rax]
lea rax, str.read_past_buffer
mov qword [rdx + rcx], rax
mov rdi, qword [rsp + 0x38]
xor eax, eax
add rsp, 0x20
pop rbx
ret
mov rdx, qword [rbx + 0x18]
lea rax, [r8 + rdx]
cmp rax, qword [rbx + 0x28]
jbe 0x7ff6d4a4cd19
mov rcx, rbx
call fcn.7ff6d4a4c520
test eax, eax
je 0x7ff6d4a4ccf2
mov rdx, qword [rbx]
mov r8, rdi
mov rcx, qword [rbx + 0x18]
call fcn.7ff6d4a6b63a
add qword [rbx], rdi
mov eax, 1
add qword [rbx + 0x18], rdi
mov rdi, qword [rsp + 0x38]
add rsp, 0x20
pop rbx
ret
Function at 0x7ff6d4a64e00
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x20
mov rbp, rcx
mov rcx, qword [rcx + 0x20]
sub rcx, qword [rbp + 0x18]
call fcn.7ff6d4981740
mov r8, qword [rbp + 0x18]
xor ebx, ebx
mov r12, qword [rbp + 0x20]
mov r13, rax
mov r15d, ebx
mov r14, r12
mov rdx, r8
cmp r12, r8
je 0x7ff6d4a64eb8
mov edi, ebx
nop dword [rax]
call qword [0x7ff6d4a6eb80]
inc r15d
lea rdi, [rdi + 1]
mov r8d, eax
mov eax, 0x80808081
imul r8d
add edx, r8d
sar edx, 7
mov ecx, edx
shr ecx, 0x1f
add edx, ecx
imul ecx, edx, 0xff
sub r8d, ecx
inc r8b
mov byte [rdi + r13 - 1], r8b
mov rax, qword [rbp + 0x18]
xor r8b, byte [rax + rdi - 1]
ror r8b, 0x16
add r8b, 0xc
mov byte [rax + rdi - 1], r8b
mov r14, qword [rbp + 0x20]
mov rdx, qword [rbp + 0x18]
mov rcx, r14
sub rcx, rdx
movsxd rax, r15d
cmp rax, rcx
jb 0x7ff6d4a64e50
mov r12d, r14d
mov r8d, edx
sub r14, rdx
lea rcx, [rbp + 0x18]
mov edx, r14d
sub r12d, r8d
add rdx, r14
call fcn.7ff6d4989c80
mov rcx, qword [rbp + 0x18]
mov rdx, r13
add rcx, r14
mov r8d, r14d
call fcn.7ff6d4a6b63a
mov eax, dword [rbp + 0x20]
lea rcx, [rbp + 0x18]
sub eax, dword [rbp + 0x18]
mov dword [rbp + 8], eax
mov rdi, qword [rbp + 0x20]
sub rdi, qword [rbp + 0x18]
lea rdx, [rdi + 4]
call fcn.7ff6d4989c80
mov rax, qword [rbp + 0x18]
mov rcx, r13
mov dword [rdi + rax], r12d
mov eax, dword [rbp + 0x20]
sub eax, dword [rbp + 0x18]
mov dword [rbp + 8], eax
call fcn.7ff6d4a69ff8
cmp dword [rbp + 8], ebx
jbe 0x7ff6d4a64f37
mov rdx, rbx
nop
mov rcx, qword [rbp + 0x18]
lea rdx, [rdx + 1]
movzx eax, byte [rbp + 0x10]
inc ebx
xor byte [rcx + rdx - 1], al
cmp ebx, dword [rbp + 8]
jb 0x7ff6d4a64f20
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x20
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x7ff6d4a64f60
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x20
xor ebx, ebx
mov rdi, rcx
mov r8d, ebx
cmp dword [rcx + 8], ebx
jbe 0x7ff6d4a64f99
mov edx, ebx
nop word [rax + rax]
mov rcx, qword [rdi + 0x18]
lea rdx, [rdx + 1]
movzx eax, byte [rdi + 0x10]
inc r8d
xor byte [rcx + rdx - 1], al
cmp r8d, dword [rdi + 8]
jb 0x7ff6d4a64f80
mov rax, qword [rdi + 0x18]
mov rdx, qword [rdi + 0x20]
sub rdx, rax
cmp rdx, 4
jb 0x7ff6d4a6507d
add rdx, 0xfffffffffffffffc
mov qword [rsp + 0x48], r12
lea rcx, [rdi + 0x18]
mov r12d, dword [rax + rdx]
call fcn.7ff6d4989c80
mov rax, qword [rdi + 0x20]
sub rax, qword [rdi + 0x18]
mov dword [rdi + 8], eax
test r12d, r12d
je 0x7ff6d4a65078
mov qword [rsp + 0x40], rbp
mov ecx, r12d
mov qword [rsp + 0x50], r14
mov ebp, r12d
mov qword [rsp + 0x58], r15
call fcn.7ff6d4981740
mov r15, qword [rdi + 0x20]
mov r14, rax
mov rax, qword [rdi + 0x18]
sub r15, rax
cmp r12, r15
ja 0x7ff6d4a65069
test r15, r15
je 0x7ff6d4a65069
sub r15, r12
mov r8d, r12d
mov rcx, r14
lea rdx, [rax + r15]
call fcn.7ff6d4a6b63a
mov rdx, r15
lea rcx, [rdi + 0x18]
call fcn.7ff6d4989c80
mov eax, dword [rdi + 0x20]
sub eax, dword [rdi + 0x18]
mov dword [rdi + 8], eax
test r12d, r12d
je 0x7ff6d4a65061
nop word [rax + rax]
mov rcx, qword [rdi + 0x18]
lea rbx, [rbx + 1]
movzx eax, byte [rcx + rbx - 1]
sub al, 0xc
rol al, 0x16
xor al, byte [r14 + rbx - 1]
mov byte [rcx + rbx - 1], al
sub rbp, 1
jne 0x7ff6d4a65040
mov rcx, r14
call fcn.7ff6d4a69ff8
mov r14, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x40]
mov r15, qword [rsp + 0x58]
mov r12, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
pop rsi
pop rbx
ret