joyce8/EMBER2024-capa huggingface dataset:
Function at 0x18004197c
Capabilities:
Generate random numbers via winapi

Disassembly:
push rbx
sub rsp, 0x60
mov rax, qword [0x180066008]
xor rax, rsp
mov qword [rsp + 0x50], rax
lea rcx, [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
movabs rcx, 0xfe624e212ac18000
movabs rax, 0x1ca213d840baf7d5
add rcx, qword [rsp + 0x28]
imul rcx
lea rcx, [0x180067c80]
sar rdx, 0x19
mov rax, rdx
shr rax, 0x3f
add rdx, rax
movzx eax, byte [0x180067c83]
imul rbx, rdx, 0x7530
cmp rbx, qword [rcx + rax*8 + 0x188]
jge 0x1800419f2
mov rax, qword [rcx + rax*8 + 0x178]
jmp 0x180041ab2
mov r9d, 2
lea rdx, [rsp + 0x30]
xor ecx, ecx
add rbx, 0x7530
lea r8d, [r9 + 0x1e]
call qword [sym.imp.bcrypt.dll_BCryptGenRandom]
lea r8, [rsp + 0x20]
mov ecx, 1
lea rdx, [rsp + 0x30]
call fcn.180019074
test eax, eax
jns 0x180041a44
test byte [0x180067c70], 4
je 0x180041a40
lea r9, str.Create_stateless_retry_key
mov r8d, eax
call fcn.18004176c
xor eax, eax
jmp 0x180041ab2
cmp byte [0x180067c83], 0
lea rcx, [0x180067e08]
lea rax, [0x180067e10]
cmovne rax, rcx
mov qword [rax], rbx
mov al, byte [0x180067c83]
mov rcx, qword [0x180067df8]
test al, al
cmove rcx, qword [0x180067e00]
test rcx, rcx
je 0x180041a88
call qword [sym.imp.bcrypt.dll_BCryptDestroyKey]
mov al, byte [0x180067c83]
test al, al
lea rcx, [0x180067e00]
mov rax, qword [rsp + 0x20]
lea rdx, [0x180067df8]
cmovne rcx, rdx
mov qword [rcx], rax
cmp byte [0x180067c83], 0
sete byte [0x180067c83]
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.180028c10
add rsp, 0x60
pop rbx
ret
Function at 0x180043220
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x70
mov rax, qword [0x180066008]
xor rax, rsp
mov qword [rsp + 0x60], rax
movups xmm0, xmmword [rdx]
mov rbx, r8
movaps xmmword [r8], xmm0
movups xmm1, xmmword [rdx + 0x10]
movaps xmmword [r8 + 0x10], xmm1
movups xmm0, xmmword [rdx + 0x20]
movaps xmmword [r8 + 0x20], xmm0
movups xmm1, xmmword [rdx + 0x30]
movaps xmmword [r8 + 0x30], xmm1
movups xmm0, xmmword [rdx + 0x40]
movaps xmmword [r8 + 0x40], xmm0
mov r8b, 0xc
movzx r9d, byte [0x180067d74]
cmp r9b, r8b
jb 0x1800432bb
mov rcx, qword [rcx + 0x10]
movsd xmm0, qword [rcx]
movsd qword [rsp + 0x30], xmm0
mov eax, dword [rcx + 8]
mov dword [rsp + 0x38], eax
jbe 0x1800432d7
lea r10, [rcx + 0xc]
movzx ecx, r8b
mov eax, 0xaaaaaaab
mul ecx
inc r8b
shr edx, 3
lea eax, [rdx + rdx*2]
shl eax, 2
sub ecx, eax
mov al, byte [r10]
movsxd rcx, ecx
inc r10
xor byte [rsp + rcx + 0x30], al
cmp r8b, r9b
jb 0x18004328e
jmp 0x1800432d7
mov rdx, qword [rcx + 0x10]
xor eax, eax
lea rcx, [rsp + 0x30]
mov qword [rsp + 0x30], rax
mov r8, r9
mov dword [rsp + 0x38], eax
call fcn.18002a1d0
lea rcx, [0x180067dd0]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
movzx edx, byte [0x180067c83]
mov rcx, qword [0x180067e08]
test dl, dl
mov r9, qword [0x180067e10]
mov rax, rcx
mov r8, qword [rbx]
cmove rax, r9
add rax, 0xffffffffffff8ad0
cmp r8, rax
jl 0x180043342
test dl, dl
cmove rcx, r9
cmp r8, rcx
jge 0x180043364
mov rcx, qword [0x180067df8]
test dl, dl
mov r8, qword [0x180067e00]
mov rax, rcx
cmove rax, r8
test rax, rax
je 0x180043342
test dl, dl
cmove rcx, r8
test rcx, rcx
jne 0x18004337f
lea rcx, [0x180067dd0]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
xor al, al
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.180028c10
add rsp, 0x70
pop rbx
ret
lea rax, [0x180067c80]
cmp r8, qword [rax + rdx*8 + 0x188]
jge 0x180043342
mov rcx, qword [rax + rdx*8 + 0x178]
jmp 0x18004333d
mov edx, 0x44
lea rax, [rbx + 8]
mov qword [rsp + 0x28], rax
mov r9, rbx
mov word [rsp + 0x20], dx
lea r8d, [rdx - 0x3c]
lea rdx, [rsp + 0x30]
call fcn.18004b560
lea rcx, [0x180067dd0]
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
test ebx, ebx
setns al
jmp 0x180043351
Function at 0x180044010
Capabilities:
Generate random numbers via winapi

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x50
mov rax, qword [0x180066008]
xor rax, rsp
mov qword [rsp + 0x48], rax
movzx esi, byte [rsp + 0xb0]
mov r13, rdx
mov rax, qword [rsp + 0xb8]
mov r12d, ecx
mov r15, qword [rsp + 0xd0]
mov r14, qword [rsp + 0xe0]
lea ebp, [rsi + 0x67]
movzx ebx, r8b
add bp, bx
mov qword [rsp + 0x30], r9
mov qword [rsp + 0x38], rax
cmp word [rsp + 0xd8], bp
jb 0x18004417d
mov r9d, 2
lea rdx, [rsp + 0x40]
xor ecx, ecx
lea r8d, [r9 - 1]
call qword [sym.imp.bcrypt.dll_BCryptGenRandom]
mov al, byte [rsp + 0x40]
lea rdi, [r14 + 6]
or al, 0xf0
mov dword [r14 + 1], r12d
mov byte [r14], al
mov byte [r14 + 5], bl
test bl, bl
je 0x1800440bc
mov r8d, ebx
mov rdx, r13
mov rcx, rdi
call fcn.18002a1d0
add rdi, rbx
mov byte [rdi], sil
xor r13d, r13d
inc rdi
test sil, sil
je 0x1800440dd
mov rdx, qword [rsp + 0x30]
mov r8, rsi
mov rcx, rdi
call fcn.18002a1d0
add rdi, rsi
movups xmm0, xmmword [r15]
lea rdx, [0x1800571c0]
mov eax, r13d
mov rbx, r13
mov rcx, rdx
movups xmmword [rdi], xmm0
movups xmm1, xmmword [r15 + 0x10]
movups xmmword [rdi + 0x10], xmm1
movups xmm0, xmmword [r15 + 0x20]
movups xmmword [rdi + 0x20], xmm0
movups xmm1, xmmword [r15 + 0x30]
movups xmmword [rdi + 0x30], xmm1
movups xmm0, xmmword [r15 + 0x40]
movups xmmword [rdi + 0x40], xmm0
add rdi, 0x50
cmp dword [rcx], r12d
je 0x18004412e
inc eax
add rcx, 0x38
cmp eax, 3
jb 0x18004411c
jmp 0x180044137
imul rbx, rax, 0x38
add rbx, rdx
jne 0x180044151
lea r8, str.VersionInfo_____void__0_
mov edx, 0x1ad
lea rcx, str.D:workspace_work1_s_srcmsquic_srccorepacket.c
call fcn.18004b2ec
int 0x2c
mov r8, qword [rsp + 0x38]
lea r9d, [rbp - 0x10]
mov dl, byte [rsp + 0xc0]
lea rcx, [rbx + 0x18]
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], r14
call fcn.1800441ac
test eax, eax
js 0x180044180
movzx eax, bp
jmp 0x180044184
xor r13d, r13d
movzx eax, r13w
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.180028c10
mov rbx, qword [rsp + 0x90]
add rsp, 0x50
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x18004b560
Capabilities:
Encrypt or decrypt data via bcrypt

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r14
push r15
lea rbp, [rsp - 0x17]
sub rsp, 0xc0
mov rax, qword [0x180066008]
xor rax, rsp
mov qword [rbp + 0xf], rax
mov r15, qword [rbp + 0x7f]
mov r14, rdx
movzx esi, word [rbp + 0x77]
xor edx, edx
movzx ebx, r8w
mov r12, rcx
lea rcx, [rbp - 0x59]
mov rdi, r9
lea r8d, [rdx + 0x58]
call fcn.180029d60
mov dword [rbp - 0x39], ebx
lea rax, [rbp + 7]
xor ebx, ebx
mov dword [rbp - 0x59], 0x58
mov dword [rsp + 0x48], ebx
lea rcx, [r15 - 0x10]
mov qword [rsp + 0x40], rax
lea r9, [rbp - 0x59]
add rcx, rsi
mov dword [rbp - 0x55], 1
mov r8d, esi
mov qword [rbp - 0x31], rcx
add r8d, 0xfffffff0
mov qword [rbp - 0x41], rdi
mov dword [rsp + 0x38], r8d
mov rdx, r15
mov qword [rsp + 0x30], r15
mov rcx, r12
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], rbx
mov dword [rbp - 0x29], shutdown
mov qword [rbp - 0x51], r14
mov dword [rbp - 0x49], 0xc
call qword [sym.imp.bcrypt.dll_BCryptDecrypt]
mov ecx, eax
call qword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
test eax, eax
jle 0x18004b628
movzx eax, ax
or eax, 0x80070000
mov rcx, qword [rbp + 0xf]
xor rcx, rsp
call fcn.180028c10
add rsp, 0xc0
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret

Function at 0x18004b648
Capabilities:
Encrypt or decrypt data via bcrypt

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r14
push r15
lea rbp, [rsp - 0x17]
sub rsp, 0xc0
mov rax, qword [0x180066008]
xor rax, rsp
mov qword [rbp + 0xf], rax
mov r15, qword [rbp + 0x7f]
mov r14, rdx
movzx esi, word [rbp + 0x77]
xor edx, edx
movzx ebx, r8w
mov r12, rcx
lea rcx, [rbp - 0x59]
mov rdi, r9
lea r8d, [rdx + 0x58]
call fcn.180029d60
mov dword [rbp - 0x39], ebx
lea rcx, [r15 - 0x10]
add rcx, rsi
mov dword [rbp - 0x59], 0x58
mov qword [rbp - 0x31], rcx
lea r8d, [rsi - 0x10]
xor ebx, ebx
mov dword [rbp - 0x55], 1
mov dword [rsp + 0x48], ebx
lea rcx, [rbp + 7]
mov qword [rsp + 0x40], rcx
lea r9, [rbp - 0x59]
mov dword [rsp + 0x38], esi
mov rdx, r15
mov qword [rsp + 0x30], r15
mov rcx, r12
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], rbx
mov qword [rbp - 0x41], rdi
mov dword [rbp - 0x29], shutdown
mov qword [rbp - 0x51], r14
mov dword [rbp - 0x49], 0xc
call qword [sym.imp.bcrypt.dll_BCryptEncrypt]
mov ecx, eax
call qword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
test eax, eax
jle 0x18004b70c
movzx eax, ax
or eax, 0x80070000
mov rcx, qword [rbp + 0xf]
xor rcx, rsp
call fcn.180028c10
add rsp, 0xc0
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
Function at 0x18004b72c
Capabilities:
Set socket configuration

Disassembly:
cmp r8d, 0x2736
je 0x18004b94c
push rbx
push rbp
push rdi
push r14
push r15
sub rsp, 0x70
mov rax, qword [0x180066008]
xor rax, rsp
mov qword [rsp + 0x60], rax
mov rbx, rdx
mov r14, rcx
cmp r8d, 0x3e3
je 0x18004b934
xor r15d, r15d
test r8d, r8d
jne 0x18004b8f0
mov rdi, qword [rdx + 0x20]
mov qword [rsp + 0x50], r15
mov rax, qword [rdi + 0x58]
or byte [rax], 8
mov rax, qword [rdi + 0x58]
mov word [rax + 2], r15w
test byte [0x180067c75], 8
je 0x18004b7b2
mov r8, qword [rdx]
lea rax, str.AcceptEx_Completed_
lea rdx, [0x180056a58]
mov qword [rsp + 0x20], rax
xor r9d, r9d
call fcn.180042260
mov rcx, qword [rdi + 0x60]
lea r9, [rbx + 8]
mov edx, 0xffff
mov dword [rsp + 0x20], 8
mov r8d, 0x700b
call qword [sym.imp.WS2_32.dll_setsockopt]
cmp eax, 0xffffffff
jne 0x18004b803
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
test byte [0x180067c75], 8
je 0x18004b917
lea rcx, str.Set_UPDATE_ACCEPT_CONTEXT
mov r8, qword [rbx + 0x20]
mov r9d, eax
mov qword [rsp + 0x20], rcx
jmp 0x18004b90b
mov rcx, qword [rdi + 0x60]
lea rax, [rsp + 0x58]
mov qword [rsp + 0x40], r15
xor r9d, r9d
mov qword [rsp + 0x38], r15
xor r8d, r8d
mov qword [rsp + 0x30], rax
mov edx, 0x48000025
lea rax, [rsp + 0x50]
mov dword [rsp + 0x28], 8
mov qword [rsp + 0x20], rax
call qword [sym.imp.WS2_32.dll_WSAIoctl]
test eax, eax
jne 0x18004b85f
movzx ecx, word [rsp + 0x50]
mov rax, qword [0x180067c60]
movzx edx, byte [rsp + 0x52]
add dx, word [rax + rcx*4]
mov rax, qword [rdi + 0x58]
mov word [rax + 2], dx
mov rax, qword [rdi + 0x58]
lea r8, [rdi + 0x58]
xor r9d, r9d
movzx ecx, word [rax + 2]
mov rax, qword [rbx]
lea rbp, [rcx + rcx*4]
mov rcx, qword [rdi + 0x60]
shl rbp, 5
add rbp, qword [rax + 8]
mov rdx, qword [rbp + 0x88]
call qword [sym.imp.KERNEL32.dll_CreateIoCompletionPort]
cmp qword [rbp + 0x88], rax
je 0x18004b8b2
call qword [sym.imp.KERNEL32.dll_GetLastError]
test byte [0x180067c75], 8
je 0x18004b917
lea rcx, str.CreateIoCompletionPort__accepted_
jmp 0x18004b7f2
lea rdx, [rbp + 0x80]
lea rcx, [rdi + 0x58]
call fcn.18001f184
test eax, eax
js 0x18004b917
mov rax, qword [rdi + 0x58]
and byte [rax], 0xdf
mov rcx, qword [rbx]
mov r8, qword [rbx + 0x20]
mov rax, qword [rcx + 8]
mov rdx, qword [rcx + 0x50]
lea r9, [r8 + 0x50]
mov rax, qword [rax + 0x48]
call qword [0x18004e538]
mov qword [rbx + 0x20], r15
jmp 0x18004b917
test byte [0x180067c75], 8
je 0x18004b917
lea rax, str.AcceptEx_completion
mov r9d, r8d
mov r8, qword [rdx]
mov qword [rsp + 0x20], rax
lea rdx, [0x180056a58]
call fcn.180042260
mov rcx, qword [rbx + 0x20]
test rcx, rcx
je 0x18004b929
call fcn.18002448c
mov qword [rbx + 0x20], r15
mov rdx, r14
mov rcx, rbx
call fcn.18004c268
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.180028c10
add rsp, 0x70
pop r15
pop r14
pop rdi
pop rbp
pop rbx
ret
Function at 0x14002873e
Capabilities:
Check if file exists

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x20
cmp qword [rcx], rdx
je 0x140028782
mov rsi, rdx
mov rdi, rcx
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov rcx, rdi
call fcn.140028790
lea rax, [rsi + 1]
cmp rax, 2
jb 0x140028772
mov qword [rdi], rsi
call fcn.1400763e0
mov ecx, ebx
add rsp, 0x20
pop rbx
pop rdi
pop rsi
jmp qword [sym.imp.KERNEL32.dll_SetLastError]
nop
add rsp, 0x20
pop rbx
pop rdi
pop rsi
ret
Function at 0x14002fc58
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x50
mov rsi, rdx
mov rdi, rcx
mov rax, qword [0x1401c1028]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov eax, dword [rcx + 0x20]
test r8d, 0x180
je 0x14002fcab
bt eax, 0xb
mov rdi, qword [rdi + 0x18]
jb 0x14002fd24
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.14014c9b0
mov rcx, rsi
mov edx, 8
mov r8, rdi
jmp 0x14002fd56
and eax, 0x1802
mov rdx, qword [rdi]
mov r8, qword [rdi + 0x18]
test rdx, rdx
je 0x14002fd65
cmp eax, 0x1000
je 0x14002fd65
movabs rcx, 0x100000001b3
mov qword [rsp + 0x40], r8
movabs r9, 0xcbf29ce484222325
xor r8d, r8d
movzx r10d, byte [rsp + r8 + 0x40]
xor r9, r10
imul r9, rcx
inc r8
cmp r8, 8
jne 0x14002fce7
mov r11b, byte [rdx]
test r11b, r11b
je 0x14002fd62
lea r10, [rdx + 1]
movzx r8d, r11b
xor r8, r9
imul r8, rcx
mov r11b, byte [r10]
inc r10
mov r9, r8
test r11b, r11b
jne 0x14002fd09
jmp 0x14002fd65
mov rbx, qword [0x1401d17e0]
cmp qword [0x1401d17d8], 0
jne 0x14002fd3b
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
xor rbx, rdi
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.14014c9b0
mov rcx, rsi
mov edx, 8
mov r8, rbx
add rsp, 0x50
pop rbx
pop rdi
pop rsi
jmp fcn.14002a31c
mov r8, r9
cmp eax, 2
je 0x14002fd86
cmp eax, 0x1000
je 0x14002fd7f
cmp eax, 0x800
jne 0x14002fd96
mov edx, 0xa
jmp 0x14002fd8b
mov edx, 0xb
jmp 0x14002fd8b
mov edx, 6
mov rcx, rsi
call fcn.14002a31c
mov rdx, qword [rdi]
test rdx, rdx
je 0x14002fddd
lea rdi, [rsp + 0x28]
mov rcx, rdi
call fcn.14002828c
movzx r9d, byte [rdi + 0x17]
test r9b, r9b
jns 0x14002fdbc
mov r9, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x28]
mov rcx, rsi
mov edx, 7
mov r8, rdi
call fcn.14002a954
cmp byte [rsp + 0x3f], 0
jns 0x14002fddd
mov rcx, qword [rsp + 0x28]
call fcn.14014b4e4
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.14014c9b0
nop
add rsp, 0x50
pop rbx
pop rdi
pop rsi
ret
Function at 0x1400313b0
Capabilities:
Allocate or change rwx memory

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x40
mov rsi, r9
mov r14, r8
mov rdi, rdx
mov rbx, rcx
mov rax, qword [0x1401c1028]
xor rax, rsp
mov qword [rsp + 0x38], rax
lea r15, [rsp + 0x34]
mov dword [r15], 0xaaaaaaaa
mov qword [rsp + 0x20], r15
mov r8, r9
mov r9d, 8
call qword [sym.imp.KERNEL32.dll_VirtualProtectEx]
test eax, eax
je 0x14003145b
movabs rax, 0xaaaaaaaaaaaaaaaa
lea r12, [rsp + 0x28]
mov qword [r12], rax
mov qword [rsp + 0x20], r12
mov rcx, rbx
mov rdx, rdi
mov r8, r14
mov r9, rsi
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov ebp, eax
mov r14, qword [r12]
mov r9d, dword [rsp + 0x34]
mov qword [rsp + 0x20], r15
mov rcx, rbx
mov rdx, rdi
mov r8, rsi
call qword [sym.imp.KERNEL32.dll_VirtualProtectEx]
test eax, eax
je 0x14003145b
test ebp, ebp
setne al
cmp r14, rsi
sete sil
and sil, al
jmp 0x14003145d
xor esi, esi
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.14014c9b0
mov eax, esi
add rsp, 0x40
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret

Function at 0x140032390
Capabilities:
Encode data using base64

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rdi, rdx
mov rsi, rcx
mov r12, qword [rcx + 0x10]
cmp r12, qword [rcx + 0x18]
je 0x1400323b7
mov r14, r12
jmp 0x1400324bf
mov r15, qword [rsi]
mov rbx, qword [rsi + 8]
mov rax, rbx
sub rax, r15
jbe 0x140032419
sar rax, 3
lea rcx, [rax + 1]
shr rcx, 0x3f
add rax, rcx
inc rax
sar rax, 1
mov r13, rax
neg r13
shl rax, 3
mov r14, rbx
sub r14, rax
mov r15, r12
sub r15, rbx
je 0x140032405
mov rcx, r14
mov rdx, rbx
mov r8, r15
call fcn.14014e420
mov r12, qword [rsi + 8]
add r14, r15
mov qword [rsi + 0x10], r14
lea rax, [r12 + r13*8]
mov qword [rsi + 8], rax
jmp 0x1400324bf
mov rax, r12
sub rax, r15
sar rax, 2
cmp r12, r15
mov r13d, 1
cmovne r13, rax
mov rax, r13
shr rax, 0x3d
jne 0x1400324e5
lea rcx, [r13*8]
call fcn.14014b4a8
mov rcx, r13
and rcx, 0xfffffffffffffffc
lea rcx, [rax + rcx*2]
mov rdx, r12
mov r14, rcx
sub rdx, rbx
je 0x140032488
lea r14, [rdx + rcx]
xor r8d, r8d
nop word [rax + rax]
mov r9, rcx
add r9, r8
je 0x1400324df
mov r10, qword [rbx + r8]
mov qword [r9], r10
add r8, 8
cmp rdx, r8
jne 0x140032470
lea rdx, [rax + r13*8]
mov qword [rsi], rax
mov qword [rsi + 8], rcx
mov qword [rsi + 0x10], r14
mov qword [rsi + 0x18], rdx
nop dword [rax + rax]
cmp r12, rbx
je 0x1400324ae
add r12, 0xfffffffffffffff8
jne 0x1400324a0
int3
test r15, r15
je 0x1400324bf
mov rcx, r15
call fcn.14014b4e4
mov r14, qword [rsi + 0x10]
test r14, r14
je 0x1400324e2
mov rax, qword [rdi]
mov qword [r14], rax
add qword [rsi + 0x10], 8
add rsp, 0x20
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
int3
int3
int3

Function at 0x140037b70
Capabilities:
Encode data using xor

Disassembly:
xor eax, eax
cmp rdx, r8
je 0x140037ba7
movabs rcx, 0xf000000000000000
shl rax, 4
movsx r9, byte [rdx]
add r9, rax
mov r10, r9
and r10, rcx
mov rax, r10
shr rax, 0x38
or rax, r10
xor rax, r9
inc rdx
cmp rdx, r8
jne 0x140037b81
ret
Function at 0x140037c20
Capabilities:
Encode data using xor

Disassembly:
xor eax, eax
cmp rdx, r8
je 0x140037c58
movabs rcx, 0xf000000000000000
shl rax, 4
movzx r9d, word [rdx]
add r9, rax
mov r10, r9
and r10, rcx
mov rax, r10
shr rax, 0x38
or rax, r10
xor rax, r9
add rdx, 2
cmp rdx, r8
jne 0x140037c31
ret

Function at 0x14003e6a0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbp
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x58
lea rbp, [rsp + 0x50]
mov qword [rbp], 0xfffffffffffffffe
mov rdi, r8
mov rsi, rdx
mov r15b, byte [rbp + 0x68]
test byte [r9 + 8], 1
jne 0x14003e6f2
mov dl, byte [rbp + 0x60]
movzx r8d, r15b
mov rax, qword [rcx]
mov rax, qword [rax + 0x30]
mov dword [rsp + 0x28], r8d
mov byte [rsp + 0x20], dl
mov rdx, rsi
mov r8, rdi
call qword [0x1401b4100]
jmp 0x14003e7fe
mov rax, qword [r9 + 0x30]
mov qword [rbp - 0x20], rax
lea rcx, [0x1401d2108]
cmp rax, rcx
je 0x14003e70a
lock inc dword [rax + 8]
mov qword [rbp - 8], rax
lea rdx, [0x1401d22c0]
lea rbx, [rbp - 0x20]
mov rcx, rbx
call fcn.14004b498
mov r14, rax
mov rcx, qword [rbp - 8]
lea rax, [0x1401d2108]
cmp rcx, rax
je 0x14003e74f
mov eax, 0xffffffff
lock xadd dword [rcx + 8], eax
test eax, eax
jne 0x14003e74f
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [0x1401b4100]
movabs rax, 0xaaaaaaaaaaaaaaaa
mov qword [rbp - 0x10], rax
movaps xmm0, xmmword [0x1401940a0]
movaps xmmword [rbp - 0x20], xmm0
mov rax, qword [r14]
xor r15b, 1
movzx ecx, r15b
mov rax, qword [rax + rcx*8 + 0x28]
mov rcx, r14
mov rdx, rbx
call qword [0x1401b4100]
mov al, byte [rbp - 9]
test al, al
jns 0x14003e7de
mov rbx, qword [rbp - 0x20]
jmp 0x14003e7de
mov rcx, qword [rbp - 0x20]
mov rax, qword [rbp - 0x18]
add rax, rcx
cmp rbx, rax
je 0x14003e7f6
test rdi, rdi
je 0x14003e7d6
mov al, byte [rbx]
mov rcx, qword [rdi + 0x30]
cmp rcx, qword [rdi + 0x38]
je 0x14003e7be
lea rdx, [rcx + 1]
mov qword [rdi + 0x30], rdx
mov byte [rcx], al
jmp 0x14003e7d8
movzx edx, al
mov rax, qword [rdi]
mov rax, qword [rax + 0x60]
mov rcx, rdi
call qword [0x1401b4100]
cmp eax, 0xffffffff
jne 0x14003e7d8
xor edi, edi
inc rbx
mov al, byte [rbp - 9]
test al, al
js 0x14003e791
movzx eax, al
add rax, rbp
add rax, 0xffffffffffffffe0
cmp rbx, rax
jne 0x14003e7a1
mov qword [rsi], rdi
jmp 0x14003e7fe
mov qword [rsi], rdi
call fcn.14014b4e4
mov rax, rsi
add rsp, 0x58
pop rbx
pop rdi
pop rsi
pop r14
pop r15
pop rbp
ret
Function at 0x14003fb60
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbp
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x58
lea rbp, [rsp + 0x50]
mov qword [rbp], 0xfffffffffffffffe
mov rdi, r8
mov rsi, rdx
mov r15b, byte [rbp + 0x68]
test byte [r9 + 8], 1
jne 0x14003fbb4
movzx edx, word [rbp + 0x60]
movzx r8d, r15b
mov rax, qword [rcx]
mov rax, qword [rax + 0x30]
mov dword [rsp + 0x28], r8d
mov word [rsp + 0x20], dx
mov rdx, rsi
mov r8, rdi
call qword [0x1401b4100]
jmp 0x14003fccf
mov rax, qword [r9 + 0x30]
mov qword [rbp - 0x20], rax
lea rcx, [0x1401d2108]
cmp rax, rcx
je 0x14003fbcc
lock inc dword [rax + 8]
mov qword [rbp - 8], rax
lea rdx, [0x1401d22d0]
lea rbx, [rbp - 0x20]
mov rcx, rbx
call fcn.14004b498
mov r14, rax
mov rcx, qword [rbp - 8]
lea rax, [0x1401d2108]
cmp rcx, rax
je 0x14003fc11
mov eax, 0xffffffff
lock xadd dword [rcx + 8], eax
test eax, eax
jne 0x14003fc11
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [0x1401b4100]
movabs rax, 0xaaaaaaaaaaaaaaaa
mov qword [rbp - 0x10], rax
movaps xmm0, xmmword [0x1401940a0]
movaps xmmword [rbp - 0x20], xmm0
mov rax, qword [r14]
xor r15b, 1
movzx ecx, r15b
mov rax, qword [rax + rcx*8 + 0x28]
mov rcx, r14
mov rdx, rbx
call qword [0x1401b4100]
mov al, byte [rbp - 9]
test al, al
jns 0x14003fcab
mov rbx, qword [rbp - 0x20]
jmp 0x14003fcab
mov rcx, qword [rbp - 0x20]
mov rdx, qword [rbp - 0x18]
lea rdx, [rcx + rdx*2]
cmp rbx, rdx
je 0x14003fcc7
test rdi, rdi
je 0x14003fc83
movzx eax, word [rbx]
mov rcx, qword [rdi + 0x30]
cmp rcx, qword [rdi + 0x38]
je 0x14003fc87
lea rdx, [rcx + 2]
mov qword [rdi + 0x30], rdx
mov word [rcx], ax
jmp 0x14003fc9c
xor edi, edi
jmp 0x14003fca7
mov rcx, qword [rdi]
mov r8, qword [rcx + 0x60]
mov rcx, rdi
mov edx, eax
mov rax, r8
call qword [0x1401b4100]
cmp ax, 0xffff
jne 0x14003fca4
xor edi, edi
mov al, byte [rbp - 9]
add rbx, 2
test al, al
js 0x14003fc53
movzx ecx, al
lea rcx, [rcx*2 - 0x20]
add rcx, rbp
cmp rbx, rcx
jne 0x14003fc64
mov qword [rsi], rdi
jmp 0x14003fccf
mov qword [rsi], rdi
call fcn.14014b4e4
mov rax, rsi
add rsp, 0x58
pop rbx
pop rdi
pop rsi
pop r14
pop r15
pop rbp
ret