joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1401870a0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
xor ebx, ebx
mov r10d, 0x100
or edx, r10d
mov r11d, r8d
mov rdi, rcx
nop dword [rax + rax]
add r11d, r11d
mov r8d, edx
shr r8d, 8
mov ecx, edx
shr ecx, 7
mov eax, r10d
and ecx, 1
and eax, r11d
neg ecx
add eax, r10d
shr rcx, 4
add r8d, eax
and ecx, 0x7f
add edx, edx
movzx r8d, word [rdi + r8*2]
shr r8, 4
xor r8, rcx
mov ecx, edx
xor ecx, r11d
not ecx
and r10d, ecx
add ebx, dword [r9 + r8*4]
cmp edx, 0x10000
jb 0x1401870c0
mov rdi, qword [rsp + 0x10]
mov eax, ebx
mov rbx, qword [rsp + 8]
ret

Function at 0x140187340
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
mov rbx, r9
mov rdi, r8
mov ebp, edx
mov rsi, rcx
xor r11d, r11d
mov r10d, r11d
lea rdi, [rdi + 8]
shr r10d, 1
mov r9d, r11d
shr r9d, 2
mov ecx, r10d
and ecx, 1
add r11d, 2
neg ecx
shr rcx, 4
and ecx, 0x7f
lea eax, [r9 + 2]
movzx edx, word [rsi + rax*2]
movzx eax, word [rsi + 2]
shr rax, 4
shr rdx, 4
xor rdx, rcx
mov ecx, r9d
neg ecx
shr rcx, 4
and ecx, 0x7f
mov r8d, dword [rbx + rdx*4]
xor rcx, rax
lea eax, [r10 + 4]
movzx edx, word [rsi + rax*2]
mov eax, edx
xor rdx, 0x7f0
add r8d, dword [rbx + rcx*4]
add r8d, ebp
shr rax, 4
shr rdx, 4
mov ecx, dword [rbx + rax*4]
add ecx, r8d
mov dword [rdi - 8], ecx
mov ecx, dword [rbx + rdx*4]
add ecx, r8d
mov dword [rdi - 4], ecx
cmp r11d, 8
jb 0x140187362
mov rbx, qword [rsp + 8]
mov rbp, qword [rsp + 0x10]
mov rsi, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
ret
Function at 0x14018ab40
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
cmp dword [rcx + 0xcc], 0
mov rbp, rcx
jne 0x14018ab6d
call fcn.140189560
mov rcx, rbp
call fcn.140189280
mov ecx, dword [rbp + 0xc4]
lea r8, [rbp + 0x2570]
mov eax, dword [rbp + 0x48]
lea r9, [rbp + 0x820]
dec eax
mov dword [rbp + 0xec], 0x40
mov ebx, 1
mov dword [rbp + 0xb174], eax
mov edx, ebx
mov dword [rbp + 0x6d70], eax
shl edx, cl
lea rcx, [rbp + 0x6d70]
call fcn.140187410
mov ecx, dword [rbp + 0xc4]
lea r8, [rbp + 0x2970]
shl ebx, cl
lea r9, [rbp + 0x820]
mov edx, ebx
lea rcx, [rbp + 0xb174]
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
jmp fcn.140187410

Function at 0x140190d0c
Capabilities:
Encode data using xor

Disassembly:
lea r10, [rdx + r8]
mov r9, rdx
cmp rdx, r10
je 0x140190d3d
movzx r8d, byte [r9]
lea rdx, [0x1402bf8e0]
mov eax, ecx
inc r9
xor r8, rax
shr ecx, 8
movzx eax, r8b
movzx edx, word [rdx + rax*2]
xor ecx, edx
cmp r9, r10
jne 0x140190d18
mov eax, ecx
ret

Function at 0x1401970b0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
xor edx, edx
mov qword [rcx + 0x480], 0xffffffffffffffff
mov qword [rcx + 0x40], rdx
lea r8, [rcx + 0x78]
mov word [rcx + 0x22], dx
mov qword [rcx + 0x28], rdx
mov dword [rcx + 0x3c], 0x20
mov byte [rcx + 0x21], 1
mov dword [rcx + 0x5c], 4
nop
mov ecx, edx
lea r8, [r8 + 4]
and ecx, 1
mov eax, edx
shr eax, 1
neg ecx
and ecx, 0xedb88320
inc edx
xor ecx, eax
mov eax, ecx
shr ecx, 1
and eax, 1
neg eax
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
shr eax, 1
and ecx, 1
neg ecx
and ecx, 0xedb88320
xor ecx, eax
mov eax, ecx
shr ecx, 1
and eax, 1
neg eax
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
shr eax, 1
and ecx, 1
neg ecx
and ecx, 0xedb88320
xor ecx, eax
mov eax, ecx
shr ecx, 1
and eax, 1
neg eax
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
shr eax, 1
and ecx, 1
neg ecx
and ecx, 0xedb88320
xor ecx, eax
mov eax, ecx
shr ecx, 1
and eax, 1
neg eax
and eax, 0xedb88320
xor eax, ecx
mov dword [r8 - 4], eax
cmp edx, 0x100
jb 0x1401970e0
ret
Function at 0x1401976c0
Capabilities:
Encrypt data using rc4 prga
Resolve function by parsing pe exports

Disassembly:
push rbx
sub rsp, 0x70
mov r9d, dword [rcx + 0x14]
mov rbx, rdx
mov r11, rcx
cmp r9d, 3
jae 0x1401976e4
call fcn.1401981f0
mov rax, rbx
add rsp, 0x70
pop rbx
ret
mov r8, qword [rcx]
mov qword [rsp + 0x88], rbp
xor ebp, ebp
mov qword [rsp + 0x68], rsi
mov qword [rsp + 0x60], rdi
movzx eax, byte [r8 + 2]
movzx ecx, byte [r8]
shl rcx, 8
or rcx, rax
mov qword [rsp + 0x58], r12
movzx eax, byte [r8 + 1]
movzx edx, cx
mov qword [rsp + 0x50], r13
mov r13d, 2
mov qword [rsp + 0x48], r14
movzx ecx, word [r11 + rax*4 + 0x78]
mov rax, qword [r11 + 0x28]
xor rdx, rcx
mov edi, dword [rax + rdx*4]
lea rcx, [rax + rdx*4]
mov eax, dword [r11 + 8]
mov dword [rcx], eax
mov ecx, ebp
mov rax, qword [r11 + 0x30]
mov edx, dword [r11 + 8]
mov esi, dword [r11 + 0x1c]
mov r8d, dword [r11 + 0x18]
mov r12d, dword [r11 + 0x3c]
mov r10, qword [r11]
mov qword [rsp + 0x30], rax
lea r14, [rax + r8*8]
mov qword [rsp + 0x40], r15
mov eax, edx
mov dword [rsp + 0x20], esi
sub eax, esi
mov qword [rsp + 0x38], r8
cmp edx, esi
mov dword [rsp + 0x24], edx
lea r15, [r14 + 4]
mov dword [rsp + 0x90], ebp
cmova ecx, eax
mov dword [rsp + 0x80], ebp
mov dword [rsp + 0x98], ecx
cmp ecx, edi
jae 0x14019789a
xor eax, eax
mov ebp, edx
sub ebp, edi
mov edx, ebp
cmp rdx, r8
cmova eax, esi
mov ecx, eax
mov rax, qword [rsp + 0x30]
sub rcx, rdx
add rcx, r8
mov r8, r10
sub r8, rdx
mov edx, dword [rsp + 0x80]
cmp dword [rsp + 0x90], edx
lea rsi, [rax + rcx*8]
mov eax, edx
cmovb eax, dword [rsp + 0x90]
mov ecx, dword [rsi]
mov dword [rsp + 0x28], ecx
movzx ecx, byte [rax + r10]
cmp byte [rax + r8], cl
jne 0x14019783b
inc eax
cmp eax, r9d
je 0x140197822
movzx ecx, byte [rax + r10]
cmp byte [rax + r8], cl
jne 0x140197822
inc eax
cmp eax, r9d
je 0x140197822
nop word [rax + rax]
movzx ecx, byte [rax + r10]
cmp byte [rax + r8], cl
jne 0x140197822
inc eax
cmp eax, r9d
jne 0x140197810
cmp r13d, eax
jae 0x14019783b
mov dword [rbx], eax
lea ecx, [rbp - 1]
mov dword [rbx + 4], ecx
mov r13d, eax
add rbx, 8
cmp eax, r9d
je 0x140197889
movzx ecx, byte [rax + r10]
cmp byte [rax + r8], cl
jae 0x140197859
mov dword [r14], edi
lea r14, [rsi + 4]
mov edi, dword [r14]
mov dword [rsp + 0x80], eax
jmp 0x140197868
mov dword [r15], edi
mov r15, rsi
mov edi, dword [rsi]
mov dword [rsp + 0x90], eax
add r12d, 0xffffffff
je 0x140197898
cmp dword [rsp + 0x98], edi
jae 0x140197898
mov r8, qword [rsp + 0x38]
mov esi, dword [rsp + 0x20]
mov edx, dword [rsp + 0x24]
jmp 0x1401977a0
mov eax, dword [rsp + 0x28]
mov dword [r14], eax
mov eax, dword [rsi + 4]
mov dword [r15], eax
jmp 0x1401978a0
xor ebp, ebp
mov dword [r14], ebp
mov dword [r15], ebp
mov ecx, dword [r11 + 8]
inc dword [r11 + 0x18]
inc ecx
inc qword [r11]
mov r15, qword [rsp + 0x40]
mov r14, qword [rsp + 0x48]
mov r13, qword [rsp + 0x50]
mov r12, qword [rsp + 0x58]
mov rdi, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
mov rbp, qword [rsp + 0x88]
mov dword [r11 + 8], ecx
cmp ecx, dword [r11 + 0xc]
jne 0x1401978e5
mov rcx, r11
call fcn.140198010
mov rax, rbx
add rsp, 0x70
pop rbx
ret
Function at 0x1401978f0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbx
sub rsp, 0x40
mov r9d, dword [rcx + 0x14]
mov rbx, rdx
mov r11, rcx
cmp r9d, 3
jae 0x140197914
call fcn.1401981f0
mov rax, rbx
add rsp, 0x40
pop rbx
ret
mov r8, qword [rcx]
mov qword [rsp + 0x58], rbp
mov ebp, 2
mov qword [rsp + 0x60], rsi
mov qword [rsp + 0x68], rdi
movzx eax, byte [r8 + 2]
movzx ecx, byte [r8]
shl rcx, 8
or rcx, rax
mov qword [rsp + 0x38], r12
movzx eax, byte [r8 + 1]
movzx edx, cx
mov qword [rsp + 0x30], r13
mov qword [rsp + 0x28], r14
movzx ecx, word [r11 + rax*4 + 0x78]
mov rax, qword [r11 + 0x28]
xor rdx, rcx
mov esi, dword [rax + rdx*4]
lea rcx, [rax + rdx*4]
mov eax, dword [r11 + 8]
mov dword [rcx], eax
mov rdx, qword [r11 + 0x30]
mov r10, qword [r11]
mov r12d, dword [r11 + 0x18]
mov r14d, dword [r11 + 0x3c]
mov r13d, dword [r11 + 8]
mov qword [rsp + 0x20], r15
lea rdi, [r10 + r9]
mov r15d, dword [r11 + 0x1c]
mov dword [rdx + r12*4], esi
mov qword [rsp + 0x50], rdx
test esi, esi
je 0x140197a3a
mov r9d, r13d
sub r9d, esi
cmp r9d, r15d
jae 0x140197a3a
xor eax, eax
mov r8d, r9d
cmp r8, r12
cmova eax, r15d
mov ecx, eax
sub rcx, r8
neg r8
add rcx, r12
mov esi, dword [rdx + rcx*4]
mov edx, ebp
lea rax, [rdx + r8]
movzx ecx, byte [rax + r10]
cmp byte [rdx + r10], cl
jne 0x140197a1a
movzx ecx, byte [r8 + r10]
mov rax, r10
mov edx, r10d
cmp byte [r10], cl
jne 0x140197a04
nop word [rax + rax]
inc rax
mov rdx, rax
cmp rax, rdi
je 0x140197a2a
movzx ecx, byte [rax + r8]
cmp byte [rax], cl
je 0x1401979f0
sub edx, r10d
cmp ebp, edx
jae 0x140197a1a
lea eax, [r9 - 1]
mov dword [rbx], edx
mov dword [rbx + 4], eax
mov ebp, edx
add rbx, 8
add r14d, 0xffffffff
je 0x140197a3a
mov rdx, qword [rsp + 0x50]
jmp 0x140197995
sub edi, r10d
lea eax, [r9 - 1]
mov dword [rbx], edi
mov dword [rbx + 4], eax
add rbx, 8
mov ecx, dword [r11 + 8]
inc dword [r11 + 0x18]
inc ecx
inc qword [r11]
mov r15, qword [rsp + 0x20]
mov r14, qword [rsp + 0x28]
mov r13, qword [rsp + 0x30]
mov r12, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x58]
mov dword [r11 + 8], ecx
cmp ecx, dword [r11 + 0xc]
jne 0x140197a7c
mov rcx, r11
call fcn.140198010
mov rax, rbx
add rsp, 0x40
pop rbx
ret
Function at 0x140197a90
Capabilities:
Encrypt data using rc4 prga
Resolve function by parsing pe exports

Disassembly:
mov dword [rsp + 0x10], edx
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x38
mov rbx, rcx
nop word [rax + rax]
mov r9d, dword [rbx + 0x14]
cmp r9d, 3
jae 0x140197ac7
mov rcx, rbx
call fcn.1401981f0
jmp 0x140197c27
mov r8, qword [rbx]
xor r13d, r13d
xor r15d, r15d
xor r12d, r12d
movzx eax, byte [r8 + 2]
movzx ecx, byte [r8]
shl rcx, 8
or rcx, rax
movzx eax, byte [r8 + 1]
movzx edx, cx
movzx ecx, word [rbx + rax*4 + 0x78]
mov rax, qword [rbx + 0x28]
xor rdx, rcx
mov r11d, dword [rax + rdx*4]
lea rcx, [rax + rdx*4]
mov eax, dword [rbx + 8]
mov dword [rcx], eax
mov edx, dword [rbx + 8]
mov eax, edx
mov ecx, dword [rbx + 0x1c]
sub eax, ecx
mov r8d, dword [rbx + 0x18]
cmp edx, ecx
mov rdi, qword [rbx + 0x30]
mov ebp, dword [rbx + 0x3c]
cmova r13d, eax
mov r10, qword [rbx]
mov dword [rsp + 0x80], ecx
mov qword [rsp + 0x98], r8
lea rsi, [rdi + r8*8]
mov qword [rsp + 0x20], rdi
lea r14, [rsi + 4]
mov dword [rsp + 0x90], edx
cmp r13d, r11d
jae 0x140197bff
nop
xor eax, eax
sub edx, r11d
cmp rdx, r8
cmova eax, ecx
mov ecx, eax
mov eax, r12d
sub rcx, rdx
add rcx, r8
mov r8, r10
sub r8, rdx
cmp r15d, r12d
cmovb eax, r15d
lea rdi, [rdi + rcx*8]
movzx ecx, byte [rax + r10]
cmp byte [rax + r8], cl
jne 0x140197bae
inc eax
cmp eax, r9d
je 0x140197ba2
nop dword [rax]
movzx ecx, byte [rax + r10]
cmp byte [rax + r8], cl
jne 0x140197bae
inc eax
cmp eax, r9d
jne 0x140197b90
mov eax, dword [rdi]
mov dword [rsi], eax
mov eax, dword [rdi + 4]
mov dword [r14], eax
jmp 0x140197c0c
movzx ecx, byte [rax + r10]
cmp byte [rax + r8], cl
jae 0x140197bc9
mov dword [rsi], r11d
mov r12d, eax
mov r11d, dword [rdi + 4]
lea rsi, [rdi + 4]
jmp 0x140197bd5
mov dword [r14], r11d
mov r15d, eax
mov r11d, dword [rdi]
mov r14, rdi
add ebp, 0xffffffff
je 0x140197bff
cmp r13d, r11d
jae 0x140197bff
mov r8, qword [rsp + 0x98]
mov ecx, dword [rsp + 0x80]
mov edx, dword [rsp + 0x90]
mov rdi, qword [rsp + 0x20]
jmp 0x140197b50
mov dword [rsi], 0
mov dword [r14], 0
mov eax, dword [rbx + 8]
inc dword [rbx + 0x18]
inc eax
inc qword [rbx]
mov dword [rbx + 8], eax
cmp eax, dword [rbx + 0xc]
jne 0x140197c27
mov rcx, rbx
call fcn.140198010
add dword [rsp + 0x88], 0xffffffff
jne 0x140197ab0
add rsp, 0x38
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x140197c50
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov edi, edx
mov rbx, rcx
cmp dword [rbx + 0x14], 3
jae 0x140197c79
mov rcx, rbx
call fcn.1401981f0
dec edi
jmp 0x140197d01
mov edx, dword [rbx + 0x18]
mov rax, qword [rbx + 0x30]
mov r10d, dword [rbx + 0xc]
mov r9d, dword [rbx + 8]
sub r10d, r9d
mov rsi, qword [rbx + 0x28]
cmp edi, r10d
lea r11, [rax + rdx*4]
cmovbe r10d, edi
sub edi, r10d
lea eax, [r10 + rdx]
mov rdx, qword [rbx]
mov dword [rbx + 0x18], eax
nop word [rax + rax]
movzx eax, byte [rdx]
lea r8, [rdx + 1]
movzx ecx, byte [rdx + 2]
lea r11, [r11 + 4]
shl rax, 8
or rcx, rax
movzx eax, byte [r8]
movzx edx, cx
movzx ecx, word [rbx + rax*4 + 0x78]
xor rdx, rcx
mov eax, dword [rsi + rdx*4]
mov dword [rsi + rdx*4], r9d
inc r9d
mov dword [r11 - 4], eax
mov rdx, r8
add r10d, 0xffffffff
jne 0x140197cb0
mov qword [rbx], rdx
mov dword [rbx + 8], r9d
cmp r9d, dword [rbx + 0xc]
jne 0x140197d01
mov rcx, rbx
call fcn.140198010
test edi, edi
jne 0x140197c64
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x1401a0030
Capabilities:
Hash data using sha256

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdi, rdx
mov rbx, rcx
call fcn.140145830
mov r8d, 0x20
lea rcx, [rbx + 0x80]
mov rdx, rdi
call fcn.140145760
mov rdx, rdi
lea rcx, [rbx + 0x80]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp fcn.140145830

Function at 0x1401a01b0
Capabilities:
Hash data using sha1

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdi, rdx
mov rbx, rcx
call fcn.140146510
mov r8d, 0x14
lea rcx, [rbx + 0x80]
mov rdx, rdi
call fcn.140145760
mov rdx, rdi
lea rcx, [rbx + 0x80]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp fcn.140146510

Function at 0x1401a0200
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
mov qword [rsp + 0x10], rdx
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0xa0
mov r12d, r8d
mov r15, rdx
mov r8d, 0x14
lea rdx, [rsp + 0x20]
mov r13, rcx
call fcn.140146620
lea rcx, [r13 + 0x80]
mov r8d, 0x14
lea rdx, [rsp + 0x60]
call fcn.140146620
mov edi, dword [r15]
mov esi, dword [r15 + 4]
mov ebp, dword [r15 + 8]
mov r14d, dword [r15 + 0xc]
mov ebx, dword [r15 + 0x10]
mov dword [rsp + 0x20], edi
mov dword [rsp + 0x24], esi
mov dword [rsp + 0x28], ebp
mov dword [rsp + 0x2c], r14d
mov dword [rsp + 0x30], ebx
test r12d, r12d
je 0x1401a02cc
lea r8, [rsp + 0x60]
mov rcx, r13
lea rdx, [rsp + 0x20]
call fcn.140146670
lea r8, [rsp + 0x20]
lea rdx, [rsp + 0x60]
lea rcx, [r13 + 0x80]
call fcn.140146670
xor edi, dword [rsp + 0x20]
xor esi, dword [rsp + 0x24]
xor ebp, dword [rsp + 0x28]
xor r14d, dword [rsp + 0x2c]
xor ebx, dword [rsp + 0x30]
sub r12, 1
jne 0x1401a0281
mov r15, qword [rsp + 0xd8]
lea r11, [rsp + 0xa0]
mov dword [r15 + 4], esi
mov rsi, qword [r11 + 0x48]
mov dword [r15 + 8], ebp
mov rbp, qword [r11 + 0x40]
mov dword [r15 + 0x10], ebx
mov rbx, qword [r11 + 0x30]
mov dword [r15], edi
mov dword [r15 + 0xc], r14d
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x1401abe20
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
xor eax, eax
mov rsi, r8
mov dword [rcx + 0x2c], eax
mov rdi, rdx
mov qword [rcx + 0x34], rax
mov rbx, rcx
mov dword [rcx + 0x3c], eax
mov r8d, 0x3c
movzx eax, word [rdx]
mov word [rcx + 0x10], ax
movzx eax, word [rdx + 2]
mov dword [rcx + 0x14], eax
mov eax, dword [rdx + 4]
mov qword [rcx + 0x20], rax
mov eax, dword [rdx + 8]
mov dword [rcx + 0x30], eax
mov eax, dword [rdx + 0x10]
mov dword [rcx + 0x28], eax
movzx eax, word [rdx + 0x18]
mov dword [rcx + 0x18], eax
movzx eax, word [rdx + 0x1a]
mov dword [rcx + 0x48], eax
mov eax, dword [rdx + 0x1c]
mov qword [rcx + 0x40], rax
mov eax, dword [rdx + 0x20]
add rdx, 0x28
mov dword [rcx + 0x4c], eax
add rcx, 0x54
call fcn.140201ae0
movzx eax, word [rbx + 0x10]
mov ecx, 0xf000
and ax, cx
mov ecx, 0x8000
cmp ax, cx
jne 0x1401abeb4
mov eax, dword [rdi + 0x6c]
shl rax, 0x20
or qword [rbx + 0x20], rax
movzx eax, word [rdi + 0x74]
shl rax, 0x20
or qword [rbx + 0x40], rax
movzx eax, word [rdi + 0x78]
shl eax, 0x10
or dword [rbx + 0x14], eax
movzx eax, word [rdi + 0x7a]
shl eax, 0x10
or dword [rbx + 0x18], eax
mov eax, 0x80
cmp word [rsi + 0x48], ax
jbe 0x1401abf1e
movzx edx, word [rdi + 0x80]
lea ecx, [rax + rdx]
movzx eax, word [rsi + 0x48]
cmp ecx, eax
jbe 0x1401abef5
xor al, al
jmp 0x1401abf20
cmp edx, 0x1c
jb 0x1401abf1e
mov eax, dword [rdi + 0x88]
mov dword [rbx + 0x2c], eax
mov eax, dword [rdi + 0x8c]
mov dword [rbx + 0x34], eax
mov eax, dword [rdi + 0x90]
mov dword [rbx + 0x38], eax
mov eax, dword [rdi + 0x94]
mov dword [rbx + 0x3c], eax
mov al, 1
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x1401b0df4
Capabilities:
Check for software breakpoints

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x50
mov r14d, r8d
mov rdi, rdx
mov rbx, rcx
cmp r8d, 0xcc
jb 0x1401b1001
mov eax, dword [rdx]
bswap eax
cmp eax, 0x6d697368
jne 0x1401b1001
mov eax, dword [rdx + 4]
bswap eax
cmp eax, 1
jne 0x1401b1001
mov rax, qword [rdx + 0x18]
mov r8d, 0x80
mov rbp, qword [rdx + 0x10]
bswap rax
mov qword [rcx + 0x10], rax
mov eax, dword [rdx + 0x40]
bswap eax
mov dword [rcx + 0x38], eax
mov eax, dword [rdx + 0x44]
add rdx, 0x48
bswap eax
mov dword [rcx + 0x3c], eax
add rcx, 0x40
bswap rbp
call fcn.140201ae0
mov esi, dword [rdi + 0xc8]
bswap esi
cmp esi, 0x10000000
ja 0x1401b1001
lea eax, [rsi + rsi*4]
lea eax, [rax*8 + 0xcc]
cmp eax, r14d
jne 0x1401b1001
and qword [rbx + 8], 0
and qword [rbx], 0
and dword [rbx + 0x30], 0
cmp esi, dword [rbx + 0x34]
jbe 0x1401b0ee4
mov rcx, qword [rbx + 0x28]
call fcn.140202c34
and qword [rbx + 0x28], 0
mov eax, 0x28
and dword [rbx + 0x34], 0
mov ecx, esi
mul rcx
mov rcx, 0xffffffffffffffff
cmovo rax, rcx
mov rcx, rax
call fcn.140202da8
mov qword [rbx + 0x28], rax
mov dword [rbx + 0x34], esi
add rdi, 0xcc
mov byte [rbx + 0xc0], 1
xor r8d, r8d
test esi, esi
je 0x1401b0fc6
mov r11, qword [rdi + 8]
mov r10, qword [rdi + 0x10]
mov r9d, dword [rdi]
mov rax, qword [rdi + 0x18]
mov r14, qword [rdi + 0x20]
bswap r11
shl r11, 9
bswap r10
shl r10, 9
cmp dword [rbx + 0x30], 0
bswap r9d
bswap rax
bswap r14
mov dword [rsp + 0x20], r9d
mov qword [rsp + 0x28], r11
mov qword [rsp + 0x30], r10
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x40], r14
je 0x1401b0f64
mov eax, dword [rbx + 0x30]
mov rcx, qword [rbx + 0x28]
lea rdx, [rax + rax*4]
mov rax, qword [rcx + rdx*8 - 0x20]
add rax, qword [rcx + rdx*8 - 0x18]
cmp r11, rax
jne 0x1401b1001
cmp r9d, 0x7ffffffe
je 0x1401b0fb6
cmp r9d, 0xffffffff
je 0x1401b0fc6
add qword [rbx + 8], r14
test r10, r10
je 0x1401b0fb6
cmp r9d, 2
jne 0x1401b0f89
mov byte [rbx + 0xc0], 0
mov eax, dword [rbx + 0x30]
movups xmm0, xmmword [rsp + 0x20]
movups xmm1, xmmword [rsp + 0x30]
lea rcx, [rax + rax*4]
mov rax, qword [rbx + 0x28]
movups xmmword [rax + rcx*8], xmm0
movsd xmm0, qword [rsp + 0x40]
movups xmmword [rax + rcx*8 + 0x10], xmm1
movsd qword [rax + rcx*8 + 0x20], xmm0
inc dword [rbx + 0x30]
inc r8d
add rdi, 0x28
cmp r8d, esi
jb 0x1401b0efd
lea eax, [rsi - 1]
cmp r8d, eax
jne 0x1401b1001
cmp dword [rbx + 0x30], 0
je 0x1401b0ff1
mov eax, dword [rbx + 0x30]
lea rdx, [rax + rax*4]
mov rax, qword [rbx + 0x28]
mov rcx, qword [rax + rdx*8 - 0x20]
mov rdx, qword [rax + rdx*8 - 0x18]
add rdx, rcx
mov qword [rbx], rdx
jmp 0x1401b0ff4
mov rdx, qword [rbx]
shl rbp, 9
cmp rdx, rbp
jne 0x1401b1001
xor eax, eax
jmp 0x1401b1006
mov eax, 1
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
mov rdi, qword [rsp + 0x78]
add rsp, 0x50
pop r14
ret
Function at 0x1401cc964
Capabilities:
Encode data using xor

Disassembly:
xor r8d, r8d
cmp edx, 8
jb 0x1401cc988
mov r9d, edx
shr r9, 3
mov eax, dword [rcx + 4]
add edx, 0xfffffff8
xor eax, dword [rcx]
add rcx, 8
xor r8d, eax
sub r9, 1
jne 0x1401cc973
cmp edx, 4
jb 0x1401cc994
xor r8d, dword [rcx]
add rcx, 4
and edx, 3
cmp edx, 2
jbe 0x1401cc9aa
movzx eax, byte [rcx]
shl eax, 0x10
xor r8d, eax
inc rcx
jmp 0x1401cc9af
cmp edx, 1
jbe 0x1401cc9bd
movzx eax, byte [rcx]
shl eax, 8
xor r8d, eax
inc rcx
jmp 0x1401cc9c1
test edx, edx
je 0x1401cc9c7
movzx ecx, byte [rcx]
xor r8d, ecx
mov eax, r8d
ret
Function at 0x1401cf3b0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp dword [rcx + 0x40], 0xa
mov rax, rcx
jae 0x1401cf427
nop dword [rax]
mov r8d, dword [rax]
cmp r8d, 8
jae 0x1401cf3f9
mov rcx, qword [rax + 8]
cmp rcx, qword [rax + 0x10]
je 0x1401cf4f6
movzx edx, byte [rcx]
lea r9d, [r8 + 8]
inc rcx
mov qword [rax + 8], rcx
mov ecx, 0x18
sub ecx, r8d
mov r8d, edx
shl r8d, cl
or r8d, dword [rax + 4]
jmp 0x1401cf400
mov r9d, r8d
mov r8d, dword [rax + 4]
mov ecx, r8d
shr r8d, 0x18
shl ecx, 8
mov dword [rax + 4], ecx
lea ecx, [r9 - 8]
mov dword [rax], ecx
mov ecx, dword [rax + 0x40]
mov byte [rcx + rax + 0x70e6], r8b
inc dword [rax + 0x40]
cmp dword [rax + 0x40], 0xa
jb 0x1401cf3c0
mov dword [rax + 0x70f0], 0
movzx ecx, byte [rax + 0x70ec]
shl ecx, 8
mov dword [rax + 0x70f0], ecx
movzx edx, byte [rax + 0x70ed]
or edx, ecx
shl edx, 8
mov dword [rax + 0x70f0], edx
movzx ecx, byte [rax + 0x70ee]
or ecx, edx
shl ecx, 8
mov dword [rax + 0x70f0], ecx
movzx edx, byte [rax + 0x70ef]
or edx, ecx
mov dword [rax + 0x70f0], edx
movzx ecx, byte [rax + 0x70e6]
cmp cl, 0x31
jne 0x1401cf4f9
cmp byte [rax + 0x70e7], 0x41
jne 0x1401cf588
cmp byte [rax + 0x70e8], 0x59
jne 0x1401cf588
cmp byte [rax + 0x70e9], 0x26
jne 0x1401cf588
cmp byte [rax + 0x70ea], 0x53
jne 0x1401cf588
cmp byte [rax + 0x70eb], 0x59
jne 0x1401cf588
cmp byte [rax + 0x70f8], 0
jne 0x1401cf4d1
inc qword [rax + 0x7100]
inc qword [rax + 0x7108]
mov byte [rax + 0x70f8], 1
mov ecx, dword [rax + 0x70f4]
rol ecx, 1
xor ecx, edx
mov dword [rax + 0x70f4], ecx
mov dword [rax + 0x3c], 2
xor eax, eax
ret
cmp cl, 0x17
jne 0x1401cf588
cmp byte [rax + 0x70e7], 0x72
jne 0x1401cf588
cmp byte [rax + 0x70e8], 0x45
jne 0x1401cf588
cmp byte [rax + 0x70e9], 0x38
jne 0x1401cf588
cmp byte [rax + 0x70ea], 0x50
jne 0x1401cf588
cmp byte [rax + 0x70eb], 0x90
jne 0x1401cf588
cmp byte [rax + 0x70f8], 0
jne 0x1401cf53f
inc qword [rax + 0x7100]
mov r8d, dword [rax + 4]
mov byte [rax + 0x70f8], 1
test r8d, r8d
je 0x1401cf556
mov byte [rax + 0x70fa], 1
mov edx, dword [rax]
mov ecx, edx
and ecx, 7
mov dword [rax + 0x3c], 0xb
sub edx, ecx
shl r8d, cl
mov ecx, dword [rax + 0x70f4]
mov dword [rax], edx
mov dword [rax + 4], r8d
cmp dword [rax + 0x70f0], ecx
je 0x1401cf4f6
mov byte [rax + 0x70f9], 1
mov eax, 1
ret