joyce8/EMBER2024-capa huggingface dataset:
Function at 0x20109820
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x28
mov rsi, rcx
movabs rbx, 0x9984d958403a33d5
mov r8, qword [rcx + 0x370]
mov rax, qword [rcx + 0x378]
sub rax, r8
shr rax, 5
imul eax, eax, 0xcccccccd
test eax, eax
jle 0x20109908
mov edi, 0x80
movabs r14, 0xe5e28847bf04b4f5
xor r15d, r15d
mov ebp, 0x3748020e
movabs r12, 0xcccccccccccccccd
jmp 0x201098f6
mov edx, dword [r8 + rdi - 0x5c]
add r8, rdi
mov r9d, dword [0x2044de68]
add r9d, ebp
mov rcx, rsi
call fcn.20081160
mov r8, qword [rsi + 0x370]
mov rax, qword [rsi + 0x378]
sub rax, r8
sar rax, 5
imul rax, r12
mov ecx, dword [0x2044de60]
mov edx, ebx
sub edx, r14d
add edx, 0x1e
mov r9d, edx
xor r9d, ecx
and edx, ecx
lea ecx, [r9 + rdx*2]
add ecx, r14d
shl rax, cl
inc r15
sar rax, 0x20
add rdi, 0xa0
cmp r15, rax
jge 0x20109908
cmp dword [r8 + rdi + 8], 0
jne 0x20109890
cmp qword [r8 + rdi + 8], 0
je 0x201098aa
jmp 0x20109890
movabs rcx, 0xf91cf246740c8e7b
mov rax, qword [rsi + 0x398]
add rax, rcx
sub rax, qword [rsi + 0x390]
sub rax, rcx
mov ecx, ebx
neg ecx
movabs rdx, 0xcf593503a9962f7a
mov r8d, dword [0x2044de60]
add r8d, edx
sub edx, r8d
mov r8d, ecx
xor r8d, edx
and edx, ecx
lea ecx, [r8 + rdx*2]
neg cl
shr rax, cl
test eax, eax
jle 0x201099e5
movabs r14, 0xc9493ced50350c8e
movabs r15, 0xb47fdf03dcec7634
movabs r12, 0x4db164be369a5b5c
xor edi, edi
movabs r13, 0x3c7328343466b8a8
lea rbp, [r14 + r15]
add rbp, r13
nop dword [rax + rax]
mov eax, dword [0x2044de68]
mov ecx, eax
xor ecx, 0x3748020e
and eax, 0x3748020e
lea r9d, [rcx + rax*2]
mov rcx, rsi
mov edx, edi
xor r8d, r8d
call fcn.20081160
inc edi
mov rax, qword [rsi + 0x398]
sub rax, r14
sub rax, r12
sub rax, r15
add rax, rbp
sub rax, qword [rsi + 0x390]
sub rax, r13
add rax, r12
mov ecx, dword [0x2044de60]
add ecx, ebx
shr rax, cl
cmp edi, eax
jl 0x20109990
lea rdi, [rsi + 0x558]
mov rcx, qword [rsi + 0x558]
test rcx, rcx
je 0x20109a21
cmp dword [rsi + 0x574], 1
jne 0x20109a0f
mov r8, qword [rsi + 0x560]
xor edx, edx
call fcn.20354420
mov rcx, qword [rdi]
test rcx, rcx
je 0x20109a21
mov edx, 0x3935ad9d
call fcn.200807c0
xorps xmm0, xmm0
movups xmmword [rdi], xmm0
mov qword [rdi + 0x10], 0
mov byte [rsi + 0x570], 1
mov rcx, rsi
add rsp, 0x28
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
jmp fcn.2007a320
Function at 0x2010fa10
Capabilities:
Encode data using xor

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x28
lea rbp, [rsp + 0x20]
mov qword [rbp], 0xfffffffffffffffe
mov r11, qword [0x2044e3c8]
mov rsi, rdx
mov rdi, rcx
mov eax, dword [0x204a1ecc]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
movsxd r8, dword [r11]
mov r10d, dword [0x20372f04]
test rdx, rdx
js 0x2010fbea
mov r14, qword [rdi + 8]
mov rbx, qword [rdi + 0x18]
sub rbx, r14
mov r9, rbx
shr r9, 1
movabs rax, 0x7fffffffffffffff
mov rdx, r9
xor rdx, rax
movzx ecx, byte [0x204a1d18]
mov r12d, dword [0x2044e3c0]
lea r15d, [r12 + 1]
mov dword [0x2044e3c0], r15d
mov r13d, r12d
not r13d
xor r12d, r15d
not r15d
and r15d, r13d
or r15d, r12d
xor r12d, r12d
xor r15d, 0xffffffff
jne 0x2010fad3
test r10d, r10d
jle 0x2010fad3
add r8, r11
xor r11d, r11d
xor r12d, r12d
movsxd r13, r11d
mov r13d, dword [r8 + r13]
xor r12d, r13d
add r11d, 4
cmp r11d, r10d
jl 0x2010fac0
mov r8, r9
xor r8, rbx
and r9, rbx
lea r8, [r8 + r9*2]
cmp r8, rsi
cmova rsi, r8
cmp rbx, rdx
cmova rsi, rax
test cl, 1
cmovne rsi, rax
test r14, r14
je 0x2010fb5a
mov rcx, r14
xor edx, edx
mov r8, rbx
call fcn.20354420
cmp rbx, 0x1000
jb 0x2010fb35
mov rax, qword [r14 - 8]
cmp byte [0x204a1eec], 0
jne 0x2010fb2e
sub r14, rax
add r14, 0xfffffffffffffff8
cmp r14, 0x20
jae 0x2010fbf4
add rbx, 0x27
mov r14, rax
lea r13, [rdi + 8]
mov rcx, r14
mov rdx, rbx
mov r8d, 0xa270e721
call fcn.200807c0
xorps xmm0, xmm0
movups xmmword [r13], xmm0
mov qword [r13 + 0x10], 0
cmp rsi, 0x1000
jb 0x2010fbb4
cmp rsi, 0xffffffffffffffd9
jae 0x2010fbef
lea rcx, [rsi + 0x27]
mov edx, 0x2eede17
call fcn.200810a0
mov rcx, rax
mov eax, dword [0x2037300c]
xor edx, edx
cmp r15d, 1
sbb edx, edx
sub eax, r12d
xor edx, eax
not edx
test edx, eax
setne al
or al, byte [0x204a1d18]
and al, 1
mov byte [0x204a1d18], al
lea rax, [rcx + 0x27]
and rax, 0xffffffffffffffe0
mov qword [rax - 8], rcx
jmp 0x2010fbca
test rsi, rsi
je 0x2010fbc8
mov rcx, rsi
mov edx, 0x2eede17
call fcn.200810a0
jmp 0x2010fbca
xor eax, eax
mov qword [rdi + 8], rax
mov qword [rdi + 0x10], rax
add rsi, rax
mov qword [rdi + 0x18], rsi
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
call fcn.2010ea80
call fcn.2006d860
call fcn.2030c4cc
int3
Function at 0x20141360
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
sub rsp, 0x28
test ecx, ecx
je 0x20141399
test edx, edx
je 0x201413c9
movzx eax, byte [0x20453c69]
cmp al, 0x2f
je 0x20141459
mov cl, 0x35
nop
mov al, 0xff
lock cmpxchg byte [0x20453c69], cl
je 0x20141429
cmp al, 0x2f
jne 0x20141380
jmp 0x20141459
test edx, edx
je 0x201413f9
movzx eax, byte [0x20453ae5]
cmp al, 7
je 0x20141499
mov cl, 0xc2
nop
mov al, 0x45
lock cmpxchg byte [0x20453ae5], cl
je 0x20141465
cmp al, 7
jne 0x201413b0
jmp 0x20141499
movzx eax, byte [0x20453c88]
cmp al, 0x64
je 0x20141529
mov cl, 0x67
nop word [rax + rax]
mov al, 0x5c
lock cmpxchg byte [0x20453c88], cl
je 0x201414a5
cmp al, 0x64
jne 0x201413e0
jmp 0x20141529
movzx eax, byte [0x20453bb5]
cmp al, 0xe7
je 0x20141569
mov cl, 0xa3
nop word [rax + rax]
mov al, 0x5d
lock cmpxchg byte [0x20453bb5], cl
je 0x20141532
cmp al, 0xe7
jne 0x20141410
jmp 0x20141569
xor eax, eax
lea rcx, [0x20453c60]
lea rdx, [0x20373ed0]
nop dword [rax]
movzx r8d, byte [rax + rdx]
xor byte [rax + rcx], r8b
inc rax
cmp eax, 9
jl 0x20141440
mov al, 0x2f
xchg byte [0x20453c69], al
lea rax, [0x20453c60]
jmp 0x20141570
xor eax, eax
lea rcx, [0x20453ae0]
lea rdx, [0x20373d70]
nop word cs:[rax + rax]
movzx r8d, byte [rax + rdx]
add byte [rax + rcx], r8b
inc rax
cmp eax, 5
jl 0x20141480
mov al, 7
xchg byte [0x20453ae5], al
lea rax, [0x20453ae0]
jmp 0x20141570
cmp qword [0x204a2008], 0
jne 0x201414ff
xor edi, edi
xor ecx, ecx
mov edx, 1
mov r8d, 4
mov r9d, 0x21d5f4e4
call fcn.20141300
mov rsi, rax
mov qword [0x204a2008], rax
lea rcx, [0x20140930]
mov edx, 0x5006f992
call fcn.200ec9f0
lea rax, [0x20373f20]
nop dword [rax + rax]
movzx ecx, byte [rdi + rax]
mov byte [rsi + rdi], cl
inc rdi
cmp edi, 2
jle 0x201414f0
mov rax, qword [0x204a2008]
xor ecx, ecx
lea rdx, [0x20373f30]
nop
movzx r8d, byte [rcx + rdx]
xor byte [rax + rcx], r8b
inc rcx
cmp ecx, 3
jl 0x20141510
mov al, 0x64
xchg byte [0x20453c88], al
mov rax, qword [0x204a2008]
jmp 0x20141570
xor eax, eax
lea rcx, [0x20453ba0]
lea rdx, [0x20373e20]
nop word cs:[rax + rax]
movzx r8d, byte [rax + rdx]
xor byte [rax + rcx], r8b
inc rax
cmp eax, 0x15
jl 0x20141550
mov al, 0xe7
xchg byte [0x20453bb5], al
lea rax, [0x20453ba0]
add rsp, 0x28
pop rdi
pop rsi
ret
Function at 0x20181050
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
test ecx, ecx
je 0x2018108c
test edx, edx
je 0x201810bc
cmp byte [0x20459d37], 0
je 0x20181084
mov cl, 0x75
nop word cs:[rax + rax]
mov al, 0xa0
lock cmpxchg byte [0x20459d37], cl
je 0x2018111c
test al, al
jne 0x20181070
lea rax, [0x20459d30]
ret
test edx, edx
je 0x201810ec
movzx eax, byte [0x20459eab]
cmp al, 0x7f
je 0x201810b4
mov cl, 0xa2
nop dword [rax]
mov al, 0x20
lock cmpxchg byte [0x20459eab], cl
je 0x20181151
cmp al, 0x7f
jne 0x201810a0
lea rax, [0x20459ea0]
ret
movzx eax, byte [0x20459e76]
cmp al, 0x46
je 0x201810e4
mov cl, 0x5c
nop dword [rax]
mov al, 0x93
lock cmpxchg byte [0x20459e76], cl
je 0x20181191
cmp al, 0x46
jne 0x201810d0
lea rax, [0x20459e50]
ret
movzx eax, byte [0x20459d26]
cmp al, 0xdc
je 0x20181114
mov cl, 0xd1
nop dword [rax]
mov al, 0xcc
lock cmpxchg byte [0x20459d26], cl
je 0x201811d1
cmp al, 0xdc
jne 0x20181100
lea rax, [0x20459d20]
ret
xor eax, eax
lea rcx, [0x20459d30]
lea rdx, [0x20375600]
nop dword [rax]
movzx r8d, byte [rax + rdx]
xor byte [rax + rcx], r8b
inc rax
cmp eax, 7
jl 0x20181130
xor eax, eax
xchg byte [0x20459d37], al
lea rax, [0x20459d30]
ret
xor eax, eax
lea rcx, [0x20459ea0]
lea rdx, [0x20375760]
nop word cs:[rax + rax]
movzx r8d, byte [rax + rdx]
add byte [rax + rcx], r8b
inc rax
cmp eax, 0xb
jl 0x20181170
mov al, 0x7f
xchg byte [0x20459eab], al
lea rax, [0x20459ea0]
ret
xor eax, eax
lea rcx, [0x20459e50]
lea rdx, [0x20375710]
nop word cs:[rax + rax]
movzx r8d, byte [rax + rdx]
add byte [rax + rcx], r8b
inc rax
cmp eax, 0x26
jl 0x201811b0
mov al, 0x46
xchg byte [0x20459e76], al
lea rax, [0x20459e50]
ret
xor eax, eax
lea rcx, [0x20459d20]
lea rdx, [0x203755f0]
nop word cs:[rax + rax]
movzx r8d, byte [rax + rdx]
add byte [rax + rcx], r8b
inc rax
cmp eax, 6
jl 0x201811f0
mov al, 0xdc
xchg byte [0x20459d26], al
lea rax, [0x20459d20]
ret
Function at 0x20182220
Capabilities:
Encode data using xor

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x38
lea rbp, [rsp + 0x30]
mov qword [rbp], 0xfffffffffffffffe
mov rsi, rcx
mov rdi, qword [rcx]
mov r12, qword [rcx + 8]
sub r12, rdi
sar r12, 4
inc r12
mov rcx, qword [rcx + 0x10]
sub rcx, rdi
sar rcx, 4
mov rax, rcx
shr rax, 1
movabs r11, 0xfffffffffffffff
mov r10, r11
sub r10, rax
add rax, rcx
cmp rax, r12
cmovbe rax, r12
cmp rcx, r10
cmova rax, r11
mov rcx, rax
shr rcx, 0x3c
jne 0x201824b9
mov r15, rdx
mov rcx, rax
shl rcx, 4
cmp rax, 0x100
mov qword [rbp - 8], rcx
mov qword [rbp - 0x10], r8
jb 0x201822f1
cmp byte [0x204a1d01], 0
jne 0x201822c6
movabs rdx, 0xffffffffffffffe
cmp rax, rdx
jae 0x201824b9
mov r13, r9
add rcx, 0x27
mov edx, 0x97df8c59
call fcn.200810a0
mov rcx, rax
xor rcx, 0x27
mov edx, eax
and edx, 0x27
lea rbx, [rcx + rdx*2]
and rbx, 0xffffffffffffffe0
mov qword [rbx - 8], rax
jmp 0x20182301
mov r13, r9
mov edx, 0x97df8c59
call fcn.200810a0
mov rbx, rax
mov r14, r15
sub r14, rdi
sar r14, 4
shl r14, 4
mov rax, qword [r13]
mov rcx, qword [rbp - 0x10]
mov rcx, qword [rcx]
mov qword [rbx + r14], rcx
mov qword [rbx + r14 + 8], rax
mov rcx, qword [rsi]
mov rax, qword [rsi + 8]
cmp rax, r15
je 0x20182386
cmp rcx, r15
je 0x20182353
mov rax, rbx
nop word [rax + rax]
movups xmm0, xmmword [rcx]
movups xmmword [rax], xmm0
add rax, 0x10
add rcx, 0x10
cmp rcx, r15
jne 0x20182340
mov rax, qword [rsi + 8]
cmp rax, r15
je 0x201823a3
lea rcx, [r14 + rbx]
add rcx, 0x10
nop word cs:[rax + rax]
movups xmm0, xmmword [r15]
movups xmmword [rcx], xmm0
add r15, 0x10
add rcx, 0x10
cmp r15, rax
jne 0x20182370
jmp 0x201823a3
cmp rcx, rax
je 0x201823a6
mov rdx, rbx
nop
movups xmm0, xmmword [rcx]
movups xmmword [rdx], xmm0
add rdx, 0x10
add rcx, 0x10
cmp rcx, rax
jne 0x20182390
mov rcx, qword [rsi]
add r14, rbx
movsxd r11, dword [0x203758fc]
mov edi, dword [0x203758f8]
test rcx, rcx
je 0x2018248c
mov rdx, qword [rsi + 0x10]
sub rdx, rcx
cmp rdx, 0x1000
jb 0x20182481
lea rax, [0x203758fc]
add r11, rax
mov rax, qword [rcx - 8]
mov r8d, dword [0x2045a104]
lea r9d, [r8 + 1]
mov dword [0x2045a104], r9d
xor r10d, r10d
test r8d, r9d
jne 0x20182423
test edi, edi
jle 0x20182423
xor r15d, r15d
xor r10d, r10d
nop word cs:[rax + rax]
movsxd r13, r15d
add r13, r11
xor r10d, dword [r13]
add r15d, 4
cmp r15d, edi
jl 0x20182410
cmp byte [0x204a229c], 0
jne 0x2018243d
sub rcx, rax
add rcx, 0xfffffffffffffff8
cmp rcx, 0x20
jae 0x201824be
xor r11d, r11d
test r8d, r9d
setne r11b
mov r8d, dword [0x203758e4]
sub r8d, r10d
lea ecx, [r11 - 1]
xor ecx, r8d
not r8d
neg r11d
and r11d, r8d
or ecx, r11d
not ecx
test ecx, ecx
setne cl
or cl, byte [0x204a229c]
and cl, 1
mov byte [0x204a229c], cl
add rdx, 0x27
mov rcx, rax
mov r8d, 0x404aba79
call fcn.200807c0
mov qword [rsi], rbx
shl r12, 4
add r12, rbx
mov qword [rsi + 8], r12
mov rax, qword [rbp - 8]
add rax, rbx
mov qword [rsi + 0x10], rax
mov rax, r14
add rsp, 0x38
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
call fcn.2006d860
call fcn.2030c4cc
int3
Function at 0x2018cda0
Capabilities:
Encode data using xor

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x68
lea rbp, [rsp + 0x60]
mov qword [rbp], 0xfffffffffffffffe
mov rax, qword [rcx]
mov r14, qword [0x2045bbe8]
mov rdi, rdx
mov rsi, rcx
movsxd r15, dword [r14]
mov ebx, dword [0x203762b4]
cmp rax, 0xffffffffffffffff
je 0x2018ce30
mov rdx, qword [rsi + 8]
test rdx, rdx
je 0x2018ce15
mov rax, qword [rsi + 0x10]
mov rax, qword [rax + 0x6e0]
xor ecx, ecx
call qword [case.0x200fc05d.0]
cmp eax, 1
sete al
movzx ecx, byte [0x204a2249]
test cl, al
jne 0x2018ce0d
xor cl, al
je 0x2018ce15
mov qword [rsi + 8], 0
mov rcx, qword [rsi]
mov rax, qword [rsi + 0x10]
mov rax, qword [rax + 0x6e8]
call qword [case.0x200fc05d.0]
mov qword [rsi], 0xffffffffffffffff
mov rax, r15
xor rax, r14
and r15, r14
lea rax, [rax + r15*2]
mov r14d, dword [0x2045bbe0]
mov ecx, r14d
neg ecx
mov r15d, 1
sub r15d, ecx
mov dword [0x2045bbe0], r15d
xor r15d, r14d
not r15d
xor r12d, r12d
test r15d, r14d
jne 0x2018ce7e
test ebx, ebx
jle 0x2018ce7e
xor ecx, ecx
xor r12d, r12d
movsxd rcx, ecx
xor r12d, dword [rax + rcx]
add ecx, 4
cmp ecx, ebx
jl 0x2018ce70
mov rax, qword [rsi + 0x10]
cmp qword [rax + 0x6d0], 0
je 0x2018cf52
mov rax, qword [rax + 0x698]
mov r13d, 1
mov edx, 1
mov r8d, 0x18
mov rcx, rdi
call qword [case.0x200fc05d.0]
test rax, rax
jne 0x2018cf0d
mov rax, qword [rsi + 0x10]
mov ecx, dword [0x203762b0]
and r15d, r14d
xor ebx, ebx
cmp r15d, 1
mov edx, 0
sbb edx, edx
sub ecx, r12d
test ecx, edx
setne cl
or cl, byte [0x204a2249]
and cl, 1
mov byte [0x204a2249], cl
mov rax, qword [rax + 0x698]
mov r13d, 2
mov edx, 2
mov r8d, 0x18
mov rcx, rdi
call qword [case.0x200fc05d.0]
test rax, rax
je 0x2018cf54
xorps xmm0, xmm0
movups xmmword [rbp - 0x20], xmm0
movups xmmword [rbp - 0x30], xmm0
mov qword [rbp - 0x10], 0
movabs rax, 0x8800000038
mov qword [rbp - 0x38], rax
mov qword [rbp - 8], rdi
mov qword [rbp - 0x18], r13
mov rax, qword [rsi + 0x10]
mov rax, qword [rax + 0x6d0]
lea rcx, [rbp - 0x38]
call qword [case.0x200fc05d.0]
mov qword [rsi], rax
mov bl, 1
jmp 0x2018cf54
xor ebx, ebx
mov eax, ebx
add rsp, 0x68
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
Function at 0x2018d630
Capabilities:
Encode data using xor

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x78
lea rbp, [rsp + 0x70]
mov qword [rbp], 0xfffffffffffffffe
movzx edx, byte [0x204a224b]
mov eax, dword [0x2045c08c]
mov qword [rbp - 8], rdx
or eax, edx
add eax, 0xffffe5ab
cdqe
add rax, qword [0x2045c0b8]
lea rcx, [rbp - 0x50]
mov edx, 0x4dd23840
call qword [case.0x200fc05d.0]
mov rbx, qword [rbp - 0x50]
mov rax, qword [rbp - 0x48]
mov qword [rbp - 0x38], rax
mov rax, qword [0x2045be68]
movsxd r15, dword [rax]
add r15, rax
mov r12d, dword [0x20376524]
mov rax, qword [rbp - 8]
neg eax
mov qword [rbp - 0x30], rax
jmp 0x2018d717
add rax, 0x28
mov rdx, rax
mov rcx, r8
and esi, r13d
movzx eax, word [0x2037653c]
cmp esi, 1
mov r8d, 0
sbb r8d, r8d
sub eax, r14d
and eax, r8d
test ax, ax
setne al
or al, byte [0x204a224b]
and al, 1
mov byte [0x204a224b], al
mov eax, dword [0x2045c090]
xor eax, dword [rbp - 8]
add eax, 0xffffe5ab
cdqe
add rax, qword [0x2045c0c8]
mov r8d, 0x1da5cedd
call qword [case.0x200fc05d.0]
mov rcx, qword [rbx + 8]
mov rax, rdi
call qword [case.0x200fc05d.0]
add rbx, 0x10
cmp rbx, qword [rbp - 0x38]
je 0x2018d82a
cmp qword [rbx + 8], 0
je 0x2018d713
mov esi, dword [0x2045be60]
lea r13d, [rsi + 1]
mov dword [0x2045be60], r13d
test esi, r13d
je 0x2018d750
xor r14d, r14d
jmp 0x2018d790
xor eax, eax
mov r14d, 0
test r12d, r12d
jle 0x2018d790
xor ecx, ecx
nop
movsxd rdx, eax
add rdx, r15
movzx edx, word [rdx]
mov r14d, edx
xor r14d, edx
not r14d
and r14d, ecx
xor r14d, edx
add eax, 2
mov ecx, r14d
cmp eax, r12d
jl 0x2018d760
nop word cs:[rax + rax]
mov qword [rbp - 0x10], 0xf
mov qword [rbp - 0x18], 0xf
mov eax, dword [0x2045c084]
mov rcx, qword [rbp - 0x30]
add eax, ecx
add eax, 0xffffe5ab
cdqe
add rax, qword [0x2045c0a0]
mov ecx, 0x256b8913
call qword [case.0x200fc05d.0]
mov rcx, qword [rax]
mov rax, qword [rax + 7]
mov qword [rbp - 0x28], rcx
mov qword [rbp - 0x21], rax
mov byte [rbp - 0x19], 0
lea rcx, [rbp - 0x28]
call fcn.2018db40
mov rdi, rax
mov rax, qword [rbp - 0x10]
cmp byte [0x204a1ec4], 0
jne 0x2018d7fb
cmp rax, 0x10
jb 0x2018d706
mov rcx, qword [rbp - 0x28]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jb 0x2018d6b3
mov r8, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, r8
cmp rcx, 0x20
jb 0x2018d6a9
call fcn.2030c4cc
mov eax, dword [0x2045c088]
mov rcx, qword [rbp - 8]
add eax, ecx
add eax, 0xffffe5ab
cdqe
add rax, qword [0x2045c0c0]
lea rcx, [rbp - 0x50]
call qword [case.0x200fc05d.0]
nop
add rsp, 0x78
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
Function at 0x2018f4a0
Capabilities:
Encode data using xor

Disassembly:
test ecx, ecx
je 0x2018f4dc
test edx, edx
je 0x2018f51c
movzx eax, byte [0x2045c1ec]
cmp al, 0x21
je 0x2018f4d4
mov cl, 0x9c
nop word cs:[rax + rax]
mov al, 0x5f
lock cmpxchg byte [0x2045c1ec], cl
je 0x2018f58c
cmp al, 0x21
jne 0x2018f4c0
lea rax, [0x2045c1d0]
ret
test edx, edx
je 0x2018f54c
test r8d, r8d
je 0x2018f5c1
movzx eax, byte [0x2045c10d]
cmp al, 0x72
je 0x2018f514
mov cl, 0xf9
nop word cs:[rax + rax]
mov al, 0x29
lock cmpxchg byte [0x2045c10d], cl
je 0x2018f659
cmp al, 0x72
jne 0x2018f500
lea rax, [0x2045c100]
ret
movzx eax, byte [0x2045c24b]
cmp al, 0x45
je 0x2018f544
mov cl, 0xb8
nop dword [rax]
mov al, 0xfb
lock cmpxchg byte [0x2045c24b], cl
je 0x2018f5ec
cmp al, 0x45
jne 0x2018f530
lea rax, [0x2045c240]
ret
test r8d, r8d
je 0x2018f621
movzx eax, byte [0x2045c1a5]
cmp al, 0x60
je 0x2018f584
mov cl, 0xaf
nop word cs:[rax + rax]
mov al, 0x7c
lock cmpxchg byte [0x2045c1a5], cl
je 0x2018f691
cmp al, 0x60
jne 0x2018f570
lea rax, [0x2045c190]
ret
xor eax, eax
lea rcx, [0x2045c1d0]
lea rdx, [0x203767d0]
nop dword [rax]
movzx r8d, byte [rax + rdx]
add byte [rax + rcx], r8b
inc rax
cmp eax, 0x1c
jl 0x2018f5a0
mov al, 0x21
xchg byte [0x2045c1ec], al
lea rax, [0x2045c1d0]
ret
movzx eax, byte [0x2045c203]
cmp al, 0x47
je 0x2018f5e4
mov cl, 0x69
nop
mov al, 0x94
lock cmpxchg byte [0x2045c203], cl
je 0x2018f6d1
cmp al, 0x47
jne 0x2018f5d0
lea rax, [0x2045c200]
ret
xor eax, eax
lea rcx, [0x2045c240]
lea rdx, [0x20376840]
nop dword [rax]
movzx r8d, byte [rax + rdx]
add byte [rax + rcx], r8b
inc rax
cmp eax, 0xb
jl 0x2018f600
mov al, 0x45
xchg byte [0x2045c24b], al
lea rax, [0x2045c240]
ret
movzx eax, byte [0x2045c1c2]
cmp al, 0xf9
je 0x2018f749
mov cl, 0xb2
nop word cs:[rax + rax]
mov al, 0xe8
lock cmpxchg byte [0x2045c1c2], cl
je 0x2018f711
cmp al, 0xf9
jne 0x2018f640
jmp 0x2018f749
xor eax, eax
lea rcx, [0x2045c100]
lea rdx, [0x20376710]
nop dword [rax]
movzx r8d, byte [rax + rdx]
add byte [rax + rcx], r8b
inc rax
cmp eax, 0xd
jl 0x2018f670
mov al, 0x72
xchg byte [0x2045c10d], al
lea rax, [0x2045c100]
ret
xor eax, eax
lea rcx, [0x2045c190]
lea rdx, [0x20376790]
nop word cs:[rax + rax]
movzx r8d, byte [rax + rdx]
add byte [rax + rcx], r8b
inc rax
cmp eax, 0x15
jl 0x2018f6b0
mov al, 0x60
xchg byte [0x2045c1a5], al
lea rax, [0x2045c190]
ret
xor eax, eax
lea rcx, [0x2045c200]
lea rdx, [0x20376800]
nop word cs:[rax + rax]
movzx r8d, byte [rax + rdx]
xor byte [rax + rcx], r8b
inc rax
cmp eax, 3
jl 0x2018f6f0
mov al, 0x47
xchg byte [0x2045c203], al
lea rax, [0x2045c200]
ret
xor eax, eax
lea rcx, [0x2045c1b0]
lea rdx, [0x203767b0]
nop word cs:[rax + rax]
movzx r8d, byte [rax + rdx]
xor byte [rax + rcx], r8b
inc rax
cmp eax, 0x12
jl 0x2018f730
mov al, 0xf9
xchg byte [0x2045c1c2], al
lea rax, [0x2045c1b0]
ret
Function at 0x20192e70
Capabilities:
Write file on windows

Disassembly:
sub rsp, 0x28
call fcn.2030cf88
nop
add rsp, 0x28
ret

Function at 0x20192e90
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
test ecx, ecx
je 0x20192ecc
test edx, edx
je 0x20192efc
movzx eax, byte [0x2045c4c2]
cmp al, 0xf6
je 0x20192ec4
mov cl, 0x59
nop word cs:[rax + rax]
mov al, 0x9e
lock cmpxchg byte [0x2045c4c2], cl
je 0x20192f5c
cmp al, 0xf6
jne 0x20192eb0
lea rax, [0x2045c4c0]
ret
test edx, edx
je 0x20192f2c
movzx eax, byte [0x2045c3ea]
cmp al, 0xa
je 0x20192ef4
mov cl, 0x3a
nop dword [rax]
mov al, 0x26
lock cmpxchg byte [0x2045c3ea], cl
je 0x20192f91
cmp al, 0xa
jne 0x20192ee0
lea rax, [0x2045c3e0]
ret
movzx eax, byte [0x2045c392]
cmp al, 0xa4
je 0x20192f24
mov cl, 0x7b
nop dword [rax]
mov al, 0xca
lock cmpxchg byte [0x2045c392], cl
je 0x20192fd1
cmp al, 0xa4
jne 0x20192f10
lea rax, [0x2045c390]
ret
movzx eax, byte [0x2045c4a6]
cmp al, 0x4d
je 0x20192f54
mov cl, 0x9b
nop dword [rax]
mov al, 0x3b
lock cmpxchg byte [0x2045c4a6], cl
je 0x20193011
cmp al, 0x4d
jne 0x20192f40
lea rax, [0x2045c480]
ret
xor eax, eax
lea rcx, [0x2045c4c0]
lea rdx, [0x20376c30]
nop dword [rax]
movzx r8d, byte [rax + rdx]
add byte [rax + rcx], r8b
inc rax
cmp eax, 2
jl 0x20192f70
mov al, 0xf6
xchg byte [0x2045c4c2], al
lea rax, [0x2045c4c0]
ret
xor eax, eax
lea rcx, [0x2045c3e0]
lea rdx, [0x20376b50]
nop word cs:[rax + rax]
movzx r8d, byte [rax + rdx]
add byte [rax + rcx], r8b
inc rax
cmp eax, 0xa
jl 0x20192fb0
mov al, 0xa
xchg byte [0x2045c3ea], al
lea rax, [0x2045c3e0]
ret
xor eax, eax
lea rcx, [0x2045c390]
lea rdx, [0x20376b10]
nop word cs:[rax + rax]
movzx r8d, byte [rax + rdx]
xor byte [rax + rcx], r8b
inc rax
cmp eax, 2
jl 0x20192ff0
mov al, 0xa4
xchg byte [0x2045c392], al
lea rax, [0x2045c390]
ret
xor eax, eax
lea rcx, [0x2045c480]
lea rdx, [0x20376bf0]
nop word cs:[rax + rax]
movzx r8d, byte [rax + rdx]
add byte [rax + rcx], r8b
inc rax
cmp eax, 0x26
jl 0x20193030
mov al, 0x4d
xchg byte [0x2045c4a6], al
lea rax, [0x2045c480]
ret
Function at 0x20193060
Capabilities:
Encode data using xor

Disassembly:
test ecx, ecx
je 0x2019309c
test edx, edx
je 0x201930cc
movzx eax, byte [0x2045c382]
cmp al, 0x6e
je 0x20193094
mov cl, 0x28
nop word cs:[rax + rax]
mov al, 0xd5
lock cmpxchg byte [0x2045c382], cl
je 0x2019312c
cmp al, 0x6e
jne 0x20193080
lea rax, [0x2045c370]
ret
test edx, edx
je 0x201930fc
movzx eax, byte [0x2045c312]
cmp al, 7
je 0x201930c4
mov cl, 0x35
nop dword [rax]
mov al, 0x1b
lock cmpxchg byte [0x2045c312], cl
je 0x20193161
cmp al, 7
jne 0x201930b0
lea rax, [0x2045c310]
ret
movzx eax, byte [0x2045c415]
cmp al, 0xec
je 0x201930f4
mov cl, 0xb8
nop dword [rax]
mov al, 0x60
lock cmpxchg byte [0x2045c415], cl
je 0x201931a1
cmp al, 0xec
jne 0x201930e0
lea rax, [0x2045c410]
ret
movzx eax, byte [0x2045c340]
cmp al, 0xf5
je 0x20193124
mov cl, 0xbf
nop dword [rax]
mov al, 0xcd
lock cmpxchg byte [0x2045c340], cl
je 0x201931e1
cmp al, 0xf5
jne 0x20193110
lea rax, [0x2045c330]
ret
xor eax, eax
lea rcx, [0x2045c370]
lea rdx, [0x20376af0]
nop dword [rax]
movzx r8d, byte [rax + rdx]
xor byte [rax + rcx], r8b
inc rax
cmp eax, 0x12
jl 0x20193140
mov al, 0x6e
xchg byte [0x2045c382], al
lea rax, [0x2045c370]
ret
xor eax, eax
lea rcx, [0x2045c310]
lea rdx, [0x20376aa0]
nop word cs:[rax + rax]
movzx r8d, byte [rax + rdx]
xor byte [rax + rcx], r8b
inc rax
cmp eax, 2
jl 0x20193180
mov al, 7
xchg byte [0x2045c312], al
lea rax, [0x2045c310]
ret
xor eax, eax
lea rcx, [0x2045c410]
lea rdx, [0x20376b80]
nop word cs:[rax + rax]
movzx r8d, byte [rax + rdx]
add byte [rax + rcx], r8b
inc rax
cmp eax, 5
jl 0x201931c0
mov al, 0xec
xchg byte [0x2045c415], al
lea rax, [0x2045c410]
ret
xor eax, eax
lea rcx, [0x2045c330]
lea rdx, [0x20376ac0]
nop word cs:[rax + rax]
movzx r8d, byte [rax + rdx]
xor byte [rax + rcx], r8b
inc rax
cmp eax, 0x10
jl 0x20193200
mov al, 0xf5
xchg byte [0x2045c340], al
lea rax, [0x2045c330]
ret