joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1401f6c90
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x30
cmp qword [rcx + 0x10], 0xffffffffffffffff
mov rdi, rdx
mov rbx, rcx
jne 0x1401f6cb4
xor al, al
mov rbx, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
mov rax, qword [rcx]
call qword [rax + 8]
test al, al
je 0x1401f6ca7
mov rcx, qword [rbx + 0x10]
lea r9, [rsp + 0x40]
mov r8d, 1
mov rdx, rdi
mov qword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_ReadFile]
cmp eax, 1
jne 0x1401f6ceb
cmp dword [rsp + 0x40], 0
je 0x1401f6ca7
mov al, 1
mov rbx, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret

Function at 0x1401f6d80
Capabilities:
Clear file content

Disassembly:
push rbx
sub rsp, 0x20
cmp qword [rcx + 0x10], 0xffffffffffffffff
mov rbx, rcx
je 0x1401f6db2
mov rax, qword [rcx]
xor r8d, r8d
call qword [rax + 0x60]
test al, al
je 0x1401f6db2
mov rcx, qword [rbx + 0x10]
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
setne al
add rsp, 0x20
pop rbx
ret
xor al, al
add rsp, 0x20
pop rbx
ret

Function at 0x1401f6dc0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x30
cmp qword [rcx + 0x10], 0xffffffffffffffff
mov edi, r8d
mov rsi, rdx
mov rbx, rcx
jne 0x1401f6df2
or eax, 0xffffffff
mov rbx, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
mov rax, qword [rcx]
call qword [rax + 0x10]
test al, al
jne 0x1401f6e0e
xor eax, eax
mov rbx, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
mov rcx, qword [rbx + 0x10]
xor eax, eax
lea r9, [rsp + 0x40]
mov r8d, edi
mov rdx, rsi
mov dword [rsp + 0x40], eax
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov ecx, dword [rsp + 0x40]
mov rbx, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
or edx, 0xffffffff
test eax, eax
cmove ecx, edx
mov eax, ecx
add rsp, 0x30
pop rdi
ret

Function at 0x1401f87b0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push rdi
sub rsp, 0x40
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x50], rbx
mov rdi, rdx
mov rbx, rcx
mov eax, 0x204e
cmp word [rdx + 0x10], ax
jne 0x1401f8853
mov rcx, qword [rdx + 8]
mov eax, dword [rcx + 0x10]
cmp eax, 0xfffffffe
jne 0x1401f8801
lea rax, vtable.Core::EventArgs.0
mov qword [rsp + 0x58], rax
mov rax, qword [rbx]
lea rdx, [rsp + 0x58]
mov rcx, rbx
call qword [rax + 0x120]
nop
jmp 0x1401f8853
cmp eax, 0xffffff9b
jne 0x1401f8853
mov r8d, dword [rcx + 0x18]
cmp r8d, 0xffffffff
je 0x1401f8853
mov r9, qword [rcx + 0x38]
mov eax, dword [rcx + 0x24]
shr eax, 1
and al, 1
mov edx, dword [rcx + 0x20]
shr edx, 1
and dl, 1
cmp al, dl
je 0x1401f8853
lea rax, vtable.Core::Windows::Forms::ListViewItemSelectionChangedEventArgs.0
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x30], r9
mov dword [rsp + 0x38], r8d
mov byte [rsp + 0x3c], dl
mov rax, qword [rbx]
lea rdx, [rsp + 0x28]
mov rcx, rbx
call qword [rax + 0x128]
nop
mov rdx, rdi
mov rcx, rbx
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rdi
jmp fcn.1401e6230
Function at 0x140205b00
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x20
mov rbx, rcx
mov eax, edx
mov edi, edx
shl rax, 4
mov ecx, 0x40
cmp rax, 0x400
cmova edi, ecx
cmp edi, dword [rbx]
jne 0x140205b34
xor eax, eax
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
mov rax, qword [0x1403fda20]
test rax, rax
je 0x140205b42
call rax
shl edi, 4
mov ecx, edi
call fcn.140201950
mov rcx, qword [0x1403fda28]
mov rdi, rax
test rcx, rcx
je 0x140205b5d
call rcx
test rdi, rdi
je 0x140205b27
mov rcx, qword [rbx + 0x10]
mov qword [rsp + 0x38], rsi
call fcn.140201c90
mov rcx, rdi
mov qword [rbx + 0x10], rdi
call qword [0x1403ee160]
xor edx, edx
mov rcx, rdi
movsxd rsi, eax
shr rsi, 4
mov r8d, esi
mov dword [rbx], esi
shl r8, 4
call fcn.1402a04b0
mov rcx, qword [rbx + 8]
xor r11d, r11d
mov qword [rbx + 8], r11
test rcx, rcx
je 0x140205c77
mov qword [rsp + 0x30], rbp
lea rbp, [0x140308b10]
nop word [rax + rax]
mov r9d, dword [rcx + 0x20]
mov r10, qword [rcx + 0x18]
mov eax, r11d
test r9d, r9d
jle 0x140205bf2
movzx edx, byte [r10]
dec r9d
lea r10, [r10 + 1]
movzx r8d, byte [rdx + rbp]
lea edx, [rax*8]
xor r8d, edx
xor eax, r8d
test r9d, r9d
jg 0x140205bd0
mov r9, qword [rcx]
xor edx, edx
div esi
mov r8d, edx
shl r8, 4
add r8, rdi
je 0x140205c4a
mov eax, dword [r8]
test eax, eax
je 0x140205c12
mov rdx, qword [r8 + 8]
jmp 0x140205c15
mov rdx, r11
inc eax
mov qword [r8 + 8], rcx
mov dword [r8], eax
test rdx, rdx
je 0x140205c4a
mov qword [rcx], rdx
mov rax, qword [rdx + 8]
mov qword [rcx + 8], rax
mov rax, qword [rdx + 8]
test rax, rax
je 0x140205c40
mov qword [rax], rcx
mov qword [rdx + 8], rcx
jmp 0x140205c66
mov qword [rbx + 8], rcx
mov qword [rdx + 8], rcx
jmp 0x140205c66
mov rax, qword [rbx + 8]
mov qword [rcx], rax
mov rax, qword [rbx + 8]
test rax, rax
je 0x140205c5e
mov qword [rax + 8], rcx
mov qword [rcx + 8], r11
mov qword [rbx + 8], rcx
mov rcx, r9
test r9, r9
jne 0x140205bc0
mov rbp, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x40]
mov eax, 1
add rsp, 0x20
pop rdi
ret
Function at 0x140205df0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r15
sub rsp, 0x20
mov rbp, r9
mov r9d, dword [rcx]
mov edi, r8d
mov rsi, rdx
mov rbx, rcx
lea r12, [0x140308b10]
test r9d, r9d
je 0x140205e5a
xor eax, eax
mov r10, rdx
test r8d, r8d
jle 0x140205e50
nop dword [rax]
movzx ecx, byte [r10]
dec r8d
lea r10, [r10 + 1]
movzx edx, byte [rcx + r12]
lea ecx, [rax*8]
xor edx, ecx
xor eax, edx
test r8d, r8d
jg 0x140205e30
xor edx, edx
div r9d
mov r15d, edx
jmp 0x140205e5d
xor r15d, r15d
mov r9d, r15d
mov r8d, edi
mov rdx, rsi
mov rcx, rbx
call fcn.140205c90
mov rdx, rax
test rax, rax
je 0x140205efa
mov rdi, qword [rax + 0x10]
test rbp, rbp
jne 0x140205eea
mov rax, qword [rax + 8]
test rax, rax
je 0x140205e94
mov rcx, qword [rdx]
mov qword [rax], rcx
jmp 0x140205e9b
mov rax, qword [rdx]
mov qword [rbx + 8], rax
mov rcx, qword [rdx]
test rcx, rcx
je 0x140205eab
mov rax, qword [rdx + 8]
mov qword [rcx + 8], rax
mov rax, qword [rbx + 0x10]
test rax, rax
je 0x140205ecd
mov ecx, r15d
shl rcx, 4
add rcx, rax
cmp qword [rcx + 8], rdx
jne 0x140205ecb
mov rax, qword [rdx]
mov qword [rcx + 8], rax
dec dword [rcx]
mov rcx, rdx
call fcn.140201c90
dec dword [rbx + 4]
jne 0x140205ef2
mov rcx, rbx
call fcn.1402059a0
mov rax, rdi
jmp 0x140205fcb
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov rax, rdi
jmp 0x140205fcb
test rbp, rbp
jne 0x140205f06
xor eax, eax
jmp 0x140205fcb
mov ecx, 0x28
mov qword [rsp + 0x40], r14
call fcn.140201950
mov r14, rax
test rax, rax
jne 0x140205f25
mov rax, rbp
jmp 0x140205fc6
mov qword [rax + 0x18], rsi
mov dword [rax + 0x20], edi
mov qword [rax + 0x10], rbp
inc dword [rbx + 4]
mov edx, dword [rbx + 4]
cmp edx, 0xa
jb 0x140205f84
mov eax, dword [rbx]
add eax, eax
cmp edx, eax
jbe 0x140205f84
add edx, edx
mov rcx, rbx
call fcn.140205b00
test eax, eax
je 0x140205f84
xor eax, eax
test edi, edi
jle 0x140205f7d
nop word [rax + rax]
movzx ecx, byte [rsi]
dec edi
lea rsi, [rsi + 1]
movzx edx, byte [rcx + r12]
lea ecx, [rax*8]
xor edx, ecx
xor eax, edx
test edi, edi
jg 0x140205f60
xor edx, edx
div dword [rbx]
mov r15d, edx
mov rax, qword [rbx + 0x10]
test rax, rax
je 0x140205fa4
mov edx, r15d
mov r8, r14
mov rcx, rbx
shl rdx, 4
add rdx, rax
call fcn.140205a90
jmp 0x140205fc4
mov rax, qword [rbx + 8]
mov qword [r14], rax
mov rax, qword [rbx + 8]
test rax, rax
je 0x140205fb8
mov qword [rax + 8], r14
mov qword [r14 + 8], 0
mov qword [rbx + 8], r14
xor eax, eax
mov r14, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x48]
mov rbp, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x20
pop r15
pop r12
pop rdi
ret
Function at 0x14021f290
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x18], r8
push rbx
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x38
mov rax, qword [rcx + 8]
mov r15, rcx
mov r14d, edx
mov r11, qword [rax + 8]
mov rax, qword [rcx + 0x28]
mov r12d, r9d
mov r8d, dword [r11 + 0x30]
mov r10, qword [rax + 8]
mov r13, qword [r11]
movsxd rax, dword [r10 + 0x30]
mov ecx, r8d
mov dword [rsp + 0x78], r8d
cmp eax, r8d
mov qword [rsp + 0x28], rax
cmovl ecx, eax
xor ebx, ebx
mov dword [rsp + 0x70], ecx
mov rcx, rax
imul r14, rax
cmp eax, r8d
je 0x14021f2f8
cmp byte [r13 + 0x12], bl
mov eax, 8
cmovne ebx, eax
mov rdi, r14
sub rdi, rcx
test ebx, ebx
jne 0x14021f41e
mov qword [rsp + 0x88], rbp
mov qword [rsp + 0x30], rsi
cmp rdi, r14
jge 0x14021f400
mov rax, rdi
movsxd rbp, r8d
mov qword [rsp + 0x20], 0
cqo
idiv rbp
mov rsi, rdx
xor edx, edx
lea r10d, [rax + 1]
mov rax, qword [r15 + 8]
mov rcx, qword [rax + 8]
mov eax, dword [0x1403ec164]
div dword [rcx + 0x30]
inc eax
cmp r10d, eax
je 0x14021f3f5
lea r8, [rsp + 0x20]
xor r9d, r9d
mov edx, r10d
mov rcx, r13
call fcn.14020faf0
mov ebx, eax
test eax, eax
jne 0x14021f3e1
mov rcx, qword [rsp + 0x20]
call fcn.1402102d0
mov ebx, eax
test eax, eax
jne 0x14021f3e1
mov rax, qword [rsp + 0x20]
movsxd r8, dword [rsp + 0x70]
add rsi, qword [rax + 8]
mov rax, rdi
cqo
mov rcx, rsi
idiv qword [rsp + 0x28]
add rdx, qword [rsp + 0x80]
call fcn.140298710
mov rax, qword [rsp + 0x20]
mov rcx, qword [rax + 0x10]
mov byte [rcx], bl
test rdi, rdi
jne 0x14021f3e1
test r12d, r12d
jne 0x14021f3e1
mov rax, qword [r15 + 0x28]
mov rcx, qword [rax + 8]
mov edx, dword [rcx + 0x3c]
mov eax, edx
mov byte [rsi + 0x1f], dl
shr eax, 0x18
mov byte [rsi + 0x1c], al
mov eax, edx
shr eax, 0x10
mov byte [rsi + 0x1d], al
mov eax, edx
shr eax, 8
mov byte [rsi + 0x1e], al
mov rcx, qword [rsp + 0x20]
test rcx, rcx
je 0x14021f3f0
call fcn.14020fe60
mov r8d, dword [rsp + 0x78]
add rdi, rbp
test ebx, ebx
je 0x14021f313
mov rbp, qword [rsp + 0x88]
mov rsi, qword [rsp + 0x30]
mov eax, ebx
add rsp, 0x38
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rbx
ret
mov eax, ebx
add rsp, 0x38
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rbx
ret
Function at 0x140234d20
Capabilities:
Encode data using xor

Disassembly:
push rbp
push r12
push r14
sub rsp, 0x30
mov r12d, r8d
mov r14, rdx
mov rbp, rcx
test rdx, rdx
jne 0x140234d44
xor eax, eax
add rsp, 0x30
pop r14
pop r12
pop rbp
ret
mov edx, 0x10
mov qword [rsp + 0x58], rsi
call fcn.140202010
mov rsi, rax
test rax, rax
jne 0x140234d6a
mov rsi, qword [rsp + 0x58]
add rsp, 0x30
pop r14
pop r12
pop rbp
ret
mov qword [rsp + 0x20], r15
xor r15d, r15d
mov dword [rax + 4], r15d
mov eax, dword [r14]
mov dword [rsi], eax
test r12b, 1
jne 0x140234d96
mov ecx, dword [r14]
mov eax, 1
cmp ecx, eax
jle 0x140234d96
nop dword [rax]
add eax, eax
cmp eax, ecx
jl 0x140234d90
lea edx, [rax + rax*4]
mov rcx, rbp
shl edx, 3
call fcn.140202010
mov qword [rsi + 8], rax
test rax, rax
jne 0x140234dbf
mov rdx, rsi
mov rcx, rbp
call fcn.140201d40
xor eax, eax
jmp 0x140234e65
mov qword [rsp + 0x50], rbx
mov rbx, qword [r14 + 8]
cmp dword [r14], r15d
jle 0x140234e5d
mov qword [rsp + 0x60], rdi
lea rdi, [rax + 0x1c]
sub rax, rbx
mov qword [rsp + 0x28], r13
lea r13, [rax - 0x10]
nop word [rax + rax]
mov rdx, qword [rbx]
xor r9d, r9d
mov r8d, r12d
mov rcx, rbp
call fcn.1402349a0
mov rcx, rbp
mov qword [r13 + rbx + 0x10], rax
mov rdx, qword [rbx + 8]
call fcn.140202180
mov rcx, rbp
mov qword [rdi - 0x14], rax
mov rdx, qword [rbx + 0x10]
call fcn.140202180
inc r15d
lea rdi, [rdi + 0x28]
mov qword [rdi - 0x34], rax
movzx eax, byte [rbx + 0x18]
and dword [rdi - 0x28], 0xfffffffe
mov byte [rdi - 0x2c], al
mov ecx, dword [rbx + 0x1c]
lea rbx, [rbx + 0x28]
xor ecx, dword [rdi - 0x28]
and ecx, 2
xor dword [rdi - 0x28], ecx
mov eax, dword [rbx - 8]
mov dword [rdi - 0x24], eax
cmp r15d, dword [r14]
jl 0x140234df0
mov r13, qword [rsp + 0x28]
mov rdi, qword [rsp + 0x60]
mov rbx, qword [rsp + 0x50]
mov rax, rsi
mov r15, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x58]
add rsp, 0x30
pop r14
pop r12
pop rbp
ret
Function at 0x140236d50
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x30
mov r14, qword [rcx + 0x10]
mov ebx, r9d
mov esi, r8d
mov r11, rdx
mov rdi, rcx
xor r10d, r10d
lea rax, [rcx + 0x88]
nop
cmp dword [rax + 0xc], 0
jle 0x140236d93
cmp dword [rax], ebx
jne 0x140236d93
movsx edx, word [rax + 4]
cmp edx, r8d
je 0x140236de1
inc r10d
add rax, 0x14
cmp r10d, 0xa
jl 0x140236d80
mov r9d, r8d
mov qword [rsp + 0x40], rbp
mov ebp, dword [rsp + 0x60]
mov r8d, ebx
mov rdx, r11
mov rcx, r14
mov dword [rsp + 0x20], ebp
call fcn.140236c70
movzx r8d, byte [rsp + 0x68]
test r8b, r8b
je 0x140236dfa
mov rdx, qword [r14 + 8]
test rdx, rdx
je 0x140236e0a
movsxd rax, dword [r14 + 0x3c]
lea rcx, [rax + rax*2]
mov byte [rdx + rcx*8 - 0x15], r8b
jmp 0x140236e0a
mov ecx, dword [rcx + 0x78]
mov dword [rax + 0x10], ecx
inc dword [rdi + 0x78]
mov edx, dword [rax + 0xc]
mov rcx, rdi
call fcn.140236bd0
mov eax, dword [rax + 0xc]
jmp 0x140236e11
mov r9d, ebp
mov r8d, esi
mov edx, ebx
mov rcx, rdi
call fcn.1402369a0
mov eax, ebp
mov rbp, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x30
pop r14
ret
Function at 0x1402391e0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rdi
sub rsp, 0x20
mov ebp, r8d
mov rbx, rdx
mov rdi, rcx
test rcx, rcx
je 0x140239369
test rdx, rdx
je 0x140239369
mov r9d, dword [rdx + 4]
mov r11d, dword [rcx + 4]
mov qword [rsp + 0x30], rsi
mov esi, r9d
or esi, r11d
bt esi, 0xa
jae 0x140239254
and r9d, r11d
bt r9d, 0xa
jae 0x14023935f
mov eax, dword [rdx + 8]
cmp dword [rcx + 8], eax
jne 0x14023935f
xor eax, eax
mov rsi, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
movzx r8d, byte [rcx]
cmp r8b, byte [rdx]
je 0x14023929c
cmp r8b, 0x5f
jne 0x140239274
mov rcx, qword [rcx + 0x10]
mov r8d, ebp
call fcn.1402391e0
cmp eax, 2
jl 0x140239295
cmp byte [rbx], 0x5f
jne 0x14023935f
mov rdx, qword [rbx + 0x10]
mov r8d, ebp
mov rcx, rdi
call fcn.1402391e0
cmp eax, 2
jge 0x14023935f
mov eax, 1
jmp 0x14023923f
lea eax, [r8 + 0x66]
test al, 0xfd
je 0x1402392dc
mov rax, qword [rcx + 8]
test rax, rax
je 0x1402392dc
mov r10, qword [rdx + 8]
sub r10, rax
movzx edx, byte [rax]
movzx ecx, byte [rax + r10]
sub edx, ecx
jne 0x1402392c7
inc rax
test ecx, ecx
jne 0x1402392b4
test edx, edx
je 0x1402392dc
xor ecx, ecx
cmp r8b, 0x5f
setne cl
lea eax, [rcx + 1]
jmp 0x14023923f
xor r9d, r11d
test r9b, 0x10
jne 0x14023935f
bt esi, 0xe
jb 0x14023923d
bt esi, 0xb
jb 0x14023935f
mov rdx, qword [rbx + 0x10]
mov rcx, qword [rdi + 0x10]
mov r8d, ebp
call fcn.1402391e0
test eax, eax
jne 0x14023935f
mov rdx, qword [rbx + 0x18]
mov rcx, qword [rdi + 0x18]
mov r8d, ebp
call fcn.1402391e0
test eax, eax
jne 0x14023935f
mov rdx, qword [rbx + 0x20]
mov rcx, qword [rdi + 0x20]
mov r8d, ebp
call fcn.140239390
test eax, eax
jne 0x14023935f
bt esi, 0xd
jb 0x14023923d
movzx eax, word [rbx + 0x30]
cmp word [rdi + 0x30], ax
jne 0x14023935f
mov ecx, dword [rdi + 0x2c]
mov eax, dword [rbx + 0x2c]
cmp ecx, eax
je 0x14023923d
cmp ecx, ebp
jne 0x14023935f
test eax, eax
js 0x14023923d
mov eax, 2
jmp 0x14023923f
mov rbx, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x40]
xor ecx, ecx
cmp rdx, rdi
mov eax, 2
cmove eax, ecx
add rsp, 0x20
pop rdi
ret
Function at 0x14023e120
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r14
push r15
sub rsp, 0x20
xor r10d, r10d
mov rsi, r8
mov rbp, rdx
mov r15, rcx
mov rdi, rdx
test rdx, rdx
jne 0x14023e151
mov edi, r10d
jmp 0x14023e166
cmp byte [rdx], r10b
je 0x14023e15e
inc rdi
cmp byte [rdi], r10b
jne 0x14023e156
sub edi, edx
and edi, 0x3fffffff
mov r14d, dword [rcx + 0x28]
mov ebx, r10d
test r14d, r14d
jle 0x14023e238
mov qword [rsp + 0x40], r12
lea r12, [0x140308b10]
mov r9d, ebx
cmp ebx, 2
jge 0x14023e18e
xor r9d, 1
test rsi, rsi
je 0x14023e1e5
mov rcx, qword [r15 + 0x20]
movsxd rdx, r9d
mov rax, rsi
shl rdx, 5
mov r8, qword [rdx + rcx]
movzx edx, byte [rsi]
test dl, dl
je 0x14023e1d0
nop dword [rax]
movzx ecx, byte [r8]
movzx edx, dl
movzx ecx, byte [rcx + r12]
cmp byte [rdx + r12], cl
jne 0x14023e1d0
movzx edx, byte [rax + 1]
inc rax
inc r8
test dl, dl
jne 0x14023e1b0
movzx ecx, byte [r8]
movzx edx, byte [rcx + r12]
movzx ecx, byte [rax]
movzx eax, byte [rcx + r12]
cmp eax, edx
jne 0x14023e20c
mov rax, qword [r15 + 0x20]
movsxd rcx, r9d
mov r8d, edi
shl rcx, 5
mov rdx, rbp
mov rcx, qword [rcx + rax + 0x18]
add rcx, 8
call fcn.140205d60
mov r10, rax
test rax, rax
jne 0x14023e21a
inc ebx
cmp ebx, r14d
jl 0x14023e182
mov rax, r10
mov r12, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x48]
mov rbp, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x20
pop r15
pop r14
pop rdi
ret
mov rax, r10
jmp 0x14023e21f

Function at 0x14023e390
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r14
sub rsp, 0x20
xor r9d, r9d
mov rsi, r8
mov rbp, rdx
mov rdi, rdx
test rdx, rdx
jne 0x14023e3b8
mov edi, r9d
jmp 0x14023e3d0
cmp byte [rdx], r9b
je 0x14023e3c8
nop dword [rax]
inc rdi
cmp byte [rdi], r9b
jne 0x14023e3c0
sub edi, edx
and edi, 0x3fffffff
mov r14d, dword [rcx + 0x28]
mov ebx, r9d
test r14d, r14d
jle 0x14023e493
mov qword [rsp + 0x40], r12
mov qword [rsp + 0x48], r15
mov r15, qword [rcx + 0x20]
lea r12, [0x140308b10]
mov eax, ebx
cmp ebx, 2
jge 0x14023e3ff
xor eax, 1
movsxd r8, eax
shl r8, 5
mov r10, qword [r8 + r15 + 0x18]
test rsi, rsi
je 0x14023e455
movzx edx, byte [rsi]
mov r8, qword [r8 + r15]
mov rax, rsi
test dl, dl
je 0x14023e440
nop
movzx ecx, byte [r8]
movzx edx, dl
movzx ecx, byte [rcx + r12]
cmp byte [rdx + r12], cl
jne 0x14023e440
movzx edx, byte [rax + 1]
inc rax
inc r8
test dl, dl
jne 0x14023e420
movzx ecx, byte [r8]
movzx edx, byte [rcx + r12]
movzx ecx, byte [rax]
movzx eax, byte [rcx + r12]
cmp eax, edx
jne 0x14023e46c
lea rcx, [r10 + 0x20]
mov r8d, edi
mov rdx, rbp
call fcn.140205d60
mov r9, rax
test rax, rax
jne 0x14023e476
inc ebx
cmp ebx, r14d
jl 0x14023e3f5
mov rax, r9
mov r12, qword [rsp + 0x40]
mov r15, qword [rsp + 0x48]
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
add rsp, 0x20
pop r14
pop rdi
pop rsi
ret
mov rax, r9
jmp 0x14023e480
Function at 0x140247240
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov dword [rsp + 0x20], r9d
mov dword [rsp + 0x18], r8d
mov qword [rsp + 8], rcx
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x38
mov rdi, qword [rsp + 0xa8]
mov rax, qword [rdx + 0x18]
mov r14, qword [rcx + 0x10]
mov r12d, r9d
mov esi, r8d
mov rbp, rdx
mov rbx, rcx
mov qword [rsp + 0x88], rax
test rdi, rdi
je 0x1402472b9
cmp qword [rdx + 0x48], 0
je 0x1402472b3
mov rcx, r14
call fcn.140221a10
mov r9d, 8
mov rcx, rbx
mov dword [rdi], eax
mov dword [rbx + 0x70], esi
mov r8d, dword [rdi]
mov rdx, qword [rbp + 0x48]
call fcn.140238d80
jmp 0x1402472b9
mov dword [rdi], 0
cmp dword [rsp + 0xa0], 0
je 0x1402472d0
test byte [rbp + 0x64], 8
je 0x1402472d0
movzx r13d, word [rbp + 0x5e]
jmp 0x1402472d5
movzx r13d, word [rbp + 0x60]
mov ecx, dword [rbx + 0x48]
mov esi, dword [rbx + 0x4c]
mov dword [rsp + 0xa0], esi
cmp r13d, ecx
jg 0x1402472f6
lea eax, [rsi + r13]
sub ecx, r13d
mov dword [rbx + 0x4c], eax
mov dword [rbx + 0x48], ecx
jmp 0x140247309
mov eax, dword [rbx + 0x58]
lea esi, [rax + 1]
add eax, r13d
mov dword [rsp + 0xa0], esi
mov dword [rbx + 0x58], eax
mov r15, qword [rsp + 0xb0]
test r15, r15
je 0x140247329
cmp esi, dword [rsp + 0xb8]
jne 0x140247326
cmp qword [r15 + 0x48], 0
je 0x140247329
xor r15d, r15d
xor edi, edi
movsxd rax, r13d
test r13d, r13d
jle 0x1402473cf
mov ebx, dword [rsp + 0x90]
mov r12d, esi
mov rsi, qword [rsp + 0x88]
nop dword [rax]
test r15, r15
je 0x140247367
mov rax, qword [rbp + 8]
mov rdx, qword [r15 + 8]
movzx ecx, word [rax + rdi*2]
cmp word [rdx + rdi*2], cx
je 0x1402473aa
mov rax, qword [rbp + 8]
mov r8d, ebx
mov rdx, rsi
movsx r9d, word [rax + rdi*2]
mov rcx, r14
mov dword [rsp + 0x20], r12d
call fcn.140236c70
movsxd rcx, dword [r14 + 0x3c]
mov rax, qword [r14 + 0x30]
lea edx, [rcx - 1]
cmp edx, dword [rax + 0x68]
jle 0x1402473aa
mov rax, qword [r14 + 8]
lea rcx, [rcx + rcx*2]
cmp byte [rax + rcx*8 - 0x18], 0x27
jne 0x1402473aa
mov rcx, r14
call fcn.140221f40
inc rdi
movsxd rax, r13d
inc r12d
cmp rdi, rax
jl 0x140247350
mov rbx, qword [rsp + 0x80]
mov esi, dword [rsp + 0xa0]
mov r12d, dword [rsp + 0x98]
test r12d, r12d
je 0x1402473ec
mov r9d, r13d
mov r8d, esi
mov edx, 0x30
mov rcx, r14
mov dword [rsp + 0x20], r12d
call fcn.140221790
lea r9d, [r13 - 1]
lea rcx, [rbx + 0x94]
mov r8d, 0xa
add r9d, esi
xor r10d, r10d
mov edx, dword [rcx]
cmp edx, esi
jl 0x14024742d
cmp edx, r9d
jg 0x14024742d
cmp byte [rcx - 6], r10b
je 0x14024742a
movzx eax, byte [rbx + 0x1f]
cmp al, 8
jae 0x140247426
movzx eax, al
mov dword [rbx + rax*4 + 0x28], edx
inc byte [rbx + 0x1f]
mov byte [rcx - 6], r10b
mov dword [rcx], r10d
add rcx, 0x14
dec r8
jne 0x140247403
mov eax, esi
cmp r13d, dword [rbx + 0x48]
jle 0x140247445
mov dword [rbx + 0x48], r13d
mov dword [rbx + 0x4c], esi
add rsp, 0x38
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x14024c220
Capabilities:
Encode data using xor

Disassembly:
mov rdx, qword [rcx]
mov rax, rdx
test rdx, rdx
je 0x14024c23f
cmp byte [rdx], 0
je 0x14024c238
inc rax
cmp byte [rax], 0
jne 0x14024c230
sub eax, edx
and eax, 0x3fffffff
mov rcx, qword [rcx + 0x70]
mov r8d, eax
add rcx, 0x50
jmp fcn.140205d60
Function at 0x14027e210
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rsi
sub rsp, 0x20
mov esi, r8d
mov rbx, r9
mov rbp, rdx
sar esi, 4
test r8b, 0xf
je 0x14027e246
mov eax, 1
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
add rsp, 0x20
pop rsi
ret
lea rdx, [0x1403fdbcc]
mov rax, rcx
mov qword [rsp + 0x30], rdi
sub rax, rdx
mov qword [rsp + 0x38], r14
test al, 3
jne 0x14027e2bc
mov rax, rbx
sub rax, rdx
test al, 3
jne 0x14027e2bc
test esi, esi
je 0x14027e360
mov r14, qword [rsp + 0x50]
lea rdi, [rcx + 8]
nop dword [rax]
mov eax, dword [rdi - 8]
mov r8, r14
mov rdx, rbx
xor dword [rbx], eax
mov eax, dword [rdi - 4]
mov rcx, rbx
xor dword [rbx + 4], eax
mov eax, dword [rdi]
xor dword [rbx + 8], eax
mov eax, dword [rdi + 4]
xor dword [rbx + 0xc], eax
call section..text
lea rbp, [rbp + 0x10]
movups xmm0, xmmword [rbx]
movups xmmword [rbp - 0x10], xmm0
lea rdi, [rdi + 0x10]
dec esi
jne 0x14027e280
jmp 0x14027e360
test esi, esi
je 0x14027e360
mov r14, qword [rsp + 0x50]
lea rdi, [rcx + 2]
sub rbp, rcx
movzx eax, byte [rdi - 2]
mov r8, r14
mov rdx, rbx
xor byte [rbx], al
movzx eax, byte [rdi - 1]
mov rcx, rbx
xor byte [rbx + 1], al
movzx eax, byte [rdi]
xor byte [rbx + 2], al
movzx eax, byte [rdi + 1]
xor byte [rbx + 3], al
movzx eax, byte [rdi + 2]
xor byte [rbx + 4], al
movzx eax, byte [rdi + 3]
xor byte [rbx + 5], al
movzx eax, byte [rdi + 4]
xor byte [rbx + 6], al
movzx eax, byte [rdi + 5]
xor byte [rbx + 7], al
movzx eax, byte [rdi + 6]
xor byte [rbx + 8], al
movzx eax, byte [rdi + 7]
xor byte [rbx + 9], al
movzx eax, byte [rdi + 8]
xor byte [rbx + 0xa], al
movzx eax, byte [rdi + 9]
xor byte [rbx + 0xb], al
movzx eax, byte [rdi + 0xa]
xor byte [rbx + 0xc], al
movzx eax, byte [rdi + 0xb]
xor byte [rbx + 0xd], al
movzx eax, byte [rdi + 0xc]
xor byte [rbx + 0xe], al
movzx eax, byte [rdi + 0xd]
xor byte [rbx + 0xf], al
call section..text
lea rdi, [rdi + 0x10]
movups xmm0, xmmword [rbx]
movups xmmword [rdi + rbp - 0x12], xmm0
dec esi
jne 0x14027e2d0
mov r14, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
xor eax, eax
add rsp, 0x20
pop rsi
ret