joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140028280
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x20
mov rdi, rcx
mov eax, edx
mov ebx, edx
shl rax, 4
mov ecx, 0x40
cmp rax, 0x400
cmova ebx, ecx
cmp ebx, dword [rdi]
jne 0x1400282b4
xor eax, eax
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
mov rax, qword [0x14014dd08]
test rax, rax
je 0x1400282c2
call rax
shl ebx, 4
mov ecx, ebx
call fcn.1400245e0
mov rcx, qword [0x14014dd10]
mov rbx, rax
test rcx, rcx
je 0x1400282dd
call rcx
test rbx, rbx
je 0x1400282a7
mov rcx, qword [rdi + 0x10]
mov qword [rsp + 0x38], rsi
call fcn.140024910
mov rcx, rbx
mov qword [rdi + 0x10], rbx
call qword [0x1401440a8]
xor edx, edx
mov rcx, rbx
movsxd rsi, eax
shr rsi, 4
mov r8d, esi
mov dword [rdi], esi
shl r8, 4
call fcn.1400e1fc0
mov r8, qword [rdi + 8]
xor r11d, r11d
mov qword [rdi + 8], r11
test r8, r8
je 0x1400283f3
mov qword [rsp + 0x30], rbp
lea rbp, [0x140113150]
nop word [rax + rax]
mov r9d, dword [r8 + 0x20]
mov r10, qword [r8 + 0x18]
mov eax, r11d
test r9d, r9d
jle 0x14002836e
movzx ecx, byte [r10]
dec r9d
inc r10
movzx edx, byte [rcx + rbp]
lea ecx, [rax*8]
xor edx, ecx
xor eax, edx
test r9d, r9d
jg 0x140028350
mov r10, qword [r8]
xor edx, edx
div esi
mov r9d, edx
shl r9, 4
add r9, rbx
je 0x1400283c6
mov eax, dword [r9]
test eax, eax
je 0x14002838e
mov rcx, qword [r9 + 8]
jmp 0x140028391
mov rcx, r11
inc eax
mov qword [r9 + 8], r8
mov dword [r9], eax
test rcx, rcx
je 0x1400283c6
mov qword [r8], rcx
mov rax, qword [rcx + 8]
mov qword [r8 + 8], rax
mov rax, qword [rcx + 8]
test rax, rax
je 0x1400283bc
mov qword [rax], r8
mov qword [rcx + 8], r8
jmp 0x1400283e2
mov qword [rdi + 8], r8
mov qword [rcx + 8], r8
jmp 0x1400283e2
mov rax, qword [rdi + 8]
mov qword [r8], rax
mov rax, qword [rdi + 8]
test rax, rax
je 0x1400283da
mov qword [rax + 8], r8
mov qword [r8 + 8], r11
mov qword [rdi + 8], r8
mov r8, r10
test r10, r10
jne 0x140028340
mov rbp, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x40]
mov eax, 1
add rsp, 0x20
pop rdi
ret
Function at 0x140028570
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push r12
push r13
push r14
sub rsp, 0x20
mov r10d, dword [rcx]
mov r12, r9
mov esi, r8d
mov rbp, rdx
mov rbx, rcx
lea r14, [0x140113150]
test r10d, r10d
je 0x1400285d9
xor eax, eax
mov r9, rdx
test r8d, r8d
jle 0x1400285cf
nop
movzx ecx, byte [r9]
dec r8d
inc r9
movzx edx, byte [rcx + r14]
lea ecx, [rax*8]
xor edx, ecx
xor eax, edx
test r8d, r8d
jg 0x1400285b0
xor edx, edx
div r10d
mov r13d, edx
jmp 0x1400285dc
xor r13d, r13d
mov r9d, r13d
mov r8d, esi
mov rdx, rbp
mov rcx, rbx
mov qword [rsp + 0x40], rdi
call fcn.140028410
mov r11, rax
test rax, rax
je 0x14002867f
mov rdi, qword [rax + 0x10]
test r12, r12
jne 0x14002866f
mov rax, qword [rax + 8]
test rax, rax
je 0x140028618
mov rcx, qword [r11]
mov qword [rax], rcx
jmp 0x14002861f
mov rax, qword [r11]
mov qword [rbx + 8], rax
mov rcx, qword [r11]
test rcx, rcx
je 0x14002862f
mov rax, qword [r11 + 8]
mov qword [rcx + 8], rax
mov rax, qword [rbx + 0x10]
test rax, rax
je 0x140028651
mov ecx, r13d
shl rcx, 4
add rcx, rax
cmp qword [rcx + 8], r11
jne 0x14002864f
mov rax, qword [r11]
mov qword [rcx + 8], rax
dec dword [rcx]
mov rcx, r11
call fcn.140024910
add dword [rbx + 4], 0xffffffff
jne 0x140028677
mov rcx, rbx
call fcn.1400281b0
mov rax, rdi
jmp 0x140028746
mov qword [rax + 0x10], r12
mov qword [rax + 0x18], rbp
mov rax, rdi
jmp 0x140028746
test r12, r12
je 0x140028744
mov ecx, 0x28
call fcn.1400245e0
mov rdi, rax
test rax, rax
jne 0x1400286a2
mov rax, r12
jmp 0x140028746
mov qword [rax + 0x18], rbp
mov dword [rax + 0x20], esi
mov qword [rax + 0x10], r12
inc dword [rbx + 4]
mov edx, dword [rbx + 4]
cmp edx, 0xa
jb 0x140028704
mov eax, dword [rbx]
add eax, eax
cmp edx, eax
jbe 0x140028704
add edx, edx
mov rcx, rbx
call fcn.140028280
test eax, eax
je 0x140028704
xor eax, eax
test esi, esi
jle 0x1400286fd
nop word [rax + rax]
movzx ecx, byte [rbp]
dec esi
inc rbp
movzx edx, byte [rcx + r14]
lea ecx, [rax*8]
xor edx, ecx
xor eax, edx
test esi, esi
jg 0x1400286e0
xor edx, edx
div dword [rbx]
mov r13d, edx
mov rax, qword [rbx + 0x10]
test rax, rax
je 0x140028724
mov edx, r13d
mov r8, rdi
mov rcx, rbx
shl rdx, 4
add rdx, rax
call fcn.140028210
jmp 0x140028744
mov rax, qword [rbx + 8]
mov qword [rdi], rax
mov rax, qword [rbx + 8]
test rax, rax
je 0x140028738
mov qword [rax + 8], rdi
mov qword [rdi + 8], 0
mov qword [rbx + 8], rdi
xor eax, eax
mov rdi, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x48]
mov rbp, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x20
pop r14
pop r13
pop r12
ret
Function at 0x14002a930
Capabilities:
Check if file exists
Delete file
Get file attributes

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
sub rsp, 0x20
xor r12d, r12d
mov r13, rdx
mov ebx, r12d
mov edi, r12d
call fcn.140028770
mov rcx, r13
test eax, eax
je 0x14002a96a
call fcn.1400287e0
mov rbp, rax
jmp 0x14002a98e
call fcn.1400287e0
mov rsi, rax
test rax, rax
je 0x14002aa4e
mov rcx, rax
call fcn.1400289c0
mov rcx, rsi
mov rbp, rax
call fcn.1400e387c
test rbp, rbp
je 0x14002aa4e
call fcn.140028770
test eax, eax
je 0x14002a9e0
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov esi, eax
cmp eax, 0xffffffff
jne 0x14002a9c6
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
cmp eax, 5
jne 0x14002aa1a
inc ebx
cmp ebx, 5
jge 0x14002aa1a
mov ecx, WSAAsyncSelect
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x14002a9a0
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov esi, eax
cmp eax, 0xffffffff
jne 0x14002aa06
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
cmp eax, 5
jne 0x14002aa1a
inc ebx
cmp ebx, 5
jge 0x14002aa1a
mov ecx, WSAAsyncSelect
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x14002a9e0
mov rcx, rbp
call fcn.1400e387c
cmp esi, 0xffffffff
jne 0x14002aa2c
cmp edi, 2
je 0x14002aa49
lea rdx, str.winDelete
mov r9d, 0x83f7
mov r8, r13
mov ecx, 0xa0a
call fcn.140028be0
mov r12d, eax
mov eax, r12d
jmp 0x14002aa53
mov eax, 7
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x20
pop r13
pop r12
pop rdi
ret
Function at 0x14002ad60
Capabilities:
Get disk size

Disassembly:
sub rsp, 0x168
mov rax, qword [0x1401423c0]
xor rax, rsp
mov qword [rsp + 0x150], rax
lea r9, [rsp + 0x40]
mov r8d, 0x104
mov dword [rsp + 0x34], 0x200
call fcn.14002abc0
test eax, eax
jne 0x14002af82
mov qword [rsp + 0x180], rbx
mov qword [rsp + 0x188], rsi
mov qword [rsp + 0x160], rdi
call fcn.140028770
test eax, eax
je 0x14002ae2c
xor esi, esi
lea r8, [rsp + 0x40]
or r9d, 0xffffffff
xor edx, edx
mov ecx, 0xfde9
mov dword [rsp + 0x28], esi
mov qword [rsp + 0x20], rsi
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
movsxd rdi, eax
mov rcx, rdi
add rcx, rcx
call fcn.1400e3ba4
mov rbx, rax
test rax, rax
je 0x14002ae8e
lea r8, [rsp + 0x40]
or r9d, 0xffffffff
xor edx, edx
mov ecx, 0xfde9
mov dword [rsp + 0x28], edi
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
test eax, eax
jne 0x14002aed6
mov rcx, rbx
call fcn.1400e387c
mov rbx, rsi
jmp 0x14002aed6
xor esi, esi
lea r8, [rsp + 0x40]
or r9d, 0xffffffff
xor edx, edx
mov ecx, 0xfde9
mov dword [rsp + 0x28], esi
mov qword [rsp + 0x20], rsi
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
movsxd rbx, eax
mov rcx, rbx
add rcx, rcx
call fcn.1400e3ba4
mov rdi, rax
test rax, rax
je 0x14002ae8e
lea r8, [rsp + 0x40]
or r9d, 0xffffffff
xor edx, edx
mov ecx, 0xfde9
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
test eax, eax
jne 0x14002aec3
mov rcx, rdi
call fcn.1400e387c
mov eax, 0x200
mov rsi, qword [rsp + 0x188]
mov rbx, qword [rsp + 0x180]
mov rdi, qword [rsp + 0x160]
mov rcx, qword [rsp + 0x150]
xor rcx, rsp
call fcn.1400e2890
add rsp, 0x168
ret
mov rcx, rdi
call fcn.1400289c0
mov rcx, rdi
mov rbx, rax
call fcn.1400e387c
test rbx, rbx
je 0x14002ae8e
call fcn.140028770
test eax, eax
je 0x14002af2b
cmp word [rbx], 0
mov rax, rbx
je 0x14002af05
nop dword [rax]
cmp word [rax], 0x5c
je 0x14002af02
add rax, 2
cmp word [rax], 0
jne 0x14002aef0
jmp 0x14002af05
mov word [rax], si
lea rax, [rsp + 0x30]
lea r9, [rsp + 0x30]
lea r8, [rsp + 0x34]
lea rdx, [rsp + 0x30]
mov rcx, rbx
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceW]
mov edi, eax
jmp 0x14002af69
cmp byte [rbx], 0
mov rax, rbx
je 0x14002af45
cmp byte [rax], 0x5c
je 0x14002af42
inc rax
cmp byte [rax], 0
jne 0x14002af33
jmp 0x14002af45
mov byte [rax], 0
lea rax, [rsp + 0x30]
lea r9, [rsp + 0x30]
lea r8, [rsp + 0x34]
lea rdx, [rsp + 0x30]
mov rcx, rbx
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceA]
mov edi, eax
mov rcx, rbx
call fcn.1400e387c
test edi, edi
je 0x14002ae8e
mov eax, dword [rsp + 0x34]
jmp 0x14002ae93
mov eax, dword [rsp + 0x34]
mov rcx, qword [rsp + 0x150]
xor rcx, rsp
call fcn.1400e2890
add rsp, 0x168
ret
Function at 0x14002b240
Capabilities:
Get system information on windows

Disassembly:
sub rsp, 0x28
xor eax, eax
lea rcx, [0x14014f160]
mov qword [0x14014f160], rax
mov qword [0x14014f168], rax
mov qword [0x14014f170], rax
mov qword [0x14014f178], rax
mov qword [0x14014f180], rax
mov qword [0x14014f188], rax
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
call fcn.14009aa50
test eax, eax
jne 0x14002b335
mov qword [rsp + 0x20], rbx
cmp dword [reloc.WS2_32.dll_accept], eax
jne 0x14002b29b
xor ebx, ebx
jmp 0x14002b2b7
mov ecx, 2
call qword [0x1401440e0]
mov rbx, rax
test rax, rax
je 0x14002b2b7
mov rcx, rax
call qword [0x1401440f0]
mov rcx, qword [0x14014dd00]
lea r9, [0x140144470]
cmp rcx, r9
jne 0x14002b2d3
mov rcx, qword [0x140144480]
jmp 0x14002b30d
test rcx, rcx
je 0x14002b30d
cmp qword [rcx + 0x10], 0
lea rax, [rcx + 0x10]
mov rdx, rcx
je 0x14002b2fc
mov r8, qword [rax]
cmp r8, r9
je 0x14002b2fc
cmp qword [r8 + 0x10], 0
lea rax, [r8 + 0x10]
mov rdx, r8
jne 0x14002b2e6
cmp qword [rdx + 0x10], r9
jne 0x14002b30d
mov rax, qword [0x140144480]
mov qword [rdx + 0x10], rax
mov qword [0x140144480], rcx
mov qword [0x14014dd00], r9
test rbx, rbx
je 0x14002b329
mov rcx, rbx
call qword [0x140144100]
xor eax, eax
mov rbx, qword [rsp + 0x20]
add rsp, 0x28
ret
xor eax, eax
add rsp, 0x28
ret
Function at 0x14005c9a0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rbx, rdx
mov rdi, rcx
test rcx, rcx
je 0x14005cafe
test rdx, rdx
je 0x14005cafe
movzx edx, word [rcx + 2]
mov r8d, 0x800
movzx eax, dx
and ax, r8w
cmp ax, r8w
je 0x14005ca6b
movzx ecx, word [rbx + 2]
movzx eax, cx
and ax, r8w
cmp ax, r8w
je 0x14005ca6b
xor cl, dl
test cl, 0x10
jne 0x14005ca6b
movzx eax, byte [rbx]
cmp byte [rdi], al
jne 0x14005ca6b
mov rdx, qword [rbx + 0x10]
mov rcx, qword [rdi + 0x10]
call fcn.14005c9a0
test eax, eax
jne 0x14005ca6b
mov rdx, qword [rbx + 0x18]
mov rcx, qword [rdi + 0x18]
call fcn.14005c9a0
test eax, eax
jne 0x14005ca6b
mov rdx, qword [rbx + 0x20]
mov rcx, qword [rdi + 0x20]
call fcn.14005cb20
test eax, eax
jne 0x14005ca6b
mov eax, dword [rbx + 0x30]
cmp dword [rdi + 0x30], eax
jne 0x14005ca6b
movzx eax, word [rbx + 0x34]
cmp word [rdi + 0x34], ax
jne 0x14005ca6b
movzx r10d, word [rdi + 2]
mov edx, 0x400
movzx eax, r10w
and ax, dx
cmp ax, dx
jne 0x14005ca7b
movzx eax, word [rbx + 2]
and ax, dx
cmp ax, dx
jne 0x14005ca6b
mov eax, dword [rbx + 8]
cmp dword [rdi + 8], eax
je 0x14005cab7
mov eax, 2
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
cmp byte [rdi], 0x98
je 0x14005cab7
mov rcx, qword [rdi + 8]
test rcx, rcx
je 0x14005cab7
movzx eax, word [rbx + 2]
and ax, dx
cmp ax, dx
je 0x14005ca6b
mov rdx, qword [rbx + 8]
test rdx, rdx
je 0x14005ca6b
call fcn.140027480
test eax, eax
je 0x14005cab7
mov eax, 2
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
movzx eax, word [rbx + 2]
mov ecx, 0x100
and ax, cx
and r10w, cx
cmp r10w, ax
je 0x14005cadd
mov eax, 1
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
test r10w, r10w
je 0x14005caf1
mov rax, qword [rbx + 0x28]
cmp qword [rdi + 0x28], rax
jne 0x14005ca6b
xor eax, eax
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
mov rbx, qword [rsp + 0x30]
xor ecx, ecx
mov eax, 2
cmp rdx, rdi
cmove eax, ecx
add rsp, 0x20
pop rdi
ret
Function at 0x140062070
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
sub rsp, 0x20
xor r10d, r10d
mov rbp, r8
mov rsi, rdx
mov r12, rcx
mov rbx, rdx
test rdx, rdx
je 0x1400620b1
cmp byte [rdx], r10b
je 0x1400620a9
inc rbx
cmp byte [rbx], r10b
jne 0x1400620a1
sub ebx, edx
and ebx, 0x3fffffff
mov r13d, dword [rcx + 8]
xor edi, edi
test r13d, r13d
jle 0x1400621ed
mov qword [rsp + 0x40], r14
lea r14, [0x140113150]
nop dword [rax]
cmp edi, 2
jge 0x1400620de
mov r9d, edi
xor r9d, 1
jmp 0x1400620e1
mov r9d, edi
test rbp, rbp
je 0x140062144
mov rax, qword [r12 + 0x10]
movsxd rcx, r9d
mov rdx, rbp
shl rcx, 5
mov r8, qword [rcx + rax]
movzx ecx, byte [rbp]
test cl, cl
je 0x14006212f
nop word [rax + rax]
movzx eax, byte [r8]
movzx ecx, cl
movzx eax, byte [rax + r14]
cmp byte [rcx + r14], al
jne 0x14006212f
mov cl, byte [rdx + 1]
inc rdx
inc r8
test cl, cl
jne 0x140062110
movzx eax, byte [r8]
movzx ecx, byte [rax + r14]
movzx eax, byte [rdx]
movzx eax, byte [rax + r14]
cmp eax, ecx
jne 0x1400621c1
mov rax, qword [r12 + 0x10]
movsxd rcx, r9d
shl rcx, 5
mov r10, qword [rcx + rax + 0x18]
cmp qword [r10 + 0x18], 0
je 0x14006219a
xor r8d, r8d
mov edx, ebx
mov r9, rsi
test ebx, ebx
jle 0x14006218f
nop dword [rax + rax]
movzx eax, byte [r9]
dec edx
inc r9
movzx ecx, byte [rax + r14]
lea eax, [r8*8]
xor ecx, eax
xor r8d, ecx
test edx, edx
jg 0x140062170
xor edx, edx
mov eax, r8d
div dword [r10 + 8]
jmp 0x14006219c
xor edx, edx
mov r9d, edx
lea rcx, [r10 + 8]
mov r8d, ebx
mov rdx, rsi
call fcn.140028410
test rax, rax
je 0x1400621be
mov r10, qword [rax + 0x10]
test r10, r10
jne 0x1400621cc
jmp 0x1400621c1
xor r10d, r10d
inc edi
cmp edi, r13d
jl 0x1400620d0
mov r14, qword [rsp + 0x40]
mov rax, r10
mov rbx, qword [rsp + 0x48]
mov rbp, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x20
pop r13
pop r12
pop rdi
ret
mov rax, r10
jmp 0x1400621d4
Function at 0x1400622d0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r13
sub rsp, 0x20
xor r9d, r9d
mov rbp, r8
mov rsi, rdx
mov rbx, rdx
test rdx, rdx
je 0x140062308
cmp byte [rdx], r9b
je 0x140062300
inc rbx
cmp byte [rbx], r9b
jne 0x1400622f8
sub ebx, edx
and ebx, 0x3fffffff
mov r13d, dword [rcx + 8]
xor edi, edi
test r13d, r13d
jle 0x14006242c
mov qword [rsp + 0x40], r12
mov r12, qword [rcx + 0x10]
mov qword [rsp + 0x48], r14
lea r14, [0x140113150]
nop dword [rax]
cmp edi, 2
jge 0x14006233c
mov eax, edi
xor eax, 1
jmp 0x14006233e
mov eax, edi
movsxd r8, eax
shl r8, 5
mov r10, qword [r8 + r12 + 0x18]
test rbp, rbp
je 0x140062394
movzx ecx, byte [rbp]
mov r8, qword [r8 + r12]
mov rdx, rbp
test cl, cl
je 0x14006237f
nop
movzx eax, byte [r8]
movzx ecx, cl
movzx eax, byte [rax + r14]
cmp byte [rcx + r14], al
jne 0x14006237f
mov cl, byte [rdx + 1]
inc rdx
inc r8
test cl, cl
jne 0x140062360
movzx eax, byte [r8]
movzx ecx, byte [rax + r14]
movzx eax, byte [rdx]
movzx eax, byte [rax + r14]
cmp eax, ecx
jne 0x140062401
cmp qword [r10 + 0x30], 0
je 0x1400623da
xor r8d, r8d
mov edx, ebx
mov r9, rsi
test ebx, ebx
jle 0x1400623cf
nop word [rax + rax]
movzx eax, byte [r9]
dec edx
inc r9
movzx ecx, byte [rax + r14]
lea eax, [r8*8]
xor ecx, eax
xor r8d, ecx
test edx, edx
jg 0x1400623b0
xor edx, edx
mov eax, r8d
div dword [r10 + 0x20]
jmp 0x1400623dc
xor edx, edx
mov r9d, edx
lea rcx, [r10 + 0x20]
mov r8d, ebx
mov rdx, rsi
call fcn.140028410
test rax, rax
je 0x1400623fe
mov r9, qword [rax + 0x10]
test r9, r9
jne 0x14006240c
jmp 0x140062401
xor r9d, r9d
inc edi
cmp edi, r13d
jl 0x140062330
mov r12, qword [rsp + 0x40]
mov r14, qword [rsp + 0x48]
mov rax, r9
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
add rsp, 0x20
pop r13
pop rdi
pop rsi
ret
mov rax, r9
jmp 0x140062419
Function at 0x1400680e0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r12
sub rsp, 0x20
mov rbx, qword [rdx]
mov rbp, rdx
mov rsi, rcx
xor edi, edi
lea r12, [0x140000000]
nop dword [rax]
test rbx, rbx
je 0x1400681a0
cmp byte [rbx], 0
mov r8, rbx
je 0x14006812a
inc r8
cmp byte [r8], 0
jne 0x140068121
sub r8d, ebx
and r8d, 0x3fffffff
cmp qword [rsi + 0x2b0], 0
je 0x14006817d
xor eax, eax
mov r9d, r8d
mov r10, rbx
test r8d, r8d
jle 0x140068173
nop dword [rax + rax]
movzx ecx, byte [r10]
dec r9d
inc r10
movzx edx, byte [rcx + r12 + 0x113150]
lea ecx, [rax*8]
xor edx, ecx
xor eax, edx
test r9d, r9d
jg 0x140068150
xor edx, edx
div dword [rsi + 0x2a0]
jmp 0x14006817f
xor edx, edx
mov r9d, edx
lea rcx, [rsi + 0x2a0]
mov rdx, rbx
call fcn.140028410
test rax, rax
je 0x14006819c
mov rdx, qword [rax + 0x10]
jmp 0x1400681a4
xor edx, edx
jmp 0x1400681a4
mov rdx, qword [rsi + 0x38]
test rdx, rdx
je 0x1400681be
movzx eax, byte [rdi + r12 + 0x113db8]
dec eax
cdqe
lea rcx, [rax + rax*4]
lea rdx, [rdx + rcx*8]
cmp qword [rdx + 0x18], 0
jne 0x1400681d9
inc rdi
cmp rdi, 3
jl 0x140068110
mov eax, 1
jmp 0x140068202
mov rax, qword [rdx]
mov qword [rbp], rax
mov rax, qword [rdx + 8]
mov qword [rbp + 8], rax
mov rax, qword [rdx + 0x10]
mov qword [rbp + 0x10], rax
mov rax, qword [rdx + 0x18]
mov qword [rbp + 0x18], rax
mov qword [rbp + 0x20], 0
xor eax, eax
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r12
ret
Function at 0x14006f280
Capabilities:
Encode data using xor

Disassembly:
mov rdx, qword [rcx]
mov rax, rdx
test rdx, rdx
je 0x14006f29f
cmp byte [rdx], 0
je 0x14006f298
inc rax
cmp byte [rax], 0
jne 0x14006f290
sub eax, edx
and eax, 0x3fffffff
mov rcx, qword [rcx + 0x78]
mov r8d, eax
add rcx, 0x50
jmp fcn.1400284e0
Function at 0x14006fb50
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push r13
sub rsp, 0x30
mov rax, qword [rcx]
xor r13d, r13d
mov rsi, rdx
bt dword [rax + 0x18], 0x1a
mov rbp, rcx
mov ebx, r13d
jae 0x14006fcd2
mov r9, qword [rdx + 0x38]
test r9, r9
je 0x14006fbb8
mov eax, dword [r9 + 0x28]
test eax, eax
jle 0x14006fbaf
lea rdx, [r9 + 0x40]
mov r8, rax
nop
mov ecx, dword [rdx]
cmp ecx, 0x1f
jle 0x14006fb9c
or eax, 0xffffffff
jmp 0x14006fba3
mov eax, 1
shl eax, cl
or ebx, eax
add rdx, 0x10
sub r8, 1
jne 0x14006fb90
mov r9, qword [r9 + 8]
test r9, r9
jne 0x14006fb80
mov r10, qword [rsi]
mov r8, r10
test r10, r10
jne 0x14006fbc8
mov r8d, r13d
jmp 0x14006fbe2
cmp byte [r10], r13b
je 0x14006fbd8
nop dword [rax]
inc r8
cmp byte [r8], r13b
jne 0x14006fbd0
sub r8d, r10d
and r8d, 0x3fffffff
mov r11, qword [rsi + 0x78]
mov qword [rsp + 0x58], rdi
cmp qword [r11 + 0x60], r13
je 0x14006fc3e
mov edx, r8d
mov rdi, r10
mov r9d, r13d
test r8d, r8d
jle 0x14006fc33
mov qword [rsp + 0x60], r12
lea r12, [0x140113150]
nop dword [rax + rax]
movzx eax, byte [rdi]
dec edx
inc rdi
movzx ecx, byte [rax + r12]
lea eax, [r9*8]
xor ecx, eax
xor r9d, ecx
test edx, edx
jg 0x14006fc10
mov r12, qword [rsp + 0x60]
xor edx, edx
mov eax, r9d
div dword [r11 + 0x50]
jmp 0x14006fc41
mov edx, r13d
mov r9d, edx
lea rcx, [r11 + 0x50]
mov rdx, r10
call fcn.140028410
test rax, rax
je 0x14006fcbd
mov rdi, qword [rax + 0x10]
test rdi, rdi
je 0x14006fcbd
nop
lea r9, [rsp + 0x50]
mov r8, rdi
mov rdx, rsi
mov rcx, rbp
mov qword [rsp + 0x50], r13
mov qword [rsp + 0x20], r13
call fcn.14006dda0
mov rdx, qword [rsp + 0x50]
test rdx, rdx
je 0x14006fcb4
mov eax, dword [rdx + 8]
test eax, eax
jle 0x14006fcb4
mov rdx, qword [rdx + 0x10]
mov r8, rax
mov ecx, dword [rdx]
cmp ecx, 0x1f
jle 0x14006fca1
or eax, 0xffffffff
jmp 0x14006fca8
mov eax, 1
shl eax, cl
or ebx, eax
add rdx, 4
sub r8, 1
jne 0x14006fc95
mov rdi, qword [rdi + 0x18]
test rdi, rdi
jne 0x14006fc60
mov eax, ebx
mov rdi, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x68]
add rsp, 0x30
pop r13
pop rsi
pop rbp
ret
mov eax, ebx
mov rbx, qword [rsp + 0x68]
add rsp, 0x30
pop r13
pop rsi
pop rbp
ret
Function at 0x140090d50
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 0x18], rbx
mov dword [rsp + 0x20], r9d
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x30
mov rax, qword [rcx]
xor r15d, r15d
mov rbp, r8
mov r8, rcx
mov rcx, qword [rsp + 0x90]
mov dword [rsp + 0x20], r15d
mov r14d, dword [rcx]
mov r13, qword [rcx + 0x10]
mov qword [rsp + 0x28], rax
mov edi, r15d
mov esi, r15d
mov r12, r15
test r14d, r14d
jle 0x140090f19
nop word [rax + rax]
cmp esi, dword [rbp + 8]
jg 0x140090f0c
mov rbx, qword [r13]
cmp byte [rbx], 0x98
jne 0x140090f0c
cmp dword [rbx + 0x30], r9d
jne 0x140090f0c
mov rdx, rbx
mov rcx, r8
call fcn.140056e70
mov rdx, rax
test rax, rax
jne 0x140090dec
mov rax, qword [rsp + 0x28]
mov rdx, qword [rax + 0x38]
cmp qword [rbp], r15
je 0x140090e23
cmp esi, dword [rbp + 8]
jge 0x140090e23
mov rax, qword [rbp + 0x10]
mov r9d, dword [rax + r12*4]
mov rax, qword [rbp + 0x20]
cmp r9d, dword [rax + 8]
mov eax, 0xffffffff
cmove r9d, eax
mov rax, qword [rbp + 0x48]
movzx r10d, byte [rax + r12]
mov rax, qword [rbp + 0x50]
mov r8, qword [rax + r12*8]
jmp 0x140090e2d
mov r8, qword [rdx]
or r9d, 0xffffffff
mov r10d, r15d
movsx eax, word [rbx + 0x34]
cmp eax, r9d
jne 0x140090ed6
mov rdx, qword [rdx]
lea rbx, [0x140113150]
movzx eax, byte [rdx]
test al, al
je 0x140090e6d
nop dword [rax + rax]
movzx ecx, al
movzx eax, byte [r8]
movzx eax, byte [rax + rbx]
cmp byte [rcx + rbx], al
jne 0x140090e6d
mov al, byte [rdx + 1]
inc rdx
inc r8
test al, al
jne 0x140090e50
movzx eax, byte [rdx]
movzx ecx, byte [rax + rbx]
movzx eax, byte [r8]
movzx eax, byte [rax + rbx]
cmp ecx, eax
jne 0x140090ed6
movzx eax, byte [r13 + 0x18]
movsxd rcx, dword [rsp + 0x98]
xor eax, r10d
cmp r12, rcx
jle 0x140090ea1
cmp eax, dword [rsp + 0x20]
jne 0x140090f5b
jmp 0x140090ea5
mov dword [rsp + 0x20], eax
inc edi
add r13, 0x20
test r9d, r9d
jns 0x140090ee3
mov r9d, dword [rsp + 0x88]
mov rdx, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x90]
mov r8d, edi
call fcn.140090ca0
test eax, eax
jne 0x140090ee3
mov edi, r14d
jmp 0x140090ee3
movsxd rax, dword [rsp + 0x98]
cmp r12, rax
jge 0x140090eff
mov r9d, dword [rsp + 0x88]
inc esi
inc r12
cmp edi, r14d
jge 0x140090f0c
mov r8, qword [rsp + 0x70]
jmp 0x140090db0
cmp esi, dword [rbp + 8]
jne 0x140090f5b
mov r9d, dword [rsp + 0x88]
mov rcx, qword [rsp + 0x90]
mov rdx, qword [rsp + 0x78]
cmp dword [rsp + 0x20], r15d
mov rax, qword [rsp + 0xa8]
setne r15b
cmp edi, r14d
mov dword [rax], r15d
jl 0x140090f39
mov eax, 1
jmp 0x140090f5d
cmp byte [rbp + 0x2c], 0
je 0x140090f5b
cmp esi, dword [rbp + 8]
jne 0x140090f5b
bt dword [rsp + 0xa0], 0x13
jb 0x140090f5b
mov r8d, edi
call fcn.140090ca0
test eax, eax
je 0x140090f32
xor eax, eax
mov rbx, qword [rsp + 0x80]
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret