joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4f0b80
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4f0c7d
push rbp
mov rbp, rsp
sub rsp, 0x50
movabs rdx, 0x697cba69161a7447
mov qword [rsp + 0x1d], rdx
movabs rdx, 0x24092cecac697cba
mov qword [rsp + 0x22], rdx
movabs rdx, 0x241f726fceee46f4
mov qword [rsp + 0x2a], rdx
movabs rdx, 0xb010610030d0804
mov qword [rsp + 0x32], rdx
movabs rdx, 0x80413090a100405
mov qword [rsp + 0x3a], rdx
movabs rdx, 0x6020b0f08020804
mov qword [rsp + 0x40], rdx
movabs rdx, 0xe130a0f06140c04
mov qword [rsp + 0x48], rdx
xor eax, eax
jmp 0x4f0c20
movzx r9d, byte [rsp + rsi + 0x1d]
sub r9d, edx
lea edx, [r9 + 0x6c]
mov byte [rsp + rdi + 0x1d], dl
lea edx, [r8 + 0x6c]
mov byte [rsp + rsi + 0x1d], dl
add rax, 2
nop dword [rax]
cmp rax, 0x1e
jge 0x4f0c4d
movzx edx, byte [rsp + rax + 0x32]
movzx esi, byte [rsp + rax + 0x33]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x15
jae 0x4f0c70
movzx r8d, byte [rsp + rdi + 0x1d]
sub r8d, edx
cmp rsi, 0x15
jb 0x4f0bff
jmp 0x4f0c64
xor eax, eax
lea rbx, [rsp + 0x1d]
mov ecx, 0x15
call fcn.00441380
add rsp, 0x50
pop rbp
ret
mov eax, esi
mov ecx, 0x15
call fcn.00451880
mov eax, edi
mov ecx, 0x15
call fcn.00451880
nop
nop dword [rax]
call fcn.0044f600
jmp fcn.004f0b80

Function at 0x4f7e20
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4f7f28
push rbp
mov rbp, rsp
sub rsp, 0x58
movabs rdx, 0x31ea19196f63f6bf
mov qword [rsp + 0x1f], rdx
movabs rdx, 0x381b70d774e98374
mov qword [rsp + 0x27], rdx
movabs rdx, 0x35381b70d774e983
mov qword [rsp + 0x28], rdx
movabs rdx, 0x23c674ac9b95352e
mov qword [rsp + 0x30], rdx
movabs rdx, 0x4000a1517040513
mov qword [rsp + 0x38], rdx
movabs rdx, 0x90c150614011409
mov qword [rsp + 0x40], rdx
movabs rdx, 0x11418120a0c0e09
mov qword [rsp + 0x48], rdx
movabs rdx, 0x70f10150414050c
mov qword [rsp + 0x50], rdx
xor eax, eax
jmp 0x4f7ecb
movzx r9d, byte [rsp + rsi + 0x1f]
sub r9d, edx
lea edx, [r9 + 0x61]
mov byte [rsp + rdi + 0x1f], dl
lea edx, [r8 + 0x61]
mov byte [rsp + rsi + 0x1f], dl
add rax, 2
cmp rax, 0x20
jge 0x4f7ef8
movzx edx, byte [rsp + rax + 0x38]
movzx esi, byte [rsp + rax + 0x39]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x19
jae 0x4f7f1b
movzx r8d, byte [rsp + rdi + 0x1f]
sub r8d, edx
cmp rsi, 0x19
jb 0x4f7eae
jmp 0x4f7f0f
xor eax, eax
lea rbx, [rsp + 0x1f]
mov ecx, 0x19
call fcn.00441380
add rsp, 0x58
pop rbp
ret
mov eax, esi
mov ecx, 0x19
call fcn.00451880
mov eax, edi
mov ecx, 0x19
call fcn.00451880
nop
call fcn.0044f600
jmp fcn.004f7e20
Function at 0x4f7f40
Capabilities:
Encrypt data using rc4 prga

Disassembly:
lea r12, [rsp - 0x48]
cmp r12, qword [r14 + 0x10]
jbe 0x4f80a0
push rbp
mov rbp, rsp
sub rsp, 0xc0
movabs rdx, 0x796e240cf73ac474
mov qword [rsp + 0x1d], rdx
movabs rdx, 0xeb7d505845675279
mov qword [rsp + 0x24], rdx
movabs rdx, 0x4e256fe2c406650a
mov qword [rsp + 0x2c], rdx
movabs rdx, 0x12d471563b7461fe
mov qword [rsp + 0x34], rdx
movabs rdx, 0x56c43782b3202d6f
mov qword [rsp + 0x3c], rdx
movabs rdx, 0x931abf522f6555d8
mov qword [rsp + 0x44], rdx
movabs rdx, 0x3c3e867320476f20
mov qword [rsp + 0x4c], rdx
movabs rdx, 0x3de61d3f723e7458
mov qword [rsp + 0x54], rdx
movabs rdx, 0x29ee3735e2995f31
mov qword [rsp + 0x5c], rdx
movabs rdx, 0xf1e0d11273c1d3c
mov qword [rsp + 0x64], rdx
movabs rdx, 0x139421701410113
mov qword [rsp + 0x6c], rdx
lea rdi, [rsp + 0x70]
lea rsi, [0x006a0da4]
mov qword [rsp - 0x10], rbp
lea rbp, [rsp - 0x10]
call fcn.00451eba
mov rbp, qword [rbp]
xor eax, eax
jmp 0x4f8040
movzx r9d, byte [rsp + rsi + 0x1d]
sub r9d, edx
lea edx, [r9 + 0x77]
mov byte [rsp + rdi + 0x1d], dl
lea edx, [r8 + 0x77]
mov byte [rsp + rsi + 0x1d], dl
add rax, 2
nop
cmp rax, 0x5c
jge 0x4f806d
movzx edx, byte [rsp + rax + 0x64]
movzx esi, byte [rsp + rax + 0x65]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x47
jae 0x4f8093
movzx r8d, byte [rsp + rdi + 0x1d]
sub r8d, edx
cmp rsi, 0x47
jb 0x4f8022
jmp 0x4f8087
xor eax, eax
lea rbx, [rsp + 0x1d]
mov ecx, 0x47
call fcn.00441380
add rsp, 0xc0
pop rbp
ret
mov eax, esi
mov ecx, 0x47
call fcn.00451880
mov eax, edi
mov ecx, 0x47
call fcn.00451880
nop
call fcn.0044f600
jmp fcn.004f7f40

Function at 0x4f8ae0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4f8bfa
push rbp
mov rbp, rsp
sub rsp, 0x60
movabs rdx, 0x6b69545b206a707a
mov qword [rsp + 0x18], rdx
movabs rdx, 0x7e2420535c6f584e
mov qword [rsp + 0x20], rdx
movabs rdx, 0x963206b633f7a4f
mov qword [rsp + 0x28], rdx
movabs rdx, 0x6e40693750656967
mov qword [rsp + 0x30], rdx
movabs rdx, 0x111c171b0002010f
mov qword [rsp + 0x38], rdx
movabs rdx, 0xa0a1e001818100e
mov qword [rsp + 0x40], rdx
movabs rdx, 0xb1006110607190a
mov qword [rsp + 0x48], rdx
movabs rdx, 0x18001b06170c131e
mov qword [rsp + 0x50], rdx
movabs rdx, 0x120b0508040e090c
mov qword [rsp + 0x58], rdx
xor eax, eax
jmp 0x4f8b97
movzx r9d, byte [rsp + rsi + 0x18]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x19]
mov byte [rsp + rdi + 0x18], dl
mov byte [rsp + rsi + 0x18], r8b
add rax, 2
cmp rax, 0x28
jge 0x4f8bc9
movzx edx, byte [rsp + rax + 0x38]
movzx esi, byte [rsp + rax + 0x39]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x20
jae 0x4f8bed
movzx r8d, byte [rsp + rdi + 0x18]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x19]
cmp rsi, 0x20
jb 0x4f8b7d
jmp 0x4f8be1
xor eax, eax
lea rbx, [rsp + 0x18]
mov ecx, 0x20
call fcn.00441380
add rsp, 0x60
pop rbp
nop
ret
mov eax, esi
mov ecx, 0x20
call fcn.00451880
mov eax, edi
mov ecx, 0x20
call fcn.00451880
nop
call fcn.0044f600
nop
jmp fcn.004f8ae0
Function at 0x4f8dc0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4f8eda
push rbp
mov rbp, rsp
sub rsp, 0x60
movabs rdx, 0x6b69545b206a707a
mov qword [rsp + 0x18], rdx
movabs rdx, 0x7e2420535c6f584e
mov qword [rsp + 0x20], rdx
movabs rdx, 0x963206b633f7a4f
mov qword [rsp + 0x28], rdx
movabs rdx, 0x6e40693750656967
mov qword [rsp + 0x30], rdx
movabs rdx, 0x111c171b0002010f
mov qword [rsp + 0x38], rdx
movabs rdx, 0xa0a1e001818100e
mov qword [rsp + 0x40], rdx
movabs rdx, 0xb1006110607190a
mov qword [rsp + 0x48], rdx
movabs rdx, 0x18001b06170c131e
mov qword [rsp + 0x50], rdx
movabs rdx, 0x120b0508040e090c
mov qword [rsp + 0x58], rdx
xor eax, eax
jmp 0x4f8e77
movzx r9d, byte [rsp + rsi + 0x18]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x19]
mov byte [rsp + rdi + 0x18], dl
mov byte [rsp + rsi + 0x18], r8b
add rax, 2
cmp rax, 0x28
jge 0x4f8ea9
movzx edx, byte [rsp + rax + 0x38]
movzx esi, byte [rsp + rax + 0x39]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x20
jae 0x4f8ecd
movzx r8d, byte [rsp + rdi + 0x18]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x19]
cmp rsi, 0x20
jb 0x4f8e5d
jmp 0x4f8ec1
xor eax, eax
lea rbx, [rsp + 0x18]
mov ecx, 0x20
call fcn.00441380
add rsp, 0x60
pop rbp
nop
ret
mov eax, esi
mov ecx, 0x20
call fcn.00451880
mov eax, edi
mov ecx, 0x20
call fcn.00451880
nop
call fcn.0044f600
nop
jmp fcn.004f8dc0
Function at 0x50efe0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x50f0b2
push rbp
mov rbp, rsp
sub rsp, 0x38
movabs rdx, 0x63546365a371805d
mov qword [rsp + 0x1f], rdx
movabs rdx, 0x8c747263546365a3
mov qword [rsp + 0x22], rdx
movabs rdx, 0x706000603000a08
mov qword [rsp + 0x2a], rdx
movabs rdx, 0x805050a01020706
mov qword [rsp + 0x30], rdx
xor eax, eax
jmp 0x50f04c
movzx r9d, byte [rsp + rsi + 0x1f]
lea edx, [r9 + rdx]
lea edx, [rdx - 0x17]
mov byte [rsp + rdi + 0x1f], dl
mov byte [rsp + rsi + 0x1f], r8b
add rax, 2
cmp rax, 0xe
jge 0x50f07e
movzx edx, byte [rsp + rax + 0x2a]
movzx esi, byte [rsp + rax + 0x2b]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0xb
jae 0x50f0a5
movzx r8d, byte [rsp + rdi + 0x1f]
lea r8d, [r8 + rdx]
lea r8d, [r8 - 0x17]
cmp rsi, 0xb
jb 0x50f032
jmp 0x50f095
xor eax, eax
lea rbx, [rsp + 0x1f]
mov ecx, 0xb
call fcn.00441380
add rsp, 0x38
pop rbp
ret
mov eax, esi
mov ecx, 0xb
nop dword [rax]
call fcn.00451880
mov eax, edi
mov ecx, 0xb
call fcn.00451880
nop
call fcn.0044f600
jmp fcn.0050efe0

Function at 0x50f440
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x50f51d
push rbp
mov rbp, rsp
sub rsp, 0x38
movabs rdx, 0xab65ffa24c081cb6
mov qword [rsp + 0x18], rdx
movabs rdx, 0x650fe2747025ab65
mov qword [rsp + 0x1e], rdx
movabs rdx, 0x30004050b070805
mov qword [rsp + 0x26], rdx
movabs rdx, 0x505030004050b07
mov qword [rsp + 0x28], rdx
movabs rdx, 0x204030b0c010004
mov qword [rsp + 0x30], rdx
xor eax, eax
nop
jmp 0x50f4c0
movzx r9d, byte [rsp + rsi + 0x18]
sub r9d, edx
lea edx, [r9 + 0x6f]
mov byte [rsp + rdi + 0x18], dl
lea edx, [r8 + 0x6f]
mov byte [rsp + rsi + 0x18], dl
add rax, 2
nop
cmp rax, 0x12
jge 0x50f4ed
movzx edx, byte [rsp + rax + 0x26]
movzx esi, byte [rsp + rax + 0x27]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0xe
jae 0x50f510
movzx r8d, byte [rsp + rdi + 0x18]
sub r8d, edx
cmp rsi, 0xe
jb 0x50f4a2
jmp 0x50f504
xor eax, eax
lea rbx, [rsp + 0x18]
mov ecx, 0xe
call fcn.00441380
add rsp, 0x38
pop rbp
ret
mov eax, esi
mov ecx, 0xe
call fcn.00451880
mov eax, edi
mov ecx, 0xe
call fcn.00451880
nop
nop dword [rax]
call fcn.0044f600
jmp fcn.0050f440
Function at 0x50f820
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x50f91b
push rbp
mov rbp, rsp
sub rsp, 0x48
movabs rdx, 0x482c72cb43d6e547
mov qword [rsp + 0x1b], rdx
movabs rdx, 0x8e9fae482c72cb43
mov qword [rsp + 0x1e], rdx
movabs rdx, 0xca4ad773db63ee28
mov qword [rsp + 0x26], rdx
movabs rdx, 0x7090b0c0a110c06
mov qword [rsp + 0x2e], rdx
movabs rdx, 0xc0a0b0c09100811
mov qword [rsp + 0x36], rdx
movabs rdx, 0x8120c0a0b0c0910
mov qword [rsp + 0x38], rdx
movabs rdx, 0xb07040e0b070201
mov qword [rsp + 0x40], rdx
xor eax, eax
jmp 0x50f8b9
movzx r9d, byte [rsp + rsi + 0x1b]
lea edx, [r9 + rdx]
lea edx, [rdx + 0x7a]
mov byte [rsp + rdi + 0x1b], dl
mov byte [rsp + rsi + 0x1b], r8b
add rax, 2
cmp rax, 0x1a
jge 0x50f8eb
movzx edx, byte [rsp + rax + 0x2e]
movzx esi, byte [rsp + rax + 0x2f]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0x13
jae 0x50f90e
movzx r8d, byte [rsp + rdi + 0x1b]
lea r8d, [r8 + rdx]
lea r8d, [r8 + 0x7a]
cmp rsi, 0x13
jb 0x50f89f
jmp 0x50f902
xor eax, eax
lea rbx, [rsp + 0x1b]
mov ecx, 0x13
call fcn.00441380
add rsp, 0x48
pop rbp
ret
mov eax, esi
mov ecx, 0x13
call fcn.00451880
mov eax, edi
mov ecx, 0x13
call fcn.00451880
nop
nop dword [rax + rax]
call fcn.0044f600
jmp fcn.0050f820

Function at 0x510f80
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x511058
push rbp
mov rbp, rsp
sub rsp, 0x38
movabs rdx, 0xc36c24a716f4695d
mov qword [rsp + 0x1a], rdx
mov dword [rsp + 0x22], 0xb8b96cd0
movabs rdx, 0x40700040703080b
mov qword [rsp + 0x26], rdx
movabs rdx, 0xb05040700040703
mov qword [rsp + 0x28], rdx
movabs rdx, 0x20205070a0b0205
mov qword [rsp + 0x30], rdx
xor eax, eax
jmp 0x510ff7
movzx r9d, byte [rsp + rsi + 0x1a]
sub r9d, edx
lea edx, [r9 - 0x49]
mov byte [rsp + rdi + 0x1a], dl
lea edx, [r8 - 0x49]
mov byte [rsp + rsi + 0x1a], dl
add rax, 2
cmp rax, 0x12
jge 0x511028
movzx edx, byte [rsp + rax + 0x26]
movzx esi, byte [rsp + rax + 0x27]
mov edi, edx
xor edx, esi
add edx, eax
cmp rdi, 0xc
jae 0x51104b
movzx r8d, byte [rsp + rdi + 0x1a]
sub r8d, edx
nop dword [rax]
cmp rsi, 0xc
jb 0x510fda
jmp 0x51103f
xor eax, eax
lea rbx, [rsp + 0x1a]
mov ecx, 0xc
call fcn.00441380
add rsp, 0x38
pop rbp
ret
mov eax, esi
mov ecx, 0xc
call fcn.00451880
mov eax, edi
mov ecx, 0xc
call fcn.00451880
nop
call fcn.0044f600
nop dword [rax]
jmp fcn.00510f80
Function at 0x1400013b0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x20
mov rdi, rcx
mov ecx, 0x18
call fcn.14000d1bc
xor esi, esi
mov rbx, rax
mov qword [rax], rsi
lea ecx, [rsi + 5]
mov qword [rax + 8], rsi
mov qword [rax + 0x10], rsi
call fcn.14000d1bc
mov qword [rbx], rax
lea r9d, [rsi + 2]
mov r11d, 1
lea r8, [rdi + 2]
mov r14d, r9d
lea r12, [0x140046570]
lea rcx, [rax + 5]
mov r10, rdi
mov qword [rbx + 0x10], rcx
sub r11, rdi
xor ecx, ecx
sub r14, rdi
mov dword [rax], ecx
mov r15, 0xfffffffffffffffe
mov byte [rax + 4], cl
not r10
add rax, 5
movabs rbp, 0x8fb823ee08fb823f
mov qword [rbx + 8], rax
sub r15, rdi
nop word [rax + rax]
lea rcx, [r15 + r8]
mov rax, rbp
mul rsi
shr rdx, 7
imul rax, rdx, 0xe4
movzx edx, byte [r8 - 2]
sub rsi, rax
mov rax, qword [rbx]
xor dl, byte [rsi + r12]
mov byte [rcx + rax], dl
mov rax, rbp
movsxd rcx, r9d
dec rcx
mul rcx
shr rdx, 7
imul rax, rdx, 0xe4
movzx edx, byte [r8 - 1]
sub rcx, rax
mov rax, qword [rbx]
xor dl, byte [rcx + r12]
lea rcx, [r10 + r8]
mov byte [rcx + rax], dl
mov rax, rbp
movsxd rcx, r9d
mul rcx
shr rdx, 7
imul rax, rdx, 0xe4
movzx edx, byte [r8]
sub rcx, rax
mov rax, qword [rbx]
xor dl, byte [rcx + r12]
mov rcx, r8
sub rcx, rdi
mov byte [rcx + rax], dl
mov rax, rbp
movsxd rcx, r9d
inc rcx
mul rcx
shr rdx, 7
imul rax, rdx, 0xe4
movzx edx, byte [r8 + 1]
sub rcx, rax
mov rax, qword [rbx]
xor dl, byte [rcx + r12]
lea rcx, [r11 + r8]
mov byte [rcx + rax], dl
mov rax, rbp
movsxd rcx, r9d
add r9d, 5
add rcx, 2
mul rcx
shr rdx, 7
imul rax, rdx, 0xe4
movzx edx, byte [r8 + 2]
sub rcx, rax
mov rax, qword [rbx]
xor dl, byte [rcx + r12]
lea rcx, [r14 + r8]
mov byte [rcx + rax], dl
add r8, 5
lea eax, [r9 - 2]
movsxd rsi, eax
cmp rsi, 5
jb 0x140001450
mov rbp, qword [rsp + 0x48]
mov rax, rbx
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x20
pop r15
pop r14
pop r12
ret
Function at 0x140001a70
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rsi, rcx
mov ecx, 0x18
call fcn.14000d1bc
xor edi, edi
mov rbx, rax
mov qword [rax], rdi
lea ecx, [rdi + 2]
mov qword [rax + 8], rdi
mov qword [rax + 0x10], rdi
call fcn.14000d1bc
mov qword [rbx], rax
lea r11, [0x140046570]
mov r9d, edi
mov r8d, edi
movabs r10, 0x8fb823ee08fb823f
lea rcx, [rax + 2]
mov qword [rbx + 0x10], rcx
xor ecx, ecx
mov word [rax], cx
add rax, 2
mov qword [rbx + 8], rax
nop dword [rax]
nop word [rax + rax]
movzx ecx, byte [r9 + rsi]
lea r9, [r9 + 2]
mov rax, r10
mul r8
shr rdx, 7
imul rax, rdx, 0xe4
sub r8, rax
mov rax, qword [rbx]
xor cl, byte [r8 + r11]
mov byte [r9 + rax - 2], cl
mov rax, r10
movzx ecx, byte [r9 + rsi - 1]
movsxd r8, edi
add edi, 2
inc r8
mul r8
shr rdx, 7
imul rax, rdx, 0xe4
sub r8, rax
mov rax, qword [rbx]
xor cl, byte [r8 + r11]
movsxd r8, edi
mov byte [rax + r9 - 1], cl
cmp r8, 2
jb 0x140001ae0
mov rsi, qword [rsp + 0x38]
mov rax, rbx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x140003160
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x20
mov rdi, rcx
mov ecx, 0x18
call fcn.14000d1bc
xor esi, esi
mov rbx, rax
mov qword [rax], rsi
lea ecx, [rsi + 0xc]
mov qword [rax + 8], rsi
mov qword [rax + 0x10], rsi
call fcn.14000d1bc
mov qword [rbx], rax
lea r8, [rdi + 4]
mov r9d, 2
lea r13, [0x140046660]
mov r10, 0xfffffffffffffffe
mov r11d, r9d
lea rcx, [rax + 0xc]
mov r14d, 4
mov qword [rbx + 0x10], rcx
mov r15d, 6
xor ecx, ecx
sub r10, rdi
mov qword [rax], rcx
sub r11, rdi
mov dword [rax + 8], ecx
sub r14, rdi
add rax, 0xc
sub r15, rdi
mov r12, 0xfffffffffffffffc
mov qword [rbx + 8], rax
sub r12, rdi
movabs rbp, 0x8fb823ee08fb823f
nop dword [rax]
nop word [rax + rax]
mov rcx, qword [rbx]
lea r8, [r8 + 0xc]
add rcx, r12
mov rax, rbp
mul rsi
shr rdx, 7
imul rax, rdx, 0xe4
sub rsi, rax
movzx eax, byte [r8 - 0x10]
xor al, byte [rsi + r13]
movsx edx, al
mov rax, rbp
mov word [rcx + r8 - 0xc], dx
movsxd rcx, r9d
dec rcx
mul rcx
shr rdx, 7
imul rax, rdx, 0xe4
sub rcx, rax
movzx eax, byte [r8 - 0xe]
xor al, byte [rcx + r13]
mov rcx, qword [rbx]
movsx edx, al
add rcx, r10
mov rax, rbp
mov word [rcx + r8 - 0xc], dx
movsxd rcx, r9d
mul rcx
shr rdx, 7
imul rax, rdx, 0xe4
sub rcx, rax
movzx eax, byte [r8 - 0xc]
xor al, byte [rcx + r13]
movsx ecx, al
mov rax, qword [rbx]
sub rax, rdi
mov word [rax + r8 - 0xc], cx
mov rax, rbp
movsxd rcx, r9d
inc rcx
mul rcx
shr rdx, 7
imul rax, rdx, 0xe4
sub rcx, rax
movzx eax, byte [r8 - 0xa]
xor al, byte [rcx + r13]
mov rcx, qword [rbx]
add rcx, r11
movsx edx, al
mov rax, rbp
mov word [rcx + r8 - 0xc], dx
movsxd rcx, r9d
add rcx, 2
mul rcx
shr rdx, 7
imul rax, rdx, 0xe4
sub rcx, rax
movzx eax, byte [r8 - 8]
xor al, byte [rcx + r13]
mov rcx, qword [rbx]
add rcx, r14
movsx edx, al
mov rax, rbp
mov word [rcx + r8 - 0xc], dx
movsxd rcx, r9d
add r9d, 6
add rcx, 3
mul rcx
shr rdx, 7
imul rax, rdx, 0xe4
sub rcx, rax
movzx eax, byte [r8 - 6]
xor al, byte [rcx + r13]
mov rcx, qword [rbx]
add rcx, r15
movsx edx, al
lea eax, [r9 - 2]
movsxd rsi, eax
mov word [rcx + r8 - 0xc], dx
cmp rsi, 6
jb 0x140003210
mov rbp, qword [rsp + 0x58]
mov rax, rbx
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x60]
add rsp, 0x20
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x140003370
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x20
mov rdi, rcx
mov ecx, 0x18
call fcn.14000d1bc
xor esi, esi
mov rbx, rax
mov qword [rax], rsi
lea ecx, [rsi + 0x10]
mov qword [rax + 8], rsi
mov qword [rax + 0x10], rsi
call fcn.14000d1bc
mov qword [rbx], rax
lea r8, [rdi + 4]
xorps xmm0, xmm0
mov r9d, 2
mov r10, 0xfffffffffffffffe
mov r11d, r9d
lea rcx, [rax + 0x10]
mov r14d, 4
mov qword [rbx + 0x10], rcx
mov r15d, 6
movups xmmword [rax], xmm0
add rax, 0x10
lea rcx, [0x140046660]
mov r12d, 8
mov qword [rbx + 8], rax
mov ebp, 0xa
sub r10, rdi
sub r11, rdi
sub r14, rdi
sub r15, rdi
sub r12, rdi
sub rbp, rdi
mov r13, 0xfffffffffffffffc
movabs rax, 0x8fb823ee08fb823f
sub r13, rdi
mul rsi
shr rdx, 7
imul rax, rdx, 0xe4
sub rsi, rax
movzx eax, byte [r8 - 4]
xor al, byte [rsi + rcx]
movabs rsi, 0x8fb823ee08fb823f
mov rcx, qword [rbx]
movsx edx, al
add rcx, r13
mov rax, rsi
mov word [rcx + r8], dx
movsxd rcx, r9d
dec rcx
mul rcx
shr rdx, 7
imul rax, rdx, 0xe4
lea rdx, [0x140046660]
sub rcx, rax
movzx eax, byte [r8 - 2]
xor al, byte [rcx + rdx]
mov rcx, qword [rbx]
movsx edx, al
add rcx, r10
mov rax, rsi
mov word [rcx + r8], dx
movsxd rcx, r9d
mul rcx
shr rdx, 7
imul rax, rdx, 0xe4
lea rdx, [0x140046660]
sub rcx, rax
movzx eax, byte [r8]
xor al, byte [rcx + rdx]
movsx ecx, al
mov rax, qword [rbx]
sub rax, rdi
mov word [rax + r8], cx
mov rax, rsi
movsxd rcx, r9d
inc rcx
mul rcx
shr rdx, 7
imul rax, rdx, 0xe4
lea rdx, [0x140046660]
sub rcx, rax
movzx eax, byte [r8 + 2]
xor al, byte [rcx + rdx]
mov rcx, qword [rbx]
add rcx, r11
movsx edx, al
mov rax, rsi
mov word [rcx + r8], dx
movsxd rcx, r9d
add rcx, 2
mul rcx
shr rdx, 7
imul rax, rdx, 0xe4
lea rdx, [0x140046660]
sub rcx, rax
movzx eax, byte [r8 + 4]
xor al, byte [rcx + rdx]
mov rcx, qword [rbx]
add rcx, r14
movsx edx, al
mov rax, rsi
mov word [rcx + r8], dx
movsxd rcx, r9d
add rcx, 3
mul rcx
shr rdx, 7
imul rax, rdx, 0xe4
lea rdx, [0x140046660]
sub rcx, rax
movzx eax, byte [r8 + 6]
xor al, byte [rcx + rdx]
mov rcx, qword [rbx]
add rcx, r15
movsx edx, al
mov word [rcx + r8], dx
movsxd rcx, r9d
add rcx, 4
lea r8, [r8 + 0x10]
mov rax, rsi
mul rcx
shr rdx, 7
imul rax, rdx, 0xe4
lea rdx, [0x140046660]
sub rcx, rax
movzx eax, byte [r8 - 8]
xor al, byte [rcx + rdx]
mov rcx, qword [rbx]
add rcx, r12
movsx edx, al
mov rax, rsi
mov word [rcx + r8 - 0x10], dx
movsxd rcx, r9d
add r9d, 8
add rcx, 5
mul rcx
shr rdx, 7
imul rax, rdx, 0xe4
lea rdx, [0x140046660]
sub rcx, rax
movzx eax, byte [r8 - 6]
xor al, byte [rcx + rdx]
mov rcx, qword [rbx]
add rcx, rbp
movsx edx, al
lea eax, [r9 - 2]
movsxd rsi, eax
movabs rax, 0x8fb823ee08fb823f
mov word [rcx + r8 - 0x10], dx
lea rcx, [0x140046660]
cmp rsi, 8
jb 0x140003422
mov rbp, qword [rsp + 0x58]
mov rax, rbx
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x60]
add rsp, 0x20
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x140003aa0
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push r14
sub rsp, 0x20
mov r14, r8
mov rsi, rdx
mov rbx, rcx
test r8, r8
jg 0x140003ad1
xor eax, eax
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
cmp qword [rcx + 0x68], 0
mov qword [rsp + 0x30], rbp
mov qword [rsp + 0x38], rdi
je 0x140003b4b
mov rdi, r14
mov rcx, rbx
call fcn.140006200
test rax, rax
jle 0x140003b23
cmp rdi, rax
mov rbp, rdi
mov rcx, rsi
cmovge rbp, rax
mov rax, qword [rbx + 0x38]
mov r8, rbp
mov rdx, qword [rax]
call fcn.14000f3e0
mov rax, qword [rbx + 0x50]
sub rdi, rbp
sub dword [rax], ebp
mov rcx, qword [rbx + 0x38]
movsxd rax, ebp
add qword [rcx], rax
jmp 0x140003b3b
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0x38]
cmp eax, 0xffffffff
je 0x140003b43
mov byte [rsi], al
dec rdi
mov ebp, 1
add rsi, rbp
test rdi, rdi
jg 0x140003ae5
sub r14, rdi
jmp 0x140003c2f
mov rax, qword [rcx + 0x38]
mov rbp, r14
mov rdx, qword [rax]
test rdx, rdx
je 0x140003b62
mov rax, qword [rcx + 0x50]
mov ecx, dword [rax]
jmp 0x140003b64
xor ecx, ecx
movsxd rax, ecx
test ecx, ecx
je 0x140003b96
cmp rax, r14
mov rdi, r14
mov rcx, rsi
cmovb rdi, rax
mov r8, rdi
call fcn.14000f3e0
mov rax, qword [rbx + 0x50]
add rsi, rdi
sub rbp, rdi
sub dword [rax], edi
mov rcx, qword [rbx + 0x38]
movsxd rax, edi
add qword [rcx], rax
cmp qword [rbx + 0x80], 0
je 0x140003c2c
mov r8, qword [rbx + 0x18]
lea rax, [rbx + 0x70]
cmp qword [r8], rax
jne 0x140003bd1
mov rcx, qword [rbx + 0x88]
mov rdx, qword [rbx + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rbx + 0x38]
mov qword [rax], rcx
mov rax, qword [rbx + 0x50]
mov dword [rax], edx
cmp rbp, 0xfff
jbe 0x140003c0d
nop word [rax + rax]
mov r9, qword [rbx + 0x80]
mov edx, 1
mov r8d, 0xfff
mov rcx, rsi
call fcn.140016944
add rsi, rax
sub rbp, rax
cmp rax, 0xfff
jne 0x140003c2c
cmp rbp, rax
ja 0x140003be0
test rbp, rbp
je 0x140003c2c
mov r9, qword [rbx + 0x80]
mov r8, rbp
mov edx, 1
mov rcx, rsi
call fcn.140016944
sub rbp, rax
sub r14, rbp
mov rbp, qword [rsp + 0x30]
mov rax, r14
mov rdi, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
Function at 0x140004680
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rsi, rcx
mov ecx, 0x18
call fcn.14000d1bc
xor edi, edi
mov rbx, rax
mov qword [rax], rdi
lea ecx, [rdi + 4]
mov qword [rax + 8], rdi
mov qword [rax + 0x10], rdi
call fcn.14000d1bc
mov qword [rbx], rax
lea r10, [0x140046660]
mov r8d, edi
movabs r9, 0x8fb823ee08fb823f
lea rcx, [rax + 4]
mov qword [rbx + 0x10], rcx
xor ecx, ecx
mov dword [rax], ecx
add rax, 4
mov qword [rbx + 8], rax
nop
mov rax, r9
lea r8, [r8 + 4]
mul rcx
shr rdx, 7
imul rax, rdx, 0xe4
sub rcx, rax
movzx eax, byte [r8 + rsi - 4]
xor al, byte [rcx + r10]
movsx ecx, al
mov rax, qword [rbx]
mov word [r8 + rax - 4], cx
mov rax, r9
movsxd rcx, edi
add edi, 2
inc rcx
mul rcx
shr rdx, 7
imul rax, rdx, 0xe4
sub rcx, rax
movzx eax, byte [r8 + rsi - 2]
xor al, byte [rcx + r10]
movsx ecx, al
mov rax, qword [rbx]
mov word [r8 + rax - 2], cx
movsxd rcx, edi
cmp rcx, 2
jb 0x1400046e0
mov rsi, qword [rsp + 0x38]
mov rax, rbx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret