joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14008bcb0
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x28
movzx eax, byte [0x1407060f8]
cmp al, 0x52
je 0x14008bce0
mov cl, 0x7f
nop word cs:[rax + rax]
mov al, 0x71
lock cmpxchg byte [0x1407060f8], cl
je 0x14008bce5
cmp al, 0x52
jne 0x14008bcd0
call fcn.1400955d0
mov eax, 0xca20ec24
mov ecx, 0x35df13f4
mov edx, 1
mov r8d, 0xca20ec25
mov r9d, 0x35df13f3
lea r10, [0x1407060e0]
lea r11, [0x1405e7770]
nop
mov esi, ecx
imul rsi, rsi, 0x51eb851f
shr rsi, 0x23
lea esi, [rsi + rsi*4]
lea esi, [rsi + rsi*4]
add esi, eax
mov edi, r9d
imul rdi, rdi, 0x51eb851f
shr rdi, 0x23
lea edi, [rdi + rdi*4]
lea edi, [rdi + rdi*4]
add edi, r8d
movzx ebx, byte [rdx + r10 - 1]
movzx ebp, byte [rdx + r10]
xor bl, byte [rdi + r11]
xor bl, 0x93
mov byte [rdx + r10 - 1], bl
xor bpl, byte [rsi + r11]
xor bpl, 0x93
mov byte [rdx + r10], bpl
add eax, 0xfffffffe
add ecx, 2
add rdx, 2
add r8d, 0xfffffffe
add r9d, 2
cmp rdx, 0x19
jne 0x14008bd10
mov al, 0x52
xchg byte [0x1407060f8], al
call fcn.1400955d0
int3

Function at 0x14008be00
Capabilities:
Encode data using xor

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x38
cmp qword [0x14078ff30], 0
jne 0x14008bf6a
movzx eax, byte [0x1407062e9]
cmp al, 0x9e
je 0x14008be69
mov cl, 0x54
nop word cs:[rax + rax]
mov al, 0xb4
lock cmpxchg byte [0x1407062e9], cl
je 0x14008be42
cmp al, 0x9e
jne 0x14008be30
jmp 0x14008be69
movq xmm0, qword [0x1407062e0]
paddb xmm0, xmmword [0x1405e75c0]
movq qword [0x1407062e0], xmm0
add byte [0x1407062e8], 0x77
mov al, 0x9e
xchg byte [0x1407062e9], al
movzx eax, byte [0x140706304]
cmp al, 0xbc
je 0x14008bf4a
mov cl, 0x20
nop word [rax + rax]
mov al, 0x1e
lock cmpxchg byte [0x140706304], cl
je 0x14008be95
cmp al, 0xbc
jne 0x14008be80
jmp 0x14008bf4a
mov eax, 0x5719af4a
mov ecx, 0xa8e650c8
mov edx, 1
mov r8d, 0x5719af4b
mov r9d, 0xa8e650c7
mov r10d, 0xaf286bcb
lea r11, [0x1407062f0]
lea rsi, [0x1405e7880]
nop word cs:[rax + rax]
mov edi, ecx
imul rdi, r10
shr rdi, 0x20
mov ebx, ecx
sub ebx, edi
shr ebx, 1
add ebx, edi
shr ebx, 4
lea edi, [rbx + rbx*8]
lea edi, [rbx + rdi*2]
add edi, eax
mov ebx, r9d
imul rbx, r10
shr rbx, 0x20
mov r14d, r9d
sub r14d, ebx
shr r14d, 1
add r14d, ebx
shr r14d, 4
lea ebx, [r14 + r14*8]
lea ebx, [r14 + rbx*2]
add ebx, r8d
movzx ebx, byte [rbx + rsi]
xor bl, 0x9c
add byte [rdx + r11 - 1], bl
movzx ebx, byte [rdi + rsi]
xor bl, 0x9c
add byte [rdx + r11], bl
add eax, 0xfffffffe
add ecx, 2
add rdx, 2
add r8d, 0xfffffffe
add r9d, 2
cmp rdx, 0x15
jne 0x14008bed0
mov al, 0xbc
xchg byte [0x140706304], al
lea rcx, [0x1407062e0]
lea r8, [0x1407062f0]
mov r9d, 0xa4db91e9
call fcn.1400a6ac0
mov qword [0x14078ff30], rax
add rsp, 0x38
pop rbx
pop rdi
pop rsi
pop r14
jmp qword [0x14078ff30]

Function at 0x140095840
Capabilities:
Read file on windows

Disassembly:
mov r9, r8
mov r8, rdx
mov edx, 1
jmp fcn.14057bde8
Function at 0x1400c3f00
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x28
movzx eax, byte [0x14070c148]
cmp al, 0xb8
je 0x1400c3f30
mov cl, 0x88
nop word cs:[rax + rax]
mov al, 0x44
lock cmpxchg byte [0x14070c148], cl
je 0x1400c3f35
cmp al, 0xb8
jne 0x1400c3f20
call fcn.1400c7570
mov ecx, 0xb707fde
xor r8d, r8d
movabs r9, 0xaaaaaaaaaaaaaaab
lea r10, [0x1405e9fd0]
lea r11, [0x14070c130]
nop word cs:[rax + rax]
mov rax, rcx
mul r9
shr rdx, 1
and rdx, 0xfffffffffffffff8
lea rax, [rdx + rdx*2]
mov rdx, r10
sub rdx, rax
movzx eax, byte [rdx + r8 + 0xb707fde]
movzx edx, byte [rdx + r8 + 0xb707fdf]
xor al, 0x38
add byte [r8 + r11], al
xor dl, 0x38
add byte [r8 + r11 + 1], dl
add r8, 2
add rcx, 2
cmp r8, 0x18
jne 0x1400c3f60
mov al, 0xb8
xchg byte [0x14070c148], al
call fcn.1400c7570
int3
Function at 0x1400d8ea0
Capabilities:
Encode data using xor

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x28
cmp qword [0x140790240], 0
jne 0x1400d8fda
movzx eax, byte [0x140712f59]
cmp al, 0xd2
je 0x1400d8f03
mov r10b, 0x5d
nop word cs:[rax + rax]
mov al, 0x20
lock cmpxchg byte [0x140712f59], r10b
je 0x1400d8ee3
cmp al, 0xd2
jne 0x1400d8ed0
jmp 0x1400d8f03
movabs rax, 0xdf788d40fc255c64
xor qword [0x140712f50], rax
xor byte [0x140712f58], 0xe6
mov al, 0xd2
xchg byte [0x140712f59], al
movzx eax, byte [0x140712f70]
cmp al, 0xc6
je 0x1400d8f97
mov r10b, 0x3a
nop word cs:[rax + rax]
mov al, 0x16
lock cmpxchg byte [0x140712f70], r10b
je 0x1400d8f33
cmp al, 0xc6
jne 0x1400d8f20
jmp 0x1400d8f97
mov eax, 0xa
lea r10, [0x140712f60]
lea r11, [0x1405ea320]
nop word cs:[rax + rax]
mov esi, eax
neg esi
and esi, 0xe
movzx ebx, byte [rax + r10 - 0xa]
xor bl, byte [rsi + r11]
movzx esi, byte [rax + r10 - 9]
xor bl, 0x94
mov byte [rax + r10 - 0xa], bl
mov edi, eax
and edi, 0xe
xor rdi, 0xf
xor sil, byte [rdi + r11]
xor sil, 0x94
mov byte [rax + r10 - 9], sil
add rax, 2
cmp rax, 0x1a
jne 0x1400d8f50
mov al, 0xc6
xchg byte [0x140712f70], al
mov rsi, rcx
mov rdi, rdx
mov rbx, r8
mov r14, r9
lea rcx, [0x140712f50]
call sub.KERNEL32.dll_LoadLibraryA
test rax, rax
je 0x1400d8fc5
lea rdx, [0x140712f60]
mov rcx, rax
call sub.KERNEL32.dll_GetProcAddress
jmp 0x1400d8fc7
xor eax, eax
mov r9, r14
mov r8, rbx
mov rdx, rdi
mov rcx, rsi
mov qword [0x140790240], rax
mov rax, qword [0x140790240]
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
jmp rax

Function at 0x1400d8ff0
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x20
cmp qword [0x140790248], 0
jne 0x1400d9126
movzx eax, byte [0x140712f89]
cmp al, 0x16
je 0x1400d9059
mov cl, 0xc5
nop word cs:[rax + rax]
mov al, 0xb
lock cmpxchg byte [0x140712f89], cl
je 0x1400d9032
cmp al, 0x16
jne 0x1400d9020
jmp 0x1400d9059
movq xmm0, qword [0x140712f80]
paddb xmm0, xmmword [0x1405ea2d0]
movq qword [0x140712f80], xmm0
add byte [0x140712f88], 0xa7
mov al, 0x16
xchg byte [0x140712f89], al
movzx eax, byte [0x140712fa2]
cmp al, 6
je 0x1400d90fb
mov cl, 0xc0
nop word [rax + rax]
mov al, 0xef
lock cmpxchg byte [0x140712fa2], cl
je 0x1400d9082
cmp al, 6
jne 0x1400d9070
jmp 0x1400d90fb
mov eax, 0x20a687ee
mov ecx, 0xdf597824
mov edx, 1
mov r8d, 0x20a687ef
mov r9d, 0xcccccccd
lea r10, [0x140712f90]
lea r11, [0x1405ea330]
nop dword [rax + rax]
mov esi, ecx
imul rsi, r9
shr rsi, 0x24
shl esi, 2
lea esi, [rsi + rsi*4]
lea edi, [rax + rsi]
add esi, r8d
movzx ebx, byte [rsi + r11]
xor bl, 4
add byte [rdx + r10 - 1], bl
movzx ebx, byte [rdi + r11]
xor bl, 4
add byte [rdx + r10], bl
add eax, 0xfffffffe
add ecx, 2
add rdx, 2
add r8d, 0xfffffffe
cmp rdx, 0x13
jne 0x1400d90b0
mov al, 6
xchg byte [0x140712fa2], al
lea rcx, [0x140712f80]
call sub.KERNEL32.dll_LoadLibraryA
test rax, rax
je 0x1400d911d
lea rdx, [0x140712f90]
mov rcx, rax
call sub.KERNEL32.dll_GetProcAddress
jmp 0x1400d911f
xor eax, eax
mov qword [0x140790248], rax
add rsp, 0x20
pop rbx
pop rdi
pop rsi
jmp qword [0x140790248]
Function at 0x1400d91c0
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x20
cmp qword [0x140790250], 0
jne 0x1400d93dc
movzx eax, byte [0x140712fb9]
cmp al, 0x20
je 0x1400d92a7
mov r8b, 0x7b
nop
mov al, 0xc3
lock cmpxchg byte [0x140712fb9], r8b
je 0x1400d9206
cmp al, 0x20
jne 0x1400d91f0
jmp 0x1400d92a7
xor byte [0x140712fb0], 0x51
mov dword [0x14071303c], 0x3ededd88
xor byte [0x140712fb1], 0xe7
mov dword [0x14071303c], 0x3ededd88
xor byte [0x140712fb2], 0x36
mov dword [0x14071303c], 0x3ededd88
xor byte [0x140712fb3], 0xaa
mov dword [0x14071303c], 0x3ededd88
xor byte [0x140712fb4], 0x26
mov dword [0x14071303c], 0x3ededd88
xor byte [0x140712fb5], 0x9f
mov dword [0x14071303c], 0x3ededd88
xor byte [0x140712fb6], 0xb6
mov dword [0x14071303c], 0x3ededd88
xor byte [0x140712fb7], 0xf9
mov dword [0x14071303c], 0x3ededd88
xor byte [0x140712fb8], 0xf3
mov dword [0x14071303c], 0x3ededd88
mov al, 0x20
xchg byte [0x140712fb9], al
movzx eax, byte [0x140712fd2]
cmp al, 0x33
je 0x1400d93a5
mov r8b, 0x59
nop dword [rax]
mov al, 0x25
lock cmpxchg byte [0x140712fd2], r8b
je 0x1400d92d6
cmp al, 0x33
jne 0x1400d92c0
jmp 0x1400d93a5
mov eax, 0x82eef3d4
mov r8d, 0x7d110c3e
mov r9d, 1
mov r10d, 0x82eef3d5
mov r11d, 0x7d110c3d
mov esi, 0xaf286bcb
lea rdi, [0x140712fc0]
lea rbx, [0x1405ea350]
nop word cs:[rax + rax]
mov r14d, r8d
imul r14, rsi
shr r14, 0x20
mov r15d, r8d
sub r15d, r14d
shr r15d, 1
add r15d, r14d
shr r15d, 4
lea r14d, [r15 + r15*8]
lea r14d, [r15 + r14*2]
add r14d, eax
mov r15d, r11d
imul r15, rsi
shr r15, 0x20
mov r12d, r11d
sub r12d, r15d
shr r12d, 1
add r12d, r15d
shr r12d, 4
lea r15d, [r12 + r12*8]
lea r15d, [r12 + r15*2]
add r15d, r10d
movzx ebp, byte [r9 + rdi - 1]
movzx r12d, byte [r9 + rdi]
xor bpl, byte [r15 + rbx]
xor bpl, 0x65
mov byte [r9 + rdi - 1], bpl
xor r12b, byte [r14 + rbx]
xor r12b, 0x65
mov byte [r9 + rdi], r12b
add eax, 0xfffffffe
add r8d, 2
add r9, 2
add r10d, 0xfffffffe
add r11d, 2
cmp r9, 0x13
jne 0x1400d9310
mov al, 0x33
xchg byte [0x140712fd2], al
mov rsi, rcx
mov rdi, rdx
lea rcx, [0x140712fb0]
call sub.KERNEL32.dll_LoadLibraryA
test rax, rax
je 0x1400d93cd
lea rdx, [0x140712fc0]
mov rcx, rax
call sub.KERNEL32.dll_GetProcAddress
jmp 0x1400d93cf
xor eax, eax
mov rdx, rdi
mov rcx, rsi
mov qword [0x140790250], rax
mov rax, qword [0x140790250]
add rsp, 0x20
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r14
pop r15
jmp rax
Function at 0x1400e7200
Capabilities:
Encode data using xor

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x28
movzx eax, byte [0x140713be0]
cmp al, 0x39
je 0x1400e7230
mov cl, 0x64
nop word cs:[rax + rax]
mov al, 0xa3
lock cmpxchg byte [0x140713be0], cl
je 0x1400e723c
cmp al, 0x39
jne 0x1400e7220
lea rcx, [0x140713bd0]
call fcn.140095530
mov r10d, 0xb6abf426
lea r11, [0x1405ea820]
mov esi, 0xb6abf427
add rsi, r11
lea rcx, [r10 + 1]
xor edi, edi
movabs rbx, 0xf0f0f0f0f0f0f0f1
lea r14, [0x140713bd0]
mov r8d, 0xb6abf426
nop
mov rax, rcx
mul rbx
mov r9, rdx
mov rax, r8
mul rbx
mov rax, rdx
shr rax, 4
and rdx, 0xfffffffffffffff0
add rdx, rax
mov rax, r11
sub rax, rdx
mov rdx, r9
shr rdx, 4
and r9, 0xfffffffffffffff0
add rax, rdi
movzx eax, byte [r10 + rax]
xor al, 2
add byte [rdi + r14], al
add r9, rdx
neg r9
movzx eax, byte [rsi + r9]
xor al, 2
add byte [rdi + r14 + 1], al
add rdi, 2
add rsi, 2
add rcx, 2
add r8, 2
cmp rdi, 0x10
jne 0x1400e7270
mov al, 0x39
xchg byte [0x140713be0], al
lea rcx, [0x140713bd0]
call fcn.140095530
int3
Function at 0x1401116e0
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x28
movzx eax, byte [0x140718410]
cmp al, 0xc
je 0x140111710
mov cl, 0x1d
nop word cs:[rax + rax]
mov al, 0x36
lock cmpxchg byte [0x140718410], cl
je 0x140111715
cmp al, 0xc
jne 0x140111700
call fcn.140113540
mov ecx, 0x5f09c9d2
xor r8d, r8d
movabs r9, 0xe38e38e38e38e38f
lea r10, [0x1405ec040]
lea r11, [0x140718400]
nop word cs:[rax + rax]
mov rax, rcx
mul r9
shr rdx, 3
and rdx, 0xfffffffffffffffe
lea rax, [rdx + rdx*8]
mov rdx, r10
sub rdx, rax
movzx eax, byte [rdx + r8 + 0x5f09c9d2]
movzx edx, byte [rdx + r8 + 0x5f09c9d3]
xor al, 0x21
add byte [r8 + r11], al
xor dl, 0x21
add byte [r8 + r11 + 1], dl
add r8, 2
add rcx, 2
cmp r8, 0x10
jne 0x140111740
mov al, 0xc
xchg byte [0x140718410], al
call fcn.140113540
int3
Function at 0x1401b9440
Capabilities:
Encode data using xor

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x58
lea rbp, [rsp + 0x50]
mov qword [rbp], 0xfffffffffffffffe
mov rdi, r8
mov rsi, rdx
mov r14, rcx
lea rax, [0x1405eb468]
mov qword [rbp - 0x28], rax
mov dword [rbp - 0x20], 0
xorps xmm0, xmm0
movups xmmword [rbp - 0x18], xmm0
mov byte [rbp - 8], 0
lea rcx, [rbp - 0x28]
call fcn.14011bde0
mov ebx, eax
test al, al
je 0x1401b9502
nop
cmp byte [0x140790498], 0
jne 0x1401b9540
movabs rax, 0x555555555555555
cmp qword [r14 + 0x48], rax
je 0x1401b9540
nop
mov r13, qword [rsi]
mov r15, qword [rdi + 0x30]
mov r12, qword [r14 + 0x40]
mov ecx, 0x30
call fcn.1400954c0
lea rcx, [0x1405ee4c8]
mov qword [rax + 0x10], rcx
mov qword [rax + 0x18], r15
mov qword [rax + 0x20], r13
mov qword [rax + 0x28], rsi
inc qword [r14 + 0x48]
mov rcx, qword [r12 + 8]
mov qword [rax], r12
mov qword [rax + 8], rcx
mov qword [r12 + 8], rax
mov qword [rcx], rax
mov rax, qword [rdi + 0x30]
mov qword [rsi], rax
jmp 0x1401b9513
mov r9d, 6
mov r8d, 0x72018f43
call fcn.1401b9dc0
lea rax, [0x1405eb468]
mov qword [rbp - 0x28], rax
cmp byte [rbp - 8], 0
je 0x1401b952d
lea rcx, [rbp - 0x28]
call fcn.1400f75e0
mov eax, ebx
add rsp, 0x58
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
nop
movzx eax, byte [0x140729e9e]
cmp al, 0x66
je 0x1401b9608
mov cl, 7
mov al, 0xa7
lock cmpxchg byte [0x140729e9e], cl
je 0x1401b9567
cmp al, 0x66
jne 0x1401b9552
jmp 0x1401b9608
lea rcx, [0x1405ee570]
lea r8, [rcx + 0xaa83294]
add rcx, 0xaa83293
mov r9d, 0xaa83294
mov r10d, 0xaa83292
movabs r11, 0x4924924924924925
lea rsi, [0x140729e90]
mov rax, r9
shr rax, 1
mul r11
shr rdx, 1
imul rdi, rdx, 0xfffffffffffffff2
mov rax, r10
shr rax, 1
mul r11
shr rdx, 1
imul rax, rdx, 0xfffffffffffffff2
movzx edx, byte [r9 + rsi - 0xaa83294]
xor dl, byte [rcx + rax]
movzx eax, byte [r9 + rsi - 0xaa83293]
xor dl, 0xa
xor al, byte [r8 + rdi]
mov byte [r9 + rsi - 0xaa83294], dl
xor al, 0xa
mov byte [r9 + rsi - 0xaa83293], al
add r8, 2
add r9, 2
add rcx, 2
add r10, 2
cmp r9, 0xaa832a2
jne 0x1401b9599
mov al, 0x66
xchg byte [0x140729e9e], al
lea rcx, [0x140729e90]
call fcn.140095530
int3
Function at 0x1401e4b80
Capabilities:
Encode data using xor

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x28
movzx eax, byte [0x14072b6e0]
cmp al, 0x47
je 0x1401e4bb0
mov cl, 0xca
nop word cs:[rax + rax]
mov al, 0x99
lock cmpxchg byte [0x14072b6e0], cl
je 0x1401e4bbc
cmp al, 0x47
jne 0x1401e4ba0
lea rcx, [0x14072b6d0]
call fcn.140095530
mov r10d, 0xa13671c0
lea r11, [0x1405eed60]
mov esi, 0xa13671c1
add rsi, r11
lea rcx, [r10 + 1]
xor edi, edi
movabs rbx, 0xf0f0f0f0f0f0f0f1
lea r14, [0x14072b6d0]
mov r8d, 0xa13671c0
nop
mov rax, rcx
mul rbx
mov r9, rdx
mov rax, r8
mul rbx
mov rax, rdx
shr rax, 4
and rdx, 0xfffffffffffffff0
add rdx, rax
mov rax, r11
sub rax, rdx
mov rdx, r9
shr rdx, 4
and r9, 0xfffffffffffffff0
add rax, rdi
movzx eax, byte [r10 + rax]
xor al, 0xf2
add byte [rdi + r14], al
add r9, rdx
neg r9
movzx eax, byte [rsi + r9]
xor al, 0xf2
add byte [rdi + r14 + 1], al
add rdi, 2
add rsi, 2
add rcx, 2
add r8, 2
cmp rdi, 0x10
jne 0x1401e4bf0
mov al, 0x47
xchg byte [0x14072b6e0], al
lea rcx, [0x14072b6d0]
call fcn.140095530
int3
Function at 0x14022b7f0
Capabilities:
Encode data using xor

Disassembly:
push rbp
push rsi
push rdi
push rbx
sub rsp, 0x48
lea rbp, [rsp + 0x40]
mov qword [rbp], 0xfffffffffffffffe
mov rsi, rdx
mov rdi, rcx
call fcn.140095670
mov qword [rdi + 8], 0
mov byte [rdi + 0x10], 0
mov qword [rdi + 0x18], 0
mov byte [rdi + 0x20], 0
mov qword [rdi + 0x28], 0
mov word [rdi + 0x30], 0
mov qword [rdi + 0x38], 0
mov word [rdi + 0x40], 0
mov qword [rdi + 0x48], 0
mov byte [rdi + 0x50], 0
mov qword [rdi + 0x58], 0
mov byte [rdi + 0x60], 0
test rsi, rsi
nop
mov qword [rbp - 8], rdi
je 0x14022b87e
mov rcx, rdi
mov rdx, rsi
call fcn.1400956b0
mov rax, qword [rbp - 8]
add rsp, 0x48
pop rbx
pop rdi
pop rsi
pop rbp
ret
nop
movzx eax, byte [0x1407313b0]
cmp al, 0xfa
je 0x14022b92f
mov cl, 0x52
mov al, pe_nt_image_headers64
lock cmpxchg byte [0x1407313b0], cl
je 0x14022b8a5
cmp al, 0xfa
jne 0x14022b890
jmp 0x14022b92f
lea r8, [0x1405f10c0]
mov r9d, 0xb170cceb
add r9, r8
mov r10d, 0xb170ccea
xor r11d, r11d
movabs rsi, 0xaaaaaaaaaaaaaaab
lea rdi, [0x1407313a0]
mov ecx, 0xb170ccea
nop word cs:[rax + rax]
mov rax, rcx
mul rsi
shr rdx, 1
and rdx, 0xfffffffffffffffc
lea rax, [rdx + rdx*2]
mov rdx, r9
sub rdx, rax
mov rbx, r8
sub rbx, rax
add rbx, r11
movzx eax, byte [r10 + rbx]
xor al, 0x20
add byte [r11 + rdi], al
movzx eax, byte [rdx]
xor al, 0x20
add byte [r11 + rdi + 1], al
add r11, 2
add r9, 2
add rcx, 2
cmp r11, 0x10
jne 0x14022b8e0
mov al, 0xfa
xchg byte [0x1407313b0], al
call fcn.140230dd0
int3
Function at 0x14022ead0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x38
mov rdi, r8
mov qword [rsp + 0x30], rcx
mov rax, qword [rdx]
and rax, 0xfffffffffffffffe
je 0x14022eb88
movzx ecx, byte [rdi]
lea r14, [rdi + 1]
mov r12d, ecx
shr r12d, 1
mov rdx, qword [rdi]
shr rdx, 1
test cl, 1
cmove r14, qword [rdi + 0x10]
cmove r12, rdx
xor r13d, r13d
xor r15d, r15d
jmp 0x14022eb74
nop
mov rdx, qword [rbx + 0x18]
mov rax, qword [rbx + 0x28]
shr rdx, 1
xor esi, esi
cmp r12, rdx
setb sil
cmovb rdx, r12
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x28], 0xea9522ea
mov rcx, r14
call fcn.1402341e0
xor ebp, ebp
test eax, eax
sets bpl
cmove ebp, esi
test bpl, bpl
cmove r15, rbx
mov eax, ebp
xor al, 1
movzx eax, al
mov rax, qword [rbx + rax*8 + 8]
inc r13
test rax, rax
je 0x14022eb94
mov rbx, rax
movzx edx, byte [rax + 0x18]
test dl, 1
je 0x14022eb20
lea rax, [rbx + 0x19]
shr edx, 1
jmp 0x14022eb2c
mov rbx, rdx
xor r15d, r15d
mov bpl, 1
xor r13d, r13d
mov rax, qword [rsp + 0xa8]
test rax, rax
je 0x14022eba5
nop
mov qword [rax], r13
test r15, r15
je 0x14022ec17
movzx r8d, byte [r15 + 0x18]
movzx edx, r8b
mov r9, qword [r15 + 0x28]
movzx eax, byte [rdi]
test al, 1
jne 0x14022ebca
mov rax, qword [rdi]
mov rdi, qword [rdi + 0x10]
shr rax, 1
jmp 0x14022ebcf
inc rdi
shr eax, 1
lea rcx, [r15 + 0x19]
shr edx, 1
mov r10, qword [r15 + 0x18]
shr r10, 1
test r8b, 1
cmove rcx, r9
cmove rdx, r10
xor esi, esi
cmp rdx, rax
setb sil
cmovae rdx, rax
mov qword [rsp + 0x20], rdi
mov dword [rsp + 0x28], 0xea9522ea
call fcn.1402341e0
xor ecx, ecx
test eax, eax
sets cl
cmovne esi, ecx
cmp sil, 1
jne 0x14022ec2b
nop
mov rax, qword [rsp + 0xa0]
mov byte [rax], bpl
mov qword [rax + 8], rbx
mov cl, 1
jmp 0x14022ec2d
xor ecx, ecx
mov rax, qword [rsp + 0x30]
mov qword [rax], r15
mov byte [rax + 8], cl
add rsp, 0x38
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x1402621a0
Capabilities:
Encode data using xor

Disassembly:
test ecx, ecx
je 0x1402621dc
test edx, edx
je 0x14026220c
movzx eax, byte [0x140734ffd]
cmp al, 0x6e
je 0x1402621d4
mov cl, 0xea
nop word cs:[rax + rax]
mov al, 0x6c
lock cmpxchg byte [0x140734ffd], cl
je 0x14026226c
cmp al, 0x6e
jne 0x1402621c0
lea rax, [0x140734ff0]
ret
test edx, edx
je 0x14026223c
movzx eax, byte [0x140734afd]
cmp al, 0x52
je 0x140262204
mov cl, 0xb7
nop dword [rax]
mov al, 0x17
lock cmpxchg byte [0x140734afd], cl
je 0x1402622a1
cmp al, 0x52
jne 0x1402621f0
lea rax, [0x140734ae0]
ret
movzx eax, byte [0x14073518a]
cmp al, 0xc5
je 0x140262234
mov cl, 0x18
nop dword [rax]
mov al, 8
lock cmpxchg byte [0x14073518a], cl
je 0x1402622e1
cmp al, 0xc5
jne 0x140262220
lea rax, [0x140735180]
ret
movzx eax, byte [0x140735043]
cmp al, 0x93
je 0x140262264
mov cl, 0x98
nop dword [rax]
mov al, 0xa3
lock cmpxchg byte [0x140735043], cl
je 0x140262321
cmp al, 0x93
jne 0x140262250
lea rax, [0x140735030]
ret
xor eax, eax
lea rcx, [0x140734ff0]
lea rdx, [0x1405f3520]
nop dword [rax]
movzx r8d, byte [rax + rdx]
xor byte [rax + rcx], r8b
inc rax
cmp eax, 0xd
jl 0x140262280
mov al, 0x6e
xchg byte [0x140734ffd], al
lea rax, [0x140734ff0]
ret
xor eax, eax
lea rcx, [0x140734ae0]
lea rdx, [0x1405f3040]
nop word cs:[rax + rax]
movzx r8d, byte [rax + rdx]
xor byte [rax + rcx], r8b
inc rax
cmp eax, 0x1d
jl 0x1402622c0
mov al, 0x52
xchg byte [0x140734afd], al
lea rax, [0x140734ae0]
ret
xor eax, eax
lea rcx, [0x140735180]
lea rdx, [0x1405f36b0]
nop word cs:[rax + rax]
movzx r8d, byte [rax + rdx]
xor byte [rax + rcx], r8b
inc rax
cmp eax, 0xa
jl 0x140262300
mov al, 0xc5
xchg byte [0x14073518a], al
lea rax, [0x140735180]
ret
xor eax, eax
lea rcx, [0x140735030]
lea rdx, [0x1405f3560]
nop word cs:[rax + rax]
movzx r8d, byte [rax + rdx]
xor byte [rax + rcx], r8b
inc rax
cmp eax, 0x13
jl 0x140262340
mov al, 0x93
xchg byte [0x140735043], al
lea rax, [0x140735030]
ret
Function at 0x14026aad0
Capabilities:
Encode data using xor

Disassembly:
test ecx, ecx
je 0x14026ab08
movzx eax, byte [0x140735f50]
cmp al, 0xf3
je 0x14026ab00
mov cl, 0xa
nop word cs:[rax + rax]
mov al, 0x28
lock cmpxchg byte [0x140735f50], cl
je 0x14026ab38
cmp al, 0xf3
jne 0x14026aaf0
lea rax, [0x140735f40]
ret
movzx eax, byte [0x140736056]
cmp al, 0xb0
je 0x14026ab30
mov cl, 0x19
nop word cs:[rax + rax]
mov al, 0xe
lock cmpxchg byte [0x140736056], cl
je 0x14026ab71
cmp al, 0xb0
jne 0x14026ab20
lea rax, [0x140736030]
ret
xor eax, eax
lea rcx, [0x140735f40]
lea rdx, [0x1405f4140]
nop dword [rax + rax]
movzx r8d, byte [rax + rdx]
xor byte [rax + rcx], r8b
inc rax
cmp eax, 0x10
jl 0x14026ab50
mov al, 0xf3
xchg byte [0x140735f50], al
lea rax, [0x140735f40]
ret
xor eax, eax
lea rcx, [0x140736030]
lea rdx, [0x1405f4220]
nop word cs:[rax + rax]
movzx r8d, byte [rax + rdx]
xor byte [rax + rcx], r8b
inc rax
cmp eax, 0x26
jl 0x14026ab90
mov al, 0xb0
xchg byte [0x140736056], al
lea rax, [0x140736030]
ret
Function at 0x14028be10
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbp
push rsi
sub rsp, 0x138
lea rbp, [rsp + 0x80]
mov qword [rbp + 0xb0], 0xfffffffffffffffe
mov rsi, rcx
nop
mov eax, dword [0x140790eb8]
mov ecx, dword [0x140793440]
mov rdx, qword gs:[0x58]
mov rcx, qword [rdx + rcx*8]
cmp eax, dword [rcx + 0x26838]
jg 0x14028bfc0
mov r8, qword [0x140790ea8]
cmp qword [rsi + 0x20], 0x10
jb 0x14028be69
mov rcx, qword [rsi + 8]
jmp 0x14028be6d
lea rcx, [rsi + 8]
xor eax, eax
test r8, r8
je 0x14028bfb6
nop
mov rdx, qword [rsi + 0x18]
test rdx, rdx
je 0x14028bfb6
nop
cmp qword [0x140790eb0], 0x10
jb 0x14028be9a
mov rax, qword [0x140790e98]
jmp 0x14028bea1
lea rax, [0x140790e98]
xorps xmm0, xmm0
movaps xmmword [rbp + 0xa0], xmm0
movaps xmmword [rbp + 0x90], xmm0
movaps xmmword [rbp + 0x80], xmm0
movaps xmmword [rbp + 0x70], xmm0
movaps xmmword [rbp + 0x60], xmm0
movaps xmmword [rbp + 0x50], xmm0
movaps xmmword [rbp + 0x40], xmm0
movaps xmmword [rbp + 0x30], xmm0
movaps xmmword [rbp + 0x20], xmm0
movaps xmmword [rbp + 0x10], xmm0
movaps xmmword [rbp], xmm0
movaps xmmword [rbp - 0x10], xmm0
movaps xmmword [rbp - 0x20], xmm0
movaps xmmword [rbp - 0x30], xmm0
movaps xmmword [rbp - 0x40], xmm0
movaps xmmword [rbp - 0x50], xmm0
mov r10, r8
and r10, 7
mov r9, rax
je 0x14028bf12
mov r9, rax
nop dword [rax]
movzx r11d, byte [r9]
mov byte [rbp + r11 - 0x50], 1
inc r9
dec r10
jne 0x14028bf00
cmp r8, 8
jb 0x14028bf80
add rax, r8
nop dword [rax + rax]
movzx r8d, byte [r9]
mov byte [rbp + r8 - 0x50], 1
movzx r8d, byte [r9 + 1]
mov byte [rbp + r8 - 0x50], 1
movzx r8d, byte [r9 + 2]
mov byte [rbp + r8 - 0x50], 1
movzx r8d, byte [r9 + 3]
mov byte [rbp + r8 - 0x50], 1
movzx r8d, byte [r9 + 4]
mov byte [rbp + r8 - 0x50], 1
movzx r8d, byte [r9 + 5]
mov byte [rbp + r8 - 0x50], 1
movzx r8d, byte [r9 + 6]
mov byte [rbp + r8 - 0x50], 1
movzx r8d, byte [r9 + 7]
mov byte [rbp + r8 - 0x50], 1
add r9, 8
cmp r9, rax
jne 0x14028bf20
test rdx, rdx
jle 0x14028bfac
add rdx, rcx
xor eax, eax
nop word [rax + rax]
movzx r8d, byte [rcx + rax]
cmp byte [rbp + r8 - 0x50], 0
jne 0x14028bfb0
lea r8, [rcx + rax]
inc r8
inc rax
cmp r8, rdx
jb 0x14028bf90
xor eax, eax
jmp 0x14028bfb6
test rax, rax
sete al
add rsp, 0x138
pop rsi
pop rbp
ret
nop
mov eax, dword [0x1407398a4]
mov r9d, 0xf4530ca4
xor r9, rax
lea r8, [0x140790eb8]
mov edx, 0xd4fc8b21
call fcn.140292090
cmp dword [0x140790eb8], 0xffffffff
jne 0x14028be55
lea rax, [0x140790e90]
mov qword [rsp + 0x28], rax
lea rax, [0x1405ec5c4]
mov qword [rsp + 0x20], rax
mov r8d, 0x2aaecc8a
call fcn.14028eb90
lea rcx, [0x14028cb70]
call fcn.140095250
lea rcx, [0x140790eb8]
call fcn.140095630
jmp 0x14028be55