joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14012be10
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x20], r9
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
mov eax, 0x50
call fcn.140189b00
sub rsp, rax
mov rbp, rdx
mov rdx, qword [rsp + 0xc0]
mov r10, r9
mov edi, dword [rdx]
mov rbx, r8
mov r12, rcx
test edi, edi
je 0x14012be7a
mov r14, qword [rsp + 0xb8]
nop
test rbx, rbx
je 0x14012be82
mov eax, edi
add edi, 1
add rbp, 1
movzx ecx, byte [rax + r14]
add r12, 1
sub rbx, 1
xor cl, byte [r12 - 1]
and edi, 0xf
mov byte [rbp - 1], cl
jne 0x14012be50
jmp 0x14012be82
mov r14, qword [rsp + 0xb8]
mov r9, qword [rsp + 0xc8]
mov r13d, reloc.WS2_32.dll_recv
mov qword [rsp + 0x48], r15
cmp rbx, r13
mov esi, 1
jb 0x14012bfae
mov rax, qword [rsp + 0xb0]
mov rcx, rbx
xor edi, edi
add rax, r13
shr rcx, 4
mov r14, rbp
mov qword [rsp + 0x30], rax
mov r15, r12
mov rax, rcx
mov dword [rsp + 0x20], edi
mov rdi, qword [rsp + 0xb8]
imul rax, rax, 0xfffffffffffffff0
add rbx, rax
mov rax, rcx
sub r14, rdi
shl rax, 4
sub r15, rdi
mov qword [rsp + 0xa0], rbx
mov rbx, qword [rsp + 0x30]
add rbp, rax
add r12, rax
mov qword [rsp + 0x90], r12
mov r12, qword [rsp + 0xb0]
mov qword [rsp + 0x98], rbp
mov rbp, rcx
mov r8, r10
mov rdx, rdi
mov rcx, r12
call r9
mov r11d, r13d
mov ecx, esi
mov rdx, rbx
nop
nop
nop
sub rdx, rsi
movzx eax, byte [rdx]
add ecx, eax
mov byte [rdx], cl
shr ecx, 8
add r11d, 0xffffffff
jne 0x14012bf30
mov rcx, rdi
lea edx, [r11 + 2]
nop
nop
mov rax, qword [r15 + rcx]
add rcx, 8
xor rax, qword [rcx - 8]
sub rdx, rsi
mov qword [r14 + rcx - 8], rax
jne 0x14012bf50
mov r9, qword [rsp + 0xc8]
mov r10, qword [rsp + 0xa8]
add r14, r13
add r15, r13
sub rbp, 1
jne 0x14012bf13
mov rbx, qword [rsp + 0xa0]
mov edi, dword [rsp + 0x20]
mov rbp, qword [rsp + 0x98]
mov r12, qword [rsp + 0x90]
mov r14, qword [rsp + 0xb8]
mov rdx, qword [rsp + 0xc0]
test rbx, rbx
je 0x14012c022
mov r15, qword [rsp + 0xb0]
mov r8, r10
mov rdx, r14
mov rcx, r15
call r9
lea rcx, [r15 + 0x10]
nop
nop
movzx eax, byte [rcx - 1]
sub rcx, 1
add esi, eax
mov byte [rcx], sil
shr esi, 8
add r13d, 0xffffffff
jne 0x14012bfd0
movsxd rcx, edi
sub r12, r14
sub rbp, r14
add rcx, r14
add edi, ebx
nop
nop
nop
movzx eax, byte [rcx + r12]
add rcx, 1
xor al, byte [rcx - 1]
sub rbx, 1
mov byte [rcx + rbp - 1], al
jne 0x14012c000
mov rax, qword [rsp + 0xc0]
mov dword [rax], edi
jmp 0x14012c024
mov dword [rdx], edi
mov r15, qword [rsp + 0x48]
add rsp, 0x50
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x14012c040
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x20], r9
push rbx
push rbp
push rsi
push rdi
push r12
push r14
push r15
mov eax, 0x40
call fcn.140189b00
sub rsp, rax
mov rbx, r8
mov r8, qword [rsp + 0xb0]
mov rsi, rdx
mov edi, dword [r8]
mov rbp, rcx
test edi, edi
mov dword [rsp + 0x30], edi
je 0x14012c0a9
mov rdx, qword [rsp + 0xa8]
test rbx, rbx
je 0x14012c0a5
mov eax, edi
add edi, 1
add rsi, 1
movzx ecx, byte [rax + rdx]
add rbp, 1
sub rbx, 1
xor cl, byte [rbp - 1]
and edi, 0xf
mov byte [rsi - 1], cl
jne 0x14012c080
mov dword [rsp + 0x30], edi
mov rdx, qword [rsp + 0xa0]
mov r10, qword [rsp + 0xb8]
mov r15d, reloc.WS2_32.dll_inet_ntoa
movzx eax, byte [rdx + 0xd]
movzx ecx, byte [rdx + 0xc]
lea r14, [rdx + 0xc]
shl ecx, 8
mov qword [rsp + 0x80], r13
lea r12d, [r15 - 0xb]
or ecx, eax
movzx eax, byte [rdx + 0xe]
shl ecx, 8
or ecx, eax
movzx eax, byte [rdx + 0xf]
shl ecx, 8
or ecx, eax
cmp rbx, 0x10
mov dword [rsp + 0x90], ecx
jb 0x14012c1da
mov eax, 0x10000000
mov rdi, rdx
nop
nop
nop
mov r13, rbx
shr r13, 4
cmp r13, rax
cmova r13, rax
add ecx, r13d
mov eax, ecx
mov dword [rsp + 0x90], ecx
cmp rax, r13
jae 0x14012c13b
sub r13, rax
xor ecx, ecx
mov dword [rsp + 0x90], ecx
mov r8, r13
mov rdx, rsi
mov rcx, rbp
mov qword [rsp + 0x20], rdi
call r10
mov ecx, dword [rsp + 0x90]
mov eax, ecx
mov r11d, ecx
mov byte [rdi + 0xf], cl
shr eax, 0x10
shr r11d, 0x18
mov byte [rdi + 0xd], al
mov eax, ecx
mov byte [r14], r11b
shr eax, 8
test ecx, ecx
mov byte [rdi + 0xe], al
jne 0x14012c19a
mov r8d, r15d
mov ecx, r12d
mov rdx, r14
nop
sub rdx, r12
movzx eax, byte [rdx]
add ecx, eax
mov byte [rdx], cl
shr ecx, 8
add r8d, 0xffffffff
jne 0x14012c180
mov ecx, dword [rsp + 0x90]
mov r9, qword [rsp + 0x98]
mov r10, qword [rsp + 0xb8]
shl r13, 4
sub rbx, r13
add rsi, r13
add rbp, r13
cmp rbx, 0x10
mov eax, 0x10000000
jae 0x14012c110
mov edi, dword [rsp + 0x30]
mov r8, qword [rsp + 0xb0]
mov rdx, qword [rsp + 0xa0]
test rbx, rbx
je 0x14012c291
mov r13, qword [rsp + 0xa8]
xor eax, eax
mov qword [rsp + 0x20], rdx
mov qword [r13], rax
mov rdx, r13
mov rcx, r13
mov r8, r12
mov qword [r13 + 8], rax
call r10
mov rdx, qword [rsp + 0xa0]
mov ecx, dword [rsp + 0x90]
add ecx, r12d
mov eax, ecx
mov byte [rdx + 0xf], cl
shr eax, 0x18
mov byte [r14], al
mov eax, ecx
shr eax, 0x10
mov byte [rdx + 0xd], al
mov eax, ecx
shr eax, 8
test ecx, ecx
mov byte [rdx + 0xe], al
jne 0x14012c259
nop
nop
nop
movzx eax, byte [r14 - 1]
sub r14, 1
add r12d, eax
mov byte [r14], r12b
shr r12d, 8
add r15d, 0xffffffff
jne 0x14012c240
movsxd rcx, edi
sub rbp, r13
sub rsi, r13
add rcx, r13
add edi, ebx
nop
nop
nop
movzx eax, byte [rcx + rbp]
add rcx, 1
xor al, byte [rcx - 1]
sub rbx, 1
mov byte [rsi + rcx - 1], al
jne 0x14012c270
mov rax, qword [rsp + 0xb0]
mov dword [rax], edi
jmp 0x14012c294
mov dword [r8], edi
mov r13, qword [rsp + 0x80]
add rsp, 0x40
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x14012c940
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rbp
push rdi
mov eax, reloc.WLDAP32.dll_Ordinal_32
call fcn.140189b00
sub rsp, rax
xor eax, eax
cmp r8, 0xc
mov rbp, r8
mov rdi, rdx
mov rbx, rcx
mov qword [rcx], rax
mov qword [rcx + 8], rax
mov qword [rcx + 0x40], rax
mov qword [rcx + 0x48], rax
mov qword [rcx + 0x30], rax
mov qword [rcx + 0x38], rax
mov dword [rcx + 0x174], eax
mov dword [rcx + 0x170], eax
jne 0x14012c99e
mov rax, qword [rdx]
lea edi, [r8 - 0xb]
mov qword [rcx], rax
mov eax, dword [rdx + 8]
mov byte [rcx + 0xf], 1
mov dword [rcx + 8], eax
jmp 0x14012cafb
cmp r8, 0x10
mov qword [rsp + 0x58], r14
mov r14, r8
jb 0x14012ca43
mov qword [rsp + 0x40], rsi
mov qword [rsp + 0x48], r12
mov r12, r8
shr r12, 4
mov rsi, rdx
mov qword [rsp + 0x50], r13
mov rax, r12
sub rsi, rcx
imul rax, rax, 0xfffffffffffffff0
add rbp, rax
nop
nop
nop
lea rdx, [rdi + 2]
mov rcx, rbx
mov r8d, 4
nop
movzx eax, byte [rsi + rcx]
add rcx, 4
add rdx, 4
xor byte [rcx - 4], al
movzx eax, byte [rdx - 5]
xor byte [rcx - 3], al
movzx eax, byte [rdx - 4]
xor byte [rcx - 2], al
movzx eax, byte [rdx - 3]
xor byte [rcx - 1], al
sub r8, 1
jne 0x14012c9f0
lea rdx, [rbx + 0x60]
mov rcx, rbx
call fcn.14012c530
add rdi, 0x10
add rsi, 0x10
sub r12, 1
jne 0x14012c9e0
mov r13, qword [rsp + 0x50]
mov r12, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x40]
test rbp, rbp
je 0x14012ca7d
test rbp, rbp
je 0x14012ca71
mov rcx, rbx
sub rdi, rbx
nop
nop
nop
nop
movzx eax, byte [rcx + rdi]
add rcx, 1
xor byte [rcx - 1], al
sub rbp, 1
jne 0x14012ca60
lea rdx, [rbx + 0x60]
mov rcx, rbx
call fcn.14012c530
shl r14, 3
lea rdx, [rbx + 0x60]
mov rcx, rbx
xor byte [rbx + 0xf], r14b
mov rax, r14
shr rax, 0x38
xor byte [rbx + 8], al
mov rax, r14
shr rax, 0x30
xor byte [rbx + 9], al
mov rax, r14
shr rax, 0x28
xor byte [rbx + 0xa], al
mov rax, r14
shr rax, 0x20
xor byte [rbx + 0xb], al
mov rax, r14
shr rax, 0x18
xor byte [rbx + 0xc], al
mov rax, r14
shr rax, 0x10
xor byte [rbx + 0xd], al
mov rax, r14
shr rax, 8
xor byte [rbx + 0xe], al
call fcn.14012c530
movzx eax, byte [rbx + 0xd]
movzx edi, byte [rbx + 0xc]
mov r14, qword [rsp + 0x58]
shl edi, 8
or edi, eax
movzx eax, byte [rbx + 0xe]
shl edi, 8
or edi, eax
movzx eax, byte [rbx + 0xf]
shl edi, 8
or edi, eax
mov r8, qword [rbx + 0x180]
lea rdx, [rbx + 0x20]
mov rcx, rbx
call qword [rbx + 0x178]
add edi, 1
mov eax, edi
mov byte [rbx + 0xf], dil
shr eax, 0x18
mov byte [rbx + 0xc], al
mov eax, edi
shr eax, 0x10
mov byte [rbx + 0xd], al
mov eax, edi
shr eax, 8
mov byte [rbx + 0xe], al
add rsp, 0x20
pop rdi
pop rbp
pop rbx
ret
Function at 0x14012cb40
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rdi
mov eax, reloc.WLDAP32.dll_Ordinal_32
call fcn.140189b00
sub rsp, rax
cmp qword [rcx + 0x38], 0
mov rbx, r8
mov rbp, rdx
mov rdi, rcx
je 0x14012cb7d
mov eax, 0xfffffffe
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret
mov rax, qword [rcx + 0x30]
lea rcx, [r8 + rax]
movabs rax, 0x2000000000000000
cmp rcx, rax
ja 0x14012cc4e
cmp rcx, rbx
jb 0x14012cc4e
mov qword [rsp + 0x30], rsi
mov esi, dword [rdi + 0x174]
mov qword [rdi + 0x30], rcx
test esi, esi
je 0x14012cbe6
test rbx, rbx
je 0x14012cbd5
movzx eax, byte [rbp]
mov ecx, esi
add esi, 1
xor byte [rcx + rdi + 0x40], al
add rbp, 1
sub rbx, 1
and esi, 0xf
jne 0x14012cbb4
jmp 0x14012cbd9
test esi, esi
jne 0x14012cc31
lea rdx, [rdi + 0x60]
lea rcx, [rdi + 0x40]
call fcn.14012c530
mov qword [rsp + 0x38], r12
mov r12, rbx
and r12, 0xfffffffffffffff0
je 0x14012cc0d
lea rdx, [rdi + 0x60]
lea rcx, [rdi + 0x40]
mov r9, r12
mov r8, rbp
call fcn.14012c680
add rbp, r12
sub rbx, r12
test rbx, rbx
mov r12, qword [rsp + 0x38]
je 0x14012cc31
xor ecx, ecx
test rbx, rbx
mov esi, ebx
je 0x14012cc31
movzx eax, byte [rcx + rbp]
add rcx, 1
xor byte [rdi + rcx + 0x3f], al
cmp rcx, rbx
jb 0x14012cc20
mov dword [rdi + 0x174], esi
mov rsi, qword [rsp + 0x30]
xor eax, eax
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
or eax, 0xffffffff
add rsp, 0x20
pop rdi
ret
Function at 0x14012e510
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov eax, 0x68
call fcn.140189b00
sub rsp, rax
mov rax, qword [0x1401f3660]
xor rax, rsp
mov qword [rsp + 0x58], rax
movzx edi, byte [rcx]
mov rax, qword [rcx + 0x28]
mov r12, qword [rsp + 0xd0]
test dil, 0x40
mov rsi, r9
mov r9, qword [rcx + 0x30]
mov r15, r8
mov r13, rdx
mov rbx, rcx
mov qword [rsp + 0x38], r9
mov byte [rsp + 0x30], dil
mov qword [rsp + 0x40], rax
jne 0x14012e580
lea rdx, [rcx + 0x10]
mov r8, r9
call rax
add qword [rbx + 0x20], 1
mov r9, qword [rsp + 0x38]
mov al, dil
mov r8d, reloc.WS2_32.dll_ntohs
xor ebp, ebp
and eax, 7
mov r14d, r8d
mov rcx, rbp
sub r14d, eax
mov byte [rbx], al
cmp r14d, r8d
movsxd rax, r14d
jae 0x14012e5c7
lea rdx, [rax + rbx]
sub r8d, r14d
nop
nop
movzx eax, byte [rdx]
mov byte [rdx], bpl
add rdx, 1
or rcx, rax
shl rcx, 8
sub r8, 1
jne 0x14012e5b0
movzx eax, byte [rbx + 0xf]
mov byte [rbx + 0xf], 1
or rcx, rax
cmp rcx, rsi
je 0x14012e5df
or eax, 0xffffffff
jmp 0x14012e76d
lea rax, [rsi + 0xf]
or rax, 8
shr rax, 3
add qword [rbx + 0x20], rax
movabs rax, 0x2000000000000000
cmp qword [rbx + 0x20], rax
jbe 0x14012e609
mov eax, 0xfffffffe
jmp 0x14012e76d
mov rdi, rsi
shr rdi, 4
je 0x14012e680
lea rax, [rbx + 0x10]
mov r8, rdi
mov rdx, r15
mov qword [rsp + 0x28], rax
mov rcx, r13
mov qword [rsp + 0x20], rbx
call r12
shl rdi, 4
add r13, rdi
add r15, rdi
sub rsi, rdi
je 0x14012e71e
shr rdi, 4
mov r8d, 8
mov rdx, rbp
nop
movzx eax, byte [r8 + rbx + 7]
sub r8, 1
movzx ecx, dil
add rdx, rax
shr rdi, 8
add rdx, rcx
mov byte [r8 + rbx + 8], dl
shr rdx, 8
test r8, r8
je 0x14012e680
test rdi, rdi
jne 0x14012e650
test rdx, rdx
jne 0x14012e650
test rsi, rsi
je 0x14012e71e
mov edx, ebp
lea rcx, [rbx + 0x10]
mov r8, r13
nop
nop
nop
nop
movzx eax, byte [r8]
add edx, 1
add r8, 1
xor byte [rcx], al
mov eax, edx
add rcx, 1
cmp rax, rsi
jb 0x14012e6a0
mov rdi, qword [rsp + 0x38]
mov r12, qword [rsp + 0x40]
lea rcx, [rbx + 0x10]
mov r8, rdi
mov rdx, rcx
call r12
lea rdx, [rsp + 0x48]
mov r8, rdi
mov rcx, rbx
call r12
test rsi, rsi
je 0x14012e728
lea rax, [rsp + 0x48]
lea rcx, [rsp + 0x48]
sub r13, rax
lea rax, [rsp + 0x48]
sub r15, rax
nop
nop
nop
movzx eax, byte [r13 + rcx]
add ebp, 1
add rcx, 1
xor al, byte [rcx - 1]
mov byte [r15 + rcx - 1], al
mov eax, ebp
cmp rax, rsi
jb 0x14012e700
jmp 0x14012e728
mov r12, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x38]
cmp r14d, 0x10
movsxd rax, r14d
jae 0x14012e745
mov r8d, reloc.WS2_32.dll_recv
lea rcx, [rax + rbx]
xor edx, edx
sub r8d, r14d
call fcn.140041940
lea rdx, [rsp + 0x48]
mov r8, rdi
mov rcx, rbx
call r12
mov rax, qword [rsp + 0x48]
xor qword [rbx + 0x10], rax
mov rax, qword [rsp + 0x50]
xor qword [rbx + 0x18], rax
mov al, byte [rsp + 0x30]
mov byte [rbx], al
xor eax, eax
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.140041910
add rsp, 0x68
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x14012e790
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov eax, 0x68
call fcn.140189b00
sub rsp, rax
mov rax, qword [0x1401f3660]
xor rax, rsp
mov qword [rsp + 0x58], rax
movzx edi, byte [rcx]
mov rax, qword [rcx + 0x28]
mov r13, qword [rsp + 0xd0]
test dil, 0x40
mov r14, qword [rcx + 0x30]
mov rbp, r9
mov r10, r8
mov qword [rsp + 0x38], r8
mov r15, rdx
mov rbx, rcx
mov byte [rsp + 0x30], dil
mov qword [rsp + 0x40], rax
jne 0x14012e7fb
lea rdx, [rcx + 0x10]
mov r8, r14
call rax
mov r10, qword [rsp + 0x38]
mov al, dil
mov r8d, reloc.WS2_32.dll_ntohs
xor esi, esi
and eax, 7
mov r12d, r8d
mov rcx, rsi
sub r12d, eax
mov byte [rbx], al
cmp r12d, r8d
movsxd rax, r12d
jae 0x14012e83a
lea rdx, [rax + rbx]
sub r8d, r12d
movzx eax, byte [rdx]
mov byte [rdx], sil
add rdx, 1
or rcx, rax
shl rcx, 8
sub r8, 1
jne 0x14012e823
movzx eax, byte [rbx + 0xf]
mov byte [rbx + 0xf], 1
or rcx, rax
cmp rcx, rbp
je 0x14012e852
or eax, 0xffffffff
jmp 0x14012e989
mov rdi, rbp
shr rdi, 4
je 0x14012e8d2
lea rax, [rbx + 0x10]
mov r9, r14
mov r8, rdi
mov qword [rsp + 0x28], rax
mov rdx, r10
mov rcx, r15
mov qword [rsp + 0x20], rbx
call r13
mov r13, qword [rsp + 0x38]
shl rdi, 4
add r13, rdi
add r15, rdi
sub rbp, rdi
je 0x14012e940
shr rdi, 4
mov r8d, 8
mov rdx, rsi
nop
movzx eax, byte [r8 + rbx + 7]
sub r8, 1
movzx ecx, dil
add rdx, rax
shr rdi, 8
add rdx, rcx
mov byte [r8 + rbx + 8], dl
shr rdx, 8
test r8, r8
je 0x14012e8d7
test rdi, rdi
jne 0x14012e8a0
test rdx, rdx
jne 0x14012e8a0
jmp 0x14012e8d7
mov r13, qword [rsp + 0x38]
test rbp, rbp
mov rdi, qword [rsp + 0x40]
je 0x14012e945
lea rdx, [rsp + 0x48]
mov r8, r14
mov rcx, rbx
call rdi
test rbp, rbp
je 0x14012e932
lea rax, [rsp + 0x48]
lea rdx, [rbx + 0x10]
lea rcx, [rsp + 0x48]
sub r15, rax
lea rax, [rsp + 0x48]
sub r13, rax
nop
movzx eax, byte [r15 + rcx]
add esi, 1
add rcx, 1
xor al, byte [rcx - 1]
add rdx, 1
mov byte [r13 + rcx - 1], al
xor byte [rdx - 1], al
mov eax, esi
cmp rax, rbp
jb 0x14012e910
lea rcx, [rbx + 0x10]
mov r8, r14
mov rdx, rcx
call rdi
jmp 0x14012e945
mov rdi, qword [rsp + 0x40]
cmp r12d, 0x10
movsxd rax, r12d
jae 0x14012e962
mov r8d, reloc.WS2_32.dll_recv
lea rcx, [rax + rbx]
xor edx, edx
sub r8d, r12d
call fcn.140041940
lea rdx, [rsp + 0x48]
mov r8, r14
mov rcx, rbx
call rdi
mov rax, qword [rsp + 0x48]
xor qword [rbx + 0x10], rax
mov rax, qword [rsp + 0x50]
xor qword [rbx + 0x18], rax
mov al, byte [rsp + 0x30]
mov byte [rbx], al
xor eax, eax
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.140041910
add rsp, 0x68
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x14012fa90
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov eax, 0x40
call fcn.140189b00
sub rsp, rax
mov rax, qword [0x1401f3660]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0xa0]
mov r14, qword [rsp + 0xa8]
mov rbp, rcx
movzx r10d, byte [rax]
mov ebx, dword [r14]
lea rdi, [rax + 1]
movzx ecx, byte [rdi + 6]
mov qword [rsp + 0x28], rax
movzx eax, byte [rdi]
shl eax, 8
mov r12, rdx
movzx edx, byte [rdi + 3]
or r10d, eax
movzx eax, byte [rdi + 1]
shl ecx, 8
shl eax, 0x10
mov r15, r9
lea r9, [rdi + 5]
or r10d, eax
movzx eax, byte [rdi + 2]
xor r13d, r13d
shl eax, 0x18
mov esi, r8d
or r10d, eax
movzx eax, byte [rdi + 4]
shl eax, 8
mov dword [rsp + 0x20], r10d
mov byte [rsp + 0x30], r10b
or edx, eax
movzx eax, byte [r9]
or ecx, eax
mov eax, r10d
shr eax, 8
shl ecx, 0x10
mov byte [rsp + 0x31], al
or edx, ecx
mov eax, r10d
shr eax, 0x10
mov dword [rsp + 0x24], edx
mov byte [rsp + 0x34], dl
mov byte [rsp + 0x32], al
mov eax, r10d
shr eax, 0x18
mov byte [rsp + 0x33], al
mov eax, edx
shr eax, 8
mov byte [rsp + 0x35], al
mov eax, edx
shr eax, 0x10
mov byte [rsp + 0x36], al
mov eax, edx
shr eax, 0x18
test r8d, r8d
mov byte [rsp + 0x37], al
je 0x14012fc5b
movzx r8d, dl
movzx r9d, r10b
sub esi, 1
test ebx, ebx
jne 0x14012fbf5
lea rcx, [rsp + 0x20]
mov rdx, r15
call fcn.14012ed00
mov r10d, dword [rsp + 0x20]
mov edx, dword [rsp + 0x24]
mov r9b, byte [rsp + 0x20]
mov r8b, byte [rsp + 0x24]
mov eax, r10d
shr eax, 8
mov byte [rsp + 0x30], r9b
mov byte [rsp + 0x34], r8b
mov byte [rsp + 0x31], al
mov eax, r10d
shr eax, 0x10
mov byte [rsp + 0x32], al
mov eax, r10d
shr eax, 0x18
mov byte [rsp + 0x33], al
mov eax, edx
shr eax, 8
mov byte [rsp + 0x35], al
mov eax, edx
shr eax, 0x10
mov byte [rsp + 0x36], al
mov eax, edx
shr eax, 0x18
add r13d, 1
mov byte [rsp + 0x37], al
movsxd rax, ebx
add ebx, 1
add r12, 1
movzx ecx, byte [rsp + rax + 0x30]
add rbp, 1
and ebx, 7
xor cl, byte [rbp - 1]
test esi, esi
mov byte [r12 - 1], cl
jne 0x14012fb87
test r13d, r13d
je 0x14012fc5b
mov rax, qword [rsp + 0x28]
mov byte [rax], r9b
mov eax, r10d
shr eax, 8
mov byte [rdi], al
mov eax, r10d
shr r10d, 0x18
shr eax, 0x10
mov byte [rdi + 1], al
mov byte [rdi + 2], r10b
mov byte [rdi + 3], r8b
mov eax, edx
shr eax, 8
mov byte [rdi + 4], al
mov eax, edx
shr eax, 0x10
shr edx, 0x18
mov byte [rdi + 5], al
mov byte [rdi + 6], dl
mov dword [r14], ebx
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.140041910
mov rbx, qword [rsp + 0x80]
add rsp, 0x40
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x14012fc90
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
mov eax, r9d
mov r9d, 0x80
mov r11, r8
cmp edx, r9d
mov r10, rcx
mov byte [rcx], 0
cmovg edx, r9d
test eax, eax
mov ebx, 0x400
jle 0x14012fcbe
cmp eax, ebx
cmovg eax, ebx
mov ebx, eax
movsxd rdx, edx
test rdx, rdx
jle 0x14012fce2
sub r11, r10
mov r8, rdx
nop
movzx eax, byte [r11 + rcx]
add rcx, 1
sub r8, 1
mov byte [rcx - 1], al
jne 0x14012fcd0
cmp rdx, r9
movzx ecx, byte [rdx + r10 - 1]
lea r11, [0x1401be990]
jge 0x14012fd1c
mov r8, r10
sub r8, rdx
nop
nop
mov al, byte [r8 + rdx]
add rdx, 1
add eax, ecx
cmp rdx, r9
movzx ecx, al
movzx ecx, byte [rcx + r11]
mov byte [rdx + r10 - 1], cl
jl 0x14012fd00
lea edx, [rbx + 7]
neg ebx
mov eax, 0xff
sar edx, 3
and ebx, 7
sub r9d, edx
movzx ecx, bl
sar eax, cl
movsxd r8, r9d
movsxd r9, edx
mov ecx, eax
movzx eax, byte [r8 + r10]
and rcx, rax
test r8, r8
movzx eax, byte [rcx + r11]
mov byte [r8 + r10], al
je 0x14012fd7a
lea rdx, [r8 + r10]
nop
nop
nop
movzx ecx, byte [rdx + r9 - 1]
sub rdx, 1
xor rcx, rax
sub r8, 1
movzx eax, byte [rcx + r11]
mov byte [rdx], al
jne 0x14012fd60
lea r8, [r10 + 0xfc]
lea rdx, [r10 + 0x7e]
mov r9d, 0x40
nop
nop
movzx eax, byte [rdx]
movzx ecx, byte [rdx + 1]
sub r8, 4
shl ecx, 8
sub rdx, 2
or ecx, eax
sub r9, 1
movzx eax, cx
mov dword [r8 + 4], eax
jne 0x14012fd90
mov rbx, qword [rsp + 8]
ret
Function at 0x140131480
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov eax, 0x40
call fcn.140189b00
sub rsp, rax
mov rax, qword [0x1401f3660]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0xa0]
mov r14, qword [rsp + 0xa8]
mov esi, r8d
movzx r10d, byte [rax]
movzx r8d, byte [rax + 4]
mov ebx, dword [r14]
lea rdi, [rax + 1]
mov qword [rsp + 0x28], rax
shl r10d, 0x18
movzx eax, byte [rdi]
mov rbp, rcx
movzx ecx, byte [rdi + 5]
shl eax, 0x10
shl r8d, 0x18
shl ecx, 8
or r10d, eax
movzx eax, byte [rdi + 1]
mov r12, rdx
shl eax, 8
lea rdx, [rdi + 5]
xor r13d, r13d
or r10d, eax
movzx eax, byte [rdi + 2]
mov r15, r9
or r10d, eax
movzx eax, byte [rdi + 4]
shl eax, 0x10
mov dword [rsp + 0x20], r10d
mov byte [rsp + 0x33], r10b
or r8d, eax
movzx eax, byte [rdx + 1]
or ecx, eax
mov eax, r10d
shr eax, 0x18
or r8d, ecx
mov byte [rsp + 0x30], al
mov eax, r10d
mov dword [rsp + 0x24], r8d
shr eax, 0x10
mov byte [rsp + 0x37], r8b
mov byte [rsp + 0x31], al
mov eax, r10d
shr eax, 8
mov byte [rsp + 0x32], al
mov eax, r8d
shr eax, 0x18
mov byte [rsp + 0x34], al
mov eax, r8d
shr eax, 0x10
mov byte [rsp + 0x35], al
mov eax, r8d
shr eax, 8
test esi, esi
mov byte [rsp + 0x36], al
je 0x140131656
movzx edx, r8b
movzx r9d, r10b
sub esi, 1
test ebx, ebx
jne 0x1401315ed
lea rcx, [rsp + 0x20]
mov rdx, r15
call fcn.1401306d0
mov r10d, dword [rsp + 0x20]
mov r8d, dword [rsp + 0x24]
mov eax, r10d
mov dl, r8b
mov r9b, r10b
shr eax, 0x18
mov byte [rsp + 0x33], r10b
mov byte [rsp + 0x37], dl
mov byte [rsp + 0x30], al
mov eax, r10d
shr eax, 0x10
mov byte [rsp + 0x31], al
mov eax, r10d
shr eax, 8
mov byte [rsp + 0x32], al
mov eax, r8d
shr eax, 0x18
mov byte [rsp + 0x34], al
mov eax, r8d
shr eax, 0x10
mov byte [rsp + 0x35], al
mov eax, r8d
shr eax, 8
add r13d, 1
mov byte [rsp + 0x36], al
movsxd rax, ebx
add ebx, 1
add r12, 1
movzx ecx, byte [rsp + rax + 0x30]
add rbp, 1
and ebx, 7
xor cl, byte [rbp - 1]
test esi, esi
mov byte [r12 - 1], cl
jne 0x140131580
test r13d, r13d
je 0x140131656
mov rcx, qword [rsp + 0x28]
mov eax, r10d
shr eax, 0x18
mov byte [rcx], al
mov eax, r10d
shr r10d, 8
shr eax, 0x10
mov byte [rdi], al
mov byte [rdi + 1], r10b
mov byte [rdi + 2], r9b
mov eax, r8d
shr eax, 0x18
mov byte [rdi + 3], al
mov eax, r8d
shr eax, 0x10
shr r8d, 8
mov byte [rdi + 4], al
mov byte [rdi + 5], r8b
mov byte [rdi + 6], dl
mov dword [r14], ebx
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.140041910
mov rbx, qword [rsp + 0x80]
add rsp, 0x40
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret