joyce8/EMBER2024-capa huggingface dataset:
Function at 0x29e85b863f0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x20], r9
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r15
sub rsp, 0x40
mov r15, qword [rsp + 0xb0]
mov rbp, rdx
mov rdx, qword [rsp + 0xa8]
mov ebx, dword [r15]
mov r10, r9
mov rdi, r8
mov r12, rcx
test ebx, ebx
je 0x29e85b86449
test rdi, rdi
je 0x29e85b86449
mov eax, ebx
inc rbp
inc r12
movzx ecx, byte [rax + rdx]
dec rdi
xor cl, byte [r12 - 1]
inc ebx
mov byte [rbp - 1], cl
and ebx, 0xf
jne 0x29e85b86426
mov r9, qword [rsp + 0xb8]
mov r13, qword [rsp + 0xa0]
mov esi, 0x10
mov qword [rsp + 0x38], r14
cmp rdi, rsi
jb 0x29e85b86544
mov rcx, rdi
mov r14, rbp
mov r15, r12
shr rcx, 4
sub r14, rdx
sub r15, rdx
imul rax, rcx, 0xfffffffffffffff0
add rdi, rax
mov rax, rcx
shl rax, 4
mov qword [rsp + 0x90], rdi
mov rdi, qword [rsp + 0x98]
add rbp, rax
add r12, rax
mov qword [rsp + 0x80], r12
mov qword [rsp + 0x88], rbp
mov rbp, qword [rsp + 0xa8]
mov r12, rcx
nop
mov r8, rdi
mov rdx, rbp
mov rcx, r13
call r9
mov edx, esi
nop
dec edx
inc byte [rdx + r13]
jne 0x29e85b864dc
test edx, edx
jne 0x29e85b864d0
cmp ebx, esi
jae 0x29e85b86507
mov edx, 0xf
mov eax, ebx
sub edx, ebx
add rax, rbp
shr edx, 3
inc edx
mov rcx, qword [r15 + rax]
lea rax, [rax + 8]
xor rcx, qword [rax - 8]
mov qword [r14 + rax - 8], rcx
dec rdx
jne 0x29e85b864f1
mov r9, qword [rsp + 0xb8]
add r14, rsi
add r15, rsi
xor ebx, ebx
dec r12
jne 0x29e85b864c0
mov rdi, qword [rsp + 0x90]
mov rbp, qword [rsp + 0x88]
mov r12, qword [rsp + 0x80]
mov r10, qword [rsp + 0x98]
mov r15, qword [rsp + 0xb0]
test rdi, rdi
je 0x29e85b86585
mov r14, qword [rsp + 0xa8]
mov r8, r10
mov rcx, r13
mov rdx, r14
call r9
nop dword [rax]
dec esi
inc byte [rsi + r13]
jne 0x29e85b86570
test esi, esi
jne 0x29e85b86560
nop dword [rax]
mov ecx, ebx
inc ebx
movzx eax, byte [rcx + r12]
xor al, byte [rcx + r14]
mov byte [rcx + rbp], al
dec rdi
jne 0x29e85b86570
mov dword [r15], ebx
mov r14, qword [rsp + 0x38]
add rsp, 0x40
pop r15
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x29e85b865a0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x20], r9
push rbx
push rbp
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x30
mov rdi, r8
mov r8, qword [rsp + 0xa0]
mov r14, rdx
mov ebx, dword [r8]
mov rbp, rcx
mov dword [rsp + 0x80], ebx
test ebx, ebx
je 0x29e85b86609
mov rdx, qword [rsp + 0x98]
nop dword [rax + rax]
test rdi, rdi
je 0x29e85b86602
mov eax, ebx
inc r14
inc rbp
movzx ecx, byte [rax + rdx]
dec rdi
xor cl, byte [rbp - 1]
inc ebx
mov byte [r14 - 1], cl
and ebx, 0xf
jne 0x29e85b865e0
mov dword [rsp + 0x80], ebx
mov r15, qword [rsp + 0x90]
mov r10, qword [rsp + 0xa8]
mov qword [rsp + 0x70], rsi
movzx eax, byte [r15 + 0xd]
movzx r13d, byte [r15 + 0xc]
mov r12d, 0xc
shl r13d, 8
or r13d, eax
movzx eax, byte [r15 + 0xe]
shl r13d, 8
or r13d, eax
movzx eax, byte [r15 + 0xf]
shl r13d, 8
or r13d, eax
cmp rdi, 0x10
jb 0x29e85b86717
mov rbx, qword [rsp + 0x88]
mov eax, 0x10000000
nop dword [rax]
nop dword [rax + rax]
mov rsi, rdi
shr rsi, 4
cmp rsi, rax
cmova rsi, rax
add r13d, esi
mov eax, r13d
cmp rax, rsi
jae 0x29e85b8668f
sub rsi, rax
xor r13d, r13d
mov r9, rbx
mov r8, rsi
mov rdx, r14
mov rcx, rbp
mov qword [rsp + 0x20], r15
call r10
mov eax, r13d
mov byte [r15 + 0xf], r13b
shr eax, 0x18
mov byte [r15 + 0xc], al
mov eax, r13d
shr eax, 0x10
mov byte [r15 + 0xd], al
mov eax, r13d
shr eax, 8
mov byte [r15 + 0xe], al
test r13d, r13d
jne 0x29e85b866dc
mov edx, r12d
nop dword [rax]
dec edx
inc byte [rdx + r15]
jne 0x29e85b866dc
test edx, edx
jne 0x29e85b866d0
mov r10, qword [rsp + 0xa8]
shl rsi, 4
mov eax, 0x10000000
sub rdi, rsi
add r14, rsi
add rbp, rsi
cmp rdi, 0x10
jae 0x29e85b86670
mov ebx, dword [rsp + 0x80]
mov r8, qword [rsp + 0xa0]
mov r9, qword [rsp + 0x88]
test rdi, rdi
je 0x29e85b867a0
mov rsi, qword [rsp + 0x98]
xor eax, eax
mov qword [rsp + 0x20], r15
mov qword [rsi], rax
lea r8d, [rax + 1]
mov rdx, rsi
mov rcx, rsi
mov qword [rsi + 8], rax
call r10
inc r13d
mov eax, r13d
mov byte [r15 + 0xf], r13b
shr eax, 0x18
mov byte [r15 + 0xc], al
mov eax, r13d
shr eax, 0x10
mov byte [r15 + 0xd], al
mov eax, r13d
shr eax, 8
mov byte [r15 + 0xe], al
test r13d, r13d
jne 0x29e85b86780
nop dword [rax]
dec r12d
inc byte [r12 + r15]
jne 0x29e85b86780
test r12d, r12d
jne 0x29e85b86770
nop
mov ecx, ebx
inc ebx
movzx eax, byte [rcx + rbp]
xor al, byte [rcx + rsi]
mov byte [rcx + r14], al
dec rdi
jne 0x29e85b86780
mov rax, qword [rsp + 0xa0]
mov dword [rax], ebx
jmp 0x29e85b867a3
mov dword [r8], ebx
mov rsi, qword [rsp + 0x70]
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rbp
pop rbx
ret

Function at 0x29e85b947b0
Capabilities:
Hash data with md5

Disassembly:
push rbx
sub rsp, 0x20
xor edx, edx
mov rbx, rcx
lea r8d, [rdx + 0x5c]
call fcn.29e85b462a0
mov dword [rbx], 0x67452301
mov dword [rbx + 4], 0xefcdab89
mov dword [rbx + 8], 0x98badcfe
mov dword [rbx + 0xc], 0x10325476
mov eax, 1
add rsp, 0x20
pop rbx
ret
Function at 0x29e85b950d0
Capabilities:
Hash data using sha1

Disassembly:
push rbx
sub rsp, 0x20
xor edx, edx
mov rbx, rcx
lea r8d, [rdx + 0x60]
call fcn.29e85b462a0
mov dword [rbx], 0x67452301
mov dword [rbx + 4], 0xefcdab89
mov dword [rbx + 8], 0x98badcfe
mov dword [rbx + 0xc], 0x10325476
mov dword [rbx + 0x10], 0xc3d2e1f0
mov eax, 1
add rsp, 0x20
pop rbx
ret

Function at 0x29e85b95600
Capabilities:
Hash data using sha256

Disassembly:
push rbx
sub rsp, 0x20
xor edx, edx
mov rbx, rcx
lea r8d, [rdx + 0x70]
call fcn.29e85b462a0
mov dword [rbx], 0x6a09e667
mov dword [rbx + 4], 0xbb67ae85
mov dword [rbx + 8], 0x3c6ef372
mov dword [rbx + 0xc], 0xa54ff53a
mov dword [rbx + 0x10], 0x510e527f
mov dword [rbx + 0x14], 0x9b05688c
mov dword [rbx + 0x18], 0x1f83d9ab
mov dword [rbx + 0x1c], 0x5be0cd19
mov dword [rbx + 0x6c], 0x20
mov eax, 1
add rsp, 0x20
pop rbx
ret
Function at 0x29e85bab730
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 0x18], rbx
push r14
xor r9d, r9d
mov r14, r8
mov r11, rdx
mov rbx, rcx
cmp rdx, 0xb
jae 0x29e85bab753
xor eax, eax
mov rbx, qword [rsp + 0x20]
pop r14
ret
movzx ecx, byte [rcx]
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
not cl
mov r10d, 2
mov r8d, 1
movzx eax, cl
shr al, 4
and cl, al
movzx eax, cl
shr al, 2
and cl, al
movzx eax, cl
movzx ecx, byte [rbx + 1]
mov edi, eax
xor cl, 2
not cl
shr edi, 1
and edi, eax
movzx eax, cl
shr al, 4
and cl, al
movzx eax, cl
shr al, 2
and cl, al
movzx eax, cl
mov esi, eax
shr esi, 1
and esi, eax
cmp r10, rdx
jae 0x29e85bab7f5
nop
movzx ecx, byte [r10 + rbx]
not cl
movzx eax, cl
shr al, 4
and cl, al
movzx eax, cl
shr al, 2
and cl, al
movzx eax, cl
mov edx, eax
shr edx, 1
and edx, eax
mov ecx, edx
and ecx, r8d
dec ecx
mov eax, ecx
and ecx, r9d
not eax
and eax, r10d
inc r10
mov r9d, eax
lea eax, [rdx - 1]
and r8d, eax
or r9d, ecx
cmp r10, r11
jb 0x29e85bab7b0
mov rbx, qword [rsp + 0x20]
lea eax, [r9 + 1]
not r8d
movsxd rcx, eax
mov eax, 9
sub eax, r9d
mov qword [r14], rcx
sar eax, 0x1f
and eax, r8d
and eax, esi
mov rsi, qword [rsp + 0x10]
and eax, edi
mov rdi, qword [rsp + 0x18]
and eax, 1
pop r14
ret
Function at 0x29e85baf2b0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
push rsi
push r14
push r15
sub rsp, 0x20
cmp qword [rcx + 0x38], 0
mov r15, qword [rcx + 0x168]
mov rbx, r8
mov r8, qword [rcx + 0x160]
mov r14, rdx
mov rsi, rcx
je 0x29e85baf2ed
xor eax, eax
mov rbx, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop rsi
ret
mov rcx, qword [rcx + 0x30]
movabs rax, 0x2000000000000000
add rcx, rbx
cmp rcx, rax
ja 0x29e85baf2dc
cmp rcx, rbx
jb 0x29e85baf2dc
mov qword [rsp + 0x48], rdi
mov edi, dword [rsi + 0x174]
mov qword [rsi + 0x30], rcx
test edi, edi
je 0x29e85baf34d
nop dword [rax + rax]
test rbx, rbx
je 0x29e85baf33e
movzx eax, byte [r14]
mov ecx, edi
inc r14
xor byte [rcx + rsi + 0x40], al
dec rbx
inc edi
and edi, 0xf
jne 0x29e85baf320
jmp 0x29e85baf342
test edi, edi
jne 0x29e85baf3a2
lea rdx, [rsi + 0x60]
lea rcx, [rsi + 0x40]
call r8
mov qword [rsp + 0x40], rbp
mov rbp, rbx
and rbp, 0xfffffffffffffff0
je 0x29e85baf372
lea rdx, [rsi + 0x60]
lea rcx, [rsi + 0x40]
mov r9, rbp
mov r8, r14
call r15
add r14, rbp
sub rbx, rbp
mov rbp, qword [rsp + 0x40]
test rbx, rbx
je 0x29e85baf3a2
mov edi, ebx
lea rcx, [rsi + 0x40]
sub r14, rsi
nop word [rax + rax]
movzx eax, byte [r14 + rcx - 0x40]
lea rcx, [rcx + 1]
xor byte [rcx - 1], al
dec rbx
jne 0x29e85baf390
mov rbx, qword [rsp + 0x50]
mov dword [rsi + 0x174], edi
mov rdi, qword [rsp + 0x48]
mov eax, 1
add rsp, 0x20
pop r15
pop r14
pop rsi
ret
Function at 0x29e85bb0150
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
push r13
push r14
sub rsp, 0x20
mov r13, qword [rcx + 0x160]
xor r14d, r14d
mov rsi, r8
mov qword [rcx], r14
mov qword [rcx + 8], r14
mov qword [rcx + 0x40], r14
mov qword [rcx + 0x48], r14
mov qword [rcx + 0x30], r14
mov qword [rcx + 0x38], r14
mov qword [rcx + 0x170], r14
mov rdi, rdx
mov rbx, rcx
cmp r8, 0xc
jne 0x29e85bb01ae
movsd xmm0, qword [rdx]
lea edi, [r8 - 0xb]
movsd qword [rcx], xmm0
mov eax, dword [rdx + 8]
mov dword [rcx + 8], eax
mov byte [rcx + 0xf], 1
jmp 0x29e85bb0343
mov qword [rsp + 0x58], rbp
mov qword [rsp + 0x50], r8
mov rbp, r8
cmp r8, 0x10
jb 0x29e85bb0262
mov qword [rsp + 0x60], r12
shr rbp, 4
mov r12, rcx
mov qword [rsp + 0x68], r15
neg r12
lea r15, [rcx + 0xf]
imul rax, rbp, 0xfffffffffffffff0
add rsi, rax
nop dword [rax]
nop dword [rax + rax]
lea r8, [r12 + rdi]
lea rax, [r8 + r15]
cmp rbx, rax
ja 0x29e85bb0230
cmp r15, rdi
jb 0x29e85bb0230
mov rax, rbx
mov edx, 0x10
nop word [rax + rax]
movzx ecx, byte [r8 + rax]
lea rax, [rax + 1]
xor byte [rax - 1], cl
dec rdx
jne 0x29e85bb0210
jmp 0x29e85bb0240
movdqu xmm1, xmmword [rbx]
movdqu xmm0, xmmword [rdi]
pxor xmm1, xmm0
movdqu xmmword [rbx], xmm1
lea rdx, [rbx + 0x60]
mov rcx, rbx
call r13
add rdi, 0x10
dec rbp
jne 0x29e85bb01f0
mov rbp, qword [rsp + 0x50]
mov r15, qword [rsp + 0x68]
mov r12, qword [rsp + 0x60]
test rsi, rsi
je 0x29e85bb030a
cmp rsi, 0x20
jb 0x29e85bb02d3
lea rax, [rdi - 1]
lea rcx, [rbx - 1]
add rax, rsi
add rcx, rsi
cmp rbx, rax
ja 0x29e85bb0289
cmp rcx, rdi
jae 0x29e85bb02d3
mov rax, rsi
mov rdx, rsi
mov rcx, rdi
and eax, 0x1f
sub rdx, rax
mov rax, rbx
sub rcx, rbx
nop
movdqu xmm0, xmmword [rax]
movdqu xmm1, xmmword [rax + rcx]
add r14, 0x20
lea rax, [rax + 0x20]
pxor xmm1, xmm0
movdqu xmmword [rax - 0x20], xmm1
movdqu xmm1, xmmword [rcx + rax - 0x10]
movdqu xmm0, xmmword [rax - 0x10]
pxor xmm1, xmm0
movdqu xmmword [rax - 0x10], xmm1
cmp r14, rdx
jb 0x29e85bb02a0
cmp r14, rsi
jae 0x29e85bb0300
sub rdi, rbx
lea rcx, [r14 + rbx]
sub rsi, r14
nop dword [rax]
nop word [rax + rax]
movzx eax, byte [rcx + rdi]
lea rcx, [rcx + 1]
xor byte [rcx - 1], al
dec rsi
jne 0x29e85bb02f0
lea rdx, [rbx + 0x60]
mov rcx, rbx
call r13
shl rbp, 3
lea rdx, [rbx + 0x60]
mov rcx, rbx
bswap rbp
xor qword [rbx + 8], rbp
call r13
movzx eax, byte [rbx + 0xd]
movzx edi, byte [rbx + 0xc]
mov rbp, qword [rsp + 0x58]
shl edi, 8
or edi, eax
movzx eax, byte [rbx + 0xe]
shl edi, 8
or edi, eax
movzx eax, byte [rbx + 0xf]
shl edi, 8
or edi, eax
mov r8, qword [rbx + 0x180]
lea rdx, [rbx + 0x20]
mov rcx, rbx
call qword [rbx + 0x178]
inc edi
mov eax, edi
mov byte [rbx + 0xf], dil
shr eax, 0x18
mov byte [rbx + 0xc], al
mov eax, edi
shr eax, 0x10
mov byte [rbx + 0xd], al
mov eax, edi
shr eax, 8
mov byte [rbx + 0xe], al
add rsp, 0x20
pop r14
pop r13
pop rdi
pop rsi
pop rbx
ret
Function at 0x29e85bb0960
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
sub rsp, 0x20
mov rbp, qword [rsp + 0x70]
mov r13, qword [rsp + 0x78]
mov r12, r9
mov rdi, r8
mov rbx, rdx
mov rsi, rcx
mov r10, rbp
cmp r8, 0x10
jb 0x29e85bb09e8
mov rbp, r8
shr rbp, 4
imul rax, rbp, 0xfffffffffffffff0
add rdi, rax
nop dword [rax]
mov r8, rbx
sub r10, rsi
mov rcx, rsi
sub r8, rsi
mov edx, 2
mov rax, qword [r10 + rcx]
lea rcx, [rcx + 8]
xor rax, qword [rcx - 8]
mov qword [r8 + rcx - 8], rax
dec rdx
jne 0x29e85bb09b1
mov r8, r12
mov rdx, rbx
mov rcx, rbx
call r13
mov r10, rbx
add rbx, 0x10
add rsi, 0x10
dec rbp
jne 0x29e85bb09a0
mov rbp, qword [rsp + 0x70]
test rdi, rdi
je 0x29e85bb0b02
mov qword [rsp + 0x50], r14
mov qword [rsp + 0x58], r15
nop dword [rax + rax]
mov r8, r10
mov r9, rbx
mov r11d, 1
mov r14d, 2
mov r15d, 3
xor eax, eax
sub r8, rsi
sub r9, rsi
sub r11, rsi
sub r14, rsi
sub r15, rsi
nop dword [rax]
cmp rax, rdi
jae 0x29e85bb0aa4
lea rdx, [rax + rsi]
movzx ecx, byte [r8 + rdx]
xor cl, byte [rdx]
mov byte [r9 + rdx], cl
lea rcx, [r11 + rdx]
cmp rcx, rdi
jae 0x29e85bb0aa1
movzx ecx, byte [rsi + rax + 1]
xor cl, byte [rax + r10 + 1]
mov byte [rbx + rax + 1], cl
lea rcx, [r14 + rdx]
cmp rcx, rdi
jae 0x29e85bb0a9b
movzx ecx, byte [rsi + rax + 2]
xor cl, byte [rax + r10 + 2]
mov byte [rbx + rax + 2], cl
lea rcx, [r15 + rdx]
cmp rcx, rdi
jae 0x29e85bb0a95
movzx ecx, byte [rsi + rax + 3]
add rax, 4
xor cl, byte [rax + r10 - 1]
mov byte [rbx + rax - 1], cl
cmp rax, 0x10
jb 0x29e85bb0a30
jmp 0x29e85bb0ad1
add rax, 3
jmp 0x29e85bb0aa4
add rax, 2
jmp 0x29e85bb0aa4
inc rax
cmp rax, 0x10
jae 0x29e85bb0ad1
mov edx, 0x10
sub r10, rbx
lea rcx, [rax + rbx]
sub rdx, rax
nop dword [rax]
movzx eax, byte [r10 + rcx]
lea rcx, [rcx + 1]
mov byte [rcx - 1], al
dec rdx
jne 0x29e85bb0ac0
mov r8, r12
mov rdx, rbx
mov rcx, rbx
call r13
mov r10, rbx
cmp rdi, 0x10
jbe 0x29e85bb0af8
add rsi, 0x10
add rbx, 0x10
sub rdi, 0x10
jne 0x29e85bb0a00
mov r14, qword [rsp + 0x50]
mov r15, qword [rsp + 0x58]
movups xmm0, xmmword [r10]
mov rbx, qword [rsp + 0x60]
movups xmmword [rbp], xmm0
add rsp, 0x20
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x29e85bccd10
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0xd0
mov rax, qword [0x29e85cc0760]
xor rax, rsp
mov qword [rsp + 0xc0], rax
mov rdi, rcx
mov qword [rsp + 0x30], rcx
mov ecx, dword [rdx + 4]
xor r12d, r12d
sub ecx, r8d
lea rax, [rsp + 0x40]
neg rax
lea rbp, [rsp + 0x40]
mov esi, r8d
and eax, 0x3f
mov r13d, r9d
mov qword [rsp + 0x28], rdx
add rbp, rax
lea eax, [rsi + 0x100]
mov dword [rsp + 0x20], ecx
mov r14d, r12d
cmp r9d, eax
jbe 0x29e85bccd87
mov r14d, r9d
sub r14d, esi
sub r14d, 0x100
xor edx, edx
mov eax, esi
mov r8, rsi
and eax, 0xfffffffe
mov r15, rsi
shl eax, 0x17
sub eax, r14d
add eax, ecx
mov rcx, rbp
div esi
mov ebx, edx
xor edx, edx
call fcn.29e85b462a0
cmp r14d, r13d
jae 0x29e85bcce0c
mov rax, qword [rsp + 0x28]
mov r8d, r14d
mov r9d, r14d
mov edi, dword [rax + 4]
add r9, qword [rax + 0x10]
sub r8d, edi
sub edi, dword [rsp + 0x20]
sub r13d, r14d
mov r10d, r13d
nop
mov ecx, r8d
lea edx, [rdi + r8]
inc r8d
not ecx
not edx
lea r9, [r9 + 1]
sar ecx, 0x1f
sar edx, 0x1f
not cl
and cl, byte [r9 - 1]
and cl, dl
or byte [r12 + rbp], cl
inc r12d
mov eax, r12d
sub eax, esi
sar eax, 0x1f
and r12d, eax
dec r10
jne 0x29e85bccdd0
mov rdi, qword [rsp + 0x30]
test esi, esi
je 0x29e85bcce37
mov eax, ebx
mov ecx, ebx
inc ebx
xor rax, 0x20
lea rdi, [rdi + 1]
movzx eax, byte [rax + rbp]
movzx eax, byte [rcx + rbp]
mov byte [rdi - 1], al
mov eax, ebx
sub eax, esi
sar eax, 0x1f
and ebx, eax
dec r15
jne 0x29e85bcce10
mov rcx, qword [rsp + 0xc0]
xor rcx, rsp
call fcn.29e85b464e0
mov rbx, qword [rsp + 0x118]
add rsp, 0xd0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x29e85bcd6f0
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 8
mov rax, qword [rcx + 8]
inc r9d
mov rcx, qword [rax + 0xb0]
test byte [rcx + 0x70], 1
je 0x29e85bcd72d
mov ecx, dword [rdx + 4]
lea eax, [r9 + r8]
cmp eax, ecx
jbe 0x29e85bcd71a
xor eax, eax
add rsp, 8
ret
mov eax, r8d
add qword [rdx + 0x10], rax
add qword [rdx + 0x18], rax
sub ecx, r8d
mov dword [rdx + 4], ecx
jmp 0x29e85bcd733
cmp r9d, dword [rdx + 4]
ja 0x29e85bcd713
mov r11d, dword [rdx + 4]
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov rsi, qword [rdx + 0x10]
mov qword [rsp], rdi
mov edi, 0x100
lea eax, [r11 - 1]
mov r8d, r11d
movzx ebx, byte [rax + rsi]
sub r8d, ebx
sub r8d, r9d
not r8d
sar r8d, 0x1f
cmp r11d, edi
cmovb edi, r11d
xor r9d, r9d
test edi, edi
je 0x29e85bcd7ab
mov r10d, ebx
nop word [rax + rax]
mov eax, r11d
sub eax, r9d
inc r9d
dec eax
movzx ecx, byte [rax + rsi]
mov eax, r10d
dec r10d
xor ecx, ebx
not eax
sar eax, 0x1f
movzx eax, al
and ecx, eax
not ecx
and r8d, ecx
cmp r9d, edi
jb 0x29e85bcd780
mov rdi, qword [rsp]
mov rsi, qword [rsp + 0x18]
mov eax, r8d
shr eax, 4
and r8d, eax
mov eax, r8d
shr eax, 2
and r8d, eax
lea eax, [rbx + 1]
mov rbx, qword [rsp + 0x10]
lea ecx, [r8 + r8]
and ecx, r8d
shl ecx, 0x1e
sar ecx, 0x1f
and eax, ecx
sub r11d, eax
shl eax, 8
or dword [rdx], eax
mov eax, ecx
not ecx
and eax, 1
mov dword [rdx + 4], r11d
or eax, ecx
add rsp, 8
ret
Function at 0x29e85bcfec0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x20], r9
mov dword [rsp + 0x18], r8d
mov qword [rsp + 0x10], rdx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x70
mov r15d, ecx
xor r14d, r14d
lea r8, [rsp + 0x68]
lea rdx, [rsp + 0x60]
xor ecx, ecx
mov edi, r14d
mov ebx, r14d
call fcn.29e85bb8150
test eax, eax
je 0x29e85bcff29
mov eax, dword [rsp + 0x60]
shl eax, 0xa
test r15d, eax
je 0x29e85bcff12
inc edi
inc ebx
lea r8, [rsp + 0x68]
lea rdx, [rsp + 0x60]
mov ecx, ebx
call fcn.29e85bb8150
test eax, eax
jne 0x29e85bcff04
mov ecx, dword [rsp + 0xf0]
movsxd rbx, dword [rsp + 0x108]
mov rsi, qword [rsp + 0xf8]
mov rbp, qword [rsp + 0xe8]
mov eax, ecx
mov r8, rbx
cdq
idiv edi
cmp edi, 1
cmove ecx, r14d
xor edx, edx
mov dword [rsp + 0xf0], ecx
mov rcx, rsi
movsxd r13, eax
call fcn.29e85b462a0
lea r8, [rsp + 0x68]
lea rdx, [rsp + 0x60]
xor ecx, ecx
call fcn.29e85bb8150
test eax, eax
je 0x29e85bd00de
mov rdi, qword [rsp + 0x100]
nop dword [rax]
mov eax, dword [rsp + 0x60]
shl eax, 0xa
test r15d, eax
je 0x29e85bd00c1
mov rcx, qword [rsp + 0x68]
test rcx, rcx
je 0x29e85bd00fb
mov eax, dword [rsp + 0xe0]
mov r8d, dword [rsp + 0xf0]
mov r9, qword [rsp + 0xb8]
mov dword [rsp + 0x50], ebx
mov qword [rsp + 0x48], rdi
mov dword [rsp + 0x40], eax
mov rax, qword [rsp + 0xd8]
and r8d, 1
mov rdx, rbp
mov qword [rsp + 0x38], rax
mov eax, dword [rsp + 0xd0]
add r8d, r13d
mov dword [rsp + 0x30], eax
mov rax, qword [rsp + 0xc8]
mov qword [rsp + 0x28], rax
mov eax, dword [rsp + 0xc0]
mov dword [rsp + 0x20], eax
call fcn.29e85bd0110
test eax, eax
je 0x29e85bd00fb
xor eax, eax
add rbp, r13
mov r9d, eax
test ebx, ebx
jle 0x29e85bd009b
cmp ebx, 0x20
jb 0x29e85bd009b
mov edx, eax
lea eax, [rbx - 1]
movsxd rcx, eax
lea rax, [rcx + rdi]
lea r8, [rcx + rsi]
cmp rsi, rax
ja 0x29e85bd0044
cmp r8, rdi
jae 0x29e85bd009b
mov eax, ebx
and eax, 0x8000001f
jge 0x29e85bd0054
dec eax
or eax, 0xffffffe0
inc eax
mov r8d, ebx
sub r8d, eax
nop word [rax + rax]
movsxd rax, edx
add r9, 0x20
movdqu xmm0, xmmword [rax + rsi]
movdqu xmm1, xmmword [rax + rdi]
pxor xmm1, xmm0
movdqu xmmword [rax + rsi], xmm1
lea eax, [rdx + 0x10]
add edx, 0x20
movsxd rcx, eax
movdqu xmm1, xmmword [rcx + rdi]
movdqu xmm0, xmmword [rcx + rsi]
pxor xmm1, xmm0
movdqu xmmword [rcx + rsi], xmm1
cmp edx, r8d
jl 0x29e85bd0060
cmp r9, rbx
jge 0x29e85bd00c1
mov r8, rdi
mov rdx, rbx
lea rax, [r9 + rsi]
sub r8, rsi
sub rdx, r9
movzx ecx, byte [r8 + rax]
lea rax, [rax + 1]
xor byte [rax - 1], cl
dec rdx
jne 0x29e85bd00b0
inc r14d
lea r8, [rsp + 0x68]
lea rdx, [rsp + 0x60]
mov ecx, r14d
call fcn.29e85bb8150
test eax, eax
jne 0x29e85bcff90
mov eax, 1
mov rbx, qword [rsp + 0xb0]
add rsp, 0x70
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
xor r14d, r14d
mov eax, r14d
jmp 0x29e85bd00e3
Function at 0x29e85bda160
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r15
sub rsp, 0x20
mov r15, rdx
mov rbx, rcx
call fcn.29e85b4df08
mov r8, qword [rax]
xor r9d, r9d
lea r12, [0x29e85c7fe70]
xorps xmm1, xmm1
movsx ebp, byte [r8]
mov qword [r15], rbx
movzx eax, byte [rbx]
test byte [rax + r12 + 1], 8
mov r10d, r9d
mov edi, r9d
mov r8d, r9d
mov r11d, r9d
je 0x29e85bda1c0
movzx eax, byte [rbx + 1]
inc rbx
test byte [rax + r12 + 1], 8
jne 0x29e85bda1b1
movzx eax, byte [rbx]
mov qword [rsp + 0x40], r14
mov esi, 1
cmp al, 0x2d
jne 0x29e85bda1d9
inc rbx
mov r14d, esi
jmp 0x29e85bda1e3
cmp al, 0x2b
jne 0x29e85bda1e0
inc rbx
mov r14d, r9d
cmp byte [rbx], 0x30
jne 0x29e85bda300
movzx eax, byte [rbx + 1]
sub al, 0x58
test al, 0xdf
jne 0x29e85bda300
movsd xmm2, qword [0x29e85c7d128]
add rbx, 2
nop word [rax + rax]
movsx rdx, byte [rbx]
mov rcx, rdx
cmp edx, ebp
jne 0x29e85bda228
test r11d, r11d
jne 0x29e85bda27f
mov r11d, esi
inc rbx
jmp 0x29e85bda210
movzx eax, dl
test byte [rax + r12 + 1], 0x10
je 0x29e85bda27f
test r10d, r10d
jne 0x29e85bda241
cmp dl, 0x30
jne 0x29e85bda241
inc edi
jmp 0x29e85bda272
inc r10d
cmp r10d, 0x1e
jg 0x29e85bda26f
test byte [rcx + r12 + 1], 2
je 0x29e85bda257
add ecx, 0xffffffd0
jmp 0x29e85bda25d
or ecx, 0x20
sub ecx, 0x57
movd xmm0, ecx
mulsd xmm1, xmm2
cvtdq2pd xmm0, xmm0
addsd xmm1, xmm0
jmp 0x29e85bda272
inc r8d
test r11d, r11d
je 0x29e85bda27a
dec r8d
inc rbx
jmp 0x29e85bda210
lea eax, [rdi + r10]
test eax, eax
je 0x29e85bda300
mov qword [r15], rbx
movzx eax, byte [rbx]
lea edx, [r8*4]
sub al, 0x50
test al, 0xdf
jne 0x29e85bda2ea
movzx eax, byte [rbx + 1]
inc rbx
cmp al, 0x2d
jne 0x29e85bda2ab
inc rbx
jmp 0x29e85bda2b5
cmp al, 0x2b
jne 0x29e85bda2b2
inc rbx
mov esi, r9d
movzx eax, byte [rbx]
test byte [rax + r12 + 1], 2
je 0x29e85bda300
lea r9d, [r9 + r9*4]
movsx eax, al
inc rbx
lea r9d, [r9 - 0x18]
lea r9d, [rax + r9*2]
movzx eax, byte [rbx]
test byte [rax + r12 + 1], 2
jne 0x29e85bda2c0
test esi, esi
je 0x29e85bda2e4
neg r9d
add edx, r9d
mov qword [r15], rbx
test r14d, r14d
je 0x29e85bda2f6
xorps xmm1, xmmword [0x29e85c54730]
movaps xmm0, xmm1
call fcn.29e85b4dd08
jmp 0x29e85bda303
xorps xmm0, xmm0
mov r14, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x48]
mov rbp, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x20
pop r15
pop r12
pop rdi
ret
Function at 0x29e85bdf770
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rdx, r8
je 0x29e85bdf880
push rbx
sub rsp, 0x20
mov qword [rsp + 0x30], rdi
mov r11, r8
mov r10, rdx
lea rdi, [0x29e85ad0000]
mov rbx, rcx
movzx edx, byte [r10 + 9]
movzx eax, dl
and al, 7
cmp al, 3
jne case.0x29e85bdf7da.8
xor dl, 7
mov byte [r10 + 9], dl
test dl, 0x20
je case.0x29e85bdf7da.8
movzx eax, byte [r10 + 8]
add eax, 0xfffffffc
cmp eax, 0x22
ja case.0x29e85bdf7da.8
cdqe
movzx eax, byte [rdi + rax + 0x10f898]
mov ecx, dword [rdi + rax*4 + 0x10f884]
add rcx, rdi
jmp rcx
and dl, 0xe7
or dl, 0x20
mov byte [r10 + 9], dl
jmp case.0x29e85bdf7da.8
lea rax, [r10 + 0x18]
cmp qword [r10 + 0x10], rax
je 0x29e85bdf7fa
and dl, 0xc7
jmp 0x29e85bdf800
and dl, 0xe7
or dl, 0x20
mov byte [r10 + 9], dl
mov rax, qword [r10 + 0x10]
test byte [rax + 8], 0x40
je case.0x29e85bdf7da.8
mov rdx, qword [rax]
test byte [rdx + 9], 0x18
je case.0x29e85bdf7da.8
mov rcx, rbx
call fcn.29e85bdfb70
jmp case.0x29e85bdf7da.8
cmp word [r10 + 0xa], 0
jne case.0x29e85bdf7da.5
mov rdx, qword [r10 + 0x18]
test rdx, rdx
je 0x29e85bdf840
test byte [rdx + 9], 0x18
je 0x29e85bdf840
mov rcx, rbx
call fcn.29e85bdfb70
and byte [r10 + 9], 0xe7
or byte [r10 + 9], 0x20
jmp case.0x29e85bdf7da.8
mov rcx, r10
call fcn.29e85bdec50
mov rcx, qword [rbx + 0x88]
mov qword [rax], rcx
mov qword [rbx + 0x88], r10
and byte [r10 + 9], 0xc7
mov r10, qword [r10]
cmp r10, r11
jne 0x29e85bdf793
mov rdi, qword [rsp + 0x30]
add rsp, 0x20
pop rbx
ret