joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140009820
Capabilities:
Enumerate process modules

Disassembly:
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x490
lea rbp, [rsp + 0x40]
mov qword [rbp + 0x490], rbx
mov rax, qword [0x140119010]
xor rax, rbp
mov qword [rbp + 0x440], rax
mov rdi, rdx
mov dword [rbp], 0x438
mov edx, dword [rcx + 0x10]
mov ecx, 8
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rcx, rax
lea rdx, [rbp]
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_Module32FirstW]
xor r14d, r14d
movabs r15, 0xffffffffffffff0
lea rcx, [rbp + 0x30]
mov rax, 0xffffffffffffffff
nop dword [rax]
inc rax
cmp word [rcx + rax*2], r14w
jne 0x140009890
lea edx, [rax + 1]
cmp edx, 0x3fffffff
jg 0x14000990a
cdqe
lea rax, [rax*2 + 2]
lea rcx, [rax + 0xf]
cmp rcx, rax
ja 0x1400098bb
mov rcx, r15
and rcx, 0xfffffffffffffff0
mov rax, rcx
call fcn.1400eb7e0
sub rsp, rcx
lea rbx, [rsp + 0x40]
test rbx, rbx
je 0x14000990a
lea eax, [rdx + rdx]
mov qword [rsp + 0x38], r14
xor edx, edx
mov qword [rsp + 0x30], r14
mov dword [rsp + 0x28], eax
lea r8, [rbp + 0x30]
mov r9d, 0xffffffff
mov byte [rbx], r14b
mov qword [rsp + 0x20], rbx
lea ecx, [rdx + 3]
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
test eax, eax
cmove rbx, r14
jmp 0x14000990d
mov rbx, r14
cmp qword [rdi + 0x18], 0x10
mov rcx, rdi
jb 0x14000991a
mov rcx, qword [rdi]
sub rcx, rbx
nop dword [rax]
movzx edx, byte [rbx]
movzx eax, byte [rbx + rcx]
sub edx, eax
jne 0x140009932
inc rbx
test eax, eax
jne 0x140009920
mov rcx, rsi
test edx, edx
je 0x140009960
lea rdx, [rbp]
call qword [sym.imp.KERNEL32.dll_Module32NextW]
test eax, eax
jne 0x140009881
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rdi
call fcn.140002dc0
xor eax, eax
jmp 0x140009975
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rbx, qword [rbp + 0x28]
mov rcx, rdi
call fcn.140002dc0
mov rax, rbx
mov rcx, qword [rbp + 0x440]
xor rcx, rbp
call fcn.1400ea4a0
mov rbx, qword [rbp + 0x490]
lea rsp, [rbp + 0x450]
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
Function at 0x14000a000
Capabilities:
Enumerate processes

Disassembly:
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x2c0
lea rbp, [rsp + 0x40]
mov qword [rbp + 0x2d0], rbx
mov rax, qword [0x140119010]
xor rax, rbp
mov qword [rbp + 0x270], rax
mov rsi, rdx
mov r14, rcx
mov qword [rbp + 0x28], rdx
lea rcx, [rbp + 8]
call fcn.140008b90
mov rdi, rax
mov dword [rbp + 0x30], 0x238
xor edx, edx
lea ecx, [rdx + 0xf]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov r15, rax
lea rdx, [rbp + 0x30]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
xor r12d, r12d
movabs r13, 0xffffffffffffff0
nop word [rax + rax]
lea rcx, [rbp + 0x5c]
mov rax, 0xffffffffffffffff
nop dword [rax + rax]
inc rax
cmp word [rcx + rax*2], r12w
jne 0x14000a090
lea edx, [rax + 1]
cmp edx, 0x3fffffff
jg 0x14000a10a
cdqe
lea rax, [rax*2 + 2]
lea rcx, [rax + 0xf]
cmp rcx, rax
ja 0x14000a0bb
mov rcx, r13
and rcx, 0xfffffffffffffff0
mov rax, rcx
call fcn.1400eb7e0
sub rsp, rcx
lea rbx, [rsp + 0x40]
test rbx, rbx
je 0x14000a10a
mov byte [rbx], r12b
lea eax, [rdx + rdx]
mov qword [rsp + 0x38], r12
mov qword [rsp + 0x30], r12
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rbx
mov r9d, 0xffffffff
lea r8, [rbp + 0x5c]
xor edx, edx
lea ecx, [rdx + 3]
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
test eax, eax
cmove rbx, r12
jmp 0x14000a10d
mov rbx, r12
mov rdx, rdi
cmp qword [rdi + 0x18], 0x10
jb 0x14000a11a
mov rdx, qword [rdi]
sub rdx, rbx
nop dword [rax]
movzx ecx, byte [rbx]
movzx eax, byte [rbx + rdx]
sub ecx, eax
jne 0x14000a132
inc rbx
test eax, eax
jne 0x14000a120
test ecx, ecx
mov rcx, r15
je 0x14000a162
lea rdx, [rbp + 0x30]
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x14000a080
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rdi
call fcn.140002dc0
mov dword [r14 + 0x10], r12d
jmp 0x14000a17b
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov ebx, dword [rbp + 0x38]
mov rcx, rdi
call fcn.140002dc0
mov dword [r14 + 0x10], ebx
test ebx, ebx
jne 0x14000a18a
mov rcx, rsi
call fcn.140002dc0
mov eax, 1
jmp 0x14000a1f2
mov r8d, ebx
mov edx, 1
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [r14 + 8], rax
test rax, rax
jne 0x14000a1b5
mov rcx, rsi
call fcn.140002dc0
mov eax, 2
jmp 0x14000a1f2
mov rdx, rsi
lea rcx, [rbp + 8]
call fcn.140008b90
mov rdx, rax
mov rcx, r14
call fcn.140009820
mov qword [r14 + 0x18], rax
test rax, rax
jne 0x14000a1e4
mov rcx, rsi
call fcn.140002dc0
mov eax, 3
jmp 0x14000a1f2
mov byte [r14], 1
mov rcx, rsi
call fcn.140002dc0
xor eax, eax
mov rcx, qword [rbp + 0x270]
xor rcx, rbp
call fcn.1400ea4a0
mov rbx, qword [rbp + 0x2d0]
lea rsp, [rbp + 0x280]
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x14000f650
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
mov r11d, r8d
mov r10, rdx
not r11d
mov r9, rcx
mov eax, r11d
test rdx, rdx
je 0x14000f6ad
lea rbx, [0x1400f2ed0]
movzx r8d, byte [r9]
lea r9, [r9 + 1]
dec r10
cmp r8b, 0x23
jne 0x14000f694
cmp r10, 2
jb 0x14000f694
cmp byte [r9], r8b
jne 0x14000f694
cmp byte [r9 + 1], r8b
cmove eax, r11d
movzx edx, al
xor rdx, r8
shr eax, 8
xor eax, dword [rbx + rdx*4]
test r10, r10
jne 0x14000f670
not eax
mov rbx, qword [rsp + 8]
ret
movzx r8d, byte [rcx]
inc r9
test r8b, r8b
je 0x14000f6ef
lea rbx, [0x1400f2ed0]
cmp r8b, 0x23
jne 0x14000f6d3
cmp byte [r9], r8b
jne 0x14000f6d3
cmp byte [r9 + 1], r8b
cmove eax, r11d
movzx edx, al
movzx ecx, r8b
movzx r8d, byte [r9]
xor rdx, rcx
shr eax, 8
inc r9
xor eax, dword [rbx + rdx*4]
test r8b, r8b
jne 0x14000f6c0
mov rbx, qword [rsp + 8]
not eax
ret

Function at 0x14000f830
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
push r14
sub rsp, 0x20
mov r14, r8
test r8, r8
je 0x14000f84a
mov qword [r8], 0
lea rdx, [0x1400fc170]
call fcn.14000f700
mov rbx, rax
test rax, rax
jne 0x14000f86a
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop r14
ret
mov qword [rsp + 0x30], rsi
mov rcx, rbx
mov qword [rsp + 0x38], rdi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
mov esi, eax
cmp eax, 0xffffffff
je 0x14000f941
xor edx, edx
mov rcx, rbx
lea r8d, [rdx + 2]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
test eax, eax
jne 0x14000f941
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
movsxd rdi, eax
cmp edi, 0xffffffff
je 0x14000f941
xor r8d, r8d
mov edx, esi
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
test eax, eax
jne 0x14000f941
cmp rdi, 0xffffffffffffffff
je 0x14000f941
mov rax, qword [0x14011bfb0]
test rax, rax
je 0x14000f8de
inc dword [rax + 0xf4]
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov rsi, rax
test rax, rax
je 0x14000f941
mov r9, rbx
mov r8, rdi
mov edx, 1
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
mov rcx, rbx
cmp rax, rdi
je 0x14000f92e
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov rax, qword [0x14011bfb0]
test rax, rax
je 0x14000f923
dec dword [rax + 0xf4]
mov rcx, rsi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
jmp 0x14000f94a
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
test r14, r14
je 0x14000f93c
mov qword [r14], rdi
mov rax, rsi
jmp 0x14000f94c
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
xor eax, eax
mov rsi, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop r14
ret
Function at 0x1400138c0
Capabilities:
Hash data with crc32

Disassembly:
push rbx
sub rsp, 0x20
movsxd r8, dword [rcx + 0xf0]
lea r11, [0x1400f2ed0]
mov rax, qword [rcx + 0xf8]
mov r9, rcx
movsxd r10, edx
mov ebx, dword [rax + r8*4 - 4]
not ebx
movzx eax, r10b
movzx r8d, bl
shr ebx, 8
xor r8, rax
mov eax, r10d
shr eax, 8
movzx edx, al
mov eax, r10d
xor ebx, dword [r11 + r8*4]
movzx ecx, bl
xor rdx, rcx
shr ebx, 8
shr eax, 0x10
xor ebx, dword [r11 + rdx*4]
movzx ecx, bl
shr ebx, 8
movzx edx, al
xor rdx, rcx
xor ebx, dword [r11 + rdx*4]
movzx ecx, bl
shr ebx, 8
mov edx, r10d
shr rdx, 0x18
xor rdx, rcx
mov rcx, qword [r9]
xor ebx, dword [r11 + rdx*4]
not ebx
cmp dword [rcx + 0x3f40], ebx
jne 0x140013956
mov r8, r10
mov edx, 4
mov ecx, ebx
call fcn.140027680
mov eax, ebx
add rsp, 0x20
pop rbx
ret

Function at 0x140013960
Capabilities:
Hash data with crc32

Disassembly:
sub rsp, 0x18
mov rax, qword [rcx + 0xf8]
lea r9, [0x1400f2ed0]
vmovss xmm3, dword [rcx + 0x110]
vmovss xmm4, dword [rcx + 0x114]
movsxd rcx, dword [rcx + 0xf0]
vmovss xmm0, dword [rdx]
vmovss xmm2, dword [rdx + 4]
vsubss xmm1, xmm0, xmm3
mov r8d, dword [rax + rcx*4 - 4]
not r8d
movzx ecx, r8b
shr r8d, 8
vmovss dword [rsp], xmm1
movzx eax, byte [rsp]
xor rcx, rax
movzx eax, byte [rsp + 1]
vmovss xmm1, dword [rdx + 8]
vsubss xmm0, xmm2, xmm4
vmovss dword [rsp + 4], xmm0
xor r8d, dword [r9 + rcx*4]
vmovss xmm0, dword [rdx + 0xc]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 2]
vsubss xmm2, xmm1, xmm3
vmovss dword [rsp + 8], xmm2
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 3]
vsubss xmm1, xmm0, xmm4
vmovss dword [rsp + 0xc], xmm1
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 4]
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 5]
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 6]
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 7]
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 8]
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 9]
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 0xa]
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 0xb]
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 0xc]
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 0xd]
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
movzx eax, byte [rsp + 0xe]
xor r8d, dword [r9 + rcx*4]
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
xor r8d, dword [r9 + rcx*4]
movzx ecx, byte [rsp + 0xf]
movzx edx, r8b
shr r8d, 8
xor rdx, rcx
xor r8d, dword [r9 + rdx*4]
not r8d
mov eax, r8d
add rsp, 0x18
ret
Function at 0x140020630
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
mov rax, qword [0x140119010]
xor rax, rsp
mov qword [rsp + 0x30], rax
mov rbx, qword [0x14011bfb0]
mov edi, ecx
cmp byte [rbx + 0x4a9d], 0
jne 0x140020691
cmp byte [rbx + 0x4a9e], 0
jne 0x140020691
movsx r9d, word [rbx + 0x5bc2]
lea r8, str.Tooltip__02d
mov edx, 0x10
lea rcx, [rsp + 0x20]
call fcn.14000f4b0
test dil, 1
je 0x1400207bf
jmp 0x140020719
vmovss xmm1, dword [rbx + 0x389c]
vmovss xmm0, dword [0x140102c7c]
vfmadd213ss xmm0, xmm1, dword [rbx + 0xe0c]
vmovss xmm2, dword [0x140102cac]
vfmadd213ss xmm2, xmm1, dword [rbx + 0xe08]
movsx r9d, word [rbx + 0x5bc2]
lea r8, str.Tooltip__02d
xor eax, eax
mov dword [rbx + 0x47d4], 1
vmovss dword [rbx + 0x47e0], xmm2
vmovss dword [rbx + 0x47e4], xmm0
mov qword [rbx + 0x47e8], rax
lea rcx, [rsp + 0x20]
vmovss xmm0, dword [rbx + 0x3904]
vmulss xmm1, xmm0, dword [0x140102aa8]
or dword [rbx + 0x47d0], 0x41
lea edx, [rax + 0x10]
vmovss dword [rbx + 0x4830], xmm1
call fcn.14000f4b0
movzx r9d, byte [rsp + 0x20]
lea r8, [rsp + 0x21]
mov r10d, 0xffffffff
mov ecx, r10d
test r9b, r9b
je 0x140020770
lea r11, [0x1400f2ed0]
nop dword [rax]
cmp r9b, 0x23
jne 0x140020753
cmp byte [r8], r9b
jne 0x140020753
cmp byte [r8 + 1], r9b
cmove ecx, r10d
movzx edx, cl
movzx eax, r9b
movzx r9d, byte [r8]
xor rdx, rax
shr ecx, 8
inc r8
xor ecx, dword [r11 + rdx*4]
test r9b, r9b
jne 0x140020740
not ecx
call fcn.140017630
test rax, rax
je 0x1400207bf
cmp byte [rax + 0xb6], 0
je 0x1400207bf
mov byte [rax + 0xbb], 1
lea r8, str.Tooltip__02d
mov byte [rax + 0xbd], 1
lea rcx, [rsp + 0x20]
mov byte [rax + 0xd8], 1
mov edx, 0x10
inc word [rbx + 0x5bc2]
movsx r9d, word [rbx + 0x5bc2]
call fcn.14000f4b0
xor edx, edx
lea rcx, [rsp + 0x20]
mov r8d, 0x20c0347
call fcn.140019e00
mov al, 1
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.1400ea4a0
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rdi
ret
Function at 0x140026000
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x20
cmp qword [rcx + 0x5ca8], 0
lea rbx, [rcx + 0x5cb0]
mov rsi, r8
mov rbp, rdx
mov rdi, rcx
je 0x1400260a7
mov r9d, dword [rbx + 4]
mov qword [rsp + 0x30], r14
xor r14d, r14d
test r9d, r9d
jns 0x14002605a
mov eax, r9d
mov rcx, rbx
cdq
sub eax, edx
mov edx, r14d
sar eax, 1
add eax, r9d
test eax, eax
cmovg edx, eax
call fcn.1400282c0
mov r8, rsi
mov dword [rbx], r14d
mov rdx, rbp
mov rcx, rbx
call fcn.1400100d0
mov eax, dword [rbx]
mov edx, 1
mov r9, qword [rdi + 0x5ca8]
test eax, eax
lea ecx, [rax - 1]
mov rax, qword [rdi + 0x5cb8]
cmove ecx, r14d
test rax, rax
movsxd r8, ecx
lea rcx, [0x14011bfa8]
cmovne rcx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
mov r14, qword [rsp + 0x30]
jmp 0x1400260af
mov rcx, rbx
call fcn.1400100d0
mov rbx, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret

Function at 0x140026520
Capabilities:
Hash data with crc32

Disassembly:
sub rsp, 8
movzx r9d, byte [rcx]
lea r8, [rcx + 1]
mov r10, qword [0x14011bfb0]
mov r11d, 0xffffffff
mov eax, r11d
test r9b, r9b
je 0x140026583
mov qword [rsp], rbx
lea rbx, [0x1400f2ed0]
nop dword [rax]
cmp r9b, 0x23
jne 0x140026563
cmp byte [r8], r9b
jne 0x140026563
cmp byte [r8 + 1], r9b
cmove eax, r11d
movzx edx, al
movzx ecx, r9b
movzx r9d, byte [r8]
xor rdx, rcx
shr eax, 8
inc r8
xor eax, dword [rbx + rdx*4]
test r9b, r9b
jne 0x140026550
mov rbx, qword [rsp]
movsxd rcx, dword [r10 + 0x5c20]
xor r8d, r8d
not eax
test ecx, ecx
jle 0x1400265b7
mov r10, qword [r10 + 0x5c28]
mov r9, rcx
mov edx, r8d
lea rcx, [r10 + 8]
cmp dword [rcx], eax
je 0x1400265be
inc r8d
inc rdx
add rcx, 0x48
cmp rdx, r9
jl 0x1400265a4
xor eax, eax
add rsp, 8
ret
movsxd rax, r8d
lea rcx, [rax + rax*8]
lea rax, [r10 + rcx*8]
add rsp, 8
ret
Function at 0x140052df0
Capabilities:
Hash data with crc32

Disassembly:
push rdi
sub rsp, 0x20
test dword [rcx + 0x10], 0x100000
mov rdi, rdx
je 0x140052e7c
movzx r9d, byte [rdx]
lea r8, [rdx + 1]
mov r10d, 0xffffffff
mov eax, r10d
test r9b, r9b
je 0x140052e50
lea r11, [0x1400f2ed0]
nop
cmp r9b, 0x23
jne 0x140052e33
cmp byte [r8], r9b
jne 0x140052e33
cmp byte [r8 + 1], r9b
cmove eax, r10d
movzx edx, al
movzx ecx, r9b
movzx r9d, byte [r8]
xor rdx, rcx
shr eax, 8
inc r8
xor eax, dword [r11 + rdx*4]
test r9b, r9b
jne 0x140052e20
mov rcx, qword [0x14011bfb0]
not eax
cmp dword [rcx + 0x3f58], eax
jne 0x140052e67
mov dword [rcx + 0x3f5c], eax
cmp dword [rcx + 0x3f88], eax
jne 0x140052ed9
mov byte [rcx + 0x3f8c], 1
add rsp, 0x20
pop rdi
ret
mov rax, qword [0x14011bfb0]
xor edx, edx
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x38], rsi
mov rbx, qword [rax + 0x3ef8]
movsxd rcx, dword [rbx + 0xf0]
mov rax, qword [rbx + 0xf8]
mov r8d, dword [rax + rcx*4 - 4]
mov rcx, rdi
call fcn.14000f650
mov rcx, qword [rbx]
mov esi, eax
mov rbx, qword [rsp + 0x30]
cmp dword [rcx + 0x3f40], eax
jne 0x140052ed2
mov r8, rdi
mov edx, 0xb
mov ecx, eax
call fcn.140027680
mov eax, esi
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x140065150
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x20
mov eax, edx
mov edi, 0x40
shl rax, 4
mov rbx, rcx
cmp rax, 0x400
cmovbe edi, edx
cmp edi, dword [rcx]
je 0x1400652cc
mov rax, qword [0x14011ccd0]
test rax, rax
je 0x140065187
call rax
shl edi, 4
mov ecx, edi
call fcn.140060ca0
mov rcx, qword [0x14011ccd8]
mov rdi, rax
test rcx, rcx
je 0x1400651a2
call rcx
test rdi, rdi
je 0x1400652cc
mov rcx, qword [rbx + 0x10]
mov qword [rsp + 0x30], rbp
mov qword [rsp + 0x38], rsi
call fcn.140060fe0
mov rcx, rdi
mov qword [rbx + 0x10], rdi
call qword [0x140119468]
movsxd rsi, eax
xor edx, edx
shr rsi, 4
mov rcx, rdi
mov r8d, esi
shl r8, 4
mov dword [rbx], esi
call sub.VCRUNTIME140.dll_memset
mov rcx, qword [rbx + 8]
xor ebp, ebp
mov qword [rbx + 8], rbp
test rcx, rcx
je 0x1400652b2
lea r11, [0x1400f8f30]
nop
mov r9d, dword [rcx + 0x20]
mov eax, ebp
mov r10, qword [rcx + 0x18]
test r9d, r9d
jle 0x140065232
nop
movzx edx, byte [r10]
lea r10, [r10 + 1]
dec r9d
movzx r8d, byte [rdx + r11]
lea edx, [rax*8]
xor r8d, edx
xor eax, r8d
test r9d, r9d
jg 0x140065210
mov r10, qword [rcx]
xor edx, edx
div esi
mov r9d, edx
shl r9, 4
add r9, rdi
je 0x14006528a
mov eax, dword [r9]
test eax, eax
je 0x140065252
mov rdx, qword [r9 + 8]
jmp 0x140065255
mov rdx, rbp
inc eax
mov qword [r9 + 8], rcx
mov dword [r9], eax
test rdx, rdx
je 0x14006528a
mov qword [rcx], rdx
mov rax, qword [rdx + 8]
mov qword [rcx + 8], rax
mov rax, qword [rdx + 8]
test rax, rax
je 0x140065280
mov qword [rax], rcx
mov qword [rdx + 8], rcx
jmp 0x1400652a6
mov qword [rbx + 8], rcx
mov qword [rdx + 8], rcx
jmp 0x1400652a6
mov rax, qword [rbx + 8]
mov qword [rcx], rax
mov rax, qword [rbx + 8]
test rax, rax
je 0x14006529e
mov qword [rax + 8], rcx
mov qword [rcx + 8], rbp
mov qword [rbx + 8], rcx
mov rcx, r10
test r10, r10
jne 0x140065200
mov rsi, qword [rsp + 0x38]
mov eax, 1
mov rbp, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
mov rbx, qword [rsp + 0x40]
xor eax, eax
add rsp, 0x20
pop rdi
ret

Function at 0x1400653a0
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x28
cmp qword [rcx + 0x10], 0
mov r11, rcx
mov qword [rsp + 0x30], rbx
mov rbx, rdx
je 0x1400653fb
xor eax, eax
mov r9d, r8d
mov r10, rdx
test r8d, r8d
jle 0x1400653f4
mov qword [rsp + 0x20], rdi
lea rdi, [0x1400f8f30]
nop
movzx ecx, byte [r10]
lea r10, [r10 + 1]
dec r9d
movzx edx, byte [rcx + rdi]
lea ecx, [rax*8]
xor edx, ecx
xor eax, edx
test r9d, r9d
jg 0x1400653d0
mov rdi, qword [rsp + 0x20]
xor edx, edx
div dword [r11]
jmp 0x1400653fd
xor edx, edx
mov r9d, edx
mov rcx, r11
mov rdx, rbx
call fcn.1400652e0
mov rbx, qword [rsp + 0x30]
test rax, rax
je 0x14006541e
mov rax, qword [rax + 0x10]
add rsp, 0x28
ret
add rsp, 0x28
ret
Function at 0x140065430
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x20
mov r14, r9
lea r12, [0x1400f8f30]
mov r9d, dword [rcx]
mov esi, r8d
mov rbp, rdx
mov rdi, rcx
test r9d, r9d
je 0x14006549a
xor eax, eax
mov r10, rdx
test r8d, r8d
jle 0x140065490
nop
movzx ecx, byte [r10]
lea r10, [r10 + 1]
dec r8d
movzx edx, byte [rcx + r12]
lea ecx, [rax*8]
xor edx, ecx
xor eax, edx
test r8d, r8d
jg 0x140065470
xor edx, edx
div r9d
mov r15d, edx
jmp 0x14006549d
xor r15d, r15d
mov r9d, r15d
mov qword [rsp + 0x40], rbx
mov r8d, esi
mov rdx, rbp
mov rcx, rdi
call fcn.1400652e0
mov rcx, rax
test rax, rax
je 0x140065536
mov rbx, qword [rax + 0x10]
test r14, r14
jne 0x140065526
mov rdx, qword [rax + 8]
mov rax, qword [rax]
test rdx, rdx
je 0x1400654d5
mov qword [rdx], rax
jmp 0x1400654d9
mov qword [rdi + 8], rax
mov rdx, qword [rcx]
test rdx, rdx
je 0x1400654e9
mov rax, qword [rcx + 8]
mov qword [rdx + 8], rax
mov rax, qword [rdi + 0x10]
test rax, rax
je 0x14006550b
mov edx, r15d
shl rdx, 4
add rdx, rax
cmp qword [rdx + 8], rcx
jne 0x140065509
mov rax, qword [rcx]
mov qword [rdx + 8], rax
dec dword [rdx]
call fcn.140060fe0
add dword [rdi + 4], 0xffffffff
jne 0x14006552e
mov rcx, rdi
call fcn.140065060
mov rax, rbx
jmp 0x14006562e
mov qword [rax + 0x10], r14
mov qword [rax + 0x18], rbp
mov rax, rbx
jmp 0x14006562e
test r14, r14
je 0x14006562c
mov ecx, 0x28
call fcn.140060ca0
mov rbx, rax
test rax, rax
jne 0x140065559
mov rax, r14
jmp 0x14006562e
mov qword [rax + 0x18], rbp
mov dword [rax + 0x20], esi
mov qword [rax + 0x10], r14
mov edx, dword [rdi + 4]
inc edx
mov dword [rdi + 4], edx
cmp edx, 0xa
jb 0x1400655b5
mov eax, dword [rdi]
add eax, eax
cmp edx, eax
jbe 0x1400655b5
add edx, edx
mov rcx, rdi
call fcn.140065150
test eax, eax
je 0x1400655b5
xor eax, eax
test esi, esi
jle 0x1400655ae
nop dword [rax]
movzx ecx, byte [rbp]
lea rbp, [rbp + 1]
dec esi
movzx edx, byte [rcx + r12]
lea ecx, [rax*8]
xor edx, ecx
xor eax, edx
test esi, esi
jg 0x140065590
xor edx, edx
div dword [rdi]
mov r15d, edx
mov rcx, qword [rdi + 0x10]
test rcx, rcx
je 0x14006560c
mov edx, r15d
shl rdx, 4
add rdx, rcx
je 0x14006560c
mov eax, dword [rdx]
test eax, eax
je 0x1400655d6
mov rcx, qword [rdx + 8]
jmp 0x1400655d8
xor ecx, ecx
inc eax
mov qword [rdx + 8], rbx
mov dword [rdx], eax
test rcx, rcx
je 0x14006560c
mov qword [rbx], rcx
mov rax, qword [rcx + 8]
mov qword [rbx + 8], rax
mov rax, qword [rcx + 8]
test rax, rax
je 0x140065602
mov qword [rax], rbx
mov qword [rcx + 8], rbx
jmp 0x14006562c
mov qword [rdi + 8], rbx
mov qword [rcx + 8], rbx
jmp 0x14006562c
mov rax, qword [rdi + 8]
mov qword [rbx], rax
mov rax, qword [rdi + 8]
test rax, rax
je 0x140065620
mov qword [rax + 8], rbx
mov qword [rbx + 8], 0
mov qword [rdi + 8], rbx
xor eax, eax
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x20
pop r15
pop r14
pop r12
ret
Function at 0x14009d1e0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x20
mov rbx, rdx
mov rdi, rcx
test rcx, rcx
je 0x14009d387
test rdx, rdx
je 0x14009d387
movzx ecx, word [rcx + 2]
bt cx, 0xb
mov qword [rsp + 0x40], rbp
mov qword [rsp + 0x48], r14
mov qword [rsp + 0x50], r15
jb 0x14009d266
movzx eax, word [rdx + 2]
bt ax, 0xb
jb 0x14009d266
xor al, cl
test al, 0x10
jne 0x14009d266
movzx eax, byte [rdx]
cmp byte [rdi], al
jne 0x14009d266
mov rdx, qword [rdx + 0x10]
mov rcx, qword [rdi + 0x10]
call fcn.14009d1e0
test eax, eax
jne 0x14009d266
mov rdx, qword [rbx + 0x18]
mov rcx, qword [rdi + 0x18]
call fcn.14009d1e0
test eax, eax
jne 0x14009d266
mov r15, qword [rdi + 0x20]
mov rbp, qword [rbx + 0x20]
test r15, r15
jne 0x14009d282
test rbp, rbp
je 0x14009d2d1
mov eax, 2
mov r14, qword [rsp + 0x48]
mov rbp, qword [rsp + 0x40]
mov r15, qword [rsp + 0x50]
add rsp, 0x20
pop rdi
pop rsi
pop rbx
ret
test rbp, rbp
je 0x14009d266
mov eax, dword [r15]
cmp eax, dword [rbp]
jne 0x14009d266
xor esi, esi
test eax, eax
jle 0x14009d2d1
mov r14d, esi
nop dword [rax + rax]
mov rdx, qword [rbp + 8]
mov rcx, qword [r15 + 8]
movzx eax, byte [rdx + r14 + 0x18]
cmp byte [rcx + r14 + 0x18], al
jne 0x14009d266
mov rdx, qword [rdx + r14]
mov rcx, qword [rcx + r14]
call fcn.14009d1e0
test eax, eax
jne 0x14009d266
inc esi
add r14, 0x20
cmp esi, dword [r15]
jl 0x14009d2a0
mov eax, dword [rbx + 0x30]
cmp dword [rdi + 0x30], eax
jne 0x14009d266
movzx eax, word [rbx + 0x34]
cmp word [rdi + 0x34], ax
jne 0x14009d266
movzx r9d, word [rdi + 2]
mov ecx, 0x400
test cx, r9w
je 0x14009d305
test word [rbx + 2], cx
je 0x14009d266
mov eax, dword [rbx + 8]
cmp dword [rdi + 8], eax
jmp 0x14009d346
movzx eax, byte [rdi]
add al, 0x68
test al, 0xfd
je 0x14009d34c
mov rax, qword [rdi + 8]
test rax, rax
je 0x14009d34c
test word [rbx + 2], cx
jne 0x14009d266
mov r8, qword [rbx + 8]
test r8, r8
je 0x14009d266
sub r8, rax
movzx edx, byte [rax]
movzx ecx, byte [rax + r8]
sub edx, ecx
jne 0x14009d344
inc rax
test ecx, ecx
jne 0x14009d331
test edx, edx
jne 0x14009d266
movzx eax, word [rbx + 2]
mov ecx, 0x100
and r9w, cx
and ax, cx
cmp r9w, ax
je 0x14009d36c
mov eax, 1
jmp 0x14009d26b
test r9w, r9w
je 0x14009d380
mov rax, qword [rbx + 0x28]
cmp qword [rdi + 0x28], rax
jne 0x14009d266
xor eax, eax
jmp 0x14009d26b
xor esi, esi
mov eax, 2
cmp rbx, rdi
cmove eax, esi
add rsp, 0x20
pop rdi
pop rsi
pop rbx
ret