joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140135970
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push r14
mov eax, 0x20
call fcn.1400fe1d0
sub rsp, rax
mov rax, qword [rcx + 8]
lea r14d, [r9 + 1]
mov rbx, rdx
mov rsi, rcx
mov edx, dword [rdx + 4]
mov r9, qword [rax + 0xc8]
test byte [r9 + 0x70], 1
je 0x140135a62
lea eax, [r14 + r8]
cmp eax, edx
ja 0x140135a6b
mov eax, r8d
add qword [rbx + 0x10], rax
add qword [rbx + 0x18], rax
sub edx, r8d
mov dword [rbx + 4], edx
test dword [rsi + 0x19c], 0x200
lea ecx, [rdx - 1]
mov rax, qword [rbx + 0x10]
mov qword [rsp + 0x48], rdi
movzx edi, byte [rcx + rax]
je 0x140135a2b
cmp qword [rsi + 0xe0], 0
jne 0x140135a2b
mov rcx, qword [rsi + 0x80]
lea rdx, [0x1402bd4f0]
add rcx, 8
mov r8d, 8
call fcn.1400d1380
test eax, eax
jne 0x140135a19
test dil, 1
jne 0x140135a19
mov rax, qword [rsi + 0x80]
or dword [rax], 8
mov rax, qword [rsi + 0x80]
test byte [rax], 8
je 0x140135a2b
test edi, edi
je 0x140135a2b
dec edi
mov rcx, qword [rsi + 0xd0]
mov rcx, qword [rcx]
call fcn.140123180
mov r8d, dword [rbx + 4]
and eax, 0x200000
je 0x140135a76
sub r8d, edi
mov eax, 1
mov rdi, qword [rsp + 0x48]
dec r8d
mov dword [rbx + 4], r8d
add rsp, 0x20
pop r14
pop rsi
pop rbx
ret
cmp r14d, edx
jbe 0x1401359c2
xor eax, eax
add rsp, 0x20
pop r14
pop rsi
pop rbx
ret
lea ecx, [rdi + r14]
mov esi, 0xff
mov r9d, r8d
mov eax, r8d
sub r9d, ecx
xor eax, ecx
xor r9d, ecx
or r9d, eax
lea eax, [r8 - 1]
xor r9d, r8d
shr r9d, 0x1f
dec r9d
cmp eax, esi
cmovb esi, eax
xor r10d, r10d
test esi, esi
je 0x140135aff
mov r11d, edi
mov qword [rsp + 0x40], rbp
mov rbp, qword [rbx + 0x10]
shr r11d, 0x1f
nop word [rax + rax]
mov eax, r10d
mov ecx, edi
sub ecx, r10d
shr eax, 0x1f
shr ecx, 0x1f
xor cl, al
xor al, r11b
or cl, al
mov eax, r8d
sub eax, r10d
xor cl, r11b
dec cl
dec eax
movzx edx, cl
inc r10d
movzx ecx, byte [rax + rbp]
xor ecx, edi
and edx, ecx
not edx
and r9d, edx
cmp r10d, esi
jb 0x140135ac0
mov rbp, qword [rsp + 0x40]
lea eax, [rdi + 1]
not r9d
mov rdi, qword [rsp + 0x48]
movzx ecx, r9b
dec ecx
shr ecx, 0x1f
neg ecx
and eax, ecx
sub r8d, eax
shl eax, 8
or dword [rbx], eax
mov eax, ecx
and eax, 1
mov dword [rbx + 4], r8d
not ecx
or eax, ecx
add rsp, 0x20
pop r14
pop rsi
pop rbx
ret
Function at 0x14013b620
Capabilities:
Encode data using base64

Disassembly:
mov eax, 8
call fcn.1400fe1d0
sub rsp, rax
xor r10d, r10d
mov r9, rcx
test r8d, r8d
jle 0x14013b732
mov qword [rsp + 0x10], rbx
inc rdx
mov qword [rsp], rdi
lea rdi, [0x1402012e0]
nop
movzx eax, byte [rdx - 1]
cmp r8d, 3
jb 0x14013b6af
mov ecx, eax
movzx eax, byte [rdx]
shl rcx, 8
or rcx, rax
movzx eax, byte [rdx + 1]
shl rcx, 8
or rcx, rax
mov rax, rcx
shr rax, 0x12
movzx eax, byte [rax + rdi]
mov byte [r9], al
mov rax, rcx
shr rax, 0xc
and eax, 0x3f
movzx eax, byte [rax + rdi]
mov byte [r9 + 1], al
mov rax, rcx
and eax, 0x3f
shr rcx, 6
add r9, 2
and ecx, 0x3f
movzx ebx, byte [rax + rdi]
movzx eax, byte [rcx + rdi]
mov rcx, r9
jmp 0x14013b6fe
mov ecx, eax
shl ecx, 0x10
cmp r8d, 2
jne 0x14013b6c2
movzx eax, byte [rdx]
shl eax, 8
or ecx, eax
mov eax, ecx
shr rcx, 0x12
movzx ecx, byte [rcx + rdi]
mov byte [r9], cl
mov ecx, eax
shr rcx, 0xc
and ecx, 0x3f
movzx ecx, byte [rcx + rdi]
mov byte [r9 + 1], cl
add r9, 2
mov rcx, r9
cmp r8d, 1
jne 0x14013b6f1
mov al, 0x3d
jmp 0x14013b6fc
shr rax, 6
and eax, 0x3f
movzx eax, byte [rax + rdi]
mov bl, 0x3d
mov byte [r9], al
add r10d, 4
add rdx, 3
mov byte [rcx + 1], bl
sub r8d, 3
lea r9, [rcx + 2]
test r8d, r8d
jg 0x14013b650
mov rdi, qword [rsp]
mov eax, r10d
mov rbx, qword [rsp + 0x10]
mov byte [rcx + 2], 0
add rsp, 8
ret
mov byte [rcx], r10b
mov eax, r10d
add rsp, 8
ret
Function at 0x140149d60
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov eax, 0x28
call fcn.1400fe1d0
sub rsp, rax
add rsp, 0x28
jmp fcn.140149da0
Function at 0x14014c190
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x20], r9
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov eax, 0x30
call fcn.1400fe1d0
sub rsp, rax
mov r10, r9
mov rbx, r8
mov r9, qword [rsp + 0xa0]
mov r14, rdx
mov rbp, rcx
mov edi, dword [r9]
mov dword [rsp + 0x80], edi
test edi, edi
je 0x14014c208
mov rdx, qword [rsp + 0x98]
nop dword [rax]
test rbx, rbx
je 0x14014c201
mov eax, edi
dec rbx
movzx ecx, byte [rax + rdx]
xor cl, byte [rbp]
inc rbp
mov byte [r14], cl
inc r14
inc edi
and edi, 0xf
jne 0x14014c1e0
mov dword [rsp + 0x80], edi
mov r8, qword [rsp + 0x90]
mov esi, 1
movzx r12d, byte [r8 + 0xc]
lea r15, [r8 + 0xc]
mov r11, qword [rsp + 0xa8]
shl r12d, 8
movzx eax, byte [r8 + 0xd]
lea r13d, [rsi + 0xb]
or r12d, eax
movzx eax, byte [r8 + 0xe]
shl r12d, 8
or r12d, eax
movzx eax, byte [r8 + 0xf]
shl r12d, 8
or r12d, eax
cmp rbx, 0x10
jb 0x14014c33e
mov eax, 0x10000000
mov edi, r13d
mov qword [rsp + 0x20], r8
mov rdx, rbx
shr rdx, 4
mov r9, r10
cmp rdx, rax
cmova rdx, rax
add r12d, edx
mov r13, rdx
mov eax, r12d
mov ecx, r12d
sub r13, rax
cmp rax, rdx
cmovae r13, rdx
xor r12d, r12d
cmp rax, rdx
mov r8, r13
mov rdx, r14
cmovae r12d, ecx
mov rcx, rbp
call r11
mov r8, qword [rsp + 0x90]
mov eax, r12d
shr eax, 0x18
mov byte [r15], al
mov eax, r12d
shr eax, 0x10
mov byte [r8 + 0xd], al
mov eax, r12d
shr eax, 8
mov byte [r8 + 0xe], al
mov byte [r8 + 0xf], r12b
test r12d, r12d
jne 0x14014c2fd
mov r8d, edi
mov eax, esi
mov rdx, r15
nop dword [rax + rax]
movzx ecx, byte [rdx - 1]
lea rdx, [rdx - 1]
add eax, ecx
mov byte [rdx], al
shr eax, 8
add r8d, 0xffffffff
jne 0x14014c2e0
mov r8, qword [rsp + 0x90]
mov r10, qword [rsp + 0x88]
mov eax, 0x10000000
mov r11, qword [rsp + 0xa8]
shl r13, 4
sub rbx, r13
add r14, r13
add rbp, r13
cmp rbx, 0x10
jae 0x14014c260
mov edi, dword [rsp + 0x80]
mov r13d, recv
mov r9, qword [rsp + 0xa0]
test rbx, rbx
je 0x14014c3e1
mov rax, qword [rsp + 0x98]
xorps xmm0, xmm0
mov qword [rsp + 0x20], r8
mov r9, r10
mov r8, rsi
mov rdx, rax
mov rcx, rax
movups xmmword [rax], xmm0
call r11
mov rcx, qword [rsp + 0x90]
inc r12d
mov eax, r12d
shr eax, 0x18
mov byte [r15], al
mov eax, r12d
shr eax, 0x10
mov byte [rcx + 0xd], al
mov eax, r12d
shr eax, 8
mov byte [rcx + 0xe], al
mov byte [rcx + 0xf], r12b
test r12d, r12d
jne 0x14014c3b7
nop dword [rax + rax]
movzx eax, byte [r15 - 1]
lea r15, [r15 - 1]
add esi, eax
mov byte [r15], sil
shr esi, 8
add r13d, 0xffffffff
jne 0x14014c3a0
mov rdx, qword [rsp + 0x98]
nop
mov ecx, edi
inc edi
movzx eax, byte [rcx + rbp]
xor al, byte [rcx + rdx]
mov byte [rcx + r14], al
sub rbx, 1
jne 0x14014c3c0
mov rax, qword [rsp + 0xa0]
mov dword [rax], edi
jmp 0x14014c3e4
mov dword [r9], edi
mov rbx, qword [rsp + 0x70]
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x14014cf00
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rbp
push r14
mov eax, 0x20
call fcn.1400fe1d0
sub rsp, rax
cmp qword [rcx + 0x38], 0
mov rbx, r8
mov r14, rdx
mov rbp, rcx
je 0x14014cf30
mov eax, 0xfffffffe
add rsp, 0x20
pop r14
pop rbp
pop rbx
ret
mov rcx, qword [rcx + 0x30]
movabs rax, 0x2000000000000000
add rcx, rbx
cmp rcx, rax
ja 0x14014d022
cmp rcx, rbx
jb 0x14014d022
mov qword [rsp + 0x40], rsi
mov esi, dword [rbp + 0x174]
mov qword [rsp + 0x48], rdi
mov qword [rsp + 0x50], r12
mov qword [rbp + 0x30], rcx
test esi, esi
je 0x14014cfa5
test rbx, rbx
je 0x14014d002
movzx eax, byte [r14]
dec rbx
mov ecx, esi
inc r14
xor byte [rcx + rbp + 0x40], al
inc esi
and esi, 0xf
jne 0x14014cf70
lea r12, [rbp + 0x60]
lea rdi, [rbp + 0x40]
mov rdx, r12
mov rcx, rdi
call fcn.14014e030
jmp 0x14014cfad
lea r12, [rbp + 0x60]
lea rdi, [rbp + 0x40]
mov qword [rsp + 0x58], r15
mov r15, rbx
and r15, 0xfffffffffffffff0
je 0x14014cfd2
mov r9, r15
mov r8, r14
mov rdx, r12
mov rcx, rdi
call fcn.14014e1a0
add r14, r15
sub rbx, r15
mov r15, qword [rsp + 0x58]
test rbx, rbx
je 0x14014d002
mov esi, ebx
sub r14, rbp
nop dword [rax]
nop word [rax + rax]
movzx eax, byte [r14 + rdi - 0x40]
xor byte [rdi], al
lea rdi, [rdi + 1]
sub rbx, 1
jne 0x14014cff0
mov rdi, qword [rsp + 0x48]
xor eax, eax
mov r12, qword [rsp + 0x50]
mov dword [rbp + 0x174], esi
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop r14
pop rbp
pop rbx
ret
mov eax, 0xffffffff
add rsp, 0x20
pop r14
pop rbp
pop rbx
ret
Function at 0x14014e030
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
movzx eax, byte [rcx + 0xf]
lea rsi, [0x140204cc0]
mov r8d, eax
mov r11, rcx
and eax, 0xf
and r8, 0xfffffffffffffff0
add rax, rax
mov rbx, rdx
mov edi, reloc.WS2_32.dll_ntohl
mov r10, qword [rdx + rax*8 + 8]
mov r9, qword [rdx + rax*8]
mov rcx, r10
and ecx, 0xf
shr r10, 4
mov rax, r9
shl r9, 0x3c
shr rax, 4
or r10, r9
xor rax, qword [rsi + rcx*8]
xor rax, qword [r8 + rdx]
xor r10, qword [r8 + rdx + 8]
movzx ecx, byte [rdi + r11]
mov r9, rax
mov r8d, ecx
shl rax, 0x3c
and ecx, 0xf
shr r9, 4
add rcx, rcx
and r8, 0xfffffffffffffff0
lea rdx, [rbx + rcx*8]
mov rcx, r10
shr r10, 4
and ecx, 0xf
or rax, r10
xor rax, qword [rdx + 8]
xor r9, qword [rsi + rcx*8]
mov rcx, rax
xor r9, qword [rdx]
and ecx, 0xf
mov rdx, rax
mov r10, r9
shl r10, 0x3c
mov rax, r9
shr rax, 4
xor rax, qword [rsi + rcx*8]
xor rax, qword [r8 + rbx]
shr rdx, 4
or r10, rdx
xor r10, qword [r8 + rbx + 8]
sub rdi, 1
jns 0x14014e090
mov rbx, qword [rsp + 8]
mov rdx, rax
mov rsi, qword [rsp + 0x10]
mov rdi, qword [rsp + 0x18]
mov byte [r11 + 7], al
shr rdx, 0x20
mov ecx, edx
mov byte [r11 + 3], dl
shr ecx, 0x18
mov byte [r11], cl
mov ecx, edx
shr ecx, 0x10
mov byte [r11 + 1], cl
mov ecx, edx
shr ecx, 8
mov byte [r11 + 2], cl
mov ecx, eax
shr ecx, 0x18
mov byte [r11 + 4], cl
mov ecx, eax
shr ecx, 0x10
mov byte [r11 + 5], cl
mov ecx, eax
shr ecx, 8
mov byte [r11 + 6], cl
mov rcx, r10
shr rcx, 0x20
mov eax, ecx
mov byte [r11 + 0xb], cl
shr eax, 0x18
mov byte [r11 + 8], al
mov eax, ecx
shr eax, 0x10
mov byte [r11 + 9], al
mov eax, ecx
shr eax, 8
mov byte [r11 + 0xa], al
mov eax, r10d
shr eax, 0x18
mov byte [r11 + 0xc], al
mov eax, r10d
shr eax, 0x10
mov byte [r11 + 0xd], al
mov eax, r10d
shr eax, 8
mov byte [r11 + 0xe], al
mov byte [r11 + 0xf], r10b
ret
Function at 0x14014e1a0
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r12
push r14
push r15
movzx r10d, byte [rcx + 0xf]
lea rbp, [r8 + 0xe]
mov rdi, rcx
lea r12, [0x140204cc0]
sub rdi, r8
mov r15, r9
mov rsi, rdx
mov r11, rcx
nop dword [rax]
movzx ecx, byte [rbp + 1]
mov rbx, rbp
movzx eax, r10b
mov r14d, recv
xor rcx, rax
mov rdx, rcx
and ecx, 0xf
add rcx, rcx
and rdx, 0xfffffffffffffff0
mov r8, qword [rsi + rcx*8]
mov r10, qword [rsi + rcx*8 + 8]
mov rax, r8
mov rcx, r10
shr rax, 4
and ecx, 0xf
shr r10, 4
shl r8, 0x3c
or r10, r8
xor rax, qword [r12 + rcx*8]
xor rax, qword [rdx + rsi]
xor r10, qword [rdx + rsi + 8]
nop
movzx ecx, byte [rbx]
mov r9, rax
movzx edx, byte [rdi + rbx]
lea rbx, [rbx - 1]
xor rdx, rcx
shl rax, 0x3c
mov rcx, r10
shr r9, 4
shr r10, 4
mov r8, rdx
or rax, r10
and edx, 0xf
add rdx, rdx
and ecx, 0xf
and r8, 0xfffffffffffffff0
xor rax, qword [rsi + rdx*8 + 8]
xor r9, qword [r12 + rcx*8]
mov rcx, rax
xor r9, qword [rsi + rdx*8]
and ecx, 0xf
mov rdx, rax
mov r10, r9
shl r10, 0x3c
mov rax, r9
shr rax, 4
xor rax, qword [r12 + rcx*8]
xor rax, qword [r8 + rsi]
shr rdx, 4
or r10, rdx
xor r10, qword [r8 + rsi + 8]
sub r14, 1
jne 0x14014e230
mov rdx, rax
mov byte [r11 + 7], al
shr rdx, 0x20
add rbp, 0x10
mov ecx, edx
mov byte [r11 + 3], dl
shr ecx, 0x18
sub rdi, 0x10
mov byte [r11], cl
mov ecx, edx
shr ecx, 0x10
mov byte [r11 + 1], cl
mov ecx, edx
shr ecx, 8
mov byte [r11 + 2], cl
mov ecx, eax
shr ecx, 0x18
mov byte [r11 + 4], cl
mov ecx, eax
shr ecx, 0x10
mov byte [r11 + 5], cl
mov ecx, eax
shr ecx, 8
mov byte [r11 + 6], cl
mov rcx, r10
shr rcx, 0x20
mov eax, ecx
mov byte [r11 + 0xb], cl
shr eax, 0x18
mov byte [r11 + 8], al
mov eax, ecx
shr eax, 0x10
mov byte [r11 + 9], al
mov eax, ecx
shr eax, 8
mov byte [r11 + 0xa], al
mov eax, r10d
shr eax, 0x18
mov byte [r11 + 0xc], al
mov eax, r10d
shr eax, 0x10
mov byte [r11 + 0xd], al
mov eax, r10d
shr eax, 8
mov byte [r11 + 0xe], al
mov byte [r11 + 0xf], r10b
sub r15, 0x10
jne 0x14014e1e0
mov rbx, qword [rsp + 0x20]
mov rbp, qword [rsp + 0x28]
mov rsi, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x38]
pop r15
pop r14
pop r12
ret

Function at 0x140151f00
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x38
call fcn.1400fe1d0
sub rsp, rax
cmp dword [rsp + 0x68], 0
je 0x140151f29
lea rax, [0x140150230]
mov qword [rsp + 0x68], rax
add rsp, 0x38
jmp fcn.14014bbb0
lea rax, [0x140151080]
mov qword [rsp + 0x68], rax
add rsp, 0x38
jmp fcn.14014bd70
Function at 0x140162150
Capabilities:
Check for software breakpoints

Disassembly:
mov eax, 0x38
call fcn.1400fe1d0
sub rsp, rax
mov r11, rcx
cmp dword [rsp + 0x60], r9d
jne 0x140162243
movzx r10d, byte [r8]
lea eax, [r10 - 0x6a]
cmp al, 1
ja 0x140162243
mov qword [rsp + 0x30], rbx
lea rdx, [r8 + 1]
cmp r10b, 0x6b
jne 0x1401621f0
lea ebx, [r9 - 3]
xor eax, eax
test ebx, ebx
jle 0x1401621aa
movzx ecx, byte [rdx]
inc rdx
cmp cl, 0xba
je 0x1401621aa
cmp cl, 0xbb
jne 0x1401621df
inc eax
cmp eax, ebx
jl 0x140162194
sub ebx, eax
test eax, eax
jne 0x1401621f4
mov dword [rsp + 0x20], 0x83
lea r9, [0x140289120]
mov edx, 0x80
lea ecx, [rdx - 0x7c]
lea r8d, [rdx + 0xa]
call fcn.1400d2310
mov rbx, qword [rsp + 0x30]
mov eax, 0xffffffff
add rsp, 0x38
ret
mov dword [rsp + 0x20], 0x7b
lea r9, [0x140289108]
jmp 0x1401621bf
lea ebx, [r9 - 2]
movsxd rax, ebx
cmp byte [rax + rdx], 0xcc
je 0x14016222c
mov edx, 0x80
mov dword [rsp + 0x20], 0x8b
lea r9, str..crypto_rsa_rsa_x931.c
lea ecx, [rdx - 0x7c]
lea r8d, [rdx + 0xb]
call fcn.1400d2310
mov rbx, qword [rsp + 0x30]
mov eax, 0xffffffff
add rsp, 0x38
ret
mov r8d, ebx
mov rcx, r11
call fcn.1401a0ad0
mov eax, ebx
mov rbx, qword [rsp + 0x30]
add rsp, 0x38
ret
mov edx, 0x80
mov dword [rsp + 0x20], reloc.WS2_32.dll_WSASetLastError
lea r9, [0x1402890f0]
lea ecx, [rdx - 0x7c]
lea r8d, [rdx + 9]
call fcn.1400d2310
mov eax, 0xffffffff
add rsp, 0x38
ret
Function at 0x140178fd0
Capabilities:
Check for time delay via gettickcount

Disassembly:
mov eax, 0x28
call fcn.1400fe1d0
sub rsp, rax
cmp dword [0x14028c68c], 0
je 0x140179018
lea rcx, [rsp + 0x38]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
test eax, eax
jne 0x140178ffd
mov dword [0x14028c68c], eax
jmp 0x140179018
xorps xmm2, xmm2
lea rcx, [rsp + 0x38]
mov edx, 8
call fcn.1400fdc90
cmp dword [0x14028c68c], 0
jne 0x140179034
call qword [sym.imp.KERNEL32.dll_GetTickCount]
xorps xmm2, xmm2
lea rcx, [rsp + 0x30]
mov edx, 4
mov dword [rsp + 0x30], eax
call fcn.1400fdc90
add rsp, 0x28
ret
Function at 0x140183c40
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov rbp, rsp
mov eax, 0x50
call fcn.1400fe1d0
sub rsp, rax
mov rax, qword [0x14025ef38]
xor rax, rsp
mov qword [rbp - 8], rax
mov rax, qword [rbp + 0x60]
mov r14d, r8d
movzx r8d, byte [rax + 4]
lea rdi, [rax + 1]
mov r13, qword [rbp + 0x68]
mov rsi, rcx
movzx ecx, byte [rdi + 5]
xor r15d, r15d
movzx r10d, byte [rax]
mov r12, rdx
mov qword [rbp - 0x18], rax
movzx eax, byte [rdi]
mov ebx, dword [r13]
shl eax, 0x10
shl r10d, 0x18
or r10d, eax
shl r8d, 0x18
movzx eax, byte [rdi + 1]
shl eax, 8
or r10d, eax
shl ecx, 8
movzx eax, byte [rdi + 2]
or r10d, eax
mov qword [rbp - 0x28], r9
movzx eax, byte [rdi + 4]
shl eax, 0x10
or r8d, eax
mov qword [rbp - 0x20], r13
movzx eax, byte [rdi + 6]
or ecx, eax
mov dword [rbp - 0x30], r10d
or r8d, ecx
mov byte [rbp - 0xd], r10b
mov eax, r10d
mov dword [rbp - 0x2c], r8d
shr eax, 0x18
mov byte [rbp - 0x10], al
mov eax, r10d
shr eax, 0x10
mov byte [rbp - 0xf], al
mov eax, r10d
shr eax, 8
mov byte [rbp - 0xe], al
mov eax, r8d
shr eax, 0x18
mov byte [rbp - 0xc], al
mov eax, r8d
shr eax, 0x10
mov byte [rbp - 0xb], al
mov eax, r8d
shr eax, 8
mov byte [rbp - 0xa], al
mov byte [rbp - 9], r8b
test r14d, r14d
je 0x140183e04
mov r13, qword [rbp - 0x28]
sub r12, rsi
movzx edx, r8b
movzx r9d, r10b
nop dword [rax]
dec r14d
test ebx, ebx
jne 0x140183da3
mov rdx, r13
lea rcx, [rbp - 0x30]
call fcn.140182c00
mov r10d, dword [rbp - 0x30]
mov eax, r10d
mov r8d, dword [rbp - 0x2c]
movzx r9d, r10b
shr eax, 0x18
movzx edx, r8b
mov byte [rbp - 0x10], al
mov eax, r10d
shr eax, 0x10
mov byte [rbp - 0xf], al
mov eax, r10d
shr eax, 8
mov byte [rbp - 0xe], al
mov eax, r8d
shr eax, 0x18
mov byte [rbp - 0xc], al
mov eax, r8d
shr eax, 0x10
mov byte [rbp - 0xb], al
mov eax, r8d
shr eax, 8
mov byte [rbp - 0xa], al
inc r15d
mov byte [rbp - 0xd], r10b
mov byte [rbp - 9], dl
movsxd rax, ebx
movzx ecx, byte [rbp + rax - 0x10]
xor cl, byte [rsi]
mov byte [r12 + rsi], cl
inc rsi
inc ebx
and ebx, 7
test r14d, r14d
jne 0x140183d40
mov r13, qword [rbp - 0x20]
test r15d, r15d
je 0x140183e04
mov rcx, qword [rbp - 0x18]
mov eax, r10d
shr eax, 0x18
mov byte [rdi + 2], r9b
mov byte [rdi + 6], dl
mov byte [rcx], al
mov eax, r10d
shr eax, 0x10
mov byte [rdi], al
mov eax, r8d
shr eax, 0x18
mov byte [rdi + 3], al
mov eax, r8d
shr eax, 0x10
shr r10d, 8
shr r8d, 8
mov byte [rdi + 5], r8b
mov byte [rdi + 1], r10b
mov byte [rdi + 4], al
mov dword [r13], ebx
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.1400fe230
mov rbx, qword [rsp + 0x90]
add rsp, 0x50
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x1401951e0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
mov eax, 0x20
call fcn.1400fe1d0
sub rsp, rax
mov r9d, dword [rdx + 8]
mov rsi, rdx
cmp r9d, dword [r8 + 8]
mov rdi, r8
mov rbx, rcx
cmovge rdi, rdx
cmovge rsi, r8
mov edx, dword [rdi + 8]
cmp edx, dword [rcx + 0xc]
jg 0x14019521e
mov rax, rcx
jmp 0x140195223
call fcn.140103060
test rax, rax
jne 0x140195238
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
xor r8d, r8d
cmp dword [rsi + 8], r8d
jle 0x140195275
xor r9d, r9d
nop dword [rax]
nop dword [rax + rax]
mov rax, qword [rsi]
lea r9, [r9 + 8]
mov rcx, qword [rdi]
inc r8d
mov rdx, qword [rcx + r9 - 8]
xor rdx, qword [r9 + rax - 8]
mov rax, qword [rbx]
mov qword [r9 + rax - 8], rdx
cmp r8d, dword [rsi + 8]
jl 0x140195250
mov eax, dword [rdi + 8]
cmp r8d, eax
jge 0x1401952af
movsxd rax, r8d
lea rdx, [rax*8]
nop dword [rax + rax]
mov rax, qword [rdi]
lea rdx, [rdx + 8]
mov rcx, qword [rbx]
inc r8d
mov rax, qword [rdx + rax - 8]
mov qword [rdx + rcx - 8], rax
mov eax, dword [rdi + 8]
cmp r8d, eax
jl 0x140195290
mov dword [rbx + 8], eax
test eax, eax
jle 0x1401952db
mov rcx, qword [rbx]
sub rcx, 8
movsxd r8, eax
lea r8, [rcx + r8*8]
mov rcx, qword [r8]
lea r8, [r8 - 8]
test rcx, rcx
jne 0x1401952d6
dec eax
test eax, eax
jg 0x1401952c4
mov dword [rbx + 8], eax
test eax, eax
jne 0x1401952e4
mov dword [rbx + 0x10], 0
mov rbx, qword [rsp + 0x30]
mov eax, 1
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x1401ab708
Capabilities:
Parse pe header

Disassembly:
xor r8d, r8d
xor edx, edx
jmp 0x1401ab838
Function at 0x14002e6cc
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x50
cmp byte [rcx + 0x79], 0
je 0x14002e6e0
xor esi, esi
jmp 0x14002e896
mov rdi, rcx
mov rsi, qword [rcx + 0x48]
mov r9, qword [rcx + 0x50]
test byte [rcx], 1
je 0x14002e71b
lea rdx, [rdi + 8]
mov rax, qword [rdi + 0x58]
cmp qword [rdi + 0x38], 0xffffffffffffffff
mov rcx, qword [rdi + 0x60]
je 0x14002e7f7
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x20], rax
mov byte [rsp + 0x30], 0
jmp 0x14002e806
cmp byte [rdi + 0x1a], 0
jne 0x14002e821
mov r8, qword [rdi + 8]
mov al, byte [rdi + 0x18]
mov ecx, eax
xor al, 1
test r8, r8
je 0x14002e74c
cmp r8, r9
jae 0x14002e746
cmp byte [rsi + r8], 0xbf
jg 0x14002e74c
jmp 0x14002e8a1
jne 0x14002e8a1
cmp r8, r9
je 0x14002e815
mov r11b, byte [rsi + r8]
movzx edx, r11b
test dl, dl
jns 0x14002e7bd
mov r10d, edx
and r10d, 0x1f
movzx ebx, byte [rsi + r8 + 1]
and ebx, 0x3f
cmp dl, 0xdf
jbe 0x14002e7aa
movzx edx, byte [rsi + r8 + 2]
shl ebx, 6
and edx, 0x3f
or edx, ebx
cmp r11b, 0xf0
jb 0x14002e7b6
movzx r11d, byte [rsi + r8 + 3]
and r10d, 7
shl r10d, 0x12
shl edx, 6
and r11d, 0x3f
or r11d, edx
or r11d, r10d
mov edx, r11d
jmp 0x14002e7bd
shl r10d, 6
or r10d, ebx
mov edx, r10d
jmp 0x14002e7bd
shl r10d, 0xc
or edx, r10d
test cl, 1
jne 0x14002e825
mov ecx, 1
cmp edx, 0x80
jb 0x14002e7eb
mov ecx, 2
cmp edx, 0x800
jb 0x14002e7eb
cmp edx, 0x10000
mov ecx, 4
sbb rcx, 0
add r8, rcx
mov qword [rdi + 8], r8
jmp 0x14002e72c
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x20], rax
mov byte [rsp + 0x30], 1
lea rcx, [rsp + 0x38]
mov r8, rsi
call fcn.14002cf57
jmp 0x14002e83f
mov byte [rdi + 0x18], al
test cl, 1
jne 0x14002e82b
mov byte [rdi + 0x1a], 1
xor eax, eax
jmp 0x14002e83a
mov byte [rdi + 0x18], al
mov r9, r8
mov qword [rsp + 0x40], r9
mov qword [rsp + 0x48], r9
mov eax, 1
mov qword [rsp + 0x38], rax
test byte [rsp + 0x38], 1
je 0x14002e860
mov rdx, qword [rsp + 0x40]
mov rax, qword [rsp + 0x48]
mov rcx, qword [rdi + 0x68]
sub rdx, rcx
add rsi, rcx
mov qword [rdi + 0x68], rax
jmp 0x14002e896
cmp byte [rdi + 0x79], 0
jne 0x14002e6d9
mov byte [rdi + 0x79], 1
cmp byte [rdi + 0x78], 1
jne 0x14002e87e
mov rsi, qword [rdi + 0x68]
mov rdx, qword [rdi + 0x70]
jmp 0x14002e88f
mov rsi, qword [rdi + 0x68]
mov rdx, qword [rdi + 0x70]
cmp rdx, rsi
je 0x14002e6d9
sub rdx, rsi
add rsi, qword [rdi + 0x48]
mov rax, rsi
add rsp, 0x50
pop rbx
pop rdi
pop rsi
ret
mov byte [rdi + 0x18], al
lea rax, [0x1401c0130]
mov qword [rsp + 0x20], rax
mov rcx, rsi
mov rdx, r9
call fcn.1401a7a00
int3
Function at 0x1400538d6
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
push rbx
mov rax, rcx
add qword [rcx + 0x30], r8
mov r11, qword [rcx + 0x40]
test r11, r11
je 0x14005390c
mov r10d, 8
sub r10, r11
cmp r8, r10
mov rdi, r10
cmovb rdi, r8
cmp rdi, 4
jb 0x140053914
mov esi, dword [rdx]
mov r9d, 4
jmp 0x140053919
xor r10d, r10d
jmp 0x1400539c7
xor esi, esi
xor r9d, r9d
mov rcx, r9
or rcx, 1
cmp rcx, rdi
jae 0x14005393c
movzx ebx, word [rdx + r9]
lea ecx, [r9*8]
shl rbx, cl
or rsi, rbx
or r9, 2
cmp r9, rdi
jae 0x140053953
movzx edi, byte [rdx + r9]
shl r9d, 3
mov ecx, r9d
shl rdi, cl
or rsi, rdi
lea ecx, [r11*8]
shl rsi, cl
or rsi, qword [rax + 0x38]
mov qword [rax + 0x38], rsi
cmp r10, r8
jbe 0x140053973
add r11, r8
jmp 0x140053a97
mov rcx, qword [rax + 0x18]
xor rcx, rsi
mov rdi, qword [rax + 0x10]
mov r9, qword [rax]
add r9, rdi
mov r11, qword [rax + 8]
add r11, rcx
rol rdi, 0xd
xor rdi, r9
rol rcx, 0x10
rol r9, 0x20
xor rcx, r11
add r11, rdi
rol rdi, 0x11
add r9, rcx
xor rdi, r11
rol rcx, 0x15
mov qword [rax + 0x10], rdi
xor rcx, r9
rol r11, 0x20
mov qword [rax + 0x18], rcx
mov qword [rax + 8], r11
xor r9, rsi
mov qword [rax], r9
sub r8, r10
mov r11d, r8d
and r11d, 7
and r8, 0xfffffffffffffff8
cmp r10, r8
jae 0x140053a3b
mov rcx, qword [rax]
mov r9, qword [rax + 8]
mov rdi, qword [rax + 0x18]
mov rsi, qword [rax + 0x10]
mov rbx, qword [rdx + r10]
xor rdi, rbx
add rcx, rsi
rol rsi, 0xd
add r9, rdi
xor rsi, rcx
rol rdi, 0x10
xor rdi, r9
rol rcx, 0x20
add r9, rsi
add rcx, rdi
rol rsi, 0x11
xor rsi, r9
rol rdi, 0x15
rol r9, 0x20
xor rdi, rcx
xor rcx, rbx
add r10, 8
cmp r10, r8
jb 0x1400539e9
mov qword [rax + 0x18], rdi
mov qword [rax + 0x10], rsi
mov qword [rax + 8], r9
mov qword [rax], rcx
cmp r11d, 4
jb 0x140053a4d
mov r9d, dword [rdx + r10]
mov r8d, 4
jmp 0x140053a53
xor r9d, r9d
xor r8d, r8d
mov ecx, r8d
or ecx, 1
cmp ecx, r11d
jae 0x140053a79
lea rcx, [rdx + r8]
movzx esi, word [r10 + rcx]
lea ecx, [r8*8]
shl rsi, cl
or r9, rsi
or r8, 2
cmp r8d, r11d
jae 0x140053a93
add r10, r8
movzx edx, byte [rdx + r10]
shl r8d, 3
mov ecx, r8d
shl rdx, cl
or r9, rdx
mov qword [rax + 0x38], r9
mov qword [rax + 0x40], r11
pop rbx
pop rdi
pop rsi
ret