joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14006ede0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r14
sub rsp, 0x20
mov rax, qword [rcx + 0x70]
mov edi, edx
mov r14d, r9d
mov esi, r8d
mov rbp, rcx
movsxd rdx, dword [rax + 0x10]
mov eax, edx
imul eax, edi
movsxd rbx, eax
add rbx, qword [rcx + 0x78]
cmp r9d, 0xff
jge 0x14006ef26
mov qword [rsp + 0x40], r15
mov r15, rdx
nop word [rax + rax]
mov r8d, edi
lea rdx, [rsp + 0x48]
mov rcx, rbp
call fcn.14004b580
mov ecx, 0x100
inc edi
dec esi
mov edx, dword [rax]
mov r9d, edx
and edx, 0xff00ff
shr r9d, 8
imul edx, r14d
and r9d, 0xff00ff
imul r9d, r14d
shr edx, 8
and edx, 0xff00ff
shr r9d, 8
and r9d, 0xff00ff
mov eax, r9d
shr eax, 0x10
sub ecx, eax
mov eax, dword [rbx]
mov r8d, eax
shr eax, 8
and eax, 0xff00ff
and r8d, 0xff00ff
imul eax, ecx
imul r8d, ecx
mov ecx, 0x100
shr eax, 8
and eax, 0xff00ff
shr r8d, 8
add r9d, eax
and r8d, 0xff00ff
add r8d, edx
mov eax, r9d
shr eax, 8
mov edx, 0x100
and eax, 0xff00ff
sub edx, eax
mov eax, r9d
shl eax, 8
shl edx, 8
or edx, eax
mov eax, r8d
shr eax, 8
and eax, 0xff00ff
sub ecx, eax
mov eax, r9d
or ecx, r8d
shr eax, 8
xor edx, ecx
shl r9d, 8
and eax, 0xff00ff
and edx, 0xff00ff
mov ecx, 0x100
sub ecx, eax
shl ecx, 8
or ecx, r9d
xor edx, ecx
mov dword [rbx], edx
add rbx, r15
test esi, esi
jg 0x14006ee30
mov r15, qword [rsp + 0x40]
jmp 0x14006f000
mov r14, rdx
nop dword [rax]
mov r8d, edi
lea rdx, [rsp + 0x48]
mov rcx, rbp
call fcn.14004b580
mov ecx, 0x100
inc edi
dec esi
mov edx, dword [rax]
mov r9d, edx
and edx, 0xff00ff
shr r9d, 8
and r9d, 0xff00ff
mov eax, r9d
shr eax, 0x10
sub ecx, eax
mov eax, dword [rbx]
mov r8d, eax
shr eax, 8
and eax, 0xff00ff
and r8d, 0xff00ff
imul eax, ecx
imul r8d, ecx
mov ecx, 0x100
shr eax, 8
and eax, 0xff00ff
shr r8d, 8
add r9d, eax
and r8d, 0xff00ff
add r8d, edx
mov eax, r9d
shr eax, 8
mov edx, 0x100
and eax, 0xff00ff
sub edx, eax
mov eax, r9d
shl eax, 8
shl edx, 8
or edx, eax
mov eax, r8d
shr eax, 8
and eax, 0xff00ff
sub ecx, eax
mov eax, r9d
or ecx, r8d
shr eax, 8
xor edx, ecx
shl r9d, 8
and eax, 0xff00ff
and edx, 0xff00ff
mov ecx, 0x100
sub ecx, eax
shl ecx, 8
or ecx, r9d
xor edx, ecx
mov dword [rbx], edx
add rbx, r14
test esi, esi
jg 0x14006ef30
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
add rsp, 0x20
pop r14
pop rdi
pop rsi
ret
Function at 0x14006f020
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r14
sub rsp, 0x20
mov rax, qword [rcx + 0x38]
mov ebp, r8d
mov esi, edx
mov rdi, rcx
movsxd r9, dword [rax + 0x10]
mov eax, r9d
mov r14, r9
imul eax, edx
movsxd rbx, eax
add rbx, qword [rcx + 0x40]
nop dword [rax]
nop word [rax + rax]
mov r8d, esi
lea rdx, [rsp + 0x48]
mov rcx, rdi
call fcn.14004b510
mov ecx, 0x100
inc esi
dec ebp
mov edx, dword [rax]
mov r9d, edx
and edx, 0xff00ff
shr r9d, 8
and r9d, 0xff00ff
mov eax, r9d
shr eax, 0x10
sub ecx, eax
mov eax, dword [rbx]
mov r8d, eax
shr eax, 8
and eax, 0xff00ff
and r8d, 0xff00ff
imul eax, ecx
imul r8d, ecx
mov ecx, 0x100
shr eax, 8
and eax, 0xff00ff
shr r8d, 8
add r9d, eax
and r8d, 0xff00ff
add r8d, edx
mov eax, r9d
shr eax, 8
mov edx, 0x100
and eax, 0xff00ff
sub edx, eax
mov eax, r9d
shl eax, 8
shl edx, 8
or edx, eax
mov eax, r8d
shr eax, 8
and eax, 0xff00ff
sub ecx, eax
mov eax, r9d
or ecx, r8d
shr eax, 8
xor edx, ecx
shl r9d, 8
and eax, 0xff00ff
and edx, 0xff00ff
mov ecx, 0x100
sub ecx, eax
shl ecx, 8
or ecx, r9d
xor edx, ecx
mov dword [rbx], edx
add rbx, r14
test ebp, ebp
jg 0x14006f060
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x50]
add rsp, 0x20
pop r14
pop rdi
pop rsi
ret
Function at 0x14006f150
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r14
sub rsp, 0x20
mov rax, qword [rcx + 0x38]
mov edi, edx
mov r14d, r9d
mov esi, r8d
mov rbp, rcx
movsxd rdx, dword [rax + 0x10]
mov eax, edx
imul eax, edi
movsxd rbx, eax
add rbx, qword [rcx + 0x40]
cmp r9d, 0xff
jge 0x14006f296
mov qword [rsp + 0x40], r15
mov r15, rdx
nop word [rax + rax]
mov r8d, edi
lea rdx, [rsp + 0x48]
mov rcx, rbp
call fcn.14004b510
mov ecx, 0x100
inc edi
dec esi
mov edx, dword [rax]
mov r9d, edx
and edx, 0xff00ff
shr r9d, 8
imul edx, r14d
and r9d, 0xff00ff
imul r9d, r14d
shr edx, 8
and edx, 0xff00ff
shr r9d, 8
and r9d, 0xff00ff
mov eax, r9d
shr eax, 0x10
sub ecx, eax
mov eax, dword [rbx]
mov r8d, eax
shr eax, 8
and eax, 0xff00ff
and r8d, 0xff00ff
imul eax, ecx
imul r8d, ecx
mov ecx, 0x100
shr eax, 8
and eax, 0xff00ff
shr r8d, 8
add r9d, eax
and r8d, 0xff00ff
add r8d, edx
mov eax, r9d
shr eax, 8
mov edx, 0x100
and eax, 0xff00ff
sub edx, eax
mov eax, r9d
shl eax, 8
shl edx, 8
or edx, eax
mov eax, r8d
shr eax, 8
and eax, 0xff00ff
sub ecx, eax
mov eax, r9d
or ecx, r8d
shr eax, 8
xor edx, ecx
shl r9d, 8
and eax, 0xff00ff
and edx, 0xff00ff
mov ecx, 0x100
sub ecx, eax
shl ecx, 8
or ecx, r9d
xor edx, ecx
mov dword [rbx], edx
add rbx, r15
test esi, esi
jg 0x14006f1a0
mov r15, qword [rsp + 0x40]
jmp 0x14006f370
mov r14, rdx
nop dword [rax]
mov r8d, edi
lea rdx, [rsp + 0x48]
mov rcx, rbp
call fcn.14004b510
mov ecx, 0x100
inc edi
dec esi
mov edx, dword [rax]
mov r9d, edx
and edx, 0xff00ff
shr r9d, 8
and r9d, 0xff00ff
mov eax, r9d
shr eax, 0x10
sub ecx, eax
mov eax, dword [rbx]
mov r8d, eax
shr eax, 8
and eax, 0xff00ff
and r8d, 0xff00ff
imul eax, ecx
imul r8d, ecx
mov ecx, 0x100
shr eax, 8
and eax, 0xff00ff
shr r8d, 8
add r9d, eax
and r8d, 0xff00ff
add r8d, edx
mov eax, r9d
shr eax, 8
mov edx, 0x100
and eax, 0xff00ff
sub edx, eax
mov eax, r9d
shl eax, 8
shl edx, 8
or edx, eax
mov eax, r8d
shr eax, 8
and eax, 0xff00ff
sub ecx, eax
mov eax, r9d
or ecx, r8d
shr eax, 8
xor edx, ecx
shl r9d, 8
and eax, 0xff00ff
and edx, 0xff00ff
mov ecx, 0x100
sub ecx, eax
shl ecx, 8
or ecx, r9d
xor edx, ecx
mov dword [rbx], edx
add rbx, r14
test esi, esi
jg 0x14006f2a0
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
add rsp, 0x20
pop r14
pop rdi
pop rsi
ret
Function at 0x1400703f0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x20
movsxd rsi, r8d
mov r14d, r9d
mov ebp, edx
mov rdi, rcx
cmp esi, dword [rcx + 0x80]
jle 0x140070439
mov qword [rcx + 0x80], rsi
mov rcx, qword [rcx + 0x78]
call fcn.1400c1bd0
mov rcx, rsi
call fcn.1400c1e7c
mov qword [rdi + 0x78], rax
mov rbx, qword [rdi + 0x78]
mov r9d, esi
mov rdx, rbx
mov r8d, ebp
mov rcx, rdi
call fcn.14005d060
mov rax, qword [rdi + 0x48]
mov r11d, dword [rdi + 0x58]
imul r11d, r14d
movsxd rcx, dword [rax + 0x10]
mov eax, ecx
imul eax, ebp
sar r11d, 8
movsxd r10, eax
add r10, qword [rdi + 0x70]
cmp r11d, 0xfe
jge 0x14007054f
mov rdi, rcx
nop
movzx eax, byte [rbx]
lea rbx, [rbx + 1]
mov r9d, eax
mov ecx, 0x100
shl r9d, 0x10
mov edx, 0x100
or r9d, eax
dec esi
imul r9d, r11d
shr r9d, 8
and r9d, 0xff00ff
mov eax, r9d
shr eax, 0x10
sub ecx, eax
mov eax, dword [r10]
mov r8d, eax
shr eax, 8
and eax, 0xff00ff
and r8d, 0xff00ff
imul eax, ecx
imul r8d, ecx
mov ecx, 0x100
shr eax, 8
and eax, 0xff00ff
shr r8d, 8
and r8d, 0xff00ff
add r8d, r9d
add r9d, eax
mov eax, r9d
shr eax, 8
and eax, 0xff00ff
sub edx, eax
mov eax, r9d
shl eax, 8
shl edx, 8
or edx, eax
mov eax, r8d
shr eax, 8
and eax, 0xff00ff
sub ecx, eax
mov eax, r9d
or ecx, r8d
shr eax, 8
xor edx, ecx
shl r9d, 8
and eax, 0xff00ff
and edx, 0xff00ff
mov ecx, 0x100
sub ecx, eax
shl ecx, 8
or ecx, r9d
xor edx, ecx
mov dword [r10], edx
add r10, rdi
test esi, esi
jg 0x140070480
jmp 0x14007061b
mov r11, rcx
nop dword [rax]
nop word [rax + rax]
movzx eax, byte [rbx]
lea rbx, [rbx + 1]
mov r9d, eax
mov ecx, 0x100
shl r9d, 0x10
mov edx, 0x100
or r9d, eax
dec esi
mov eax, r9d
shr eax, 0x10
sub ecx, eax
mov eax, dword [r10]
mov r8d, eax
shr eax, 8
and eax, 0xff00ff
and r8d, 0xff00ff
imul eax, ecx
imul r8d, ecx
mov ecx, 0x100
shr eax, 8
and eax, 0xff00ff
shr r8d, 8
and r8d, 0xff00ff
add r8d, r9d
add r9d, eax
mov eax, r9d
shr eax, 8
and eax, 0xff00ff
sub edx, eax
mov eax, r9d
shl eax, 8
shl edx, 8
or edx, eax
mov eax, r8d
shr eax, 8
and eax, 0xff00ff
sub ecx, eax
mov eax, r9d
or ecx, r8d
shr eax, 8
xor edx, ecx
shl r9d, 8
and eax, 0xff00ff
and edx, 0xff00ff
mov ecx, 0x100
sub ecx, eax
shl ecx, 8
or ecx, r9d
xor edx, ecx
mov dword [r10], edx
add r10, r11
test esi, esi
jg 0x140070560
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
Function at 0x140070640
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x20
movsxd rsi, r8d
mov r14d, r9d
mov ebp, edx
mov rdi, rcx
cmp esi, dword [rcx + 0x80]
jle 0x140070689
mov qword [rcx + 0x80], rsi
mov rcx, qword [rcx + 0x78]
call fcn.1400c1bd0
mov rcx, rsi
call fcn.1400c1e7c
mov qword [rdi + 0x78], rax
mov rbx, qword [rdi + 0x78]
mov r9d, esi
mov rdx, rbx
mov r8d, ebp
mov rcx, rdi
call fcn.140074e10
mov rax, qword [rdi + 0x48]
mov r11d, dword [rdi + 0x58]
imul r11d, r14d
movsxd rcx, dword [rax + 0x10]
mov eax, ecx
imul eax, ebp
sar r11d, 8
movsxd r10, eax
add r10, qword [rdi + 0x70]
cmp r11d, 0xfe
jge 0x14007079f
mov rdi, rcx
nop
movzx eax, byte [rbx]
lea rbx, [rbx + 1]
mov r9d, eax
mov ecx, 0x100
shl r9d, 0x10
mov edx, 0x100
or r9d, eax
dec esi
imul r9d, r11d
shr r9d, 8
and r9d, 0xff00ff
mov eax, r9d
shr eax, 0x10
sub ecx, eax
mov eax, dword [r10]
mov r8d, eax
shr eax, 8
and eax, 0xff00ff
and r8d, 0xff00ff
imul eax, ecx
imul r8d, ecx
mov ecx, 0x100
shr eax, 8
and eax, 0xff00ff
shr r8d, 8
and r8d, 0xff00ff
add r8d, r9d
add r9d, eax
mov eax, r9d
shr eax, 8
and eax, 0xff00ff
sub edx, eax
mov eax, r9d
shl eax, 8
shl edx, 8
or edx, eax
mov eax, r8d
shr eax, 8
and eax, 0xff00ff
sub ecx, eax
mov eax, r9d
or ecx, r8d
shr eax, 8
xor edx, ecx
shl r9d, 8
and eax, 0xff00ff
and edx, 0xff00ff
mov ecx, 0x100
sub ecx, eax
shl ecx, 8
or ecx, r9d
xor edx, ecx
mov dword [r10], edx
add r10, rdi
test esi, esi
jg 0x1400706d0
jmp 0x14007086b
mov r11, rcx
nop dword [rax]
nop word [rax + rax]
movzx eax, byte [rbx]
lea rbx, [rbx + 1]
mov r9d, eax
mov ecx, 0x100
shl r9d, 0x10
mov edx, 0x100
or r9d, eax
dec esi
mov eax, r9d
shr eax, 0x10
sub ecx, eax
mov eax, dword [r10]
mov r8d, eax
shr eax, 8
and eax, 0xff00ff
and r8d, 0xff00ff
imul eax, ecx
imul r8d, ecx
mov ecx, 0x100
shr eax, 8
and eax, 0xff00ff
shr r8d, 8
and r8d, 0xff00ff
add r8d, r9d
add r9d, eax
mov eax, r9d
shr eax, 8
and eax, 0xff00ff
sub edx, eax
mov eax, r9d
shl eax, 8
shl edx, 8
or edx, eax
mov eax, r8d
shr eax, 8
and eax, 0xff00ff
sub ecx, eax
mov eax, r9d
or ecx, r8d
shr eax, 8
xor edx, ecx
shl r9d, 8
and eax, 0xff00ff
and edx, 0xff00ff
mov ecx, 0x100
sub ecx, eax
shl ecx, 8
or ecx, r9d
xor edx, ecx
mov dword [r10], edx
add r10, r11
test esi, esi
jg 0x1400707b0
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
Function at 0x140070890
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
push rsi
push rdi
push r14
sub rsp, 0x20
movsxd rdi, r8d
mov r14d, r9d
mov ebp, edx
mov rsi, rcx
cmp edi, dword [rcx + 0x80]
jle 0x1400708d2
mov qword [rcx + 0x80], rdi
mov rcx, qword [rcx + 0x78]
call fcn.1400c1bd0
lea rcx, [rdi + rdi*2]
call fcn.1400c1e7c
mov qword [rsi + 0x78], rax
mov rbx, qword [rsi + 0x78]
mov r9d, edi
mov rdx, rbx
mov r8d, ebp
mov rcx, rsi
call fcn.140074fb0
mov rax, qword [rsi + 0x48]
mov r11d, dword [rsi + 0x58]
imul r11d, r14d
movsxd rcx, dword [rax + 0x10]
mov eax, ecx
imul eax, ebp
sar r11d, 8
movsxd r10, eax
add r10, qword [rsi + 0x70]
cmp r11d, 0xfe
jge 0x140070a04
mov rsi, rcx
add rbx, 2
nop dword [rax + rax]
mov edx, dword [r10]
mov ecx, 0x100
movzx r9d, byte [rbx - 1]
dec edi
movzx r8d, byte [rbx]
lea rbx, [rbx + 3]
or r9d, 0xff0000
shl r8d, 0x10
imul r9d, r11d
shr r9d, 8
and r9d, 0xff00ff
mov eax, r9d
shr eax, 0x10
sub ecx, eax
movzx eax, byte [rbx - 5]
or r8d, eax
mov eax, edx
and eax, 0xff00ff
shr edx, 8
imul eax, ecx
and edx, 0xff00ff
imul edx, ecx
mov ecx, 0x100
imul r8d, r11d
shr eax, 8
and eax, 0xff00ff
shr edx, 8
and edx, 0xff00ff
shr r8d, 8
add r9d, edx
and r8d, 0xff00ff
add r8d, eax
mov edx, 0x100
mov eax, r9d
shr eax, 8
and eax, 0xff00ff
sub edx, eax
mov eax, r9d
shl eax, 8
shl edx, 8
or edx, eax
mov eax, r8d
shr eax, 8
and eax, 0xff00ff
sub ecx, eax
mov eax, r9d
or ecx, r8d
shr eax, 8
xor edx, ecx
shl r9d, 8
and eax, 0xff00ff
and edx, 0xff00ff
mov ecx, 0x100
sub ecx, eax
shl ecx, 8
or ecx, r9d
xor edx, ecx
mov dword [r10], edx
add r10, rsi
test edi, edi
jg 0x140070920
jmp 0x140070a46
mov rdx, rcx
nop word [rax + rax]
movzx eax, word [rbx]
dec edi
movzx ecx, byte [rbx + 2]
lea rbx, [rbx + 3]
shl ecx, 8
mov word [rsp + 0x50], ax
movzx eax, byte [rsp + 0x51]
or ecx, eax
movzx eax, byte [rsp + 0x50]
shl ecx, 8
or ecx, eax
or ecx, 0xff000000
mov dword [r10], ecx
add r10, rdx
test edi, edi
jg 0x140070a10
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
add rsp, 0x20
pop r14
pop rdi
pop rsi
ret
Function at 0x140070a60
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
push rsi
push rdi
push r14
sub rsp, 0x20
movsxd rdi, r8d
mov r14d, r9d
mov ebp, edx
mov rsi, rcx
cmp edi, dword [rcx + 0x80]
jle 0x140070aa2
mov qword [rcx + 0x80], rdi
mov rcx, qword [rcx + 0x78]
call fcn.1400c1bd0
lea rcx, [rdi + rdi*2]
call fcn.1400c1e7c
mov qword [rsi + 0x78], rax
mov rbx, qword [rsi + 0x78]
mov r9d, edi
mov rdx, rbx
mov r8d, ebp
mov rcx, rsi
call fcn.1400752b0
mov rax, qword [rsi + 0x48]
mov r11d, dword [rsi + 0x58]
imul r11d, r14d
movsxd rcx, dword [rax + 0x10]
mov eax, ecx
imul eax, ebp
sar r11d, 8
movsxd r10, eax
add r10, qword [rsi + 0x70]
cmp r11d, 0xfe
jge 0x140070bd4
mov rsi, rcx
add rbx, 2
nop dword [rax + rax]
mov edx, dword [r10]
mov ecx, 0x100
movzx r9d, byte [rbx - 1]
dec edi
movzx r8d, byte [rbx]
lea rbx, [rbx + 3]
or r9d, 0xff0000
shl r8d, 0x10
imul r9d, r11d
shr r9d, 8
and r9d, 0xff00ff
mov eax, r9d
shr eax, 0x10
sub ecx, eax
movzx eax, byte [rbx - 5]
or r8d, eax
mov eax, edx
and eax, 0xff00ff
shr edx, 8
imul eax, ecx
and edx, 0xff00ff
imul edx, ecx
mov ecx, 0x100
imul r8d, r11d
shr eax, 8
and eax, 0xff00ff
shr edx, 8
and edx, 0xff00ff
shr r8d, 8
add r9d, edx
and r8d, 0xff00ff
add r8d, eax
mov edx, 0x100
mov eax, r9d
shr eax, 8
and eax, 0xff00ff
sub edx, eax
mov eax, r9d
shl eax, 8
shl edx, 8
or edx, eax
mov eax, r8d
shr eax, 8
and eax, 0xff00ff
sub ecx, eax
mov eax, r9d
or ecx, r8d
shr eax, 8
xor edx, ecx
shl r9d, 8
and eax, 0xff00ff
and edx, 0xff00ff
mov ecx, 0x100
sub ecx, eax
shl ecx, 8
or ecx, r9d
xor edx, ecx
mov dword [r10], edx
add r10, rsi
test edi, edi
jg 0x140070af0
jmp 0x140070c16
mov rdx, rcx
nop word [rax + rax]
movzx eax, word [rbx]
dec edi
movzx ecx, byte [rbx + 2]
lea rbx, [rbx + 3]
shl ecx, 8
mov word [rsp + 0x50], ax
movzx eax, byte [rsp + 0x51]
or ecx, eax
movzx eax, byte [rsp + 0x50]
shl ecx, 8
or ecx, eax
or ecx, 0xff000000
mov dword [r10], ecx
add r10, rdx
test edi, edi
jg 0x140070be0
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
add rsp, 0x20
pop r14
pop rdi
pop rsi
ret
Function at 0x140070c30
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x20
movsxd rsi, r8d
mov r14d, r9d
mov ebp, edx
mov rdi, rcx
cmp esi, dword [rcx + 0x80]
jle 0x140070c7e
mov qword [rcx + 0x80], rsi
mov rcx, qword [rcx + 0x78]
call fcn.1400c1bd0
lea rcx, [rsi*4]
call fcn.1400c1e7c
mov qword [rdi + 0x78], rax
mov rbx, qword [rdi + 0x78]
mov r9d, esi
mov rdx, rbx
mov r8d, ebp
mov rcx, rdi
call fcn.140075400
mov rax, qword [rdi + 0x48]
mov r11d, dword [rdi + 0x58]
imul r11d, r14d
movsxd rcx, dword [rax + 0x10]
mov eax, ecx
imul eax, ebp
sar r11d, 8
movsxd r10, eax
add r10, qword [rdi + 0x70]
cmp r11d, 0xfe
jge 0x140070da7
mov rdi, rcx
mov r8d, dword [rbx]
lea rbx, [rbx + 4]
mov edx, dword [r10]
mov r9d, r8d
shr r9d, 8
and r8d, 0xff00ff
and r9d, 0xff00ff
imul r8d, r11d
imul r9d, r11d
mov ecx, 0x100
dec esi
shr r8d, 8
shr r9d, 8
and r8d, 0xff00ff
and r9d, 0xff00ff
mov eax, r9d
shr eax, 0x10
sub ecx, eax
mov eax, edx
and eax, 0xff00ff
shr edx, 8
imul eax, ecx
and edx, 0xff00ff
imul edx, ecx
mov ecx, 0x100
shr eax, 8
and eax, 0xff00ff
shr edx, 8
add r8d, eax
and edx, 0xff00ff
add r9d, edx
mov edx, 0x100
mov eax, r9d
shr eax, 8
and eax, 0xff00ff
sub edx, eax
mov eax, r9d
shl eax, 8
shl edx, 8
or edx, eax
mov eax, r8d
shr eax, 8
and eax, 0xff00ff
sub ecx, eax
mov eax, r9d
or ecx, r8d
shr eax, 8
xor edx, ecx
shl r9d, 8
and eax, 0xff00ff
and edx, 0xff00ff
mov ecx, 0x100
sub ecx, eax
shl ecx, 8
or ecx, r9d
xor edx, ecx
mov dword [r10], edx
add r10, rdi
test esi, esi
jg 0x140070cc3
jmp 0x140070e74
mov r11, rcx
nop word [rax + rax]
mov edx, dword [rbx]
lea rbx, [rbx + 4]
mov r9d, edx
mov ecx, 0x100
and edx, 0xff00ff
shr r9d, 8
and r9d, 0xff00ff
dec esi
mov eax, r9d
shr eax, 0x10
sub ecx, eax
mov eax, dword [r10]
mov r8d, eax
shr eax, 8
and eax, 0xff00ff
and r8d, 0xff00ff
imul eax, ecx
imul r8d, ecx
mov ecx, 0x100
shr eax, 8
and eax, 0xff00ff
shr r8d, 8
add r9d, eax
and r8d, 0xff00ff
add r8d, edx
mov eax, r9d
shr eax, 8
mov edx, 0x100
and eax, 0xff00ff
sub edx, eax
mov eax, r9d
shl eax, 8
shl edx, 8
or edx, eax
mov eax, r8d
shr eax, 8
and eax, 0xff00ff
sub ecx, eax
mov eax, r9d
or ecx, r8d
shr eax, 8
xor edx, ecx
shl r9d, 8
and eax, 0xff00ff
and edx, 0xff00ff
mov ecx, 0x100
sub ecx, eax
shl ecx, 8
or ecx, r9d
xor edx, ecx
mov dword [r10], edx
add r10, r11
test esi, esi
jg 0x140070db0
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
Function at 0x140070e90
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
mov qword [rsp + 8], rbx
mov rax, qword [rcx]
mov r11, rcx
mov r10d, edx
movsxd rcx, dword [rax + 0x10]
sub r10d, dword [r11 + 0x14]
mov eax, ecx
imul eax, edx
mov rbx, rcx
movsxd r9, eax
add r9, qword [r11 + 0x20]
cmp dword [r11 + 0x10], 0xfe
jge 0x140070f12
nop
mov rcx, qword [r11 + 8]
mov eax, r10d
cdq
inc r10d
dec r8d
idiv dword [rcx + 0x14]
mov eax, dword [rcx + 0x10]
imul eax, edx
movsxd rcx, eax
mov rax, qword [r11 + 0x28]
movzx edx, byte [rcx + rax]
mov ecx, 0x100
mov eax, dword [r11 + 0x10]
inc eax
imul edx, eax
movzx eax, byte [r9]
shr edx, 8
sub ecx, edx
imul ecx, eax
sar ecx, 8
add cl, dl
mov byte [r9], cl
add r9, rbx
test r8d, r8d
jg 0x140070ec0
mov rbx, qword [rsp + 8]
ret
mov rcx, qword [r11 + 8]
mov eax, r10d
cdq
inc r10d
dec r8d
idiv dword [rcx + 0x14]
mov eax, dword [rcx + 0x10]
imul eax, edx
movsxd rcx, eax
mov rax, qword [r11 + 0x28]
movzx edx, byte [rcx + rax]
mov ecx, 0x100
movzx eax, byte [r9]
sub ecx, edx
imul ecx, eax
sar ecx, 8
add cl, dl
mov byte [r9], cl
add r9, rbx
test r8d, r8d
jg 0x140070f12
mov rbx, qword [rsp + 8]
ret

Function at 0x140070f60
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push rbx
mov rax, qword [rcx]
mov rbx, rcx
mov r11d, edx
movsxd rcx, dword [rax + 0x10]
sub r11d, dword [rbx + 0x14]
mov eax, ecx
imul eax, edx
movsxd r10, eax
mov eax, dword [rbx + 0x10]
add r10, qword [rbx + 0x20]
imul eax, r9d
sar eax, 8
cmp eax, 0xfe
jge 0x140070fee
mov qword [rsp + 0x10], rdi
lea r9d, [rax + 1]
mov rdi, rcx
nop dword [rax]
mov rcx, qword [rbx + 8]
mov eax, r11d
cdq
inc r11d
dec r8d
idiv dword [rcx + 0x14]
mov eax, dword [rcx + 0x10]
imul eax, edx
movsxd rcx, eax
mov rax, qword [rbx + 0x28]
movzx edx, byte [rcx + rax]
mov ecx, 0x100
movzx eax, byte [r10]
imul edx, r9d
shr edx, 8
sub ecx, edx
imul ecx, eax
sar ecx, 8
add cl, dl
mov byte [r10], cl
add r10, rdi
test r8d, r8d
jg 0x140070fa0
mov rdi, qword [rsp + 0x10]
pop rbx
ret
mov r9, rcx
mov rcx, qword [rbx + 8]
mov eax, r11d
cdq
inc r11d
dec r8d
idiv dword [rcx + 0x14]
mov eax, dword [rcx + 0x10]
imul eax, edx
movsxd rcx, eax
mov rax, qword [rbx + 0x28]
movzx edx, byte [rcx + rax]
mov ecx, 0x100
movzx eax, byte [r10]
sub ecx, edx
imul ecx, eax
sar ecx, 8
add cl, dl
mov byte [r10], cl
add r10, r9
test r8d, r8d
jg 0x140070ff1
pop rbx
ret
Function at 0x140071440
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
mov qword [rsp + 8], rbx
mov rax, qword [rcx]
mov r11, rcx
mov r10d, edx
movsxd rcx, dword [rax + 0x10]
sub r10d, dword [r11 + 0x14]
mov eax, ecx
imul eax, edx
mov rbx, rcx
movsxd r9, eax
add r9, qword [r11 + 0x20]
cmp dword [r11 + 0x10], 0xfe
jge 0x1400714d0
nop
mov rcx, qword [r11 + 8]
mov eax, r10d
cdq
inc r10d
dec r8d
idiv dword [rcx + 0x14]
mov eax, dword [rcx + 0x10]
imul eax, edx
movsxd rcx, eax
mov rax, qword [r11 + 0x28]
movzx edx, byte [rcx + rax + 3]
mov ecx, 0x100
mov eax, dword [r11 + 0x10]
inc eax
imul edx, eax
movzx eax, byte [r9]
shr edx, 8
sub ecx, edx
imul ecx, eax
sar ecx, 8
add cl, dl
mov byte [r9], cl
add r9, rbx
test r8d, r8d
jg 0x140071470
mov rbx, qword [rsp + 8]
ret
mov rcx, qword [r11 + 8]
mov eax, r10d
cdq
inc r10d
dec r8d
idiv dword [rcx + 0x14]
mov eax, dword [rcx + 0x10]
imul eax, edx
movsxd rcx, eax
mov rax, qword [r11 + 0x28]
movzx edx, byte [rcx + rax + 3]
mov ecx, 0x100
movzx eax, byte [r9]
sub ecx, edx
imul ecx, eax
sar ecx, 8
add cl, dl
mov byte [r9], cl
add r9, rbx
test r8d, r8d
jg 0x1400714d0
mov rbx, qword [rsp + 8]
ret

Function at 0x140071520
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push rbx
mov rax, qword [rcx]
mov rbx, rcx
mov r11d, edx
movsxd rcx, dword [rax + 0x10]
sub r11d, dword [rbx + 0x14]
mov eax, ecx
imul eax, edx
movsxd r10, eax
mov eax, dword [rbx + 0x10]
add r10, qword [rbx + 0x20]
imul eax, r9d
sar eax, 8
cmp eax, 0xfe
jge 0x1400715af
mov qword [rsp + 0x10], rdi
lea r9d, [rax + 1]
mov rdi, rcx
nop dword [rax]
mov rcx, qword [rbx + 8]
mov eax, r11d
cdq
inc r11d
dec r8d
idiv dword [rcx + 0x14]
mov eax, dword [rcx + 0x10]
imul eax, edx
movsxd rcx, eax
mov rax, qword [rbx + 0x28]
movzx edx, byte [rcx + rax + 3]
mov ecx, 0x100
movzx eax, byte [r10]
imul edx, r9d
shr edx, 8
sub ecx, edx
imul ecx, eax
sar ecx, 8
add cl, dl
mov byte [r10], cl
add r10, rdi
test r8d, r8d
jg 0x140071560
mov rdi, qword [rsp + 0x10]
pop rbx
ret
mov r9, rcx
mov rcx, qword [rbx + 8]
mov eax, r11d
cdq
inc r11d
dec r8d
idiv dword [rcx + 0x14]
mov eax, dword [rcx + 0x10]
imul eax, edx
movsxd rcx, eax
mov rax, qword [rbx + 0x28]
movzx edx, byte [rcx + rax + 3]
mov ecx, 0x100
movzx eax, byte [r10]
sub ecx, edx
imul ecx, eax
sar ecx, 8
add cl, dl
mov byte [r10], cl
add r10, r9
test r8d, r8d
jg 0x1400715b2
pop rbx
ret
Function at 0x1400720b0
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
mov qword [rsp + 0x20], rbp
push rsi
push rdi
mov rax, qword [rcx]
mov rsi, rcx
mov edi, edx
mov ebp, r8d
movsxd rcx, dword [rax + 0x10]
sub edi, dword [rsi + 0x14]
mov eax, ecx
imul eax, edx
movsxd r9, eax
add r9, qword [rsi + 0x20]
cmp dword [rsi + 0x10], 0xfe
jge 0x1400721cc
mov qword [rsp + 0x20], rbx
mov qword [rsp + 0x28], r14
mov r14, rcx
nop
mov rcx, qword [rsi + 8]
mov eax, edi
movzx ebx, byte [r9 + 1]
cdq
mov r8d, 0x100
inc edi
dec ebp
idiv dword [rcx + 0x14]
mov eax, dword [rcx + 0x10]
imul eax, edx
movsxd rdx, eax
add rdx, qword [rsi + 0x28]
movzx ecx, byte [rdx + 1]
movzx r11d, byte [rdx + 2]
or ecx, 0xff0000
imul ecx, dword [rsi + 0x10]
shl r11d, 0x10
shr ecx, 8
and ecx, 0xff00ff
mov eax, ecx
shr eax, 0x10
sub r8d, eax
movzx eax, byte [rdx]
or r11d, eax
imul ebx, r8d
imul r11d, dword [rsi + 0x10]
movzx eax, byte [r9]
shr ebx, 8
add ebx, ecx
shr r11d, 8
movzx ecx, byte [r9 + 2]
and r11d, 0xff00ff
shl ecx, 0x10
or ecx, eax
imul ecx, r8d
shr ecx, 8
and ecx, 0xff00ff
add r11d, ecx
mov ecx, 0x100
mov eax, r11d
shr eax, 8
and eax, 0xff00ff
sub ecx, eax
mov eax, ebx
shr eax, 8
or ecx, r11d
neg al
and ecx, 0xff00ff
or al, bl
mov byte [r9], cl
mov byte [r9 + 1], al
mov eax, ecx
shr eax, 0x10
mov byte [r9 + 2], al
add r9, r14
test ebp, ebp
jg 0x1400720f0
mov r14, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x20]
mov rbp, qword [rsp + 0x30]
pop rdi
pop rsi
ret
mov r8, rcx
nop
mov rcx, qword [rsi + 8]
mov eax, edi
cdq
inc edi
dec ebp
idiv dword [rcx + 0x14]
mov eax, dword [rcx + 0x10]
imul eax, edx
movsxd rdx, eax
add rdx, qword [rsi + 0x28]
movzx eax, word [rdx]
movzx ecx, byte [rdx + 2]
mov byte [r9], al
mov word [rsp + 0x18], ax
movzx eax, byte [rsp + 0x19]
mov byte [r9 + 1], al
mov byte [r9 + 2], cl
add r9, r8
test ebp, ebp
jg 0x1400721d0
mov rbp, qword [rsp + 0x30]
pop rdi
pop rsi
ret