joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140106cf0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], r9
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x30
mov rax, qword [rsp + 0x90]
mov r15, rcx
movzx ecx, byte [rax + 7]
lea rdi, [rax + 1]
mov r12, qword [rsp + 0x98]
mov rsi, rdx
movzx edx, byte [rdi + 3]
xor r14d, r14d
movzx r11d, byte [rax]
mov ebp, r8d
movzx eax, byte [rdi]
mov ebx, dword [r12]
shl eax, 8
or r11d, eax
shl ecx, 8
movzx eax, byte [rdi + 1]
shl eax, 0x10
or r11d, eax
movzx eax, byte [rdi + 2]
shl eax, 0x18
or r11d, eax
movzx eax, byte [rdi + 4]
shl eax, 8
or edx, eax
mov dword [rsp + 0x28], r11d
movzx eax, byte [rdi + 5]
or ecx, eax
mov byte [rsp + 0x20], r11b
shl ecx, 0x10
mov eax, r11d
shr eax, 8
or edx, ecx
mov byte [rsp + 0x21], al
mov eax, r11d
shr eax, 0x10
mov byte [rsp + 0x22], al
mov eax, r11d
shr eax, 0x18
mov byte [rsp + 0x23], al
mov eax, edx
shr eax, 8
mov byte [rsp + 0x25], al
mov eax, edx
shr eax, 0x10
mov byte [rsp + 0x26], al
mov eax, edx
shr eax, 0x18
mov dword [rsp + 0x2c], edx
mov byte [rsp + 0x24], dl
mov byte [rsp + 0x27], al
test r8d, r8d
je 0x140106eb1
mov r12, qword [rsp + 0x78]
sub r15, rsi
mov qword [rsp + 0x60], r13
mov r13, qword [rsp + 0x88]
dec ebp
test ebx, ebx
jne 0x140106e44
mov r8, qword [rsp + 0x80]
lea rcx, [rsp + 0x28]
mov r9, r13
mov rdx, r12
call fcn.1401048c0
mov r11d, dword [rsp + 0x28]
mov eax, r11d
mov edx, dword [rsp + 0x2c]
shr eax, 8
mov byte [rsp + 0x21], al
mov eax, r11d
shr eax, 0x10
mov byte [rsp + 0x22], al
mov eax, r11d
shr eax, 0x18
mov byte [rsp + 0x23], al
mov eax, edx
shr eax, 8
mov byte [rsp + 0x25], al
mov eax, edx
shr eax, 0x10
mov byte [rsp + 0x26], al
mov eax, edx
shr eax, 0x18
mov byte [rsp + 0x27], al
inc r14d
mov byte [rsp + 0x20], r11b
mov byte [rsp + 0x24], dl
movsxd rax, ebx
movzx ecx, byte [rsp + rax + 0x20]
xor cl, byte [r15 + rsi]
mov byte [rsi], cl
inc rsi
inc ebx
and ebx, 7
test ebp, ebp
jne 0x140106dd8
mov r13, qword [rsp + 0x60]
mov r12, qword [rsp + 0x98]
test r14d, r14d
je 0x140106eb1
mov rax, qword [rsp + 0x90]
mov byte [rax], r11b
mov eax, r11d
shr eax, 8
mov byte [rdi], al
mov eax, r11d
shr eax, 0x10
mov byte [rdi + 1], al
mov eax, edx
shr eax, 8
shr r11d, 0x18
mov byte [rdi + 2], r11b
mov byte [rdi + 3], dl
mov byte [rdi + 4], al
mov eax, edx
shr eax, 0x10
shr edx, 0x18
mov byte [rdi + 5], al
mov byte [rdi + 6], dl
mov rbp, qword [rsp + 0x70]
mov dword [r12], ebx
mov rbx, qword [rsp + 0x68]
add rsp, 0x30
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret
Function at 0x140108210
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
mov qword [rsp + 0x20], r9
push rbp
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x30
mov rax, qword [rbp + 0x50]
mov rsi, rdx
movzx edx, byte [rax + 4]
lea rdi, [rax + 1]
mov r13, qword [rbp + 0x58]
lea r9, [rdi + 5]
mov r12, rcx
shl edx, 0x18
movzx r10d, byte [rax]
xor r15d, r15d
movzx eax, byte [rdi]
mov r14d, r8d
movzx ecx, byte [r9]
mov ebx, dword [r13]
shl eax, 0x10
shl r10d, 0x18
or r10d, eax
shl ecx, 8
movzx eax, byte [rdi + 1]
shl eax, 8
or r10d, eax
movzx eax, byte [rdi + 2]
or r10d, eax
movzx eax, byte [rdi + 4]
shl eax, 0x10
or edx, eax
mov dword [rbp - 8], r10d
movzx eax, byte [r9 + 1]
or ecx, eax
mov byte [rbp - 0xd], r10b
or edx, ecx
mov eax, r10d
shr eax, 0x18
mov byte [rbp - 0x10], al
mov eax, r10d
shr eax, 0x10
mov byte [rbp - 0xf], al
mov eax, r10d
shr eax, 8
mov byte [rbp - 0xe], al
mov eax, edx
shr eax, 0x18
mov byte [rbp - 0xc], al
mov eax, edx
shr eax, 0x10
mov byte [rbp - 0xb], al
mov eax, edx
shr eax, 8
mov dword [rbp - 4], edx
mov byte [rbp - 0xa], al
mov byte [rbp - 9], dl
test r8d, r8d
je 0x1401083ad
mov r13, qword [rbp + 0x48]
sub r12, rsi
movzx r8d, dl
movzx r9d, r10b
nop
dec r14d
test ebx, ebx
jne 0x14010834f
mov rdx, r13
lea rcx, [rbp - 8]
call fcn.140107800
mov r10d, dword [rbp - 8]
mov eax, r10d
mov edx, dword [rbp - 4]
movzx r9d, r10b
shr eax, 0x18
movzx r8d, dl
mov byte [rbp - 0x10], al
mov eax, r10d
shr eax, 0x10
mov byte [rbp - 0xf], al
mov eax, r10d
shr eax, 8
mov byte [rbp - 0xe], al
mov eax, edx
shr eax, 0x18
mov byte [rbp - 0xc], al
mov eax, edx
shr eax, 0x10
mov byte [rbp - 0xb], al
mov eax, edx
shr eax, 8
mov byte [rbp - 0xa], al
inc r15d
mov byte [rbp - 0xd], r10b
mov byte [rbp - 9], dl
movsxd rax, ebx
movzx ecx, byte [rbp + rax - 0x10]
xor cl, byte [r12 + rsi]
mov byte [rsi], cl
inc rsi
inc ebx
and ebx, 7
test r14d, r14d
jne 0x1401082f0
mov r13, qword [rbp + 0x58]
test r15d, r15d
je 0x1401083ad
mov rcx, qword [rbp + 0x50]
mov eax, r10d
shr eax, 0x18
mov byte [rcx], al
mov eax, r10d
shr eax, 0x10
mov byte [rdi], al
mov eax, edx
shr eax, 0x18
shr r10d, 8
mov byte [rdi + 1], r10b
mov byte [rdi + 2], r9b
mov byte [rdi + 3], al
mov eax, edx
shr eax, 0x10
mov byte [rdi + 4], al
shr edx, 8
mov byte [rdi + 5], dl
mov byte [rdi + 6], r8b
mov rsi, qword [rsp + 0x68]
mov rdi, qword [rsp + 0x70]
mov dword [r13], ebx
mov rbx, qword [rsp + 0x60]
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
Function at 0x1401091c0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
mov qword [rsp + 0x20], r9
push rbp
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x30
mov rax, qword [rbp + 0x50]
mov r12, rcx
movzx ecx, byte [rax + 7]
lea rdi, [rax + 1]
mov r13, qword [rbp + 0x58]
mov rsi, rdx
movzx edx, byte [rdi + 3]
xor r15d, r15d
movzx r11d, byte [rax]
mov r14d, r8d
movzx eax, byte [rdi]
mov ebx, dword [r13]
shl eax, 8
or r11d, eax
shl ecx, 8
movzx eax, byte [rdi + 1]
shl eax, 0x10
or r11d, eax
movzx eax, byte [rdi + 2]
shl eax, 0x18
or r11d, eax
movzx eax, byte [rdi + 4]
shl eax, 8
or edx, eax
mov dword [rbp - 8], r11d
movzx eax, byte [rdi + 5]
or ecx, eax
mov byte [rbp - 0x10], r11b
shl ecx, 0x10
mov eax, r11d
shr eax, 8
or edx, ecx
mov byte [rbp - 0xf], al
mov eax, r11d
shr eax, 0x10
mov byte [rbp - 0xe], al
mov eax, r11d
shr eax, 0x18
mov byte [rbp - 0xd], al
mov eax, edx
shr eax, 8
mov byte [rbp - 0xb], al
mov eax, edx
shr eax, 0x10
mov byte [rbp - 0xa], al
mov eax, edx
shr eax, 0x18
mov dword [rbp - 4], edx
mov byte [rbp - 0xc], dl
mov byte [rbp - 9], al
test r8d, r8d
je 0x140109360
mov r13, qword [rbp + 0x48]
sub r12, rsi
movzx r8d, dl
movzx r9d, r11b
nop dword [rax]
dec r14d
test ebx, ebx
jne 0x140109302
mov rdx, r13
lea rcx, [rbp - 8]
call fcn.140108e60
mov r11d, dword [rbp - 8]
mov eax, r11d
mov edx, dword [rbp - 4]
movzx r9d, byte [rbp - 8]
movzx r8d, byte [rbp - 4]
shr eax, 8
mov byte [rbp - 0xf], al
mov eax, r11d
shr eax, 0x10
mov byte [rbp - 0xe], al
mov eax, r11d
shr eax, 0x18
mov byte [rbp - 0xd], al
mov eax, edx
shr eax, 8
mov byte [rbp - 0xb], al
mov eax, edx
shr eax, 0x10
mov byte [rbp - 0xa], al
mov eax, edx
shr eax, 0x18
mov byte [rbp - 9], al
inc r15d
mov byte [rbp - 0x10], r9b
mov byte [rbp - 0xc], r8b
movsxd rax, ebx
movzx ecx, byte [rbp + rax - 0x10]
xor cl, byte [r12 + rsi]
mov byte [rsi], cl
inc rsi
inc ebx
and ebx, 7
test r14d, r14d
jne 0x1401092a0
mov r13, qword [rbp + 0x58]
test r15d, r15d
je 0x140109360
mov rax, qword [rbp + 0x50]
mov byte [rax], r9b
mov eax, r11d
shr eax, 8
mov byte [rdi], al
mov eax, r11d
shr eax, 0x10
mov byte [rdi + 1], al
mov eax, edx
shr eax, 8
shr r11d, 0x18
mov byte [rdi + 2], r11b
mov byte [rdi + 3], r8b
mov byte [rdi + 4], al
mov eax, edx
shr eax, 0x10
shr edx, 0x18
mov byte [rdi + 5], al
mov byte [rdi + 6], dl
mov rsi, qword [rsp + 0x68]
mov rdi, qword [rsp + 0x70]
mov dword [r13], ebx
mov rbx, qword [rsp + 0x60]
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
Function at 0x140109fe0
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, r8
call fcn.14010a250
test eax, eax
js 0x14010a244
mov ecx, dword [rbx + 0xf0]
lea eax, [rcx*4]
movsxd r9, eax
test eax, eax
jle 0x14010a073
lea r8, [rbx + 8]
xor r10d, r10d
lea r8, [r8 + r9*4]
lea rax, [rbx + 8]
nop dword [rax]
mov edx, dword [rax - 8]
add r10, 4
mov ecx, dword [r8 - 8]
lea r8, [r8 - 0x10]
mov dword [rax - 8], ecx
lea rax, [rax + 0x10]
mov ecx, dword [r8 + 0xc]
sub r9, 4
mov dword [r8 + 8], edx
mov edx, dword [rax - 0x14]
mov dword [rax - 0x14], ecx
mov ecx, dword [r8 + 0x10]
mov dword [r8 + 0xc], edx
mov edx, dword [rax - 0x10]
mov dword [rax - 0x10], ecx
mov ecx, dword [r8 + 0x14]
mov dword [r8 + 0x10], edx
mov edx, dword [rax - 0xc]
mov dword [rax - 0xc], ecx
mov dword [r8 + 0x14], edx
cmp r10, r9
jl 0x14010a020
mov ecx, dword [rbx + 0xf0]
mov r11d, 1
cmp ecx, r11d
jle 0x14010a242
mov qword [rsp + 0x30], rdi
lea r10, [rbx + 4]
lea rdi, [0x140000000]
nop dword [rax]
nop word [rax + rax]
mov r9d, dword [r10 + 0x10]
lea r10, [r10 + 0x10]
mov edx, dword [r10 - 4]
inc r11d
movzx eax, byte [r10 - 3]
movzx ecx, byte [rdi + rax*4 + 0x20cc20]
mov eax, edx
shr rax, 0x18
mov r8d, dword [rdi + rcx*4 + 0x20e020]
movzx eax, byte [rdi + rax*4 + 0x20cc20]
xor r8d, dword [rdi + rax*4 + 0x20d820]
movzx eax, dl
movzx ecx, byte [rdi + rax*4 + 0x20cc20]
movzx eax, byte [r10 - 2]
xor r8d, dword [rdi + rcx*4 + 0x20e420]
movzx ecx, byte [rdi + rax*4 + 0x20cc20]
mov eax, r9d
shr eax, 0x10
xor r8d, dword [rdi + rcx*4 + 0x20dc20]
movzx ecx, al
mov eax, r9d
shr eax, 8
mov dword [r10 - 4], r8d
movzx edx, byte [rdi + rcx*4 + 0x20cc20]
movzx ecx, al
mov r8d, dword [rdi + rdx*4 + 0x20dc20]
movzx eax, byte [rdi + rcx*4 + 0x20cc20]
xor r8d, dword [rdi + rax*4 + 0x20e020]
mov eax, r9d
shr rax, 0x18
movzx ecx, byte [rdi + rax*4 + 0x20cc20]
movzx eax, r9b
mov r9d, dword [r10 + 4]
xor r8d, dword [rdi + rcx*4 + 0x20d820]
movzx ecx, byte [rdi + rax*4 + 0x20cc20]
mov eax, r9d
shr eax, 0x10
xor r8d, dword [rdi + rcx*4 + 0x20e420]
movzx ecx, al
mov eax, r9d
shr eax, 8
mov dword [r10], r8d
movzx edx, byte [rdi + rcx*4 + 0x20cc20]
movzx ecx, al
mov r8d, dword [rdi + rdx*4 + 0x20dc20]
movzx eax, byte [rdi + rcx*4 + 0x20cc20]
xor r8d, dword [rdi + rax*4 + 0x20e020]
mov eax, r9d
shr rax, 0x18
movzx ecx, byte [rdi + rax*4 + 0x20cc20]
movzx eax, r9b
mov r9d, dword [r10 + 8]
xor r8d, dword [rdi + rcx*4 + 0x20d820]
movzx ecx, byte [rdi + rax*4 + 0x20cc20]
mov eax, r9d
shr eax, 0x10
xor r8d, dword [rdi + rcx*4 + 0x20e420]
movzx ecx, al
mov eax, r9d
shr eax, 8
mov dword [r10 + 4], r8d
movzx edx, byte [rdi + rcx*4 + 0x20cc20]
movzx ecx, al
mov r8d, dword [rdi + rdx*4 + 0x20dc20]
movzx eax, byte [rdi + rcx*4 + 0x20cc20]
xor r8d, dword [rdi + rax*4 + 0x20e020]
mov eax, r9d
shr rax, 0x18
movzx ecx, byte [rdi + rax*4 + 0x20cc20]
movzx eax, r9b
xor r8d, dword [rdi + rcx*4 + 0x20d820]
movzx ecx, byte [rdi + rax*4 + 0x20cc20]
xor r8d, dword [rdi + rcx*4 + 0x20e420]
mov dword [r10 + 8], r8d
cmp r11d, dword [rbx + 0xf0]
jl 0x14010a0a0
mov rdi, qword [rsp + 0x30]
xor eax, eax
add rsp, 0x20
pop rbx
ret
Function at 0x14010b6a0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x20], r9
push rbx
push rbp
push rsi
push rdi
push r13
push r14
push r15
sub rsp, 0x40
mov r15, qword [rsp + 0xa8]
mov r14, rdx
mov rdx, qword [rsp + 0xb0]
mov r10, r9
mov rdi, r8
mov rbp, rcx
mov ebx, dword [rdx]
test ebx, ebx
je 0x14010b6f7
test rdi, rdi
je 0x14010b6f7
mov eax, ebx
dec rdi
movzx ecx, byte [rax + r15]
xor cl, byte [rbp]
inc rbp
mov byte [r14], cl
inc r14
inc ebx
and ebx, 0xf
jne 0x14010b6d5
mov r9, qword [rsp + 0xb8]
mov r13d, reloc.WS2_32.dll_recv
mov qword [rsp + 0x38], r12
mov esi, 1
cmp rdi, r13
jb 0x14010b81b
mov rcx, rdi
xor ebx, ebx
shr rcx, 4
mov r15, r14
imul rax, rcx, 0xfffffffffffffff0
mov r12, rbp
mov dword [rsp + 0x20], ebx
mov rbx, qword [rsp + 0xa8]
add rdi, rax
mov rax, rcx
mov qword [rsp + 0x90], rdi
mov rdi, qword [rsp + 0x98]
sub r15, rbx
shl rax, 4
sub r12, rbx
add r14, rax
add rbp, rax
mov qword [rsp + 0x88], r14
mov qword [rsp + 0x80], rbp
mov r14, rcx
mov rbp, qword [rsp + 0xa0]
nop dword [rax + rax]
mov r8, rdi
mov rdx, rbx
mov rcx, rbp
call r9
mov r8d, r13d
lea rdx, [rbp + 0x10]
mov ecx, esi
nop word [rax + rax]
movzx eax, byte [rdx - 1]
lea rdx, [rdx - 1]
add ecx, eax
mov byte [rdx], cl
shr ecx, 8
add r8d, 0xffffffff
jne 0x14010b7a0
mov rax, rbx
lea edx, [r8 + 2]
nop dword [rax]
mov rcx, qword [r12 + rax]
xor rcx, qword [rax]
mov qword [r15 + rax], rcx
lea rax, [rax + 8]
sub rdx, rsi
jne 0x14010b7c0
mov r9, qword [rsp + 0xb8]
add r15, r13
add r12, r13
sub r14, rsi
jne 0x14010b780
mov ebx, dword [rsp + 0x20]
mov rdi, qword [rsp + 0x90]
mov r14, qword [rsp + 0x88]
mov rbp, qword [rsp + 0x80]
mov r15, qword [rsp + 0xa8]
mov rdx, qword [rsp + 0xb0]
mov r10, qword [rsp + 0x98]
test rdi, rdi
je 0x14010b882
mov r12, qword [rsp + 0xa0]
mov r8, r10
mov rcx, r12
mov rdx, r15
call r9
lea rcx, [r12 + 0x10]
nop dword [rax]
movzx eax, byte [rcx - 1]
lea rcx, [rcx - 1]
add esi, eax
mov byte [rcx], sil
shr esi, 8
add r13d, 0xffffffff
jne 0x14010b840
nop word [rax + rax]
mov ecx, ebx
inc ebx
movzx eax, byte [rcx + rbp]
xor al, byte [rcx + r15]
mov byte [rcx + r14], al
sub rdi, 1
jne 0x14010b860
mov rax, qword [rsp + 0xb0]
mov dword [rax], ebx
jmp 0x14010b884
mov dword [rdx], ebx
mov r12, qword [rsp + 0x38]
add rsp, 0x40
pop r15
pop r14
pop r13
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x14010b8a0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x20], r9
push rbx
push rbp
push rsi
push rdi
push r13
push r14
push r15
sub rsp, 0x40
mov r11, r9
mov rbx, r8
mov r9, qword [rsp + 0xb0]
mov r14, rdx
mov rbp, rcx
mov edi, dword [r9]
mov dword [rsp + 0x30], edi
test edi, edi
je 0x14010b905
mov rdx, qword [rsp + 0xa8]
nop word [rax + rax]
test rbx, rbx
je 0x14010b901
mov eax, edi
dec rbx
movzx ecx, byte [rax + rdx]
xor cl, byte [rbp]
inc rbp
mov byte [r14], cl
inc r14
inc edi
and edi, 0xf
jne 0x14010b8e0
mov dword [rsp + 0x30], edi
mov rax, qword [rsp + 0xa0]
mov esi, 1
mov r8d, dword [rax + 0xc]
lea r15, [rax + 0xc]
mov r10, qword [rsp + 0xb8]
mov qword [rsp + 0x80], r12
lea r13d, [rsi + 0xb]
bswap r8d
mov dword [rsp + 0x90], r8d
cmp rbx, 0x10
jb 0x14010ba25
mov rdi, qword [rsp + 0xa0]
mov eax, 0x10000000
mov rdx, rbx
mov qword [rsp + 0x20], rdi
shr rdx, 4
mov r9, r11
cmp rdx, rax
cmova rdx, rax
add r8d, edx
mov r12, rdx
mov eax, r8d
mov ecx, r8d
sub r12, rax
cmp rax, rdx
cmovae r12, rdx
xor r8d, r8d
cmp rax, rdx
mov rdx, r14
cmovae r8d, ecx
mov rcx, rbp
mov dword [rsp + 0x90], r8d
mov r8, r12
call r10
mov r8d, dword [rsp + 0x90]
mov eax, r8d
bswap eax
mov dword [r15], eax
test r8d, r8d
jne 0x14010b9dd
mov r8d, r13d
mov eax, esi
mov rdx, r15
nop word [rax + rax]
movzx ecx, byte [rdx - 1]
lea rdx, [rdx - 1]
add eax, ecx
mov byte [rdx], al
shr eax, 8
add r8d, 0xffffffff
jne 0x14010b9c0
mov r8d, dword [rsp + 0x90]
mov r10, qword [rsp + 0xb8]
mov eax, 0x10000000
mov r11, qword [rsp + 0x98]
shl r12, 4
sub rbx, r12
add r14, r12
add rbp, r12
cmp rbx, 0x10
jae 0x14010b950
mov edi, dword [rsp + 0x30]
mov r9, qword [rsp + 0xb0]
mov rax, qword [rsp + 0xa0]
mov dword [rsp + 0x90], r8d
test rbx, rbx
je 0x14010bab2
mov r12, qword [rsp + 0xa8]
xor ecx, ecx
mov r9, r11
mov qword [rsp + 0x20], rax
mov r8, rsi
mov rdx, r12
mov qword [r12], rcx
mov qword [r12 + 8], rcx
mov rcx, r12
call r10
mov r8d, dword [rsp + 0x90]
add r8d, esi
bswap r8d
mov dword [r15], r8d
jne 0x14010ba90
nop dword [rax + rax]
movzx eax, byte [r15 - 1]
lea r15, [r15 - 1]
add esi, eax
mov byte [r15], sil
shr esi, 8
add r13d, 0xffffffff
jne 0x14010ba70
nop word [rax + rax]
mov ecx, edi
inc edi
movzx eax, byte [rcx + rbp]
xor al, byte [rcx + r12]
mov byte [rcx + r14], al
sub rbx, 1
jne 0x14010ba90
mov rax, qword [rsp + 0xb0]
mov dword [rax], edi
jmp 0x14010bab5
mov dword [r9], edi
mov r12, qword [rsp + 0x80]
add rsp, 0x40
pop r15
pop r14
pop r13
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x14010bad0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x20], r9
push rbx
push rbp
push rsi
push rdi
push r12
push r15
sub rsp, 0x28
mov rsi, qword [rsp + 0x88]
mov r10, r9
mov rbp, qword [rsp + 0x80]
mov rdi, r8
mov r15, rdx
mov r12, rcx
mov ebx, dword [rsi]
test ebx, ebx
je 0x14010bb25
test rdi, rdi
je 0x14010bb25
mov eax, ebx
dec rdi
movzx ecx, byte [rax + rbp]
xor cl, byte [r12]
inc r12
mov byte [r15], cl
inc r15
inc ebx
and ebx, 0xf
jne 0x14010bb03
mov r9, qword [rsp + 0x90]
cmp rdi, 0x10
jb 0x14010bbe9
mov qword [rsp + 0x60], r13
mov rsi, r15
mov r13, rdi
mov qword [rsp + 0x20], r14
shr r13, 4
mov r14, r12
imul rax, r13, 0xfffffffffffffff0
sub rsi, rbp
sub r14, rbp
add rdi, rax
mov rax, r13
shl rax, 4
add r15, rax
mov qword [rsp + 0x68], r15
add r12, rax
mov r15, qword [rsp + 0x78]
mov r8, r15
mov rdx, rbp
mov rcx, rbp
call r9
cmp ebx, 0x10
jae 0x14010bbb5
mov edx, send
mov eax, ebx
sub edx, ebx
add rax, rbp
shr edx, 3
inc edx
nop dword [rax]
nop dword [rax + rax]
mov rcx, qword [r14 + rax]
xor rcx, qword [rax]
mov qword [rsi + rax], rcx
lea rax, [rax + 8]
sub rdx, 1
jne 0x14010bba0
mov r9, qword [rsp + 0x90]
add rsi, 0x10
add r14, 0x10
xor ebx, ebx
sub r13, 1
jne 0x14010bb72
mov r15, qword [rsp + 0x68]
mov r10, qword [rsp + 0x78]
mov rsi, qword [rsp + 0x88]
mov r14, qword [rsp + 0x20]
mov r13, qword [rsp + 0x60]
test rdi, rdi
je 0x14010bc16
mov r8, r10
mov rdx, rbp
mov rcx, rbp
call r9
nop word [rax + rax]
mov ecx, ebx
inc ebx
movzx eax, byte [rcx + r12]
xor al, byte [rcx + rbp]
mov byte [rcx + r15], al
sub rdi, 1
jne 0x14010bc00
mov dword [rsi], ebx
add rsp, 0x28
pop r15
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x14010bc30
Capabilities:
Encrypt data using rc4 prga

Disassembly:
test r8, r8
je 0x14010be70
mov rax, rsp
mov qword [rax + 0x18], r8
mov qword [rax + 0x10], rdx
push rbx
push rbp
push r14
push r15
sub rsp, 0x68
mov rbx, qword [rsp + 0xb0]
mov r14, r9
mov qword [rax + 8], rsi
mov r15, rcx
mov qword [rax - 0x28], rdi
xor ebp, ebp
mov qword [rax - 0x30], r12
mov r12, qword [rsp + 0xc8]
mov qword [rax - 0x38], r13
mov r13d, dword [rsp + 0xc0]
nop
movups xmm0, xmmword [rbx]
movzx eax, bpl
mov ecx, 7
and al, 7
mov rsi, rbp
sub cl, al
shr rsi, 3
mov eax, 1
mov r8, r14
shl eax, cl
mov rdx, rbx
mov rcx, rbx
and al, byte [rsi + r15]
neg al
movups xmmword [rsp + 0x20], xmm0
sbb dil, dil
and dil, 0x80
call r12
movzx r9d, dil
xor r9b, byte [rbx]
movzx eax, r9b
test r13d, r13d
jne 0x14010bcd0
movzx r9d, dil
movzx r8d, byte [rsp + 0x21]
movzx edx, byte [rsp + 0x20]
movzx ecx, r8b
shr cl, 7
add dl, dl
or dl, cl
add r8b, r8b
mov byte [rbx], dl
movzx edx, byte [rsp + 0x22]
movzx ecx, dl
add dl, dl
shr cl, 7
or cl, r8b
movzx r8d, byte [rsp + 0x23]
mov byte [rbx + 1], cl
movzx ecx, r8b
shr cl, 7
add r8b, r8b
or cl, dl
movzx edx, byte [rsp + 0x24]
mov byte [rbx + 2], cl
movzx ecx, dl
shr cl, 7
add dl, dl
or cl, r8b
movzx r8d, byte [rsp + 0x25]
mov byte [rbx + 3], cl
movzx ecx, r8b
shr cl, 7
add r8b, r8b
or cl, dl
movzx edx, byte [rsp + 0x26]
mov byte [rbx + 4], cl
movzx ecx, dl
shr cl, 7
add dl, dl
or cl, r8b
movzx r8d, byte [rsp + 0x27]
mov byte [rbx + 5], cl
movzx ecx, r8b
shr cl, 7
add r8b, r8b
or cl, dl
movzx edx, byte [rsp + 0x28]
mov byte [rbx + 6], cl
movzx ecx, dl
shr cl, 7
add dl, dl
or cl, r8b
movzx r8d, byte [rsp + 0x29]
mov byte [rbx + 7], cl
movzx ecx, r8b
shr cl, 7
add r8b, r8b
or cl, dl
movzx edx, byte [rsp + 0x2a]
mov byte [rbx + 8], cl
movzx ecx, dl
shr cl, 7
add dl, dl
or cl, r8b
movzx r8d, byte [rsp + 0x2b]
mov byte [rbx + 9], cl
movzx ecx, r8b
shr cl, 7
add r8b, r8b
or cl, dl
movzx edx, byte [rsp + 0x2c]
mov byte [rbx + 0xa], cl
movzx ecx, dl
shr cl, 7
add dl, dl
or cl, r8b
movzx r8d, byte [rsp + 0x2d]
mov byte [rbx + 0xb], cl
movzx ecx, r8b
shr cl, 7
or cl, dl
movzx edx, byte [rsp + 0x2e]
mov byte [rbx + 0xc], cl
add r8b, r8b
movzx ecx, dl
shr r9b, 7
shr cl, 7
add dl, dl
or r8b, cl
and al, 0x80
mov byte [rbx + 0xd], r8b
movzx r8d, byte [rsp + 0x2f]
movzx ecx, r8b
add r8b, r8b
or r9b, r8b
shr cl, 7
or cl, dl
mov byte [rbx + 0xf], r9b
mov r9, qword [rsp + 0x98]
mov edx, ebp
mov byte [rbx + 0xe], cl
and edx, 7
mov ecx, 7
sub ecx, edx
movzx r8d, byte [rsi + r9]
btr r8d, ecx
movzx ecx, bpl
and cl, 7
inc rbp
shr al, cl
or r8b, al
mov byte [rsi + r9], r8b
cmp rbp, qword [rsp + 0xa0]
jb 0x14010bc80
mov r13, qword [rsp + 0x50]
mov r12, qword [rsp + 0x58]
mov rdi, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x90]
add rsp, 0x68
pop r15
pop r14
pop rbp
pop rbx
ret
Function at 0x14010bf30
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x20], r9
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x20
cmp dword [rsp + 0x90], 0
mov r10, r9
mov r15, qword [rsp + 0x88]
mov rdi, r8
mov rbp, qword [rsp + 0x80]
mov rsi, rdx
mov r14, rcx
mov ebx, dword [r15]
je 0x14010c08e
test ebx, ebx
je 0x14010bfa4
nop word [rax + rax]
test rdi, rdi
je 0x14010bfa4
movzx eax, byte [r14]
dec rdi
mov ecx, ebx
inc r14
xor byte [rcx + rbp], al
movzx eax, byte [rcx + rbp]
mov byte [rsi], al
inc rsi
inc ebx
and ebx, 0xf
jne 0x14010bf80
mov r9, qword [rsp + 0x98]
cmp rdi, 0x10
jb 0x14010c054
mov r15, rsi
mov r13, rdi
shr r13, 4
mov r12, r14
imul rax, r13, 0xfffffffffffffff0
sub r15, rbp
sub r12, rbp
add rdi, rax
mov rax, r13
shl rax, 4
add rsi, rax
mov qword [rsp + 0x68], rsi
add r14, rax
mov rsi, qword [rsp + 0x78]
nop word [rax + rax]
mov r8, rsi
mov rdx, rbp
mov rcx, rbp
call r9
cmp ebx, 0x10
jae 0x14010c02a
mov edx, send
mov ecx, ebx
sub edx, ebx
add rcx, rbp
shr edx, 3
inc edx
mov rax, qword [r12 + rcx]
xor qword [rcx], rax
mov rax, qword [rcx]
mov qword [r15 + rcx], rax
lea rcx, [rcx + 8]
sub rdx, 1
jne 0x14010c012
mov r9, qword [rsp + 0x98]
add r15, 0x10
add r12, 0x10
xor ebx, ebx
sub r13, 1
jne 0x14010bff0
mov rsi, qword [rsp + 0x68]
mov r10, qword [rsp + 0x78]
mov r15, qword [rsp + 0x88]
test rdi, rdi
je 0x14010c19b
mov r8, r10
mov rdx, rbp
mov rcx, rbp
call r9
nop dword [rax]
mov ecx, ebx
inc ebx
movzx eax, byte [rcx + r14]
xor byte [rcx + rbp], al
movzx eax, byte [rcx + rbp]
mov byte [rcx + rsi], al
sub rdi, 1
jne 0x14010c070
jmp 0x14010c19b
test ebx, ebx
je 0x14010c0b8
test rdi, rdi
je 0x14010c0b8
movzx edx, byte [r14]
dec rdi
mov ecx, ebx
inc r14
movzx eax, byte [rcx + rbp]
xor al, dl
mov byte [rsi], al
inc rsi
inc ebx
mov byte [rcx + rbp], dl
and ebx, 0xf
jne 0x14010c092
mov r13, qword [rsp + 0x98]
cmp rdi, 0x10
jb 0x14010c165
mov r12, rdi
mov r15, rsi
shr r12, 4
sub r15, rbp
imul rax, r12, 0xfffffffffffffff0
add rdi, rax
mov qword [rsp + 0x70], rdi
mov rdi, qword [rsp + 0x78]
nop dword [rax + rax]
mov r8, rdi
mov rdx, rbp
mov rcx, rbp
call r13
cmp ebx, 0x10
jae 0x14010c13f
mov r9d, send
mov r8d, ebx
sub r9d, ebx
mov r10, r14
shr r9d, 3
add r8, rbp
sub r10, rsi
inc r9d
nop dword [rax]
mov rax, qword [r8]
lea rcx, [r15 + r8]
mov rdx, qword [rcx + r10]
lea r8, [r8 + 8]
xor rax, rdx
mov qword [rcx], rax
mov qword [r8 - 8], rdx
sub r9, 1
jne 0x14010c120
add rsi, 0x10
add r15, 0x10
add r14, 0x10
xor ebx, ebx
sub r12, 1
jne 0x14010c0f0
mov rdi, qword [rsp + 0x70]
mov r10, qword [rsp + 0x78]
mov r15, qword [rsp + 0x88]
test rdi, rdi
je 0x14010c19b
mov r8, r10
mov rdx, rbp
mov rcx, rbp
call r13
nop word [rax + rax]
mov ecx, ebx
inc ebx
movzx edx, byte [rcx + r14]
movzx eax, byte [rcx + rbp]
xor al, dl
mov byte [rcx + rsi], al
mov byte [rcx + rbp], dl
sub rdi, 1
jne 0x14010c180
mov dword [r15], ebx
mov rbx, qword [rsp + 0x60]
add rsp, 0x20
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret