joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1401cd6c0
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r14
mov eax, reloc.WS2_32.dll_WSASetLastError
call fcn.140285430
sub rsp, rax
mov rax, qword [0x1403a1e40]
xor rax, rsp
mov qword [rsp + 0x60], rax
mov rax, r8
lea rbp, [r8 + r8]
shl rax, 7
xor edi, edi
mov rsi, r8
mov rbx, rdx
mov r14, rcx
movups xmm0, xmmword [rax + rdx - 0x40]
movups xmm1, xmmword [rax + rdx - 0x30]
movups xmmword [rsp + 0x20], xmm0
movups xmmword [rsp + 0x30], xmm1
movups xmm0, xmmword [rax + rdx - 0x20]
movups xmm1, xmmword [rax + rdx - 0x10]
movups xmmword [rsp + 0x40], xmm0
movups xmmword [rsp + 0x50], xmm1
test rbp, rbp
je 0x1401cd800
nop word [rax + rax]
xor eax, eax
lea rcx, [rbx + 0x3c]
lea rdx, [rsp + 0x20]
cmp rdx, rcx
ja 0x1401cd765
lea rcx, [rsp + 0x5c]
cmp rcx, rbx
jb 0x1401cd765
nop word [rax + rax]
mov ecx, dword [rbx]
add rbx, 4
xor dword [rsp + rax*4 + 0x20], ecx
inc rax
cmp rax, 0x10
jb 0x1401cd750
jmp 0x1401cd7a8
movdqu xmm0, xmmword [rbx]
xorps xmm0, xmmword [rsp + 0x20]
movdqu xmmword [rsp + 0x20], xmm0
movdqu xmm0, xmmword [rbx + 0x10]
xorps xmm0, xmmword [rsp + 0x30]
movdqu xmmword [rsp + 0x30], xmm0
movdqu xmm0, xmmword [rbx + 0x20]
xorps xmm0, xmmword [rsp + 0x40]
movdqu xmmword [rsp + 0x40], xmm0
movdqu xmm0, xmmword [rbx + 0x30]
add rbx, 0x40
xorps xmm0, xmmword [rsp + 0x50]
movdqu xmmword [rsp + 0x50], xmm0
lea rcx, [rsp + 0x20]
call fcn.1401cd240
movups xmm0, xmmword [rsp + 0x20]
mov rcx, rdi
movups xmm1, xmmword [rsp + 0x30]
and ecx, 1
imul rcx, rsi
mov rax, rdi
inc rdi
shr rax, 1
add rcx, rax
shl rcx, 6
movups xmmword [rcx + r14], xmm0
movups xmm0, xmmword [rsp + 0x40]
movups xmmword [rcx + r14 + 0x10], xmm1
movups xmm1, xmmword [rsp + 0x50]
movups xmmword [rcx + r14 + 0x20], xmm0
movups xmmword [rcx + r14 + 0x30], xmm1
cmp rdi, rbp
jb 0x1401cd730
mov edx, 0x40
lea rcx, [rsp + 0x20]
call fcn.140001240
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.140285090
add rsp, 0x70
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x1401ce880
Capabilities:
Encode data using xor

Disassembly:
push rbp
push r12
push r15
mov eax, 0x50
call fcn.140285430
sub rsp, rax
mov r12, rdx
test rdx, rdx
mov rdx, r8
mov r15, r9
mov rbp, r8
je 0x1401cead3
mov qword [rsp + 0x70], rbx
mov rbx, qword [rsp + 0xa8]
mov qword [rsp + 0x78], rsi
mov rsi, qword [rsp + 0xa0]
mov qword [rsp + 0x48], r13
mov r13, qword [rsp + 0x98]
mov qword [rsp + 0x40], r14
lea r14, [r9 + 1]
mov r9, qword [rsp + 0x90]
mov qword [rsp + 0x30], rbx
shr r14, 1
mov r8, r14
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x80], rdi
mov qword [rsp + 0x20], r13
call fcn.1401ce670
test eax, eax
je 0x1401ce968
mov r8d, 0x1c8
lea rdx, str.providersimplementationskdfs_tls1_prf.c
mov rcx, rbx
call fcn.14010e130
mov rdi, rax
test rax, rax
je 0x1401ce968
mov r9, qword [rsp + 0x90]
sub rbp, r14
mov qword [rsp + 0x30], rbx
mov r8, r14
mov qword [rsp + 0x28], rax
mov rcx, r12
mov qword [rsp + 0x20], r13
lea rdx, [r15 + rbp]
call fcn.1401ce670
test eax, eax
jne 0x1401ce990
mov r9d, 0x1cd
lea r8, str.providersimplementationskdfs_tls1_prf.c
mov rdx, rbx
mov rcx, rdi
call fcn.14010e2b0
xor eax, eax
mov rdi, qword [rsp + 0x80]
mov r13, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x78]
mov rbx, qword [rsp + 0x70]
mov r14, qword [rsp + 0x40]
add rsp, 0x50
pop r15
pop r12
pop rbp
ret
xor ecx, ecx
test rbx, rbx
je 0x1401ceab1
cmp rbx, 8
jb 0x1401cea84
lea rdx, [rsi - 1]
lea rax, [rbx - 1]
add rdx, rbx
add rax, rdi
cmp rsi, rax
ja 0x1401ce9c1
cmp rdx, rdi
jae 0x1401cea84
cmp rbx, 0x40
jb 0x1401cea43
mov rdx, rbx
mov r8, rbx
and edx, 0x3f
sub r8, rdx
mov r9, rdi
lea rax, [rsi + 0x10]
sub r9, rsi
nop dword [rax]
movdqu xmm0, xmmword [rax - 0x10]
add rcx, 0x40
movdqu xmm1, xmmword [r9 + rax - 0x10]
lea rax, [rax + 0x40]
xorps xmm1, xmm0
movdqu xmm0, xmmword [r9 + rax - 0x40]
movdqu xmmword [rax - 0x50], xmm1
movdqu xmm2, xmmword [rax - 0x40]
movdqu xmm1, xmmword [r9 + rax - 0x30]
xorps xmm2, xmm0
movdqu xmmword [rax - 0x40], xmm2
movdqu xmm0, xmmword [rax - 0x30]
xorps xmm1, xmm0
movdqu xmmword [rax - 0x30], xmm1
movdqu xmm0, xmmword [rax - 0x20]
movdqu xmm1, xmmword [r9 + rax - 0x20]
xorps xmm1, xmm0
movdqu xmmword [rax - 0x20], xmm1
cmp rcx, r8
jb 0x1401ce9e0
cmp rdx, 8
jb 0x1401cea7f
mov rdx, rbx
and rdx, 0xfffffffffffffff8
mov r8, rdi
lea rax, [rcx + rsi]
sub r8, rsi
nop dword [rax]
nop dword [rax + rax]
movq xmm0, qword [rax]
add rcx, 8
movq xmm1, qword [r8 + rax]
lea rax, [rax + 8]
xorps xmm1, xmm0
movq qword [rax - 8], xmm1
cmp rcx, rdx
jb 0x1401cea60
cmp rcx, rbx
jae 0x1401ceab1
mov r8, rdi
lea rax, [rcx + rsi]
sub r8, rsi
mov rdx, rbx
sub rdx, rcx
nop dword [rax]
nop dword [rax + rax]
movzx ecx, byte [r8 + rax]
xor byte [rax], cl
lea rax, [rax + 1]
sub rdx, 1
jne 0x1401ceaa0
mov r9d, 0x1d2
lea r8, str.providersimplementationskdfs_tls1_prf.c
mov rdx, rbx
mov rcx, rdi
call fcn.14010e2b0
mov eax, 1
jmp 0x1401ce96a
mov rax, qword [rsp + 0xa8]
mov r8, r15
mov r9, qword [rsp + 0x90]
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0xa0]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x98]
mov qword [rsp + 0x20], rax
call fcn.1401ce670
xor ecx, ecx
test eax, eax
setne cl
mov eax, ecx
add rsp, 0x50
pop r15
pop r12
pop rbp
ret
Function at 0x1401d78e0
Capabilities:
Encode data using xor

Disassembly:
test rcx, rcx
je 0x1401d7b42
mov qword [rsp + 0x20], rbx
push rsi
mov eax, 0x840
call fcn.140285430
sub rsp, rax
mov rax, qword [0x1403a1e40]
xor rax, rsp
mov qword [rsp + 0x830], rax
mov r11d, dword [rcx + 0x7c]
mov rbx, rcx
mov qword [rsp + 0x860], rdi
mov eax, r11d
mov rdi, qword [rcx + 0x68]
mov rsi, rdx
shl rax, 0xa
mov edx, 8
lea rcx, [rdi - 0x400]
add rcx, rax
lea rax, [rsp + 0x30]
nop
lea rax, [rax + 0x80]
movups xmm0, xmmword [rcx]
lea rcx, [rcx + 0x80]
movups xmmword [rax - 0x80], xmm0
movups xmm1, xmmword [rcx - 0x70]
movups xmmword [rax - 0x70], xmm1
movups xmm0, xmmword [rcx - 0x60]
movups xmmword [rax - 0x60], xmm0
movups xmm1, xmmword [rcx - 0x50]
movups xmmword [rax - 0x50], xmm1
movups xmm0, xmmword [rcx - 0x40]
movups xmmword [rax - 0x40], xmm0
movups xmm1, xmmword [rcx - 0x30]
movups xmmword [rax - 0x30], xmm1
movups xmm0, xmmword [rcx - 0x20]
movups xmmword [rax - 0x20], xmm0
movups xmm1, xmmword [rcx - 0x10]
movups xmmword [rax - 0x10], xmm1
sub rdx, 1
jne 0x1401d7940
mov r10d, dword [rbx + 0x54]
mov r9d, 1
cmp r10d, r9d
jbe 0x1401d7a87
nop word [rax + rax]
lea eax, [r9 + 1]
mov r9d, eax
lea r8, [rsp + 0x30]
imul eax, r11d
lea edx, [rax - 1]
xor eax, eax
shl rdx, 0xa
add rdx, rdi
lea rcx, [rdx + 0x3f8]
cmp r8, rcx
ja 0x1401d7a06
lea rcx, [rsp + 0x428]
cmp rcx, rdx
jb 0x1401d7a06
nop word [rax + rax]
mov rcx, qword [rdx + rax*8]
xor qword [rsp + rax*8 + 0x30], rcx
inc rax
cmp rax, 0x80
jl 0x1401d79f0
jmp 0x1401d7a7e
lea rcx, [rsp + 0x30]
sub rcx, rdx
lea r8, [rsp + 0x40]
sub r8, rdx
lea rax, [rdx + 0x20]
mov edx, reloc.WS2_32.dll_recv
nop
movdqu xmm0, xmmword [rcx + rax - 0x20]
movdqu xmm1, xmmword [rax - 0x20]
lea rax, [rax + 0x40]
xorps xmm1, xmm0
movdqu xmmword [rcx + rax - 0x60], xmm1
movdqu xmm0, xmmword [r8 + rax - 0x60]
movdqu xmm1, xmmword [rax - 0x50]
xorps xmm1, xmm0
movdqu xmm0, xmmword [rax - 0x40]
movdqu xmmword [r8 + rax - 0x60], xmm1
movdqu xmm1, xmmword [rcx + rax - 0x40]
xorps xmm1, xmm0
movdqu xmmword [rcx + rax - 0x40], xmm1
movdqu xmm0, xmmword [r8 + rax - 0x40]
movdqu xmm1, xmmword [rax - 0x30]
xorps xmm1, xmm0
movdqu xmmword [r8 + rax - 0x40], xmm1
sub rdx, 1
jne 0x1401d7a20
cmp r9d, r10d
jb 0x1401d79b0
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x430]
call fcn.1401d82d0
mov r9d, dword [rbx + 8]
lea rax, [rsp + 0x430]
mov rdx, qword [rbx + 0x90]
mov r8, rsi
mov rcx, qword [rbx + 0x88]
mov qword [rsp + 0x28], 0x400
mov qword [rsp + 0x20], rax
call fcn.1401d5cd0
mov edx, 0x400
lea rcx, [rsp + 0x30]
call fcn.140001240
mov edx, 0x400
lea rcx, [rsp + 0x430]
call fcn.140001240
mov edx, dword [rbx + 0x74]
lea r8, str.providersimplementationskdfs_argon2.c
mov rcx, qword [rbx + 0x68]
mov rdi, qword [rsp + 0x860]
shl rdx, 0xa
cmp dword [rbx + 0x64], 0
je 0x1401d7b17
mov r9d, 0x310
call fcn.140139970
jmp 0x1401d7b22
mov r9d, 0x313
call fcn.14010e2b0
mov rcx, qword [rsp + 0x830]
xor rcx, rsp
call fcn.140285090
mov rbx, qword [rsp + 0x868]
add rsp, 0x840
pop rsi
ret
Function at 0x1401db5a0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
mov eax, gethostbyname
call fcn.140285430
sub rsp, rax
xor edi, edi
mov qword [rsp + 0x40], rbp
movsxd rbx, r9d
mov r11, r8
mov dword [rsp + 0x58], reloc.WS2_32.dll_recv
mov rbp, rcx
mov r10d, edi
test r9d, r9d
jle 0x1401db6c4
cmp ebx, 8
jb 0x1401db6c4
lea rax, [rbx - 1]
lea rcx, [rax + rdx]
add rax, r8
cmp rdx, rax
ja 0x1401db5f9
cmp rcx, r8
jae 0x1401db6c4
sub r8, rdx
cmp ebx, 0x40
jb 0x1401db68e
mov eax, ebx
mov qword [rsp + 0x48], rsi
and eax, 0xffffffc0
mov r9, 0xfffffffffffffff0
movsxd rsi, eax
sub r9, rdx
lea rcx, [rdx + 0x10]
movdqu xmm0, xmmword [rcx - 0x10]
add r10d, 0x40
movdqu xmm1, xmmword [rcx + r8 - 0x10]
lea rcx, [rcx + 0x40]
lea rax, [r9 + rcx]
xorps xmm1, xmm0
movdqu xmm0, xmmword [rcx + r8 - 0x40]
movdqu xmmword [rcx - 0x50], xmm1
movdqu xmm2, xmmword [rcx - 0x40]
movdqu xmm1, xmmword [rcx + r8 - 0x30]
xorps xmm2, xmm0
movdqu xmmword [rcx - 0x40], xmm2
movdqu xmm0, xmmword [rcx - 0x30]
xorps xmm1, xmm0
movdqu xmmword [rcx - 0x30], xmm1
movdqu xmm0, xmmword [rcx - 0x20]
movdqu xmm1, xmmword [rcx + r8 - 0x20]
xorps xmm1, xmm0
movdqu xmmword [rcx - 0x20], xmm1
cmp rax, rsi
jl 0x1401db620
mov rsi, qword [rsp + 0x48]
mov eax, ebx
and al, 0x3f
cmp al, 8
jb 0x1401db6c4
mov ecx, ebx
and ecx, 0xfffffff8
movsxd rax, r10d
movsxd r9, ecx
lea rcx, [rax + rdx]
nop dword [rax]
movq xmm0, qword [rcx]
add r10d, 8
movq xmm1, qword [r8 + rcx]
xorps xmm1, xmm0
movq qword [rcx], xmm1
add rcx, 8
mov rax, rcx
sub rax, rdx
cmp rax, r9
jl 0x1401db6a0
movsxd rcx, r10d
mov r8, rbx
cmp rcx, rbx
jge 0x1401db6f1
sub r11, rdx
lea rax, [rcx + rdx]
sub r8, rcx
nop dword [rax]
movzx ecx, byte [r11 + rax]
xor byte [rax], cl
lea rax, [rax + 1]
sub r8, 1
jne 0x1401db6e0
mov rcx, qword [rbp + 0x10]
lea r8, [rsp + 0x58]
mov r9, rdx
mov dword [rsp + 0x20], ebx
call fcn.140108710
mov rbp, qword [rsp + 0x40]
test eax, eax
je 0x1401db724
cmp dword [rsp + 0x58], ebx
sete dil
mov eax, edi
mov rbx, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
mov rbx, qword [rsp + 0x50]
xor eax, eax
add rsp, 0x30
pop rdi
ret

Function at 0x1401db8b0
Capabilities:
Encode data using xor

Disassembly:
mov r11, rdx
mov r10, rcx
test rdx, rdx
je 0x1401db92b
test r8, r8
je 0x1401db92b
mov r9, qword [rcx + 0x28]
cmp r8, r9
cmovb r9, r8
test r9, r9
je 0x1401db8f1
add rcx, 0x34
sub rdx, r10
nop word [rax + rax]
movzx eax, byte [rdx + rcx - 0x34]
xor byte [rcx], al
lea rcx, [rcx + 1]
sub r9, 1
jne 0x1401db8e0
mov rax, qword [r10 + 0x28]
cmp r8, rax
jbe 0x1401db92b
sub r8, rax
cmp r8, 0x10
jbe 0x1401db90b
mov r8d, reloc.WS2_32.dll_recv
jmp 0x1401db910
test r8, r8
je 0x1401db92b
xor ecx, ecx
mov rax, qword [r10 + 0x28]
add rax, rcx
movzx eax, byte [rax + r11]
xor byte [r10 + rcx + 0x54], al
inc rcx
cmp rcx, r8
jb 0x1401db912
ret
Function at 0x14020cf80
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov rbp, rsp
mov eax, 0x50
call fcn.140285430
sub rsp, rax
mov rax, qword [0x1403a1e40]
xor rax, rsp
mov qword [rbp - 0x10], rax
mov r14, qword [rbp + 0x60]
mov rdi, rcx
mov r13, qword [rbp + 0x68]
mov esi, r8d
mov qword [rbp - 0x28], r9
mov r12, rdx
xor r15d, r15d
mov qword [rbp - 0x20], r13
movzx r8d, byte [r14 + 3]
movzx edx, byte [r14 + 7]
movzx eax, byte [r14 + 1]
mov ecx, edx
movzx r10d, byte [r14]
movzx r9d, byte [r14 + 4]
mov ebx, dword [r13]
shl eax, 8
or r10d, eax
shl ecx, 8
movzx eax, byte [r14 + 2]
shl eax, 0x10
or r10d, eax
mov byte [rbp - 0x15], r8b
mov eax, r8d
mov byte [rbp - 0x11], dl
shl eax, 0x18
or r10d, eax
movzx eax, byte [r14 + 5]
shl eax, 8
or r9d, eax
mov dword [rbp - 0x30], r10d
movzx eax, byte [r14 + 6]
or ecx, eax
mov byte [rbp - 0x18], r10b
mov eax, ecx
mov byte [rbp - 0x12], cl
shl eax, 0x10
or r9d, eax
mov eax, r10d
shr eax, 8
mov byte [rbp - 0x17], al
mov eax, r10d
shr eax, 0x10
mov byte [rbp - 0x16], al
mov eax, r9d
shr eax, 8
mov dword [rbp - 0x2c], r9d
mov byte [rbp - 0x14], r9b
mov byte [rbp - 0x13], al
test esi, esi
je 0x14020d13d
mov r13, qword [rbp - 0x28]
sub r12, rdi
movzx edx, r9b
movzx r8d, r10b
nop dword [rax + rax]
dec esi
test ebx, ebx
jne 0x14020d0d7
lea r8d, [rbx + 1]
mov rdx, r13
lea rcx, [rbp - 0x30]
call fcn.140209310
mov r10d, dword [rbp - 0x30]
mov eax, r10d
mov r9d, dword [rbp - 0x2c]
movzx r8d, byte [rbp - 0x30]
movzx edx, byte [rbp - 0x2c]
shr eax, 8
mov byte [rbp - 0x17], al
mov eax, r10d
shr eax, 0x10
mov byte [rbp - 0x16], al
mov eax, r10d
shr eax, 0x18
mov byte [rbp - 0x15], al
mov eax, r9d
shr eax, 8
mov byte [rbp - 0x13], al
mov eax, r9d
shr eax, 0x10
mov byte [rbp - 0x12], al
mov eax, r9d
shr eax, 0x18
mov byte [rbp - 0x11], al
inc r15d
mov byte [rbp - 0x18], r8b
mov byte [rbp - 0x14], dl
movsxd rax, ebx
movzx ecx, byte [rbp + rax - 0x18]
xor cl, byte [rdi]
mov byte [rdi + r12], cl
inc rdi
inc ebx
and ebx, 7
test esi, esi
jne 0x14020d070
mov r13, qword [rbp - 0x20]
test r15d, r15d
je 0x14020d13d
mov eax, r10d
mov byte [r14], r8b
shr eax, 8
mov byte [r14 + 1], al
mov eax, r10d
shr eax, 0x10
mov byte [r14 + 2], al
mov eax, r9d
shr eax, 8
mov byte [r14 + 5], al
mov eax, r9d
shr eax, 0x10
shr r10d, 0x18
shr r9d, 0x18
mov byte [r14 + 7], r9b
mov byte [r14 + 3], r10b
mov byte [r14 + 4], dl
mov byte [r14 + 6], al
mov dword [r13], ebx
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.140285090
mov rbx, qword [rsp + 0x90]
add rsp, 0x50
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x14020de20
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov eax, 0x60
call fcn.140285430
sub rsp, rax
mov rax, qword [0x1403a1e40]
xor rax, rsp
mov qword [rsp + 0x50], rax
mov r14, qword [rsp + 0xd0]
mov r13, r9
mov rax, qword [rsp + 0xc0]
mov rdi, rcx
mov rcx, qword [rsp + 0xc8]
mov esi, r8d
mov r12, qword [rsp + 0xd8]
mov r15, rdx
movzx r8d, byte [r14 + 3]
xor ebp, ebp
movzx edx, byte [r14 + 7]
movzx r9d, byte [r14]
movzx r10d, byte [r14 + 4]
mov ebx, dword [r12]
mov qword [rsp + 0x28], rax
movzx eax, byte [r14 + 1]
shl eax, 8
or r9d, eax
mov qword [rsp + 0x30], rcx
movzx eax, byte [r14 + 2]
mov ecx, edx
shl eax, 0x10
or r9d, eax
shl ecx, 8
mov eax, r8d
mov qword [rsp + 0x38], r14
shl eax, 0x18
or r9d, eax
mov qword [rsp + 0x40], r12
movzx eax, byte [r14 + 5]
shl eax, 8
or r10d, eax
mov dword [rsp + 0x20], r9d
movzx eax, byte [r14 + 6]
or ecx, eax
mov byte [rsp + 0x48], r9b
mov eax, ecx
mov byte [rsp + 0x4b], r8b
shl eax, 0x10
or r10d, eax
mov byte [rsp + 0x4e], cl
mov eax, r9d
mov dword [rsp + 0x24], r10d
shr eax, 8
mov byte [rsp + 0x49], al
mov eax, r9d
shr eax, 0x10
mov byte [rsp + 0x4a], al
mov eax, r10d
shr eax, 8
mov byte [rsp + 0x4c], r10b
mov byte [rsp + 0x4d], al
mov byte [rsp + 0x4f], dl
test esi, esi
je 0x14020e00d
mov r12, qword [rsp + 0x28]
sub r15, rdi
mov r14, qword [rsp + 0x30]
dec esi
test ebx, ebx
jne 0x14020dfa2
mov r9, r14
lea rcx, [rsp + 0x20]
mov r8, r12
mov rdx, r13
call fcn.14020b8c0
mov r9d, dword [rsp + 0x20]
mov eax, r9d
mov r10d, dword [rsp + 0x24]
shr eax, 8
mov byte [rsp + 0x49], al
mov eax, r9d
shr eax, 0x10
mov byte [rsp + 0x4a], al
mov eax, r9d
shr eax, 0x18
mov byte [rsp + 0x4b], al
mov eax, r10d
shr eax, 8
mov byte [rsp + 0x4d], al
mov eax, r10d
shr eax, 0x10
mov byte [rsp + 0x4e], al
mov eax, r10d
shr eax, 0x18
mov byte [rsp + 0x4f], al
inc ebp
mov byte [rsp + 0x48], r9b
mov byte [rsp + 0x4c], r10b
movsxd rax, ebx
movzx ecx, byte [rsp + rax + 0x48]
xor cl, byte [rdi]
mov byte [rdi + r15], cl
inc rdi
inc ebx
and ebx, 7
test esi, esi
jne 0x14020df37
mov r14, qword [rsp + 0x38]
mov r12, qword [rsp + 0x40]
test ebp, ebp
je 0x14020e00d
mov eax, r9d
mov byte [r14], r9b
shr eax, 8
mov byte [r14 + 1], al
mov eax, r9d
shr eax, 0x10
mov byte [r14 + 2], al
mov eax, r10d
shr eax, 8
mov byte [r14 + 5], al
mov eax, r10d
shr eax, 0x10
shr r9d, 0x18
mov byte [r14 + 4], r10b
shr r10d, 0x18
mov byte [r14 + 7], r10b
mov byte [r14 + 3], r9b
mov byte [r14 + 6], al
mov dword [r12], ebx
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.140285090
mov rbx, qword [rsp + 0xa0]
add rsp, 0x60
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x14020fcd0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbx
push rbp
push rsi
push r12
push r13
push r14
push r15
mov eax, 0x50
call fcn.140285430
sub rsp, rax
mov rax, qword [0x1403a1e40]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov r13, qword [rsp + 0xb8]
xor r15d, r15d
mov r14, qword [rsp + 0xb0]
mov ebp, r8d
mov qword [rsp + 0x28], r9
mov r12, rdx
mov rsi, rcx
mov qword [rsp + 0x30], r13
mov ebx, dword [r13]
test ebx, ebx
jns 0x14020fd33
mov dword [r13], 0xffffffff
jmp 0x14020feb8
movzx r10d, byte [r14]
movzx eax, byte [r14 + 1]
mov r9d, r10d
movzx r8d, byte [r14 + 4]
movzx ecx, byte [r14 + 6]
mov edx, r8d
mov qword [rsp + 0x90], rdi
shl r9d, 8
or r9d, eax
shl edx, 8
movzx eax, byte [r14 + 2]
mov r11d, r9d
shl eax, 8
shl r11d, 0x10
or r11d, eax
shl ecx, 8
movzx eax, byte [r14 + 3]
or r11d, eax
mov byte [rsp + 0x38], r10b
movzx eax, byte [r14 + 5]
or edx, eax
mov dword [rsp + 0x20], r11d
movzx eax, byte [r14 + 7]
mov edi, edx
or ecx, eax
shl edi, 0x10
or edi, ecx
mov byte [rsp + 0x39], r9b
mov eax, r11d
mov dword [rsp + 0x24], edi
shr eax, 8
mov byte [rsp + 0x3a], al
mov eax, edi
shr eax, 8
mov byte [rsp + 0x3b], r11b
mov byte [rsp + 0x3c], r8b
mov byte [rsp + 0x3d], dl
mov byte [rsp + 0x3e], al
mov byte [rsp + 0x3f], dil
test ebp, ebp
je 0x14020feac
mov r13, qword [rsp + 0x28]
sub r12, rsi
movzx r8d, dil
movzx edx, r11b
dec ebp
test ebx, ebx
jne 0x14020fe48
mov rdx, r13
lea rcx, [rsp + 0x20]
call fcn.14020f290
mov r11d, dword [rsp + 0x20]
mov eax, r11d
mov edi, dword [rsp + 0x24]
mov edx, r11d
shr eax, 0x18
mov r8d, edi
mov byte [rsp + 0x38], al
mov eax, r11d
shr eax, 0x10
mov byte [rsp + 0x39], al
mov eax, r11d
shr eax, 8
mov byte [rsp + 0x3a], al
mov eax, edi
shr eax, 0x18
mov byte [rsp + 0x3c], al
mov eax, edi
shr eax, 0x10
mov byte [rsp + 0x3d], al
mov eax, edi
shr eax, 8
mov byte [rsp + 0x3e], al
inc r15d
mov byte [rsp + 0x3b], dl
mov byte [rsp + 0x3f], r8b
movsxd rax, ebx
movzx ecx, byte [rsp + rax + 0x38]
xor cl, byte [rsi]
mov byte [rsi + r12], cl
inc rsi
inc ebx
and ebx, 7
test ebp, ebp
jne 0x14020fde1
mov r13, qword [rsp + 0x30]
test r15d, r15d
je 0x14020feac
mov eax, r11d
mov byte [r14 + 3], dl
shr eax, 0x18
mov byte [r14], al
mov eax, r11d
shr eax, 0x10
mov byte [r14 + 1], al
mov eax, edi
shr eax, 0x18
mov byte [r14 + 4], al
mov eax, edi
shr eax, 0x10
shr r11d, 8
shr edi, 8
mov byte [r14 + 6], dil
mov byte [r14 + 2], r11b
mov byte [r14 + 5], al
mov byte [r14 + 7], r8b
mov dword [r13], ebx
mov rdi, qword [rsp + 0x90]
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.140285090
add rsp, 0x50
pop r15
pop r14
pop r13
pop r12
pop rsi
pop rbp
pop rbx
ret
Function at 0x140210d50
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov rbp, rsp
mov eax, 0x50
call fcn.140285430
sub rsp, rax
mov rax, qword [0x1403a1e40]
xor rax, rsp
mov qword [rbp - 0x10], rax
mov r15, qword [rbp + 0x60]
mov rdi, rcx
mov r13, qword [rbp + 0x68]
mov esi, r8d
mov qword [rbp - 0x28], r9
mov r12, rdx
xor r14d, r14d
mov qword [rbp - 0x20], r13
movzx r8d, byte [r15 + 3]
movzx edx, byte [r15 + 7]
movzx eax, byte [r15 + 1]
mov ecx, edx
movzx r10d, byte [r15]
movzx r9d, byte [r15 + 4]
mov ebx, dword [r13]
shl eax, 8
or r10d, eax
shl ecx, 8
movzx eax, byte [r15 + 2]
shl eax, 0x10
or r10d, eax
mov byte [rbp - 0x15], r8b
mov eax, r8d
mov byte [rbp - 0x11], dl
shl eax, 0x18
or r10d, eax
movzx eax, byte [r15 + 5]
shl eax, 8
or r9d, eax
mov dword [rbp - 0x30], r10d
movzx eax, byte [r15 + 6]
or ecx, eax
mov byte [rbp - 0x18], r10b
mov eax, ecx
mov byte [rbp - 0x12], cl
shl eax, 0x10
or r9d, eax
mov eax, r10d
shr eax, 8
mov byte [rbp - 0x17], al
mov eax, r10d
shr eax, 0x10
mov byte [rbp - 0x16], al
mov eax, r9d
shr eax, 8
mov dword [rbp - 0x2c], r9d
mov byte [rbp - 0x14], r9b
mov byte [rbp - 0x13], al
test esi, esi
je 0x140210f05
mov r13, qword [rbp - 0x28]
sub r12, rdi
movzx edx, r9b
movzx r8d, r10b
nop dword [rax + rax]
dec esi
test ebx, ebx
jne 0x140210ea3
mov rdx, r13
lea rcx, [rbp - 0x30]
call fcn.1402109d0
mov r10d, dword [rbp - 0x30]
mov eax, r10d
mov r9d, dword [rbp - 0x2c]
movzx r8d, byte [rbp - 0x30]
movzx edx, byte [rbp - 0x2c]
shr eax, 8
mov byte [rbp - 0x17], al
mov eax, r10d
shr eax, 0x10
mov byte [rbp - 0x16], al
mov eax, r10d
shr eax, 0x18
mov byte [rbp - 0x15], al
mov eax, r9d
shr eax, 8
mov byte [rbp - 0x13], al
mov eax, r9d
shr eax, 0x10
mov byte [rbp - 0x12], al
mov eax, r9d
shr eax, 0x18
mov byte [rbp - 0x11], al
inc r14d
mov byte [rbp - 0x18], r8b
mov byte [rbp - 0x14], dl
movsxd rax, ebx
movzx ecx, byte [rbp + rax - 0x18]
xor cl, byte [rdi]
mov byte [rdi + r12], cl
inc rdi
inc ebx
and ebx, 7
test esi, esi
jne 0x140210e40
mov r13, qword [rbp - 0x20]
test r14d, r14d
je 0x140210f05
mov eax, r10d
mov byte [r15], r8b
shr eax, 8
mov byte [r15 + 1], al
mov eax, r10d
shr eax, 0x10
mov byte [r15 + 2], al
mov eax, r9d
shr eax, 8
mov byte [r15 + 5], al
mov eax, r9d
shr eax, 0x10
shr r10d, 0x18
shr r9d, 0x18
mov byte [r15 + 7], r9b
mov byte [r15 + 3], r10b
mov byte [r15 + 4], dl
mov byte [r15 + 6], al
mov dword [r13], ebx
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.140285090
mov rbx, qword [rsp + 0x90]
add rsp, 0x50
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x140212400
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov eax, 0x50
call fcn.140285430
sub rsp, rax
mov rax, qword [0x1403a1e40]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov r14, qword [rsp + 0xb0]
mov r12, rdx
mov r13, qword [rsp + 0xb8]
mov rsi, rcx
mov qword [rsp + 0x28], r9
mov ebp, r8d
xor r15d, r15d
mov qword [rsp + 0x30], r13
movzx r10d, byte [r14]
movzx eax, byte [r14 + 1]
mov r9d, r10d
movzx r8d, byte [r14 + 4]
movzx ecx, byte [r14 + 6]
mov edx, r8d
mov ebx, dword [r13]
shl r9d, 8
or r9d, eax
shl edx, 8
movzx eax, byte [r14 + 2]
mov r11d, r9d
shl eax, 8
shl r11d, 0x10
or r11d, eax
shl ecx, 8
movzx eax, byte [r14 + 3]
or r11d, eax
mov byte [rsp + 0x38], r10b
movzx eax, byte [r14 + 5]
or edx, eax
mov dword [rsp + 0x20], r11d
movzx eax, byte [r14 + 7]
mov edi, edx
or ecx, eax
shl edi, 0x10
or edi, ecx
mov byte [rsp + 0x39], r9b
mov eax, r11d
mov dword [rsp + 0x24], edi
shr eax, 8
mov byte [rsp + 0x3a], al
mov eax, edi
shr eax, 8
mov byte [rsp + 0x3b], r11b
mov byte [rsp + 0x3c], r8b
mov byte [rsp + 0x3d], dl
mov byte [rsp + 0x3e], al
mov byte [rsp + 0x3f], dil
test ebp, ebp
je 0x1402125cb
mov r13, qword [rsp + 0x28]
sub r12, rsi
movzx r8d, dil
movzx edx, r11b
nop dword [rax]
dec ebp
test ebx, ebx
jne 0x140212567
mov rdx, r13
lea rcx, [rsp + 0x20]
call fcn.140211d40
mov r11d, dword [rsp + 0x20]
mov eax, r11d
mov edi, dword [rsp + 0x24]
mov edx, r11d
shr eax, 0x18
mov r8d, edi
mov byte [rsp + 0x38], al
mov eax, r11d
shr eax, 0x10
mov byte [rsp + 0x39], al
mov eax, r11d
shr eax, 8
mov byte [rsp + 0x3a], al
mov eax, edi
shr eax, 0x18
mov byte [rsp + 0x3c], al
mov eax, edi
shr eax, 0x10
mov byte [rsp + 0x3d], al
mov eax, edi
shr eax, 8
mov byte [rsp + 0x3e], al
inc r15d
mov byte [rsp + 0x3b], dl
mov byte [rsp + 0x3f], r8b
movsxd rax, ebx
movzx ecx, byte [rsp + rax + 0x38]
xor cl, byte [rsi]
mov byte [rsi + r12], cl
inc rsi
inc ebx
and ebx, 7
test ebp, ebp
jne 0x140212500
mov r13, qword [rsp + 0x30]
test r15d, r15d
je 0x1402125cb
mov eax, r11d
mov byte [r14 + 3], dl
shr eax, 0x18
mov byte [r14], al
mov eax, r11d
shr eax, 0x10
mov byte [r14 + 1], al
mov eax, edi
shr eax, 0x18
mov byte [r14 + 4], al
mov eax, edi
shr eax, 0x10
shr r11d, 8
shr edi, 8
mov byte [r14 + 6], dil
mov byte [r14 + 2], r11b
mov byte [r14 + 5], al
mov byte [r14 + 7], r8b
mov dword [r13], ebx
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.140285090
mov rbx, qword [rsp + 0x90]
add rsp, 0x50
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret