joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1401530b0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x20], r9
push rbx
push rbp
push rsi
push rdi
push r12
push r15
sub rsp, 0x28
mov rsi, qword [rsp + 0x88]
mov rbp, qword [rsp + 0x80]
mov r10, r9
mov ebx, dword [rsi]
mov rdi, r8
mov r15, rdx
mov r12, rcx
test ebx, ebx
je 0x140153107
test rdi, rdi
je 0x140153107
mov eax, ebx
inc r15
inc r12
movzx ecx, byte [rax + rbp]
dec rdi
xor cl, byte [r12 - 1]
inc ebx
mov byte [r15 - 1], cl
and ebx, 0xf
jne 0x1401530e3
mov r9, qword [rsp + 0x90]
cmp rdi, 0x10
jb 0x1401531c9
mov qword [rsp + 0x60], r13
mov rsi, r15
mov r13, rdi
shr r13, 4
mov qword [rsp + 0x20], r14
mov r14, r12
sub rsi, rbp
sub r14, rbp
imul rax, r13, 0xfffffffffffffff0
add rdi, rax
mov rax, r13
shl rax, 4
add r15, rax
add r12, rax
mov qword [rsp + 0x68], r15
mov r15, qword [rsp + 0x78]
mov r8, r15
mov rdx, rbp
mov rcx, rbp
call r9
cmp ebx, 0x10
jae 0x140153196
mov edx, reloc.WS2_32.dll_ntohs
mov eax, ebx
sub edx, ebx
add rax, rbp
shr edx, 3
inc edx
nop word [rax + rax]
mov rcx, qword [r14 + rax]
lea rax, [rax + 8]
xor rcx, qword [rax - 8]
mov qword [rsi + rax - 8], rcx
dec rdx
jne 0x140153180
mov r9, qword [rsp + 0x90]
add rsi, 0x10
add r14, 0x10
xor ebx, ebx
dec r13
jne 0x140153154
mov r15, qword [rsp + 0x68]
mov r10, qword [rsp + 0x78]
mov rsi, qword [rsp + 0x88]
mov r14, qword [rsp + 0x20]
mov r13, qword [rsp + 0x60]
test rdi, rdi
je 0x1401531f5
mov r8, r10
mov rdx, rbp
mov rcx, rbp
call r9
nop word [rax + rax]
mov ecx, ebx
inc ebx
movzx eax, byte [rcx + r12]
xor al, byte [rcx + rbp]
mov byte [rcx + r15], al
dec rdi
jne 0x1401531e0
mov dword [rsi], ebx
add rsp, 0x28
pop r15
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x140153210
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
sub rsp, 0x20
mov rbp, qword [rsp + 0x70]
mov r13, qword [rsp + 0x78]
mov r12, r9
mov rdi, r8
mov rbx, rdx
mov rsi, rcx
mov r10, rbp
cmp r8, 0x10
jb 0x140153298
mov rbp, r8
shr rbp, 4
imul rax, rbp, 0xfffffffffffffff0
add rdi, rax
nop dword [rax]
mov r8, rbx
sub r10, rsi
mov rcx, rsi
sub r8, rsi
mov edx, 2
mov rax, qword [r10 + rcx]
lea rcx, [rcx + 8]
xor rax, qword [rcx - 8]
mov qword [r8 + rcx - 8], rax
dec rdx
jne 0x140153261
mov r8, r12
mov rdx, rbx
mov rcx, rbx
call r13
mov r10, rbx
add rbx, 0x10
add rsi, 0x10
dec rbp
jne 0x140153250
mov rbp, qword [rsp + 0x70]
test rdi, rdi
je 0x1401533b2
mov qword [rsp + 0x50], r14
mov qword [rsp + 0x58], r15
nop dword [rax + rax]
mov r8, r10
mov r9, rbx
mov r11d, 1
mov r14d, 2
mov r15d, 3
xor eax, eax
sub r8, rsi
sub r9, rsi
sub r11, rsi
sub r14, rsi
sub r15, rsi
nop dword [rax]
cmp rax, rdi
jae 0x140153354
lea rdx, [rax + rsi]
movzx ecx, byte [r8 + rdx]
xor cl, byte [rdx]
mov byte [r9 + rdx], cl
lea rcx, [r11 + rdx]
cmp rcx, rdi
jae 0x140153351
movzx ecx, byte [rsi + rax + 1]
xor cl, byte [rax + r10 + 1]
mov byte [rbx + rax + 1], cl
lea rcx, [r14 + rdx]
cmp rcx, rdi
jae 0x14015334b
movzx ecx, byte [rsi + rax + 2]
xor cl, byte [rax + r10 + 2]
mov byte [rbx + rax + 2], cl
lea rcx, [r15 + rdx]
cmp rcx, rdi
jae 0x140153345
movzx ecx, byte [rsi + rax + 3]
add rax, 4
xor cl, byte [rax + r10 - 1]
mov byte [rbx + rax - 1], cl
cmp rax, 0x10
jb 0x1401532e0
jmp 0x140153381
add rax, 3
jmp 0x140153354
add rax, 2
jmp 0x140153354
inc rax
cmp rax, 0x10
jae 0x140153381
mov edx, reloc.WS2_32.dll_recv
sub r10, rbx
lea rcx, [rax + rbx]
sub rdx, rax
nop dword [rax]
movzx eax, byte [r10 + rcx]
lea rcx, [rcx + 1]
mov byte [rcx - 1], al
dec rdx
jne 0x140153370
mov r8, r12
mov rdx, rbx
mov rcx, rbx
call r13
mov r10, rbx
cmp rdi, 0x10
jbe 0x1401533a8
add rsi, 0x10
add rbx, 0x10
sub rdi, 0x10
jne 0x1401532b0
mov r14, qword [rsp + 0x50]
mov r15, qword [rsp + 0x58]
movups xmm0, xmmword [r10]
mov rbx, qword [rsp + 0x60]
movups xmmword [rbp], xmm0
add rsp, 0x20
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x1401533d0
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r13
push r14
push r15
sub rsp, 0x50
mov rax, qword [0x140264330]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov r14, qword [rsp + 0xb0]
mov r13, r9
mov rdi, r8
mov rsi, rdx
mov rbx, rcx
cmp rcx, rdx
je 0x140153457
mov r15, r14
cmp r8, 0x10
jb 0x14015344d
mov rbp, r8
shr rbp, 4
imul rax, rbp, 0xfffffffffffffff0
add rdi, rax
nop
mov r8, r13
mov rdx, rsi
mov rcx, rbx
call fcn.140159d70
mov rax, qword [r15]
add rsi, 0x10
xor qword [rsi - 0x10], rax
mov rax, qword [r15 + 8]
mov r15, rbx
xor qword [rsi - 8], rax
add rbx, 0x10
dec rbp
jne 0x140153420
movups xmm0, xmmword [r15]
movups xmmword [r14], xmm0
jmp 0x1401534b4
cmp r8, 0x10
jb 0x1401534b4
mov rbp, r8
shr rbp, 4
imul rax, rbp, 0xfffffffffffffff0
add rdi, rax
nop dword [rax + rax]
lea rdx, [rsp + 0x30]
mov r8, r13
mov rcx, rbx
call fcn.140159d70
mov rcx, qword [rbx]
mov rax, qword [r14]
xor rax, qword [rsp + 0x30]
add rsi, 0x10
add rbx, 0x10
mov qword [rsi - 0x10], rax
mov rax, qword [r14 + 8]
mov qword [r14], rcx
mov rcx, qword [rbx - 8]
xor rax, qword [rsp + 0x38]
mov qword [rsi - 8], rax
mov qword [r14 + 8], rcx
dec rbp
jne 0x140153470
test rdi, rdi
je 0x140153628
lea rcx, [rsp + 0x30]
mov qword [rsp + 0xa0], r12
mov rax, r14
sub rax, rcx
lea rcx, [rsp + 0x30]
mov r12d, 2
mov qword [rsp + 0x28], rax
mov eax, 1
mov ebp, 3
sub rax, rcx
lea r15, [rsp + 0x31]
mov qword [rsp + 0x20], rax
lea rax, [rsp + 0x30]
sub r12, rax
lea rax, [rsp + 0x30]
sub rbp, rax
inc rsi
neg r15
nop dword [rax]
lea rdx, [rsp + 0x30]
mov r8, r13
mov rcx, rbx
call fcn.140159d70
mov r10, qword [rsp + 0x28]
xor eax, eax
lea r9, [r15 + rsi]
nop dword [rax + rax]
cmp rax, rdi
jae 0x1401535df
lea r8, [rsp + 0x30]
add r8, rax
lea rcx, [r15 + r8]
movzx edx, byte [rcx + rbx + 1]
movzx ecx, byte [r8]
xor cl, byte [r10 + r8]
mov byte [r9 + r8], cl
mov rcx, qword [rsp + 0x20]
mov byte [r10 + r8], dl
add rcx, r8
cmp rcx, rdi
jae 0x1401535dc
movzx ecx, byte [rsp + rax + 0x31]
movzx edx, byte [rbx + rax + 1]
xor cl, byte [r14 + rax + 1]
mov byte [rsi + rax], cl
lea rcx, [r12 + r8]
mov byte [r14 + rax + 1], dl
cmp rcx, rdi
jae 0x1401535d6
movzx ecx, byte [rsp + rax + 0x32]
movzx edx, byte [rbx + rax + 2]
xor cl, byte [r14 + rax + 2]
mov byte [rsi + rax + 1], cl
lea rcx, [r8 + rbp]
mov byte [r14 + rax + 2], dl
cmp rcx, rdi
jae 0x1401535d0
movzx edx, byte [rbx + rax + 3]
movzx ecx, byte [rsp + rax + 0x33]
add rax, 4
xor cl, byte [r14 + rax - 1]
mov byte [rsi + rax - 2], cl
mov byte [r14 + rax - 1], dl
cmp rax, 0x10
jb 0x140153530
jmp 0x1401535df
add rax, 3
jmp 0x1401535df
add rax, 2
jmp 0x1401535df
inc rax
cmp rdi, 0x10
jbe 0x1401535f9
add rbx, 0x10
add rsi, 0x10
sub rdi, 0x10
jne 0x140153510
jmp 0x140153620
cmp rax, 0x10
jae 0x140153620
mov edx, reloc.WS2_32.dll_recv
sub rbx, r14
lea rcx, [r14 + rax]
sub rdx, rax
nop
movzx eax, byte [rbx + rcx]
lea rcx, [rcx + 1]
mov byte [rcx - 1], al
dec rdx
jne 0x140153610
mov r12, qword [rsp + 0xa0]
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.1401bb2c0
add rsp, 0x50
pop r15
pop r14
pop r13
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x140153650
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x50
mov rax, qword [0x140264330]
xor rax, rsp
mov qword [rbp - 8], rax
mov rax, qword [rbp + 0x60]
mov r13, qword [rbp + 0x68]
mov rsi, rcx
movzx r10d, byte [rax]
mov ebx, dword [r13]
lea rdi, [rax + 1]
movzx ecx, byte [rdi + 6]
mov qword [rbp - 0x18], rax
movzx eax, byte [rdi]
shl eax, 8
mov r12, rdx
movzx edx, byte [rdi + 3]
or r10d, eax
movzx eax, byte [rdi + 1]
shl ecx, 8
shl eax, 0x10
mov r14d, r8d
lea r8, [rdi + 5]
or r10d, eax
movzx eax, byte [rdi + 2]
xor r15d, r15d
shl eax, 0x18
mov qword [rbp - 0x28], r9
mov qword [rbp - 0x20], r13
or r10d, eax
movzx eax, byte [rdi + 4]
shl eax, 8
mov dword [rbp - 0x30], r10d
mov byte [rbp - 0x10], r10b
or edx, eax
movzx eax, byte [r8]
or ecx, eax
mov eax, r10d
shr eax, 8
shl ecx, 0x10
mov byte [rbp - 0xf], al
or edx, ecx
mov eax, r10d
shr eax, 0x10
mov dword [rbp - 0x2c], edx
mov byte [rbp - 0xc], dl
mov byte [rbp - 0xe], al
mov eax, r10d
shr eax, 0x18
mov byte [rbp - 0xd], al
mov eax, edx
shr eax, 8
mov byte [rbp - 0xb], al
mov eax, edx
shr eax, 0x10
mov byte [rbp - 0xa], al
mov eax, edx
shr eax, 0x18
mov byte [rbp - 9], al
test r14d, r14d
je 0x140153802
mov r13, qword [rbp - 0x28]
sub r12, rsi
movzx r8d, dl
movzx r9d, r10b
nop word [rax + rax]
dec r14d
test ebx, ebx
jne 0x1401537a2
lea rcx, [rbp - 0x30]
mov rdx, r13
call fcn.140153ed0
mov r10d, dword [rbp - 0x30]
mov edx, dword [rbp - 0x2c]
movzx r9d, byte [rbp - 0x30]
movzx r8d, byte [rbp - 0x2c]
mov eax, r10d
shr eax, 8
mov byte [rbp - 0x10], r9b
mov byte [rbp - 0xc], r8b
mov byte [rbp - 0xf], al
mov eax, r10d
shr eax, 0x10
mov byte [rbp - 0xe], al
mov eax, r10d
shr eax, 0x18
mov byte [rbp - 0xd], al
mov eax, edx
shr eax, 8
mov byte [rbp - 0xb], al
mov eax, edx
shr eax, 0x10
mov byte [rbp - 0xa], al
mov eax, edx
shr eax, 0x18
inc r15d
mov byte [rbp - 9], al
movsxd rax, ebx
inc rsi
movzx ecx, byte [rbp + rax - 0x10]
xor cl, byte [rsi - 1]
inc ebx
mov byte [r12 + rsi - 1], cl
and ebx, 7
test r14d, r14d
jne 0x140153740
mov r13, qword [rbp - 0x20]
test r15d, r15d
je 0x140153802
mov rax, qword [rbp - 0x18]
mov byte [rax], r9b
mov eax, r10d
shr eax, 8
mov byte [rdi], al
mov eax, r10d
shr r10d, 0x18
shr eax, 0x10
mov byte [rdi + 1], al
mov byte [rdi + 2], r10b
mov byte [rdi + 3], r8b
mov eax, edx
shr eax, 8
mov byte [rdi + 4], al
mov eax, edx
shr eax, 0x10
shr edx, 0x18
mov byte [rdi + 5], al
mov byte [rdi + 6], dl
mov dword [r13], ebx
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.1401bb2c0
mov rbx, qword [rsp + 0x90]
add rsp, 0x50
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x140153830
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
sub rsp, 8
mov qword [rsp + 0x18], rsi
mov qword [rsp], rdi
mov edi, 0x80
cmp edx, edi
mov r10, rcx
mov byte [rcx], 0
cmovg edx, edi
mov r11d, 0x400
test r9d, r9d
jle 0x140153862
cmp r9d, r11d
cmovg r9d, r11d
mov r11d, r9d
movsxd r9, edx
test edx, edx
jle 0x140153881
sub r8, rcx
mov rdx, r9
nop
movzx eax, byte [r8 + rcx]
lea rcx, [rcx + 1]
mov byte [rcx - 1], al
dec rdx
jne 0x140153870
movzx ecx, byte [r9 + r10 - 1]
lea rdx, [r9 + r10]
lea rsi, [0x1402402d0]
cmp r9, rdi
jge 0x1401538ce
mov qword [rsp + 0x10], rbx
mov rbx, r9
mov r8, rdi
neg rbx
sub r8, r9
nop dword [rax + rax]
movzx eax, byte [rdx + rbx]
lea rdx, [rdx + 1]
add eax, ecx
movzx ecx, al
movzx ecx, byte [rcx + rsi]
mov byte [rdx - 1], cl
dec r8
jne 0x1401538b0
mov rbx, qword [rsp + 0x10]
lea r9d, [r11 + 7]
neg r11d
mov eax, 0xff
sar r9d, 3
and r11d, 7
sub edi, r9d
movzx ecx, r11b
sar eax, cl
movsxd r8, edi
mov rdi, qword [rsp]
mov ecx, eax
movzx eax, byte [r8 + r10]
lea rdx, [r8 + r10]
and rcx, rax
movzx eax, byte [rcx + rsi]
mov byte [rdx], al
test r8, r8
je 0x140153928
movsxd r9, r9d
nop
movzx ecx, byte [rdx + r9 - 1]
lea rdx, [rdx - 1]
xor rcx, rax
movzx eax, byte [rcx + rsi]
mov byte [rdx], al
dec r8
jne 0x140153910
mov rsi, qword [rsp + 0x18]
lea r8, [r10 + 0xfc]
lea rdx, [r10 + 0x7e]
mov r9d, 0x40
nop
movzx eax, byte [rdx]
movzx ecx, byte [rdx + 1]
lea r8, [r8 - 4]
shl ecx, 8
lea rdx, [rdx - 2]
or ecx, eax
movzx eax, cx
mov dword [r8 + 4], eax
dec r9
jne 0x140153940
add rsp, 8
ret
Function at 0x140155f50
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x50
mov rax, qword [0x140264330]
xor rax, rsp
mov qword [rbp - 8], rax
mov rax, qword [rbp + 0x60]
mov r13, qword [rbp + 0x68]
mov rsi, rcx
movzx r10d, byte [rax]
mov ebx, dword [r13]
lea rdi, [rax + 1]
movzx ecx, byte [rdi + 6]
mov qword [rbp - 0x18], rax
movzx eax, byte [rdi]
shl eax, 8
mov r12, rdx
movzx edx, byte [rdi + 3]
or r10d, eax
movzx eax, byte [rdi + 1]
shl ecx, 8
shl eax, 0x10
mov r14d, r8d
lea r8, [rdi + 5]
or r10d, eax
movzx eax, byte [rdi + 2]
xor r15d, r15d
shl eax, 0x18
mov qword [rbp - 0x28], r9
mov qword [rbp - 0x20], r13
or r10d, eax
movzx eax, byte [rdi + 4]
shl eax, 8
mov dword [rbp - 0x30], r10d
mov byte [rbp - 0x10], r10b
or edx, eax
movzx eax, byte [r8]
or ecx, eax
mov eax, r10d
shr eax, 8
shl ecx, 0x10
mov byte [rbp - 0xf], al
or edx, ecx
mov eax, r10d
shr eax, 0x10
mov dword [rbp - 0x2c], edx
mov byte [rbp - 0xc], dl
mov byte [rbp - 0xe], al
mov eax, r10d
shr eax, 0x18
mov byte [rbp - 0xd], al
mov eax, edx
shr eax, 8
mov byte [rbp - 0xb], al
mov eax, edx
shr eax, 0x10
mov byte [rbp - 0xa], al
mov eax, edx
shr eax, 0x18
mov byte [rbp - 9], al
test r14d, r14d
je 0x14015610a
mov r13, qword [rbp - 0x28]
sub r12, rsi
movzx r8d, dl
movzx r9d, r10b
nop word [rax + rax]
dec r14d
test ebx, ebx
jne 0x1401560a6
lea r8d, [rbx + 1]
lea rcx, [rbp - 0x30]
mov rdx, r13
call fcn.140154b00
mov r10d, dword [rbp - 0x30]
mov edx, dword [rbp - 0x2c]
movzx r9d, byte [rbp - 0x30]
movzx r8d, byte [rbp - 0x2c]
mov eax, r10d
shr eax, 8
mov byte [rbp - 0x10], r9b
mov byte [rbp - 0xc], r8b
mov byte [rbp - 0xf], al
mov eax, r10d
shr eax, 0x10
mov byte [rbp - 0xe], al
mov eax, r10d
shr eax, 0x18
mov byte [rbp - 0xd], al
mov eax, edx
shr eax, 8
mov byte [rbp - 0xb], al
mov eax, edx
shr eax, 0x10
mov byte [rbp - 0xa], al
mov eax, edx
shr eax, 0x18
inc r15d
mov byte [rbp - 9], al
movsxd rax, ebx
inc rsi
movzx ecx, byte [rbp + rax - 0x10]
xor cl, byte [rsi - 1]
inc ebx
mov byte [r12 + rsi - 1], cl
and ebx, 7
test r14d, r14d
jne 0x140156040
mov r13, qword [rbp - 0x20]
test r15d, r15d
je 0x14015610a
mov rax, qword [rbp - 0x18]
mov byte [rax], r9b
mov eax, r10d
shr eax, 8
mov byte [rdi], al
mov eax, r10d
shr r10d, 0x18
shr eax, 0x10
mov byte [rdi + 1], al
mov byte [rdi + 2], r10b
mov byte [rdi + 3], r8b
mov eax, edx
shr eax, 8
mov byte [rdi + 4], al
mov eax, edx
shr eax, 0x10
shr edx, 0x18
mov byte [rdi + 5], al
mov byte [rdi + 6], dl
mov dword [r13], ebx
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.1401bb2c0
mov rbx, qword [rsp + 0x90]
add rsp, 0x50
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x140156f60
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x70
mov rax, qword [0x140264330]
xor rax, rsp
mov qword [rbp - 0x10], rax
mov rax, qword [rbp + 0x60]
mov r13, qword [rbp + 0x78]
mov r10, qword [rbp + 0x68]
mov ebx, dword [r13]
mov qword [rbp - 0x48], rax
mov rax, qword [rbp + 0x70]
lea rdi, [rax + 1]
mov qword [rbp - 0x28], rax
mov r14d, r8d
movzx r8d, byte [rax]
movzx eax, byte [rdi]
mov rsi, rcx
movzx ecx, byte [rdi + 6]
shl eax, 8
mov qword [rbp - 0x30], r9
movzx r9d, byte [rdi + 3]
or r8d, eax
movzx eax, byte [rdi + 1]
shl eax, 0x10
shl ecx, 8
xor r12d, r12d
or r8d, eax
movzx eax, byte [rdi + 2]
mov r15, rdx
shl eax, 0x18
mov qword [rbp - 0x40], r10
mov qword [rbp - 0x20], r13
or r8d, eax
movzx eax, byte [rdi + 4]
mov qword [rbp - 0x38], rdi
shl eax, 8
mov dword [rbp - 0x50], r8d
mov byte [rbp - 0x18], r8b
or r9d, eax
movzx eax, byte [rdi + 5]
or ecx, eax
mov eax, r8d
shr eax, 8
shl ecx, 0x10
mov byte [rbp - 0x17], al
or r9d, ecx
mov eax, r8d
shr eax, 0x10
mov dword [rbp - 0x4c], r9d
mov byte [rbp - 0x14], r9b
mov byte [rbp - 0x16], al
mov eax, r8d
shr eax, 0x18
mov byte [rbp - 0x15], al
mov eax, r9d
shr eax, 8
mov byte [rbp - 0x13], al
mov eax, r9d
shr eax, 0x10
mov byte [rbp - 0x12], al
mov eax, r9d
shr eax, 0x18
mov byte [rbp - 0x11], al
test r14d, r14d
je 0x140157138
mov r13, qword [rbp - 0x30]
mov rdi, qword [rbp - 0x48]
sub r15, rsi
nop
dec r14d
test ebx, ebx
jne 0x1401570cc
lea rcx, [rbp - 0x50]
mov r9, r10
mov r8, rdi
mov rdx, r13
call fcn.1401551b0
mov r8d, dword [rbp - 0x50]
mov r9d, dword [rbp - 0x4c]
mov r10, qword [rbp - 0x40]
movzx eax, r8b
mov byte [rbp - 0x18], al
mov eax, r8d
shr eax, 8
mov byte [rbp - 0x17], al
mov eax, r8d
shr eax, 0x10
mov byte [rbp - 0x16], al
mov eax, r8d
shr eax, 0x18
mov byte [rbp - 0x15], al
movzx eax, r9b
mov byte [rbp - 0x14], al
mov eax, r9d
shr eax, 8
mov byte [rbp - 0x13], al
mov eax, r9d
shr eax, 0x10
mov byte [rbp - 0x12], al
mov eax, r9d
shr eax, 0x18
inc r12d
mov byte [rbp - 0x11], al
movsxd rax, ebx
inc rsi
movzx ecx, byte [rbp + rax - 0x18]
xor cl, byte [rsi - 1]
inc ebx
mov byte [r15 + rsi - 1], cl
and ebx, 7
test r14d, r14d
jne 0x140157060
mov rdi, qword [rbp - 0x38]
mov r13, qword [rbp - 0x20]
test r12d, r12d
je 0x140157138
mov rax, qword [rbp - 0x28]
mov byte [rax], r8b
mov eax, r8d
shr eax, 8
mov byte [rdi], al
mov eax, r8d
shr r8d, 0x18
shr eax, 0x10
mov byte [rdi + 1], al
mov byte [rdi + 2], r8b
mov byte [rdi + 3], r9b
mov eax, r9d
shr eax, 8
mov byte [rdi + 4], al
mov eax, r9d
shr eax, 0x10
shr r9d, 0x18
mov byte [rdi + 5], al
mov byte [rdi + 6], r9b
mov dword [r13], ebx
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.1401bb2c0
mov rbx, qword [rsp + 0xb0]
add rsp, 0x70
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x140157160
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x50
mov rax, qword [0x140264330]
xor rax, rsp
mov qword [rbp - 8], rax
mov rax, qword [rbp + 0x60]
mov r13, qword [rbp + 0x68]
mov r14d, r8d
movzx r10d, byte [rax]
movzx r8d, byte [rax + 4]
mov ebx, dword [r13]
lea rdi, [rax + 1]
mov qword [rbp - 0x18], rax
shl r10d, 0x18
movzx eax, byte [rdi]
mov rsi, rcx
movzx ecx, byte [rdi + 5]
shl eax, 0x10
shl r8d, 0x18
shl ecx, 8
or r10d, eax
movzx eax, byte [rdi + 1]
mov r12, rdx
shl eax, 8
lea rdx, [rdi + 5]
xor r15d, r15d
or r10d, eax
movzx eax, byte [rdi + 2]
mov qword [rbp - 0x28], r9
or r10d, eax
movzx eax, byte [rdi + 4]
mov qword [rbp - 0x20], r13
shl eax, 0x10
mov dword [rbp - 0x30], r10d
mov byte [rbp - 0xd], r10b
or r8d, eax
movzx eax, byte [rdx + 1]
or ecx, eax
mov eax, r10d
shr eax, 0x18
or r8d, ecx
mov byte [rbp - 0x10], al
mov eax, r10d
mov dword [rbp - 0x2c], r8d
shr eax, 0x10
mov byte [rbp - 9], r8b
mov byte [rbp - 0xf], al
mov eax, r10d
shr eax, 8
mov byte [rbp - 0xe], al
mov eax, r8d
shr eax, 0x18
mov byte [rbp - 0xc], al
mov eax, r8d
shr eax, 0x10
mov byte [rbp - 0xb], al
mov eax, r8d
shr eax, 8
mov byte [rbp - 0xa], al
test r14d, r14d
je 0x14015731a
mov r13, qword [rbp - 0x28]
sub r12, rsi
movzx edx, r8b
movzx r9d, r10b
dec r14d
test ebx, ebx
jne 0x1401572b7
lea rcx, [rbp - 0x30]
mov rdx, r13
call fcn.140157b70
mov r10d, dword [rbp - 0x30]
mov r8d, dword [rbp - 0x2c]
mov eax, r10d
movzx edx, r8b
movzx r9d, r10b
shr eax, 0x18
mov byte [rbp - 0xd], r10b
mov byte [rbp - 9], dl
mov byte [rbp - 0x10], al
mov eax, r10d
shr eax, 0x10
mov byte [rbp - 0xf], al
mov eax, r10d
shr eax, 8
mov byte [rbp - 0xe], al
mov eax, r8d
shr eax, 0x18
mov byte [rbp - 0xc], al
mov eax, r8d
shr eax, 0x10
mov byte [rbp - 0xb], al
mov eax, r8d
shr eax, 8
inc r15d
mov byte [rbp - 0xa], al
movsxd rax, ebx
inc rsi
movzx ecx, byte [rbp + rax - 0x10]
xor cl, byte [rsi - 1]
inc ebx
mov byte [r12 + rsi - 1], cl
and ebx, 7
test r14d, r14d
jne 0x140157254
mov r13, qword [rbp - 0x20]
test r15d, r15d
je 0x14015731a
mov rcx, qword [rbp - 0x18]
mov eax, r10d
shr eax, 0x18
mov byte [rcx], al
mov eax, r10d
shr r10d, 8
shr eax, 0x10
mov byte [rdi], al
mov byte [rdi + 1], r10b
mov byte [rdi + 2], r9b
mov eax, r8d
shr eax, 0x18
mov byte [rdi + 3], al
mov eax, r8d
shr eax, 0x10
shr r8d, 8
mov byte [rdi + 4], al
mov byte [rdi + 5], r8b
mov byte [rdi + 6], dl
mov dword [r13], ebx
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.1401bb2c0
mov rbx, qword [rsp + 0x90]
add rsp, 0x50
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x140165910
Capabilities:
Check for software breakpoints

Disassembly:
sub rsp, 0x38
mov r11, rcx
cmp dword [rsp + 0x60], r9d
jne 0x1401659fb
movzx r10d, byte [r8]
lea eax, [r10 - 0x6a]
cmp al, 1
ja 0x1401659fb
mov qword [rsp + 0x30], rbx
lea rdx, [r8 + 1]
cmp r10b, 0x6b
jne 0x1401659aa
lea ebx, [r9 - 3]
xor eax, eax
test ebx, ebx
jle 0x140165966
nop dword [rax + rax]
movzx ecx, byte [rdx]
inc rdx
cmp cl, 0xba
je 0x140165966
cmp cl, 0xbb
jne 0x140165999
inc eax
cmp eax, ebx
jl 0x140165950
sub ebx, eax
test eax, eax
jne 0x1401659ae
mov dword [rsp + 0x20], 0x8a
lea r9, [0x1402b4548]
mov edx, 0x80
lea ecx, [rdx - 0x7c]
lea r8d, [rdx + 0xa]
call fcn.1400dabf0
mov rbx, qword [rsp + 0x30]
or eax, 0xffffffff
add rsp, 0x38
ret
mov dword [rsp + 0x20], 0x81
lea r9, [0x1402b4578]
jmp 0x14016597b
lea ebx, [r9 - 2]
movsxd rax, ebx
cmp byte [rax + rdx], 0xcc
je 0x1401659e4
mov edx, 0x80
lea r9, str.....opensslopensslcrypto_rsa_rsa_x931.c
mov dword [rsp + 0x20], __WSAFDIsSet
lea ecx, [rdx - 0x7c]
lea r8d, [rdx + 0xb]
call fcn.1400dabf0
mov rbx, qword [rsp + 0x30]
or eax, 0xffffffff
add rsp, 0x38
ret
mov r8d, ebx
mov rcx, r11
call sub.MSVCR120.dll_memcpy
mov eax, ebx
mov rbx, qword [rsp + 0x30]
add rsp, 0x38
ret
mov edx, 0x80
lea r9, [0x1402b44e8]
mov dword [rsp + 0x20], WSACleanup
lea ecx, [rdx - 0x7c]
lea r8d, [rdx + 9]
call fcn.1400dabf0
or eax, 0xffffffff
add rsp, 0x38
ret
Function at 0x140171370
Capabilities:
Encode data using xor
Encrypt data using blowfish
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov r10, r8
mov rdi, rcx
mov r9, rcx
mov r8d, edx
mov ecx, 0x20
lea rax, [0x140243890]
nop word [rax + rax]
movups xmm0, xmmword [rax]
lea r9, [r9 + 0x80]
lea rax, [rax + 0x80]
movups xmmword [r9 - 0x80], xmm0
movups xmm1, xmmword [rax - 0x70]
movups xmmword [r9 - 0x70], xmm1
movups xmm0, xmmword [rax - 0x60]
movups xmmword [r9 - 0x60], xmm0
movups xmm1, xmmword [rax - 0x50]
movups xmmword [r9 - 0x50], xmm1
movups xmm0, xmmword [rax - 0x40]
movups xmmword [r9 - 0x40], xmm0
movups xmm1, xmmword [rax - 0x30]
movups xmmword [r9 - 0x30], xmm1
movups xmm0, xmmword [rax - 0x20]
movups xmmword [r9 - 0x20], xmm0
movups xmm1, xmmword [rax - 0x10]
movups xmmword [r9 - 0x10], xmm1
dec rcx
jne 0x1401713a0
movups xmm0, xmmword [rax]
movups xmmword [r9], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [r9 + 0x10], xmm1
movups xmm0, xmmword [rax + 0x20]
movups xmmword [r9 + 0x20], xmm0
movups xmm1, xmmword [rax + 0x30]
movups xmmword [r9 + 0x30], xmm1
mov rcx, qword [rax + 0x40]
mov eax, 0x48
cmp edx, eax
mov qword [r9 + 0x40], rcx
mov rdx, r10
cmovg r8d, eax
movsxd r8, r8d
add r8, r10
xor ebx, ebx
mov r9d, ebx
nop dword [rax]
movzx ecx, byte [rdx]
inc rdx
cmp rdx, r8
cmovae rdx, r10
shl ecx, 8
movzx eax, byte [rdx]
inc rdx
or ecx, eax
cmp rdx, r8
cmovae rdx, r10
shl ecx, 8
movzx eax, byte [rdx]
inc rdx
or ecx, eax
cmp rdx, r8
cmovae rdx, r10
shl ecx, 8
movzx eax, byte [rdx]
inc rdx
or ecx, eax
cmp rdx, r8
cmovae rdx, r10
xor dword [rdi + r9*4], ecx
inc r9
cmp r9, 0x12
jl 0x140171440
mov qword [rsp + 0x30], rbx
mov rsi, rbx
nop dword [rax + rax]
lea rcx, [rsp + 0x30]
mov rdx, rdi
call fcn.140171510
mov eax, dword [rsp + 0x30]
add rsi, 2
mov dword [rdi + rsi*4 - 8], eax
mov eax, dword [rsp + 0x34]
mov dword [rdi + rsi*4 - 4], eax
cmp rsi, 0x12
jl 0x1401714a0
nop word [rax + rax]
lea rcx, [rsp + 0x30]
mov rdx, rdi
call fcn.140171510
mov eax, dword [rsp + 0x30]
add rbx, 2
mov dword [rdi + rbx*4 + 0x40], eax
mov eax, dword [rsp + 0x34]
mov dword [rdi + rbx*4 + 0x44], eax
cmp rbx, 0x400
jl 0x1401714d0
mov rbx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret