joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1401dad40
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
mov eax, 0x60
call fcn.1402563f0
sub rsp, rax
mov rax, qword [0x1403bb2d8]
xor rax, rsp
mov qword [rsp + 0x50], rax
mov rax, qword [rcx + 0x68]
mov rsi, r9
xor edi, edi
shr rsi, 4
mov rbp, r9
mov r12, r8
mov r14, rdx
mov rbx, rcx
lea r13, [rax + rsi]
test rsi, rsi
je 0x1401dadfb
cmp qword [rcx + 0x20], rdi
je 0x1401dadfb
mov rax, r13
mov edx, edi
shr rax, 1
je 0x1401dada8
nop dword [rax]
inc rdx
shr rax, 1
jne 0x1401dada0
call fcn.1401da660
test rax, rax
jne 0x1401dadb9
xor eax, eax
jmp 0x1401daf7a
mov rdx, qword [rbx + 0x68]
mov r9, qword [rbx + 0x10]
lea rax, [rbx + 0xa0]
mov qword [rsp + 0x38], rax
mov rax, qword [rbx + 0x58]
inc rdx
mov qword [rsp + 0x30], rax
lea rcx, [rbx + 0x90]
mov r8, rsi
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x20], rdx
mov rdx, r12
mov rcx, r14
call qword [rbx + 0x20]
jmp 0x1401daece
lea rsi, [rax + 1]
cmp rsi, r13
ja 0x1401daece
nop dword [rax + rax]
mov rax, rsi
mov ecx, edi
test sil, 1
jne 0x1401dae29
nop dword [rax + rax]
shr rax, 1
inc ecx
test al, 1
je 0x1401dae20
mov edx, ecx
mov rcx, rbx
call fcn.1401da660
test rax, rax
je 0x1401dadb2
mov rcx, qword [rax]
mov r8, qword [rbx + 0x10]
lea rdx, [rsp + 0x40]
xor qword [rbx + 0x90], rcx
mov rax, qword [rax + 8]
add r14, 0x10
xor qword [rbx + 0x98], rax
mov rcx, qword [r14 - 8]
mov rax, qword [r14 - 0x10]
xor qword [rbx + 0xa8], rcx
xor rcx, qword [rbx + 0x98]
xor qword [rbx + 0xa0], rax
xor rax, qword [rbx + 0x90]
mov qword [rsp + 0x48], rcx
lea rcx, [rsp + 0x40]
mov qword [rsp + 0x40], rax
call qword [rbx]
mov r11, qword [rsp + 0x40]
xor r11, qword [rbx + 0x90]
mov rax, qword [rsp + 0x48]
inc rsi
xor rax, qword [rbx + 0x98]
mov qword [r12], r11
add r12, 0x10
mov qword [r12 - 8], rax
mov qword [rsp + 0x40], r11
mov qword [rsp + 0x48], rax
cmp rsi, r13
jbe 0x1401dae10
and ebp, 0xf
jbe 0x1401daf71
mov rax, qword [rbx + 0x38]
mov r8, qword [rbx + 0x10]
lea rcx, [rbx + 0x90]
xor qword [rcx], rax
mov rax, qword [rbx + 0x40]
lea rdx, [rsp + 0x40]
xor qword [rbx + 0x98], rax
call qword [rbx]
test rbp, rbp
je 0x1401daf38
lea rax, [rsp + 0x40]
mov r8, r14
sub r8, rax
lea rax, [rsp + 0x40]
sub r12, rax
nop word [rax + rax]
lea rcx, [rsp + rdi + 0x40]
inc rdi
movzx eax, byte [r8 + rcx]
xor al, byte [rcx]
mov byte [r12 + rcx], al
cmp rdi, rbp
jb 0x1401daf20
xor eax, eax
lea rcx, [rsp + 0x40]
mov r8, rbp
mov rdx, r14
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x48], rax
call fcn.140255100
mov byte [rsp + rbp + 0x40], 0x80
mov rax, qword [rsp + 0x40]
xor qword [rbx + 0xa0], rax
mov rax, qword [rsp + 0x48]
xor qword [rbx + 0xa8], rax
mov qword [rbx + 0x68], r13
mov eax, 1
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.140254fb0
add rsp, 0x60
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x1401dafa0
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
mov eax, 0x60
call fcn.1402563f0
sub rsp, rax
mov rax, qword [0x1403bb2d8]
xor rax, rsp
mov qword [rsp + 0x50], rax
mov rax, qword [rcx + 0x68]
mov rsi, r9
xor edi, edi
shr rsi, 4
mov rbp, r9
mov r14, r8
mov r12, rdx
mov rbx, rcx
lea r13, [rax + rsi]
test rsi, rsi
je 0x1401db05b
cmp qword [rcx + 0x20], rdi
je 0x1401db05b
mov rax, r13
mov edx, edi
shr rax, 1
je 0x1401db008
nop dword [rax]
inc rdx
shr rax, 1
jne 0x1401db000
call fcn.1401da660
test rax, rax
jne 0x1401db019
xor eax, eax
jmp 0x1401db1da
mov rdx, qword [rbx + 0x68]
mov r9, qword [rbx + 0x18]
lea rax, [rbx + 0xa0]
mov qword [rsp + 0x38], rax
mov rax, qword [rbx + 0x58]
inc rdx
mov qword [rsp + 0x30], rax
lea rcx, [rbx + 0x90]
mov r8, rsi
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x20], rdx
mov rdx, r14
mov rcx, r12
call qword [rbx + 0x20]
jmp 0x1401db12f
lea rsi, [rax + 1]
cmp rsi, r13
ja 0x1401db12f
nop dword [rax + rax]
mov rax, rsi
mov ecx, edi
test sil, 1
jne 0x1401db089
nop dword [rax + rax]
shr rax, 1
inc ecx
test al, 1
je 0x1401db080
mov edx, ecx
mov rcx, rbx
call fcn.1401da660
test rax, rax
je 0x1401db012
mov rcx, qword [rax]
mov r8, qword [rbx + 0x18]
lea rdx, [rsp + 0x40]
xor qword [rbx + 0x90], rcx
mov rax, qword [rax + 8]
add r12, 0x10
xor qword [rbx + 0x98], rax
mov rcx, qword [r12 - 8]
mov rax, qword [r12 - 0x10]
xor rcx, qword [rbx + 0x98]
xor rax, qword [rbx + 0x90]
mov qword [rsp + 0x48], rcx
lea rcx, [rsp + 0x40]
mov qword [rsp + 0x40], rax
call qword [rbx + reloc.WS2_32.dll_htonl]
mov r11, qword [rsp + 0x40]
mov rax, qword [rsp + 0x48]
xor r11, qword [rbx + 0x90]
xor rax, qword [rbx + 0x98]
inc rsi
xor qword [rbx + 0xa0], r11
xor qword [rbx + 0xa8], rax
mov qword [r14], r11
mov qword [r14 + 8], rax
add r14, 0x10
mov qword [rsp + 0x40], r11
mov qword [rsp + 0x48], rax
cmp rsi, r13
jbe 0x1401db070
and ebp, 0xf
jbe 0x1401db1d1
mov rax, qword [rbx + 0x38]
mov r8, qword [rbx + 0x10]
lea rcx, [rbx + 0x90]
xor qword [rcx], rax
mov rax, qword [rbx + 0x40]
lea rdx, [rsp + 0x40]
xor qword [rbx + 0x98], rax
call qword [rbx]
test rbp, rbp
je 0x1401db198
lea rax, [rsp + 0x40]
mov r8, r14
sub r12, rax
lea rax, [rsp + 0x40]
sub r8, rax
nop word [rax + rax]
lea rcx, [rsp + rdi + 0x40]
inc rdi
movzx eax, byte [r12 + rcx]
xor al, byte [rcx]
mov byte [r8 + rcx], al
cmp rdi, rbp
jb 0x1401db180
xor eax, eax
lea rcx, [rsp + 0x40]
mov r8, rbp
mov rdx, r14
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x48], rax
call fcn.140255100
mov byte [rsp + rbp + 0x40], 0x80
mov rax, qword [rsp + 0x40]
xor qword [rbx + 0xa0], rax
mov rax, qword [rsp + 0x48]
xor qword [rbx + 0xa8], rax
mov qword [rbx + 0x68], r13
mov eax, 1
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.140254fb0
add rsp, 0x60
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x1401dc670
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov rbp, rsp
mov eax, 0x50
call fcn.1402563f0
sub rsp, rax
mov rax, qword [0x1403bb2d8]
xor rax, rsp
mov qword [rbp - 8], rax
mov rax, qword [rbp + 0x60]
mov r15, qword [rbp + 0x68]
mov r12d, r8d
movzx r10d, byte [rax]
movzx r8d, byte [rax + 4]
mov ebx, dword [r15]
lea rdi, [rax + 1]
mov qword [rbp - 0x18], rax
shl r10d, 0x18
movzx eax, byte [rdi]
mov rsi, rcx
movzx ecx, byte [rdi + 5]
shl eax, 0x10
shl r8d, 0x18
shl ecx, 8
or r10d, eax
movzx eax, byte [rdi + 1]
mov r14, rdx
shl eax, 8
lea rdx, [rdi + 5]
xor r13d, r13d
or r10d, eax
movzx eax, byte [rdi + 2]
mov qword [rbp - 0x28], r9
or r10d, eax
movzx eax, byte [rdi + 4]
mov qword [rbp - 0x20], r15
shl eax, 0x10
mov dword [rbp - 0x30], r10d
mov byte [rbp - 0xd], r10b
or r8d, eax
movzx eax, byte [rdx + 1]
or ecx, eax
mov eax, r10d
shr eax, 0x18
or r8d, ecx
mov byte [rbp - 0x10], al
mov eax, r10d
mov dword [rbp - 0x2c], r8d
shr eax, 0x10
mov byte [rbp - 9], r8b
mov byte [rbp - 0xf], al
mov eax, r10d
shr eax, 8
mov byte [rbp - 0xe], al
mov eax, r8d
shr eax, 0x18
mov byte [rbp - 0xc], al
mov eax, r8d
shr eax, 0x10
mov byte [rbp - 0xb], al
mov eax, r8d
shr eax, 8
mov byte [rbp - 0xa], al
test r12d, r12d
je 0x1401dc836
mov r15, qword [rbp - 0x28]
sub r14, rsi
movzx edx, r8b
movzx r9d, r10b
nop dword [rax]
dec r12d
test ebx, ebx
jne 0x1401dc7d3
lea rcx, [rbp - 0x30]
mov rdx, r15
call fcn.1401db410
mov r10d, dword [rbp - 0x30]
mov r8d, dword [rbp - 0x2c]
mov eax, r10d
movzx edx, r8b
movzx r9d, r10b
shr eax, 0x18
mov byte [rbp - 0xd], r10b
mov byte [rbp - 9], dl
mov byte [rbp - 0x10], al
mov eax, r10d
shr eax, 0x10
mov byte [rbp - 0xf], al
mov eax, r10d
shr eax, 8
mov byte [rbp - 0xe], al
mov eax, r8d
shr eax, 0x18
mov byte [rbp - 0xc], al
mov eax, r8d
shr eax, 0x10
mov byte [rbp - 0xb], al
mov eax, r8d
shr eax, 8
inc r13d
mov byte [rbp - 0xa], al
movsxd rax, ebx
inc rsi
movzx ecx, byte [rbp + rax - 0x10]
xor cl, byte [rsi - 1]
inc ebx
mov byte [r14 + rsi - 1], cl
and ebx, 7
test r12d, r12d
jne 0x1401dc770
mov r15, qword [rbp - 0x20]
test r13d, r13d
je 0x1401dc836
mov rcx, qword [rbp - 0x18]
mov eax, r10d
shr eax, 0x18
mov byte [rcx], al
mov eax, r10d
shr r10d, 8
shr eax, 0x10
mov byte [rdi], al
mov byte [rdi + 1], r10b
mov byte [rdi + 2], r9b
mov eax, r8d
shr eax, 0x18
mov byte [rdi + 3], al
mov eax, r8d
shr eax, 0x10
shr r8d, 8
mov byte [rdi + 4], al
mov byte [rdi + 5], r8b
mov byte [rdi + 6], dl
mov dword [r15], ebx
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.140254fb0
mov rbx, qword [rsp + 0x90]
add rsp, 0x50
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x1401dedd0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov rbp, rsp
mov eax, 0x50
call fcn.1402563f0
sub rsp, rax
mov rax, qword [0x1403bb2d8]
xor rax, rsp
mov qword [rbp - 8], rax
mov rax, qword [rbp + 0x60]
mov r15, qword [rbp + 0x68]
mov r12d, r8d
movzx r10d, byte [rax]
movzx r8d, byte [rax + 4]
mov ebx, dword [r15]
lea rdi, [rax + 1]
mov qword [rbp - 0x18], rax
shl r10d, 0x18
movzx eax, byte [rdi]
mov rsi, rcx
movzx ecx, byte [rdi + 5]
shl eax, 0x10
shl r8d, 0x18
shl ecx, 8
or r10d, eax
movzx eax, byte [rdi + 1]
mov r14, rdx
shl eax, 8
lea rdx, [rdi + 5]
xor r13d, r13d
or r10d, eax
movzx eax, byte [rdi + 2]
mov qword [rbp - 0x28], r9
or r10d, eax
movzx eax, byte [rdi + 4]
mov qword [rbp - 0x20], r15
shl eax, 0x10
mov dword [rbp - 0x30], r10d
mov byte [rbp - 0xd], r10b
or r8d, eax
movzx eax, byte [rdx + 1]
or ecx, eax
mov eax, r10d
shr eax, 0x18
or r8d, ecx
mov byte [rbp - 0x10], al
mov eax, r10d
mov dword [rbp - 0x2c], r8d
shr eax, 0x10
mov byte [rbp - 9], r8b
mov byte [rbp - 0xf], al
mov eax, r10d
shr eax, 8
mov byte [rbp - 0xe], al
mov eax, r8d
shr eax, 0x18
mov byte [rbp - 0xc], al
mov eax, r8d
shr eax, 0x10
mov byte [rbp - 0xb], al
mov eax, r8d
shr eax, 8
mov byte [rbp - 0xa], al
test r12d, r12d
je 0x1401def96
mov r15, qword [rbp - 0x28]
sub r14, rsi
movzx edx, r8b
movzx r9d, r10b
nop dword [rax]
dec r12d
test ebx, ebx
jne 0x1401def33
lea rcx, [rbp - 0x30]
mov rdx, r15
call fcn.1401ddbe0
mov r10d, dword [rbp - 0x30]
mov r8d, dword [rbp - 0x2c]
mov eax, r10d
movzx edx, r8b
movzx r9d, r10b
shr eax, 0x18
mov byte [rbp - 0xd], r10b
mov byte [rbp - 9], dl
mov byte [rbp - 0x10], al
mov eax, r10d
shr eax, 0x10
mov byte [rbp - 0xf], al
mov eax, r10d
shr eax, 8
mov byte [rbp - 0xe], al
mov eax, r8d
shr eax, 0x18
mov byte [rbp - 0xc], al
mov eax, r8d
shr eax, 0x10
mov byte [rbp - 0xb], al
mov eax, r8d
shr eax, 8
inc r13d
mov byte [rbp - 0xa], al
movsxd rax, ebx
inc rsi
movzx ecx, byte [rbp + rax - 0x10]
xor cl, byte [rsi - 1]
inc ebx
mov byte [r14 + rsi - 1], cl
and ebx, 7
test r12d, r12d
jne 0x1401deed0
mov r15, qword [rbp - 0x20]
test r13d, r13d
je 0x1401def96
mov rcx, qword [rbp - 0x18]
mov eax, r10d
shr eax, 0x18
mov byte [rcx], al
mov eax, r10d
shr r10d, 8
shr eax, 0x10
mov byte [rdi], al
mov byte [rdi + 1], r10b
mov byte [rdi + 2], r9b
mov eax, r8d
shr eax, 0x18
mov byte [rdi + 3], al
mov eax, r8d
shr eax, 0x10
shr r8d, 8
mov byte [rdi + 4], al
mov byte [rdi + 5], r8b
mov byte [rdi + 6], dl
mov dword [r15], ebx
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.140254fb0
mov rbx, qword [rsp + 0x90]
add rsp, 0x50
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x1401defc0
Capabilities:
Encode data using xor
Encrypt data using blowfish
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
mov eax, 0x20
call fcn.1402563f0
sub rsp, rax
mov ebx, edx
mov rsi, r8
lea rdx, [0x14035ecc0]
mov r8d, 0x1048
mov rdi, rcx
call fcn.140255100
mov eax, 0x48
mov rdx, rsi
cmp ebx, eax
cmovg ebx, eax
movsxd r8, ebx
add r8, rsi
xor ebx, ebx
mov r9d, ebx
nop word [rax + rax]
movzx ecx, byte [rdx]
inc rdx
cmp rdx, r8
cmovae rdx, rsi
shl ecx, 8
movzx eax, byte [rdx]
inc rdx
or ecx, eax
cmp rdx, r8
cmovae rdx, rsi
shl ecx, 8
movzx eax, byte [rdx]
inc rdx
or ecx, eax
cmp rdx, r8
cmovae rdx, rsi
shl ecx, 8
movzx eax, byte [rdx]
inc rdx
or ecx, eax
cmp rdx, r8
cmovae rdx, rsi
xor dword [rdi + r9*4], ecx
inc r9
cmp r9, 0x12
jl 0x1401df010
mov qword [rsp + 0x30], rbx
mov rsi, rbx
nop dword [rax + rax]
lea rcx, [rsp + 0x30]
mov rdx, rdi
call fcn.1401ddbe0
mov eax, dword [rsp + 0x30]
add rsi, 2
mov dword [rdi + rsi*4 - 8], eax
mov eax, dword [rsp + 0x34]
mov dword [rdi + rsi*4 - 4], eax
cmp rsi, 0x12
jl 0x1401df070
nop word [rax + rax]
lea rcx, [rsp + 0x30]
mov rdx, rdi
call fcn.1401ddbe0
mov eax, dword [rsp + 0x30]
add rbx, 2
mov dword [rdi + rbx*4 + 0x40], eax
mov eax, dword [rsp + 0x34]
mov dword [rdi + rbx*4 + 0x44], eax
cmp rbx, 0x400
jl 0x1401df0a0
mov rbx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x1401dfc30
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov rbp, rsp
mov eax, 0x50
call fcn.1402563f0
sub rsp, rax
mov rax, qword [0x1403bb2d8]
xor rax, rsp
mov qword [rbp - 8], rax
mov rax, qword [rbp + 0x60]
mov r15, qword [rbp + 0x68]
mov rsi, rcx
movzx r10d, byte [rax]
mov ebx, dword [r15]
lea rdi, [rax + 1]
movzx ecx, byte [rdi + 6]
mov qword [rbp - 0x18], rax
movzx eax, byte [rdi]
shl eax, 8
mov r14, rdx
movzx edx, byte [rdi + 3]
or r10d, eax
movzx eax, byte [rdi + 1]
shl ecx, 8
shl eax, 0x10
mov r12d, r8d
lea r8, [rdi + 5]
or r10d, eax
movzx eax, byte [rdi + 2]
xor r13d, r13d
shl eax, 0x18
mov qword [rbp - 0x28], r9
mov qword [rbp - 0x20], r15
or r10d, eax
movzx eax, byte [rdi + 4]
shl eax, 8
mov dword [rbp - 0x30], r10d
mov byte [rbp - 0x10], r10b
or edx, eax
movzx eax, byte [r8]
or ecx, eax
mov eax, r10d
shr eax, 8
shl ecx, 0x10
mov byte [rbp - 0xf], al
or edx, ecx
mov eax, r10d
shr eax, 0x10
mov dword [rbp - 0x2c], edx
mov byte [rbp - 0xc], dl
mov byte [rbp - 0xe], al
mov eax, r10d
shr eax, 0x18
mov byte [rbp - 0xd], al
mov eax, edx
shr eax, 8
mov byte [rbp - 0xb], al
mov eax, edx
shr eax, 0x10
mov byte [rbp - 0xa], al
mov eax, edx
shr eax, 0x18
mov byte [rbp - 9], al
test r12d, r12d
je 0x1401dfde4
mov r15, qword [rbp - 0x28]
sub r14, rsi
movzx r8d, dl
movzx r9d, r10b
dec r12d
test ebx, ebx
jne 0x1401dfd84
lea rcx, [rbp - 0x30]
mov rdx, r15
call fcn.1401df0e0
mov r10d, dword [rbp - 0x30]
mov edx, dword [rbp - 0x2c]
movzx r9d, byte [rbp - 0x30]
movzx r8d, byte [rbp - 0x2c]
mov eax, r10d
shr eax, 8
mov byte [rbp - 0x10], r9b
mov byte [rbp - 0xc], r8b
mov byte [rbp - 0xf], al
mov eax, r10d
shr eax, 0x10
mov byte [rbp - 0xe], al
mov eax, r10d
shr eax, 0x18
mov byte [rbp - 0xd], al
mov eax, edx
shr eax, 8
mov byte [rbp - 0xb], al
mov eax, edx
shr eax, 0x10
mov byte [rbp - 0xa], al
mov eax, edx
shr eax, 0x18
inc r13d
mov byte [rbp - 9], al
movsxd rax, ebx
inc rsi
movzx ecx, byte [rbp + rax - 0x10]
xor cl, byte [rsi - 1]
inc ebx
mov byte [r14 + rsi - 1], cl
and ebx, 7
test r12d, r12d
jne 0x1401dfd22
mov r15, qword [rbp - 0x20]
test r13d, r13d
je 0x1401dfde4
mov rax, qword [rbp - 0x18]
mov byte [rax], r9b
mov eax, r10d
shr eax, 8
mov byte [rdi], al
mov eax, r10d
shr r10d, 0x18
shr eax, 0x10
mov byte [rdi + 1], al
mov byte [rdi + 2], r10b
mov byte [rdi + 3], r8b
mov eax, edx
shr eax, 8
mov byte [rdi + 4], al
mov eax, edx
shr eax, 0x10
shr edx, 0x18
mov byte [rdi + 5], al
mov byte [rdi + 6], dl
mov dword [r15], ebx
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.140254fb0
mov rbx, qword [rsp + 0x90]
add rsp, 0x50
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x1401dfe10
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
mov edi, 0x80
mov r10, rcx
mov byte [rcx], 0
cmp edx, edi
mov ebx, 0x400
cmovg edx, edi
test r9d, r9d
jle 0x1401dfe43
cmp r9d, ebx
cmovg r9d, ebx
mov ebx, r9d
movsxd r9, edx
test edx, edx
jle 0x1401dfe60
sub r8, r10
mov rdx, r9
movzx eax, byte [r8 + rcx]
inc rcx
dec rdx
mov byte [rcx - 1], al
jne 0x1401dfe50
movzx ecx, byte [r9 + r10 - 1]
lea rdx, [r9 + r10]
lea rsi, [0x14035fd10]
cmp r9, rdi
jge 0x1401dfea9
mov r11, r9
mov r8, rdi
neg r11
sub r8, r9
nop word [rax + rax]
movzx eax, byte [rdx + r11]
inc rdx
add eax, ecx
dec r8
movzx ecx, al
movzx ecx, byte [rcx + rsi]
mov byte [rdx - 1], cl
jne 0x1401dfe90
lea edx, [rbx + 7]
neg ebx
mov eax, 0xff
sar edx, 3
and ebx, 7
sub edi, edx
movzx ecx, bl
movsxd r11, edx
sar eax, cl
movsxd r9, edi
mov ecx, eax
lea r8, [r9 + r10]
movzx eax, byte [r8]
and rcx, rax
movzx eax, byte [rcx + rsi]
mov byte [r8], al
test edi, edi
je 0x1401dfef8
nop
movzx ecx, byte [r8 + r11 - 1]
dec r8
xor rcx, rax
dec r9
movzx eax, byte [rcx + rsi]
mov byte [r8], al
jne 0x1401dfee0
lea r8, [r10 + 0xfc]
lea rdx, [r10 + 0x7e]
mov r9d, 0x40
nop dword [rax]
movzx eax, byte [rdx]
movzx ecx, byte [rdx + 1]
sub r8, 4
shl ecx, 8
sub rdx, 2
or ecx, eax
dec r9
movzx eax, cx
mov dword [r8 + 4], eax
jne 0x1401dff10
mov rbx, qword [rsp + 8]
mov rsi, qword [rsp + 0x10]
mov rdi, qword [rsp + 0x18]
ret
Function at 0x1401e5430
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbp
push rbx
push rsi
push r12
push r13
push r14
push r15
mov rbp, rsp
mov eax, 0x50
call fcn.1402563f0
sub rsp, rax
mov rax, qword [0x1403bb2d8]
xor rax, rsp
mov qword [rbp - 8], rax
mov r15, qword [rbp + 0x68]
mov rax, qword [rbp + 0x60]
xor r13d, r13d
mov ebx, dword [r15]
mov qword [rbp - 0x28], r9
mov r12d, r8d
mov r14, rdx
mov rsi, rcx
mov qword [rbp - 0x18], rax
mov qword [rbp - 0x20], r15
test ebx, ebx
jns 0x1401e548d
mov dword [r15], 0xffffffff
jmp 0x1401e5611
movzx r8d, byte [rax]
movzx r9d, byte [rax + 4]
mov qword [rsp + 0x90], rdi
lea rdi, [rax + 1]
shl r8d, 0x18
shl r9d, 0x18
movzx eax, byte [rdi]
movzx ecx, byte [rdi + 5]
lea rdx, [rdi + 5]
shl eax, 0x10
shl ecx, 8
or r8d, eax
movzx eax, byte [rdi + 1]
shl eax, 8
or r8d, eax
movzx eax, byte [rdi + 2]
or r8d, eax
movzx eax, byte [rdi + 4]
shl eax, 0x10
mov dword [rbp - 0x30], r8d
mov byte [rbp - 0xd], r8b
or r9d, eax
movzx eax, byte [rdx + 1]
or ecx, eax
mov eax, r8d
shr eax, 0x18
or r9d, ecx
mov byte [rbp - 0x10], al
mov eax, r8d
mov dword [rbp - 0x2c], r9d
shr eax, 0x10
mov byte [rbp - 9], r9b
mov byte [rbp - 0xf], al
mov eax, r8d
shr eax, 8
mov byte [rbp - 0xe], al
mov eax, r9d
shr eax, 0x18
mov byte [rbp - 0xc], al
mov eax, r9d
shr eax, 0x10
mov byte [rbp - 0xb], al
mov eax, r9d
shr eax, 8
mov byte [rbp - 0xa], al
test r12d, r12d
je 0x1401e5606
mov r15, qword [rbp - 0x28]
sub r14, rsi
movzx edx, r9b
movzx r10d, r8b
dec r12d
test ebx, ebx
jne 0x1401e55a3
lea rcx, [rbp - 0x30]
mov rdx, r15
call fcn.1401e46a0
mov r8d, dword [rbp - 0x30]
mov r9d, dword [rbp - 0x2c]
mov eax, r8d
movzx edx, r9b
movzx r10d, r8b
shr eax, 0x18
mov byte [rbp - 0xd], r8b
mov byte [rbp - 9], dl
mov byte [rbp - 0x10], al
mov eax, r8d
shr eax, 0x10
mov byte [rbp - 0xf], al
mov eax, r8d
shr eax, 8
mov byte [rbp - 0xe], al
mov eax, r9d
shr eax, 0x18
mov byte [rbp - 0xc], al
mov eax, r9d
shr eax, 0x10
mov byte [rbp - 0xb], al
mov eax, r9d
shr eax, 8
inc r13d
mov byte [rbp - 0xa], al
movsxd rax, ebx
inc rsi
movzx ecx, byte [rbp + rax - 0x10]
xor cl, byte [rsi - 1]
inc ebx
mov byte [r14 + rsi - 1], cl
and ebx, 7
test r12d, r12d
jne 0x1401e5540
mov r15, qword [rbp - 0x20]
test r13d, r13d
je 0x1401e5606
mov rcx, qword [rbp - 0x18]
mov eax, r8d
shr eax, 0x18
mov byte [rcx], al
mov eax, r8d
shr r8d, 8
shr eax, 0x10
mov byte [rdi], al
mov byte [rdi + 1], r8b
mov byte [rdi + 2], r10b
mov eax, r9d
shr eax, 0x18
mov byte [rdi + 3], al
mov eax, r9d
shr eax, 0x10
shr r9d, 8
mov byte [rdi + 4], al
mov byte [rdi + 5], r9b
mov byte [rdi + 6], dl
mov rdi, qword [rsp + 0x90]
mov dword [r15], ebx
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.140254fb0
add rsp, 0x50
pop r15
pop r14
pop r13
pop r12
pop rsi
pop rbx
pop rbp
ret
Function at 0x1401ea080
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov rbp, rsp
mov eax, 0x50
call fcn.1402563f0
sub rsp, rax
mov rax, qword [0x1403bb2d8]
xor rax, rsp
mov qword [rbp - 8], rax
mov rax, qword [rbp + 0x60]
mov r15, qword [rbp + 0x68]
mov rsi, rcx
movzx r10d, byte [rax]
mov ebx, dword [r15]
lea rdi, [rax + 1]
movzx ecx, byte [rdi + 6]
mov qword [rbp - 0x18], rax
movzx eax, byte [rdi]
shl eax, 8
mov r14, rdx
movzx edx, byte [rdi + 3]
or r10d, eax
movzx eax, byte [rdi + 1]
shl ecx, 8
shl eax, 0x10
mov r12d, r8d
lea r8, [rdi + 5]
or r10d, eax
movzx eax, byte [rdi + 2]
xor r13d, r13d
shl eax, 0x18
mov qword [rbp - 0x28], r9
mov qword [rbp - 0x20], r15
or r10d, eax
movzx eax, byte [rdi + 4]
shl eax, 8
mov dword [rbp - 0x30], r10d
mov byte [rbp - 0x10], r10b
or edx, eax
movzx eax, byte [r8]
or ecx, eax
mov eax, r10d
shr eax, 8
shl ecx, 0x10
mov byte [rbp - 0xf], al
or edx, ecx
mov eax, r10d
shr eax, 0x10
mov dword [rbp - 0x2c], edx
mov byte [rbp - 0xc], dl
mov byte [rbp - 0xe], al
mov eax, r10d
shr eax, 0x18
mov byte [rbp - 0xd], al
mov eax, edx
shr eax, 8
mov byte [rbp - 0xb], al
mov eax, edx
shr eax, 0x10
mov byte [rbp - 0xa], al
mov eax, edx
shr eax, 0x18
mov byte [rbp - 9], al
test r12d, r12d
je 0x1401ea23c
mov r15, qword [rbp - 0x28]
sub r14, rsi
movzx r8d, dl
movzx r9d, r10b
dec r12d
test ebx, ebx
jne 0x1401ea1d8
lea r8d, [rbx + 1]
lea rcx, [rbp - 0x30]
mov rdx, r15
call fcn.1401e5e50
mov r10d, dword [rbp - 0x30]
mov edx, dword [rbp - 0x2c]
movzx r9d, byte [rbp - 0x30]
movzx r8d, byte [rbp - 0x2c]
mov eax, r10d
shr eax, 8
mov byte [rbp - 0x10], r9b
mov byte [rbp - 0xc], r8b
mov byte [rbp - 0xf], al
mov eax, r10d
shr eax, 0x10
mov byte [rbp - 0xe], al
mov eax, r10d
shr eax, 0x18
mov byte [rbp - 0xd], al
mov eax, edx
shr eax, 8
mov byte [rbp - 0xb], al
mov eax, edx
shr eax, 0x10
mov byte [rbp - 0xa], al
mov eax, edx
shr eax, 0x18
inc r13d
mov byte [rbp - 9], al
movsxd rax, ebx
inc rsi
movzx ecx, byte [rbp + rax - 0x10]
xor cl, byte [rsi - 1]
inc ebx
mov byte [r14 + rsi - 1], cl
and ebx, 7
test r12d, r12d
jne 0x1401ea172
mov r15, qword [rbp - 0x20]
test r13d, r13d
je 0x1401ea23c
mov rax, qword [rbp - 0x18]
mov byte [rax], r9b
mov eax, r10d
shr eax, 8
mov byte [rdi], al
mov eax, r10d
shr r10d, 0x18
shr eax, 0x10
mov byte [rdi + 1], al
mov byte [rdi + 2], r10b
mov byte [rdi + 3], r8b
mov eax, edx
shr eax, 8
mov byte [rdi + 4], al
mov eax, edx
shr eax, 0x10
shr edx, 0x18
mov byte [rdi + 5], al
mov byte [rdi + 6], dl
mov dword [r15], ebx
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.140254fb0
mov rbx, qword [rsp + 0x90]
add rsp, 0x50
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x1401eb720
Capabilities:
Encode data using xor
Hash data using sha256

Disassembly:
mov qword [rsp + 8], rbx
push rdi
mov eax, 0x20
call fcn.1402563f0
sub rsp, rax
mov rdi, rdx
lea r8d, [rax + 0x60]
xor edx, edx
mov rbx, rcx
call fcn.140254810
mov dword [rbx], 0x6a09e667
mov dword [rbx + 4], 0xbb67ae85
mov dword [rbx + 8], 0x3c6ef372
mov dword [rbx + 0xc], 0xa54ff53a
mov dword [rbx + 0x10], 0x510e527f
mov dword [rbx + 0x14], 0x9b05688c
mov dword [rbx + 0x18], 0x1f83d9ab
mov dword [rbx + 0x1c], 0x5be0cd19
movzx eax, byte [rdi]
mov ecx, 8
mov qword [rbx + 0x78], rax
sub rdi, rbx
nop word [rax + rax]
mov eax, dword [rdi + rbx]
add rbx, 4
xor dword [rbx - 4], eax
dec rcx
jne 0x1401eb790
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x1401ed7a0
Capabilities:
Encode data using xor
Hash data using sha512

Disassembly:
mov qword [rsp + 8], rbx
push rdi
mov eax, 0x20
call fcn.1402563f0
sub rsp, rax
mov rdi, rdx
mov r8d, 0xf0
xor edx, edx
mov rbx, rcx
call fcn.140254810
movabs rax, 0xbb67ae8584caa73b
mov qword [rbx + 8], rax
movabs rax, 0x3c6ef372fe94f82b
movabs r11, 0x6a09e667f3bcc908
mov qword [rbx + 0x10], rax
movabs rax, 0xa54ff53a5f1d36f1
mov qword [rbx], r11
mov qword [rbx + 0x18], rax
movabs rax, 0x510e527fade682d1
mov ecx, 8
mov qword [rbx + 0x20], rax
movabs rax, 0x9b05688c2b3e6c1f
mov qword [rbx + 0x28], rax
movabs rax, 0x1f83d9abfb41bd6b
mov qword [rbx + 0x30], rax
movabs rax, 0x5be0cd19137e2179
mov qword [rbx + 0x38], rax
movzx eax, byte [rdi]
sub rdi, rbx
mov qword [rbx + 0xe8], rax
nop word [rax + rax]
mov rax, qword [rdi + rbx]
add rbx, 8
xor qword [rbx - 8], rax
dec rcx
jne 0x1401ed850
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret