joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10000ccec
Capabilities:
Delete file

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x30
mov rbp, rdx
mov rsi, rcx
call fcn.10000cdbc
test eax, eax
je 0x10000cda0
xor ebx, ebx
mov rdi, qword [rsi + rbx*8]
test rdi, rdi
je 0x10000cd89
mov rcx, qword [rdi]
test rcx, rcx
je 0x10000cd2c
call qword [sym.imp.msvcrt.dll_fclose]
mov rcx, qword [rdi + 8]
call qword [sym.imp.msvcrt.dll_remove]
test eax, eax
je 0x10000cd5d
mov rax, qword [rdi + 8]
mov r9, qword [rdi + 0x10]
lea r8, [0x100001a7c]
lea rdx, [0x100003468]
mov rcx, rbp
mov qword [rsp + 0x20], rax
call fcn.10000afac
mov rcx, qword [rdi + 0x10]
test rcx, rcx
je 0x10000cd6c
call qword [sym.imp.msvcrt.dll_free]
mov rcx, qword [rdi + 8]
test rcx, rcx
je 0x10000cd7b
call qword [sym.imp.msvcrt.dll_free]
mov rcx, rdi
call qword [sym.imp.msvcrt.dll_free]
and qword [rsi + rbx*8], 0
inc rbx
cmp rbx, 3
jl 0x10000cd15
mov rcx, rsi
call qword [sym.imp.msvcrt.dll_free]
mov eax, 1
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret

Function at 0x10000d60c
Capabilities:
Read file on windows
Write file on windows

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x40
mov rsi, qword [rsp + 0xa0]
mov r13, qword [r8 + 0x10]
mov r14, qword [r8 + 8]
mov qword [rsp + 0x30], rcx
mov ecx, 0x800
mov rdi, r8
mov r12, rdx
xor ebx, ebx
call qword [sym.imp.msvcrt.dll_malloc]
mov rbp, rax
test rax, rax
jne 0x10000d678
lea r8, [0x100001f44]
lea rdx, [0x100003a50]
mov r9, r13
mov rcx, rsi
mov qword [rsp + 0x28], r12
mov qword [rsp + 0x20], r14
call fcn.10000afac
jmp 0x10000d76b
mov rcx, qword [rdi + 8]
lea rdx, [0x100003a1c]
call qword [sym.imp.msvcrt.dll_fopen]
mov qword [rdi], rax
test rax, rax
jne 0x10000d6bd
mov rax, qword [rdi + 8]
mov r9, qword [rdi + 0x10]
lea r8, [0x100001a7c]
lea rdx, [0x100003450]
mov rcx, rsi
mov qword [rsp + 0x20], rax
call fcn.10000afac
cmp qword [rdi], rbx
je 0x10000d754
mov rbx, qword [rdi]
test rbx, rbx
je 0x10000d754
mov rcx, rbx
call qword [sym.imp.msvcrt.dll_feof]
test eax, eax
jne 0x10000d785
lea edx, [rax + 1]
mov r9, rbx
mov r8d, 0x800
mov rcx, rbp
call qword [sym.imp.msvcrt.dll_fread]
mov rcx, rbx
mov r15, rax
call qword [sym.imp.msvcrt.dll_ferror]
test eax, eax
jne 0x10000d731
test r15d, r15d
jle 0x10000d6c9
movsxd r8, r15d
mov r15, qword [rsp + 0x30]
lea edx, [rax + 1]
mov r9, r15
mov rcx, rbp
call qword [sym.imp.msvcrt.dll_fwrite]
mov rcx, r15
call qword [sym.imp.msvcrt.dll_ferror]
test eax, eax
je 0x10000d6c9
lea rdx, [0x100003a98]
jmp 0x10000d738
lea rdx, [0x100003a78]
lea r8, [0x100001f44]
mov r9, r13
mov rcx, rsi
mov qword [rsp + 0x28], r12
mov qword [rsp + 0x20], r14
call fcn.10000afac
mov rcx, rbp
call qword [sym.imp.msvcrt.dll_free]
test rbx, rbx
je 0x10000d76b
mov rcx, rbx
call qword [sym.imp.msvcrt.dll_fclose]
xor eax, eax
mov rbx, qword [rsp + 0x98]
add rsp, 0x40
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
mov rdx, rsi
mov rcx, rdi
call fcn.10000b0c8
mov rcx, rbp
call qword [sym.imp.msvcrt.dll_free]
mov eax, 1
jmp 0x10000d76d
Function at 0x10000f9a0
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov dword [rsp + 0x18], r8d
push rsi
push rdi
push r12
push r13
push r15
sub rsp, 0x20
xor r8d, r8d
mov edx, 0x8000
mov rsi, r9
mov rdi, rcx
mov r15d, 0x1000
call qword [sym.imp.msvcrt.dll__open]
mov r13d, eax
cmp eax, 0xffffffff
jne 0x10000f9fd
lea rdx, [0x100003f00]
lea r8, [0x100001ac0]
mov r9, rdi
mov rcx, rsi
call fcn.10000afac
xor eax, eax
jmp 0x10000fab2
mov ecx, 0x438
call qword [sym.imp.msvcrt.dll_malloc]
mov rbx, rax
test rax, rax
jne 0x10000fa19
lea rdx, [0x100003f18]
jmp 0x10000f9e4
movsxd rcx, r15d
call qword [sym.imp.msvcrt.dll_malloc]
mov rbp, rax
mov qword [rbx + 0x10], rax
test rax, rax
jne 0x10000fa39
mov rcx, rbx
call qword [sym.imp.msvcrt.dll_free]
jmp 0x10000fa10
mov rcx, rdi
call qword [sym.imp.msvcrt.dll__strdup]
mov r12, rax
mov qword [rbx], rax
test rax, rax
jne 0x10000fa58
mov rcx, rbp
call qword [sym.imp.msvcrt.dll_free]
jmp 0x10000fa2e
and qword [rbx + 0x20], 0
and dword [rbx + 0x28], 0
and dword [rbx + 0x2c], 0
and dword [rbx + 0x34], 0
mov dword [rbx + 0xc], r15d
mov r15d, 1
lea rdx, [rsp + 0x60]
lea r8d, [r15 + 2]
mov ecx, r13d
mov dword [rbx + 8], r13d
mov qword [rbx + 0x18], rbp
mov dword [rbx + 0x30], r15d
call qword [sym.imp.msvcrt.dll__read]
cmp eax, 3
jne 0x10000fac9
cmp byte [rsp + 0x60], 0xef
jne 0x10000fac9
cmp byte [rsp + 0x61], 0xbb
jne 0x10000fac9
cmp byte [rsp + 0x62], 0xbf
jne 0x10000fac9
mov dword [rbx + 0x34], r15d
mov rax, rbx
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
add rsp, 0x20
pop r15
pop r13
pop r12
pop rdi
pop rsi
ret
xor r8d, r8d
xor edx, edx
mov ecx, r13d
call qword [sym.imp.msvcrt.dll__lseek]
cmp eax, 0xffffffff
jne 0x10000faaf
mov rcx, r12
call qword [sym.imp.msvcrt.dll_free]
mov rcx, rbp
call qword [sym.imp.msvcrt.dll_free]
mov rcx, rbx
call qword [sym.imp.msvcrt.dll_free]
jmp 0x10000f9dd
Function at 0x1000139e0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], r12
push r13
sub rsp, 0x20
mov rax, qword [rsp + 0x60]
xor ebp, ebp
mov rbx, rcx
mov qword [rcx + 0x28], rax
mov rax, qword [rsp + 0x58]
mov qword [rcx + 8], r9
mov qword [rcx + 0x30], rax
mov eax, dword [rsp + 0x50]
mov word [rcx + 0x18], bp
mov qword [rcx + 0x20], rdx
mov dword [rcx + 0x3c], r8d
mov dword [rcx + 0x40], ebp
mov dword [rcx + 0x1c], eax
mov r12d, 0x8000
cmp byte [rsp + 0x68], bpl
jne 0x100013a42
lea rcx, [rdx + 0x8000]
mov r8, r12
call sub.msvcrt.dll_memcpy
mov rcx, rbx
mov word [rbx + 0x44], bp
mov dword [rbx + 0x48], ebp
call fcn.100013e68
mov rdx, qword [rbx + 0x20]
mov r13d, 2
mov word [rbx + 0x54], r12w
mov dword [rbx + 0x4c], r12d
mov dword [rbx + 0x38], ebp
add rdx, r12
mov r8, r13
movzx eax, byte [rdx]
mov ecx, dword [rbx + 0x38]
inc rdx
shl ecx, 5
xor ecx, eax
and ecx, 0x7fff
sub r8, 1
mov dword [rbx + 0x38], ecx
jne 0x100013a6d
cmp byte [rsp + 0x68], bpl
je 0x100013aeb
mov r8, rbp
mov r9, r12
mov rdx, qword [rbx + 0x28]
mov eax, ebp
movzx ecx, word [r8 + rdx]
add cx, r12w
cmp word [r8 + rdx], r12w
cmovae ax, cx
mov word [r8 + rdx], ax
add r8, r13
sub r9, 1
jne 0x100013a97
mov r8, rbp
mov r9, r12
mov rdx, qword [rbx + 0x30]
mov eax, ebp
movzx ecx, word [r8 + rdx]
add cx, r12w
cmp word [r8 + rdx], r12w
cmovae ax, cx
mov word [r8 + rdx], ax
add r8, r13
sub r9, 1
jne 0x100013ac3
jmp 0x100013b02
mov rcx, rbp
mov rdx, r12
mov rax, qword [rbx + 0x28]
mov word [rcx + rax], bp
add rcx, r13
sub rdx, 1
jne 0x100013af1
mov edx, 0x43
mov rcx, rbx
lea r8d, [rdx - 0x3b]
call fcn.100013b7c
mov edx, 0x4b
mov rcx, rbx
lea r8d, [rdx - 0x43]
call fcn.100013b7c
mov rcx, rbx
call fcn.10001502c
add ax, r13w
movzx ecx, ax
mov rax, qword [rsp + 0x70]
mov dword [rax], ecx
cmp byte [rsp + 0x68], bpl
je 0x100013b54
mov rcx, qword [rbx + 0x20]
mov r8, r12
lea rdx, [rcx + 0x8000]
call sub.msvcrt.dll_memcpy
mov eax, dword [rbx + 0x40]
mov rbp, qword [rsp + 0x38]
mov r12, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x30]
neg eax
sbb eax, eax
and eax, 3
add rsp, 0x20
pop r13
ret

Function at 0x1000143f0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
mov rax, qword [0x10001b110]
xor rax, rsp
mov qword [rsp + 0x20], rax
xor edi, edi
mov r11, rdx
add rcx, 0x106c
lea ebx, [rdi + 1]
movzx r9d, di
mov r10, rbx
add r9w, word [rcx]
add rcx, 2
add r9w, r9w
mov word [rsp + r10*2], r9w
add r10, rbx
cmp r10, 0xf
jle 0x10001441f
movsxd r9, r8d
mov rdx, rdi
cmp r9, rdi
jl 0x10001448f
movzx r8d, word [r11 + rdx*4 + 2]
lea eax, [r8 - 1]
cmp eax, 0xe
ja 0x100014487
movzx r10d, word [rsp + r8*2]
mov rcx, r8
movzx ecx, di
lea eax, [rbx + r10]
mov word [rsp + r8*2], ax
movzx eax, r10w
sub r8d, ebx
sar r10d, 1
and ax, bx
or cx, ax
add cx, cx
cmp r8d, edi
jg 0x100014467
shr cx, 1
mov word [r11 + rdx*4], cx
add rdx, rbx
cmp rdx, r9
jle 0x100014444
mov rcx, qword [rsp + 0x20]
xor rcx, rsp
call fcn.100018d50
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
Function at 0x1000144b0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r13
push r14
sub rsp, 0x20
movsxd r12, dword [rdx + 0x1c]
mov rbp, qword [rdx]
mov r9, qword [rdx + 8]
xor r10d, r10d
or esi, 0xffffffff
mov rdi, rcx
cmp r12, r10
mov dword [rcx + 0x5c], 0x23d
mov dword [rcx + 0x58], r10d
mov r13, rdx
mov r8d, r10d
mov rcx, r10
lea r14d, [rsi + 2]
jle 0x100014534
cmp word [rbp + rcx*4], r10w
je 0x100014523
add dword [rdi + 0x58], r14d
movsxd rax, dword [rdi + 0x58]
mov esi, r8d
mov dword [rdi + rax*4 + 0x108c], r8d
mov byte [rcx + rdi + 0x1980], r10b
jmp 0x100014529
mov word [rbp + rcx*4 + 2], r10w
add rcx, r14
add r8d, r14d
cmp rcx, r12
jl 0x1000144fe
movsxd rdx, esi
jmp 0x100014581
cmp esi, 2
jge 0x10001454c
add esi, r14d
add rdx, r14
mov rcx, rdx
mov r8d, esi
jmp 0x100014552
mov r8d, r10d
mov rcx, r10
add dword [rdi + 0x58], r14d
movsxd rax, dword [rdi + 0x58]
mov dword [rdi + rax*4 + 0x108c], r8d
mov word [rbp + rcx*4], r14w
mov byte [rdi + rcx + 0x1980], r10b
dec dword [rdi + 0x68]
cmp r9, r10
je 0x100014581
movzx eax, word [r9 + rcx*4 + 2]
sub dword [rdi + 0x6c], eax
cmp dword [rdi + 0x58], 2
jl 0x100014539
mov dword [r13 + 0x24], esi
mov eax, dword [rdi + 0x58]
cdq
sub eax, edx
sar eax, 1
cmp eax, r14d
mov ebx, eax
jl 0x1000145b0
mov r8d, ebx
mov rdx, rbp
mov rcx, rdi
call fcn.100014160
sub ebx, r14d
cmp ebx, r14d
jge 0x10001459a
movsxd rdx, dword [rdi + 0x58]
movsxd rbx, dword [rdi + 0x1090]
mov r8d, r14d
mov ecx, dword [rdi + rdx*4 + 0x108c]
lea eax, [rdx - 1]
mov rdx, rbp
mov dword [rdi + 0x1090], ecx
mov rcx, rdi
mov dword [rdi + 0x58], eax
call fcn.100014160
dec dword [rdi + 0x5c]
movsxd rcx, dword [rdi + 0x1090]
movsxd rax, dword [rdi + 0x5c]
movsxd r9, r12d
mov rdx, rcx
mov dword [rdi + rax*4 + 0x108c], ebx
dec dword [rdi + 0x5c]
movsxd rax, dword [rdi + 0x5c]
mov dword [rdi + rax*4 + 0x108c], ecx
movzx eax, word [rbp + rcx*4]
add ax, word [rbp + rbx*4]
mov word [rbp + r9*4], ax
mov al, byte [rbx + rdi + 0x1980]
mov cl, byte [rcx + rdi + 0x1980]
cmp al, cl
movzx eax, al
jae 0x10001462d
movzx eax, cl
add al, r14b
mov r8d, r14d
mov rcx, rdi
mov byte [r9 + rdi + 0x1980], al
mov word [rbp + rdx*4 + 2], r12w
mov word [rbp + rbx*4 + 2], r12w
mov dword [rdi + 0x1090], r12d
mov rdx, rbp
add r12d, r14d
call fcn.100014160
cmp dword [rdi + 0x58], 2
jge 0x1000145b0
dec dword [rdi + 0x5c]
movsxd rcx, dword [rdi + 0x5c]
mov eax, dword [rdi + 0x1090]
mov dword [rdi + rcx*4 + 0x108c], eax
mov rdx, r13
mov rcx, rdi
call fcn.100014214
mov r8d, esi
mov rdx, rbp
mov rcx, rdi
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x20
pop r14
pop r13
pop r12
jmp fcn.1000143f0
Function at 0x100016bf0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x10
mov rax, qword [0x10001b110]
xor rax, rsp
mov qword [rsp + 8], rax
cmp dword [rcx + 0x8a8], 0
mov r9, rcx
je 0x100016c21
and dword [rcx + 0x8a4], 0
jmp 0x100016d38
mov ecx, dword [rcx + 0x9d4]
add ecx, r8d
cmp ecx, 0xa
jae 0x100016c47
and dword [r9 + 0x8a4], 0
mov dword [r9 + 0x8a8], 1
jmp 0x100016d38
cmp r8d, 6
jg 0x100016c59
mov dword [r9 + 0x9d4], ecx
jmp 0x100016d38
lea rcx, [rsp]
movsxd r11, r8d
add r11, rdx
mov eax, dword [r11 - 6]
mov dword [rcx], eax
movzx eax, word [r11 - 2]
mov word [rcx + 4], ax
lea eax, [r8 - 6]
movsxd rcx, eax
movabs rax, 0xe8e8e8e8e8e8e8e8
mov dword [rcx + rdx], eax
mov word [rcx + rdx + 4], ax
mov eax, dword [r9 + 0x9d4]
lea edi, [rax + r8 - 0xa]
jmp 0x100016ca3
inc rdx
inc dword [r9 + 0x9d4]
cmp byte [rdx], 0xe8
jne 0x100016c99
mov r8d, dword [r9 + 0x9d4]
cmp r8d, edi
jae 0x100016d1b
movzx eax, byte [rdx + 3]
movzx ebx, byte [rdx + 4]
shl ebx, 8
or ebx, eax
movzx eax, byte [rdx + 2]
shl ebx, 8
or ebx, eax
movzx eax, byte [rdx + 1]
shl ebx, 8
or ebx, eax
lea ecx, [r8 + rbx]
test ecx, ecx
js 0x100016d0d
mov r10d, dword [r9 + 0x8a4]
lea eax, [r10 + r8]
cmp ecx, eax
jae 0x100016d0d
cmp ecx, r10d
jb 0x100016cf4
mov ecx, ebx
sub ecx, r10d
mov eax, ecx
mov byte [rdx + 1], cl
shr eax, 8
mov byte [rdx + 2], al
mov eax, ecx
shr eax, 0x10
shr ecx, 0x18
mov byte [rdx + 4], cl
mov byte [rdx + 3], al
add rdx, 5
add dword [r9 + 0x9d4], 5
jmp 0x100016ca3
lea rcx, [rsp]
mov eax, dword [rcx]
mov dword [r11 - 6], eax
movzx eax, word [rcx + 4]
mov word [r11 - 2], ax
lea eax, [rdi + 0xa]
mov dword [r9 + 0x9d4], eax
mov rcx, qword [rsp + 8]
xor rcx, rsp
call fcn.100018d50
mov rbx, qword [rsp + 0x38]
add rsp, 0x10
pop rdi
ret
Function at 0x10001821c
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x870
mov rax, qword [0x10001b110]
xor rax, rsp
mov qword [rsp + 0x860], rax
mov rax, qword [rsp + 0x8c0]
mov r13, qword [rsp + 0x8c8]
mov rsi, rcx
mov dword [rax], r8d
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], r13
test r13, r13
je 0x100018276
mov dword [r13], r9d
cmp r8d, 0x1800
jb 0x10001845f
mov bpl, byte [rcx + 0x8b0]
cmp bpl, 4
jae 0x10001845f
mov r9d, r8d
xor r10d, r10d
xor ebx, ebx
shr r9d, 3
xor edx, edx
test r9d, r9d
je 0x1000182e2
lea r11, [rsp + 0x50]
test dl, 7
jne 0x1000182c9
cmp r10d, 0x408
jae 0x10001845f
mov word [r11], bx
inc r10d
add r11, 2
mov rax, qword [rsi + 0x50]
movzx ecx, byte [rax + rdx]
inc edx
movzx eax, byte [rcx + rsi + 0x8b1]
add ebx, eax
cmp edx, r9d
jb 0x1000182ac
lea eax, [r8 - 0x1000]
mov dword [rsp + 0x30], eax
cmp eax, 0x800
jbe 0x10001845f
mov r12d, dword [rsp + 0x30]
mov ebx, 0x1000
lea r8d, [rbx - 0x400]
lea edx, [rbx - 0x800]
mov dword [rsp + 0x28], 0x400
mov eax, r8d
shr rax, 6
movzx ecx, word [rsp + rax*2 + 0x50]
mov eax, edx
shr rax, 6
mov dword [rsp + 0x20], ecx
mov rcx, rsi
movzx r9d, word [rsp + rax*2 + 0x50]
call fcn.100017f34
cmp eax, 0x578
jbe 0x100018449
lea edx, [rbx - 0xc00]
mov eax, ebx
mov dword [rsp + 0x28], 0x400
shr rax, 6
mov r8d, ebx
movzx ecx, word [rsp + rax*2 + 0x50]
mov eax, edx
shr rax, 6
mov dword [rsp + 0x20], ecx
mov rcx, rsi
movzx r9d, word [rsp + rax*2 + 0x50]
call fcn.100017f34
cmp eax, 0x578
jbe 0x100018449
lea r8d, [rbx + 0x400]
lea edx, [rbx - 0x1000]
mov dword [rsp + 0x28], 0x400
mov eax, r8d
shr rax, 6
movzx ecx, word [rsp + rax*2 + 0x50]
mov eax, edx
shr rax, 6
mov dword [rsp + 0x20], ecx
mov rcx, rsi
movzx r9d, word [rsp + rax*2 + 0x50]
call fcn.100017f34
cmp eax, 0x578
jbe 0x100018449
lea edi, [rbx - 0x600]
lea eax, [rbx + 0x200]
xor r15d, r15d
cmp edi, eax
jae 0x100018449
mov r14d, edi
lea r13d, [rbx + 0x200]
lea edx, [rdi - 0x400]
mov rax, r14
mov dword [rsp + 0x28], 0x400
shr rax, 6
mov r8d, edi
movzx ecx, word [rsp + rax*2 + 0x50]
mov eax, edx
shr rax, 6
mov dword [rsp + 0x20], ecx
mov rcx, rsi
movzx r9d, word [rsp + rax*2 + 0x50]
call fcn.100017f34
cmp eax, r15d
jbe 0x100018426
mov r15d, eax
mov r12d, edi
add edi, 0x40
add r14, 0x40
cmp edi, r13d
jb 0x1000183e6
mov r13, qword [rsp + 0x38]
cmp r15d, 0x6a4
jb 0x100018449
cmp r12d, 0x1000
jae 0x100018492
add ebx, 0x400
lea eax, [rbx - 0x800]
cmp eax, dword [rsp + 0x30]
jb 0x100018302
xor eax, eax
mov rcx, qword [rsp + 0x860]
xor rcx, rsp
call fcn.100018d50
lea r11, [rsp + 0x870]
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
mov rcx, qword [rsp + 0x40]
inc bpl
mov byte [rsi + 0x8b0], bpl
mov dword [rcx], r12d
test r13, r13
je 0x1000184b9
mov ecx, r12d
shr rcx, 6
movzx ecx, word [rsp + rcx*2 + 0x50]
mov dword [r13], ecx
mov eax, 1
jmp 0x100018461
Function at 0x1000186ac
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x50
mov rax, qword [0x10001b110]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov rsi, qword [rsp + 0xb0]
xor ebx, ebx
mov r12, r9
movsxd rbp, edx
mov rdi, rcx
lea r13d, [rbx + 1]
lea r14d, [rbx + 2]
cmp ebp, ebx
mov dword [rdi + 0x256c], ebp
mov qword [rdi + 0x9d8], r8
mov qword [rdi + 0x9e8], r9
movzx r10d, bp
mov byte [rdi + 0x2572], bl
mov word [rdi + 0x2570], bx
mov word [rdi + 0x9f2], bx
movzx edx, bx
jle 0x1000187f6
mov rax, qword [rdi + 0x9e8]
movsx rcx, dx
mov byte [rcx + rax], bl
cmp word [r8 + rcx*2], bx
je 0x100018749
add word [rdi + 0x2570], r13w
movsx rax, word [rdi + 0x2570]
mov word [rdi + rax*2 + 0x9f0], dx
add dx, r13w
movsx eax, dx
cmp eax, ebp
jl 0x10001871c
movzx eax, word [rdi + 0x2570]
cmp ax, r14w
jge 0x100018786
cmp ax, bx
je 0x1000187f6
cmp word [rdi + 0x9f2], bx
jne 0x10001877d
mov word [r8 + 2], r13w
jmp 0x1000186e5
mov word [r8], r13w
jmp 0x1000186e5
mov r9, rsi
movzx edx, r10w
mov rcx, rdi
call fcn.100018824
cmp dword [rsp + 0xb8], ebx
je 0x100018802
mov word [rsp + 0x20], bx
mov word [rsp + 0x22], bx
mov rcx, r13
add rdi, 0x254a
movzx eax, word [rsp + rcx*2 + 0x20]
add ax, word [rdi]
add rdi, r14
add ax, ax
mov word [rsp + rcx*2 + 0x22], ax
add rcx, r13
cmp rcx, 0x10
jle 0x1000187b2
cmp rbp, rbx
jle 0x100018802
movsx rax, byte [rbx + r12]
movzx ecx, word [rsp + rax*2 + 0x20]
mov word [rsi + rbx*2], cx
movsx rax, byte [rbx + r12]
add rbx, r13
add word [rsp + rax*2 + 0x20], r13w
cmp rbx, rbp
jl 0x1000187d3
jmp 0x100018802
movsx rax, word [rdi + 0x9f2]
mov word [rsi + rax*2], bx
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.100018d50
add rsp, 0x50
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x100018d20
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbp
mov rbp, rsp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0xd0
mov qword [rbp - 0x40], 6
mov r13, 7
mov rax, 0x54
mov r10, qword [rbp - 0x40]
cqo
cdq
idiv r10
mov qword [rbp - 0x50], rax
mov qword [rbp - 0x58], 9
xor r15d, r15d
mov r10, qword [rbp - 0x58]
mov r14, r10
sub r14, 9
movabs r10, 0x5280
add byte [rax], al
mov qword [rbp - 0xb8], r10
mov edi, 0xec03d4aa
mov r14d, 0x16fd
mov r10, qword [rbp - 0xb8]
movabs r9, 6
mov r15, r10
imul r15, r9
mov r10d, r14d
movabs r9, 0x7495
mov r14, r10
add r14, r9
movabs r10, 0x100000000
mov qword [rbp - 0x60], r10
add r15, qword [rbp - 0x60]
mov r10, qword [rbp - 0x40]
mov r12, r10
sub r12, 6
mov esi, 0x1e4b
movabs r10, 0x1648
add r15, r10
mov r10d, r14d
movabs r9, 0x4686e
mov r14, r10
add r14, r9
sub edi, 1
sub r15, rsi
mov r10, qword [rbp - 0x40]
sub r10, 3
mov r9d, esi
mov r11, r10
add r11, r9
jmp 0x100018e76
mov r10d, r11d
mov r10b, byte [r15 + r10]
mov byte [rbp - 0x31], r10b
movzx r10d, byte [rbp - 0x31]
mov dword [rbp - 0xf4], r10d
mov eax, r12d
mov qword [rbp - 0xf0], rax
mov rax, 0x2a
cqo
idiv r13
mov r10, rax
mov rax, qword [rbp - 0xf0]
cqo
idiv r10
mov r10d, edi
mov r9, rax
add r9, r10
movzx r10d, r9b
movsxd r9, dword [rbp - 0xf4]
xor r9d, r10d
mov byte [rbp - 0x31], r9b
mov r10d, r11d
mov r9b, byte [rbp - 0x31]
mov byte [r15 + r10], r9b
lea r11, [r11 + 1]
mov r10d, esi
add r10d, r14d
cmp r11d, r10d
jb 0x100018e10
mov qword [rbp - 0x88], 0x20948
lea r12, [r12 + 1]
mov qword [rbp - 0x78], 0xa7000
mov r10, qword [rbp - 0x60]
movabs al, byte [0xa0558b4c8855014c]
add qword [rbp - 0x88], r10
mov r10, qword [rbp - 0x50]
sub r10, 8
mov r9d, r12d
cmp r10, r9
jge 0x100018dfd
mov qword [rbp - 0x90], 0x1e2000
mov r10, qword [rbp - 0x50]
sub r10, 0xe
mov dword [rbp - 0x64], r10d
mov r10d, dword [rbp - 0x64]
mov r9, qword [rbp - 0x88]
mov r10b, byte [r9 + r10]
adc al, 0x11
mov byte [rbp - 0x31], r10b
mov r10d, dword [rbp - 0x64]
invalid
invalid
Function at 0x100018d84
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbp
mov rbp, rsp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0xd0
mov qword [rbp - 0x40], 6
mov r13, 7
mov rax, 0x54
mov r10, qword [rbp - 0x40]
cqo
cdq
idiv r10
mov qword [rbp - 0x50], rax
mov qword [rbp - 0x58], 9
xor r15d, r15d
mov r10, qword [rbp - 0x58]
mov r14, r10
sub r14, 9
movabs r10, 0x5280
add byte [rax], al
mov qword [rbp - 0xb8], r10
mov edi, 0xec03d4aa
mov r14d, 0x16fd
mov r10, qword [rbp - 0xb8]
movabs r9, 6
mov r15, r10
imul r15, r9
mov r10d, r14d
movabs r9, 0x7495
mov r14, r10
add r14, r9
movabs r10, 0x100000000
mov qword [rbp - 0x60], r10
add r15, qword [rbp - 0x60]
mov r10, qword [rbp - 0x40]
mov r12, r10
sub r12, 6
mov esi, 0x1e4b
movabs r10, 0x1648
add r15, r10
mov r10d, r14d
movabs r9, 0x4686e
mov r14, r10
add r14, r9
sub edi, 1
sub r15, rsi
mov r10, qword [rbp - 0x40]
sub r10, 3
mov r9d, esi
mov r11, r10
add r11, r9
jmp 0x100018e76
mov r10d, r11d
mov r10b, byte [r15 + r10]
mov byte [rbp - 0x31], r10b
movzx r10d, byte [rbp - 0x31]
mov dword [rbp - 0xf4], r10d
mov eax, r12d
mov qword [rbp - 0xf0], rax
mov rax, 0x2a
cqo
idiv r13
mov r10, rax
mov rax, qword [rbp - 0xf0]
cqo
idiv r10
mov r10d, edi
mov r9, rax
add r9, r10
movzx r10d, r9b
movsxd r9, dword [rbp - 0xf4]
xor r9d, r10d
mov byte [rbp - 0x31], r9b
mov r10d, r11d
mov r9b, byte [rbp - 0x31]
mov byte [r15 + r10], r9b
lea r11, [r11 + 1]
mov r10d, esi
add r10d, r14d
cmp r11d, r10d
jb 0x100018e10
mov qword [rbp - 0x88], 0x20948
lea r12, [r12 + 1]
mov qword [rbp - 0x78], 0xa7000
mov r10, qword [rbp - 0x60]
movabs al, byte [0xa0558b4c8855014c]
add qword [rbp - 0x88], r10
mov r10, qword [rbp - 0x50]
sub r10, 8
mov r9d, r12d
cmp r10, r9
jge 0x100018dfd
mov qword [rbp - 0x90], 0x1e2000
mov r10, qword [rbp - 0x50]
sub r10, 0xe
mov dword [rbp - 0x64], r10d
mov r10d, dword [rbp - 0x64]
mov r9, qword [rbp - 0x88]
mov r10b, byte [r9 + r10]
adc al, 0x11
mov byte [rbp - 0x31], r10b
mov r10d, dword [rbp - 0x64]
invalid
invalid
Function at 0x100018e9c
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbp
mov rbp, rsp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0xd0
mov qword [rbp - 0x40], 6
mov r13, 7
mov rax, 0x54
mov r10, qword [rbp - 0x40]
cqo
cdq
idiv r10
mov qword [rbp - 0x50], rax
mov qword [rbp - 0x58], 9
xor r15d, r15d
mov r10, qword [rbp - 0x58]
mov r14, r10
sub r14, 9
movabs r10, 0x5280
add byte [rax], al
mov qword [rbp - 0xb8], r10
mov edi, 0xec03d4aa
mov r14d, 0x16fd
mov r10, qword [rbp - 0xb8]
movabs r9, 6
mov r15, r10
imul r15, r9
mov r10d, r14d
movabs r9, 0x7495
mov r14, r10
add r14, r9
movabs r10, 0x100000000
mov qword [rbp - 0x60], r10
add r15, qword [rbp - 0x60]
mov r10, qword [rbp - 0x40]
mov r12, r10
sub r12, 6
mov esi, 0x1e4b
movabs r10, 0x1648
add r15, r10
mov r10d, r14d
movabs r9, 0x4686e
mov r14, r10
add r14, r9
sub edi, 1
sub r15, rsi
mov r10, qword [rbp - 0x40]
sub r10, 3
mov r9d, esi
mov r11, r10
add r11, r9
jmp 0x100018e76
mov r10d, r11d
mov r10b, byte [r15 + r10]
mov byte [rbp - 0x31], r10b
movzx r10d, byte [rbp - 0x31]
mov dword [rbp - 0xf4], r10d
mov eax, r12d
mov qword [rbp - 0xf0], rax
mov rax, 0x2a
cqo
idiv r13
mov r10, rax
mov rax, qword [rbp - 0xf0]
cqo
idiv r10
mov r10d, edi
mov r9, rax
add r9, r10
movzx r10d, r9b
movsxd r9, dword [rbp - 0xf4]
xor r9d, r10d
mov byte [rbp - 0x31], r9b
mov r10d, r11d
mov r9b, byte [rbp - 0x31]
mov byte [r15 + r10], r9b
lea r11, [r11 + 1]
mov r10d, esi
add r10d, r14d
cmp r11d, r10d
jb 0x100018e10
mov qword [rbp - 0x88], 0x20948
lea r12, [r12 + 1]
mov qword [rbp - 0x78], 0xa7000
mov r10, qword [rbp - 0x60]
movabs al, byte [0xa0558b4c8855014c]
add qword [rbp - 0x88], r10
mov r10, qword [rbp - 0x50]
sub r10, 8
mov r9d, r12d
cmp r10, r9
jge 0x100018dfd
mov qword [rbp - 0x90], 0x1e2000
mov r10, qword [rbp - 0x50]
sub r10, 0xe
mov dword [rbp - 0x64], r10d
mov r10d, dword [rbp - 0x64]
mov r9, qword [rbp - 0x88]
mov r10b, byte [r9 + r10]
adc al, 0x11
mov byte [rbp - 0x31], r10b
mov r10d, dword [rbp - 0x64]
invalid
invalid