joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180177d80
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rdi
mov qword [rsp + 0x10], rdx
push r14
sub rsp, 0x40
mov ebp, r8d
mov rbx, rdx
cmp qword [rdx + 0x18], 0xf
jbe 0x180177db0
mov rdx, qword [rdx]
lea rdi, [rbx + 0x18]
jmp 0x180177db4
lea rdi, [rdx + 0x18]
mov r8d, 0x84222325
movzx eax, byte [rdx]
test al, al
je 0x180177ddd
movsx eax, al
xor eax, r8d
imul r8d, eax, 0x1b3
lea rdx, [rdx + 1]
movzx eax, byte [rdx]
test al, al
jne 0x180177dc1
lea rdi, [rbx + 0x18]
lea rdx, [rsp + 0x20]
call fcn.18017a2a0
cmp qword [rsp + 0x30], 0
jne 0x180177e8e
mov rdx, qword [rsp + 0x38]
cmp rdx, 0xf
jbe 0x180177e30
inc rdx
mov rcx, qword [rsp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180177e2b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180177f59
call fcn.180182790
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x38], 0xf
mov byte [rsp + 0x20], 0
mov rdx, qword [rbx + 0x18]
cmp rdx, 0xf
jbe 0x180177e81
inc rdx
mov rcx, qword [rbx]
cmp rdx, 0x1000
jb 0x180177e7c
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x180177f5f
mov rcx, r8
call fcn.180182790
mov qword [rbx + 0x18], 0xf
jmp 0x180177f36
lea rcx, [rsp + 0x20]
cmp qword [rsp + 0x38], 0xf
cmova rcx, qword [rsp + 0x20]
call fcn.1801841c0
mov ebp, eax
mov rdx, qword [rsp + 0x38]
cmp rdx, 0xf
jbe 0x180177ee3
inc rdx
mov rcx, qword [rsp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180177ede
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180177f59
lea rdi, [rbx + 0x18]
call fcn.180182790
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x38], 0xf
mov byte [rsp + 0x20], 0
mov rdx, qword [rdi]
cmp rdx, 0xf
jbe 0x180177f2f
inc rdx
mov rcx, qword [rbx]
cmp rdx, 0x1000
jb 0x180177f2a
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x180177f5f
mov rcx, r8
call fcn.180182790
mov qword [rdi], 0xf
mov eax, ebp
mov byte [rbx], 0
mov qword [rbx + 0x10], 0
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x40
pop r14
ret
call fcn.1800e6e30
nop
call fcn.1800e6e30
int3
Function at 0x180177f70
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rdi
mov qword [rsp + 0x10], rdx
push r14
sub rsp, 0x50
vmovaps xmmword [rsp + 0x40], xmm6
vmovaps xmm6, xmm2
mov rbx, rdx
cmp qword [rdx + 0x18], 0xf
jbe 0x180177fa2
mov rdx, qword [rdx]
lea rdi, [rbx + 0x18]
jmp 0x180177fa6
lea rdi, [rdx + 0x18]
mov r8d, 0x84222325
movzx eax, byte [rdx]
test al, al
je 0x180177fcf
movsx eax, al
xor eax, r8d
imul r8d, eax, 0x1b3
lea rdx, [rdx + 1]
movzx eax, byte [rdx]
test al, al
jne 0x180177fb3
lea rdi, [rbx + 0x18]
lea rdx, [rsp + 0x20]
call fcn.18017a2a0
cmp qword [rsp + 0x30], 0
jne 0x180178080
mov rdx, qword [rsp + 0x38]
cmp rdx, 0xf
jbe 0x180178022
inc rdx
mov rcx, qword [rsp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18017801d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180178154
call fcn.180182790
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x38], 0xf
mov byte [rsp + 0x20], 0
mov rdx, qword [rbx + 0x18]
cmp rdx, 0xf
jbe 0x180178073
inc rdx
mov rcx, qword [rbx]
cmp rdx, 0x1000
jb 0x18017806e
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x18017815a
mov rcx, r8
call fcn.180182790
mov qword [rbx + 0x18], 0xf
jmp 0x18017812e
lea rcx, [rsp + 0x20]
cmp qword [rsp + 0x38], 0xf
cmova rcx, qword [rsp + 0x20]
call fcn.180184030
vcvtsd2ss xmm6, xmm0, xmm0
mov rdx, qword [rsp + 0x38]
cmp rdx, 0xf
jbe 0x1801780db
inc rdx
mov rcx, qword [rsp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1801780d6
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180178154
lea rdi, [rbx + 0x18]
call fcn.180182790
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x38], 0xf
mov byte [rsp + 0x20], 0
mov rdx, qword [rdi]
cmp rdx, 0xf
jbe 0x180178127
inc rdx
mov rcx, qword [rbx]
cmp rdx, 0x1000
jb 0x180178122
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x18017815a
mov rcx, r8
call fcn.180182790
mov qword [rdi], 0xf
vmovaps xmm0, xmm6
mov byte [rbx], 0
mov qword [rbx + 0x10], 0
mov rbx, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x70]
vmovaps xmm6, xmmword [rsp + 0x40]
add rsp, 0x50
pop r14
ret
call fcn.1800e6e30
nop
call fcn.1800e6e30
int3
Function at 0x180178ce0
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x10], rdx
push rsi
push rdi
push r14
sub rsp, 0x80
movzx ebp, r8b
mov rbx, rdx
cmp qword [rdx + 0x18], 0xf
jbe 0x180178d11
mov rdx, qword [rdx]
lea rdi, [rbx + 0x18]
jmp 0x180178d15
lea rdi, [rdx + 0x18]
mov r8d, 0x84222325
movzx eax, byte [rdx]
test al, al
je 0x180178d3e
movsx eax, al
xor eax, r8d
imul r8d, eax, 0x1b3
lea rdx, [rdx + 1]
movzx eax, byte [rdx]
test al, al
jne 0x180178d22
lea rdi, [rbx + 0x18]
lea rdx, [rsp + 0x20]
call fcn.18017a2a0
cmp qword [rsp + 0x30], 0
jne 0x180178ddd
mov rdx, qword [rsp + 0x38]
cmp rdx, 0xf
jbe 0x180178d92
inc rdx
mov rcx, qword [rsp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180178d8c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180178f5c
call fcn.180182790
nop
mov rdx, qword [rbx + 0x18]
cmp rdx, 0xf
jbe 0x180178dcc
inc rdx
mov rcx, qword [rbx]
cmp rdx, 0x1000
jb 0x180178dc7
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x180178f62
mov rcx, r8
call fcn.180182790
mov qword [rbx + 0x18], 0xf
movzx eax, bpl
jmp 0x180178f2d
movabs rax, 0x8e992baa416bd703
mov qword [rsp + 0xa8], rax
mov rax, qword [rsp + 0xa8]
mov qword [rsp + 0x40], rax
movabs rcx, 0x93e8cbcb24d100b0
mov qword [rsp + 0xa8], rcx
mov rax, qword [rsp + 0xa8]
mov qword [rsp + 0x48], rax
movabs rax, 0x8e992baa241ea577
mov qword [rsp + 0xa8], rax
mov rax, qword [rsp + 0xa8]
mov qword [rsp + 0x60], rax
mov qword [rsp + 0xa8], rcx
mov rax, qword [rsp + 0xa8]
mov qword [rsp + 0x68], rax
vmovdqu xmm0, xmmword [rsp + 0x40]
vpxor xmm1, xmm0, xmmword [rsp + 0x60]
vmovdqu xmmword [rsp + 0x40], xmm1
lea rcx, [rsp + 0x40]
mov rax, 0xffffffffffffffff
nop dword [rax]
inc rax
cmp byte [rcx + rax], 0
jne 0x180178e70
lea rcx, [rsp + 0x20]
mov rsi, qword [rsp + 0x20]
mov rbp, qword [rsp + 0x38]
cmp rbp, 0xf
jbe 0x180178e95
mov rcx, rsi
lea rdi, [rbx + 0x18]
mov r8, qword [rsp + 0x30]
cmp r8, rax
jne 0x180178eb2
lea rdx, [rsp + 0x40]
call fcn.180184e00
test eax, eax
jne 0x180178eb2
mov r14b, 1
jmp 0x180178eb5
xor r14b, r14b
cmp rbp, 0xf
jbe 0x180178eed
lea rdx, [rbp + 1]
mov rax, rsi
cmp rdx, 0x1000
jb 0x180178ee4
add rdx, 0x27
mov rsi, qword [rsi - 8]
sub rax, rsi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180178f50
lea rdi, [rbx + 0x18]
mov rcx, rsi
call fcn.180182790
nop
mov rdx, qword [rdi]
cmp rdx, 0xf
jbe 0x180178f22
inc rdx
mov rcx, qword [rbx]
cmp rdx, 0x1000
jb 0x180178f1d
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x180178f56
mov rcx, r8
call fcn.180182790
mov qword [rdi], 0xf
movzx eax, r14b
mov byte [rbx], 0
mov qword [rbx + 0x10], 0
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret
call fcn.1800e6e30
nop
call fcn.1800e6e30
nop
call fcn.1800e6e30
nop
call fcn.1800e6e30
int3
Function at 0x180178f70
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x10], rdx
push rsi
push rdi
push r14
sub rsp, 0x40
mov rbx, rdx
mov rbp, rcx
mov r9, rdx
lea rsi, [rdx + 0x18]
cmp qword [rdx + 0x18], 0xf
jbe 0x180178f9e
mov r9, qword [rdx]
mov edi, 0x84222325
movzx eax, byte [r9]
test al, al
je 0x180178fcb
nop dword [rax + rax]
movsx eax, al
xor eax, edi
imul edi, eax, 0x1b3
lea r9, [r9 + 1]
movzx eax, byte [r9]
test al, al
jne 0x180178fb0
lea rsi, [rdx + 0x18]
mov edx, r8d
lea rcx, [rsp + 0x20]
call fcn.18011fbc0
mov r8, rax
mov edx, edi
mov rcx, rbp
call fcn.18017a9c0
nop
mov rdx, qword [rbx + 0x18]
cmp rdx, 0xf
jbe 0x18017901c
inc rdx
mov rcx, qword [rbx]
cmp rdx, 0x1000
jb 0x180179017
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x180179041
mov rcx, r8
call fcn.180182790
mov qword [rbx + 0x10], 0
mov qword [rsi], 0xf
mov byte [rbx], 0
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x70]
add rsp, 0x40
pop r14
pop rdi
pop rsi
ret
call fcn.1800e6e30
int3

Function at 0x180179050
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x10], rdx
push rsi
push rdi
push r14
sub rsp, 0x40
mov rbx, rdx
mov rbp, rcx
mov r8, rdx
lea rsi, [rdx + 0x18]
cmp qword [rdx + 0x18], 0xf
jbe 0x18017907e
mov r8, qword [rdx]
mov edi, 0x84222325
movzx eax, byte [r8]
test al, al
je 0x1801790ab
nop dword [rax + rax]
movsx eax, al
xor eax, edi
imul edi, eax, 0x1b3
lea r8, [r8 + 1]
movzx eax, byte [r8]
test al, al
jne 0x180179090
lea rsi, [rdx + 0x18]
vmovaps xmm1, xmm2
lea rcx, [rsp + 0x20]
call fcn.18017b970
mov r8, rax
mov edx, edi
mov rcx, rbp
call fcn.18017a9c0
nop
mov rdx, qword [rbx + 0x18]
cmp rdx, 0xf
jbe 0x1801790fd
inc rdx
mov rcx, qword [rbx]
cmp rdx, 0x1000
jb 0x1801790f8
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x180179122
mov rcx, r8
call fcn.180182790
mov qword [rbx + 0x10], 0
mov qword [rsi], 0xf
mov byte [rbx], 0
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x70]
add rsp, 0x40
pop r14
pop rdi
pop rsi
ret
call fcn.1800e6e30
int3
Function at 0x180179a40
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x10], rdx
push rdi
sub rsp, 0xa0
mov rbx, rdx
mov rsi, rcx
mov r9, rdx
cmp qword [rdx + 0x18], 0xf
jbe 0x180179a6a
mov r9, qword [rdx]
mov edi, 0x84222325
movzx eax, byte [r9]
test al, al
je 0x180179a97
nop word [rax + rax]
movsx eax, al
xor eax, edi
imul edi, eax, 0x1b3
lea r9, [r9 + 1]
movzx eax, byte [r9]
test al, al
jne 0x180179a80
movabs rcx, 0x93e8cbcb24d100b0
test r8b, r8b
je 0x180179b37
movabs rax, 0x8e992baa416bd703
mov qword [rsp + 0xc8], rax
mov rax, qword [rsp + 0xc8]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0xc8], rcx
mov rax, qword [rsp + 0xc8]
mov qword [rsp + 0x48], rax
movabs rax, 0x8e992baa241ea577
mov qword [rsp + 0xc8], rax
mov rax, qword [rsp + 0xc8]
mov qword [rsp + 0x80], rax
mov qword [rsp + 0xc8], rcx
mov rax, qword [rsp + 0xc8]
mov qword [rsp + 0x88], rax
vmovdqu xmm0, xmmword [rsp + 0x40]
vpxor xmm1, xmm0, xmmword [rsp + 0x80]
vmovdqu xmmword [rsp + 0x40], xmm1
lea rdx, [rsp + 0x40]
jmp 0x180179bbf
movabs rax, 0x8e992bcf5772c411
mov qword [rsp + 0xc8], rax
mov rax, qword [rsp + 0xc8]
mov qword [rsp + 0x60], rax
mov qword [rsp + 0xc8], rcx
mov rax, qword [rsp + 0xc8]
mov qword [rsp + 0x68], rax
movabs rax, 0x8e992baa241ea577
mov qword [rsp + 0xc8], rax
mov rax, qword [rsp + 0xc8]
mov qword [rsp + 0x80], rax
mov qword [rsp + 0xc8], rcx
mov rax, qword [rsp + 0xc8]
mov qword [rsp + 0x88], rax
vmovdqu xmm0, xmmword [rsp + 0x60]
vpxor xmm1, xmm0, xmmword [rsp + 0x80]
vmovdqu xmmword [rsp + 0x60], xmm1
lea rdx, [rsp + 0x60]
vpxor xmm0, xmm0, xmm0
vmovups xmmword [rsp + 0x20], xmm0
mov qword [rsp + 0x30], 0
mov qword [rsp + 0x38], 0
mov r8, 0xffffffffffffffff
inc r8
cmp byte [rdx + r8], 0
jne 0x180179be2
lea rcx, [rsp + 0x20]
call fcn.1800db380
lea r8, [rsp + 0x20]
mov edx, edi
mov rcx, rsi
call fcn.18017a9c0
nop
mov rdx, qword [rbx + 0x18]
cmp rdx, 0xf
jbe 0x180179c3c
inc rdx
mov rcx, qword [rbx]
cmp rdx, 0x1000
jb 0x180179c37
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x180179c64
mov rcx, r8
call fcn.180182790
mov qword [rbx + 0x10], 0
mov qword [rbx + 0x18], 0xf
mov byte [rbx], 0
lea r11, [rsp + 0xa0]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
call fcn.1800e6e30
int3
Function at 0x180179fa0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x20], rbx
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x60
mov rsi, rdx
mov r14, rcx
vpxor xmm0, xmm0, xmm0
vmovups xmmword [rcx], xmm0
xor r13d, r13d
mov qword [rcx + 0x10], r13
mov qword [rcx + 0x18], 0xf
mov byte [rcx], r13b
lea rdi, [rcx + 0x20]
vmovups xmmword [rdi], xmm0
mov qword [rdi + 0x10], r13
mov qword [rdi + 0x18], 0xf
mov byte [rdi], r13b
cmp rcx, rdx
je 0x18017a00d
cmp qword [rdx + 0x18], 0xf
jbe 0x18017a004
mov rdx, qword [rdx]
mov r8, qword [rsi + 0x10]
call fcn.1800e9e30
movabs rax, 0x8e992baa241ea505
mov qword [rsp + 0xb0], rax
mov rax, qword [rsp + 0xb0]
mov qword [rsp + 0x20], rax
movabs rcx, 0x93e8cbcb24d100b0
mov qword [rsp + 0xb0], rcx
mov rax, qword [rsp + 0xb0]
mov qword [rsp + 0x28], rax
movabs rax, 0x8e992baa241ea577
mov qword [rsp + 0xb0], rax
mov rax, qword [rsp + 0xb0]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0xb0], rcx
mov rax, qword [rsp + 0xb0]
mov qword [rsp + 0x48], rax
vmovdqu xmm0, xmmword [rsp + 0x20]
vpxor xmm1, xmm0, xmmword [rsp + 0x40]
vmovdqu xmmword [rsp + 0x20], xmm1
mov rcx, r14
cmp qword [r14 + 0x18], 0xf
jbe 0x18017a09e
mov rcx, qword [r14]
lea rdx, [rsp + 0x20]
call fcn.180184570
mov r15, rax
test rax, rax
je 0x18017a178
xor edx, edx
lea r8d, [rdx + 2]
mov rcx, rax
call fcn.180184840
mov rcx, r15
call fcn.180184ad0
movsxd rbx, eax
xor r8d, r8d
xor edx, edx
mov rcx, r15
call fcn.180184840
test ebx, ebx
jg 0x18017a0eb
mov rcx, r15
call fcn.180184340
jmp 0x18017a178
mov rcx, rbx
call fcn.180182770
mov rbp, rax
mov qword [rsp + 0xb0], rax
mov r9, r15
mov r8, rbx
mov edx, 1
mov rcx, rax
call fcn.180184700
mov r12, rax
mov rcx, r15
call fcn.180184340
cmp r12, rbx
jne 0x18017a16a
mov r8, r12
mov rdx, rbp
mov rcx, rdi
call fcn.1800e9e30
cmp qword [rdi + 0x18], 0xf
jbe 0x18017a139
mov rdi, qword [rdi]
mov ecx, 0x84222325
movzx eax, byte [rdi]
test al, al
je 0x18017a166
nop word [rax + rax]
movsx eax, al
xor eax, ecx
imul ecx, eax, 0x1b3
lea rdi, [rdi + 1]
movzx eax, byte [rdi]
test al, al
jne 0x18017a150
mov dword [r14 + 0x40], ecx
test rbp, rbp
je 0x18017a178
mov rcx, rbp
call fcn.180182790
nop
mov rdx, qword [rsi + 0x18]
cmp rdx, 0xf
jbe 0x18017a1ae
inc rdx
mov rcx, qword [rsi]
cmp rdx, 0x1000
jb 0x18017a1a9
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x18017a1d8
mov rcx, r8
call fcn.180182790
mov qword [rsi + 0x10], r13
mov qword [rsi + 0x18], 0xf
mov byte [rsi], 0
mov rax, r14
mov rbx, qword [rsp + 0xb8]
add rsp, 0x60
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
call fcn.1800e6e30
int3

Function at 0x18017a260
Capabilities:
Encode data using xor

Disassembly:
add rcx, 0x20
cmp qword [rcx + 0x18], 0xf
jbe 0x18017a26e
mov rcx, qword [rcx]
movzx eax, byte [rcx]
mov edx, 0x84222325
test al, al
je 0x18017a296
nop word [rax + rax]
movsx eax, al
lea rcx, [rcx + 1]
xor eax, edx
imul edx, eax, 0x1b3
movzx eax, byte [rcx]
test al, al
jne 0x18017a280
mov eax, edx
ret
Function at 0x18017fa40
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x30
movzx ebp, r9b
mov r15, r8
mov edi, edx
mov rsi, rcx
call fcn.180185bc0
test rax, rax
je 0x18017fb00
movzx r14d, word [rax + 0x14]
xor r12d, r12d
movzx r11d, word [rax + 6]
add r14, rax
movzx r9d, r12w
cmp r12w, r11w
jae 0x18017fb00
movzx eax, r9w
lea rcx, [rax + rax*4]
mov r10d, dword [r14 + rcx*8 + 0x20]
cmp dword [r14 + rcx*8 + 0x28], r10d
mov ebx, dword [r14 + rcx*8 + 0x24]
cmovb r10d, dword [r14 + rcx*8 + 0x28]
test ebx, ebx
je 0x18017faf6
test r10d, r10d
je 0x18017faf6
mov rdx, qword [r14 + rcx*8 + 0x18]
mov r8d, 0x84222325
mov qword [rsp + 0x28], r12
lea rcx, [rsp + 0x20]
mov qword [rsp + 0x20], rdx
test dl, dl
je 0x18017faf1
movsx eax, dl
lea rcx, [rcx + 1]
xor eax, r8d
imul r8d, eax, 0x1b3
movzx eax, byte [rcx]
movzx edx, al
test al, al
jne 0x18017fad6
cmp edi, r8d
je 0x18017fb21
inc r9w
cmp r9w, r11w
jb 0x18017fa92
xor eax, eax
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x30
pop r15
pop r14
pop r12
ret
mov edx, r10d
lea rcx, [rbx + rsi]
add rdx, rbx
movzx r9d, bpl
add rdx, rsi
mov r8, r15
call fcn.18017f8e0
jmp 0x18017fb02

Function at 0x1801852d0
Capabilities:
Encode data using xor

Disassembly:
movzx eax, byte [rcx]
mov edx, 0x84222325
test al, al
je 0x1801852f6
nop dword [rax]
movsx eax, al
lea rcx, [rcx + 1]
xor eax, edx
imul edx, eax, 0x1b3
movzx eax, byte [rcx]
test al, al
jne 0x1801852e0
mov eax, edx
ret
Function at 0x180185300
Capabilities:
Access peb ldr_data
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x70
mov rax, qword gs:[0x30]
movzx ebp, dl
mov edi, ecx
mov r8, qword [rax + 0x60]
mov rsi, qword [r8 + 0x18]
add rsi, 0x20
mov r10, qword [rsi]
cmp r10, rsi
je 0x1801853da
nop word [rax + rax]
movzx ebx, word [r10 + 0x48]
xor eax, eax
vpxor xmm0, xmm0, xmm0
shr rbx, 1
xor r9d, r9d
mov dword [rsp + 0x60], eax
vmovups ymmword [rsp], ymm0
vmovups ymmword [rsp + 0x20], ymm0
vmovups ymmword [rsp + 0x40], ymm0
add rbx, 0xfffffffffffffffc
je 0x18018539b
mov r11, qword [r10 + 0x50]
movzx edx, word [r11]
lea r11, [r11 + 2]
movzx r8d, dl
sub dx, 0x41
cmp dx, 0x19
lea eax, [r8 + 0x20]
movzx ecx, al
cmova ecx, r8d
mov byte [rsp + r9], cl
inc r9
cmp r9, rbx
jne 0x180185370
test edi, edi
je 0x1801853f5
movzx eax, byte [rsp]
lea rdx, [rsp]
mov r8d, 0x84222325
test al, al
je 0x1801853c9
movsx ecx, al
lea rdx, [rdx + 1]
movzx eax, byte [rdx]
xor ecx, r8d
imul r8d, ecx, 0x1b3
test al, al
jne 0x1801853b1
cmp edi, r8d
je 0x1801853f5
mov r10, qword [r10]
cmp r10, rsi
jne 0x180185340
xor eax, eax
vzeroupper
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
test bpl, bpl
je 0x180185426
mov rcx, qword [r10 - 0x10]
mov rax, qword [r10 - 8]
mov qword [rcx + 8], rax
mov rcx, qword [r10 - 8]
mov rax, qword [r10 - 0x10]
mov qword [rcx], rax
mov rcx, qword [r10]
mov rax, qword [r10 + 8]
mov qword [rcx + 8], rax
mov rcx, qword [r10 + 8]
mov rax, qword [r10]
mov qword [rcx], rax
mov rax, qword [r10 + 0x20]
jmp 0x1801853dc

Function at 0x180185430
Capabilities:
Access peb ldr_data

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
push rsi
push rdi
push r14
sub rsp, 0x20
mov rax, qword gs:[0x30]
movzx ebp, r8b
mov rsi, rdx
mov r14d, ecx
mov r9, qword [rax + 0x60]
mov rdi, qword [r9 + 0x18]
add rdi, 0x20
mov rbx, qword [rdi]
cmp rbx, rdi
je 0x180185492
nop dword [rax]
mov rcx, qword [rbx + 0x20]
cmp rsi, rcx
je 0x18018548a
movzx r8d, bpl
mov edx, r14d
call fcn.1801854b0
test rax, rax
jne 0x180185494
mov rbx, qword [rbx]
cmp rbx, rdi
jne 0x180185470
xor eax, eax
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
add rsp, 0x20
pop r14
pop rdi
pop rsi
ret
Function at 0x1801859a0
Capabilities:
Parse pe header

Disassembly:
test rcx, rcx
je 0x1801859c6
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x1801859c6
movsxd rax, dword [rcx + 0x3c]
add rax, rcx
xor ecx, ecx
cmp dword [rax], 0x4550
cmovne rax, rcx
mov eax, dword [rax + 0x50]
ret
xor ecx, ecx
mov eax, dword [rcx + 0x50]
ret

Function at 0x1801859d0
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x430
mov rax, qword [rcx + 0x10]
mov esi, r8d
mov rbp, rdx
mov rdi, rcx
test rax, rax
je 0x180185ac5
lea rbx, [rax + 0x90]
test rbx, rbx
je 0x180185ac5
test r8d, r8d
je 0x180185ac5
xor edx, edx
lea rcx, [rsp + 0x20]
mov r8d, 0x200
call fcn.180184e70
xor edx, edx
lea rcx, [rsp + 0x220]
mov r8d, 0x200
call fcn.180184e70
mov rdi, qword [rdi]
mov ebx, dword [rbx]
mov qword [rsp + 0x420], 0
add rbx, rdi
je 0x180185ac5
mov eax, dword [rbx + 0xc]
test eax, eax
je 0x180185ac5
mov r11d, eax
add r11, rdi
je 0x180185ac0
mov edx, dword [rbx]
mov r10d, 0
add rdx, rdi
je 0x180185abc
nop
mov rax, qword [rdx]
test rax, rax
je 0x180185abc
lea rcx, [rdi + rax]
test rcx, rcx
je 0x180185ab3
lea r9, [rcx + 2]
mov r8d, 0x84222325
movzx ecx, byte [r9]
mov rax, r9
test cl, cl
je 0x180185aae
movsx ecx, cl
lea rax, [rax + 1]
xor ecx, r8d
imul r8d, ecx, 0x1b3
movzx ecx, byte [rax]
test cl, cl
jne 0x180185a96
cmp r8d, esi
je 0x180185b13
inc r10
add rdx, 8
jne 0x180185a70
add rbx, 0x14
test rbx, rbx
jne 0x180185a53
xor edx, edx
mov r8d, 0x200
mov rcx, rbp
call fcn.180184e70
lea rcx, [rbp + 0x200]
xor edx, edx
mov r8d, 0x200
call fcn.180184e70
mov qword [rbp + 0x400], 0
mov rax, rbp
vzeroupper
lea r11, [rsp + 0x430]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
lea rcx, [rsp + 0x20]
sub rcx, r11
nop dword [rax + rax]
movzx eax, byte [r11]
mov byte [rcx + r11], al
lea r11, [r11 + 1]
test al, al
jne 0x180185b20
lea rcx, [rsp + 0x220]
sub rcx, r9
nop dword [rax + rax]
movzx eax, byte [r9]
mov byte [rcx + r9], al
lea r9, [r9 + 1]
test al, al
jne 0x180185b40
mov ecx, dword [rbx + 0x10]
mov edx, 8
add rcx, rdi
lea rax, [rcx + r10*8]
mov rcx, rbp
mov qword [rsp + 0x420], rax
lea rax, [rsp + 0x20]
nop
lea rcx, [rcx + 0x80]
vmovups ymm0, ymmword [rax]
vmovups xmm1, xmmword [rax + 0x70]
lea rax, [rax + 0x80]
vmovups ymmword [rcx - 0x80], ymm0
vmovups ymm0, ymmword [rax - 0x60]
vmovups ymmword [rcx - 0x60], ymm0
vmovups ymm0, ymmword [rax - 0x40]
vmovups ymmword [rcx - 0x40], ymm0
vmovups xmm0, xmmword [rax - 0x20]
vmovups xmmword [rcx - 0x20], xmm0
vmovups xmmword [rcx - 0x10], xmm1
sub rdx, 1
jne 0x180185b70
mov rax, qword [rax]
mov qword [rcx], rax
jmp 0x180185af4

Function at 0x180185bc0
Capabilities:
Parse pe header

Disassembly:
test rcx, rcx
je 0x180185be3
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x180185be3
movsxd rax, dword [rcx + 0x3c]
add rax, rcx
xor ecx, ecx
cmp dword [rax], 0x4550
cmovne rax, rcx
ret
xor eax, eax
ret