joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180125f70
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov rbp, rsp
mov eax, 0x50
call fcn.180188f30
sub rsp, rax
mov rax, qword [0x180237160]
xor rax, rsp
mov qword [rbp - 8], rax
mov rax, qword [rbp + 0x60]
mov r15, qword [rbp + 0x68]
mov r12d, r8d
movzx r10d, byte [rax]
movzx r8d, byte [rax + 4]
mov ebx, dword [r15]
lea rdi, [rax + 1]
mov qword [rbp - 0x18], rax
shl r10d, 0x18
movzx eax, byte [rdi]
mov rsi, rcx
movzx ecx, byte [rdi + 5]
shl eax, 0x10
shl r8d, 0x18
shl ecx, 8
or r10d, eax
movzx eax, byte [rdi + 1]
mov r14, rdx
shl eax, 8
lea rdx, [rdi + 5]
xor r13d, r13d
or r10d, eax
movzx eax, byte [rdi + 2]
mov qword [rbp - 0x28], r9
or r10d, eax
movzx eax, byte [rdi + 4]
mov qword [rbp - 0x20], r15
shl eax, 0x10
mov dword [rbp - 0x30], r10d
mov byte [rbp - 0xd], r10b
or r8d, eax
movzx eax, byte [rdx + 1]
or ecx, eax
mov eax, r10d
shr eax, 0x18
or r8d, ecx
mov byte [rbp - 0x10], al
mov eax, r10d
mov dword [rbp - 0x2c], r8d
shr eax, 0x10
mov byte [rbp - 9], r8b
mov byte [rbp - 0xf], al
mov eax, r10d
shr eax, 8
mov byte [rbp - 0xe], al
mov eax, r8d
shr eax, 0x18
mov byte [rbp - 0xc], al
mov eax, r8d
shr eax, 0x10
mov byte [rbp - 0xb], al
mov eax, r8d
shr eax, 8
mov byte [rbp - 0xa], al
test r12d, r12d
je 0x180126136
mov r15, qword [rbp - 0x28]
sub r14, rsi
movzx edx, r8b
movzx r9d, r10b
nop dword [rax]
dec r12d
test ebx, ebx
jne 0x1801260d3
lea rcx, [rbp - 0x30]
mov rdx, r15
call fcn.180124d80
mov r10d, dword [rbp - 0x30]
mov r8d, dword [rbp - 0x2c]
mov eax, r10d
movzx edx, r8b
movzx r9d, r10b
shr eax, 0x18
mov byte [rbp - 0xd], r10b
mov byte [rbp - 9], dl
mov byte [rbp - 0x10], al
mov eax, r10d
shr eax, 0x10
mov byte [rbp - 0xf], al
mov eax, r10d
shr eax, 8
mov byte [rbp - 0xe], al
mov eax, r8d
shr eax, 0x18
mov byte [rbp - 0xc], al
mov eax, r8d
shr eax, 0x10
mov byte [rbp - 0xb], al
mov eax, r8d
shr eax, 8
inc r13d
mov byte [rbp - 0xa], al
movsxd rax, ebx
inc rsi
movzx ecx, byte [rbp + rax - 0x10]
xor cl, byte [rsi - 1]
inc ebx
mov byte [r14 + rsi - 1], cl
and ebx, 7
test r12d, r12d
jne 0x180126070
mov r15, qword [rbp - 0x20]
test r13d, r13d
je 0x180126136
mov rcx, qword [rbp - 0x18]
mov eax, r10d
shr eax, 0x18
mov byte [rcx], al
mov eax, r10d
shr r10d, 8
shr eax, 0x10
mov byte [rdi], al
mov byte [rdi + 1], r10b
mov byte [rdi + 2], r9b
mov eax, r8d
shr eax, 0x18
mov byte [rdi + 3], al
mov eax, r8d
shr eax, 0x10
shr r8d, 8
mov byte [rdi + 4], al
mov byte [rdi + 5], r8b
mov byte [rdi + 6], dl
mov dword [r15], ebx
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.180183a50
mov rbx, qword [rsp + 0x90]
add rsp, 0x50
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x180126160
Capabilities:
Encode data using xor
Encrypt data using blowfish
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
mov eax, 0x20
call fcn.180188f30
sub rsp, rax
mov ebx, edx
mov rsi, r8
lea rdx, [0x1801f0130]
mov r8d, 0x1048
mov rdi, rcx
call fcn.180183a80
mov eax, 0x48
mov rdx, rsi
cmp ebx, eax
cmovg ebx, eax
movsxd r8, ebx
add r8, rsi
xor ebx, ebx
mov r9d, ebx
nop word [rax + rax]
movzx ecx, byte [rdx]
inc rdx
cmp rdx, r8
cmovae rdx, rsi
shl ecx, 8
movzx eax, byte [rdx]
inc rdx
or ecx, eax
cmp rdx, r8
cmovae rdx, rsi
shl ecx, 8
movzx eax, byte [rdx]
inc rdx
or ecx, eax
cmp rdx, r8
cmovae rdx, rsi
shl ecx, 8
movzx eax, byte [rdx]
inc rdx
or ecx, eax
cmp rdx, r8
cmovae rdx, rsi
xor dword [rdi + r9*4], ecx
inc r9
cmp r9, 0x12
jl 0x1801261b0
mov qword [rsp + 0x30], rbx
mov rsi, rbx
nop dword [rax + rax]
lea rcx, [rsp + 0x30]
mov rdx, rdi
call fcn.180124d80
mov eax, dword [rsp + 0x30]
add rsi, 2
mov dword [rdi + rsi*4 - 8], eax
mov eax, dword [rsp + 0x34]
mov dword [rdi + rsi*4 - 4], eax
cmp rsi, 0x12
jl 0x180126210
nop word [rax + rax]
lea rcx, [rsp + 0x30]
mov rdx, rdi
call fcn.180124d80
mov eax, dword [rsp + 0x30]
add rbx, 2
mov dword [rdi + rbx*4 + 0x40], eax
mov eax, dword [rsp + 0x34]
mov dword [rdi + rbx*4 + 0x44], eax
cmp rbx, 0x400
jl 0x180126240
mov rbx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x180126dd0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov rbp, rsp
mov eax, 0x50
call fcn.180188f30
sub rsp, rax
mov rax, qword [0x180237160]
xor rax, rsp
mov qword [rbp - 8], rax
mov rax, qword [rbp + 0x60]
mov r15, qword [rbp + 0x68]
mov rsi, rcx
movzx r10d, byte [rax]
mov ebx, dword [r15]
lea rdi, [rax + 1]
movzx ecx, byte [rdi + 6]
mov qword [rbp - 0x18], rax
movzx eax, byte [rdi]
shl eax, 8
mov r14, rdx
movzx edx, byte [rdi + 3]
or r10d, eax
movzx eax, byte [rdi + 1]
shl ecx, 8
shl eax, 0x10
mov r12d, r8d
lea r8, [rdi + 5]
or r10d, eax
movzx eax, byte [rdi + 2]
xor r13d, r13d
shl eax, 0x18
mov qword [rbp - 0x28], r9
mov qword [rbp - 0x20], r15
or r10d, eax
movzx eax, byte [rdi + 4]
shl eax, 8
mov dword [rbp - 0x30], r10d
mov byte [rbp - 0x10], r10b
or edx, eax
movzx eax, byte [r8]
or ecx, eax
mov eax, r10d
shr eax, 8
shl ecx, 0x10
mov byte [rbp - 0xf], al
or edx, ecx
mov eax, r10d
shr eax, 0x10
mov dword [rbp - 0x2c], edx
mov byte [rbp - 0xc], dl
mov byte [rbp - 0xe], al
mov eax, r10d
shr eax, 0x18
mov byte [rbp - 0xd], al
mov eax, edx
shr eax, 8
mov byte [rbp - 0xb], al
mov eax, edx
shr eax, 0x10
mov byte [rbp - 0xa], al
mov eax, edx
shr eax, 0x18
mov byte [rbp - 9], al
test r12d, r12d
je 0x180126f84
mov r15, qword [rbp - 0x28]
sub r14, rsi
movzx r8d, dl
movzx r9d, r10b
dec r12d
test ebx, ebx
jne 0x180126f24
lea rcx, [rbp - 0x30]
mov rdx, r15
call fcn.180126280
mov r10d, dword [rbp - 0x30]
mov edx, dword [rbp - 0x2c]
movzx r9d, byte [rbp - 0x30]
movzx r8d, byte [rbp - 0x2c]
mov eax, r10d
shr eax, 8
mov byte [rbp - 0x10], r9b
mov byte [rbp - 0xc], r8b
mov byte [rbp - 0xf], al
mov eax, r10d
shr eax, 0x10
mov byte [rbp - 0xe], al
mov eax, r10d
shr eax, 0x18
mov byte [rbp - 0xd], al
mov eax, edx
shr eax, 8
mov byte [rbp - 0xb], al
mov eax, edx
shr eax, 0x10
mov byte [rbp - 0xa], al
mov eax, edx
shr eax, 0x18
inc r13d
mov byte [rbp - 9], al
movsxd rax, ebx
inc rsi
movzx ecx, byte [rbp + rax - 0x10]
xor cl, byte [rsi - 1]
inc ebx
mov byte [r14 + rsi - 1], cl
and ebx, 7
test r12d, r12d
jne 0x180126ec2
mov r15, qword [rbp - 0x20]
test r13d, r13d
je 0x180126f84
mov rax, qword [rbp - 0x18]
mov byte [rax], r9b
mov eax, r10d
shr eax, 8
mov byte [rdi], al
mov eax, r10d
shr r10d, 0x18
shr eax, 0x10
mov byte [rdi + 1], al
mov byte [rdi + 2], r10b
mov byte [rdi + 3], r8b
mov eax, edx
shr eax, 8
mov byte [rdi + 4], al
mov eax, edx
shr eax, 0x10
shr edx, 0x18
mov byte [rdi + 5], al
mov byte [rdi + 6], dl
mov dword [r15], ebx
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.180183a50
mov rbx, qword [rsp + 0x90]
add rsp, 0x50
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x180126fb0
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
mov edi, 0x80
mov r10, rcx
mov byte [rcx], 0
cmp edx, edi
mov ebx, 0x400
cmovg edx, edi
test r9d, r9d
jle 0x180126fe3
cmp r9d, ebx
cmovg r9d, ebx
mov ebx, r9d
movsxd r9, edx
test edx, edx
jle 0x180127000
sub r8, r10
mov rdx, r9
movzx eax, byte [r8 + rcx]
inc rcx
dec rdx
mov byte [rcx - 1], al
jne 0x180126ff0
movzx ecx, byte [r9 + r10 - 1]
lea rdx, [r9 + r10]
lea rsi, [0x1801f1180]
cmp r9, rdi
jge 0x180127049
mov r11, r9
mov r8, rdi
neg r11
sub r8, r9
nop word [rax + rax]
movzx eax, byte [rdx + r11]
inc rdx
add eax, ecx
dec r8
movzx ecx, al
movzx ecx, byte [rcx + rsi]
mov byte [rdx - 1], cl
jne 0x180127030
lea edx, [rbx + 7]
neg ebx
mov eax, 0xff
sar edx, 3
and ebx, 7
sub edi, edx
movzx ecx, bl
movsxd r11, edx
sar eax, cl
movsxd r9, edi
mov ecx, eax
lea r8, [r9 + r10]
movzx eax, byte [r8]
and rcx, rax
movzx eax, byte [rcx + rsi]
mov byte [r8], al
test edi, edi
je 0x180127098
nop
movzx ecx, byte [r8 + r11 - 1]
dec r8
xor rcx, rax
dec r9
movzx eax, byte [rcx + rsi]
mov byte [r8], al
jne 0x180127080
lea r8, [r10 + 0xfc]
lea rdx, [r10 + 0x7e]
mov r9d, 0x40
nop dword [rax]
movzx eax, byte [rdx]
movzx ecx, byte [rdx + 1]
sub r8, 4
shl ecx, 8
sub rdx, 2
or ecx, eax
dec r9
movzx eax, cx
mov dword [r8 + 4], eax
jne 0x1801270b0
mov rbx, qword [rsp + 8]
mov rsi, qword [rsp + 0x10]
mov rdi, qword [rsp + 0x18]
ret
Function at 0x18012c5d0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov rbp, rsp
mov eax, 0x50
call fcn.180188f30
sub rsp, rax
mov rax, qword [0x180237160]
xor rax, rsp
mov qword [rbp - 8], rax
mov rax, qword [rbp + 0x60]
mov r15, qword [rbp + 0x68]
mov r12d, r8d
movzx r10d, byte [rax]
movzx r8d, byte [rax + 4]
mov ebx, dword [r15]
lea rdi, [rax + 1]
mov qword [rbp - 0x18], rax
shl r10d, 0x18
movzx eax, byte [rdi]
mov rsi, rcx
movzx ecx, byte [rdi + 5]
shl eax, 0x10
shl r8d, 0x18
shl ecx, 8
or r10d, eax
movzx eax, byte [rdi + 1]
mov r14, rdx
shl eax, 8
lea rdx, [rdi + 5]
xor r13d, r13d
or r10d, eax
movzx eax, byte [rdi + 2]
mov qword [rbp - 0x28], r9
or r10d, eax
movzx eax, byte [rdi + 4]
mov qword [rbp - 0x20], r15
shl eax, 0x10
mov dword [rbp - 0x30], r10d
mov byte [rbp - 0xd], r10b
or r8d, eax
movzx eax, byte [rdx + 1]
or ecx, eax
mov eax, r10d
shr eax, 0x18
or r8d, ecx
mov byte [rbp - 0x10], al
mov eax, r10d
mov dword [rbp - 0x2c], r8d
shr eax, 0x10
mov byte [rbp - 9], r8b
mov byte [rbp - 0xf], al
mov eax, r10d
shr eax, 8
mov byte [rbp - 0xe], al
mov eax, r8d
shr eax, 0x18
mov byte [rbp - 0xc], al
mov eax, r8d
shr eax, 0x10
mov byte [rbp - 0xb], al
mov eax, r8d
shr eax, 8
mov byte [rbp - 0xa], al
test r12d, r12d
je 0x18012c796
mov r15, qword [rbp - 0x28]
sub r14, rsi
movzx edx, r8b
movzx r9d, r10b
nop dword [rax]
dec r12d
test ebx, ebx
jne 0x18012c733
lea rcx, [rbp - 0x30]
mov rdx, r15
call fcn.18012b840
mov r10d, dword [rbp - 0x30]
mov r8d, dword [rbp - 0x2c]
mov eax, r10d
movzx edx, r8b
movzx r9d, r10b
shr eax, 0x18
mov byte [rbp - 0xd], r10b
mov byte [rbp - 9], dl
mov byte [rbp - 0x10], al
mov eax, r10d
shr eax, 0x10
mov byte [rbp - 0xf], al
mov eax, r10d
shr eax, 8
mov byte [rbp - 0xe], al
mov eax, r8d
shr eax, 0x18
mov byte [rbp - 0xc], al
mov eax, r8d
shr eax, 0x10
mov byte [rbp - 0xb], al
mov eax, r8d
shr eax, 8
inc r13d
mov byte [rbp - 0xa], al
movsxd rax, ebx
inc rsi
movzx ecx, byte [rbp + rax - 0x10]
xor cl, byte [rsi - 1]
inc ebx
mov byte [r14 + rsi - 1], cl
and ebx, 7
test r12d, r12d
jne 0x18012c6d0
mov r15, qword [rbp - 0x20]
test r13d, r13d
je 0x18012c796
mov rcx, qword [rbp - 0x18]
mov eax, r10d
shr eax, 0x18
mov byte [rcx], al
mov eax, r10d
shr r10d, 8
shr eax, 0x10
mov byte [rdi], al
mov byte [rdi + 1], r10b
mov byte [rdi + 2], r9b
mov eax, r8d
shr eax, 0x18
mov byte [rdi + 3], al
mov eax, r8d
shr eax, 0x10
shr r8d, 8
mov byte [rdi + 4], al
mov byte [rdi + 5], r8b
mov byte [rdi + 6], dl
mov dword [r15], ebx
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.180183a50
mov rbx, qword [rsp + 0x90]
add rsp, 0x50
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x1801316c0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov rbp, rsp
mov eax, 0x50
call fcn.180188f30
sub rsp, rax
mov rax, qword [0x180237160]
xor rax, rsp
mov qword [rbp - 8], rax
mov rax, qword [rbp + 0x60]
mov r15, qword [rbp + 0x68]
mov rsi, rcx
movzx r10d, byte [rax]
mov ebx, dword [r15]
lea rdi, [rax + 1]
movzx ecx, byte [rdi + 6]
mov qword [rbp - 0x18], rax
movzx eax, byte [rdi]
shl eax, 8
mov r14, rdx
movzx edx, byte [rdi + 3]
or r10d, eax
movzx eax, byte [rdi + 1]
shl ecx, 8
shl eax, 0x10
mov r12d, r8d
lea r8, [rdi + 5]
or r10d, eax
movzx eax, byte [rdi + 2]
xor r13d, r13d
shl eax, 0x18
mov qword [rbp - 0x28], r9
mov qword [rbp - 0x20], r15
or r10d, eax
movzx eax, byte [rdi + 4]
shl eax, 8
mov dword [rbp - 0x30], r10d
mov byte [rbp - 0x10], r10b
or edx, eax
movzx eax, byte [r8]
or ecx, eax
mov eax, r10d
shr eax, 8
shl ecx, 0x10
mov byte [rbp - 0xf], al
or edx, ecx
mov eax, r10d
shr eax, 0x10
mov dword [rbp - 0x2c], edx
mov byte [rbp - 0xc], dl
mov byte [rbp - 0xe], al
mov eax, r10d
shr eax, 0x18
mov byte [rbp - 0xd], al
mov eax, edx
shr eax, 8
mov byte [rbp - 0xb], al
mov eax, edx
shr eax, 0x10
mov byte [rbp - 0xa], al
mov eax, edx
shr eax, 0x18
mov byte [rbp - 9], al
test r12d, r12d
je 0x18013187c
mov r15, qword [rbp - 0x28]
sub r14, rsi
movzx r8d, dl
movzx r9d, r10b
dec r12d
test ebx, ebx
jne 0x180131818
lea r8d, [rbx + 1]
lea rcx, [rbp - 0x30]
mov rdx, r15
call fcn.18012cfd0
mov r10d, dword [rbp - 0x30]
mov edx, dword [rbp - 0x2c]
movzx r9d, byte [rbp - 0x30]
movzx r8d, byte [rbp - 0x2c]
mov eax, r10d
shr eax, 8
mov byte [rbp - 0x10], r9b
mov byte [rbp - 0xc], r8b
mov byte [rbp - 0xf], al
mov eax, r10d
shr eax, 0x10
mov byte [rbp - 0xe], al
mov eax, r10d
shr eax, 0x18
mov byte [rbp - 0xd], al
mov eax, edx
shr eax, 8
mov byte [rbp - 0xb], al
mov eax, edx
shr eax, 0x10
mov byte [rbp - 0xa], al
mov eax, edx
shr eax, 0x18
inc r13d
mov byte [rbp - 9], al
movsxd rax, ebx
inc rsi
movzx ecx, byte [rbp + rax - 0x10]
xor cl, byte [rsi - 1]
inc ebx
mov byte [r14 + rsi - 1], cl
and ebx, 7
test r12d, r12d
jne 0x1801317b2
mov r15, qword [rbp - 0x20]
test r13d, r13d
je 0x18013187c
mov rax, qword [rbp - 0x18]
mov byte [rax], r9b
mov eax, r10d
shr eax, 8
mov byte [rdi], al
mov eax, r10d
shr r10d, 0x18
shr eax, 0x10
mov byte [rdi + 1], al
mov byte [rdi + 2], r10b
mov byte [rdi + 3], r8b
mov eax, edx
shr eax, 8
mov byte [rdi + 4], al
mov eax, edx
shr eax, 0x10
shr edx, 0x18
mov byte [rdi + 5], al
mov byte [rdi + 6], dl
mov dword [r15], ebx
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.180183a50
mov rbx, qword [rsp + 0x90]
add rsp, 0x50
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x1801330e0
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r12
mov eax, 0x20
call fcn.180188f30
sub rsp, rax
mov rbp, r9
mov rdi, r9
mov rbx, r8
shr rbp, 3
mov rsi, rdx
mov r12, rcx
cmp r8, r9
jb 0x1801331a6
nop
xor r8d, r8d
test rbp, rbp
je 0x180133192
nop dword [rax + rax]
movzx eax, byte [rsi + 6]
movzx ecx, byte [rsi + 7]
inc r8
shl rcx, 8
add rsi, 8
or rcx, rax
movzx eax, byte [rsi - 3]
shl rcx, 8
or rcx, rax
movzx eax, byte [rsi - 4]
shl rcx, 8
or rcx, rax
movzx eax, byte [rsi - 5]
shl rcx, 8
or rcx, rax
movzx eax, byte [rsi - 6]
shl rcx, 8
or rcx, rax
movzx eax, byte [rsi - 7]
shl rcx, 8
or rcx, rax
movzx eax, byte [rsi - 8]
shl rcx, 8
or rcx, rax
xor qword [r12 + r8*8 - 8], rcx
cmp r8, rbp
jb 0x180133130
mov rcx, r12
call fcn.180132cb0
sub rbx, rdi
cmp rbx, rdi
jae 0x180133120
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
mov rax, rbx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop r12
ret
Function at 0x18013d5c0
Capabilities:
Hash data using sha512

Disassembly:
push rbx
mov eax, 0x110
call fcn.180188f30
sub rsp, rax
mov rax, qword [0x180237160]
xor rax, rsp
mov qword [rsp + 0x100], rax
test r8, r8
movabs rax, 0x6a09e667f3bcc908
lea rbx, [0x180240fa0]
mov qword [rsp + 0x20], rax
cmovne rbx, r8
movabs rax, 0xbb67ae8584caa73b
mov qword [rsp + 0x28], rax
movabs rax, 0x3c6ef372fe94f82b
mov r8, rdx
mov qword [rsp + 0x30], rax
movabs rax, 0xa54ff53a5f1d36f1
mov rdx, rcx
mov qword [rsp + 0x38], rax
movabs rax, 0x510e527fade682d1
lea rcx, [rsp + 0x20]
mov qword [rsp + 0x40], rax
movabs rax, 0x9b05688c2b3e6c1f
mov dword [rsp + 0xf4], 0x40
mov qword [rsp + 0x48], rax
movabs rax, 0x1f83d9abfb41bd6b
mov qword [rsp + 0x50], rax
movabs rax, 0x5be0cd19137e2179
mov qword [rsp + 0x58], rax
xor eax, eax
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], rax
mov dword [rsp + 0xf0], eax
call fcn.18013d490
lea rdx, [rsp + 0x20]
mov rcx, rbx
call fcn.18013cc50
lea rcx, [rsp + 0x20]
mov edx, 0xd8
call fcn.1800b6ec0
mov rax, rbx
mov rcx, qword [rsp + 0x100]
xor rcx, rsp
call fcn.180183a50
add rsp, 0x110
pop rbx
ret
Function at 0x18013f0e9
Capabilities:
Encode data using xor

Disassembly:
test r8, r8
je 0x18013f2e7
push rbp
mov eax, 0xe0
call fcn.180188f30
sub rsp, rax
mov rax, qword [0x180237160]
xor rax, rsp
mov qword [rsp + 0xb0], rax
mov qword [rsp + 0x100], rbx
mov qword [rsp + 0xd8], rsi
mov qword [rsp + 0xd0], rdi
mov qword [rsp + 0xc8], r12
lea rsi, [r8 - 1]
mov qword [rsp + 0xc0], r13
shr rsi, 3
mov rbp, rdx
lea r12, [rcx + 0xc]
inc rsi
lea r13, [rcx + 0x14]
nop word [rax + rax]
movzx eax, byte [rbp + 1]
movzx ebx, byte [rbp]
movzx edi, byte [rbp + 4]
shl eax, 8
mov rcx, r12
add rbp, 8
or ebx, eax
movzx eax, byte [rbp - 6]
shl eax, 0x10
or ebx, eax
movzx eax, byte [rbp - 5]
shl eax, 0x18
or ebx, eax
movzx eax, byte [rbp - 3]
shl eax, 8
mov dword [rsp + 0x28], ebx
mov dword [rsp + 0x20], ebx
or edi, eax
movzx eax, byte [rbp - 2]
shl eax, 0x10
or edi, eax
movzx eax, byte [rbp - 1]
and byte [r12], 0xdf
and byte [r13], 0xbf
or byte [r12], 0x40
or byte [r13], 0x20
shl eax, 0x18
or edi, eax
mov dword [rsp + 0x2c], edi
mov dword [rsp + 0x24], edi
call fcn.180130d80
lea rdx, [rsp + 0x30]
mov rcx, r12
call fcn.180130de0
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x20]
mov r8d, 1
call fcn.18012cfd0
mov rcx, r13
call fcn.180130d80
lea rdx, [rsp + 0x30]
mov rcx, r13
call fcn.180130de0
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x28]
mov r8d, 1
call fcn.18012cfd0
mov r11d, dword [rsp + 0x28]
mov edx, dword [rsp + 0x2c]
xor r11d, ebx
xor ebx, dword [rsp + 0x20]
xor edx, edi
xor edi, dword [rsp + 0x24]
mov byte [r12], bl
mov eax, ebx
shr eax, 8
mov byte [r12 + 1], al
mov eax, ebx
shr ebx, 0x18
shr eax, 0x10
mov byte [r12 + 2], al
mov byte [r12 + 3], bl
mov byte [r12 + 4], dl
mov eax, edx
shr eax, 8
mov byte [r12 + 5], al
mov eax, edx
shr edx, 0x18
shr eax, 0x10
mov byte [r12 + 6], al
mov byte [r12 + 7], dl
mov byte [r13], r11b
mov eax, r11d
shr eax, 8
mov byte [r13 + 1], al
mov eax, r11d
shr eax, 0x10
shr r11d, 0x18
mov byte [r13 + 2], al
mov byte [r13 + 3], r11b
mov byte [r13 + 4], dil
mov eax, edi
shr eax, 8
mov byte [r13 + 5], al
mov eax, edi
shr edi, 0x18
shr eax, 0x10
dec rsi
mov byte [r13 + 6], al
mov byte [r13 + 7], dil
jne 0x18013f150
mov r13, qword [rsp + 0xc0]
mov r12, qword [rsp + 0xc8]
mov rdi, qword [rsp + 0xd0]
mov rsi, qword [rsp + 0xd8]
mov rbx, qword [rsp + 0x100]
mov rcx, qword [rsp + 0xb0]
xor rcx, rsp
call fcn.180183a50
add rsp, 0xe0
pop rbp
repz ret

Function at 0x18013f430
Capabilities:
Hash data with md5

Disassembly:
push rbx
mov eax, 0x20
call fcn.180188f30
sub rsp, rax
lea r8d, [rax + 0x3c]
xor edx, edx
mov rbx, rcx
call fcn.180189610
mov dword [rbx], 0x67452301
mov dword [rbx + 4], 0xefcdab89
mov dword [rbx + 8], 0x98badcfe
mov dword [rbx + 0xc], 0x10325476
mov eax, 1
add rsp, 0x20
pop rbx
ret
Function at 0x180144d20
Capabilities:
Encode data using xor

Disassembly:
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
push rbx
push rbp
push rsi
push rdi
push r12
push r15
mov eax, 0x68
call fcn.180188f30
sub rsp, rax
mov r12d, dword [rsp + 0xc0]
mov r15, rcx
movsxd rsi, edx
mov ecx, r12d
mov ebx, 1
mov edx, esi
shl ebx, cl
mov rcx, r15
mov ebp, r9d
mov rdi, r8
mov qword [rsp + 0x28], r8
call fcn.1800d3d80
test rax, rax
jne 0x180144d7d
add rsp, 0x68
pop r15
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
mov qword [rsp + 0xb0], rsi
cmp r12d, 3
jg 0x180144df5
xor r10d, r10d
test rsi, rsi
jle 0x180144fac
movsxd r11, ebx
shl r11, 3
nop
xor r9d, r9d
xor edx, edx
test ebx, ebx
jle 0x180144ddd
mov r8, rdi
nop dword [rax]
mov ecx, edx
inc edx
add r8, 8
xor ecx, ebp
lea eax, [rcx - 1]
not ecx
shr ecx, 0x1f
shr eax, 0x1f
and ecx, eax
mov rax, qword [r8 - 8]
neg ecx
and ecx, 1
neg rcx
and rcx, rax
or r9, rcx
cmp edx, ebx
jl 0x180144db0
mov rax, qword [r15]
inc r10
add rdi, r11
mov qword [rax + r10*8 - 8], r9
cmp r10, rsi
jl 0x180144da0
jmp 0x180144fac
lea ecx, [r12 - 2]
mov edx, ebp
mov r8d, 1
sar edx, cl
shl r8d, cl
mov qword [rsp + 0x60], r14
lea ecx, [rdx - 1]
lea eax, [r8 - 1]
xor r14d, r14d
and ebp, eax
shr ecx, 0x1f
mov eax, edx
not eax
movsxd r11, r8d
mov qword [rsp + 0x20], r14
shr eax, 0x1f
and eax, ecx
mov ecx, edx
neg eax
xor ecx, 1
and eax, 1
neg rax
mov qword [rsp + 0x38], rax
lea eax, [rcx - 1]
not ecx
shr ecx, 0x1f
shr eax, 0x1f
and eax, ecx
mov ecx, edx
xor edx, 3
xor ecx, 2
neg eax
and eax, 1
neg rax
mov qword [rsp + 0x40], rax
lea eax, [rcx - 1]
not ecx
shr ecx, 0x1f
shr eax, 0x1f
and eax, ecx
lea ecx, [rdx - 1]
not edx
shr ecx, 0x1f
neg eax
shr edx, 0x1f
and ecx, edx
and eax, 1
neg ecx
neg rax
and ecx, 1
mov qword [rsp + 0x48], rax
neg rcx
mov qword [rsp + 0x30], rcx
test rsi, rsi
jle 0x180144fa7
movsxd rax, ebx
mov qword [rsp + 0xb8], r13
shl rax, 3
mov qword [rsp + 0x50], rax
mov rax, rsi
nop word [rax + rax]
xor esi, esi
xor r10d, r10d
test r11, r11
jle 0x180144f77
mov r15, qword [rsp + 0x38]
mov r14, qword [rsp + 0x40]
mov r9, r11
shl r9, 4
mov rbx, r11
mov r13, r11
add r9, rdi
mov rdi, qword [rsp + 0x48]
neg rbx
neg r13
mov r12, r11
add rbx, rbx
nop dword [rax]
mov rax, qword [r9 + r11*8]
mov r8d, r10d
add r9, 8
and rax, rcx
mov rcx, qword [r9 - 8]
mov rdx, qword [r9 + r13*8 - 8]
and rcx, rdi
xor r8d, ebp
and rdx, r14
or rcx, rax
mov rax, qword [r9 + rbx*8 - 8]
inc r10d
or rdx, rcx
lea ecx, [r8 - 1]
and rax, r15
shr ecx, 0x1f
or rax, rdx
not r8d
shr r8d, 0x1f
and ecx, r8d
neg ecx
and ecx, 1
neg rcx
and rcx, rax
or rsi, rcx
dec r12
mov rcx, qword [rsp + 0x30]
jne 0x180144f00
mov rdi, qword [rsp + 0x28]
mov r14, qword [rsp + 0x20]
mov r15, qword [rsp + 0xa0]
mov rax, qword [rsp + 0xb0]
mov rcx, qword [r15]
add rdi, qword [rsp + 0x50]
inc r14
mov qword [rcx + r14*8 - 8], rsi
mov rcx, qword [rsp + 0x30]
mov qword [rsp + 0x20], r14
mov qword [rsp + 0x28], rdi
cmp r14, rax
jl 0x180144ec0
mov r13, qword [rsp + 0xb8]
mov r14, qword [rsp + 0x60]
mov ecx, dword [rsp + 0xa8]
mov eax, 1
mov dword [r15 + 8], ecx
add rsp, 0x68
pop r15
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x18014ec60
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
mov eax, 0x20
call fcn.180188f30
sub rsp, rax
movsxd rsi, r8d
mov rdi, rdx
mov rbp, rcx
mov r8, rsi
call fcn.180189e30
test eax, eax
jle case.0x18014ed49.2
xor r8d, r8d
test esi, esi
jle 0x18014ecc7
mov rdx, rbp
mov r9, rdi
mov rcx, rdi
sub rdx, rdi
neg r9
nop dword [rax]
movzx eax, byte [rcx]
cmp byte [rdx + rcx], al
jne 0x18014ecc7
inc rcx
inc r8d
lea rax, [r9 + rcx]
cmp rax, rsi
jl 0x18014ecb0
lea edx, [rsi - 1]
movsxd rcx, edx
test edx, edx
js 0x18014ecf6
mov r9, rbp
lea rax, [rcx + rdi]
sub r9, rdi
nop dword [rax + rax]
cmp byte [rax + r9], 0
jne 0x18014ecf6
cmp byte [rax], 0xff
jne 0x18014ecf6
dec edx
dec rax
dec rcx
jns 0x18014ece0
cmp r8d, edx
jl case.0x18014ed49.2
jle 0x18014ed0e
lea eax, [r8*8]
jmp 0x18014ed90
movsxd rax, r8d
movzx r9d, byte [rax + rdi]
movzx r10d, byte [rax + rbp]
movzx edx, r9b
xor dl, r10b
movzx eax, dl
dec eax
cmp eax, 0x7e
ja case.0x18014ed49.2
lea r11, [0x180000000]
cdqe
movzx eax, byte [r11 + rax + 0x14edc8]
mov ecx, dword [r11 + rax*4 + 0x14eda8]
add rcx, r11
jmp rcx
mov eax, 7
jmp 0x18014ed7a
mov eax, 6
jmp 0x18014ed7a
mov eax, 5
jmp 0x18014ed7a
mov eax, 4
jmp 0x18014ed7a
mov eax, 3
jmp 0x18014ed7a
mov eax, 2
jmp 0x18014ed7a
mov eax, 1
test dl, r10b
jne case.0x18014ed49.2
and r9b, dl
cmp r9b, dl
jne case.0x18014ed49.2
lea eax, [rax + r8*8]
jmp 0x18014ed90
or eax, 0xffffffff
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret