joyce8/EMBER2024-capa huggingface dataset:
Function at 0x18000803f
Capabilities:
Encrypt data using rc4 prga

Disassembly:
jmp 0x1800263e0
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rsi
push rdi
sub rsp, 0x108
cmp qword [0x180641050], 0
jne 0x180026515
lea rax, [rsp + 0xb0]
lea rcx, [0x1802897a0]
mov rdi, rax
mov rsi, rcx
mov ecx, 0x4e
rep movsb byte [rdi], byte [rsi]
mov eax, 2
imul rax, rax, 0x26
movzx eax, word [rsp + rax + 0xb0]
test eax, eax
je 0x180026446
mov dword [rsp + 0x2c], 1
jmp 0x18002644e
mov dword [rsp + 0x2c], 0
movzx eax, byte [rsp + 0x2c]
mov byte [rsp + 0x20], al
movzx eax, byte [rsp + 0x20]
movzx eax, al
test eax, eax
je 0x1800264b7
mov dword [rsp + 0x24], 0
jmp 0x180026477
mov eax, dword [rsp + 0x24]
inc eax
mov dword [rsp + 0x24], eax
cmp dword [rsp + 0x24], 0x27
jge 0x1800264b7
movsxd rax, dword [rsp + 0x24]
movzx eax, word [rsp + rax*2 + 0xb0]
mov dword [rsp + 0x30], eax
mov eax, dword [rsp + 0x24]
cdq
mov ecx, 3
idiv ecx
mov eax, edx
add eax, 0xa
mov ecx, dword [rsp + 0x30]
xor ecx, eax
mov eax, ecx
movsxd rcx, dword [rsp + 0x24]
mov word [rsp + rcx*2 + 0xb0], ax
jmp 0x18002646d
lea rax, [rsp + 0xb0]
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
xor r9d, r9d
mov r8, rax
xor edx, edx
xor ecx, ecx
call fcn.180002662
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x48]
mov qword [0x180641050], rax
mov dword [rsp + 0x28], 0
jmp 0x1800264fd
mov eax, dword [rsp + 0x28]
inc eax
mov dword [rsp + 0x28], eax
cmp dword [rsp + 0x28], 0x27
jge 0x180026515
movsxd rax, dword [rsp + 0x28]
xor ecx, ecx
mov word [rsp + rax*2 + 0xb0], cx
jmp 0x1800264f3
lea rax, [rsp + 0x60]
mov rdi, rax
mov rsi, qword [rsp + 0x130]
mov ecx, 0x10
rep movsb byte [rdi], byte [rsi]
lea rax, [rsp + 0x70]
mov rdi, rax
mov rsi, qword [rsp + 0x138]
mov ecx, 0x10
rep movsb byte [rdi], byte [rsi]
movsd xmm0, qword [rsp + 0x140]
movsd qword [rsp + 0x80], xmm0
lea rax, [rsp + 0x88]
mov rdi, rax
mov rsi, qword [rsp + 0x148]
mov ecx, 0x10
rep movsb byte [rdi], byte [rsi]
mov qword [rsp + 0x98], 0
mov dword [rsp + 0xa4], 0
mov dword [rsp + 0xa0], 0
mov rax, qword [0x180641050]
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x120]
mov rax, qword [rax]
mov qword [rsp + 0x38], rax
cmp qword [rsp + 0x38], 0
je 0x1800265e3
mov eax, 8
imul rax, rax, 0x4f
mov rcx, qword [rsp + 0x38]
mov rax, qword [rcx + rax]
mov qword [rsp + 0x58], rax
lea r8, [rsp + 0x60]
mov rdx, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x120]
call qword [rsp + 0x58]
nop
lea rax, [rsp + 0x98]
mov rdi, qword [rsp + 0x128]
mov rsi, rax
mov ecx, 0x10
rep movsb byte [rdi], byte [rsi]
mov rax, qword [rsp + 0x128]
add rsp, 0x108
pop rdi
pop rsi
ret
Function at 0x1800081d9
Capabilities:
Encrypt data using rc4 prga

Disassembly:
jmp 0x1800647b0
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rsi
push rdi
sub rsp, 0xd8
cmp qword [0x1806406e0], 0
jne 0x1800648d3
lea rax, [rsp + 0x60]
lea rcx, [0x1802866e8]
mov rdi, rax
mov rsi, rcx
mov ecx, 0x2c
rep movsb byte [rdi], byte [rsi]
mov eax, 2
imul rax, rax, 0x15
movzx eax, word [rsp + rax + 0x60]
test eax, eax
je 0x180064810
mov dword [rsp + 0x2c], 1
jmp 0x180064818
mov dword [rsp + 0x2c], 0
movzx eax, byte [rsp + 0x2c]
mov byte [rsp + 0x20], al
movzx eax, byte [rsp + 0x20]
movzx eax, al
test eax, eax
je 0x18006487b
mov dword [rsp + 0x24], 0
jmp 0x180064841
mov eax, dword [rsp + 0x24]
inc eax
mov dword [rsp + 0x24], eax
cmp dword [rsp + 0x24], 0x16
jge 0x18006487b
movsxd rax, dword [rsp + 0x24]
movzx eax, word [rsp + rax*2 + 0x60]
mov dword [rsp + 0x30], eax
mov eax, dword [rsp + 0x24]
cdq
mov ecx, 3
idiv ecx
mov eax, edx
add eax, 0xa
mov ecx, dword [rsp + 0x30]
xor ecx, eax
mov eax, ecx
movsxd rcx, dword [rsp + 0x24]
mov word [rsp + rcx*2 + 0x60], ax
jmp 0x180064837
lea rax, [rsp + 0x60]
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
xor r9d, r9d
mov r8, rax
xor edx, edx
xor ecx, ecx
call fcn.180002662
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x48]
mov qword [0x1806406e0], rax
mov dword [rsp + 0x28], 0
jmp 0x1800648be
mov eax, dword [rsp + 0x28]
inc eax
mov dword [rsp + 0x28], eax
cmp dword [rsp + 0x28], 0x16
jge 0x1800648d3
movsxd rax, dword [rsp + 0x28]
xor ecx, ecx
mov word [rsp + rax*2 + 0x60], cx
jmp 0x1800648b4
mov rax, qword [rsp + 0xf8]
mov qword [rsp + 0x90], rax
lea rax, [rsp + 0x98]
mov rdi, rax
mov rsi, qword [rsp + 0x100]
mov ecx, 0x10
rep movsb byte [rdi], byte [rsi]
lea rax, [rsp + 0xa8]
mov rdi, rax
mov rsi, qword [rsp + 0x108]
mov ecx, 0x10
rep movsb byte [rdi], byte [rsi]
mov eax, dword [rsp + 0x110]
mov dword [rsp + 0xb8], eax
lea rax, [rsp + 0xbc]
mov rdi, rax
mov rsi, qword [rsp + 0x118]
mov ecx, 0x10
rep movsb byte [rdi], byte [rsi]
mov rax, qword [0x1806406e0]
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0xf0]
mov rax, qword [rax]
mov qword [rsp + 0x38], rax
cmp qword [rsp + 0x38], 0
je 0x180064994
mov eax, 8
imul rax, rax, 0x4f
mov rcx, qword [rsp + 0x38]
mov rax, qword [rcx + rax]
mov qword [rsp + 0x58], rax
lea r8, [rsp + 0x90]
mov rdx, qword [rsp + 0x50]
mov rcx, qword [rsp + 0xf0]
call qword [rsp + 0x58]
nop
add rsp, 0xd8
pop rdi
pop rsi
ret
Function at 0x1800081de
Capabilities:
Resolve function by parsing pe exports

Disassembly:
jmp 0x1801080a0
mov byte [rsp + 0x20], r9b
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rsi
push rdi
sub rsp, 0x68
movss xmm0, dword [rsp + 0x88]
movss dword [rsp + 0x38], xmm0
movss xmm0, dword [rsp + 0x8c]
movss dword [rsp + 0x3c], xmm0
movss xmm0, dword [rsp + 0x90]
movss dword [rsp + 0x40], xmm0
movss xmm0, dword [rsp + 0x94]
movss dword [rsp + 0x44], xmm0
movzx eax, byte [rsp + 0x98]
test eax, eax
je 0x1801081ae
mov rax, qword [rsp + 0x80]
cmp dword [rax + 0x60], 0
je 0x1801081ae
mov rax, qword [rsp + 0x80]
mov eax, dword [rax + 0x60]
dec eax
cdqe
imul rax, rax, 0x10
mov rcx, qword [rsp + 0x80]
mov rcx, qword [rcx + 0x68]
lea rdx, [rsp + 0x48]
mov rdi, rdx
lea rsi, [rcx + rax]
mov ecx, 0x10
rep movsb byte [rdi], byte [rsi]
movss xmm0, dword [rsp + 0x48]
comiss xmm0, dword [rsp + 0x38]
jbe 0x180108163
movss xmm0, dword [rsp + 0x48]
movss dword [rsp + 0x38], xmm0
movss xmm0, dword [rsp + 0x4c]
comiss xmm0, dword [rsp + 0x3c]
jbe 0x18010817c
movss xmm0, dword [rsp + 0x4c]
movss dword [rsp + 0x3c], xmm0
movss xmm0, dword [rsp + 0x40]
comiss xmm0, dword [rsp + 0x50]
jbe 0x180108195
movss xmm0, dword [rsp + 0x50]
movss dword [rsp + 0x40], xmm0
movss xmm0, dword [rsp + 0x44]
comiss xmm0, dword [rsp + 0x54]
jbe 0x1801081ae
movss xmm0, dword [rsp + 0x54]
movss dword [rsp + 0x44], xmm0
movss xmm0, dword [rsp + 0x38]
comiss xmm0, dword [rsp + 0x40]
jb 0x1801081c9
movss xmm0, dword [rsp + 0x38]
movss dword [rsp + 0x20], xmm0
jmp 0x1801081d5
movss xmm0, dword [rsp + 0x40]
movss dword [rsp + 0x20], xmm0
movss xmm0, dword [rsp + 0x20]
movss dword [rsp + 0x28], xmm0
movss xmm0, dword [rsp + 0x28]
movss dword [rsp + 0x40], xmm0
movss xmm0, dword [rsp + 0x3c]
comiss xmm0, dword [rsp + 0x44]
jb 0x180108208
movss xmm0, dword [rsp + 0x3c]
movss dword [rsp + 0x24], xmm0
jmp 0x180108214
movss xmm0, dword [rsp + 0x44]
movss dword [rsp + 0x24], xmm0
movss xmm0, dword [rsp + 0x24]
movss dword [rsp + 0x2c], xmm0
movss xmm0, dword [rsp + 0x2c]
movss dword [rsp + 0x44], xmm0
mov rax, qword [rsp + 0x80]
add rax, 0x60
mov qword [rsp + 0x30], rax
lea rdx, [rsp + 0x38]
mov rcx, qword [rsp + 0x30]
call fcn.180002d47
mov rcx, qword [rsp + 0x80]
call fcn.18000270c
nop
add rsp, 0x68
pop rdi
pop rsi
ret
Function at 0x1800081e3
Capabilities:
Parse pe header

Disassembly:
jmp 0x18023e930
mov dword [rsp + 0x18], r8d
mov dword [rsp + 0x10], edx
push rbp
mov rbp, rsp
sub rsp, 0x50
mov qword [rbp - 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x60], rbx
mov ebx, ecx
test r8d, r8d
jne 0x18023e70b
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x18023e70b
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x18023e70b
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x18023e70b
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x18023e70b
cmp dword [rcx + 0x84], 0xe
jbe 0x18023e70b
cmp dword [rcx + 0xf8], 0
je 0x18023e70b
mov ecx, ebx
call fcn.18023e874
mov byte [rbp + 0x28], 0
lea rax, [rbp + 0x18]
mov qword [rbp - 0x18], rax
lea rax, [rbp + 0x20]
mov qword [rbp - 0x10], rax
lea rax, [rbp + 0x28]
mov qword [rbp - 8], rax
mov eax, 2
mov dword [rbp - 0x2c], eax
mov dword [rbp - 0x28], eax
lea r9, [rbp - 0x2c]
lea r8, [rbp - 0x18]
lea rdx, [rbp - 0x28]
lea rcx, [rbp - 0x30]
call fcn.18023e3fc
nop
cmp dword [rbp + 0x20], 0
je 0x18023e759
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rbp
ret
mov ecx, ebx
call fcn.18023e794
int3
xor edx, edx
xor ecx, ecx
lea r8d, [rdx + 1]
jmp 0x18023e69c

Function at 0x1800082fb
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
jmp 0x18019e2cc
jmp 0x1801bb0c8
lea r9, [rdx + rdx]
movabs r8, 0xcbf29ce484222325
xor edx, edx
test r9, r9
je 0x18019e2fe
movzx eax, byte [rcx + rdx]
movabs r10, 0x100000001b3
xor r8, rax
inc rdx
imul r8, r10
cmp rdx, r9
jb 0x18019e2e1
mov rax, r8
ret
sub r8, rdx
mov rcx, rdx
sar r8, 1
mov rdx, r8
jmp 0x1800058c1
Function at 0x1800083e1
Capabilities:
Encrypt data using rc4 prga

Disassembly:
jmp 0x180059d90
mov qword [rsp + 8], rcx
push rsi
push rdi
sub rsp, 0xc8
cmp qword [0x180640a40], 0
jne 0x180059ea4
lea rax, [rsp + 0x60]
lea rcx, [0x1802872e0]
mov rdi, rax
mov rsi, rcx
mov ecx, 0x56
rep movsb byte [rdi], byte [rsi]
mov eax, 2
imul rax, rax, 0x2a
movzx eax, word [rsp + rax + 0x60]
test eax, eax
je 0x180059de1
mov dword [rsp + 0x2c], 1
jmp 0x180059de9
mov dword [rsp + 0x2c], 0
movzx eax, byte [rsp + 0x2c]
mov byte [rsp + 0x20], al
movzx eax, byte [rsp + 0x20]
movzx eax, al
test eax, eax
je 0x180059e4c
mov dword [rsp + 0x24], 0
jmp 0x180059e12
mov eax, dword [rsp + 0x24]
inc eax
mov dword [rsp + 0x24], eax
cmp dword [rsp + 0x24], 0x2b
jge 0x180059e4c
movsxd rax, dword [rsp + 0x24]
movzx eax, word [rsp + rax*2 + 0x60]
mov dword [rsp + 0x34], eax
mov eax, dword [rsp + 0x24]
cdq
mov ecx, 3
idiv ecx
mov eax, edx
add eax, 0xa
mov ecx, dword [rsp + 0x34]
xor ecx, eax
mov eax, ecx
movsxd rcx, dword [rsp + 0x24]
mov word [rsp + rcx*2 + 0x60], ax
jmp 0x180059e08
lea rax, [rsp + 0x60]
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
xor r9d, r9d
mov r8, rax
xor edx, edx
xor ecx, ecx
call fcn.180002662
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x48]
mov qword [0x180640a40], rax
mov dword [rsp + 0x28], 0
jmp 0x180059e8f
mov eax, dword [rsp + 0x28]
inc eax
mov dword [rsp + 0x28], eax
cmp dword [rsp + 0x28], 0x2b
jge 0x180059ea4
movsxd rax, dword [rsp + 0x28]
xor ecx, ecx
mov word [rsp + rax*2 + 0x60], cx
jmp 0x180059e85
lea rax, [rsp + 0x30]
mov rdi, rax
xor eax, eax
mov ecx, 4
rep stosb byte [rdi], al
mov rax, qword [0x180640a40]
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0xe0]
mov rax, qword [rax]
mov qword [rsp + 0x38], rax
cmp qword [rsp + 0x38], 0
je 0x180059f07
mov eax, 8
imul rax, rax, 0x4f
mov rcx, qword [rsp + 0x38]
mov rax, qword [rcx + rax]
mov qword [rsp + 0x58], rax
lea r8, [rsp + 0x30]
mov rdx, qword [rsp + 0x50]
mov rcx, qword [rsp + 0xe0]
call qword [rsp + 0x58]
nop
movss xmm0, dword [rsp + 0x30]
add rsp, 0xc8
pop rdi
pop rsi
ret
Function at 0x1800087ec
Capabilities:
Encrypt data using rc4 prga

Disassembly:
jmp 0x180059570
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rsi
push rdi
sub rsp, 0xf8
cmp qword [0x180640fc0], 0
jne 0x1800596a5
lea rax, [rsp + 0xa0]
lea rcx, [0x180289460]
mov rdi, rax
mov rsi, rcx
mov ecx, 0x4e
rep movsb byte [rdi], byte [rsi]
mov eax, 2
imul rax, rax, 0x26
movzx eax, word [rsp + rax + 0xa0]
test eax, eax
je 0x1800595d6
mov dword [rsp + 0x2c], 1
jmp 0x1800595de
mov dword [rsp + 0x2c], 0
movzx eax, byte [rsp + 0x2c]
mov byte [rsp + 0x20], al
movzx eax, byte [rsp + 0x20]
movzx eax, al
test eax, eax
je 0x180059647
mov dword [rsp + 0x24], 0
jmp 0x180059607
mov eax, dword [rsp + 0x24]
inc eax
mov dword [rsp + 0x24], eax
cmp dword [rsp + 0x24], 0x27
jge 0x180059647
movsxd rax, dword [rsp + 0x24]
movzx eax, word [rsp + rax*2 + 0xa0]
mov dword [rsp + 0x30], eax
mov eax, dword [rsp + 0x24]
cdq
mov ecx, 3
idiv ecx
mov eax, edx
add eax, 0xa
mov ecx, dword [rsp + 0x30]
xor ecx, eax
mov eax, ecx
movsxd rcx, dword [rsp + 0x24]
mov word [rsp + rcx*2 + 0xa0], ax
jmp 0x1800595fd
lea rax, [rsp + 0xa0]
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
xor r9d, r9d
mov r8, rax
xor edx, edx
xor ecx, ecx
call fcn.180002662
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x48]
mov qword [0x180640fc0], rax
mov dword [rsp + 0x28], 0
jmp 0x18005968d
mov eax, dword [rsp + 0x28]
inc eax
mov dword [rsp + 0x28], eax
cmp dword [rsp + 0x28], 0x27
jge 0x1800596a5
movsxd rax, dword [rsp + 0x28]
xor ecx, ecx
mov word [rsp + rax*2 + 0xa0], cx
jmp 0x180059683
lea rcx, [rsp + 0x60]
call fcn.180003418
mov rax, qword [rsp + 0x118]
mov qword [rsp + 0x60], rax
mov rax, qword [0x180640fc0]
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x110]
mov rax, qword [rax]
mov qword [rsp + 0x38], rax
cmp qword [rsp + 0x38], 0
je 0x18005970e
mov eax, 8
imul rax, rax, 0x4f
mov rcx, qword [rsp + 0x38]
mov rax, qword [rcx + rax]
mov qword [rsp + 0x58], rax
lea r8, [rsp + 0x60]
mov rdx, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x110]
call qword [rsp + 0x58]
nop
cmp qword [rsp + 0x120], 0
je 0x180059751
mov rax, qword [rsp + 0x120]
movsd xmm0, qword [rsp + 0x68]
movsd qword [rax], xmm0
mov rax, qword [rsp + 0x120]
movsd xmm0, qword [rsp + 0x70]
movsd qword [rax + 8], xmm0
mov rax, qword [rsp + 0x120]
movsd xmm0, qword [rsp + 0x78]
movsd qword [rax + 0x10], xmm0
cmp qword [rsp + 0x128], 0
je 0x18005979d
mov rax, qword [rsp + 0x128]
movsd xmm0, qword [rsp + 0x80]
movsd qword [rax], xmm0
mov rax, qword [rsp + 0x128]
movsd xmm0, qword [rsp + 0x88]
movsd qword [rax + 8], xmm0
mov rax, qword [rsp + 0x128]
movsd xmm0, qword [rsp + 0x90]
movsd qword [rax + 0x10], xmm0
cmp qword [rsp + 0x130], 0
je 0x1800597bd
mov rax, qword [rsp + 0x130]
movss xmm0, dword [rsp + 0x98]
movss dword [rax], xmm0
add rsp, 0xf8
pop rdi
pop rsi
ret
Function at 0x180008891
Capabilities:
Encrypt data using rc4 prga

Disassembly:
jmp 0x180070700
movss dword [rsp + 0x10], xmm1
mov qword [rsp + 8], rcx
push rsi
push rdi
sub rsp, 0x98
cmp qword [0x180640cf0], 0
jne 0x18007081a
lea rax, [rsp + 0x60]
lea rcx, str.HefoedlMi
mov rdi, rax
mov rsi, rcx
mov ecx, 0x30
rep movsb byte [rdi], byte [rsi]
mov eax, 2
imul rax, rax, 0x17
movzx eax, word [rsp + rax + 0x60]
test eax, eax
je 0x180070757
mov dword [rsp + 0x2c], 1
jmp 0x18007075f
mov dword [rsp + 0x2c], 0
movzx eax, byte [rsp + 0x2c]
mov byte [rsp + 0x20], al
movzx eax, byte [rsp + 0x20]
movzx eax, al
test eax, eax
je 0x1800707c2
mov dword [rsp + 0x24], 0
jmp 0x180070788
mov eax, dword [rsp + 0x24]
inc eax
mov dword [rsp + 0x24], eax
cmp dword [rsp + 0x24], 0x18
jge 0x1800707c2
movsxd rax, dword [rsp + 0x24]
movzx eax, word [rsp + rax*2 + 0x60]
mov dword [rsp + 0x30], eax
mov eax, dword [rsp + 0x24]
cdq
mov ecx, 3
idiv ecx
mov eax, edx
add eax, 0xa
mov ecx, dword [rsp + 0x30]
xor ecx, eax
mov eax, ecx
movsxd rcx, dword [rsp + 0x24]
mov word [rsp + rcx*2 + 0x60], ax
jmp 0x18007077e
lea rax, [rsp + 0x60]
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
xor r9d, r9d
mov r8, rax
xor edx, edx
xor ecx, ecx
call fcn.180002662
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x48]
mov qword [0x180640cf0], rax
mov dword [rsp + 0x28], 0
jmp 0x180070805
mov eax, dword [rsp + 0x28]
inc eax
mov dword [rsp + 0x28], eax
cmp dword [rsp + 0x28], 0x18
jge 0x18007081a
movsxd rax, dword [rsp + 0x28]
xor ecx, ecx
mov word [rsp + rax*2 + 0x60], cx
jmp 0x1800707fb
movss xmm0, dword [rsp + 0xb8]
movss dword [rsp + 0x34], xmm0
mov rax, qword [0x180640cf0]
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0xb0]
mov rax, qword [rax]
mov qword [rsp + 0x38], rax
cmp qword [rsp + 0x38], 0
je 0x18007087b
mov eax, 8
imul rax, rax, 0x4f
mov rcx, qword [rsp + 0x38]
mov rax, qword [rcx + rax]
mov qword [rsp + 0x58], rax
lea r8, [rsp + 0x34]
mov rdx, qword [rsp + 0x50]
mov rcx, qword [rsp + 0xb0]
call qword [rsp + 0x58]
nop
add rsp, 0x98
pop rdi
pop rsi
ret
Function at 0x18000898b
Capabilities:
Encrypt data using rc4 prga

Disassembly:
jmp 0x1800798e0
movss dword [rsp + 0x18], xmm2
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rsi
push rdi
sub rsp, 0xd8
cmp qword [0x180641000], 0
jne 0x180079a11
lea rax, [rsp + 0x80]
lea rcx, [0x1802895d0]
mov rdi, rax
mov rsi, rcx
mov ecx, 0x50
rep movsb byte [rdi], byte [rsi]
mov eax, 2
imul rax, rax, 0x27
movzx eax, word [rsp + rax + 0x80]
test eax, eax
je 0x180079942
mov dword [rsp + 0x2c], 1
jmp 0x18007994a
mov dword [rsp + 0x2c], 0
movzx eax, byte [rsp + 0x2c]
mov byte [rsp + 0x20], al
movzx eax, byte [rsp + 0x20]
movzx eax, al
test eax, eax
je 0x1800799b3
mov dword [rsp + 0x24], 0
jmp 0x180079973
mov eax, dword [rsp + 0x24]
inc eax
mov dword [rsp + 0x24], eax
cmp dword [rsp + 0x24], 0x28
jge 0x1800799b3
movsxd rax, dword [rsp + 0x24]
movzx eax, word [rsp + rax*2 + 0x80]
mov dword [rsp + 0x30], eax
mov eax, dword [rsp + 0x24]
cdq
mov ecx, 3
idiv ecx
mov eax, edx
add eax, 0xa
mov ecx, dword [rsp + 0x30]
xor ecx, eax
mov eax, ecx
movsxd rcx, dword [rsp + 0x24]
mov word [rsp + rcx*2 + 0x80], ax
jmp 0x180079969
lea rax, [rsp + 0x80]
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
xor r9d, r9d
mov r8, rax
xor edx, edx
xor ecx, ecx
call fcn.180002662
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x48]
mov qword [0x180641000], rax
mov dword [rsp + 0x28], 0
jmp 0x1800799f9
mov eax, dword [rsp + 0x28]
inc eax
mov dword [rsp + 0x28], eax
cmp dword [rsp + 0x28], 0x28
jge 0x180079a11
movsxd rax, dword [rsp + 0x28]
xor ecx, ecx
mov word [rsp + rax*2 + 0x80], cx
jmp 0x1800799ef
movss xmm0, dword [rsp + 0x100]
movss dword [rsp + 0x60], xmm0
mov qword [rsp + 0x68], 0
mov dword [rsp + 0x74], 0
mov dword [rsp + 0x70], 0
mov rax, qword [0x180641000]
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0xf0]
mov rax, qword [rax]
mov qword [rsp + 0x38], rax
cmp qword [rsp + 0x38], 0
je 0x180079a8b
mov eax, 8
imul rax, rax, 0x4f
mov rcx, qword [rsp + 0x38]
mov rax, qword [rcx + rax]
mov qword [rsp + 0x58], rax
lea r8, [rsp + 0x60]
mov rdx, qword [rsp + 0x50]
mov rcx, qword [rsp + 0xf0]
call qword [rsp + 0x58]
nop
lea rax, [rsp + 0x68]
mov rdi, qword [rsp + 0xf8]
mov rsi, rax
mov ecx, 0x10
rep movsb byte [rdi], byte [rsi]
mov rax, qword [rsp + 0xf8]
add rsp, 0xd8
pop rdi
pop rsi
ret
Function at 0x180008b3e
Capabilities:
Encrypt data using rc4 prga

Disassembly:
jmp 0x180028560
mov qword [rsp + 8], rcx
push rsi
push rdi
sub rsp, 0x98
cmp qword [0x180640b90], 0
jne 0x180028674
lea rax, [rsp + 0x60]
lea rcx, str.Icmxjon_HmdAyg_f
mov rdi, rax
mov rsi, rcx
mov ecx, 0x24
rep movsb byte [rdi], byte [rsi]
mov eax, 2
imul rax, rax, 0x11
movzx eax, word [rsp + rax + 0x60]
test eax, eax
je 0x1800285b1
mov dword [rsp + 0x2c], 1
jmp 0x1800285b9
mov dword [rsp + 0x2c], 0
movzx eax, byte [rsp + 0x2c]
mov byte [rsp + 0x21], al
movzx eax, byte [rsp + 0x21]
movzx eax, al
test eax, eax
je 0x18002861c
mov dword [rsp + 0x24], 0
jmp 0x1800285e2
mov eax, dword [rsp + 0x24]
inc eax
mov dword [rsp + 0x24], eax
cmp dword [rsp + 0x24], 0x12
jge 0x18002861c
movsxd rax, dword [rsp + 0x24]
movzx eax, word [rsp + rax*2 + 0x60]
mov dword [rsp + 0x30], eax
mov eax, dword [rsp + 0x24]
cdq
mov ecx, 3
idiv ecx
mov eax, edx
add eax, 0xa
mov ecx, dword [rsp + 0x30]
xor ecx, eax
mov eax, ecx
movsxd rcx, dword [rsp + 0x24]
mov word [rsp + rcx*2 + 0x60], ax
jmp 0x1800285d8
lea rax, [rsp + 0x60]
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
xor r9d, r9d
mov r8, rax
xor edx, edx
xor ecx, ecx
call fcn.180002662
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x48]
mov qword [0x180640b90], rax
mov dword [rsp + 0x28], 0
jmp 0x18002865f
mov eax, dword [rsp + 0x28]
inc eax
mov dword [rsp + 0x28], eax
cmp dword [rsp + 0x28], 0x12
jge 0x180028674
movsxd rax, dword [rsp + 0x28]
xor ecx, ecx
mov word [rsp + rax*2 + 0x60], cx
jmp 0x180028655
lea rax, [rsp + 0x20]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
mov rax, qword [0x180640b90]
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0xb0]
mov rax, qword [rax]
mov qword [rsp + 0x38], rax
cmp qword [rsp + 0x38], 0
je 0x1800286d7
mov eax, 8
imul rax, rax, 0x4f
mov rcx, qword [rsp + 0x38]
mov rax, qword [rcx + rax]
mov qword [rsp + 0x58], rax
lea r8, [rsp + 0x20]
mov rdx, qword [rsp + 0x50]
mov rcx, qword [rsp + 0xb0]
call qword [rsp + 0x58]
nop
movzx eax, byte [rsp + 0x20]
add rsp, 0x98
pop rdi
pop rsi
ret
Function at 0x180008cdd
Capabilities:
Encrypt data using rc4 prga

Disassembly:
jmp 0x18005df80
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rsi
push rdi
sub rsp, 0xc8
cmp qword [0x180640fa0], 0
jne 0x18005e099
lea rax, [rsp + 0x70]
lea rcx, [0x180289390]
mov rdi, rax
mov rsi, rcx
mov ecx, 0x50
rep movsb byte [rdi], byte [rsi]
mov eax, 2
imul rax, rax, 0x27
movzx eax, word [rsp + rax + 0x70]
test eax, eax
je 0x18005dfd6
mov dword [rsp + 0x2c], 1
jmp 0x18005dfde
mov dword [rsp + 0x2c], 0
movzx eax, byte [rsp + 0x2c]
mov byte [rsp + 0x20], al
movzx eax, byte [rsp + 0x20]
movzx eax, al
test eax, eax
je 0x18005e041
mov dword [rsp + 0x24], 0
jmp 0x18005e007
mov eax, dword [rsp + 0x24]
inc eax
mov dword [rsp + 0x24], eax
cmp dword [rsp + 0x24], 0x28
jge 0x18005e041
movsxd rax, dword [rsp + 0x24]
movzx eax, word [rsp + rax*2 + 0x70]
mov dword [rsp + 0x30], eax
mov eax, dword [rsp + 0x24]
cdq
mov ecx, 3
idiv ecx
mov eax, edx
add eax, 0xa
mov ecx, dword [rsp + 0x30]
xor ecx, eax
mov eax, ecx
movsxd rcx, dword [rsp + 0x24]
mov word [rsp + rcx*2 + 0x70], ax
jmp 0x18005dffd
lea rax, [rsp + 0x70]
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x50]
xor r9d, r9d
mov r8, rax
xor edx, edx
xor ecx, ecx
call fcn.180002662
mov qword [rsp + 0x58], rax
mov rax, qword [rsp + 0x58]
mov qword [0x180640fa0], rax
mov dword [rsp + 0x28], 0
jmp 0x18005e084
mov eax, dword [rsp + 0x28]
inc eax
mov dword [rsp + 0x28], eax
cmp dword [rsp + 0x28], 0x28
jge 0x18005e099
movsxd rax, dword [rsp + 0x28]
xor ecx, ecx
mov word [rsp + rax*2 + 0x70], cx
jmp 0x18005e07a
mov qword [rsp + 0x40], 0
mov dword [rsp + 0x4c], 0
mov dword [rsp + 0x48], 0
mov rax, qword [0x180640fa0]
mov qword [rsp + 0x60], rax
mov rax, qword [rsp + 0xe0]
mov rax, qword [rax]
mov qword [rsp + 0x38], rax
cmp qword [rsp + 0x38], 0
je 0x18005e104
mov eax, 8
imul rax, rax, 0x4f
mov rcx, qword [rsp + 0x38]
mov rax, qword [rcx + rax]
mov qword [rsp + 0x68], rax
lea r8, [rsp + 0x40]
mov rdx, qword [rsp + 0x60]
mov rcx, qword [rsp + 0xe0]
call qword [rsp + 0x68]
nop
lea rax, [rsp + 0x40]
mov rdi, qword [rsp + 0xe8]
mov rsi, rax
mov ecx, 0x10
rep movsb byte [rdi], byte [rsi]
mov rax, qword [rsp + 0xe8]
add rsp, 0xc8
pop rdi
pop rsi
ret