joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1800809b0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x20], rbp
push rsi
push rdi
mov rax, qword [rcx]
mov rsi, rcx
mov r9d, edx
movsxd rcx, dword [rax + 0x10]
sub r9d, dword [rsi + 0x14]
mov ebp, r8d
mov eax, ecx
imul eax, edx
movsxd rdi, eax
add rdi, qword [rsi + 0x20]
cmp dword [rsi + 0x10], 0xfe
jge 0x180080afb
mov qword [rsp + 0x20], rbx
mov qword [rsp + 0x28], r14
mov r14, rcx
mov rcx, qword [rsi + 8]
mov r10d, dword [rdi]
mov eax, r9d
cdq
mov r8d, 0x100
dec ebp
inc r9d
idiv dword [rcx + 0x14]
mov eax, dword [rcx + 0x10]
imul eax, edx
mov edx, 0x100
movsxd rcx, eax
add rcx, qword [rsi + 0x28]
movzx ebx, byte [rcx + 1]
movzx r11d, byte [rcx + 2]
or ebx, 0xff0000
shl r11d, 0x10
imul ebx, dword [rsi + 0x10]
shr ebx, 8
and ebx, 0xff00ff
mov eax, ebx
shr eax, 0x10
sub r8d, eax
movzx eax, byte [rcx]
mov ecx, 0x100
or r11d, eax
mov eax, r10d
shr r10d, 8
and eax, 0xff00ff
and r10d, 0xff00ff
imul r11d, dword [rsi + 0x10]
shr r11d, 8
and r11d, 0xff00ff
imul eax, r8d
shr eax, 8
imul r10d, r8d
and eax, 0xff00ff
shr r10d, 8
add r11d, eax
and r10d, 0xff00ff
add ebx, r10d
mov eax, ebx
shr eax, 8
and eax, 0xff00ff
sub edx, eax
mov eax, ebx
shl eax, 8
shl edx, 8
or edx, eax
mov eax, r11d
shr eax, 8
and eax, 0xff00ff
sub ecx, eax
mov eax, ebx
shl ebx, 8
or ecx, r11d
shr eax, 8
xor edx, ecx
and eax, 0xff00ff
mov ecx, 0x100
sub ecx, eax
and edx, 0xff00ff
shl ecx, 8
or ecx, ebx
xor edx, ecx
mov dword [rdi], edx
add rdi, r14
test ebp, ebp
jg 0x1800809f1
mov r14, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x20]
mov rbp, qword [rsp + 0x30]
pop rdi
pop rsi
ret
mov r8, rcx
nop
mov rcx, qword [rsi + 8]
mov eax, r9d
dec ebp
cdq
inc r9d
idiv dword [rcx + 0x14]
mov eax, dword [rcx + 0x10]
imul eax, edx
movsxd rcx, eax
add rcx, qword [rsi + 0x28]
movzx eax, word [rcx]
movzx edx, byte [rcx + 2]
shl edx, 8
mov word [rsp + 0x18], ax
movzx eax, byte [rsp + 0x19]
or edx, eax
movzx eax, byte [rsp + 0x18]
shl edx, 8
or edx, eax
or edx, 0xff000000
mov dword [rdi], edx
add rdi, r8
test ebp, ebp
jg 0x180080b00
mov rbp, qword [rsp + 0x30]
pop rdi
pop rsi
ret
Function at 0x180080b60
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
sub rsp, 0x20
mov r10, qword [rcx]
mov esi, dword [rcx + 0x10]
mov ebp, edx
movsxd rdx, dword [r10 + 0x10]
mov ebx, r8d
mov rdi, rcx
imul esi, r9d
mov eax, edx
sar esi, 8
imul eax, ebp
sub ebp, dword [rcx + 0x14]
movsxd r11, eax
add r11, qword [rcx + 0x20]
cmp esi, 0xfe
jge 0x180080cb9
mov qword [rsp + 0x48], r14
mov r14, rdx
nop dword [rax + rax]
mov rax, qword [rdi + 8]
mov r8d, dword [r11]
dec ebx
mov ecx, dword [rax + 0x10]
imul ecx, ebp
inc ebp
movsxd rdx, ecx
mov ecx, 0x100
add rdx, qword [rdi + 0x28]
movzx r10d, byte [rdx + 1]
movzx r9d, byte [rdx + 2]
or r10d, 0xff0000
shl r9d, 0x10
imul r10d, esi
shr r10d, 8
and r10d, 0xff00ff
mov eax, r10d
shr eax, 0x10
sub ecx, eax
movzx eax, byte [rdx]
mov edx, 0x100
or r9d, eax
mov eax, r8d
shr r8d, 8
and eax, 0xff00ff
and r8d, 0xff00ff
imul r9d, esi
shr r9d, 8
and r9d, 0xff00ff
imul eax, ecx
shr eax, 8
imul r8d, ecx
and eax, 0xff00ff
shr r8d, 8
mov ecx, 0x100
add r9d, eax
and r8d, 0xff00ff
add r10d, r8d
mov eax, r10d
shr eax, 8
and eax, 0xff00ff
sub edx, eax
mov eax, r10d
shl eax, 8
shl edx, 8
or edx, eax
mov eax, r9d
shr eax, 8
and eax, 0xff00ff
sub ecx, eax
mov eax, r10d
shl r10d, 8
or ecx, r9d
shr eax, 8
xor edx, ecx
and eax, 0xff00ff
mov ecx, 0x100
sub ecx, eax
and edx, 0xff00ff
shl ecx, 8
or ecx, r10d
xor edx, ecx
mov dword [r11], edx
add r11, r14
test ebx, ebx
jg 0x180080bb0
mov r14, qword [rsp + 0x48]
mov rbx, qword [rsp + 0x50]
add rsp, 0x20
pop rdi
pop rsi
pop rbp
ret
mov r8, qword [rcx + 8]
movsxd rcx, dword [r8 + 0x10]
mov eax, ecx
imul eax, ebp
cdqe
add rax, qword [rdi + 0x28]
cmp edx, ecx
jne 0x180080cfb
cmp dword [r8 + 8], 1
jne 0x180080cfb
cmp dword [r10 + 8], 1
jne 0x180080cfb
imul ecx, ebx
mov rdx, rax
movsxd r8, ecx
mov rcx, r11
mov rbx, qword [rsp + 0x50]
add rsp, 0x20
pop rdi
pop rsi
pop rbp
jmp fcn.1800a0460
mov r8, rdx
mov r9, rcx
movzx ecx, word [rax]
movzx edx, byte [rax + 2]
dec ebx
shl edx, 8
mov word [rsp + 0x40], cx
movzx ecx, byte [rsp + 0x41]
or edx, ecx
movzx ecx, byte [rsp + 0x40]
add rax, r9
shl edx, 8
or edx, ecx
or edx, 0xff000000
mov dword [r11], edx
add r11, r8
test ebx, ebx
jg 0x180080d01
mov rbx, qword [rsp + 0x50]
add rsp, 0x20
pop rdi
pop rsi
pop rbp
ret
Function at 0x180080d50
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
sub rsp, 0x20
mov ebp, edx
mov edi, r8d
mov r8, qword [rcx]
movsxd rdx, dword [r8 + 0x10]
mov rsi, rcx
mov eax, edx
imul eax, ebp
sub ebp, dword [rcx + 0x14]
movsxd rbx, eax
add rbx, qword [rcx + 0x20]
cmp dword [rcx + 0x10], 0xfe
jge 0x180080e9d
mov qword [rsp + 0x48], r14
mov r14, rdx
nop
mov rax, qword [rsi + 8]
mov r9d, dword [rbx]
mov r8d, 0x100
mov ecx, dword [rax + 0x10]
dec edi
imul ecx, ebp
inc ebp
movsxd rdx, ecx
mov ecx, 0x100
add rdx, qword [rsi + 0x28]
movzx r11d, byte [rdx + 1]
movzx r10d, byte [rdx + 2]
or r11d, 0xff0000
shl r10d, 0x10
imul r11d, dword [rsi + 0x10]
shr r11d, 8
and r11d, 0xff00ff
mov eax, r11d
shr eax, 0x10
sub r8d, eax
movzx eax, byte [rdx]
mov edx, 0x100
or r10d, eax
mov eax, r9d
shr r9d, 8
and eax, 0xff00ff
and r9d, 0xff00ff
imul r10d, dword [rsi + 0x10]
shr r10d, 8
and r10d, 0xff00ff
imul eax, r8d
shr eax, 8
imul r9d, r8d
and eax, 0xff00ff
shr r9d, 8
add r10d, eax
and r9d, 0xff00ff
add r11d, r9d
mov eax, r11d
shr eax, 8
and eax, 0xff00ff
sub edx, eax
mov eax, r11d
shl eax, 8
shl edx, 8
or edx, eax
mov eax, r10d
shr eax, 8
and eax, 0xff00ff
sub ecx, eax
mov eax, r11d
shl r11d, 8
or ecx, r10d
shr eax, 8
xor edx, ecx
and eax, 0xff00ff
mov ecx, 0x100
sub ecx, eax
and edx, 0xff00ff
shl ecx, 8
or ecx, r11d
xor edx, ecx
mov dword [rbx], edx
add rbx, r14
test edi, edi
jg 0x180080d90
mov r14, qword [rsp + 0x48]
mov rbx, qword [rsp + 0x50]
add rsp, 0x20
pop rdi
pop rsi
pop rbp
ret
mov r9, qword [rcx + 8]
movsxd rcx, dword [r9 + 0x10]
mov eax, ecx
imul eax, ebp
cdqe
add rax, qword [rsi + 0x28]
cmp edx, ecx
jne 0x180080edf
cmp dword [r9 + 8], 1
jne 0x180080edf
cmp dword [r8 + 8], 1
jne 0x180080edf
imul ecx, edi
mov rdx, rax
movsxd r8, ecx
mov rcx, rbx
mov rbx, qword [rsp + 0x50]
add rsp, 0x20
pop rdi
pop rsi
pop rbp
jmp fcn.1800a0460
mov r8, rdx
mov r9, rcx
nop word [rax + rax]
movzx ecx, word [rax]
movzx edx, byte [rax + 2]
dec edi
shl edx, 8
mov word [rsp + 0x40], cx
movzx ecx, byte [rsp + 0x41]
or edx, ecx
movzx ecx, byte [rsp + 0x40]
add rax, r9
shl edx, 8
or edx, ecx
or edx, 0xff000000
mov dword [rbx], edx
add rbx, r8
test edi, edi
jg 0x180080ef0
mov rbx, qword [rsp + 0x50]
add rsp, 0x20
pop rdi
pop rsi
pop rbp
ret
Function at 0x180080f40
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
mov rax, qword [rcx]
mov r11, rcx
mov r10d, edx
movsxd rcx, dword [rax + 0x10]
mov edi, dword [r11 + 0x10]
sub r10d, dword [r11 + 0x14]
imul edi, r9d
mov eax, ecx
sar edi, 8
mov esi, r8d
imul eax, edx
movsxd rbx, eax
add rbx, qword [r11 + 0x20]
cmp edi, 0xfe
jge 0x180081080
mov qword [rsp + 0x10], rbp
mov rbp, rcx
nop word [rax + rax]
mov rcx, qword [r11 + 8]
mov eax, r10d
dec esi
cdq
inc r10d
idiv dword [rcx + 0x14]
mov eax, dword [rcx + 0x10]
imul eax, edx
mov edx, 0x100
movsxd rcx, eax
add rcx, qword [r11 + 0x28]
movzx eax, byte [rcx]
mov ecx, 0x100
mov r9d, eax
shl r9d, 0x10
or r9d, eax
imul r9d, edi
shr r9d, 8
and r9d, 0xff00ff
mov eax, r9d
shr eax, 0x10
sub ecx, eax
mov eax, dword [rbx]
mov r8d, eax
shr eax, 8
and eax, 0xff00ff
and r8d, 0xff00ff
imul eax, ecx
imul r8d, ecx
mov ecx, 0x100
shr eax, 8
shr r8d, 8
and eax, 0xff00ff
and r8d, 0xff00ff
add r8d, r9d
add r9d, eax
mov eax, r9d
shr eax, 8
and eax, 0xff00ff
sub edx, eax
mov eax, r9d
shl eax, 8
shl edx, 8
or edx, eax
mov eax, r8d
shr eax, 8
and eax, 0xff00ff
sub ecx, eax
mov eax, r9d
shl r9d, 8
or ecx, r8d
shr eax, 8
xor edx, ecx
and eax, 0xff00ff
mov ecx, 0x100
sub ecx, eax
and edx, 0xff00ff
shl ecx, 8
or ecx, r9d
xor edx, ecx
mov dword [rbx], edx
add rbx, rbp
test esi, esi
jg 0x180080f90
mov rbp, qword [rsp + 0x10]
mov rbx, qword [rsp + 0x18]
mov rsi, qword [rsp + 0x20]
pop rdi
ret
mov rdi, rcx
mov rcx, qword [r11 + 8]
mov eax, r10d
dec esi
cdq
inc r10d
idiv dword [rcx + 0x14]
mov eax, dword [rcx + 0x10]
imul eax, edx
mov edx, 0x100
movsxd rcx, eax
add rcx, qword [r11 + 0x28]
movzx eax, byte [rcx]
mov ecx, 0x100
mov r9d, eax
shl r9d, 0x10
or r9d, eax
mov eax, r9d
shr eax, 0x10
sub ecx, eax
mov eax, dword [rbx]
mov r8d, eax
shr eax, 8
and eax, 0xff00ff
and r8d, 0xff00ff
imul eax, ecx
imul r8d, ecx
mov ecx, 0x100
shr eax, 8
shr r8d, 8
and eax, 0xff00ff
and r8d, 0xff00ff
add r8d, r9d
add r9d, eax
mov eax, r9d
shr eax, 8
and eax, 0xff00ff
sub edx, eax
mov eax, r9d
shl eax, 8
shl edx, 8
or edx, eax
mov eax, r8d
shr eax, 8
and eax, 0xff00ff
sub ecx, eax
mov eax, r9d
shl r9d, 8
or ecx, r8d
shr eax, 8
xor edx, ecx
and eax, 0xff00ff
mov ecx, 0x100
sub ecx, eax
and edx, 0xff00ff
shl ecx, 8
or ecx, r9d
xor edx, ecx
mov dword [rbx], edx
add rbx, rdi
test esi, esi
jg 0x180081083
mov rbx, qword [rsp + 0x18]
mov rsi, qword [rsp + 0x20]
pop rdi
ret
Function at 0x180081160
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
mov rax, qword [rcx]
mov r10, rcx
mov r11d, edx
movsxd rcx, dword [rax + 0x10]
sub r11d, dword [r10 + 0x14]
mov edi, r8d
mov eax, ecx
mov rsi, rcx
imul eax, edx
movsxd rbx, eax
add rbx, qword [r10 + 0x20]
cmp dword [r10 + 0x10], 0xfe
jge 0x180081290
mov rcx, qword [r10 + 8]
mov eax, r11d
dec edi
cdq
inc r11d
idiv dword [rcx + 0x14]
mov eax, dword [rcx + 0x10]
imul eax, edx
mov edx, 0x100
movsxd rcx, eax
add rcx, qword [r10 + 0x28]
movzx eax, byte [rcx]
mov ecx, 0x100
mov r9d, eax
shl r9d, 0x10
or r9d, eax
imul r9d, dword [r10 + 0x10]
shr r9d, 8
and r9d, 0xff00ff
mov eax, r9d
shr eax, 0x10
sub ecx, eax
mov eax, dword [rbx]
mov r8d, eax
shr eax, 8
and eax, 0xff00ff
and r8d, 0xff00ff
imul eax, ecx
imul r8d, ecx
mov ecx, 0x100
shr eax, 8
shr r8d, 8
and eax, 0xff00ff
and r8d, 0xff00ff
add r8d, r9d
add r9d, eax
mov eax, r9d
shr eax, 8
and eax, 0xff00ff
sub edx, eax
mov eax, r9d
shl eax, 8
shl edx, 8
or edx, eax
mov eax, r8d
shr eax, 8
and eax, 0xff00ff
sub ecx, eax
mov eax, r9d
shl r9d, 8
or ecx, r8d
shr eax, 8
xor edx, ecx
and eax, 0xff00ff
mov ecx, 0x100
sub ecx, eax
and edx, 0xff00ff
shl ecx, 8
or ecx, r9d
xor edx, ecx
mov dword [rbx], edx
add rbx, rsi
test edi, edi
jg 0x1800811a0
mov rbx, qword [rsp + 8]
mov rsi, qword [rsp + 0x10]
mov rdi, qword [rsp + 0x18]
ret
mov rcx, qword [r10 + 8]
mov eax, r11d
dec edi
cdq
inc r11d
idiv dword [rcx + 0x14]
mov eax, dword [rcx + 0x10]
imul eax, edx
mov edx, 0x100
movsxd rcx, eax
add rcx, qword [r10 + 0x28]
movzx eax, byte [rcx]
mov ecx, 0x100
mov r9d, eax
shl r9d, 0x10
or r9d, eax
mov eax, r9d
shr eax, 0x10
sub ecx, eax
mov eax, dword [rbx]
mov r8d, eax
shr eax, 8
and eax, 0xff00ff
and r8d, 0xff00ff
imul eax, ecx
imul r8d, ecx
mov ecx, 0x100
shr eax, 8
shr r8d, 8
and eax, 0xff00ff
and r8d, 0xff00ff
add r8d, r9d
add r9d, eax
mov eax, r9d
shr eax, 8
and eax, 0xff00ff
sub edx, eax
mov eax, r9d
shl eax, 8
shl edx, 8
or edx, eax
mov eax, r8d
shr eax, 8
and eax, 0xff00ff
sub ecx, eax
mov eax, r9d
shl r9d, 8
or ecx, r8d
shr eax, 8
xor edx, ecx
and eax, 0xff00ff
mov ecx, 0x100
sub ecx, eax
and edx, 0xff00ff
shl ecx, 8
or ecx, r9d
xor edx, ecx
mov dword [rbx], edx
add rbx, rsi
test edi, edi
jg 0x180081290
mov rbx, qword [rsp + 8]
mov rsi, qword [rsp + 0x10]
mov rdi, qword [rsp + 0x18]
ret
Function at 0x180081370
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov rbp, qword [rcx]
mov r11d, dword [rcx + 0x10]
mov esi, edx
movsxd rdx, dword [rbp + 0x10]
mov edi, r8d
mov rbx, rcx
imul r11d, r9d
mov eax, edx
sar r11d, 8
imul eax, esi
sub esi, dword [rcx + 0x14]
movsxd r10, eax
add r10, qword [rcx + 0x20]
cmp r11d, 0xfe
jge 0x18008149d
mov rbp, rdx
nop
mov rax, qword [rbx + 8]
mov edx, 0x100
dec edi
mov eax, dword [rax + 0x10]
imul eax, esi
inc esi
cdqe
add rax, qword [rbx + 0x28]
movzx ecx, byte [rax]
mov r9d, ecx
shl r9d, 0x10
or r9d, ecx
mov ecx, 0x100
imul r9d, r11d
shr r9d, 8
and r9d, 0xff00ff
mov eax, r9d
shr eax, 0x10
sub ecx, eax
mov eax, dword [r10]
mov r8d, eax
shr eax, 8
and eax, 0xff00ff
and r8d, 0xff00ff
imul eax, ecx
imul r8d, ecx
mov ecx, 0x100
shr eax, 8
shr r8d, 8
and eax, 0xff00ff
and r8d, 0xff00ff
add r8d, r9d
add r9d, eax
mov eax, r9d
shr eax, 8
and eax, 0xff00ff
sub edx, eax
mov eax, r9d
shl eax, 8
shl edx, 8
or edx, eax
mov eax, r8d
shr eax, 8
and eax, 0xff00ff
sub ecx, eax
mov eax, r9d
shl r9d, 8
or ecx, r8d
shr eax, 8
xor edx, ecx
and eax, 0xff00ff
mov ecx, 0x100
sub ecx, eax
and edx, 0xff00ff
shl ecx, 8
or ecx, r9d
xor edx, ecx
mov dword [r10], edx
add r10, rbp
test edi, edi
jg 0x1800813c0
jmp 0x18008159b
mov r8, qword [rcx + 8]
movsxd rcx, dword [r8 + 0x10]
mov eax, ecx
imul eax, esi
movsxd r11, eax
add r11, qword [rbx + 0x28]
cmp edx, ecx
jne 0x1800814d8
cmp dword [r8 + 8], 1
jne 0x1800814d8
cmp dword [rbp + 8], 1
jne 0x1800814d8
imul ecx, edi
mov rdx, r11
movsxd r8, ecx
mov rcx, r10
call fcn.1800a0460
jmp 0x18008159b
mov rbx, rdx
mov rsi, rcx
nop
movzx eax, byte [r11]
mov ecx, 0x100
mov edx, 0x100
mov r9d, eax
dec edi
add r11, rsi
shl r9d, 0x10
or r9d, eax
mov eax, r9d
shr eax, 0x10
sub ecx, eax
mov eax, dword [r10]
mov r8d, eax
shr eax, 8
and eax, 0xff00ff
and r8d, 0xff00ff
imul eax, ecx
imul r8d, ecx
mov ecx, 0x100
shr eax, 8
shr r8d, 8
and eax, 0xff00ff
and r8d, 0xff00ff
add r8d, r9d
add r9d, eax
mov eax, r9d
shr eax, 8
and eax, 0xff00ff
sub edx, eax
mov eax, r9d
shl eax, 8
shl edx, 8
or edx, eax
mov eax, r8d
shr eax, 8
and eax, 0xff00ff
sub ecx, eax
mov eax, r9d
shl r9d, 8
or ecx, r8d
shr eax, 8
xor edx, ecx
and eax, 0xff00ff
mov ecx, 0x100
sub ecx, eax
and edx, 0xff00ff
shl ecx, 8
or ecx, r9d
xor edx, ecx
mov dword [r10], edx
add r10, rbx
test edi, edi
jg 0x1800814e0
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x1800815b0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov ebx, edx
mov edi, r8d
mov r8, qword [rcx]
movsxd rdx, dword [r8 + 0x10]
mov r11, rcx
mov eax, edx
imul eax, ebx
sub ebx, dword [rcx + 0x14]
movsxd r10, eax
add r10, qword [rcx + 0x20]
cmp dword [rcx + 0x10], 0xfe
jge 0x1800816d9
mov rsi, rdx
nop dword [rax]
mov rax, qword [r11 + 8]
mov edx, 0x100
dec edi
mov eax, dword [rax + 0x10]
imul eax, ebx
inc ebx
cdqe
add rax, qword [r11 + 0x28]
movzx ecx, byte [rax]
mov r9d, ecx
shl r9d, 0x10
or r9d, ecx
mov ecx, 0x100
imul r9d, dword [r11 + 0x10]
shr r9d, 8
and r9d, 0xff00ff
mov eax, r9d
shr eax, 0x10
sub ecx, eax
mov eax, dword [r10]
mov r8d, eax
shr eax, 8
and eax, 0xff00ff
and r8d, 0xff00ff
imul eax, ecx
imul r8d, ecx
mov ecx, 0x100
shr eax, 8
shr r8d, 8
and eax, 0xff00ff
and r8d, 0xff00ff
add r8d, r9d
add r9d, eax
mov eax, r9d
shr eax, 8
and eax, 0xff00ff
sub edx, eax
mov eax, r9d
shl eax, 8
shl edx, 8
or edx, eax
mov eax, r8d
shr eax, 8
and eax, 0xff00ff
sub ecx, eax
mov eax, r9d
shl r9d, 8
or ecx, r8d
shr eax, 8
xor edx, ecx
and eax, 0xff00ff
mov ecx, 0x100
sub ecx, eax
and edx, 0xff00ff
shl ecx, 8
or ecx, r9d
xor edx, ecx
mov dword [r10], edx
add r10, rsi
test edi, edi
jg 0x1800815f0
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
mov r9, qword [rcx + 8]
movsxd rcx, dword [r9 + 0x10]
mov eax, ecx
imul eax, ebx
movsxd rbx, eax
add rbx, qword [r11 + 0x28]
cmp edx, ecx
jne 0x18008171f
cmp dword [r9 + 8], 1
jne 0x18008171f
cmp dword [r8 + 8], 1
jne 0x18008171f
imul ecx, edi
mov rdx, rbx
movsxd r8, ecx
mov rcx, r10
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
jmp fcn.1800a0460
mov r11, rdx
mov rsi, rcx
nop word [rax + rax]
movzx eax, byte [rbx]
mov ecx, 0x100
mov edx, 0x100
mov r9d, eax
dec edi
add rbx, rsi
shl r9d, 0x10
or r9d, eax
mov eax, r9d
shr eax, 0x10
sub ecx, eax
mov eax, dword [r10]
mov r8d, eax
shr eax, 8
and eax, 0xff00ff
and r8d, 0xff00ff
imul eax, ecx
imul r8d, ecx
mov ecx, 0x100
shr eax, 8
shr r8d, 8
and eax, 0xff00ff
and r8d, 0xff00ff
add r8d, r9d
add r9d, eax
mov eax, r9d
shr eax, 8
and eax, 0xff00ff
sub edx, eax
mov eax, r9d
shl eax, 8
shl edx, 8
or edx, eax
mov eax, r8d
shr eax, 8
and eax, 0xff00ff
sub ecx, eax
mov eax, r9d
shl r9d, 8
or ecx, r8d
shr eax, 8
xor edx, ecx
and eax, 0xff00ff
mov ecx, 0x100
sub ecx, eax
and edx, 0xff00ff
shl ecx, 8
or ecx, r9d
xor edx, ecx
mov dword [r10], edx
add r10, r11
test edi, edi
jg 0x180081730
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x180082020
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
mov rax, qword [rcx]
mov rdi, rcx
mov ebx, edx
movsxd rcx, dword [rax + 0x10]
mov ebp, dword [rdi + 0x10]
sub ebx, dword [rdi + 0x14]
imul ebp, r9d
mov eax, ecx
sar ebp, 8
mov esi, r8d
imul eax, edx
movsxd r10, eax
add r10, qword [rdi + 0x20]
cmp ebp, 0xfe
jge 0x18008214e
mov qword [rsp + 0x20], r14
mov r14, rcx
nop dword [rax + rax]
mov rcx, qword [rdi + 8]
movzx r11d, byte [r10 + 1]
mov eax, ebx
cdq
mov r8d, 0x100
dec esi
inc ebx
idiv dword [rcx + 0x14]
mov eax, dword [rcx + 0x10]
imul eax, edx
movsxd rdx, eax
add rdx, qword [rdi + 0x28]
movzx ecx, byte [rdx + 1]
movzx r9d, byte [rdx + 2]
or ecx, 0xff0000
shl r9d, 0x10
imul ecx, ebp
shr ecx, 8
and ecx, 0xff00ff
mov eax, ecx
shr eax, 0x10
sub r8d, eax
movzx eax, byte [rdx]
or r9d, eax
movzx eax, byte [r10]
imul r11d, r8d
shr r11d, 8
add r11d, ecx
movzx ecx, byte [r10 + 2]
imul r9d, ebp
shl ecx, 0x10
shr r9d, 8
or ecx, eax
and r9d, 0xff00ff
imul ecx, r8d
shr ecx, 8
and ecx, 0xff00ff
add r9d, ecx
mov ecx, 0x100
mov eax, r9d
shr eax, 8
and eax, 0xff00ff
sub ecx, eax
mov eax, r11d
shr eax, 8
or ecx, r9d
neg al
and ecx, 0xff00ff
or al, r11b
mov byte [r10], cl
mov byte [r10 + 1], al
mov eax, ecx
shr eax, 0x10
mov byte [r10 + 2], al
add r10, r14
test esi, esi
jg 0x180082070
mov r14, qword [rsp + 0x20]
mov rbx, qword [rsp + 0x28]
mov rbp, qword [rsp + 0x30]
pop rdi
pop rsi
ret
mov r8, rcx
mov rcx, qword [rdi + 8]
mov eax, ebx
dec esi
cdq
inc ebx
idiv dword [rcx + 0x14]
mov eax, dword [rcx + 0x10]
imul eax, edx
movsxd rcx, eax
add rcx, qword [rdi + 0x28]
movzx eax, word [rcx]
movzx ecx, byte [rcx + 2]
mov byte [r10], al
mov word [rsp + 0x18], ax
movzx eax, byte [rsp + 0x19]
mov byte [r10 + 1], al
mov byte [r10 + 2], cl
add r10, r8
test esi, esi
jg 0x180082151
mov rbx, qword [rsp + 0x28]
mov rbp, qword [rsp + 0x30]
pop rdi
pop rsi
ret
Function at 0x1800821a0
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
mov qword [rsp + 0x20], rbp
push rsi
push rdi
mov rax, qword [rcx]
mov rsi, rcx
mov edi, edx
movsxd rcx, dword [rax + 0x10]
sub edi, dword [rsi + 0x14]
mov ebp, r8d
mov eax, ecx
imul eax, edx
movsxd r9, eax
add r9, qword [rsi + 0x20]
cmp dword [rsi + 0x10], 0xfe
jge 0x1800822bc
mov qword [rsp + 0x20], rbx
mov qword [rsp + 0x28], r14
mov r14, rcx
nop
mov rcx, qword [rsi + 8]
movzx ebx, byte [r9 + 1]
mov eax, edi
cdq
mov r8d, 0x100
dec ebp
inc edi
idiv dword [rcx + 0x14]
mov eax, dword [rcx + 0x10]
imul eax, edx
movsxd rdx, eax
add rdx, qword [rsi + 0x28]
movzx ecx, byte [rdx + 1]
movzx r11d, byte [rdx + 2]
or ecx, 0xff0000
shl r11d, 0x10
imul ecx, dword [rsi + 0x10]
shr ecx, 8
and ecx, 0xff00ff
mov eax, ecx
shr eax, 0x10
sub r8d, eax
movzx eax, byte [rdx]
or r11d, eax
movzx eax, byte [r9]
imul ebx, r8d
shr ebx, 8
add ebx, ecx
movzx ecx, byte [r9 + 2]
imul r11d, dword [rsi + 0x10]
shl ecx, 0x10
shr r11d, 8
or ecx, eax
and r11d, 0xff00ff
imul ecx, r8d
shr ecx, 8
and ecx, 0xff00ff
add r11d, ecx
mov ecx, 0x100
mov eax, r11d
shr eax, 8
and eax, 0xff00ff
sub ecx, eax
mov eax, ebx
shr eax, 8
or ecx, r11d
neg al
and ecx, 0xff00ff
or al, bl
mov byte [r9], cl
mov byte [r9 + 1], al
mov eax, ecx
shr eax, 0x10
mov byte [r9 + 2], al
add r9, r14
test ebp, ebp
jg 0x1800821e0
mov r14, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x20]
mov rbp, qword [rsp + 0x30]
pop rdi
pop rsi
ret
mov r8, rcx
nop
mov rcx, qword [rsi + 8]
mov eax, edi
dec ebp
cdq
inc edi
idiv dword [rcx + 0x14]
mov eax, dword [rcx + 0x10]
imul eax, edx
movsxd rcx, eax
add rcx, qword [rsi + 0x28]
movzx eax, word [rcx]
movzx ecx, byte [rcx + 2]
mov byte [r9], al
mov word [rsp + 0x18], ax
movzx eax, byte [rsp + 0x19]
mov byte [r9 + 1], al
mov byte [r9 + 2], cl
add r9, r8
test ebp, ebp
jg 0x1800822c0
mov rbp, qword [rsp + 0x30]
pop rdi
pop rsi
ret

Function at 0x180082dc0
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push rbx
mov rax, qword [rcx]
mov rbx, rcx
mov r11d, edx
movsxd rcx, dword [rax + 0x10]
sub r11d, dword [rbx + 0x14]
mov eax, ecx
imul eax, edx
movsxd r10, eax
mov eax, dword [rbx + 0x10]
add r10, qword [rbx + 0x20]
imul eax, r9d
sar eax, 8
cmp eax, 0xfe
jge 0x180082e51
mov qword [rsp + 0x10], rdi
lea r9d, [rax + 1]
mov rdi, rcx
nop dword [rax]
mov rcx, qword [rbx + 8]
mov eax, r11d
dec r8d
cdq
inc r11d
idiv dword [rcx + 0x14]
movsxd rcx, dword [rcx + 0x10]
movsxd rax, edx
imul rcx, rax
mov rax, qword [rbx + 0x28]
movzx edx, byte [rcx + rax + 3]
movzx eax, byte [r10]
mov ecx, 0x100
imul edx, r9d
shr edx, 8
sub ecx, edx
imul ecx, eax
sar ecx, 8
add cl, dl
mov byte [r10], cl
add r10, rdi
test r8d, r8d
jg 0x180082e00
mov rdi, qword [rsp + 0x10]
pop rbx
ret
mov r9, rcx
nop dword [rax]
nop dword [rax + rax]
mov rcx, qword [rbx + 8]
mov eax, r11d
dec r8d
cdq
inc r11d
idiv dword [rcx + 0x14]
movsxd rcx, dword [rcx + 0x10]
movsxd rax, edx
imul rcx, rax
mov rax, qword [rbx + 0x28]
movzx edx, byte [rcx + rax + 3]
movzx eax, byte [r10]
mov ecx, 0x100
sub ecx, edx
imul ecx, eax
sar ecx, 8
add cl, dl
mov byte [r10], cl
add r10, r9
test r8d, r8d
jg 0x180082e60
pop rbx
ret
Function at 0x180082eb0
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
mov qword [rsp + 8], rbx
mov rax, qword [rcx]
mov r11, rcx
mov r10d, edx
movsxd rcx, dword [rax + 0x10]
sub r10d, dword [r11 + 0x14]
mov eax, ecx
mov rbx, rcx
imul eax, edx
movsxd r9, eax
add r9, qword [r11 + 0x20]
cmp dword [r11 + 0x10], 0xfe
jge 0x180082f40
nop
mov rcx, qword [r11 + 8]
mov eax, r10d
dec r8d
cdq
inc r10d
idiv dword [rcx + 0x14]
movsxd rcx, dword [rcx + 0x10]
movsxd rax, edx
imul rcx, rax
mov rax, qword [r11 + 0x28]
movzx edx, byte [rcx + rax + 3]
mov eax, dword [r11 + 0x10]
mov ecx, 0x100
inc eax
imul edx, eax
movzx eax, byte [r9]
shr edx, 8
sub ecx, edx
imul ecx, eax
sar ecx, 8
add cl, dl
mov byte [r9], cl
add r9, rbx
test r8d, r8d
jg 0x180082ee0
mov rbx, qword [rsp + 8]
ret
mov rcx, qword [r11 + 8]
mov eax, r10d
dec r8d
cdq
inc r10d
idiv dword [rcx + 0x14]
movsxd rcx, dword [rcx + 0x10]
movsxd rax, edx
imul rcx, rax
mov rax, qword [r11 + 0x28]
movzx edx, byte [rcx + rax + 3]
movzx eax, byte [r9]
mov ecx, 0x100
sub ecx, edx
imul ecx, eax
sar ecx, 8
add cl, dl
mov byte [r9], cl
add r9, rbx
test r8d, r8d
jg 0x180082f40
mov rbx, qword [rsp + 8]
ret

Function at 0x180083390
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push rbx
mov rax, qword [rcx]
mov rbx, rcx
mov r11d, edx
movsxd rcx, dword [rax + 0x10]
sub r11d, dword [rbx + 0x14]
mov eax, ecx
imul eax, edx
movsxd r10, eax
mov eax, dword [rbx + 0x10]
add r10, qword [rbx + 0x20]
imul eax, r9d
sar eax, 8
cmp eax, 0xfe
jge 0x180083420
mov qword [rsp + 0x10], rdi
lea r9d, [rax + 1]
mov rdi, rcx
nop dword [rax]
mov rcx, qword [rbx + 8]
mov eax, r11d
dec r8d
cdq
inc r11d
idiv dword [rcx + 0x14]
movsxd rcx, dword [rcx + 0x10]
movsxd rax, edx
imul rcx, rax
mov rax, qword [rbx + 0x28]
movzx edx, byte [rcx + rax]
movzx eax, byte [r10]
mov ecx, 0x100
imul edx, r9d
shr edx, 8
sub ecx, edx
imul ecx, eax
sar ecx, 8
add cl, dl
mov byte [r10], cl
add r10, rdi
test r8d, r8d
jg 0x1800833d0
mov rdi, qword [rsp + 0x10]
pop rbx
ret
mov r9, rcx
nop dword [rax]
nop word [rax + rax]
mov rcx, qword [rbx + 8]
mov eax, r11d
dec r8d
cdq
inc r11d
idiv dword [rcx + 0x14]
movsxd rcx, dword [rcx + 0x10]
movsxd rax, edx
imul rcx, rax
mov rax, qword [rbx + 0x28]
movzx edx, byte [rcx + rax]
movzx eax, byte [r10]
mov ecx, 0x100
sub ecx, edx
imul ecx, eax
sar ecx, 8
add cl, dl
mov byte [r10], cl
add r10, r9
test r8d, r8d
jg 0x180083430
pop rbx
ret