joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180002f54
Capabilities:
Encrypt data using rc4 prga

Disassembly:
jmp 0x18008aab0
movsd qword [rsp + 0x10], xmm1
mov qword [rsp + 8], rcx
push rsi
push rdi
sub rsp, 0xa8
cmp qword [0x180640ed0], 0
jne 0x18008abca
lea rax, [rsp + 0x70]
lea rcx, [0x180288ee8]
mov rdi, rax
mov rsi, rcx
mov ecx, 0x2e
rep movsb byte [rdi], byte [rsi]
mov eax, 2
imul rax, rax, 0x16
movzx eax, word [rsp + rax + 0x70]
test eax, eax
je 0x18008ab07
mov dword [rsp + 0x2c], 1
jmp 0x18008ab0f
mov dword [rsp + 0x2c], 0
movzx eax, byte [rsp + 0x2c]
mov byte [rsp + 0x20], al
movzx eax, byte [rsp + 0x20]
movzx eax, al
test eax, eax
je 0x18008ab72
mov dword [rsp + 0x24], 0
jmp 0x18008ab38
mov eax, dword [rsp + 0x24]
inc eax
mov dword [rsp + 0x24], eax
cmp dword [rsp + 0x24], 0x17
jge 0x18008ab72
movsxd rax, dword [rsp + 0x24]
movzx eax, word [rsp + rax*2 + 0x70]
mov dword [rsp + 0x30], eax
mov eax, dword [rsp + 0x24]
cdq
mov ecx, 3
idiv ecx
mov eax, edx
add eax, 0xa
mov ecx, dword [rsp + 0x30]
xor ecx, eax
mov eax, ecx
movsxd rcx, dword [rsp + 0x24]
mov word [rsp + rcx*2 + 0x70], ax
jmp 0x18008ab2e
lea rax, [rsp + 0x70]
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
xor r9d, r9d
mov r8, rax
xor edx, edx
xor ecx, ecx
call fcn.180002662
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x48]
mov qword [0x180640ed0], rax
mov dword [rsp + 0x28], 0
jmp 0x18008abb5
mov eax, dword [rsp + 0x28]
inc eax
mov dword [rsp + 0x28], eax
cmp dword [rsp + 0x28], 0x17
jge 0x18008abca
movsxd rax, dword [rsp + 0x28]
xor ecx, ecx
mov word [rsp + rax*2 + 0x70], cx
jmp 0x18008abab
movsd xmm0, qword [rsp + 0xc8]
movsd qword [rsp + 0x60], xmm0
lea rax, [rsp + 0x68]
mov rdi, rax
xor eax, eax
mov ecx, 8
rep stosb byte [rdi], al
mov rax, qword [0x180640ed0]
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0xc0]
mov rax, qword [rax]
mov qword [rsp + 0x38], rax
cmp qword [rsp + 0x38], 0
je 0x18008ac3c
mov eax, 8
imul rax, rax, 0x4f
mov rcx, qword [rsp + 0x38]
mov rax, qword [rcx + rax]
mov qword [rsp + 0x58], rax
lea r8, [rsp + 0x60]
mov rdx, qword [rsp + 0x50]
mov rcx, qword [rsp + 0xc0]
call qword [rsp + 0x58]
nop
movsd xmm0, qword [rsp + 0x68]
add rsp, 0xa8
pop rdi
pop rsi
ret
Function at 0x180002f5e
Capabilities:
Encrypt data using rc4 prga

Disassembly:
jmp 0x180062b20
mov qword [rsp + 8], rcx
push rsi
push rdi
sub rsp, 0x88
cmp qword [0x180640bc0], 0
jne 0x180062c34
lea rax, [rsp + 0x60]
lea rcx, str.Ld_me_CxHHEC_n
mov rdi, rax
mov rsi, rcx
mov ecx, 0x20
rep movsb byte [rdi], byte [rsi]
mov eax, 2
imul rax, rax, 0xf
movzx eax, word [rsp + rax + 0x60]
test eax, eax
je 0x180062b71
mov dword [rsp + 0x2c], 1
jmp 0x180062b79
mov dword [rsp + 0x2c], 0
movzx eax, byte [rsp + 0x2c]
mov byte [rsp + 0x21], al
movzx eax, byte [rsp + 0x21]
movzx eax, al
test eax, eax
je 0x180062bdc
mov dword [rsp + 0x24], 0
jmp 0x180062ba2
mov eax, dword [rsp + 0x24]
inc eax
mov dword [rsp + 0x24], eax
cmp dword [rsp + 0x24], 0x10
jge 0x180062bdc
movsxd rax, dword [rsp + 0x24]
movzx eax, word [rsp + rax*2 + 0x60]
mov dword [rsp + 0x30], eax
mov eax, dword [rsp + 0x24]
cdq
mov ecx, 3
idiv ecx
mov eax, edx
add eax, 0xa
mov ecx, dword [rsp + 0x30]
xor ecx, eax
mov eax, ecx
movsxd rcx, dword [rsp + 0x24]
mov word [rsp + rcx*2 + 0x60], ax
jmp 0x180062b98
lea rax, [rsp + 0x60]
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
xor r9d, r9d
mov r8, rax
xor edx, edx
xor ecx, ecx
call fcn.180002662
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x48]
mov qword [0x180640bc0], rax
mov dword [rsp + 0x28], 0
jmp 0x180062c1f
mov eax, dword [rsp + 0x28]
inc eax
mov dword [rsp + 0x28], eax
cmp dword [rsp + 0x28], 0x10
jge 0x180062c34
movsxd rax, dword [rsp + 0x28]
xor ecx, ecx
mov word [rsp + rax*2 + 0x60], cx
jmp 0x180062c15
lea rax, [rsp + 0x20]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
mov rax, qword [0x180640bc0]
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0xa0]
mov rax, qword [rax]
mov qword [rsp + 0x38], rax
cmp qword [rsp + 0x38], 0
je 0x180062c97
mov eax, 8
imul rax, rax, 0x4f
mov rcx, qword [rsp + 0x38]
mov rax, qword [rcx + rax]
mov qword [rsp + 0x58], rax
lea r8, [rsp + 0x20]
mov rdx, qword [rsp + 0x50]
mov rcx, qword [rsp + 0xa0]
call qword [rsp + 0x58]
nop
movzx eax, byte [rsp + 0x20]
add rsp, 0x88
pop rdi
pop rsi
ret
Function at 0x1800031ca
Capabilities:
Encrypt data using rc4 prga

Disassembly:
jmp 0x1800701a0
mov byte [rsp + 0x18], r8b
mov byte [rsp + 0x10], dl
mov qword [rsp + 8], rcx
push rsi
push rdi
sub rsp, 0xa8
cmp qword [0x180640c30], 0
jne 0x1800702bd
lea rax, [rsp + 0x60]
lea rcx, str.Ld__krix_me_YnxIyc
mov rdi, rax
mov rsi, rcx
mov ecx, 0x32
rep movsb byte [rdi], byte [rsi]
mov eax, 2
imul rax, rax, 0x18
movzx eax, word [rsp + rax + 0x60]
test eax, eax
je 0x1800701fa
mov dword [rsp + 0x30], 1
jmp 0x180070202
mov dword [rsp + 0x30], 0
movzx eax, byte [rsp + 0x30]
mov byte [rsp + 0x20], al
movzx eax, byte [rsp + 0x20]
movzx eax, al
test eax, eax
je 0x180070265
mov dword [rsp + 0x24], 0
jmp 0x18007022b
mov eax, dword [rsp + 0x24]
inc eax
mov dword [rsp + 0x24], eax
cmp dword [rsp + 0x24], 0x19
jge 0x180070265
movsxd rax, dword [rsp + 0x24]
movzx eax, word [rsp + rax*2 + 0x60]
mov dword [rsp + 0x34], eax
mov eax, dword [rsp + 0x24]
cdq
mov ecx, 3
idiv ecx
mov eax, edx
add eax, 0xa
mov ecx, dword [rsp + 0x34]
xor ecx, eax
mov eax, ecx
movsxd rcx, dword [rsp + 0x24]
mov word [rsp + rcx*2 + 0x60], ax
jmp 0x180070221
lea rax, [rsp + 0x60]
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
xor r9d, r9d
mov r8, rax
xor edx, edx
xor ecx, ecx
call fcn.180002662
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x48]
mov qword [0x180640c30], rax
mov dword [rsp + 0x2c], 0
jmp 0x1800702a8
mov eax, dword [rsp + 0x2c]
inc eax
mov dword [rsp + 0x2c], eax
cmp dword [rsp + 0x2c], 0x19
jge 0x1800702bd
movsxd rax, dword [rsp + 0x2c]
xor ecx, ecx
mov word [rsp + rax*2 + 0x60], cx
jmp 0x18007029e
movzx eax, byte [rsp + 0xc8]
mov byte [rsp + 0x28], al
movzx eax, byte [rsp + 0xd0]
mov byte [rsp + 0x29], al
mov rax, qword [0x180640c30]
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0xc0]
mov rax, qword [rax]
mov qword [rsp + 0x38], rax
cmp qword [rsp + 0x38], 0
je 0x180070327
mov eax, 8
imul rax, rax, 0x4f
mov rcx, qword [rsp + 0x38]
mov rax, qword [rcx + rax]
mov qword [rsp + 0x58], rax
lea r8, [rsp + 0x28]
mov rdx, qword [rsp + 0x50]
mov rcx, qword [rsp + 0xc0]
call qword [rsp + 0x58]
nop
add rsp, 0xa8
pop rdi
pop rsi
ret
Function at 0x1800033af
Capabilities:
Encrypt data using rc4 prga

Disassembly:
jmp 0x180083520
movsd qword [rsp + 0x10], xmm1
mov qword [rsp + 8], rcx
push rsi
push rdi
sub rsp, 0xa8
cmp qword [0x180640e40], 0
jne 0x18008363a
lea rax, [rsp + 0x70]
lea rcx, [0x180288c60]
mov rdi, rax
mov rsi, rcx
mov ecx, 0x2e
rep movsb byte [rdi], byte [rsi]
mov eax, 2
imul rax, rax, 0x16
movzx eax, word [rsp + rax + 0x70]
test eax, eax
je 0x180083577
mov dword [rsp + 0x2c], 1
jmp 0x18008357f
mov dword [rsp + 0x2c], 0
movzx eax, byte [rsp + 0x2c]
mov byte [rsp + 0x20], al
movzx eax, byte [rsp + 0x20]
movzx eax, al
test eax, eax
je 0x1800835e2
mov dword [rsp + 0x24], 0
jmp 0x1800835a8
mov eax, dword [rsp + 0x24]
inc eax
mov dword [rsp + 0x24], eax
cmp dword [rsp + 0x24], 0x17
jge 0x1800835e2
movsxd rax, dword [rsp + 0x24]
movzx eax, word [rsp + rax*2 + 0x70]
mov dword [rsp + 0x30], eax
mov eax, dword [rsp + 0x24]
cdq
mov ecx, 3
idiv ecx
mov eax, edx
add eax, 0xa
mov ecx, dword [rsp + 0x30]
xor ecx, eax
mov eax, ecx
movsxd rcx, dword [rsp + 0x24]
mov word [rsp + rcx*2 + 0x70], ax
jmp 0x18008359e
lea rax, [rsp + 0x70]
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
xor r9d, r9d
mov r8, rax
xor edx, edx
xor ecx, ecx
call fcn.180002662
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x48]
mov qword [0x180640e40], rax
mov dword [rsp + 0x28], 0
jmp 0x180083625
mov eax, dword [rsp + 0x28]
inc eax
mov dword [rsp + 0x28], eax
cmp dword [rsp + 0x28], 0x17
jge 0x18008363a
movsxd rax, dword [rsp + 0x28]
xor ecx, ecx
mov word [rsp + rax*2 + 0x70], cx
jmp 0x18008361b
movsd xmm0, qword [rsp + 0xc8]
movsd qword [rsp + 0x60], xmm0
lea rax, [rsp + 0x68]
mov rdi, rax
xor eax, eax
mov ecx, 8
rep stosb byte [rdi], al
mov rax, qword [0x180640e40]
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0xc0]
mov rax, qword [rax]
mov qword [rsp + 0x38], rax
cmp qword [rsp + 0x38], 0
je 0x1800836ac
mov eax, 8
imul rax, rax, 0x4f
mov rcx, qword [rsp + 0x38]
mov rax, qword [rcx + rax]
mov qword [rsp + 0x58], rax
lea r8, [rsp + 0x60]
mov rdx, qword [rsp + 0x50]
mov rcx, qword [rsp + 0xc0]
call qword [rsp + 0x58]
nop
movsd xmm0, qword [rsp + 0x68]
add rsp, 0xa8
pop rdi
pop rsi
ret
Function at 0x1800034cc
Capabilities:
Encrypt data using rc4 prga

Disassembly:
jmp 0x1800703a0
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
push rsi
push rdi
sub rsp, 0xc8
cmp qword [0x180640980], 0
jne 0x1800704b8
lea rax, [rsp + 0x60]
lea rcx, str.ZyegbxciIdazdboex_XiHyy
mov rdi, rax
mov rsi, rcx
mov ecx, 0x5c
rep movsb byte [rdi], byte [rsi]
mov eax, 2
imul rax, rax, 0x2d
movzx eax, word [rsp + rax + 0x60]
test eax, eax
je 0x1800703f5
mov dword [rsp + 0x2c], 1
jmp 0x1800703fd
mov dword [rsp + 0x2c], 0
movzx eax, byte [rsp + 0x2c]
mov byte [rsp + 0x20], al
movzx eax, byte [rsp + 0x20]
movzx eax, al
test eax, eax
je 0x180070460
mov dword [rsp + 0x24], 0
jmp 0x180070426
mov eax, dword [rsp + 0x24]
inc eax
mov dword [rsp + 0x24], eax
cmp dword [rsp + 0x24], 0x2e
jge 0x180070460
movsxd rax, dword [rsp + 0x24]
movzx eax, word [rsp + rax*2 + 0x60]
mov dword [rsp + 0x30], eax
mov eax, dword [rsp + 0x24]
cdq
mov ecx, 3
idiv ecx
mov eax, edx
add eax, 0xa
mov ecx, dword [rsp + 0x30]
xor ecx, eax
mov eax, ecx
movsxd rcx, dword [rsp + 0x24]
mov word [rsp + rcx*2 + 0x60], ax
jmp 0x18007041c
lea rax, [rsp + 0x60]
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
xor r9d, r9d
mov r8, rax
xor edx, edx
xor ecx, ecx
call fcn.180002662
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x48]
mov qword [0x180640980], rax
mov dword [rsp + 0x28], 0
jmp 0x1800704a3
mov eax, dword [rsp + 0x28]
inc eax
mov dword [rsp + 0x28], eax
cmp dword [rsp + 0x28], 0x2e
jge 0x1800704b8
movsxd rax, dword [rsp + 0x28]
xor ecx, ecx
mov word [rsp + rax*2 + 0x60], cx
jmp 0x180070499
mov eax, dword [rsp + 0xe8]
mov dword [rsp + 0x34], eax
mov rax, qword [0x180640980]
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0xe0]
mov rax, qword [rax]
mov qword [rsp + 0x38], rax
cmp qword [rsp + 0x38], 0
je 0x180070515
mov eax, 8
imul rax, rax, 0x4f
mov rcx, qword [rsp + 0x38]
mov rax, qword [rcx + rax]
mov qword [rsp + 0x58], rax
lea r8, [rsp + 0x34]
mov rdx, qword [rsp + 0x50]
mov rcx, qword [rsp + 0xe0]
call qword [rsp + 0x58]
nop
add rsp, 0xc8
pop rdi
pop rsi
ret
Function at 0x1800035e9
Capabilities:
Encrypt data using rc4 prga

Disassembly:
jmp 0x1800852c0
movsd qword [rsp + 0x10], xmm1
mov qword [rsp + 8], rcx
push rsi
push rdi
sub rsp, 0xa8
cmp qword [0x180640e30], 0
jne 0x1800853da
lea rax, [rsp + 0x70]
lea rcx, [0x180288c28]
mov rdi, rax
mov rsi, rcx
mov ecx, 0x2c
rep movsb byte [rdi], byte [rsi]
mov eax, 2
imul rax, rax, 0x15
movzx eax, word [rsp + rax + 0x70]
test eax, eax
je 0x180085317
mov dword [rsp + 0x2c], 1
jmp 0x18008531f
mov dword [rsp + 0x2c], 0
movzx eax, byte [rsp + 0x2c]
mov byte [rsp + 0x20], al
movzx eax, byte [rsp + 0x20]
movzx eax, al
test eax, eax
je 0x180085382
mov dword [rsp + 0x24], 0
jmp 0x180085348
mov eax, dword [rsp + 0x24]
inc eax
mov dword [rsp + 0x24], eax
cmp dword [rsp + 0x24], 0x16
jge 0x180085382
movsxd rax, dword [rsp + 0x24]
movzx eax, word [rsp + rax*2 + 0x70]
mov dword [rsp + 0x30], eax
mov eax, dword [rsp + 0x24]
cdq
mov ecx, 3
idiv ecx
mov eax, edx
add eax, 0xa
mov ecx, dword [rsp + 0x30]
xor ecx, eax
mov eax, ecx
movsxd rcx, dword [rsp + 0x24]
mov word [rsp + rcx*2 + 0x70], ax
jmp 0x18008533e
lea rax, [rsp + 0x70]
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
xor r9d, r9d
mov r8, rax
xor edx, edx
xor ecx, ecx
call fcn.180002662
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x48]
mov qword [0x180640e30], rax
mov dword [rsp + 0x28], 0
jmp 0x1800853c5
mov eax, dword [rsp + 0x28]
inc eax
mov dword [rsp + 0x28], eax
cmp dword [rsp + 0x28], 0x16
jge 0x1800853da
movsxd rax, dword [rsp + 0x28]
xor ecx, ecx
mov word [rsp + rax*2 + 0x70], cx
jmp 0x1800853bb
movsd xmm0, qword [rsp + 0xc8]
movsd qword [rsp + 0x60], xmm0
lea rax, [rsp + 0x68]
mov rdi, rax
xor eax, eax
mov ecx, 8
rep stosb byte [rdi], al
mov rax, qword [0x180640e30]
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0xc0]
mov rax, qword [rax]
mov qword [rsp + 0x38], rax
cmp qword [rsp + 0x38], 0
je 0x18008544c
mov eax, 8
imul rax, rax, 0x4f
mov rcx, qword [rsp + 0x38]
mov rax, qword [rcx + rax]
mov qword [rsp + 0x58], rax
lea r8, [rsp + 0x60]
mov rdx, qword [rsp + 0x50]
mov rcx, qword [rsp + 0xc0]
call qword [rsp + 0x58]
nop
movsd xmm0, qword [rsp + 0x68]
add rsp, 0xa8
pop rdi
pop rsi
ret
Function at 0x180003661
Capabilities:
Encrypt data using rc4 prga

Disassembly:
jmp 0x180058160
mov qword [rsp + 8], rcx
push rsi
push rdi
sub rsp, 0xc8
cmp qword [0x180640a60], 0
jne 0x180058274
lea rax, [rsp + 0x60]
lea rcx, [0x1802873d0]
mov rdi, rax
mov rsi, rcx
mov ecx, 0x58
rep movsb byte [rdi], byte [rsi]
mov eax, 2
imul rax, rax, 0x2b
movzx eax, word [rsp + rax + 0x60]
test eax, eax
je 0x1800581b1
mov dword [rsp + 0x2c], 1
jmp 0x1800581b9
mov dword [rsp + 0x2c], 0
movzx eax, byte [rsp + 0x2c]
mov byte [rsp + 0x20], al
movzx eax, byte [rsp + 0x20]
movzx eax, al
test eax, eax
je 0x18005821c
mov dword [rsp + 0x24], 0
jmp 0x1800581e2
mov eax, dword [rsp + 0x24]
inc eax
mov dword [rsp + 0x24], eax
cmp dword [rsp + 0x24], 0x2c
jge 0x18005821c
movsxd rax, dword [rsp + 0x24]
movzx eax, word [rsp + rax*2 + 0x60]
mov dword [rsp + 0x34], eax
mov eax, dword [rsp + 0x24]
cdq
mov ecx, 3
idiv ecx
mov eax, edx
add eax, 0xa
mov ecx, dword [rsp + 0x34]
xor ecx, eax
mov eax, ecx
movsxd rcx, dword [rsp + 0x24]
mov word [rsp + rcx*2 + 0x60], ax
jmp 0x1800581d8
lea rax, [rsp + 0x60]
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
xor r9d, r9d
mov r8, rax
xor edx, edx
xor ecx, ecx
call fcn.180002662
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x48]
mov qword [0x180640a60], rax
mov dword [rsp + 0x28], 0
jmp 0x18005825f
mov eax, dword [rsp + 0x28]
inc eax
mov dword [rsp + 0x28], eax
cmp dword [rsp + 0x28], 0x2c
jge 0x180058274
movsxd rax, dword [rsp + 0x28]
xor ecx, ecx
mov word [rsp + rax*2 + 0x60], cx
jmp 0x180058255
lea rax, [rsp + 0x30]
mov rdi, rax
xor eax, eax
mov ecx, 4
rep stosb byte [rdi], al
mov rax, qword [0x180640a60]
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0xe0]
mov rax, qword [rax]
mov qword [rsp + 0x38], rax
cmp qword [rsp + 0x38], 0
je 0x1800582d7
mov eax, 8
imul rax, rax, 0x4f
mov rcx, qword [rsp + 0x38]
mov rax, qword [rcx + rax]
mov qword [rsp + 0x58], rax
lea r8, [rsp + 0x30]
mov rdx, qword [rsp + 0x50]
mov rcx, qword [rsp + 0xe0]
call qword [rsp + 0x58]
nop
movss xmm0, dword [rsp + 0x30]
add rsp, 0xc8
pop rdi
pop rsi
ret
Function at 0x1800036c5
Capabilities:
Encrypt data using rc4 prga

Disassembly:
jmp 0x180083310
movsd qword [rsp + 0x10], xmm1
mov qword [rsp + 8], rcx
push rsi
push rdi
sub rsp, 0xa8
cmp qword [0x180640e90], 0
jne 0x18008342a
lea rax, [rsp + 0x70]
lea rcx, [0x180288d80]
mov rdi, rax
mov rsi, rcx
mov ecx, 0x2c
rep movsb byte [rdi], byte [rsi]
mov eax, 2
imul rax, rax, 0x15
movzx eax, word [rsp + rax + 0x70]
test eax, eax
je 0x180083367
mov dword [rsp + 0x2c], 1
jmp 0x18008336f
mov dword [rsp + 0x2c], 0
movzx eax, byte [rsp + 0x2c]
mov byte [rsp + 0x20], al
movzx eax, byte [rsp + 0x20]
movzx eax, al
test eax, eax
je 0x1800833d2
mov dword [rsp + 0x24], 0
jmp 0x180083398
mov eax, dword [rsp + 0x24]
inc eax
mov dword [rsp + 0x24], eax
cmp dword [rsp + 0x24], 0x16
jge 0x1800833d2
movsxd rax, dword [rsp + 0x24]
movzx eax, word [rsp + rax*2 + 0x70]
mov dword [rsp + 0x30], eax
mov eax, dword [rsp + 0x24]
cdq
mov ecx, 3
idiv ecx
mov eax, edx
add eax, 0xa
mov ecx, dword [rsp + 0x30]
xor ecx, eax
mov eax, ecx
movsxd rcx, dword [rsp + 0x24]
mov word [rsp + rcx*2 + 0x70], ax
jmp 0x18008338e
lea rax, [rsp + 0x70]
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
xor r9d, r9d
mov r8, rax
xor edx, edx
xor ecx, ecx
call fcn.180002662
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x48]
mov qword [0x180640e90], rax
mov dword [rsp + 0x28], 0
jmp 0x180083415
mov eax, dword [rsp + 0x28]
inc eax
mov dword [rsp + 0x28], eax
cmp dword [rsp + 0x28], 0x16
jge 0x18008342a
movsxd rax, dword [rsp + 0x28]
xor ecx, ecx
mov word [rsp + rax*2 + 0x70], cx
jmp 0x18008340b
movsd xmm0, qword [rsp + 0xc8]
movsd qword [rsp + 0x60], xmm0
lea rax, [rsp + 0x68]
mov rdi, rax
xor eax, eax
mov ecx, 8
rep stosb byte [rdi], al
mov rax, qword [0x180640e90]
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0xc0]
mov rax, qword [rax]
mov qword [rsp + 0x38], rax
cmp qword [rsp + 0x38], 0
je 0x18008349c
mov eax, 8
imul rax, rax, 0x4f
mov rcx, qword [rsp + 0x38]
mov rax, qword [rcx + rax]
mov qword [rsp + 0x58], rax
lea r8, [rsp + 0x60]
mov rdx, qword [rsp + 0x50]
mov rcx, qword [rsp + 0xc0]
call qword [rsp + 0x58]
nop
movsd xmm0, qword [rsp + 0x68]
add rsp, 0xa8
pop rdi
pop rsi
ret

Function at 0x180003819
Capabilities:
Get geographical location

Disassembly:
jmp 0x1801c9eec
sub rsp, 0x28
call fcn.1800052c7
mov rcx, qword [rax + 0x28]
test rcx, rcx
je 0x1801c9f3e
and dword [rsp + 0x30], 0
lea r8, [rsp + 0x30]
mov r9d, 2
lea edx, [r9 + 0x20]
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
movzx ecx, word [rsp + 0x30]
sub ecx, 0x30
je 0x1801c9f3e
sub ecx, 1
je 0x1801c9f37
cmp ecx, 1
je 0x1801c9f30
xor eax, eax
jmp 0x1801c9f43
mov eax, 3
jmp 0x1801c9f43
mov eax, 1
jmp 0x1801c9f43
mov eax, 2
add rsp, 0x28
ret
Function at 0x18000381e
Capabilities:
Encrypt data using rc4 prga

Disassembly:
jmp 0x180063700
mov qword [rsp + 8], rcx
push rsi
push rdi
sub rsp, 0xa8
cmp qword [0x180640c80], 0
jne 0x180063814
lea rax, [rsp + 0x60]
lea rcx, [0x180288148]
mov rdi, rax
mov rsi, rcx
mov ecx, 0x38
rep movsb byte [rdi], byte [rsi]
mov eax, 2
imul rax, rax, 0x1b
movzx eax, word [rsp + rax + 0x60]
test eax, eax
je 0x180063751
mov dword [rsp + 0x2c], 1
jmp 0x180063759
mov dword [rsp + 0x2c], 0
movzx eax, byte [rsp + 0x2c]
mov byte [rsp + 0x20], al
movzx eax, byte [rsp + 0x20]
movzx eax, al
test eax, eax
je 0x1800637bc
mov dword [rsp + 0x24], 0
jmp 0x180063782
mov eax, dword [rsp + 0x24]
inc eax
mov dword [rsp + 0x24], eax
cmp dword [rsp + 0x24], 0x1c
jge 0x1800637bc
movsxd rax, dword [rsp + 0x24]
movzx eax, word [rsp + rax*2 + 0x60]
mov dword [rsp + 0x30], eax
mov eax, dword [rsp + 0x24]
cdq
mov ecx, 3
idiv ecx
mov eax, edx
add eax, 0xa
mov ecx, dword [rsp + 0x30]
xor ecx, eax
mov eax, ecx
movsxd rcx, dword [rsp + 0x24]
mov word [rsp + rcx*2 + 0x60], ax
jmp 0x180063778
lea rax, [rsp + 0x60]
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
xor r9d, r9d
mov r8, rax
xor edx, edx
xor ecx, ecx
call fcn.180002662
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x48]
mov qword [0x180640c80], rax
mov dword [rsp + 0x28], 0
jmp 0x1800637ff
mov eax, dword [rsp + 0x28]
inc eax
mov dword [rsp + 0x28], eax
cmp dword [rsp + 0x28], 0x1c
jge 0x180063814
movsxd rax, dword [rsp + 0x28]
xor ecx, ecx
mov word [rsp + rax*2 + 0x60], cx
jmp 0x1800637f5
mov rax, qword [0x180640c80]
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0xc0]
mov rax, qword [rax]
mov qword [rsp + 0x38], rax
cmp qword [rsp + 0x38], 0
je 0x180063866
mov eax, 8
imul rax, rax, 0x4f
mov rcx, qword [rsp + 0x38]
mov rax, qword [rcx + rax]
mov qword [rsp + 0x58], rax
lea r8, [rsp + 0x21]
mov rdx, qword [rsp + 0x50]
mov rcx, qword [rsp + 0xc0]
call qword [rsp + 0x58]
nop
movzx eax, byte [rsp + 0x21]
add rsp, 0xa8
pop rdi
pop rsi
ret
Function at 0x1800039b8
Capabilities:
Encrypt data using rc4 prga

Disassembly:
jmp 0x180057ab0
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rsi
push rdi
sub rsp, 0xd8
cmp qword [0x180640f40], 0
jne 0x180057be5
lea rax, [rsp + 0x80]
lea rcx, [0x180289130]
mov rdi, rax
mov rsi, rcx
mov ecx, 0x48
rep movsb byte [rdi], byte [rsi]
mov eax, 2
imul rax, rax, 0x23
movzx eax, word [rsp + rax + 0x80]
test eax, eax
je 0x180057b16
mov dword [rsp + 0x2c], 1
jmp 0x180057b1e
mov dword [rsp + 0x2c], 0
movzx eax, byte [rsp + 0x2c]
mov byte [rsp + 0x20], al
movzx eax, byte [rsp + 0x20]
movzx eax, al
test eax, eax
je 0x180057b87
mov dword [rsp + 0x24], 0
jmp 0x180057b47
mov eax, dword [rsp + 0x24]
inc eax
mov dword [rsp + 0x24], eax
cmp dword [rsp + 0x24], 0x24
jge 0x180057b87
movsxd rax, dword [rsp + 0x24]
movzx eax, word [rsp + rax*2 + 0x80]
mov dword [rsp + 0x30], eax
mov eax, dword [rsp + 0x24]
cdq
mov ecx, 3
idiv ecx
mov eax, edx
add eax, 0xa
mov ecx, dword [rsp + 0x30]
xor ecx, eax
mov eax, ecx
movsxd rcx, dword [rsp + 0x24]
mov word [rsp + rcx*2 + 0x80], ax
jmp 0x180057b3d
lea rax, [rsp + 0x80]
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
xor r9d, r9d
mov r8, rax
xor edx, edx
xor ecx, ecx
call fcn.180002662
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x48]
mov qword [0x180640f40], rax
mov dword [rsp + 0x28], 0
jmp 0x180057bcd
mov eax, dword [rsp + 0x28]
inc eax
mov dword [rsp + 0x28], eax
cmp dword [rsp + 0x28], 0x24
jge 0x180057be5
movsxd rax, dword [rsp + 0x28]
xor ecx, ecx
mov word [rsp + rax*2 + 0x80], cx
jmp 0x180057bc3
mov rax, qword [rsp + 0x100]
mov qword [rsp + 0x60], rax
mov rax, qword [rsp + 0x108]
mov qword [rsp + 0x68], rax
mov qword [rsp + 0x70], 0
mov dword [rsp + 0x7c], 0
mov dword [rsp + 0x78], 0
mov rax, qword [0x180640f40]
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0xf0]
mov rax, qword [rax]
mov qword [rsp + 0x38], rax
cmp qword [rsp + 0x38], 0
je 0x180057c6a
mov eax, 8
imul rax, rax, 0x4f
mov rcx, qword [rsp + 0x38]
mov rax, qword [rcx + rax]
mov qword [rsp + 0x58], rax
lea r8, [rsp + 0x60]
mov rdx, qword [rsp + 0x50]
mov rcx, qword [rsp + 0xf0]
call qword [rsp + 0x58]
nop
lea rax, [rsp + 0x70]
mov rdi, qword [rsp + 0xf8]
mov rsi, rax
mov ecx, 0x10
rep movsb byte [rdi], byte [rsi]
mov rax, qword [rsp + 0xf8]
add rsp, 0xd8
pop rdi
pop rsi
ret
Function at 0x1800039c2
Capabilities:
Encrypt data using rc4 prga

Disassembly:
jmp 0x180065f60
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rsi
push rdi
sub rsp, 0xc8
cmp qword [0x180640760], 0
jne 0x18006607e
lea rax, [rsp + 0x60]
lea rcx, str.Khxey_A9Sn_ocx
mov rdi, rax
mov rsi, rcx
mov ecx, 0x28
rep movsb byte [rdi], byte [rsi]
mov eax, 2
imul rax, rax, 0x13
movzx eax, word [rsp + rax + 0x60]
test eax, eax
je 0x180065fbb
mov dword [rsp + 0x2c], 1
jmp 0x180065fc3
mov dword [rsp + 0x2c], 0
movzx eax, byte [rsp + 0x2c]
mov byte [rsp + 0x20], al
movzx eax, byte [rsp + 0x20]
movzx eax, al
test eax, eax
je 0x180066026
mov dword [rsp + 0x24], 0
jmp 0x180065fec
mov eax, dword [rsp + 0x24]
inc eax
mov dword [rsp + 0x24], eax
cmp dword [rsp + 0x24], 0x14
jge 0x180066026
movsxd rax, dword [rsp + 0x24]
movzx eax, word [rsp + rax*2 + 0x60]
mov dword [rsp + 0x30], eax
mov eax, dword [rsp + 0x24]
cdq
mov ecx, 3
idiv ecx
mov eax, edx
add eax, 0xa
mov ecx, dword [rsp + 0x30]
xor ecx, eax
mov eax, ecx
movsxd rcx, dword [rsp + 0x24]
mov word [rsp + rcx*2 + 0x60], ax
jmp 0x180065fe2
lea rax, [rsp + 0x60]
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
xor r9d, r9d
mov r8, rax
xor edx, edx
xor ecx, ecx
call fcn.180002662
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x48]
mov qword [0x180640760], rax
mov dword [rsp + 0x28], 0
jmp 0x180066069
mov eax, dword [rsp + 0x28]
inc eax
mov dword [rsp + 0x28], eax
cmp dword [rsp + 0x28], 0x14
jge 0x18006607e
movsxd rax, dword [rsp + 0x28]
xor ecx, ecx
mov word [rsp + rax*2 + 0x60], cx
jmp 0x18006605f
lea rax, [rsp + 0x88]
mov rdi, rax
mov rsi, qword [rsp + 0xe8]
mov ecx, 0x18
rep movsb byte [rdi], byte [rsi]
lea rax, [rsp + 0xa0]
mov rdi, rax
mov rsi, qword [rsp + 0xf0]
mov ecx, 0x18
rep movsb byte [rdi], byte [rsi]
lea rax, [rsp + 0xb8]
mov rdi, rax
xor eax, eax
mov ecx, 8
rep stosb byte [rdi], al
mov rax, qword [0x180640760]
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0xe0]
mov rax, qword [rax]
mov qword [rsp + 0x38], rax
cmp qword [rsp + 0x38], 0
je 0x18006611b
mov eax, 8
imul rax, rax, 0x4f
mov rcx, qword [rsp + 0x38]
mov rax, qword [rcx + rax]
mov qword [rsp + 0x58], rax
lea r8, [rsp + 0x88]
mov rdx, qword [rsp + 0x50]
mov rcx, qword [rsp + 0xe0]
call qword [rsp + 0x58]
nop
movzx eax, byte [rsp + 0xb8]
add rsp, 0xc8
pop rdi
pop rsi
ret