joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180030500
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rsi
push rdi
sub rsp, 0xd8
cmp qword [0x18033ed58], 0
jne 0x18003062b
lea rax, [rsp + 0x80]
lea rcx, [0x18006ed90]
mov rdi, rax
mov rsi, rcx
mov ecx, 0x4c
rep movsb byte [rdi], byte [rsi]
mov eax, 2
imul rax, rax, 0x25
movzx eax, word [rsp + rax + 0x80]
test eax, eax
je 0x18003055c
mov dword [rsp + 0x2c], 1
jmp 0x180030564
mov dword [rsp + 0x2c], 0
movzx eax, byte [rsp + 0x2c]
mov byte [rsp + 0x20], al
movzx eax, byte [rsp + 0x20]
movzx eax, al
test eax, eax
je 0x1800305cd
mov dword [rsp + 0x24], 0
jmp 0x18003058d
mov eax, dword [rsp + 0x24]
inc eax
mov dword [rsp + 0x24], eax
cmp dword [rsp + 0x24], 0x26
jge 0x1800305cd
movsxd rax, dword [rsp + 0x24]
movzx eax, word [rsp + rax*2 + 0x80]
mov dword [rsp + 0x30], eax
mov eax, dword [rsp + 0x24]
cdq
mov ecx, 0xb
idiv ecx
mov eax, edx
add eax, 0x67
mov ecx, dword [rsp + 0x30]
xor ecx, eax
mov eax, ecx
movsxd rcx, dword [rsp + 0x24]
mov word [rsp + rcx*2 + 0x80], ax
jmp 0x180030583
lea rax, [rsp + 0x80]
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
xor r9d, r9d
mov r8, rax
xor edx, edx
xor ecx, ecx
call fcn.18003e720
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x48]
mov qword [0x18033ed58], rax
mov dword [rsp + 0x28], 0
jmp 0x180030613
mov eax, dword [rsp + 0x28]
inc eax
mov dword [rsp + 0x28], eax
cmp dword [rsp + 0x28], 0x26
jge 0x18003062b
movsxd rax, dword [rsp + 0x28]
xor ecx, ecx
mov word [rsp + rax*2 + 0x80], cx
jmp 0x180030609
xorps xmm0, xmm0
movsd qword [rsp + 0x60], xmm0
xorps xmm0, xmm0
movsd qword [rsp + 0x68], xmm0
xorps xmm0, xmm0
movsd qword [rsp + 0x70], xmm0
mov rax, qword [0x18033ed58]
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0xf0]
mov rax, qword [rax]
mov qword [rsp + 0x38], rax
cmp qword [rsp + 0x38], 0
je 0x180030698
mov eax, 8
imul rax, rax, 0x4f
mov rcx, qword [rsp + 0x38]
mov rax, qword [rcx + rax]
mov qword [rsp + 0x58], rax
lea r8, [rsp + 0x60]
mov rdx, qword [rsp + 0x50]
mov rcx, qword [rsp + 0xf0]
call qword [rsp + 0x58]
nop
lea rax, [rsp + 0x60]
mov rdi, qword [rsp + 0xf8]
mov rsi, rax
mov ecx, 0x18
rep movsb byte [rdi], byte [rsi]
mov rax, qword [rsp + 0xf8]
add rsp, 0xd8
pop rdi
pop rsi
ret
Function at 0x1800306d0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rsi
push rdi
sub rsp, 0xb8
cmp qword [0x18033efb0], 0
jne 0x1800307e9
lea rax, [rsp + 0x70]
lea rcx, [0x1800703f0]
mov rdi, rax
mov rsi, rcx
mov ecx, 0x3e
rep movsb byte [rdi], byte [rsi]
mov eax, 2
imul rax, rax, 0x1e
movzx eax, word [rsp + rax + 0x70]
test eax, eax
je 0x180030726
mov dword [rsp + 0x2c], 1
jmp 0x18003072e
mov dword [rsp + 0x2c], 0
movzx eax, byte [rsp + 0x2c]
mov byte [rsp + 0x20], al
movzx eax, byte [rsp + 0x20]
movzx eax, al
test eax, eax
je 0x180030791
mov dword [rsp + 0x24], 0
jmp 0x180030757
mov eax, dword [rsp + 0x24]
inc eax
mov dword [rsp + 0x24], eax
cmp dword [rsp + 0x24], 0x1f
jge 0x180030791
movsxd rax, dword [rsp + 0x24]
movzx eax, word [rsp + rax*2 + 0x70]
mov dword [rsp + 0x30], eax
mov eax, dword [rsp + 0x24]
cdq
mov ecx, 0xb
idiv ecx
mov eax, edx
add eax, 0x67
mov ecx, dword [rsp + 0x30]
xor ecx, eax
mov eax, ecx
movsxd rcx, dword [rsp + 0x24]
mov word [rsp + rcx*2 + 0x70], ax
jmp 0x18003074d
lea rax, [rsp + 0x70]
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
xor r9d, r9d
mov r8, rax
xor edx, edx
xor ecx, ecx
call fcn.18003e720
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x48]
mov qword [0x18033efb0], rax
mov dword [rsp + 0x28], 0
jmp 0x1800307d4
mov eax, dword [rsp + 0x28]
inc eax
mov dword [rsp + 0x28], eax
cmp dword [rsp + 0x28], 0x1f
jge 0x1800307e9
movsxd rax, dword [rsp + 0x28]
xor ecx, ecx
mov word [rsp + rax*2 + 0x70], cx
jmp 0x1800307ca
mov rax, qword [rsp + 0xd8]
mov qword [rsp + 0x60], rax
lea rax, [rsp + 0x68]
mov rdi, rax
xor eax, eax
mov ecx, 8
rep stosb byte [rdi], al
mov rax, qword [0x18033efb0]
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0xd0]
mov rax, qword [rax]
mov qword [rsp + 0x38], rax
cmp qword [rsp + 0x38], 0
je 0x180030859
mov eax, 8
imul rax, rax, 0x4f
mov rcx, qword [rsp + 0x38]
mov rax, qword [rcx + rax]
mov qword [rsp + 0x58], rax
lea r8, [rsp + 0x60]
mov rdx, qword [rsp + 0x50]
mov rcx, qword [rsp + 0xd0]
call qword [rsp + 0x58]
nop
movsd xmm0, qword [rsp + 0x68]
add rsp, 0xb8
pop rdi
pop rsi
ret
Function at 0x180030b10
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rcx
push rsi
push rdi
sub rsp, 0xb8
cmp qword [0x18033ee00], 0
jne 0x180030c24
lea rax, [rsp + 0x68]
lea rcx, [0x18006f338]
mov rdi, rax
mov rsi, rcx
mov ecx, 0x3e
rep movsb byte [rdi], byte [rsi]
mov eax, 2
imul rax, rax, 0x1e
movzx eax, word [rsp + rax + 0x68]
test eax, eax
je 0x180030b61
mov dword [rsp + 0x2c], 1
jmp 0x180030b69
mov dword [rsp + 0x2c], 0
movzx eax, byte [rsp + 0x2c]
mov byte [rsp + 0x20], al
movzx eax, byte [rsp + 0x20]
movzx eax, al
test eax, eax
je 0x180030bcc
mov dword [rsp + 0x24], 0
jmp 0x180030b92
mov eax, dword [rsp + 0x24]
inc eax
mov dword [rsp + 0x24], eax
cmp dword [rsp + 0x24], 0x1f
jge 0x180030bcc
movsxd rax, dword [rsp + 0x24]
movzx eax, word [rsp + rax*2 + 0x68]
mov dword [rsp + 0x30], eax
mov eax, dword [rsp + 0x24]
cdq
mov ecx, 0xb
idiv ecx
mov eax, edx
add eax, 0x67
mov ecx, dword [rsp + 0x30]
xor ecx, eax
mov eax, ecx
movsxd rcx, dword [rsp + 0x24]
mov word [rsp + rcx*2 + 0x68], ax
jmp 0x180030b88
lea rax, [rsp + 0x68]
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x48]
xor r9d, r9d
mov r8, rax
xor edx, edx
xor ecx, ecx
call fcn.18003e720
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x50]
mov qword [0x18033ee00], rax
mov dword [rsp + 0x28], 0
jmp 0x180030c0f
mov eax, dword [rsp + 0x28]
inc eax
mov dword [rsp + 0x28], eax
cmp dword [rsp + 0x28], 0x1f
jge 0x180030c24
movsxd rax, dword [rsp + 0x28]
xor ecx, ecx
mov word [rsp + rax*2 + 0x68], cx
jmp 0x180030c05
lea rax, [rsp + 0x40]
mov rdi, rax
xor eax, eax
mov ecx, 8
rep stosb byte [rdi], al
mov rax, qword [0x18033ee00]
mov qword [rsp + 0x58], rax
mov rax, qword [rsp + 0xd0]
mov rax, qword [rax]
mov qword [rsp + 0x38], rax
cmp qword [rsp + 0x38], 0
je 0x180030c87
mov eax, 8
imul rax, rax, 0x4f
mov rcx, qword [rsp + 0x38]
mov rax, qword [rcx + rax]
mov qword [rsp + 0x60], rax
lea r8, [rsp + 0x40]
mov rdx, qword [rsp + 0x58]
mov rcx, qword [rsp + 0xd0]
call qword [rsp + 0x60]
nop
mov rax, qword [rsp + 0x40]
add rsp, 0xb8
pop rdi
pop rsi
ret
Function at 0x180030ca0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rsi
push rdi
sub rsp, 0xa8
cmp qword [0x18033eb28], 0
jne 0x180030db9
lea rax, [rsp + 0x78]
lea rcx, [0x18006e0f8]
mov rdi, rax
mov rsi, rcx
mov ecx, 0x24
rep movsb byte [rdi], byte [rsi]
mov eax, 2
imul rax, rax, 0x11
movzx eax, word [rsp + rax + 0x78]
test eax, eax
je 0x180030cf6
mov dword [rsp + 0x2c], 1
jmp 0x180030cfe
mov dword [rsp + 0x2c], 0
movzx eax, byte [rsp + 0x2c]
mov byte [rsp + 0x20], al
movzx eax, byte [rsp + 0x20]
movzx eax, al
test eax, eax
je 0x180030d61
mov dword [rsp + 0x24], 0
jmp 0x180030d27
mov eax, dword [rsp + 0x24]
inc eax
mov dword [rsp + 0x24], eax
cmp dword [rsp + 0x24], 0x12
jge 0x180030d61
movsxd rax, dword [rsp + 0x24]
movzx eax, word [rsp + rax*2 + 0x78]
mov dword [rsp + 0x30], eax
mov eax, dword [rsp + 0x24]
cdq
mov ecx, 0xb
idiv ecx
mov eax, edx
add eax, 0x67
mov ecx, dword [rsp + 0x30]
xor ecx, eax
mov eax, ecx
movsxd rcx, dword [rsp + 0x24]
mov word [rsp + rcx*2 + 0x78], ax
jmp 0x180030d1d
lea rax, [rsp + 0x78]
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
xor r9d, r9d
mov r8, rax
xor edx, edx
xor ecx, ecx
call fcn.18003e720
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x48]
mov qword [0x18033eb28], rax
mov dword [rsp + 0x28], 0
jmp 0x180030da4
mov eax, dword [rsp + 0x28]
inc eax
mov dword [rsp + 0x28], eax
cmp dword [rsp + 0x28], 0x12
jge 0x180030db9
movsxd rax, dword [rsp + 0x28]
xor ecx, ecx
mov word [rsp + rax*2 + 0x78], cx
jmp 0x180030d9a
xorps xmm0, xmm0
movsd qword [rsp + 0x60], xmm0
xorps xmm0, xmm0
movsd qword [rsp + 0x68], xmm0
xorps xmm0, xmm0
movsd qword [rsp + 0x70], xmm0
mov rax, qword [0x18033eb28]
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0xc0]
mov rax, qword [rax]
mov qword [rsp + 0x38], rax
cmp qword [rsp + 0x38], 0
je 0x180030e26
mov eax, 8
imul rax, rax, 0x4f
mov rcx, qword [rsp + 0x38]
mov rax, qword [rcx + rax]
mov qword [rsp + 0x58], rax
lea r8, [rsp + 0x60]
mov rdx, qword [rsp + 0x50]
mov rcx, qword [rsp + 0xc0]
call qword [rsp + 0x58]
nop
lea rax, [rsp + 0x60]
mov rdi, qword [rsp + 0xc8]
mov rsi, rax
mov ecx, 0x18
rep movsb byte [rdi], byte [rsi]
mov rax, qword [rsp + 0xc8]
add rsp, 0xa8
pop rdi
pop rsi
ret
Function at 0x180030e50
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rcx
push rsi
push rdi
sub rsp, 0xa8
cmp qword [0x18033ed08], 0
jne 0x180030f64
lea rax, [rsp + 0x60]
lea rcx, [0x18006e918]
mov rdi, rax
mov rsi, rcx
mov ecx, 0x34
rep movsb byte [rdi], byte [rsi]
mov eax, 2
imul rax, rax, 0x19
movzx eax, word [rsp + rax + 0x60]
test eax, eax
je 0x180030ea1
mov dword [rsp + 0x2c], 1
jmp 0x180030ea9
mov dword [rsp + 0x2c], 0
movzx eax, byte [rsp + 0x2c]
mov byte [rsp + 0x20], al
movzx eax, byte [rsp + 0x20]
movzx eax, al
test eax, eax
je 0x180030f0c
mov dword [rsp + 0x24], 0
jmp 0x180030ed2
mov eax, dword [rsp + 0x24]
inc eax
mov dword [rsp + 0x24], eax
cmp dword [rsp + 0x24], 0x1a
jge 0x180030f0c
movsxd rax, dword [rsp + 0x24]
movzx eax, word [rsp + rax*2 + 0x60]
mov dword [rsp + 0x30], eax
mov eax, dword [rsp + 0x24]
cdq
mov ecx, 0xb
idiv ecx
mov eax, edx
add eax, 0x67
mov ecx, dword [rsp + 0x30]
xor ecx, eax
mov eax, ecx
movsxd rcx, dword [rsp + 0x24]
mov word [rsp + rcx*2 + 0x60], ax
jmp 0x180030ec8
lea rax, [rsp + 0x60]
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
xor r9d, r9d
mov r8, rax
xor edx, edx
xor ecx, ecx
call fcn.18003e720
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x48]
mov qword [0x18033ed08], rax
mov dword [rsp + 0x28], 0
jmp 0x180030f4f
mov eax, dword [rsp + 0x28]
inc eax
mov dword [rsp + 0x28], eax
cmp dword [rsp + 0x28], 0x1a
jge 0x180030f64
movsxd rax, dword [rsp + 0x28]
xor ecx, ecx
mov word [rsp + rax*2 + 0x60], cx
jmp 0x180030f45
cmp qword [0x18033ed08], 0
je 0x180030fc7
mov rax, qword [0x18033ed08]
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0xc0]
mov rax, qword [rax]
mov qword [rsp + 0x38], rax
cmp qword [rsp + 0x38], 0
je 0x180030fc0
mov eax, 8
imul rax, rax, 0x4f
mov rcx, qword [rsp + 0x38]
mov rax, qword [rcx + rax]
mov qword [rsp + 0x58], rax
lea r8, [rsp + 0x21]
mov rdx, qword [rsp + 0x50]
mov rcx, qword [rsp + 0xc0]
call qword [rsp + 0x58]
nop
movzx eax, byte [rsp + 0x21]
jmp 0x180030fc9
mov al, 5
add rsp, 0xa8
pop rdi
pop rsi
ret
Function at 0x180031130
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rsi
push rdi
sub rsp, 0xc8
cmp qword [0x18033efa8], 0
jne 0x180031249
lea rax, [rsp + 0x70]
lea rcx, [0x1800703a0]
mov rdi, rax
mov rsi, rcx
mov ecx, 0x4a
rep movsb byte [rdi], byte [rsi]
mov eax, 2
imul rax, rax, 0x24
movzx eax, word [rsp + rax + 0x70]
test eax, eax
je 0x180031186
mov dword [rsp + 0x2c], 1
jmp 0x18003118e
mov dword [rsp + 0x2c], 0
movzx eax, byte [rsp + 0x2c]
mov byte [rsp + 0x20], al
movzx eax, byte [rsp + 0x20]
movzx eax, al
test eax, eax
je 0x1800311f1
mov dword [rsp + 0x24], 0
jmp 0x1800311b7
mov eax, dword [rsp + 0x24]
inc eax
mov dword [rsp + 0x24], eax
cmp dword [rsp + 0x24], 0x25
jge 0x1800311f1
movsxd rax, dword [rsp + 0x24]
movzx eax, word [rsp + rax*2 + 0x70]
mov dword [rsp + 0x30], eax
mov eax, dword [rsp + 0x24]
cdq
mov ecx, 0xb
idiv ecx
mov eax, edx
add eax, 0x67
mov ecx, dword [rsp + 0x30]
xor ecx, eax
mov eax, ecx
movsxd rcx, dword [rsp + 0x24]
mov word [rsp + rcx*2 + 0x70], ax
jmp 0x1800311ad
lea rax, [rsp + 0x70]
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
xor r9d, r9d
mov r8, rax
xor edx, edx
xor ecx, ecx
call fcn.18003e720
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x48]
mov qword [0x18033efa8], rax
mov dword [rsp + 0x28], 0
jmp 0x180031234
mov eax, dword [rsp + 0x28]
inc eax
mov dword [rsp + 0x28], eax
cmp dword [rsp + 0x28], 0x25
jge 0x180031249
movsxd rax, dword [rsp + 0x28]
xor ecx, ecx
mov word [rsp + rax*2 + 0x70], cx
jmp 0x18003122a
mov rax, qword [rsp + 0xe8]
mov qword [rsp + 0x60], rax
lea rax, [rsp + 0x68]
mov rdi, rax
xor eax, eax
mov ecx, 8
rep stosb byte [rdi], al
mov rax, qword [0x18033efa8]
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0xe0]
mov rax, qword [rax]
mov qword [rsp + 0x38], rax
cmp qword [rsp + 0x38], 0
je 0x1800312b9
mov eax, 8
imul rax, rax, 0x4f
mov rcx, qword [rsp + 0x38]
mov rax, qword [rcx + rax]
mov qword [rsp + 0x58], rax
lea r8, [rsp + 0x60]
mov rdx, qword [rsp + 0x50]
mov rcx, qword [rsp + 0xe0]
call qword [rsp + 0x58]
nop
movsd xmm0, qword [rsp + 0x68]
add rsp, 0xc8
pop rdi
pop rsi
ret
Function at 0x1800314b0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rcx
push rsi
push rdi
sub rsp, 0xa8
cmp qword [0x18033ee48], 0
jne 0x1800315c4
lea rax, [rsp + 0x60]
lea rcx, [0x18006f660]
mov rdi, rax
mov rsi, rcx
mov ecx, 0x38
rep movsb byte [rdi], byte [rsi]
mov eax, 2
imul rax, rax, 0x1b
movzx eax, word [rsp + rax + 0x60]
test eax, eax
je 0x180031501
mov dword [rsp + 0x2c], 1
jmp 0x180031509
mov dword [rsp + 0x2c], 0
movzx eax, byte [rsp + 0x2c]
mov byte [rsp + 0x20], al
movzx eax, byte [rsp + 0x20]
movzx eax, al
test eax, eax
je 0x18003156c
mov dword [rsp + 0x24], 0
jmp 0x180031532
mov eax, dword [rsp + 0x24]
inc eax
mov dword [rsp + 0x24], eax
cmp dword [rsp + 0x24], 0x1c
jge 0x18003156c
movsxd rax, dword [rsp + 0x24]
movzx eax, word [rsp + rax*2 + 0x60]
mov dword [rsp + 0x30], eax
mov eax, dword [rsp + 0x24]
cdq
mov ecx, 0xb
idiv ecx
mov eax, edx
add eax, 0x67
mov ecx, dword [rsp + 0x30]
xor ecx, eax
mov eax, ecx
movsxd rcx, dword [rsp + 0x24]
mov word [rsp + rcx*2 + 0x60], ax
jmp 0x180031528
lea rax, [rsp + 0x60]
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
xor r9d, r9d
mov r8, rax
xor edx, edx
xor ecx, ecx
call fcn.18003e720
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x48]
mov qword [0x18033ee48], rax
mov dword [rsp + 0x28], 0
jmp 0x1800315af
mov eax, dword [rsp + 0x28]
inc eax
mov dword [rsp + 0x28], eax
cmp dword [rsp + 0x28], 0x1c
jge 0x1800315c4
movsxd rax, dword [rsp + 0x28]
xor ecx, ecx
mov word [rsp + rax*2 + 0x60], cx
jmp 0x1800315a5
mov rax, qword [0x18033ee48]
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0xc0]
mov rax, qword [rax]
mov qword [rsp + 0x38], rax
cmp qword [rsp + 0x38], 0
je 0x180031616
mov eax, 8
imul rax, rax, 0x4f
mov rcx, qword [rsp + 0x38]
mov rax, qword [rcx + rax]
mov qword [rsp + 0x58], rax
lea r8, [rsp + 0x21]
mov rdx, qword [rsp + 0x50]
mov rcx, qword [rsp + 0xc0]
call qword [rsp + 0x58]
nop
movzx eax, byte [rsp + 0x21]
add rsp, 0xa8
pop rdi
pop rsi
ret
Function at 0x1800317e0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rcx
push rsi
push rdi
sub rsp, 0xd8
cmp qword [0x18033ed00], 0
jne 0x1800318f4
lea rax, [rsp + 0x60]
lea rcx, [0x18006e880]
mov rdi, rax
mov rsi, rcx
mov ecx, 0x70
rep movsb byte [rdi], byte [rsi]
mov eax, 2
imul rax, rax, 0x37
movzx eax, word [rsp + rax + 0x60]
test eax, eax
je 0x180031831
mov dword [rsp + 0x2c], 1
jmp 0x180031839
mov dword [rsp + 0x2c], 0
movzx eax, byte [rsp + 0x2c]
mov byte [rsp + 0x21], al
movzx eax, byte [rsp + 0x21]
movzx eax, al
test eax, eax
je 0x18003189c
mov dword [rsp + 0x24], 0
jmp 0x180031862
mov eax, dword [rsp + 0x24]
inc eax
mov dword [rsp + 0x24], eax
cmp dword [rsp + 0x24], 0x38
jge 0x18003189c
movsxd rax, dword [rsp + 0x24]
movzx eax, word [rsp + rax*2 + 0x60]
mov dword [rsp + 0x30], eax
mov eax, dword [rsp + 0x24]
cdq
mov ecx, 0xb
idiv ecx
mov eax, edx
add eax, 0x67
mov ecx, dword [rsp + 0x30]
xor ecx, eax
mov eax, ecx
movsxd rcx, dword [rsp + 0x24]
mov word [rsp + rcx*2 + 0x60], ax
jmp 0x180031858
lea rax, [rsp + 0x60]
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
xor r9d, r9d
mov r8, rax
xor edx, edx
xor ecx, ecx
call fcn.18003e720
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x48]
mov qword [0x18033ed00], rax
mov dword [rsp + 0x28], 0
jmp 0x1800318df
mov eax, dword [rsp + 0x28]
inc eax
mov dword [rsp + 0x28], eax
cmp dword [rsp + 0x28], 0x38
jge 0x1800318f4
movsxd rax, dword [rsp + 0x28]
xor ecx, ecx
mov word [rsp + rax*2 + 0x60], cx
jmp 0x1800318d5
mov byte [rsp + 0x20], 1
mov rax, qword [0x18033ed00]
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0xf0]
mov rax, qword [rax]
mov qword [rsp + 0x38], rax
cmp qword [rsp + 0x38], 0
je 0x18003194b
mov eax, 8
imul rax, rax, 0x4f
mov rcx, qword [rsp + 0x38]
mov rax, qword [rcx + rax]
mov qword [rsp + 0x58], rax
lea r8, [rsp + 0x20]
mov rdx, qword [rsp + 0x50]
mov rcx, qword [rsp + 0xf0]
call qword [rsp + 0x58]
nop
movzx eax, byte [rsp + 0x20]
add rsp, 0xd8
pop rdi
pop rsi
ret
Function at 0x180031cc0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rcx
push rsi
push rdi
sub rsp, 0xa8
cmp qword [0x18033ecb0], 0
jne 0x180031dd4
lea rax, [rsp + 0x70]
lea rcx, [0x18006e520]
mov rdi, rax
mov rsi, rcx
mov ecx, 0x26
rep movsb byte [rdi], byte [rsi]
mov eax, 2
imul rax, rax, 0x12
movzx eax, word [rsp + rax + 0x70]
test eax, eax
je 0x180031d11
mov dword [rsp + 0x2c], 1
jmp 0x180031d19
mov dword [rsp + 0x2c], 0
movzx eax, byte [rsp + 0x2c]
mov byte [rsp + 0x21], al
movzx eax, byte [rsp + 0x21]
movzx eax, al
test eax, eax
je 0x180031d7c
mov dword [rsp + 0x24], 0
jmp 0x180031d42
mov eax, dword [rsp + 0x24]
inc eax
mov dword [rsp + 0x24], eax
cmp dword [rsp + 0x24], 0x13
jge 0x180031d7c
movsxd rax, dword [rsp + 0x24]
movzx eax, word [rsp + rax*2 + 0x70]
mov dword [rsp + 0x30], eax
mov eax, dword [rsp + 0x24]
cdq
mov ecx, 0xb
idiv ecx
mov eax, edx
add eax, 0x67
mov ecx, dword [rsp + 0x30]
xor ecx, eax
mov eax, ecx
movsxd rcx, dword [rsp + 0x24]
mov word [rsp + rcx*2 + 0x70], ax
jmp 0x180031d38
lea rax, [rsp + 0x70]
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x50]
xor r9d, r9d
mov r8, rax
xor edx, edx
xor ecx, ecx
call fcn.18003e720
mov qword [rsp + 0x58], rax
mov rax, qword [rsp + 0x58]
mov qword [0x18033ecb0], rax
mov dword [rsp + 0x28], 0
jmp 0x180031dbf
mov eax, dword [rsp + 0x28]
inc eax
mov dword [rsp + 0x28], eax
cmp dword [rsp + 0x28], 0x13
jge 0x180031dd4
movsxd rax, dword [rsp + 0x28]
xor ecx, ecx
mov word [rsp + rax*2 + 0x70], cx
jmp 0x180031db5
cmp qword [0x18033ecb0], 0
je 0x180031e73
mov qword [rsp + 0x40], 0
mov dword [rsp + 0x4c], 0
mov dword [rsp + 0x48], 0
mov rax, qword [0x18033ecb0]
mov qword [rsp + 0x60], rax
mov rax, qword [rsp + 0xc0]
mov rax, qword [rax]
mov qword [rsp + 0x38], rax
cmp qword [rsp + 0x38], 0
je 0x180031e4d
mov eax, 8
imul rax, rax, 0x4f
mov rcx, qword [rsp + 0x38]
mov rax, qword [rcx + rax]
mov qword [rsp + 0x68], rax
lea r8, [rsp + 0x40]
mov rdx, qword [rsp + 0x60]
mov rcx, qword [rsp + 0xc0]
call qword [rsp + 0x68]
nop
cmp qword [rsp + 0x40], 0
je 0x180031e5c
mov byte [rsp + 0x20], 1
jmp 0x180031e61
mov byte [rsp + 0x20], 0
movzx eax, byte [rsp + 0x20]
mov byte [rsp + 0x22], al
movzx eax, byte [rsp + 0x22]
jmp 0x180031e75
mov al, 1
add rsp, 0xa8
pop rdi
pop rsi
ret
Function at 0x180031ef0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rcx
push rsi
push rdi
sub rsp, 0x88
cmp qword [0x18033ede0], 0
jne 0x180032004
lea rax, [rsp + 0x60]
lea rcx, [0x18006f270]
mov rdi, rax
mov rsi, rcx
mov ecx, 0x20
rep movsb byte [rdi], byte [rsi]
mov eax, 2
imul rax, rax, 0xf
movzx eax, word [rsp + rax + 0x60]
test eax, eax
je 0x180031f41
mov dword [rsp + 0x2c], 1
jmp 0x180031f49
mov dword [rsp + 0x2c], 0
movzx eax, byte [rsp + 0x2c]
mov byte [rsp + 0x21], al
movzx eax, byte [rsp + 0x21]
movzx eax, al
test eax, eax
je 0x180031fac
mov dword [rsp + 0x24], 0
jmp 0x180031f72
mov eax, dword [rsp + 0x24]
inc eax
mov dword [rsp + 0x24], eax
cmp dword [rsp + 0x24], 0x10
jge 0x180031fac
movsxd rax, dword [rsp + 0x24]
movzx eax, word [rsp + rax*2 + 0x60]
mov dword [rsp + 0x30], eax
mov eax, dword [rsp + 0x24]
cdq
mov ecx, 0xb
idiv ecx
mov eax, edx
add eax, 0x67
mov ecx, dword [rsp + 0x30]
xor ecx, eax
mov eax, ecx
movsxd rcx, dword [rsp + 0x24]
mov word [rsp + rcx*2 + 0x60], ax
jmp 0x180031f68
lea rax, [rsp + 0x60]
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
xor r9d, r9d
mov r8, rax
xor edx, edx
xor ecx, ecx
call fcn.18003e720
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x48]
mov qword [0x18033ede0], rax
mov dword [rsp + 0x28], 0
jmp 0x180031fef
mov eax, dword [rsp + 0x28]
inc eax
mov dword [rsp + 0x28], eax
cmp dword [rsp + 0x28], 0x10
jge 0x180032004
movsxd rax, dword [rsp + 0x28]
xor ecx, ecx
mov word [rsp + rax*2 + 0x60], cx
jmp 0x180031fe5
lea rax, [rsp + 0x20]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
mov rax, qword [0x18033ede0]
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0xa0]
mov rax, qword [rax]
mov qword [rsp + 0x38], rax
cmp qword [rsp + 0x38], 0
je 0x180032067
mov eax, 8
imul rax, rax, 0x4f
mov rcx, qword [rsp + 0x38]
mov rax, qword [rcx + rax]
mov qword [rsp + 0x58], rax
lea r8, [rsp + 0x20]
mov rdx, qword [rsp + 0x50]
mov rcx, qword [rsp + 0xa0]
call qword [rsp + 0x58]
nop
movzx eax, byte [rsp + 0x20]
add rsp, 0x88
pop rdi
pop rsi
ret
Function at 0x180032080
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rcx
push rsi
push rdi
sub rsp, 0x88
cmp qword [0x18033edd0], 0
jne 0x180032194
lea rax, [rsp + 0x60]
lea rcx, [0x18006f1f8]
mov rdi, rax
mov rsi, rcx
mov ecx, 0x20
rep movsb byte [rdi], byte [rsi]
mov eax, 2
imul rax, rax, 0xf
movzx eax, word [rsp + rax + 0x60]
test eax, eax
je 0x1800320d1
mov dword [rsp + 0x2c], 1
jmp 0x1800320d9
mov dword [rsp + 0x2c], 0
movzx eax, byte [rsp + 0x2c]
mov byte [rsp + 0x21], al
movzx eax, byte [rsp + 0x21]
movzx eax, al
test eax, eax
je 0x18003213c
mov dword [rsp + 0x24], 0
jmp 0x180032102
mov eax, dword [rsp + 0x24]
inc eax
mov dword [rsp + 0x24], eax
cmp dword [rsp + 0x24], 0x10
jge 0x18003213c
movsxd rax, dword [rsp + 0x24]
movzx eax, word [rsp + rax*2 + 0x60]
mov dword [rsp + 0x30], eax
mov eax, dword [rsp + 0x24]
cdq
mov ecx, 0xb
idiv ecx
mov eax, edx
add eax, 0x67
mov ecx, dword [rsp + 0x30]
xor ecx, eax
mov eax, ecx
movsxd rcx, dword [rsp + 0x24]
mov word [rsp + rcx*2 + 0x60], ax
jmp 0x1800320f8
lea rax, [rsp + 0x60]
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
xor r9d, r9d
mov r8, rax
xor edx, edx
xor ecx, ecx
call fcn.18003e720
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x48]
mov qword [0x18033edd0], rax
mov dword [rsp + 0x28], 0
jmp 0x18003217f
mov eax, dword [rsp + 0x28]
inc eax
mov dword [rsp + 0x28], eax
cmp dword [rsp + 0x28], 0x10
jge 0x180032194
movsxd rax, dword [rsp + 0x28]
xor ecx, ecx
mov word [rsp + rax*2 + 0x60], cx
jmp 0x180032175
lea rax, [rsp + 0x20]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
mov rax, qword [0x18033edd0]
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0xa0]
mov rax, qword [rax]
mov qword [rsp + 0x38], rax
cmp qword [rsp + 0x38], 0
je 0x1800321f7
mov eax, 8
imul rax, rax, 0x4f
mov rcx, qword [rsp + 0x38]
mov rax, qword [rcx + rax]
mov qword [rsp + 0x58], rax
lea r8, [rsp + 0x20]
mov rdx, qword [rsp + 0x50]
mov rcx, qword [rsp + 0xa0]
call qword [rsp + 0x58]
nop
movzx eax, byte [rsp + 0x20]
add rsp, 0x88
pop rdi
pop rsi
ret