joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1801b8170
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
movsxd r10, dword [rdx + 8]
lea rbx, [rcx - 1]
movsxd rcx, dword [r8 + 8]
xor rcx, r10
shr rbx, 0x3f
movsxd rsi, r9d
dec rbx
lea eax, [rsi - 1]
mov r11, r8
and rcx, rbx
mov rdi, rdx
xor r10d, ecx
mov dword [rdx + 8], r10d
xor dword [r8 + 8], ecx
cmp eax, 9
ja case.default.0x1801b81c7
lea rdx, [0x180000000]
cdqe
mov ecx, dword [rdx + rax*4 + 0x1b8370]
add rcx, rdx
jmp rcx
mov r9d, 0xa
cmp r9, rsi
jge case.0x1801b81c7.10
nop word [rax + rax]
mov rax, qword [r11]
mov r8, qword [rdi]
inc r9
mov rcx, qword [r8 + r9*8 - 8]
mov rdx, qword [rax + r9*8 - 8]
xor rdx, rcx
and rdx, rbx
xor rcx, rdx
mov qword [r8 + r9*8 - 8], rcx
mov rax, qword [r11]
xor qword [rax + r9*8 - 8], rdx
cmp r9, rsi
jl 0x1801b81e0
mov rax, qword [r11]
mov r8, qword [rdi]
mov rcx, qword [r8 + 0x48]
mov rdx, qword [rax + 0x48]
xor rdx, rcx
and rdx, rbx
xor rcx, rdx
mov qword [r8 + 0x48], rcx
mov rax, qword [r11]
xor qword [rax + 0x48], rdx
mov rax, qword [r11]
mov r8, qword [rdi]
mov rcx, qword [r8 + 0x40]
mov rdx, qword [rax + 0x40]
xor rdx, rcx
and rdx, rbx
xor rcx, rdx
mov qword [r8 + 0x40], rcx
mov rax, qword [r11]
xor qword [rax + 0x40], rdx
mov rax, qword [r11]
mov r8, qword [rdi]
mov rcx, qword [r8 + 0x38]
mov rdx, qword [rax + 0x38]
xor rdx, rcx
and rdx, rbx
xor rcx, rdx
mov qword [r8 + 0x38], rcx
mov rax, qword [r11]
xor qword [rax + 0x38], rdx
mov rax, qword [r11]
mov r8, qword [rdi]
mov rcx, qword [r8 + 0x30]
mov rdx, qword [rax + 0x30]
xor rdx, rcx
and rdx, rbx
xor rcx, rdx
mov qword [r8 + 0x30], rcx
mov rax, qword [r11]
xor qword [rax + 0x30], rdx
mov rax, qword [r11]
mov r8, qword [rdi]
mov rcx, qword [r8 + 0x28]
mov rdx, qword [rax + 0x28]
xor rdx, rcx
and rdx, rbx
xor rcx, rdx
mov qword [r8 + 0x28], rcx
mov rax, qword [r11]
xor qword [rax + 0x28], rdx
mov rax, qword [r11]
mov r8, qword [rdi]
mov rcx, qword [r8 + 0x20]
mov rdx, qword [rax + 0x20]
xor rdx, rcx
and rdx, rbx
xor rcx, rdx
mov qword [r8 + 0x20], rcx
mov rax, qword [r11]
xor qword [rax + 0x20], rdx
mov rax, qword [r11]
mov r8, qword [rdi]
mov rcx, qword [r8 + 0x18]
mov rdx, qword [rax + 0x18]
xor rdx, rcx
and rdx, rbx
xor rcx, rdx
mov qword [r8 + 0x18], rcx
mov rax, qword [r11]
xor qword [rax + 0x18], rdx
mov rax, qword [r11]
mov r8, qword [rdi]
mov rcx, qword [r8 + 0x10]
mov rdx, qword [rax + 0x10]
xor rdx, rcx
and rdx, rbx
xor rcx, rdx
mov qword [r8 + 0x10], rcx
mov rax, qword [r11]
xor qword [rax + 0x10], rdx
mov rax, qword [r11]
mov r8, qword [rdi]
mov rcx, qword [r8 + 8]
mov rdx, qword [rax + 8]
xor rdx, rcx
and rdx, rbx
xor rcx, rdx
mov qword [r8 + 8], rcx
mov rax, qword [r11]
xor qword [rax + 8], rdx
mov r8, qword [rdi]
mov rax, qword [r11]
mov rsi, qword [rsp + 0x10]
mov rdx, qword [r8]
mov rcx, qword [rax]
mov rdi, qword [rsp + 0x18]
xor rcx, rdx
and rcx, rbx
mov rbx, qword [rsp + 8]
xor rdx, rcx
mov qword [r8], rdx
mov rax, qword [r11]
xor qword [rax], rcx
ret
Function at 0x1801bb620
Capabilities:
Generate random numbers via winapi
Get memory capacity

Disassembly:
push rbx
mov eax, 0xe0
call fcn.18014c9d0
sub rsp, rax
movaps xmmword [rsp + 0xd0], xmm6
mov rax, qword [0x1803b0b00]
xor rax, rsp
mov qword [rsp + 0xc0], rax
lea rcx, [rsp + 0x30]
mov r9d, 1
xor r8d, r8d
xor edx, edx
mov dword [rsp + 0x20], 0xf0000040
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
mov ebx, 0x40
movsd xmm6, qword [0x1802c7588]
test eax, eax
je 0x1801bb6bf
mov rcx, qword [rsp + 0x30]
lea r8, [rsp + 0x80]
mov edx, ebx
call qword [sym.imp.ADVAPI32.dll_CryptGenRandom]
test eax, eax
je 0x1801bb6b2
pxor xmm2, xmm2
cvtsi2sd xmm2, rbx
test rbx, rbx
jns 0x1801bb6a3
addsd xmm2, xmm6
lea rcx, [rsp + 0x80]
mov edx, ebx
call fcn.1801a0a70
mov rcx, qword [rsp + 0x30]
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
lea r8, str.Intel_Hardware_Cryptographic_Service_Provider
lea rcx, [rsp + 0x30]
mov r9d, socket
xor edx, edx
mov dword [rsp + 0x20], 0xf0000040
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
je 0x1801bb72c
mov rcx, qword [rsp + 0x30]
lea r8, [rsp + 0x80]
mov edx, ebx
call qword [sym.imp.ADVAPI32.dll_CryptGenRandom]
test eax, eax
je 0x1801bb71f
pxor xmm2, xmm2
cvtsi2sd xmm2, rbx
test rbx, rbx
jns 0x1801bb710
addsd xmm2, xmm6
lea rcx, [rsp + 0x80]
mov edx, ebx
call fcn.1801a0a70
mov rcx, qword [rsp + 0x30]
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
cmp dword [0x1803b40f0], 0
xorpd xmm6, xmm6
je 0x1801bb76c
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
test eax, eax
jne 0x1801bb750
mov dword [0x1803b40f0], eax
jmp 0x1801bb76c
lea rcx, [rsp + 0x40]
movapd xmm2, xmm6
mov edx, 8
call fcn.1801a0a70
cmp dword [0x1803b40f0], 0
jne 0x1801bb789
call qword [sym.imp.KERNEL32.dll_GetTickCount]
lea rcx, [rsp + 0x3c]
movapd xmm2, xmm6
mov edx, 4
mov dword [rsp + 0x3c], eax
call fcn.1801a0a70
lea rcx, [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_GlobalMemoryStatus]
lea rcx, [rsp + 0x48]
mov edx, gethostname
movsd xmm2, qword [0x1802c9880]
call fcn.1801a0a70
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
lea rcx, [rsp + 0x38]
movsd xmm2, qword [0x1802c9880]
mov edx, 4
mov dword [rsp + 0x38], eax
call fcn.1801a0a70
mov eax, 1
mov rcx, qword [rsp + 0xc0]
xor rcx, rsp
call fcn.180146c80
movaps xmm6, xmmword [rsp + 0xd0]
add rsp, 0xe0
pop rbx
ret
Function at 0x1801bd440
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
mov eax, 0x40
call fcn.18014c9d0
sub rsp, rax
mov rdi, qword [rcx + 0x70]
movsxd rcx, dword [rdi + 0x70]
mov rsi, r9
lea r12, [rdi + 0x70]
mov rbx, r8
mov rbp, rdx
mov qword [rsp + 0x30], r12
test ecx, ecx
je 0x1801bd4c1
mov rdx, rcx
test r9, r9
je 0x1801bd49f
nop word [rax + rax]
cmp ecx, 0x40
jae 0x1801bd49f
movzx eax, byte [rdx + rdi + 0x30]
inc rbp
inc ecx
xor al, byte [rbx]
inc rdx
inc rbx
dec rsi
mov byte [rbp - 1], al
jne 0x1801bd480
mov dword [r12], ecx
test rsi, rsi
je 0x1801bd5e5
cmp ecx, 0x40
jne 0x1801bd4c1
inc dword [rdi + 0x20]
mov dword [r12], 0
jne 0x1801bd4c1
inc dword [rdi + 0x24]
mov qword [rsp + 0x78], r13
mov qword [rsp + 0x80], r14
mov r14d, dword [rdi + 0x20]
mov qword [rsp + 0x88], r15
mov r15d, esi
lea rax, [rdi + 0x20]
and r15d, 0x3f
mov r13d, r15d
mov dword [rsp + 0x70], r15d
sub rsi, r13
cmp rsi, 0x40
jb 0x1801bd565
mov r15d, 0x10000000
lea r13, [rdi + 0x20]
mov r12, rsi
shr r12, 6
cmp r12, r15
cmova r12, r15
add r14d, r12d
mov eax, r14d
cmp rax, r12
jae 0x1801bd51f
sub r12, rax
xor r14d, r14d
shl r12, 6
mov r9, rdi
mov rdx, rbx
mov rcx, rbp
mov r8, r12
mov qword [rsp + 0x20], r13
call fcn.1801d7080
sub rsi, r12
add rbx, r12
add rbp, r12
mov dword [r13], r14d
test r14d, r14d
jne 0x1801bd54e
inc dword [rdi + 0x24]
cmp rsi, 0x40
jae 0x1801bd500
mov r15d, dword [rsp + 0x70]
mov r12, qword [rsp + 0x30]
lea rax, [rdi + 0x20]
mov r13d, r15d
mov r14, qword [rsp + 0x80]
test r15d, r15d
je 0x1801bd5d8
xor edx, edx
lea rcx, [rdi + 0x30]
mov r9, rdi
mov qword [rcx], rdx
mov qword [rcx + 8], rdx
mov qword [rcx + 0x10], rdx
mov qword [rcx + 0x18], rdx
mov qword [rcx + 0x20], rdx
mov qword [rcx + 0x28], rdx
mov qword [rcx + 0x30], rdx
lea r8d, [rdx + 0x40]
mov qword [rcx + 0x38], rdx
mov rdx, rcx
mov qword [rsp + 0x20], rax
call fcn.1801d7080
test r15d, r15d
je 0x1801bd5d4
sub rdi, rbx
sub rbp, rbx
nop word [rax + rax]
movzx eax, byte [rdi + rbx + 0x30]
inc rbx
xor al, byte [rbx - 1]
dec r13
mov byte [rbx + rbp - 1], al
jne 0x1801bd5c0
mov dword [r12], r15d
mov r15, qword [rsp + 0x88]
mov r13, qword [rsp + 0x78]
mov eax, 1
add rsp, 0x40
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x1801c67d0
Capabilities:
Hash data using sha1

Disassembly:
push rbx
mov eax, 0x20
call fcn.18014c9d0
sub rsp, rax
lea r8d, [rax + 0x40]
xor edx, edx
mov rbx, rcx
call fcn.18014af80
mov dword [rbx], 0x67452301
mov dword [rbx + 4], 0xefcdab89
mov dword [rbx + 8], 0x98badcfe
mov dword [rbx + 0xc], 0x10325476
mov dword [rbx + 0x10], 0xc3d2e1f0
mov eax, 1
add rsp, 0x20
pop rbx
ret

Function at 0x1801d5f50
Capabilities:
Hash data using sha256

Disassembly:
push rbx
mov eax, 0x20
call fcn.18014c9d0
sub rsp, rax
lea r8d, [rax + 0x50]
xor edx, edx
mov rbx, rcx
call fcn.18014af80
mov dword [rbx], 0x6a09e667
mov dword [rbx + 4], 0xbb67ae85
mov dword [rbx + 8], 0x3c6ef372
mov dword [rbx + 0xc], 0xa54ff53a
mov dword [rbx + 0x10], 0x510e527f
mov dword [rbx + 0x14], 0x9b05688c
mov dword [rbx + 0x18], 0x1f83d9ab
mov dword [rbx + 0x1c], 0x5be0cd19
mov dword [rbx + 0x6c], 0x20
mov eax, 1
add rsp, 0x20
pop rbx
ret
Function at 0x1801ffbc0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov rbp, rsp
mov eax, 0x50
call fcn.18014c9d0
sub rsp, rax
mov rax, qword [0x1803b0b00]
xor rax, rsp
mov qword [rbp - 8], rax
mov rax, qword [rbp + 0x60]
mov r15, qword [rbp + 0x68]
mov r12d, r8d
movzx r10d, byte [rax]
movzx r8d, byte [rax + 4]
mov ebx, dword [r15]
lea rdi, [rax + 1]
mov qword [rbp - 0x18], rax
shl r10d, 0x18
movzx eax, byte [rdi]
mov rsi, rcx
movzx ecx, byte [rdi + 5]
shl eax, 0x10
shl r8d, 0x18
shl ecx, 8
or r10d, eax
movzx eax, byte [rdi + 1]
mov r14, rdx
shl eax, 8
lea rdx, [rdi + 5]
xor r13d, r13d
or r10d, eax
movzx eax, byte [rdi + 2]
mov qword [rbp - 0x28], r9
or r10d, eax
movzx eax, byte [rdi + 4]
mov qword [rbp - 0x20], r15
shl eax, 0x10
mov dword [rbp - 0x30], r10d
mov byte [rbp - 0xd], r10b
or r8d, eax
movzx eax, byte [rdx + 1]
or ecx, eax
mov eax, r10d
shr eax, 0x18
or r8d, ecx
mov byte [rbp - 0x10], al
mov eax, r10d
mov dword [rbp - 0x2c], r8d
shr eax, 0x10
mov byte [rbp - 9], r8b
mov byte [rbp - 0xf], al
mov eax, r10d
shr eax, 8
mov byte [rbp - 0xe], al
mov eax, r8d
shr eax, 0x18
mov byte [rbp - 0xc], al
mov eax, r8d
shr eax, 0x10
mov byte [rbp - 0xb], al
mov eax, r8d
shr eax, 8
mov byte [rbp - 0xa], al
test r12d, r12d
je 0x1801ffd86
mov r15, qword [rbp - 0x28]
sub r14, rsi
movzx edx, r8b
movzx r9d, r10b
nop dword [rax]
dec r12d
test ebx, ebx
jne 0x1801ffd23
lea rcx, [rbp - 0x30]
mov rdx, r15
call fcn.1801fe960
mov r10d, dword [rbp - 0x30]
mov r8d, dword [rbp - 0x2c]
mov eax, r10d
movzx edx, r8b
movzx r9d, r10b
shr eax, 0x18
mov byte [rbp - 0xd], r10b
mov byte [rbp - 9], dl
mov byte [rbp - 0x10], al
mov eax, r10d
shr eax, 0x10
mov byte [rbp - 0xf], al
mov eax, r10d
shr eax, 8
mov byte [rbp - 0xe], al
mov eax, r8d
shr eax, 0x18
mov byte [rbp - 0xc], al
mov eax, r8d
shr eax, 0x10
mov byte [rbp - 0xb], al
mov eax, r8d
shr eax, 8
inc r13d
mov byte [rbp - 0xa], al
movsxd rax, ebx
inc rsi
movzx ecx, byte [rbp + rax - 0x10]
xor cl, byte [rsi - 1]
inc ebx
mov byte [r14 + rsi - 1], cl
and ebx, 7
test r12d, r12d
jne 0x1801ffcc0
mov r15, qword [rbp - 0x20]
test r13d, r13d
je 0x1801ffd86
mov rcx, qword [rbp - 0x18]
mov eax, r10d
shr eax, 0x18
mov byte [rcx], al
mov eax, r10d
shr r10d, 8
shr eax, 0x10
mov byte [rdi], al
mov byte [rdi + 1], r10b
mov byte [rdi + 2], r9b
mov eax, r8d
shr eax, 0x18
mov byte [rdi + 3], al
mov eax, r8d
shr eax, 0x10
shr r8d, 8
mov byte [rdi + 4], al
mov byte [rdi + 5], r8b
mov byte [rdi + 6], dl
mov dword [r15], ebx
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.180146c80
mov rbx, qword [rsp + 0x90]
add rsp, 0x50
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x180202320
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov rbp, rsp
mov eax, 0x50
call fcn.18014c9d0
sub rsp, rax
mov rax, qword [0x1803b0b00]
xor rax, rsp
mov qword [rbp - 8], rax
mov rax, qword [rbp + 0x60]
mov r15, qword [rbp + 0x68]
mov r12d, r8d
movzx r10d, byte [rax]
movzx r8d, byte [rax + 4]
mov ebx, dword [r15]
lea rdi, [rax + 1]
mov qword [rbp - 0x18], rax
shl r10d, 0x18
movzx eax, byte [rdi]
mov rsi, rcx
movzx ecx, byte [rdi + 5]
shl eax, 0x10
shl r8d, 0x18
shl ecx, 8
or r10d, eax
movzx eax, byte [rdi + 1]
mov r14, rdx
shl eax, 8
lea rdx, [rdi + 5]
xor r13d, r13d
or r10d, eax
movzx eax, byte [rdi + 2]
mov qword [rbp - 0x28], r9
or r10d, eax
movzx eax, byte [rdi + 4]
mov qword [rbp - 0x20], r15
shl eax, 0x10
mov dword [rbp - 0x30], r10d
mov byte [rbp - 0xd], r10b
or r8d, eax
movzx eax, byte [rdx + 1]
or ecx, eax
mov eax, r10d
shr eax, 0x18
or r8d, ecx
mov byte [rbp - 0x10], al
mov eax, r10d
mov dword [rbp - 0x2c], r8d
shr eax, 0x10
mov byte [rbp - 9], r8b
mov byte [rbp - 0xf], al
mov eax, r10d
shr eax, 8
mov byte [rbp - 0xe], al
mov eax, r8d
shr eax, 0x18
mov byte [rbp - 0xc], al
mov eax, r8d
shr eax, 0x10
mov byte [rbp - 0xb], al
mov eax, r8d
shr eax, 8
mov byte [rbp - 0xa], al
test r12d, r12d
je 0x1802024e6
mov r15, qword [rbp - 0x28]
sub r14, rsi
movzx edx, r8b
movzx r9d, r10b
nop dword [rax]
dec r12d
test ebx, ebx
jne 0x180202483
lea rcx, [rbp - 0x30]
mov rdx, r15
call fcn.180201130
mov r10d, dword [rbp - 0x30]
mov r8d, dword [rbp - 0x2c]
mov eax, r10d
movzx edx, r8b
movzx r9d, r10b
shr eax, 0x18
mov byte [rbp - 0xd], r10b
mov byte [rbp - 9], dl
mov byte [rbp - 0x10], al
mov eax, r10d
shr eax, 0x10
mov byte [rbp - 0xf], al
mov eax, r10d
shr eax, 8
mov byte [rbp - 0xe], al
mov eax, r8d
shr eax, 0x18
mov byte [rbp - 0xc], al
mov eax, r8d
shr eax, 0x10
mov byte [rbp - 0xb], al
mov eax, r8d
shr eax, 8
inc r13d
mov byte [rbp - 0xa], al
movsxd rax, ebx
inc rsi
movzx ecx, byte [rbp + rax - 0x10]
xor cl, byte [rsi - 1]
inc ebx
mov byte [r14 + rsi - 1], cl
and ebx, 7
test r12d, r12d
jne 0x180202420
mov r15, qword [rbp - 0x20]
test r13d, r13d
je 0x1802024e6
mov rcx, qword [rbp - 0x18]
mov eax, r10d
shr eax, 0x18
mov byte [rcx], al
mov eax, r10d
shr r10d, 8
shr eax, 0x10
mov byte [rdi], al
mov byte [rdi + 1], r10b
mov byte [rdi + 2], r9b
mov eax, r8d
shr eax, 0x18
mov byte [rdi + 3], al
mov eax, r8d
shr eax, 0x10
shr r8d, 8
mov byte [rdi + 4], al
mov byte [rdi + 5], r8b
mov byte [rdi + 6], dl
mov dword [r15], ebx
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.180146c80
mov rbx, qword [rsp + 0x90]
add rsp, 0x50
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x180202510
Capabilities:
Encode data using xor
Encrypt data using blowfish
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
mov eax, 0x20
call fcn.18014c9d0
sub rsp, rax
mov ebx, edx
mov rsi, r8
lea rdx, [0x18033f970]
mov r8d, 0x1048
mov rdi, rcx
call fcn.180147850
mov eax, 0x48
mov rdx, rsi
cmp ebx, eax
cmovg ebx, eax
movsxd r8, ebx
add r8, rsi
xor ebx, ebx
mov r9d, ebx
nop word [rax + rax]
movzx ecx, byte [rdx]
inc rdx
cmp rdx, r8
cmovae rdx, rsi
shl ecx, 8
movzx eax, byte [rdx]
inc rdx
or ecx, eax
cmp rdx, r8
cmovae rdx, rsi
shl ecx, 8
movzx eax, byte [rdx]
inc rdx
or ecx, eax
cmp rdx, r8
cmovae rdx, rsi
shl ecx, 8
movzx eax, byte [rdx]
inc rdx
or ecx, eax
cmp rdx, r8
cmovae rdx, rsi
xor dword [rdi + r9*4], ecx
inc r9
cmp r9, 0x12
jl 0x180202560
mov qword [rsp + 0x30], rbx
mov rsi, rbx
nop dword [rax + rax]
lea rcx, [rsp + 0x30]
mov rdx, rdi
call fcn.180201130
mov eax, dword [rsp + 0x30]
add rsi, 2
mov dword [rdi + rsi*4 - 8], eax
mov eax, dword [rsp + 0x34]
mov dword [rdi + rsi*4 - 4], eax
cmp rsi, 0x12
jl 0x1802025c0
nop word [rax + rax]
lea rcx, [rsp + 0x30]
mov rdx, rdi
call fcn.180201130
mov eax, dword [rsp + 0x30]
add rbx, 2
mov dword [rdi + rbx*4 + 0x40], eax
mov eax, dword [rsp + 0x34]
mov dword [rdi + rbx*4 + 0x44], eax
cmp rbx, 0x400
jl 0x1802025f0
mov rbx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x180203180
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov rbp, rsp
mov eax, 0x50
call fcn.18014c9d0
sub rsp, rax
mov rax, qword [0x1803b0b00]
xor rax, rsp
mov qword [rbp - 8], rax
mov rax, qword [rbp + 0x60]
mov r15, qword [rbp + 0x68]
mov rsi, rcx
movzx r10d, byte [rax]
mov ebx, dword [r15]
lea rdi, [rax + 1]
movzx ecx, byte [rdi + 6]
mov qword [rbp - 0x18], rax
movzx eax, byte [rdi]
shl eax, 8
mov r14, rdx
movzx edx, byte [rdi + 3]
or r10d, eax
movzx eax, byte [rdi + 1]
shl ecx, 8
shl eax, 0x10
mov r12d, r8d
lea r8, [rdi + 5]
or r10d, eax
movzx eax, byte [rdi + 2]
xor r13d, r13d
shl eax, 0x18
mov qword [rbp - 0x28], r9
mov qword [rbp - 0x20], r15
or r10d, eax
movzx eax, byte [rdi + 4]
shl eax, 8
mov dword [rbp - 0x30], r10d
mov byte [rbp - 0x10], r10b
or edx, eax
movzx eax, byte [r8]
or ecx, eax
mov eax, r10d
shr eax, 8
shl ecx, 0x10
mov byte [rbp - 0xf], al
or edx, ecx
mov eax, r10d
shr eax, 0x10
mov dword [rbp - 0x2c], edx
mov byte [rbp - 0xc], dl
mov byte [rbp - 0xe], al
mov eax, r10d
shr eax, 0x18
mov byte [rbp - 0xd], al
mov eax, edx
shr eax, 8
mov byte [rbp - 0xb], al
mov eax, edx
shr eax, 0x10
mov byte [rbp - 0xa], al
mov eax, edx
shr eax, 0x18
mov byte [rbp - 9], al
test r12d, r12d
je 0x180203334
mov r15, qword [rbp - 0x28]
sub r14, rsi
movzx r8d, dl
movzx r9d, r10b
dec r12d
test ebx, ebx
jne 0x1802032d4
lea rcx, [rbp - 0x30]
mov rdx, r15
call fcn.180202630
mov r10d, dword [rbp - 0x30]
mov edx, dword [rbp - 0x2c]
movzx r9d, byte [rbp - 0x30]
movzx r8d, byte [rbp - 0x2c]
mov eax, r10d
shr eax, 8
mov byte [rbp - 0x10], r9b
mov byte [rbp - 0xc], r8b
mov byte [rbp - 0xf], al
mov eax, r10d
shr eax, 0x10
mov byte [rbp - 0xe], al
mov eax, r10d
shr eax, 0x18
mov byte [rbp - 0xd], al
mov eax, edx
shr eax, 8
mov byte [rbp - 0xb], al
mov eax, edx
shr eax, 0x10
mov byte [rbp - 0xa], al
mov eax, edx
shr eax, 0x18
inc r13d
mov byte [rbp - 9], al
movsxd rax, ebx
inc rsi
movzx ecx, byte [rbp + rax - 0x10]
xor cl, byte [rsi - 1]
inc ebx
mov byte [r14 + rsi - 1], cl
and ebx, 7
test r12d, r12d
jne 0x180203272
mov r15, qword [rbp - 0x20]
test r13d, r13d
je 0x180203334
mov rax, qword [rbp - 0x18]
mov byte [rax], r9b
mov eax, r10d
shr eax, 8
mov byte [rdi], al
mov eax, r10d
shr r10d, 0x18
shr eax, 0x10
mov byte [rdi + 1], al
mov byte [rdi + 2], r10b
mov byte [rdi + 3], r8b
mov eax, edx
shr eax, 8
mov byte [rdi + 4], al
mov eax, edx
shr eax, 0x10
shr edx, 0x18
mov byte [rdi + 5], al
mov byte [rdi + 6], dl
mov dword [r15], ebx
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.180146c80
mov rbx, qword [rsp + 0x90]
add rsp, 0x50
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x180203360
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
mov edi, 0x80
mov r10, rcx
mov byte [rcx], 0
cmp edx, edi
mov ebx, 0x400
cmovg edx, edi
test r9d, r9d
jle 0x180203393
cmp r9d, ebx
cmovg r9d, ebx
mov ebx, r9d
movsxd r9, edx
test edx, edx
jle 0x1802033b0
sub r8, r10
mov rdx, r9
movzx eax, byte [r8 + rcx]
inc rcx
dec rdx
mov byte [rcx - 1], al
jne 0x1802033a0
movzx ecx, byte [r9 + r10 - 1]
lea rdx, [r9 + r10]
lea rsi, [0x1803409c0]
cmp r9, rdi
jge 0x1802033f9
mov r11, r9
mov r8, rdi
neg r11
sub r8, r9
nop word [rax + rax]
movzx eax, byte [rdx + r11]
inc rdx
add eax, ecx
dec r8
movzx ecx, al
movzx ecx, byte [rcx + rsi]
mov byte [rdx - 1], cl
jne 0x1802033e0
lea edx, [rbx + 7]
neg ebx
mov eax, 0xff
sar edx, 3
and ebx, 7
sub edi, edx
movzx ecx, bl
movsxd r11, edx
sar eax, cl
movsxd r9, edi
mov ecx, eax
lea r8, [r9 + r10]
movzx eax, byte [r8]
and rcx, rax
movzx eax, byte [rcx + rsi]
mov byte [r8], al
test edi, edi
je 0x180203448
nop
movzx ecx, byte [r8 + r11 - 1]
dec r8
xor rcx, rax
dec r9
movzx eax, byte [rcx + rsi]
mov byte [r8], al
jne 0x180203430
lea r8, [r10 + 0xfc]
lea rdx, [r10 + 0x7e]
mov r9d, 0x40
nop dword [rax]
movzx eax, byte [rdx]
movzx ecx, byte [rdx + 1]
sub r8, 4
shl ecx, 8
sub rdx, 2
or ecx, eax
dec r9
movzx eax, cx
mov dword [r8 + 4], eax
jne 0x180203460
mov rbx, qword [rsp + 8]
mov rsi, qword [rsp + 0x10]
mov rdi, qword [rsp + 0x18]
ret
Function at 0x180206c20
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov rbp, rsp
mov eax, 0x50
call fcn.18014c9d0
sub rsp, rax
mov rax, qword [0x1803b0b00]
xor rax, rsp
mov qword [rbp - 8], rax
mov rax, qword [rbp + 0x60]
mov r15, qword [rbp + 0x68]
mov r12d, r8d
movzx r10d, byte [rax]
movzx r8d, byte [rax + 4]
mov ebx, dword [r15]
lea rdi, [rax + 1]
mov qword [rbp - 0x18], rax
shl r10d, 0x18
movzx eax, byte [rdi]
mov rsi, rcx
movzx ecx, byte [rdi + 5]
shl eax, 0x10
shl r8d, 0x18
shl ecx, 8
or r10d, eax
movzx eax, byte [rdi + 1]
mov r14, rdx
shl eax, 8
lea rdx, [rdi + 5]
xor r13d, r13d
or r10d, eax
movzx eax, byte [rdi + 2]
mov qword [rbp - 0x28], r9
or r10d, eax
movzx eax, byte [rdi + 4]
mov qword [rbp - 0x20], r15
shl eax, 0x10
mov dword [rbp - 0x30], r10d
mov byte [rbp - 0xd], r10b
or r8d, eax
movzx eax, byte [rdx + 1]
or ecx, eax
mov eax, r10d
shr eax, 0x18
or r8d, ecx
mov byte [rbp - 0x10], al
mov eax, r10d
mov dword [rbp - 0x2c], r8d
shr eax, 0x10
mov byte [rbp - 9], r8b
mov byte [rbp - 0xf], al
mov eax, r10d
shr eax, 8
mov byte [rbp - 0xe], al
mov eax, r8d
shr eax, 0x18
mov byte [rbp - 0xc], al
mov eax, r8d
shr eax, 0x10
mov byte [rbp - 0xb], al
mov eax, r8d
shr eax, 8
mov byte [rbp - 0xa], al
test r12d, r12d
je 0x180206de6
mov r15, qword [rbp - 0x28]
sub r14, rsi
movzx edx, r8b
movzx r9d, r10b
nop dword [rax]
dec r12d
test ebx, ebx
jne 0x180206d83
lea rcx, [rbp - 0x30]
mov rdx, r15
call fcn.180205e90
mov r10d, dword [rbp - 0x30]
mov r8d, dword [rbp - 0x2c]
mov eax, r10d
movzx edx, r8b
movzx r9d, r10b
shr eax, 0x18
mov byte [rbp - 0xd], r10b
mov byte [rbp - 9], dl
mov byte [rbp - 0x10], al
mov eax, r10d
shr eax, 0x10
mov byte [rbp - 0xf], al
mov eax, r10d
shr eax, 8
mov byte [rbp - 0xe], al
mov eax, r8d
shr eax, 0x18
mov byte [rbp - 0xc], al
mov eax, r8d
shr eax, 0x10
mov byte [rbp - 0xb], al
mov eax, r8d
shr eax, 8
inc r13d
mov byte [rbp - 0xa], al
movsxd rax, ebx
inc rsi
movzx ecx, byte [rbp + rax - 0x10]
xor cl, byte [rsi - 1]
inc ebx
mov byte [r14 + rsi - 1], cl
and ebx, 7
test r12d, r12d
jne 0x180206d20
mov r15, qword [rbp - 0x20]
test r13d, r13d
je 0x180206de6
mov rcx, qword [rbp - 0x18]
mov eax, r10d
shr eax, 0x18
mov byte [rcx], al
mov eax, r10d
shr r10d, 8
shr eax, 0x10
mov byte [rdi], al
mov byte [rdi + 1], r10b
mov byte [rdi + 2], r9b
mov eax, r8d
shr eax, 0x18
mov byte [rdi + 3], al
mov eax, r8d
shr eax, 0x10
shr r8d, 8
mov byte [rdi + 4], al
mov byte [rdi + 5], r8b
mov byte [rdi + 6], dl
mov dword [r15], ebx
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.180146c80
mov rbx, qword [rsp + 0x90]
add rsp, 0x50
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret