joyce8/EMBER2024-capa huggingface dataset:
Function at 0x18009b080
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 8
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
mov qword [rsp + 0x28], rdi
mov qword [rsp], r12
xor bpl, bpl
xor r12b, r12b
xor di, di
test edx, edx
mov rbx, r8
mov r11d, edx
mov rsi, rcx
jle 0x18009b127
movzx ecx, r12b
movzx eax, bpl
movsx r9, di
inc eax
inc di
cdq
movzx edx, dl
add eax, edx
movzx eax, al
sub eax, edx
movzx r10d, al
mov ebp, eax
movzx eax, byte [r10 + rbx]
add eax, ecx
cdq
movzx edx, dl
add eax, edx
movzx eax, al
sub eax, edx
movzx edx, byte [r10 + rbx]
movzx r8d, al
mov r12d, eax
movzx eax, dl
movzx ecx, byte [r8 + rbx]
mov byte [r10 + rbx], cl
mov byte [r8 + rbx], dl
movzx ecx, byte [r10 + rbx]
add eax, ecx
cdq
movzx edx, dl
add eax, edx
movzx eax, al
sub eax, edx
movzx ecx, al
movzx eax, byte [rcx + rbx]
xor byte [r9 + rsi], al
movsx eax, di
cmp eax, r11d
jl 0x18009b0b2
mov r12, qword [rsp]
mov rdi, qword [rsp + 0x28]
mov rsi, qword [rsp + 0x20]
mov rbp, qword [rsp + 0x18]
mov rbx, qword [rsp + 0x10]
add rsp, 8
ret

Function at 0x18009b150
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x20], rdi
mov r10, r8
mov rdi, rcx
mov ebx, edx
xor ax, ax
mov r9, r8
nop
nop
mov byte [r9], al
inc ax
inc r9
cmp ax, 0x100
jl 0x18009b170
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
xor bpl, bpl
xor sil, sil
mov r9, r8
mov r11d, 0x100
nop
nop
movzx ecx, byte [r9]
movzx eax, bpl
inc r9
movzx eax, byte [rax + rdi]
sub eax, ecx
movzx ecx, sil
add eax, ecx
cdq
movzx edx, dl
add eax, edx
movzx eax, al
sub eax, edx
movzx edx, byte [r9 - 1]
movzx r8d, al
mov esi, eax
movzx eax, bpl
movzx ecx, byte [r8 + r10]
inc eax
mov byte [r9 - 1], cl
mov byte [r8 + r10], dl
cdq
idiv ebx
dec r11
mov ebp, edx
jne 0x18009b1a0
mov rdi, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x18]
mov rbp, qword [rsp + 0x10]
mov rbx, qword [rsp + 8]
ret

Function at 0x18009bb60
Capabilities:
Encode data using xor

Disassembly:
push rbx
xor r9w, r9w
test edx, edx
mov r10, rcx
je 0x18009bbc4
mov r11d, edx
lea rbx, [0x18014bff0]
nop
nop
nop
movzx r8d, byte [r10]
mov dl, r9b
shr r9w, 4
mov al, r8b
and edx, 0xf
shr r8, 4
movzx ecx, word [rbx + rdx*4]
and eax, 0xf
inc r10
xor cx, word [rbx + rax*4]
xor cx, r9w
mov al, cl
shr cx, 4
and eax, 0xf
movzx r9d, word [rbx + rax*4]
xor r9w, word [rbx + r8*4]
xor r9w, cx
dec r11
jne 0x18009bb80
mov ax, r9w
pop rbx
ret
Function at 0x1800a0300
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x58
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x68], rbp
mov qword [rsp + 0x70], rsi
mov qword [rsp + 0x78], rdi
mov rdi, rcx
mov ecx, dword [r9]
mov rbx, r9
mov ebp, r8d
mov rsi, rdx
call fcn.1800cda80
test eax, eax
jne 0x1800a0452
mov ecx, dword [rbx + 4]
cmp ecx, 1
jl 0x1800a046b
cmp ecx, 0x80
jg 0x1800a046b
xor edx, edx
mov eax, ebp
div ecx
test edx, edx
mov r8d, eax
jne 0x1800a046b
test cl, 3
jne 0x1800a046b
movsxd rax, dword [rbx]
mov qword [rsp + 0x48], r13
lea r13, [0x180238060]
lea rcx, [rax + rax*4]
shl rcx, 5
mov r10, qword [rcx + r13 + 0x60]
test r10, r10
je 0x1800a03a5
lea rax, [rbx + 0x88]
lea r9, [rbx + 8]
mov rdx, rsi
mov rcx, rdi
mov qword [rsp + 0x20], rax
call r10
jmp 0x1800a044d
test ebp, ebp
mov qword [rsp + 0x50], r12
je 0x1800a0446
nop
nop
nop
nop
movsxd rax, dword [rbx]
lea r8, [rbx + 0x88]
lea rdx, [rsp + 0x30]
lea r9, [rax + rax*4]
mov rcx, rdi
shl r9, 5
call qword [r9 + r13 + gethostbyname]
test eax, eax
jne 0x1800a0448
xor r8d, r8d
cmp dword [rbx + 4], r8d
jle 0x1800a0433
lea r10, [rsp + 0x30]
mov r11, rsi
lea r9, [rbx + 8]
sub r10, rdi
sub r11, rdi
mov rdx, rdi
nop
nop
nop
nop
mov ecx, dword [r10 + rdx]
mov eax, dword [rdx]
add r8d, 4
xor ecx, dword [r9]
mov dword [r9], eax
add rdx, 4
mov dword [r11 + rdx - 4], ecx
add r9, 4
cmp r8d, dword [rbx + 4]
jl 0x1800a0410
movsxd rax, dword [rbx + 4]
add rdi, rax
add rsi, rax
sub ebp, dword [rbx + 4]
jne 0x1800a03c0
xor eax, eax
mov r12, qword [rsp + 0x50]
mov r13, qword [rsp + 0x48]
mov rdi, qword [rsp + 0x78]
mov rsi, qword [rsp + 0x70]
mov rbp, qword [rsp + 0x68]
mov rbx, qword [rsp + 0x60]
add rsp, 0x58
ret
mov eax, reloc.WSOCK32.dll_shutdown
jmp 0x1800a0452

Function at 0x1800a04d0
Capabilities:
Check mutex on windows

Disassembly:
sub rsp, 0x28
cmp dword [reloc.WSOCK32.dll_accept], 0
je 0x1800a0522
lea rcx, [0x1801b3530]
xor edx, edx
mov r8d, 0x7a000
mov dword [reloc.WSOCK32.dll_accept], 0
call fcn.18000abd0
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexA]
mov edx, 0xffffffff
mov rcx, rax
mov qword [0x1801b3520], rax
add rsp, 0x28
jmp qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rax, qword [0x1801b3520]
mov edx, 0xffffffff
mov rcx, rax
add rsp, 0x28
jmp qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
Function at 0x1800a1050
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x48
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x58], rbp
mov qword [rsp + 0x60], rsi
mov rsi, rcx
mov ecx, dword [r9]
mov qword [rsp + 0x68], rdi
mov rbx, r9
mov ebp, r8d
mov rdi, rdx
call fcn.1800cda80
test eax, eax
jne 0x1800a11ae
mov r9d, dword [rbx + 4]
cmp r9d, 1
jl 0x1800a11c7
cmp r9d, 0x80
jg 0x1800a11c7
xor edx, edx
mov eax, ebp
div r9d
test edx, edx
mov r8d, eax
jne 0x1800a11c7
test r9b, 3
jne 0x1800a11c7
movsxd rax, dword [rbx]
mov qword [rsp + 0x30], r14
lea r14, [0x180238060]
lea rcx, [rax + rax*4]
shl rcx, 5
mov r10, qword [rcx + r14 + 0x58]
test r10, r10
je 0x1800a10fa
lea rax, [rbx + 0x88]
lea r9, [rbx + 8]
mov rdx, rdi
mov rcx, rsi
mov qword [rsp + 0x20], rax
call r10
jmp 0x1800a11a9
test ebp, ebp
mov qword [rsp + 0x40], r12
mov qword [rsp + 0x38], r13
je 0x1800a119d
nop
xor r8d, r8d
test r9d, r9d
jle 0x1800a1137
lea rcx, [rbx + 8]
mov rdx, rsi
nop
mov eax, dword [rdx]
add r8d, 4
add rcx, 4
xor dword [rcx - 4], eax
add rdx, 4
cmp r8d, dword [rbx + 4]
jl 0x1800a1120
movsxd rax, dword [rbx]
lea r8, [rbx + 0x88]
lea rcx, [rbx + 8]
lea r9, [rax + rax*4]
mov rdx, rdi
shl r9, 5
call qword [r9 + r14 + 0x28]
test eax, eax
jne 0x1800a119f
xor ecx, ecx
cmp dword [rbx + 4], ecx
jle 0x1800a1186
lea rdx, [rbx + 8]
mov r8, rdi
nop
nop
nop
mov eax, dword [r8]
add ecx, 4
add rdx, 4
mov dword [rdx - 4], eax
add r8, 4
cmp ecx, dword [rbx + 4]
jl 0x1800a1170
movsxd rax, dword [rbx + 4]
mov r9d, dword [rbx + 4]
add rdi, rax
add rsi, rax
sub ebp, r9d
jne 0x1800a1110
xor eax, eax
mov r13, qword [rsp + 0x38]
mov r12, qword [rsp + 0x40]
mov r14, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x50]
add rsp, 0x48
ret
mov eax, reloc.WSOCK32.dll_shutdown
jmp 0x1800a11ae

Function at 0x1800a1a50
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
xor eax, eax
test rdx, rdx
je 0x1800a1a75
nop
nop
nop
movzx r8d, byte [rcx]
imul eax, eax, 0x1000193
inc rcx
xor eax, r8d
dec rdx
jne 0x1800a1a60
ret 0
Function at 0x1800ac350
Capabilities:
Allocate thread local storage
Set thread local storage value

Disassembly:
push rbx
sub rsp, 0x20
mov eax, dword [0x18014ea80]
movsxd rbx, ecx
cmp eax, 0xffffffff
jne 0x1800ac370
call qword [sym.imp.KERNEL32.dll_TlsAlloc]
mov dword [0x18014ea80], eax
mov rdx, rbx
mov ecx, eax
add rsp, 0x20
pop rbx
jmp qword [sym.imp.KERNEL32.dll_TlsSetValue]

Function at 0x1800ac390
Capabilities:
Allocate thread local storage
Get thread local storage value
Set thread local storage value

Disassembly:
jmp 0x1800ac390
sub rsp, 0x28
mov ecx, dword [0x18014ea80]
cmp ecx, 0xffffffff
jne 0x1800ac3bb
call qword [sym.imp.KERNEL32.dll_TlsAlloc]
xor edx, edx
mov ecx, eax
mov dword [0x18014ea80], eax
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
mov ecx, dword [0x18014ea80]
add rsp, 0x28
jmp qword [sym.imp.KERNEL32.dll_TlsGetValue]
Function at 0x1800b52c0
Capabilities:
Encode data using xor

Disassembly:
rol dx, 1
mov r8d, reloc.WSOCK32.dll_shutdown
mov word [rsp + 0x10], dx
xor byte [rsp + 0x11], dl
movzx eax, dl
movzx eax, word [rsp + 0x10]
lea rdx, [rcx + 4]
ror ax, 1
ror ax, 1
mov word [rsp + 0x10], ax
nop
nop
movzx eax, byte [rsp + 0x11]
movzx ecx, byte [rsp + 0x10]
add rdx, 8
rol cl, 1
ror al, 1
xor al, cl
mov byte [rsp + 0x10], cl
mov byte [rsp + 0x11], al
movzx eax, word [rsp + 0x10]
not ax
xor word [rdx - 0xc], ax
add ax, 0x55
mov word [rsp + 0x10], ax
movzx ecx, al
movzx eax, byte [rsp + 0x11]
rol cl, 1
ror al, 1
xor al, cl
mov byte [rsp + 0x10], cl
mov byte [rsp + 0x11], al
movzx eax, word [rsp + 0x10]
not ax
xor word [rdx - 0xa], ax
add ax, 0x55
mov word [rsp + 0x10], ax
movzx ecx, al
movzx eax, byte [rsp + 0x11]
rol cl, 1
ror al, 1
xor al, cl
mov byte [rsp + 0x10], cl
mov byte [rsp + 0x11], al
movzx eax, word [rsp + 0x10]
not ax
xor word [rdx - 8], ax
add ax, 0x55
mov word [rsp + 0x10], ax
movzx ecx, al
movzx eax, byte [rsp + 0x11]
rol cl, 1
ror al, 1
xor al, cl
mov byte [rsp + 0x10], cl
mov byte [rsp + 0x11], al
movzx eax, word [rsp + 0x10]
not ax
xor word [rdx - 6], ax
add ax, 0x55
dec r8
mov word [rsp + 0x10], ax
jne 0x1800b52f0
ret
Function at 0x1800b7ec0
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x430
mov rbx, rcx
lea rcx, [rsp + 0x30]
xor edx, edx
mov r8d, 0x400
call fcn.18000abd0
lea rdx, [0x18022e8a0]
lea rcx, [rsp + 0x30]
mov r8d, 0xa5
call fcn.180005f30
movzx r11d, byte [0x18022e8a0]
movzx eax, r11b
and al, 0xf
movzx r10d, al
nop
nop
nop
xor dl, dl
mov r9w, 0xa4
lea r8, [rsp + 0xd4]
nop
movzx ecx, byte [r8]
movzx eax, dl
dec r8
movzx edx, cl
add cl, cl
or cl, al
shr dl, 7
add r9w, 0xffff
mov byte [r8 + 1], cl
jne 0x1800b7f20
test dl, dl
je 0x1800b7f4c
or byte [rsp + 0xd4], 1
movzx eax, r10w
add r10w, 0xffff
test ax, ax
jne 0x1800b7f10
xor cx, cx
nop
movzx eax, cx
inc cx
xor byte [rsp + rax + 0x31], r11b
cmp cx, 0xa4
jb 0x1800b7f60
inc dword [0x18022f3cc]
xor eax, eax
lea rcx, [rbx + 1]
lea r8, [0x18022ea8c]
mov qword [0x18022ea88], rax
mov qword [0x18022ea90], rax
mov word [0x18022ea88], 2
lea edx, [rax + 4]
sub r8, rcx
nop
nop
nop
nop
movzx eax, byte [rcx]
inc rcx
dec rdx
mov byte [r8 + rcx - 1], al
jne 0x1800b7fb0
movzx ecx, word [0x18014ed30]
mov eax, 0x1db
test cx, cx
cmove cx, ax
mov word [0x18014ed30], cx
call qword [0x18022eaa8]
mov rcx, qword [0x18022eae0]
mov word [0x18022ea8a], ax
lea rax, [0x18022ea88]
lea rdx, [rsp + 0x30]
xor r9d, r9d
mov r8d, 0xa5
mov dword [rsp + 0x28], setsockopt
mov qword [rsp + 0x20], rax
call qword [0x18022e460]
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_Sleep]
add rsp, 0x430
pop rbx
ret
Function at 0x1800b8030
Capabilities:
Encode data using xor

Disassembly:
mov rax, rsp
sub rsp, 0x438
inc dword [0x18022f3cc]
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
movzx ebp, word [rdx + 6]
mov rbx, rdx
mov qword [rax + 0x20], rdi
xor eax, eax
add ebp, 8
lea rdx, [0x18022ea8c]
inc rcx
mov edi, 4
mov qword [0x18022ea88], rax
sub rdx, rcx
mov qword [0x18022ea90], rax
mov word [0x18022ea88], 2
mov r8, rdi
nop
nop
nop
movzx eax, byte [rcx]
inc rcx
dec r8
mov byte [rdx + rcx - 1], al
jne 0x1800b8090
movzx ecx, word [0x18014ed30]
mov eax, 0x1db
mov qword [rsp + 0x450], rsi
test cx, cx
cmove cx, ax
mov word [0x18014ed30], cx
call qword [0x18022eaa8]
test ebp, ebp
mov word [0x18022ea8a], ax
movsxd rsi, ebp
je 0x1800b80e5
lea rcx, [rsp + 0x30]
mov r8, rsi
mov rdx, rbx
call fcn.180005f30
cmp word [rsp + 0x34], 0x135
jne 0x1800b8185
movzx eax, word [rsp + 0x32]
lea r11, [rsp + 0x38]
mov ebx, gethostname
add eax, 0x22030000
nop
nop
nop
mov r9d, dword [r11 + 4]
mov r8d, dword [r11]
mov r10d, setsockopt
nop
mov dl, al
mov ecx, r9d
and dx, 0xf
jbe 0x1800b8146
nop
nop
bt ecx, 0x1f
jae 0x1800b813d
add ecx, ecx
or ecx, 1
jmp 0x1800b813f
add ecx, ecx
add dx, 0xffff
jne 0x1800b8130
xor r8d, ecx
mov cx, 2
xor r8d, eax
mov edx, r8d
test al, 1
je 0x1800b815f
shr eax, 1
bts eax, 0x1f
jmp 0x1800b8161
shr eax, 1
add cx, 0xffff
jne 0x1800b8153
dec r10
mov r8d, r9d
mov r9d, edx
jne 0x1800b8120
mov dword [r11 + 4], edx
mov dword [r11], r8d
add r11, 8
inc eax
dec rbx
jne 0x1800b8110
cmp rdi, rsi
movzx eax, byte [rsp + 0x32]
mov rbx, qword [rsp + 0x440]
lea r8, str._.C
movzx edx, byte [rax + r8]
jge 0x1800b81b9
movzx ecx, dl
inc rdi
inc edx
movzx eax, byte [rcx + r8]
xor byte [rsp + rdi + 0x2f], al
cmp rdi, rsi
jl 0x1800b81a3
mov rcx, qword [0x18022eae0]
lea rax, [0x18022ea88]
lea rdx, [rsp + 0x30]
xor r9d, r9d
mov r8d, ebp
mov dword [rsp + 0x28], setsockopt
mov qword [rsp + 0x20], rax
call qword [0x18022e460]
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_Sleep]
mov rdi, qword [rsp + 0x458]
mov rsi, qword [rsp + 0x450]
mov rbp, qword [rsp + 0x448]
add rsp, 0x438
ret
Function at 0x1800b82b0
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x28
test edx, edx
mov rax, qword [rcx]
mov qword [rsp + 0x40], rbx
mov qword [0x18022f3f8], rax
mov eax, dword [rcx + 8]
mov qword [rsp + 0x48], rdi
mov dword [0x18022f400], eax
movzx eax, byte [rcx + 0xc]
mov ebx, edx
mov byte [0x18022f404], al
mov rdi, rcx
je 0x1800b82eb
inc word [0x18014ed04]
cmp byte [rcx], 8
je 0x1800b830e
mov dword [0x18022f414], 0xa
mov eax, 0xfffffef1
mov rdi, qword [rsp + 0x48]
mov rbx, qword [rsp + 0x40]
add rsp, 0x28
ret
movzx ecx, word [0x18022f3c8]
call qword [0x18022eaa8]
test ebx, ebx
mov word [0x18022e8df], ax
je 0x1800b832b
call fcn.1800b7c00
movzx eax, byte [0x18022e8a1]
cmp al, 0x31
je 0x1800b843c
cmp al, 0x62
je 0x1800b843c
cmp al, 0x60
je 0x1800b843c
lea rcx, [0x18022e9d0]
xor edx, edx
mov r8d, 0xad
call fcn.18000abd0
movzx eax, word [0x18014ed04]
lea rdx, [0x18022e8a0]
lea rcx, [0x18022e9d8]
mov r8d, 0xa5
mov word [0x18022e9d2], ax
mov word [0x18022e9d0], 0x2309
mov word [0x18022e9d4], 0x12c
mov word [0x18022e9d6], 0xa5
call fcn.180005f30
movzx r11d, byte [0x18022e8a0]
lea rbx, [0x18022ea7c]
movzx eax, r11b
and al, 0xf
movzx r10d, al
nop
nop
xor dl, dl
mov r9w, 0xa4
mov r8, rbx
nop
nop
movzx ecx, byte [r8]
movzx eax, dl
dec r8
movzx edx, cl
add cl, cl
or cl, al
shr dl, 7
add r9w, 0xffff
mov byte [r8 + 1], cl
jne 0x1800b83d0
test dl, dl
je 0x1800b83fb
or byte [0x18022ea7c], 1
movzx eax, r10w
add r10w, 0xffff
test ax, ax
jne 0x1800b83c0
lea rax, [0x18022e9d9]
mov ecx, 0xa4
nop
nop
nop
xor byte [rax], r11b
inc rax
dec rcx
jne 0x1800b8420
lea rdx, [0x18022e9d0]
mov rcx, rdi
call fcn.1800b8030
jmp 0x1800b8444
mov rcx, rdi
call fcn.1800b7ec0
mov rdi, qword [rsp + 0x48]
mov rbx, qword [rsp + 0x40]
mov dword [0x18022f414], 0
xor eax, eax
add rsp, 0x28
ret
Function at 0x1800c3710
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
mov rax, rsp
sub rsp, 0x78
mov qword [rax - 8], rbx
mov qword [rax - 0x18], rsi
mov qword [rax - 0x20], rdi
mov qword [rax - 0x28], r12
mov rdi, r8
xor ebx, ebx
mov qword [rax - 0x30], r13
lea r8, [rax - 0x48]
mov r12d, r9d
mov r13, rcx
mov qword [rax - 0x40], rbx
mov dword [rax - 0x48], ebx
call fcn.1800c34e0
test rax, rax
mov rsi, rax
jne 0x1800c3758
mov eax, 0xf1
jmp 0x1800c386c
lea rax, [rsp + 0x38]
lea r9, [0x1800c3700]
xor r8d, r8d
mov rdx, rdi
mov rcx, rsi
mov qword [rsp + 0x68], rbp
mov qword [rsp + 0x20], rax
call fcn.1800c35f0
cmp eax, 0xffffffff
je 0x1800c3858
mov rcx, qword [rsp + 0x38]
test rcx, rcx
je 0x1800c3858
mov rax, qword [rcx + 8]
mov r10d, dword [rsp + 0xa0]
test r10d, r10d
movzx edi, byte [rax + 4]
mov ebp, dword [rax]
jne 0x1800c37ba
cmp dil, 1
je 0x1800c37ba
mov ebx, 0xf3
jmp 0x1800c385d
mov byte [rax + 4], 1
mov rax, qword [rsp + 0x38]
mov r8d, 0xffffffff
mov rcx, qword [rax + 8]
mov r9, rbx
mov dword [rcx], r12d
mov r11d, dword [rsp + 0x30]
test r11, r11
je 0x1800c3810
lea r12, [0x18014f250]
nop
nop
nop
movzx ecx, byte [r9 + r13]
mov eax, r8d
inc r9
xor cl, r8b
shr eax, 8
movzx edx, cl
mov r8d, dword [r12 + rdx*4]
xor r8d, eax
cmp r9, r11
jb 0x1800c37f0
test r10d, r10d
not r8d
je 0x1800c3833
mov rax, qword [rsp + 0x38]
mov rcx, qword [rax + 8]
mov byte [rcx + 4], 1
mov rax, qword [rsp + 0x38]
mov rcx, qword [rax + 8]
mov dword [rcx], r8d
jmp 0x1800c385d
mov eax, 0xf0
cmp ebp, r8d
cmovne ebx, eax
mov rax, qword [rsp + 0x38]
mov rcx, qword [rax + 8]
mov byte [rcx + 4], dil
mov rax, qword [rsp + 0x38]
mov rcx, qword [rax + 8]
mov dword [rcx], ebp
jmp 0x1800c385d
mov ebx, 0xf2
mov rcx, rsi
call fcn.1800c3480
mov rbp, qword [rsp + 0x68]
mov eax, ebx
mov r13, qword [rsp + 0x48]
mov r12, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov rbx, qword [rsp + 0x70]
add rsp, 0x78
ret
Function at 0x1800c3890
Capabilities:
Encode data using xor
Encrypt data using aes
Reference aes constants

Disassembly:
sub rsp, 0x28
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x38], rbp
mov qword [rsp + 0x20], r12
lea r12d, [r8 - 6]
mov rbx, rdx
mov ebp, r8d
lea eax, [r12 - 1]
mov rdx, rcx
test eax, eax
movsxd r9, eax
js 0x1800c38e1
lea rax, [rsp]
sub rdx, rax
nop
nop
nop
nop
lea rax, [rdx + r9*4]
dec r9
mov ecx, dword [rsp + rax]
mov dword [rsp + r9*4 + 4], ecx
jns 0x1800c38d0
mov qword [rsp + 0x40], rsi
mov qword [rsp + 0x48], rdi
xor r10d, r10d
xor edi, edi
xor r8d, r8d
xor edx, edx
test r12d, r12d
movsxd r9, r12d
jle 0x1800c3944
lea esi, [rbp + 1]
xor r11d, r11d
cmp edi, esi
jge 0x1800c3944
cmp r8, r9
jge 0x1800c392f
nop
cmp rdx, 4
jge 0x1800c392f
mov eax, dword [rsp + r8*4]
lea rcx, [r11 + rdx]
inc r8
inc r10d
inc rdx
cmp r8, r9
mov dword [rbx + rcx*4], eax
jl 0x1800c3910
cmp rdx, 4
jne 0x1800c393f
inc edi
add r11, rdx
xor r10d, r10d
xor edx, edx
cmp r8, r9
jl 0x1800c3903
inc ebp
movsxd r11, edi
movsxd r8, r10d
cmp edi, ebp
jge 0x1800c3a86
lea r10, [0x180152850]
lea rsi, [0x18014f650]
movzx ecx, byte [rsp + r9*4 - 3]
movzx eax, byte [rsp]
add r10, 4
xor al, byte [rcx + rsi]
mov byte [rsp], al
movzx eax, byte [rsp + r9*4 - 2]
movzx eax, byte [rax + rsi]
xor byte [rsp + 1], al
movzx eax, byte [rsp + r9*4 - 1]
movzx eax, byte [rax + rsi]
xor byte [rsp + 2], al
movzx eax, byte [rsp + r9*4 - 4]
movzx eax, byte [rax + rsi]
xor byte [rsp + 3], al
movzx eax, byte [r10 - 4]
xor byte [rsp], al
cmp r12d, 8
je 0x1800c39d2
mov ecx, 1
cmp rcx, r9
jge 0x1800c3a40
nop
mov eax, dword [rsp + rcx*4 - 4]
inc rcx
xor dword [rsp + rcx*4 - 4], eax
cmp rcx, r9
jl 0x1800c39c0
jmp 0x1800c3a40
lea rcx, [rsp + 4]
mov edx, 3
nop
mov eax, dword [rcx - 4]
add rcx, 4
xor dword [rcx - 4], eax
dec rdx
jne 0x1800c39e0
movzx eax, byte [rsp + 0xc]
mov ecx, 5
movzx eax, byte [rax + rsi]
xor byte [rsp + 0x10], al
movzx eax, byte [rsp + 0xd]
movzx eax, byte [rax + rsi]
xor byte [rsp + 0x11], al
movzx eax, byte [rsp + 0xe]
movzx eax, byte [rax + rsi]
xor byte [rsp + 0x12], al
movzx eax, byte [rsp + 0xf]
movzx eax, byte [rax + rsi]
xor byte [rsp + 0x13], al
cmp rcx, r9
jge 0x1800c3a40
nop
mov eax, dword [rsp + rcx*4 - 4]
inc rcx
xor dword [rsp + rcx*4 - 4], eax
cmp rcx, r9
jl 0x1800c3a30
xor edx, edx
test r12d, r12d
jle 0x1800c3a7e
cmp edi, ebp
jge 0x1800c3a7e
cmp rdx, r9
jge 0x1800c3a6b
cmp r8, 4
jge 0x1800c3a6b
mov eax, dword [rsp + rdx*4]
lea rcx, [r8 + r11*4]
inc rdx
inc r8
cmp rdx, r9
mov dword [rbx + rcx*4], eax
jl 0x1800c3a50
cmp r8, 4
jne 0x1800c3a79
inc edi
inc r11
xor r8d, r8d
cmp rdx, r9
jl 0x1800c3a47
cmp edi, ebp
jl 0x1800c3962
mov r12, qword [rsp + 0x20]
mov rdi, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x30]
xor eax, eax
add rsp, 0x28
ret
Function at 0x1800c3ab0
Capabilities:
Encode data using xor

Disassembly:
movsxd rax, edx
cmp rax, 1
jle 0x1800c3bbd
lea r8, [rcx + 0x16]
lea r9, [rax - 1]
lea r10, [0x180000000]
nop
movzx ecx, byte [r8 - 3]
movzx eax, byte [r8 - 4]
add r8, 0x10
mov edx, dword [r10 + rcx*4 + 0x152450]
xor edx, dword [r10 + rax*4 + 0x152050]
movzx eax, byte [r8 - 0x15]
xor edx, dword [r10 + rax*4 + 0x151c50]
movzx eax, byte [r8 - 0x16]
xor edx, dword [r10 + rax*4 + 0x151850]
mov dword [r8 - 0x16], edx
movzx ecx, byte [r8 - 0xf]
movzx eax, byte [r8 - 0x11]
mov edx, dword [r10 + rcx*4 + 0x152450]
xor edx, dword [r10 + rax*4 + 0x151c50]
movzx eax, byte [r8 - 0x12]
xor edx, dword [r10 + rax*4 + 0x151850]
movzx eax, byte [r8 - 0x10]
xor edx, dword [r10 + rax*4 + 0x152050]
mov dword [r8 - 0x12], edx
movzx ecx, byte [r8 - 0xb]
movzx eax, byte [r8 - 0xc]
mov edx, dword [r10 + rcx*4 + 0x152450]
xor edx, dword [r10 + rax*4 + 0x152050]
movzx eax, byte [r8 - 0xd]
xor edx, dword [r10 + rax*4 + 0x151c50]
movzx eax, byte [r8 - 0xe]
xor edx, dword [r10 + rax*4 + 0x151850]
mov dword [r8 - 0xe], edx
movzx eax, byte [r8 - 8]
movzx ecx, byte [r8 - 7]
mov edx, dword [r10 + rcx*4 + 0x152450]
xor edx, dword [r10 + rax*4 + 0x152050]
movzx eax, byte [r8 - 9]
xor edx, dword [r10 + rax*4 + 0x151c50]
movzx eax, byte [r8 - 0xa]
xor edx, dword [r10 + rax*4 + 0x151850]
dec r9
mov dword [r8 - 0xa], edx
jne 0x1800c3ad0
xor eax, eax
ret
Function at 0x1800ca910
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 0x20], rdi
mov cx, 1
xor r8w, r8w
lea rdi, [0x180000000]
nop
nop
nop
movsx rax, cx
movsx ecx, cx
mov word [rdi + rax*2 + 0x237160], r8w
add ecx, ecx
mov eax, 0x33af3e2f
inc r8w
imul ecx
sar edx, 6
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 0x13d
sub ecx, edx
cmp r8w, 0x9e
jl 0x1800ca930
cmp cx, 1
jne 0x1800ca9b9
mov cx, 0x13c
xor r8w, r8w
nop
nop
nop
movsx rax, cx
movsx ecx, cx
mov word [rdi + rax*2 + 0x237160], r8w
add ecx, ecx
mov eax, 0x33af3e2f
inc r8w
imul ecx
sar edx, 6
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 0x13d
sub ecx, edx
cmp r8w, 0x9e
jl 0x1800ca980
jmp 0x1800ca9f7
mov r8w, 0x9e
nop
movsx rax, cx
movsx ecx, cx
mov word [rdi + rax*2 + 0x237160], r8w
add ecx, ecx
mov eax, 0x33af3e2f
inc r8w
imul ecx
sar edx, 6
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 0x13d
sub ecx, edx
cmp r8w, 0x13c
jl 0x1800ca9c0
mov r11d, 0x9d
mov qword [rsp + 0x18], rbx
mov word [0x180236c60], 1
mov word [0x180236eda], 0xffff
mov bx, 1
mov r9d, 1
mov r10, r11
movsx ebx, bx
mov eax, 0x33af3e2f
add ebx, ebx
imul ebx
sar edx, 6
mov eax, edx
shr eax, 0x1f
add edx, eax
imul edx, edx, 0x13d
sub ebx, edx
movsx rdx, bx
mov rcx, rdx
neg rcx
movzx eax, word [rdi + rcx*2 + 0x2373dc]
mov word [rsp + 8], ax
movzx eax, word [rdi + rcx*2 + 0x2373d8]
xor cx, cx
mov word [rsp + 0xa], ax
movzx eax, word [rdi + rdx*2 + 0x23715e]
mov word [rsp + 0xc], ax
movzx eax, word [rdi + rdx*2 + 0x237162]
xor dx, dx
mov word [rsp + 0xe], ax
nop
nop
nop
nop
movsx rax, dx
movzx r8d, word [rsp + rax*2 + 8]
cmp r8w, 0x9e
jge 0x1800caabc
movsx rax, cx
imul rax, rax, 0x13d
add rax, r9
inc cx
mov word [rdi + rax*2 + 0x236c60], r8w
inc dx
cmp cx, 2
jl 0x1800caa90
inc r9
dec r10
jne 0x1800caa21
mov rdi, qword [rsp + 0x20]
mov rbx, qword [rsp + 0x18]
mov ax, select
mov r8d, 0xffff0000
lea r9d, [r10 + 0x10]
nop
nop
mov ecx, r8d
and ecx, r11d
je 0x1800caaff
add r10w, ax
mov r11d, ecx
mov eax, r9d
cdq
sub eax, edx
mov edx, r8d
sar eax, 1
movsx r9d, ax
mov ecx, r9d
shr edx, cl
xor r8d, edx
test ax, ax
jne 0x1800caaf0
mov word [0x180236c54], r10w
ret