joyce8/EMBER2024-capa huggingface dataset:
Function at 0x18030ed60
Capabilities:
Encode data using xor

Disassembly:
push rbp
push rdi
push r12
push r15
mov eax, 0x48
call fcn.180409810
sub rsp, rax
mov rdi, qword [rsp + 0xa0]
mov r12, rdx
test rdx, rdx
mov r15, r9
mov rdx, r8
mov rbp, r8
je 0x18030efa3
mov qword [rsp + 0x70], rbx
mov rbx, qword [rsp + 0xa8]
mov qword [rsp + 0x80], r13
mov r13, qword [rsp + 0x98]
mov qword [rsp + 0x40], r14
lea r14, [r9 + 1]
mov r9, qword [rsp + 0x90]
mov qword [rsp + 0x30], rbx
shr r14, 1
mov r8, r14
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x78], rsi
mov qword [rsp + 0x20], r13
call fcn.18030eb50
test eax, eax
je 0x18030ee44
mov r8d, 0x1c8
lea rdx, str.providersimplementationskdfs_tls1_prf.c
mov rcx, rbx
call fcn.180233220
mov rsi, rax
test rax, rax
je 0x18030ee44
mov r9, qword [rsp + 0x90]
sub rbp, r14
mov qword [rsp + 0x30], rbx
mov r8, r14
mov qword [rsp + 0x28], rax
mov rcx, r12
mov qword [rsp + 0x20], r13
lea rdx, [r15 + rbp]
call fcn.18030eb50
test eax, eax
jne 0x18030ee68
mov r9d, 0x1cd
lea r8, str.providersimplementationskdfs_tls1_prf.c
mov rdx, rbx
mov rcx, rsi
call fcn.180233390
xor eax, eax
mov rsi, qword [rsp + 0x78]
mov r13, qword [rsp + 0x80]
mov rbx, qword [rsp + 0x70]
mov r14, qword [rsp + 0x40]
add rsp, 0x48
pop r15
pop r12
pop rdi
pop rbp
ret
xor ecx, ecx
test rbx, rbx
je 0x18030ef81
cmp rbx, 8
jb 0x18030ef56
lea rdx, [rdi - 1]
lea rax, [rbx - 1]
add rdx, rbx
add rax, rsi
cmp rdi, rax
ja 0x18030ee99
cmp rdx, rsi
jae 0x18030ef56
mov rdx, rsi
cmp rbx, 0x40
jb 0x18030ef24
mov r8, rbx
mov r9, rbx
and r8d, 0x3f
sub r9, r8
lea rax, [rdi + 0x10]
sub rdx, rdi
nop word [rax + rax]
movdqu xmm0, xmmword [rax - 0x10]
add rcx, 0x40
movdqu xmm1, xmmword [rdx + rax - 0x10]
movdqu xmm2, xmmword [rdx + rax]
lea rax, [rax + 0x40]
pxor xmm1, xmm0
movdqu xmmword [rax - 0x50], xmm1
movdqu xmm0, xmmword [rax - 0x40]
movdqu xmm1, xmmword [rdx + rax - 0x30]
pxor xmm2, xmm0
movdqu xmmword [rax - 0x40], xmm2
movdqu xmm0, xmmword [rax - 0x30]
pxor xmm1, xmm0
movdqu xmmword [rax - 0x30], xmm1
movdqu xmm0, xmmword [rax - 0x20]
movdqu xmm1, xmmword [rdx + rax - 0x20]
pxor xmm1, xmm0
movdqu xmmword [rax - 0x20], xmm1
cmp rcx, r9
jb 0x18030eec0
cmp r8, 8
jb 0x18030ef51
jmp 0x18030ef27
sub rdx, rdi
mov r8, rbx
and r8, 0xfffffffffffffff8
lea rax, [rcx + rdi]
movq xmm0, qword [rax]
add rcx, 8
movq xmm1, qword [rdx + rax]
lea rax, [rax + 8]
pxor xmm1, xmm0
movq qword [rax - 8], xmm1
cmp rcx, r8
jb 0x18030ef32
cmp rcx, rbx
jae 0x18030ef81
mov r8, rsi
lea rax, [rcx + rdi]
sub r8, rdi
mov rdx, rbx
sub rdx, rcx
nop word [rax + rax]
movzx ecx, byte [rax + r8]
xor byte [rax], cl
lea rax, [rax + 1]
sub rdx, 1
jne 0x18030ef70
mov r9d, 0x1d2
lea r8, str.providersimplementationskdfs_tls1_prf.c
mov rdx, rbx
mov rcx, rsi
call fcn.180233390
mov eax, 1
jmp 0x18030ee46
mov rax, qword [rsp + 0xa8]
mov r8, r15
mov r9, qword [rsp + 0x90]
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x98]
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], rax
call fcn.18030eb50
xor ecx, ecx
test eax, eax
setne cl
mov eax, ecx
add rsp, 0x48
pop r15
pop r12
pop rdi
pop rbp
ret
Function at 0x180317b30
Capabilities:
Encode data using xor

Disassembly:
test rcx, rcx
je 0x180317d96
mov qword [rsp + 0x20], rbx
push rsi
mov eax, 0x840
call fcn.180409810
sub rsp, rax
mov rax, qword [0x18056a580]
xor rax, rsp
mov qword [rsp + 0x830], rax
mov r11d, dword [rcx + 0x7c]
mov rbx, rcx
mov qword [rsp + 0x860], rdi
mov eax, r11d
mov rdi, qword [rcx + 0x68]
mov rsi, rdx
shl rax, 0xa
mov edx, 8
lea rcx, [rdi - 0x400]
add rcx, rax
lea rax, [rsp + 0x30]
nop
lea rax, [rax + 0x80]
movups xmm0, xmmword [rcx]
lea rcx, [rcx + 0x80]
movups xmmword [rax - 0x80], xmm0
movups xmm1, xmmword [rcx - 0x70]
movups xmmword [rax - 0x70], xmm1
movups xmm0, xmmword [rcx - 0x60]
movups xmmword [rax - 0x60], xmm0
movups xmm1, xmmword [rcx - 0x50]
movups xmmword [rax - 0x50], xmm1
movups xmm0, xmmword [rcx - 0x40]
movups xmmword [rax - 0x40], xmm0
movups xmm1, xmmword [rcx - 0x30]
movups xmmword [rax - 0x30], xmm1
movups xmm0, xmmword [rcx - 0x20]
movups xmmword [rax - 0x20], xmm0
movups xmm1, xmmword [rcx - 0x10]
movups xmmword [rax - 0x10], xmm1
sub rdx, 1
jne 0x180317b90
mov r10d, dword [rbx + 0x54]
mov r9d, 1
cmp r10d, r9d
jbe 0x180317cdb
nop word [rax + rax]
lea eax, [r9 + 1]
mov r9d, eax
lea r8, [rsp + 0x30]
imul eax, r11d
lea edx, [rax - 1]
xor eax, eax
shl rdx, 0xa
add rdx, rdi
lea rcx, [rdx + 0x3f8]
cmp r8, rcx
ja 0x180317c56
lea rcx, [rsp + 0x428]
cmp rcx, rdx
jb 0x180317c56
nop word [rax + rax]
mov rcx, qword [rdx + rax*8]
xor qword [rsp + rax*8 + 0x30], rcx
inc rax
cmp rax, 0x80
jl 0x180317c40
jmp 0x180317cd2
lea rcx, [rsp + 0x30]
sub rcx, rdx
lea r8, [rsp + 0x40]
sub r8, rdx
lea rax, [rdx + 0x20]
mov edx, reloc.WS2_32.dll_recv
nop
movdqu xmm0, xmmword [rcx + rax - 0x20]
movdqu xmm1, xmmword [rax - 0x20]
lea rax, [rax + 0x40]
pxor xmm1, xmm0
movdqu xmmword [rcx + rax - 0x60], xmm1
movdqu xmm0, xmmword [r8 + rax - 0x60]
movdqu xmm1, xmmword [rax - 0x50]
pxor xmm1, xmm0
movdqu xmm0, xmmword [rax - 0x40]
movdqu xmmword [r8 + rax - 0x60], xmm1
movdqu xmm1, xmmword [rax + rcx - 0x40]
pxor xmm1, xmm0
movdqu xmmword [rax + rcx - 0x40], xmm1
movdqu xmm0, xmmword [rax + r8 - 0x40]
movdqu xmm1, xmmword [rax - 0x30]
pxor xmm1, xmm0
movdqu xmmword [rax + r8 - 0x40], xmm1
sub rdx, 1
jne 0x180317c70
cmp r9d, r10d
jb 0x180317c00
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x430]
call fcn.180318590
mov r9d, dword [rbx + 8]
lea rax, [rsp + 0x430]
mov rdx, qword [rbx + 0x90]
mov r8, rsi
mov rcx, qword [rbx + 0x88]
mov qword [rsp + 0x28], 0x400
mov qword [rsp + 0x20], rax
call fcn.180316120
mov edx, 0x400
lea rcx, [rsp + 0x30]
call fcn.180001240
mov edx, 0x400
lea rcx, [rsp + 0x430]
call fcn.180001240
mov edx, dword [rbx + 0x74]
lea r8, str.providersimplementationskdfs_argon2.c
mov rcx, qword [rbx + 0x68]
mov rdi, qword [rsp + 0x860]
shl rdx, 0xa
cmp dword [rbx + 0x64], 0
je 0x180317d6b
mov r9d, 0x310
call fcn.1802660c0
jmp 0x180317d76
mov r9d, 0x313
call fcn.180233390
mov rcx, qword [rsp + 0x830]
xor rcx, rsp
call fcn.180408b20
mov rbx, qword [rsp + 0x868]
add rsp, 0x840
pop rsi
ret
Function at 0x18031b850
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
mov eax, Ordinal_50
call fcn.180409810
sub rsp, rax
xor edi, edi
mov qword [rsp + 0x40], rbp
movsxd rbx, r9d
mov r11, r8
mov dword [rsp + 0x58], reloc.WS2_32.dll_recv
mov rbp, rcx
mov r10d, edi
test r9d, r9d
jle 0x18031b975
cmp ebx, 8
jb 0x18031b975
lea rax, [rbx - 1]
lea rcx, [rax + rdx]
add rax, r8
cmp rdx, rax
ja 0x18031b8a9
cmp rcx, r8
jae 0x18031b975
sub r8, rdx
cmp ebx, 0x40
jb 0x18031b941
mov eax, ebx
mov qword [rsp + 0x48], rsi
and eax, 0xffffffc0
mov r9, 0xfffffffffffffff0
movsxd rsi, eax
sub r9, rdx
lea rcx, [rdx + 0x10]
movdqu xmm0, xmmword [rcx - 0x10]
add r10d, 0x40
movdqu xmm1, xmmword [r8 + rcx - 0x10]
movdqu xmm2, xmmword [r8 + rcx]
lea rcx, [rcx + 0x40]
pxor xmm1, xmm0
lea rax, [r9 + rcx]
movdqu xmmword [rcx - 0x50], xmm1
movdqu xmm0, xmmword [rcx - 0x40]
movdqu xmm1, xmmword [r8 + rcx - 0x30]
pxor xmm2, xmm0
movdqu xmmword [rcx - 0x40], xmm2
movdqu xmm0, xmmword [rcx - 0x30]
pxor xmm1, xmm0
movdqu xmmword [rcx - 0x30], xmm1
movdqu xmm0, xmmword [rcx - 0x20]
movdqu xmm1, xmmword [r8 + rcx - 0x20]
pxor xmm1, xmm0
movdqu xmmword [rcx - 0x20], xmm1
cmp rax, rsi
jl 0x18031b8d0
mov rsi, qword [rsp + 0x48]
mov eax, ebx
and al, 0x3f
cmp al, 8
jb 0x18031b975
mov ecx, ebx
and ecx, 0xfffffff8
movsxd rax, r10d
movsxd r9, ecx
lea rcx, [rax + rdx]
movq xmm0, qword [rcx]
add r10d, 8
movq xmm1, qword [r8 + rcx]
pxor xmm1, xmm0
movq qword [rcx], xmm1
add rcx, 8
mov rax, rcx
sub rax, rdx
cmp rax, r9
jl 0x18031b950
movsxd rcx, r10d
mov r8, rbx
cmp rcx, rbx
jge 0x18031b9a1
sub r11, rdx
lea rax, [rcx + rdx]
sub r8, rcx
nop word [rax + rax]
movzx ecx, byte [rax + r11]
xor byte [rax], cl
lea rax, [rax + 1]
sub r8, 1
jne 0x18031b990
mov rcx, qword [rbp + 0x10]
lea r8, [rsp + 0x58]
mov r9, rdx
mov dword [rsp + 0x20], ebx
call fcn.180251630
mov rbp, qword [rsp + 0x40]
test eax, eax
je 0x18031b9d4
cmp dword [rsp + 0x58], ebx
sete dil
mov eax, edi
mov rbx, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
mov rbx, qword [rsp + 0x50]
xor eax, eax
add rsp, 0x30
pop rdi
ret

Function at 0x18031bb80
Capabilities:
Encode data using xor

Disassembly:
mov r10, rcx
test rdx, rdx
je 0x18031bc08
test r8, r8
je 0x18031bc08
mov r9, qword [rcx + 0x28]
cmp r8, r9
cmovb r9, r8
test r9, r9
je 0x18031bbc2
add rcx, 0x34
mov r11, rdx
sub r11, r10
nop dword [rax + rax]
movzx eax, byte [r11 + rcx - 0x34]
xor byte [rcx], al
lea rcx, [rcx + 1]
sub r9, 1
jne 0x18031bbb0
mov rax, qword [r10 + 0x28]
cmp r8, rax
jbe 0x18031bc08
sub r8, rax
cmp r8, 0x10
jbe 0x18031bbdc
mov r8d, reloc.WS2_32.dll_recv
jmp 0x18031bbe1
test r8, r8
je 0x18031bc08
xor ecx, ecx
nop dword [rax]
nop word [rax + rax]
mov rax, qword [r10 + 0x28]
add rax, rcx
movzx eax, byte [rax + rdx]
xor byte [r10 + rcx + 0x54], al
inc rcx
cmp rcx, r8
jb 0x18031bbf0
ret
Function at 0x18034ae90
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov eax, 0x60
call fcn.180409810
sub rsp, rax
mov rax, qword [0x18056a580]
xor rax, rsp
mov qword [rsp + 0x50], rax
mov r14, qword [rsp + 0xd0]
mov rdi, rcx
mov rax, qword [rsp + 0xc0]
mov r13, r9
mov rcx, qword [rsp + 0xc8]
mov esi, r8d
mov r12, qword [rsp + 0xd8]
mov r15, rdx
movzx r9d, byte [r14]
xor ebp, ebp
movzx edx, byte [r14 + 3]
movzx r8d, byte [r14 + 4]
mov ebx, dword [r12]
mov qword [rsp + 0x28], rax
movzx eax, byte [r14 + 1]
shl eax, 8
or r9d, eax
mov qword [rsp + 0x30], rcx
movzx eax, byte [r14 + 2]
movzx ecx, byte [r14 + 7]
shl eax, 0x10
or r9d, eax
shl edx, 0x18
movzx eax, byte [r14 + 5]
or r9d, edx
shl eax, 8
or r8d, eax
shl ecx, 8
movzx eax, byte [r14 + 6]
or ecx, eax
mov qword [rsp + 0x38], r14
shl ecx, 0x10
mov eax, r9d
shr eax, 8
or r8d, ecx
mov byte [rsp + 0x49], al
mov eax, r9d
shr eax, 0x10
mov byte [rsp + 0x4a], al
mov eax, r8d
shr eax, 8
mov byte [rsp + 0x4d], al
mov eax, r8d
shr eax, 0x10
mov byte [rsp + 0x4e], al
mov eax, r8d
shr eax, 0x18
mov qword [rsp + 0x40], r12
mov dword [rsp + 0x20], r9d
mov dword [rsp + 0x24], r8d
mov byte [rsp + 0x48], r9b
mov byte [rsp + 0x4c], r8b
mov byte [rsp + 0x4f], al
bswap edx
mov byte [rsp + 0x4b], dl
test esi, esi
je 0x18034b086
mov r12, qword [rsp + 0x28]
sub r15, rdi
mov r14, qword [rsp + 0x30]
nop dword [rax]
dec esi
test ebx, ebx
jne 0x18034b01b
mov r9, r14
lea rcx, [rsp + 0x20]
mov r8, r12
mov rdx, r13
call fcn.180348920
mov r9d, dword [rsp + 0x20]
mov eax, r9d
mov r8d, dword [rsp + 0x24]
shr eax, 8
mov byte [rsp + 0x49], al
mov eax, r9d
shr eax, 0x10
mov byte [rsp + 0x4a], al
mov eax, r9d
shr eax, 0x18
mov byte [rsp + 0x4b], al
mov eax, r8d
shr eax, 8
mov byte [rsp + 0x4d], al
mov eax, r8d
shr eax, 0x10
mov byte [rsp + 0x4e], al
mov eax, r8d
shr eax, 0x18
mov byte [rsp + 0x4f], al
inc ebp
mov byte [rsp + 0x48], r9b
mov byte [rsp + 0x4c], r8b
movsxd rax, ebx
movzx ecx, byte [rsp + rax + 0x48]
xor cl, byte [rdi]
mov byte [r15 + rdi], cl
inc rdi
inc ebx
and ebx, 7
test esi, esi
jne 0x18034afb0
mov r14, qword [rsp + 0x38]
mov r12, qword [rsp + 0x40]
test ebp, ebp
je 0x18034b086
mov eax, r9d
mov byte [r14], r9b
shr eax, 8
mov byte [r14 + 1], al
mov eax, r9d
shr eax, 0x10
mov byte [r14 + 2], al
mov eax, r8d
shr eax, 8
mov byte [r14 + 5], al
mov eax, r8d
shr eax, 0x10
shr r9d, 0x18
mov byte [r14 + 4], r8b
shr r8d, 0x18
mov byte [r14 + 7], r8b
mov byte [r14 + 3], r9b
mov byte [r14 + 6], al
mov dword [r12], ebx
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.180408b20
mov rbx, qword [rsp + 0xa0]
add rsp, 0x60
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x18034ca40
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov eax, 0x40
call fcn.180409810
sub rsp, rax
mov rax, qword [0x18056a580]
xor rax, rsp
mov qword [rsp + 0x30], rax
mov r12, qword [rsp + 0xa8]
xor ebp, ebp
mov r14, qword [rsp + 0xa0]
mov r13, r9
mov esi, r8d
mov r15, rdx
mov rdi, rcx
mov ebx, dword [r12]
test ebx, ebx
jns 0x18034ca9f
mov dword [r12], 0xffffffff
jmp 0x18034cc1f
movzx r8d, byte [r14]
movzx r9d, byte [r14 + 1]
movzx eax, byte [r14 + 2]
movzx ecx, byte [r14 + 6]
movzx edx, byte [r14 + 4]
movzx r10d, byte [r14 + 5]
shl eax, 8
shl r9d, 0x10
shl r8d, 0x18
or r9d, r8d
shl edx, 0x18
or r9d, eax
shl r10d, 0x10
movzx eax, byte [r14 + 3]
or r10d, edx
or r9d, eax
shl ecx, 8
movzx eax, byte [r14 + 7]
or ecx, eax
mov dword [rsp + 0x20], r9d
or r10d, ecx
mov byte [rsp + 0x2b], r9b
mov eax, r9d
mov dword [rsp + 0x24], r10d
shr eax, 0x10
mov byte [rsp + 0x29], al
mov eax, r9d
shr eax, 8
mov byte [rsp + 0x2a], al
mov eax, r10d
shr eax, 0x10
mov byte [rsp + 0x2d], al
mov eax, r10d
shr eax, 8
mov byte [rsp + 0x2e], al
mov byte [rsp + 0x2f], r10b
bswap r8d
mov byte [rsp + 0x28], r8b
bswap edx
mov byte [rsp + 0x2c], dl
test esi, esi
je 0x18034cc1b
sub r15, rdi
movzx r8d, r10b
movzx edx, r9b
nop dword [rax]
dec esi
test ebx, ebx
jne 0x18034cbba
mov rdx, r13
lea rcx, [rsp + 0x20]
call fcn.18034c000
mov r9d, dword [rsp + 0x20]
mov eax, r9d
mov r10d, dword [rsp + 0x24]
mov edx, r9d
shr eax, 0x18
mov r8d, r10d
mov byte [rsp + 0x28], al
mov eax, r9d
shr eax, 0x10
mov byte [rsp + 0x29], al
mov eax, r9d
shr eax, 8
mov byte [rsp + 0x2a], al
mov eax, r10d
shr eax, 0x18
mov byte [rsp + 0x2c], al
mov eax, r10d
shr eax, 0x10
mov byte [rsp + 0x2d], al
mov eax, r10d
shr eax, 8
mov byte [rsp + 0x2e], al
inc ebp
mov byte [rsp + 0x2b], dl
mov byte [rsp + 0x2f], r8b
movsxd rax, ebx
movzx ecx, byte [rsp + rax + 0x28]
xor cl, byte [rdi]
mov byte [r15 + rdi], cl
inc rdi
inc ebx
and ebx, 7
test esi, esi
jne 0x18034cb50
test ebp, ebp
je 0x18034cc1b
mov eax, r9d
mov byte [r14 + 3], dl
shr eax, 0x18
mov byte [r14], al
mov eax, r9d
shr eax, 0x10
mov byte [r14 + 1], al
mov eax, r10d
shr eax, 0x18
mov byte [r14 + 4], al
mov eax, r10d
shr eax, 0x10
shr r9d, 8
shr r10d, 8
mov byte [r14 + 6], r10b
mov byte [r14 + 2], r9b
mov byte [r14 + 5], al
mov byte [r14 + 7], r8b
mov dword [r12], ebx
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.180408b20
mov rbx, qword [rsp + 0x80]
add rsp, 0x40
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x18034f180
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov eax, 0x40
call fcn.180409810
sub rsp, rax
mov rax, qword [0x18056a580]
xor rax, rsp
mov qword [rsp + 0x30], rax
mov r14, qword [rsp + 0xa0]
mov esi, r8d
mov r12, qword [rsp + 0xa8]
mov r13, r9
mov rdi, rcx
mov r15, rdx
xor ebp, ebp
movzx r10d, byte [r14]
movzx r8d, byte [r14 + 1]
movzx eax, byte [r14 + 2]
movzx ecx, byte [r14 + 6]
movzx edx, byte [r14 + 4]
movzx r9d, byte [r14 + 5]
mov ebx, dword [r12]
shl eax, 8
shl r8d, 0x10
shl r10d, 0x18
or r8d, r10d
shl edx, 0x18
or r8d, eax
shl r9d, 0x10
movzx eax, byte [r14 + 3]
or r9d, edx
or r8d, eax
shl ecx, 8
movzx eax, byte [r14 + 7]
or ecx, eax
mov dword [rsp + 0x20], r8d
or r9d, ecx
mov byte [rsp + 0x2b], r8b
mov eax, r8d
mov dword [rsp + 0x24], r9d
shr eax, 0x10
mov byte [rsp + 0x29], al
mov eax, r8d
shr eax, 8
mov byte [rsp + 0x2a], al
mov eax, r9d
shr eax, 0x10
mov byte [rsp + 0x2d], al
mov eax, r9d
shr eax, 8
mov byte [rsp + 0x2e], al
mov byte [rsp + 0x2f], r9b
bswap r10d
mov byte [rsp + 0x28], r10b
bswap edx
mov byte [rsp + 0x2c], dl
test esi, esi
je 0x18034f343
sub r15, rdi
movzx r10d, r9b
movzx edx, r8b
dec esi
test ebx, ebx
jne 0x18034f2e2
mov rdx, r13
lea rcx, [rsp + 0x20]
call fcn.18034eac0
mov r8d, dword [rsp + 0x20]
mov eax, r8d
mov r9d, dword [rsp + 0x24]
mov edx, r8d
shr eax, 0x18
mov r10d, r9d
mov byte [rsp + 0x28], al
mov eax, r8d
shr eax, 0x10
mov byte [rsp + 0x29], al
mov eax, r8d
shr eax, 8
mov byte [rsp + 0x2a], al
mov eax, r9d
shr eax, 0x18
mov byte [rsp + 0x2c], al
mov eax, r9d
shr eax, 0x10
mov byte [rsp + 0x2d], al
mov eax, r9d
shr eax, 8
mov byte [rsp + 0x2e], al
inc ebp
mov byte [rsp + 0x2b], dl
mov byte [rsp + 0x2f], r10b
movsxd rax, ebx
movzx ecx, byte [rsp + rax + 0x28]
xor cl, byte [rdi]
mov byte [r15 + rdi], cl
inc rdi
inc ebx
and ebx, 7
test esi, esi
jne 0x18034f278
test ebp, ebp
je 0x18034f343
mov eax, r8d
mov byte [r14 + 3], dl
shr eax, 0x18
mov byte [r14], al
mov eax, r8d
shr eax, 0x10
mov byte [r14 + 1], al
mov eax, r9d
shr eax, 0x18
mov byte [r14 + 4], al
mov eax, r9d
shr eax, 0x10
shr r8d, 8
shr r9d, 8
mov byte [r14 + 6], r9b
mov byte [r14 + 2], r8b
mov byte [r14 + 5], al
mov byte [r14 + 7], r10b
mov dword [r12], ebx
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.180408b20
mov rbx, qword [rsp + 0x80]
add rsp, 0x40
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x180351c30
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov eax, 0x40
call fcn.180409810
sub rsp, rax
mov rax, qword [0x18056a580]
xor rax, rsp
mov qword [rsp + 0x30], rax
mov r14, qword [rsp + 0xa0]
mov esi, r8d
mov r12, qword [rsp + 0xa8]
mov r13, r9
mov rdi, rcx
mov r15, rdx
xor ebp, ebp
movzx r10d, byte [r14]
movzx r8d, byte [r14 + 1]
movzx eax, byte [r14 + 2]
movzx ecx, byte [r14 + 6]
movzx edx, byte [r14 + 4]
movzx r9d, byte [r14 + 5]
mov ebx, dword [r12]
shl eax, 8
shl r8d, 0x10
shl r10d, 0x18
or r8d, r10d
shl edx, 0x18
or r8d, eax
shl r9d, 0x10
movzx eax, byte [r14 + 3]
or r9d, edx
or r8d, eax
shl ecx, 8
movzx eax, byte [r14 + 7]
or ecx, eax
mov dword [rsp + 0x20], r8d
or r9d, ecx
mov byte [rsp + 0x2b], r8b
mov eax, r8d
mov dword [rsp + 0x24], r9d
shr eax, 0x10
mov byte [rsp + 0x29], al
mov eax, r8d
shr eax, 8
mov byte [rsp + 0x2a], al
mov eax, r9d
shr eax, 0x10
mov byte [rsp + 0x2d], al
mov eax, r9d
shr eax, 8
mov byte [rsp + 0x2e], al
mov byte [rsp + 0x2f], r9b
bswap r10d
mov byte [rsp + 0x28], r10b
bswap edx
mov byte [rsp + 0x2c], dl
test esi, esi
je 0x180351df3
sub r15, rdi
movzx r10d, r9b
movzx edx, r8b
dec esi
test ebx, ebx
jne 0x180351d92
mov rdx, r13
lea rcx, [rsp + 0x20]
call fcn.180351540
mov r8d, dword [rsp + 0x20]
mov eax, r8d
mov r9d, dword [rsp + 0x24]
mov edx, r8d
shr eax, 0x18
mov r10d, r9d
mov byte [rsp + 0x28], al
mov eax, r8d
shr eax, 0x10
mov byte [rsp + 0x29], al
mov eax, r8d
shr eax, 8
mov byte [rsp + 0x2a], al
mov eax, r9d
shr eax, 0x18
mov byte [rsp + 0x2c], al
mov eax, r9d
shr eax, 0x10
mov byte [rsp + 0x2d], al
mov eax, r9d
shr eax, 8
mov byte [rsp + 0x2e], al
inc ebp
mov byte [rsp + 0x2b], dl
mov byte [rsp + 0x2f], r10b
movsxd rax, ebx
movzx ecx, byte [rsp + rax + 0x28]
xor cl, byte [rdi]
mov byte [r15 + rdi], cl
inc rdi
inc ebx
and ebx, 7
test esi, esi
jne 0x180351d28
test ebp, ebp
je 0x180351df3
mov eax, r8d
mov byte [r14 + 3], dl
shr eax, 0x18
mov byte [r14], al
mov eax, r8d
shr eax, 0x10
mov byte [r14 + 1], al
mov eax, r9d
shr eax, 0x18
mov byte [r14 + 4], al
mov eax, r9d
shr eax, 0x10
shr r8d, 8
shr r9d, 8
mov byte [r14 + 6], r9b
mov byte [r14 + 2], r8b
mov byte [r14 + 5], al
mov byte [r14 + 7], r10b
mov dword [r12], ebx
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.180408b20
mov rbx, qword [rsp + 0x80]
add rsp, 0x40
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x1803522b0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x20], r9
push rbx
push rsi
push rdi
push r12
push r15
mov eax, Ordinal_50
call fcn.180409810
sub rsp, rax
mov rsi, qword [rsp + 0x88]
mov r10, r9
mov rdi, r8
mov r15, rdx
mov r12, rcx
mov ebx, dword [rsi]
test ebx, ebx
jns 0x1803522f5
mov dword [rsi], 0xffffffff
add rsp, 0x30
pop r15
pop r12
pop rdi
pop rsi
pop rbx
ret
mov qword [rsp + 0x60], rbp
mov rbp, qword [rsp + 0x80]
test ebx, ebx
je 0x180352328
test rdi, rdi
je 0x180352328
mov eax, ebx
dec rdi
movzx ecx, byte [rax + rbp]
xor cl, byte [r12]
inc r12
mov byte [r15], cl
inc r15
inc ebx
and ebx, 0xf
jne 0x180352306
mov r9, qword [rsp + 0x90]
cmp rdi, 0x10
jb 0x1803523f9
mov qword [rsp + 0x28], r13
mov rsi, r15
mov r13, rdi
mov qword [rsp + 0x20], r14
shr r13, 4
mov r14, r12
imul rax, r13, 0xfffffffffffffff0
sub rsi, rbp
sub r14, rbp
add rdi, rax
mov rax, r13
shl rax, 4
add r15, rax
mov qword [rsp + 0x68], r15
add r12, rax
mov r15, qword [rsp + 0x78]
nop word [rax + rax]
mov r8, r15
mov rdx, rbp
mov rcx, rbp
call r9
cmp ebx, 0x10
jae 0x1803523c5
mov edx, reloc.WS2_32.dll_ntohs
mov eax, ebx
sub edx, ebx
add rax, rbp
shr edx, 3
inc edx
nop dword [rax]
nop word [rax + rax]
mov rcx, qword [r14 + rax]
xor rcx, qword [rax]
mov qword [rsi + rax], rcx
lea rax, [rax + 8]
sub rdx, 1
jne 0x1803523b0
mov r9, qword [rsp + 0x90]
add rsi, 0x10
add r14, 0x10
xor ebx, ebx
sub r13, 1
jne 0x180352380
mov r14, qword [rsp + 0x20]
mov r13, qword [rsp + 0x28]
mov r15, qword [rsp + 0x68]
mov r10, qword [rsp + 0x78]
mov rsi, qword [rsp + 0x88]
test rdi, rdi
je 0x180352426
mov r8, r10
mov rdx, rbp
mov rcx, rbp
call r9
nop word [rax + rax]
mov ecx, ebx
inc ebx
movzx eax, byte [rcx + r12]
xor al, byte [rcx + rbp]
mov byte [rcx + r15], al
sub rdi, 1
jne 0x180352410
mov dword [rsi], ebx
mov rbp, qword [rsp + 0x60]
add rsp, 0x30
pop r15
pop r12
pop rdi
pop rsi
pop rbx
ret
Function at 0x180352e80
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rbp
push r14
mov eax, reloc.WLDAP32.dll_Ordinal_32
call fcn.180409810
sub rsp, rax
cmp qword [rcx + 0x38], 0
mov rbx, r8
mov r14, rdx
mov rbp, rcx
je 0x180352eb0
mov eax, 0xfffffffe
add rsp, 0x20
pop r14
pop rbp
pop rbx
ret
mov rcx, qword [rcx + 0x30]
movabs rax, 0x2000000000000000
add rcx, rbx
cmp rcx, rax
ja 0x180352fa2
cmp rcx, rbx
jb 0x180352fa2
mov qword [rsp + 0x40], rsi
mov esi, dword [rbp + 0x17c]
mov qword [rsp + 0x48], rdi
mov qword [rsp + 0x50], r12
mov qword [rbp + 0x30], rcx
test esi, esi
je 0x180352f26
test rbx, rbx
je 0x180352f82
movzx eax, byte [r14]
dec rbx
mov ecx, esi
inc r14
xor byte [rcx + rbp + 0x40], al
inc esi
and esi, 0xf
jne 0x180352ef0
lea r12, [rbp + 0x60]
lea rdi, [rbp + 0x40]
mov rdx, r12
mov rcx, rdi
call qword [rbp + 0x170]
jmp 0x180352f2e
lea r12, [rbp + 0x60]
lea rdi, [rbp + 0x40]
mov qword [rsp + 0x58], r15
mov r15, rbx
and r15, 0xfffffffffffffff0
je 0x180352f54
mov r9, r15
mov r8, r14
mov rdx, r12
mov rcx, rdi
call qword [rbp + 0x168]
add r14, r15
sub rbx, r15
mov r15, qword [rsp + 0x58]
test rbx, rbx
je 0x180352f82
mov esi, ebx
sub r14, rbp
nop dword [rax]
nop word [rax + rax]
movzx eax, byte [r14 + rdi - 0x40]
xor byte [rdi], al
lea rdi, [rdi + 1]
sub rbx, 1
jne 0x180352f70
mov rdi, qword [rsp + 0x48]
xor eax, eax
mov r12, qword [rsp + 0x50]
mov dword [rbp + 0x17c], esi
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop r14
pop rbp
pop rbx
ret
mov eax, 0xffffffff
add rsp, 0x20
pop r14
pop rbp
pop rbx
ret