joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180003b20
Capabilities:
Encrypt data using rc4 prga

Disassembly:
jmp 0x18026f890
push rbx
push rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x40
mov rax, qword [0x1802f0f00]
xor rax, rsp
mov qword [rsp + 0x30], rax
mov rsi, qword [rsp + 0xa0]
lea r10, [0x18064a9f8]
xor r11d, r11d
lea rdi, [0x18028644e]
test r9, r9
mov rax, rdx
mov r12, rdx
cmovne r10, r9
test rdx, rdx
lea ebp, [r11 + 1]
cmovne rdi, rdx
mov r15d, ebp
cmovne r15, r8
neg rax
sbb r14, r14
and r14, rcx
test r15, r15
jne 0x18026f900
mov rax, 0xfffffffffffffffe
jmp 0x18026fa4d
cmp word [r10 + 6], r11w
jne 0x18026f96f
movzx r9d, byte [rdi]
inc rdi
test r9b, r9b
js 0x18026f92a
test r14, r14
je 0x18026f91b
mov dword [r14], r9d
test r9b, r9b
setne r11b
mov rax, r11
jmp 0x18026fa4d
mov al, r9b
and al, 0xe0
cmp al, 0xc0
jne 0x18026f938
mov r8b, 2
jmp 0x18026f956
mov al, r9b
and al, 0xf0
cmp al, 0xe0
jne 0x18026f946
mov r8b, 3
jmp 0x18026f956
mov al, r9b
and al, 0xf8
cmp al, 0xf0
jne 0x18026fa42
mov r8b, 4
movzx eax, r8b
mov ecx, 7
sub ecx, eax
mov edx, ebp
shl edx, cl
mov bl, r8b
sub edx, ebp
and edx, r9d
jmp 0x18026f998
mov r8b, byte [r10 + 4]
mov edx, dword [r10]
mov bl, byte [r10 + 6]
lea eax, [r8 - 2]
cmp al, 2
ja 0x18026fa42
cmp bl, bpl
jb 0x18026fa42
cmp bl, r8b
jae 0x18026fa42
movzx ebp, bl
cmp rbp, r15
mov r9d, ebp
cmovae r9, r15
jmp 0x18026f9c5
movzx ecx, byte [rdi]
inc rdi
mov al, cl
and al, 0xc0
cmp al, 0x80
jne 0x18026fa42
mov eax, edx
and ecx, 0x3f
shl eax, 6
mov edx, ecx
or edx, eax
mov rax, rdi
sub rax, r12
cmp rax, r9
jb 0x18026f9a7
cmp r9, rbp
jae 0x18026f9f1
movzx eax, r8b
sub bl, r9b
mov word [r10 + 4], ax
movzx eax, bl
mov word [r10 + 6], ax
mov dword [r10], edx
jmp 0x18026f8f4
lea eax, [rdx - 0xd800]
cmp eax, 0x7ff
jbe 0x18026fa42
cmp edx, 0x110000
jae 0x18026fa42
movzx eax, r8b
mov dword [rsp + 0x20], 0x80
mov dword [rsp + 0x24], 0x800
mov dword [rsp + 0x28], 0x10000
cmp edx, dword [rsp + rax*4 + 0x18]
jb 0x18026fa42
test r14, r14
je 0x18026fa30
mov dword [r14], edx
neg edx
mov rdx, r10
sbb rcx, rcx
and rcx, rbp
call fcn.180007b44
jmp 0x18026fa4d
mov rdx, rsi
mov rcx, r10
call fcn.180008c97
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.180004700
add rsp, 0x40
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret

Function at 0x180003bd9
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
jmp 0x1801cb1c0
sub rsp, 0x18
mov r8, rcx
mov eax, 0x5a4d
cmp word [0x180000000], ax
jne 0x1801cb24d
movsxd rcx, dword [0x18000003c]
lea rdx, [0x180000000]
add rcx, rdx
cmp dword [rcx], 0x4550
jne 0x1801cb24d
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x1801cb24d
sub r8, rdx
movzx edx, word [rcx + 0x14]
add rdx, 0x18
add rdx, rcx
movzx eax, word [rcx + 6]
lea rcx, [rax + rax*4]
lea r9, [rdx + rcx*8]
mov qword [rsp], rdx
cmp rdx, r9
je 0x1801cb234
mov ecx, dword [rdx + 0xc]
cmp r8, rcx
jb 0x1801cb22e
mov eax, dword [rdx + 8]
add eax, ecx
cmp r8, rax
jb 0x1801cb236
add rdx, 0x28
jmp 0x1801cb213
xor edx, edx
test rdx, rdx
jne 0x1801cb23f
xor al, al
jmp 0x1801cb253
cmp dword [rdx + 0x24], 0
jge 0x1801cb249
xor al, al
jmp 0x1801cb253
mov al, 1
jmp 0x1801cb253
xor al, al
jmp 0x1801cb253
add rsp, 0x18
ret
Function at 0x180003cc9
Capabilities:
Encrypt data using rc4 prga

Disassembly:
jmp 0x18005ece0
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rsi
push rdi
sub rsp, 0xf8
cmp qword [0x1806407c0], 0
jne 0x18005ee0b
lea rax, [rsp + 0x80]
lea rcx, [0x180286a20]
mov rdi, rax
mov rsi, rcx
mov ecx, 0x68
rep movsb byte [rdi], byte [rsi]
mov eax, 2
imul rax, rax, 0x33
movzx eax, word [rsp + rax + 0x80]
test eax, eax
je 0x18005ed3c
mov dword [rsp + 0x2c], 1
jmp 0x18005ed44
mov dword [rsp + 0x2c], 0
movzx eax, byte [rsp + 0x2c]
mov byte [rsp + 0x20], al
movzx eax, byte [rsp + 0x20]
movzx eax, al
test eax, eax
je 0x18005edad
mov dword [rsp + 0x24], 0
jmp 0x18005ed6d
mov eax, dword [rsp + 0x24]
inc eax
mov dword [rsp + 0x24], eax
cmp dword [rsp + 0x24], 0x34
jge 0x18005edad
movsxd rax, dword [rsp + 0x24]
movzx eax, word [rsp + rax*2 + 0x80]
mov dword [rsp + 0x30], eax
mov eax, dword [rsp + 0x24]
cdq
mov ecx, 3
idiv ecx
mov eax, edx
add eax, 0xa
mov ecx, dword [rsp + 0x30]
xor ecx, eax
mov eax, ecx
movsxd rcx, dword [rsp + 0x24]
mov word [rsp + rcx*2 + 0x80], ax
jmp 0x18005ed63
lea rax, [rsp + 0x80]
mov qword [rsp + 0x58], rax
mov rax, qword [rsp + 0x58]
xor r9d, r9d
mov r8, rax
xor edx, edx
xor ecx, ecx
call fcn.180002662
mov qword [rsp + 0x60], rax
mov rax, qword [rsp + 0x60]
mov qword [0x1806407c0], rax
mov dword [rsp + 0x28], 0
jmp 0x18005edf3
mov eax, dword [rsp + 0x28]
inc eax
mov dword [rsp + 0x28], eax
cmp dword [rsp + 0x28], 0x34
jge 0x18005ee0b
movsxd rax, dword [rsp + 0x28]
xor ecx, ecx
mov word [rsp + rax*2 + 0x80], cx
jmp 0x18005ede9
mov qword [rsp + 0x40], 0
mov dword [rsp + 0x4c], 0
mov dword [rsp + 0x48], 0
lea rax, [rsp + 0x50]
mov rdi, rax
xor eax, eax
mov ecx, 4
rep stosb byte [rdi], al
lea rax, [rsp + 0x54]
mov rdi, rax
xor eax, eax
mov ecx, 4
rep stosb byte [rdi], al
mov rax, qword [0x1806407c0]
mov qword [rsp + 0x68], rax
mov rax, qword [rsp + 0x110]
mov rax, qword [rax]
mov qword [rsp + 0x38], rax
cmp qword [rsp + 0x38], 0
je 0x18005ee98
mov eax, 8
imul rax, rax, 0x4f
mov rcx, qword [rsp + 0x38]
mov rax, qword [rcx + rax]
mov qword [rsp + 0x70], rax
lea r8, [rsp + 0x40]
mov rdx, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x110]
call qword [rsp + 0x70]
nop
lea rax, [rsp + 0x40]
mov rdi, qword [rsp + 0x118]
mov rsi, rax
mov ecx, 0x18
rep movsb byte [rdi], byte [rsi]
mov rax, qword [rsp + 0x118]
add rsp, 0xf8
pop rdi
pop rsi
ret
Function at 0x180003d8c
Capabilities:
Encrypt data using rc4 prga

Disassembly:
jmp 0x18005c360
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rsi
push rdi
sub rsp, 0xc8
cmp qword [0x180640b00], 0
jne 0x18005c48b
lea rax, [rsp + 0x80]
lea rcx, str.Ldikcd_Ko
mov rdi, rax
mov rsi, rcx
mov ecx, 0x3a
rep movsb byte [rdi], byte [rsi]
mov eax, 2
imul rax, rax, 0x1c
movzx eax, word [rsp + rax + 0x80]
test eax, eax
je 0x18005c3bc
mov dword [rsp + 0x2c], 1
jmp 0x18005c3c4
mov dword [rsp + 0x2c], 0
movzx eax, byte [rsp + 0x2c]
mov byte [rsp + 0x20], al
movzx eax, byte [rsp + 0x20]
movzx eax, al
test eax, eax
je 0x18005c42d
mov dword [rsp + 0x24], 0
jmp 0x18005c3ed
mov eax, dword [rsp + 0x24]
inc eax
mov dword [rsp + 0x24], eax
cmp dword [rsp + 0x24], 0x1d
jge 0x18005c42d
movsxd rax, dword [rsp + 0x24]
movzx eax, word [rsp + rax*2 + 0x80]
mov dword [rsp + 0x30], eax
mov eax, dword [rsp + 0x24]
cdq
mov ecx, 3
idiv ecx
mov eax, edx
add eax, 0xa
mov ecx, dword [rsp + 0x30]
xor ecx, eax
mov eax, ecx
movsxd rcx, dword [rsp + 0x24]
mov word [rsp + rcx*2 + 0x80], ax
jmp 0x18005c3e3
lea rax, [rsp + 0x80]
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
xor r9d, r9d
mov r8, rax
xor edx, edx
xor ecx, ecx
call fcn.180002662
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x48]
mov qword [0x180640b00], rax
mov dword [rsp + 0x28], 0
jmp 0x18005c473
mov eax, dword [rsp + 0x28]
inc eax
mov dword [rsp + 0x28], eax
cmp dword [rsp + 0x28], 0x1d
jge 0x18005c48b
movsxd rax, dword [rsp + 0x28]
xor ecx, ecx
mov word [rsp + rax*2 + 0x80], cx
jmp 0x18005c469
lea rax, [rsp + 0x60]
mov rdi, rax
xor eax, eax
mov ecx, 8
rep stosb byte [rdi], al
xorps xmm0, xmm0
movsd qword [rsp + 0x68], xmm0
xorps xmm0, xmm0
movsd qword [rsp + 0x70], xmm0
xorps xmm0, xmm0
movsd qword [rsp + 0x78], xmm0
mov rax, qword [0x180640b00]
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0xe0]
mov rax, qword [rax]
mov qword [rsp + 0x38], rax
cmp qword [rsp + 0x38], 0
je 0x18005c509
mov eax, 8
imul rax, rax, 0x4f
mov rcx, qword [rsp + 0x38]
mov rax, qword [rcx + rax]
mov qword [rsp + 0x58], rax
lea r8, [rsp + 0x60]
mov rdx, qword [rsp + 0x50]
mov rcx, qword [rsp + 0xe0]
call qword [rsp + 0x58]
nop
lea rax, [rsp + 0x68]
mov rdi, qword [rsp + 0xe8]
mov rsi, rax
mov ecx, 0x18
rep movsb byte [rdi], byte [rsi]
mov rax, qword [rsp + 0xe8]
add rsp, 0xc8
pop rdi
pop rsi
ret
Function at 0x180003f12
Capabilities:
Encrypt data using rc4 prga

Disassembly:
jmp 0x18005f7d0
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rsi
push rdi
sub rsp, 0xd8
cmp qword [0x1806409d0], 0
jne 0x18005f900
lea rax, [rsp + 0x80]
lea rcx, [0x180287040]
mov rdi, rax
mov rsi, rcx
mov ecx, 0x42
rep movsb byte [rdi], byte [rsi]
mov eax, 2
imul rax, rax, 0x20
movzx eax, word [rsp + rax + 0x80]
test eax, eax
je 0x18005f831
mov dword [rsp + 0x2c], 1
jmp 0x18005f839
mov dword [rsp + 0x2c], 0
movzx eax, byte [rsp + 0x2c]
mov byte [rsp + 0x20], al
movzx eax, byte [rsp + 0x20]
movzx eax, al
test eax, eax
je 0x18005f8a2
mov dword [rsp + 0x24], 0
jmp 0x18005f862
mov eax, dword [rsp + 0x24]
inc eax
mov dword [rsp + 0x24], eax
cmp dword [rsp + 0x24], 0x21
jge 0x18005f8a2
movsxd rax, dword [rsp + 0x24]
movzx eax, word [rsp + rax*2 + 0x80]
mov dword [rsp + 0x30], eax
mov eax, dword [rsp + 0x24]
cdq
mov ecx, 3
idiv ecx
mov eax, edx
add eax, 0xa
mov ecx, dword [rsp + 0x30]
xor ecx, eax
mov eax, ecx
movsxd rcx, dword [rsp + 0x24]
mov word [rsp + rcx*2 + 0x80], ax
jmp 0x18005f858
lea rax, [rsp + 0x80]
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
xor r9d, r9d
mov r8, rax
xor edx, edx
xor ecx, ecx
call fcn.180002662
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x48]
mov qword [0x1806409d0], rax
mov dword [rsp + 0x28], 0
jmp 0x18005f8e8
mov eax, dword [rsp + 0x28]
inc eax
mov dword [rsp + 0x28], eax
cmp dword [rsp + 0x28], 0x21
jge 0x18005f900
movsxd rax, dword [rsp + 0x28]
xor ecx, ecx
mov word [rsp + rax*2 + 0x80], cx
jmp 0x18005f8de
mov rax, qword [rsp + 0x100]
mov qword [rsp + 0x60], rax
xorps xmm0, xmm0
movsd qword [rsp + 0x68], xmm0
xorps xmm0, xmm0
movsd qword [rsp + 0x70], xmm0
xorps xmm0, xmm0
movsd qword [rsp + 0x78], xmm0
mov rax, qword [0x1806409d0]
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0xf0]
mov rax, qword [rax]
mov qword [rsp + 0x38], rax
cmp qword [rsp + 0x38], 0
je 0x18005f97a
mov eax, 8
imul rax, rax, 0x4f
mov rcx, qword [rsp + 0x38]
mov rax, qword [rcx + rax]
mov qword [rsp + 0x58], rax
lea r8, [rsp + 0x60]
mov rdx, qword [rsp + 0x50]
mov rcx, qword [rsp + 0xf0]
call qword [rsp + 0x58]
nop
lea rax, [rsp + 0x68]
mov rdi, qword [rsp + 0xf8]
mov rsi, rax
mov ecx, 0x18
rep movsb byte [rdi], byte [rsi]
mov rax, qword [rsp + 0xf8]
add rsp, 0xd8
pop rdi
pop rsi
ret
Function at 0x180003f9e
Capabilities:
Encrypt data using rc4 prga

Disassembly:
jmp 0x180027f90
mov qword [rsp + 8], rcx
push rsi
push rdi
sub rsp, 0xb8
cmp qword [0x180640b40], 0
jne 0x1800280a4
lea rax, [rsp + 0x60]
lea rcx, str.LdJxbnbk_ibbofn_IjbIdbjed__krixx_f
mov rdi, rax
mov rsi, rcx
mov ecx, 0x48
rep movsb byte [rdi], byte [rsi]
mov eax, 2
imul rax, rax, 0x23
movzx eax, word [rsp + rax + 0x60]
test eax, eax
je 0x180027fe1
mov dword [rsp + 0x2c], 1
jmp 0x180027fe9
mov dword [rsp + 0x2c], 0
movzx eax, byte [rsp + 0x2c]
mov byte [rsp + 0x21], al
movzx eax, byte [rsp + 0x21]
movzx eax, al
test eax, eax
je 0x18002804c
mov dword [rsp + 0x24], 0
jmp 0x180028012
mov eax, dword [rsp + 0x24]
inc eax
mov dword [rsp + 0x24], eax
cmp dword [rsp + 0x24], 0x24
jge 0x18002804c
movsxd rax, dword [rsp + 0x24]
movzx eax, word [rsp + rax*2 + 0x60]
mov dword [rsp + 0x30], eax
mov eax, dword [rsp + 0x24]
cdq
mov ecx, 3
idiv ecx
mov eax, edx
add eax, 0xa
mov ecx, dword [rsp + 0x30]
xor ecx, eax
mov eax, ecx
movsxd rcx, dword [rsp + 0x24]
mov word [rsp + rcx*2 + 0x60], ax
jmp 0x180028008
lea rax, [rsp + 0x60]
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
xor r9d, r9d
mov r8, rax
xor edx, edx
xor ecx, ecx
call fcn.180002662
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x48]
mov qword [0x180640b40], rax
mov dword [rsp + 0x28], 0
jmp 0x18002808f
mov eax, dword [rsp + 0x28]
inc eax
mov dword [rsp + 0x28], eax
cmp dword [rsp + 0x28], 0x24
jge 0x1800280a4
movsxd rax, dword [rsp + 0x28]
xor ecx, ecx
mov word [rsp + rax*2 + 0x60], cx
jmp 0x180028085
lea rax, [rsp + 0x20]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
mov rax, qword [0x180640b40]
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0xd0]
mov rax, qword [rax]
mov qword [rsp + 0x38], rax
cmp qword [rsp + 0x38], 0
je 0x180028107
mov eax, 8
imul rax, rax, 0x4f
mov rcx, qword [rsp + 0x38]
mov rax, qword [rcx + rax]
mov qword [rsp + 0x58], rax
lea r8, [rsp + 0x20]
mov rdx, qword [rsp + 0x50]
mov rcx, qword [rsp + 0xd0]
call qword [rsp + 0x58]
nop
movzx eax, byte [rsp + 0x20]
add rsp, 0xb8
pop rdi
pop rsi
ret
Function at 0x1800040f7
Capabilities:
Encrypt data using rc4 prga

Disassembly:
jmp 0x18007a500
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rsi
push rdi
sub rsp, 0xf8
cmp qword [0x180640eb0], 0
jne 0x18007a630
lea rax, [rsp + 0xa0]
lea rcx, [0x180288e30]
mov rdi, rax
mov rsi, rcx
mov ecx, 0x44
rep movsb byte [rdi], byte [rsi]
mov eax, 2
imul rax, rax, 0x21
movzx eax, word [rsp + rax + 0xa0]
test eax, eax
je 0x18007a561
mov dword [rsp + 0x2c], 1
jmp 0x18007a569
mov dword [rsp + 0x2c], 0
movzx eax, byte [rsp + 0x2c]
mov byte [rsp + 0x20], al
movzx eax, byte [rsp + 0x20]
movzx eax, al
test eax, eax
je 0x18007a5d2
mov dword [rsp + 0x24], 0
jmp 0x18007a592
mov eax, dword [rsp + 0x24]
inc eax
mov dword [rsp + 0x24], eax
cmp dword [rsp + 0x24], 0x22
jge 0x18007a5d2
movsxd rax, dword [rsp + 0x24]
movzx eax, word [rsp + rax*2 + 0xa0]
mov dword [rsp + 0x30], eax
mov eax, dword [rsp + 0x24]
cdq
mov ecx, 3
idiv ecx
mov eax, edx
add eax, 0xa
mov ecx, dword [rsp + 0x30]
xor ecx, eax
mov eax, ecx
movsxd rcx, dword [rsp + 0x24]
mov word [rsp + rcx*2 + 0xa0], ax
jmp 0x18007a588
lea rax, [rsp + 0xa0]
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
xor r9d, r9d
mov r8, rax
xor edx, edx
xor ecx, ecx
call fcn.180002662
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x48]
mov qword [0x180640eb0], rax
mov dword [rsp + 0x28], 0
jmp 0x18007a618
mov eax, dword [rsp + 0x28]
inc eax
mov dword [rsp + 0x28], eax
cmp dword [rsp + 0x28], 0x22
jge 0x18007a630
movsxd rax, dword [rsp + 0x28]
xor ecx, ecx
mov word [rsp + rax*2 + 0xa0], cx
jmp 0x18007a60e
lea rax, [rsp + 0x60]
mov rdi, rax
mov rsi, qword [rsp + 0x118]
mov ecx, 0x18
rep movsb byte [rdi], byte [rsi]
lea rax, [rsp + 0x78]
mov rdi, rax
mov rsi, qword [rsp + 0x120]
mov ecx, 0x18
rep movsb byte [rdi], byte [rsi]
lea rax, [rsp + 0x90]
mov rdi, rax
xor eax, eax
mov ecx, 8
rep stosb byte [rdi], al
mov rax, qword [0x180640eb0]
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x110]
mov rax, qword [rax]
mov qword [rsp + 0x38], rax
cmp qword [rsp + 0x38], 0
je 0x18007a6c4
mov eax, 8
imul rax, rax, 0x4f
mov rcx, qword [rsp + 0x38]
mov rax, qword [rcx + rax]
mov qword [rsp + 0x58], rax
lea r8, [rsp + 0x60]
mov rdx, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x110]
call qword [rsp + 0x58]
nop
movsd xmm0, qword [rsp + 0x90]
add rsp, 0xf8
pop rdi
pop rsi
ret
Function at 0x1800042c8
Capabilities:
Encrypt data using rc4 prga

Disassembly:
jmp 0x18005bb30
mov qword [rsp + 8], rcx
push rsi
push rdi
sub rsp, 0xd8
cmp qword [0x180640a70], 0
jne 0x18005bc44
lea rax, [rsp + 0x60]
lea rcx, [0x180287440]
mov rdi, rax
mov rsi, rcx
mov ecx, 0x6c
rep movsb byte [rdi], byte [rsi]
mov eax, 2
imul rax, rax, 0x35
movzx eax, word [rsp + rax + 0x60]
test eax, eax
je 0x18005bb81
mov dword [rsp + 0x2c], 1
jmp 0x18005bb89
mov dword [rsp + 0x2c], 0
movzx eax, byte [rsp + 0x2c]
mov byte [rsp + 0x20], al
movzx eax, byte [rsp + 0x20]
movzx eax, al
test eax, eax
je 0x18005bbec
mov dword [rsp + 0x24], 0
jmp 0x18005bbb2
mov eax, dword [rsp + 0x24]
inc eax
mov dword [rsp + 0x24], eax
cmp dword [rsp + 0x24], 0x36
jge 0x18005bbec
movsxd rax, dword [rsp + 0x24]
movzx eax, word [rsp + rax*2 + 0x60]
mov dword [rsp + 0x34], eax
mov eax, dword [rsp + 0x24]
cdq
mov ecx, 3
idiv ecx
mov eax, edx
add eax, 0xa
mov ecx, dword [rsp + 0x34]
xor ecx, eax
mov eax, ecx
movsxd rcx, dword [rsp + 0x24]
mov word [rsp + rcx*2 + 0x60], ax
jmp 0x18005bba8
lea rax, [rsp + 0x60]
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
xor r9d, r9d
mov r8, rax
xor edx, edx
xor ecx, ecx
call fcn.180002662
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x48]
mov qword [0x180640a70], rax
mov dword [rsp + 0x28], 0
jmp 0x18005bc2f
mov eax, dword [rsp + 0x28]
inc eax
mov dword [rsp + 0x28], eax
cmp dword [rsp + 0x28], 0x36
jge 0x18005bc44
movsxd rax, dword [rsp + 0x28]
xor ecx, ecx
mov word [rsp + rax*2 + 0x60], cx
jmp 0x18005bc25
lea rax, [rsp + 0x30]
mov rdi, rax
xor eax, eax
mov ecx, 4
rep stosb byte [rdi], al
mov rax, qword [0x180640a70]
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0xf0]
mov rax, qword [rax]
mov qword [rsp + 0x38], rax
cmp qword [rsp + 0x38], 0
je 0x18005bca7
mov eax, 8
imul rax, rax, 0x4f
mov rcx, qword [rsp + 0x38]
mov rax, qword [rcx + rax]
mov qword [rsp + 0x58], rax
lea r8, [rsp + 0x30]
mov rdx, qword [rsp + 0x50]
mov rcx, qword [rsp + 0xf0]
call qword [rsp + 0x58]
nop
movss xmm0, dword [rsp + 0x30]
add rsp, 0xd8
pop rdi
pop rsi
ret

Function at 0x180004386
Capabilities:
Query environment variable

Disassembly:
jmp 0x18025ea3c
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor ebp, ebp
mov rbx, rax
test rax, rax
je 0x18025eac3
mov rsi, rbx
cmp word [rax], bp
je 0x18025ea82
or rax, 0xffffffffffffffff
inc rax
cmp word [rsi + rax*2], bp
jne 0x18025ea6c
lea rsi, [rsi + rax*2]
add rsi, 2
cmp word [rsi], bp
jne 0x18025ea68
sub rsi, rbx
add rsi, 2
sar rsi, 1
add rsi, rsi
mov rcx, rsi
call fcn.180001087
mov rdi, rax
test rax, rax
je 0x18025eab0
mov r8, rsi
mov rdx, rbx
mov rcx, rax
call fcn.18000472d
mov rbp, rdi
xor ecx, ecx
call fcn.18000135c
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rax, rbp
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x18000448f
Capabilities:
Encrypt data using rc4 prga

Disassembly:
jmp 0x180033e20
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rsi
push rdi
sub rsp, 0x98
cmp qword [0x180640730], 0
jne 0x180033f39
lea rax, [rsp + 0x68]
lea rcx, str.Khxey_Nb
mov rdi, rax
mov rsi, rcx
mov ecx, 0x26
rep movsb byte [rdi], byte [rsi]
mov eax, 2
imul rax, rax, 0x12
movzx eax, word [rsp + rax + 0x68]
test eax, eax
je 0x180033e76
mov dword [rsp + 0x2c], 1
jmp 0x180033e7e
mov dword [rsp + 0x2c], 0
movzx eax, byte [rsp + 0x2c]
mov byte [rsp + 0x20], al
movzx eax, byte [rsp + 0x20]
movzx eax, al
test eax, eax
je 0x180033ee1
mov dword [rsp + 0x24], 0
jmp 0x180033ea7
mov eax, dword [rsp + 0x24]
inc eax
mov dword [rsp + 0x24], eax
cmp dword [rsp + 0x24], 0x13
jge 0x180033ee1
movsxd rax, dword [rsp + 0x24]
movzx eax, word [rsp + rax*2 + 0x68]
mov dword [rsp + 0x30], eax
mov eax, dword [rsp + 0x24]
cdq
mov ecx, 3
idiv ecx
mov eax, edx
add eax, 0xa
mov ecx, dword [rsp + 0x30]
xor ecx, eax
mov eax, ecx
movsxd rcx, dword [rsp + 0x24]
mov word [rsp + rcx*2 + 0x68], ax
jmp 0x180033e9d
lea rax, [rsp + 0x68]
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
xor r9d, r9d
mov r8, rax
xor edx, edx
xor ecx, ecx
call fcn.180002662
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x48]
mov qword [0x180640730], rax
mov dword [rsp + 0x28], 0
jmp 0x180033f24
mov eax, dword [rsp + 0x28]
inc eax
mov dword [rsp + 0x28], eax
cmp dword [rsp + 0x28], 0x13
jge 0x180033f39
movsxd rax, dword [rsp + 0x28]
xor ecx, ecx
mov word [rsp + rax*2 + 0x68], cx
jmp 0x180033f1a
mov rax, qword [rsp + 0xb8]
mov qword [rsp + 0x50], rax
mov rax, qword [0x180640730]
mov qword [rsp + 0x58], rax
mov rax, qword [rsp + 0xb0]
mov rax, qword [rax]
mov qword [rsp + 0x38], rax
cmp qword [rsp + 0x38], 0
je 0x180033f98
mov eax, 8
imul rax, rax, 0x4f
mov rcx, qword [rsp + 0x38]
mov rax, qword [rcx + rax]
mov qword [rsp + 0x60], rax
lea r8, [rsp + 0x50]
mov rdx, qword [rsp + 0x58]
mov rcx, qword [rsp + 0xb0]
call qword [rsp + 0x60]
nop
add rsp, 0x98
pop rdi
pop rsi
ret
Function at 0x180004589
Capabilities:
Encrypt data using rc4 prga

Disassembly:
jmp 0x18005b910
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rsi
push rdi
sub rsp, 0xb8
cmp qword [0x1806409f0], 0
jne 0x18005ba29
lea rax, [rsp + 0x70]
lea rcx, [0x1802870e0]
mov rdi, rax
mov rsi, rcx
mov ecx, 0x36
rep movsb byte [rdi], byte [rsi]
mov eax, 2
imul rax, rax, 0x1a
movzx eax, word [rsp + rax + 0x70]
test eax, eax
je 0x18005b966
mov dword [rsp + 0x2c], 1
jmp 0x18005b96e
mov dword [rsp + 0x2c], 0
movzx eax, byte [rsp + 0x2c]
mov byte [rsp + 0x20], al
movzx eax, byte [rsp + 0x20]
movzx eax, al
test eax, eax
je 0x18005b9d1
mov dword [rsp + 0x24], 0
jmp 0x18005b997
mov eax, dword [rsp + 0x24]
inc eax
mov dword [rsp + 0x24], eax
cmp dword [rsp + 0x24], 0x1b
jge 0x18005b9d1
movsxd rax, dword [rsp + 0x24]
movzx eax, word [rsp + rax*2 + 0x70]
mov dword [rsp + 0x30], eax
mov eax, dword [rsp + 0x24]
cdq
mov ecx, 3
idiv ecx
mov eax, edx
add eax, 0xa
mov ecx, dword [rsp + 0x30]
xor ecx, eax
mov eax, ecx
movsxd rcx, dword [rsp + 0x24]
mov word [rsp + rcx*2 + 0x70], ax
jmp 0x18005b98d
lea rax, [rsp + 0x70]
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x50]
xor r9d, r9d
mov r8, rax
xor edx, edx
xor ecx, ecx
call fcn.180002662
mov qword [rsp + 0x58], rax
mov rax, qword [rsp + 0x58]
mov qword [0x1806409f0], rax
mov dword [rsp + 0x28], 0
jmp 0x18005ba14
mov eax, dword [rsp + 0x28]
inc eax
mov dword [rsp + 0x28], eax
cmp dword [rsp + 0x28], 0x1b
jge 0x18005ba29
movsxd rax, dword [rsp + 0x28]
xor ecx, ecx
mov word [rsp + rax*2 + 0x70], cx
jmp 0x18005ba0a
mov qword [rsp + 0x40], 0
mov dword [rsp + 0x4c], 0
mov dword [rsp + 0x48], 0
mov rax, qword [0x1806409f0]
mov qword [rsp + 0x60], rax
mov rax, qword [rsp + 0xd0]
mov rax, qword [rax]
mov qword [rsp + 0x38], rax
cmp qword [rsp + 0x38], 0
je 0x18005ba94
mov eax, 8
imul rax, rax, 0x4f
mov rcx, qword [rsp + 0x38]
mov rax, qword [rcx + rax]
mov qword [rsp + 0x68], rax
lea r8, [rsp + 0x40]
mov rdx, qword [rsp + 0x60]
mov rcx, qword [rsp + 0xd0]
call qword [rsp + 0x68]
nop
lea rax, [rsp + 0x40]
mov rdi, qword [rsp + 0xd8]
mov rsi, rax
mov ecx, 0x10
rep movsb byte [rdi], byte [rsi]
mov rax, qword [rsp + 0xd8]
add rsp, 0xb8
pop rdi
pop rsi
ret