joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1800e17ab
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
cmovb r9w, bp
shr bh, cl
movsx r8, r13w
mov qword [rsp + 0x10], rbp
btr bx, 0x14
mov qword [rsp + 0x18], rsi
rcl r8b, 0x7e
shr r9b, 0x5a
mov qword [rsp + 0x20], rdi
push r14
shr r8b, cl
sub ebx, r12d
sub rsp, 0x40
stc
movsxd r9, edi
add r8, rdi
mov r8, qword [0x180088ef0]
bt r14w, r11w
btc bx, 0xa3
movsx r9d, r12w
xor ebp, ebp
movsx r9, r8w
mov r14, rcx
bt bx, sp
movsx bx, r9b
mov ebx, ebp
sub r9b, bpl
cmp r12b, spl
mov r9d, dword [r8 + 0x14]
stc
jmp 0x1800e1823
test r9d, r9d
jmp 0x1800e182b
jle 0x1800e1a27
mov eax, ebx
adc r10w, si
cdq
ror cx, 0xb3
movzx edx, dx
shl cl, cl
add eax, edx
btc r10d, 0x68
mov ecx, eax
btr r10w, sp
movzx eax, ax
inc r10b
rcr r10w, cl
sub eax, edx
shr r10b, 0x3a
sar ecx, 0x10
bts r10d, r9d
movsxd r10, eax
stc
cmp ebx, r9d
jmp 0x1800e1872
jge 0x1800e1a18
test ebx, ebx
js 0x1800e1a18
cmp ecx, dword [r8 + 0x1c]
jmp 0x1800e1889
jg 0x1800e1a18
cmp ebx, dword [r8 + 0x10]
jg 0x1800e1a18
mov rax, qword [r8]
movzx rdx, r11w
movsxd rcx, ecx
xor dl, sil
mov rdx, qword [rax + rcx*8]
clc
cmp r12b, 0x32
test rdx, rdx
jmp 0x1800e18b7
je 0x1800e1a18
mov rax, r10
cmc
shl rax, 4
cmc
add rax, rdx
je 0x1800e1a18
mov rsi, qword [rax]
test rsi, rsi
jmp 0x1800e18da
je 0x1800e1a18
lea rdx, [rsp + 0x20]
cmovl rcx, r12
movsx cx, r15b
xchg cl, ch
mov rcx, rsi
jmp 0x1800e18f8
call fcn.1800e577a
cmp qword [r14 + 0x18], 0x10
movsxd rdx, ebp
cwd
mov rdx, r14
jmp 0x1800e190f
jb 0x1800e1918
mov rdx, qword [r14]
cmp qword [rax + 0x18], 0x10
mov r8, qword [rax + 0x10]
jb 0x1800e192e
mov rax, qword [rax]
test r12b, 0xd5
cmp r8, qword [r14 + 0x10]
jmp 0x1800e1937
jne 0x1800e195f
mov rcx, rax
jmp 0x1800e1945
call fcn.180119e6e
test eax, eax
jne 0x1800e195f
mov dil, 1
jmp 0x1800e195a
jmp 0x1800e196b
sub dil, dil
movzx edx, r9w
btc dx, r13w
mov rdx, qword [rsp + 0x38]
cmc
cmp rdx, 0x10
jmp 0x1800e197a
jb 0x1800e19dd
mov rcx, qword [rsp + 0x20]
lahf
inc al
dec al
inc rdx
shl ax, cl
btr ax, sp
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800e19d8
mov rcx, qword [rcx - 8]
test r13b, 0xa3
cmp di, r10w
cmp dx, 0x55c6
add rdx, 0x27
cmp rcx, 0x44ad3820
sub rax, rcx
clc
add rax, 0xfffffffffffffff8
stc
cmp rax, 0x1f
jmp 0x1800e19d2
ja 0x1800e1a89
call fcn.180099614
mov qword [rsp + 0x30], rbp
mov qword [rsp + 0x38], 0xf
mov byte [rsp + 0x20], bpl
test r11d, 0x7dc169ab
test dil, dil
jmp 0x1800e19ff
jne 0x1800e1a7c
mov r8, qword [0x180088ef0]
movsx r9, bx
movsx r9w, spl
not r9b
mov r9d, dword [r8 + 0x14]
inc ebx
cmp ebx, r9d
jl 0x1800e1831
xor eax, eax
or di, 0x145f
mov rbx, qword [rsp + 0x50]
add r14, 0x5d9e33e0
rcr r14b, cl
btr si, 0xcf
mov rbp, qword [rsp + 0x58]
add si, r13w
bts r14w, bx
mov di, 0x4d75
mov rsi, qword [rsp + 0x60]
bt di, 0xe
mov rdi, qword [rsp + 0x68]
mov r14w, dx
add rsp, 0x40
cmovl r14w, bp
seta r14b
pop r14
jmp 0x1800e1a7b
ret
mov rax, rsi
jmp 0x1800e1a84
jmp 0x1800e1a2e
call fcn.180122a65
int3
Function at 0x1800e5df1
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
sbb r9b, 0x93
and r8b, r9b
setne r8b
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
shr r9w, cl
push r14
test r9b, 0x87
sub rsp, 0x40
mov r8, qword [0x180088ef0]
sar r14, cl
xor ebp, ebp
movzx r14d, r10w
shr r9b, 0x4b
xor bl, r8b
mov r14, rcx
mov ebx, ebp
cmc
sar r9, 0x1c
mov r9d, dword [r8 + 0x14]
cmc
test ecx, edx
test r9d, r9d
jmp 0x1800e5e4e
jle 0x1800e608a
mov eax, ebx
cmovae cx, bx
rcl ch, 0x8a
cdq
bt ecx, 0x70
rcr cx, cl
movzx edx, dx
mov r10w, 0x3c2d
add eax, edx
mov ecx, eax
movzx eax, ax
movsx r10d, cx
test r8w, 0xc7d
add r10d, r10d
sub eax, edx
sar ecx, 0x10
and r10b, al
movsxd r10, eax
clc
cmp r14b, 0xe1
cmp ebx, r9d
jmp 0x1800e5e99
jge 0x1800e606d
test ebx, ebx
jmp 0x1800e5ea6
js 0x1800e606d
cmp ecx, dword [r8 + 0x1c]
jmp 0x1800e5eb5
jg 0x1800e606d
cmp ebx, dword [r8 + 0x10]
jg 0x1800e606d
mov rax, qword [r8]
movsxd rcx, ecx
movsx dx, r13b
btr dx, 0xe6
mov rdx, qword [rax + rcx*8]
cmp sp, bx
cmc
test rdx, rdx
jmp 0x1800e5ee5
je 0x1800e606d
mov rax, r10
test r15b, r12b
shl rax, 4
cmc
cmp r9b, 0x3e
add rax, rdx
jmp 0x1800e5f02
je 0x1800e606d
mov rsi, qword [rax]
clc
test rsi, rsi
jmp 0x1800e5f14
je 0x1800e606d
lea rdx, [rsp + 0x20]
movsxd rcx, ebx
mov ch, 0xa1
mov rcx, rsi
jmp 0x1800e5f2d
call fcn.1800e577a
cmp qword [r14 + 0x18], 0x10
movzx dx, r13b
movzx rdx, r14w
cwd
mov rdx, r14
jb 0x1800e5f56
mov rdx, qword [r14]
shr r8w, cl
sar r8, 0x3a
cmp qword [rax + 0x18], 0x10
mov r8, qword [rax + 0x10]
jb 0x1800e5f69
mov rax, qword [rax]
cmc
cmp r8, qword [r14 + 0x10]
jmp 0x1800e5f72
jne 0x1800e5f9a
mov rcx, rax
jmp 0x1800e5f80
call fcn.180119e6e
test eax, eax
jmp 0x1800e5f8c
jne 0x1800e5f9a
mov dil, 1
jmp 0x1800e5fa7
xor dil, dil
rcl dh, cl
cmovp dx, si
bsr dx, bp
mov rdx, qword [rsp + 0x38]
cmp r15b, r10b
test sp, 0x49dd
cmp rcx, 0x3e401d03
cmp rdx, 0x10
jmp 0x1800e5fc4
jb 0x1800e6028
mov rcx, qword [rsp + 0x20]
inc rdx
mov rax, rcx
cmp rbx, 0x1196e1a
cmp rdx, 0x1000
jmp 0x1800e5fe8
jb 0x1800e6023
mov rcx, qword [rcx - 8]
test r9d, esp
cmp rbx, r8
add rdx, 0x27
test r10, rsi
jmp 0x1800e6004
sub rax, rcx
test r11w, si
add rax, 0xfffffffffffffff8
test cx, r12w
stc
cmp rax, 0x1f
jmp 0x1800e601d
ja 0x1800e60e1
call fcn.180099614
mov qword [rsp + 0x30], rbp
test r12b, r14b
jmp 0x1800e6036
mov qword [rsp + 0x38], 0xf
cmp r13b, r15b
mov byte [rsp + 0x20], bpl
cmp ecx, 0xf5c3b1f
test dil, dil
jmp 0x1800e6055
jne 0x1800e6096
mov r8, qword [0x180088ef0]
xchg r9b, r9b
jmp 0x1800e606d
mov r9d, dword [r8 + 0x14]
jmp 0x1800e6076
inc ebx
test r12b, 0x1c
cmp ebx, r9d
jmp 0x1800e6084
jl 0x1800e5e54
mov rsi, rbp
movzx bx, r13b
shl r14b, cl
cmc
mov rbx, qword [rsp + 0x50]
xadd r14b, dil
shl dil, 0x10
mov rax, rsi
mov rsi, qword [rsp + 0x60]
bsf r14w, r15w
add dil, 9
mov rbp, qword [rsp + 0x58]
sar dil, 0xc8
bt di, ax
movzx r14w, sil
mov rdi, qword [rsp + 0x68]
not r14d
sar r14b, cl
add rsp, 0x40
movzx r14d, di
pop r14
jmp 0x1800e60e0
ret
call fcn.180122a65
int3
Function at 0x180115786
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
sub rsp, 0x18
movsx r8w, dl
mov r8, rcx
setns al
sub ax, 0x30ee
shr rax, cl
mov eax, 0x5a4d
cmp r12b, 0xc3
cmp word [0x180000000], ax
jmp 0x1801157b1
jne 0x1801158e1
movsxd rcx, dword [0x18000003c]
btr dx, 0xe3
lea rdx, [0x180000000]
jmp 0x1801157d6
lea rcx, [rcx + rdx]
cmc
jmp 0x1801157e3
cmp dword [rcx], 0x4550
jmp 0x1801157ee
jne 0x1801158e1
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jmp 0x180115802
jne 0x1801158e1
sub r8, rdx
movzx eax, word [rcx + 0x14]
sal r9b, cl
movsx r9, bp
cmovg r9d, ecx
lea rdx, [rcx + 0x18]
and r9b, 0x6e
xadd r9w, r9w
btr r9d, 0x21
lea rdx, [rdx + rax]
btr ax, r11w
movzx eax, word [rcx + 6]
sar ch, 0xbe
stc
movsx cx, r10b
lea rcx, [rax + rax*4]
sbb r9b, 0x87
sar r9b, 0xb7
lea r9, [rdx + rcx*8]
cmp r11w, ax
mov qword [rsp], rdx
clc
cmp r12b, r9b
cmp rdx, r9
jmp 0x180115866
je 0x1801158a3
mov ecx, dword [rdx + 0xc]
cmp r8, rcx
jmp 0x180115877
jb 0x180115895
mov eax, dword [rdx + 8]
add eax, ecx
jmp 0x180115887
cmp r8, rax
jmp 0x18011588f
jb 0x1801158aa
add rdx, 0x28
jmp 0x18011589e
jmp 0x180115856
xor edx, edx
stc
test r11w, r13w
test rdx, rdx
jmp 0x1801158b2
jne 0x1801158bf
sub al, al
jmp 0x1801158ef
cmp dword [rdx + 0x24], 0
jmp 0x1801158c8
jge 0x1801158da
sub al, al
jmp 0x1801158d5
jmp 0x1801158ef
mov al, 1
jmp 0x1801158ef
sub al, al
jmp 0x1801158e8
jmp 0x1801158ef
add rsp, 0x18
jmp 0x1801158f8
ret

Function at 0x180116e32
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
ror ebp, cl
adc al, sil
and al, r12b
mov rbp, rsp
adc al, bh
or rbx, r13
rcr ax, cl
sub rsp, 0x20
bts ebx, r15d
not ebx
mov rax, qword [0x180086020]
shrd bx, ax, 0xd1
movsxd rbx, r13d
cmp sil, r11b
movabs rbx, 0x2b992ddfa232
stc
cmp rax, rbx
jmp 0x180116e7a
jne 0x180116f2a
and qword [rbp + 0x18], 0
lea rcx, [rbp + 0x18]
jmp 0x180116e8e
call qword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
mov rax, qword [rbp + 0x18]
jmp 0x180116e9d
mov qword [rbp + 0x10], rax
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov eax, eax
xor qword [rbp + 0x10], rax
jmp 0x180116eb2
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov eax, eax
lea rcx, [rbp + 0x20]
clc
test r8b, 0x9f
xor qword [rbp + 0x10], rax
jmp 0x180116ecc
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov eax, dword [rbp + 0x20]
xadd cx, cx
rcl cx, cl
xor cl, r9b
lea rcx, [rbp + 0x10]
shl rax, 0x20
xor rax, qword [rbp + 0x20]
test r11b, r15b
clc
xor rax, qword [rbp + 0x10]
xor rax, rcx
rcl bp, cl
movabs rcx, 0xffffffffffff
and rax, rcx
movabs rcx, 0x2b992ddfa233
cmp rax, rbx
movsx rbp, r15w
cmove rax, rcx
or rbx, rsp
bsf bx, r8w
mov qword [0x180086020], rax
mov rbx, qword [rsp + 0x48]
movzx bp, r9b
bsf ebp, r9d
not rax
mov qword [0x180086018], rax
xor ebp, edi
setl bpl
sub bpl, 0x45
add rsp, 0x20
cmovle bp, r12w
movzx ebp, cx
mov bpl, 2
pop rbp
jmp 0x180116f61
ret
Function at 0x180117dca
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 0x10], rbx
test spl, bl
mov qword [rsp + 0x18], rbp
test r13b, r15b
jmp 0x180117de0
push rsi
push rdi
bt rsi, r11
btc esi, ebp
inc di
push r12
cmc
bt rdi, r12
btr esi, r10d
push r14
rol sil, cl
push r15
sub rsp, 0x20
setne r15b
xchg di, r12w
movzx esi, dx
mov edi, dword [r8 + 0xc]
mov r12, rcx
mov rcx, r8
jmp 0x180117e1f
mov rsi, r9
setne r15b
mov r14w, ax
mov r14, r8
movsx r15, di
xchg r15w, r15w
mov r15b, spl
mov r15, rdx
jmp 0x180117e40
call fcn.180099075
mov r10, qword [r12]
movsxd rbp, ebx
mov ebp, eax
mov qword [rsi], r10
test edi, edi
jmp 0x180117e58
je 0x180117f71
movsxd rax, dword [r14 + 0x10]
movzx rdx, r10w
movsx ebx, dx
dec edi
rcl bl, 0x6e
sal dl, 0x82
lea rdx, [rdi + rdi*4]
add bl, dil
jmp 0x180117e7d
lea rbx, [rax + rdx*4]
cmp r12w, 0x62fd
test rax, 0x1b940172
add rbx, qword [r15 + 8]
cmp r13b, r10b
cmp ebp, dword [rbx + 4]
jle 0x180117e51
cmp ebp, dword [rbx + 8]
jmp 0x180117ea5
jg 0x180117e51
mov rcx, qword [r15]
shr dh, cl
lea rdx, [rsp + 0x50]
jmp 0x180117ebb
sub r8d, r8d
jmp 0x180117ec3
call qword [sym.imp.KERNEL32.dll_RtlLookupFunctionEntry]
movsxd r8, dword [rbx + 0x10]
adc r9b, r15b
setb r10b
stc
sub ecx, ecx
and r9b, bl
add r8, qword [rsp + 0x50]
mov r9d, dword [rbx + 0xc]
xor r10w, di
movzx r10d, bx
mov r10d, dword [rax]
cmp r10d, 0x1214dc2
clc
test r9d, r9d
je 0x180117f38
lea rdx, [r8 + 0xc]
and ax, bp
movsxd rax, dword [rdx]
cmp r12w, 0x159b
clc
cmp rax, r10
jmp 0x180117f18
je 0x180117f41
inc ecx
add rdx, 0x14
jmp 0x180117f2a
cmp ecx, r9d
jmp 0x180117f32
jb 0x180117f06
cmp ecx, r9d
jae 0x180117e51
mov rax, qword [r12]
lea rcx, [rcx + rcx*4]
movsxd rcx, dword [r8 + rcx*4 + 0x10]
rcl di, cl
sal r12w, cl
mov rcx, qword [rcx + rax]
btc rdi, 0x83
shrd ax, r9w, 0x5a
mov qword [rsi], rcx
neg bpl
ror bpl, cl
setne r14b
mov rbx, qword [rsp + 0x58]
inc bpl
sbb bpl, 0xa7
mov rax, rsi
not r12b
ror r15b, cl
mov rbp, qword [rsp + 0x60]
add rsp, 0x20
movzx r14d, r11w
xchg r14w, r12w
movsx r14d, r8w
pop r15
xchg r14d, esi
setbe sil
movsx r12w, r10b
pop r14
mov r12d, r8d
pop r12
pop rdi
bswap si
not sil
cmovno esi, ebp
pop rsi
ret
Function at 0x180119c6e
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rdi
mov eax, edx
movzx di, r11b
movsx di, r11b
movsx rdi, r11w
mov rdi, rcx
movsx ecx, dx
movzx cx, r11b
movzx ecx, r8w
mov rcx, r8
rep stosb byte [rdi], al
mov rax, r11
bswap rdi
movzx rdi, sp
cmovb di, r9w
pop rdi
jmp 0x180119c6d
ret
mov r11, rcx
ror r9d, 0xfd
movzx edx, dl
bt r9d, r10d
btr r9w, bp
movabs r9, 0x101010101010101
imul r9, rdx
stc
cmp r8, 0x10
jmp 0x180119c99
jbe 0x180119e26
movq xmm0, r9
punpcklbw xmm0, xmm0
cmp r8, 0x80
jmp 0x180119cb4
ja 0x180119cbf
jmp 0x180119d7d
test byte [0x1800881b0], 2
jne 0x180119c33
movups xmmword [rcx], xmm0
lea r8, [r8 + rcx]
xchg r9d, r9d
not r9b
add rcx, 0x10
adc r9b, al
and rcx, 0xfffffffffffffff0
test bl, 0x61
btr r9w, bx
movzx r9, di
sub r8, rcx
xor r9, r11
setno r9b
test r10w, 0x7ea0
mov r9, r8
cmc
jmp 0x180119d0a
shr r9, 7
jmp 0x180119d13
je 0x180119d7d
cmp r9, qword [0x180086040]
jmp 0x180119d25
ja 0x180119de1
movaps xmmword [rcx], xmm0
movaps xmmword [rcx + 0x10], xmm0
cmc
cmp edx, 0x55f872a3
add rcx, 0x80
jmp 0x180119d45
movaps xmmword [rcx - 0x60], xmm0
movaps xmmword [rcx - 0x50], xmm0
dec r9
movaps xmmword [rcx - 0x40], xmm0
movaps xmmword [rcx - 0x30], xmm0
jmp 0x180119d5d
movaps xmmword [rcx - 0x20], xmm0
jmp 0x180119d66
movapd xmmword [rcx - 0x10], xmm0
jne 0x180119d2b
and r8, 0x7f
and r9b, bl
bts r9w, r12w
mov r9, r8
stc
test bh, 0xe7
cmp r13b, r13b
shr r9, 4
jmp 0x180119d90
je 0x180119dc5
nop dword [rax]
jmp 0x180119da2
movups xmmword [rcx], xmm0
cmp esp, 0x7a2e5cb9
clc
test r10d, 0x1d3f6bd5
add rcx, 0x10
dec r9
jmp 0x180119dbf
jne 0x180119da2
and r8, 0xf
je 0x180119ddd
movups xmmword [rcx + r8 - 0x10], xmm0
setns ah
movsxd rax, r13d
cdqe
mov rax, r11
ret
movntps xmmword [rcx], xmm0
movntps xmmword [rcx + 0x10], xmm0
add rcx, 0x80
jmp 0x180119df4
movntps xmmword [rcx - 0x60], xmm0
movntps xmmword [rcx - 0x50], xmm0
dec r9
jmp 0x180119e04
movntps xmmword [rcx - 0x40], xmm0
movntps xmmword [rcx - 0x30], xmm0
movntps xmmword [rcx - 0x20], xmm0
movntps xmmword [rcx - 0x10], xmm0
jne 0x180119de1
sfence
and r8, 0x7f
jmp 0x180119d7d
mov rdx, r9
lea r9, [0x180000000]
shld ax, r12w, 0xc
mov eax, dword [r9 + r8*4 + 0x8f0b0]
test r8, 0x7e660bd1
cmp r14b, r14b
add r9, rax
add al, ch
bts ax, r10w
shr ax, 0x5a
add rcx, r8
not ah
mov ah, 0xa3
jmp 0x180119e63
mov rax, r11
jmp 0x180119e6b
push r9
ret
Function at 0x18011ab9b
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
cmp bl, r10b
mov qword [rax + 0x10], rsi
and r10w, 0x463e
not bh
mov qword [rax + 0x18], rdi
rcr r10b, cl
sal bh, cl
mov qword [rax + 0x20], r14
movsx ebx, cx
cmp r9w, 0x2dc6
cmp dword [rcx + 0x10], 0
movzx r10w, r13b
xchg r10, r10
bswap bx
mov rbx, r8
jmp 0x18011abde
mov r10, rdx
jmp 0x18011abe6
je 0x18011ad5a
movsxd r9, dword [rcx + 0x10]
lea r14, [0x180000000]
stc
shl r11w, cl
mov rdi, qword [rdx + 8]
shr ax, cl
cmp rsp, r14
shrd r11, r13, 0xe
xor esi, esi
add r9, rdi
shld rcx, r13, 0x8b
shrd eax, esp, 0x5a
movzx ecx, sp
or edx, 0xffffffff
xor r8d, r8d
bt cx, r8w
not ax
inc cl
movzx ecx, byte [r9]
movsxd rax, eax
test r10w, 0x6b34
and ecx, 0xf
shr r11w, 0xb3
movsx rax, byte [rcx + r14 + 0x6d968]
mov cl, byte [rcx + r14 + 0x6d978]
rcl r11b, cl
sub r9, rax
cmp cx, r11w
sal r11d, 0x8f
mov r11d, dword [r9 - 4]
shr r11d, cl
test ax, si
cmp r15d, edx
cmp r8d, 0x8f144e9
test r11d, r11d
je 0x18011ad5a
mov rax, qword [r10 + 0x10]
xor r10, 0xb270209
shld ecx, r11d, 0xc0
mov r10d, dword [rax]
movzx ecx, byte [r9]
cmp r13b, r12b
and ecx, 0xf
xadd ax, ax
test r8d, 0x756d10fb
movsx rax, byte [rcx + r14 + 0x6d968]
mov cl, byte [rcx + r14 + 0x6d978]
sub r9, rax
movsx ax, r14b
mov eax, dword [r9 - 4]
cmp di, bx
shr eax, cl
add esi, eax
cmp dx, 0x280d
mov eax, esi
add rax, r10
cmp r14b, dl
clc
lea rax, [rax + rdi]
cmp rbx, rax
jmp 0x18011ace3
jb 0x18011ad45
movzx ecx, byte [r9]
mov dl, sil
not edx
movsx ax, r12b
inc r8d
sbb al, 0xf8
and ecx, 0xf
movsx rax, byte [rcx + r14 + 0x6d968]
rol dl, 0x81
movsxd rdx, ebx
mov cl, byte [rcx + r14 + 0x6d978]
sub r9, rax
rol dx, cl
jmp 0x18011ad21
mov edx, dword [r9 - 4]
stc
shr edx, cl
jmp 0x18011ad2d
dec edx
jmp 0x18011ad37
cmp r8d, r11d
jmp 0x18011ad3f
jb 0x18011ac90
test r8d, r8d
jmp 0x18011ad4d
je 0x18011ad5a
mov eax, edx
jmp 0x18011ad62
or eax, 0xffffffff
jmp 0x18011ad62
mov rbx, qword [rsp + 8]
movsxd r14, r8d
movzx edi, r15w
mov rsi, qword [rsp + 0x10]
mov rdi, qword [rsp + 0x18]
jmp 0x18011ad86
mov r14, qword [rsp + 0x20]
ret
Function at 0x18011fc0f
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
test r9b, r15b
rcr bpl, 0xdc
mov qword [rsp + 0x20], rsi
or bpl, 0x46
push rdi
shl bpl, cl
xor bpl, 0x52
add bp, 0x57a2
push r12
shld ebp, eax, 0xeb
xor bpl, r11b
test bp, cx
push r13
movzx r13w, bpl
sub bpl, r14b
rcr bpl, cl
push r14
movzx bp, spl
sal bpl, 0x76
ror r13b, cl
push r15
sub rsp, 0x20
or bpl, al
rcr r13w, 0x27
mov rbp, rdx
mov r13, rcx
cmp r14d, r14d
test rdx, rdx
je 0x18011fdff
xor r15b, r15b
sub esi, esi
cmp dword [rdx], esi
jmp 0x18011fc89
jle 0x18011fda8
call fcn.180118b85
mov rdx, rax
bsr ax, r13w
mov al, 0x8d
mov rax, qword [r13 + 0x30]
sub r12b, 0x7d
bt r12d, edx
bts r12w, dx
movsxd r12, dword [rax + 0xc]
add r12, 4
add r12, rdx
jmp 0x18011fcbf
call fcn.180118b85
mov rdx, rax
mov rax, qword [r13 + 0x30]
movsxd rcx, dword [rax + 0xc]
mov r14d, dword [rdx + rcx]
test r14d, r14d
jmp 0x18011fcdb
jle 0x18011fd94
movsxd rax, esi
jmp 0x18011fce9
lea rax, [rax + rax*4]
jmp 0x18011fcf2
mov qword [rsp + 0x58], rax
jmp 0x18011fcfc
call fcn.180118b85
mov rbx, qword [r13 + 0x30]
xadd dil, dil
bsr rdi, r10
movzx di, r13b
mov rdi, rax
movsxd rax, dword [r12]
cmc
clc
add rdi, rax
jmp 0x18011fd23
call fcn.180118b6d
mov rdx, qword [rsp + 0x58]
and cl, 0xd3
mov r8, rbx
mov ch, 0x34
movsxd rcx, dword [rbp + 4]
stc
test ah, 0xc3
cmc
lea rax, [rax + rdx*4]
sar dx, cl
cwd
bt rdx, rdx
mov rdx, rdi
add rcx, rax
jmp 0x18011fd57
call fcn.18011d886
test eax, eax
jne 0x18011fd8c
dec r14d
cmp si, 0x4da
test bp, 0x1b13
stc
add r12, 4
cmp r12b, al
test r14d, r14d
jmp 0x18011fd81
jg 0x18011fcfc
jmp 0x18011fd94
mov r15b, 1
jmp 0x18011fd94
inc esi
test r14b, 0x24
cmp esi, dword [rbp]
jmp 0x18011fda2
jl 0x18011fc8f
mov rbx, qword [rsp + 0x50]
bts edi, r9d
mov al, r15b
mov bpl, 0xf2
sbb bpl, r9b
mov rbp, qword [rsp + 0x60]
bt rsi, 0x56
not rdi
mov rsi, qword [rsp + 0x68]
movsx r12d, sp
add rsp, 0x20
cmova r14w, r14w
pop r15
movzx r13d, r10w
setne dil
pop r14
movsx r12w, cl
pop r13
movzx r12d, r9w
movsxd r12, r12d
not di
pop r12
pop rdi
jmp 0x18011fdfe
ret
call fcn.1801293f6
int3
Function at 0x18011ff45
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov r11, rsp
sbb ax, cx
mov qword [r11 + 0x18], rbx
lahf
movsx bx, r15b
movzx ebx, r10w
mov qword [r11 + 0x20], r9
mov dword [rsp + 0x10], edx
push rbp
sbb ax, 0x45a3
push rsi
sets bh
bts ax, r10w
bt rsi, 0x78
push rdi
cdqe
movsx rsi, r11w
mov rbx, rax
push r12
shl sil, cl
jmp 0x18011ff88
push r13
adc sil, 0x60
bt rsi, 0x3f
movzx r13d, dx
push r14
inc r13b
push r15
cmp r14b, 0xc6
and esi, r15d
add r15b, 0x79
sub rsp, 0x20
sete r13b
btc r12w, bp
bts bx, sp
mov rax, qword [rcx + 8]
rcr r15b, cl
dec r12b
sub bpl, bpl
xor r14b, r14b
inc r12b
movsx r12, cx
adc bl, r15b
mov qword [r11 + 8], rax
sub edi, edi
bts rsi, r15
mov r12, r9
mov r13d, r8d
or r15b, r12b
mov rbx, rcx
setl r15b
mov si, 0x3017
lea rsi, [rax - 1]
rol r15b, 0xb3
mov r15, rsi
test esp, 0x1f273132
cmp dword [rcx], edi
jle 0x18012009b
mov r12d, dword [r11 + 0x10]
clc
test dil, r11b
cmp r8b, dl
cmp edi, r12d
jmp 0x18012001e
jne 0x180120034
mov rsi, rax
shl bpl, cl
adc bpl, bl
mov bpl, 1
cmp spl, 0xfd
cmp edi, r13d
jmp 0x18012003c
jne 0x18012004c
mov r15, rax
and r14b, bpl
mov r14b, 1
cmc
test bpl, bpl
jmp 0x180120054
je 0x180120068
test r14b, r14b
jmp 0x180120062
jne 0x180120096
lea rdx, [rsp + 0x60]
bswap cx
mov rcx, rbx
jmp 0x180120078
call fcn.180095574
inc edi
cmp edi, dword [rbx]
jmp 0x180120086
jge 0x180120096
mov rax, qword [rsp + 0x60]
jmp 0x180120016
mov r12, qword [rsp + 0x78]
mov rax, qword [r12]
mov qword [r12 + 8], rsi
sar r12w, 0x88
bsf r13w, dx
movups xmm0, xmmword [rbx]
sub r14b, 0xd5
movups xmmword [rax], xmm0
movups xmm1, xmmword [rbx + 0x10]
or r14b, dl
movups xmmword [rax + 0x10], xmm1
sbb rbp, r10
mov rax, qword [rsp + 0x80]
cmc
btc r14w, 5
sbb bpl, 0x4f
mov rcx, qword [rax]
or bp, 0x2ea7
xor bp, 0x6cca
mov qword [rax + 8], r15
bsf di, r13w
movups xmm0, xmmword [rbx]
sbb r12w, 0x41db
add rdi, 0x67307664
and sil, al
movups xmmword [rcx], xmm0
shrd edi, r13d, 5
movups xmm1, xmmword [rbx + 0x10]
mov rbx, qword [rsp + 0x70]
movzx r13d, bx
sub r15b, r15b
movups xmmword [rcx + 0x10], xmm1
sal r13, 0xe5
xchg r15w, bp
add rsp, 0x20
not bp
pop r15
movsx r13d, r9w
pop r14
movzx esi, r15w
movsx r13w, cl
pop r13
movsx si, bl
xchg sil, dil
pop r12
pop rdi
mov esi, r12d
pop rsi
mov bp, r8w
movzx ebp, si
bswap bp
pop rbp
jmp 0x18012015e
ret

Function at 0x180120819
Capabilities:
Set thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
not r9b
movzx r9, bx
add r8, 0x4dde2326
push rdi
bts bx, sp
sar dil, cl
btc r8w, dx
sub rsp, 0x20
movsx rbx, r8w
mov rbx, rdx
movsx edx, r11w
lea r9, [0x18006e990]
mov r8b, dl
cqo
mov edi, ecx
lea rdx, [0x18006d338]
jmp 0x180120867
mov ecx, 3
lea r8, [0x18006e988]
jmp 0x180120878
call fcn.1801203c8
mov rdx, rbx
xchg ch, ch
and cl, dil
mov ecx, edi
clc
test rax, rax
je 0x18012089c
call qword [0x18006c2b0]
jmp 0x1801208a2
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
bswap di
pop rdi
jmp 0x1801208b4
ret
Function at 0x180122aca
Capabilities:
Terminate process

Disassembly:
sub rsp, 0x28
movsx cx, r11b
mov ecx, 0x17
jmp 0x180122add
call qword [sym.imp.KERNEL32.dll_IsProcessorFeaturePresent]
test eax, eax
jmp 0x180122aea
je 0x180122b01
mov ecx, 5
jmp 0x180122afa
int 0x29
jmp 0x180122b01
mov r8d, 1
mov edx, 0xc0000417
movsx ecx, r15w
bswap cx
lea ecx, [r8 + 1]
jmp 0x180122b1c
call fcn.180122550
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
rcr dh, cl
mov edx, 0xc0000417
add rsp, 0x28
jmp 0x180122b3a
jmp qword [sym.imp.KERNEL32.dll_TerminateProcess]
Function at 0x18012495b
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
mov rax, qword [rcx + 0x458]
sal r9w, cl
shr bl, cl
rcr bl, 0x43
mov r9, rcx
ror bl, cl
add rcx, 0x50
adc r10b, r13b
mov bl, 0xf4
mov bl, r8b
movsx r10w, sil
mov r10, rdx
cmp di, r15w
test rax, rax
jmp 0x180124995
jne 0x1801249aa
mov eax, 0x100
jmp 0x1801249a5
jmp 0x1801249bd
mov rcx, rax
movzx r8w, r15b
mov rax, qword [r9 + 0x450]
shr rax, 2
lea rax, [rax - 1]
shr r11, 0xd
stc
lea r8, [rcx + rax*2]
mov qword [r9 + 0x40], r8
shr ax, 0x29
mov rax, r8
xadd r11b, r11b
mov cx, bx
mov r11, r8
sar cx, cl
sub cx, sp
seta ch
mov ecx, dword [r9 + 0x30]
cmp bl, 0x99
cmc
test ecx, ecx
jmp 0x1801249f7
jg 0x180124a0b
test r10, r10
jmp 0x180124a05
je 0x180124acd
lea eax, [rcx - 1]
mov dword [r9 + 0x30], eax
bsf rdx, r8
stc
movabs rax, 0xcccccccccccccccd
clc
or cx, si
test edx, 0x245817b9
mul r10
xadd ch, cl
mov rax, 0x2f213cad
not al
shr rdx, 3
xchg ah, cl
movzx eax, dx
movzx rcx, sp
rcl cx, 0xef
shl cl, cl
shl ax, 2
add cl, 0x43
lea ecx, [rax + rdx]
add cx, cx
sub r10w, cx
lea ecx, [r10 + 0x30]
jmp 0x180124a67
mov r10, rdx
cmp cx, 0x39
jmp 0x180124a73
jbe 0x180124a9c
mov al, bl
clc
cmc
xor al, 1
shl al, 5
clc
cmp r9w, 0x2568
add al, 7
clc
cmc
cmp dil, r12b
add al, cl
movsx ecx, al
add rax, 0x1b81ea6
movsx eax, cl
cmp r15b, r9b
mov word [r11], ax
setns al
add qword [r9 + 0x40], 0xfffffffffffffffe
cdqe
cwde
mov rax, qword [r9 + 0x40]
movzx r11w, spl
mov r11b, 0x83
movsxd r11, edi
mov r11, rax
jmp 0x180124ac8
jmp 0x1801249e8
mov rbx, qword [rsp + 8]
sub r8, rax
jmp 0x180124ada
sar r8, 1
add rax, 2
jmp 0x180124ae6
mov dword [r9 + 0x48], r8d
jmp 0x180124aef
mov qword [r9 + 0x40], rax
jmp 0x180124af8
ret