joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1801bc480
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x20], r9
push rbx
push rbp
push rsi
push rdi
push r12
push r15
sub rsp, 0x28
mov rsi, qword [rsp + 0x90]
mov r12, qword [rsp + 0x88]
mov rdi, r8
mov ebx, dword [rsi]
mov r15, rdx
mov rbp, rcx
test ebx, ebx
je 0x1801bc4d3
test rdi, rdi
je 0x1801bc4d3
mov eax, ebx
inc r15
inc rbp
movzx ecx, byte [rax + r12]
dec rdi
xor cl, byte [rbp - 1]
inc ebx
mov byte [r15 - 1], cl
and ebx, 7
jne 0x1801bc4b0
mov rcx, qword [rsp + 0x80]
cmp rdi, 8
jb 0x1801bc58b
mov qword [rsp + 0x60], r13
mov rsi, r15
mov r13, rdi
shr r13, 3
mov qword [rsp + 0x20], r14
mov r14, rbp
sub rsi, r12
sub r14, r12
imul rax, r13, 0xfffffffffffffff8
add rdi, rax
lea rax, [r13*8]
add r15, rax
add rbp, rax
mov qword [rsp + 0x68], r15
mov r15, qword [rsp + 0x78]
mov r8, r15
mov rdx, r12
call fcn.1801bc5d0
cmp ebx, 8
jae 0x1801bc558
mov edx, 7
mov eax, ebx
sub edx, ebx
add rax, r12
shr edx, 3
inc edx
mov rcx, qword [r14 + rax]
lea rax, [rax + 8]
xor rcx, qword [rax - 8]
mov qword [rsi + rax - 8], rcx
dec rdx
jne 0x1801bc542
mov rcx, qword [rsp + 0x80]
add rsi, 8
add r14, 8
xor ebx, ebx
dec r13
jne 0x1801bc521
mov r15, qword [rsp + 0x68]
mov r9, qword [rsp + 0x78]
mov rsi, qword [rsp + 0x90]
mov r14, qword [rsp + 0x20]
mov r13, qword [rsp + 0x60]
test rdi, rdi
je 0x1801bc5b5
mov r8, r9
mov rdx, r12
call fcn.1801bc5d0
nop dword [rax + rax]
mov ecx, ebx
inc ebx
movzx eax, byte [rcx + rbp]
xor al, byte [rcx + r12]
mov byte [rcx + r15], al
dec rdi
jne 0x1801bc5a0
mov dword [rsi], ebx
add rsp, 0x28
pop r15
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x1801be5c9
Capabilities:
Encrypt data using rc4 prga

Disassembly:
test r8, r8
je 0x1801be7b5
mov r11, rsp
push rdi
push r12
sub rsp, 0x98
mov rax, qword [0x18050a0d0]
xor rax, rsp
mov qword [rsp + 0x70], rax
mov qword [r11 + 0x10], rbx
mov qword [r11 + 0x18], rbp
mov qword [r11 + 0x20], rsi
mov rdi, rcx
mov qword [r11 - 0x18], r13
mov qword [r11 - 0x20], r14
mov qword [r11 - 0x28], r15
lea r15, [r11 - 0x78]
lea rsi, [r11 - 0x78]
sub r15, rdi
lea r9, [rcx + 0x48]
lea r14, [r11 - 0x70]
lea rcx, [r11 - 0x78]
mov rbp, rdi
sub rsi, rdx
add r15, 0xffffffffffffff30
xor r12d, r12d
sub r14, rdi
sub rbp, rcx
mov qword [rsp + 0x20], r8
lea rbx, [rdx + 6]
sub rsi, 6
nop word [rax + rax]
mov edx, 8
nop word [rax + rax]
movzx eax, byte [rbx]
movzx ecx, byte [rbx + 1]
add rbx, 8
shl rcx, 8
or rcx, rax
movzx eax, byte [rbx - 9]
shl rcx, 8
or rcx, rax
movzx eax, byte [rbx - 0xa]
shl rcx, 8
or rcx, rax
movzx eax, byte [rbx - 0xb]
shl rcx, 8
or rcx, rax
movzx eax, byte [rbx - 0xc]
shl rcx, 8
or rcx, rax
movzx eax, byte [rbx - 0xd]
shl rcx, 8
or rcx, rax
movzx eax, byte [rbx - 0xe]
shl rcx, 8
or rcx, rax
mov qword [rbx + rsi - 8], rcx
dec rdx
jne 0x1801be650
lea r8, [rdi + 0x88]
lea rdx, [rsp + 0x30]
mov rcx, r9
call fcn.1801be470
mov rax, qword [rdi + 0x88]
lea rcx, [rax + 0x200]
mov qword [rdi + 0x88], rcx
cmp rcx, rax
jb 0x1801be6e5
cmp rcx, 0x200
jae 0x1801be701
mov ecx, 1
lea rax, [rdi + 0x90]
inc qword [rax]
jne 0x1801be701
inc ecx
add rax, 8
cmp ecx, 8
jl 0x1801be6f1
mov rax, qword [rsp + 0x30]
xor edx, edx
add qword [rdi + 0xc8], rax
lea rax, [rdi + 0xd0]
lea r10d, [rdx + 7]
nop word [rax + rax]
mov r9, qword [r15 + rax]
lea rcx, [r15 + rax]
mov r8, qword [rcx + rbp + 0xc8]
cmp r8, r9
je 0x1801be73d
xor edx, edx
cmp r8, r9
setb dl
mov rcx, qword [r14 + rax - 0xd0]
add rax, 8
add rcx, rdx
add qword [rax - 8], rcx
dec r10
jne 0x1801be720
inc r12d
sub rsi, 0x40
lea r9, [rdi + 0x48]
movsxd rax, r12d
cmp rax, qword [rsp + 0x20]
jb 0x1801be640
mov r15, qword [rsp + 0x80]
mov r14, qword [rsp + 0x88]
mov r13, qword [rsp + 0x90]
mov rsi, qword [rsp + 0xc8]
mov rbp, qword [rsp + 0xc0]
mov rbx, qword [rsp + 0xb8]
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.180243450
add rsp, 0x98
pop r12
pop rdi
ret
Function at 0x1801bf880
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x50
mov rax, qword [0x18050a0d0]
xor rax, rsp
mov qword [rbp - 8], rax
mov rax, qword [rbp + 0x60]
mov r13, qword [rbp + 0x68]
mov rsi, rcx
movzx r10d, byte [rax]
mov ebx, dword [r13]
lea rdi, [rax + 1]
movzx ecx, byte [rdi + 6]
mov qword [rbp - 0x18], rax
movzx eax, byte [rdi]
shl eax, 8
mov r12, rdx
movzx edx, byte [rdi + 3]
or r10d, eax
movzx eax, byte [rdi + 1]
shl ecx, 8
shl eax, 0x10
mov r14d, r8d
lea r8, [rdi + 5]
or r10d, eax
movzx eax, byte [rdi + 2]
xor r15d, r15d
shl eax, 0x18
mov qword [rbp - 0x28], r9
mov qword [rbp - 0x20], r13
or r10d, eax
movzx eax, byte [rdi + 4]
shl eax, 8
mov dword [rbp - 0x30], r10d
mov byte [rbp - 0x10], r10b
or edx, eax
movzx eax, byte [r8]
or ecx, eax
mov eax, r10d
shr eax, 8
shl ecx, 0x10
mov byte [rbp - 0xf], al
or edx, ecx
mov eax, r10d
shr eax, 0x10
mov dword [rbp - 0x2c], edx
mov byte [rbp - 0xc], dl
mov byte [rbp - 0xe], al
mov eax, r10d
shr eax, 0x18
mov byte [rbp - 0xd], al
mov eax, edx
shr eax, 8
mov byte [rbp - 0xb], al
mov eax, edx
shr eax, 0x10
mov byte [rbp - 0xa], al
mov eax, edx
shr eax, 0x18
mov byte [rbp - 9], al
test r14d, r14d
je 0x1801bfa3a
mov r13, qword [rbp - 0x28]
sub r12, rsi
movzx r8d, dl
movzx r9d, r10b
nop word [rax + rax]
dec r14d
test ebx, ebx
jne 0x1801bf9d6
lea r8d, [rbx + 1]
lea rcx, [rbp - 0x30]
mov rdx, r13
call fcn.1801a4c50
mov r10d, dword [rbp - 0x30]
mov edx, dword [rbp - 0x2c]
movzx r9d, byte [rbp - 0x30]
movzx r8d, byte [rbp - 0x2c]
mov eax, r10d
shr eax, 8
mov byte [rbp - 0x10], r9b
mov byte [rbp - 0xc], r8b
mov byte [rbp - 0xf], al
mov eax, r10d
shr eax, 0x10
mov byte [rbp - 0xe], al
mov eax, r10d
shr eax, 0x18
mov byte [rbp - 0xd], al
mov eax, edx
shr eax, 8
mov byte [rbp - 0xb], al
mov eax, edx
shr eax, 0x10
mov byte [rbp - 0xa], al
mov eax, edx
shr eax, 0x18
inc r15d
mov byte [rbp - 9], al
movsxd rax, ebx
inc rsi
movzx ecx, byte [rbp + rax - 0x10]
xor cl, byte [rsi - 1]
inc ebx
mov byte [r12 + rsi - 1], cl
and ebx, 7
test r14d, r14d
jne 0x1801bf970
mov r13, qword [rbp - 0x20]
test r15d, r15d
je 0x1801bfa3a
mov rax, qword [rbp - 0x18]
mov byte [rax], r9b
mov eax, r10d
shr eax, 8
mov byte [rdi], al
mov eax, r10d
shr r10d, 0x18
shr eax, 0x10
mov byte [rdi + 1], al
mov byte [rdi + 2], r10b
mov byte [rdi + 3], r8b
mov eax, edx
shr eax, 8
mov byte [rdi + 4], al
mov eax, edx
shr eax, 0x10
shr edx, 0x18
mov byte [rdi + 5], al
mov byte [rdi + 6], dl
mov dword [r13], ebx
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.180243450
mov rbx, qword [rsp + 0x90]
add rsp, 0x50
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x1801c0670
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x70
mov rax, qword [0x18050a0d0]
xor rax, rsp
mov qword [rbp - 0x10], rax
mov rax, qword [rbp + 0x60]
mov r13, qword [rbp + 0x78]
mov r10, qword [rbp + 0x68]
mov ebx, dword [r13]
mov qword [rbp - 0x48], rax
mov rax, qword [rbp + 0x70]
lea rdi, [rax + 1]
mov qword [rbp - 0x28], rax
mov r14d, r8d
movzx r8d, byte [rax]
movzx eax, byte [rdi]
mov rsi, rcx
movzx ecx, byte [rdi + 6]
shl eax, 8
mov qword [rbp - 0x30], r9
movzx r9d, byte [rdi + 3]
or r8d, eax
movzx eax, byte [rdi + 1]
shl eax, 0x10
shl ecx, 8
xor r12d, r12d
or r8d, eax
movzx eax, byte [rdi + 2]
mov r15, rdx
shl eax, 0x18
mov qword [rbp - 0x40], r10
mov qword [rbp - 0x20], r13
or r8d, eax
movzx eax, byte [rdi + 4]
mov qword [rbp - 0x38], rdi
shl eax, 8
mov dword [rbp - 0x50], r8d
mov byte [rbp - 0x18], r8b
or r9d, eax
movzx eax, byte [rdi + 5]
or ecx, eax
mov eax, r8d
shr eax, 8
shl ecx, 0x10
mov byte [rbp - 0x17], al
or r9d, ecx
mov eax, r8d
shr eax, 0x10
mov dword [rbp - 0x4c], r9d
mov byte [rbp - 0x14], r9b
mov byte [rbp - 0x16], al
mov eax, r8d
shr eax, 0x18
mov byte [rbp - 0x15], al
mov eax, r9d
shr eax, 8
mov byte [rbp - 0x13], al
mov eax, r9d
shr eax, 0x10
mov byte [rbp - 0x12], al
mov eax, r9d
shr eax, 0x18
mov byte [rbp - 0x11], al
test r14d, r14d
je 0x1801c0848
mov r13, qword [rbp - 0x30]
mov rdi, qword [rbp - 0x48]
sub r15, rsi
nop
dec r14d
test ebx, ebx
jne 0x1801c07dc
lea rcx, [rbp - 0x50]
mov r9, r10
mov r8, rdi
mov rdx, r13
call fcn.1801a72d0
mov r8d, dword [rbp - 0x50]
mov r9d, dword [rbp - 0x4c]
mov r10, qword [rbp - 0x40]
movzx eax, r8b
mov byte [rbp - 0x18], al
mov eax, r8d
shr eax, 8
mov byte [rbp - 0x17], al
mov eax, r8d
shr eax, 0x10
mov byte [rbp - 0x16], al
mov eax, r8d
shr eax, 0x18
mov byte [rbp - 0x15], al
movzx eax, r9b
mov byte [rbp - 0x14], al
mov eax, r9d
shr eax, 8
mov byte [rbp - 0x13], al
mov eax, r9d
shr eax, 0x10
mov byte [rbp - 0x12], al
mov eax, r9d
shr eax, 0x18
inc r12d
mov byte [rbp - 0x11], al
movsxd rax, ebx
inc rsi
movzx ecx, byte [rbp + rax - 0x18]
xor cl, byte [rsi - 1]
inc ebx
mov byte [r15 + rsi - 1], cl
and ebx, 7
test r14d, r14d
jne 0x1801c0770
mov rdi, qword [rbp - 0x38]
mov r13, qword [rbp - 0x20]
test r12d, r12d
je 0x1801c0848
mov rax, qword [rbp - 0x28]
mov byte [rax], r8b
mov eax, r8d
shr eax, 8
mov byte [rdi], al
mov eax, r8d
shr r8d, 0x18
shr eax, 0x10
mov byte [rdi + 1], al
mov byte [rdi + 2], r8b
mov byte [rdi + 3], r9b
mov eax, r9d
shr eax, 8
mov byte [rdi + 4], al
mov eax, r9d
shr eax, 0x10
shr r9d, 0x18
mov byte [rdi + 5], al
mov byte [rdi + 6], r9b
mov dword [r13], ebx
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.180243450
mov rbx, qword [rsp + 0xb0]
add rsp, 0x70
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x1801c28d0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x50
mov rax, qword [0x18050a0d0]
xor rax, rsp
mov qword [rbp - 8], rax
mov rax, qword [rbp + 0x60]
mov r13, qword [rbp + 0x68]
mov r14d, r8d
movzx r10d, byte [rax]
movzx r8d, byte [rax + 4]
mov ebx, dword [r13]
lea rdi, [rax + 1]
mov qword [rbp - 0x18], rax
shl r10d, 0x18
movzx eax, byte [rdi]
mov rsi, rcx
movzx ecx, byte [rdi + 5]
shl eax, 0x10
shl r8d, 0x18
shl ecx, 8
or r10d, eax
movzx eax, byte [rdi + 1]
mov r12, rdx
shl eax, 8
lea rdx, [rdi + 5]
xor r15d, r15d
or r10d, eax
movzx eax, byte [rdi + 2]
mov qword [rbp - 0x28], r9
or r10d, eax
movzx eax, byte [rdi + 4]
mov qword [rbp - 0x20], r13
shl eax, 0x10
mov dword [rbp - 0x30], r10d
mov byte [rbp - 0xd], r10b
or r8d, eax
movzx eax, byte [rdx + 1]
or ecx, eax
mov eax, r10d
shr eax, 0x18
or r8d, ecx
mov byte [rbp - 0x10], al
mov eax, r10d
mov dword [rbp - 0x2c], r8d
shr eax, 0x10
mov byte [rbp - 9], r8b
mov byte [rbp - 0xf], al
mov eax, r10d
shr eax, 8
mov byte [rbp - 0xe], al
mov eax, r8d
shr eax, 0x18
mov byte [rbp - 0xc], al
mov eax, r8d
shr eax, 0x10
mov byte [rbp - 0xb], al
mov eax, r8d
shr eax, 8
mov byte [rbp - 0xa], al
test r14d, r14d
je 0x1801c2a8a
mov r13, qword [rbp - 0x28]
sub r12, rsi
movzx edx, r8b
movzx r9d, r10b
dec r14d
test ebx, ebx
jne 0x1801c2a27
lea rcx, [rbp - 0x30]
mov rdx, r13
call fcn.1801c1ec0
mov r10d, dword [rbp - 0x30]
mov r8d, dword [rbp - 0x2c]
mov eax, r10d
movzx edx, r8b
movzx r9d, r10b
shr eax, 0x18
mov byte [rbp - 0xd], r10b
mov byte [rbp - 9], dl
mov byte [rbp - 0x10], al
mov eax, r10d
shr eax, 0x10
mov byte [rbp - 0xf], al
mov eax, r10d
shr eax, 8
mov byte [rbp - 0xe], al
mov eax, r8d
shr eax, 0x18
mov byte [rbp - 0xc], al
mov eax, r8d
shr eax, 0x10
mov byte [rbp - 0xb], al
mov eax, r8d
shr eax, 8
inc r15d
mov byte [rbp - 0xa], al
movsxd rax, ebx
inc rsi
movzx ecx, byte [rbp + rax - 0x10]
xor cl, byte [rsi - 1]
inc ebx
mov byte [r12 + rsi - 1], cl
and ebx, 7
test r14d, r14d
jne 0x1801c29c4
mov r13, qword [rbp - 0x20]
test r15d, r15d
je 0x1801c2a8a
mov rcx, qword [rbp - 0x18]
mov eax, r10d
shr eax, 0x18
mov byte [rcx], al
mov eax, r10d
shr r10d, 8
shr eax, 0x10
mov byte [rdi], al
mov byte [rdi + 1], r10b
mov byte [rdi + 2], r9b
mov eax, r8d
shr eax, 0x18
mov byte [rdi + 3], al
mov eax, r8d
shr eax, 0x10
shr r8d, 8
mov byte [rdi + 4], al
mov byte [rdi + 5], r8b
mov byte [rdi + 6], dl
mov dword [r13], ebx
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.180243450
mov rbx, qword [rsp + 0x90]
add rsp, 0x50
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x1801c3890
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
sub rsp, 8
mov qword [rsp + 0x18], rsi
mov qword [rsp], rdi
mov edi, 0x80
cmp edx, edi
mov r10, rcx
mov byte [rcx], 0
cmovg edx, edi
mov r11d, 0x400
test r9d, r9d
jle 0x1801c38c2
cmp r9d, r11d
cmovg r9d, r11d
mov r11d, r9d
movsxd r9, edx
test edx, edx
jle 0x1801c38e1
sub r8, rcx
mov rdx, r9
nop
movzx eax, byte [r8 + rcx]
lea rcx, [rcx + 1]
mov byte [rcx - 1], al
dec rdx
jne 0x1801c38d0
movzx ecx, byte [r9 + r10 - 1]
lea rdx, [r9 + r10]
lea rsi, [0x18037c140]
cmp r9, rdi
jge 0x1801c392e
mov qword [rsp + 0x10], rbx
mov rbx, r9
mov r8, rdi
neg rbx
sub r8, r9
nop dword [rax + rax]
movzx eax, byte [rdx + rbx]
lea rdx, [rdx + 1]
add eax, ecx
movzx ecx, al
movzx ecx, byte [rcx + rsi]
mov byte [rdx - 1], cl
dec r8
jne 0x1801c3910
mov rbx, qword [rsp + 0x10]
lea r9d, [r11 + 7]
neg r11d
mov eax, 0xff
sar r9d, 3
and r11d, 7
sub edi, r9d
movzx ecx, r11b
sar eax, cl
movsxd r8, edi
mov rdi, qword [rsp]
mov ecx, eax
movzx eax, byte [r8 + r10]
lea rdx, [r8 + r10]
and rcx, rax
movzx eax, byte [rcx + rsi]
mov byte [rdx], al
test r8, r8
je 0x1801c3988
movsxd r9, r9d
nop
movzx ecx, byte [rdx + r9 - 1]
lea rdx, [rdx - 1]
xor rcx, rax
movzx eax, byte [rcx + rsi]
mov byte [rdx], al
dec r8
jne 0x1801c3970
mov rsi, qword [rsp + 0x18]
lea r8, [r10 + 0xfc]
lea rdx, [r10 + 0x7e]
mov r9d, 0x40
nop
movzx eax, byte [rdx]
movzx ecx, byte [rdx + 1]
lea r8, [r8 - 4]
shl ecx, 8
lea rdx, [rdx - 2]
or ecx, eax
movzx eax, cx
mov dword [r8 + 4], eax
dec r9
jne 0x1801c39a0
add rsp, 8
ret
Function at 0x1801c44a0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x50
mov rax, qword [0x18050a0d0]
xor rax, rsp
mov qword [rbp - 8], rax
mov rax, qword [rbp + 0x60]
mov r13, qword [rbp + 0x68]
mov rsi, rcx
movzx r10d, byte [rax]
mov ebx, dword [r13]
lea rdi, [rax + 1]
movzx ecx, byte [rdi + 6]
mov qword [rbp - 0x18], rax
movzx eax, byte [rdi]
shl eax, 8
mov r12, rdx
movzx edx, byte [rdi + 3]
or r10d, eax
movzx eax, byte [rdi + 1]
shl ecx, 8
shl eax, 0x10
mov r14d, r8d
lea r8, [rdi + 5]
or r10d, eax
movzx eax, byte [rdi + 2]
xor r15d, r15d
shl eax, 0x18
mov qword [rbp - 0x28], r9
mov qword [rbp - 0x20], r13
or r10d, eax
movzx eax, byte [rdi + 4]
shl eax, 8
mov dword [rbp - 0x30], r10d
mov byte [rbp - 0x10], r10b
or edx, eax
movzx eax, byte [r8]
or ecx, eax
mov eax, r10d
shr eax, 8
shl ecx, 0x10
mov byte [rbp - 0xf], al
or edx, ecx
mov eax, r10d
shr eax, 0x10
mov dword [rbp - 0x2c], edx
mov byte [rbp - 0xc], dl
mov byte [rbp - 0xe], al
mov eax, r10d
shr eax, 0x18
mov byte [rbp - 0xd], al
mov eax, edx
shr eax, 8
mov byte [rbp - 0xb], al
mov eax, edx
shr eax, 0x10
mov byte [rbp - 0xa], al
mov eax, edx
shr eax, 0x18
mov byte [rbp - 9], al
test r14d, r14d
je 0x1801c4652
mov r13, qword [rbp - 0x28]
sub r12, rsi
movzx r8d, dl
movzx r9d, r10b
nop word [rax + rax]
dec r14d
test ebx, ebx
jne 0x1801c45f2
lea rcx, [rbp - 0x30]
mov rdx, r13
call fcn.1801c4140
mov r10d, dword [rbp - 0x30]
mov edx, dword [rbp - 0x2c]
movzx r9d, byte [rbp - 0x30]
movzx r8d, byte [rbp - 0x2c]
mov eax, r10d
shr eax, 8
mov byte [rbp - 0x10], r9b
mov byte [rbp - 0xc], r8b
mov byte [rbp - 0xf], al
mov eax, r10d
shr eax, 0x10
mov byte [rbp - 0xe], al
mov eax, r10d
shr eax, 0x18
mov byte [rbp - 0xd], al
mov eax, edx
shr eax, 8
mov byte [rbp - 0xb], al
mov eax, edx
shr eax, 0x10
mov byte [rbp - 0xa], al
mov eax, edx
shr eax, 0x18
inc r15d
mov byte [rbp - 9], al
movsxd rax, ebx
inc rsi
movzx ecx, byte [rbp + rax - 0x10]
xor cl, byte [rsi - 1]
inc ebx
mov byte [r12 + rsi - 1], cl
and ebx, 7
test r14d, r14d
jne 0x1801c4590
mov r13, qword [rbp - 0x20]
test r15d, r15d
je 0x1801c4652
mov rax, qword [rbp - 0x18]
mov byte [rax], r9b
mov eax, r10d
shr eax, 8
mov byte [rdi], al
mov eax, r10d
shr r10d, 0x18
shr eax, 0x10
mov byte [rdi + 1], al
mov byte [rdi + 2], r10b
mov byte [rdi + 3], r8b
mov eax, edx
shr eax, 8
mov byte [rdi + 4], al
mov eax, edx
shr eax, 0x10
shr edx, 0x18
mov byte [rdi + 5], al
mov byte [rdi + 6], dl
mov dword [r13], ebx
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.180243450
mov rbx, qword [rsp + 0x90]
add rsp, 0x50
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x1801c4680
Capabilities:
Encode data using xor
Encrypt data using blowfish
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov r10, r8
mov rdi, rcx
mov r9, rcx
mov r8d, edx
mov ecx, 0x20
lea rax, [0x18037c240]
nop word [rax + rax]
movups xmm0, xmmword [rax]
lea r9, [r9 + 0x80]
lea rax, [rax + 0x80]
movups xmmword [r9 - 0x80], xmm0
movups xmm1, xmmword [rax - 0x70]
movups xmmword [r9 - 0x70], xmm1
movups xmm0, xmmword [rax - 0x60]
movups xmmword [r9 - 0x60], xmm0
movups xmm1, xmmword [rax - 0x50]
movups xmmword [r9 - 0x50], xmm1
movups xmm0, xmmword [rax - 0x40]
movups xmmword [r9 - 0x40], xmm0
movups xmm1, xmmword [rax - 0x30]
movups xmmword [r9 - 0x30], xmm1
movups xmm0, xmmword [rax - 0x20]
movups xmmword [r9 - 0x20], xmm0
movups xmm1, xmmword [rax - 0x10]
movups xmmword [r9 - 0x10], xmm1
dec rcx
jne 0x1801c46b0
movups xmm0, xmmword [rax]
movups xmmword [r9], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [r9 + 0x10], xmm1
movups xmm0, xmmword [rax + 0x20]
movups xmmword [r9 + 0x20], xmm0
movups xmm1, xmmword [rax + 0x30]
movups xmmword [r9 + 0x30], xmm1
mov rcx, qword [rax + 0x40]
mov eax, 0x48
cmp edx, eax
mov qword [r9 + 0x40], rcx
mov rdx, r10
cmovg r8d, eax
movsxd r8, r8d
add r8, r10
xor ebx, ebx
mov r9d, ebx
nop dword [rax]
movzx ecx, byte [rdx]
inc rdx
cmp rdx, r8
cmovae rdx, r10
shl ecx, 8
movzx eax, byte [rdx]
inc rdx
or ecx, eax
cmp rdx, r8
cmovae rdx, r10
shl ecx, 8
movzx eax, byte [rdx]
inc rdx
or ecx, eax
cmp rdx, r8
cmovae rdx, r10
shl ecx, 8
movzx eax, byte [rdx]
inc rdx
or ecx, eax
cmp rdx, r8
cmovae rdx, r10
xor dword [rdi + r9*4], ecx
inc r9
cmp r9, 0x12
jl 0x1801c4750
mov qword [rsp + 0x30], rbx
mov rsi, rbx
nop dword [rax + rax]
lea rcx, [rsp + 0x30]
mov rdx, rdi
call fcn.1801c5270
mov eax, dword [rsp + 0x30]
add rsi, 2
mov dword [rdi + rsi*4 - 8], eax
mov eax, dword [rsp + 0x34]
mov dword [rdi + rsi*4 - 4], eax
cmp rsi, 0x12
jl 0x1801c47b0
nop word [rax + rax]
lea rcx, [rsp + 0x30]
mov rdx, rdi
call fcn.1801c5270
mov eax, dword [rsp + 0x30]
add rbx, 2
mov dword [rdi + rbx*4 + 0x40], eax
mov eax, dword [rsp + 0x34]
mov dword [rdi + rbx*4 + 0x44], eax
cmp rbx, 0x400
jl 0x1801c47e0
mov rbx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x1801c58b0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x50
mov rax, qword [0x18050a0d0]
xor rax, rsp
mov qword [rbp - 8], rax
mov rax, qword [rbp + 0x60]
mov r13, qword [rbp + 0x68]
mov r14d, r8d
movzx r10d, byte [rax]
movzx r8d, byte [rax + 4]
mov ebx, dword [r13]
lea rdi, [rax + 1]
mov qword [rbp - 0x18], rax
shl r10d, 0x18
movzx eax, byte [rdi]
mov rsi, rcx
movzx ecx, byte [rdi + 5]
shl eax, 0x10
shl r8d, 0x18
shl ecx, 8
or r10d, eax
movzx eax, byte [rdi + 1]
mov r12, rdx
shl eax, 8
lea rdx, [rdi + 5]
xor r15d, r15d
or r10d, eax
movzx eax, byte [rdi + 2]
mov qword [rbp - 0x28], r9
or r10d, eax
movzx eax, byte [rdi + 4]
mov qword [rbp - 0x20], r13
shl eax, 0x10
mov dword [rbp - 0x30], r10d
mov byte [rbp - 0xd], r10b
or r8d, eax
movzx eax, byte [rdx + 1]
or ecx, eax
mov eax, r10d
shr eax, 0x18
or r8d, ecx
mov byte [rbp - 0x10], al
mov eax, r10d
mov dword [rbp - 0x2c], r8d
shr eax, 0x10
mov byte [rbp - 9], r8b
mov byte [rbp - 0xf], al
mov eax, r10d
shr eax, 8
mov byte [rbp - 0xe], al
mov eax, r8d
shr eax, 0x18
mov byte [rbp - 0xc], al
mov eax, r8d
shr eax, 0x10
mov byte [rbp - 0xb], al
mov eax, r8d
shr eax, 8
mov byte [rbp - 0xa], al
test r14d, r14d
je 0x1801c5a6a
mov r13, qword [rbp - 0x28]
sub r12, rsi
movzx edx, r8b
movzx r9d, r10b
dec r14d
test ebx, ebx
jne 0x1801c5a07
lea rcx, [rbp - 0x30]
mov rdx, r13
call fcn.1801c5270
mov r10d, dword [rbp - 0x30]
mov r8d, dword [rbp - 0x2c]
mov eax, r10d
movzx edx, r8b
movzx r9d, r10b
shr eax, 0x18
mov byte [rbp - 0xd], r10b
mov byte [rbp - 9], dl
mov byte [rbp - 0x10], al
mov eax, r10d
shr eax, 0x10
mov byte [rbp - 0xf], al
mov eax, r10d
shr eax, 8
mov byte [rbp - 0xe], al
mov eax, r8d
shr eax, 0x18
mov byte [rbp - 0xc], al
mov eax, r8d
shr eax, 0x10
mov byte [rbp - 0xb], al
mov eax, r8d
shr eax, 8
inc r15d
mov byte [rbp - 0xa], al
movsxd rax, ebx
inc rsi
movzx ecx, byte [rbp + rax - 0x10]
xor cl, byte [rsi - 1]
inc ebx
mov byte [r12 + rsi - 1], cl
and ebx, 7
test r14d, r14d
jne 0x1801c59a4
mov r13, qword [rbp - 0x20]
test r15d, r15d
je 0x1801c5a6a
mov rcx, qword [rbp - 0x18]
mov eax, r10d
shr eax, 0x18
mov byte [rcx], al
mov eax, r10d
shr r10d, 8
shr eax, 0x10
mov byte [rdi], al
mov byte [rdi + 1], r10b
mov byte [rdi + 2], r9b
mov eax, r8d
shr eax, 0x18
mov byte [rdi + 3], al
mov eax, r8d
shr eax, 0x10
shr r8d, 8
mov byte [rdi + 4], al
mov byte [rdi + 5], r8b
mov byte [rdi + 6], dl
mov dword [r13], ebx
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.180243450
mov rbx, qword [rsp + 0x90]
add rsp, 0x50
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x1801c85a0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x50
mov rax, qword [0x18050a0d0]
xor rax, rsp
mov qword [rbp - 8], rax
mov rax, qword [rbp + 0x60]
mov r13, qword [rbp + 0x68]
mov r14d, r8d
movzx r10d, byte [rax]
movzx r8d, byte [rax + 4]
mov ebx, dword [r13]
lea rdi, [rax + 1]
mov qword [rbp - 0x18], rax
shl r10d, 0x18
movzx eax, byte [rdi]
mov rsi, rcx
movzx ecx, byte [rdi + 5]
shl eax, 0x10
shl r8d, 0x18
shl ecx, 8
or r10d, eax
movzx eax, byte [rdi + 1]
mov r12, rdx
shl eax, 8
lea rdx, [rdi + 5]
xor r15d, r15d
or r10d, eax
movzx eax, byte [rdi + 2]
mov qword [rbp - 0x28], r9
or r10d, eax
movzx eax, byte [rdi + 4]
mov qword [rbp - 0x20], r13
shl eax, 0x10
mov dword [rbp - 0x30], r10d
mov byte [rbp - 0xd], r10b
or r8d, eax
movzx eax, byte [rdx + 1]
or ecx, eax
mov eax, r10d
shr eax, 0x18
or r8d, ecx
mov byte [rbp - 0x10], al
mov eax, r10d
mov dword [rbp - 0x2c], r8d
shr eax, 0x10
mov byte [rbp - 9], r8b
mov byte [rbp - 0xf], al
mov eax, r10d
shr eax, 8
mov byte [rbp - 0xe], al
mov eax, r8d
shr eax, 0x18
mov byte [rbp - 0xc], al
mov eax, r8d
shr eax, 0x10
mov byte [rbp - 0xb], al
mov eax, r8d
shr eax, 8
mov byte [rbp - 0xa], al
test r14d, r14d
je 0x1801c875a
mov r13, qword [rbp - 0x28]
sub r12, rsi
movzx edx, r8b
movzx r9d, r10b
dec r14d
test ebx, ebx
jne 0x1801c86f7
lea rcx, [rbp - 0x30]
mov rdx, r13
call fcn.1801c7d70
mov r10d, dword [rbp - 0x30]
mov r8d, dword [rbp - 0x2c]
mov eax, r10d
movzx edx, r8b
movzx r9d, r10b
shr eax, 0x18
mov byte [rbp - 0xd], r10b
mov byte [rbp - 9], dl
mov byte [rbp - 0x10], al
mov eax, r10d
shr eax, 0x10
mov byte [rbp - 0xf], al
mov eax, r10d
shr eax, 8
mov byte [rbp - 0xe], al
mov eax, r8d
shr eax, 0x18
mov byte [rbp - 0xc], al
mov eax, r8d
shr eax, 0x10
mov byte [rbp - 0xb], al
mov eax, r8d
shr eax, 8
inc r15d
mov byte [rbp - 0xa], al
movsxd rax, ebx
inc rsi
movzx ecx, byte [rbp + rax - 0x10]
xor cl, byte [rsi - 1]
inc ebx
mov byte [r12 + rsi - 1], cl
and ebx, 7
test r14d, r14d
jne 0x1801c8694
mov r13, qword [rbp - 0x20]
test r15d, r15d
je 0x1801c875a
mov rcx, qword [rbp - 0x18]
mov eax, r10d
shr eax, 0x18
mov byte [rcx], al
mov eax, r10d
shr r10d, 8
shr eax, 0x10
mov byte [rdi], al
mov byte [rdi + 1], r10b
mov byte [rdi + 2], r9b
mov eax, r8d
shr eax, 0x18
mov byte [rdi + 3], al
mov eax, r8d
shr eax, 0x10
shr r8d, 8
mov byte [rdi + 4], al
mov byte [rdi + 5], r8b
mov byte [rdi + 6], dl
mov dword [r13], ebx
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.180243450
mov rbx, qword [rsp + 0x90]
add rsp, 0x50
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret