joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180027ed0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x20
mov rbx, rdx
mov r14, r9
sub rdx, rcx
mov edi, r8d
sub rdx, 0x40
mov rbp, rcx
sar rdx, 2
call fcn.180027100
test rax, rax
jne 0x180027f82
lea rsi, [rbp + 0x40]
lea r15, [0x180066760]
sub rbx, 4
cmp rbx, rsi
jbe 0x180027f4b
mov eax, dword [rbx]
movzx edx, al
mov ecx, eax
shr ecx, 8
movzx r8d, cl
movzx ecx, word [r15 + rdx*2]
and cx, 7
cmp cx, 2
jne 0x180027f4f
cmp edi, r8d
jb 0x180027f14
cmp edx, 0x2c
jne 0x180027f4b
shr eax, 0x10
cmp edi, eax
ja 0x180027f14
xor eax, eax
jmp 0x180027f8c
cmp cx, 1
jne 0x180027f14
cmp r8d, edi
jne 0x180027f14
cmp edx, 0x12
jne 0x180027fa5
mov edi, eax
mov rdx, rbx
sub rdx, rbp
shr edi, 0x10
sub rdx, 0x40
mov r8d, edi
sar rdx, 2
mov rcx, rbp
call fcn.180027100
test rax, rax
je 0x180027f14
mov qword [r14], rax
lea rax, str.local
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop rdi
ret
cmp edx, 0x2d
je 0x18002802e
cmp edx, 0x36
je 0x18002800b
cmp edx, 0x39
jne 0x180027f4b
mov ecx, eax
shr rcx, 0x10
movzx edx, cl
mov ecx, dword [rbp + 0x10]
not rdx
mov edx, dword [rcx + rdx*4]
add rdx, 0x10
mov qword [r14], rdx
mov r9d, dword [rbx - 4]
cmp r9b, 0x12
jne 0x180028002
mov ecx, r9d
shr ecx, 8
movzx edx, cl
lea ecx, [r8 + 1]
cmp edx, ecx
jne 0x180028002
shr eax, 8
xor eax, r9d
test eax, 0xffff0000
jne 0x180028002
lea rax, str.method
jmp 0x180027f8c
lea rax, str.field
jmp 0x180027f8c
mov rcx, rax
mov eax, dword [rbp + 0x10]
shr rcx, 0x10
not rcx
mov ecx, dword [rax + rcx*4]
lea rax, str.global
add rcx, 0x10
mov qword [r14], rcx
jmp 0x180027f8c
mov edx, dword [rbp + 0x38]
shr eax, 0x10
test edx, edx
jne 0x18002804e
lea rdx, [0x180066fbd]
mov qword [r14], rdx
lea rax, str.upvalue
jmp 0x180027f8c
test eax, eax
je 0x180028061
movzx ecx, byte [rdx]
inc rdx
test cl, cl
jne 0x180028052
add eax, 0xffffffff
jne 0x180028052
mov qword [r14], rdx
lea rax, str.upvalue
jmp 0x180027f8c
Function at 0x180029880
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdi, qword [rcx + 0x30]
mov r10, rdx
mov rdx, qword [rcx + 0x10]
mov r9d, r8d
sub rdx, 8
mov rbx, rcx
test rdi, rdi
je case.default.0x1800298f1
lea r11, [0x180000000]
nop
mov rax, rdi
and rax, 0xfffffffffffffffc
mov ecx, dword [rax + 0x58]
test ecx, ecx
jns 0x1800298d2
mov eax, dword [rbx + 0x24]
neg ecx
movsxd r8, ecx
add r8, rax
cmp rdx, r8
jb 0x18002998f
mov eax, dword [rbx + 0x24]
cmp rdx, rax
jbe case.default.0x1800298f1
mov ecx, dword [rdx + 4]
movsxd r8, ecx
mov rax, r8
and eax, 7
mov eax, dword [r11 + rax*4 + 0x29aa4]
add rax, r11
jmp rax
movzx ecx, byte [rcx - 3]
mov rax, 0xfffffffffffffff8
shl rcx, 3
sub rax, rcx
add rdx, rax
jmp 0x180029942
cmp dword [rdx - 8], 1
jne case.0x1800298f1.3
test r9d, r9d
jne 0x1800299c1
cmp rdi, r10
je 0x1800299e3
mov rdi, qword [rdi + 0x68]
jmp case.0x1800298f1.3
test r9d, r9d
je 0x180029a21
cmp r9d, 1
jne 0x1800299f0
and r8, 0xfffffffffffffff8
sub rdx, r8
test rdi, rdi
jne 0x1800298b0
test r9d, r9d
je 0x180029a94
mov edx, dword [rbx + 0x24]
mov rcx, rbx
add rdx, 8
mov qword [rbx + 0x30], 0
mov qword [rbx + 0x10], rdx
call fcn.18002a500
mov eax, dword [rbx + 8]
mov rdx, qword [rax + 0xe8]
test rdx, rdx
je 0x180029983
mov rcx, rbx
call rdx
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
test r9d, r9d
je 0x180029a86
lea rax, [rdx + 8]
mov rcx, rbx
mov qword [rbx + 0x10], rax
mov rdx, r8
mov rax, qword [rdi + 0x68]
mov qword [rbx + 0x30], rax
call fcn.18002a500
mov rax, rdi
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
and r8, 0xfffffffffffffff8
mov rax, rdx
sub rax, r8
mov rcx, rbx
add rax, 8
mov qword [rbx + 0x10], rax
mov rax, qword [rdi + 0x68]
mov qword [rbx + 0x30], rax
call fcn.18002a500
xor eax, eax
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
mov eax, ecx
and eax, 7
cmp al, 6
jne 0x180029a03
mov eax, dword [rbx + 8]
and byte [rax + 0x7d], 0xef
mov ecx, dword [rdx + 4]
movsxd rax, ecx
mov rcx, rbx
and rax, 0xfffffffffffffff8
mov qword [rbx + 0x30], rdi
sub rdx, rax
add rdx, 8
mov qword [rbx + 0x10], rdx
call fcn.18002a500
or rdi, 2
mov rax, rdi
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
test dil, 1
je 0x180029a5f
test r9d, r9d
je 0x180029a86
mov eax, dword [rbx + 8]
and byte [rax + 0x7d], 0xef
mov rax, rdi
mov qword [rbx + 0x30], 0
mov byte [rbx + 7], r9b
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
test r9d, r9d
je 0x180029a86
and r8, 0xfffffffffffffff8
mov rcx, rdx
sub rcx, r8
add rcx, 8
mov qword [rbx + 0x10], rcx
mov rcx, qword [rdi + 0x68]
mov qword [rbx + 0x30], rcx
mov rcx, rbx
call fcn.18002a500
mov rax, rdi
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
mov rax, rbx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x18002de90
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rdi
push r12
push r14
sub rsp, 0x20
mov rbp, rdx
mov rbx, r8
movzx edx, byte [rdx + 0x24]
mov r12, rcx
lea edx, [rdx*4 + 0x14]
call fcn.180030100
lea r8d, [rbp + 0x40]
mov rdi, rax
mov word [rax + 5], 8
mov byte [rax + 7], 0
mov dword [rax + 0x10], r8d
mov dword [rax + 8], ebx
movzx edx, byte [rbp + 0x25]
movzx r14d, byte [rbp + 0x24]
add edx, 0x20
mov ecx, edx
shr ecx, 3
and cl, 0x20
sub dl, cl
mov byte [rbp + 0x25], dl
test r14b, r14b
je 0x18002df6f
mov qword [rsp + 0x40], rsi
xor ebx, ebx
mov qword [rsp + 0x48], r15
lea rsi, [rax + 0x14]
mov r15d, r14d
nop word [rax + rax]
mov edx, 0x18
mov rcx, r12
call fcn.180030100
lea rsi, [rsi + 4]
lea rbx, [rbx + 2]
mov word [rax + 5], 0x105
lea ecx, [rax + 8]
mov dword [rax + 0x10], ecx
mov dword [rax + 0xc], 0xffffffff
mov ecx, dword [rbp + 0x14]
movzx edx, word [rcx + rbx - 2]
mov ecx, edx
shl edx, 0x18
shr ecx, 0xe
xor edx, ebp
and cl, 1
mov dword [rax + 0x14], edx
mov byte [rax + 7], cl
mov dword [rsi - 4], eax
sub r15, 1
jne 0x18002df10
mov r15, qword [rsp + 0x48]
mov rax, rdi
mov rsi, qword [rsp + 0x40]
mov byte [rdi + 7], r14b
jmp 0x18002df73
mov byte [rax + 7], r14b
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
add rsp, 0x20
pop r14
pop r12
pop rdi
ret
Function at 0x18002ecc0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r14
sub rsp, 0x20
movzx r14d, byte [rcx + 0x28]
mov ebp, r8d
mov ebx, dword [rdx]
xor r14d, 3
mov rdi, rdx
mov rsi, rcx
test rbx, rbx
je 0x18002ed85
mov qword [rsp + 0x40], r15
lea r15, [0x1800683a0]
nop dword [rax + rax]
mov eax, ebp
dec ebp
test eax, eax
je 0x18002ed6a
cmp byte [rbx + 5], 6
jne 0x18002ed20
lea rdx, [rbx + 0x28]
mov r8d, 0xffffffff
mov rcx, rsi
call fcn.18002ecc0
movzx ecx, byte [rbx + 4]
mov eax, ecx
xor eax, 3
test r14d, eax
je 0x18002ed41
movzx eax, byte [rsi + 0x28]
and cl, 0xf8
and al, 3
mov rdi, rbx
or cl, al
mov byte [rbx + 4], cl
jmp 0x18002ed63
mov eax, dword [rbx]
mov dword [rdi], eax
mov eax, dword [rsi + 0x30]
cmp rbx, rax
jne 0x18002ed52
mov eax, dword [rbx]
mov dword [rsi + 0x30], eax
movzx eax, byte [rbx + 5]
mov rdx, rbx
sub eax, 4
mov rcx, rsi
call qword [r15 + rax*8]
mov ebx, dword [rdi]
test rbx, rbx
jne 0x18002ed00
mov r15, qword [rsp + 0x40]
mov rax, rdi
mov rbx, qword [rsp + 0x48]
mov rbp, qword [rsp + 0x50]
add rsp, 0x20
pop r14
pop rdi
pop rsi
ret
mov rax, rdx
jmp 0x18002ed72

Function at 0x1800336f0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov eax, 0x4500
shr r8, 2
or dx, ax
mov word [rcx + 0xa2], r8w
mov eax, 0x7fff
mov word [rcx + 0xa4], dx
mov word [rcx + 0xa0], ax
jmp fcn.18003c670

Function at 0x180037950
Capabilities:
Allocate or change rwx memory

Disassembly:
push rdi
sub rsp, 0x20
mov r10, rdx
mov rdi, rcx
test r8d, r8d
je 0x1800379d8
mov rcx, qword [rcx + 0x9c8]
cmp rcx, rdx
jne 0x1800379ac
cmp dword [rdi + 0x9c4], 0x20
je 0x1800379d0
mov rdx, qword [rdi + 0x9e0]
lea r9, [rsp + 0x40]
mov r8d, 0x20
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x18003799a
mov rcx, rdi
call fcn.180037c70
mov dword [rdi + 0x9c4], 0x20
xor eax, eax
add rsp, 0x20
pop rdi
ret
mov rdx, qword [rdx + 8]
lea r9, [rsp + 0x40]
mov r8d, 0x20
mov rcx, r10
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x1800379d0
mov rcx, rdi
call fcn.180037c70
xor eax, eax
add rsp, 0x20
pop rdi
ret
mov qword [rsp + 0x30], rbx
mov rbx, qword [rcx + 0x9c8]
cmp r10, rbx
jb 0x180037a40
mov rdx, qword [rcx + 0x9e0]
lea rax, [rdx + rbx]
cmp r10, rax
jae 0x180037a40
cmp dword [rcx + 0x9c4], 4
je 0x180037a75
lea r9, [rsp + 0x40]
mov r8d, 4
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x180037a22
mov rcx, rdi
call fcn.180037c70
mov rax, rbx
mov dword [rdi + 0x9c4], 4
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
mov rbx, qword [rbx]
cmp r10, rbx
jb 0x180037a40
mov rdx, qword [rbx + 8]
lea rax, [rdx + rbx]
cmp r10, rax
jae 0x180037a40
lea r9, [rsp + 0x40]
mov r8d, 4
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x180037a75
mov rcx, rdi
call fcn.180037c70
mov rax, rbx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x18003c670
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x20
mov rdi, rcx
lea r14, [0x180000000]
mov ecx, dword [rcx + 0x90]
mov eax, ecx
and eax, 0xfff0000
cmp eax, 0x3ff0000
je 0x18003c728
bt ecx, 0x10
jb 0x18003c6c8
movzx eax, byte [rdi + 0xa5]
test byte [rax + r14 + 0x683f0], 0x60
jne 0x18003c6c8
mov rcx, rdi
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
jmp fcn.180039020
mov eax, ecx
and eax, 0xb0000
cmp eax, 0xb0000
je 0x18003c704
movzx edx, byte [rdi + 0xa5]
movzx eax, byte [rdx + r14 + 0x683f0]
and al, 0x60
cmp al, 0x40
jne 0x18003c704
cmp dl, 0x47
je 0x18003c704
mov rcx, rdi
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
jmp fcn.180033660
and ecx, 0x110000
cmp ecx, 0x110000
je 0x18003c728
movzx eax, byte [rdi + 0xa5]
movzx eax, byte [rax + r14 + 0x683f0]
and al, 0x60
cmp al, 0x60
je 0x18003c6f1
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x38], rbp
mov ebp, 0x7ffd
mov qword [rsp + 0x40], rsi
nop dword [rax]
movzx r8d, byte [rdi + 0xa5]
movzx ecx, word [rdi + 0xa0]
mov r9d, dword [rdi + 0x18]
shl r8d, 0x11
cmp ecx, r9d
jb 0x18003c790
mov r10, qword [rdi + 0x10]
lea rdx, [rcx*8]
movzx eax, byte [rdx + r10 + 5]
shl eax, 0xa
add r8d, eax
mov rax, qword [rdx + r10]
mov qword [rdi + 0xa8], rax
cmp cx, bp
jae 0x18003c790
mov rax, qword [rdx + r10 + 8]
mov qword [rdi + 0xb0], rax
movzx edx, word [rdi + 0xa2]
cmp edx, r9d
jb 0x18003c7c4
mov r9, qword [rdi + 0x10]
mov rax, qword [r9 + rdx*8]
movzx ecx, byte [r9 + rdx*8 + 5]
mov qword [rdi + 0xb8], rax
cmp dx, bp
jae 0x18003c7cc
mov rax, qword [r9 + rdx*8 + 8]
mov qword [rdi + 0xc0], rax
jmp 0x18003c7cc
mov ecx, edx
and ecx, 0x3ff
lea esi, [rcx + r8]
xor ebx, ebx
nop dword [rax]
nop word [rax + rax]
mov r8d, ebx
mov eax, 0x143b58c1
and r8d, 0x1ffff
or r8d, esi
mov ecx, r8d
ror ecx, 2
sub ecx, r8d
ror ecx, 7
mul ecx
mov eax, ecx
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 9
imul eax, eax, 0x3b5
sub ecx, eax
mov edx, dword [r14 + rcx*4 + 0x693c0]
mov eax, edx
and eax, 0xffffff
cmp eax, r8d
je 0x18003c83e
lea eax, [rcx + 1]
mov edx, dword [r14 + rax*4 + 0x693c0]
mov eax, edx
and eax, 0xffffff
cmp eax, r8d
jne 0x18003c856
mov eax, edx
mov rcx, rdi
shr rax, 0x18
call qword [r14 + rax*8 + 0x68ef0]
movzx edx, ax
test edx, edx
jne 0x18003c870
cmp ebx, 0xfffff
je 0x18003c893
mov eax, ebx
shr eax, 0xa
or ebx, eax
xor ebx, 0xffc00
jmp 0x18003c7e0
cmp edx, 5
jae 0x18003c8a9
cmp edx, 1
je 0x18003c740
cmp edx, 2
jne 0x18003c89d
mov edx, dword [rdi + 0xa0]
mov rcx, rdi
call fcn.180033a50
jmp 0x18003c8b7
mov rcx, rdi
call fcn.180039020
jmp 0x18003c8b7
cmp edx, 3
je 0x18003c8d2
mov eax, 0xffff
jmp 0x18003c8b7
mov rax, qword [rdi + 0x10]
movzx eax, byte [rax + rdx*8 + 4]
shl eax, 0x18
add eax, edx
mov rbp, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
mov edx, 0x18
mov rcx, rdi
call fcn.180055a70
int3
Function at 0x18003d4c0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbx
push rdi
push r14
sub rsp, 0x20
movzx r11d, word [rdx + 2]
mov r14, rcx
movzx r9d, word [r8 + 2]
cmp rdx, r8
je 0x18003d613
mov r10, qword [rcx + 0x10]
cmp byte [r10 + r11*8 + 5], 0x1e
lea rbx, [r10 + r11*8]
jne 0x18003d4f7
movzx r11d, word [rbx]
lea rbx, [r10 + r11*8]
cmp byte [r10 + r9*8 + 5], 0x1e
lea rcx, [r10 + r9*8]
jne 0x18003d50b
movzx r9d, word [rcx]
lea rcx, [r10 + r9*8]
movzx edi, byte [rdx + 5]
lea eax, [rdi - 0x39]
cmp al, 1
jbe 0x18003d51b
movzx eax, word [rdx]
jmp 0x18003d523
movzx eax, word [rdx]
movzx eax, word [r10 + rax*8]
movzx edx, ax
movzx eax, byte [r8 + 5]
sub al, 0x39
cmp al, 1
jbe 0x18003d537
movzx eax, word [r8]
jmp 0x18003d540
movzx eax, word [r8]
movzx eax, word [r10 + rax*8]
movzx r8d, ax
cmp r11d, r9d
jne 0x18003d562
cmp edx, r8d
je 0x18003d613
mov rcx, r14
add rsp, 0x20
pop r14
pop rdi
pop rbx
jmp fcn.18003d6c0
mov qword [rsp + 0x40], rbp
mov qword [rsp + 0x48], rsi
mov qword [rsp + 0x50], r15
mov r15d, 0x8000
cmp r11d, r15d
jae 0x18003d581
cmp r9d, r15d
jb 0x18003d5e3
cmp dil, 0x39
jne 0x18003d5d8
xor esi, esi
mov ebp, r11d
cmp byte [rbx + 5], 0x29
mov edi, esi
jne 0x18003d5ae
movzx eax, word [rbx + 2]
cmp ax, r15w
jae 0x18003d5ae
movzx ebp, word [rbx]
mov esi, dword [r10 + rax*8]
cmp ebp, r9d
jne 0x18003d5ae
test esi, esi
jne 0x18003d5e3
cmp byte [rcx + 5], 0x29
jne 0x18003d5cf
movzx eax, word [rcx + 2]
cmp ax, r15w
jae 0x18003d5cf
movzx r9d, word [rcx]
mov edi, dword [r10 + rax*8]
cmp r11d, r9d
jne 0x18003d5cf
test edi, edi
jne 0x18003d5e3
cmp ebp, r9d
jne 0x18003d5fd
cmp esi, edi
jmp 0x18003d5e1
movzx eax, byte [rcx + 4]
xor al, byte [rbx + 4]
test al, 0x1f
je 0x18003d5fd
xor eax, eax
mov rsi, qword [rsp + 0x48]
mov rbp, qword [rsp + 0x40]
mov r15, qword [rsp + 0x50]
add rsp, 0x20
pop r14
pop rdi
pop rbx
ret
cmp edx, r8d
jne 0x18003d609
mov eax, 1
jmp 0x18003d5e5
mov rcx, r14
call fcn.18003d6c0
jmp 0x18003d5e5
mov eax, 2
add rsp, 0x20
pop r14
pop rdi
pop rbx
ret
Function at 0x18003e390
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x20
movzx eax, byte [rcx + 0xbc]
lea rsi, [rcx + 0xa0]
movzx r12d, word [rsi]
and al, 0x1f
mov r15, rcx
cmp al, 0xe
jne 0x18003e3f8
movzx edx, word [rcx + 0x1fa]
cmp edx, r12d
jbe 0x18003e3f8
movzx eax, word [rcx + 0x214]
cmp eax, r12d
jbe 0x18003e3f8
nop
cmp eax, edx
jb 0x18003e54b
mov ecx, eax
mov rax, qword [r15 + 0x10]
movzx eax, word [rax + rcx*8 + 6]
cmp eax, r12d
ja 0x18003e3e0
movzx eax, word [r15 + 0x216]
cmp eax, r12d
jbe 0x18003e54f
mov rbx, qword [r15 + 0x10]
mov ebp, 0x8000
mov dword [rsp + 0x50], ebp
nop word [rax + rax]
lea r13, [rbx + rax*8]
movzx eax, word [rbx + rax*8]
movzx ecx, word [rbx + rax*8 + 2]
lea rdx, [rbx + rax*8]
cmp rsi, rdx
je 0x18003e54b
movzx r9d, word [rsi + 2]
cmp byte [rbx + r9*8 + 5], 0x1e
lea r8, [rbx + r9*8]
jne 0x18003e453
movzx r9d, word [r8]
lea r8, [rbx + r9*8]
cmp byte [rbx + rcx*8 + 5], 0x1e
lea r10, [rbx + rcx*8]
jne 0x18003e466
movzx ecx, word [r10]
lea r10, [rbx + rcx*8]
movzx r11d, byte [rsi + 5]
lea eax, [r11 - 0x39]
cmp al, 1
jbe 0x18003e478
movzx eax, word [rsi]
jmp 0x18003e47f
movzx eax, word [rsi]
movzx eax, word [rbx + rax*8]
movzx r14d, ax
movzx eax, byte [rdx + 5]
sub al, 0x39
cmp al, 1
jbe 0x18003e492
movzx eax, word [rdx]
jmp 0x18003e499
movzx eax, word [rdx]
movzx eax, word [rbx + rax*8]
movzx edi, ax
cmp r9d, ecx
je 0x18003e520
cmp r9d, ebp
jae 0x18003e4ae
cmp ecx, ebp
jb 0x18003e537
cmp r11b, 0x39
jne 0x18003e513
xor r11d, r11d
xor edx, edx
cmp byte [r8 + 5], 0x29
mov ebp, r9d
jne 0x18003e4e0
movzx eax, word [r8 + 2]
cmp ax, word [rsp + 0x50]
jae 0x18003e4e0
movzx ebp, word [r8]
mov r11d, dword [rbx + rax*8]
cmp ebp, ecx
jne 0x18003e4e0
test r11d, r11d
jne 0x18003e537
cmp byte [r10 + 5], 0x29
jne 0x18003e508
movzx eax, word [r10 + 2]
mov r8d, 0x8000
cmp ax, r8w
jae 0x18003e508
movzx ecx, word [r10]
mov edx, dword [rbx + rax*8]
cmp r9d, ecx
jne 0x18003e508
test edx, edx
jne 0x18003e537
cmp ebp, ecx
jne 0x18003e520
cmp r11d, edx
je 0x18003e520
jmp 0x18003e537
movzx eax, byte [r10 + 4]
xor al, byte [r8 + 4]
test al, 0x1f
jne 0x18003e537
cmp r14d, edi
je 0x18003e54b
mov r8d, edi
mov edx, r14d
mov rcx, r15
call fcn.18003d6c0
test eax, eax
jne 0x18003e54b
movzx eax, word [r13 + 6]
cmp eax, r12d
jbe 0x18003e54f
mov ebp, 0x8000
jmp 0x18003e420
xor eax, eax
jmp 0x18003e554
mov eax, 1
mov rbx, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
add rsp, 0x20
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x18003e8c0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
movzx esi, dx
mov rdi, rcx
movzx r9d, word [rcx + rsi*2 + 0x190]
cmp r9d, r8d
jbe 0x18003e95d
mov r11, qword [rcx + 0x10]
mov eax, r8d
lea rbp, [r11 + rax*8]
nop word [rax + rax]
movzx eax, byte [r11 + r9*8 + 4]
lea rbx, [r11 + r9*8]
movzx ecx, word [rbx]
and al, 0x1f
cmp ecx, r8d
je 0x18003e99f
test al, al
jne 0x18003e953
movzx r9d, word [r11 + rcx*8 + 2]
movzx r10d, word [rbp + 2]
cmp esi, 0x42
je 0x18003e93c
movzx edx, byte [r11 + r10*8 + 4]
xor dl, byte [r11 + r9*8 + 4]
test dl, 0x1f
jne 0x18003e953
cmp r9d, r10d
je 0x18003e986
cmp r9d, 0x8000
jae 0x18003e986
cmp r10d, 0x8000
jae 0x18003e986
movzx r9d, word [rbx + 6]
cmp r9d, r8d
ja 0x18003e900
movzx eax, word [rdi + rsi*2 + 0x182]
cmp eax, r8d
jbe 0x18003e986
mov rdx, qword [rdi + 0x10]
nop
lea rcx, [rdx + rax*8]
movzx eax, word [rdx + rax*8]
cmp eax, r8d
je 0x18003e9aa
movzx eax, word [rcx + 6]
cmp eax, r8d
ja 0x18003e970
xor eax, eax
mov rbx, qword [rsp + 0x10]
mov rbp, qword [rsp + 0x18]
mov rsi, qword [rsp + 0x20]
mov rdi, qword [rsp + 0x28]
pop r14
ret
xor ecx, ecx
test al, al
setne cl
mov eax, ecx
jmp 0x18003e988
test byte [rcx + 4], 0x1f
mov ecx, 0
setne cl
mov eax, ecx
jmp 0x18003e988
Function at 0x18003fc30
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push r12
push r14
push r15
sub rsp, 0x20
mov r10, qword [rcx + 0x10]
mov esi, r9d
movzx r14d, dx
mov r12d, r8d
mov r9d, edx
mov rbp, rcx
movzx r15d, byte [r10 + r14*8 + 5]
cmp r15d, 0x36
jb 0x18003fd6f
cmp r15d, r8d
jg 0x18003fd6f
xor edx, edx
add rcx, 0x910
nop word [rax + rax]
cmp word [rcx], r14w
jne 0x18003fc9a
mov eax, dword [rcx + 4]
cmp eax, esi
jb 0x18003fc9a
xor eax, esi
test eax, 0xfff
je 0x18003fd5e
inc rdx
add rcx, 8
cmp rdx, 0x10
jl 0x18003fc80
movzx edx, word [r10 + r14*8]
mov r9d, esi
mov qword [rsp + 0x40], rbx
mov rcx, rbp
movzx ebx, word [r10 + r14*8 + 2]
mov qword [rsp + 0x48], rdi
call fcn.18003fc30
mov r9d, esi
mov r8d, r12d
mov edx, ebx
mov rcx, rbp
mov edi, eax
call fcn.18003fc30
mov ecx, 0xf3
mov word [rbp + 0xa0], di
add r15w, cx
mov word [rbp + 0xa2], ax
movzx edx, r15w
mov ecx, 0x100
imul edx, ecx
mov r8d, esi
shr r8d, 5
mov rcx, rbp
and r8w, 0x1f
or r8w, dx
mov word [rbp + 0xa4], r8w
call fcn.18003c670
mov ecx, dword [rbp + 0x990]
mov r9d, eax
mov rdi, qword [rsp + 0x48]
mov rbx, qword [rsp + 0x40]
lea rdx, [rcx*8]
lea eax, [rcx + 1]
and eax, 0xf
mov dword [rbp + 0x990], eax
mov word [rdx + rbp + 0x910], r14w
mov word [rdx + rbp + 0x912], r9w
mov dword [rdx + rbp + 0x914], esi
jmp 0x18003fdb0
movzx ecx, word [rcx + 2]
movzx eax, byte [r10 + rcx*8 + 4]
shl eax, 0x18
add eax, ecx
jmp 0x18003fdb3
bt esi, 0xb
jae 0x18003fdb0
movzx ecx, byte [r10 + r14*8 + 4]
mov edx, 0x604208
and ecx, 0x1f
shr edx, cl
test dl, 1
jne 0x18003fdb0
mov eax, 0x5a15
mov word [rbp + 0xa0], r14w
mov rcx, rbp
mov word [rbp + 0xa4], ax
mov word [rbp + 0xa2], si
call fcn.18003c670
mov r9d, eax
mov eax, r9d
mov rbp, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x20
pop r15
pop r14
pop r12
ret
Function at 0x180048370
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x30
movzx eax, byte [rdx]
xor r15d, r15d
mov rbp, r9
mov r14, r8
mov rbx, rdx
mov rsi, rcx
mov edi, 0xa
test al, al
je 0x1800483d4
movsx edx, al
inc rbx
cmp edx, 0x66
je 0x1800483bc
cmp edx, 0x69
je 0x1800484a3
cmp edx, 0x6c
jne 0x1800483cd
mov eax, dword [rsi + 8]
mov rcx, rsi
mov dword [rax + 0xba4], edx
call fcn.180055da0
movzx eax, byte [rbx]
test al, al
jne 0x1800483a3
cmp qword [0x180075240], r15
je 0x1800483f2
mov rcx, rsi
call sym.lua51.dll_luaJIT_profile_stop
cmp qword [0x180075240], r15
jne 0x180048519
cmp qword [0x180075278], r15
mov eax, dword [rsi + 8]
mov qword [0x180075240], rax
mov dword [0x180075268], edi
mov qword [0x180075248], r14
mov qword [0x180075250], rbp
mov dword [0x18007526c], r15d
mov dword [0x180075264], esi
mov qword [0x180075258], r15
mov dword [0x180075260], r15d
jne 0x1800484dc
xor r8d, r8d
lea rcx, str.winmm.dll
xor edx, edx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExA]
mov qword [0x180075278], rax
test rax, rax
je 0x1800484dc
lea rdx, str.timeBeginPeriod
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x180075278]
lea rdx, str.timeEndPeriod
mov qword [0x180075280], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp qword [0x180075280], r15
mov qword [0x180075288], rax
je 0x18004849a
test rax, rax
jne 0x1800484dc
mov qword [0x180075278], r15
jmp 0x180048519
movzx eax, byte [rbx]
mov edi, r15d
cmp al, 0x30
jl 0x1800484d2
nop dword [rax]
cmp al, 0x39
ja 0x1800484ca
inc rbx
movzx ecx, al
lea edi, [rdi + rdi*4]
lea edi, [rdi - 0x18]
movzx eax, byte [rbx]
lea edi, [rcx + rdi*2]
cmp al, 0x30
jge 0x1800484b0
test edi, edi
jg 0x1800483cd
mov edi, 1
jmp 0x1800483cd
lea rcx, [0x180075290]
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
lea r9, [0x180075240]
mov qword [rsp + 0x28], r15
lea r8, [0x1800485f0]
mov dword [0x1800752c0], r15d
xor edx, edx
mov dword [rsp + 0x20], r15d
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [0x1800752b8], rax
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x30
pop r15
pop r14
pop rdi
ret
Function at 0x18004be10
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov r10d, dword [rdx + 4]
mov r9, rcx
test r8d, r8d
je 0x18004be2c
mov eax, r10d
shr eax, 0x10
lea r8d, [rax*4 - 0x1fff8]
jmp 0x18004be32
mov r8d, 8
movzx ecx, word [rcx + 0x1c]
add r8d, edx
mov rax, qword [r9 + 0x20]
shr r10d, 8
movzx edx, byte [rax + rcx*8 - 2]
movzx eax, word [rax + rcx*8 - 8]
add rdx, rax
mov rax, qword [r9 + 0x28]
mov dword [rax + rdx*4], r8d
movzx eax, r10b
mov byte [r9 + 0x9d], 1
cmp eax, dword [r9 + 0x94]
jae 0x18004be72
mov dword [r9 + 0x94], eax
mov rcx, r9
jmp 0x18004ee30
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r14
push r15
sub rsp, 0x130
mov rax, qword [0x1800751c8]
xor rax, rsp
mov qword [rsp + 0x120], rax
movzx edx, word [rcx + 0x1c]
mov r15, rcx
mov rax, qword [rcx + 0x20]
movzx edi, byte [rax + rdx*8 - 2]
lea r14, [rax + rdx*8]
mov rdx, qword [rcx + 0x28]
movzx eax, word [r14 - 8]
mov esi, dword [rcx + 0x94]
mov r9d, esi
mov ebp, dword [rcx + 0x98]
lea rbx, [rdx + rax*4]
add rax, rdi
mov r8d, dword [rdx + rax*4]
lea rdx, [rsp + 0x20]
call fcn.18004f860
xor edx, edx
add esi, ebp
mov byte [r14 - 4], sil
mov r8d, edx
lea r11d, [rax + rbp]
test dil, dil
je 0x18004eeeb
mov r9, rbx
mov r8d, edi
nop dword [rax + rax]
mov r10d, dword [r9]
mov eax, r10d
shr eax, 0x18
cmp eax, r11d
jb 0x18004eedb
cmp eax, esi
jae 0x18004eee1
sub eax, ebp
cmp byte [rsp + rax + 0x20], 0
jne 0x18004eee1
mov dword [rbx + rdx*4], r10d
inc edx
add r9, 4
sub rdi, 1
jne 0x18004eec0
movzx eax, word [r14 - 8]
mov byte [r14 - 2], dl
movzx r9d, word [r15 + 0x1e]
sub r9d, eax
dec r9d
cmp r8d, r9d
ja 0x18004ef28
nop dword [rax]
nop dword [rax + rax]
mov eax, r8d
inc r8d
mov eax, dword [rbx + rax*4]
mov dword [rbx + rdx*4], eax
inc edx
cmp r8d, r9d
jbe 0x18004ef10
movzx eax, word [r14 - 8]
add ax, dx
mov word [r15 + 0x1e], ax
mov rcx, qword [rsp + 0x120]
xor rcx, rsp
call fcn.1800647d0
lea r11, [rsp + 0x130]
mov rbx, qword [r11 + 0x28]
mov rbp, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rdi
ret