joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140010100
Capabilities:
Create process on windows

Disassembly:
jmp 0x140010100
mov qword [rsp + 8], rcx
sub rsp, 0x158
mov rax, qword [0x140110040]
xor rax, rsp
mov qword [rsp + 0x140], rax
mov r8d, 0x68
xor edx, edx
lea rcx, [rsp + 0x70]
call fcn.14000496c
mov r8d, 0x18
xor edx, edx
lea rcx, [rsp + 0x50]
call fcn.14000496c
mov dword [rsp + 0x70], 0x68
mov rdx, qword [rsp + 0x160]
lea rcx, [rsp + 0xe0]
call fcn.140001a3c
xor r8d, r8d
mov dl, 0x20
lea rcx, [rsp + 0xe0]
call fcn.140003936
cmp rax, 0xffffffffffffffff
je 0x1400101d4
lea r8, [rsp + 0xe0]
lea rdx, [0x1400eb258]
lea rcx, [rsp + 0x120]
call fcn.140001334
lea r8, [0x1400eb254]
mov rdx, rax
lea rcx, [rsp + 0x100]
call fcn.140005646
mov rdx, rax
lea rcx, [rsp + 0xe0]
call fcn.1400024d7
lea rcx, [rsp + 0x100]
call fcn.140001e74
lea rcx, [rsp + 0x120]
call fcn.140001e74
lea rcx, [rsp + 0xe0]
call fcn.140001758
lea rcx, [rsp + 0x50]
mov qword [rsp + 0x48], rcx
lea rcx, [rsp + 0x70]
mov qword [rsp + 0x40], rcx
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
mov rdx, rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
jne 0x140010242
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
lea rcx, [0x1400eb260]
call fcn.140003472
jmp 0x140010258
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [rsp + 0xe0]
call fcn.140001e74
mov rcx, qword [rsp + 0x140]
xor rcx, rsp
call fcn.140003521
add rsp, 0x158
ret
Function at 0x140010400
Capabilities:
Set registry value

Disassembly:
jmp 0x140010400
mov qword [rsp + 8], rcx
sub rsp, 0xd8
mov rax, qword [0x140110040]
xor rax, rsp
mov qword [rsp + 0xc8], rax
lea rax, [rsp + 0x88]
mov qword [rsp + 0x68], rax
lea rdx, [0x1400eb280]
mov rcx, qword [rsp + 0x68]
call fcn.14000330a
mov rcx, rax
call fcn.1400064d3
mov qword [rsp + 0x70], rax
lea rdx, [0x1400eb2b8]
lea rcx, [rsp + 0xa8]
call fcn.14000330a
lea rax, [rsp + 0x60]
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0x58]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0xf003f
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
mov rdx, qword [rsp + 0x70]
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
mov dword [rsp + 0x50], eax
cmp dword [rsp + 0x50], 0
je 0x1400104cf
mov edx, dword [rsp + 0x50]
lea rcx, [0x1400eb2c0]
call fcn.140003472
lea rcx, [rsp + 0xa8]
call fcn.140001e74
jmp 0x140010566
mov rcx, qword [rsp + 0xe0]
call fcn.140004737
inc rax
mov qword [rsp + 0x78], rax
mov rcx, qword [rsp + 0xe0]
call fcn.140001758
mov qword [rsp + 0x80], rax
lea rcx, [rsp + 0xa8]
call fcn.140001758
mov rcx, qword [rsp + 0x78]
mov dword [rsp + 0x28], ecx
mov rcx, qword [rsp + 0x80]
mov qword [rsp + 0x20], rcx
mov r9d, 1
xor r8d, r8d
mov rdx, rax
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov dword [rsp + 0x50], eax
cmp dword [rsp + 0x50], 0
je 0x14001054e
mov edx, dword [rsp + 0x50]
lea rcx, [0x1400eb2e0]
call fcn.140003472
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rcx, [rsp + 0xa8]
call fcn.140001e74
mov rcx, qword [rsp + 0xc8]
xor rcx, rsp
call fcn.140003521
add rsp, 0xd8
ret

Function at 0x14005cd14
Capabilities:
Parse pe header

Disassembly:
jmp 0x14005cd14
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14005cd5e
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14005cd5e
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14005cd5e
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14005cd5e
cmp dword [rcx + 0x84], 0xe
jbe 0x14005cd5e
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x14005cd60
xor al, al
add rsp, 0x28
ret
Function at 0x1400ccb3c
Capabilities:
Get geographical location

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov esi, edx
mov ebx, ecx
call fcn.1400020f9
mov ecx, ebx
lea r8, [rsp + 0x30]
and ecx, 0x3ff
mov r9d, 2
bts ecx, 0xa
mov edx, 0x20000001
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
xor edx, edx
test eax, eax
je 0x1400ccbdd
cmp ebx, dword [rsp + 0x30]
je 0x1400ccbd6
test esi, esi
je 0x1400ccbd6
mov r10, qword [rdi + 0x98]
mov r9d, edx
movzx r8d, word [r10]
lea rcx, [r10 + 2]
lea eax, [r8 - 0x41]
cmp ax, 0x19
jbe 0x1400ccbb1
sub r8w, 0x61
cmp r8w, 0x19
ja 0x1400ccbbe
movzx r8d, word [rcx]
inc r9d
add rcx, 2
jmp 0x1400ccb9b
or rax, 0xffffffffffffffff
inc rax
cmp word [r10 + rax*2], dx
jne 0x1400ccbc2
cmp r9d, eax
setne dl
mov eax, edx
jmp 0x1400ccbdf
mov eax, 1
jmp 0x1400ccbdf
xor eax, eax
mov rbx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x1400d31f0
Capabilities:
Get file size

Disassembly:
push rbx
sub rsp, 0x20
mov edx, dword [rcx + 0x14]
nop
shr edx, 3
test dl, 1
je 0x1400d3206
mov al, 1
jmp 0x1400d3266
mov eax, dword [rcx + 0x14]
nop
test al, 0xc0
je 0x1400d3217
mov rax, qword [rcx + 8]
cmp qword [rcx], rax
je 0x1400d3264
mov ecx, dword [rcx + 0x18]
nop
call fcn.140005fdd
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x1400d3264
mov r9d, 1
lea r8, [rsp + 0x38]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
je 0x1400d3264
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
je 0x1400d3264
mov rax, qword [rsp + 0x30]
cmp qword [rsp + 0x38], rax
sete al
jmp 0x1400d3266
xor al, al
add rsp, 0x20
pop rbx
ret

Function at 0x1404c4058
Capabilities:
Decompress data using aplib

Disassembly:
call 0x1404c41df
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x1404c4089
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1404c406f
add dl, dl
jne 0x1404c4096
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1404c40f6
xor eax, eax
add dl, dl
jne 0x1404c40a5
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1404c41ad
add dl, dl
jne 0x1404c40b6
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1404c40c3
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1404c40d0
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1404c40dd
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x1404c40ea
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x1404c407e
mov eax, 1
add dl, dl
jne 0x1404c4106
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1404c4113
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1404c40fb
sub eax, ebx
mov ebx, 1
jne 0x1404c414c
mov ecx, 1
add dl, dl
jne 0x1404c412e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x1404c413b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1404c4123
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x1404c407e
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x1404c4168
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x1404c4175
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1404c415d
cmp eax, 0x7d00
jae 0x1404c419b
cmp eax, 0x500
jb 0x1404c4196
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x1404c407e
cmp eax, 0x7f
ja 0x1404c419e
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x1404c407e
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x1404c41d2
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x1404c407e
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x1401bede0
Capabilities:
Encode data using xor
Hash data using murmur3

Disassembly:
push rdi
push rsi
push rbp
push rbx
sub rsp, 0x28
mov rsi, r8
mov edi, edx
xor ebx, ebx
mov ebp, dword [rsi + 8]
test ebp, ebp
jle 0x1401bee14
mov ecx, ebx
mov rcx, qword [rsi + rcx*8 + 0x10]
mov rax, qword [rcx]
call qword [rax + 0x28]
mov edx, edi
rol edx, 0xd
add edx, edi
mov edi, eax
xor edi, edx
inc ebx
cmp ebp, ebx
jg 0x1401bedf6
mov eax, edi
rol eax, 0xf
add eax, edi
add rsp, 0x28
pop rbx
pop rbp
pop rsi
pop rdi
ret

Function at 0x100403a20
Capabilities:
Encode data using xor

Disassembly:
xor al, 0x6c
xor al, 0x64
xor al, 0x67
xor al, 0x41
xor al, 0x3e
xor al, 0x7d
xor al, 0xa2
xor al, 0x9a
xor al, 0xa3
xor al, 0x88
xor al, 0x9d
xor al, 0xa4
xor al, 0x71
xor al, 0x74
xor al, 0x59
xor al, 0x87
xchg dword [rbp*4 - 0x57cb58cc], esi
xor al, 0x99
xor al, 0xa1
xor al, 0x86
xor al, 0xa3
xor al, 0xa3
movabs dword [0xa73490345934a834], eax
xor al, 0xad
xor al, 0xa7
xor al, 0xa8
xor al, 0x99
cdq
xor al, 0xa1
xor al, 0x67
xor al, 0x66
xor al, 0x90
xor al, 0xa7
xor al, 0x9c
xor al, 0x99
xor al, 0xa0
xor al, 0xa0
xor al, 0x67
xor al, 0x66
xor al, 0x62
Function at 0x140022156
Capabilities:
Get geographical location

Disassembly:
mov rbx, rdx
lea r8, [rsp + 0x60]
mov edi, ecx
mov edx, 0x20000001
lea rcx, str._x_sys_default_locale
mov ah, 0x37
add byte [rax], al

Function at 0x14002348f
Capabilities:
Parse pe header

Disassembly:
adc eax, 0x1cec
test rax, rax
je 0x1400234d2
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x1400234d2
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x1400234d2
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x1400234d2
cmp dword [rcx + 0x84], 0xe
jbe 0x1400234d2
cmp dword [rcx + 0xf8], 0
invalid
xchg ebp, eax

Function at 0x140001000
Capabilities:
Accept command line arguments
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x70
lea rcx, str._JAVA_LAUNCHER_DEBUG
call qword [sym.imp.MSVCR100.dll_getenv]
test rax, rax
je 0x140001066
lea rcx, str.Windows_original_main_args:_n
call qword [sym.imp.MSVCR100.dll_printf]
mov rax, qword [sym.imp.MSVCR100.dll___argc]
xor ebx, ebx
cmp dword [rax], ebx
jle 0x140001066
xor edi, edi
mov rax, qword [sym.imp.MSVCR100.dll___argv]
lea rcx, str.wwwd_args__d____s_n
mov edx, ebx
mov r8, qword [rax]
mov r8, qword [r8 + rdi]
call qword [sym.imp.MSVCR100.dll_printf]
mov rax, qword [sym.imp.MSVCR100.dll___argc]
inc ebx
add rdi, 8
cmp ebx, dword [rax]
jl 0x140001038
call qword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov rcx, rax
call sub.jli.dll_JLI_CmdToArgs
call sub.jli.dll_JLI_GetStdArgc
movsxd rdi, eax
lea ecx, [rdi + 1]
movsxd rcx, ecx
shl rcx, 3
call sub.jli.dll_JLI_MemAlloc
mov rbx, rax
call sub.jli.dll_JLI_GetStdArgs
xor r9d, r9d
xor edx, edx
test edi, edi
jle 0x1400010b2
mov r9d, edi
mov rcx, qword [rax]
add rax, 0x10
mov qword [rbx + rdx*8], rcx
inc rdx
cmp rdx, rdi
jl 0x14000109f
mov rcx, qword [str.java]
movsxd rax, r9d
and qword [rbx + rax*8], 0
test rcx, rcx
jne 0x1400010c9
mov rcx, qword [rbx]
mov rax, qword [str.java]
test rax, rax
jne 0x1400010d8
mov rax, qword [rbx]
and dword [rsp + 0x68], 0
mov byte [rsp + 0x60], 0
mov byte [rsp + 0x58], 0
mov byte [rsp + 0x50], 1
mov qword [rsp + 0x48], rcx
mov qword [rsp + 0x40], rax
lea rax, [0x140002250]
mov r8d, 2
lea r9, str._J_ms8m
mov qword [rsp + 0x38], rax
lea rax, [0x140002240]
mov rdx, rbx
mov qword [rsp + 0x30], rax
lea rax, str._lib_tools.jar
mov ecx, edi
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], r8d
call sub.jli.dll_JLI_Launch
mov rbx, qword [rsp + 0x80]
add rsp, 0x70
pop rdi
ret
Function at 0x1800820db
Capabilities:
Parse pe header

Disassembly:
jmp 0x180121cd2
xor r8d, r8d
jmp 0x180084066
lea edx, [r8 + 2]
jmp 0x180081008

Function at 0x180082b90
Capabilities:
Parse pe header

Disassembly:
xor edx, edx
movzx r8w, r15b
xor ecx, ecx
lea r8d, [rdx + 1]
jmp 0x180084a90
jmp 0x180121cd2
mov dword [rsp + 0x18], r8d
jmp 0x180121cf6
mov dword [rsp + 0x10], edx
stc
cmp r12d, 0x485b0201
cmc
push rbp
btr ebp, 0x8d
movsx bp, r11b
rol bp, cl
mov rbp, rsp
cmp di, 0x6d1d
test r11b, cl
jmp 0x180121d20
sub rsp, 0x50
mov qword [rbp - 0x20], 0xfffffffffffffffe
test bpl, r10b
mov qword [rsp + 0x60], rbx
and bx, 0x21ea
movzx rbx, bx
shr bx, 0xa7
mov ebx, ecx
cmp r9b, 0xa7
cmc
test r8d, r8d
jne 0x180121df2
xor ecx, ecx
jmp 0x180121d58
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
jmp 0x180121d66
je 0x180121df2
mov ecx, 0x5a4d
test r15d, 0x58ee4b7c
cmp word [rax], cx
jne 0x180121df2
movsxd rcx, dword [rax + 0x3c]
cmp rdi, 0x567395b
test r14w, r10w
cmp r12, rdi
add rcx, rax
cmp cl, r11b
jmp 0x180121d9e
cmp dword [rcx], 0x4550
jne 0x180121df2
mov eax, 0x20b
cmp bx, r8w
cmp word [rcx + 0x18], ax
jmp 0x180121dbc
jne 0x180121df2
cmp dword [rcx + 0x84], 0xe
jmp 0x180121dce
jbe 0x180121df2
cmp dword [rcx + 0xf8], 0
jmp 0x180121de0
je 0x180121df2
mov ecx, ebx
jmp 0x180121ded
call fcn.180121f38
mov byte [rbp + 0x28], 0
cmovo eax, esp
lea rax, [rbp + 0x18]
movzx dx, bpl
setae cl
xchg cl, r9b
mov qword [rbp - 0x18], rax
lea rax, [rbp + 0x20]
seto r8b
movsx cx, sil
mov qword [rbp - 0x10], rax
cdqe
lea rax, [rbp + 0x28]
cdq
mov qword [rbp - 8], rax
mov eax, 2
movsxd rcx, ebp
mov dword [rbp - 0x2c], eax
movzx rcx, si
movsx edx, r15w
mov dword [rbp - 0x28], eax
cdq
lea r9, [rbp - 0x2c]
movsx ecx, r14w
cmovns dx, cx
movzx r8w, r12b
lea r8, [rbp - 0x18]
lea rdx, [rbp - 0x28]
lea rcx, [rbp - 0x30]
jmp 0x180121e61
call fcn.180121afc
nop
stc
cmp bl, 0xa5
cmp r9b, r14b
cmp dword [rbp + 0x20], 0
jmp 0x180121e77
je 0x180121e99
mov rbx, qword [rsp + 0x60]
shl bpl, 0x1d
or rbp, 0x5054b47
inc ebp
add rsp, 0x50
movzx rbp, r9w
pop rbp
ret
mov ecx, ebx
jmp 0x180121ea0
call fcn.180121eab
int3

Function at 0x180082fb0
Capabilities:
Parse pe header

Disassembly:
mov eax, 0x5a4d
cmp word [rcx], ax
jmp 0x180088ffe
xor eax, eax
jmp 0x180084b74
ret
jne 0x180083fb8
movsxd rax, dword [rcx + 0x3c]
cmp r9b, bl
cmc
stc
lea rax, [rax + rcx]
cmp dword [rax], 0x4550
jmp 0x180089598
jne 0x180083fb8
mov ecx, 0x20b
test bpl, spl
cmp word [rax + 0x18], cx
jne 0x180083fb8
mov eax, 1
ret

Function at 0x180085a60
Capabilities:
Encrypt data using rc4 prga

Disassembly:
jmp fcn.18011a301
mov r8, qword [rdx]
jmp 0x18008291b
Function at 0x180098b98
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 0x20], rbx
bt ax, r10w
push rbp
cdqe
cmp dil, r9b
shld ebp, ebp, 0x3c
push rdi
push r14
sub rsp, 0x20
add bpl, 0xae
mov rax, qword [rcx]
and ebp, 0x6001d8e
mov rbx, r8
adc r8b, 0xfc
mov r8, qword [rcx + 8]
mov r14, rcx
movzx ebp, si
mov rbp, r8
stc
cmp r8, r15
sub rbp, rax
sar rbp, 3
cmp rbp, rdx
jmp 0x180098be7
jae 0x180098d6e
movabs rax, 0x1fffffffffffffff
mov qword [rsp + 0x50], rsi
clc
stc
cmp di, 0x3a0b
cmp rdx, rax
jmp 0x180098c0b
ja 0x180098df3
lea rsi, [rdx*8]
test r10b, 0x79
cmp rsi, 0x1000
jb 0x180098c6d
lea rcx, [rsi + 0x27]
cmp bx, 0x381
cmp rcx, rsi
jmp 0x180098c3b
jbe 0x180098df3
call fcn.180115839
test rax, rax
je 0x180098dfd
lea rdi, [rax + 0x27]
test r9b, sil
and rdi, 0xffffffffffffffe0
jmp 0x180098c5f
mov qword [rdi - 8], rax
jmp 0x180098c68
jmp 0x180098c98
test rsi, rsi
jmp 0x180098c75
je 0x180098c90
mov rcx, rsi
call fcn.180115839
mov rdi, rax
jmp 0x180098c8b
jmp 0x180098c98
sub edi, edi
jmp 0x180098c98
test rbp, rbp
jmp 0x180098ca0
je 0x180098cff
mov rcx, qword [r14]
sal dx, cl
movzx dx, al
lea rdx, [rbp*8]
cmp ax, 0x4035
cmp rdx, 0x1000
jb 0x180098cfa
mov r8, qword [rcx - 8]
or rax, rbx
add rdx, 0x27
sbb al, r11b
sar rax, cl
sub rcx, r8
cmovbe ax, r9w
cbw
lea rax, [rcx - 8]
cmp rax, 0x1f
jmp 0x180098cf1
ja 0x180098dfd
mov rcx, r8
call fcn.180089d00
lea rax, [rsi + rdi]
mov qword [r14], rdi
cmp rbp, 0x16393f16
test r15b, r15b
mov qword [r14 + 8], rax
test r11b, bl
test r12, 0x38c656e1
mov qword [r14 + 0x10], rax
cmp dil, 0xcf
cmp rdi, rax
jmp 0x180098d2e
je 0x180098d4f
nop dword [rax]
mov qword [rdi], rbx
cmp r12, rax
add rdi, 8
cmp rdi, rax
jmp 0x180098d49
jne 0x180098d37
mov rsi, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x58]
xor bpl, cl
add rsp, 0x20
pop r14
setns dil
pop rdi
pop rbp
jmp 0x180098d6d
ret
xor edi, edi
movsxd rcx, eax
mov rcx, r8
stc
clc
sub rcx, rax
add rcx, 7
test r14b, 0xff
cmp ah, 0x9d
shr rcx, 3
cmp r8b, 0x2f
clc
test r12w, r9w
cmp rax, r8
jmp 0x180098d9b
cmova rcx, rdi
cmc
cmp rdi, 0x5fe40a08
test rcx, rcx
jmp 0x180098daf
je 0x180098d54
mov rdi, rax
mov rax, rbx
setle bpl
movsx rbx, bx
mov rbx, qword [rsp + 0x58]
not bpl
movzx r14w, spl
rep stosq qword [rdi], rax
bts r14d, ecx
shl bpl, cl
sal r14b, cl
add rsp, 0x20
bswap r14d
pop r14
movzx bp, r11b
pop rdi
pop rbp
jmp 0x180098df2
ret
call fcn.1800919de
jmp 0x18000b1a7
call fcn.180121611
int3
Function at 0x1800bc836
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 0x18], rbx
neg rbx
cmovp ebx, ebx
push rbp
adc al, r8b
movzx bx, dil
push rsi
push rdi
push r14
cwde
push r15
rcl al, 0xfc
rol ah, 0xf7
xor al, 0xa3
sub rsp, 0x20
cwde
mov r15, rdx
mov rbx, rcx
rcl ah, 0xe5
mov eax, dword [rcx + 0xc]
cmp cl, r11b
test r15w, r12w
mov ecx, dword [rcx + 8]
test r14b, r10b
cmp ecx, eax
jmp 0x1800bc87e
jne 0x1800bc9ac
test eax, eax
lea r14d, [rax + rax]
jg 0x1800bc89c
mov r14d, 4
and al, r10b
xor cl, r13b
movsxd rdi, r14d
movzx eax, r8w
mov qword [rsp + 0x50], rdi
and dl, 0xbe
mov eax, 0x18
mul rdi
movzx ecx, ax
mov rcx, 0xffffffffffffffff
jmp 0x1800bc8c2
cmovo rax, rcx
jmp 0x1800bc8cb
mov rcx, rax
jmp 0x1800bc8d3
call fcn.180086d98
mov rbp, rax
movsx rsi, ax
sal si, 0x99
mov qword [rsp + 0x58], rax
bt si, 0x67
mov rsi, rax
cmc
test r14d, r14d
jmp 0x1800bc8f9
je 0x1800bc925
mov rcx, rsi
jmp 0x1800bc907
call fcn.18008353c
add rsi, 0x18
stc
test di, 0x2e
cmp dx, 0x6503
sub rdi, 1
jne 0x1800bc8ff
sub edx, edx
test r9w, 0x1e9d
test ecx, r9d
cmp dword [rbx + 8], edx
jle 0x1800bc989
mov ecx, edx
movzx eax, bx
mov rax, qword [rbx]
jmp 0x1800bc946
movups xmm0, xmmword [rcx + rax]
jmp 0x1800bc94f
movups xmmword [rcx + rbp], xmm0
movsd xmm1, qword [rcx + rax + 0x10]
jmp 0x1800bc95e
movsd qword [rcx + rbp + 0x10], xmm1
jmp 0x1800bc969
inc edx
test r10b, sil
cmp r9b, 0x31
jmp 0x1800bc977
lea rcx, [rcx + 0x18]
cmp edx, dword [rbx + 8]
jmp 0x1800bc983
jl 0x1800bc93e
mov rcx, qword [rbx]
jmp 0x1800bc991
call fcn.180089d00
mov qword [rbx], rbp
mov dword [rbx + 0xc], r14d
lahf
mov ecx, dword [rbx + 8]
bswap bp
setbe ah
jmp 0x1800bc9ac
movsxd rax, ecx
movzx rdi, r10w
dec rcx
lea rcx, [rax + rax*2]
movzx rbp, r12w
lahf
cmovbe ebp, edi
mov rax, qword [rbx]
movsx rsi, r12w
bswap r14w
movups xmm0, xmmword [r15]
cmovnp di, r12w
movsx ebp, cx
movups xmmword [rax + rcx*8], xmm0
cmovbe esi, r12d
movsx rsi, r10w
movsd xmm1, qword [r15 + 0x10]
movsd qword [rax + rcx*8 + 0x10], xmm1
movzx ebp, cx
inc dword [rbx + 8]
shr esi, cl
mov rbx, qword [rsp + 0x60]
add rsp, 0x20
pop r15
xchg ebp, r14d
pop r14
cmovns si, r8w
movsx rsi, ax
movzx bp, al
pop rdi
pop rsi
bswap bp
not ebp
pop rbp
jmp 0x1800bca23
ret
Function at 0x1800c0a2d
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 0x18], rbx
shrd ax, r12w, 0x99
rcl ax, 0x26
sub al, 0x33
mov qword [rsp + 0x20], rbp
bt ax, sp
movsxd rax, ebp
mov qword [rsp + 8], rcx
movzx ecx, cx
btc cx, 0xfa
test dil, r10b
push rsi
bswap ecx
push rdi
and cl, bpl
push r14
rcr ax, cl
movzx eax, sp
sub rsp, 0x20
shld r14, rax, 0x26
xor r14w, 0x4cc2
dec r14b
mov r14, rdx
shrd ax, r14w, 0x62
movzx ax, r11b
or eax, 0x211c3f22
mov ecx, dword [0x18007c048]
cwde
jmp 0x1800c0a9d
mov eax, dword [0x18007c04c]
cmp al, r10b
jmp 0x1800c0aab
cmp ecx, eax
jmp 0x1800c0ab2
jne 0x1800c0c2f
test eax, eax
jmp 0x1800c0abf
lea ebp, [rax + rax]
jmp 0x1800c0ac7
jg 0x1800c0ad7
mov ebp, 4
neg edx
sal ah, 0x23
movsxd rbx, ebp
cmovbe eax, r13d
mov qword [rsp + 0x40], rbx
sar ax, cl
or ax, r9w
mov eax, 0x38
dec dh
cmovns rcx, rdi
mul rbx
movsxd rcx, r15d
cmovns rcx, r12
xchg cx, cx
mov rcx, 0xffffffffffffffff
jmp 0x1800c0b0e
cmovo rax, rcx
setb cl
bswap ecx
mov rcx, rax
call fcn.180086d98
mov rsi, rax
mov qword [rsp + 0x48], rax
test r8w, 0x5ed8
shrd di, dx, 0x2e
btr rdi, 1
mov rdi, rax
test ebp, ebp
jmp 0x1800c0b41
je 0x1800c0b65
nop dword [rax]
mov rcx, rdi
call fcn.18008452c
add rdi, 0x38
test bx, bx
clc
sub rbx, 1
jne 0x1800c0b4b
xor edx, edx
cmp r8d, 0x2df415c7
cmc
clc
cmp dword [0x18007c048], edx
jle 0x1800c0bfc
mov ecx, edx
mov al, 0x17
nop
jmp 0x1800c0b89
mov rax, qword [0x18007c040]
movups xmm0, xmmword [rcx + rax]
jmp 0x1800c0b99
movups xmmword [rcx + rsi], xmm0
jmp 0x1800c0ba2
movups xmm1, xmmword [rcx + rax + 0x10]
jmp 0x1800c0bac
movups xmmword [rcx + rsi + 0x10], xmm1
jmp 0x1800c0bb6
movups xmm0, xmmword [rcx + rax + 0x20]
jmp 0x1800c0bc0
movups xmmword [rcx + rsi + 0x20], xmm0
jmp 0x1800c0bca
movsd xmm1, qword [rcx + rax + 0x30]
jmp 0x1800c0bd5
movsd qword [rcx + rsi + 0x30], xmm1
jmp 0x1800c0be0
inc edx
lea rcx, [rcx + 0x38]
stc
test r9b, 0xe4
cmp edx, dword [0x18007c048]
jmp 0x1800c0bf6
jl 0x1800c0b89
mov rcx, qword [0x18007c040]
jmp 0x1800c0c08
call fcn.180089d00
mov qword [0x18007c040], rsi
mov dword [0x18007c04c], ebp
movsx cx, r11b
mov ecx, dword [0x18007c048]
jmp 0x1800c0c2a
jmp 0x1800c0c3b
mov rsi, qword [0x18007c040]
test dh, 0xe
and al, 0x19
movsxd rax, ecx
btc rdi, rdx
inc bpl
imul rcx, rax, 0x38
seto bl
movups xmm0, xmmword [r14]
movsxd rbx, r10d
dec bl
movsx rbx, r12w
movups xmmword [rcx + rsi], xmm0
movzx rbx, cx
movups xmm1, xmmword [r14 + 0x10]
movups xmmword [rcx + rsi + 0x10], xmm1
setb dil
movzx bp, bpl
movsx rdi, ax
movups xmm0, xmmword [r14 + 0x20]
not bp
movups xmmword [rcx + rsi + 0x20], xmm0
mov dil, r11b
movsx rdi, ax
not dil
movsd xmm1, qword [r14 + 0x30]
inc ebx
setnp r14b
movsd qword [rcx + rsi + 0x30], xmm1
not esi
movzx r14w, r8b
inc dword [0x18007c048]
mov rbx, qword [rsp + 0x50]
btc r14w, 0x48
rcl ebp, 0x66
bsr di, ax
mov rbp, qword [rsp + 0x58]
btr r14, rsi
bt di, r11w
add rsp, 0x20
not r14b
movsxd rsi, ecx
mov sil, cl
pop r14
jmp 0x1800c0ce5
pop rdi
pop rsi
jmp 0x1800c0cec
ret