joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1801c2bc0
Capabilities:
Check for time delay via gettickcount

Disassembly:
push rdi
sub rsp, 0x1b0
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x1c8], rbx
mov rax, qword [0x18036d060]
xor rax, rsp
mov qword [rsp + 0x1a0], rax
mov rbx, rcx
call sub.KERNEL32.dll_GetTickCount
mov ecx, dword [rbx + 0x18]
cmp eax, ecx
jb 0x1801c2c49
cmp eax, dword [rbx + 0x28]
jb 0x1801c2c49
sub eax, ecx
mov ecx, eax
je 0x1801c2ccc
mov r8, qword [rbx + 8]
mov eax, 1
add r8, rcx
cmove r8, rax
mov r9, qword [rbx + 0x20]
add r9, qword [rbx + 0x10]
imul rax, r9, 0x3e8
cqo
idiv r8
mov ecx, 0xffffffff
cmp rax, rcx
jg 0x1801c2ccc
mov qword [rbx + 0x30], r9
mov qword [rbx + 0x38], rax
jmp 0x1801c2ccc
xor edx, edx
mov r8d, 0x170
lea rcx, [rsp + 0x30]
call fcn.180211600
lea rcx, [rsp + 0x30]
call fcn.1800deb00
nop
cmp byte [rsp + 0x197], 0
je 0x1801c2ca1
mov eax, dword [rbx + 0x44]
cmp eax, 1
jne 0x1801c2c81
lea rdx, str.resetSendPerfMon
jmp 0x1801c2c94
cmp eax, 2
lea rdx, str.resetReceivePerfMon
je 0x1801c2c94
lea rdx, str.resetPerformanceMon
mov rax, qword [rsp + 0x30]
lea rcx, [rsp + 0x30]
call qword [rax + 0x30]
xor edi, edi
mov dword [rbx + 0x28], edi
mov qword [rbx + 0x20], rdi
call sub.KERNEL32.dll_GetTickCount
mov dword [rbx + 0x18], eax
mov qword [rbx + 8], rdi
mov qword [rbx + 0x10], rdi
mov qword [rbx + 0x30], rdi
mov qword [rbx + 0x38], rdi
lea rcx, [rsp + 0x30]
call fcn.1800deb30
mov rcx, qword [rsp + 0x1a0]
xor rcx, rsp
call fcn.18007b140
mov rbx, qword [rsp + 0x1c8]
add rsp, 0x1b0
pop rdi
ret
Function at 0x1801c66e0
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rbp
push rdi
sub rsp, 0x20
lea rcx, [r9 + 0x50]
mov rbp, r9
mov rbx, r8
call fcn.1800be430
test eax, eax
jne 0x1801c6711
xor edx, edx
lea r8d, [rax + 0x10]
lea rcx, [rbp + 0x50]
call fcn.1800bb330
mov dword [rbp + 0x48], reloc.WS2_32.dll_inet_ntoa
cmp dword [rbx + 0x54c], 0
je 0x1801c6726
lea rdx, str.Not_in_IV_mode.
jmp 0x1801c6930
mov ecx, dword [rbx + 0x550]
cmp ecx, 0xf
ja 0x1801c6929
mov edx, dword [rbp + 0x48]
mov qword [rsp + 0x40], rsi
add edx, ecx
mov qword [rsp + 0x48], r12
mov qword [rsp + 0x58], r15
cmp edx, 0xc
jbe 0x1801c6755
or dword [rbx + 0x548], 1
lea rcx, [rbp + 0x50]
call fcn.1800bdfb0
mov r15, qword [rsp + 0x60]
xor r12d, r12d
mov rsi, rax
mov edi, r12d
cmp dword [rbx + 0x550], r12d
jne 0x1801c67dc
test dword [rbp + 0x48], 0xfffffff0
jbe 0x1801c67d7
mov qword [rsp + 0x50], r14
nop dword [rax]
nop word [rax + rax]
mov eax, edi
lea rdx, [rbx + 0x508]
mov r8, r15
mov rcx, qword [rax + rsi]
lea eax, [rdi + 8]
xor qword [rbx + 0x508], rcx
mov rcx, rbx
mov rax, qword [rax + rsi]
xor qword [rbx + 0x510], rax
call fcn.1801c8210
sub qword [rbx + 0x558], 0xffffffffffffff80
add edi, 0x10
mov eax, dword [rbp + 0x48]
and eax, 0xfffffff0
cmp edi, eax
jb 0x1801c6790
mov r14, qword [rsp + 0x50]
mov eax, edi
add rsi, rax
cmp edi, dword [rbp + 0x48]
jae 0x1801c6910
nop word [rax + rax]
movzx eax, byte [rsi]
lea rsi, [rsi + 1]
movsxd rcx, dword [rbx + 0x550]
mov byte [rcx + rbx + 0x538], al
inc dword [rbx + 0x550]
cmp dword [rbx + 0x550], 0x10
jne 0x1801c6905
movzx eax, byte [rbx + 0x538]
lea rdx, [rbx + 0x508]
xor byte [rdx], al
mov r8, r15
movzx eax, byte [rbx + 0x539]
mov rcx, rbx
xor byte [rbx + 0x509], al
movzx eax, byte [rbx + 0x53a]
xor byte [rbx + 0x50a], al
movzx eax, byte [rbx + 0x53b]
xor byte [rbx + 0x50b], al
movzx eax, byte [rbx + 0x53c]
xor byte [rbx + 0x50c], al
movzx eax, byte [rbx + 0x53d]
xor byte [rbx + 0x50d], al
movzx eax, byte [rbx + 0x53e]
xor byte [rbx + 0x50e], al
movzx eax, byte [rbx + 0x53f]
xor byte [rbx + 0x50f], al
movzx eax, byte [rbx + 0x540]
xor byte [rbx + 0x510], al
movzx eax, byte [rbx + 0x541]
xor byte [rbx + 0x511], al
movzx eax, byte [rbx + 0x542]
xor byte [rbx + 0x512], al
movzx eax, byte [rbx + 0x543]
xor byte [rbx + 0x513], al
movzx eax, byte [rbx + 0x544]
xor byte [rbx + 0x514], al
movzx eax, byte [rbx + 0x545]
xor byte [rbx + 0x515], al
movzx eax, byte [rbx + 0x546]
xor byte [rbx + 0x516], al
movzx eax, byte [rbx + 0x547]
xor byte [rbx + 0x517], al
call fcn.1801c8210
sub qword [rbx + 0x558], 0xffffffffffffff80
mov dword [rbx + 0x550], r12d
inc edi
cmp edi, dword [rbp + 0x48]
jb 0x1801c67f0
mov r15, qword [rsp + 0x58]
mov al, 1
mov r12, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
pop rbp
pop rbx
ret
lea rdx, str.buflen_error.
mov rcx, qword [rsp + 0x60]
mov rax, qword [rcx]
call qword [rax + 0x28]
xor al, al
add rsp, 0x20
pop rdi
pop rbp
pop rbx
ret
Function at 0x1801c7fc0
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
sub rsp, 0x40
mov rax, qword [0x18036d060]
xor rax, rsp
mov qword [rsp + 0x30], rax
mov rax, qword [rcx]
lea rdx, [rsp + 0x20]
mov rbx, r8
xorps xmm0, xmm0
add r8, 0x4f8
movups xmmword [rsp + 0x20], xmm0
call qword [rax + 0x20]
xor edi, edi
xorps xmm0, xmm0
movups xmmword [rbx + 0x538], xmm0
mov esi, edi
xorps xmm1, xmm1
movups xmmword [rbx + 0x508], xmm1
mov qword [rbx + 0x548], rdi
mov dword [rbx + 0x550], edi
mov qword [rbx + 0x558], rdi
mov qword [rbx + 0x560], rdi
movups xmmword [rsp + 0x20], xmm0
mov r8, qword [rbx + 0x568]
lea rdx, [rsp + 0x20]
add r8, 8
mov byte [rsp + 0x20], dil
add r8, rsi
lea rcx, [rbx + 0x4f8]
call fcn.1801c6fd0
inc edi
add rsi, 0x10
cmp edi, 0x100
jl 0x1801c8030
mov eax, 0x1000
lea r11, [0x1802c8f20]
nop
mov r10d, 0x100
nop word [rax + rax]
mov rdx, qword [rbx + 0x568]
movzx ecx, byte [rdx + rax - 0xfea]
movzx r9d, byte [rdx + rax - 0xfe9]
mov byte [rdx + rax + 0x17], cl
mov rdx, qword [rbx + 0x568]
movzx ecx, byte [rdx + rax - 0xfeb]
mov byte [rdx + rax + 0x16], cl
mov rdx, qword [rbx + 0x568]
movzx ecx, byte [rdx + rax - 0xfec]
mov byte [rdx + rax + 0x15], cl
mov rdx, qword [rbx + 0x568]
movzx ecx, byte [rdx + rax - 0xfed]
mov byte [rdx + rax + 0x14], cl
mov rdx, qword [rbx + 0x568]
movzx ecx, byte [rdx + rax - 0xfee]
mov byte [rdx + rax + 0x13], cl
mov rdx, qword [rbx + 0x568]
movzx ecx, byte [rdx + rax - 0xfef]
mov byte [rdx + rax + 0x12], cl
mov rdx, qword [rbx + 0x568]
movzx ecx, byte [rdx + rax - 0xff0]
mov byte [rdx + rax + 0x11], cl
mov rdx, qword [rbx + 0x568]
movzx ecx, byte [rdx + rax - 0xff1]
mov byte [rdx + rax + 0x10], cl
mov rdx, qword [rbx + 0x568]
movzx ecx, byte [rdx + rax - 0xff2]
mov byte [rdx + rax + 0xf], cl
mov rdx, qword [rbx + 0x568]
movzx ecx, byte [rdx + rax - 0xff3]
mov byte [rdx + rax + 0xe], cl
mov rdx, qword [rbx + 0x568]
movzx ecx, byte [rdx + rax - 0xff4]
mov byte [rdx + rax + 0xd], cl
mov rdx, qword [rbx + 0x568]
movzx ecx, byte [rdx + rax - 0xff5]
mov byte [rdx + rax + 0xc], cl
mov rdx, qword [rbx + 0x568]
movzx ecx, byte [rdx + rax - 0xff6]
mov byte [rdx + rax + 0xb], cl
mov rdx, qword [rbx + 0x568]
movzx ecx, byte [rdx + rax - 0xff7]
mov byte [rdx + rax + 0xa], cl
mov rdx, qword [rbx + 0x568]
movzx ecx, byte [rdx + rax - 0xff8]
mov byte [rdx + rax + 9], cl
lea ecx, [r9 + r9]
mov rdx, qword [rbx + 0x568]
movzx ecx, byte [rcx + r11]
mov byte [rdx + rax + 8], cl
lea ecx, [r9 + r9]
mov r8, qword [rbx + 0x568]
movzx ecx, byte [rcx + r11 + 1]
xor byte [r8 + rax + 9], cl
add rax, 0x10
sub r10, 1
jne 0x1801c8080
cmp rax, 0x10000
jl 0x1801c8070
mov al, 1
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.18007b140
mov rbx, qword [rsp + 0x68]
add rsp, 0x40
pop rdi
pop rsi
pop rbp
ret
Function at 0x1801ced80
Capabilities:
Encode data using xor

Disassembly:
mov r9, rdx
movzx r10d, r8b
not r10d
lea rdx, [rcx + 0x7c]
inc r10d
lea rax, [r9 + 0x7c]
movd xmm2, r10d
pshufd xmm2, xmm2, 0
cmp rcx, rax
ja 0x1801cedd7
cmp rdx, r9
jb 0x1801cedd7
sub r9, rcx
mov r8d, 0x20
nop dword [rax]
nop word [rax + rax]
mov edx, dword [rcx + r9]
xor edx, dword [rcx]
lea rcx, [rcx + 4]
and edx, r10d
xor dword [rcx - 4], edx
sub r8, 1
jne 0x1801cedc0
ret
lea rax, [rcx + 0x10]
sub r9, rcx
mov ecx, 4
nop dword [rax]
nop word [rax + rax]
movdqu xmm0, xmmword [rax - 0x10]
movdqu xmm1, xmmword [r9 + rax - 0x10]
lea rax, [rax + 0x20]
pxor xmm1, xmm0
pand xmm1, xmm2
pxor xmm1, xmm0
movdqu xmmword [rax - 0x30], xmm1
movdqu xmm0, xmmword [rax - 0x20]
movdqu xmm1, xmmword [r9 + rax - 0x20]
pxor xmm1, xmm0
pand xmm1, xmm2
pxor xmm1, xmm0
movdqu xmmword [rax - 0x20], xmm1
sub rcx, 1
jne 0x1801cedf0
ret
Function at 0x1801d7330
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rdi
mov r11, rdx
mov edi, r9d
mov r9d, dword [rsp + 0x30]
xor edx, edx
mov eax, r9d
mov rbx, r8
shr eax, 8
mov r8d, edi
movzx r10d, al
movzx eax, r9b
shl eax, 8
or r10d, eax
mov qword [r11 + 0x30], rdx
shl r10d, 8
mov eax, r9d
shr eax, 0x10
movzx ecx, al
or r10d, ecx
shr r9d, 0x18
shl r10d, 8
mov rcx, r11
or r10d, r9d
mov dword [r11 + 0x38], edx
mov qword [r11 + 0xb8], rdx
mov rdx, rbx
mov dword [r11 + 0x3c], r10d
mov dword [r11 + 0xc0], r10d
mov dword [r11 + 0x40], 0x40
mov dword [r11 + 0xc4], 0x40
mov dword [r11 + 0xb4], 1
mov rbx, qword [rsp + 0x10]
pop rdi
jmp fcn.1801d6f40
Function at 0x1801d73d0
Capabilities:
Encrypt data using salsa20 or chacha

Disassembly:
mov r10, rcx
mov r9, qword [str.expand_32_byte_k]
movzx eax, byte [r9 + 2]
movzx r8d, byte [r9 + 3]
shl r8d, 8
or r8d, eax
movzx eax, byte [r9 + 1]
shl r8d, 8
or r8d, eax
movzx eax, byte [r9]
shl r8d, 8
or r8d, eax
mov dword [rcx], r8d
movzx eax, byte [r9 + 6]
movzx ecx, byte [r9 + 7]
shl ecx, 8
or ecx, eax
movzx eax, byte [r9 + 5]
shl ecx, 8
or ecx, eax
movzx eax, byte [r9 + 4]
shl ecx, 8
or ecx, eax
mov dword [r10 + 4], ecx
movzx eax, byte [r9 + 0xa]
movzx ecx, byte [r9 + 0xb]
shl ecx, 8
or ecx, eax
movzx eax, byte [r9 + 9]
shl ecx, 8
or ecx, eax
movzx eax, byte [r9 + 8]
shl ecx, 8
or ecx, eax
mov dword [r10 + 8], ecx
movzx eax, byte [r9 + 0xe]
movzx ecx, byte [r9 + 0xf]
shl ecx, 8
or ecx, eax
movzx eax, byte [r9 + 0xd]
shl ecx, 8
or ecx, eax
movzx eax, byte [r9 + 0xc]
shl ecx, 8
or ecx, eax
mov dword [r10 + 0xc], ecx
movzx eax, byte [rdx + 2]
movzx ecx, byte [rdx + 3]
shl ecx, 8
or ecx, eax
movzx eax, byte [rdx + 1]
shl ecx, 8
or ecx, eax
movzx eax, byte [rdx]
shl ecx, 8
or ecx, eax
mov dword [r10 + 0x10], ecx
movzx eax, byte [rdx + 6]
movzx ecx, byte [rdx + 7]
shl ecx, 8
or ecx, eax
movzx eax, byte [rdx + 5]
shl ecx, 8
or ecx, eax
movzx eax, byte [rdx + 4]
shl ecx, 8
or ecx, eax
mov dword [r10 + 0x14], ecx
movzx eax, byte [rdx + 0xa]
movzx ecx, byte [rdx + 0xb]
shl ecx, 8
or ecx, eax
movzx eax, byte [rdx + 9]
shl ecx, 8
or ecx, eax
movzx eax, byte [rdx + 8]
shl ecx, 8
or ecx, eax
mov dword [r10 + 0x18], ecx
movzx ecx, byte [rdx + 0xf]
shl ecx, 8
movzx eax, byte [rdx + 0xe]
or ecx, eax
movzx eax, byte [rdx + 0xd]
shl ecx, 8
or ecx, eax
movzx eax, byte [rdx + 0xc]
shl ecx, 8
or ecx, eax
mov dword [r10 + 0x1c], ecx
movzx eax, byte [rdx + 0x12]
movzx ecx, byte [rdx + 0x13]
shl ecx, 8
or ecx, eax
movzx eax, byte [rdx + 0x11]
shl ecx, 8
or ecx, eax
movzx eax, byte [rdx + 0x10]
shl ecx, 8
or ecx, eax
mov dword [r10 + 0x20], ecx
movzx eax, byte [rdx + 0x16]
movzx ecx, byte [rdx + 0x17]
shl ecx, 8
or ecx, eax
movzx eax, byte [rdx + 0x15]
shl ecx, 8
or ecx, eax
movzx eax, byte [rdx + 0x14]
shl ecx, 8
or ecx, eax
mov dword [r10 + 0x24], ecx
movzx eax, byte [rdx + 0x1a]
movzx ecx, byte [rdx + 0x1b]
shl ecx, 8
or ecx, eax
movzx eax, byte [rdx + 0x19]
shl ecx, 8
or ecx, eax
movzx eax, byte [rdx + 0x18]
shl ecx, 8
or ecx, eax
mov dword [r10 + 0x28], ecx
movzx eax, byte [rdx + 0x1e]
movzx ecx, byte [rdx + 0x1f]
shl ecx, 8
or ecx, eax
movzx eax, byte [rdx + 0x1d]
shl ecx, 8
or ecx, eax
movzx eax, byte [rdx + 0x1c]
shl ecx, 8
or ecx, eax
mov dword [r10 + 0x40], 0x40
mov dword [r10 + 0x2c], ecx
ret
Function at 0x1801e0a20
Capabilities:
Check for time delay via gettickcount

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r14
sub rsp, 0x50
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov rax, qword [0x18036d060]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov rsi, r9
movzx ebp, r8b
mov rbx, rdx
mov r14, rcx
mov rdi, qword [rsp + 0xa0]
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rsp + 0x28], xmm0
mov qword [rsp + 0x38], rax
movzx r9d, byte [rdx + 0x38]
lea r8, str.readExpectedMessage
mov rdx, rdi
lea rcx, [rsp + 0x28]
call fcn.180105ba0
nop
cmp byte [rbx + 0x38], 0
je 0x1801e0a9e
cmp qword [rbx + 0x40], 0
jne 0x1801e0a9e
mov rax, qword [rdi]
lea rdx, str.No_m_pHandler.
mov rcx, rdi
call qword [rax + 0x28]
mov dword [rbx + 0x50], 0
cmp dword [rbx + 8], 0
jne 0x1801e0ab3
call sub.KERNEL32.dll_GetTickCount
mov dword [rbx + 8], eax
mov eax, dword [rbx + 0x14]
cmp eax, 5
jne 0x1801e0ae8
cmp dword [0x180389f38], 0xa
jge 0x1801e0ada
mov rax, qword [rdi]
lea rdx, str.sshRp.m_totalTimeoutMs_wf_is_too_small__2_
mov rcx, rdi
call qword [rax + 0x28]
inc dword [0x180389f38]
mov dword [rbx + 0x14], 0x7530
mov eax, 0x7530
jmp 0x1801e0aec
test eax, eax
je 0x1801e0b1e
cmp dword [rbx + 8], 0
jne 0x1801e0afd
call sub.KERNEL32.dll_GetTickCount
mov dword [rbx + 8], eax
mov eax, dword [rbx + 0x14]
cmp eax, 0x3e8
jae 0x1801e0b0b
mov dword [rbx + 0x14], 0x7530
call sub.KERNEL32.dll_GetTickCount
mov ecx, dword [rbx + 8]
cmp eax, ecx
jbe 0x1801e0b1e
sub eax, ecx
cmp eax, dword [rbx + 0x14]
ja 0x1801e0b52
mov r9, rdi
mov r8, rsi
mov rdx, rbx
mov rcx, r14
call fcn.1801e7260
test al, al
je 0x1801e0b8a
mov rcx, rsi
call fcn.180175ac0
test al, al
jne 0x1801e0b8a
test bpl, bpl
je 0x1801e0b4e
cmp dword [rbx + 0x50], 0x5d
je 0x1801e0ab3
mov bl, 1
jmp 0x1801e0b8c
mov rcx, rsi
call fcn.180175b40
mov byte [rsi + 0x28], 1
cmp byte [rdi + 0x161], 0
je 0x1801e0b8a
mov rax, qword [rdi]
lea rdx, str.Too_much_time_elapsed_waiting_for_response.
mov rcx, rdi
call qword [rax + 0x28]
mov r8d, dword [rbx + 0x14]
lea rdx, str.totalTimeoutMs
mov rcx, rdi
call fcn.180106220
xor bl, bl
lea rcx, [rsp + 0x28]
call fcn.180105c80
movzx eax, bl
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.18007b140
add rsp, 0x50
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x1801e7820
Capabilities:
Check for time delay via gettickcount

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov eax, dword [rdx + 0x14]
mov rdi, r8
mov rbx, rdx
test eax, eax
je 0x1801e7882
cmp dword [rdx + 8], 0
jne 0x1801e7848
call sub.KERNEL32.dll_GetTickCount
mov dword [rbx + 8], eax
mov eax, dword [rbx + 0x14]
cmp eax, 0x3e8
jae 0x1801e7856
mov dword [rbx + 0x14], 0x7530
call sub.KERNEL32.dll_GetTickCount
mov ecx, dword [rbx + 8]
cmp eax, ecx
jbe 0x1801e7882
sub eax, ecx
cmp eax, dword [rbx + 0x14]
jbe 0x1801e7882
mov rcx, rdi
call fcn.180175b40
mov al, 1
mov byte [rdi + 0x28], 1
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
mov rbx, qword [rsp + 0x30]
xor al, al
add rsp, 0x20
pop rdi
ret
Function at 0x1801f8c50
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r14
sub rsp, 0x20
mov ebx, pe_nt_image_headers64
mov r14d, r9d
mov edi, r8d
mov r12, rdx
mov rsi, rcx
cmp r8d, ebx
jbe 0x1801f8c82
mov edi, ebx
jmp 0x1801f8c8c
mov eax, 1
cmp edi, eax
cmovb edi, eax
mov qword [rsp + 0x40], r15
mov r15d, 0x400
test r14d, r14d
jne 0x1801f8ca1
mov r14d, r15d
jmp 0x1801f8ca8
cmp r14d, r15d
cmova r14d, r15d
mov edx, edi
mov rcx, r12
call fcn.1800bdb80
mov rcx, r12
mov ebp, edi
call fcn.1800bdfb0
cmp edi, ebx
jbe 0x1801f8cc7
xor al, al
jmp 0x1801f8de8
test r14d, r14d
mov r8d, edi
lea r12, [rsi + 0xb0]
mov rdx, rax
cmove r14d, r15d
mov rcx, r12
mov r15d, edi
call fcn.180210e90
lea r11, [0x1802f3c20]
cmp edi, ebx
jae 0x1801f8d2a
lea eax, [rdi - 1]
movzx r8d, byte [rax + rsi + 0xb0]
lea rdx, [r15 + r12]
mov eax, ebp
lea rdx, [rdx + 1]
sub eax, edi
inc ebp
movzx ecx, byte [rax + rsi + 0xb0]
movzx eax, r8b
add rcx, rax
movzx eax, cl
movzx r8d, byte [rax + r11]
mov byte [rdx - 1], r8b
cmp ebp, ebx
jb 0x1801f8d01
lea eax, [r14 + 7]
mov r8d, ebx
shr eax, 3
lea r9, [rsi + 0xb0]
sub r8d, eax
neg r14d
mov eax, r8d
movzx ecx, r14b
add r9, rax
and cl, 7
mov edx, 0xff
sar rdx, cl
movzx eax, byte [r9]
and rdx, rax
movzx r10d, byte [rdx + r11]
mov byte [r9], r10b
test r8d, r8d
je 0x1801f8d94
nop word [rax + rax]
movzx eax, r10b
lea ebx, [rbx - 1]
movzx ecx, byte [rbx + rsi + 0xb0]
lea r9, [r9 - 1]
xor rcx, rax
movzx r10d, byte [rcx + r11]
mov byte [r9], r10b
add r8d, 0xffffffff
jne 0x1801f8d70
mov r9d, 0x3f
lea r10, [rsi + 0x12e]
mov r11d, 0x100
nop word [rax + rax]
lea r8d, [r9 + r9]
movzx ecx, r11w
lea eax, [r8 + 1]
movzx edx, byte [rax + rsi + 0xb0]
lea r10, [r10 - 2]
imul edx, ecx
mov eax, r9d
movzx ecx, byte [r8 + rsi + 0xb0]
dec r9d
add dx, cx
mov word [r10 + 2], dx
test eax, eax
jne 0x1801f8db0
mov al, 1
mov r15, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x48]
mov rbp, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x20
pop r14
pop r12
pop rdi
ret

Function at 0x1801f9960
Capabilities:
Encode data using add xor sub operations
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
mov r10d, dword [rdx + 0x458]
mov rbx, r8
mov r11d, dword [rdx + 0x45c]
movsxd rdi, r9d
test r9d, r9d
jle 0x1801f99cf
nop dword [rax]
nop word [rax + rax]
inc r10b
lea rbx, [rbx + 1]
movzx r10d, r10b
mov r9d, dword [rdx + r10*4 + 0x58]
lea r8, [rdx + r10*4]
lea eax, [r11 + r9]
movzx r11d, al
mov ecx, dword [rdx + r11*4 + 0x58]
mov dword [r8 + 0x58], ecx
mov dword [rdx + r11*4 + 0x58], r9d
add r9b, cl
movzx eax, r9b
movzx ecx, byte [rdx + rax*4 + 0x58]
xor byte [rbx - 1], cl
sub rdi, 1
jne 0x1801f9990
mov rbx, qword [rsp + 8]
mov rdi, qword [rsp + 0x10]
mov dword [rdx + 0x45c], r11d
mov dword [rdx + 0x458], r10d
ret
Function at 0x1801fa030
Capabilities:
Encrypt data using salsa20 or chacha
Enumerate pe sections

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov rdi, r8
mov rbx, rdx
test r8, r8
je 0x1801fa237
lea rcx, [rdx + 0x18]
call fcn.1800be430
cmp eax, 0x20
jne 0x1801fa237
lea rbp, [rbx + 0x50]
mov rcx, rbp
call fcn.1800be430
cmp eax, 0xc
jb 0x1801fa237
lea rcx, [rbx + 0x18]
call fcn.1800bdfb0
mov rcx, rbp
mov rbx, rax
call fcn.1800bdfb0
mov dword [rdi], 0x61707865
mov r8, rax
mov dword [rdi + 4], 0x3320646e
mov dword [rdi + 8], 0x79622d32
mov dword [rdi + 0xc], 0x6b206574
movzx ecx, byte [rbx + 2]
movzx eax, byte [rbx]
movzx edx, byte [rbx + 3]
shl edx, 8
or edx, ecx
movzx ecx, byte [rbx + 1]
shl edx, 8
or edx, ecx
shl edx, 8
or edx, eax
mov dword [rdi + 0x10], edx
movzx eax, byte [rbx + 6]
movzx ecx, byte [rbx + 7]
shl ecx, 8
or ecx, eax
movzx eax, byte [rbx + 5]
shl ecx, 8
or ecx, eax
movzx eax, byte [rbx + 4]
shl ecx, 8
or ecx, eax
mov dword [rdi + 0x14], ecx
movzx eax, byte [rbx + 0xa]
movzx ecx, byte [rbx + 0xb]
shl ecx, 8
or ecx, eax
movzx eax, byte [rbx + 9]
shl ecx, 8
or ecx, eax
movzx eax, byte [rbx + 8]
shl ecx, 8
or ecx, eax
mov dword [rdi + 0x18], ecx
movzx eax, byte [rbx + 0xe]
movzx ecx, byte [rbx + 0xf]
shl ecx, 8
or ecx, eax
movzx eax, byte [rbx + 0xd]
shl ecx, 8
or ecx, eax
movzx eax, byte [rbx + 0xc]
shl ecx, 8
or ecx, eax
mov dword [rdi + 0x1c], ecx
movzx eax, byte [rbx + 0x12]
movzx ecx, byte [rbx + 0x13]
shl ecx, 8
or ecx, eax
movzx eax, byte [rbx + 0x11]
shl ecx, 8
or ecx, eax
movzx eax, byte [rbx + 0x10]
shl ecx, 8
or ecx, eax
mov dword [rdi + 0x20], ecx
movzx eax, byte [rbx + 0x16]
movzx ecx, byte [rbx + 0x17]
shl ecx, 8
or ecx, eax
movzx eax, byte [rbx + 0x15]
shl ecx, 8
or ecx, eax
movzx eax, byte [rbx + 0x14]
shl ecx, 8
or ecx, eax
mov dword [rdi + 0x24], ecx
movzx ecx, byte [rbx + 0x1b]
movzx eax, byte [rbx + 0x1a]
shl ecx, 8
or ecx, eax
shl ecx, 8
movzx eax, byte [rbx + 0x19]
or ecx, eax
movzx eax, byte [rbx + 0x18]
shl ecx, 8
or ecx, eax
mov dword [rdi + 0x28], ecx
movzx eax, byte [rbx + 0x1e]
movzx ecx, byte [rbx + 0x1f]
shl ecx, 8
or ecx, eax
movzx eax, byte [rbx + 0x1d]
shl ecx, 8
or ecx, eax
movzx eax, byte [rbx + 0x1c]
shl ecx, 8
or ecx, eax
mov dword [rdi + 0x30], 0
mov dword [rdi + 0x2c], ecx
movzx eax, byte [r8 + 2]
movzx ecx, byte [r8 + 3]
shl ecx, 8
or ecx, eax
movzx eax, byte [r8 + 1]
shl ecx, 8
or ecx, eax
movzx eax, byte [r8]
shl ecx, 8
or ecx, eax
mov dword [rdi + 0x34], ecx
movzx eax, byte [r8 + 6]
movzx ecx, byte [r8 + 7]
shl ecx, 8
or ecx, eax
movzx eax, byte [r8 + 5]
shl ecx, 8
or ecx, eax
movzx eax, byte [r8 + 4]
shl ecx, 8
or ecx, eax
mov dword [rdi + 0x38], ecx
movzx eax, byte [r8 + 0xa]
movzx ecx, byte [r8 + 0xb]
shl ecx, 8
or ecx, eax
movzx eax, byte [r8 + 9]
shl ecx, 8
or ecx, eax
movzx eax, byte [r8 + 8]
shl ecx, 8
or ecx, eax
mov al, 1
mov dword [rdi + 0x3c], ecx
jmp 0x1801fa239
xor al, al
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x1801fc7a0
Capabilities:
Compute adler32 checksum

Disassembly:
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov eax, dword [rcx + 0x28]
mov rbp, rdx
cmp eax, r8d
mov esi, eax
mov rdi, rcx
cmova esi, r8d
test esi, esi
jne 0x1801fc7d7
xor eax, eax
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
sub eax, esi
mov qword [rsp + 0x30], rbx
cmp byte [rcx + 0x18], 0
mov dword [rcx + 0x28], eax
je 0x1801fc94b
mov r9, qword [rcx + 0x20]
mov r11d, esi
mov r8d, dword [rcx + 0x1c]
movzx ecx, r8w
shr r8d, 0x10
test r9, r9
jne 0x1801fc80c
lea r8d, [r9 + 1]
jmp 0x1801fc947
test esi, esi
je 0x1801fc940
nop dword [rax]
nop dword [rax + rax]
mov edx, 0x15b0
cmp r11d, edx
cmovb edx, r11d
sub r11d, edx
cmp edx, 0x10
jb 0x1801fc8f0
mov r10d, edx
shr r10, 4
nop
movzx eax, byte [r9]
add edx, 0xfffffff0
add ecx, eax
movzx eax, byte [r9 + 1]
add r8d, ecx
add ecx, eax
movzx eax, byte [r9 + 2]
add r8d, ecx
add ecx, eax
movzx eax, byte [r9 + 3]
add r8d, ecx
add ecx, eax
movzx eax, byte [r9 + 4]
add r8d, ecx
add ecx, eax
movzx eax, byte [r9 + 5]
add r8d, ecx
add ecx, eax
movzx eax, byte [r9 + 6]
add r8d, ecx
add ecx, eax
movzx eax, byte [r9 + 7]
add r8d, ecx
add ecx, eax
movzx eax, byte [r9 + 8]
add r8d, ecx
add ecx, eax
movzx eax, byte [r9 + 9]
add r8d, ecx
add ecx, eax
movzx eax, byte [r9 + 0xa]
add r8d, ecx
add ecx, eax
movzx eax, byte [r9 + 0xb]
add r8d, ecx
add ecx, eax
movzx eax, byte [r9 + 0xc]
add r8d, ecx
add ecx, eax
movzx eax, byte [r9 + 0xd]
add r8d, ecx
add ecx, eax
movzx eax, byte [r9 + 0xe]
add r8d, ecx
add ecx, eax
movzx eax, byte [r9 + 0xf]
add r8d, ecx
add r9, 0x10
add ecx, eax
add r8d, ecx
sub r10, 1
jne 0x1801fc840
test edx, edx
je 0x1801fc911
nop dword [rax]
nop dword [rax + rax]
movzx eax, byte [r9]
inc r9
add ecx, eax
add r8d, ecx
add edx, 0xffffffff
jne 0x1801fc900
mov eax, 0x80078071
mul ecx
shr edx, 0xf
imul eax, edx, 0xffff000f
add ecx, eax
mov eax, 0x80078071
mul r8d
shr edx, 0xf
imul eax, edx, 0xffff000f
add r8d, eax
test r11d, r11d
jne 0x1801fc820
shl r8d, 0x10
or r8d, ecx
mov dword [rdi + 0x1c], r8d
mov rdx, qword [rdi + 0x20]
mov rcx, rbp
mov r8d, esi
mov ebx, esi
call fcn.180210e90
add qword [rdi + 0x20], rbx
mov eax, esi
add dword [rdi + 0x2c], esi
mov rsi, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x1802089b9
Capabilities:
Encrypt data using rc4 prga

Disassembly:
test rcx, rcx
je 0x180208a95
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x100
mov rax, qword [0x18036d060]
xor rax, rsp
mov qword [rsp + 0xf0], rax
movzx eax, byte [rcx]
mov rdi, rdx
mov rbx, rcx
cmp al, 0x3a
je 0x1802089f8
test al, al
je 0x180208a75
movzx eax, byte [rbx + 1]
inc rbx
cmp al, 0x3a
jne 0x1802089e5
mov rcx, rbx
test al, al
je 0x180208a75
movzx eax, byte [rbx + 1]
inc rbx
cmp al, 0x20
jne 0x180208a12
movzx eax, byte [rcx + 2]
lea rbx, [rcx + 2]
xor r8d, r8d
test al, al
je 0x180208a75
xor ecx, ecx
nop dword [rax + rax]
mov byte [rsp + rcx + 0x20], al
inc r8d
inc rcx
cmp al, 0xa
jne 0x180208a3a
movzx eax, byte [rbx + 1]
cmp al, 0x20
je 0x180208a3a
cmp al, 9
jne 0x180208a63
cmp rcx, 0xc8
jne 0x180208a58
mov r8d, ecx
lea rdx, [rsp + 0x20]
mov rcx, rdi
call fcn.1800d3f30
xor r8d, r8d
xor ecx, ecx
movzx eax, byte [rbx + 1]
inc rbx
test al, al
jne 0x180208a20
test r8d, r8d
je 0x180208a75
lea rdx, [rsp + 0x20]
mov rcx, rdi
call fcn.1800d3f30
mov rcx, qword [rsp + 0xf0]
xor rcx, rsp
call fcn.18007b140
mov rbx, qword [rsp + 0x110]
add rsp, 0x100
pop rdi
ret