joyce8/EMBER2024-capa huggingface dataset:
Function at 0x141bcc058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.141bcc1df
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x141bcc089
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x141bcc06f
add dl, dl
jne 0x141bcc096
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x141bcc0f6
xor eax, eax
add dl, dl
jne 0x141bcc0a5
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x141bcc1ad
add dl, dl
jne 0x141bcc0b6
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x141bcc0c3
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x141bcc0d0
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x141bcc0dd
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x141bcc0ea
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x141bcc07e
mov eax, 1
add dl, dl
jne 0x141bcc106
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x141bcc113
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x141bcc0fb
sub eax, ebx
mov ebx, 1
jne 0x141bcc14c
mov ecx, 1
add dl, dl
jne 0x141bcc12e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x141bcc13b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x141bcc123
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x141bcc07e
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x141bcc168
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x141bcc175
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x141bcc15d
cmp eax, 0x7d00
jae 0x141bcc19b
cmp eax, 0x500
jb 0x141bcc196
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x141bcc07e
cmp eax, 0x7f
ja 0x141bcc19e
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x141bcc07e
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x141bcc1d2
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x141bcc07e
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x18000bd70
Capabilities:
Reference sql statements

Disassembly:
mov rax, rsp
push rbp
push r14
push r15
lea rbp, [rax - 0x78]
sub rsp, 0x160
mov qword [rsp + 0x40], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x20], rdi
mov ebx, edx
mov rdi, rcx
mov dword [rsp + 0x20], 0
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x28], xmm0
mov qword [rsp + 0x38], 0
lea rax, [0x1800e55b0]
mov qword [rsp + 0x50], rax
lea rax, [rbp - 0x28]
mov qword [rbp + 0x90], rax
lea r14, [0x1800e5208]
mov qword [rbp - 0x28], r14
lea r15, [0x1800e52d8]
mov qword [rbp - 0x28], r15
mov dword [rsp + 0x20], 1
mov rax, qword [rsp + 0x50]
movsxd rcx, dword [rax + 4]
lea rax, [0x1800e53f0]
mov qword [rsp + rcx + 0x50], rax
mov rax, qword [rsp + 0x50]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0x10]
mov dword [rsp + rcx + 0x4c], edx
mov rax, qword [rsp + 0x50]
movsxd rcx, dword [rax + 4]
lea rax, [rsp + 0x50]
add rcx, rax
xor r8d, r8d
lea rdx, [rsp + 0x58]
call fcn.180008ab0
nop
mov rax, qword [rsp + 0x50]
movsxd rcx, dword [rax + 4]
lea rax, [0x1800e54f0]
mov qword [rsp + rcx + 0x50], rax
mov rax, qword [rsp + 0x50]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0x88]
mov dword [rsp + rcx + 0x4c], edx
mov edx, 2
lea rcx, [rsp + 0x58]
call fcn.18000edd0
nop
mov dword [rbp + 0x80], 0
lea rdx, str.SELECT_COUNT_id__FROM__users__WHERE__hashvalue_
lea rcx, [rsp + 0x50]
call fcn.180008e70
mov rcx, rax
mov edx, ebx
call fcn.18000d7d0
mov rcx, rax
lea rdx, [0x1800e5788]
call fcn.180008e70
lea rax, [rbp + 0x40]
mov qword [rbp + 0x90], rax
lea rdx, [rbp + 0x40]
lea rcx, [rsp + 0x50]
call fcn.18000ce40
nop
lea rcx, [rdi + 8]
lea r8, [rsp + 0x28]
mov rdx, rax
call fcn.18001e940
test al, al
jne 0x18000becb
xor bl, bl
jmp 0x18000bf20
mov rcx, qword [rsp + 0x30]
mov r9, qword [rsp + 0x28]
sub rcx, r9
movabs rax, 0x2aaaaaaaaaaaaaab
imul rcx
sar rdx, 2
mov rax, rdx
shr rax, 0x3f
add rdx, rax
je 0x18000bf16
mov rax, qword [r9 + 8]
sub rax, qword [r9]
sar rax, 6
test rax, rax
je 0x18000bf16
lea r8, [rbp + 0x80]
xor edx, edx
mov rcx, r9
call fcn.18001ee20
cmp dword [rbp + 0x80], 0
seta bl
lea rcx, [rbp - 0x28]
call fcn.18000ce80
lea rax, [rbp - 0x28]
mov qword [rbp + 0x90], rax
mov qword [rbp - 0x28], r15
mov qword [rbp - 0x28], r14
lea rcx, [rbp - 0x28]
call fcn.1800988f4
nop
lea rcx, [rsp + 0x28]
call fcn.18000e970
movzx eax, bl
lea r11, [rsp + 0x160]
mov rbx, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
Function at 0x180016b90
Capabilities:
Reference sql statements

Disassembly:
mov rax, rsp
push rbp
push rsi
push rdi
sub rsp, 0x150
mov qword [rsp + 0x38], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov ebx, r8d
mov ebp, edx
mov rsi, rcx
xor edi, edi
mov dword [rax + 0x10], edi
test edx, edx
je 0x180016cf3
test ebx, ebx
je 0x180016cf3
cmp qword [rcx + 0x88], rdi
jne 0x180016bde
mov rax, qword [rcx]
call qword [rax + 0x10]
test al, al
je 0x180016cf3
mov edx, 2
lea r8d, [rdx - 1]
lea rcx, [rsp + 0x60]
call fcn.18000cf10
nop
sub ebx, 1
je 0x180016c05
cmp ebx, 1
jne 0x180016c2f
lea rdx, str.SELECT__notificationgenerated__FROM__events__WHERE_id
jmp 0x180016c0c
lea rdx, str.SELECT__senttodv__FROM__events__WHERE_id
lea rcx, [rsp + 0x60]
call fcn.180008e70
mov edx, ebp
mov rcx, rax
call fcn.18000d7d0
lea rdx, [0x1800e5788]
mov rcx, rax
call fcn.180008e70
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x20], xmm0
mov qword [rsp + 0x30], rdi
lea rax, [rsp + 0x40]
mov qword [rsp + 0x188], rax
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x60]
call fcn.18000ce40
nop
lea rcx, [rsi + 8]
lea r8, [rsp + 0x20]
mov rdx, rax
call fcn.18001e940
test al, al
je 0x180016c9c
mov rax, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x20]
sub rax, rcx
sub rax, 0x18
cmp rax, 0x18
jae 0x180016c95
lea r8, [rsp + 0x178]
xor edx, edx
call fcn.18001ee20
mov edi, dword [rsp + 0x178]
lea rcx, [rsp + 0x20]
call fcn.18000e970
nop
lea rcx, [rsp + 0xe8]
call fcn.18000ce80
lea rax, [rsp + 0xe8]
mov qword [rsp + 0x188], rax
lea rax, [0x1800e52d8]
mov qword [rsp + 0xe8], rax
lea rax, [0x1800e5208]
mov qword [rsp + 0xe8], rax
lea rcx, [rsp + 0xe8]
call fcn.1800988f4
mov eax, edi
jmp 0x180016cf5
xor eax, eax
mov rbx, qword [rsp + 0x170]
add rsp, 0x150
pop rdi
pop rsi
pop rbp
ret
Function at 0x18001b630
Capabilities:
Terminate thread

Disassembly:
mov qword [rsp + 8], rcx
push rbx
sub rsp, 0x30
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov rbx, rcx
lea rax, [0x1800e6240]
mov qword [rcx], rax
lea rdx, [rcx + 0x30]
mov ecx, 2
call qword [sym.imp.SHELL32.dll_Shell_NotifyIconA]
nop
mov rcx, qword [rbx + 0x20]
test rcx, rcx
je 0x18001b67a
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 0x10]
call qword [sym.imp.USER32.dll_SendMessageA]
nop
xor edx, edx
lea rcx, str.spTrayNotify
call qword [sym.imp.USER32.dll_UnregisterClassA]
nop
mov rcx, qword [rbx + 0x10]
test rcx, rcx
je 0x18001b6a7
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TerminateThread]
nop
mov rcx, qword [rbx + 0x10]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
jmp 0x18001b6ae
lea rcx, [rbx + 0x260]
call fcn.1800026e0
nop
lea rcx, [rbx + 0x240]
call fcn.1800026e0
nop
lea rax, method.std::_Facet_base.virtual_8
mov qword [rbx], rax
add rsp, 0x30
pop rbx
ret

Function at 0x18001b6f0
Capabilities:
Create thread

Disassembly:
push rdi
sub rsp, 0x90
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov qword [rsp + 0xa0], rbx
mov rbx, rcx
cmp byte [rcx + 8], 0
je 0x18001b71a
mov al, 1
jmp 0x18001b817
cmp qword [rcx + 0x10], 0
jne 0x18001b811
cmp qword [rcx + 0x20], 0
jne 0x18001b811
xor edx, edx
lea r8d, [rdx + 0x50]
lea rcx, [rsp + 0x40]
call fcn.18009c1f0
mov dword [rsp + 0x40], 0x50
lea rax, str.spTrayNotify
mov qword [rsp + 0x80], rax
lea rax, [0x18001bb60]
mov qword [rsp + 0x48], rax
lea rcx, [rsp + 0x40]
call qword [sym.imp.USER32.dll_RegisterClassExA]
test ax, ax
je 0x18001b817
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 1]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventA]
mov qword [rbx + 0x18], rax
test rax, rax
je 0x18001b817
lea rdi, [rbx + 0xc]
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], 0
mov r9, rbx
lea r8, [0x18001bda0]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rbx + 0x10], rax
test rax, rax
je 0x18001b817
or edx, 0xffffffff
mov rcx, qword [rbx + 0x18]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rbx + 0x18]
call qword [sym.imp.KERNEL32.dll_ResetEvent]
xor r9d, r9d
xor r8d, r8d
mov edx, 0x401
mov ecx, dword [rdi]
call qword [sym.imp.USER32.dll_PostThreadMessageA]
test eax, eax
je 0x18001b817
or edx, 0xffffffff
mov rcx, qword [rbx + 0x18]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rbx + 0x18]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov byte [rbx + 8], 1
mov al, 1
jmp 0x18001b817
xor al, al
jmp 0x18001b817
mov rbx, qword [rsp + 0xa0]
add rsp, 0x90
pop rdi
ret
Function at 0x1800223c0
Capabilities:
Clear file content

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
mov rax, rdx
movsxd rcx, dword [rcx + 0x38]
test ecx, ecx
je 0x1800223e3
dec rax
add rax, rcx
cqo
idiv rcx
imul rax, rcx
mov rdx, rax
mov rcx, rbx
call fcn.180050be0
test eax, eax
je 0x180022412
mov r8, qword [rbx + 0x30]
lea rdx, str.winTruncate1
mov r9d, 0x7e4b
mov ecx, 0x60a
add rsp, 0x20
pop rbx
jmp fcn.18008ed40
mov rcx, qword [rbx + 0x10]
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
jne 0x180022449
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8, qword [rbx + 0x30]
lea rdx, str.winTruncate2
mov r9d, 0x7e4e
mov dword [rbx + 0x1c], eax
mov ecx, 0x60a
add rsp, 0x20
pop rbx
jmp fcn.18008ed40
xor eax, eax
add rsp, 0x20
pop rbx
ret

Function at 0x180023ed0
Capabilities:
Check if file exists
Delete file
Get file attributes

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x20
xor r14d, r14d
mov r15, rdx
mov ebx, r14d
mov edi, r14d
call fcn.180044bb0
mov rcx, r15
test eax, eax
je 0x180023f0a
call fcn.18008bc20
mov rsi, rax
jmp 0x180023f2e
call fcn.18008bc20
mov rbp, rax
test rax, rax
je 0x180023fee
mov rcx, rax
call fcn.18008af00
mov rcx, rbp
mov rsi, rax
call fcn.18009f338
test rsi, rsi
je 0x180023fee
call fcn.180044bb0
test eax, eax
je 0x180023f80
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ebp, eax
cmp eax, 0xffffffff
jne 0x180023f66
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
cmp eax, 5
jne 0x180023fba
inc ebx
cmp ebx, 5
jge 0x180023fba
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x180023f40
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov ebp, eax
cmp eax, 0xffffffff
jne 0x180023fa6
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
cmp eax, 5
jne 0x180023fba
inc ebx
cmp ebx, 5
jge 0x180023fba
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x180023f80
mov rcx, rsi
call fcn.18009f338
cmp ebp, 0xffffffff
jne 0x180023fcc
cmp edi, 2
je 0x180023fe9
mov r9d, 0x83f7
lea rdx, str.winDelete
mov r8, r15
mov ecx, 0xa0a
call fcn.18008ed40
mov r14d, eax
mov eax, r14d
jmp 0x180023ff3
mov eax, 7
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop rdi
ret
Function at 0x180043340
Capabilities:
Get disk size

Disassembly:
sub rsp, 0x168
mov rax, qword [0x1800ff5a8]
xor rax, rsp
mov qword [rsp + 0x150], rax
lea r9, [rsp + 0x40]
mov dword [rsp + 0x34], 0x200
mov r8d, 0x104
call fcn.18002b530
test eax, eax
jne 0x18004353f
mov qword [rsp + 0x180], rbx
mov qword [rsp + 0x188], rsi
mov qword [rsp + 0x160], rdi
call fcn.180044bb0
xor esi, esi
lea r8, [rsp + 0x40]
or r9d, 0xffffffff
mov dword [rsp + 0x28], esi
xor edx, edx
mov qword [rsp + 0x20], rsi
mov ecx, 0xfde9
test eax, eax
je 0x180043407
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
movsxd rdi, eax
mov rcx, rdi
add rcx, rcx
call fcn.1800a7c08
mov rbx, rax
test rax, rax
je 0x18004344e
mov dword [rsp + 0x28], edi
lea r8, [rsp + 0x40]
or r9d, 0xffffffff
mov qword [rsp + 0x20], rax
xor edx, edx
mov ecx, 0xfde9
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
test eax, eax
jne 0x180043493
mov rcx, rbx
call fcn.18009f338
mov ebx, esi
jmp 0x180043493
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
movsxd rbx, eax
mov rcx, rbx
add rcx, rcx
call fcn.1800a7c08
mov rdi, rax
test rax, rax
je 0x18004344e
mov dword [rsp + 0x28], ebx
lea r8, [rsp + 0x40]
or r9d, 0xffffffff
mov qword [rsp + 0x20], rax
xor edx, edx
mov ecx, 0xfde9
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov rcx, rdi
test eax, eax
jne 0x180043483
call fcn.18009f338
mov eax, 0x200
mov rsi, qword [rsp + 0x188]
mov rbx, qword [rsp + 0x180]
mov rdi, qword [rsp + 0x160]
mov rcx, qword [rsp + 0x150]
xor rcx, rsp
call fcn.180099e90
add rsp, 0x168
ret
call fcn.18008af00
mov rcx, rdi
mov rbx, rax
call fcn.18009f338
test rbx, rbx
je 0x18004344e
call fcn.180044bb0
test eax, eax
mov rax, rbx
je 0x1800434e9
cmp word [rbx], 0
je 0x1800434c5
nop word [rax + rax]
cmp word [rax], 0x5c
je 0x1800434c2
add rax, 2
cmp word [rax], 0
jne 0x1800434b0
jmp 0x1800434c5
mov word [rax], si
lea rax, [rsp + 0x30]
mov rcx, rbx
lea r9, [rsp + 0x30]
mov qword [rsp + 0x20], rax
lea r8, [rsp + 0x34]
lea rdx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceW]
jmp 0x180043524
cmp byte [rbx], 0
je 0x180043502
nop
cmp byte [rax], 0x5c
je 0x1800434ff
inc rax
cmp byte [rax], 0
jne 0x1800434f0
jmp 0x180043502
mov byte [rax], 0
lea rax, [rsp + 0x30]
mov rcx, rbx
lea r9, [rsp + 0x30]
mov qword [rsp + 0x20], rax
lea r8, [rsp + 0x34]
lea rdx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceA]
mov rcx, rbx
mov edi, eax
call fcn.18009f338
test edi, edi
je 0x18004344e
mov eax, dword [rsp + 0x34]
jmp 0x180043453
mov eax, dword [rsp + 0x34]
mov rcx, qword [rsp + 0x150]
xor rcx, rsp
call fcn.180099e90
add rsp, 0x168
ret
Function at 0x180044c20
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 0x18], rbx
mov dword [rsp + 0x20], r9d
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x30
mov rax, qword [rcx]
xor r13d, r13d
mov rsi, r8
mov dword [rsp + 0x20], r13d
mov r8, rcx
mov qword [rsp + 0x28], rax
mov rcx, qword [rsp + 0x90]
mov edi, r13d
mov r14d, r13d
mov r12d, dword [rcx]
mov r15, qword [rcx + 0x10]
test r12d, r12d
jle 0x180044dec
mov ebp, r13d
nop word [rax + rax]
cmp r14d, dword [rsi + 8]
jg 0x180044ddf
mov rbx, qword [r15]
cmp byte [rbx], 0x98
jne 0x180044ddf
cmp dword [rbx + 0x30], r9d
jne 0x180044ddf
mov rdx, rbx
mov rcx, r8
call fcn.1800610d0
mov rcx, rax
test rax, rax
jne 0x180044cbc
mov rax, qword [rsp + 0x28]
mov rcx, qword [rax + 0x38]
cmp qword [rsi], r13
je 0x180044cf3
cmp r14d, dword [rsi + 8]
jge 0x180044cf3
mov rax, qword [rsi + 0x10]
mov r9d, dword [rax + rbp*4]
mov rax, qword [rsi + 0x20]
cmp r9d, dword [rax + 8]
mov eax, 0xffffffff
cmove r9d, eax
mov rax, qword [rsi + 0x48]
movzx r10d, byte [rax + rbp]
mov rax, qword [rsi + 0x50]
lea r8, [rax + rbp*8]
jmp 0x180044cfd
or r9d, 0xffffffff
mov r10d, r13d
mov r8, rcx
movsx eax, word [rbx + 0x34]
mov r8, qword [r8]
cmp eax, r9d
jne 0x180044da7
mov rax, qword [rcx]
lea rbx, [0x1800ca130]
movzx ecx, byte [rax]
test cl, cl
je 0x180044d3e
nop
movzx edx, cl
movzx ecx, byte [r8]
movzx ecx, byte [rcx + rbx]
cmp byte [rdx + rbx], cl
jne 0x180044d3e
movzx ecx, byte [rax + 1]
inc rax
inc r8
test cl, cl
jne 0x180044d20
movzx ecx, byte [rax]
movzx eax, byte [r8]
movzx edx, byte [rcx + rbx]
movzx eax, byte [rax + rbx]
cmp edx, eax
jne 0x180044da7
movzx eax, byte [r15 + 0x18]
movsxd rcx, dword [rsp + 0x98]
xor eax, r10d
cmp rbp, rcx
jle 0x180044d72
cmp eax, dword [rsp + 0x20]
jne 0x180044e31
jmp 0x180044d76
mov dword [rsp + 0x20], eax
inc edi
add r15, 0x20
test r9d, r9d
jns 0x180044db4
mov r9d, dword [rsp + 0x88]
mov r8d, edi
mov rdx, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x90]
call fcn.18004ded0
test eax, eax
jne 0x180044db4
mov edi, r12d
jmp 0x180044db4
movsxd rax, dword [rsp + 0x98]
cmp rbp, rax
jge 0x180044dd1
mov r9d, dword [rsp + 0x88]
inc r14d
inc rbp
cmp edi, r12d
jge 0x180044ddf
mov r8, qword [rsp + 0x70]
jmp 0x180044c80
cmp r14d, dword [rsi + 8]
jne 0x180044e31
mov r9d, dword [rsp + 0x88]
mov rcx, qword [rsp + 0x90]
mov rdx, qword [rsp + 0x78]
cmp dword [rsp + 0x20], r13d
mov rax, qword [rsp + 0xa8]
setne r13b
mov dword [rax], r13d
cmp edi, r12d
jl 0x180044e0c
mov eax, 1
jmp 0x180044e33
cmp byte [rsi + 0x2c], 0
je 0x180044e31
cmp r14d, dword [rsi + 8]
jne 0x180044e31
test dword [rsp + 0xa0], 0x80000
jne 0x180044e31
mov r8d, edi
call fcn.18004ded0
test eax, eax
je 0x180044e05
xor eax, eax
mov rbx, qword [rsp + 0x80]
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x18004e020
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x20
mov eax, edx
mov edi, 0x40
shl rax, 4
mov rbx, rcx
cmp rax, 0x400
cmovbe edi, edx
cmp edi, dword [rcx]
jne 0x18004e052
xor eax, eax
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
mov rax, qword [0x180100860]
test rax, rax
je 0x18004e060
call rax
shl edi, 4
mov ecx, edi
call fcn.18006aa70
mov rcx, qword [0x180100868]
mov rdi, rax
test rcx, rcx
je 0x18004e07b
call rcx
test rdi, rdi
je 0x18004e045
mov rcx, qword [rbx + 0x10]
mov qword [rsp + 0x38], rsi
call fcn.18002ab40
mov rcx, rdi
mov qword [rbx + 0x10], rdi
call qword [0x1800fe1a8]
movsxd rsi, eax
xor edx, edx
shr rsi, 4
mov rcx, rdi
mov r8d, esi
shl r8, 4
mov dword [rbx], esi
call fcn.18009c1f0
mov rcx, qword [rbx + 8]
xor r11d, r11d
mov qword [rbx + 8], r11
test rcx, rcx
je 0x18004e197
mov qword [rsp + 0x30], rbp
lea rbp, [0x1800ca130]
nop word [rax + rax]
mov r9d, dword [rcx + 0x20]
mov eax, r11d
mov r10, qword [rcx + 0x18]
test r9d, r9d
jle 0x18004e112
movzx edx, byte [r10]
lea r10, [r10 + 1]
dec r9d
movzx r8d, byte [rdx + rbp]
lea edx, [rax*8]
xor r8d, edx
xor eax, r8d
test r9d, r9d
jg 0x18004e0f0
mov r9, qword [rcx]
xor edx, edx
div esi
mov r8d, edx
shl r8, 4
add r8, rdi
je 0x18004e16a
mov eax, dword [r8]
test eax, eax
je 0x18004e132
mov rdx, qword [r8 + 8]
jmp 0x18004e135
mov rdx, r11
inc eax
mov qword [r8 + 8], rcx
mov dword [r8], eax
test rdx, rdx
je 0x18004e16a
mov qword [rcx], rdx
mov rax, qword [rdx + 8]
mov qword [rcx + 8], rax
mov rax, qword [rdx + 8]
test rax, rax
je 0x18004e160
mov qword [rax], rcx
mov qword [rdx + 8], rcx
jmp 0x18004e186
mov qword [rbx + 8], rcx
mov qword [rdx + 8], rcx
jmp 0x18004e186
mov rax, qword [rbx + 8]
mov qword [rcx], rax
mov rax, qword [rbx + 8]
test rax, rax
je 0x18004e17e
mov qword [rax + 8], rcx
mov qword [rcx + 8], r11
mov qword [rbx + 8], rcx
mov rcx, r9
test r9, r9
jne 0x18004e0e0
mov rbp, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
mov eax, 1
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x180061230
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rbx, rdx
mov rdi, rcx
test rcx, rcx
je 0x180061362
test rdx, rdx
je 0x180061362
movzx ecx, word [rcx + 2]
mov edx, 0x800
test dx, cx
jne 0x1800612d9
movzx eax, word [rbx + 2]
test dx, ax
jne 0x1800612d9
xor al, cl
test al, 0x10
jne 0x1800612d9
movzx eax, byte [rbx]
cmp byte [rdi], al
jne 0x1800612d9
mov rdx, qword [rbx + 0x10]
mov rcx, qword [rdi + 0x10]
call fcn.180061230
test eax, eax
jne 0x1800612d9
mov rdx, qword [rbx + 0x18]
mov rcx, qword [rdi + 0x18]
call fcn.180061230
test eax, eax
jne 0x1800612d9
mov rdx, qword [rbx + 0x20]
mov rcx, qword [rdi + 0x20]
call fcn.180061ee0
test eax, eax
jne 0x1800612d9
mov eax, dword [rbx + 0x30]
cmp dword [rdi + 0x30], eax
jne 0x1800612d9
movzx eax, word [rbx + 0x34]
cmp word [rdi + 0x34], ax
jne 0x1800612d9
movzx r11d, word [rdi + 2]
mov eax, 0x400
test ax, r11w
je 0x1800612e9
test word [rbx + 2], ax
je 0x1800612d9
mov eax, dword [rbx + 8]
cmp dword [rdi + 8], eax
je 0x18006131f
mov eax, 2
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
cmp byte [rdi], 0x98
je 0x18006131f
mov rcx, qword [rdi + 8]
test rcx, rcx
je 0x18006131f
test word [rbx + 2], ax
jne 0x1800612d9
mov rdx, qword [rbx + 8]
test rdx, rdx
je 0x1800612d9
call fcn.1800774d0
test eax, eax
je 0x18006131f
mov eax, 2
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
movzx eax, word [rbx + 2]
mov ecx, 0x100
and r11w, cx
and ax, cx
cmp r11w, ax
je 0x180061345
mov eax, 1
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
test r11w, r11w
je 0x180061355
mov rax, qword [rbx + 0x28]
cmp qword [rdi + 0x28], rax
jne 0x1800612d9
xor eax, eax
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
xor ecx, ecx
mov eax, 2
cmp rbx, rdi
mov rbx, qword [rsp + 0x30]
cmove eax, ecx
add rsp, 0x20
pop rdi
ret
Function at 0x180062f50
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r14
sub rsp, 0x20
xor r9d, r9d
mov r14, r8
mov rsi, rdx
mov rbx, rdx
test rdx, rdx
je 0x180062f88
cmp byte [rdx], r9b
je 0x180062f80
inc rbx
cmp byte [rbx], r9b
jne 0x180062f78
sub ebx, esi
and ebx, 0x3fffffff
mov ebp, dword [rcx + 8]
xor edi, edi
test ebp, ebp
jle 0x1800630ac
mov qword [rsp + 0x40], r12
lea r12, [0x1800ca130]
mov qword [rsp + 0x48], r15
mov r15, qword [rcx + 0x10]
nop word [rax + rax]
mov eax, edi
cmp edi, 2
jge 0x180062fba
xor eax, 1
movsxd r8, eax
shl r8, 5
mov r10, qword [r8 + r15 + 0x18]
test r14, r14
je 0x180063015
movzx edx, byte [r14]
mov rax, r14
mov r8, qword [r8 + r15]
test dl, dl
je 0x180063000
nop word [rax + rax]
movzx ecx, byte [r8]
movzx edx, dl
movzx ecx, byte [rcx + r12]
cmp byte [rdx + r12], cl
jne 0x180063000
movzx edx, byte [rax + 1]
inc rax
inc r8
test dl, dl
jne 0x180062fe0
movzx ecx, byte [r8]
movzx edx, byte [rcx + r12]
movzx ecx, byte [rax]
movzx eax, byte [rcx + r12]
cmp eax, edx
jne 0x180063082
cmp qword [r10 + 0x30], 0
je 0x18006305b
xor r8d, r8d
mov edx, ebx
mov r9, rsi
test ebx, ebx
je 0x180063050
nop dword [rax + rax]
movzx eax, byte [r9]
lea r9, [r9 + 1]
dec edx
movzx ecx, byte [rax + r12]
lea eax, [r8*8]
xor ecx, eax
xor r8d, ecx
test edx, edx
jg 0x180063030
xor edx, edx
mov eax, r8d
div dword [r10 + 0x20]
jmp 0x18006305d
xor edx, edx
mov r9d, edx
lea rcx, [r10 + 0x20]
mov rdx, rsi
mov r8d, ebx
call fcn.18003ea00
test rax, rax
je 0x18006307f
mov r9, qword [rax + 0x10]
test r9, r9
jne 0x18006308c
jmp 0x180063082
xor r9d, r9d
inc edi
cmp edi, ebp
jl 0x180062fb0
mov r12, qword [rsp + 0x40]
mov rax, r9
mov r15, qword [rsp + 0x48]
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
add rsp, 0x20
pop r14
pop rdi
pop rsi
ret
mov rax, r9
jmp 0x180063099