joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1801c21b0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
mov eax, 0x20
call fcn.1800b9c10
sub rsp, rax
add qword [rcx], r8
mov rsi, qword [rcx + 8]
mov rdi, qword [rcx + 0x10]
mov rbp, qword [rcx + 0x18]
mov rbx, qword [rcx + 0x20]
mov r12, rcx
mov ecx, dword [rcx + 0x28]
mov r13, r8
mov r14, rdx
test ecx, ecx
je 0x1801c22d8
mov r15d, 8
sub r15d, ecx
lea rcx, [rcx + r12 + 0x38]
cmp r8, r15
jae 0x1801c221e
call fcn.1800acfd0
add dword [r12 + 0x28], r13d
jmp 0x1801c23e1
mov r8, r15
call fcn.1800acfd0
movzx eax, byte [r12 + 0x3e]
movzx ecx, byte [r12 + 0x3f]
shl rcx, 8
sub r13, r15
add r14, r15
or rcx, rax
movzx eax, byte [r12 + 0x3d]
shl rcx, 8
or rcx, rax
movzx eax, byte [r12 + 0x3c]
shl rcx, 8
or rcx, rax
movzx eax, byte [r12 + 0x3b]
shl rcx, 8
or rcx, rax
movzx eax, byte [r12 + 0x3a]
shl rcx, 8
or rcx, rax
movzx eax, byte [r12 + 0x39]
shl rcx, 8
or rcx, rax
movzx eax, byte [r12 + 0x38]
shl rcx, 8
or rcx, rax
xor rbx, rcx
cmp dword [r12 + 0x30], 0
jbe 0x1801c22d5
mov eax, dword [r12 + 0x30]
nop dword [rax]
add rsi, rdi
add rbp, rbx
rol rdi, 0xd
xor rdi, rsi
rol rbx, 0x10
xor rbx, rbp
rol rsi, 0x20
add rbp, rdi
add rsi, rbx
rol rbx, 0x15
xor rbx, rsi
rol rdi, 0x11
xor rdi, rbp
rol rbp, 0x20
dec rax
jne 0x1801c22a0
xor rsi, rcx
mov r15d, r13d
mov rdx, r14
and r15d, 7
movsxd r8, r15d
sub rdx, r8
add rdx, r13
cmp r14, rdx
je 0x1801c23b9
mov r10d, dword [r12 + 0x30]
lea r9, [r14 + 6]
nop dword [rax]
movzx eax, byte [r9]
movzx ecx, byte [r9 + 1]
shl rcx, 8
or rcx, rax
movzx eax, byte [r9 - 1]
shl rcx, 8
or rcx, rax
movzx eax, byte [r9 - 2]
shl rcx, 8
or rcx, rax
movzx eax, byte [r9 - 3]
shl rcx, 8
or rcx, rax
movzx eax, byte [r9 - 4]
shl rcx, 8
or rcx, rax
movzx eax, byte [r9 - 5]
shl rcx, 8
or rcx, rax
movzx eax, byte [r9 - 6]
shl rcx, 8
or rcx, rax
xor rbx, rcx
test r10d, r10d
je 0x1801c23a5
mov eax, dword [r12 + 0x30]
nop word [rax + rax]
add rsi, rdi
add rbp, rbx
rol rdi, 0xd
xor rdi, rsi
rol rbx, 0x10
xor rbx, rbp
rol rsi, 0x20
add rbp, rdi
add rsi, rbx
rol rbx, 0x15
xor rbx, rsi
rol rdi, 0x11
xor rdi, rbp
rol rbp, 0x20
dec rax
jne 0x1801c2370
add r9, 8
xor rsi, rcx
lea rax, [r9 - 6]
cmp rax, rdx
jne 0x1801c2300
test r15d, r15d
je 0x1801c23c8
lea rcx, [r12 + 0x38]
call fcn.1800acfd0
mov dword [r12 + 0x28], r15d
mov qword [r12 + 8], rsi
mov qword [r12 + 0x10], rdi
mov qword [r12 + 0x18], rbp
mov qword [r12 + 0x20], rbx
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x20
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x1801c2400
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
mov rbx, qword [rcx]
mov ebp, dword [rcx + 0x2c]
mov r10, qword [rcx + 0x10]
mov r11, qword [rcx + 0x18]
mov r9, qword [rcx + 0x20]
shl rbx, 0x38
mov rsi, rdx
mov rdx, qword [rcx + 8]
mov rdi, rcx
cmp r8, rbp
je 0x1801c2440
xor eax, eax
jmp 0x1801c2626
mov eax, dword [rcx + 0x28]
dec eax
cmp eax, 6
ja case.default.0x1801c245c
lea r8, [0x180000000]
mov ecx, dword [r8 + rax*4 + 0x1c263c]
add rcx, r8
jmp rcx
movzx eax, byte [rdi + 0x3e]
shl rax, 0x30
or rbx, rax
movzx eax, byte [rdi + 0x3d]
shl rax, 0x28
or rbx, rax
movzx eax, byte [rdi + 0x3c]
shl rax, 0x20
or rbx, rax
movzx eax, byte [rdi + 0x3b]
shl rax, 0x18
or rbx, rax
movzx eax, byte [rdi + 0x3a]
shl rax, 0x10
or rbx, rax
movzx eax, byte [rdi + 0x39]
shl rax, 8
or rbx, rax
movzx eax, byte [rdi + 0x38]
or rbx, rax
mov eax, dword [rdi + 0x30]
xor r9, rbx
test eax, eax
je 0x1801c24e8
mov ecx, eax
add rdx, r10
add r11, r9
rol r10, 0xd
xor r10, rdx
rol r9, 0x10
xor r9, r11
rol rdx, 0x20
add r11, r10
add rdx, r9
rol r9, 0x15
xor r9, rdx
rol r10, 0x11
xor r10, r11
rol r11, 0x20
dec rcx
jne 0x1801c24b3
xor rdx, rbx
cmp ebp, 0x10
jne 0x1801c24f9
xor r11, 0xee
jmp 0x1801c2500
xor r11, 0xff
mov eax, dword [rdi + 0x34]
test eax, eax
je 0x1801c2545
mov ecx, eax
nop dword [rax]
add rdx, r10
add r11, r9
rol r10, 0xd
xor r10, rdx
rol r9, 0x10
xor r9, r11
rol rdx, 0x20
add r11, r10
add rdx, r9
rol r9, 0x15
xor r9, rdx
rol r10, 0x11
xor r10, r11
rol r11, 0x20
dec rcx
jne 0x1801c2510
mov rcx, r9
xor rcx, r11
xor rcx, r10
xor rcx, rdx
mov eax, ecx
mov byte [rsi], cl
shr eax, 8
mov byte [rsi + 1], al
mov eax, ecx
shr eax, 0x10
mov byte [rsi + 2], al
mov eax, ecx
shr rcx, 0x20
shr eax, 0x18
mov byte [rsi + 4], cl
mov byte [rsi + 3], al
mov eax, ecx
shr eax, 8
mov byte [rsi + 5], al
mov eax, ecx
shr ecx, 0x18
shr eax, 0x10
mov byte [rsi + 7], cl
mov byte [rsi + 6], al
cmp dword [rdi + 0x2c], 8
je 0x1801c2621
mov eax, dword [rdi + 0x34]
xor r10, 0xdd
test eax, eax
je 0x1801c25d7
mov ecx, eax
add rdx, r10
add r11, r9
rol r10, 0xd
xor r10, rdx
rol r9, 0x10
xor r9, r11
rol rdx, 0x20
add r11, r10
add rdx, r9
rol r9, 0x15
xor r9, rdx
rol r10, 0x11
xor r10, r11
rol r11, 0x20
dec rcx
jne 0x1801c25a2
xor r9, r11
xor r9, r10
xor r9, rdx
mov eax, r9d
mov byte [rsi + 8], r9b
shr eax, 8
mov byte [rsi + 9], al
mov eax, r9d
shr eax, 0x10
mov byte [rsi + 0xa], al
mov eax, r9d
shr r9, 0x20
shr eax, 0x18
mov byte [rsi + 0xc], r9b
mov byte [rsi + 0xb], al
mov eax, r9d
shr eax, 8
mov byte [rsi + 0xd], al
mov eax, r9d
shr eax, 0x10
shr r9d, 0x18
mov byte [rsi + 0xf], r9b
mov byte [rsi + 0xe], al
mov eax, 1
mov rbx, qword [rsp + 8]
mov rbp, qword [rsp + 0x10]
mov rsi, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
ret
Function at 0x1801c3170
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
movzx r9d, byte [rdx]
lea eax, [r8 - 1]
xor edi, edi
movzx r11d, r9b
mov esi, r8d
mov rbx, rcx
shr r11b, 7
test eax, eax
jle 0x1801c31d2
mov r10, rcx
sub rdx, rcx
mov edi, eax
mov r8d, eax
nop word [rax + rax]
movzx ecx, byte [rdx + r10 + 1]
add r9b, r9b
inc r10
movzx eax, cl
shr al, 7
or al, r9b
dec r8
movzx r9d, cl
mov byte [r10 - 1], al
jne 0x1801c31b0
mov eax, 0x87
cmp esi, 0x10
mov rsi, qword [rsp + 0x10]
mov ecx, 0x1b
cmove ecx, eax
movsxd rax, edi
mov rdi, qword [rsp + 0x18]
neg r11b
add r9b, r9b
and cl, r11b
xor cl, r9b
mov byte [rax + rbx], cl
mov rbx, qword [rsp + 8]
ret

Function at 0x1801c3860
Capabilities:
Encode data using xor
Hash data using sha256

Disassembly:
mov qword [rsp + 8], rbx
push rdi
mov eax, 0x20
call fcn.1800b9c10
sub rsp, rax
mov rdi, rdx
lea r8d, [rax + 0x60]
xor edx, edx
mov rbx, rcx
call fcn.1800b45b0
mov dword [rbx], 0x6a09e667
mov dword [rbx + 4], 0xbb67ae85
mov dword [rbx + 8], 0x3c6ef372
mov dword [rbx + 0xc], 0xa54ff53a
mov dword [rbx + 0x10], 0x510e527f
mov dword [rbx + 0x14], 0x9b05688c
mov dword [rbx + 0x18], 0x1f83d9ab
mov dword [rbx + 0x1c], 0x5be0cd19
movzx eax, byte [rdi]
mov ecx, 8
mov qword [rbx + 0x78], rax
sub rdi, rbx
nop word [rax + rax]
mov eax, dword [rdi + rbx]
add rbx, 4
xor dword [rbx - 4], eax
dec rcx
jne 0x1801c38d0
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x1801c58e0
Capabilities:
Encode data using xor
Hash data using sha512

Disassembly:
mov qword [rsp + 8], rbx
push rdi
mov eax, 0x20
call fcn.1800b9c10
sub rsp, rax
mov rdi, rdx
mov r8d, 0xf0
xor edx, edx
mov rbx, rcx
call fcn.1800b45b0
movabs rax, 0xbb67ae8584caa73b
mov qword [rbx + 8], rax
movabs rax, 0x3c6ef372fe94f82b
movabs r11, 0x6a09e667f3bcc908
mov qword [rbx + 0x10], rax
movabs rax, 0xa54ff53a5f1d36f1
mov qword [rbx], r11
mov qword [rbx + 0x18], rax
movabs rax, 0x510e527fade682d1
mov ecx, 8
mov qword [rbx + 0x20], rax
movabs rax, 0x9b05688c2b3e6c1f
mov qword [rbx + 0x28], rax
movabs rax, 0x1f83d9abfb41bd6b
mov qword [rbx + 0x30], rax
movabs rax, 0x5be0cd19137e2179
mov qword [rbx + 0x38], rax
movzx eax, byte [rdi]
sub rdi, rbx
mov qword [rbx + 0xe8], rax
nop word [rax + rax]
mov rax, qword [rdi + rbx]
add rbx, 8
xor qword [rbx - 8], rax
dec rcx
jne 0x1801c5990
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x1801cda30
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
mov eax, reloc.WS2_32.dll_WSASetLastError
call fcn.1800b9c10
sub rsp, rax
mov rax, qword [0x1802e4710]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov rdi, r9
mov rbx, r9
mov rsi, r8
and edi, 0xf
mov r12, rdx
mov rbp, rcx
jne 0x1801cda87
mov rax, qword [rcx + 0xa8]
mov r8, rdx
mov rdx, rsi
call qword [rax + reloc.WS2_32.dll_htonl]
xor ecx, ecx
test eax, eax
cmove rbx, rcx
mov rax, rbx
jmp 0x1801cdbbd
mov rax, 0xfffffffffffffff0
sub rax, rdi
add rbx, rax
je 0x1801cdaba
mov rax, qword [rcx + 0xa8]
mov r8, rdx
mov r9, rbx
mov rdx, rsi
call qword [rax + reloc.WS2_32.dll_htonl]
test eax, eax
jne 0x1801cdab4
xor eax, eax
jmp 0x1801cdbbd
add r12, rbx
add rsi, rbx
mov rax, qword [rbp + 0x9c]
lea r8, [r12 + rdi]
mov qword [rsp + 0x68], r13
mov r13, qword [r8]
mov qword [rsp + 0x20], rax
xor eax, eax
mov qword [rsp + 0x60], r14
mov r14, qword [r8 + 8]
mov qword [rsp + 0x58], r15
mov r15, qword [rbp + 0x94]
mov qword [rbp + 0x94], rax
mov qword [rbp + 0x9c], rax
mov rax, qword [rbp + 0xa8]
lea rdx, [rsp + 0x38]
mov r9d, reloc.WS2_32.dll_recv
mov rcx, rbp
call qword [rax + reloc.WS2_32.dll_htonl]
test eax, eax
je 0x1801cdb97
lea rcx, [rsp + 0x28]
mov r8, rdi
mov rdx, r12
call fcn.1800acfd0
mov r8d, reloc.WS2_32.dll_recv
lea rdx, [rsp + rdi + 0x38]
lea rcx, [rsp + rdi + 0x28]
sub r8, rdi
call fcn.1800acfd0
xor ecx, ecx
test rdi, rdi
je 0x1801cdb65
nop word [rax + rax]
movzx eax, byte [rsp + rcx + 0x28]
inc rcx
xor al, byte [rsp + rcx + 0x37]
mov byte [rsi + rcx + 0xf], al
cmp rcx, rdi
jb 0x1801cdb50
mov rax, qword [rsp + 0x20]
mov qword [rbp + 0x94], r15
lea r8, [rsp + 0x28]
mov qword [rbp + 0x9c], rax
mov rax, qword [rbp + 0xa8]
mov r9d, reloc.WS2_32.dll_recv
mov rdx, rsi
mov rcx, rbp
call qword [rax + reloc.WS2_32.dll_htonl]
test eax, eax
jne 0x1801cdb9b
xor eax, eax
jmp 0x1801cdbae
mov qword [rbp + 0x94], r13
lea rax, [rbx + rdi + 0x10]
mov qword [rbp + 0x9c], r14
mov r14, qword [rsp + 0x60]
mov r13, qword [rsp + 0x68]
mov r15, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.1800acfa0
add rsp, 0x70
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x1801cdce0
Capabilities:
Encode data using xor

Disassembly:
push rbp
push rsi
push rdi
push r12
mov eax, 0x88
call fcn.1800b9c10
sub rsp, rax
mov rax, qword [0x1802e4710]
xor rax, rsp
mov qword [rsp + 0x50], rax
mov rdi, r9
mov rsi, r8
mov r12, rdx
mov rbp, rcx
cmp r9, 0x10
jae 0x1801cdd1b
xor eax, eax
jmp 0x1801cde97
mov qword [rsp + 0x78], r13
cmp r9, 0x10
jne 0x1801cdd43
mov rax, qword [rcx + 0xa8]
mov r8, rdx
mov rdx, rsi
call qword [rax + reloc.WS2_32.dll_htonl]
neg eax
sbb rax, rax
and eax, 0x10
jmp 0x1801cde92
mov qword [rsp + 0x80], rbx
mov rbx, r9
mov r13d, reloc.WS2_32.dll_recv
and ebx, 0xf
mov rax, 0xfffffffffffffff0
cmove ebx, r13d
sub rax, rbx
add rdi, rax
je 0x1801cdd8e
mov rax, qword [rcx + 0xa8]
mov r8, rdx
mov r9, rdi
mov rdx, rsi
call qword [rax + reloc.WS2_32.dll_htonl]
test eax, eax
jne 0x1801cdd88
xor eax, eax
jmp 0x1801cde8a
add r12, rdi
add rsi, rdi
mov rax, qword [rbp + 0x94]
mov qword [rsp + 0x70], r14
mov r14, qword [r12]
mov qword [rsp + 0x28], rax
mov rax, qword [rbp + 0x9c]
mov qword [rsp + 0x68], r15
mov r15, qword [r12 + 8]
mov qword [rsp + 0x20], rax
xor eax, eax
mov qword [rbp + 0x94], rax
mov qword [rbp + 0x9c], rax
mov rax, qword [rbp + 0xa8]
lea rdx, [rsp + 0x40]
mov r9, r13
mov r8, r12
mov rcx, rbp
call qword [rax + reloc.WS2_32.dll_htonl]
test eax, eax
je 0x1801cde69
lea rdx, [r12 + 0x10]
lea rcx, [rsp + 0x30]
mov r8, rbx
call fcn.1800acfd0
cmp rbx, r13
je 0x1801cde15
mov r8, r13
lea rdx, [rsp + rbx + 0x40]
lea rcx, [rsp + rbx + 0x30]
sub r8, rbx
call fcn.1800acfd0
xor ecx, ecx
test rbx, rbx
je 0x1801cde35
nop dword [rax]
movzx eax, byte [rsp + rcx + 0x30]
inc rcx
xor al, byte [rsp + rcx + 0x3f]
mov byte [rsi + rcx + 0xf], al
cmp rcx, rbx
jb 0x1801cde20
mov rax, qword [rsp + 0x28]
lea r8, [rsp + 0x30]
mov r9, r13
mov qword [rbp + 0x94], rax
mov rax, qword [rsp + 0x20]
mov rdx, rsi
mov qword [rbp + 0x9c], rax
mov rax, qword [rbp + 0xa8]
mov rcx, rbp
call qword [rax + reloc.WS2_32.dll_htonl]
test eax, eax
jne 0x1801cde6d
xor eax, eax
jmp 0x1801cde80
mov qword [rbp + 0x94], r14
lea rax, [rdi + rbx + 0x10]
mov qword [rbp + 0x9c], r15
mov r14, qword [rsp + 0x70]
mov r15, qword [rsp + 0x68]
mov rbx, qword [rsp + 0x80]
mov r13, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.1800acfa0
add rsp, 0x88
pop r12
pop rdi
pop rsi
pop rbp
ret

Function at 0x1801cf050
Capabilities:
Hash data using sha1

Disassembly:
push rbx
mov eax, 0x20
call fcn.1800b9c10
sub rsp, rax
mov rbx, rcx
call fcn.1800c1b80
test eax, eax
jne 0x1801cf071
add rsp, 0x20
pop rbx
ret
lea rcx, [rbx + 0x5c]
add rsp, 0x20
pop rbx
jmp fcn.1801e4750
Function at 0x1801d2690
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r12
mov eax, 0x20
call fcn.1800b9c10
sub rsp, rax
mov rbp, r9
mov rdi, r9
mov rbx, r8
shr rbp, 3
mov rsi, rdx
mov r12, rcx
cmp r8, r9
jb 0x1801d2756
nop
xor r8d, r8d
test rbp, rbp
je 0x1801d2742
nop dword [rax + rax]
movzx eax, byte [rsi + 6]
movzx ecx, byte [rsi + 7]
inc r8
shl rcx, 8
add rsi, 8
or rcx, rax
movzx eax, byte [rsi - 3]
shl rcx, 8
or rcx, rax
movzx eax, byte [rsi - 4]
shl rcx, 8
or rcx, rax
movzx eax, byte [rsi - 5]
shl rcx, 8
or rcx, rax
movzx eax, byte [rsi - 6]
shl rcx, 8
or rcx, rax
movzx eax, byte [rsi - 7]
shl rcx, 8
or rcx, rax
movzx eax, byte [rsi - 8]
shl rcx, 8
or rcx, rax
xor qword [r12 + r8*8 - 8], rcx
cmp r8, rbp
jb 0x1801d26e0
mov rcx, r12
call fcn.1801d21d0
sub rbx, rdi
cmp rbx, rdi
jae 0x1801d26d0
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
mov rax, rbx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop r12
ret
Function at 0x1801d5790
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov rbp, rsp
mov eax, 0x50
call fcn.1800b9c10
sub rsp, rax
mov rax, qword [0x1802e4710]
xor rax, rsp
mov qword [rbp - 8], rax
mov rax, qword [rbp + 0x60]
mov r15, qword [rbp + 0x68]
mov r12d, r8d
movzx r10d, byte [rax]
movzx r8d, byte [rax + 4]
mov ebx, dword [r15]
lea rdi, [rax + 1]
mov qword [rbp - 0x18], rax
shl r10d, 0x18
movzx eax, byte [rdi]
mov rsi, rcx
movzx ecx, byte [rdi + 5]
shl eax, 0x10
shl r8d, 0x18
shl ecx, 8
or r10d, eax
movzx eax, byte [rdi + 1]
mov r14, rdx
shl eax, 8
lea rdx, [rdi + 5]
xor r13d, r13d
or r10d, eax
movzx eax, byte [rdi + 2]
mov qword [rbp - 0x28], r9
or r10d, eax
movzx eax, byte [rdi + 4]
mov qword [rbp - 0x20], r15
shl eax, 0x10
mov dword [rbp - 0x30], r10d
mov byte [rbp - 0xd], r10b
or r8d, eax
movzx eax, byte [rdx + 1]
or ecx, eax
mov eax, r10d
shr eax, 0x18
or r8d, ecx
mov byte [rbp - 0x10], al
mov eax, r10d
mov dword [rbp - 0x2c], r8d
shr eax, 0x10
mov byte [rbp - 9], r8b
mov byte [rbp - 0xf], al
mov eax, r10d
shr eax, 8
mov byte [rbp - 0xe], al
mov eax, r8d
shr eax, 0x18
mov byte [rbp - 0xc], al
mov eax, r8d
shr eax, 0x10
mov byte [rbp - 0xb], al
mov eax, r8d
shr eax, 8
mov byte [rbp - 0xa], al
test r12d, r12d
je 0x1801d5956
mov r15, qword [rbp - 0x28]
sub r14, rsi
movzx edx, r8b
movzx r9d, r10b
nop dword [rax]
dec r12d
test ebx, ebx
jne 0x1801d58f3
lea rcx, [rbp - 0x30]
mov rdx, r15
call fcn.1801d4530
mov r10d, dword [rbp - 0x30]
mov r8d, dword [rbp - 0x2c]
mov eax, r10d
movzx edx, r8b
movzx r9d, r10b
shr eax, 0x18
mov byte [rbp - 0xd], r10b
mov byte [rbp - 9], dl
mov byte [rbp - 0x10], al
mov eax, r10d
shr eax, 0x10
mov byte [rbp - 0xf], al
mov eax, r10d
shr eax, 8
mov byte [rbp - 0xe], al
mov eax, r8d
shr eax, 0x18
mov byte [rbp - 0xc], al
mov eax, r8d
shr eax, 0x10
mov byte [rbp - 0xb], al
mov eax, r8d
shr eax, 8
inc r13d
mov byte [rbp - 0xa], al
movsxd rax, ebx
inc rsi
movzx ecx, byte [rbp + rax - 0x10]
xor cl, byte [rsi - 1]
inc ebx
mov byte [r14 + rsi - 1], cl
and ebx, 7
test r12d, r12d
jne 0x1801d5890
mov r15, qword [rbp - 0x20]
test r13d, r13d
je 0x1801d5956
mov rcx, qword [rbp - 0x18]
mov eax, r10d
shr eax, 0x18
mov byte [rcx], al
mov eax, r10d
shr r10d, 8
shr eax, 0x10
mov byte [rdi], al
mov byte [rdi + 1], r10b
mov byte [rdi + 2], r9b
mov eax, r8d
shr eax, 0x18
mov byte [rdi + 3], al
mov eax, r8d
shr eax, 0x10
shr r8d, 8
mov byte [rdi + 4], al
mov byte [rdi + 5], r8b
mov byte [rdi + 6], dl
mov dword [r15], ebx
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.1800acfa0
mov rbx, qword [rsp + 0x90]
add rsp, 0x50
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x1801d7ef0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov rbp, rsp
mov eax, 0x50
call fcn.1800b9c10
sub rsp, rax
mov rax, qword [0x1802e4710]
xor rax, rsp
mov qword [rbp - 8], rax
mov rax, qword [rbp + 0x60]
mov r15, qword [rbp + 0x68]
mov r12d, r8d
movzx r10d, byte [rax]
movzx r8d, byte [rax + 4]
mov ebx, dword [r15]
lea rdi, [rax + 1]
mov qword [rbp - 0x18], rax
shl r10d, 0x18
movzx eax, byte [rdi]
mov rsi, rcx
movzx ecx, byte [rdi + 5]
shl eax, 0x10
shl r8d, 0x18
shl ecx, 8
or r10d, eax
movzx eax, byte [rdi + 1]
mov r14, rdx
shl eax, 8
lea rdx, [rdi + 5]
xor r13d, r13d
or r10d, eax
movzx eax, byte [rdi + 2]
mov qword [rbp - 0x28], r9
or r10d, eax
movzx eax, byte [rdi + 4]
mov qword [rbp - 0x20], r15
shl eax, 0x10
mov dword [rbp - 0x30], r10d
mov byte [rbp - 0xd], r10b
or r8d, eax
movzx eax, byte [rdx + 1]
or ecx, eax
mov eax, r10d
shr eax, 0x18
or r8d, ecx
mov byte [rbp - 0x10], al
mov eax, r10d
mov dword [rbp - 0x2c], r8d
shr eax, 0x10
mov byte [rbp - 9], r8b
mov byte [rbp - 0xf], al
mov eax, r10d
shr eax, 8
mov byte [rbp - 0xe], al
mov eax, r8d
shr eax, 0x18
mov byte [rbp - 0xc], al
mov eax, r8d
shr eax, 0x10
mov byte [rbp - 0xb], al
mov eax, r8d
shr eax, 8
mov byte [rbp - 0xa], al
test r12d, r12d
je 0x1801d80b6
mov r15, qword [rbp - 0x28]
sub r14, rsi
movzx edx, r8b
movzx r9d, r10b
nop dword [rax]
dec r12d
test ebx, ebx
jne 0x1801d8053
lea rcx, [rbp - 0x30]
mov rdx, r15
call fcn.1801d6d00
mov r10d, dword [rbp - 0x30]
mov r8d, dword [rbp - 0x2c]
mov eax, r10d
movzx edx, r8b
movzx r9d, r10b
shr eax, 0x18
mov byte [rbp - 0xd], r10b
mov byte [rbp - 9], dl
mov byte [rbp - 0x10], al
mov eax, r10d
shr eax, 0x10
mov byte [rbp - 0xf], al
mov eax, r10d
shr eax, 8
mov byte [rbp - 0xe], al
mov eax, r8d
shr eax, 0x18
mov byte [rbp - 0xc], al
mov eax, r8d
shr eax, 0x10
mov byte [rbp - 0xb], al
mov eax, r8d
shr eax, 8
inc r13d
mov byte [rbp - 0xa], al
movsxd rax, ebx
inc rsi
movzx ecx, byte [rbp + rax - 0x10]
xor cl, byte [rsi - 1]
inc ebx
mov byte [r14 + rsi - 1], cl
and ebx, 7
test r12d, r12d
jne 0x1801d7ff0
mov r15, qword [rbp - 0x20]
test r13d, r13d
je 0x1801d80b6
mov rcx, qword [rbp - 0x18]
mov eax, r10d
shr eax, 0x18
mov byte [rcx], al
mov eax, r10d
shr r10d, 8
shr eax, 0x10
mov byte [rdi], al
mov byte [rdi + 1], r10b
mov byte [rdi + 2], r9b
mov eax, r8d
shr eax, 0x18
mov byte [rdi + 3], al
mov eax, r8d
shr eax, 0x10
shr r8d, 8
mov byte [rdi + 4], al
mov byte [rdi + 5], r8b
mov byte [rdi + 6], dl
mov dword [r15], ebx
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.1800acfa0
mov rbx, qword [rsp + 0x90]
add rsp, 0x50
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x1801d80e0
Capabilities:
Encode data using xor
Encrypt data using blowfish
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
mov eax, 0x20
call fcn.1800b9c10
sub rsp, rax
mov ebx, edx
mov rsi, r8
lea rdx, [0x1802a5bd0]
mov r8d, 0x1048
mov rdi, rcx
call fcn.1800acfd0
mov eax, 0x48
mov rdx, rsi
cmp ebx, eax
cmovg ebx, eax
movsxd r8, ebx
add r8, rsi
xor ebx, ebx
mov r9d, ebx
nop word [rax + rax]
movzx ecx, byte [rdx]
inc rdx
cmp rdx, r8
cmovae rdx, rsi
shl ecx, 8
movzx eax, byte [rdx]
inc rdx
or ecx, eax
cmp rdx, r8
cmovae rdx, rsi
shl ecx, 8
movzx eax, byte [rdx]
inc rdx
or ecx, eax
cmp rdx, r8
cmovae rdx, rsi
shl ecx, 8
movzx eax, byte [rdx]
inc rdx
or ecx, eax
cmp rdx, r8
cmovae rdx, rsi
xor dword [rdi + r9*4], ecx
inc r9
cmp r9, 0x12
jl 0x1801d8130
mov qword [rsp + 0x30], rbx
mov rsi, rbx
nop dword [rax + rax]
lea rcx, [rsp + 0x30]
mov rdx, rdi
call fcn.1801d6d00
mov eax, dword [rsp + 0x30]
add rsi, 2
mov dword [rdi + rsi*4 - 8], eax
mov eax, dword [rsp + 0x34]
mov dword [rdi + rsi*4 - 4], eax
cmp rsi, 0x12
jl 0x1801d8190
nop word [rax + rax]
lea rcx, [rsp + 0x30]
mov rdx, rdi
call fcn.1801d6d00
mov eax, dword [rsp + 0x30]
add rbx, 2
mov dword [rdi + rbx*4 + 0x40], eax
mov eax, dword [rsp + 0x34]
mov dword [rdi + rbx*4 + 0x44], eax
cmp rbx, 0x400
jl 0x1801d81c0
mov rbx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x1801d8d50
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov rbp, rsp
mov eax, 0x50
call fcn.1800b9c10
sub rsp, rax
mov rax, qword [0x1802e4710]
xor rax, rsp
mov qword [rbp - 8], rax
mov rax, qword [rbp + 0x60]
mov r15, qword [rbp + 0x68]
mov rsi, rcx
movzx r10d, byte [rax]
mov ebx, dword [r15]
lea rdi, [rax + 1]
movzx ecx, byte [rdi + 6]
mov qword [rbp - 0x18], rax
movzx eax, byte [rdi]
shl eax, 8
mov r14, rdx
movzx edx, byte [rdi + 3]
or r10d, eax
movzx eax, byte [rdi + 1]
shl ecx, 8
shl eax, 0x10
mov r12d, r8d
lea r8, [rdi + 5]
or r10d, eax
movzx eax, byte [rdi + 2]
xor r13d, r13d
shl eax, 0x18
mov qword [rbp - 0x28], r9
mov qword [rbp - 0x20], r15
or r10d, eax
movzx eax, byte [rdi + 4]
shl eax, 8
mov dword [rbp - 0x30], r10d
mov byte [rbp - 0x10], r10b
or edx, eax
movzx eax, byte [r8]
or ecx, eax
mov eax, r10d
shr eax, 8
shl ecx, 0x10
mov byte [rbp - 0xf], al
or edx, ecx
mov eax, r10d
shr eax, 0x10
mov dword [rbp - 0x2c], edx
mov byte [rbp - 0xc], dl
mov byte [rbp - 0xe], al
mov eax, r10d
shr eax, 0x18
mov byte [rbp - 0xd], al
mov eax, edx
shr eax, 8
mov byte [rbp - 0xb], al
mov eax, edx
shr eax, 0x10
mov byte [rbp - 0xa], al
mov eax, edx
shr eax, 0x18
mov byte [rbp - 9], al
test r12d, r12d
je 0x1801d8f04
mov r15, qword [rbp - 0x28]
sub r14, rsi
movzx r8d, dl
movzx r9d, r10b
dec r12d
test ebx, ebx
jne 0x1801d8ea4
lea rcx, [rbp - 0x30]
mov rdx, r15
call fcn.1801d8200
mov r10d, dword [rbp - 0x30]
mov edx, dword [rbp - 0x2c]
movzx r9d, byte [rbp - 0x30]
movzx r8d, byte [rbp - 0x2c]
mov eax, r10d
shr eax, 8
mov byte [rbp - 0x10], r9b
mov byte [rbp - 0xc], r8b
mov byte [rbp - 0xf], al
mov eax, r10d
shr eax, 0x10
mov byte [rbp - 0xe], al
mov eax, r10d
shr eax, 0x18
mov byte [rbp - 0xd], al
mov eax, edx
shr eax, 8
mov byte [rbp - 0xb], al
mov eax, edx
shr eax, 0x10
mov byte [rbp - 0xa], al
mov eax, edx
shr eax, 0x18
inc r13d
mov byte [rbp - 9], al
movsxd rax, ebx
inc rsi
movzx ecx, byte [rbp + rax - 0x10]
xor cl, byte [rsi - 1]
inc ebx
mov byte [r14 + rsi - 1], cl
and ebx, 7
test r12d, r12d
jne 0x1801d8e42
mov r15, qword [rbp - 0x20]
test r13d, r13d
je 0x1801d8f04
mov rax, qword [rbp - 0x18]
mov byte [rax], r9b
mov eax, r10d
shr eax, 8
mov byte [rdi], al
mov eax, r10d
shr r10d, 0x18
shr eax, 0x10
mov byte [rdi + 1], al
mov byte [rdi + 2], r10b
mov byte [rdi + 3], r8b
mov eax, edx
shr eax, 8
mov byte [rdi + 4], al
mov eax, edx
shr eax, 0x10
shr edx, 0x18
mov byte [rdi + 5], al
mov byte [rdi + 6], dl
mov dword [r15], ebx
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.1800acfa0
mov rbx, qword [rsp + 0x90]
add rsp, 0x50
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret