joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180001de3
Capabilities:
Encrypt data using rc4 prga

Disassembly:
jmp 0x180063510
mov qword [rsp + 8], rcx
push rsi
push rdi
sub rsp, 0xa8
cmp qword [0x180640a80], 0
jne 0x180063624
lea rax, [rsp + 0x60]
lea rcx, str.LdikcdYmdlin_EyDzoydojxoo_f
mov rdi, rax
mov rsi, rcx
mov ecx, 0x3c
rep movsb byte [rdi], byte [rsi]
mov eax, 2
imul rax, rax, 0x1d
movzx eax, word [rsp + rax + 0x60]
test eax, eax
je 0x180063561
mov dword [rsp + 0x2c], 1
jmp 0x180063569
mov dword [rsp + 0x2c], 0
movzx eax, byte [rsp + 0x2c]
mov byte [rsp + 0x21], al
movzx eax, byte [rsp + 0x21]
movzx eax, al
test eax, eax
je 0x1800635cc
mov dword [rsp + 0x24], 0
jmp 0x180063592
mov eax, dword [rsp + 0x24]
inc eax
mov dword [rsp + 0x24], eax
cmp dword [rsp + 0x24], 0x1e
jge 0x1800635cc
movsxd rax, dword [rsp + 0x24]
movzx eax, word [rsp + rax*2 + 0x60]
mov dword [rsp + 0x30], eax
mov eax, dword [rsp + 0x24]
cdq
mov ecx, 3
idiv ecx
mov eax, edx
add eax, 0xa
mov ecx, dword [rsp + 0x30]
xor ecx, eax
mov eax, ecx
movsxd rcx, dword [rsp + 0x24]
mov word [rsp + rcx*2 + 0x60], ax
jmp 0x180063588
lea rax, [rsp + 0x60]
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
xor r9d, r9d
mov r8, rax
xor edx, edx
xor ecx, ecx
call fcn.180002662
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x48]
mov qword [0x180640a80], rax
mov dword [rsp + 0x28], 0
jmp 0x18006360f
mov eax, dword [rsp + 0x28]
inc eax
mov dword [rsp + 0x28], eax
cmp dword [rsp + 0x28], 0x1e
jge 0x180063624
movsxd rax, dword [rsp + 0x28]
xor ecx, ecx
mov word [rsp + rax*2 + 0x60], cx
jmp 0x180063605
lea rax, [rsp + 0x20]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
mov rax, qword [0x180640a80]
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0xc0]
mov rax, qword [rax]
mov qword [rsp + 0x38], rax
cmp qword [rsp + 0x38], 0
je 0x180063687
mov eax, 8
imul rax, rax, 0x4f
mov rcx, qword [rsp + 0x38]
mov rax, qword [rcx + rax]
mov qword [rsp + 0x58], rax
lea r8, [rsp + 0x20]
mov rdx, qword [rsp + 0x50]
mov rcx, qword [rsp + 0xc0]
call qword [rsp + 0x58]
nop
movzx eax, byte [rsp + 0x20]
add rsp, 0xa8
pop rdi
pop rsi
ret
Function at 0x180001fa0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
jmp 0x1800566d0
mov byte [rsp + 0x10], dl
mov qword [rsp + 8], rcx
push rsi
push rdi
sub rsp, 0xb8
cmp qword [0x180640ac0], 0
jne 0x1800567e8
lea rax, [rsp + 0x60]
lea rcx, [0x1802877a0]
mov rdi, rax
mov rsi, rcx
mov ecx, 0x50
rep movsb byte [rdi], byte [rsi]
mov eax, 2
imul rax, rax, 0x27
movzx eax, word [rsp + rax + 0x60]
test eax, eax
je 0x180056725
mov dword [rsp + 0x2c], 1
jmp 0x18005672d
mov dword [rsp + 0x2c], 0
movzx eax, byte [rsp + 0x2c]
mov byte [rsp + 0x20], al
movzx eax, byte [rsp + 0x20]
movzx eax, al
test eax, eax
je 0x180056790
mov dword [rsp + 0x24], 0
jmp 0x180056756
mov eax, dword [rsp + 0x24]
inc eax
mov dword [rsp + 0x24], eax
cmp dword [rsp + 0x24], 0x28
jge 0x180056790
movsxd rax, dword [rsp + 0x24]
movzx eax, word [rsp + rax*2 + 0x60]
mov dword [rsp + 0x30], eax
mov eax, dword [rsp + 0x24]
cdq
mov ecx, 3
idiv ecx
mov eax, edx
add eax, 0xa
mov ecx, dword [rsp + 0x30]
xor ecx, eax
mov eax, ecx
movsxd rcx, dword [rsp + 0x24]
mov word [rsp + rcx*2 + 0x60], ax
jmp 0x18005674c
lea rax, [rsp + 0x60]
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
xor r9d, r9d
mov r8, rax
xor edx, edx
xor ecx, ecx
call fcn.180002662
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x48]
mov qword [0x180640ac0], rax
mov dword [rsp + 0x28], 0
jmp 0x1800567d3
mov eax, dword [rsp + 0x28]
inc eax
mov dword [rsp + 0x28], eax
cmp dword [rsp + 0x28], 0x28
jge 0x1800567e8
movsxd rax, dword [rsp + 0x28]
xor ecx, ecx
mov word [rsp + rax*2 + 0x60], cx
jmp 0x1800567c9
movzx eax, byte [rsp + 0xd8]
mov byte [rsp + 0x21], al
mov rax, qword [0x180640ac0]
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0xd0]
mov rax, qword [rax]
mov qword [rsp + 0x38], rax
cmp qword [rsp + 0x38], 0
je 0x180056846
mov eax, 8
imul rax, rax, 0x4f
mov rcx, qword [rsp + 0x38]
mov rax, qword [rcx + rax]
mov qword [rsp + 0x58], rax
lea r8, [rsp + 0x21]
mov rdx, qword [rsp + 0x50]
mov rcx, qword [rsp + 0xd0]
call qword [rsp + 0x58]
nop
add rsp, 0xb8
pop rdi
pop rsi
ret
Function at 0x1800020d1
Capabilities:
Encrypt data using rc4 prga

Disassembly:
jmp 0x180071390
mov byte [rsp + 0x10], dl
mov qword [rsp + 8], rcx
push rsi
push rdi
sub rsp, 0xb8
cmp qword [0x180640cb0], 0
jne 0x1800714a8
lea rax, [rsp + 0x60]
lea rcx, [0x180288230]
mov rdi, rax
mov rsi, rcx
mov ecx, 0x46
rep movsb byte [rdi], byte [rsi]
mov eax, 2
imul rax, rax, 0x22
movzx eax, word [rsp + rax + 0x60]
test eax, eax
je 0x1800713e5
mov dword [rsp + 0x2c], 1
jmp 0x1800713ed
mov dword [rsp + 0x2c], 0
movzx eax, byte [rsp + 0x2c]
mov byte [rsp + 0x20], al
movzx eax, byte [rsp + 0x20]
movzx eax, al
test eax, eax
je 0x180071450
mov dword [rsp + 0x24], 0
jmp 0x180071416
mov eax, dword [rsp + 0x24]
inc eax
mov dword [rsp + 0x24], eax
cmp dword [rsp + 0x24], 0x23
jge 0x180071450
movsxd rax, dword [rsp + 0x24]
movzx eax, word [rsp + rax*2 + 0x60]
mov dword [rsp + 0x30], eax
mov eax, dword [rsp + 0x24]
cdq
mov ecx, 3
idiv ecx
mov eax, edx
add eax, 0xa
mov ecx, dword [rsp + 0x30]
xor ecx, eax
mov eax, ecx
movsxd rcx, dword [rsp + 0x24]
mov word [rsp + rcx*2 + 0x60], ax
jmp 0x18007140c
lea rax, [rsp + 0x60]
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
xor r9d, r9d
mov r8, rax
xor edx, edx
xor ecx, ecx
call fcn.180002662
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x48]
mov qword [0x180640cb0], rax
mov dword [rsp + 0x28], 0
jmp 0x180071493
mov eax, dword [rsp + 0x28]
inc eax
mov dword [rsp + 0x28], eax
cmp dword [rsp + 0x28], 0x23
jge 0x1800714a8
movsxd rax, dword [rsp + 0x28]
xor ecx, ecx
mov word [rsp + rax*2 + 0x60], cx
jmp 0x180071489
movzx eax, byte [rsp + 0xd8]
mov byte [rsp + 0x21], al
mov rax, qword [0x180640cb0]
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0xd0]
mov rax, qword [rax]
mov qword [rsp + 0x38], rax
cmp qword [rsp + 0x38], 0
je 0x180071506
mov eax, 8
imul rax, rax, 0x4f
mov rcx, qword [rsp + 0x38]
mov rax, qword [rcx + rax]
mov qword [rsp + 0x58], rax
lea r8, [rsp + 0x21]
mov rdx, qword [rsp + 0x50]
mov rcx, qword [rsp + 0xd0]
call qword [rsp + 0x58]
nop
add rsp, 0xb8
pop rdi
pop rsi
ret
Function at 0x18000212b
Capabilities:
Resolve function by parsing pe exports

Disassembly:
jmp 0x1800f4e50
mov qword [rsp + 8], rcx
push rsi
push rdi
sub rsp, 0x98
mov rax, qword [rsp + 0xb0]
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x50]
xorps xmm0, xmm0
movss dword [rax + 4], xmm0
mov rax, qword [rsp + 0x50]
xorps xmm0, xmm0
movss dword [rax], xmm0
mov rax, qword [rsp + 0xb0]
add rax, 0x18
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x28]
xorps xmm0, xmm0
movss dword [rax + 0xc], xmm0
mov rax, qword [rsp + 0x28]
xorps xmm0, xmm0
movss dword [rax + 8], xmm0
mov rax, qword [rsp + 0x28]
xorps xmm0, xmm0
movss dword [rax + 4], xmm0
mov rax, qword [rsp + 0x28]
xorps xmm0, xmm0
movss dword [rax], xmm0
mov qword [rsp + 0x40], 0xc
mov rax, qword [rsp + 0xb0]
add rax, 0x2c
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x70], rax
mov rax, qword [rsp + 0x40]
dec rax
mov qword [rsp + 0x40], rax
cmp qword [rsp + 0x70], 0
jbe 0x1800f4f26
lea rax, [0x180005c3b]
mov qword [rsp + 0x78], rax
mov rcx, qword [rsp + 0x48]
call qword [rsp + 0x78]
mov rax, qword [rsp + 0x48]
add rax, 8
mov qword [rsp + 0x48], rax
jmp 0x1800f4ee2
mov rax, qword [rsp + 0xb0]
mov qword [rax + 8], 0
mov rax, qword [rsp + 0xb0]
xorps xmm0, xmm0
movss dword [rax + 0x10], xmm0
mov rax, qword [rsp + 0xb0]
xorps xmm0, xmm0
movss dword [rax + 0x14], xmm0
movss xmm0, dword [0x1802b1114]
movss dword [rsp + 0x60], xmm0
movss xmm0, dword [0x1802b1114]
movss dword [rsp + 0x64], xmm0
movss xmm0, dword [0x1802b1108]
movss dword [rsp + 0x68], xmm0
movss xmm0, dword [0x1802b1108]
movss dword [rsp + 0x6c], xmm0
lea rax, [rsp + 0x60]
mov qword [rsp + 0x80], rax
mov rax, qword [rsp + 0xb0]
lea rdi, [rax + 0x18]
mov rsi, qword [rsp + 0x80]
mov ecx, 0x10
rep movsb byte [rdi], byte [rsi]
mov rax, qword [rsp + 0xb0]
mov dword [rax + 0x28], 0
mov dword [rsp + 0x20], 0
jmp 0x1800f4fd9
mov eax, dword [rsp + 0x20]
inc eax
mov dword [rsp + 0x20], eax
cmp dword [rsp + 0x20], 0xc
jge 0x1800f5089
cvtsi2ss xmm0, dword [rsp + 0x20]
mulss xmm0, dword [0x18028a7f4]
mulss xmm0, dword [0x18029771c]
divss xmm0, dword [0x18028abac]
movss dword [rsp + 0x24], xmm0
movss xmm0, dword [rsp + 0x24]
call fcn.180004732
movss dword [rsp + 0x30], xmm0
movss xmm0, dword [rsp + 0x30]
movss dword [rsp + 0x3c], xmm0
movss xmm0, dword [rsp + 0x24]
call fcn.180002504
movss dword [rsp + 0x34], xmm0
movss xmm0, dword [rsp + 0x34]
movss dword [rsp + 0x38], xmm0
movss xmm0, dword [rsp + 0x38]
movss dword [rsp + 0x58], xmm0
movss xmm0, dword [rsp + 0x3c]
movss dword [rsp + 0x5c], xmm0
lea rax, [rsp + 0x58]
mov qword [rsp + 0x88], rax
mov rax, qword [rsp + 0x88]
mov rax, qword [rax]
movsxd rcx, dword [rsp + 0x20]
mov rdx, qword [rsp + 0xb0]
mov qword [rdx + rcx*8 + 0x2c], rax
jmp 0x1800f4fcf
mov rax, qword [rsp + 0xb0]
add rsp, 0x98
pop rdi
pop rsi
ret
Function at 0x180002153
Capabilities:
Print debug messages

Disassembly:
jmp 0x180255dbc
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov edi, r8d
mov rbp, rdx
mov rbx, rcx
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
setne sil
test eax, eax
je 0x180255e08
test rbx, rbx
je 0x180255df7
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
call fcn.18000243c
cmp eax, 1
je 0x180255e08
mov eax, 4
jmp 0x180255e4b
call fcn.180007ad1
cmp eax, 2
jne 0x180255e44
call fcn.180002518
test al, al
je 0x180255e44
call fcn.180005579
test al, al
jne 0x180255e3a
bts edi, 0x15
xor ecx, ecx
mov rdx, rbx
mov r8, rbp
mov r9d, edi
call fcn.180007b49
jmp 0x180255e4b
call fcn.180007806
mov rcx, rax
jmp 0x180255e2a
movzx eax, sil
add eax, 3
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret

Function at 0x1800021e4
Capabilities:
Encrypt data using rc4 prga

Disassembly:
jmp 0x1800568b0
mov byte [rsp + 0x10], dl
mov qword [rsp + 8], rcx
push rsi
push rdi
sub rsp, 0xb8
cmp qword [0x180640ad0], 0
jne 0x1800569c8
lea rax, [rsp + 0x60]
lea rcx, str.LdikcdYmdlin_IdjnfnMf
mov rdi, rax
mov rsi, rcx
mov ecx, 0x4e
rep movsb byte [rdi], byte [rsi]
mov eax, 2
imul rax, rax, 0x26
movzx eax, word [rsp + rax + 0x60]
test eax, eax
je 0x180056905
mov dword [rsp + 0x2c], 1
jmp 0x18005690d
mov dword [rsp + 0x2c], 0
movzx eax, byte [rsp + 0x2c]
mov byte [rsp + 0x20], al
movzx eax, byte [rsp + 0x20]
movzx eax, al
test eax, eax
je 0x180056970
mov dword [rsp + 0x24], 0
jmp 0x180056936
mov eax, dword [rsp + 0x24]
inc eax
mov dword [rsp + 0x24], eax
cmp dword [rsp + 0x24], 0x27
jge 0x180056970
movsxd rax, dword [rsp + 0x24]
movzx eax, word [rsp + rax*2 + 0x60]
mov dword [rsp + 0x30], eax
mov eax, dword [rsp + 0x24]
cdq
mov ecx, 3
idiv ecx
mov eax, edx
add eax, 0xa
mov ecx, dword [rsp + 0x30]
xor ecx, eax
mov eax, ecx
movsxd rcx, dword [rsp + 0x24]
mov word [rsp + rcx*2 + 0x60], ax
jmp 0x18005692c
lea rax, [rsp + 0x60]
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
xor r9d, r9d
mov r8, rax
xor edx, edx
xor ecx, ecx
call fcn.180002662
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x48]
mov qword [0x180640ad0], rax
mov dword [rsp + 0x28], 0
jmp 0x1800569b3
mov eax, dword [rsp + 0x28]
inc eax
mov dword [rsp + 0x28], eax
cmp dword [rsp + 0x28], 0x27
jge 0x1800569c8
movsxd rax, dword [rsp + 0x28]
xor ecx, ecx
mov word [rsp + rax*2 + 0x60], cx
jmp 0x1800569a9
movzx eax, byte [rsp + 0xd8]
mov byte [rsp + 0x21], al
mov rax, qword [0x180640ad0]
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0xd0]
mov rax, qword [rax]
mov qword [rsp + 0x38], rax
cmp qword [rsp + 0x38], 0
je 0x180056a26
mov eax, 8
imul rax, rax, 0x4f
mov rcx, qword [rsp + 0x38]
mov rax, qword [rcx + rax]
mov qword [rsp + 0x58], rax
lea r8, [rsp + 0x21]
mov rdx, qword [rsp + 0x50]
mov rcx, qword [rsp + 0xd0]
call qword [rsp + 0x58]
nop
add rsp, 0xb8
pop rdi
pop rsi
ret
Function at 0x1800021f3
Capabilities:
Resolve function by parsing pe exports

Disassembly:
jmp 0x180105ac0
movss dword [rsp + 0x20], xmm3
movss dword [rsp + 0x18], xmm2
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x68
movss xmm0, dword [rsp + 0x80]
ucomiss xmm0, dword [0x18028a57c]
jp 0x180105b13
jne 0x180105b13
mov rax, qword [rsp + 0x70]
add rax, 0x80
mov qword [rsp + 0x40], rax
mov rdx, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x40]
call fcn.1800037ab
nop
jmp 0x180105c61
mov rax, qword [rsp + 0x70]
add rax, 0x80
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x70]
mov eax, dword [rax + 0x80]
mov ecx, dword [rsp + 0x98]
lea eax, [rcx + rax + 1]
mov edx, eax
mov rcx, qword [rsp + 0x48]
call fcn.18000592f
nop
mov dword [rsp + 0x20], 0
jmp 0x180105b5a
mov eax, dword [rsp + 0x20]
inc eax
mov dword [rsp + 0x20], eax
mov eax, dword [rsp + 0x98]
cmp dword [rsp + 0x20], eax
jg 0x180105c61
cvtsi2ss xmm0, dword [rsp + 0x20]
cvtsi2ss xmm1, dword [rsp + 0x98]
divss xmm0, xmm1
movss xmm1, dword [rsp + 0x90]
subss xmm1, dword [rsp + 0x88]
mulss xmm0, xmm1
movss xmm1, dword [rsp + 0x88]
addss xmm1, xmm0
movaps xmm0, xmm1
movss dword [rsp + 0x24], xmm0
mov rax, qword [rsp + 0x70]
add rax, 0x80
mov qword [rsp + 0x58], rax
movss xmm0, dword [rsp + 0x24]
call fcn.180004732
movss dword [rsp + 0x28], xmm0
movss xmm0, dword [rsp + 0x28]
mulss xmm0, dword [rsp + 0x80]
mov rax, qword [rsp + 0x78]
movss xmm1, dword [rax + 4]
addss xmm1, xmm0
movaps xmm0, xmm1
movss dword [rsp + 0x34], xmm0
movss xmm0, dword [rsp + 0x24]
call fcn.180002504
movss dword [rsp + 0x2c], xmm0
movss xmm0, dword [rsp + 0x2c]
mulss xmm0, dword [rsp + 0x80]
mov rax, qword [rsp + 0x78]
movss xmm1, dword [rax]
addss xmm1, xmm0
movaps xmm0, xmm1
movss dword [rsp + 0x30], xmm0
movss xmm0, dword [rsp + 0x30]
movss dword [rsp + 0x38], xmm0
movss xmm0, dword [rsp + 0x34]
movss dword [rsp + 0x3c], xmm0
lea rax, [rsp + 0x38]
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x50]
mov rdx, rax
mov rcx, qword [rsp + 0x58]
call fcn.1800037ab
nop
jmp 0x180105b50
add rsp, 0x68
ret
Function at 0x180002338
Capabilities:
Encrypt data using rc4 prga

Disassembly:
jmp 0x180061a40
mov qword [rsp + 8], rcx
push rsi
push rdi
sub rsp, 0xd8
cmp qword [0x180640a00], 0
jne 0x180061b54
lea rax, [rsp + 0x60]
lea rcx, str.LdikcdYmdlinBxofHomedbxcdb_CmyGemcxnemcxZyc_nob_o_v
mov rdi, rax
mov rsi, rcx
mov ecx, 0x70
rep movsb byte [rdi], byte [rsi]
mov eax, 2
imul rax, rax, 0x37
movzx eax, word [rsp + rax + 0x60]
test eax, eax
je 0x180061a91
mov dword [rsp + 0x2c], 1
jmp 0x180061a99
mov dword [rsp + 0x2c], 0
movzx eax, byte [rsp + 0x2c]
mov byte [rsp + 0x21], al
movzx eax, byte [rsp + 0x21]
movzx eax, al
test eax, eax
je 0x180061afc
mov dword [rsp + 0x24], 0
jmp 0x180061ac2
mov eax, dword [rsp + 0x24]
inc eax
mov dword [rsp + 0x24], eax
cmp dword [rsp + 0x24], 0x38
jge 0x180061afc
movsxd rax, dword [rsp + 0x24]
movzx eax, word [rsp + rax*2 + 0x60]
mov dword [rsp + 0x30], eax
mov eax, dword [rsp + 0x24]
cdq
mov ecx, 3
idiv ecx
mov eax, edx
add eax, 0xa
mov ecx, dword [rsp + 0x30]
xor ecx, eax
mov eax, ecx
movsxd rcx, dword [rsp + 0x24]
mov word [rsp + rcx*2 + 0x60], ax
jmp 0x180061ab8
lea rax, [rsp + 0x60]
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
xor r9d, r9d
mov r8, rax
xor edx, edx
xor ecx, ecx
call fcn.180002662
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x48]
mov qword [0x180640a00], rax
mov dword [rsp + 0x28], 0
jmp 0x180061b3f
mov eax, dword [rsp + 0x28]
inc eax
mov dword [rsp + 0x28], eax
cmp dword [rsp + 0x28], 0x38
jge 0x180061b54
movsxd rax, dword [rsp + 0x28]
xor ecx, ecx
mov word [rsp + rax*2 + 0x60], cx
jmp 0x180061b35
mov byte [rsp + 0x20], 1
mov rax, qword [0x180640a00]
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0xf0]
mov rax, qword [rax]
mov qword [rsp + 0x38], rax
cmp qword [rsp + 0x38], 0
je 0x180061bab
mov eax, 8
imul rax, rax, 0x4f
mov rcx, qword [rsp + 0x38]
mov rax, qword [rcx + rax]
mov qword [rsp + 0x58], rax
lea r8, [rsp + 0x20]
mov rdx, qword [rsp + 0x50]
mov rcx, qword [rsp + 0xf0]
call qword [rsp + 0x58]
nop
movzx eax, byte [rsp + 0x20]
add rsp, 0xd8
pop rdi
pop rsi
ret
Function at 0x180002455
Capabilities:
Encrypt data using rc4 prga

Disassembly:
jmp 0x180065710
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rsi
push rdi
sub rsp, 0xc8
cmp qword [0x180640700], 0
jne 0x18006582e
lea rax, [rsp + 0x60]
lea rcx, str.Ijbj
mov rdi, rax
mov rsi, rcx
mov ecx, 0x24
rep movsb byte [rdi], byte [rsi]
mov eax, 2
imul rax, rax, 0x11
movzx eax, word [rsp + rax + 0x60]
test eax, eax
je 0x18006576b
mov dword [rsp + 0x2c], 1
jmp 0x180065773
mov dword [rsp + 0x2c], 0
movzx eax, byte [rsp + 0x2c]
mov byte [rsp + 0x20], al
movzx eax, byte [rsp + 0x20]
movzx eax, al
test eax, eax
je 0x1800657d6
mov dword [rsp + 0x24], 0
jmp 0x18006579c
mov eax, dword [rsp + 0x24]
inc eax
mov dword [rsp + 0x24], eax
cmp dword [rsp + 0x24], 0x12
jge 0x1800657d6
movsxd rax, dword [rsp + 0x24]
movzx eax, word [rsp + rax*2 + 0x60]
mov dword [rsp + 0x30], eax
mov eax, dword [rsp + 0x24]
cdq
mov ecx, 3
idiv ecx
mov eax, edx
add eax, 0xa
mov ecx, dword [rsp + 0x30]
xor ecx, eax
mov eax, ecx
movsxd rcx, dword [rsp + 0x24]
mov word [rsp + rcx*2 + 0x60], ax
jmp 0x180065792
lea rax, [rsp + 0x60]
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
xor r9d, r9d
mov r8, rax
xor edx, edx
xor ecx, ecx
call fcn.180002662
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x48]
mov qword [0x180640700], rax
mov dword [rsp + 0x28], 0
jmp 0x180065819
mov eax, dword [rsp + 0x28]
inc eax
mov dword [rsp + 0x28], eax
cmp dword [rsp + 0x28], 0x12
jge 0x18006582e
movsxd rax, dword [rsp + 0x28]
xor ecx, ecx
mov word [rsp + rax*2 + 0x60], cx
jmp 0x18006580f
lea rax, [rsp + 0x88]
mov rdi, rax
mov rsi, qword [rsp + 0xf0]
mov ecx, 0x18
rep movsb byte [rdi], byte [rsi]
xorps xmm0, xmm0
movsd qword [rsp + 0xa0], xmm0
xorps xmm0, xmm0
movsd qword [rsp + 0xa8], xmm0
xorps xmm0, xmm0
movsd qword [rsp + 0xb0], xmm0
mov rax, qword [0x180640700]
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0xe0]
mov rax, qword [rax]
mov qword [rsp + 0x38], rax
cmp qword [rsp + 0x38], 0
je 0x1800658c1
mov eax, 8
imul rax, rax, 0x4f
mov rcx, qword [rsp + 0x38]
mov rax, qword [rcx + rax]
mov qword [rsp + 0x58], rax
lea r8, [rsp + 0x88]
mov rdx, qword [rsp + 0x50]
mov rcx, qword [rsp + 0xe0]
call qword [rsp + 0x58]
nop
lea rax, [rsp + 0xa0]
mov rdi, qword [rsp + 0xe8]
mov rsi, rax
mov ecx, 0x18
rep movsb byte [rdi], byte [rsi]
mov rax, qword [rsp + 0xe8]
add rsp, 0xc8
pop rdi
pop rsi
ret
Function at 0x1800024b4
Capabilities:
Encrypt data using rc4 prga

Disassembly:
jmp 0x180063ad0
mov qword [rsp + 8], rcx
push rsi
push rdi
sub rsp, 0x98
cmp qword [0x180640b10], 0
jne 0x180063be4
lea rax, [rsp + 0x60]
lea rcx, str.Ldikcd_EyYifdmnbbm_v
mov rdi, rax
mov rsi, rcx
mov ecx, 0x2e
rep movsb byte [rdi], byte [rsi]
mov eax, 2
imul rax, rax, 0x16
movzx eax, word [rsp + rax + 0x60]
test eax, eax
je 0x180063b21
mov dword [rsp + 0x2c], 1
jmp 0x180063b29
mov dword [rsp + 0x2c], 0
movzx eax, byte [rsp + 0x2c]
mov byte [rsp + 0x21], al
movzx eax, byte [rsp + 0x21]
movzx eax, al
test eax, eax
je 0x180063b8c
mov dword [rsp + 0x24], 0
jmp 0x180063b52
mov eax, dword [rsp + 0x24]
inc eax
mov dword [rsp + 0x24], eax
cmp dword [rsp + 0x24], 0x17
jge 0x180063b8c
movsxd rax, dword [rsp + 0x24]
movzx eax, word [rsp + rax*2 + 0x60]
mov dword [rsp + 0x30], eax
mov eax, dword [rsp + 0x24]
cdq
mov ecx, 3
idiv ecx
mov eax, edx
add eax, 0xa
mov ecx, dword [rsp + 0x30]
xor ecx, eax
mov eax, ecx
movsxd rcx, dword [rsp + 0x24]
mov word [rsp + rcx*2 + 0x60], ax
jmp 0x180063b48
lea rax, [rsp + 0x60]
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
xor r9d, r9d
mov r8, rax
xor edx, edx
xor ecx, ecx
call fcn.180002662
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x48]
mov qword [0x180640b10], rax
mov dword [rsp + 0x28], 0
jmp 0x180063bcf
mov eax, dword [rsp + 0x28]
inc eax
mov dword [rsp + 0x28], eax
cmp dword [rsp + 0x28], 0x17
jge 0x180063be4
movsxd rax, dword [rsp + 0x28]
xor ecx, ecx
mov word [rsp + rax*2 + 0x60], cx
jmp 0x180063bc5
lea rax, [rsp + 0x20]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
mov rax, qword [0x180640b10]
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0xb0]
mov rax, qword [rax]
mov qword [rsp + 0x38], rax
cmp qword [rsp + 0x38], 0
je 0x180063c47
mov eax, 8
imul rax, rax, 0x4f
mov rcx, qword [rsp + 0x38]
mov rax, qword [rcx + rax]
mov qword [rsp + 0x58], rax
lea r8, [rsp + 0x20]
mov rdx, qword [rsp + 0x50]
mov rcx, qword [rsp + 0xb0]
call qword [rsp + 0x58]
nop
movzx eax, byte [rsp + 0x20]
add rsp, 0x98
pop rdi
pop rsi
ret
Function at 0x180002513
Capabilities:
Encrypt data using rc4 prga

Disassembly:
jmp 0x18005bd20
mov qword [rsp + 8], rcx
push rsi
push rdi
sub rsp, 0xa8
cmp qword [0x180640cd0], 0
jne 0x18005be34
lea rax, [rsp + 0x60]
lea rcx, [0x1802882c8]
mov rdi, rax
mov rsi, rcx
mov ecx, 0x36
rep movsb byte [rdi], byte [rsi]
mov eax, 2
imul rax, rax, 0x1a
movzx eax, word [rsp + rax + 0x60]
test eax, eax
je 0x18005bd71
mov dword [rsp + 0x2c], 1
jmp 0x18005bd79
mov dword [rsp + 0x2c], 0
movzx eax, byte [rsp + 0x2c]
mov byte [rsp + 0x20], al
movzx eax, byte [rsp + 0x20]
movzx eax, al
test eax, eax
je 0x18005bddc
mov dword [rsp + 0x24], 0
jmp 0x18005bda2
mov eax, dword [rsp + 0x24]
inc eax
mov dword [rsp + 0x24], eax
cmp dword [rsp + 0x24], 0x1b
jge 0x18005bddc
movsxd rax, dword [rsp + 0x24]
movzx eax, word [rsp + rax*2 + 0x60]
mov dword [rsp + 0x34], eax
mov eax, dword [rsp + 0x24]
cdq
mov ecx, 3
idiv ecx
mov eax, edx
add eax, 0xa
mov ecx, dword [rsp + 0x34]
xor ecx, eax
mov eax, ecx
movsxd rcx, dword [rsp + 0x24]
mov word [rsp + rcx*2 + 0x60], ax
jmp 0x18005bd98
lea rax, [rsp + 0x60]
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
xor r9d, r9d
mov r8, rax
xor edx, edx
xor ecx, ecx
call fcn.180002662
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x48]
mov qword [0x180640cd0], rax
mov dword [rsp + 0x28], 0
jmp 0x18005be1f
mov eax, dword [rsp + 0x28]
inc eax
mov dword [rsp + 0x28], eax
cmp dword [rsp + 0x28], 0x1b
jge 0x18005be34
movsxd rax, dword [rsp + 0x28]
xor ecx, ecx
mov word [rsp + rax*2 + 0x60], cx
jmp 0x18005be15
lea rax, [rsp + 0x30]
mov rdi, rax
xor eax, eax
mov ecx, 4
rep stosb byte [rdi], al
mov rax, qword [0x180640cd0]
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0xc0]
mov rax, qword [rax]
mov qword [rsp + 0x38], rax
cmp qword [rsp + 0x38], 0
je 0x18005be97
mov eax, 8
imul rax, rax, 0x4f
mov rcx, qword [rsp + 0x38]
mov rax, qword [rcx + rax]
mov qword [rsp + 0x58], rax
lea r8, [rsp + 0x30]
mov rdx, qword [rsp + 0x50]
mov rcx, qword [rsp + 0xc0]
call qword [rsp + 0x58]
nop
movss xmm0, dword [rsp + 0x30]
add rsp, 0xa8
pop rdi
pop rsi
ret