joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1800f5cf0
Capabilities:
Encode data using xor

Disassembly:
mov rax, rsp
push rbp
mov rbp, rsp
sub rsp, 0x70
mov qword [rbp - 0x40], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r14
mov rbx, r9
mov rdi, r8
mov rsi, rdx
mov r14, rcx
mov r9, qword [rbp + 0x30]
mov r8d, dword [rbx + 0x20]
mov edx, dword [rbx + 0x24]
lea rcx, [rbp - 0x20]
call fcn.1800f5c40
nop
mov eax, dword [rbx + 0x20]
lea r8, [rbx + 8]
mov dword [rsp + 0x20], eax
mov r9d, dword [rbx + 0x24]
mov rdx, rdi
lea rcx, [rbp - 0x38]
call fcn.1800f5ed0
nop
mov rax, qword [rbp - 0x30]
mov r11, qword [rbp - 0x38]
sub rax, r11
mov rdx, qword [rbp - 0x18]
mov r10, qword [rbp - 0x20]
sub rdx, r10
cmp rax, rdx
jae 0x1800f5d7c
lea rcx, [rbp - 0x38]
call fcn.180036440
mov r10, qword [rbp - 0x20]
mov r11, qword [rbp - 0x38]
mov r9, qword [rbp - 0x18]
sub r9, r10
mov r8, r10
mov rax, r11
cmp r9, 0x10
jb 0x1800f5dcb
mov r10, r9
shr r10, 4
imul rcx, r10, 0xfffffffffffffff0
add r9, rcx
nop dword [rax]
mov rdx, qword [rax]
xor rdx, qword [r8]
mov rcx, qword [rax + 8]
xor rcx, qword [r8 + 8]
mov qword [rax], rdx
mov qword [rax + 8], rcx
add rax, 0x10
add r8, 0x10
sub r10, 1
jne 0x1800f5da0
mov r10, qword [rbp - 0x20]
mov r11, qword [rbp - 0x38]
test r9, r9
je 0x1800f5df9
sub r8, rax
nop dword [rax]
nop word [rax + rax]
movzx ecx, byte [r8 + rax]
xor byte [rax], cl
lea rax, [rax + 1]
sub r9, 1
jne 0x1800f5de0
mov r10, qword [rbp - 0x20]
mov r11, qword [rbp - 0x38]
lea rax, [rbp - 0x38]
cmp r14, rax
je 0x1800f5e31
mov rax, qword [r14]
mov qword [r14], r11
mov r11, rax
mov qword [rbp - 0x38], rax
mov rcx, qword [r14 + 8]
mov rax, qword [rbp - 0x30]
mov qword [r14 + 8], rax
mov qword [rbp - 0x30], rcx
mov rdx, qword [r14 + 0x10]
mov rax, qword [rbp - 0x28]
mov qword [r14 + 0x10], rax
mov qword [rbp - 0x28], rdx
jmp 0x1800f5e35
mov rdx, qword [rbp - 0x28]
lea rax, [rbp - 0x20]
cmp rsi, rax
je 0x1800f5e6b
mov rax, qword [rsi]
mov qword [rsi], r10
mov r10, rax
mov qword [rbp - 0x20], rax
mov rcx, qword [rsi + 8]
mov rax, qword [rbp - 0x18]
mov qword [rsi + 8], rax
mov qword [rbp - 0x18], rcx
mov rcx, qword [rsi + 0x10]
mov rax, qword [rbp - 0x10]
mov qword [rsi + 0x10], rax
mov qword [rbp - 0x10], rcx
test r11, r11
je 0x1800f5e95
sub rdx, r11
mov r8d, 1
mov rcx, r11
call fcn.180033660
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x38], xmm0
mov qword [rbp - 0x28], 0
mov r10, qword [rbp - 0x20]
test r10, r10
je 0x1800f5eb0
mov rdx, qword [rbp - 0x10]
sub rdx, r10
mov r8d, 1
mov rcx, r10
call fcn.180033660
nop
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov r14, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret
Function at 0x1800f5ed0
Capabilities:
Encode data using xor

Disassembly:
mov dword [rsp + 0x20], r9d
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x78
mov qword [rsp + 0x48], 0xfffffffffffffffe
mov ebp, r9d
mov rsi, r8
mov rbx, rdx
xor r13d, r13d
mov dword [rsp + 0x30], r13d
cmp r9d, 0x80000000
jb 0x1800f5f18
lea edi, [r13 + 0x20]
jmp 0x1800f5f2f
mov rdi, r13
mov eax, 1
cmp r9d, eax
jbe 0x1800f5f2f
add eax, eax
inc rdi
cmp eax, r9d
jb 0x1800f5f25
imul edi, dword [rsp + 0xe0]
mov qword [rsp + 0x40], rdi
mov r15d, r9d
sub r15d, edi
mov dword [rsp + 0xe0], r15d
lea edx, [rdi - 1]
shr edx, 5
inc edx
shl rdx, 2
lea rcx, [rsp + 0x50]
call fcn.1800360e0
nop
mov rsi, qword [rsi]
mov r14, r13
mov r10d, r15d
mov qword [rsp + 0xd0], r10
mov ecx, r15d
shr rcx, 3
mov qword [rsp + 0x38], rcx
mov r12, qword [rsp + 0x58]
mov r15, qword [rsp + 0x50]
test rcx, rcx
je 0x1800f605c
mov rdi, r12
sub rdi, r15
mov r13, qword [rsp + 0xc8]
nop
mov ebx, 1
lea ebp, [rbx + 7]
nop dword [rax + rax]
mov rax, qword [r13]
test byte [r14 + rax], bl
je 0x1800f6021
mov r8, rdi
mov r9, rsi
mov rax, r15
cmp rdi, 0x10
jb 0x1800f6004
mov r11, rsi
sub r11, r15
mov r10, rdi
shr r10, 4
imul r8, r10, 0xfffffffffffffff0
add r8, rdi
nop dword [rax]
mov rdx, qword [rax]
xor rdx, qword [r9]
mov rcx, qword [rax + 8]
xor rcx, qword [r11 + rax + 8]
mov qword [rax], rdx
mov qword [rax + 8], rcx
add rax, 0x10
add r9, 0x10
sub r10, 1
jne 0x1800f5fe0
test r8, r8
je 0x1800f6021
sub r9, rax
nop dword [rax]
movzx ecx, byte [r9 + rax]
xor byte [rax], cl
lea rax, [rax + 1]
sub r8, 1
jne 0x1800f6010
add rsi, rdi
rol ebx, 1
sub rbp, 1
jne 0x1800f5fb0
inc r14
mov rcx, qword [rsp + 0x38]
cmp r14, rcx
jb 0x1800f5fa0
xor r13d, r13d
mov rbx, qword [rsp + 0xc8]
mov rdi, qword [rsp + 0x40]
mov ebp, dword [rsp + 0xd8]
mov r10, qword [rsp + 0xd0]
and r10d, 7
mov qword [rsp + 0xd0], r10
jbe 0x1800f6115
sub r12, r15
mov rax, qword [rbx]
movzx edx, byte [rcx + rax]
mov rcx, r13
mov eax, 1
shl eax, cl
test al, dl
je 0x1800f6101
mov r9, r12
mov r8, rsi
mov rdx, r15
cmp r12, 0x10
jb 0x1800f60dc
mov r11, rsi
sub r11, r15
mov r10, r12
shr r10, 4
imul r9, r10, 0xfffffffffffffff0
add r9, r12
nop dword [rax]
mov rcx, qword [rdx]
xor rcx, qword [r8]
mov rax, qword [rdx + 8]
xor rax, qword [r11 + rdx + 8]
mov qword [rdx], rcx
mov qword [rdx + 8], rax
add rdx, 0x10
add r8, 0x10
sub r10, 1
jne 0x1800f60b0
mov r10, qword [rsp + 0xd0]
test r9, r9
je 0x1800f6101
sub r8, rdx
nop dword [rax]
nop dword [rax + rax]
movzx eax, byte [rdx + r8]
xor byte [rdx], al
lea rdx, [rdx + 1]
sub r9, 1
jne 0x1800f60f0
add rsi, r12
inc r13
cmp r13, r10
mov rcx, qword [rsp + 0x38]
jb 0x1800f6071
mov dword [rsp + 0x20], edi
mov r9d, dword [rsp + 0xe0]
lea r8, [rsp + 0x50]
mov rdx, rbx
mov rbx, qword [rsp + 0xc0]
mov rcx, rbx
call fcn.1800f5ad0
mov dword [rsp + 0x30], 1
lea edx, [rbp + 7]
shr rdx, 3
mov rcx, rbx
call fcn.180036440
nop
mov rcx, qword [rsp + 0x50]
test rcx, rcx
je 0x1800f616f
mov rdx, qword [rsp + 0x60]
sub rdx, rcx
mov r8d, 1
call fcn.180033660
nop
mov rax, rbx
add rsp, 0x78
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x180100600
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 0x18], rbp
push rsi
movzx r9d, byte [rdx + r8 - 1]
xor r10d, r10d
cmp r9, r8
mov qword [rsp + 0x10], rbx
mov r11d, 1
mov rbp, r8
seta r10b
mov ecx, r11d
nop word [rax + rax]
mov rax, r10
shr rax, cl
add rcx, rcx
or r10, rax
cmp rcx, 0x40
jne 0x180100630
and r10d, r11d
lea rbx, [r8 - 1]
dec r10
mov rsi, rbp
sub rsi, r9
not r10
test rbx, rbx
je 0x1801006ea
mov qword [rsp + 0x18], rdi
lea rdi, [rdx - 1]
nop word [rax + rax]
movzx eax, byte [rdi + rbx + 1]
mov r8, r11
dec al
xor al, byte [rdi + rbx]
nop dword [rax]
movzx edx, al
movzx ecx, r8b
shr dl, cl
add r8, r8
or al, dl
cmp r8, 8
jne 0x180100680
and al, r11b
mov r9, r11
dec al
cmp rbx, rsi
seta r8b
nop dword [rax]
nop word [rax + rax]
movzx edx, r8b
movzx ecx, r9b
shr dl, cl
add r9, r9
or r8b, dl
cmp r9, 8
jne 0x1801006b0
and r8b, r11b
movzx eax, al
dec r8b
not eax
not r8b
cdqe
movzx edx, r8b
and rdx, rax
or r10, rdx
sub rbx, r11
jne 0x180100670
mov rdi, qword [rsp + 0x18]
mov rbx, qword [rsp + 0x10]
nop
mov rax, r10
mov rcx, r11
shr rax, cl
add r11, r11
or r10, rax
cmp r11, 0x40
jne 0x1801006f0
and r10d, 1
dec r10
not r10
mov rax, r10
and r10, rbp
mov rbp, qword [rsp + 0x20]
not rax
and rax, rsi
or rax, r10
pop rsi
ret

Function at 0x180100730
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 0x20], rbp
push r14
mov qword [rsp + 0x20], rdi
lea r14, [r8 - 1]
xor dil, dil
xor r11b, r11b
mov rbp, r8
mov r10d, 1
test r8, r8
je 0x1801007e3
mov qword [rsp + 0x10], rbx
lea rbx, [rdx - 1]
mov qword [rsp + 0x18], rsi
add rbx, r8
mov rsi, r8
nop dword [rax]
movzx eax, byte [rbx]
mov r9, r10
movzx r8d, al
xor r8b, 0x80
nop
movzx edx, r8b
movzx ecx, r9b
shr dl, cl
add r9, r9
or r8b, dl
cmp r9, 8
jne 0x180100780
and r8b, r10b
dec r8b
or r11b, r8b
mov r8, r10
movzx ecx, r11b
not cl
and ecx, r10d
sub r14, rcx
nop
movzx edx, al
movzx ecx, r8b
shr dl, cl
add r8, r8
or al, dl
cmp r8, 8
jne 0x1801007b0
and al, r10b
dec rbx
dec al
or al, r11b
not al
or dil, al
sub rsi, r10
jne 0x180100770
mov rsi, qword [rsp + 0x18]
mov rbx, qword [rsp + 0x10]
movzx eax, dil
not r11b
mov rdi, qword [rsp + 0x20]
movzx edx, r11b
or rdx, rax
nop word [rax + rax]
mov rax, rdx
mov rcx, r10
shr rax, cl
add r10, r10
or rdx, rax
cmp r10, 0x40
jne 0x180100800
and edx, 1
dec rdx
not rdx
mov rax, rdx
and rdx, rbp
mov rbp, qword [rsp + 0x28]
not rax
and rax, r14
or rax, rdx
pop r14
ret
Function at 0x180100840
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
movzx ebp, byte [rdx + r8 - 1]
xor r10d, r10d
cmp rbp, r8
mov r11d, 1
mov r14, r8
mov rsi, rdx
seta r10b
mov r9d, ebp
mov ecx, r11d
nop dword [rax + rax]
mov rax, r10
shr rax, cl
add rcx, rcx
or r10, rax
cmp rcx, 0x40
jne 0x180100880
and r10d, r11d
lea rbx, [r8 - 2]
dec r10
mov rdi, r14
sub rdi, r9
not r10
test rbx, rbx
je 0x180100930
nop
movzx eax, byte [rbx + rsi]
mov r8, r11
xor al, bpl
nop word [rax + rax]
movzx edx, al
movzx ecx, r8b
shr dl, cl
add r8, r8
or al, dl
cmp r8, 8
jne 0x1801008c0
and al, r11b
mov r9, r11
dec al
cmp rbx, rdi
setae r8b
nop dword [rax]
nop word [rax + rax]
movzx edx, r8b
movzx ecx, r9b
shr dl, cl
add r9, r9
or r8b, dl
cmp r9, 8
jne 0x1801008f0
and r8b, r11b
movzx eax, al
dec r8b
not eax
not r8b
cdqe
movzx edx, r8b
and rdx, rax
or r10, rdx
sub rbx, r11
jne 0x1801008b0
nop word [rax + rax]
mov rax, r10
mov rcx, r11
shr rax, cl
add r11, r11
or r10, rax
cmp r11, 0x40
jne 0x180100930
mov rbx, qword [rsp + 0x10]
and r10d, 1
mov rbp, qword [rsp + 0x18]
dec r10
mov rsi, qword [rsp + 0x20]
not r10
mov rax, r10
and r10, r14
not rax
and rax, rdi
mov rdi, qword [rsp + 0x28]
or rax, r10
pop r14
ret
Function at 0x180101030
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r15
sub rsp, 0x20
mov qword [rsp + 0x40], rbx
mov rsi, rcx
mov rbx, qword [rcx + 0x50]
mov r15, r8
mov rcx, qword [rcx + 0x38]
mov rbp, rdx
mov rdi, r8
test rcx, rcx
je 0x180101116
mov qword [rsp + 0x48], r14
mov rax, rbx
sub rax, rcx
mov r14, r8
cmp rax, r8
mov r8, rdx
mov rdx, rcx
cmovb r14, rax
add rdx, qword [rsi + 0x20]
mov r9, r14
cmp r14, 0x10
jb 0x1801010c0
mov r10, r14
shr r10, 4
imul r9, r10, 0xfffffffffffffff0
add r9, r14
nop word [rax + rax]
mov rcx, qword [r8 + 8]
xor rcx, qword [rdx + 8]
mov rax, qword [r8]
add r8, 0x10
xor qword [rdx], rax
mov qword [rdx + 8], rcx
add rdx, 0x10
sub r10, 1
jne 0x1801010a0
test r9, r9
je 0x1801010e1
sub r8, rdx
nop dword [rax + rax]
movzx eax, byte [r8 + rdx]
xor byte [rdx], al
lea rdx, [rdx + 1]
sub r9, 1
jne 0x1801010d0
test r14, r14
je 0x1801010f9
mov rdx, qword [rsi + 0x38]
mov r8, r14
add rdx, qword [rsi + 0x20]
mov rcx, rbp
call fcn.1801a4560
add qword [rsi + 0x38], r14
sub rdi, r14
add rbp, r14
mov r14, qword [rsp + 0x48]
cmp qword [rsi + 0x38], rbx
jne 0x180101116
mov rcx, rsi
call fcn.180101270
cmp rdi, rbx
jb 0x1801011ac
nop
mov rax, qword [rsi + 0x20]
mov r9, rbx
mov r8, rbp
cmp rbx, 0x10
jb 0x180101160
mov r10, rbx
shr r10, 4
imul r9, r10, 0xfffffffffffffff0
add r9, rbx
nop
mov rdx, qword [r8 + 8]
xor rdx, qword [rax + 8]
mov rcx, qword [r8]
add r8, 0x10
xor qword [rax], rcx
mov qword [rax + 8], rdx
add rax, 0x10
sub r10, 1
jne 0x180101140
test r9, r9
je 0x180101181
sub r8, rax
nop dword [rax + rax]
movzx ecx, byte [r8 + rax]
xor byte [rax], cl
lea rax, [rax + 1]
sub r9, 1
jne 0x180101170
test rbx, rbx
je 0x180101195
mov rdx, qword [rsi + 0x20]
mov r8, rbx
mov rcx, rbp
call fcn.1801a4560
mov rcx, rsi
sub rdi, rbx
add rbp, rbx
call fcn.180101270
cmp rdi, rbx
jae 0x180101120
mov rbx, qword [rsp + 0x40]
test rdi, rdi
je 0x180101234
mov rdx, qword [rsi + 0x20]
mov r9, rdi
mov r8, rbp
cmp rdi, 0x10
jb 0x180101200
mov r10, rdi
shr r10, 4
imul r9, r10, 0xfffffffffffffff0
add r9, rdi
nop dword [rax]
nop dword [rax + rax]
mov rcx, qword [r8 + 8]
xor rcx, qword [rdx + 8]
mov rax, qword [r8]
add r8, 0x10
xor qword [rdx], rax
mov qword [rdx + 8], rcx
add rdx, 0x10
sub r10, 1
jne 0x1801011e0
test r9, r9
je 0x180101221
sub r8, rdx
nop dword [rax + rax]
movzx eax, byte [r8 + rdx]
xor byte [rdx], al
lea rdx, [rdx + 1]
sub r9, 1
jne 0x180101210
mov rdx, qword [rsi + 0x20]
mov r8, rdi
mov rcx, rbp
call fcn.1801a4560
add qword [rsi + 0x38], rdi
mov rax, r15
mov rbp, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop rdi
pop rsi
ret
Function at 0x180101470
Capabilities:
Encode data using xor

Disassembly:
mov r9, rdx
xor edx, edx
test r8, r8
je 0x180101528
cmp r8, 0x20
jb 0x1801014fb
lea r10, [rcx - 1]
lea rax, [r8 - 1]
add r10, r8
add rax, r9
cmp rcx, rax
ja 0x18010149c
cmp r10, r9
jae 0x1801014fb
mov r11, r8
mov r10, r9
and r11, 0xffffffffffffffe0
mov rax, rcx
sub r10, rcx
nop dword [rax]
movdqu xmm0, xmmword [rax]
add rdx, 0x20
movdqu xmm2, xmmword [r10 + rax]
movdqu xmmword [r10 + rax], xmm0
movdqu xmm1, xmmword [rax]
lea rax, [rax + 0x20]
pxor xmm2, xmm1
movdqu xmmword [rax - 0x20], xmm2
movdqu xmm2, xmmword [r10 + rax - 0x10]
movdqu xmm0, xmmword [rax - 0x10]
movdqu xmmword [r10 + rax - 0x10], xmm0
movdqu xmm1, xmmword [rax - 0x10]
pxor xmm1, xmm2
movdqu xmmword [rax - 0x10], xmm1
cmp rdx, r11
jne 0x1801014b0
cmp rdx, r8
je 0x180101528
sub r9, rcx
lea rax, [rdx + rcx]
sub r8, rdx
nop word [rax + rax]
movzx ecx, byte [rax]
movzx edx, byte [rax + r9]
mov byte [rax + r9], cl
xor byte [rax], dl
lea rax, [rax + 1]
sub r8, 1
jne 0x180101510
ret
Function at 0x1801026d0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rcx
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x18
mov eax, dword [rdx + 0x34]
mov r8d, dword [rdx]
mov r14d, dword [rdx + 4]
mov r15d, dword [rdx + 8]
mov r12d, dword [rdx + 0xc]
mov ebp, dword [rdx + 0x10]
mov r9d, dword [rdx + 0x14]
mov r10d, dword [rdx + 0x18]
mov r11d, dword [rdx + 0x1c]
mov ebx, dword [rdx + 0x20]
mov edi, dword [rdx + 0x24]
mov esi, dword [rdx + 0x28]
mov r13d, dword [rdx + 0x2c]
mov ecx, dword [rdx + 0x30]
mov dword [rsp + 0x68], eax
mov eax, dword [rdx + 0x38]
mov edx, dword [rdx + 0x3c]
mov dword [rsp + 0x70], eax
mov qword [rsp + 8], 0xa
nop dword [rax]
lea eax, [rcx + r8]
rol eax, 7
xor ebp, eax
lea eax, [r8 + rbp]
rol eax, 9
xor ebx, eax
lea eax, [rbx + rbp]
rol eax, 0xd
xor ecx, eax
lea eax, [rcx + rbx]
ror eax, 0xe
xor r8d, eax
lea eax, [r9 + r14]
rol eax, 7
xor edi, eax
lea eax, [rdi + r9]
rol eax, 9
xor dword [rsp + 0x68], eax
mov eax, dword [rsp + 0x68]
add eax, edi
rol eax, 0xd
xor r14d, eax
mov eax, dword [rsp + 0x68]
add eax, r14d
ror eax, 0xe
xor r9d, eax
lea eax, [rsi + r10]
rol eax, 7
xor dword [rsp + 0x70], eax
mov eax, dword [rsp + 0x70]
add eax, esi
rol eax, 9
xor r15d, eax
mov eax, dword [rsp + 0x70]
add eax, r15d
rol eax, 0xd
xor r10d, eax
lea eax, [r10 + r15]
ror eax, 0xe
xor esi, eax
lea eax, [rdx + r13]
rol eax, 7
xor r12d, eax
lea eax, [rdx + r12]
rol eax, 9
xor r11d, eax
lea eax, [r11 + r12]
rol eax, 0xd
xor r13d, eax
lea eax, [r11 + r13]
ror eax, 0xe
xor edx, eax
lea eax, [r12 + r8]
rol eax, 7
xor r14d, eax
mov dword [rsp], r14d
lea eax, [r14 + r8]
rol eax, 9
xor r15d, eax
lea eax, [r15 + r14]
rol eax, 0xd
xor r12d, eax
lea eax, [r12 + r15]
ror eax, 0xe
xor r8d, eax
lea eax, [r9 + rbp]
rol eax, 7
xor r10d, eax
lea eax, [r10 + r9]
rol eax, 9
xor r11d, eax
lea eax, [r11 + r10]
rol eax, 0xd
xor ebp, eax
lea eax, [r11 + rbp]
ror eax, 0xe
xor r9d, eax
lea eax, [rsi + rdi]
rol eax, 7
xor r13d, eax
lea eax, [rsi + r13]
mov r14d, dword [rsp + 0x70]
rol eax, 9
xor ebx, eax
lea eax, [rbx + r13]
rol eax, 0xd
xor edi, eax
lea eax, [rdi + rbx]
ror eax, 0xe
xor esi, eax
mov eax, dword [rsp + 0x70]
add eax, edx
rol eax, 7
xor ecx, eax
lea eax, [rdx + rcx]
rol eax, 9
xor dword [rsp + 0x68], eax
mov eax, dword [rsp + 0x68]
add eax, ecx
rol eax, 0xd
xor r14d, eax
mov eax, dword [rsp + 0x68]
add eax, r14d
mov dword [rsp + 0x70], r14d
mov r14d, dword [rsp]
ror eax, 0xe
xor edx, eax
sub qword [rsp + 8], 1
jne 0x180102730
mov rcx, qword [rsp + 0x60]
mov dword [rcx], r8d
mov dword [rcx + 4], r9d
mov dword [rcx + 8], esi
mov dword [rcx + 0xc], edx
mov dword [rcx + 0x10], r10d
mov dword [rcx + 0x14], r11d
mov dword [rcx + 0x18], ebx
mov dword [rcx + 0x1c], edi
add rsp, 0x18
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x1801053e0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
mov qword [rsp + 0x20], r14
push r15
sub rsp, 0x20
lea rsi, [rcx + 8]
mov r14, rdx
lea r15, [rcx + 0x20]
mov edx, 0x19
mov rcx, rsi
mov rdi, r8
call fcn.18005b360
mov edx, 0xa8
mov rcx, r15
call fcn.180036440
mov rcx, qword [rsi]
mov r8, qword [rsi + 8]
sub r8, rcx
and r8, 0xfffffffffffffff8
je 0x180105439
xor edx, edx
call fcn.1801a4970
xor ebx, ebx
shr rdi, 3
mov edx, ebx
test rdi, rdi
je 0x180105466
nop word [rax + rax]
mov rax, qword [rsi]
lea rcx, [rax + rdx*8]
mov rax, qword [r14 + rdx*8]
xor qword [rcx], rax
inc rdx
cmp rdx, rdi
jb 0x180105450
mov rax, qword [rsi]
movabs rcx, 0x8000000000000000
xor qword [rax + rdi*8], 0x1f
mov rax, qword [rsi]
xor qword [rax + 0xa0], rcx
mov rcx, qword [rsi]
call fcn.1800cfe50
mov r9, qword [r15 + 8]
sub r9, qword [r15]
mov rdx, qword [rsi]
mov r8, qword [r15]
cmp r9, 8
jb 0x1801054c4
mov rcx, r9
shr rcx, 3
imul rax, rcx, 0xfffffffffffffff8
add r9, rax
nop dword [rax + rax]
mov rax, qword [rdx]
add rdx, 8
mov qword [r8], rax
add r8, 8
sub rcx, 1
jne 0x1801054b0
test r9, r9
je 0x1801054eb
nop dword [rax]
mov rax, qword [rdx]
movzx ecx, bl
and cl, 7
shl cl, 3
shr rax, cl
mov byte [rbx + r8], al
inc rbx
cmp rbx, r9
jne 0x1801054d0
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x40]
mov r14, qword [rsp + 0x48]
add rsp, 0x20
pop r15
ret

Function at 0x180106e40
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x20
mov r15, rdx
mov rdi, rcx
mov edx, pe_nt_image_headers64
add rcx, 0x18
mov rbp, r8
call fcn.180036440
mov edx, pe_nt_image_headers64
lea rcx, [rdi + 0x30]
call fcn.180036440
xor ebx, ebx
mov word [rdi + 0x10], 0
mov qword [rdi + 0x48], rbx
mov eax, ebx
nop dword [rax + rax]
mov rcx, qword [rdi + 0x18]
mov byte [rax + rcx], al
inc rax
cmp rax, 0x100
jne 0x180106e90
mov r11, rbx
mov r10, rbx
nop dword [rax + rax]
mov r8, qword [rdi + 0x18]
xor edx, edx
mov rax, r10
div rbp
movzx r9d, byte [r8 + r10]
movzx ecx, byte [rdx + r15]
add rcx, r11
add rcx, r9
movzx r11d, cl
movzx eax, byte [r8 + r11]
mov byte [r8 + r10], al
inc r10
mov byte [r8 + r11], r9b
cmp r10, 0x100
jne 0x180106eb0
nop dword [rax]
mov rcx, rdi
call fcn.180106cb0
mov rax, qword [rdi + 0x38]
sub rax, qword [rdi + 0x30]
add rbx, rax
cmp rbx, qword [rdi + 8]
jbe 0x180106ef0
mov rcx, qword [rdi + 0x38]
xor edx, edx
sub rcx, qword [rdi + 0x30]
mov rax, qword [rdi + 8]
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
div rcx
add qword [rdi + 0x48], rdx
add rsp, 0x20
pop r15
pop r14
pop rdi
ret
Function at 0x180116200
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x38
movaps xmmword [rsp + 0x20], xmm6
mov r10, rcx
movdqa xmm6, xmmword [0x1801ec100]
movaps xmmword [rsp + 0x10], xmm7
movdqa xmm7, xmmword [0x1801e7eb0]
movdqu xmm0, xmmword [rcx]
pshufb xmm0, xmm6
test r9, r9
je 0x1801162f6
movaps xmmword [rsp], xmm8
xorps xmm8, xmm8
nop dword [rax]
movdqu xmm4, xmmword [r8]
lea rax, [rdx + 0x20]
mov ecx, 0x20
movdqa xmm5, xmm8
pshufb xmm4, xmm6
pxor xmm4, xmm0
nop dword [rax]
movdqu xmm0, xmmword [rax - 0x20]
lea rax, [rax + 0x40]
movdqa xmm2, xmm4
psllq xmm4, 1
psrlq xmm2, 0x3f
movdqa xmm3, xmm4
psrlq xmm3, 0x3f
paddq xmm2, xmm7
psllq xmm4, 1
paddq xmm3, xmm7
movdqa xmm1, xmm2
punpckhqdq xmm1, xmm2
punpcklqdq xmm2, xmm2
pandn xmm1, xmm0
pxor xmm1, xmm5
movdqa xmm5, xmm1
movdqa xmm1, xmm3
punpckhqdq xmm1, xmm3
punpcklqdq xmm3, xmm3
movdqu xmm0, xmmword [rax - 0x50]
pandn xmm2, xmm0
pxor xmm5, xmm2
movdqu xmm0, xmmword [rax - 0x40]
pandn xmm1, xmm0
pxor xmm5, xmm1
movdqu xmm0, xmmword [rax - 0x30]
pandn xmm3, xmm0
pxor xmm5, xmm3
sub rcx, 1
jne 0x180116260
add r8, 0x10
pshufd xmm0, xmm5, 0x4e
sub r9, 1
jne 0x180116240
movaps xmm8, xmmword [rsp]
movaps xmm7, xmmword [rsp + 0x10]
pshufb xmm0, xmm6
movaps xmm6, xmmword [rsp + 0x20]
movdqu xmmword [r10], xmm0
add rsp, 0x38
ret
Function at 0x1801254c0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x50
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov qword [rsp + 0xa0], rbx
mov rax, qword [0x18028f9a8]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov r15, rdx
mov rbx, rcx
lea rdx, [rsp + 0x20]
mov rcx, r15
call fcn.1800f4150
nop
mov rcx, r15
call fcn.1800f4110
mov r14d, eax
xor esi, esi
mov r13d, esi
mov r11, qword [rsp + 0x20]
movzx r9d, word [r11]
cmp si, r9w
jae 0x1801256bc
mov r10d, dword [rbx + 0x38]
mov r12d, r10d
imul r12d, r13d
mov eax, 1
mov ecx, r13d
shl ax, cl
movzx edx, ax
mov rax, qword [r11 + 8]
mov r8, qword [rax]
mov rcx, qword [rax + 8]
sub rcx, r8
sar rcx, 1
cmp rcx, rdx
jbe 0x1801256af
movzx eax, word [r8 + rdx*2]
mov word [rsp + 0x38], ax
add ax, ax
movzx edx, ax
movzx r8d, word [r11 + 2]
movzx ecx, r9b
mov eax, edx
sar eax, cl
and dx, r8w
add ax, dx
mov word [rsp + 0x3a], ax
add ax, ax
movzx eax, ax
mov edx, eax
sar edx, cl
and ax, r8w
add dx, ax
mov word [rsp + 0x3c], dx
add dx, dx
movzx edx, dx
mov eax, edx
sar eax, cl
and dx, r8w
add ax, dx
mov word [rsp + 0x3e], ax
mov edi, esi
test r10d, r10d
je 0x180125686
xor r10d, r10d
nop dword [rax]
lea ebp, [rdi + rdi*4]
lea eax, [rdi + r12]
lea rsi, [rax + rax]
mov rax, qword [rbx + 8]
mov word [rsi + rax], r10w
mov r8d, r10d
lea r9, [rsp + 0x38]
nop dword [rax]
mov ecx, r8d
mov eax, 1
shl eax, cl
add eax, ebp
cmp eax, r14d
ja 0x180125679
mov ecx, eax
mov rax, qword [r15 + 8]
movzx edx, word [rax + rcx*2]
test dx, dx
jne 0x18012560a
movzx ecx, r10w
jmp 0x180125660
movzx r10d, dx
mov rax, qword [r11 + 8]
mov rdx, qword [rax]
mov rcx, qword [rax + 8]
sub rcx, rdx
sar rcx, 1
cmp rcx, r10
jbe 0x1801256a2
movzx edx, word [rdx + r10*2]
movzx eax, word [r9]
add edx, eax
movzx ecx, byte [r11]
mov eax, edx
sar eax, cl
and dx, word [r11 + 2]
add ax, dx
movzx edx, ax
mov rax, qword [r11 + 0x10]
mov r10, qword [rax]
mov rcx, qword [rax + 8]
sub rcx, r10
sar rcx, 1
cmp rcx, rdx
jbe 0x180125695
movzx ecx, word [r10 + rdx*2]
xor r10d, r10d
mov rax, qword [rbx + 8]
xor word [rax + rsi], cx
inc r8d
add r9, 2
cmp r8d, 3
jbe 0x1801255e0
inc edi
cmp edi, dword [rbx + 0x38]
jb 0x1801255c0
xor esi, esi
inc r13d
movzx r9d, word [r11]
cmp r13d, r9d
jmp 0x180125521
lea rcx, str.invalid_vector_T__subscript
call fcn.18015ddcc
int3
lea rcx, str.invalid_vector_T__subscript
call fcn.18015ddcc
int3
lea rcx, str.invalid_vector_T__subscript
call fcn.18015ddcc
nop
mov rcx, qword [rsp + 0x28]
test rcx, rcx
je 0x1801256f7
or edi, 0xffffffff
mov eax, edi
lock xadd dword [rcx + 8], eax
cmp eax, 1
jne 0x1801256f7
mov rbx, qword [rsp + 0x28]
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax]
lock xadd dword [rbx + 0xc], edi
cmp edi, 1
jne 0x1801256f7
mov rcx, qword [rsp + 0x28]
mov rax, qword [rcx]
call qword [rax + 8]
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.180186840
mov rbx, qword [rsp + 0xa0]
add rsp, 0x50
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret