joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1800d47e0
Capabilities:
Encode data using xor

Disassembly:
mov rax, rsp
push rbp
mov rbp, rsp
sub rsp, 0x70
mov qword [rbp - 0x40], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x20], rdi
mov rdi, rdx
mov rbx, rcx
lea rdx, [rbp - 0x20]
mov rcx, qword [rcx + 8]
call fcn.180020930
nop
lea rdx, [rbp - 0x38]
mov rcx, qword [rbx + 0x10]
call fcn.180020930
nop
mov r8, qword [rbp - 0x30]
mov r9, qword [rbp - 0x38]
sub r8, r9
mov qword [rbp + 0x10], r8
mov rdx, qword [rbp - 0x18]
mov rax, qword [rbp - 0x20]
sub rdx, rax
mov qword [rbp + 0x20], rdx
lea rcx, [rbp + 0x10]
lea r10, [rbp + 0x20]
cmp r8, rdx
cmovae rcx, r10
mov r8, qword [rcx]
cmp r8, 0x10
jb 0x1800d4880
mov r10, r8
shr r10, 4
imul rcx, r10, 0xfffffffffffffff0
add r8, rcx
mov rdx, qword [r9 + 8]
mov rcx, qword [rax]
xor rcx, qword [r9]
xor qword [rax + 8], rdx
mov qword [rax], rcx
add rax, 0x10
add r9, 0x10
sub r10, 1
jne 0x1800d4861
test r8, r8
je 0x1800d48a1
sub r9, rax
nop dword [rax + rax]
movzx ecx, byte [rax + r9]
xor byte [rax], cl
lea rax, [rax + 1]
sub r8, 1
jne 0x1800d4890
mov rax, qword [rbx + 0x10]
mov qword [rsp + 0x20], rax
mov r9, qword [rbx + 8]
mov r8b, 1
lea rdx, [rbp - 0x20]
lea rcx, [rbp - 0x38]
call fcn.1800d4480
mov rax, qword [rbx + 0x10]
mov qword [rsp + 0x20], rax
mov r9, qword [rbx + 8]
mov r8b, 2
lea rdx, [rbp - 0x38]
lea rcx, [rbp - 0x20]
call fcn.1800d4480
mov rax, qword [rbp - 0x18]
mov r8, rax
mov rcx, qword [rbp - 0x20]
sub r8, rcx
je 0x1800d48fe
mov rdx, rcx
mov rcx, rdi
call fcn.18017c7f0
mov rax, qword [rbp - 0x18]
mov rcx, qword [rbp - 0x20]
mov r8, qword [rbp - 0x30]
mov rdx, qword [rbp - 0x38]
sub rax, rcx
sub r8, rdx
je 0x1800d4917
lea rcx, [rax + rdi]
call fcn.18017c7f0
mov rcx, qword [rbx + 8]
mov byte [rbp + 0x10], 0
mov rax, qword [rcx]
mov r8d, 1
lea rdx, [rbp + 0x10]
call qword [rax + 0x10]
mov rcx, qword [rbx + 0x10]
mov byte [rbp + 0x10], 0
mov rax, qword [rcx]
mov r8d, 1
lea rdx, [rbp + 0x10]
call qword [rax + 0x10]
nop
mov rcx, qword [rbp - 0x38]
test rcx, rcx
je 0x1800d4973
mov rdx, qword [rbp - 0x28]
sub rdx, rcx
mov r8d, 1
call fcn.1800302d0
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x38], xmm0
mov qword [rbp - 0x28], 0
mov rcx, qword [rbp - 0x20]
test rcx, rcx
je 0x1800d498f
mov rdx, qword [rbp - 0x10]
sub rdx, rcx
mov r8d, 1
call fcn.1800302d0
nop
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret
Function at 0x1800d6fc0
Capabilities:
Hash data using sha512

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rbx, rcx
mov rcx, qword [rcx + 0x30]
mov r8, qword [rbx + 0x38]
sub r8, rcx
and r8, 0xfffffffffffffff8
je 0x1800d6fe5
xor edx, edx
call fcn.18017cc00
mov rcx, qword [rbx + 0x10]
mov r8, qword [rbx + 0x18]
sub r8, rcx
je 0x1800d6ff9
xor edx, edx
call fcn.18017cc00
xor edi, edi
lea rdx, [0x1801dafd0]
mov qword [rbx + 0x28], rdi
mov rcx, qword [rbx + 0x30]
lea r8d, [rdi + 0x40]
call fcn.18017c7f0
mov eax, dword [rbx + 8]
mov rdx, qword [rbx + 0x30]
shr rax, 3
movzx ecx, al
xor rcx, qword [rdx]
xor rcx, 0x1010000
mov qword [rdx], rcx
mov qword [rbx + 0x50], rdi
mov qword [rbx + 0x48], rdi
mov qword [rbx + 0x60], rdi
mov qword [rbx + 0x58], rdi
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x1800d77a0
Capabilities:
Hash data using sha512

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
lea rdx, [0x1801dafd0]
mov rcx, qword [rcx + 0x30]
mov r8d, 0x40
call fcn.18017c7f0
mov eax, dword [rbx + 8]
mov r8, qword [rbx + 0x30]
shr rax, 3
movzx edx, al
xor rdx, qword [r8]
xor rdx, 0x1010000
xor eax, eax
mov qword [r8], rdx
mov qword [rbx + 0x50], rax
mov qword [rbx + 0x48], rax
mov qword [rbx + 0x60], rax
mov qword [rbx + 0x58], rax
add rsp, 0x20
pop rbx
ret

Function at 0x1800e9bf0
Capabilities:
Encrypt data using curve25519

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0xf0
mov qword [rsp + 0x90], 0xfffffffffffffffe
mov rax, qword [0x1802609a8]
xor rax, rsp
mov qword [rsp + 0xe0], rax
mov rbx, r8
mov rdi, rdx
mov rsi, rcx
mov qword [rsp + 0x20], 0x10
mov r9b, 1
movzx r8d, r9b
mov edx, 0x80
lea rcx, [rsp + 0x30]
call fcn.180038e00
nop
lea rax, vtable.Botan::SHA_512.0
mov qword [rsp + 0x30], rax
mov edx, 8
lea rcx, [rsp + 0x70]
call fcn.18005d240
nop
lea rcx, [rsp + 0x30]
call fcn.1800cc0d0
nop
mov r8d, 0x20
mov rdx, rbx
lea rcx, [rsp + 0x30]
mov rax, qword [rsp + 0x30]
call qword [rax + 0x10]
lea rdx, [rsp + 0xa0]
lea rcx, [rsp + 0x30]
mov rax, qword [rsp + 0x30]
call qword [rax + 0x18]
and byte [rsp + 0xa0], 0xf8
movzx eax, byte [rsp + 0xbf]
and al, 0x3f
or al, 0x40
mov byte [rsp + 0xbf], al
lea rdx, [rsp + 0xa0]
mov rcx, rsi
call fcn.18011e310
mov r8d, 0x20
mov rdx, rbx
mov rcx, rdi
call fcn.18017c7f0
lea rcx, [rdi + 0x20]
mov r8d, 0x20
mov rdx, rsi
call fcn.18017c7f0
nop
mov rcx, qword [rsp + 0x70]
test rcx, rcx
je 0x1800e9d1c
mov rdx, qword [rsp + 0x80]
sub rdx, rcx
sar rdx, 3
mov r8d, 8
call fcn.1800302d0
xorps xmm0, xmm0
movdqa xmmword [rsp + 0x70], xmm0
mov qword [rsp + 0x80], 0
mov rcx, qword [rsp + 0x38]
test rcx, rcx
je 0x1800e9d3a
mov rdx, qword [rsp + 0x48]
sub rdx, rcx
mov r8d, 1
call fcn.1800302d0
nop
mov rcx, qword [rsp + 0xe0]
xor rcx, rsp
call fcn.18015e5e0
add rsp, 0xf0
pop rdi
pop rsi
pop rbx
ret
Function at 0x1800e9d60
Capabilities:
Encrypt data using curve25519

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r14
lea rbp, [rsp - 0x70]
sub rsp, 0x170
mov qword [rbp - 0x70], 0xfffffffffffffffe
mov rax, qword [0x1802609a8]
xor rax, rsp
mov qword [rbp + 0x60], rax
mov rbx, r9
mov rsi, r8
mov rdi, rdx
mov r14, rcx
mov qword [rsp + 0x20], 0x10
mov r9b, 1
movzx r8d, r9b
mov edx, 0x80
lea rcx, [rsp + 0x30]
call fcn.180038e00
nop
lea rax, vtable.Botan::SHA_512.0
mov qword [rsp + 0x30], rax
mov edx, 8
lea rcx, [rsp + 0x70]
call fcn.18005d240
nop
lea rcx, [rsp + 0x30]
call fcn.1800cc0d0
nop
mov r8d, 0x20
mov rdx, rbx
lea rcx, [rsp + 0x30]
mov rax, qword [rsp + 0x30]
call qword [rax + 0x10]
lea rdx, [rbp - 0x60]
lea rcx, [rsp + 0x30]
mov rax, qword [rsp + 0x30]
call qword [rax + 0x18]
and byte [rbp - 0x60], 0xf8
movzx eax, byte [rbp - 0x41]
and al, 0x3f
or al, 0x40
mov byte [rbp - 0x41], al
mov r8d, 0x20
lea rdx, [rbp - 0x40]
lea rcx, [rsp + 0x30]
mov rax, qword [rsp + 0x30]
call qword [rax + 0x10]
mov r8, rsi
mov rdx, rdi
lea rcx, [rsp + 0x30]
mov rax, qword [rsp + 0x30]
call qword [rax + 0x10]
lea rdx, [rbp - 0x20]
lea rcx, [rsp + 0x30]
mov rax, qword [rsp + 0x30]
call qword [rax + 0x18]
lea rcx, [rbp - 0x20]
call fcn.18011f500
lea rdx, [rbp - 0x20]
mov rcx, r14
call fcn.18011e310
mov r8d, 0x20
mov rdx, r14
lea rcx, [rsp + 0x30]
mov rax, qword [rsp + 0x30]
call qword [rax + 0x10]
lea rdx, [rbx + 0x20]
mov r8d, 0x20
lea rcx, [rsp + 0x30]
mov rax, qword [rsp + 0x30]
call qword [rax + 0x10]
mov r8, rsi
mov rdx, rdi
lea rcx, [rsp + 0x30]
mov rax, qword [rsp + 0x30]
call qword [rax + 0x10]
lea rdx, [rbp + 0x20]
lea rcx, [rsp + 0x30]
mov rax, qword [rsp + 0x30]
call qword [rax + 0x18]
lea rcx, [rbp + 0x20]
call fcn.18011f500
lea rcx, [r14 + 0x20]
lea r9, [rbp - 0x20]
lea r8, [rbp - 0x60]
lea rdx, [rbp + 0x20]
call fcn.1801201d0
nop
mov rcx, qword [rsp + 0x70]
test rcx, rcx
je 0x1800e9f03
mov rdx, qword [rbp - 0x80]
sub rdx, rcx
sar rdx, 3
mov r8d, 8
call fcn.1800302d0
xorps xmm0, xmm0
movdqa xmmword [rsp + 0x70], xmm0
mov qword [rbp - 0x80], 0
mov rcx, qword [rsp + 0x38]
test rcx, rcx
je 0x1800e9f21
mov rdx, qword [rsp + 0x48]
sub rdx, rcx
mov r8d, 1
call fcn.1800302d0
nop
mov rcx, qword [rbp + 0x60]
xor rcx, rsp
call fcn.18015e5e0
add rsp, 0x170
pop r14
pop rdi
pop rsi
pop rbx
pop rbp
ret
Function at 0x1800ed7b0
Capabilities:
Encrypt data using curve25519

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0xf0
mov rax, qword [0x1802609a8]
xor rax, rsp
mov qword [rsp + 0xe0], rax
mov rbx, r8
mov rdi, rcx
mov r8d, 0x20
lea rcx, [rsp + 0xc0]
call fcn.18017c7f0
movzx eax, byte [rsp + 0xdf]
lea r9, [rsp + 0x48]
and byte [rsp + 0xc0], 0xf8
lea r8, [rsp + 0xc0]
and al, 0x3f
lea rdx, [rsp + 0x70]
or al, 0x40
movabs rcx, 0x7ffffffffffff
mov byte [rsp + 0xdf], al
mov rax, qword [rbx]
and rax, rcx
mov qword [rsp + 0x48], rax
mov rax, qword [rbx + 6]
shr rax, 3
and rax, rcx
mov qword [rsp + 0x50], rax
mov rax, qword [rbx + 0xc]
shr rax, 6
and rax, rcx
mov qword [rsp + 0x58], rax
mov rax, qword [rbx + 0x13]
shr rax, 1
and rax, rcx
mov qword [rsp + 0x60], rax
mov rax, qword [rbx + 0x18]
shr rax, 0xc
and rax, rcx
lea rcx, [rsp + 0x98]
mov qword [rsp + 0x68], rax
call fcn.1800ea180
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x20]
call fcn.1800ec610
lea r8, [rsp + 0x20]
lea rdx, [rsp + 0x98]
lea rcx, [rsp + 0x70]
call fcn.1800edf00
lea rdx, [rsp + 0x70]
mov rcx, rdi
call fcn.1800ed9a0
mov rcx, qword [rsp + 0xe0]
xor rcx, rsp
call fcn.18015e5e0
mov rbx, qword [rsp + 0x110]
add rsp, 0xf0
pop rdi
ret

Function at 0x1800eef80
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x30
mov rbx, rcx
mov dword [rsp + 0x20], 0
mov rcx, rdx
mov rsi, rdx
mov edi, 1
movzx ebp, r8w
mov eax, edi
shl eax, cl
mov rcx, rbx
inc eax
movsxd rdx, eax
call fcn.1800dbd90
mov rax, qword [rbx]
mov word [rax], di
mov rax, qword [rbx + 8]
sub rax, qword [rbx]
sar rax, 1
cmp rdi, rax
jae 0x1800ef01d
dec si
nop word [rax + rax]
mov rax, qword [rbx]
movzx ecx, si
lea r8, [rax + rdi*2]
movzx eax, word [rax + rdi*2 - 2]
movzx edx, ax
shr dx, cl
test dx, dx
je 0x1800eefff
movzx ecx, bp
jmp 0x1800ef001
xor ecx, ecx
add ax, ax
inc rdi
xor ax, cx
mov word [r8], ax
mov rax, qword [rbx + 8]
sub rax, qword [rbx]
sar rax, 1
cmp rdi, rax
jb 0x1800eefe0
mov rbp, qword [rsp + 0x48]
mov rax, rbx
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
Function at 0x1800f1fb0
Capabilities:
Encode data using xor

Disassembly:
push rdi
sub rsp, 0x30
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x48], rbp
mov qword [rsp + 0x50], rsi
mov ebp, r8d
mov rbx, rcx
xor r10d, r10d
mov edi, edx
test edx, edx
je 0x1800f204d
mov r11d, dword [rsp + 0x68]
mov rsi, qword [rsp + 0x60]
nop word [rax + rax]
mov rax, r10
shr rax, 3
movzx ecx, r10b
and cl, 7
movzx edx, byte [rax + r9]
shr dl, cl
test dl, 1
je 0x1800f2045
test r11d, r11d
je 0x1800f2045
mov rax, rsi
mov rdx, rbp
imul rdx, r10
shl rdx, 2
sub rdx, rsi
mov r8, r11
nop dword [rax]
nop word [rax + rax]
mov rcx, qword [rbx]
add rcx, rdx
mov ecx, dword [rcx + rax]
xor dword [rax], ecx
lea rax, [rax + 4]
sub r8, 1
jne 0x1800f2030
inc r10
cmp r10, rdi
jb 0x1800f1ff0
mov rcx, qword [rbx]
test rcx, rcx
je 0x1800f20dd
mov rax, qword [rbx + 0x10]
sub rax, rcx
sar rax, 2
movabs rdx, 0x3fffffffffffffff
cmp rax, rdx
jbe 0x1800f2079
call fcn.1801810ec
int3
lea rax, [rax*4]
cmp rax, 0x1000
jb 0x1800f20c1
test cl, 0x1f
je 0x1800f2094
call fcn.1801810ec
int3
mov rax, qword [rcx - 8]
cmp rax, rcx
jb 0x1800f20a3
call fcn.1801810ec
int3
sub rcx, rax
cmp rcx, 8
jae 0x1800f20b2
call fcn.1801810ec
int3
cmp rcx, 0x27
jbe 0x1800f20be
call fcn.1801810ec
int3
mov rcx, rax
call fcn.18015dea0
mov qword [rbx], 0
mov qword [rbx + 8], 0
mov qword [rbx + 0x10], 0
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
Function at 0x1800f2740
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rcx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x30
mov qword [rsp + 0x28], 0xfffffffffffffffe
mov qword [rsp + 0x78], rbx
mov ebx, r9d
mov r14, r8
mov r12, rdx
mov rdi, rcx
xor esi, esi
mov dword [rsp + 0x20], esi
lea r13d, [rbx - 1]
shr r13d, 3
mov eax, dword [rsp + 0x90]
dec eax
shr eax, 3
mov dword [rsp + 0x88], eax
lea edx, [rax + 2]
add edx, r13d
call fcn.180032ca0
mov r15d, 1
mov dword [rsp + 0x20], r15d
mov r8d, ebx
mov ebp, ebx
and ebp, 7
jne 0x1800f27e2
lea eax, [r13 + 1]
mov ebx, eax
mov r8d, eax
mov rdx, qword [r12]
mov rcx, qword [rdi]
call fcn.18017c7f0
mov r8d, dword [rsp + 0x88]
inc r8d
mov rcx, qword [rdi]
add rcx, rbx
mov rdx, qword [r14]
call fcn.18017c7f0
jmp 0x1800f2890
shr r8, 3
test r8, r8
je 0x1800f27f7
mov rdx, qword [r12]
mov rcx, qword [rdi]
call fcn.18017c7f0
shr ebx, 3
mov r8d, ebx
mov rax, qword [r12]
mov rcx, rbp
shl r15b, cl
dec r15b
movzx ecx, byte [rbx + rax]
and cl, r15b
mov rax, qword [rdi]
mov byte [rbx + rax], cl
mov r11d, dword [rsp + 0x90]
mov eax, r11d
shr eax, 3
test eax, eax
je 0x1800f2874
mov r9d, 8
sub r9b, bpl
mov r10d, eax
nop word [rax + rax]
add r8, qword [rdi]
mov rax, qword [r14]
mov rcx, rbp
movzx edx, byte [rsi + rax]
shl dl, cl
xor byte [r8], dl
inc ebx
mov r8d, ebx
mov rax, qword [r14]
movzx edx, byte [rsi + rax]
movzx ecx, r9b
shr dl, cl
mov rax, qword [rdi]
mov byte [rbx + rax], dl
lea rsi, [rsi + 1]
sub r10, 1
jne 0x1800f2840
mov r8d, ebx
add r8, qword [rdi]
mov rdx, r11
shr rdx, 3
mov rax, qword [r14]
mov rcx, rbp
movzx edx, byte [rdx + rax]
shl dl, cl
xor byte [r8], dl
mov rax, rdi
mov rbx, qword [rsp + 0x78]
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x1800f2960
Capabilities:
Encode data using xor

Disassembly:
mov rax, rsp
push rbp
mov rbp, rsp
sub rsp, 0x70
mov qword [rbp - 0x40], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r14
mov rbx, r9
mov rdi, r8
mov rsi, rdx
mov r14, rcx
mov r9, qword [rbp + 0x30]
mov r8d, dword [rbx + 0x20]
mov edx, dword [rbx + 0x24]
lea rcx, [rbp - 0x20]
call fcn.1800f28b0
nop
mov eax, dword [rbx + 0x20]
lea r8, [rbx + 8]
mov dword [rsp + 0x20], eax
mov r9d, dword [rbx + 0x24]
mov rdx, rdi
lea rcx, [rbp - 0x38]
call fcn.1800f2b40
nop
mov rax, qword [rbp - 0x30]
mov r11, qword [rbp - 0x38]
sub rax, r11
mov rdx, qword [rbp - 0x18]
mov r10, qword [rbp - 0x20]
sub rdx, r10
cmp rax, rdx
jae 0x1800f29ec
lea rcx, [rbp - 0x38]
call fcn.180033000
mov r10, qword [rbp - 0x20]
mov r11, qword [rbp - 0x38]
mov r9, qword [rbp - 0x18]
sub r9, r10
mov r8, r10
mov rax, r11
cmp r9, 0x10
jb 0x1800f2a3b
mov r10, r9
shr r10, 4
imul rcx, r10, 0xfffffffffffffff0
add r9, rcx
nop dword [rax]
mov rdx, qword [rax]
xor rdx, qword [r8]
mov rcx, qword [rax + 8]
xor rcx, qword [r8 + 8]
mov qword [rax], rdx
mov qword [rax + 8], rcx
add rax, 0x10
add r8, 0x10
sub r10, 1
jne 0x1800f2a10
mov r10, qword [rbp - 0x20]
mov r11, qword [rbp - 0x38]
test r9, r9
je 0x1800f2a69
sub r8, rax
nop dword [rax]
nop word [rax + rax]
movzx ecx, byte [r8 + rax]
xor byte [rax], cl
lea rax, [rax + 1]
sub r9, 1
jne 0x1800f2a50
mov r10, qword [rbp - 0x20]
mov r11, qword [rbp - 0x38]
lea rax, [rbp - 0x38]
cmp r14, rax
je 0x1800f2aa1
mov rax, qword [r14]
mov qword [r14], r11
mov r11, rax
mov qword [rbp - 0x38], rax
mov rcx, qword [r14 + 8]
mov rax, qword [rbp - 0x30]
mov qword [r14 + 8], rax
mov qword [rbp - 0x30], rcx
mov rdx, qword [r14 + 0x10]
mov rax, qword [rbp - 0x28]
mov qword [r14 + 0x10], rax
mov qword [rbp - 0x28], rdx
jmp 0x1800f2aa5
mov rdx, qword [rbp - 0x28]
lea rax, [rbp - 0x20]
cmp rsi, rax
je 0x1800f2adb
mov rax, qword [rsi]
mov qword [rsi], r10
mov r10, rax
mov qword [rbp - 0x20], rax
mov rcx, qword [rsi + 8]
mov rax, qword [rbp - 0x18]
mov qword [rsi + 8], rax
mov qword [rbp - 0x18], rcx
mov rcx, qword [rsi + 0x10]
mov rax, qword [rbp - 0x10]
mov qword [rsi + 0x10], rax
mov qword [rbp - 0x10], rcx
test r11, r11
je 0x1800f2b05
sub rdx, r11
mov r8d, 1
mov rcx, r11
call fcn.1800302d0
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x38], xmm0
mov qword [rbp - 0x28], 0
mov r10, qword [rbp - 0x20]
test r10, r10
je 0x1800f2b20
mov rdx, qword [rbp - 0x10]
sub rdx, r10
mov r8d, 1
mov rcx, r10
call fcn.1800302d0
nop
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov r14, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret
Function at 0x1800f2b40
Capabilities:
Encode data using xor

Disassembly:
mov dword [rsp + 0x20], r9d
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x78
mov qword [rsp + 0x48], 0xfffffffffffffffe
mov ebp, r9d
mov rsi, r8
mov rbx, rdx
xor r13d, r13d
mov dword [rsp + 0x30], r13d
cmp r9d, 0x80000000
jb 0x1800f2b88
lea edi, [r13 + 0x20]
jmp 0x1800f2b9f
mov rdi, r13
mov eax, 1
cmp r9d, eax
jbe 0x1800f2b9f
add eax, eax
inc rdi
cmp eax, r9d
jb 0x1800f2b95
imul edi, dword [rsp + 0xe0]
mov qword [rsp + 0x40], rdi
mov r15d, r9d
sub r15d, edi
mov dword [rsp + 0xe0], r15d
lea edx, [rdi - 1]
shr edx, 5
inc edx
shl rdx, 2
lea rcx, [rsp + 0x50]
call fcn.180032ca0
nop
mov rsi, qword [rsi]
mov r14, r13
mov r10d, r15d
mov qword [rsp + 0xd0], r10
mov ecx, r15d
shr rcx, 3
mov qword [rsp + 0x38], rcx
mov r12, qword [rsp + 0x58]
mov r15, qword [rsp + 0x50]
test rcx, rcx
je 0x1800f2ccc
mov rdi, r12
sub rdi, r15
mov r13, qword [rsp + 0xc8]
nop
mov ebx, 1
lea ebp, [rbx + 7]
nop dword [rax + rax]
mov rax, qword [r13]
test byte [r14 + rax], bl
je 0x1800f2c91
mov r8, rdi
mov r9, rsi
mov rax, r15
cmp rdi, 0x10
jb 0x1800f2c74
mov r11, rsi
sub r11, r15
mov r10, rdi
shr r10, 4
imul r8, r10, 0xfffffffffffffff0
add r8, rdi
nop dword [rax]
mov rdx, qword [rax]
xor rdx, qword [r9]
mov rcx, qword [rax + 8]
xor rcx, qword [r11 + rax + 8]
mov qword [rax], rdx
mov qword [rax + 8], rcx
add rax, 0x10
add r9, 0x10
sub r10, 1
jne 0x1800f2c50
test r8, r8
je 0x1800f2c91
sub r9, rax
nop dword [rax]
movzx ecx, byte [r9 + rax]
xor byte [rax], cl
lea rax, [rax + 1]
sub r8, 1
jne 0x1800f2c80
add rsi, rdi
rol ebx, 1
sub rbp, 1
jne 0x1800f2c20
inc r14
mov rcx, qword [rsp + 0x38]
cmp r14, rcx
jb 0x1800f2c10
xor r13d, r13d
mov rbx, qword [rsp + 0xc8]
mov rdi, qword [rsp + 0x40]
mov ebp, dword [rsp + 0xd8]
mov r10, qword [rsp + 0xd0]
and r10d, 7
mov qword [rsp + 0xd0], r10
jbe 0x1800f2d85
sub r12, r15
mov rax, qword [rbx]
movzx edx, byte [rcx + rax]
mov rcx, r13
mov eax, 1
shl eax, cl
test al, dl
je 0x1800f2d71
mov r9, r12
mov r8, rsi
mov rdx, r15
cmp r12, 0x10
jb 0x1800f2d4c
mov r11, rsi
sub r11, r15
mov r10, r12
shr r10, 4
imul r9, r10, 0xfffffffffffffff0
add r9, r12
nop dword [rax]
mov rcx, qword [rdx]
xor rcx, qword [r8]
mov rax, qword [rdx + 8]
xor rax, qword [r11 + rdx + 8]
mov qword [rdx], rcx
mov qword [rdx + 8], rax
add rdx, 0x10
add r8, 0x10
sub r10, 1
jne 0x1800f2d20
mov r10, qword [rsp + 0xd0]
test r9, r9
je 0x1800f2d71
sub r8, rdx
nop dword [rax]
nop dword [rax + rax]
movzx eax, byte [rdx + r8]
xor byte [rdx], al
lea rdx, [rdx + 1]
sub r9, 1
jne 0x1800f2d60
add rsi, r12
inc r13
cmp r13, r10
mov rcx, qword [rsp + 0x38]
jb 0x1800f2ce1
mov dword [rsp + 0x20], edi
mov r9d, dword [rsp + 0xe0]
lea r8, [rsp + 0x50]
mov rdx, rbx
mov rbx, qword [rsp + 0xc0]
mov rcx, rbx
call fcn.1800f2740
mov dword [rsp + 0x30], 1
lea edx, [rbp + 7]
shr rdx, 3
mov rcx, rbx
call fcn.180033000
nop
mov rcx, qword [rsp + 0x50]
test rcx, rcx
je 0x1800f2ddf
mov rdx, qword [rsp + 0x60]
sub rdx, rcx
mov r8d, 1
call fcn.1800302d0
nop
mov rax, rbx
add rsp, 0x78
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x1800fd270
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 0x18], rbp
push rsi
movzx r9d, byte [rdx + r8 - 1]
xor r10d, r10d
cmp r9, r8
mov qword [rsp + 0x10], rbx
mov r11d, 1
mov rbp, r8
seta r10b
mov ecx, r11d
nop word [rax + rax]
mov rax, r10
shr rax, cl
add rcx, rcx
or r10, rax
cmp rcx, 0x40
jne 0x1800fd2a0
and r10d, r11d
lea rbx, [r8 - 1]
dec r10
mov rsi, rbp
sub rsi, r9
not r10
test rbx, rbx
je 0x1800fd35a
mov qword [rsp + 0x18], rdi
lea rdi, [rdx - 1]
nop word [rax + rax]
movzx eax, byte [rdi + rbx + 1]
mov r8, r11
dec al
xor al, byte [rdi + rbx]
nop dword [rax]
movzx edx, al
movzx ecx, r8b
shr dl, cl
add r8, r8
or al, dl
cmp r8, 8
jne 0x1800fd2f0
and al, r11b
mov r9, r11
dec al
cmp rbx, rsi
seta r8b
nop dword [rax]
nop word [rax + rax]
movzx edx, r8b
movzx ecx, r9b
shr dl, cl
add r9, r9
or r8b, dl
cmp r9, 8
jne 0x1800fd320
and r8b, r11b
movzx eax, al
dec r8b
not eax
not r8b
cdqe
movzx edx, r8b
and rdx, rax
or r10, rdx
sub rbx, r11
jne 0x1800fd2e0
mov rdi, qword [rsp + 0x18]
mov rbx, qword [rsp + 0x10]
nop
mov rax, r10
mov rcx, r11
shr rax, cl
add r11, r11
or r10, rax
cmp r11, 0x40
jne 0x1800fd360
and r10d, 1
dec r10
not r10
mov rax, r10
and r10, rbp
mov rbp, qword [rsp + 0x20]
not rax
and rax, rsi
or rax, r10
pop rsi
ret

Function at 0x1800fd3a0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 0x20], rbp
push r14
mov qword [rsp + 0x20], rdi
lea r14, [r8 - 1]
xor dil, dil
xor r11b, r11b
mov rbp, r8
mov r10d, 1
test r8, r8
je 0x1800fd453
mov qword [rsp + 0x10], rbx
lea rbx, [rdx - 1]
mov qword [rsp + 0x18], rsi
add rbx, r8
mov rsi, r8
nop dword [rax]
movzx eax, byte [rbx]
mov r9, r10
movzx r8d, al
xor r8b, 0x80
nop
movzx edx, r8b
movzx ecx, r9b
shr dl, cl
add r9, r9
or r8b, dl
cmp r9, 8
jne 0x1800fd3f0
and r8b, r10b
dec r8b
or r11b, r8b
mov r8, r10
movzx ecx, r11b
not cl
and ecx, r10d
sub r14, rcx
nop
movzx edx, al
movzx ecx, r8b
shr dl, cl
add r8, r8
or al, dl
cmp r8, 8
jne 0x1800fd420
and al, r10b
dec rbx
dec al
or al, r11b
not al
or dil, al
sub rsi, r10
jne 0x1800fd3e0
mov rsi, qword [rsp + 0x18]
mov rbx, qword [rsp + 0x10]
movzx eax, dil
not r11b
mov rdi, qword [rsp + 0x20]
movzx edx, r11b
or rdx, rax
nop word [rax + rax]
mov rax, rdx
mov rcx, r10
shr rax, cl
add r10, r10
or rdx, rax
cmp r10, 0x40
jne 0x1800fd470
and edx, 1
dec rdx
not rdx
mov rax, rdx
and rdx, rbp
mov rbp, qword [rsp + 0x28]
not rax
and rax, r14
or rax, rdx
pop r14
ret
Function at 0x1800fd4b0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
movzx ebp, byte [rdx + r8 - 1]
xor r10d, r10d
cmp rbp, r8
mov r11d, 1
mov r14, r8
mov rsi, rdx
seta r10b
mov r9d, ebp
mov ecx, r11d
nop dword [rax + rax]
mov rax, r10
shr rax, cl
add rcx, rcx
or r10, rax
cmp rcx, 0x40
jne 0x1800fd4f0
and r10d, r11d
lea rbx, [r8 - 2]
dec r10
mov rdi, r14
sub rdi, r9
not r10
test rbx, rbx
je 0x1800fd5a0
nop
movzx eax, byte [rbx + rsi]
mov r8, r11
xor al, bpl
nop word [rax + rax]
movzx edx, al
movzx ecx, r8b
shr dl, cl
add r8, r8
or al, dl
cmp r8, 8
jne 0x1800fd530
and al, r11b
mov r9, r11
dec al
cmp rbx, rdi
setae r8b
nop dword [rax]
nop word [rax + rax]
movzx edx, r8b
movzx ecx, r9b
shr dl, cl
add r9, r9
or r8b, dl
cmp r9, 8
jne 0x1800fd560
and r8b, r11b
movzx eax, al
dec r8b
not eax
not r8b
cdqe
movzx edx, r8b
and rdx, rax
or r10, rdx
sub rbx, r11
jne 0x1800fd520
nop word [rax + rax]
mov rax, r10
mov rcx, r11
shr rax, cl
add r11, r11
or r10, rax
cmp r11, 0x40
jne 0x1800fd5a0
mov rbx, qword [rsp + 0x10]
and r10d, 1
mov rbp, qword [rsp + 0x18]
dec r10
mov rsi, qword [rsp + 0x20]
not r10
mov rax, r10
and r10, r14
not rax
and rax, rdi
mov rdi, qword [rsp + 0x28]
or rax, r10
pop r14
ret