joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14007e6a0
Capabilities:
Hash data using fnv

Disassembly:
mov rax, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov edx, dword [rsp + 8]
xor ebx, ebx
jmp 0x14007e6c1
movzx esi, byte [rax + rbx]
inc rbx
imul edx, edx, 0x1000193
xor edx, esi
cmp rcx, rbx
jg 0x14007e6b2
mov dword [rsp + 0x28], edx
ret

Function at 0x14009b520
Capabilities:
Access peb ldr_data
Encode data using xor
Get ntdll base address
Populate syswhispers2 syscall list
Resolve function by parsing pe exports

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x38
mov esi, dword [0x140212080]
test esi, esi
jne 0x14009b72d
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rdx, qword [rax + 0x10]
mov rax, qword [rdx + 0x30]
test rax, rax
je 0x14009b743
xor r9d, r9d
nop
mov rbx, rax
movsxd rax, dword [rax + 0x3c]
mov eax, dword [rbx + rax + 0x88]
test eax, eax
je 0x14009b59c
lea r9, [rbx + rax]
mov eax, dword [r9 + 0xc]
add rax, rbx
mov ecx, dword [rax]
or ecx, 0x20202020
cmp ecx, 0x6c64746e
jne 0x14009b59c
mov eax, dword [rax + 4]
or eax, 0x20202020
cmp eax, 0x6c642e6c
je 0x14009b5b1
mov rdx, qword [rdx]
mov rax, qword [rdx + 0x30]
test rax, rax
jne 0x14009b560
test r9, r9
je 0x14009b743
mov ebp, dword [r9 + 0x1c]
mov r8d, dword [r9 + 0x24]
xor edi, edi
lea r12, [0x140212088]
lea rax, [rbp + rbx]
lea rbp, [r8 + rbx]
mov qword [rsp + 0x28], rax
mov eax, dword [r9 + 0x18]
lea edx, [rax - 1]
mov eax, dword [r9 + 0x20]
lea r13, [rbp + rdx*2]
add rax, rbx
lea r14, [rax + rdx*4]
jmp 0x14009b604
sub r14, 4
lea rax, [r13 - 2]
cmp rbp, r13
je 0x14009b6a0
mov r13, rax
mov eax, dword [r14]
add rax, rbx
cmp word [rax], 0x775a
jne 0x14009b5f0
mov r15d, edi
shl r15, 4
add r15, r12
cmp byte [rax], 0
je 0x14009b747
cmp byte [rax + 1], 0
mov ecx, 0x93723eb9
mov edx, 1
mov r9d, 1
je 0x14009b65d
nop word [rax + rax]
mov r10d, ecx
movzx edx, word [rax + rdx]
add r9d, 1
ror r10d, 8
add edx, r10d
xor ecx, edx
mov edx, r9d
cmp byte [rax + rdx], 0
jne 0x14009b640
mov dword [r15], ecx
movzx eax, word [r13]
add edi, 1
mov rcx, qword [rsp + 0x28]
mov eax, dword [rcx + rax*4]
mov dword [r15 + 4], eax
lea rcx, [rax + rbx]
call fcn.14009b430
mov qword [r15 + 8], rax
cmp edi, 0x1f4
jne 0x14009b5f0
mov dword [0x140212080], 0x1f4
mov r9d, 0x1f3
jmp 0x14009b6af
mov dword [0x140212080], edi
lea r9d, [rdi - 1]
cmp edi, 1
je 0x14009b72d
lea r11d, [rdi - 2]
lea r10, [0x140212098]
nop word [rax + rax]
mov eax, edi
sub eax, esi
cmp eax, 1
je 0x14009b725
mov r8d, r11d
lea rax, [0x140212088]
sub r8d, esi
shl r8, 4
add r8, r10
nop dword [rax]
mov edx, dword [rax + 4]
mov ecx, dword [rax + 0x14]
cmp ecx, edx
jae 0x14009b71c
movd xmm2, edx
movd xmm3, ecx
mov rdx, qword [rax + 8]
mov rcx, qword [rax + 0x18]
movd xmm0, dword [rax]
movd xmm1, dword [rax + 0x10]
mov qword [rax + 8], rcx
mov qword [rax + 0x18], rdx
punpckldq xmm0, xmm2
punpckldq xmm1, xmm3
movq qword [rax], xmm1
movq qword [rax + 0x10], xmm0
add rax, 0x10
cmp r8, rax
jne 0x14009b6e0
add esi, 1
cmp esi, r9d
jb 0x14009b6c0
mov eax, 1
add rsp, 0x38
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
xor eax, eax
jmp 0x14009b732
mov ecx, 0x8dfc4d1e
jmp 0x14009b65d
Function at 0x1400ab0f0
Capabilities:
Write file on windows

Disassembly:
push rsi
push rbx
sub rsp, 0x38
mov rbx, rcx
lea rax, [rsp + 0x58]
mov ecx, 2
mov qword [rsp + 0x58], rdx
mov qword [rsp + 0x60], r8
mov qword [rsp + 0x68], r9
mov qword [rsp + 0x28], rax
call fcn.1400ac1c0
mov r8d, 0x1b
mov edx, 1
lea rcx, str.Mingw_w64_runtime_failure:_n
mov r9, rax
call sub.msvcrt.dll_fwrite
mov rsi, qword [rsp + 0x28]
mov ecx, 2
call fcn.1400ac1c0
mov rdx, rbx
mov rcx, rax
mov r8, rsi
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort
nop
nop dword [rax]

Function at 0x1400ab160
Capabilities:
Allocate or change rwx memory

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x50
movsxd rsi, dword [0x140214ab4]
mov rbx, rcx
test esi, esi
jle 0x1400ab290
mov rax, qword [0x140214ab8]
xor r9d, r9d
add rax, 0x18
nop word [rax + rax]
mov r8, qword [rax]
cmp rbx, r8
jb 0x1400ab1ab
mov rdx, qword [rax + 8]
mov edx, dword [rdx + 8]
add r8, rdx
cmp rbx, r8
jb 0x1400ab235
add r9d, 1
add rax, 0x28
cmp r9d, esi
jne 0x1400ab190
mov rcx, rbx
call fcn.1400abbd0
mov rdi, rax
test rax, rax
je 0x1400ab2b2
mov rax, qword [0x140214ab8]
lea rbx, [rsi + rsi*4]
shl rbx, 3
add rax, rbx
mov qword [rax + 0x20], rdi
mov dword [rax], 0
call fcn.1400abd10
mov edx, dword [rdi + 0xc]
mov r8d, 0x30
lea rcx, [rax + rdx]
mov rax, qword [0x140214ab8]
lea rdx, [rsp + 0x20]
mov qword [rax + rbx + 0x18], rcx
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x1400ab297
mov eax, dword [rsp + 0x44]
lea edx, [rax - 4]
and edx, 0xfffffffb
je 0x1400ab22e
lea edx, [rax - 0x40]
and edx, 0xffffffbf
jne 0x1400ab240
add dword [0x140214ab4], 1
add rsp, 0x50
pop rbx
pop rsi
pop rdi
ret
cmp eax, 2
mov rcx, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x38]
mov r8d, 0x40
mov eax, 4
cmove r8d, eax
add rbx, qword [0x140214ab8]
mov qword [rbx + 8], rcx
mov r9, rbx
mov qword [rbx + 0x10], rdx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x1400ab22e
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.__VirtualProtect_failed_with_code_0x_x
mov edx, eax
call fcn.1400ab0f0
nop dword [rax]
xor esi, esi
jmp 0x1400ab1b8
mov rax, qword [0x140214ab8]
mov edx, dword [rdi + 8]
lea rcx, str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov r8, qword [rax + rbx + 0x18]
call fcn.1400ab0f0
mov rdx, rbx
lea rcx, str.Address__p_has_no_image_section
call fcn.1400ab0f0
nop
nop word cs:[rax + rax]
nop dword [rax]

Function at 0x1400ab840
Capabilities:
Get thread local storage value

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x20
lea r12, [0x140214b20]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rbx, qword [0x140214b00]
test rbx, rbx
je 0x1400ab89c
mov rbp, qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rdi, qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax]
mov ecx, dword [rbx]
call rbp
mov rsi, rax
call rdi
test rsi, rsi
je 0x1400ab893
test eax, eax
jne 0x1400ab893
mov rax, qword [rbx + 8]
mov rcx, rsi
call rax
mov rbx, qword [rbx + 0x10]
test rbx, rbx
jne 0x1400ab878
mov rcx, r12
add rsp, 0x20
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
jmp qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
Function at 0x1400abbd0
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
mov rdx, qword [0x1401c5270]
xor eax, eax
cmp word [rdx], 0x5a4d
jne 0x1400abbf0
movsxd r8, dword [rdx + 0x3c]
add r8, rdx
cmp dword [r8], 0x4550
je 0x1400abbf8
ret
cmp word [r8 + 0x18], 0x20b
jne 0x1400abbf0
movzx eax, word [r8 + 0x14]
sub rcx, rdx
lea rax, [r8 + rax + 0x18]
movzx r8d, word [r8 + 6]
test r8w, r8w
je 0x1400abc4d
lea edx, [r8 - 1]
lea rdx, [rdx + rdx*4]
lea r9, [rax + rdx*8 + 0x28]
nop word cs:[rax + rax]
mov r8d, dword [rax + 0xc]
mov rdx, r8
cmp rcx, r8
jb 0x1400abc44
add edx, dword [rax + 8]
cmp rcx, rdx
jb 0x1400abbf0
add rax, 0x28
cmp rax, r9
jne 0x1400abc30
xor eax, eax
ret

Function at 0x1400abc50
Capabilities:
Parse pe header

Disassembly:
mov rax, qword [0x1401c5270]
xor ecx, ecx
cmp word [rax], 0x5a4d
jne 0x1400abc6f
movsxd rdx, dword [rax + 0x3c]
add rax, rdx
cmp dword [rax], 0x4550
je 0x1400abc78
mov eax, ecx
ret
cmp word [rax + 0x18], 0x20b
jne 0x1400abc6f
movzx ecx, word [rax + 6]
mov eax, ecx
ret

Function at 0x1400abd10
Capabilities:
Parse pe header

Disassembly:
mov rax, qword [0x1401c5270]
xor edx, edx
cmp word [rax], 0x5a4d
jne 0x1400abd2f
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
je 0x1400abd38
mov rax, rdx
ret
cmp word [rcx + 0x18], 0x20b
cmove rdx, rax
mov rax, rdx
ret
Function at 0x401cc0
Capabilities:
Enumerate processes

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x158
xor edx, edx
lea rbx, [rsp + 0x20]
mov rbp, rcx
mov ecx, 2
mov dword [rsp + 0x20], 0x130
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
lea rdi, [rbx + 0x2c]
mov rdx, rbx
mov rcx, rax
mov rsi, rax
call sub.KERNEL32.dll_Process32First
test eax, eax
jne 0x401d0f
jmp 0x401d1e
mov rdx, rbp
mov rcx, rdi
call sub.msvcrt.dll_strcmp
test eax, eax
je 0x401d35
mov rdx, rbx
mov rcx, rsi
call sub.KERNEL32.dll_Process32Next
test eax, eax
jne 0x401d00
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
add rsp, 0x158
pop rbx
pop rsi
pop rdi
pop rbp
ret
mov eax, dword [rsp + 0x28]
add rsp, 0x158
pop rbx
pop rsi
pop rdi
pop rbp
ret

Function at 0x401d50
Capabilities:
Enumerate process modules

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x268
mov r8d, 0x238
lea rsi, [rsp + 0x20]
mov ebx, edx
mov rdi, rcx
xor edx, edx
mov rcx, rsi
call sub.msvcrt.dll_memset
mov edx, ebx
mov ecx, 8
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov rbx, rax
xor eax, eax
test rbx, rbx
je 0x401ddc
mov rdx, rsi
mov rcx, rbx
mov dword [rsp + 0x20], 0x238
call sub.KERNEL32.dll_Module32First
test eax, eax
je 0x401df0
lea rbp, [rsi + 0x30]
jmp 0x401dbf
mov rdx, rsi
mov rcx, rbx
call sub.KERNEL32.dll_Module32Next
test eax, eax
je 0x401df0
mov rdx, rdi
mov rcx, rbp
call sub.msvcrt.dll_strcmp
test eax, eax
jne 0x401db0
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rax, qword [rsp + 0x38]
add rsp, 0x268
pop rbx
pop rsi
pop rdi
pop rbp
ret
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
add rsp, 0x268
pop rbx
pop rsi
pop rdi
pop rbp
ret
Function at 0x402610
Capabilities:
Allocate or change rwx memory

Disassembly:
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x50
movsxd rsi, dword [0x00408624]
test esi, esi
mov rbx, rcx
mov rbp, rdx
mov rdi, r8
jle 0x402798
mov rax, qword [0x00408628]
xor ecx, ecx
add rax, 0x18
nop
mov rdx, qword [rax]
cmp rbx, rdx
jb 0x40265c
mov r8, qword [rax + 8]
mov r8d, dword [r8 + 8]
add rdx, r8
cmp rbx, rdx
jb 0x4026e5
add ecx, 1
add rax, 0x28
cmp ecx, esi
jne 0x402640
mov rcx, rbx
call fcn.004032b0
test rax, rax
mov r12, rax
je 0x4027cd
mov rax, qword [0x00408628]
lea rsi, [rsi + rsi*4]
shl rsi, 3
add rax, rsi
mov qword [rax + 0x20], r12
mov dword [rax], 0
call fcn.004033e0
mov ecx, dword [r12 + 0xc]
lea rdx, [rsp + 0x20]
mov r8d, 0x30
add rcx, rax
mov rax, qword [0x00408628]
mov qword [rax + rsi + 0x18], rcx
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
je 0x4027b0
mov eax, dword [rsp + 0x44]
lea edx, [rax - 4]
and edx, 0xfffffffb
je 0x4026de
sub eax, 0x40
and eax, 0xffffffbf
jne 0x402740
add dword [0x00408624], 1
cmp edi, 8
jae 0x402713
test dil, 4
jne 0x402784
test edi, edi
je 0x402708
movzx eax, byte [rbp]
test dil, 2
mov byte [rbx], al
jne 0x40279f
add rsp, 0x50
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
ret
mov eax, edi
sub edi, 1
mov rdx, qword [rbp + rax - 8]
cmp edi, 8
mov qword [rbx + rax - 8], rdx
jb 0x402708
and edi, 0xfffffff8
xor eax, eax
mov edx, eax
add eax, 8
mov rcx, qword [rbp + rdx]
cmp eax, edi
mov qword [rbx + rdx], rcx
jb 0x40272c
jmp 0x402708
add rsi, qword [0x00408628]
mov r8d, 0x40
mov rcx, qword [rsp + 0x20]
mov rdx, qword [rsp + 0x38]
mov r9, rsi
mov qword [rsi + 8], rcx
mov qword [rsi + 0x10], rdx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x4026de
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.__VirtualProtect_failed_with_code_0x_x
mov edx, eax
call fcn.004038b0
mov eax, dword [rbp]
mov edi, edi
mov dword [rbx], eax
mov eax, dword [rbp + rdi - 4]
mov dword [rbx + rdi - 4], eax
jmp 0x402708
xor esi, esi
jmp 0x402667
mov edi, edi
movzx eax, word [rbp + rdi - 2]
mov word [rbx + rdi - 2], ax
jmp 0x402708
mov rax, qword [0x00408628]
lea rcx, str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov edx, dword [r12 + 8]
mov r8, qword [rax + rsi + 0x18]
call fcn.004038b0
lea rcx, str.Address__p_has_no_image_section
mov rdx, rbx
call fcn.004038b0
nop
nop dword [rax]

Function at 0x402f20
Capabilities:
Get thread local storage value

Disassembly:
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x28
lea rcx, [0x00408900]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rbx, qword [0x004088e0]
test rbx, rbx
je 0x402f74
mov rbp, qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov rdi, qword [sym.imp.KERNEL32.dll_GetLastError]
nop
mov ecx, dword [rbx]
call rbp
mov rsi, rax
call rdi
test eax, eax
jne 0x402f6b
test rsi, rsi
je 0x402f6b
mov rax, qword [rbx + 8]
mov rcx, rsi
call rax
mov rbx, qword [rbx + 0x10]
test rbx, rbx
jne 0x402f50
lea rcx, [0x00408900]
add rsp, 0x28
pop rbx
pop rsi
pop rdi
pop rbp
jmp qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
Function at 0x4032b0
Capabilities:
Enumerate pe sections

Disassembly:
sub rsp, 0x28
mov r8, qword [0x00405880]
cmp word [r8], 0x5a4d
mov rdx, rcx
jne 0x40331d
mov rcx, r8
call fcn.00403190
test eax, eax
je 0x40331d
movsxd rax, dword [r8 + 0x3c]
mov rcx, rdx
sub rcx, r8
add r8, rax
movzx edx, word [r8 + 6]
movzx eax, word [r8 + 0x14]
test edx, edx
lea rax, [r8 + rax + 0x18]
je 0x40331d
sub edx, 1
lea rdx, [rdx + rdx*4]
lea r9, [rax + rdx*8 + 0x28]
nop
mov r8d, dword [rax + 0xc]
cmp rcx, r8
mov rdx, r8
jb 0x403314
add edx, dword [rax + 8]
cmp rcx, rdx
jb 0x40331f
add rax, 0x28
cmp rax, r9
jne 0x403300
xor eax, eax
add rsp, 0x28
ret
Function at 0x4038b0
Capabilities:
Write file on windows

Disassembly:
lea rcx, [0x00401540]
jmp 0x401510
push rsi
push rbx
sub rsp, 0x38
lea rax, [rsp + 0x58]
mov rbx, rcx
mov ecx, 2
mov qword [rsp + 0x58], rdx
mov qword [rsp + 0x60], r8
mov qword [rsp + 0x68], r9
mov qword [rsp + 0x28], rax
call fcn.00403680
mov r8d, 0x1b
mov edx, 1
lea rcx, str.Mingw_w64_runtime_failure:_n
mov r9, rax
call sub.msvcrt.dll_fwrite
mov rsi, qword [rsp + 0x28]
mov ecx, 2
call fcn.00403680
mov rdx, rbx
mov rcx, rax
mov r8, rsi
call sub.msvcrt.dll_vfprintf
call sub.msvcrt.dll_abort
nop
nop
nop
nop
nop
nop
nop
nop
jmp 0x401530
Function at 0x1800099ec
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov word [rsp + 0x20], r9w
mov word [rsp + 0x18], r8w
mov word [rsp + 0x10], dx
sub rsp, 0x38
movzx eax, word [0x1800100ac]
mov r8d, 0x883367c5
mov dword [rsp + 8], eax
mov eax, 0xfffffb9b
mov word [rsp], ax
movzx eax, byte [0x18001005f]
mov qword [rsp + 0x10], rax
mov eax, 0xffffe81e
mov dword [rsp + 4], 0x38611cf
mov qword [rsp + 0x28], 0x20e4
mov qword [rsp + 0x18], 0xa
mov word [rsp + 0x60], ax
mov rax, qword [0x180058568]
mov byte [rsp + 0x50], al
mov byte [rsp + 0x48], 5
mov dword [rsp + 0x58], 0x4d47
mov eax, dword [0x18001008c]
mov byte [rsp + 0x58], al
movzx eax, word [0x1800100b0]
mov dword [rsp + 0x40], 0x198e
mov qword [rsp + 0x20], rax
mov eax, 0x2461
mov word [rsp + 0x40], ax
mov byte [rsp + 0x40], 0x9b
mov al, byte [0x18001005e]
mov eax, dword [0x1800100a8]
mov dword [rsp + 0x40], eax
mov r9, qword [0x1800100c0]
movsx eax, byte [0x18001007e]
mov dword [rsp + 0x40], eax
mov eax, 0x9a
mov word [rsp + 0x40], ax
movsx eax, byte [rsp + 0x58]
movsx edx, byte [rsp + 0x58]
add edx, eax
mov dword [rsp + 0xc], 0xd2b1876b
mov eax, dword [rsp + 8]
add al, dl
mov byte [rsp + 0x58], al
movsx rax, word [0x1800100cc]
cmp qword [0x1800100e8], rax
jae 0x180009afe
movsx eax, byte [0x1800100b0]
imul ecx, eax, 0xffffffb9
mov byte [rsp + 0x50], cl
jmp 0x180009bbd
cmp byte [0x180010037], 0
jne 0x180009bbd
mov al, byte [rsp + 0x50]
test al, al
je 0x180009b6b
mov cl, byte [0x18001007e]
mov edx, 0x3b
mov al, cl
add al, al
add cl, al
mov rax, qword [rsp + 0x20]
sub dl, cl
sub dl, al
mov al, byte [0x180010033]
mov rcx, qword [0x180010098]
xor al, dl
mov byte [0x18001005a], al
movzx eax, byte [0x18001005a]
add rcx, rax
mov qword [0x180010098], rcx
mov ecx, dword [rsp + 4]
mov eax, dword [rsp + 4]
sub rcx, rax
mov rax, qword [rsp + 0x10]
add eax, ecx
mov dword [rsp + 4], eax
jmp 0x180009bbd
mov rax, qword [0x180010090]
xor edx, edx
test rax, rax
movzx eax, word [0x1800100d8]
sete dl
imul eax, eax, 0x8661
cmp edx, eax
jl 0x180009bbd
mov eax, dword [0x1800100f0]
xor r8d, r8d
add eax, 0x6daab3bc
xor ecx, ecx
mov dword [0x180010084], eax
mov al, byte [rsp + 0x48]
mov rax, qword [rsp + 0x10]
test rax, rax
mov qword [rsp + 0x18], 0x7200
sete r8b
sub r8d, ecx
mov dword [rsp + 8], 0
mov ecx, 0x16f6
movzx eax, byte [0x18001007a]
mov dword [0x180354904], eax
mov al, byte [0x18001007f]
inc al
mov byte [0x18001007f], al
mov rax, qword [rsp + 0x18]
add eax, 0xc2
mov dword [rsp + 0x58], eax
mov eax, dword [rsp + 8]
mov eax, dword [rsp + 0x58]
movzx eax, byte [0x180401cd1]
sub word [0x180058560], ax
mov eax, 0xc432
sub ax, r8w
add word [0x1800100f8], ax
movsx eax, word [rsp]
mov dword [0x1800100dc], eax
movzx eax, word [rsp + 0x60]
mov edx, 0xb9
add ax, r8w
add ax, dx
mov word [rsp + 0x60], ax
mov rax, qword [rsp + 0x28]
sub rcx, 1
jne 0x180009c23
mov dword [rsp + 0x58], 0xc2b2431c
test r8d, r8d
je 0x180009c57
mov eax, dword [rsp + 0x58]
jmp 0x180009c5b
mov ecx, dword [rsp + 0xc]
movzx eax, r9w
add rsp, 0x38
ret
Function at 0x180009c64
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov word [rsp + 0x20], r9w
mov word [rsp + 0x10], dx
mov word [rsp + 8], cx
sub rsp, 0x38
mov eax, dword [0x180010084]
xor r10d, r10d
movzx eax, word [str.bW_m]
movzx r9d, word [0x1800100a0]
mov word [rsp], ax
mov eax, 0x1b2f
mov dword [rsp + 0x58], 0x662ab938
mov word [rsp + 0x48], ax
movzx eax, word [0x1800100f8]
mov qword [rsp + 8], rax
movzx eax, byte [0x18001007a]
mov r8, qword [0x1800100b8]
mov word [rsp + 0x50], ax
mov rax, qword [0x1800100d0]
mov dword [rsp + 4], 0xc8e2bdeb
mov byte [rsp + 0x58], 0x3a
mov qword [rsp + 0x18], rax
mov eax, 0xaf
mov word [rsp + 0x40], ax
mov al, byte [0x18001007e]
mov byte [rsp + 0x50], al
movzx eax, word [0x180058560]
mov byte [rsp + 0x50], 0xbd
mov qword [rsp + 0x10], rax
mov rax, qword [0x180058568]
mov qword [rsp + 0x10], rax
mov al, byte [0x180010036]
mov byte [rsp + 0x50], al
mov al, byte [0x18001006a]
mov byte [rsp + 0x50], al
movsxd rax, dword [0x180058550]
mov qword [rsp + 0x20], rax
movzx eax, word [0x1800100b0]
mov word [rsp + 0x50], ax
mov byte [rsp + 0x50], 0x74
mov byte [rsp + 0x50], 0x8b
mov al, byte [0x18001007f]
mov dword [rsp + 0x50], 0xc92dec6
movsx eax, word [rsp + 0x40]
cmp eax, r9d
jle 0x180009d8a
mov rax, qword [rsp + 8]
movzx ecx, word [0x1800100e0]
imul rcx, qword [0x1800100e8]
sub rcx, rax
mov rax, qword [rsp + 0x10]
add ax, cx
mov word [rsp + 0x48], ax
movzx eax, word [rsp]
jmp 0x180009e15
movsx rcx, word [rsp + 0x48]
mov edx, r10d
mov rax, qword [0x180058568]
cmp rcx, rax
movzx eax, word [0x1800100ac]
sete dl
cmp edx, eax
ja 0x180009db7
mov eax, 2
mov word [rsp + 0x50], ax
jmp 0x180009e15
cmp qword [str.bW_m], 0xa2
jl 0x180009de7
movsx eax, word [0x180010080]
imul ecx, eax, 0x3d2bb7d1
xor r8b, byte [0x1800100b8]
mov dword [0x1800100e4], ecx
mov byte [0x18001006a], r8b
jmp 0x180009e15
cmp word [0x1800100b0], r10w
je 0x180009e15
movsxd rax, dword [rsp + 4]
mov rdx, qword [rsp + 0x18]
imul rdx, rax
mov eax, dword [rsp + 4]
add eax, edx
mov dword [rsp + 4], eax
mov eax, 0xffffdcc4
mov word [0x180010080], ax
mov edx, 0x2cc
movzx eax, word [rsp + 0x48]
dec edx
movzx eax, byte [0x180010033]
imul eax, eax, 0xf
mov byte [0x18001007f], al
mov eax, dword [rsp + 4]
inc eax
mov dword [rsp + 4], eax
test edx, edx
jg 0x180009e1a
movsx eax, word [0x1800100b4]
mov ecx, r9d
not eax
mov word [0x18001007c], r10w
mov dword [rsp + 4], eax
mov al, byte [0x18001005f]
mov byte [0x180412b1d], al
mov eax, 0xd511
imul ecx, eax
mov word [0x1800100ac], cx
mov ecx, dword [0x18001008c]
neg rcx
mov qword [0x1800100e8], rcx
mov rcx, qword [rsp + 0x10]
mov rax, qword [rsp + 8]
imul rcx, rax
mov qword [rsp + 8], rcx
mov ecx, 0xffffa67f
movzx eax, byte [rsp + 0x58]
and ax, cx
mov word [0x180010080], ax
movzx eax, word [rsp + 0x40]
add rsp, 0x38
ret
Function at 0x18000e140
Capabilities:
Execute syscall

Disassembly:
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], r9
sub rsp, 0x28
mov ecx, 0x4b9c4f07
call fcn.18000dc0c
add rsp, 0x28
mov rcx, qword [rsp + 8]
mov rdx, qword [rsp + 0x10]
mov r8, qword [rsp + 0x18]
mov r9, qword [rsp + 0x20]
mov r10, rcx
syscall
ret

Function at 0x18000e180
Capabilities:
Execute syscall

Disassembly:
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], r9
sub rsp, 0x28
mov ecx, 0x5a8d145d
call fcn.18000dc0c
add rsp, 0x28
mov rcx, qword [rsp + 8]
mov rdx, qword [rsp + 0x10]
mov r8, qword [rsp + 0x18]
mov r9, qword [rsp + 0x20]
mov r10, rcx
syscall
ret

Function at 0x18000e1c0
Capabilities:
Execute syscall

Disassembly:
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], r9
sub rsp, 0x28
mov ecx, 0x3964b57
call fcn.18000dc0c
add rsp, 0x28
mov rcx, qword [rsp + 8]
mov rdx, qword [rsp + 0x10]
mov r8, qword [rsp + 0x18]
mov r9, qword [rsp + 0x20]
mov r10, rcx
syscall
ret

Function at 0x18000e200
Capabilities:
Execute syscall

Disassembly:
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], r9
sub rsp, 0x28
mov ecx, 0x17991117
call fcn.18000dc0c
add rsp, 0x28
mov rcx, qword [rsp + 8]
mov rdx, qword [rsp + 0x10]
mov r8, qword [rsp + 0x18]
mov r9, qword [rsp + 0x20]
mov r10, rcx
syscall
ret

Function at 0x18000e240
Capabilities:
Execute syscall

Disassembly:
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], r9
sub rsp, 0x28
mov ecx, 0xe56f10e3
call fcn.18000dc0c
add rsp, 0x28
mov rcx, qword [rsp + 8]
mov rdx, qword [rsp + 0x10]
mov r8, qword [rsp + 0x18]
mov r9, qword [rsp + 0x20]
mov r10, rcx
syscall
ret

Function at 0x18000e280
Capabilities:
Execute syscall

Disassembly:
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], r9
sub rsp, 0x28
mov ecx, 0x8d096c64
call fcn.18000dc0c
add rsp, 0x28
mov rcx, qword [rsp + 8]
mov rdx, qword [rsp + 0x10]
mov r8, qword [rsp + 0x18]
mov r9, qword [rsp + 0x20]
mov r10, rcx
syscall
ret

Function at 0x18000e2c0
Capabilities:
Execute syscall

Disassembly:
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], r9
sub rsp, 0x28
mov ecx, 0x41cd5b5f
call fcn.18000dc0c
add rsp, 0x28
mov rcx, qword [rsp + 8]
mov rdx, qword [rsp + 0x10]
mov r8, qword [rsp + 0x18]
mov r9, qword [rsp + 0x20]
mov r10, rcx
syscall
ret

Function at 0x18000e300
Capabilities:
Execute syscall

Disassembly:
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], r9
sub rsp, 0x28
mov ecx, 0x3974b57
call fcn.18000dc0c
add rsp, 0x28
mov rcx, qword [rsp + 8]
mov rdx, qword [rsp + 0x10]
mov r8, qword [rsp + 0x18]
mov r9, qword [rsp + 0x20]
mov r10, rcx
syscall
ret
Function at 0x18000e340
Capabilities:
Execute syscall

Disassembly:
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], r9
sub rsp, 0x28
mov ecx, 0xcd502f0f
call fcn.18000dc0c
add rsp, 0x28
mov rcx, qword [rsp + 8]
mov rdx, qword [rsp + 0x10]
mov r8, qword [rsp + 0x18]
mov r9, qword [rsp + 0x20]
mov r10, rcx
syscall
ret

Function at 0x18000e380
Capabilities:
Execute syscall

Disassembly:
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], r9
sub rsp, 0x28
mov ecx, 0x1db0d0f4
call fcn.18000dc0c
add rsp, 0x28
mov rcx, qword [rsp + 8]
mov rdx, qword [rsp + 0x10]
mov r8, qword [rsp + 0x18]
mov r9, qword [rsp + 0x20]
mov r10, rcx
syscall
ret