joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140014660
Capabilities:
Read file on windows

Disassembly:
push rbp
push rsi
push r14
sub rsp, 0x30
mov rbp, r8
mov r14, rdx
mov rsi, rcx
test r8, r8
jg 0x140014682
xor eax, eax
add rsp, 0x30
pop r14
pop rsi
pop rbp
ret
cmp qword [rcx + 0x68], 0
je case.default.0x140014691
add rsp, 0x30
pop r14
pop rsi
pop rbp
jmp qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsgetn_char____ptr64__long_long___int64_____ptr64]
mov rax, qword [rcx + 0x38]
mov qword [rsp + 0x28], rbx
mov rbx, rbp
mov rdx, qword [rax]
test rdx, rdx
je 0x1400146b4
mov rax, qword [rcx + 0x50]
mov ecx, dword [rax]
jmp 0x1400146b6
xor ecx, ecx
movsxd rax, ecx
test ecx, ecx
je 0x1400146f2
mov qword [rsp + 0x20], rdi
cmp rax, rbp
mov rdi, rbp
mov rcx, r14
cmovb rdi, rax
mov r8, rdi
call sub.VCRUNTIME140.dll_memcpy
mov rax, qword [rsi + 0x50]
add r14, rdi
sub rbx, rdi
sub dword [rax], edi
mov rcx, qword [rsi + 0x38]
movsxd rax, edi
mov rdi, qword [rsp + 0x20]
add qword [rcx], rax
cmp qword [rsi + 0x80], 0
je 0x14001478e
mov r8, qword [rsi + 0x18]
lea rax, [rsi + 0x70]
cmp qword [r8], rax
jne 0x14001472d
mov rcx, qword [rsi + 0x88]
mov rdx, qword [rsi + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rsi + 0x38]
mov qword [rax], rcx
mov rax, qword [rsi + 0x50]
mov dword [rax], edx
cmp rbx, 0xfff
jbe 0x14001476e
nop word [rax + rax]
mov r9, qword [rsi + 0x80]
mov edx, 1
mov r8d, 0xfff
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
add r14, rax
sub rbx, rax
cmp rax, 0xfff
jne 0x14001478e
cmp rbx, rax
ja 0x140014740
test rbx, rbx
je 0x14001478e
mov r9, qword [rsi + 0x80]
mov r8, rbx
mov edx, 1
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
sub rbx, rax
sub rbp, rbx
mov rbx, qword [rsp + 0x28]
mov rax, rbp
add rsp, 0x30
pop r14
pop rsi
pop rbp
ret
in al, dx
sbb byte [r8], dl
Function at 0x140014bf0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x80
mov rax, qword [0x14003a040]
xor rax, rsp
mov qword [rsp + 0x78], rax
mov edi, edx
mov rbx, rcx
cmp edx, 0xffffffff
jne 0x140014c1d
xor eax, eax
jmp 0x140014d89
mov rax, qword [rcx + 0x40]
mov rdx, qword [rax]
test rdx, rdx
je 0x140014c57
mov rax, qword [rcx + 0x58]
movsxd r8, dword [rax]
lea rcx, [rdx + r8]
cmp rdx, rcx
jae 0x140014c57
lea ecx, [r8 - 1]
mov dword [rax], ecx
mov eax, edi
mov rdx, qword [rbx + 0x40]
mov r8, qword [rdx]
lea rcx, [r8 + 1]
mov qword [rdx], rcx
mov byte [r8], dil
jmp 0x140014d89
cmp qword [rbx + 0x80], 0
mov qword [rsp + 0xa0], rsi
je 0x140014d7c
mov r8, qword [rbx + 0x18]
lea rax, [rbx + 0x70]
cmp qword [r8], rax
jne 0x140014c9a
mov rcx, qword [rbx + 0x88]
mov rdx, qword [rbx + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rbx + 0x38]
mov qword [rax], rcx
mov rax, qword [rbx + 0x50]
mov dword [rax], edx
mov rcx, qword [rbx + 0x68]
test rcx, rcx
jne 0x140014cc5
mov rdx, qword [rbx + 0x80]
movsx ecx, dil
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
mov ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, edi
mov eax, ecx
jmp 0x140014d81
lea rax, [rsp + 0x40]
mov byte [rsp + 0x50], dil
mov qword [rsp + 0x38], rax
lea rdx, [rbx + 0x74]
lea rax, [rsp + 0x78]
mov qword [rsp + 0x30], rax
lea r9, [rsp + 0x51]
lea rax, [rsp + 0x58]
mov qword [rsp + 0x28], rax
lea r8, [rsp + 0x50]
lea rax, [rsp + 0x48]
mov qword [rsp + 0x20], rax
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::out_struct__Mbstatet____ptr64__char_const____ptr64__char_const____ptr64__char_const____ptr64____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x140014d34
sub eax, 1
je 0x140014d34
cmp eax, 2
jne 0x140014d7c
movsx ecx, byte [rsp + 0x50]
mov rdx, qword [rbx + 0x80]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
mov ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, edi
mov eax, ecx
jmp 0x140014d81
mov rsi, qword [rsp + 0x40]
lea rax, [rsp + 0x58]
sub rsi, rax
je 0x140014d62
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x58]
mov r8, rsi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rsi, rax
jne 0x140014d7c
lea rax, [rsp + 0x50]
mov byte [rbx + 0x71], 1
cmp qword [rsp + 0x48], rax
mov ecx, 0xffffffff
cmovne ecx, edi
mov eax, ecx
jmp 0x140014d81
mov eax, 0xffffffff
mov rsi, qword [rsp + 0xa0]
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.1400288d0
mov rbx, qword [rsp + 0xa8]
add rsp, 0x80
pop rdi
ret

Function at 0x140015cf0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
movabs rax, 0xcbf29ce484222325
mov r9d, 0
sub r8, rdx
je 0x140015d24
movabs r10, 0x100000001b3
nop
movzx ecx, byte [rdx + r9]
inc r9
xor rax, rcx
imul rax, r10
cmp r9, r8
jb 0x140015d10
ret
Function at 0x140016650
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
mov r10d, dword [0x140375c60]
lea r11, [0x140375c60]
mov r9d, 0x270
cmp r10d, r9d
jne 0x1400166b5
lea r8, [0x140375c68]
mov edx, dword [r8 - 4]
xor edx, dword [r8]
lea r8, [r8 + 4]
btr edx, 0x1f
xor edx, dword [r8 - 8]
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r8 + 0x62c]
xor ecx, edx
mov dword [r8 + 0x9b8], ecx
sub r9, 1
jne 0x140016670
mov r10d, dword [0x140375c60]
jmp 0x14001678f
cmp r10d, 0x4e0
jb 0x14001678f
xor r10d, r10d
mov r8d, 0x38c
mov r9d, r10d
nop
mov eax, dword [r9 + r11 + 0x9c4]
mov edx, eax
xor edx, dword [r9 + r11 + 0x9c8]
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r9 + r11 + 0xff8]
xor ecx, edx
mov dword [r9 + r11 + 4], ecx
add r9, 4
cmp r9, r8
jb 0x1400166d0
mov eax, dword [r8 + r11 + 0x9c4]
mov edx, eax
xor edx, dword [r8 + r11 + 0x9c8]
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r8 + r11 - 0x388]
xor ecx, edx
mov dword [r8 + r11 + 4], ecx
add r8, 4
cmp r8, 0x9bc
jb 0x140016710
mov edx, dword [0x140376fe0]
xor edx, dword [0x140375c64]
btr edx, 0x1f
mov dword [0x140375c60], r10d
xor edx, dword [0x140376fe0]
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, edx
xor ecx, dword [0x140376294]
mov dword [0x140376620], ecx
mov eax, r10d
mov ecx, dword [r11 + rax*4 + 4]
inc eax
mov dword [0x140375c60], eax
mov eax, ecx
shr eax, 0xb
and eax, dword [0x140376fe4]
xor ecx, eax
mov eax, ecx
and eax, 0xff3a58ad
shl eax, 7
xor ecx, eax
mov eax, ecx
and eax, 0xffffdf8c
shl eax, 0xf
xor ecx, eax
mov eax, ecx
shr eax, 0x12
xor eax, ecx
ret
Function at 0x1400167d0
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x60
mov rax, qword [0x14003a040]
xor rax, rsp
mov qword [rsp + 0x58], rax
cmp qword [rcx + 0x68], 0
mov rbx, rcx
je 0x1400168a3
cmp byte [rcx + 0x71], 0
je 0x1400168a3
mov rax, qword [rcx]
mov edx, 0xffffffff
mov qword [rsp + 0x78], rdi
call qword [rax + 0x18]
cmp eax, 0xffffffff
je 0x14001689f
mov rcx, qword [rbx + 0x68]
lea rax, [rsp + 0x30]
lea rdx, [rbx + 0x74]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x58]
lea r8, [rsp + 0x38]
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x140016864
sub eax, 1
je 0x140016868
cmp eax, 2
jne 0x14001689f
mov byte [rbx + 0x71], 0
mov al, 1
mov rdi, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.1400288d0
add rsp, 0x60
pop rbx
ret
mov byte [rbx + 0x71], 0
mov rdi, qword [rsp + 0x30]
lea rax, [rsp + 0x38]
sub rdi, rax
je 0x140016896
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x38]
mov r8, rdi
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rdi, rax
jne 0x14001689f
cmp byte [rbx + 0x71], 0
sete al
jmp 0x14001684c
xor al, al
jmp 0x14001684c
mov al, 1
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.1400288d0
add rsp, 0x60
pop rbx
ret
Function at 0x140016c80
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov rax, rsp
push rbp
push r14
push r15
sub rsp, 0x50
mov r14, r8
mov r15, rdx
mov rbp, rcx
cmp rdx, r8
je 0x140016d93
cmp qword [rdx + 0x28], 0xf
lea r8, [rdx + 0x10]
mov r10, qword [rcx + 0x18]
mov r9, qword [r8 + 0x10]
mov qword [rax + 0x10], rbx
mov rbx, rdx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov qword [rax - 0x20], r12
mov qword [rax - 0x28], r13
mov rax, qword [rcx + 8]
mov qword [rsp + 0x28], rax
mov rax, qword [rdx + 8]
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x38], r10
jbe 0x140016ce2
mov r8, qword [r8]
xor ecx, ecx
movabs rdx, 0xcbf29ce484222325
movabs r11, 0x100000001b3
test r9, r9
je 0x140016d14
nop dword [rax]
movzx eax, byte [r8 + rcx]
inc rcx
xor rdx, rax
imul rdx, r11
cmp rcx, r9
jb 0x140016d00
mov r12, qword [rbp + 0x30]
and r12, rdx
shl r12, 4
add r12, r10
mov rax, qword [r12]
mov r13, qword [r12 + 8]
mov qword [rsp + 0x30], rax
mov rdi, rbx
mov rsi, rbx
mov rbx, qword [rbx]
lea rcx, [rdi + 0x10]
call fcn.140022b80
mov edx, 0x50
mov rcx, rdi
call fcn.1400288f0
dec qword [rbp + 0x10]
cmp rdi, r13
je 0x140016da0
cmp rbx, r14
jne 0x140016d30
cmp qword [rsp + 0x30], r15
jne 0x140016d68
mov qword [r12], rbx
mov rax, qword [rsp + 0x20]
mov r12, qword [rsp + 0x48]
mov rdi, qword [rsp + 0x88]
mov rsi, qword [rsp + 0x80]
mov r13, qword [rsp + 0x40]
mov qword [rax], rbx
mov qword [rbx + 8], rax
mov rbx, qword [rsp + 0x78]
mov rax, r14
add rsp, 0x50
pop r15
pop r14
pop rbp
ret
mov r13, qword [rsp + 0x28]
cmp qword [rsp + 0x30], r15
jne 0x140016db5
mov qword [r12], r13
mov rax, r13
jmp 0x140016dba
mov rax, qword [rsp + 0x20]
mov qword [r12 + 8], rax
cmp rbx, r14
je 0x140016d68
nop dword [rax]
nop dword [rax + rax]
cmp qword [rbx + 0x28], 0xf
lea r8, [rbx + 0x10]
mov r9, qword [r8 + 0x10]
jbe 0x140016de2
mov r8, qword [r8]
xor edx, edx
movabs rcx, 0xcbf29ce484222325
test r9, r9
je 0x140016e19
movabs r13, 0x100000001b3
nop dword [rax]
movzx eax, byte [rdx + r8]
inc rdx
xor rcx, rax
imul rcx, r13
cmp rdx, r9
jb 0x140016e00
mov r13, qword [rsp + 0x28]
mov r12, qword [rbp + 0x30]
and r12, rcx
shl r12, 4
add r12, qword [rsp + 0x38]
mov r15, qword [r12 + 8]
nop
mov rdi, rbx
mov rsi, rbx
mov rbx, qword [rbx]
lea rcx, [rdi + 0x10]
call fcn.140022b80
mov edx, 0x50
mov rcx, rdi
call fcn.1400288f0
dec qword [rbp + 0x10]
cmp rdi, r15
je 0x140016e62
cmp rbx, r14
jne 0x140016e30
jmp 0x140016d64
mov qword [r12], r13
mov qword [r12 + 8], r13
cmp rbx, r14
jne 0x140016dd0
jmp 0x140016d68
Function at 0x140021bf0
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
mov rax, qword [0x14003a040]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov rbx, r8
mov rdi, rdx
mov ecx, 8
call fcn.140028a18
mov rcx, qword [rbx]
mov qword [rax], rcx
mov qword [rsp + 0x30], rax
lea rbx, [rdi + 8]
mov qword [rsp + 0x28], rbx
mov dword [rsp + 0x20], 0
mov r9, rax
lea r8, [0x140027ef0]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rdi], rax
test rax, rax
je 0x140021c69
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.1400288d0
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rdi
ret
mov dword [rbx], 0
mov ecx, 6
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
int3
Function at 0x140021e00
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
sub rsp, 0x28
mov rdi, r8
mov rsi, rdx
sub rdi, rdx
sar rdi, 2
test rdi, rdi
je 0x140021fe3
mov qword [rsp + 0x40], rbx
mov rbx, qword [0x140376ff0]
sub rbx, qword [0x140376fe8]
mov qword [rsp + 0x50], r13
sar rbx, 2
mov qword [rsp + 0x58], r14
mov qword [rsp + 0x20], r15
cmp rdi, 0x26f
jb 0x140021e53
mov eax, listen
jmp 0x140021e81
cmp rdi, 0x44
jb 0x140021e60
mov eax, 7
jmp 0x140021e81
cmp rdi, 0x27
jb 0x140021e6d
mov eax, 5
jmp 0x140021e81
cmp rdi, 7
jb 0x140021e7a
mov eax, 3
jmp 0x140021e81
lea rax, [rdi - 1]
shr rax, 1
mov r14, rdi
lea r15, [rbx + 1]
sub r14, rax
shr r14, 1
lea r13, [r14 + rax]
cmp rdi, rbx
jbe 0x140021e9a
mov r15, rdi
mov r8, rdi
mov qword [rsp + 0x48], rbp
shl r8, 2
mov edx, 0x8b8b8b8b
mov rcx, rsi
call sub.VCRUNTIME140.dll_memset
xor ecx, ecx
test r15, r15
je 0x140021f4d
nop
xor edx, edx
lea rax, [rcx + r14]
div rdi
mov r11d, dword [rsi + rdx*4]
lea r10, [rsi + rdx*4]
xor edx, edx
mov rax, rcx
div rdi
lea rbp, [rsi + rdx*4]
mov r8d, r11d
mov r9, rdx
lea rax, [rcx - 1]
xor edx, edx
div rdi
xor r8d, dword [rsi + rdx*4]
xor r8d, dword [rbp]
mov eax, r8d
shr eax, 0x1b
xor eax, r8d
imul edx, eax, 0x19660d
test rcx, rcx
jne 0x140021f0d
mov rax, rbx
jmp 0x140021f25
cmp rcx, rbx
ja 0x140021f22
mov rax, qword [0x140376fe8]
mov eax, dword [rax + rcx*4 - 4]
add rax, r9
jmp 0x140021f25
mov rax, r9
lea r8d, [rax + rdx]
lea eax, [r11 + rdx]
xor edx, edx
mov dword [r10], eax
lea rax, [rcx + r13]
div rdi
inc rcx
add dword [rsi + rdx*4], r8d
mov dword [rbp], r8d
cmp rcx, r15
jb 0x140021ec0
add r15, rdi
cmp rcx, r15
jae 0x140021fca
inc r14
lea rbp, [rcx - 1]
inc r13
nop
xor edx, edx
lea rax, [r14 + rbp]
div rdi
mov r10d, dword [rsi + rdx*4]
lea r11, [rsi + rdx*4]
xor edx, edx
lea rbx, [rbp + 1]
mov rax, rbx
div rdi
mov rax, rbp
mov r9, rdx
xor edx, edx
div rdi
mov ecx, dword [rsi + rdx*4]
xor edx, edx
add ecx, dword [rsi + r9*4]
add ecx, r10d
mov eax, ecx
shr eax, 0x1b
xor eax, ecx
imul ecx, eax, 0x5d588b65
mov rax, rbp
add rax, r13
mov rbp, rbx
div rdi
xor r10d, ecx
lea rax, [rbx + 1]
mov dword [r11], r10d
mov r8d, ecx
sub r8d, r9d
xor dword [rsi + rdx*4], r8d
mov dword [rsi + r9*4], r8d
cmp rax, r15
jb 0x140021f60
mov rbp, qword [rsp + 0x48]
mov r13, qword [rsp + 0x50]
mov r14, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x40]
mov r15, qword [rsp + 0x20]
add rsp, 0x28
pop rdi
pop rsi
ret
Function at 0x1400265e0
Capabilities:
Validate payment card number using luhn algorithm

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov esi, edx
mov dword [rcx + 0x74], 0
mov rbx, rcx
mov edi, 0x7fffffff
movsx ecx, byte [rbx + 0x78]
lea eax, [rcx - 0x30]
cmp al, 9
ja 0x1400266a5
lea r8d, [rcx - 0x30]
cmp r8d, 0xffffffff
je 0x1400266a5
mov r9d, dword [rbx + 0x74]
mov ecx, 0x7fffffff
sub ecx, r8d
mov eax, 0x66666667
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
cmp r9d, edx
jg 0x1400266be
lea eax, [r9 + r9*4]
dec edi
lea ecx, [r8 + rax*2]
mov rax, qword [rbx + 0x10]
mov dword [rbx + 0x74], ecx
mov rcx, qword [rbx]
cmp rcx, rax
je 0x140026695
cmp byte [rcx], 0x5c
jne 0x14002668e
lea rdx, [rcx + 1]
cmp rdx, rax
je 0x14002668e
mov r8d, dword [rbx + 0x80]
test r8b, 8
jne 0x14002667c
movzx eax, byte [rdx]
sub al, 0x28
cmp al, 1
jbe 0x14002668b
test r8b, 0x10
jne 0x14002668e
movzx eax, byte [rdx]
sub al, 0x7b
test al, 0xfd
jne 0x14002668e
mov rcx, rdx
lea rax, [rcx + 1]
mov qword [rbx], rax
mov rcx, rbx
call fcn.140021560
test edi, edi
jne 0x140026600
mov rbx, qword [rsp + 0x30]
cmp edi, 0x7fffffff
mov rsi, qword [rsp + 0x38]
setne al
add rsp, 0x20
pop rdi
ret
mov edx, esi
call fcn.140021550
int3

Function at 0x140029714
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14002975e
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x14002975e
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x14002975e
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x14002975e
cmp dword [rcx + 0x84], 0xe
jbe 0x14002975e
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140029760
xor al, al
add rsp, 0x28
ret
Function at 0x180008e00
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rsi
push rdi
push rbp
push rbx
movd edx, xmm0
mov r11d, edx
and r11d, 0x7fffff
shr edx, 0x17
and edx, 0xff
je 0x180008e35
add edx, 0xffffff6a
test r11d, r11d
je 0x180008fd4
or r11d, 0x800000
jmp 0x180008e43
mov edx, 0xffffff6b
test r11d, r11d
je 0x18000906e
imul r9d, edx, 0x4d105
sar r9d, 0x14
mov eax, 1
sub eax, r9d
mov ecx, 0x20
sub ecx, r9d
lea r8, [0x18001d650]
mov r10, qword [r8 + rcx*8]
imul r8d, eax, 0x1a934f
sar r8d, 0x13
add r8d, edx
mov ecx, r8d
not cl
mov rbx, r10
shr rbx, cl
lea edi, [r11 + r11]
lea eax, [r11*2 + 1]
mov ecx, r8d
shl eax, cl
shl rax, 0x20
mul r10
mov rax, rdx
shr rax, 0x20
imul rsi, rax, 0x51eb851f
shr rsi, 0x25
imul ebp, esi, 0xffffff9c
add ebp, eax
cmp ebp, ebx
jae 0x180008ed2
test ebp, ebp
jne 0x180008f0b
test r11b, 1
je 0x180008f0b
mov eax, edx
test rax, rax
jne 0x180008f0b
dec esi
mov ebp, 0x64
jmp 0x180008f64
ja 0x180008f64
lea eax, [rdi - 1]
imul rax, r10
mov cl, 0x40
sub cl, r8b
movzx ecx, cl
xor edx, edx
bt rax, rcx
setb dl
lea ecx, [r8 + 0x20]
neg ecx
shr rax, cl
xor ecx, ecx
test eax, eax
sete cl
not r11d
and r11d, ecx
or r11d, edx
je 0x180008f64
inc r9d
imul eax, esi, 0xc28f5c29
rol eax, 0x1e
xor ecx, ecx
cmp eax, 0x28f5c28
ja 0x180008f45
xor ecx, ecx
nop word cs:[rax + rax]
mov esi, eax
add ecx, 2
imul eax, eax, 0xc28f5c29
rol eax, 0x1e
cmp eax, 0x28f5c29
jb 0x180008f30
imul eax, esi, 0xcccccccd
ror eax, 1
xor edx, edx
cmp eax, 0x1999999a
setb dl
cmovae eax, esi
or edx, ecx
add r9d, edx
jmp 0x1800090ce
lea eax, [rsi + rsi*4]
shr ebx, 1
sub ebp, ebx
imul edx, ebp, 0x199a
add edx, 0x8002
movzx ecx, dx
shr edx, 0x10
lea eax, [rdx + rax*2]
cmp ecx, 0x1999
ja 0x1800090ce
mov ecx, edi
imul r10, rcx
mov cl, 0x40
sub cl, r8b
movzx ecx, cl
bt r10, rcx
setb cl
test bpl, 1
sete r11b
xor r11b, cl
je 0x1800090c4
add r8d, 0x20
neg r8d
mov ecx, r8d
shr r10, cl
test r10d, r10d
sete cl
and edx, 1
and dl, cl
movzx ecx, dl
sub eax, ecx
jmp 0x1800090ce
imul r9d, edx, 0x9a209
add r9d, 0xfffc01e1
sar r9d, 0x15
imul r8d, r9d, 0xffe56cb1
sar r8d, 0x13
add r8d, edx
mov eax, 0x1f
sub eax, r9d
lea rcx, [0x18001d650]
mov rax, qword [rcx + rax*8]
mov rcx, rax
shr rcx, 0x19
mov r11, rax
sub r11, rcx
mov cl, 0x28
sub cl, r8b
shr r11, cl
mov rsi, rax
shr rsi, 0x18
add rsi, rax
shr rsi, cl
mov ecx, edx
and ecx, 0xfffffffe
xor r10d, r10d
cmp ecx, 2
setne r10b
add r10d, r11d
mov r11d, esi
mov ecx, 0xcccccccd
imul rcx, r11
shr rcx, 0x23
lea r11d, [rcx + rcx]
lea r11d, [r11 + r11*4]
cmp r11d, r10d
jae 0x180009075
mov cl, 0x27
sub cl, r8b
shr rax, cl
inc eax
shr eax, 1
cmp edx, 0xffffffdd
jne 0x1800090c8
and eax, 0xfffffffe
jmp 0x1800090ce
xor eax, eax
xor r9d, r9d
jmp 0x1800090ce
inc r9d
imul eax, ecx, 0xc28f5c29
rol eax, 0x1e
xor edx, edx
cmp eax, 0x28f5c28
ja 0x1800090a5
xor edx, edx
nop dword [rax]
mov ecx, eax
add edx, 2
imul eax, eax, 0xc28f5c29
rol eax, 0x1e
cmp eax, 0x28f5c29
jb 0x180009090
imul eax, ecx, 0xcccccccd
ror eax, 1
xor r8d, r8d
cmp eax, 0x1999999a
setb r8b
cmovae eax, ecx
or r8d, edx
add r9d, r8d
jmp 0x1800090ce
dec eax
jmp 0x1800090ce
cmp eax, r10d
adc eax, 0
shl r9, 0x20
mov eax, eax
or rax, r9
pop rbx
pop rbp
pop rdi
pop rsi
ret
Function at 0x18000a870
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x50
mov rdi, r8
mov rsi, rcx
mov eax, dword [r8]
xor ebx, ebx
sub rax, 1
cmovae rbx, rax
movzx eax, byte [r8 + 9]
and eax, 0xf
lea rcx, [0x18001e211]
movzx ecx, byte [rax + rcx]
mov r15, rbx
shr r15, cl
mov r12, r9
mov r14, rdx
movzx eax, byte [r8 + 0xf]
imul rax, rbx
mov rcx, qword [rdx + 8]
lea rdx, [rcx + rax]
inc rdx
cmp qword [r14 + 0x10], rdx
jae 0x18000a8d1
mov rcx, r14
call qword [r14 + 0x18]
add rdi, 0xb
test r15, r15
je 0x18000a8f2
lea rcx, [rsp + 0x30]
mov rdx, r14
mov r8, r15
mov r9, rdi
call fcn.18000aaa0
mov r14, qword [rsp + 0x30]
cmp byte [r12], 0
movzx ebp, byte [r12 + 1]
je 0x18000a9e2
mov byte [rsp + 0x2f], bpl
mov rcx, qword [r14 + 8]
lea rdx, [rcx + 1]
cmp qword [r14 + 0x10], rdx
jae 0x18000a925
mov rcx, r14
call qword [r14 + 0x18]
mov rcx, qword [r14 + 8]
lea rdx, [rcx + 1]
movsx eax, bpl
mov r8, qword [r14]
mov qword [r14 + 8], rdx
mov byte [r8 + rcx], 0x27
mov cl, 1
cmp bpl, 0x20
jb 0x18000a9a7
cmp eax, 0x22
je 0x18000a9a7
cmp eax, 0x5c
je 0x18000a9a7
cmp eax, 0x7f
je 0x18000a9a7
test bpl, bpl
js 0x18000a9a7
movzx edx, bpl
cmp edx, 0xad
je 0x18000a9a7
xor edx, edx
lea r8, [0x18001ce00]
mov r9d, eax
nop dword [rax]
movzx r10d, byte [rdx + r8]
test r10b, r10b
jns 0x18000a98e
and r10d, 0x7f
shl r10d, 8
movzx r11d, byte [rdx + r8 + 1]
inc rdx
or r10d, r11d
sub r9d, r10d
js 0x18000a9a2
xor cl, 1
inc rdx
cmp rdx, 0x135
jb 0x18000a970
test cl, cl
sete cl
cmp bpl, 0x22
setne dl
cmp bpl, 0x27
je 0x18000aa11
and dl, cl
jne 0x18000aa11
mov rax, qword [r14 + 8]
lea rdx, [rax + 1]
cmp qword [r14 + 0x10], rdx
jae 0x18000a9d5
mov rcx, r14
call qword [r14 + 0x18]
mov rax, qword [r14 + 8]
lea rdx, [rax + 1]
mov rcx, qword [r14]
mov qword [r14 + 8], rdx
mov byte [rcx + rax], bpl
jmp 0x18000aa40
mov rax, qword [r14 + 8]
lea rdx, [rax + 1]
cmp qword [r14 + 0x10], rdx
jae 0x18000a9ff
mov rcx, r14
call qword [r14 + 0x18]
mov rax, qword [r14 + 8]
lea rdx, [rax + 1]
mov rcx, qword [r14]
mov qword [r14 + 8], rdx
mov byte [rcx + rax], bpl
cmp rbx, r15
jne 0x18000aa6d
jmp 0x18000aa88
lea rcx, [rsp + 0x2f]
mov qword [rsp + 0x30], rcx
lea rcx, [rsp + 0x30]
mov qword [rsp + 0x38], rcx
mov dword [rsp + 0x40], eax
lea rcx, [rsp + 0x48]
lea r8, [rsp + 0x30]
mov rdx, r14
call fcn.18000acd0
mov r14, qword [rsp + 0x48]
mov rax, qword [r14 + 8]
lea rdx, [rax + 1]
cmp qword [r14 + 0x10], rdx
jae 0x18000aa5d
mov rcx, r14
call qword [r14 + 0x18]
mov rax, qword [r14 + 8]
lea rdx, [rax + 1]
mov rcx, qword [r14]
mov qword [r14 + 8], rdx
mov byte [rcx + rax], 0x27
cmp rbx, r15
je 0x18000aa88
sub rbx, r15
lea rcx, [rsp + 0x30]
mov rdx, r14
mov r8, rbx
mov r9, rdi
call fcn.18000aaa0
mov r14, qword [rsp + 0x30]
mov qword [rsi], r14
mov rax, rsi
add rsp, 0x50
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret