joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180053480
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push rbx
sub rsp, 0x420
mov rax, qword [0x180153c80]
xor rax, rsp
mov qword [rsp + 0x410], rax
mov ebx, dword [rcx + 0xc]
mov r9, rdx
mov r11, rcx
cmp ebx, dword [rcx + 0x10]
jne 0x1800534c1
mov rcx, qword [rcx + 0x28]
lea r8, [rbx + rbx*2]
lea rdx, [rcx + r8*8]
mov qword [r9], rdx
mov qword [r9 + 8], rdx
jmp 0x180053621
mov r10, qword [r8]
mov edx, 8
mov qword [rsp + 0x430], rsi
xor esi, esi
test r10, r10
mov qword [rsp + 0x440], rdi
lea rax, [r10 - 0x18]
cmove rax, rsi
test rax, rax
lea rcx, [rax + 0x18]
cmove rcx, rsi
lea rax, [0x1800f5ba0]
test rcx, rcx
cmovne rax, rcx
lea rcx, [0x1800f5500]
mov qword [rsp + 8], rax
lea rax, [rsp + 0x10]
lea rax, [rax + 0x80]
movups xmm0, xmmword [rcx]
movups xmm1, xmmword [rcx + 0x10]
lea rcx, [rcx + 0x80]
movups xmmword [rax - 0x80], xmm0
movups xmm0, xmmword [rcx - 0x60]
movups xmmword [rax - 0x70], xmm1
movups xmm1, xmmword [rcx - 0x50]
movups xmmword [rax - 0x60], xmm0
movups xmm0, xmmword [rcx - 0x40]
movups xmmword [rax - 0x50], xmm1
movups xmm1, xmmword [rcx - 0x30]
movups xmmword [rax - 0x40], xmm0
movups xmm0, xmmword [rcx - 0x20]
movups xmmword [rax - 0x30], xmm1
movups xmm1, xmmword [rcx - 0x10]
movups xmmword [rax - 0x20], xmm0
movups xmmword [rax - 0x10], xmm1
sub rdx, 1
jne 0x180053510
lea rdi, [rsp + 0x10]
mov edx, esi
lea r8, [rsp + 8]
cmp r8, rdi
je 0x18005359b
nop dword [rax]
nop dword [rax + rax]
movzx ecx, byte [r8]
mov eax, edx
xor rcx, rax
shr edx, 8
movzx eax, cl
inc r8
xor edx, dword [rsp + rax*4 + 0x10]
cmp r8, rdi
jne 0x180053580
mov rdi, qword [rsp + 0x440]
lea ecx, [rbx - 1]
mov eax, edx
and rcx, rax
mov rax, qword [r11 + 0x28]
lea rcx, [rcx + rcx*2]
cmp qword [rax + rcx*8 + 0x10], rsi
lea rax, [rax + rcx*8]
je 0x180053602
nop
mov rdx, qword [rax]
cmp rdx, r10
je 0x18005363d
test rdx, rdx
lea rcx, [rdx - 0x18]
cmove rcx, rsi
test rcx, rcx
je 0x1800535e1
test dword [rcx + 0x10], 0xffffff
jne 0x1800535f8
test r10, r10
je 0x18005363d
lea rcx, [r10 - 0x18]
test rcx, rcx
je 0x18005363d
test dword [rcx + 0x10], 0xffffff
je 0x18005363d
mov rax, qword [rax + 0x10]
cmp rax, qword [r11 + 0x18]
jne 0x1800535c0
mov eax, dword [r11 + 0xc]
lea rcx, [rax + rax*2]
mov rax, qword [r11 + 0x28]
lea rdx, [rax + rcx*8]
mov qword [r9], rdx
mov qword [r9 + 8], rdx
mov rsi, qword [rsp + 0x430]
mov rax, r9
mov rcx, qword [rsp + 0x410]
xor rcx, rsp
call fcn.1800b5f90
add rsp, 0x420
pop rbx
ret
mov ecx, dword [r11 + 0xc]
lea rdx, [rcx + rcx*2]
mov rcx, qword [r11 + 0x28]
mov qword [r9], rax
lea r8, [rcx + rdx*8]
mov qword [r9 + 8], r8
test r8, r8
je 0x180053619
cmp rax, r8
je 0x180053619
cmp qword [rax + 0x10], rsi
jne 0x180053619
add rax, 0x18
mov qword [r9], rax
cmp rax, r8
je 0x180053619
cmp qword [rax + 0x10], rsi
je 0x180053664
jmp 0x180053619
Function at 0x180053970
Capabilities:
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x30
mov r13, r8
mov r14, rdx
mov rsi, rcx
movzx r12d, byte [r8]
movabs rax, 0xcbf29ce484222325
xor r12, rax
movabs rcx, 0x100000001b3
imul r12, rcx
movzx eax, byte [r8 + 1]
xor r12, rax
imul r12, rcx
movzx eax, byte [r8 + 2]
xor r12, rax
imul r12, rcx
movzx eax, byte [r8 + 3]
xor r12, rax
imul r12, rcx
mov rcx, r12
and rcx, qword [rsi + 0x30]
add rcx, rcx
mov rax, qword [rsi + 0x18]
mov rbx, qword [rax + rcx*8 + 8]
lea rdx, [rsi + 8]
mov r15, qword [rdx]
cmp rbx, r15
jne 0x1800539ff
mov rbx, r15
mov rbp, r15
jmp 0x180053a4c
mov rcx, qword [rax + rcx*8]
mov eax, dword [r8]
cmp eax, dword [rbx + 0x10]
je 0x180053a1e
nop dword [rax + rax]
cmp rbx, rcx
je 0x180053a46
mov rbx, qword [rbx + 8]
cmp eax, dword [rbx + 0x10]
jne 0x180053a10
mov qword [r14], rbx
mov byte [r14 + 8], 0
mov rax, r14
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
mov r15, rbx
mov rbp, rbx
movabs rax, 0xaaaaaaaaaaaaaaa
cmp qword [rsi + 0x10], rax
je 0x180053ba9
mov qword [rsp + 0x20], rdx
mov qword [rsp + 0x28], 0
mov ecx, 0x18
call fcn.1800b59a4
mov rdi, rax
mov qword [rsp + 0x28], rax
mov ecx, dword [r13]
mov dword [rax + 0x10], ecx
mov rcx, qword [rsi + 0x10]
add rcx, 1
xorps xmm0, xmm0
js 0x180053a9b
cvtsi2ss xmm0, rcx
jmp 0x180053ab0
mov rax, rcx
shr rax, 1
and ecx, 1
or rax, rcx
cvtsi2ss xmm0, rax
addss xmm0, xmm0
mov rcx, qword [rsi + 0x38]
xorps xmm1, xmm1
test rcx, rcx
js 0x180053ac3
cvtsi2ss xmm1, rcx
jmp 0x180053ad8
mov rax, rcx
shr rax, 1
and ecx, 1
or rax, rcx
cvtsi2ss xmm1, rax
addss xmm1, xmm1
divss xmm0, xmm1
comiss xmm0, dword [rsi]
jbe 0x180053b41
mov rcx, rsi
call fcn.180062670
mov rcx, qword [rsi + 0x30]
and rcx, r12
add rcx, rcx
mov rdx, qword [rsi + 0x18]
mov rax, qword [rdx + rcx*8 + 8]
mov rbx, qword [rsi + 8]
cmp rax, rbx
jne 0x180053b10
mov qword [rsp + 0x28], 0
jmp 0x180053b34
mov rdx, qword [rdx + rcx*8]
mov ecx, dword [rdi + 0x10]
cmp ecx, dword [rax + 0x10]
je 0x180053b31
nop dword [rax]
mov rbx, rax
cmp rax, rdx
je 0x180053b75
mov rax, qword [rax + 8]
cmp ecx, dword [rax + 0x10]
jne 0x180053b20
mov rbx, qword [rax]
mov qword [rsp + 0x20], rbx
mov rbp, rbx
mov r15, qword [rsp + 0x20]
mov rdx, qword [rbx + 8]
inc qword [rsi + 0x10]
mov qword [rdi], r15
mov qword [rdi + 8], rdx
mov qword [rdx], rdi
mov qword [rbx + 8], rdi
mov rcx, qword [rsi + 0x18]
mov rax, qword [rsi + 0x30]
and rax, r12
add rax, rax
mov r8, qword [rcx + rax*8]
cmp r8, qword [rsi + 8]
jne 0x180053b85
mov qword [rcx + rax*8], rdi
jmp 0x180053b97
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x28], 0
jmp 0x180053b39
cmp r8, rbp
jne 0x180053b90
mov qword [rcx + rax*8], rdi
jmp 0x180053b9c
cmp qword [rcx + rax*8 + 8], rdx
jne 0x180053b9c
mov qword [rcx + rax*8 + 8], rdi
mov qword [r14], rdi
mov byte [r14 + 8], 1
jmp 0x180053a26
lea rcx, str.unordered_map_set_too_long
call fcn.1800b23a0
int3
Function at 0x180061a10
Capabilities:
Hash data using fnv

Disassembly:
mov qword [rsp + 0x20], rbx
push rsi
sub rsp, 0x20
movabs rax, 0xfffffffffffffff
mov rsi, rcx
bsr rcx, rax
mov ebx, 1
mov eax, ebx
shl rax, cl
cmp rdx, rax
ja 0x180061bc1
lea rax, [rdx - 1]
mov qword [rsp + 0x38], rdi
mov rdi, qword [rsi + 8]
or rax, rbx
bsr rcx, rax
mov r8, rdi
mov qword [rsp + 0x40], r14
inc ecx
shl rbx, cl
lea rcx, [rsi + 0x18]
lea rdx, [rbx + rbx]
call fcn.180025660
mov qword [rsi + 0x38], rbx
lea rax, [rbx - 1]
mov qword [rsi + 0x30], rax
mov rcx, qword [rsi + 8]
mov rcx, qword [rcx]
cmp rcx, rdi
je 0x180061b86
mov qword [rsp + 0x30], rbp
mov rax, rcx
movabs rbp, 0xcbf29ce484222325
movabs rbx, 0x100000001b3
nop dword [rax]
nop dword [rax + rax]
movzx edx, byte [rax + 0x11]
movzx r9d, byte [rax + 0x10]
mov r11, qword [rsi + 0x30]
xor r9, rbp
mov rcx, qword [rcx]
imul r9, rbx
xor r9, rdx
movzx edx, byte [rax + 0x12]
imul r9, rbx
xor r9, rdx
movzx edx, byte [rax + 0x13]
imul r9, rbx
xor r9, rdx
imul r9, rbx
and r11, r9
shl r11, 4
add r11, qword [rsi + 0x18]
mov r9, qword [r11]
cmp r9, rdi
jne 0x180061b00
mov qword [r11], rax
mov qword [r11 + 8], rax
jmp 0x180061b75
mov rdx, qword [r11 + 8]
mov r8d, dword [rax + 0x10]
cmp r8d, dword [rdx + 0x10]
jne 0x180061b3d
mov r10, qword [rdx]
cmp r10, rax
je 0x180061b37
mov r9, qword [rax + 8]
mov qword [r9], rcx
mov r8, qword [rcx + 8]
mov qword [r8], r10
mov rdx, qword [r10 + 8]
mov qword [rdx], rax
mov qword [r10 + 8], r8
mov qword [rcx + 8], r9
mov qword [rax + 8], rdx
mov qword [r11 + 8], rax
jmp 0x180061b75
cmp r9, rdx
je 0x180061b51
mov rdx, qword [rdx + 8]
cmp r8d, dword [rdx + 0x10]
je 0x180061b9b
cmp r9, rdx
jne 0x180061b42
mov r10, qword [rax + 8]
mov qword [r10], rcx
mov r9, qword [rcx + 8]
mov qword [r9], rdx
mov r8, qword [rdx + 8]
mov qword [r8], rax
mov qword [rdx + 8], r9
mov qword [rcx + 8], r10
mov qword [rax + 8], r8
mov qword [r11], rax
mov rax, rcx
cmp rcx, rdi
jne 0x180061ab0
mov rbp, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x38]
mov r14, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x48]
add rsp, 0x20
pop rsi
ret
mov r10, qword [rdx]
mov r9, qword [rax + 8]
mov qword [r9], rcx
mov r8, qword [rcx + 8]
mov qword [r8], r10
mov rdx, qword [r10 + 8]
mov qword [rdx], rax
mov qword [r10 + 8], r8
mov qword [rcx + 8], r9
mov qword [rax + 8], rdx
jmp 0x180061b75
lea rcx, str.invalid_hash_bucket_count
call fcn.1800b23a0
int3
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdx, qword [rcx + 0x10]
mov rdi, rcx
add rdx, 1
mov rbx, qword [rcx + 0x38]
xorps xmm0, xmm0
js 0x180062695
cvtsi2ss xmm0, rdx
jmp 0x1800626aa
mov rax, rdx
and edx, 1
shr rax, 1
or rax, rdx
cvtsi2ss xmm0, rax
addss xmm0, xmm0
divss xmm0, dword [rcx]
call fcn.1800bf274
movss xmm1, dword [0x1800f6324]
xor ecx, ecx
comiss xmm0, xmm1
jb 0x1800626d8
subss xmm0, xmm1
comiss xmm0, xmm1
jae 0x1800626d8
movabs rax, 0x8000000000000000
mov rcx, rax
cvttss2si rax, xmm0
add rax, rcx
mov ecx, 8
cmp rax, rcx
cmova rcx, rax
cmp rbx, rcx
jae 0x18006270a
cmp rbx, 0x200
jae 0x180062707
lea rbx, [rbx*8]
cmp rbx, rcx
jae 0x18006270a
mov rbx, rcx
mov rdx, rbx
mov rcx, rdi
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp 0x180061a10
Function at 0x180064c60
Capabilities:
Hash data using fnv

Disassembly:
push rbp
push rsi
push r14
sub rsp, 0x40
mov rbp, r8
mov r14, rdx
mov rsi, rcx
cmp rdx, r8
je 0x180064d5e
mov rdx, qword [rcx + 0x18]
movabs r8, 0x100000001b3
mov qword [rsp + 0x60], rbx
movabs rax, 0xcbf29ce484222325
mov qword [rsp + 0x38], rdi
mov rbx, r14
mov qword [rsp + 0x30], r12
mov r12, qword [rcx + 8]
movzx ecx, byte [r14 + 0x10]
xor rcx, rax
mov qword [rsp + 0x28], r13
movzx eax, byte [r14 + 0x11]
mov r13, qword [r14 + 8]
imul rcx, r8
mov qword [rsp + 0x20], r15
mov r15, qword [rsi + 0x30]
xor rcx, rax
movzx eax, byte [r14 + 0x12]
imul rcx, r8
mov qword [rsp + 0x78], rdx
xor rcx, rax
movzx eax, byte [r14 + 0x13]
imul rcx, r8
xor rcx, rax
imul rcx, r8
and r15, rcx
shl r15, 4
add r15, rdx
mov rax, qword [r15]
mov qword [rsp + 0x68], rax
mov rax, qword [r15 + 8]
mov qword [rsp + 0x70], rax
nop dword [rax + rax]
mov rcx, rbx
mov rdi, rbx
mov rbx, qword [rbx]
mov edx, 0x18
call fcn.1800b59e0
dec qword [rsi + 0x10]
cmp rdi, qword [rsp + 0x70]
je 0x180064d6a
cmp rbx, rbp
jne 0x180064d10
cmp qword [rsp + 0x68], r14
jne 0x180064d3d
mov qword [r15], rbx
mov r12, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x38]
mov r15, qword [rsp + 0x20]
mov qword [r13], rbx
mov qword [rbx + 8], r13
mov r13, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x60]
mov rax, rbp
add rsp, 0x40
pop r14
pop rsi
pop rbp
ret
cmp qword [rsp + 0x68], r14
jne 0x180064d79
mov qword [r15], r12
mov rax, r12
jmp 0x180064d7c
mov rax, r13
mov qword [r15 + 8], rax
cmp rbx, rbp
je 0x180064d3d
nop word [rax + rax]
movzx r15d, byte [rbx + 0x10]
movabs rdx, 0x100000001b3
movabs rax, 0xcbf29ce484222325
xor r15, rax
movzx eax, byte [rbx + 0x11]
imul r15, rdx
xor r15, rax
movzx eax, byte [rbx + 0x12]
imul r15, rdx
xor r15, rax
movzx eax, byte [rbx + 0x13]
imul r15, rdx
xor r15, rax
imul r15, rdx
and r15, qword [rsi + 0x30]
shl r15, 4
add r15, qword [rsp + 0x78]
mov r14, qword [r15 + 8]
mov rcx, rbx
mov rdi, rbx
mov rbx, qword [rbx]
mov edx, 0x18
call fcn.1800b59e0
dec qword [rsi + 0x10]
cmp rdi, r14
je 0x180064e08
cmp rbx, rbp
jne 0x180064de2
jmp 0x180064d3a
mov qword [r15], r12
mov qword [r15 + 8], r12
cmp rbx, rbp
jne 0x180064d90
jmp 0x180064d3d
Function at 0x18006dde0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rdx, r8
je 0x18006deef
push rbx
sub rsp, 0x20
mov qword [rsp + 0x30], rdi
mov r11, r8
lea rdi, [0x180000000]
mov r10, rdx
mov rbx, rcx
movzx edx, byte [r10 + 9]
movzx eax, dl
and al, 7
cmp al, 3
jne case.0x18006de4a.8
xor dl, 7
mov byte [r10 + 9], dl
test dl, 0x20
je case.0x18006de4a.8
movzx eax, byte [r10 + 8]
add eax, 0xfffffffc
cmp eax, 0x22
ja case.0x18006de4a.8
cdqe
movzx eax, byte [rdi + rax + 0x6df04]
mov ecx, dword [rdi + rax*4 + 0x6def0]
add rcx, rdi
jmp rcx
and dl, 0xe7
or dl, 0x20
mov byte [r10 + 9], dl
jmp case.0x18006de4a.8
mov rcx, qword [r10 + 0x10]
lea rax, [r10 + 0x18]
cmp rcx, rax
je 0x18006de6d
and dl, 0xc7
jmp 0x18006de73
and dl, 0xe7
or dl, 0x20
mov byte [r10 + 9], dl
test byte [rcx + 8], 0x40
je case.0x18006de4a.8
mov rdx, qword [rcx]
test byte [rdx + 9], 0x18
je case.0x18006de4a.8
mov rcx, rbx
call fcn.18006e530
jmp case.0x18006de4a.8
cmp word [r10 + 0xa], 0
jne case.0x18006de4a.5
mov rdx, qword [r10 + 0x18]
test rdx, rdx
je 0x18006deaf
test byte [rdx + 9], 0x18
je 0x18006deaf
mov rcx, rbx
call fcn.18006e530
and byte [r10 + 9], 0xe7
or byte [r10 + 9], 0x20
jmp case.0x18006de4a.8
mov rcx, r10
call fcn.18006d390
mov rcx, qword [rbx + 0x88]
mov qword [rax], rcx
mov qword [rbx + 0x88], r10
and byte [r10 + 9], 0xc7
mov r10, qword [r10]
cmp r10, r11
jne 0x18006de03
mov rdi, qword [rsp + 0x30]
add rsp, 0x20
pop rbx
ret

Function at 0x18006f9c0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rbx, rcx
mov eax, 1
movzx ecx, byte [rdx + 0xb]
mov rdi, rdx
shl eax, cl
mov rcx, rdx
cdqe
lea r8, [rax + rax*2]
mov rax, qword [rdx + 0x18]
lea rsi, [rax + r8*8]
call fcn.180072f50
test eax, eax
je 0x18006fa28
xor r10d, r10d
mov r11d, eax
mov rax, qword [rdi + 0x10]
test byte [r10 + rax + 8], 0x40
je 0x18006fa1e
mov rdx, qword [r10 + rax]
test byte [rdx + 9], 0x18
je 0x18006fa1e
mov rcx, rbx
call fcn.18006e530
add r10, 0x10
sub r11, 1
jne 0x18006fa00
mov r10, qword [rdi + 0x18]
cmp r10, rsi
jae 0x18006fa7f
test byte [r10 + 8], 0xf
movzx eax, byte [r10 + 9]
jne 0x18006fa48
test al, 0x40
je 0x18006fa76
mov byte [r10 + 9], 0xb
jmp 0x18006fa76
test al, 0x40
je 0x18006fa5e
mov rdx, qword [r10 + 0x10]
test byte [rdx + 9], 0x18
je 0x18006fa5e
mov rcx, rbx
call fcn.18006e530
test byte [r10 + 8], 0x40
je 0x18006fa76
mov rdx, qword [r10]
test byte [rdx + 9], 0x18
je 0x18006fa76
mov rcx, rbx
call fcn.18006e530
add r10, 0x18
cmp r10, rsi
jb 0x18006fa31
movzx eax, byte [rdi + 9]
movzx ecx, al
and cl, 7
cmp cl, 5
jne 0x18006fabb
mov rcx, rdi
call fcn.18006d390
mov rcx, qword [rbx + 0x90]
mov qword [rax], rcx
mov qword [rbx + 0x90], rdi
and byte [rdi + 9], 0xc7
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
cmp cl, 6
jne 0x18006fac5
xor al, 2
mov byte [rdi + 9], al
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x180071cc0
Capabilities:
Encode data using xor

Disassembly:
mov eax, edx
mov r10, rcx
xor eax, r8d
test rdx, rdx
je 0x180071cf1
nop dword [rax]
movzx r9d, byte [r10 + rdx - 1]
mov r8d, eax
shl r8d, 5
mov ecx, eax
add r9d, r8d
shr ecx, 2
add r9d, ecx
xor eax, r9d
sub rdx, 1
jne 0x180071cd0
ret

Function at 0x180071f60
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbp
push rsi
sub rsp, 0x20
mov rsi, r8
mov rbp, rdx
cmp r8, 0x28
ja 0x180071f85
mov rbp, qword [rsp + 0x40]
add rsp, 0x20
pop rsi
jmp fcn.1800719e0
movabs rax, 0x7fffffffffffffdf
cmp rsi, rax
jae 0x180071ff1
mov rax, qword [rcx + 0x18]
add r8, 0x19
mov qword [rsp + 0x30], rbx
mov edx, 0x14
mov qword [rsp + 0x38], rdi
mov ebx, dword [rax + 0x60]
call fcn.18006d7c0
mov r8, rsi
mov rdx, rbp
mov rdi, rax
mov dword [rax + 0xc], ebx
lea rcx, [rax + 0x18]
mov byte [rax + 0xa], 0
mov byte [rax + rsi + 0x18], 0
mov qword [rax + 0x10], rsi
mov byte [rax + 0xb], 0xff
call fcn.1800e5580
mov rbx, qword [rsp + 0x30]
mov rax, rdi
mov rdi, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x40]
add rsp, 0x20
pop rsi
ret
call fcn.180068e70
int3
Function at 0x1800745c0
Capabilities:
Check http status code

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r14
sub rsp, 0x110
mov rax, qword [0x180153c80]
xor rax, rsp
mov qword [rsp + 0x100], rax
mov r14, rdx
mov rbx, rcx
lea rdx, [rsp + 0x20]
call fcn.180073ae0
test rax, rax
je 0x180074615
mov r8, qword [rsp + 0x20]
mov cl, 3
sub rax, rbx
mov qword [r14], r8
mov byte [r14 + 8], cl
inc rax
jmp 0x180074797
lea rdx, [0x1800ffeb0]
mov rcx, rbx
call fcn.1800c50c0
test rax, rax
je 0x18007464c
movzx edi, byte [rax]
or edi, 0x20
cmp edi, 0x6e
je 0x180074795
cmp edi, 0x78
jne 0x18007464e
lea rdx, [rsp + 0x20]
mov rcx, rbx
call fcn.1800748f0
jmp 0x18007465b
xor edi, edi
lea rdx, [rsp + 0x20]
mov rcx, rbx
call fcn.1800c500c
mov rcx, qword [rsp + 0x20]
lea rbp, [0x180100510]
cmp rcx, rbx
jne 0x180074670
xor eax, eax
jmp 0x18007469d
movzx edx, byte [rcx]
test byte [rdx + rbp + 1], 8
je 0x180074695
nop word [rax + rax]
inc rcx
mov qword [rsp + 0x20], rcx
movzx eax, byte [rcx]
test byte [rax + rbp + 1], 8
jne 0x180074680
movzx edx, al
xor eax, eax
test dl, dl
cmove rax, rcx
test rax, rax
jne 0x180074782
mov edx, 0x2e
mov rcx, rbx
call fcn.1800b7058
mov rsi, rax
test rax, rax
je 0x180074795
mov rcx, 0xffffffffffffffff
inc rcx
cmp byte [rbx + rcx], 0
jne 0x1800746c6
cmp rcx, 0xc8
ja 0x180074795
lea rdx, [rsp + 0x30]
mov rcx, rbx
sub rdx, rbx
nop word [rax + rax]
movzx eax, byte [rcx]
mov byte [rdx + rcx], al
lea rcx, [rcx + 1]
test al, al
jne 0x1800746f0
call fcn.1800bf240
sub rsi, rbx
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x30]
mov rax, qword [rax]
movzx eax, byte [rax]
mov byte [rsp + rsi + 0x30], al
cmp edi, 0x78
jne 0x180074726
call fcn.1800748f0
jmp 0x18007472b
call fcn.1800c500c
mov rcx, qword [rsp + 0x20]
lea rax, [rsp + 0x30]
cmp rcx, rax
jne 0x18007473e
xor eax, eax
jmp 0x18007477d
movzx edx, byte [rcx]
test byte [rdx + rbp + 1], 8
je 0x180074765
nop dword [rax + rax]
inc rcx
mov qword [rsp + 0x20], rcx
movzx eax, byte [rcx]
test byte [rax + rbp + 1], 8
jne 0x180074750
movzx edx, al
xor eax, eax
test dl, dl
cmove rax, rcx
test rax, rax
je 0x180074795
lea rcx, [rsp + 0x30]
sub rax, rcx
add rax, rbx
test rax, rax
je 0x180074795
mov cl, 0x13
movsd qword [r14], xmm0
sub rax, rbx
mov byte [r14 + 8], cl
inc rax
jmp 0x180074797
xor eax, eax
mov rcx, qword [rsp + 0x100]
xor rcx, rsp
call fcn.1800b5f90
lea r11, [rsp + 0x110]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret
Function at 0x1800748f0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 0x20], rbp
mov qword [rsp + 0x10], rdx
push rsi
push rdi
push r13
push r14
push r15
sub rsp, 0x20
mov qword [rsp + 0x50], rbx
mov r13, rdx
mov rbx, rcx
call fcn.1800bf240
xor esi, esi
lea r11, [0x180100510]
xorps xmm1, xmm1
mov r10d, esi
mov r14d, esi
mov r9d, esi
mov r8, qword [rax]
mov edi, esi
movsx r15d, byte [r8]
mov qword [r13], rbx
movzx eax, byte [rbx]
test byte [rax + r11 + 1], 8
je 0x18007495f
nop dword [rax]
nop word [rax + rax]
movzx eax, byte [rbx + 1]
inc rbx
test byte [rax + r11 + 1], 8
jne 0x180074950
mov qword [rsp + 0x60], r12
lea rdx, [rbx + 1]
mov ebp, 1
cmp al, 0x2d
jne 0x180074976
mov r12d, ebp
jmp 0x180074980
cmp byte [rbx], 0x2b
mov r12d, esi
cmovne rdx, rbx
cmp byte [rdx], 0x30
mov rbx, qword [rsp + 0x50]
jne 0x180074ac8
movzx eax, byte [rdx + 1]
sub al, 0x58
test al, 0xdf
jne 0x180074ac8
movsd xmm2, qword [0x1800fff28]
lea r13, [0x180100510]
add rdx, 2
nop
movzx r8d, byte [rdx]
mov r11, rdx
movsx rcx, r8b
cmp ecx, r15d
jne 0x1800749cb
test edi, edi
jne 0x180074a20
mov edi, ebp
inc rdx
jmp 0x1800749b0
test byte [r8 + r13 + 1], 0x10
je 0x180074a20
test r10d, r10d
jne 0x1800749e3
cmp r8b, 0x30
jne 0x1800749e3
inc r14d
jmp 0x180074a14
inc r10d
cmp r10d, 0x1e
jg 0x180074a11
test byte [rcx + r13 + 1], 2
je 0x1800749f9
add ecx, 0xffffffd0
jmp 0x1800749ff
or ecx, 0x20
sub ecx, 0x57
movd xmm0, ecx
cvtdq2pd xmm0, xmm0
mulsd xmm1, xmm2
addsd xmm1, xmm0
jmp 0x180074a14
inc r9d
test edi, edi
je 0x180074a1b
dec r9d
inc rdx
jmp 0x1800749b0
mov r13, qword [rsp + 0x58]
lea eax, [r14 + r10]
test eax, eax
je 0x180074ac8
mov qword [r13], rdx
lea r9d, [r9*4]
movzx eax, byte [rdx]
sub al, 0x50
test al, 0xdf
jne 0x180074aaf
movzx eax, byte [rdx + 1]
inc rdx
cmp al, 0x2d
jne 0x180074a57
lea rdx, [r11 + 2]
jmp 0x180074a61
cmp al, 0x2b
jne 0x180074a5f
lea rdx, [r11 + 2]
mov ebp, esi
movzx r8d, byte [rdx]
lea r11, [0x180100510]
test byte [r8 + r11 + 1], 2
je 0x180074ac8
nop dword [rax]
nop dword [rax + rax]
movsx eax, r8b
lea esi, [rsi + rsi*4]
inc rdx
lea esi, [rsi - 0x18]
lea esi, [rax + rsi*2]
movzx eax, byte [rdx]
movzx r8d, al
test byte [rax + r11 + 1], 2
jne 0x180074a80
mov eax, esi
mov qword [r13], rdx
neg eax
test ebp, ebp
cmove eax, esi
add r9d, eax
test r12d, r12d
je 0x180074abb
xorps xmm1, xmmword [0x1800fff30]
mov edx, r9d
movaps xmm0, xmm1
call fcn.1800c1608
jmp 0x180074acb
xorps xmm0, xmm0
mov r12, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x68]
add rsp, 0x20
pop r15
pop r14
pop r13
pop rdi
pop rsi
ret

Function at 0x180081b20
Capabilities:
Terminate process

Disassembly:
sub rsp, 0x28
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
test eax, eax
setne al
add rsp, 0x28
ret
Function at 0x18008c280
Capabilities:
Read file via mapping

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], r8
push rdi
sub rsp, 0x30
mov rbx, rcx
mov rdi, r8
mov rcx, qword [rcx + 8]
mov rsi, rdx
test rcx, rcx
je 0x18008c2b3
call fcn.180081b40
mov qword [rbx + 8], 0
mov rcx, qword [rbx]
test rcx, rcx
je 0x18008c2c7
call fcn.1800819d0
mov qword [rbx], 0
mov rsi, qword [rsi]
xor edx, edx
mov r8, rsi
mov ecx, 6
call fcn.180081af0
mov qword [rbx], rax
test rax, rax
jne 0x18008c31b
mov r9d, dword [rsp + 0x54]
xor edx, edx
mov qword [rsp + 0x28], rsi
mov rcx, 0xffffffffffffffff
mov r8d, 4
mov dword [rsp + 0x20], edi
call sub.KERNEL32.dll_CreateFileMappingW
mov qword [rbx], rax
test rax, rax
jne 0x18008c31b
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
xor r9d, r9d
mov qword [rsp + 0x20], rdi
xor r8d, r8d
mov edx, 6
mov rcx, rax
call sub.KERNEL32.dll_MapViewOfFile
mov rsi, qword [rsp + 0x48]
test rax, rax
mov qword [rbx + 8], rax
mov rbx, qword [rsp + 0x40]
setne al
add rsp, 0x30
pop rdi
ret

Function at 0x18008f2b0
Capabilities:
Read file via mapping

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x30
mov rbx, rcx
xor ebp, ebp
mov rcx, qword [rcx + 8]
mov rsi, r8
mov rdi, rdx
test rcx, rcx
je 0x18008f2e1
call fcn.180081b40
mov qword [rbx + 8], rbp
mov rcx, qword [rbx]
test rcx, rcx
je 0x18008f2f1
call fcn.1800819d0
mov qword [rbx], rbp
mov r8, qword [rdi]
xor edx, edx
mov ecx, 6
call fcn.180081af0
mov qword [rbx], rax
test rax, rax
jne 0x18008f31c
mov rcx, qword [rbx + 8]
test rcx, rcx
je 0x18008f33d
call fcn.180081b40
mov qword [rbx + 8], rbp
jmp 0x18008f33d
xor r9d, r9d
mov qword [rsp + 0x20], rsi
xor r8d, r8d
mov edx, 6
mov rcx, rax
call sub.KERNEL32.dll_MapViewOfFile
mov qword [rbx + 8], rax
test rax, rax
jne 0x18008f351
mov rcx, qword [rbx]
test rcx, rcx
je 0x18008f34d
call fcn.1800819d0
mov qword [rbx], rbp
xor al, al
jmp 0x18008f353
mov al, 1
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret