joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180005e48
Capabilities:
Clear file content

Disassembly:
jmp 0x1802702d8
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x20
mov rbx, rdx
mov rsi, r8
xor edx, edx
mov r14d, ecx
lea r8d, [rdx + 1]
call fcn.1800022d9
xor edx, edx
mov ecx, r14d
mov r12, rax
lea r8d, [rdx + 2]
call fcn.1800022d9
mov rbp, rbx
sub rbp, rax
cmp r12, 0xffffffffffffffff
je 0x180270428
cmp rax, 0xffffffffffffffff
je 0x180270428
xor edi, edi
test rbp, rbp
jle 0x1802703d3
lea edx, [rdi + 1]
mov ecx, 0x1000
call fcn.180007851
mov rbx, rax
test rax, rax
jne 0x180270360
lea edi, [rax + 0xc]
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], edi
jmp 0x1802703c9
mov edx, 0x8000
mov ecx, r14d
call fcn.1800062c1
mov r15d, eax
mov eax, 0x1000
mov r8d, ebp
cmp rbp, rax
mov r9, rsi
mov rdx, rbx
mov ecx, r14d
cmovge r8d, eax
call fcn.1800071a3
cmp eax, 0xffffffff
je 0x1802703a9
cdqe
sub rbp, rax
test rbp, rbp
jg 0x180270370
mov edx, r15d
mov ecx, r14d
call fcn.1800062c1
jmp 0x1802703c9
cmp byte [rsi + 0x38], dil
je 0x1802703c0
cmp dword [rsi + 0x34], 5
jne 0x1802703c0
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], 0xd
cmp byte [rsi + 0x30], dil
je 0x1802703c9
mov edi, dword [rsi + 0x2c]
mov rcx, rbx
call fcn.18000135c
jmp 0x18027043c
jns 0x18027043c
xor r8d, r8d
mov rdx, rbx
mov ecx, r14d
call fcn.1800022d9
cmp rax, 0xffffffffffffffff
jne 0x1802703f4
cmp byte [rsi + 0x30], dil
je 0x18027043c
mov edi, dword [rsi + 0x2c]
jmp 0x18027043c
mov ecx, r14d
call fcn.180008896
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
jne 0x18027043c
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov byte [rsi + 0x38], 1
mov edi, 0xd
mov dword [rsi + 0x34], eax
mov byte [rsi + 0x30], 1
mov dword [rsi + 0x2c], 0xd
jmp 0x18027043c
xor edi, edi
cmp byte [rsi + 0x30], dil
je 0x180270435
mov eax, dword [rsi + 0x2c]
jmp 0x18027043a
mov eax, 0x16
mov edi, eax
xor r8d, r8d
mov rdx, r12
mov ecx, r14d
call fcn.1800022d9
mov rbx, qword [rsp + 0x40]
mov eax, edi
mov rdi, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop r12
ret
Function at 0x180005e98
Capabilities:
Encrypt data using rc4 prga

Disassembly:
jmp 0x18005d0d0
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rsi
push rdi
sub rsp, 0xd8
cmp qword [0x180640fd0], 0
jne 0x18005d200
lea rax, [rsp + 0x80]
lea rcx, [0x1802894c0]
mov rdi, rax
mov rsi, rcx
mov ecx, 0x44
rep movsb byte [rdi], byte [rsi]
mov eax, 2
imul rax, rax, 0x21
movzx eax, word [rsp + rax + 0x80]
test eax, eax
je 0x18005d131
mov dword [rsp + 0x2c], 1
jmp 0x18005d139
mov dword [rsp + 0x2c], 0
movzx eax, byte [rsp + 0x2c]
mov byte [rsp + 0x20], al
movzx eax, byte [rsp + 0x20]
movzx eax, al
test eax, eax
je 0x18005d1a2
mov dword [rsp + 0x24], 0
jmp 0x18005d162
mov eax, dword [rsp + 0x24]
inc eax
mov dword [rsp + 0x24], eax
cmp dword [rsp + 0x24], 0x22
jge 0x18005d1a2
movsxd rax, dword [rsp + 0x24]
movzx eax, word [rsp + rax*2 + 0x80]
mov dword [rsp + 0x30], eax
mov eax, dword [rsp + 0x24]
cdq
mov ecx, 3
idiv ecx
mov eax, edx
add eax, 0xa
mov ecx, dword [rsp + 0x30]
xor ecx, eax
mov eax, ecx
movsxd rcx, dword [rsp + 0x24]
mov word [rsp + rcx*2 + 0x80], ax
jmp 0x18005d158
lea rax, [rsp + 0x80]
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
xor r9d, r9d
mov r8, rax
xor edx, edx
xor ecx, ecx
call fcn.180002662
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x48]
mov qword [0x180640fd0], rax
mov dword [rsp + 0x28], 0
jmp 0x18005d1e8
mov eax, dword [rsp + 0x28]
inc eax
mov dword [rsp + 0x28], eax
cmp dword [rsp + 0x28], 0x22
jge 0x18005d200
movsxd rax, dword [rsp + 0x28]
xor ecx, ecx
mov word [rsp + rax*2 + 0x80], cx
jmp 0x18005d1de
mov rax, qword [rsp + 0x100]
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], 0
mov dword [rsp + 0x74], 0
mov dword [rsp + 0x70], 0
mov rax, qword [0x180640fd0]
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0xf0]
mov rax, qword [rax]
mov qword [rsp + 0x38], rax
cmp qword [rsp + 0x38], 0
je 0x18005d278
mov eax, 8
imul rax, rax, 0x4f
mov rcx, qword [rsp + 0x38]
mov rax, qword [rcx + rax]
mov qword [rsp + 0x58], rax
lea r8, [rsp + 0x60]
mov rdx, qword [rsp + 0x50]
mov rcx, qword [rsp + 0xf0]
call qword [rsp + 0x58]
nop
lea rax, [rsp + 0x68]
mov rdi, qword [rsp + 0xf8]
mov rsi, rax
mov ecx, 0x10
rep movsb byte [rdi], byte [rsi]
mov rax, qword [rsp + 0xf8]
add rsp, 0xd8
pop rdi
pop rsi
ret
Function at 0x180005eac
Capabilities:
Encrypt data using rc4 prga

Disassembly:
jmp 0x1800611f0
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rsi
push rdi
sub rsp, 0xc8
cmp qword [0x180640f60], 0
jne 0x180061309
lea rax, [rsp + 0x70]
lea rcx, [0x1802891d0]
mov rdi, rax
mov rsi, rcx
mov ecx, 0x4a
rep movsb byte [rdi], byte [rsi]
mov eax, 2
imul rax, rax, 0x24
movzx eax, word [rsp + rax + 0x70]
test eax, eax
je 0x180061246
mov dword [rsp + 0x2c], 1
jmp 0x18006124e
mov dword [rsp + 0x2c], 0
movzx eax, byte [rsp + 0x2c]
mov byte [rsp + 0x20], al
movzx eax, byte [rsp + 0x20]
movzx eax, al
test eax, eax
je 0x1800612b1
mov dword [rsp + 0x24], 0
jmp 0x180061277
mov eax, dword [rsp + 0x24]
inc eax
mov dword [rsp + 0x24], eax
cmp dword [rsp + 0x24], 0x25
jge 0x1800612b1
movsxd rax, dword [rsp + 0x24]
movzx eax, word [rsp + rax*2 + 0x70]
mov dword [rsp + 0x30], eax
mov eax, dword [rsp + 0x24]
cdq
mov ecx, 3
idiv ecx
mov eax, edx
add eax, 0xa
mov ecx, dword [rsp + 0x30]
xor ecx, eax
mov eax, ecx
movsxd rcx, dword [rsp + 0x24]
mov word [rsp + rcx*2 + 0x70], ax
jmp 0x18006126d
lea rax, [rsp + 0x70]
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
xor r9d, r9d
mov r8, rax
xor edx, edx
xor ecx, ecx
call fcn.180002662
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x48]
mov qword [0x180640f60], rax
mov dword [rsp + 0x28], 0
jmp 0x1800612f4
mov eax, dword [rsp + 0x28]
inc eax
mov dword [rsp + 0x28], eax
cmp dword [rsp + 0x28], 0x25
jge 0x180061309
movsxd rax, dword [rsp + 0x28]
xor ecx, ecx
mov word [rsp + rax*2 + 0x70], cx
jmp 0x1800612ea
mov rax, qword [rsp + 0xe8]
mov qword [rsp + 0x60], rax
lea rax, [rsp + 0x68]
mov rdi, rax
xor eax, eax
mov ecx, 8
rep stosb byte [rdi], al
mov rax, qword [0x180640f60]
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0xe0]
mov rax, qword [rax]
mov qword [rsp + 0x38], rax
cmp qword [rsp + 0x38], 0
je 0x180061379
mov eax, 8
imul rax, rax, 0x4f
mov rcx, qword [rsp + 0x38]
mov rax, qword [rcx + rax]
mov qword [rsp + 0x58], rax
lea r8, [rsp + 0x60]
mov rdx, qword [rsp + 0x50]
mov rcx, qword [rsp + 0xe0]
call qword [rsp + 0x58]
nop
movsd xmm0, qword [rsp + 0x68]
add rsp, 0xc8
pop rdi
pop rsi
ret
Function at 0x180005f01
Capabilities:
Encrypt data using rc4 prga

Disassembly:
jmp 0x18005ac10
mov qword [rsp + 8], rcx
push rsi
push rdi
sub rsp, 0x98
cmp qword [0x180640cc0], 0
jne 0x18005ad24
lea rax, [rsp + 0x60]
lea rcx, [0x180288288]
mov rdi, rax
mov rsi, rcx
mov ecx, 0x30
rep movsb byte [rdi], byte [rsi]
mov eax, 2
imul rax, rax, 0x17
movzx eax, word [rsp + rax + 0x60]
test eax, eax
je 0x18005ac61
mov dword [rsp + 0x2c], 1
jmp 0x18005ac69
mov dword [rsp + 0x2c], 0
movzx eax, byte [rsp + 0x2c]
mov byte [rsp + 0x20], al
movzx eax, byte [rsp + 0x20]
movzx eax, al
test eax, eax
je 0x18005accc
mov dword [rsp + 0x24], 0
jmp 0x18005ac92
mov eax, dword [rsp + 0x24]
inc eax
mov dword [rsp + 0x24], eax
cmp dword [rsp + 0x24], 0x18
jge 0x18005accc
movsxd rax, dword [rsp + 0x24]
movzx eax, word [rsp + rax*2 + 0x60]
mov dword [rsp + 0x34], eax
mov eax, dword [rsp + 0x24]
cdq
mov ecx, 3
idiv ecx
mov eax, edx
add eax, 0xa
mov ecx, dword [rsp + 0x34]
xor ecx, eax
mov eax, ecx
movsxd rcx, dword [rsp + 0x24]
mov word [rsp + rcx*2 + 0x60], ax
jmp 0x18005ac88
lea rax, [rsp + 0x60]
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
xor r9d, r9d
mov r8, rax
xor edx, edx
xor ecx, ecx
call fcn.180002662
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x48]
mov qword [0x180640cc0], rax
mov dword [rsp + 0x28], 0
jmp 0x18005ad0f
mov eax, dword [rsp + 0x28]
inc eax
mov dword [rsp + 0x28], eax
cmp dword [rsp + 0x28], 0x18
jge 0x18005ad24
movsxd rax, dword [rsp + 0x28]
xor ecx, ecx
mov word [rsp + rax*2 + 0x60], cx
jmp 0x18005ad05
lea rax, [rsp + 0x30]
mov rdi, rax
xor eax, eax
mov ecx, 4
rep stosb byte [rdi], al
mov rax, qword [0x180640cc0]
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0xb0]
mov rax, qword [rax]
mov qword [rsp + 0x38], rax
cmp qword [rsp + 0x38], 0
je 0x18005ad87
mov eax, 8
imul rax, rax, 0x4f
mov rcx, qword [rsp + 0x38]
mov rax, qword [rcx + rax]
mov qword [rsp + 0x58], rax
lea r8, [rsp + 0x30]
mov rdx, qword [rsp + 0x50]
mov rcx, qword [rsp + 0xb0]
call qword [rsp + 0x58]
nop
movss xmm0, dword [rsp + 0x30]
add rsp, 0x98
pop rdi
pop rsi
ret
Function at 0x180005f47
Capabilities:
Encrypt data using rc4 prga

Disassembly:
jmp 0x180063f10
mov qword [rsp + 8], rcx
push rsi
push rdi
sub rsp, 0xb8
cmp qword [0x180640c50], 0
jne 0x180064024
lea rax, [rsp + 0x60]
lea rcx, str.Ld__krix_me_Cx_arhcedlJxdaH
mov rdi, rax
mov rsi, rcx
mov ecx, 0x44
rep movsb byte [rdi], byte [rsi]
mov eax, 2
imul rax, rax, 0x21
movzx eax, word [rsp + rax + 0x60]
test eax, eax
je 0x180063f61
mov dword [rsp + 0x2c], 1
jmp 0x180063f69
mov dword [rsp + 0x2c], 0
movzx eax, byte [rsp + 0x2c]
mov byte [rsp + 0x21], al
movzx eax, byte [rsp + 0x21]
movzx eax, al
test eax, eax
je 0x180063fcc
mov dword [rsp + 0x24], 0
jmp 0x180063f92
mov eax, dword [rsp + 0x24]
inc eax
mov dword [rsp + 0x24], eax
cmp dword [rsp + 0x24], 0x22
jge 0x180063fcc
movsxd rax, dword [rsp + 0x24]
movzx eax, word [rsp + rax*2 + 0x60]
mov dword [rsp + 0x30], eax
mov eax, dword [rsp + 0x24]
cdq
mov ecx, 3
idiv ecx
mov eax, edx
add eax, 0xa
mov ecx, dword [rsp + 0x30]
xor ecx, eax
mov eax, ecx
movsxd rcx, dword [rsp + 0x24]
mov word [rsp + rcx*2 + 0x60], ax
jmp 0x180063f88
lea rax, [rsp + 0x60]
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
xor r9d, r9d
mov r8, rax
xor edx, edx
xor ecx, ecx
call fcn.180002662
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x48]
mov qword [0x180640c50], rax
mov dword [rsp + 0x28], 0
jmp 0x18006400f
mov eax, dword [rsp + 0x28]
inc eax
mov dword [rsp + 0x28], eax
cmp dword [rsp + 0x28], 0x22
jge 0x180064024
movsxd rax, dword [rsp + 0x28]
xor ecx, ecx
mov word [rsp + rax*2 + 0x60], cx
jmp 0x180064005
lea rax, [rsp + 0x20]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
mov rax, qword [0x180640c50]
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0xd0]
mov rax, qword [rax]
mov qword [rsp + 0x38], rax
cmp qword [rsp + 0x38], 0
je 0x180064087
mov eax, 8
imul rax, rax, 0x4f
mov rcx, qword [rsp + 0x38]
mov rax, qword [rcx + rax]
mov qword [rsp + 0x58], rax
lea r8, [rsp + 0x20]
mov rdx, qword [rsp + 0x50]
mov rcx, qword [rsp + 0xd0]
call qword [rsp + 0x58]
nop
movzx eax, byte [rsp + 0x20]
add rsp, 0xb8
pop rdi
pop rsi
ret
Function at 0x1800060b4
Capabilities:
Encrypt data using rc4 prga

Disassembly:
jmp 0x180028370
mov qword [rsp + 8], rcx
push rsi
push rdi
sub rsp, 0x98
cmp qword [0x180640af0], 0
jne 0x180028484
lea rax, [rsp + 0x60]
lea rcx, str.Ldikcd_OkeJcyi_n
mov rdi, rax
mov rsi, rcx
mov ecx, 0x26
rep movsb byte [rdi], byte [rsi]
mov eax, 2
imul rax, rax, 0x12
movzx eax, word [rsp + rax + 0x60]
test eax, eax
je 0x1800283c1
mov dword [rsp + 0x30], 1
jmp 0x1800283c9
mov dword [rsp + 0x30], 0
movzx eax, byte [rsp + 0x30]
mov byte [rsp + 0x20], al
movzx eax, byte [rsp + 0x20]
movzx eax, al
test eax, eax
je 0x18002842c
mov dword [rsp + 0x28], 0
jmp 0x1800283f2
mov eax, dword [rsp + 0x28]
inc eax
mov dword [rsp + 0x28], eax
cmp dword [rsp + 0x28], 0x13
jge 0x18002842c
movsxd rax, dword [rsp + 0x28]
movzx eax, word [rsp + rax*2 + 0x60]
mov dword [rsp + 0x34], eax
mov eax, dword [rsp + 0x28]
cdq
mov ecx, 3
idiv ecx
mov eax, edx
add eax, 0xa
mov ecx, dword [rsp + 0x34]
xor ecx, eax
mov eax, ecx
movsxd rcx, dword [rsp + 0x28]
mov word [rsp + rcx*2 + 0x60], ax
jmp 0x1800283e8
lea rax, [rsp + 0x60]
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
xor r9d, r9d
mov r8, rax
xor edx, edx
xor ecx, ecx
call fcn.180002662
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x48]
mov qword [0x180640af0], rax
mov dword [rsp + 0x2c], 0
jmp 0x18002846f
mov eax, dword [rsp + 0x2c]
inc eax
mov dword [rsp + 0x2c], eax
cmp dword [rsp + 0x2c], 0x13
jge 0x180028484
movsxd rax, dword [rsp + 0x2c]
xor ecx, ecx
mov word [rsp + rax*2 + 0x60], cx
jmp 0x180028465
mov byte [rsp + 0x24], 1
lea rax, [rsp + 0x25]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
mov rax, qword [0x180640af0]
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0xb0]
mov rax, qword [rax]
mov qword [rsp + 0x38], rax
cmp qword [rsp + 0x38], 0
je 0x1800284ec
mov eax, 8
imul rax, rax, 0x4f
mov rcx, qword [rsp + 0x38]
mov rax, qword [rcx + rax]
mov qword [rsp + 0x58], rax
lea r8, [rsp + 0x24]
mov rdx, qword [rsp + 0x50]
mov rcx, qword [rsp + 0xb0]
call qword [rsp + 0x58]
nop
movzx eax, byte [rsp + 0x25]
add rsp, 0x98
pop rdi
pop rsi
ret

Function at 0x1800060d7
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
jmp 0x18019e310
jmp 0x1801bb0e0
lea r9, [rdx + rdx]
movabs r8, 0xcbf29ce484222325
xor edx, edx
test r9, r9
je 0x18019e342
movzx eax, byte [rcx + rdx]
movabs r10, 0x100000001b3
xor r8, rax
inc rdx
imul r8, r10
cmp rdx, r9
jb 0x18019e325
mov rax, r8
ret
sub r8, rdx
mov rcx, rdx
sar r8, 1
mov rdx, r8
jmp 0x180001221
Function at 0x1800061b3
Capabilities:
Encrypt data using rc4 prga

Disassembly:
jmp 0x180056ff0
movsd qword [rsp + 0x18], xmm2
movsd qword [rsp + 0x10], xmm1
mov qword [rsp + 8], rcx
push rsi
push rdi
sub rsp, 0xb8
cmp qword [0x180640e00], 0
jne 0x180057110
lea rax, [rsp + 0x78]
lea rcx, [0x180288b78]
mov rdi, rax
mov rsi, rcx
mov ecx, 0x2e
rep movsb byte [rdi], byte [rsi]
mov eax, 2
imul rax, rax, 0x16
movzx eax, word [rsp + rax + 0x78]
test eax, eax
je 0x18005704d
mov dword [rsp + 0x2c], 1
jmp 0x180057055
mov dword [rsp + 0x2c], 0
movzx eax, byte [rsp + 0x2c]
mov byte [rsp + 0x20], al
movzx eax, byte [rsp + 0x20]
movzx eax, al
test eax, eax
je 0x1800570b8
mov dword [rsp + 0x24], 0
jmp 0x18005707e
mov eax, dword [rsp + 0x24]
inc eax
mov dword [rsp + 0x24], eax
cmp dword [rsp + 0x24], 0x17
jge 0x1800570b8
movsxd rax, dword [rsp + 0x24]
movzx eax, word [rsp + rax*2 + 0x78]
mov dword [rsp + 0x30], eax
mov eax, dword [rsp + 0x24]
cdq
mov ecx, 3
idiv ecx
mov eax, edx
add eax, 0xa
mov ecx, dword [rsp + 0x30]
xor ecx, eax
mov eax, ecx
movsxd rcx, dword [rsp + 0x24]
mov word [rsp + rcx*2 + 0x78], ax
jmp 0x180057074
lea rax, [rsp + 0x78]
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
xor r9d, r9d
mov r8, rax
xor edx, edx
xor ecx, ecx
call fcn.180002662
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x48]
mov qword [0x180640e00], rax
mov dword [rsp + 0x28], 0
jmp 0x1800570fb
mov eax, dword [rsp + 0x28]
inc eax
mov dword [rsp + 0x28], eax
cmp dword [rsp + 0x28], 0x17
jge 0x180057110
movsxd rax, dword [rsp + 0x28]
xor ecx, ecx
mov word [rsp + rax*2 + 0x78], cx
jmp 0x1800570f1
movsd xmm0, qword [rsp + 0xd8]
movsd qword [rsp + 0x60], xmm0
movsd xmm0, qword [rsp + 0xe0]
movsd qword [rsp + 0x68], xmm0
lea rax, [rsp + 0x70]
mov rdi, rax
xor eax, eax
mov ecx, 8
rep stosb byte [rdi], al
mov rax, qword [0x180640e00]
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0xd0]
mov rax, qword [rax]
mov qword [rsp + 0x38], rax
cmp qword [rsp + 0x38], 0
je 0x180057191
mov eax, 8
imul rax, rax, 0x4f
mov rcx, qword [rsp + 0x38]
mov rax, qword [rcx + rax]
mov qword [rsp + 0x58], rax
lea r8, [rsp + 0x60]
mov rdx, qword [rsp + 0x50]
mov rcx, qword [rsp + 0xd0]
call qword [rsp + 0x58]
nop
movsd xmm0, qword [rsp + 0x70]
add rsp, 0xb8
pop rdi
pop rsi
ret
Function at 0x1800061ef
Capabilities:
Encrypt data using rc4 prga

Disassembly:
jmp 0x180059b90
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rsi
push rdi
sub rsp, 0xd8
cmp qword [0x180640de0], 0
jne 0x180059ca9
lea rax, [rsp + 0x70]
lea rcx, str.Ld_eyfiGehymxr_MnxIxnbXmlnVeeiZcmyn_f
mov rdi, rax
mov rsi, rcx
mov ecx, 0x54
rep movsb byte [rdi], byte [rsi]
mov eax, 2
imul rax, rax, 0x29
movzx eax, word [rsp + rax + 0x70]
test eax, eax
je 0x180059be6
mov dword [rsp + 0x2c], 1
jmp 0x180059bee
mov dword [rsp + 0x2c], 0
movzx eax, byte [rsp + 0x2c]
mov byte [rsp + 0x20], al
movzx eax, byte [rsp + 0x20]
movzx eax, al
test eax, eax
je 0x180059c51
mov dword [rsp + 0x24], 0
jmp 0x180059c17
mov eax, dword [rsp + 0x24]
inc eax
mov dword [rsp + 0x24], eax
cmp dword [rsp + 0x24], 0x2a
jge 0x180059c51
movsxd rax, dword [rsp + 0x24]
movzx eax, word [rsp + rax*2 + 0x70]
mov dword [rsp + 0x30], eax
mov eax, dword [rsp + 0x24]
cdq
mov ecx, 3
idiv ecx
mov eax, edx
add eax, 0xa
mov ecx, dword [rsp + 0x30]
xor ecx, eax
mov eax, ecx
movsxd rcx, dword [rsp + 0x24]
mov word [rsp + rcx*2 + 0x70], ax
jmp 0x180059c0d
lea rax, [rsp + 0x70]
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
xor r9d, r9d
mov r8, rax
xor edx, edx
xor ecx, ecx
call fcn.180002662
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x48]
mov qword [0x180640de0], rax
mov dword [rsp + 0x28], 0
jmp 0x180059c94
mov eax, dword [rsp + 0x28]
inc eax
mov dword [rsp + 0x28], eax
cmp dword [rsp + 0x28], 0x2a
jge 0x180059ca9
movsxd rax, dword [rsp + 0x28]
xor ecx, ecx
mov word [rsp + rax*2 + 0x70], cx
jmp 0x180059c8a
mov rax, qword [rsp + 0xf8]
mov qword [rsp + 0x60], rax
lea rax, [rsp + 0x68]
mov rdi, rax
xor eax, eax
mov ecx, 8
rep stosb byte [rdi], al
mov rax, qword [0x180640de0]
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0xf0]
mov rax, qword [rax]
mov qword [rsp + 0x38], rax
cmp qword [rsp + 0x38], 0
je 0x180059d19
mov eax, 8
imul rax, rax, 0x4f
mov rcx, qword [rsp + 0x38]
mov rax, qword [rcx + rax]
mov qword [rsp + 0x58], rax
lea r8, [rsp + 0x60]
mov rdx, qword [rsp + 0x50]
mov rcx, qword [rsp + 0xf0]
call qword [rsp + 0x58]
nop
mov eax, dword [rsp + 0x68]
add rsp, 0xd8
pop rdi
pop rsi
ret
Function at 0x18000623a
Capabilities:
Encrypt data using rc4 prga

Disassembly:
jmp 0x180064550
movss dword [rsp + 0x20], xmm3
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rsi
push rdi
sub rsp, 0xc8
cmp qword [0x1806406c0], 0
jne 0x180064674
lea rax, [rsp + 0x60]
lea rcx, [0x180286688]
mov rdi, rax
mov rsi, rcx
mov ecx, 0x26
rep movsb byte [rdi], byte [rsi]
mov eax, 2
imul rax, rax, 0x12
movzx eax, word [rsp + rax + 0x60]
test eax, eax
je 0x1800645b1
mov dword [rsp + 0x2c], 1
jmp 0x1800645b9
mov dword [rsp + 0x2c], 0
movzx eax, byte [rsp + 0x2c]
mov byte [rsp + 0x20], al
movzx eax, byte [rsp + 0x20]
movzx eax, al
test eax, eax
je 0x18006461c
mov dword [rsp + 0x24], 0
jmp 0x1800645e2
mov eax, dword [rsp + 0x24]
inc eax
mov dword [rsp + 0x24], eax
cmp dword [rsp + 0x24], 0x13
jge 0x18006461c
movsxd rax, dword [rsp + 0x24]
movzx eax, word [rsp + rax*2 + 0x60]
mov dword [rsp + 0x30], eax
mov eax, dword [rsp + 0x24]
cdq
mov ecx, 3
idiv ecx
mov eax, edx
add eax, 0xa
mov ecx, dword [rsp + 0x30]
xor ecx, eax
mov eax, ecx
movsxd rcx, dword [rsp + 0x24]
mov word [rsp + rcx*2 + 0x60], ax
jmp 0x1800645d8
lea rax, [rsp + 0x60]
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
xor r9d, r9d
mov r8, rax
xor edx, edx
xor ecx, ecx
call fcn.180002662
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x48]
mov qword [0x1806406c0], rax
mov dword [rsp + 0x28], 0
jmp 0x18006465f
mov eax, dword [rsp + 0x28]
inc eax
mov dword [rsp + 0x28], eax
cmp dword [rsp + 0x28], 0x13
jge 0x180064674
movsxd rax, dword [rsp + 0x28]
xor ecx, ecx
mov word [rsp + rax*2 + 0x60], cx
jmp 0x180064655
lea rax, [rsp + 0x88]
mov rdi, rax
mov rsi, qword [rsp + 0xe8]
mov ecx, 0x10
rep movsb byte [rdi], byte [rsi]
lea rax, [rsp + 0x98]
mov rdi, rax
mov rsi, qword [rsp + 0xf0]
mov ecx, 0x10
rep movsb byte [rdi], byte [rsi]
movss xmm0, dword [rsp + 0xf8]
movss dword [rsp + 0xa8], xmm0
lea rax, [rsp + 0xac]
mov rdi, rax
mov rsi, qword [rsp + 0x100]
mov ecx, 0x10
rep movsb byte [rdi], byte [rsi]
mov rax, qword [0x1806406c0]
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0xe0]
mov rax, qword [rax]
mov qword [rsp + 0x38], rax
cmp qword [rsp + 0x38], 0
je 0x180064729
mov eax, 8
imul rax, rax, 0x4f
mov rcx, qword [rsp + 0x38]
mov rax, qword [rcx + rax]
mov qword [rsp + 0x58], rax
lea r8, [rsp + 0x88]
mov rdx, qword [rsp + 0x50]
mov rcx, qword [rsp + 0xe0]
call qword [rsp + 0x58]
nop
add rsp, 0xc8
pop rdi
pop rsi
ret
Function at 0x1800062ee
Capabilities:
Encrypt data using rc4 prga

Disassembly:
jmp 0x1800266a0
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rsi
push rdi
sub rsp, 0x108
cmp qword [0x180641040], 0
jne 0x1800267d5
lea rax, [rsp + 0xb0]
lea rcx, [0x180289740]
mov rdi, rax
mov rsi, rcx
mov ecx, 0x48
rep movsb byte [rdi], byte [rsi]
mov eax, 2
imul rax, rax, 0x23
movzx eax, word [rsp + rax + 0xb0]
test eax, eax
je 0x180026706
mov dword [rsp + 0x2c], 1
jmp 0x18002670e
mov dword [rsp + 0x2c], 0
movzx eax, byte [rsp + 0x2c]
mov byte [rsp + 0x20], al
movzx eax, byte [rsp + 0x20]
movzx eax, al
test eax, eax
je 0x180026777
mov dword [rsp + 0x24], 0
jmp 0x180026737
mov eax, dword [rsp + 0x24]
inc eax
mov dword [rsp + 0x24], eax
cmp dword [rsp + 0x24], 0x24
jge 0x180026777
movsxd rax, dword [rsp + 0x24]
movzx eax, word [rsp + rax*2 + 0xb0]
mov dword [rsp + 0x30], eax
mov eax, dword [rsp + 0x24]
cdq
mov ecx, 3
idiv ecx
mov eax, edx
add eax, 0xa
mov ecx, dword [rsp + 0x30]
xor ecx, eax
mov eax, ecx
movsxd rcx, dword [rsp + 0x24]
mov word [rsp + rcx*2 + 0xb0], ax
jmp 0x18002672d
lea rax, [rsp + 0xb0]
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
xor r9d, r9d
mov r8, rax
xor edx, edx
xor ecx, ecx
call fcn.180002662
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x48]
mov qword [0x180641040], rax
mov dword [rsp + 0x28], 0
jmp 0x1800267bd
mov eax, dword [rsp + 0x28]
inc eax
mov dword [rsp + 0x28], eax
cmp dword [rsp + 0x28], 0x24
jge 0x1800267d5
movsxd rax, dword [rsp + 0x28]
xor ecx, ecx
mov word [rsp + rax*2 + 0xb0], cx
jmp 0x1800267b3
lea rax, [rsp + 0x60]
mov rdi, rax
mov rsi, qword [rsp + 0x130]
mov ecx, 0x10
rep movsb byte [rdi], byte [rsi]
lea rax, [rsp + 0x70]
mov rdi, rax
mov rsi, qword [rsp + 0x138]
mov ecx, 0x10
rep movsb byte [rdi], byte [rsi]
mov eax, dword [rsp + 0x140]
mov dword [rsp + 0x80], eax
lea rax, [rsp + 0x88]
mov rdi, rax
mov rsi, qword [rsp + 0x148]
mov ecx, 0x10
rep movsb byte [rdi], byte [rsi]
mov qword [rsp + 0x98], 0
mov dword [rsp + 0xa4], 0
mov dword [rsp + 0xa0], 0
mov rax, qword [0x180641040]
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x120]
mov rax, qword [rax]
mov qword [rsp + 0x38], rax
cmp qword [rsp + 0x38], 0
je 0x18002689f
mov eax, 8
imul rax, rax, 0x4f
mov rcx, qword [rsp + 0x38]
mov rax, qword [rcx + rax]
mov qword [rsp + 0x58], rax
lea r8, [rsp + 0x60]
mov rdx, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x120]
call qword [rsp + 0x58]
nop
lea rax, [rsp + 0x98]
mov rdi, qword [rsp + 0x128]
mov rsi, rax
mov ecx, 0x10
rep movsb byte [rdi], byte [rsi]
mov rax, qword [rsp + 0x128]
add rsp, 0x108
pop rdi
pop rsi
ret