joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1802a08e0
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x20
mov rsi, rcx
mov rax, qword [rsi]
movabs rcx, 0x7ffffffffffffffb
mov rdx, rax
add rdx, rcx
movabs rcx, 0x7ffffffffffffffc
mov r8, rax
add r8, rcx
xor ecx, ecx
cmp rdx, 2
cmovb rcx, r8
test rcx, rcx
je 0x1802a0934
jmp 0x1802a0925
sub rcx, 1
je 0x1802a3b1a
jmp 0x1802a3c28
mov cl, byte [rsi + 0x388]
movzx ecx, cl
test ecx, ecx
je 0x1802a0951
jmp 0x1802a0943
sub ecx, 3
je 0x1802a0b64
jmp 0x1802a3c28
movabs rcx, 0x8000000000000000
xor rax, rcx
mov rcx, rax
sub rcx, 5
mov edx, 5
cmovb rdx, rax
mov rax, rdx
sub rax, 4
mov rcx, rsi
ja 0x1802a09c9
lea rax, [0x180489900]
movsxd rcx, dword [rax + rdx*4]
add rcx, rax
jmp rcx
mov r8, qword [rcx]
mov eax, dword [0x180525240]
xor edx, edx
div dword [0x180525244]
xor eax, 0xec600e4d
sub eax, 0x2f8932da
sub eax, 0x57cc03df
cmp eax, 0x1970b225
je 0x1802a3c37
jmp 0x1802a09f6
mov eax, dword [0x180525248]
imul eax, dword [0x18052524c]
mov r9d, 0xa70ec27f
xor edx, edx
div r9d
sub eax, 0xac7897b0
and eax, 0x3752cc14
cmp r8, 0
sete dl
cmp eax, 0x3639d280
jae 0x1802a09f6
test dl, 1
jne 0x1802a0a44
jmp 0x1802a0a2d
add rcx, 8
mov rcx, qword [rcx]
mov rdx, r8
mov r8d, 1
call fcn.1802cbf20
jmp 0x1802a0a44
add rsi, 0x28
mov rdi, qword [rsi]
mov rax, rdi
add rax, 0x1c8
lock dec qword [rax]
sete al
test al, 1
je 0x1802a0a9a
mov rcx, rdi
sub rcx, 0xffffffffffffff80
mov edx, 1
lock xadd qword [rdi + 0x88], rdx
call fcn.1802c54a0
movabs rcx, 0x200000000
lock or qword [rax + 0x510], rcx
add rdi, 0x100
mov rcx, rdi
call fcn.180407590
mov eax, dword [0x180525250]
xor edx, edx
div dword [0x180525254]
xor eax, 0x6d0622f5
or eax, 0xa9241829
add eax, 0x6c1a8ef7
cmp eax, 0x38885cf8
jbe 0x1802a3c48
mov rax, rsi
add rax, 0x88
add byte [rax], al
mov rax, rsi
add rax, 8
cmp qword [rax], 0
sete al
test al, 1
jne 0x1802a3c28
jmp 0x1802a3b32
mov rax, rsi
add rax, 0x10
mov rdi, qword [rax]
mov eax, dword [0x1805257b0]
or eax, dword [0x1805257b4]
xor eax, 0x38fa24fe
or eax, 0xbc895d62
sub eax, 0x18c226d2
cmp eax, 0x442cf0a8
je 0x1802a4200
jmp 0x1802a3b64
mov ecx, dword [0x1805257b8]
add ecx, dword [0x1805257bc]
xor ecx, 0x8568bd8b
add ecx, 0xf80fb1b0
add ecx, 0xaeedf042
mov rbx, qword [rsi + 0x18]
cmp rdi, 0
sete al
cmp ecx, 0x59bb0ea4
jae 0x1802a3b64
test al, 1
jne 0x1802a3c28
jmp 0x1802a3b9f
mov eax, dword [0x1805257c0]
sub eax, dword [0x1805257c4]
add eax, 0x8d3be6dc
imul eax, eax, 0x81091a38
add eax, 0xccf042aa
cmp eax, 0x1e003704
jbe 0x1802a4211
mov eax, dword [0x1805257c8]
xor edx, edx
div dword [0x1805257cc]
imul eax, eax, 0xe0a7eef9
or eax, 0xf4b7a8ae
imul eax, eax, 0x49cea422
cmp rbx, 0
setne cl
cmp eax, 0x73b7a526
je 0x1802a4211
jmp 0x1802a3bf9
mov rax, qword [rbx]
cmp rax, 0
je 0x1802a3c09
mov rcx, rdi
call rax
jmp 0x1802a3c09
mov rdx, qword [rbx + 8]
mov r8, qword [rbx + 0x10]
cmp rdx, 0
sete al
test al, 1
jne 0x1802a3c28
jmp 0x1802a3c1e
mov rcx, rdi
call fcn.1802cbf20
xor byte [rbp + 0x66], dh
xchg byte [rbp - 0x63], dh
iretd
wait
or dword [rsp + rbx + 1], 0x46
stosb byte [rdi], al
invalid
invalid
Function at 0x1802a6740
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rsi, rcx
mov rcx, rsi
call fcn.1802b7070
mov r14, rsi
add r14, 0x18
mov rcx, qword [rsi + 0x18]
cmp rcx, 0xffffffffffffffff
sete al
test al, 1
jne 0x1802a6933
jmp 0x1802a6772
mov r15, rsi
add r15, 0x20
mov rdi, qword [r15]
cmp rdi, 0
je 0x1802a692d
mov eax, dword [str.DNa_]
xor eax, dword [0x180525b34]
xor eax, 0xf064b642
add eax, 0xae6d804c
xor eax, 0x9d797229
cmp eax, 0x37b2accc
jb 0x1802a6b37
cmp ebp, dword [rcx - 0x2bc0a1d7]
xchg ebx, eax
fisttp word [rdi + 0x4851462d]
Function at 0x1802abb30
Capabilities:
Encode data using xor

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x58
mov r14, rdx
mov rdi, rcx
mov rsi, rdi
mov rbx, qword [r14 + 8]
mov r8, qword [r14 + 0x10]
lea rcx, [rsp + 0x40]
mov rdx, rbx
call fcn.1802d4380
lea rcx, [rsp + 0x20]
lea rdx, [rsp + 0x40]
call fcn.1802b7750
mov rdx, qword [r14]
cmp rdx, 0
je 0x1802abb7f
mov rcx, rbx
mov r8d, 1
call fcn.1802cbf20
jmp 0x1802abb7f
mov eax, dword [0x180526190]
xor eax, dword [0x180526194]
mov ecx, 0x7e69a5ea
xor edx, edx
div ecx
and eax, 0x10de9827
and eax, 0x194ee8ba
cmp eax, 0x9b0355f1
je 0x1802abcca
jmp 0x1802abbab
mov eax, dword [0x180526198]
xor eax, dword [0x18052619c]
add eax, 0xd1cd8b70
xor eax, 0x74308506
xor eax, 0x82467b17
mov rdx, qword [rsp + 0x20]
cmp eax, 0xfebeceea
jae 0x1802abbab
jmp 0x1802abbd4
movabs rax, 0x8000000000000000
mov rcx, rdx
sub rcx, rax
je 0x1802abc55
jmp 0x1802abbe8
movabs rax, 0x8000000000000001
mov rcx, rdx
sub rcx, rax
je 0x1802abc03
jmp 0x1802abbfc
test rdx, rdx
je 0x1802abc55
jmp 0x1802abc3b
mov rbx, qword [rsp + 0x28]
mov r14, qword [rsp + 0x30]
lea rdx, [0x1802ab940]
mov rcx, rbx
mov r8d, 1
call qword [sym.imp.advapi32.dll_RegisterServiceCtrlHandlerExW]
cmp rax, 0
sete dl
movabs rcx, 0x8000000000000007
test dl, 1
jne 0x1802abc7a
jmp 0x1802abc95
lea rax, [rsp + 0x20]
add rax, 8
mov rcx, qword [rax]
shl rdx, 1
mov r8d, 2
call fcn.1802cbf20
movabs rax, 0x8000000000000004
mov qword [rdi], rax
lea rax, str.service_name
mov qword [rdi + 8], rax
add rdi, 0x10
mov qword [rdi], 0xc
jmp 0x1802abcbd
call sub.kernel32.dll_GetLastError
cdqe
shl rax, 0x20
or rax, 2
movabs rcx, 0x8000000000000006
jmp 0x1802abc95
mov qword [rdi], rcx
mov qword [rdi + 8], rax
mov word [rbx], 0
cmp r14, 0
je 0x1802abcbd
shl r14, 1
mov rcx, rbx
mov rdx, r14
mov r8d, 2
call fcn.1802cbf20
jmp 0x1802abcbd
mov rax, rsi
add rsp, 0x58
pop rbx
pop rdi
pop rsi
pop r14
ret
cli
xchg ebx, eax
cmp esp, esi
xchg byte [0x110bc3a56], ch
xchg ecx, eax
fldl2t
invalid
Function at 0x1802bbe60
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x68
mov rbp, r9
mov r13, r8
mov r15, rdx
mov rsi, rcx
mov r8, qword [rsp + 0xd0]
imul rax, r13, 0x18
mov rbx, r15
add rbx, rax
Function at 0x1802bca80
Capabilities:
Encode data using xor

Disassembly:
push r14
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x70
movaps xmmword [rsp + 0x60], xmm6
mov rsi, rcx
lea rcx, [rsp + 0x28]
call fcn.180261b40
mov cl, byte [rsp + 0x28]
cmp cl, 0x11
jne 0x1802bcb38
mov rdi, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x38]
mov r14, qword [rsp + 0x40]
mov eax, dword [0x180527588]
or eax, dword [0x18052758c]
or eax, 0xc647bfd8
or eax, 0x8fc77968
mov ecx, 0x981102c9
xor edx, edx
div ecx
cmp eax, 0x65a7e8e2
jae 0x1802bccc8
mov eax, dword [0x180527590]
or eax, dword [0x180527594]
add eax, 0x9c173d12
mov ecx, 0x5bbce2d3
xor edx, edx
div ecx
mov ebp, eax
or ebp, 0xc50d7acc
lea rcx, [rsp + 0x48]
mov rdx, rbx
mov r8, r14
call fcn.18044c830
cmp qword [rsp + 0x48], 0
sete al
cmp ebp, 0x9e77e3e7
jb 0x1802bccc8
jmp 0x1802bcb2b
test al, 1
jne 0x1802bcc1f
jmp 0x1802bcc33
mov eax, dword [str.6n__]
imul eax, dword [0x18052759c]
sub eax, 0x4656b46c
mov r8d, 0x3117ef9e
xor edx, edx
div r8d
sub eax, 0xcdd324d8
cmp eax, 0xb59af7a2
ja 0x1802bcce9
mov eax, dword [0x1805275a0]
and eax, dword [0x1805275a4]
imul eax, eax, 0x71913d85
mov r8d, 0xaffec8c9
xor edx, edx
div r8d
or eax, 0x3bdbbfe3
mov edx, dword [rsp + 0x29]
mov dword [rsi + 1], edx
mov dx, word [rsp + 0x2d]
mov word [rsi + 5], dx
mov dl, byte [rsp + 0x2f]
mov byte [rsi + 7], dl
mov rdx, qword [rsp + 0x30]
cmp eax, 0x2882f093
jbe 0x1802bcce9
jmp 0x1802bcbb0
mov rax, qword [rsp + 0x38]
mov r8, qword [rsp + 0x40]
mov byte [rsi], cl
mov qword [rsi + 8], rdx
mov qword [rsi + 0x10], rax
mov qword [rsi + 0x18], r8
mov eax, dword [0x1805275a8]
or eax, dword [0x1805275ac]
mov ecx, 0xb8dfd260
xor edx, edx
div ecx
or eax, 0x2b04b302
or eax, 0x57366ca0
cmp eax, 0x628f1d4e
je 0x1802bcd0d
jmp 0x1802bcbf4
mov eax, dword [0x1805275b0]
sub eax, dword [0x1805275b4]
xor eax, 0x2f467349
add eax, 0x645ca5d0
mov ecx, 0xa04da493
xor edx, edx
div ecx
cmp eax, 0x97b434c2
je 0x1802bcbf4
jmp 0x1802bccb5
mov qword [rsi + 8], rdi
mov qword [rsi + 0x10], rbx
mov qword [rsi + 0x18], r14
mov byte [rsi], 0x11
jmp 0x1802bccb5
movdqu xmm6, xmmword [rsp + 0x50]
cmp rdi, 0
sete al
test al, 1
jne 0x1802bcc59
jmp 0x1802bcc46
mov rcx, rbx
mov rdx, rdi
mov r8d, 1
call fcn.1802cbf20
jmp 0x1802bcc59
mov eax, dword [0x1805275b8]
xor eax, dword [0x1805275bc]
or eax, 0x67492b08
or eax, 0xa78b0071
mov ecx, 0x7965977b
xor edx, edx
div ecx
cmp eax, 0x5fd6fcd5
je 0x1802bcd1e
mov eax, dword [0x1805275c0]
or eax, dword [0x1805275c4]
and eax, 0x261785d5
xor eax, 0x94c11fec
mov ecx, 0x149ab70c
xor edx, edx
div ecx
mov byte [rsi], 5
cmp eax, 0x3f8359aa
ja 0x1802bcd1e
jmp 0x1802bccae
movdqu xmmword [rsi + 8], xmm6
jmp 0x1802bccb5
mov rax, rsi
movaps xmm6, xmmword [rsp + 0x60]
add rsp, 0x70
pop rbx
pop rbp
pop rdi
pop rsi
pop r14
ret
mov cl, dl
cwde
pushfq
mov byte [rax + 0x3120e38], bh
mov cl, 0x3f
lea rcx, [rsp + 0x48]
mov rdx, rbx
mov r8, r14
call fcn.18044c830
jmp 0x1802bcae2
invalid
mov dh, 0xaf
sub dl, byte [rbx - 0x4ce4ddb6]
xchg esp, eax
jmp 0x1802bcbf2
mov bl, 0x42
xor ebx, ebp
wait
loop 0x1802bcd38
ror byte [rdi - 0x3933e58f], 1
invalid
int3
Function at 0x1802c2350
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x20
mov rsi, rcx
mov al, byte [rsi + 0x10]
movzx eax, al
mov ecx, eax
sub ecx, 3
je 0x1802c2378
jmp 0x1802c2369
sub eax, 4
je 0x1802c23a4
jmp 0x1802c2370
mov rax, rsi
add rax, 0x18
mov ax, word [rax]
cmp ax, 3
jne 0x1802c2370
mov rsi, qword [rsi + 0x20]
mov rcx, rsi
call fcn.180405e10
test al, 1
jne 0x1802c239a
jmp 0x1802c2370
mov rcx, rsi
call fcn.180407050
jmp 0x1802c2370
mov rcx, rsi
add rcx, 0x48
call fcn.1802c43b0
mov rax, rsi
add rax, 0x20
mov ecx, dword [rax]
mov eax, dword [0x180527a38]
sub eax, dword [0x180527a3c]
sub eax, 0xd4db315
mov r8d, 0xbc33480f
xor edx, edx
div r8d
and eax, 0x4543d058
cmp eax, 0x6f06e6a1
je 0x1802c2550
mov eax, dword [0x180527a40]
imul eax, dword [0x180527a44]
sub eax, 0xd9db4d6b
add eax, 0xd7397308
Function at 0x1802c3cf0
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x38
mov rsi, rcx
mov rcx, rsi
call fcn.180416750
cmp qword [rsi], 0
sete al
mov rcx, rsi
Function at 0x1802c5840
Capabilities:
Encode data using xor

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
mov eax, 0x1138
call fcn.18045a590
sub rsp, rax
mov r15, r8
mov bpl, dl
mov rdi, rcx
Function at 0x1802c95f0
Capabilities:
Reference absolute stream path on windows

Disassembly:
push r15
push r14
push rsi
push rdi
push rbx
sub rsp, 0xc0
mov rsi, r8
mov rdi, rdx
mov rbx, rcx
mov r15, qword [0x180528ce8]
mov rax, qword [r15]
lea r14, [rsp + 0x30]
cmp rax, 5
jne 0x1802c9689
lea rax, str.C:Userslucak.cargo_registry_srcindex.crates.io_6f17d22bba15001f_tokio_tungstenite_0.24.0_srccompat.rs:167_Write.write
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], 1
mov qword [rsp + 0x70], r14
xorps xmm0, xmm0
movups xmmword [rsp + 0x78], xmm0
lea rcx, str.C:Userslucak.cargo_registry_srcindex.crates.io_6f17d22bba15001f_tokio_tungstenite_0.24.0_srccompat.rs
call fcn.180424ea0
lea rcx, str.tokio_tungstenite::compat
mov qword [rsp + 0x38], rcx
mov qword [rsp + 0x40], 0x19
mov qword [rsp + 0x48], rcx
mov qword [rsp + 0x50], 0x19
mov qword [rsp + 0x58], rax
lea rcx, [rsp + 0x60]
lea r8, [rsp + 0x38]
mov edx, 5
xor r9d, r9d
call fcn.180424d90
mov rax, qword [r15]
cmp rax, 5
jne 0x1802c96ff
lea rax, str.C:Userslucak.cargo_registry_srcindex.crates.io_6f17d22bba15001f_tokio_tungstenite_0.24.0_srccompat.rs:126_AllowStd.with_context
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], 1
mov qword [rsp + 0x70], r14
xorps xmm0, xmm0
movups xmmword [rsp + 0x78], xmm0
lea rcx, str.C:Userslucak.cargo_registry_srcindex.crates.io_6f17d22bba15001f_tokio_tungstenite_0.24.0_srccompat.rs
call fcn.180424ea0
lea rcx, str.tokio_tungstenite::compat
mov qword [rsp + 0x38], rcx
mov qword [rsp + 0x40], 0x19
mov qword [rsp + 0x48], rcx
mov qword [rsp + 0x50], 0x19
mov qword [rsp + 0x58], rax
lea rcx, [rsp + 0x60]
lea r8, [rsp + 0x38]
mov edx, 5
xor r9d, r9d
call fcn.180424d90
mov rax, qword [rbx + 0x28]
add rax, 0x10
lea rcx, [0x18048a668]
mov qword [rsp + 0x90], rcx
mov qword [rsp + 0x98], rax
lea rax, [rsp + 0x90]
mov qword [rsp + 0xa0], rax
mov qword [rsp + 0xa8], rax
mov qword [rsp + 0xb0], 0
mov rax, qword [r15]
cmp rax, 5
jne 0x1802c97b8
lea rax, str.C:Userslucak.cargo_registry_srcindex.crates.io_6f17d22bba15001f_tokio_tungstenite_0.24.0_srccompat.rs:169_Write.with_context_write____poll_write
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], 1
mov qword [rsp + 0x70], r14
xorps xmm0, xmm0
movups xmmword [rsp + 0x78], xmm0
lea rcx, str.C:Userslucak.cargo_registry_srcindex.crates.io_6f17d22bba15001f_tokio_tungstenite_0.24.0_srccompat.rs
call fcn.180424ea0
lea rcx, str.tokio_tungstenite::compat
mov qword [rsp + 0x38], rcx
mov qword [rsp + 0x40], 0x19
mov qword [rsp + 0x48], rcx
mov qword [rsp + 0x50], 0x19
mov qword [rsp + 0x58], rax
lea rcx, [rsp + 0x60]
lea r8, [rsp + 0x38]
mov edx, 5
xor r9d, r9d
call fcn.180424d90
lea rdx, [rsp + 0xa0]
mov rcx, rbx
mov r8, rdi
mov r9, rsi
call fcn.180407930
cmp rax, 2
movabs rcx, 0xd00000003
cmove rdx, rcx
mov ecx, 1
cmove rax, rcx
add rsp, 0xc0
pop rbx
pop rdi
pop rsi
pop r14
pop r15
ret
Function at 0x1802ca750
Capabilities:
Encode data using xor

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x50
mov rsi, rcx
mov rdi, rsi
add rdi, 0x120
lea rbx, [rsp + 0x28]
add rbx, 8
lea rcx, [rsp + 0x28]
mov rdx, rdi
mov r8, rsi
call fcn.1802c4e60
mov rax, qword [rsp + 0x28]
movabs rcx, 0x7ffffffffffffffb
mov rdx, rax
add rdx, rcx
cmp rdx, 2
jb 0x1802ca79f
jmp 0x1802ca828
jmp 0x1802ca79f
mov eax, dword [0x1805283c8]
xor edx, edx
div dword [0x1805283cc]
sub eax, 0x9d185d57
and eax, 0x70881945
sub eax, 0x3b1b32c0
cmp eax, 0x7653d425
je 0x1802ca9e9
mov eax, dword [0x1805283d0]
imul eax, dword [0x1805283d4]
xor eax, 0xcf837119
mov ecx, 0xe5fcb62c
xor edx, edx
div ecx
mov ecx, 0x35320b8
xor edx, edx
div ecx
cmp eax, 0x4be08d54
jae 0x1802ca9e9
jmp 0x1802ca7f8
add rsi, 0x128
mov rcx, qword [rsi]
mov rsi, qword [rcx + 0x508]
mov edx, 0x520
mov r8d, 8
call fcn.1802cbf20
cmp rsi, 0
mov rcx, rsi
je case.0x1802bed72.113
jmp 0x1802ca802
movabs rcx, 0x8000000000000000
xor rax, rcx
mov rcx, rax
sub rcx, 5
mov ecx, 5
cmovb rcx, rax
lea r9, [rsp + 0x28]
mov rax, rcx
sub rax, 4
ja 0x1802ca8ea
lea rax, [0x18048b298]
movsxd rcx, dword [rax + rcx*4]
add rcx, rax
jmp rcx
mov r8, qword [r9]
cmp r8, 0
je 0x1802ca95a
mov eax, dword [0x1805283e8]
or eax, dword [0x1805283ec]
and eax, 0xbe94c65b
pop rbx
invalid
xchg esp, eax
mov esi, 0x19773725
xor eax, 0xfe9ca6a6
cmp eax, 0xb8bd606e
jbe 0x1802caa07
mov eax, dword [0x1805283f0]
or eax, dword [0x1805283f4]
mov ecx, 0x962a228
xor edx, edx
div ecx
imul eax, eax, 0xab693b19
or eax, 0xd57d87c5
mov rcx, qword [r9 + 8]
cmp eax, 0xcd831926
je 0x1802caa07
jmp 0x1802ca94a
mov rdx, r8
mov r8d, 1
call fcn.1802cbf20
jmp 0x1802ca95a
lea rcx, [rsp + 0x28]
mov rdx, rdi
mov r8, rsi
call fcn.1802c4e60
mov eax, dword [0x1805283f8]
xor edx, edx
sal bh, cl
xor eax, 0x25da84
add eax, 0x4db64708
imul eax, eax, 0xe7cc4074
or eax, 0xab87a51f
cmp eax, 0x48936790
je 0x1802caa14
jmp 0x1802ca995
mov ecx, dword [0x180528400]
xor ecx, dword [0x180528404]
xor ecx, 0x4bb91cd6
xor ecx, 0xc0fc1a09
or dword [rdx], ebx
cld
rol byte [rcx + 0x74e40be1], 0x74
mov rax, qword [rsp + 0x28]
cmp ecx, 0xf60bef0d
ja 0x1802ca995
jmp 0x1802ca9c2
movabs rcx, 0x7ffffffffffffffb
mov rdx, rax
add rdx, rcx
cmp rdx, 2
jb 0x1802ca79d
jmp 0x1802ca828
add rsp, 0x50
pop rbx
pop rdi
pop rsi
ret
invalid
xor dword [rcx + rbp*8 - 0x4db0fdff], ebp
jmp 0x1802ca919
jge 0x1802caa1a
push rsp
mov cl, 0xa7
mov dh, 0xc2
cwde
invalid
Function at 0x1802ce0f0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x78
mov qword [rsp + 0x58], rdx
movsxd rax, dword [rcx + 0x3c]
mov qword [rsp + 0x28], rcx
mov edx, dword [rcx + rax + 0x88]
mov rcx, rdx
mov qword [rsp + 0x38], rdx
test rdx, rdx
je 0x1802ce2c2
mov rcx, qword [rsp + 0x28]
mov eax, dword [rcx + rax + 0x8c]
mov qword [rsp + 0x48], rax
test rax, rax
je 0x1802ce2c2
mov rax, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x38]
mov eax, dword [rax + rcx + 0x1c]
mov qword [rsp + 0x40], rax
test rax, rax
je 0x1802ce2c2
mov rax, qword [rsp + 0x28]
mov rcx, qword [rsp + 0x38]
add rax, rcx
mov qword [rsp + 0x30], rax
mov r12d, dword [rax + 0x14]
test r12d, r12d
je 0x1802ce2c2
mov rax, qword [rsp + 0x30]
mov r15d, dword [rax + 0x20]
test r15, r15
je 0x1802ce2c2
mov rax, qword [rsp + 0x30]
mov ebp, dword [rax + 0x18]
test ebp, ebp
je 0x1802ce2c2
mov rdi, r8
mov rax, qword [rsp + 0x28]
add qword [rsp + 0x40], rax
mov rcx, qword [rsp + 0x30]
mov ecx, dword [rcx + 0x24]
add r15, rax
add rcx, rax
mov qword [rsp + 0x50], rcx
xor r13d, r13d
jmp 0x1802ce1db
mov ebp, ebx
cmp r13d, ebp
jae 0x1802ce2c2
lea r14d, [rbp + r13]
mov ebx, r14d
shr ebx, 1
cmp ebx, r12d
jae 0x1802ce2c2
mov eax, ebx
mov edx, dword [r15 + rax*4]
add rdx, qword [rsp + 0x28]
mov r8, 0xffffffffffffffff
cmp byte [rdx + r8 + 1], 0
lea r8, [r8 + 1]
jne 0x1802ce200
lea rcx, [rsp + 0x60]
call fcn.18044c830
cmp qword [rsp + 0x60], 0
jne 0x1802ce2c2
mov rcx, qword [rsp + 0x68]
mov r8, qword [rsp + 0x70]
mov rsi, r8
sub rsi, rdi
cmovae r8, rdi
mov rdx, qword [rsp + 0x58]
call fcn.180469550
cdqe
test eax, eax
cmovne rsi, rax
xor eax, eax
test rsi, rsi
setne al
mov ecx, 0xff
cmovs eax, ecx
cmp al, 1
je 0x1802ce1d0
movzx eax, al
cmp eax, 0xff
jne 0x1802ce27a
inc ebx
mov r13d, ebx
cmp r13d, ebp
jb 0x1802ce1db
jmp 0x1802ce2c2
and r14d, 0xfffffffe
mov rax, qword [rsp + 0x50]
movzx eax, word [rax + r14]
mov rcx, qword [rsp + 0x40]
mov eax, dword [rcx + rax*4]
add qword [rsp + 0x28], rax
cmp eax, dword [rsp + 0x38]
jb 0x1802ce2ac
mov rax, qword [rsp + 0x30]
add rax, qword [rsp + 0x48]
cmp qword [rsp + 0x28], rax
jb 0x1802ce2c2
mov rax, qword [rsp + 0x28]
add rsp, 0x78
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
ud2
Function at 0x1802ce5b0
Capabilities:
Parse pe header

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbp
push rbx
movzx eax, word [rdx]
cmp eax, 0x5a4d
jne 0x1802ce63c
movsxd rax, dword [rdx + 0x3c]
test rax, rax
je 0x1802ce641
cmp eax, 0x40
jb 0x1802ce731
cmp rax, r8
ja 0x1802ce731
movzx r9d, word [rax + rdx + 0x18]
cmp r9d, 0x10b
je 0x1802ce646
mov r10b, 5
cmp r9d, 0x20b
jne 0x1802ce671
mov r10b, 2
cmp dword [rdx + rax], 0x4550
jne 0x1802ce671
lea r9, [rdx + rax]
movzx r11d, word [r9 + 4]
mov r10b, 3
cmp r11d, 0x8664
jne 0x1802ce671
mov r10b, 4
test byte [r9 + 0x16], 2
je 0x1802ce671
lea r10, [rax + 0x108]
mov r11d, 1
cmp r10, r8
jbe 0x1802ce6a4
jmp 0x1802ce731
xor r10d, r10d
jmp 0x1802ce671
mov r10b, 1
jmp 0x1802ce671
mov r10b, 2
cmp dword [rdx + rax], 0x4550
jne 0x1802ce671
lea r9, [rdx + rax]
movzx r11d, word [r9 + 4]
mov r10b, 3
cmp r11d, 0x14c
jne 0x1802ce671
mov r10b, 4
test byte [r9 + 0x16], 2
jne 0x1802ce691
mov byte [rcx], r10b
mov r8d, 2
mov eax, 0x18
mov qword [rcx + rax], r8
mov rax, rcx
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
lea r10, [rax + 0xf8]
cmp r10, r8
ja 0x1802ce731
xor r11d, r11d
mov rsi, r8
sub rsi, r10
movzx ebx, word [rdx + rax + 6]
lea rdi, [rbx*8]
lea rdi, [rdi + rdi*4]
sub rsi, rdi
jb 0x1802ce731
add rax, 0xffffffffffffffc0
lea r14, [rdx + 0x40]
add r10, rdx
mov r15, rdx
shr r15, 8
add rdi, r10
mov ebp, ebx
shr ebp, 8
mov byte [rcx], dl
mov r12, rdx
shr r12, 0x38
mov byte [rcx + 7], r12b
mov r12, rdx
shr r12, 0x28
mov word [rcx + 5], r12w
mov dword [rcx + 1], r15d
mov qword [rcx + 8], r14
mov qword [rcx + 0x10], rax
mov qword [rcx + 0x18], r11
mov qword [rcx + 0x20], r9
mov qword [rcx + 0x28], r10
mov byte [rcx + 0x30], bl
mov dword [rcx + 0x31], ebp
mov byte [rcx + 0x37], 0
mov word [rcx + 0x35], 0
mov qword [rcx + 0x38], rdi
mov qword [rcx + 0x40], rsi
mov qword [rcx + 0x48], rdx
mov eax, 0x50
jmp 0x1802ce67f
ud2
Function at 0x1802de9b0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbx
sub rsp, 0x68
mov ebx, edx
mov rsi, rcx
movzx r14d, dl
test dl, dl
je 0x1802dea16
lea ecx, [r14 + 0x2f6]
lea eax, [r14 + 0x19c]
and eax, ecx
shr eax, 8
inc al
cmp al, 1
jbe 0x1802dea0e
xor edi, edi
cmp bl, 0x64
jae 0x1802dea3c
mov r15d, 2
cmp bl, 0xa
jb 0x1802dea64
lea rax, [0x18048c4ab]
movzx eax, word [rax + r14*2]
mov word [rsp + 0x41], ax
mov r15d, 1
jmp 0x1802dea6c
test al, al
je 0x1802deaff
mov rdx, qword [rsi + 0x10]
cmp qword [rsi], rdx
je 0x1802dead9
mov rax, qword [rsi + 8]
mov byte [rax + rdx], 0x30
inc rdx
mov qword [rsi + 0x10], rdx
mov edi, 1
cmp bl, 0x64
jb 0x1802de9ea
lea eax, [r14 + r14*4]
lea eax, [r14 + rax*8]
shr eax, 0xc
imul ecx, eax, 0x64
sub bl, cl
movzx ecx, bl
lea rdx, [0x18048c4ab]
movzx ecx, word [rdx + rcx*2]
mov word [rsp + 0x41], cx
xor r15d, r15d
mov ebx, eax
or bl, 0x30
mov byte [rsp + r15 + 0x40], bl
mov rbx, r15
xor rbx, 3
mov rax, qword [rsi]
mov r14, qword [rsi + 0x10]
sub rax, r14
cmp rax, rbx
jb 0x1802deab6
lea rdx, [rsp + r15]
add rdx, 0x40
mov rcx, qword [rsi + 8]
add rcx, r14
mov r8, rbx
call fcn.180468b10
add r14, rbx
mov qword [rsi + 0x10], r14
add rdi, rbx
xor eax, eax
mov rdx, rdi
add rsp, 0x68
pop rbx
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
mov qword [rsp + 0x20], 1
mov r9d, 1
mov rcx, rsi
mov rdx, r14
mov r8, rbx
call fcn.180469640
mov r14, qword [rsi + 0x10]
jmp 0x1802dea82
mov qword [rsp + 0x20], 1
mov r8d, 1
mov r9d, 1
mov rcx, rsi
call fcn.180469640
mov rdx, qword [rsi + 0x10]
jmp 0x1802dea23
mov r12, qword [rsi + 0x10]
mov rcx, qword [rsi]
mov rax, qword [rsi + 8]
xor edi, edi
lea rbx, [rsp + 0x28]
lea r14, [rsp + 0x40]
jmp 0x1802deb2c
mov byte [rax + r12], 0x30
inc r12
mov qword [rsi + 0x10], r12
cmp r12, rcx
jne 0x1802deb20
cmp rcx, 0xffffffffffffffff
je 0x1802deba0
lea r15, [rcx + 1]
lea rdx, [rcx + rcx]
cmp rdx, r15
cmova r15, rdx
cmp r15, 9
jae 0x1802deb52
mov r15d, 8
test r15, r15
js 0x1802deba0
test rcx, rcx
je 0x1802deb6d
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x50], rcx
mov eax, 1
jmp 0x1802deb6f
xor eax, eax
mov qword [rsp + 0x48], rax
mov edx, 1
mov rcx, rbx
mov r8, r15
mov r9, r14
call fcn.1802ce410
cmp qword [rsp + 0x28], 0
jne 0x1802deba8
mov rax, qword [rsp + 0x30]
mov qword [rsi + 8], rax
mov qword [rsi], r15
mov rcx, r15
jmp 0x1802deb20
mov rcx, rdi
call fcn.180407090
mov rcx, qword [rsp + 0x30]
mov rdx, qword [rsp + 0x38]
call fcn.180407090
int3