joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1800d9820
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov eax, 0x68
call fcn.1800b9c10
sub rsp, rax
mov rax, qword [0x1802e4710]
xor rax, rsp
mov qword [rsp + 0x58], rax
movzx edi, byte [rcx]
mov rax, qword [rcx + 0x28]
mov r12, qword [rsp + 0xd0]
mov rsi, r9
mov r9, qword [rcx + 0x30]
mov r15, r8
mov r13, rdx
mov rbx, rcx
mov byte [rsp + 0x30], dil
mov qword [rsp + 0x38], r9
mov qword [rsp + 0x40], rax
test dil, 0x40
jne 0x1800d988f
lea rdx, [rcx + 0x10]
mov r8, r9
call rax
inc qword [rbx + 0x20]
mov r9, qword [rsp + 0x38]
movzx eax, dil
mov r8d, reloc.WS2_32.dll_ntohs
xor ebp, ebp
and eax, 7
mov r14d, r8d
mov ecx, ebp
sub r14d, eax
mov byte [rbx], al
movsxd rax, r14d
cmp r14d, r8d
jae 0x1800d98d5
lea rdx, [rax + rbx]
sub r8d, r14d
nop word [rax + rax]
movzx eax, byte [rdx]
mov byte [rdx], bpl
inc rdx
or rcx, rax
shl rcx, 8
dec r8
jne 0x1800d98c0
movzx eax, byte [rbx + 0xf]
mov byte [rbx + 0xf], 1
or rcx, rax
cmp rcx, rsi
je 0x1800d98ed
or eax, 0xffffffff
jmp 0x1800d9a8c
lea rax, [rsi + 0xf]
or rax, 8
shr rax, 3
add qword [rbx + 0x20], rax
movabs rax, 0x2000000000000000
cmp qword [rbx + 0x20], rax
jbe 0x1800d9917
mov eax, 0xfffffffe
jmp 0x1800d9a8c
mov rdi, rsi
shr rdi, 4
test rdi, rdi
je 0x1800d99a0
lea rax, [rbx + 0x10]
mov r8, rdi
mov rdx, r15
mov qword [rsp + 0x28], rax
mov rcx, r13
mov qword [rsp + 0x20], rbx
call r12
shl rdi, 4
add r13, rdi
add r15, rdi
sub rsi, rdi
je 0x1800d9a3c
lea r9, [rbx + 8]
shr rdi, 4
mov rdx, rbp
lea r8, [r9 + 8]
neg r9
nop word [rax + rax]
movzx eax, byte [r8 - 1]
dec r8
movzx ecx, dil
add rdx, rax
lea rax, [r9 + r8]
shr rdi, 8
add rdx, rcx
mov byte [r8], dl
shr rdx, 8
test rax, rax
je 0x1800d99a0
test rdi, rdi
jne 0x1800d9970
test rdx, rdx
jne 0x1800d9970
test rsi, rsi
je 0x1800d9a3c
mov r8, r13
mov edx, ebp
lea rcx, [rbx + 0x10]
sub r8, rbx
nop word [rax + rax]
movzx eax, byte [r8 + rcx - 0x10]
inc edx
inc rcx
xor byte [rcx - 1], al
mov eax, edx
cmp rax, rsi
jb 0x1800d99c0
mov rdi, qword [rsp + 0x38]
mov r12, qword [rsp + 0x40]
lea rcx, [rbx + 0x10]
mov r8, rdi
mov rdx, rcx
call r12
lea rdx, [rsp + 0x48]
mov r8, rdi
mov rcx, rbx
call r12
test rsi, rsi
je 0x1800d9a46
lea rax, [rsp + 0x48]
lea rcx, [rsp + 0x48]
sub r13, rax
lea rax, [rsp + 0x48]
sub r15, rax
nop word [rax + rax]
movzx eax, byte [r13 + rcx]
inc ebp
inc rcx
xor al, byte [rcx - 1]
mov byte [r15 + rcx - 1], al
mov eax, ebp
cmp rax, rsi
jb 0x1800d9a20
jmp 0x1800d9a46
mov r12, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x38]
movsxd rax, r14d
cmp r14d, 0x10
jae 0x1800d9a63
mov r8d, reloc.WS2_32.dll_recv
lea rcx, [rax + rbx]
xor edx, edx
sub r8d, r14d
call fcn.1800b45b0
lea rdx, [rsp + 0x48]
mov r8, rdi
mov rcx, rbx
call r12
mov rax, qword [rsp + 0x48]
xor qword [rbx + 0x10], rax
mov rax, qword [rsp + 0x50]
xor qword [rbx + 0x18], rax
movzx eax, byte [rsp + 0x30]
mov byte [rbx], al
xor eax, eax
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.1800acfa0
add rsp, 0x68
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x1800d9ab0
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov eax, 0x68
call fcn.1800b9c10
sub rsp, rax
mov rax, qword [0x1802e4710]
xor rax, rsp
mov qword [rsp + 0x58], rax
movzx ebx, byte [rcx]
mov rax, qword [rcx + 0x28]
mov r13, qword [rsp + 0xd0]
mov r14, qword [rcx + 0x30]
mov rsi, r9
mov r10, r8
mov qword [rsp + 0x38], r8
mov r15, rdx
mov rdi, rcx
mov byte [rsp + 0x30], bl
mov qword [rsp + 0x40], rax
test bl, 0x40
jne 0x1800d9b19
lea rdx, [rcx + 0x10]
mov r8, r14
call rax
mov r10, qword [rsp + 0x38]
movzx eax, bl
mov r8d, reloc.WS2_32.dll_ntohs
xor ebp, ebp
and eax, 7
mov r12d, r8d
mov ecx, ebp
sub r12d, eax
mov byte [rdi], al
movsxd rax, r12d
cmp r12d, r8d
jae 0x1800d9b55
lea rdx, [rax + rdi]
sub r8d, r12d
movzx eax, byte [rdx]
mov byte [rdx], bpl
inc rdx
or rcx, rax
shl rcx, 8
dec r8
jne 0x1800d9b40
movzx eax, byte [rdi + 0xf]
mov byte [rdi + 0xf], 1
or rcx, rax
cmp rcx, rsi
je 0x1800d9b6d
or eax, 0xffffffff
jmp 0x1800d9caa
mov rbx, rsi
shr rbx, 4
test rbx, rbx
je 0x1800d9bf1
lea rax, [rdi + 0x10]
mov r9, r14
mov r8, rbx
mov qword [rsp + 0x28], rax
mov rdx, r10
mov rcx, r15
mov qword [rsp + 0x20], rdi
call r13
mov r13, qword [rsp + 0x38]
shl rbx, 4
add r13, rbx
add r15, rbx
sub rsi, rbx
je 0x1800d9c60
lea r9, [rdi + 8]
shr rbx, 4
mov rdx, rbp
lea r8, [r9 + 8]
neg r9
movzx eax, byte [r8 - 1]
dec r8
movzx ecx, bl
add rdx, rax
lea rax, [r9 + r8]
shr rbx, 8
add rdx, rcx
mov byte [r8], dl
shr rdx, 8
test rax, rax
je 0x1800d9bf6
test rbx, rbx
jne 0x1800d9bc0
test rdx, rdx
jne 0x1800d9bc0
jmp 0x1800d9bf6
mov r13, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x40]
test rsi, rsi
je 0x1800d9c65
lea rdx, [rsp + 0x48]
mov r8, r14
mov rcx, rdi
call rbx
test rsi, rsi
je 0x1800d9c52
lea rax, [rsp + 0x48]
mov r8, rdi
lea rdx, [rsp + 0x48]
sub r15, rax
lea rax, [rsp + 0x48]
sub r13, rax
lea rax, [rsp + 0x48]
sub r8, rax
movzx ecx, byte [r15 + rdx]
movzx eax, byte [rdx]
inc ebp
xor ecx, eax
mov eax, ebp
inc rdx
mov byte [r13 + rdx - 1], cl
xor byte [r8 + rdx + 0xf], cl
cmp rax, rsi
jb 0x1800d9c32
lea rcx, [rdi + 0x10]
mov r8, r14
mov rdx, rcx
call rbx
jmp 0x1800d9c65
mov rbx, qword [rsp + 0x40]
movsxd rax, r12d
cmp r12d, 0x10
jae 0x1800d9c82
mov r8d, reloc.WS2_32.dll_recv
lea rcx, [rax + rdi]
xor edx, edx
sub r8d, r12d
call fcn.1800b45b0
lea rdx, [rsp + 0x48]
mov r8, r14
mov rcx, rdi
call rbx
mov rax, qword [rsp + 0x48]
xor qword [rdi + 0x10], rax
mov rax, qword [rsp + 0x50]
xor qword [rdi + 0x18], rax
movzx eax, byte [rsp + 0x30]
mov byte [rdi], al
xor eax, eax
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.1800acfa0
add rsp, 0x68
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x1800da3e0
Capabilities:
Encode data using xor

Disassembly:
push rbp
push rsi
push r12
mov eax, 0x20
call fcn.1800b9c10
sub rsp, rax
mov r12, qword [rcx + 0x28]
mov rsi, rdx
mov rbp, rcx
cmp rdx, r12
ja 0x1800da415
shl rsi, 4
add rsi, qword [rcx + 0x58]
mov rax, rsi
add rsp, 0x20
pop r12
pop rsi
pop rbp
ret
mov rcx, qword [rcx + 0x30]
cmp rdx, rcx
jb 0x1800da45c
sub rdx, rcx
lea r8, str.cryptomodesocb128.c
mov r9d, WSAStartup
add rdx, 4
and rdx, 0xfffffffffffffffc
add rdx, rcx
mov rcx, qword [rbp + 0x58]
mov qword [rbp + 0x30], rdx
shl rdx, 4
call fcn.1800ca990
test rax, rax
jne 0x1800da458
add rsp, 0x20
pop r12
pop rsi
pop rbp
ret
mov qword [rbp + 0x58], rax
cmp r12, rsi
jae 0x1800da4d6
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x48], rdi
mov qword [rsp + 0x50], r13
mov qword [rsp + 0x58], r14
mov r14, r12
mov r13, rsi
sub r13, r12
shl r14, 4
add r12, r13
nop word [rax + rax]
mov rax, qword [rbp + 0x58]
mov edx, 1
movzx ebx, byte [r14 + rax]
lea rcx, [r14 + rax]
lea rdi, [rcx + 0x10]
shr bl, 7
neg bl
mov r8, rdi
and bl, 0x87
call fcn.1800da330
xor byte [rdi + 0xf], bl
add r14, 0x10
dec r13
jne 0x1800da490
mov r14, qword [rsp + 0x58]
mov r13, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x48]
mov rbx, qword [rsp + 0x40]
shl rsi, 4
mov qword [rbp + 0x28], r12
add rsi, qword [rbp + 0x58]
mov rax, rsi
add rsp, 0x20
pop r12
pop rsi
pop rbp
ret
Function at 0x1800daac0
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
mov eax, 0x60
call fcn.1800b9c10
sub rsp, rax
mov rax, qword [0x1802e4710]
xor rax, rsp
mov qword [rsp + 0x50], rax
mov rax, qword [rcx + 0x68]
mov rsi, r9
xor edi, edi
shr rsi, 4
mov rbp, r9
mov r12, r8
mov r14, rdx
mov rbx, rcx
lea r13, [rax + rsi]
test rsi, rsi
je 0x1800dab7b
cmp qword [rcx + 0x20], rdi
je 0x1800dab7b
mov rax, r13
mov edx, edi
shr rax, 1
je 0x1800dab28
nop dword [rax]
inc rdx
shr rax, 1
jne 0x1800dab20
call fcn.1800da3e0
test rax, rax
jne 0x1800dab39
xor eax, eax
jmp 0x1800dacfa
mov rdx, qword [rbx + 0x68]
mov r9, qword [rbx + 0x10]
lea rax, [rbx + 0xa0]
mov qword [rsp + 0x38], rax
mov rax, qword [rbx + 0x58]
inc rdx
mov qword [rsp + 0x30], rax
lea rcx, [rbx + 0x90]
mov r8, rsi
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x20], rdx
mov rdx, r12
mov rcx, r14
call qword [rbx + 0x20]
jmp 0x1800dac4e
lea rsi, [rax + 1]
cmp rsi, r13
ja 0x1800dac4e
nop dword [rax + rax]
mov rax, rsi
mov ecx, edi
test sil, 1
jne 0x1800daba9
nop dword [rax + rax]
shr rax, 1
inc ecx
test al, 1
je 0x1800daba0
mov edx, ecx
mov rcx, rbx
call fcn.1800da3e0
test rax, rax
je 0x1800dab32
mov rcx, qword [rax]
mov r8, qword [rbx + 0x10]
lea rdx, [rsp + 0x40]
xor qword [rbx + 0x90], rcx
mov rax, qword [rax + 8]
add r14, 0x10
xor qword [rbx + 0x98], rax
mov rcx, qword [r14 - 8]
mov rax, qword [r14 - 0x10]
xor qword [rbx + 0xa8], rcx
xor rcx, qword [rbx + 0x98]
xor qword [rbx + 0xa0], rax
xor rax, qword [rbx + 0x90]
mov qword [rsp + 0x48], rcx
lea rcx, [rsp + 0x40]
mov qword [rsp + 0x40], rax
call qword [rbx]
mov r11, qword [rsp + 0x40]
xor r11, qword [rbx + 0x90]
mov rax, qword [rsp + 0x48]
inc rsi
xor rax, qword [rbx + 0x98]
mov qword [r12], r11
add r12, 0x10
mov qword [r12 - 8], rax
mov qword [rsp + 0x40], r11
mov qword [rsp + 0x48], rax
cmp rsi, r13
jbe 0x1800dab90
and ebp, 0xf
jbe 0x1800dacf1
mov rax, qword [rbx + 0x38]
mov r8, qword [rbx + 0x10]
lea rcx, [rbx + 0x90]
xor qword [rcx], rax
mov rax, qword [rbx + 0x40]
lea rdx, [rsp + 0x40]
xor qword [rbx + 0x98], rax
call qword [rbx]
test rbp, rbp
je 0x1800dacb8
lea rax, [rsp + 0x40]
mov r8, r14
sub r8, rax
lea rax, [rsp + 0x40]
sub r12, rax
nop word [rax + rax]
lea rcx, [rsp + rdi + 0x40]
inc rdi
movzx eax, byte [r8 + rcx]
xor al, byte [rcx]
mov byte [r12 + rcx], al
cmp rdi, rbp
jb 0x1800daca0
xor eax, eax
lea rcx, [rsp + 0x40]
mov r8, rbp
mov rdx, r14
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x48], rax
call fcn.1800acfd0
mov byte [rsp + rbp + 0x40], 0x80
mov rax, qword [rsp + 0x40]
xor qword [rbx + 0xa0], rax
mov rax, qword [rsp + 0x48]
xor qword [rbx + 0xa8], rax
mov qword [rbx + 0x68], r13
mov eax, 1
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.1800acfa0
add rsp, 0x60
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x1800dad20
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
mov eax, 0x60
call fcn.1800b9c10
sub rsp, rax
mov rax, qword [0x1802e4710]
xor rax, rsp
mov qword [rsp + 0x50], rax
mov rax, qword [rcx + 0x68]
mov rsi, r9
xor edi, edi
shr rsi, 4
mov rbp, r9
mov r14, r8
mov r12, rdx
mov rbx, rcx
lea r13, [rax + rsi]
test rsi, rsi
je 0x1800daddb
cmp qword [rcx + 0x20], rdi
je 0x1800daddb
mov rax, r13
mov edx, edi
shr rax, 1
je 0x1800dad88
nop dword [rax]
inc rdx
shr rax, 1
jne 0x1800dad80
call fcn.1800da3e0
test rax, rax
jne 0x1800dad99
xor eax, eax
jmp 0x1800daf5a
mov rdx, qword [rbx + 0x68]
mov r9, qword [rbx + 0x18]
lea rax, [rbx + 0xa0]
mov qword [rsp + 0x38], rax
mov rax, qword [rbx + 0x58]
inc rdx
mov qword [rsp + 0x30], rax
lea rcx, [rbx + 0x90]
mov r8, rsi
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x20], rdx
mov rdx, r14
mov rcx, r12
call qword [rbx + 0x20]
jmp 0x1800daeaf
lea rsi, [rax + 1]
cmp rsi, r13
ja 0x1800daeaf
nop dword [rax + rax]
mov rax, rsi
mov ecx, edi
test sil, 1
jne 0x1800dae09
nop dword [rax + rax]
shr rax, 1
inc ecx
test al, 1
je 0x1800dae00
mov edx, ecx
mov rcx, rbx
call fcn.1800da3e0
test rax, rax
je 0x1800dad92
mov rcx, qword [rax]
mov r8, qword [rbx + 0x18]
lea rdx, [rsp + 0x40]
xor qword [rbx + 0x90], rcx
mov rax, qword [rax + 8]
add r12, 0x10
xor qword [rbx + 0x98], rax
mov rcx, qword [r12 - 8]
mov rax, qword [r12 - 0x10]
xor rcx, qword [rbx + 0x98]
xor rax, qword [rbx + 0x90]
mov qword [rsp + 0x48], rcx
lea rcx, [rsp + 0x40]
mov qword [rsp + 0x40], rax
call qword [rbx + reloc.WS2_32.dll_htonl]
mov r11, qword [rsp + 0x40]
mov rax, qword [rsp + 0x48]
xor r11, qword [rbx + 0x90]
xor rax, qword [rbx + 0x98]
inc rsi
xor qword [rbx + 0xa0], r11
xor qword [rbx + 0xa8], rax
mov qword [r14], r11
mov qword [r14 + 8], rax
add r14, 0x10
mov qword [rsp + 0x40], r11
mov qword [rsp + 0x48], rax
cmp rsi, r13
jbe 0x1800dadf0
and ebp, 0xf
jbe 0x1800daf51
mov rax, qword [rbx + 0x38]
mov r8, qword [rbx + 0x10]
lea rcx, [rbx + 0x90]
xor qword [rcx], rax
mov rax, qword [rbx + 0x40]
lea rdx, [rsp + 0x40]
xor qword [rbx + 0x98], rax
call qword [rbx]
test rbp, rbp
je 0x1800daf18
lea rax, [rsp + 0x40]
mov r8, r14
sub r12, rax
lea rax, [rsp + 0x40]
sub r8, rax
nop word [rax + rax]
lea rcx, [rsp + rdi + 0x40]
inc rdi
movzx eax, byte [r12 + rcx]
xor al, byte [rcx]
mov byte [r8 + rcx], al
cmp rdi, rbp
jb 0x1800daf00
xor eax, eax
lea rcx, [rsp + 0x40]
mov r8, rbp
mov rdx, r14
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x48], rax
call fcn.1800acfd0
mov byte [rsp + rbp + 0x40], 0x80
mov rax, qword [rsp + 0x40]
xor qword [rbx + 0xa0], rax
mov rax, qword [rsp + 0x48]
xor qword [rbx + 0xa8], rax
mov qword [rbx + 0x68], r13
mov eax, 1
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.1800acfa0
add rsp, 0x60
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x1800e37d0
Capabilities:
Encode data using xor

Disassembly:
push rdi
movsxd rdi, r9d
mov r10, r8
mov r11, rdx
cmp rdx, r8
je 0x1800e3884
movsxd rdx, dword [rdx + 8]
mov qword [rsp + 0x10], rbx
lea rbx, [rcx - 1]
not rcx
shr rbx, 0x3f
xor r9d, r9d
shr rcx, 0x3f
and rbx, rcx
movsxd rcx, dword [r8 + 8]
xor rcx, rdx
dec rbx
and rcx, rbx
xor edx, ecx
mov dword [r11 + 8], edx
xor dword [r8 + 8], ecx
movsxd rdx, dword [r11 + 0x10]
movsxd rcx, dword [r8 + 0x10]
xor rcx, rdx
and rcx, rbx
xor edx, ecx
mov dword [r11 + 0x10], edx
xor dword [r8 + 0x10], ecx
mov ecx, dword [r11 + 0x14]
mov eax, dword [r8 + 0x14]
xor rax, rcx
and eax, 4
and rax, rbx
xor ecx, eax
mov dword [r11 + 0x14], ecx
xor dword [r8 + 0x14], eax
test rdi, rdi
jle 0x1800e387f
mov rax, qword [r10]
mov r8, qword [r11]
inc r9
mov rcx, qword [r8 + r9*8 - 8]
mov rdx, qword [rax + r9*8 - 8]
xor rdx, rcx
and rdx, rbx
xor rcx, rdx
mov qword [r8 + r9*8 - 8], rcx
mov rax, qword [r10]
xor qword [rax + r9*8 - 8], rdx
cmp r9, rdi
jl 0x1800e3851
mov rbx, qword [rsp + 0x10]
pop rdi
ret
Function at 0x1800e3e40
Capabilities:
Encode data using xor

Disassembly:
mov dword [rsp + 0x18], r8d
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
mov eax, 0x40
call fcn.1800b9c10
sub rsp, rax
mov eax, dword [rcx + 8]
mov r12d, r9d
xor r9d, r9d
test byte [rcx + 0x14], 4
mov ebx, r8d
mov r14, rdx
lea ebp, [rax - 1]
mov rdi, rcx
mov dword [rsp + 0x80], r9d
mov r13d, r9d
mov esi, r9d
je 0x1800e3e8f
call fcn.1800e3360
mov r11d, eax
jmp 0x1800e3eaf
test eax, eax
jne 0x1800e3e98
mov r11d, r9d
jmp 0x1800e3eb2
mov rcx, qword [rcx]
movsxd rax, ebp
mov rcx, qword [rcx + rax*8]
call fcn.1800e3280
shl ebp, 6
lea r11d, [rbp + rax]
xor r9d, r9d
lea eax, [r11 + 7]
cdq
and edx, 7
add eax, edx
sar eax, 3
cmp dword [rsp + 0xa0], esi
jne 0x1800e3efb
mov r13d, dword [rdi + 0x10]
mov ecx, r13d
neg ecx
lea ecx, [rax*8]
sbb r8d, r8d
movzx r8d, r8b
mov dword [rsp + 0x80], r8d
cmp ecx, r11d
jne 0x1800e3ef8
test r13d, r13d
mov esi, r9d
sete sil
jmp 0x1800e3efb
mov esi, r13d
cmp ebx, 0xffffffff
jne 0x1800e3f35
lea ebx, [rax + rsi]
mov dword [rsp + 0x90], ebx
mov eax, dword [rdi + 0xc]
shl eax, 3
movsxd r8, eax
test eax, eax
jne 0x1800e3fe2
test ebx, ebx
je 0x1800e40a3
movsxd r8, ebx
xor edx, edx
mov rcx, r14
call fcn.1800b45b0
jmp 0x1800e40a3
add eax, esi
cmp ebx, eax
jge 0x1800e3f0a
mov rax, qword [rdi + 8]
mov r8, qword [rdi]
mov qword [rsp + 0x28], rax
movsxd rcx, dword [rsp + 0x28]
mov rax, qword [rdi + 0x10]
mov qword [rsp + 0x20], r8
mov qword [rsp + 0x30], rax
test ecx, ecx
jle 0x1800e3f76
lea rdx, [r8 + rcx*8]
sub rdx, 8
cmp qword [rdx], 0
jne 0x1800e3f72
dec ecx
test ecx, ecx
jg 0x1800e3f62
mov dword [rsp + 0x28], ecx
mov eax, dword [rsp + 0x30]
test ecx, ecx
lea r11d, [rcx - 1]
cmove eax, r9d
test byte [rsp + 0x34], 4
mov dword [rsp + 0x30], eax
je 0x1800e3f9b
lea rcx, [rsp + 0x20]
call fcn.1800e3360
jmp 0x1800e3fb7
test ecx, ecx
jne 0x1800e3fa4
mov eax, r9d
jmp 0x1800e3fba
movsxd rcx, r11d
mov rcx, qword [r8 + rcx*8]
call fcn.1800e3280
shl r11d, 6
add eax, r11d
xor r9d, r9d
add eax, 7
cdq
and edx, 7
add eax, edx
sar eax, 3
add eax, esi
cmp ebx, eax
jge 0x1800e3f0a
or eax, 0xffffffff
add rsp, 0x40
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
mov qword [rsp + 0x88], r15
test r12d, r12d
je 0x1800e4004
dec r12d
jne 0x1800e3ffb
lea edx, [r12 + 1]
jmp 0x1800e4010
mov edx, dword [rsp + 0x90]
jmp 0x1800e4010
lea eax, [rbx - 1]
or edx, 0xffffffff
movsxd rcx, eax
add r14, rcx
mov eax, dword [rdi + 8]
lea r15, [r8 - 1]
mov r11, r9
shl eax, 3
mov rbp, r9
movsxd rsi, ebx
movsxd r10, eax
test ebx, ebx
je 0x1800e409b
mov ebx, dword [rsp + 0x80]
movsxd r12, edx
neg r10
nop word [rax + rax]
mov rdx, qword [rdi]
mov r8, r11
movzx ecx, r11b
shr r8, 3
and cl, 7
lea rax, [r10 + rbp]
mov r9, qword [rdx + r8*8]
shr rax, 0x3f
shl cl, 3
neg al
shr r9, cl
and r9b, al
xor r9b, bl
lea eax, [r9 + r13]
xor r13d, r13d
cmp r9b, al
mov byte [r14], al
mov rax, r11
seta r13b
sub rax, r15
inc rbp
shr rax, 0x3f
add r14, r12
add r11, rax
cmp rbp, rsi
jb 0x1800e4040
mov ebx, dword [rsp + 0x90]
mov r15, qword [rsp + 0x88]
mov eax, ebx
add rsp, 0x40
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x1800e47d0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rdi
push r13
mov eax, 0x20
call fcn.1800b9c10
sub rsp, rax
xor ebp, ebp
mov rdi, r8
movsxd rbx, edx
mov r13, rcx
test r8, r8
jne 0x1800e4814
call fcn.1800e3450
mov rbp, rax
mov rdi, rax
test rax, rax
jne 0x1800e4814
mov rbx, qword [rsp + 0x58]
add rsp, 0x20
pop r13
pop rdi
pop rbp
ret
mov qword [rsp + 0x48], r12
mov qword [rsp + 0x50], r14
movzx r14d, byte [rbx + r13 - 1]
shr r14d, 7
lea rcx, [rbx + r13 - 1]
mov eax, r14d
neg eax
sbb r12d, r12d
movzx r12d, r12b
test ebx, ebx
jle 0x1800e4851
nop dword [rax]
movzx eax, byte [rcx]
cmp eax, r12d
jne 0x1800e4851
dec ebx
dec rcx
test ebx, ebx
jg 0x1800e4840
cmp r12d, 0xff
jne 0x1800e4865
test ebx, ebx
je 0x1800e4863
test byte [rcx], 0x80
jne 0x1800e4865
inc ebx
test ebx, ebx
jne 0x1800e4874
mov dword [rdi + 8], ebx
mov rax, rdi
jmp 0x1800e4958
mov qword [rsp + 0x40], rsi
lea eax, [rbx - 1]
cdq
and edx, 7
lea esi, [rdx + rax]
sar esi, 3
inc esi
cmp esi, dword [rdi + 0xc]
jg 0x1800e4892
mov rax, rdi
jmp 0x1800e489c
mov edx, esi
mov rcx, rdi
call fcn.1800e3db0
test rax, rax
jne 0x1800e48b0
mov rcx, rbp
call fcn.1800e3c00
xor eax, eax
jmp 0x1800e4953
mov dword [rdi + 8], esi
mov dword [rdi + 0x10], r14d
test esi, esi
je 0x1800e4918
xor r10d, r10d
nop
dec esi
xor r9d, r9d
xor r8d, r8d
test ebx, ebx
jle 0x1800e4908
nop dword [rax]
cmp r8d, 0x40
jae 0x1800e4908
movzx eax, byte [r13]
mov rcx, r12
xor rcx, rax
lea rax, [rcx + r14]
xor r14d, r14d
movzx edx, al
cmp rcx, rdx
mov ecx, r8d
seta r14b
shl rdx, cl
dec ebx
or r9, rdx
inc r13
add r8d, 8
test ebx, ebx
jg 0x1800e48d0
mov rax, qword [rdi]
add r10, 8
mov qword [r10 + rax - 8], r9
test esi, esi
jne 0x1800e48c0
movsxd rdx, dword [rdi + 8]
test edx, edx
jle 0x1800e4943
mov rax, qword [rdi]
lea r8, [rax + rdx*8]
nop word [rax + rax]
sub r8, 8
cmp qword [r8], 0
jne 0x1800e4940
dec edx
test edx, edx
jg 0x1800e4930
mov dword [rdi + 8], edx
cmp dword [rdi + 8], 0
jne 0x1800e4950
mov dword [rdi + 0x10], 0
mov rax, rdi
mov rsi, qword [rsp + 0x40]
mov r12, qword [rsp + 0x48]
mov r14, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x58]
add rsp, 0x20
pop r13
pop rdi
pop rbp
ret
mov eax, 0x28
call fcn.1800b9c10
sub rsp, rax
add rsp, 0x28
jmp 0x1800e47d0
Function at 0x1800e4990
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rdi
push r13
mov eax, 0x20
call fcn.1800b9c10
sub rsp, rax
xor ebp, ebp
mov rdi, r8
movsxd rbx, edx
mov r13, rcx
test r8, r8
jne 0x1800e4814
call fcn.1800e3450
mov rbp, rax
mov rdi, rax
test rax, rax
jne 0x1800e4814
mov rbx, qword [rsp + 0x58]
add rsp, 0x20
pop r13
pop rdi
pop rbp
ret
mov qword [rsp + 0x48], r12
mov qword [rsp + 0x50], r14
movzx r14d, byte [rbx + r13 - 1]
shr r14d, 7
lea rcx, [rbx + r13 - 1]
mov eax, r14d
neg eax
sbb r12d, r12d
movzx r12d, r12b
test ebx, ebx
jle 0x1800e4851
nop dword [rax]
movzx eax, byte [rcx]
cmp eax, r12d
jne 0x1800e4851
dec ebx
dec rcx
test ebx, ebx
jg 0x1800e4840
cmp r12d, 0xff
jne 0x1800e4865
test ebx, ebx
je 0x1800e4863
test byte [rcx], 0x80
jne 0x1800e4865
inc ebx
test ebx, ebx
jne 0x1800e4874
mov dword [rdi + 8], ebx
mov rax, rdi
jmp 0x1800e4958
mov qword [rsp + 0x40], rsi
lea eax, [rbx - 1]
cdq
and edx, 7
lea esi, [rdx + rax]
sar esi, 3
inc esi
cmp esi, dword [rdi + 0xc]
jg 0x1800e4892
mov rax, rdi
jmp 0x1800e489c
mov edx, esi
mov rcx, rdi
call fcn.1800e3db0
test rax, rax
jne 0x1800e48b0
mov rcx, rbp
call fcn.1800e3c00
xor eax, eax
jmp 0x1800e4953
mov dword [rdi + 8], esi
mov dword [rdi + 0x10], r14d
test esi, esi
je 0x1800e4918
xor r10d, r10d
nop
dec esi
xor r9d, r9d
xor r8d, r8d
test ebx, ebx
jle 0x1800e4908
nop dword [rax]
cmp r8d, 0x40
jae 0x1800e4908
movzx eax, byte [r13]
mov rcx, r12
xor rcx, rax
lea rax, [rcx + r14]
xor r14d, r14d
movzx edx, al
cmp rcx, rdx
mov ecx, r8d
seta r14b
shl rdx, cl
dec ebx
or r9, rdx
inc r13
add r8d, 8
test ebx, ebx
jg 0x1800e48d0
mov rax, qword [rdi]
add r10, 8
mov qword [r10 + rax - 8], r9
test esi, esi
jne 0x1800e48c0
movsxd rdx, dword [rdi + 8]
test edx, edx
jle 0x1800e4943
mov rax, qword [rdi]
lea r8, [rax + rdx*8]
nop word [rax + rax]
sub r8, 8
cmp qword [r8], 0
jne 0x1800e4940
dec edx
test edx, edx
jg 0x1800e4930
mov dword [rdi + 8], edx
cmp dword [rdi + 8], 0
jne 0x1800e4950
mov dword [rdi + 0x10], 0
mov rax, rdi
mov rsi, qword [rsp + 0x40]
mov r12, qword [rsp + 0x48]
mov r14, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x58]
add rsp, 0x20
pop r13
pop rdi
pop rbp
ret
mov eax, 0x28
call fcn.1800b9c10
sub rsp, rax
add rsp, 0x28
jmp 0x1800e47d0
Function at 0x1800e9f70
Capabilities:
Generate random numbers via winapi

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r12
mov eax, gethostbyaddr
call fcn.1800b9c10
sub rsp, rax
lea edx, [rax - 0x2f]
xor esi, esi
mov rdi, rcx
mov ebx, esi
call fcn.1800ec740
mov rcx, rdi
mov rdx, rax
mov rbp, rax
call fcn.1800ec990
mov r12, rax
test rax, rax
je 0x1800ea01a
lea r9d, [rsi + 1]
lea rcx, [rsp + 0x58]
xor r8d, r8d
xor edx, edx
mov dword [rsp + 0x20], 0xf0000040
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
je 0x1800e9ff3
mov rcx, qword [rsp + 0x58]
mov r8, r12
mov edx, ebp
call qword [sym.imp.ADVAPI32.dll_CryptGenRandom]
mov rcx, qword [rsp + 0x58]
test eax, eax
cmovne rbx, rbp
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
lea r8, [rbx*8]
mov rdx, rbx
mov rcx, rdi
call fcn.1800eca40
mov rcx, rdi
call fcn.1800ec590
mov rbx, rax
test rax, rax
jne 0x1800ea0b6
mov edx, 1
mov rcx, rdi
call fcn.1800ec740
mov rcx, rdi
mov rdx, rax
mov rbp, rax
call fcn.1800ec990
mov r12, rax
test rax, rax
je 0x1800ea0a4
lea r8, str.Intel_Hardware_Cryptographic_Service_Provider
lea rcx, [rsp + 0x58]
mov r9d, reloc.WS2_32.dll_shutdown
xor edx, edx
mov dword [rsp + 0x20], 0xf0000040
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
je 0x1800ea086
mov rcx, qword [rsp + 0x58]
mov r8, r12
mov edx, ebp
call qword [sym.imp.ADVAPI32.dll_CryptGenRandom]
mov rcx, qword [rsp + 0x58]
test eax, eax
cmovne rsi, rbp
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
lea r8, [rsi*8]
mov rdx, rsi
mov rcx, rdi
call fcn.1800eca40
mov rcx, rdi
call fcn.1800ec590
mov rbx, rax
test rbx, rbx
je 0x1800ea0ae
mov rax, rbx
jmp 0x1800ea0b6
mov rcx, rdi
call fcn.1800ec590
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x60]
add rsp, 0x30
pop r12
pop rdi
pop rsi
ret

Function at 0x1800ecf10
Capabilities:
Encode data using add xor sub operations

Disassembly:
mov eax, 8
call fcn.1800b9c10
sub rsp, rax
xor r10d, r10d
mov r11, rcx
test rcx, rcx
je 0x1800ecf9b
movzx eax, byte [rcx]
test al, al
je 0x1800ecf9b
mov qword [rsp], rbx
mov ebx, 0x100
nop dword [rax + rax]
movsx r9d, al
mov edx, r10d
mov eax, r10d
or r9d, ebx
inc r11
mov ecx, 0x20
mov r8d, r9d
add ebx, 0x100
shr r8d, 2
xor r8d, r9d
and r8d, 0xf
sub ecx, r8d
shr rdx, cl
mov ecx, r8d
imul r9d, r9d
shl eax, cl
mov r10d, edx
or r10d, eax
movzx eax, byte [r11]
xor r10d, r9d
test al, al
jne 0x1800ecf40
mov rbx, qword [rsp]
mov eax, r10d
shr eax, 0x10
xor eax, r10d
add rsp, 8
ret
xor eax, eax
add rsp, 8
ret