joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1800bbcc4
Capabilities:
Link many functions at runtime

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x50
mov rax, qword [0x1802e4710]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov ebp, r8d
mov r14, rdx
mov r13, rcx
call fcn.1800b52b4
xor ebx, ebx
cmp qword [0x1802ee810], rbx
mov rdi, rax
jne 0x1800bbdd7
lea rcx, str.USER32.DLL
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov rsi, rax
test rax, rax
je 0x1800bbeae
lea rdx, [0x18021a3d8]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x1800bbeae
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EncodePointer]
lea rdx, str.GetActiveWindow
mov rcx, rsi
mov qword [0x1802ee810], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EncodePointer]
lea rdx, str.GetLastActivePopup
mov rcx, rsi
mov qword [0x1802ee818], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EncodePointer]
lea rdx, [0x18021a390]
mov rcx, rsi
mov qword [0x1802ee820], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EncodePointer]
mov r11, rax
mov qword [0x1802ee830], rax
test rax, rax
je 0x1800bbdce
lea rdx, [0x18021a378]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EncodePointer]
mov qword [0x1802ee828], rax
jmp 0x1800bbdde
mov rax, qword [0x1802ee828]
jmp 0x1800bbde5
mov rax, qword [0x1802ee828]
mov r11, qword [0x1802ee830]
cmp rax, rdi
je 0x1800bbe4c
cmp r11, rdi
je 0x1800bbe4c
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_DecodePointer]
mov rcx, qword [0x1802ee830]
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_DecodePointer]
mov r12, rax
test rsi, rsi
je 0x1800bbe4c
test rax, rax
je 0x1800bbe4c
call rsi
test rax, rax
je 0x1800bbe46
lea rcx, [rsp + 0x30]
mov r9d, reloc.WS2_32.dll_inet_ntoa
lea r8, [rsp + 0x38]
mov qword [rsp + 0x20], rcx
lea edx, [r9 - 0xb]
mov rcx, rax
call r12
test eax, eax
je 0x1800bbe46
test byte [rsp + 0x40], 1
jne 0x1800bbe4c
bts ebp, 0x15
jmp 0x1800bbe8c
mov rcx, qword [0x1802ee818]
cmp rcx, rdi
je 0x1800bbe8c
call qword [sym.imp.KERNEL32.dll_DecodePointer]
test rax, rax
je 0x1800bbe8c
call rax
mov rbx, rax
test rax, rax
je 0x1800bbe8c
mov rcx, qword [0x1802ee820]
cmp rcx, rdi
je 0x1800bbe8c
call qword [sym.imp.KERNEL32.dll_DecodePointer]
test rax, rax
je 0x1800bbe8c
mov rcx, rbx
call rax
mov rbx, rax
mov rcx, qword [0x1802ee810]
call qword [sym.imp.KERNEL32.dll_DecodePointer]
test rax, rax
je 0x1800bbeae
mov r9d, ebp
mov r8, r14
mov rdx, r13
mov rcx, rbx
call rax
jmp 0x1800bbeb0
xor eax, eax
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.1800acfa0
add rsp, 0x50
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret

Function at 0x1800c1b80
Capabilities:
Hash data with md5

Disassembly:
push rbx
mov eax, 0x20
call fcn.1800b9c10
sub rsp, rax
lea r8d, [rax + 0x3c]
xor edx, edx
mov rbx, rcx
call fcn.1800b45b0
mov dword [rbx], 0x67452301
mov dword [rbx + 4], 0xefcdab89
mov dword [rbx + 8], 0x98badcfe
mov dword [rbx + 0xc], 0x10325476
mov eax, 1
add rsp, 0x20
pop rbx
ret
Function at 0x1800c56a0
Capabilities:
Hash data using sha224

Disassembly:
push rbx
mov eax, 0x20
call fcn.1800b9c10
sub rsp, rax
lea r8d, [rax + 0x50]
xor edx, edx
mov rbx, rcx
call fcn.1800b45b0
mov dword [rbx], 0xc1059ed8
mov dword [rbx + 4], 0x367cd507
mov dword [rbx + 8], 0x3070dd17
mov dword [rbx + 0xc], 0xf70e5939
mov dword [rbx + 0x10], 0xffc00b31
mov dword [rbx + 0x14], 0x68581511
mov dword [rbx + 0x18], 0x64f98fa7
mov dword [rbx + 0x1c], 0xbefa4fa4
mov dword [rbx + 0x6c], 0x1c
mov eax, 1
add rsp, 0x20
pop rbx
ret

Function at 0x1800c5710
Capabilities:
Hash data using sha256

Disassembly:
push rbx
mov eax, 0x20
call fcn.1800b9c10
sub rsp, rax
lea r8d, [rax + 0x50]
xor edx, edx
mov rbx, rcx
call fcn.1800b45b0
mov dword [rbx], 0x6a09e667
mov dword [rbx + 4], 0xbb67ae85
mov dword [rbx + 8], 0x3c6ef372
mov dword [rbx + 0xc], 0xa54ff53a
mov dword [rbx + 0x10], 0x510e527f
mov dword [rbx + 0x14], 0x9b05688c
mov dword [rbx + 0x18], 0x1f83d9ab
mov dword [rbx + 0x1c], 0x5be0cd19
mov dword [rbx + 0x6c], 0x20
mov eax, 1
add rsp, 0x20
pop rbx
ret
Function at 0x1800c99f0
Capabilities:
Encode data using xor

Disassembly:
push rbx
mov eax, 0x20
call fcn.1800b9c10
sub rsp, rax
mov rbx, r8
call fcn.1800c9400
test eax, eax
js 0x1800c9c2e
mov eax, dword [rbx + 0xf0]
xor r10d, r10d
shl eax, 2
movsxd r9, eax
test eax, eax
jle 0x1800c9a79
lea rdx, [rbx + r9*4 + 8]
lea r8, [rbx + 8]
nop dword [rax + rax]
mov eax, dword [rdx - 8]
mov ecx, dword [r8 - 8]
add r10, 4
mov dword [r8 - 8], eax
mov eax, dword [rdx - 4]
mov dword [rdx - 8], ecx
mov ecx, dword [r8 - 4]
mov dword [r8 - 4], eax
mov eax, dword [rdx]
mov dword [rdx - 4], ecx
mov ecx, dword [r8]
mov dword [r8], eax
mov eax, dword [rdx + 4]
mov dword [rdx], ecx
mov ecx, dword [r8 + 4]
mov dword [r8 + 4], eax
sub r9, 4
mov dword [rdx + 4], ecx
sub rdx, 0x10
add r8, 0x10
cmp r10, r9
jl 0x1800c9a30
mov r11d, 1
cmp dword [rbx + 0xf0], r11d
jle 0x1800c9c2c
mov qword [rsp + 0x30], rdi
lea r10, [rbx + 2]
lea rdi, [0x180000000]
nop dword [rax]
mov r8d, dword [r10 + 0xe]
add r10, 0x10
inc r11d
mov eax, r8d
shr rax, 0x18
movzx edx, byte [rdi + rax*4 + 0x21db40]
movzx eax, byte [r10 - 1]
movzx ecx, byte [rdi + rax*4 + 0x21db40]
mov r9d, dword [rdi + rdx*4 + 0x21e740]
movzx eax, r8b
xor r9d, dword [rdi + rcx*4 + 0x21ef40]
movzx ecx, byte [rdi + rax*4 + 0x21db40]
movzx eax, byte [r10]
xor r9d, dword [rdi + rcx*4 + 0x21f340]
movzx ecx, byte [rdi + rax*4 + 0x21db40]
xor r9d, dword [rdi + rcx*4 + 0x21eb40]
mov dword [r10 - 2], r9d
mov r9d, dword [r10 + 2]
mov eax, r9d
shr rax, 0x18
movzx edx, byte [rdi + rax*4 + 0x21db40]
movzx eax, byte [r10 + 3]
movzx ecx, byte [rdi + rax*4 + 0x21db40]
mov r8d, dword [rdi + rdx*4 + 0x21e740]
movzx eax, byte [r10 + 4]
xor r8d, dword [rdi + rcx*4 + 0x21ef40]
movzx ecx, byte [rdi + rax*4 + 0x21db40]
movzx eax, r9b
xor r8d, dword [rdi + rcx*4 + 0x21eb40]
movzx ecx, byte [rdi + rax*4 + 0x21db40]
mov r9d, dword [r10 + 6]
xor r8d, dword [rdi + rcx*4 + 0x21f340]
mov eax, r9d
mov dword [r10 + 2], r8d
shr rax, 0x18
movzx edx, byte [rdi + rax*4 + 0x21db40]
movzx eax, byte [r10 + 7]
movzx ecx, byte [rdi + rax*4 + 0x21db40]
mov r8d, dword [rdi + rdx*4 + 0x21e740]
movzx eax, byte [r10 + 8]
xor r8d, dword [rdi + rcx*4 + 0x21ef40]
movzx ecx, byte [rdi + rax*4 + 0x21db40]
movzx eax, r9b
xor r8d, dword [rdi + rcx*4 + 0x21eb40]
movzx ecx, byte [rdi + rax*4 + 0x21db40]
movzx eax, byte [r10 + 0xb]
xor r8d, dword [rdi + rcx*4 + 0x21f340]
mov r9d, dword [r10 + 0xa]
mov dword [r10 + 6], r8d
movzx edx, byte [rdi + rax*4 + 0x21db40]
movzx eax, byte [r10 + 0xc]
movzx ecx, byte [rdi + rax*4 + 0x21db40]
mov r8d, dword [rdi + rdx*4 + 0x21ef40]
mov eax, r9d
xor r8d, dword [rdi + rcx*4 + 0x21eb40]
shr rax, 0x18
movzx ecx, byte [rdi + rax*4 + 0x21db40]
movzx eax, r9b
xor r8d, dword [rdi + rcx*4 + 0x21e740]
movzx ecx, byte [rdi + rax*4 + 0x21db40]
xor r8d, dword [rdi + rcx*4 + 0x21f340]
mov dword [r10 + 0xa], r8d
cmp r11d, dword [rbx + 0xf0]
jl 0x1800c9aa0
mov rdi, qword [rsp + 0x30]
xor eax, eax
add rsp, 0x20
pop rbx
ret
Function at 0x1800d2fc0
Capabilities:
Allocate thread local storage

Disassembly:
push rbx
mov eax, 0x20
call fcn.1800b9c10
sub rsp, rax
mov rbx, rcx
call qword [sym.imp.KERNEL32.dll_TlsAlloc]
xor ecx, ecx
cmp eax, 0xffffffff
mov dword [rbx], eax
setne cl
mov eax, ecx
add rsp, 0x20
pop rbx
ret

Function at 0x1800d3030
Capabilities:
Set thread local storage value

Disassembly:
mov eax, 0x28
call fcn.1800b9c10
sub rsp, rax
mov ecx, dword [rcx]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
xor ecx, ecx
test eax, eax
setne cl
mov eax, ecx
add rsp, 0x28
ret

Function at 0x1800d63d0
Capabilities:
Encode data using xor

Disassembly:
test r8, r8
je 0x1800d6532
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rdi
push r13
push r14
mov eax, 0x20
call fcn.1800b9c10
sub rsp, rax
mov r14, qword [rsp + 0x60]
mov qword [rsp + 0x48], r12
mov r12, qword [rsp + 0x68]
mov r10, r14
mov r13, r9
mov rdi, r8
mov rbx, rdx
mov rbp, rcx
cmp r8, 0x10
jb 0x1800d6478
mov qword [rsp + 0x40], rsi
mov rsi, r8
shr rsi, 4
mov rax, rsi
imul rax, rax, 0xfffffffffffffff0
add rdi, rax
nop
mov r8, rbx
sub r10, rbp
mov rcx, rbp
sub r8, rbp
mov edx, 2
mov rax, qword [r10 + rcx]
add rcx, 8
xor rax, qword [rcx - 8]
dec rdx
mov qword [r8 + rcx - 8], rax
jne 0x1800d6441
mov r8, r13
mov rdx, rbx
mov rcx, rbx
call r12
mov r10, rbx
add rbx, 0x10
add rbp, 0x10
dec rsi
jne 0x1800d6430
mov rsi, qword [rsp + 0x40]
test rdi, rdi
je 0x1800d6507
mov rdx, r10
mov r9, rbx
xor r8d, r8d
sub rdx, rbp
sub r9, rbp
mov rcx, rbp
cmp r8, rdi
jae 0x1800d64b2
movzx eax, byte [rdx + rcx]
inc r8
inc rcx
xor al, byte [rcx - 1]
mov byte [r9 + rcx - 1], al
cmp r8, 0x10
jb 0x1800d6493
jmp 0x1800d64e0
cmp r8, 0x10
jae 0x1800d64e0
mov edx, reloc.WS2_32.dll_recv
sub r10, rbx
lea rcx, [r8 + rbx]
sub rdx, r8
nop word [rax + rax]
movzx eax, byte [r10 + rcx]
inc rcx
dec rdx
mov byte [rcx - 1], al
jne 0x1800d64d0
mov r8, r13
mov rdx, rbx
mov rcx, rbx
call r12
mov r10, rbx
cmp rdi, 0x10
jbe 0x1800d6507
add rbx, 0x10
add rbp, 0x10
sub rdi, 0x10
jne 0x1800d6481
mov r12, qword [rsp + 0x48]
cmp r14, r10
je 0x1800d651f
mov rax, qword [r10]
mov qword [r14], rax
mov rax, qword [r10 + 8]
mov qword [r14 + 8], rax
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
add rsp, 0x20
pop r14
pop r13
pop rdi
repz ret
Function at 0x1800d6549
Capabilities:
Encode data using xor

Disassembly:
test r8, r8
je 0x1800d6746
push rbx
push rsi
push rdi
push r13
push r14
push r15
mov eax, 0x48
call fcn.1800b9c10
sub rsp, rax
mov rax, qword [0x1802e4710]
xor rax, rsp
mov qword [rsp + 0x30], rax
mov r13, qword [rsp + 0xa0]
mov r15, qword [rsp + 0xa8]
mov qword [rsp + 0x90], rbp
mov qword [rsp + 0x40], r12
mov r14, r9
mov rbx, r8
mov rsi, rdx
mov rdi, rcx
cmp rcx, rdx
je 0x1800d6603
mov rbp, r13
cmp rbx, 0x10
jb 0x1800d6664
mov r12, rbx
shr r12, 4
mov rax, r12
imul rax, rax, 0xfffffffffffffff0
add rbx, rax
nop word [rax + rax]
mov r8, r14
mov rdx, rsi
mov rcx, rdi
call r15
mov r11, qword [rbp]
add rsi, 0x10
xor qword [rsi - 0x10], r11
mov rax, qword [rbp + 8]
mov rbp, rdi
xor qword [rsi - 8], rax
add rdi, 0x10
dec r12
jne 0x1800d65c0
cmp r13, rbp
je 0x1800d6664
mov rax, qword [rbp]
mov qword [r13], rax
mov rax, qword [rbp + 8]
mov qword [r13 + 8], rax
jmp 0x1800d6664
cmp rbx, 0x10
jb 0x1800d6664
mov rbp, rbx
shr rbp, 4
mov rax, rbp
imul rax, rax, 0xfffffffffffffff0
add rbx, rax
nop word [rax + rax]
lea rdx, [rsp + 0x20]
mov r8, r14
mov rcx, rdi
call r15
mov r11, qword [rdi]
mov rax, qword [r13]
xor rax, qword [rsp + 0x20]
add rsi, 0x10
add rdi, 0x10
mov qword [rsi - 0x10], rax
mov rax, qword [r13 + 8]
mov qword [r13], r11
mov rcx, qword [rdi - 8]
xor rax, qword [rsp + 0x28]
dec rbp
mov qword [rsi - 8], rax
mov qword [r13 + 8], rcx
jne 0x1800d6620
test rbx, rbx
je 0x1800d671f
lea rax, [rsp + 0x20]
mov rbp, r13
lea r12, [rsp + 0x20]
sub rbp, rax
lea rax, [rsp + 0x20]
sub rsi, rax
neg r12
nop dword [rax + rax]
lea rdx, [rsp + 0x20]
mov r8, r14
mov rcx, rdi
call r15
xor r11d, r11d
lea r9, [r12 + rdi]
cmp r11, rbx
jae 0x1800d66d8
movzx ecx, byte [rsp + r11 + 0x20]
lea rax, [r9 + r11]
lea rdx, [r11 + rbp]
movzx r8d, byte [rsp + rax + 0x20]
xor cl, byte [rsp + rdx + 0x20]
lea rax, [rsi + r11]
inc r11
mov byte [rsp + rax + 0x20], cl
mov byte [rsp + rdx + 0x20], r8b
cmp r11, 0x10
jb 0x1800d66a5
cmp rbx, 0x10
jbe 0x1800d66ee
add rdi, 0x10
add rsi, 0x10
sub rbx, 0x10
jne 0x1800d6690
jmp 0x1800d671f
cmp r11, 0x10
jae 0x1800d671f
mov edx, reloc.WS2_32.dll_recv
sub rdi, r13
lea rcx, [r13 + r11]
sub rdx, r11
nop word [rax + rax]
movzx eax, byte [rdi + rcx]
inc rcx
dec rdx
mov byte [rcx - 1], al
jne 0x1800d6710
mov rbp, qword [rsp + 0x90]
mov r12, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.1800acfa0
add rsp, 0x48
pop r15
pop r14
pop r13
pop rdi
pop rsi
pop rbx
repz ret
Function at 0x1800d6750
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x20], r9
push rbx
push rsi
push rdi
push r12
push r13
mov eax, 0x40
call fcn.1800b9c10
sub rsp, rax
mov rsi, qword [rsp + 0x98]
mov r10, r9
mov rdi, r8
mov ebx, dword [rsi]
mov r12, rdx
mov r13, rcx
test ebx, ebx
jns 0x1800d6795
mov dword [rsi], 0xffffffff
add rsp, 0x40
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret
mov qword [rsp + 0x38], r14
mov r14, qword [rsp + 0x90]
mov qword [rsp + 0x30], r15
test ebx, ebx
je 0x1800d67d5
nop dword [rax + rax]
test rdi, rdi
je 0x1800d67d5
mov eax, ebx
inc r12
inc r13
movzx ecx, byte [rax + r14]
dec rdi
xor cl, byte [r13 - 1]
inc ebx
and ebx, 0xf
mov byte [r12 - 1], cl
jne 0x1800d67b0
mov r9, qword [rsp + 0xa0]
movsxd r15, ebx
cmp rdi, 0x10
jb 0x1800d68b2
mov rsi, r12
mov rcx, rdi
mov qword [rsp + 0x80], rbp
shr rcx, 4
mov rbp, r13
sub rsi, r14
mov rax, rcx
sub rbp, r14
imul rax, rax, 0xfffffffffffffff0
add rdi, rax
mov rax, rcx
shl rax, 4
add r12, rax
add r13, rax
mov qword [rsp + 0x70], r13
mov r13, qword [rsp + 0x88]
mov qword [rsp + 0x78], r12
mov r12, rcx
mov r8, r13
mov rdx, r14
mov rcx, r14
call r9
cmp ebx, 0x10
jae 0x1800d6876
mov edx, reloc.WS2_32.dll_ntohs
lea rcx, [r15 + r14]
sub edx, ebx
shr edx, 3
inc edx
nop word [rax + rax]
mov rax, qword [rcx + rbp]
add rcx, 8
xor rax, qword [rcx - 8]
dec rdx
mov qword [rsi + rcx - 8], rax
jne 0x1800d6860
mov r9, qword [rsp + 0xa0]
add rsi, 0x10
add rbp, 0x10
xor ebx, ebx
xor r15d, r15d
dec r12
jne 0x1800d6831
mov r12, qword [rsp + 0x78]
mov r13, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x98]
mov r10, qword [rsp + 0x88]
mov rbp, qword [rsp + 0x80]
mov r15, qword [rsp + 0x30]
test rdi, rdi
je 0x1800d68f5
mov r8, r10
mov rdx, r14
mov rcx, r14
call r9
movsxd rcx, ebx
sub r13, r14
add rcx, r14
sub r12, r14
add ebx, edi
nop word [rax + rax]
movzx eax, byte [rcx + r13]
inc rcx
xor al, byte [rcx - 1]
dec rdi
mov byte [rcx + r12 - 1], al
jne 0x1800d68e0
mov dword [rsi], ebx
mov r14, qword [rsp + 0x38]
add rsp, 0x40
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret
Function at 0x1800d6f10
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x20], r9
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
mov eax, 0x50
call fcn.1800b9c10
sub rsp, rax
mov r14, qword [rsp + 0xb8]
mov rbp, rdx
mov rdx, qword [rsp + 0xc0]
mov edi, dword [rdx]
mov r10, r9
mov rbx, r8
mov r12, rcx
test edi, edi
je 0x1800d6f74
nop
test rbx, rbx
je 0x1800d6f74
mov eax, edi
inc rbp
inc r12
movzx ecx, byte [rax + r14]
dec rbx
xor cl, byte [r12 - 1]
inc edi
and edi, 0xf
mov byte [rbp - 1], cl
jne 0x1800d6f50
mov r9, qword [rsp + 0xc8]
mov r13d, reloc.WS2_32.dll_recv
mov qword [rsp + 0x48], r15
mov esi, 1
cmp rbx, r13
jb 0x1800d70ad
mov rax, qword [rsp + 0xb0]
mov rcx, rbx
xor edi, edi
add rax, r13
shr rcx, 4
mov r14, rbp
mov qword [rsp + 0x30], rax
mov r15, r12
mov rax, rcx
mov dword [rsp + 0x20], edi
mov rdi, qword [rsp + 0xb8]
imul rax, rax, 0xfffffffffffffff0
add rbx, rax
mov rax, rcx
sub r14, rdi
shl rax, 4
sub r15, rdi
mov qword [rsp + 0xa0], rbx
mov rbx, qword [rsp + 0x30]
add rbp, rax
add r12, rax
mov qword [rsp + 0x90], r12
mov r12, qword [rsp + 0xb0]
mov qword [rsp + 0x98], rbp
mov rbp, rcx
nop word [rax + rax]
mov r8, r10
mov rdx, rdi
mov rcx, r12
call r9
mov r11d, r13d
mov ecx, esi
mov rdx, rbx
nop word [rax + rax]
movzx eax, byte [rdx - 1]
dec rdx
add ecx, eax
mov byte [rdx], cl
shr ecx, 8
dec r11d
jne 0x1800d7030
mov rcx, rdi
lea edx, [r11 + 2]
nop word [rax + rax]
mov rax, qword [r15 + rcx]
add rcx, 8
xor rax, qword [rcx - 8]
dec rdx
mov qword [r14 + rcx - 8], rax
jne 0x1800d7050
mov r9, qword [rsp + 0xc8]
mov r10, qword [rsp + 0xa8]
add r14, r13
add r15, r13
dec rbp
jne 0x1800d7010
mov rbx, qword [rsp + 0xa0]
mov edi, dword [rsp + 0x20]
mov rbp, qword [rsp + 0x98]
mov r12, qword [rsp + 0x90]
mov r14, qword [rsp + 0xb8]
mov rdx, qword [rsp + 0xc0]
test rbx, rbx
je 0x1800d7112
mov r15, qword [rsp + 0xb0]
mov r8, r10
mov rdx, r14
mov rcx, r15
call r9
lea rcx, [r15 + 0x10]
nop word [rax + rax]
movzx eax, byte [rcx - 1]
dec rcx
add esi, eax
mov byte [rcx], sil
shr esi, 8
dec r13d
jne 0x1800d70d0
movsxd rcx, edi
sub r12, r14
sub rbp, r14
add rcx, r14
add edi, ebx
movzx eax, byte [rcx + r12]
inc rcx
xor al, byte [rcx - 1]
dec rbx
mov byte [rcx + rbp - 1], al
jne 0x1800d70f2
mov rax, qword [rsp + 0xc0]
mov dword [rax], edi
jmp 0x1800d7114
mov dword [rdx], edi
mov r15, qword [rsp + 0x48]
add rsp, 0x50
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x1800d7130
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x20], r9
push rbx
push rbp
push rsi
push rdi
push r12
push r14
push r15
mov eax, 0x40
call fcn.1800b9c10
sub rsp, rax
mov rbx, r8
mov r8, qword [rsp + 0xb0]
mov rsi, rdx
mov edi, dword [r8]
mov rbp, rcx
mov dword [rsp + 0x30], edi
test edi, edi
je 0x1800d7195
mov rdx, qword [rsp + 0xa8]
test rbx, rbx
je 0x1800d7191
mov eax, edi
inc rsi
inc rbp
movzx ecx, byte [rax + rdx]
dec rbx
xor cl, byte [rbp - 1]
inc edi
and edi, 0xf
mov byte [rsi - 1], cl
jne 0x1800d7170
mov dword [rsp + 0x30], edi
mov rdx, qword [rsp + 0xa0]
mov r10, qword [rsp + 0xb8]
mov r15d, reloc.WS2_32.dll_inet_ntoa
movzx eax, byte [rdx + 0xd]
movzx ecx, byte [rdx + 0xc]
lea r14, [rdx + 0xc]
shl ecx, 8
mov qword [rsp + 0x80], r13
lea r12d, [r15 - 0xb]
or ecx, eax
movzx eax, byte [rdx + 0xe]
shl ecx, 8
or ecx, eax
movzx eax, byte [rdx + 0xf]
shl ecx, 8
or ecx, eax
mov dword [rsp + 0x90], ecx
cmp rbx, 0x10
jb 0x1800d72ca
mov eax, 0x10000000
mov rdi, rdx
nop word [rax + rax]
mov r13, rbx
shr r13, 4
cmp r13, rax
cmova r13, rax
add ecx, r13d
mov eax, ecx
mov dword [rsp + 0x90], ecx
cmp rax, r13
jae 0x1800d722b
sub r13, rax
xor ecx, ecx
mov dword [rsp + 0x90], ecx
mov r8, r13
mov rdx, rsi
mov rcx, rbp
mov qword [rsp + 0x20], rdi
call r10
mov ecx, dword [rsp + 0x90]
mov eax, ecx
mov r11d, ecx
mov byte [rdi + 0xf], cl
shr eax, 0x10
shr r11d, 0x18
mov byte [rdi + 0xd], al
mov eax, ecx
mov byte [r14], r11b
shr eax, 8
mov byte [rdi + 0xe], al
test ecx, ecx
jne 0x1800d728a
mov r8d, r15d
mov ecx, r12d
mov rdx, r14
nop dword [rax]
movzx eax, byte [rdx - 1]
dec rdx
add ecx, eax
mov byte [rdx], cl
shr ecx, 8
dec r8d
jne 0x1800d7270
mov ecx, dword [rsp + 0x90]
mov r9, qword [rsp + 0x98]
mov r10, qword [rsp + 0xb8]
shl r13, 4
sub rbx, r13
add rsi, r13
add rbp, r13
mov eax, 0x10000000
cmp rbx, 0x10
jae 0x1800d7200
mov edi, dword [rsp + 0x30]
mov r8, qword [rsp + 0xb0]
mov rdx, qword [rsp + 0xa0]
test rbx, rbx
je 0x1800d737f
mov r13, qword [rsp + 0xa8]
xor eax, eax
mov qword [rsp + 0x20], rdx
mov qword [r13], rax
mov rdx, r13
mov rcx, r13
mov r8, r12
mov qword [r13 + 8], rax
call r10
mov rdx, qword [rsp + 0xa0]
mov ecx, dword [rsp + 0x90]
inc ecx
mov eax, ecx
mov byte [rdx + 0xf], cl
shr eax, 0x18
mov byte [r14], al
mov eax, ecx
shr eax, 0x10
mov byte [rdx + 0xd], al
mov eax, ecx
shr eax, 8
mov byte [rdx + 0xe], al
test ecx, ecx
jne 0x1800d7347
nop word [rax + rax]
movzx eax, byte [r14 - 1]
dec r14
add r12d, eax
mov byte [r14], r12b
shr r12d, 8
dec r15d
jne 0x1800d7330
movsxd rcx, edi
sub rbp, r13
sub rsi, r13
add rcx, r13
add edi, ebx
nop word [rax + rax]
movzx eax, byte [rcx + rbp]
inc rcx
xor al, byte [rcx - 1]
dec rbx
mov byte [rsi + rcx - 1], al
jne 0x1800d7360
mov rax, qword [rsp + 0xb0]
mov dword [rax], edi
jmp 0x1800d7382
mov dword [r8], edi
mov r13, qword [rsp + 0x80]
add rsp, 0x40
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x1800d7990
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r13
mov eax, 0x20
call fcn.1800b9c10
sub rsp, rax
xor r13d, r13d
mov rsi, r8
mov rbp, rdx
mov rdi, rcx
mov qword [rcx + 0x30], r13
mov qword [rcx + 0x38], r13
mov qword [rcx + 0x170], r13
cmp r8, 0xc
jne 0x1800d79e1
mov rax, qword [rdx]
lea ebx, [r8 - 0xb]
mov qword [rcx], rax
mov eax, dword [rdx + 8]
mov dword [rcx + 0xc], 0x1000000
mov dword [rcx + 8], eax
jmp 0x1800d7b40
mov qword [rsp + 0x50], r12
mov qword [rsp + 0x60], r15
mov qword [rcx + 0x40], r13
mov r15, r8
mov qword [rcx + 0x48], r13
cmp r8, 0x10
jb 0x1800d7a84
mov r13, r8
mov rbx, rdx
mov qword [rsp + 0x58], r14
shr r13, 4
sub rbx, rcx
mov rax, r13
sub rbx, 0x3f
imul rax, rax, 0xfffffffffffffff0
add rsi, rax
mov rax, r13
shl rax, 4
add rbp, rax
nop word [rax + rax]
lea rcx, [rdi + 0x40]
mov edx, 4
nop dword [rax]
movzx eax, byte [rbx + rcx - 1]
add rcx, 4
xor byte [rcx - 4], al
movzx eax, byte [rbx + rcx - 4]
xor byte [rcx - 3], al
movzx eax, byte [rbx + rcx - 3]
xor byte [rcx - 2], al
movzx eax, byte [rbx + rcx - 2]
xor byte [rcx - 1], al
dec rdx
jne 0x1800d7a40
lea rdx, [rdi + 0x60]
lea rcx, [rdi + 0x40]
call fcn.1800d7590
add rbx, 0x10
dec r13
jne 0x1800d7a30
mov r14, qword [rsp + 0x58]
test rsi, rsi
je 0x1800d7aad
lea rcx, [rdi + 0x40]
sub rbp, rdi
movzx eax, byte [rcx + rbp - 0x40]
inc rcx
xor byte [rcx - 1], al
dec rsi
jne 0x1800d7a90
lea rdx, [rdi + 0x60]
lea rcx, [rdi + 0x40]
call fcn.1800d7590
shl r15, 3
lea rdx, [rdi + 0x60]
lea rcx, [rdi + 0x40]
xor byte [rdi + 0x4f], r15b
mov rax, r15
shr rax, 0x38
xor byte [rdi + 0x48], al
mov rax, r15
shr rax, 0x30
xor byte [rdi + 0x49], al
mov rax, r15
shr rax, 0x28
xor byte [rdi + 0x4a], al
mov rax, r15
shr rax, 0x20
xor byte [rdi + 0x4b], al
mov rax, r15
shr rax, 0x18
xor byte [rdi + 0x4c], al
mov rax, r15
shr rax, 0x10
xor byte [rdi + 0x4d], al
mov rax, r15
shr rax, 8
xor byte [rdi + 0x4e], al
call fcn.1800d7590
movzx eax, byte [rdi + 0x4d]
movzx ebx, byte [rdi + 0x4c]
mov r15, qword [rsp + 0x60]
mov r12, qword [rsp + 0x50]
shl ebx, 8
or ebx, eax
movzx eax, byte [rdi + 0x4e]
shl ebx, 8
or ebx, eax
movzx eax, byte [rdi + 0x4f]
shl ebx, 8
or ebx, eax
mov rax, qword [rdi + 0x40]
mov qword [rdi], rax
mov rax, qword [rdi + 0x48]
mov qword [rdi + 8], rax
mov r8, qword [rdi + 0x180]
lea rdx, [rdi + 0x20]
mov rcx, rdi
mov qword [rdi + 0x40], r13
mov qword [rdi + 0x48], r13
call qword [rdi + 0x178]
inc ebx
mov eax, ebx
mov byte [rdi + 0xf], bl
shr eax, 0x18
mov byte [rdi + 0xc], al
mov eax, ebx
shr eax, 0x10
mov byte [rdi + 0xd], al
mov eax, ebx
shr eax, 8
mov byte [rdi + 0xe], al
add rsp, 0x20
pop r13
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x1800d7b90
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rdi
mov eax, 0x20
call fcn.1800b9c10
sub rsp, rax
cmp qword [rcx + 0x38], 0
mov rbx, r8
mov rbp, rdx
mov rdi, rcx
je 0x1800d7bcd
mov eax, 0xfffffffe
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret
mov rax, qword [rcx + 0x30]
lea rcx, [r8 + rax]
movabs rax, 0x2000000000000000
cmp rcx, rax
ja 0x1800d7c9d
cmp rcx, rbx
jb 0x1800d7c9d
mov qword [rsp + 0x30], rsi
mov esi, dword [rdi + 0x174]
mov qword [rdi + 0x30], rcx
test esi, esi
je 0x1800d7c33
test rbx, rbx
je 0x1800d7c22
movzx eax, byte [rbp]
mov ecx, esi
inc rbp
xor byte [rcx + rdi + 0x40], al
dec rbx
inc esi
and esi, 0xf
jne 0x1800d7c04
jmp 0x1800d7c26
test esi, esi
jne 0x1800d7c80
lea rdx, [rdi + 0x60]
lea rcx, [rdi + 0x40]
call fcn.1800d7590
mov qword [rsp + 0x38], r12
mov r12, rbx
and r12, 0xfffffffffffffff0
je 0x1800d7c5a
lea rdx, [rdi + 0x60]
lea rcx, [rdi + 0x40]
mov r9, r12
mov r8, rbp
call fcn.1800d76d0
add rbp, r12
sub rbx, r12
mov r12, qword [rsp + 0x38]
test rbx, rbx
je 0x1800d7c80
mov esi, ebx
lea rcx, [rdi + 0x40]
sub rbp, rdi
nop dword [rax]
movzx eax, byte [rcx + rbp - 0x40]
inc rcx
xor byte [rcx - 1], al
dec rbx
jne 0x1800d7c70
mov dword [rdi + 0x174], esi
mov rsi, qword [rsp + 0x30]
xor eax, eax
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
or eax, 0xffffffff
add rsp, 0x20
pop rdi
ret
Function at 0x1800d8df0
Capabilities:
Encode data using xor

Disassembly:
xor r9b, r9b
mov r10, rdx
test r8, r8
je 0x1800d8e15
sub r10, rcx
nop
movzx edx, byte [r10 + rcx]
movzx eax, byte [rcx]
inc rcx
xor dl, al
or r9b, dl
dec r8
jne 0x1800d8e00
movzx eax, r9b
ret