joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140078470
Capabilities:
Query or enumerate registry value

Disassembly:
push rbx
push rbp
push rsi
push rdi
sub rsp, 0x68
mov rax, qword [0x140177090]
xor rax, rsp
mov qword [rsp + 0x58], rax
mov rbp, r9
mov rsi, r8
cmp qword [rdx + 0x10], 0
je 0x1400785d2
cmp qword [rdx + 0x18], 8
jb 0x1400784a3
mov rdx, qword [rdx]
lea rax, [rsp + 0x30]
mov qword [rsp + 0x20], rax
mov r9d, 0x20019
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1400785d2
mov rdx, rsi
cmp qword [rsi + 0x18], 8
jb 0x1400784d1
mov rdx, qword [rsi]
lea rax, [rsp + 0x38]
mov qword [rsp + 0x28], rax
xor edi, edi
mov qword [rsp + 0x20], rdi
lea r9, [rsp + 0x3c]
xor r8d, r8d
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1400785c7
cmp dword [rsp + 0x3c], 1
jne 0x1400785c7
xorps xmm0, xmm0
mov ebx, dword [rsp + 0x38]
movdqu xmmword [rsp + 0x40], xmm0
mov qword [rsp + 0x50], rdi
test rbx, rbx
je 0x14007854f
mov edx, ebx
lea rcx, [rsp + 0x40]
call fcn.1400089e0
mov rdi, rax
mov qword [rsp + 0x40], rax
lea r8, [rbx + rbx]
lea rbx, [r8 + rax]
mov qword [rsp + 0x50], rbx
xor edx, edx
mov rcx, rax
call fcn.1400ec680
mov qword [rsp + 0x48], rbx
cmp qword [rsi + 0x18], 8
jb 0x140078559
mov rsi, qword [rsi]
lea rax, [rsp + 0x38]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rdi
lea r9, [rsp + 0x3c]
xor r8d, r8d
mov rdx, rsi
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ebx, eax
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test ebx, ebx
je 0x140078593
xor bl, bl
jmp 0x1400785b8
mov r8, 0xffffffffffffffff
nop word [rax + rax]
inc r8
cmp word [rdi + r8*2], 0
jne 0x1400785a0
mov rdx, rdi
mov rcx, rbp
call fcn.1400088b0
mov bl, 1
lea rcx, [rsp + 0x40]
call fcn.1400087e0
movzx eax, bl
jmp 0x1400785d4
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor al, al
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.1400e9d60
add rsp, 0x68
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x140082870
Capabilities:
Check if file exists

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r14
lea rbp, [rsp - 0x10]
sub rsp, 0x110
mov rax, qword [0x140177090]
xor rax, rsp
mov qword [rbp + 8], rax
mov rsi, r8
mov rbx, rdx
mov qword [rsp + 0x48], rdx
xor r14d, r14d
mov dword [rsp + 0x20], r14d
mov qword [rbp - 0x60], r14
mov qword [rbp - 0x58], reloc.WS2_32.dll_ntohs
mov byte [rbp - 0x70], r14b
lea r8, [rbp - 0x70]
mov rdx, r9
lea rcx, [rbp - 0x30]
call fcn.1400825a0
nop
lea rax, [rbp - 0x30]
cmp qword [rbp - 0x18], 0x10
cmovae rax, qword [rbp - 0x30]
mov qword [rbp - 0x10], rax
lea rax, [rbp - 0x70]
cmp qword [rbp - 0x58], 0x10
cmovae rax, qword [rbp - 0x70]
mov qword [rbp - 8], rax
lea rax, [0x140153e50]
mov qword [rbp], rax
mov qword [rbx + 0x10], r14
mov qword [rbx + 0x18], 7
mov word [rbx], r14w
mov dword [rsp + 0x20], 1
lea rdi, [rbp - 0x10]
mov rax, qword [rdi]
mov qword [rsp + 0x38], r14
mov qword [rsp + 0x40], 7
mov word [rsp + 0x28], r14w
lea rdx, [0x1401490f7]
test rax, rax
cmovne rdx, rax
mov qword [rbp - 0x40], r14
mov qword [rbp - 0x38], reloc.WS2_32.dll_ntohs
mov byte [rbp - 0x50], 0
mov r8, 0xffffffffffffffff
nop dword [rax]
inc r8
cmp byte [rdx + r8], 0
jne 0x140082950
lea rcx, [rbp - 0x50]
call fcn.140008ab0
nop
lea rdx, [rsp + 0x28]
lea rcx, [rbp - 0x50]
call fcn.14001a690
nop
lea rcx, [rbp - 0x50]
call fcn.140008a50
nop
lea r8, [rsp + 0x28]
lea rdx, [rsp + 0x70]
mov rcx, rsi
call fcn.140025150
nop
lea r8, str..json
lea rdx, [rsp + 0x50]
mov rcx, rax
call fcn.140025500
nop
cmp rbx, rax
je 0x1400829c4
mov r8, qword [rax + 0x10]
cmp qword [rax + 0x18], 8
jb 0x1400829b8
mov rax, qword [rax]
mov rdx, rax
mov rcx, rbx
call fcn.1400088b0
nop
lea rcx, [rsp + 0x50]
call fcn.140008840
nop
lea rcx, [rsp + 0x70]
call fcn.140008840
nop
lea rcx, [rsp + 0x28]
call fcn.140008840
mov rcx, rbx
cmp qword [rbx + 0x18], 8
jb 0x1400829f1
mov rcx, qword [rbx]
call qword [sym.imp.SHLWAPI.dll_PathFileExistsW]
cmp eax, 1
je 0x140082a0d
add rdi, 8
lea rax, [rbp + 8]
cmp rdi, rax
jne 0x140082910
lea rcx, [rbp - 0x30]
call fcn.140008a50
nop
lea rcx, [rbp - 0x70]
call fcn.140008a50
mov rax, rbx
mov rcx, qword [rbp + 8]
xor rcx, rsp
call fcn.1400e9d60
add rsp, 0x110
pop r14
pop rdi
pop rsi
pop rbx
pop rbp
ret
Function at 0x18000ab50
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 7], 0
je 0x18000ab73
xor eax, eax
nop dword [rax + rax]
lea edx, [rax + 0xb]
xor byte [rax + rcx], dl
inc rax
cmp rax, 6
jb 0x18000ab60
mov byte [rcx + 7], 0
mov rax, rcx
ret

Function at 0x18000aba0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 8], 0
je 0x18000abc3
xor eax, eax
nop dword [rax + rax]
lea edx, [rax + 0xb]
xor byte [rax + rcx], dl
inc rax
cmp rax, 7
jb 0x18000abb0
mov byte [rcx + 8], 0
mov rax, rcx
ret

Function at 0x18000abd0
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x20
mov rdi, rcx
mov rcx, rdx
call fcn.180038600
mov rcx, rdi
mov rbx, rax
call fcn.180038600
xor r9d, r9d
mov r8, rbx
mov rdx, rax
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
mov ecx, 0x3df
call qword [sym.imp.KERNEL32.dll_ExitProcess]

Function at 0x18000aca0
Capabilities:
Enumerate processes

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x160
mov rax, qword [0x1801491e0]
xor rax, rsp
mov qword [rsp + 0x150], rax
xor edx, edx
mov rbx, rcx
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
xor edx, edx
lea rcx, [rsp + 0x24]
mov r8d, Ordinal_301
mov rdi, rax
call sub.VCRUNTIME140.dll_memset
mov dword [rsp + 0x20], 0x130
cmp rdi, 0xffffffffffffffff
je 0x18000ad66
lea rdx, [rsp + 0x20]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_Process32First]
test eax, eax
je 0x18000ad66
lea rdx, [rsp + 0x20]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_Process32Next]
test eax, eax
je 0x18000ad5d
cmp qword [rbx + 0x18], 0x10
mov r8, rbx
jb 0x18000ad21
mov r8, qword [rbx]
lea rax, [rsp + 0x4c]
sub r8, rax
nop dword [rax]
movzx edx, byte [rax]
movzx ecx, byte [rax + r8]
sub edx, ecx
jne 0x18000ad43
inc rax
test ecx, ecx
jne 0x18000ad30
mov rcx, rdi
test edx, edx
je 0x18000add6
lea rdx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_Process32Next]
test eax, eax
jne 0x18000ad14
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rdx, qword [rbx + 0x18]
cmp rdx, 0x10
jb 0x18000ada0
mov rcx, qword [rbx]
inc rdx
cmp rdx, 0x1000
jb 0x18000ad9b
mov r8, qword [rcx - 8]
add rdx, 0x27
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x18000ae1d
mov rcx, r8
call fcn.18010acb0
xor al, al
mov byte [rbx], 0
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov qword [rbx + 0x10], 0
mov rcx, qword [rsp + 0x150]
xor rcx, rsp
call fcn.18010a550
mov rbx, qword [rsp + 0x178]
add rsp, 0x160
pop rdi
ret
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [rsp + 0x28], 0
je 0x18000ad66
mov rdx, qword [rbx + 0x18]
cmp rdx, 0x10
jb 0x18000ae19
mov rcx, qword [rbx]
inc rdx
cmp rdx, 0x1000
jb 0x18000ae14
mov r8, qword [rcx - 8]
add rdx, 0x27
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x18000ae1d
mov rcx, r8
call fcn.18010acb0
mov al, 1
jmp 0x18000ada2
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
Function at 0x18000bfe0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x1e], 0
je 0x18000c003
xor eax, eax
nop dword [rax + rax]
lea edx, [rax + 0xb]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x1d
jb 0x18000bff0
mov byte [rcx + 0x1e], 0
mov rax, rcx
ret

Function at 0x18000c010
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 6], 0
je 0x18000c033
xor eax, eax
nop dword [rax + rax]
lea edx, [rax + 0xb]
xor byte [rax + rcx], dl
inc rax
cmp rax, 5
jb 0x18000c020
mov byte [rcx + 6], 0
mov rax, rcx
ret
Function at 0x18000e490
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 3], 0
je 0x18000e4b3
xor eax, eax
nop dword [rax + rax]
lea edx, [rax + 0xb]
xor byte [rax + rcx], dl
inc rax
cmp rax, 2
jb 0x18000e4a0
mov byte [rcx + 3], 0
mov rax, rcx
ret

Function at 0x18000e4c0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 4], 0
je 0x18000e4e3
xor eax, eax
nop dword [rax + rax]
lea edx, [rax + 0xb]
xor byte [rax + rcx], dl
inc rax
cmp rax, 3
jb 0x18000e4d0
mov byte [rcx + 4], 0
mov rax, rcx
ret
Function at 0x18000fe40
Capabilities:
Log keystrokes via polling

Disassembly:
mov r11, rsp
sub rsp, 0xe8
mov rax, qword [0x1801491e0]
xor rax, rsp
mov qword [rsp + 0x90], rax
cmp byte [0x180173810], 0
je 0x18001003f
mov edx, dword [0x18017383c]
lea rcx, [rsp + 0x50]
mov qword [r11 - 8], rdi
movaps xmmword [r11 - 0x18], xmm6
movaps xmmword [r11 - 0x38], xmm8
movaps xmmword [r11 - 0x48], xmm9
call fcn.18000f660
movups xmm8, xmmword [rax]
movsd xmm9, qword [rax + 0x20]
movups xmm6, xmmword [rax + 0x10]
movdqa xmm0, xmm8
movsd qword [rsp + 0x40], xmm9
psrldq xmm0, 8
movq rdi, xmm0
test rdi, rdi
je 0x18001001d
movss xmm0, dword [0x18017381c]
comiss xmm0, dword [rsp + 0x40]
jb 0x18001001d
movss xmm1, dword [0x180173834]
movaps xmm0, xmm6
cvtps2pd xmm1, xmm1
unpckhpd xmm0, xmm6
comisd xmm1, xmm0
jb 0x18001001d
mov ecx, dword [reloc.WS2_32.dll_bind]
call qword [sym.imp.USER32.dll_GetKeyState]
bt ax, 0xf
jae 0x18001001d
mov qword [rsp + 0xf8], rsi
movd esi, xmm6
test esi, esi
je 0x180010015
mov qword [rsp + 0xf0], rbx
lea rdx, [rsp + 0x80]
movd ebx, xmm8
mov rcx, rdi
movaps xmmword [rsp + 0xc0], xmm7
mov r8d, ebx
call qword [0x1801776a0]
movaps xmm1, xmmword [rsp + 0x80]
movss dword [rsp + 0x80], xmm1
movaps xmm0, xmm1
shufps xmm0, xmm1, 0x55
shufps xmm1, xmm1, 0xaa
movss dword [rsp + 0x88], xmm1
movss dword [rsp + 0x84], xmm0
cmp ebx, 0x1233
jne 0x18000ff82
movsd xmm7, qword [rdi + 0x90]
mov ebx, dword [rdi + 0x98]
jmp 0x18000ff92
mov ebx, dword [rsp + 0x88]
movsd xmm7, qword [rsp + 0x80]
cmp byte [0x180177565], 0
je 0x18000ffbc
lea rcx, [rsp + 0x80]
movsd qword [rsp + 0x80], xmm7
mov dword [rsp + 0x88], ebx
call fcn.18000c7e0
test al, al
jne 0x180010005
mov edx, esi
movabs rcx, 0x7239b21a38f536ba
call fcn.18003da50
test eax, eax
je 0x180010005
lea rdx, [rsp + 0x80]
movsd qword [rsp + 0x80], xmm7
lea rcx, [rsp + 0x20]
mov dword [rsp + 0x88], ebx
movaps xmmword [rsp + 0x20], xmm8
movaps xmmword [rsp + 0x30], xmm6
movsd qword [rsp + 0x40], xmm9
call fcn.18000f8f0
movaps xmm7, xmmword [rsp + 0xc0]
mov rbx, qword [rsp + 0xf0]
mov rsi, qword [rsp + 0xf8]
mov rdi, qword [rsp + 0xe0]
movaps xmm6, xmmword [rsp + 0xd0]
movaps xmm8, xmmword [rsp + 0xb0]
movaps xmm9, xmmword [rsp + 0xa0]
mov rcx, qword [rsp + 0x90]
xor rcx, rsp
call fcn.18010a550
add rsp, 0xe8
ret
Function at 0x180010060
Capabilities:
Log keystrokes via polling

Disassembly:
push rbp
push rsi
push r14
lea rbp, [rsp - 0x47]
sub rsp, 0xd0
mov rax, qword [0x1801491e0]
xor rax, rsp
mov qword [rbp - 9], rax
cmp byte [0x180173ac0], 0
mov rsi, rdx
mov r14, rcx
je 0x1800102a8
mov rax, qword [0x1801776a8]
movss xmm0, dword [rcx + 8]
movss xmm1, dword [rcx]
movss xmm2, dword [rcx + 4]
subss xmm2, dword [rax + 0x94]
subss xmm0, dword [rax + 0x98]
subss xmm1, dword [rax + 0x90]
mulss xmm2, xmm2
mulss xmm0, xmm0
mulss xmm1, xmm1
addss xmm2, xmm1
addss xmm2, xmm0
xorps xmm0, xmm0
ucomiss xmm0, xmm2
ja 0x1800100e4
xorps xmm0, xmm0
sqrtss xmm0, xmm2
jmp 0x1800100ec
movaps xmm0, xmm2
call sub.api_ms_win_crt_math_l1_1_0.dll_sqrtf
movss xmm1, dword [0x18012cf90]
comiss xmm1, xmm0
jbe 0x1800102a8
mov edx, dword [0x180173ad0]
lea rcx, [rbp - 0x41]
mov qword [rsp + 0x108], rdi
call fcn.18000f660
movups xmm2, xmmword [rax]
movups xmm0, xmmword [rax + 0x10]
movsd xmm1, qword [rax + 0x20]
movups xmmword [rbp - 0x69], xmm2
psrldq xmm2, 8
movq rdi, xmm2
movsd qword [rbp - 0x49], xmm1
movups xmmword [rbp - 0x59], xmm0
test rdi, rdi
je 0x1800102a0
movss xmm0, dword [0x180173ac4]
comiss xmm0, dword [rbp - 0x49]
jb 0x1800102a0
movss xmm0, dword [0x180173acc]
cvtps2pd xmm0, xmm0
comisd xmm0, xmmword [rbp - 0x51]
jb 0x1800102a0
mov ecx, dword [reloc.WS2_32.dll_bind]
call qword [sym.imp.USER32.dll_GetKeyState]
bt ax, 0xf
jae 0x1800102a0
mov r8d, dword [rbp - 0x69]
lea rdx, [rbp - 0x19]
mov qword [rsp + 0x100], rbx
mov rcx, rdi
movaps xmmword [rsp + 0xc0], xmm6
movaps xmmword [rsp + 0xb0], xmm7
movaps xmmword [rsp + 0xa0], xmm8
movaps xmmword [rsp + 0x90], xmm9
call qword [0x1801776a0]
cmp dword [rbp - 0x69], 0x1233
movaps xmm8, xmmword [rbp - 0x19]
movaps xmm9, xmm8
movss dword [rbp - 0x19], xmm8
movaps xmm7, xmm8
shufps xmm9, xmm8, 0x55
shufps xmm7, xmm8, 0xaa
movss dword [rbp - 0x15], xmm9
movss dword [rbp - 0x11], xmm7
jne 0x180010219
movsd xmm6, qword [rdi + 0x90]
mov ebx, dword [rdi + 0x98]
movaps xmm0, xmm6
shufps xmm0, xmm0, 0x55
mov dword [rbp - 0x11], ebx
movaps xmm9, xmm0
movss xmm7, dword [rbp - 0x11]
movsd qword [rbp - 0x19], xmm6
movss xmm8, dword [rbp - 0x19]
jmp 0x180010221
mov ebx, dword [rbp - 0x11]
movsd xmm6, qword [rbp - 0x19]
cmp byte [0x180177565], 0
je 0x180010245
cmp byte [rbp - 0x45], 0
jne 0x180010245
lea rcx, [rbp - 0x19]
movsd qword [rbp - 0x19], xmm6
mov dword [rbp - 0x11], ebx
call fcn.18000c7e0
test al, al
jne 0x180010276
cmp byte [0x180173ac8], 0
je 0x18001026f
addss xmm7, dword [0x18012cedc]
movaps xmm0, xmm8
unpcklps xmm0, xmm9
movsd qword [r14], xmm0
movss dword [rbp - 0x11], xmm7
mov eax, dword [rbp - 0x11]
mov dword [r14 + 8], eax
movsd qword [rsi], xmm6
mov dword [rsi + 8], ebx
movaps xmm8, xmmword [rsp + 0xa0]
movaps xmm7, xmmword [rsp + 0xb0]
movaps xmm6, xmmword [rsp + 0xc0]
mov rbx, qword [rsp + 0x100]
movaps xmm9, xmmword [rsp + 0x90]
mov rdi, qword [rsp + 0x108]
mov rcx, qword [rbp - 9]
xor rcx, rsp
call fcn.18010a550
add rsp, 0xd0
pop r14
pop rsi
pop rbp
ret
Function at 0x1800102c0
Capabilities:
Log keystrokes via polling

Disassembly:
sub rsp, 0xa8
mov rax, qword [0x1801491e0]
xor rax, rsp
mov qword [rsp + 0x90], rax
cmp byte [0x180173848], 0
je 0x1800104db
mov edx, dword [0x180173858]
lea rcx, [rsp + 0x58]
mov qword [rsp + 0xa0], rbx
call fcn.18000f660
movups xmm2, xmmword [rax]
movups xmm0, xmmword [rax + 0x10]
movsd xmm1, qword [rax + 0x20]
movups xmmword [rsp + 0x30], xmm2
psrldq xmm2, 8
movq rbx, xmm2
movsd qword [rsp + 0x50], xmm1
movups xmmword [rsp + 0x40], xmm0
test rbx, rbx
je 0x1800104d3
movss xmm0, dword [0x180173850]
cvtps2pd xmm0, xmm0
comisd xmm0, xmmword [rsp + 0x48]
jb 0x1800104d3
cmp qword [0x180178d80], rbx
je 0x18001035e
mov qword [0x180178d80], rbx
mov dword [0x180178d94], 0
mov ecx, dword [0x180177544]
mov rax, qword gs:[0x58]
mov edx, 4
mov rax, qword [rax + rcx*8]
mov ecx, dword [rdx + rax]
cmp dword [0x180178f48], ecx
jle 0x1800103af
lea rcx, [0x180178f48]
call fcn.18010a6f8
cmp dword [0x180178f48], 0xffffffff
jne 0x1800103af
call qword [sym.imp.KERNEL32.dll_GetTickCount64]
lea rcx, [0x180178f48]
mov qword [0x180178f20], rax
call fcn.18010a698
call qword [sym.imp.KERNEL32.dll_GetTickCount64]
sub rax, qword [0x180178f20]
movsxd rcx, dword [0x180178d94]
cmp rax, rcx
jb 0x1800104d3
mov ecx, dword [reloc.WS2_32.dll_bind]
call qword [sym.imp.USER32.dll_GetKeyState]
bt ax, 0xf
jae 0x1800104c6
cmp byte [0x180177565], 0
je 0x18001044a
cmp byte [rsp + 0x54], 0
jne 0x18001044a
mov r8d, dword [rsp + 0x30]
lea rdx, [rsp + 0x80]
mov rcx, rbx
call qword [0x1801776a0]
movaps xmm1, xmmword [rsp + 0x80]
lea rcx, [rsp + 0x20]
movaps xmm2, xmm1
movaps xmm0, xmm1
shufps xmm0, xmm1, 0xaa
shufps xmm2, xmm1, 0x55
movss dword [rsp + 0x88], xmm0
mov eax, dword [rsp + 0x88]
unpcklps xmm1, xmm2
movsd qword [rsp + 0x20], xmm1
mov dword [rsp + 0x28], eax
call fcn.18000c7e0
test al, al
jne 0x1800104c6
cmp byte [0x18017384a], 0
jne 0x180010484
movss xmm0, dword [0x18017384c]
comiss xmm0, dword [rsp + 0x50]
jb 0x1800104c6
movss xmm3, dword [0x18012cf34]
call fcn.18003ed60
cmp byte [0x18017384a], 0
mov eax, dword [0x180173854]
mov dword [0x180178d94], eax
je 0x1800104c6
movabs rcx, 0x4f8644af03d0e0d6
call fcn.18003d830
mov r8d, dword [rsp + 0x40]
mov edx, eax
movabs rcx, 0x3c06b5c839b38f7b
call fcn.18003d730
test eax, eax
je 0x1800104c6
movss xmm3, dword [0x18012cf34]
call fcn.18003ed60
mov eax, dword [0x180173854]
mov dword [0x180178d94], eax
call qword [sym.imp.KERNEL32.dll_GetTickCount64]
mov qword [0x180178f20], rax
mov rbx, qword [rsp + 0xa0]
mov rcx, qword [rsp + 0x90]
xor rcx, rsp
call fcn.18010a550
add rsp, 0xa8
ret
Function at 0x180013840
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x40
mov rdi, rcx
mov rbx, rdx
mov ecx, 3
call fcn.1800b5200
call fcn.1800b4f30
mov qword [rdi], 0
mov rsi, rax
mov qword [rdi + 0x10], 0
mov r8, rbx
mov qword [rdi + 0x18], reloc.WS2_32.dll_ntohs
cmp qword [rbx + 0x18], 0x10
jb 0x18001388b
mov r8, qword [rbx]
mov edx, 0x2712
mov rcx, rsi
call fcn.1800b7dd0
xor r8d, r8d
mov rcx, rsi
lea edx, [r8 + 0x40]
call fcn.1800b7dd0
movdqa xmm0, xmmword [0x18012ed50]
xor eax, eax
movdqu xmmword [rsp + 0x20], xmm0
mov word [rsp + 0x30], 0x100
nop
lea ecx, [rax + 0xb]
xor byte [rsp + rax + 0x20], cl
inc rax
cmp rax, 0x10
jb 0x1800138c0
lea r8, [rsp + 0x20]
mov byte [rsp + 0x31], 0
mov edx, 0x2722
mov rcx, rsi
call fcn.1800b7dd0
lea r8, [0x180013810]
mov edx, 0x4e2b
mov rcx, rsi
call fcn.1800b7dd0
mov r8, rdi
mov edx, 0x2711
mov rcx, rsi
call fcn.1800b7dd0
mov rcx, rsi
call fcn.1800b5010
mov rcx, rsi
call fcn.1800b4f10
call fcn.1800b51a0
mov rdx, qword [rbx + 0x18]
cmp rdx, 0x10
jb 0x180013956
mov rcx, qword [rbx]
inc rdx
cmp rdx, 0x1000
jb 0x180013951
mov r8, qword [rcx - 8]
add rdx, 0x27
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x18001397c
mov rcx, r8
call fcn.18010acb0
mov rsi, qword [rsp + 0x68]
mov rax, rdi
mov qword [rbx + 0x10], 0
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], 0
mov rbx, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3

Function at 0x180013990
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x11], 0
je 0x1800139b3
xor eax, eax
nop dword [rax + rax]
lea edx, [rax + 0xb]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x10
jb 0x1800139a0
mov byte [rcx + 0x11], 0
mov rax, rcx
ret
Function at 0x180016190
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r14
push r15
lea rbp, [rsp - 0x47]
sub rsp, 0xb0
mov rax, qword [0x1801491e0]
xor rax, rsp
mov qword [rbp + 0x37], rax
mov r15, rdx
mov rsi, rcx
mov qword [rbp + 0x17], rcx
xor ebx, ebx
mov dword [rbp - 0x49], ebx
mov qword [rcx], rbx
mov qword [rcx + 0x10], rbx
mov qword [rcx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rcx], bl
mov dword [rbp - 0x49], 1
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x1f], xmm0
mov qword [rbp + 0x2f], rbx
mov edx, 0x100
call fcn.1800482f0
mov qword [rbp + 0x1f], rax
lea rdi, [rax + 0x400]
mov qword [rbp + 0x2f], rdi
movdqa xmm0, xmmword [0x18012f2a0]
lea ecx, [rbx + 8]
nop word [rax + rax]
movups xmmword [rax], xmm0
movups xmmword [rax + 0x10], xmm0
movups xmmword [rax + 0x20], xmm0
movups xmmword [rax + 0x30], xmm0
movups xmmword [rax + 0x40], xmm0
movups xmmword [rax + 0x50], xmm0
movups xmmword [rax + 0x60], xmm0
lea rax, [rax + 0x80]
movups xmmword [rax - 0x10], xmm0
sub rcx, 1
jne 0x180016220
mov qword [rbp + 0x27], rdi
mov edx, ebx
lea r8, [rbp - 0x39]
nop word [rax + rax]
movdqa xmm0, xmmword [0x18012e320]
movdqa xmmword [rbp - 0x39], xmm0
movdqa xmm1, xmmword [0x18012e470]
movdqa xmmword [rbp - 0x29], xmm1
movdqa xmm0, xmmword [0x18012e460]
movdqa xmmword [rbp - 0x19], xmm0
movdqa xmm1, xmmword [0x18012eb70]
movdqa xmmword [rbp - 9], xmm1
mov word [rbp + 7], 0x100
mov rax, rbx
nop dword [rax]
lea ecx, [rax + 0xb]
xor byte [rbp + rax - 0x39], cl
inc rax
cmp rax, 0x40
jb 0x1800162a0
mov byte [rbp + 8], 0
movsx rcx, byte [r8]
mov rax, qword [rbp + 0x1f]
mov dword [rax + rcx*4], edx
inc edx
inc r8
cmp edx, 0x40
jl 0x180016260
mov edi, 0xfffffff8
mov rcx, r15
cmp qword [r15 + 0x18], 0x10
jb 0x1800162e0
mov rcx, qword [r15]
mov rdx, rcx
jmp 0x1800162e3
mov rdx, r15
mov r14, rcx
mov r15, qword [r15 + 0x10]
add r15, rdx
cmp rcx, r15
mov rcx, qword [rbp + 0x1f]
je 0x180016369
nop word [rax + rax]
movzx eax, byte [r14]
mov edx, dword [rcx + rax*4]
cmp edx, 0xffffffff
je 0x180016369
shl ebx, 6
add ebx, edx
add edi, 6
js 0x180016361
mov edx, ebx
mov ecx, edi
sar edx, cl
mov rcx, qword [rsi + 0x10]
mov r8, qword [rsi + 0x18]
cmp rcx, r8
jae 0x180016347
lea rax, [rcx + 1]
mov qword [rsi + 0x10], rax
mov rax, rsi
cmp r8, 0x10
jb 0x18001633d
mov rax, qword [rsi]
mov byte [rax + rcx], dl
mov byte [rax + rcx + 1], 0
jmp 0x18001635a
movzx r9d, dl
xor r8d, r8d
lea edx, [r8 + 1]
mov rcx, rsi
call fcn.180042f40
sub edi, 8
mov rcx, qword [rbp + 0x1f]
inc r14
cmp r14, r15
jne 0x180016300
test rcx, rcx
je 0x1800163a6
mov rdx, qword [rbp + 0x2f]
sub rdx, rcx
and rdx, 0xfffffffffffffffc
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800163a1
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1800163a1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.18010acb0
mov rax, rsi
mov rcx, qword [rbp + 0x37]
xor rcx, rsp
call fcn.18010a550
lea r11, [rsp + 0xb0]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
Function at 0x180018b00
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0xb], 0
je 0x180018b23
xor eax, eax
nop dword [rax + rax]
lea edx, [rax + 0xb]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0xa
jb 0x180018b10
mov byte [rcx + 0xb], 0
mov rax, rcx
ret

Function at 0x180018b30
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0xc], 0
je 0x180018b53
xor eax, eax
nop dword [rax + rax]
lea edx, [rax + 0xb]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0xb
jb 0x180018b40
mov byte [rcx + 0xc], 0
mov rax, rcx
ret

Function at 0x180018b60
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x10], 0
je 0x180018b83
xor eax, eax
nop dword [rax + rax]
lea edx, [rax + 0xb]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0xf
jb 0x180018b70
mov byte [rcx + 0x10], 0
mov rax, rcx
ret

Function at 0x180018b90
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 9], 0
je 0x180018bb3
xor eax, eax
nop dword [rax + rax]
lea edx, [rax + 0xb]
xor byte [rax + rcx], dl
inc rax
cmp rax, 8
jb 0x180018ba0
mov byte [rcx + 9], 0
mov rax, rcx
ret

Function at 0x18001a090
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0xd], 0
je 0x18001a0b3
xor eax, eax
nop dword [rax + rax]
lea edx, [rax + 0xb]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0xc
jb 0x18001a0a0
mov byte [rcx + 0xd], 0
mov rax, rcx
ret