joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1800ee990
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x20
mov rbp, r9
mov rbx, r8
mov rdi, rdx
mov r14, rcx
mov rax, qword [rcx]
call qword [rax + 0x20]
test al, al
jne 0x1800ee9c8
mov rcx, r14
call fcn.1800a53c0
mov eax, dword [0x18043b6e4]
test al, 1
jne 0x1800ee9e8
or eax, 1
mov dword [0x18043b6e4], eax
lea rcx, [0x18043b6e0]
call fcn.1801587d0
nop
test byte [0x18043b6e0], 1
je 0x1800eea2d
cmp rbp, 8
jb 0x1800eea2d
mov rsi, rbp
shr rsi, 3
imul rax, rsi, 0xfffffffffffffff8
add rbp, rax
nop word [rax + rax]
mov r8, qword [r14 + 0x20]
mov rdx, rbx
mov rcx, rdi
call fcn.180158b50
add rdi, 0x40
add rbx, 0x40
sub rsi, 1
jne 0x1800eea10
mov r9, qword [r14 + 0x20]
mov r8, rbp
mov rdx, rbx
mov rcx, rdi
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
jmp 0x1800eefd0

Function at 0x1800eef00
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
movzx r10d, cx
mov r11d, reloc.WS2_32.dll_ntohs
movzx eax, r10w
mov ebx, r10d
nop word [rax + rax]
movzx r9d, ax
xor r8d, r8d
imul r9d, r9d
movzx ecx, r9w
mov edx, r9d
shr edx, 0x10
cmp ecx, edx
setb r8b
add ax, ax
sub r8w, dx
add r8w, cx
lea ecx, [r9 - 1]
shr ecx, 0x1f
not r9d
shr r9d, 0x1f
and r9w, cx
mov ecx, 1
sub cx, ax
neg r9w
xor cx, r8w
and r9w, cx
xor r9w, r8w
xor r8d, r8d
movzx eax, r9w
imul eax, ebx
movzx ecx, ax
mov edx, eax
shr edx, 0x10
cmp ecx, edx
setb r8b
sub r8w, dx
add r8w, cx
lea ecx, [rax - 1]
shr ecx, 0x1f
not eax
shr eax, 0x1f
and ax, cx
mov ecx, 1
sub cx, r9w
neg ax
sub cx, r10w
xor cx, r8w
and ax, cx
xor ax, r8w
sub r11, 1
jne 0x1800eef20
mov rbx, qword [rsp + 8]
ret
Function at 0x1800f7260
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push r14
push r15
sub rsp, 0x40
mov r11, rdx
mov rbp, rdx
mov r15, r9
mov rdx, rcx
sub rdx, r8
and r15d, 0x1f
mov r10, r9
sub r11, r8
mov rbx, r8
mov r14, rcx
sub r10, r15
je 0x1800f730e
mov rcx, rbx
nop word [rax + rax]
movups xmm0, xmmword [r11 + rcx]
xor eax, eax
movups xmm1, xmmword [r11 + rcx + 0x10]
movups xmmword [rsp], xmm0
movups xmm0, xmmword [rcx]
movups xmmword [rsp + 0x10], xmm1
movups xmm1, xmmword [rcx + 0x10]
movups xmmword [rsp + 0x20], xmm0
movups xmmword [rsp + 0x30], xmm1
nop word [rax + rax]
movdqu xmm0, xmmword [rsp + rax]
movdqu xmm1, xmmword [rsp + rax + 0x20]
xorps xmm1, xmm0
movdqu xmmword [rsp + rax], xmm1
add rax, 0x10
cmp rax, 0x20
jl 0x1800f72d0
movups xmm0, xmmword [rsp]
movups xmm1, xmmword [rsp + 0x10]
movups xmmword [rdx + rcx], xmm0
movups xmmword [rdx + rcx + 0x10], xmm1
add rcx, 0x20
mov rax, rcx
sub rax, rbx
cmp rax, r10
jne 0x1800f72a0
cmp r10, r9
je 0x1800f73c4
cmp r15, 8
jb 0x1800f739a
lea r8, [r9 - 1]
mov qword [rsp + 0x68], rdi
lea rax, [r9 - 1]
add r8, r14
add rax, rbx
lea rdi, [r10 + r14]
lea rcx, [r10 + rbx]
cmp rdi, rax
ja 0x1800f7346
cmp r8, rcx
jae 0x1800f7395
lea rax, [r9 - 1]
mov qword [rsp + 0x60], rsi
add rax, rbp
lea rsi, [r10 + rbp]
cmp rdi, rax
ja 0x1800f7360
cmp r8, rsi
jae 0x1800f7390
and r15d, 7
mov rax, r9
sub rax, r15
sub rbp, rbx
sub r14, rbx
movq xmm1, qword [rcx + rbp]
add r10, 8
movq xmm0, qword [rcx]
lea rcx, [rcx + 8]
xorps xmm1, xmm0
movq qword [rcx + r14 - 8], xmm1
cmp r10, rax
jne 0x1800f7370
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
cmp r10, r9
je 0x1800f73c4
lea rax, [r10 + rbx]
sub r9, r10
nop word [rax + rax]
movzx ecx, byte [r11 + rax]
xor cl, byte [rax]
mov byte [rdx + rax], cl
lea rax, [rax + 1]
sub r9, 1
jne 0x1800f73b0
mov rbx, qword [rsp + 0x70]
add rsp, 0x40
pop r15
pop r14
pop rbp
ret
Function at 0x18010d480
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x20
mov r14, rdx
movzx r15d, r9b
mov rdx, qword [rdx + 8]
sub r15b, r8b
movzx ebx, r15b
mov rcx, r14
mov rdi, r9
sub rdx, qword [r14]
add rdx, rbx
call fcn.18009c590
mov rsi, qword [r14 + 8]
mov rbp, rsi
sub rsi, qword [r14]
sub rbp, qword [r14]
sub rsi, rbx
mov rax, rbp
sub rax, rdi
cmp rax, rbp
je 0x18010d52e
mov r11, rax
sub r11, rsi
nop dword [rax]
mov r10, qword [r14]
mov r9, r11
shr r9, 0x3f
mov rcx, rax
shr rcx, 0x3f
mov rdx, rax
xor r9b, cl
shr rdx, 0x3f
mov rcx, rsi
inc r11
shr rcx, 0x3f
xor dl, cl
mov rcx, rax
shr rcx, 0x3f
or r9b, dl
xor r9b, cl
movzx ecx, byte [r10 + rax]
xor cl, r15b
dec r9b
and r9b, cl
xor byte [r10 + rax], r9b
inc rax
cmp rax, rbp
jne 0x18010d4e0
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop rdi
ret

Function at 0x18010d550
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 8
lea rax, [r8 - 3]
cmp rax, 0xfc
jbe 0x18010d568
mov rax, r8
add rsp, 8
ret
mov qword [rsp + 0x18], rsi
mov r11, r8
mov qword [rsp], rdi
lea rsi, [r8 - 1]
movzx edi, byte [rdx + r8 - 1]
mov rcx, r8
sub r11, rdi
xor r10d, r10d
mov r9, r11
xor r9, r8
or rcx, r9
xor rcx, r8
shr rcx, 0x3f
neg rcx
test rsi, rsi
je 0x18010d5f3
mov qword [rsp + 0x10], rbx
lea rbx, [r11 + rdx]
nop dword [rax + rax]
mov rdx, r10
mov rax, r10
sub rdx, r11
xor rax, r11
mov r8, rdx
xor r8, r10
or r8, rax
movzx edx, byte [rdx + rbx]
xor r8, r10
xor rdx, rdi
shr r8, 0x3f
dec rdx
dec r8
shr rdx, 0x3f
inc r10
dec rdx
and r8, rdx
or rcx, r8
cmp r10, rsi
jne 0x18010d5b0
mov rbx, qword [rsp + 0x10]
mov rdi, qword [rsp]
and r9, rcx
mov rsi, qword [rsp + 0x18]
xor r9, r11
mov rax, r9
add rsp, 8
ret

Function at 0x18010d690
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x20
mov rsi, rdx
movzx r14d, r9b
sub r14b, r8b
mov rcx, rsi
movzx ebx, r14b
mov rdi, r9
mov edx, ebx
sub rdx, qword [rsi]
add rdx, qword [rsi + 8]
call fcn.18009c590
mov rax, qword [rsi + 8]
mov rcx, qword [rsi]
mov rbp, rax
mov r11, rax
sub rbp, rcx
sub r11, rcx
sub rax, rcx
dec rbp
sub r11, rbx
sub rax, rdi
cmp rax, rbp
je 0x18010d743
mov r10, rax
sub r10, r11
nop word [rax + rax]
mov r9, qword [rsi]
mov r8, r10
shr r8, 0x3f
mov rcx, rax
shr rcx, 0x3f
mov rdx, rax
xor r8b, cl
shr rdx, 0x3f
mov rcx, r11
inc r10
shr rcx, 0x3f
xor dl, cl
mov rcx, rax
or r8b, dl
shr rcx, 0x3f
xor r8b, cl
neg r8b
and byte [r9 + rax], r8b
inc rax
cmp rax, rbp
jne 0x18010d700
mov rax, qword [rsi + 8]
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
mov byte [rax - 1], r14b
add rsp, 0x20
pop r14
ret
Function at 0x18010d770
Capabilities:
Encode data using xor

Disassembly:
push rbx
lea rax, [r8 - 3]
mov rbx, rdx
cmp rax, 0xfc
jbe 0x18010d786
mov rax, r8
pop rbx
ret
movzx eax, byte [rdx + r8 - 1]
mov r11, r8
sub r11, rax
mov qword [rsp + 0x10], rsi
mov r10, r11
lea rsi, [r8 - 1]
xor r10, r8
xor r9d, r9d
mov rcx, r10
or rcx, r8
xor rcx, r8
shr rcx, 0x3f
neg rcx
test rsi, rsi
je 0x18010d813
mov qword [rsp + 0x18], rdi
lea rdi, [r11 + rdx]
nop dword [rax]
nop word [rax + rax]
lea rdx, [r9 + rbx]
mov rax, r9
mov r8, rdx
xor rax, r11
movzx edx, byte [rdx]
sub r8, rdi
xor r8, r9
dec rdx
or r8, rax
shr rdx, 0x3f
xor r8, r9
neg rdx
shr r8, 0x3f
inc r9
neg r8
or r8, rdx
not r8
or rcx, r8
cmp r9, rsi
jne 0x18010d7d0
mov rdi, qword [rsp + 0x18]
mov rsi, qword [rsp + 0x10]
and r10, rcx
xor r10, r11
mov rax, r10
pop rbx
ret

Function at 0x18010d870
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x20
mov r14, rdx
movzx eax, r9b
sub al, r8b
mov rcx, r14
movzx ebx, al
mov rdi, r9
mov edx, ebx
sub rdx, qword [r14]
add rdx, qword [r14 + 8]
call fcn.18009c590
mov r11, qword [r14 + 8]
mov rax, qword [r14]
mov rsi, r11
mov rbp, r11
sub rsi, rax
sub r11, rax
sub rsi, rbx
sub rbp, rax
sub r11, rdi
cmp r11, rbp
je 0x18010d936
mov rbx, rsi
shr rbx, 0x3f
nop dword [rax]
nop word [rax + rax]
mov r10, qword [r14]
mov rcx, r11
xor rcx, rsi
mov rax, r11
shr rax, 0x3f
mov rdx, rsi
sub rdx, r11
xor al, bl
shr rdx, 0x3f
xor dl, bl
lea r9, [rcx - 1]
or dl, al
shr r9, 0x3f
movzx eax, byte [r10 + r11]
xor dl, bl
xor al, 0x80
dec dl
not rcx
shr rcx, 0x3f
and r9b, cl
neg r9b
and r9b, al
xor r9b, byte [r10 + r11]
and dl, r9b
mov byte [r10 + r11], dl
inc r11
cmp r11, rbp
jne 0x18010d8e0
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret

Function at 0x18010d960
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 8
mov r10, r8
cmp r8, 2
ja 0x18010d975
mov rax, r8
add rsp, 8
ret
mov qword [rsp + 0x10], rbx
lea r11, [r8 - 1]
xor cl, cl
mov qword [rsp], rdi
xor al, al
lea rdi, [rdx - 1]
mov rbx, r10
nop dword [rax]
movzx r9d, byte [rdi + rbx]
movzx r8d, r9b
xor r8b, 0x80
lea edx, [r8 - 1]
not r8b
shr dl, 7
shr r8b, 7
and dl, r8b
neg dl
or al, dl
movzx edx, al
not dl
movzx r8d, dl
mov edx, r8d
and edx, 1
sub r11, rdx
lea edx, [r9 - 1]
shr dl, 7
not r9b
shr r9b, 7
and dl, r9b
dec dl
and dl, r8b
or cl, dl
sub rbx, 1
jne 0x18010d990
mov rdi, qword [rsp]
not al
mov rbx, qword [rsp + 0x10]
movzx eax, al
movzx edx, cl
mov rcx, r11
or rax, rdx
xor rcx, r10
dec rax
shr rax, 0x3f
dec rax
and rax, rcx
xor rax, r11
add rsp, 8
ret
Function at 0x18010da80
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x20
mov r14, rdx
movzx eax, r9b
mov rdx, qword [rdx + 8]
sub al, r8b
movzx ebx, al
mov rcx, r14
mov rdi, r9
sub rdx, qword [r14]
add rdx, rbx
call fcn.18009c590
mov rsi, qword [r14 + 8]
mov r11b, 1
mov rbp, rsi
sub rsi, qword [r14]
sub rbp, qword [r14]
sub rsi, rbx
mov r9, rbp
sub r9, rdi
cmp r9, rbp
je 0x18010db3b
mov r10, r9
sub r10, rsi
mov rdx, qword [r14]
mov r8, r10
shr r8, 0x3f
mov rax, r9
shr rax, 0x3f
mov rcx, r9
xor r8b, al
shr rcx, 0x3f
mov rax, rsi
inc r10
shr rax, 0x3f
xor cl, al
mov rax, r9
or r8b, cl
shr rax, 0x3f
movzx ecx, byte [rdx + r9]
xor r8b, al
dec r8b
lea eax, [r11 + 1]
xor cl, r11b
xor al, r11b
and cl, r8b
and al, r8b
xor byte [rdx + r9], cl
xor r11b, al
inc r9
cmp r9, rbp
jne 0x18010dae0
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret

Function at 0x18010db60
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 8
lea rax, [r8 - 3]
mov r10, rdx
cmp rax, 0xfc
jbe 0x18010db7b
mov rax, r8
add rsp, 8
ret
movzx edx, byte [rdx + r8 - 1]
movzx eax, dl
mov qword [rsp + 0x10], rbx
mov qword [rsp], rdi
movzx edi, r8b
xor al, dil
movzx r11d, dil
sub r11b, dl
movzx ecx, r11b
movzx ebx, r11b
xor cl, dil
or cl, al
lea eax, [rdx - 1]
xor cl, dil
shr al, 7
shr cl, 7
not dl
shr dl, 7
neg cl
and al, dl
neg al
or cl, al
mov eax, edi
sub rax, 1
je 0x18010dc13
nop dword [rax]
movzx r8d, byte [rax + r10]
mov rdx, rax
shr rdx, 0x3f
dec r8b
xor r8b, byte [rax + r10 - 1]
mov r9, rbx
sub r9, rax
shr r9, 0x3f
or r9b, dl
lea edx, [r8 - 1]
neg r9b
shr dl, 7
not r8b
shr r8b, 7
and dl, r8b
dec dl
and r9b, dl
or cl, r9b
sub rax, 1
jne 0x18010dbd0
mov rbx, qword [rsp + 0x10]
mov rax, rdi
mov rdi, qword [rsp]
movzx edx, r11b
xor rax, rdx
movzx edx, cl
and rax, rdx
movzx ecx, r11b
xor rax, rcx
add rsp, 8
ret
Function at 0x18010fdc0
Capabilities:
Encode data using xor

Disassembly:
push rsi
push r14
push r15
sub rsp, 0x20
mov rax, qword [rcx]
mov r15, r8
mov rsi, rdx
mov r14, rcx
call qword [rax + 0x20]
test al, al
jne 0x18010fde5
mov rcx, r14
call fcn.1800a53c0
mov rax, qword [r14 + 0x10]
cmp qword [r14 + 8], rax
je 0x18010ff46
mov rcx, qword [r14 + 0x38]
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x48], rbp
mov rbp, r15
mov qword [rsp + 0x50], rdi
mov rdi, qword [r14 + 0x50]
test rcx, rcx
je 0x18010fe4c
mov rdx, qword [r14 + 0x20]
mov rax, rdi
sub rax, rcx
mov rbx, r15
cmp rax, r15
cmovb rbx, rax
add rdx, rcx
mov r8, rbx
mov rcx, rsi
call fcn.1801101b0
add qword [r14 + 0x38], rbx
sub rbp, rbx
add rsi, rbx
cmp qword [r14 + 0x38], rdi
jne 0x18010fe4c
mov rcx, r14
call fcn.18010f760
mov rbx, rbp
cmp rbp, rdi
jb 0x18010ff12
nop dword [rax + rax]
mov r9, qword [r14 + 0x20]
xor ecx, ecx
test rdi, rdi
je 0x18010fef8
cmp rdi, 0x10
jb 0x18010feca
lea rdx, [rdi - 1]
lea rax, [r9 - 1]
add rdx, rsi
add rax, rdi
cmp rsi, rax
ja 0x18010fe8d
cmp rdx, r9
jae 0x18010feca
mov rdx, rdi
and rdx, 0xfffffffffffffff0
mov r8, r9
mov rax, rsi
sub r8, rsi
nop dword [rax]
movdqu xmm0, xmmword [rax]
add rcx, 0x10
movdqu xmm1, xmmword [r8 + rax]
movdqu xmmword [r8 + rax], xmm0
lea rax, [rax + 0x10]
xorps xmm1, xmm0
movdqu xmmword [rax - 0x10], xmm1
cmp rcx, rdx
jne 0x18010fea0
cmp rcx, rdi
je 0x18010fef8
sub r9, rsi
lea rax, [rcx + rsi]
mov r8, rdi
sub r8, rcx
nop word [rax + rax]
movzx ecx, byte [rax]
movzx edx, byte [rax + r9]
mov byte [rax + r9], cl
xor byte [rax], dl
lea rax, [rax + 1]
sub r8, 1
jne 0x18010fee0
sub rbp, rdi
mov rcx, r14
mov rbx, rbp
add rsi, rdi
call fcn.18010f760
cmp rbp, rdi
jae 0x18010fe60
mov rdi, qword [rsp + 0x50]
test rbx, rbx
je 0x18010ff2f
mov rdx, qword [r14 + 0x20]
mov r8, rbp
mov rcx, rsi
call fcn.1801101b0
add qword [r14 + 0x38], rbx
mov rbp, qword [rsp + 0x48]
mov rax, r15
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop r15
pop r14
pop rsi
ret
lea r8, [0x1803e3c00]
lea rdx, str.process_msg
lea rcx, str.m_state.empty____false
call fcn.1800d2170
int3

Function at 0x1801101b0
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 8
xor r9d, r9d
mov r10, rdx
test r8, r8
je 0x180110258
cmp r8, 0x10
jb 0x18011022e
lea rdx, [rcx - 1]
lea rax, [r8 - 1]
add rdx, r8
add rax, r10
cmp rcx, rax
ja 0x1801101e1
cmp rdx, r10
jae 0x18011022e
mov rdx, r8
mov qword [rsp], rbx
and rdx, 0xfffffffffffffff0
mov r11, r10
mov rax, rcx
sub r11, rcx
nop word [rax + rax]
movdqu xmm0, xmmword [rax]
add r9, 0x10
movdqu xmm1, xmmword [r11 + rax]
movdqu xmmword [r11 + rax], xmm0
lea rax, [rax + 0x10]
xorps xmm1, xmm0
movdqu xmmword [rax - 0x10], xmm1
cmp r9, rdx
jne 0x180110200
mov rbx, qword [rsp]
cmp r9, r8
je 0x180110258
sub r10, rcx
lea rax, [r9 + rcx]
sub r8, r9
nop dword [rax + rax]
movzx ecx, byte [rax]
movzx edx, byte [rax + r10]
mov byte [rax + r10], cl
xor byte [rax], dl
lea rax, [rax + 1]
sub r8, 1
jne 0x180110240
add rsp, 8
ret
Function at 0x180111100
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x40
mov rbx, qword [rcx]
mov rdi, r8
mov rsi, qword [rdx]
and edi, 0x1f
mov r9, rsi
mov rcx, r8
sub r9, rbx
sub rcx, rdi
je 0x18011119c
mov rdx, rbx
nop dword [rax]
movups xmm0, xmmword [rdx]
xor eax, eax
movups xmm1, xmmword [rdx + 0x10]
movups xmmword [rsp], xmm0
movups xmm0, xmmword [r9 + rdx]
movups xmmword [rsp + 0x10], xmm1
movups xmm1, xmmword [r9 + rdx + 0x10]
movups xmmword [rsp + 0x20], xmm0
movups xmmword [rsp + 0x30], xmm1
nop word [rax + rax]
movdqu xmm0, xmmword [rsp + rax]
movdqu xmm1, xmmword [rsp + rax + 0x20]
xorps xmm1, xmm0
movdqu xmmword [rsp + rax], xmm1
add rax, 0x10
cmp rax, 0x20
jl 0x180111160
movups xmm0, xmmword [rsp]
movups xmm1, xmmword [rsp + 0x10]
movups xmmword [rdx], xmm0
movups xmmword [rdx + 0x10], xmm1
add rdx, 0x20
mov rax, rdx
sub rax, rbx
cmp rax, rcx
jne 0x180111130
cmp rcx, r8
je 0x180111211
cmp rdi, 8
jb 0x1801111f4
lea r10, [r8 - 1]
lea rax, [r8 - 1]
add r10, rbx
add rax, rsi
lea rdx, [rbx + rcx]
lea r11, [rsi + rcx]
cmp rdx, rax
ja 0x1801111c7
cmp r10, r11
jae 0x1801111f4
and edi, 7
mov rax, r8
sub rax, rdi
movq xmm0, qword [rdx]
add rcx, 8
movq xmm1, qword [r9 + rdx]
lea rdx, [rdx + 8]
xorps xmm1, xmm0
movq qword [rdx - 8], xmm1
cmp rcx, rax
jne 0x1801111d0
cmp rcx, r8
je 0x180111211
lea rax, [rbx + rcx]
sub r8, rcx
nop dword [rax + rax]
movzx ecx, byte [r9 + rax]
xor byte [rax], cl
lea rax, [rax + 1]
sub r8, 1
jne 0x180111200
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x40
pop rdi
ret
Function at 0x180112cd0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push r14
push r15
sub rsp, 0x30
mov rbp, rcx
mov qword [rsp + 0x58], rdi
mov rcx, qword [rcx + 8]
mov rdi, rdx
mov rax, qword [rcx]
call qword [rax + 0x28]
mov rdx, qword [rbp + 0x48]
lea rcx, [rbp + 0x10]
call fcn.18009c590
mov rdx, qword [rbp + 0x48]
lea rcx, [rbp + 0x28]
call fcn.18009c590
mov rcx, qword [rbp + 0x10]
mov r8, qword [rbp + 0x18]
sub r8, rcx
je 0x180112d21
xor edx, edx
call fcn.180283390
mov rcx, qword [rbp + 0x28]
mov r8, qword [rbp + 0x30]
sub r8, rcx
je 0x180112d35
xor edx, edx
call fcn.180283390
mov r9, qword [rdi + 8]
xor ebx, ebx
mov rax, qword [rbp + 0x48]
cmp r9, rax
jbe 0x180112d97
mov rcx, qword [rbp + 8]
lea rdx, [rsp + 0x20]
movups xmm0, xmmword [rdi]
mov qword [rsp + 0x50], rsi
mov rax, qword [rcx]
movaps xmmword [rsp + 0x20], xmm0
call qword [rax + reloc.WS2_32.dll_recv]
mov rdi, qword [rbp + 8]
mov rax, qword [rbp + 0x10]
mov rcx, rdi
mov qword [rsp + 0x20], rax
mov rsi, qword [rdi]
call qword [rsi]
mov qword [rsp + 0x28], rax
lea rdx, [rsp + 0x20]
movaps xmm0, xmmword [rsp + 0x20]
mov rcx, rdi
movdqa xmmword [rsp + 0x20], xmm0
call qword [rsi + 0x18]
mov rsi, qword [rsp + 0x50]
jmp 0x180112e07
test r9, r9
je 0x180112e07
mov r10, rbx
mov r8, rbx
test rax, rax
je 0x180112e07
mov rdi, qword [rdi]
mov r11, r9
shr r11, 0x3f
mov rcx, r8
mov rdx, r10
sub rcx, r9
sub rdx, r9
xor rcx, r8
shr rdx, 0x3f
mov rax, r9
xor rax, r8
or rcx, rax
xor rcx, r8
shr rcx, 0x3f
neg rcx
and r8, rcx
mov rcx, r10
shr rcx, 0x3f
xor dl, cl
movzx eax, cl
xor al, r11b
or dl, al
mov rax, qword [rbp + 0x10]
xor dl, cl
neg dl
and dl, byte [rdi + r8]
inc r8
mov byte [r10 + rax], dl
inc r10
cmp r10, qword [rbp + 0x48]
jne 0x180112db1
mov rdi, qword [rsp + 0x58]
cmp qword [rbp + 0x48], rbx
je 0x180112e43
nop dword [rax]
nop word [rax + rax]
mov rax, qword [rbp + 0x10]
xor byte [rax + rbx], 0x36
mov rax, qword [rbp + 0x10]
movzx ecx, byte [rax + rbx]
mov rax, qword [rbp + 0x28]
xor cl, 0x6a
mov byte [rbx + rax], cl
inc rbx
cmp rbx, qword [rbp + 0x48]
jne 0x180112e20
mov rdx, qword [rbp + 0x10]
mov rcx, qword [rbp + 8]
mov rax, qword [rbp + 0x18]
sub rax, rdx
mov qword [rsp + 0x20], rdx
mov qword [rsp + 0x28], rax
lea rdx, [rsp + 0x20]
movaps xmm0, xmmword [rsp + 0x20]
mov rax, qword [rcx]
movdqa xmmword [rsp + 0x20], xmm0
call qword [rax + reloc.WS2_32.dll_recv]
mov rbx, qword [rsp + 0x60]
add rsp, 0x30
pop r15
pop r14
pop rbp
ret
Function at 0x1801141c0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
mov rbx, qword [rdx]
mov rax, rcx
mov rdi, rdx
mov rsi, rcx
xor rax, qword [rbx + 0x18]
mov r9, qword [rbx]
mov r10, qword [rbx + 8]
mov r11, qword [rbx + 0x10]
test r8, r8
je 0x180114236
nop
add r11, rax
add r9, r10
ror r10, 0x33
xor r10, r9
ror rax, 0x30
xor rax, r11
ror r9, 0x20
add r11, r10
add r9, rax
mov rdx, r11
ror r10, 0x2f
mov rcx, r11
shr rdx, 0x20
xor r10, r11
ror rax, 0x2b
shl rcx, 0x20
mov r11, rdx
or r11, rcx
xor rax, r9
sub r8, 1
jne 0x1801141f0
xor r9, rsi
mov rsi, qword [rsp + 0x10]
mov qword [rbx], r9
mov rcx, qword [rdi]
mov rbx, qword [rsp + 8]
mov qword [rcx + 8], r10
mov rcx, qword [rdi]
mov qword [rcx + 0x10], r11
mov rcx, qword [rdi]
mov rdi, qword [rsp + 0x18]
mov qword [rcx + 0x18], rax
ret

Function at 0x180114d60
Capabilities:
Hash data using sha512

Disassembly:
add rcx, 8
jmp method.Botan::BLAKE2b.virtual_40
push rbx
sub rsp, 0x20
mov rbx, rcx
mov rcx, qword [rcx + 0xa0]
mov r8, qword [rbx + 0xa8]
sub r8, rcx
and r8, 0xfffffffffffffff8
je 0x180172527
xor edx, edx
call fcn.180283390
xorps xmm0, xmm0
movups xmmword [rbx + 0x18], xmm0
movups xmmword [rbx + 0x28], xmm0
movups xmmword [rbx + 0x38], xmm0
movups xmmword [rbx + 0x48], xmm0
movups xmmword [rbx + 0x58], xmm0
movups xmmword [rbx + 0x68], xmm0
movups xmmword [rbx + 0x78], xmm0
movups xmmword [rbx + 0x88], xmm0
mov qword [rbx + 0x98], 0
mov rcx, qword [rbx + 0xd8]
mov r8, qword [rbx + 0xe0]
sub r8, rcx
je 0x180172572
xor edx, edx
call fcn.180283390
mov rcx, rbx
mov qword [rbx + 0xd0], 0
add rsp, 0x20
pop rbx
jmp 0x180172a70
push rbx
sub rsp, 0x30
mov rbx, rcx
mov rcx, qword [rcx + 0xa0]
test rcx, rcx
je 0x180172b79
mov r8d, 0x40
mov qword [rsp + 0x40], rdi
lea rdx, [0x180372a60]
call fcn.180282cf0
mov rdx, qword [rbx + 0xa0]
lea rdi, [rbx + 0x18]
mov eax, dword [rbx + 0x10]
xorps xmm0, xmm0
shr rax, 3
movzx ecx, al
movzx eax, byte [rbx + 0xd0]
or rax, 0x10100
shl rax, 8
or rcx, rax
xor eax, eax
xor qword [rdx], rcx
mov qword [rbx + 0xc0], rax
mov qword [rbx + 0xb8], rax
mov qword [rbx + 0xc8], rax
movups xmmword [rdi], xmm0
movups xmmword [rdi + 0x10], xmm0
movups xmmword [rdi + 0x20], xmm0
movups xmmword [rdi + 0x30], xmm0
movups xmmword [rdi + 0x40], xmm0
movups xmmword [rdi + 0x50], xmm0
movups xmmword [rdi + 0x60], xmm0
movups xmmword [rdi + 0x70], xmm0
mov qword [rdi + 0x80], rax
cmp qword [rbx + 0xd0], rax
jbe 0x180172b44
mov r8, qword [rbx + 0xe0]
mov rdx, qword [rbx + 0xd8]
mov rbx, r8
sub rbx, rdx
cmp rbx, 0x80
ja 0x180172b4f
sub r8, rdx
mov rcx, rdi
call fcn.180282cf0
add qword [rdi + 0x80], rbx
mov rdi, qword [rsp + 0x40]
add rsp, 0x30
pop rbx
ret
lea r9, [0x1803e4b20]
mov dword [rsp + 0x20], 0x5b
lea r8, str.append
lea rdx, [0x1803c6beb]
lea rcx, str.elements.size_____elements_until_alignment__
call fcn.1800d1f70
int3
lea r9, [0x1803e49b0]
mov dword [rsp + 0x20], 0x7b
lea r8, str.copy_mem
lea rdx, str.If_n___0_then_args_are_not_null
lea rcx, str.n___0_implies_in___nullptr__out___nullptr
call fcn.1800d1f70
int3
Function at 0x180121330
Capabilities:
Convert ip address from string

Disassembly:
push rbp
push rdi
push r14
sub rsp, 0xd0
mov rax, qword [0x180428208]
xor rax, rsp
mov qword [rsp + 0xb0], rax
xor edi, edi
mov r14, rdx
mov rbp, rcx
cmp byte [rcx + 0xa2f], dil
je 0x18012154f
cmp byte [rdx + 0x18], dil
mov qword [rsp + 0xc8], rsi
lea rsi, [rdx + 0x18]
je 0x180121547
lea r8, [rsp + 0x20]
mov rdx, rsi
lea ecx, [rdi + 2]
call qword [sym.imp.WS2_32.dll_inet_pton]
test eax, eax
jg 0x180121547
lea r8, [rsp + 0x70]
mov rdx, rsi
lea ecx, [rdi + 0x17]
call qword [sym.imp.WS2_32.dll_inet_pton]
test eax, eax
jg 0x180121547
cmp byte [rsi], dil
lea rdx, str.Host__s:_d_was_resolved.
mov r9d, dword [r14 + 0x14]
mov rcx, rbp
mov qword [rsp + 0x100], rbx
mov rbx, qword [r14]
mov qword [rsp + 0xc0], r15
lea r15, str._none_
mov r8, r15
cmovne r8, rsi
call fcn.1800c0f50
mov edx, 0x400
lea rcx, [rsp + 0x30]
call fcn.1800b3e90
mov edx, 0x400
lea rcx, [rsp + 0x50]
call fcn.1800b3e90
test rbx, rbx
je 0x1801214b4
lea r14d, [rdi + 0x20]
nop dword [rax]
mov ecx, dword [rbx + 4]
cmp ecx, 0x17
je 0x180121421
cmp ecx, 2
jne 0x1801214a7
xor eax, eax
mov byte [rsp + 0x80], 0
cmp ecx, 2
lea rsi, [rsp + 0x30]
cmovne rax, r14
add rsi, rax
cmp ecx, 2
je 0x18012144e
cmp ecx, 0x17
jne 0x180121469
mov rdx, qword [rbx + 0x20]
add rdx, 8
jmp 0x180121456
mov rdx, qword [rbx + 0x20]
add rdx, 4
mov r9d, 0x2e
lea r8, [rsp + 0x80]
call sub.WS2_32.dll_inet_ntop
mov rcx, rsi
call fcn.1800a3130
test rax, rax
je 0x18012148d
mov r8d, 2
lea rdx, [0x1803c7d5c]
mov rcx, rsi
call fcn.1800b3ee0
mov edi, eax
test edi, edi
jne 0x1801214cf
lea rdx, [rsp + 0x80]
mov rcx, rsi
call fcn.1800b3ef0
mov edi, eax
test eax, eax
jne 0x1801214cf
mov rbx, qword [rbx + 0x28]
test rbx, rbx
jne 0x180121410
lea rcx, [rsp + 0x50]
call fcn.1800a3130
test rax, rax
je 0x1801214e0
lea rcx, [rsp + 0x50]
call fcn.1800a2a30
jmp 0x1801214e3
lea rdx, str.too_many_IP__cant_show
mov rcx, rbp
call fcn.1800c0f50
jmp 0x180121523
mov rax, r15
mov r8, rax
lea rdx, str.IPv6:__s
mov rcx, rbp
call fcn.1800c0f50
lea rcx, [rsp + 0x30]
call fcn.1800a3130
test rax, rax
je 0x180121511
lea rcx, [rsp + 0x30]
call fcn.1800a2a30
mov r15, rax
mov r8, r15
lea rdx, str.IPv4:__s
mov rcx, rbp
call fcn.1800c0f50
lea rcx, [rsp + 0x30]
call fcn.1800b3eb0
lea rcx, [rsp + 0x50]
call fcn.1800b3eb0
mov r15, qword [rsp + 0xc0]
mov rbx, qword [rsp + 0x100]
mov rsi, qword [rsp + 0xc8]
mov rcx, qword [rsp + 0xb0]
xor rcx, rsp
call fcn.1800a5910
add rsp, 0xd0
pop r14
pop rdi
pop rbp
ret