joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1800a5280
Capabilities:
Encrypt data using curve25519

Disassembly:
jmp 0x1800a5280
mov qword [rsp + 0x18], rbx
push rbp
lea rbp, [rsp - 0x70]
mov eax, 0x170
call fcn.180001055
sub rsp, rax
mov rax, qword [0x1802946b8]
xor rax, rsp
mov qword [rbp + 0x60], rax
movups xmm0, xmmword [rdx]
mov rbx, rcx
lea rcx, [rsp + 0x50]
movups xmm1, xmmword [rdx + 0x10]
lea rdx, [rbp + 0x40]
movd eax, xmm0
movups xmmword [rbp + 0x50], xmm1
and al, 0xf8
psrldq xmm1, 8
movups xmmword [rbp + 0x40], xmm0
mov byte [rbp + 0x40], al
movq rax, xmm1
shr rax, 0x38
and al, 0x3f
or al, 0x40
mov byte [rbp + 0x5f], al
call fcn.1800aa530
mov ecx, dword [rsp + 0x78]
mov edx, dword [rbp - 0x60]
mov r8d, dword [rbp - 0x3c]
lea eax, [rcx + rdx]
sub edx, ecx
mov ecx, dword [rsp + 0x7c]
mov dword [rbp + 0x18], edx
mov edx, dword [rbp - 0x5c]
mov dword [rbp - 0x10], eax
lea eax, [rcx + rdx]
sub edx, ecx
mov ecx, dword [rbp - 0x80]
mov dword [rbp + 0x1c], edx
mov edx, dword [rbp - 0x58]
mov dword [rbp - 0xc], eax
lea eax, [rcx + rdx]
sub edx, ecx
mov ecx, dword [rbp - 0x7c]
mov dword [rbp + 0x20], edx
mov edx, dword [rbp - 0x54]
mov dword [rbp - 8], eax
lea eax, [rcx + rdx]
sub edx, ecx
mov ecx, dword [rbp - 0x78]
mov dword [rbp + 0x24], edx
mov edx, dword [rbp - 0x50]
mov dword [rbp - 4], eax
lea eax, [rcx + rdx]
sub edx, ecx
mov ecx, dword [rbp - 0x74]
mov dword [rbp + 0x28], edx
mov edx, dword [rbp - 0x4c]
mov dword [rbp], eax
lea eax, [rcx + rdx]
sub edx, ecx
mov ecx, dword [rbp - 0x70]
mov dword [rbp + 0x2c], edx
mov edx, dword [rbp - 0x48]
mov dword [rbp + 4], eax
lea eax, [rcx + rdx]
sub edx, ecx
mov ecx, dword [rbp - 0x6c]
mov dword [rbp + 0x30], edx
mov edx, dword [rbp - 0x44]
mov dword [rbp + 8], eax
lea eax, [rcx + rdx]
sub edx, ecx
mov ecx, dword [rbp - 0x68]
mov dword [rbp + 0x34], edx
mov edx, dword [rbp - 0x40]
mov dword [rbp + 0xc], eax
lea eax, [rcx + rdx]
sub edx, ecx
mov dword [rbp + 0x38], edx
lea rcx, [rsp + 0x20]
mov edx, dword [rbp - 0x64]
mov dword [rbp + 0x10], eax
lea eax, [rdx + r8]
sub r8d, edx
lea rdx, [rbp + 0x18]
mov dword [rbp + 0x3c], r8d
mov dword [rbp + 0x14], eax
call fcn.1800a5ce0
lea r8, [rsp + 0x20]
lea rdx, [rbp - 0x10]
lea rcx, [rbp - 0x10]
call fcn.1800a60a0
lea rdx, [rbp - 0x10]
mov rcx, rbx
call fcn.1800a8090
mov edx, 0x20
lea rcx, [rbp + 0x40]
call sym.libcrypto_1_1_x64.dll_OPENSSL_cleanse
mov rcx, qword [rbp + 0x60]
xor rcx, rsp
call fcn.1800028c4
mov rbx, qword [rsp + 0x190]
add rsp, 0x170
pop rbp
ret
Function at 0x180101320
Capabilities:
Query environment variable

Disassembly:
jmp 0x180101320
push rbx
mov eax, 0x20
call fcn.180001055
sub rsp, rax
mov rbx, rcx
call sym.libcrypto_1_1_x64.dll_OPENSSL_issetugid
test eax, eax
je 0x180101343
xor eax, eax
add rsp, 0x20
pop rbx
ret
mov rcx, rbx
add rsp, 0x20
pop rbx
jmp qword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll_getenv]
Function at 0x180103b90
Capabilities:
Encrypt data using rc4 prga

Disassembly:
jmp 0x180103b90
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov rbp, rsp
mov eax, 0x50
call fcn.180001055
sub rsp, rax
mov rax, qword [0x1802946b8]
xor rax, rsp
mov qword [rbp - 8], rax
mov rax, qword [rbp + 0x60]
mov r14d, r8d
movzx r8d, byte [rax + 4]
lea rdi, [rax + 1]
mov r13, qword [rbp + 0x68]
mov rsi, rcx
movzx ecx, byte [rdi + 5]
mov r12, rdx
movzx r10d, byte [rax]
lea rdx, [rdi + 5]
mov qword [rbp - 0x18], rax
xor r15d, r15d
movzx eax, byte [rdi]
mov ebx, dword [r13]
shl eax, 0x10
shl r10d, 0x18
or r10d, eax
shl r8d, 0x18
movzx eax, byte [rdi + 1]
shl eax, 8
or r10d, eax
shl ecx, 8
movzx eax, byte [rdi + 2]
or r10d, eax
mov qword [rbp - 0x28], r9
movzx eax, byte [rdi + 4]
shl eax, 0x10
or r8d, eax
mov qword [rbp - 0x20], r13
movzx eax, byte [rdx + 1]
or ecx, eax
mov dword [rbp - 0x30], r10d
or r8d, ecx
mov byte [rbp - 0xd], r10b
mov eax, r10d
mov dword [rbp - 0x2c], r8d
shr eax, 0x18
mov byte [rbp - 0x10], al
mov eax, r10d
shr eax, 0x10
mov byte [rbp - 0xf], al
mov eax, r10d
shr eax, 8
mov byte [rbp - 0xe], al
mov eax, r8d
shr eax, 0x18
mov byte [rbp - 0xc], al
mov eax, r8d
shr eax, 0x10
mov byte [rbp - 0xb], al
mov eax, r8d
shr eax, 8
mov byte [rbp - 0xa], al
mov byte [rbp - 9], r8b
test r14d, r14d
je 0x180103d54
mov r13, qword [rbp - 0x28]
sub r12, rsi
movzx edx, r8b
movzx r9d, r10b
nop dword [rax]
dec r14d
test ebx, ebx
jne 0x180103cf3
mov rdx, r13
lea rcx, [rbp - 0x30]
call sym.libcrypto_1_1_x64.dll_IDEA_encrypt
mov r10d, dword [rbp - 0x30]
mov eax, r10d
mov r8d, dword [rbp - 0x2c]
movzx r9d, r10b
shr eax, 0x18
movzx edx, r8b
mov byte [rbp - 0x10], al
mov eax, r10d
shr eax, 0x10
mov byte [rbp - 0xf], al
mov eax, r10d
shr eax, 8
mov byte [rbp - 0xe], al
mov eax, r8d
shr eax, 0x18
mov byte [rbp - 0xc], al
mov eax, r8d
shr eax, 0x10
mov byte [rbp - 0xb], al
mov eax, r8d
shr eax, 8
mov byte [rbp - 0xa], al
inc r15d
mov byte [rbp - 0xd], r10b
mov byte [rbp - 9], dl
movsxd rax, ebx
movzx ecx, byte [rbp + rax - 0x10]
xor cl, byte [rsi]
mov byte [r12 + rsi], cl
inc rsi
inc ebx
and ebx, 7
test r14d, r14d
jne 0x180103c90
mov r13, qword [rbp - 0x20]
test r15d, r15d
je 0x180103d54
mov rcx, qword [rbp - 0x18]
mov eax, r10d
shr eax, 0x18
mov byte [rcx], al
mov eax, r10d
shr eax, 0x10
mov byte [rdi], al
mov eax, r8d
shr eax, 0x18
shr r10d, 8
mov byte [rdi + 1], r10b
mov byte [rdi + 2], r9b
mov byte [rdi + 3], al
mov eax, r8d
shr eax, 0x10
mov byte [rdi + 4], al
shr r8d, 8
mov byte [rdi + 5], r8b
mov byte [rdi + 6], dl
mov dword [r13], ebx
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.1800028c4
mov rbx, qword [rsp + 0x90]
add rsp, 0x50
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret

Function at 0x1801091e0
Capabilities:
Encrypt data using chaskey
Hash data using murmur3
Resolve function by parsing pe exports

Disassembly:
jmp 0x1801091e0
mov eax, 0x28
call fcn.180001055
sub rsp, rax
lea r8d, [rax - 0x27]
add rsp, 0x28
jmp fcn.180003706
Function at 0x18010a050
Capabilities:
Resolve function by parsing pe exports

Disassembly:
jmp 0x18010a050
mov eax, 0x28
call fcn.180001055
sub rsp, rax
lea r8d, [rax - 0x27]
add rsp, 0x28
jmp fcn.1800067f3
Function at 0x18010b279
Capabilities:
Encode data using xor

Disassembly:
test r8, r8
je 0x18010b46a
push rbx
mov eax, 0xd0
call fcn.180001055
sub rsp, rax
mov rax, qword [0x1802946b8]
xor rax, rsp
mov qword [rsp + 0xb0], rax
mov qword [rsp + 0xe8], rbp
mov rbx, rdx
mov qword [rsp + 0xf0], rsi
lea rbp, [r8 - 1]
mov qword [rsp + 0xf8], rdi
mov qword [rsp + 0xc8], r14
lea r14, [rcx + 0xc]
shr rbp, 3
mov qword [rsp + 0xc0], r15
inc rbp
lea r15, [rcx + 0x14]
nop word [rax + rax]
movzx eax, byte [rbx + 1]
mov rcx, r14
movzx edi, byte [rbx]
movzx esi, byte [rbx + 4]
lea rbx, [rbx + 8]
shl eax, 8
or edi, eax
movzx eax, byte [rbx - 6]
shl eax, 0x10
or edi, eax
movzx eax, byte [rbx - 5]
shl eax, 0x18
or edi, eax
movzx eax, byte [rbx - 3]
shl eax, 8
or esi, eax
mov dword [rsp + 0x20], edi
movzx eax, byte [rbx - 2]
shl eax, 0x10
or esi, eax
mov dword [rsp + 0x28], edi
movzx eax, byte [rbx - 1]
and byte [r14], 0xdf
and byte [r15], 0xbf
or byte [r14], 0x40
or byte [r15], 0x20
shl eax, 0x18
or esi, eax
mov dword [rsp + 0x24], esi
mov dword [rsp + 0x2c], esi
call sym.libcrypto_1_1_x64.dll_DES_set_odd_parity
lea rdx, [rsp + 0x30]
mov rcx, r14
call sym.libcrypto_1_1_x64.dll_DES_set_key_unchecked
mov r8d, 1
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x28]
call sym.libcrypto_1_1_x64.dll_DES_encrypt1
mov rcx, r15
call sym.libcrypto_1_1_x64.dll_DES_set_odd_parity
lea rdx, [rsp + 0x30]
mov rcx, r15
call sym.libcrypto_1_1_x64.dll_DES_set_key_unchecked
mov r8d, 1
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x20]
call sym.libcrypto_1_1_x64.dll_DES_encrypt1
mov r8d, dword [rsp + 0x20]
mov edx, dword [rsp + 0x24]
xor r8d, edi
xor edi, dword [rsp + 0x28]
xor edx, esi
xor esi, dword [rsp + 0x2c]
mov eax, edi
mov byte [r14], dil
shr eax, 8
mov byte [r14 + 1], al
mov eax, edi
shr eax, 0x10
mov byte [r14 + 2], al
mov eax, edx
shr eax, 8
shr edi, 0x18
mov byte [r14 + 3], dil
mov byte [r14 + 4], dl
mov byte [r14 + 5], al
mov eax, edx
shr eax, 0x10
mov byte [r14 + 6], al
mov eax, r8d
shr eax, 8
shr edx, 0x18
mov byte [r14 + 7], dl
mov byte [r15], r8b
mov byte [r15 + 1], al
mov eax, r8d
shr eax, 0x10
mov byte [r15 + 2], al
shr r8d, 0x18
mov byte [r15 + 3], r8b
mov byte [r15 + 4], sil
mov eax, esi
shr eax, 8
mov byte [r15 + 5], al
mov eax, esi
shr eax, 0x10
shr esi, 0x18
mov byte [r15 + 6], al
mov byte [r15 + 7], sil
sub rbp, 1
jne 0x18010b2e0
mov r15, qword [rsp + 0xc0]
mov r14, qword [rsp + 0xc8]
mov rdi, qword [rsp + 0xf8]
mov rsi, qword [rsp + 0xf0]
mov rbp, qword [rsp + 0xe8]
mov rcx, qword [rsp + 0xb0]
xor rcx, rsp
call fcn.1800028c4
add rsp, 0xd0
pop rbx
ret
Function at 0x18010c340
Capabilities:
Encode data using xor

Disassembly:
jmp 0x18010c340
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov eax, 0x40
call fcn.180001055
sub rsp, rax
mov rax, qword [0x1802946b8]
xor rax, rsp
mov qword [rsp + 0x38], rax
movzx edi, byte [rcx]
mov rbp, r9
mov r14, qword [rcx + 0x28]
mov r13, r8
mov r15, qword [rcx + 0x30]
mov r12, rdx
mov byte [rsp + 0x20], dil
mov rbx, rcx
test dil, 0x40
jne 0x18010c398
lea rdx, [rcx + 0x10]
mov r8, r15
call r14
xor esi, esi
movzx edi, dil
and edi, 7
mov eax, reloc.WS2_32.dll_ntohs
sub eax, edi
mov byte [rbx], dil
mov dword [rsp + 0x24], eax
mov ecx, esi
cmp eax, 0xf
jae 0x18010c3d7
mov edx, eax
add rdx, rbx
nop dword [rax + rax]
movzx eax, byte [rdx]
mov byte [rdx], sil
lea rdx, [rdx + 1]
or rcx, rax
shl rcx, 8
sub rdi, 1
jne 0x18010c3c0
movzx eax, byte [rbx + 0xf]
or rcx, rax
mov byte [rbx + 0xf], 1
cmp rcx, rbp
je 0x18010c3f1
mov eax, 0xffffffff
jmp 0x18010c4fa
cmp rbp, 0x10
jb 0x18010c46f
mov rsi, rbp
shr rsi, 4
imul rax, rsi, 0xfffffffffffffff0
add rbp, rax
nop word [rax + rax]
mov r8, r15
lea rdx, [rsp + 0x28]
mov rcx, rbx
call r14
mov eax, 8
dec eax
add byte [rax + rbx + 8], 1
jne 0x18010c430
test eax, eax
jne 0x18010c423
mov rax, qword [r12]
lea rdx, [rbx + 0x10]
xor rax, qword [rsp + 0x28]
lea rcx, [rbx + 0x10]
mov qword [r13], rax
mov r8, r15
xor qword [rbx + 0x10], rax
mov rax, qword [r12 + 8]
xor rax, qword [rsp + 0x30]
mov qword [r13 + 8], rax
xor qword [rbx + 0x18], rax
call r14
add r12, 0x10
add r13, 0x10
sub rsi, 1
jne 0x18010c410
test rbp, rbp
je 0x18010c4b7
mov r8, r15
lea rdx, [rsp + 0x28]
mov rcx, rbx
call r14
test rbp, rbp
je 0x18010c4aa
mov rcx, rsi
nop word [rax + rax]
movzx eax, byte [rcx + r12]
inc esi
xor al, byte [rsp + rcx + 0x28]
mov byte [rcx + r13], al
xor byte [rcx + rbx + 0x10], al
mov ecx, esi
cmp rcx, rbp
jb 0x18010c490
lea rcx, [rbx + 0x10]
mov r8, r15
mov rdx, rcx
call r14
mov ecx, dword [rsp + 0x24]
cmp ecx, 0x10
jae 0x18010c4d1
mov eax, reloc.WS2_32.dll_recv
lea rdi, [rbx + rcx]
sub eax, ecx
mov ecx, eax
xor eax, eax
rep stosb byte [rdi], al
mov r8, r15
lea rdx, [rsp + 0x28]
mov rcx, rbx
call r14
mov rax, qword [rsp + 0x28]
xor qword [rbx + 0x10], rax
mov rax, qword [rsp + 0x30]
xor qword [rbx + 0x18], rax
movzx eax, byte [rsp + 0x20]
mov byte [rbx], al
xor eax, eax
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.1800028c4
mov rbx, qword [rsp + 0x88]
add rsp, 0x40
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x18010c5a0
Capabilities:
Encode data using xor

Disassembly:
jmp 0x18010c5a0
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov eax, 0x68
call fcn.180001055
sub rsp, rax
mov rax, qword [0x1802946b8]
xor rax, rsp
mov qword [rsp + 0x58], rax
movzx edi, byte [rcx]
mov rbp, r9
mov r10, qword [rsp + 0xd0]
mov r13, r8
mov rax, qword [rcx + 0x28]
mov r12, rdx
mov r15, qword [rcx + 0x30]
mov rbx, rcx
mov qword [rsp + 0x40], r10
lea r9, [rcx + 0x10]
mov byte [rsp + 0x30], dil
mov qword [rsp + 0x38], rax
test dil, 0x40
jne 0x18010c612
mov r8, r15
mov rdx, r9
call rax
mov r10, qword [rsp + 0x40]
lea r9, [rbx + 0x10]
xor esi, esi
movzx edi, dil
and edi, 7
mov r14d, reloc.WS2_32.dll_ntohs
sub r14d, edi
mov byte [rbx], dil
mov ecx, esi
cmp r14d, 0xf
jae 0x18010c657
mov edx, r14d
add rdx, rbx
nop word [rax + rax]
movzx eax, byte [rdx]
mov byte [rdx], sil
lea rdx, [rdx + 1]
or rcx, rax
shl rcx, 8
sub rdi, 1
jne 0x18010c640
movzx eax, byte [rbx + 0xf]
or rcx, rax
mov byte [rbx + 0xf], 1
cmp rcx, rbp
je 0x18010c671
mov eax, 0xffffffff
jmp 0x18010c748
mov rdi, rbp
shr rdi, 4
test rdi, rdi
je 0x18010c6b4
mov qword [rsp + 0x28], r9
mov r8, rdi
mov r9, r15
mov qword [rsp + 0x20], rbx
mov rdx, r13
mov rcx, r12
call r10
shl rdi, 4
add r12, rdi
add r13, rdi
sub rbp, rdi
je 0x18010c706
shr rdi, 4
mov rcx, rbx
mov rdx, rdi
call fcn.18010d0b0
test rbp, rbp
je 0x18010c706
mov rdi, qword [rsp + 0x38]
lea rdx, [rsp + 0x48]
mov r8, r15
mov rcx, rbx
call rdi
test rbp, rbp
je 0x18010c6fa
mov rdx, rsi
nop dword [rax]
nop word [rax + rax]
movzx eax, byte [rdx + r12]
inc esi
xor al, byte [rsp + rdx + 0x48]
mov byte [rdx + r13], al
xor byte [rdx + rbx + 0x10], al
mov edx, esi
cmp rdx, rbp
jb 0x18010c6e0
lea rcx, [rbx + 0x10]
mov r8, r15
mov rdx, rcx
call rdi
cmp r14d, 0x10
jae 0x18010c71e
mov ecx, reloc.WS2_32.dll_recv
mov edi, r14d
sub ecx, r14d
add rdi, rbx
xor eax, eax
rep stosb byte [rdi], al
mov r8, r15
lea rdx, [rsp + 0x48]
mov rcx, rbx
call qword [rsp + 0x38]
mov rax, qword [rsp + 0x48]
xor qword [rbx + 0x10], rax
mov rax, qword [rsp + 0x50]
xor qword [rbx + 0x18], rax
movzx eax, byte [rsp + 0x30]
mov byte [rbx], al
xor eax, eax
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.1800028c4
add rsp, 0x68
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x18010d390
Capabilities:
Encode data using xor

Disassembly:
jmp 0x18010d390
mov qword [rsp + 8], rbx
mov qword [rsp + 0x20], r9
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov eax, 0x20
call fcn.180001055
sub rsp, rax
cmp dword [rsp + 0x90], 0
mov r10, r9
mov r15, qword [rsp + 0x88]
mov rdi, r8
mov rbp, qword [rsp + 0x80]
mov rsi, rdx
mov r14, rcx
mov ebx, dword [r15]
je 0x18010d4ee
test ebx, ebx
je 0x18010d407
test rdi, rdi
je 0x18010d407
movzx eax, byte [r14]
dec rdi
mov ecx, ebx
inc r14
xor byte [rcx + rbp], al
movzx eax, byte [rcx + rbp]
mov byte [rsi], al
inc rsi
inc ebx
and ebx, 0xf
jne 0x18010d3e3
mov r9, qword [rsp + 0x98]
cmp rdi, 0x10
jb 0x18010d4b4
mov r15, rsi
mov r13, rdi
shr r13, 4
mov r12, r14
imul rax, r13, 0xfffffffffffffff0
sub r15, rbp
sub r12, rbp
add rdi, rax
mov rax, r13
shl rax, 4
add rsi, rax
mov qword [rsp + 0x68], rsi
add r14, rax
mov rsi, qword [rsp + 0x78]
nop word [rax + rax]
mov r8, rsi
mov rdx, rbp
mov rcx, rbp
call r9
cmp ebx, 0x10
jae 0x18010d48a
mov edx, reloc.WS2_32.dll_ntohs
mov ecx, ebx
sub edx, ebx
add rcx, rbp
shr edx, 3
inc edx
mov rax, qword [r12 + rcx]
xor qword [rcx], rax
mov rax, qword [rcx]
mov qword [r15 + rcx], rax
lea rcx, [rcx + 8]
sub rdx, 1
jne 0x18010d472
mov r9, qword [rsp + 0x98]
add r15, 0x10
add r12, 0x10
xor ebx, ebx
sub r13, 1
jne 0x18010d450
mov rsi, qword [rsp + 0x68]
mov r10, qword [rsp + 0x78]
mov r15, qword [rsp + 0x88]
test rdi, rdi
je 0x18010d5fb
mov r8, r10
mov rdx, rbp
mov rcx, rbp
call r9
nop dword [rax]
mov ecx, ebx
inc ebx
movzx eax, byte [rcx + r14]
xor byte [rcx + rbp], al
movzx eax, byte [rcx + rbp]
mov byte [rcx + rsi], al
sub rdi, 1
jne 0x18010d4d0
jmp 0x18010d5fb
test ebx, ebx
je 0x18010d518
test rdi, rdi
je 0x18010d518
movzx edx, byte [r14]
dec rdi
mov ecx, ebx
inc r14
movzx eax, byte [rcx + rbp]
xor al, dl
mov byte [rsi], al
inc rsi
inc ebx
mov byte [rcx + rbp], dl
and ebx, 0xf
jne 0x18010d4f2
mov r13, qword [rsp + 0x98]
cmp rdi, 0x10
jb 0x18010d5c5
mov r12, rdi
mov r15, rsi
shr r12, 4
sub r15, rbp
imul rax, r12, 0xfffffffffffffff0
add rdi, rax
mov qword [rsp + 0x70], rdi
mov rdi, qword [rsp + 0x78]
nop dword [rax + rax]
mov r8, rdi
mov rdx, rbp
mov rcx, rbp
call r13
cmp ebx, 0x10
jae 0x18010d59f
mov r9d, reloc.WS2_32.dll_ntohs
mov r8d, ebx
sub r9d, ebx
mov r10, r14
shr r9d, 3
add r8, rbp
sub r10, rsi
inc r9d
nop dword [rax]
mov rax, qword [r8]
lea rcx, [r15 + r8]
mov rdx, qword [rcx + r10]
lea r8, [r8 + 8]
xor rax, rdx
mov qword [rcx], rax
mov qword [r8 - 8], rdx
sub r9, 1
jne 0x18010d580
add rsi, 0x10
add r15, 0x10
add r14, 0x10
xor ebx, ebx
sub r12, 1
jne 0x18010d550
mov rdi, qword [rsp + 0x70]
mov r10, qword [rsp + 0x78]
mov r15, qword [rsp + 0x88]
test rdi, rdi
je 0x18010d5fb
mov r8, r10
mov rdx, rbp
mov rcx, rbp
call r13
nop word [rax + rax]
mov ecx, ebx
inc ebx
movzx edx, byte [rcx + r14]
movzx eax, byte [rcx + rbp]
xor al, dl
mov byte [rcx + rsi], al
mov byte [rcx + rbp], dl
sub rdi, 1
jne 0x18010d5e0
mov dword [r15], ebx
mov rbx, qword [rsp + 0x60]
add rsp, 0x20
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x18010db90
Capabilities:
Encode data using xor

Disassembly:
jmp 0x18010db90
mov qword [rsp + 0x20], r9
push rbx
push rbp
push rsi
push rdi
push r12
push r15
mov eax, 0x28
call fcn.180001055
sub rsp, rax
mov rsi, qword [rsp + 0x90]
mov r10, r9
mov r12, qword [rsp + 0x88]
mov rdi, r8
mov r15, rdx
mov rbp, rcx
mov ebx, dword [rsi]
test ebx, ebx
je 0x18010dbf2
nop dword [rax]
test rdi, rdi
je 0x18010dbf2
mov eax, ebx
dec rdi
movzx ecx, byte [rax + r12]
xor cl, byte [rbp]
inc rbp
mov byte [r15], cl
inc r15
inc ebx
and ebx, 0xf
jne 0x18010dbd0
mov r9, qword [rsp + 0x98]
mov rcx, qword [rsp + 0x80]
cmp rdi, 0x10
jb 0x18010dcbe
mov qword [rsp + 0x60], r13
xor ebx, ebx
mov r13, rdi
mov qword [rsp + 0x20], r14
shr r13, 4
mov rsi, r15
imul rax, r13, 0xfffffffffffffff0
mov r14, rbp
mov dword [rsp + 0x70], ebx
mov rbx, qword [rsp + 0x78]
add rdi, rax
mov rax, r13
sub rsi, r12
shl rax, 4
sub r14, r12
add r15, rax
add rbp, rax
nop dword [rax + rax]
mov r8, rbx
mov rdx, r12
call r9
mov rcx, qword [rsp + 0x80]
call fcn.18010e080
mov edx, 2
mov rcx, r12
nop
mov rax, qword [r14 + rcx]
xor rax, qword [rcx]
mov qword [rsi + rcx], rax
lea rcx, [rcx + 8]
sub rdx, 1
jne 0x18010dc70
mov rcx, qword [rsp + 0x80]
add rsi, 0x10
mov r9, qword [rsp + 0x98]
add r14, 0x10
sub r13, 1
jne 0x18010dc50
mov ebx, dword [rsp + 0x70]
mov rsi, qword [rsp + 0x90]
mov r10, qword [rsp + 0x78]
mov r14, qword [rsp + 0x20]
mov r13, qword [rsp + 0x60]
test rdi, rdi
je 0x18010dcf6
mov r8, r10
mov rdx, r12
call r9
mov rcx, qword [rsp + 0x80]
call fcn.18010e080
nop dword [rax]
mov ecx, ebx
inc ebx
movzx eax, byte [rcx + rbp]
xor al, byte [rcx + r12]
mov byte [rcx + r15], al
sub rdi, 1
jne 0x18010dce0
mov dword [rsi], ebx
add rsp, 0x28
pop r15
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x18010dd70
Capabilities:
Encode data using xor

Disassembly:
jmp 0x18010dd70
mov qword [rsp + 8], rbx
mov qword [rsp + 0x20], r9
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov eax, gethostbyname
call fcn.180001055
sub rsp, rax
mov r10, r9
mov rbx, r8
mov r9, qword [rsp + 0xa0]
mov r14, rdx
mov rbp, rcx
mov edi, dword [r9]
mov dword [rsp + 0x80], edi
test edi, edi
je 0x18010dde8
mov rdx, qword [rsp + 0x98]
nop dword [rax]
test rbx, rbx
je 0x18010dde1
mov eax, edi
dec rbx
movzx ecx, byte [rax + rdx]
xor cl, byte [rbp]
inc rbp
mov byte [r14], cl
inc r14
inc edi
and edi, 0xf
jne 0x18010ddc0
mov dword [rsp + 0x80], edi
mov r8, qword [rsp + 0x90]
mov esi, 1
movzx r12d, byte [r8 + 0xc]
lea r15, [r8 + 0xc]
mov r11, qword [rsp + 0xa8]
shl r12d, 8
movzx eax, byte [r8 + 0xd]
lea r13d, [rsi + 0xb]
or r12d, eax
movzx eax, byte [r8 + 0xe]
shl r12d, 8
or r12d, eax
movzx eax, byte [r8 + 0xf]
shl r12d, 8
or r12d, eax
cmp rbx, 0x10
jb 0x18010df1e
mov eax, 0x10000000
mov edi, r13d
mov qword [rsp + 0x20], r8
mov rdx, rbx
shr rdx, 4
mov r9, r10
cmp rdx, rax
cmova rdx, rax
add r12d, edx
mov r13, rdx
mov eax, r12d
mov ecx, r12d
sub r13, rax
cmp rax, rdx
cmovae r13, rdx
xor r12d, r12d
cmp rax, rdx
mov r8, r13
mov rdx, r14
cmovae r12d, ecx
mov rcx, rbp
call r11
mov r8, qword [rsp + 0x90]
mov eax, r12d
shr eax, 0x18
mov byte [r15], al
mov eax, r12d
shr eax, 0x10
mov byte [r8 + 0xd], al
mov eax, r12d
shr eax, 8
mov byte [r8 + 0xe], al
mov byte [r8 + 0xf], r12b
test r12d, r12d
jne 0x18010dedd
mov r8d, edi
mov eax, esi
mov rdx, r15
nop dword [rax + rax]
movzx ecx, byte [rdx - 1]
lea rdx, [rdx - 1]
add eax, ecx
mov byte [rdx], al
shr eax, 8
add r8d, 0xffffffff
jne 0x18010dec0
mov r8, qword [rsp + 0x90]
mov r10, qword [rsp + 0x88]
mov eax, 0x10000000
mov r11, qword [rsp + 0xa8]
shl r13, 4
sub rbx, r13
add r14, r13
add rbp, r13
cmp rbx, 0x10
jae 0x18010de40
mov edi, dword [rsp + 0x80]
mov r13d, listen
mov r9, qword [rsp + 0xa0]
test rbx, rbx
je 0x18010dfc1
mov rax, qword [rsp + 0x98]
xor ecx, ecx
mov qword [rsp + 0x20], r8
mov r9, r10
mov r8, rsi
mov rdx, rax
mov qword [rax], rcx
mov qword [rax + 8], rcx
mov rcx, rax
call r11
mov rcx, qword [rsp + 0x90]
inc r12d
mov eax, r12d
shr eax, 0x18
mov byte [r15], al
mov eax, r12d
shr eax, 0x10
mov byte [rcx + 0xd], al
mov eax, r12d
shr eax, 8
mov byte [rcx + 0xe], al
mov byte [rcx + 0xf], r12b
test r12d, r12d
jne 0x18010df97
nop dword [rax + rax]
movzx eax, byte [r15 - 1]
lea r15, [r15 - 1]
add esi, eax
mov byte [r15], sil
shr esi, 8
add r13d, 0xffffffff
jne 0x18010df80
mov rdx, qword [rsp + 0x98]
nop
mov ecx, edi
inc edi
movzx eax, byte [rcx + rbp]
xor al, byte [rcx + rdx]
mov byte [rcx + r14], al
sub rbx, 1
jne 0x18010dfa0
mov rax, qword [rsp + 0xa0]
mov dword [rax], edi
jmp 0x18010dfc4
mov dword [r9], edi
mov rbx, qword [rsp + 0x70]
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x18010e850
Capabilities:
Encode data using xor

Disassembly:
jmp 0x18010e850
push rbx
push rdi
push r12
push r14
push r15
mov eax, gethostbyname
call fcn.180001055
sub rsp, rax
mov r15, r9
mov rdi, r8
mov r14, rdx
mov rbx, rcx
mov r12, r8
cmp r8, 0x10
ja 0x18010e88a
xor eax, eax
add rsp, 0x30
pop r15
pop r14
pop r12
pop rdi
pop rbx
ret
mov qword [rsp + 0x60], rbp
mov eax, reloc.WS2_32.dll_recv
mov rbp, qword [rsp + 0x80]
mov qword [rsp + 0x68], rsi
mov rsi, rdi
and esi, 0xf
mov qword [rsp + 0x70], r13
mov r13, qword [rsp + 0x88]
cmove esi, eax
mov qword [rsp + 0x28], r13
sub rdi, rsi
mov qword [rsp + 0x20], rbp
mov r8, rdi
call sym.libcrypto_1_1_x64.dll_CRYPTO_cbc128_encrypt
add rbx, rdi
add r14, rdi
test rsi, rsi
je 0x18010e8f0
mov rax, rbp
sub rbx, rbp
mov edx, esi
nop
movzx ecx, byte [rbx + rax]
xor byte [rax], cl
lea rax, [rax + 1]
sub rdx, 1
jne 0x18010e8e0
mov r8, r15
mov rdx, rbp
mov rcx, rbp
call r13
mov r8, rsi
lea rdx, [r14 - 0x10]
mov rcx, r14
call sub.VCRUNTIME140.dll_memcpy
movups xmm0, xmmword [rbp]
mov r13, qword [rsp + 0x70]
mov rax, r12
mov rsi, qword [rsp + 0x68]
mov rbp, qword [rsp + 0x60]
movups xmmword [r14 - 0x10], xmm0
add rsp, 0x30
pop r15
pop r14
pop r12
pop rdi
pop rbx
ret