joyce8/EMBER2024-capa huggingface dataset:
Function at 0x18005d728
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
mov rsi, rdx
mov rdi, rcx
or rax, 0xffffffffffffffff
inc rax
cmp byte [rcx + rax], 0
jne 0x18005d741
test rax, rax
je 0x18005d838
cmp byte [0x18010a364], 0
je 0x18005d7ba
lea rcx, [rsp + 0x50]
call fcn.18005a8d4
mov rbx, rax
cmp byte [rax + 0x4a], 0
je 0x18005d799
xor r9d, r9d
mov cl, r9b
and cl, 7
shl cl, 3
movabs r8, 0xd993efbb19cfe32d
shr r8, cl
xor byte [r9 + rax], r8b
inc r9
cmp r9, 0x4a
jb 0x18005d772
mov byte [rax + 0x4a], 0
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [rsp + 0x20], eax
lea r9, [0x180108580]
mov r8, rdi
mov rdx, rbx
mov ecx, 3
call fcn.18006a848
cmp byte [0x180108580], 0
je 0x18005d7d0
mov rdx, rsi
mov ecx, 1
call fcn.18005d240
mov ebx, 0x824
mov r8d, ebx
xor edx, edx
lea rcx, [0x180108580]
call fcn.1800a02d0
lea esi, [rbx - 1]
mov r8d, esi
mov rdx, rdi
lea rcx, [0x180108580]
call fcn.1800a8850
lea rcx, [0x180108510]
call fcn.180007dac
mov r8d, ebx
xor edx, edx
lea rcx, [0x180109220]
call fcn.1800a02d0
mov r8d, esi
mov rdx, rdi
lea rcx, [0x180109220]
call fcn.1800a8850
nop
lea rcx, [0x180108510]
call fcn.180007dc4
nop
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret

Function at 0x18005d858
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x20
cmp byte [0x18010a364], 0
mov rbx, rcx
je 0x18005d8b4
lea rcx, [rsp + 0x38]
call fcn.18005a7fc
cmp byte [rax + 0x2e], 0
je 0x18005d8a4
xor r9d, r9d
mov cl, r9b
movabs r8, 0xd993efbb19cfe32d
and cl, 7
shl cl, 3
shr r8, cl
xor byte [r9 + rax], r8b
inc r9
cmp r9, 0x2e
jb 0x18005d87d
mov byte [rax + 0x2e], 0
mov r8, rbx
mov rdx, rax
mov ecx, 3
call fcn.18006a848
xor edx, edx
lea rcx, [0x180108580]
mov r8d, 0x824
call fcn.1800a02d0
mov r8d, 0x823
lea rcx, [0x180108580]
mov rdx, rbx
add rsp, 0x20
pop rbx
jmp fcn.1800a8850

Function at 0x18005d8e4
Capabilities:
Create thread
Encode data using xor

Disassembly:
sub rsp, 0x38
cmp dword [0x180109104], 0
jne 0x18005d975
lea rax, [rsp + 0x48]
xor r9d, r9d
mov qword [rsp + 0x28], rax
lea r8, [0x18005bdc4]
and dword [rsp + 0x20], 0
xor edx, edx
xor ecx, ecx
call fcn.1800a8cdc
test rax, rax
jne 0x18005d96b
cmp byte [0x18010a364], al
je 0x18005d96b
lea rcx, [rsp + 0x40]
call fcn.180059d98
cmp byte [rax + 0x42], 0
je 0x18005d95e
xor r9d, r9d
mov cl, r9b
movabs r8, 0xd993efbb19cfe32d
and cl, 7
shl cl, 3
shr r8, cl
xor byte [r9 + rax], r8b
inc r9
cmp r9, 0x42
jb 0x18005d937
mov byte [rax + 0x42], 0
mov rdx, rax
mov ecx, 3
call fcn.18006a848
mov dword [0x180109104], 1
add rsp, 0x38
ret

Function at 0x18005d97c
Capabilities:
Check for time delay via gettickcount

Disassembly:
sub rsp, 0x28
inc dword [0x180108fe4]
call qword [sym.imp.KERNEL32.dll_GetTickCount]
xor edx, edx
xor ecx, ecx
mov dword [0x180108fd4], eax
add rsp, 0x28
jmp fcn.18005d240

Function at 0x18005d9a0
Capabilities:
Check for time delay via gettickcount

Disassembly:
push rbx
sub rsp, 0x20
inc dword [0x180108fe8]
mov rbx, rcx
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov rdx, rbx
xor ecx, ecx
mov dword [0x180108fd8], eax
add rsp, 0x20
pop rbx
jmp fcn.18005d240
Function at 0x18005da74
Capabilities:
Check for time delay via gettickcount
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x20
inc dword [0x180108fec]
mov rbx, rcx
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov rdx, rbx
xor ecx, ecx
mov dword [0x180108fdc], eax
add rsp, 0x20
pop rbx
jmp fcn.18005d240

Function at 0x18005daa0
Capabilities:
Encode data using xor

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x20], rdi
push rbp
lea rbp, [rax - 0x778]
sub rsp, 0x870
mov edi, r8d
mov rbx, rdx
mov rsi, rcx
xor edx, edx
mov r8d, 0x824
lea rcx, [rsp + 0x40]
call fcn.1800a02d0
mov dword [rbp + 0x764], ebx
mov dword [rbp + 0x768], edi
xor ebx, ebx
test rsi, rsi
je 0x18005daff
mov r8d, 0x823
mov rdx, rsi
lea rcx, [rsp + 0x40]
call fcn.1800a8850
lea rcx, [rsp + 0x20]
call fcn.18003d8c0
nop
mov edx, 0x555
lea rcx, [rsp + 0x20]
call fcn.18003e08c
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov edx, eax
lea rcx, [rsp + 0x20]
call fcn.18003e084
xor r9d, r9d
mov r8d, 0x82c
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x20]
call fcn.18003de9c
call fcn.180049c04
mov rcx, rax
mov r8d, 0x3e8
lea rdx, [rsp + 0x20]
call fcn.180077c5c
test rsi, rsi
je 0x18005dbba
cmp byte [0x18010a364], bl
je 0x18005dbba
lea rcx, [rbp + 0x790]
call fcn.180059e80
cmp byte [rax + 0x3d], bl
je 0x18005dba2
mov r9, rbx
mov cl, r9b
and cl, 7
shl cl, 3
movabs r8, 0xd993efbb19cfe32d
shr r8, cl
xor byte [r9 + rax], r8b
inc r9
cmp r9, 0x3d
jb 0x18005db7c
mov byte [rax + 0x3d], bl
mov r9d, dword [rbp + 0x764]
mov r8, rsi
mov rdx, rax
mov ecx, 3
call fcn.18006a848
nop
lea rcx, [rsp + 0x20]
call fcn.18001d6c0
lea r11, [rsp + 0x870]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret

Function at 0x18005dbe0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
push rsi
sub rsp, 0x30
mov rbx, rcx
or rsi, 0xffffffffffffffff
mov rax, rsi
inc rax
cmp byte [rcx + rax], 0
jne 0x18005dbf4
test rax, rax
je 0x18005dcec
cmp byte [0x18010a364], 0
je 0x18005dc6d
lea rcx, [rsp + 0x48]
call fcn.18005a3a0
mov r10, rax
cmp byte [rax + 0x46], 0
je 0x18005dc4c
xor r9d, r9d
mov cl, r9b
and cl, 7
shl cl, 3
movabs r8, 0xd993efbb19cfe32d
shr r8, cl
xor byte [r9 + rax], r8b
inc r9
cmp r9, 0x46
jb 0x18005dc25
mov byte [rax + 0x46], 0
mov eax, dword [0x18010850c]
mov dword [rsp + 0x20], eax
lea r9, [0x180108580]
mov r8, rbx
mov rdx, r10
mov ecx, 3
call fcn.18006a848
cmp byte [0x180108580], 0
je 0x18005dc83
mov rdx, rsi
mov ecx, 1
call fcn.18005d240
xor edx, edx
mov r8d, 0x824
lea rcx, [0x180108580]
call fcn.1800a02d0
mov esi, 0x823
mov r8d, esi
mov rdx, rbx
lea rcx, [0x180108580]
call fcn.1800a8850
lea rcx, [0x180108510]
call fcn.180007dac
xor edx, edx
lea r8d, [rsi + 1]
lea rcx, [0x180109220]
call fcn.1800a02d0
mov r8d, esi
mov rdx, rbx
lea rcx, [0x180109220]
call fcn.1800a8850
nop
lea rcx, [0x180108510]
call fcn.180007dc4
nop
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rsi
ret
Function at 0x18005dff4
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x20
lea rbx, str.kernel32.dll
mov rcx, rbx
lea rdx, str.CreateFileA
call fcn.18009b404
lea rdx, [0x1800d42e8]
mov qword [0x180109b30], rax
mov rcx, rbx
call fcn.18009b404
lea rdx, [0x1800d42f8]
mov qword [0x180109b38], rax
mov rcx, rbx
call fcn.18009b404
lea rdx, [0x1800d4308]
mov qword [0x180109b40], rax
mov rcx, rbx
call fcn.18009b404
lea rdx, [0x1800d4318]
mov qword [0x180109b48], rax
mov rcx, rbx
call fcn.18009b404
mov qword [0x180109b50], rax
call fcn.18009a9a8
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov rcx, rax
call fcn.18009acd0
lea rdx, [0x18005e1e0]
lea rcx, [0x180109b30]
call fcn.18009a470
cmp qword [0x180109b38], 0
je 0x18005e0b2
lea rdx, [0x18005e27c]
lea rcx, [0x180109b38]
call fcn.18009a470
lea rdx, [0x18005e1b8]
lea rcx, [0x180109b40]
call fcn.18009a470
lea rdx, [0x18005e37c]
lea rcx, [0x180109b48]
call fcn.18009a470
lea rdx, [0x18005e418]
lea rcx, [0x180109b50]
call fcn.18009a470
call fcn.18009aa00
mov byte [0x180109b58], 1
mov ebx, eax
test eax, eax
jne 0x18005e156
cmp byte [0x18010a364], al
je 0x18005e152
lea rcx, [rsp + 0x30]
call fcn.18005df24
mov r8, rax
cmp byte [rax + 0x2b], bl
je 0x18005e145
xor r9d, r9d
movabs r10, 0xd993efbb19cfe32d
mov cl, r9b
mov rax, r10
and cl, 7
shl cl, 3
shr rax, cl
xor byte [r9 + r8], al
inc r9
cmp r9, 0x2b
jb 0x18005e124
mov byte [r8 + 0x2b], 0
mov rdx, r8
mov ecx, 4
call fcn.18006a848
xor eax, eax
jmp 0x18005e1af
cmp byte [0x18010a364], 0
je 0x18005e1ad
lea rcx, [rsp + 0x30]
call fcn.18005de64
mov r8, rax
cmp byte [rax + 0x27], 0
je 0x18005e1a0
xor r9d, r9d
movabs r10, 0xd993efbb19cfe32d
mov cl, r9b
mov rax, r10
and cl, 7
shl cl, 3
shr rax, cl
xor byte [r9 + r8], al
inc r9
cmp r9, 0x27
jb 0x18005e17f
mov byte [r8 + 0x27], 0
mov rdx, r8
mov ecx, 3
call fcn.18006a848
mov eax, ebx
add rsp, 0x20
pop rbx
ret
Function at 0x18005ec8c
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x20
lea rdi, str.PR_Read
mov rdx, rdi
lea rcx, str.nss3.dll
call fcn.18009b404
lea rdx, str.PR_Write
mov qword [0x180109ba8], rax
lea rcx, str.nss3.dll
call fcn.18009b404
mov rcx, qword [0x180109ba8]
xor ebx, ebx
mov qword [0x180109bb0], rax
test rcx, rcx
je 0x18005ece0
test rax, rax
jne 0x18005ed17
mov rdx, rdi
lea rcx, str.nspr4.dll
call fcn.18009b404
lea rdx, str.PR_Write
mov qword [0x180109ba8], rax
lea rcx, str.nspr4.dll
call fcn.18009b404
mov rcx, qword [0x180109ba8]
mov qword [0x180109bb0], rax
test rcx, rcx
je 0x18005ed21
test rax, rax
jne 0x18005ed58
mov rdx, rdi
lea rcx, str.gecko_nspr4.dll
call fcn.18009b404
lea rdx, str.PR_Write
mov qword [0x180109ba8], rax
lea rcx, str.gecko_nspr4.dll
call fcn.18009b404
mov rcx, qword [0x180109ba8]
mov qword [0x180109bb0], rax
test rcx, rcx
je 0x18005ee32
test rax, rax
je 0x18005ee32
call fcn.18009a9a8
mov edi, eax
test eax, eax
jne 0x18005ee29
call qword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov rcx, rax
call fcn.18009acd0
mov edi, eax
test eax, eax
jne 0x18005ee29
lea rdx, [sym.OSMIMHK.DLL_int___cdecl_Mine_PR_Read_struct_PRFileDesc____ptr64__void____ptr64__int_]
lea rcx, [0x180109ba8]
call fcn.18009a470
mov edi, eax
test eax, eax
jne 0x18005ee29
lea rdx, [sym.OSMIMHK.DLL_int___cdecl_Mine_PR_Write_struct_PRFileDesc____ptr64__void_const____ptr64__int_]
lea rcx, [0x180109bb0]
call fcn.18009a470
mov edi, eax
test eax, eax
jne 0x18005ee29
call fcn.18009aa00
mov edi, eax
test eax, eax
jne 0x18005ee29
cmp byte [0x18010a364], bl
je 0x18005ee22
lea rcx, [rsp + 0x30]
call fcn.18005e7a0
mov r8, rax
cmp byte [rax + 0x25], bl
je 0x18005ee15
mov r9, rbx
movabs r10, 0xd993efbb19cfe32d
mov cl, r9b
mov rax, r10
and cl, 7
shl cl, 3
shr rax, cl
xor byte [r9 + r8], al
inc r9
cmp r9, 0x25
jb 0x18005edf5
mov byte [r8 + 0x25], bl
mov rdx, r8
mov ecx, 4
call fcn.18006a848
mov byte [0x180109bbc], 1
test edi, edi
sete bl
mov eax, ebx
jmp 0x18005ee84
cmp byte [0x18010a364], bl
je 0x18005ee82
lea rcx, [rsp + 0x30]
call fcn.18005e6d0
cmp byte [rax + 0x40], bl
je 0x18005ee75
mov r9, rbx
movabs r10, 0xd993efbb19cfe32d
mov cl, r9b
mov rdx, r10
and cl, 7
shl cl, 3
shr rdx, cl
xor byte [r9 + rax], dl
inc r9
cmp r9, 0x40
jb 0x18005ee56
mov byte [rax + 0x40], bl
mov rdx, rax
mov ecx, 4
call fcn.18006a848
xor eax, eax
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x18005ef14
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x28
test ecx, ecx
je 0x18005ec75
cmp ecx, 1
je 0x18005ec6c
mov eax, 0xffff
jmp 0x18005ec85
add rsp, 0x28
jmp 0x18005ef14
cmp dword [0x180109bb8], 1
jne 0x18005ec83
call fcn.18005ef98
xor eax, eax
add rsp, 0x28
ret
push rbx
sub rsp, 0x20
call fcn.18005e9cc
xor ebx, ebx
cmp byte [0x18010a364], bl
je 0x18005ef75
lea rcx, [rsp + 0x30]
call fcn.18005e654
mov rdx, rax
cmp byte [rax + 0x10], bl
je 0x18005ef64
mov r8d, ebx
mov cl, r8b
movabs rax, 0xd993efbb19cfe32d
and cl, 7
shl cl, 3
shr rax, cl
xor byte [r8 + rdx], al
inc r8
cmp r8, 0x10
jb 0x18005ef3e
mov byte [rdx + 0x10], bl
mov r8d, dword [0x180109bb8]
mov ecx, 4
call fcn.18006a848
cmp dword [0x180109bb8], 1
je 0x18005ef85
mov eax, 0xffff
jmp 0x18005ef91
call fcn.18005ec8c
test eax, eax
sete bl
mov eax, ebx
add rsp, 0x20
pop rbx
ret
Function at 0x180061ed0
Capabilities:
Encode data using xor

Disassembly:
mov rax, rsp
mov qword [rax + 0x18], rbx
mov qword [rax + 0x20], rbp
mov dword [rax + 0x10], edx
push rsi
push rdi
push r14
sub rsp, 0x40
mov edi, r8d
mov rsi, rcx
lea rbp, [rcx + 0x2f0]
mov qword [rax - 0x38], rbp
mov rcx, rbp
call fcn.180007dac
mov byte [rsp + 0x28], 1
lea r14, [rsi + 0x88]
mov rax, qword [r14]
mov rdx, qword [rax + 8]
mov rcx, rax
mov r8d, dword [rsp + 0x68]
xor ebx, ebx
jmp 0x180061f30
cmp dword [rdx + 0x20], r8d
jae 0x180061f2a
mov rdx, qword [rdx + 0x10]
jmp 0x180061f30
mov rcx, rdx
mov rdx, qword [rdx]
cmp byte [rdx + 0x19], bl
je 0x180061f1e
cmp byte [rcx + 0x19], bl
jne 0x180061f49
cmp r8d, dword [rcx + 0x20]
jb 0x180061f49
cmp rcx, rax
jne 0x18006204d
lea eax, [rdi - 1]
test eax, 0xfffffffb
je 0x180061fb4
cmp byte [0x18010a364], bl
je 0x18006204f
lea rcx, [rsp + 0x60]
call fcn.1800604dc
mov rdx, rax
cmp byte [rax + 0x53], bl
je 0x180061f9d
mov r8, rbx
movabs r9, 0xd993efbb19cfe32d
mov cl, r8b
and cl, 7
shl cl, 3
mov rax, r9
shr rax, cl
xor byte [r8 + rdx], al
inc r8
cmp r8, 0x53
jb 0x180061f7e
mov byte [rdx + 0x53], bl
mov r9d, edi
mov r8d, dword [rsp + 0x68]
mov ecx, 2
call fcn.18006a848
jmp 0x18006204f
mov ecx, 0xb8
call fcn.18009d1b8
mov qword [rsp + 0x60], rax
test rax, rax
je 0x180061fd9
mov edx, dword [rsp + 0x68]
mov rcx, rax
call fcn.18005fe90
mov rdi, rax
jmp 0x180061fdc
mov rdi, rbx
lea r8, [rsp + 0x68]
lea rdx, [rsp + 0x30]
mov rcx, r14
call fcn.18005f894
mov rcx, qword [rax]
mov qword [rcx + 0x28], rdi
cmp byte [0x18010a364], bl
je 0x18006204d
lea rcx, [rsp + 0x60]
call fcn.1800603e0
mov rdx, rax
cmp byte [rax + 0x46], bl
je 0x18006203b
mov r8, rbx
movabs r9, 0xd993efbb19cfe32d
mov cl, r8b
and cl, 7
shl cl, 3
mov rax, r9
shr rax, cl
xor byte [rdx + r8], al
inc r8
cmp r8, 0x46
jb 0x18006201c
mov byte [rdx + 0x46], bl
mov r9, qword [rsi]
mov r8d, dword [rsp + 0x68]
mov ecx, 4
call fcn.18006a848
mov bl, 1
mov rcx, rbp
call fcn.180007dc4
nop
mov al, bl
mov rbx, qword [rsp + 0x70]
mov rbp, qword [rsp + 0x78]
add rsp, 0x40
pop r14
pop rdi
pop rsi
ret
Function at 0x1800620e0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
push rsi
push rdi
push r14
sub rsp, 0x20
mov esi, r9d
mov r14, rdx
mov ebp, r8d
mov rdi, rcx
test r9d, r9d
je 0x180062130
mov ecx, esi
call fcn.18009d8b4
mov rcx, qword [rdi + 0x18]
mov qword [rdi + 0x18], rax
call fcn.18009d1f4
mov rcx, qword [rdi + 0x18]
mov r8d, esi
xor edx, edx
call fcn.1800a02d0
and dword [rdi + 0x10], 0
xor eax, eax
mov dword [rdi + 0xc], esi
jmp 0x180062136
mov esi, dword [rcx + 0xc]
mov eax, dword [rcx + 0x10]
sub esi, eax
cmp ebp, esi
jbe 0x180062194
cmp byte [0x18010a364], 0
je 0x180062190
lea rcx, [rsp + 0x50]
call fcn.1800617a4
mov r8, rax
cmp byte [rax + 0x44], 0
je 0x180062183
xor r9d, r9d
mov cl, r9b
movabs rax, 0xd993efbb19cfe32d
and cl, 7
shl cl, 3
shr rax, cl
xor byte [r9 + r8], al
inc r9
cmp r9, 0x44
jb 0x18006215b
mov byte [r8 + 0x44], 0
mov rdx, r8
mov ecx, 2
call fcn.18006a848
xor al, al
jmp 0x1800621b1
cmp qword [rdi + 0x18], 0
je 0x1800621af
mov ecx, eax
mov r8, rbp
add rcx, qword [rdi + 0x18]
mov rdx, r14
call fcn.18009fc20
add dword [rdi + 0x10], ebp
mov al, 1
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
add rsp, 0x20
pop r14
pop rdi
pop rsi
ret

Function at 0x18006225c
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r14
sub rsp, 0x40
mov al, r8b
mov r14b, r8b
neg al
mov rbp, rdx
mov rsi, rcx
sbb rdi, rdi
and rdi, 0xffffffffffffffb0
add rdi, 0x68
add rdi, rcx
mov rax, qword [rdi + 8]
cmp rax, qword [rdi]
je 0x1800623d6
mov rdx, rdi
mov rcx, rbp
call fcn.1800423e0
movabs r12, 0xd993efbb19cfe32d
test al, al
jne 0x180062305
cmp byte [0x18010a364], al
je 0x180062365
lea rcx, [rsp + 0x70]
call fcn.1800606b4
mov rdx, rax
cmp byte [rax + 0x4b], 0
je 0x1800622f8
xor r8d, r8d
mov cl, r8b
mov rax, r12
and cl, 7
shl cl, 3
shr rax, cl
xor byte [r8 + rdx], al
inc r8
cmp r8, 0x4b
jb 0x1800622d8
mov byte [rdx + 0x4b], 0
mov r8d, dword [rsi]
mov ecx, 2
call fcn.18006a848
cmp byte [0x18010a364], 0
je 0x180062365
lea rbx, [rbp + 0xa8]
cmp qword [rbx + 0x18], 0x10
jb 0x18006231f
mov rbx, qword [rbx]
lea rcx, [rsp + 0x70]
call fcn.180060da4
mov rdx, rax
cmp byte [rax + 0x49], 0
je 0x180062355
xor r8d, r8d
mov cl, r8b
mov rax, r12
and cl, 7
shl cl, 3
shr rax, cl
xor byte [r8 + rdx], al
inc r8
cmp r8, 0x49
jb 0x180062335
mov byte [rdx + 0x49], 0
mov r8d, dword [rsi]
mov r9, rbx
mov ecx, 4
call fcn.18006a848
neg r14b
lea rdx, [rbp + 0x90]
lea rcx, [rsp + 0x20]
sbb rbx, rbx
and rbx, 0xffffffffffffffb0
add rbx, 0x98
add rbx, rsi
call fcn.1800191f0
lea rax, [rsp + 0x20]
cmp rbx, rax
je 0x1800623c5
mov rcx, rbx
call fcn.180018ae4
mov rax, qword [rsp + 0x20]
xorps xmm0, xmm0
mov rcx, qword [rsp + 0x30]
and qword [rsp + 0x30], 0
mov qword [rbx], rax
mov rax, qword [rsp + 0x28]
mov qword [rbx + 8], rax
mov qword [rbx + 0x10], rcx
movdqu xmmword [rsp + 0x20], xmm0
lea rcx, [rsp + 0x20]
call fcn.180018ae4
mov rcx, qword [rdi]
mov qword [rdi + 8], rcx
mov rbx, qword [rsp + 0x60]
mov al, 1
mov rbp, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x78]
add rsp, 0x40
pop r14
pop r12
pop rdi
ret
Function at 0x1800623f4
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
push rsi
push rdi
push r14
sub rsp, 0x20
mov ebp, r9d
mov ebx, r8d
mov rsi, rdx
mov rdi, rcx
cmp r8d, 9
jb 0x180062574
jge 0x180062423
xor r8d, r8d
jmp 0x180062431
mov ecx, dword [rdx]
call sub.WS2_32.dll_ntohl
mov r8d, eax
shr r8d, 8
mov r14b, byte [rsi + 4]
lea eax, [r8 + 9]
cmp ebx, eax
jb 0x180062521
mov rdx, qword [rdi + 0x88]
mov rcx, rdx
mov rax, qword [rdx + 8]
jmp 0x180062462
cmp dword [rax + 0x20], ebp
jae 0x18006245c
mov rax, qword [rax + 0x10]
jmp 0x180062462
mov rcx, rax
mov rax, qword [rax]
cmp byte [rax + 0x19], 0
je 0x180062451
cmp byte [rcx + 0x19], 0
jne 0x180062473
cmp ebp, dword [rcx + 0x20]
jae 0x180062476
mov rcx, rdx
mov rbx, qword [rcx + 0x28]
test rbx, rbx
je 0x1800624c7
lea rdx, [rsi + 9]
lea rcx, [rbx + 0x10]
call fcn.1800620a8
test r14b, 4
je 0x18006251d
lea rdx, [rdi + 0x1d0]
mov byte [rbx + 0x11], 1
mov r8b, 1
mov rcx, rbx
call fcn.18006225c
mov rdx, qword [rdi + 0x98]
lea r8, [rdi + 0x320]
mov r9b, 1
mov rcx, rbx
call fcn.180064c00
jmp 0x18006251d
cmp byte [0x18010a364], 0
je 0x18006251d
lea rcx, [rsp + 0x50]
call fcn.180061154
mov rdx, rax
cmp byte [rax + 0x44], 0
je 0x180062510
xor r8d, r8d
movabs r10, 0xd993efbb19cfe32d
mov cl, r8b
mov rax, r10
and cl, 7
shl cl, 3
shr rax, cl
xor byte [r8 + rdx], al
inc r8
cmp r8, 0x44
jb 0x1800624f0
mov byte [rdx + 0x44], 0
mov r8d, ebp
mov ecx, 2
call fcn.18006a848
mov al, 1
jmp 0x180062576
cmp byte [0x18010a364], 0
je 0x180062574
lea rcx, [rsp + 0x50]
call fcn.18006130c
cmp byte [rax + 0x42], 0
je 0x180062567
xor r9d, r9d
movabs r10, 0xd993efbb19cfe32d
mov cl, r9b
mov rdx, r10
and cl, 7
shl cl, 3
shr rdx, cl
xor byte [r9 + rax], dl
inc r9
cmp r9, 0x42
jb 0x180062547
mov byte [rax + 0x42], 0
mov rdx, rax
mov ecx, 2
call fcn.18006a848
xor al, al
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
add rsp, 0x20
pop r14
pop rdi
pop rsi
ret
Function at 0x18006258c
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x20
mov r13d, r9d
mov edi, r8d
mov r15, rdx
mov r14, rcx
cmp r8d, 9
jb 0x180062788
jge 0x1800625c4
xor ebx, ebx
jmp 0x1800625d0
mov ecx, dword [rdx]
call sub.WS2_32.dll_ntohl
mov ebx, eax
shr ebx, 8
mov r12b, byte [r15 + 4]
lea ecx, [rbx + 9]
xor ebp, ebp
xor esi, esi
cmp edi, ecx
jb 0x180062735
test r12b, 8
je 0x1800625f1
lea esi, [rbp + 1]
movzx ebp, byte [r15 + 9]
mov eax, esi
mov ecx, dword [rax + r15 + 9]
btr ecx, 0x1f
call sub.WS2_32.dll_ntohl
sub ebx, esi
mov edi, eax
sub ebx, ebp
lea ebp, [rbx - 4]
xor ebx, ebx
cmp byte [0x18010a364], bl
je 0x180062666
lea rcx, [rsp + 0x60]
call fcn.180061960
mov r10, rax
cmp byte [rax + 0x55], bl
je 0x180062653
mov r8d, ebx
movabs r11, 0xd993efbb19cfe32d
mov cl, r8b
mov rax, r11
and cl, 7
shl cl, 3
shr rax, cl
xor byte [r8 + r10], al
inc r8
cmp r8, 0x55
jb 0x180062633
mov byte [r10 + 0x55], bl
mov r9d, edi
mov r8d, r13d
mov rdx, r10
mov ecx, 4
call fcn.18006a848
mov r8d, 5
mov edx, edi
mov rcx, r14
call fcn.180061ed0
xor r13d, r13d
test al, al
je 0x180062788
mov rcx, qword [r14 + 0x88]
mov rbx, rcx
mov rax, qword [rcx + 8]
jmp 0x1800626a2
cmp dword [rax + 0x20], edi
jae 0x18006269c
mov rax, qword [rax + 0x10]
jmp 0x1800626a2
mov rbx, rax
mov rax, qword [rax]
cmp byte [rax + 0x19], r13b
je 0x180062691
cmp byte [rbx + 0x19], r13b
jne 0x1800626b3
cmp edi, dword [rbx + 0x20]
jae 0x1800626b6
mov rbx, rcx
mov rbx, qword [rbx + 0x28]
test rbx, rbx
je 0x180062731
mov r8b, r13b
and r12b, 4
je 0x1800626cf
mov byte [rbx + 0x11], 1
mov r8b, 1
mov r9d, 5
mov dl, 1
mov rcx, rbx
call fcn.180063c34
lea edx, [rsi + 0xd]
mov byte [rbx + 0xb0], 1
add rdx, r15
lea rcx, [rbx + 0x10]
mov r8d, ebp
call fcn.1800620a8
test r12b, r12b
je 0x18006272a
lea rdx, [r14 + 0x1d0]
mov r8b, 1
mov rcx, rbx
call fcn.18006225c
mov rdx, qword [r14 + 0x98]
lea r8, [r14 + 0x320]
mov r9b, 1
mov rcx, rbx
call fcn.180064c00
jmp 0x180062731
mov rcx, qword [rsp + 0x70]
mov dword [rcx], edi
mov al, 1
jmp 0x18006278a
cmp byte [0x18010a364], sil
je 0x180062788
lea rcx, [rsp + 0x60]
call fcn.180060b08
xor ebx, ebx
cmp byte [rax + 0x3d], bl
je 0x18006277b
mov r9d, ebx
movabs r11, 0xd993efbb19cfe32d
mov cl, r9b
mov rdx, r11
and cl, 7
shl cl, 3
shr rdx, cl
xor byte [rax + r9], dl
inc r9
cmp r9, 0x3d
jb 0x18006275c
mov byte [rax + 0x3d], bl
mov rdx, rax
mov ecx, 2
call fcn.18006a848
xor al, al
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x68]
add rsp, 0x20
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x1800627a8
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
push rdi
sub rsp, 0x20
cmp byte [0x18010a364], 0
mov ebx, edx
mov rdi, rcx
movabs rbp, 0xd993efbb19cfe32d
je 0x180062812
lea rcx, [rsp + 0x40]
call fcn.1800614bc
mov rdx, rax
cmp byte [rax + 0x49], 0
je 0x180062805
xor r8d, r8d
mov cl, r8b
mov rax, rbp
and cl, 7
shl cl, 3
shr rax, cl
xor byte [r8 + rdx], al
inc r8
cmp r8, 0x49
jb 0x1800627e5
mov byte [rdx + 0x49], 0
mov r8d, ebx
mov ecx, 4
call fcn.18006a848
mov edx, ebx
mov rcx, rdi
call fcn.1800638d0
test al, al
jne 0x18006286f
cmp byte [0x18010a364], al
je 0x18006286b
lea rcx, [rsp + 0x40]
call fcn.180061b34
mov rdx, rax
cmp byte [rax + 0x3d], 0
je 0x18006285e
xor r8d, r8d
mov cl, r8b
mov rax, rbp
and cl, 7
shl cl, 3
shr rax, cl
xor byte [r8 + rdx], al
inc r8
cmp r8, 0x3d
jb 0x18006283e
mov byte [rdx + 0x3d], 0
mov r8d, ebx
mov ecx, 2
call fcn.18006a848
xor al, al
jmp 0x180062871
mov al, 1
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret