joyce8/EMBER2024-capa huggingface dataset:
Function at 0x14002e8e5
Capabilities:
Set thread local storage value

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x40
mov qword [rbp + 0x10], rcx
mov dword [rbp - 0x14], 0
mov rax, qword [rbp + 0x10]
mov qword [rbp - 8], rax
call sym._fpreset
lea rax, [0x1400376c0]
mov rcx, rax
call sym.pthread_mutex_lock
mov rax, qword [rbp - 8]
add rax, 0x38
mov rcx, rax
call sym.pthread_mutex_lock
lea rax, [sym.pthread_tls_init]
mov rdx, rax
lea rax, [0x140044ed0]
mov rcx, rax
call sym._pthread_once_raw
mov eax, dword [0x1400376b0]
mov rdx, qword [rbp - 8]
mov ecx, eax
mov rax, qword [sym.imp.KERNEL32.dll_TlsSetValue]
call rax
mov rax, qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
call rax
mov rdx, qword [rbp - 8]
mov dword [rdx + 0x70], eax
mov rax, qword [rbp - 8]
add rax, 0x38
mov rcx, rax
call sym.pthread_mutex_unlock
mov rdx, rbp
mov rax, qword [rbp - 8]
add rax, 0xd0
mov rcx, rax
call sym._setjmp
test eax, eax
jne 0x14002e9fa
mov qword [rbp - 0x10], pe_nt_image_headers64
lea rax, [0x1400376c0]
mov rcx, rax
call sym.pthread_mutex_unlock
mov rax, qword [rbp - 8]
mov rax, qword [rax + 0x10]
test rax, rax
je 0x14002e9c8
mov rax, qword [rbp - 8]
mov rdx, qword [rax + 0x10]
mov rax, qword [rbp - 8]
mov rax, qword [rax + 8]
mov rcx, rax
call rdx
mov qword [rbp - 0x10], rax
nop
nop
lea rax, [0x1400376c0]
mov rcx, rax
call sym.pthread_mutex_lock
mov rdx, qword [rbp - 0x10]
mov rax, qword [rbp - 8]
mov qword [rax + 8], rdx
mov rax, qword [rbp - 8]
mov rax, qword [rax + 0x1d8]
mov rcx, rax
call sym._pthread_cleanup_dest
jmp 0x14002ea09
lea rax, [0x1400376c0]
mov rcx, rax
call sym.pthread_mutex_lock
mov rax, qword [rbp - 8]
add rax, 0x38
mov rcx, rax
call sym.pthread_mutex_lock
mov rax, qword [rbp - 8]
mov rax, qword [rax + 8]
mov dword [rbp - 0x14], eax
mov rax, qword [rbp - 8]
mov rax, qword [rax + 0x30]
test rax, rax
je 0x14002ea45
mov rax, qword [rbp - 8]
mov rax, qword [rax + 0x30]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
mov rax, qword [rbp - 8]
mov qword [rax + 0x30], 0
mov rax, qword [rbp - 8]
mov rax, qword [rax + 0x28]
test rax, rax
jne 0x14002eab3
mov rax, qword [rbp - 8]
mov dword [rax], 0xdeadbeef
mov rax, qword [rbp - 8]
add rax, 0x38
mov rcx, rax
call sym.pthread_mutex_unlock
mov rax, qword [rbp - 8]
add rax, 0x38
mov rcx, rax
call sym.pthread_mutex_destroy
mov rax, qword [rbp - 8]
mov rcx, rax
call sym.push_pthread_mem
mov qword [rbp - 8], 0
mov eax, dword [0x1400376b0]
mov rdx, qword [rbp - 8]
mov ecx, eax
mov rax, qword [sym.imp.KERNEL32.dll_TlsSetValue]
call rax
jmp 0x14002eafd
mov rax, qword [rbp - 8]
add rax, 0x38
mov rcx, rax
call sym.pthread_mutex_unlock
mov rax, qword [rbp - 8]
add rax, 0x38
mov rcx, rax
call sym.pthread_mutex_destroy
mov rax, qword [rbp - 8]
mov qword [rax + 0x38], 0xffffffffffffffff
mov rax, qword [rbp - 8]
mov dword [rax + 0xbc], 1
jmp 0x14002eafd
mov ecx, 0
mov rax, qword [sym.imp.KERNEL32.dll_Sleep]
call rax
lea rax, [0x1400376c0]
mov rcx, rax
call sym.pthread_mutex_unlock
test eax, eax
je 0x14002eaef
mov eax, dword [rbp - 0x14]
mov ecx, eax
mov rax, qword [sym.imp.msvcrt.dll__endthreadex]
call rax
nop
Function at 0x14002d808
Capabilities:
Terminate process

Disassembly:
mov rcx, qword [0x140065950]
call fcn.1403b04dc
nop
int3
Function at 0x18000ed40
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 7], 0
je 0x18000ed63
xor eax, eax
nop dword [rax + rax]
lea edx, [rax + 0x33]
xor byte [rax + rcx], dl
inc rax
cmp rax, 6
jb 0x18000ed50
mov byte [rcx + 7], 0
mov rax, rcx
ret

Function at 0x18000ed90
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 8], 0
je 0x18000edb3
xor eax, eax
nop dword [rax + rax]
lea edx, [rax + 0x33]
xor byte [rax + rcx], dl
inc rax
cmp rax, 7
jb 0x18000eda0
mov byte [rcx + 8], 0
mov rax, rcx
ret

Function at 0x18000edc0
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x20
mov rdi, rcx
mov rcx, rdx
call fcn.18003ef80
mov rcx, rdi
mov rbx, rax
call fcn.18003ef80
xor r9d, r9d
mov r8, rbx
mov rdx, rax
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
mov ecx, 0x3df
call qword [sym.imp.KERNEL32.dll_ExitProcess]

Function at 0x18000ee90
Capabilities:
Enumerate processes

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x160
mov rax, qword [0x1801561e0]
xor rax, rsp
mov qword [rsp + 0x150], rax
xor edx, edx
mov rbx, rcx
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
xor edx, edx
lea rcx, [rsp + 0x24]
mov r8d, Ordinal_301
mov rdi, rax
call sub.VCRUNTIME140.dll_memset
mov dword [rsp + 0x20], 0x130
cmp rdi, 0xffffffffffffffff
je 0x18000ef52
lea rdx, [rsp + 0x20]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_Process32First]
test eax, eax
je 0x18000ef52
lea rdx, [rsp + 0x20]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_Process32Next]
test eax, eax
je 0x18000ef49
cmp qword [rbx + 0x18], 0x10
mov r8, rbx
jb 0x18000ef11
mov r8, qword [rbx]
lea rax, [rsp + 0x4c]
sub r8, rax
nop dword [rax]
movzx edx, byte [rax]
movzx ecx, byte [rax + r8]
sub edx, ecx
jne 0x18000ef33
inc rax
test ecx, ecx
jne 0x18000ef20
mov rcx, rdi
test edx, edx
je 0x18000ef7d
lea rdx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_Process32Next]
test eax, eax
jne 0x18000ef04
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rbx
call fcn.180040c10
xor al, al
mov rcx, qword [rsp + 0x150]
xor rcx, rsp
call fcn.180112b70
mov rbx, qword [rsp + 0x178]
add rsp, 0x160
pop rdi
ret
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [rsp + 0x28], 0
je 0x18000ef52
mov rcx, rbx
call fcn.180040c10
mov al, 1
jmp 0x18000ef5c
Function at 0x180010320
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x1e], 0
je 0x180010343
xor eax, eax
nop dword [rax + rax]
lea edx, [rax + 0x33]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x1d
jb 0x180010330
mov byte [rcx + 0x1e], 0
mov rax, rcx
ret

Function at 0x180010350
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 6], 0
je 0x180010373
xor eax, eax
nop dword [rax + rax]
lea edx, [rax + 0x33]
xor byte [rax + rcx], dl
inc rax
cmp rax, 5
jb 0x180010360
mov byte [rcx + 6], 0
mov rax, rcx
ret

Function at 0x1800126d0
Capabilities:
Encode data using xor

Disassembly:
mov rax, rsp
mov qword [rax + 0x20], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x5f]
sub rsp, 0xe0
movaps xmmword [rax - 0x48], xmm6
movaps xmmword [rax - 0x58], xmm7
mov rsi, qword [0x180184828]
mov r15, qword [0x180184830]
cmp rsi, r15
je 0x1800128a1
xor r13d, r13d
movzx ebx, byte [rbp + 0x67]
movss xmm7, dword [0x180137c00]
movzx edi, byte [rbp + 0x67]
nop
movsd xmm6, qword [rsi + 0x50]
movss xmm0, dword [0x180180804]
cvtps2pd xmm0, xmm0
comisd xmm6, xmm0
jae 0x180012894
lea rcx, [0x180180590]
call fcn.180063510
mov r12d, eax
mov dword [rbp + 0x6f], 0x685913
mov byte [rbp + 0x73], 1
mov rdx, r13
nop word [rax + rax]
lea ecx, [rdx + 0x33]
xor byte [rbp + rdx + 0x6f], cl
inc rdx
cmp rdx, 3
jb 0x180012760
mov byte [rbp + 0x73], 0
cvttsd2si edx, xmm6
lea rcx, [rbp - 0x19]
call fcn.18000eac0
mov r14, rax
mov dword [rbp + 0x67], 0x1006f13
mov rdx, r13
nop
lea ecx, [rdx + 0x33]
xor byte [rbp + rdx + 0x67], cl
inc rdx
cmp rdx, 2
jb 0x180012790
mov byte [rbp + 0x6a], 0
mov rdx, qword [rsi + 0x10]
lea rax, [rbp + 0x67]
mov rcx, 0xffffffffffffffff
inc rcx
cmp byte [rax + rcx], 0
jne 0x1800127b3
movabs rax, 0x7fffffffffffffff
sub rax, rdx
cmp rax, rcx
jb 0x1800128c6
mov r9, rsi
cmp qword [rsi + 0x18], 0x10
jb 0x1800127df
mov r9, qword [rsi]
mov qword [rsp + 0x30], rcx
lea rax, [rbp + 0x67]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rdx
mov r8, rsi
movzx edx, bl
lea rcx, [rbp - 0x39]
call fcn.180052030
nop
mov r9, r14
lea r8, [rbp - 0x39]
movzx edx, dil
lea rcx, [rbp - 0x59]
call fcn.180051e40
nop
lea rax, [rbp + 0x6f]
mov r8, 0xffffffffffffffff
inc r8
cmp byte [rax + r8], 0
jne 0x180012822
lea rdx, [rbp + 0x6f]
lea rcx, [rbp - 0x59]
call fcn.18003ef90
mov qword [rbp - 0x79], r13
mov qword [rbp - 0x69], r13
mov qword [rbp - 0x61], r13
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x79], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x69], xmm1
mov qword [rax + 0x10], r13
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
lea rdx, [rsi + 0x48]
mov r9d, r12d
movaps xmm2, xmm7
lea rcx, [rbp - 0x79]
call fcn.180010fa0
nop
lea rcx, [rbp - 0x59]
call fcn.180040c10
nop
lea rcx, [rbp - 0x39]
call fcn.180040c10
nop
lea rcx, [rbp - 0x19]
call fcn.180040c10
add rsi, 0x58
cmp rsi, r15
jne 0x180012720
lea r11, [rsp + 0xe0]
mov rbx, qword [r11 + 0x58]
movaps xmm6, xmmword [r11 - 0x10]
movaps xmm7, xmmword [r11 - 0x20]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
call fcn.18000c960
nop
int3
Function at 0x1800128d0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 3], 0
je 0x1800128f3
xor eax, eax
nop dword [rax + rax]
lea edx, [rax + 0x33]
xor byte [rax + rcx], dl
inc rax
cmp rax, 2
jb 0x1800128e0
mov byte [rcx + 3], 0
mov rax, rcx
ret

Function at 0x180012900
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 4], 0
je 0x180012923
xor eax, eax
nop dword [rax + rax]
lea edx, [rax + 0x33]
xor byte [rax + rcx], dl
inc rax
cmp rax, 3
jb 0x180012910
mov byte [rcx + 4], 0
mov rax, rcx
ret
Function at 0x180013f00
Capabilities:
Log keystrokes via polling

Disassembly:
mov r11, rsp
sub rsp, 0xe8
mov rax, qword [0x1801561e0]
xor rax, rsp
mov qword [rsp + 0x90], rax
cmp byte [0x180180830], 0
je 0x1800140ff
mov edx, dword [0x18018085c]
lea rcx, [rsp + 0x50]
mov qword [r11 - 8], rdi
movaps xmmword [r11 - 0x18], xmm6
movaps xmmword [r11 - 0x38], xmm8
movaps xmmword [r11 - 0x48], xmm9
call fcn.1800136f0
movups xmm8, xmmword [rax]
movsd xmm9, qword [rax + 0x20]
movups xmm6, xmmword [rax + 0x10]
movdqa xmm0, xmm8
movsd qword [rsp + 0x40], xmm9
psrldq xmm0, 8
movq rdi, xmm0
test rdi, rdi
je 0x1800140dd
movss xmm0, dword [0x18018083c]
comiss xmm0, dword [rsp + 0x40]
jb 0x1800140dd
movss xmm1, dword [0x180180854]
movaps xmm0, xmm6
cvtps2pd xmm1, xmm1
unpckhpd xmm0, xmm6
comisd xmm1, xmm0
jb 0x1800140dd
mov ecx, dword [reloc.WS2_32.dll_bind]
call qword [sym.imp.USER32.dll_GetKeyState]
bt ax, 0xf
jae 0x1800140dd
mov qword [rsp + 0xf8], rsi
movd esi, xmm6
test esi, esi
je 0x1800140d5
mov qword [rsp + 0xf0], rbx
lea rdx, [rsp + 0x80]
movd ebx, xmm8
mov rcx, rdi
movaps xmmword [rsp + 0xc0], xmm7
mov r8d, ebx
call qword [0x180184780]
movaps xmm1, xmmword [rsp + 0x80]
movss dword [rsp + 0x80], xmm1
movaps xmm0, xmm1
shufps xmm0, xmm1, 0x55
shufps xmm1, xmm1, 0xaa
movss dword [rsp + 0x88], xmm1
movss dword [rsp + 0x84], xmm0
cmp ebx, 0x1233
jne 0x180014042
movsd xmm7, qword [rdi + 0x90]
mov ebx, dword [rdi + 0x98]
jmp 0x180014052
mov ebx, dword [rsp + 0x88]
movsd xmm7, qword [rsp + 0x80]
cmp byte [0x1801845f5], 0
je 0x18001407c
lea rcx, [rsp + 0x80]
movsd qword [rsp + 0x80], xmm7
mov dword [rsp + 0x88], ebx
call fcn.180010a20
test al, al
jne 0x1800140c5
mov edx, esi
movabs rcx, 0x7239b21a38f536ba
call fcn.180043f50
test eax, eax
je 0x1800140c5
lea rdx, [rsp + 0x80]
movsd qword [rsp + 0x80], xmm7
lea rcx, [rsp + 0x20]
mov dword [rsp + 0x88], ebx
movaps xmmword [rsp + 0x20], xmm8
movaps xmmword [rsp + 0x30], xmm6
movsd qword [rsp + 0x40], xmm9
call fcn.180013980
movaps xmm7, xmmword [rsp + 0xc0]
mov rbx, qword [rsp + 0xf0]
mov rsi, qword [rsp + 0xf8]
mov rdi, qword [rsp + 0xe0]
movaps xmm6, xmmword [rsp + 0xd0]
movaps xmm8, xmmword [rsp + 0xb0]
movaps xmm9, xmmword [rsp + 0xa0]
mov rcx, qword [rsp + 0x90]
xor rcx, rsp
call fcn.180112b70
add rsp, 0xe8
ret
Function at 0x180014120
Capabilities:
Log keystrokes via polling

Disassembly:
push rbp
push rsi
push r14
lea rbp, [rsp - 0x47]
sub rsp, 0xd0
mov rax, qword [0x1801561e0]
xor rax, rsp
mov qword [rbp - 9], rax
cmp byte [0x180180b40], 0
mov rsi, rdx
mov r14, rcx
je 0x180014368
mov rax, qword [0x180184788]
movss xmm0, dword [rcx + 8]
movss xmm1, dword [rcx]
movss xmm2, dword [rcx + 4]
subss xmm2, dword [rax + 0x94]
subss xmm0, dword [rax + 0x98]
subss xmm1, dword [rax + 0x90]
mulss xmm2, xmm2
mulss xmm0, xmm0
mulss xmm1, xmm1
addss xmm2, xmm1
addss xmm2, xmm0
xorps xmm0, xmm0
ucomiss xmm0, xmm2
ja 0x1800141a4
xorps xmm0, xmm0
sqrtss xmm0, xmm2
jmp 0x1800141ac
movaps xmm0, xmm2
call sub.api_ms_win_crt_math_l1_1_0.dll_sqrtf
movss xmm1, dword [0x180137b70]
comiss xmm1, xmm0
jbe 0x180014368
mov edx, dword [0x180180b50]
lea rcx, [rbp - 0x41]
mov qword [rsp + 0x108], rdi
call fcn.1800136f0
movups xmm2, xmmword [rax]
movups xmm0, xmmword [rax + 0x10]
movsd xmm1, qword [rax + 0x20]
movups xmmword [rbp - 0x69], xmm2
psrldq xmm2, 8
movq rdi, xmm2
movsd qword [rbp - 0x49], xmm1
movups xmmword [rbp - 0x59], xmm0
test rdi, rdi
je 0x180014360
movss xmm0, dword [0x180180b44]
comiss xmm0, dword [rbp - 0x49]
jb 0x180014360
movss xmm0, dword [0x180180b4c]
cvtps2pd xmm0, xmm0
comisd xmm0, xmmword [rbp - 0x51]
jb 0x180014360
mov ecx, dword [reloc.WS2_32.dll_bind]
call qword [sym.imp.USER32.dll_GetKeyState]
bt ax, 0xf
jae 0x180014360
mov r8d, dword [rbp - 0x69]
lea rdx, [rbp - 0x19]
mov qword [rsp + 0x100], rbx
mov rcx, rdi
movaps xmmword [rsp + 0xc0], xmm6
movaps xmmword [rsp + 0xb0], xmm7
movaps xmmword [rsp + 0xa0], xmm8
movaps xmmword [rsp + 0x90], xmm9
call qword [0x180184780]
cmp dword [rbp - 0x69], 0x1233
movaps xmm8, xmmword [rbp - 0x19]
movaps xmm9, xmm8
movss dword [rbp - 0x19], xmm8
movaps xmm7, xmm8
shufps xmm9, xmm8, 0x55
shufps xmm7, xmm8, 0xaa
movss dword [rbp - 0x15], xmm9
movss dword [rbp - 0x11], xmm7
jne 0x1800142d9
movsd xmm6, qword [rdi + 0x90]
mov ebx, dword [rdi + 0x98]
movaps xmm0, xmm6
shufps xmm0, xmm0, 0x55
mov dword [rbp - 0x11], ebx
movaps xmm9, xmm0
movss xmm7, dword [rbp - 0x11]
movsd qword [rbp - 0x19], xmm6
movss xmm8, dword [rbp - 0x19]
jmp 0x1800142e1
mov ebx, dword [rbp - 0x11]
movsd xmm6, qword [rbp - 0x19]
cmp byte [0x1801845f5], 0
je 0x180014305
cmp byte [rbp - 0x45], 0
jne 0x180014305
lea rcx, [rbp - 0x19]
movsd qword [rbp - 0x19], xmm6
mov dword [rbp - 0x11], ebx
call fcn.180010a20
test al, al
jne 0x180014336
cmp byte [0x180180b48], 0
je 0x18001432f
addss xmm7, dword [0x180137abc]
movaps xmm0, xmm8
unpcklps xmm0, xmm9
movsd qword [r14], xmm0
movss dword [rbp - 0x11], xmm7
mov eax, dword [rbp - 0x11]
mov dword [r14 + 8], eax
movsd qword [rsi], xmm6
mov dword [rsi + 8], ebx
movaps xmm8, xmmword [rsp + 0xa0]
movaps xmm7, xmmword [rsp + 0xb0]
movaps xmm6, xmmword [rsp + 0xc0]
mov rbx, qword [rsp + 0x100]
movaps xmm9, xmmword [rsp + 0x90]
mov rdi, qword [rsp + 0x108]
mov rcx, qword [rbp - 9]
xor rcx, rsp
call fcn.180112b70
add rsp, 0xd0
pop r14
pop rsi
pop rbp
ret
Function at 0x180014380
Capabilities:
Log keystrokes via polling

Disassembly:
sub rsp, 0xa8
mov rax, qword [0x1801561e0]
xor rax, rsp
mov qword [rsp + 0x90], rax
cmp byte [0x180180868], 0
je 0x18001459b
mov edx, dword [0x180180878]
lea rcx, [rsp + 0x58]
mov qword [rsp + 0xa0], rbx
call fcn.1800136f0
movups xmm2, xmmword [rax]
movups xmm0, xmmword [rax + 0x10]
movsd xmm1, qword [rax + 0x20]
movups xmmword [rsp + 0x30], xmm2
psrldq xmm2, 8
movq rbx, xmm2
movsd qword [rsp + 0x50], xmm1
movups xmmword [rsp + 0x40], xmm0
test rbx, rbx
je 0x180014593
movss xmm0, dword [0x180180870]
cvtps2pd xmm0, xmm0
comisd xmm0, xmmword [rsp + 0x48]
jb 0x180014593
cmp qword [0x180185e70], rbx
je 0x18001441e
mov qword [0x180185e70], rbx
mov dword [0x180185e8c], 0
mov ecx, dword [0x1801845d4]
mov rax, qword gs:[0x58]
mov edx, 4
mov rax, qword [rax + rcx*8]
mov ecx, dword [rdx + rax]
cmp dword [0x180186058], ecx
jle 0x18001446f
lea rcx, [0x180186058]
call fcn.180112d18
cmp dword [0x180186058], 0xffffffff
jne 0x18001446f
call qword [sym.imp.KERNEL32.dll_GetTickCount64]
lea rcx, [0x180186058]
mov qword [0x180185f18], rax
call fcn.180112cb8
call qword [sym.imp.KERNEL32.dll_GetTickCount64]
sub rax, qword [0x180185f18]
movsxd rcx, dword [0x180185e8c]
cmp rax, rcx
jb 0x180014593
mov ecx, dword [reloc.WS2_32.dll_bind]
call qword [sym.imp.USER32.dll_GetKeyState]
bt ax, 0xf
jae 0x180014586
cmp byte [0x1801845f5], 0
je 0x18001450a
cmp byte [rsp + 0x54], 0
jne 0x18001450a
mov r8d, dword [rsp + 0x30]
lea rdx, [rsp + 0x80]
mov rcx, rbx
call qword [0x180184780]
movaps xmm1, xmmword [rsp + 0x80]
lea rcx, [rsp + 0x20]
movaps xmm2, xmm1
movaps xmm0, xmm1
shufps xmm0, xmm1, 0xaa
shufps xmm2, xmm1, 0x55
movss dword [rsp + 0x88], xmm0
mov eax, dword [rsp + 0x88]
unpcklps xmm1, xmm2
movsd qword [rsp + 0x20], xmm1
mov dword [rsp + 0x28], eax
call fcn.180010a20
test al, al
jne 0x180014586
cmp byte [0x18018086a], 0
jne 0x180014544
movss xmm0, dword [0x18018086c]
comiss xmm0, dword [rsp + 0x50]
jb 0x180014586
movss xmm3, dword [0x180137b14]
call fcn.180045470
cmp byte [0x18018086a], 0
mov eax, dword [0x180180874]
mov dword [0x180185e8c], eax
je 0x180014586
movabs rcx, 0x4f8644af03d0e0d6
call fcn.180043d30
mov r8d, dword [rsp + 0x40]
mov edx, eax
movabs rcx, 0x3c06b5c839b38f7b
call fcn.180043c30
test eax, eax
je 0x180014586
movss xmm3, dword [0x180137b14]
call fcn.180045470
mov eax, dword [0x180180874]
mov dword [0x180185e8c], eax
call qword [sym.imp.KERNEL32.dll_GetTickCount64]
mov qword [0x180185f18], rax
mov rbx, qword [rsp + 0xa0]
mov rcx, qword [rsp + 0x90]
xor rcx, rsp
call fcn.180112b70
add rsp, 0xa8
ret
Function at 0x1800182f0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
sub rsp, 0x40
mov rsi, rcx
mov rdi, rdx
mov ecx, 3
call fcn.1800bd820
call fcn.1800bd550
xor ebx, ebx
mov qword [rsi + 0x18], reloc.WS2_32.dll_ntohs
mov qword [rsi], rbx
mov rbp, rax
mov qword [rsi + 0x10], rbx
mov r8, rdi
cmp qword [rdi + 0x18], 0x10
jb 0x180018332
mov r8, qword [rdi]
mov edx, 0x2712
mov rcx, rbp
call fcn.1800c03f0
xor r8d, r8d
mov rcx, rbp
lea edx, [r8 + 0x40]
call fcn.1800c03f0
movdqa xmm0, xmmword [0x1801396f0]
movdqu xmmword [rsp + 0x20], xmm0
mov word [rsp + 0x30], 0x100
nop dword [rax]
nop word [rax + rax]
lea eax, [rbx + 0x33]
xor byte [rsp + rbx + 0x20], al
inc rbx
cmp rbx, 0x10
jb 0x180018370
lea r8, [rsp + 0x20]
mov byte [rsp + 0x31], 0
mov edx, 0x2722
mov rcx, rbp
call fcn.1800c03f0
lea r8, [0x1800182c0]
mov edx, 0x4e2b
mov rcx, rbp
call fcn.1800c03f0
mov r8, rsi
mov edx, 0x2711
mov rcx, rbp
call fcn.1800c03f0
mov rcx, rbp
call fcn.1800bd630
mov rcx, rbp
call fcn.1800bd530
call fcn.1800bd7c0
mov rcx, rdi
call fcn.180040c10
mov rbx, qword [rsp + 0x70]
mov rax, rsi
add rsp, 0x40
pop rdi
pop rsi
pop rbp
ret

Function at 0x1800183f0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x11], 0
je 0x180018413
xor eax, eax
nop dword [rax + rax]
lea edx, [rax + 0x33]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x10
jb 0x180018400
mov byte [rcx + 0x11], 0
mov rax, rcx
ret
Function at 0x18001d030
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0xb], 0
je 0x18001d053
xor eax, eax
nop dword [rax + rax]
lea edx, [rax + 0x33]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0xa
jb 0x18001d040
mov byte [rcx + 0xb], 0
mov rax, rcx
ret

Function at 0x18001d060
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0xc], 0
je 0x18001d083
xor eax, eax
nop dword [rax + rax]
lea edx, [rax + 0x33]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0xb
jb 0x18001d070
mov byte [rcx + 0xc], 0
mov rax, rcx
ret

Function at 0x18001d090
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x10], 0
je 0x18001d0b3
xor eax, eax
nop dword [rax + rax]
lea edx, [rax + 0x33]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0xf
jb 0x18001d0a0
mov byte [rcx + 0x10], 0
mov rax, rcx
ret

Function at 0x18001d0c0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 9], 0
je 0x18001d0e3
xor eax, eax
nop dword [rax + rax]
lea edx, [rax + 0x33]
xor byte [rax + rcx], dl
inc rax
cmp rax, 8
jb 0x18001d0d0
mov byte [rcx + 9], 0
mov rax, rcx
ret
Function at 0x18001dfd0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0xd], 0
je 0x18001dff3
xor eax, eax
nop dword [rax + rax]
lea edx, [rax + 0x33]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0xc
jb 0x18001dfe0
mov byte [rcx + 0xd], 0
mov rax, rcx
ret

Function at 0x18001e1d0
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x50
mov r9, r8
mov rbx, rdx
mov rdi, rcx
mov qword [rsp + 0x40], rcx
xor esi, esi
cmp byte [r8 + 9], sil
je 0x18001e204
mov eax, esi
lea ecx, [rax + 0x33]
xor byte [r8 + rax], cl
inc rax
cmp rax, 8
jb 0x18001e1f0
mov byte [r8 + 9], sil
lea rax, [r8 + 8]
mov qword [rsp + 0x20], rsi
movdqa xmm0, xmmword [0x180137dd0]
movdqu xmmword [rsp + 0x30], xmm0
mov byte [rsp + 0x20], sil
cmp r9, rax
je 0x18001e239
mov r8d, 8
mov rdx, r9
lea rcx, [rsp + 0x20]
call fcn.180040d10
nop
mov r9, qword [rbx + 0x10]
cmp qword [rbx + 0x18], 0x10
jb 0x18001e247
mov rbx, qword [rbx]
mov r8, rbx
xor edx, edx
lea rcx, [rsp + 0x20]
call fcn.180051d30
mov qword [rdi], rsi
mov qword [rdi + 0x10], rsi
mov qword [rdi + 0x18], rsi
movups xmm0, xmmword [rax]
movups xmmword [rdi], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rdi + 0x10], xmm1
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
lea rcx, [rsp + 0x20]
call fcn.180040c10
mov rax, rdi
add rsp, 0x50
pop rdi
pop rsi
pop rbx
ret

Function at 0x18001e2a0
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x30
mov rbx, rdx
xor r8d, r8d
mov rdx, rcx
mov qword [rsp + 0x20], rbx
cmp byte [rcx + 9], r8b
je 0x18001e2d3
mov ecx, r8d
nop dword [rax]
lea eax, [rcx + 0x33]
xor byte [rdx + rcx], al
inc rcx
cmp rcx, 8
jb 0x18001e2c0
mov byte [rdx + 9], r8b
lea rcx, [rdx + 8]
mov qword [rbx], r8
mov qword [rbx + 0x10], r8
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], r8b
cmp rdx, rcx
je 0x18001e2fc
mov r8d, 8
mov rcx, rbx
call fcn.180040d10
mov rax, rbx
add rsp, 0x30
pop rbx
ret

Function at 0x18001e310
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x50
mov r9, r8
mov rbx, rdx
mov rdi, rcx
mov qword [rsp + 0x40], rcx
xor esi, esi
cmp byte [r8 + 0xa], sil
je 0x18001e344
mov eax, esi
lea ecx, [rax + 0x33]
xor byte [r8 + rax], cl
inc rax
cmp rax, 9
jb 0x18001e330
mov byte [r8 + 0xa], sil
lea rax, [r8 + 9]
mov qword [rsp + 0x20], rsi
movdqa xmm0, xmmword [0x180137dd0]
movdqu xmmword [rsp + 0x30], xmm0
mov byte [rsp + 0x20], sil
cmp r9, rax
je 0x18001e379
mov r8d, 9
mov rdx, r9
lea rcx, [rsp + 0x20]
call fcn.180040d10
nop
mov r9, qword [rbx + 0x10]
cmp qword [rbx + 0x18], 0x10
jb 0x18001e387
mov rbx, qword [rbx]
mov r8, rbx
xor edx, edx
lea rcx, [rsp + 0x20]
call fcn.180051d30
mov qword [rdi], rsi
mov qword [rdi + 0x10], rsi
mov qword [rdi + 0x18], rsi
movups xmm0, xmmword [rax]
movups xmmword [rdi], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rdi + 0x10], xmm1
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
lea rcx, [rsp + 0x20]
call fcn.180040c10
mov rax, rdi
add rsp, 0x50
pop rdi
pop rsi
pop rbx
ret
Function at 0x18001e3e0
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x30
mov rbx, rdx
xor r8d, r8d
mov rdx, rcx
mov qword [rsp + 0x20], rbx
cmp byte [rcx + 0xa], r8b
je 0x18001e413
mov ecx, r8d
nop dword [rax]
lea eax, [rcx + 0x33]
xor byte [rdx + rcx], al
inc rcx
cmp rcx, 9
jb 0x18001e400
mov byte [rdx + 0xa], r8b
lea rcx, [rdx + 9]
mov qword [rbx], r8
mov qword [rbx + 0x10], r8
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], r8b
cmp rdx, rcx
je 0x18001e43c
mov r8d, 9
mov rcx, rbx
call fcn.180040d10
mov rax, rbx
add rsp, 0x30
pop rbx
ret