joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140002630
Capabilities:
Enumerate gui resources

Disassembly:
sub rsp, 0x28
lea rcx, [0x140002d30]
xor edx, edx
mov dword [0x140012404], 0
call qword [sym.imp.USER32.dll_EnumWindows]
mov ecx, 2
call fcn.140002500
test eax, eax
jne 0x140002660
add rsp, 0x28
ret
lea rcx, str.MOM.exe
call section..text
lea rcx, str.CCC.exe
call section..text
lea rcx, str.RadeonSoftware.exe
call section..text
lea rcx, str.RadeonSettings.exe
call section..text
lea rcx, str.cnext.exe
call section..text
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
call fcn.140002270
mov eax, 1
add rsp, 0x28
ret

Function at 0x140002890
Capabilities:
Create process on windows

Disassembly:
sub rsp, 0x2f8
mov rax, qword [0x140010008]
xor rax, rsp
mov qword [rsp + 0x2e0], rax
movzx eax, word [rcx]
cmp ax, 0x2d
je 0x1400028b8
cmp ax, 0x2f
jne 0x1400028e3
cmp word [rcx + 4], 0
jne 0x1400028e3
movzx ecx, word [rcx + 2]
sub ecx, 0x51
je 0x1400028dc
dec ecx
je 0x1400028d5
sub ecx, 0x1f
je 0x1400028dc
dec ecx
jne 0x1400028e3
mov ecx, 0x66
jmp 0x1400028ef
mov ecx, 0x65
jmp 0x1400028ef
call fcn.1400027d0
neg eax
sbb ecx, ecx
and ecx, 0x65
sub ecx, 0x65
lea rdx, [0x140000000]
je 0x14000293b
dec ecx
je 0x14000291c
xor ecx, ecx
movzx eax, word [rcx + rdx + 0xe560]
add rcx, 2
mov word [rsp + rcx + 0xde], ax
test ax, ax
jne 0x140002901
jmp 0x140002959
xor ecx, ecx
nop
movzx eax, word [rcx + rdx + 0xe538]
add rcx, 2
mov word [rsp + rcx + 0xde], ax
test ax, ax
jne 0x140002920
jmp 0x140002959
xor ecx, ecx
nop dword [rax]
movzx eax, word [rcx + rdx + 0xe510]
add rcx, 2
mov word [rsp + rcx + 0xde], ax
test ax, ax
jne 0x140002940
lea rcx, [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_GetStartupInfoW]
lea r11, [rsp + 0x50]
lea rax, [rsp + 0x70]
mov qword [rsp + 0x48], r11
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
lea rdx, [rsp + 0xe0]
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x1400029cc
mov rcx, qword [rsp + 0x2e0]
xor rcx, rsp
call fcn.140002ef0
add rsp, 0x2f8
ret
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
mov rcx, qword [rsp + 0x2e0]
xor rcx, rsp
call fcn.140002ef0
add rsp, 0x2f8
ret
Function at 0x140003ccf
Capabilities:
Terminate process

Disassembly:
cmp rcx, qword [0x140010008]
jne 0x140002f0a
rol rcx, 0x10
test cx, 0xffff
jne 0x140002f06
repz ret
ror rcx, 0x10
jmp 0x140003c28
mov qword [rsp + 8], rcx
sub rsp, 0x88
lea rcx, [0x140011380]
call qword [sym.imp.KERNEL32.dll_RtlCaptureContext]
mov rax, qword [0x140011478]
mov qword [rsp + 0x58], rax
xor r8d, r8d
lea rdx, [rsp + 0x60]
mov rcx, qword [rsp + 0x58]
call sub.KERNEL32.dll_RtlLookupFunctionEntry
mov qword [rsp + 0x50], rax
cmp qword [rsp + 0x50], 0
je 0x140003cad
mov qword [rsp + 0x38], 0
lea rax, [rsp + 0x48]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x28], rax
lea rax, [0x140011380]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x50]
mov r8, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x60]
xor ecx, ecx
call sub.KERNEL32.dll_RtlVirtualUnwind
jmp 0x140003ccf
mov rax, qword [rsp + 0x88]
mov qword [0x140011478], rax
lea rax, [rsp + 0x88]
add rax, 8
mov qword [0x140011418], rax
mov rax, qword [0x140011478]
mov qword [0x1400112f0], rax
mov rax, qword [rsp + 0x90]
mov qword [0x140011400], rax
mov dword [0x1400112e0], 0xc0000409
mov dword [0x1400112e4], 1
mov rax, qword [0x140010008]
mov qword [rsp + 0x68], rax
mov rax, qword [0x140010010]
mov qword [rsp + 0x70], rax
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
mov dword [0x140011378], eax
mov ecx, 1
call fcn.140007cdc
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
lea rcx, [0x14000c430]
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
cmp dword [0x140011378], 0
jne 0x140003d56
mov ecx, 1
call fcn.140007cdc
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xc0000409
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
add rsp, 0x88
ret

Function at 0x1400053fc
Capabilities:
Terminate process

Disassembly:
xor r8d, r8d
xor edx, edx
jmp fcn.14000526c
Function at 0x140009394
Capabilities:
Link many functions at runtime

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x50
mov rax, qword [0x140010008]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov ebp, r8d
mov r14, rdx
mov r13, rcx
call fcn.140004938
xor ebx, ebx
cmp qword [0x1400123b8], rbx
mov rdi, rax
jne 0x1400094a7
lea rcx, str.USER32.DLL
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov rsi, rax
test rax, rax
je 0x14000957e
lea rdx, [0x14000dce0]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x14000957e
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EncodePointer]
lea rdx, str.GetActiveWindow
mov rcx, rsi
mov qword [0x1400123b8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EncodePointer]
lea rdx, str.GetLastActivePopup
mov rcx, rsi
mov qword [0x1400123c0], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EncodePointer]
lea rdx, str.GetUserObjectInformationW
mov rcx, rsi
mov qword [0x1400123c8], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EncodePointer]
mov r11, rax
mov qword [0x1400123d8], rax
test rax, rax
je 0x14000949e
lea rdx, str.GetProcessWindowStation
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_EncodePointer]
mov qword [0x1400123d0], rax
jmp 0x1400094ae
mov rax, qword [0x1400123d0]
jmp 0x1400094b5
mov rax, qword [0x1400123d0]
mov r11, qword [0x1400123d8]
cmp rax, rdi
je 0x14000951c
cmp r11, rdi
je 0x14000951c
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_DecodePointer]
mov rcx, qword [0x1400123d8]
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_DecodePointer]
mov r12, rax
test rsi, rsi
je 0x14000951c
test rax, rax
je 0x14000951c
call rsi
test rax, rax
je 0x140009516
lea rcx, [rsp + 0x30]
mov r9d, 0xc
lea r8, [rsp + 0x38]
mov qword [rsp + 0x20], rcx
lea edx, [r9 - 0xb]
mov rcx, rax
call r12
test eax, eax
je 0x140009516
test byte [rsp + 0x40], 1
jne 0x14000951c
bts ebp, 0x15
jmp 0x14000955c
mov rcx, qword [0x1400123c0]
cmp rcx, rdi
je 0x14000955c
call qword [sym.imp.KERNEL32.dll_DecodePointer]
test rax, rax
je 0x14000955c
call rax
mov rbx, rax
test rax, rax
je 0x14000955c
mov rcx, qword [0x1400123c8]
cmp rcx, rdi
je 0x14000955c
call qword [sym.imp.KERNEL32.dll_DecodePointer]
test rax, rax
je 0x14000955c
mov rcx, rbx
call rax
mov rbx, rax
mov rcx, qword [0x1400123b8]
call qword [sym.imp.KERNEL32.dll_DecodePointer]
test rax, rax
je 0x14000957e
mov r9d, ebp
mov r8, r14
mov rdx, r13
mov rcx, rbx
call rax
jmp 0x140009580
xor eax, eax
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.140002ef0
add rsp, 0x50
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x18000a3f0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x47], 0
je 0x18000a413
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 9]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x46
jb 0x18000a400
mov byte [rcx + 0x47], 0
mov rax, rcx
ret

Function at 0x18000a420
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x70
mov r9, r8
mov rbx, rdx
mov rdi, rcx
mov qword [rsp + 0x68], rcx
xor esi, esi
cmp byte [r8 + 6], sil
je 0x18000a454
mov ecx, esi
lea eax, [rcx - 9]
xor byte [r8 + rcx], al
inc rcx
cmp rcx, 5
jb 0x18000a440
mov byte [r8 + 6], sil
lea rax, [r8 + 5]
mov qword [rsp + 0x48], rsi
mov qword [rsp + 0x58], rsi
mov qword [rsp + 0x60], reloc.WS2_32.dll_ntohs
mov byte [rsp + 0x48], sil
cmp r9, rax
je 0x18000a489
mov r8d, 5
mov rdx, r9
lea rcx, [rsp + 0x48]
call fcn.18000e970
nop
cmp byte [rbx + 0xa], 0
je 0x18000a4b3
mov rcx, rsi
nop dword [rax]
nop word [rax + rax]
lea eax, [rcx - 9]
xor byte [rcx + rbx], al
inc rcx
cmp rcx, 9
jb 0x18000a4a0
mov byte [rbx + 0xa], 0
lea rax, [rbx + 9]
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x40], reloc.WS2_32.dll_ntohs
mov byte [rsp + 0x28], 0
cmp rbx, rax
je 0x18000a4e8
mov r8d, 9
mov rdx, rbx
lea rcx, [rsp + 0x28]
call fcn.18000e970
nop
lea r9, [rsp + 0x48]
lea r8, [rsp + 0x28]
movzx edx, byte [rsp + 0x20]
mov rcx, rdi
call fcn.180011220
nop
mov rdx, qword [rsp + 0x40]
cmp rdx, 0x10
jb 0x18000a541
inc rdx
mov rcx, qword [rsp + 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18000a53b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x18000a53b
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.180153a5c
nop
mov rdx, qword [rsp + 0x60]
cmp rdx, 0x10
jb 0x18000a581
inc rdx
mov rcx, qword [rsp + 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18000a57c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x18000a57c
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.180153a5c
mov rax, rdi
add rsp, 0x70
pop rdi
pop rsi
pop rbx
ret
Function at 0x18000a590
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x50
mov r9, r8
mov rbx, rdx
mov rdi, rcx
mov qword [rsp + 0x48], rcx
xor esi, esi
cmp byte [r8 + 7], sil
je 0x18000a5c4
mov eax, esi
lea ecx, [rax - 9]
xor byte [r8 + rax], cl
inc rax
cmp rax, 6
jb 0x18000a5b0
mov byte [r8 + 7], sil
lea rax, [r8 + 6]
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x40], reloc.WS2_32.dll_ntohs
mov byte [rsp + 0x28], sil
cmp r9, rax
je 0x18000a5f9
mov r8d, 6
mov rdx, r9
lea rcx, [rsp + 0x28]
call fcn.18000e970
nop
mov r9, qword [rbx + 0x10]
cmp qword [rbx + 0x18], 0x10
jb 0x18000a607
mov rbx, qword [rbx]
mov r8, rbx
xor edx, edx
lea rcx, [rsp + 0x28]
call fcn.180012330
mov qword [rdi], rsi
mov qword [rdi + 0x10], rsi
mov qword [rdi + 0x18], rsi
movups xmm0, xmmword [rax]
movups xmmword [rdi], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rdi + 0x10], xmm1
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
mov rdx, qword [rsp + 0x40]
cmp rdx, 0x10
jb 0x18000a67e
inc rdx
mov rcx, qword [rsp + 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18000a679
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x18000a679
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.180153a5c
mov rax, rdi
add rsp, 0x50
pop rdi
pop rsi
pop rbx
ret

Function at 0x18000a690
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x50
mov r9, r8
mov rbx, rdx
mov rdi, rcx
mov qword [rsp + 0x48], rcx
xor esi, esi
cmp byte [r8 + 0xa], sil
je 0x18000a6c4
mov eax, esi
lea ecx, [rax - 9]
xor byte [r8 + rax], cl
inc rax
cmp rax, 9
jb 0x18000a6b0
mov byte [r8 + 0xa], sil
lea rax, [r8 + 9]
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x40], reloc.WS2_32.dll_ntohs
mov byte [rsp + 0x28], sil
cmp r9, rax
je 0x18000a6f9
mov r8d, 9
mov rdx, r9
lea rcx, [rsp + 0x28]
call fcn.18000e970
nop
mov r9, qword [rbx + 0x10]
cmp qword [rbx + 0x18], 0x10
jb 0x18000a707
mov rbx, qword [rbx]
mov r8, rbx
xor edx, edx
lea rcx, [rsp + 0x28]
call fcn.180012330
mov qword [rdi], rsi
mov qword [rdi + 0x10], rsi
mov qword [rdi + 0x18], rsi
movups xmm0, xmmword [rax]
movups xmmword [rdi], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rdi + 0x10], xmm1
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
mov rdx, qword [rsp + 0x40]
cmp rdx, 0x10
jb 0x18000a77e
inc rdx
mov rcx, qword [rsp + 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18000a779
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x18000a779
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.180153a5c
mov rax, rdi
add rsp, 0x50
pop rdi
pop rsi
pop rbx
ret

Function at 0x18000a790
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x136], 0
je 0x18000a7b8
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 9]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x135
jb 0x18000a7a0
mov byte [rcx + 0x136], 0
mov rax, rcx
ret
Function at 0x18000a840
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x50
mov r9, r8
mov rbx, rdx
mov rdi, rcx
mov qword [rsp + 0x48], rcx
xor esi, esi
cmp byte [r8 + 0xc], sil
je 0x18000a874
mov eax, esi
lea ecx, [rax - 9]
xor byte [r8 + rax], cl
inc rax
cmp rax, 0xb
jb 0x18000a860
mov byte [r8 + 0xc], sil
lea rax, [r8 + 0xb]
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x40], reloc.WS2_32.dll_ntohs
mov byte [rsp + 0x28], sil
cmp r9, rax
je 0x18000a8a9
mov r8d, ntohs
mov rdx, r9
lea rcx, [rsp + 0x28]
call fcn.18000e970
nop
mov r9, qword [rbx + 0x10]
cmp qword [rbx + 0x18], 0x10
jb 0x18000a8b7
mov rbx, qword [rbx]
mov r8, rbx
xor edx, edx
lea rcx, [rsp + 0x28]
call fcn.180012330
mov qword [rdi], rsi
mov qword [rdi + 0x10], rsi
mov qword [rdi + 0x18], rsi
movups xmm0, xmmword [rax]
movups xmmword [rdi], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rdi + 0x10], xmm1
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
mov rdx, qword [rsp + 0x40]
cmp rdx, 0x10
jb 0x18000a92e
inc rdx
mov rcx, qword [rsp + 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18000a929
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x18000a929
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.180153a5c
mov rax, rdi
add rsp, 0x50
pop rdi
pop rsi
pop rbx
ret
Function at 0x18000b2d0
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x70
mov r9, r8
mov rbx, rdx
mov rdi, rcx
mov qword [rsp + 0x68], rcx
xor esi, esi
cmp byte [r8 + 6], sil
je 0x18000b304
mov ecx, esi
lea eax, [rcx - 9]
xor byte [r8 + rcx], al
inc rcx
cmp rcx, 5
jb 0x18000b2f0
mov byte [r8 + 6], sil
lea rax, [r8 + 5]
mov qword [rsp + 0x48], rsi
mov qword [rsp + 0x58], rsi
mov qword [rsp + 0x60], reloc.WS2_32.dll_ntohs
mov byte [rsp + 0x48], sil
cmp r9, rax
je 0x18000b339
mov r8d, 5
mov rdx, r9
lea rcx, [rsp + 0x48]
call fcn.18000e970
nop
cmp byte [rbx + 0xd], 0
je 0x18000b363
mov rcx, rsi
nop dword [rax]
nop word [rax + rax]
lea eax, [rcx - 9]
xor byte [rcx + rbx], al
inc rcx
cmp rcx, 0xc
jb 0x18000b350
mov byte [rbx + 0xd], 0
lea rax, [rbx + 0xc]
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x40], reloc.WS2_32.dll_ntohs
mov byte [rsp + 0x28], 0
cmp rbx, rax
je 0x18000b398
mov r8d, ntohs
mov rdx, rbx
lea rcx, [rsp + 0x28]
call fcn.18000e970
nop
lea r9, [rsp + 0x48]
lea r8, [rsp + 0x28]
movzx edx, byte [rsp + 0x20]
mov rcx, rdi
call fcn.180011220
nop
mov rdx, qword [rsp + 0x40]
cmp rdx, 0x10
jb 0x18000b3f1
inc rdx
mov rcx, qword [rsp + 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18000b3eb
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x18000b3eb
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.180153a5c
nop
mov rdx, qword [rsp + 0x60]
cmp rdx, 0x10
jb 0x18000b431
inc rdx
mov rcx, qword [rsp + 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18000b42c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x18000b42c
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.180153a5c
mov rax, rdi
add rsp, 0x70
pop rdi
pop rsi
pop rbx
ret
Function at 0x18000bbd0
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x70
mov r9, r8
mov rbx, rdx
mov rdi, rcx
mov qword [rsp + 0x68], rcx
xor esi, esi
cmp byte [r8 + 8], sil
je 0x18000bc04
mov ecx, esi
lea eax, [rcx - 9]
xor byte [r8 + rcx], al
inc rcx
cmp rcx, 7
jb 0x18000bbf0
mov byte [r8 + 8], sil
lea rax, [r8 + 7]
mov qword [rsp + 0x48], rsi
mov qword [rsp + 0x58], rsi
mov qword [rsp + 0x60], reloc.WS2_32.dll_ntohs
mov byte [rsp + 0x48], sil
cmp r9, rax
je 0x18000bc39
mov r8d, 7
mov rdx, r9
lea rcx, [rsp + 0x48]
call fcn.18000e970
nop
cmp byte [rbx + 9], 0
je 0x18000bc63
mov rcx, rsi
nop dword [rax]
nop word [rax + rax]
lea eax, [rcx - 9]
xor byte [rcx + rbx], al
inc rcx
cmp rcx, 8
jb 0x18000bc50
mov byte [rbx + 9], 0
lea rax, [rbx + 8]
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x40], reloc.WS2_32.dll_ntohs
mov byte [rsp + 0x28], 0
cmp rbx, rax
je 0x18000bc98
mov r8d, 8
mov rdx, rbx
lea rcx, [rsp + 0x28]
call fcn.18000e970
nop
lea r9, [rsp + 0x48]
lea r8, [rsp + 0x28]
movzx edx, byte [rsp + 0x20]
mov rcx, rdi
call fcn.180011220
nop
mov rdx, qword [rsp + 0x40]
cmp rdx, 0x10
jb 0x18000bcf1
inc rdx
mov rcx, qword [rsp + 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18000bceb
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x18000bceb
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.180153a5c
nop
mov rdx, qword [rsp + 0x60]
cmp rdx, 0x10
jb 0x18000bd31
inc rdx
mov rcx, qword [rsp + 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18000bd2c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x18000bd2c
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.180153a5c
mov rax, rdi
add rsp, 0x70
pop rdi
pop rsi
pop rbx
ret
Function at 0x18000c9a0
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x70
mov r9, r8
mov rbx, rdx
mov rdi, rcx
mov qword [rsp + 0x68], rcx
xor esi, esi
cmp byte [r8 + 9], sil
je 0x18000c9d4
mov ecx, esi
lea eax, [rcx - 9]
xor byte [r8 + rcx], al
inc rcx
cmp rcx, 8
jb 0x18000c9c0
mov byte [r8 + 9], sil
lea rax, [r8 + 8]
mov qword [rsp + 0x48], rsi
mov qword [rsp + 0x58], rsi
mov qword [rsp + 0x60], reloc.WS2_32.dll_ntohs
mov byte [rsp + 0x48], sil
cmp r9, rax
je 0x18000ca09
mov r8d, 8
mov rdx, r9
lea rcx, [rsp + 0x48]
call fcn.18000e970
nop
cmp byte [rbx + 0xa], 0
je 0x18000ca33
mov rcx, rsi
nop dword [rax]
nop word [rax + rax]
lea eax, [rcx - 9]
xor byte [rcx + rbx], al
inc rcx
cmp rcx, 9
jb 0x18000ca20
mov byte [rbx + 0xa], 0
lea rax, [rbx + 9]
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x40], reloc.WS2_32.dll_ntohs
mov byte [rsp + 0x28], 0
cmp rbx, rax
je 0x18000ca68
mov r8d, 9
mov rdx, rbx
lea rcx, [rsp + 0x28]
call fcn.18000e970
nop
lea r9, [rsp + 0x48]
lea r8, [rsp + 0x28]
movzx edx, byte [rsp + 0x20]
mov rcx, rdi
call fcn.180011220
nop
mov rdx, qword [rsp + 0x40]
cmp rdx, 0x10
jb 0x18000cac1
inc rdx
mov rcx, qword [rsp + 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18000cabb
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x18000cabb
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.180153a5c
nop
mov rdx, qword [rsp + 0x60]
cmp rdx, 0x10
jb 0x18000cb01
inc rdx
mov rcx, qword [rsp + 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18000cafc
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x18000cafc
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.180153a5c
mov rax, rdi
add rsp, 0x70
pop rdi
pop rsi
pop rbx
ret
Function at 0x18001e3e0
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
sub rsp, 8
mov r9, qword [rcx]
mov r10d, 0x270
mov ecx, dword [r9]
cmp ecx, r10d
jne 0x18001e441
lea r8, [r9 + 8]
nop dword [rax]
mov edx, dword [r8 - 4]
xor edx, dword [r8]
lea r8, [r8 + 4]
btr edx, 0x1f
xor edx, dword [r8 - 8]
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r8 + 0x62c]
xor ecx, edx
mov dword [r8 + 0x9b8], ecx
sub r10, 1
jne 0x18001e400
mov ecx, dword [r9]
jmp 0x18001e528
cmp ecx, 0x4e0
jb 0x18001e528
lea r10, [r9 + 0x9c4]
mov qword [rsp], rbx
mov r11d, dword [r10]
mov ebx, 0xe3
mov eax, r11d
mov r11d, dword [r10 + 4]
mov edx, eax
lea r10, [r10 + 4]
xor edx, r11d
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r10 + 0x630]
xor ecx, edx
mov dword [r10 - 0x9c4], ecx
sub rbx, 1
jne 0x18001e460
lea r10, [r9 + 0xd50]
mov ebx, 0x18c
mov r11d, dword [r10]
nop dword [rax + rax]
mov eax, r11d
mov r11d, dword [r10 + 4]
mov edx, eax
lea r10, [r10 + 4]
xor edx, r11d
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r10 - 0xd50]
xor ecx, edx
mov dword [r10 - 0x9c4], ecx
sub rbx, 1
jne 0x18001e4b0
mov eax, dword [r9 + 0x1380]
mov edx, eax
xor edx, dword [r9 + 4]
mov rbx, qword [rsp]
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r9 + 0x634]
xor ecx, edx
mov dword [r9 + 0x9c0], ecx
xor ecx, ecx
mov dword [r9], ecx
mov eax, ecx
mov edx, dword [r9 + rax*4 + 4]
lea eax, [rcx + 1]
mov dword [r9], eax
mov ecx, edx
mov eax, dword [r9 + 0x1384]
shr ecx, 0xb
and eax, ecx
xor edx, eax
mov eax, edx
and eax, 0xff3a58ad
shl eax, 7
xor edx, eax
mov eax, edx
and edx, 0xffffdf8c
shl edx, 0xf
mov ecx, edx
xor rcx, rax
mov rax, rcx
shr rax, 0x12
xor rax, rcx
add rsp, 8
ret
Function at 0x18001e570
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x30
mov ebp, r9d
mov r15, r8
mov r14, rdx
mov rsi, rcx
call fcn.18001e3e0
mov rdi, rax
add ebp, 0xffffffff
je 0x18001e74a
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], r12
xor r12d, r12d
nop word [rax + rax]
mov r9, qword [rsi]
shl rdi, 0x20
mov ecx, dword [r9]
cmp ecx, 0x270
jne 0x18001e614
lea rax, [r9 + 8]
mov r10d, ecx
nop dword [rax]
mov r8d, dword [rax - 4]
xor r8d, dword [rax]
lea rax, [rax + 4]
btr r8d, 0x1f
xor r8d, dword [rax - 8]
mov ecx, r8d
and cl, 1
neg cl
sbb edx, edx
shr r8d, 1
and edx, 0x9908b0df
xor edx, dword [rax + 0x62c]
xor edx, r8d
mov dword [rax + 0x9b8], edx
sub r10, 1
jne 0x18001e5d0
mov ecx, dword [r9]
jmp 0x18001e6f3
cmp ecx, 0x4e0
jb 0x18001e6f3
lea r10, [r9 + 0x9c4]
mov r11d, 0xe3
mov ebx, dword [r10]
mov eax, ebx
mov ebx, dword [r10 + 4]
mov edx, eax
lea r10, [r10 + 4]
xor edx, ebx
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r10 + 0x630]
xor ecx, edx
mov dword [r10 - 0x9c4], ecx
sub r11, 1
jne 0x18001e630
lea r10, [r9 + 0xd50]
mov r11d, 0x18c
mov ebx, dword [r10]
nop word [rax + rax]
mov eax, ebx
mov ebx, dword [r10 + 4]
mov edx, eax
lea r10, [r10 + 4]
xor edx, ebx
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r10 - 0xd50]
xor ecx, edx
mov dword [r10 - 0x9c4], ecx
sub r11, 1
jne 0x18001e680
mov eax, dword [r9 + 0x1380]
mov edx, eax
xor edx, dword [r9 + 4]
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r9 + 0x634]
xor ecx, edx
mov dword [r9 + 0x9c0], ecx
mov ecx, r12d
mov dword [r9], r12d
mov eax, ecx
mov edx, dword [r9 + rax*4 + 4]
lea eax, [rcx + 1]
mov ecx, edx
mov dword [r9], eax
mov eax, dword [r9 + 0x1384]
shr ecx, 0xb
and eax, ecx
xor edx, eax
mov eax, edx
and eax, 0xff3a58ad
shl eax, 7
xor edx, eax
mov eax, edx
and edx, 0xffffdf8c
shl edx, 0xf
xor rdx, rax
mov rcx, rdx
shr rcx, 0x12
xor rcx, rdx
or rdi, rcx
add ebp, 0xffffffff
jne 0x18001e5b0
mov r12, qword [rsp + 0x20]
mov rbx, qword [rsp + 0x28]
mov rax, r15
mul rdi
mov qword [r14], rax
mov rax, r14
mov qword [r14 + 8], rdx
add rsp, 0x30
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret