joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1800887a0
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
mov eax, 0x28
call fcn.18017e6d0
sub rsp, rax
mov r8d, dword [rcx + 4]
mov r9, rdx
movsxd rdx, dword [rcx]
mov rcx, qword [rcx + 8]
and r8d, 0x100
add rsp, 0x28
jmp fcn.180088540

Function at 0x18008d120
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
mov eax, 0x20
call fcn.18017e6d0
sub rsp, rax
movsxd rsi, r8d
mov rdi, rdx
mov rbp, rcx
mov r8, rsi
call fcn.18017e7c0
test eax, eax
jle case.0x18008d209.2
xor r8d, r8d
test esi, esi
jle 0x18008d187
mov rdx, rbp
mov r9, rdi
mov rcx, rdi
sub rdx, rdi
neg r9
nop dword [rax]
movzx eax, byte [rcx]
cmp byte [rdx + rcx], al
jne 0x18008d187
inc rcx
inc r8d
lea rax, [r9 + rcx]
cmp rax, rsi
jl 0x18008d170
lea edx, [rsi - 1]
movsxd rcx, edx
test edx, edx
js 0x18008d1b6
mov r9, rbp
lea rax, [rcx + rdi]
sub r9, rdi
nop dword [rax + rax]
cmp byte [rax + r9], 0
jne 0x18008d1b6
cmp byte [rax], 0xff
jne 0x18008d1b6
dec edx
dec rax
dec rcx
jns 0x18008d1a0
cmp r8d, edx
jl case.0x18008d209.2
jle 0x18008d1ce
lea eax, [r8*8]
jmp 0x18008d250
movsxd rax, r8d
movzx r9d, byte [rax + rdi]
movzx r10d, byte [rax + rbp]
movzx edx, r9b
xor dl, r10b
movzx eax, dl
dec eax
cmp eax, 0x7e
ja case.0x18008d209.2
lea r11, [0x180000000]
cdqe
movzx eax, byte [r11 + rax + 0x8d288]
mov ecx, dword [r11 + rax*4 + 0x8d268]
add rcx, r11
jmp rcx
mov eax, 7
jmp 0x18008d23a
mov eax, 6
jmp 0x18008d23a
mov eax, 5
jmp 0x18008d23a
mov eax, 4
jmp 0x18008d23a
mov eax, 3
jmp 0x18008d23a
mov eax, 2
jmp 0x18008d23a
mov eax, 1
test dl, r10b
jne case.0x18008d209.2
and r9b, dl
cmp r9b, dl
jne case.0x18008d209.2
lea eax, [rax + r8*8]
jmp 0x18008d250
or eax, 0xffffffff
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret

Function at 0x180092710
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
movzx r9d, byte [rdx]
lea eax, [r8 - 1]
xor edi, edi
movzx r11d, r9b
mov esi, r8d
mov rbx, rcx
shr r11b, 7
test eax, eax
jle 0x180092772
mov r10, rcx
sub rdx, rcx
mov edi, eax
mov r8d, eax
nop word [rax + rax]
movzx ecx, byte [rdx + r10 + 1]
add r9b, r9b
inc r10
movzx eax, cl
shr al, 7
or al, r9b
dec r8
movzx r9d, cl
mov byte [r10 - 1], al
jne 0x180092750
mov eax, 0x87
cmp esi, 0x10
mov rsi, qword [rsp + 0x10]
mov ecx, 0x1b
cmove ecx, eax
movsxd rax, edi
mov rdi, qword [rsp + 0x18]
neg r11b
add r9b, r9b
and cl, r11b
xor cl, r9b
mov byte [rax + rbx], cl
mov rbx, qword [rsp + 8]
ret
Function at 0x180096970
Capabilities:
Encode data using xor

Disassembly:
test r8, r8
je 0x180096acd
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rdi
push r13
push r14
mov eax, 0x20
call fcn.18017e6d0
sub rsp, rax
mov r14, qword [rsp + 0x60]
mov qword [rsp + 0x48], r12
mov r12, qword [rsp + 0x68]
mov r10, r14
mov r13, r9
mov rdi, r8
mov rbx, rdx
mov rbp, rcx
cmp r8, 0x10
jb 0x180096a18
mov qword [rsp + 0x40], rsi
mov rsi, r8
shr rsi, 4
mov rax, rsi
imul rax, rax, 0xfffffffffffffff0
add rdi, rax
nop
mov r8, rbx
sub r10, rbp
mov rcx, rbp
sub r8, rbp
mov edx, 2
mov rax, qword [r10 + rcx]
add rcx, 8
xor rax, qword [rcx - 8]
dec rdx
mov qword [r8 + rcx - 8], rax
jne 0x1800969e1
mov r8, r13
mov rdx, rbx
mov rcx, rbx
call r12
mov r10, rbx
add rbx, 0x10
add rbp, 0x10
dec rsi
jne 0x1800969d0
mov rsi, qword [rsp + 0x40]
test rdi, rdi
je 0x180096aa7
mov rdx, r10
mov r9, rbx
xor r8d, r8d
sub rdx, rbp
sub r9, rbp
mov rcx, rbp
cmp r8, rdi
jae 0x180096a52
movzx eax, byte [rdx + rcx]
inc r8
inc rcx
xor al, byte [rcx - 1]
mov byte [r9 + rcx - 1], al
cmp r8, 0x10
jb 0x180096a33
jmp 0x180096a80
cmp r8, 0x10
jae 0x180096a80
mov edx, reloc.WS2_32.dll_recv
sub r10, rbx
lea rcx, [r8 + rbx]
sub rdx, r8
nop word [rax + rax]
movzx eax, byte [r10 + rcx]
inc rcx
dec rdx
mov byte [rcx - 1], al
jne 0x180096a70
mov r8, r13
mov rdx, rbx
mov rcx, rbx
call r12
mov r10, rbx
cmp rdi, 0x10
jbe 0x180096aa7
add rbx, 0x10
add rbp, 0x10
sub rdi, 0x10
jne 0x180096a21
mov rax, qword [r10]
mov r12, qword [rsp + 0x48]
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov qword [r14], rax
mov rax, qword [r10 + 8]
mov qword [r14 + 8], rax
add rsp, 0x20
pop r14
pop r13
pop rdi
repz ret
Function at 0x180096ad9
Capabilities:
Encode data using xor

Disassembly:
test r8, r8
je 0x180096cb1
push rbx
push rsi
push rdi
push r13
push r14
push r15
mov eax, 0x48
call fcn.18017e6d0
sub rsp, rax
mov rax, qword [0x1802658e0]
xor rax, rsp
mov qword [rsp + 0x30], rax
mov r13, qword [rsp + 0xa0]
mov r15, qword [rsp + 0xa8]
mov r14, r9
mov rbx, r8
mov rsi, rdx
mov rdi, rcx
mov qword [rsp + 0x90], rbp
cmp rcx, rdx
je 0x180096b95
mov qword [rsp + 0x40], r12
mov r12, r13
cmp rbx, 0x10
jb 0x180096b7d
mov rbp, rbx
shr rbp, 4
mov rax, rbp
imul rax, rax, 0xfffffffffffffff0
add rbx, rax
nop word [rax + rax]
mov r8, r14
mov rdx, rsi
mov rcx, rdi
call r15
mov r11, qword [r12]
add rsi, 0x10
xor qword [rsi - 0x10], r11
mov rax, qword [r12 + 8]
mov r12, rdi
xor qword [rsi - 8], rax
add rdi, 0x10
dec rbp
jne 0x180096b50
mov rax, qword [r12]
mov qword [r13], rax
mov rax, qword [r12 + 8]
mov r12, qword [rsp + 0x40]
mov qword [r13 + 8], rax
jmp 0x180096bf4
cmp rbx, 0x10
jb 0x180096bf4
mov rbp, rbx
shr rbp, 4
mov rax, rbp
imul rax, rax, 0xfffffffffffffff0
add rbx, rax
nop dword [rax]
lea rdx, [rsp + 0x20]
mov r8, r14
mov rcx, rdi
call r15
mov r11, qword [rdi]
mov rax, qword [r13]
xor rax, qword [rsp + 0x20]
add rsi, 0x10
add rdi, 0x10
mov qword [rsi - 0x10], rax
mov rax, qword [r13 + 8]
mov qword [r13], r11
mov rcx, qword [rdi - 8]
xor rax, qword [rsp + 0x28]
dec rbp
mov qword [rsi - 8], rax
mov qword [r13 + 8], rcx
jne 0x180096bb0
test rbx, rbx
je 0x180096c8f
lea rax, [rsp + 0x20]
mov rbp, r13
sub rbp, rax
lea rax, [rsp + 0x20]
sub rsi, rax
lea rdx, [rsp + 0x20]
mov r8, r14
mov rcx, rdi
call r15
xor r11d, r11d
cmp r11, rbx
jae 0x180096c4f
movzx r8d, byte [rdi + r11]
movzx ecx, byte [rsp + r11 + 0x20]
lea rdx, [r11 + rbp]
xor cl, byte [rsp + rdx + 0x20]
lea rax, [rsi + r11]
inc r11
mov byte [rsp + rax + 0x20], cl
mov byte [rsp + rdx + 0x20], r8b
cmp r11, 0x10
jb 0x180096c21
cmp rbx, 0x10
jbe 0x180096c65
add rdi, 0x10
add rsi, 0x10
sub rbx, 0x10
jne 0x180096c10
jmp 0x180096c8f
cmp r11, 0x10
jae 0x180096c8f
mov edx, reloc.WS2_32.dll_recv
sub rdi, r13
lea rcx, [r13 + r11]
sub rdx, r11
nop dword [rax + rax]
movzx eax, byte [rdi + rcx]
inc rcx
dec rdx
mov byte [rcx - 1], al
jne 0x180096c80
mov rbp, qword [rsp + 0x90]
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.180179370
add rsp, 0x48
pop r15
pop r14
pop r13
pop rdi
pop rsi
pop rbx
repz ret
Function at 0x180096cc0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x20], r9
push rbx
push rsi
push rdi
push r12
push r13
push r14
mov eax, 0x38
call fcn.18017e6d0
sub rsp, rax
mov rsi, qword [rsp + 0x98]
mov r14, qword [rsp + 0x90]
mov qword [rsp + 0x28], r15
mov ebx, dword [rsi]
mov r10, r9
mov rdi, r8
mov r12, rdx
mov r13, rcx
test ebx, ebx
je 0x180096d27
test rdi, rdi
je 0x180096d27
mov eax, ebx
inc r12
inc r13
movzx ecx, byte [rax + r14]
dec rdi
xor cl, byte [r13 - 1]
inc ebx
and ebx, 0xf
mov byte [r12 - 1], cl
jne 0x180096d02
mov r9, qword [rsp + 0xa0]
movsxd r15, ebx
cmp rdi, 0x10
jb 0x180096df0
mov rsi, r12
mov rcx, rdi
mov qword [rsp + 0x30], rbp
shr rcx, 4
mov rbp, r13
sub rsi, r14
mov rax, rcx
sub rbp, r14
imul rax, rax, 0xfffffffffffffff0
add rdi, rax
mov rax, rcx
shl rax, 4
add r12, rax
add r13, rax
mov qword [rsp + 0x70], r13
mov r13, qword [rsp + 0x88]
mov qword [rsp + 0x78], r12
mov r12, rcx
mov r8, r13
mov rdx, r14
mov rcx, r14
call r9
cmp ebx, 0x10
jae 0x180096db7
mov edx, reloc.WS2_32.dll_ntohs
lea rcx, [r15 + r14]
sub edx, ebx
shr edx, 3
inc edx
mov rax, qword [rcx + rbp]
add rcx, 8
xor rax, qword [rcx - 8]
dec rdx
mov qword [rsi + rcx - 8], rax
jne 0x180096da1
mov r9, qword [rsp + 0xa0]
add rsi, 0x10
add rbp, 0x10
xor ebx, ebx
xor r15d, r15d
dec r12
jne 0x180096d80
mov r12, qword [rsp + 0x78]
mov r13, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x98]
mov r10, qword [rsp + 0x88]
mov rbp, qword [rsp + 0x30]
mov r15, qword [rsp + 0x28]
test rdi, rdi
je 0x180096e35
mov r8, r10
mov rdx, r14
mov rcx, r14
call r9
movsxd rcx, ebx
sub r13, r14
add rcx, r14
sub r12, r14
add ebx, edi
nop word [rax + rax]
movzx eax, byte [rcx + r13]
inc rcx
xor al, byte [rcx - 1]
dec rdi
mov byte [rcx + r12 - 1], al
jne 0x180096e20
mov dword [rsi], ebx
add rsp, 0x38
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret
Function at 0x180097440
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x20], r9
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
mov eax, 0x50
call fcn.18017e6d0
sub rsp, rax
mov r14, qword [rsp + 0xb8]
mov rbp, rdx
mov rdx, qword [rsp + 0xc0]
mov edi, dword [rdx]
mov r10, r9
mov rbx, r8
mov r12, rcx
test edi, edi
je 0x1800974a4
nop
test rbx, rbx
je 0x1800974a4
mov eax, edi
inc rbp
inc r12
movzx ecx, byte [rax + r14]
dec rbx
xor cl, byte [r12 - 1]
inc edi
and edi, 0xf
mov byte [rbp - 1], cl
jne 0x180097480
mov r9, qword [rsp + 0xc8]
mov r13d, reloc.WS2_32.dll_recv
mov qword [rsp + 0x48], r15
mov esi, 1
cmp rbx, r13
jb 0x1800975dd
mov rax, qword [rsp + 0xb0]
mov rcx, rbx
xor edi, edi
add rax, r13
shr rcx, 4
mov r14, rbp
mov qword [rsp + 0x30], rax
mov r15, r12
mov rax, rcx
mov dword [rsp + 0x20], edi
mov rdi, qword [rsp + 0xb8]
imul rax, rax, 0xfffffffffffffff0
add rbx, rax
mov rax, rcx
sub r14, rdi
shl rax, 4
sub r15, rdi
mov qword [rsp + 0xa0], rbx
mov rbx, qword [rsp + 0x30]
add rbp, rax
add r12, rax
mov qword [rsp + 0x90], r12
mov r12, qword [rsp + 0xb0]
mov qword [rsp + 0x98], rbp
mov rbp, rcx
nop word [rax + rax]
mov r8, r10
mov rdx, rdi
mov rcx, r12
call r9
mov r11d, r13d
mov ecx, esi
mov rdx, rbx
nop word [rax + rax]
movzx eax, byte [rdx - 1]
dec rdx
add ecx, eax
mov byte [rdx], cl
shr ecx, 8
dec r11d
jne 0x180097560
mov rcx, rdi
lea edx, [r11 + 2]
nop word [rax + rax]
mov rax, qword [r15 + rcx]
add rcx, 8
xor rax, qword [rcx - 8]
dec rdx
mov qword [r14 + rcx - 8], rax
jne 0x180097580
mov r9, qword [rsp + 0xc8]
mov r10, qword [rsp + 0xa8]
add r14, r13
add r15, r13
dec rbp
jne 0x180097540
mov rbx, qword [rsp + 0xa0]
mov edi, dword [rsp + 0x20]
mov rbp, qword [rsp + 0x98]
mov r12, qword [rsp + 0x90]
mov r14, qword [rsp + 0xb8]
mov rdx, qword [rsp + 0xc0]
test rbx, rbx
je 0x180097642
mov r15, qword [rsp + 0xb0]
mov r8, r10
mov rdx, r14
mov rcx, r15
call r9
lea rcx, [r15 + 0x10]
nop word [rax + rax]
movzx eax, byte [rcx - 1]
dec rcx
add esi, eax
mov byte [rcx], sil
shr esi, 8
dec r13d
jne 0x180097600
movsxd rcx, edi
sub r12, r14
sub rbp, r14
add rcx, r14
add edi, ebx
movzx eax, byte [rcx + r12]
inc rcx
xor al, byte [rcx - 1]
dec rbx
mov byte [rcx + rbp - 1], al
jne 0x180097622
mov rax, qword [rsp + 0xc0]
mov dword [rax], edi
jmp 0x180097644
mov dword [rdx], edi
mov r15, qword [rsp + 0x48]
add rsp, 0x50
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x180097660
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x20], r9
push rbx
push rbp
push rsi
push rdi
push r12
push r14
push r15
mov eax, 0x40
call fcn.18017e6d0
sub rsp, rax
mov rbx, r8
mov r8, qword [rsp + 0xb0]
mov rsi, rdx
mov edi, dword [r8]
mov rbp, rcx
mov dword [rsp + 0x30], edi
test edi, edi
je 0x1800976c5
mov rdx, qword [rsp + 0xa8]
test rbx, rbx
je 0x1800976c1
mov eax, edi
inc rsi
inc rbp
movzx ecx, byte [rax + rdx]
dec rbx
xor cl, byte [rbp - 1]
inc edi
and edi, 0xf
mov byte [rsi - 1], cl
jne 0x1800976a0
mov dword [rsp + 0x30], edi
mov rdx, qword [rsp + 0xa0]
mov r10, qword [rsp + 0xb8]
mov r15d, ntohs
movzx eax, byte [rdx + 0xd]
movzx ecx, byte [rdx + 0xc]
lea r14, [rdx + 0xc]
shl ecx, 8
mov qword [rsp + 0x80], r13
lea r12d, [r15 - 0xb]
or ecx, eax
movzx eax, byte [rdx + 0xe]
shl ecx, 8
or ecx, eax
movzx eax, byte [rdx + 0xf]
shl ecx, 8
or ecx, eax
mov dword [rsp + 0x90], ecx
cmp rbx, 0x10
jb 0x1800977fa
mov eax, 0x10000000
mov rdi, rdx
nop word [rax + rax]
mov r13, rbx
shr r13, 4
cmp r13, rax
cmova r13, rax
add ecx, r13d
mov eax, ecx
mov dword [rsp + 0x90], ecx
cmp rax, r13
jae 0x18009775b
sub r13, rax
xor ecx, ecx
mov dword [rsp + 0x90], ecx
mov r8, r13
mov rdx, rsi
mov rcx, rbp
mov qword [rsp + 0x20], rdi
call r10
mov ecx, dword [rsp + 0x90]
mov eax, ecx
mov r11d, ecx
mov byte [rdi + 0xf], cl
shr eax, 0x10
shr r11d, 0x18
mov byte [rdi + 0xd], al
mov eax, ecx
mov byte [r14], r11b
shr eax, 8
mov byte [rdi + 0xe], al
test ecx, ecx
jne 0x1800977ba
mov r8d, r15d
mov ecx, r12d
mov rdx, r14
nop dword [rax]
movzx eax, byte [rdx - 1]
dec rdx
add ecx, eax
mov byte [rdx], cl
shr ecx, 8
dec r8d
jne 0x1800977a0
mov ecx, dword [rsp + 0x90]
mov r9, qword [rsp + 0x98]
mov r10, qword [rsp + 0xb8]
shl r13, 4
sub rbx, r13
add rsi, r13
add rbp, r13
mov eax, 0x10000000
cmp rbx, 0x10
jae 0x180097730
mov edi, dword [rsp + 0x30]
mov r8, qword [rsp + 0xb0]
mov rdx, qword [rsp + 0xa0]
test rbx, rbx
je 0x1800978af
mov r13, qword [rsp + 0xa8]
xor eax, eax
mov qword [rsp + 0x20], rdx
mov qword [r13], rax
mov rdx, r13
mov rcx, r13
mov r8, r12
mov qword [r13 + 8], rax
call r10
mov rdx, qword [rsp + 0xa0]
mov ecx, dword [rsp + 0x90]
inc ecx
mov eax, ecx
mov byte [rdx + 0xf], cl
shr eax, 0x18
mov byte [r14], al
mov eax, ecx
shr eax, 0x10
mov byte [rdx + 0xd], al
mov eax, ecx
shr eax, 8
mov byte [rdx + 0xe], al
test ecx, ecx
jne 0x180097877
nop word [rax + rax]
movzx eax, byte [r14 - 1]
dec r14
add r12d, eax
mov byte [r14], r12b
shr r12d, 8
dec r15d
jne 0x180097860
movsxd rcx, edi
sub rbp, r13
sub rsi, r13
add rcx, r13
add edi, ebx
nop word [rax + rax]
movzx eax, byte [rcx + rbp]
inc rcx
xor al, byte [rcx - 1]
dec rbx
mov byte [rsi + rcx - 1], al
jne 0x180097890
mov rax, qword [rsp + 0xb0]
mov dword [rax], edi
jmp 0x1800978b2
mov dword [r8], edi
mov r13, qword [rsp + 0x80]
add rsp, 0x40
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x180099640
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r13
mov eax, 0x20
call fcn.18017e6d0
sub rsp, rax
xor r13d, r13d
mov rsi, r8
mov rbp, rdx
mov rdi, rcx
mov qword [rcx + 0x30], r13
mov qword [rcx + 0x38], r13
mov qword [rcx + 0x170], r13
cmp r8, 0xc
jne 0x180099691
mov rax, qword [rdx]
lea ebx, [r8 - 0xb]
mov qword [rcx], rax
mov eax, dword [rdx + 8]
mov dword [rcx + 0xc], 0x1000000
mov dword [rcx + 8], eax
jmp 0x1800997f0
mov qword [rsp + 0x50], r12
mov qword [rsp + 0x60], r15
mov qword [rcx + 0x40], r13
mov r15, r8
mov qword [rcx + 0x48], r13
cmp r8, 0x10
jb 0x180099734
mov r13, r8
mov rbx, rdx
mov qword [rsp + 0x58], r14
shr r13, 4
sub rbx, rcx
mov rax, r13
sub rbx, 0x3f
imul rax, rax, 0xfffffffffffffff0
add rsi, rax
mov rax, r13
shl rax, 4
add rbp, rax
nop word [rax + rax]
lea rcx, [rdi + 0x40]
mov edx, 4
nop dword [rax]
movzx eax, byte [rbx + rcx - 1]
add rcx, 4
xor byte [rcx - 4], al
movzx eax, byte [rbx + rcx - 4]
xor byte [rcx - 3], al
movzx eax, byte [rbx + rcx - 3]
xor byte [rcx - 2], al
movzx eax, byte [rbx + rcx - 2]
xor byte [rcx - 1], al
dec rdx
jne 0x1800996f0
lea rdx, [rdi + 0x60]
lea rcx, [rdi + 0x40]
call fcn.180099240
add rbx, 0x10
dec r13
jne 0x1800996e0
mov r14, qword [rsp + 0x58]
test rsi, rsi
je 0x18009975d
lea rcx, [rdi + 0x40]
sub rbp, rdi
movzx eax, byte [rcx + rbp - 0x40]
inc rcx
xor byte [rcx - 1], al
dec rsi
jne 0x180099740
lea rdx, [rdi + 0x60]
lea rcx, [rdi + 0x40]
call fcn.180099240
shl r15, 3
lea rdx, [rdi + 0x60]
lea rcx, [rdi + 0x40]
xor byte [rdi + 0x4f], r15b
mov rax, r15
shr rax, 0x38
xor byte [rdi + 0x48], al
mov rax, r15
shr rax, 0x30
xor byte [rdi + 0x49], al
mov rax, r15
shr rax, 0x28
xor byte [rdi + 0x4a], al
mov rax, r15
shr rax, 0x20
xor byte [rdi + 0x4b], al
mov rax, r15
shr rax, 0x18
xor byte [rdi + 0x4c], al
mov rax, r15
shr rax, 0x10
xor byte [rdi + 0x4d], al
mov rax, r15
shr rax, 8
xor byte [rdi + 0x4e], al
call fcn.180099240
movzx eax, byte [rdi + 0x4d]
movzx ebx, byte [rdi + 0x4c]
mov r15, qword [rsp + 0x60]
mov r12, qword [rsp + 0x50]
shl ebx, 8
or ebx, eax
movzx eax, byte [rdi + 0x4e]
shl ebx, 8
or ebx, eax
movzx eax, byte [rdi + 0x4f]
shl ebx, 8
or ebx, eax
mov rax, qword [rdi + 0x40]
mov qword [rdi], rax
mov rax, qword [rdi + 0x48]
mov qword [rdi + 8], rax
mov r8, qword [rdi + 0x180]
lea rdx, [rdi + 0x20]
mov rcx, rdi
mov qword [rdi + 0x40], r13
mov qword [rdi + 0x48], r13
call qword [rdi + 0x178]
inc ebx
mov eax, ebx
mov byte [rdi + 0xf], bl
shr eax, 0x18
mov byte [rdi + 0xc], al
mov eax, ebx
shr eax, 0x10
mov byte [rdi + 0xd], al
mov eax, ebx
shr eax, 8
mov byte [rdi + 0xe], al
add rsp, 0x20
pop r13
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x180099840
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rdi
mov eax, 0x20
call fcn.18017e6d0
sub rsp, rax
cmp qword [rcx + 0x38], 0
mov rbx, r8
mov rbp, rdx
mov rdi, rcx
je 0x18009987d
mov eax, 0xfffffffe
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret
mov rax, qword [rcx + 0x30]
lea rcx, [r8 + rax]
movabs rax, 0x2000000000000000
cmp rcx, rax
ja 0x18009994d
cmp rcx, rbx
jb 0x18009994d
mov qword [rsp + 0x30], rsi
mov esi, dword [rdi + 0x174]
mov qword [rdi + 0x30], rcx
test esi, esi
je 0x1800998e3
test rbx, rbx
je 0x1800998d2
movzx eax, byte [rbp]
mov ecx, esi
inc rbp
xor byte [rcx + rdi + 0x40], al
dec rbx
inc esi
and esi, 0xf
jne 0x1800998b4
jmp 0x1800998d6
test esi, esi
jne 0x180099930
lea rdx, [rdi + 0x60]
lea rcx, [rdi + 0x40]
call fcn.180099240
mov qword [rsp + 0x38], r12
mov r12, rbx
and r12, 0xfffffffffffffff0
je 0x18009990a
lea rdx, [rdi + 0x60]
lea rcx, [rdi + 0x40]
mov r9, r12
mov r8, rbp
call fcn.180099380
add rbp, r12
sub rbx, r12
mov r12, qword [rsp + 0x38]
test rbx, rbx
je 0x180099930
mov esi, ebx
lea rcx, [rdi + 0x40]
sub rbp, rdi
nop dword [rax]
movzx eax, byte [rcx + rbp - 0x40]
inc rcx
xor byte [rcx - 1], al
dec rbx
jne 0x180099920
mov dword [rdi + 0x174], esi
mov rsi, qword [rsp + 0x30]
xor eax, eax
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
or eax, 0xffffffff
add rsp, 0x20
pop rdi
ret
Function at 0x18009b1e0
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov eax, 0x68
call fcn.18017e6d0
sub rsp, rax
mov rax, qword [0x1802658e0]
xor rax, rsp
mov qword [rsp + 0x58], rax
movzx edi, byte [rcx]
mov rax, qword [rcx + 0x28]
mov r12, qword [rsp + 0xd0]
mov rsi, r9
mov r9, qword [rcx + 0x30]
mov r15, r8
mov r13, rdx
mov rbx, rcx
mov byte [rsp + 0x30], dil
mov qword [rsp + 0x38], r9
mov qword [rsp + 0x40], rax
test dil, 0x40
jne 0x18009b24f
lea rdx, [rcx + 0x10]
mov r8, r9
call rax
inc qword [rbx + 0x20]
mov r9, qword [rsp + 0x38]
movzx eax, dil
mov r8d, reloc.WS2_32.dll_ntohs
xor ebp, ebp
and eax, 7
mov r14d, r8d
mov ecx, ebp
sub r14d, eax
mov byte [rbx], al
movsxd rax, r14d
cmp r14d, r8d
jae 0x18009b295
lea rdx, [rax + rbx]
sub r8d, r14d
nop word [rax + rax]
movzx eax, byte [rdx]
mov byte [rdx], bpl
inc rdx
or rcx, rax
shl rcx, 8
dec r8
jne 0x18009b280
movzx eax, byte [rbx + 0xf]
mov byte [rbx + 0xf], 1
or rcx, rax
cmp rcx, rsi
je 0x18009b2ad
or eax, 0xffffffff
jmp 0x18009b44c
lea rax, [rsi + 0xf]
or rax, 8
shr rax, 3
add qword [rbx + 0x20], rax
movabs rax, 0x2000000000000000
cmp qword [rbx + 0x20], rax
jbe 0x18009b2d7
mov eax, 0xfffffffe
jmp 0x18009b44c
mov rdi, rsi
shr rdi, 4
test rdi, rdi
je 0x18009b360
lea rax, [rbx + 0x10]
mov r8, rdi
mov rdx, r15
mov qword [rsp + 0x28], rax
mov rcx, r13
mov qword [rsp + 0x20], rbx
call r12
shl rdi, 4
add r13, rdi
add r15, rdi
sub rsi, rdi
je 0x18009b3fc
lea r9, [rbx + 8]
shr rdi, 4
mov rdx, rbp
lea r8, [r9 + 8]
neg r9
nop word [rax + rax]
movzx eax, byte [r8 - 1]
dec r8
movzx ecx, dil
add rdx, rax
lea rax, [r9 + r8]
shr rdi, 8
add rdx, rcx
mov byte [r8], dl
shr rdx, 8
test rax, rax
je 0x18009b360
test rdi, rdi
jne 0x18009b330
test rdx, rdx
jne 0x18009b330
test rsi, rsi
je 0x18009b3fc
mov r8, r13
mov edx, ebp
lea rcx, [rbx + 0x10]
sub r8, rbx
nop word [rax + rax]
movzx eax, byte [r8 + rcx - 0x10]
inc edx
inc rcx
xor byte [rcx - 1], al
mov eax, edx
cmp rax, rsi
jb 0x18009b380
mov rdi, qword [rsp + 0x38]
mov r12, qword [rsp + 0x40]
lea rcx, [rbx + 0x10]
mov r8, rdi
mov rdx, rcx
call r12
lea rdx, [rsp + 0x48]
mov r8, rdi
mov rcx, rbx
call r12
test rsi, rsi
je 0x18009b406
lea rax, [rsp + 0x48]
lea rcx, [rsp + 0x48]
sub r13, rax
lea rax, [rsp + 0x48]
sub r15, rax
nop word [rax + rax]
movzx eax, byte [r13 + rcx]
inc ebp
inc rcx
xor al, byte [rcx - 1]
mov byte [r15 + rcx - 1], al
mov eax, ebp
cmp rax, rsi
jb 0x18009b3e0
jmp 0x18009b406
mov r12, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x38]
movsxd rax, r14d
cmp r14d, 0x10
jae 0x18009b423
mov r8d, reloc.WS2_32.dll_recv
lea rcx, [rax + rbx]
xor edx, edx
sub r8d, r14d
call fcn.18017e8a0
lea rdx, [rsp + 0x48]
mov r8, rdi
mov rcx, rbx
call r12
mov rax, qword [rsp + 0x48]
xor qword [rbx + 0x10], rax
mov rax, qword [rsp + 0x50]
xor qword [rbx + 0x18], rax
movzx eax, byte [rsp + 0x30]
mov byte [rbx], al
xor eax, eax
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.180179370
add rsp, 0x68
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x18009b470
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov eax, 0x68
call fcn.18017e6d0
sub rsp, rax
mov rax, qword [0x1802658e0]
xor rax, rsp
mov qword [rsp + 0x58], rax
movzx ebx, byte [rcx]
mov rax, qword [rcx + 0x28]
mov r13, qword [rsp + 0xd0]
mov r14, qword [rcx + 0x30]
mov rsi, r9
mov r10, r8
mov qword [rsp + 0x38], r8
mov r15, rdx
mov rdi, rcx
mov byte [rsp + 0x30], bl
mov qword [rsp + 0x40], rax
test bl, 0x40
jne 0x18009b4d9
lea rdx, [rcx + 0x10]
mov r8, r14
call rax
mov r10, qword [rsp + 0x38]
movzx eax, bl
mov r8d, reloc.WS2_32.dll_ntohs
xor ebp, ebp
and eax, 7
mov r12d, r8d
mov ecx, ebp
sub r12d, eax
mov byte [rdi], al
movsxd rax, r12d
cmp r12d, r8d
jae 0x18009b515
lea rdx, [rax + rdi]
sub r8d, r12d
movzx eax, byte [rdx]
mov byte [rdx], bpl
inc rdx
or rcx, rax
shl rcx, 8
dec r8
jne 0x18009b500
movzx eax, byte [rdi + 0xf]
mov byte [rdi + 0xf], 1
or rcx, rax
cmp rcx, rsi
je 0x18009b52d
or eax, 0xffffffff
jmp 0x18009b66a
mov rbx, rsi
shr rbx, 4
test rbx, rbx
je 0x18009b5b1
lea rax, [rdi + 0x10]
mov r9, r14
mov r8, rbx
mov qword [rsp + 0x28], rax
mov rdx, r10
mov rcx, r15
mov qword [rsp + 0x20], rdi
call r13
mov r13, qword [rsp + 0x38]
shl rbx, 4
add r13, rbx
add r15, rbx
sub rsi, rbx
je 0x18009b620
lea r9, [rdi + 8]
shr rbx, 4
mov rdx, rbp
lea r8, [r9 + 8]
neg r9
movzx eax, byte [r8 - 1]
dec r8
movzx ecx, bl
add rdx, rax
lea rax, [r9 + r8]
shr rbx, 8
add rdx, rcx
mov byte [r8], dl
shr rdx, 8
test rax, rax
je 0x18009b5b6
test rbx, rbx
jne 0x18009b580
test rdx, rdx
jne 0x18009b580
jmp 0x18009b5b6
mov r13, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x40]
test rsi, rsi
je 0x18009b625
lea rdx, [rsp + 0x48]
mov r8, r14
mov rcx, rdi
call rbx
test rsi, rsi
je 0x18009b612
lea rax, [rsp + 0x48]
mov r8, rdi
lea rdx, [rsp + 0x48]
sub r15, rax
lea rax, [rsp + 0x48]
sub r13, rax
lea rax, [rsp + 0x48]
sub r8, rax
movzx ecx, byte [r15 + rdx]
movzx eax, byte [rdx]
inc ebp
xor ecx, eax
mov eax, ebp
inc rdx
mov byte [r13 + rdx - 1], cl
xor byte [r8 + rdx + 0xf], cl
cmp rax, rsi
jb 0x18009b5f2
lea rcx, [rdi + 0x10]
mov r8, r14
mov rdx, rcx
call rbx
jmp 0x18009b625
mov rbx, qword [rsp + 0x40]
movsxd rax, r12d
cmp r12d, 0x10
jae 0x18009b642
mov r8d, reloc.WS2_32.dll_recv
lea rcx, [rax + rdi]
xor edx, edx
sub r8d, r12d
call fcn.18017e8a0
lea rdx, [rsp + 0x48]
mov r8, r14
mov rcx, rdi
call rbx
mov rax, qword [rsp + 0x48]
xor qword [rdi + 0x10], rax
mov rax, qword [rsp + 0x50]
xor qword [rdi + 0x18], rax
movzx eax, byte [rsp + 0x30]
mov byte [rdi], al
xor eax, eax
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.180179370
add rsp, 0x68
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret