joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1801b01d0
Capabilities:
Enumerate process modules

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
mov eax, 0x1188
call fcn.1802cf310
sub rsp, rax
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x1100], 0xfffffffffffffffe
mov qword [rbp + 0x10f8], rcx
mov rax, qword [0x18053cad0]
xor ecx, ecx
xor edx, edx
sub rdx, qword [0x18053cb10]
movabs r9, 0x57d909bafff2a323
xor rdx, r9
lea rdx, [rdx + rdx*2]
lea rdx, [rdx*2 + 6]
xor rdx, r9
mov rax, qword [rax + rdx + 0x29]
mov rdx, qword [0x18053cac8]
xor r8d, r8d
sub r8, qword [0x18053cb08]
xor r8, r9
lea r8, [r8 + r8*4]
add r8, 5
xor r8, r9
sub rcx, qword [rdx + r8 + 0x29]
movabs rdx, 0x63304d3782496483
xor rcx, rdx
lea rcx, [rcx + rcx*4]
add rcx, 5
xor rcx, rdx
add rax, rcx
inc rax
lea rcx, [rbp + 0x10c8]
call rax
lea rdi, [rbp - 0x60]
lea r8, [rbp + 0x10f4]
mov rcx, rdi
mov edx, 0x1000
call sub.KERNEL32.dll_K32EnumProcesses
xor ecx, ecx
test eax, eax
sete cl
lea r8, [rcx*2 + 7]
mov rcx, qword [0x18053caa8]
xor edx, edx
xor eax, eax
sub rax, qword [0x18053cae8]
movabs r14, 0x57d909bafff2a323
xor rax, r14
inc rax
xor rax, r14
add rax, rcx
lea r9d, [r8*8]
mov r10, qword [r9 + rax + 1]
mov rax, qword [0x18053cab8]
xor r11d, r11d
sub r11, qword [0x18053caf8]
xor r11, r14
lea r11, [r11 + r11*2]
add r11, 3
xor r11, r14
add r11, rax
sub rdx, qword [r9 + r11 + 1]
movabs r9, 0xadeb4efd11b82566
xor rdx, r9
inc rdx
imul rdx, r8
xor rdx, r9
add rdx, r10
inc rdx
jmp rdx

Function at 0x1802c8180
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x68
mov r8d, gethostbyname
lea rdx, [rsp + 0x20]
mov rcx, qword [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
nop
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x50]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x1802c81c2
xor al, al
jmp 0x1802c8240
mov rax, qword [rsp + 0x50]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x50]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x58], rax
mov rax, qword [rsp + 0x58]
cmp dword [rax], 0x4550
je 0x1802c81ec
xor al, al
jmp 0x1802c8240
mov rax, qword [rsp + 0x58]
mov eax, dword [rax + 0xe8]
mov rcx, qword [rsp + 0x50]
add rcx, rax
mov rax, rcx
cmp qword [rsp + 0x78], rax
jb 0x1802c8238
mov rax, qword [rsp + 0x58]
mov eax, dword [rax + 0xe8]
mov rcx, qword [rsp + 0x50]
add rcx, rax
mov rax, rcx
mov rcx, qword [rsp + 0x58]
mov ecx, dword [rcx + 0xec]
add rax, rcx
cmp qword [rsp + 0x78], rax
jae 0x1802c8238
mov al, 1
jmp 0x1802c8240
xor al, al
jmp 0x1802c8240
add rsp, 0x68
ret

Function at 0x1802c82d0
Capabilities:
Allocate or change rwx memory

Disassembly:
sub rsp, 0x38
mov rax, qword [0x1805b5af0]
mov qword [rsp + 0x20], rax
jmp 0x1802c82f0
mov rax, qword [rsp + 0x20]
mov rax, qword [rax + 8]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
je 0x1802c8315
lea r9, [rsp + 0x28]
mov r8d, 0x40
mov edx, 0x10000
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
jmp 0x1802c82e2
add rsp, 0x38
ret
Function at 0x1802c8320
Capabilities:
Resume thread

Disassembly:
sub rsp, 0x68
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [0x1805b5b08], eax
je 0x1802c833c
mov eax, 0x10dd
jmp 0x1802c8459
mov rax, qword [0x1805b5b20]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x20], 0
je 0x1802c83e2
mov rax, qword [rsp + 0x20]
mov rax, qword [rax + 0x20]
movzx eax, byte [rax + 0x3e]
lea r9, [rsp + 0x30]
mov rcx, qword [rsp + 0x20]
mov r8d, dword [rcx + 0x28]
mov edx, eax
mov rax, qword [rsp + 0x20]
mov rcx, qword [rax + 0x18]
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov rax, qword [rsp + 0x20]
cmp dword [rax + 8], 0
jne 0x1802c83b2
mov rax, qword [rsp + 0x20]
cmp qword [rax + 0x20], 0
je 0x1802c83b2
mov rax, qword [rsp + 0x20]
mov rcx, qword [rax + 0x20]
call fcn.1802c84d0
mov rax, qword [rsp + 0x20]
mov qword [rax + 0x20], 0
mov rax, qword [rsp + 0x20]
mov rax, qword [rax]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x20]
mov qword [rsp + 0x48], rax
mov rcx, qword [rsp + 0x48]
call fcn.1802e2210
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0x20], rax
jmp 0x1802c8348
mov qword [0x1805b5b20], 0
call fcn.1802c8460
mov rax, qword [0x1805b5b18]
mov qword [rsp + 0x38], rax
cmp qword [rsp + 0x38], 0
je 0x1802c8442
mov rax, qword [rsp + 0x38]
mov rcx, qword [rax + 8]
call qword [sym.imp.KERNEL32.dll_ResumeThread]
mov rax, qword [rsp + 0x38]
mov rax, qword [rax]
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x38]
mov qword [rsp + 0x50], rax
mov rcx, qword [rsp + 0x50]
call fcn.1802e2210
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x38], rax
jmp 0x1802c83fe
mov qword [0x1805b5b18], 0
mov dword [0x1805b5b08], 0
xor eax, eax
add rsp, 0x68
ret
Function at 0x1802c8bd0
Capabilities:
Hook routines via microsoft detours

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x28
mov rax, qword [rsp + 0x30]
cmp dword [rax], 0x52727464
je 0x1802c8bed
xor eax, eax
jmp 0x1802c8c85
mov rax, qword [rsp + 0x30]
mov qword [rsp], rax
mov rax, qword [rsp]
add rax, 0x10000
mov qword [rsp + 8], rax
mov rax, qword [rsp + 0x30]
add rax, 0x60
mov qword [rsp + 0x10], rax
mov dword [rsp + 0x18], 0
jmp 0x1802c8c27
mov eax, dword [rsp + 0x18]
inc eax
mov dword [rsp + 0x18], eax
cmp dword [rsp + 0x18], 0x2a9
jae 0x1802c8c80
movsxd rax, dword [rsp + 0x18]
imul rax, rax, 0x60
mov rcx, qword [rsp + 0x10]
cmp qword [rcx + rax + 0x48], 0
je 0x1802c8c7e
movsxd rax, dword [rsp + 0x18]
imul rax, rax, 0x60
mov rcx, qword [rsp + 0x10]
mov rdx, qword [rsp]
cmp qword [rcx + rax + 0x48], rdx
jb 0x1802c8c7a
movsxd rax, dword [rsp + 0x18]
imul rax, rax, 0x60
mov rcx, qword [rsp + 0x10]
mov rdx, qword [rsp + 8]
cmp qword [rcx + rax + 0x48], rdx
jb 0x1802c8c7e
xor eax, eax
jmp 0x1802c8c85
jmp 0x1802c8c1d
mov eax, 1
add rsp, 0x28
ret
Function at 0x1802c9980
Capabilities:
Allocate or change rwx memory

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x68
mov rcx, qword [rsp + 0x70]
call fcn.1802c9a80
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x78]
cmp qword [rsp + 0x20], rax
jae 0x1802c9a78
cmp qword [rsp + 0x20], 0x50000000
jb 0x1802c99d0
mov eax, 0x80000000
cmp qword [rsp + 0x20], rax
ja 0x1802c99d0
mov eax, 0x80010000
mov qword [rsp + 0x20], rax
jmp 0x1802c999d
mov r8d, gethostbyname
xor edx, edx
lea rcx, [rsp + 0x28]
call fcn.18034bad0
mov r8d, gethostbyname
lea rdx, [rsp + 0x28]
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
jne 0x1802c99ff
jmp 0x1802c9a78
cmp dword [rsp + 0x48], 0x10000
jne 0x1802c9a56
cmp qword [rsp + 0x40], 0x10000
jb 0x1802c9a56
mov r9d, 0x40
mov r8d, 0x3000
mov edx, 0x10000
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov qword [rsp + 0x58], rax
cmp qword [rsp + 0x58], 0
je 0x1802c9a44
mov rax, qword [rsp + 0x58]
jmp 0x1802c9a7a
mov rax, qword [rsp + 0x20]
add rax, 0x10000
mov qword [rsp + 0x20], rax
jmp 0x1802c9a73
mov rax, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x28]
add rcx, rax
mov rax, rcx
mov rcx, rax
call fcn.1802c9a80
mov qword [rsp + 0x20], rax
jmp 0x1802c999d
xor eax, eax
add rsp, 0x68
ret

Function at 0x1802c9ad0
Capabilities:
Allocate or change rwx memory

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x68
mov rax, qword [rsp + 0x78]
sub rax, 0x10000
mov rcx, rax
call fcn.1802c9be0
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x70]
cmp qword [rsp + 0x20], rax
jbe 0x1802c9bcb
cmp qword [rsp + 0x20], 0x50000000
jb 0x1802c9b28
mov eax, 0x80000000
cmp qword [rsp + 0x20], rax
ja 0x1802c9b28
mov qword [rsp + 0x20], 0x4fff0000
jmp 0x1802c9af6
mov r8d, gethostbyname
xor edx, edx
lea rcx, [rsp + 0x28]
call fcn.18034bad0
mov r8d, gethostbyname
lea rdx, [rsp + 0x28]
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
jne 0x1802c9b57
jmp 0x1802c9bcb
cmp dword [rsp + 0x48], 0x10000
jne 0x1802c9bae
cmp qword [rsp + 0x40], 0x10000
jb 0x1802c9bae
mov r9d, 0x40
mov r8d, 0x3000
mov edx, 0x10000
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov qword [rsp + 0x58], rax
cmp qword [rsp + 0x58], 0
je 0x1802c9b9c
mov rax, qword [rsp + 0x58]
jmp 0x1802c9bcd
mov rax, qword [rsp + 0x20]
sub rax, 0x10000
mov qword [rsp + 0x20], rax
jmp 0x1802c9bc6
mov rax, qword [rsp + 0x30]
sub rax, 0x10000
mov rcx, rax
call fcn.1802c9be0
mov qword [rsp + 0x20], rax
jmp 0x1802c9af6
xor eax, eax
add rsp, 0x68
ret
Function at 0x1802c9e60
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x78
cmp qword [rsp + 0x80], 0
jne 0x1802c9e7f
mov qword [rsp + 0x20], 0x10000
jmp 0x1802c9e92
mov rax, qword [rsp + 0x80]
add rax, 0x10000
mov qword [rsp + 0x20], rax
mov r8d, gethostbyname
xor edx, edx
lea rcx, [rsp + 0x28]
call fcn.18034bad0
jmp 0x1802c9ebb
mov rax, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x28]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x20], rax
mov r8d, gethostbyname
lea rdx, [rsp + 0x28]
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
ja 0x1802c9edb
jmp 0x1802c9f78
cmp dword [rsp + 0x48], 0x1000
jne 0x1802c9f00
mov eax, dword [rsp + 0x4c]
and eax, 0xff
cmp eax, 1
je 0x1802c9f00
mov eax, dword [rsp + 0x4c]
and eax, 0x100
test eax, eax
je 0x1802c9f02
jmp 0x1802c9ea6
mov rax, qword [rsp + 0x20]
mov qword [rsp + 0x58], rax
mov rax, qword [rsp + 0x58]
movzx eax, word [rax]
cmp eax, 0x5a4d
jne 0x1802c9f38
mov rax, qword [rsp + 0x58]
mov eax, dword [rax + 0x3c]
cmp rax, qword [rsp + 0x40]
ja 0x1802c9f38
mov rax, qword [rsp + 0x58]
mov eax, dword [rax + 0x3c]
cmp rax, 0x40
jae 0x1802c9f3d
jmp 0x1802c9ea6
mov rax, qword [rsp + 0x58]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x58]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x60], rax
mov rax, qword [rsp + 0x60]
cmp dword [rax], 0x4550
jne 0x1802c9ea6
mov rax, qword [rsp + 0x58]
jmp 0x1802c9f7a
xor eax, eax
add rsp, 0x78
ret
Function at 0x1802c9f80
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x58
mov rax, qword [rsp + 0x60]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x60], 0
jne 0x1802c9fa8
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x20]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x1802c9fc9
mov ecx, 0xc1
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
jmp 0x1802ca147
mov rax, qword [rsp + 0x20]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x20]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
cmp dword [rax], 0x4550
je 0x1802ca001
mov ecx, 0xbf
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
jmp 0x1802ca147
mov rax, qword [rsp + 0x30]
movzx eax, word [rax + 0x14]
test eax, eax
jne 0x1802ca020
mov ecx, 0xc0
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
jmp 0x1802ca147
mov rax, qword [rsp + 0x30]
movzx eax, word [rax + 0x14]
mov rcx, qword [rsp + 0x30]
lea rax, [rcx + rax + 0x18]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x38], 0
jmp 0x1802ca04c
mov eax, dword [rsp + 0x38]
inc eax
mov dword [rsp + 0x38], eax
mov rax, qword [rsp + 0x30]
movzx eax, word [rax + 6]
cmp dword [rsp + 0x38], eax
jae 0x1802ca129
mov eax, dword [rsp + 0x38]
imul rax, rax, 0x28
mov rcx, qword [rsp + 0x28]
add rcx, rax
mov rax, rcx
lea rdx, str..detour
mov rcx, rax
call fcn.18035f590
test eax, eax
jne 0x1802ca124
mov eax, dword [rsp + 0x38]
imul rax, rax, 0x28
mov rcx, qword [rsp + 0x28]
cmp dword [rcx + rax + 0xc], 0
je 0x1802ca0b1
mov eax, dword [rsp + 0x38]
imul rax, rax, 0x28
mov rcx, qword [rsp + 0x28]
cmp dword [rcx + rax + 0x10], 0
jne 0x1802ca0b3
jmp 0x1802ca129
mov eax, dword [rsp + 0x38]
imul rax, rax, 0x28
mov rcx, qword [rsp + 0x28]
mov eax, dword [rcx + rax + 0xc]
mov rcx, qword [rsp + 0x20]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x48]
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
mov eax, dword [rax]
cmp rax, 0x40
jb 0x1802ca0f9
mov rax, qword [rsp + 0x40]
cmp dword [rax + 4], 0x727444
je 0x1802ca0fb
jmp 0x1802ca129
mov rax, qword [rsp + 0x40]
cmp dword [rax + 8], 0
jne 0x1802ca115
mov rax, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x40]
mov ecx, dword [rcx]
mov dword [rax + 8], ecx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rax, qword [rsp + 0x40]
jmp 0x1802ca147
jmp 0x1802ca042
mov ecx, 0xc0
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
jmp 0x1802ca147
add rsp, 0x58
ret
Function at 0x1802ca410
Capabilities:
Allocate or change rwx memory

Disassembly:
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
sub rsp, 0x48
mov rax, qword [rsp + 0x50]
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x38]
mov eax, dword [rax]
cmp rax, 0x688
jne 0x1802ca443
mov rax, qword [rsp + 0x38]
mov ecx, dword [rsp + 0x58]
cmp dword [rax], ecx
jbe 0x1802ca455
mov ecx, 0xc1
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
jmp 0x1802ca5f2
mov dword [rsp + 0x30], 0xffffffff
mov dword [rsp + 0x20], 0xffffffff
mov dword [rsp + 0x2c], 0xffffffff
mov dword [rsp + 0x24], 0
mov rax, qword [rsp + 0x38]
mov eax, dword [rax + 4]
lea r9, [rsp + 0x30]
mov r8d, 0x40
mov edx, eax
mov rax, qword [rsp + 0x38]
mov rcx, qword [rax + 0x10]
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x1802ca5ee
mov rax, qword [rsp + 0x38]
mov eax, dword [rax + 8]
lea r9, [rsp + 0x20]
mov r8d, 0x40
mov edx, eax
mov rax, qword [rsp + 0x38]
mov rcx, qword [rax + 0x18]
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x1802ca5cb
mov rax, qword [rsp + 0x38]
mov eax, dword [rax + 4]
mov rcx, qword [rsp + 0x38]
add rcx, 0x28
mov r8d, eax
mov rdx, rcx
mov rax, qword [rsp + 0x38]
mov rcx, qword [rax + 0x10]
call fcn.18034b420
mov rax, qword [rsp + 0x38]
mov eax, dword [rax + 8]
mov rcx, qword [rsp + 0x38]
add rcx, 0x68
mov r8d, eax
mov rdx, rcx
mov rax, qword [rsp + 0x38]
mov rcx, qword [rax + 0x18]
call fcn.18034b420
mov rax, qword [rsp + 0x38]
cmp qword [rax + 0x20], 0
je 0x1802ca5a0
mov rax, qword [rsp + 0x38]
mov eax, dword [rax + 0xc]
lea r9, [rsp + 0x2c]
mov r8d, 0x40
mov edx, eax
mov rax, qword [rsp + 0x38]
mov rcx, qword [rax + 0x20]
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x1802ca59e
mov rax, qword [rsp + 0x38]
mov eax, dword [rax + 0xc]
mov rcx, qword [rsp + 0x38]
add rcx, 0x670
mov r8d, eax
mov rdx, rcx
mov rax, qword [rsp + 0x38]
mov rcx, qword [rax + 0x20]
call fcn.18034b420
mov rax, qword [rsp + 0x38]
mov eax, dword [rax + 0xc]
lea r9, [rsp + 0x28]
mov r8d, dword [rsp + 0x2c]
mov edx, eax
mov rax, qword [rsp + 0x38]
mov rcx, qword [rax + 0x20]
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov dword [rsp + 0x24], 1
jmp 0x1802ca5a8
mov dword [rsp + 0x24], 1
mov rax, qword [rsp + 0x38]
mov eax, dword [rax + 8]
lea r9, [rsp + 0x28]
mov r8d, dword [rsp + 0x20]
mov edx, eax
mov rax, qword [rsp + 0x38]
mov rcx, qword [rax + 0x18]
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov rax, qword [rsp + 0x38]
mov eax, dword [rax + 4]
lea r9, [rsp + 0x28]
mov r8d, dword [rsp + 0x30]
mov edx, eax
mov rax, qword [rsp + 0x38]
mov rcx, qword [rax + 0x10]
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov eax, dword [rsp + 0x24]
add rsp, 0x48
ret

Function at 0x1802cb340
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov eax, 0x28
call fcn.1802cf310
sub rsp, rax
add rsp, 0x28
jmp fcn.1802d11e0
Function at 0x1802d4110
Capabilities:
Encode data using xor

Disassembly:
xor r9b, r9b
mov r10, rdx
test r8, r8
je 0x1802d4137
sub r10, rcx
nop
movzx edx, byte [r10 + rcx]
movzx eax, byte [rcx]
lea rcx, [rcx + 1]
xor dl, al
or r9b, dl
sub r8, 1
jne 0x1802d4120
movzx eax, r9b
ret

Function at 0x1802f62e0
Capabilities:
Encode data using base64

Disassembly:
mov eax, 8
call fcn.1802cf310
sub rsp, rax
xor r11d, r11d
mov r9, rcx
test r8d, r8d
jle 0x1802f63f5
mov qword [rsp + 0x10], rbx
inc rdx
mov qword [rsp], rdi
lea rdi, str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_
nop
movzx eax, byte [rdx - 1]
cmp r8d, 3
jl 0x1802f636e
movzx ecx, al
movzx eax, byte [rdx]
shl rcx, 8
or rcx, rax
movzx eax, byte [rdx + 1]
shl rcx, 8
or rcx, rax
mov rax, rcx
shr rax, 0x12
movzx eax, byte [rax + rdi]
mov byte [r9], al
mov rax, rcx
shr rax, 0xc
inc r9
and eax, 0x3f
mov r10, r9
movzx eax, byte [rax + rdi]
mov byte [r9], al
mov rax, rcx
and eax, 0x3f
shr rcx, 6
and ecx, 0x3f
movzx ebx, byte [rax + rdi]
movzx eax, byte [rcx + rdi]
jmp 0x1802f63bd
movzx ecx, al
shl ecx, 0x10
cmp r8d, 2
jne 0x1802f6382
movzx eax, byte [rdx]
shl eax, 8
or ecx, eax
mov eax, ecx
lea r10, [r9 + 1]
shr rcx, 0x12
movzx ecx, byte [rcx + rdi]
mov byte [r9], cl
mov ecx, eax
shr rcx, 0xc
mov r9, r10
and ecx, 0x3f
movzx ecx, byte [rcx + rdi]
mov byte [r10], cl
cmp r8d, 1
jne 0x1802f63b0
mov al, 0x3d
jmp 0x1802f63bb
shr rax, 6
and eax, 0x3f
movzx eax, byte [rax + rdi]
mov bl, 0x3d
lea rcx, [r9 + 2]
mov byte [r10 + 1], al
add r11d, 4
mov byte [rcx], bl
add rdx, 3
lea r9, [rcx + 1]
sub r8d, 3
test r8d, r8d
jg 0x1802f6310
mov rdi, qword [rsp]
mov eax, r11d
mov rbx, qword [rsp + 0x10]
mov byte [r9], 0
add rsp, 8
ret
mov byte [rcx], r11b
mov eax, r11d
add rsp, 8
ret
Function at 0x1802fb6d0
Capabilities:
Check for software breakpoints

Disassembly:
mov eax, 0x38
call fcn.1802cf310
sub rsp, rax
mov r11, rcx
cmp dword [rsp + 0x60], r9d
jne 0x1802fb7c3
movzx r10d, byte [r8]
lea eax, [r10 - 0x6a]
cmp al, 1
ja 0x1802fb7c3
mov qword [rsp + 0x30], rbx
lea rdx, [r8 + 1]
cmp r10b, 0x6b
jne 0x1802fb770
lea ebx, [r9 - 3]
xor eax, eax
test ebx, ebx
jle 0x1802fb72a
movzx ecx, byte [rdx]
inc rdx
cmp cl, 0xba
je 0x1802fb72a
cmp cl, 0xbb
jne 0x1802fb75f
inc eax
cmp eax, ebx
jl 0x1802fb714
sub ebx, eax
test eax, eax
jne 0x1802fb774
mov dword [rsp + 0x20], 0x83
lea r9, [0x18059c510]
mov edx, 0x80
lea ecx, [rdx - 0x7c]
lea r8d, [rdx + 0xa]
call fcn.1802d4eb0
mov rbx, qword [rsp + 0x30]
mov eax, 0xffffffff
add rsp, 0x38
ret
mov dword [rsp + 0x20], 0x7b
lea r9, [0x18059c4f8]
jmp 0x1802fb73f
lea ebx, [r9 - 2]
movsxd rax, ebx
cmp byte [rax + rdx], 0xcc
je 0x1802fb7ac
mov edx, 0x80
mov dword [rsp + 0x20], 0x8b
lea r9, str..crypto_rsa_rsa_x931.c
lea ecx, [rdx - 0x7c]
lea r8d, [rdx + 0xb]
call fcn.1802d4eb0
mov rbx, qword [rsp + 0x30]
mov eax, 0xffffffff
add rsp, 0x38
ret
mov r8d, ebx
mov rcx, r11
call fcn.18034b420
mov eax, ebx
mov rbx, qword [rsp + 0x30]
add rsp, 0x38
ret
mov edx, 0x80
mov dword [rsp + 0x20], WSACleanup
lea r9, [0x18059c4e0]
lea ecx, [rdx - 0x7c]
lea r8d, [rdx + 9]
call fcn.1802d4eb0
mov eax, 0xffffffff
add rsp, 0x38
ret

Function at 0x1802fc560
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push r14
mov eax, 0x20
call fcn.1802cf310
sub rsp, rax
mov esi, dword [rdx + 8]
mov r14, rdx
mov rbx, rcx
test esi, esi
jne 0x1802fc5a1
xor edx, edx
call fcn.1802cd490
lea eax, [rsi + 1]
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
lea eax, [rsi - 1]
mov qword [rsp + 0x30], rdi
movsxd rdi, eax
xor eax, eax
mov qword [rsp + 0x38], r15
mov r15, qword [rdx]
mov rcx, qword [r15 + rdi*8]
cmp rcx, 1
sete al
sub esi, eax
cmp r14, rbx
je 0x1802fc5ec
cmp esi, dword [rbx + 0xc]
jg 0x1802fc5d2
mov rax, rbx
jmp 0x1802fc5dc
mov edx, esi
mov rcx, rbx
call fcn.1802cdc30
test rax, rax
je 0x1802fc656
mov eax, dword [r14 + 0x10]
mov dword [rbx + 0x10], eax
mov rcx, qword [r15 + rdi*8]
mov rdx, qword [rbx]
mov rax, rcx
xor rax, 1
inc rax
neg rax
shl rax, 0x3f
lea r8, [rdx + rdi*8]
shr rcx, 1
je 0x1802fc60c
mov qword [r8], rcx
test rdi, rdi
jle 0x1802fc64e
sub r15, rdx
nop dword [rax]
nop dword [rax + rax]
mov rdx, qword [r15 + r8 - 8]
lea r8, [r8 - 8]
mov rcx, rdx
dec rdi
shr rcx, 1
or rcx, rax
mov rax, rdx
xor rax, 1
mov qword [r8], rcx
inc rax
neg rax
shl rax, 0x3f
test rdi, rdi
jg 0x1802fc620
mov dword [rbx + 8], esi
mov eax, 1
mov rdi, qword [rsp + 0x30]
mov r15, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
Function at 0x180320e80
Capabilities:
Check for time delay via gettickcount

Disassembly:
mov eax, 0x28
call fcn.1802cf310
sub rsp, rax
cmp dword [0x1805a22cc], 0
je 0x180320ec8
lea rcx, [rsp + 0x38]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
test eax, eax
jne 0x180320ead
mov dword [0x1805a22cc], eax
jmp 0x180320ec8
xorps xmm2, xmm2
lea rcx, [rsp + 0x38]
mov edx, 8
call fcn.1802e2190
cmp dword [0x1805a22cc], 0
jne 0x180320ee4
call qword [sym.imp.KERNEL32.dll_GetTickCount]
xorps xmm2, xmm2
lea rcx, [rsp + 0x30]
mov edx, 4
mov dword [rsp + 0x30], eax
call fcn.1802e2190
add rsp, 0x28
ret

Function at 0x180328190
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
mov eax, 0x20
call fcn.1802cf310
sub rsp, rax
mov r9d, dword [rdx + 8]
mov rsi, rdx
cmp r9d, dword [r8 + 8]
mov rdi, r8
mov rbx, rcx
cmovge rdi, rdx
cmovge rsi, r8
mov edx, dword [rdi + 8]
cmp edx, dword [rcx + 0xc]
jg 0x1803281ce
mov rax, rcx
jmp 0x1803281d3
call fcn.1802cdc30
test rax, rax
jne 0x1803281e8
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
xor r8d, r8d
cmp dword [rsi + 8], r8d
jle 0x180328225
xor r9d, r9d
nop dword [rax]
nop dword [rax + rax]
mov rax, qword [rsi]
lea r9, [r9 + 8]
mov rcx, qword [rdi]
inc r8d
mov rdx, qword [rcx + r9 - 8]
xor rdx, qword [r9 + rax - 8]
mov rax, qword [rbx]
mov qword [r9 + rax - 8], rdx
cmp r8d, dword [rsi + 8]
jl 0x180328200
mov eax, dword [rdi + 8]
cmp r8d, eax
jge 0x18032825f
movsxd rax, r8d
lea rdx, [rax*8]
nop dword [rax + rax]
mov rax, qword [rdi]
lea rdx, [rdx + 8]
mov rcx, qword [rbx]
inc r8d
mov rax, qword [rdx + rax - 8]
mov qword [rdx + rcx - 8], rax
mov eax, dword [rdi + 8]
cmp r8d, eax
jl 0x180328240
mov dword [rbx + 8], eax
test eax, eax
jle 0x18032828b
mov rcx, qword [rbx]
sub rcx, 8
movsxd r8, eax
lea r8, [rcx + r8*8]
mov rcx, qword [r8]
lea r8, [r8 - 8]
test rcx, rcx
jne 0x180328286
dec eax
test eax, eax
jg 0x180328274
mov dword [rbx + 8], eax
test eax, eax
jne 0x180328294
mov dword [rbx + 0x10], 0
mov rbx, qword [rsp + 0x30]
mov eax, 1
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x180342a70
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
mov eax, 0x20
call fcn.1802cf310
sub rsp, rax
mov rbp, qword [rsp + 0x70]
mov r12, r9
mov r13, qword [rsp + 0x78]
mov r10, rbp
mov rdi, r8
mov rbx, rdx
mov rsi, rcx
cmp r8, 0x10
jb 0x180342b08
mov rbp, r8
shr rbp, 4
imul rax, rbp, 0xfffffffffffffff0
add rdi, rax
nop word [rax + rax]
sub r10, rsi
mov r8, rbx
sub r8, rsi
mov rcx, rsi
mov edx, 2
mov rax, qword [r10 + rcx]
xor rax, qword [rcx]
mov qword [r8 + rcx], rax
lea rcx, [rcx + 8]
sub rdx, 1
jne 0x180342ad1
mov r8, r12
mov rdx, rbx
mov rcx, rbx
call r13
mov r10, rbx
add rsi, 0x10
add rbx, 0x10
sub rbp, 1
jne 0x180342ac0
mov rbp, qword [rsp + 0x70]
test rdi, rdi
je 0x180342c22
mov qword [rsp + 0x50], r14
mov qword [rsp + 0x58], r15
nop dword [rax + rax]
mov r8, r10
mov r9, rbx
mov r11d, 1
mov r14d, 2
sub r8, rsi
sub r9, rsi
sub r11, rsi
sub r14, rsi
xor eax, eax
mov r15d, 3
sub r15, rsi
nop dword [rax]
cmp rax, rdi
jae 0x180342bc4
lea rdx, [rax + rsi]
movzx ecx, byte [r8 + rdx]
xor cl, byte [rdx]
mov byte [r9 + rdx], cl
lea rcx, [r11 + rdx]
cmp rcx, rdi
jae 0x180342bc1
movzx ecx, byte [rsi + rax + 1]
xor cl, byte [rax + r10 + 1]
mov byte [rbx + rax + 1], cl
lea rcx, [r14 + rdx]
cmp rcx, rdi
jae 0x180342bbb
movzx ecx, byte [rsi + rax + 2]
xor cl, byte [rax + r10 + 2]
mov byte [rbx + rax + 2], cl
lea rcx, [r15 + rdx]
cmp rcx, rdi
jae 0x180342bb5
movzx ecx, byte [rsi + rax + 3]
xor cl, byte [rax + r10 + 3]
mov byte [rbx + rax + 3], cl
add rax, 4
cmp rax, 0x10
jb 0x180342b50
jmp 0x180342bf1
add rax, 3
jmp 0x180342bc4
add rax, 2
jmp 0x180342bc4
inc rax
cmp rax, 0x10
jae 0x180342bf1
sub r10, rbx
lea rcx, [rax + rbx]
mov edx, recvfrom
sub rdx, rax
nop dword [rax]
movzx eax, byte [r10 + rcx]
mov byte [rcx], al
lea rcx, [rcx + 1]
sub rdx, 1
jne 0x180342be0
mov r8, r12
mov rdx, rbx
mov rcx, rbx
call r13
mov r10, rbx
cmp rdi, 0x10
jbe 0x180342c18
add rsi, 0x10
add rbx, 0x10
sub rdi, 0x10
jne 0x180342b20
mov r14, qword [rsp + 0x50]
mov r15, qword [rsp + 0x58]
movups xmm0, xmmword [r10]
mov rbx, qword [rsp + 0x60]
movups xmmword [rbp], xmm0
add rsp, 0x20
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret