joyce8/EMBER2024-capa huggingface dataset:
Function at 0x18001a700
Capabilities:
Get file version info

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 8], rcx
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x40
mov rdi, rdx
mov rbx, rcx
mov ecx, 0x20
call fcn.18009d1b8
mov qword [rsp + 0x30], socket
mov qword [rsp + 0x38], 0x1f
movups xmm0, xmmword [str.Packet_Queue_Capture]
movups xmmword [rax], xmm0
mov edx, dword [0x1800ead98]
mov dword [rax + 0x10], edx
mov byte [rax + 0x14], 0
mov qword [rsp + 0x20], rax
mov r8, rdi
lea rdx, [rsp + 0x20]
mov rcx, rbx
call fcn.18001e250
nop
mov rdx, qword [rsp + 0x38]
cmp rdx, 0x10
jb 0x18001a7a1
inc rdx
mov rcx, qword [rsp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18001a79c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18001a8d3
call fcn.18009d1f4
lea rax, vtable.PacketQueueFilter.0
mov qword [rbx], rax
xor r15d, r15d
mov qword [rbx + 0xd0], r15
mov qword [rbx + 0xd8], r15
mov qword [rbx + 0xe0], r15
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [rbx + 0xe8], eax
cmp qword [rdi + 0x18], 0x10
jb 0x18001a7d9
mov rdi, qword [rdi]
mov rsi, r15
mov qword [rsp + 0x20], r15
xor bpl, bpl
mov byte [rsp + 0x28], bpl
lea rdx, [rsp + 0x80]
mov rcx, rdi
call qword [sym.imp.VERSION.dll_GetFileVersionInfoSizeA]
mov r14d, eax
test eax, eax
je 0x18001a832
mov ecx, r14d
call fcn.18009d8b4
mov rsi, rax
xor ecx, ecx
call fcn.18009d1f4
mov r9, rsi
mov r8d, r14d
xor edx, edx
mov rcx, rdi
call qword [sym.imp.VERSION.dll_GetFileVersionInfoA]
movzx ebp, bpl
mov ecx, 1
test eax, eax
cmovne ebp, ecx
test bpl, bpl
je 0x18001a894
lea r9, [rsp + 0x80]
lea r8, [rsp + 0x20]
lea rdx, [0x1800ea574]
mov rcx, rsi
call qword [sym.imp.VERSION.dll_VerQueryValueA]
test eax, eax
je 0x18001a894
mov rax, qword [rsp + 0x20]
test rax, rax
je 0x18001a894
mov edx, dword [rax + 0xc]
mov ecx, dword [rax + 8]
mov eax, ecx
shr eax, 0x10
mov word [rsp + 0x88], ax
mov word [rsp + 0x8a], cx
mov eax, edx
shr eax, 0x10
mov word [rsp + 0x8c], ax
mov word [rsp + 0x8e], dx
jmp 0x18001a89c
mov qword [rsp + 0x88], r15
lea rdx, [rbx + 0xf0]
mov r8d, 4
lea rcx, [rsp + 0x88]
call fcn.18000eb74
mov rcx, rsi
call fcn.18009d1f4
nop
mov rax, rbx
mov rbx, qword [rsp + 0x78]
add rsp, 0x40
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
call fcn.1800a45b8
nop
int3
Function at 0x18001ede0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rbx, rcx
lea rax, vtable.BandwidthFilter.0
mov qword [rcx], rax
cmp byte [0x18010a364], 0
je 0x18001ee7a
call fcn.18001f510
mov r9, rax
cmp byte [rax + 0x54], 0
je 0x18001ee6d
lea r8, [rax + 1]
mov r10, 0xffffffffffffffff
sub r10, rax
movabs r11, 0xd993efbb19cfe32d
nop dword [rax + rax]
lea ecx, [r8 + r10]
and cl, 7
shl cl, 3
mov rdx, r11
shr rdx, cl
xor byte [r8 - 1], dl
movzx ecx, r8b
sub cl, r9b
and cl, 7
shl cl, 3
mov rdx, r11
shr rdx, cl
xor byte [r8], dl
add r8, 2
lea rax, [r10 + r8]
cmp rax, 0x54
jb 0x18001ee30
mov byte [r9 + 0x54], 0
mov rdx, r9
mov ecx, 4
call fcn.18006a848
mov rcx, rbx
call fcn.18001ffc0
lea rcx, [rbx + 0x110]
call fcn.180046674
mov rcx, qword [rbx + 0x100]
test rcx, rcx
je 0x18001ee9f
call fcn.1800214b0
xor esi, esi
mov qword [rbx + 0x100], rsi
mov rdx, qword [rbx + 0x188]
cmp rdx, 0x10
jb 0x18001eee9
inc rdx
mov rcx, qword [rbx + 0x170]
cmp rdx, 0x1000
jb 0x18001eee4
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x18001efa3
mov rcx, r8
call fcn.18009d1f4
mov qword [rbx + 0x180], rsi
mov qword [rbx + 0x188], reloc.WS2_32.dll_ntohs
mov byte [rbx + 0x170], sil
mov rdx, qword [rbx + 0x168]
cmp rdx, 0x10
jb 0x18001ef3f
inc rdx
mov rcx, qword [rbx + 0x150]
cmp rdx, 0x1000
jb 0x18001ef3a
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x18001efa3
mov rcx, r8
call fcn.18009d1f4
mov qword [rbx + 0x160], rsi
mov qword [rbx + 0x168], reloc.WS2_32.dll_ntohs
mov byte [rbx + 0x150], sil
lea rcx, [rbx + 0x110]
call fcn.180046674
mov rcx, qword [rbx + 0x100]
test rcx, rcx
je 0x18001ef75
call fcn.1800214b0
lea rcx, [rbx + 0xd0]
cmp qword [rcx + 0x28], rsi
je 0x18001ef8c
mov qword [rcx + 0x28], rsi
call qword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
mov rcx, rbx
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
jmp fcn.18001e8f0
call fcn.1800a45b8
int3
Function at 0x18001f440
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x20
cmp byte [0x18010a364], 0
mov rbx, rcx
je 0x18001f4ca
call fcn.18001f510
mov r9, rax
cmp byte [rax + 0x54], 0
je 0x18001f4bd
mov r10, 0xffffffffffffffff
lea r8, [rax + 1]
sub r10, rax
movabs r11, 0xd993efbb19cfe32d
nop dword [rax + rax]
lea ecx, [r8 + r10]
mov rdx, r11
and cl, 7
shl cl, 3
shr rdx, cl
movzx ecx, r8b
xor byte [r8 - 1], dl
sub cl, r9b
and cl, 7
mov rdx, r11
shl cl, 3
shr rdx, cl
xor byte [r8], dl
add r8, 2
lea rax, [r10 + r8]
cmp rax, 0x54
jb 0x18001f480
mov byte [r9 + 0x54], 0
mov rdx, r9
mov ecx, 4
call fcn.18006a848
mov rcx, rbx
call fcn.18001ffc0
lea rcx, [rbx + 0x110]
call fcn.180046674
mov rcx, qword [rbx + 0x100]
test rcx, rcx
je 0x18001f4ef
call fcn.1800214b0
mov al, 1
mov qword [rbx + 0x100], 0
add rsp, 0x20
pop rbx
ret
Function at 0x1800206c0
Capabilities:
Check for time delay via gettickcount

Disassembly:
push rbx
sub rsp, 0x70
mov rbx, rcx
call qword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [rbx + 0x108]
cmp eax, dword [rbx + 0x144]
jb 0x1800207af
cmp byte [0x18010a364], 0
je 0x18002078e
mov eax, dword [0x18010bb98]
mov rcx, qword gs:[0x58]
movaps xmmword [rsp + 0x60], xmm6
movdqa xmm6, xmmword [0x1800ec5c0]
mov edx, 4
mov rcx, qword [rcx + rax*8]
movaps xmmword [rsp + 0x50], xmm7
movdqa xmm7, xmmword [0x1800ebf20]
mov dword [rsp + 0x40], 0x60b78c5f
mov eax, dword [rdx + rcx]
cmp dword [0x18010d114], eax
jg 0x1800207b5
cmp byte [0x180105745], 0
lea rdx, [0x180105720]
movaps xmm7, xmmword [rsp + 0x50]
movaps xmm6, xmmword [rsp + 0x60]
je 0x180020784
xor r8d, r8d
movabs r9, 0xd993efbb19cfe32d
nop
movzx ecx, r8b
mov rax, r9
and cl, 7
shl cl, 3
shr rax, cl
xor byte [r8 + rdx], al
inc r8
cmp r8, 0x25
jb 0x180020760
mov byte [0x180105745], 0
mov ecx, 5
call fcn.18006a848
mov rcx, rbx
call fcn.18001ffc0
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov rcx, rbx
mov dword [rbx + 0x108], eax
add rsp, 0x70
pop rbx
jmp fcn.180021170
add rsp, 0x70
pop rbx
ret
lea rcx, [0x18010d114]
call fcn.18009d704
cmp dword [0x18010d114], 0xffffffff
jne 0x180020737
mov eax, dword [rsp + 0x40]
lea rcx, [0x1800cd8d0]
mov dword [0x180105740], eax
mov word [0x180105744], 0x1bb
movaps xmmword [0x180105720], xmm6
movaps xmmword [0x180105730], xmm7
call fcn.18009d564
lea rcx, [0x18010d114]
call fcn.18009d6a4
jmp 0x180020737

Function at 0x180021050
Capabilities:
Check for time delay via gettickcount

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x20
mov esi, r8d
movzx ebx, dx
mov rdi, rcx
add rcx, 0xd0
cmp qword [rcx + 0x28], 0
je 0x180021081
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp qword [rdi + 0x100], 0
je 0x1800210b5
movzx r8d, bx
lea rdx, [rsp + 0x48]
mov rcx, rdi
call fcn.180020b80
mov rbx, qword [rax]
add dword [rbx + 0x2c], esi
inc dword [rbx + 0x34]
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [rbx + 0x44], eax
jmp 0x1800210b5
lea rcx, [rdi + 0xd0]
cmp qword [rcx + 0x28], 0
je 0x1800210c9
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov rcx, rdi
mov rbx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
jmp fcn.1800206c0
Function at 0x1800210e0
Capabilities:
Check for time delay via gettickcount
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x20
mov esi, r8d
movzx ebx, dx
mov rdi, rcx
add rcx, 0xd0
cmp qword [rcx + 0x28], 0
je 0x180021111
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp qword [rdi + 0x100], 0
je 0x180021145
movzx r8d, bx
lea rdx, [rsp + 0x48]
mov rcx, rdi
call fcn.180020b80
mov rbx, qword [rax]
add dword [rbx + 0x28], esi
inc dword [rbx + 0x30]
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [rbx + 0x40], eax
jmp 0x180021145
lea rcx, [rdi + 0xd0]
cmp qword [rcx + 0x28], 0
je 0x180021159
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov rcx, rdi
mov rbx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
jmp fcn.1800206c0

Function at 0x180021440
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
cmp byte [rcx + 0x1c], 0
mov r8, rcx
je 0x18002149a
mov r9, rcx
lea rax, [rcx + 1]
not r9
movabs r10, 0xd993efbb19cfe32d
nop dword [rax]
lea ecx, [rax + r9]
mov rdx, r10
and cl, 7
shl cl, 3
shr rdx, cl
movzx ecx, al
xor byte [rax - 1], dl
sub cl, r8b
and cl, 7
mov rdx, r10
shl cl, 3
shr rdx, cl
xor byte [rax], dl
add rax, 2
lea rcx, [r9 + rax]
cmp rcx, 0x1c
jb 0x180021460
mov byte [r8 + 0x1c], 0
mov rax, r8
ret
Function at 0x180023260
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x70
cmp dword [rsp + 0xa8], 0xffffffff
mov ebx, r9d
mov rdi, r8
mov rbp, rdx
mov rsi, rcx
je 0x1800233a9
cmp byte [0x18010a364], 0
je 0x18002332e
mov eax, dword [0x18010bb98]
mov rcx, qword gs:[0x58]
mov edx, 4
movaps xmmword [rsp + 0x60], xmm6
movdqa xmm6, xmmword [0x1800ebf70]
mov rcx, qword [rcx + rax*8]
mov dword [rsp + 0x50], 0x31ab8d48
mov word [rsp + 0x54], 0xef92
mov eax, dword [rdx + rcx]
cmp dword [0x18010d134], eax
jg 0x1800233c1
cmp byte [0x180105936], 0
lea rdx, [0x180105920]
movaps xmm6, xmmword [rsp + 0x60]
je 0x180023324
xor r8d, r8d
movabs r9, 0xd993efbb19cfe32d
movzx ecx, r8b
mov rax, r9
and cl, 7
shl cl, 3
shr rax, cl
xor byte [r8 + rdx], al
inc r8
cmp r8, 0x16
jb 0x180023300
mov byte [0x180105936], 0
mov ecx, 5
call fcn.18006a848
xorps xmm0, xmm0
mov dword [rsp + 0xa8], reloc.WS2_32.dll_recv
lea r8, [rsp + 0xa8]
mov rcx, rbp
lea rdx, [rsp + 0x30]
movups xmmword [rsp + 0x30], xmm0
call qword [sym.imp.WS2_32.dll_getpeername]
test eax, eax
jne 0x1800233a9
mov rax, qword [rsp + 0x34]
cmp al, 0xa
je 0x1800233a9
cmp al, 0xac
jne 0x180023375
movzx eax, byte [rsp + 0x35]
sub al, 0x10
cmp al, 0xf
ja 0x180023380
jmp 0x1800233a9
cmp al, 0xc0
jne 0x180023380
cmp byte [rsp + 0x35], 0xa8
je 0x1800233a9
mov rcx, qword [rsi + 0xf8]
lea rdx, [rsp + 0x30]
mov r9d, ebx
mov r8, rdi
call fcn.18003b470
mov rcx, qword [rsi + 0xf8]
mov r9d, ebx
mov r8, rdi
call fcn.18003a9d0
lea r11, [rsp + 0x70]
mov al, 1
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
lea rcx, [0x18010d134]
call fcn.18009d704
cmp dword [0x18010d134], 0xffffffff
jne 0x1800232de
mov eax, dword [rsp + 0x50]
lea rcx, [0x1800cda00]
mov dword [0x180105930], eax
movzx eax, word [rsp + 0x54]
mov word [0x180105934], ax
mov byte [0x180105936], 1
movaps xmmword [0x180105920], xmm6
call fcn.18009d564
lea rcx, [0x18010d134]
call fcn.18009d6a4
jmp 0x1800232de
Function at 0x180023420
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x70
cmp dword [rsp + 0xa8], 0xffffffff
mov edi, r9d
mov rsi, r8
mov rbp, rdx
mov rbx, rcx
je 0x180023556
cmp byte [0x18010a364], 0
je 0x1800234fe
mov eax, dword [0x18010bb98]
mov rcx, qword gs:[0x58]
mov edx, 4
movaps xmmword [rsp + 0x60], xmm6
movdqa xmm6, xmmword [0x1800ebf80]
mov rcx, qword [rcx + rax*8]
mov dword [rsp + 0x50], 0x70aa8048
mov dword [rsp + 0x54], 0xf0bb8acd
mov eax, dword [rdx + rcx]
cmp dword [0x18010d130], eax
jg 0x18002356e
cmp byte [0x1801058e9], 0
lea rdx, [0x1801058d0]
movaps xmm6, xmmword [rsp + 0x60]
je 0x1800234f4
xor r8d, r8d
movabs r9, 0xd993efbb19cfe32d
nop dword [rax]
nop word [rax + rax]
movzx ecx, r8b
mov rax, r9
and cl, 7
shl cl, 3
shr rax, cl
xor byte [r8 + rdx], al
inc r8
cmp r8, 0x19
jb 0x1800234d0
mov byte [0x1801058e9], 0
mov ecx, 5
call fcn.18006a848
xorps xmm0, xmm0
mov dword [rsp + 0xa8], reloc.WS2_32.dll_recv
lea r8, [rsp + 0xa8]
mov rcx, rbp
lea rdx, [rsp + 0x30]
movups xmmword [rsp + 0x30], xmm0
call qword [sym.imp.WS2_32.dll_getpeername]
test eax, eax
jne 0x180023556
mov rcx, qword [rbx + 0xf8]
lea rax, [rbx + 0xd8]
mov qword [rsp + 0x28], rax
mov r9d, edi
mov rax, qword [rsp + 0xa0]
mov r8, rsi
mov qword [rsp + 0x20], rax
call fcn.18003c630
lea r11, [rsp + 0x70]
mov al, 1
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
lea rcx, [0x18010d130]
call fcn.18009d704
cmp dword [0x18010d130], 0xffffffff
jne 0x18002349f
movsd xmm0, qword [rsp + 0x50]
lea rcx, [0x1800cda20]
movsd qword [0x1801058e0], xmm0
mov word [0x1801058e8], 0x12d
movaps xmmword [0x1801058d0], xmm6
call fcn.18009d564
lea rcx, [0x18010d130]
call fcn.18009d6a4
jmp 0x18002349f

Function at 0x1800235d0
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
cmp byte [rcx + 0x22], 0
mov r8, rcx
je 0x18002362a
mov r9, rcx
lea rax, [rcx + 1]
not r9
movabs r10, 0xd993efbb19cfe32d
nop dword [rax]
lea ecx, [rax + r9]
mov rdx, r10
and cl, 7
shl cl, 3
shr rdx, cl
movzx ecx, al
xor byte [rax - 1], dl
sub cl, r8b
and cl, 7
mov rdx, r10
shl cl, 3
shr rdx, cl
xor byte [rax], dl
add rax, 2
lea rcx, [r9 + rax]
cmp rcx, 0x22
jb 0x1800235f0
mov byte [r8 + 0x22], 0
mov rax, r8
ret
Function at 0x1800268f0
Capabilities:
Encode data using xor

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
push rdi
sub rsp, 0x80
cmp dword [rsp + 0xb8], 0xffffffff
mov rdi, r8
mov esi, r9d
mov rbx, rdx
je 0x180026b12
mov qword [rax + 8], rbp
xor ebp, ebp
cmp byte [0x18010a364], bpl
je 0x1800269ce
mov rcx, qword gs:[0x58]
movaps xmmword [rax - 0x18], xmm6
movdqa xmm6, xmmword [0x1800ec320]
movaps xmmword [rax - 0x28], xmm7
movdqa xmm7, xmmword [0x1800ec590]
mov word [rax - 0x38], 0xca05
mov eax, dword [0x18010bb98]
mov edx, 4
mov rcx, qword [rcx + rax*8]
mov eax, dword [rdx + rcx]
cmp dword [0x18010d160], eax
jg 0x180026b29
cmp byte [0x180105e63], bpl
lea rdx, [0x180105e40]
movaps xmm7, xmmword [rsp + 0x60]
movaps xmm6, xmmword [rsp + 0x70]
je 0x1800269c4
mov r8, rbp
movabs r9, 0xd993efbb19cfe32d
nop dword [rax]
movzx ecx, r8b
mov rax, r9
and cl, 7
shl cl, 3
shr rax, cl
xor byte [r8 + rdx], al
inc r8
cmp r8, 0x23
jb 0x1800269a0
mov byte [0x180105e63], bpl
mov ecx, 5
call fcn.18006a848
xorps xmm0, xmm0
mov dword [rsp + 0xb8], reloc.WS2_32.dll_recv
lea r8, [rsp + 0xb8]
mov rcx, rbx
lea rdx, [rsp + 0x20]
movups xmmword [rsp + 0x20], xmm0
call qword [sym.imp.WS2_32.dll_getpeername]
test eax, eax
jne 0x180026b0a
call fcn.180019bc4
test eax, eax
jne 0x180026a96
mov rcx, qword [0x18010cee8]
movzx ebx, byte [rcx + 0x2080]
sub ebx, 0x2a
jne 0x180026a2c
movzx ebx, byte [rcx + 0x2081]
movzx eax, bpl
sub ebx, eax
cmp byte [0x18010cef8], bpl
je 0x180026a54
mov rcx, qword [0x18010ced8]
mov byte [0x18010cef8], bpl
call qword [sym.imp.KERNEL32.dll_ReleaseMutex]
cmp eax, 1
je 0x180026a54
call qword [sym.imp.KERNEL32.dll_GetLastError]
test ebx, ebx
je 0x180026a96
cmp byte [rsp + 0x24], 0x7f
jne 0x180026b0a
cmp byte [rsp + 0x25], bpl
jne 0x180026b0a
cmp byte [rsp + 0x26], bpl
jne 0x180026b0a
cmp byte [rsp + 0x27], 1
jne 0x180026b0a
mov ecx, 0x203e
call qword [sym.imp.WS2_32.dll_htons]
cmp word [rsp + 0x22], ax
jne 0x180026ad6
cmp byte [rsp + 0x24], 0x7f
jne 0x180026b0a
cmp byte [rsp + 0x25], bpl
jne 0x180026b0a
cmp byte [rsp + 0x26], bpl
jne 0x180026b0a
cmp byte [rsp + 0x27], 1
jne 0x180026b0a
mov ecx, 0x2d07
call qword [sym.imp.WS2_32.dll_htons]
cmp word [rsp + 0x22], ax
je 0x180026ad6
mov ecx, 0x2d10
call qword [sym.imp.WS2_32.dll_htons]
cmp word [rsp + 0x22], ax
jne 0x180026b0a
mov rcx, qword [rdi + 8]
lea rdx, str.HTTP_1.1_200_Ok
mov r8, rsi
call fcn.1800a74e0
test eax, eax
jne 0x180026b0a
mov rcx, qword [rdi + 8]
lea rdx, str.X_CONFIGURE:_1
call fcn.18009eb24
test rax, rax
je 0x180026b0a
mov rax, qword [rdi + 8]
mov byte [rax + 9], reloc.WS2_32.dll_gethostbyname
mov rbp, qword [rsp + 0x90]
lea r11, [rsp + 0x80]
mov al, 1
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
lea rcx, [0x18010d160]
call fcn.18009d704
cmp dword [0x18010d160], 0xffffffff
jne 0x180026972
movzx eax, word [rsp + 0x50]
lea rcx, [0x1800cdbb0]
mov word [0x180105e60], ax
mov word [0x180105e62], 0x1cf
movaps xmmword [0x180105e40], xmm6
movaps xmmword [0x180105e50], xmm7
call fcn.18009d564
lea rcx, [0x18010d160]
call fcn.18009d6a4
jmp 0x180026972
Function at 0x180027f50
Capabilities:
Encode data using xor

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x10], rdx
push rdi
sub rsp, 0x50
cmp byte [0x18010a364], 0
mov rbx, rdx
mov rsi, rcx
je 0x180028045
mov rcx, qword gs:[0x58]
movaps xmmword [rax - 0x18], xmm6
movdqa xmm6, xmmword [0x1800ec330]
mov dword [rax - 0x28], 0x6daa884e
mov dword [rax - 0x24], 0x82f7ca9b
mov dword [rax - 0x20], 0x19928708
mov eax, dword [0x18010bb98]
mov edx, 4
mov rcx, qword [rcx + rax*8]
mov eax, dword [rdx + rcx]
cmp dword [0x18010d158], eax
jg 0x1800280e3
cmp byte [0x180105e3c], 0
lea rdi, [0x180105e20]
movaps xmm6, xmmword [rsp + 0x40]
je 0x18002802c
xor r10d, r10d
mov r11d, 1
sub r11, rdi
movabs rdx, 0xd993efbb19cfe32d
nop word [rax + rax]
lea r9, [r10 + rdi]
movzx ecx, r10b
and cl, 7
mov rax, rdx
shl cl, 3
mov r8, rdx
shr rax, cl
add r10, 2
xor byte [r9], al
lea ecx, [r9 + r11]
and cl, 7
shl cl, 3
shr r8, cl
xor byte [r9 + 1], r8b
cmp r10, 0x1c
jb 0x180027ff0
mov byte [0x180105e3c], 0
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov r8, rbx
mov rdx, rdi
mov r9d, eax
mov ecx, 4
call fcn.18006a848
cmp byte [rsi + 0x120], 0
je 0x1800280d1
cmp qword [rsi + 0xf8], 0
je 0x180028069
lea rcx, [rsi + 0xd0]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rax, qword [rsi + 0x100]
mov rdx, rax
mov rcx, qword [rax + 8]
cmp byte [rcx + 0x19], 0
jne 0x180028098
nop dword [rax]
cmp qword [rcx + 0x20], rbx
jae 0x18002808c
mov rcx, qword [rcx + 0x10]
jmp 0x180028092
mov rdx, rcx
mov rcx, qword [rcx]
cmp byte [rcx + 0x19], 0
je 0x180028080
cmp byte [rdx + 0x19], 0
jne 0x1800280ba
cmp rbx, qword [rdx + 0x20]
jb 0x1800280ba
cmp rdx, rax
je 0x1800280ba
lea rdx, [rsp + 0x68]
lea rcx, [rsi + 0x100]
call fcn.180029780
cmp qword [rsi + 0xf8], 0
je 0x1800280d1
lea rcx, [rsi + 0xd0]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov rbx, qword [rsp + 0x60]
mov al, 1
mov rsi, qword [rsp + 0x70]
add rsp, 0x50
pop rdi
ret
lea rcx, [0x18010d158]
call fcn.18009d704
cmp dword [0x18010d158], 0xffffffff
jne 0x180027fbf
movsd xmm0, qword [rsp + 0x30]
lea rcx, [0x1800cdd70]
mov eax, dword [rsp + 0x38]
movsd qword [0x180105e30], xmm0
mov byte [0x180105e3c], 1
movaps xmmword [0x180105e20], xmm6
mov dword [0x180105e38], eax
call fcn.18009d564
lea rcx, [0x18010d158]
call fcn.18009d6a4
jmp 0x180027fbf
Function at 0x18002a080
Capabilities:
Resolve dns

Disassembly:
push rbx
sub rsp, 0x40
cmp qword [rcx + 0x18], 0x10
mov rbx, rdx
mov qword [rsp + 0x50], 0
jb 0x18002a09c
mov rcx, qword [rcx]
lea r9, [rsp + 0x50]
mov qword [rsp + 0x58], rdi
xor r8d, r8d
xor edx, edx
call qword [sym.imp.WS2_32.dll_getaddrinfo]
test eax, eax
jne 0x18002a174
mov rdi, qword [rsp + 0x50]
test rdi, rdi
je 0x18002a184
cmp dword [rdi + 4], 0x17
jne 0x18002a118
mov rax, qword [rdi + 0x20]
xorps xmm0, xmm0
mov rdx, qword [rbx + 8]
movups xmmword [rsp + 0x20], xmm0
mov byte [rsp + 0x34], 1
movups xmm0, xmmword [rax + 8]
movups xmmword [rsp + 0x24], xmm0
cmp rdx, qword [rbx + 0x10]
je 0x18002a10b
movups xmm0, xmmword [rsp + 0x20]
movsd xmm1, qword [rsp + 0x30]
movups xmmword [rdx], xmm0
movsd qword [rdx + 0x10], xmm1
add qword [rbx + 8], 0x18
jmp 0x18002a118
lea r8, [rsp + 0x20]
mov rcx, rbx
call fcn.18002a2c0
cmp dword [rdi + 4], 2
jne 0x18002a167
mov rax, qword [rdi + 0x20]
xorps xmm0, xmm0
mov rdx, qword [rbx + 8]
movups xmmword [rsp + 0x24], xmm0
mov byte [rsp + 0x34], 0
mov ecx, dword [rax + 4]
mov dword [rsp + 0x20], ecx
cmp rdx, qword [rbx + 0x10]
je 0x18002a15a
movups xmm0, xmmword [rsp + 0x20]
movsd xmm1, qword [rsp + 0x30]
movups xmmword [rdx], xmm0
movsd qword [rdx + 0x10], xmm1
add qword [rbx + 8], 0x18
jmp 0x18002a167
lea r8, [rsp + 0x20]
mov rcx, rbx
call fcn.18002a2c0
mov rdi, qword [rdi + 0x28]
test rdi, rdi
jne 0x18002a0c7
mov rcx, qword [rsp + 0x50]
test rcx, rcx
je 0x18002a184
call qword [sym.imp.WS2_32.dll_freeaddrinfo]
mov rdi, qword [rsp + 0x58]
add rsp, 0x40
pop rbx
ret
Function at 0x18002bac0
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x78
cmp byte [0x18010a364], 0
je 0x18002bb6e
mov eax, dword [0x18010bb98]
mov rcx, qword gs:[0x58]
movaps xmmword [rsp + 0x60], xmm6
movdqa xmm6, xmmword [0x1800ebfe0]
mov edx, 4
mov rcx, qword [rcx + rax*8]
movaps xmmword [rsp + 0x50], xmm7
movdqa xmm7, xmmword [0x1800ec220]
mov word [rsp + 0x40], 0x9148
mov eax, dword [rdx + rcx]
cmp dword [0x18010d1a4], eax
jg 0x18002bb75
cmp byte [0x180106083], 0
lea rdx, [0x180106060]
movaps xmm7, xmmword [rsp + 0x50]
movaps xmm6, xmmword [rsp + 0x60]
je 0x18002bb64
xor r8d, r8d
movabs r9, 0xd993efbb19cfe32d
nop dword [rax]
movzx ecx, r8b
mov rax, r9
and cl, 7
shl cl, 3
shr rax, cl
xor byte [r8 + rdx], al
inc r8
cmp r8, 0x23
jb 0x18002bb40
mov byte [0x180106083], 0
mov ecx, 4
call fcn.18006a848
mov al, 1
add rsp, 0x78
ret
lea rcx, [0x18010d1a4]
call fcn.18009d704
cmp dword [0x18010d1a4], 0xffffffff
jne 0x18002bb15
movzx eax, word [rsp + 0x40]
lea rcx, [0x1800cded0]
mov word [0x180106080], ax
mov word [0x180106082], 0x1cf
movaps xmmword [0x180106060], xmm6
movaps xmmword [0x180106070], xmm7
call fcn.18009d564
lea rcx, [0x18010d1a4]
call fcn.18009d6a4
jmp 0x18002bb15
Function at 0x1800333d0
Capabilities:
Encode data using xor

Disassembly:
mov rax, rsp
push rbp
push r14
push r15
sub rsp, 0x80
xor ebp, ebp
mov r15d, r8d
mov r14, rdx
test r8d, r8d
je 0x180033585
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax - 0x20], r12
mov r12d, dword [0x18010bb98]
mov qword [rax - 0x28], r13
lea r13, [0x180106440]
movaps xmmword [rax - 0x38], xmm6
movaps xmmword [rax - 0x48], xmm7
nop word [rax + rax]
mov rsi, qword [r14 + 8]
lea rdx, str.PRIVMSG
mov edi, dword [r14]
mov rcx, rsi
mov r8d, 8
call fcn.1800a74e0
test eax, eax
je 0x180033581
mov r8d, 8
lea rdx, str.WHISPER
mov rcx, rsi
call fcn.1800a74e0
test eax, eax
jne 0x180033537
mov ebx, 5
add edi, 0xfffffff8
cmp edi, ebx
jbe 0x180033537
mov ecx, ebx
lea rdx, str.ERR_NOUSERWHISPER
add rcx, rsi
mov r8d, send
call fcn.1800a74e0
test eax, eax
je 0x180033497
inc ebx
cmp ebx, edi
jb 0x180033471
jmp 0x180033537
cmp byte [0x18010a364], 0
je 0x180033537
mov rcx, qword gs:[0x58]
movdqa xmm6, xmmword [0x1800ec1f0]
movdqa xmm7, xmmword [str.Bq]
mov eax, r12d
mov edx, 4
mov word [rsp + 0x40], 0x865e
mov rcx, qword [rcx + rax*8]
mov eax, dword [rdx + rcx]
cmp dword [0x18010d224], eax
jg 0x180033594
cmp byte [0x180106463], 0
je 0x18003352a
xor edx, edx
movabs r12, 0xd993efbb19cfe32d
nop dword [rax]
nop dword [rax + rax]
movzx ecx, dl
mov rax, r12
and cl, 7
shl cl, 3
shr rax, cl
xor byte [rdx + r13], al
inc rdx
cmp rdx, 0x23
jb 0x180033500
mov r12d, dword [0x18010bb98]
mov byte [0x180106463], 0
mov rdx, r13
mov ecx, 4
call fcn.18006a848
inc ebp
add r14, 0x10
cmp ebp, r15d
jb 0x180033420
xor al, al
movaps xmm6, xmmword [rsp + 0x60]
movaps xmm7, xmmword [rsp + 0x50]
mov r12, qword [rsp + 0x78]
mov rdi, qword [rsp + 0xb0]
mov rsi, qword [rsp + 0xa8]
mov rbx, qword [rsp + 0xa0]
mov r13, qword [rsp + 0x70]
add rsp, 0x80
pop r15
pop r14
pop rbp
ret
mov al, 1
jmp 0x180033548
xor al, al
add rsp, 0x80
pop r15
pop r14
pop rbp
ret
lea rcx, [0x18010d224]
call fcn.18009d704
cmp dword [0x18010d224], 0xffffffff
jne 0x1800334df
movzx eax, word [rsp + 0x40]
lea rcx, [0x1800ce430]
mov word [0x180106460], ax
mov word [0x180106462], 0x1cf
movaps xmmword [0x180106440], xmm6
movaps xmmword [0x180106450], xmm7
call fcn.18009d564
lea rcx, [0x18010d224]
call fcn.18009d6a4
jmp 0x1800334df