joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1801c9420
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, r8
call fcn.1801c9670
test eax, eax
js 0x1801c965e
mov eax, dword [rbx + 0xf0]
xor r10d, r10d
shl eax, 2
movsxd r9, eax
test eax, eax
jle 0x1801c94a9
lea r8, [rbx + 8]
lea rax, [rbx + 8]
lea r8, [r8 + r9*4]
nop word [rax + rax]
mov ecx, dword [r8 - 8]
mov edx, dword [rax - 8]
add r10, 4
mov dword [rax - 8], ecx
mov ecx, dword [r8 - 4]
mov dword [r8 - 8], edx
mov edx, dword [rax - 4]
mov dword [rax - 4], ecx
mov ecx, dword [r8]
mov dword [r8 - 4], edx
mov edx, dword [rax]
mov dword [rax], ecx
mov ecx, dword [r8 + 4]
mov dword [r8], edx
mov edx, dword [rax + 4]
mov dword [rax + 4], ecx
sub r9, 4
mov dword [r8 + 4], edx
lea r8, [r8 - 0x10]
lea rax, [rax + 0x10]
cmp r10, r9
jl 0x1801c9460
mov r11d, 1
cmp dword [rbx + 0xf0], r11d
jle 0x1801c965c
mov qword [rsp + 0x30], rdi
lea r10, [rbx + 2]
lea rdi, [0x180000000]
nop dword [rax]
mov r8d, dword [r10 + 0xe]
lea r10, [r10 + 0x10]
inc r11d
mov eax, r8d
shr rax, 0x18
movzx edx, byte [rdi + rax*4 + 0x37f690]
movzx eax, byte [r10 - 1]
movzx ecx, byte [rdi + rax*4 + 0x37f690]
mov r9d, dword [rdi + rdx*4 + 0x380290]
movzx eax, r8b
xor r9d, dword [rdi + rcx*4 + 0x380a90]
movzx ecx, byte [rdi + rax*4 + 0x37f690]
movzx eax, byte [r10]
xor r9d, dword [rdi + rcx*4 + 0x380e90]
movzx ecx, byte [rdi + rax*4 + 0x37f690]
movzx eax, byte [r10 + 3]
movzx edx, byte [rdi + rax*4 + 0x37f690]
xor r9d, dword [rdi + rcx*4 + 0x380690]
movzx eax, byte [r10 + 4]
movzx ecx, byte [rdi + rax*4 + 0x37f690]
mov r8d, dword [rdi + rdx*4 + 0x380a90]
mov dword [r10 - 2], r9d
xor r8d, dword [rdi + rcx*4 + 0x380690]
mov r9d, dword [r10 + 2]
mov eax, r9d
shr rax, 0x18
movzx ecx, byte [rdi + rax*4 + 0x37f690]
movzx eax, r9b
mov r9d, dword [r10 + 6]
xor r8d, dword [rdi + rcx*4 + 0x380290]
movzx ecx, byte [rdi + rax*4 + 0x37f690]
movzx eax, byte [r10 + 7]
xor r8d, dword [rdi + rcx*4 + 0x380e90]
movzx edx, byte [rdi + rax*4 + 0x37f690]
movzx eax, byte [r10 + 8]
movzx ecx, byte [rdi + rax*4 + 0x37f690]
mov dword [r10 + 2], r8d
mov r8d, dword [rdi + rdx*4 + 0x380a90]
xor r8d, dword [rdi + rcx*4 + 0x380690]
mov eax, r9d
shr rax, 0x18
movzx ecx, byte [rdi + rax*4 + 0x37f690]
movzx eax, r9b
mov r9d, dword [r10 + 0xa]
xor r8d, dword [rdi + rcx*4 + 0x380290]
movzx ecx, byte [rdi + rax*4 + 0x37f690]
movzx eax, byte [r10 + 0xb]
xor r8d, dword [rdi + rcx*4 + 0x380e90]
movzx edx, byte [rdi + rax*4 + 0x37f690]
movzx eax, byte [r10 + 0xc]
movzx ecx, byte [rdi + rax*4 + 0x37f690]
mov dword [r10 + 6], r8d
mov r8d, dword [rdi + rdx*4 + 0x380a90]
xor r8d, dword [rdi + rcx*4 + 0x380690]
mov eax, r9d
shr rax, 0x18
movzx ecx, byte [rdi + rax*4 + 0x37f690]
movzx eax, r9b
xor r8d, dword [rdi + rcx*4 + 0x380290]
movzx ecx, byte [rdi + rax*4 + 0x37f690]
xor r8d, dword [rdi + rcx*4 + 0x380e90]
mov dword [r10 + 0xa], r8d
cmp r11d, dword [rbx + 0xf0]
jl 0x1801c94d0
mov rdi, qword [rsp + 0x30]
xor eax, eax
add rsp, 0x20
pop rbx
ret
Function at 0x1801ca3f0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x20], r9
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r15
sub rsp, 0x40
mov r15, qword [rsp + 0xb0]
mov rbp, rdx
mov rdx, qword [rsp + 0xa8]
mov ebx, dword [r15]
mov r10, r9
mov rdi, r8
mov r12, rcx
test ebx, ebx
je 0x1801ca449
test rdi, rdi
je 0x1801ca449
mov eax, ebx
inc rbp
inc r12
movzx ecx, byte [rax + rdx]
dec rdi
xor cl, byte [r12 - 1]
inc ebx
mov byte [rbp - 1], cl
and ebx, 0xf
jne 0x1801ca426
mov r9, qword [rsp + 0xb8]
mov r13, qword [rsp + 0xa0]
mov esi, reloc.WS2_32.dll_recv
mov qword [rsp + 0x38], r14
cmp rdi, rsi
jb 0x1801ca544
mov rcx, rdi
mov r14, rbp
mov r15, r12
shr rcx, 4
sub r14, rdx
sub r15, rdx
imul rax, rcx, 0xfffffffffffffff0
add rdi, rax
mov rax, rcx
shl rax, 4
mov qword [rsp + 0x90], rdi
mov rdi, qword [rsp + 0x98]
add rbp, rax
add r12, rax
mov qword [rsp + 0x80], r12
mov qword [rsp + 0x88], rbp
mov rbp, qword [rsp + 0xa8]
mov r12, rcx
nop
mov r8, rdi
mov rdx, rbp
mov rcx, r13
call r9
mov edx, esi
nop
dec edx
inc byte [rdx + r13]
jne 0x1801ca4dc
test edx, edx
jne 0x1801ca4d0
cmp ebx, esi
jae 0x1801ca507
mov edx, reloc.WS2_32.dll_ntohs
mov eax, ebx
sub edx, ebx
add rax, rbp
shr edx, 3
inc edx
mov rcx, qword [r15 + rax]
lea rax, [rax + 8]
xor rcx, qword [rax - 8]
mov qword [r14 + rax - 8], rcx
dec rdx
jne 0x1801ca4f1
mov r9, qword [rsp + 0xb8]
add r14, rsi
add r15, rsi
xor ebx, ebx
dec r12
jne 0x1801ca4c0
mov rdi, qword [rsp + 0x90]
mov rbp, qword [rsp + 0x88]
mov r12, qword [rsp + 0x80]
mov r10, qword [rsp + 0x98]
mov r15, qword [rsp + 0xb0]
test rdi, rdi
je 0x1801ca585
mov r14, qword [rsp + 0xa8]
mov r8, r10
mov rcx, r13
mov rdx, r14
call r9
nop dword [rax]
dec esi
inc byte [rsi + r13]
jne 0x1801ca570
test esi, esi
jne 0x1801ca560
nop dword [rax]
mov ecx, ebx
inc ebx
movzx eax, byte [rcx + r12]
xor al, byte [rcx + r14]
mov byte [rcx + rbp], al
dec rdi
jne 0x1801ca570
mov dword [r15], ebx
mov r14, qword [rsp + 0x38]
add rsp, 0x40
pop r15
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x1801ca5a0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x20], r9
push rbx
push rbp
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x30
mov rdi, r8
mov r8, qword [rsp + 0xa0]
mov r14, rdx
mov ebx, dword [r8]
mov rbp, rcx
mov dword [rsp + 0x80], ebx
test ebx, ebx
je 0x1801ca609
mov rdx, qword [rsp + 0x98]
nop dword [rax + rax]
test rdi, rdi
je 0x1801ca602
mov eax, ebx
inc r14
inc rbp
movzx ecx, byte [rax + rdx]
dec rdi
xor cl, byte [rbp - 1]
inc ebx
mov byte [r14 - 1], cl
and ebx, 0xf
jne 0x1801ca5e0
mov dword [rsp + 0x80], ebx
mov r15, qword [rsp + 0x90]
mov r10, qword [rsp + 0xa8]
mov qword [rsp + 0x70], rsi
movzx eax, byte [r15 + 0xd]
movzx r13d, byte [r15 + 0xc]
mov r12d, reloc.WS2_32.dll_inet_ntoa
shl r13d, 8
or r13d, eax
movzx eax, byte [r15 + 0xe]
shl r13d, 8
or r13d, eax
movzx eax, byte [r15 + 0xf]
shl r13d, 8
or r13d, eax
cmp rdi, 0x10
jb 0x1801ca717
mov rbx, qword [rsp + 0x88]
mov eax, 0x10000000
nop dword [rax]
nop dword [rax + rax]
mov rsi, rdi
shr rsi, 4
cmp rsi, rax
cmova rsi, rax
add r13d, esi
mov eax, r13d
cmp rax, rsi
jae 0x1801ca68f
sub rsi, rax
xor r13d, r13d
mov r9, rbx
mov r8, rsi
mov rdx, r14
mov rcx, rbp
mov qword [rsp + 0x20], r15
call r10
mov eax, r13d
mov byte [r15 + 0xf], r13b
shr eax, 0x18
mov byte [r15 + 0xc], al
mov eax, r13d
shr eax, 0x10
mov byte [r15 + 0xd], al
mov eax, r13d
shr eax, 8
mov byte [r15 + 0xe], al
test r13d, r13d
jne 0x1801ca6dc
mov edx, r12d
nop dword [rax]
dec edx
inc byte [rdx + r15]
jne 0x1801ca6dc
test edx, edx
jne 0x1801ca6d0
mov r10, qword [rsp + 0xa8]
shl rsi, 4
mov eax, 0x10000000
sub rdi, rsi
add r14, rsi
add rbp, rsi
cmp rdi, 0x10
jae 0x1801ca670
mov ebx, dword [rsp + 0x80]
mov r8, qword [rsp + 0xa0]
mov r9, qword [rsp + 0x88]
test rdi, rdi
je 0x1801ca7a0
mov rsi, qword [rsp + 0x98]
xor eax, eax
mov qword [rsp + 0x20], r15
mov qword [rsi], rax
lea r8d, [rax + 1]
mov rdx, rsi
mov rcx, rsi
mov qword [rsi + 8], rax
call r10
inc r13d
mov eax, r13d
mov byte [r15 + 0xf], r13b
shr eax, 0x18
mov byte [r15 + 0xc], al
mov eax, r13d
shr eax, 0x10
mov byte [r15 + 0xd], al
mov eax, r13d
shr eax, 8
mov byte [r15 + 0xe], al
test r13d, r13d
jne 0x1801ca780
nop dword [rax]
dec r12d
inc byte [r12 + r15]
jne 0x1801ca780
test r12d, r12d
jne 0x1801ca770
nop
mov ecx, ebx
inc ebx
movzx eax, byte [rcx + rbp]
xor al, byte [rcx + rsi]
mov byte [rcx + r14], al
dec rdi
jne 0x1801ca780
mov rax, qword [rsp + 0xa0]
mov dword [rax], ebx
jmp 0x1801ca7a3
mov dword [r8], ebx
mov rsi, qword [rsp + 0x70]
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rbp
pop rbx
ret
Function at 0x1801ca7c0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x20], r9
push rbx
push rbp
push rsi
push rdi
push r12
push r15
sub rsp, 0x28
mov rsi, qword [rsp + 0x88]
mov rbp, qword [rsp + 0x80]
mov r10, r9
mov ebx, dword [rsi]
mov rdi, r8
mov r15, rdx
mov r12, rcx
test ebx, ebx
je 0x1801ca817
test rdi, rdi
je 0x1801ca817
mov eax, ebx
inc r15
inc r12
movzx ecx, byte [rax + rbp]
dec rdi
xor cl, byte [r12 - 1]
inc ebx
mov byte [r15 - 1], cl
and ebx, 0xf
jne 0x1801ca7f3
mov r9, qword [rsp + 0x90]
cmp rdi, 0x10
jb 0x1801ca8d9
mov qword [rsp + 0x60], r13
mov rsi, r15
mov r13, rdi
shr r13, 4
mov qword [rsp + 0x20], r14
mov r14, r12
sub rsi, rbp
sub r14, rbp
imul rax, r13, 0xfffffffffffffff0
add rdi, rax
mov rax, r13
shl rax, 4
add r15, rax
add r12, rax
mov qword [rsp + 0x68], r15
mov r15, qword [rsp + 0x78]
mov r8, r15
mov rdx, rbp
mov rcx, rbp
call r9
cmp ebx, 0x10
jae 0x1801ca8a6
mov edx, reloc.WS2_32.dll_ntohs
mov eax, ebx
sub edx, ebx
add rax, rbp
shr edx, 3
inc edx
nop word [rax + rax]
mov rcx, qword [r14 + rax]
lea rax, [rax + 8]
xor rcx, qword [rax - 8]
mov qword [rsi + rax - 8], rcx
dec rdx
jne 0x1801ca890
mov r9, qword [rsp + 0x90]
add rsi, 0x10
add r14, 0x10
xor ebx, ebx
dec r13
jne 0x1801ca864
mov r15, qword [rsp + 0x68]
mov r10, qword [rsp + 0x78]
mov rsi, qword [rsp + 0x88]
mov r14, qword [rsp + 0x20]
mov r13, qword [rsp + 0x60]
test rdi, rdi
je 0x1801ca905
mov r8, r10
mov rdx, rbp
mov rcx, rbp
call r9
nop word [rax + rax]
mov ecx, ebx
inc ebx
movzx eax, byte [rcx + r12]
xor al, byte [rcx + rbp]
mov byte [rcx + r15], al
dec rdi
jne 0x1801ca8f0
mov dword [rsi], ebx
add rsp, 0x28
pop r15
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x1801cabc0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x20], r9
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x20
cmp dword [rsp + 0x90], 0
mov r15, qword [rsp + 0x88]
mov rbp, qword [rsp + 0x80]
mov ebx, dword [r15]
mov r10, r9
mov rdi, r8
mov rsi, rdx
mov r14, rcx
je 0x1801cad2f
test ebx, ebx
je 0x1801cac37
nop word [rax + rax]
test rdi, rdi
je 0x1801cac37
movzx eax, byte [r14]
mov ecx, ebx
inc rsi
movzx edx, byte [rcx + rbp]
inc r14
dec rdi
xor edx, eax
inc ebx
mov byte [rcx + rbp], dl
mov byte [rsi - 1], dl
and ebx, 0xf
jne 0x1801cac10
mov r9, qword [rsp + 0x98]
cmp rdi, 0x10
jb 0x1801cacf3
mov r15, rsi
mov r13, rdi
mov r12, r14
shr r13, 4
sub r15, rbp
sub r12, rbp
imul rax, r13, 0xfffffffffffffff0
add rdi, rax
mov rax, r13
shl rax, 4
add rsi, rax
add r14, rax
mov qword [rsp + 0x68], rsi
mov rsi, qword [rsp + 0x78]
nop word [rax + rax]
mov r8, rsi
mov rdx, rbp
mov rcx, rbp
call r9
cmp ebx, 0x10
jae 0x1801cacca
mov edx, reloc.WS2_32.dll_ntohs
mov ecx, ebx
sub edx, ebx
add rcx, rbp
shr edx, 3
inc edx
nop dword [rax]
nop word [rax + rax]
mov rax, qword [r12 + rcx]
lea rcx, [rcx + 8]
xor qword [rcx - 8], rax
mov rax, qword [rcx - 8]
mov qword [r15 + rcx - 8], rax
dec rdx
jne 0x1801cacb0
mov r9, qword [rsp + 0x98]
add r15, 0x10
add r12, 0x10
xor ebx, ebx
dec r13
jne 0x1801cac80
mov rsi, qword [rsp + 0x68]
mov r10, qword [rsp + 0x78]
mov r15, qword [rsp + 0x88]
test rdi, rdi
je 0x1801cae3a
mov r8, r10
mov rdx, rbp
mov rcx, rbp
call r9
nop dword [rax + rax]
mov edx, ebx
inc ebx
movzx ecx, byte [rdx + r14]
movzx eax, byte [rdx + rbp]
xor ecx, eax
mov byte [rdx + rbp], cl
mov byte [rdx + rsi], cl
dec rdi
jne 0x1801cad10
jmp 0x1801cae3a
test ebx, ebx
je 0x1801cad5a
test rdi, rdi
je 0x1801cad5a
movzx edx, byte [r14]
mov ecx, ebx
inc rsi
movzx eax, byte [rcx + rbp]
inc r14
dec rdi
xor al, dl
inc ebx
mov byte [rsi - 1], al
mov byte [rcx + rbp], dl
and ebx, 0xf
jne 0x1801cad33
mov r13, qword [rsp + 0x98]
cmp rdi, 0x10
jb 0x1801cae04
mov r12, rdi
mov r15, rsi
shr r12, 4
sub r15, rbp
imul rax, r12, 0xfffffffffffffff0
add rdi, rax
mov qword [rsp + 0x70], rdi
mov rdi, qword [rsp + 0x78]
nop word [rax + rax]
mov r8, rdi
mov rdx, rbp
mov rcx, rbp
call r13
cmp ebx, 0x10
jae 0x1801caddf
mov r9d, reloc.WS2_32.dll_ntohs
mov r8d, ebx
mov r10, r14
sub r9d, ebx
add r8, rbp
sub r10, rsi
shr r9d, 3
inc r9d
nop dword [rax]
lea rcx, [r15 + r8]
lea r8, [r8 + 8]
mov rdx, qword [rcx + r10]
mov rax, rdx
xor rax, qword [r8 - 8]
mov qword [rcx], rax
mov qword [r8 - 8], rdx
dec r9
jne 0x1801cadc0
add rsi, 0x10
add r15, 0x10
add r14, 0x10
xor ebx, ebx
dec r12
jne 0x1801cad90
mov rdi, qword [rsp + 0x70]
mov r10, qword [rsp + 0x78]
mov r15, qword [rsp + 0x88]
test rdi, rdi
je 0x1801cae3a
mov r8, r10
mov rdx, rbp
mov rcx, rbp
call r13
nop word [rax + rax]
mov ecx, ebx
inc ebx
movzx edx, byte [rcx + r14]
movzx eax, byte [rcx + rbp]
xor al, dl
mov byte [rcx + rsi], al
mov byte [rcx + rbp], dl
dec rdi
jne 0x1801cae20
mov dword [r15], ebx
mov rbx, qword [rsp + 0x60]
add rsp, 0x20
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x1801cae60
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push r14
sub rsp, 0x20
cmp qword [rcx + 0x38], 0
mov rbx, r8
mov r14, rdx
mov rsi, rcx
je 0x1801cae96
mov eax, 0xfffffffe
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
mov rcx, qword [rcx + 0x30]
movabs rax, 0x2000000000000000
add rcx, rbx
cmp rcx, rax
ja 0x1801caf70
cmp rcx, rbx
jb 0x1801caf70
mov qword [rsp + 0x38], rdi
mov edi, dword [rsi + 0x174]
mov qword [rsi + 0x30], rcx
test edi, edi
je 0x1801caeff
nop dword [rax]
test rbx, rbx
je 0x1801caeee
movzx eax, byte [r14]
mov ecx, edi
inc r14
xor byte [rcx + rsi + 0x40], al
dec rbx
inc edi
and edi, 0xf
jne 0x1801caed0
jmp 0x1801caef2
test edi, edi
jne 0x1801caf52
lea rdx, [rsi + 0x60]
lea rcx, [rsi + 0x40]
call fcn.1801cc220
mov qword [rsp + 0x30], rbp
mov rbp, rbx
and rbp, 0xfffffffffffffff0
je 0x1801caf26
lea rdx, [rsi + 0x60]
lea rcx, [rsi + 0x40]
mov r9, rbp
mov r8, r14
call fcn.1801cc050
add r14, rbp
sub rbx, rbp
mov rbp, qword [rsp + 0x30]
test rbx, rbx
je 0x1801caf52
mov edi, ebx
lea rcx, [rsi + 0x40]
sub r14, rsi
nop dword [rax]
movzx eax, byte [r14 + rcx - 0x40]
lea rcx, [rcx + 1]
xor byte [rcx - 1], al
dec rbx
jne 0x1801caf40
mov dword [rsi + 0x174], edi
mov rdi, qword [rsp + 0x38]
xor eax, eax
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
or eax, 0xffffffff
add rsp, 0x20
pop r14
ret
Function at 0x1801cb2a0
Capabilities:
Encode data using xor

Disassembly:
push rbx
push r12
push r14
push r15
sub rsp, 0x58
mov rax, qword [rcx + 0x180]
mov rbx, rcx
mov rcx, qword [rcx + 0x38]
mov qword [rsp + 0x30], rax
add rcx, r9
movabs rax, 0xfffffffe0
mov r14, r9
mov r12, r8
mov r15, rdx
cmp rcx, rax
ja 0x1801cb51e
cmp rcx, r9
jb 0x1801cb51e
cmp dword [rbx + 0x174], 0
mov qword [rsp + 0x88], rbp
mov qword [rbx + 0x38], rcx
mov qword [rsp + 0x50], rsi
je 0x1801cb318
lea rdx, [rbx + 0x60]
lea rcx, [rbx + 0x40]
call fcn.1801cc220
mov dword [rbx + 0x174], 0
movzx eax, byte [rbx + 0xd]
mov esi, dword [rbx + 0x170]
movzx ebp, byte [rbx + 0xc]
shl ebp, 8
mov dword [rsp + 0x80], esi
or ebp, eax
movzx eax, byte [rbx + 0xe]
shl ebp, 8
or ebp, eax
movzx eax, byte [rbx + 0xf]
shl ebp, 8
or ebp, eax
test esi, esi
je 0x1801cb391
test r14, r14
je 0x1801cb37c
movzx edx, byte [r15]
mov ecx, esi
inc r12
movzx eax, byte [rcx + rbx + 0x10]
inc r15
dec r14
xor al, dl
mov byte [r12 - 1], al
xor byte [rcx + rbx + 0x40], dl
inc esi
and esi, 0xf
mov dword [rsp + 0x80], esi
jne 0x1801cb348
jmp 0x1801cb384
test esi, esi
jne 0x1801cb4fd
lea rdx, [rbx + 0x60]
lea rcx, [rbx + 0x40]
call fcn.1801cc220
mov qword [rsp + 0x48], rdi
mov qword [rsp + 0x40], r13
mov r13, qword [rsp + 0xa0]
cmp r14, 0xc00
jb 0x1801cb43b
movabs rax, 0xaaaaaaaaaaaaaaab
mul r14
mov rdi, rdx
shr rdi, 0xb
imul rax, rdi, 0xfffffffffffff400
add r14, rax
nop
lea rdx, [rbx + 0x60]
lea rcx, [rbx + 0x40]
mov r9d, 0xc00
mov r8, r15
call fcn.1801cc050
mov r9, qword [rsp + 0x30]
mov r8d, 0xc0
mov rdx, r12
mov rcx, r15
mov qword [rsp + 0x20], rbx
call r13
add ebp, 0xc0
add r12, 0xc00
mov eax, ebp
add r15, 0xc00
mov byte [rbx + 0xf], bpl
shr eax, 0x18
mov byte [rbx + 0xc], al
mov eax, ebp
shr eax, 0x10
mov byte [rbx + 0xd], al
mov eax, ebp
shr eax, 8
mov byte [rbx + 0xe], al
dec rdi
jne 0x1801cb3d0
mov esi, dword [rsp + 0x80]
mov r13, r14
and r13, 0xfffffffffffffff0
je 0x1801cb49f
lea rdx, [rbx + 0x60]
lea rcx, [rbx + 0x40]
mov rdi, r13
mov r9, r13
mov r8, r15
shr rdi, 4
call fcn.1801cc050
mov r9, qword [rsp + 0x30]
mov r8, rdi
mov rdx, r12
mov rcx, r15
mov qword [rsp + 0x20], rbx
call qword [rsp + 0xa0]
add ebp, edi
add r12, r13
mov eax, ebp
add r15, r13
mov byte [rbx + 0xf], bpl
shr eax, 0x18
mov byte [rbx + 0xc], al
mov eax, ebp
shr eax, 0x10
mov byte [rbx + 0xd], al
mov eax, ebp
shr eax, 8
sub r14, r13
mov byte [rbx + 0xe], al
mov r13, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
test r14, r14
je 0x1801cb4fd
mov r8, qword [rsp + 0x30]
lea rdx, [rbx + 0x10]
mov rcx, rbx
call qword [rbx + 0x178]
inc ebp
mov eax, ebp
mov byte [rbx + 0xf], bpl
shr eax, 0x18
mov byte [rbx + 0xc], al
mov eax, ebp
shr eax, 0x10
mov byte [rbx + 0xd], al
mov eax, ebp
shr eax, 8
mov byte [rbx + 0xe], al
nop
mov edx, esi
inc esi
movzx ecx, byte [rdx + r15]
movzx eax, byte [rdx + rbx + 0x10]
xor byte [rdx + rbx + 0x40], cl
xor al, cl
mov byte [rdx + r12], al
dec r14
jne 0x1801cb4e0
mov rbp, qword [rsp + 0x88]
mov dword [rbx + 0x170], esi
mov rsi, qword [rsp + 0x50]
xor eax, eax
add rsp, 0x58
pop r15
pop r14
pop r12
pop rbx
ret
or eax, 0xffffffff
add rsp, 0x58
pop r15
pop r14
pop r12
pop rbx
ret
Function at 0x1801cc050
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r12
push r13
push r14
push r15
mov rsi, rcx
mov r12, r9
mov rbp, rdx
mov r11, rcx
lea r14, [r8 + 0xe]
lea r13, [0x1803813c0]
sub rsi, r8
nop word [rax + rax]
movzx eax, byte [r11 + 0xf]
movzx ecx, byte [r14 + 1]
mov rdi, r14
xor rcx, rax
mov r15d, reloc.WS2_32.dll_ntohs
mov r9, rcx
and ecx, 0xf
add rcx, rcx
and r9, 0xfffffffffffffff0
mov r8, qword [rbp + rcx*8]
mov rcx, qword [rbp + rcx*8 + 8]
mov rdx, rcx
mov rax, r8
shr r8, 4
and edx, 0xf
shl rax, 0x3c
shr rcx, 4
mov rbx, qword [r13 + rdx*8]
or rax, rcx
xor rbx, r8
xor rbx, qword [r9 + rbp]
xor rax, qword [r9 + rbp + 8]
nop word [rax + rax]
movzx ecx, byte [rdi]
movzx edx, byte [rsi + rdi]
mov r9, rbx
xor rdx, rcx
mov rcx, rax
shr rax, 4
shr rbx, 4
shl r9, 0x3c
and ecx, 0xf
mov r8, qword [r13 + rcx*8]
or r9, rax
mov r10, rdx
xor r8, rbx
and r10, 0xfffffffffffffff0
and edx, 0xf
add rdx, rdx
lea rdi, [rdi - 1]
xor r9, qword [rbp + rdx*8 + 8]
xor r8, qword [rbp + rdx*8]
mov rcx, r9
mov rax, r8
shr r9, 4
shl rax, 0x3c
and ecx, 0xf
shr r8, 4
mov rbx, qword [r13 + rcx*8]
or rax, r9
xor rax, qword [r10 + rbp + 8]
xor rbx, r8
xor rbx, qword [r10 + rbp]
dec r15
jne 0x1801cc0f0
mov rdx, rbx
add r14, 0x10
sub rsi, 0x10
shr rdx, 0x20
mov byte [r11 + 7], bl
mov byte [r11 + 0xf], al
mov ecx, edx
mov byte [r11 + 3], dl
shr ecx, 0x18
mov byte [r11], cl
mov ecx, edx
shr ecx, 0x10
mov byte [r11 + 1], cl
mov ecx, edx
mov rdx, rax
shr ecx, 8
shr rdx, 0x20
mov byte [r11 + 2], cl
mov ecx, ebx
mov byte [r11 + 0xb], dl
shr ecx, 0x18
mov byte [r11 + 4], cl
mov ecx, ebx
shr ecx, 0x10
mov byte [r11 + 5], cl
mov ecx, ebx
shr ecx, 8
mov byte [r11 + 6], cl
mov ecx, edx
shr ecx, 0x18
mov byte [r11 + 8], cl
mov ecx, edx
shr ecx, 0x10
mov byte [r11 + 9], cl
mov ecx, edx
shr ecx, 8
mov byte [r11 + 0xa], cl
mov ecx, eax
shr ecx, 0x18
mov byte [r11 + 0xc], cl
mov ecx, eax
shr ecx, 0x10
mov byte [r11 + 0xd], cl
mov ecx, eax
shr ecx, 8
mov byte [r11 + 0xe], cl
sub r12, 0x10
jne 0x1801cc090
mov rbx, qword [rsp + 0x28]
mov rbp, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x40]
pop r15
pop r14
pop r13
pop r12
ret
Function at 0x1801cc220
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
mov qword [rsp + 0x20], r14
movzx eax, byte [rcx + 0xf]
lea r14, [0x1803813c0]
mov rdi, rdx
mov r10d, eax
and eax, 0xf
mov esi, reloc.WS2_32.dll_ntohl
add rax, rax
and r10, 0xfffffffffffffff0
mov r9, qword [rdx + rax*8]
mov r8, qword [rdx + rax*8 + 8]
mov rax, r8
mov r11, r9
shr r9, 4
and eax, 0xf
shl r11, 0x3c
shr r8, 4
mov rbx, qword [r14 + rax*8]
or r11, r8
xor rbx, r9
xor rbx, qword [r10 + rdx]
xor r11, qword [r10 + rdx + 8]
nop word [rax + rax]
movzx edx, byte [rsi + rcx]
mov rax, r11
shr r11, 4
mov r9, rbx
shr rbx, 4
and eax, 0xf
mov r8, qword [r14 + rax*8]
shl r9, 0x3c
mov r10d, edx
or r9, r11
xor r8, rbx
and r10, 0xfffffffffffffff0
and edx, 0xf
add rdx, rdx
xor r9, qword [rdi + rdx*8 + 8]
xor r8, qword [rdi + rdx*8]
mov rax, r9
mov r11, r8
shr r9, 4
shl r11, 0x3c
and eax, 0xf
shr r8, 4
mov rbx, qword [r14 + rax*8]
or r11, r9
xor r11, qword [r10 + rdi + 8]
xor rbx, r8
xor rbx, qword [r10 + rdi]
dec rsi
jns 0x1801cc290
mov rsi, qword [rsp + 0x10]
mov rdi, qword [rsp + 0x18]
mov r14, qword [rsp + 0x20]
mov rdx, rbx
mov byte [rcx + 7], bl
mov byte [rcx + 0xf], r11b
shr rdx, 0x20
mov eax, edx
mov byte [rcx + 3], dl
shr eax, 0x18
mov byte [rcx], al
mov eax, edx
shr eax, 0x10
mov byte [rcx + 1], al
mov eax, edx
mov rdx, r11
shr eax, 8
shr rdx, 0x20
mov byte [rcx + 2], al
mov eax, ebx
mov byte [rcx + 0xb], dl
shr eax, 0x18
mov byte [rcx + 4], al
mov eax, ebx
shr eax, 0x10
mov byte [rcx + 5], al
mov eax, ebx
mov rbx, qword [rsp + 8]
shr eax, 8
mov byte [rcx + 6], al
mov eax, edx
shr eax, 0x18
mov byte [rcx + 8], al
mov eax, edx
shr eax, 0x10
mov byte [rcx + 9], al
mov eax, edx
shr eax, 8
mov byte [rcx + 0xa], al
mov eax, r11d
shr eax, 0x18
mov byte [rcx + 0xc], al
mov eax, r11d
shr eax, 0x10
mov byte [rcx + 0xd], al
mov eax, r11d
shr eax, 8
mov byte [rcx + 0xe], al
ret
Function at 0x1801cc710
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x40
mov rax, qword [0x18050a0d0]
xor rax, rsp
mov qword [rsp + 0x38], rax
movzx edi, byte [rcx]
mov r12, qword [rcx + 0x28]
mov r13, qword [rcx + 0x30]
mov rbp, r9
mov r15, r8
mov r14, rdx
mov rbx, rcx
mov byte [rsp + 0x20], dil
test dil, 0x40
jne 0x1801cc75f
lea rdx, [rcx + 0x10]
mov r8, r13
call r12
movzx eax, dil
mov edi, reloc.WS2_32.dll_ntohs
xor esi, esi
and eax, 7
mov r8d, edi
mov ecx, esi
sub r8d, eax
mov byte [rbx], al
mov dword [rsp + 0x24], r8d
cmp r8d, edi
jae 0x1801cc7a6
mov edx, r8d
add rdx, rbx
sub edi, r8d
nop word [rax + rax]
movzx eax, byte [rdx]
mov byte [rdx], sil
lea rdx, [rdx + 1]
or rcx, rax
shl rcx, 8
dec rdi
jne 0x1801cc790
movzx eax, byte [rbx + 0xf]
mov byte [rbx + 0xf], 1
or rcx, rax
cmp rcx, rbp
je 0x1801cc7be
or eax, 0xffffffff
jmp 0x1801cc8bb
cmp rbp, 0x10
jb 0x1801cc82c
mov rsi, rbp
shr rsi, 4
imul rax, rsi, 0xfffffffffffffff0
add rbp, rax
lea rdx, [rsp + 0x28]
mov r8, r13
mov rcx, rbx
call r12
mov eax, 8
dec eax
inc byte [rax + rbx + 8]
jne 0x1801cc7f1
test eax, eax
jne 0x1801cc7e5
mov rax, qword [r14]
lea rdx, [rbx + 0x10]
lea rcx, [rbx + 0x10]
xor rax, qword [rsp + 0x28]
mov r8, r13
mov qword [r15], rax
xor qword [rbx + 0x10], rax
mov rax, qword [r14 + 8]
xor rax, qword [rsp + 0x30]
mov qword [r15 + 8], rax
xor qword [rbx + 0x18], rax
call r12
add r14, 0x10
add r15, 0x10
dec rsi
jne 0x1801cc7d2
test rbp, rbp
je 0x1801cc87a
lea rdx, [rsp + 0x28]
mov r8, r13
mov rcx, rbx
call r12
test rbp, rbp
je 0x1801cc86d
mov rdx, rsi
nop word [rax + rax]
movzx ecx, byte [rdx + r14]
movzx eax, byte [rsp + rdx + 0x28]
inc esi
xor ecx, eax
mov byte [rdx + r15], cl
xor byte [rdx + rbx + 0x10], cl
mov edx, esi
cmp rdx, rbp
jb 0x1801cc850
lea rcx, [rbx + 0x10]
mov r8, r13
mov rdx, rcx
call r12
mov edx, dword [rsp + 0x24]
cmp edx, 0x10
jae 0x1801cc892
mov ecx, reloc.WS2_32.dll_recv
lea rdi, [rbx + rdx]
sub ecx, edx
xor eax, eax
rep stosb byte [rdi], al
lea rdx, [rsp + 0x28]
mov r8, r13
mov rcx, rbx
call r12
mov rax, qword [rsp + 0x28]
xor qword [rbx + 0x10], rax
mov rax, qword [rsp + 0x30]
xor qword [rbx + 0x18], rax
movzx eax, byte [rsp + 0x20]
mov byte [rbx], al
xor eax, eax
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.180243450
mov rbx, qword [rsp + 0x88]
add rsp, 0x40
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret