joyce8/EMBER2024-capa huggingface dataset:
Function at 0x18012b900
Capabilities:
Allocate or change rwx memory

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x68
mov rcx, qword [rsp + 0x70]
call fcn.18012ba00
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x78]
cmp qword [rsp + 0x20], rax
jae 0x18012b9f8
cmp qword [rsp + 0x20], 0x50000000
jb 0x18012b950
mov eax, 0x80000000
cmp qword [rsp + 0x20], rax
ja 0x18012b950
mov eax, 0x80010000
mov qword [rsp + 0x20], rax
jmp 0x18012b91d
mov r8d, gethostbyname
xor edx, edx
lea rcx, [rsp + 0x28]
call fcn.1801ada60
mov r8d, gethostbyname
lea rdx, [rsp + 0x28]
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
jne 0x18012b97f
jmp 0x18012b9f8
cmp dword [rsp + 0x48], 0x10000
jne 0x18012b9d6
cmp qword [rsp + 0x40], 0x10000
jb 0x18012b9d6
mov r9d, 0x40
mov r8d, 0x3000
mov edx, 0x10000
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov qword [rsp + 0x58], rax
cmp qword [rsp + 0x58], 0
je 0x18012b9c4
mov rax, qword [rsp + 0x58]
jmp 0x18012b9fa
mov rax, qword [rsp + 0x20]
add rax, 0x10000
mov qword [rsp + 0x20], rax
jmp 0x18012b9f3
mov rax, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x28]
add rcx, rax
mov rax, rcx
mov rcx, rax
call fcn.18012ba00
mov qword [rsp + 0x20], rax
jmp 0x18012b91d
xor eax, eax
add rsp, 0x68
ret

Function at 0x18012ba50
Capabilities:
Allocate or change rwx memory

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x68
mov rax, qword [rsp + 0x78]
sub rax, 0x10000
mov rcx, rax
call fcn.18012bb60
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x70]
cmp qword [rsp + 0x20], rax
jbe 0x18012bb4b
cmp qword [rsp + 0x20], 0x50000000
jb 0x18012baa8
mov eax, 0x80000000
cmp qword [rsp + 0x20], rax
ja 0x18012baa8
mov qword [rsp + 0x20], 0x4fff0000
jmp 0x18012ba76
mov r8d, gethostbyname
xor edx, edx
lea rcx, [rsp + 0x28]
call fcn.1801ada60
mov r8d, gethostbyname
lea rdx, [rsp + 0x28]
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
jne 0x18012bad7
jmp 0x18012bb4b
cmp dword [rsp + 0x48], 0x10000
jne 0x18012bb2e
cmp qword [rsp + 0x40], 0x10000
jb 0x18012bb2e
mov r9d, 0x40
mov r8d, 0x3000
mov edx, 0x10000
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov qword [rsp + 0x58], rax
cmp qword [rsp + 0x58], 0
je 0x18012bb1c
mov rax, qword [rsp + 0x58]
jmp 0x18012bb4d
mov rax, qword [rsp + 0x20]
sub rax, 0x10000
mov qword [rsp + 0x20], rax
jmp 0x18012bb46
mov rax, qword [rsp + 0x30]
sub rax, 0x10000
mov rcx, rax
call fcn.18012bb60
mov qword [rsp + 0x20], rax
jmp 0x18012ba76
xor eax, eax
add rsp, 0x68
ret
Function at 0x18012bde0
Capabilities:
Parse pe header

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x78
cmp qword [rsp + 0x80], 0
jne 0x18012bdff
mov qword [rsp + 0x20], 0x10000
jmp 0x18012be12
mov rax, qword [rsp + 0x80]
add rax, 0x10000
mov qword [rsp + 0x20], rax
mov r8d, gethostbyname
xor edx, edx
lea rcx, [rsp + 0x28]
call fcn.1801ada60
jmp 0x18012be3b
mov rax, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x28]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x20], rax
mov r8d, gethostbyname
lea rdx, [rsp + 0x28]
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
ja 0x18012be5b
jmp 0x18012bef8
cmp dword [rsp + 0x48], 0x1000
jne 0x18012be80
mov eax, dword [rsp + 0x4c]
and eax, 0xff
cmp eax, 1
je 0x18012be80
mov eax, dword [rsp + 0x4c]
and eax, 0x100
test eax, eax
je 0x18012be82
jmp 0x18012be26
mov rax, qword [rsp + 0x20]
mov qword [rsp + 0x58], rax
mov rax, qword [rsp + 0x58]
movzx eax, word [rax]
cmp eax, 0x5a4d
jne 0x18012beb8
mov rax, qword [rsp + 0x58]
mov eax, dword [rax + 0x3c]
cmp rax, qword [rsp + 0x40]
ja 0x18012beb8
mov rax, qword [rsp + 0x58]
mov eax, dword [rax + 0x3c]
cmp rax, 0x40
jae 0x18012bebd
jmp 0x18012be26
mov rax, qword [rsp + 0x58]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x58]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x60], rax
mov rax, qword [rsp + 0x60]
cmp dword [rax], 0x4550
jne 0x18012be26
mov rax, qword [rsp + 0x58]
jmp 0x18012befa
xor eax, eax
add rsp, 0x78
ret
Function at 0x18012bf00
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x58
mov rax, qword [rsp + 0x60]
mov qword [rsp + 0x20], rax
cmp qword [rsp + 0x60], 0
jne 0x18012bf28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x20]
movzx eax, word [rax]
cmp eax, 0x5a4d
je 0x18012bf49
mov ecx, 0xc1
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
jmp 0x18012c0c7
mov rax, qword [rsp + 0x20]
movsxd rax, dword [rax + 0x3c]
mov rcx, qword [rsp + 0x20]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x30], rax
mov rax, qword [rsp + 0x30]
cmp dword [rax], 0x4550
je 0x18012bf81
mov ecx, 0xbf
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
jmp 0x18012c0c7
mov rax, qword [rsp + 0x30]
movzx eax, word [rax + 0x14]
test eax, eax
jne 0x18012bfa0
mov ecx, 0xc0
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
jmp 0x18012c0c7
mov rax, qword [rsp + 0x30]
movzx eax, word [rax + 0x14]
mov rcx, qword [rsp + 0x30]
lea rax, [rcx + rax + 0x18]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x38], 0
jmp 0x18012bfcc
mov eax, dword [rsp + 0x38]
inc eax
mov dword [rsp + 0x38], eax
mov rax, qword [rsp + 0x30]
movzx eax, word [rax + 6]
cmp dword [rsp + 0x38], eax
jae 0x18012c0a9
mov eax, dword [rsp + 0x38]
imul rax, rax, 0x28
mov rcx, qword [rsp + 0x28]
add rcx, rax
mov rax, rcx
lea rdx, str..detour
mov rcx, rax
call fcn.1801c1970
test eax, eax
jne 0x18012c0a4
mov eax, dword [rsp + 0x38]
imul rax, rax, 0x28
mov rcx, qword [rsp + 0x28]
cmp dword [rcx + rax + 0xc], 0
je 0x18012c031
mov eax, dword [rsp + 0x38]
imul rax, rax, 0x28
mov rcx, qword [rsp + 0x28]
cmp dword [rcx + rax + 0x10], 0
jne 0x18012c033
jmp 0x18012c0a9
mov eax, dword [rsp + 0x38]
imul rax, rax, 0x28
mov rcx, qword [rsp + 0x28]
mov eax, dword [rcx + rax + 0xc]
mov rcx, qword [rsp + 0x20]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x48]
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x40]
mov eax, dword [rax]
cmp rax, 0x40
jb 0x18012c079
mov rax, qword [rsp + 0x40]
cmp dword [rax + 4], 0x727444
je 0x18012c07b
jmp 0x18012c0a9
mov rax, qword [rsp + 0x40]
cmp dword [rax + 8], 0
jne 0x18012c095
mov rax, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x40]
mov ecx, dword [rcx]
mov dword [rax + 8], ecx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rax, qword [rsp + 0x40]
jmp 0x18012c0c7
jmp 0x18012bfc2
mov ecx, 0xc0
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
jmp 0x18012c0c7
add rsp, 0x58
ret
Function at 0x18012c390
Capabilities:
Allocate or change rwx memory

Disassembly:
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
sub rsp, 0x48
mov rax, qword [rsp + 0x50]
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x38]
mov eax, dword [rax]
cmp rax, 0x688
jne 0x18012c3c3
mov rax, qword [rsp + 0x38]
mov ecx, dword [rsp + 0x58]
cmp dword [rax], ecx
jbe 0x18012c3d5
mov ecx, 0xc1
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
jmp 0x18012c572
mov dword [rsp + 0x30], 0xffffffff
mov dword [rsp + 0x20], 0xffffffff
mov dword [rsp + 0x2c], 0xffffffff
mov dword [rsp + 0x24], 0
mov rax, qword [rsp + 0x38]
mov eax, dword [rax + 4]
lea r9, [rsp + 0x30]
mov r8d, 0x40
mov edx, eax
mov rax, qword [rsp + 0x38]
mov rcx, qword [rax + 0x10]
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x18012c56e
mov rax, qword [rsp + 0x38]
mov eax, dword [rax + 8]
lea r9, [rsp + 0x20]
mov r8d, 0x40
mov edx, eax
mov rax, qword [rsp + 0x38]
mov rcx, qword [rax + 0x18]
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x18012c54b
mov rax, qword [rsp + 0x38]
mov eax, dword [rax + 4]
mov rcx, qword [rsp + 0x38]
add rcx, 0x28
mov r8d, eax
mov rdx, rcx
mov rax, qword [rsp + 0x38]
mov rcx, qword [rax + 0x10]
call fcn.1801ad3b0
mov rax, qword [rsp + 0x38]
mov eax, dword [rax + 8]
mov rcx, qword [rsp + 0x38]
add rcx, 0x68
mov r8d, eax
mov rdx, rcx
mov rax, qword [rsp + 0x38]
mov rcx, qword [rax + 0x18]
call fcn.1801ad3b0
mov rax, qword [rsp + 0x38]
cmp qword [rax + 0x20], 0
je 0x18012c520
mov rax, qword [rsp + 0x38]
mov eax, dword [rax + 0xc]
lea r9, [rsp + 0x2c]
mov r8d, 0x40
mov edx, eax
mov rax, qword [rsp + 0x38]
mov rcx, qword [rax + 0x20]
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x18012c51e
mov rax, qword [rsp + 0x38]
mov eax, dword [rax + 0xc]
mov rcx, qword [rsp + 0x38]
add rcx, 0x670
mov r8d, eax
mov rdx, rcx
mov rax, qword [rsp + 0x38]
mov rcx, qword [rax + 0x20]
call fcn.1801ad3b0
mov rax, qword [rsp + 0x38]
mov eax, dword [rax + 0xc]
lea r9, [rsp + 0x28]
mov r8d, dword [rsp + 0x2c]
mov edx, eax
mov rax, qword [rsp + 0x38]
mov rcx, qword [rax + 0x20]
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov dword [rsp + 0x24], 1
jmp 0x18012c528
mov dword [rsp + 0x24], 1
mov rax, qword [rsp + 0x38]
mov eax, dword [rax + 8]
lea r9, [rsp + 0x28]
mov r8d, dword [rsp + 0x20]
mov edx, eax
mov rax, qword [rsp + 0x38]
mov rcx, qword [rax + 0x18]
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov rax, qword [rsp + 0x38]
mov eax, dword [rax + 4]
lea r9, [rsp + 0x28]
mov r8d, dword [rsp + 0x30]
mov edx, eax
mov rax, qword [rsp + 0x38]
mov rcx, qword [rax + 0x10]
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov eax, dword [rsp + 0x24]
add rsp, 0x48
ret

Function at 0x18012d2c0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov eax, 0x28
call fcn.1801312a0
sub rsp, rax
add rsp, 0x28
jmp fcn.180133170
Function at 0x1801360a0
Capabilities:
Encode data using xor

Disassembly:
xor r9b, r9b
mov r10, rdx
test r8, r8
je 0x1801360c7
sub r10, rcx
nop
movzx edx, byte [r10 + rcx]
movzx eax, byte [rcx]
lea rcx, [rcx + 1]
xor dl, al
or r9b, dl
sub r8, 1
jne 0x1801360b0
movzx eax, r9b
ret

Function at 0x180158270
Capabilities:
Encode data using base64

Disassembly:
mov eax, 8
call fcn.1801312a0
sub rsp, rax
xor r11d, r11d
mov r9, rcx
test r8d, r8d
jle 0x180158385
mov qword [rsp + 0x10], rbx
inc rdx
mov qword [rsp], rdi
lea rdi, str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_
nop
movzx eax, byte [rdx - 1]
cmp r8d, 3
jl 0x1801582fe
movzx ecx, al
movzx eax, byte [rdx]
shl rcx, 8
or rcx, rax
movzx eax, byte [rdx + 1]
shl rcx, 8
or rcx, rax
mov rax, rcx
shr rax, 0x12
movzx eax, byte [rax + rdi]
mov byte [r9], al
mov rax, rcx
shr rax, 0xc
inc r9
and eax, 0x3f
mov r10, r9
movzx eax, byte [rax + rdi]
mov byte [r9], al
mov rax, rcx
and eax, 0x3f
shr rcx, 6
and ecx, 0x3f
movzx ebx, byte [rax + rdi]
movzx eax, byte [rcx + rdi]
jmp 0x18015834d
movzx ecx, al
shl ecx, 0x10
cmp r8d, 2
jne 0x180158312
movzx eax, byte [rdx]
shl eax, 8
or ecx, eax
mov eax, ecx
lea r10, [r9 + 1]
shr rcx, 0x12
movzx ecx, byte [rcx + rdi]
mov byte [r9], cl
mov ecx, eax
shr rcx, 0xc
mov r9, r10
and ecx, 0x3f
movzx ecx, byte [rcx + rdi]
mov byte [r10], cl
cmp r8d, 1
jne 0x180158340
mov al, 0x3d
jmp 0x18015834b
shr rax, 6
and eax, 0x3f
movzx eax, byte [rax + rdi]
mov bl, 0x3d
lea rcx, [r9 + 2]
mov byte [r10 + 1], al
add r11d, 4
mov byte [rcx], bl
add rdx, 3
lea r9, [rcx + 1]
sub r8d, 3
test r8d, r8d
jg 0x1801582a0
mov rdi, qword [rsp]
mov eax, r11d
mov rbx, qword [rsp + 0x10]
mov byte [r9], 0
add rsp, 8
ret
mov byte [rcx], r11b
mov eax, r11d
add rsp, 8
ret
Function at 0x18015d660
Capabilities:
Check for software breakpoints

Disassembly:
mov eax, 0x38
call fcn.1801312a0
sub rsp, rax
mov r11, rcx
cmp dword [rsp + 0x60], r9d
jne 0x18015d753
movzx r10d, byte [r8]
lea eax, [r10 - 0x6a]
cmp al, 1
ja 0x18015d753
mov qword [rsp + 0x30], rbx
lea rdx, [r8 + 1]
cmp r10b, 0x6b
jne 0x18015d700
lea ebx, [r9 - 3]
xor eax, eax
test ebx, ebx
jle 0x18015d6ba
movzx ecx, byte [rdx]
inc rdx
cmp cl, 0xba
je 0x18015d6ba
cmp cl, 0xbb
jne 0x18015d6ef
inc eax
cmp eax, ebx
jl 0x18015d6a4
sub ebx, eax
test eax, eax
jne 0x18015d704
mov dword [rsp + 0x20], 0x83
lea r9, [0x180368a80]
mov edx, 0x80
lea ecx, [rdx - 0x7c]
lea r8d, [rdx + 0xa]
call fcn.180136e40
mov rbx, qword [rsp + 0x30]
mov eax, 0xffffffff
add rsp, 0x38
ret
mov dword [rsp + 0x20], 0x7b
lea r9, [0x180368a68]
jmp 0x18015d6cf
lea ebx, [r9 - 2]
movsxd rax, ebx
cmp byte [rax + rdx], 0xcc
je 0x18015d73c
mov edx, 0x80
mov dword [rsp + 0x20], 0x8b
lea r9, str..crypto_rsa_rsa_x931.c
lea ecx, [rdx - 0x7c]
lea r8d, [rdx + 0xb]
call fcn.180136e40
mov rbx, qword [rsp + 0x30]
mov eax, 0xffffffff
add rsp, 0x38
ret
mov r8d, ebx
mov rcx, r11
call fcn.1801ad3b0
mov eax, ebx
mov rbx, qword [rsp + 0x30]
add rsp, 0x38
ret
mov edx, 0x80
mov dword [rsp + 0x20], WSACleanup
lea r9, [0x180368a50]
lea ecx, [rdx - 0x7c]
lea r8d, [rdx + 9]
call fcn.180136e40
mov eax, 0xffffffff
add rsp, 0x38
ret

Function at 0x18015e4f0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push r14
mov eax, 0x20
call fcn.1801312a0
sub rsp, rax
mov esi, dword [rdx + 8]
mov r14, rdx
mov rbx, rcx
test esi, esi
jne 0x18015e531
xor edx, edx
call fcn.18012f410
lea eax, [rsi + 1]
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
lea eax, [rsi - 1]
mov qword [rsp + 0x30], rdi
movsxd rdi, eax
xor eax, eax
mov qword [rsp + 0x38], r15
mov r15, qword [rdx]
mov rcx, qword [r15 + rdi*8]
cmp rcx, 1
sete al
sub esi, eax
cmp r14, rbx
je 0x18015e57c
cmp esi, dword [rbx + 0xc]
jg 0x18015e562
mov rax, rbx
jmp 0x18015e56c
mov edx, esi
mov rcx, rbx
call fcn.18012fbb0
test rax, rax
je 0x18015e5e6
mov eax, dword [r14 + 0x10]
mov dword [rbx + 0x10], eax
mov rcx, qword [r15 + rdi*8]
mov rdx, qword [rbx]
mov rax, rcx
xor rax, 1
inc rax
neg rax
shl rax, 0x3f
lea r8, [rdx + rdi*8]
shr rcx, 1
je 0x18015e59c
mov qword [r8], rcx
test rdi, rdi
jle 0x18015e5de
sub r15, rdx
nop dword [rax]
nop dword [rax + rax]
mov rdx, qword [r15 + r8 - 8]
lea r8, [r8 - 8]
mov rcx, rdx
dec rdi
shr rcx, 1
or rcx, rax
mov rax, rdx
xor rax, 1
mov qword [r8], rcx
inc rax
neg rax
shl rax, 0x3f
test rdi, rdi
jg 0x18015e5b0
mov dword [rbx + 8], esi
mov eax, 1
mov rdi, qword [rsp + 0x30]
mov r15, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
Function at 0x180182e10
Capabilities:
Check for time delay via gettickcount

Disassembly:
mov eax, 0x28
call fcn.1801312a0
sub rsp, rax
cmp dword [0x18036e83c], 0
je 0x180182e58
lea rcx, [rsp + 0x38]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
test eax, eax
jne 0x180182e3d
mov dword [0x18036e83c], eax
jmp 0x180182e58
xorps xmm2, xmm2
lea rcx, [rsp + 0x38]
mov edx, 8
call fcn.180144120
cmp dword [0x18036e83c], 0
jne 0x180182e74
call qword [sym.imp.KERNEL32.dll_GetTickCount]
xorps xmm2, xmm2
lea rcx, [rsp + 0x30]
mov edx, 4
mov dword [rsp + 0x30], eax
call fcn.180144120
add rsp, 0x28
ret

Function at 0x18018a120
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
mov eax, 0x20
call fcn.1801312a0
sub rsp, rax
mov r9d, dword [rdx + 8]
mov rsi, rdx
cmp r9d, dword [r8 + 8]
mov rdi, r8
mov rbx, rcx
cmovge rdi, rdx
cmovge rsi, r8
mov edx, dword [rdi + 8]
cmp edx, dword [rcx + 0xc]
jg 0x18018a15e
mov rax, rcx
jmp 0x18018a163
call fcn.18012fbb0
test rax, rax
jne 0x18018a178
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
xor r8d, r8d
cmp dword [rsi + 8], r8d
jle 0x18018a1b5
xor r9d, r9d
nop dword [rax]
nop dword [rax + rax]
mov rax, qword [rsi]
lea r9, [r9 + 8]
mov rcx, qword [rdi]
inc r8d
mov rdx, qword [rcx + r9 - 8]
xor rdx, qword [r9 + rax - 8]
mov rax, qword [rbx]
mov qword [r9 + rax - 8], rdx
cmp r8d, dword [rsi + 8]
jl 0x18018a190
mov eax, dword [rdi + 8]
cmp r8d, eax
jge 0x18018a1ef
movsxd rax, r8d
lea rdx, [rax*8]
nop dword [rax + rax]
mov rax, qword [rdi]
lea rdx, [rdx + 8]
mov rcx, qword [rbx]
inc r8d
mov rax, qword [rdx + rax - 8]
mov qword [rdx + rcx - 8], rax
mov eax, dword [rdi + 8]
cmp r8d, eax
jl 0x18018a1d0
mov dword [rbx + 8], eax
test eax, eax
jle 0x18018a21b
mov rcx, qword [rbx]
sub rcx, 8
movsxd r8, eax
lea r8, [rcx + r8*8]
mov rcx, qword [r8]
lea r8, [r8 - 8]
test rcx, rcx
jne 0x18018a216
dec eax
test eax, eax
jg 0x18018a204
mov dword [rbx + 8], eax
test eax, eax
jne 0x18018a224
mov dword [rbx + 0x10], 0
mov rbx, qword [rsp + 0x30]
mov eax, 1
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x1801a4a00
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
mov eax, 0x20
call fcn.1801312a0
sub rsp, rax
mov rbp, qword [rsp + 0x70]
mov r12, r9
mov r13, qword [rsp + 0x78]
mov r10, rbp
mov rdi, r8
mov rbx, rdx
mov rsi, rcx
cmp r8, 0x10
jb 0x1801a4a98
mov rbp, r8
shr rbp, 4
imul rax, rbp, 0xfffffffffffffff0
add rdi, rax
nop word [rax + rax]
sub r10, rsi
mov r8, rbx
sub r8, rsi
mov rcx, rsi
mov edx, 2
mov rax, qword [r10 + rcx]
xor rax, qword [rcx]
mov qword [r8 + rcx], rax
lea rcx, [rcx + 8]
sub rdx, 1
jne 0x1801a4a61
mov r8, r12
mov rdx, rbx
mov rcx, rbx
call r13
mov r10, rbx
add rsi, 0x10
add rbx, 0x10
sub rbp, 1
jne 0x1801a4a50
mov rbp, qword [rsp + 0x70]
test rdi, rdi
je 0x1801a4bb2
mov qword [rsp + 0x50], r14
mov qword [rsp + 0x58], r15
nop dword [rax + rax]
mov r8, r10
mov r9, rbx
mov r11d, 1
mov r14d, 2
sub r8, rsi
sub r9, rsi
sub r11, rsi
sub r14, rsi
xor eax, eax
mov r15d, 3
sub r15, rsi
nop dword [rax]
cmp rax, rdi
jae 0x1801a4b54
lea rdx, [rax + rsi]
movzx ecx, byte [r8 + rdx]
xor cl, byte [rdx]
mov byte [r9 + rdx], cl
lea rcx, [r11 + rdx]
cmp rcx, rdi
jae 0x1801a4b51
movzx ecx, byte [rsi + rax + 1]
xor cl, byte [rax + r10 + 1]
mov byte [rbx + rax + 1], cl
lea rcx, [r14 + rdx]
cmp rcx, rdi
jae 0x1801a4b4b
movzx ecx, byte [rsi + rax + 2]
xor cl, byte [rax + r10 + 2]
mov byte [rbx + rax + 2], cl
lea rcx, [r15 + rdx]
cmp rcx, rdi
jae 0x1801a4b45
movzx ecx, byte [rsi + rax + 3]
xor cl, byte [rax + r10 + 3]
mov byte [rbx + rax + 3], cl
add rax, 4
cmp rax, 0x10
jb 0x1801a4ae0
jmp 0x1801a4b81
add rax, 3
jmp 0x1801a4b54
add rax, 2
jmp 0x1801a4b54
inc rax
cmp rax, 0x10
jae 0x1801a4b81
sub r10, rbx
lea rcx, [rax + rbx]
mov edx, recvfrom
sub rdx, rax
nop dword [rax]
movzx eax, byte [r10 + rcx]
mov byte [rcx], al
lea rcx, [rcx + 1]
sub rdx, 1
jne 0x1801a4b70
mov r8, r12
mov rdx, rbx
mov rcx, rbx
call r13
mov r10, rbx
cmp rdi, 0x10
jbe 0x1801a4ba8
add rsi, 0x10
add rbx, 0x10
sub rdi, 0x10
jne 0x1801a4ab0
mov r14, qword [rsp + 0x50]
mov r15, qword [rsp + 0x58]
movups xmm0, xmmword [r10]
mov rbx, qword [rsp + 0x60]
movups xmmword [rbp], xmm0
add rsp, 0x20
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x1801a4bd0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov eax, 0x50
call fcn.1801312a0
sub rsp, rax
mov rax, qword [0x180357448]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov r14, qword [rsp + 0xb0]
mov r12, r9
mov r13, qword [rsp + 0xb8]
mov rdi, r8
mov rsi, rdx
mov rbx, rcx
cmp rcx, rdx
je 0x1801a4c69
mov r15, r14
cmp r8, 0x10
jb 0x1801a4c5f
mov rbp, r8
shr rbp, 4
imul rax, rbp, 0xfffffffffffffff0
add rdi, rax
mov r8, r12
mov rdx, rsi
mov rcx, rbx
call r13
mov rax, qword [r15]
xor qword [rsi], rax
mov rax, qword [r15 + 8]
mov r15, rbx
xor qword [rsi + 8], rax
add rbx, 0x10
add rsi, 0x10
sub rbp, 1
jne 0x1801a4c34
movups xmm0, xmmword [r15]
movups xmmword [r14], xmm0
jmp 0x1801a4cc2
cmp rdi, 0x10
jb 0x1801a4cc2
mov rbp, rdi
shr rbp, 4
imul rax, rbp, 0xfffffffffffffff0
add rdi, rax
nop dword [rax]
mov r8, r12
lea rdx, [rsp + 0x38]
mov rcx, rbx
call r13
mov rcx, qword [rbx]
mov rax, qword [r14]
xor rax, qword [rsp + 0x38]
mov qword [rsi], rax
mov rax, qword [r14 + 8]
xor rax, qword [rsp + 0x40]
mov qword [r14], rcx
mov rcx, qword [rbx + 8]
add rbx, 0x10
mov qword [rsi + 8], rax
add rsi, 0x10
mov qword [r14 + 8], rcx
sub rbp, 1
jne 0x1801a4c80
test rdi, rdi
je 0x1801a4e40
lea rcx, [rsp + 0x38]
mov rax, r14
sub rax, rcx
lea r15, [rsp + 0x39]
mov qword [rsp + 0x20], rax
lea rcx, [rsp + 0x38]
mov eax, 1
mov ebp, 3
sub rax, rcx
lea rcx, [rsp + 0x38]
mov qword [rsp + 0x28], rax
mov eax, 2
sub rax, rcx
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x38]
sub rbp, rax
inc rsi
neg r15
nop word [rax + rax]
mov r8, r12
lea rdx, [rsp + 0x38]
mov rcx, rbx
call r13
mov r10, qword [rsp + 0x20]
lea r9, [r15 + rsi]
xor eax, eax
nop dword [rax]
cmp rax, rdi
jae 0x1801a4df4
lea r8, [rsp + 0x38]
add r8, rax
lea rcx, [r8 + rbx]
movzx edx, byte [rcx + r15 + 1]
movzx ecx, byte [r8]
xor cl, byte [r10 + r8]
mov byte [r8 + r9], cl
mov rcx, qword [rsp + 0x28]
add rcx, r8
mov byte [r10 + r8], dl
cmp rcx, rdi
jae 0x1801a4df1
movzx ecx, byte [r8 + 1]
xor cl, byte [r14 + rax + 1]
movzx edx, byte [rax + rbx + 1]
mov byte [rsi + rax], cl
mov rcx, qword [rsp + 0x30]
add rcx, r8
mov byte [r14 + rax + 1], dl
cmp rcx, rdi
jae 0x1801a4deb
movzx ecx, byte [r8 + 2]
xor cl, byte [r14 + rax + 2]
movzx edx, byte [rbx + rax + 2]
mov byte [rsi + rax + 1], cl
lea rcx, [r8 + rbp]
mov byte [r14 + rax + 2], dl
cmp rcx, rdi
jae 0x1801a4de5
movzx edx, byte [rbx + rax + 3]
movzx ecx, byte [r8 + 3]
xor cl, byte [r14 + rax + 3]
mov byte [rsi + rax + 2], cl
mov byte [r14 + rax + 3], dl
add rax, 4
cmp rax, 0x10
jb 0x1801a4d40
jmp 0x1801a4df4
add rax, 3
jmp 0x1801a4df4
add rax, 2
jmp 0x1801a4df4
inc rax
cmp rdi, 0x10
jbe 0x1801a4e0e
add rbx, 0x10
add rsi, 0x10
sub rdi, 0x10
jne 0x1801a4d20
jmp 0x1801a4e40
cmp rax, 0x10
jae 0x1801a4e40
sub rbx, r14
lea rcx, [r14 + rax]
mov edx, recvfrom
sub rdx, rax
nop dword [rax]
nop word [rax + rax]
movzx eax, byte [rbx + rcx]
mov byte [rcx], al
lea rcx, [rcx + 1]
sub rdx, 1
jne 0x1801a4e30
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.180137fb0
mov rbx, qword [rsp + 0xa0]
add rsp, 0x50
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret