joyce8/EMBER2024-capa huggingface dataset:
Function at 0x18001a710
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x40
mov rdi, qword [0x180365770]
movzx esi, r9b
mov r15d, dword [rsp + 0x90]
mov r14d, edx
movaps xmmword [rsp + 0x30], xmm6
mov rbx, qword [rdi + 0x3ed8]
mov eax, dword [rbx + 0x14]
movss xmm3, dword [rbx + 0x250]
and eax, 4
movss xmm4, dword [rbx + 0x254]
or eax, 0x1000103
or r15d, eax
cmp qword [rbx + 0x1a8], 0
jne 0x18001a77a
cmp qword [rdi + 0x4b30], 0
je 0x18001a782
movss xmm3, dword [rbx + 0x220]
cvttss2si eax, dword [r8]
mov edx, 2
subss xmm3, dword [rbx + 0x100]
subss xmm4, dword [rbx + 0x104]
movss xmm2, dword [0x18031f720]
xorps xmm5, xmm5
movd xmm1, eax
cvttss2si eax, dword [r8 + 4]
mov r8d, 1
cvtdq2ps xmm1, xmm1
movd xmm0, eax
xor eax, eax
ucomiss xmm1, xmm5
cvtdq2ps xmm0, xmm0
cmove eax, r8d
xor r12d, r12d
ucomiss xmm0, xmm5
cmove r12d, edx
or r12d, eax
comiss xmm1, xmm5
ja 0x18001a7e8
addss xmm1, xmm3
comiss xmm1, xmm2
jae 0x18001a7e8
movaps xmm1, xmm2
comiss xmm0, xmm5
ja 0x18001a7f9
addss xmm0, xmm4
comiss xmm0, xmm2
jae 0x18001a7f9
movaps xmm0, xmm2
or dword [rdi + 0x47b0], edx
xor edx, edx
movss dword [rdi + 0x47d0], xmm1
movss dword [rdi + 0x47d4], xmm0
mov dword [rdi + 0x47b8], r8d
mov r9, qword [rbx + 8]
test rcx, rcx
je 0x18001a83e
mov dword [rsp + 0x28], r14d
lea r8, str._s__s__08X
mov qword [rsp + 0x20], rcx
lea rcx, [rsp + 0x70]
call fcn.180013970
jmp 0x18001a854
lea r8, str._s__08X
mov dword [rsp + 0x20], r14d
lea rcx, [rsp + 0x70]
call fcn.180013970
movss xmm6, dword [rdi + 0x37f8]
test sil, sil
jne 0x18001a86b
mov dword [rdi + 0x37f8], 0
mov rcx, qword [rsp + 0x70]
mov r8d, r15d
xor edx, edx
call fcn.18001d5e0
mov rsi, qword [rdi + 0x3ed8]
movzx ebp, al
movss dword [rdi + 0x37f8], xmm6
cmp word [rsi + 0xc2], 1
mov dword [rsi + 0x80], r14d
mov byte [rsi + 0xd2], r12b
jne 0x18001a8b1
movsd xmm0, qword [rsi + 0x20]
movsd qword [rbx + 0x100], xmm0
mov r9d, r14d
lea rdx, [0x1802f8b31]
not r9d
lea r10, [0x1802f1e60]
mov ebx, r9d
mov r8b, 0x23
nop dword [rax + rax]
cmp r8b, 0x23
jne 0x18001a8e3
cmp byte [rdx], r8b
jne 0x18001a8e3
cmp byte [rdx + 1], r8b
cmove ebx, r9d
movzx ecx, bl
movzx eax, r8b
movzx r8d, byte [rdx]
xor rcx, rax
shr ebx, 8
inc rdx
xor ebx, dword [r10 + rcx*4]
test r8b, r8b
jne 0x18001a8d0
not ebx
cmp dword [rdi + 0x3f38], ebx
jne 0x18001a913
xor edx, edx
xor ecx, ecx
call fcn.180017120
cmp dword [rdi + 0x48c8], r14d
jne 0x18001a960
bt r15d, 0x17
jb 0x18001a960
cmp word [rsi + 0x15c], 0
jne 0x18001a936
cmp byte [rsi + 0x162], 0
je 0x18001a960
xor edx, edx
mov rcx, rsi
call fcn.18001fae0
xor edx, edx
mov rcx, rsi
call fcn.180025bf0
mov rdx, rsi
mov ecx, ebx
call fcn.180017120
mov eax, dword [rdi + 0x48ec]
mov dword [rdi + 0x3f60], eax
mov rbx, qword [rsp + 0x78]
movzx eax, bpl
mov rbp, qword [rsp + 0x80]
movaps xmm6, xmmword [rsp + 0x30]
add rsp, 0x40
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret
Function at 0x180020330
Capabilities:
Hash data with crc32

Disassembly:
sub rsp, 0x28
mov rax, rcx
mov r10d, 0xffffffff
mov r11, rdx
mov ecx, r10d
movzx r9d, byte [rax]
lea r8, [rax + 1]
test r9b, r9b
je 0x180020394
mov qword [rsp + 0x20], rbx
lea rbx, [0x1802f1e60]
nop dword [rax]
cmp r9b, 0x23
jne 0x180020373
cmp byte [r8], r9b
jne 0x180020373
cmp byte [r8 + 1], r9b
cmove ecx, r10d
movzx edx, cl
movzx eax, r9b
movzx r9d, byte [r8]
xor rdx, rax
shr ecx, 8
inc r8
xor ecx, dword [rbx + rdx*4]
test r9b, r9b
jne 0x180020360
mov rbx, qword [rsp + 0x20]
not ecx
call fcn.18001ae20
test rax, rax
je 0x1800203b2
xor r8d, r8d
mov rdx, r11
mov rcx, rax
add rsp, 0x28
jmp fcn.1800201d0
add rsp, 0x28
ret

Function at 0x1800204b0
Capabilities:
Hash data with crc32

Disassembly:
sub rsp, 0x28
mov rax, rcx
mov r10d, 0xffffffff
mov r11, rdx
mov ecx, r10d
movzx r9d, byte [rax]
lea r8, [rax + 1]
test r9b, r9b
je 0x180020514
mov qword [rsp + 0x20], rbx
lea rbx, [0x1802f1e60]
nop dword [rax]
cmp r9b, 0x23
jne 0x1800204f3
cmp byte [r8], r9b
jne 0x1800204f3
cmp byte [r8 + 1], r9b
cmove ecx, r10d
movzx edx, cl
movzx eax, r9b
movzx r9d, byte [r8]
xor rdx, rax
shr ecx, 8
inc r8
xor ecx, dword [rbx + rdx*4]
test r9b, r9b
jne 0x1800204e0
mov rbx, qword [rsp + 0x20]
not ecx
call fcn.18001ae20
test rax, rax
je 0x180020532
xor r8d, r8d
mov rdx, r11
mov rcx, rax
add rsp, 0x28
jmp fcn.1800203c0
add rsp, 0x28
ret
Function at 0x180023ee0
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
mov rbx, qword [0x180365770]
mov edi, ecx
cmp byte [rbx + 0x4a79], 0
jne 0x180023f32
cmp byte [rbx + 0x4a7a], 0
jne 0x180023f32
movsx r9d, word [rbx + 0x5bb2]
lea r8, str.Tooltip__02d
mov edx, 0x10
lea rcx, [rsp + 0x20]
call fcn.1800138f0
test dil, 2
je 0x18002405f
jmp 0x180023fbb
movss xmm1, dword [rbx + 0x3894]
lea r8, str.Tooltip__02d
movsx r9d, word [rbx + 0x5bb2]
lea rcx, [rsp + 0x20]
movaps xmm0, xmm1
xor eax, eax
mulss xmm0, dword [0x18031f768]
mulss xmm1, dword [0x18031f754]
lea edx, [rax + 0x10]
addss xmm0, dword [rbx + 0xe00]
addss xmm1, dword [rbx + 0xe04]
mov qword [rbx + 0x47c8], rax
mov dword [rbx + 0x47b4], 1
movss dword [rbx + 0x47c0], xmm0
movss dword [rbx + 0x47c4], xmm1
movss xmm0, dword [rbx + 0x38f0]
mulss xmm0, dword [0x18031f618]
or dword [rbx + 0x47b0], 0x41
movss dword [rbx + 0x4810], xmm0
call fcn.1800138f0
movzx r9d, byte [rsp + 0x20]
lea r8, [rsp + 0x21]
mov r10d, 0xffffffff
mov ecx, r10d
test r9b, r9b
je 0x180024010
lea r11, [0x1802f1e60]
nop dword [rax + rax]
cmp r9b, 0x23
jne 0x180023ff3
cmp byte [r8], r9b
jne 0x180023ff3
cmp byte [r8 + 1], r9b
cmove ecx, r10d
movzx edx, cl
movzx eax, r9b
movzx r9d, byte [r8]
xor rdx, rax
shr ecx, 8
inc r8
xor ecx, dword [r11 + rdx*4]
test r9b, r9b
jne 0x180023fe0
not ecx
call fcn.18001ae20
test rax, rax
je 0x18002405f
cmp byte [rax + 0xb6], 0
je 0x18002405f
mov byte [rax + 0xbb], 1
lea r8, str.Tooltip__02d
mov byte [rax + 0xbd], 1
lea rcx, [rsp + 0x20]
mov byte [rax + 0xd8], 1
mov edx, 0x10
inc word [rbx + 0x5bb2]
movsx r9d, word [rbx + 0x5bb2]
call fcn.1800138f0
xor edx, edx
lea rcx, [rsp + 0x20]
mov r8d, 0x20c0347
call fcn.18001d5e0
mov rbx, qword [rsp + 0x40]
mov al, 1
add rsp, 0x30
pop rdi
ret
Function at 0x180028c20
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x20
cmp qword [rcx + 0x5ca0], 0
lea rbx, [rcx + 0x5ca8]
mov rsi, r8
mov rbp, rdx
mov rdi, rcx
je 0x180028cc7
mov r9d, dword [rbx + 4]
mov qword [rsp + 0x30], r14
xor r14d, r14d
test r9d, r9d
jns 0x180028c7a
mov eax, r9d
mov rcx, rbx
cdq
sub eax, edx
mov edx, r14d
sar eax, 1
add eax, r9d
test eax, eax
cmovg edx, eax
call fcn.18000fc00
mov r8, rsi
mov dword [rbx], r14d
mov rdx, rbp
mov rcx, rbx
call fcn.1800146f0
mov eax, dword [rbx]
mov edx, 1
mov r9, qword [rdi + 0x5ca0]
test eax, eax
lea ecx, [rax - 1]
mov rax, qword [rdi + 0x5cb0]
cmove ecx, r14d
test rax, rax
movsxd r8, ecx
lea rcx, [0x180365584]
cmovne rcx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
mov r14, qword [rsp + 0x30]
jmp 0x180028ccf
mov rcx, rbx
call fcn.1800146f0
mov rbx, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret

Function at 0x180029150
Capabilities:
Hash data with crc32

Disassembly:
sub rsp, 8
movzx r9d, byte [rcx]
lea r8, [rcx + 1]
mov r10, qword [0x180365770]
mov r11d, 0xffffffff
mov eax, r11d
test r9b, r9b
je 0x1800291b3
mov qword [rsp], rbx
lea rbx, [0x1802f1e60]
nop dword [rax]
cmp r9b, 0x23
jne 0x180029193
cmp byte [r8], r9b
jne 0x180029193
cmp byte [r8 + 1], r9b
cmove eax, r11d
movzx edx, al
movzx ecx, r9b
movzx r9d, byte [r8]
xor rdx, rcx
shr eax, 8
inc r8
xor eax, dword [rbx + rdx*4]
test r9b, r9b
jne 0x180029180
mov rbx, qword [rsp]
movsxd rcx, dword [r10 + 0x5c10]
xor r8d, r8d
not eax
test ecx, ecx
jle 0x1800291e7
mov r10, qword [r10 + 0x5c18]
mov r9, rcx
mov edx, r8d
lea rcx, [r10 + 8]
cmp dword [rcx], eax
je 0x1800291ee
inc r8d
inc rdx
add rcx, 0x48
cmp rdx, r9
jl 0x1800291d4
xor eax, eax
add rsp, 8
ret
movsxd rax, r8d
lea rcx, [rax + rax*8]
lea rax, [r10 + rcx*8]
add rsp, 8
ret

Function at 0x180029470
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x20
mov rax, qword [0x180365770]
mov rbx, rcx
xor ecx, ecx
mov dword [rax + 0x5bfc], ecx
test rbx, rbx
je 0x1800294df
mov qword [rsp + 0x30], rcx
lea rcx, [rsp + 0x30]
mov qword [rsp + 0x38], rdi
call fcn.1800294f0
lea rdx, [0x1802f9644]
mov rcx, rbx
mov rdi, rax
call fcn.180013b40
mov rbx, rax
test rax, rax
je 0x1800294da
mov r8, qword [rsp + 0x30]
mov r9, rax
mov edx, 1
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov rdi, qword [rsp + 0x38]
add rsp, 0x20
pop rbx
ret
Function at 0x180047f80
Capabilities:
Execute shellcode via indirect call

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
mov rcx, qword [rcx]
test rcx, rcx
je 0x1800480ce
mov rax, qword [rbx + 0x28]
cmp rax, qword [rbx + 0x20]
jne 0x180047fc8
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rdx, str.WriteExeProtected:NewBytes_Zero
call fcn.18000b990
lea rdx, [0x18000bb70]
mov rcx, rax
add rsp, 0x20
pop rbx
jmp qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x40], rdi
test edx, edx
jne 0x180048044
mov rax, qword [rbx + 8]
cmp rax, qword [rbx + 0x10]
je 0x180047fe4
mov qword [rbx + 0x10], rax
mov rax, qword [rbx + 0x28]
xor edi, edi
cmp rax, qword [rbx + 0x20]
je 0x1800480c4
mov rcx, qword [rbx]
mov edx, edi
call fcn.180134850
mov rdx, qword [rbx + 0x10]
mov byte [rsp + 0x30], al
cmp rdx, qword [rbx + 0x18]
je 0x180048014
mov byte [rdx], al
inc qword [rbx + 0x10]
jmp 0x180048022
lea r8, [rsp + 0x30]
lea rcx, [rbx + 8]
call fcn.18005ea70
mov rcx, qword [rbx + 0x28]
inc edi
sub rcx, qword [rbx + 0x20]
movsxd rax, edi
cmp rax, rcx
jb 0x180047ff4
mov rsi, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x40]
add rsp, 0x20
pop rbx
ret
cmp edx, 1
jne 0x1800480c4
mov rdx, qword [rbx + 0x10]
lea r9, [rsp + 0x30]
sub rdx, qword [rbx + 8]
xor edi, edi
mov dword [rsp + 0x30], edi
lea r8d, [rdi + 0x40]
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov r10, qword [rbx + 0x10]
mov rdx, qword [rbx + 8]
cmp r10, rdx
je 0x1800480ab
mov esi, edi
nop word [rax + rax]
movzx r8d, byte [rdx + rsi]
mov edx, edi
mov rcx, qword [rbx]
call fcn.180134b10
mov r10, qword [rbx + 0x10]
lea rsi, [rsi + 1]
mov rdx, qword [rbx + 8]
inc edi
mov rcx, r10
movsxd rax, edi
sub rcx, rdx
cmp rax, rcx
jb 0x180048080
mov r8d, dword [rsp + 0x30]
lea r9, [rsp + 0x30]
mov rcx, qword [rbx]
sub r10, rdx
mov rdx, r10
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov rsi, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x40]
add rsp, 0x20
pop rbx
ret
Function at 0x18005c6c0
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x40
mov rbx, rdx
mov rdi, rcx
xor ebp, ebp
mov dword [rsp + 0x30], ebp
lea ecx, [rbp + 8]
call fcn.180298d00
mov qword [rax], rbx
mov qword [rsp + 0x50], rax
mov ebx, 1
mov dword [rsp + 0x30], ebx
lea rsi, [rdi + 8]
mov qword [rsp + 0x28], rsi
mov dword [rsp + 0x20], ebp
mov r9, rax
lea r8, [0x18005f360]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rdi], rax
test rax, rax
je 0x18005c746
mov qword [rsp + 0x50], rbp
and ebx, 0xfffffffe
mov dword [rsp + 0x30], ebx
mov rax, rdi
mov rbx, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x68]
add rsp, 0x40
pop rdi
ret
mov dword [rsi], ebp
mov ecx, 6
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
int3
Function at 0x1800b1c80
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rdi
sub rsp, 0x20
mov eax, 1
mov qword [rsp + 0x38], rsi
mov r11, rcx
mov rdi, rdx
movzx ecx, byte [rdx + 0xb]
shl eax, cl
cmp byte [rdx + 0xa], 0
cdqe
lea r8, [rax + rax*2]
mov rax, qword [rdx + 0x18]
lea rsi, [rax + r8*8]
jge 0x1800b1ce0
mov ecx, dword [rdx + 0xc]
lea eax, [rcx - 1]
test ecx, eax
je 0x1800b1ce0
mov eax, ecx
shr eax, 1
or ecx, eax
mov eax, ecx
shr eax, 2
or ecx, eax
mov eax, ecx
shr eax, 4
or ecx, eax
mov eax, ecx
shr eax, 8
or ecx, eax
mov eax, ecx
shr eax, 0x10
or eax, ecx
inc eax
jmp 0x1800b1ce3
mov eax, dword [rdx + 0xc]
test eax, eax
je 0x1800b1d1e
mov qword [rsp + 0x30], rbx
xor r10d, r10d
mov ebx, eax
mov rax, qword [rdi + 0x10]
test byte [r10 + rax + 8], 0x40
je 0x1800b1d0f
mov rdx, qword [r10 + rax]
test byte [rdx + 9], 0x18
je 0x1800b1d0f
mov rcx, r11
call fcn.1800b1430
add r10, 0x10
sub rbx, 1
jne 0x1800b1cf1
mov rbx, qword [rsp + 0x30]
mov r10, qword [rdi + 0x18]
cmp r10, rsi
jae 0x1800b1d80
nop word [rax + rax]
movzx eax, byte [r10 + 9]
and al, 0x40
test byte [r10 + 8], 0xf
jne 0x1800b1d49
test al, al
je 0x1800b1d77
mov byte [r10 + 9], 0xb
jmp 0x1800b1d77
test al, al
je 0x1800b1d5f
mov rdx, qword [r10 + 0x10]
test byte [rdx + 9], 0x18
je 0x1800b1d5f
mov rcx, r11
call fcn.1800b1430
test byte [r10 + 8], 0x40
je 0x1800b1d77
mov rdx, qword [r10]
test byte [rdx + 9], 0x18
je 0x1800b1d77
mov rcx, r11
call fcn.1800b1430
add r10, 0x18
cmp r10, rsi
jb 0x1800b1d30
movzx eax, byte [rdi + 9]
mov rsi, qword [rsp + 0x38]
movzx ecx, al
and cl, 7
cmp cl, 5
jne 0x1800b1db7
mov rcx, rdi
call fcn.1800b12e0
mov rcx, qword [r11 + 0x90]
mov qword [rax], rcx
mov qword [r11 + 0x90], rdi
and byte [rdi + 9], 0xc7
add rsp, 0x20
pop rdi
ret
cmp cl, 6
jne 0x1800b1dc1
xor al, 2
mov byte [rdi + 9], al
add rsp, 0x20
pop rdi
ret
Function at 0x1800b3fd0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rdx, r8
je 0x1800b40df
push rbx
sub rsp, 0x20
mov qword [rsp + 0x30], rdi
mov r11, r8
lea rdi, [0x180000000]
mov r10, rdx
mov rbx, rcx
movzx edx, byte [r10 + 9]
movzx eax, dl
and al, 7
cmp al, 3
jne case.0x1800b403a.8
xor dl, 7
mov byte [r10 + 9], dl
test dl, 0x20
je case.0x1800b403a.8
movzx eax, byte [r10 + 8]
add eax, 0xfffffffc
cmp eax, 0x22
ja case.0x1800b403a.8
cdqe
movzx eax, byte [rdi + rax + 0xb40f4]
mov ecx, dword [rdi + rax*4 + 0xb40e0]
add rcx, rdi
jmp rcx
and dl, 0xe7
or dl, 0x20
mov byte [r10 + 9], dl
jmp case.0x1800b403a.8
mov rcx, qword [r10 + 0x10]
lea rax, [r10 + 0x18]
cmp rcx, rax
je 0x1800b405d
and dl, 0xc7
jmp 0x1800b4063
and dl, 0xe7
or dl, 0x20
mov byte [r10 + 9], dl
test byte [rcx + 8], 0x40
je case.0x1800b403a.8
mov rdx, qword [rcx]
test byte [rdx + 9], 0x18
je case.0x1800b403a.8
mov rcx, rbx
call fcn.1800b1430
jmp case.0x1800b403a.8
cmp word [r10 + 0xa], 0
jne case.0x1800b403a.5
mov rdx, qword [r10 + 0x18]
test rdx, rdx
je 0x1800b409f
test byte [rdx + 9], 0x18
je 0x1800b409f
mov rcx, rbx
call fcn.1800b1430
and byte [r10 + 9], 0xe7
or byte [r10 + 9], 0x20
jmp case.0x1800b403a.8
mov rcx, r10
call fcn.1800b12e0
mov rcx, qword [rbx + 0x88]
mov qword [rax], rcx
mov qword [rbx + 0x88], r10
and byte [r10 + 9], 0xc7
mov r10, qword [r10]
cmp r10, r11
jne 0x1800b3ff3
mov rdi, qword [rsp + 0x30]
add rsp, 0x20
pop rbx
ret
Function at 0x1800be370
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 0x20], rbp
mov qword [rsp + 0x10], rdx
push rsi
push rdi
push r13
push r14
push r15
sub rsp, 0x20
mov qword [rsp + 0x50], rbx
mov r13, rdx
mov rbx, rcx
call qword [sym.imp.api_ms_win_crt_locale_l1_1_0.dll_localeconv]
xor esi, esi
lea r11, [0x1802f67d0]
xorps xmm1, xmm1
mov r10d, esi
mov r14d, esi
mov r9d, esi
mov r8, qword [rax]
mov edi, esi
movsx r15d, byte [r8]
mov qword [r13], rbx
movzx eax, byte [rbx]
test byte [rax + r11 + 1], 8
je 0x1800be3df
nop dword [rax]
nop dword [rax + rax]
movzx eax, byte [rbx + 1]
inc rbx
test byte [rax + r11 + 1], 8
jne 0x1800be3d0
mov qword [rsp + 0x60], r12
lea rdx, [rbx + 1]
mov ebp, 1
cmp al, 0x2d
jne 0x1800be3f6
mov r12d, ebp
jmp 0x1800be3ff
cmp al, 0x2b
mov r12d, esi
cmovne rdx, rbx
cmp byte [rdx], 0x30
mov rbx, qword [rsp + 0x50]
jne 0x1800be549
movzx eax, byte [rdx + 1]
sub al, 0x58
test al, 0xdf
jne 0x1800be549
movsd xmm2, qword [0x18031f6c0]
lea r13, [0x1802f67d0]
add rdx, 2
nop
movzx r8d, byte [rdx]
mov r11, rdx
movsx rcx, r8b
cmp ecx, r15d
jne 0x1800be44b
test edi, edi
jne 0x1800be4a0
mov edi, ebp
inc rdx
jmp 0x1800be430
test byte [r8 + r13 + 1], 0x10
je 0x1800be4a0
test r10d, r10d
jne 0x1800be463
cmp r8b, 0x30
jne 0x1800be463
inc r14d
jmp 0x1800be494
inc r10d
cmp r10d, 0x1e
jg 0x1800be491
test byte [rcx + r13 + 1], 2
je 0x1800be479
add ecx, 0xffffffd0
jmp 0x1800be47f
or ecx, 0x20
sub ecx, 0x57
movd xmm0, ecx
cvtdq2pd xmm0, xmm0
mulsd xmm1, xmm2
addsd xmm1, xmm0
jmp 0x1800be494
inc r9d
test edi, edi
je 0x1800be49b
dec r9d
inc rdx
jmp 0x1800be430
mov r13, qword [rsp + 0x58]
lea eax, [r14 + r10]
test eax, eax
je 0x1800be549
mov qword [r13], rdx
lea r9d, [r9*4]
movzx eax, byte [rdx]
sub al, 0x50
test al, 0xdf
jne 0x1800be52f
movzx eax, byte [rdx + 1]
inc rdx
cmp al, 0x2d
jne 0x1800be4d7
lea rdx, [r11 + 2]
jmp 0x1800be4e1
cmp al, 0x2b
jne 0x1800be4df
lea rdx, [r11 + 2]
mov ebp, esi
movzx r8d, byte [rdx]
lea r11, [0x1802f67d0]
test byte [r8 + r11 + 1], 2
je 0x1800be549
nop dword [rax]
nop dword [rax + rax]
movsx eax, r8b
lea esi, [rsi + rsi*4]
inc rdx
lea esi, [rsi - 0x18]
lea esi, [rax + rsi*2]
movzx eax, byte [rdx]
movzx r8d, al
test byte [rax + r11 + 1], 2
jne 0x1800be500
mov eax, esi
mov qword [r13], rdx
neg eax
test ebp, ebp
cmove eax, esi
add r9d, eax
test r12d, r12d
je 0x1800be53b
xorps xmm1, xmmword [0x1803210d0]
mov edx, r9d
movaps xmm0, xmm1
call qword [sym.imp.api_ms_win_crt_math_l1_1_0.dll_ldexp]
jmp 0x1800be54c
xorps xmm0, xmm0
mov r12, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x68]
add rsp, 0x20
pop r15
pop r14
pop r13
pop rdi
pop rsi
ret
Function at 0x1800be6c0
Capabilities:
Check http status code

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
push rsi
push rdi
push r14
sub rsp, 0xf0
mov r14, rdx
mov rbx, rcx
lea rdx, [rsp + 0x120]
call fcn.1800be570
mov r9, rax
test rax, rax
je 0x1800be70d
mov r8, qword [rsp + 0x120]
mov al, 3
sub r9, rbx
mov qword [r14], r8
mov byte [r14 + 8], al
lea rax, [r9 + 1]
jmp 0x1800be89c
lea rdx, str..xXnN
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strpbrk]
test rax, rax
je 0x1800be748
movzx edi, byte [rax]
or edi, 0x20
cmp edi, 0x6e
je 0x1800be89a
cmp edi, 0x78
jne 0x1800be74a
lea rdx, [rsp + 0x120]
mov rcx, rbx
call fcn.1800be370
jmp 0x1800be75b
xor edi, edi
lea rdx, [rsp + 0x120]
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll_strtod]
mov rax, qword [rsp + 0x120]
lea rbp, [0x1802f67d0]
cmp rax, rbx
je 0x1800be7a7
movzx ecx, byte [rax]
test byte [rcx + rbp + 1], 8
je 0x1800be795
nop dword [rax]
inc rax
mov qword [rsp + 0x120], rax
movzx ecx, byte [rax]
test byte [rcx + rbp + 1], 8
jne 0x1800be780
xor r9d, r9d
test cl, cl
cmove r9, rax
test r9, r9
jne 0x1800be886
mov edx, 0x2e
mov rcx, rbx
call qword [sym.imp.VCRUNTIME140.dll_strchr]
mov rsi, rax
test rax, rax
je 0x1800be89a
mov rcx, 0xffffffffffffffff
nop dword [rax + rax]
inc rcx
cmp byte [rbx + rcx], 0
jne 0x1800be7d0
cmp rcx, 0xc8
ja 0x1800be89a
lea rdx, [rsp + 0x20]
mov rcx, rbx
sub rdx, rbx
movzx eax, byte [rcx]
mov byte [rdx + rcx], al
lea rcx, [rcx + 1]
test al, al
jne 0x1800be7f1
call qword [sym.imp.api_ms_win_crt_locale_l1_1_0.dll_localeconv]
sub rsi, rbx
lea rdx, [rsp + 0x120]
lea rcx, [rsp + 0x20]
mov rax, qword [rax]
movzx eax, byte [rax]
mov byte [rsp + rsi + 0x20], al
cmp edi, 0x78
jne 0x1800be82b
call fcn.1800be370
jmp 0x1800be831
call qword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll_strtod]
mov rax, qword [rsp + 0x120]
lea rcx, [rsp + 0x20]
cmp rax, rcx
je 0x1800be89a
movzx ecx, byte [rax]
test byte [rcx + rbp + 1], 8
je 0x1800be865
nop dword [rax]
inc rax
mov qword [rsp + 0x120], rax
movzx ecx, byte [rax]
test byte [rcx + rbp + 1], 8
jne 0x1800be850
xor r9d, r9d
test cl, cl
cmove r9, rax
test r9, r9
je 0x1800be89a
lea rcx, [rsp + 0x20]
mov rax, rbx
sub rax, rcx
add r9, rax
test r9, r9
je 0x1800be89a
mov al, 0x13
movsd qword [r14], xmm0
sub r9, rbx
mov byte [r14 + 8], al
lea rax, [r9 + 1]
jmp 0x1800be89c
xor eax, eax
lea r11, [rsp + 0xf0]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret
Function at 0x1800c8b90
Capabilities:
Encode data using xor

Disassembly:
push rbp
push rsi
sub rsp, 0x48
mov rsi, rdx
mov rbp, rcx
xor edx, edx
mov r9d, 0x658
mov rcx, rsi
lea r8d, [rdx + 8]
call rbp
test rax, rax
jne 0x1800c8bba
add rsp, 0x48
pop rsi
pop rbp
ret
mov qword [rsp + 0x68], rbx
xor ecx, ecx
lea rbx, [rax + 0xd0]
mov word [rax + 0x10], 0x808
mov byte [rbx + 0x64], 8
mov qword [rax + 0x20], rbx
mov qword [rsp + 0x70], rdi
lea rdi, [rax + 8]
mov qword [rdi + 0x50], rdi
lea rax, [rsp + 0x60]
mov qword [rsp + 0x28], rax
lea rax, [fcn.1800c8b90]
mov qword [rbx + 8], rsi
mov qword [rsp + 0x40], r14
xor r14d, r14d
mov dword [rdi + 0xb0], r14d
add dword [rdi + 0xb0], 0x10000
mov qword [rdi + 0x30], r14
mov qword [rdi + 0x20], r14
lea esi, [r14 + 0x18]
mov word [rdi + 0xc], r14w
mov qword [rdi + 0x58], r14
mov qword [rdi + 0xa0], r14
mov qword [rsp + 0x30], rax
mov dword [rdi + 0xc0], r14d
mov qword [rdi + 0xb8], r14
mov word [rdi + 0xa], pe_nt_image_headers64
mov qword [rdi + 0x38], r14
mov qword [rdi + 0xa8], r14
mov dword [rdi + 0xb4], r14d
mov qword [rbx + 0x70], rdi
mov qword [rdi], r14
mov qword [rbx], rbp
mov qword [rbx + 0x578], r14
mov qword [rbx + 0x580], r14
mov qword [rbx + 0x108], rdi
mov qword [rsp + 0x20], rdi
call qword [sym.imp.api_ms_win_crt_time_l1_1_0.dll__time64]
xor eax, esi
nop dword [rax]
nop dword [rax + rax]
movzx edx, byte [rsp + rsi + 0x1f]
mov ecx, eax
shl ecx, 5
add edx, ecx
mov ecx, eax
shr ecx, 2
add edx, ecx
xor eax, edx
sub rsi, 1
jne 0x1800c8c90
mov dword [rbx + 0x60], eax
lea rdx, [0x1800c87b0]
mov dword [rbx + 0x6a], 0x19320002
xor r8d, r8d
mov qword [rbx + 0x38], r14
mov rcx, rdi
mov qword [rbx + 0x30], r14
mov byte [rbx + 0x48], r14b
mov qword [rbx + 0x100], r14
mov dword [rbx + 0x65], 0x14000008
mov qword [rbx + 0xb8], r14
mov qword [rbx + 0xb0], r14
mov qword [rbx + 0x80], r14
mov qword [rbx + 0xd0], r14
mov qword [rbx + 0xc8], r14
mov qword [rbx + 0xc0], r14
mov qword [rbx + 0xd8], r14
mov qword [rbx + 0xf0], r14
mov qword [rbx + 0xe8], r14
mov qword [rbx + 0xe0], r14
mov qword [rbx + 0x78], r14
mov qword [rbx + 0x90], r14
mov qword [rbx + 0x88], r14
mov qword [rbx + 0xa8], r14
mov qword [rbx + 0xa0], r14
mov qword [rbx + 0x98], r14
mov qword [rbx + 0xf8], r14
mov qword [rbx + 0x10], 0x658
mov qword [rbx + 0x18], r14
mov qword [rbx + 0x28], r14
mov qword [rbx + 0x50], r14
mov byte [rbx + 0x58], 3
mov byte [rbx + 0x6e], 0xd
mov byte [rbx + 0x69], 0x19
mov qword [rbx + 0x1e0], r14
mov qword [rbx + 0x1e8], r14
mov qword [rbx + 0x1f0], r14
mov qword [rbx + 0x1f8], r14
mov qword [rbx + 0x200], r14
mov qword [rbx + 0x208], r14
mov qword [rbx + 0x210], r14
mov qword [rbx + 0x218], r14
mov qword [rbx + 0x220], r14
call fcn.1800ae9a0
mov rbx, qword [rsp + 0x68]
test eax, eax
je 0x1800c8dc8
mov rcx, rdi
call fcn.1800c8a40
mov rdi, r14
mov r14, qword [rsp + 0x40]
mov rax, rdi
mov rdi, qword [rsp + 0x70]
add rsp, 0x48
pop rsi
pop rbp
ret