joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180085860
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x80
mov rax, qword [0x1802dd180]
xor rax, rsp
mov qword [rsp + 0x78], rax
mov esi, edx
mov rdi, rcx
cmp edx, 0xffffffff
jne 0x18008588d
xor eax, eax
jmp 0x1800859f6
mov qword [rsp + 0xa0], rbx
call qword [sym.imp.MSVCP140.dll_protected:_char____ptr64___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::pptr_void_const___ptr64]
test rax, rax
je 0x1800858cd
mov rcx, rdi
call qword [sym.imp.MSVCP140.dll_protected:_char____ptr64___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::epptr_void_const___ptr64]
mov rcx, rdi
mov rbx, rax
call qword [sym.imp.MSVCP140.dll_protected:_char____ptr64___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::pptr_void_const___ptr64]
cmp rax, rbx
jae 0x1800858cd
mov rcx, rdi
call qword [sym.imp.MSVCP140.dll_protected:_char____ptr64___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::_Pninc_void____ptr64]
mov byte [rax], sil
mov eax, esi
jmp 0x1800859ee
cmp qword [rdi + 0x80], 0
je 0x1800859e9
mov rcx, rdi
call qword [sym.imp.MSVCP140.dll_protected:_char____ptr64___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::eback_void_const___ptr64]
lea rcx, [rdi + 0x70]
cmp rax, rcx
jne 0x180085907
mov rdx, qword [rdi + 0x88]
mov rcx, rdi
mov r9, qword [rdi + 0x90]
mov r8, rdx
call qword [sym.imp.MSVCP140.dll_protected:_void___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::setg_char____ptr64__char____ptr64__char____ptr64____ptr64]
mov rcx, qword [rdi + 0x68]
test rcx, rcx
jne 0x180085932
mov rdx, qword [rdi + 0x80]
movsx ecx, sil
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
mov ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, esi
mov eax, ecx
jmp 0x1800859ee
lea rax, [rsp + 0x40]
mov byte [rsp + 0x50], sil
mov qword [rsp + 0x38], rax
lea rdx, [rdi + 0x74]
lea rax, [rsp + 0x78]
mov qword [rsp + 0x30], rax
lea r9, [rsp + 0x51]
lea rax, [rsp + 0x58]
mov qword [rsp + 0x28], rax
lea r8, [rsp + 0x50]
lea rax, [rsp + 0x48]
mov qword [rsp + 0x20], rax
call qword [sym.imp.MSVCP140.dll_public:_int___cdecl_std::codecvt_char__char__struct__Mbstatet_::out_struct__Mbstatet____ptr64__char_const____ptr64__char_const____ptr64__char_const____ptr64____ptr64__char____ptr64__char____ptr64__char____ptr64____ptr64_const___ptr64]
test eax, eax
je 0x1800859a1
sub eax, 1
je 0x1800859a1
cmp eax, 2
jne 0x1800859e9
movsx ecx, byte [rsp + 0x50]
mov rdx, qword [rdi + 0x80]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
mov ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, esi
mov eax, ecx
jmp 0x1800859ee
mov rbx, qword [rsp + 0x40]
lea rax, [rsp + 0x58]
sub rbx, rax
je 0x1800859cf
mov r9, qword [rdi + 0x80]
lea rcx, [rsp + 0x58]
mov r8, rbx
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rbx, rax
jne 0x1800859e9
lea rax, [rsp + 0x50]
mov byte [rdi + 0x71], 1
cmp qword [rsp + 0x48], rax
mov ecx, 0xffffffff
cmovne ecx, esi
mov eax, ecx
jmp 0x1800859ee
mov eax, 0xffffffff
mov rbx, qword [rsp + 0xa0]
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.180157e20
mov rsi, qword [rsp + 0xa8]
add rsp, 0x80
pop rdi
ret
Function at 0x1800937f0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbx
sub rsp, 0x20
mov eax, dword [rcx + 0x10]
mov rbx, rcx
mov r10d, eax
and r10d, 7
je 0x180093821
cmp eax, r10d
jge 0x18009380f
call fcn.18008ce80
mov eax, dword [rbx + 0x18]
mov ecx, r10d
shr eax, cl
sub dword [rbx + 0x10], r10d
mov dword [rbx + 0x18], eax
mov eax, dword [rbx + 0x10]
xor r8d, r8d
mov r9d, eax
test eax, eax
jle 0x180093862
mov ecx, dword [rbx + 0x18]
lea rdx, [rsp + 0x30]
movzx r10d, cl
nop word [rax + rax]
shr ecx, 8
lea eax, [r9 - 8]
mov byte [rdx], r10b
lea rdx, [rdx + 1]
inc r8d
mov dword [rbx + 0x18], ecx
mov r9d, eax
movzx r10d, cl
test eax, eax
jg 0x180093840
mov dword [rbx + 0x10], eax
jns 0x18009388f
mov edx, dword [0x1802e1470]
mov rax, qword gs:[0x58]
mov ecx, reloc.WLDAP32.dll_Ordinal_32
mov rax, qword [rax + rdx*8]
lea rdx, str.zlib_corrupt
mov qword [rcx + rax], rdx
xor eax, eax
add rsp, 0x20
pop rbx
ret
movsxd rcx, r8d
cmp rcx, 4
jge 0x1800938c2
mov r8, qword [rbx + 8]
nop dword [rax]
mov rax, qword [rbx]
cmp rax, r8
jb 0x1800938ac
xor dl, dl
jmp 0x1800938b5
movzx edx, byte [rax]
inc rax
mov qword [rbx], rax
mov byte [rsp + rcx + 0x30], dl
inc rcx
cmp rcx, 4
jl 0x1800938a0
movzx eax, byte [rsp + 0x30]
movzx r8d, byte [rsp + 0x31]
movzx ecx, byte [rsp + 0x33]
shl r8d, 8
add r8d, eax
shl ecx, 8
movzx eax, byte [rsp + 0x32]
add ecx, eax
mov eax, r8d
xor eax, 0xffff
cmp ecx, eax
jne 0x180093864
mov rcx, qword [rbx]
mov qword [rsp + 0x38], rdi
mov edi, r8d
add rcx, rdi
cmp rcx, qword [rbx + 8]
jbe 0x180093937
mov edx, dword [0x1802e1470]
mov rax, qword gs:[0x58]
mov ecx, reloc.WLDAP32.dll_Ordinal_32
mov rax, qword [rax + rdx*8]
lea rdx, str.read_past_buffer
mov qword [rcx + rax], rdx
mov rdi, qword [rsp + 0x38]
xor eax, eax
add rsp, 0x20
pop rbx
ret
mov rdx, qword [rbx + 0x20]
lea rax, [r8 + rdx]
cmp rax, qword [rbx + 0x30]
jbe 0x180093951
mov rcx, rbx
call fcn.180098e40
test eax, eax
je 0x18009392a
mov rdx, qword [rbx]
mov r8, rdi
mov rcx, qword [rbx + 0x20]
call sub.VCRUNTIME140.dll_memcpy
add qword [rbx], rdi
mov eax, 1
add qword [rbx + 0x20], rdi
mov rdi, qword [rsp + 0x38]
add rsp, 0x20
pop rbx
ret
Function at 0x180099750
Capabilities:
Read file on windows

Disassembly:
push rbp
push rsi
push r14
sub rsp, 0x30
mov rsi, r8
mov r14, rdx
mov rbp, rcx
test r8, r8
jg 0x180099772
xor eax, eax
add rsp, 0x30
pop r14
pop rsi
pop rbp
ret
cmp qword [rcx + 0x68], 0
je 0x180099788
add rsp, 0x30
pop r14
pop rsi
pop rbp
jmp qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsgetn_char____ptr64__long_long___int64_____ptr64]
mov qword [rsp + 0x28], rbx
mov rbx, rsi
mov qword [rsp + 0x20], rdi
call qword [sym.imp.MSVCP140.dll_protected:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::_Gnavail_void_const___ptr64]
test rax, rax
je 0x1800997d2
cmp rax, rsi
mov rdi, rsi
mov rcx, rbp
cmovb rdi, rax
call qword [sym.imp.MSVCP140.dll_protected:_char____ptr64___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::gptr_void_const___ptr64]
mov r8, rdi
mov rcx, r14
mov rdx, rax
call sub.VCRUNTIME140.dll_memcpy
mov edx, edi
mov rcx, rbp
add r14, rdi
sub rbx, rdi
call qword [sym.imp.MSVCP140.dll_protected:_void___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::gbump_int____ptr64]
cmp qword [rbp + 0x80], 0
mov rdi, rbx
je 0x180099841
mov rcx, rbp
call fcn.180080d50
cmp rbx, 0xfff
jbe 0x180099821
mov r9, qword [rbp + 0x80]
mov edx, 1
mov r8d, 0xfff
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
sub rbx, rax
add r14, rax
mov rdi, rbx
cmp rax, 0xfff
jne 0x18009985a
cmp rbx, rax
ja 0x1800997f0
test rdi, rdi
je 0x180099841
mov r9, qword [rbp + 0x80]
mov r8, rbx
mov edx, 1
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
sub rdi, rax
sub rsi, rdi
mov rbx, qword [rsp + 0x28]
mov rax, rsi
mov rdi, qword [rsp + 0x20]
add rsp, 0x30
pop r14
pop rsi
pop rbp
ret
sub rsi, rbx
jmp 0x180099844
Function at 0x180099860
Capabilities:
Write file on windows

Disassembly:
push rbx
push rdi
push r14
sub rsp, 0x20
cmp qword [rcx + 0x68], 0
mov rbx, r8
mov r14, rdx
mov rdi, rcx
je 0x180099888
add rsp, 0x20
pop r14
pop rdi
pop rbx
jmp qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsputn_char_const____ptr64__long_long___int64_____ptr64]
mov qword [rsp + 0x40], rbp
mov qword [rsp + 0x48], rsi
mov rsi, rbx
call qword [sym.imp.MSVCP140.dll_protected:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::_Pnavail_void_const___ptr64]
mov rbp, rax
test rbx, rbx
jle 0x1800998fc
test rax, rax
jle 0x1800998dc
cmp rbx, rax
mov rcx, rdi
cmovl rbp, rbx
call qword [sym.imp.MSVCP140.dll_protected:_char____ptr64___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::pptr_void_const___ptr64]
mov r8, rbp
mov rdx, r14
mov rcx, rax
call sub.VCRUNTIME140.dll_memcpy
mov edx, ebp
mov rcx, rdi
add r14, rbp
sub rbx, rbp
call qword [sym.imp.MSVCP140.dll_protected:_void___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::pbump_int____ptr64]
test rbx, rbx
jle 0x1800998fc
mov r9, qword [rdi + 0x80]
test r9, r9
je 0x1800998fc
mov r8, rbx
mov edx, 1
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
sub rbx, rax
mov rbp, qword [rsp + 0x40]
sub rsi, rbx
mov rax, rsi
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
pop rdi
pop rbx
ret

Function at 0x180099920
Capabilities:
Create thread

Disassembly:
sub rsp, 0x38
cmp edx, 1
jne 0x18009994f
xor eax, eax
mov qword [0x1802dfed0], rcx
mov qword [rsp + 0x28], rax
lea r8, [0x180099960]
xor r9d, r9d
mov dword [rsp + 0x20], eax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov eax, 1
add rsp, 0x38
ret
Function at 0x1800af460
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x70
movups xmm3, xmmword [str.vf_Y__IoDP_]
xor r9d, r9d
mov rbx, rcx
movdqa xmm0, xmm3
psrldq xmm0, 0xf
movd eax, xmm0
movups xmmword [rsp + 0x20], xmm3
test al, al
je 0x1800af686
cmp dword [reloc.WS2_32.dll_accept], 2
mov ecx, r9d
jl 0x1800af651
movdqa xmm5, xmmword [0x1801aecf0]
movdqa xmm2, xmmword [0x180168c90]
movdqa xmm4, xmmword [0x18016fe50]
movdqa xmm1, xmm2
punpckldq xmm1, xmm2
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm5
pmuldq xmm1, xmm5
movd eax, xmm3
movdqa xmm3, xmmword [0x18016fdb0]
movaps xmmword [rsp + 0x60], xmm6
movdqa xmm6, xmmword [str.1111]
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
movaps xmmword [rsp + 0x50], xmm7
movdqa xmm7, xmmword [str.5555555555555555]
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm6
psubd xmm2, xmm0
movd xmm0, eax
andps xmm2, xmm4
packuswb xmm2, xmm2
packuswb xmm2, xmm2
paddb xmm2, xmm7
xorps xmm2, xmm0
movd dword [rsp + 0x20], xmm2
movdqa xmm2, xmmword [0x18016fd90]
movdqa xmm1, xmm2
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
punpckldq xmm1, xmm2
pmuldq xmm0, xmm5
pmuldq xmm1, xmm5
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
movdqa xmm1, xmm3
pmulld xmm0, xmm6
psubd xmm2, xmm0
punpckldq xmm1, xmm3
movd xmm0, dword [rsp + 0x24]
andps xmm2, xmm4
pmuldq xmm1, xmm5
packuswb xmm2, xmm2
packuswb xmm2, xmm2
paddb xmm2, xmm7
xorps xmm2, xmm0
movdqa xmm0, xmm3
punpckhdq xmm0, xmm3
pmuldq xmm0, xmm5
movd dword [rsp + 0x24], xmm2
movdqa xmm2, xmmword [0x18016fdc0]
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
movdqa xmm1, xmm2
pmulld xmm0, xmm6
psubd xmm3, xmm0
punpckldq xmm1, xmm2
movd xmm0, dword [rsp + 0x28]
andps xmm3, xmm4
packuswb xmm3, xmm3
packuswb xmm3, xmm3
pmuldq xmm1, xmm5
paddb xmm3, xmm7
xorps xmm3, xmm0
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm5
movd dword [rsp + 0x28], xmm3
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm6
movaps xmm6, xmmword [rsp + 0x60]
psubd xmm2, xmm0
movd xmm0, dword [rsp + 0x2c]
andps xmm2, xmm4
packuswb xmm2, xmm2
packuswb xmm2, xmm2
paddb xmm2, xmm7
movaps xmm7, xmmword [rsp + 0x50]
xorps xmm2, xmm0
movd dword [rsp + 0x2c], xmm2
jmp 0x1800af686
lea r8, [rsp + 0x20]
nop word [rax + rax]
mov eax, 0x5397829d
lea r8, [r8 + 1]
mul ecx
shr edx, 4
movsx eax, dl
imul edx, eax, 0x31
movzx eax, cl
inc ecx
sub al, dl
add al, 0x35
xor byte [r8 - 1], al
cmp ecx, 0x10
jl 0x1800af660
xorps xmm0, xmm0
mov qword [rsp + 0x40], r9
movups xmmword [rsp + 0x30], xmm0
mov qword [rsp + 0x48], r9
lea rax, [rsp + 0x20]
mov r8, 0xffffffffffffffff
inc r8
cmp byte [rax + r8], r9b
jne 0x1800af6a4
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x30]
call fcn.18004a030
lea rdx, [rsp + 0x30]
lea rcx, [0x1802e053f]
call fcn.1800c5380
mov rcx, qword [rax + 0x40]
mov rax, qword [rbx]
cmp byte [rax], 0
je 0x1800af6f2
nop dword [rax]
mov dword [rcx + 0xc8], 0x5dd
mov rax, qword [rbx]
cmp byte [rax], 0
jne 0x1800af6e0
add rsp, 0x70
pop rbx
ret
Function at 0x1800af700
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x70
movups xmm3, xmmword [0x1801ac508]
xor r9d, r9d
mov rbx, rcx
movdqa xmm0, xmm3
psrldq xmm0, 0xf
movd eax, xmm0
movups xmmword [rsp + 0x20], xmm3
test al, al
je 0x1800af926
cmp dword [reloc.WS2_32.dll_accept], 2
mov ecx, r9d
jl 0x1800af8f1
movdqa xmm5, xmmword [0x1801aecf0]
movdqa xmm2, xmmword [0x180168c90]
movdqa xmm4, xmmword [0x18016fe50]
movdqa xmm1, xmm2
punpckldq xmm1, xmm2
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm5
pmuldq xmm1, xmm5
movd eax, xmm3
movdqa xmm3, xmmword [0x18016fdb0]
movaps xmmword [rsp + 0x60], xmm6
movdqa xmm6, xmmword [str.1111]
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
movaps xmmword [rsp + 0x50], xmm7
movdqa xmm7, xmmword [str.5555555555555555]
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm6
psubd xmm2, xmm0
movd xmm0, eax
andps xmm2, xmm4
packuswb xmm2, xmm2
packuswb xmm2, xmm2
paddb xmm2, xmm7
xorps xmm2, xmm0
movd dword [rsp + 0x20], xmm2
movdqa xmm2, xmmword [0x18016fd90]
movdqa xmm1, xmm2
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
punpckldq xmm1, xmm2
pmuldq xmm0, xmm5
pmuldq xmm1, xmm5
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
movdqa xmm1, xmm3
pmulld xmm0, xmm6
psubd xmm2, xmm0
punpckldq xmm1, xmm3
movd xmm0, dword [rsp + 0x24]
andps xmm2, xmm4
pmuldq xmm1, xmm5
packuswb xmm2, xmm2
packuswb xmm2, xmm2
paddb xmm2, xmm7
xorps xmm2, xmm0
movdqa xmm0, xmm3
punpckhdq xmm0, xmm3
pmuldq xmm0, xmm5
movd dword [rsp + 0x24], xmm2
movdqa xmm2, xmmword [0x18016fdc0]
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
movdqa xmm1, xmm2
pmulld xmm0, xmm6
psubd xmm3, xmm0
punpckldq xmm1, xmm2
movd xmm0, dword [rsp + 0x28]
andps xmm3, xmm4
packuswb xmm3, xmm3
packuswb xmm3, xmm3
pmuldq xmm1, xmm5
paddb xmm3, xmm7
xorps xmm3, xmm0
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm5
movd dword [rsp + 0x28], xmm3
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm6
movaps xmm6, xmmword [rsp + 0x60]
psubd xmm2, xmm0
movd xmm0, dword [rsp + 0x2c]
andps xmm2, xmm4
packuswb xmm2, xmm2
packuswb xmm2, xmm2
paddb xmm2, xmm7
movaps xmm7, xmmword [rsp + 0x50]
xorps xmm2, xmm0
movd dword [rsp + 0x2c], xmm2
jmp 0x1800af926
lea r8, [rsp + 0x20]
nop word [rax + rax]
mov eax, 0x5397829d
lea r8, [r8 + 1]
mul ecx
shr edx, 4
movsx eax, dl
imul edx, eax, 0x31
movzx eax, cl
inc ecx
sub al, dl
add al, 0x35
xor byte [r8 - 1], al
cmp ecx, 0x10
jl 0x1800af900
xorps xmm0, xmm0
mov qword [rsp + 0x40], r9
movups xmmword [rsp + 0x30], xmm0
mov qword [rsp + 0x48], r9
lea rax, [rsp + 0x20]
mov r8, 0xffffffffffffffff
inc r8
cmp byte [rax + r8], r9b
jne 0x1800af944
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x30]
call fcn.18004a030
lea rdx, [rsp + 0x30]
lea rcx, [0x1802e053f]
call fcn.1800c5380
mov rcx, qword [rax + 0x40]
mov rax, qword [rbx]
cmp byte [rax + 2], 0
je 0x1800af993
nop word [rax + rax]
mov dword [rcx + 0xc8], 0x5dd
mov rax, qword [rbx]
cmp byte [rax + 2], 0
jne 0x1800af980
add rsp, 0x70
pop rbx
ret
Function at 0x1800b08f0
Capabilities:
Create thread

Disassembly:
push rbx
sub rsp, 0xa0
mov rax, qword [0x1802dd180]
xor rax, rsp
mov qword [rsp + 0x90], rax
mov rbx, rcx
mov rdx, qword [rcx + 0x10]
lea rcx, [rsp + 0x40]
call fcn.18005cc80
mov rdx, qword [rbx + 8]
mov rcx, qword [rbx]
mov r9, rax
mov r8, qword [rdx]
mov rdx, qword [rcx]
lea rcx, [0x1802e051f]
call fcn.1800be2a0
mov rdx, qword [0x1802e0950]
add rdx, qword [0x1802e08e0]
movsxd rax, dword [rdx + 0x8b]
lea rcx, [rdx + 0x8f]
add rcx, rax
mov qword [0x1802e0550], rcx
mov ecx, 8
call fcn.180157834
test rax, rax
je 0x1800b0977
lea rcx, [0x1802e0790]
mov qword [rax], rcx
mov qword [rsp + 0x80], rax
lea rcx, [rsp + 0x48]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], 0
mov r9, rax
lea r8, [0x1800a1810]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rsp + 0x40], rax
test rax, rax
je 0x1800b0ad4
cmp dword [rsp + 0x48], 0
je 0x1800b0ac9
movaps xmm0, xmmword [rsp + 0x40]
movdqa xmmword [rsp + 0x80], xmm0
lea rcx, [rsp + 0x80]
call sub.MSVCP140.dll__Thrd_detach
test eax, eax
jne 0x1800b0ac9
xorps xmm0, xmm0
movdqa xmmword [rsp + 0x40], xmm0
call fcn.1800f5080
mov cl, 1
call fcn.1800bc920
lea rcx, [rax + 0x20]
lea rax, [0x1801aea50]
mov qword [rsp + 0x40], rax
movzx eax, byte [rsp + 0x30]
mov byte [rsp + 0x48], al
lea rax, [rsp + 0x40]
mov qword [rsp + 0x78], rax
xor r8d, r8d
lea rdx, [rsp + 0x40]
call fcn.1800b91a0
lea rdx, [0x18009d940]
movabs rcx, 0xa940d998fa90
call qword [0x1802e0898]
lea rdx, [0x18009dc60]
movabs rcx, 0xa940d998fa70
call qword [0x1802e0898]
lea rdx, [0x18009df20]
movabs rcx, 0x905493068943
call qword [0x1802e0898]
lea rdx, [0x18009dff0]
movabs rcx, 0x8950843958495
call qword [0x1802e0898]
lea rdx, [0x18009e060]
movabs rcx, 0x905493068903
call qword [0x1802e0898]
lea rdx, [0x18009e110]
movabs rcx, 0x8953289582952
call qword [0x1802e0898]
mov rcx, qword [rsp + 0x90]
xor rcx, rsp
call fcn.180157e20
add rsp, 0xa0
pop rbx
ret
mov ecx, 1
call sub.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_
nop
mov dword [rsp + 0x48], 0
mov ecx, 6
call sub.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_
int3
Function at 0x1800b6e90
Capabilities:
Encode data using xor

Disassembly:
mov rax, rsp
push rbx
sub rsp, 0xa0
mov ebx, dword [reloc.WS2_32.dll_accept]
movaps xmmword [rax - 0x18], xmm6
movdqa xmm6, xmmword [0x1801aecf0]
movaps xmmword [rax - 0x28], xmm7
movdqa xmm7, xmmword [0x18016fdb0]
movaps xmmword [rax - 0x38], xmm8
movdqa xmm8, xmmword [0x18016fd90]
movaps xmmword [rax - 0x48], xmm9
movdqa xmm9, xmmword [0x180168c90]
movaps xmmword [rax - 0x58], xmm10
movdqa xmm10, xmmword [0x18016fe50]
movaps xmmword [rax - 0x68], xmm11
movdqa xmm11, xmmword [str.5555555555555555]
movaps xmmword [rax - 0x78], xmm12
movdqa xmm12, xmmword [str.1111]
movzx eax, word [0x1801ac814]
xor ecx, ecx
movsd xmm0, qword [str.VYYPVIO]
mov edx, dword [0x1801ac810]
mov word [rsp + 0x2c], ax
movzx eax, byte [0x1801ac816]
mov byte [rsp + 0x2e], al
mov dword [rsp + 0x28], edx
movsd qword [rsp + 0x20], xmm0
cmp ebx, 2
jl 0x1800b7062
movdqa xmm1, xmm9
movdqa xmm0, xmm9
punpckldq xmm1, xmm9
mov ecx, listen
pmuldq xmm1, xmm6
punpckhdq xmm0, xmm9
pmuldq xmm0, xmm6
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
movdqa xmm1, xmm9
pmulld xmm0, xmm12
psubd xmm1, xmm0
movd xmm0, dword [str.VYYPVIO]
andps xmm1, xmm10
packuswb xmm1, xmm1
packuswb xmm1, xmm1
paddb xmm1, xmm11
xorps xmm1, xmm0
movdqa xmm0, xmm8
movd dword [rsp + 0x20], xmm1
movdqa xmm1, xmm8
punpckldq xmm1, xmm8
pmuldq xmm1, xmm6
punpckhdq xmm0, xmm8
pmuldq xmm0, xmm6
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
movdqa xmm1, xmm8
pmulld xmm0, xmm12
psubd xmm1, xmm0
movd xmm0, dword [rsp + 0x24]
andps xmm1, xmm10
packuswb xmm1, xmm1
packuswb xmm1, xmm1
paddb xmm1, xmm11
xorps xmm1, xmm0
movdqa xmm0, xmm7
movd dword [rsp + 0x24], xmm1
movdqa xmm1, xmm7
punpckldq xmm1, xmm7
pmuldq xmm1, xmm6
punpckhdq xmm0, xmm7
pmuldq xmm0, xmm6
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
movdqa xmm1, xmm7
pmulld xmm0, xmm12
psubd xmm1, xmm0
movd xmm0, edx
andps xmm1, xmm10
packuswb xmm1, xmm1
packuswb xmm1, xmm1
paddb xmm1, xmm11
xorps xmm1, xmm0
movd dword [rsp + 0x28], xmm1
mov eax, ecx
lea r8, [rsp + 0x20]
add r8, rax
nop dword [rax]
mov eax, 0x5397829d
lea r8, [r8 + 1]
imul ecx
sar edx, 4
mov eax, edx
shr eax, 0x1f
add edx, eax
movsx eax, dl
imul edx, eax, 0x31
movzx eax, cl
inc ecx
sub al, dl
add al, 0x35
xor byte [r8 - 1], al
cmp ecx, 0xf
jl 0x1800b7070
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
cmp byte [0x1802e07c6], 0
mov r8, rax
je 0x1800b70dc
movzx ecx, byte [reloc.WS2_32.dll_accept]
mov rdx, qword [0x1802e08f0]
mov byte [0x1802e0f3c], 1
mov byte [rdx + rax], cl
mov ecx, 0xa
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x1800b6eff
cmp byte [0x1802e0f3c], 0
je 0x1800b7103
mov rax, qword [0x1802e08f8]
mov byte [0x1802e0f3c], 0
movzx ecx, byte [rax + r8]
mov rax, qword [0x1802e08f0]
mov byte [rax + r8], cl
mov ecx, 0xa
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x1800b6eff
Function at 0x1800b8ca0
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
sub rsp, 8
mov r9, rcx
mov r10d, 0x270
mov ecx, dword [rcx]
cmp ecx, r10d
jne 0x1800b8d01
lea r8, [r9 + 8]
nop dword [rax + rax]
mov edx, dword [r8 - 4]
xor edx, dword [r8]
lea r8, [r8 + 4]
btr edx, 0x1f
xor edx, dword [r8 - 8]
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r8 + 0x62c]
xor ecx, edx
mov dword [r8 + 0x9b8], ecx
sub r10, 1
jne 0x1800b8cc0
mov ecx, dword [r9]
jmp 0x1800b8deb
cmp ecx, 0x4e0
jb 0x1800b8deb
lea r10, [r9 + 0x9c4]
mov qword [rsp], rbx
mov r11d, dword [r10]
mov ebx, 0xe3
mov eax, r11d
mov r8, r10
mov r11d, dword [r10 + 4]
add r10, 4
mov edx, r11d
xor edx, eax
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r8 + 0x634]
xor ecx, edx
mov dword [r8 - 0x9c0], ecx
sub rbx, 1
jne 0x1800b8d20
lea r10, [r9 + 0xd50]
mov ebx, 0x18c
mov r11d, dword [r10]
nop
mov eax, r11d
mov r8, r10
mov r11d, dword [r10 + 4]
mov edx, eax
xor edx, r11d
add r10, 4
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r8 - 0xd4c]
xor ecx, edx
mov dword [r8 - 0x9c0], ecx
sub rbx, 1
jne 0x1800b8d70
mov eax, dword [r9 + 0x1380]
mov edx, eax
xor edx, dword [r9 + 4]
mov rbx, qword [rsp]
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r9 + 0x634]
xor ecx, edx
mov dword [r9 + 0x9c0], ecx
xor ecx, ecx
mov dword [r9], ecx
mov eax, ecx
mov edx, dword [r9 + rax*4 + 4]
lea eax, [rcx + 1]
mov dword [r9], eax
mov ecx, edx
mov eax, dword [r9 + 0x1384]
shr ecx, 0xb
and eax, ecx
xor edx, eax
mov eax, edx
and eax, 0xff3a58ad
shl eax, 7
xor edx, eax
mov eax, edx
and eax, 0xffffdf8c
shl eax, 0xf
xor edx, eax
mov eax, edx
shr eax, 0x12
xor eax, edx
add rsp, 8
ret