joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180040b40
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x20
mov rdi, r8
mov rsi, rcx
xor ebp, ebp
cmp byte [rdx + 0x25], bpl
je 0x180040ba1
mov r9d, ebp
movabs r8, 0x55d5cd91afbf43e9
nop dword [rax]
nop dword [rax + rax]
movzx ecx, r9b
and cl, 7
shl cl, 3
mov rax, r8
shr rax, cl
xor byte [r9 + rdx], al
inc r9
cmp r9, 0x25
jb 0x180040b80
mov byte [rdx + 0x25], bpl
mov qword [rsi], rbp
mov qword [rsi + 0x10], rbp
mov qword [rsi + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rsi], bpl
mov rbx, 0xffffffffffffffff
mov r8, rbx
nop dword [rax]
inc r8
cmp byte [rdx + r8], bpl
jne 0x180040bc0
mov rcx, rsi
call fcn.18002c300
nop
cmp byte [rdi + 1], 0
je 0x180040bdf
xor byte [rdi], 0xe9
mov byte [rdi + 1], 0
lea rcx, [rsi + 0x20]
mov qword [rcx], rbp
mov qword [rcx + 0x10], rbp
mov qword [rcx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rcx], 0
inc rbx
cmp byte [rdi + rbx], 0
jne 0x180040bf5
mov r8, rbx
mov rdx, rdi
call fcn.18002c300
nop
mov rax, rsi
mov rbx, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret

Function at 0x180040c30
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x20
mov rdi, r8
mov r9, rdx
mov rsi, rcx
cmp byte [rdx + 0x2c], 0
je 0x180040cad
lea r10, [rdx + 1]
mov r8, rdx
not r8
movabs r11, 0x55d5cd91afbf43e9
nop dword [rax]
lea ecx, [r10 + r8]
and cl, 7
shl cl, 3
mov rdx, r11
shr rdx, cl
xor byte [r10 - 1], dl
movzx ecx, r10b
sub cl, r9b
and cl, 7
shl cl, 3
mov rdx, r11
shr rdx, cl
xor byte [r10], dl
add r10, 2
lea rax, [r8 + r10]
cmp rax, 0x2c
jb 0x180040c70
mov byte [r9 + 0x2c], 0
xor ebp, ebp
mov qword [rsi], rbp
mov qword [rsi + 0x10], rbp
mov qword [rsi + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rsi], bpl
mov rbx, 0xffffffffffffffff
mov r8, rbx
nop dword [rax + rax]
inc r8
cmp byte [r9 + r8], bpl
jne 0x180040cd0
mov rdx, r9
mov rcx, rsi
call fcn.18002c300
nop
cmp byte [rdi + 1], 0
je 0x180040cf2
xor byte [rdi], 0xe9
mov byte [rdi + 1], 0
lea rcx, [rsi + 0x20]
mov qword [rcx], rbp
mov qword [rcx + 0x10], rbp
mov qword [rcx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rcx], 0
nop dword [rax + rax]
inc rbx
cmp byte [rdi + rbx], 0
jne 0x180040d10
mov r8, rbx
mov rdx, rdi
call fcn.18002c300
nop
mov rax, rsi
mov rbx, qword [rsp + 0x38]
mov rbp, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret
Function at 0x1800455fc
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push rbx
sub rsp, 0x20
mov r9d, 0x270
mov rbx, rcx
cmp dword [rcx], r9d
jne 0x18004564f
lea r8, [rcx + 8]
mov edx, dword [r8 - 4]
xor edx, dword [r8]
lea r8, [r8 + 4]
btr edx, 0x1f
xor edx, dword [r8 - 8]
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r8 + 0x62c]
xor ecx, edx
mov dword [r8 + 0x9b8], ecx
sub r9, 1
jne 0x180045614
jmp 0x18004565c
cmp dword [rcx], 0x4e0
jb 0x18004565c
call fcn.1800475a8
mov eax, dword [rbx]
mov edx, dword [rbx + rax*4 + 4]
inc eax
mov dword [rbx], eax
mov ecx, edx
mov eax, dword [rbx + 0x1384]
shr ecx, 0xb
and eax, ecx
xor edx, eax
mov eax, edx
and eax, 0xff3a58ad
shl eax, 7
xor edx, eax
mov eax, edx
and eax, 0xffffdf8c
shl eax, 0xf
xor edx, eax
mov eax, edx
shr eax, 0x12
xor eax, edx
add rsp, 0x20
pop rbx
ret
Function at 0x180046188
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
lea rdx, [0x180041d18]
mov rcx, qword [rcx]
call fcn.1800697e0
mov ecx, pe_nt_image_headers64
call fcn.18013e628
mov rcx, qword [rbx + 0x38]
mov rdx, rax
mov qword [rbx], rax
mov rcx, qword [rcx]
call fcn.18006a8c0
mov rax, qword [rbx]
mov rcx, rbx
mov qword [rax], rbx
add rsp, 0x20
pop rbx
jmp fcn.180045924

Function at 0x1800466e0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x40
mov rbx, rcx
inc qword [rcx + 0x68]
mov rax, qword [rcx + 0x68]
cmp rax, qword [rcx + 0x60]
jb 0x180046707
and qword [rcx + 0x68], 0
call qword [rcx + reloc.WS2_32.dll_WSASetLastError]
mov rax, qword [rbx + 0x68]
lea rdx, [rax + rax*4]
shl rdx, 5
add rdx, qword [rbx + 0x48]
and qword [rsp + 0x20], 0
and qword [rsp + 0x30], 0
and qword [rsp + 0x38], 0
lea rcx, [rsp + 0x20]
call fcn.18002e610
lea rcx, [rsp + 0x20]
call fcn.180048e94
mov r8d, 0x16d
lea rdx, str.Z:DevelopePrivateCodes_netshield_thirdgen_serverlocal_serverlocal_server.cpp
lea rcx, [rsp + 0x20]
call fcn.180076e00
mov rdi, rax
lea rcx, [rsp + 0x50]
call fcn.180043980
mov rbx, rax
cmp byte [rax + 0x16], 0
je 0x180046790
xor r9d, r9d
mov cl, r9b
and cl, 7
shl cl, 3
movabs r8, 0x3fe1bd3b95499f39
shr r8, cl
xor byte [r9 + rax], r8b
inc r9
cmp r9, 0x16
jb 0x180046769
mov byte [rax + 0x16], 0
mov rcx, rdi
call fcn.18007cf90
mov rcx, rax
mov rdx, rbx
call fcn.18002e990
nop
lea rcx, [rsp + 0x20]
call fcn.180077220
mov rbx, qword [rsp + 0x58]
add rsp, 0x40
pop rdi
ret
Function at 0x180046860
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r13
push r14
push r15
sub rsp, 0x40
mov bl, r9b
mov r14, r8
mov r15, rdx
mov rbp, rcx
lea r13, [rcx + 0x90]
mov rcx, r13
call fcn.180047d18
mov rdi, rax
lea rsi, [rax + 0xc0]
test bl, bl
je 0x1800469bd
lea rdx, [rbp + 0x330]
lea rcx, [rbp + 0xd8]
mov qword [rsp + 0x28], 4
mov qword [rsp + 0x20], rsi
mov r9, r14
mov r8, r15
call fcn.180048b5c
test eax, eax
je 0x1800469b3
mov r9d, 2
mov r8d, 0x3cd
lea rdx, str.Z:DevelopePrivateCodes_netshield_thirdgen_serverlocal_serverlocal_server.cpp
lea rcx, [rsp + 0x30]
call fcn.180076e30
mov rsi, rax
lea rcx, [rsp + 0x88]
call fcn.180044a8c
mov rbx, rax
cmp byte [rax + 0x24], 0
je 0x180046932
xor r9d, r9d
mov cl, r9b
and cl, 7
shl cl, 3
movabs r8, 0x5615713a1fd752b
shr r8, cl
xor byte [r9 + rax], r8b
inc r9
cmp r9, 0x24
jb 0x18004690b
mov byte [rax + 0x24], 0
mov rcx, rsi
call fcn.18007cf90
mov rcx, rax
mov rdx, rbx
call fcn.18002e990
nop
lea rcx, [rsp + 0x30]
call fcn.180077220
mov qword [rsp + 0x70], rdi
test rdi, rdi
je 0x1800469a9
mov rcx, qword [r13 + 0x28]
mov rax, qword [rcx + 8]
mov rbx, rcx
jmp 0x180046979
cmp qword [rax + 0x20], rdi
jae 0x180046973
mov rax, qword [rax + 0x10]
jmp 0x180046979
mov rbx, rax
mov rax, qword [rax]
cmp byte [rax + 0x19], 0
je 0x180046967
cmp byte [rbx + 0x19], 0
jne 0x1800469a9
cmp rdi, qword [rbx + 0x20]
jb 0x1800469a9
cmp rbx, rcx
je 0x1800469a9
lea rdx, [rsp + 0x70]
mov rcx, r13
call fcn.180042284
mov rdx, rbx
lea rcx, [r13 + 0x28]
call fcn.180046ce0
mov rcx, rbp
call fcn.1800458b4
jmp 0x1800469d9
mov rcx, rsi
call fcn.180047fbc
jmp 0x1800469ce
xor r9d, r9d
mov r8, r14
mov rdx, r15
mov rcx, rsi
call fcn.180047fdc
mov rdx, rdi
mov rcx, rbp
call fcn.180047f58
lea r11, [rsp + 0x40]
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop rdi
pop rsi
ret

Function at 0x1800475a8
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
lea r10, [rcx + 0x9c4]
mov r9, rcx
mov eax, dword [r10]
mov r11d, 0xe3
lea r8, [r10 + 4]
mov edx, dword [r8]
xor edx, eax
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
mov eax, dword [r8]
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r10 + 0x634]
xor ecx, edx
mov dword [r10 - 0x9c0], ecx
lea r10, [r8]
sub r11, 1
jne 0x1800475bb
lea r10, [r9 + 0xd50]
mov r11d, 0x18c
mov eax, dword [r10]
lea r8, [r10 + 4]
mov edx, dword [r8]
xor edx, eax
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
mov eax, dword [r8]
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r10 - 0xd4c]
xor ecx, edx
mov dword [r10 - 0x9c0], ecx
lea r10, [r8]
sub r11, 1
jne 0x180047606
mov edx, dword [r9 + 0x1380]
xor edx, dword [r9 + 4]
btr edx, 0x1f
xor edx, dword [r9 + 0x1380]
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r9 + 0x634]
xor ecx, edx
mov dword [r9 + 0x9c0], ecx
and dword [r9], 0
ret
Function at 0x180048d50
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x40
mov rdi, rcx
xor esi, esi
mov edx, dword [0x1804a2b54]
mov rax, qword gs:[0x58]
mov ecx, 0x76c8
mov r14, qword [rax + rdx*8]
lea ebp, [rsi + 1]
lea r15, [0x180204cc0]
mov eax, dword [r14 + rcx]
cmp dword [0x180206048], eax
jg 0x180048e62
mov qword [rsp + 0x20], r15
mov qword [rsp + 0x28], reloc.WLDAP32.dll_Ordinal_32
or dword [rsp + 0x30], 0xffffffff
movzx ebx, word [0x1802012a0]
movzx edx, word [0x1802012a2]
mov eax, edx
sub eax, ebx
cmp eax, 0xffff
jne 0x180048dd5
mov rcx, r15
call fcn.1800455fc
jmp 0x180048de5
sub dx, bx
add dx, bp
lea rcx, [rsp + 0x20]
call fcn.180045560
add ax, bx
movzx ecx, ax
mov eax, 0x80808081
mul ecx
shr edx, 7
imul eax, edx, 0xff
sub ecx, eax
mov byte [rdi], cl
add esi, ebp
add rdi, rbp
cmp esi, 0xc
mov ecx, 0x76c8
jb 0x180048d8f
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
add rsp, 0x40
pop r15
pop r14
pop rdi
ret
mov ecx, eax
shr ecx, 0x1e
xor ecx, eax
imul eax, ecx, 0x6c078965
add eax, edx
mov dword [r15 + rdx*4 + 4], eax
add rdx, rbp
cmp rdx, 0x270
jb 0x180048e27
mov dword [0x180204cc0], 0x270
lea rcx, [0x180206048]
call fcn.180133778
jmp 0x180048d9f
lea rcx, [0x180206048]
call fcn.1801337d8
cmp dword [0x180206048], 0xffffffff
jne 0x180048d9f
call fcn.18013265c
or dword [0x180206044], 0xffffffff
mov dword [0x180204cc4], eax
mov rdx, rbp
jmp 0x180048e27
Function at 0x18004a1f0
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
mov qword [rsp + 0x20], rbx
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x30
mov rdi, rcx
or dword [rcx + 0x30], 0xffffffff
xorps xmm0, xmm0
movups xmmword [rcx + 0x34], xmm0
and dword [rcx + 0x44], 0
call fcn.18013265c
or dword [rdi + 0x13d0], 0xffffffff
mov dword [rdi + 0x50], eax
mov edx, 1
lea r8, [rdi + 0x54]
mov r9d, 0x270
mov ecx, eax
shr ecx, 0x1e
xor ecx, eax
imul eax, ecx, 0x6c078965
add eax, edx
mov dword [r8], eax
inc rdx
lea r8, [r8 + 4]
cmp rdx, r9
jb 0x18004a22f
mov dword [rdi + 0x4c], r9d
mov dword [rdi + 0x13d4], 0xfffa7530
lea rbx, [rdi + 0x13d8]
mov qword [rsp + 0x48], rbx
and qword [rbx], 0
and qword [rbx + 8], 0
mov ecx, Ordinal_41
call fcn.1801338e8
mov qword [rax], rax
mov qword [rax + 8], rax
mov qword [rax + 0x10], rax
mov word [rax + 0x18], 0x101
mov qword [rbx], rax
lea rbx, [rdi + 0x13e8]
mov qword [rsp + 0x48], rbx
mov edx, 2
mov rcx, rbx
call fcn.180132130
nop
add rbx, 0x50
mov qword [rsp + 0x50], rbx
and qword [rbx], 0
and qword [rbx + 8], 0
mov ecx, 0x48
call fcn.1801338e8
mov qword [rax], rax
mov qword [rax + 8], rax
mov qword [rax + 0x10], rax
mov word [rax + 0x18], 0x101
mov qword [rbx], rax
lea rbx, [rdi + 0x1448]
mov qword [rsp + 0x48], rbx
and qword [rbx], 0
and qword [rbx + 8], 0
mov ecx, 0x48
call fcn.1801338e8
mov qword [rax], rax
mov qword [rax + 8], rax
mov qword [rax + 0x10], rax
mov word [rax + 0x18], 0x101
mov qword [rbx], rax
mov ecx, 0x1d0
call fcn.18013e628
mov qword [rdi], rax
mov ecx, Ordinal_41
call fcn.18013e628
mov qword [rdi + 8], rax
mov ecx, 0x40
call fcn.18013e628
mov qword [rdi + 0x10], rax
mov ebx, 0xe0
mov ecx, ebx
call fcn.18013e628
mov qword [rdi + 0x18], rax
mov ecx, ebx
call fcn.18013e628
mov qword [rdi + 0x20], rax
lea ecx, [rbx + 0x60]
call fcn.18013e628
mov qword [rdi + 0x28], rax
lea ecx, [rbx - 0x40]
call fcn.18013e628
mov qword [rdi + 0x1458], rax
lea r8d, [rbx - 0x4a]
lea rdx, str.Z:DevelopePrivateCodes_netshield_thirdgen_serverdup_serverdup_server.cpp
lea rcx, [rsp + 0x20]
call fcn.180076e00
nop
mov rcx, rax
call fcn.18007cf90
mov rcx, rax
lea rdx, str._dupserver_server_has_been_created.
call fcn.18002e990
nop
lea rcx, [rsp + 0x20]
call fcn.180077220
nop
mov rax, rdi
mov rbx, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret
Function at 0x18004cf18
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
mov rdi, rdx
mov rbx, rcx
test r8b, r8b
je 0x18004cf36
mov qword [rcx + 0x10], rdx
call fcn.180085d50
mov qword [rbx], rax
test rax, rax
jne 0x18004cfc1
lea r9d, [rax + 2]
lea r8d, [rax + 0x37]
lea rdx, str.Z:DevelopePrivateCodes_netshield_thirdgen_registerhttpclienthttp_client.cpp
lea rcx, [rsp + 0x20]
call fcn.180076e30
mov rdi, rax
lea rcx, [rsp + 0x50]
call fcn.18004cb84
mov rbx, rax
cmp byte [rax + 0x10], 0
je 0x18004cf9c
xor r8d, r8d
mov cl, r8b
and cl, 7
shl cl, 3
movabs rax, 0xcf2529af23519919
shr rax, cl
xor byte [r8 + rbx], al
inc r8
cmp r8, 0x10
jb 0x18004cf75
mov byte [rbx + 0x10], 0
mov rcx, rdi
call fcn.18007cf90
mov rcx, rax
mov rdx, rbx
call fcn.18002e990
nop
lea rcx, [rsp + 0x20]
call fcn.180077220
xor al, al
jmp 0x18004d0ac
lea r8, [rdi + 0x20]
cmp qword [r8 + 0x18], 0x10
jb 0x18004cfcf
mov r8, qword [r8]
mov edx, 0x2712
mov rcx, rax
call fcn.180089f60
xor r8d, r8d
lea edx, [r8 + 0x40]
mov rcx, qword [rbx]
call fcn.180089f60
xor r8d, r8d
lea edx, [r8 + 0x51]
mov rcx, qword [rbx]
call fcn.180089f60
mov r8d, dword [rdi + 0xac]
mov edx, Ordinal_79
mov rcx, qword [rbx]
call fcn.180089f60
mov r8d, dword [rdi + 0xb0]
mov edx, reloc.WS2_32.dll_listen
mov rcx, qword [rbx]
call fcn.180089f60
lea r8, [0x18004d3b8]
mov edx, 0x4e2b
mov rcx, qword [rbx]
call fcn.180089f60
lea r8, [rdi + 0x68]
mov edx, 0x2711
mov rcx, qword [rbx]
call fcn.180089f60
cmp dword [rdi], 1
jne 0x18004d067
lea r8, [rdi + 0x40]
cmp qword [r8 + 0x18], 0x10
jb 0x18004d05a
mov r8, qword [r8]
mov edx, 0x271f
mov rcx, qword [rbx]
call fcn.180089f60
mov rsi, qword [rdi + 0x10]
mov rdi, qword [rdi + 8]
jmp 0x18004d08f
mov rdx, rdi
cmp qword [rdi + 0x18], 0x10
jb 0x18004d07e
mov rdx, qword [rdi]
mov rcx, qword [rbx + 8]
call fcn.1800860f0
mov qword [rbx + 8], rax
add rdi, 0x20
cmp rdi, rsi
jne 0x18004d071
mov r8, qword [rbx + 8]
test r8, r8
je 0x18004d0aa
mov edx, 0x2727
mov rcx, qword [rbx]
call fcn.180089f60
mov al, 1
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
Function at 0x1800585e8
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x30
mov rdi, rcx
mov r8d, 0x1a2
lea rdx, str.Z:DevelopePrivateCodes_netshield_thirdgen_registerhelper_register_helper.cpp
lea rcx, [rsp + 0x20]
call fcn.180076e00
mov rsi, rax
lea rcx, [rsp + 0x40]
call fcn.180057e1c
mov rbx, rax
cmp byte [rax + 0x13], 0
je 0x180058651
xor r8d, r8d
mov cl, r8b
and cl, 7
shl cl, 3
movabs rax, 0x69c17b8f8ff5cdb1
shr rax, cl
xor byte [r8 + rbx], al
inc r8
cmp r8, 0x13
jb 0x18005862a
mov byte [rbx + 0x13], 0
mov rcx, rsi
call fcn.18007cf90
mov rcx, rax
mov rdx, rbx
call fcn.18002e990
nop
lea rcx, [rsp + 0x20]
call fcn.180077220
lea rcx, [rdi + 0x40]
cmp qword [rcx + 0x18], 0x10
jb 0x18005867d
mov rcx, qword [rcx]
mov rbx, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
jmp 0x180143da0
mov qword [rsp + 8], rbx
push rbp
mov rbp, rsp
sub rsp, 0x70
mov rbx, rcx
test rcx, rcx
jne 0x180143dbf
call fcn.18015b298
jmp 0x180143e70
and qword [rbp - 0x30], 0
lea rcx, [rbp - 0x50]
and qword [rbp - 0x28], 0
xor edx, edx
and qword [rbp - 0x20], 0
and qword [rbp - 0x18], 0
and qword [rbp - 0x10], 0
mov byte [rbp - 8], 0
call fcn.18013aff0
mov rax, qword [rbp - 0x48]
mov r8d, 0xfde9
cmp dword [rax + 0xc], r8d
jne 0x180143e0a
cmp byte [rbp - 0x38], 0
je 0x180143e3f
mov rax, qword [rbp - 0x50]
and dword [rax + 0x3a8], 0xfffffffd
jmp 0x180143e3f
call fcn.18015a0fc
test eax, eax
jne 0x180143e2b
cmp byte [rbp - 0x38], al
je 0x180143e23
mov rax, qword [rbp - 0x50]
and dword [rax + 0x3a8], 0xfffffffd
mov r8d, 1
jmp 0x180143e3f
cmp byte [rbp - 0x38], 0
je 0x180143e3c
mov rax, qword [rbp - 0x50]
and dword [rax + 0x3a8], 0xfffffffd
xor r8d, r8d
lea rdx, [rbp - 0x30]
mov rcx, rbx
call fcn.180143c20
test eax, eax
je 0x180143e54
or ebx, 0xffffffff
jmp 0x180143e5f
mov rcx, qword [rbp - 0x20]
call fcn.18015b298
mov ebx, eax
cmp byte [rbp - 8], 0
je 0x180143e6e
mov rcx, qword [rbp - 0x20]
call fcn.180156214
mov eax, ebx
mov rbx, qword [rsp + 0x80]
add rsp, 0x70
pop rbp
ret
Function at 0x1800593dc
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x60
mov rax, qword [0x180201ac0]
xor rax, rsp
mov qword [rsp + 0x58], rax
cmp qword [rcx + 0x68], 0
mov rbx, rcx
je 0x18005944b
cmp byte [rcx + 0x71], 0
je 0x18005944b
mov rax, qword [rcx]
or edx, 0xffffffff
call qword [rax + Ordinal_26]
cmp eax, 0xffffffff
je 0x18005949f
mov rcx, qword [rbx + 0x68]
lea r8, [rsp + 0x30]
mov qword [rsp + 0x20], r8
lea rdx, [rbx + 0x74]
lea r9, [rsp + 0x58]
lea r8, [rsp + 0x38]
mov rax, qword [rcx]
call qword [rax + 0x40]
test eax, eax
je 0x180059465
sub eax, 1
je 0x180059469
cmp eax, 2
jne 0x18005949f
mov byte [rbx + 0x71], 0
mov al, 1
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.180133630
mov rbx, qword [rsp + 0x78]
add rsp, 0x60
pop rdi
ret
mov byte [rbx + 0x71], 0
mov rdi, qword [rsp + 0x30]
lea rax, [rsp + 0x38]
sub rdi, rax
je 0x180059496
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x38]
mov r8, rdi
mov edx, 1
call fcn.180143b9c
cmp rdi, rax
jne 0x18005949f
cmp byte [rbx + 0x71], 0
sete al
jmp 0x18005944d
xor al, al
jmp 0x18005944d
Function at 0x18005ed10
Capabilities:
Encode data using xor

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x57]
sub rsp, 0x90
mov r14d, r9d
mov r15d, r8d
mov r12, rdx
mov rsi, rcx
mov r10d, dword [0x1804a2b54]
mov rax, qword gs:[0x58]
mov ecx, 0x76c8
mov r11, qword [rax + r10*8]
or rbx, 0xffffffffffffffff
xor r13d, r13d
mov eax, dword [rcx + r11]
cmp dword [0x1802078fc], eax
jg 0x18005eee6
mov rdi, qword [rbp + 0x7f]
test rdi, rdi
jne 0x18005ee22
lea rcx, [rbp + 0x7f]
call fcn.180057558
mov rdi, rax
cmp byte [rax + 0x20], r13b
je 0x18005edb8
mov r9, r13
mov cl, r9b
and cl, 7
shl cl, 3
movabs r8, 0x91db53d32fe1d7e9
shr r8, cl
xor byte [r9 + rax], r8b
inc r9
cmp r9, 0x20
jb 0x18005ed91
mov byte [rax + 0x20], r13b
lea rax, [rbp + 0xf]
mov qword [rbp + 0x7f], rax
inc rbx
cmp byte [rsi + rbx], r13b
jne 0x18005edc0
movabs rax, 0x7fffffffffffffff
mov rcx, qword [0x1802078e8]
sub rax, rcx
cmp rax, rbx
jb 0x18005ef7d
lea r9, [0x1802078d8]
cmp qword [0x1802078f0], 0x10
cmovae r9, qword [0x1802078d8]
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x20], rcx
lea r8, [0x1802078d8]
mov dl, byte [rbp + 0x7f]
lea rcx, [rbp + 0xf]
call fcn.180054dc0
nop
jmp 0x18005ee8a
lea rax, [rbp + 0xf]
mov qword [rbp + 0x7f], rax
inc rbx
cmp byte [rsi + rbx], r13b
jne 0x18005ee2a
movabs rax, 0x7fffffffffffffff
mov rcx, qword [0x1802078e8]
sub rax, rcx
cmp rax, rbx
jb 0x18005eee0
lea r9, [0x1802078d8]
cmp qword [0x1802078f0], 0x10
cmovae r9, qword [0x1802078d8]
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x20], rcx
lea r8, [0x1802078d8]
mov dl, byte [rbp + 0x7f]
lea rcx, [rbp + 0xf]
call fcn.180054dc0
nop
mov qword [rbp - 0x11], r13
mov qword [rbp - 1], r13
mov qword [rbp + 7], reloc.WS2_32.dll_ntohs
mov rdx, rdi
lea rcx, [rbp - 0x11]
call fcn.18002e560
nop
mov dword [rsp + 0x20], r14d
mov r9d, r15d
mov r8, r12
lea rdx, [rbp + 0xf]
lea rcx, [rbp - 0x11]
call fcn.18005af30
lea r11, [rsp + 0x90]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call fcn.18002b5f0
int3
lea rcx, [0x1802078fc]
call fcn.1801337d8
cmp dword [0x1802078fc], ebx
jne 0x18005ed6f
lea rcx, [rbp - 0x21]
call fcn.180057f74
cmp byte [rax + 6], r13b
je 0x18005ef37
mov r9, r13
mov cl, r9b
and cl, 7
shl cl, 3
movabs r8, 0x512927bb37fd033b
shr r8, cl
xor byte [r9 + rax], r8b
inc r9
cmp r9, 6
jb 0x18005ef10
mov byte [rax + 6], r13b
mov qword [0x1802078d8], r13
mov qword [0x1802078e8], r13
mov qword [0x1802078f0], 0xf
mov rdx, rax
lea rcx, [0x1802078d8]
call fcn.18002e560
lea rcx, [0x18016a8c8]
call fcn.180133c8c
nop
lea rcx, [0x1802078fc]
call fcn.180133778
jmp 0x18005ed6f
call fcn.18002b5f0
int3
Function at 0x18005fa78
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rbp
push rdi
push r14
mov rbp, rsp
sub rsp, 0x80
mov rax, qword [0x180201ac0]
xor rax, rsp
mov qword [rbp - 8], rax
or edi, 0xffffffff
mov esi, edx
mov rbx, rcx
cmp edx, edi
jne 0x18005fab1
xor eax, eax
jmp 0x18005fbd3
mov rax, qword [rcx + 0x40]
cmp qword [rax], 0
je 0x18005faeb
mov rdx, qword [rcx + 0x58]
movsxd r8, dword [rdx]
mov rcx, r8
add rcx, qword [rax]
cmp qword [rax], rcx
jae 0x18005faeb
lea ecx, [r8 - 1]
mov eax, esi
mov dword [rdx], ecx
mov rdx, qword [rbx + 0x40]
mov r8, qword [rdx]
lea rcx, [r8 + 1]
mov qword [rdx], rcx
mov byte [r8], sil
jmp 0x18005fbd3
cmp qword [rbx + 0x80], 0
je 0x18005fbd1
mov r8, qword [rbx + 0x18]
lea rax, [rbx + 0x70]
cmp qword [r8], rax
jne 0x18005fb26
mov rcx, qword [rbx + 0x88]
mov rdx, qword [rbx + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rbx + 0x38]
mov qword [rax], rcx
mov rax, qword [rbx + 0x50]
mov dword [rax], edx
mov rcx, qword [rbx + 0x68]
test rcx, rcx
jne 0x18005fb49
movsx ecx, sil
mov rdx, qword [rbx + 0x80]
call fcn.1801432b0
cmp eax, edi
cmovne edi, esi
jmp 0x18005fbd1
lea r8, [rbp - 0x38]
mov byte [rbp - 0x40], sil
mov rax, qword [rcx]
lea rdx, [rbx + 0x74]
mov qword [rsp + 0x38], r8
lea r9, [rbp - 0x3f]
lea r8, [rbp - 8]
mov qword [rsp + 0x30], r8
lea r8, [rbp - 0x28]
mov qword [rsp + 0x28], r8
lea r8, [rbp - 0x30]
mov qword [rsp + 0x20], r8
lea r8, [rbp - 0x40]
call qword [rax + gethostname]
test eax, eax
je 0x18005fb97
sub eax, 1
je 0x18005fb97
cmp eax, 2
jne 0x18005fbd1
movsx ecx, byte [rbp - 0x40]
jmp 0x18005fb33
mov r14, qword [rbp - 0x38]
lea rax, [rbp - 0x28]
sub r14, rax
je 0x18005fbc1
mov r9, qword [rbx + 0x80]
lea rcx, [rbp - 0x28]
mov r8, r14
mov edx, 1
call fcn.180143b9c
cmp r14, rax
jne 0x18005fbd1
lea rax, [rbp - 0x40]
mov byte [rbx + 0x71], 1
cmp qword [rbp - 0x30], rax
mov eax, esi
jne 0x18005fbd3
mov eax, edi
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.180133630
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret