joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180064340
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov rax, rsp
push rdi
sub rsp, 0x2a0
mov qword [rsp + 0x28], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rbp
mov qword [rax + 0x20], rsi
mov rax, qword [0x1800d1eb0]
xor rax, rsp
mov qword [rsp + 0x290], rax
mov rdi, rcx
mov qword [rsp + 0x30], rcx
cmp qword [rcx + 0x18], 8
jb 0x180064384
mov rcx, qword [rcx]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x180064478
shr eax, 4
not eax
and eax, 1
je 0x180064478
lea rcx, [rsp + 0x40]
call fcn.180033230
nop
cmp qword [rdi + 0x18], 8
jb 0x1800643b8
mov rdx, qword [rdi]
jmp 0x1800643bb
mov rdx, rdi
lea rcx, [rsp + 0x40]
call fcn.180033e40
xor esi, esi
mov ecx, esi
lea rdx, [0x1800a8438]
movzx eax, byte [rcx + rdx]
cmp byte [rsp + rcx + 0x68], al
jne 0x1800643ea
inc rcx
cmp rcx, 9
jl 0x1800643d0
mov ebp, 1
jmp 0x1800643ec
mov ebp, esi
mov rax, qword [rsp + 0x270]
mov rdx, qword [rax]
mov qword [rax], rax
mov rax, qword [rsp + 0x270]
mov qword [rax + 8], rax
mov qword [rsp + 0x278], rsi
mov rcx, qword [rsp + 0x270]
cmp rdx, rcx
je 0x18006443b
nop dword [rax + rax]
mov rbx, qword [rdx]
mov rcx, rdx
call fcn.18007a7a4
mov rdx, rbx
mov rcx, qword [rsp + 0x270]
cmp rbx, rcx
jne 0x180064420
call fcn.18007a7a4
cmp qword [rsp + 0x58], 8
jb 0x180064452
mov rcx, qword [rsp + 0x40]
call fcn.18007a7a4
mov qword [rsp + 0x58], 7
mov qword [rsp + 0x50], rsi
mov word [rsp + 0x40], si
cmp qword [rdi + 0x18], 8
jb 0x180064474
mov rcx, qword [rdi]
call fcn.18007a7a4
mov eax, ebp
jmp 0x18006448b
cmp qword [rdi + 0x18], 8
jb 0x180064487
mov rcx, qword [rdi]
call fcn.18007a7a4
xor esi, esi
xor eax, eax
mov qword [rdi + 0x18], 7
mov qword [rdi + 0x10], rsi
mov word [rdi], si
mov rcx, qword [rsp + 0x290]
xor rcx, rsp
call fcn.18007a7c0
lea r11, [rsp + 0x2a0]
mov rbx, qword [r11 + 0x18]
mov rbp, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x180064a00
Capabilities:
Enumerate gui resources

Disassembly:
mov rax, rsp
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x5f]
sub rsp, 0xe0
mov qword [rbp - 0x69], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov rax, qword [0x1800d1eb0]
xor rax, rsp
mov qword [rbp + 0x2f], rax
mov r14, rcx
mov qword [rbp - 0x39], 7
xor r15d, r15d
mov qword [rbp - 0x41], r15
mov word [rbp - 0x51], r15w
mov qword [rbp - 0x21], r15
mov qword [rbp - 0x19], r15
mov qword [rbp - 0x11], r15
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [rbp - 0x59], eax
mov qword [rbp - 0x29], r15
xor r8d, r8d
lea rdx, [0x1800a4614]
lea rcx, [rbp - 0x51]
call fcn.180004cc0
nop
mov qword [rsp + 0x20], r15
mov qword [rsp + 0x28], r15
mov qword [rbp - 0x79], r15
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [rbp - 0x59], eax
mov rbx, qword [rbp - 0x21]
mov rdx, qword [rbp - 0x19]
cmp rbx, rdx
je 0x180064ab0
xor r8d, r8d
mov rcx, rbx
call fcn.18007abc0
mov qword [rbp - 0x19], rbx
lea rdx, [rbp - 0x59]
lea rcx, [0x18005d900]
call qword [sym.imp.USER32.dll_EnumWindows]
lea rdx, [rbp - 0x21]
lea rcx, [rsp + 0x20]
call fcn.18005da80
mov r12, qword [rsp + 0x28]
mov rdi, qword [rsp + 0x20]
sub r12, rdi
sar r12, 3
mov rbx, r15
movsxd r13, r12d
test r12d, r12d
jle 0x180064bbb
nop
cmp r12, rbx
jbe 0x180064bae
mov rsi, qword [rdi + rbx*8]
mov rdx, rsi
lea rcx, [rbp + 7]
call fcn.18006c4c0
nop
lea rdx, [r14 + 8]
cmp qword [rdx + 0x18], 8
jb 0x180064b18
mov rdx, qword [rdx]
lea rcx, [rbp + 7]
cmp qword [rbp + 0x1f], 8
cmovae rcx, qword [rbp + 7]
call fcn.18002f130
test rax, rax
jne 0x180064b4a
cmp qword [rbp + 0x1f], 8
jb 0x180064b40
mov rcx, qword [rbp + 7]
call fcn.18007a7a4
inc rbx
cmp rbx, r13
jl 0x180064af0
jmp 0x180064bbb
mov qword [r14 + 0x30], rsi
cmp qword [rbp + 0x1f], 8
jb 0x180064b5e
mov rcx, qword [rbp + 7]
call fcn.18007a7a4
mov qword [rbp + 0x1f], 7
mov qword [rbp + 0x17], r15
mov word [rbp + 7], r15w
test rdi, rdi
je 0x180064b7d
mov rcx, rdi
call fcn.18007a7a4
nop
mov rcx, qword [rbp - 0x21]
test rcx, rcx
je 0x180064b8b
call fcn.18007a7a4
mov qword [rbp - 0x21], r15
mov qword [rbp - 0x19], r15
mov qword [rbp - 0x11], r15
cmp qword [rbp - 0x39], 8
jb 0x180064ba7
mov rcx, qword [rbp - 0x51]
call fcn.18007a7a4
mov eax, 1
jmp 0x180064bf5
lea rcx, str.invalid_vector_T__subscript
call fcn.18007837c
nop
test rdi, rdi
je 0x180064bc9
mov rcx, rdi
call fcn.18007a7a4
nop
mov rcx, qword [rbp - 0x21]
test rcx, rcx
je 0x180064bd7
call fcn.18007a7a4
mov qword [rbp - 0x21], r15
mov qword [rbp - 0x19], r15
mov qword [rbp - 0x11], r15
cmp qword [rbp - 0x39], 8
jb 0x180064bf3
mov rcx, qword [rbp - 0x51]
call fcn.18007a7a4
xor eax, eax
mov rcx, qword [rbp + 0x2f]
xor rcx, rsp
call fcn.18007a7c0
lea r11, [rsp + 0xe0]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
Function at 0x180064c30
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov rax, rsp
push rdi
sub rsp, 0x4a0
mov qword [rsp + 0x28], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rbp
mov qword [rax + 0x20], rsi
mov rax, qword [0x1800d1eb0]
xor rax, rsp
mov qword [rsp + 0x490], rax
mov rdi, rdx
cmp dword [rcx], 0
jne 0x180064c71
xor eax, eax
jmp 0x180064da4
lea rcx, [rsp + 0x30]
call fcn.180033230
nop
mov rdx, rdi
lea rcx, [rsp + 0x30]
call fcn.180033e40
xor ebp, ebp
mov ecx, ebp
lea rsi, [0x1800a8438]
movzx eax, byte [rcx + rsi]
cmp byte [rsp + rcx + 0x58], al
jne 0x180064cac
inc rcx
cmp rcx, 9
jl 0x180064c94
jmp 0x180064d37
mov ebx, ebp
lea rcx, [rsp + 0x280]
sub rcx, rdi
nop dword [rax]
movzx eax, word [rdi]
mov word [rcx + rdi], ax
add rdi, 2
test ax, ax
jne 0x180064cc0
xor eax, eax
or rcx, 0xffffffffffffffff
lea rdi, [rsp + 0x280]
repne scasw ax, word [rdi]
not rcx
lea rax, [rcx - 1]
cdqe
mov word [rsp + rax*2 + 0x27e], bp
lea rcx, [rsp + 0x280]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x180064d3c
shr eax, 4
not eax
and eax, 1
je 0x180064d3c
lea rdx, [rsp + 0x280]
lea rcx, [rsp + 0x30]
call fcn.180033e40
mov rdx, rbp
movzx eax, byte [rdx + rsi]
cmp byte [rsp + rdx + 0x58], al
jne 0x180064d3c
inc rdx
cmp rdx, 9
jl 0x180064d24
mov ebx, 1
mov rax, qword [rsp + 0x260]
mov rcx, qword [rax]
mov qword [rax], rax
mov rax, qword [rsp + 0x260]
mov qword [rax + 8], rax
mov qword [rsp + 0x268], rbp
mov rax, qword [rsp + 0x260]
cmp rcx, rax
je 0x180064d88
nop dword [rax + rax]
mov rdi, qword [rcx]
call fcn.18007a7a4
mov rcx, rdi
mov rax, qword [rsp + 0x260]
cmp rdi, rax
jne 0x180064d70
mov rcx, rax
call fcn.18007a7a4
cmp qword [rsp + 0x48], 8
jb 0x180064da2
mov rcx, qword [rsp + 0x30]
call fcn.18007a7a4
mov eax, ebx
mov rcx, qword [rsp + 0x490]
xor rcx, rsp
call fcn.18007a7c0
lea r11, [rsp + 0x4a0]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x180066040
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rbx
sub rsp, 0x80
mov qword [rsp + 0x48], 0xfffffffffffffffe
mov rax, qword [0x1800d1eb0]
xor rax, rsp
mov qword [rsp + 0x78], rax
mov rbx, rcx
lea rcx, [rsp + 0x50]
call fcn.180065f40
nop
lea rcx, [rsp + 0x50]
cmp qword [rsp + 0x68], 8
cmovae rcx, qword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x1800660ac
shr eax, 4
not eax
and eax, 1
je 0x1800660ac
lea rdx, [rsp + 0x50]
mov rcx, rbx
call fcn.180066330
mov rcx, rbx
call fcn.180066560
jmp 0x1800660f2
lea rcx, [rsp + 0x50]
cmp qword [rsp + 0x68], 8
cmovae rcx, qword [rsp + 0x50]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 1
xor r9d, r9d
mov edx, 0xc0000000
lea r8d, [r9 + 7]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
cmp qword [rsp + 0x68], 8
jb 0x180066104
mov rcx, qword [rsp + 0x50]
call fcn.18007a7a4
mov al, 1
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.18007a7c0
add rsp, 0x80
pop rbx
ret
Function at 0x180066330
Capabilities:
Read file on windows

Disassembly:
mov rax, rsp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x50
mov qword [rsp + 0x40], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x20], rbp
mov rax, rdx
mov rsi, rcx
cmp qword [rdx + 0x18], 8
jb 0x180066360
mov rax, qword [rdx]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov edx, 0xc0000000
lea r8d, [r9 + 7]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rbx, rax
cmp rax, 0xffffffffffffffff
jne 0x1800663ad
call qword [sym.imp.KERNEL32.dll_GetLastError]
or rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor al, al
jmp 0x1800664fc
mov r9d, 2
xor r8d, r8d
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
mov edi, eax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
test edi, edi
je 0x180066411
mov ecx, edi
call fcn.180078408
mov rbp, rax
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x88]
mov r8d, edi
mov rdx, rax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_ReadFile]
cmp dword [rsp + 0x88], edi
je 0x180066421
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor al, al
jmp 0x1800664fc
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [rbp]
cmp eax, dword [str.PS]
jne 0x1800663a6
movsx r13, word [rbp + 0xc]
mov rcx, r13
call fcn.180078408
mov r14, rax
mov r8, r13
lea rdx, [rbp + 0xe]
mov rcx, rax
call fcn.18007abc0
lea rbx, [rbp + r13 + 0x12]
movsxd r12, dword [rbx]
mov rcx, r12
call fcn.180078408
mov rdi, rax
mov r8, r12
lea rdx, [rbx + 4]
mov rcx, rax
call fcn.18007abc0
mov r11d, r12d
and r11d, 0x80000007
jge 0x180066490
dec r11d
or r11d, 0xfffffff8
inc r11d
mov r8d, r12d
sub r8d, r11d
lea rax, vtable.piy::CDesEnc.0
mov qword [rsp + 0x90], rax
and r8d, 0xfffffff8
je 0x1800664c6
movsx eax, r13w
mov byte [rsp + 0x28], 1
mov dword [rsp + 0x20], eax
mov r9, r14
mov rdx, rdi
mov rcx, rdi
call fcn.18002fe00
mov rcx, qword [rsi + 0x20]
test rcx, rcx
je 0x1800664dc
call fcn.18007b7a8
mov qword [rsi + 0x20], 0
mov rcx, r12
call fcn.180078408
mov qword [rsi + 0x20], rax
mov r8, r12
mov rdx, rdi
mov rcx, rax
call fcn.18007abc0
mov dword [rsi + 0x28], r12d
mov al, 1
lea r11, [rsp + 0x50]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x48]
mov rsp, r11
pop r14
pop r13
pop r12
pop rdi
pop rsi
ret
Function at 0x18006a6f0
Capabilities:
Connect socket
Initialize winsock library
Resolve dns

Disassembly:
push rsi
push rdi
sub rsp, 0x1e8
mov rax, qword [0x1800d1eb0]
xor rax, rsp
mov qword [rsp + 0x1d0], rax
mov esi, edx
mov rdi, rcx
lea rdx, [rsp + 0x30]
mov ecx, 0x202
call qword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
je 0x18006a72c
xor eax, eax
jmp 0x18006a7c3
movzx edx, word [rsp + 0x30]
movzx eax, dx
shr ax, 8
cmp al, 2
jne 0x18006a7b8
cmp dl, al
jne 0x18006a7b8
xor r8d, r8d
mov qword [rsp + 0x210], rbx
mov qword [rsp + 0x1e0], rbp
mov ebp, 2
lea edx, [r8 + 1]
mov ecx, ebp
call qword [sym.imp.WS2_32.dll_socket]
mov rcx, rdi
mov rbx, rax
call qword [sym.imp.WS2_32.dll_gethostbyname]
movzx ecx, si
mov rdx, qword [rax + 0x18]
mov r8, qword [rdx]
mov edx, dword [r8]
mov word [rsp + 0x20], bp
mov dword [rsp + 0x24], edx
call qword [sym.imp.WS2_32.dll_htons]
lea r8d, [rbp + 0xe]
lea rdx, [rsp + 0x20]
mov rcx, rbx
mov word [rsp + 0x22], ax
call qword [sym.imp.WS2_32.dll_connect]
mov rbp, qword [rsp + 0x1e0]
mov rax, rbx
mov rbx, qword [rsp + 0x210]
jmp 0x18006a7c3
call qword [sym.imp.WS2_32.dll_WSACleanup]
mov eax, 1
mov rcx, qword [rsp + 0x1d0]
xor rcx, rsp
call fcn.18007a7c0
add rsp, 0x1e8
pop rdi
pop rsi
ret

Function at 0x18006a7e0
Capabilities:
Receive data
Receive data on socket

Disassembly:
push rbx
sub rsp, 0x430
mov rax, qword [0x1800d1eb0]
xor rax, rsp
mov qword [rsp + 0x420], rax
mov rbx, rcx
lea rcx, [rsp + 0x20]
xor edx, edx
mov r8d, 0x400
call fcn.18007e840
lea rdx, [rsp + 0x20]
xor r9d, r9d
mov r8d, 0x400
mov rcx, rbx
call qword [sym.imp.WS2_32.dll_recv]
mov rcx, qword [rsp + 0x420]
xor rcx, rsp
call fcn.18007a7c0
add rsp, 0x430
pop rbx
ret
Function at 0x18006c400
Capabilities:
Get graphical window text

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x840
mov rax, qword [0x1800d1eb0]
xor rax, rsp
mov qword [rsp + 0x830], rax
mov rbx, rcx
mov rdi, rdx
xor esi, esi
lea rcx, [rsp + 0x32]
xor edx, edx
mov r8d, 0x7fe
mov dword [rsp + 0x20], esi
mov word [rsp + 0x30], si
call fcn.18007e840
lea rdx, [rsp + 0x30]
mov r8d, 0x400
mov rcx, rdi
call qword [sym.imp.USER32.dll_GetWindowTextW]
or rcx, 0xffffffffffffffff
xor eax, eax
mov qword [rbx + 0x18], 7
mov qword [rbx + 0x10], rsi
mov word [rbx], si
lea rdi, [rsp + 0x30]
lea rdx, [rsp + 0x30]
repne scasw ax, word [rdi]
not rcx
lea r8, [rcx - 1]
mov rcx, rbx
call fcn.180004cc0
mov rax, rbx
mov rcx, qword [rsp + 0x830]
xor rcx, rsp
call fcn.18007a7c0
lea r11, [rsp + 0x840]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x18006f6b0
Capabilities:
Link many functions at runtime

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rbx, rcx
lea rcx, str.Kernel32.DLL
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rdi, rax
test rax, rax
je 0x18006f776
lea rdx, [0x1800ab410]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.Process32First
mov rcx, rdi
mov qword [rbx + 0x10], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.Process32Next
mov rcx, rdi
mov qword [rbx + 0x18], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.Module32First
mov rcx, rdi
mov qword [rbx + 0x20], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.Module32Next
mov rcx, rdi
mov qword [rbx + 0x28], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rdi
mov qword [rbx + 0x30], rax
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
cmp qword [rbx + 0x10], 0
je 0x18006f776
cmp qword [rbx + 0x18], 0
je 0x18006f776
cmp qword [rbx + 0x20], 0
je 0x18006f776
cmp qword [rbx + 0x28], 0
je 0x18006f776
cmp qword [rbx + 0x30], 0
je 0x18006f776
mov eax, 1
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
xor eax, eax
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x18007152c
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
sub rsp, 0x160
mov rax, qword [0x1800d1eb0]
mov qword [rsp + 0x150], rax
lea rdx, [0x1800d1640]
lea rcx, [rsp + 0x20]
mov r8d, 0x12c
call fcn.1800715fc
mov rdx, qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov r12, qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ebx, 0xe73d110a
lea rax, [rsp + 0x20]
mov ecx, 0x4b
xor rdx, rbx
xor r12, rbx
xor dword [rax], ebx
add rax, 4
dec rcx
jne 0x180071583
lea rcx, [rsp + 0x20]
xor rdx, rbx
call rdx
test rax, rax
mov rsi, rax
je 0x1800715d0
xor r12, rbx
lea rdi, [rsp + 0x34]
mov ebp, recv
lea rbx, [0x1800d15c8]
mov rdx, rdi
mov rcx, rsi
call r12
add rdi, 0x14
mov qword [rbx], rax
add rbx, 8
dec rbp
jne 0x1800715b4
lea eax, [rbp + 1]
mov rcx, qword [rsp + 0x150]
call fcn.18007a7c0
add rsp, 0x160
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x180071edc
Capabilities:
Encode data using xor
Encrypt data using aes
Reference aes constants

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
sub rsp, 0x50
mov rax, qword [0x1800d1eb0]
mov qword [rsp + 0x40], rax
mov r12d, dword [rdx + 0x1c]
xor edi, edi
xor esi, esi
sub r12d, 6
mov rbp, rdx
test r12d, r12d
movsxd rbx, r12d
jle 0x180071f1e
mov rdx, rcx
mov r8, rbx
lea rcx, [rsp + 0x20]
shl r8, 2
call fcn.18007abc0
xor r8d, r8d
xor edx, edx
test r12d, r12d
jle 0x180071f68
lea r9d, [r8 + 8]
cmp edi, dword [rbp + 0x1c]
jg 0x180071f68
jmp 0x180071f4e
cmp rdx, 4
jge 0x180071f57
mov eax, dword [rsp + r8*4 + 0x20]
lea rcx, [r9 + rdx]
inc r8
inc esi
inc rdx
mov dword [rbp + rcx*4], eax
cmp r8, rbx
jl 0x180071f33
cmp rdx, 4
jne 0x180071f63
inc edi
add r9, 4
xor esi, esi
xor edx, edx
cmp r8, rbx
jl 0x180071f2c
cmp edi, dword [rbp + 0x1c]
movsxd r10, edi
movsxd r9, esi
jg 0x180072093
lea r11, [0x1800d1250]
lea rsi, str.cw
movzx ecx, byte [rsp + rbx*4 + 0x1d]
mov al, byte [rsp + 0x20]
xor al, byte [rcx + rsi]
mov byte [rsp + 0x20], al
movzx eax, byte [rsp + rbx*4 + 0x1e]
mov al, byte [rax + rsi]
xor byte [rsp + 0x21], al
movzx eax, byte [rsp + rbx*4 + 0x1f]
mov al, byte [rax + rsi]
xor byte [rsp + 0x22], al
movzx eax, byte [rsp + rbx*4 + 0x1c]
mov al, byte [rax + rsi]
xor byte [rsp + 0x23], al
mov al, byte [r11]
add r11, 4
xor byte [rsp + 0x20], al
cmp r12d, 8
je 0x180071fe3
mov ecx, 1
jmp 0x180071fdc
mov eax, dword [rsp + rcx*4 + 0x1c]
xor dword [rsp + rcx*4 + 0x20], eax
inc rcx
cmp rcx, rbx
jl 0x180071fd1
jmp 0x180072040
lea rcx, [rsp + 0x24]
mov edx, 3
mov eax, dword [rcx - 4]
xor dword [rcx], eax
add rcx, 4
dec rdx
jne 0x180071fed
movzx eax, byte [rsp + 0x2c]
lea ecx, [rdx + 5]
mov al, byte [rax + rsi]
xor byte [rsp + 0x30], al
movzx eax, byte [rsp + 0x2d]
mov al, byte [rax + rsi]
xor byte [rsp + 0x31], al
movzx eax, byte [rsp + 0x2e]
mov al, byte [rax + rsi]
xor byte [rsp + 0x32], al
movzx eax, byte [rsp + 0x2f]
mov al, byte [rax + rsi]
xor byte [rsp + 0x33], al
jmp 0x18007203b
mov eax, dword [rsp + rcx*4 + 0x1c]
xor dword [rsp + rcx*4 + 0x20], eax
inc rcx
cmp rcx, rbx
jl 0x180072030
xor edx, edx
test r12d, r12d
jle 0x18007208a
lea r8, [r10*4 + 8]
cmp edi, dword [rbp + 0x1c]
jg 0x180072093
jmp 0x18007206e
cmp r9, 4
jge 0x180072077
mov eax, dword [rsp + rdx*4 + 0x20]
lea rcx, [r9 + r8]
inc rdx
mov dword [rbp + rcx*4], eax
inc r9
cmp rdx, rbx
jl 0x180072056
cmp r9, 4
jne 0x180072085
inc edi
inc r10
add r8, 4
xor r9d, r9d
cmp rdx, rbx
jl 0x18007204f
cmp edi, dword [rbp + 0x1c]
jle 0x180071f85
mov rcx, qword [rsp + 0x40]
call fcn.18007a7c0
add rsp, 0x50
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x1800720bc
Capabilities:
Encode data using xor

Disassembly:
mov r10d, 1
mov r8, rcx
cmp dword [rcx + 0x1c], r10d
jle 0x1800721ca
lea r9, [rcx + 0x32]
lea r11, [0x180000000]
movzx edx, byte [r9 + 1]
movzx eax, byte [r9 - 1]
inc r10d
mov ecx, dword [r11 + rdx*4 + 0xd0e50]
xor ecx, dword [r11 + rax*4 + 0xd0650]
movzx eax, byte [r9]
add r9, 0x10
xor ecx, dword [r11 + rax*4 + 0xd0a50]
movzx eax, byte [r9 - 0x12]
xor ecx, dword [r11 + rax*4 + 0xd0250]
mov dword [r9 - 0x12], ecx
movzx ecx, byte [r9 - 0xb]
movzx eax, byte [r9 - 0xc]
mov edx, dword [r11 + rcx*4 + 0xd0e50]
xor edx, dword [r11 + rax*4 + 0xd0a50]
movzx eax, byte [r9 - 0xd]
xor edx, dword [r11 + rax*4 + 0xd0650]
movzx eax, byte [r9 - 0xe]
xor edx, dword [r11 + rax*4 + 0xd0250]
mov dword [r9 - 0xe], edx
movzx ecx, byte [r9 - 7]
movzx eax, byte [r9 - 8]
mov edx, dword [r11 + rcx*4 + 0xd0e50]
xor edx, dword [r11 + rax*4 + 0xd0a50]
movzx eax, byte [r9 - 9]
xor edx, dword [r11 + rax*4 + 0xd0650]
movzx eax, byte [r9 - 0xa]
xor edx, dword [r11 + rax*4 + 0xd0250]
mov dword [r9 - 0xa], edx
movzx eax, byte [r9 - 4]
movzx ecx, byte [r9 - 3]
mov edx, dword [r11 + rcx*4 + 0xd0e50]
xor edx, dword [r11 + rax*4 + 0xd0a50]
movzx eax, byte [r9 - 5]
xor edx, dword [r11 + rax*4 + 0xd0650]
movzx eax, byte [r9 - 6]
xor edx, dword [r11 + rax*4 + 0xd0250]
mov dword [r9 - 6], edx
cmp r10d, dword [r8 + 0x1c]
jl 0x1800720da
ret
Function at 0x180072c1c
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbx
push rdi
sub rsp, 0x48
mov rax, qword [0x1800d1eb0]
mov qword [rsp + 0x38], rax
mov edi, 8
lea rdx, [0x1800d15e0]
lea rcx, [rsp + 0x20]
mov r8d, edi
call fcn.1800715fc
mov rbx, qword [rsp + 0x20]
lea rdx, [0x1800d15d8]
lea rcx, [rsp + 0x20]
mov r8d, edi
call fcn.1800715fc
mov rdi, qword [rsp + 0x20]
lea r8, [rsp + 0x28]
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x28], 0x475f4352
mov dword [rsp + 0x2c], 0x646e6172
mov dword [rsp + 0x30], 0x6e65704f
mov dword [rsp + 0x34], 0x676f44
call rbx
test rax, rax
mov rbx, rax
je 0x180072ca6
mov edx, 0xffffffff
mov rcx, rax
call rdi
mov rax, rbx
mov rcx, qword [rsp + 0x38]
call fcn.18007a7c0
add rsp, 0x48
pop rdi
pop rbx
ret

Function at 0x180072cbc
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rdi
sub rsp, 0x28
mov eax, dword [0x1800d1570]
xor edi, edi
mov rbx, rcx
and eax, 3
cmp eax, edi
je 0x180072d51
dec eax
je 0x180072d2d
dec eax
je 0x180072d09
dec eax
jne 0x180072d73
mov eax, dword [0x1800d1580]
lea rdx, [rcx + 2]
lea rcx, [rsp + 0x40]
mov dword [rsp + 0x40], eax
call fcn.180072dcc
add dword [0x1800d1580], 0x3f2
jmp 0x180072d73
mov eax, dword [0x1800d157c]
lea rdx, [rcx + 2]
lea rcx, [rsp + 0x40]
mov dword [rsp + 0x40], eax
call fcn.180072dcc
add dword [0x1800d157c], 0x3f2
jmp 0x180072d73
mov eax, dword [0x1800d1578]
lea rdx, [rcx + 2]
lea rcx, [rsp + 0x40]
mov dword [rsp + 0x40], eax
call fcn.180072dcc
add dword [0x1800d1578], 0x3f2
jmp 0x180072d73
mov eax, dword [0x1800d1574]
lea rdx, [rcx + 2]
lea rcx, [rsp + 0x40]
mov dword [rsp + 0x40], eax
call fcn.180072dcc
add dword [0x1800d1574], 0x3f2
movzx eax, word [rbx + 2]
add dword [0x1800d1570], 0x3eb
lea rdx, [rbx + 0x12]
xor word [rbx], ax
mov eax, edi
inc edi
and eax, 3
shl eax, 2
mov ecx, dword [rax + rbx + 2]
xor dword [rdx], ecx
add rdx, 4
cmp edi, 0xa
jb 0x180072d88
mov al, byte [rbx + 0x10]
mov rcx, rbx
xor byte [rbx + 0x42], al
mov al, byte [rbx + 0x11]
xor byte [rbx + 0x43], al
call fcn.180072e9c
add rsp, 0x28
pop rdi
pop rbx
ret
Function at 0x18007306c
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 8], rcx
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x48
test r8b, 0xf
mov r13d, r8d
mov rbp, rdx
mov r12, rcx
je 0x18007309f
mov eax, 1
jmp 0x1800731c7
test r8d, r8d
je 0x1800731c5
add rcx, 0x14
lea rdx, [r12 + 0x10]
mov eax, dword [rbp]
mov r14d, dword [rbp + 4]
mov r15d, dword [rbp + 8]
add r14d, dword [r12 + 8]
mov dword [rsp + 0x24], eax
mov eax, dword [rbp + 0xc]
add rbp, 0x10
add r13d, 0xfffffff0
add eax, dword [r12 + 0xc]
mov qword [rsp + 0x98], rbp
mov ebp, dword [rsp + 0x24]
mov dword [rsp + 0xa0], r13d
mov r12d, eax
mov r13, rcx
mov qword [rsp + 0x28], socket
mov rsi, rdx
lea ecx, [r14 + r14 + 1]
mov edx, 5
imul ecx, r14d
call fcn.1800731ec
lea ecx, [r12 + r12 + 1]
mov edx, 5
mov edi, eax
imul ecx, r12d
call fcn.1800731ec
mov ecx, edi
mov edx, eax
xor ecx, ebp
mov ebx, eax
call fcn.1800731ec
xor ebx, r15d
mov edx, edi
add eax, dword [rsi]
mov ecx, ebx
mov ebp, r14d
mov dword [rsp + 0x24], eax
call fcn.1800731ec
add rsi, 8
mov r14d, eax
mov eax, dword [rsp + 0x24]
mov r15d, r12d
add r14d, dword [r13]
add r13, 8
dec qword [rsp + 0x28]
mov r12d, eax
jne 0x1800730fb
mov rsi, qword [rsp + 0xa8]
mov r12, qword [rsp + 0x90]
mov r13d, dword [rsp + 0xa0]
mov ecx, dword [r12 + 0xb0]
add r15d, dword [r12 + 0xb4]
lea edx, [rbp + rcx]
mov rbp, qword [rsp + 0x98]
lea rcx, [r12 + 0x14]
mov dword [rsi], edx
mov dword [rsi + 4], r14d
mov dword [rsi + 8], r15d
mov dword [rsi + 0xc], eax
add rsi, 0x10
test r13d, r13d
mov qword [rsp + 0xa8], rsi
lea rdx, [r12 + 0x10]
jne 0x1800730b1
xor eax, eax
add rsp, 0x48
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret

Function at 0x1800732dc
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rbp
push rsi
push rdi
sub rsp, 0x28
mov rdi, rcx
mov rax, rcx
mov esi, r8d
mov ecx, 4
mov rbp, rdx
xor dword [rax], 0x41dfac36
add rax, 4
dec rcx
jne 0x1800732f6
mov eax, dword [rdi + 0x10]
mov r8d, eax
lea ecx, [rax + rsi*8]
shr r8d, 3
mov eax, esi
shl eax, 3
and r8d, 0x3f
mov dword [rdi + 0x10], ecx
cmp ecx, eax
jae 0x180073325
inc dword [rdi + 0x14]
mov eax, esi
mov ebx, 0x40
shr eax, 0x1d
sub ebx, r8d
add dword [rdi + 0x14], eax
cmp esi, ebx
jb 0x180073370
lea rcx, [r8 + rdi + 0x18]
mov r8d, ebx
call 0x180073ccc
lea rdx, [rdi + 0x18]
mov rcx, rdi
call fcn.18007344c
jmp 0x180073364
mov edx, ebx
mov rcx, rdi
add rdx, rbp
call fcn.18007344c
add ebx, 0x40
lea eax, [rbx + 0x3f]
cmp eax, esi
jb 0x180073354
xor r8d, r8d
jmp 0x180073372
xor ebx, ebx
sub esi, ebx
lea rcx, [r8 + rdi + 0x18]
mov edx, ebx
add rdx, rbp
mov r8d, esi
add rsp, 0x28
pop rdi
pop rsi
pop rbp
pop rbx
jmp 0x180073ccc
test r8d, r8d
je 0x180073ce4
sub rdx, rcx
mov r8d, r8d
mov al, byte [rdx + rcx]
mov byte [rcx], al
inc rcx
dec r8
jne 0x180073cd7
ret