joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1800cacb0
Capabilities:
Encode data using xor

Disassembly:
mov rax, rsp
sub rsp, 0xc88
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
xor eax, eax
mov edi, 0x9d
mov rsi, r8
mov qword [r8], rax
mov qword [r8 + 8], rax
mov dword [r8 + 0x10], eax
mov rax, qword [rdx]
mov r9d, dword [rdx + 0x10]
lea r10, [rsp + 0x34]
mov qword [rsp], rax
mov rax, qword [rdx + 8]
mov dword [rsp + 0x10], r9d
mov qword [rsp + 8], rax
mov rax, qword [rcx]
mov rbx, rdi
mov qword [rsp + 0x20], rax
mov rax, qword [rcx + 8]
mov qword [rsp + 0x28], rax
mov eax, dword [rcx + 0x10]
mov dword [rsp + 0x30], eax
nop
nop
nop
mov eax, dword [r10 - 0x14]
mov rdx, r10
mov r11d, 5
mov dword [r10], eax
mov eax, dword [r10 - 0x10]
mov dword [r10 + 4], eax
mov eax, dword [r10 - 0xc]
mov dword [r10 + 8], eax
mov eax, dword [r10 - 8]
mov dword [r10 + 0xc], eax
mov eax, dword [r10 - 4]
mov r8b, al
mov dword [r10 + 0x10], eax
and r8d, 1
shl r8d, 0x1d
nop
nop
mov eax, dword [rdx]
add rdx, 4
mov ecx, eax
shr ecx, 1
or ecx, r8d
mov r8d, eax
mov dword [rdx - 4], ecx
shl r8d, 0x1f
dec r11
jne 0x1800cad60
and dword [r10], 0x3fffffff
dec rbx
mov r10, rdx
jne 0x1800cad20
movsx rax, word [0x180236c60]
lea r11, [rsp]
mov rdx, rsi
lea rcx, [rax + rax*4]
sub r11, rsi
lea r8, [rsp + rcx*4 + 0x20]
lea ecx, [rbx + 5]
nop
nop
mov eax, dword [r11 + rdx]
add rdx, 4
add r8, 4
and eax, dword [r8 - 4]
dec rcx
mov dword [rdx - 4], eax
jne 0x1800cadb0
lea rbx, [0x180236edc]
jmp 0x1800cadd6
mov r9d, dword [rsp + 0x10]
and r9d, 1
lea rdx, [rsp]
mov r8d, 5
shl r9d, 0x1d
nop
nop
mov eax, dword [rdx]
add rdx, 4
mov ecx, eax
shr ecx, 1
or ecx, r9d
mov r9d, eax
mov dword [rdx - 4], ecx
shl r9d, 0x1f
dec r8
jne 0x1800cadf0
movsx rax, word [rbx - 0x27a]
and dword [rsp], 0x3fffffff
mov rdx, rsi
lea rcx, [rax + rax*4]
movsx rax, word [rbx]
mov r10d, 5
lea r8, [rsp + rcx*4 + 0x20]
lea rcx, [rax + rax*4]
lea r9, [rsp + rcx*4 + 0x20]
nop
nop
mov ecx, dword [r8]
mov eax, dword [r11 + rdx]
add rdx, 4
xor ecx, dword [r9]
add r9, 4
add r8, 4
and eax, ecx
xor dword [rdx - 4], eax
dec r10
jne 0x1800cae40
add rbx, 2
dec rdi
jne 0x1800cadd1
mov rdi, qword [rsp + 0xca8]
mov rsi, qword [rsp + 0xca0]
mov rbx, qword [rsp + 0xc98]
add rsp, 0xc88
ret
Function at 0x1800caea0
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x78
cmp edx, 0x13d
mov qword [rsp + 0x80], rbx
mov rbx, rcx
jne 0x1800caede
sub rbx, r8
mov r9d, 0xa
mov eax, dword [rbx + r8]
add r8, 4
dec r9
mov dword [r8 - 4], eax
jne 0x1800caec0
mov rbx, qword [rsp + 0x80]
add rsp, 0x78
ret
xor eax, eax
mov qword [rsp + 0x90], rsi
mov qword [rsp + 0x98], rdi
mov edi, reloc.WSOCK32.dll_sendto
mov qword [rsp], rax
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rax
mov qword [rsp + 0x18], rax
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x48], rax
mov dword [rsp + 0x50], eax
mov esi, edx
mov r11d, edi
mov al, dl
shr rsi, 5
lea r9d, [rdi - 0xa]
sub r11w, si
and ax, 0x1f
je 0x1800cafbd
mov qword [rsp + 0x88], rbp
mov qword [rsp + 0x70], r12
mov ecx, 0x20
sub cx, ax
movsx r12d, ax
movsx rax, r11w
mov qword [rsp + 0x68], r13
mov rbp, r9
lea r10, [rsp + rax*4]
movsx r13d, cx
add rbx, 0x24
nop
nop
nop
mov edx, dword [rbx]
mov ecx, r12d
dec r11w
mov eax, edx
sub rbx, 4
shl eax, cl
mov ecx, r13d
or dword [r10], eax
shr edx, cl
movsx rax, r11w
or dword [rsp + rax*4], edx
dec rbp
lea r10, [rsp + rax*4]
jne 0x1800caf80
mov r13, qword [rsp + 0x68]
mov r12, qword [rsp + 0x70]
mov rbp, qword [rsp + 0x88]
jmp 0x1800cafe8
lea r10d, [r11 + rsi - 0xb]
nop
nop
nop
nop
movsx rax, r10w
movsx rdx, r11w
dec r11w
mov ecx, dword [rbx + rax*4]
or dword [rsp + rdx*4], ecx
dec r10w
jns 0x1800cafd0
movsx rax, si
mov rsi, qword [rsp + 0x90]
mov r11, rdi
sub r11, rax
mov cx, ioctlsocket
movzx edx, di
cmp r11, rdi
ja 0x1800cb039
lea r10, [rsp + 0x2c]
nop
nop
mov eax, dword [r10]
dec cx
dec dx
shr eax, 0x1d
or dword [rsp + rdi*4], eax
movsx rax, cx
lea r10, [rsp + rax*4]
mov eax, dword [rsp + rax*4]
shl eax, 3
or dword [rsp + rdi*4], eax
movsx rdi, dx
cmp rdi, r11
jae 0x1800cb010
mov eax, dword [rsp + 0x2c]
mov rdi, qword [rsp + 0x98]
lea r10, [rsp + 0x2c]
and eax, 0x10000000
mov rcx, r8
neg eax
sbb edx, edx
sub r10, r8
nop
nop
mov eax, dword [r10 + rcx]
add rcx, 4
xor eax, edx
dec r9
mov dword [rcx - 4], eax
jne 0x1800cb060
and dword [r8], 0xfffffff
mov rbx, qword [rsp + 0x80]
add rsp, 0x78
ret
Function at 0x1800cbea0
Capabilities:
Encode data using xor
Execute anti-debugging instructions

Disassembly:
mov rax, rsp
sub rsp, 0x48
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov qword [rax - 8], r12
mov qword [rax - 0x10], r13
mov r13, rcx
xor ebp, ebp
xor esi, esi
xor ebx, ebx
xor ecx, ecx
test edx, edx
mov qword [rax - 0x18], r14
mov r12d, edx
mov edi, 8
mov r14d, edx
je 0x1800cbf5b
nop
add r12d, 0xffffffff
nop
nop
nop
dec edi
rdtsc
shl rdx, 0x20
mov r8d, ecx
lea rcx, [rsp + 0x20]
or rax, rdx
mov edx, 8
mov qword [rsp + 0x20], rax
call fcn.1800f2a70
mov r8d, eax
and eax, 1
xor esi, eax
rdtsc
shl rdx, 0x20
lea rcx, [rsp + 0x20]
or rax, rdx
mov edx, 8
mov qword [rsp + 0x20], rax
call fcn.1800f2a70
mov ecx, eax
and eax, 1
xor ebp, eax
cmp esi, ebp
je 0x1800cbef2
add ebx, ebx
or ebx, esi
test edi, edi
jne 0x1800cbef0
mov byte [r13], bl
xor ebx, ebx
inc r13
test r12d, r12d
lea edi, [rbx + 8]
jne 0x1800cbee0
mov r13, qword [rsp + 0x38]
mov r12, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x50]
mov eax, r14d
mov r14, qword [rsp + 0x30]
add rsp, 0x48
ret
Function at 0x1800d6410
Capabilities:
Encode data using xor

Disassembly:
mov r11, rsp
sub rsp, 0x388
mov ecx, dword [rcx + 4]
mov qword [r11 - 0x20], rdi
mov byte [rsp + 0x33], 0
mov eax, ecx
mov rdi, rdx
mov byte [rsp + 0x34], 0
shr eax, 0x10
mov byte [rsp + 0x35], 0
mov byte [rsp + 0x36], 0
mov byte [rsp + 0x30], al
mov eax, ecx
mov byte [rsp + 0x37], 0
shr eax, 8
shr r8d, 4
mov byte [rsp + 0x38], 0
mov byte [rsp + 0x39], 0
mov byte [rsp + 0x3a], 0
mov byte [rsp + 0x3b], 0
mov byte [rsp + 0x31], al
mov byte [rsp + 0x3c], 0
mov byte [rsp + 0x3d], 0
mov byte [rsp + 0x3e], 0
mov byte [rsp + 0x3f], 0
mov byte [rsp + 0x32], cl
je 0x1800d6567
mov qword [r11 - 8], rbx
mov qword [r11 - 0x10], rbp
mov rbp, qword [rsp + 0x3b0]
mov qword [r11 - 0x18], rsi
lea rbx, [r9 + 1]
mov esi, r8d
lea rcx, [0x18011b600]
call fcn.1800f2dc0
lea rcx, [rsp + 0x50]
xor r9d, r9d
mov qword [rsp + 0x20], rcx
lea r8d, [r9 + 0x10]
mov rdx, rbp
mov ecx, eax
call fcn.1800f2d40
test eax, eax
jne 0x1800d64eb
lea r9, [rsp + 0x50]
lea r8d, [rax + 0x10]
lea rdx, [rsp + 0x40]
mov rcx, rdi
call fcn.1800f42d0
lea rcx, [rsp + 0x50]
call fcn.1800f2c10
xor ecx, ecx
lea edx, [rcx + 4]
movzx eax, byte [rsp + rcx + 0x40]
add rcx, 4
xor al, byte [rsp + rcx + 0x2c]
mov byte [rbx + rcx - 5], al
movzx eax, byte [rsp + rcx + 0x3d]
xor al, byte [rsp + rcx + 0x2d]
mov byte [rbx + rcx - 4], al
movzx eax, byte [rsp + rcx + 0x3e]
xor al, byte [rsp + rcx + 0x2e]
mov byte [rbx + rcx - 3], al
movzx eax, byte [rsp + rcx + 0x3f]
xor al, byte [rsp + rcx + 0x2f]
dec rdx
mov byte [rbx + rcx - 2], al
jne 0x1800d64f0
lea r8d, [rdx + 0x10]
lea rcx, [rsp + 0x30]
mov rdx, rdi
call fcn.180079270
add rdi, 0x10
add rbx, 0x10
dec rsi
jne 0x1800d64a0
mov rsi, qword [rsp + 0x370]
mov rbp, qword [rsp + 0x378]
mov rbx, qword [rsp + 0x380]
xor eax, eax
mov rdi, qword [rsp + 0x368]
add rsp, 0x388
ret
Function at 0x1800d6580
Capabilities:
Encode data using xor

Disassembly:
mov r11, rsp
sub rsp, 0x388
mov ecx, dword [rcx + 4]
mov qword [r11 - 0x20], rdi
mov byte [rsp + 0x33], 0
mov eax, ecx
mov rdi, rdx
mov byte [rsp + 0x34], 0
shr eax, 0x10
mov byte [rsp + 0x35], 0
mov byte [rsp + 0x36], 0
mov byte [rsp + 0x30], al
mov eax, ecx
mov byte [rsp + 0x37], 0
shr eax, 8
shr r9d, 4
mov byte [rsp + 0x38], 0
mov byte [rsp + 0x39], 0
mov byte [rsp + 0x3a], 0
mov byte [rsp + 0x3b], 0
mov byte [rsp + 0x31], al
mov byte [rsp + 0x3c], 0
mov byte [rsp + 0x3d], 0
mov byte [rsp + 0x3e], 0
mov byte [rsp + 0x3f], 0
mov byte [rsp + 0x32], cl
je 0x1800d66e4
mov qword [r11 - 8], rbx
mov qword [r11 - 0x10], rbp
mov rbp, qword [rsp + 0x3b0]
mov qword [r11 - 0x18], rsi
lea rbx, [r8 + 1]
mov esi, r9d
xor ecx, ecx
lea edx, [rcx + 4]
nop
nop
nop
movzx eax, byte [rbx + rcx - 1]
add rcx, 4
xor al, byte [rsp + rcx + 0x2c]
mov byte [rsp + rcx + 0x3c], al
movzx eax, byte [rbx + rcx - 4]
xor al, byte [rsp + rcx + 0x2d]
mov byte [rsp + rcx + 0x3d], al
movzx eax, byte [rbx + rcx - 3]
xor al, byte [rsp + rcx + 0x2e]
mov byte [rsp + rcx + 0x3e], al
movzx eax, byte [rbx + rcx - 2]
xor al, byte [rsp + rcx + 0x2f]
dec rdx
mov byte [rsp + rcx + 0x3f], al
jne 0x1800d6620
lea rcx, [0x18011b600]
call fcn.1800f2dc0
lea rcx, [rsp + 0x50]
xor r9d, r9d
mov qword [rsp + 0x20], rcx
lea r8d, [r9 + 0x10]
mov rdx, rbp
mov ecx, eax
call fcn.1800f2d40
test eax, eax
jne 0x1800d66a8
lea r9, [rsp + 0x50]
lea r8d, [rax + 0x10]
lea rcx, [rsp + 0x40]
mov rdx, rdi
call fcn.1800f2c50
lea rcx, [rsp + 0x50]
call fcn.1800f2c10
lea rcx, [rsp + 0x30]
mov r8d, setsockopt
mov rdx, rdi
call fcn.180079270
add rdi, 0x10
add rbx, 0x10
dec rsi
jne 0x1800d6610
mov rsi, qword [rsp + 0x370]
mov rbp, qword [rsp + 0x378]
mov rbx, qword [rsp + 0x380]
xor eax, eax
mov rdi, qword [rsp + 0x368]
add rsp, 0x388
ret
Function at 0x1800f0bd0
Capabilities:
Encode data using xor

Disassembly:
mov rax, rsp
sub rsp, 0x78
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov qword [rax - 8], r12
xor esi, esi
mov edi, 5
mov rbx, r8
mov r12, rdx
mov rbp, rcx
mov rax, rcx
mov r9, rdi
mov r8d, esi
or r8d, dword [rax]
add rax, 4
dec r9
jne 0x1800f0c04
test r8d, r8d
jne 0x1800f0c39
mov rdx, rbx
mov rcx, r12
call fcn.1800ca650
mov rcx, rbx
call fcn.1800ca5e0
lea rdx, [rbx + 0x14]
mov rcx, rbx
call fcn.1800ca650
jmp 0x1800f0db2
lea rdx, [rsp + 0x50]
call fcn.1800cb090
lea rcx, [rsp + 0x50]
call fcn.1800ca590
lea r8, [rsp + 0x38]
lea rdx, [rsp + 0x50]
mov rcx, r12
call fcn.1800cacb0
lea rcx, [rsp + 0x38]
call fcn.1800ca5e0
mov r11d, esi
lea rax, [rsp + 0x38]
mov rcx, rdi
xor r11d, dword [rax]
add rax, 4
dec rcx
jne 0x1800f0c74
mov r9d, 0xffffffff
mov r8w, select
nop
nop
movsx ecx, r8w
mov edx, r11d
sar r8w, 1
shr r9d, cl
shr edx, cl
mov eax, r9d
and eax, r11d
mov r11d, edx
xor r11d, eax
test r8w, r8w
jg 0x1800f0c90
test r11d, r11d
je 0x1800f0cd2
mov rcx, rbx
call fcn.1800ca630
lea rcx, [rbx + 0x14]
call fcn.1800ca630
mov eax, 1
jmp 0x1800f0db4
lea rcx, [rsp + 0x20]
call fcn.1800ca630
xor dx, dx
mov r8d, 1
nop
nop
nop
mov rax, rsi
mov ecx, 4
mov r10d, 4
shr rax, 5
sub cx, ax
movsx eax, dx
inc eax
shr rax, 5
sub r10w, ax
movsx rax, cx
mov r9d, dword [rsp + rax*4 + 0x20]
xor r9d, dword [rsp + rax*4 + 0x38]
and r9d, r8d
cmp r10w, cx
jne 0x1800f0d3a
lea eax, [r9 + r9]
movsx rcx, r10w
or dword [rsp + rcx*4 + 0x20], eax
add r8d, r8d
jmp 0x1800f0d4e
test r9d, r9d
mov r8d, 1
je 0x1800f0d4e
movsx rax, r10w
mov dword [rsp + rax*4 + 0x20], r8d
inc dx
inc rsi
cmp dx, 0x9e
jl 0x1800f0cf0
mov eax, dword [rsp + 0x20]
xor eax, dword [rsp + 0x38]
bt eax, 0x1d
jae 0x1800f0d81
mov rcx, rbx
call fcn.1800ca630
lea rcx, [rbx + 0x14]
call fcn.1800ca630
mov eax, 2
jmp 0x1800f0db4
lea rdx, [rsp + 0x20]
mov r8, rbx
mov rcx, rbp
call fcn.1800cacb0
lea rcx, [rbx + 0x14]
call fcn.1800ca630
sub rbp, rbx
nop
mov eax, dword [rbx + rbp]
add rbx, 4
xor eax, dword [rbx - 4]
dec rdi
mov dword [rbx + 0x10], eax
jne 0x1800f0da0
xor eax, eax
mov r12, qword [rsp + 0x70]
mov rdi, qword [rsp + 0x98]
mov rsi, qword [rsp + 0x90]
mov rbp, qword [rsp + 0x88]
mov rbx, qword [rsp + 0x80]
add rsp, 0x78
ret

Function at 0x1800f0df0
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x58
mov qword [rsp + 0x68], rbx
mov qword [rsp + 0x70], rsi
mov rsi, rdx
lea rdx, [rsp + 0x20]
mov qword [rsp + 0x78], rdi
mov rbx, rcx
mov rdi, r8
call fcn.1800ca650
lea rcx, [rsp + 0x20]
call fcn.1800ca590
lea r8, [rsp + 0x38]
lea rdx, [rsp + 0x20]
mov rcx, rbx
call fcn.1800cacb0
cmp word [rsi], 0
mov rbx, qword [rsp + 0x68]
je 0x1800f0e50
lea rdx, [rsi + 2]
lea rcx, [rsp + 0x20]
mov r8, rdi
call fcn.1800cacb0
jmp 0x1800f0e58
mov rcx, rdi
call fcn.1800ca630
lea r8, [rsp + 0x38]
lea rcx, [rsi + 0x16]
mov rsi, qword [rsp + 0x70]
sub r8, rdi
mov edx, 5
nop
mov eax, dword [r8 + rdi]
add rdi, 4
add rcx, 4
xor eax, dword [rdi - 4]
xor eax, dword [rcx - 4]
dec rdx
mov dword [rdi - 4], eax
jne 0x1800f0e70
mov rdi, qword [rsp + 0x78]
add rsp, 0x58
ret
Function at 0x1800f0ea0
Capabilities:
Encode data using xor

Disassembly:
mov rax, rsp
sub rsp, 0xb8
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov qword [rax - 8], r12
mov rsi, rcx
mov qword [rax - 0x10], r13
lea rcx, [rsp + 0x20]
mov r12, r8
mov r13, r9
mov rbx, rdx
call fcn.1800ca630
lea rcx, [rsp + 0x68]
call fcn.1800ca630
lea rax, [rsp + 0x20]
mov rbp, rsi
mov r10, rsi
mov edi, 5
sub rbp, rbx
sub r10, rax
xor edx, edx
lea r11, [rbx + 0x14]
mov r8, rdi
lea rcx, [rsp + rdx + 0x20]
add r11, 4
add rdx, 4
mov eax, dword [r10 + rcx]
xor eax, dword [r11 - 0x18]
mov dword [rcx], eax
mov eax, dword [r11 + rbp - 4]
xor eax, dword [r11 - 4]
dec r8
mov dword [rsp + rdx + 0x64], eax
jne 0x1800f0f01
lea rdx, [rsp + 0x80]
lea rcx, [rsp + 0x20]
call fcn.1800cb090
lea r8, [rsp + 0x50]
lea rdx, [rsp + 0x68]
lea rcx, [rsp + 0x80]
call fcn.1800cacb0
lea rdx, [rsp + 0x38]
lea rcx, [rsp + 0x50]
call fcn.1800ca650
lea rcx, [rsp + 0x38]
call fcn.1800ca590
cmp word [r13], 0
je 0x1800f0fb8
lea r8, [rsp + 0x38]
lea r9, [rsp + 0x50]
mov r10, r12
sub r8, rbx
sub r9, rbx
lea rcx, [r13 + 2]
sub r10, rbx
mov rdx, rdi
mov eax, dword [r9 + rbx]
add rbx, 4
add rcx, 4
xor eax, dword [r8 + rbx - 4]
xor eax, dword [rbx + rbp - 4]
xor eax, dword [rcx - 4]
xor eax, dword [rbx - 4]
dec rdx
mov dword [r10 + rbx - 4], eax
jne 0x1800f0f91
jmp 0x1800f0ffd
lea rdx, [rsp + 0x38]
lea r8, [rsp + 0x50]
mov r9, r12
sub rdx, rbx
sub r8, rbx
sub r9, rbx
mov rcx, rdi
nop
nop
nop
nop
mov eax, dword [rbx + rbp]
add rbx, 4
xor eax, dword [rbx + r8 - 4]
xor eax, dword [rbx + rdx - 4]
xor eax, dword [rbx - 4]
dec rcx
mov dword [rbx + r9 - 4], eax
jne 0x1800f0fe0
mov r13, qword [rsp + 0xa8]
mov rbp, qword [rsp + 0xc8]
mov rbx, qword [rsp + 0xc0]
lea r8, [rsp + 0x20]
sub rsi, r12
mov rcx, r12
sub r8, r12
mov rdx, rdi
nop
nop
nop
mov eax, dword [rcx + rsi]
add rcx, 4
xor eax, dword [rcx - 4]
dec rdx
mov dword [rcx + r8 - 4], eax
jne 0x1800f1030
lea r8, [rsp + 0x38]
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x20]
call fcn.1800cacb0
lea rcx, [r12 + 0x14]
mov r12, qword [rsp + 0xb0]
lea r11, [rsp + 0x38]
nop
nop
mov eax, dword [rcx + rsi]
add rcx, 4
add r11, 4
xor eax, dword [rcx - 0x18]
xor eax, dword [r11 - 4]
dec rdi
mov dword [rcx - 4], eax
jne 0x1800f1070
mov rdi, qword [rsp + 0xd8]
mov rsi, qword [rsp + 0xd0]
add rsp, 0xb8
ret
Function at 0x1800f11c0
Capabilities:
Encode data using xor

Disassembly:
mov rax, rsp
sub rsp, 0xa8
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov rsi, rdx
mov qword [rax + 0x20], rdi
mov qword [rax - 8], r12
lea rdx, [rax - 0x70]
mov rbp, r8
mov r12, rcx
call fcn.1800cb090
lea rdx, [r12 + 0x14]
lea r8, [rsp + 0x20]
lea rcx, [rsp + 0x38]
call fcn.1800cacb0
lea r11, [rsp + 0x20]
mov r9, r12
sub r9, r11
xor ebx, ebx
mov edi, 5
mov rdx, rbx
mov r8, rdi
nop
lea rax, [rsp + rdx + 0x20]
add rdx, 4
mov ecx, dword [r9 + rax]
xor ecx, dword [rax]
dec r8
mov dword [rsp + rdx + 0x4c], ecx
jne 0x1800f1220
lea rdx, [rsp + 0x68]
lea rcx, [rsp + 0x50]
call fcn.1800ca650
lea rcx, [rsp + 0x68]
call fcn.1800ca590
cmp word [rbp], bx
je 0x1800f128e
lea rdx, [rbp + 2]
mov rcx, rbx
mov r8, rdi
nop
nop
nop
nop
mov eax, dword [rsp + rcx + 0x68]
add rcx, 4
add rdx, 4
xor eax, dword [rsp + rcx + 0x4c]
xor eax, dword [rdx - 4]
dec r8
mov dword [rcx + rsi - 4], eax
jne 0x1800f1270
jmp 0x1800f12b5
mov rcx, rbx
mov rdx, rdi
nop
nop
nop
mov eax, dword [rsp + rcx + 0x68]
add rcx, 4
xor eax, dword [rsp + rcx + 0x4c]
dec rdx
mov dword [rcx + rsi - 4], eax
jne 0x1800f12a0
mov rbp, qword [rsp + 0xb8]
mov qword [rsp + 0x20], 0xffffffffffffffff
and dword [rsp + 0x20], 0x3fffffff
mov qword [rsp + 0x28], 0xffffffffffffffff
mov dword [rsp + 0x30], 0xffffffff
mov rcx, rbx
mov rdx, rdi
nop
nop
nop
mov eax, dword [rsp + rcx + 0x50]
add rcx, 4
xor dword [rsp + rcx + 0x1c], eax
dec rdx
jne 0x1800f12f0
lea r8, [rsp + 0x80]
lea rcx, [rsp + 0x20]
mov rdx, rsi
call fcn.1800cacb0
lea rdx, [rsp + 0x38]
mov rcx, r12
call fcn.1800ca650
lea rcx, [rsp + 0x38]
call fcn.1800ca590
mov r12, qword [rsp + 0xa0]
lea r11, [rsi + 0x14]
mov rsi, qword [rsp + 0xc0]
mov eax, dword [rsp + rbx + 0x80]
add r11, 4
add rbx, 4
xor eax, dword [rsp + rbx + 0x34]
dec rdi
mov dword [r11 - 4], eax
jne 0x1800f1341
mov rdi, qword [rsp + 0xc8]
mov rbx, qword [rsp + 0xb0]
add rsp, 0xa8
ret
Function at 0x1800f1380
Capabilities:
Encode data using xor

Disassembly:
mov rax, rsp
sub rsp, 0x148
mov qword [rax + 0x10], rbp
mov qword [rax - 8], r12
mov qword [rax - 0x10], r13
mov r13, rdx
lea rdx, [rsp + 0x20]
mov r12, r9
mov rbp, r8
call fcn.1800ca650
xor ecx, ecx
lea rax, [rsp + 0x20]
mov r10d, 5
nop
nop
nop
or ecx, dword [rax]
add rax, 4
dec r10
jne 0x1800f13c0
test ecx, ecx
jne 0x1800f13e5
mov rcx, rbp
call fcn.1800ca630
lea rcx, [rbp + 0x14]
call fcn.1800ca630
jmp 0x1800f157c
mov qword [rsp + 0x150], rbx
xor bx, bx
test byte [rsp + 0x30], 1
je 0x1800f1427
movzx eax, byte [rsp + 0x30]
mov ecx, 2
and al, 3
sub cl, al
movsx rax, bx
mov byte [rsp + rax + 0x90], cl
jns 0x1800f1433
mov cx, 4
movsx rax, cx
inc dword [rsp + rax*4 + 0x20]
jne 0x1800f1433
dec cx
jns 0x1800f1416
jmp 0x1800f1433
movsx rax, bx
mov byte [rsp + rax + 0x90], 0
and dword [rsp + 0x30], 0xfffffffe
lea rcx, [rsp + 0x20]
call fcn.1800ca5e0
inc bx
xor ecx, ecx
lea rax, [rsp + 0x20]
mov edx, 5
or ecx, dword [rax]
add rax, 4
dec rdx
jne 0x1800f1451
test ecx, ecx
jne 0x1800f13f0
mov rdx, rbp
mov rcx, r13
mov qword [rsp + 0x160], rsi
dec bx
call fcn.1800ca650
lea rcx, [r13 + 0x14]
lea rdx, [rbp + 0x14]
call fcn.1800ca650
test bx, bx
jle 0x1800f156c
movsx rax, bx
mov qword [rsp + 0x168], rdi
lea rdi, [rsp + rax + 0x90]
lea rdx, [rsp + 0x38]
mov r8, r12
mov rcx, rbp
call fcn.1800f11c0
mov al, byte [rdi - 1]
dec rdi
dec bx
cmp al, 0xff
je 0x1800f14fb
test al, al
je 0x1800f14de
cmp al, 1
jne 0x1800f155b
lea rdx, [rsp + 0x38]
mov r9, r12
mov r8, rbp
mov rcx, r13
call fcn.1800f0ea0
jmp 0x1800f155b
lea rcx, [rsp + 0x38]
mov rdx, rbp
call fcn.1800ca650
lea rdx, [rbp + 0x14]
lea rcx, [rsp + 0x4c]
call fcn.1800ca650
jmp 0x1800f155b
lea rdx, [rsp + 0x60]
mov rcx, r13
call fcn.1800ca650
lea rcx, [rsp + 0x74]
call fcn.1800ca630
lea rdx, [rsp + 0x74]
mov r11, r13
sub rdx, r13
mov ecx, 5
nop
nop
nop
nop
mov eax, dword [r11 + 0x14]
add r11, 4
xor eax, dword [r11 - 4]
dec rcx
mov dword [rdx + r11 - 4], eax
jne 0x1800f1530
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0x38]
mov r9, r12
mov r8, rbp
call fcn.1800f0ea0
test bx, bx
jg 0x1800f14a0
mov rdi, qword [rsp + 0x168]
mov rsi, qword [rsp + 0x160]
mov rbx, qword [rsp + 0x150]
mov r13, qword [rsp + 0x138]
mov r12, qword [rsp + 0x140]
mov rbp, qword [rsp + 0x158]
add rsp, 0x148
ret
Function at 0x1800f2a70
Capabilities:
Encode data using xor

Disassembly:
cmp rdx, 3
mov qword [rsp + 0x18], rbx
mov r9d, 0x9e3779b9
mov qword [rsp + 0x20], rdi
mov rbx, rdx
mov r11, rdx
mov r10d, r9d
mov rdi, rcx
jb 0x1800f2b58
movabs rax, 0xaaaaaaaaaaaaaaab
mul rbx
shr rdx, 1
mov r11, rdx
imul r11, r11, 0xfffffffffffffffd
add r11, rbx
movzx eax, byte [rdi + 1]
movzx ecx, byte [rdi]
add rdi, 3
add r9d, eax
movzx eax, byte [rdi - 1]
add r8d, eax
sub ecx, r8d
mov eax, r8d
shr eax, 0xd
sub ecx, r9d
sub r9d, r8d
add r10d, ecx
xor r10d, eax
sub r9d, r10d
mov eax, r10d
shl eax, 8
xor r9d, eax
sub r8d, r9d
mov eax, r9d
sub r8d, r10d
shr eax, 0xd
xor r8d, eax
sub r10d, r8d
mov eax, r8d
shr eax, 0xc
sub r10d, r9d
sub r9d, r8d
xor r10d, eax
sub r9d, r10d
mov eax, r10d
shl eax, 0x10
xor r9d, eax
sub r8d, r9d
mov eax, r9d
sub r8d, r10d
shr eax, 5
xor r8d, eax
sub r10d, r8d
mov eax, r8d
shr eax, 3
sub r10d, r9d
sub r9d, r8d
xor r10d, eax
sub r9d, r10d
mov eax, r10d
shl eax, 0xa
xor r9d, eax
sub r8d, r9d
mov eax, r9d
sub r8d, r10d
shr eax, 0xf
xor r8d, eax
dec rdx
jne 0x1800f2ab0
add r8d, ebx
dec r11
mov rbx, qword [rsp + 0x18]
je 0x1800f2b71
dec r11
jne 0x1800f2b77
movzx eax, byte [rdi + 1]
add r9d, eax
movzx eax, byte [rdi]
add r10d, eax
mov rdi, qword [rsp + 0x20]
sub r10d, r8d
mov eax, r8d
sub r10d, r9d
sub r9d, r8d
shr eax, 0xd
xor r10d, eax
sub r9d, r10d
mov eax, r10d
shl eax, 8
xor r9d, eax
sub r8d, r9d
mov eax, r9d
sub r8d, r10d
shr eax, 0xd
xor r8d, eax
sub r10d, r8d
mov eax, r8d
sub r10d, r9d
sub r9d, r8d
shr eax, 0xc
xor r10d, eax
sub r9d, r10d
mov eax, r10d
shl eax, 0x10
xor r9d, eax
sub r8d, r9d
mov eax, r9d
sub r8d, r10d
shr eax, 5
xor r8d, eax
sub r10d, r8d
mov eax, r8d
sub r10d, r9d
sub r9d, r8d
shr eax, 3
xor r10d, eax
sub r9d, r10d
mov eax, r10d
shl eax, 0xa
xor r9d, eax
sub r8d, r9d
shr r9d, 0xf
sub r8d, r10d
xor r8d, r9d
mov eax, r8d
ret
Function at 0x1800f4ee0
Capabilities:
Encode data using xor

Disassembly:
sub rsp, 0x58
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x70], rsi
mov qword [rsp + 0x78], rdi
movsxd rdi, dword [rcx + 0x110]
mov rsi, rcx
mov qword [rsp + 0x50], r12
mov ecx, edi
mov r12, r8
mov rbx, rdx
call fcn.1800b0d20
test eax, eax
jne 0x1800f5098
mov qword [rsp + 0x68], rbp
mov qword [rsp + 0x48], r13
mov qword [rsp + 0x40], r14
mov r14, rdi
mov qword [rsp + 0x20], rdi
lea rdi, [0x18022d530]
mov qword [rsp + 0x38], r15
imul r14, r14, 0x78
mov ecx, dword [r14 + rdi + 0x10]
mov r13d, dword [r14 + rdi + 0xc]
call fcn.180079290
mov rcx, r13
mov r15, rax
call fcn.180079290
test r15, r15
mov rbp, rax
je 0x1800f5072
test rax, rax
je 0x1800f506d
mov rdx, rax
mov rcx, rsi
call qword [r14 + rdi + 0x68]
test eax, eax
mov edi, eax
jne 0x1800f504d
lea r11, [0x18022d530]
xor r8d, r8d
cmp dword [r14 + r11 + 0x10], r8d
jbe 0x1800f4fc0
mov r10, qword [rsp + 0x20]
mov r9, r15
imul r10, r10, 0x78
nop
mov rax, qword [rsi + 0x228]
inc r9
movzx edx, byte [r8 + rax]
inc r8d
xor dl, 0x5c
mov byte [r9 - 1], dl
cmp r8d, dword [r10 + r11 + 0x10]
jb 0x1800f4fa0
mov rcx, rsi
call qword [r14 + r11 + 0x58]
test eax, eax
mov edi, eax
jne 0x1800f504d
lea rax, [0x18022d530]
mov rdx, r15
mov rcx, rsi
mov r8d, dword [r14 + rax + 0x10]
call qword [r14 + rax + 0x60]
test eax, eax
mov edi, eax
jne 0x1800f504d
lea rax, [0x18022d530]
mov r8d, r13d
mov rdx, rbp
mov rcx, rsi
call qword [r14 + rax + 0x60]
test eax, eax
mov edi, eax
jne 0x1800f504d
lea rax, [0x18022d530]
mov rdx, r15
mov rcx, rsi
call qword [r14 + rax + 0x68]
test eax, eax
mov edi, eax
jne 0x1800f504d
xor ecx, ecx
test r13d, r13d
je 0x1800f5047
mov rdx, r15
sub rdx, rbx
nop
nop
cmp ecx, dword [r12]
jae 0x1800f5047
movzx eax, byte [rdx + rbx]
inc ecx
inc rbx
cmp ecx, r13d
mov byte [rbx - 1], al
jb 0x1800f5030
mov dword [r12], ecx
xor edi, edi
mov rcx, qword [rsi + 0x228]
call fcn.180078fc0
mov rcx, rbp
call fcn.180078fc0
mov rcx, r15
call fcn.180078fc0
mov eax, edi
jmp 0x1800f5084
mov rcx, r15
jmp 0x1800f507a
test rax, rax
je 0x1800f507f
mov rcx, rax
call fcn.180078fc0
mov eax, reloc.WSOCK32.dll_ioctlsocket
mov r14, qword [rsp + 0x40]
mov r13, qword [rsp + 0x48]
mov rbp, qword [rsp + 0x68]
mov r15, qword [rsp + 0x38]
mov r12, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x78]
mov rsi, qword [rsp + 0x70]
mov rbx, qword [rsp + 0x60]
add rsp, 0x58
ret