joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180045820
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r14
push r15
lea rbp, [rsp - 0x37]
sub rsp, 0xc0
mov rax, qword [0x180107070]
xor rax, rsp
mov qword [rbp + 0x27], rax
mov rsi, r8
mov r15, rdx
mov rdi, rcx
mov qword [rbp - 0x51], rcx
mov qword [rbp - 1], r8
xor ebx, ebx
mov dword [rbp - 0x59], ebx
mov qword [rcx], rbx
mov qword [rcx + 0x10], rbx
mov qword [rcx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rcx], bl
mov dword [rbp - 0x59], 1
call fcn.18007b0f0
mov r14, rax
test rax, rax
je 0x1800459e3
lea rdx, [rbp - 0x21]
mov rcx, rsi
call fcn.180063910
mov rdx, rax
lea rcx, [rbp - 0x41]
call fcn.1800451d0
nop
lea r9d, [rbx + 5]
lea r8, str.data
mov rcx, rax
call fcn.18006da50
movups xmm0, xmmword [rax]
movups xmmword [rbp + 7], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x17], xmm1
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], bl
mov dword [rbp - 0x59], 5
mov rdx, qword [rbp - 0x29]
cmp rdx, 0x10
jb 0x180045913
inc rdx
mov rcx, qword [rbp - 0x41]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18004590e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x18004590e
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1800cf59c
mov r8, r15
mov edx, 0x2712
mov rcx, r14
call fcn.18007dea0
mov dword [rbp - 1], 0x8b9d8d8a
mov word [rbp + 3], 0x100
lea eax, [rbx - 0x19]
xor byte [rbp + rbx - 1], al
inc rbx
cmp rbx, 4
jb 0x180045930
mov byte [rbp + 4], 0
lea r8, [rbp - 1]
mov edx, 0x2722
mov rcx, r14
call fcn.18007dea0
lea r8, [rbp + 7]
cmp qword [rbp + 0x1f], 0x10
cmovae r8, qword [rbp + 7]
mov edx, 0x271f
mov rcx, r14
call fcn.18007dea0
lea r8, [0x1800457f0]
mov edx, 0x4e2b
mov rcx, r14
call fcn.18007dea0
mov r8, rdi
mov edx, 0x2711
mov rcx, r14
call fcn.18007dea0
mov rcx, r14
call fcn.18007b1b0
mov rcx, r14
call fcn.18007b0d0
mov rdx, qword [rbp + 0x1f]
cmp rdx, 0x10
jb 0x1800459e3
inc rdx
mov rcx, qword [rbp + 7]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800459dd
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1800459dd
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1800cf59c
nop
mov rcx, rsi
call fcn.1800662f0
lea rcx, [rsi + 8]
movzx edx, byte [rsi]
call fcn.180065db0
nop
mov rax, rdi
mov rcx, qword [rbp + 0x27]
xor rcx, rsp
call fcn.1800cf2e0
mov rbx, qword [rsp + 0x108]
add rsp, 0xc0
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret

Function at 0x180045a20
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 5], 0
je 0x180045a43
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x19]
xor byte [rax + rcx], dl
inc rax
cmp rax, 4
jb 0x180045a30
mov byte [rcx + 5], 0
mov rax, rcx
ret

Function at 0x180045b80
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x10], 0
je 0x180045ba3
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x19]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0xf
jb 0x180045b90
mov byte [rcx + 0x10], 0
mov rax, rcx
ret
Function at 0x180046910
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 6], 0
je 0x180046933
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x19]
xor byte [rax + rcx], dl
inc rax
cmp rax, 5
jb 0x180046920
mov byte [rcx + 6], 0
mov rax, rcx
ret
Function at 0x180046e50
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x13], 0
je 0x180046e73
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x19]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x12
jb 0x180046e60
mov byte [rcx + 0x13], 0
mov rax, rcx
ret

Function at 0x180046e80
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 3], 0
je 0x180046ea3
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x19]
xor byte [rax + rcx], dl
inc rax
cmp rax, 2
jb 0x180046e90
mov byte [rcx + 3], 0
mov rax, rcx
ret

Function at 0x180046eb0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0xc], 0
je 0x180046ed3
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x19]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0xb
jb 0x180046ec0
mov byte [rcx + 0xc], 0
mov rax, rcx
ret

Function at 0x180046ee0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x14], 0
je 0x180046f03
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x19]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x13
jb 0x180046ef0
mov byte [rcx + 0x14], 0
mov rax, rcx
ret

Function at 0x180046f10
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0xf], 0
je 0x180046f33
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x19]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0xe
jb 0x180046f20
mov byte [rcx + 0xf], 0
mov rax, rcx
ret
Function at 0x1800478e0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 4], 0
je 0x180047903
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x19]
xor byte [rax + rcx], dl
inc rax
cmp rax, 3
jb 0x1800478f0
mov byte [rcx + 4], 0
mov rax, rcx
ret
Function at 0x18004fc70
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 7], 0
je 0x18004fc93
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x19]
xor byte [rax + rcx], dl
inc rax
cmp rax, 6
jb 0x18004fc80
mov byte [rcx + 7], 0
mov rax, rcx
ret

Function at 0x18004fca0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0xa], 0
je 0x18004fcc3
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x19]
xor byte [rax + rcx], dl
inc rax
cmp rax, 9
jb 0x18004fcb0
mov byte [rcx + 0xa], 0
mov rax, rcx
ret

Function at 0x18004fcd0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x11], 0
je 0x18004fcf3
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x19]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x10
jb 0x18004fce0
mov byte [rcx + 0x11], 0
mov rax, rcx
ret

Function at 0x18004fd00
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x15], 0
je 0x18004fd23
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x19]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x14
jb 0x18004fd10
mov byte [rcx + 0x15], 0
mov rax, rcx
ret

Function at 0x18004fd30
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x17], 0
je 0x18004fd53
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x19]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x16
jb 0x18004fd40
mov byte [rcx + 0x17], 0
mov rax, rcx
ret

Function at 0x18004fd60
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x1c], 0
je 0x18004fd83
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x19]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x1b
jb 0x18004fd70
mov byte [rcx + 0x1c], 0
mov rax, rcx
ret

Function at 0x18004fd90
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x19], 0
je 0x18004fdb3
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x19]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x18
jb 0x18004fda0
mov byte [rcx + 0x19], 0
mov rax, rcx
ret

Function at 0x18004fdc0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x1a], 0
je 0x18004fde3
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x19]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x19
jb 0x18004fdd0
mov byte [rcx + 0x1a], 0
mov rax, rcx
ret

Function at 0x18004fdf0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x16], 0
je 0x18004fe13
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x19]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x15
jb 0x18004fe00
mov byte [rcx + 0x16], 0
mov rax, rcx
ret

Function at 0x18004fe20
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0xe], 0
je 0x18004fe43
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x19]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0xd
jb 0x18004fe30
mov byte [rcx + 0xe], 0
mov rax, rcx
ret

Function at 0x18004fe50
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x12], 0
je 0x18004fe73
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x19]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x11
jb 0x18004fe60
mov byte [rcx + 0x12], 0
mov rax, rcx
ret
Function at 0x18004fe80
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x18], 0
je 0x18004fea3
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x19]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x17
jb 0x18004fe90
mov byte [rcx + 0x18], 0
mov rax, rcx
ret

Function at 0x18004feb0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 8], 0
je 0x18004fed3
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x19]
xor byte [rax + rcx], dl
inc rax
cmp rax, 7
jb 0x18004fec0
mov byte [rcx + 8], 0
mov rax, rcx
ret

Function at 0x18004fee0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0xd], 0
je 0x18004ff03
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x19]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0xc
jb 0x18004fef0
mov byte [rcx + 0xd], 0
mov rax, rcx
ret

Function at 0x18004ff10
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0xb], 0
je 0x18004ff33
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x19]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0xa
jb 0x18004ff20
mov byte [rcx + 0xb], 0
mov rax, rcx
ret

Function at 0x18004ff40
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 9], 0
je 0x18004ff63
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x19]
xor byte [rax + rcx], dl
inc rax
cmp rax, 8
jb 0x18004ff50
mov byte [rcx + 9], 0
mov rax, rcx
ret
Function at 0x180060c00
Capabilities:
Enumerate process modules

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x280
mov rax, qword [0x180107070]
xor rax, rsp
mov qword [rsp + 0x270], rax
mov ebx, r8d
mov rsi, rcx
mov qword [rsp + 0x28], rcx
xor eax, eax
mov dword [rsp + 0x20], eax
mov qword [rcx], rax
mov qword [rcx + 0x10], rax
mov qword [rcx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rcx], al
mov dword [rsp + 0x20], 1
lea ecx, [rax + 0xf]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rdi, rax
mov dword [rsp + 0x30], 0x238
lea rdx, [rsp + 0x30]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Module32First]
test eax, eax
je 0x180060cb7
mov ecx, dword [rsp + 0x48]
cmp ebx, ecx
jb 0x180060c84
add ecx, dword [rsp + 0x50]
cmp ebx, ecx
jbe 0x180060c94
lea rdx, [rsp + 0x30]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_Module32Next]
jmp 0x180060c70
lea rax, [rsp + 0x60]
mov r8, 0xffffffffffffffff
inc r8
cmp byte [rax + r8], 0
jne 0x180060ca0
lea rdx, [rsp + 0x60]
mov rcx, rsi
call fcn.180046fa0
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rax, rsi
mov rcx, qword [rsp + 0x270]
xor rcx, rsp
call fcn.1800cf2e0
lea r11, [rsp + 0x280]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret

Function at 0x180060cf0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
mov rbp, rsp
sub rsp, 0x80
mov rax, qword [0x180107070]
xor rax, rsp
mov qword [rbp - 0x10], rax
movdqa xmm0, xmmword [0x1800f3cf0]
xor eax, eax
mov qword [rbp - 0x18], rax
mov edx, eax
mov dword [rbp - 0x20], eax
mov rbx, rcx
movdqu xmmword [rbp - 0x40], xmm0
mov dword [rbp - 0x30], 0x92ad9698
mov dword [rbp - 0x2c], 0x9a9c9989
mov word [rbp - 0x28], 0x100
nop dword [rax]
lea ecx, [rdx - 0x19]
xor byte [rbp + rdx - 0x40], cl
inc rdx
cmp rdx, 0x18
jb 0x180060d40
mov byte [rbp - 0x27], al
mov dword [rbp - 0x50], 0x868d9c89
mov dword [rbp - 0x4c], 0x8289c287
mov word [rbp - 0x48], 0x83
mov byte [rbp - 0x46], 1
nop dword [rax + rax]
lea ecx, [rax - 0x19]
xor byte [rbp + rax - 0x50], cl
inc rax
cmp rax, 9
jb 0x180060d70
lea rcx, [rbp - 0x50]
mov byte [rbp - 0x46], 0
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rcx, rax
lea rdx, [rbp - 0x40]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r9d, 8
lea rcx, [rbp - 0x20]
mov qword [rsp + 0x20], rcx
lea r8, [rbp - 0x18]
mov rcx, rbx
lea edx, [r9 + 1]
call rax
mov rax, qword [rbp - 0x18]
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.1800cf2e0
mov rbx, qword [rsp + 0x98]
add rsp, 0x80
pop rbp
ret
Function at 0x180062090
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x23], 0
je 0x1800620b3
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x19]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x22
jb 0x1800620a0
mov byte [rcx + 0x23], 0
mov rax, rcx
ret

Function at 0x180062260
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 9], 0
je 0x180062283
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x19]
xor byte [rax + rcx], dl
inc rax
cmp rax, 8
jb 0x180062270
mov byte [rcx + 9], 0
ret

Function at 0x180062290
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 8], 0
je 0x1800622b3
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x19]
xor byte [rax + rcx], dl
inc rax
cmp rax, 7
jb 0x1800622a0
mov byte [rcx + 8], 0
ret

Function at 0x1800622c0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x18], 0
je 0x1800622e3
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x19]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x17
jb 0x1800622d0
mov byte [rcx + 0x18], 0
ret

Function at 0x1800622f0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x12], 0
je 0x180062313
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x19]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x11
jb 0x180062300
mov byte [rcx + 0x12], 0
ret

Function at 0x180062320
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0xe], 0
je 0x180062343
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x19]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0xd
jb 0x180062330
mov byte [rcx + 0xe], 0
ret

Function at 0x180062350
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x16], 0
je 0x180062373
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x19]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x15
jb 0x180062360
mov byte [rcx + 0x16], 0
ret

Function at 0x180062380
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x1a], 0
je 0x1800623a3
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x19]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x19
jb 0x180062390
mov byte [rcx + 0x1a], 0
ret

Function at 0x1800623b0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x19], 0
je 0x1800623d3
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x19]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x18
jb 0x1800623c0
mov byte [rcx + 0x19], 0
ret

Function at 0x1800623e0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x1c], 0
je 0x180062403
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x19]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x1b
jb 0x1800623f0
mov byte [rcx + 0x1c], 0
ret

Function at 0x180062410
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x17], 0
je 0x180062433
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x19]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x16
jb 0x180062420
mov byte [rcx + 0x17], 0
ret

Function at 0x180062440
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x15], 0
je 0x180062463
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x19]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x14
jb 0x180062450
mov byte [rcx + 0x15], 0
ret
Function at 0x180062470
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x11], 0
je 0x180062493
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x19]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x10
jb 0x180062480
mov byte [rcx + 0x11], 0
ret

Function at 0x1800624a0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0xa], 0
je 0x1800624c3
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x19]
xor byte [rax + rcx], dl
inc rax
cmp rax, 9
jb 0x1800624b0
mov byte [rcx + 0xa], 0
ret

Function at 0x1800624d0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 7], 0
je 0x1800624f3
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x19]
xor byte [rax + rcx], dl
inc rax
cmp rax, 6
jb 0x1800624e0
mov byte [rcx + 7], 0
ret

Function at 0x180062500
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 4], 0
je 0x180062523
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x19]
xor byte [rax + rcx], dl
inc rax
cmp rax, 3
jb 0x180062510
mov byte [rcx + 4], 0
ret

Function at 0x180062540
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0xf], 0
je 0x180062563
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x19]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0xe
jb 0x180062550
mov byte [rcx + 0xf], 0
ret

Function at 0x180062570
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x14], 0
je 0x180062593
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x19]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x13
jb 0x180062580
mov byte [rcx + 0x14], 0
ret

Function at 0x1800625a0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x13], 0
je 0x1800625c3
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x19]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x12
jb 0x1800625b0
mov byte [rcx + 0x13], 0
ret

Function at 0x1800625d0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x10], 0
je 0x1800625f3
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x19]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0xf
jb 0x1800625e0
mov byte [rcx + 0x10], 0
ret

Function at 0x180062600
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 5], 0
je 0x180062623
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 0x19]
xor byte [rax + rcx], dl
inc rax
cmp rax, 4
jb 0x180062610
mov byte [rcx + 5], 0
ret
Function at 0x1800627a0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x50
mov rax, qword [0x180107070]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov rbx, rdx
mov r14, rcx
mov qword [rsp + 0x40], rdx
mov rcx, rdx
call fcn.180043570
mov rdx, qword [rbx + 0x10]
cmp qword [rbx + 0x18], 0x10
jb 0x1800627e9
mov rsi, qword [rbx]
lea rbp, [rdx + rsi]
mov rdi, rsi
jmp 0x1800627f3
lea rbp, [rbx + rdx]
mov rdi, rbx
mov rsi, rbx
cmp rdi, rbp
je 0x180062818
sub rsi, rdi
nop dword [rax + rax]
movsx ecx, byte [rdi]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_tolower]
mov byte [rsi + rdi], al
inc rdi
cmp rdi, rbp
jne 0x180062800
mov rdx, qword [rbx + 0x10]
mov r8, rbx
cmp qword [rbx + 0x18], 0x10
jb 0x180062825
mov r8, qword [rbx]
movabs r9, 0xcbf29ce484222325
xor r15d, r15d
mov ecx, r15d
test rdx, rdx
je 0x180062864
movabs r10, 0x100000001b3
nop dword [rax]
nop dword [rax + rax]
movzx eax, byte [rcx + r8]
xor r9, rax
imul r9, r10
inc rcx
cmp rcx, rdx
jb 0x180062850
mov r8, rbx
lea rdx, [rsp + 0x20]
mov rcx, r14
call fcn.180070370
mov rdi, qword [rax + 8]
test rdi, rdi
je 0x18006288c
cmp rdi, qword [r14 + 8]
je 0x18006288c
mov rdi, qword [rdi + 0x30]
jmp 0x180062953
mov rdi, qword [r14 + 0x48]
sub rdi, qword [r14 + 0x40]
sar rdi, 6
mov r8, rbx
lea rdx, [rsp + 0x20]
mov rcx, r14
call fcn.18006adf0
mov rcx, qword [rax]
mov qword [rcx + 0x30], rdi
mov qword [rsp + 0x20], r15
mov qword [rsp + 0x30], r15
mov qword [rsp + 0x38], reloc.WS2_32.dll_ntohs
mov byte [rsp + 0x20], 0
mov rsi, qword [r14 + 0x48]
cmp rsi, qword [r14 + 0x50]
je 0x1800628ff
mov rdx, rbx
mov rcx, rsi
call fcn.180064700
movups xmm0, xmmword [rsp + 0x20]
movups xmmword [rsi + 0x20], xmm0
movups xmm1, xmmword [rsp + 0x30]
movups xmmword [rsi + 0x30], xmm1
mov edx, reloc.WS2_32.dll_ntohs
mov byte [rsp + 0x20], 0
add qword [r14 + 0x48], 0x40
jmp 0x180062918
lea r9, [rsp + 0x20]
mov r8, rbx
mov rdx, rsi
lea rcx, [r14 + 0x40]
call fcn.180069e70
mov rdx, qword [rsp + 0x38]
cmp rdx, 0x10
jb 0x180062953
inc rdx
mov rcx, qword [rsp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18006294e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x18006294e
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1800cf59c
shl rdi, 6
add rdi, qword [r14 + 0x40]
mov rdx, qword [rbx + 0x18]
cmp rdx, 0x10
jb 0x180062991
inc rdx
mov rcx, qword [rbx]
cmp rdx, 0x1000
jb 0x18006298c
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x1800629c5
mov rcx, r8
call fcn.1800cf59c
mov qword [rbx + 0x10], r15
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], 0
lea rax, [rdi + 0x20]
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.1800cf2e0
mov rbx, qword [rsp + 0x90]
add rsp, 0x50
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
Function at 0x1800629d0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r14
sub rsp, 0xb0
mov rax, qword [0x180107070]
xor rax, rsp
mov qword [rsp + 0xa0], rax
mov rbx, rdx
mov r14, rcx
mov qword [rsp + 0x98], rdx
mov rcx, rdx
call fcn.180043570
mov rdx, qword [rbx + 0x10]
cmp qword [rbx + 0x18], 0x10
jb 0x180062a24
mov rsi, qword [rbx]
lea rbp, [rdx + rsi]
mov rdi, rsi
jmp 0x180062a2e
lea rbp, [rdx + rbx]
mov rdi, rbx
mov rsi, rbx
cmp rdi, rbp
je 0x180062a4e
sub rsi, rdi
movsx ecx, byte [rdi]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_tolower]
mov byte [rsi + rdi], al
inc rdi
cmp rdi, rbp
jne 0x180062a36
mov rdx, qword [rbx + 0x10]
mov r8, rbx
cmp qword [rbx + 0x18], 0x10
jb 0x180062a5b
mov r8, qword [rbx]
xor ecx, ecx
movabs r9, 0xcbf29ce484222325
test rdx, rdx
je 0x180062a94
movabs r10, 0x100000001b3
nop word [rax + rax]
movzx eax, byte [rcx + r8]
xor r9, rax
imul r9, r10
inc rcx
cmp rcx, rdx
jb 0x180062a80
mov r8, rbx
lea rdx, [rsp + 0x20]
mov rcx, r14
call fcn.180070370
mov rcx, qword [rax + 8]
test rcx, rcx
je 0x180062abc
cmp rcx, qword [r14 + 8]
je 0x180062abc
mov rsi, qword [rcx + 0x30]
jmp 0x180062b76
mov rcx, qword [r14 + 0x48]
sub rcx, qword [r14 + 0x40]
movabs rax, 0x8888888888888889
imul rcx
lea rsi, [rcx + rdx]
sar rsi, 6
mov rax, rsi
shr rax, 0x3f
add rsi, rax
mov r8, rbx
lea rdx, [rsp + 0x88]
mov rcx, r14
call fcn.18006adf0
mov rcx, qword [rax]
mov qword [rcx + 0x30], rsi
lea rcx, [rsp + 0x30]
call fcn.180065cb0
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x70], xmm0
mov qword [rsp + 0x80], 0
mov rdi, qword [r14 + 0x48]
cmp rdi, qword [r14 + 0x50]
je 0x180062b4d
mov qword [rsp + 0x20], rdi
mov rdx, rbx
mov rcx, rdi
call fcn.180064700
nop
lea rcx, [rdi + 0x20]
lea rdx, [rsp + 0x30]
call fcn.180074c80
nop
add qword [r14 + 0x48], 0x78
jmp 0x180062b62
lea r9, [rsp + 0x30]
mov r8, rbx
mov rdx, rdi
lea rcx, [r14 + 0x40]
call fcn.18006a030
nop
lea rcx, [rsp + 0x70]
call fcn.180066d50
lea rcx, [rsp + 0x30]
call fcn.180044a50
imul rdi, rsi, 0x78
add rdi, qword [r14 + 0x40]
mov rdx, qword [rbx + 0x18]
cmp rdx, 0x10
jb 0x180062bb4
inc rdx
mov rcx, qword [rbx]
cmp rdx, 0x1000
jb 0x180062baf
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x180062bf3
mov rcx, r8
call fcn.1800cf59c
mov qword [rbx + 0x10], 0
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], 0
lea rax, [rdi + 0x20]
mov rcx, qword [rsp + 0xa0]
xor rcx, rsp
call fcn.1800cf2e0
lea r11, [rsp + 0xb0]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3