joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400021d0
Capabilities:
Enumerate pe sections

Disassembly:
movsxd rax, dword [rcx + 0x3c]
add rcx, rax
movzx eax, word [rcx + 0x14]
movzx r8d, word [rcx + 6]
lea rax, [rcx + rax + 0x18]
test r8w, r8w
je 0x14000221d
lea ecx, [r8 - 1]
lea rcx, [rcx + rcx*4]
lea r9, [rax + rcx*8 + 0x28]
nop dword [rax + rax]
mov r8d, dword [rax + 0xc]
mov rcx, r8
cmp rdx, r8
jb 0x140002214
add ecx, dword [rax + 8]
cmp rdx, rcx
jb 0x14000221f
add rax, 0x28
cmp rax, r9
jne 0x140002200
xor eax, eax
ret

Function at 0x140002220
Capabilities:
Parse pe header

Disassembly:
push rdi
push rsi
push rbx
sub rsp, 0x20
mov rsi, rcx
call sym.strlen
cmp rax, 8
ja 0x1400022b0
mov rdx, qword [0x14000a7b0]
xor ebx, ebx
cmp word [rdx], 0x5a4d
jne 0x14000229e
movsxd rax, dword [rdx + 0x3c]
add rax, rdx
cmp dword [rax], 0x4550
jne 0x14000229e
cmp word [rax + 0x18], 0x20b
jne 0x14000229e
movzx edx, word [rax + 0x14]
lea rbx, [rax + rdx + 0x18]
movzx edx, word [rax + 6]
test dx, dx
je 0x1400022b0
lea eax, [rdx - 1]
lea rax, [rax + rax*4]
lea rdi, [rbx + rax*8 + 0x28]
jmp 0x140002289
add rbx, 0x28
cmp rbx, rdi
je 0x1400022b0
mov r8d, 8
mov rdx, rsi
mov rcx, rbx
call sym.strncmp
test eax, eax
jne 0x140002280
mov rax, rbx
add rsp, 0x20
pop rbx
pop rsi
pop rdi
ret
xor ebx, ebx
mov rax, rbx
add rsp, 0x20
pop rbx
pop rsi
pop rdi
ret

Function at 0x1400022c0
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
mov rdx, qword [0x14000a7b0]
xor eax, eax
cmp word [rdx], 0x5a4d
jne 0x1400022e0
movsxd r8, dword [rdx + 0x3c]
add r8, rdx
cmp dword [r8], 0x4550
je 0x1400022e8
ret
cmp word [r8 + 0x18], 0x20b
jne 0x1400022e0
movzx eax, word [r8 + 0x14]
sub rcx, rdx
lea rax, [r8 + rax + 0x18]
movzx r8d, word [r8 + 6]
test r8w, r8w
je 0x14000233d
lea edx, [r8 - 1]
lea rdx, [rdx + rdx*4]
lea r9, [rax + rdx*8 + 0x28]
nop word cs:[rax + rax]
mov r8d, dword [rax + 0xc]
mov rdx, r8
cmp rcx, r8
jb 0x140002334
add edx, dword [rax + 8]
cmp rcx, rdx
jb 0x1400022e0
add rax, 0x28
cmp rax, r9
jne 0x140002320
xor eax, eax
ret

Function at 0x140002340
Capabilities:
Parse pe header

Disassembly:
mov rax, qword [0x14000a7b0]
xor ecx, ecx
cmp word [rax], 0x5a4d
jne 0x14000235f
movsxd rdx, dword [rax + 0x3c]
add rax, rdx
cmp dword [rax], 0x4550
je 0x140002368
mov eax, ecx
ret
cmp word [rax + 0x18], 0x20b
jne 0x14000235f
movzx ecx, word [rax + 6]
mov eax, ecx
ret

Function at 0x140002380
Capabilities:
Parse pe header

Disassembly:
mov r8, qword [0x14000a7b0]
xor eax, eax
cmp word [r8], 0x5a4d
jne 0x1400023a0
movsxd rdx, dword [r8 + 0x3c]
add rdx, r8
cmp dword [rdx], 0x4550
je 0x1400023a8
ret
cmp word [rdx + 0x18], 0x20b
jne 0x1400023a0
movzx eax, word [rdx + 0x14]
movzx r8d, word [rdx + 6]
lea rax, [rdx + rax + 0x18]
test r8w, r8w
je 0x1400023f0
lea edx, [r8 - 1]
lea rdx, [rdx + rdx*4]
lea rdx, [rax + rdx*8 + 0x28]
nop dword [rax]
test byte [rax + 0x27], 0x20
je 0x1400023e7
test rcx, rcx
je 0x1400023a0
sub rcx, 1
add rax, 0x28
cmp rdx, rax
jne 0x1400023d8
xor eax, eax
ret
Function at 0x140002400
Capabilities:
Parse pe header

Disassembly:
mov rax, qword [0x14000a7b0]
xor edx, edx
cmp word [rax], 0x5a4d
jne 0x14000241f
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
je 0x140002428
mov rax, rdx
ret
cmp word [rcx + 0x18], 0x20b
cmove rdx, rax
mov rax, rdx
ret

Function at 0x140002440
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
mov rdx, qword [0x14000a7b0]
xor eax, eax
cmp word [rdx], 0x5a4d
jne 0x140002460
movsxd r8, dword [rdx + 0x3c]
add r8, rdx
cmp dword [r8], 0x4550
je 0x140002468
ret
cmp word [r8 + 0x18], 0x20b
jne 0x140002460
sub rcx, rdx
movzx r9d, word [r8 + 6]
movzx edx, word [r8 + 0x14]
lea rdx, [r8 + rdx + 0x18]
test r9w, r9w
je 0x140002460
lea eax, [r9 - 1]
lea rax, [rax + rax*4]
lea r9, [rdx + rax*8 + 0x28]
nop word cs:[rax + rax]
mov r8d, dword [rdx + 0xc]
mov rax, r8
cmp rcx, r8
jb 0x1400024b4
add eax, dword [rdx + 8]
cmp rcx, rax
jb 0x1400024c0
add rdx, 0x28
cmp rdx, r9
jne 0x1400024a0
xor eax, eax
ret
mov eax, dword [rdx + 0x24]
not eax
shr eax, 0x1f
ret

Function at 0x1400024d0
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
mov r11, qword [0x14000a7b0]
xor r9d, r9d
cmp word [r11], 0x5a4d
jne 0x1400024f2
movsxd r8, dword [r11 + 0x3c]
add r8, r11
cmp dword [r8], 0x4550
je 0x140002500
mov rax, r9
ret
cmp word [r8 + 0x18], 0x20b
jne 0x1400024f2
mov eax, dword [r8 + 0x90]
test eax, eax
je 0x1400024f2
movzx edx, word [r8 + 0x14]
movzx r10d, word [r8 + 6]
lea rdx, [r8 + rdx + 0x18]
test r10w, r10w
je 0x1400024f2
lea r8d, [r10 - 1]
lea r8, [r8 + r8*4]
lea r10, [rdx + r8*8 + 0x28]
nop word cs:[rax + rax]
mov r9d, dword [rdx + 0xc]
mov r8, r9
cmp rax, r9
jb 0x140002555
add r8d, dword [rdx + 8]
cmp rax, r8
jb 0x140002568
add rdx, 0x28
cmp r10, rdx
jne 0x140002540
xor r9d, r9d
mov rax, r9
ret
add rax, r11
jmp 0x140002577
sub ecx, 1
add rax, 0x14
mov r8d, dword [rax + 4]
test r8d, r8d
jne 0x140002587
mov edx, dword [rax + 0xc]
test edx, edx
je 0x14000255e
test ecx, ecx
jg 0x140002570
mov r9d, dword [rax + 0xc]
add r9, r11
mov rax, r9
ret
Function at 0x180004790
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x47], 0
je 0x1800047b3
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 9]
xor byte [rcx + rax], dl
inc rax
cmp rax, 0x46
jb 0x1800047a0
mov byte [rcx + 0x47], 0
mov rax, rcx
ret

Function at 0x1800047c0
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x70
mov r9, r8
mov rbx, rdx
mov rdi, rcx
mov qword [rsp + 0x68], rcx
xor esi, esi
cmp byte [r8 + 6], sil
je 0x1800047f4
mov ecx, esi
lea eax, [rcx - 9]
xor byte [r8 + rcx], al
inc rcx
cmp rcx, 5
jb 0x1800047e0
mov byte [r8 + 6], sil
lea rax, [r8 + 5]
mov qword [rsp + 0x48], rsi
mov qword [rsp + 0x58], rsi
mov qword [rsp + 0x60], reloc.WS2_32.dll_ntohs
mov byte [rsp + 0x48], sil
cmp r9, rax
je 0x180004829
mov r8d, 5
mov rdx, r9
lea rcx, [rsp + 0x48]
call fcn.180008c80
nop
cmp byte [rbx + 0xa], 0
je 0x180004853
mov rcx, rsi
nop dword [rax]
nop word [rax + rax]
lea eax, [rcx - 9]
xor byte [rbx + rcx], al
inc rcx
cmp rcx, 9
jb 0x180004840
mov byte [rbx + 0xa], 0
lea rax, [rbx + 9]
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x40], reloc.WS2_32.dll_ntohs
mov byte [rsp + 0x28], 0
cmp rbx, rax
je 0x180004888
mov r8d, 9
mov rdx, rbx
lea rcx, [rsp + 0x28]
call fcn.180008c80
nop
lea r9, [rsp + 0x48]
lea r8, [rsp + 0x28]
movzx edx, byte [rsp + 0x20]
mov rcx, rdi
call fcn.18000ab70
nop
mov rdx, qword [rsp + 0x40]
cmp rdx, 0x10
jb 0x1800048e1
inc rdx
mov rcx, qword [rsp + 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800048db
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1800048db
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1800bfaf8
nop
mov rdx, qword [rsp + 0x60]
cmp rdx, 0x10
jb 0x180004921
inc rdx
mov rcx, qword [rsp + 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18000491c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x18000491c
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1800bfaf8
mov rax, rdi
add rsp, 0x70
pop rdi
pop rsi
pop rbx
ret
Function at 0x180004930
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x50
mov r9, r8
mov rbx, rdx
mov rdi, rcx
mov qword [rsp + 0x48], rcx
xor esi, esi
cmp byte [r8 + 7], sil
je 0x180004964
mov ecx, esi
lea eax, [rcx - 9]
xor byte [r8 + rcx], al
inc rcx
cmp rcx, 6
jb 0x180004950
mov byte [r8 + 7], sil
lea rax, [r8 + 6]
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x40], reloc.WS2_32.dll_ntohs
mov byte [rsp + 0x28], sil
cmp r9, rax
je 0x180004999
mov r8d, 6
mov rdx, r9
lea rcx, [rsp + 0x28]
call fcn.180008c80
nop
mov r9, qword [rbx + 0x10]
cmp qword [rbx + 0x18], 0x10
jb 0x1800049a7
mov rbx, qword [rbx]
mov r8, rbx
xor edx, edx
lea rcx, [rsp + 0x28]
call fcn.18000bb50
mov qword [rdi], rsi
mov qword [rdi + 0x10], rsi
mov qword [rdi + 0x18], rsi
movups xmm0, xmmword [rax]
movups xmmword [rdi], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rdi + 0x10], xmm1
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
mov rdx, qword [rsp + 0x40]
cmp rdx, 0x10
jb 0x180004a1e
inc rdx
mov rcx, qword [rsp + 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180004a19
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x180004a19
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1800bfaf8
mov rax, rdi
add rsp, 0x50
pop rdi
pop rsi
pop rbx
ret

Function at 0x180004a30
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x50
mov r9, r8
mov rbx, rdx
mov rdi, rcx
mov qword [rsp + 0x48], rcx
xor esi, esi
cmp byte [r8 + 0xa], sil
je 0x180004a64
mov ecx, esi
lea eax, [rcx - 9]
xor byte [r8 + rcx], al
inc rcx
cmp rcx, 9
jb 0x180004a50
mov byte [r8 + 0xa], sil
lea rax, [r8 + 9]
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x40], reloc.WS2_32.dll_ntohs
mov byte [rsp + 0x28], sil
cmp r9, rax
je 0x180004a99
mov r8d, 9
mov rdx, r9
lea rcx, [rsp + 0x28]
call fcn.180008c80
nop
mov r9, qword [rbx + 0x10]
cmp qword [rbx + 0x18], 0x10
jb 0x180004aa7
mov rbx, qword [rbx]
mov r8, rbx
xor edx, edx
lea rcx, [rsp + 0x28]
call fcn.18000bb50
mov qword [rdi], rsi
mov qword [rdi + 0x10], rsi
mov qword [rdi + 0x18], rsi
movups xmm0, xmmword [rax]
movups xmmword [rdi], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rdi + 0x10], xmm1
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
mov rdx, qword [rsp + 0x40]
cmp rdx, 0x10
jb 0x180004b1e
inc rdx
mov rcx, qword [rsp + 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180004b19
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x180004b19
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1800bfaf8
mov rax, rdi
add rsp, 0x50
pop rdi
pop rsi
pop rbx
ret

Function at 0x180004b30
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x136], 0
je 0x180004b58
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 9]
xor byte [rcx + rax], dl
inc rax
cmp rax, 0x135
jb 0x180004b40
mov byte [rcx + 0x136], 0
mov rax, rcx
ret
Function at 0x1800056e0
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x70
mov r9, r8
mov rbx, rdx
mov rdi, rcx
mov qword [rsp + 0x68], rcx
xor esi, esi
cmp byte [r8 + 0xb], sil
je 0x180005714
mov ecx, esi
lea eax, [rcx - 9]
xor byte [r8 + rcx], al
inc rcx
cmp rcx, 0xa
jb 0x180005700
mov byte [r8 + 0xb], sil
lea rax, [r8 + 0xa]
mov qword [rsp + 0x48], rsi
mov qword [rsp + 0x58], rsi
mov qword [rsp + 0x60], reloc.WS2_32.dll_ntohs
mov byte [rsp + 0x48], sil
cmp r9, rax
je 0x180005749
mov r8d, 0xa
mov rdx, r9
lea rcx, [rsp + 0x48]
call fcn.180008c80
nop
cmp byte [rbx + 0xb], 0
je 0x180005773
mov rcx, rsi
nop dword [rax]
nop word [rax + rax]
lea eax, [rcx - 9]
xor byte [rbx + rcx], al
inc rcx
cmp rcx, 0xa
jb 0x180005760
mov byte [rbx + 0xb], 0
lea rax, [rbx + 0xa]
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x40], reloc.WS2_32.dll_ntohs
mov byte [rsp + 0x28], 0
cmp rbx, rax
je 0x1800057a8
mov r8d, 0xa
mov rdx, rbx
lea rcx, [rsp + 0x28]
call fcn.180008c80
nop
lea r9, [rsp + 0x48]
lea r8, [rsp + 0x28]
movzx edx, byte [rsp + 0x20]
mov rcx, rdi
call fcn.18000ab70
nop
mov rdx, qword [rsp + 0x40]
cmp rdx, 0x10
jb 0x180005801
inc rdx
mov rcx, qword [rsp + 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800057fb
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1800057fb
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1800bfaf8
nop
mov rdx, qword [rsp + 0x60]
cmp rdx, 0x10
jb 0x180005841
inc rdx
mov rcx, qword [rsp + 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18000583c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x18000583c
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1800bfaf8
mov rax, rdi
add rsp, 0x70
pop rdi
pop rsi
pop rbx
ret
Function at 0x180005850
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x50
mov r9, r8
mov rbx, rdx
mov rdi, rcx
mov qword [rsp + 0x48], rcx
xor esi, esi
cmp byte [r8 + 0xc], sil
je 0x180005884
mov ecx, esi
lea eax, [rcx - 9]
xor byte [r8 + rcx], al
inc rcx
cmp rcx, 0xb
jb 0x180005870
mov byte [r8 + 0xc], sil
lea rax, [r8 + 0xb]
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x40], reloc.WS2_32.dll_ntohs
mov byte [rsp + 0x28], sil
cmp r9, rax
je 0x1800058b9
mov r8d, listen
mov rdx, r9
lea rcx, [rsp + 0x28]
call fcn.180008c80
nop
mov r9, qword [rbx + 0x10]
cmp qword [rbx + 0x18], 0x10
jb 0x1800058c7
mov rbx, qword [rbx]
mov r8, rbx
xor edx, edx
lea rcx, [rsp + 0x28]
call fcn.18000bb50
mov qword [rdi], rsi
mov qword [rdi + 0x10], rsi
mov qword [rdi + 0x18], rsi
movups xmm0, xmmword [rax]
movups xmmword [rdi], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rdi + 0x10], xmm1
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
mov rdx, qword [rsp + 0x40]
cmp rdx, 0x10
jb 0x18000593e
inc rdx
mov rcx, qword [rsp + 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180005939
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x180005939
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1800bfaf8
mov rax, rdi
add rsp, 0x50
pop rdi
pop rsi
pop rbx
ret
Function at 0x1800065b0
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x70
mov r9, r8
mov rbx, rdx
mov rdi, rcx
mov qword [rsp + 0x68], rcx
xor esi, esi
cmp byte [r8 + 0xb], sil
je 0x1800065e4
mov ecx, esi
lea eax, [rcx - 9]
xor byte [r8 + rcx], al
inc rcx
cmp rcx, 0xa
jb 0x1800065d0
mov byte [r8 + 0xb], sil
lea rax, [r8 + 0xa]
mov qword [rsp + 0x48], rsi
mov qword [rsp + 0x58], rsi
mov qword [rsp + 0x60], reloc.WS2_32.dll_ntohs
mov byte [rsp + 0x48], sil
cmp r9, rax
je 0x180006619
mov r8d, 0xa
mov rdx, r9
lea rcx, [rsp + 0x48]
call fcn.180008c80
nop
cmp byte [rbx + 0xe], 0
je 0x180006643
mov rcx, rsi
nop dword [rax]
nop word [rax + rax]
lea eax, [rcx - 9]
xor byte [rbx + rcx], al
inc rcx
cmp rcx, 0xd
jb 0x180006630
mov byte [rbx + 0xe], 0
lea rax, [rbx + 0xd]
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x40], reloc.WS2_32.dll_ntohs
mov byte [rsp + 0x28], 0
cmp rbx, rax
je 0x180006678
mov r8d, reloc.WS2_32.dll_listen
mov rdx, rbx
lea rcx, [rsp + 0x28]
call fcn.180008c80
nop
lea r9, [rsp + 0x48]
lea r8, [rsp + 0x28]
movzx edx, byte [rsp + 0x20]
mov rcx, rdi
call fcn.18000ab70
nop
mov rdx, qword [rsp + 0x40]
cmp rdx, 0x10
jb 0x1800066d1
inc rdx
mov rcx, qword [rsp + 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800066cb
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1800066cb
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1800bfaf8
nop
mov rdx, qword [rsp + 0x60]
cmp rdx, 0x10
jb 0x180006711
inc rdx
mov rcx, qword [rsp + 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18000670c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x18000670c
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1800bfaf8
mov rax, rdi
add rsp, 0x70
pop rdi
pop rsi
pop rbx
ret
Function at 0x180006720
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x50
mov r9, r8
mov rbx, rdx
mov rdi, rcx
mov qword [rsp + 0x48], rcx
xor esi, esi
cmp byte [r8 + 6], sil
je 0x180006754
mov ecx, esi
lea eax, [rcx - 9]
xor byte [r8 + rcx], al
inc rcx
cmp rcx, 5
jb 0x180006740
mov byte [r8 + 6], sil
lea rax, [r8 + 5]
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x40], reloc.WS2_32.dll_ntohs
mov byte [rsp + 0x28], sil
cmp r9, rax
je 0x180006789
mov r8d, 5
mov rdx, r9
lea rcx, [rsp + 0x28]
call fcn.180008c80
nop
mov r9, qword [rbx + 0x10]
cmp qword [rbx + 0x18], 0x10
jb 0x180006797
mov rbx, qword [rbx]
mov r8, rbx
xor edx, edx
lea rcx, [rsp + 0x28]
call fcn.18000bb50
mov qword [rdi], rsi
mov qword [rdi + 0x10], rsi
mov qword [rdi + 0x18], rsi
movups xmm0, xmmword [rax]
movups xmmword [rdi], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rdi + 0x10], xmm1
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
mov rdx, qword [rsp + 0x40]
cmp rdx, 0x10
jb 0x18000680e
inc rdx
mov rcx, qword [rsp + 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180006809
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x180006809
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1800bfaf8
mov rax, rdi
add rsp, 0x50
pop rdi
pop rsi
pop rbx
ret
Function at 0x180007020
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x70
mov r9, r8
mov rbx, rdx
mov rdi, rcx
mov qword [rsp + 0x68], rcx
xor esi, esi
cmp byte [r8 + 9], sil
je 0x180007054
mov ecx, esi
lea eax, [rcx - 9]
xor byte [r8 + rcx], al
inc rcx
cmp rcx, 8
jb 0x180007040
mov byte [r8 + 9], sil
lea rax, [r8 + 8]
mov qword [rsp + 0x48], rsi
mov qword [rsp + 0x58], rsi
mov qword [rsp + 0x60], reloc.WS2_32.dll_ntohs
mov byte [rsp + 0x48], sil
cmp r9, rax
je 0x180007089
mov r8d, 8
mov rdx, r9
lea rcx, [rsp + 0x48]
call fcn.180008c80
nop
cmp byte [rbx + 9], 0
je 0x1800070b3
mov rcx, rsi
nop dword [rax]
nop word [rax + rax]
lea eax, [rcx - 9]
xor byte [rbx + rcx], al
inc rcx
cmp rcx, 8
jb 0x1800070a0
mov byte [rbx + 9], 0
lea rax, [rbx + 8]
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x40], reloc.WS2_32.dll_ntohs
mov byte [rsp + 0x28], 0
cmp rbx, rax
je 0x1800070e8
mov r8d, 8
mov rdx, rbx
lea rcx, [rsp + 0x28]
call fcn.180008c80
nop
lea r9, [rsp + 0x48]
lea r8, [rsp + 0x28]
movzx edx, byte [rsp + 0x20]
mov rcx, rdi
call fcn.18000ab70
nop
mov rdx, qword [rsp + 0x40]
cmp rdx, 0x10
jb 0x180007141
inc rdx
mov rcx, qword [rsp + 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18000713b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x18000713b
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1800bfaf8
nop
mov rdx, qword [rsp + 0x60]
cmp rdx, 0x10
jb 0x180007181
inc rdx
mov rcx, qword [rsp + 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18000717c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x18000717c
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1800bfaf8
mov rax, rdi
add rsp, 0x70
pop rdi
pop rsi
pop rbx
ret
Function at 0x180022fa8
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x20
movsxd rbp, r9d
mov r14, r8
test r8, r8
je 0x180022fcf
and qword [r8], 0
call fcn.1800230b4
mov rbx, rax
test rax, rax
je 0x180023097
mov rcx, rax
call fcn.180022f30
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x18002308e
mov rax, qword [0x1801830e8]
test rax, rax
je 0x180023007
inc dword [rax + 0xf4]
mov rdx, qword [0x1801830f8]
lea rcx, [rdi + rbp]
call qword [0x1801811e8]
mov rsi, rax
test rax, rax
je 0x18002308e
mov r9, rbx
mov r8, rdi
mov edx, 1
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
cmp rax, rdi
je 0x180023066
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov rax, qword [0x1801830e8]
test rax, rax
je 0x180023054
dec dword [rax + 0xf4]
mov rdx, qword [0x1801830f8]
mov rcx, rsi
call qword [0x1801811f0]
jmp 0x180023097
test ebp, ebp
jle 0x180023078
lea rcx, [rsi + rdi]
mov r8, rbp
xor edx, edx
call sub.VCRUNTIME140.dll_memset
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
test r14, r14
je 0x180023089
mov qword [r14], rdi
mov rax, rsi
jmp 0x180023099
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
xor eax, eax
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop rdi
ret

Function at 0x180023b84
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
mov r9, rcx
not r8d
test rdx, rdx
je 0x180023bb2
movzx eax, byte [r9]
inc r9
movzx ecx, r8b
xor rcx, rax
shr r8d, 8
lea rax, [0x1800c52f0]
xor r8d, dword [rax + rcx*4]
sub rdx, 1
jne 0x180023b8f
not r8d
mov eax, r8d
ret

Function at 0x180023bbc
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
not r8d
mov r10, rcx
mov r9d, r8d
test rdx, rdx
je 0x180023c16
mov r11b, reloc.WLDAP32.dll_Ordinal_35
lea rbx, [0x1800c52f0]
movzx edi, byte [r10]
dec rdx
inc r10
cmp dil, r11b
jne 0x180023c00
cmp rdx, 2
jb 0x180023c00
cmp byte [r10], r11b
jne 0x180023c00
cmp byte [r10 + 1], r11b
cmove r9d, r8d
movzx ecx, r9b
xor rcx, rdi
shr r9d, 8
xor r9d, dword [rbx + rcx*4]
test rdx, rdx
jne 0x180023bde
jmp 0x180023c57
mov dl, byte [rcx]
inc r10
test dl, dl
je 0x180023c57
mov r11b, reloc.WLDAP32.dll_Ordinal_35
lea rbx, [0x1800c52f0]
cmp dl, r11b
jne 0x180023c3b
cmp byte [r10], r11b
jne 0x180023c3b
cmp byte [r10 + 1], r11b
cmove r9d, r8d
movzx ecx, r9b
movzx eax, dl
mov dl, byte [r10]
xor rcx, rax
shr r9d, 8
inc r10
xor r9d, dword [rbx + rcx*4]
test dl, dl
jne 0x180023c29
mov rbx, qword [rsp + 8]
not r9d
mov rdi, qword [rsp + 0x10]
mov eax, r9d
ret
Function at 0x180025b94
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
cmp qword [rcx + 0x5c58], 0
lea rbx, [rcx + 0x5c60]
mov rsi, r8
mov rbp, rdx
mov rdi, rcx
je 0x180025c2d
mov r9d, dword [rbx + 4]
test r9d, r9d
jns 0x180025be5
mov eax, r9d
mov rcx, rbx
cdq
sub eax, edx
xor edx, edx
sar eax, 1
add eax, r9d
test eax, eax
cmovg edx, eax
call fcn.180032260
and dword [rbx], 0
mov r8, rsi
mov rdx, rbp
mov rcx, rbx
call fcn.18003187c
mov eax, dword [rbx]
mov edx, 1
mov r9, qword [rdi + 0x5c58]
lea ecx, [rax - 1]
neg eax
sbb eax, eax
and eax, ecx
lea rcx, [0x1801830f0]
movsxd r8, eax
mov rax, qword [rdi + 0x5c68]
test rax, rax
cmovne rcx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
jmp 0x180025c35
mov rcx, rbx
call fcn.18003187c
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret

Function at 0x18002cc94
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x20
mov rax, qword [0x1801830e8]
mov rbx, rcx
and dword [rax + 0x5bbc], 0
test rcx, rcx
je 0x18002ccfd
and qword [rsp + 0x30], 0
lea rcx, [rsp + 0x30]
call fcn.18002cd08
lea rdx, [0x1800c6b7c]
mov rcx, rbx
mov rdi, rax
call fcn.1800230b4
mov rbx, rax
test rax, rax
je 0x18002ccfd
mov r8, qword [rsp + 0x30]
mov r9, rax
mov edx, 1
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret