joyce8/EMBER2024-capa huggingface dataset:
Function at 0x18007b580
Capabilities:
Enumerate pe sections

Disassembly:
mov r9, rdx
mov r10, rcx
cmp r8d, 0x100
je 0x18007b592
xor eax, eax
ret
movzx eax, byte [rdx]
mov dword [rcx], eax
movzx ecx, byte [rdx + 1]
shl ecx, 8
or ecx, eax
mov dword [r10], ecx
movzx edx, byte [rdx + 2]
shl edx, 0x10
or edx, ecx
mov dword [r10], edx
movzx eax, byte [r9 + 3]
shl eax, 0x18
or eax, edx
mov dword [r10], eax
movzx eax, byte [r9 + 4]
mov dword [r10 + 4], eax
movzx ecx, byte [r9 + 5]
shl ecx, 8
or ecx, eax
mov dword [r10 + 4], ecx
movzx edx, byte [r9 + 6]
shl edx, 0x10
or edx, ecx
mov dword [r10 + 4], edx
movzx eax, byte [r9 + 7]
shl eax, 0x18
or eax, edx
mov dword [r10 + 4], eax
movzx eax, byte [r9 + 8]
mov dword [r10 + 8], eax
movzx ecx, byte [r9 + 9]
shl ecx, 8
or ecx, eax
mov dword [r10 + 8], ecx
movzx edx, byte [r9 + 0xa]
shl edx, 0x10
or edx, ecx
mov dword [r10 + 8], edx
movzx eax, byte [r9 + 0xb]
shl eax, 0x18
or eax, edx
mov dword [r10 + 8], eax
movzx eax, byte [r9 + 0xc]
mov dword [r10 + 0xc], eax
movzx ecx, byte [r9 + 0xd]
shl ecx, 8
or ecx, eax
mov dword [r10 + 0xc], ecx
movzx edx, byte [r9 + 0xe]
shl edx, 0x10
or edx, ecx
mov dword [r10 + 0xc], edx
movzx eax, byte [r9 + 0xf]
shl eax, 0x18
or eax, edx
mov dword [r10 + 0xc], eax
movzx eax, byte [r9 + 0x10]
mov dword [r10 + 0x10], eax
movzx ecx, byte [r9 + 0x11]
shl ecx, 8
or ecx, eax
mov dword [r10 + 0x10], ecx
movzx edx, byte [r9 + 0x12]
shl edx, 0x10
or edx, ecx
mov dword [r10 + 0x10], edx
movzx eax, byte [r9 + 0x13]
shl eax, 0x18
or eax, edx
mov dword [r10 + 0x10], eax
movzx eax, byte [r9 + 0x14]
mov dword [r10 + 0x14], eax
movzx ecx, byte [r9 + 0x15]
shl ecx, 8
or ecx, eax
mov dword [r10 + 0x14], ecx
movzx edx, byte [r9 + 0x16]
shl edx, 0x10
or edx, ecx
mov dword [r10 + 0x14], edx
movzx eax, byte [r9 + 0x17]
shl eax, 0x18
or eax, edx
mov dword [r10 + 0x14], eax
movzx eax, byte [r9 + 0x18]
mov dword [r10 + 0x18], eax
movzx ecx, byte [r9 + 0x19]
shl ecx, 8
or ecx, eax
mov dword [r10 + 0x18], ecx
movzx edx, byte [r9 + 0x1a]
shl edx, 0x10
or edx, ecx
mov dword [r10 + 0x18], edx
movzx eax, byte [r9 + 0x1b]
shl eax, 0x18
or eax, edx
mov dword [r10 + 0x18], eax
movzx eax, byte [r9 + 0x1c]
mov dword [r10 + 0x1c], eax
movzx ecx, byte [r9 + 0x1d]
shl ecx, 8
or ecx, eax
mov dword [r10 + 0x1c], ecx
movzx edx, byte [r9 + 0x1e]
shl edx, 0x10
or edx, ecx
mov dword [r10 + 0x1c], edx
movzx eax, byte [r9 + 0x1f]
shl eax, 0x18
or eax, edx
mov dword [r10 + 0x1c], eax
mov eax, 1
mov dword [r10 + 0x1020], 0
ret
Function at 0x1800848b0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x50
mov rax, qword [0x1801772b8]
xor rax, rsp
mov qword [rbp - 8], rax
mov rax, qword [rbp + 0x60]
mov r14d, r8d
movzx r8d, byte [rax + 4]
lea rdi, [rax + 1]
mov r13, qword [rbp + 0x68]
mov rsi, rcx
movzx ecx, byte [rdi + 5]
xor r15d, r15d
movzx r10d, byte [rax]
mov r12, rdx
mov qword [rbp - 0x18], rax
movzx eax, byte [rdi]
mov ebx, dword [r13]
shl eax, 0x10
shl r10d, 0x18
or r10d, eax
shl r8d, 0x18
movzx eax, byte [rdi + 1]
shl eax, 8
or r10d, eax
shl ecx, 8
movzx eax, byte [rdi + 2]
or r10d, eax
mov qword [rbp - 0x28], r9
movzx eax, byte [rdi + 4]
shl eax, 0x10
or r8d, eax
mov qword [rbp - 0x20], r13
movzx eax, byte [rdi + 6]
or ecx, eax
mov dword [rbp - 0x30], r10d
or r8d, ecx
mov byte [rbp - 0xd], r10b
mov eax, r10d
mov dword [rbp - 0x2c], r8d
shr eax, 0x18
mov byte [rbp - 0x10], al
mov eax, r10d
shr eax, 0x10
mov byte [rbp - 0xf], al
mov eax, r10d
shr eax, 8
mov byte [rbp - 0xe], al
mov eax, r8d
shr eax, 0x18
mov byte [rbp - 0xc], al
mov eax, r8d
shr eax, 0x10
mov byte [rbp - 0xb], al
mov eax, r8d
shr eax, 8
mov byte [rbp - 0xa], al
mov byte [rbp - 9], r8b
test r14d, r14d
je 0x180084a64
mov r13, qword [rbp - 0x28]
sub r12, rsi
movzx edx, r8b
movzx r9d, r10b
dec r14d
test ebx, ebx
jne 0x180084a03
mov rdx, r13
lea rcx, [rbp - 0x30]
call sym.version.dll_idea_encrypt
mov r10d, dword [rbp - 0x30]
mov eax, r10d
mov r8d, dword [rbp - 0x2c]
movzx r9d, r10b
shr eax, 0x18
movzx edx, r8b
mov byte [rbp - 0x10], al
mov eax, r10d
shr eax, 0x10
mov byte [rbp - 0xf], al
mov eax, r10d
shr eax, 8
mov byte [rbp - 0xe], al
mov eax, r8d
shr eax, 0x18
mov byte [rbp - 0xc], al
mov eax, r8d
shr eax, 0x10
mov byte [rbp - 0xb], al
mov eax, r8d
shr eax, 8
mov byte [rbp - 0xa], al
inc r15d
mov byte [rbp - 0xd], r10b
mov byte [rbp - 9], dl
movsxd rax, ebx
movzx ecx, byte [rbp + rax - 0x10]
xor cl, byte [rsi]
mov byte [r12 + rsi], cl
inc rsi
inc ebx
and ebx, 7
test r14d, r14d
jne 0x1800849a0
mov r13, qword [rbp - 0x20]
test r15d, r15d
je 0x180084a64
mov rcx, qword [rbp - 0x18]
mov eax, r10d
shr eax, 0x18
mov byte [rdi + 2], r9b
mov byte [rdi + 6], dl
mov byte [rcx], al
mov eax, r10d
shr eax, 0x10
mov byte [rdi], al
mov eax, r8d
shr eax, 0x18
mov byte [rdi + 3], al
mov eax, r8d
shr eax, 0x10
shr r10d, 8
shr r8d, 8
mov byte [rdi + 5], r8b
mov byte [rdi + 1], r10b
mov byte [rdi + 4], al
mov dword [r13], ebx
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.1800d61c0
mov rbx, qword [rsp + 0x90]
add rsp, 0x50
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret

Function at 0x180085c00
Capabilities:
Encrypt data using chaskey
Hash data using murmur3
Resolve function by parsing pe exports

Disassembly:
mov r8d, 1
jmp fcn.180085d30
Function at 0x180086710
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov r8d, 1
jmp fcn.180086840
Function at 0x1800875f0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
push rsi
push rdi
push r12
push r13
push r15
sub rsp, 0x20
mov r13, qword [rsp + 0x70]
mov r15, r9
mov r12, qword [rsp + 0x78]
mov r10, r13
mov rdi, r8
mov rbx, rdx
mov rsi, rcx
cmp r8, 0x10
jb 0x180087687
mov qword [rsp + 0x50], rbp
mov rbp, r8
shr rbp, 4
imul rax, rbp, 0xfffffffffffffff0
add rdi, rax
sub r10, rsi
mov r8, rbx
sub r8, rsi
mov rax, rsi
mov edx, 2
nop dword [rax]
nop dword [rax + rax]
mov rcx, qword [r10 + rax]
xor rcx, qword [rax]
mov qword [r8 + rax], rcx
lea rax, [rax + 8]
sub rdx, 1
jne 0x180087650
mov r8, r15
mov rdx, rbx
mov rcx, rbx
call r12
mov r10, rbx
add rsi, 0x10
add rbx, 0x10
sub rbp, 1
jne 0x180087633
mov rbp, qword [rsp + 0x50]
test rdi, rdi
je 0x18008778d
mov qword [rsp + 0x58], r14
nop word [rax + rax]
mov r8, r10
lea rcx, [rsi + 1]
mov r9, rbx
mov r11d, 1
sub r8, rsi
sub r9, rsi
sub r11, rsi
xor edx, edx
mov r14d, 2
sub r14, rsi
cmp rdx, rdi
jae 0x180087740
movzx eax, byte [r8 + rcx - 1]
xor al, byte [rcx - 1]
mov byte [r9 + rcx - 1], al
mov rax, rcx
sub rax, rsi
cmp rax, rdi
jae 0x180087737
movzx eax, byte [rcx + r8]
xor al, byte [rcx]
mov byte [rcx + r9], al
lea rax, [r11 + rcx]
cmp rax, rdi
jae 0x180087731
movzx eax, byte [r8 + rcx + 1]
xor al, byte [rcx + 1]
mov byte [r9 + rcx + 1], al
lea rax, [r14 + rcx]
cmp rax, rdi
jae 0x18008772b
movzx eax, byte [r8 + rcx + 2]
add rdx, 4
xor al, byte [rcx + 2]
mov byte [r9 + rcx + 2], al
add rcx, 4
cmp rdx, 0x10
jb 0x1800876c4
jmp 0x180087761
add rdx, 3
jmp 0x18008773a
add rdx, 2
jmp 0x18008773a
inc rdx
cmp rdx, 0x10
jae 0x180087761
sub r10, rbx
lea rcx, [rdx + rbx]
mov r8d, reloc.WS2_32.dll_recv
sub r8, rdx
movzx eax, byte [r10 + rcx]
mov byte [rcx], al
lea rcx, [rcx + 1]
sub r8, 1
jne 0x180087750
mov r8, r15
mov rdx, rbx
mov rcx, rbx
call r12
mov r10, rbx
cmp rdi, 0x10
jbe 0x180087788
add rsi, 0x10
add rbx, 0x10
sub rdi, 0x10
jne 0x1800876a0
mov r14, qword [rsp + 0x58]
movups xmm0, xmmword [r10]
mov rbx, qword [rsp + 0x60]
movups xmmword [r13], xmm0
add rsp, 0x20
pop r15
pop r13
pop r12
pop rdi
pop rsi
ret
Function at 0x180087940
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x40
mov rax, qword [0x1801772b8]
xor rax, rsp
mov qword [rsp + 0x38], rax
movzx edi, byte [rcx]
mov rsi, r9
mov rbp, qword [rcx + 0x28]
mov r15, r8
mov r12, qword [rcx + 0x30]
mov r14, rdx
mov byte [rsp + 0x20], dil
mov rbx, rcx
test dil, 0x40
jne 0x18008798e
lea rdx, [rcx + 0x10]
mov r8, r12
call rbp
mov r8d, edi
mov r13d, reloc.WS2_32.dll_ntohs
and r8d, 7
xor edi, edi
sub r13d, r8d
mov byte [rbx], r8b
mov ecx, edi
cmp r13d, 0xf
jae 0x1800879c8
mov edx, r13d
add rdx, rbx
movzx eax, byte [rdx]
mov byte [rdx], dil
lea rdx, [rdx + 1]
or rcx, rax
shl rcx, 8
sub r8, 1
jne 0x1800879b1
movzx eax, byte [rbx + 0xf]
or rcx, rax
mov byte [rbx + 0xf], 1
cmp rcx, rsi
je 0x1800879e2
mov eax, 0xffffffff
jmp 0x180087aea
cmp rsi, 0x10
jb 0x180087a5a
mov rdi, rsi
shr rdi, 4
imul rax, rdi, 0xfffffffffffffff0
add rsi, rax
nop word [rax + rax]
mov r8, r12
lea rdx, [rsp + 0x28]
mov rcx, rbx
call rbp
mov eax, 8
dec eax
add byte [rax + rbx + 8], 1
jne 0x180087a1f
test eax, eax
jne 0x180087a12
mov rax, qword [r14]
lea rdx, [rbx + 0x10]
xor rax, qword [rsp + 0x28]
lea rcx, [rbx + 0x10]
mov qword [r15], rax
mov r8, r12
xor qword [rbx + 0x10], rax
mov rax, qword [r14 + 8]
xor rax, qword [rsp + 0x30]
mov qword [r15 + 8], rax
xor qword [rbx + 0x18], rax
call rbp
add r14, 0x10
add r15, 0x10
sub rdi, 1
jne 0x180087a00
test rsi, rsi
je 0x180087aa6
mov r8, r12
lea rdx, [rsp + 0x28]
mov rcx, rbx
call rbp
test rsi, rsi
je 0x180087a9a
mov rcx, rdi
nop dword [rax]
nop dword [rax + rax]
movzx eax, byte [rcx + r14]
inc edi
xor al, byte [rsp + rcx + 0x28]
mov byte [rcx + r15], al
xor byte [rcx + rbx + 0x10], al
mov ecx, edi
cmp rcx, rsi
jb 0x180087a80
lea rcx, [rbx + 0x10]
mov r8, r12
mov rdx, rcx
call rbp
cmp r13d, 0x10
jae 0x180087ac2
mov r8d, reloc.WS2_32.dll_recv
mov ecx, r13d
sub r8d, r13d
add rcx, rbx
xor edx, edx
call fcn.1800d7430
mov r8, r12
lea rdx, [rsp + 0x28]
mov rcx, rbx
call rbp
mov rax, qword [rsp + 0x28]
xor qword [rbx + 0x10], rax
mov rax, qword [rsp + 0x30]
xor qword [rbx + 0x18], rax
movzx eax, byte [rsp + 0x20]
mov byte [rbx], al
xor eax, eax
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.1800d61c0
mov rbx, qword [rsp + 0x88]
add rsp, 0x40
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x180087b10
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x78
mov rax, qword [0x1801772b8]
xor rax, rsp
mov qword [rsp + 0x68], rax
mov rax, qword [rsp + 0xe0]
mov rbp, r9
movzx ebx, byte [rcx]
mov r15, r8
mov r11, qword [rcx + 0x30]
mov r14, rdx
mov qword [rsp + 0x50], rax
mov rdi, rcx
mov rax, qword [rcx + 0x28]
mov r10, r9
mov qword [rsp + 0x40], rax
mov byte [rsp + 0x30], bl
mov qword [rsp + 0x38], r11
test bl, 0x40
jne 0x180087b81
mov r8, r11
lea rdx, [rcx + 0x10]
call rax
mov r11, qword [rsp + 0x38]
lea r9, [rdi + 0x10]
mov r10, rbp
jmp 0x180087b85
lea r9, [rcx + 0x10]
xor esi, esi
mov r8d, ebx
and r8d, 7
mov r12d, reloc.WS2_32.dll_ntohs
sub r12d, r8d
mov byte [rdi], r8b
mov ecx, esi
cmp r12d, 0xf
jae 0x180087bc7
mov edx, r12d
add rdx, rdi
nop dword [rax + rax]
movzx eax, byte [rdx]
mov byte [rdx], sil
lea rdx, [rdx + 1]
or rcx, rax
shl rcx, 8
sub r8, 1
jne 0x180087bb0
movzx eax, byte [rdi + 0xf]
or rcx, rax
mov byte [rdi + 0xf], 1
cmp rcx, rbp
je 0x180087be1
mov eax, 0xffffffff
jmp 0x180087d0c
mov rbx, rbp
shr rbx, 4
test rbx, rbx
je 0x180087c62
mov qword [rsp + 0x28], r9
mov r8, rbx
mov r9, r11
mov qword [rsp + 0x20], rdi
mov rdx, r15
mov rcx, r14
call qword [rsp + 0x50]
shl rbx, 4
add r14, rbx
add r15, rbx
sub rbp, rbx
je 0x180087cbe
shr rbx, 4
lea r8, [rdi + 0x10]
mov r9, 0xfffffffffffffff8
mov rdx, rsi
sub r9, rdi
nop
movzx eax, byte [r8 - 1]
lea r8, [r8 - 1]
add rdx, rax
movzx ecx, bl
add rdx, rcx
shr rbx, 8
mov byte [r8], dl
lea rax, [r9 + r8]
shr rdx, 8
test rax, rax
je 0x180087c6a
test rbx, rbx
jne 0x180087c30
test rdx, rdx
jne 0x180087c30
jmp 0x180087c6a
mov rbp, r10
test r10, r10
je 0x180087cbe
mov rbx, qword [rsp + 0x38]
lea rdx, [rsp + 0x58]
mov r8, rbx
mov rcx, rdi
call qword [rsp + 0x40]
test rbp, rbp
je 0x180087caa
mov rdx, rsi
nop word [rax + rax]
movzx eax, byte [rdx + r14]
inc esi
xor al, byte [rsp + rdx + 0x58]
mov byte [rdx + r15], al
xor byte [rdx + rdi + 0x10], al
mov edx, esi
cmp rdx, rbp
jb 0x180087c90
mov rsi, qword [rsp + 0x40]
lea rdx, [rdi + 0x10]
mov r8, rbx
lea rcx, [rdi + 0x10]
call rsi
jmp 0x180087cc8
mov rsi, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x38]
cmp r12d, 0x10
jae 0x180087ce4
mov r8d, reloc.WS2_32.dll_recv
mov ecx, r12d
sub r8d, r12d
add rcx, rdi
xor edx, edx
call fcn.1800d7430
mov r8, rbx
lea rdx, [rsp + 0x58]
mov rcx, rdi
call rsi
mov rax, qword [rsp + 0x58]
xor qword [rdi + 0x10], rax
mov rax, qword [rsp + 0x60]
xor qword [rdi + 0x18], rax
movzx eax, byte [rsp + 0x30]
mov byte [rdi], al
xor eax, eax
mov rcx, qword [rsp + 0x68]
xor rcx, rsp
call fcn.1800d61c0
add rsp, 0x78
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x180088700
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x20], r9
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x20
cmp dword [rsp + 0x90], 0
mov r10, r9
mov r15, qword [rsp + 0x88]
mov rdi, r8
mov rbp, qword [rsp + 0x80]
mov rsi, rdx
mov r14, rcx
mov ebx, dword [r15]
je 0x18008885e
test ebx, ebx
je 0x180088774
nop word [rax + rax]
test rdi, rdi
je 0x180088774
movzx eax, byte [r14]
dec rdi
mov ecx, ebx
inc r14
xor byte [rcx + rbp], al
movzx eax, byte [rcx + rbp]
mov byte [rsi], al
inc rsi
inc ebx
and ebx, 0xf
jne 0x180088750
mov r9, qword [rsp + 0x98]
cmp rdi, 0x10
jb 0x180088824
mov r15, rsi
mov r13, rdi
shr r13, 4
mov r12, r14
imul rax, r13, 0xfffffffffffffff0
sub r15, rbp
sub r12, rbp
add rdi, rax
mov rax, r13
shl rax, 4
add rsi, rax
mov qword [rsp + 0x68], rsi
add r14, rax
mov rsi, qword [rsp + 0x78]
nop word [rax + rax]
mov r8, rsi
mov rdx, rbp
mov rcx, rbp
call r9
cmp ebx, 0x10
jae 0x1800887fa
mov edx, reloc.WS2_32.dll_ntohs
mov ecx, ebx
sub edx, ebx
add rcx, rbp
shr edx, 3
inc edx
mov rax, qword [r12 + rcx]
xor qword [rcx], rax
mov rax, qword [rcx]
mov qword [r15 + rcx], rax
lea rcx, [rcx + 8]
sub rdx, 1
jne 0x1800887e2
mov r9, qword [rsp + 0x98]
add r15, 0x10
add r12, 0x10
xor ebx, ebx
sub r13, 1
jne 0x1800887c0
mov rsi, qword [rsp + 0x68]
mov r10, qword [rsp + 0x78]
mov r15, qword [rsp + 0x88]
test rdi, rdi
je 0x18008896b
mov r8, r10
mov rdx, rbp
mov rcx, rbp
call r9
nop dword [rax]
mov ecx, ebx
inc ebx
movzx eax, byte [rcx + r14]
xor byte [rcx + rbp], al
movzx eax, byte [rcx + rbp]
mov byte [rcx + rsi], al
sub rdi, 1
jne 0x180088840
jmp 0x18008896b
test ebx, ebx
je 0x180088888
test rdi, rdi
je 0x180088888
movzx edx, byte [r14]
dec rdi
mov ecx, ebx
inc r14
movzx eax, byte [rcx + rbp]
xor al, dl
mov byte [rsi], al
inc rsi
inc ebx
mov byte [rcx + rbp], dl
and ebx, 0xf
jne 0x180088862
mov r13, qword [rsp + 0x98]
cmp rdi, 0x10
jb 0x180088936
mov r12, rdi
mov r15, rsi
shr r12, 4
sub r15, rbp
imul rax, r12, 0xfffffffffffffff0
add rdi, rax
mov qword [rsp + 0x70], rdi
mov rdi, qword [rsp + 0x78]
nop dword [rax + rax]
mov r8, rdi
mov rdx, rbp
mov rcx, rbp
call r13
cmp ebx, 0x10
jae 0x180088910
mov r9d, reloc.WS2_32.dll_ntohs
mov r8d, ebx
sub r9d, ebx
mov r10, r14
shr r9d, 3
add r8, rbp
sub r10, rsi
inc r9d
nop dword [rax]
lea rcx, [r15 + r8]
mov rdx, qword [rcx + r10]
lea r8, [r8 + 8]
mov rax, rdx
xor rax, qword [r8 - 8]
mov qword [rcx], rax
mov qword [r8 - 8], rdx
sub r9, 1
jne 0x1800888f0
add rsi, 0x10
add r15, 0x10
add r14, 0x10
xor ebx, ebx
sub r12, 1
jne 0x1800888c0
mov rdi, qword [rsp + 0x70]
mov r10, qword [rsp + 0x78]
mov r15, qword [rsp + 0x88]
test rdi, rdi
je 0x18008896b
mov r8, r10
mov rdx, rbp
mov rcx, rbp
call r13
nop word [rax + rax]
mov ecx, ebx
inc ebx
movzx edx, byte [rcx + r14]
movzx eax, byte [rcx + rbp]
xor al, dl
mov byte [rcx + rsi], al
mov byte [rcx + rbp], dl
sub rdi, 1
jne 0x180088950
mov dword [r15], ebx
mov rbx, qword [rsp + 0x60]
add rsp, 0x20
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x180088990
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x20], r9
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r15
sub rsp, 0x40
mov r15, qword [rsp + 0xb0]
mov rbp, rdx
mov rdx, qword [rsp + 0xa8]
mov r10, r9
mov rdi, r8
mov r12, rcx
mov ebx, dword [r15]
test ebx, ebx
je 0x1800889e8
test rdi, rdi
je 0x1800889e8
mov eax, ebx
dec rdi
movzx ecx, byte [rax + rdx]
xor cl, byte [r12]
inc r12
mov byte [rbp], cl
inc rbp
inc ebx
and ebx, 0xf
jne 0x1800889c6
mov r9, qword [rsp + 0xb8]
mov esi, reloc.WS2_32.dll_recv
mov r13, qword [rsp + 0xa0]
mov qword [rsp + 0x38], r14
cmp rdi, rsi
jb 0x180088af3
mov rcx, rdi
mov r14, rbp
shr rcx, 4
mov r15, r12
imul rax, rcx, 0xfffffffffffffff0
sub r14, rdx
sub r15, rdx
add rdi, rax
mov rax, rcx
shl rax, 4
add rbp, rax
mov qword [rsp + 0x90], rdi
mov rdi, qword [rsp + 0x98]
add r12, rax
mov qword [rsp + 0x80], r12
mov r12, rcx
mov qword [rsp + 0x88], rbp
mov rbp, qword [rsp + 0xa8]
nop dword [rax]
mov r8, rdi
mov rdx, rbp
mov rcx, r13
call r9
mov edx, esi
nop
dec edx
add byte [rdx + r13], 1
jne 0x180088a7d
test edx, edx
jne 0x180088a70
cmp ebx, esi
jae 0x180088ab5
mov edx, reloc.WS2_32.dll_ntohs
mov eax, ebx
sub edx, ebx
add rax, rbp
shr edx, 3
inc edx
nop dword [rax]
nop word [rax + rax]
mov rcx, qword [r15 + rax]
xor rcx, qword [rax]
mov qword [r14 + rax], rcx
lea rax, [rax + 8]
sub rdx, 1
jne 0x180088aa0
mov r9, qword [rsp + 0xb8]
add r14, rsi
add r15, rsi
xor ebx, ebx
sub r12, 1
jne 0x180088a60
mov rdi, qword [rsp + 0x90]
mov rbp, qword [rsp + 0x88]
mov r12, qword [rsp + 0x80]
mov r10, qword [rsp + 0x98]
mov r15, qword [rsp + 0xb0]
test rdi, rdi
je 0x180088b36
mov r14, qword [rsp + 0xa8]
mov r8, r10
mov rdx, r14
mov rcx, r13
call r9
nop dword [rax]
dec esi
add byte [rsi + r13], 1
jne 0x180088b20
test esi, esi
jne 0x180088b10
nop dword [rax]
mov ecx, ebx
inc ebx
movzx eax, byte [rcx + r12]
xor al, byte [rcx + r14]
mov byte [rcx + rbp], al
sub rdi, 1
jne 0x180088b20
mov r14, qword [rsp + 0x38]
mov dword [r15], ebx
add rsp, 0x40
pop r15
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x180088b50
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x20], r9
push rbx
push rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x30
mov rbx, r8
mov r14, rdx
mov r8, qword [rsp + 0xa0]
mov rbp, rcx
mov edi, dword [r8]
mov dword [rsp + 0x80], edi
test edi, edi
je 0x180088bb8
mov rdx, qword [rsp + 0x98]
nop word [rax + rax]
test rbx, rbx
je 0x180088bb1
mov eax, edi
dec rbx
movzx ecx, byte [rax + rdx]
xor cl, byte [rbp]
inc rbp
mov byte [r14], cl
inc r14
inc edi
and edi, 0xf
jne 0x180088b90
mov dword [rsp + 0x80], edi
mov rsi, qword [rsp + 0x90]
mov r15d, recv
mov r10, qword [rsp + 0xa8]
mov qword [rsp + 0x70], r13
movzx eax, byte [rsi + 0xd]
movzx r12d, byte [rsi + 0xc]
shl r12d, 8
or r12d, eax
movzx eax, byte [rsi + 0xe]
shl r12d, 8
or r12d, eax
movzx eax, byte [rsi + 0xf]
shl r12d, 8
or r12d, eax
cmp rbx, 0x10
jb 0x180088cc7
mov rdi, qword [rsp + 0x88]
mov eax, 0x10000000
mov rdx, rbx
mov qword [rsp + 0x20], rsi
shr rdx, 4
mov r9, rdi
cmp rdx, rax
cmova rdx, rax
add r12d, edx
mov r13, rdx
mov eax, r12d
mov ecx, r12d
sub r13, rax
cmp rax, rdx
cmovae r13, rdx
xor r12d, r12d
cmp rax, rdx
mov r8, r13
mov rdx, r14
cmovae r12d, ecx
mov rcx, rbp
call r10
mov eax, r12d
mov byte [rsi + 0xf], r12b
shr eax, 0x18
mov byte [rsi + 0xc], al
mov eax, r12d
shr eax, 0x10
mov byte [rsi + 0xd], al
mov eax, r12d
shr eax, 8
mov byte [rsi + 0xe], al
test r12d, r12d
jne 0x180088c8c
mov eax, r15d
nop dword [rax]
dec eax
add byte [rax + rsi], 1
jne 0x180088c8c
test eax, eax
jne 0x180088c80
mov r10, qword [rsp + 0xa8]
mov eax, 0x10000000
shl r13, 4
sub rbx, r13
add r14, r13
add rbp, r13
cmp rbx, 0x10
jae 0x180088c10
mov edi, dword [rsp + 0x80]
mov r8, qword [rsp + 0xa0]
mov r9, qword [rsp + 0x88]
test rbx, rbx
je 0x180088d52
mov r13, qword [rsp + 0x98]
xorps xmm0, xmm0
mov r8d, 1
mov qword [rsp + 0x20], rsi
mov rdx, r13
mov rcx, r13
movups xmmword [r13], xmm0
call r10
inc r12d
mov eax, r12d
mov byte [rsi + 0xf], r12b
shr eax, 0x18
mov byte [rsi + 0xc], al
mov eax, r12d
shr eax, 0x10
mov byte [rsi + 0xd], al
mov eax, r12d
shr eax, 8
mov byte [rsi + 0xe], al
test r12d, r12d
jne 0x180088d30
nop dword [rax + rax]
dec r15d
add byte [r15 + rsi], 1
jne 0x180088d30
test r15d, r15d
jne 0x180088d20
nop
mov ecx, edi
inc edi
movzx eax, byte [rcx + rbp]
xor al, byte [rcx + r13]
mov byte [rcx + r14], al
sub rbx, 1
jne 0x180088d30
mov rax, qword [rsp + 0xa0]
mov dword [rax], edi
jmp 0x180088d55
mov dword [r8], edi
mov r13, qword [rsp + 0x70]
add rsp, 0x30
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x180088ea0
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rbp
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x70
mov rax, qword [0x1801772b8]
xor rax, rsp
mov qword [rsp + 0x50], rax
mov r14, qword [rsp + 0xd0]
mov r15, r9
mov r12, qword [rsp + 0xd8]
mov rbp, r8
mov rbx, rdx
mov rdi, rcx
mov r13, r8
cmp r8, 0x10
ja 0x180088eeb
xor eax, eax
jmp 0x180089042
mov qword [rsp + 0x68], rsi
mov eax, reloc.WS2_32.dll_recv
mov rsi, rbp
and esi, 0xf
cmove esi, eax
mov rax, 0xfffffffffffffff0
sub rax, rsi
add rbp, rax
je 0x180088f25
mov qword [rsp + 0x28], r12
mov r8, rbp
mov qword [rsp + 0x20], r14
call sym.version.dll_CRYPTO_cbc128_decrypt
add rdi, rbp
add rbx, rbp
mov r8, r15
lea rdx, [rsp + 0x40]
mov rcx, rdi
call r12
movups xmm0, xmmword [rsp + 0x40]
lea rdx, [rdi + 0x10]
mov r8, rsi
lea rcx, [rsp + 0x30]
movups xmmword [rsp + 0x30], xmm0
call fcn.1800d7020
mov r8, r15
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x30]
call r12
xor eax, eax
lea rcx, [rsp + 0x3f]
lea rdx, [r14 + 0xf]
cmp r14, rcx
ja 0x180088f78
lea rcx, [rsp + 0x30]
cmp rdx, rcx
jae 0x180088fc0
lea rcx, [rbx + 0xf]
cmp r14, rcx
ja 0x180088f86
cmp rdx, rbx
jae 0x180088fc0
lea r8, [rdi + 0xf]
cmp r14, r8
ja 0x180088f94
cmp rdx, rdi
jae 0x180088fc0
lea rdx, [rsp + 0x3f]
cmp rbx, rdx
ja 0x180088fa8
lea rdx, [rsp + 0x30]
cmp rcx, rdx
jae 0x180088fc0
cmp rbx, r8
ja 0x180088fdf
cmp rcx, rdi
jb 0x180088fdf
nop dword [rax]
nop word [rax + rax]
movzx ecx, byte [rsp + rax + 0x30]
xor cl, byte [r14 + rax]
movzx edx, byte [rdi + rax]
mov byte [rbx + rax], cl
mov byte [r14 + rax], dl
inc rax
cmp rax, 0x10
jb 0x180088fc0
jmp 0x180089000
movdqu xmm1, xmmword [r14]
mov eax, reloc.WS2_32.dll_recv
movdqu xmm0, xmmword [rsp + 0x30]
pxor xmm1, xmm0
movdqu xmm0, xmmword [rdi]
movdqu xmmword [rbx], xmm1
movdqu xmmword [r14], xmm0
add rsi, 0x10
cmp rax, rsi
jae 0x180089039
lea rcx, [rsp + 0x30]
sub rdi, rcx
lea rcx, [rsp + 0x30]
sub rbx, rcx
nop dword [rax]
lea rdx, [rsp + 0x30]
add rdx, rax
inc rax
movzx ecx, byte [rdi + rdx]
xor cl, byte [rdx]
mov byte [rbx + rdx], cl
cmp rax, rsi
jb 0x180089020
mov rsi, qword [rsp + 0x68]
lea rax, [r13 + 0x10]
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.1800d61c0
add rsp, 0x70
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rbp
pop rbx
ret
Function at 0x180089150
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rdi
push r12
push r14
push r15
sub rsp, 0x30
mov r15, r9
mov rdi, r8
mov r14, rdx
mov rbx, rcx
mov r12, r8
cmp r8, 0x10
ja 0x180089181
xor eax, eax
add rsp, 0x30
pop r15
pop r14
pop r12
pop rdi
pop rbx
ret
mov qword [rsp + 0x60], rbp
mov eax, reloc.WS2_32.dll_recv
mov rbp, qword [rsp + 0x80]
mov qword [rsp + 0x68], rsi
mov rsi, rdi
and esi, 0xf
mov qword [rsp + 0x70], r13
mov r13, qword [rsp + 0x88]
cmove esi, eax
mov qword [rsp + 0x28], r13
sub rdi, rsi
mov qword [rsp + 0x20], rbp
mov r8, rdi
call sym.version.dll_CRYPTO_cbc128_encrypt
add rbx, rdi
add r14, rdi
test rsi, rsi
je 0x1800891f0
mov rax, rbp
sub rbx, rbp
mov edx, esi
nop word [rax + rax]
movzx ecx, byte [rbx + rax]
xor byte [rax], cl
lea rax, [rax + 1]
sub rdx, 1
jne 0x1800891e0
mov r8, r15
mov rdx, rbp
mov rcx, rbp
call r13
mov r8, rsi
lea rdx, [r14 - 0x10]
mov rcx, r14
call fcn.1800d7020
movups xmm0, xmmword [rbp]
mov r13, qword [rsp + 0x70]
mov rax, r12
mov rsi, qword [rsp + 0x68]
mov rbp, qword [rsp + 0x60]
movups xmmword [r14 - 0x10], xmm0
add rsp, 0x30
pop r15
pop r14
pop r12
pop rdi
pop rbx
ret