joyce8/EMBER2024-capa huggingface dataset:
Function at 0x18012c260
Capabilities:
Allocate or change rwx memory

Disassembly:
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
sub rsp, 0x48
mov rax, qword [rsp + 0x50]
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x38]
mov eax, dword [rax]
cmp rax, 0x688
jne 0x18012c293
mov rax, qword [rsp + 0x38]
mov ecx, dword [rsp + 0x58]
cmp dword [rax], ecx
jbe 0x18012c2a5
mov ecx, 0xc1
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
jmp 0x18012c442
mov dword [rsp + 0x30], 0xffffffff
mov dword [rsp + 0x20], 0xffffffff
mov dword [rsp + 0x2c], 0xffffffff
mov dword [rsp + 0x24], 0
mov rax, qword [rsp + 0x38]
mov eax, dword [rax + 4]
lea r9, [rsp + 0x30]
mov r8d, 0x40
mov edx, eax
mov rax, qword [rsp + 0x38]
mov rcx, qword [rax + 0x10]
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x18012c43e
mov rax, qword [rsp + 0x38]
mov eax, dword [rax + 8]
lea r9, [rsp + 0x20]
mov r8d, 0x40
mov edx, eax
mov rax, qword [rsp + 0x38]
mov rcx, qword [rax + 0x18]
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x18012c41b
mov rax, qword [rsp + 0x38]
mov eax, dword [rax + 4]
mov rcx, qword [rsp + 0x38]
add rcx, 0x28
mov r8d, eax
mov rdx, rcx
mov rax, qword [rsp + 0x38]
mov rcx, qword [rax + 0x10]
call fcn.1801ad280
mov rax, qword [rsp + 0x38]
mov eax, dword [rax + 8]
mov rcx, qword [rsp + 0x38]
add rcx, 0x68
mov r8d, eax
mov rdx, rcx
mov rax, qword [rsp + 0x38]
mov rcx, qword [rax + 0x18]
call fcn.1801ad280
mov rax, qword [rsp + 0x38]
cmp qword [rax + 0x20], 0
je 0x18012c3f0
mov rax, qword [rsp + 0x38]
mov eax, dword [rax + 0xc]
lea r9, [rsp + 0x2c]
mov r8d, 0x40
mov edx, eax
mov rax, qword [rsp + 0x38]
mov rcx, qword [rax + 0x20]
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x18012c3ee
mov rax, qword [rsp + 0x38]
mov eax, dword [rax + 0xc]
mov rcx, qword [rsp + 0x38]
add rcx, 0x670
mov r8d, eax
mov rdx, rcx
mov rax, qword [rsp + 0x38]
mov rcx, qword [rax + 0x20]
call fcn.1801ad280
mov rax, qword [rsp + 0x38]
mov eax, dword [rax + 0xc]
lea r9, [rsp + 0x28]
mov r8d, dword [rsp + 0x2c]
mov edx, eax
mov rax, qword [rsp + 0x38]
mov rcx, qword [rax + 0x20]
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov dword [rsp + 0x24], 1
jmp 0x18012c3f8
mov dword [rsp + 0x24], 1
mov rax, qword [rsp + 0x38]
mov eax, dword [rax + 8]
lea r9, [rsp + 0x28]
mov r8d, dword [rsp + 0x20]
mov edx, eax
mov rax, qword [rsp + 0x38]
mov rcx, qword [rax + 0x18]
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov rax, qword [rsp + 0x38]
mov eax, dword [rax + 4]
lea r9, [rsp + 0x28]
mov r8d, dword [rsp + 0x30]
mov edx, eax
mov rax, qword [rsp + 0x38]
mov rcx, qword [rax + 0x10]
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov eax, dword [rsp + 0x24]
add rsp, 0x48
ret

Function at 0x18012d190
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov eax, 0x28
call fcn.180131170
sub rsp, rax
add rsp, 0x28
jmp fcn.180133040
Function at 0x180135f70
Capabilities:
Encode data using xor

Disassembly:
xor r9b, r9b
mov r10, rdx
test r8, r8
je 0x180135f97
sub r10, rcx
nop
movzx edx, byte [r10 + rcx]
movzx eax, byte [rcx]
lea rcx, [rcx + 1]
xor dl, al
or r9b, dl
sub r8, 1
jne 0x180135f80
movzx eax, r9b
ret

Function at 0x180158140
Capabilities:
Encode data using base64

Disassembly:
mov eax, 8
call fcn.180131170
sub rsp, rax
xor r11d, r11d
mov r9, rcx
test r8d, r8d
jle 0x180158255
mov qword [rsp + 0x10], rbx
inc rdx
mov qword [rsp], rdi
lea rdi, str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_
nop
movzx eax, byte [rdx - 1]
cmp r8d, 3
jl 0x1801581ce
movzx ecx, al
movzx eax, byte [rdx]
shl rcx, 8
or rcx, rax
movzx eax, byte [rdx + 1]
shl rcx, 8
or rcx, rax
mov rax, rcx
shr rax, 0x12
movzx eax, byte [rax + rdi]
mov byte [r9], al
mov rax, rcx
shr rax, 0xc
inc r9
and eax, 0x3f
mov r10, r9
movzx eax, byte [rax + rdi]
mov byte [r9], al
mov rax, rcx
and eax, 0x3f
shr rcx, 6
and ecx, 0x3f
movzx ebx, byte [rax + rdi]
movzx eax, byte [rcx + rdi]
jmp 0x18015821d
movzx ecx, al
shl ecx, 0x10
cmp r8d, 2
jne 0x1801581e2
movzx eax, byte [rdx]
shl eax, 8
or ecx, eax
mov eax, ecx
lea r10, [r9 + 1]
shr rcx, 0x12
movzx ecx, byte [rcx + rdi]
mov byte [r9], cl
mov ecx, eax
shr rcx, 0xc
mov r9, r10
and ecx, 0x3f
movzx ecx, byte [rcx + rdi]
mov byte [r10], cl
cmp r8d, 1
jne 0x180158210
mov al, 0x3d
jmp 0x18015821b
shr rax, 6
and eax, 0x3f
movzx eax, byte [rax + rdi]
mov bl, 0x3d
lea rcx, [r9 + 2]
mov byte [r10 + 1], al
add r11d, 4
mov byte [rcx], bl
add rdx, 3
lea r9, [rcx + 1]
sub r8d, 3
test r8d, r8d
jg 0x180158170
mov rdi, qword [rsp]
mov eax, r11d
mov rbx, qword [rsp + 0x10]
mov byte [r9], 0
add rsp, 8
ret
mov byte [rcx], r11b
mov eax, r11d
add rsp, 8
ret
Function at 0x18015d530
Capabilities:
Check for software breakpoints

Disassembly:
mov eax, 0x38
call fcn.180131170
sub rsp, rax
mov r11, rcx
cmp dword [rsp + 0x60], r9d
jne 0x18015d623
movzx r10d, byte [r8]
lea eax, [r10 - 0x6a]
cmp al, 1
ja 0x18015d623
mov qword [rsp + 0x30], rbx
lea rdx, [r8 + 1]
cmp r10b, 0x6b
jne 0x18015d5d0
lea ebx, [r9 - 3]
xor eax, eax
test ebx, ebx
jle 0x18015d58a
movzx ecx, byte [rdx]
inc rdx
cmp cl, 0xba
je 0x18015d58a
cmp cl, 0xbb
jne 0x18015d5bf
inc eax
cmp eax, ebx
jl 0x18015d574
sub ebx, eax
test eax, eax
jne 0x18015d5d4
mov dword [rsp + 0x20], 0x83
lea r9, [0x180368d90]
mov edx, 0x80
lea ecx, [rdx - 0x7c]
lea r8d, [rdx + 0xa]
call fcn.180136d10
mov rbx, qword [rsp + 0x30]
mov eax, 0xffffffff
add rsp, 0x38
ret
mov dword [rsp + 0x20], 0x7b
lea r9, [0x180368d78]
jmp 0x18015d59f
lea ebx, [r9 - 2]
movsxd rax, ebx
cmp byte [rax + rdx], 0xcc
je 0x18015d60c
mov edx, 0x80
mov dword [rsp + 0x20], 0x8b
lea r9, str..crypto_rsa_rsa_x931.c
lea ecx, [rdx - 0x7c]
lea r8d, [rdx + 0xb]
call fcn.180136d10
mov rbx, qword [rsp + 0x30]
mov eax, 0xffffffff
add rsp, 0x38
ret
mov r8d, ebx
mov rcx, r11
call fcn.1801ad280
mov eax, ebx
mov rbx, qword [rsp + 0x30]
add rsp, 0x38
ret
mov edx, 0x80
mov dword [rsp + 0x20], WSACleanup
lea r9, [0x180368d60]
lea ecx, [rdx - 0x7c]
lea r8d, [rdx + 9]
call fcn.180136d10
mov eax, 0xffffffff
add rsp, 0x38
ret

Function at 0x18015e3c0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push r14
mov eax, 0x20
call fcn.180131170
sub rsp, rax
mov esi, dword [rdx + 8]
mov r14, rdx
mov rbx, rcx
test esi, esi
jne 0x18015e401
xor edx, edx
call fcn.18012f2e0
lea eax, [rsi + 1]
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
lea eax, [rsi - 1]
mov qword [rsp + 0x30], rdi
movsxd rdi, eax
xor eax, eax
mov qword [rsp + 0x38], r15
mov r15, qword [rdx]
mov rcx, qword [r15 + rdi*8]
cmp rcx, 1
sete al
sub esi, eax
cmp r14, rbx
je 0x18015e44c
cmp esi, dword [rbx + 0xc]
jg 0x18015e432
mov rax, rbx
jmp 0x18015e43c
mov edx, esi
mov rcx, rbx
call fcn.18012fa80
test rax, rax
je 0x18015e4b6
mov eax, dword [r14 + 0x10]
mov dword [rbx + 0x10], eax
mov rcx, qword [r15 + rdi*8]
mov rdx, qword [rbx]
mov rax, rcx
xor rax, 1
inc rax
neg rax
shl rax, 0x3f
lea r8, [rdx + rdi*8]
shr rcx, 1
je 0x18015e46c
mov qword [r8], rcx
test rdi, rdi
jle 0x18015e4ae
sub r15, rdx
nop dword [rax]
nop dword [rax + rax]
mov rdx, qword [r15 + r8 - 8]
lea r8, [r8 - 8]
mov rcx, rdx
dec rdi
shr rcx, 1
or rcx, rax
mov rax, rdx
xor rax, 1
mov qword [r8], rcx
inc rax
neg rax
shl rax, 0x3f
test rdi, rdi
jg 0x18015e480
mov dword [rbx + 8], esi
mov eax, 1
mov rdi, qword [rsp + 0x30]
mov r15, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
Function at 0x180182ce0
Capabilities:
Check for time delay via gettickcount

Disassembly:
mov eax, 0x28
call fcn.180131170
sub rsp, rax
cmp dword [0x18036eb4c], 0
je 0x180182d28
lea rcx, [rsp + 0x38]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
test eax, eax
jne 0x180182d0d
mov dword [0x18036eb4c], eax
jmp 0x180182d28
xorps xmm2, xmm2
lea rcx, [rsp + 0x38]
mov edx, 8
call fcn.180143ff0
cmp dword [0x18036eb4c], 0
jne 0x180182d44
call qword [sym.imp.KERNEL32.dll_GetTickCount]
xorps xmm2, xmm2
lea rcx, [rsp + 0x30]
mov edx, 4
mov dword [rsp + 0x30], eax
call fcn.180143ff0
add rsp, 0x28
ret

Function at 0x180189ff0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
mov eax, 0x20
call fcn.180131170
sub rsp, rax
mov r9d, dword [rdx + 8]
mov rsi, rdx
cmp r9d, dword [r8 + 8]
mov rdi, r8
mov rbx, rcx
cmovge rdi, rdx
cmovge rsi, r8
mov edx, dword [rdi + 8]
cmp edx, dword [rcx + 0xc]
jg 0x18018a02e
mov rax, rcx
jmp 0x18018a033
call fcn.18012fa80
test rax, rax
jne 0x18018a048
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
xor r8d, r8d
cmp dword [rsi + 8], r8d
jle 0x18018a085
xor r9d, r9d
nop dword [rax]
nop dword [rax + rax]
mov rax, qword [rsi]
lea r9, [r9 + 8]
mov rcx, qword [rdi]
inc r8d
mov rdx, qword [rcx + r9 - 8]
xor rdx, qword [r9 + rax - 8]
mov rax, qword [rbx]
mov qword [r9 + rax - 8], rdx
cmp r8d, dword [rsi + 8]
jl 0x18018a060
mov eax, dword [rdi + 8]
cmp r8d, eax
jge 0x18018a0bf
movsxd rax, r8d
lea rdx, [rax*8]
nop dword [rax + rax]
mov rax, qword [rdi]
lea rdx, [rdx + 8]
mov rcx, qword [rbx]
inc r8d
mov rax, qword [rdx + rax - 8]
mov qword [rdx + rcx - 8], rax
mov eax, dword [rdi + 8]
cmp r8d, eax
jl 0x18018a0a0
mov dword [rbx + 8], eax
test eax, eax
jle 0x18018a0eb
mov rcx, qword [rbx]
sub rcx, 8
movsxd r8, eax
lea r8, [rcx + r8*8]
mov rcx, qword [r8]
lea r8, [r8 - 8]
test rcx, rcx
jne 0x18018a0e6
dec eax
test eax, eax
jg 0x18018a0d4
mov dword [rbx + 8], eax
test eax, eax
jne 0x18018a0f4
mov dword [rbx + 0x10], 0
mov rbx, qword [rsp + 0x30]
mov eax, 1
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x1801a48d0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
mov eax, 0x20
call fcn.180131170
sub rsp, rax
mov rbp, qword [rsp + 0x70]
mov r12, r9
mov r13, qword [rsp + 0x78]
mov r10, rbp
mov rdi, r8
mov rbx, rdx
mov rsi, rcx
cmp r8, 0x10
jb 0x1801a4968
mov rbp, r8
shr rbp, 4
imul rax, rbp, 0xfffffffffffffff0
add rdi, rax
nop word [rax + rax]
sub r10, rsi
mov r8, rbx
sub r8, rsi
mov rcx, rsi
mov edx, 2
mov rax, qword [r10 + rcx]
xor rax, qword [rcx]
mov qword [r8 + rcx], rax
lea rcx, [rcx + 8]
sub rdx, 1
jne 0x1801a4931
mov r8, r12
mov rdx, rbx
mov rcx, rbx
call r13
mov r10, rbx
add rsi, 0x10
add rbx, 0x10
sub rbp, 1
jne 0x1801a4920
mov rbp, qword [rsp + 0x70]
test rdi, rdi
je 0x1801a4a82
mov qword [rsp + 0x50], r14
mov qword [rsp + 0x58], r15
nop dword [rax + rax]
mov r8, r10
mov r9, rbx
mov r11d, 1
mov r14d, 2
sub r8, rsi
sub r9, rsi
sub r11, rsi
sub r14, rsi
xor eax, eax
mov r15d, 3
sub r15, rsi
nop dword [rax]
cmp rax, rdi
jae 0x1801a4a24
lea rdx, [rax + rsi]
movzx ecx, byte [r8 + rdx]
xor cl, byte [rdx]
mov byte [r9 + rdx], cl
lea rcx, [r11 + rdx]
cmp rcx, rdi
jae 0x1801a4a21
movzx ecx, byte [rsi + rax + 1]
xor cl, byte [rax + r10 + 1]
mov byte [rbx + rax + 1], cl
lea rcx, [r14 + rdx]
cmp rcx, rdi
jae 0x1801a4a1b
movzx ecx, byte [rsi + rax + 2]
xor cl, byte [rax + r10 + 2]
mov byte [rbx + rax + 2], cl
lea rcx, [r15 + rdx]
cmp rcx, rdi
jae 0x1801a4a15
movzx ecx, byte [rsi + rax + 3]
xor cl, byte [rax + r10 + 3]
mov byte [rbx + rax + 3], cl
add rax, 4
cmp rax, 0x10
jb 0x1801a49b0
jmp 0x1801a4a51
add rax, 3
jmp 0x1801a4a24
add rax, 2
jmp 0x1801a4a24
inc rax
cmp rax, 0x10
jae 0x1801a4a51
sub r10, rbx
lea rcx, [rax + rbx]
mov edx, recvfrom
sub rdx, rax
nop dword [rax]
movzx eax, byte [r10 + rcx]
mov byte [rcx], al
lea rcx, [rcx + 1]
sub rdx, 1
jne 0x1801a4a40
mov r8, r12
mov rdx, rbx
mov rcx, rbx
call r13
mov r10, rbx
cmp rdi, 0x10
jbe 0x1801a4a78
add rsi, 0x10
add rbx, 0x10
sub rdi, 0x10
jne 0x1801a4980
mov r14, qword [rsp + 0x50]
mov r15, qword [rsp + 0x58]
movups xmm0, xmmword [r10]
mov rbx, qword [rsp + 0x60]
movups xmmword [rbp], xmm0
add rsp, 0x20
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x1801a4aa0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov eax, 0x50
call fcn.180131170
sub rsp, rax
mov rax, qword [0x180357758]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov r14, qword [rsp + 0xb0]
mov r12, r9
mov r13, qword [rsp + 0xb8]
mov rdi, r8
mov rsi, rdx
mov rbx, rcx
cmp rcx, rdx
je 0x1801a4b39
mov r15, r14
cmp r8, 0x10
jb 0x1801a4b2f
mov rbp, r8
shr rbp, 4
imul rax, rbp, 0xfffffffffffffff0
add rdi, rax
mov r8, r12
mov rdx, rsi
mov rcx, rbx
call r13
mov rax, qword [r15]
xor qword [rsi], rax
mov rax, qword [r15 + 8]
mov r15, rbx
xor qword [rsi + 8], rax
add rbx, 0x10
add rsi, 0x10
sub rbp, 1
jne 0x1801a4b04
movups xmm0, xmmword [r15]
movups xmmword [r14], xmm0
jmp 0x1801a4b92
cmp rdi, 0x10
jb 0x1801a4b92
mov rbp, rdi
shr rbp, 4
imul rax, rbp, 0xfffffffffffffff0
add rdi, rax
nop dword [rax]
mov r8, r12
lea rdx, [rsp + 0x38]
mov rcx, rbx
call r13
mov rcx, qword [rbx]
mov rax, qword [r14]
xor rax, qword [rsp + 0x38]
mov qword [rsi], rax
mov rax, qword [r14 + 8]
xor rax, qword [rsp + 0x40]
mov qword [r14], rcx
mov rcx, qword [rbx + 8]
add rbx, 0x10
mov qword [rsi + 8], rax
add rsi, 0x10
mov qword [r14 + 8], rcx
sub rbp, 1
jne 0x1801a4b50
test rdi, rdi
je 0x1801a4d10
lea rcx, [rsp + 0x38]
mov rax, r14
sub rax, rcx
lea r15, [rsp + 0x39]
mov qword [rsp + 0x20], rax
lea rcx, [rsp + 0x38]
mov eax, 1
mov ebp, 3
sub rax, rcx
lea rcx, [rsp + 0x38]
mov qword [rsp + 0x28], rax
mov eax, 2
sub rax, rcx
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x38]
sub rbp, rax
inc rsi
neg r15
nop word [rax + rax]
mov r8, r12
lea rdx, [rsp + 0x38]
mov rcx, rbx
call r13
mov r10, qword [rsp + 0x20]
lea r9, [r15 + rsi]
xor eax, eax
nop dword [rax]
cmp rax, rdi
jae 0x1801a4cc4
lea r8, [rsp + 0x38]
add r8, rax
lea rcx, [r8 + rbx]
movzx edx, byte [rcx + r15 + 1]
movzx ecx, byte [r8]
xor cl, byte [r10 + r8]
mov byte [r8 + r9], cl
mov rcx, qword [rsp + 0x28]
add rcx, r8
mov byte [r10 + r8], dl
cmp rcx, rdi
jae 0x1801a4cc1
movzx ecx, byte [r8 + 1]
xor cl, byte [r14 + rax + 1]
movzx edx, byte [rax + rbx + 1]
mov byte [rsi + rax], cl
mov rcx, qword [rsp + 0x30]
add rcx, r8
mov byte [r14 + rax + 1], dl
cmp rcx, rdi
jae 0x1801a4cbb
movzx ecx, byte [r8 + 2]
xor cl, byte [r14 + rax + 2]
movzx edx, byte [rbx + rax + 2]
mov byte [rsi + rax + 1], cl
lea rcx, [r8 + rbp]
mov byte [r14 + rax + 2], dl
cmp rcx, rdi
jae 0x1801a4cb5
movzx edx, byte [rbx + rax + 3]
movzx ecx, byte [r8 + 3]
xor cl, byte [r14 + rax + 3]
mov byte [rsi + rax + 2], cl
mov byte [r14 + rax + 3], dl
add rax, 4
cmp rax, 0x10
jb 0x1801a4c10
jmp 0x1801a4cc4
add rax, 3
jmp 0x1801a4cc4
add rax, 2
jmp 0x1801a4cc4
inc rax
cmp rdi, 0x10
jbe 0x1801a4cde
add rbx, 0x10
add rsi, 0x10
sub rdi, 0x10
jne 0x1801a4bf0
jmp 0x1801a4d10
cmp rax, 0x10
jae 0x1801a4d10
sub rbx, r14
lea rcx, [r14 + rax]
mov edx, recvfrom
sub rdx, rax
nop dword [rax]
nop word [rax + rax]
movzx eax, byte [rbx + rcx]
mov byte [rcx], al
lea rcx, [rcx + 1]
sub rdx, 1
jne 0x1801a4d00
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.180137e80
mov rbx, qword [rsp + 0xa0]
add rsp, 0x50
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x1801a4ec0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x20], r9
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov eax, gethostbyname
call fcn.180131170
sub rsp, rax
mov r10, r9
mov rbx, r8
mov r9, qword [rsp + 0xa0]
mov r14, rdx
mov rbp, rcx
mov edi, dword [r9]
mov dword [rsp + 0x80], edi
test edi, edi
je 0x1801a4f38
mov rdx, qword [rsp + 0x98]
nop dword [rax]
test rbx, rbx
je 0x1801a4f31
mov eax, edi
dec rbx
movzx ecx, byte [rax + rdx]
xor cl, byte [rbp]
inc rbp
mov byte [r14], cl
inc r14
inc edi
and edi, 0xf
jne 0x1801a4f10
mov dword [rsp + 0x80], edi
mov r8, qword [rsp + 0x90]
mov esi, 1
movzx r12d, byte [r8 + 0xc]
lea r15, [r8 + 0xc]
mov r11, qword [rsp + 0xa8]
shl r12d, 8
movzx eax, byte [r8 + 0xd]
lea r13d, [rsi + 0xb]
or r12d, eax
movzx eax, byte [r8 + 0xe]
shl r12d, 8
or r12d, eax
movzx eax, byte [r8 + 0xf]
shl r12d, 8
or r12d, eax
cmp rbx, 0x10
jb 0x1801a506e
mov eax, 0x10000000
mov edi, r13d
mov qword [rsp + 0x20], r8
mov rdx, rbx
shr rdx, 4
mov r9, r10
cmp rdx, rax
cmova rdx, rax
add r12d, edx
mov r13, rdx
mov eax, r12d
mov ecx, r12d
sub r13, rax
cmp rax, rdx
cmovae r13, rdx
xor r12d, r12d
cmp rax, rdx
mov r8, r13
mov rdx, r14
cmovae r12d, ecx
mov rcx, rbp
call r11
mov r8, qword [rsp + 0x90]
mov eax, r12d
shr eax, 0x18
mov byte [r15], al
mov eax, r12d
shr eax, 0x10
mov byte [r8 + 0xd], al
mov eax, r12d
shr eax, 8
mov byte [r8 + 0xe], al
mov byte [r8 + 0xf], r12b
test r12d, r12d
jne 0x1801a502d
mov r8d, edi
mov eax, esi
mov rdx, r15
nop dword [rax + rax]
movzx ecx, byte [rdx - 1]
lea rdx, [rdx - 1]
add eax, ecx
mov byte [rdx], al
shr eax, 8
add r8d, 0xffffffff
jne 0x1801a5010
mov r8, qword [rsp + 0x90]
mov r10, qword [rsp + 0x88]
mov eax, 0x10000000
mov r11, qword [rsp + 0xa8]
shl r13, 4
sub rbx, r13
add r14, r13
add rbp, r13
cmp rbx, 0x10
jae 0x1801a4f90
mov edi, dword [rsp + 0x80]
mov r13d, reloc.WS2_32.dll_inet_ntoa
mov r9, qword [rsp + 0xa0]
test rbx, rbx
je 0x1801a5111
mov rax, qword [rsp + 0x98]
xor ecx, ecx
mov qword [rsp + 0x20], r8
mov r9, r10
mov r8, rsi
mov rdx, rax
mov qword [rax], rcx
mov qword [rax + 8], rcx
mov rcx, rax
call r11
mov rcx, qword [rsp + 0x90]
inc r12d
mov eax, r12d
shr eax, 0x18
mov byte [r15], al
mov eax, r12d
shr eax, 0x10
mov byte [rcx + 0xd], al
mov eax, r12d
shr eax, 8
mov byte [rcx + 0xe], al
mov byte [rcx + 0xf], r12b
test r12d, r12d
jne 0x1801a50e7
nop dword [rax + rax]
movzx eax, byte [r15 - 1]
lea r15, [r15 - 1]
add esi, eax
mov byte [r15], sil
shr esi, 8
add r13d, 0xffffffff
jne 0x1801a50d0
mov rdx, qword [rsp + 0x98]
nop
mov ecx, edi
inc edi
movzx eax, byte [rcx + rbp]
xor al, byte [rcx + rdx]
mov byte [rcx + r14], al
sub rbx, 1
jne 0x1801a50f0
mov rax, qword [rsp + 0xa0]
mov dword [rax], edi
jmp 0x1801a5114
mov dword [r9], edi
mov rbx, qword [rsp + 0x70]
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x1801a5f40
Capabilities:
Encode data using xor

Disassembly:
push rbp
push rdi
push r14
mov eax, 0x20
call fcn.180131170
sub rsp, rax
cmp qword [rcx + 0x38], 0
mov rdi, r8
mov r14, rdx
mov rbp, rcx
je 0x1801a5f70
mov eax, 0xfffffffe
add rsp, 0x20
pop r14
pop rdi
pop rbp
ret
mov rcx, qword [rcx + 0x30]
movabs rax, 0x2000000000000000
add rcx, r8
cmp rcx, rax
ja 0x1801a6072
cmp rcx, r8
jb 0x1801a6072
mov qword [rsp + 0x40], rbx
lea rbx, [rbp + 0x40]
mov qword [rsp + 0x48], rsi
mov esi, dword [rbp + 0x174]
mov qword [rsp + 0x50], r12
mov qword [rbp + 0x30], rcx
test esi, esi
je 0x1801a5ff9
test rdi, rdi
je 0x1801a5fe4
movzx eax, byte [r14]
lea rbx, [rbp + 0x40]
mov ecx, esi
inc r14
dec rdi
xor byte [rcx + rbx], al
inc esi
and esi, 0xf
jne 0x1801a5fb4
lea r12, [rbp + 0x60]
mov rcx, rbx
mov rdx, r12
call fcn.1801a7180
jmp 0x1801a5ffd
test esi, esi
jne 0x1801a6052
lea r12, [rbp + 0x60]
mov rcx, rbx
mov rdx, r12
call fcn.1801a7180
jmp 0x1801a5ffd
lea r12, [rbp + 0x60]
mov qword [rsp + 0x58], r15
mov r15, rdi
and r15, 0xfffffffffffffff0
je 0x1801a6022
mov r9, r15
mov r8, r14
mov rdx, r12
mov rcx, rbx
call fcn.1801a7300
add r14, r15
sub rdi, r15
mov r15, qword [rsp + 0x58]
test rdi, rdi
je 0x1801a6052
mov esi, edi
sub r14, rbp
nop dword [rax]
nop word [rax + rax]
movzx eax, byte [r14 + rbx - 0x40]
xor byte [rbx], al
lea rbx, [rbx + 1]
sub rdi, 1
jne 0x1801a6040
mov rbx, qword [rsp + 0x40]
xor eax, eax
mov r12, qword [rsp + 0x50]
mov dword [rbp + 0x174], esi
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
pop rdi
pop rbp
ret
mov eax, 0xffffffff
add rsp, 0x20
pop r14
pop rdi
pop rbp
ret
Function at 0x1801a7180
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
mov qword [rsp + 0x20], r14
movzx eax, byte [rcx + 0xf]
lea r14, [0x1802d7f70]
mov r8d, eax
mov rdi, rdx
and eax, 0xf
mov r11, rcx
add rax, rax
and r8, 0xfffffffffffffff0
mov esi, reloc.WS2_32.dll_ntohl
mov r9, qword [rdx + rax*8]
mov rax, qword [rdx + rax*8 + 8]
mov rcx, r9
mov rdx, rax
shr rcx, 4
and edx, 0xf
shr rax, 4
shl r9, 0x3c
or rax, r9
mov rbx, qword [r14 + rdx*8]
xor rbx, rcx
xor rbx, qword [r8 + rdi]
xor rax, qword [r8 + rdi + 8]
nop dword [rax + rax]
movzx ecx, byte [rsi + r11]
mov rdx, rax
shr rax, 4
mov r9d, ecx
and ecx, 0xf
and edx, 0xf
add rcx, rcx
and r9, 0xfffffffffffffff0
lea r8, [rdi + rcx*8]
mov rcx, rbx
shl rbx, 0x3c
mov r10, qword [r14 + rdx*8]
or rbx, rax
xor rbx, qword [r8 + 8]
shr rcx, 4
mov rdx, rbx
xor r10, rcx
shr rdx, 4
xor r10, qword [r8]
mov rcx, rbx
and ecx, 0xf
mov rax, r10
shr rax, 4
mov rbx, qword [r14 + rcx*8]
xor rbx, rax
mov rax, r10
xor rbx, qword [r9 + rdi]
shl rax, 0x3c
or rax, rdx
xor rax, qword [r9 + rdi + 8]
sub rsi, 1
jns 0x1801a71f0
mov rsi, qword [rsp + 0x10]
mov rdx, rbx
mov rdi, qword [rsp + 0x18]
mov r14, qword [rsp + 0x20]
shr rdx, 0x20
mov ecx, edx
mov byte [r11 + 3], dl
shr ecx, 0x18
mov byte [r11], cl
mov ecx, edx
shr ecx, 0x10
mov byte [r11 + 1], cl
mov ecx, edx
shr ecx, 8
mov rdx, rax
mov byte [r11 + 2], cl
mov ecx, ebx
shr ecx, 0x18
mov byte [r11 + 4], cl
mov ecx, ebx
shr ecx, 0x10
mov byte [r11 + 5], cl
mov ecx, ebx
shr ecx, 8
mov byte [r11 + 6], cl
shr rdx, 0x20
mov ecx, edx
mov byte [r11 + 7], bl
mov rbx, qword [rsp + 8]
shr ecx, 0x18
mov byte [r11 + 8], cl
mov ecx, edx
shr ecx, 0x10
mov byte [r11 + 9], cl
mov ecx, edx
shr ecx, 8
mov byte [r11 + 0xa], cl
mov ecx, eax
shr ecx, 0x18
mov byte [r11 + 0xc], cl
mov ecx, eax
shr ecx, 0x10
mov byte [r11 + 0xd], cl
mov ecx, eax
shr ecx, 8
mov byte [r11 + 0xe], cl
mov byte [r11 + 0xb], dl
mov byte [r11 + 0xf], al
ret
Function at 0x1801a7300
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r12
push r13
push r14
push r15
movzx eax, byte [rcx + 0xf]
lea r14, [r8 + 0xe]
mov rsi, rcx
lea r13, [0x1802d7f70]
sub rsi, r8
mov r12, r9
mov rbp, rdx
mov rbx, rcx
nop word [rax + rax]
movzx edx, byte [r14 + 1]
mov rdi, r14
movzx ecx, al
mov r15d, reloc.WS2_32.dll_ntohs
xor rdx, rcx
mov r8, rdx
and edx, 0xf
add rdx, rdx
and r8, 0xfffffffffffffff0
mov r9, qword [rbp + rdx*8]
mov rax, qword [rbp + rdx*8 + 8]
mov rcx, r9
mov rdx, rax
shr rcx, 4
and edx, 0xf
shr rax, 4
shl r9, 0x3c
or rax, r9
mov r11, qword [r13 + rdx*8]
xor r11, rcx
xor r11, qword [r8 + rbp]
xor rax, qword [r8 + rbp + 8]
nop dword [rax]
nop dword [rax + rax]
movzx ecx, byte [rdi]
movzx edx, byte [rsi + rdi]
lea rdi, [rdi - 1]
xor rdx, rcx
mov rcx, r11
mov r9, rdx
shl r11, 0x3c
and edx, 0xf
shr rcx, 4
add rdx, rdx
and r9, 0xfffffffffffffff0
lea r8, [rdx*8]
mov rdx, rax
shr rax, 4
and edx, 0xf
or r11, rax
xor r11, qword [r8 + rbp + 8]
mov r10, qword [r13 + rdx*8]
mov rdx, r11
xor r10, rcx
shr rdx, 4
xor r10, qword [r8 + rbp]
mov rcx, r11
and ecx, 0xf
mov rax, r10
shr rax, 4
mov r11, qword [r13 + rcx*8]
xor r11, rax
mov rax, r10
xor r11, qword [r9 + rbp]
shl rax, 0x3c
or rax, rdx
xor rax, qword [r9 + rbp + 8]
sub r15, 1
jne 0x1801a73a0
mov rdx, r11
mov byte [rbx + 7], r11b
shr rdx, 0x20
add r14, 0x10
mov ecx, edx
mov byte [rbx + 3], dl
shr ecx, 0x18
sub rsi, 0x10
mov byte [rbx], cl
mov ecx, edx
shr ecx, 0x10
mov byte [rbx + 1], cl
mov ecx, edx
shr ecx, 8
mov rdx, rax
mov byte [rbx + 2], cl
mov ecx, r11d
shr ecx, 0x18
mov byte [rbx + 4], cl
mov ecx, r11d
shr ecx, 0x10
mov byte [rbx + 5], cl
mov ecx, r11d
shr ecx, 8
mov byte [rbx + 6], cl
shr rdx, 0x20
mov ecx, edx
mov byte [rbx + 0xb], dl
shr ecx, 0x18
mov byte [rbx + 8], cl
mov ecx, edx
shr ecx, 0x10
mov byte [rbx + 9], cl
mov ecx, edx
shr ecx, 8
mov byte [rbx + 0xa], cl
mov ecx, eax
shr ecx, 0x18
mov byte [rbx + 0xc], cl
mov ecx, eax
shr ecx, 0x10
mov byte [rbx + 0xd], cl
mov ecx, eax
shr ecx, 8
mov byte [rbx + 0xe], cl
mov byte [rbx + 0xf], al
sub r12, 0x10
jne 0x1801a7340
mov rbx, qword [rsp + 0x28]
mov rbp, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x40]
pop r15
pop r14
pop r13
pop r12
ret