joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1802f6ab0
Capabilities:
Allocate or change rwx memory

Disassembly:
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
sub rsp, 0x48
mov rax, qword [rsp + 0x50]
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x38]
mov eax, dword [rax]
cmp rax, 0x688
jne 0x1802f6ae3
mov rax, qword [rsp + 0x38]
mov ecx, dword [rsp + 0x58]
cmp dword [rax], ecx
jbe 0x1802f6af5
mov ecx, 0xc1
call qword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
jmp 0x1802f6c92
mov dword [rsp + 0x30], 0xffffffff
mov dword [rsp + 0x20], 0xffffffff
mov dword [rsp + 0x2c], 0xffffffff
mov dword [rsp + 0x24], 0
mov rax, qword [rsp + 0x38]
mov eax, dword [rax + 4]
lea r9, [rsp + 0x30]
mov r8d, 0x40
mov edx, eax
mov rax, qword [rsp + 0x38]
mov rcx, qword [rax + 0x10]
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x1802f6c8e
mov rax, qword [rsp + 0x38]
mov eax, dword [rax + 8]
lea r9, [rsp + 0x20]
mov r8d, 0x40
mov edx, eax
mov rax, qword [rsp + 0x38]
mov rcx, qword [rax + 0x18]
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x1802f6c6b
mov rax, qword [rsp + 0x38]
mov eax, dword [rax + 4]
mov rcx, qword [rsp + 0x38]
add rcx, 0x28
mov r8d, eax
mov rdx, rcx
mov rax, qword [rsp + 0x38]
mov rcx, qword [rax + 0x10]
call fcn.180377ac0
mov rax, qword [rsp + 0x38]
mov eax, dword [rax + 8]
mov rcx, qword [rsp + 0x38]
add rcx, 0x68
mov r8d, eax
mov rdx, rcx
mov rax, qword [rsp + 0x38]
mov rcx, qword [rax + 0x18]
call fcn.180377ac0
mov rax, qword [rsp + 0x38]
cmp qword [rax + 0x20], 0
je 0x1802f6c40
mov rax, qword [rsp + 0x38]
mov eax, dword [rax + 0xc]
lea r9, [rsp + 0x2c]
mov r8d, 0x40
mov edx, eax
mov rax, qword [rsp + 0x38]
mov rcx, qword [rax + 0x20]
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x1802f6c3e
mov rax, qword [rsp + 0x38]
mov eax, dword [rax + 0xc]
mov rcx, qword [rsp + 0x38]
add rcx, 0x670
mov r8d, eax
mov rdx, rcx
mov rax, qword [rsp + 0x38]
mov rcx, qword [rax + 0x20]
call fcn.180377ac0
mov rax, qword [rsp + 0x38]
mov eax, dword [rax + 0xc]
lea r9, [rsp + 0x28]
mov r8d, dword [rsp + 0x2c]
mov edx, eax
mov rax, qword [rsp + 0x38]
mov rcx, qword [rax + 0x20]
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov dword [rsp + 0x24], 1
jmp 0x1802f6c48
mov dword [rsp + 0x24], 1
mov rax, qword [rsp + 0x38]
mov eax, dword [rax + 8]
lea r9, [rsp + 0x28]
mov r8d, dword [rsp + 0x20]
mov edx, eax
mov rax, qword [rsp + 0x38]
mov rcx, qword [rax + 0x18]
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov rax, qword [rsp + 0x38]
mov eax, dword [rax + 4]
lea r9, [rsp + 0x28]
mov r8d, dword [rsp + 0x30]
mov edx, eax
mov rax, qword [rsp + 0x38]
mov rcx, qword [rax + 0x10]
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov eax, dword [rsp + 0x24]
add rsp, 0x48
ret

Function at 0x1802f79e0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov eax, 0x28
call fcn.1802fb9b0
sub rsp, rax
add rsp, 0x28
jmp fcn.1802fd880
Function at 0x1803007b0
Capabilities:
Encode data using xor

Disassembly:
xor r9b, r9b
mov r10, rdx
test r8, r8
je 0x1803007d7
sub r10, rcx
nop
movzx edx, byte [r10 + rcx]
movzx eax, byte [rcx]
lea rcx, [rcx + 1]
xor dl, al
or r9b, dl
sub r8, 1
jne 0x1803007c0
movzx eax, r9b
ret

Function at 0x180322980
Capabilities:
Encode data using base64

Disassembly:
mov eax, 8
call fcn.1802fb9b0
sub rsp, rax
xor r11d, r11d
mov r9, rcx
test r8d, r8d
jle 0x180322a95
mov qword [rsp + 0x10], rbx
inc rdx
mov qword [rsp], rdi
lea rdi, str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_
nop
movzx eax, byte [rdx - 1]
cmp r8d, 3
jl 0x180322a0e
movzx ecx, al
movzx eax, byte [rdx]
shl rcx, 8
or rcx, rax
movzx eax, byte [rdx + 1]
shl rcx, 8
or rcx, rax
mov rax, rcx
shr rax, 0x12
movzx eax, byte [rax + rdi]
mov byte [r9], al
mov rax, rcx
shr rax, 0xc
inc r9
and eax, 0x3f
mov r10, r9
movzx eax, byte [rax + rdi]
mov byte [r9], al
mov rax, rcx
and eax, 0x3f
shr rcx, 6
and ecx, 0x3f
movzx ebx, byte [rax + rdi]
movzx eax, byte [rcx + rdi]
jmp 0x180322a5d
movzx ecx, al
shl ecx, 0x10
cmp r8d, 2
jne 0x180322a22
movzx eax, byte [rdx]
shl eax, 8
or ecx, eax
mov eax, ecx
lea r10, [r9 + 1]
shr rcx, 0x12
movzx ecx, byte [rcx + rdi]
mov byte [r9], cl
mov ecx, eax
shr rcx, 0xc
mov r9, r10
and ecx, 0x3f
movzx ecx, byte [rcx + rdi]
mov byte [r10], cl
cmp r8d, 1
jne 0x180322a50
mov al, 0x3d
jmp 0x180322a5b
shr rax, 6
and eax, 0x3f
movzx eax, byte [rax + rdi]
mov bl, 0x3d
lea rcx, [r9 + 2]
mov byte [r10 + 1], al
add r11d, 4
mov byte [rcx], bl
add rdx, 3
lea r9, [rcx + 1]
sub r8d, 3
test r8d, r8d
jg 0x1803229b0
mov rdi, qword [rsp]
mov eax, r11d
mov rbx, qword [rsp + 0x10]
mov byte [r9], 0
add rsp, 8
ret
mov byte [rcx], r11b
mov eax, r11d
add rsp, 8
ret
Function at 0x180327d70
Capabilities:
Check for software breakpoints

Disassembly:
mov eax, 0x38
call fcn.1802fb9b0
sub rsp, rax
mov r11, rcx
cmp dword [rsp + 0x60], r9d
jne 0x180327e63
movzx r10d, byte [r8]
lea eax, [r10 - 0x6a]
cmp al, 1
ja 0x180327e63
mov qword [rsp + 0x30], rbx
lea rdx, [r8 + 1]
cmp r10b, 0x6b
jne 0x180327e10
lea ebx, [r9 - 3]
xor eax, eax
test ebx, ebx
jle 0x180327dca
movzx ecx, byte [rdx]
inc rdx
cmp cl, 0xba
je 0x180327dca
cmp cl, 0xbb
jne 0x180327dff
inc eax
cmp eax, ebx
jl 0x180327db4
sub ebx, eax
test eax, eax
jne 0x180327e14
mov dword [rsp + 0x20], 0x83
lea r9, [0x1805d5ed0]
mov edx, 0x80
lea ecx, [rdx - 0x7c]
lea r8d, [rdx + 0xa]
call fcn.180301550
mov rbx, qword [rsp + 0x30]
mov eax, 0xffffffff
add rsp, 0x38
ret
mov dword [rsp + 0x20], 0x7b
lea r9, [0x1805d5eb8]
jmp 0x180327ddf
lea ebx, [r9 - 2]
movsxd rax, ebx
cmp byte [rax + rdx], 0xcc
je 0x180327e4c
mov edx, 0x80
mov dword [rsp + 0x20], 0x8b
lea r9, str..crypto_rsa_rsa_x931.c
lea ecx, [rdx - 0x7c]
lea r8d, [rdx + 0xb]
call fcn.180301550
mov rbx, qword [rsp + 0x30]
mov eax, 0xffffffff
add rsp, 0x38
ret
mov r8d, ebx
mov rcx, r11
call fcn.180377ac0
mov eax, ebx
mov rbx, qword [rsp + 0x30]
add rsp, 0x38
ret
mov edx, 0x80
mov dword [rsp + 0x20], WSACleanup
lea r9, [0x1805d5ea0]
lea ecx, [rdx - 0x7c]
lea r8d, [rdx + 9]
call fcn.180301550
mov eax, 0xffffffff
add rsp, 0x38
ret

Function at 0x180328c00
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push r14
mov eax, 0x20
call fcn.1802fb9b0
sub rsp, rax
mov esi, dword [rdx + 8]
mov r14, rdx
mov rbx, rcx
test esi, esi
jne 0x180328c41
xor edx, edx
call fcn.1802f9b30
lea eax, [rsi + 1]
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
lea eax, [rsi - 1]
mov qword [rsp + 0x30], rdi
movsxd rdi, eax
xor eax, eax
mov qword [rsp + 0x38], r15
mov r15, qword [rdx]
mov rcx, qword [r15 + rdi*8]
cmp rcx, 1
sete al
sub esi, eax
cmp r14, rbx
je 0x180328c8c
cmp esi, dword [rbx + 0xc]
jg 0x180328c72
mov rax, rbx
jmp 0x180328c7c
mov edx, esi
mov rcx, rbx
call fcn.1802fa2d0
test rax, rax
je 0x180328cf6
mov eax, dword [r14 + 0x10]
mov dword [rbx + 0x10], eax
mov rcx, qword [r15 + rdi*8]
mov rdx, qword [rbx]
mov rax, rcx
xor rax, 1
inc rax
neg rax
shl rax, 0x3f
lea r8, [rdx + rdi*8]
shr rcx, 1
je 0x180328cac
mov qword [r8], rcx
test rdi, rdi
jle 0x180328cee
sub r15, rdx
nop dword [rax]
nop dword [rax + rax]
mov rdx, qword [r15 + r8 - 8]
lea r8, [r8 - 8]
mov rcx, rdx
dec rdi
shr rcx, 1
or rcx, rax
mov rax, rdx
xor rax, 1
mov qword [r8], rcx
inc rax
neg rax
shl rax, 0x3f
test rdi, rdi
jg 0x180328cc0
mov dword [rbx + 8], esi
mov eax, 1
mov rdi, qword [rsp + 0x30]
mov r15, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
Function at 0x18034d520
Capabilities:
Check for time delay via gettickcount

Disassembly:
mov eax, 0x28
call fcn.1802fb9b0
sub rsp, rax
cmp dword [0x1805dbc8c], 0
je 0x18034d568
lea rcx, [rsp + 0x38]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
test eax, eax
jne 0x18034d54d
mov dword [0x1805dbc8c], eax
jmp 0x18034d568
xorps xmm2, xmm2
lea rcx, [rsp + 0x38]
mov edx, 8
call fcn.18030e830
cmp dword [0x1805dbc8c], 0
jne 0x18034d584
call qword [sym.imp.KERNEL32.dll_GetTickCount]
xorps xmm2, xmm2
lea rcx, [rsp + 0x30]
mov edx, 4
mov dword [rsp + 0x30], eax
call fcn.18030e830
add rsp, 0x28
ret

Function at 0x180354830
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
mov eax, 0x20
call fcn.1802fb9b0
sub rsp, rax
mov r9d, dword [rdx + 8]
mov rsi, rdx
cmp r9d, dword [r8 + 8]
mov rdi, r8
mov rbx, rcx
cmovge rdi, rdx
cmovge rsi, r8
mov edx, dword [rdi + 8]
cmp edx, dword [rcx + 0xc]
jg 0x18035486e
mov rax, rcx
jmp 0x180354873
call fcn.1802fa2d0
test rax, rax
jne 0x180354888
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
xor r8d, r8d
cmp dword [rsi + 8], r8d
jle 0x1803548c5
xor r9d, r9d
nop dword [rax]
nop dword [rax + rax]
mov rax, qword [rsi]
lea r9, [r9 + 8]
mov rcx, qword [rdi]
inc r8d
mov rdx, qword [rcx + r9 - 8]
xor rdx, qword [r9 + rax - 8]
mov rax, qword [rbx]
mov qword [r9 + rax - 8], rdx
cmp r8d, dword [rsi + 8]
jl 0x1803548a0
mov eax, dword [rdi + 8]
cmp r8d, eax
jge 0x1803548ff
movsxd rax, r8d
lea rdx, [rax*8]
nop dword [rax + rax]
mov rax, qword [rdi]
lea rdx, [rdx + 8]
mov rcx, qword [rbx]
inc r8d
mov rax, qword [rdx + rax - 8]
mov qword [rdx + rcx - 8], rax
mov eax, dword [rdi + 8]
cmp r8d, eax
jl 0x1803548e0
mov dword [rbx + 8], eax
test eax, eax
jle 0x18035492b
mov rcx, qword [rbx]
sub rcx, 8
movsxd r8, eax
lea r8, [rcx + r8*8]
mov rcx, qword [r8]
lea r8, [r8 - 8]
test rcx, rcx
jne 0x180354926
dec eax
test eax, eax
jg 0x180354914
mov dword [rbx + 8], eax
test eax, eax
jne 0x180354934
mov dword [rbx + 0x10], 0
mov rbx, qword [rsp + 0x30]
mov eax, 1
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x18036f110
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
mov eax, 0x20
call fcn.1802fb9b0
sub rsp, rax
mov rbp, qword [rsp + 0x70]
mov r12, r9
mov r13, qword [rsp + 0x78]
mov r10, rbp
mov rdi, r8
mov rbx, rdx
mov rsi, rcx
cmp r8, 0x10
jb 0x18036f1a8
mov rbp, r8
shr rbp, 4
imul rax, rbp, 0xfffffffffffffff0
add rdi, rax
nop word [rax + rax]
sub r10, rsi
mov r8, rbx
sub r8, rsi
mov rcx, rsi
mov edx, 2
mov rax, qword [r10 + rcx]
xor rax, qword [rcx]
mov qword [r8 + rcx], rax
lea rcx, [rcx + 8]
sub rdx, 1
jne 0x18036f171
mov r8, r12
mov rdx, rbx
mov rcx, rbx
call r13
mov r10, rbx
add rsi, 0x10
add rbx, 0x10
sub rbp, 1
jne 0x18036f160
mov rbp, qword [rsp + 0x70]
test rdi, rdi
je 0x18036f2c2
mov qword [rsp + 0x50], r14
mov qword [rsp + 0x58], r15
nop dword [rax + rax]
mov r8, r10
mov r9, rbx
mov r11d, 1
mov r14d, 2
sub r8, rsi
sub r9, rsi
sub r11, rsi
sub r14, rsi
xor eax, eax
mov r15d, 3
sub r15, rsi
nop dword [rax]
cmp rax, rdi
jae 0x18036f264
lea rdx, [rax + rsi]
movzx ecx, byte [r8 + rdx]
xor cl, byte [rdx]
mov byte [r9 + rdx], cl
lea rcx, [r11 + rdx]
cmp rcx, rdi
jae 0x18036f261
movzx ecx, byte [rsi + rax + 1]
xor cl, byte [rax + r10 + 1]
mov byte [rbx + rax + 1], cl
lea rcx, [r14 + rdx]
cmp rcx, rdi
jae 0x18036f25b
movzx ecx, byte [rsi + rax + 2]
xor cl, byte [rax + r10 + 2]
mov byte [rbx + rax + 2], cl
lea rcx, [r15 + rdx]
cmp rcx, rdi
jae 0x18036f255
movzx ecx, byte [rsi + rax + 3]
xor cl, byte [rax + r10 + 3]
mov byte [rbx + rax + 3], cl
add rax, 4
cmp rax, 0x10
jb 0x18036f1f0
jmp 0x18036f291
add rax, 3
jmp 0x18036f264
add rax, 2
jmp 0x18036f264
inc rax
cmp rax, 0x10
jae 0x18036f291
sub r10, rbx
lea rcx, [rax + rbx]
mov edx, recvfrom
sub rdx, rax
nop dword [rax]
movzx eax, byte [r10 + rcx]
mov byte [rcx], al
lea rcx, [rcx + 1]
sub rdx, 1
jne 0x18036f280
mov r8, r12
mov rdx, rbx
mov rcx, rbx
call r13
mov r10, rbx
cmp rdi, 0x10
jbe 0x18036f2b8
add rsi, 0x10
add rbx, 0x10
sub rdi, 0x10
jne 0x18036f1c0
mov r14, qword [rsp + 0x50]
mov r15, qword [rsp + 0x58]
movups xmm0, xmmword [r10]
mov rbx, qword [rsp + 0x60]
movups xmmword [rbp], xmm0
add rsp, 0x20
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x18036f2e0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov eax, 0x50
call fcn.1802fb9b0
sub rsp, rax
mov rax, qword [0x1805c4898]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov r14, qword [rsp + 0xb0]
mov r12, r9
mov r13, qword [rsp + 0xb8]
mov rdi, r8
mov rsi, rdx
mov rbx, rcx
cmp rcx, rdx
je 0x18036f379
mov r15, r14
cmp r8, 0x10
jb 0x18036f36f
mov rbp, r8
shr rbp, 4
imul rax, rbp, 0xfffffffffffffff0
add rdi, rax
mov r8, r12
mov rdx, rsi
mov rcx, rbx
call r13
mov rax, qword [r15]
xor qword [rsi], rax
mov rax, qword [r15 + 8]
mov r15, rbx
xor qword [rsi + 8], rax
add rbx, 0x10
add rsi, 0x10
sub rbp, 1
jne 0x18036f344
movups xmm0, xmmword [r15]
movups xmmword [r14], xmm0
jmp 0x18036f3d2
cmp rdi, 0x10
jb 0x18036f3d2
mov rbp, rdi
shr rbp, 4
imul rax, rbp, 0xfffffffffffffff0
add rdi, rax
nop dword [rax]
mov r8, r12
lea rdx, [rsp + 0x38]
mov rcx, rbx
call r13
mov rcx, qword [rbx]
mov rax, qword [r14]
xor rax, qword [rsp + 0x38]
mov qword [rsi], rax
mov rax, qword [r14 + 8]
xor rax, qword [rsp + 0x40]
mov qword [r14], rcx
mov rcx, qword [rbx + 8]
add rbx, 0x10
mov qword [rsi + 8], rax
add rsi, 0x10
mov qword [r14 + 8], rcx
sub rbp, 1
jne 0x18036f390
test rdi, rdi
je 0x18036f550
lea rcx, [rsp + 0x38]
mov rax, r14
sub rax, rcx
lea r15, [rsp + 0x39]
mov qword [rsp + 0x20], rax
lea rcx, [rsp + 0x38]
mov eax, 1
mov ebp, 3
sub rax, rcx
lea rcx, [rsp + 0x38]
mov qword [rsp + 0x28], rax
mov eax, 2
sub rax, rcx
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x38]
sub rbp, rax
inc rsi
neg r15
nop word [rax + rax]
mov r8, r12
lea rdx, [rsp + 0x38]
mov rcx, rbx
call r13
mov r10, qword [rsp + 0x20]
lea r9, [r15 + rsi]
xor eax, eax
nop dword [rax]
cmp rax, rdi
jae 0x18036f504
lea r8, [rsp + 0x38]
add r8, rax
lea rcx, [r8 + rbx]
movzx edx, byte [rcx + r15 + 1]
movzx ecx, byte [r8]
xor cl, byte [r10 + r8]
mov byte [r8 + r9], cl
mov rcx, qword [rsp + 0x28]
add rcx, r8
mov byte [r10 + r8], dl
cmp rcx, rdi
jae 0x18036f501
movzx ecx, byte [r8 + 1]
xor cl, byte [r14 + rax + 1]
movzx edx, byte [rax + rbx + 1]
mov byte [rsi + rax], cl
mov rcx, qword [rsp + 0x30]
add rcx, r8
mov byte [r14 + rax + 1], dl
cmp rcx, rdi
jae 0x18036f4fb
movzx ecx, byte [r8 + 2]
xor cl, byte [r14 + rax + 2]
movzx edx, byte [rbx + rax + 2]
mov byte [rsi + rax + 1], cl
lea rcx, [r8 + rbp]
mov byte [r14 + rax + 2], dl
cmp rcx, rdi
jae 0x18036f4f5
movzx edx, byte [rbx + rax + 3]
movzx ecx, byte [r8 + 3]
xor cl, byte [r14 + rax + 3]
mov byte [rsi + rax + 2], cl
mov byte [r14 + rax + 3], dl
add rax, 4
cmp rax, 0x10
jb 0x18036f450
jmp 0x18036f504
add rax, 3
jmp 0x18036f504
add rax, 2
jmp 0x18036f504
inc rax
cmp rdi, 0x10
jbe 0x18036f51e
add rbx, 0x10
add rsi, 0x10
sub rdi, 0x10
jne 0x18036f430
jmp 0x18036f550
cmp rax, 0x10
jae 0x18036f550
sub rbx, r14
lea rcx, [r14 + rax]
mov edx, recvfrom
sub rdx, rax
nop dword [rax]
nop word [rax + rax]
movzx eax, byte [rbx + rcx]
mov byte [rcx], al
lea rcx, [rcx + 1]
sub rdx, 1
jne 0x18036f540
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.1803026c0
mov rbx, qword [rsp + 0xa0]
add rsp, 0x50
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x18036f700
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x20], r9
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov eax, gethostbyname
call fcn.1802fb9b0
sub rsp, rax
mov r10, r9
mov rbx, r8
mov r9, qword [rsp + 0xa0]
mov r14, rdx
mov rbp, rcx
mov edi, dword [r9]
mov dword [rsp + 0x80], edi
test edi, edi
je 0x18036f778
mov rdx, qword [rsp + 0x98]
nop dword [rax]
test rbx, rbx
je 0x18036f771
mov eax, edi
dec rbx
movzx ecx, byte [rax + rdx]
xor cl, byte [rbp]
inc rbp
mov byte [r14], cl
inc r14
inc edi
and edi, 0xf
jne 0x18036f750
mov dword [rsp + 0x80], edi
mov r8, qword [rsp + 0x90]
mov esi, 1
movzx r12d, byte [r8 + 0xc]
lea r15, [r8 + 0xc]
mov r11, qword [rsp + 0xa8]
shl r12d, 8
movzx eax, byte [r8 + 0xd]
lea r13d, [rsi + 0xb]
or r12d, eax
movzx eax, byte [r8 + 0xe]
shl r12d, 8
or r12d, eax
movzx eax, byte [r8 + 0xf]
shl r12d, 8
or r12d, eax
cmp rbx, 0x10
jb 0x18036f8ae
mov eax, 0x10000000
mov edi, r13d
mov qword [rsp + 0x20], r8
mov rdx, rbx
shr rdx, 4
mov r9, r10
cmp rdx, rax
cmova rdx, rax
add r12d, edx
mov r13, rdx
mov eax, r12d
mov ecx, r12d
sub r13, rax
cmp rax, rdx
cmovae r13, rdx
xor r12d, r12d
cmp rax, rdx
mov r8, r13
mov rdx, r14
cmovae r12d, ecx
mov rcx, rbp
call r11
mov r8, qword [rsp + 0x90]
mov eax, r12d
shr eax, 0x18
mov byte [r15], al
mov eax, r12d
shr eax, 0x10
mov byte [r8 + 0xd], al
mov eax, r12d
shr eax, 8
mov byte [r8 + 0xe], al
mov byte [r8 + 0xf], r12b
test r12d, r12d
jne 0x18036f86d
mov r8d, edi
mov eax, esi
mov rdx, r15
nop dword [rax + rax]
movzx ecx, byte [rdx - 1]
lea rdx, [rdx - 1]
add eax, ecx
mov byte [rdx], al
shr eax, 8
add r8d, 0xffffffff
jne 0x18036f850
mov r8, qword [rsp + 0x90]
mov r10, qword [rsp + 0x88]
mov eax, 0x10000000
mov r11, qword [rsp + 0xa8]
shl r13, 4
sub rbx, r13
add r14, r13
add rbp, r13
cmp rbx, 0x10
jae 0x18036f7d0
mov edi, dword [rsp + 0x80]
mov r13d, reloc.WS2_32.dll_inet_ntoa
mov r9, qword [rsp + 0xa0]
test rbx, rbx
je 0x18036f951
mov rax, qword [rsp + 0x98]
xor ecx, ecx
mov qword [rsp + 0x20], r8
mov r9, r10
mov r8, rsi
mov rdx, rax
mov qword [rax], rcx
mov qword [rax + 8], rcx
mov rcx, rax
call r11
mov rcx, qword [rsp + 0x90]
inc r12d
mov eax, r12d
shr eax, 0x18
mov byte [r15], al
mov eax, r12d
shr eax, 0x10
mov byte [rcx + 0xd], al
mov eax, r12d
shr eax, 8
mov byte [rcx + 0xe], al
mov byte [rcx + 0xf], r12b
test r12d, r12d
jne 0x18036f927
nop dword [rax + rax]
movzx eax, byte [r15 - 1]
lea r15, [r15 - 1]
add esi, eax
mov byte [r15], sil
shr esi, 8
add r13d, 0xffffffff
jne 0x18036f910
mov rdx, qword [rsp + 0x98]
nop
mov ecx, edi
inc edi
movzx eax, byte [rcx + rbp]
xor al, byte [rcx + rdx]
mov byte [rcx + r14], al
sub rbx, 1
jne 0x18036f930
mov rax, qword [rsp + 0xa0]
mov dword [rax], edi
jmp 0x18036f954
mov dword [r9], edi
mov rbx, qword [rsp + 0x70]
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x180370780
Capabilities:
Encode data using xor

Disassembly:
push rbp
push rdi
push r14
mov eax, 0x20
call fcn.1802fb9b0
sub rsp, rax
cmp qword [rcx + 0x38], 0
mov rdi, r8
mov r14, rdx
mov rbp, rcx
je 0x1803707b0
mov eax, 0xfffffffe
add rsp, 0x20
pop r14
pop rdi
pop rbp
ret
mov rcx, qword [rcx + 0x30]
movabs rax, 0x2000000000000000
add rcx, r8
cmp rcx, rax
ja 0x1803708b2
cmp rcx, r8
jb 0x1803708b2
mov qword [rsp + 0x40], rbx
lea rbx, [rbp + 0x40]
mov qword [rsp + 0x48], rsi
mov esi, dword [rbp + 0x174]
mov qword [rsp + 0x50], r12
mov qword [rbp + 0x30], rcx
test esi, esi
je 0x180370839
test rdi, rdi
je 0x180370824
movzx eax, byte [r14]
lea rbx, [rbp + 0x40]
mov ecx, esi
inc r14
dec rdi
xor byte [rcx + rbx], al
inc esi
and esi, 0xf
jne 0x1803707f4
lea r12, [rbp + 0x60]
mov rcx, rbx
mov rdx, r12
call fcn.1803719c0
jmp 0x18037083d
test esi, esi
jne 0x180370892
lea r12, [rbp + 0x60]
mov rcx, rbx
mov rdx, r12
call fcn.1803719c0
jmp 0x18037083d
lea r12, [rbp + 0x60]
mov qword [rsp + 0x58], r15
mov r15, rdi
and r15, 0xfffffffffffffff0
je 0x180370862
mov r9, r15
mov r8, r14
mov rdx, r12
mov rcx, rbx
call fcn.180371b40
add r14, r15
sub rdi, r15
mov r15, qword [rsp + 0x58]
test rdi, rdi
je 0x180370892
mov esi, edi
sub r14, rbp
nop dword [rax]
nop word [rax + rax]
movzx eax, byte [r14 + rbx - 0x40]
xor byte [rbx], al
lea rbx, [rbx + 1]
sub rdi, 1
jne 0x180370880
mov rbx, qword [rsp + 0x40]
xor eax, eax
mov r12, qword [rsp + 0x50]
mov dword [rbp + 0x174], esi
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
pop rdi
pop rbp
ret
mov eax, 0xffffffff
add rsp, 0x20
pop r14
pop rdi
pop rbp
ret
Function at 0x1803719c0
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
mov qword [rsp + 0x20], r14
movzx eax, byte [rcx + 0xf]
lea r14, [0x1804a3540]
mov r8d, eax
mov rdi, rdx
and eax, 0xf
mov r11, rcx
add rax, rax
and r8, 0xfffffffffffffff0
mov esi, reloc.WS2_32.dll_ntohl
mov r9, qword [rdx + rax*8]
mov rax, qword [rdx + rax*8 + 8]
mov rcx, r9
mov rdx, rax
shr rcx, 4
and edx, 0xf
shr rax, 4
shl r9, 0x3c
or rax, r9
mov rbx, qword [r14 + rdx*8]
xor rbx, rcx
xor rbx, qword [r8 + rdi]
xor rax, qword [r8 + rdi + 8]
nop dword [rax + rax]
movzx ecx, byte [rsi + r11]
mov rdx, rax
shr rax, 4
mov r9d, ecx
and ecx, 0xf
and edx, 0xf
add rcx, rcx
and r9, 0xfffffffffffffff0
lea r8, [rdi + rcx*8]
mov rcx, rbx
shl rbx, 0x3c
mov r10, qword [r14 + rdx*8]
or rbx, rax
xor rbx, qword [r8 + 8]
shr rcx, 4
mov rdx, rbx
xor r10, rcx
shr rdx, 4
xor r10, qword [r8]
mov rcx, rbx
and ecx, 0xf
mov rax, r10
shr rax, 4
mov rbx, qword [r14 + rcx*8]
xor rbx, rax
mov rax, r10
xor rbx, qword [r9 + rdi]
shl rax, 0x3c
or rax, rdx
xor rax, qword [r9 + rdi + 8]
sub rsi, 1
jns 0x180371a30
mov rsi, qword [rsp + 0x10]
mov rdx, rbx
mov rdi, qword [rsp + 0x18]
mov r14, qword [rsp + 0x20]
shr rdx, 0x20
mov ecx, edx
mov byte [r11 + 3], dl
shr ecx, 0x18
mov byte [r11], cl
mov ecx, edx
shr ecx, 0x10
mov byte [r11 + 1], cl
mov ecx, edx
shr ecx, 8
mov rdx, rax
mov byte [r11 + 2], cl
mov ecx, ebx
shr ecx, 0x18
mov byte [r11 + 4], cl
mov ecx, ebx
shr ecx, 0x10
mov byte [r11 + 5], cl
mov ecx, ebx
shr ecx, 8
mov byte [r11 + 6], cl
shr rdx, 0x20
mov ecx, edx
mov byte [r11 + 7], bl
mov rbx, qword [rsp + 8]
shr ecx, 0x18
mov byte [r11 + 8], cl
mov ecx, edx
shr ecx, 0x10
mov byte [r11 + 9], cl
mov ecx, edx
shr ecx, 8
mov byte [r11 + 0xa], cl
mov ecx, eax
shr ecx, 0x18
mov byte [r11 + 0xc], cl
mov ecx, eax
shr ecx, 0x10
mov byte [r11 + 0xd], cl
mov ecx, eax
shr ecx, 8
mov byte [r11 + 0xe], cl
mov byte [r11 + 0xb], dl
mov byte [r11 + 0xf], al
ret
Function at 0x180371b40
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r12
push r13
push r14
push r15
movzx eax, byte [rcx + 0xf]
lea r14, [r8 + 0xe]
mov rsi, rcx
lea r13, [0x1804a3540]
sub rsi, r8
mov r12, r9
mov rbp, rdx
mov rbx, rcx
nop word [rax + rax]
movzx edx, byte [r14 + 1]
mov rdi, r14
movzx ecx, al
mov r15d, reloc.WS2_32.dll_ntohs
xor rdx, rcx
mov r8, rdx
and edx, 0xf
add rdx, rdx
and r8, 0xfffffffffffffff0
mov r9, qword [rbp + rdx*8]
mov rax, qword [rbp + rdx*8 + 8]
mov rcx, r9
mov rdx, rax
shr rcx, 4
and edx, 0xf
shr rax, 4
shl r9, 0x3c
or rax, r9
mov r11, qword [r13 + rdx*8]
xor r11, rcx
xor r11, qword [r8 + rbp]
xor rax, qword [r8 + rbp + 8]
nop dword [rax]
nop dword [rax + rax]
movzx ecx, byte [rdi]
movzx edx, byte [rsi + rdi]
lea rdi, [rdi - 1]
xor rdx, rcx
mov rcx, r11
mov r9, rdx
shl r11, 0x3c
and edx, 0xf
shr rcx, 4
add rdx, rdx
and r9, 0xfffffffffffffff0
lea r8, [rdx*8]
mov rdx, rax
shr rax, 4
and edx, 0xf
or r11, rax
xor r11, qword [r8 + rbp + 8]
mov r10, qword [r13 + rdx*8]
mov rdx, r11
xor r10, rcx
shr rdx, 4
xor r10, qword [r8 + rbp]
mov rcx, r11
and ecx, 0xf
mov rax, r10
shr rax, 4
mov r11, qword [r13 + rcx*8]
xor r11, rax
mov rax, r10
xor r11, qword [r9 + rbp]
shl rax, 0x3c
or rax, rdx
xor rax, qword [r9 + rbp + 8]
sub r15, 1
jne 0x180371be0
mov rdx, r11
mov byte [rbx + 7], r11b
shr rdx, 0x20
add r14, 0x10
mov ecx, edx
mov byte [rbx + 3], dl
shr ecx, 0x18
sub rsi, 0x10
mov byte [rbx], cl
mov ecx, edx
shr ecx, 0x10
mov byte [rbx + 1], cl
mov ecx, edx
shr ecx, 8
mov rdx, rax
mov byte [rbx + 2], cl
mov ecx, r11d
shr ecx, 0x18
mov byte [rbx + 4], cl
mov ecx, r11d
shr ecx, 0x10
mov byte [rbx + 5], cl
mov ecx, r11d
shr ecx, 8
mov byte [rbx + 6], cl
shr rdx, 0x20
mov ecx, edx
mov byte [rbx + 0xb], dl
shr ecx, 0x18
mov byte [rbx + 8], cl
mov ecx, edx
shr ecx, 0x10
mov byte [rbx + 9], cl
mov ecx, edx
shr ecx, 8
mov byte [rbx + 0xa], cl
mov ecx, eax
shr ecx, 0x18
mov byte [rbx + 0xc], cl
mov ecx, eax
shr ecx, 0x10
mov byte [rbx + 0xd], cl
mov ecx, eax
shr ecx, 8
mov byte [rbx + 0xe], cl
mov byte [rbx + 0xf], al
sub r12, 0x10
jne 0x180371b80
mov rbx, qword [rsp + 0x28]
mov rbp, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x40]
pop r15
pop r14
pop r13
pop r12
ret