joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180055158
Capabilities:
Hash data using fnv

Disassembly:
sub rcx, 8
jmp method.IMySteamNetworking.1.virtual_0

Function at 0x1800554f4
Capabilities:
Hash data using fnv

Disassembly:
sub rcx, 0x18
jmp method.IMySteamApps.2.virtual_56

Function at 0x180055638
Capabilities:
Get common file path

Disassembly:
sub rcx, 0x10
jmp method.IMySteamApps.3.virtual_144

Function at 0x1800556a4
Capabilities:
Hash data using fnv

Disassembly:
sub rcx, 0x10
jmp method.IMySteamNetworking.1.virtual_16

Function at 0x180055824
Capabilities:
Hash data using fnv

Disassembly:
sub rcx, 8
jmp method.IMySteamNetworking.1.virtual_8

Function at 0x180055a7c
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
sub rcx, 0x10
jmp method.IMySteamNetworking.1.virtual_0

Function at 0x180055d88
Capabilities:
Hash data using fnv

Disassembly:
sub rcx, 0x20
jmp method.IMySteamApps.2.virtual_56

Function at 0x180055eb4
Capabilities:
Get common file path

Disassembly:
sub rcx, 0x18
jmp method.IMySteamApps.3.virtual_144

Function at 0x18005604c
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
sub rcx, 0x10
jmp method.IMySteamNetworking.1.virtual_8

Function at 0x180056304
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
sub rcx, 8
jmp method.IMySteamInput.3.virtual_192

Function at 0x1800563c4
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
sub rcx, 8
jmp method.IMySteamInput.3.virtual_184

Function at 0x18005646c
Capabilities:
Hash data using fnv

Disassembly:
sub rcx, 8
jmp method.IMySteamApps.2.virtual_56

Function at 0x18005655c
Capabilities:
Hash data using fnv

Disassembly:
sub rcx, 0x28
jmp method.IMySteamApps.2.virtual_56

Function at 0x180056598
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub rcx, 8
jmp method.IMySteamInput.virtual_0

Function at 0x180056acc
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub rcx, 8
jmp method.IMySteamInput.virtual_32

Function at 0x180056c04
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
sub rcx, 0x10
jmp method.IMySteamApps.2.virtual_56

Function at 0x180056d30
Capabilities:
Get common file path

Disassembly:
sub rcx, 8
jmp method.IMySteamApps.3.virtual_144

Function at 0x180056d84
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
sub rcx, 8
jmp method.IMySteamNetworking.1.virtual_16
Function at 0x180059de4
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], r8
push rdi
sub rsp, 0x30
mov rbx, r9
mov rdi, rdx
mov rsi, rcx
mov ecx, 0x20
call fcn.180095318
mov r8, qword [rbx]
mov qword [rax], r8
mov r8, qword [0x1801b82e8]
mov qword [rax + 8], r8
movups xmm0, xmmword [rdi]
movdqu xmmword [rax + 0x10], xmm0
mov qword [rsp + 0x50], rax
lea rbx, [rsi + 8]
mov qword [rsp + 0x28], rbx
and dword [rsp + 0x20], 0
mov r9, rax
lea r8, [0x180059e90]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.msvcrt.dll__beginthreadex]
mov qword [rsi], rax
test rax, rax
je 0x180059e66
mov rax, rsi
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
and dword [rbx], 0
mov ecx, 6
call fcn.180093cd4
int3
Function at 0x18005ae60
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rcx
push rbp
push rbx
push rsi
push rdi
push r14
mov rbp, rsp
sub rsp, 0x40
mov r14, rdx
mov rdi, rcx
call fcn.18005d1b0
nop
lea rsi, [rdi + 0xc0]
mov rcx, rsi
call fcn.180080298
nop
lea rax, vtable.GlRender.0
mov qword [rdi], rax
lea rax, vtable.GlRender.1.0
mov qword [rsi], rax
lea rbx, [rdi + 0x168]
mov qword [rbp + 0x48], rbx
and dword [rbp + 0x40], 0
mov eax, dword [rbp + 0x40]
mov dword [rbx], eax
and qword [rbx + 8], 0
and qword [rbx + 0x10], 0
mov ecx, 0x60
call fcn.180095318
mov qword [rax], rax
mov qword [rax + 8], rax
mov qword [rbx + 8], rax
lea rcx, [rbx + 0x18]
and qword [rcx], 0
and qword [rcx + 8], 0
and qword [rcx + 0x10], 0
mov qword [rbx + 0x30], 7
mov qword [rbx + 0x38], 8
mov dword [rbx], 0x3f800000
mov r8, qword [rbx + 8]
mov edx, 0x10
call fcn.18000d9a0
nop
mov byte [rbp - 0x10], 0x81
mov byte [rbp - 0xf], WSACleanup
mov byte [rbp - 0xe], 0x76
mov byte [rbp - 0xd], 0x5d
mov byte [rbp - 0xc], 0x81
mov byte [rbp - 0xb], 0x6b
mov byte [rbp - 0xa], 0x7a
mov byte [rbp - 9], 0x4c
mov byte [rbp - 8], 0x7f
mov byte [rbp - 7], reloc.WS2_32.dll_WSASetLastError
mov byte [rbp - 6], reloc.WS2_32.dll_WSASetLastError
mov byte [rbp - 5], WSASetLastError
mov byte [rbp - 4], 0x7c
mov byte [rbp - 3], 0x7d
mov byte [rbp - 2], 0
mov al, byte [rbp - 0x10]
xor edx, edx
mov al, byte [rbp + rdx - 0x10]
sub al, 0xa
mov byte [rbp + rdx - 0x10], al
inc rdx
cmp rdx, 0xe
jb 0x18005af4d
lea rdx, [rbp - 0x10]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x18005af9a
mov byte [rsp + 0x20], 1
mov r9d, 1
lea r8, [0x18005ad24]
mov rdx, rax
mov rcx, rsi
call fcn.18007b7bc
mov qword [0x1801b82f8], rdi
mov byte [rdi + 8], 1
mov rax, rdi
add rsp, 0x40
pop r14
pop rdi
pop rsi
pop rbx
pop rbp
ret
Function at 0x18005c76c
Capabilities:
Contain obfuscated stackstrings
Log keystrokes via application hook

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rdi
push rbp
mov rbp, rsp
sub rsp, 0x50
mov rdx, qword [0x1801b7b00]
mov rdi, rcx
mov r8d, dword [rdx + 0x128]
sub r8d, 1
je 0x18005c91d
cmp r8d, 1
jne 0x18005c93b
mov byte [rbp - 0x20], 0x4f
xor ebx, ebx
mov byte [rbp - 0x1f], reloc.WS2_32.dll_WSACleanup
mov ecx, ebx
mov byte [rbp - 0x1e], 0x7e
mov byte [rbp - 0x1d], 0x7b
mov byte [rbp - 0x1c], 0x6c
mov byte [rbp - 0x1b], 0x7f
mov byte [rbp - 0x1a], WSASetLastError
mov byte [rbp - 0x19], reloc.WS2_32.dll_WSAStartup
mov byte [rbp - 0x18], 0x58
mov byte [rbp - 0x17], reloc.WS2_32.dll_WSASetLastError
mov byte [rbp - 0x16], 0x7e
mov byte [rbp - 0x15], 0x7e
mov byte [rbp - 0x14], 0x6c
mov byte [rbp - 0x13], WSACleanup
mov byte [rbp - 0x12], reloc.WS2_32.dll_WSASetLastError
mov byte [rbp - 0x11], 0x4c
mov byte [rbp - 0x10], bl
mov al, byte [rbp - 0x20]
mov al, byte [rbp + rcx - 0x20]
sub al, 0xb
mov byte [rbp + rcx - 0x20], al
inc rcx
cmp rcx, 0x10
jb 0x18005c7ed
mov byte [rbp + 0x18], 0x5f
mov rcx, rbx
mov byte [rbp + 0x19], 0x7d
mov byte [rbp + 0x1a], WSASetLastError
mov byte [rbp + 0x1b], 0x7c
mov byte [rbp + 0x1c], 0x3d
mov byte [rbp + 0x1d], 0x3c
mov byte [rbp + 0x1e], bl
mov al, byte [rbp + 0x18]
mov al, byte [rbp + rcx + 0x18]
sub al, 0xa
mov byte [rbp + rcx + 0x18], al
inc rcx
cmp rcx, 6
jb 0x18005c821
lea r8, [rbp - 0x20]
mov rcx, rdi
lea rdx, [rbp + 0x18]
call fcn.180080b0c
mov rdx, rax
mov byte [rsp + 0x20], 1
mov r9d, 1
lea r8, [0x18005c328]
mov rcx, rdi
call fcn.18007b7bc
mov byte [rbp - 0x20], 0x4e
mov rcx, rbx
mov byte [rbp - 0x1f], reloc.WS2_32.dll_WSAStartup
mov byte [rbp - 0x1e], 0x7d
mov byte [rbp - 0x1d], 0x7a
mov byte [rbp - 0x1c], 0x6b
mov byte [rbp - 0x1b], 0x7e
mov byte [rbp - 0x1a], WSASetLastError
mov byte [rbp - 0x19], WSACleanup
mov byte [rbp - 0x18], 0x57
mov byte [rbp - 0x17], WSASetLastError
mov byte [rbp - 0x16], 0x7d
mov byte [rbp - 0x15], 0x7d
mov byte [rbp - 0x14], 0x6b
mov byte [rbp - 0x13], WSACleanup
mov byte [rbp - 0x12], WSASetLastError
mov byte [rbp - 0x11], 0x61
mov byte [rbp - 0x10], bl
mov al, byte [rbp - 0x20]
mov al, byte [rbp + rcx - 0x20]
sub al, 0xa
mov byte [rbp + rcx - 0x20], al
inc rcx
cmp rcx, 0x10
jb 0x18005c8aa
mov byte [rbp + 0x18], 0x5c
mov byte [rbp + 0x19], 0x7a
mov byte [rbp + 0x1a], 0x6c
mov byte [rbp + 0x1b], 0x79
mov byte [rbp + 0x1c], 0x3a
mov byte [rbp + 0x1d], 0x39
mov byte [rbp + 0x1e], bl
mov al, byte [rbp + 0x18]
mov al, byte [rbp + rbx + 0x18]
sub al, 7
mov byte [rbp + rbx + 0x18], al
inc rbx
cmp rbx, 6
jb 0x18005c8db
lea r8, [rbp - 0x20]
mov rcx, rdi
lea rdx, [rbp + 0x18]
call fcn.180080b0c
mov rdx, rax
mov byte [rsp + 0x20], 1
mov r9d, 1
lea r8, [0x18005c328]
mov rcx, rdi
call fcn.18007b7bc
jmp 0x18005c93b
xor r9d, r9d
lea rdx, [0x18005bec0]
xor r8d, r8d
lea ecx, [r9 + 0xd]
call qword [sym.imp.USER32.dll_SetWindowsHookExA]
mov qword [0x1801b8860], rax
mov rbx, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x70]
add rsp, 0x50
pop rbp
ret
Function at 0x180061f30
Capabilities:
Enumerate gui resources

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
push r14
push r15
mov rbp, rsp
sub rsp, 0x80
cmp byte [rcx + 9], 0
mov r15, r8
mov rdi, rcx
jne 0x1800620eb
cmp qword [rcx + 0x178], 0
je 0x1800620eb
and qword [rbp + 0x30], 0
lea r8, [rbp + 0x30]
call fcn.180062ab0
and qword [rbp - 0x38], 0
xor eax, eax
mov dword [rbp - 0x44], eax
mov qword [rbp + 0x48], rax
mov dword [rbp - 0x28], eax
mov qword [rbp - 0x18], rax
mov rax, qword [rdi + 0x170]
mov qword [rbp - 0x60], rax
mov rax, qword [rdi + 0x180]
mov qword [rbp - 0x58], rax
mov rax, qword [rdi + 0x178]
mov qword [rbp - 0x50], rax
mov eax, dword [rdi + 0x190]
mov dword [rbp - 0x48], eax
mov rax, qword [rdi + 0x188]
mov qword [rbp - 0x30], rax
mov eax, 2
mov dword [rbp - 0x24], eax
mov dword [rbp - 0x20], eax
lea rax, [sym.steam_api64.dll_SteamAPI_ISteamApps_RequestPublisherOwnedAppData]
mov qword [rbp - 0x10], rax
mov rax, qword [rbp + 0x30]
and qword [rbp + 0x30], 0
mov qword [rbp - 0x40], rax
mov dword [rbp - 0x1c], 1
lea rdx, [rbp + 0x30]
lea rcx, [0x18005f004]
call qword [sym.imp.USER32.dll_EnumWindows]
mov rax, qword [rbp + 0x30]
test rax, rax
je 0x180061fe6
mov qword [rdi + 0x168], rax
call fcn.180021e20
mov rcx, qword [rdi + 0x168]
call fcn.18001f04c
mov rsi, qword [0x1801b7d10]
mov r14, qword [rdi + 0x1b0]
test rsi, rsi
je 0x180062031
inc dword [rsi + 0xf4]
mov ecx, 0xe8
call qword [sym.imp.msvcrt.dll_malloc]
mov qword [rbp + 0x30], rax
mov rbx, rax
test rax, rax
je 0x180062062
xor edx, edx
mov r8d, 0xe8
mov rcx, rax
call fcn.180097230
mov qword [rbx + 0x60], 0x100
jmp 0x180062064
xor ebx, ebx
or dword [rsi + 0xc], 8
lea rax, str.imgui_impl_vulkan
movaps xmm0, xmmword [rbp - 0x60]
movaps xmm1, xmmword [rbp - 0x50]
mov qword [rsi + 0x90], rax
mov rax, qword [rbp + 0x48]
mov qword [rsi + 0xa0], rbx
movups xmmword [rbx], xmm0
mov qword [rbx + 0x58], r14
movaps xmm0, xmmword [rbp - 0x40]
movups xmmword [rbx + 0x10], xmm1
mov dword [rbx + 0x88], eax
movaps xmm1, xmmword [rbp - 0x30]
movups xmmword [rbx + 0x20], xmm0
movaps xmm0, xmmword [rbp - 0x20]
movups xmmword [rbx + 0x30], xmm1
movsd xmm1, qword [rbp - 0x10]
movups xmmword [rbx + 0x40], xmm0
movsd qword [rbx + 0x50], xmm1
call fcn.18001e354
mov rcx, rdi
call fcn.18005d8d4
mov rax, qword [r15 + 0x30]
mov ecx, dword [rax]
lea rax, [rcx + rcx*2]
mov rcx, qword [rdi + 0x1b8]
add rax, rax
mov rcx, qword [rcx + rax*8 + 8]
call fcn.18001da64
mov byte [rdi + 9], 1
mov rbx, qword [rsp + 0xb8]
add rsp, 0x80
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
Function at 0x1800643e4
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r14
sub rsp, 0x20
mov rbp, qword [0x1801b7d18]
mov rbx, rcx
lea rcx, [rbp + 0x90]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov r9d, dword [rbx + 0xc]
movabs rdx, 0xcbf29ce484222325
mov dword [rsp + 0x40], r9d
xor r8d, r8d
movzx eax, byte [rsp + r8 + 0x40]
movabs rcx, 0x100000001b3
xor rdx, rax
inc r8
imul rdx, rcx
cmp r8, 4
jb 0x180064423
mov rax, qword [rbp + 0x38]
mov rcx, qword [rbp + 0x20]
and rax, rdx
add rax, rax
mov rdi, qword [rcx + rax*8 + 8]
cmp rdi, qword [rbp + 0x10]
je 0x180064473
mov rcx, qword [rcx + rax*8]
jmp 0x18006446b
cmp rdi, rcx
je 0x180064473
mov rdi, qword [rdi + 8]
cmp r9d, dword [rdi + 0x10]
jne 0x180064462
jmp 0x180064475
xor edi, edi
test rdi, rdi
je 0x1800644ff
cmp rdi, qword [rbp + 0x10]
je 0x1800644ff
mov rdx, qword [rdi + 0x20]
mov rsi, qword [rdi + 0x18]
jmp 0x180064497
cmp qword [rsi], rbx
je 0x18006449c
add rsi, 8
cmp rsi, rdx
jne 0x18006448e
cmp rsi, rdx
je 0x1800644de
lea rax, [rsi + 8]
jmp 0x1800644ba
mov rcx, qword [rax]
cmp rcx, rbx
je 0x1800644b6
mov qword [rsi], rcx
add rsi, 8
add rax, 8
cmp rax, rdx
jne 0x1800644a7
cmp rsi, rdx
je 0x1800644de
mov rbx, qword [rdi + 0x20]
mov rcx, rsi
sub rbx, rdx
mov r8, rbx
call sub.msvcrt.dll_memmove
lea rax, [rbx + rsi]
mov qword [rdi + 0x20], rax
mov rax, qword [rdi + 0x20]
sub rax, qword [rdi + 0x18]
test rax, 0xfffffffffffffff8
jne 0x1800644ff
lea rcx, [rbp + 8]
mov r8, rdi
lea rdx, [rsp + 0x40]
call fcn.1800436a4
lea rcx, [rbp + 0x90]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
add rsp, 0x20
pop r14
pop rdi
pop rsi
ret

Function at 0x18006ba84
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov rax, qword [rsp + 0x30]
mov byte [rax], 0
jmp fcn.180043248
Function at 0x18006d828
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x20
mov rbp, rdx
mov r14, rcx
xor edi, edi
xor ebx, ebx
xor esi, esi
call qword [sym.imp.msvcrt.dll_feof]
test eax, eax
jne 0x18006d8c9
cmp esi, edi
jne 0x18006d87d
lea r15d, [rdi + 0x3e8]
mov edx, edi
mov r8d, r15d
mov rcx, rbx
call fcn.18006bd2c
test rax, rax
je 0x18006d905
mov rbx, rax
mov edi, r15d
call qword [sym.imp.msvcrt.dll__errno]
movsxd rcx, esi
mov r9, r14
add rcx, rbx
mov edx, 1
and dword [rax], 0
mov eax, edi
sub eax, esi
movsxd r8, eax
call qword [sym.imp.msvcrt.dll_fread]
mov rcx, r14
mov r15, rax
call qword [sym.imp.msvcrt.dll_ferror]
test eax, eax
jne 0x18006d90e
mov rcx, r14
add esi, r15d
call qword [sym.imp.msvcrt.dll_feof]
test eax, eax
je 0x18006d856
cmp esi, edi
jne 0x18006d94c
lea r8d, [rdi + 1]
mov edx, edi
mov rcx, rbx
call fcn.18006bd2c
test rax, rax
jne 0x18006d949
lea r8, [0x1801b38d8]
mov edx, 0xc8
mov rcx, rbp
call fcn.1800444ec
test rbx, rbx
je 0x18006d901
mov rax, qword [fcn.180099908]
mov rcx, rbx
call rax
xor eax, eax
jmp 0x18006d975
lea r8, [0x1801b3900]
jmp 0x18006d8e3
call qword [sym.imp.msvcrt.dll__errno]
cmp dword [rax], 0
je 0x18006d929
call qword [sym.imp.msvcrt.dll__errno]
mov ecx, dword [rax]
call qword [sym.imp.msvcrt.dll_strerror]
jmp 0x18006d930
lea rax, str.Error_reading_file
mov r9, rax
lea r8, [0x1801b36e4]
mov edx, 0xc8
mov rcx, rbp
call fcn.1800444ec
jmp 0x18006d8f0
mov rbx, rax
movsxd rax, esi
mov rdx, rbp
mov rcx, rbx
mov byte [rax + rbx], 0
call fcn.18006d100
mov rdi, rax
test rbx, rbx
je 0x18006d972
mov rdx, qword [fcn.180099908]
mov rcx, rbx
call rdx
mov rax, rdi
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop rdi
ret
Function at 0x18006ebcc
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], r8
push rdi
sub rsp, 0x20
mov rdi, qword [0x1801b84d8]
mov rsi, rdx
mov rbx, qword [rdi + 8]
test rbx, rbx
jne 0x18006ec49
mov r9d, 0x4f4e4554
lea r8, [0x180116130]
mov edx, 0x2728e
mov ecx, dword [r8]
mov eax, ecx
xor eax, r9d
mov r9d, ecx
mov dword [r8], eax
lea r8, [r8 + 4]
sub rdx, 1
jne 0x18006ec05
mov edx, 0x4e078
mov ecx, 1
call qword [sym.imp.msvcrt.dll_calloc]
mov rbx, rax
test rax, rax
je 0x18006ec65
and dword [rax + 0x70], 0
mov rcx, rax
call fcn.1800739d0
test eax, eax
je 0x18006ec5c
mov qword [rdi + 8], rbx
mov rdx, rsi
mov rcx, rbx
call fcn.180075400
test eax, eax
je 0x18006ec6c
xor al, al
jmp 0x18006ecc4
mov rcx, rbx
call qword [sym.imp.msvcrt.dll_free]
and qword [rdi + 8], 0
jmp 0x18006ec58
mov rcx, qword [rdi + 8]
lea rdx, [rsp + 0x40]
call fcn.180075bdc
mov rdi, rax
test eax, eax
jle 0x18006ecc2
lea rdx, [0x1800ce2d8]
lea rcx, [0x1801b8d20]
call qword [sym.imp.msvcrt.dll_fopen]
mov rcx, qword [rsp + 0x40]
mov r8d, 1
mov r9, rax
movsxd rdx, edi
mov rbx, rax
call fcn.1800a2b70
mov rcx, rbx
call qword [sym.imp.msvcrt.dll_fclose]
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.msvcrt.dll_free]
mov al, 1
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret

Function at 0x18006ecd4
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
lea rbx, [0x1800cedc0]
mov r9d, ecx
not r9d
cmp r8, 4
jb 0x18006ed26
mov r10, r8
shr r10, 2
imul rax, r10, 0xfffffffffffffffc
add r8, rax
xor r11d, r11d
movzx ecx, byte [rdx + r11]
mov eax, r9d
xor rcx, rax
shr r9d, 8
movzx eax, cl
inc r11
xor r9d, dword [rbx + rax*4]
cmp r11, 4
jl 0x18006ecfd
add rdx, 4
sub r10, 1
jne 0x18006ecfa
test r8, r8
je 0x18006ed48
movzx ecx, byte [rdx]
mov eax, r9d
xor rcx, rax
shr r9d, 8
movzx eax, cl
inc rdx
xor r9d, dword [rbx + rax*4]
sub r8, 1
jne 0x18006ed2b
mov rbx, qword [rsp + 8]
not r9d
mov eax, r9d
ret
Function at 0x180077f14
Capabilities:
Allocate or change rwx memory

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
and qword [rcx + 8], 0
lea rax, vtable.MemoryAllocator.0
mov rbx, r8
mov qword [rcx], rax
and rbx, 0xfffffffffffff000
mov rsi, rdx
test r8, r8
mov rdi, rcx
cmove rbx, r8
add rbx, 0x1000
mov r9d, 0x40
mov rcx, rbx
mov r8d, 0x3000
mov rdx, rsi
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov qword [rdi + 8], rax
test rax, rax
je 0x180077f49
mov rbx, qword [rsp + 0x30]
mov rax, rdi
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
Function at 0x18007953c
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
mov rbp, rsp
sub rsp, 0x30
mov rax, rdx
mov ecx, 0xfffffffd
sub rax, r8
mov rdi, r8
add rax, 0x7ffffffa
mov rsi, rdx
cmp rax, rcx
ja 0x1800795cf
mov byte [rbp - 0x10], WSASetLastError
xor ecx, ecx
mov byte [rbp - 0xf], reloc.WS2_32.dll_WSASetLastError
mov byte [rbp - 0xe], reloc.WS2_32.dll_WSAStartup
mov byte [rbp - 0xd], 0x23
mov byte [rbp - 0xc], 0x33
mov byte [rbp - 0xb], 0x7b
mov byte [rbp - 0xa], 0x28
mov byte [rbp - 9], 0x33
mov byte [rbp - 8], 0x34
mov byte [rbp - 7], 0x39
mov byte [rbp - 6], WSASetLastError
mov byte [rbp - 5], WSASetLastError
mov byte [rbp - 4], 0x7b
mov byte [rbp - 3], cl
mov al, byte [rbp - 0x10]
mov al, byte [rbp + rcx - 0x10]
sub al, 3
mov byte [rbp + rcx - 0x10], al
inc rcx
cmp rcx, 0xd
jb 0x1800795ab
mov r8, rsi
lea rdx, [rbp - 0x10]
mov rcx, rdi
call fcn.180080668
jmp 0x180079637
mov byte [rbp - 0x10], reloc.WS2_32.dll_WSACleanup
xor ecx, ecx
mov byte [rbp - 0xf], 0x77
mov byte [rbp - 0xe], 0x7a
mov byte [rbp - 0xd], 0x2a
mov byte [rbp - 0xc], 0x65
mov byte [rbp - 0xb], 0x7c
mov byte [rbp - 0xa], reloc.WS2_32.dll_WSAStartup
mov byte [rbp - 9], 0x7a
mov byte [rbp - 8], 0x67
mov byte [rbp - 7], cl
mov al, byte [rbp - 0x10]
mov al, byte [rbp + rcx - 0x10]
sub al, 0xa
mov byte [rbp + rcx - 0x10], al
inc rcx
cmp rcx, 9
jb 0x1800795fb
lea rdx, [rbp - 0x10]
mov rcx, rdi
call fcn.180080668
mov r8d, 8
mov qword [rbp + 0x18], rsi
lea rdx, [rbp + 0x18]
mov rbx, rax
lea rcx, [rax + rdi]
call fcn.180080edc
add rax, rbx
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x30
pop rbp
ret
Function at 0x18007b7bc
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x50
mov r13, r8
mov rsi, rdx
mov r8, rdx
mov r15, rcx
mov edx, 0x200
add rcx, 8
call fcn.18007964c
mov r9, rax
mov edx, 5
sub r9, rsi
mov r12, rax
add r9, 0x7ffffffa
mov eax, 0xfffffffd
cmp r9, rax
lea ecx, [rdx + 9]
cmova edx, ecx
mov rcx, rsi
call fcn.180080ab8
mov r9, rax
mov r8, rsi
mov rdx, r12
mov rcx, r15
mov r14, rax
call fcn.1800811d4
add r12, rax
mov rcx, r12
call fcn.18007a7dc
mov byte [rbp - 0x30], 0x75
xor edi, edi
mov byte [rbp - 0x2f], 0x77
mov ecx, edi
mov byte [rbp - 0x2e], 0x7e
mov byte [rbp - 0x2d], 0x28
lea rbx, [r12 + rax]
mov byte [rbp - 0x2c], 0x7a
mov byte [rbp - 0x2b], 0x6b
mov byte [rbp - 0x2a], 0x80
mov byte [rbp - 0x29], 0x34
mov byte [rbp - 0x28], 0x28
mov byte [rbp - 0x27], 0x7a
mov byte [rbp - 0x26], 0x7b
mov byte [rbp - 0x25], 0x78
mov byte [rbp - 0x24], dil
mov al, byte [rbp - 0x30]
mov al, byte [rbp + rcx - 0x30]
sub al, 8
mov byte [rbp + rcx - 0x30], al
inc rcx
cmp rcx, 0xc
jb 0x18007b87e
lea rdx, [rbp - 0x30]
mov rcx, rbx
call fcn.180080668
add rbx, rax
mov rdx, r13
mov r8, rbx
mov rcx, r15
call fcn.1800789b4
mov byte [rbp - 0x23], 0x7b
add rbx, rax
mov byte [rbp - 0x22], 0x6c
mov rcx, rdi
mov byte [rbp - 0x21], 0x7a
mov byte [rbp - 0x20], 0x7b
mov byte [rbp - 0x1f], 0x27
mov byte [rbp - 0x1e], 0x79
mov byte [rbp - 0x1d], 0x68
mov byte [rbp - 0x1c], 0x7f
mov byte [rbp - 0x1b], 0x33
mov byte [rbp - 0x1a], 0x27
mov byte [rbp - 0x19], 0x79
mov byte [rbp - 0x18], 0x68
mov byte [rbp - 0x17], 0x7f
mov byte [rbp - 0x16], 0x42
mov byte [rbp - 0x15], WSACleanup
mov byte [rbp - 0x14], 0x6c
mov byte [rbp - 0x13], 0x27
mov byte [rbp - 0x12], 0x37
mov byte [rbp - 0x11], 0x7f
mov byte [rbp - 0x10], 0x2c
mov byte [rbp - 0xf], 0x37
mov byte [rbp - 0xe], 0x38
mov byte [rbp - 0xd], 0x3d
mov byte [rbp - 0xc], reloc.WS2_32.dll_WSAStartup
mov byte [rbp - 0xb], reloc.WS2_32.dll_WSAStartup
mov byte [rbp - 0xa], 0x7f
mov byte [rbp - 9], dil
mov al, byte [rbp - 0x23]
mov al, byte [rbp + rcx - 0x23]
sub al, 7
mov byte [rbp + rcx - 0x23], al
inc rcx
cmp rcx, 0x1a
jb 0x18007b923
lea r8, [rbx + 0x55]
mov rcx, rbx
lea rdx, [rbp - 0x23]
call fcn.180080668
add rbx, rax
mov rcx, rbx
call fcn.1800796d0
mov byte [rbp + 0x30], 0x7f
add rbx, rax
mov byte [rbp + 0x31], WSACleanup
mov byte [rbp + 0x32], 0x81
mov byte [rbp + 0x33], dil
mov al, byte [rbp + 0x30]
mov al, byte [rbp + rdi + 0x30]
sub al, 0xd
mov byte [rbp + rdi + 0x30], al
inc rdi
cmp rdi, 3
jb 0x18007b967
lea rdx, [rbp + 0x30]
mov rcx, rbx
call fcn.180080668
add rbx, rax
mov rcx, rbx
call fcn.1800796d0
add rbx, rax
mov r9, r14
mov rdx, rbx
mov r8, rsi
mov rcx, r15
call fcn.180078ff4
lea rdx, [r14 + rsi]
mov rcx, r15
lea r8, [rax + rbx]
call fcn.18007953c
mov r8, rsi
mov rdx, r12
mov rcx, r15
call fcn.18007953c
sub r14, rax
mov rdx, r14
lea rcx, [rax + rsi]
call fcn.180080f68
lea r11, [rsp + 0x50]
mov al, 1
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
Function at 0x18007be20
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r12
push rbp
push r14
push r15
mov rbp, rsp
sub rsp, 0x30
lea rax, [rdx - 1]
mov r15, r8
mov rbx, rdx
mov rsi, rcx
cmp rax, 0xfffffffffffffffd
ja 0x18007bf70
mov rax, r8
mov ecx, 0xfffffffd
sub rax, rdx
mov edx, 5
add rax, 0x7ffffffa
cmp rax, rcx
mov rcx, rbx
lea r8d, [rdx + 9]
cmova edx, r8d
call fcn.180080ab8
lea rcx, [rsi + 8]
mov r8, rbx
mov r12, rax
lea rdx, [rax + 0x100]
call fcn.18007964c
mov r9, r12
mov r8, rbx
mov rdx, rax
mov rcx, rsi
mov r14, rax
call fcn.1800811d4
add r14, rax
mov rcx, r14
call fcn.18007a7dc
mov byte [rbp - 0x10], WSACleanup
xor ecx, ecx
mov byte [rbp - 0xf], reloc.WS2_32.dll_WSAStartup
mov byte [rbp - 0xe], 0x7a
mov byte [rbp - 0xd], 0x24
lea rdi, [r14 + rax]
mov byte [rbp - 0xc], 0x76
mov byte [rbp - 0xb], 0x67
mov byte [rbp - 0xa], 0x7c
mov byte [rbp - 9], 0x30
mov byte [rbp - 8], 0x24
mov byte [rbp - 7], 0x76
mov byte [rbp - 6], 0x77
mov byte [rbp - 5], reloc.WS2_32.dll_WSACleanup
mov byte [rbp - 4], cl
mov al, byte [rbp - 0x10]
mov al, byte [rbp + rcx - 0x10]
sub al, 4
mov byte [rbp + rcx - 0x10], al
inc rcx
cmp rcx, 0xc
jb 0x18007bef0
lea rdx, [rbp - 0x10]
mov rcx, rdi
call fcn.180080668
add rdi, rax
mov rdx, r15
mov r8, rdi
mov rcx, rsi
call fcn.1800789b4
add rdi, rax
mov rcx, rdi
call fcn.1800796d0
add rdi, rax
mov r9, r12
mov rdx, rdi
mov r8, rbx
mov rcx, rsi
call fcn.180078ff4
lea rdx, [r12 + rbx]
mov rcx, rsi
lea r8, [rax + rdi]
call fcn.18007953c
mov r8, rbx
mov rdx, r14
mov rcx, rsi
call fcn.18007953c
sub r12, rax
mov rdx, r12
lea rcx, [rax + rbx]
call fcn.180080f68
mov al, 1
jmp 0x18007bf72
xor al, al
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
mov rdi, qword [rsp + 0x60]
mov r12, qword [rsp + 0x68]
add rsp, 0x30
pop r15
pop r14
pop rbp
ret