joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1800739c0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x20
xor r10d, r10d
mov rdi, r9
lea r9, section..data
mov rbp, r8
mov r15, rdx
mov r12, rcx
mov r11, rdx
test r8, r8
je 0x180073a34
lea rdx, [r8 - 1]
test rdx, rdx
je 0x180073a2c
nop word [rax + rax]
movzx eax, byte [r11]
movzx ecx, dl
and cl, 0x1f
inc r11
mov eax, dword [r9 + rax*4]
rol eax, cl
xor r10d, eax
sub rdx, 1
jne 0x180073a10
movzx eax, byte [r11]
xor r10d, dword [r9 + rax*4]
test rdi, rdi
je 0x180073a84
mov rax, 0xffffffffffffffff
inc rax
cmp byte [rdi + rax], 0
jne 0x180073a40
mov r8, rdi
test rax, rax
je 0x180073a84
lea rdx, [rax - 1]
test rdx, rdx
je 0x180073a7c
nop word [rax + rax]
movzx eax, byte [r8]
movzx ecx, dl
and cl, 0x1f
inc r8
mov eax, dword [r9 + rax*4]
rol eax, cl
xor r10d, eax
sub rdx, 1
jne 0x180073a60
movzx ecx, byte [r8]
xor r10d, dword [r9 + rcx*4]
xor edx, edx
mov eax, r10d
div dword [r12]
xor esi, esi
mov r14d, edx
mov rbx, qword [r12 + rdx*8 + 8]
test rbx, rbx
je 0x180073b15
nop dword [rax]
cmp qword [rbx + 8], rbp
jne 0x180073abe
mov rcx, qword [rbx]
mov r8, rbp
mov rdx, r15
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
jne 0x180073abe
lea r9d, [rax + 1]
jmp 0x180073ac1
xor r9d, r9d
mov rax, qword [rbx + 0x10]
cmp rax, rdi
je 0x180073afb
test rax, rax
je 0x180073af7
test rdi, rdi
je 0x180073af7
mov r8, rdi
sub r8, rax
nop word [rax + rax]
movzx edx, byte [rax]
movzx ecx, byte [rax + r8]
sub edx, ecx
jne 0x180073af3
inc rax
test ecx, ecx
jne 0x180073ae0
test edx, edx
je 0x180073afb
xor eax, eax
jmp 0x180073b00
mov eax, 1
test r9d, r9d
je 0x180073b09
test eax, eax
jne 0x180073b36
mov rsi, rbx
mov rbx, qword [rbx + 0x20]
test rbx, rbx
jne 0x180073aa0
xor eax, eax
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x20
pop r15
pop r14
pop r12
ret
cmp dword [rsp + 0x60], 0
mov rdi, qword [rbx + 0x18]
je 0x180073b73
mov rcx, qword [rbx + 0x20]
test rsi, rsi
jne 0x180073b51
mov qword [r12 + r14*8 + 8], rcx
jmp 0x180073b55
mov qword [rsi + 0x20], rcx
mov rcx, qword [rbx + 0x10]
test rcx, rcx
je 0x180073b63
call fcn.180078c60
mov rcx, qword [rbx]
call fcn.180078c60
mov rcx, rbx
call fcn.180078c60
mov rax, rdi
jmp 0x180073b17

Function at 0x180073b80
Capabilities:
Encode data using xor

Disassembly:
mov r10, rdx
mov r9d, ecx
test r8, r8
je 0x180073bc4
lea rdx, [r8 - 1]
lea r8, section..data
test rdx, rdx
je 0x180073bbc
nop dword [rax + rax]
movzx eax, byte [r10]
movzx ecx, dl
and cl, 0x1f
inc r10
mov eax, dword [r8 + rax*4]
rol eax, cl
xor r9d, eax
sub rdx, 1
jne 0x180073ba0
movzx eax, byte [r10]
xor r9d, dword [r8 + rax*4]
mov eax, r9d
ret

Function at 0x180073d90
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [rsp + 0x28]
mov r10, rcx
cmp eax, 0xfffffffe
jb 0x180073da2
mov eax, 0x1d
ret
lea ecx, [rax + 1]
mov qword [rsp + 0x28], rcx
mov rcx, r10
jmp fcn.180073c00
Function at 0x18007a8e0
Capabilities:
Allocate thread local storage

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
call qword [sym.imp.KERNEL32.dll_TlsAlloc]
xor ecx, ecx
mov edx, 0x1f
cmp eax, 0xffffffff
mov dword [rbx], eax
cmove ecx, edx
mov eax, ecx
add rsp, 0x20
pop rbx
ret

Function at 0x18009c121
Capabilities:
Encrypt data using rc4 ksa
Manually build aes constants

Disassembly:
push rbp
mov ebp, esp
sub esp, 0x208
movabs eax, dword [0x4589c5330042b520]
cld
push rbx
push rsi
xor ecx, ecx
mov al, 1
push rdi
lea ebx, [rbx]
movzx edx, al
mov byte [rbp + rdx - 0x104], cl
mov dl, al
and dl, 0x80
mov byte [rbp + rcx - 0x204], al
neg r10b
sbb dl, dl
mov bl, al
and dl, 0x1b
add bl, bl
xor dl, bl
xor al, dl
cmp ecx, 0x100
jl 0x18009c141
mov al, 1
mov ecx, 0x46f380
movzx edx, al
shl edx, 0x18
mov dword [rcx], edx
mov dl, al
and dl, 0x80
add ecx, 4
neg dl
sbb dl, dl
and dl, 0x1b
add al, al
xor al, dl
cmp ecx, 0x46f3a8
jl 0x18009c176
mov dword [0x18050a923], 0x63
mov dword [0x18050daf9], 0
mov edx, 1
jmp 0x18009c1c1
movzx eax, byte [rbp + rdx - 0x104]
lea ecx, [rbp - 0x105]
sub ecx, eax
mov cl, byte [rcx]
mov al, cl
rol al, 1
xor cl, al
rol al, 1
xor cl, al
rol al, 1
xor cl, al
rol al, 1
xor al, cl
xor al, 0x63
movzx eax, al
mov dword [rdx*4 + 0x46e780], eax
mov dword [rax*4 + 0x4717c0], edx
cmp edx, 0x100
jl 0x18009c1c1
xor ecx, ecx
mov dl, byte [rcx + 0x46e780]
mov al, dl
and al, 0x80
neg al
sbb al, al
and al, 0x1b
mov bl, dl
add bl, bl
xor al, bl
movzx esi, al
movzx edx, dl
mov eax, esi
shl eax, 8
xor eax, edx
shl eax, 8
xor eax, edx
shl eax, 8
xor eax, esi
xor eax, edx
mov dword [rcx + 0x4713c0], eax
ror eax, 8
mov dword [rcx + 0x470fc0], eax
ror eax, 8
mov dword [rcx + 0x470bc0], eax
ror eax, 8
mov dword [rcx + 0x4707c0], eax
mov al, byte [rcx + 0x4717c0]
test al, al
je 0x18009c2d0
movzx edx, al
movzx esi, byte [rbp + rdx - 0x104]
movzx eax, byte [rbp - 0xf9]
add eax, esi
cdq
mov edi, 0xff
idiv edi
movzx eax, byte [rbp + rdx - 0x204]
mov dword [rbp - 0x208], eax
movzx eax, byte [rbp - 0xf7]
add eax, esi
cdq
idiv edi
movzx eax, byte [rbp - 0xfb]
add eax, esi
movzx ebx, byte [rbp + rdx - 0x204]
cdq
idiv edi
movzx eax, byte [rbp - 0xf6]
add eax, esi
mov esi, 0xff
movzx edi, byte [rbp + rdx - 0x204]
cdq
idiv esi
movzx eax, byte [rbp + rdx - 0x204]
mov edx, dword [rbp - 0x208]
jmp 0x18009c2d8
xor edx, edx
xor ebx, ebx
xor edi, edi
xor eax, eax
shl eax, 8
xor eax, edi
shl eax, 8
xor eax, ebx
shl eax, 8
xor eax, edx
mov dword [rcx + 0x4703c0], eax
ror eax, 8
mov dword [rcx + 0x46ffc0], eax
ror eax, 8
mov dword [rcx + 0x46ef80], eax
ror eax, 8
mov dword [rcx + 0x46eb80], eax
add ecx, 4
cmp ecx, 0x400
jl 0x18009c203
mov ecx, dword [rbp - 4]
pop rdi
pop rsi
xor ecx, ebp
pop rbx
call fcn.1800ac42c
mov esp, ebp
pop rbp
ret
Function at 0x18009c140
Capabilities:
Encode data using xor
Encrypt data using rc4 ksa
Manually build aes constants

Disassembly:
push rbp
mov ebp, esp
sub esp, 0x208
movabs eax, dword [0x4589c5330042b520]
cld
push rbx
push rsi
xor ecx, ecx
mov al, 1
push rdi
lea ebx, [rbx]
movzx edx, al
mov byte [rbp + rdx - 0x104], cl
mov dl, al
and dl, 0x80
mov byte [rbp + rcx - 0x204], al
neg r10b
sbb dl, dl
mov bl, al
and dl, 0x1b
add bl, bl
xor dl, bl
xor al, dl
cmp ecx, 0x100
jl 0x18009c141
mov al, 1
mov ecx, 0x46f380
movzx edx, al
shl edx, 0x18
mov dword [rcx], edx
mov dl, al
and dl, 0x80
add ecx, 4
neg dl
sbb dl, dl
and dl, 0x1b
add al, al
xor al, dl
cmp ecx, 0x46f3a8
jl 0x18009c176
mov dword [0x18050a923], 0x63
mov dword [0x18050daf9], 0
mov edx, 1
jmp 0x18009c1c1
movzx eax, byte [rbp + rdx - 0x104]
lea ecx, [rbp - 0x105]
sub ecx, eax
mov cl, byte [rcx]
mov al, cl
rol al, 1
xor cl, al
rol al, 1
xor cl, al
rol al, 1
xor cl, al
rol al, 1
xor al, cl
xor al, 0x63
movzx eax, al
mov dword [rdx*4 + 0x46e780], eax
mov dword [rax*4 + 0x4717c0], edx
cmp edx, 0x100
jl 0x18009c1c1
xor ecx, ecx
mov dl, byte [rcx + 0x46e780]
mov al, dl
and al, 0x80
neg al
sbb al, al
and al, 0x1b
mov bl, dl
add bl, bl
xor al, bl
movzx esi, al
movzx edx, dl
mov eax, esi
shl eax, 8
xor eax, edx
shl eax, 8
xor eax, edx
shl eax, 8
xor eax, esi
xor eax, edx
mov dword [rcx + 0x4713c0], eax
ror eax, 8
mov dword [rcx + 0x470fc0], eax
ror eax, 8
mov dword [rcx + 0x470bc0], eax
ror eax, 8
mov dword [rcx + 0x4707c0], eax
mov al, byte [rcx + 0x4717c0]
test al, al
je 0x18009c2d0
movzx edx, al
movzx esi, byte [rbp + rdx - 0x104]
movzx eax, byte [rbp - 0xf9]
add eax, esi
cdq
mov edi, 0xff
idiv edi
movzx eax, byte [rbp + rdx - 0x204]
mov dword [rbp - 0x208], eax
movzx eax, byte [rbp - 0xf7]
add eax, esi
cdq
idiv edi
movzx eax, byte [rbp - 0xfb]
add eax, esi
movzx ebx, byte [rbp + rdx - 0x204]
cdq
idiv edi
movzx eax, byte [rbp - 0xf6]
add eax, esi
mov esi, 0xff
movzx edi, byte [rbp + rdx - 0x204]
cdq
idiv esi
movzx eax, byte [rbp + rdx - 0x204]
mov edx, dword [rbp - 0x208]
jmp 0x18009c2d8
xor edx, edx
xor ebx, ebx
xor edi, edi
xor eax, eax
shl eax, 8
xor eax, edi
shl eax, 8
xor eax, ebx
shl eax, 8
xor eax, edx
mov dword [rcx + 0x4703c0], eax
ror eax, 8
mov dword [rcx + 0x46ffc0], eax
ror eax, 8
mov dword [rcx + 0x46ef80], eax
ror eax, 8
mov dword [rcx + 0x46eb80], eax
add ecx, 4
cmp ecx, 0x400
jl 0x18009c203
mov ecx, dword [rbp - 4]
pop rdi
pop rsi
xor ecx, ebp
pop rbx
call fcn.1800ac42c
mov esp, ebp
pop rbp
ret
Function at 0x18009e4d1
Capabilities:
Hash data using sha256

Disassembly:
mov dword [rax], 0
mov dword [rax + 4], 0
mov dword [rax + 8], 0x6a09e667
mov dword [rax + 0xc], 0xbb67ae85
mov dword [rax + 0x10], 0x3c6ef372
mov dword [rax + 0x14], 0xa54ff53a
mov dword [rax + 0x18], 0x510e527f
mov dword [rax + 0x1c], 0x9b05688c
mov dword [rax + 0x20], 0x1f83d9ab
mov dword [rax + 0x24], 0x5be0cd19
ret
Function at 0x1800b5b80
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov edi, edi
push rbp
mov ebp, esp
sub esp, 0x20
movabs eax, dword [0x4589c5330042b520]
cld
push rbx
mov ebx, dword [rbp + 0xc]
push rsi
mov esi, dword [rbp + 8]
push rdi
call fcn.1800b5a0c
mov edi, eax
xor esi, esi
mov dword [rbp + 8], edi
cmp edi, esi
jne 0x1800b5ac1
mov eax, ebx
call fcn.1800b5774
mov dword [rbp - 0x1c], esi
xor eax, eax
cmp dword [rax + 0x42bad0], edi
je 0x1800b5b63
inc dword [rbp - 0x1c]
add eax, 0x30
cmp eax, 0xf0
jb 0x1800b5ac6
cmp edi, 0xfde8
je 0x1800b5c5f
cmp edi, 0xfde9
je 0x1800b5c5f
movzx eax, di
push rax
call qword [0x1804d9c69]
test eax, eax
je 0x1800b5c5f
lea eax, [rbp - 0x18]
push rax
push rdi
call qword [0x1804d9c14]
test eax, eax
je 0x1800b5c53
push 0x101
lea eax, [rbx + 0x1c]
push rsi
push rax
call fcn.1800ae441
xor edx, edx
add esp, 0xc
mov dword [rbx + 4], edi
mov dword [rbx + 0xc], esi
cmp dword [rbp - 0x18], edx
jbe 0x1800b5c3c
cmp byte [rbp - 0x12], 0
je 0x1800b5c1d
lea esi, [rbp - 0x11]
push 0x101
lea eax, [rbx + 0x1c]
push rsi
push rax
call fcn.1800ae441
mov ecx, dword [rbp - 0x1c]
add esp, 0xc
imul ecx, ecx, 0x30
mov dword [rbp - 0x20], esi
lea esi, [rcx + 0x42bae0]
loopne 0x1800b5b3c
add byte [rcx + 0x2bebe475], cl
mov al, byte [rsi + 1]
test al, al
je 0x1800b5bb9
movzx edi, byte [rsi]
movzx eax, al
jmp 0x1800b5baa
mov eax, dword [rbp - 0x20]
mov al, byte [rax + 0x42bacc]
or byte [rbx + rdi + 0x1d], al
movzx eax, byte [rsi + 1]
cmp r15d, r8d
cmp edi, eax
jbe 0x1800b5b98
mov edi, dword [rbp + 8]
add esi, 2
cmp byte [rsi], 0
jne 0x1800b5b89
mov esi, dword [rbp - 0x1c]
inc dword [rbp - 0x20]
add esi, 8
cmp dword [rbp - 0x20], 4
mov dword [rbp - 0x1c], esi
jb 0x1800b5bb4
mov eax, edi
mov dword [rbx + 4], edi
mov dword [rbx + 8], esi
cmp dword [0x180523019], esi
jne 0x1800b5ab3
or eax, 0xffffffff

Function at 0x1800bbc10
Capabilities:
Encrypt data using speck

Disassembly:
mov edi, edi
push rbp
mov ebp, esp
sub esp, 0x34
push rbx
xor ebx, ebx
test byte [rbp + 0x10], 0x80
push rsi
mov esi, eax
mov dword [rbp - 0x24], ebx
mov byte [rbp - 2], bl
mov dword [rbp - 8], ebx
mov dword [rbp - 0x34], recv
mov dword [rbp - 0x30], ebx
je 0x1800bbc01
mov dword [rbp - 0x2c], ebx
mov byte [rbp - 1], reloc.WS2_32.dll_recv
jmp 0x1800bbc0b
mov dword [rbp - 0x2c], 1
mov byte [rbp - 1], bl
lea eax, [rbp - 0x24]
push rax
call fcn.1800bd764
push rax
sbb eax, dword [rax]
add byte [rcx - 0x7b], bl
ror byte [rdi], 0x85
fiadd word [rsi]
add byte [rax], al
mov eax, 0x8000
test dword [rbp + 0x10], eax
jne 0x1800bbc39
test dword [rbp + 0x10], 0x74000
jne 0x1800bbc35
push rbx
push rbx
push rbx
push rbx
push rbx
call fcn.1800b29f5
int3
Function at 0x1800c5230
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
add r8d, 0xdeadbeef
mov rdi, rdx
add r8d, edx
mov r11, rcx
mov r10d, r8d
mov ebx, r8d
cmp rdx, 0xc
jbe 0x1800c5363
mov qword [rsp + 0x10], rsi
lea r9, [rdx - 0xd]
movabs rax, 0xaaaaaaaaaaaaaaab
mul r9
mov rsi, rdx
shr rsi, 3
inc rsi
imul rax, rsi, 0xfffffffffffffff4
add rdi, rax
nop dword [rax]
movzx eax, byte [r11 + 6]
movzx ecx, byte [r11 + 7]
movzx r9d, byte [r11 + 4]
movzx edx, byte [r11 + 8]
add r9d, r10d
shl ecx, 8
add edx, r8d
add ecx, eax
movzx eax, byte [r11 + 5]
shl ecx, 8
add ecx, eax
movzx eax, byte [r11 + 0xa]
shl ecx, 8
add r9d, ecx
movzx ecx, byte [r11 + 0xb]
shl ecx, 8
add ecx, eax
movzx eax, byte [r11 + 9]
shl ecx, 8
add ecx, eax
movzx eax, byte [r11 + 2]
shl ecx, 8
add edx, ecx
movzx ecx, byte [r11 + 3]
shl ecx, 8
mov r8d, edx
add ecx, eax
rol r8d, 4
movzx eax, byte [r11 + 1]
shl ecx, 8
add ecx, eax
movzx eax, byte [r11]
shl ecx, 8
add r11, 0xc
add ecx, eax
sub ecx, edx
add edx, r9d
add ecx, ebx
xor r8d, ecx
sub r9d, r8d
mov eax, r8d
add r8d, edx
rol eax, 6
xor eax, r9d
sub edx, eax
mov ecx, eax
add eax, r8d
rol ecx, 8
xor ecx, edx
sub r8d, ecx
mov ebx, ecx
add ecx, eax
rol ebx, 0x10
xor ebx, r8d
sub eax, ebx
mov r10d, ebx
ror r10d, 0xd
add ebx, ecx
xor r10d, eax
sub ecx, r10d
mov r8d, r10d
rol r8d, 4
add r10d, ebx
xor r8d, ecx
sub rsi, 1
jne 0x1800c5280
mov rsi, qword [rsp + 0x10]
cmp rdi, 0xc
ja 0x1800c53ec
lea rcx, [0x180000000]
mov eax, dword [rcx + rdi*4 + 0xc544c]
add rax, rcx
jmp rax
movzx eax, byte [r11 + 0xb]
shl eax, 0x18
add r8d, eax
movzx eax, byte [r11 + 0xa]
shl eax, 0x10
add r8d, eax
movzx eax, byte [r11 + 9]
shl eax, 8
add r8d, eax
movzx eax, byte [r11 + 8]
add r8d, eax
movzx eax, byte [r11 + 7]
shl eax, 0x18
add r10d, eax
movzx eax, byte [r11 + 6]
shl eax, 0x10
add r10d, eax
movzx eax, byte [r11 + 5]
shl eax, 8
add r10d, eax
movzx eax, byte [r11 + 4]
add r10d, eax
movzx eax, byte [r11 + 3]
shl eax, 0x18
add ebx, eax
movzx eax, byte [r11 + 2]
shl eax, 0x10
add ebx, eax
movzx eax, byte [r11 + 1]
shl eax, 8
add ebx, eax
movzx eax, byte [r11]
add ebx, eax
xor r8d, r10d
mov eax, r10d
rol eax, 0xe
sub r8d, eax
mov eax, r8d
mov edx, r8d
rol eax, 0xb
xor edx, ebx
sub edx, eax
xor r10d, edx
mov eax, edx
ror eax, 7
sub r10d, eax
xor r8d, r10d
mov eax, r10d
rol eax, 0x10
sub r8d, eax
mov eax, r8d
mov ecx, r8d
rol eax, 4
xor ecx, edx
sub ecx, eax
xor r10d, ecx
mov eax, ecx
rol eax, 0xe
sub r10d, eax
mov eax, r10d
xor r8d, r10d
ror eax, 8
sub r8d, eax
mov eax, r8d
mov rbx, qword [rsp + 0x18]
pop rdi
ret

Function at 0x1800c8e30
Capabilities:
Set thread local storage value

Disassembly:
mov eax, 0x28
call fcn.18019a850
sub rsp, rax
mov ecx, dword [rcx]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
xor ecx, ecx
test eax, eax
setne cl
mov eax, ecx
add rsp, 0x28
ret

Function at 0x1800ee440
Capabilities:
Encode data using base64

Disassembly:
mov eax, 0x28
call fcn.18019a850
sub rsp, rax
mov r9d, r8d
mov r8, rdx
mov rdx, rcx
xor ecx, ecx
add rsp, 0x28
jmp fcn.1800ee820
Function at 0x1800f3500
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov eax, 0x28
call fcn.18019a850
sub rsp, rax
add rsp, 0x28
jmp fcn.1800b5b80

Function at 0x1800f6490
Capabilities:
Get thread local storage value

Disassembly:
mov eax, 0x28
call fcn.18019a850
sub rsp, rax
lea rcx, [0x180239a40]
add rsp, 0x28
jmp fcn.1800c8c90

Function at 0x18012fab0
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x38
call fcn.18019a850
sub rsp, rax
mov r10, rdx
mov dword [rsp + 0x40], reloc.WS2_32.dll_recv
add rdx, 0xf
lea rax, [r8 + 0xf]
mov r11, rcx
cmp r10, rax
ja 0x18012fae0
xor r9d, r9d
cmp rdx, r8
jae 0x18012faf9
movdqu xmm1, xmmword [r10]
movdqu xmm0, xmmword [r8]
pxor xmm1, xmm0
movdqu xmmword [r10], xmm1
mov r9d, reloc.WS2_32.dll_recv
cmp r9, 0x10
jae 0x18012fb21
sub r8, r10
lea rax, [r9 + r10]
mov edx, reloc.WS2_32.dll_recv
sub rdx, r9
nop
movzx ecx, byte [r8 + rax]
xor byte [rax], cl
lea rax, [rax + 1]
sub rdx, 1
jne 0x18012fb10
mov rcx, qword [r11 + 8]
lea r8, [rsp + 0x40]
mov r9, r10
mov dword [rsp + 0x20], reloc.WS2_32.dll_recv
mov rdx, r10
call fcn.1800cd400
test eax, eax
je 0x18012fb52
cmp dword [rsp + 0x40], 0x10
jne 0x18012fb52
mov eax, 1
add rsp, 0x38
ret
xor eax, eax
add rsp, 0x38
ret

Function at 0x18012fd00
Capabilities:
Encode data using xor

Disassembly:
mov r10, rcx
test rdx, rdx
je 0x18012fd88
test r8, r8
je 0x18012fd88
mov rax, qword [rcx + 0x18]
cmp r8, rax
mov r9, rax
cmovb r9, r8
test r9, r9
je 0x18012fd46
add rcx, 0x20
mov r11, rdx
sub r11, r10
nop
movzx eax, byte [r11 + rcx - 0x20]
xor byte [rcx], al
lea rcx, [rcx + 1]
sub r9, 1
jne 0x18012fd30
mov rax, qword [r10 + 0x18]
cmp r8, rax
jbe 0x18012fd88
sub r8, rax
mov eax, reloc.WS2_32.dll_recv
cmp r8, rax
cmova r8, rax
xor ecx, ecx
test r8, r8
je 0x18012fd88
nop dword [rax]
nop word [rax + rax]
mov rax, qword [r10 + 0x18]
add rax, rcx
movzx eax, byte [rax + rdx]
xor byte [r10 + rcx + 0x40], al
inc rcx
cmp rcx, r8
jb 0x18012fd70
ret

Function at 0x180179a50
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x38
call fcn.18019a850
sub rsp, rax
cmp dword [rsp + 0x68], 0
je 0x180179a79
lea rax, [0x1801780c0]
mov qword [rsp + 0x68], rax
add rsp, 0x38
jmp fcn.180170e20
lea rax, [0x180177280]
mov qword [rsp + 0x68], rax
add rsp, 0x38
jmp fcn.180170b70
Function at 0x140002a17
Capabilities:
Read file on windows

Disassembly:
push r14
push rsi
push rdi
push rbx
sub rsp, 0x28
mov rbx, r8
mov r14, rdx
lea rdx, [0x140035c04]
call fcn.140002878
test rax, rax
je 0x140002a4b
mov rsi, rax
mov rcx, rax
call fcn.140002840
cmp rax, rbx
jbe 0x140002a4f
xor ebx, ebx
jmp 0x140002a84
xor ebx, ebx
jmp 0x140002a8c
mov rdi, rax
mov rcx, r14
mov rdx, rax
call fcn.140003288
mov rcx, qword [r14 + 0x10]
mov edx, 1
mov r8, rdi
mov r9, rsi
call fcn.14000b760
mov bl, 1
cmp rax, rdi
je 0x140002a84
xor ebx, ebx
xor edx, edx
mov rcx, r14
call fcn.140003288
mov rcx, rsi
call fcn.14000ba14
mov eax, ebx
add rsp, 0x28
pop rbx
pop rdi
pop rsi
pop r14
ret
Function at 0x14000be10
Capabilities:
Encode data using xor

Disassembly:
mov rax, rcx
neg rcx
test rax, 7
je 0x14000be2d
nop
mov dl, byte [rax]
inc rax
test dl, dl
je 0x14000be88
test al, 7
jne 0x14000be20
movabs r8, 0x7efefefefefefeff
movabs r11, 0x8101010101010100
mov rdx, qword [rax]
mov r9, r8
add rax, 8
add r9, rdx
not rdx
xor rdx, r9
and rdx, r11
je 0x14000be41
mov rdx, qword [rax - 8]
test dl, dl
je 0x14000beb2
test dh, dh
je 0x14000beac
shr rdx, 0x10
test dl, dl
je 0x14000bea6
test dh, dh
je 0x14000bea0
shr rdx, 0x10
test dl, dl
je 0x14000be9a
test dh, dh
je 0x14000be94
shr edx, 0x10
test dl, dl
je 0x14000be8e
test dh, dh
jne 0x14000be41
lea rax, [rcx + rax - 1]
ret
lea rax, [rcx + rax - 2]
ret
lea rax, [rcx + rax - 3]
ret
lea rax, [rcx + rax - 4]
ret
lea rax, [rcx + rax - 5]
ret
lea rax, [rcx + rax - 6]
ret
lea rax, [rcx + rax - 7]
ret
lea rax, [rcx + rax - 8]
ret

Function at 0x14000ed38
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
mov eax, 0x1050
call fcn.14001c020
sub rsp, rax
mov rax, qword [0x14003d2e0]
xor rax, rsp
mov qword [rsp + 0x1040], rax
mov r14, rdx
mov rbx, rcx
call fcn.1400102b4
xor esi, esi
movsxd r12, eax
cmp dword [rbx + 0x10], esi
jne 0x14000ed8c
mov rax, r14
jmp 0x14000eea6
mov rax, qword [rbx]
mov rdi, r12
sub rax, qword [rbx + 8]
xor r8d, r8d
cqo
sar rdi, 6
sub rax, rdx
mov rbx, r12
sar rax, 1
and ebx, 0x3f
mov r15, rax
shl rbx, 6
lea rax, [0x140000000]
mov ecx, r12d
mov rdx, qword [rax + rdi*8 + 0x3e150]
mov rbp, r12
mov rdx, qword [rbx + rdx + 0x30]
call fcn.14001be5c
mov r13, rax
lea rax, [0x140000000]
mov rcx, qword [rax + rdi*8 + 0x3e150]
cmp r13, qword [rbx + rcx + 0x30]
je 0x14000edf3
or rax, 0xffffffffffffffff
jmp 0x14000eea6
mov rcx, rbp
mov qword [rsp + 0x20], rsi
sar rcx, 6
lea r9, [rsp + 0x30]
and ebp, 0x3f
lea rdx, [rsp + 0x40]
shl rbp, 6
mov r8d, 0x1000
mov rcx, qword [rax + rcx*8 + 0x3e150]
mov rcx, qword [rcx + rbp + 0x28]
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x14000edea
xor r8d, r8d
mov rdx, r14
mov ecx, r12d
call fcn.14001be5c
test rax, rax
js 0x14000edea
mov eax, dword [rsp + 0x30]
cmp r15, rax
jg 0x14000edea
lea rdx, [rsp + 0x40]
add rdx, rax
lea rcx, [rsp + 0x40]
test r15, r15
je 0x14000ee9a
lea r8, [0x140000000]
cmp rcx, rdx
jae 0x14000ee9a
cmp byte [rcx], 0xd
jne 0x14000ee80
lea rax, [rdx - 1]
cmp rcx, rax
jae 0x14000ee8f
cmp byte [rcx + 1], 0xa
jne 0x14000ee8f
inc rcx
jmp 0x14000ee8f
movzx eax, byte [rcx]
movsx rax, byte [rax + r8 + 0x3d0b0]
add rcx, rax
inc rsi
inc rcx
cmp rsi, r15
jne 0x14000ee62
lea rax, [rsp + 0x40]
sub rcx, rax
lea rax, [rcx + r13]
mov rcx, qword [rsp + 0x1040]
xor rcx, rsp
call fcn.140017f30
lea r11, [rsp + 0x1050]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x140011d10
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x30
movsxd r15, ecx
lea r10, [0x14003e150]
mov r14, rdx
mov rax, r15
sar rax, 6
mov rdx, r15
and edx, 0x3f
mov rdi, r15
shl rdx, 6
mov r9, qword [r10 + rax*8]
mov r12, qword [r9 + rdx + 0x28]
test r8, r8
je 0x140011d75
cmp byte [r14], 0xa
jne 0x140011d75
mov rcx, r15
mov rax, r15
sar rax, 6
and ecx, 0x3f
shl rcx, 6
mov rax, qword [r10 + rax*8]
or byte [rax + rcx + 0x38], 4
jmp 0x140011d96
mov dl, byte [r9 + rdx + 0x38]
mov rcx, rdi
and dl, 0xfb
mov rax, rdi
sar rax, 6
and ecx, 0x3f
shl rcx, 6
mov rax, qword [r10 + rax*8]
mov byte [rax + rcx + 0x38], dl
lea rbp, [r14 + r8]
mov rsi, r14
mov rbx, r14
cmp r14, rbp
jae 0x140011ef0
mov r13d, 1
mov al, byte [rsi]
cmp al, 0x1a
je 0x140011eb0
cmp al, 0xd
je 0x140011dca
mov byte [rbx], al
add rbx, r13
add rsi, r13
jmp 0x140011ea5
lea rax, [rsi + 1]
cmp rax, rbp
jae 0x140011df0
cmp byte [rax], 0xa
jne 0x140011de2
mov byte [rbx], 0xa
mov eax, 2
jmp 0x140011de8
mov byte [rbx], 0xd
mov rax, r13
add rsi, rax
jmp 0x140011ea2
and qword [rsp + 0x20], 0
lea r9, [rsp + 0x78]
mov r8d, r13d
lea rdx, [rsp + 0x70]
mov rcx, r12
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x140011e98
cmp dword [rsp + 0x78], 0
je 0x140011e98
mov rcx, rdi
lea r10, [0x14003e150]
and ecx, 0x3f
mov rax, rdi
sar rax, 6
shl rcx, 6
mov rax, qword [r10 + rax*8]
test byte [rax + rcx + 0x38], 0x48
je 0x140011e68
mov dl, byte [rsp + 0x70]
cmp dl, 0xa
je 0x140011e74
mov rcx, rdi
mov byte [rbx], 0xd
mov rax, rdi
and ecx, 0x3f
sar rax, 6
shl rcx, 6
mov rax, qword [r10 + rax*8]
mov byte [rax + rcx + 0x3a], dl
jmp 0x140011ea2
cmp byte [rsp + 0x70], 0xa
jne 0x140011e79
cmp rbx, r14
jne 0x140011e79
mov byte [rbx], 0xa
jmp 0x140011ea2
mov r8d, r13d
or rdx, 0xffffffffffffffff
mov ecx, r15d
call fcn.14001be64
cmp byte [rsp + 0x70], 0xa
lea r10, [0x14003e150]
je 0x140011ea5
jmp 0x140011e9f
lea r10, [0x14003e150]
mov byte [rbx], 0xd
add rbx, r13
cmp rsi, rbp
jb 0x140011daf
jmp 0x140011ef0
mov rcx, rdi
mov rax, rdi
sar rax, 6
and ecx, 0x3f
shl rcx, 6
mov rax, qword [r10 + rax*8]
mov dl, byte [rax + rcx + 0x38]
test dl, 0x40
jne 0x140011ee9
mov rax, rdi
or dl, 2
sar rax, 6
and edi, 0x3f
shl rdi, 6
mov rax, qword [r10 + rax*8]
mov byte [rax + rdi + 0x38], dl
jmp 0x140011ef0
mov cl, byte [rsi]
mov byte [rbx], cl
add rbx, r13
sub rbx, r14
mov eax, ebx
mov rbx, qword [rsp + 0x80]
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret