joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1801693f0
Capabilities:
Receive data
Receive data on socket

Disassembly:
push rbp
push rsi
push rdi
sub rsp, 0xd0
mov rax, qword [0x180496d00]
xor rax, rsp
mov qword [rsp + 0xc0], rax
mov rax, qword [rcx + 0x20]
mov rbp, rcx
xor r9d, r9d
xor esi, esi
mov rdi, qword [rax + 0x680]
lea rax, [rsp + 0x30]
mov dword [rsp + 0x30], 0x80
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x40]
mov qword [rsp + 0x20], rax
mov r8d, dword [rdi + 0x144]
mov rdx, qword [rdi + 0x150]
add r8d, 4
mov rcx, qword [rdi + 0x18]
call qword [sym.imp.WS2_32.dll_recvfrom]
mov dword [rdi + 0x13c], eax
cmp dword [rdi + 0x138], esi
jne 0x180169486
movsxd r8, dword [rsp + 0x30]
lea rcx, [rdi + 0xb8]
lea rdx, [rsp + 0x40]
call sub.VCRUNTIME140.dll_memcpy
mov eax, dword [rsp + 0x30]
mov dword [rdi + 0x138], eax
mov r8d, dword [rdi + 0x13c]
mov qword [rsp + 0x100], r14
cmp r8d, 4
jge 0x1801694d6
lea rdx, str.Received_too_short_packet
mov rcx, rbp
call fcn.180143220
mov dword [rdi + 0xc], 7
mov eax, esi
mov r14, qword [rsp + 0x100]
mov rcx, qword [rsp + 0xc0]
xor rcx, rsp
call fcn.1803a0e80
add rsp, 0xd0
pop rdi
pop rsi
pop rbp
ret
mov rdx, qword [rdi + 0x150]
movzx eax, byte [rdx]
movzx ecx, byte [rdx + 1]
shl eax, 8
or ecx, eax
mov dword [rdi + 0xc], ecx
dec ecx
cmp ecx, 5
ja case.0x18016950c.1
movsxd rax, ecx
lea r9, [0x180000000]
mov ecx, dword [r9 + rax*4 + 0x169614]
add rcx, r9
jmp rcx
cmp r8d, 4
jle case.0x18016950c.4
movzx eax, byte [rdx + 3]
movzx ecx, byte [rdx + 2]
shl ecx, 8
or ecx, eax
movzx eax, word [rdi + 0x14c]
inc eax
movzx eax, ax
cmp eax, ecx
jne case.0x18016950c.4
lea eax, [r8 - 4]
mov rcx, rbp
lea r8, [rdx + 4]
movsxd r9, eax
mov edx, 1
call fcn.180144690
mov esi, eax
test eax, eax
je case.0x18016950c.4
mov edx, 5
mov rcx, rdi
call fcn.18016a030
jmp 0x1801694b1
movzx ecx, byte [rdx + 2]
lea eax, [r8 - 4]
shl ecx, 8
lea r14, [rdx + 4]
mov qword [rsp + 0xf8], rbx
movsxd rbx, eax
movzx eax, byte [rdx + 3]
mov rdx, rbx
or ecx, eax
mov dword [rdi + 8], ecx
mov rcx, r14
call fcn.18016a0a0
cmp rax, rbx
mov rbx, qword [rsp + 0xf8]
jae case.0x18016950c.4
mov r8, r14
lea rdx, str.TFTP_error:__s
mov rcx, rbp
call fcn.180143310
jmp case.0x18016950c.4
add r8d, 0xfffffffe
add rdx, 2
mov rcx, rdi
call fcn.180169130
mov esi, eax
test eax, eax
je case.0x18016950c.4
jmp 0x1801694b3
lea r8, str.Internal_error:_Unexpected_packet
mov rcx, rbp
lea rdx, [0x1803a3b78]
call fcn.180143220
mov rcx, rbp
call fcn.180159b10
test eax, eax
je 0x1801694b1
mov edx, 5
mov rcx, rdi
call fcn.18016a030
mov eax, Ordinal_46
jmp 0x1801694b3
Function at 0x180171bf0
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0xc0
mov rax, qword [0x180496d00]
xor rax, rsp
mov qword [rsp + 0xb0], rax
mov rsi, qword [rcx + 0x20]
lea r8, [rsp + 0x20]
mov rdi, rcx
lea rdx, [rsp + 0x30]
mov rbx, qword [rsi + 0x228]
mov rcx, rbx
mov qword [rsp + 0x28], 0xffffffffffffffff
mov dword [rsp + 0x20], 0x80
call qword [sym.imp.WS2_32.dll_getsockname]
test eax, eax
jne 0x180171c6c
lea r8, [rsp + 0x20]
mov dword [rsp + 0x20], 0x80
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [sym.imp.WS2_32.dll_accept]
mov qword [rsp + 0x28], rax
jmp 0x180171c71
mov rax, qword [rsp + 0x28]
mov rcx, rdi
cmp rax, 0xffffffffffffffff
jne 0x180171c90
lea rdx, str.Error_accept__ing_server_connect
call fcn.180143220
mov eax, reloc.WLDAP32.dll_Ordinal_30
jmp 0x180171d2a
lea rdx, str.Connection_accepted_from_server
call fcn.180143310
mov byte [rsi + 0x3ad], 0
mov edx, 1
mov rcx, qword [rsp + 0x28]
call fcn.180184050
lea r9, [rsp + 0x28]
mov r8d, 1
mov rdx, rsi
mov rcx, rdi
call fcn.18014b070
mov ebx, eax
test eax, eax
je 0x180171cdd
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.WS2_32.dll_closesocket]
mov eax, ebx
jmp 0x180171d2a
cmp qword [rdi + 0x280], 0
je 0x180171d28
mov dl, 1
mov rcx, rdi
call fcn.18012e880
mov rdx, qword [rsp + 0x28]
mov r8d, 1
mov rcx, qword [rdi + 0x288]
call qword [rdi + 0x280]
xor edx, edx
mov rcx, rdi
mov ebx, eax
call fcn.18012e880
test ebx, ebx
je 0x180171d28
mov rcx, rdi
call fcn.180172420
mov eax, Ordinal_46
jmp 0x180171d2a
xor eax, eax
mov rcx, qword [rsp + 0xb0]
xor rcx, rsp
call fcn.1803a0e80
lea r11, [rsp + 0xc0]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret

Function at 0x180173c10
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rax, qword [rcx + 0x1b8]
mov rbx, rcx
mov rdi, qword [rcx + 0x20]
cmp dword [rax + 0x10], 0
je 0x180173c83
movzx eax, byte [rdi + 0x78e]
cmp al, 0xd
je 0x180173c65
test rdi, rdi
je 0x180173c4b
lea r8, str.STOP
mov r8, qword [r8 + rax*8]
jmp 0x180173c52
lea r8, [0x1803af608]
lea r9, str.RETR_PREQUOTE
lea rdx, str.__s_______s_
call fcn.1801434d0
mov r8b, reloc.WS2_32.dll_listen
mov byte [rdi + 0x78e], 0xd
mov dl, 1
mov rcx, rbx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp fcn.180173dd0
cmp byte [rcx + 0xa4e], 0
je 0x180173c9d
xor edx, edx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp fcn.180174ab0
cmp byte [rcx + 0xa51], 0
je 0x180173d20
mov r9, qword [rdi + 0x738]
lea rdx, [rdi + 0x680]
test r9, r9
jne 0x180173ce7
mov r9, qword [rcx + 0x7f8]
test r9, r9
jne 0x180173cde
cmp byte [rcx + 0x12b1], 0
lea rax, str.NLST
lea r9, str.LIST
cmovne r9, rax
lea r8, str.PRET__s
jmp 0x180173cfe
cmp byte [rcx + 0x12b5], 0
lea r8, str.PRET_STOR__s
jne 0x180173cfe
lea r8, str.PRET_RETR__s
call fcn.180188780
mov edi, eax
test eax, eax
jne 0x180173d13
mov dl, Ordinal_30
mov rcx, rbx
call fcn.1801723c0
mov eax, edi
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
mov rdx, rdi
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp fcn.1801749d0
Function at 0x180174070
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
push rbx
sub rsp, 0x20
mov rax, qword [rcx + 0x1b8]
add rdx, 0x680
mov rbx, rcx
cmp dword [rax + 0x10], 0
je 0x1801740c8
cmp qword [rdx + 0xb8], 0
je 0x1801740c8
xor r9d, r9d
mov qword [rsp + 0x30], rdi
lea r8, str.REST__d
call fcn.180188780
mov edi, eax
test eax, eax
jne 0x1801740bd
mov dl, reloc.WLDAP32.dll_Ordinal_26
mov rcx, rbx
call fcn.1801723c0
mov eax, edi
mov rdi, qword [rsp + 0x30]
add rsp, 0x20
pop rbx
ret
add rsp, 0x20
pop rbx
jmp fcn.180173c10

Function at 0x180174580
Capabilities:
Check http status code

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
sub rsp, 0x30
mov rbp, qword [rcx + 0x20]
lea eax, [rdx - 0xc8]
xor edi, edi
movzx esi, r8b
mov rbx, rcx
cmp eax, 0x64
jb 0x1801745c2
lea rdx, str.Couldnt_set_desired_mode
call fcn.180143220
mov eax, reloc.WS2_32.dll_recvfrom
mov rbx, qword [rsp + 0x60]
add rsp, 0x30
pop rdi
pop rsi
pop rbp
ret
cmp edx, 0xc8
je 0x1801745d9
mov r8d, edx
lea rdx, str.Got_a__03d_response_code_instead_of_the_assumed_200
call fcn.180143310
cmp sil, 0x13
jne 0x1801745f6
mov rdx, rbp
mov rcx, rbx
mov rbx, qword [rsp + 0x60]
add rsp, 0x30
pop rdi
pop rsi
pop rbp
jmp fcn.180174290
cmp sil, 0x14
jne 0x18017473a
cmp byte [rbx + 0x6f0], 2
mov qword [rsp + 0x58], r14
mov r14, qword [rbx + 0x20]
jne 0x18017467d
mov rax, qword [rbx + 0x1b8]
mov rcx, qword [rax]
test rcx, rcx
je 0x18017467d
xor r9d, r9d
mov qword [rsp + 0x50], rdi
lea r8, [rsp + 0x50]
mov dword [rsp + 0x20], 3
xor edx, edx
call fcn.18014d820
mov esi, eax
test eax, eax
jne 0x180174726
mov rcx, qword [rsp + 0x50]
mov edx, gethostbyaddr
call sub.VCRUNTIME140.dll_strrchr
test rax, rax
je 0x180174672
mov rdi, qword [rsp + 0x50]
mov ecx, 1
sub rax, rdi
cmovne rcx, rax
mov byte [rcx + rdi], sil
jmp 0x18017467d
mov rcx, qword [rsp + 0x50]
call qword [fcn.1803a1f8a]
mov rdx, qword [rbx + 0x7f8]
test rdx, rdx
jne 0x1801746a2
cmp byte [rbx + 0x12b1], 0
lea rax, str.NLST
lea rdx, str.LIST
cmovne rdx, rax
lea r8, [0x18046a4a0]
test rdi, rdi
mov r9, r8
lea rax, [0x18046a674]
cmovne r9, rdi
lea rcx, [0x1803a583c]
cmovne r8, rax
call fcn.18014f290
mov rcx, rdi
mov rbp, rax
call qword [fcn.1803a1f8a]
test rbp, rbp
jne 0x1801746f4
mov r14, qword [rsp + 0x58]
mov esi, reloc.WLDAP32.dll_Ordinal_27
mov eax, esi
mov rbx, qword [rsp + 0x60]
add rsp, 0x30
pop rdi
pop rsi
pop rbp
ret
lea rdx, [r14 + 0x680]
mov r9, rbp
lea r8, [0x1803a3b78]
mov rcx, rbx
call fcn.180188780
mov rcx, rbp
mov esi, eax
call qword [fcn.1803a1f8a]
test esi, esi
jne 0x180174726
mov dl, Ordinal_32
mov rcx, rbx
call fcn.1801723c0
mov r14, qword [rsp + 0x58]
mov eax, esi
mov rbx, qword [rsp + 0x60]
add rsp, 0x30
pop rdi
pop rsi
pop rbp
ret
cmp sil, 0x15
jne 0x180174745
mov r8b, reloc.WS2_32.dll_listen
jmp 0x18017474e
cmp sil, 0x16
jne 0x18017475a
mov r8b, recv
mov dl, 1
mov rcx, rbx
call fcn.180173dd0
mov edi, eax
mov rbx, qword [rsp + 0x60]
mov eax, edi
add rsp, 0x30
pop rdi
pop rsi
pop rbp
ret
Function at 0x180189c00
Capabilities:
Get hostname

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
movsxd rbx, edx
mov rdi, rcx
mov edx, ebx
mov byte [rcx], 0
call qword [sym.imp.WS2_32.dll_gethostname]
mov byte [rbx + rdi - 1], 0
test eax, eax
jne 0x180189c3b
mov edx, reloc.WLDAP32.dll_Ordinal_46
mov rcx, rdi
call sub.VCRUNTIME140.dll_strchr
test rax, rax
je 0x180189c39
mov byte [rax], 0
xor eax, eax
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x18018b0f0
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push r15
sub rsp, 0x20
mov eax, dword [rcx + 0x18]
mov rbp, rcx
mov ecx, dword [rcx + 0x20]
mov rsi, rdx
add rcx, 0x18
mov r15d, r8d
lea r9d, [rax + rax]
add rcx, r9
call qword [section..data]
mov rbx, rax
test rax, rax
jne 0x18018b133
mov rbx, qword [rsp + 0x58]
add rsp, 0x20
pop r15
pop rsi
pop rbp
ret
lea rcx, [rax + 0x18]
mov qword [rax], rbp
mov qword [rax + 8], rcx
mov eax, dword [rbp + 0x18]
add rax, rcx
mov qword [rsp + 0x48], rdi
mov qword [rbx + 0x10], rax
lea rdi, [rbp + 8]
mov qword [rsp + 0x50], r14
cmp r15d, dword [rbp + 0x1c]
jbe 0x18018b180
call qword [rbp]
mov rcx, qword [rbx + 8]
mov r8d, r15d
mov rdx, rsi
call qword [rdi]
mov esi, dword [rbp + 0x18]
add rsi, qword [rbx + 0x10]
mov rdx, qword [rbx + 8]
mov rcx, rsi
call qword [rbp + reloc.WS2_32.dll_recv]
mov r15d, dword [rbp + 0x20]
mov rcx, qword [rbx + 8]
call qword [rbp]
mov rcx, qword [rbx + 0x10]
call qword [rbp]
xor r14d, r14d
test r15, r15
je 0x18018b1e2
mov r14, r15
nop dword [rax]
movzx eax, byte [rsi]
lea rdx, [rsp + 0x40]
xor al, 0x36
mov r8d, 1
mov byte [rsp + 0x40], al
mov rcx, qword [rbx + 8]
call qword [rdi]
movzx eax, byte [rsi]
lea rdx, [rsp + 0x40]
xor al, 0x5c
lea rsi, [rsi + 1]
mov byte [rsp + 0x40], al
mov r8d, 1
mov rcx, qword [rbx + 0x10]
call qword [rdi]
sub r15, 1
jne 0x18018b1a0
lea rdi, [rbp + 8]
mov eax, dword [rbp + 0x1c]
cmp r14, rax
jae 0x18018b221
nop word [rax + rax]
mov rcx, qword [rbx + 8]
lea rdx, [0x1803b34f9]
mov r8d, 1
call qword [rdi]
mov rcx, qword [rbx + 0x10]
lea rdx, [0x1803b34fa]
mov r8d, 1
call qword [rdi]
mov eax, dword [rbp + 0x1c]
inc r14
cmp r14, rax
jb 0x18018b1f0
mov r14, qword [rsp + 0x50]
mov rax, rbx
mov rbx, qword [rsp + 0x58]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r15
pop rsi
pop rbp
ret
Function at 0x18018c060
Capabilities:
Hash data using md4
Hash data via wincrypt
Initialize hashing via wincrypt

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
sub rsp, 0x50
mov rax, qword [0x180496d00]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov rsi, r8
mov dword [rsp + 0x20], 0xf0000040
mov rdi, rdx
mov rbx, rcx
xor ebp, ebp
lea rcx, [rsp + 0x38]
xor r8d, r8d
mov qword [rsp + 0x38], rbp
xor edx, edx
mov qword [rsp + 0x40], rbp
mov r9d, 1
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
test eax, eax
je 0x18018c0e3
mov rcx, qword [rsp + 0x38]
lea rax, [rsp + 0x40]
xor r9d, r9d
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov edx, 0x8002
call qword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
jne 0x18018c105
mov rcx, qword [rsp + 0x38]
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov eax, 2
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.1803a0e80
mov rbx, qword [rsp + 0x88]
add rsp, 0x50
pop rdi
pop rsi
pop rbp
ret
mov rcx, rsi
call fcn.180147520
mov rcx, qword [rsp + 0x40]
xor r9d, r9d
mov r8d, eax
mov rdx, rdi
call qword [sym.imp.ADVAPI32.dll_CryptHashData]
mov rcx, qword [rsp + 0x40]
lea r9, [rsp + 0x30]
xor r8d, r8d
mov dword [rsp + 0x30], ebp
mov edx, 2
mov dword [rsp + 0x20], ebp
call qword [sym.imp.ADVAPI32.dll_CryptGetHashParam]
cmp dword [rsp + 0x30], 0x10
jne 0x18018c164
mov rcx, qword [rsp + 0x40]
lea r9, [rsp + 0x30]
mov r8, rbx
mov dword [rsp + 0x20], ebp
mov edx, 2
call qword [sym.imp.ADVAPI32.dll_CryptGetHashParam]
mov rcx, qword [rsp + 0x40]
test rcx, rcx
je 0x18018c174
call qword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
mov rcx, qword [rsp + 0x38]
test rcx, rcx
je 0x18018c186
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
xor eax, eax
jmp 0x18018c0e8
Function at 0x1801db060
Capabilities:
Get socket status

Disassembly:
push rbx
push rsi
push rdi
mov eax, 0x690
call fcn.1803a1670
sub rsp, rax
mov rax, qword [0x180496d00]
xor rax, rsp
mov qword [rsp + 0x670], rax
mov rsi, qword [rsp + 0x6d8]
mov eax, edx
xor edx, edx
mov r10d, ecx
mov dword [rsp + 0x460], 0
mov dword [rsp + 0x250], 0
mov dword [rsp + 0x40], edx
cmp ecx, 0xffffffff
je 0x1801db0c8
test eax, eax
je 0x1801db0c8
mov qword [rsp + 0x468], r10
mov dword [rsp + 0x460], 1
cmp r8d, 0xffffffff
je 0x1801db0e9
test r9d, r9d
je 0x1801db0e9
mov eax, r8d
mov qword [rsp + 0x258], rax
mov dword [rsp + 0x250], 1
cmp r10d, 0xffffffff
je 0x1801db0fd
mov edx, 1
mov qword [rsp + 0x48], r10
mov dword [rsp + 0x40], edx
cmp r8d, 0xffffffff
je 0x1801db132
xor eax, eax
test edx, edx
je 0x1801db11d
mov r9d, r8d
nop dword [rax]
cmp qword [rsp + rax*8 + 0x48], r9
je 0x1801db11d
inc eax
cmp eax, edx
jb 0x1801db110
cmp eax, edx
jne 0x1801db132
cmp edx, 0x40
jae 0x1801db132
mov edx, r8d
mov qword [rsp + rax*8 + 0x48], rdx
inc dword [rsp + 0x40]
mov rbx, qword [rsp + 0x6d0]
cmp r8d, r10d
mov edi, r8d
cmovle edi, r10d
cmp r10d, 0xffffffff
jne 0x1801db15c
cmp r8d, r10d
jne 0x1801db15c
cmp rbx, 0xffffffffffffffff
jb 0x1801db15c
xor eax, eax
jmp 0x1801db292
mov qword [rsp + 0x6b8], rbp
mov qword [rsp + 0x688], r12
mov qword [rsp + 0x680], r15
test rsi, rsi
je 0x1801db181
mov rcx, rsi
call fcn.18025c420
lea ebp, [rdi + 1]
movabs r15, 0x12e0be826d694b2f
movabs r12, 0x624dd2f1a9fbe77
nop dword [rax + rax]
cmp rbx, 0xffffffffffffffff
jae 0x1801db22a
call fcn.180245ab0
cmp rax, rbx
jbe 0x1801db1bb
mov ecx, 0x3e7
jmp 0x1801db1df
mov rcx, rbx
sub rcx, rax
mov rax, rcx
not rax
cmp rax, 0x3e7
jae 0x1801db1d8
mov rcx, 0xffffffffffffffff
jmp 0x1801db1df
add rcx, 0x3e7
mov r8, rcx
mov rax, r15
mul rcx
sub r8, rdx
shr r8, 1
add r8, rdx
shr r8, 0x1d
imul rax, r8, 0x3b9aca00
sub rcx, rax
mov rax, r12
mul rcx
mov eax, r8d
sub rcx, rdx
shr rcx, 1
add rdx, rcx
shr rdx, 9
mov edx, edx
shl rdx, 0x20
or rdx, rax
lea rax, [rsp + 0x30]
mov qword [rsp + 0x30], rdx
jmp 0x1801db22c
xor eax, eax
lea r9, [rsp + 0x40]
mov qword [rsp + 0x20], rax
lea r8, [rsp + 0x250]
mov ecx, ebp
lea rdx, [rsp + 0x460]
call qword [sym.imp.WS2_32.dll_select]
mov edi, eax
cmp eax, 0xffffffff
jne 0x1801db266
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x2714
je 0x1801db1a0
mov r15, qword [rsp + 0x680]
mov r12, qword [rsp + 0x688]
mov rbp, qword [rsp + 0x6b8]
test rsi, rsi
je 0x1801db28b
mov rcx, rsi
call fcn.18025c3b0
not edi
shr edi, 0x1f
mov eax, edi
mov rcx, qword [rsp + 0x670]
xor rcx, rsp
call fcn.1803a0e80
add rsp, 0x690
pop rdi
pop rsi
pop rbx
ret
Function at 0x1801ea200
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
mov eax, gethostbyaddr
call fcn.1803a1670
sub rsp, rax
mov rax, qword [0x180496d00]
xor rax, rsp
mov qword [rsp + 0x28], rax
mov rbx, qword [rdx + 0x18]
lea r9, [rsp + 0x20]
mov rdi, qword [rdx]
mov r8, qword [rdx + 0x10]
mov rdx, qword [rdx + 8]
call fcn.1801e9b50
test eax, eax
je 0x1801ea285
movzx ecx, byte [rdi]
shr cl, 3
not cl
and cl, 0x10
or cl, 0xf
and cl, byte [rsp + 0x20]
xor cl, byte [rdi]
mov byte [rdi], cl
and cl, 3
add cl, 1
je 0x1801ea280
lea rdx, [rsp + 0x21]
movzx ecx, cl
sub rdx, rbx
nop dword [rax + rax]
movzx eax, byte [rbx + rdx]
xor byte [rbx], al
lea rbx, [rbx + 1]
sub rcx, 1
jne 0x1801ea270
mov eax, 1
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.1803a0e80
mov rbx, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret

Function at 0x1801ea2a0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
mov eax, gethostbyaddr
call fcn.1803a1670
sub rsp, rax
mov rax, qword [0x180496d00]
xor rax, rsp
mov qword [rsp + 0x28], rax
mov rbx, qword [rdx + 0x18]
lea r9, [rsp + 0x20]
mov rdi, qword [rdx]
mov r8, qword [rdx + 0x10]
mov rdx, qword [rdx + 8]
call fcn.1801e9b50
test eax, eax
je 0x1801ea329
movzx eax, byte [rdi]
and al, 3
add al, 1
je 0x1801ea310
lea rdx, [rsp + 0x21]
movzx ecx, al
sub rdx, rbx
nop dword [rax]
nop word [rax + rax]
movzx eax, byte [rbx + rdx]
xor byte [rbx], al
lea rbx, [rbx + 1]
sub rcx, 1
jne 0x1801ea300
movzx ecx, byte [rdi]
mov eax, 1
shr cl, 3
not cl
and cl, 0x10
or cl, 0xf
and cl, byte [rsp + 0x20]
xor byte [rdi], cl
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.1803a0e80
mov rbx, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
Function at 0x18020fb50
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
lea rsi, [rcx - 1]
movsxd rdi, r9d
not rcx
shr rsi, 0x3f
shr rcx, 0x3f
mov r11, rdx
and rsi, rcx
mov r10, r8
mov ecx, dword [rdx + 8]
dec rsi
xor ecx, dword [r8 + 8]
and ecx, esi
xor dword [rdx + 8], ecx
xor dword [r8 + 8], ecx
movq xmm4, rsi
mov ecx, dword [rdx + 0x10]
xor ecx, dword [r8 + 0x10]
and ecx, esi
punpcklqdq xmm4, xmm4
xor dword [rdx + 0x10], ecx
xor dword [r8 + 0x10], ecx
mov edx, dword [rdx + 0x14]
mov ecx, edx
mov eax, dword [r8 + 0x14]
xor rcx, rax
and ecx, 4
and rcx, rsi
mov eax, ecx
xor eax, edx
mov dword [r11 + 0x14], eax
xor dword [r8 + 0x14], ecx
xor ecx, ecx
mov edx, ecx
test r9d, r9d
jle 0x18020fc69
cmp edi, 2
jb 0x18020fc69
mov r9, qword [r8]
lea rax, [rdi - 1]
mov r8, qword [r11]
lea rbx, [rdi - 1]
lea rbx, [r9 + rbx*8]
lea rax, [r8 + rax*8]
cmp r9, rax
ja 0x18020fbfa
cmp rbx, r8
jae 0x18020fc69
cmp r9, r10
ja 0x18020fc04
cmp rbx, r10
jae 0x18020fc69
cmp r9, r11
ja 0x18020fc0e
cmp rbx, r11
jae 0x18020fc69
cmp r8, r10
ja 0x18020fc18
cmp rax, r10
jae 0x18020fc69
cmp r8, r11
ja 0x18020fc22
cmp rax, r11
jae 0x18020fc69
mov eax, edi
and eax, 0xfffffffe
nop word [rax + rax]
movdqu xmm2, xmmword [rcx + r9]
add edx, 2
movdqu xmm1, xmmword [r8 + rcx]
lea rcx, [rcx + 0x10]
movdqa xmm3, xmm2
xorps xmm3, xmm1
andps xmm3, xmm4
movdqa xmm0, xmm3
xorps xmm3, xmm2
xorps xmm0, xmm1
movdqu xmmword [r8 + rcx - 0x10], xmm0
movdqu xmmword [rcx + r9 - 0x10], xmm3
cmp edx, eax
jl 0x18020fc30
movsxd rax, edx
cmp rax, rdi
jge 0x18020fc9e
mov rcx, qword [r11]
mov rdx, qword [rcx + rax*8]
lea r8, [rcx + rax*8]
mov rcx, qword [r10]
mov r9, rdx
xor r9, qword [rcx + rax*8]
and r9, rsi
xor rdx, r9
mov qword [r8], rdx
mov rcx, qword [r10]
xor qword [rcx + rax*8], r9
inc rax
cmp rax, rdi
jl 0x18020fc71
mov rbx, qword [rsp + 8]
mov rsi, qword [rsp + 0x10]
mov rdi, qword [rsp + 0x18]
ret
Function at 0x180210520
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x20], rbx
push rsi
test byte [rcx + 0x14], 4
lea rax, [rcx + 8]
mov r11, qword [rcx]
lea rsi, [rdx + 8]
mov rbx, qword [rdx]
je 0x18021061d
mov ecx, dword [rsi]
cmp dword [rax], ecx
jne 0x18021061d
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rdi
xor edi, edi
mov ebp, edi
test ecx, ecx
jle 0x18021060a
sub r11, rbx
nop dword [rax]
nop word [rax + rax]
mov r8, qword [rbx + r11]
inc ebp
mov rdx, qword [rbx]
lea rbx, [rbx + 8]
mov rcx, r8
shr rdx, 0x3f
sub r8, qword [rbx - 8]
shr r8, 0x3f
xor r8d, edx
shr rcx, 0x3f
xor edx, ecx
or r8d, edx
xor r8d, ecx
neg r8d
mov dword [rsp + 0x10], r8d
not r8d
mov r10d, dword [rsp + 0x10]
mov dword [rsp + 0x10], r8d
mov r9d, dword [rsp + 0x10]
and edi, r9d
mov r8, qword [rbx - 8]
or edi, r10d
mov rdx, qword [rbx + r11 - 8]
mov rcx, r8
sub r8, qword [rbx + r11 - 8]
shr r8, 0x3f
shr rdx, 0x3f
xor r8d, edx
shr rcx, 0x3f
xor edx, ecx
or r8d, edx
xor r8d, ecx
neg r8d
mov dword [rsp + 0x10], r8d
not r8d
mov edx, dword [rsp + 0x10]
and edx, 1
mov dword [rsp + 0x10], r8d
mov ecx, dword [rsp + 0x10]
and edi, ecx
or edi, edx
cmp ebp, dword [rsi]
jl 0x180210570
mov rbp, qword [rsp + 0x18]
mov eax, edi
mov rdi, qword [rsp + 0x20]
mov rbx, qword [rsp + 0x28]
pop rsi
ret
mov ecx, dword [rax]
mov eax, ecx
sub eax, dword [rsi]
jne 0x18021064b
lea eax, [rcx - 1]
movsxd rcx, eax
test eax, eax
js 0x180210649
lea rax, [rbx + rcx*8]
sub r11, rbx
mov rdx, qword [rax + r11]
cmp rdx, qword [rax]
jne 0x180210652
sub rax, 8
sub rcx, 1
jns 0x180210636
xor eax, eax
mov rbx, qword [rsp + 0x28]
pop rsi
ret
mov rbx, qword [rsp + 0x28]
mov eax, 0xffffffff
mov ecx, 1
cmova eax, ecx
pop rsi
ret
Function at 0x180210950
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
mov eax, 0x40
call fcn.1803a1670
sub rsp, rax
xor r13d, r13d
mov r12d, r9d
mov r15d, r13d
mov edi, r13d
mov ebp, r13d
mov ebx, r8d
mov r14, rdx
mov rsi, rcx
call fcn.1802100b0
mov r8d, eax
add eax, 7
cdq
and edx, 7
add eax, edx
sar eax, 3
cmp dword [rsp + 0x90], r13d
jne 0x1802109cf
mov edi, dword [rsi + 0x10]
mov ecx, edi
neg ecx
lea ecx, [rax*8]
sbb r15d, r15d
movzx r15d, r15b
cmp ecx, r8d
jne 0x1802109cd
test edi, edi
sete bpl
jmp 0x1802109cf
mov ebp, edi
add eax, ebp
cmp ebx, 0xffffffff
jne 0x180210a03
mov ebx, eax
mov eax, dword [rsi + 0xc]
shl eax, 3
movsxd rdx, eax
test eax, eax
jne 0x180210a7e
test ebx, ebx
je 0x180210b15
movsxd r8, ebx
xor edx, edx
mov rcx, r14
call sub.VCRUNTIME140.dll_memset
jmp 0x180210b15
cmp ebx, eax
jge 0x1802109d8
movups xmm2, xmmword [rsi]
movsxd rax, dword [rsi + 8]
movsd xmm0, qword [rsi + 0x10]
movsd qword [rsp + 0x30], xmm0
movups xmmword [rsp + 0x20], xmm2
test eax, eax
jle 0x180210a44
movq rcx, xmm2
lea r8, [rcx + rax*8]
nop dword [rax + rax]
cmp qword [r8 - 8], r13
lea r8, [r8 - 8]
jne 0x180210a40
dec eax
test eax, eax
jg 0x180210a30
mov dword [rsp + 0x28], eax
mov ecx, dword [rsp + 0x30]
test eax, eax
cmove ecx, r13d
mov dword [rsp + 0x30], ecx
lea rcx, [rsp + 0x20]
call fcn.1802100b0
add eax, 7
cdq
and edx, 7
add eax, edx
sar eax, 3
add eax, ebp
cmp ebx, eax
jge 0x1802109d8
mov rax, 0xffffffffffffffff
jmp 0x180210b17
cmp r12d, 1
je 0x180210a8d
lea eax, [rbx - 1]
movsxd rcx, eax
add r14, rcx
mov r11d, 1
movsxd rbp, ebx
cmp r12d, r11d
mov rax, 0xffffffffffffffff
lea r12, [rdx - 1]
cmovne r11, rax
mov eax, dword [rsi + 8]
shl eax, 3
xor r9d, r9d
xor r10d, r10d
movsxd r13, eax
test ebx, ebx
je 0x180210b15
nop dword [rax + rax]
mov rcx, qword [rsi]
movzx eax, r9b
and al, 7
mov rdx, r9
shl al, 3
shr rdx, 3
mov r8, qword [rcx + rdx*8]
movzx ecx, al
shr r8, cl
mov rax, r10
sub rax, r13
shr rax, 0x3f
neg al
and r8b, al
xor r8b, r15b
lea eax, [r8 + rdi]
cmp r8b, al
mov byte [r14], al
mov rax, r9
seta dil
sub rax, r12
shr rax, 0x3f
add r14, r11
add r9, rax
inc r10
cmp r10, rbp
jb 0x180210ac0
mov eax, ebx
mov rbx, qword [rsp + 0x70]
mov rbp, qword [rsp + 0x78]
mov rsi, qword [rsp + 0x80]
add rsp, 0x40
pop r15
pop r14
pop r13
pop r12
pop rdi
ret

Function at 0x180231260
Capabilities:
Set thread local storage value

Disassembly:
mov eax, Ordinal_41
call fcn.1803a1670
sub rsp, rax
mov ecx, dword [rcx]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
xor ecx, ecx
test eax, eax
setne cl
mov eax, ecx
add rsp, 0x28
ret