joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180006098
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
push r14
push r15
sub rsp, 0x460
mov r14, r9
mov r15, r8
mov rbx, rdx
xor edi, edi
mov qword [rsp + 0x48], rdi
mov qword [rsp + 0x40], rcx
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x50], rdi
xor edx, edx
lea r8d, [rdi + 0x60]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rsi, rax
mov qword [rsp + 0x488], rax
test rax, rax
jne 0x180006117
xor edx, edx
lea r8d, [rdi + 2]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov rsi, rax
mov qword [rsp + 0x488], rax
test rax, rax
jne 0x180006117
call fcn.180005864
mov ebx, eax
jmp 0x18000622b
mov r8, r14
mov rdx, r15
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov rbx, rax
test rax, rax
jne 0x180006138
call fcn.180005864
jmp 0x18000621a
mov rdx, rbx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_LoadResource]
mov r14, rax
mov qword [rsp + 0x30], rax
test rax, rax
je 0x18000612e
mov rdx, rbx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov ebx, eax
mov dword [rsp + 0x480], eax
inc eax
cmp eax, ebx
jae 0x180006176
mov ebx, 0x8007000e
jmp 0x18000621c
mov ecx, eax
test eax, eax
je 0x1800061a8
xor edx, edx
or rax, 0xffffffffffffffff
div rcx
cmp rax, 2
jb 0x18000625d
lea rdx, [rcx + rcx]
cmp rdx, 0x400
jbe 0x1800061a8
lea rcx, [rsp + 0x50]
call fcn.1800091c0
jmp 0x1800061b2
lea rax, [rsp + 0x58]
mov qword [rsp + 0x50], rax
jmp 0x1800061ca
cmp qword [rsp + 0x50], rdi
je 0x18000616c
mov dword [rsp + 0x28], ebx
mov rax, qword [rsp + 0x50]
mov qword [rsp + 0x20], rax
mov r9d, ebx
mov r8, r14
xor edx, edx
lea ecx, [rdx + 3]
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
test eax, eax
je 0x18000612e
mov ecx, eax
mov rax, qword [rsp + 0x50]
mov word [rax + rcx*2], di
mov r8d, dword [rsp + 0x4a0]
mov rdx, qword [rsp + 0x50]
lea rcx, [rsp + 0x38]
call fcn.180006df0
mov ebx, eax
test rsi, rsi
je 0x18000622b
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
nop
lea rax, [rsp + 0x58]
cmp qword [rsp + 0x50], rax
je 0x180006242
lea rcx, [rsp + 0x50]
call fcn.180009048
nop
mov eax, ebx
lea r11, [rsp + 0x460]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rdi
ret
mov ecx, 0x80070216
call fcn.180005840
int3
Function at 0x180008190
Capabilities:
Write file on windows

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x20
mov rbx, r8
mov r14, rdx
mov rdi, rcx
cmp qword [rcx + 0x68], 0
je 0x1800081c0
call fcn.180008978
jmp 0x180008238
mov rsi, rbx
mov rax, qword [rcx + 0x40]
mov r9, qword [rax]
test r9, r9
je 0x1800081d7
mov rax, qword [rcx + 0x58]
mov ecx, dword [rax]
jmp 0x1800081d9
xor ecx, ecx
movsxd rbp, ecx
test rbx, rbx
jle 0x180008232
test ecx, ecx
jle 0x180008213
cmp rbx, rbp
cmovl rbp, rbx
mov r8, rbp
mov rcx, r9
call fcn.18000bc80
nop
sub rbx, rbp
mov rax, qword [rdi + 0x58]
sub dword [rax], ebp
mov rcx, qword [rdi + 0x40]
movsxd rax, ebp
add qword [rcx], rax
add r14, rbp
test rbx, rbx
jle 0x180008232
mov r9, qword [rdi + 0x80]
test r9, r9
je 0x180008232
mov r8, rbx
mov edx, 1
mov rcx, r14
call fcn.18001033c
sub rbx, rax
sub rsi, rbx
mov rax, rsi
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret

Function at 0x180008254
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x20
mov rdi, r8
mov r14, rdx
mov rsi, rcx
test r8, r8
jg 0x180008281
xor eax, eax
jmp 0x180008372
cmp qword [rcx + 0x68], 0
je 0x180008292
call fcn.180008a28
jmp 0x180008372
mov rbp, rdi
mov rax, qword [rcx + 0x38]
mov rdx, qword [rax]
test rdx, rdx
je 0x1800082a9
mov rax, qword [rcx + 0x50]
mov ecx, dword [rax]
jmp 0x1800082ab
xor ecx, ecx
movsxd rax, ecx
test ecx, ecx
je 0x1800082e1
mov rbx, rdi
cmp rax, rdi
cmovb rbx, rax
mov r8, rbx
mov rcx, r14
call fcn.18000bc80
nop
add r14, rbx
mov rbp, rdi
sub rbp, rbx
mov rax, qword [rsi + 0x50]
sub dword [rax], ebx
mov rcx, qword [rsi + 0x38]
movsxd rax, ebx
add qword [rcx], rax
mov rbx, rbp
cmp qword [rsi + 0x80], 0
je 0x18000836c
mov r8, qword [rsi + 0x18]
lea rax, [rsi + 0x70]
cmp qword [r8], rax
jne 0x18000831b
mov rdx, qword [rsi + 0x90]
mov rcx, qword [rsi + 0x88]
mov qword [r8], rcx
mov rax, qword [rsi + 0x38]
mov qword [rax], rcx
sub edx, ecx
mov rax, qword [rsi + 0x50]
mov dword [rax], edx
mov r15d, 0xfff
jmp 0x180008348
mov r9, qword [rsi + 0x80]
mov r8, r15
mov edx, 1
mov rcx, r14
call fcn.180010650
add r14, rax
sub rbp, rax
mov rbx, rbp
cmp rax, r15
jne 0x18000838b
cmp rbp, r15
ja 0x180008323
test rbx, rbx
je 0x18000836c
mov r9, qword [rsi + 0x80]
mov r8, rbp
mov edx, 1
mov rcx, r14
call fcn.180010650
sub rbx, rax
sub rdi, rbx
mov rax, rdi
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop rdi
ret
sub rdi, rbp
jmp 0x18000836f
Function at 0x180008720
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rbp
push rdi
push r14
mov rbp, rsp
sub rsp, 0x70
or edi, 0xffffffff
mov esi, edx
mov rbx, rcx
cmp edx, edi
jne 0x180008748
xor eax, eax
jmp 0x18000886a
mov rax, qword [rcx + 0x40]
mov rcx, qword [rax]
test rcx, rcx
je 0x180008782
mov rdx, qword [rbx + 0x58]
movsxd r8, dword [rdx]
lea rax, [rcx + r8]
cmp rcx, rax
jae 0x180008782
lea eax, [r8 - 1]
mov dword [rdx], eax
mov rcx, qword [rbx + 0x40]
mov rdx, qword [rcx]
lea rax, [rdx + 1]
mov qword [rcx], rax
mov eax, esi
mov byte [rdx], sil
jmp 0x18000886a
cmp qword [rbx + 0x80], 0
je 0x180008868
mov r8, qword [rbx + 0x18]
lea rax, [rbx + 0x70]
cmp qword [r8], rax
jne 0x1800087bd
mov rcx, qword [rbx + 0x88]
mov rdx, qword [rbx + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rbx + 0x38]
mov qword [rax], rcx
mov rax, qword [rbx + 0x50]
mov dword [rax], edx
mov rcx, qword [rbx + 0x68]
test rcx, rcx
jne 0x1800087e0
movsx ecx, sil
mov rdx, qword [rbx + 0x80]
call fcn.18000f7a8
cmp eax, edi
cmovne edi, esi
jmp 0x180008868
lea r8, [rbp + 0x30]
mov byte [rbp - 0x30], sil
mov rax, qword [rcx]
lea rdx, [rbx + 0x74]
mov qword [rsp + 0x38], r8
lea r9, [rbp - 0x2f]
lea r8, [rbp - 8]
mov qword [rsp + 0x30], r8
lea r8, [rbp - 0x28]
mov qword [rsp + 0x28], r8
lea r8, [rbp + 0x38]
mov qword [rsp + 0x20], r8
lea r8, [rbp - 0x30]
call qword [rax + 0x38]
test eax, eax
je 0x18000882e
sub eax, 1
je 0x18000882e
cmp eax, 2
jne 0x180008868
movsx ecx, byte [rbp - 0x30]
jmp 0x1800087ca
mov r14, qword [rbp + 0x30]
lea rax, [rbp - 0x28]
sub r14, rax
je 0x180008858
mov r9, qword [rbx + 0x80]
lea rcx, [rbp - 0x28]
mov r8, r14
mov edx, 1
call fcn.18001033c
cmp r14, rax
jne 0x180008868
lea rax, [rbp - 0x30]
mov byte [rbx + 0x71], 1
cmp qword [rbp + 0x38], rax
mov eax, esi
jne 0x18000886a
mov eax, edi
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret

Function at 0x180008dc0
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x50
cmp qword [rcx + 0x68], 0
mov rbx, rcx
je 0x180008e1c
cmp byte [rcx + 0x71], 0
je 0x180008e1c
mov rax, qword [rcx]
or edx, 0xffffffff
call qword [rax + 0x18]
cmp eax, 0xffffffff
je 0x180008e63
mov rcx, qword [rbx + 0x68]
lea r8, [rsp + 0x60]
mov qword [rsp + 0x20], r8
lea rdx, [rbx + 0x74]
lea r9, [rsp + 0x50]
lea r8, [rsp + 0x30]
mov rax, qword [rcx]
call qword [rax + 0x40]
test eax, eax
je 0x180008e29
sub eax, 1
je 0x180008e2d
cmp eax, 2
jne 0x180008e63
mov byte [rbx + 0x71], 0
mov al, 1
mov rbx, qword [rsp + 0x68]
add rsp, 0x50
pop rdi
ret
mov byte [rbx + 0x71], 0
mov rdi, qword [rsp + 0x60]
lea rax, [rsp + 0x30]
sub rdi, rax
je 0x180008e5a
mov r9, qword [rbx + 0x80]
lea rcx, [rsp + 0x30]
mov r8, rdi
mov edx, 1
call fcn.18001033c
cmp rdi, rax
jne 0x180008e63
cmp byte [rbx + 0x71], 0
sete al
jmp 0x180008e1e
xor al, al
jmp 0x180008e1e
Function at 0x180017d78
Capabilities:
Read file on windows

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov qword [rax + 8], rcx
push rbp
mov rbp, rsp
sub rsp, 0x20
test rcx, rcx
jne 0x180017c18
call fcn.18000f5a0
mov dword [rax], 0x16
call fcn.18000f27c
or eax, 0xffffffff
mov rbx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop rbp
ret
mov eax, dword [rcx + 0x14]
shr eax, 0xd
test al, 1
je 0x180017c00
mov rax, qword [rbp + 0x10]
mov ecx, dword [rax + 0x14]
shr ecx, 0xc
test cl, 1
jne 0x180017c00
mov rax, qword [rbp + 0x10]
mov ecx, dword [rax + 0x14]
mov rax, qword [rbp + 0x10]
shr ecx, 1
test cl, 1
je 0x180017c4a
lock or dword [rax + 0x14], 0x10
jmp 0x180017c00
lock or dword [rax + 0x14], 1
mov rax, qword [rbp + 0x10]
mov ecx, dword [rax + 0x14]
test ecx, 0x4c0
jne 0x180017c67
mov rcx, qword [rbp + 0x10]
call fcn.180017f6c
mov rax, qword [rbp + 0x10]
mov rcx, qword [rax + 8]
mov qword [rax], rcx
mov rbx, qword [rbp + 0x10]
mov rcx, rbx
call fcn.180015fa8
mov rdx, qword [rbp + 0x10]
mov ecx, eax
mov r8d, dword [rdx + 0x20]
mov rdx, qword [rdx + 8]
call fcn.180019638
mov dword [rbx + 0x10], eax
mov rax, qword [rbp + 0x10]
mov edx, dword [rax + 0x10]
lea ecx, [rdx + 1]
cmp ecx, 1
ja 0x180017cbe
neg edx
sbb ecx, ecx
and ecx, 8
add ecx, 8
lock or dword [rax + 0x14], ecx
mov rax, qword [rbp + 0x10]
and dword [rax + 0x10], 0
jmp 0x180017c00
mov ecx, dword [rax + 0x14]
test cl, 6
jne 0x180017d2a
mov rcx, qword [rbp + 0x10]
call fcn.180015fa8
cmp eax, 0xffffffff
je 0x180017d11
mov rcx, qword [rbp + 0x10]
call fcn.180015fa8
cmp eax, 0xfffffffe
je 0x180017d11
mov rbx, qword [rbp + 0x10]
mov rcx, rbx
call fcn.180015fa8
movsxd rdi, eax
lea rsi, [0x180038dd0]
mov rcx, rbx
sar rdi, 6
call fcn.180015fa8
and eax, 0x3f
shl rax, 6
add rax, qword [rsi + rdi*8]
jmp 0x180017d18
lea rax, [0x1800373c0]
mov al, byte [rax + 0x38]
and al, 0x82
cmp al, 0x82
jne 0x180017d2a
mov rax, qword [rbp + 0x10]
lock or dword [rax + 0x14], 0x20
mov rax, qword [rbp + 0x10]
cmp dword [rax + 0x20], 0x200
jne 0x180017d60
mov ecx, dword [rax + 0x14]
shr ecx, 6
test cl, 1
je 0x180017d5c
mov rax, qword [rbp + 0x10]
mov ecx, dword [rax + 0x14]
shr ecx, 8
test cl, 1
jne 0x180017d5c
mov rax, qword [rbp + 0x10]
mov dword [rax + 0x20], 0x1000
mov rax, qword [rbp + 0x10]
dec dword [rax + 0x10]
mov rcx, qword [rax]
movzx edx, byte [rcx]
inc rcx
mov qword [rax], rcx
mov eax, edx
jmp 0x180017c03
jmp 0x180017bd0
Function at 0x18001a04c
Capabilities:
Get geographical location

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x20
mov edi, r9d
mov rsi, r8
mov ebp, edx
lea r9, str.GetLocaleInfoEx
mov r14, rcx
lea r8, [0x180029080]
lea rdx, str.GetLocaleInfoEx
mov ecx, 0xc
call fcn.180019c94
mov rbx, rax
test rax, rax
je 0x18001a0af
mov rcx, rax
call qword [method.std::basic_streambuf_char__struct_std::char_traits_char__.virtual_8]
mov r9d, edi
mov r8, rsi
mov edx, ebp
mov rcx, r14
call rbx
jmp 0x18001a0c9
xor edx, edx
mov rcx, r14
call fcn.18001a3b4
mov ecx, eax
mov r9d, edi
mov r8, rsi
mov edx, ebp
call qword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
Function at 0x180001448
Capabilities:
Encode data using xor

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x30
mov rbp, rcx
mov ecx, dword [r9]
mov rbx, r9
mov esi, r8d
mov rdi, rdx
call fcn.1800040f4
test eax, eax
jne 0x180001569
mov ecx, dword [r9 + 4]
lea eax, [rcx - 1]
cmp eax, 0x7f
ja 0x180001564
xor edx, edx
mov eax, r8d
div ecx
mov r8d, eax
test edx, edx
jne 0x180001564
test cl, 3
jne 0x180001564
movsxd rax, dword [r9]
lea r12, [0x180043a30]
imul rax, rax, 0xb0
mov r10, qword [rax + r12 + 0x60]
test r10, r10
je 0x1800014e5
lea rax, [r9 + 0x88]
mov rdx, rdi
mov rcx, rbp
add r9, 8
mov qword [rsp + 0x20], rax
call r10
jmp 0x180001569
test esi, esi
je 0x180001560
lea r14, [r9 + 8]
xor edx, edx
test ecx, ecx
jle 0x18000150f
mov r8, rbp
mov rcx, r14
sub r8, rbx
mov eax, dword [r8 + rcx - 8]
add edx, 4
xor dword [rcx], eax
lea rcx, [rcx + 4]
cmp edx, dword [rbx + 4]
jl 0x1800014fc
movsxd rax, dword [rbx]
lea r8, [rbx + 0x88]
mov rdx, rdi
mov rcx, r14
imul rax, rax, 0xb0
call qword [rax + r12 + 0x28]
test eax, eax
jne 0x180001569
xor edx, edx
cmp dword [rbx + 4], edx
jle 0x180001552
mov r8, rdi
mov rcx, r14
sub r8, rbx
mov eax, dword [r8 + rcx - 8]
add edx, 4
mov dword [rcx], eax
lea rcx, [rcx + 4]
cmp edx, dword [rbx + 4]
jl 0x18000153f
movsxd rcx, dword [rbx + 4]
add rdi, rcx
add rbp, rcx
sub esi, ecx
jne 0x1800014ed
xor eax, eax
jmp 0x180001569
mov eax, reloc.WS2_32.dll_recv
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x30
pop r15
pop r14
pop r12
ret
Function at 0x180001588
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x58
mov rax, qword [0x18003d030]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov rdi, rcx
mov ecx, dword [r9]
mov rbx, r9
mov esi, r8d
mov rbp, rdx
call fcn.1800040f4
test eax, eax
jne 0x1800016a6
mov ecx, dword [r9 + 4]
lea eax, [rcx - 1]
cmp eax, 0x7f
ja 0x1800016a1
xor edx, edx
mov eax, r8d
div ecx
mov r8d, eax
test edx, edx
jne 0x1800016a1
test cl, 3
jne 0x1800016a1
movsxd rax, dword [r9]
lea r15, [0x180043a30]
imul rax, rax, 0xb0
mov r10, qword [rax + r15 + 0x68]
test r10, r10
je 0x180001624
lea rax, [r9 + 0x88]
mov rdx, rbp
mov rcx, rdi
add r9, 8
mov qword [rsp + 0x20], rax
call r10
jmp 0x1800016a6
test esi, esi
je 0x18000169d
movsxd rax, dword [rbx]
lea r8, [rbx + 0x88]
lea rdx, [rsp + 0x30]
mov rcx, rdi
imul rax, rax, 0xb0
call qword [rax + r15 + gethostbyname]
test eax, eax
jne 0x1800016a6
xor r8d, r8d
cmp dword [rbx + 4], r8d
jle 0x18000168e
lea r9, [rsp + 0x30]
mov r10, rdi
mov r11, rbp
sub r9, rdi
sub r10, rbx
sub r11, rbx
lea rdx, [rbx + 8]
lea rax, [r10 + rdx]
add r8d, 4
mov ecx, dword [r9 + rax - 8]
mov eax, dword [rax - 8]
xor ecx, dword [rdx]
mov dword [rdx], eax
lea rdx, [rdx + 4]
mov dword [r11 + rdx - 0xc], ecx
cmp r8d, dword [rbx + 4]
jl 0x18000166b
movsxd rax, dword [rbx + 4]
add rdi, rax
add rbp, rax
sub esi, dword [rbx + 4]
jne 0x180001628
xor eax, eax
jmp 0x1800016a6
mov eax, reloc.WS2_32.dll_recv
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.18001a200
add rsp, 0x58
pop r15
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x1800039f4
Capabilities:
Hash data using sha256

Disassembly:
and dword [rcx + 0x28], 0
and qword [rcx], 0
xor eax, eax
mov dword [rcx + 8], 0x6a09e667
mov dword [rcx + 0xc], 0xbb67ae85
mov dword [rcx + 0x10], 0x3c6ef372
mov dword [rcx + 0x14], 0xa54ff53a
mov dword [rcx + 0x18], 0x510e527f
mov dword [rcx + 0x1c], 0x9b05688c
mov dword [rcx + 0x20], 0x1f83d9ab
mov dword [rcx + 0x24], 0x5be0cd19
ret

Function at 0x180004170
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x20
mov rsi, rcx
mov ecx, dword [rcx + 0x70]
mov r13, r8
mov r15, rdx
call fcn.18000411c
test eax, eax
jne 0x1800042e2
movsxd rdi, dword [rsi + 0x70]
lea rbx, [0x180045030]
shl rdi, 7
mov ecx, dword [rdi + rbx + 0x10]
mov r12d, dword [rdi + rbx + 0xc]
call fcn.180019378
mov ecx, r12d
mov r14, rax
call fcn.180019378
mov rbp, rax
test r14, r14
je 0x1800042d0
test rax, rax
je 0x1800042c8
mov rdx, rax
mov rcx, rsi
call qword [rdi + rbx + 0x68]
mov ebx, eax
test eax, eax
jne 0x1800042a8
lea r9, [0x180045030]
xor r8d, r8d
cmp dword [rdi + r9 + 0x10], r8d
jbe 0x180004223
mov rax, qword [rsi + 0xe8]
mov cl, byte [rax + r8]
xor cl, 0x5c
mov byte [r8 + r14], cl
inc r8d
cmp r8d, dword [rdi + r9 + 0x10]
jb 0x180004207
mov rcx, rsi
call qword [rdi + r9 + 0x58]
mov ebx, eax
test eax, eax
jne 0x1800042a8
lea rax, [0x180045030]
mov rdx, r14
mov rcx, rsi
mov r8d, dword [rdi + rax + 0x10]
call qword [rdi + rax + 0x60]
mov ebx, eax
test eax, eax
jne 0x1800042a8
lea rax, [0x180045030]
mov r8d, r12d
mov rdx, rbp
mov rcx, rsi
call qword [rdi + rax + 0x60]
mov ebx, eax
test eax, eax
jne 0x1800042a8
lea rax, [0x180045030]
mov rdx, r14
mov rcx, rsi
call qword [rdi + rax + 0x68]
mov ebx, eax
test eax, eax
jne 0x1800042a8
xor ecx, ecx
test r12d, r12d
je 0x1800042a2
mov rdx, r14
sub rdx, r15
cmp ecx, dword [r13]
jae 0x1800042a2
mov al, byte [rdx + r15]
inc ecx
mov byte [r15], al
inc r15
cmp ecx, r12d
jb 0x18000428b
mov dword [r13], ecx
xor ebx, ebx
mov rcx, qword [rsi + 0xe8]
call fcn.180019338
mov rcx, rbp
call fcn.180019338
mov rcx, r14
call fcn.180019338
mov eax, ebx
jmp 0x1800042e2
mov rcx, r14
call fcn.180019338
test rbp, rbp
je 0x1800042dd
mov rcx, rbp
call fcn.180019338
mov eax, reloc.WS2_32.dll_listen
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x20
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x180004300
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x40
mov rsi, rcx
movsxd rbp, edx
mov edi, r9d
mov ecx, ebp
mov r13, r8
call fcn.18000411c
test eax, eax
jne 0x18000446d
mov rbx, rbp
lea rax, [0x180045030]
mov dword [rsi + 0x70], ebp
shl rbx, 7
mov r15d, dword [rbx + rax + 0xc]
test r9d, r9d
jne 0x18000435b
lea eax, [r9 + 3]
jmp 0x18000446d
mov r12d, dword [rbx + rax + 0x10]
mov ecx, r12d
call fcn.180019378
mov r14, rax
test rax, rax
jne 0x180004379
lea eax, [r14 + 0xd]
jmp 0x18000446d
mov rcx, r12
call fcn.180019378
mov qword [rsi + 0xe8], rax
test rax, rax
jne 0x180004395
lea edi, [rax + 0xd]
jmp 0x180004463
lea r12, [0x180045030]
mov rdx, r13
mov ecx, dword [rbx + r12 + 0x10]
cmp edi, ecx
jbe 0x1800043e6
mov dword [rsp + 0x30], ecx
lea rcx, [rsp + 0x30]
mov r9, rax
mov qword [rsp + 0x20], rcx
mov ecx, ebp
mov r8d, edi
call fcn.1800018bc
mov edi, eax
test eax, eax
jne 0x180004457
mov eax, dword [rbx + r12 + 0x10]
cmp r15d, eax
jae 0x18000440d
mov rcx, r15
sub eax, r15d
add rcx, qword [rsi + 0xe8]
jmp 0x180004406
mov r8, rdi
mov rcx, rax
call fcn.180019c80
mov eax, dword [rbx + r12 + 0x10]
cmp edi, eax
jae 0x18000440d
mov rcx, qword [rsi + 0xe8]
sub eax, edi
add rcx, rdi
mov edx, eax
call fcn.1800040dc
xor r8d, r8d
cmp dword [rbx + r12 + 0x10], r8d
jbe 0x180004433
mov rax, qword [rsi + 0xe8]
mov cl, byte [rax + r8]
xor cl, 0x36
mov byte [r8 + r14], cl
inc r8d
cmp r8d, dword [rbx + r12 + 0x10]
jb 0x180004417
mov rcx, rsi
call qword [rbx + r12 + 0x58]
mov edi, eax
test eax, eax
jne 0x180004457
mov r8d, dword [rbx + r12 + 0x10]
mov rdx, r14
mov rcx, rsi
call qword [rbx + r12 + 0x60]
mov edi, eax
test eax, eax
je 0x180004463
mov rcx, qword [rsi + 0xe8]
call fcn.180019338
mov rcx, r14
call fcn.180019338
mov eax, edi
lea r11, [rsp + 0x40]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x18000ca74
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x20
mov ecx, 0x380
call fcn.180014120
mov edx, 0x100
mov rcx, rax
mov rbx, rax
call fcn.18001423c
mov edx, 0x100
mov rcx, rbx
mov r15, rax
call fcn.18001423c
mov edx, 0x80
mov rcx, rbx
call fcn.18001423c
mov edx, 0x100
mov rcx, rbx
mov rsi, rax
call fcn.18001423c
mov ecx, 8
mov rbx, rax
call fcn.1800180e4
mov ecx, 1
mov r12, rax
call fcn.180018118
mov ecx, 2
call fcn.180018118
mov ecx, 3
movzx ebp, ax
call fcn.180018090
mov ecx, reloc.WS2_32.dll_send
mov edi, eax
call fcn.180018090
mov ecx, 9
call fcn.1800180e4
mov ecx, 0xa
mov r14, rax
call fcn.1800180e4
mov r13, rax
call fcn.18000de0c
test eax, eax
je 0x18000cb3c
call fcn.180018800
mov ecx, 5
mov dword [section..data], edi
call fcn.180018118
movzx ecx, ax
mov dword [0x18003e448], ecx
mov ecx, 4
call fcn.180018090
mov ecx, eax
call fcn.180019378
mov ecx, 4
mov rdi, rax
call fcn.180018090
mov ecx, eax
call fcn.180019378
mov ecx, 4
call fcn.180018090
mov r8, rbx
mov rcx, rdi
mov edx, eax
call fcn.180013db4
cmp dword [section..data], 0
jbe 0x18000cd37
mov rcx, r12
call fcn.18000ce28
mov ebx, 0x80
lea r8, [0x18002c728]
mov edx, ebx
mov rcx, rsi
mov r9, rax
call fcn.18001972c
mov rcx, r12
call fcn.18000ce28
lea r8, [0x18002c728]
mov edx, ebx
mov r9, rax
mov rcx, r15
call fcn.18001972c
lea r8, [0x18002c728]
lea rcx, [0x180046e80]
mov r9, r13
mov edx, 0x100
mov dword [reloc.WS2_32.dll_accept], 1
call fcn.18001972c
mov r8, r14
mov edx, ebp
mov rcx, rsi
call fcn.18000d858
lea ecx, [rbx - 0x7c]
call fcn.180018090
lea rdx, [0x180046a60]
mov r8, rdi
mov r9d, eax
mov rcx, r15
call fcn.18000d804
mov ebx, eax
test eax, eax
jle 0x18000cc4a
mov edx, eax
mov rcx, rdi
call fcn.180017bfc
mov ebx, eax
test eax, eax
jle 0x18000cc4a
mov edx, eax
mov rcx, rdi
call fcn.180016950
cmp ebx, 0xffffffff
je 0x18000cccb
lea rbx, [fcn.18000cd58]
mov rcx, rbx
call fcn.1800149a8
mov ecx, 0x1c
call fcn.180018090
mov rcx, rbx
mov edx, 0x80000
test eax, eax
je 0x18000cc79
mov edx, 0x1000
call fcn.18000ff64
mov rcx, rbx
call fcn.18001335c
mov edx, 0x80000
mov rcx, rbx
call fcn.180012e88
call fcn.18000de0c
test eax, eax
je 0x18000cca4
mov rcx, rbx
call fcn.18000dee4
cmp dword [0x18003e470], 0
jle 0x18000cccb
call fcn.18000d7d8
mov r8, r14
mov edx, ebp
mov rcx, rsi
call fcn.18000d858
lea rcx, [0x180046e80]
call fcn.18000da0c
call fcn.18000d7d8
call fcn.18000de0c
test eax, eax
je 0x18000ccde
call fcn.180018800
mov ecx, dword [section..data]
test ecx, ecx
je 0x18000cd37
cmp dword [0x18003e448], 0
je 0x18000cd24
call fcn.18000ddec
mov edx, dword [0x18003e448]
mov ecx, dword [section..data]
imul edx, ecx
mov r9d, eax
mov eax, 0x51eb851f
mul edx
mov eax, r9d
mov r8d, edx
xor edx, edx
shr r8d, 5
div r8d
cmp edx, ecx
jae 0x18000cd2f
sub ecx, edx
call fcn.1800107c0
mov ecx, dword [section..data]
test ecx, ecx
jne 0x18000cb9e
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x20
pop r15
pop r14
pop r13
pop r12
pop rdi
jmp fcn.180018800