joyce8/EMBER2024-capa huggingface dataset:
Function at 0x18000ed40
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 7], 0
je 0x18000ed63
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 3]
xor byte [rax + rcx], dl
inc rax
cmp rax, 6
jb 0x18000ed50
mov byte [rcx + 7], 0
mov rax, rcx
ret

Function at 0x18000ed90
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 8], 0
je 0x18000edb3
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 3]
xor byte [rax + rcx], dl
inc rax
cmp rax, 7
jb 0x18000eda0
mov byte [rcx + 8], 0
mov rax, rcx
ret

Function at 0x18000edc0
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x20
mov rdi, rcx
mov rcx, rdx
call fcn.18003ec00
mov rcx, rdi
mov rbx, rax
call fcn.18003ec00
xor r9d, r9d
mov r8, rbx
mov rdx, rax
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
mov ecx, 0x3df
call qword [sym.imp.KERNEL32.dll_ExitProcess]

Function at 0x18000ee90
Capabilities:
Enumerate processes

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x160
mov rax, qword [0x1801551e0]
xor rax, rsp
mov qword [rsp + 0x150], rax
xor edx, edx
mov rbx, rcx
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
xor edx, edx
lea rcx, [rsp + 0x24]
mov r8d, Ordinal_301
mov rdi, rax
call sub.VCRUNTIME140.dll_memset
mov dword [rsp + 0x20], 0x130
cmp rdi, 0xffffffffffffffff
je 0x18000ef52
lea rdx, [rsp + 0x20]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_Process32First]
test eax, eax
je 0x18000ef52
lea rdx, [rsp + 0x20]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_Process32Next]
test eax, eax
je 0x18000ef49
cmp qword [rbx + 0x18], 0x10
mov r8, rbx
jb 0x18000ef11
mov r8, qword [rbx]
lea rax, [rsp + 0x4c]
sub r8, rax
nop dword [rax]
movzx edx, byte [rax]
movzx ecx, byte [rax + r8]
sub edx, ecx
jne 0x18000ef33
inc rax
test ecx, ecx
jne 0x18000ef20
mov rcx, rdi
test edx, edx
je 0x18000ef7d
lea rdx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_Process32Next]
test eax, eax
jne 0x18000ef04
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rbx
call fcn.180040890
xor al, al
mov rcx, qword [rsp + 0x150]
xor rcx, rsp
call fcn.1801127f0
mov rbx, qword [rsp + 0x178]
add rsp, 0x160
pop rdi
ret
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [rsp + 0x28], 0
je 0x18000ef52
mov rcx, rbx
call fcn.180040890
mov al, 1
jmp 0x18000ef5c
Function at 0x180010320
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x1e], 0
je 0x180010343
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 3]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x1d
jb 0x180010330
mov byte [rcx + 0x1e], 0
mov rax, rcx
ret

Function at 0x180010350
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 6], 0
je 0x180010373
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 3]
xor byte [rax + rcx], dl
inc rax
cmp rax, 5
jb 0x180010360
mov byte [rcx + 6], 0
mov rax, rcx
ret

Function at 0x1800126d0
Capabilities:
Encode data using xor

Disassembly:
mov rax, rsp
mov qword [rax + 0x20], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x5f]
sub rsp, 0xe0
movaps xmmword [rax - 0x48], xmm6
movaps xmmword [rax - 0x58], xmm7
mov rsi, qword [0x1801837c8]
mov r15, qword [0x1801837d0]
cmp rsi, r15
je 0x1800128a1
xor r13d, r13d
movzx ebx, byte [rbp + 0x67]
movss xmm7, dword [0x180136c00]
movzx edi, byte [rbp + 0x67]
nop
movsd xmm6, qword [rsi + 0x50]
movss xmm0, dword [0x18017f804]
cvtps2pd xmm0, xmm0
comisd xmm6, xmm0
jae 0x180012894
lea rcx, [0x18017f5a0]
call fcn.180063190
mov r12d, eax
mov dword [rbp + 0x6f], 0xa293dd
mov byte [rbp + 0x73], 1
mov rdx, r13
nop word [rax + rax]
lea ecx, [rdx - 3]
xor byte [rbp + rdx + 0x6f], cl
inc rdx
cmp rdx, 3
jb 0x180012760
mov byte [rbp + 0x73], 0
cvttsd2si edx, xmm6
lea rcx, [rbp - 0x19]
call fcn.18000eac0
mov r14, rax
mov dword [rbp + 0x67], 0x100a5dd
mov rdx, r13
nop
lea ecx, [rdx - 3]
xor byte [rbp + rdx + 0x67], cl
inc rdx
cmp rdx, 2
jb 0x180012790
mov byte [rbp + 0x6a], 0
mov rdx, qword [rsi + 0x10]
lea rax, [rbp + 0x67]
mov rcx, 0xffffffffffffffff
inc rcx
cmp byte [rax + rcx], 0
jne 0x1800127b3
movabs rax, 0x7fffffffffffffff
sub rax, rdx
cmp rax, rcx
jb 0x1800128c6
mov r9, rsi
cmp qword [rsi + 0x18], 0x10
jb 0x1800127df
mov r9, qword [rsi]
mov qword [rsp + 0x30], rcx
lea rax, [rbp + 0x67]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rdx
mov r8, rsi
movzx edx, bl
lea rcx, [rbp - 0x39]
call fcn.180051cb0
nop
mov r9, r14
lea r8, [rbp - 0x39]
movzx edx, dil
lea rcx, [rbp - 0x59]
call fcn.180051ac0
nop
lea rax, [rbp + 0x6f]
mov r8, 0xffffffffffffffff
inc r8
cmp byte [rax + r8], 0
jne 0x180012822
lea rdx, [rbp + 0x6f]
lea rcx, [rbp - 0x59]
call fcn.18003ec10
mov qword [rbp - 0x79], r13
mov qword [rbp - 0x69], r13
mov qword [rbp - 0x61], r13
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x79], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x69], xmm1
mov qword [rax + 0x10], r13
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
lea rdx, [rsi + 0x48]
mov r9d, r12d
movaps xmm2, xmm7
lea rcx, [rbp - 0x79]
call fcn.180010fa0
nop
lea rcx, [rbp - 0x59]
call fcn.180040890
nop
lea rcx, [rbp - 0x39]
call fcn.180040890
nop
lea rcx, [rbp - 0x19]
call fcn.180040890
add rsi, 0x58
cmp rsi, r15
jne 0x180012720
lea r11, [rsp + 0xe0]
mov rbx, qword [r11 + 0x58]
movaps xmm6, xmmword [r11 - 0x10]
movaps xmm7, xmmword [r11 - 0x20]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
call fcn.18000c960
nop
int3
Function at 0x1800128d0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 3], 0
je 0x1800128f3
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 3]
xor byte [rax + rcx], dl
inc rax
cmp rax, 2
jb 0x1800128e0
mov byte [rcx + 3], 0
mov rax, rcx
ret

Function at 0x180012900
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 4], 0
je 0x180012923
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 3]
xor byte [rax + rcx], dl
inc rax
cmp rax, 3
jb 0x180012910
mov byte [rcx + 4], 0
mov rax, rcx
ret
Function at 0x180013ed0
Capabilities:
Log keystrokes via polling

Disassembly:
mov r11, rsp
sub rsp, 0xe8
mov rax, qword [0x1801551e0]
xor rax, rsp
mov qword [rsp + 0x90], rax
cmp byte [0x18017f830], 0
je 0x1800140cf
mov edx, dword [0x18017f85c]
lea rcx, [rsp + 0x50]
mov qword [r11 - 8], rdi
movaps xmmword [r11 - 0x18], xmm6
movaps xmmword [r11 - 0x38], xmm8
movaps xmmword [r11 - 0x48], xmm9
call fcn.1800136f0
movups xmm8, xmmword [rax]
movsd xmm9, qword [rax + 0x20]
movups xmm6, xmmword [rax + 0x10]
movdqa xmm0, xmm8
movsd qword [rsp + 0x40], xmm9
psrldq xmm0, 8
movq rdi, xmm0
test rdi, rdi
je 0x1800140ad
movss xmm0, dword [0x18017f83c]
comiss xmm0, dword [rsp + 0x40]
jb 0x1800140ad
movss xmm1, dword [0x18017f854]
movaps xmm0, xmm6
cvtps2pd xmm1, xmm1
unpckhpd xmm0, xmm6
comisd xmm1, xmm0
jb 0x1800140ad
mov ecx, dword [reloc.WS2_32.dll_bind]
call qword [sym.imp.USER32.dll_GetKeyState]
bt ax, 0xf
jae 0x1800140ad
mov qword [rsp + 0xf8], rsi
movd esi, xmm6
test esi, esi
je 0x1800140a5
mov qword [rsp + 0xf0], rbx
lea rdx, [rsp + 0x80]
movd ebx, xmm8
mov rcx, rdi
movaps xmmword [rsp + 0xc0], xmm7
mov r8d, ebx
call qword [0x180183720]
movaps xmm1, xmmword [rsp + 0x80]
movss dword [rsp + 0x80], xmm1
movaps xmm0, xmm1
shufps xmm0, xmm1, 0x55
shufps xmm1, xmm1, 0xaa
movss dword [rsp + 0x88], xmm1
movss dword [rsp + 0x84], xmm0
cmp ebx, 0x1233
jne 0x180014012
movsd xmm7, qword [rdi + 0x90]
mov ebx, dword [rdi + 0x98]
jmp 0x180014022
mov ebx, dword [rsp + 0x88]
movsd xmm7, qword [rsp + 0x80]
cmp byte [0x180183595], 0
je 0x18001404c
lea rcx, [rsp + 0x80]
movsd qword [rsp + 0x80], xmm7
mov dword [rsp + 0x88], ebx
call fcn.180010a20
test al, al
jne 0x180014095
mov edx, esi
movabs rcx, 0x7239b21a38f536ba
call fcn.180043bd0
test eax, eax
je 0x180014095
lea rdx, [rsp + 0x80]
movsd qword [rsp + 0x80], xmm7
lea rcx, [rsp + 0x20]
mov dword [rsp + 0x88], ebx
movaps xmmword [rsp + 0x20], xmm8
movaps xmmword [rsp + 0x30], xmm6
movsd qword [rsp + 0x40], xmm9
call fcn.180013980
movaps xmm7, xmmword [rsp + 0xc0]
mov rbx, qword [rsp + 0xf0]
mov rsi, qword [rsp + 0xf8]
mov rdi, qword [rsp + 0xe0]
movaps xmm6, xmmword [rsp + 0xd0]
movaps xmm8, xmmword [rsp + 0xb0]
movaps xmm9, xmmword [rsp + 0xa0]
mov rcx, qword [rsp + 0x90]
xor rcx, rsp
call fcn.1801127f0
add rsp, 0xe8
ret
Function at 0x1800140f0
Capabilities:
Log keystrokes via polling

Disassembly:
push rbp
push rsi
push r14
lea rbp, [rsp - 0x47]
sub rsp, 0xd0
mov rax, qword [0x1801551e0]
xor rax, rsp
mov qword [rbp - 9], rax
cmp byte [0x18017faf0], 0
mov rsi, rdx
mov r14, rcx
je 0x180014338
mov rax, qword [0x180183728]
movss xmm0, dword [rcx + 8]
movss xmm1, dword [rcx]
movss xmm2, dword [rcx + 4]
subss xmm2, dword [rax + 0x94]
subss xmm0, dword [rax + 0x98]
subss xmm1, dword [rax + 0x90]
mulss xmm2, xmm2
mulss xmm0, xmm0
mulss xmm1, xmm1
addss xmm2, xmm1
addss xmm2, xmm0
xorps xmm0, xmm0
ucomiss xmm0, xmm2
ja 0x180014174
xorps xmm0, xmm0
sqrtss xmm0, xmm2
jmp 0x18001417c
movaps xmm0, xmm2
call sub.api_ms_win_crt_math_l1_1_0.dll_sqrtf
movss xmm1, dword [0x180136b70]
comiss xmm1, xmm0
jbe 0x180014338
mov edx, dword [0x18017fb00]
lea rcx, [rbp - 0x41]
mov qword [rsp + 0x108], rdi
call fcn.1800136f0
movups xmm2, xmmword [rax]
movups xmm0, xmmword [rax + 0x10]
movsd xmm1, qword [rax + 0x20]
movups xmmword [rbp - 0x69], xmm2
psrldq xmm2, 8
movq rdi, xmm2
movsd qword [rbp - 0x49], xmm1
movups xmmword [rbp - 0x59], xmm0
test rdi, rdi
je 0x180014330
movss xmm0, dword [0x18017faf4]
comiss xmm0, dword [rbp - 0x49]
jb 0x180014330
movss xmm0, dword [0x18017fafc]
cvtps2pd xmm0, xmm0
comisd xmm0, xmmword [rbp - 0x51]
jb 0x180014330
mov ecx, dword [reloc.WS2_32.dll_bind]
call qword [sym.imp.USER32.dll_GetKeyState]
bt ax, 0xf
jae 0x180014330
mov r8d, dword [rbp - 0x69]
lea rdx, [rbp - 0x19]
mov qword [rsp + 0x100], rbx
mov rcx, rdi
movaps xmmword [rsp + 0xc0], xmm6
movaps xmmword [rsp + 0xb0], xmm7
movaps xmmword [rsp + 0xa0], xmm8
movaps xmmword [rsp + 0x90], xmm9
call qword [0x180183720]
cmp dword [rbp - 0x69], 0x1233
movaps xmm8, xmmword [rbp - 0x19]
movaps xmm9, xmm8
movss dword [rbp - 0x19], xmm8
movaps xmm7, xmm8
shufps xmm9, xmm8, 0x55
shufps xmm7, xmm8, 0xaa
movss dword [rbp - 0x15], xmm9
movss dword [rbp - 0x11], xmm7
jne 0x1800142a9
movsd xmm6, qword [rdi + 0x90]
mov ebx, dword [rdi + 0x98]
movaps xmm0, xmm6
shufps xmm0, xmm0, 0x55
mov dword [rbp - 0x11], ebx
movaps xmm9, xmm0
movss xmm7, dword [rbp - 0x11]
movsd qword [rbp - 0x19], xmm6
movss xmm8, dword [rbp - 0x19]
jmp 0x1800142b1
mov ebx, dword [rbp - 0x11]
movsd xmm6, qword [rbp - 0x19]
cmp byte [0x180183595], 0
je 0x1800142d5
cmp byte [rbp - 0x45], 0
jne 0x1800142d5
lea rcx, [rbp - 0x19]
movsd qword [rbp - 0x19], xmm6
mov dword [rbp - 0x11], ebx
call fcn.180010a20
test al, al
jne 0x180014306
cmp byte [0x18017faf8], 0
je 0x1800142ff
addss xmm7, dword [0x180136abc]
movaps xmm0, xmm8
unpcklps xmm0, xmm9
movsd qword [r14], xmm0
movss dword [rbp - 0x11], xmm7
mov eax, dword [rbp - 0x11]
mov dword [r14 + 8], eax
movsd qword [rsi], xmm6
mov dword [rsi + 8], ebx
movaps xmm8, xmmword [rsp + 0xa0]
movaps xmm7, xmmword [rsp + 0xb0]
movaps xmm6, xmmword [rsp + 0xc0]
mov rbx, qword [rsp + 0x100]
movaps xmm9, xmmword [rsp + 0x90]
mov rdi, qword [rsp + 0x108]
mov rcx, qword [rbp - 9]
xor rcx, rsp
call fcn.1801127f0
add rsp, 0xd0
pop r14
pop rsi
pop rbp
ret
Function at 0x180014350
Capabilities:
Log keystrokes via polling

Disassembly:
sub rsp, 0xa8
mov rax, qword [0x1801551e0]
xor rax, rsp
mov qword [rsp + 0x90], rax
cmp byte [0x18017f868], 0
je 0x18001456b
mov edx, dword [0x18017f878]
lea rcx, [rsp + 0x58]
mov qword [rsp + 0xa0], rbx
call fcn.1800136f0
movups xmm2, xmmword [rax]
movups xmm0, xmmword [rax + 0x10]
movsd xmm1, qword [rax + 0x20]
movups xmmword [rsp + 0x30], xmm2
psrldq xmm2, 8
movq rbx, xmm2
movsd qword [rsp + 0x50], xmm1
movups xmmword [rsp + 0x40], xmm0
test rbx, rbx
je 0x180014563
movss xmm0, dword [0x18017f870]
cvtps2pd xmm0, xmm0
comisd xmm0, xmmword [rsp + 0x48]
jb 0x180014563
cmp qword [0x180184e10], rbx
je 0x1800143ee
mov qword [0x180184e10], rbx
mov dword [0x180184e24], 0
mov ecx, dword [0x180183574]
mov rax, qword gs:[0x58]
mov edx, 4
mov rax, qword [rax + rcx*8]
mov ecx, dword [rdx + rax]
cmp dword [0x180184fb8], ecx
jle 0x18001443f
lea rcx, [0x180184fb8]
call fcn.180112998
cmp dword [0x180184fb8], 0xffffffff
jne 0x18001443f
call qword [sym.imp.KERNEL32.dll_GetTickCount64]
lea rcx, [0x180184fb8]
mov qword [0x180184f90], rax
call fcn.180112938
call qword [sym.imp.KERNEL32.dll_GetTickCount64]
sub rax, qword [0x180184f90]
movsxd rcx, dword [0x180184e24]
cmp rax, rcx
jb 0x180014563
mov ecx, dword [reloc.WS2_32.dll_bind]
call qword [sym.imp.USER32.dll_GetKeyState]
bt ax, 0xf
jae 0x180014556
cmp byte [0x180183595], 0
je 0x1800144da
cmp byte [rsp + 0x54], 0
jne 0x1800144da
mov r8d, dword [rsp + 0x30]
lea rdx, [rsp + 0x80]
mov rcx, rbx
call qword [0x180183720]
movaps xmm1, xmmword [rsp + 0x80]
lea rcx, [rsp + 0x20]
movaps xmm2, xmm1
movaps xmm0, xmm1
shufps xmm0, xmm1, 0xaa
shufps xmm2, xmm1, 0x55
movss dword [rsp + 0x88], xmm0
mov eax, dword [rsp + 0x88]
unpcklps xmm1, xmm2
movsd qword [rsp + 0x20], xmm1
mov dword [rsp + 0x28], eax
call fcn.180010a20
test al, al
jne 0x180014556
cmp byte [0x18017f86a], 0
jne 0x180014514
movss xmm0, dword [0x18017f86c]
comiss xmm0, dword [rsp + 0x50]
jb 0x180014556
movss xmm3, dword [0x180136b14]
call fcn.1800450f0
cmp byte [0x18017f86a], 0
mov eax, dword [0x18017f874]
mov dword [0x180184e24], eax
je 0x180014556
movabs rcx, 0x4f8644af03d0e0d6
call fcn.1800439b0
mov r8d, dword [rsp + 0x40]
mov edx, eax
movabs rcx, 0x3c06b5c839b38f7b
call fcn.1800438b0
test eax, eax
je 0x180014556
movss xmm3, dword [0x180136b14]
call fcn.1800450f0
mov eax, dword [0x18017f874]
mov dword [0x180184e24], eax
call qword [sym.imp.KERNEL32.dll_GetTickCount64]
mov qword [0x180184f90], rax
mov rbx, qword [rsp + 0xa0]
mov rcx, qword [rsp + 0x90]
xor rcx, rsp
call fcn.1801127f0
add rsp, 0xa8
ret
Function at 0x180018270
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
sub rsp, 0x40
mov rsi, rcx
mov rdi, rdx
mov ecx, 3
call fcn.1800bd4a0
call fcn.1800bd1d0
xor ebx, ebx
mov qword [rsi + 0x18], reloc.WS2_32.dll_ntohs
mov qword [rsi], rbx
mov rbp, rax
mov qword [rsi + 0x10], rbx
mov r8, rdi
cmp qword [rdi + 0x18], 0x10
jb 0x1800182b2
mov r8, qword [rdi]
mov edx, 0x2712
mov rcx, rbp
call fcn.1800c0070
xor r8d, r8d
mov rcx, rbp
lea edx, [r8 + 0x40]
call fcn.1800c0070
movdqa xmm0, xmmword [0x180139340]
movdqu xmmword [rsp + 0x20], xmm0
mov word [rsp + 0x30], 0x100
nop dword [rax]
nop word [rax + rax]
lea eax, [rbx - 3]
xor byte [rsp + rbx + 0x20], al
inc rbx
cmp rbx, 0x10
jb 0x1800182f0
lea r8, [rsp + 0x20]
mov byte [rsp + 0x31], 0
mov edx, 0x2722
mov rcx, rbp
call fcn.1800c0070
lea r8, [0x180018240]
mov edx, 0x4e2b
mov rcx, rbp
call fcn.1800c0070
mov r8, rsi
mov edx, 0x2711
mov rcx, rbp
call fcn.1800c0070
mov rcx, rbp
call fcn.1800bd2b0
mov rcx, rbp
call fcn.1800bd1b0
call fcn.1800bd440
mov rcx, rdi
call fcn.180040890
mov rbx, qword [rsp + 0x70]
mov rax, rsi
add rsp, 0x40
pop rdi
pop rsi
pop rbp
ret

Function at 0x180018370
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x11], 0
je 0x180018393
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 3]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0x10
jb 0x180018380
mov byte [rcx + 0x11], 0
mov rax, rcx
ret
Function at 0x18001a7b0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r14
push r15
lea rbp, [rsp - 0x47]
sub rsp, 0xb0
mov rax, qword [0x1801551e0]
xor rax, rsp
mov qword [rbp + 0x37], rax
mov r15, rdx
mov rsi, rcx
mov qword [rbp + 0x17], rcx
xor ebx, ebx
mov dword [rbp - 0x49], ebx
mov qword [rcx], rbx
mov qword [rcx + 0x10], rbx
mov qword [rcx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rcx], bl
mov dword [rbp - 0x49], 1
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x1f], xmm0
mov qword [rbp + 0x2f], rbx
mov edx, 0x100
call fcn.1800518b0
mov qword [rbp + 0x1f], rax
lea rdi, [rax + 0x400]
mov qword [rbp + 0x2f], rdi
movdqa xmm0, xmmword [0x1801396a0]
lea ecx, [rbx + 8]
nop word [rax + rax]
movups xmmword [rax], xmm0
movups xmmword [rax + 0x10], xmm0
movups xmmword [rax + 0x20], xmm0
movups xmmword [rax + 0x30], xmm0
movups xmmword [rax + 0x40], xmm0
movups xmmword [rax + 0x50], xmm0
movups xmmword [rax + 0x60], xmm0
lea rax, [rax + 0x80]
movups xmmword [rax - 0x10], xmm0
sub rcx, 1
jne 0x18001a840
mov qword [rbp + 0x27], rdi
mov edx, ebx
lea r8, [rbp - 0x39]
nop word [rax + rax]
movdqa xmm0, xmmword [0x1801386a0]
movdqa xmmword [rbp - 0x39], xmm0
movdqa xmm1, xmmword [0x180139450]
movdqa xmmword [rbp - 0x29], xmm1
movdqa xmm0, xmmword [0x180138650]
movdqa xmmword [rbp - 0x19], xmm0
movdqa xmm1, xmmword [0x180137200]
movdqa xmmword [rbp - 9], xmm1
mov word [rbp + 7], 0x100
mov rax, rbx
nop dword [rax]
lea ecx, [rax - 3]
xor byte [rbp + rax - 0x39], cl
inc rax
cmp rax, 0x40
jb 0x18001a8c0
mov byte [rbp + 8], 0
movsx rcx, byte [r8]
mov rax, qword [rbp + 0x1f]
mov dword [rax + rcx*4], edx
inc edx
inc r8
cmp edx, 0x40
jl 0x18001a880
mov edi, 0xfffffff8
mov rcx, r15
cmp qword [r15 + 0x18], 0x10
jb 0x18001a900
mov rcx, qword [r15]
mov rdx, rcx
jmp 0x18001a903
mov rdx, r15
mov r14, rcx
mov r15, qword [r15 + 0x10]
add r15, rdx
cmp rcx, r15
mov rcx, qword [rbp + 0x1f]
je 0x18001a989
nop word [rax + rax]
movzx eax, byte [r14]
mov edx, dword [rcx + rax*4]
cmp edx, 0xffffffff
je 0x18001a989
shl ebx, 6
add ebx, edx
add edi, 6
js 0x18001a981
mov edx, ebx
mov ecx, edi
sar edx, cl
mov rcx, qword [rsi + 0x10]
mov r8, qword [rsi + 0x18]
cmp rcx, r8
jae 0x18001a967
lea rax, [rcx + 1]
mov qword [rsi + 0x10], rax
mov rax, rsi
cmp r8, 0x10
jb 0x18001a95d
mov rax, qword [rsi]
mov byte [rax + rcx], dl
mov byte [rax + rcx + 1], 0
jmp 0x18001a97a
movzx r9d, dl
xor r8d, r8d
lea edx, [r8 + 1]
mov rcx, rsi
call fcn.18004d7d0
sub edi, 8
mov rcx, qword [rbp + 0x1f]
inc r14
cmp r14, r15
jne 0x18001a920
test rcx, rcx
je 0x18001a9c6
mov rdx, qword [rbp + 0x2f]
sub rdx, rcx
and rdx, 0xfffffffffffffffc
mov rax, rcx
cmp rdx, 0x1000
jb 0x18001a9c1
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x18001a9c1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.180112f50
mov rax, rsi
mov rcx, qword [rbp + 0x37]
xor rcx, rsp
call fcn.1801127f0
lea r11, [rsp + 0xb0]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
Function at 0x18001cf00
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0xb], 0
je 0x18001cf23
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 3]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0xa
jb 0x18001cf10
mov byte [rcx + 0xb], 0
mov rax, rcx
ret

Function at 0x18001cf30
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0xc], 0
je 0x18001cf53
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 3]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0xb
jb 0x18001cf40
mov byte [rcx + 0xc], 0
mov rax, rcx
ret

Function at 0x18001cf60
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0x10], 0
je 0x18001cf83
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 3]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0xf
jb 0x18001cf70
mov byte [rcx + 0x10], 0
mov rax, rcx
ret

Function at 0x18001cf90
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 9], 0
je 0x18001cfb3
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 3]
xor byte [rax + rcx], dl
inc rax
cmp rax, 8
jb 0x18001cfa0
mov byte [rcx + 9], 0
mov rax, rcx
ret
Function at 0x18001dea0
Capabilities:
Encode data using xor

Disassembly:
cmp byte [rcx + 0xd], 0
je 0x18001dec3
xor eax, eax
nop dword [rax + rax]
lea edx, [rax - 3]
xor byte [rax + rcx], dl
inc rax
cmp rax, 0xc
jb 0x18001deb0
mov byte [rcx + 0xd], 0
mov rax, rcx
ret

Function at 0x18001e0a0
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x50
mov r9, r8
mov rbx, rdx
mov rdi, rcx
mov qword [rsp + 0x40], rcx
xor esi, esi
cmp byte [r8 + 9], sil
je 0x18001e0d4
mov eax, esi
lea ecx, [rax - 3]
xor byte [r8 + rax], cl
inc rax
cmp rax, 8
jb 0x18001e0c0
mov byte [r8 + 9], sil
lea rax, [r8 + 8]
mov qword [rsp + 0x20], rsi
movdqa xmm0, xmmword [0x180136dd0]
movdqu xmmword [rsp + 0x30], xmm0
mov byte [rsp + 0x20], sil
cmp r9, rax
je 0x18001e109
mov r8d, 8
mov rdx, r9
lea rcx, [rsp + 0x20]
call fcn.180040990
nop
mov r9, qword [rbx + 0x10]
cmp qword [rbx + 0x18], 0x10
jb 0x18001e117
mov rbx, qword [rbx]
mov r8, rbx
xor edx, edx
lea rcx, [rsp + 0x20]
call fcn.1800519b0
mov qword [rdi], rsi
mov qword [rdi + 0x10], rsi
mov qword [rdi + 0x18], rsi
movups xmm0, xmmword [rax]
movups xmmword [rdi], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rdi + 0x10], xmm1
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
lea rcx, [rsp + 0x20]
call fcn.180040890
mov rax, rdi
add rsp, 0x50
pop rdi
pop rsi
pop rbx
ret

Function at 0x18001e170
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x30
mov rbx, rdx
xor r8d, r8d
mov rdx, rcx
mov qword [rsp + 0x20], rbx
cmp byte [rcx + 9], r8b
je 0x18001e1a3
mov ecx, r8d
nop dword [rax]
lea eax, [rcx - 3]
xor byte [rdx + rcx], al
inc rcx
cmp rcx, 8
jb 0x18001e190
mov byte [rdx + 9], r8b
lea rcx, [rdx + 8]
mov qword [rbx], r8
mov qword [rbx + 0x10], r8
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], r8b
cmp rdx, rcx
je 0x18001e1cc
mov r8d, 8
mov rcx, rbx
call fcn.180040990
mov rax, rbx
add rsp, 0x30
pop rbx
ret

Function at 0x18001e1e0
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x50
mov r9, r8
mov rbx, rdx
mov rdi, rcx
mov qword [rsp + 0x40], rcx
xor esi, esi
cmp byte [r8 + 0xa], sil
je 0x18001e214
mov eax, esi
lea ecx, [rax - 3]
xor byte [r8 + rax], cl
inc rax
cmp rax, 9
jb 0x18001e200
mov byte [r8 + 0xa], sil
lea rax, [r8 + 9]
mov qword [rsp + 0x20], rsi
movdqa xmm0, xmmword [0x180136dd0]
movdqu xmmword [rsp + 0x30], xmm0
mov byte [rsp + 0x20], sil
cmp r9, rax
je 0x18001e249
mov r8d, 9
mov rdx, r9
lea rcx, [rsp + 0x20]
call fcn.180040990
nop
mov r9, qword [rbx + 0x10]
cmp qword [rbx + 0x18], 0x10
jb 0x18001e257
mov rbx, qword [rbx]
mov r8, rbx
xor edx, edx
lea rcx, [rsp + 0x20]
call fcn.1800519b0
mov qword [rdi], rsi
mov qword [rdi + 0x10], rsi
mov qword [rdi + 0x18], rsi
movups xmm0, xmmword [rax]
movups xmmword [rdi], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rdi + 0x10], xmm1
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
lea rcx, [rsp + 0x20]
call fcn.180040890
mov rax, rdi
add rsp, 0x50
pop rdi
pop rsi
pop rbx
ret
Function at 0x18001e2b0
Capabilities:
Encode data using xor

Disassembly:
push rbx
sub rsp, 0x30
mov rbx, rdx
xor r8d, r8d
mov rdx, rcx
mov qword [rsp + 0x20], rbx
cmp byte [rcx + 0xa], r8b
je 0x18001e2e3
mov ecx, r8d
nop dword [rax]
lea eax, [rcx - 3]
xor byte [rdx + rcx], al
inc rcx
cmp rcx, 9
jb 0x18001e2d0
mov byte [rdx + 0xa], r8b
lea rcx, [rdx + 9]
mov qword [rbx], r8
mov qword [rbx + 0x10], r8
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], r8b
cmp rdx, rcx
je 0x18001e30c
mov r8d, 9
mov rcx, rbx
call fcn.180040990
mov rax, rbx
add rsp, 0x30
pop rbx
ret