joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180010ab0
Capabilities:
Create thread

Disassembly:
sub rsp, 0x58
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov rax, qword [0x180067008]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov rax, qword [0x180068f90]
test rax, rax
jne 0x180010b4c
lea ecx, [rax + 0x40]
call fcn.180033e94
mov qword [rsp + 0x38], rax
xor ecx, ecx
mov qword [rax], rcx
mov qword [rax + 8], rcx
mov qword [rax + 0x10], rcx
mov qword [rax + 0x18], rcx
mov qword [rax + 0x20], rcx
mov qword [rax + 0x28], rcx
mov qword [rax + 0x30], rcx
mov qword [rax + 0x38], rcx
mov rcx, rax
call fcn.180010b60
nop
mov qword [0x180068f90], rax
xor edx, edx
mov dword [rsp + 0x40], edx
lea rcx, [rsp + 0x40]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], edx
mov r9, rax
lea r8, [0x1800130e0]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rax, qword [0x180068f90]
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.180033e70
add rsp, 0x58
ret
Function at 0x18001c520
Capabilities:
Encode data using xor

Disassembly:
mov rax, rsp
push rbp
mov rbp, rsp
sub rsp, 0x70
mov qword [rbp - 0x28], 0xfffffffffffffffe
mov qword [rax + 0x18], rbx
mov qword [rax + 0x20], rdi
mov rax, qword [0x180067008]
xor rax, rsp
mov qword [rbp - 0x10], rax
mov rdi, rdx
mov rbx, rcx
xor r8d, r8d
mov dword [rbp - 0x50], r8d
mov dword [rbp - 0x20], 0x5a3f5c3f
mov dword [rbp - 0x1c], 0x71055a29
mov dword [rbp - 0x18], 0x7e10751e
mov byte [rbp - 0x14], 0x7e
lea r9, [rbp - 0x15]
lea r10d, [r8 + 2]
nop word [rax + rax]
movzx ecx, byte [r9]
xor byte [r9 + 1], cl
movzx eax, byte [r9 - 1]
xor al, cl
mov byte [r9], al
movzx eax, byte [r9 - 2]
xor byte [r9 - 1], al
movzx eax, byte [r9 - 3]
xor byte [r9 - 2], al
movzx eax, byte [r9 - 4]
xor byte [r9 - 3], al
movzx eax, byte [r9 - 5]
xor byte [r9 - 4], al
lea r9, [r9 - 6]
sub r10, 1
jne 0x18001c580
xor byte [rbp - 0x20], 0x5e
mov qword [rbp - 0x30], reloc.WS2_32.dll_ntohs
mov qword [rbp - 0x38], r8
mov byte [rbp - 0x48], r8b
je 0x18001c5ea
lea rax, [rbp - 0x20]
or r8, 0xffffffffffffffff
nop
inc r8
cmp byte [rax + r8], 0
jne 0x18001c5e0
lea rdx, [rbp - 0x20]
lea rcx, [rbp - 0x48]
call fcn.1800020b0
nop
lea r8, [rbp - 0x48]
mov rdx, rdi
mov rcx, rbx
call fcn.18001d2b0
nop
mov rax, qword [rbp - 0x30]
cmp rax, 0x10
jb 0x18001c65e
inc rax
mov rcx, qword [rbp - 0x48]
cmp rax, 0x1000
jb 0x18001c659
test cl, 0x1f
je 0x18001c62c
call fcn.18003835c
int3
mov rax, qword [rcx - 8]
cmp rax, rcx
jb 0x18001c63b
call fcn.18003835c
int3
sub rcx, rax
cmp rcx, 8
jae 0x18001c64a
call fcn.18003835c
int3
cmp rcx, 0x27
jbe 0x18001c656
call fcn.18003835c
int3
mov rcx, rax
call fcn.180033ed0
mov rax, rbx
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.180033e70
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret
Function at 0x18001d170
Capabilities:
Encode data using xor

Disassembly:
push rdi
sub rsp, 0x60
mov qword [rsp + 0x48], 0xfffffffffffffffe
mov qword [rsp + 0x80], rbx
mov rax, qword [0x180067008]
xor rax, rsp
mov qword [rsp + 0x58], rax
mov rdi, rdx
mov rbx, rcx
xor r8d, r8d
mov dword [rsp + 0x20], r8d
movzx eax, word [0x18005900c]
mov word [rsp + 0x50], ax
movzx eax, byte [0x18005900e]
mov byte [rsp + 0x52], al
mov edx, 1
lea rcx, [rdx - 1]
movzx eax, byte [rsp + rcx + 0x50]
xor byte [rsp + rdx + 0x50], al
mov rdx, rcx
test rcx, rcx
jg 0x18001d1c0
xor byte [rsp + 0x50], 0xa6
mov qword [rsp + 0x40], reloc.WS2_32.dll_ntohs
mov qword [rsp + 0x38], r8
mov byte [rsp + 0x28], r8b
je 0x18001d20a
lea rax, [rsp + 0x50]
or r8, 0xffffffffffffffff
nop dword [rax + rax]
inc r8
cmp byte [rax + r8], 0
jne 0x18001d200
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x28]
call fcn.1800020b0
nop
lea r8, [rsp + 0x28]
mov rdx, rdi
mov rcx, rbx
call fcn.18001d2b0
nop
mov rax, qword [rsp + 0x40]
cmp rax, 0x10
jb 0x18001d283
inc rax
mov rcx, qword [rsp + 0x28]
cmp rax, 0x1000
jb 0x18001d27e
test cl, 0x1f
je 0x18001d251
call fcn.18003835c
int3
mov rax, qword [rcx - 8]
cmp rax, rcx
jb 0x18001d260
call fcn.18003835c
int3
sub rcx, rax
cmp rcx, 8
jae 0x18001d26f
call fcn.18003835c
int3
cmp rcx, 0x27
jbe 0x18001d27b
call fcn.18003835c
int3
mov rcx, rax
call fcn.180033ed0
mov rax, rbx
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.180033e70
mov rbx, qword [rsp + 0x80]
add rsp, 0x60
pop rdi
ret
Function at 0x1800283e0
Capabilities:
Create thread
Initialize winsock library

Disassembly:
mov rax, rsp
push rdi
sub rsp, 0x220
mov qword [rsp + 0x50], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov rax, qword [0x180067008]
xor rax, rsp
mov qword [rsp + 0x210], rax
mov rbx, rcx
mov ecx, 0x202
lea rdx, [rsp + 0x60]
call qword [sym.imp.WS2_32.dll_WSAStartup]
xor esi, esi
mov dword [rbx + 0x10], esi
mov rcx, qword [rbx]
cmp rcx, 0xffffffffffffffff
je 0x180028435
call qword [sym.imp.IPHLPAPI.DLL_IcmpCloseHandle]
mov rcx, rbx
call fcn.180028110
mov dword [rsp + 0x204], 0x302e30
mov dword [rsp + 0x200], 0x2e302e30
mov qword [rsp + 0x48], reloc.WS2_32.dll_ntohs
mov qword [rsp + 0x40], rsi
mov byte [rsp + 0x30], sil
lea rax, [rsp + 0x200]
or r8, 0xffffffffffffffff
inc r8
cmp byte [rax + r8], sil
jne 0x180028472
lea rdx, [rsp + 0x200]
lea rcx, [rsp + 0x30]
call fcn.1800020b0
nop
mov r9, rbx
lea rdx, [rsp + 0x30]
mov rcx, rbx
call fcn.180027d60
test eax, eax
sete dil
mov rax, qword [rsp + 0x48]
cmp rax, 0x10
jb 0x1800284fc
inc rax
mov rcx, qword [rsp + 0x30]
cmp rax, 0x1000
jb 0x1800284f7
test cl, 0x1f
je 0x1800284ca
call fcn.18003835c
int3
mov rax, qword [rcx - 8]
cmp rax, rcx
jb 0x1800284d9
call fcn.18003835c
int3
sub rcx, rax
cmp rcx, 8
jae 0x1800284e8
call fcn.18003835c
int3
cmp rcx, 0x27
jbe 0x1800284f4
call fcn.18003835c
int3
mov rcx, rax
call fcn.180033ed0
test dil, dil
je 0x180028505
xor eax, eax
jmp 0x180028539
mov dword [rsp + 0x58], esi
lea rax, [rsp + 0x58]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], esi
mov r9, rbx
lea r8, [0x180028560]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
mov rcx, qword [rsp + 0x210]
xor rcx, rsp
call fcn.180033e70
lea r11, [rsp + 0x220]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
Function at 0x18002d9c0
Capabilities:
Create thread

Disassembly:
push rbp
push rsi
push rdi
sub rsp, 0x70
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov qword [rsp + 0xa0], rbx
mov rax, qword [0x180067008]
xor rax, rsp
mov qword [rsp + 0x60], rax
movsxd rbp, edx
mov rsi, rcx
mov edx, ebp
lea rcx, [rsp + 0x40]
call fcn.18002d820
nop
lea eax, [rbp + 0xb]
movsxd rbx, eax
mov rcx, rbx
call fcn.180033ee0
mov rdi, rax
mov r8, rbx
xor edx, edx
mov rcx, rax
call fcn.180037440
lea rdx, [rsp + 0x40]
cmp qword [rsp + 0x58], 0x10
cmovae rdx, qword [rsp + 0x40]
mov r8, qword [rsp + 0x50]
mov rcx, rdi
call fcn.180035250
mov r8, rbp
lea rcx, [rdi + 0xa]
mov rdx, rsi
call fcn.180035250
lea eax, [rbp + 0xa]
movsxd rcx, eax
mov byte [rcx + rdi], 0
xor ecx, ecx
mov dword [rsp + 0x38], ecx
lea rax, [rsp + 0x38]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], ecx
mov r9, rdi
lea r8, [0x18002d840]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateThread]
nop
mov rax, qword [rsp + 0x58]
cmp rax, 0x10
jb 0x18002dacf
inc rax
mov rcx, qword [rsp + 0x40]
cmp rax, 0x1000
jb 0x18002daca
test cl, 0x1f
je 0x18002da9d
call fcn.18003835c
int3
mov rax, qword [rcx - 8]
cmp rax, rcx
jb 0x18002daac
call fcn.18003835c
int3
sub rcx, rax
cmp rcx, 8
jae 0x18002dabb
call fcn.18003835c
int3
cmp rcx, 0x27
jbe 0x18002dac7
call fcn.18003835c
int3
mov rcx, rax
call fcn.180033ed0
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.180033e70
mov rbx, qword [rsp + 0xa0]
add rsp, 0x70
pop rdi
pop rsi
pop rbp
ret

Function at 0x18002dc70
Capabilities:
Create thread

Disassembly:
sub rsp, 0x48
mov rax, qword [0x180067008]
xor rax, rsp
mov qword [rsp + 0x38], rax
sub edx, 1
je 0x18002dc9e
cmp edx, 5
jne 0x18002dccb
test r8, r8
je 0x18002dccb
mov rax, qword [0x180068fb8]
mov qword [r8], rax
jmp 0x18002dccb
xor edx, edx
mov qword [0x180068fb8], rcx
lea rax, [rsp + 0x30]
mov dword [rsp + 0x30], edx
mov qword [rsp + 0x28], rax
lea r8, [0x18002daf0]
xor r9d, r9d
mov dword [rsp + 0x20], edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov eax, 1
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.180033e70
add rsp, 0x48
ret
Function at 0x180030650
Capabilities:
Resolve dns

Disassembly:
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r12
push r14
push r15
sub rsp, 0x20
mov rdi, qword [rsp + 0x68]
movzx ebp, r9w
mov r12, qword [rsp + 0x60]
mov r14d, r8d
mov r15d, edx
mov qword [rdi], 0
mov byte [r12], 0
call qword [sym.imp.WS2_32.dll_gethostbyname]
mov rsi, rax
test rax, rax
je 0x180030728
cmp word [rax + 0x10], 2
mov qword [rsp + 0x40], rbx
jne 0x1800306eb
cmp word [rax + 0x12], 4
jne 0x1800306eb
mov rbx, qword [rax + 0x18]
mov rcx, qword [rbx]
test rcx, rcx
je 0x1800306eb
nop word [rax + rax]
mov r9d, dword [rcx]
movzx r8d, bp
mov ecx, r15d
mov edx, r14d
call fcn.1800305b0
mov qword [rdi], rax
test rax, rax
je 0x180030721
mov rcx, qword [rbx + 8]
lea rdi, [rax + 0x28]
add rbx, 8
test rcx, rcx
jne 0x1800306c0
mov r8, qword [rsi]
mov r9d, 0x400
mov rcx, r12
lea edx, [r9 + 1]
call fcn.18003c190
xor eax, eax
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x20
pop r15
pop r14
pop r12
ret
mov eax, 8
jmp 0x180030702
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
sub eax, 0x2af9
je 0x180030742
sub eax, 1
je 0x180030750
sub eax, 1
je 0x180030749
cmp eax, 1
mov eax, 0x2af9
jmp 0x180030707
mov eax, 0x2afb
jmp 0x180030707
mov eax, 0x2afa
jmp 0x180030707
Function at 0x180030fd0
Capabilities:
Get common file path

Disassembly:
push rbx
sub rsp, 0x280
mov rax, qword [0x180067008]
xor rax, rsp
mov qword [rsp + 0x270], rax
cmp dword [0x1800692d0], 0
lea rax, [0x180030a60]
mov qword [rsp + 0x28], rax
lea rbx, str.getaddrinfo
lea rax, str.getnameinfo
mov qword [rsp + 0x20], rbx
mov qword [rsp + 0x30], rax
lea rax, [0x180030d70]
mov qword [rsp + 0x38], rax
lea rax, [0x180059ef8]
mov qword [rsp + 0x40], rax
lea rax, [fcn.180030a10]
mov qword [rsp + 0x48], rax
jne 0x180031199
mov edx, 0x104
lea rcx, [rsp + 0x160]
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
test eax, eax
je 0x18003118f
lea r8, [rsp + 0x160]
mov qword [rsp + 0x290], rsi
mov edx, 0x10c
lea rcx, [rsp + 0x50]
call fcn.18003bf18
lea r8, str.ws2_32
mov edx, 0x10c
lea rcx, [rsp + 0x50]
call fcn.18003c360
lea rcx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rsi, rax
test rax, rax
je 0x1800310bd
mov rdx, rbx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
jne 0x18003111d
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
lea r8, [rsp + 0x160]
mov edx, 0x10c
lea rcx, [rsp + 0x50]
call fcn.18003bf18
lea r8, str.wship6
mov edx, 0x10c
lea rcx, [rsp + 0x50]
call fcn.18003c360
lea rcx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rsi, rax
test rax, rax
je 0x180031187
mov rdx, rbx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
jne 0x18003111d
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
jmp 0x180031187
mov qword [rsp + 0x298], rdi
lea rbx, [rsp + 0x28]
xor edi, edi
nop dword [rax]
mov rdx, qword [rbx - 8]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rbx], rax
test rax, rax
je 0x180031176
inc edi
add rbx, 0x10
cmp edi, 3
jl 0x180031130
mov rax, qword [rsp + 0x28]
mov qword [0x180067a18], rax
mov rax, qword [rsp + 0x38]
mov qword [0x180067a28], rax
mov rax, qword [rsp + 0x48]
mov qword [fcn.180030a10], rax
jmp 0x18003117f
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov rdi, qword [rsp + 0x298]
mov rsi, qword [rsp + 0x290]
mov dword [0x1800692d0], 1
mov rax, qword [0x180067a18]
mov rcx, qword [rsp + 0x270]
xor rcx, rsp
call fcn.180033e70
add rsp, 0x280
pop rbx
ret
Function at 0x180031410
Capabilities:
Convert ip address from string
Initialize winsock library
Receive data
Receive data on socket

Disassembly:
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
lea rbp, [rsp - 0x130]
sub rsp, 0x230
mov rax, qword [0x180067008]
xor rax, rsp
mov qword [rbp + 0x120], rax
xor esi, esi
mov rdi, rdx
xor eax, eax
mov dword [rsp + 0x50], esi
lea rdx, [rbp - 0x80]
mov qword [rsp + 0x58], rax
mov ecx, 0x202
mov dword [rsp + 0x64], esi
mov dword [rsp + 0x60], esi
call qword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
je 0x18003146e
or eax, 0xffffffff
jmp 0x180031640
call fcn.180031280
cmp eax, 0xffffffff
jne 0x18003147f
xor eax, eax
jmp 0x180031640
movzx ecx, word [0x1800690d0]
xor r9d, r9d
mov r8d, dword [0x180068fc8]
mov dword [rsp + 0x28], 1
mov qword [rsp + 0x240], rbx
lea edx, [r9 + 3]
mov dword [rsp + 0x20], esi
call qword [sym.imp.WS2_32.dll_WSASocketW]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x180031553
xor eax, eax
lea r8, [rsp + 0x6c]
mov ecx, 2
mov qword [rsp + 0x6a], rax
mov rdx, rdi
mov dword [rsp + 0x72], eax
mov word [rsp + 0x76], ax
mov word [rsp + 0x68], cx
call qword [sym.imp.WS2_32.dll_inet_pton]
mov eax, 0x22b8
lea rdx, [rsp + 0x68]
mov r8d, reloc.WS2_32.dll_recv
mov word [rsp + 0x6a], ax
mov rcx, rbx
call qword [sym.imp.WS2_32.dll_bind]
mov rcx, rbx
cmp eax, 0xffffffff
je 0x180031547
mov edx, dword [0x180067a04]
lea rax, [rsp + 0x64]
mov qword [rsp + 0x40], rsi
lea r8, [0x180067a08]
mov qword [rsp + 0x38], rsi
mov r9d, 4
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], esi
mov qword [rsp + 0x20], rsi
call qword [sym.imp.WS2_32.dll_WSAIoctl]
cmp eax, 0xffffffff
jne 0x18003155b
mov rcx, rbx
call qword [sym.imp.WS2_32.dll_closesocket]
call qword [sym.imp.WS2_32.dll_WSACleanup]
or eax, 0xffffffff
jmp 0x180031638
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
xor edx, edx
mov r8d, 0xffff
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rdi, rax
mov rcx, rbx
test rax, rax
je 0x180031547
mov qword [rsp + 0x58], rax
lea r9, [rsp + 0x64]
lea rax, [rsp + 0x60]
mov qword [rsp + 0x30], rsi
mov qword [rsp + 0x28], rsi
lea rdx, [rsp + 0x50]
mov r8d, 1
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x50], 0xffff
mov dword [rsp + 0x60], esi
call qword [sym.imp.WS2_32.dll_WSARecv]
cmp eax, 0xffffffff
je 0x180031613
nop dword [rax]
mov edx, dword [rsp + 0x64]
mov rcx, rdi
call fcn.180030270
test eax, eax
jne 0x180031613
mov qword [rsp + 0x30], rsi
lea rax, [rsp + 0x60]
mov qword [rsp + 0x28], rsi
lea r9, [rsp + 0x64]
mov r8d, 1
mov qword [rsp + 0x20], rax
lea rdx, [rsp + 0x50]
mov dword [rsp + 0x50], 0xffff
mov rcx, rbx
mov qword [rsp + 0x58], rdi
mov dword [rsp + 0x60], esi
call qword [sym.imp.WS2_32.dll_WSARecv]
cmp eax, 0xffffffff
jne 0x1800315c0
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8, rdi
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rcx, rbx
call qword [sym.imp.WS2_32.dll_closesocket]
call qword [sym.imp.WS2_32.dll_WSACleanup]
xor eax, eax
mov rbx, qword [rsp + 0x240]
mov rcx, qword [rbp + 0x120]
xor rcx, rsp
call fcn.180033e70
lea r11, [rsp + 0x230]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret
Function at 0x1800333b0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x80
mov rax, qword [0x180067008]
xor rax, rsp
mov qword [rsp + 0x78], rax
mov rdi, rcx
xor ebx, ebx
xor ecx, ecx
mov dword [rsp + 0x20], ebx
call fcn.18003bec0
movdqa xmm0, xmmword [0x18005a140]
mov ecx, select
mov qword [rsp + 0x28], rax
xor eax, eax
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], rax
mov qword [rsp + 0x70], rax
movdqu xmmword [rsp + 0x30], xmm0
mov word [rsp + 0x40], 0x2020
nop dword [rax + rax]
movzx eax, byte [rsp + rcx + 0x2f]
xor byte [rsp + rcx + 0x30], al
dec rcx
test rcx, rcx
jg 0x180033420
xor byte [rsp + 0x30], 6
lea rcx, [rsp + 0x28]
call fcn.18003c8b8
mov r9, rax
lea r8, [rsp + 0x30]
mov edx, gethostbyname
lea rcx, [rsp + 0x48]
call fcn.18003c580
mov qword [rdi + 0x18], reloc.WS2_32.dll_ntohs
mov qword [rdi + 0x10], rbx
mov byte [rdi], bl
cmp byte [rsp + 0x48], bl
je 0x18003347d
lea rax, [rsp + 0x48]
or rbx, 0xffffffffffffffff
inc rbx
cmp byte [rax + rbx], 0
jne 0x180033474
mov r8, rbx
lea rdx, [rsp + 0x48]
mov rcx, rdi
call fcn.1800020b0
mov rax, rdi
mov rcx, qword [rsp + 0x78]
xor rcx, rsp
call fcn.180033e70
mov rbx, qword [rsp + 0x98]
add rsp, 0x80
pop rdi
ret
Function at 0x1800334b0
Capabilities:
Enumerate processes

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r14
push r15
sub rsp, 0x290
mov rax, qword [0x180067008]
xor rax, rsp
mov qword [rsp + 0x280], rax
mov r14, rcx
xor esi, esi
xor edx, edx
lea ecx, [rsi + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rbp, rax
cmp rax, 0xffffffffffffffff
je 0x18003361e
lea rdx, [rsp + 0x40]
mov dword [rsp + 0x40], 0x238
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x180033615
movabs r15, 0x7fffffffffffffff
mov qword [rsp + 0x38], 7
mov qword [rsp + 0x30], rsi
mov word [rsp + 0x20], si
cmp word [rsp + 0x6c], si
jne 0x180033541
mov r8, rsi
jmp 0x18003355a
lea rax, [rsp + 0x6c]
or r8, 0xffffffffffffffff
nop word [rax + rax]
inc r8
cmp word [rax + r8*2], si
jne 0x180033550
lea rdx, [rsp + 0x6c]
lea rcx, [rsp + 0x20]
call fcn.180005ff0
cmp qword [r14 + 0x18], 8
jb 0x180033575
mov r8, qword [r14]
jmp 0x180033578
mov r8, r14
mov rdi, qword [rsp + 0x38]
lea rcx, [rsp + 0x20]
mov rbx, qword [rsp + 0x20]
cmp rdi, 8
mov r9, qword [r14 + 0x10]
mov rdx, qword [rsp + 0x30]
cmovae rcx, rbx
call fcn.18002f8f0
test eax, eax
je 0x180033607
cmp rdi, 8
jb 0x1800335ef
lea rax, [rdi + 1]
cmp rax, r15
ja 0x180033665
add rax, rax
cmp rax, 0x1000
jb 0x1800335e7
test bl, 0x1f
jne 0x18003365f
mov rax, qword [rbx - 8]
cmp rax, rbx
jae 0x180033659
sub rbx, rax
cmp rbx, 8
jb 0x180033653
cmp rbx, 0x27
ja 0x18003364d
mov rbx, rax
mov rcx, rbx
call fcn.180033ed0
lea rdx, [rsp + 0x40]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x180033522
jmp 0x180033615
mov esi, dword [rsp + 0x48]
lea rcx, [rsp + 0x20]
call fcn.180005ed0
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, esi
mov rcx, qword [rsp + 0x280]
xor rcx, rsp
call fcn.180033e70
lea r11, [rsp + 0x290]
mov rbx, qword [r11 + 0x28]
mov rbp, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rdi
ret
call fcn.18003835c
int3
call fcn.18003835c
int3
call fcn.18003835c
int3
call fcn.18003835c
int3
call fcn.18003835c
int3
Function at 0x180033a00
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push rbx
sub rsp, 0x20
mov eax, dword [rcx]
mov r9d, 0x270
mov rbx, rcx
cmp eax, r9d
jne 0x180033a5b
lea r8, [rcx + 8]
nop word [rax + rax]
mov edx, dword [r8 - 4]
xor edx, dword [r8]
lea r8, [r8 + 4]
btr edx, 0x1f
xor edx, dword [r8 - 8]
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r8 + 0x62c]
xor ecx, edx
mov dword [r8 + 0x9b8], ecx
sub r9, 1
jne 0x180033a20
jmp 0x180033a67
cmp eax, 0x4e0
jb 0x180033a67
call fcn.180033ab0
mov eax, dword [rbx]
mov edx, dword [rbx + rax*4 + 4]
inc eax
mov dword [rbx], eax
mov ecx, edx
mov eax, dword [rbx + 0x1384]
shr ecx, 0xb
and eax, ecx
xor edx, eax
mov eax, edx
and eax, 0xff3a58ad
shl eax, 7
xor edx, eax
mov eax, edx
and eax, 0xffffdf8c
shl eax, 0xf
xor edx, eax
mov eax, edx
shr eax, 0x12
xor eax, edx
add rsp, 0x20
pop rbx
ret

Function at 0x180033ab0
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
mov r10, rcx
lea r9, [rcx + 0x9c4]
mov r11d, 0xe3
mov edx, dword [r9]
xor edx, dword [r9 + 4]
lea r9, [r9 + 4]
btr edx, 0x1f
xor edx, dword [r9 - 4]
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r9 + 0x630]
xor ecx, edx
mov dword [r9 - 0x9c4], ecx
sub r11, 1
jne 0x180033ac0
lea r9, [r10 + 0xd50]
mov r11d, 0x18c
nop word [rax + rax]
mov edx, dword [r9]
xor edx, dword [r9 + 4]
lea r9, [r9 + 4]
btr edx, 0x1f
xor edx, dword [r9 - 4]
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r9 - 0xd50]
xor ecx, edx
mov dword [r9 - 0x9c4], ecx
sub r11, 1
jne 0x180033b10
mov edx, dword [r10 + 0x1380]
xor edx, dword [r10 + 4]
btr edx, 0x1f
xor edx, dword [r10 + 0x1380]
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r10 + 0x634]
xor ecx, edx
mov dword [r10 + 0x9c0], ecx
mov dword [r10], r11d
ret
Function at 0x140003cc0
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x28
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140003d0a
mov ecx, 0x5a4d
cmp word [rax], cx
jne 0x140003d0a
movsxd rcx, dword [rax + 0x3c]
add rcx, rax
cmp dword [rcx], 0x4550
jne 0x140003d0a
mov eax, 0x20b
cmp word [rcx + 0x18], ax
jne 0x140003d0a
cmp dword [rcx + 0x84], 0xe
jbe 0x140003d0a
cmp dword [rcx + 0xf8], 0
setne al
jmp 0x140003d0c
xor al, al
add rsp, 0x28
ret
Function at 0x141ed5058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.141ed51df
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x141ed5089
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x141ed506f
add dl, dl
jne 0x141ed5096
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x141ed50f6
xor eax, eax
add dl, dl
jne 0x141ed50a5
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x141ed51ad
add dl, dl
jne 0x141ed50b6
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x141ed50c3
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x141ed50d0
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x141ed50dd
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x141ed50ea
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x141ed507e
mov eax, 1
add dl, dl
jne 0x141ed5106
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x141ed5113
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x141ed50fb
sub eax, ebx
mov ebx, 1
jne 0x141ed514c
mov ecx, 1
add dl, dl
jne 0x141ed512e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x141ed513b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x141ed5123
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x141ed507e
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x141ed5168
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x141ed5175
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x141ed515d
cmp eax, 0x7d00
jae 0x141ed519b
cmp eax, 0x500
jb 0x141ed5196
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x141ed507e
cmp eax, 0x7f
ja 0x141ed519e
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x141ed507e
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x141ed51d2
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x141ed507e
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20