joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1801415f0
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r12
push r14
push r15
mov rbx, rcx
lea rbp, [r8 + 0xe]
sub rbx, r8
lea r12, [0x1803efaf0]
mov r15, r9
mov rsi, rdx
mov r11, rcx
movzx eax, byte [r11 + 0xf]
mov rdi, rbp
movzx ecx, byte [rbp + 1]
mov r14d, 0xf
xor rcx, rax
mov rax, rcx
and rcx, 0xfffffffffffffff0
and eax, 0xf
lea rdx, [rcx + rsi]
add rax, rax
mov r10, qword [rsi + rax*8 + 8]
mov r8, qword [rsi + rax*8]
mov rcx, r10
and ecx, 0xf
shr r10, 4
mov rax, r8
shl r8, 0x3c
shr rax, 4
or r10, r8
xor rax, qword [r12 + rcx*8]
xor rax, qword [rdx]
xor r10, qword [rdx + 8]
nop word [rax + rax]
movzx ecx, byte [rdi]
mov r9, rax
movzx r8d, byte [rdi + rbx]
lea rdi, [rdi - 1]
xor r8, rcx
shl rax, 0x3c
mov rcx, r10
shr r9, 4
shr r10, 4
and ecx, 0xf
or rax, r10
mov rdx, r8
and edx, 0xf
and r8, 0xfffffffffffffff0
add rdx, rdx
xor r9, qword [r12 + rcx*8]
xor rax, qword [rsi + rdx*8 + 8]
xor r9, qword [rsi + rdx*8]
mov rcx, rax
mov rdx, rax
and ecx, 0xf
shr rdx, 4
mov rax, r9
shr rax, 4
mov r10, r9
shl r10, 0x3c
xor rax, qword [r12 + rcx*8]
or r10, rdx
xor rax, qword [r8 + rsi]
xor r10, qword [r8 + rsi + 8]
sub r14, 1
jne 0x180141150
mov rdx, rax
mov byte [r11 + 7], al
shr rdx, 0x20
add rbp, 0x10
mov ecx, edx
mov byte [r11 + 3], dl
shr ecx, 0x18
sub rbx, 0x10
mov byte [r11], cl
mov ecx, edx
shr ecx, 0x10
mov byte [r11 + 1], cl
mov ecx, edx
shr ecx, 8
mov byte [r11 + 2], cl
mov ecx, eax
shr ecx, 0x18
mov byte [r11 + 4], cl
mov ecx, eax
shr ecx, 0x10
mov byte [r11 + 5], cl
mov ecx, eax
shr ecx, 8
mov byte [r11 + 6], cl
mov rcx, r10
shr rcx, 0x20
mov eax, ecx
mov byte [r11 + 0xb], cl
shr eax, 0x18
mov byte [r11 + 8], al
mov eax, ecx
shr eax, 0x10
mov byte [r11 + 9], al
mov eax, ecx
shr eax, 8
mov byte [r11 + 0xa], al
mov eax, r10d
shr eax, 0x18
mov byte [r11 + 0xc], al
mov eax, r10d
shr eax, 0x10
mov byte [r11 + 0xd], al
mov eax, r10d
shr eax, 8
mov byte [r11 + 0xe], al
mov byte [r11 + 0xf], r10b
sub r15, 0x10
jne 0x1801410f4
mov rbx, qword [rsp + 0x20]
mov rbp, qword [rsp + 0x28]
mov rsi, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x38]
pop r15
pop r14
pop r12
ret
mov eax, 0x28
call fcn.1803146e0
sub rsp, rax
add rsp, 0x28
jmp 0x1801410c0
Function at 0x1801419b0
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov eax, 0x78
call fcn.1803146e0
sub rsp, rax
mov rax, qword [0x18050b500]
xor rax, rsp
mov qword [rsp + 0x60], rax
movzx edi, byte [rcx]
mov rbp, r9
mov r10, qword [rsp + 0xe0]
mov r13, r9
mov r9, qword [rcx + 0x30]
mov r15, r8
mov rax, qword [rcx + 0x28]
mov r14, rdx
mov qword [rsp + 0x38], r9
mov rbx, rcx
mov qword [rsp + 0x40], r10
mov byte [rsp + 0x30], dil
mov qword [rsp + 0x48], rax
test dil, 0x40
jne 0x180141a28
lea rdx, [rcx + 0x10]
mov r8, r9
call rax
mov r9, qword [rsp + 0x38]
mov r10, qword [rsp + 0x40]
mov r12d, 0xf
xor esi, esi
mov r8d, edi
mov eax, r12d
and r8d, 7
mov ecx, esi
sub eax, r8d
mov dword [rsp + 0x40], r8d
mov byte [rbx], r8b
cmp eax, r12d
jae 0x180141a68
mov edx, eax
add rdx, rbx
movzx eax, byte [rdx]
mov byte [rdx], sil
lea rdx, [rdx + 1]
or rcx, rax
shl rcx, 8
sub r8, 1
jne 0x180141a51
movzx eax, byte [rbx + 0xf]
or rcx, rax
mov byte [rbx + 0xf], 1
cmp rcx, rbp
je 0x180141a82
mov eax, 0xffffffff
jmp 0x180141bad
mov rdi, rbp
shr rdi, 4
test rdi, rdi
je 0x180141b03
lea rax, [rbx + 0x10]
mov r8, rdi
mov qword [rsp + 0x28], rax
mov rdx, r15
mov rcx, r14
mov qword [rsp + 0x20], rbx
call r10
shl rdi, 4
add r14, rdi
add r15, rdi
sub rbp, rdi
je 0x180141b59
shr rdi, 4
lea r8, [rbx + 0x10]
mov r9, 0xfffffffffffffff8
mov rdx, rsi
sub r9, rbx
movzx eax, byte [r8 - 1]
lea r8, [r8 - 1]
add rdx, rax
movzx ecx, dil
add rdx, rcx
shr rdi, 8
mov byte [r8], dl
lea rax, [r9 + r8]
shr rdx, 8
test rax, rax
je 0x180141b08
test rdi, rdi
jne 0x180141ad0
test rdx, rdx
jne 0x180141ad0
jmp 0x180141b08
test r13, r13
je 0x180141b59
mov rdi, qword [rsp + 0x38]
lea rdx, [rsp + 0x50]
mov r13, qword [rsp + 0x48]
mov r8, rdi
mov rcx, rbx
call r13
test rbp, rbp
je 0x180141b4a
mov rcx, rsi
nop dword [rax + rax]
movzx eax, byte [rcx + r14]
inc esi
xor al, byte [rsp + rcx + 0x50]
mov byte [rcx + r15], al
xor byte [rcx + rbx + 0x10], al
mov ecx, esi
cmp rcx, rbp
jb 0x180141b30
lea rcx, [rbx + 0x10]
mov r8, rdi
mov rdx, rcx
call r13
jmp 0x180141b63
mov r13, qword [rsp + 0x48]
mov rdi, qword [rsp + 0x38]
sub r12d, dword [rsp + 0x40]
cmp r12d, 0x10
jae 0x180141b84
mov r8d, 0x10
mov ecx, r12d
sub r8d, r12d
add rcx, rbx
xor edx, edx
call fcn.1803bc5c0
mov r8, rdi
lea rdx, [rsp + 0x50]
mov rcx, rbx
call r13
mov rax, qword [rsp + 0x50]
xor qword [rbx + 0x10], rax
mov rax, qword [rsp + 0x58]
xor qword [rbx + 0x18], rax
movzx eax, byte [rsp + 0x30]
mov byte [rbx], al
xor eax, eax
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.180313c00
add rsp, 0x78
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x180143a40
Capabilities:
Encode data using xor

Disassembly:
test r8, r8
je 0x180143ba9
mov eax, 8
call fcn.1803146e0
sub rsp, rax
xor r10d, r10d
mov r11, rcx
cmp r8, rax
jb 0x180143b7d
lea rcx, [r9 - 1]
lea rax, [rdx - 1]
add rcx, r8
add rax, r8
cmp r9, rax
ja 0x180143a81
cmp rcx, rdx
jae 0x180143b7d
lea rax, [r8 - 1]
add rax, r11
cmp r9, rax
ja 0x180143a96
cmp rcx, r11
jae 0x180143b7d
mov rcx, r11
mov qword [rsp + 0x10], rbx
sub rcx, rdx
mov qword [rsp], rdi
cmp r8, 0x40
jb 0x180143b37
mov rbx, r8
mov qword [rsp + 0x18], rsi
and ebx, 0x3f
mov rdi, r8
sub rdi, rbx
mov rsi, r9
lea rax, [rdx + 0x10]
sub rsi, rdx
nop word [rax + rax]
movdqu xmm0, xmmword [rax - 0x10]
add r10, 0x40
movdqu xmm1, xmmword [rcx + rax - 0x10]
movdqu xmm2, xmmword [rcx + rax]
lea rax, [rax + 0x40]
xorps xmm1, xmm0
movdqu xmm0, xmmword [rax - 0x40]
movdqu xmmword [rsi + rax - 0x50], xmm1
xorps xmm2, xmm0
movdqu xmm0, xmmword [rcx + rax - 0x30]
movdqu xmm1, xmmword [rax - 0x30]
movdqu xmmword [rsi + rax - 0x40], xmm2
xorps xmm1, xmm0
movdqu xmm0, xmmword [rcx + rax - 0x20]
movdqu xmm2, xmmword [rax - 0x20]
movdqu xmmword [rsi + rax - 0x30], xmm1
xorps xmm2, xmm0
movdqu xmmword [rsi + rax - 0x20], xmm2
cmp r10, rdi
jb 0x180143ad0
mov rsi, qword [rsp + 0x18]
cmp rbx, 8
jb 0x180143b6f
mov rbx, r8
and rbx, 0xfffffffffffffff8
mov rdi, r9
lea rax, [r10 + rdx]
sub rdi, rdx
nop dword [rax + rax]
movq xmm1, qword [rax + rcx]
add r10, 8
movq xmm0, qword [rax]
lea rax, [rax + 8]
xorps xmm1, xmm0
movq qword [rdi + rax - 8], xmm1
cmp r10, rbx
jb 0x180143b50
mov rdi, qword [rsp]
mov rbx, qword [rsp + 0x10]
cmp r10, r8
jae 0x180143ba5
sub r11, rdx
lea rax, [r10 + rdx]
sub r9, rdx
sub r8, r10
nop word [rax + rax]
movzx ecx, byte [rax + r11]
xor cl, byte [rax]
mov byte [r9 + rax], cl
lea rax, [rax + 1]
sub r8, 1
jne 0x180143b90
add rsp, 8
ret
Function at 0x180143c90
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rdi
push r14
mov eax, 0x20
call fcn.1803146e0
sub rsp, rax
mov rdi, qword [rcx + 0x28]
mov rbx, rdx
mov rbp, rcx
cmp rdx, rdi
ja 0x180143cce
shl rbx, 4
add rbx, qword [rcx + 0x58]
mov rax, rbx
mov rbx, qword [rsp + 0x58]
add rsp, 0x20
pop r14
pop rdi
pop rbp
ret
mov rcx, qword [rcx + 0x30]
cmp rbx, rcx
jb 0x180143d1a
sub rdx, rcx
lea r8, [0x1803efb80]
add rdx, 4
mov r9d, 0x71
and rdx, 0xfffffffffffffffc
add rdx, rcx
mov rcx, qword [rbp + 0x58]
mov qword [rbp + 0x30], rdx
shl rdx, 4
call fcn.18012d660
test rax, rax
jne 0x180143d16
mov rbx, qword [rsp + 0x58]
add rsp, 0x20
pop r14
pop rdi
pop rbp
ret
mov qword [rbp + 0x58], rax
mov qword [rsp + 0x40], rsi
mov qword [rsp + 0x48], r12
mov r12, rbx
mov qword [rsp + 0x50], r15
mov r15, rdi
shl r15, 4
sub r12, rdi
nop word [rax + rax]
mov rcx, qword [rbp + 0x58]
mov edx, 1
add rcx, r15
movzx edi, byte [rcx]
lea rsi, [rcx + 0x10]
shr dil, 7
mov r8, rsi
neg dil
and dil, 0x87
call fcn.180143890
xor byte [rsi + 0xf], dil
add r15, 0x10
sub r12, 1
jne 0x180143d40
mov r15, qword [rsp + 0x50]
mov r12, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x40]
mov qword [rbp + 0x28], rbx
shl rbx, 4
add rbx, qword [rbp + 0x58]
mov rax, rbx
mov rbx, qword [rsp + 0x58]
add rsp, 0x20
pop r14
pop rdi
pop rbp
ret

Function at 0x1801445d0
Capabilities:
Set thread local storage value

Disassembly:
mov eax, 0x28
call fcn.1803146e0
sub rsp, rax
mov ecx, dword [rcx]
call qword [sym.imp.kernel32.dll_TlsSetValue]
xor ecx, ecx
test eax, eax
setne cl
mov eax, ecx
add rsp, 0x28
ret
Function at 0x1801447c0
Capabilities:
Allocate thread local storage

Disassembly:
push rbx
push rdi
push r13
mov eax, 0x30
call fcn.1803146e0
sub rsp, rax
mov eax, dword [0x1805126e4]
mov r13d, ecx
mov ebx, 1
cmp eax, 2
je 0x180144833
nop word [rax + rax]
xor eax, eax
lock cmpxchg dword [0x1805126e4], ebx
je 0x18014480d
cmp eax, ebx
je 0x1801447f0
mov eax, dword [0x1805126e4]
cmp eax, 2
jne 0x180144851
jmp 0x180144833
call qword [sym.imp.kernel32.dll_TlsAlloc]
lea r8, [0x1801446e0]
xor edx, edx
xor ecx, ecx
mov dword [0x1805126e0], eax
call fcn.18014c9d0
mov dword [0x1805126e4], 2
mov r8d, 0x97
lea rdx, [0x1803efbf0]
lea ecx, [r8 - 0x3f]
call fcn.18012d8c0
mov rdi, rax
test rax, rax
jne 0x18014485c
xor eax, eax
add rsp, 0x30
pop r13
pop rdi
pop rbx
ret
mov qword [rsp + 0x50], rbp
mov qword [rsp + 0x58], rsi
mov qword [rsp + 0x60], r12
mov qword [rsp + 0x28], r14
mov qword [rsp + 0x20], r15
call fcn.180174da0
mov qword [rdi + 0x30], rax
call fcn.1801749a0
mov qword [rdi + 0x40], rax
call fcn.1801749a0
mov qword [rdi + 0x50], rax
call fcn.180174da0
mov qword [rdi + 0x38], rax
call fcn.180174da0
cmp r13d, ebx
mov qword [rdi + 0x48], rax
mov r8d, 0x85
lea rdx, [0x1803efbf0]
cmovge ebx, r13d
inc ebx
movsxd rbx, ebx
lea rcx, [rbx*8]
call fcn.18012d8c0
mov qword [rdi + 0x18], rbx
mov qword [rdi + 0x10], rax
test rax, rax
je 0x1801448f8
cmp qword [rdi + 0x40], 0
je 0x1801448f8
cmp qword [rdi + 0x50], 0
je 0x1801448f8
cmp qword [rdi + 0x30], 0
je 0x1801448f8
cmp qword [rdi + 0x38], 0
je 0x1801448f8
cmp qword [rdi + 0x48], 0
jne 0x180144951
mov r8d, 0xa8
lea rdx, [0x1803efbf0]
mov rcx, rax
call fcn.18012d630
lea rcx, [rdi + 0x40]
call fcn.180174900
lea rcx, [rdi + 0x50]
call fcn.180174900
lea rcx, [rdi + 0x38]
call fcn.180174d30
lea rcx, [rdi + 0x48]
call fcn.180174d30
lea rcx, [rdi + 0x30]
call fcn.180174d30
mov r8d, 0xae
lea rdx, [0x1803efbf0]
mov rcx, rdi
call fcn.18012d630
xor edi, edi
mov r15, qword [rsp + 0x20]
mov rax, rdi
mov r14, qword [rsp + 0x28]
mov r12, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x50]
add rsp, 0x30
pop r13
pop rdi
pop rbx
ret
Function at 0x180144980
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push r14
mov eax, 0x20
call fcn.1803146e0
sub rsp, rax
mov rbx, rcx
lea esi, [rax - 0x21]
call qword [sym.imp.kernel32.dll_GetLastError]
mov ecx, dword [0x1805126e0]
mov edi, eax
call qword [sym.imp.kernel32.dll_TlsGetValue]
mov ecx, edi
mov r14, rax
call qword [sym.imp.kernel32.dll_SetLastError]
test r14, r14
jne 0x180144a0e
mov r8d, 0xdd
lea rdx, [0x1803efbf0]
lea ecx, [r8 + 0x13]
call fcn.18012d8c0
mov r14, rax
test rax, rax
jne 0x1801449ff
mov r8d, 0xde
lea rdx, [0x1803efbf0]
lea rcx, [0x1803efc08]
call fcn.18012d920
mov ecx, dword [0x1805126e0]
mov rdx, r14
call qword [sym.imp.kernel32.dll_TlsSetValue]
xor ecx, ecx
mov rax, r14
cmp qword [rax], 0
jne 0x180144a1f
cmp esi, 0xffffffff
cmove esi, ecx
cmp qword [rax + 0x10], rbx
je 0x180144ae3
inc ecx
add rax, 0x18
cmp ecx, 0xa
jl 0x180144a13
prefetchw byte [rbx + 0x24]
mov eax, dword [rbx + 0x24]
nop dword [rax + rax]
mov ecx, eax
lock cmpxchg dword [rbx + 0x24], ecx
jne 0x180144a40
mov rcx, qword [rbx + 0x10]
mov r8d, eax
lea rdx, [r8*8]
lock inc qword [rdx + rcx]
prefetchw byte [rbx + 0x24]
mov eax, dword [rbx + 0x24]
mov ecx, eax
lock cmpxchg dword [rbx + 0x24], ecx
jne 0x180144a64
cmp r8d, eax
je 0x180144ac2
nop dword [rax]
nop word [rax + rax]
mov rax, qword [rbx + 0x10]
lock dec qword [rdx + rax]
prefetchw byte [rbx + 0x24]
mov eax, dword [rbx + 0x24]
mov ecx, eax
lock cmpxchg dword [rbx + 0x24], ecx
jne 0x180144a90
mov r8d, eax
mov rax, qword [rbx + 0x10]
lea rdx, [r8*8]
lock inc qword [rdx + rax]
prefetchw byte [rbx + 0x24]
mov eax, dword [rbx + 0x24]
mov ecx, eax
lock cmpxchg dword [rbx + 0x24], ecx
jne 0x180144ab4
cmp r8d, eax
jne 0x180144a80
movsxd rax, esi
lea rcx, [rax + rax*2]
mov rax, qword [rbx + 0x10]
lea rdx, [r14 + rcx*8]
mov dword [rdx + 8], 1
mov qword [rdx + 0x10], rbx
lea rcx, [rax + r8*8]
mov qword [rdx], rcx
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x40]
add rsp, 0x20
pop r14
ret

Function at 0x180144b00
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
push rdi
mov eax, 0x20
call fcn.1803146e0
sub rsp, rax
mov rdi, rcx
call qword [sym.imp.kernel32.dll_GetLastError]
mov ecx, dword [0x1805126e0]
mov ebx, eax
call qword [sym.imp.kernel32.dll_TlsGetValue]
mov ecx, ebx
mov rsi, rax
call qword [sym.imp.kernel32.dll_SetLastError]
xor r9d, r9d
lea rdx, [rsi + 0x10]
xor r8d, r8d
cmp qword [rdx], rdi
je 0x180144b69
inc r9d
inc r8
add rdx, 0x18
cmp r8, 0xa
jl 0x180144b44
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
movsxd rax, r9d
lea rcx, [rax + rax*2]
add dword [rsi + rcx*8 + 8], 0xffffffff
lea rbx, [rsi + rcx*8]
jne 0x180144bb8
mov rax, qword [rbx]
mov rcx, 0xffffffffffffffff
lock xadd qword [rax], rcx
cmp rcx, 1
jns 0x180144ba9
mov r8d, 0x10b
lea rdx, [0x1803efbf0]
lea rcx, [0x1803efc28]
call fcn.18012d920
mov qword [rbx], 0
mov qword [rbx + 0x10], 0
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x1801459e0
Capabilities:
Initialize winsock library

Disassembly:
mov eax, 0x28
call fcn.1803146e0
sub rsp, rax
cmp dword [0x1805126f0], 0
jne 0x180145a9a
xor edx, edx
mov dword [0x1805126f0], 1
mov r8d, 0x198
lea rcx, [0x180512700]
call fcn.1803bc5c0
mov ecx, 0x202
lea rdx, [0x180512700]
call qword [sym.imp.ws2_32.dll_WSAStartup]
test eax, eax
je 0x180145a9a
call fcn.180132860
lea r8, [0x1803efcc0]
mov edx, 0x96
lea rcx, [0x1803efca8]
call fcn.180132980
call qword [sym.imp.ws2_32.dll_WSAGetLastError]
lea r8, [0x1803efcd0]
mov ecx, 2
mov edx, eax
call fcn.180132ae0
call fcn.180132860
lea r8, [0x1803efcc0]
mov edx, 0x98
lea rcx, [0x1803efca8]
call fcn.180132980
xor r8d, r8d
lea edx, [r8 + 0x7a]
lea ecx, [rdx - 0x5a]
call fcn.180132ae0
mov eax, 0xffffffff
add rsp, 0x28
ret
mov eax, 1
add rsp, 0x28
ret

Function at 0x180145ab0
Capabilities:
Set socket configuration

Disassembly:
push rbx
mov eax, 0x20
call fcn.1803146e0
sub rsp, rax
mov dword [rsp + 0x30], edx
lea r8, [rsp + 0x30]
mov edx, 0x8004667e
movsxd rcx, ecx
call qword [sym.imp.ws2_32.dll_ioctlsocket]
mov ebx, eax
test eax, eax
jns 0x180145b12
call fcn.180132860
lea r8, [0x1803efce8]
mov edx, 0xf4
lea rcx, [0x1803efca8]
call fcn.180132980
call qword [sym.imp.ws2_32.dll_WSAGetLastError]
lea r8, [0x1803efd00]
mov ecx, 2
mov edx, eax
call fcn.180132ae0
xor eax, eax
test ebx, ebx
sete al
add rsp, 0x20
pop rbx
ret

Function at 0x180145b20
Capabilities:
Get socket status

Disassembly:
push rbx
push rsi
push rdi
mov eax, 0x260
call fcn.1803146e0
sub rsp, rax
mov rax, qword [0x18050b500]
xor rax, rsp
mov qword [rsp + 0x250], rax
mov edi, ecx
mov rbx, r8
mov esi, edx
cmp ecx, 0xffffffff
jne 0x180145b53
mov eax, ecx
jmp 0x180145bb3
test rbx, rbx
jne 0x180145b5d
lea eax, [rbx + 1]
jmp 0x180145bb3
xor ecx, ecx
call fcn.180328c04
mov rcx, rax
cmp rbx, rax
jge 0x180145b70
xor eax, eax
jmp 0x180145bb3
xor eax, eax
mov qword [rsp + 0x48], rdi
sub ebx, ecx
mov dword [rsp + 0x34], eax
test esi, esi
mov dword [rsp + 0x40], 1
lea r8, [rsp + 0x40]
mov dword [rsp + 0x30], ebx
cmovne r8, rax
lea rdx, [rsp + 0x40]
cmove rdx, rax
lea ecx, [rdi + 1]
lea rax, [rsp + 0x30]
xor r9d, r9d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ws2_32.dll_select]
mov rcx, qword [rsp + 0x250]
xor rcx, rsp
call fcn.180313c00
add rsp, 0x260
pop rdi
pop rsi
pop rbx
ret
Function at 0x180147f00
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
mov eax, 0x280
call fcn.1803146e0
sub rsp, rax
mov rax, qword [0x18050b500]
xor rax, rsp
mov qword [rsp + 0x270], rax
cmp dword [0x1805129d8], 0
lea rax, [0x180147880]
mov qword [rsp + 0x28], rax
lea rbx, [0x1803f03d8]
lea rax, [0x1803f03e8]
movzx ebp, cx
mov qword [rsp + 0x30], rax
lea rax, [0x180147cc0]
mov qword [rsp + 0x38], rax
lea rax, [0x1803f03f8]
mov qword [rsp + 0x40], rax
lea rax, [0x180147820]
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x20], rbx
jne 0x1801480d9
mov edx, 0x104
lea rcx, [rsp + 0x160]
call qword [sym.imp.kernel32.dll_GetSystemDirectoryA]
test eax, eax
je 0x1801480cf
lea r8, [rsp + 0x160]
mov qword [rsp + 0x290], rsi
mov edx, 0x10c
lea rcx, [rsp + 0x50]
call fcn.18032a3dc
lea r8, [0x1803f0408]
mov edx, 0x10c
lea rcx, [rsp + 0x50]
call fcn.180330938
lea rcx, [rsp + 0x50]
call qword [sym.imp.kernel32.dll_LoadLibraryA]
mov rsi, rax
test rax, rax
je 0x180147ffa
mov rdx, rbx
mov rcx, rax
call qword [sym.imp.kernel32.dll_GetProcAddress]
test rax, rax
jne 0x18014805a
mov rcx, rsi
call qword [sym.imp.kernel32.dll_FreeLibrary]
lea r8, [rsp + 0x160]
mov edx, 0x10c
lea rcx, [rsp + 0x50]
call fcn.18032a3dc
lea r8, [0x1803f0410]
mov edx, 0x10c
lea rcx, [rsp + 0x50]
call fcn.180330938
lea rcx, [rsp + 0x50]
call qword [sym.imp.kernel32.dll_LoadLibraryA]
mov rsi, rax
test rax, rax
je 0x1801480c7
mov rdx, rbx
mov rcx, rax
call qword [sym.imp.kernel32.dll_GetProcAddress]
test rax, rax
jne 0x18014805a
mov rcx, rsi
call qword [sym.imp.kernel32.dll_FreeLibrary]
jmp 0x1801480c7
mov qword [rsp + 0x298], rdi
lea rbx, [rsp + 0x28]
xor edi, edi
nop dword [rax]
mov rdx, qword [rbx - 8]
mov rcx, rsi
call qword [sym.imp.kernel32.dll_GetProcAddress]
mov qword [rbx], rax
test rax, rax
je 0x1801480b6
inc edi
add rbx, 0x10
cmp edi, 3
jl 0x180148070
mov rax, qword [rsp + 0x28]
mov qword [0x1805086e0], rax
mov rax, qword [rsp + 0x38]
mov qword [0x1805086f0], rax
mov rax, qword [rsp + 0x48]
mov qword [0x180508700], rax
jmp 0x1801480bf
mov rcx, rsi
call qword [sym.imp.kernel32.dll_FreeLibrary]
mov rdi, qword [rsp + 0x298]
mov rsi, qword [rsp + 0x290]
mov dword [0x1805129d8], 1
mov rax, rbp
lea rcx, [0x1805086d8]
add rax, rax
mov rax, qword [rcx + rax*8 + 8]
mov rcx, qword [rsp + 0x270]
xor rcx, rsp
call fcn.180313c00
mov rbx, qword [rsp + 0x2a0]
add rsp, 0x280
pop rbp
ret
Function at 0x180148110
Capabilities:
Resolve dns

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
mov eax, 0x870
call fcn.1803146e0
sub rsp, rax
mov rax, qword [0x18050b500]
xor rax, rsp
mov qword [rsp + 0x860], rax
mov r13, qword [rsp + 0x8c8]
mov r14, rcx
mov dword [rsp + 0x24], r8d
xor ebp, ebp
mov dword [rsp + 0x28], edx
mov r8d, 0x400
mov qword [rsp + 0x38], rcx
xor edx, edx
lea rcx, [rsp + 0x41]
mov byte [rsp + 0x40], bpl
mov r12d, ebp
mov word [rsp + 0x20], r9w
call fcn.1803bc5c0
xor edx, edx
mov byte [rsp + 0x450], bpl
mov r8d, 0x400
lea rcx, [rsp + 0x451]
call fcn.1803bc5c0
mov r9d, 0x400
lea rbx, [rsp + 0x40]
mov r8, r14
mov qword [rsp + 0x30], rbx
lea rcx, [rsp + 0x40]
lea rdi, [rsp + 0x450]
lea edx, [r9 + 1]
call fcn.1803309a4
lea r15, [rbp - 1]
nop dword [rax]
mov rcx, r14
mov qword [r13], rbp
mov rsi, r13
mov byte [rdi], bpl
call qword [sym.imp.ws2_32.dll_gethostbyname]
mov r14, rax
test rax, rax
je 0x18014831e
cmp word [rax + 0x10], 2
jne 0x180148247
cmp word [rax + 0x12], 4
jne 0x180148247
mov rbx, qword [rax + 0x18]
mov rax, qword [rbx]
test rax, rax
je 0x180148242
nop dword [rax]
mov r9d, dword [rax]
movzx r8d, word [rsp + 0x20]
mov edx, dword [rsp + 0x24]
mov ecx, dword [rsp + 0x28]
call fcn.180148380
mov qword [rsi], rax
test rax, rax
je 0x180148317
add rbx, 8
lea rsi, [rax + 0x28]
mov rax, qword [rbx]
test rax, rax
jne 0x180148210
mov rbx, qword [rsp + 0x30]
mov r8, qword [r14]
mov r9d, 0x400
mov rcx, rdi
lea edx, [r9 + 1]
call fcn.1803309a4
cmp qword [r13], rbp
jne 0x1801482c0
mov rax, r15
inc rax
cmp byte [rdi + rax], bpl
jne 0x180148265
test rax, rax
je 0x180148338
mov r8, rdi
mov rax, rbx
sub r8, rbx
movzx edx, byte [rax]
movzx ecx, byte [rax + r8]
sub edx, ecx
jne 0x180148293
inc rax
test ecx, ecx
jne 0x180148280
test edx, edx
je 0x180148338
inc r12d
cmp r12d, 0x10
je 0x180148338
mov r14, qword [rsp + 0x38]
mov rax, rbx
mov rbx, rdi
mov rdi, rax
mov qword [rsp + 0x30], rbx
jmp 0x1801481d0
cmp dword [rsp + 0x8c0], ebp
je 0x18014834b
nop dword [rax]
cmp byte [rdi + r15 + 1], bpl
lea r15, [r15 + 1]
jne 0x1801482d0
lea rdx, [r15 + 1]
mov ecx, 1
call fcn.18031b148
mov rbx, rax
test rax, rax
jne 0x1801482f6
mov rbx, rbp
jmp 0x180148305
mov r8, rdi
lea rdx, [r15 + 1]
mov rcx, rax
call fcn.18032a3dc
mov rax, qword [r13]
mov qword [rax + 0x18], rbx
mov rax, qword [r13]
cmp qword [rax + 0x18], rbp
jne 0x18014834b
mov ebp, 8
jmp 0x18014834b
call qword [sym.imp.ws2_32.dll_WSAGetLastError]
mov ecx, eax
sub ecx, 0x2af9
je 0x180148346
sub ecx, 1
je 0x18014833f
sub ecx, 1
jne 0x180148346
mov ebp, 0x2afb
jmp 0x18014834b
mov ebp, 0x2afa
jmp 0x18014834b
mov ebp, 0x2af9
mov eax, ebp
mov rcx, qword [rsp + 0x860]
xor rcx, rsp
call fcn.180313c00
lea r11, [rsp + 0x870]
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x18014c010
Capabilities:
Generate random numbers via winapi

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r14
mov eax, 0x30
call fcn.1803146e0
sub rsp, rax
lea edx, [rax - 0x2f]
mov rbx, rcx
call fcn.18014bbe0
mov rdx, rax
mov rcx, rbx
mov rbp, rax
call fcn.18014bac0
xor edi, edi
mov r14, rax
test rax, rax
je 0x18014c0b7
lea r9d, [rdi + 1]
mov dword [rsp + 0x20], 0xf0000040
xor r8d, r8d
lea rcx, [rsp + 0x58]
xor edx, edx
mov esi, edi
call qword [sym.imp.advapi32.dll_CryptAcquireContextW]
test eax, eax
je 0x18014c093
mov rcx, qword [rsp + 0x58]
mov r8, r14
mov edx, ebp
call qword [sym.imp.advapi32.dll_CryptGenRandom]
mov rcx, qword [rsp + 0x58]
test eax, eax
cmovne rsi, rbp
xor edx, edx
call qword [sym.imp.advapi32.dll_CryptReleaseContext]
lea r8, [rsi*8]
mov rdx, rsi
mov rcx, rbx
call fcn.18014bb70
mov rcx, rbx
call fcn.18014bd30
test rax, rax
jne 0x18014c14b
mov edx, 1
mov rcx, rbx
call fcn.18014bbe0
mov rdx, rax
mov rcx, rbx
mov rsi, rax
call fcn.18014bac0
mov rbp, rax
test rax, rax
je 0x18014c143
mov r9d, 0x16
mov dword [rsp + 0x20], 0xf0000040
lea r8, [0x1803f0720]
xor edx, edx
lea rcx, [rsp + 0x58]
call qword [sym.imp.advapi32.dll_CryptAcquireContextW]
test eax, eax
je 0x18014c123
mov rcx, qword [rsp + 0x58]
mov r8, rbp
mov edx, esi
call qword [sym.imp.advapi32.dll_CryptGenRandom]
mov rcx, qword [rsp + 0x58]
test eax, eax
cmovne rdi, rsi
xor edx, edx
call qword [sym.imp.advapi32.dll_CryptReleaseContext]
lea r8, [rdi*8]
mov rdx, rdi
mov rcx, rbx
call fcn.18014bb70
mov rcx, rbx
call fcn.18014bd30
test rax, rax
jne 0x18014c14b
mov rcx, rbx
call fcn.18014bd30
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x60]
add rsp, 0x30
pop r14
pop rdi
pop rsi
ret

Function at 0x180151690
Capabilities:
Encode data using base64

Disassembly:
mov eax, 0x28
call fcn.1803146e0
sub rsp, rax
mov r9d, r8d
mov r8, rdx
mov rdx, rcx
xor ecx, ecx
add rsp, 0x28
jmp fcn.180151a40