joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180160570
Capabilities:
Get disk information

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
mov eax, 0x1060
call fcn.18011e9f0
sub rsp, rax
mov rax, qword [0x18065f280]
xor rax, rsp
mov qword [rsp + 0x1050], rax
mov r14, rcx
xor edx, edx
mov r8d, 0x1000
lea rcx, [rsp + 0x50]
call fcn.18037f450
lea rdx, [rsp + 0x50]
mov ecx, 0x800
call qword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsW]
lea rbx, [rsp + 0x50]
xor r15d, r15d
mov esi, r15d
mov qword [rsp + 0x30], r15
mov ebp, r15d
mov qword [rsp + 0x38], r15
mov edi, r15d
lea r12, [0x180660030]
cmp word [rsp + 0x50], r15w
je 0x180160671
nop word [rax + rax]
mov rdx, rbx
lea rcx, [rsp + 0x28]
call fcn.18001d210
lea ecx, [rdi + 1]
cmp ecx, ebp
jle 0x18016063e
mov eax, ecx
test ecx, ecx
jns 0x18016061d
lea eax, [rcx + 1]
sar eax, 1
lea edx, [rax + 8]
add edx, ecx
and edx, 0xfffffff8
lea rcx, [rsp + 0x30]
call fcn.18000c670
mov edi, dword [rsp + 0x3c]
mov ebp, dword [rsp + 0x38]
mov rsi, qword [rsp + 0x30]
movsxd rax, edi
lea edi, [rax + 1]
mov dword [rsp + 0x3c], edi
lea rcx, [rsi + rax*8]
mov rax, qword [rsp + 0x28]
mov qword [rcx], rax
mov qword [rsp + 0x28], r12
nop dword [rax]
movzx eax, word [rbx]
add rbx, 2
test ax, ax
jne 0x180160660
cmp word [rbx], ax
jne 0x180160600
movsxd r8, edi
lea rdx, [rsi + r8*8]
movzx r9d, byte [rsp + 0x20]
mov rcx, rsi
call fcn.180020d30
test edi, edi
jle 0x18016072b
mov ecx, dword [0x18067a7b8]
mov rax, qword gs:[0x58]
lea rbx, [rax + rcx*8]
mov r13d, 4
lea rbp, [0x180660908]
cmp r15d, edi
jae 0x1801606b8
mov rdx, rsi
jmp 0x1801606cf
mov rax, qword [rbx]
mov ecx, dword [r13 + rax]
cmp dword [0x1806c7008], ecx
jg 0x180160770
mov rdx, rbp
lea rcx, [rsp + 0x28]
call fcn.18018e080
mov eax, dword [r14 + 0xc]
inc eax
cmp eax, dword [r14 + 8]
jle 0x180160700
mov ecx, eax
test eax, eax
jns 0x1801606ee
lea ecx, [rax + 1]
sar ecx, 1
lea edx, [rax + 8]
add edx, ecx
and edx, 0xfffffff8
mov rcx, r14
call fcn.18000c670
movsxd rcx, dword [r14 + 0xc]
lea eax, [rcx + 1]
mov dword [r14 + 0xc], eax
mov rax, qword [r14]
lea rdx, [rax + rcx*8]
mov rax, qword [rsp + 0x28]
mov qword [rdx], rax
mov qword [rsp + 0x28], r12
inc r15d
add rsi, 8
cmp r15d, edi
jl 0x1801606b1
lea rcx, [rsp + 0x30]
call fcn.180009780
mov rcx, qword [rsp + 0x30]
call fcn.180124068
mov rcx, qword [rsp + 0x1050]
xor rcx, rsp
call fcn.18011d9a0
lea r11, [rsp + 0x1060]
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
lea rcx, [0x1806c7008]
call fcn.18011da70
cmp dword [0x1806c7008], 0xffffffff
jne 0x1801606cc
mov qword [0x180660908], r12
lea rcx, [0x1803993d0]
call fcn.18011de7c
lea rcx, [0x1806c7008]
call fcn.18011da04
jmp 0x1801606cc
Function at 0x180160930
Capabilities:
Get system information on windows
Read file via mapping

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x70
cmp qword [rcx + 8], 0
mov rdi, rdx
mov rbx, rcx
jle 0x180160974
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
mov rcx, qword [rbx + 8]
mov r8d, dword [rsp + 0x68]
mov rax, rcx
cqo
idiv r8
sub rcx, rdx
mov qword [rbx + 8], rcx
cmp qword [rbx + 0x10], rcx
jge 0x180160974
mov qword [rbx + 0x10], rcx
mov rdx, rdi
lea rcx, [rsp + 0x80]
call fcn.180017f90
xor edi, edi
xor r9d, r9d
mov qword [rsp + 0x30], rdi
mov edx, 0x80000000
mov dword [rsp + 0x28], 0x8000080
mov r8d, 5
mov rcx, qword [rax]
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileW]
cmp rax, 0xffffffffffffffff
je 0x180160a26
mov ecx, dword [rbx + 0x10]
xor edx, edx
mov r9, qword [rbx + 0x10]
mov r8d, 2
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], ecx
mov rcx, rax
sar r9, 0x20
mov qword [rbx + 0x18], rax
call qword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov rdi, rax
test rax, rax
je 0x180160a26
mov r9, qword [rbx + 8]
mov edx, 4
mov rcx, qword [rbx + 0x10]
mov r8, r9
sub rcx, r9
sar r8, 0x20
mov qword [rsp + 0x20], rcx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov qword [rbx], rax
test rax, rax
jne 0x180160a1d
xorps xmm0, xmm0
movups xmmword [rbx + 8], xmm0
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rbx, qword [rsp + 0x88]
add rsp, 0x70
pop rdi
ret

Function at 0x180160bd0
Capabilities:
Write file on windows

Disassembly:
push rbx
sub rsp, 0x30
xor eax, eax
mov rbx, rcx
mov rcx, qword [rcx + 0x18]
mov dword [rsp + 0x40], eax
test rcx, rcx
je 0x180160c3e
lea r9, [rsp + 0x40]
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x180160c3e
lea rcx, [rsp + 0x58]
call fcn.1801615b0
mov rcx, qword [rbx + 0x20]
mov rdx, qword [rax]
mov qword [rbx + 0x20], rdx
mov qword [rax], rcx
lea rax, [0x180660020]
mov rcx, qword [rsp + 0x58]
add rcx, 0xfffffffffffffff0
cmp rcx, rax
je 0x180160c3e
mov eax, 0xffffffff
lock xadd dword [rcx], eax
dec eax
cmp eax, 0xffffffff
jne 0x180160c3e
call fcn.18011d9c0
mov eax, dword [rsp + 0x40]
add rsp, 0x30
pop rbx
ret
Function at 0x180161160
Capabilities:
Check if file exists
Delete directory
Delete file
Get file attributes

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
mov rax, qword [rcx]
cmp byte [rax], 0
je 0x1801611f9
mov rdx, rcx
lea rcx, [rsp + 0x30]
call fcn.180017f90
mov rcx, qword [rax]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
nop
cmp eax, 0xffffffff
je 0x1801611f9
mov rdx, rbx
lea rcx, [rsp + 0x30]
call fcn.180017f90
mov rcx, qword [rax]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
nop
test al, 0x10
je 0x1801611d5
cmp eax, 0xffffffff
je 0x1801611d5
mov rdx, rbx
lea rcx, [rsp + 0x30]
call fcn.180017f90
mov rcx, qword [rax]
call qword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
test eax, eax
setne cl
movzx eax, cl
add rsp, 0x20
pop rbx
ret
mov rdx, rbx
lea rcx, [rsp + 0x30]
call fcn.180017f90
mov rcx, qword [rax]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
setne cl
movzx eax, cl
add rsp, 0x20
pop rbx
ret
mov al, 1
add rsp, 0x20
pop rbx
ret

Function at 0x180161220
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x20
mov rbx, rcx
mov rax, qword [rcx]
cmp byte [rax], 0
je 0x18016129e
mov rdx, rcx
lea rcx, [rsp + 0x30]
call fcn.180017f90
mov rcx, qword [rax]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
nop
cmp eax, 0xffffffff
je 0x18016129e
mov rdx, rbx
lea rcx, [rsp + 0x30]
call fcn.180017f90
mov rcx, qword [rax]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov edi, eax
mov edx, 0x40000000
mov rcx, rbx
call fcn.180161410
test al, al
je 0x180161320
cmp edi, 0xffffffff
je 0x180161291
and dil, 0x11
cmp dil, 1
je 0x180161320
mov al, 1
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
mov rdx, rbx
lea rcx, [rsp + 0x30]
call fcn.180017f90
mov rcx, qword [rax]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
nop
test al, 0x10
je 0x1801612be
cmp eax, 0xffffffff
jne 0x180161320
mov edx, 0x5c
mov rcx, qword [rbx]
call fcn.18001c630
test eax, eax
js 0x180161320
lea rdx, [rsp + 0x30]
mov rcx, rbx
call fcn.180190bc0
nop
mov rcx, rax
call fcn.180161220
movzx ebx, al
mov rcx, qword [rsp + 0x30]
add rcx, 0xfffffffffffffff0
lea rax, [0x180660020]
cmp rcx, rax
je 0x180161312
mov edx, 0xffffffff
lock xadd dword [rcx], edx
dec edx
cmp edx, 0xffffffff
jne 0x180161312
call fcn.18011d9c0
movzx eax, bl
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
xor al, al
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret

Function at 0x1801617f0
Capabilities:
Get disk information

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
sub rsp, 0x20
mov rax, qword [rcx]
mov qword [rsp + 0x30], rax
add rax, 0xfffffffffffffff0
lea rdi, [0x180660020]
cmp rax, rdi
je 0x180161815
lock inc dword [rax]
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x38]
call fcn.180161880
nop
mov rdx, rax
lea rcx, [rsp + 0x40]
call fcn.180017f90
mov rcx, qword [rax]
call qword [sym.imp.KERNEL32.dll_GetDriveTypeW]
mov ebx, eax
mov rcx, qword [rsp + 0x38]
add rcx, 0xfffffffffffffff0
cmp rcx, rdi
je 0x180161862
mov edx, 0xffffffff
lock xadd dword [rcx], edx
dec edx
cmp edx, 0xffffffff
jne 0x180161862
call fcn.18011d9c0
mov eax, ebx
mov rbx, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret
Function at 0x180167ac0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rsi
push r12
push r14
sub rsp, 0x20
mov esi, dword [rcx + 0x44]
mov rbx, rcx
mov qword [rsp + 0x40], rdi
xor r12d, r12d
mov qword [rsp + 0x48], r15
nop word [rax + rax]
mov edx, dword [rbx + 0x94]
mov ebp, dword [rbx + 0x58]
sub ebp, dword [rbx + 0x9c]
mov ecx, dword [rbx + 0x44]
sub ebp, edx
add ecx, 0xfffffefa
add ecx, esi
cmp edx, ecx
jb 0x180167ba0
mov rcx, qword [rbx + 0x50]
mov r8, rsi
lea rdx, [rcx + rsi]
call fcn.18037edb0
mov r8d, dword [rbx + 0x74]
mov rax, qword [rbx + 0x68]
sub dword [rbx + 0x98], esi
sub dword [rbx + 0x94], esi
sub dword [rbx + 0x84], esi
lea rdx, [rax + r8*2]
nop dword [rax]
nop word [rax + rax]
movzx ecx, word [rdx - 2]
lea rdx, [rdx - 2]
movzx eax, cx
sub ax, si
cmp ecx, esi
cmovb ax, r12w
mov word [rdx], ax
add r8d, 0xffffffff
jne 0x180167b50
mov rax, qword [rbx + 0x60]
mov r8d, esi
lea rdx, [rax + rsi*2]
nop dword [rax]
movzx ecx, word [rdx - 2]
lea rdx, [rdx - 2]
movzx eax, cx
sub ax, si
cmp ecx, esi
cmovb ax, r12w
mov word [rdx], ax
add r8d, 0xffffffff
jne 0x180167b80
add ebp, esi
mov r14, qword [rbx]
mov ecx, dword [r14 + 8]
test ecx, ecx
je 0x180167c8d
mov r10, qword [rbx + 0x50]
mov r15d, dword [rbx + 0x9c]
mov r9d, dword [rbx + 0x94]
add r15, r10
add r15, r9
cmp ecx, ebp
cmovbe ebp, ecx
test ebp, ebp
jne 0x180167bd5
mov ebp, r12d
jmp 0x180167c3c
mov rax, qword [r14 + 0x28]
sub ecx, ebp
mov dword [r14 + 8], ecx
mov ecx, dword [rax + 0x2c]
cmp ecx, 1
jne 0x180167bf8
mov rdx, qword [r14]
mov r8d, ebp
mov ecx, dword [r14 + 0x4c]
call fcn.1801697f0
jmp 0x180167c16
cmp ecx, 2
jne 0x180167c1a
mov rdx, qword [r14]
test rdx, rdx
jne 0x180167c0a
mov eax, r12d
jmp 0x180167c16
mov ecx, dword [r14 + 0x4c]
mov r8d, ebp
call fcn.180169480
mov dword [r14 + 0x4c], eax
mov rdx, qword [r14]
mov rcx, r15
mov r8d, ebp
mov edi, ebp
call fcn.18037edb0
add qword [r14], rdi
add dword [r14 + 0xc], ebp
mov r9d, dword [rbx + 0x94]
mov r10, qword [rbx + 0x50]
mov r8d, dword [rbx + 0x9c]
add r8d, ebp
mov dword [rbx + 0x9c], r8d
cmp r8d, 3
jb 0x180167c77
mov ecx, dword [rbx + 0x80]
mov eax, r9d
movzx edx, byte [rax + r10]
lea eax, [r9 + 1]
mov dword [rbx + 0x70], edx
movzx eax, byte [rax + r10]
shl edx, cl
xor edx, eax
and edx, dword [rbx + 0x7c]
mov dword [rbx + 0x70], edx
cmp r8d, 0x106
jae 0x180167c8d
mov rax, qword [rbx]
cmp dword [rax + 8], r12d
jne 0x180167af0
mov r15, qword [rsp + 0x48]
mov rdi, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
add rsp, 0x20
pop r14
pop r12
pop rsi
ret
Function at 0x18016a990
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
lea rbp, [rsp - 0x57]
sub rsp, 0xa0
mov rbx, r8
mov rdi, rcx
xor r8d, r8d
lea rcx, [rbp - 0x11]
call fcn.180189530
nop
mov r8d, 0x4000
lea rdx, [rbp - 0x11]
lea rcx, [rbp + 7]
call fcn.18018a3a0
nop
mov rax, qword [rbp + 0x27]
cmp byte [rax], 0
jne 0x18016aac9
mov r8, rbx
lea rdx, [rbp + 7]
mov rcx, rdi
call fcn.18016ab00
lea rsi, [0x180660020]
mov ebx, 0xffffffff
mov r8, qword [rbp + 0x3f]
mov rcx, qword [rbp + 0x1f]
test r8, r8
je 0x18016aa66
xor edi, edi
mov dword [rbp + 0x7f], edi
test rcx, rcx
je 0x18016aa62
mov qword [rsp + 0x20], rdi
lea r9, [rbp + 0x7f]
mov rdx, qword [rbp + 0x47]
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x18016aa5e
lea rcx, [rbp - 0x19]
call fcn.1801615b0
mov rcx, qword [rbp + 0x27]
mov rdx, qword [rax]
mov qword [rbp + 0x27], rdx
mov qword [rax], rcx
mov rcx, qword [rbp - 0x19]
add rcx, 0xfffffffffffffff0
cmp rcx, rsi
je 0x18016aa5e
mov eax, ebx
lock xadd dword [rcx], eax
dec eax
cmp eax, ebx
jne 0x18016aa5e
call fcn.18011d9c0
mov rcx, qword [rbp + 0x1f]
mov qword [rbp + 0x3f], rdi
test rcx, rcx
je 0x18016aaa9
call qword [sym.imp.KERNEL32.dll_FlushFileBuffers]
test eax, eax
jne 0x18016aaa9
lea rcx, [rbp + 0x7f]
call fcn.1801615b0
mov rcx, qword [rbp + 0x27]
mov rdx, qword [rax]
mov qword [rbp + 0x27], rdx
mov qword [rax], rcx
mov rcx, qword [rbp + 0x7f]
add rcx, 0xfffffffffffffff0
cmp rcx, rsi
je 0x18016aaa9
lock xadd dword [rcx], ebx
dec ebx
cmp ebx, 0xffffffff
jne 0x18016aaa9
call fcn.18011d9c0
mov rax, qword [rbp + 0x27]
cmp byte [rax], 0
jne 0x18016aac9
lea rcx, [rbp + 7]
call fcn.18018a2d0
lea rcx, [rbp - 0x11]
call fcn.180189350
movzx ebx, al
jmp 0x18016aad4
lea rcx, [rbp + 7]
call fcn.18018a2d0
xor bl, bl
lea rcx, [rbp - 0x11]
call fcn.180189460
movzx eax, bl
lea r11, [rsp + 0xa0]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret
Function at 0x1801720a0
Capabilities:
Print debug messages

Disassembly:
mov rcx, qword [0x18067b4c0]
test rcx, rcx
je 0x1801720b3
mov rax, qword [rcx]
jmp qword [rax + reloc.WS2_32.dll_htonl]
mov rcx, rdx
jmp fcn.18015e740

Function at 0x180174710
Capabilities:
Terminate thread

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x20
mov edi, edx
mov rbx, rcx
lea rsi, [rcx + 0x60]
mov qword [rsp + 0x40], rsi
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
nop
mov rax, qword [rbx + 0x10]
nop
test rax, rax
je 0x18017480b
mov eax, 1
xchg byte [rbx + 0x1ed], al
lea rcx, [rbx + 0x1f0]
call fcn.180020fc0
lea rcx, [rbx + 0x138]
call fcn.18015c2a0
test edi, edi
je 0x180174776
mov edx, edi
mov rcx, rbx
call fcn.180174830
mov rax, qword [rbx + 0x10]
nop
test rax, rax
je 0x18017480b
lea rdx, str.___killing_thread_by_force___
lea rcx, [rsp + 0x30]
call fcn.18001d070
nop
mov rcx, qword [0x18067b4c0]
test rcx, rcx
je 0x1801747af
mov rax, qword [rcx]
lea rdx, [rsp + 0x30]
call qword [rax + reloc.WS2_32.dll_htonl]
jmp 0x1801747ba
lea rcx, [rsp + 0x30]
call fcn.18015e740
nop
mov rcx, qword [rsp + 0x30]
add rcx, 0xfffffffffffffff0
lea rax, [0x180660020]
cmp rcx, rax
je 0x1801747e4
mov eax, 0xffffffff
lock xadd dword [rcx], eax
dec eax
cmp eax, 0xffffffff
jne 0x1801747e4
call fcn.18011d9c0
mov rax, qword [rbx + 0x10]
nop
test rax, rax
je 0x1801747fb
mov rcx, qword [rbx + 0x10]
nop
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TerminateThread]
xor ecx, ecx
mov eax, ecx
xchg qword [rbx + 0x10], rax
xchg qword [rbx + 0x18], rcx
xor bl, bl
jmp 0x18017480d
mov bl, 1
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
movzx eax, bl
mov rbx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret

Function at 0x180174a70
Capabilities:
Resume thread
Terminate thread

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x30
mov rbx, rcx
lea r8, [0x18015d1a0]
mov esi, edx
xor edi, edi
mov eax, edi
mov r9, rbx
xchg byte [rcx + 0x1ed], al
mov edx, dword [rbx + 0x1e0]
lea rcx, [rsp + 0x40]
mov qword [rsp + 0x28], rcx
xor ecx, ecx
mov dword [rsp + 0x20], 4
call fcn.180125318
xchg qword [rbx + 0x10], rax
mov rax, qword [rbx + 0x10]
nop
test rax, rax
je 0x180174b38
mov eax, dword [rsp + 0x40]
mov r8d, esi
xchg qword [rbx + 0x18], rax
mov rdx, qword [rbx + 0x10]
nop
movzx ecx, byte [rbx + 0x58]
call fcn.18015d120
test al, al
je 0x180174b0b
mov rcx, qword [rbx + 0x10]
nop
call qword [sym.imp.KERNEL32.dll_ResumeThread]
lea rcx, [rbx + 0x90]
call fcn.18015c2a0
mov al, 1
mov rbx, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
mov rax, qword [rbx + 0x10]
nop
test rax, rax
je 0x180174b22
mov rcx, qword [rbx + 0x10]
xor edx, edx
nop
call qword [sym.imp.KERNEL32.dll_TerminateThread]
mov rcx, qword [rbx + 0x10]
nop
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rax, rdi
xchg qword [rbx + 0x18], rax
xchg qword [rbx + 0x10], rdi
mov rbx, qword [rsp + 0x48]
xor al, al
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
Function at 0x1801756b0
Capabilities:
Encode data using base64

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x20
cmp byte [rdx], 0
mov rbx, rdx
mov r14, rcx
je 0x18017580f
nop dword [rax]
nop dword [rax + rax]
xor r9d, r9d
movzx ecx, byte [rbx]
inc rbx
mov eax, ecx
test cl, cl
jns 0x180175742
mov ecx, 0x40
xor r8d, r8d
mov edx, 0x7f
test cl, al
je 0x180175710
cmp ecx, 8
jbe 0x180175710
shr edx, 1
inc r8d
shr ecx, 1
test eax, ecx
jne 0x180175700
and eax, edx
sub r8d, 1
js 0x180175742
nop dword [rax + rax]
movzx edx, byte [rbx]
mov ecx, edx
and cl, 0xc0
cmp cl, 0x80
jne 0x180175742
mov ecx, eax
and edx, 0x3f
shl ecx, 6
mov eax, edx
or eax, ecx
inc rbx
sub r8d, 1
jns 0x180175720
lea ecx, [rax - 0x41]
cmp ecx, 0x19
jbe 0x180175794
lea ecx, [rax - 0x61]
cmp ecx, 0x19
ja 0x180175757
lea ecx, [rax - 0x47]
jmp 0x180175794
lea ecx, [rax - 0x30]
cmp ecx, 9
ja 0x180175764
lea ecx, [rax + 4]
jmp 0x180175794
cmp eax, 0x2b
jne 0x180175770
mov ecx, 0x3e
jmp 0x180175794
cmp eax, 0x2f
jne 0x18017577c
mov ecx, 0x3f
jmp 0x180175794
cmp eax, 0x3d
jne 0x180175827
mov ecx, 0x40
cmp r9, 1
jle 0x180175827
mov byte [rsp + r9 + 0x38], cl
inc r9
cmp r9, 4
jl 0x1801756e3
movzx eax, byte [rsp + 0x38]
mov rcx, r14
movzx esi, byte [rsp + 0x39]
mov r8, qword [r14]
movzx edx, sil
shr dl, 4
shl al, 2
or dl, al
call qword [r8 + 0x28]
movzx edi, byte [rsp + 0x3a]
cmp dil, 0x40
jae 0x180175806
mov rax, qword [r14]
movzx edx, dil
shr dl, 2
mov rcx, r14
shl sil, 4
or dl, sil
call qword [rax + 0x28]
movzx ecx, byte [rsp + 0x3b]
cmp cl, 0x40
jae 0x180175806
mov rax, qword [r14]
shl dil, 6
or dil, cl
mov rcx, r14
movzx edx, dil
call qword [rax + 0x28]
cmp byte [rbx], 0
jne 0x1801756e0
mov al, 1
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
xor al, al
jmp 0x180175811
Function at 0x180183710
Capabilities:
Initialize winsock library

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r14
sub rsp, 0x270
mov rax, qword [0x18065f280]
xor rax, rsp
mov qword [rsp + 0x260], rax
mov rdi, rcx
movzx eax, byte [rcx + 0x20]
nop
test al, al
je 0x180183841
movzx eax, byte [rcx + 0x21]
nop
test al, al
je 0x180183841
mov dword [rsp + 0x20], 0x80
movsxd rcx, dword [rcx + 0x1c]
nop
lea r8, [rsp + 0x20]
lea rdx, [rsp + 0x40]
call qword [sym.imp.WS2_32.dll_accept]
mov rsi, rax
test eax, eax
js 0x180183841
movzx ecx, byte [rdi + 0x20]
nop
test cl, cl
je 0x180183841
mov ecx, 0x58
call fcn.18011dae8
mov rbx, rax
mov qword [rsp + 0x30], rax
mov ebp, dword [rdi + 0x18]
nop
mov ecx, dword [rsp + 0x44]
call qword [sym.imp.WS2_32.dll_inet_ntoa]
mov rdx, rax
lea rcx, [rsp + 0x28]
call fcn.18001d070
movups xmm0, xmmword [rdi]
movups xmmword [rbx], xmm0
mov rax, qword [rsp + 0x28]
mov qword [rbx + 0x10], rax
lea rdi, [rax - 0x10]
lea r14, [0x180660020]
cmp rdi, r14
je 0x1801837d8
lock inc dword [rdi]
mov dword [rbx + 0x18], ebp
mov dword [rbx + 0x1c], esi
mov word [rbx + 0x20], 1
lea rcx, [rbx + 0x28]
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
cmp byte [0x1806c6d70], 0
jne 0x180183813
mov ecx, 0x101
lea rdx, [rsp + 0xc0]
call qword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
sete byte [0x1806c6d70]
movsxd rcx, esi
mov r9, rbx
call fcn.180184050
nop
cmp rdi, r14
je 0x18018383c
mov eax, 0xffffffff
lock xadd dword [rdi], eax
dec eax
cmp eax, 0xffffffff
jne 0x18018383c
mov rcx, rdi
call fcn.18011d9c0
mov rax, rbx
jmp 0x180183843
xor eax, eax
mov rcx, qword [rsp + 0x260]
xor rcx, rsp
call fcn.18011d9a0
lea r11, [rsp + 0x270]
mov rbx, qword [r11 + 0x28]
mov rbp, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret

Function at 0x180183b30
Capabilities:
Resolve dns

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rsi
push rdi
sub rsp, 0x90
mov rax, qword [0x18065f280]
xor rax, rsp
mov qword [rsp + 0x80], rax
xor esi, esi
mov dword [rsp + 0x38], 2
mov rdi, rdx
mov dword [rsp + 0x5c], esi
xorps xmm0, xmm0
mov dword [rsp + 0x34], esi
xorps xmm1, xmm1
mov qword [r11 - 0x78], rsi
mov edx, r8d
mov dword [rsp + 0x30], 8
lea rcx, [r11 - 0x18]
movdqu xmmword [rsp + 0x3c], xmm0
movdqu xmmword [rsp + 0x4c], xmm1
call fcn.18017dee0
lea r8, [rsp + 0x7f]
mov rdx, rax
sub r8, rax
lea rcx, [rsp + 0x28]
call fcn.180011cc0
mov rbx, qword [rsp + 0x28]
lea r9, [rsp + 0x20]
mov rcx, qword [rdi]
lea r8, [rsp + 0x30]
mov rdx, rbx
call qword [sym.imp.WS2_32.dll_getaddrinfo]
mov edi, eax
lea rcx, [rbx - 0x10]
lea rax, [0x180660020]
cmp rcx, rax
je 0x180183beb
mov edx, 0xffffffff
lock xadd dword [rcx], edx
dec edx
cmp edx, 0xffffffff
jne 0x180183beb
call fcn.18011d9c0
test edi, edi
cmove rsi, qword [rsp + 0x20]
mov rax, rsi
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.18011d9a0
lea r11, [rsp + 0x90]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rsp, r11
pop rdi
ret
Function at 0x180183ca0
Capabilities:
Get socket status

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x260
mov rax, qword [0x18065f280]
xor rax, rsp
mov qword [rsp + 0x250], rax
mov rbx, rcx
mov esi, r9d
mov rcx, rdx
mov rdi, rdx
call qword [sym.imp.KERNEL32.dll_TryEnterCriticalSection]
test eax, eax
je 0x180183d9e
movsxd rcx, dword [rbx]
mov eax, 0x10624dd3
imul esi
nop
xor r9d, r9d
sar edx, 6
xor r8d, r8d
mov eax, edx
mov qword [rsp + 0x48], rcx
shr eax, 0x1f
add edx, eax
mov dword [rsp + 0x40], 1
imul eax, edx, 0x3e8
mov dword [rsp + 0x38], edx
lea rdx, [rsp + 0x40]
sub esi, eax
imul eax, esi, 0x3e8
mov rsi, rcx
inc ecx
mov dword [rsp + 0x3c], eax
lea rax, [rsp + 0x38]
mov qword [rsp + 0x20], rax
call qword [sym.imp.WS2_32.dll_select]
test eax, eax
js 0x180183d95
movsxd rax, dword [rbx]
nop
mov rcx, rax
cmp rax, 0xffffffffffffffff
je 0x180183d95
lea rax, [rsp + 0x30]
mov dword [rsp + 0x30], 4
lea r9, [rsp + 0x34]
mov qword [rsp + 0x20], rax
mov edx, 0xffff
mov r8d, 0x1007
call qword [sym.imp.WS2_32.dll_getsockopt]
test eax, eax
js 0x180183d95
cmp dword [rsp + 0x34], 0
jne 0x180183d95
lea rdx, [rsp + 0x40]
mov rcx, rsi
call qword [sym.imp.WS2_32.dll___WSAFDIsSet]
xor ebx, ebx
mov rcx, rdi
test eax, eax
setne bl
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, ebx
jmp 0x180183da3
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, 0xffffffff
mov rcx, qword [rsp + 0x250]
xor rcx, rsp
call fcn.18011d9a0
add rsp, 0x260
pop rdi
pop rsi
pop rbx
ret

Function at 0x180183dd0
Capabilities:
Receive data
Receive data on socket
Set socket configuration

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x30
mov r12, r9
mov ebp, r8d
mov r13, rdx
mov qword [rsp + 0x28], rcx
mov r15, qword [rsp + 0x98]
movzx r14d, byte [rsp + 0x90]
mov eax, r14d
xor eax, 1
mov dword [rsp + 0x20], eax
lea r8, [rsp + 0x20]
mov edx, 0x8004667e
call qword [sym.imp.WS2_32.dll_ioctlsocket]
xor ebx, ebx
test ebp, ebp
jle 0x180183e83
movsxd rdi, ebx
add rdi, r13
mov esi, ebp
sub esi, ebx
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_TryEnterCriticalSection]
test eax, eax
je 0x180183e74
xor r9d, r9d
mov r8d, esi
mov rdx, rdi
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.WS2_32.dll_recv]
mov edi, eax
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
test edi, edi
jle 0x180183e74
movzx ecx, byte [r12]
nop
test cl, cl
je 0x180183e74
add ebx, edi
test r14b, r14b
je 0x180183e83
cmp ebx, ebp
jl 0x180183e23
jmp 0x180183e83
test ebx, ebx
jne 0x180183e83
mov eax, 0xffffffff
test r14b, r14b
cmovne ebx, eax
mov eax, ebx
mov rbx, qword [rsp + 0x88]
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret