joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1400a5760
Capabilities:
Enumerate pe sections

Disassembly:
sub rsp, 0x38
cmp r8d, 8
jge 0x1400a57fd
xor eax, eax
cmp r8d, 4
jl 0x1400a57b1
add r8d, 0xfffffffc
movsx r10, word [rcx + rax*2]
movsx r9, dx
cmp r10d, r9d
je 0x1400a57f8
nop dword [rax]
movsx r10, word [rcx + rax*2 + 2]
cmp r10d, r9d
je 0x1400a57f1
movsx r10, word [rcx + rax*2 + 4]
cmp r10d, r9d
je 0x1400a57e9
movsx r10, word [rcx + rax*2 + 6]
cmp r10d, r9d
je 0x1400a57e1
add rax, 4
test r8d, r8d
jle 0x1400a59da
movsx r9, dx
nop
dec r8d
movsx rdx, word [rcx + rax*2]
cmp edx, r9d
je 0x1400a57f8
inc rax
test r8d, r8d
jg 0x1400a57c0
jmp 0x1400a59da
add eax, 3
jmp 0x1400a59d5
add eax, 2
jmp 0x1400a59d5
inc eax
jmp 0x1400a59d5
jmp 0x1400a59d5
movsx r9, dx
movd xmm0, r9d
punpcklwd xmm0, xmm0
pshufd xmm0, xmm0, 0
mov rax, rcx
lea edx, [r8 - 8]
movsxd rdx, edx
add rdx, rdx
lea r10, [rax + rdx]
movups xmm1, xmmword [rax]
pcmpeqw xmm1, xmm0
movaps xmmword [rsp + 0x20], xmm1
xorps xmm2, xmm2
pcmpeqw xmm1, xmm2
pmovmskb r9d, xmm1
cmp r9d, 0xffff
jne 0x1400a5916
add rax, 0x10
cmp rax, r10
jbe 0x1400a5820
mov eax, r8d
test al, 7
je 0x1400a59da
movups xmm1, xmmword [r10]
pcmpeqw xmm0, xmm1
movaps xmmword [rsp + 0x20], xmm0
xorps xmm1, xmm1
pcmpeqw xmm0, xmm1
pmovmskb ecx, xmm0
cmp ecx, 0xffff
je 0x1400a59da
mov rax, qword [rsp + 0x20]
mov qword [rsp + 8], rax
movzx eax, word [rsp + 8]
shr eax, 0xf
movzx ecx, word [rsp + 0xa]
shr ecx, 0xf
add ecx, ecx
or eax, ecx
movzx ecx, word [rsp + 0xc]
shr ecx, 0xf
shl ecx, 2
or ecx, eax
mov eax, ecx
movzx ecx, word [rsp + 0xe]
shr ecx, 0xf
shl ecx, 3
or ecx, eax
mov eax, ecx
mov rcx, qword [rsp + 0x28]
mov qword [rsp], rcx
movzx ecx, word [rsp]
shr ecx, 0xf
movzx r8d, word [rsp + 2]
shr r8d, 0xf
add r8d, r8d
or ecx, r8d
movzx r8d, word [rsp + 4]
shr r8d, 0xf
shl r8d, 2
or r8d, ecx
mov ecx, r8d
movzx r8d, word [rsp + 6]
shr r8d, 0xf
shl r8d, 3
or r8d, ecx
mov ecx, r8d
shl ecx, 4
or eax, ecx
jne 0x1400a59cc
mov ecx, 0x20
jmp 0x1400a59cf
mov rdx, qword [rsp + 0x20]
mov qword [rsp + 0x18], rdx
movzx edx, word [rsp + 0x18]
shr edx, 0xf
movzx r8d, word [rsp + 0x1a]
shr r8d, 0xf
add r8d, r8d
or edx, r8d
movzx r8d, word [rsp + 0x1c]
shr r8d, 0xf
shl r8d, 2
or r8d, edx
mov edx, r8d
movzx r8d, word [rsp + 0x1e]
shr r8d, 0xf
shl r8d, 3
or r8d, edx
mov edx, r8d
mov r8, qword [rsp + 0x28]
mov qword [rsp + 0x10], r8
movzx r8d, word [rsp + 0x10]
shr r8d, 0xf
movzx r10d, word [rsp + 0x12]
shr r10d, 0xf
add r10d, r10d
or r8d, r10d
movzx r10d, word [rsp + 0x14]
shr r10d, 0xf
shl r10d, 2
or r10d, r8d
mov r8d, r10d
movzx r10d, word [rsp + 0x16]
shr r10d, 0xf
shl r10d, 3
or r10d, r8d
mov r8d, r10d
shl r8d, 4
or edx, r8d
jne 0x1400a59bd
mov r8d, 0x20
jmp 0x1400a59c1
bsf r8d, edx
sub rax, rcx
shr rax, 1
add eax, r8d
jmp 0x1400a59d5
bsf ecx, eax
shr rdx, 1
lea eax, [rdx + rcx]
add rsp, 0x38
ret
mov eax, 0xffffffff
add rsp, 0x38
ret
Function at 0x140001000
Capabilities:
Read file on windows
Write file on windows

Disassembly:
push rbx
sub rsp, 0xd0
mov rax, qword [0x140003008]
xor rax, rsp
mov qword [rsp + 0xc0], rax
mov qword [rsp + 0x30], 0
lea rcx, str.example.txt
mov dword [rsp + 0x28], 0x80
xor r9d, r9d
xor r8d, r8d
mov dword [rsp + 0x20], 4
mov edx, 0xc0000000
call qword [sym.imp.KERNEL32.dll_CreateFileW]
lea r9, [rsp + 0x40]
mov qword [rsp + 0x20], 0
mov rcx, rax
lea rdx, [rsp + 0x50]
mov r8d, 0x64
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_ReadFile]
xor ecx, ecx
lea rax, [rsp + 0x50]
lea r8, [0x140002258]
nop
movzx edx, byte [rax + rcx]
inc rcx
cmp dl, byte [r8 + rcx - 1]
jne 0x1400010b6
cmp rcx, 4
jne 0x140001080
lea r8d, [rcx + 0xe]
mov qword [rsp + 0x20], 0
mov rcx, rbx
lea r9, [rsp + 0x44]
lea rdx, str.Hello__WriteFile_
call qword [sym.imp.KERNEL32.dll_WriteFile]
xor eax, eax
mov rcx, qword [rsp + 0xc0]
xor rcx, rsp
call fcn.1400010f0
add rsp, 0xd0
pop rbx
ret
Function at 0x180002053
Capabilities:
Access peb ldr_data
Resolve function by parsing pe exports

Disassembly:
push rsi
sub rsp, 0x4f0
lea rax, [0x1803c065c]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x390], 0
mov rax, qword [rsp + 0x38]
mov eax, dword [rax + 0x10]
lea rcx, [rsp + 0x390]
mov qword [rsp + 0x4e0], rcx
mov dword [rsp + 0x1c8], eax
mov rax, qword gs:[0x30]
mov qword [rsp + 0x3a0], rax
add eax, dword [rax]
add byte [rax - 0x75], cl
test byte [rax + riz*4], ah
add eax, dword [rax]
add byte [rax - 0x75], cl
invalid
invalid
mov qword [rsp + 0x398], rax
mov rax, qword [rsp + 0x398]
mov rax, qword [rax + 0x18]
mov qword [rsp + 0x3a8], rax
mov rax, qword [rsp + 0x3a8]
add rax, 0x10
mov qword [rsp + 0x158], rax
mov qword [rsp + 0x2c0], rax
mov rax, qword [rsp + 0x2c0]
mov rax, qword [rax]
mov qword [rsp + 0x158], rax
mov rax, qword [rsp + 0x158]
cmp rax, qword [rsp + 0x2c0]
je 0x180002163
mov rax, qword [rsp + 0x158]
mov qword [rsp + 0x2b8], rax
mov esi, dword [rsp + 0x1c8]
add dword [rax], eax
add byte [rax - 0x75], cl
test byte [rax + rdi*4], ah
add al, byte [rax]
add byte [rax - 0x75], cl
invalid
invalid
call fcn.180001fb3
cmp esi, eax
jne 0x18000214e
mov rax, qword [rsp + 0x2b8]
mov rax, qword [rax + 0x30]
mov qword [rsp + 0x2c8], rax
jmp 0x18000216f
mov rax, qword [rsp + 0x158]
mov rax, qword [rax]
mov qword [rsp + 0x158], rax
jmp 0x1800020fa

Function at 0x180002100
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push rsi
sub rsp, 0x4f0
lea rax, [0x1803c065c]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x390], 0
mov rax, qword [rsp + 0x38]
mov eax, dword [rax + 0x10]
lea rcx, [rsp + 0x390]
mov qword [rsp + 0x4e0], rcx
mov dword [rsp + 0x1c8], eax
mov rax, qword gs:[0x30]
mov qword [rsp + 0x3a0], rax
add eax, dword [rax]
add byte [rax - 0x75], cl
test byte [rax + riz*4], ah
add eax, dword [rax]
add byte [rax - 0x75], cl
invalid
invalid
mov qword [rsp + 0x398], rax
mov rax, qword [rsp + 0x398]
mov rax, qword [rax + 0x18]
mov qword [rsp + 0x3a8], rax
mov rax, qword [rsp + 0x3a8]
add rax, 0x10
mov qword [rsp + 0x158], rax
mov qword [rsp + 0x2c0], rax
mov rax, qword [rsp + 0x2c0]
mov rax, qword [rax]
mov qword [rsp + 0x158], rax
mov rax, qword [rsp + 0x158]
cmp rax, qword [rsp + 0x2c0]
je 0x180002163
mov rax, qword [rsp + 0x158]
mov qword [rsp + 0x2b8], rax
mov esi, dword [rsp + 0x1c8]
add dword [rax], eax
add byte [rax - 0x75], cl
test byte [rax + rdi*4], ah
add al, byte [rax]
add byte [rax - 0x75], cl
invalid
invalid
call fcn.180001fb3
cmp esi, eax
jne 0x18000214e
mov rax, qword [rsp + 0x2b8]
mov rax, qword [rax + 0x30]
mov qword [rsp + 0x2c8], rax
jmp 0x18000216f
mov rax, qword [rsp + 0x158]
mov rax, qword [rax]
mov qword [rsp + 0x158], rax
jmp 0x1800020fa

Function at 0x180002120
Capabilities:
Resolve function by parsing pe exports

Disassembly:
add dword [rax], eax
add byte [rax - 0x75], cl
test byte [rax + rdi*4], ah
add al, byte [rax]
add byte [rax - 0x75], cl
invalid
Function at 0x180002150
Capabilities:
Resolve function by parsing pe exports

Disassembly:
test byte [rax + rbx*2], ah
add dword [rax], eax
add byte [rax - 0x75], cl
add byte [rax - 0x77], cl
test byte [rax + rbx*2], ah
add dword [rax], eax
add bl, ch
xchg edi, eax
mov qword [rsp + 0x2c8], 0
mov rax, qword [rsp + 0x2c8]
mov qword [rsp + 0xe8], rax
mov rax, qword [rsp + 0x38]
mov eax, dword [rsp + 0x38]
mov eax, dword [rax + 4]
mov rcx, qword [rsp + 0x38]
mov ecx, dword [rcx + 0x5c]
mov rdx, qword [rsp + 0xe8]
mov edx, dword [rsp + 0xe8]
mov rsi, qword [rsp + 0x38]
mov esi, dword [rsi + 0x48]
mov dword [rsp + 0x21c], eax
test byte [rsp + rbx], ah
add al, byte [rax]
add byte [rcx + 0x218248c], cl
add byte [rax], al
mov qword [rsp + 0xe0], rdx
mov dword [rsp + 0x214], esi
mov rax, qword [rsp + 0xe0]
mov rcx, qword [rsp + 0xe0]
movsxd rcx, dword [rcx + 0x3c]
add rax, rcx
mov qword [rsp + 0x4c0], rax
mov rax, qword [rsp + 0xe0]
mov rcx, qword [rsp + 0x4c0]
mov edx, dword [rsp + 0x214]
mov ecx, dword [rcx + rdx*8 + 0x88]
add rax, rcx
mov qword [rsp + 0x1a0], rax
mov rax, qword [rsp + 0xe0]
mov rcx, qword [rsp + 0x1a0]
movabs al, byte [0x14824498b000001]
enter 0xffffffffffff8948, 0xffffffffffffff84
and al, 0xb8
add al, 0
add byte [rax - 0x75], cl
test byte [rax + riz*8], ah
add byte [rax], al
add byte [rax - 0x75], cl
mov word [rax + riz*4], fs
add dword [rax], eax
add byte [rbx + 0x1482049], cl
enter 0xffffffffffff8948, 0xffffffffffffff84
and al, 0xb0
add al, 0
invalid
Function at 0x180002240
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov rax, qword [rsp + 0xe0]
mov rcx, qword [rsp + 0x1a0]
mov ecx, dword [rcx + 0x1c]
add rax, rcx
mov qword [rsp + 0x4a8], rax
mov dword [rsp + 0x7c], 0
mov eax, dword [rsp + 0x7c]
mov rcx, qword [rsp + 0x1a0]
cmp eax, dword [rcx + 0x18]
jae 0x1800023f5
mov rax, qword [rsp + 0xe0]
mov rcx, qword [rsp + 0x4b0]
mov edx, dword [rsp + 0x7c]
mov ecx, dword [rcx + rdx*4]
add rax, rcx
mov qword [rsp + 0x4a0], rax
mov rax, qword [rsp + 0x4a0]
and al, 0xa0
add al, 0
add byte [rbx + 0x21c248c], cl
add byte [rax], al
mov qword [rsp + 0x308], rax
mov dword [rsp + 0x224], ecx
mov dword [rsp + 0xfc], 0
mov rcx, qword [rsp + 0x308]
call fcn.180002013
mov dword [rsp + 0x220], eax
mov dword [rsp + 0x94], 0
mov eax, dword [rsp + 0x94]
cmp eax, dword [rsp + 0x220]
jae 0x1800023a5
mov rax, qword [rsp + 0x308]
movsxd rcx, dword [rsp + 0x94]
mov al, byte [rax + rcx]
mov byte [rsp + 0x59], al
mov eax, dword [rsp + 0x224]
mov ecx, dword [rsp + 0xfc]
mov dword [rsp + 0x28c], eax
mov dword [rsp + 0x288], ecx
mov dword [rsp + 0x14c], 0
mov dword [rsp + 0x148], 0
mov eax, dword [rsp + 0x148]
cmp eax, dword [rsp + 0x28c]
jae 0x18000237a
mov eax, dword [rsp + 0x288]
add eax, dword [rsp + 0x14c]
mov eax, dword [rsp + 0x14c]
movzx ecx, byte [rsp + 0x59]
add eax, ecx
mov dword [rsp + 0xfc], eax
mov eax, dword [rsp + 0x94]
add eax, 1
mov dword [rsp + 0x94], eax
jmp 0x1800022e5
mov eax, dword [rsp + 0xfc]
cmp eax, dword [rsp + 0x218]
jne 0x1800023e5
mov rax, qword [rsp + 0xe0]
mov rcx, qword [rsp + 0x4a8]
and al, 0xa8
add al, 0
add byte [rax - 0x75], cl
xchg esp, eax
and al, 0xb8
add al, 0
add byte [rbx + 0xf7c2474], cl
mov bh, reloc.WS2_32.dll_sendto
jb 0x180002361
or al, 0x91
add rax, rcx
mov qword [rsp + 0x300], rax
jmp 0x180002401
mov eax, dword [rsp + 0x7c]
add eax, 1
mov dword [rsp + 0x7c], eax
jmp 0x180002266
mov qword [rsp + 0x300], 0
mov rax, qword [rsp + 0x300]
mov qword [rsp + 0x388], rax
mov rax, qword [rsp + 0x388]
mov rcx, qword [rsp + 0x38]
mov ecx, dword [rcx + 0x60]
mov edx, ecx
xor ecx, ecx
call rax
mov qword [rsp + 0x150], rax
mov rax, qword [rsp + 0x38]
mov eax, dword [rsp + 0x38]
Function at 0x180002300
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov rax, qword [rsp + 0xe0]
mov rcx, qword [rsp + 0x1a0]
mov ecx, dword [rcx + 0x1c]
add rax, rcx
mov qword [rsp + 0x4a8], rax
mov dword [rsp + 0x7c], 0
mov eax, dword [rsp + 0x7c]
mov rcx, qword [rsp + 0x1a0]
cmp eax, dword [rcx + 0x18]
jae 0x1800023f5
mov rax, qword [rsp + 0xe0]
mov rcx, qword [rsp + 0x4b0]
mov edx, dword [rsp + 0x7c]
mov ecx, dword [rcx + rdx*4]
add rax, rcx
mov qword [rsp + 0x4a0], rax
mov rax, qword [rsp + 0x4a0]
and al, 0xa0
add al, 0
add byte [rbx + 0x21c248c], cl
add byte [rax], al
mov qword [rsp + 0x308], rax
mov dword [rsp + 0x224], ecx
mov dword [rsp + 0xfc], 0
mov rcx, qword [rsp + 0x308]
call fcn.180002013
mov dword [rsp + 0x220], eax
mov dword [rsp + 0x94], 0
mov eax, dword [rsp + 0x94]
cmp eax, dword [rsp + 0x220]
jae 0x1800023a5
mov rax, qword [rsp + 0x308]
movsxd rcx, dword [rsp + 0x94]
mov al, byte [rax + rcx]
mov byte [rsp + 0x59], al
mov eax, dword [rsp + 0x224]
mov ecx, dword [rsp + 0xfc]
mov dword [rsp + 0x28c], eax
mov dword [rsp + 0x288], ecx
mov dword [rsp + 0x14c], 0
mov dword [rsp + 0x148], 0
mov eax, dword [rsp + 0x148]
cmp eax, dword [rsp + 0x28c]
jae 0x18000237a
mov eax, dword [rsp + 0x288]
add eax, dword [rsp + 0x14c]
mov eax, dword [rsp + 0x14c]
movzx ecx, byte [rsp + 0x59]
add eax, ecx
mov dword [rsp + 0xfc], eax
mov eax, dword [rsp + 0x94]
add eax, 1
mov dword [rsp + 0x94], eax
jmp 0x1800022e5
mov eax, dword [rsp + 0xfc]
cmp eax, dword [rsp + 0x218]
jne 0x1800023e5
mov rax, qword [rsp + 0xe0]
mov rcx, qword [rsp + 0x4a8]
and al, 0xa8
add al, 0
add byte [rax - 0x75], cl
xchg esp, eax
and al, 0xb8
add al, 0
add byte [rbx + 0xf7c2474], cl
mov bh, reloc.WS2_32.dll_sendto
jb 0x180002361
or al, 0x91
add rax, rcx
mov qword [rsp + 0x300], rax
jmp 0x180002401
mov eax, dword [rsp + 0x7c]
add eax, 1
mov dword [rsp + 0x7c], eax
jmp 0x180002266
mov qword [rsp + 0x300], 0
mov rax, qword [rsp + 0x300]
mov qword [rsp + 0x388], rax
mov rax, qword [rsp + 0x388]
mov rcx, qword [rsp + 0x38]
mov ecx, dword [rcx + 0x60]
mov edx, ecx
xor ecx, ecx
call rax
mov qword [rsp + 0x150], rax
mov rax, qword [rsp + 0x38]
mov eax, dword [rsp + 0x38]

Function at 0x180002360
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov dword [rsp + 0x14c], eax
mov eax, dword [rsp + 0x148]
add eax, 1
mov dword [rsp + 0x148], eax
jmp 0x180002342
Function at 0x1800023c0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov rax, qword [rsp + 0xe0]
mov rcx, qword [rsp + 0x1a0]
mov ecx, dword [rcx + 0x1c]
add rax, rcx
mov qword [rsp + 0x4a8], rax
mov dword [rsp + 0x7c], 0
mov eax, dword [rsp + 0x7c]
mov rcx, qword [rsp + 0x1a0]
cmp eax, dword [rcx + 0x18]
jae 0x1800023f5
mov rax, qword [rsp + 0xe0]
mov rcx, qword [rsp + 0x4b0]
mov edx, dword [rsp + 0x7c]
mov ecx, dword [rcx + rdx*4]
add rax, rcx
mov qword [rsp + 0x4a0], rax
mov rax, qword [rsp + 0x4a0]
and al, 0xa0
add al, 0
add byte [rbx + 0x21c248c], cl
add byte [rax], al
mov qword [rsp + 0x308], rax
mov dword [rsp + 0x224], ecx
mov dword [rsp + 0xfc], 0
mov rcx, qword [rsp + 0x308]
call fcn.180002013
mov dword [rsp + 0x220], eax
mov dword [rsp + 0x94], 0
mov eax, dword [rsp + 0x94]
cmp eax, dword [rsp + 0x220]
jae 0x1800023a5
mov rax, qword [rsp + 0x308]
movsxd rcx, dword [rsp + 0x94]
mov al, byte [rax + rcx]
mov byte [rsp + 0x59], al
mov eax, dword [rsp + 0x224]
mov ecx, dword [rsp + 0xfc]
mov dword [rsp + 0x28c], eax
mov dword [rsp + 0x288], ecx
mov dword [rsp + 0x14c], 0
mov dword [rsp + 0x148], 0
mov eax, dword [rsp + 0x148]
cmp eax, dword [rsp + 0x28c]
jae 0x18000237a
mov eax, dword [rsp + 0x288]
add eax, dword [rsp + 0x14c]
mov eax, dword [rsp + 0x14c]
movzx ecx, byte [rsp + 0x59]
add eax, ecx
mov dword [rsp + 0xfc], eax
mov eax, dword [rsp + 0x94]
add eax, 1
mov dword [rsp + 0x94], eax
jmp 0x1800022e5
mov eax, dword [rsp + 0xfc]
cmp eax, dword [rsp + 0x218]
jne 0x1800023e5
mov rax, qword [rsp + 0xe0]
mov rcx, qword [rsp + 0x4a8]
and al, 0xa8
add al, 0
add byte [rax - 0x75], cl
xchg esp, eax
and al, 0xb8
add al, 0
add byte [rbx + 0xf7c2474], cl
mov bh, reloc.WS2_32.dll_sendto
jb 0x180002361
or al, 0x91
add rax, rcx
mov qword [rsp + 0x300], rax
jmp 0x180002401
mov eax, dword [rsp + 0x7c]
add eax, 1
mov dword [rsp + 0x7c], eax
jmp 0x180002266
mov qword [rsp + 0x300], 0
mov rax, qword [rsp + 0x300]
mov qword [rsp + 0x388], rax
mov rax, qword [rsp + 0x388]
mov rcx, qword [rsp + 0x38]
mov ecx, dword [rcx + 0x60]
mov edx, ecx
xor ecx, ecx
call rax
mov qword [rsp + 0x150], rax
mov rax, qword [rsp + 0x38]
mov eax, dword [rsp + 0x38]
Function at 0x180002400
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov rax, qword [rsp + 0xe0]
mov rcx, qword [rsp + 0x1a0]
mov ecx, dword [rcx + 0x1c]
add rax, rcx
mov qword [rsp + 0x4a8], rax
mov dword [rsp + 0x7c], 0
mov eax, dword [rsp + 0x7c]
mov rcx, qword [rsp + 0x1a0]
cmp eax, dword [rcx + 0x18]
jae 0x1800023f5
mov rax, qword [rsp + 0xe0]
mov rcx, qword [rsp + 0x4b0]
mov edx, dword [rsp + 0x7c]
mov ecx, dword [rcx + rdx*4]
add rax, rcx
mov qword [rsp + 0x4a0], rax
mov rax, qword [rsp + 0x4a0]
and al, 0xa0
add al, 0
add byte [rbx + 0x21c248c], cl
add byte [rax], al
mov qword [rsp + 0x308], rax
mov dword [rsp + 0x224], ecx
mov dword [rsp + 0xfc], 0
mov rcx, qword [rsp + 0x308]
call fcn.180002013
mov dword [rsp + 0x220], eax
mov dword [rsp + 0x94], 0
mov eax, dword [rsp + 0x94]
cmp eax, dword [rsp + 0x220]
jae 0x1800023a5
mov rax, qword [rsp + 0x308]
movsxd rcx, dword [rsp + 0x94]
mov al, byte [rax + rcx]
mov byte [rsp + 0x59], al
mov eax, dword [rsp + 0x224]
mov ecx, dword [rsp + 0xfc]
mov dword [rsp + 0x28c], eax
mov dword [rsp + 0x288], ecx
mov dword [rsp + 0x14c], 0
mov dword [rsp + 0x148], 0
mov eax, dword [rsp + 0x148]
cmp eax, dword [rsp + 0x28c]
jae 0x18000237a
mov eax, dword [rsp + 0x288]
add eax, dword [rsp + 0x14c]
mov eax, dword [rsp + 0x14c]
movzx ecx, byte [rsp + 0x59]
add eax, ecx
mov dword [rsp + 0xfc], eax
mov eax, dword [rsp + 0x94]
add eax, 1
mov dword [rsp + 0x94], eax
jmp 0x1800022e5
mov eax, dword [rsp + 0xfc]
cmp eax, dword [rsp + 0x218]
jne 0x1800023e5
mov rax, qword [rsp + 0xe0]
mov rcx, qword [rsp + 0x4a8]
and al, 0xa8
add al, 0
add byte [rax - 0x75], cl
xchg esp, eax
and al, 0xb8
add al, 0
add byte [rbx + 0xf7c2474], cl
mov bh, reloc.WS2_32.dll_sendto
jb 0x180002361
or al, 0x91
add rax, rcx
mov qword [rsp + 0x300], rax
jmp 0x180002401
mov eax, dword [rsp + 0x7c]
add eax, 1
mov dword [rsp + 0x7c], eax
jmp 0x180002266
mov qword [rsp + 0x300], 0
mov rax, qword [rsp + 0x300]
mov qword [rsp + 0x388], rax
mov rax, qword [rsp + 0x388]
mov rcx, qword [rsp + 0x38]
mov ecx, dword [rcx + 0x60]
mov edx, ecx
xor ecx, ecx
call rax
mov qword [rsp + 0x150], rax
mov rax, qword [rsp + 0x38]
mov eax, dword [rsp + 0x38]

Function at 0x180002470
Capabilities:
Resolve function by parsing pe exports

Disassembly:
fadd dword [rax]
add byte [rax], al
mov rcx, qword [rsp + 0xd8]
movsxd rcx, dword [rcx + 0x3c]
add rax, rcx
mov qword [rsp + 0x498], rax
mov rax, qword [rsp + 0xd8]
mov rcx, qword [rsp + 0x498]
mov edx, dword [rsp + 0x208]
mov ecx, dword [rcx + rdx*8 + 0x88]
add rax, rcx
mov qword [rsp + 0x198], rax
mov rax, qword [rsp + 0xd8]
mov rcx, qword [rsp + 0x198]
mov ecx, dword [rcx + 0x24]
add rax, rcx
mov qword [rsp + 0x490], rax
mov rax, qword [rsp + 0xd8]
invalid
invalid
mov word [rax + rbx*4], fs
invalid

Function at 0x1800024f0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov rax, qword [rsp + 0xd8]
mov rcx, qword [rsp + 0x198]

Function at 0x180002500
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov ecx, dword [rcx + 0x1c]
add rax, rcx
mov qword [rsp + 0x480], rax
mov dword [rsp + 0x78], 0
Function at 0x1800025e0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov eax, dword [rsp + 0x78]
mov rcx, qword [rsp + 0x198]
cmp eax, dword [rcx + 0x18]
jae 0x1800026a5
mov rax, qword [rsp + 0xd8]
mov rcx, qword [rsp + 0x488]
mov edx, dword [rsp + 0x78]
mov ecx, dword [rcx + rdx*4]
add rax, rcx
mov qword [rsp + 0x478], rax
mov rax, qword [rsp + 0x478]
mov ecx, dword [rsp + 0x210]
mov qword [rsp + 0x310], rax
adc byte [rbx], al
add byte [rax], al
mov dword [rsp + 0x22c], ecx
mov dword [rsp + 0x100], 0
mov rcx, qword [rsp + 0x310]
call fcn.180002013
cli
invalid
dec dword [rcx + 0x2282484]
add byte [rax], al
mov dword [rsp + 0x98], 0
mov eax, dword [rsp + 0x98]
cmp eax, dword [rsp + 0x228]
jae 0x180002655
mov rax, qword [rsp + 0x310]
movsxd rcx, dword [rsp + 0x98]
mov al, byte [rax + rcx]
mov byte [rsp + 0x5a], al
mov eax, dword [rsp + 0x22c]
mov ecx, dword [rsp + 0x100]
mov dword [rsp + 0x284], eax
mov dword [rsp + 0x280], ecx
mov dword [rsp + 0x144], 0
add dword [rax], eax
add byte [rax], al
add byte [rax], al
add bh, al
test byte [rax + rax*2], ah
add dword [rax], eax
add byte [rax], al
add byte [rax], al
invalid
mov eax, dword [rsp + 0x140]
cmp eax, dword [rsp + 0x284]
jae 0x18000262a
mov eax, dword [rsp + 0x280]
add eax, dword [rsp + 0x144]
mov eax, dword [rsp + 0x144]
movzx ecx, byte [rsp + 0x5a]
add eax, ecx
mov dword [rsp + 0x100], eax
mov eax, dword [rsp + 0x98]
add eax, 1
mov dword [rsp + 0x98], eax
jmp 0x180002595
mov eax, dword [rsp + 0x100]
cmp eax, dword [rsp + 0x20c]
jne 0x180002695
mov rax, qword [rsp + 0xd8]
mov rcx, qword [rsp + 0x480]
mov rdx, qword [rsp + 0x490]
mov esi, dword [rsp + 0x78]
movzx edx, word [rdx + rsi*2]
mov ecx, dword [rcx + rdx*4]
add rax, rcx
mov qword [rsp + 0x2f8], rax
jmp 0x1800026b1
mov eax, dword [rsp + 0x78]
add eax, 1
mov dword [rsp + 0x78], eax
jmp 0x180002516
invalid
invalid
test byte [rax + rdi*8], ah
add al, byte [rax]
add byte [rax], al
add byte [rax], al
Function at 0x180002600
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov eax, dword [rsp + 0x78]
mov rcx, qword [rsp + 0x198]
cmp eax, dword [rcx + 0x18]
jae 0x1800026a5
mov rax, qword [rsp + 0xd8]
mov rcx, qword [rsp + 0x488]
mov edx, dword [rsp + 0x78]
mov ecx, dword [rcx + rdx*4]
add rax, rcx
mov qword [rsp + 0x478], rax
mov rax, qword [rsp + 0x478]
mov ecx, dword [rsp + 0x210]
mov qword [rsp + 0x310], rax
adc byte [rbx], al
add byte [rax], al
mov dword [rsp + 0x22c], ecx
mov dword [rsp + 0x100], 0
mov rcx, qword [rsp + 0x310]
call fcn.180002013
cli
invalid
dec dword [rcx + 0x2282484]
add byte [rax], al
mov dword [rsp + 0x98], 0
mov eax, dword [rsp + 0x98]
cmp eax, dword [rsp + 0x228]
jae 0x180002655
mov rax, qword [rsp + 0x310]
movsxd rcx, dword [rsp + 0x98]
mov al, byte [rax + rcx]
mov byte [rsp + 0x5a], al
mov eax, dword [rsp + 0x22c]
mov ecx, dword [rsp + 0x100]
mov dword [rsp + 0x284], eax
mov dword [rsp + 0x280], ecx
mov dword [rsp + 0x144], 0
add dword [rax], eax
add byte [rax], al
add byte [rax], al
add bh, al
test byte [rax + rax*2], ah
add dword [rax], eax
add byte [rax], al
add byte [rax], al
invalid
mov eax, dword [rsp + 0x140]
cmp eax, dword [rsp + 0x284]
jae 0x18000262a
mov eax, dword [rsp + 0x280]
add eax, dword [rsp + 0x144]
mov eax, dword [rsp + 0x144]
movzx ecx, byte [rsp + 0x5a]
add eax, ecx
mov dword [rsp + 0x100], eax
mov eax, dword [rsp + 0x98]
add eax, 1
mov dword [rsp + 0x98], eax
jmp 0x180002595
mov eax, dword [rsp + 0x100]
cmp eax, dword [rsp + 0x20c]
jne 0x180002695
mov rax, qword [rsp + 0xd8]
mov rcx, qword [rsp + 0x480]
mov rdx, qword [rsp + 0x490]
mov esi, dword [rsp + 0x78]
movzx edx, word [rdx + rsi*2]
mov ecx, dword [rcx + rdx*4]
add rax, rcx
mov qword [rsp + 0x2f8], rax
jmp 0x1800026b1
mov eax, dword [rsp + 0x78]
add eax, 1
mov dword [rsp + 0x78], eax
jmp 0x180002516
invalid
invalid
test byte [rax + rdi*8], ah
add al, byte [rax]
add byte [rax], al
add byte [rax], al

Function at 0x180002610
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov dword [rsp + 0x144], eax
mov eax, dword [rsp + 0x140]
add eax, 1
mov dword [rsp + 0x140], eax
jmp 0x1800025f2

Function at 0x1800026c0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
add byte [rax - 0x75], cl
test byte [rax + rax*4], ah
add eax, dword [rax]
add byte [rax - 0x75], cl
xchg esp, eax
and al, 0x50
add dword [rax], eax
add byte [rcx], dh
leave
mov r8d, 0x104
call rax
mov dword [rsp + 0x1c4], eax
mov rax, qword [rsp + 0x38]
mov rax, qword [rax + 0x1c]
mov qword [rsp + 0x2b0], rax
mov eax, dword [rsp + 0x1c4]
mov dword [rsp + 0x54], eax
invalid
invalid

Function at 0x180002700
Capabilities:
Resolve function by parsing pe exports

Disassembly:
test byte [rax + rdx*2], ah
add dword [rax], eax
add byte [rbx - 0x7cabdbb4], cl
jmp 0x18fc9b011