joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1800543c0
Capabilities:
Allocate or change rwx memory

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x30
mov rax, qword [0x180070010]
xor rax, rsp
mov qword [rsp + 0x28], rax
mov eax, ecx
lea r9, [rsp + 0x20]
imul rbx, rax, 0x38
mov esi, edx
add rbx, qword [0x1800712b0]
mov r8, qword [rbx]
movzx eax, byte [rbx + 0x20]
and al, 1
movzx ecx, al
lea rdi, [r8 - 5]
cmove rdi, r8
mov r8d, 0x40
lea rbp, [rcx*2 + 5]
mov rcx, rdi
mov rdx, rbp
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x180054433
mov eax, 0xa
jmp 0x1800544c2
test esi, esi
je 0x180054455
mov byte [rdi], 0xe9
mov eax, dword [rbx + 8]
sub eax, edi
sub eax, 5
mov dword [rdi + 1], eax
test byte [rbx + 0x20], 1
je 0x180054478
mov rax, qword [rbx]
mov word [rax], 0xf9eb
jmp 0x180054478
mov eax, dword [rbx + 0x18]
test byte [rbx + 0x20], 1
mov dword [rdi], eax
je 0x180054471
movzx eax, word [rbx + 0x1c]
mov word [rdi + 4], ax
movzx eax, byte [rbx + 0x1e]
mov byte [rdi + 6], al
jmp 0x180054478
movzx eax, byte [rbx + 0x1c]
mov byte [rdi + 4], al
mov r8d, dword [rsp + 0x20]
lea r9, [rsp + 0x20]
mov rdx, rbp
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov r8, rbp
mov rdx, rdi
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_FlushInstructionCache]
and byte [rbx + 0x20], 0xfd
and sil, 1
movzx eax, sil
shl sil, 2
add al, al
or al, byte [rbx + 0x20]
and al, 0xfb
or al, sil
mov byte [rbx + 0x20], al
xor eax, eax
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.180059d20
mov rbx, qword [rsp + 0x48]
mov rbp, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret
Function at 0x1800544f0
Capabilities:
Resume thread

Disassembly:
mov qword [rsp + 0x18], rbx
push rsi
sub rsp, 0x30
mov r8d, dword [0x1800712bc]
mov esi, ecx
xor ecx, ecx
mov ebx, ecx
test r8d, r8d
je 0x180054537
mov rax, qword [0x1800712b0]
add rax, 0x20
nop word [rax + rax]
movzx edx, byte [rax]
shr edx, 1
and edx, 1
cmp edx, esi
jne 0x180054544
inc ebx
add rax, 0x38
cmp ebx, r8d
jb 0x180054520
mov eax, ecx
mov rbx, qword [rsp + 0x50]
add rsp, 0x30
pop rsi
ret
cmp ebx, 0xffffffff
je 0x180054537
test esi, esi
mov qword [rsp + 0x48], rdi
mov edx, 0xffffffff
setne cl
mov r8d, ecx
lea rcx, [rsp + 0x20]
call fcn.1800541f0
mov edi, eax
test eax, eax
jne 0x18005462d
mov r9d, dword [0x1800712bc]
cmp ebx, r9d
jae 0x1800545bc
nop dword [rax + rax]
mov ecx, ebx
imul rdx, rcx, 0x38
mov rcx, qword [0x1800712b0]
movzx r8d, byte [rdx + rcx + 0x20]
shr r8d, 1
and r8d, 1
cmp r8d, esi
je 0x1800545b5
mov edx, esi
mov ecx, ebx
call fcn.1800543c0
mov edi, eax
test eax, eax
jne 0x1800545bc
mov r9d, dword [0x1800712bc]
inc ebx
cmp ebx, r9d
jb 0x180054580
cmp qword [rsp + 0x20], 0
je 0x18005462b
mov eax, dword [rsp + 0x2c]
test eax, eax
je 0x180054617
mov rbx, qword [rsp + 0x20]
mov qword [rsp + 0x40], rbp
mov ebp, eax
nop dword [rax + rax]
mov r8d, dword [rbx]
xor edx, edx
lea ecx, [rdx + 0x5a]
call qword [sym.imp.KERNEL32.dll_OpenThread]
mov rsi, rax
test rax, rax
je 0x180054608
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_ResumeThread]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
add rbx, 4
sub rbp, 1
jne 0x1800545e0
mov rbp, qword [rsp + 0x40]
mov r8, qword [rsp + 0x20]
xor edx, edx
mov rcx, qword [0x1800710e8]
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, edi
mov rdi, qword [rsp + 0x48]
mov rbx, qword [rsp + 0x50]
add rsp, 0x30
pop rsi
ret
Function at 0x1800549d0
Capabilities:
Resume thread

Disassembly:
mov qword [rsp + 0x20], rbx
push rdi
push r14
push r15
sub rsp, 0x30
xor r15d, r15d
mov edi, 1
mov r14d, r15d
mov ebx, r15d
xor eax, eax
lock cmpxchg dword [0x1800710e0], edi
je 0x180054a19
cmp rbx, 0x20
jae 0x180054a02
xor ecx, ecx
jmp 0x180054a04
mov ecx, edi
call qword [sym.imp.KERNEL32.dll_Sleep]
inc rbx
xor eax, eax
lock cmpxchg dword [0x1800710e0], edi
jne 0x1800549f8
cmp qword [0x1800710e8], r14
mov qword [rsp + 0x60], r13
je 0x180054bbb
mov ecx, dword [0x1800712bc]
mov ebx, r15d
test ecx, ecx
je 0x180054a51
mov rdx, qword [0x1800712b0]
mov rax, rdx
cmp qword [rax], r14
je 0x180054a5c
inc ebx
add rax, 0x38
cmp ebx, ecx
jb 0x180054a42
mov r14d, 4
jmp 0x180054bc1
cmp ebx, 0xffffffff
je 0x180054a51
mov eax, ebx
imul r13, rax, 0x38
test byte [rdx + r13 + 0x20], 2
je 0x180054b20
xor r8d, r8d
lea rcx, [rsp + 0x20]
mov edx, ebx
call fcn.1800541f0
mov r14d, eax
test eax, eax
jne 0x180054bc1
xor edx, edx
mov ecx, ebx
call fcn.1800543c0
mov r14d, eax
cmp qword [rsp + 0x20], r15
je 0x180054b10
mov eax, dword [rsp + 0x2c]
test eax, eax
je 0x180054afc
mov rdi, qword [rsp + 0x20]
mov qword [rsp + 0x50], rbp
mov ebp, eax
mov qword [rsp + 0x58], rsi
nop dword [rax]
mov r8d, dword [rdi]
xor edx, edx
lea ecx, [rdx + 0x5a]
call qword [sym.imp.KERNEL32.dll_OpenThread]
mov rsi, rax
test rax, rax
je 0x180054ae8
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_ResumeThread]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
add rdi, 4
sub rbp, 1
jne 0x180054ac0
mov rsi, qword [rsp + 0x58]
mov rbp, qword [rsp + 0x50]
mov r8, qword [rsp + 0x20]
xor edx, edx
mov rcx, qword [0x1800710e8]
call qword [sym.imp.KERNEL32.dll_HeapFree]
test r14d, r14d
jne 0x180054bc1
mov rdx, qword [0x1800712b0]
mov rcx, qword [rdx + r13 + 0x10]
call fcn.180053800
mov edx, dword [0x1800712bc]
dec edx
cmp ebx, edx
jae 0x180054b6f
mov eax, edx
imul rcx, rax, 0x38
mov rax, qword [0x1800712b0]
movups xmm0, xmmword [rcx + rax]
movups xmmword [rax + r13], xmm0
movups xmm1, xmmword [rcx + rax + 0x10]
movups xmmword [rax + r13 + 0x10], xmm1
movups xmm0, xmmword [rcx + rax + 0x20]
movups xmmword [rax + r13 + 0x20], xmm0
movsd xmm1, qword [rcx + rax + 0x30]
movsd qword [rax + r13 + 0x30], xmm1
mov ecx, dword [0x1800712b8]
mov eax, ecx
mov dword [0x1800712bc], edx
shr eax, 1
cmp eax, 0x20
jb 0x180054bc1
cmp eax, edx
jb 0x180054bc1
mov r8, qword [0x1800712b0]
mov eax, ecx
mov rcx, qword [0x1800710e8]
xor edx, edx
shr rax, 1
imul r9, rax, 0x38
call qword [sym.imp.KERNEL32.dll_HeapReAlloc]
test rax, rax
je 0x180054bc1
shr dword [0x1800712b8], 1
mov qword [0x1800712b0], rax
jmp 0x180054bc1
mov r14d, 2
xchg dword [0x1800710e0], r15d
mov r13, qword [rsp + 0x60]
mov eax, r14d
mov rbx, qword [rsp + 0x68]
add rsp, 0x30
pop r15
pop r14
pop rdi
ret
Function at 0x1800563d0
Capabilities:
Resume thread

Disassembly:
push rbx
sub rsp, 0x20
mov r8d, 0x1b
lea rdx, str.fusion_internal__rip_lunar
lea rcx, [0x180070340]
call fcn.18000acd0
lea rcx, str.opengl32.dll
mov byte [0x180071280], 0
mov byte [0x1800710b0], 0
mov dword [0x180071284], 0x2d
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rcx, rax
lea rdx, str.wglSwapBuffers
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
mov rbx, rax
call fcn.1800546e0
mov edx, 1
mov rcx, rbx
add rsp, 0x20
pop rbx
jmp fcn.180054be0
Function at 0x1800591c0
Capabilities:
Create thread

Disassembly:
push rbx
sub rsp, 0x30
mov rbx, rcx
cmp edx, 1
jne 0x180059208
mov qword [0x1800712a0], rcx
call qword [sym.imp.KERNEL32.dll_DisableThreadLibraryCalls]
xor eax, eax
lea r8, [0x180059190]
mov qword [rsp + 0x28], rax
mov r9, rbx
xor edx, edx
mov dword [rsp + 0x20], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
test rax, rax
je 0x180059208
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
add rsp, 0x30
pop rbx
ret
Function at 0x180001000
Capabilities:
Read file on windows
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
push rsi
push rdi
push r12
push r13
push r14
sub rsp, 0x30
mov r12, r8
mov ebp, edx
mov r14, rcx
xor r8d, r8d
xor edx, edx
mov rcx, r12
xor edi, edi
call fcn.180146d54
lea r8d, [rdi + 2]
xor edx, edx
mov rcx, r12
call fcn.180146d54
mov rcx, r12
call fcn.18014736c
cmp eax, 0xc
jbe 0x18000116c
mov ebx, 0xffffffe8
mov qword [rsp + 0x20], rdi
mov qword [rsp + 0x70], rdi
mov qword [rsp + 0x78], rdi
mov r8d, 2
mov edx, ebx
mov rcx, r12
call fcn.180146d54
mov edx, 8
lea rcx, [rsp + 0x20]
lea r8d, [rdx - 7]
mov r9, r12
call fcn.1801470b0
mov edx, 8
lea rcx, [rsp + 0x70]
lea r8d, [rdx - 7]
mov r9, r12
call fcn.1801470b0
mov edx, 8
lea rcx, [rsp + 0x78]
lea r8d, [rdx - 7]
mov r9, r12
call fcn.1801470b0
cmp dword [rsp + 0x78], 0xc8785
mov rsi, qword [rsp + 0x70]
jne 0x18000116c
cmp dword [rsp + 0x20], ebp
je 0x1800010d6
mov eax, 0xffffffe8
sub eax, esi
add ebx, eax
jmp 0x180001060
lea eax, [rsi + 8]
mov ecx, eax
mov r13d, eax
call fcn.1801474a8
mov rbp, rax
test rax, rax
je 0x18000116c
mov r8d, r13d
xor edx, edx
mov rcx, rax
call fcn.18014af80
sub ebx, esi
mov r8d, 2
mov edx, ebx
mov rcx, r12
call fcn.180146d54
mov esi, esi
mov r9, r12
mov r8d, 1
mov rcx, rbp
mov edx, esi
call fcn.1801470b0
mov rcx, r12
call fcn.180147440
lea rdx, [0x180364204]
mov rcx, r14
call fcn.1801471a8
mov rbx, rax
test rax, rax
je 0x180001162
mov r9, rax
mov r8d, 1
mov edx, esi
mov rcx, rbp
call fcn.1801476ec
mov rcx, rbx
call fcn.180147440
mov edi, 1
mov rcx, rbp
call fcn.18014777c
jmp 0x180001174
mov rcx, r12
call fcn.180147440
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x68]
mov eax, edi
add rsp, 0x30
pop r14
pop r13
pop r12
pop rdi
pop rsi
ret
Function at 0x180001190
Capabilities:
Encode data using base64

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rdi
mov r10, rdx
mov eax, 0x55555556
mov edi, r8d
xor r11d, r11d
mov rbx, rcx
lea rbp, [0x180364210]
imul r8d
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*2]
sub edi, eax
test edx, edx
jle 0x180001250
mov qword [rsp + 0x10], rsi
lea r11d, [rdx*4]
mov esi, edx
nop dword [rax]
movzx ecx, byte [rbx + 1]
movzx edx, byte [rbx]
movzx r9d, byte [rbx + 2]
mov r8d, ecx
shr ecx, 4
mov eax, edx
shr rax, 2
add r10, 4
add rbx, 3
movzx eax, byte [rax + rbp]
mov byte [r10 - 4], al
mov eax, edx
shl eax, 4
or rcx, rax
and ecx, 0x3f
movzx eax, byte [rcx + rbp]
mov ecx, r9d
mov byte [r10 - 3], al
lea eax, [r8*4]
shr rcx, 6
or rcx, rax
and ecx, 0x3f
movzx eax, byte [rcx + rbp]
mov byte [r10 - 2], al
mov eax, r9d
and eax, 0x3f
dec rsi
movzx eax, byte [rax + rbp]
mov byte [r10 - 1], al
jne 0x1800011e0
mov rsi, qword [rsp + 0x10]
cmp edi, 1
jne 0x180001292
movzx ecx, byte [rbx]
mov eax, ecx
and ecx, 3
shr rax, 2
shl ecx, 4
movzx eax, byte [rax + rbp]
movsxd rcx, ecx
mov byte [r10], al
movzx ecx, byte [rcx + rbp]
lea eax, [r11 + 4]
mov byte [r10 + 1], cl
mov word [r10 + 2], 0x3d3d
mov byte [r10 + 4], 0
mov rbx, qword [rsp + 0x18]
mov rbp, qword [rsp + 0x20]
pop rdi
ret
cmp edi, 2
jne 0x1800012f2
movzx edx, byte [rbx]
movzx r8d, byte [rbx + 1]
mov eax, edx
shr rax, 2
movzx eax, byte [rax + rbp]
mov byte [r10], al
mov eax, edx
and eax, 3
shl eax, 4
movsxd rcx, eax
mov eax, r8d
and r8d, 0xf
shr eax, 4
or rcx, rax
shl r8d, 2
movzx eax, byte [rcx + rbp]
mov byte [r10 + 1], al
movsxd rax, r8d
movzx eax, byte [rax + rbp]
mov byte [r10 + 2], al
mov word [r10 + 3], 0x3d
lea eax, [r11 + 4]
mov rbx, qword [rsp + 0x18]
mov rbp, qword [rsp + 0x20]
pop rdi
ret
mov rbx, qword [rsp + 0x18]
mov rbp, qword [rsp + 0x20]
mov byte [r10], 0
mov eax, r11d
pop rdi
ret
Function at 0x180001600
Capabilities:
Read .ini file

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
sub rsp, 0x848
mov rax, qword [0x1803b0b00]
xor rax, rsp
mov qword [rsp + 0x830], rax
mov rdi, qword [rsp + 0x8a0]
mov rbx, rcx
mov rbp, r8
mov rsi, rdx
lea rcx, [rsp + 0x31]
mov r8d, 0x3ff
xor edx, edx
mov r12, r9
mov byte [rsp + 0x30], 0
call fcn.18014af80
lea rcx, [rsp + 0x431]
xor edx, edx
mov r8d, 0x3ff
mov byte [rsp + 0x430], 0
call fcn.18014af80
mov r13, qword [rdi]
lea r9, [rsp + 0x30]
mov r8, r12
mov rdx, rbp
mov rcx, rsi
mov qword [rsp + 0x28], rbx
mov dword [rsp + 0x20], 0x400
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
test eax, eax
je 0x1800017d3
lea rdx, [rsp + 0x30]
sub rdx, r12
nop
movzx ecx, byte [r12]
movzx eax, byte [r12 + rdx]
sub ecx, eax
jne 0x1800016b5
inc r12
test eax, eax
jne 0x1800016a0
test ecx, ecx
je 0x1800017a8
or rcx, 0xffffffffffffffff
xor eax, eax
lea rdi, [rsp + 0x30]
repne scasb al, byte [rdi]
xor r9d, r9d
xor r10d, r10d
not rcx
lea r8, [rsp + 0x430]
lea rdx, [rsp + 0x30]
dec rcx
mov r11, rcx
test ecx, ecx
jle 0x180001785
lea rbx, [0x180364260]
movzx eax, byte [rdx]
cmp al, 0xd
je 0x180001776
cmp al, 0xa
je 0x180001776
movsx rax, al
add rdx, 2
inc r8
movsx edi, byte [rax + rbx]
movsx rax, byte [rdx - 1]
inc r10d
movsx ecx, byte [rax + rbx]
shl edi, 0x12
shl ecx, 0xc
add edi, ecx
mov eax, edi
sar eax, 0x10
mov byte [r8 - 1], al
movzx eax, byte [rdx]
cmp al, 0x3d
je 0x180001770
movsx rax, al
inc rdx
inc r8
movsx ecx, byte [rax + rbx]
inc r10d
shl ecx, 6
add edi, ecx
mov eax, edi
sar eax, 8
mov byte [r8 - 1], al
movzx eax, byte [rdx]
cmp al, 0x3d
je 0x180001770
movsx rax, al
inc r8
inc rdx
movsx eax, byte [rax + rbx]
add edi, eax
inc r10d
mov byte [r8 - 1], dil
add r9d, 4
jmp 0x18000177c
inc rdx
inc r9d
cmp r9d, r11d
jl 0x1800016f5
mov byte [r8], 0
test r10d, r10d
jle 0x1800017d3
lea rdx, [rsp + 0x430]
mov r8d, 0x104
mov rcx, r13
call fcn.180147d90
xor eax, eax
jmp 0x1800017d6
lea rax, [rsp + 0x30]
lea rcx, [rsp + 0x30]
sub r13, rax
nop word [rax + rax]
movzx eax, byte [rcx]
inc rcx
mov byte [r13 + rcx - 1], al
test al, al
jne 0x1800017c0
xor eax, eax
jmp 0x1800017d6
or eax, 0xffffffff
mov rcx, qword [rsp + 0x830]
xor rcx, rsp
call fcn.180146c80
add rsp, 0x848
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x180001da0
Capabilities:
Link many functions at runtime

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
lea rcx, str.Iphlpapi.dll
xor ebx, ebx
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rdi, rax
test rax, rax
je 0x180001e4e
lea rdx, str.IcmpCreateFile
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.IcmpCloseHandle
mov rcx, rdi
mov qword [0x1803cac48], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.IcmpSendEcho
mov rcx, rdi
mov qword [0x1803cac40], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp qword [0x1803cac48], rbx
mov qword [0x1803cac38], rax
je 0x180001e37
cmp qword [0x1803cac40], rbx
je 0x180001e37
test rax, rax
je 0x180001e37
lea rcx, str.InitIcmp_from_Iphlpapi_suc.
mov ebx, 1
call fcn.18000b040
jmp 0x180001f08
lea rcx, str.InitIcmp_from_Iphlpapi_error.
call fcn.18000b040
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
jmp 0x180001e62
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.InitIcmp_load_Iphlpapi_error:_d.
mov edx, eax
call fcn.18000b040
lea rcx, str.icmp.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rdi, rax
test rax, rax
je 0x180001ef4
lea rdx, str.IcmpCreateFile
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.IcmpCloseHandle
mov rcx, rdi
mov qword [0x1803cac48], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, str.IcmpSendEcho
mov rcx, rdi
mov qword [0x1803cac40], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp qword [0x1803cac48], rbx
mov qword [0x1803cac38], rax
je 0x180001ee6
cmp qword [0x1803cac40], rbx
je 0x180001ee6
test rax, rax
je 0x180001ee6
lea rcx, str.InitIcmp_from_icmp_suc.
mov ebx, 1
call fcn.18000b040
jmp 0x180001f08
lea rcx, str.InitIcmp_from_icmp_error.
call fcn.18000b040
jmp 0x180001f08
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rcx, str.InitIcmp_load_from_error:_d.
mov edx, eax
call fcn.18000b040
lea rcx, str.InitIcmp_end.
call fcn.18000b040
mov eax, ebx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x180001f30
Capabilities:
Connect socket
Get socket status
Initialize winsock library
Print debug messages
Set socket configuration

Disassembly:
push rbp
push rbx
push rdi
lea rbp, [rsp - 0x720]
sub rsp, 0x820
mov rax, qword [0x1803b0b00]
xor rax, rsp
mov qword [rbp + 0x710], rax
mov rbx, rcx
lea rcx, [rbp + 0x511]
xor edi, edi
xor edx, edx
mov r8d, 0x1ff
mov byte [rbp + 0x510], dil
call fcn.18014af80
lea rdx, [rbp + 0x370]
mov ecx, 0x101
call qword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
jne 0x180002110
movzx eax, word [rbp + 0x370]
mov qword [rsp + 0x848], rsi
cmp al, 1
jne 0x1800020d7
shr ax, 8
cmp al, 1
jne 0x1800020d7
mov qword [rsp + 0x850], r12
mov r12d, 2
lea edx, [rdi + 1]
mov ecx, r12d
xor r8d, r8d
call qword [sym.imp.WS2_32.dll_socket]
mov rcx, rbx
mov dword [rsp + 0x30], 1
mov rsi, rax
call qword [sym.imp.WS2_32.dll_inet_addr]
mov ecx, 0xc25
mov dword [rsp + 0x44], eax
mov word [rsp + 0x40], r12w
call qword [sym.imp.WS2_32.dll_htons]
lea r8, [rsp + 0x30]
mov edx, 0x8004667e
mov rcx, rsi
mov word [rsp + 0x42], ax
call qword [sym.imp.WS2_32.dll_ioctlsocket]
mov r12, qword [rsp + 0x850]
test eax, eax
jne 0x1800020ce
lea r8d, [rdi + 0x10]
lea rdx, [rsp + 0x40]
mov rcx, rsi
call qword [sym.imp.WS2_32.dll_connect]
lea r8, [rsp + 0x30]
mov edx, 0x8004667e
mov rcx, rsi
mov dword [rsp + 0x30], edi
call qword [sym.imp.WS2_32.dll_ioctlsocket]
test eax, eax
jne 0x1800020c5
lea rax, [rsp + 0x38]
lea r9, [rbp + 0x160]
lea r8, [rsp + 0x50]
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x38], 1
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x58], rsi
mov dword [rsp + 0x50], 1
mov qword [rbp + 0x168], rsi
mov dword [rbp + 0x160], 1
call qword [sym.imp.WS2_32.dll_select]
lea rdx, [rsp + 0x50]
mov rcx, rsi
call qword [sym.imp.WS2_32.dll___WSAFDIsSet]
test eax, eax
je 0x1800020bc
mov rcx, rsi
call qword [sym.imp.WS2_32.dll_closesocket]
mov edi, 1
lea rdx, str.ChkHostEnable_IP:_s_port:_d__FD_ISSET_success.
jmp 0x1800020de
lea rdx, str.ChkHostEnable_IP:_s_port:_d__FD_ISSET_error.
jmp 0x1800020de
lea rdx, str.ChkHostEnable_IP:_s_port:_d__ioctlsocket_0_error.
jmp 0x1800020de
lea rdx, str.ChkHostEnable_IP:_s_port:_d__ioctlsocket_1_error.
jmp 0x1800020de
lea rdx, str.ChkHostEnable_IP:_s_port:_d__wVersion__error.
lea rcx, [rbp + 0x510]
mov r9d, 0xc25
mov r8, rbx
call fcn.180147ef4
lea rcx, [rbp + 0x510]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
call qword [sym.imp.WS2_32.dll_WSACleanup]
mov rsi, qword [rsp + 0x848]
jmp 0x180002139
lea rdx, str.ChkHostEnable_IP:_s_port:_d__WSAStartup__error.
lea rcx, [rbp + 0x510]
mov r9d, 0xc25
mov r8, rbx
call fcn.180147ef4
lea rcx, [rbp + 0x510]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringA]
mov eax, edi
mov rcx, qword [rbp + 0x710]
xor rcx, rsp
call fcn.180146c80
add rsp, 0x820
pop rdi
pop rbx
pop rbp
ret
Function at 0x180002160
Capabilities:
Initialize winsock library

Disassembly:
push rbx
sub rsp, 0x1e0
mov qword [rsp + 0x28], 0xfffffffffffffffe
mov rax, qword [0x1803b0b00]
xor rax, rsp
mov qword [rsp + 0x1d0], rax
mov rbx, rcx
mov qword [rsp + 0x20], rcx
mov qword [rcx + 0x18], send
xor eax, eax
mov qword [rcx + 0x10], rax
mov byte [rcx], al
mov qword [rcx + 0x40], send
mov qword [rcx + 0x38], rax
mov byte [rcx + 0x28], al
mov qword [rcx + 0x488], rax
mov qword [rcx + 0x490], rax
mov qword [rcx + 0x498], rax
mov qword [rcx + 0x4a8], rax
mov qword [rcx + 0x4b0], rax
mov qword [rcx + 0x4b8], rax
mov qword [rcx + 0x4e0], 0xf
mov qword [rcx + 0x4d8], rax
mov byte [rcx + 0x4c8], al
mov qword [rcx + 0x508], 0xf
mov qword [rcx + 0x500], rax
mov byte [rcx + 0x4f0], al
add rcx, 0x518
mov qword [rcx + 0x18], send
mov qword [rcx + 0x10], rax
mov byte [rcx], al
mov qword [rbx + 0x558], 0xf
mov qword [rbx + 0x550], rax
mov byte [rbx + 0x540], al
mov qword [rbx + 0x580], 0xf
mov qword [rbx + 0x578], rax
mov byte [rbx + 0x568], al
mov qword [rbx + 0x598], rax
mov qword [rbx + 0x5a0], rax
mov qword [rbx + 0x5a8], rax
mov qword [rbx + 0x5b8], rax
mov qword [rbx + 0x5c0], rax
mov qword [rbx + 0x5c8], rax
xor r8d, r8d
lea rdx, [0x180364c6e]
call fcn.1800081f0
lea rcx, [rbx + 0x50]
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov ecx, 0x102
lea rdx, [rsp + 0x30]
call qword [sym.imp.WS2_32.dll_WSAStartup]
call fcn.180001da0
mov ecx, 0x2800
call fcn.1801474a8
mov qword [rbx + 0x590], rax
xor edx, edx
mov r8d, 0x2800
mov rcx, rax
call fcn.18014af80
nop
mov rax, rbx
mov rcx, qword [rsp + 0x1d0]
xor rcx, rsp
call fcn.180146c80
add rsp, 0x1e0
pop rbx
ret

Function at 0x180002df0
Capabilities:
Get hostname
Resolve dns

Disassembly:
push rsi
sub rsp, 0xb0
mov rax, qword [0x1803b0b00]
xor rax, rsp
mov qword [rsp + 0xa0], rax
xor edx, edx
mov rsi, rcx
lea rcx, [rsp + 0x21]
lea r8d, [rdx + 0x7f]
mov byte [rsp + 0x20], 0
call fcn.18014af80
lea rcx, [rsp + 0x20]
mov edx, 0x80
call qword [sym.imp.WS2_32.dll_gethostname]
cmp eax, 0xffffffff
jne 0x180002e3f
or eax, eax
jmp 0x180002ef7
lea rcx, [rsp + 0x20]
mov qword [rsp + 0xd0], rbp
call qword [sym.imp.WS2_32.dll_gethostbyname]
mov rbp, rax
test rax, rax
je 0x180002eed
mov rcx, qword [rax + 0x18]
mov qword [rsp + 0xc8], rbx
xor ebx, ebx
cmp qword [rcx], rbx
je 0x180002ee5
mov qword [rsp + 0xd8], rdi
mov edi, ebx
nop dword [rax + rax]
test rbx, rbx
je 0x180002e9a
lea rdx, [0x180364678]
mov r8d, 1
mov rcx, rsi
call fcn.1800066b0
mov rax, qword [rbp + 0x18]
mov rcx, qword [rdi + rax]
mov ecx, dword [rcx]
call qword [sym.imp.WS2_32.dll_inet_ntoa]
or rcx, 0xffffffffffffffff
mov rdx, rax
xor eax, eax
mov rdi, rdx
repne scasb al, byte [rdi]
not rcx
lea r8, [rcx - 1]
mov rcx, rsi
call fcn.1800066b0
mov rax, qword [rbp + 0x18]
inc rbx
lea rdi, [rbx*8]
cmp qword [rdi + rax], 0
jne 0x180002e80
mov rdi, qword [rsp + 0xd8]
mov rbx, qword [rsp + 0xc8]
mov rbp, qword [rsp + 0xd0]
xor eax, eax
mov rcx, qword [rsp + 0xa0]
xor rcx, rsp
call fcn.180146c80
add rsp, 0xb0
pop rsi
ret
Function at 0x1800046a0
Capabilities:
Create process on windows

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
lea rbp, [rsp - 0x500]
sub rsp, 0x600
mov rax, qword [0x1803b0b00]
xor rax, rsp
mov qword [rbp + 0x4f0], rax
mov rbx, rcx
mov rsi, rdx
lea rcx, [rbp + 0xf1]
xor edi, edi
xor edx, edx
mov r8d, 0x3ff
mov byte [rbp + 0xf0], dil
call fcn.18014af80
xor eax, eax
lea r8, str._s__f__s___t_jpg__s_460
lea rcx, [rbp + 0xf0]
mov r9, rbx
mov edx, 0x3ff
mov qword [rsp + 0x58], rdi
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], rax
mov qword [rsp + 0x20], rsi
call fcn.180148b60
lea rdx, [rbp + 0xf0]
lea rcx, str.GetSnapshot_use_exe_to_snap:__s
call fcn.18000b040
lea rcx, [rbp - 0x1f]
xor edx, edx
mov r8d, 0x103
mov byte [rbp - 0x20], dil
call fcn.18014af80
lea r8d, [rdi + 0x60]
lea rcx, [rsp + 0x78]
xor edx, edx
call fcn.18014af80
lea rcx, [rbp - 0x20]
mov r8d, 0x104
mov rdx, rbx
mov dword [rsp + 0x70], WSAGetLastError
mov qword [rbp - 0x80], rdi
call fcn.180147d90
lea edx, [rdi + 0x5c]
lea rcx, [rbp - 0x20]
call fcn.180148b38
lea rdx, [rbp + 0xf0]
xor r9d, r9d
mov byte [rax + 1], dil
lea rax, [rsp + 0x58]
xor r8d, r8d
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x70]
mov rcx, rbx
mov qword [rsp + 0x40], rax
lea rax, [rbp - 0x20]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rdi
mov dword [rsp + 0x28], edi
mov dword [rsp + 0x20], edi
call qword [sym.imp.KERNEL32.dll_CreateProcessA]
mov rcx, qword [rsp + 0x58]
test rcx, rcx
je 0x18000480d
or edx, 0xffffffff
mov dword [rsp + 0x50], edi
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rsp + 0x58]
lea rdx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8d, dword [rsp + 0x50]
lea rcx, str.GetSnapshot___s__exit_code:_d__ret:_d
mov r9d, eax
mov rdx, rsi
call fcn.18000b040
mov edi, 1
jmp 0x180004819
lea rcx, str.GetSnapshot_WaitForSingleObject_TimeOut_
call fcn.18000b040
mov rcx, qword [rsp + 0x60]
test rcx, rcx
je 0x180004829
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x58]
test rcx, rcx
je 0x180004839
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, 0x7d0
call qword [sym.imp.KERNEL32.dll_Sleep]
mov eax, edi
mov rcx, qword [rbp + 0x4f0]
xor rcx, rsp
call fcn.180146c80
mov rbx, qword [rsp + 0x630]
add rsp, 0x600
pop rdi
pop rsi
pop rbp
ret