joyce8/EMBER2024-capa huggingface dataset:
Function at 0x18003c2e0
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rdi
push rbp
lea rbp, [rsp - 0x57]
sub rsp, 0xf0
mov rax, qword [0x18006d210]
xor rax, rsp
mov qword [rbp + 0x47], rax
mov eax, dword [rcx]
lea rdi, [rcx + 0x3c]
mov dword [rbp - 0x79], eax
lea rdx, [rbp - 0x39]
mov eax, dword [rcx + 4]
mov rbx, rcx
mov dword [rbp - 0x75], eax
xor r8d, r8d
mov eax, dword [rcx + 8]
mov dword [rbp - 0x71], eax
mov eax, dword [rcx + 0xc]
mov dword [rbp - 0x6d], eax
mov eax, dword [rcx + 0x10]
mov dword [rbp - 0x69], eax
mov eax, dword [rcx + 0x14]
mov dword [rbp - 0x65], eax
mov eax, dword [rcx + 0x18]
mov dword [rbp - 0x61], eax
mov eax, dword [rcx + 0x1c]
mov dword [rbp - 0x5d], eax
mov eax, dword [rcx + 0x20]
mov dword [rbp - 0x59], eax
mov eax, dword [rcx + 0x24]
mov dword [rbp - 0x55], eax
mov eax, dword [rcx + 0x28]
mov dword [rbp - 0x51], eax
mov eax, dword [rcx + 0x2c]
mov dword [rbp - 0x4d], eax
mov eax, dword [rcx + 0x30]
mov dword [rbp - 0x49], eax
mov eax, dword [rcx + 0x34]
mov dword [rbp - 0x45], eax
mov eax, dword [rcx + 0x38]
lea rcx, [rbp - 0x79]
mov dword [rbp - 0x41], eax
mov eax, dword [rdi]
mov dword [rbp - 0x3d], eax
call fcn.18003c4e0
mov r8d, 1
lea rdx, [rbp + 7]
lea rcx, [rbp - 0x39]
call fcn.18003c4e0
mov r8d, 2
lea rdx, [rbp - 0x39]
lea rcx, [rbp + 7]
call fcn.18003c4e0
mov r8d, 3
lea rdx, [rbp + 7]
lea rcx, [rbp - 0x39]
call fcn.18003c4e0
mov r8d, 4
lea rdx, [rbp - 0x39]
lea rcx, [rbp + 7]
call fcn.18003c4e0
mov r8d, 5
lea rdx, [rbp + 7]
lea rcx, [rbp - 0x39]
call fcn.18003c4e0
mov r8d, 6
lea rdx, [rbp - 0x39]
lea rcx, [rbp + 7]
call fcn.18003c4e0
mov r8d, 7
lea rdx, [rbp + 7]
lea rcx, [rbp - 0x39]
call fcn.18003c4e0
mov r8d, 8
lea rdx, [rbp - 0x39]
lea rcx, [rbp + 7]
call fcn.18003c4e0
mov r8d, 9
lea rdx, [rbp - 0x79]
lea rcx, [rbp - 0x39]
call fcn.18003c4e0
lea rax, [rbp - 0x3d]
mov edx, 0x10
cmp rbx, rax
ja 0x18003c43e
xor ecx, ecx
lea rax, [rbp - 0x79]
cmp rdi, rax
jae 0x18003c487
movdqu xmm0, xmmword [rbx]
movdqu xmm1, xmmword [rbp - 0x69]
pxor xmm0, xmmword [rbp - 0x79]
movdqu xmmword [rbx], xmm0
movdqu xmm0, xmmword [rbx + 0x10]
pxor xmm1, xmm0
movdqu xmmword [rbx + 0x10], xmm1
movdqu xmm0, xmmword [rbx + 0x20]
movdqu xmm1, xmmword [rbp - 0x59]
pxor xmm1, xmm0
movdqu xmmword [rbx + 0x20], xmm1
movdqu xmm0, xmmword [rbx + 0x30]
movdqu xmm1, xmmword [rbp - 0x49]
pxor xmm1, xmm0
movdqu xmmword [rbx + 0x30], xmm1
mov rcx, rdx
cmp rcx, rdx
jae 0x18003c4b0
lea r8, [rbp - 0x79]
sub r8, rbx
lea rax, [rbx + rcx*4]
sub rdx, rcx
nop word [rax + rax]
mov ecx, dword [r8 + rax]
xor dword [rax], ecx
lea rax, [rax + 4]
sub rdx, 1
jne 0x18003c4a0
mov rcx, qword [rbp + 0x47]
xor rcx, rsp
call fcn.180043e10
lea r11, [rsp + 0xf0]
mov rbx, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret
Function at 0x140029000
Capabilities:
Encode data using xor

Disassembly:
mov r9, rdx
sub r9, 0x1570
mov ecx, 0xb000
call 0x140029014
pop rax
sub rax, 0x1015
xor byte [rax], 0x4d
dec rax
loop 0x14002901b
jmp r9
Function at 0x140004907
Capabilities:
Delete directory

Disassembly:
push rbp
push r15
xor rax, rax
push rax
push rax
sub rsp, 0x28
call fcn.1400123e0
mov r15, qword [0x14002048c]
cmp r15, 1
jne 0x1400049d6
push qword [0x14002057c]
pop rcx
call fcn.14000d5b4
mov r15, rax
and r15, r15
jle 0x14000496c
mov rcx, qword [0x14002057c]
call fcn.14000d5bc
mov rcx, qword [0x14002057c]
call fcn.14000d5d0
or rax, rax
je 0x14000496c
mov rbp, qword [0x140020584]
push qword [rbp + 0x10]
pop rcx
call fcn.14000da6c
jmp 0x140004949
push qword [0x14002056c]
pop rcx
call fcn.14000d5b4
mov qword [rsp + 0x28], rax
mov r15, qword [rsp + 0x28]
and r15, r15
jle 0x1400049d6
push 5
push 0
push 1
push qword [0x14002056c]
pop rcx
pop rdx
pop r8
pop r9
call fcn.140009070
mov rcx, qword [0x14002056c]
call fcn.14000d5bc
mov rcx, qword [0x14002056c]
call fcn.14000d5d0
or rax, rax
je 0x1400049d6
mov rbp, qword [0x140020574]
push qword [rbp + 0x14]
pop rcx
call sub.KERNEL32.dll_RemoveDirectoryW
jmp 0x1400049b3
mov rax, 1
jmp 0x1400049e2
add rsp, 0x38
pop r15
pop rbp
ret

Function at 0x140006a58
Capabilities:
Get thread local storage value

Disassembly:
sub rsp, 0x48
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x30], rcx
call sub.KERNEL32.dll_GetLastError
mov qword [rsp + 0x38], rax
mov rcx, qword [0x14001f190]
call sub.KERNEL32.dll_TlsGetValue
mov rcx, qword [rsp + 0x30]
mov qword [rax + 0x10], rcx
mov rcx, qword [rsp + 0x38]
call sub.KERNEL32.dll_SetLastError
mov rax, qword [rsp + 0x28]
add rsp, 0x48
ret

Function at 0x14000720c
Capabilities:
Terminate thread

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rdi, rcx
call fcn.14000719c
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateThread]
lea rcx, [0x140021170]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rbx, qword [0x1400205b8]
jmp 0x140007248
cmp qword [rbx + 0x18], rdi
je 0x14000724f
mov rbx, qword [rbx]
test rbx, rbx
jne 0x14000723f
jmp 0x140007269
mov rcx, qword [rbx + 0x10]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rdx, [rbx + 0x10]
lea rcx, [0x1400205b8]
call fcn.140011c68
lea rcx, [0x140021170]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
retf 0xd215
xor esi, ebp
invalid
cmp eax, 0x748b9314
lahf
mov dh, 0x27
mov dh, 0xea
popfq
movsb byte [rdi], byte [rsi]
pop rcx
outsd dx, dword [rsi]
sysexit
invalid
pop rbx
wait
sal byte [rax + 1], 0x65
ret 0x1994
invalid
or al, 0xd5
jl 0x14003f6f1
invalid
mov dl, 0x70
mov bh, 0x43
or eax, 0xc1c01af5
fcompi st(7)
movabs byte [0xec3a7922dc282c88], al
push rsp
push rsi
pop rdi
cmp dword [rsi + 0x67], ebx
mov ss, eax
invalid
mov bl, 0xd7
or ebp, 0xffffffe9
push rsp
adc byte [rdx + 0x4f9b1ae8], bpl
js 0x14003f708
invalid
sti
sbb ah, byte [rdx + 0x29]
or al, dh
adc byte [rax + 0x34], bh
iretd
invalid
Function at 0x180001ee0
Capabilities:
Create thread

Disassembly:
sub rsp, 0x38
test edx, edx
je 0x180001f25
cmp edx, 1
jne 0x180001f1b
call qword [sym.imp.KERNEL32.dll_DisableThreadLibraryCalls]
xor eax, eax
lea r8, [0x180001f60]
mov qword [rsp + 0x28], rax
xor r9d, r9d
xor edx, edx
mov dword [rsp + 0x20], eax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
add rsp, 0x38
ret
call fcn.180039e40
call fcn.18003a1f0
call fcn.1800157b0
call fcn.1800020d0
mov rcx, qword [0x1800a3d00]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_recv]
mov rcx, qword [0x1800a3d18]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_recv]
xor ecx, ecx
call fcn.180056620
int3
Function at 0x180002f40
Capabilities:
Allocate or change rwx memory

Disassembly:
mov qword [rsp + 8], rbx
push rbp
lea rbp, [rsp - 0x57]
sub rsp, 0x90
mov rax, qword [0x1800a1080]
xor rax, rsp
mov qword [rbp + 0x47], rax
mov rcx, qword [0x1800a3e10]
mov dword [rbp - 0x19], 0xb93d8350
mov dword [rbp - 0x15], 0x1000000
mov dword [rbp - 0x11], 0xb8492475
lea rax, [rcx + 0xc1]
mov qword [rbp - 0xd], 0
mov qword [0x1800a3e08], rax
lea rax, [rcx + 0x45]
mov qword [0x1800a3e20], rax
lea rax, [rcx + 0x55]
mov ecx, 0x3e
mov qword [0x1800a3e28], rax
mov dword [rbp - 5], 0x4c008b4d
mov dword [rbp - 1], 0x20244439
mov dword [rbp + 3], 0xff31075
mov dword [rbp + 7], 0x1f1d10
mov dword [rbp + 0xb], 0xff30000
mov dword [rbp + 0xf], 0x271510
mov dword [rbp + 0x13], 0xff580000
mov qword [rbp + 0x17], 0x25
mov dword [rbp + 0x1f], 0
mov word [rbp + 0x23], 0xc300
call fcn.18004f5e8
mov r8d, 0x3e
mov qword [rbp + 0x27], rax
lea rdx, [rbp - 0x19]
mov rcx, rax
lea rbx, [rax + 0x3e]
mov qword [rbp + 0x37], rbx
call fcn.18007ef80
mov rcx, qword [0x1800a3e10]
lea rdx, [rbp + 0x27]
mov qword [rbp + 0x2f], rbx
call fcn.18004e3b0
mov rcx, qword [0x1800a3e10]
mov rdx, qword [0x1800a3db0]
add rcx, 0xc
call fcn.18004e330
mov rbx, qword [0x1800a3e18]
mov edx, 0x3ec
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_IsBadReadPtr]
test eax, eax
jne 0x180003070
lea r9, [rbp + 0x3f]
mov edx, 0x3ec
lea r8d, [rax + 0x40]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov rbx, qword [0x1800a3e18]
mov edx, 8
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_IsBadReadPtr]
test eax, eax
je 0x18000308d
xor edx, edx
jmp 0x180003090
mov rdx, qword [rbx]
mov rcx, qword [0x1800a3e10]
add rcx, 0x35
call fcn.18004e330
mov rdx, qword [0x1800a3e10]
mov rcx, qword [0x1800a3e18]
call fcn.18004e330
mov rcx, qword [rbp + 0x47]
xor rcx, rsp
call fcn.18004f5c0
mov rbx, qword [rsp + 0xa0]
add rsp, 0x90
pop rbp
ret
Function at 0x180006fc0
Capabilities:
Read file on windows

Disassembly:
push rbx
push rsi
push r14
sub rsp, 0x30
mov r14, r8
mov rsi, rdx
mov rbx, rcx
test r8, r8
jg 0x180006fe2
xor eax, eax
add rsp, 0x30
pop r14
pop rsi
pop rbx
ret
cmp qword [rcx + 0x68], 0
mov qword [rsp + 0x28], rbp
mov qword [rsp + 0x20], rdi
je 0x18000705c
mov rdi, r14
mov rcx, rbx
call fcn.180008730
test rax, rax
jle 0x180007034
mov rdx, qword [rbx + 0x38]
cmp rdi, rax
mov rbp, rdi
mov rcx, rsi
cmovge rbp, rax
mov r8, rbp
mov rdx, qword [rdx]
call fcn.18007ef80
mov rax, qword [rbx + 0x50]
sub rdi, rbp
sub dword [rax], ebp
mov rcx, qword [rbx + 0x38]
movsxd rax, ebp
add qword [rcx], rax
jmp 0x18000704c
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0x38]
cmp eax, 0xffffffff
je 0x180007054
mov byte [rsi], al
dec rdi
mov ebp, 1
add rsi, rbp
test rdi, rdi
jg 0x180006ff6
sub r14, rdi
jmp 0x18000713f
mov rax, qword [rcx + 0x38]
mov rbp, r14
mov rdx, qword [rax]
test rdx, rdx
je 0x180007073
mov rax, qword [rcx + 0x50]
mov ecx, dword [rax]
jmp 0x180007075
xor ecx, ecx
movsxd rax, ecx
test ecx, ecx
je 0x1800070a7
cmp rax, r14
mov rdi, r14
mov rcx, rsi
cmovb rdi, rax
mov r8, rdi
call fcn.18007ef80
mov rax, qword [rbx + 0x50]
add rsi, rdi
sub rbp, rdi
sub dword [rax], edi
mov rcx, qword [rbx + 0x38]
movsxd rax, edi
add qword [rcx], rax
cmp qword [rbx + 0x80], 0
je 0x18000713c
mov r8, qword [rbx + 0x18]
lea rax, [rbx + 0x70]
cmp qword [r8], rax
jne 0x1800070e2
mov rcx, qword [rbx + 0x88]
mov rdx, qword [rbx + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rbx + 0x38]
mov qword [rax], rcx
mov rax, qword [rbx + 0x50]
mov dword [rax], edx
cmp rbp, 0xfff
jbe 0x18000711d
nop dword [rax + rax]
mov r9, qword [rbx + 0x80]
mov edx, 1
mov r8d, 0xfff
mov rcx, rsi
call fcn.18005b2e8
add rsi, rax
sub rbp, rax
cmp rax, 0xfff
jne 0x18000713c
cmp rbp, rax
ja 0x1800070f0
test rbp, rbp
je 0x18000713c
mov r9, qword [rbx + 0x80]
mov r8, rbp
mov edx, 1
mov rcx, rsi
call fcn.18005b2e8
sub rbp, rax
sub r14, rbp
mov rbp, qword [rsp + 0x28]
mov rax, r14
mov rdi, qword [rsp + 0x20]
add rsp, 0x30
pop r14
pop rsi
pop rbx
ret

Function at 0x18000c190
Capabilities:
Allocate or change rwx memory

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
movaps xmmword [rsp + 0x30], xmm6
mov rax, qword [0x1800a1080]
xor rax, rsp
mov qword [rsp + 0x28], rax
mov rbx, qword [0x1800a3e28]
lea r9, [rsp + 0x20]
movss xmm6, dword [rcx + 4]
mov edx, 4
mov rdi, rcx
mov rcx, rbx
lea r8d, [rdx + 0x3c]
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov r8d, dword [rsp + 0x20]
lea rcx, [rbx + 1]
lea r9, [rsp + 0x20]
movss dword [rbx], xmm6
mov edx, 4
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov rbx, qword [0x1800a3e20]
lea r9, [rsp + 0x20]
movss xmm6, dword [rdi]
mov edx, 4
mov rcx, rbx
lea r8d, [rdx + 0x3c]
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov r8d, dword [rsp + 0x20]
lea rcx, [rbx + 1]
lea r9, [rsp + 0x20]
movss dword [rbx], xmm6
mov edx, 4
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.18004f5c0
mov rbx, qword [rsp + 0x50]
movaps xmm6, xmmword [rsp + 0x30]
add rsp, 0x40
pop rdi
ret
Function at 0x18000c350
Capabilities:
Connect socket

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x40
mov rax, qword [0x1800a1080]
xor rax, rsp
mov qword [rsp + 0x30], rax
mov edi, dword [0x1800a3ef8]
mov edx, 1
mov rbx, rcx
mov esi, 2
mov ecx, esi
lea r8d, [rdx + 5]
call qword [sym.imp.WS2_32.dll_socket]
mov qword [0x1800a3f48], rax
test rax, rax
jne 0x18000c3dc
mov rdx, qword [rbx + 0x18]
cmp rdx, 0xf
jbe 0x18000c3d3
mov rcx, qword [rbx]
inc rdx
cmp rdx, 0x1000
jb 0x18000c3ce
mov r8, qword [rcx - 8]
add rdx, 0x27
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x18000c4d9
mov rcx, r8
call fcn.18004f5e0
xor edi, edi
xor al, al
jmp 0x18000c4ad
movzx ecx, di
mov word [rsp + 0x20], si
call qword [sym.imp.WS2_32.dll_htons]
cmp qword [rbx + 0x18], 0xf
mov rcx, rbx
mov word [rsp + 0x22], ax
jbe 0x18000c3fc
mov rcx, qword [rbx]
call qword [sym.imp.WS2_32.dll_inet_addr]
mov rcx, qword [0x1800a3f48]
lea rdx, [rsp + 0x20]
mov r8d, reloc.WS2_32.dll_recv
mov dword [rsp + 0x24], eax
call qword [sym.imp.WS2_32.dll_connect]
cmp eax, 0xffffffff
jne 0x18000c473
mov rcx, qword [0x1800a3f48]
call qword [sym.imp.WS2_32.dll_closesocket]
mov rdx, qword [rbx + 0x18]
xor edi, edi
mov qword [0x1800a3f48], rdi
cmp rdx, 0xf
jbe 0x18000c46f
mov rcx, qword [rbx]
inc rdx
cmp rdx, 0x1000
jb 0x18000c46a
mov r8, qword [rcx - 8]
add rdx, 0x27
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x18000c4d9
mov rcx, r8
call fcn.18004f5e0
xor al, al
jmp 0x18000c4ad
mov rdx, qword [rbx + 0x18]
cmp rdx, 0xf
jbe 0x18000c4a9
mov rcx, qword [rbx]
inc rdx
cmp rdx, 0x1000
jb 0x18000c4a4
mov r8, qword [rcx - 8]
add rdx, 0x27
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x18000c4d9
mov rcx, r8
call fcn.18004f5e0
xor edi, edi
mov al, 1
mov byte [rbx], dil
mov qword [rbx + 0x18], recv
mov qword [rbx + 0x10], rdi
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.18004f5c0
mov rbx, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret
call fcn.18005baf8
int3
Function at 0x18000c4e0
Capabilities:
Receive data
Receive data on socket

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r14
push r15
mov rbp, rsp
sub rsp, 0x60
mov rax, qword [0x1800a1080]
xor rax, rsp
mov qword [rbp - 0x10], rax
mov r15, rcx
xor eax, eax
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x28], xmm1
mov qword [rbp - 0x18], rax
mov ecx, 0xa00027
call fcn.18004f5e8
test rax, rax
je 0x18000c697
lea rsi, [rax + 0x27]
and rsi, 0xffffffffffffffe0
mov qword [rsi - 8], rax
mov qword [rbp - 0x28], rsi
lea r14, [rsi + 0xa00000]
mov qword [rbp - 0x18], r14
xor edx, edx
mov r8d, 0xa00000
mov rcx, rsi
call fcn.18007f620
mov qword [rbp - 0x20], r14
xor eax, eax
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x40], xmm1
mov qword [rbp - 0x30], rax
xor r9d, r9d
mov r8d, 0xa00000
mov rdx, rsi
mov rcx, qword [0x1800a3f48]
call qword [sym.imp.WS2_32.dll_recv]
test eax, eax
jle 0x18000c5e4
movsxd rdi, eax
mov rbx, rsi
mov rcx, qword [rbp - 0x38]
cmp rcx, qword [rbp - 0x30]
je 0x18000c5a9
movzx eax, byte [rbx]
mov byte [rcx], al
mov rcx, qword [rbp - 0x38]
inc rcx
mov qword [rbp - 0x38], rcx
jmp 0x18000c5bc
mov r8, rbx
mov rdx, rcx
lea rcx, [rbp - 0x40]
call fcn.1800112a0
mov rcx, qword [rbp - 0x38]
inc rbx
sub rdi, 1
jne 0x18000c591
lea rax, [rbp - 0x40]
cmp r15, rax
je 0x18000c5e0
mov rdx, qword [rbp - 0x40]
sub rcx, rdx
mov r8, rcx
mov rcx, r15
call fcn.180010c10
mov bl, 1
jmp 0x18000c5f3
xor r8d, r8d
xor edx, edx
mov rcx, r15
call fcn.180010c10
xor bl, bl
mov rcx, qword [rbp - 0x40]
test rcx, rcx
je 0x18000c639
mov rdx, qword [rbp - 0x30]
sub rdx, rcx
mov rax, rcx
cmp rdx, 0x1000
jb 0x18000c624
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18000c691
call fcn.18004f5e0
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x40], xmm0
mov qword [rbp - 0x30], 0
sub r14, rsi
cmp r14, 0x1000
jb 0x18000c65d
add r14, 0x27
mov rdx, qword [rsi - 8]
sub rsi, rdx
lea rcx, [rsi - 8]
cmp rcx, 0x1f
ja 0x18000c697
mov rsi, rdx
mov rdx, r14
mov rcx, rsi
call fcn.18004f5e0
movzx eax, bl
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.18004f5c0
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
call fcn.18005baf8
nop
call fcn.18005baf8
int3
Function at 0x18000cd80
Capabilities:
Initialize winsock library

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r14
sub rsp, 0x1f0
mov rax, qword [0x1800a1080]
xor rax, rsp
mov qword [rsp + 0x1e0], rax
mov rdi, r9
mov rsi, rcx
mov qword [rsp + 0x20], rcx
mov qword [rsp + 0x28], r9
mov rbx, qword [rsp + 0x230]
mov qword [rsp + 0x30], rbx
mov ecx, 0x101
lea rdx, [rsp + 0x40]
call qword [sym.imp.WS2_32.dll_WSAStartup]
lea r14, [0x1800a1d68]
cmp r14, rsi
je 0x18000ce30
mov r9, rsi
cmp qword [rsi + 0x18], 0xf
jbe 0x18000cded
mov r9, qword [rsi]
mov rbp, qword [rsi + 0x10]
mov rax, qword [0x1800a1d80]
cmp rbp, rax
ja 0x18000ce25
cmp rax, 0xf
cmova r14, qword [0x1800a1d68]
mov qword [0x1800a1d78], rbp
mov r8, rbp
mov rdx, r9
mov rcx, r14
call fcn.18007ef80
mov byte [r14 + rbp], 0
jmp 0x18000ce30
mov rdx, rbp
mov rcx, r14
call fcn.180010f50
mov dword [0x1800a3ef8], 0x458
mov dword [0x1800a3d8c], 1
lea r14, [0x1800a1da8]
cmp r14, rdi
je 0x18000cea0
mov r9, rdi
cmp qword [rdi + 0x18], 0xf
jbe 0x18000ce5d
mov r9, qword [rdi]
mov rbp, qword [rdi + 0x10]
mov rax, qword [0x1800a1dc0]
cmp rbp, rax
ja 0x18000ce95
cmp rax, 0xf
cmova r14, qword [0x1800a1da8]
mov qword [0x1800a1db8], rbp
mov r8, rbp
mov rdx, r9
mov rcx, r14
call fcn.18007ef80
mov byte [r14 + rbp], 0
jmp 0x18000cea0
mov rdx, rbp
mov rcx, r14
call fcn.180010f50
lea r14, [0x1800a1d88]
cmp r14, rbx
je 0x18000cefc
mov r9, rbx
cmp qword [rbx + 0x18], 0xf
jbe 0x18000ceb9
mov r9, qword [rbx]
mov rbp, qword [rbx + 0x10]
mov rax, qword [0x1800a1da0]
cmp rbp, rax
ja 0x18000cef1
cmp rax, 0xf
cmova r14, qword [0x1800a1d88]
mov qword [0x1800a1d98], rbp
mov r8, rbp
mov rdx, r9
mov rcx, r14
call fcn.18007ef80
mov byte [r14 + rbp], 0
jmp 0x18000cefc
mov rdx, rbp
mov rcx, r14
call fcn.180010f50
lea rcx, [0x1800a3f98]
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
nop
mov rdx, qword [rsi + 0x18]
cmp rdx, 0xf
jbe 0x18000cf44
mov rcx, qword [rsi]
inc rdx
cmp rdx, 0x1000
jb 0x18000cf3f
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x18000d017
mov rcx, r8
call fcn.18004f5e0
xor ebp, ebp
mov qword [rsi + 0x10], rbp
mov qword [rsi + 0x18], recv
mov byte [rsi], bpl
mov rdx, qword [rdi + 0x18]
cmp rdx, 0xf
jbe 0x18000cf8f
mov rcx, qword [rdi]
inc rdx
cmp rdx, 0x1000
jb 0x18000cf8a
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x18000d00b
mov rcx, r8
call fcn.18004f5e0
mov qword [rdi + 0x10], rbp
mov qword [rdi + 0x18], recv
mov byte [rdi], 0
mov rdx, qword [rbx + 0x18]
cmp rdx, 0xf
jbe 0x18000cfd4
inc rdx
mov rcx, qword [rbx]
cmp rdx, 0x1000
jb 0x18000cfcf
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x18000d011
mov rcx, r8
call fcn.18004f5e0
mov qword [rbx + 0x10], rbp
mov qword [rbx + 0x18], recv
mov byte [rbx], 0
mov rcx, qword [rsp + 0x1e0]
xor rcx, rsp
call fcn.18004f5c0
lea r11, [rsp + 0x1f0]
mov rbx, qword [r11 + 0x28]
mov rbp, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret
call fcn.18005baf8
nop
call fcn.18005baf8
nop
call fcn.18005baf8
int3
Function at 0x1800105b0
Capabilities:
Read .ini file

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x478
mov rax, qword [0x1800a1080]
xor rax, rsp
mov qword [rsp + 0x460], rax
mov rdi, r9
mov rsi, r8
mov r14, rdx
mov rbp, rcx
mov qword [rsp + 0x38], rcx
mov qword [rsp + 0x38], rdx
mov qword [rsp + 0x40], r8
mov qword [rsp + 0x48], r9
mov rbx, qword [rsp + 0x4d0]
mov qword [rsp + 0x50], rbx
xor r15d, r15d
mov rax, rdx
cmp qword [rdx + 0x18], 0xf
jbe 0x18001060f
mov rax, qword [rdx]
mov r8, rbx
cmp qword [rbx + 0x18], 0xf
jbe 0x18001061c
mov r8, qword [rbx]
mov rdx, rdi
cmp qword [r9 + 0x18], 0xf
jbe 0x180010629
mov rdx, qword [r9]
mov rcx, rsi
cmp qword [rsi + 0x18], 0xf
jbe 0x180010636
mov rcx, qword [rsi]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0x400
lea r9, [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
xorps xmm0, xmm0
movups xmmword [rbp], xmm0
mov qword [rbp + 0x10], r15
mov qword [rbp + 0x18], r15
lea rax, [rsp + 0x60]
mov r8, 0xffffffffffffffff
nop dword [rax]
inc r8
cmp byte [rax + r8], 0
jne 0x180010670
lea rdx, [rsp + 0x60]
mov rcx, rbp
call fcn.180008c20
nop
mov rdx, qword [r14 + 0x18]
cmp rdx, 0xf
jbe 0x1800106c2
mov rcx, qword [r14]
inc rdx
cmp rdx, 0x1000
jb 0x1800106bd
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x1800107d4
mov rcx, r8
call fcn.18004f5e0
mov qword [r14 + 0x10], r15
mov qword [r14 + 0x18], recv
mov byte [r14], 0
mov rdx, qword [rsi + 0x18]
cmp rdx, 0xf
jbe 0x18001070c
mov rcx, qword [rsi]
inc rdx
cmp rdx, 0x1000
jb 0x180010707
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x1800107da
mov rcx, r8
call fcn.18004f5e0
mov qword [rsi + 0x10], r15
mov qword [rsi + 0x18], recv
mov byte [rsi], 0
mov rdx, qword [rdi + 0x18]
cmp rdx, 0xf
jbe 0x180010751
mov rcx, qword [rdi]
inc rdx
cmp rdx, 0x1000
jb 0x18001074c
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x1800107c8
mov rcx, r8
call fcn.18004f5e0
mov qword [rdi + 0x10], r15
mov qword [rdi + 0x18], recv
mov byte [rdi], 0
mov rdx, qword [rbx + 0x18]
cmp rdx, 0xf
jbe 0x180010796
inc rdx
mov rcx, qword [rbx]
cmp rdx, 0x1000
jb 0x180010791
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x1800107ce
mov rcx, r8
call fcn.18004f5e0
mov qword [rbx + 0x10], r15
mov qword [rbx + 0x18], recv
mov byte [rbx], 0
mov rax, rbp
mov rcx, qword [rsp + 0x460]
xor rcx, rsp
call fcn.18004f5c0
add rsp, 0x478
pop r15
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret
call fcn.18005baf8
nop
call fcn.18005baf8
nop
call fcn.18005baf8
nop
call fcn.18005baf8
int3
Function at 0x180012d00
Capabilities:
Hash data with crc32

Disassembly:
mov qword [rsp + 8], rbx
mov r11d, r8d
mov r10, rdx
not r11d
mov r9, rcx
mov eax, r11d
test rdx, rdx
je 0x180012d5d
lea rbx, [0x18008cb70]
movzx r8d, byte [r9]
lea r9, [r9 + 1]
dec r10
cmp r8b, 0x23
jne 0x180012d44
cmp r10, 2
jb 0x180012d44
cmp byte [r9], r8b
jne 0x180012d44
cmp byte [r9 + 1], r8b
cmove eax, r11d
movzx edx, al
xor rdx, r8
shr eax, 8
xor eax, dword [rbx + rdx*4]
test r10, r10
jne 0x180012d20
not eax
mov rbx, qword [rsp + 8]
ret
movzx r8d, byte [rcx]
inc r9
test r8b, r8b
je 0x180012d9f
lea rbx, [0x18008cb70]
cmp r8b, 0x23
jne 0x180012d83
cmp byte [r9], r8b
jne 0x180012d83
cmp byte [r9 + 1], r8b
cmove eax, r11d
movzx edx, al
movzx ecx, r8b
movzx r8d, byte [r9]
xor rdx, rcx
shr eax, 8
inc r9
xor eax, dword [rbx + rdx*4]
test r8b, r8b
jne 0x180012d70
mov rbx, qword [rsp + 8]
not eax
ret

Function at 0x180012ee0
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
push r14
sub rsp, 0x20
mov r14, r8
test r8, r8
je 0x180012efa
mov qword [r8], 0
lea rdx, [0x180090e08]
call fcn.180012db0
mov rbx, rax
test rax, rax
jne 0x180012f1a
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop r14
ret
mov qword [rsp + 0x30], rsi
mov rcx, rbx
mov qword [rsp + 0x38], rdi
call fcn.18005d110
mov esi, eax
cmp eax, 0xffffffff
je 0x180012fe8
xor edx, edx
mov rcx, rbx
lea r8d, [rdx + 2]
call fcn.18005b6b8
test eax, eax
jne 0x180012fe8
mov rcx, rbx
call fcn.18005d110
movsxd rdi, eax
cmp edi, 0xffffffff
je 0x180012fe8
xor r8d, r8d
mov edx, esi
mov rcx, rbx
call fcn.18005b6b8
test eax, eax
jne 0x180012fe8
cmp rdi, 0xffffffffffffffff
je 0x180012fe8
mov rax, qword [0x1800a3fc8]
test rax, rax
je 0x180012f8a
inc dword [rax + 0x3b4]
mov rcx, rdi
call fcn.180062e58
mov rsi, rax
test rax, rax
je 0x180012fe8
mov r9, rbx
mov r8, rdi
mov edx, 1
mov rcx, rax
call fcn.18005b2e8
mov rcx, rbx
cmp rax, rdi
je 0x180012fd6
call fcn.180056dc0
mov rax, qword [0x1800a3fc8]
test rax, rax
je 0x180012fcc
dec dword [rax + 0x3b4]
mov rcx, rsi
call fcn.18005aec4
jmp 0x180012ff0
call fcn.180056dc0
test r14, r14
je 0x180012fe3
mov qword [r14], rdi
mov rax, rsi
jmp 0x180012ff2
mov rcx, rbx
call fcn.180056dc0
xor eax, eax
mov rsi, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop r14
ret