joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180076260
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push rbx
sub rsp, 0x20
mov r9d, 0x270
mov rbx, rcx
cmp dword [rcx], r9d
jne 0x1800762b3
lea r8, [rcx + 8]
mov edx, dword [r8 - 4]
xor edx, dword [r8]
lea r8, [r8 + 4]
btr edx, 0x1f
xor edx, dword [r8 - 8]
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r8 + 0x62c]
xor ecx, edx
mov dword [r8 + 0x9b8], ecx
sub r9, 1
jne 0x180076278
jmp 0x1800762c0
cmp dword [rcx], 0x4e0
jb 0x1800762c0
call fcn.18007f678
mov eax, dword [rbx]
mov edx, dword [rbx + rax*4 + 4]
inc eax
mov dword [rbx], eax
mov ecx, edx
mov eax, dword [rbx + 0x1384]
shr ecx, 0xb
and eax, ecx
xor edx, eax
mov eax, edx
and eax, 0xff3a58ad
shl eax, 7
xor edx, eax
mov eax, edx
and eax, 0xffffdf8c
shl eax, 0xf
xor edx, eax
mov eax, edx
shr eax, 0x12
xor eax, edx
add rsp, 0x20
pop rbx
ret

Function at 0x1800770b4
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push r14
mov rbp, rsp
sub rsp, 0x60
lea rax, [rbp - 0x20]
mov qword [rbp + 0x20], rax
xorps xmm0, xmm0
movups xmmword [rbp - 0x20], xmm0
and qword [rbp - 0x10], 0
and qword [rbp - 8], 0
lea rsi, [0x18019c490]
or rbx, 0xffffffffffffffff
mov r8, rbx
inc r8
cmp byte [rsi + r8], 0
jne 0x1800770eb
mov rdx, rsi
lea rcx, [rbp - 0x20]
call fcn.180015834
nop
xorps xmm0, xmm0
movups xmmword [rbp - 0x40], xmm0
and qword [rbp - 0x30], 0
and qword [rbp - 0x28], 0
lea r14, [0x18019be90]
inc rbx
cmp byte [r14 + rbx], 0
jne 0x18007711a
mov r8, rbx
mov rdx, r14
lea rcx, [rbp - 0x40]
call fcn.180015834
nop
lea r8, [rbp - 0x20]
lea rdx, [rbp - 0x40]
lea rcx, [0x18019c160]
call fcn.1800048c0
cmp byte [0x18019c398], 0
je 0x18007723f
movabs rax, 0xd3bffb32abbbb74b
mov qword [rbp - 0x20], rax
movabs rcx, 0x5685a947535281ac
mov qword [rbp - 0x18], rcx
movabs rax, 0xd3bffb5cc2dcd807
mov qword [rbp - 0x40], rax
mov qword [rbp - 0x38], rcx
movaps xmm0, xmmword [rbp - 0x40]
xorps xmm0, xmmword [rbp - 0x20]
movdqa xmmword [rbp - 0x20], xmm0
lea r8, [0x18017906c]
lea rdx, [rbp - 0x20]
lea rcx, [0x18019bfd0]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fopen_s]
xor r8d, r8d
xor edx, edx
mov rcx, qword [0x18019bfd0]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
mov r9, qword [0x18019bfd0]
mov ebx, 1
mov r8d, ebx
mov edx, 0xff
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
mov r9, qword [0x18019bfd0]
mov r8d, ebx
lea edx, [rbx + 0x18]
mov rcx, rsi
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
mov rcx, qword [0x18019bfd0]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov dword [0x18019bfd8], 2
mov byte [0x18019bfc2], bl
xorps xmm0, xmm0
movups xmmword [rbp - 0x20], xmm0
and qword [rbp - 0x10], 0
and qword [rbp - 8], 0
lea r8d, [rbx + 0x1a]
lea rdx, str.User_Connected_Successfully
lea rcx, [rbp - 0x20]
call fcn.180015834
lea rdx, [rbp - 0x20]
lea rcx, [0x18019c160]
call fcn.180005630
mov rbx, qword [rsp + 0x90]
add rsp, 0x60
pop r14
pop rsi
pop rbp
ret
Function at 0x18007f678
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
mov qword [rsp + 8], rbx
lea r10, [rcx + 0x9c4]
mov r9, rcx
mov r11d, dword [r10]
mov ebx, 0xe3
mov eax, r11d
mov r11d, dword [r10 + 4]
mov edx, eax
lea r10, [r10 + 4]
xor edx, r11d
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r10 + 0x630]
xor ecx, edx
mov dword [r10 - 0x9c4], ecx
sub rbx, 1
jne 0x18007f68f
lea r10, [r9 + 0xd50]
mov ebx, 0x18c
mov r11d, dword [r10]
mov eax, r11d
mov r11d, dword [r10 + 4]
mov edx, eax
lea r10, [r10 + 4]
xor edx, r11d
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
shr edx, 1
and ecx, 0x9908b0df
xor ecx, dword [r10 - 0xd50]
xor ecx, edx
mov dword [r10 - 0x9c4], ecx
sub rbx, 1
jne 0x18007f6da
mov eax, dword [r9 + 0x1380]
mov edx, eax
xor edx, dword [r9 + 4]
btr edx, 0x1f
xor edx, eax
mov eax, edx
and al, 1
neg al
sbb ecx, ecx
and dword [r9], ebx
mov rbx, qword [rsp + 8]
and ecx, 0x9908b0df
xor ecx, dword [r9 + 0x634]
shr edx, 1
xor ecx, edx
mov dword [r9 + 0x9c0], ecx
ret
Function at 0x18007f770
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x30
xor ebp, ebp
cmp byte [0x18019c509], bpl
je 0x18007f953
mov rax, qword [0x18019c550]
test rax, rax
jne 0x18007f83b
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x18]
mov rax, qword [rcx + 0x10]
mov r11, qword [rax]
mov rdx, r11
mov r8, qword [rdx + 0x30]
movsxd rax, dword [r8 + 0x3c]
mov r9d, dword [rax + r8 + 0x88]
add r9, r8
cmp r9, r8
je 0x18007f820
mov r10d, dword [r9 + 0x18]
test r10d, r10d
je 0x18007f820
mov esi, dword [r9 + 0x20]
dec r10d
mov ebx, 0x811c9dc5
lea rax, [rsi + r10*4]
mov ecx, dword [rax + r8]
add rcx, r8
mov al, byte [rcx]
inc rcx
test al, al
je 0x18007f81b
movsx eax, al
xor eax, ebx
imul ebx, eax, 0x1000193
mov al, byte [rcx]
inc rcx
test al, al
jne 0x18007f7fb
cmp ebx, 0x95466b05
je 0x18007f935
test r10d, r10d
jne 0x18007f7df
mov rax, qword [rdx]
mov rdx, rax
cmp rax, r11
je 0x18007f831
cmp qword [rax + 0x30], rbp
jne 0x18007f7ba
mov rax, rbp
mov qword [0x18019c550], rax
mov ecx, dword [0x18019c524]
call rax
test ax, ax
je 0x18007f953
mov rax, qword [0x18019bce0]
mov rcx, qword [rax]
test rcx, rcx
je 0x18007f953
mov r9, qword [rcx + 8]
test r9, r9
je 0x18007f953
mov rax, qword [0x18019bce8]
mov rcx, qword [rax]
test rcx, rcx
je 0x18007f953
mov r8, qword [rcx + 0x18]
test r8, r8
je 0x18007f953
movss xmm3, dword [0x1800d8098]
mov r10d, ebp
mov r11, rbp
movsxd rax, r10d
cmp rax, qword [r8 + 0x108]
jae 0x18007f953
mov rcx, qword [r8 + 0x100]
test rcx, rcx
je 0x18007f929
mov rcx, qword [r11 + rcx]
test rcx, rcx
je 0x18007f929
cmp rcx, r9
je 0x18007f929
mov eax, dword [0x18019bd14]
mov edx, dword [rax + rcx]
test edx, edx
je 0x18007f929
and edx, 0x1fc000
cmp edx, 0x8000
je 0x18007f929
movsd xmm0, qword [r9 + 0x90]
movss xmm1, dword [r9 + 0x98]
movsd qword [rsp + 0x20], xmm0
movss xmm2, dword [rsp + 0x24]
movss xmm0, dword [rsp + 0x20]
addss xmm2, xmm3
movss dword [rcx + 0x90], xmm0
movss dword [rcx + 0x94], xmm2
movss dword [rcx + 0x98], xmm1
mov dword [rcx + 0x280], 0x3dcccccd
inc r10d
add r11, 0x10
jmp 0x18007f89a
mov ecx, dword [r9 + 0x24]
add rcx, r8
movzx edx, word [rcx + r10*2]
mov ecx, dword [r9 + 0x1c]
add rcx, r8
mov eax, dword [rcx + rdx*4]
add rax, r8
jmp 0x18007f834
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
Function at 0x1800815b4
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
mov eax, 0x1400
call fcn.1800d24d0
sub rsp, rax
movaps xmmword [rsp + 0x13f0], xmm6
movaps xmmword [rsp + 0x13e0], xmm7
movaps xmmword [rsp + 0x13d0], xmm9
mov rax, qword [0x18019aa08]
xor rax, rsp
mov qword [rsp + 0x13c0], rax
call sub.MSVCP140.dll_unsigned_int___cdecl_std::_Random_device_void_
or dword [rsp + 0x13b4], 0xffffffff
mov edx, 1
mov dword [rsp + 0x34], eax
mov r8d, 0x270
mov ecx, eax
shr ecx, 0x1e
xor ecx, eax
imul eax, ecx, 0x6c078965
add eax, edx
mov dword [rsp + rdx*4 + 0x34], eax
inc rdx
cmp rdx, r8
jb 0x18008161d
mov rax, qword [0x18019c450]
xor edi, edi
mov rsi, qword [0x18019c448]
sub rax, rsi
mov dword [rsp + 0x30], r8d
sar rax, 3
test rax, rax
je 0x1800817b6
mov r14d, edi
mov ebx, edi
xorps xmm9, xmm9
mov rbp, qword [0x18019c460]
xorps xmm7, xmm7
mov rax, qword [0x18019c478]
movss xmm0, dword [rbx + rsi]
cvtps2pd xmm0, xmm0
mov ecx, dword [r14 + rax]
movss xmm1, dword [rbx + rbp]
cvtps2pd xmm1, xmm1
cvtsi2ss xmm7, ecx
mulsd xmm1, qword [0x1801794b8]
addsd xmm1, xmm0
movss xmm0, dword [rbx + rsi + 4]
cvtps2pd xmm0, xmm0
cvtpd2ps xmm2, xmm1
movss dword [rbx + rsi], xmm2
movss xmm1, dword [rbx + rbp + 4]
cvtps2pd xmm1, xmm1
mulsd xmm1, qword [0x1801794b8]
addsd xmm1, xmm0
cvtpd2ps xmm0, xmm1
movaps xmm1, xmm2
subss xmm1, xmm7
movss dword [rbx + rsi + 4], xmm0
comiss xmm9, xmm1
ja 0x1800816ea
movaps xmm6, xmm7
addss xmm6, xmm2
call fcn.18002221c
comiss xmm6, xmm0
jbe 0x18008172a
movss xmm0, dword [rbx + rbp]
lea rdx, [rsp + 0x30]
xorps xmm0, xmmword [0x1800d9cd0]
lea rcx, [rsp + 0x20]
mov r9d, 0x168
movss dword [rbx + rbp], xmm0
xor r8d, r8d
call fcn.1800754dc
and eax, 1
lea eax, [rax*2 - 1]
movd xmm0, eax
cvtdq2ps xmm0, xmm0
movss dword [rbx + rbp + 4], xmm0
movss xmm0, dword [rbx + rsi + 4]
subss xmm0, xmm7
comiss xmm9, xmm0
ja 0x18008174a
addss xmm7, dword [rbx + rsi + 4]
call fcn.1800221ec
comiss xmm7, xmm0
jbe 0x18008178b
movss xmm0, dword [rbx + rbp + 4]
lea rdx, [rsp + 0x30]
xorps xmm0, xmmword [0x1800d9cd0]
lea rcx, [rsp + 0x20]
mov r9d, 0x168
movss dword [rbx + rbp + 4], xmm0
xor r8d, r8d
call fcn.1800754dc
and eax, 1
lea eax, [rax*2 - 1]
movd xmm0, eax
cvtdq2ps xmm0, xmm0
movss dword [rbx + rbp], xmm0
mov rcx, qword [0x18019c450]
inc edi
mov rsi, qword [0x18019c448]
add rbx, 8
sub rcx, rsi
movsxd rax, edi
sar rcx, 3
add r14, 4
cmp rax, rcx
jb 0x180081666
mov rcx, qword [rsp + 0x13c0]
xor rcx, rsp
call fcn.1800d22b0
lea r11, [rsp + 0x1400]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
movaps xmm6, xmmword [r11 - 0x10]
movaps xmm7, xmmword [r11 - 0x20]
movaps xmm9, xmmword [r11 - 0x30]
mov rsp, r11
pop r14
ret
Function at 0x180083914
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
mov qword [rsp + 8], rbx
push rbp
lea rbp, [rsp - 0x12f0]
mov eax, 0x13f0
call fcn.1800d24d0
sub rsp, rax
movaps xmmword [rsp + 0x13e0], xmm6
mov rax, qword [0x18019aa08]
xor rax, rsp
mov qword [rbp + 0x12d0], rax
call sub.MSVCP140.dll_unsigned_int___cdecl_std::_Random_device_void_
or dword [rbp + 0x12c4], 0xffffffff
mov edx, 1
mov dword [rsp + 0x44], eax
mov r8d, 0x270
mov ecx, eax
shr ecx, 0x1e
xor ecx, eax
imul eax, ecx, 0x6c078965
add eax, edx
mov dword [rsp + rdx*4 + 0x44], eax
inc rdx
cmp rdx, r8
jb 0x180083963
mov dword [rsp + 0x40], r8d
mov ebx, Ordinal_301
mov dword [rsp + 0x20], 3
mov r9d, 0x438
lea rdx, [rsp + 0x40]
xor r8d, r8d
lea rcx, [rsp + 0x38]
call fcn.1800754dc
mov r9d, 0x7bc
lea rdx, [rsp + 0x40]
xor r8d, r8d
lea rcx, [rsp + 0x38]
movd xmm6, eax
cvtdq2ps xmm6, xmm6
call fcn.1800754dc
mov rdx, qword [0x18019c450]
cmp rdx, qword [0x18019c458]
movd xmm0, eax
cvtdq2ps xmm0, xmm0
movss dword [rsp + 0x28], xmm6
movss dword [rsp + 0x24], xmm0
je 0x180083a01
unpcklps xmm0, xmm6
movsd qword [rdx], xmm0
add qword [0x18019c450], 8
movsd qword [rsp + 0x24], xmm0
jmp 0x180083a12
lea r8, [rsp + 0x24]
lea rcx, [0x18019c448]
call fcn.180075380
mov r9d, 1
lea rdx, [rsp + 0x40]
xor r8d, r8d
lea rcx, [rsp + 0x38]
call fcn.1800754dc
neg eax
lea rdx, [rsp + 0x40]
mov r9d, 1
sbb ecx, ecx
xor r8d, r8d
and ecx, 2
dec ecx
movd xmm6, ecx
lea rcx, [rsp + 0x38]
cvtdq2ps xmm6, xmm6
call fcn.1800754dc
mov rdx, qword [0x18019c468]
neg eax
sbb ecx, ecx
and ecx, 2
movss dword [rsp + 0x30], xmm6
dec ecx
cmp rdx, qword [0x18019c470]
movd xmm0, ecx
cvtdq2ps xmm0, xmm0
movss dword [rsp + 0x2c], xmm0
je 0x180083a95
unpcklps xmm0, xmm6
movsd qword [rdx], xmm0
add qword [0x18019c468], 8
movsd qword [rsp + 0x2c], xmm0
jmp 0x180083aa6
lea r8, [rsp + 0x2c]
lea rcx, [0x18019c460]
call fcn.180075380
mov rdx, qword [0x18019c480]
cmp rdx, qword [0x18019c488]
je 0x180083ac6
mov dword [rdx], 3
add qword [0x18019c480], 4
jmp 0x180083ad7
lea r8, [rsp + 0x20]
lea rcx, [0x18019c478]
call fcn.18005e914
sub rbx, 1
jne 0x180083990
mov rcx, qword [rbp + 0x12d0]
xor rcx, rsp
call fcn.1800d22b0
lea r11, [rsp + 0x13f0]
mov rbx, qword [r11 + 0x10]
movaps xmm6, xmmword [r11 - 0x10]
mov rsp, r11
pop rbp
ret

Function at 0x18008462c
Capabilities:
Enumerate gui resources
Get graphical window text

Disassembly:
sub rsp, 0xd8
mov rax, qword [0x18019aa08]
xor rax, rsp
mov qword [rsp + 0xc0], rax
and qword [rsp + 0x30], 0
lea rdx, [rsp + 0x30]
lea rcx, [0x180084594]
call qword [sym.imp.USER32.dll_EnumWindows]
mov rcx, qword [rsp + 0x30]
test rcx, rcx
jne 0x1800846a3
mov qword [rsp + 0x20], reloc.WLDAP32.dll_Ordinal_200
lea rdx, [rsp + 0x30]
lea rcx, [0x180084594]
call qword [sym.imp.USER32.dll_EnumWindows]
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x28]
call fcn.180074f90
mov rcx, rax
call fcn.1800750a8
mov rcx, qword [rsp + 0x30]
test rcx, rcx
je 0x180084670
mov r8d, 0x80
lea rdx, [rsp + 0x40]
call qword [sym.imp.USER32.dll_GetWindowTextA]
mov rax, qword [rsp + 0x30]
mov rcx, qword [rsp + 0xc0]
xor rcx, rsp
call fcn.1800d22b0
add rsp, 0xd8
ret
Function at 0x180098460
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x30
cmp qword [rcx + 0x718], 0
mov rsi, r9
mov rbp, r8
movsxd rbx, edx
mov rdi, rcx
je 0x1800984be
mov dl, 1
call fcn.180088eb0
mov rax, qword [rdi + 0x670]
mov r9, rsi
mov r8, rbp
mov qword [rsp + 0x20], rax
mov edx, ebx
mov rcx, rdi
call qword [rdi + 0x718]
xor edx, edx
mov rcx, rdi
mov ebx, eax
call fcn.180088eb0
mov eax, ebx
jmp 0x180098502
cmp ebx, 2
ja 0x180098500
mov r9, qword [rdi + 0x668]
lea rdx, [0x18017c6c8]
lea rcx, [rbx + rbx*2]
add rcx, rdx
mov edx, 2
lea r8d, [rdx - 1]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
mov r9, qword [rdi + 0x668]
mov r8d, 1
mov rdx, rsi
mov rcx, rbp
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
xor eax, eax
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret

Function at 0x180098520
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x20], r9
push rdi
sub rsp, 0x160
mov rax, qword [0x18019aa08]
xor rax, rsp
mov qword [rsp + 0x140], rax
cmp byte [rcx + 0xf1e], 0
mov rdi, rcx
jne 0x180098563
cmp qword [rcx + 0x678], 0
je 0x180098640
mov r8, rdx
mov qword [rsp + 0x158], rbx
mov edx, 0x100
lea r9, [rsp + 0x180]
lea rcx, [rsp + 0x30]
call fcn.18009bb30
lea rax, [rsp + 0x30]
mov rbx, 0xffffffffffffffff
inc rbx
cmp byte [rax + rbx], 0
jne 0x180098591
mov rcx, qword [rdi + 0x678]
test rcx, rcx
je 0x1800985d8
cmp byte [rdi + 0x1597], 0
jne 0x1800985d8
lea rdx, [rsp + 0x30]
nop dword [rax]
nop dword [rax + rax]
movzx eax, byte [rdx]
lea rdx, [rdx + 1]
mov byte [rcx], al
lea rcx, [rcx + 1]
test al, al
jne 0x1800985c0
mov byte [rdi + 0x1597], 1
cmp byte [rdi + 0xf1e], 0
je 0x180098638
mov byte [rsp + rbx + 0x30], 0xa
inc rbx
cmp rbx, 0x102
jae 0x180098693
cmp qword [rdi + 0x718], 0
mov byte [rsp + rbx + 0x30], 0
je 0x180098659
mov dl, 1
mov rcx, rdi
call fcn.180088eb0
mov rax, qword [rdi + 0x670]
lea r8, [rsp + 0x30]
mov r9, rbx
mov qword [rsp + 0x20], rax
xor edx, edx
mov rcx, rdi
call qword [rdi + 0x718]
xor edx, edx
mov rcx, rdi
call fcn.180088eb0
mov rbx, qword [rsp + 0x158]
mov rcx, qword [rsp + 0x140]
xor rcx, rsp
call fcn.1800d22b0
add rsp, 0x160
pop rdi
ret
mov r9, qword [rdi + 0x668]
lea rcx, [0x18017c6c8]
mov edx, 2
lea r8d, [rdx - 1]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
mov r9, qword [rdi + 0x668]
lea rcx, [rsp + 0x30]
mov r8d, 1
mov rdx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
jmp 0x180098638
call fcn.1800d2990
int3
Function at 0x1800986a0
Capabilities:
Write file on windows

Disassembly:
test rcx, rcx
je 0x180098806
mov r11, rsp
mov qword [r11 + 0x10], rdx
mov qword [r11 + 0x18], r8
mov qword [r11 + 0x20], r9
push rdi
sub rsp, 0x860
mov rax, qword [0x18019aa08]
xor rax, rsp
mov qword [rsp + 0x840], rax
cmp byte [rcx + 0xf1e], 0
mov rdi, rcx
je 0x1800987ee
mov r8, rdx
mov qword [r11 - 0x10], rbx
mov edx, 0x801
lea r9, [r11 + 0x18]
lea rcx, [rsp + 0x30]
call fcn.18009bb30
movsxd rcx, eax
mov rbx, 0xffffffffffffffff
cmp rcx, 0x801
jb 0x180098761
mov rcx, qword [rsp + 0x878]
mov rax, rbx
nop word [rax + rax]
cmp byte [rcx + rax + 1], 0
lea rax, [rax + 1]
jne 0x180098720
cmp byte [rax + rcx - 1], 0xa
jne 0x180098748
lea r8, str...._n
mov edx, 5
lea rcx, [rsp + 0x82c]
jmp 0x18009875c
lea r8, [0x1800d8f1c]
mov edx, 4
lea rcx, [rsp + 0x82d]
call fcn.18009ba30
lea rax, [rsp + 0x30]
inc rbx
cmp byte [rax + rbx], 0
jne 0x180098766
cmp qword [rdi + 0x718], 0
je 0x1800987ae
mov dl, 1
mov rcx, rdi
call fcn.180088eb0
mov rax, qword [rdi + 0x670]
lea r8, [rsp + 0x30]
mov r9, rbx
mov qword [rsp + 0x20], rax
xor edx, edx
mov rcx, rdi
call qword [rdi + 0x718]
xor edx, edx
mov rcx, rdi
call fcn.180088eb0
jmp 0x1800987e6
mov r9, qword [rdi + 0x668]
lea rcx, [0x18017c6c8]
mov edx, 2
lea r8d, [rdx - 1]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
mov r9, qword [rdi + 0x668]
lea rcx, [rsp + 0x30]
mov r8d, 1
mov rdx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
mov rbx, qword [rsp + 0x858]
mov rcx, qword [rsp + 0x840]
xor rcx, rsp
call fcn.1800d22b0
add rsp, 0x860
pop rdi
ret

Function at 0x1800988a0
Capabilities:
Receive data
Receive data on socket

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, r9
xor r9d, r9d
call qword [sym.imp.WS2_32.dll_recv]
movsxd rcx, eax
cmp rcx, 0xffffffffffffffff
jne 0x1800988e2
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov ecx, gethostname
mov qword [rbx], 0
cmp eax, 0x2733
mov edx, 0x51
cmove ecx, edx
mov eax, ecx
add rsp, 0x20
pop rbx
ret
mov qword [rbx], rcx
xor eax, eax
add rsp, 0x20
pop rbx
ret
Function at 0x180098a80
Capabilities:
Receive data
Receive data on socket
Send data
Send data on socket

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x138
mov rax, qword [0x18019aa08]
xor rax, rsp
mov qword [rsp + 0x120], rax
mov r14, qword [rsp + 0x1a0]
mov rsi, rcx
movsxd rcx, edx
xor r13d, r13d
mov rax, rcx
mov r12, r9
shl rax, 5
mov r15, r8
lea rbx, [rsi + 0x508]
mov rbp, qword [rsi + rcx*8 + 0x4c0]
add rbx, rax
mov rax, qword [rsi + 0x698]
mov rdi, qword [rbx + 8]
sub rdi, qword [rbx + 0x10]
test byte [rax + 0x7c], 3
je 0x180098b87
lea rax, [0x180098930]
cmp qword [rsi + rcx*8 + 0x4e8], rax
jne 0x180098b87
cmp qword [rbx], r13
je 0x180098b0e
test rdi, rdi
je 0x180098b87
mov rdx, 0xffffffffffffffff
xor r9d, r9d
mov r8, rdx
mov rcx, rbp
call fcn.1800a8b30
cmp eax, 0xffffffff
je 0x180098b87
test al, 1
je 0x180098b87
mov rax, qword [rbx]
test rax, rax
jne 0x180098b60
mov rax, qword [rsi]
mov ecx, dword [rax + 0xb70]
add ecx, ecx
movsxd rcx, ecx
mov qword [rbx + 8], rcx
call qword [sub.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov rdi, qword [rbx + 8]
mov qword [rbx], rax
mov qword [rbx + 0x10], r13
mov qword [rbx + 0x18], r13
test rax, rax
je 0x180098b83
mov rdx, qword [rbx + 0x10]
xor r9d, r9d
add rdx, rax
mov r8d, edi
mov rcx, rbp
call qword [sym.imp.WS2_32.dll_recv]
movsxd rcx, eax
test eax, eax
jle 0x180098b87
add qword [rbx + 0x10], rcx
jmp 0x180098b87
mov qword [rbx + 8], r13
xor r9d, r9d
mov r8d, r12d
mov rdx, r15
mov rcx, rbp
call qword [sym.imp.WS2_32.dll_send]
movsxd rdi, eax
mov dword [r14], r13d
cmp rdi, 0xffffffffffffffff
jne 0x180098bf4
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov ebx, eax
cmp eax, 0x2733
jne 0x180098bc0
mov dword [r14], 0x51
mov rax, r13
jmp 0x180098bf7
mov r8d, 0x100
lea rdx, [rsp + 0x20]
mov ecx, ebx
call fcn.180085120
mov rcx, qword [rsi]
lea rdx, str.Send_failure:__s
mov r8, rax
call fcn.180098520
mov rcx, qword [rsi]
mov dword [rcx + 0x11b0], ebx
mov dword [r14], gethostname
mov rax, rdi
mov rcx, qword [rsp + 0x120]
xor rcx, rsp
call fcn.1800d22b0
add rsp, 0x138
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret

Function at 0x180099290
Capabilities:
Receive data
Receive data on socket

Disassembly:
sub rsp, 0x28
cmp byte [rcx + 0x558], 0
je 0x1800992ad
call fcn.180092430
test eax, eax
jne 0x1800992d3
xor al, al
add rsp, 0x28
ret
mov rcx, qword [rcx + 0x4c0]
cmp rcx, 0xffffffffffffffff
je 0x1800992a6
mov r9d, 2
lea rdx, [rsp + 0x30]
lea r8d, [r9 - 1]
call qword [sym.imp.WS2_32.dll_recv]
test eax, eax
je 0x1800992a6
mov al, 1
add rsp, 0x28
ret
Function at 0x18009af00
Capabilities:
Read file on windows

Disassembly:
sub rsp, 0x28
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__read]
cdqe
add rsp, 0x28
ret

Function at 0x18009b210
Capabilities:
Get common file path

Disassembly:
push rbx
push rbp
push rdi
sub rsp, 0x20
mov rbx, rcx
xor ebp, ebp
lea rcx, str.kernel32
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rdi, rax
test rax, rax
jne 0x18009b23a
add rsp, 0x20
pop rdi
pop rbp
pop rbx
ret
lea rdx, str.LoadLibraryExA
mov qword [rsp + 0x48], r14
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x18017cb78]
mov rcx, rbx
mov r14, rax
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strpbrk]
test rax, rax
je 0x18009b29e
mov rcx, rbx
test r14, r14
je 0x18009b288
xor edx, edx
lea r8d, [rdx + 8]
call r14
mov r14, qword [rsp + 0x48]
mov rbp, rax
add rsp, 0x20
pop rdi
pop rbp
pop rbx
ret
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov r14, qword [rsp + 0x48]
mov rbp, rax
add rsp, 0x20
pop rdi
pop rbp
pop rbx
ret
test r14, r14
je 0x18009b2d6
lea rdx, str.AddDllDirectory
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x18009b2d6
xor edx, edx
mov r8d, 0x800
mov rcx, rbx
call r14
mov r14, qword [rsp + 0x48]
mov rbp, rax
add rsp, 0x20
pop rdi
pop rbp
pop rbx
ret
xor edx, edx
mov qword [rsp + 0x50], r15
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
mov r15d, eax
test eax, eax
je 0x18009b398
mov qword [rsp + 0x40], rsi
mov rsi, 0xffffffffffffffff
mov rdx, rsi
nop
inc rdx
cmp byte [rbx + rdx], bpl
jne 0x18009b300
lea ecx, [rax + 1]
add rcx, rdx
call qword [sub.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov rdi, rax
test rax, rax
je 0x18009b38a
mov edx, r15d
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
test eax, eax
je 0x18009b38a
mov rax, rsi
cmp byte [rdi + rax + 1], bpl
lea rax, [rax + 1]
jne 0x18009b330
mov ecx, 0x5c
mov word [rax + rdi], cx
inc rsi
cmp byte [rdi + rsi], bpl
jne 0x18009b344
mov rcx, rdi
sub rcx, rbx
add rcx, rsi
nop word [rax + rax]
movzx eax, byte [rbx]
mov byte [rcx + rbx], al
lea rbx, [rbx + 1]
test al, al
jne 0x18009b360
mov rcx, rdi
test r14, r14
je 0x18009b381
xor edx, edx
lea r8d, [rdx + 8]
call r14
jmp 0x18009b387
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rbp, rax
mov rcx, rdi
call qword [fcn.1800d3a08]
mov rsi, qword [rsp + 0x40]
mov r15, qword [rsp + 0x50]
mov rax, rbp
mov r14, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
pop rbp
pop rbx
ret