joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180012f00
Capabilities:
Send data
Send data on socket

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rbp
push rdi
push r12
push r14
push r15
mov rbp, rsp
sub rsp, 0x70
mov rax, qword [0x180240300]
xor rax, rsp
mov qword [rbp - 0x10], rax
mov rbx, qword [rbp + 0x50]
lea r9, [rbp - 0x18]
xor r15d, r15d
mov r8d, 1
mov qword [rsp + 0x30], r15
mov qword [rsp + 0x28], r15
mov dword [rsp + 0x20], r15d
mov dword [rbp - 0x18], r15d
call qword [sym.imp.WS2_32.dll_WSASend]
mov esi, eax
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov rdx, qword [0x180244b60]
lea r14, [0x180244b58]
movabs r12, 0x4d54ee85da812030
mov dword [rbp - 0x2c], r15d
add rdx, r12
mov edi, eax
cmp rdx, 1
jbe 0x180012f95
mov rcx, qword [0x180244b58]
mov edx, eax
mov r8, qword [rcx + 0x30]
mov rcx, r14
call r8
jmp 0x180012f9a
test edi, edi
setne al
movzx eax, al
movabs r10, 0x4800144005b3
add rax, 2
mov dword [rbp - 0x30], edi
mov qword [rbp - 0x28], r14
movups xmm0, xmmword [rbp - 0x30]
mov qword [rbp - 0x20], rax
movsd xmm1, qword [rbp - 0x20]
movups xmmword [rbx], xmm0
movsd qword [rbx + 0x10], xmm1
mov r9, qword [rbx + 0x10]
cmp r9, 1
je 0x180012fd8
mov eax, dword [rbx]
mov r8d, eax
jmp 0x180013008
mov rcx, qword [rbx + 8]
mov rax, r10
mov r8d, dword [rbx]
mul rcx
mov rax, rcx
sub rax, rdx
shr rax, 1
add rax, rdx
shr rax, 0x14
imul rax, rax, 0x1ffff7
sub rcx, rax
imul eax, ecx, 0x3e8
add eax, r8d
cmp eax, 0x40
jne 0x180013047
mov rcx, qword [0x180244b60]
add rcx, r12
mov dword [rbp - 0x2c], r15d
cmp rcx, 1
jbe 0x18001303c
mov rax, qword [0x180244b58]
mov edx, 0x2746
mov rcx, r14
call qword [rax + 0x30]
mov dword [rbp - 0x30], 0x2746
jmp 0x1800130b4
mov al, 1
mov dword [rbp - 0x30], 0x2746
jmp 0x1800130b4
cmp r9, 1
jne 0x18001307a
mov rcx, qword [rbx + 8]
mov rax, r10
mul rcx
mov rax, rcx
sub rax, rdx
shr rax, 1
add rax, rdx
shr rax, 0x14
imul rax, rax, 0x1ffff7
sub rcx, rax
imul eax, ecx, 0x3e8
add r8d, eax
cmp r8d, 0x4d2
jne 0x1800130d4
mov rcx, qword [0x180244b60]
add rcx, r12
mov dword [rbp - 0x2c], r15d
cmp rcx, 1
jbe 0x1800130ab
mov rax, qword [0x180244b58]
mov edx, 0x274d
mov rcx, r14
call qword [rax + 0x30]
jmp 0x1800130ad
mov al, 1
mov dword [rbp - 0x30], 0x274d
movzx eax, al
mov qword [rbp - 0x28], r14
add rax, 2
movups xmm0, xmmword [rbp - 0x30]
mov qword [rbp - 0x20], rax
movsd xmm1, qword [rbp - 0x20]
movups xmmword [rbx], xmm0
movsd qword [rbx + 0x10], xmm1
test esi, esi
je 0x1800130df
mov eax, 0xffffffff
jmp 0x1800130f6
mov eax, dword [rbp - 0x18]
xorps xmm0, xmm0
movups xmmword [rbx], xmm0
mov qword [rbp - 0x20], r15
movsd xmm0, qword [rbp - 0x20]
movsd qword [rbx + 0x10], xmm0
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.18017b860
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rbp
ret
Function at 0x180013ea0
Capabilities:
Terminate thread

Disassembly:
push rbx
sub rsp, 0x40
mov rax, qword [0x180240300]
xor rax, rsp
mov qword [rsp + 0x30], rax
mov rax, qword [rcx + 0x10]
lea rdx, [rsp + 0x20]
mov qword [rsp + 0x20], rax
mov rbx, rcx
mov rax, qword [rcx + 8]
mov r9d, 0xffffffff
mov ecx, 2
mov qword [rsp + 0x28], rax
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
mov rcx, qword [rbx + 0x10]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
lock xadd dword [0x180251c38], eax
test eax, eax
mov rax, qword [rbx + 8]
je 0x180013f1d
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateThread]
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.18017b860
add rsp, 0x40
pop rbx
ret
xor r8d, r8d
lea rcx, [fcn.1800121c0]
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_QueueUserAPC]
mov rcx, qword [rbx + 8]
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.18017b860
add rsp, 0x40
pop rbx
ret
Function at 0x180017fe0
Capabilities:
Send data
Send data on socket

Disassembly:
push rsi
push rdi
sub rsp, 0x58
mov rax, qword [0x180240300]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov rdi, qword [rsp + 0xa0]
mov r11, r9
mov rax, qword [rcx + 8]
mov r10, r8
mov rsi, rcx
lock inc dword [rax + 0x30]
cmp byte [rsp + 0x98], 0
je 0x180018030
mov rcx, qword [rcx + 8]
xor r9d, r9d
xor r8d, r8d
mov rdx, rdi
call fcn.180014e90
jmp 0x1800180c8
mov rcx, qword [rdx]
cmp rcx, 0xffffffffffffffff
jne 0x180018050
mov rcx, qword [rsi + 8]
xor r9d, r9d
mov r8d, 0x2719
mov rdx, rdi
call fcn.180014e90
jmp 0x1800180c8
xor eax, eax
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x30], rax
lea r9, [rsp + 0x40]
mov dword [rsp + 0x40], eax
mov r8d, r11d
mov eax, dword [rsp + 0x90]
mov rdx, r10
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], eax
call qword [sym.imp.WS2_32.dll_WSASend]
mov ebx, eax
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x4d2
mov ecx, 0x274d
cmove eax, ecx
test ebx, ebx
mov rbx, qword [rsp + 0x50]
je 0x1800180bc
cmp eax, 0x3e5
je 0x1800180bc
mov r9d, dword [rsp + 0x40]
mov r8d, eax
mov rcx, qword [rsi + 8]
mov rdx, rdi
call fcn.180014e90
jmp 0x1800180c8
mov rcx, qword [rsi + 8]
mov rdx, rdi
call fcn.180014e00
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.18017b860
add rsp, 0x58
pop rdi
pop rsi
ret

Function at 0x1800180e0
Capabilities:
Receive data
Receive data on socket

Disassembly:
push rbx
push rdi
sub rsp, 0x58
mov rax, qword [0x180240300]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov rbx, qword [rsp + 0xa0]
mov r11, r9
mov rax, qword [rcx + 8]
mov r10, r8
mov rdi, rcx
lock inc dword [rax + 0x30]
cmp byte [rsp + 0x98], 0
je 0x180018130
mov rcx, qword [rcx + 8]
xor r9d, r9d
xor r8d, r8d
mov rdx, rbx
call fcn.180014e90
jmp 0x1800181e1
mov rcx, qword [rdx]
cmp rcx, 0xffffffffffffffff
jne 0x180018153
mov rcx, qword [rdi + 8]
xor r9d, r9d
mov r8d, 0x2719
mov rdx, rbx
call fcn.180014e90
jmp 0x1800181e1
mov eax, dword [rsp + 0x90]
lea r9, [rsp + 0x40]
xor edx, edx
mov dword [rsp + 0x44], eax
mov qword [rsp + 0x30], rdx
lea rax, [rsp + 0x44]
mov dword [rsp + 0x40], edx
mov r8d, r11d
mov qword [rsp + 0x28], rbx
mov rdx, r10
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x50], rsi
call qword [sym.imp.WS2_32.dll_WSARecv]
mov esi, eax
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x40
jne 0x1800181a2
mov eax, 0x2746
jmp 0x1800181af
cmp eax, 0x4d2
mov ecx, 0x274d
cmove eax, ecx
test esi, esi
mov rsi, qword [rsp + 0x50]
je 0x1800181d5
cmp eax, 0x3e5
je 0x1800181d5
mov r9d, dword [rsp + 0x40]
mov r8d, eax
mov rcx, qword [rdi + 8]
mov rdx, rbx
call fcn.180014e90
jmp 0x1800181e1
mov rcx, qword [rdi + 8]
mov rdx, rbx
call fcn.180014e00
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.18017b860
add rsp, 0x58
pop rdi
pop rbx
ret
Function at 0x180024220
Capabilities:
Encode data using base64

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x30
mov rbp, r9
mov r14, r8
mov rbx, rdx
mov qword [rsp + 0x28], rdx
xor r12d, r12d
mov dword [rsp + 0x20], r12d
xorps xmm0, xmm0
movups xmmword [rdx], xmm0
mov qword [rdx + 0x10], r12
mov qword [rdx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rdx], r12b
mov dword [rsp + 0x20], 1
lea rcx, [r9 + 2]
movabs rax, 0xaaaaaaaaaaaaaaab
mul rcx
shr rdx, 1
shl rdx, 2
mov rcx, rbx
call fcn.18002f610
test rbp, rbp
je 0x18002441c
mov edi, 3
lea r15, [0x1801fdc30]
nop
mov edx, r12d
lea rax, [rdi - 3]
cmp rax, rdi
jae 0x1800242c7
nop dword [rax]
shl edx, 8
cmp rax, rbp
jae 0x1800242bf
movzx ecx, byte [rax + r14]
or edx, ecx
inc rax
cmp rax, rdi
jb 0x1800242b0
movsxd rsi, edx
mov rax, rsi
sar rax, 0x12
and eax, 0x3f
movzx r9d, byte [rax + r15]
mov rcx, qword [rbx + 0x10]
mov rdx, qword [rbx + 0x18]
cmp rcx, rdx
jae 0x180024305
lea rax, [rcx + 1]
mov qword [rbx + 0x10], rax
mov rax, rbx
cmp rdx, 0xf
jbe 0x1800242fa
mov rax, qword [rbx]
mov byte [rax + rcx], r9b
mov byte [rax + rcx + 1], 0
jmp 0x180024315
xor r8d, r8d
mov edx, 1
mov rcx, rbx
call fcn.18003d400
mov rax, rsi
sar rax, 0xc
and eax, 0x3f
movzx r9d, byte [rax + r15]
mov rcx, qword [rbx + 0x10]
mov rdx, qword [rbx + 0x18]
cmp rcx, rdx
jae 0x180024350
lea rax, [rcx + 1]
mov qword [rbx + 0x10], rax
mov rax, rbx
cmp rdx, 0xf
jbe 0x180024345
mov rax, qword [rbx]
mov byte [rax + rcx], r9b
mov byte [rax + rcx + 1], 0
jmp 0x180024360
xor r8d, r8d
mov edx, 1
mov rcx, rbx
call fcn.18003d400
lea rax, [rdi - 2]
cmp rax, rbp
jae 0x18002437a
mov rax, rsi
sar rax, 6
and eax, 0x3f
movzx r9d, byte [rax + r15]
jmp 0x18002437d
mov r9b, 0x3d
mov rcx, qword [rbx + 0x10]
mov rdx, qword [rbx + 0x18]
cmp rcx, rdx
jae 0x1800243a9
lea rax, [rcx + 1]
mov qword [rbx + 0x10], rax
mov rax, rbx
cmp rdx, 0xf
jbe 0x18002439e
mov rax, qword [rbx]
mov byte [rax + rcx], r9b
mov byte [rax + rcx + 1], 0
jmp 0x1800243b9
xor r8d, r8d
mov edx, 1
mov rcx, rbx
call fcn.18003d400
lea rax, [rdi - 1]
cmp rax, rbp
jae 0x1800243cc
and esi, 0x3f
movzx r9d, byte [rsi + r15]
jmp 0x1800243cf
mov r9b, 0x3d
mov rcx, qword [rbx + 0x10]
mov rdx, qword [rbx + 0x18]
cmp rcx, rdx
jae 0x1800243fb
lea rax, [rcx + 1]
mov qword [rbx + 0x10], rax
mov rax, rbx
cmp rdx, 0xf
jbe 0x1800243f0
mov rax, qword [rbx]
mov byte [rax + rcx], r9b
mov byte [rax + rcx + 1], 0
jmp 0x18002440b
xor r8d, r8d
mov edx, 1
mov rcx, rbx
call fcn.18003d400
add rdi, 3
lea rcx, [rdi - 3]
cmp rcx, rbp
jb 0x1800242a0
mov rax, rbx
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x70]
add rsp, 0x30
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret
Function at 0x1800248e0
Capabilities:
Decode data using base64 via winapi
Encrypt data using dpapi

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x80
mov rax, qword [0x180240300]
xor rax, rsp
mov qword [rsp + 0x70], rax
mov rsi, rdx
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x58], xmm1
xor ebp, ebp
mov edi, ebp
mov qword [rsp + 0x68], rbp
mov dword [rsp + 0x50], ebp
mov rcx, rdx
cmp qword [rdx + 0x18], 0xf
jbe 0x18002492c
mov rcx, qword [rdx]
mov qword [rsp + 0x30], rbp
mov qword [rsp + 0x28], rbp
lea rax, [rsp + 0x50]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor edx, edx
mov r8d, 1
call qword [sym.imp.CRYPT32.dll_CryptStringToBinaryA]
test eax, eax
je 0x180024a01
mov edx, dword [rsp + 0x50]
test rdx, rdx
je 0x180024971
lea rcx, [rsp + 0x58]
call fcn.18004b860
mov rdi, qword [rsp + 0x68]
cmp qword [rsi + 0x18], 0xf
jbe 0x18002497b
mov rsi, qword [rsi]
mov qword [rsp + 0x30], rbp
mov qword [rsp + 0x28], rbp
lea rax, [rsp + 0x50]
mov qword [rsp + 0x20], rax
mov rbx, qword [rsp + 0x58]
mov r9, rbx
xor edx, edx
mov r8d, 1
mov rcx, rsi
call qword [sym.imp.CRYPT32.dll_CryptStringToBinaryA]
test eax, eax
je 0x180024a06
lea rax, [rbx + 5]
mov qword [rsp + 0x48], rax
mov eax, dword [rsp + 0x50]
add eax, 0xfffffffb
mov dword [rsp + 0x40], eax
mov ecx, reloc.WS2_32.dll_recv
call fcn.18017bcf4
mov rsi, rax
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], ebp
mov qword [rsp + 0x20], rbp
xor r9d, r9d
xor r8d, r8d
xor edx, edx
lea rcx, [rsp + 0x40]
call qword [sym.imp.CRYPT32.dll_CryptUnprotectData]
test eax, eax
jne 0x180024a09
mov edx, reloc.WS2_32.dll_recv
mov rcx, rsi
call fcn.18017bcc0
jmp 0x180024a06
mov rbx, qword [rsp + 0x58]
mov rsi, rbp
test rbx, rbx
je 0x180024a3d
sub rdi, rbx
mov rax, rbx
cmp rdi, 0x1000
jb 0x180024a32
add rdi, 0x27
mov rbx, qword [rbx - 8]
sub rax, rbx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180024a66
mov rdx, rdi
mov rcx, rbx
call fcn.18017bcc0
mov rax, rsi
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.18017b860
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x10]
mov rbp, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
call fcn.1801b27d8
int3
Function at 0x18002ad20
Capabilities:
Accept command line arguments

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
mov qword [rsp + 0x20], r12
push rbp
push r14
push r15
lea rbp, [rsp - 0x47]
sub rsp, 0xe0
mov rax, qword [0x180240300]
xor rax, rsp
mov qword [rbp + 0x3f], rax
xor ebx, ebx
mov dword [rbp - 0x69], ebx
call qword [sym.imp.KERNEL32.dll_GetCommandLineA]
xorps xmm0, xmm0
movups xmmword [rbp - 1], xmm0
mov qword [rbp + 0xf], rbx
mov qword [rbp + 0x17], rbx
mov r8, 0xffffffffffffffff
inc r8
cmp byte [rax + r8], bl
jne 0x18002ad74
mov rdx, rax
lea rcx, [rbp - 1]
call fcn.180005680
nop
xorps xmm0, xmm0
movups xmmword [rbp - 0x41], xmm0
mov qword [rbp - 0x31], rbx
mov qword [rbp - 0x29], rbx
mov r8d, reloc.WS2_32.dll_recv
lea rdx, str.8dPtXeHtprHxQELs
lea rcx, [rbp - 0x41]
call fcn.180005680
nop
xorps xmm0, xmm0
movups xmmword [rbp - 0x21], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x11], xmm1
mov r8d, 9
lea rdx, str.DowmOB
lea rcx, [rbp - 0x21]
call fcn.180005680
nop
lea rdx, [rbp - 0x21]
lea rcx, [rbp + 0x1f]
call fcn.180020240
nop
xorps xmm0, xmm0
movups xmmword [rbp - 0x61], xmm0
mov qword [rbp - 0x51], rbx
mov esi, reloc.WS2_32.dll_ntohs
mov qword [rbp - 0x49], rsi
mov byte [rbp - 0x61], 0
mov dword [rbp - 0x69], 2
mov rdi, rbx
cmp qword [rbp + 0x2f], rbx
jbe 0x18002ae92
mov r14, qword [rbp - 0x29]
mov r15, qword [rbp - 0x31]
mov r12, qword [rbp - 0x41]
nop dword [rax]
lea rcx, [rbp + 0x1f]
cmp qword [rbp + 0x37], 0xf
cmova rcx, qword [rbp + 0x1f]
lea r8, [rbp - 0x41]
cmp r14, 0xf
cmova r8, r12
xor edx, edx
mov rax, rdi
div r15
movzx r9d, byte [rdx + r8]
xor r9b, byte [rcx + rdi]
cmp rbx, rsi
jae 0x18002ae70
lea rax, [rbx + 1]
mov qword [rbp - 0x51], rax
lea rax, [rbp - 0x61]
cmp rsi, 0xf
cmova rax, qword [rbp - 0x61]
mov byte [rax + rbx], r9b
mov byte [rax + rbx + 1], 0
jmp 0x18002ae81
xor r8d, r8d
mov edx, 1
lea rcx, [rbp - 0x61]
call fcn.18003d400
inc rdi
mov rsi, qword [rbp - 0x49]
mov rbx, qword [rbp - 0x51]
cmp rdi, qword [rbp + 0x2f]
jb 0x18002ae20
lea rcx, [rbp + 0x1f]
call fcn.1800042b0
lea r9, [rbp - 0x61]
cmp rsi, 0xf
cmova r9, qword [rbp - 0x61]
lea rcx, [rbp - 1]
cmp qword [rbp + 0x17], 0xf
cmova rcx, qword [rbp - 1]
mov qword [rsp + 0x20], rbx
xor r8d, r8d
mov rdx, qword [rbp + 0xf]
call fcn.18003d1e0
mov rbx, rax
lea rcx, [rbp - 0x61]
call fcn.1800042b0
nop
lea rcx, [rbp - 0x21]
call fcn.1800042b0
nop
lea rcx, [rbp - 0x41]
call fcn.1800042b0
nop
cmp rbx, 0xffffffffffffffff
setne bl
lea rcx, [rbp - 1]
call fcn.1800042b0
movzx eax, bl
mov rcx, qword [rbp + 0x3f]
xor rcx, rsp
call fcn.18017b860
lea r11, [rsp + 0xe0]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov r12, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
Function at 0x18002b990
Capabilities:
Read file on windows

Disassembly:
push rbx
push r14
push r15
sub rsp, 0x30
mov r15, r8
mov r14, rdx
mov rbx, rcx
test r8, r8
jg 0x18002b9b4
xor eax, eax
add rsp, 0x30
pop r15
pop r14
pop rbx
ret
cmp qword [rcx + 0x68], 0
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x20], rdi
je 0x18002ba42
mov rdi, r15
mov qword [rsp + 0x68], rbp
lea rsi, [rcx + 0x50]
mov rax, qword [rbx + 0x38]
mov rdx, qword [rax]
test rdx, rdx
je 0x18002ba10
mov rax, qword [rsi]
movsxd rcx, dword [rax]
test ecx, ecx
jle 0x18002ba10
cmp rdi, rcx
mov rbp, rdi
cmovge rbp, rcx
mov rcx, r14
mov r8, rbp
call fcn.1801d8b30
mov rax, qword [rsi]
sub rdi, rbp
sub dword [rax], ebp
mov rcx, qword [rbx + 0x38]
movsxd rax, ebp
add qword [rcx], rax
jmp 0x18002ba2d
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + gethostname]
cmp eax, 0xffffffff
je 0x18002ba35
mov byte [r14], al
lea rsi, [rbx + 0x50]
dec rdi
mov ebp, 1
add r14, rbp
test rdi, rdi
jg 0x18002b9d1
mov rbp, qword [rsp + 0x68]
sub r15, rdi
jmp 0x18002bb20
mov rax, qword [rcx + 0x38]
mov rsi, r15
mov rdx, qword [rax]
test rdx, rdx
je 0x18002ba59
mov rax, qword [rcx + 0x50]
mov ecx, dword [rax]
jmp 0x18002ba5b
xor ecx, ecx
movsxd rax, ecx
test ecx, ecx
je 0x18002ba8d
cmp rax, r15
mov rdi, r15
mov rcx, r14
cmovb rdi, rax
mov r8, rdi
call fcn.1801d8b30
mov rax, qword [rbx + 0x50]
add r14, rdi
sub rsi, rdi
sub dword [rax], edi
mov rcx, qword [rbx + 0x38]
movsxd rax, edi
add qword [rcx], rax
cmp qword [rbx + 0x80], 0
je 0x18002bb1d
mov r8, qword [rbx + 0x18]
lea rax, [rbx + 0x70]
cmp qword [r8], rax
jne 0x18002bac8
mov rcx, qword [rbx + 0x88]
mov rdx, qword [rbx + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rbx + 0x38]
mov qword [rax], rcx
mov rax, qword [rbx + 0x50]
mov dword [rax], edx
cmp rsi, 0xfff
jbe 0x18002bafe
mov r9, qword [rbx + 0x80]
mov edx, 1
mov r8d, 0xfff
mov rcx, r14
call fcn.1801bd744
add r14, rax
sub rsi, rax
cmp rax, 0xfff
jne 0x18002bb1d
cmp rsi, rax
ja 0x18002bad1
test rsi, rsi
je 0x18002bb1d
mov r9, qword [rbx + 0x80]
mov r8, rsi
mov edx, 1
mov rcx, r14
call fcn.1801bd744
sub rsi, rax
sub r15, rsi
mov rsi, qword [rsp + 0x28]
mov rax, r15
mov rdi, qword [rsp + 0x20]
add rsp, 0x30
pop r15
pop r14
pop rbx
ret
Function at 0x18002d9a0
Capabilities:
Initialize winsock library

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x200
mov rax, qword [0x180240300]
xor rax, rsp
mov qword [rsp + 0x1f0], rax
movzx ebx, dl
mov rdi, rcx
mov eax, 1
lock xadd dword [0x180251c78], eax
inc eax
cmp eax, 1
jne 0x18002d9ef
mov ecx, 0x202
lea rdx, [rsp + 0x50]
call qword [sym.imp.WS2_32.dll_WSAStartup]
xchg dword [0x180251c7c], eax
test bl, bl
je 0x18002da93
xor ebx, ebx
lock xadd dword [0x180251c7c], ebx
test ebx, ebx
je 0x18002da93
movabs rcx, 0x4d54ee85da812030
mov qword [rsp + 0x210], rsi
add rcx, qword [0x180244b60]
lea rsi, [0x180244b58]
mov dword [rsp + 0x3c], 0
cmp rcx, 1
jbe 0x18002da48
mov rax, qword [0x180244b58]
mov edx, ebx
mov rcx, rsi
call qword [rax + 0x30]
jmp 0x18002da4a
mov al, 1
lea rcx, str.C:UsersAdminDownloads_boost_1_85_0__1__boost_1_85_0_boost_1_85_0_boost_asiodetailimplwinsock_init.ipp
movzx eax, al
add rax, 2
mov qword [rsp + 0x20], rcx
mov qword [rsp + 0x40], rsi
lea rcx, str.void___cdecl_boost::asio::detail::winsock_init_base::throw_on_error_struct_boost::asio::detail::winsock_init_base::data__
mov rsi, qword [rsp + 0x210]
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x48], rax
mov dword [rsp + 0x38], ebx
mov dword [rsp + 0x30], 0x48
mov dword [rsp + 0x34], 0x1a
test al, 1
jne 0x18002dab7
mov rax, rdi
mov rcx, qword [rsp + 0x1f0]
xor rcx, rsp
call fcn.18017b860
mov rbx, qword [rsp + 0x218]
add rsp, 0x200
pop rdi
ret
lea r8, [rsp + 0x20]
lea rdx, str.winsock
lea rcx, [rsp + 0x38]
call fcn.180011eb0
int3
Function at 0x18005f1f0
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x40
cmp byte [rcx + 0x19], 0
mov r12, r9
mov rdi, r8
mov r10, rdx
mov rbp, rcx
jge 0x18005f260
mov rax, qword [rcx + 0x80]
xor ecx, ecx
mov rdx, qword [rax + 0x10]
mov dword [rsp + 0x20], edx
test r8, r8
je 0x18005f24e
nop word [rax + rax]
mov rax, rcx
and eax, 3
movzx eax, byte [rsp + rax + 0x20]
xor byte [r10 + rcx], al
inc rcx
cmp rcx, rdi
jb 0x18005f230
mov rax, qword [rbp + 0x80]
mov rcx, rdi
and ecx, 3
je 0x18005f25c
shl cl, 3
ror rdx, cl
mov qword [rax + 0x10], rdx
mov rax, qword [rbp + 0x80]
mov rdx, r10
mov rbx, qword [rax]
add rbx, 0x50
mov r15, qword [rbx + 0x10]
lea r14, [rbx + 0x10]
mov rcx, rbx
call fcn.180004310
mov r10, qword [rbp + 0x80]
mov rax, qword [r10]
cmp dword [rax + 0x70], 1
jne 0x18005f31a
cmp qword [rbx + 0x18], 0xf
jbe 0x18005f2a7
mov rdx, qword [rbx]
mov rbx, rdx
add rdx, qword [r14]
jmp 0x18005f2ad
mov rdx, qword [r14]
add rdx, rbx
lea rax, [r15 + rbx]
cmp rax, rdx
je 0x18005f31a
lea rbx, [0x1801f54a0]
nop dword [rax]
cmp dword [r10 + 0x18], 0
movzx r8d, byte [rax]
mov r9d, r8d
movzx r11d, byte [r8 + rbx]
je 0x18005f2e3
mov ecx, dword [r10 + 0x1c]
and r9d, 0x3f
shl ecx, 6
or r9d, ecx
jmp 0x18005f2f2
mov r8d, 0xff
mov ecx, r11d
sar r8d, cl
and r9d, r8d
mov dword [r10 + 0x1c], r9d
mov ecx, dword [r10 + 0x18]
add ecx, 0x10
shl ecx, 4
add ecx, r11d
movzx r8d, byte [rcx + rbx]
mov dword [r10 + 0x18], r8d
cmp r8d, 1
je 0x18005f330
inc rax
cmp rax, rdx
jne 0x18005f2c0
sub qword [rbp + 0x30], rdi
mov rax, rdi
add rsp, 0x40
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
mov dword [rsp + 0x28], reloc.WS2_32.dll_recv
call fcn.18001c0a0
mov qword [rsp + 0x30], rax
xor eax, eax
movups xmm0, xmmword [rsp + 0x28]
movups xmmword [r12], xmm0
add rsp, 0x40
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x180080a30
Capabilities:
Encrypt data using salsa20 or chacha

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
sub rsp, 0x20
mov rbp, rdx
mov ebx, ecx
call fcn.1801459d0
test eax, eax
jne 0x180080c35
cmp byte [reloc.WS2_32.dll_accept], al
mov qword [rsp + 0x38], rdi
jne 0x180080a5d
xor edi, edi
jmp 0x180080a79
mov ecx, 5
call qword [0x180241320]
mov rdi, rax
test rax, rax
je 0x180080a79
mov rcx, rax
call qword [0x180241330]
test ebx, ebx
jle 0x180080c18
test rbp, rbp
je 0x180080c18
cmp dword [0x180251aa0], 0
mov qword [rsp + 0x30], rsi
jne 0x180080b9f
call fcn.1801459d0
test eax, eax
je 0x180080ab5
movups xmm0, xmmword [str.expand_32_byte_k]
movaps xmmword [0x180251aa0], xmm0
jmp 0x180080b19
cmp byte [reloc.WS2_32.dll_accept], 0
jne 0x180080ac7
mov rsi, qword [0x1802517e8]
jmp 0x180080b06
mov ecx, 2
mov qword [rsp + 0x40], r14
call qword [0x180241320]
mov r14, rax
test rax, rax
je 0x180080afa
mov rcx, rax
call qword [0x180241330]
mov rsi, qword [0x1802517e8]
mov rcx, r14
call qword [0x180241340]
jmp 0x180080b01
mov rsi, qword [0x1802517e8]
mov r14, qword [rsp + 0x40]
movups xmm0, xmmword [str.expand_32_byte_k]
movaps xmmword [0x180251aa0], xmm0
test rsi, rsi
jne 0x180080b3b
xorps xmm0, xmm0
xor eax, eax
movups xmmword [0x180251ab0], xmm0
mov qword [0x180251ad0], rax
movups xmmword [0x180251ac0], xmm0
mov dword [0x180251ad8], eax
jmp 0x180080b7f
mov eax, dword [0x180241460]
test eax, eax
je 0x180080b6d
xorps xmm0, xmm0
xor ecx, ecx
movups xmmword [0x180251ab0], xmm0
mov dword [0x180251ab0], eax
movups xmmword [0x180251ac0], xmm0
mov qword [0x180251ad0], rcx
mov dword [0x180251ad8], ecx
jmp 0x180080b7f
lea r8, [0x180251ab0]
mov edx, 0x2c
mov rcx, rsi
call qword [rsi + 0x68]
mov eax, dword [0x180251ad0]
xor cl, cl
mov byte [0x180251b20], cl
mov dword [0x180251adc], eax
mov dword [0x180251ad0], 0
jmp 0x180080ba6
movzx ecx, byte [0x180251b20]
movzx eax, cl
lea rsi, [0x180251ae0]
cmp ebx, eax
jle 0x180080bf5
test cl, cl
je 0x180080bd3
movzx r8d, cl
mov rdx, rsi
mov rcx, rbp
call fcn.1801d8b30
movzx ecx, byte [0x180251b20]
sub ebx, ecx
add rbp, rcx
inc dword [0x180251ad0]
lea rdx, [0x180251aa0]
mov rcx, rsi
call fcn.180080680
mov cl, 0x40
mov byte [0x180251b20], cl
cmp ebx, 0x40
jg 0x180080bb4
movzx eax, cl
mov rcx, rbp
sub eax, ebx
movsxd r8, ebx
movsxd rdx, eax
add rdx, rsi
call fcn.1801d8b30
sub byte [0x180251b20], bl
mov rsi, qword [rsp + 0x30]
jmp 0x180080c22
mov dword [0x180251aa0], 0
test rdi, rdi
je 0x180080c30
mov rcx, rdi
call qword [0x180241340]
mov rdi, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x48]
add rsp, 0x20
pop rbp
ret
Function at 0x18009c920
Capabilities:
Resolve function by parsing pe exports

Disassembly:
cmp byte [rcx + 0x11], 0
mov r9, rcx
jne 0x18009c977
movzx eax, byte [rcx + 0x10]
test al, al
je 0x18009c977
cmp al, 1
jne 0x18009c939
test edx, edx
jne 0x18009c977
mov r10, qword [rcx + 8]
test r8, r8
je 0x18009c952
mov rax, qword [r10 + 0x18]
mov rcx, qword [rax + 0x50]
mov eax, dword [rcx + 0x28]
bswap eax
mov dword [r8], eax
test edx, edx
je 0x18009c974
mov rax, qword [r9]
mov rcx, qword [r10]
mov edx, dword [rax + 0x2f0]
cmp edx, dword [rcx + 0x80]
jle 0x18009c974
cmp byte [rcx + 0xa], 0
jne fcn.180093b20
xor eax, eax
ret
jmp fcn.18009c560
Function at 0x1800b1130
Capabilities:
Encode data using xor

Disassembly:
mov rax, qword [rcx + 8]
test rax, rax
je 0x1800b115f
lea r8d, [rdx + 1]
nop dword [rax]
mov ecx, dword [rax + 0xc8]
mov edx, r8d
xor edx, ecx
and edx, 3
xor edx, ecx
mov dword [rax + 0xc8], edx
mov rax, qword [rax + 0x10]
test rax, rax
jne 0x1800b1140
ret