joyce8/EMBER2024-capa huggingface dataset:
Function at 0x18002fd30
Capabilities:
Create thread

Disassembly:
push rbx
sub rsp, 0x30
mov rbx, rcx
cmp edx, 1
jne 0x18002fd66
and qword [rsp + 0x28], 0
lea r8, [0x18002f724]
and dword [rsp + 0x20], 0
mov r9, rcx
xor ecx, ecx
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_DisableThreadLibraryCalls]
mov al, 1
add rsp, 0x30
pop rbx
ret
Function at 0x1800302bc
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rbx, rcx
mov rax, qword [0x180218298]
test rax, rax
jne 0x180030378
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
mov r8, qword [rax + 0x30]
movsxd rcx, dword [r8 + 0x3c]
mov r9d, dword [rcx + r8 + 0x88]
add r9, r8
cmp r9, r8
je 0x180030354
mov edx, dword [r9 + 0x18]
test edx, edx
je 0x180030354
mov esi, dword [r9 + 0x20]
dec edx
lea rcx, [rsi + rdx*4]
mov r10d, dword [rcx + r8]
add r10, r8
mov r11d, 0x3201e174
mov cl, byte [r10]
inc r10
test cl, cl
je 0x180030350
movsx ecx, cl
xor ecx, r11d
imul r11d, ecx, 0x1000193
mov cl, byte [r10]
inc r10
test cl, cl
jne 0x180030330
cmp r11d, 0x623d3dfe
je 0x180030359
test edx, edx
jne 0x180030313
mov rax, qword [rax]
jmp 0x1800302ef
mov ecx, dword [r9 + 0x24]
add rcx, r8
movzx edx, word [rcx + rdx*2]
mov ecx, dword [r9 + 0x1c]
add rcx, r8
mov eax, dword [rcx + rdx*4]
add rax, r8
mov qword [0x180218298], rax
mov rcx, qword [rbx + 8]
call rax
nop
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret

Function at 0x180030390
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rax, qword [0x1802182a0]
mov r11, rcx
test rax, rax
jne 0x180030448
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
mov r8, qword [rax + 0x30]
movsxd rcx, dword [r8 + 0x3c]
mov r9d, dword [rcx + r8 + 0x88]
add r9, r8
cmp r9, r8
je 0x180030424
mov edx, dword [r9 + 0x18]
test edx, edx
je 0x180030424
mov esi, dword [r9 + 0x20]
dec edx
mov ebx, 0x2f17a30a
lea rcx, [rsi + rdx*4]
mov r10d, dword [rcx + r8]
add r10, r8
mov cl, byte [r10]
inc r10
test cl, cl
je 0x180030420
movsx ecx, cl
xor ecx, ebx
imul ebx, ecx, 0x1000193
mov cl, byte [r10]
inc r10
test cl, cl
jne 0x180030403
cmp ebx, 0x91be783a
je 0x180030429
test edx, edx
jne 0x1800303e7
mov rax, qword [rax]
jmp 0x1800303c3
mov ecx, dword [r9 + 0x24]
add rcx, r8
movzx edx, word [rcx + rdx*2]
mov ecx, dword [r9 + 0x1c]
add rcx, r8
mov eax, dword [rcx + rdx*4]
add rax, r8
mov qword [0x1802182a0], rax
mov rdx, qword [r11 + 0x10]
lea r8, [r11 + 0x20]
mov rcx, qword [r11 + 8]
mov r9d, 0x30
call rax
mov rbx, qword [rsp + 0x30]
test rax, rax
mov rsi, qword [rsp + 0x38]
setne al
add rsp, 0x20
pop rdi
ret
Function at 0x180030474
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x30
mov rax, qword [0x1802182a8]
mov rbp, rdx
mov rbx, rcx
test rax, rax
jne 0x180030538
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
mov r8, qword [rax + 0x30]
movsxd rcx, dword [r8 + 0x3c]
mov r9d, dword [rcx + r8 + 0x88]
add r9, r8
cmp r9, r8
je 0x180030514
mov edx, dword [r9 + 0x18]
test edx, edx
je 0x180030514
mov esi, dword [r9 + 0x20]
dec edx
mov r11d, 0x33743f25
lea rcx, [rsi + rdx*4]
mov r10d, dword [rcx + r8]
add r10, r8
mov cl, byte [r10]
inc r10
test cl, cl
je 0x180030510
movsx ecx, cl
xor ecx, r11d
imul r11d, ecx, 0x1000193
mov cl, byte [r10]
inc r10
test cl, cl
jne 0x1800304f0
cmp r11d, 0xe249d1f1
je 0x180030519
test edx, edx
jne 0x1800304d3
mov rax, qword [rax]
jmp 0x1800304af
mov ecx, dword [r9 + 0x24]
add rcx, r8
movzx edx, word [rcx + rdx*2]
mov ecx, dword [r9 + 0x1c]
add rcx, r8
mov eax, dword [rcx + rdx*4]
add rax, r8
mov qword [0x1802182a8], rax
mov r9d, dword [rbx + 0x38]
mov r8, rbp
mov rdx, qword [rbx + 0x10]
mov rcx, qword [rbx + 8]
and qword [rsp + 0x20], 0
call rax
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
shr eax, 0x1f
xor al, 1
add rsp, 0x30
pop rdi
ret
Function at 0x180033b9c
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x40
mov rax, qword [0x1801ee5c0]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov rbx, r8
mov rdi, rdx
mov rsi, rcx
mov ecx, reloc.WS2_32.dll_recv
call fcn.18013d8d4
mov r9, rax
mov rax, qword [rbx]
mov qword [r9], rax
mov rax, qword [rdi]
mov qword [r9 + 8], rax
mov qword [rsp + 0x30], r9
lea rbx, [rsi + 8]
mov qword [rsp + 0x28], rbx
and dword [rsp + 0x20], 0
lea r8, [0x180033eb8]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rsi], rax
test rax, rax
je 0x180033c29
mov rax, rsi
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.18013d070
mov rbx, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret
and dword [rbx], 0
mov ecx, 6
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
int3
Function at 0x180046aa0
Capabilities:
Get file size
Read file on windows
Read file via mapping

Disassembly:
push rbx
push rbp
sub rsp, 0x48
mov rbp, rdx
mov rbx, rcx
test rcx, rcx
jne 0x180046abe
mov eax, 0x28
add rsp, 0x48
pop rbp
pop rbx
ret
mov qword [rsp + 0x68], rsi
xor r9d, r9d
mov qword [rsp + 0x40], r14
mov edx, 0x80000000
xor r14d, r14d
mov r8d, 1
mov qword [rsp + 0x30], r14
mov rcx, rbp
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov rsi, rax
cmp rax, 0xffffffffffffffff
jne 0x180046b16
mov rsi, qword [rsp + 0x68]
mov eax, 1
mov r14, qword [rsp + 0x40]
add rsp, 0x48
pop rbp
pop rbx
ret
lea rdx, [rsp + 0x70]
mov qword [rsp + 0x78], rdi
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
je 0x180046c36
mov rax, qword [rsp + 0x70]
cmp rax, 0x7fffffff
jg 0x180046c36
test rax, rax
je 0x180046c36
mov qword [rsp + 0x28], r14
xor r9d, r9d
xor edx, edx
mov dword [rsp + 0x20], r14d
mov r8d, 2
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov rdi, rax
test rax, rax
je 0x180046c36
mov ecx, dword [rsp + 0x70]
xor r9d, r9d
mov dword [rbx + 8], ecx
xor r8d, r8d
mov rcx, rax
mov dword [rbx + 0xc], r14d
mov edx, 4
mov qword [rsp + 0x20], r14
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov rcx, rdi
mov qword [rbx], rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp qword [rbx], r14
je 0x180046bb3
lea rax, [0x180046ca0]
jmp 0x180046c04
mov rcx, qword [rbx + 0x30]
xor edx, edx
movsxd r8, dword [rbx + 8]
mov rcx, qword [rcx]
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov qword [rbx], rax
test rax, rax
je 0x180046c36
mov edi, r14d
mov r8d, dword [rbx + 8]
lea r9, [rsp + 0x60]
mov edx, edi
sub r8d, edi
add rdx, qword [rbx]
mov rcx, rsi
mov qword [rsp + 0x20], r14
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x180046c24
add edi, dword [rsp + 0x60]
cmp edi, dword [rbx + 8]
jne 0x180046bd1
lea rax, [0x180046c70]
mov rcx, rsi
mov qword [rbx + 0x28], rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rax, qword [rbx]
mov qword [rbx + 0x10], rax
xor eax, eax
mov qword [rbx + 0x18], rbp
mov qword [rbx + 0x20], r14
jmp 0x180046c4b
mov rcx, qword [rbx + 0x30]
xor edx, edx
mov r8, qword [rbx]
mov rcx, qword [rcx]
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 0x51
mov qword [rbx], r14
mov qword [rbx + 8], r14
mov rdi, qword [rsp + 0x78]
mov rsi, qword [rsp + 0x68]
mov r14, qword [rsp + 0x40]
add rsp, 0x48
pop rbp
pop rbx
ret
Function at 0x18004e6c0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push rbx
push rdi
push r12
sub rsp, 0x50
mov rax, qword [rcx + 8]
mov r12d, r8d
mov ecx, 0x3e80000
mov rbx, qword [rax + 0x2f0]
mov rax, qword [rdx + 0x80]
movzx edx, word [rdx + 0x68]
movzx edi, word [rax + 0x18]
mov eax, 0x40000
shl edi, 0x10
cmp edi, eax
cmovl edi, eax
shl edx, 0x10
call fcn.18003d090
mov dword [rsp + 0x24], eax
mov ecx, eax
cmp eax, 0x28f
jge 0x18004e718
xor eax, eax
add rsp, 0x50
pop r12
pop rdi
pop rbx
ret
mov eax, dword [rbx + 0x24]
mov qword [rsp + 0x80], rbp
mov ebp, dword [rbx + 0x40]
mov qword [rsp + 0x48], rsi
mov esi, dword [rbx + 0x28]
mov qword [rsp + 0x40], r13
mov r13d, dword [rbx + 0x3c]
mov dword [rsp + 0x88], eax
mov eax, dword [rbx + 0x2c]
mov qword [rsp + 0x38], r14
mov r14d, dword [rbx + 0x34]
mov dword [rsp + 0x70], eax
mov eax, dword [rbx + 0x38]
mov qword [rsp + 0x30], r15
mov r15d, dword [rbx + 0x30]
mov dword [rsp + 0x78], eax
mov dword [rsp + 0x20], r13d
test r12d, r12d
jg 0x18004e76f
mov ebx, 0x4b0000
jmp 0x18004e77f
shl r12d, 0x10
mov edx, ecx
mov ecx, r12d
call fcn.18003f350
mov ebx, eax
bsr ecx, ebx
bsr eax, edi
shl r13d, 0x10
add eax, ecx
cmp eax, 0x2e
jl 0x18004e795
mov ecx, r13d
jmp 0x18004e7a0
mov edx, edi
mov ecx, ebx
call fcn.18003f350
mov ecx, eax
mov r8d, dword [rsp + 0x88]
mov eax, r8d
shl eax, 0x10
cmp ecx, eax
jge 0x18004e7bc
shl esi, 0x10
mov ecx, esi
jmp 0x18004e882
mov edx, dword [rsp + 0x70]
mov r12d, edx
shl r12d, 0x10
cmp ecx, r12d
jge 0x18004e7ef
mov r13d, edx
mov ecx, eax
mov edx, edi
sub r13d, r8d
call fcn.18003d090
mov ecx, ebx
sub ecx, eax
test r13d, r13d
je 0x18004e83f
sub r15d, esi
mov r8d, r13d
mov edx, r15d
jmp 0x18004e828
mov eax, r14d
shl eax, 0x10
cmp ecx, eax
jl 0x18004e843
cmp ecx, r13d
jge 0x18004e87d
mov r15d, dword [rsp + 0x20]
mov edx, edi
sub r15d, r14d
shl r14d, 0x10
mov ecx, r14d
call fcn.18003d090
sub ebx, eax
test r15d, r15d
je 0x18004e87d
mov esi, dword [rsp + 0x78]
mov r8d, r15d
sub ebp, esi
mov ecx, ebx
mov edx, ebp
call fcn.18003f220
shl esi, 0x10
mov edx, edi
mov ecx, esi
mov ebx, eax
call fcn.18003d090
add ebx, eax
jmp 0x18004e88b
mov edx, dword [rsp + 0x70]
mov esi, r14d
mov ecx, r12d
sub esi, edx
mov edx, edi
call fcn.18003d090
mov ecx, ebx
sub ecx, eax
test esi, esi
je 0x18004e7fe
mov edx, dword [rsp + 0x78]
mov r8d, esi
sub edx, r15d
call fcn.18003f220
shl r15d, 0x10
mov edx, edi
mov ecx, r15d
mov ebx, eax
call fcn.18003d090
add ebx, eax
jmp 0x18004e88b
shl ebp, 0x10
mov ecx, ebp
mov edx, edi
call fcn.18003d090
mov ebx, eax
mov edx, dword [rsp + 0x24]
mov ecx, ebx
mov r15, qword [rsp + 0x30]
mov r14, qword [rsp + 0x38]
mov r13, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
mov rbp, qword [rsp + 0x80]
add rsp, 0x50
pop r12
pop rdi
pop rbx
jmp fcn.18003d090
Function at 0x18009e280
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push r14
sub rsp, 0x250
mov rax, qword [0x1801ee5c0]
xor rax, rsp
mov qword [rsp + 0x240], rax
mov eax, dword [rcx + 0x58]
lea rbx, [rsp + 0x30]
mov dword [rsp + 0x40], eax
mov ebp, r9d
mov eax, dword [rcx + 0x5c]
mov rsi, rcx
mov dword [rsp + 0x44], eax
mov eax, dword [rsp + 0x290]
mov dword [rsp + 0x34], eax
mov dword [rsp + 0x38], edx
mov dword [rsp + 0x3c], r8d
mov dword [rsp + 0x30], r9d
mov qword [rsp + 0x278], rdi
nop dword [rax]
mov r10d, dword [rbx + 0x14]
mov eax, r10d
mov r14d, dword [rbx + 4]
cmp r10d, r14d
mov r11d, dword [rbx + 0xc]
cmovg eax, r14d
cmp r11d, eax
jl 0x18009e41c
cmp r10d, r14d
mov eax, r14d
cmovg eax, r10d
cmp r11d, eax
jg 0x18009e41c
cmp r10d, r14d
jne 0x18009e320
sub rbx, 0x10
jmp 0x18009e469
mov edx, dword [rsi + 0x88]
xor r9d, r9d
cmp r10d, r14d
setge r9b
inc r9d
cmp edx, r9d
je 0x18009e392
mov eax, dword [rsi + 4]
mov ecx, eax
mov r8d, dword [rsi + 8]
neg ecx
cmp r10d, r14d
jge 0x18009e354
dec eax
add eax, r10d
and eax, ecx
sub eax, r10d
jmp 0x18009e35c
and ecx, r10d
mov eax, r10d
sub eax, ecx
cmp eax, r8d
setge r11b
test edx, edx
je 0x18009e37b
movzx edx, r11b
mov rcx, rsi
call fcn.18009f350
test al, al
jne 0x18009e47a
movzx r8d, r11b
mov edx, r9d
mov rcx, rsi
call fcn.18009fa80
test al, al
jne 0x18009e47a
mov edx, dword [rsi + 0x64]
lea r9, [0x18009fdd0]
mov ecx, dword [rsi + 0x60]
mov r8, rbx
cmp r10d, r14d
jge 0x18009e3be
mov dword [rsp + 0x28], edx
mov edx, 2
mov dword [rsp + 0x20], ecx
mov rcx, rsi
call fcn.18009e100
jmp 0x18009e412
mov eax, dword [rbx + 4]
neg ecx
movzx edi, byte [rsi + 0x6a]
neg eax
mov dword [rbx + 4], eax
neg edx
mov eax, dword [rbx + 0xc]
neg eax
mov dword [rsp + 0x28], ecx
mov dword [rbx + 0xc], eax
mov rcx, rsi
mov eax, dword [rbx + 0x14]
neg eax
mov dword [rsp + 0x20], edx
mov edx, 2
mov dword [rbx + 0x14], eax
call fcn.18009e100
test dil, dil
je 0x18009e40a
cmp byte [rsi + 0x6a], 0
jne 0x18009e40a
mov rdx, qword [rsi + 0x70]
mov ecx, dword [rdx + 0x20]
neg ecx
mov dword [rdx + 0x20], ecx
mov ecx, dword [rbx + 4]
neg ecx
mov dword [rbx + 4], ecx
test al, al
jne 0x18009e47a
sub rbx, 0x10
jmp 0x18009e469
mov edx, dword [rbx + 0x10]
lea ecx, [r10 + r11]
mov r8d, dword [rbx]
add r8d, dword [rbx + 8]
mov dword [rbx + 0x20], edx
add edx, dword [rbx + 8]
mov eax, edx
mov dword [rbx + 0x24], r10d
sar eax, 1
mov dword [rbx + 0x18], eax
lea eax, [rdx + r8]
sar r8d, 1
sar eax, 2
lea edx, [r14 + r11]
mov dword [rbx + 0x10], eax
mov eax, ecx
sar eax, 1
mov dword [rbx + 0x1c], eax
lea eax, [rcx + rdx]
sar eax, 2
sar edx, 1
mov dword [rbx + 0x14], eax
mov dword [rbx + 8], r8d
mov dword [rbx + 0xc], edx
add rbx, 0x10
lea rax, [rsp + 0x30]
cmp rbx, rax
jb 0x18009e47e
mov ebp, dword [rbx]
jmp 0x18009e2e0
mov al, 1
jmp 0x18009e487
mov dword [rsi + 0x58], ebp
xor al, al
mov dword [rsi + 0x5c], r14d
mov rdi, qword [rsp + 0x278]
mov rcx, qword [rsp + 0x240]
xor rcx, rsp
call fcn.18013d070
mov rbx, qword [rsp + 0x280]
add rsp, 0x250
pop r14
pop rsi
pop rbp
ret
Function at 0x18009e4c0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x20
mov rax, qword [rcx + 0x20]
xor r15d, r15d
sub rax, 0x34
mov qword [rcx + 0x78], r15
mov qword [rcx + 0x28], rax
mov r14d, edx
mov rax, qword [rcx + 0x30]
mov rbx, rcx
mov word [rcx + 0x6a], r15w
mov ebp, 0xffffffff
mov dword [rcx + 0x3c], r15d
mov edi, r15d
mov qword [rcx + 0x70], rax
mov qword [rax + 0x10], rax
mov word [rcx + 0x68], r15w
cmp r15w, word [rcx + 0xb8]
jge 0x18009e5fd
mov esi, r15d
mov rax, qword [rbx + 0xd0]
lea edx, [rbp + 1]
mov dword [rbx + 0x88], r15d
mov r9d, r14d
mov qword [rbx + 0x80], r15
mov rcx, rbx
movsx ebp, word [rsi + rax]
mov r8d, ebp
call fcn.18009e980
test al, al
jne 0x18009e696
mov r8d, dword [rbx + 4]
mov edx, dword [rbx + 0x5c]
lea eax, [r8 - 1]
test edx, eax
jne 0x18009e591
cmp edx, dword [rbx + 0x60]
jl 0x18009e591
cmp edx, dword [rbx + 0x64]
jg 0x18009e591
mov r9, qword [rbx + 0x80]
test r9, r9
je 0x18009e591
mov rax, qword [rbx + 0x70]
movzx ecx, byte [rax + 0x18]
xor cl, byte [r9 + 0x18]
test cl, 8
jne 0x18009e591
add qword [rbx + 0x30], 0xfffffffffffffffc
mov r9, qword [rbx + 0x70]
mov rax, qword [r9 + 0x10]
cmp qword [rbx + 0x30], rax
je 0x18009e5b4
test byte [r9 + 0x18], 8
je 0x18009e5b4
neg r8d
and r8d, edx
sub edx, r8d
cmp edx, dword [rbx + 8]
jmp 0x18009e5c5
lea eax, [r8 - 1]
neg r8d
add eax, edx
and eax, r8d
sub eax, edx
cmp eax, dword [rbx + 8]
setge dl
mov rcx, rbx
call fcn.18009f350
test al, al
jne 0x18009e696
mov rax, qword [rbx + 0x80]
test rax, rax
je 0x18009e5e8
mov qword [r9 + 0x28], rax
movsx eax, word [rbx + 0xb8]
inc edi
add rsi, 2
cmp edi, eax
jl 0x18009e524
movzx edi, word [rbx + 0x68]
mov rdx, qword [rbx + 0x78]
cmp di, 1
jbe 0x18009e69a
test rdx, rdx
je 0x18009e69a
mov ebp, 0xffff
nop dword [rax]
lea rsi, [rdx + 8]
cmp di, 1
jbe 0x18009e638
movsxd rcx, dword [rdx + 0x1c]
mov rax, qword [rdx + 0x10]
lea r10, [rax + rcx*4]
jmp 0x18009e63b
mov r10, r15
mov qword [rsi], r10
test byte [rdx + 0x18], 8
mov r11d, dword [rdx + 0x20]
mov r8d, r11d
mov eax, dword [rdx + 0x1c]
je 0x18009e656
dec r11d
add r11d, eax
jmp 0x18009e66d
sub r8d, eax
inc r8d
dec eax
mov dword [rdx + 0x20], r8d
movsxd rcx, eax
shl rcx, 2
add qword [rdx + 0x10], rcx
mov edx, r8d
mov rcx, rbx
call fcn.18009f670
test al, al
jne 0x18009e696
lea edx, [r11 + 1]
mov rcx, rbx
call fcn.18009f670
test al, al
jne 0x18009e696
mov rdx, qword [rsi]
add di, bp
jne 0x18009e620
jmp 0x18009e69e
mov al, 1
jmp 0x18009e6a9
mov qword [rbx + 0x78], r15
mov rax, qword [rbx + 0x28]
cmp qword [rbx + 0x30], rax
setae al
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop rdi
ret
Function at 0x1800b10a0
Capabilities:
Encode data using xor
Hash data using djb2

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
test rcx, rcx
je 0x1800b1182
call fcn.1800ca630
test al, al
jne 0x1800b1182
mov qword [rsp + 0x30], rsi
xor esi, esi
mov qword [rsp + 0x38], rdi
mov rdi, 0xffffffffffffffff
inc rdi
cmp byte [rbx + rdi], sil
jne 0x1800b10d2
mov r8, rdi
mov edx, 0x2e
mov rcx, rbx
call fcn.1800d40e0
test rax, rax
je 0x1800b1117
sub rax, rbx
mov edx, 0x2e
mov r8, rax
mov rcx, rbx
call fcn.1800d40e0
mov rsi, rax
test rax, rax
je 0x1800b1117
inc rsi
mov rcx, rbx
sub rcx, rsi
add rdi, rcx
test rsi, rsi
cmovne rbx, rsi
lea rsi, [rbx + rdi]
mov edi, 0x1505
cmp rbx, rsi
jae 0x1800b114b
nop dword [rax]
movzx ecx, byte [rbx]
call fcn.1800c5950
imul rdi, rdi, 0x21
movsx rcx, al
inc rbx
xor rdi, rcx
cmp rbx, rsi
jb 0x1800b1130
mov rsi, qword [rsp + 0x30]
mov rcx, rdi
movabs rax, 0x410410410410411
mul rdi
sub rcx, rdx
shr rcx, 1
add rcx, rdx
shr rcx, 5
imul rcx, rcx, 0x3f
sub rdi, rcx
mov rax, rdi
mov rdi, qword [rsp + 0x38]
add rsp, 0x20
pop rbx
ret
xor eax, eax
add rsp, 0x20
pop rbx
ret
Function at 0x1800bf420
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x30
cmp byte [rcx + 0xa4e], 0
mov rbp, r9
mov r14, r8
movsxd rsi, edx
mov rdi, rcx
je 0x1800bf4eb
cmp qword [rcx + 0x278], 0
je 0x1800bf49e
mov qword [rsp + 0x40], rbx
call fcn.1800ab3e0
mov dl, 1
mov rcx, rdi
movzx ebx, al
call fcn.1800aba20
mov rcx, qword [rdi + 0x1f0]
mov r9, rbp
mov qword [rsp + 0x20], rcx
mov r8, r14
mov rcx, rdi
mov edx, esi
call qword [rdi + 0x278]
movzx edx, bl
mov rcx, rdi
call fcn.1800aba20
mov rbx, qword [rsp + 0x40]
jmp 0x1800bf4eb
mov ecx, esi
test edx, edx
je 0x1800bf4ae
sub ecx, 1
je 0x1800bf4ae
cmp ecx, 1
jne 0x1800bf4eb
mov r9, qword [rdi + 0x1e8]
lea rax, [0x180161e48]
lea rcx, [rsi + rsi*2]
mov edx, 2
add rcx, rax
mov r8d, 1
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fwrite
mov r9, qword [rdi + 0x1e8]
mov r8d, 1
mov rdx, rbp
mov rcx, r14
call sub.api_ms_win_crt_stdio_l1_1_0.dll_fwrite
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov rdi, qword [rsp + 0x58]
add rsp, 0x30
pop r14
ret

Function at 0x1800c32c0
Capabilities:
Read file on windows

Disassembly:
sub rsp, 0x28
call sub.api_ms_win_crt_stdio_l1_1_0.dll__read
cdqe
add rsp, 0x28
ret
Function at 0x1800c35b0
Capabilities:
Get common file path

Disassembly:
push rbx
push rbp
push rdi
sub rsp, 0x20
mov rbx, rcx
xor ebp, ebp
lea rcx, str.kernel32
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rdi, rax
test rax, rax
jne 0x1800c35da
add rsp, 0x20
pop rdi
pop rbp
pop rbx
ret
lea rdx, str.LoadLibraryExW
mov qword [rsp + 0x48], r14
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x180162910]
mov rcx, rbx
mov r14, rax
call sub.api_ms_win_crt_string_l1_1_0.dll_wcspbrk
test rax, rax
je 0x1800c363b
mov rcx, rbx
test r14, r14
je 0x1800c3628
xor edx, edx
mov r8d, 8
mov rax, r14
mov r14, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
pop rbp
pop rbx
jmp rax
mov r14, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
pop rbp
pop rbx
jmp qword [sym.imp.KERNEL32.dll_LoadLibraryW]
test r14, r14
je 0x1800c3672
lea rdx, str.AddDllDirectory
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x1800c3672
xor edx, edx
mov r8d, 0x800
mov rcx, rbx
mov rax, r14
mov r14, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
pop rbp
pop rbx
jmp rax
xor edx, edx
mov qword [rsp + 0x50], r15
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
mov r15d, eax
test eax, eax
je 0x1800c373c
mov rdi, 0xffffffffffffffff
mov qword [rsp + 0x40], rsi
mov rdx, rdi
nop dword [rax + rax]
inc rdx
cmp word [rbx + rdx*2], bp
jne 0x1800c36a0
lea ecx, [rax + 1]
add rcx, rdx
add rcx, rcx
call qword [section..data]
mov rsi, rax
test rax, rax
je 0x1800c372e
mov edx, r15d
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
test eax, eax
je 0x1800c372e
mov rax, rdi
cmp word [rsi + rax*2 + 2], bp
lea rax, [rax + 1]
jne 0x1800c36d3
mov dword [rsi + rax*2], 0x5c
inc rdi
cmp word [rsi + rdi*2], bp
jne 0x1800c36e5
add rdi, rdi
sub rdi, rbx
add rdi, rsi
nop word [rax + rax]
movzx eax, word [rbx]
mov word [rbx + rdi], ax
lea rbx, [rbx + 2]
test ax, ax
jne 0x1800c3700
mov rcx, rsi
test r14, r14
je 0x1800c3725
xor edx, edx
mov r8d, 8
call r14
jmp 0x1800c372b
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov rbp, rax
mov rcx, rsi
call qword [case.0x1800b2965.0]
mov rsi, qword [rsp + 0x40]
mov r15, qword [rsp + 0x50]
mov rax, rbp
mov r14, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
pop rbp
pop rbx
ret
Function at 0x1800cb440
Capabilities:
Convert ip address from string

Disassembly:
cmp qword [rsp + 0x28], 0
mov qword [r9], 0
jge 0x1800cb455
mov eax, 0xfffffffe
ret
mov qword [rsp + 0x28], r9
mov r9b, 1
jmp fcn.1800cae60

Function at 0x1800cb740
Capabilities:
Convert ip address from string

Disassembly:
push rbp
push rdi
push r14
sub rsp, 0xd0
mov rax, qword [0x1801ee5c0]
xor rax, rsp
mov qword [rsp + 0xb0], rax
xor edi, edi
mov r14, rdx
mov rbp, rcx
cmp byte [rcx + 0xa4e], dil
je 0x1800cb962
cmp byte [rdx + 0x18], dil
mov qword [rsp + 0xc8], rsi
lea rsi, [rdx + 0x18]
je 0x1800cb95a
lea r8, [rsp + 0x20]
mov rdx, rsi
mov ecx, 2
call qword [sym.imp.WS2_32.dll_inet_pton]
test eax, eax
jg 0x1800cb95a
lea r8, [rsp + 0x70]
mov rdx, rsi
mov ecx, reloc.WS2_32.dll_socket
call qword [sym.imp.WS2_32.dll_inet_pton]
test eax, eax
jg 0x1800cb95a
cmp byte [rsi], dil
lea rdx, str.Host__s:_d_was_resolved.
mov r9d, dword [r14 + 0x14]
mov rcx, rbp
mov qword [rsp + 0x100], rbx
mov rbx, qword [r14]
mov qword [rsp + 0xc0], r15
lea r15, str._none_
mov r8, r15
cmovne r8, rsi
call fcn.1800bf600
mov edx, 0x400
lea rcx, [rsp + 0x30]
call fcn.1800b16e0
mov edx, 0x400
lea rcx, [rsp + 0x50]
call fcn.1800b16e0
test rbx, rbx
je 0x1800cb8c7
mov r14d, 0x20
mov ecx, dword [rbx + 4]
cmp ecx, 0x17
je 0x1800cb834
cmp ecx, 2
jne 0x1800cb8ba
xor eax, eax
mov byte [rsp + 0x80], 0
cmp ecx, 2
lea rsi, [rsp + 0x30]
cmovne rax, r14
add rsi, rax
cmp ecx, 2
je 0x1800cb861
cmp ecx, 0x17
jne 0x1800cb87c
mov rdx, qword [rbx + 0x20]
add rdx, 8
jmp 0x1800cb869
mov rdx, qword [rbx + 0x20]
add rdx, 4
mov r9d, 0x2e
lea r8, [rsp + 0x80]
call sub.WS2_32.dll_inet_ntop
mov rcx, rsi
call fcn.1800b1700
test rax, rax
je 0x1800cb8a0
mov r8d, 2
lea rdx, [0x1801971c0]
mov rcx, rsi
call fcn.1800b16a0
mov edi, eax
test edi, edi
jne 0x1800cb8e2
lea rdx, [rsp + 0x80]
mov rcx, rsi
call fcn.1800b1640
mov edi, eax
test eax, eax
jne 0x1800cb8e2
mov rbx, qword [rbx + 0x28]
test rbx, rbx
jne 0x1800cb823
lea rcx, [rsp + 0x50]
call fcn.1800b1700
test rax, rax
je 0x1800cb8f3
lea rcx, [rsp + 0x50]
call fcn.1800b1710
jmp 0x1800cb8f6
lea rdx, str.too_many_IP__cant_show
mov rcx, rbp
call fcn.1800bf600
jmp 0x1800cb936
mov rax, r15
mov r8, rax
lea rdx, str.IPv6:__s
mov rcx, rbp
call fcn.1800bf600
lea rcx, [rsp + 0x30]
call fcn.1800b1700
test rax, rax
je 0x1800cb924
lea rcx, [rsp + 0x30]
call fcn.1800b1710
mov r15, rax
mov r8, r15
lea rdx, str.IPv4:__s
mov rcx, rbp
call fcn.1800bf600
lea rcx, [rsp + 0x30]
call fcn.1800b16b0
lea rcx, [rsp + 0x50]
call fcn.1800b16b0
mov r15, qword [rsp + 0xc0]
mov rbx, qword [rsp + 0x100]
mov rsi, qword [rsp + 0xc8]
mov rcx, qword [rsp + 0xb0]
xor rcx, rsp
call fcn.18013d070
add rsp, 0xd0
pop r14
pop rdi
pop rbp
ret