joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180038620
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x20
mov rbp, r8
mov r14, rdx
mov rbx, rcx
test r8, r8
je 0x180038788
xor r12d, r12d
cmp dword [rcx + 0x70], r12d
je 0x18003866d
mov rdx, qword [rcx + 0x68]
mov dword [rcx + 0x70], r12d
call fcn.180038510
cmp eax, 0xffffffff
je 0x180038788
mov r15, r12
mov r13d, 0x40000000
mov eax, 0xffffffff
cmp rbp, rax
mov esi, eax
mov eax, dword [rbx]
cmovb esi, ebp
test eax, eax
je 0x1800386aa
mov rdx, qword [rbx + 8]
cmp eax, esi
mov rcx, r14
cmovae eax, esi
mov r8d, eax
mov edi, eax
call fcn.180228d60
add qword [rbx + 8], rdi
sub dword [rbx], edi
jmp 0x180038734
cmp dword [rbx + 0x50], r12d
je 0x1800386bd
cmp dword [rbx + 0x88], r12d
je 0x180038760
mov ecx, dword [rbx + 0x44]
test ecx, ecx
je 0x180038745
mov eax, dword [rbx + 0x28]
add eax, eax
cmp esi, eax
jb 0x180038745
cmp ecx, 1
jne 0x180038715
mov edi, r12d
nop dword [rax]
mov ecx, dword [rbx + 0x1c]
mov r8d, esi
sub r8d, edi
mov edx, edi
cmp r8d, r13d
cmova r8d, r13d
add rdx, r14
call fcn.18023d0c4
test eax, eax
jle 0x180038706
add edi, eax
cmp edi, esi
jb 0x1800386e0
test eax, eax
js 0x18003876c
test eax, eax
jne 0x180038734
mov dword [rbx + 0x50], 1
jmp 0x180038734
mov rcx, rbx
mov dword [rbx + 0x98], esi
mov qword [rbx + 0x90], r14
call fcn.180038290
cmp eax, 0xffffffff
je 0x180038788
mov edi, dword [rbx]
mov dword [rbx], r12d
mov eax, edi
sub rbp, rax
add r14, rax
add r15, rax
add qword [rbx + 0x10], rax
jmp 0x180038752
mov rcx, rbx
call fcn.180038460
cmp eax, 0xffffffff
je 0x180038788
test rbp, rbp
jne 0x180038676
mov rax, r15
jmp 0x18003878a
mov dword [rbx + 0x54], 1
mov rax, r15
jmp 0x18003878a
call fcn.1802397c4
mov ecx, dword [rax]
call fcn.180239850
mov r8, rax
mov edx, 0xffffffff
mov rcx, rbx
call fcn.1800374a0
xor eax, eax
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x20
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x180040b80
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
add r8d, 0xdeadbeef
mov rdi, rdx
add r8d, edx
mov r11, rcx
mov r10d, r8d
mov ebx, r8d
cmp rdx, 0xc
jbe 0x180040ca9
mov qword [rsp + 0x10], rsi
lea r9, [rdx - 0xd]
movabs rax, 0xaaaaaaaaaaaaaaab
mul r9
mov rsi, rdx
shr rsi, 3
inc rsi
imul rax, rsi, 0xfffffffffffffff4
add rdi, rax
nop dword [rax]
movzx eax, byte [r11 + 6]
movzx ecx, byte [r11 + 7]
movzx r9d, byte [r11 + 4]
movzx edx, byte [r11 + 8]
add r9d, r10d
shl ecx, 8
add edx, r8d
add ecx, eax
movzx eax, byte [r11 + 5]
shl ecx, 8
add ecx, eax
movzx eax, byte [r11 + 0xa]
shl ecx, 8
add r9d, ecx
movzx ecx, byte [r11 + 0xb]
shl ecx, 8
add ecx, eax
movzx eax, byte [r11 + 9]
shl ecx, 8
add ecx, eax
movzx eax, byte [r11 + 2]
shl ecx, 8
add edx, ecx
movzx ecx, byte [r11 + 3]
shl ecx, 8
mov r8d, edx
add ecx, eax
rol r8d, 4
movzx eax, byte [r11 + 1]
shl ecx, 8
add ecx, eax
movzx eax, byte [r11]
shl ecx, 8
add r11, 0xc
add ecx, eax
sub ecx, edx
add edx, r9d
add ecx, ebx
xor r8d, ecx
sub r9d, r8d
mov eax, r8d
add r8d, edx
rol eax, 6
xor eax, r9d
sub edx, eax
mov ecx, eax
add eax, r8d
rol ecx, 8
xor ecx, edx
sub r8d, ecx
mov ebx, ecx
add ecx, eax
rol ebx, 0x10
xor ebx, r8d
sub eax, ebx
mov r10d, ebx
ror r10d, 0xd
add ebx, ecx
xor r10d, eax
sub ecx, r10d
mov r8d, r10d
rol r8d, 4
add r10d, ebx
xor r8d, ecx
sub rsi, 1
jne 0x180040bd0
mov rsi, qword [rsp + 0x10]
cmp rdi, 0xc
ja case.default.0x180040cc4
lea rcx, [0x180000000]
mov eax, dword [rcx + rdi*4 + 0x40d9c]
add rax, rcx
jmp rax
movzx eax, byte [r11 + 0xb]
shl eax, 0x18
add r8d, eax
movzx eax, byte [r11 + 0xa]
shl eax, 0x10
add r8d, eax
movzx eax, byte [r11 + 9]
shl eax, 8
add r8d, eax
movzx eax, byte [r11 + 8]
add r8d, eax
movzx eax, byte [r11 + 7]
shl eax, 0x18
add r10d, eax
movzx eax, byte [r11 + 6]
shl eax, 0x10
add r10d, eax
movzx eax, byte [r11 + 5]
shl eax, 8
add r10d, eax
movzx eax, byte [r11 + 4]
add r10d, eax
movzx eax, byte [r11 + 3]
shl eax, 0x18
add ebx, eax
movzx eax, byte [r11 + 2]
shl eax, 0x10
add ebx, eax
movzx eax, byte [r11 + 1]
shl eax, 8
add ebx, eax
movzx eax, byte [r11]
add ebx, eax
xor r8d, r10d
mov eax, r10d
rol eax, 0xe
sub r8d, eax
mov eax, r8d
mov edx, r8d
rol eax, 0xb
xor edx, ebx
sub edx, eax
xor r10d, edx
mov eax, edx
ror eax, 7
sub r10d, eax
xor r8d, r10d
mov eax, r10d
rol eax, 0x10
sub r8d, eax
mov eax, r8d
mov ecx, r8d
rol eax, 4
xor ecx, edx
sub ecx, eax
xor r10d, ecx
mov eax, ecx
rol eax, 0xe
sub r10d, eax
mov eax, r10d
xor r8d, r10d
ror eax, 8
sub r8d, eax
mov rbx, qword [rsp + 0x18]
mov eax, r8d
pop rdi
ret
Function at 0x180047cb0
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x10], rbx
push rsi
sub rsp, 0x30
lea rcx, [0x180332b80]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rbx, qword [0x18032f518]
xor esi, esi
test rbx, rbx
jne 0x180047e00
mov ecx, 0xa8
call fcn.18022c454
mov rbx, rax
test rax, rax
jne 0x180047cf2
mov ebx, esi
jmp 0x180047df9
xor edx, edx
mov qword [rsp + 0x40], rdi
mov r8d, 0xa8
mov rcx, rbx
call fcn.180229410
lea rax, [rbx + 0x68]
mov qword [rbx + 0x70], rax
lea rcx, [rbx + 0x38]
mov qword [rax], rax
lea rax, [rbx + 0x18]
mov qword [rbx + 0x20], rax
mov qword [rax], rax
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventA]
mov qword [rbx + 0x60], rax
call fcn.180027820
mov qword [rbx], rax
test rax, rax
je 0x180047dd5
lea rcx, [rbx + 0x88]
mov rdx, rax
call fcn.18000cfe0
mov rcx, qword [rbx]
lea r9, [0x180048c20]
mov r8d, reloc.WS2_32.dll_select
mov qword [rsp + 0x20], rbx
mov rdx, 0xffffffffffffffff
call fcn.180052250
mov qword [rbx + 0x10], rax
test rax, rax
je 0x180047dcd
or dword [rbx + 0x30], 1
lea r8, [0x180048aa0]
mov qword [rsp + 0x28], rsi
mov r9, rbx
xor edx, edx
mov dword [rsp + 0x20], 0x10000
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rcx, qword [rbx + 0x10]
mov qword [rbx + 0x28], rax
test rax, rax
je 0x180047dc0
xor edx, edx
call fcn.180052650
jmp 0x180047df4
and dword [rbx + 0x30], 0xfffffffe
call fcn.1800523b0
mov qword [rbx + 0x10], rsi
mov rcx, qword [rbx]
call fcn.180051b20
lea rcx, [rbx + 0x38]
call qword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
mov rcx, qword [rbx + 0x60]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rbx
call fcn.18022c440
mov rbx, rsi
mov rdi, qword [rsp + 0x40]
mov qword [0x18032f518], rbx
lea rcx, [0x180332b80]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
test rbx, rbx
mov eax, reloc.WS2_32.dll_inet_ntoa
mov rbx, qword [rsp + 0x48]
cmovne eax, esi
add rsp, 0x30
pop rsi
ret
Function at 0x180047ec0
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x30
mov edi, ecx
mov ecx, 0xa8
call fcn.18022c454
mov rbx, rax
test rax, rax
jne 0x180047ee9
mov rbx, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
xor edx, edx
mov qword [rsp + 0x40], rsi
mov r8d, 0xa8
mov rcx, rbx
call fcn.180229410
lea rax, [rbx + 0x68]
mov qword [rbx + 0x70], rax
lea rcx, [rbx + 0x38]
mov qword [rax], rax
lea rax, [rbx + 0x18]
mov qword [rbx + 0x20], rax
mov qword [rax], rax
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventA]
mov qword [rbx + 0x60], rax
call fcn.180027820
mov qword [rbx], rax
test rax, rax
je 0x180047ffa
lea rcx, [rbx + 0x88]
mov rdx, rax
call fcn.18000cfe0
test edi, edi
jne 0x180047f6d
or dword [rbx + 0x30], 4
mov rax, rbx
mov rsi, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
mov rcx, qword [rbx]
lea r9, [0x180048c20]
mov r8d, reloc.WS2_32.dll_select
mov qword [rsp + 0x20], rbx
mov rdx, 0xffffffffffffffff
call fcn.180052250
mov qword [rbx + 0x10], rax
test rax, rax
je 0x180047ff2
or dword [rbx + 0x30], 1
lea r8, [0x180048aa0]
xor edi, edi
mov r9, rbx
mov qword [rsp + 0x28], rdi
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x20], 0x10000
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rcx, qword [rbx + 0x10]
mov qword [rbx + 0x28], rax
test rax, rax
je 0x180047fe5
xor edx, edx
call fcn.180052650
mov rsi, qword [rsp + 0x40]
mov rax, rbx
mov rbx, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
and dword [rbx + 0x30], 0xfffffffe
call fcn.1800523b0
mov qword [rbx + 0x10], rdi
mov rcx, qword [rbx]
call fcn.180051b20
lea rcx, [rbx + 0x38]
call qword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
mov rcx, qword [rbx + 0x60]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rbx
call fcn.18022c440
mov rsi, qword [rsp + 0x40]
xor eax, eax
mov rbx, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
Function at 0x18004a1b0
Capabilities:
Read file on windows

Disassembly:
push rbp
push r14
push r15
sub rsp, 0xf0
mov rax, qword [0x18032d860]
xor rax, rsp
mov qword [rsp + 0xd8], rax
mov rbp, rcx
mov r15, r8
mov rcx, qword [rdx + 0x18]
mov r14, rdx
test rcx, rcx
je 0x18004a1f4
call fcn.18004bdb0
test eax, eax
jne 0x18004a1f4
mov eax, reloc.WS2_32.dll_shutdown
jmp 0x18004a342
mov rcx, qword [r14 + 8]
mov qword [rsp + 0x128], rbx
mov qword [rsp + 0xe0], rdi
call fcn.18001eba0
mov rdi, rax
test rax, rax
jne 0x18004a21d
lea eax, [rdi + 0xc]
jmp 0x18004a332
lea rdx, [rsp + 0x38]
mov rcx, rdi
call fcn.18001ea70
mov ebx, eax
test eax, eax
jne 0x18004a3dd
cmp qword [rsp + 0x38], 0
je 0x18004a3dd
lea rcx, [rsp + 0x40]
mov qword [rsp + 0xe8], rsi
mov qword [rsp + 0x30], 0
call fcn.180046ba0
lea r8, [0x180260704]
mov rdx, rdi
lea rcx, [rsp + 0x30]
call fcn.18001eb50
mov ebx, eax
test eax, eax
jne 0x18004a320
mov ecx, 0x4000
call fcn.18022c454
mov rsi, rax
test rax, rax
jne 0x18004a2a0
mov rcx, qword [rsp + 0x30]
call fcn.180239d4c
lea ebx, [rsi + 0xc]
jmp 0x18004a320
mov r9, qword [rsp + 0x30]
mov edx, 1
mov r8d, 0x4000
mov rcx, rsi
call fcn.18023c4d8
test eax, eax
je 0x18004a2ce
mov r8d, eax
lea rcx, [rsp + 0x40]
mov rdx, rsi
call fcn.180046bd0
jmp 0x18004a2a0
mov rcx, qword [rsp + 0x30]
call fcn.18023c220
test eax, eax
je 0x18004a305
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0xa0]
call fcn.180046cd0
lea rdx, [rsp + 0xb0]
lea rcx, [rsp + 0xa0]
call fcn.1800475d0
jmp 0x18004a30a
mov ebx, 0x271b
mov rcx, qword [rsp + 0x30]
call fcn.180239d4c
mov rcx, rsi
call fcn.18022c440
test ebx, ebx
je 0x18004a35f
mov rcx, rdi
call fcn.18022c440
mov eax, ebx
mov rsi, qword [rsp + 0xe8]
mov rbx, qword [rsp + 0x128]
mov rdi, qword [rsp + 0xe0]
mov rcx, qword [rsp + 0xd8]
xor rcx, rsp
call fcn.180227e50
add rsp, 0xf0
pop r15
pop r14
pop rbp
ret
mov rax, qword [rsp + 0x38]
lea r9, [rsp + 0xb0]
mov r8, qword [r14 + 0x10]
mov rdx, qword [r14 + 0x18]
mov rcx, qword [r14]
mov qword [rsp + 0x20], rax
call fcn.18004b1a0
mov rbx, rax
test rax, rax
je 0x18004a3a1
mov rcx, rbp
call fcn.18004b5c0
mov rcx, rax
test rax, rax
jne 0x18004a3b3
mov rcx, rbx
call fcn.18022c440
mov rcx, rdi
call fcn.18022c440
mov eax, reloc.WS2_32.dll_inet_ntoa
jmp 0x18004a32a
mov dword [rax + 0x40], 0
mov qword [rax + 0x28], 0
mov rax, qword [rsp + 0x38]
mov qword [rcx + 0x18], rax
xor eax, eax
mov qword [rcx + 0x10], rdi
mov qword [rcx + 0x48], rbx
mov qword [r15], rcx
jmp 0x18004a32a
mov rcx, rdi
call fcn.18022c440
test ebx, ebx
mov eax, 0x3d
cmovne eax, ebx
jmp 0x18004a332
Function at 0x18004a910
Capabilities:
Delete file

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
mov edi, dword [rcx + 0x50]
mov rbx, rcx
mov rcx, qword [rcx + 0x58]
and edi, 1
test rcx, rcx
je 0x18004a9a5
add rcx, 0x10
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov rcx, qword [rbx + 0x58]
mov eax, dword [rcx + 0xa4]
test eax, eax
je 0x18004a997
dec eax
mov dword [rcx + 0xa4], eax
mov rax, qword [rbx + 0x58]
cmp dword [rax + 0xa4], 0
jne 0x18004a997
test byte [rax + 0x48], 0x40
je 0x18004a997
lea rax, str.upload_request_destroy
mov r9d, 0x197
lea r8, str..._srcuploadupload_request.c
mov qword [rsp + 0x20], rax
lea rdx, str.__s:_d___s:_signal_user_thread__due_to_BDNC_CTX_F_WAIT_4_UPLOADS__n
mov ecx, 3
call fcn.18002b690
mov rcx, qword [rbx + 0x58]
mov rcx, qword [rcx + 0x38]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov rcx, qword [rbx + 0x58]
add rcx, 0x10
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, dword [rbx + 0x40]
test eax, eax
jne 0x18004a9ce
mov rcx, qword [rbx + 0x28]
test rcx, rcx
je 0x18004a9ba
call fcn.180239d4c
test edi, edi
je 0x18004a9c8
mov rcx, qword [rbx + 0x10]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
mov rcx, qword [rbx + 0x10]
jmp 0x18004aa17
test edi, edi
je 0x18004a9f2
cmp eax, 1
jne 0x18004a9f2
mov rax, qword [rbx + 0x1c8]
test rax, rax
je 0x18004aa21
mov rdx, qword [rbx + 0x1d0]
mov rcx, qword [rbx + 0x10]
call rax
jmp 0x18004aa21
cmp eax, 2
jne 0x18004aa21
mov rcx, qword [rbx + 0x28]
test rcx, rcx
je 0x18004aa05
call fcn.18022c440
mov rcx, qword [rbx + 0x38]
test rcx, rcx
je 0x18004aa13
call fcn.18022c440
mov rcx, qword [rbx + 0x30]
test rcx, rcx
je 0x18004aa21
call fcn.18022c440
mov rcx, qword [rbx + 0x48]
test rcx, rcx
je 0x18004aa2f
call fcn.18022c440
mov rcx, qword [rbx + 0x70]
xor edi, edi
test rcx, rcx
je 0x18004aa43
call fcn.18022c440
mov qword [rbx + 0x70], rdi
mov dword [rbx + 0x78], edi
xorps xmm0, xmm0
mov qword [rbx + 0x80], rdi
xor eax, eax
movups xmmword [rbx + 0x8a], xmm0
movups xmmword [rbx + 0x9a], xmm0
movups xmmword [rbx + 0xaa], xmm0
movups xmmword [rbx + 0xba], xmm0
movups xmmword [rbx + 0xca], xmm0
movups xmmword [rbx + 0xda], xmm0
movups xmmword [rbx + 0xea], xmm0
mov qword [rbx + 0xfa], rax
mov qword [rbx + 0x102], rax
mov word [rbx + 0x88], di
movups xmmword [rbx + 0x10a], xmm0
movups xmmword [rbx + 0x11a], xmm0
movups xmmword [rbx + 0x12a], xmm0
movups xmmword [rbx + 0x13a], xmm0
movups xmmword [rbx + 0x14a], xmm0
movups xmmword [rbx + 0x15a], xmm0
movups xmmword [rbx + 0x16a], xmm0
mov qword [rbx + 0x17a], rax
mov dword [rbx + 0x182], eax
mov word [rbx + 0x186], ax
mov rcx, qword [rbx + 0x198]
mov dword [rbx + 0x18c], 0xffffffff
mov qword [rbx + 0x190], rdi
test rcx, rcx
je 0x18004aaff
call fcn.18022c440
mov rcx, qword [rbx + 0x1d8]
test rcx, rcx
je 0x18004ab10
call fcn.180023570
mov rcx, rbx
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
jmp fcn.18022c440
Function at 0x18004aba0
Capabilities:
Delete file

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov ebx, r8d
mov rdi, rcx
cmp edx, 3
je 0x18004abbf
test ebx, ebx
mov eax, 0x7d
cmove ebx, eax
mov r8d, ebx
call fcn.18004ae10
mov edx, ebx
mov rcx, rdi
call fcn.18004c260
mov rcx, qword [rdi + 0x1d8]
test rcx, rcx
je 0x18004abe2
call fcn.180023fc0
mov rcx, rdi
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp fcn.18004a910

Function at 0x18004be90
Capabilities:
Set thread local storage value

Disassembly:
mov qword [rsp + 0x18], rbx
push rsi
sub rsp, 0x20
mov rsi, rcx
xor ecx, ecx
call fcn.180047ec0
mov rbx, rax
test rax, rax
je 0x18004bec3
mov rdx, qword [rax]
mov rcx, rsi
call fcn.18004a610
test eax, eax
je 0x18004bed3
mov rcx, rbx
call fcn.180048030
mov eax, reloc.WS2_32.dll_inet_ntoa
mov rbx, qword [rsp + 0x40]
add rsp, 0x20
pop rsi
ret
xor r9d, r9d
mov qword [rsp + 0x30], rdi
xor r8d, r8d
mov qword [rbx + 0x80], rsi
mov rcx, rsi
lea edx, [r9 + 1]
call fcn.18004ae10
mov edi, eax
test eax, eax
jne 0x18004bf9e
mov ecx, dword [0x180332e08]
lea rdx, [rbx + 0x88]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
mov rcx, rbx
call fcn.180048090
mov edi, eax
test eax, eax
jne 0x18004bf59
mov rax, qword [rbx + 0x78]
lea rcx, [0x18004bfd0]
mov qword [rax + 0x1f0], rcx
mov rcx, qword [rbx + 0x78]
call fcn.18001f640
mov edi, eax
test eax, eax
jne 0x18004bf51
mov rcx, qword [rbx]
call fcn.180051270
mov edi, dword [rsi + 0x1e0]
test edi, edi
je 0x18004bf6b
jmp 0x18004bf59
mov rcx, rbx
call fcn.180048550
xor r9d, r9d
mov r8d, edi
mov rcx, rsi
lea edx, [r9 + 3]
call fcn.18004ae10
mov qword [rbx + 0x80], 0
mov rcx, qword [rsi + 0x1d8]
call fcn.180023fc0
mov rcx, qword [rsi + 0x1d8]
call fcn.180023f90
mov ecx, dword [0x180332e08]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
jmp 0x18004bfa9
mov qword [rbx + 0x80], 0
mov rcx, rbx
call fcn.180048030
mov rbx, qword [rsp + 0x40]
mov eax, edi
mov rdi, qword [rsp + 0x30]
add rsp, 0x20
pop rsi
ret

Function at 0x18004c660
Capabilities:
Set socket configuration

Disassembly:
push rbx
sub rsp, 0x20
lea r8, [rsp + 0x38]
mov dword [rsp + 0x38], 1
mov edx, 0x8004667e
mov rbx, rcx
call qword [sym.imp.WS2_32.dll_ioctlsocket]
cmp eax, 0xffffffff
jne 0x18004c6a3
mov r8d, ebx
lea rdx, str.fcntl__d__F_GETFL_
mov rcx, rbx
call fcn.180062b10
mov eax, 0xffffffff
add rsp, 0x20
pop rbx
ret
xor eax, eax
add rsp, 0x20
pop rbx
ret

Function at 0x18004c6e0
Capabilities:
Set socket configuration

Disassembly:
sub rsp, 0x38
mov edx, 0x29
mov dword [rsp + 0x48], 1
lea r9, [rsp + 0x48]
mov dword [rsp + 0x20], 4
lea r8d, [rdx - 0xe]
call qword [sym.imp.WS2_32.dll_setsockopt]
add rsp, 0x38
ret
Function at 0x18004c7d0
Capabilities:
Hash data using murmur3

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
mov rdx, qword [0x18032f598]
xor edi, edi
mov qword [rsp + 0x58], rdi
mov ebx, ecx
test rdx, rdx
je 0x18004c7f6
xor ecx, ecx
call fcn.180075b10
mov r8, qword [0x180327f48]
test r8, r8
je 0x18004c861
xor edx, edx
mov eax, ebx
shr eax, 0x10
xor eax, ebx
imul ecx, eax, 0x85ebca6b
mov eax, ecx
shr eax, 0xd
xor eax, ecx
imul ecx, eax, 0xc2b2ae35
mov eax, ecx
shr eax, 0x10
xor eax, ecx
div dword [0x180327f50]
mov rcx, qword [r8 + rdx*8]
lea rdx, [r8 + rdx*8]
test rcx, rcx
je 0x18004c84b
cmp dword [rcx + 8], ebx
je 0x18004c84b
mov rax, qword [rcx]
mov rdx, rcx
mov rcx, rax
test rax, rax
jne 0x18004c838
mov rax, qword [rdx]
test rax, rax
je 0x18004c861
mov rax, qword [rax + 0x10]
mov qword [rsp + 0x58], rax
jmp 0x18004c9bf
mov qword [rsp + 0x30], rdi
lea rax, [rsp + 0x58]
mov dword [rsp + 0x28], edi
xor r9d, r9d
mov r8d, ebx
mov qword [rsp + 0x20], rax
xor edx, edx
mov ecx, 0x1300
call qword [sym.imp.KERNEL32.dll_FormatMessageA]
test eax, eax
je 0x18004c8cd
mov rcx, qword [rsp + 0x58]
test rcx, rcx
je 0x18004c90c
mov rax, 0xffffffffffffffff
nop dword [rax]
inc rax
cmp byte [rcx + rax], dil
jne 0x18004c8a0
test rax, rax
je 0x18004c90c
cmp byte [rcx + rax - 1], 0xa
jne 0x18004c90c
sub rax, 1
mov byte [rcx + rax], dil
je 0x18004c90c
cmp byte [rax + rcx - 1], 0xd
jne 0x18004c90c
mov byte [rax + rcx - 1], dil
jmp 0x18004c90c
mov edx, gethostbyaddr
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov qword [rsp + 0x58], rax
test rax, rax
jne 0x18004c8f5
lea rax, str.LocalAlloc_failed_during_Winsock_error
mov qword [rsp + 0x58], rax
jmp 0x18004c9bf
mov r9d, ebx
lea r8, str.winsock_error_0x_08x
mov edx, gethostbyaddr
mov rcx, rax
call fcn.18004ca00
mov ecx, 0x18
call fcn.18022c454
mov rdi, rax
test rax, rax
jne 0x18004c93a
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_LocalFree]
lea rax, str.malloc_failed_during_Winsock_error
mov qword [rsp + 0x58], rax
jmp 0x18004c9bf
mov dword [rax + 8], ebx
mov rax, qword [rsp + 0x58]
mov qword [rdi + 0x10], rax
mov r8, qword [0x180327f48]
mov eax, dword [0x180327f54]
test r8, r8
je 0x18004c960
cmp eax, dword [0x180327f58]
jb 0x18004c97c
lea edx, [rax + 1]
lea rcx, [0x180327f48]
call fcn.180050770
mov eax, dword [0x180327f54]
mov r8, qword [0x180327f48]
inc eax
mov dword [0x180327f54], eax
mov ecx, dword [rdi + 8]
shr ecx, 0x10
xor ecx, dword [rdi + 8]
imul eax, ecx, 0x85ebca6b
mov ecx, eax
shr ecx, 0xd
xor ecx, eax
imul edx, ecx, 0xc2b2ae35
mov eax, edx
shr eax, 0x10
xor eax, edx
xor edx, edx
div dword [0x180327f50]
mov rax, qword [r8 + rdx*8]
mov qword [rdi], rax
mov qword [r8 + rdx*8], rdi
mov rax, qword [rsp + 0x58]
mov rdx, qword [0x18032f598]
test rdx, rdx
je 0x18004c9d7
xor ecx, ecx
call fcn.180075b30
mov rax, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rdi
ret
Function at 0x18004dfe0
Capabilities:
Read file on windows

Disassembly:
push rbx
push rbp
push r14
push r15
sub rsp, 0x78
mov rax, qword [0x18032d860]
xor rax, rsp
mov qword [rsp + 0x58], rax
xor ebx, ebx
mov r14, rdx
mov qword [rdx], rbx
neg r9d
mov r15, r8
mov qword [r8], rbx
sbb edx, edx
xor r8d, r8d
and edx, 0x8000
call fcn.180238e18
mov ebp, eax
test eax, eax
jns 0x18004e029
lea eax, [rbx - 1]
jmp 0x18004e0ed
lea rdx, [rsp + 0x20]
mov qword [rsp + 0x70], rsi
mov ecx, ebp
call fcn.18023e024
test eax, eax
jne 0x18004e0dc
mov rcx, qword [rsp + 0x38]
movabs rax, 0x7ffffffffffffffe
cmp rcx, rax
ja 0x18004e0dc
inc rcx
call fcn.18022c454
mov rsi, rax
test rax, rax
je 0x18004e0dc
mov r8, qword [rsp + 0x38]
mov qword [rsp + 0x68], rdi
mov qword [rsp + 0x60], r12
mov r12d, 0x7fffffff
nop
mov rcx, r8
lea rdx, [rsi + rbx]
sub rcx, rbx
sub r8d, ebx
cmp rcx, r12
mov ecx, ebp
cmova r8d, r12d
call fcn.18023d0c4
movsxd rdi, eax
test eax, eax
jle 0x18004e0af
mov r8, qword [rsp + 0x38]
add rbx, rdi
cmp rbx, r8
jb 0x18004e080
mov ecx, ebp
call fcn.18023c954
mov r12, qword [rsp + 0x60]
test edi, edi
mov rdi, qword [rsp + 0x68]
jns 0x18004e0ce
mov rcx, rsi
call fcn.18022c440
jmp 0x18004e0e3
mov byte [rsi + rbx], 0
xor eax, eax
mov qword [r15], rbx
mov qword [r14], rsi
jmp 0x18004e0e8
mov ecx, ebp
call fcn.18023c954
mov eax, 0xfffffffe
mov rsi, qword [rsp + 0x70]
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.180227e50
add rsp, 0x78
pop r15
pop r14
pop rbp
pop rbx
ret

Function at 0x18004e110
Capabilities:
Connect socket

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
sub rsp, 0x30
xor ebp, ebp
mov esi, r8d
mov rdi, rdx
mov rbx, rcx
cmp qword [rcx], rbp
jge 0x18004e15c
movzx ecx, word [rdx]
xor r8d, r8d
lea edx, [rbp + 1]
call qword [sym.imp.WS2_32.dll_socket]
mov qword [rbx], rax
test rax, rax
js 0x18004e21b
mov rcx, rax
mov ebp, 1
call fcn.18004c660
test eax, eax
js 0x18004e20b
mov rcx, qword [rbx]
mov r8d, esi
mov rdx, rdi
call qword [sym.imp.WS2_32.dll_connect]
test eax, eax
jns 0x18004e22d
mov rsi, qword [rbx]
mov dword [rsp + 0x50], 4
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov edi, eax
cmp eax, 0x2733
jne 0x18004e1c1
test rsi, rsi
js 0x18004e1c1
lea rax, [rsp + 0x50]
mov edx, 0xffff
lea r9, [rsp + 0x68]
mov qword [rsp + 0x20], rax
mov r8d, 0x1007
mov rcx, rsi
call qword [sym.imp.WS2_32.dll_getsockopt]
test eax, eax
jne 0x18004e1de
mov ecx, dword [rsp + 0x68]
test ecx, ecx
jne 0x18004e1c3
mov ecx, edi
lea eax, [rcx - 0x2714]
cmp eax, 0x20
ja 0x18004e1ed
movabs rdx, 0x180040001
bt rdx, rax
jae 0x18004e1ed
xor eax, eax
mov rbx, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
pop rsi
pop rbp
ret
cmp ecx, 0x274d
jne 0x18004e207
mov eax, 2
mov rbx, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
pop rsi
pop rbp
ret
test ebp, ebp
je 0x18004e21b
mov rcx, qword [rbx]
call qword [sym.imp.WS2_32.dll_closesocket]
mov qword [rbx], 0xffffffffffffffff
mov eax, 0xffffffff
mov rbx, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
pop rsi
pop rbp
ret
mov rbx, qword [rsp + 0x58]
mov eax, 1
add rsp, 0x30
pop rdi
pop rsi
pop rbp
ret