joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1801830e0
Capabilities:
Generate random numbers via rtlgenrandom
Generate random numbers via winapi

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x20
test rdx, rdx
je 0x180183152
mov rsi, rdx
mov rdi, rcx
mov r14d, 0xffffffff
mov r15, qword [sym.imp.bcrypt.dll_BCryptGenRandom]
mov r12, qword [sym.imp.advapi32.dll_SystemFunction036]
jmp 0x180183118
add rdi, rbx
sub rsi, rbx
je 0x180183152
cmp rsi, r14
mov ebx, 0xffffffff
cmovb rbx, rsi
xor ecx, ecx
mov rdx, rdi
mov r8d, ebx
mov r9d, 2
call r15
cmp eax, 0xbfffffff
jbe 0x180183110
mov ebp, eax
mov rcx, rdi
mov edx, ebx
call r12
test al, al
jne 0x180183110
add ebp, 0x80000000
jmp 0x180183154
xor ebp, ebp
mov eax, ebp
add rsp, 0x20
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
Function at 0x18018c580
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x48
mov r12, r9
mov r9d, r8d
mov rdi, rdx
mov r14, qword [rcx + 0x10]
lea rcx, [rsp + 0x28]
mov rdx, r14
mov r8, rdi
mov byte [rsp + 0x27], r9b
call fcn.18018c380
movzx eax, byte [rsp + 0x31]
mov esi, 2
cmp al, 3
jne 0x18018c5c5
jmp 0x18018c71f
mov r13, qword [r12]
mov rcx, qword [r12 + 8]
mov qword [rsp + 0x40], rcx
add r13, 0x18
mov rcx, qword [r12 + 0x10]
mov qword [rsp + 0x38], rcx
lea rsi, [rsp + 0x28]
jmp 0x18018c62a
dec r15
mov edx, 0x18
mov r8d, 8
mov rcx, r15
call fcn.180057680
mov rsi, rbx
mov rcx, rbx
mov rdx, r14
mov r8, rdi
movzx r9d, byte [rsp + 0x27]
call fcn.18018c380
movzx eax, byte [rsp + 0x31]
cmp al, 3
je 0x18018c71a
mov rbp, qword [rsp + 0x28]
cmp al, 2
je 0x18018c70f
cmp qword [r13], 0xffffffffffffffff
je 0x18018c739
movzx r12d, byte [rsp + 0x30]
mov qword [rsp + 0x28], r13
mov rbx, rsi
mov rcx, rsi
mov rdx, qword [rsp + 0x40]
mov r8, qword [rsp + 0x38]
call fcn.1801a2cb0
mov r15, rdx
test rax, rax
je 0x18018c716
mov rsi, rax
mov rcx, r15
call fcn.18018c050
cmp al, 0xd
jne 0x18018c722
and ebp, 0x23
mov rax, qword [r14 + 0x90]
xor rbp, 0x2f
mov rcx, r12
shl rcx, 0x10
nop word cs:[rax + rax]
mov edx, eax
shr edx, 0x10
cmp r12b, dl
jne 0x18018c6bc
mov edx, eax
and edx, ebp
or rdx, rcx
lock cmpxchg qword [r14 + 0x90], rdx
jne 0x18018c6a0
mov eax, r15d
and eax, 3
lea rcx, [rax - 2]
cmp rcx, 2
jb 0x18018c606
test rax, rax
je 0x18018c606
mov rsi, qword [r15 - 1]
mov r12, qword [r15 + 7]
mov rax, qword [r12]
test rax, rax
je 0x18018c6ef
mov rcx, rsi
call rax
mov rdx, qword [r12 + 8]
test rdx, rdx
je 0x18018c5f0
mov r8, qword [r12 + 0x10]
mov rcx, rsi
call fcn.180057680
jmp 0x18018c5f0
mov esi, 1
jmp 0x18018c71f
xor esi, esi
jmp 0x18018c722
mov esi, 2
mov r15, rbp
mov rax, rsi
mov rdx, r15
add rsp, 0x48
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
ud2

Function at 0x18018c920
Capabilities:
Encode data using xor

Disassembly:
mov rax, qword [rcx]
nop word cs:[rax + rax]
mov rdx, rax
xor rdx, 3
lock cmpxchg qword [rcx], rdx
jne 0x18018c930
test al, 1
je 0x18018c94b
test al, 2
jne 0x18018c94b
xor rax, 3
ret
ud2

Function at 0x18018e420
Capabilities:
Set socket configuration

Disassembly:
cmp qword [rcx + 0x18], 0xffffffffffffffff
je 0x18018e430
add rcx, 0x18
jmp 0x1801a2c70
ud2
jmp 0x1801b1100
sub rsp, 0x38
movzx eax, dl
mov rcx, qword [rcx]
mov dword [rsp + 0x34], eax
mov dword [rsp + 0x20], 4
lea r9, [rsp + 0x34]
mov edx, 6
mov r8d, 1
call qword [sym.imp.ws2_32.dll_setsockopt]
cmp eax, 0xffffffff
je 0x1801b1138
xor eax, eax
add rsp, 0x38
ret
call qword [sym.imp.ws2_32.dll_WSAGetLastError]
shl rax, 0x20
or rax, 2
add rsp, 0x38
ret
Function at 0x18018e4c0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
jmp 0x1801966e0
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x38
mov rsi, r8
mov rdi, rdx
mov rbx, rcx
cmp qword [rcx + 0x18], 0xffffffffffffffff
je 0x18019672a
mov r15, qword [rbx + 0x10]
lea rcx, [rsp + 0x20]
mov rdx, r15
mov r8, rdi
xor r9d, r9d
call fcn.18018c380
movzx eax, byte [rsp + 0x29]
cmp al, 3
jne 0x180196755
mov eax, 1
jmp 0x1801968c3
mov rdx, qword [rbx + 0x10]
lea rcx, [rsp + 0x20]
mov r8, rdi
xor r9d, r9d
call fcn.18018c380
movzx eax, byte [rsp + 0x29]
cmp al, 3
jne 0x18019688c
mov eax, 1
jmp 0x1801968c3
add rbx, 0x18
lea r13, [rsp + 0x20]
mov qword [rsp + 0x30], rdi
jmp 0x1801967af
dec r13
mov edx, 0x18
mov r8d, 8
mov rcx, r13
call fcn.180057680
mov r13, rbx
mov rcx, rbx
mov rdx, r15
mov r8, qword [rsp + 0x30]
xor r9d, r9d
call fcn.18018c380
movzx eax, byte [rsp + 0x29]
cmp al, 3
mov rbx, rsi
mov rsi, r14
je 0x180196720
mov rbp, qword [rsp + 0x20]
cmp al, 2
je 0x180196895
mov r8, qword [rsi + 8]
mov r12, qword [rsi + 0x10]
sub r8, r12
jb 0x1801968df
movzx edi, byte [rsp + 0x28]
mov r14, rsi
mov rdx, qword [rsi]
add rdx, r12
mov rsi, rbx
mov qword [rsp + 0x20], rbx
mov rbx, r13
mov rcx, r13
call fcn.1801a2c90
mov r13, rdx
test rax, rax
je 0x180196899
mov rcx, r13
call fcn.180196380
cmp al, 0xd
jne 0x1801968be
and ebp, 0x23
mov rax, qword [r15 + 0x90]
xor rbp, 0x2f
mov rcx, rdi
shl rcx, 0x10
nop
mov edx, eax
shr edx, 0x10
cmp dil, dl
jne 0x18019683c
mov edx, eax
and edx, ebp
or rdx, rcx
lock cmpxchg qword [r15 + 0x90], rdx
jne 0x180196820
mov eax, r13d
and eax, 3
lea rcx, [rax - 2]
cmp rcx, 2
jb 0x180196786
test rax, rax
je 0x180196786
mov rbp, qword [r13 - 1]
mov rdi, qword [r13 + 7]
mov rax, qword [rdi]
test rax, rax
je 0x18019686e
mov rcx, rbp
call rax
mov rdx, qword [rdi + 8]
test rdx, rdx
je 0x180196770
mov r8, qword [rdi + 0x10]
mov rcx, rbp
call fcn.180057680
jmp 0x180196770
cmp al, 2
jne 0x1801968d7
mov rbp, qword [rsp + 0x20]
xor eax, eax
jmp 0x1801968c3
lea rax, [r12 + r13]
mov rcx, qword [r14 + 0x18]
cmp rax, rcx
jbe 0x1801968ad
mov qword [r14 + 0x18], rax
mov rcx, rax
add r12, r13
jb 0x1801968df
cmp rax, rcx
ja 0x1801968df
mov qword [r14 + 0x10], rax
xor r13d, r13d
xor eax, eax
mov rbp, r13
mov rdx, rbp
add rsp, 0x38
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov rax, qword [rsi + 0x10]
cmp rax, qword [rsi + 8]
ud2
Function at 0x18018e4d0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
jmp 0x1801968f0
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x48
mov qword [rsp + 0x40], r9
mov qword [rsp + 0x38], r8
mov rdi, rdx
mov r15, rcx
cmp qword [rcx + 0x18], 0xffffffffffffffff
je 0x180196941
mov r12, qword [r15 + 0x10]
lea rcx, [rsp + 0x28]
mov rdx, r12
mov r8, rdi
mov r9b, 1
call fcn.18018c380
movzx eax, byte [rsp + 0x31]
cmp al, 3
jne 0x18019696c
mov eax, 2
jmp 0x180196aa6
mov rdx, qword [r15 + 0x10]
lea rcx, [rsp + 0x28]
mov r8, rdi
mov r9b, 1
call fcn.18018c380
movzx eax, byte [rsp + 0x31]
cmp al, 3
jne 0x180196a8c
mov eax, 2
jmp 0x180196aa6
add r15, 0x18
lea rsi, [rsp + 0x28]
jmp 0x1801969b3
dec r13
mov edx, 0x18
mov r8d, 8
mov rcx, r13
call fcn.180057680
mov rsi, r14
mov rcx, r14
mov rdx, r12
mov r8, rdi
mov r9b, 1
call fcn.18018c380
movzx eax, byte [rsp + 0x31]
cmp al, 3
je 0x180196937
mov rbp, qword [rsp + 0x28]
cmp al, 2
je 0x180196aa1
movzx ebx, byte [rsp + 0x30]
mov qword [rsp + 0x28], r15
mov r14, rsi
mov rcx, rsi
mov rdx, qword [rsp + 0x38]
mov r8, qword [rsp + 0x40]
call fcn.1801a2ca0
mov rsi, rax
mov r13, rdx
test rax, rax
je 0x180196a9c
mov rcx, r13
call fcn.180196380
cmp al, 0xd
jne 0x180196a9c
and ebp, 0x23
mov rax, qword [r12 + 0x90]
xor rbp, 0x2f
mov rcx, rbx
shl rcx, 0x10
nop word cs:[rax + rax]
mov edx, eax
shr edx, 0x10
cmp bl, dl
jne 0x180196a3c
mov edx, eax
and edx, ebp
or rdx, rcx
lock cmpxchg qword [r12 + 0x90], rdx
jne 0x180196a20
mov eax, r13d
and eax, 3
lea rcx, [rax - 2]
cmp rcx, 2
jb 0x180196996
test rax, rax
je 0x180196996
mov rsi, qword [r13 - 1]
mov rbx, qword [r13 + 7]
mov rax, qword [rbx]
test rax, rax
je 0x180196a6e
mov rcx, rsi
call rax
mov rdx, qword [rbx + 8]
test rdx, rdx
je 0x180196980
mov r8, qword [rbx + 0x10]
mov rcx, rsi
call fcn.180057680
jmp 0x180196980
cmp al, 2
jne 0x180196abd
mov r13, qword [rsp + 0x28]
mov eax, 1
jmp 0x180196aa9
mov rax, rsi
jmp 0x180196aa9
mov eax, 1
mov r13, rbp
mov rdx, r13
add rsp, 0x48
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
ud2
Function at 0x1801966e0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
jmp 0x1801966e0
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x38
mov rsi, r8
mov rdi, rdx
mov rbx, rcx
cmp qword [rcx + 0x18], 0xffffffffffffffff
je 0x18019672a
mov r15, qword [rbx + 0x10]
lea rcx, [rsp + 0x20]
mov rdx, r15
mov r8, rdi
xor r9d, r9d
call fcn.18018c380
movzx eax, byte [rsp + 0x29]
cmp al, 3
jne 0x180196755
mov eax, 1
jmp 0x1801968c3
mov rdx, qword [rbx + 0x10]
lea rcx, [rsp + 0x20]
mov r8, rdi
xor r9d, r9d
call fcn.18018c380
movzx eax, byte [rsp + 0x29]
cmp al, 3
jne 0x18019688c
mov eax, 1
jmp 0x1801968c3
add rbx, 0x18
lea r13, [rsp + 0x20]
mov qword [rsp + 0x30], rdi
jmp 0x1801967af
dec r13
mov edx, 0x18
mov r8d, 8
mov rcx, r13
call fcn.180057680
mov r13, rbx
mov rcx, rbx
mov rdx, r15
mov r8, qword [rsp + 0x30]
xor r9d, r9d
call fcn.18018c380
movzx eax, byte [rsp + 0x29]
cmp al, 3
mov rbx, rsi
mov rsi, r14
je 0x180196720
mov rbp, qword [rsp + 0x20]
cmp al, 2
je 0x180196895
mov r8, qword [rsi + 8]
mov r12, qword [rsi + 0x10]
sub r8, r12
jb 0x1801968df
movzx edi, byte [rsp + 0x28]
mov r14, rsi
mov rdx, qword [rsi]
add rdx, r12
mov rsi, rbx
mov qword [rsp + 0x20], rbx
mov rbx, r13
mov rcx, r13
call fcn.1801a2c90
mov r13, rdx
test rax, rax
je 0x180196899
mov rcx, r13
call fcn.180196380
cmp al, 0xd
jne 0x1801968be
and ebp, 0x23
mov rax, qword [r15 + 0x90]
xor rbp, 0x2f
mov rcx, rdi
shl rcx, 0x10
nop
mov edx, eax
shr edx, 0x10
cmp dil, dl
jne 0x18019683c
mov edx, eax
and edx, ebp
or rdx, rcx
lock cmpxchg qword [r15 + 0x90], rdx
jne 0x180196820
mov eax, r13d
and eax, 3
lea rcx, [rax - 2]
cmp rcx, 2
jb 0x180196786
test rax, rax
je 0x180196786
mov rbp, qword [r13 - 1]
mov rdi, qword [r13 + 7]
mov rax, qword [rdi]
test rax, rax
je 0x18019686e
mov rcx, rbp
call rax
mov rdx, qword [rdi + 8]
test rdx, rdx
je 0x180196770
mov r8, qword [rdi + 0x10]
mov rcx, rbp
call fcn.180057680
jmp 0x180196770
cmp al, 2
jne 0x1801968d7
mov rbp, qword [rsp + 0x20]
xor eax, eax
jmp 0x1801968c3
lea rax, [r12 + r13]
mov rcx, qword [r14 + 0x18]
cmp rax, rcx
jbe 0x1801968ad
mov qword [r14 + 0x18], rax
mov rcx, rax
add r12, r13
jb 0x1801968df
cmp rax, rcx
ja 0x1801968df
mov qword [r14 + 0x10], rax
xor r13d, r13d
xor eax, eax
mov rbp, r13
mov rdx, rbp
add rsp, 0x38
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov rax, qword [rsi + 0x10]
cmp rax, qword [rsi + 8]
ud2
Function at 0x1801968f0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
jmp 0x1801968f0
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x48
mov qword [rsp + 0x40], r9
mov qword [rsp + 0x38], r8
mov rdi, rdx
mov r15, rcx
cmp qword [rcx + 0x18], 0xffffffffffffffff
je 0x180196941
mov r12, qword [r15 + 0x10]
lea rcx, [rsp + 0x28]
mov rdx, r12
mov r8, rdi
mov r9b, 1
call fcn.18018c380
movzx eax, byte [rsp + 0x31]
cmp al, 3
jne 0x18019696c
mov eax, 2
jmp 0x180196aa6
mov rdx, qword [r15 + 0x10]
lea rcx, [rsp + 0x28]
mov r8, rdi
mov r9b, 1
call fcn.18018c380
movzx eax, byte [rsp + 0x31]
cmp al, 3
jne 0x180196a8c
mov eax, 2
jmp 0x180196aa6
add r15, 0x18
lea rsi, [rsp + 0x28]
jmp 0x1801969b3
dec r13
mov edx, 0x18
mov r8d, 8
mov rcx, r13
call fcn.180057680
mov rsi, r14
mov rcx, r14
mov rdx, r12
mov r8, rdi
mov r9b, 1
call fcn.18018c380
movzx eax, byte [rsp + 0x31]
cmp al, 3
je 0x180196937
mov rbp, qword [rsp + 0x28]
cmp al, 2
je 0x180196aa1
movzx ebx, byte [rsp + 0x30]
mov qword [rsp + 0x28], r15
mov r14, rsi
mov rcx, rsi
mov rdx, qword [rsp + 0x38]
mov r8, qword [rsp + 0x40]
call fcn.1801a2ca0
mov rsi, rax
mov r13, rdx
test rax, rax
je 0x180196a9c
mov rcx, r13
call fcn.180196380
cmp al, 0xd
jne 0x180196a9c
and ebp, 0x23
mov rax, qword [r12 + 0x90]
xor rbp, 0x2f
mov rcx, rbx
shl rcx, 0x10
nop word cs:[rax + rax]
mov edx, eax
shr edx, 0x10
cmp bl, dl
jne 0x180196a3c
mov edx, eax
and edx, ebp
or rdx, rcx
lock cmpxchg qword [r12 + 0x90], rdx
jne 0x180196a20
mov eax, r13d
and eax, 3
lea rcx, [rax - 2]
cmp rcx, 2
jb 0x180196996
test rax, rax
je 0x180196996
mov rsi, qword [r13 - 1]
mov rbx, qword [r13 + 7]
mov rax, qword [rbx]
test rax, rax
je 0x180196a6e
mov rcx, rsi
call rax
mov rdx, qword [rbx + 8]
test rdx, rdx
je 0x180196980
mov r8, qword [rbx + 0x10]
mov rcx, rsi
call fcn.180057680
jmp 0x180196980
cmp al, 2
jne 0x180196abd
mov r13, qword [rsp + 0x28]
mov eax, 1
jmp 0x180196aa9
mov rax, rsi
jmp 0x180196aa9
mov eax, 1
mov r13, rbp
mov rdx, r13
add rsp, 0x48
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
ud2

Function at 0x180196ac0
Capabilities:
Set socket configuration

Disassembly:
jmp 0x1801a02f0
sub rsp, 0x38
mov rcx, qword [rcx]
movzx eax, dl
mov dword [rsp + 0x34], eax
mov dword [rsp + 0x20], 4
lea r9, [rsp + 0x34]
mov edx, 0xffff
mov r8d, 4
call qword [sym.imp.ws2_32.dll_setsockopt]
cmp eax, 0xffffffff
je 0x1801a0328
xor eax, eax
add rsp, 0x38
ret
call sub.kernel32.dll_GetLastError
shl rax, 0x20
or rax, 2
add rsp, 0x38
ret

Function at 0x180196ad0
Capabilities:
Set socket configuration

Disassembly:
mov edx, edx
jmp 0x1801a0340
sub rsp, 0x38
mov rcx, qword [rcx]
mov dword [rsp + 0x34], edx
mov dword [rsp + 0x20], 4
lea r9, [rsp + 0x34]
mov edx, 0xffff
mov r8d, 0x1001
call qword [sym.imp.ws2_32.dll_setsockopt]
cmp eax, 0xffffffff
je 0x1801a0375
xor eax, eax
add rsp, 0x38
ret
call sub.kernel32.dll_GetLastError
shl rax, 0x20
or rax, 2
add rsp, 0x38
ret
Function at 0x180196ae0
Capabilities:
Set socket configuration

Disassembly:
mov edx, edx
jmp 0x1801a02a0
sub rsp, 0x38
mov rcx, qword [rcx]
mov dword [rsp + 0x34], edx
mov dword [rsp + 0x20], 4
lea r9, [rsp + 0x34]
mov edx, 0xffff
mov r8d, 0x1002
call qword [sym.imp.ws2_32.dll_setsockopt]
cmp eax, 0xffffffff
je 0x1801a02d5
xor eax, eax
add rsp, 0x38
ret
call sub.kernel32.dll_GetLastError
shl rax, 0x20
or rax, 2
add rsp, 0x38
ret

Function at 0x18019c2e0
Capabilities:
Encode data using xor

Disassembly:
push rsi
sub rsp, 0x50
mov rsi, rcx
mov rax, qword [rcx]
nop dword [rax + rax]
mov rcx, rax
xor rcx, 3
lock cmpxchg qword [rsi], rcx
jne 0x18019c2f0
test al, 1
je 0x18019c3e3
test al, 2
jne 0x18019c3e3
test al, 8
jne 0x18019c32b
lea rcx, [rsi + 0x20]
mov qword [rsp + 0x28], 4
lea rdx, [rsp + 0x28]
call fcn.18018f290
jmp 0x18019c343
test al, 0x10
je 0x18019c343
mov rax, qword [rsi + 0x60]
test rax, rax
je 0x18019c3e3
mov rcx, qword [rsi + 0x68]
call qword [rax + 0x10]
mov rax, 0xffffffffffffffc0
lock xadd qword [rsi], rax
cmp rax, 0x3f
jbe 0x18019c3e3
and rax, 0xffffffffffffffc0
cmp rax, 0x40
jne 0x18019c3ac
mov rcx, qword [rsi + 0x28]
add rcx, 0xfffffffffffffffe
cmp rcx, 3
mov eax, 1
cmovb rax, rcx
cmp rax, 1
je 0x18019c3b2
test rax, rax
jne 0x18019c3bb
mov rdx, qword [rsi + 0x30]
movabs rax, 0x8000000000000000
cmp rdx, rax
je 0x18019c3bb
test rdx, rdx
je 0x18019c3bb
mov rcx, qword [rsi + 0x38]
mov r8d, 1
call fcn.180057680
jmp 0x18019c3bb
add rsp, 0x50
pop rsi
ret
lea rcx, [rsi + 0x28]
call fcn.180135190
mov rax, qword [rsi + 0x60]
test rax, rax
je 0x18019c3cb
mov rcx, qword [rsi + 0x68]
call qword [rax + 0x18]
mov edx, 0x80
mov r8d, 0x80
mov rcx, rsi
add rsp, 0x50
pop rsi
jmp fcn.180057680
ud2
Function at 0x1801a0220
Capabilities:
Connect socket

Disassembly:
sub rsp, 0x28
mov rcx, qword [rcx]
mov r8d, dword [rdx + 0x80]
call qword [sym.imp.ws2_32.dll_connect]
test eax, eax
je 0x1801a024a
call sub.kernel32.dll_GetLastError
shl rax, 0x20
or rax, 2
add rsp, 0x28
ret
xor eax, eax
add rsp, 0x28
ret

Function at 0x1801a0260
Capabilities:
Set socket configuration

Disassembly:
sub rsp, 0x28
mov rcx, qword [rcx]
movzx eax, dl
mov dword [rsp + 0x24], eax
lea r8, [rsp + 0x24]
mov edx, 0x8004667e
call qword [sym.imp.ws2_32.dll_ioctlsocket]
cmp eax, 0xffffffff
je 0x1801a028a
xor eax, eax
add rsp, 0x28
ret
call sub.kernel32.dll_GetLastError
shl rax, 0x20
or rax, 2
add rsp, 0x28
ret

Function at 0x1801a02a0
Capabilities:
Set socket configuration

Disassembly:
mov edx, edx
jmp 0x1801a02a0
sub rsp, 0x38
mov rcx, qword [rcx]
mov dword [rsp + 0x34], edx
mov dword [rsp + 0x20], 4
lea r9, [rsp + 0x34]
mov edx, 0xffff
mov r8d, 0x1002
call qword [sym.imp.ws2_32.dll_setsockopt]
cmp eax, 0xffffffff
je 0x1801a02d5
xor eax, eax
add rsp, 0x38
ret
call sub.kernel32.dll_GetLastError
shl rax, 0x20
or rax, 2
add rsp, 0x38
ret

Function at 0x1801a02f0
Capabilities:
Set socket configuration

Disassembly:
jmp 0x1801a02f0
sub rsp, 0x38
mov rcx, qword [rcx]
movzx eax, dl
mov dword [rsp + 0x34], eax
mov dword [rsp + 0x20], 4
lea r9, [rsp + 0x34]
mov edx, 0xffff
mov r8d, 4
call qword [sym.imp.ws2_32.dll_setsockopt]
cmp eax, 0xffffffff
je 0x1801a0328
xor eax, eax
add rsp, 0x38
ret
call sub.kernel32.dll_GetLastError
shl rax, 0x20
or rax, 2
add rsp, 0x38
ret

Function at 0x1801a0340
Capabilities:
Set socket configuration

Disassembly:
mov edx, edx
jmp 0x1801a0340
sub rsp, 0x38
mov rcx, qword [rcx]
mov dword [rsp + 0x34], edx
mov dword [rsp + 0x20], 4
lea r9, [rsp + 0x34]
mov edx, 0xffff
mov r8d, 0x1001
call qword [sym.imp.ws2_32.dll_setsockopt]
cmp eax, 0xffffffff
je 0x1801a0375
xor eax, eax
add rsp, 0x38
ret
call sub.kernel32.dll_GetLastError
shl rax, 0x20
or rax, 2
add rsp, 0x38
ret
Function at 0x1801a0390
Capabilities:
Set socket configuration

Disassembly:
push rsi
push rdi
sub rsp, 0x58
mov rdi, rdx
mov rsi, qword [rcx]
mov dword [rsp + 0x48], 1
mov dword [rsp + 0x20], 4
lea r9, [rsp + 0x48]
mov rcx, rsi
mov edx, 0xffff
mov r8d, 8
call qword [sym.imp.ws2_32.dll_setsockopt]
cmp eax, 0xffffffff
je 0x1801a04b7
mov r9d, dword [rdi + 8]
xor ecx, ecx
mov r8d, 0
cmp r9d, 0x3b9aca00
je 0x1801a0418
mov eax, 0x3e8
mul qword [rdi]
mov r8d, r9d
imul r9, r8, 0x431bde83
shr r9, 0x32
add r9, rax
adc rdx, 0
mov eax, 0xffffffff
cmp r9, rax
cmovae r9, rax
xor r8d, r8d
neg rdx
sbb r8d, r8d
or r8d, r9d
mov r9d, dword [rdi + 0x18]
cmp r9d, 0x3b9aca00
je 0x1801a0459
mov eax, 0x3e8
mul qword [rdi + 0x10]
mov ecx, r9d
imul r9, rcx, 0x431bde83
shr r9, 0x32
add r9, rax
adc rdx, 0
mov eax, 0xffffffff
cmp r9, rax
cmovae r9, rax
xor ecx, ecx
neg rdx
sbb ecx, ecx
or ecx, r9d
mov dword [rsp + 0x48], 1
mov dword [rsp + 0x4c], r8d
mov dword [rsp + 0x50], ecx
mov dword [rsp + 0x54], 0
xorps xmm0, xmm0
movups xmmword [rsp + 0x38], xmm0
lea rax, [rsp + 0x54]
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
lea r8, [rsp + 0x48]
mov rcx, rsi
mov edx, 0x98000004
mov r9d, 0xc
call qword [sym.imp.ws2_32.dll_WSAIoctl]
cmp eax, 0xffffffff
je 0x1801a04b7
xor eax, eax
jmp 0x1801a04c4
call sub.kernel32.dll_GetLastError
shl rax, 0x20
or rax, 2
add rsp, 0x58
pop rdi
pop rsi
ret

Function at 0x1801a2a60
Capabilities:
Set socket configuration

Disassembly:
push rsi
push rdi
sub rsp, 0x38
mov esi, edx
cmp word [rcx], 0
mov eax, 2
mov edi, 0x17
cmove edi, eax
mov eax, dword [0x180281360]
cmp eax, 3
jne 0x1801a2afd
mov ecx, edi
mov edx, esi
xor r8d, r8d
call qword [sym.imp.ws2_32.dll_socket]
cmp rax, 0xffffffffffffffff
je 0x1801a2ad8
mov rsi, rax
mov dword [rsp + 0x2c], 1
lea r8, [rsp + 0x2c]
mov rcx, rax
mov edx, 0x8004667e
call qword [sym.imp.ws2_32.dll_ioctlsocket]
test eax, eax
je 0x1801a2aee
call sub.kernel32.dll_GetLastError
mov edi, eax
shl rdi, 0x20
or rdi, 2
mov rcx, rsi
call qword [sym.imp.ws2_32.dll_closesocket]
mov eax, 1
jmp 0x1801a2af3
call sub.kernel32.dll_GetLastError
mov edi, eax
shl rdi, 0x20
or rdi, 2
mov eax, 1
jmp 0x1801a2af3
xor eax, eax
mov rdi, rsi
mov rdx, rdi
add rsp, 0x38
pop rdi
pop rsi
ret
mov byte [rsp + 0x2b], 1
lea rax, [rsp + 0x2b]
mov qword [rsp + 0x30], rax
lea rax, str.C:Userslucak.cargo_registry_srcindex.crates.io_6f17d22bba15001fmio_1.0.2_src_syswindows_net.rs
mov qword [rsp + 0x20], rax
lea rcx, [0x180281360]
lea r9, [0x180261518]
lea r8, [rsp + 0x30]
xor edx, edx
call fcn.1801fd9b0
jmp 0x1801a2a84
Function at 0x1801a2b40
Capabilities:
Connect socket

Disassembly:
push rsi
push rdi
push rbx
sub rsp, 0x40
mov rbx, rdx
mov rsi, rcx
mov rcx, rdx
mov edx, 1
call fcn.1801a2a60
mov rdi, rdx
test rax, rax
je 0x1801a2b72
mov qword [rsi + 8], rdi
mov qword [rsi], 0xffffffffffffffff
jmp 0x1801a2c13
cmp word [rbx], 0
je 0x1801a2b97
movups xmm0, xmmword [rbx + 4]
movzx eax, word [rbx + 0x1c]
rol ax, 8
mov ecx, dword [rbx + 0x18]
add rbx, 0x14
mov r8d, 0x1c
mov dx, 0x17
jmp 0x1801a2bb0
movzx eax, word [rbx + 6]
rol ax, 8
add rbx, 2
xorps xmm0, xmm0
mov r8d, 0x10
mov dx, 2
mov r9d, dword [rbx]
mov word [rsp + 0x24], dx
mov word [rsp + 0x26], ax
mov dword [rsp + 0x28], r9d
movups xmmword [rsp + 0x2c], xmm0
mov dword [rsp + 0x3c], ecx
lea rdx, [rsp + 0x24]
mov rcx, rdi
call qword [sym.imp.ws2_32.dll_connect]
cmp eax, 0xffffffff
jne 0x1801a2bea
call sub.kernel32.dll_GetLastError
cmp eax, 0x2733
jne 0x1801a2bf7
mov qword [rsi], rdi
mov qword [rsi + 8], 0
jmp 0x1801a2c13
shl rax, 0x20
or rax, 2
mov qword [rsi + 8], rax
mov qword [rsi], 0xffffffffffffffff
mov rcx, rdi
call qword [sym.imp.ws2_32.dll_closesocket]
mov rax, rsi
add rsp, 0x40
pop rbx
pop rdi
pop rsi
ret
Function at 0x1801ab630
Capabilities:
Parse pe header

Disassembly:
push r15
push r14
push r12
push rsi
push rdi
push rbp
push rbx
movzx eax, word [rdx]
cmp eax, 0x5a4d
jne 0x1801ab6bc
movsxd rax, dword [rdx + 0x3c]
test rax, rax
je 0x1801ab6c1
cmp eax, 0x40
jb 0x1801ab7b1
cmp rax, r8
ja 0x1801ab7b1
movzx r9d, word [rax + rdx + 0x18]
cmp r9d, 0x10b
je 0x1801ab6c6
mov r10b, 5
cmp r9d, 0x20b
jne 0x1801ab6f1
mov r10b, 2
cmp dword [rdx + rax], 0x4550
jne 0x1801ab6f1
lea r9, [rdx + rax]
movzx r11d, word [r9 + 4]
mov r10b, 3
cmp r11d, 0x8664
jne 0x1801ab6f1
mov r10b, 4
test byte [r9 + 0x16], 2
je 0x1801ab6f1
lea r10, [rax + 0x108]
mov r11d, 1
cmp r10, r8
jbe 0x1801ab724
jmp 0x1801ab7b1
xor r10d, r10d
jmp 0x1801ab6f1
mov r10b, 1
jmp 0x1801ab6f1
mov r10b, 2
cmp dword [rdx + rax], 0x4550
jne 0x1801ab6f1
lea r9, [rdx + rax]
movzx r11d, word [r9 + 4]
mov r10b, 3
cmp r11d, 0x14c
jne 0x1801ab6f1
mov r10b, 4
test byte [r9 + 0x16], 2
jne 0x1801ab711
mov byte [rcx], r10b
mov r8d, 2
mov eax, 0x18
mov qword [rcx + rax], r8
mov rax, rcx
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r14
pop r15
ret
lea r10, [rax + 0xf8]
cmp r10, r8
ja 0x1801ab7b1
xor r11d, r11d
mov rsi, r8
sub rsi, r10
movzx ebx, word [rdx + rax + 6]
lea rdi, [rbx*8]
lea rdi, [rdi + rdi*4]
sub rsi, rdi
jb 0x1801ab7b1
add rax, 0xffffffffffffffc0
lea r14, [rdx + 0x40]
add r10, rdx
mov r15, rdx
shr r15, 8
add rdi, r10
mov ebp, ebx
shr ebp, 8
mov byte [rcx], dl
mov r12, rdx
shr r12, 0x38
mov byte [rcx + 7], r12b
mov r12, rdx
shr r12, 0x28
mov word [rcx + 5], r12w
mov dword [rcx + 1], r15d
mov qword [rcx + 8], r14
mov qword [rcx + 0x10], rax
mov qword [rcx + 0x18], r11
mov qword [rcx + 0x20], r9
mov qword [rcx + 0x28], r10
mov byte [rcx + 0x30], bl
mov dword [rcx + 0x31], ebp
mov byte [rcx + 0x37], 0
mov word [rcx + 0x35], 0
mov qword [rcx + 0x38], rdi
mov qword [rcx + 0x40], rsi
mov qword [rcx + 0x48], rdx
mov eax, 0x50
jmp 0x1801ab6ff
ud2