joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1001540
Capabilities:
Terminate process

Disassembly:
cld
pop r11
jmp 0x100154d
inc rsi
mov byte [rdi], dl
inc rdi
mov dl, byte [rsi]
add ebx, ebx
jne 0x100155d
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jb 0x1001545
lea eax, [rcx + 1]
jmp 0x100156b
dec eax
call r11
adc eax, eax
call r11
adc eax, eax
add ebx, ebx
jne 0x100157e
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
mov dl, byte [rsi]
jae 0x1001564
sub eax, 3
jb 0x100159e
shl eax, 8
movzx edx, dl
or eax, edx
inc rsi
xor eax, 0xffffffff
je 0x10015ed
sar eax, 1
movsxd rbp, eax
jb 0x10015d4
jmp 0x10015ac
add ebx, ebx
jne 0x10015aa
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jb 0x10015d4
inc ecx
add ebx, ebx
jne 0x10015ba
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jb 0x10015d4
call r11
adc ecx, ecx
add ebx, ebx
jne 0x10015cd
mov ebx, dword [rsi]
sub rsi, 0xfffffffffffffffc
adc ebx, ebx
jae 0x10015bc
add ecx, 2
jmp 0x10015d9
call r11
adc ecx, ecx
cmp rbp, 0xfffffffffffffb00
adc ecx, 2
call fcn.01001502
jmp 0x100154d
pop rsi
pop rdi
pop rax
mov dword [rdi], eax
sub rsp, 0x28
lea rdi, [rsi + 0xbf2000]
mov eax, dword [rdi]
or eax, eax
je 0x100164d
mov ebx, dword [rdi + 4]
lea rcx, [rax + rsi + 0xc014ec]
add rbx, rsi
add rdi, 8
call qword [sym.imp.KERNEL32.DLL_LoadLibraryA]
xchg rbp, rax
mov al, byte [rdi]
inc rdi
or al, al
je 0x10015fd
mov rcx, rdi
mov rdx, rdi
dec eax
repne scasb al, byte [rdi]
mov rcx, rbp
call qword [sym.imp.KERNEL32.DLL_GetProcAddress]
or rax, rax
je 0x1001647
mov qword [rbx], rax
add rbx, 8
jmp 0x100161d
jmp qword [sym.imp.KERNEL32.DLL_ExitProcess]
add rsp, 0x28
add rdi, 4
lea rbx, [rsi - 4]
xor eax, eax
mov al, byte [rdi]
inc rdi
or eax, eax
je 0x1001691
cmp al, 0xef
ja 0x1001679
add rbx, rax
mov rax, qword [rbx]
bswap rax
add rax, rsi
mov qword [rbx], rax
jmp 0x1001659
and al, 0xf
shl eax, 0x10
mov ax, word [rdi]
add rdi, 2
or eax, eax
jne 0x1001668
mov eax, dword [rdi]
add rdi, 4
jmp 0x1001668
mov rbp, qword [sym.imp.KERNEL32.DLL_VirtualProtect]
lea rdi, [rsi - 0x1000]
mov ebx, 0x1000
push rax
mov r9, rsp
mov r8d, 4
mov rdx, rbx
mov rcx, rdi
sub rsp, 0x20
call rbp
lea rax, [rdi + 0x1af]
and byte [rax], 0x7f
and byte [rax + 0x28], 0x7f
lea r9, [rsp + 0x20]
mov r8, qword [r9]
mov rdx, rbx
mov rcx, rdi
call rbp
add rsp, 0x28
mov byte [fcn.01001710], 0xfc
lea rcx, [rsi - 0x1000]
push 1
pop rdx
xor r8, r8
push rax
call fcn.01001710
pop rax
pop rbp
pop rdi
pop rsi
pop rbx
lea rax, [rsp - 0x80]
push 0
cmp rsp, rax
jne 0x1001700
sub rsp, 0xffffffffffffff80
jmp 0x4014f0
Function at 0x180002aa0
Capabilities:
Send data
Send data on socket

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x20
mov r15, qword [0x180251320]
xor esi, esi
mov ebp, r8d
mov r14, rdx
mov ebx, esi
mov edi, r8d
mov eax, esi
test r8d, r8d
jle 0x180002b02
nop dword [rax]
nop word [rax + rax]
movsxd rdx, ebx
xor r9d, r9d
add rdx, r14
mov r8d, edi
mov rcx, r15
call qword [sym.imp.WS2_32.dll_send]
cmp eax, 0xffffffff
je 0x180002b05
add ebx, eax
sub edi, eax
cmp ebx, ebp
jl 0x180002ae0
cmp eax, 0xffffffff
mov rbx, qword [rsp + 0x40]
setne sil
mov rbp, qword [rsp + 0x48]
lea eax, [rsi - 1]
mov rsi, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop rdi
ret

Function at 0x180002b30
Capabilities:
Send data
Send data on socket

Disassembly:
push r14
sub rsp, 0x60
mov rax, qword [0x180240300]
xor rax, rsp
mov qword [rsp + 0x30], rax
mov r14, rcx
mov dword [rsp + 0x20], edx
lea rcx, reloc.OLEAUT32.dll_SysReAllocString
mov qword [rsp + 0x28], r8
call fcn.180157fb8
test eax, eax
jne 0x180002c6f
cmp dword [0x18024108c], 0x7fffffff
je 0x180002c5a
mov qword [rsp + 0x58], rbx
xor ebx, ebx
mov qword [rsp + 0x50], rbp
mov rbp, qword [0x180251320]
mov qword [rsp + 0x48], rsi
mov esi, 4
mov qword [rsp + 0x40], rdi
mov edi, ebx
nop dword [rax]
movsxd rax, edi
lea rdx, [rsp + 0x20]
add rdx, rax
xor r9d, r9d
mov r8d, esi
mov rcx, rbp
call qword [sym.imp.WS2_32.dll_send]
cmp eax, 0xffffffff
je 0x180002bc8
add edi, eax
sub esi, eax
cmp edi, 4
jl 0x180002ba0
mov rbp, qword [0x180251320]
cmp eax, 0xffffffff
mov esi, ebx
mov edi, 8
setne sil
dec esi
nop
movsxd rax, ebx
lea rdx, [rsp + 0x28]
add rdx, rax
xor r9d, r9d
mov r8d, edi
mov rcx, rbp
call qword [sym.imp.WS2_32.dll_send]
cmp eax, 0xffffffff
je 0x180002c08
add ebx, eax
sub edi, eax
cmp ebx, 8
jl 0x180002be0
mov r8d, dword [rsp + 0x20]
mov ebx, 0xffffffff
cmp eax, ebx
mov rdx, r14
cmove esi, ebx
call fcn.180002aa0
cmp eax, ebx
lea rcx, reloc.OLEAUT32.dll_SysReAllocString
cmove esi, ebx
call fcn.180157fc0
mov rdi, qword [rsp + 0x40]
mov eax, esi
mov rsi, qword [rsp + 0x48]
mov rbp, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.18017b580
add rsp, 0x60
pop r14
ret
mov ecx, 6
mov dword [0x18024108c], 0x7ffffffe
call fcn.1801576b4
int3
mov ecx, 5
call fcn.1801576b4
int3
Function at 0x180006ce0
Capabilities:
Delete registry key

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
mov rsi, rdx
mov rbx, rcx
mov rdi, qword [rcx + 0x10]
test rdi, rdi
je 0x180006d96
mov rbx, qword [rcx]
cmp qword [rdi], 0
je 0x180006d62
lea rcx, str.Advapi32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test rax, rax
je 0x180006d81
lea rdx, str.RegDeleteKeyTransactedA
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x180006d81
mov qword [rsp + 0x28], 0
mov rdx, qword [rdi]
mov qword [rsp + 0x20], rdx
xor r9d, r9d
xor r8d, r8d
mov rdx, rsi
mov rcx, rbx
call rax
nop
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
cmp dword [rdi + 8], 0
je 0x180006d81
mov rcx, rbx
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
jmp qword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
mov eax, 1
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
cmp byte [0x180251c20], 0
jne 0x180006de1
lea rcx, str.Advapi32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test rax, rax
je 0x180006dd1
lea rdx, str.RegDeleteKeyExA
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x180251c28], rax
mov byte [0x180251c20], 1
jmp 0x180006de8
mov rax, qword [0x180251c28]
mov byte [0x180251c20], 1
jmp 0x180006de8
mov rax, qword [0x180251c28]
mov rdx, rsi
mov rcx, qword [rbx]
test rax, rax
je 0x180006d6b
xor r9d, r9d
mov r8d, dword [rbx + 8]
call rax
nop
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
Function at 0x180006f20
Capabilities:
Query or enumerate registry key

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
sub rsp, 0x180
mov rax, qword [0x180240300]
xor rax, rsp
mov qword [rsp + 0x170], rax
mov r9d, dword [rcx + 8]
xor ebp, ebp
mov rsi, rdx
mov qword [rsp + 0x48], rbp
mov r8, rdx
mov qword [rsp + 0x40], rbp
mov rdx, qword [rcx]
mov rdi, rcx
or r9d, 0x2001f
mov qword [rsp + 0x50], rbp
lea rcx, [rsp + 0x40]
call fcn.180006e20
mov rcx, qword [rsp + 0x40]
mov ebx, eax
test eax, eax
jne 0x18000703c
lea rax, [rsp + 0x60]
mov dword [rsp + 0x58], 0x100
mov qword [rsp + 0x38], rax
lea r9, [rsp + 0x58]
mov qword [rsp + 0x30], rbp
lea r8, [rsp + 0x70]
mov qword [rsp + 0x28], rbp
xor edx, edx
mov qword [rsp + 0x20], rbp
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
test eax, eax
jne 0x180007011
nop dword [rax]
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x40]
call fcn.180006f20
mov rcx, qword [rsp + 0x40]
mov ebx, eax
test eax, eax
jne 0x18000703c
lea rax, [rsp + 0x60]
mov dword [rsp + 0x58], 0x100
mov qword [rsp + 0x38], rax
lea r9, [rsp + 0x58]
mov qword [rsp + 0x30], rbp
lea r8, [rsp + 0x70]
mov qword [rsp + 0x28], rbp
xor edx, edx
mov qword [rsp + 0x20], rbp
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
test eax, eax
je 0x180006fc0
mov rcx, qword [rsp + 0x40]
test rcx, rcx
je 0x180007026
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rsp + 0x40], rbp
mov rdx, rsi
mov dword [rsp + 0x48], ebp
mov rcx, rdi
call fcn.180006ce0
mov rcx, qword [rsp + 0x40]
mov ebx, eax
test rcx, rcx
je 0x180007047
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, ebx
mov rcx, qword [rsp + 0x170]
xor rcx, rsp
call fcn.18017b580
mov rbx, qword [rsp + 0x1b0]
add rsp, 0x180
pop rdi
pop rsi
pop rbp
ret
Function at 0x180012440
Capabilities:
Set socket configuration

Disassembly:
push rbp
push rdi
push r12
push r14
push r15
mov rbp, rsp
sub rsp, 0x80
mov rax, qword [0x180240300]
xor rax, rsp
mov qword [rbp - 0x18], rax
xor r12d, r12d
mov r15, r9
mov r14, rdx
mov rdi, rcx
cmp rcx, 0xffffffffffffffff
je 0x18001262d
mov qword [rsp + 0xc0], rbx
test r8b, r8b
je 0x1800124be
movzx eax, byte [rdx]
test al, 8
je 0x1800124be
or al, 8
mov dword [rbp - 0x20], r12d
mov byte [rdx], al
lea r9, [rbp - 0x20]
mov edx, 0xffff
mov dword [rsp + 0x20], 4
mov r8d, 0x80
call qword [sym.imp.WS2_32.dll_setsockopt]
test eax, eax
lea rcx, [rbp - 0x38]
setne dl
call fcn.1800122d0
mov rcx, rdi
call qword [sym.imp.WS2_32.dll_closesocket]
test eax, eax
mov rcx, r15
mov ebx, eax
setne dl
call fcn.1800122d0
test ebx, ebx
je 0x180012629
mov qword [rsp + 0x78], rsi
movabs rcx, 0x4d54ee85da812030
mov rsi, qword [0x180244b60]
add rcx, rsi
mov qword [rsp + 0x70], r13
mov dword [rbp - 0x4c], r12d
lea r13, [0x180244b58]
cmp rcx, 1
jbe 0x180012528
mov rax, qword [0x180244b58]
mov edx, 0x2733
mov rcx, r13
call qword [rax + 0x30]
mov rsi, qword [0x180244b60]
jmp 0x18001252a
mov al, 1
movzx eax, al
lea rdx, [rbp - 0x38]
add rax, 2
mov dword [rbp - 0x50], 0x2733
mov qword [rbp - 0x40], rax
mov rcx, r15
movsd xmm1, qword [rbp - 0x40]
mov qword [rbp - 0x48], r13
movups xmm0, xmmword [rbp - 0x50]
movsd qword [rbp - 0x28], xmm1
movups xmmword [rbp - 0x38], xmm0
call fcn.180011710
test al, al
jne 0x1800125c7
movabs rax, 0x4d54ee85da812030
mov dword [rbp - 0x4c], r12d
add rax, rsi
cmp rax, 1
jbe 0x18001258d
mov rax, qword [0x180244b58]
mov edx, 0x4d5
mov rcx, r13
call qword [rax + 0x30]
jmp 0x18001258f
mov al, 1
movzx eax, al
lea rdx, [rbp - 0x38]
add rax, 2
mov dword [rbp - 0x50], 0x4d5
mov qword [rbp - 0x40], rax
mov rcx, r15
movsd xmm1, qword [rbp - 0x40]
mov qword [rbp - 0x48], r13
movups xmm0, xmmword [rbp - 0x50]
movsd qword [rbp - 0x28], xmm1
movups xmmword [rbp - 0x38], xmm0
call fcn.180011710
test al, al
je 0x1800125f9
lea r8, [rbp - 0x20]
mov dword [rbp - 0x20], r12d
mov edx, 0x8004667e
mov rcx, rdi
call qword [sym.imp.WS2_32.dll_ioctlsocket]
and byte [r14], 0xfc
mov rcx, rdi
call qword [sym.imp.WS2_32.dll_closesocket]
test eax, eax
mov rcx, r15
mov ebx, eax
setne dl
call fcn.1800122d0
mov rsi, qword [rsp + 0x78]
mov eax, ebx
mov r13, qword [rsp + 0x70]
mov rbx, qword [rsp + 0xc0]
mov rcx, qword [rbp - 0x18]
xor rcx, rsp
call fcn.18017b580
add rsp, 0x80
pop r15
pop r14
pop r12
pop rdi
pop rbp
ret
mov eax, ebx
jmp 0x180012605
mov eax, r12d
jmp 0x18001260d
Function at 0x180012640
Capabilities:
Connect socket

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x40
mov rdi, r9
cmp rcx, 0xffffffffffffffff
jne 0x1800126cb
movabs rcx, 0x4d54ee85da812030
mov dword [rsp + 0x24], 0
add rcx, qword [0x180244b60]
lea rbx, [0x180244b58]
cmp rcx, 1
jbe 0x18001268d
mov rax, qword [0x180244b58]
mov edx, 0x2719
mov rcx, rbx
call qword [rax + 0x30]
jmp 0x18001268f
mov al, 1
movzx eax, al
add rax, 2
mov dword [rsp + 0x20], 0x2719
mov qword [rsp + 0x30], rax
mov eax, 0xffffffff
movsd xmm1, qword [rsp + 0x30]
mov qword [rsp + 0x28], rbx
movups xmm0, xmmword [rsp + 0x20]
movups xmmword [rdi], xmm0
movsd qword [rdi + 0x10], xmm1
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rdi
ret
call qword [sym.imp.WS2_32.dll_connect]
test eax, eax
mov rcx, rdi
mov ebx, eax
setne dl
call fcn.1800122d0
mov eax, ebx
mov rbx, qword [rsp + 0x50]
add rsp, 0x40
pop rdi
ret
Function at 0x1800126f0
Capabilities:
Set socket configuration

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r14
push r15
mov rbp, rsp
sub rsp, 0x50
cmp qword [rdx + 0x10], 1
mov rbx, rdx
mov rdi, rcx
je 0x18001271c
mov edx, dword [rdx]
jmp 0x18001274f
mov rcx, qword [rdx + 8]
movabs rax, 0x4800144005b3
mul rcx
mov rax, rcx
sub rax, rdx
shr rax, 1
add rax, rdx
shr rax, 0x14
imul rax, rax, 0x1ffff7
sub rcx, rax
imul edx, ecx, 0x3e8
add edx, dword [rbx]
xor r14d, r14d
lea rsi, [0x180244b58]
movabs r15, 0x4d54ee85da812030
sub edx, 0x79
je 0x18001283a
sub edx, 0x450
je 0x180012800
sub edx, 6
je 0x1800127c6
cmp edx, 1
jne 0x18001288b
mov rcx, qword [0x180244b60]
add rcx, r15
mov dword [rbp - 0x1c], r14d
cmp rcx, 1
jbe 0x1800127b8
mov rax, qword [0x180244b58]
mov edx, 0x2751
mov rcx, rsi
call qword [rax + 0x30]
mov dword [rbp - 0x20], 0x2751
jmp 0x18001286b
mov al, 1
mov dword [rbp - 0x20], 0x2751
jmp 0x18001286b
mov rcx, qword [0x180244b60]
add rcx, r15
mov dword [rbp - 0x1c], r14d
cmp rcx, 1
jbe 0x1800127f5
mov rax, qword [0x180244b58]
mov edx, 0x2743
mov rcx, rsi
call qword [rax + 0x30]
mov dword [rbp - 0x20], 0x2743
jmp 0x18001286b
mov al, 1
mov dword [rbp - 0x20], 0x2743
jmp 0x18001286b
mov rcx, qword [0x180244b60]
add rcx, r15
mov dword [rbp - 0x1c], r14d
cmp rcx, 1
jbe 0x18001282f
mov rax, qword [0x180244b58]
mov edx, 0x274d
mov rcx, rsi
call qword [rax + 0x30]
mov dword [rbp - 0x20], 0x274d
jmp 0x18001286b
mov al, 1
mov dword [rbp - 0x20], 0x274d
jmp 0x18001286b
mov rcx, qword [0x180244b60]
add rcx, r15
mov dword [rbp - 0x1c], r14d
cmp rcx, 1
jbe 0x180012862
mov rax, qword [0x180244b58]
mov edx, 0x274c
mov rcx, rsi
call qword [rax + 0x30]
jmp 0x180012864
mov al, 1
mov dword [rbp - 0x20], 0x274c
movzx eax, al
mov qword [rbp - 0x18], rsi
add rax, 2
movups xmm0, xmmword [rbp - 0x20]
mov qword [rbp - 0x10], rax
movsd xmm1, qword [rbp - 0x10]
movups xmmword [rbx], xmm0
movsd qword [rbx + 0x10], xmm1
mov rax, qword [rbx + 0x10]
test al, 1
je 0x1800128a6
cmp rax, 1
jne 0x180012928
cmp dword [rbx], r14d
jne 0x180012928
cmp rdi, 0xffffffffffffffff
jne 0x1800128ff
mov rcx, qword [0x180244b60]
add rcx, r15
mov dword [rbp - 0x1c], r14d
cmp rcx, 1
jbe 0x1800128d4
mov rax, qword [0x180244b58]
mov edx, 0x2719
mov rcx, rsi
call qword [rax + 0x30]
jmp 0x1800128d6
mov al, 1
movzx eax, al
mov dword [rbp - 0x20], 0x2719
add rax, 2
mov qword [rbp - 0x18], rsi
movups xmm0, xmmword [rbp - 0x20]
mov qword [rbp - 0x10], rax
movsd xmm1, qword [rbp - 0x10]
movups xmmword [rbx], xmm0
movsd qword [rbx + 0x10], xmm1
jmp 0x180012928
xor r9d, r9d
mov dword [rsp + 0x20], r14d
mov edx, 0xffff
mov r8d, 0x7010
mov rcx, rdi
call qword [sym.imp.WS2_32.dll_setsockopt]
test eax, eax
mov rcx, rbx
setne dl
call fcn.1800122d0
mov rbx, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
mov rdi, qword [rsp + 0x80]
add rsp, 0x50
pop r15
pop r14
pop rbp
ret
Function at 0x180012f00
Capabilities:
Send data
Send data on socket

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rbp
push rdi
push r12
push r14
push r15
mov rbp, rsp
sub rsp, 0x70
mov rax, qword [0x180240300]
xor rax, rsp
mov qword [rbp - 0x10], rax
mov rbx, qword [rbp + 0x50]
lea r9, [rbp - 0x18]
xor r15d, r15d
mov r8d, 1
mov qword [rsp + 0x30], r15
mov qword [rsp + 0x28], r15
mov dword [rsp + 0x20], r15d
mov dword [rbp - 0x18], r15d
call qword [sym.imp.WS2_32.dll_WSASend]
mov esi, eax
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov rdx, qword [0x180244b60]
lea r14, [0x180244b58]
movabs r12, 0x4d54ee85da812030
mov dword [rbp - 0x2c], r15d
add rdx, r12
mov edi, eax
cmp rdx, 1
jbe 0x180012f95
mov rcx, qword [0x180244b58]
mov edx, eax
mov r8, qword [rcx + 0x30]
mov rcx, r14
call r8
jmp 0x180012f9a
test edi, edi
setne al
movzx eax, al
movabs r10, 0x4800144005b3
add rax, 2
mov dword [rbp - 0x30], edi
mov qword [rbp - 0x28], r14
movups xmm0, xmmword [rbp - 0x30]
mov qword [rbp - 0x20], rax
movsd xmm1, qword [rbp - 0x20]
movups xmmword [rbx], xmm0
movsd qword [rbx + 0x10], xmm1
mov r9, qword [rbx + 0x10]
cmp r9, 1
je 0x180012fd8
mov eax, dword [rbx]
mov r8d, eax
jmp 0x180013008
mov rcx, qword [rbx + 8]
mov rax, r10
mov r8d, dword [rbx]
mul rcx
mov rax, rcx
sub rax, rdx
shr rax, 1
add rax, rdx
shr rax, 0x14
imul rax, rax, 0x1ffff7
sub rcx, rax
imul eax, ecx, 0x3e8
add eax, r8d
cmp eax, 0x40
jne 0x180013047
mov rcx, qword [0x180244b60]
add rcx, r12
mov dword [rbp - 0x2c], r15d
cmp rcx, 1
jbe 0x18001303c
mov rax, qword [0x180244b58]
mov edx, 0x2746
mov rcx, r14
call qword [rax + 0x30]
mov dword [rbp - 0x30], 0x2746
jmp 0x1800130b4
mov al, 1
mov dword [rbp - 0x30], 0x2746
jmp 0x1800130b4
cmp r9, 1
jne 0x18001307a
mov rcx, qword [rbx + 8]
mov rax, r10
mul rcx
mov rax, rcx
sub rax, rdx
shr rax, 1
add rax, rdx
shr rax, 0x14
imul rax, rax, 0x1ffff7
sub rcx, rax
imul eax, ecx, 0x3e8
add r8d, eax
cmp r8d, 0x4d2
jne 0x1800130d4
mov rcx, qword [0x180244b60]
add rcx, r12
mov dword [rbp - 0x2c], r15d
cmp rcx, 1
jbe 0x1800130ab
mov rax, qword [0x180244b58]
mov edx, 0x274d
mov rcx, r14
call qword [rax + 0x30]
jmp 0x1800130ad
mov al, 1
mov dword [rbp - 0x30], 0x274d
movzx eax, al
mov qword [rbp - 0x28], r14
add rax, 2
movups xmm0, xmmword [rbp - 0x30]
mov qword [rbp - 0x20], rax
movsd xmm1, qword [rbp - 0x20]
movups xmmword [rbx], xmm0
movsd qword [rbx + 0x10], xmm1
test esi, esi
je 0x1800130df
mov eax, 0xffffffff
jmp 0x1800130f6
mov eax, dword [rbp - 0x18]
xorps xmm0, xmm0
movups xmmword [rbx], xmm0
mov qword [rbp - 0x20], r15
movsd xmm0, qword [rbp - 0x20]
movsd qword [rbx + 0x10], xmm0
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.18017b580
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rbp
ret
Function at 0x180013ea0
Capabilities:
Terminate thread

Disassembly:
push rbx
sub rsp, 0x40
mov rax, qword [0x180240300]
xor rax, rsp
mov qword [rsp + 0x30], rax
mov rax, qword [rcx + 0x10]
lea rdx, [rsp + 0x20]
mov qword [rsp + 0x20], rax
mov rbx, rcx
mov rax, qword [rcx + 8]
mov r9d, 0xffffffff
mov ecx, 2
mov qword [rsp + 0x28], rax
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
mov rcx, qword [rbx + 0x10]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
lock xadd dword [0x180251c38], eax
test eax, eax
mov rax, qword [rbx + 8]
je 0x180013f1d
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateThread]
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.18017b580
add rsp, 0x40
pop rbx
ret
xor r8d, r8d
lea rcx, [fcn.1800121c0]
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_QueueUserAPC]
mov rcx, qword [rbx + 8]
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.18017b580
add rsp, 0x40
pop rbx
ret
Function at 0x180017fe0
Capabilities:
Send data
Send data on socket

Disassembly:
push rsi
push rdi
sub rsp, 0x58
mov rax, qword [0x180240300]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov rdi, qword [rsp + 0xa0]
mov r11, r9
mov rax, qword [rcx + 8]
mov r10, r8
mov rsi, rcx
lock inc dword [rax + 0x30]
cmp byte [rsp + 0x98], 0
je 0x180018030
mov rcx, qword [rcx + 8]
xor r9d, r9d
xor r8d, r8d
mov rdx, rdi
call fcn.180014e90
jmp 0x1800180c8
mov rcx, qword [rdx]
cmp rcx, 0xffffffffffffffff
jne 0x180018050
mov rcx, qword [rsi + 8]
xor r9d, r9d
mov r8d, 0x2719
mov rdx, rdi
call fcn.180014e90
jmp 0x1800180c8
xor eax, eax
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x30], rax
lea r9, [rsp + 0x40]
mov dword [rsp + 0x40], eax
mov r8d, r11d
mov eax, dword [rsp + 0x90]
mov rdx, r10
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], eax
call qword [sym.imp.WS2_32.dll_WSASend]
mov ebx, eax
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x4d2
mov ecx, 0x274d
cmove eax, ecx
test ebx, ebx
mov rbx, qword [rsp + 0x50]
je 0x1800180bc
cmp eax, 0x3e5
je 0x1800180bc
mov r9d, dword [rsp + 0x40]
mov r8d, eax
mov rcx, qword [rsi + 8]
mov rdx, rdi
call fcn.180014e90
jmp 0x1800180c8
mov rcx, qword [rsi + 8]
mov rdx, rdi
call fcn.180014e00
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.18017b580
add rsp, 0x58
pop rdi
pop rsi
ret

Function at 0x1800180e0
Capabilities:
Receive data
Receive data on socket

Disassembly:
push rbx
push rdi
sub rsp, 0x58
mov rax, qword [0x180240300]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov rbx, qword [rsp + 0xa0]
mov r11, r9
mov rax, qword [rcx + 8]
mov r10, r8
mov rdi, rcx
lock inc dword [rax + 0x30]
cmp byte [rsp + 0x98], 0
je 0x180018130
mov rcx, qword [rcx + 8]
xor r9d, r9d
xor r8d, r8d
mov rdx, rbx
call fcn.180014e90
jmp 0x1800181e1
mov rcx, qword [rdx]
cmp rcx, 0xffffffffffffffff
jne 0x180018153
mov rcx, qword [rdi + 8]
xor r9d, r9d
mov r8d, 0x2719
mov rdx, rbx
call fcn.180014e90
jmp 0x1800181e1
mov eax, dword [rsp + 0x90]
lea r9, [rsp + 0x40]
xor edx, edx
mov dword [rsp + 0x44], eax
mov qword [rsp + 0x30], rdx
lea rax, [rsp + 0x44]
mov dword [rsp + 0x40], edx
mov r8d, r11d
mov qword [rsp + 0x28], rbx
mov rdx, r10
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x50], rsi
call qword [sym.imp.WS2_32.dll_WSARecv]
mov esi, eax
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x40
jne 0x1800181a2
mov eax, 0x2746
jmp 0x1800181af
cmp eax, 0x4d2
mov ecx, 0x274d
cmove eax, ecx
test esi, esi
mov rsi, qword [rsp + 0x50]
je 0x1800181d5
cmp eax, 0x3e5
je 0x1800181d5
mov r9d, dword [rsp + 0x40]
mov r8d, eax
mov rcx, qword [rdi + 8]
mov rdx, rbx
call fcn.180014e90
jmp 0x1800181e1
mov rcx, qword [rdi + 8]
mov rdx, rbx
call fcn.180014e00
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.18017b580
add rsp, 0x58
pop rdi
pop rbx
ret
Function at 0x180024220
Capabilities:
Encode data using base64

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x30
mov rbp, r9
mov r14, r8
mov rbx, rdx
mov qword [rsp + 0x28], rdx
xor r12d, r12d
mov dword [rsp + 0x20], r12d
xorps xmm0, xmm0
movups xmmword [rdx], xmm0
mov qword [rdx + 0x10], r12
mov qword [rdx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rdx], r12b
mov dword [rsp + 0x20], 1
lea rcx, [r9 + 2]
movabs rax, 0xaaaaaaaaaaaaaaab
mul rcx
shr rdx, 1
shl rdx, 2
mov rcx, rbx
call fcn.18002f330
test rbp, rbp
je 0x18002441c
mov edi, 3
lea r15, [0x1801fdc30]
nop
mov edx, r12d
lea rax, [rdi - 3]
cmp rax, rdi
jae 0x1800242c7
nop dword [rax]
shl edx, 8
cmp rax, rbp
jae 0x1800242bf
movzx ecx, byte [rax + r14]
or edx, ecx
inc rax
cmp rax, rdi
jb 0x1800242b0
movsxd rsi, edx
mov rax, rsi
sar rax, 0x12
and eax, 0x3f
movzx r9d, byte [rax + r15]
mov rcx, qword [rbx + 0x10]
mov rdx, qword [rbx + 0x18]
cmp rcx, rdx
jae 0x180024305
lea rax, [rcx + 1]
mov qword [rbx + 0x10], rax
mov rax, rbx
cmp rdx, 0xf
jbe 0x1800242fa
mov rax, qword [rbx]
mov byte [rax + rcx], r9b
mov byte [rax + rcx + 1], 0
jmp 0x180024315
xor r8d, r8d
mov edx, 1
mov rcx, rbx
call fcn.18003d120
mov rax, rsi
sar rax, 0xc
and eax, 0x3f
movzx r9d, byte [rax + r15]
mov rcx, qword [rbx + 0x10]
mov rdx, qword [rbx + 0x18]
cmp rcx, rdx
jae 0x180024350
lea rax, [rcx + 1]
mov qword [rbx + 0x10], rax
mov rax, rbx
cmp rdx, 0xf
jbe 0x180024345
mov rax, qword [rbx]
mov byte [rax + rcx], r9b
mov byte [rax + rcx + 1], 0
jmp 0x180024360
xor r8d, r8d
mov edx, 1
mov rcx, rbx
call fcn.18003d120
lea rax, [rdi - 2]
cmp rax, rbp
jae 0x18002437a
mov rax, rsi
sar rax, 6
and eax, 0x3f
movzx r9d, byte [rax + r15]
jmp 0x18002437d
mov r9b, 0x3d
mov rcx, qword [rbx + 0x10]
mov rdx, qword [rbx + 0x18]
cmp rcx, rdx
jae 0x1800243a9
lea rax, [rcx + 1]
mov qword [rbx + 0x10], rax
mov rax, rbx
cmp rdx, 0xf
jbe 0x18002439e
mov rax, qword [rbx]
mov byte [rax + rcx], r9b
mov byte [rax + rcx + 1], 0
jmp 0x1800243b9
xor r8d, r8d
mov edx, 1
mov rcx, rbx
call fcn.18003d120
lea rax, [rdi - 1]
cmp rax, rbp
jae 0x1800243cc
and esi, 0x3f
movzx r9d, byte [rsi + r15]
jmp 0x1800243cf
mov r9b, 0x3d
mov rcx, qword [rbx + 0x10]
mov rdx, qword [rbx + 0x18]
cmp rcx, rdx
jae 0x1800243fb
lea rax, [rcx + 1]
mov qword [rbx + 0x10], rax
mov rax, rbx
cmp rdx, 0xf
jbe 0x1800243f0
mov rax, qword [rbx]
mov byte [rax + rcx], r9b
mov byte [rax + rcx + 1], 0
jmp 0x18002440b
xor r8d, r8d
mov edx, 1
mov rcx, rbx
call fcn.18003d120
add rdi, 3
lea rcx, [rdi - 3]
cmp rcx, rbp
jb 0x1800242a0
mov rax, rbx
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x70]
add rsp, 0x30
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret