joyce8/EMBER2024-capa huggingface dataset:
Function at 0x469020
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x10
mov qword [rsp + 0x20], rax
test rbx, rbx
jbe 0x469197
movzx edx, byte [rax]
test edx, edx
jne 0x469054
nop dword [rax]
test r8b, r8b
jne 0x469054
xor eax, eax
xor ebx, ebx
mov rcx, rbx
xor edi, edi
add rsp, 0x10
pop rbp
ret
bt edx, 7
jae 0x469067
xor edx, edx
xor r8d, r8d
xor r9d, r9d
jmp 0x469157
mov r8d, 1
mov r9d, edx
and edx, 1
neg edx
shr r9d, 1
xor edx, r9d
add dword [rsi], edx
nop dword [rax]
cmp rbx, r8
jb 0x469145
sub rbx, r8
sub rcx, r8
mov rdx, rcx
neg rdx
sar rdx, 0x3f
and r8, rdx
lea rdx, [rax + r8]
test rbx, rbx
jbe 0x469137
movzx esi, byte [rax + r8]
bt esi, 7
jae 0x4690bd
xor eax, eax
xor esi, esi
xor r8d, r8d
jmp 0x469100
mov eax, 1
cmp rax, rbx
ja 0x4690eb
add qword [rdi], rsi
sub rcx, rax
sub rbx, rax
mov rsi, rcx
neg rsi
sar rsi, 0x3f
and rax, rsi
add rax, rdx
mov edi, 1
add rsp, 0x10
pop rbp
ret
mov rcx, rbx
call sym.runtime.panicSliceB
lea r8d, [rcx + 7]
mov rcx, r11
mov eax, r12d
nop dword [rax]
cmp rax, rbx
jae 0x46912f
movzx r9d, byte [rax + rdx]
mov r10d, r9d
and r9d, 0x7f
mov r11, rcx
mov ecx, r8d
shl r9d, cl
lea r12d, [rax + 1]
or esi, r9d
test r10b, 0x80
jne 0x4690f3
mov rcx, r11
mov eax, r12d
jmp 0x4690c2
mov rcx, rbx
call sym.runtime.panicIndex
xor eax, eax
mov rcx, rax
nop dword [rax]
call sym.runtime.panicIndex
mov eax, r8d
mov rcx, rbx
call sym.runtime.panicSliceB
lea r9d, [rcx + 7]
mov rcx, r12
cmp rbx, rdx
jbe 0x46918d
movzx r10d, byte [rdx + rax]
mov r11d, r10d
and r10d, 0x7f
mov r12, rcx
mov ecx, r9d
shl r10d, cl
inc edx
or r8d, r10d
test r11b, 0x80
jne 0x469150
mov rcx, r12
mov r9d, edx
mov edx, r8d
mov r8d, r9d
jmp 0x46906d
mov eax, edx
mov rcx, rbx
call sym.runtime.panicIndex
xor eax, eax
mov rcx, rax
nop dword [rax]
call sym.runtime.panicIndex
nop
int3

Function at 0x46a720
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x46a7cf
push rbp
mov rbp, rsp
sub rsp, 0x58
mov qword [rsp + 0x70], rbx
lea rdx, [rsp + 0x68]
mov qword [rsp + 8], 0
movups xmmword [rsp + 0x10], xmm15
movups xmmword [rsp + 0x18], xmm15
movups xmmword [rsp + 0x28], xmm15
movups xmmword [rsp + 0x38], xmm15
movups xmmword [rsp + 0x48], xmm15
lea rsi, [sym.runtime.callers.func1]
mov qword [rsp + 0x10], rsi
mov rsi, qword [rsp + 0x60]
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdx
mov rdx, r14
mov qword [rsp + 0x28], rdx
lea rdx, [rsp + 8]
mov qword [rsp + 0x30], rdx
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x48], rcx
mov qword [rsp + 0x50], rdi
mov qword [rsp + 0x40], rbx
lea rax, [rsp + 0x10]
mov qword [rsp], rax
call sym.runtime.systemstack.abi0
xorps xmm15, xmm15
mov r14, qword [0x005c17d0]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 8]
add rsp, 0x58
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
call sym.runtime.morestack_noctxt.abi0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
nop dword [rax]
jmp sym.runtime.callers
Function at 0x46dc20
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
cmp byte [0x005c15ac], 0
je 0x46dc2e
jmp sym.aeshashbody
jmp sym.runtime.memhashFallback

Function at 0x46dc40
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
cmp byte [0x005c15ac], 0
je 0x46dc55
mov rcx, qword [rax + 8]
mov rax, qword [rax]
jmp sym.aeshashbody
jmp sym.runtime.strhashFallback

Function at 0x46dc60
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
cmp byte [0x005c15ac], 0
je 0x46dc95
movq xmm0, rbx
pinsrd xmm0, dword [rax], 2
aesenc xmm0, xmmword [0x005c1be0]
aesenc xmm0, xmmword [0x005c1bf0]
aesenc xmm0, xmmword [0x005c1c00]
movq rax, xmm0
ret
jmp sym.runtime.memhash32Fallback

Function at 0x46dca0
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
cmp byte [0x005c15ac], 0
je 0x46dcd6
movq xmm0, rbx
pinsrq xmm0, qword [rax], 1
aesenc xmm0, xmmword [0x005c1be0]
aesenc xmm0, xmmword [0x005c1bf0]
aesenc xmm0, xmmword [0x005c1c00]
movq rax, xmm0
ret
jmp sym.runtime.memhash64Fallback

Function at 0x46f360
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push rbp
mov rbp, rsp
pushfq
cld
sub rsp, 0xe0
mov qword [rsp], rdi
mov qword [rsp + 8], rsi
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], r12
mov qword [rsp + 0x28], r13
mov qword [rsp + 0x30], r14
mov qword [rsp + 0x38], r15
movups xmmword [rsp + 0x40], xmm6
movups xmmword [rsp + 0x50], xmm7
movups xmmword [rsp + 0x60], xmm8
movups xmmword [rsp + 0x70], xmm9
movups xmmword [rsp + 0x80], xmm10
movups xmmword [rsp + 0x90], xmm11
movups xmmword [rsp + 0xa0], xmm12
movups xmmword [rsp + 0xb0], xmm13
movups xmmword [rsp + 0xc0], xmm14
movups xmmword [rsp + 0xd0], xmm15
xorps xmm15, xmm15
xor r14, r14
mov rax, qword [0x005c17d0]
mov rax, qword gs:[rax]
cmp rax, 0
je 0x46f3fb
mov r14, qword [rax]
sub rsp, 0x10
mov rax, rcx
mov rbx, rdx
call sym.runtime.sigtrampgo
add rsp, 0x10
mov rdi, qword [rsp]
mov rsi, qword [rsp + 8]
mov rbp, qword [rsp + 0x10]
mov rbx, qword [rsp + 0x18]
mov r12, qword [rsp + 0x20]
mov r13, qword [rsp + 0x28]
mov r14, qword [rsp + 0x30]
mov r15, qword [rsp + 0x38]
movups xmm6, xmmword [rsp + 0x40]
movups xmm7, xmmword [rsp + 0x50]
movups xmm8, xmmword [rsp + 0x60]
movups xmm9, xmmword [rsp + 0x70]
movups xmm10, xmmword [rsp + 0x80]
movups xmm11, xmmword [rsp + 0x90]
movups xmm12, xmmword [rsp + 0xa0]
movups xmm13, xmmword [rsp + 0xb0]
movups xmm14, xmmword [rsp + 0xc0]
movups xmm15, xmmword [rsp + 0xd0]
add rsp, 0xe0
popfq
pop rbp
ret
Function at 0x46f620
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push rbp
mov rbp, rsp
sub rsp, 0x28
pushfq
cld
sub rsp, 0xe0
mov qword [rsp], rdi
mov qword [rsp + 8], rsi
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], r12
mov qword [rsp + 0x28], r13
mov qword [rsp + 0x30], r14
mov qword [rsp + 0x38], r15
movups xmmword [rsp + 0x40], xmm6
movups xmmword [rsp + 0x50], xmm7
movups xmmword [rsp + 0x60], xmm8
movups xmmword [rsp + 0x70], xmm9
movups xmmword [rsp + 0x80], xmm10
movups xmmword [rsp + 0x90], xmm11
movups xmmword [rsp + 0xa0], xmm12
movups xmmword [rsp + 0xb0], xmm13
movups xmmword [rsp + 0xc0], xmm14
movups xmmword [rsp + 0xd0], xmm15
mov rax, qword [0x005c17d0]
mov rax, qword gs:[rax]
cmp rax, 0
jne 0x46f6b7
int 3
mov r14, qword [rax]
sub rsp, 0x28
mov qword [rsp], rcx
mov qword [rsp + 8], rdx
mov qword [rsp + 0x10], r8
mov qword [rsp + 0x18], r9
call sym.runtime.sehhandler.abi0
mov eax, dword [rsp + 0x20]
add rsp, 0x28
mov rdi, qword [rsp]
mov rsi, qword [rsp + 8]
mov rbp, qword [rsp + 0x10]
mov rbx, qword [rsp + 0x18]
mov r12, qword [rsp + 0x20]
mov r13, qword [rsp + 0x28]
mov r14, qword [rsp + 0x30]
mov r15, qword [rsp + 0x38]
movups xmm6, xmmword [rsp + 0x40]
movups xmm7, xmmword [rsp + 0x50]
movups xmm8, xmmword [rsp + 0x60]
movups xmm9, xmmword [rsp + 0x70]
movups xmm10, xmmword [rsp + 0x80]
movups xmm11, xmmword [rsp + 0x90]
movups xmm12, xmmword [rsp + 0xa0]
movups xmm13, xmmword [rsp + 0xb0]
movups xmm14, xmmword [rsp + 0xc0]
movups xmm15, xmmword [rsp + 0xd0]
add rsp, 0xe0
popfq
add rsp, 0x28
pop rbp
ret

Function at 0x46fa80
Capabilities:
Allocate thread local storage

Disassembly:
push rbp
mov rbp, rsp
mov rax, rsp
and rsp, 0xfffffffffffffff0
sub rsp, 0x30
mov qword [rsp + 0x20], rax
mov rax, qword [sym.imp.kernel32.dll_TlsAlloc]
call rax
mov rsp, qword [rsp + 0x20]
mov rcx, rax
cmp rcx, 0x40
jb 0x46fab4
mov rcx, 0x28
jmp 0x46fabf
shl rcx, 3
add rcx, 0x1480
mov qword [0x005c17d0], rcx
pop rbp
ret
Function at 0x476a00
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x476afe
push rbp
mov rbp, rsp
sub rsp, 0x10
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x40], rsi
nop dword [rax]
test r8, r8
je 0x476a82
cmp rdi, r8
jb 0x476af2
cmp rbx, rsi
je 0x476a65
mov rdx, rbx
lea rdi, [rsi + r8]
lea rdi, [rdi - 1]
nop
nop
cmp rdi, rbx
jb 0x476a62
mov rdi, rsi
lea r9, [rdx + r8]
lea r9, [r9 - 1]
cmp r9, rsi
jae 0x476adf
mov rbx, rdx
mov rsi, rdi
nop
jmp 0x476a65
mov rbx, rdx
lea rdx, [r8 - 1]
cmp rcx, rdx
jbe 0x476ad7
movzx ecx, byte [rax + 0x400]
movzx edx, byte [rax + 0x401]
xor edi, edi
nop
jmp 0x476ac0
add rsp, 0x10
pop rbp
ret
movzx r9d, byte [rsi + rdi]
inc ecx
movzx r10d, cl
mov r11d, dword [rax + r10*4]
add edx, r11d
movzx r12d, dl
mov r13d, dword [rax + r12*4]
mov dword [rax + r10*4], r13d
mov dword [rax + r12*4], r11d
lea r10d, [r11 + r13]
movzx r10d, r10b
xor r9d, dword [rax + r10*4]
mov byte [rbx + rdi], r9b
inc rdi
nop dword [rax]
cmp r8, rdi
jg 0x476a88
mov byte [rax + 0x400], cl
mov byte [rax + 0x401], dl
add rsp, 0x10
pop rbp
ret
mov rax, rdx
call sym.runtime.panicIndex
lea rax, [0x004ae800]
lea rbx, [0x004ef000]
call sym.runtime.gopanic
mov rcx, r8
mov rdx, rdi
call sym.runtime.panicSliceAcap
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x30], r8
mov qword [rsp + 0x38], r9
call sym.runtime.morestack_noctxt.abi0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x28]
mov r8, qword [rsp + 0x30]
mov r9, qword [rsp + 0x38]
jmp sym.crypto_rc4._Cipher_.XORKeyStream

Function at 0x479e80
Capabilities:
Hash data using fnv

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x47a5bf
push rbp
mov rbp, rsp
sub rsp, 0x10
mov qword [rsp + 0x20], rax
movabs rcx, 0xcbf29ce484222325
jmp 0x479ead
lea rax, [rdx + 0x10]
dec rbx
mov rcx, rsi
test rbx, rbx
jle 0x47a131
mov rdx, rax
mov rsi, qword [rax]
nop dword [rax]
test rsi, rsi
je 0x47a15d
mov edi, dword [rsi + 0x10]
shr edi, 1
mov r8, qword [rax + 8]
and edi, 0x3f
lea rax, [0x004f03e0]
jmp qword [rax + rdi*8]
mov rax, rcx
add rsp, 0x10
pop rbp
ret
lea rax, [0x004ae800]
lea rbx, [0x004ef320]
call sym.runtime.gopanic
inc rax
cmp rax, r8
jge 0x47a182
mov r9, qword [rsi + rax*8]
xor r10d, r10d
nop
jmp 0x47a1b7
lea rdi, [0x004ae880]
mov rsi, rcx
movabs rcx, 0x100000001b3
jmp 0x479ea3
movzx r11d, r9b
xor rcx, r11
inc r10
shr r9, 8
movabs r11, 0x100000001b3
imul rcx, r11
cmp r10, 8
jl 0x47a19b
jmp 0x47a170
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
call sym.runtime.morestack_noctxt.abi0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
jmp sym.internal_bisect.Hash
Function at 0x47a760
Capabilities:
Hash data using fnv

Disassembly:
test byte [rax], al
mov rcx, rbx
and ebx, 0x7f
shl rbx, 5
lea rdx, [rax + rbx]
xor eax, eax
jmp 0x47a777
inc rax
cmp rax, 4
jge 0x47a78f
lea rbx, [rdx + rax*8]
mov rbx, qword [rbx]
cmp rbx, rcx
jne 0x47a774
mov eax, 1
ret
xor eax, eax
movabs rbx, 0xcbf29ce484222325
jmp 0x47a7a0
inc rax
cmp rax, 4
jge 0x47a7ae
mov rsi, qword [rdx + rax*8]
xor edi, edi
jmp 0x47a7d7
and ebx, 3
lea rdx, [rdx + rbx*8]
xchg qword [rdx], rcx
xor eax, eax
ret
movzx r8d, sil
xor rbx, r8
inc rdi
shr rsi, 8
movabs r8, 0x100000001b3
imul rbx, r8
cmp rdi, 8
jl 0x47a7bb
jmp 0x47a79d
Function at 0x4803a0
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x48046a
push rbp
mov rbp, rsp
sub rsp, 0x48
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rbx
mov qword [rsp], rax
mov qword [rsp + 8], rbx
mov byte [rsp + 0x10], 0
call sym.internal_bytealg.IndexByteString.abi0
xorps xmm15, xmm15
mov r14, qword [0x005c17d0]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x18], 0xffffffffffffffff
jne 0x48044f
mov rcx, qword [rsp + 0x60]
lea rdx, [rcx + 1]
mov qword [rsp + 0x40], rdx
lea rax, [0x004ae900]
xor ebx, ebx
mov rcx, rdx
call sym.runtime.makeslice
mov rbx, qword [rsp + 0x60]
mov rcx, rax
xor edi, edi
mov rsi, qword [rsp + 0x40]
mov rax, qword [rsp + 0x58]
nop dword [rax]
call sym.syscall.encodeWTF16
inc rbx
cmp rcx, rbx
jae 0x48043e
mov edi, 1
lea rsi, [0x004ae900]
call sym.runtime.growslice
mov word [rax + rbx*2 - 2], 0
xor edi, edi
xor esi, esi
add rsp, 0x48
pop rbp
ret
xor eax, eax
xor ebx, ebx
mov rcx, rbx
lea rdi, [0x004ef408]
lea rsi, [0x004eee60]
add rsp, 0x48
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call sym.runtime.morestack_noctxt.abi0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp sym.syscall.UTF16FromString

Function at 0x490020
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4900cc
push rbp
mov rbp, rsp
sub rsp, 0x40
mov byte [rsp + 0x60], cl
mov byte [rsp + 0x61], dil
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], rbx
mov qword [rsp], rax
mov qword [rsp + 8], rbx
mov byte [rsp + 0x10], cl
call sym.internal_bytealg.IndexByteString.abi0
xorps xmm15, xmm15
mov r14, qword [0x005c17d0]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x18], 0xffffffffffffffff
je 0x490093
lea rax, [rsp + 0x20]
mov rbx, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x58]
call sym.runtime.stringtoslicebyte
movzx edx, byte [rsp + 0x61]
movzx esi, byte [rsp + 0x60]
xor ecx, ecx
jmp 0x4900a6
mov rax, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x58]
add rsp, 0x40
pop rbp
ret
inc rcx
cmp rbx, rcx
jle 0x4900b9
movzx edi, byte [rax + rcx]
cmp dil, sil
jne 0x4900a3
mov byte [rax + rcx], dl
jmp 0x4900a3
mov rcx, rbx
mov rbx, rax
xor eax, eax
call sym.runtime.slicebytetostring
add rsp, 0x40
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov byte [rsp + 0x18], cl
mov byte [rsp + 0x19], dil
nop
call sym.runtime.morestack_noctxt.abi0
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
movzx ecx, byte [rsp + 0x18]
movzx edi, byte [rsp + 0x19]
jmp sym.internal_filepathlite.replaceStringByte
Function at 0x100002454
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 8], rsi
mov qword [rsp + 0x10], rdi
mov qword [rsp + 0x18], r12
push r13
sub rsp, 0x30
mov rax, qword gs:[0x30]
mov rdi, qword [rax + 8]
xor r12d, r12d
xor eax, eax
lock cmpxchg qword [0x100004758], rdi
je 0x1000024a2
cmp rax, rdi
jne 0x100002495
mov edi, 1
mov r12d, edi
jmp 0x1000024a7
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x100002479
mov edi, 1
mov eax, dword [0x100004750]
cmp eax, edi
jne 0x1000024bd
mov ecx, 0x1f
call sub.msvcrt.dll__amsg_exit
jmp 0x10000251a
mov eax, dword [0x100004750]
test eax, eax
jne 0x100002514
mov dword [0x100004750], edi
lea r13, [0x100001290]
lea rsi, [0x100001278]
mov qword [rsp + 0x28], rsi
mov dword [rsp + 0x20], eax
cmp rsi, r13
jae 0x100002506
test eax, eax
jne 0x100002506
mov rcx, qword [rsi]
test rcx, rcx
je 0x1000024fb
call rcx
mov dword [rsp + 0x20], eax
add rsi, 8
mov qword [rsp + 0x28], rsi
jmp 0x1000024e4
test eax, eax
je 0x10000251a
mov eax, 0xff
jmp 0x1000025ec
mov dword [0x100004184], edi
mov eax, dword [0x100004750]
cmp eax, edi
jne 0x100002541
lea rdx, [0x100001270]
lea rcx, [0x100001260]
call sub.msvcrt.dll__initterm
mov dword [0x100004750], 2
test r12d, r12d
jne 0x10000254f
xor eax, eax
xchg qword [0x100004758], rax
cmp qword [0x100004760], 0
je 0x100002578
lea rcx, [0x100004760]
call fcn.10000284c
test eax, eax
je 0x100002578
xor r8d, r8d
lea edx, [r8 + 2]
xor ecx, ecx
call qword [0x100004760]
mov r8, qword [0x100004168]
mov rdx, qword [0x100004170]
mov ecx, dword [0x100004160]
call fcn.100001b54
mov dword [0x100004180], eax
cmp dword [0x100004164], 0
jne 0x1000025a8
mov ecx, eax
call qword [sym.imp.msvcrt.dll_exit]
cmp dword [0x100004184], 0
jne 0x1000025bd
call qword [sym.imp.msvcrt.dll__cexit]
mov eax, dword [0x100004180]
jmp 0x1000025ec
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
mov r12, qword [rsp + 0x50]
add rsp, 0x30
pop r13
ret
sub rsp, 0x28
call fcn.100094000
add rsp, 0x28
jmp 0x100002454
Function at 0x180001070
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rsi
push rdi
push r15
sub rsp, 0x28
mov qword [rsp + 0x60], r13
xor r15d, r15d
mov qword [rsp + 0x20], r14
mov r13d, r9d
mov edi, r8d
mov r14, rdx
mov rbx, rcx
cmp qword [rcx + 8], r15
jne 0x18000109e
mov eax, r15d
jmp 0x1800010a4
mov eax, dword [rcx + 0x10]
sub eax, dword [rcx + 8]
lea ecx, [rax + rdi]
mov qword [rsp + 0x50], rbp
cmp ecx, dword [rbx + 0x18]
jb 0x18000113d
pxor xmm0, xmm0
mov eax, ecx
mov qword [rsp + 0x58], r12
cvtsi2sd xmm0, rax
mulsd xmm0, qword [0x18001fae8]
call fcn.18001a6d4
xor ecx, ecx
mov r8d, 0x1000
lea r9d, [rcx + 4]
cvttsd2si rbp, xmm0
shl ebp, 0xa
mov edx, ebp
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rdx, qword [rbx + 8]
mov rsi, rax
test rdx, rdx
jne 0x1800010ff
mov ecx, r15d
jmp 0x180001104
mov ecx, dword [rbx + 0x10]
sub ecx, edx
mov r12d, ecx
mov r8d, ecx
mov rcx, rax
call fcn.18000a910
mov rcx, qword [rbx + 8]
test rcx, rcx
je 0x180001129
xor edx, edx
mov r8d, 0x8000
call qword [sym.imp.KERNEL32.dll_VirtualFree]
lea rax, [r12 + rsi]
mov r12, qword [rsp + 0x58]
mov qword [rbx + 8], rsi
mov qword [rbx + 0x10], rax
mov dword [rbx + 0x18], ebp
mov rcx, qword [rbx + 0x10]
mov r8, rdi
mov rdx, r14
call fcn.18000a910
mov r14, qword [rsp + 0x20]
test r13d, r13d
mov r13, qword [rsp + 0x60]
je 0x1800011c8
mov r9, qword [rsp + 0x70]
mov r11d, r15d
mov r10, r15
mov rbp, r15
test edi, edi
jle 0x1800011c0
nop dword [rax]
movzx ecx, byte [r10 + r9]
mov r8, qword [rbx + 0x10]
inc r10
mov eax, 0x20f30021
imul ecx
sar edx, 8
mov eax, edx
shr eax, 0x1f
add edx, eax
mov eax, 0xcccccccd
imul edx, edx, 0x7c5
sub ecx, edx
mul r11d
add cl, 0x36
xor byte [r8 + rbp], cl
shr edx, 3
lea r8d, [rdx + rdx*4]
add r8d, r8d
cmp r11d, r8d
cmove r10, r15
inc r11d
inc rbp
cmp r11d, edi
jl 0x180001170
mov rcx, r9
call fcn.180001000
add qword [rbx + 0x10], rdi
mov rbp, qword [rsp + 0x50]
mov eax, edi
add rsp, 0x28
pop r15
pop rdi
pop rsi
pop rbx
ret

Function at 0x1800013e0
Capabilities:
Initialize winsock library

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x1d0
mov rax, qword [0x1800241e0]
xor rax, rsp
mov qword [rsp + 0x1c0], rax
xor edi, edi
lea rax, vtable.CBuffer.0
mov rbx, rcx
mov qword [rcx + 8], rax
mov dword [rcx + 0x20], edi
mov qword [rcx + 0x10], rdi
mov qword [rcx + 0x18], rdi
mov qword [rcx + 0x28], rax
mov dword [rcx + 0x40], edi
mov qword [rcx + 0x30], rdi
mov qword [rcx + 0x38], rdi
mov qword [rcx + 0x48], rax
mov dword [rcx + 0x60], edi
mov qword [rcx + 0x50], rdi
mov qword [rcx + 0x58], rdi
lea rax, vtable.CTcpSocket.0
lea rdx, [rsp + 0x20]
mov qword [rcx], rax
mov ecx, 0x202
call qword [sym.imp.WS2_32.dll_WSAStartup]
lea edx, [rdi + 1]
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov ecx, edi
mov qword [rbx + 0x68], rax
xchg dword [rbx + 0x74], ecx
mov qword [rbx + 0x98], 0xffffffffffffffff
mov dword [rbx + 0x70], edi
mov rax, rbx
mov rcx, qword [rsp + 0x1c0]
xor rcx, rsp
call fcn.18000a8e0
mov rbx, qword [rsp + 0x1e8]
add rsp, 0x1d0
pop rdi
ret
Function at 0x1800014a0
Capabilities:
Set socket configuration

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x30
mov rdi, rcx
mov rcx, qword [rcx + 0x98]
lea r9, [rsp + 0x40]
mov edx, 0xffff
mov r8d, 0x80
xor ebx, ebx
mov dword [rsp + 0x40], 1
mov dword [rsp + 0x20], 4
call qword [sym.imp.WS2_32.dll_setsockopt]
mov rcx, qword [rdi + 0x98]
call qword [sym.imp.KERNEL32.dll_CancelIo]
xchg dword [rdi + 0x74], ebx
mov rcx, qword [rdi + 0x98]
call qword [sym.imp.WS2_32.dll_closesocket]
mov rcx, qword [rdi + 0x68]
call qword [sym.imp.KERNEL32.dll_SetEvent]
mov rbx, qword [rsp + 0x48]
mov qword [rdi + 0x98], 0xffffffffffffffff
add rsp, 0x30
pop rdi
ret
Function at 0x180001520
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Create tcp socket
Create thread
Resolve dns
Set socket configuration

Disassembly:
push rbp
push rsi
push r12
push r13
push r14
push r15
sub rsp, 0x98
mov rax, qword [0x1800241e0]
xor rax, rsp
mov qword [rsp + 0x80], rax
mov rax, qword [rcx]
mov r12d, r8d
mov r13, rdx
mov rsi, rcx
call qword [rax]
mov rcx, qword [rsi + 0x68]
call qword [sym.imp.KERNEL32.dll_ResetEvent]
xor r14d, r14d
mov eax, r14d
xchg dword [rsi + 0x74], eax
call qword [sym.imp.WINMM.dll_timeGetTime]
mov ebp, 1
mov dword [rsi + 0x70], eax
xor eax, eax
mov r15d, 2
mov qword [rsi + 0x80], rax
mov word [rsi + 0x88], ax
mov rax, qword [rsi + 0x70]
lea r8d, [r14 + 6]
mov edx, ebp
mov ecx, r15d
mov qword [rsi + 0x80], rax
call qword [sym.imp.WS2_32.dll_socket]
mov qword [rsi + 0x98], rax
cmp rax, 0xffffffffffffffff
jne 0x1800015b7
xor al, al
jmp 0x180001753
mov rcx, r13
mov qword [rsp + 0xe8], rbx
mov qword [rsp + 0x90], rdi
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov qword [rsp + 0x38], r14
mov qword [rsp + 0x30], r14
mov r8, r13
xor edx, edx
xor ecx, ecx
mov r9d, eax
mov dword [rsp + 0x28], r14d
mov qword [rsp + 0x20], r14
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
movsxd rbx, eax
lea ecx, [rbx + 1]
movsxd rcx, ecx
call fcn.18000ad14
mov rcx, r13
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov qword [rsp + 0x38], r14
mov qword [rsp + 0x30], r14
mov r8, r13
xor edx, edx
mov r9d, eax
xor ecx, ecx
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], rdi
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov rcx, rdi
mov byte [rbx + rdi], r14b
call qword [sym.imp.WS2_32.dll_gethostbyname]
mov rcx, rdi
mov rbx, rax
call fcn.18000ac44
mov rdi, qword [rsp + 0x90]
test rbx, rbx
je 0x180001695
movzx ecx, r12w
mov word [rsp + 0x70], r15w
call qword [sym.imp.WS2_32.dll_htons]
lea rdx, [rsp + 0x70]
mov r8d, reloc.WS2_32.dll_recv
mov word [rsp + 0x72], ax
mov rax, qword [rbx + 0x18]
mov rcx, qword [rax]
mov eax, dword [rcx]
mov rcx, qword [rsi + 0x98]
mov dword [rsp + 0x74], eax
call qword [sym.imp.WS2_32.dll_connect]
cmp eax, 0xffffffff
jne 0x18000169c
xor al, al
jmp 0x18000174b
mov rcx, qword [rsi + 0x98]
lea r9, [rsp + 0x50]
mov edx, 0xffff
mov r8d, 8
mov dword [rsp + 0x50], ebp
mov dword [rsp + 0x20], 4
call qword [sym.imp.WS2_32.dll_setsockopt]
test eax, eax
jne 0x180001718
mov rcx, qword [rsi + 0x98]
mov qword [rsp + 0x40], r14
mov qword [rsp + 0x38], r14
lea rax, [rsp + 0x58]
lea r8, [rsp + 0x60]
mov r9d, ntohs
mov qword [rsp + 0x30], rax
mov edx, 0x98000004
mov dword [rsp + 0x28], r14d
mov qword [rsp + 0x20], r14
mov dword [rsp + 0x60], ebp
mov dword [rsp + 0x64], 0x2bf20
mov dword [rsp + 0x68], 0x1388
call qword [sym.imp.WS2_32.dll_WSAIoctl]
xchg dword [rsi + 0x74], ebp
lea rax, [rsp + 0x54]
lea r8, [0x180001780]
mov qword [rsp + 0x28], rax
mov r9, rsi
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x54], r14d
mov dword [rsp + 0x20], r14d
call fcn.18000ae88
mov qword [rsi + 0x90], rax
mov al, 1
mov rbx, qword [rsp + 0xe8]
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.18000a8e0
add rsp, 0x98
pop r15
pop r14
pop r13
pop r12
pop rsi
pop rbp
ret