joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180012520
Capabilities:
Set socket configuration

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r14
push r15
mov rbp, rsp
sub rsp, 0x50
cmp qword [rdx + 0x10], 1
mov rbx, rdx
mov rdi, rcx
je 0x18001254c
mov edx, dword [rdx]
jmp 0x18001257f
mov rcx, qword [rdx + 8]
movabs rax, 0x4800144005b3
mul rcx
mov rax, rcx
sub rax, rdx
shr rax, 1
add rax, rdx
shr rax, 0x14
imul rax, rax, 0x1ffff7
sub rcx, rax
imul edx, ecx, 0x3e8
add edx, dword [rbx]
xor r14d, r14d
lea rsi, [0x180244090]
movabs r15, 0x4d54ee85da812030
sub edx, 0x79
je 0x18001266a
sub edx, 0x450
je 0x180012630
sub edx, 6
je 0x1800125f6
cmp edx, 1
jne 0x1800126bb
mov rcx, qword [0x180244098]
add rcx, r15
mov dword [rbp - 0x1c], r14d
cmp rcx, 1
jbe 0x1800125e8
mov rax, qword [0x180244090]
mov edx, 0x2751
mov rcx, rsi
call qword [rax + 0x30]
mov dword [rbp - 0x20], 0x2751
jmp 0x18001269b
mov al, 1
mov dword [rbp - 0x20], 0x2751
jmp 0x18001269b
mov rcx, qword [0x180244098]
add rcx, r15
mov dword [rbp - 0x1c], r14d
cmp rcx, 1
jbe 0x180012625
mov rax, qword [0x180244090]
mov edx, 0x2743
mov rcx, rsi
call qword [rax + 0x30]
mov dword [rbp - 0x20], 0x2743
jmp 0x18001269b
mov al, 1
mov dword [rbp - 0x20], 0x2743
jmp 0x18001269b
mov rcx, qword [0x180244098]
add rcx, r15
mov dword [rbp - 0x1c], r14d
cmp rcx, 1
jbe 0x18001265f
mov rax, qword [0x180244090]
mov edx, 0x274d
mov rcx, rsi
call qword [rax + 0x30]
mov dword [rbp - 0x20], 0x274d
jmp 0x18001269b
mov al, 1
mov dword [rbp - 0x20], 0x274d
jmp 0x18001269b
mov rcx, qword [0x180244098]
add rcx, r15
mov dword [rbp - 0x1c], r14d
cmp rcx, 1
jbe 0x180012692
mov rax, qword [0x180244090]
mov edx, 0x274c
mov rcx, rsi
call qword [rax + 0x30]
jmp 0x180012694
mov al, 1
mov dword [rbp - 0x20], 0x274c
movzx eax, al
mov qword [rbp - 0x18], rsi
add rax, 2
movups xmm0, xmmword [rbp - 0x20]
mov qword [rbp - 0x10], rax
movsd xmm1, qword [rbp - 0x10]
movups xmmword [rbx], xmm0
movsd qword [rbx + 0x10], xmm1
mov rax, qword [rbx + 0x10]
test al, 1
je 0x1800126d6
cmp rax, 1
jne 0x180012758
cmp dword [rbx], r14d
jne 0x180012758
cmp rdi, 0xffffffffffffffff
jne 0x18001272f
mov rcx, qword [0x180244098]
add rcx, r15
mov dword [rbp - 0x1c], r14d
cmp rcx, 1
jbe 0x180012704
mov rax, qword [0x180244090]
mov edx, 0x2719
mov rcx, rsi
call qword [rax + 0x30]
jmp 0x180012706
mov al, 1
movzx eax, al
mov dword [rbp - 0x20], 0x2719
add rax, 2
mov qword [rbp - 0x18], rsi
movups xmm0, xmmword [rbp - 0x20]
mov qword [rbp - 0x10], rax
movsd xmm1, qword [rbp - 0x10]
movups xmmword [rbx], xmm0
movsd qword [rbx + 0x10], xmm1
jmp 0x180012758
xor r9d, r9d
mov dword [rsp + 0x20], r14d
mov edx, 0xffff
mov r8d, 0x7010
mov rcx, rdi
call qword [sym.imp.WS2_32.dll_setsockopt]
test eax, eax
mov rcx, rbx
setne dl
call fcn.180012100
mov rbx, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
mov rdi, qword [rsp + 0x80]
add rsp, 0x50
pop r15
pop r14
pop rbp
ret
Function at 0x180012d30
Capabilities:
Send data
Send data on socket

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rbp
push rdi
push r12
push r14
push r15
mov rbp, rsp
sub rsp, 0x70
mov rax, qword [0x180243280]
xor rax, rsp
mov qword [rbp - 0x10], rax
mov rbx, qword [rbp + 0x50]
lea r9, [rbp - 0x18]
xor r15d, r15d
mov qword [rsp + 0x30], r15
mov qword [rsp + 0x28], r15
mov dword [rbp - 0x18], r15d
lea r8d, [r15 + 1]
mov dword [rsp + 0x20], r15d
call qword [sym.imp.WS2_32.dll_WSASend]
mov esi, eax
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov rdx, qword [0x180244098]
lea r14, [0x180244090]
movabs r12, 0x4d54ee85da812030
mov dword [rbp - 0x2c], r15d
add rdx, r12
mov edi, eax
cmp rdx, 1
jbe 0x180012dc3
mov rcx, qword [0x180244090]
mov edx, eax
mov r8, qword [rcx + 0x30]
mov rcx, r14
call r8
jmp 0x180012dc8
test edi, edi
setne al
movzx eax, al
movabs r10, 0x4800144005b3
add rax, 2
mov dword [rbp - 0x30], edi
mov qword [rbp - 0x28], r14
movups xmm0, xmmword [rbp - 0x30]
mov qword [rbp - 0x20], rax
movsd xmm1, qword [rbp - 0x20]
movups xmmword [rbx], xmm0
movsd qword [rbx + 0x10], xmm1
mov r9, qword [rbx + 0x10]
cmp r9, 1
je 0x180012e06
mov eax, dword [rbx]
mov r8d, eax
jmp 0x180012e36
mov rcx, qword [rbx + 8]
mov rax, r10
mov r8d, dword [rbx]
mul rcx
mov rax, rcx
sub rax, rdx
shr rax, 1
add rax, rdx
shr rax, 0x14
imul rax, rax, 0x1ffff7
sub rcx, rax
imul eax, ecx, 0x3e8
add eax, r8d
cmp eax, 0x40
jne 0x180012e75
mov rcx, qword [0x180244098]
add rcx, r12
mov dword [rbp - 0x2c], r15d
cmp rcx, 1
jbe 0x180012e6a
mov rax, qword [0x180244090]
mov edx, 0x2746
mov rcx, r14
call qword [rax + 0x30]
mov dword [rbp - 0x30], 0x2746
jmp 0x180012ee2
mov al, 1
mov dword [rbp - 0x30], 0x2746
jmp 0x180012ee2
cmp r9, 1
jne 0x180012ea8
mov rcx, qword [rbx + 8]
mov rax, r10
mul rcx
mov rax, rcx
sub rax, rdx
shr rax, 1
add rax, rdx
shr rax, 0x14
imul rax, rax, 0x1ffff7
sub rcx, rax
imul eax, ecx, 0x3e8
add r8d, eax
cmp r8d, 0x4d2
jne 0x180012f02
mov rcx, qword [0x180244098]
add rcx, r12
mov dword [rbp - 0x2c], r15d
cmp rcx, 1
jbe 0x180012ed9
mov rax, qword [0x180244090]
mov edx, 0x274d
mov rcx, r14
call qword [rax + 0x30]
jmp 0x180012edb
mov al, 1
mov dword [rbp - 0x30], 0x274d
movzx eax, al
mov qword [rbp - 0x28], r14
add rax, 2
movups xmm0, xmmword [rbp - 0x30]
mov qword [rbp - 0x20], rax
movsd xmm1, qword [rbp - 0x20]
movups xmmword [rbx], xmm0
movsd qword [rbx + 0x10], xmm1
test esi, esi
je 0x180012f0d
mov eax, 0xffffffff
jmp 0x180012f24
mov eax, dword [rbp - 0x18]
xorps xmm0, xmm0
movups xmmword [rbx], xmm0
mov qword [rbp - 0x20], r15
movsd xmm0, qword [rbp - 0x20]
movsd qword [rbx + 0x10], xmm0
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.18017ae80
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rbp
ret
Function at 0x180013d20
Capabilities:
Terminate thread

Disassembly:
push rbx
sub rsp, 0x40
mov rax, qword [0x180243280]
xor rax, rsp
mov qword [rsp + 0x30], rax
mov rax, qword [rcx + 0x10]
lea rdx, [rsp + 0x20]
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov rax, qword [rcx + 8]
mov rbx, rcx
mov r9d, 0xffffffff
mov qword [rsp + 0x28], rax
lea ecx, [r8 + 2]
call qword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
mov rcx, qword [rbx + 0x10]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
lock xadd dword [0x180254728], eax
mov rcx, qword [rbx + 8]
test eax, eax
je 0x180013d99
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TerminateThread]
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.18017ae80
add rsp, 0x40
pop rbx
ret
mov rdx, rcx
xor r8d, r8d
lea rcx, [fcn.180011ff0]
call qword [sym.imp.KERNEL32.dll_QueueUserAPC]
mov rcx, qword [rbx + 8]
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.18017ae80
add rsp, 0x40
pop rbx
ret
Function at 0x180017ee0
Capabilities:
Send data
Send data on socket

Disassembly:
push rsi
push rdi
sub rsp, 0x58
mov rax, qword [0x180243280]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov rdi, qword [rsp + 0xa0]
mov r11, r9
mov rax, qword [rcx + 8]
mov r10, r8
mov rsi, rcx
lock inc dword [rax + 0x30]
cmp byte [rsp + 0x98], 0
je 0x180017f30
mov rcx, qword [rcx + 8]
xor r9d, r9d
xor r8d, r8d
mov rdx, rdi
call fcn.180014d00
jmp 0x180017fc8
mov rcx, qword [rdx]
cmp rcx, 0xffffffffffffffff
jne 0x180017f50
mov rcx, qword [rsi + 8]
xor r9d, r9d
mov r8d, 0x2719
mov rdx, rdi
call fcn.180014d00
jmp 0x180017fc8
xor eax, eax
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x30], rax
lea r9, [rsp + 0x40]
mov dword [rsp + 0x40], eax
mov r8d, r11d
mov eax, dword [rsp + 0x90]
mov rdx, r10
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], eax
call qword [sym.imp.WS2_32.dll_WSASend]
mov ebx, eax
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x4d2
mov ecx, 0x274d
cmove eax, ecx
test ebx, ebx
mov rbx, qword [rsp + 0x50]
je 0x180017fbc
cmp eax, 0x3e5
je 0x180017fbc
mov r9d, dword [rsp + 0x40]
mov r8d, eax
mov rcx, qword [rsi + 8]
mov rdx, rdi
call fcn.180014d00
jmp 0x180017fc8
mov rcx, qword [rsi + 8]
mov rdx, rdi
call fcn.180014c70
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.18017ae80
add rsp, 0x58
pop rdi
pop rsi
ret

Function at 0x180017fe0
Capabilities:
Receive data
Receive data on socket

Disassembly:
push rbx
push rdi
sub rsp, 0x58
mov rax, qword [0x180243280]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov rbx, qword [rsp + 0xa0]
mov r11, r9
mov rax, qword [rcx + 8]
mov r10, r8
mov rdi, rcx
lock inc dword [rax + 0x30]
cmp byte [rsp + 0x98], 0
je 0x180018030
mov rcx, qword [rcx + 8]
xor r9d, r9d
xor r8d, r8d
mov rdx, rbx
call fcn.180014d00
jmp 0x1800180e1
mov rcx, qword [rdx]
cmp rcx, 0xffffffffffffffff
jne 0x180018053
mov rcx, qword [rdi + 8]
xor r9d, r9d
mov r8d, 0x2719
mov rdx, rbx
call fcn.180014d00
jmp 0x1800180e1
mov eax, dword [rsp + 0x90]
lea r9, [rsp + 0x40]
xor edx, edx
mov dword [rsp + 0x44], eax
mov qword [rsp + 0x30], rdx
lea rax, [rsp + 0x44]
mov dword [rsp + 0x40], edx
mov r8d, r11d
mov qword [rsp + 0x28], rbx
mov rdx, r10
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x50], rsi
call qword [sym.imp.WS2_32.dll_WSARecv]
mov esi, eax
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x40
jne 0x1800180a2
mov eax, 0x2746
jmp 0x1800180af
cmp eax, 0x4d2
mov ecx, 0x274d
cmove eax, ecx
test esi, esi
mov rsi, qword [rsp + 0x50]
je 0x1800180d5
cmp eax, 0x3e5
je 0x1800180d5
mov r9d, dword [rsp + 0x40]
mov r8d, eax
mov rcx, qword [rdi + 8]
mov rdx, rbx
call fcn.180014d00
jmp 0x1800180e1
mov rcx, qword [rdi + 8]
mov rdx, rbx
call fcn.180014c70
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.18017ae80
add rsp, 0x58
pop rdi
pop rbx
ret
Function at 0x180024250
Capabilities:
Encode data using base64

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x30
mov rbp, r9
mov r14, r8
mov rbx, rdx
mov qword [rsp + 0x28], rdx
xor r12d, r12d
mov dword [rsp + 0x20], r12d
xorps xmm0, xmm0
movups xmmword [rdx], xmm0
mov qword [rdx + 0x10], r12
mov qword [rdx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rdx], r12b
mov dword [rsp + 0x20], 1
lea rcx, [r9 + 2]
movabs rax, 0xaaaaaaaaaaaaaaab
mul rcx
shr rdx, 1
shl rdx, 2
mov rcx, rbx
call fcn.18002f2e0
test rbp, rbp
je 0x180024448
mov edi, 3
lea r15, str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_
nop
mov edx, r12d
lea rax, [rdi - 3]
cmp rax, rdi
jae 0x1800242f7
nop dword [rax]
shl edx, 8
cmp rax, rbp
jae 0x1800242ef
movzx ecx, byte [rax + r14]
or edx, ecx
inc rax
cmp rax, rdi
jb 0x1800242e0
movsxd rsi, edx
mov rax, rsi
sar rax, 0x12
and eax, 0x3f
movzx r9d, byte [rax + r15]
mov rcx, qword [rbx + 0x10]
mov rdx, qword [rbx + 0x18]
cmp rcx, rdx
jae 0x180024335
lea rax, [rcx + 1]
mov qword [rbx + 0x10], rax
mov rax, rbx
cmp rdx, 0xf
jbe 0x18002432a
mov rax, qword [rbx]
mov byte [rax + rcx], r9b
mov byte [rax + rcx + 1], 0
jmp 0x180024344
xor r8d, r8d
lea edx, [r8 + 1]
mov rcx, rbx
call fcn.18003d0c0
mov rax, rsi
sar rax, 0xc
and eax, 0x3f
movzx r9d, byte [rax + r15]
mov rcx, qword [rbx + 0x10]
mov rdx, qword [rbx + 0x18]
cmp rcx, rdx
jae 0x18002437f
lea rax, [rcx + 1]
mov qword [rbx + 0x10], rax
mov rax, rbx
cmp rdx, 0xf
jbe 0x180024374
mov rax, qword [rbx]
mov byte [rax + rcx], r9b
mov byte [rax + rcx + 1], 0
jmp 0x18002438e
xor r8d, r8d
lea edx, [r8 + 1]
mov rcx, rbx
call fcn.18003d0c0
lea rax, [rdi - 2]
cmp rax, rbp
jae 0x1800243a8
mov rax, rsi
sar rax, 6
and eax, 0x3f
movzx r9d, byte [rax + r15]
jmp 0x1800243ab
mov r9b, 0x3d
mov rcx, qword [rbx + 0x10]
mov rdx, qword [rbx + 0x18]
cmp rcx, rdx
jae 0x1800243d7
lea rax, [rcx + 1]
mov qword [rbx + 0x10], rax
mov rax, rbx
cmp rdx, 0xf
jbe 0x1800243cc
mov rax, qword [rbx]
mov byte [rax + rcx], r9b
mov byte [rax + rcx + 1], 0
jmp 0x1800243e6
xor r8d, r8d
lea edx, [r8 + 1]
mov rcx, rbx
call fcn.18003d0c0
lea rax, [rdi - 1]
cmp rax, rbp
jae 0x1800243f9
and esi, 0x3f
movzx r9d, byte [rsi + r15]
jmp 0x1800243fc
mov r9b, 0x3d
mov rcx, qword [rbx + 0x10]
mov rdx, qword [rbx + 0x18]
cmp rcx, rdx
jae 0x180024428
lea rax, [rcx + 1]
mov qword [rbx + 0x10], rax
mov rax, rbx
cmp rdx, 0xf
jbe 0x18002441d
mov rax, qword [rbx]
mov byte [rax + rcx], r9b
mov byte [rax + rcx + 1], 0
jmp 0x180024437
xor r8d, r8d
lea edx, [r8 + 1]
mov rcx, rbx
call fcn.18003d0c0
add rdi, 3
lea rcx, [rdi - 3]
cmp rcx, rbp
jb 0x1800242d0
mov rax, rbx
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x70]
add rsp, 0x30
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret
Function at 0x18002b330
Capabilities:
Read file on windows

Disassembly:
push rbx
push rsi
push r14
sub rsp, 0x30
mov r14, r8
mov rsi, rdx
mov rbx, rcx
test r8, r8
jg 0x18002b352
xor eax, eax
add rsp, 0x30
pop r14
pop rsi
pop rbx
ret
cmp qword [rcx + 0x68], 0
mov qword [rsp + 0x28], rbp
mov qword [rsp + 0x20], rdi
je 0x18002b3cc
mov rdi, r14
mov rcx, rbx
call fcn.1800342e0
test rax, rax
jle 0x18002b3a4
mov rdx, qword [rbx + 0x38]
cmp rdi, rax
mov rbp, rdi
mov rcx, rsi
cmovge rbp, rax
mov r8, rbp
mov rdx, qword [rdx]
call fcn.1801da970
mov rax, qword [rbx + 0x50]
sub rdi, rbp
sub dword [rax], ebp
mov rcx, qword [rbx + 0x38]
movsxd rax, ebp
add qword [rcx], rax
jmp 0x18002b3bc
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + gethostname]
cmp eax, 0xffffffff
je 0x18002b3c4
mov byte [rsi], al
dec rdi
mov ebp, 1
add rsi, rbp
test rdi, rdi
jg 0x18002b366
sub r14, rdi
jmp 0x18002b4af
mov rax, qword [rcx + 0x38]
mov rbp, r14
mov rdx, qword [rax]
test rdx, rdx
je 0x18002b3e3
mov rax, qword [rcx + 0x50]
mov ecx, dword [rax]
jmp 0x18002b3e5
xor ecx, ecx
movsxd rax, ecx
test ecx, ecx
je 0x18002b417
cmp rax, r14
mov rdi, r14
mov rcx, rsi
cmovb rdi, rax
mov r8, rdi
call fcn.1801da970
mov rax, qword [rbx + 0x50]
add rsi, rdi
sub rbp, rdi
sub dword [rax], edi
mov rcx, qword [rbx + 0x38]
movsxd rax, edi
add qword [rcx], rax
cmp qword [rbx + 0x80], 0
je 0x18002b4ac
mov r8, qword [rbx + 0x18]
lea rax, [rbx + 0x70]
cmp qword [r8], rax
jne 0x18002b452
mov rcx, qword [rbx + 0x88]
mov rdx, qword [rbx + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rbx + 0x38]
mov qword [rax], rcx
mov rax, qword [rbx + 0x50]
mov dword [rax], edx
cmp rbp, 0xfff
jbe 0x18002b48d
nop dword [rax + rax]
mov r9, qword [rbx + 0x80]
mov edx, 1
mov r8d, 0xfff
mov rcx, rsi
call fcn.1801bf260
add rsi, rax
sub rbp, rax
cmp rax, 0xfff
jne 0x18002b4ac
cmp rbp, rax
ja 0x18002b460
test rbp, rbp
je 0x18002b4ac
mov r9, qword [rbx + 0x80]
mov r8, rbp
mov edx, 1
mov rcx, rsi
call fcn.1801bf260
sub rbp, rax
sub r14, rbp
mov rbp, qword [rsp + 0x28]
mov rax, r14
mov rdi, qword [rsp + 0x20]
add rsp, 0x30
pop r14
pop rsi
pop rbx
ret
Function at 0x18002d440
Capabilities:
Initialize winsock library

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x200
mov rax, qword [0x180243280]
xor rax, rsp
mov qword [rsp + 0x1f0], rax
movzx ebx, dl
mov rdi, rcx
mov eax, 1
lock xadd dword [0x180254768], eax
inc eax
cmp eax, 1
jne 0x18002d48f
mov ecx, 0x202
lea rdx, [rsp + 0x50]
call qword [sym.imp.WS2_32.dll_WSAStartup]
xchg dword [0x18025476c], eax
test bl, bl
je 0x18002d533
xor ebx, ebx
lock xadd dword [0x18025476c], ebx
test ebx, ebx
je 0x18002d533
movabs rcx, 0x4d54ee85da812030
mov qword [rsp + 0x210], rsi
add rcx, qword [0x180244098]
lea rsi, [0x180244090]
mov dword [rsp + 0x3c], 0
cmp rcx, 1
jbe 0x18002d4e8
mov rax, qword [0x180244090]
mov edx, ebx
mov rcx, rsi
call qword [rax + 0x30]
jmp 0x18002d4ea
mov al, 1
lea rcx, str.C:_boost_1_85_0_boost_1_85_0_boost_asiodetailimplwinsock_init.ipp
movzx eax, al
add rax, 2
mov qword [rsp + 0x20], rcx
mov qword [rsp + 0x40], rsi
lea rcx, str.void___cdecl_boost::asio::detail::winsock_init_base::throw_on_error_struct_boost::asio::detail::winsock_init_base::data__
mov rsi, qword [rsp + 0x210]
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x48], rax
mov dword [rsp + 0x38], ebx
mov dword [rsp + 0x30], 0x48
mov dword [rsp + 0x34], 0x1a
test al, 1
jne 0x18002d557
mov rax, rdi
mov rcx, qword [rsp + 0x1f0]
xor rcx, rsp
call fcn.18017ae80
mov rbx, qword [rsp + 0x218]
add rsp, 0x200
pop rdi
ret
lea r8, [rsp + 0x20]
lea rdx, str.winsock
lea rcx, [rsp + 0x38]
call fcn.180011ce0
int3
Function at 0x18005f100
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x40
cmp byte [rcx + 0x19], 0
mov r12, r9
mov rdi, r8
mov r10, rdx
mov rbp, rcx
jge 0x18005f170
mov rax, qword [rcx + 0x80]
xor ecx, ecx
mov rdx, qword [rax + 0x10]
mov dword [rsp + 0x20], edx
test r8, r8
je 0x18005f15e
nop word [rax + rax]
mov rax, rcx
and eax, 3
movzx eax, byte [rsp + rax + 0x20]
xor byte [r10 + rcx], al
inc rcx
cmp rcx, rdi
jb 0x18005f140
mov rax, qword [rbp + 0x80]
mov rcx, rdi
and ecx, 3
je 0x18005f16c
shl cl, 3
ror rdx, cl
mov qword [rax + 0x10], rdx
mov rax, qword [rbp + 0x80]
mov rdx, r10
mov rbx, qword [rax]
add rbx, 0x50
mov r15, qword [rbx + 0x10]
lea r14, [rbx + 0x10]
mov rcx, rbx
call fcn.180004480
mov r10, qword [rbp + 0x80]
mov rax, qword [r10]
cmp dword [rax + 0x70], 1
jne 0x18005f22a
cmp qword [rbx + 0x18], 0xf
jbe 0x18005f1b7
mov rdx, qword [rbx]
mov rbx, rdx
add rdx, qword [r14]
jmp 0x18005f1bd
mov rdx, qword [r14]
add rdx, rbx
lea rax, [r15 + rbx]
cmp rax, rdx
je 0x18005f22a
lea rbx, [0x1801f85a0]
nop dword [rax]
cmp dword [r10 + 0x18], 0
movzx r8d, byte [rax]
mov r9d, r8d
movzx r11d, byte [r8 + rbx]
je 0x18005f1f3
mov ecx, dword [r10 + 0x1c]
and r9d, 0x3f
shl ecx, 6
or r9d, ecx
jmp 0x18005f202
mov r8d, 0xff
mov ecx, r11d
sar r8d, cl
and r9d, r8d
mov dword [r10 + 0x1c], r9d
mov ecx, dword [r10 + 0x18]
add ecx, 0x10
shl ecx, 4
add ecx, r11d
movzx r8d, byte [rcx + rbx]
mov dword [r10 + 0x18], r8d
cmp r8d, 1
je 0x18005f240
inc rax
cmp rax, rdx
jne 0x18005f1d0
sub qword [rbp + 0x30], rdi
mov rax, rdi
add rsp, 0x40
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
mov dword [rsp + 0x28], reloc.WS2_32.dll_recv
call fcn.18001bff0
mov qword [rsp + 0x30], rax
xor eax, eax
movups xmm0, xmmword [rsp + 0x28]
movups xmmword [r12], xmm0
add rsp, 0x40
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x180080be0
Capabilities:
Encrypt data using salsa20 or chacha

Disassembly:
mov qword [rsp + 0x20], rbx
push rsi
sub rsp, 0x20
mov rsi, rdx
mov ebx, ecx
call fcn.180145120
test eax, eax
jne 0x180080df8
cmp byte [reloc.WS2_32.dll_accept], al
mov qword [rsp + 0x30], rbp
jne 0x180080c0d
xor ebp, ebp
jmp 0x180080c29
mov ecx, 5
call qword [0x180244340]
mov rbp, rax
test rax, rax
je 0x180080c29
mov rcx, rax
call qword [0x180244350]
test ebx, ebx
jle 0x180080ddb
test rsi, rsi
je 0x180080ddb
cmp dword [0x180254590], 0
mov qword [rsp + 0x38], rdi
jne 0x180080d4f
call fcn.180145120
test eax, eax
je 0x180080c65
movups xmm0, xmmword [str.expand_32_byte_k]
movups xmmword [0x180254590], xmm0
jmp 0x180080cc9
cmp byte [reloc.WS2_32.dll_accept], 0
jne 0x180080c77
mov rdi, qword [0x1802542e8]
jmp 0x180080cb6
mov ecx, 2
mov qword [rsp + 0x40], r14
call qword [0x180244340]
mov r14, rax
test rax, rax
je 0x180080caa
mov rcx, rax
call qword [0x180244350]
mov rdi, qword [0x1802542e8]
mov rcx, r14
call qword [0x180244360]
jmp 0x180080cb1
mov rdi, qword [0x1802542e8]
mov r14, qword [rsp + 0x40]
movups xmm0, xmmword [str.expand_32_byte_k]
movaps xmmword [0x180254590], xmm0
test rdi, rdi
jne 0x180080ceb
xorps xmm0, xmm0
xor eax, eax
movups xmmword [0x1802545a0], xmm0
mov qword [0x1802545c0], rax
movups xmmword [0x1802545b0], xmm0
mov dword [0x1802545c8], eax
jmp 0x180080d2f
mov eax, dword [0x180244480]
test eax, eax
je 0x180080d1d
xorps xmm0, xmm0
xor ecx, ecx
movups xmmword [0x1802545a0], xmm0
mov dword [0x1802545a0], eax
movups xmmword [0x1802545b0], xmm0
mov qword [0x1802545c0], rcx
mov dword [0x1802545c8], ecx
jmp 0x180080d2f
lea r8, [0x1802545a0]
mov edx, 0x2c
mov rcx, rdi
call qword [rdi + 0x68]
mov eax, dword [0x1802545c0]
xor cl, cl
mov byte [0x180254610], cl
mov dword [0x1802545cc], eax
mov dword [0x1802545c0], 0
jmp 0x180080d56
movzx ecx, byte [0x180254610]
movzx eax, cl
lea rdi, [0x1802545d0]
cmp ebx, eax
jle 0x180080da5
test cl, cl
je 0x180080d83
movzx r8d, cl
mov rdx, rdi
mov rcx, rsi
call fcn.1801da970
movzx ecx, byte [0x180254610]
sub ebx, ecx
add rsi, rcx
inc dword [0x1802545c0]
lea rdx, [0x180254590]
mov rcx, rdi
call fcn.180080830
mov cl, 0x40
mov byte [0x180254610], cl
cmp ebx, 0x40
jg 0x180080d64
movzx eax, cl
mov rcx, rsi
sub eax, ebx
movsxd r8, ebx
movsxd rdx, eax
add rdx, rdi
call fcn.1801da970
sub byte [0x180254610], bl
mov rdi, qword [rsp + 0x38]
test rbp, rbp
jne 0x180080dea
mov rbp, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x48]
add rsp, 0x20
pop rsi
ret
mov dword [0x180254590], 0
test rbp, rbp
je 0x180080df3
mov rcx, rbp
call qword [0x180244360]
mov rbp, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x48]
add rsp, 0x20
pop rsi
ret
Function at 0x18009c9e0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
cmp byte [rcx + 0x11], 0
mov r9, rcx
jne 0x18009ca37
movzx eax, byte [rcx + 0x10]
test al, al
je 0x18009ca37
cmp al, 1
jne 0x18009c9f9
test edx, edx
jne 0x18009ca37
mov r10, qword [rcx + 8]
test r8, r8
je 0x18009ca12
mov rax, qword [r10 + 0x18]
mov rcx, qword [rax + 0x50]
mov eax, dword [rcx + 0x28]
bswap eax
mov dword [r8], eax
test edx, edx
je 0x18009ca34
mov rax, qword [r9]
mov rcx, qword [r10]
mov edx, dword [rax + 0x2f0]
cmp edx, dword [rcx + 0x80]
jle 0x18009ca34
cmp byte [rcx + 0xa], 0
jne fcn.180093e70
xor eax, eax
ret
jmp fcn.18009c620
Function at 0x1800b1120
Capabilities:
Encode data using xor

Disassembly:
mov rax, qword [rcx + 8]
test rax, rax
je 0x1800b114f
lea r8d, [rdx + 1]
nop dword [rax]
mov ecx, dword [rax + 0xc8]
mov edx, r8d
xor edx, ecx
and edx, 3
xor edx, ecx
mov dword [rax + 0xc8], edx
mov rax, qword [rax + 0x10]
test rax, rax
jne 0x1800b1130
ret