joyce8/EMBER2024-capa huggingface dataset:
Function at 0x140060420
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0x40
mov rax, qword [0x1400a4010]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov rbx, rdx
mov rdi, rcx
mov ecx, 8
call fcn.140085060
mov qword [rax], rbx
mov qword [rsp + 0x30], rax
lea rbx, [rdi + 8]
mov qword [rsp + 0x28], rbx
mov dword [rsp + 0x20], 0
mov r9, rax
lea r8, [0x1400604d0]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rdi], rax
test rax, rax
je 0x140060499
mov rax, rdi
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.140084da0
mov rbx, qword [rsp + 0x58]
add rsp, 0x40
pop rdi
ret
mov dword [rbx], 0
mov ecx, 6
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
int3
Function at 0x140069510
Capabilities:
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
sub rsp, 0xc0
mov rax, qword [0x1400a4010]
xor rax, rsp
mov qword [rsp + 0xb0], rax
mov rbx, r8
mov edx, 1
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
cmp rax, rbx
jb 0x140069563
mov rcx, qword [rsp + 0xb0]
xor rcx, rsp
call fcn.140084da0
mov rbx, qword [rsp + 0xd8]
add rsp, 0xc0
pop rdi
ret
lea rax, str.cannot_write_to_file
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x48], 0x14
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
mov ebx, dword [rax]
lea rdi, vtable.std::exception.0
mov qword [rsp + 0x50], rdi
xorps xmm0, xmm0
movups xmmword [rsp + 0x58], xmm0
lea rax, [0x14008bd5b]
mov qword [rsp + 0xa0], rax
mov byte [rsp + 0xa8], 1
lea rdx, [rsp + 0x58]
lea rcx, [rsp + 0xa0]
call qword [sym.imp.VCRUNTIME140.dll___std_exception_copy]
nop
lea rax, vtable.fmt::v7::system_error.0
mov qword [rsp + 0x50], rax
xor eax, eax
mov dword [rsp + 0x70], eax
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x70]
mov qword [rsp + 0x38], rax
movaps xmm0, xmmword [rsp + 0x30]
movdqa xmmword [rsp + 0x30], xmm0
movaps xmm1, xmmword [rsp + 0x40]
movdqa xmmword [rsp + 0x40], xmm1
lea r9, [rsp + 0x30]
lea r8, [rsp + 0x40]
mov edx, ebx
lea rcx, [rsp + 0x50]
call fcn.140069640
nop
mov byte [rsp + 0x20], 1
movzx eax, byte [rsp + 0x20]
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x80]
call fcn.14006cbf0
lea rdx, [0x1400a0720]
lea rcx, [rsp + 0x80]
call sub.VCRUNTIME140.dll__CxxThrowException
int3
Function at 0x140402058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.1404021df
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x140402089
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x14040206f
add dl, dl
jne 0x140402096
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1404020f6
xor eax, eax
add dl, dl
jne 0x1404020a5
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1404021ad
add dl, dl
jne 0x1404020b6
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1404020c3
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1404020d0
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1404020dd
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x1404020ea
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x14040207e
mov eax, 1
add dl, dl
jne 0x140402106
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x140402113
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1404020fb
sub eax, ebx
mov ebx, 1
jne 0x14040214c
mov ecx, 1
add dl, dl
jne 0x14040212e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x14040213b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x140402123
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14040207e
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x140402168
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x140402175
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x14040215d
cmp eax, 0x7d00
jae 0x14040219b
cmp eax, 0x500
jb 0x140402196
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14040207e
cmp eax, 0x7f
ja 0x14040219e
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x14040207e
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x1404021d2
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x14040207e
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x140009c50
Capabilities:
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push r15
sub rsp, 0x30
mov rax, qword gs:[0x30]
mov rbx, qword [rax + 8]
xor esi, esi
xor eax, eax
lock cmpxchg qword [0x140013ee0], rbx
je 0x140009c9c
cmp rax, rbx
jne 0x140009c8f
mov ebx, 1
mov esi, ebx
jmp 0x140009ca1
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x140009c74
mov ebx, 1
mov eax, dword [0x140013ee8]
cmp eax, ebx
jne 0x140009cb7
mov ecx, 0x1f
call sub.msvcrt.dll__amsg_exit
jmp 0x140009d1c
mov eax, dword [0x140013ee8]
test eax, eax
jne 0x140009d16
mov dword [0x140013ee8], ebx
lea r15, [0x14000b650]
lea rdi, [0x14000b638]
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], eax
cmp rdi, r15
jae 0x140009d08
test eax, eax
jne 0x140009d0c
cmp qword [rdi], 0
je 0x140009cfd
mov rax, qword [rdi]
mov rcx, qword [0x14000b618]
call rcx
mov dword [rsp + 0x20], eax
add rdi, 8
mov qword [rsp + 0x28], rdi
jmp 0x140009cde
test eax, eax
je 0x140009d1c
mov eax, 0xff
jmp 0x140009df8
mov dword [0x140013084], ebx
mov eax, dword [0x140013ee8]
cmp eax, ebx
jne 0x140009d43
lea rdx, [0x14000b630]
lea rcx, [0x14000b620]
call sub.msvcrt.dll__initterm
mov dword [0x140013ee8], 2
test esi, esi
jne 0x140009d50
xor eax, eax
xchg qword [0x140013ee0], rax
cmp qword [0x140013ef0], 0
je 0x140009d84
lea rcx, [0x140013ef0]
call fcn.14000a020
test eax, eax
je 0x140009d84
xor r8d, r8d
lea edx, [r8 + 2]
xor ecx, ecx
mov rax, qword [0x140013ef0]
mov r9, qword [0x14000b618]
call r9
mov r8, qword [0x140013098]
mov rdx, qword [0x140013090]
mov ecx, dword [0x140013088]
call fcn.1400044dc
mov dword [0x140013080], eax
cmp dword [0x1400130a0], 0
jne 0x140009db4
mov ecx, eax
call qword [sym.imp.msvcrt.dll_exit]
cmp dword [0x140013084], 0
jne 0x140009dc9
call qword [sym.imp.msvcrt.dll__cexit]
mov eax, dword [0x140013080]
jmp 0x140009df8
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
mov rdi, qword [rsp + 0x50]
add rsp, 0x30
pop r15
ret
sub rsp, 0x28
call fcn.140137000
add rsp, 0x28
jmp 0x140009c50

Function at 0x140009f0c
Capabilities:
Parse pe header

Disassembly:
sub rsp, 0x18
xor edx, edx
lea rax, [rcx - 1]
cmp rax, 0xfffffffffffffffd
ja 0x140009f58
mov eax, 0x5a4d
cmp word [rcx], ax
jne 0x140009f50
cmp dword [rcx + 0x3c], edx
jl 0x140009f50
cmp dword [rcx + 0x3c], 0x10000000
jae 0x140009f50
movsxd rax, dword [rcx + 0x3c]
add rax, rcx
mov qword [rsp], rax
cmp dword [rax], 0x4550
cmovne rax, rdx
mov rdx, rax
mov qword [rsp], rax
jmp 0x140009f58
mov rax, rdx
add rsp, 0x18
ret
Function at 0x140015c30
Capabilities:
Parse pe header

Disassembly:
mov rax, rsp
sub rsp, 0xc8
mov qword [rax + 0x18], rbx
mov qword [rax + 0x20], rdi
lea rcx, [rax - 0x78]
call qword [0x140017128]
nop
cmp word [0x140000000], 0x5a4d
je 0x140015c6d
xor ebx, ebx
mov dword [rsp + 0xd0], ebx
lea rdi, [0x140000000]
jmp 0x140015cfb
movsxd rax, dword [0x14000003c]
lea rdi, [0x140000000]
add rax, rdi
cmp dword [rax], 0x4550
je 0x140015c91
xor ebx, ebx
mov dword [rsp + 0xd0], ebx
jmp 0x140015cfb
movzx ecx, word [rax + 0x18]
cmp ecx, 0x10b
je 0x140015cd8
cmp ecx, 0x20b
je 0x140015cb0
xor ebx, ebx
mov dword [rsp + 0xd0], ebx
jmp 0x140015cfb
cmp dword [rax + 0x84], 0xe
ja 0x140015cc4
xor ebx, ebx
mov dword [rsp + 0xd0], ebx
jmp 0x140015cfb
xor ebx, ebx
cmp dword [rax + 0xf8], ebx
setne bl
mov dword [rsp + 0xd0], ebx
jmp 0x140015cfb
cmp dword [rax + 0x74], 0xe
ja 0x140015ce9
xor ebx, ebx
mov dword [rsp + 0xd0], ebx
jmp 0x140015cfb
xor ebx, ebx
cmp dword [rax + 0xe8], ebx
setne bl
mov dword [rsp + 0xd0], ebx
mov ecx, 2
call qword [0x140017650]
mov qword [0x14001dbf8], 0xffffffffffffffff
mov qword [0x14001dc00], 0xffffffffffffffff
mov rcx, qword [0x140017648]
mov eax, dword [0x14001d2cc]
mov dword [rcx], eax
mov rcx, qword [0x140017640]
mov eax, dword [0x14001d2c8]
mov dword [rcx], eax
call fcn.140015ee0
cmp dword [section..data], 0
jne 0x140015d55
lea rcx, [fcn.140015ee0]
call qword [0x1400175e8]
lea rdx, [0x140017790]
lea rcx, [0x140017788]
call fcn.140015ece
mov r11d, dword [0x14001d2c4]
mov dword [rsp + 0xd8], r11d
lea rax, [rsp + 0xd8]
mov qword [rsp + 0x20], rax
mov r9d, dword [0x14001d2c0]
lea r8, [rsp + 0x40]
lea rdx, [rsp + 0x48]
lea rcx, [rsp + 0x3c]
call qword [0x140017598]
lea rdx, [0x140017780]
lea rcx, [0x140017758]
call fcn.140015ece
mov r11, qword [0x1400175a0]
mov r8, qword [r11]
mov qword [rsp + 0x30], r8
cmp byte [r8], 0x22
jne 0x140015df6
nop
nop
inc r8
mov qword [rsp + 0x30], r8
movzx eax, byte [r8]
test al, al
je 0x140015de6
cmp al, 0x22
je 0x140015de6
jmp 0x140015dd0
cmp byte [r8], 0x22
jne 0x140015e06
inc r8
mov qword [rsp + 0x30], r8
jmp 0x140015e06
cmp byte [r8], 0x20
jbe 0x140015e06
inc r8
mov qword [rsp + 0x30], r8
jmp 0x140015df6
movzx eax, byte [r8]
test al, al
je 0x140015e1c
cmp al, 0x20
ja 0x140015e1c
inc r8
mov qword [rsp + 0x30], r8
jmp 0x140015e06
test byte [rsp + 0x8c], 1
je 0x140015e31
movzx r9d, word [rsp + 0x90]
jmp 0x140015e37
mov r9d, 0xa
xor edx, edx
mov rcx, rdi
call fcn.140004200
mov edi, eax
mov dword [rsp + 0x38], eax
test ebx, ebx
jne 0x140015e53
mov ecx, eax
call qword [0x1400175a8]
call qword [0x1400175b0]
jmp 0x140015e77
mov eax, edi
jmp 0x140015e80
mov rbx, qword [rsp + 0xe0]
mov rdi, qword [rsp + 0xe8]
add rsp, 0xc8
ret
Function at 0x180001070
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
mov edi, r8d
mov rsi, rdx
mov rbp, rcx
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
jne 0x1800010a3
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
mov rcx, rax
mov qword [rsp + 0x30], rbx
call qword [sym.imp.KERNEL32.dll_LockResource]
mov rbx, rax
test rax, rax
je 0x1800010e6
mov rdx, rsi
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_SizeofResource]
mov r11d, eax
add r11, rbx
and edi, 0xf
jbe 0x1800010e1
cmp rbx, r11
jae 0x1800010e6
dec edi
movzx eax, word [rbx]
lea rbx, [rbx + rax*2 + 2]
jne 0x1800010d0
cmp rbx, r11
jb 0x1800010ea
xor eax, eax
jmp 0x1800010f6
xor eax, eax
cmp word [rbx], ax
cmove rbx, rax
mov rax, rbx
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret
Function at 0x180002630
Capabilities:
Write file on windows

Disassembly:
push rbp
push rsi
push rdi
sub rsp, 0x40
mov qword [rsp + 0x30], 0xfffffffffffffffe
mov qword [rsp + 0x60], rbx
mov rbp, rcx
mov rcx, qword [0x18003a0f0]
add rcx, 0xffffffffffffffe8
call fcn.1800013c0
add rax, 0x18
mov qword [rsp + 0x70], rax
lea rcx, [rsp + 0x70]
call fcn.18000b060
mov rcx, qword [0x18003a048]
cmp dword [rcx - 0x10], 0
jne 0x180002725
xor ecx, ecx
call fcn.1800111f4
mov rdi, rax
xor ecx, ecx
call fcn.1800111f4
mov rcx, rax
call fcn.180010eb0
mov r11d, dword [0x18003a058]
mov ebx, r11d
inc r11d
mov dword [0x18003a058], r11d
call fcn.180010ec8
mov r11d, eax
mov eax, 0x68db8bad
imul r11d
sar edx, 0xc
mov ecx, edx
shr ecx, 0x1f
add edx, ecx
imul edx, edx, 0x2710
sub r11d, edx
mov dword [rsp + 0x28], ebx
mov dword [rsp + 0x20], r11d
mov r9d, edi
mov r8, qword [0x18003a0f0]
lea rdx, str._s_u__05u__u.
lea rcx, [0x18003a048]
call fcn.180002450
mov r8, qword [0x18003a048]
lea rdx, str._stxt
lea rcx, [0x18003a050]
call fcn.180002450
mov edx, 3
lea rcx, [0x18003a048]
call fcn.180002c80
mov rcx, qword [0x18003a048]
lea rdx, [0x180030ddc]
call fcn.180010ea4
mov rdi, rax
test rax, rax
je 0x180002800
lea rcx, [0x180037078]
mov rdx, qword [0x180037078]
call qword [rdx + 0x18]
add rax, 0x18
mov qword [rsp + 0x68], rax
lea rcx, [rsp + 0x78]
call fcn.18000b690
nop
mov r8, qword [rax]
lea rdx, str._s_t_t
lea rcx, [rsp + 0x68]
call fcn.180002450
nop
mov rdx, qword [rsp + 0x78]
add rdx, 0xffffffffffffffe8
or esi, 0xffffffff
mov eax, esi
lock xadd dword [rdx + 0x10], eax
dec eax
test eax, eax
jg 0x180002799
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_htonl]
mov rbx, qword [rsp + 0x68]
movsxd r8, dword [rbx - 0x10]
mov r9, rdi
mov edx, 1
mov rcx, rbx
call fcn.180011080
mov rcx, qword [rbp]
movsxd r8, dword [rcx - 0x10]
mov r9, rdi
mov edx, 1
call fcn.180011080
mov r9, rdi
mov edx, 1
lea r8d, [rdx + 1]
lea rcx, [0x180030de8]
call fcn.180011080
mov rcx, rdi
call fcn.18001118c
nop
lea rdx, [rbx - 0x18]
lock xadd dword [rdx + 0x10], esi
dec esi
test esi, esi
jg 0x180002800
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_htonl]
mov rbx, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
pop rsi
pop rbp
ret
Function at 0x180002810
Capabilities:
Open clipboard
Read clipboard data

Disassembly:
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x30
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x58], rsi
mov rbx, rcx
xor edi, edi
mov dword [rsp + 0x48], edi
lea rcx, [0x180037078]
mov rax, qword [0x180037078]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rbx], rax
mov dword [rsp + 0x48], 1
call qword [sym.imp.KERNEL32.dll_GetConsoleWindow]
mov rcx, rax
call qword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x1800028c4
lea ecx, [rdi + 1]
call qword [sym.imp.USER32.dll_IsClipboardFormatAvailable]
test eax, eax
je 0x1800028be
lea ecx, [rdi + 1]
call qword [sym.imp.USER32.dll_GetClipboardData]
mov rsi, rax
test rax, rax
je 0x1800028be
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GlobalLock]
mov rdx, rax
test rax, rax
je 0x1800028aa
xor eax, eax
or rcx, 0xffffffffffffffff
mov rdi, rdx
repne scasb al, byte [rdi]
not rcx
lea rdi, [rcx - 1]
mov r8d, edi
mov rcx, rbx
call fcn.180001590
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
call qword [sym.imp.USER32.dll_CloseClipboard]
mov rax, rbx
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret
Function at 0x180002d80
Capabilities:
Encode data using xor
Hash data with crc32
Send data
Send data on socket

Disassembly:
sub rsp, 0x58
mov qword [rsp + 0x70], rbx
mov rbx, rcx
mov rcx, qword [0x18003a068]
test rcx, rcx
je 0x180002da8
or edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [0x18003a068]
mov r8, qword [0x18003a078]
mov rdx, r8
mov rax, qword [r8 + 8]
cmp byte [rax + 0x29], 0
jne 0x180002dd7
nop dword [rax]
cmp dword [rax + 0x18], ebx
jae 0x180002dcb
mov rax, qword [rax + 0x10]
jmp 0x180002dd1
mov rdx, rax
mov rax, qword [rax]
cmp byte [rax + 0x29], 0
je 0x180002dc0
mov qword [rsp + 0x60], rdx
cmp rdx, r8
je 0x180002ded
cmp ebx, dword [rdx + 0x18]
jb 0x180002ded
lea rbx, [rsp + 0x60]
jmp 0x180002df7
mov qword [rsp + 0x68], r8
lea rbx, [rsp + 0x68]
mov rbx, qword [rbx]
cmp rbx, r8
je 0x180002eed
mov qword [rsp + 0x50], rbp
mov qword [rsp + 0x48], rsi
mov qword [rsp + 0x40], rdi
mov qword [rsp + 0x38], r12
mov qword [rsp + 0x30], r13
mov r13, qword [rbx + 0x20]
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov edi, dword [r13 + 0x10]
mov esi, dword [r13 + 0xc]
mov ecx, 0x50
mov ebp, eax
call fcn.18000fddc
xor edx, edx
lea r9, [0x180030840]
mov qword [rax + 4], 3
mov qword [rax + 0xc], 1
mov dword [rax + 0x14], edx
mov dword [rax + 0x18], edi
mov rdi, qword [rsp + 0x40]
mov dword [rax + 0x1c], ebp
mov rbp, qword [rsp + 0x50]
mov dword [rax + 0x20], esi
mov rsi, qword [rsp + 0x48]
mov dword [rax + 0x24], edx
mov r12, rax
xor eax, eax
mov qword [r12 + 0x28], rax
mov r8d, edx
nop
movsx ecx, byte [r12 + r8 + 4]
mov eax, edx
shr edx, 8
xor rcx, rax
inc r8
movzx eax, cl
mov eax, dword [r9 + rax*4]
xor edx, eax
cmp r8, 0x2c
jne 0x180002e80
not edx
xor r9d, r9d
lea rax, [r13 + 0x48]
mov dword [r12], edx
mov rcx, qword [r13 + 0x40]
lea r8d, [r9 + 0x30]
mov rdx, r12
mov dword [rsp + 0x28], reloc.WS2_32.dll_recv
mov qword [rsp + 0x20], rax
call qword [sym.imp.WS2_32.dll_sendto]
mov rcx, r12
call fcn.18001010c
mov rcx, qword [rbx + 0x20]
call fcn.180004a20
mov rcx, qword [0x18003a068]
mov r13, qword [rsp + 0x30]
mov r12, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x70]
test rcx, rcx
je 0x180002efd
call qword [sym.imp.KERNEL32.dll_SetEvent]
add rsp, 0x58
ret
Function at 0x180003150
Capabilities:
Check for time delay via gettickcount
Receive data
Receive data on socket

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r12
sub rsp, 0x110
mov rax, qword [0x1800370e0]
xor rax, rsp
mov qword [rsp + 0x100], rax
mov ebp, edx
mov rsi, rcx
xor ebx, ebx
mov dword [rsp + 0x30], reloc.WS2_32.dll_recv
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov rcx, qword [rsi]
mov edi, eax
lea rax, [rsp + 0x30]
lea r8d, [rbx + 0x30]
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x38]
lea rdx, [rsp + 0x50]
xor r9d, r9d
mov qword [rsp + 0x20], rax
call qword [sym.imp.WS2_32.dll_recvfrom]
lea r12d, [rbx + 1]
cmp eax, 0x30
je 0x180003206
mov ecx, r12d
call qword [sym.imp.KERNEL32.dll_Sleep]
call qword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, edi
cmp eax, 0x3e8
jae 0x18000322a
mov rcx, qword [rsi]
lea rax, [rsp + 0x30]
xor r9d, r9d
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x38]
lea r8d, [r9 + 0x30]
lea rdx, [rsp + 0x50]
mov qword [rsp + 0x20], rax
call qword [sym.imp.WS2_32.dll_recvfrom]
cmp eax, 0x30
jne 0x1800031c0
lea r8, [rsp + 0x50]
lea rcx, [rsp + 0x50]
mov edx, eax
call fcn.18000f500
test eax, eax
je 0x18000322a
cmp dword [rsp + 0x54], r12d
jne 0x18000322a
cmp dword [rsp + 0x68], ebp
cmove ebx, r12d
mov eax, ebx
mov rcx, qword [rsp + 0x100]
xor rcx, rsp
call fcn.180010130
lea r11, [rsp + 0x110]
mov rbx, qword [r11 + 0x28]
mov rbp, qword [r11 + 0x30]
mov rsp, r11
pop r12
pop rdi
pop rsi
ret

Function at 0x180003260
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
mov ebx, ecx
mov ecx, reloc.WS2_32.dll_recv
call fcn.18000fddc
lea rdx, [0x180030dec]
mov r8d, ebx
mov rdi, rax
xor eax, eax
mov qword [rdi], rax
mov rcx, rdi
mov qword [rdi + 8], rax
call fcn.18001140c
lea r8, [0x18000f160]
mov r9, rdi
mov edx, 0x10000
xor ecx, ecx
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0x10000
call qword [sym.imp.KERNEL32.dll_CreateThread]
test rax, rax
je 0x1800032ca
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
Function at 0x180004e20
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
sub rsp, 0x48
lea rcx, [rsp + 0x60]
movaps xmmword [rsp + 0x30], xmm6
movaps xmmword [rsp + 0x20], xmm7
call qword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
lea rcx, [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov r11d, 1
movsd xmm7, qword [0x180031138]
pxor xmm6, xmm6
cvtsi2sd xmm6, r11
nop dword [rax + rax]
lea rcx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov r11, qword [rsp + 0x50]
sub r11, qword [rsp + 0x58]
pxor xmm0, xmm0
pxor xmm1, xmm1
cvtsi2sd xmm1, qword [rsp + 0x60]
cvtsi2sd xmm0, r11
divsd xmm0, xmm1
mulsd xmm0, xmm7
comisd xmm0, xmm6
jb 0x180004e60
movaps xmm6, xmmword [rsp + 0x30]
movaps xmm7, xmmword [rsp + 0x20]
add rsp, 0x48
ret

Function at 0x180004eb0
Capabilities:
Send data
Send data on socket

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
push rdi
sub rsp, 0x60
xor edi, edi
mov dword [rax - 0x30], edx
mov dword [rax - 0x24], r9d
mov dword [rax - 0x14], r9d
mov qword [rax - 0x2c], 1
mov qword [rax - 0x10], r8
mov qword [rax - 0x38], rdi
mov eax, dword [rsp + 0x98]
mov rbx, rcx
mov dword [rsp + 0x4c], eax
test eax, eax
jne 0x180004ef5
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [rsp + 0x4c], eax
mov eax, dword [rbx + 0x10]
mov r9d, dword [rsp + 0x90]
mov r8d, dword [rbx + 0xc]
lea rdx, [rsp + 0x98]
lea rcx, [rsp + 0x30]
mov dword [rsp + 0x20], eax
mov dword [rsp + 0x98], edi
call fcn.18000f5b0
mov rdi, rax
test rax, rax
je 0x180004f5a
mov r8d, dword [rsp + 0x98]
lea rcx, [rbx + 0x48]
mov dword [rsp + 0x28], reloc.WS2_32.dll_recv
mov qword [rsp + 0x20], rcx
mov rcx, qword [rbx + 0x40]
xor r9d, r9d
mov rdx, rax
call qword [sym.imp.WS2_32.dll_sendto]
mov rcx, rdi
call fcn.18001010c
mov rbx, qword [rsp + 0x70]
add rsp, 0x60
pop rdi
ret
Function at 0x180005a60
Capabilities:
Check for time delay via gettickcount

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x20
mov r15, rdx
mov rbx, rcx
xor ebp, ebp
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov r14d, eax
cmp dword [rbx + 0x64], ebp
je 0x180005b99
cmp dword [rbx + 0x68], 0
jbe 0x180005b70
mov rcx, qword [rbx]
mov r12d, 8
movsxd r13, ebp
sub r12d, ebp
add r13, r15
xor edi, edi
test rcx, rcx
je 0x180005ac2
or edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rsi, qword [rbx + 0x70]
test rsi, rsi
je 0x180005b31
mov eax, dword [rsi + 0xc]
mov edi, dword [rsi + 8]
mov rcx, r13
mov edx, eax
sub edi, eax
add rdx, qword [rsi]
cmp edi, r12d
jb 0x180005b01
mov r8d, r12d
mov edi, r12d
call fcn.180010360
add dword [rsi + 0xc], r12d
mov eax, dword [rsi + 0xc]
cmp eax, dword [rsi + 8]
jne 0x180005b21
mov rax, qword [rsi + 0x10]
mov qword [rbx + 0x70], rax
jmp 0x180005b11
mov r8d, edi
call fcn.180010360
mov r11, qword [rsi + 0x10]
mov qword [rbx + 0x70], r11
mov rcx, qword [rsi]
call fcn.18001010c
mov rcx, rsi
call fcn.18001010c
test edi, edi
jle 0x180005b31
mov eax, dword [rbx + 0x68]
cmp edi, eax
ja 0x180005b43
sub eax, edi
mov dword [rbx + 0x68], eax
cmp dword [rbx + 0x68], 0x500000
jb 0x180005b4a
mov dword [rbx + 0xc], 0
jmp 0x180005b55
mov dword [rbx + 0x68], 0
mov eax, 0x500000
sub eax, dword [rbx + 0x68]
mov dword [rbx + 0xc], eax
mov rcx, qword [rbx]
test rcx, rcx
je 0x180005b63
call qword [sym.imp.KERNEL32.dll_SetEvent]
test edi, edi
jle 0x180005b70
add ebp, edi
cmp ebp, 8
jge 0x180005bba
jmp 0x180005b8f
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_Sleep]
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, dword [rbx + 0x5c]
test ecx, ecx
je 0x180005b8f
sub eax, r14d
cmp eax, ecx
jae 0x180005bb8
cmp dword [rbx + 0x64], 0
jne 0x180005a96
xor eax, eax
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x20
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
xor ebp, ebp
mov eax, ebp
jmp 0x180005b9b

Function at 0x180008f40
Capabilities:
Create thread

Disassembly:
sub rsp, 0x38
dec edx
jne 0x180008f6e
xor eax, eax
mov qword [0x180039e08], rcx
lea r8, [0x180008ef0]
mov qword [rsp + 0x28], rax
xor r9d, r9d
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x20], eax
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov eax, 1
add rsp, 0x38
ret
Function at 0x180009380
Capabilities:
Create thread

Disassembly:
push rbx
sub rsp, 0x30
xor ebx, ebx
lea r8, [0x1800029b0]
xor r9d, r9d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x28], rbx
mov dword [rsp + 0x20], ebx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea r8, [0x18000dcd0]
xor r9d, r9d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x28], rbx
mov dword [rsp + 0x20], ebx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea r8, [0x18000f6c0]
xor r9d, r9d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x28], rbx
mov dword [rsp + 0x20], ebx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea r8, [0x18000afe0]
xor r9d, r9d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x28], rbx
mov dword [rsp + 0x20], ebx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea r8, [0x180002150]
xor r9d, r9d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x28], rbx
mov dword [rsp + 0x20], ebx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rcx, rax
add rsp, 0x30
pop rbx
jmp qword [sym.imp.KERNEL32.dll_CloseHandle]