joyce8/EMBER2024-capa huggingface dataset:
Function at 0x18006eba4
Capabilities:
Check http status code

Disassembly:
mov byte [rsp + rax + 0x1b0], 0x70
mov eax, 1
imul rax, rax, 0x22
mov byte [rsp + rax + 0x1b0], 0x72
mov eax, 1
add byte [rax + 0x6b], cl
ror byte [rsi + rax*8], 0x84
add al, 0xb0
add dword [rax], eax
add byte [rdx], bh
mov eax, 1
imul rax, rax, 0x19
mov byte [rsp + rax + 0x1b0], 0x2f
mov eax, 1
imul rax, rax, 0xa
mov byte [rsp + rax + 0x1b0], 0x70
mov eax, 1
imul rax, rax, 0xf
mov byte [rsp + rax + 0x1b0], 0x70
add al, 0xb0
add dword [rax], eax
add byte [rax - 0x48], dh
add dword [rax], eax
add byte [rax], al
imul rax, rax, 0x16
mov byte [rsp + rax + 0x1b0], 0x69
mov eax, 1
imul rax, rax, 0x25
imul eax, eax, 0x25
mov byte [rsp + rax + 0x1b0], 0x75
lea rdx, [rsp + 0x1b0]
lea rcx, [rsp + 0x130]
call fcn.180074c54
mov rcx, qword [rsp + 0x730]
call fcn.1800747e1
mov qword [rsp + 0xb0], rax
mov rcx, qword [rsp + 0x730]
add byte [rax], al
call fcn.180074816
mov qword [rsp + 0xb8], rax
lea rcx, [rsp + 0x130]
call fcn.18007480b
mov qword [rsp + 0xc0], rax
lea rcx, [rsp + 0x130]
call fcn.180074840
mov rcx, qword [rsp + 0xb0]
mov dword [rsp + 0x20], ecx
mov rcx, qword [rsp + 0xb8]
mov r9, rcx
mov rcx, qword [rsp + 0xc0]
mov r8d, ecx
mov rdx, rax
mov rcx, qword [rsp + 0x50]
call qword [0x18008d5d8]
mov dword [rsp + 0x4c], eax
lea rcx, [rsp + 0x130]
call fcn.180074bd1
jmp 0x18006ec85
cmp dword [rsp + 0x4c], 0
je 0x18006ef66
movzx eax, byte [rsp + 0x738]
test eax, eax
je 0x18006ee4e
mov qword [rsp + 0x110], 0
mov dword [rsp + 0x128], 8
mov dword [rsp + 0x88], 0
lea r9, [rsp + 0x128]
lea ecx, [rsp + 0x128]
lea r8, [rsp + 0x110]
mov edx, 0x69
mov rcx, qword [rsp + 0x50]
and al, 0x50
call qword [0x18008d608]
test eax, eax
je 0x18006ee4e

Function at 0x18006ebab
Capabilities:
Check http status code

Disassembly:
add dword [rax], eax
add byte [rbp + 0x48], dh
lea edx, [rsp + 0x1b0]

Function at 0x18006ecea
Capabilities:
Check http status code

Disassembly:
mov qword [rsp + 0x68], 0
mov rax, qword [rsp + 0x110]
cmp qword [rax + 0x10], 0
je 0x18006ee40
mov eax, 8
imul rax, rax, 0
mov rcx, qword [rsp + 0x110]
mov rcx, qword [rcx + 0x10]

Function at 0x18006f593
Capabilities:
Contain obfuscated stackstrings

Disassembly:
add byte [rax + 0x6b], cl
ror byte [rsi + rax*8], 0x44
add al, 0x30
movabs r8, 0x10c06b4800000001

Function at 0x18006f740
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0xf8
add byte [rax], al
add byte [rax - 0x75], cl
add eax, 0x65a60
xor rax, rsp
mov qword [rsp + 0xe0], rax
mov dword [rsp + 0x50], 0
mov eax, 1
imul rax, rax, 4
mov byte [rsp + rax + 0x38], 0x34
mov eax, 1
imul rax, rax, 0xe
mov byte [rsp + rax + 0x38], 0x65
mov eax, 1
imul rax, rax, 0xd
mov byte [rsp + rax + 0x38], 0x64
mov eax, 1
imul rax, rax, 0xf
mov byte [rsp + rax + 0x38], 0x66
mov eax, 1
imul rax, rax, 0
mov byte [rsp + rax + 0x38], 0x30
mov eax, 1
imul rax, rax, 8
mov byte [rsp + rax + 0x38], 0x38
mov eax, 1
imul rax, rax, 1
mov byte [rsp + rax + 0x38], 0x31
mov eax, 1
Function at 0x18006f74e
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0xf8
add byte [rax], al
add byte [rax - 0x75], cl
add eax, 0x65a60
xor rax, rsp
mov qword [rsp + 0xe0], rax
mov dword [rsp + 0x50], 0
mov eax, 1
imul rax, rax, 4
mov byte [rsp + rax + 0x38], 0x34
mov eax, 1
imul rax, rax, 0xe
mov byte [rsp + rax + 0x38], 0x65
mov eax, 1
imul rax, rax, 0xd
mov byte [rsp + rax + 0x38], 0x64
mov eax, 1
imul rax, rax, 0xf
mov byte [rsp + rax + 0x38], 0x66
mov eax, 1
imul rax, rax, 0
mov byte [rsp + rax + 0x38], 0x30
mov eax, 1
imul rax, rax, 8
mov byte [rsp + rax + 0x38], 0x38
mov eax, 1
imul rax, rax, 1
mov byte [rsp + rax + 0x38], 0x31
mov eax, 1

Function at 0x180072495
Capabilities:
Hash data using sha256

Disassembly:
imul eax, eax, 0
mov rcx, qword [rsp + 8]
mov dword [rcx + rax], 0x6a09e667
mov eax, 4
imul rax, rax, 1
mov rcx, qword [rsp + 8]
mov dword [rcx + rax], 0xbb67ae85
mov eax, 4
imul rax, rax, 2
mov rcx, qword [rsp + 8]
and al, 8

Function at 0x180072cb6
Capabilities:
Encode data using base64

Disassembly:
mov dword [rsp + 4], eax
mov eax, dword [rsp + 0x300]
cmp dword [rsp + 4], eax
jge 0x18007324f
mov eax, dword [rsp + 4]
shl eax, 7
cdqe
mov rcx, qword [rsp + 0x2f8]
add rcx, rax
mov rax, rcx
mov qword [rsp + 8], rax
mov dword [rsp], 0
jmp 0x180072cf8
cmp dword [rsp], 0x10
jge 0x180072dd7
mov eax, dword [rsp]
shl eax, 3
cdqe
mov rcx, qword [rsp + 8]
invalid
mov dh, 0x44
invalid

Function at 0x180078199
Capabilities:
Read file on windows

Disassembly:
add eax, 0x5d01a
xor rax, rsp
mov qword [rsp + 0x40], rax
mov byte [rsp + 0x30], 0
mov rax, qword [rsp + 0x60]
cmp qword [rax], 0xffffffffffffffff
je 0x180078225
xor r9d, r9d
xor r8d, r8d
mov edx, dword [rsp + 0x68]
mov rax, qword [rsp + 0x60]
mov rcx, qword [rax]

Function at 0x1800781c8
Capabilities:
Read file on windows

Disassembly:
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
mov dword [rsp + 0x38], 0
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x38]
mov r8d, dword [rsp + 0x78]
mov rdx, qword [rsp + 0x70]
mov rax, qword [rsp + 0x60]
mov rcx, qword [rax]
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x180078225
mov eax, dword [rsp + 0x78]
cmp dword [rsp + 0x38], eax
jne 0x180078214
mov dword [rsp + 0x34], 1
jmp 0x18007821c
mov dword [rsp + 0x34], 0
movzx eax, byte [rsp + 0x34]
mov byte [rsp + 0x30], al
movzx eax, byte [rsp + 0x30]
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call 0x1800bf547
add rsp, 0x58
ret
Function at 0x18007b39b
Capabilities:
Get file size
Read file on windows

Disassembly:
add byte [rax], al
add bh, al
and al, 0x20
add eax, dword [rax]
add byte [rax], al
xor r9d, r9d
mov r8d, 1
mov edx, 0x80000000
mov rcx, rax
call qword [0x18008d260]
mov qword [rsp + 0x48], rax
invalid
invalid
jl 0x18007b3ea

Function at 0x18007b921
Capabilities:
Read file via mapping

Disassembly:
jne 0x18007b977
mov byte [rsp + 0x31], 0
lea rcx, [rsp + 0x140]
call fcn.1800818b5
nop
lea rcx, [rsp + 0x120]
call fcn.1800818c3
nop
lea rcx, [rsp + 0x180]
call fcn.1800818d1
nop
lea rcx, [rsp + 0x160]
call fcn.1800818df
nop
mov rcx, qword [rsp + 0x620]
call fcn.1800818ed
movzx eax, byte [rsp + 0x31]
jmp 0x1800f682f
mov dword [rsp + 0x34], 0x400
mov eax, dword [rsp + 0x34]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor ecx, ecx
xor r8d, r8d
mov edx, 4
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
adc eax, 0x11842
mov qword [rsp + 0x40], rax
cmp qword [rsp + 0x40], 0
jne 0x18007ba0a
mov rcx, qword [rsp + 0x38]
call qword [0x18008d258]
mov byte [rsp + 0x32], 0
lea rcx, [rsp + 0x140]
call fcn.180081948
nop
lea rcx, [rsp + 0x120]
call fcn.180081956
nop
lea rcx, [rsp + 0x180]
call fcn.180081964
nop
lea rcx, [rsp + 0x160]
call fcn.180081972
nop
mov rcx, qword [rsp + 0x620]
call fcn.180081980
movzx eax, byte [rsp + 0x32]
jmp 0x1800f68c2
mov eax, dword [rsp + 0x34]
mov r8d, eax
mov rdx, qword [rsp + 0x40]
lea rcx, [rsp + 0x200]
call 0x1800c4283
lea rcx, [rsp + 0x180]
call fcn.180081660
mov r8d, 0x20
mov rdx, rax
lea rcx, [rsp + 0x200]
call 0x1800c4736
test eax, eax
jne 0x18007ba4f
mov byte [rsp + 0x30], 1
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
mov rcx, qword [rsp + 0x38]
call qword [0x18008d258]
Function at 0x18007d7ad
Capabilities:
Read file on windows

Disassembly:
xchg esp, eax
and al, 0x98
add dword [rax], eax
add byte [rax - 0x73], cl
mov word [rax + rdx*2], fs
add eax, dword [rax]
add al, ch
call 0x180082caa
mov rcx, qword [rsp + 0x98]
mov r9, rcx
mov rcx, qword [rsp + 0xa0]
mov r8, qword [rcx]
mov rdx, qword [rax]
lea rcx, [rsp + 0x3e0]
call 0x1800a2e60
push rsi
add al, byte [rax]
mov qword [rsp + 0x1a0], rax
mov edx, 0x18
lea rcx, [rsp + 0x388]
call fcn.18007e8fa
mov byte [rsp + 0x20], 0
lea r9, [rsp + 0x3e0]
lea r8, [rsp + 0x3a0]
lea rdx, [rsp + 0x350]
lea rcx, [rsp + 0x388]
call 0x1800a3c44
mov qword [rsp + 0x1a8], rax
lea rcx, [rsp + 0x3a0]
call fcn.180083419
add byte [rax - 0x77], cl
test byte [rax + rbp*4], ah
add byte [rax], al
add byte [rax - 0x73], cl
mov word [rax + riz*4], fs
add eax, dword [rax]
add al, ch
xor byte [rax + rax], bl
mov rcx, qword [rsp + 0xa8]
mov rdx, rcx
mov rcx, rax
call 0x1800a3221
lea rdx, [rsp + 0x1b0]
lea rcx, [rsp + 0x388]
add byte [rax], al
call fcn.180082d66
mov r8d, 0x10
lea rdx, [rsp + 0x1b8]
mov rcx, rax
call 0x1800a439c
mov qword [rsp + 0xb0], rax
lea rdx, [rsp + 0x1c0]
lea rcx, [rsp + 0x388]
call 0x18009fbd9
mov r8, qword [rax]
mov rax, qword [rsp + 0xb0]
mov rdx, qword [rax]
lea rcx, [rsp + 0x368]
call 0x1800a6b04
nop
lea rcx, [rsp + 0x388]
call 0x18009fc62
nop
lea rcx, [rsp + 0x3e0]
call fcn.180083830
nop
lea rcx, [rsp + 0x3a0]
call fcn.18008383e
nop
lea rcx, [rsp + 0x350]
call 0x18009fc8c
nop
lea rcx, [rsp + 0x3c0]
call fcn.18008385a
lea rcx, [rsp + 0x400]
add byte [rax + rax], al
add al, ch
lock and eax, dword [rax + rax]
mov qword [rsp + 0x1c8], rax
lea rcx, [rsp + 0x400]
call 0x1800c05ec
cmp dword [rsp + 0x400], 0
jne 0x18007d910
mov dword [rsp + 0x38], 0
jmp 0x18007d918
mov dword [rsp + 0x38], 1
movzx eax, byte [rsp + 0x38]
mov byte [rsp + 0x35], al
movzx eax, byte [rsp + 0x2050]
test eax, eax
je 0x18007d93f
call 0x1800f8812
mov byte [rsp + 0x34], al
movzx eax, byte [rsp + 0x34]
test eax, eax
je 0x18007d95e
movzx eax, byte [rsp + 0x35]
test eax, eax
jne 0x18007d95e
lea rcx, [rsp + 0x368]
call fcn.180083565
test rax, rax
jne 0x18007db37
lea rdx, [rsp + 0x280]
lea rcx, [0x1800d9780]
add al, ch
add dword [rdx], 0
mov qword [rsp + 0xb8], rax
mov rax, qword [rsp + 0xb8]
mov qword [rsp + 0xc8], rax
mov edx, 0x1b
lea rcx, [rsp + 0x260]
lea rcx, [rsp + 0x368]
call fcn.180083754
Function at 0x180080600
Capabilities:
Acquire debug privileges

Disassembly:
sub rsp, 0x68
mov rax, qword [0x1800d51b8]
xor rax, rsp
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x30], 0
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea r8, [rsp + 0x30]
mov edx, 0x20
mov rcx, rax
call qword [0x18008d0d0]
test eax, eax
je fcn.1800806b2
lea r8, [rsp + 0x38]
lea rdx, str.SeDebugPrivilege
xor ecx, ecx
call qword [0x18008d040]
test eax, eax
je 0x1800806a7
mov dword [rsp + 0x40], 1
mov eax, 0xc
imul rax, rax, 0
mov rcx, qword [rsp + 0x38]
mov qword [rsp + rax + 0x44], rcx
mov eax, 0xc
imul rax, rax, 0
mov dword [rsp + rax + 0x4c], 2
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
mov r9d, 0x10
lea r8, [rsp + 0x40]
xor edx, edx
mov rcx, qword [rsp + 0x30]
call qword [0x18008d050]
mov rcx, qword [rsp + 0x30]
call qword [0x18008d258]

Function at 0x180081123
Capabilities:
Hash data with crc32

Disassembly:
movsxd rax, dword [rsp + 4]
mov rcx, qword [rsp + 0x30]
movzx eax, byte [rcx + rax]
mov dh, 4
invalid
test eax, eax
je 0x180081193
movsxd rax, dword [rsp + 4]
mov rcx, qword [rsp + 0x30]
movzx eax, byte [rcx + rax]
mov dword [rsp + 0xc], eax
mov eax, dword [rsp + 0xc]
mov ecx, dword [rsp]
and al, 0x33
enter 0xffffffffffffc18b, 0xffffffffffffff89
add al, 0x24
and al, 0x33
enter 0xffffffffffffc18b, 0xffffffffffffff89
add al, 0x24
mov dword [rsp + 8], 7
jmp 0x18008115e
mov eax, dword [rsp + 8]
dec eax
mov dword [rsp + 8], eax
cmp dword [rsp + 8], 0
jl 0x180081187
mov eax, dword [rsp]
and eax, 1
neg eax
mov dword [rsp + 0x10], eax
mov eax, dword [rsp]
shr eax, 1
mov ecx, dword [rsp + 0x10]
and ecx, 0xedb88320
xor eax, ecx
mov dword [rsp], eax
jmp 0x180081154
mov eax, dword [rsp + 4]
inc eax
mov dword [rsp + 4], eax
jmp 0x180081118
mov eax, dword [rsp]

Function at 0x180081142
Capabilities:
Hash data with crc32

Disassembly:
movsxd rax, dword [rsp + 4]
mov rcx, qword [rsp + 0x30]
movzx eax, byte [rcx + rax]
mov dh, 4
invalid
test eax, eax
je 0x180081193
movsxd rax, dword [rsp + 4]
mov rcx, qword [rsp + 0x30]
movzx eax, byte [rcx + rax]
mov dword [rsp + 0xc], eax
mov eax, dword [rsp + 0xc]
mov ecx, dword [rsp]
and al, 0x33
enter 0xffffffffffffc18b, 0xffffffffffffff89
add al, 0x24
and al, 0x33
enter 0xffffffffffffc18b, 0xffffffffffffff89
add al, 0x24
mov dword [rsp + 8], 7
jmp 0x18008115e
mov eax, dword [rsp + 8]
dec eax
mov dword [rsp + 8], eax
cmp dword [rsp + 8], 0
jl 0x180081187
mov eax, dword [rsp]
and eax, 1
neg eax
mov dword [rsp + 0x10], eax
mov eax, dword [rsp]
shr eax, 1
mov ecx, dword [rsp + 0x10]
and ecx, 0xedb88320
xor eax, ecx
mov dword [rsp], eax
jmp 0x180081154
mov eax, dword [rsp + 4]
inc eax
mov dword [rsp + 4], eax
jmp 0x180081118
mov eax, dword [rsp]

Function at 0x180083350
Capabilities:
Get file size
Read file on windows

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x88
mov rax, qword [0x1800d51b8]
xor rax, rsp
mov qword [rsp + 0x78], rax
mov rcx, qword [rsp + 0x90]
call fcn.180088f8d
test rax, rax
jne 0x180083389
xor al, al
jmp 0x180105cbd
mov rcx, qword [rsp + 0x90]
call 0x1800a7be6
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 3
xor r9d, r9d
Function at 0x18008338e
Capabilities:
Get file size
Read file on windows

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x88
mov rax, qword [0x1800d51b8]
xor rax, rsp
mov qword [rsp + 0x78], rax
mov rcx, qword [rsp + 0x90]
call fcn.180088f8d
test rax, rax
jne 0x180083389
xor al, al
jmp 0x180105cbd
mov rcx, qword [rsp + 0x90]
call 0x1800a7be6
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 3
xor r9d, r9d

Function at 0x1800833b2
Capabilities:
Get file size
Read file on windows

Disassembly:
mov r8d, 1
mov edx, 0x80000000
mov rcx, rax
call qword [0x18008d260]
mov qword [rsp + 0x48], rax
cmp qword [rsp + 0x48], 0xffffffffffffffff
jne 0x1800833da
xor al, al
jmp 0x180105d0e
xor edx, edx
mov rcx, qword [rsp + 0x48]

Function at 0x1800833f4
Capabilities:
Read file on windows

Disassembly:
and al, 0x58
mov eax, dword [rsp + 0x50]
mov r8d, eax
xor edx, edx
mov rcx, qword [rsp + 0x58]
call qword [0x18008d2d8]
mov qword [rsp + 0x40], rax
cmp qword [rsp + 0x40], 0
jne fcn.180083429
invalid
invalid

Function at 0x180083429
Capabilities:
Read file on windows

Disassembly:
mov dword [rsp + 0x70], 0
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x70]
mov r8d, dword [rsp + 0x50]
mov rdx, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x48]

Function at 0x18008344e
Capabilities:
Read file on windows

Disassembly:
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x18008347c
mov r8, qword [rsp + 0x40]
xor edx, edx
mov rcx, qword [rsp + 0x58]
call qword [0x18008d308]
invalid

Function at 0x1800846b6
Capabilities:
Write file on windows

Disassembly:
dec dword [rax - 0x75]
add eax, 0x50b7b
xor rax, rsp
mov qword [rsp + 0xc0], rax
mov edx, 8
lea rcx, [rsp + 0xb0]
call fcn.18008578a
lea rcx, [rsp + 0xb0]
call 0x1800a8157
nop
mov edx, 0x800
lea rcx, [rsp + 0xb0]
call 0x1800a828a
mov r8d, 0x104
mov rdx, rax
xor ecx, ecx
call qword [0x18008d268]
mov edx, 0x800
lea rcx, [rsp + 0xb0]
call 0x1800a82ad
mov rcx, rax
call qword [0x18008d540]
mov edx, 0xffffffff
lea rcx, [rsp + 0xb0]
call 0x1800a8fd8
add al, byte [rax]
lea rdx, [0x1800a4eac]
lea rcx, [rsp + 0xb0]
call 0x1800a904c
mov edx, 5
lea rcx, [rsp + 0x90]
call 0x1800b15c2
mov qword [rsp + 0x58], rax
mov rax, qword [rsp + 0x58]
mov qword [rsp + 0x60], rax
mov rcx, qword [rsp + 0x60]
call 0x1800a8f47
mov rdx, rax
lea rcx, [rsp + 0xb0]
call 0x1800a9087
nop
lea rcx, [rsp + 0x90]
call 0x1800a8f95
lea rcx, [rsp + 0xb0]
call fcn.18008a1d2
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 2
xor r9d, r9d
xor r8d, r8d
mov edx, 0x40000000
mov rcx, rax
call qword [0x18008d260]
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x48]
mov qword [rsp + 0x48], rax
cmp qword [rsp + 0x48], 0xffffffffffffffff
jne 0x180084782
mov byte [rsp + 0x40], 0
lea rcx, [rsp + 0xb0]
call 0x1800a8158
movzx eax, byte [rsp + 0x40]
jmp 0x180108493
invalid
mov rcx, qword [rsp + 0xf0]
call 0x1800a699f
Function at 0x180084781
Capabilities:
Write file on windows

Disassembly:
add byte [rax - 0x75], cl
mov word [rax + rsi*8], fs
add byte [rax], al
add al, ch
adc byte [rdx], ah
add al, byte [rax]
mov qword [rsp + 0x68], rax
mov rcx, qword [rsp + 0xf0]
call 0x1800aaeb1
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0xb8]
mov rcx, qword [rsp + 0x68]
mov r8d, ecx
mov rdx, rax
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_WriteFile]
jo 0x18008474f
add byte [rax], al
mov rcx, qword [rsp + 0xf0]
call 0x1800a69e5
mov qword [rsp + 0x70], rax
mov rcx, qword [rsp + 0xf0]
call 0x1800aaef7
mov rcx, qword [rsp + 0x70]
mov rdx, rcx
mov rcx, rax
call 0x1800aa1e7
mov rcx, qword [rsp + 0x48]
call qword [0x18008d258]
lea rcx, [rsp + 0xb0]
call fcn.18008a2bf
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov qword [rsp + 0x50], rax
cmp qword [rsp + 0x50], 0
jne 0x180084841
mov byte [rsp + 0x41], 0
invalid
invalid
invalid
invalid

Function at 0x1800854f2
Capabilities:
Get file version info

Disassembly:
and al, 0x18
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0xd8
mov qword [rsp + 0x70], 0xfffffffffffffffe
mov rax, qword [0x1800d51b8]
xor rax, rsp
mov qword [rsp + 0xc0], rax
mov dword [rsp + 0x30], 0
mov eax, 2
imul rax, rax, 0xa
mov ecx, 0x36
mov word [rsp + rax + 0x90], cx
mov eax, 2
imul rax, rax, 2
mov ecx, 0x2e
mov word [rsp + rax + 0x90], cx
mov eax, 2
imul rax, rax, 1
mov ecx, 0x36
mov word [rsp + rax + 0x90], cx
mov eax, 2
imul rax, rax, 6
mov ecx, 0x2e
mov word [rsp + rax + 0x90], cx
mov eax, 2
imul rax, rax, 5
mov ecx, 0x35
mov word [rsp + rax + 0x90], cx
mov eax, 2
imul rax, rax, 8
mov ecx, 0x30
mov word [rsp + rax + 0x90], cx
mov eax, 2
imul rax, rax, 9
mov ecx, 0x36
mov word [rsp + rax + 0x90], cx
mov eax, 2
imul rax, rax, 3
mov ecx, 0x30
mov word [rsp + rax + 0x90], cx
mov eax, 2
imul rax, rax, 0
mov ecx, 0x36
mov word [rsp + rax + 0x90], cx
mov eax, 2
imul rax, rax, 0xb
mov qword [rsp + 0x48], rax
cmp qword [rsp + 0x48], 0x18
jae 0x180085607
jmp 0x18008560c
call 0x1800cd1c8
xor eax, eax
mov rcx, qword [rsp + 0x48]
mov word [rsp + rcx + 0x90], ax
mov eax, 2
imul rax, rax, 4
mov ecx, 0x2e
mov word [rsp + rax + 0x90], cx
mov eax, 2
imul rax, rax, 7
mov ecx, 0x37
mov word [rsp + rax + 0x90], cx
mov edx, 8
lea rcx, [rsp + 0x80]
call fcn.180086789
lea rdx, [rsp + 0x90]
lea rcx, [rsp + 0x80]
call 0x1800a90ce
nop
mov rcx, qword [rsp + 0xf0]
call fcn.18008b21c
movzx eax, al
test eax, eax
je 0x1800856d3
lea rcx, [rsp + 0x80]
call fcn.18008b140
mov rdx, rax
mov rcx, qword [rsp + 0xe8]
call fcn.180029160
mov eax, dword [rsp + 0x30]
or eax, 1
mov dword [rsp + 0x30], eax
lea rcx, [rsp + 0x80]
and al, 0x80
add byte [rax], al
add al, ch
loopne 0x1800856ef
add al, byte [rax]
mov dword [rsp + 0x88], 0
mov dword [rsp + 0x8c], 0
mov qword [rsp + 0x78], 0
mov rcx, qword [rsp + 0xf0]
call 0x1800a9f4f
Function at 0x1800856ae
Capabilities:
Get file version info

Disassembly:
and al, 0x80
add byte [rax], al
add al, ch
loopne 0x1800856ef
add al, byte [rax]
nop
mov rcx, qword [rsp + 0xf0]
call 0x1800a9f46
mov rax, qword [rsp + 0xe8]
jmp 0x1800859bb
add byte [rax], al
add byte [rax - 0x75], cl
mov word [rax + rsi*8], fs
add byte [rax], al
add al, ch
push rax
add al, byte [rax]
lea rdx, [rsp + 0x88]
mov rcx, rax
call qword [sym.imp.VERSION.dll_GetFileVersionInfoSizeW]
mov dword [rsp + 0x34], eax
cmp dword [rsp + 0x34], 0
je 0x180085970
mov eax, dword [rsp + 0x34]
mov ecx, eax
call 0x1800cd47a
mov qword [rsp + 0x60], rax
mov rax, qword [rsp + 0x60]
mov qword [rsp + 0x40], rax
mov rcx, qword [rsp + 0xf0]
call 0x1800a9f96
mov r9, qword [rsp + 0x40]
mov r8d, dword [rsp + 0x34]
mov edx, dword [rsp + 0x88]
mov rcx, rax
call qword [sym.imp.VERSION.dll_GetFileVersionInfoW]
test eax, eax
je 0x180085936
lea r9, [rsp + 0x8c]
lea r8, [rsp + 0x78]
lea rdx, [0x1800a4e6c]
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.VERSION.dll_VerQueryValueW]
test eax, eax
je 0x180085936
invalid
cmpsd dword [rsi], dword [rdi]
add dword [rax], eax
invalid
cmp dword [rsp + 0x8c], 0
Function at 0x180003f20
Capabilities:
Receive data
Receive data on socket

Disassembly:
sub rsp, 0x28
cmp byte [rcx + 0x280], 0
je 0x180003f3d
call fcn.180057450
test eax, eax
jne 0x180003f63
xor al, al
add rsp, 0x28
ret
mov rcx, qword [rcx + 0x1e8]
cmp rcx, 0xffffffffffffffff
je 0x180003f36
mov r9d, 2
lea rdx, [rsp + 0x30]
lea r8d, [r9 - 1]
call qword [sym.imp.WS2_32.dll_recv]
test eax, eax
je 0x180003f36
mov al, 1
add rsp, 0x28
ret

Function at 0x1800041b0
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x1c0
mov rax, qword [0x18009ddc8]
xor rax, rsp
mov qword [rsp + 0x1b0], rax
xorps xmm0, xmm0
mov dword [rsp + 0x20], 0x80
mov rax, rdx
mov rdi, r8
mov rsi, rcx
lea r8, [rsp + 0x20]
mov rcx, rax
lea rdx, [rsp + 0x30]
mov rbx, r9
movups xmmword [rsp + 0x30], xmm0
movups xmmword [rsp + 0x40], xmm0
movups xmmword [rsp + 0x50], xmm0
movups xmmword [rsp + 0x60], xmm0
movups xmmword [rsp + 0x70], xmm0
movups xmmword [rsp + 0x80], xmm0
movups xmmword [rsp + 0x90], xmm0
movups xmmword [rsp + 0xa0], xmm0
call qword [sym.imp.WS2_32.dll_getsockname]
test eax, eax
je 0x180004258
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov r8d, 0x100
lea rdx, [rsp + 0xb0]
mov ecx, eax
mov ebx, eax
call fcn.18003d5c0
mov r8d, ebx
lea rdx, str.getsockname___failed_with_errno__d:__s
jmp 0x1800042e1
movzx eax, word [rsp + 0x30]
cmp eax, 2
je 0x180004293
cmp eax, 0x17
jne 0x18000429f
lea rdx, [rsp + 0x38]
mov ecx, eax
mov r8, rdi
mov r9d, reloc.WLDAP32.dll_Ordinal_46
call fcn.180023c70
test rax, rax
je 0x18000429f
movzx ecx, word [rsp + 0x32]
call qword [sym.imp.WS2_32.dll_ntohs]
movzx eax, ax
mov dword [rbx], eax
jmp 0x1800042ec
lea rdx, [rsp + 0x34]
mov ecx, 2
jmp 0x18000426e
mov byte [rdi], 0
mov dword [rbx], 0
call fcn.180063140
mov dword [rax], 0x273f
call fcn.180063140
mov ebx, dword [rax]
call fcn.180063140
mov r8d, 0x100
lea rdx, [rsp + 0xb0]
mov ecx, ebx
mov rdi, rax
call fcn.18003d5c0
mov r8d, dword [rdi]
lea rdx, str.ssloc_inet_ntop___failed_with_errno__d:__s
mov r9, rax
mov rcx, rsi
call fcn.180033740
mov rcx, qword [rsp + 0x1b0]
xor rcx, rsp
call fcn.180058650
add rsp, 0x1c0
pop rdi
pop rsi
pop rbx
ret