joyce8/EMBER2024-capa huggingface dataset:
Function at 0x18004e2d0
Capabilities:
Connect socket
Get local ipv4 addresses
Get socket information

Disassembly:
push rbp
push rbx
push rsi
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x58
mov rax, qword [0x18032d860]
xor rax, rsp
mov qword [rbp - 0x10], rax
xor r13d, r13d
dec ecx
cmp ecx, 1
mov r15d, edx
mov edx, r13d
mov rbx, 0xffffffffffffffff
seta dl
mov r14, r9
mov rsi, rbx
test r8d, r8d
jne 0x18004e4f5
test edx, edx
jne 0x18004e4f5
test r9, r9
jne 0x18004e332
mov ecx, 0x2726
call qword [sym.imp.WS2_32.dll_WSASetLastError]
mov eax, ebx
jmp 0x18004e36b
mov qword [rsp + 0x90], rdi
xor r8d, r8d
mov qword [rsp + 0x50], r12
mov edx, r15d
mov r12d, 2
mov ecx, r12d
call qword [sym.imp.WS2_32.dll_socket]
mov rdi, rax
test rax, rax
jns 0x18004e385
mov eax, ebx
mov rdi, qword [rsp + 0x90]
mov r12, qword [rsp + 0x50]
mov rcx, qword [rbp - 0x10]
xor rcx, rsp
call fcn.180227e50
add rsp, 0x58
pop r15
pop r14
pop r13
pop rsi
pop rbx
pop rbp
ret
mov ecx, 0x7f000001
mov qword [rbp - 0x28], r13
mov word [rbp - 0x30], r12w
call qword [sym.imp.WS2_32.dll_htonl]
mov r8d, reloc.WS2_32.dll_recv
mov word [rbp - 0x2e], r13w
lea rdx, [rbp - 0x30]
mov dword [rbp - 0x2c], eax
mov rcx, rdi
call qword [sym.imp.WS2_32.dll_bind]
cmp eax, ebx
je 0x18004e4b2
mov edx, 1
mov rcx, rdi
call qword [sym.imp.WS2_32.dll_listen]
cmp eax, ebx
je 0x18004e4b2
xor r8d, r8d
mov edx, r15d
mov ecx, r12d
call qword [sym.imp.WS2_32.dll_socket]
mov rbx, rax
test rax, rax
js 0x18004e4b2
xorps xmm0, xmm0
mov dword [rbp - 0x38], reloc.WS2_32.dll_recv
lea r8, [rbp - 0x38]
mov rcx, rdi
lea rdx, [rbp - 0x20]
movups xmmword [rbp - 0x20], xmm0
call qword [sym.imp.WS2_32.dll_getsockname]
cmp eax, esi
je 0x18004e4b2
cmp dword [rbp - 0x38], 0x10
jne 0x18004e4aa
mov r8d, reloc.WS2_32.dll_recv
lea rdx, [rbp - 0x20]
mov rcx, rbx
call qword [sym.imp.WS2_32.dll_connect]
cmp eax, esi
je 0x18004e4b2
lea r8, [rbp - 0x38]
mov dword [rbp - 0x38], reloc.WS2_32.dll_recv
lea rdx, [rbp - 0x30]
mov rcx, rdi
call qword [sym.imp.WS2_32.dll_accept]
mov rsi, rax
test rax, rax
js 0x18004e4b2
cmp dword [rbp - 0x38], 0x10
jne 0x18004e4aa
lea r8, [rbp - 0x38]
mov rcx, rbx
lea rdx, [rbp - 0x20]
call qword [sym.imp.WS2_32.dll_getsockname]
cmp eax, 0xffffffff
je 0x18004e4b2
cmp dword [rbp - 0x38], 0x10
jne 0x18004e4aa
movzx eax, word [rbp - 0x20]
cmp word [rbp - 0x30], ax
jne 0x18004e4aa
mov eax, dword [rbp - 0x1c]
cmp dword [rbp - 0x2c], eax
jne 0x18004e4aa
movzx eax, word [rbp - 0x1e]
cmp word [rbp - 0x2e], ax
jne 0x18004e4aa
mov rcx, rdi
call qword [sym.imp.WS2_32.dll_closesocket]
xor eax, eax
mov qword [r14], rbx
mov qword [r14 + 8], rsi
jmp 0x18004e35e
mov r14d, 0x2745
jmp 0x18004e4bb
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov r14d, eax
mov rcx, rdi
call qword [sym.imp.WS2_32.dll_closesocket]
cmp rbx, 0xffffffffffffffff
je 0x18004e4d3
mov rcx, rbx
call qword [sym.imp.WS2_32.dll_closesocket]
cmp rsi, 0xffffffffffffffff
je 0x18004e4e2
mov rcx, rsi
call qword [sym.imp.WS2_32.dll_closesocket]
mov ecx, r14d
call qword [sym.imp.WS2_32.dll_WSASetLastError]
mov eax, 0xffffffff
jmp 0x18004e35e
mov ecx, 0x273f
call qword [sym.imp.WS2_32.dll_WSASetLastError]
mov eax, ebx
jmp 0x18004e36b
Function at 0x18004f590
Capabilities:
Hash data using murmur3

Disassembly:
push rsi
sub rsp, 0x20
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x38], rdi
call fcn.180074da0
mov r8d, dword [0x180327f50]
xor esi, esi
mov eax, esi
test r8d, r8d
je 0x18004f672
mov rdx, qword [0x180327f48]
mov rcx, rdx
cmp qword [rcx], rsi
jne 0x18004f5d8
inc eax
add rcx, 8
cmp eax, r8d
jb 0x18004f5c3
jmp 0x18004f679
lea rbx, [rdx + rax*8]
test rbx, rbx
je 0x18004f679
nop word [rax + rax]
mov rdi, qword [rbx]
mov ecx, dword [rdi + 8]
shr ecx, 0x10
xor ecx, dword [rdi + 8]
imul eax, ecx, 0x85ebca6b
mov ecx, eax
shr ecx, 0xd
xor ecx, eax
mov rax, qword [rdi]
mov qword [rbx], rax
dec dword [0x180327f54]
imul edx, ecx, 0xc2b2ae35
cmp qword [rbx], rsi
jne 0x18004f6d2
mov r8d, dword [0x180327f50]
mov eax, edx
shr eax, 0x10
xor eax, edx
xor edx, edx
div r8d
inc edx
cmp edx, r8d
jae 0x18004f660
mov r9, qword [0x180327f48]
lea rcx, [r9 + rdx*8]
nop dword [rax]
cmp qword [rcx], rsi
jne 0x18004f6ce
inc edx
add rcx, 8
cmp edx, r8d
jb 0x18004f650
mov rcx, qword [rdi + 0x10]
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rcx, rdi
call fcn.18022c440
mov rdx, qword [0x180327f48]
mov rdi, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x30]
test rdx, rdx
je 0x18004f690
mov rcx, rdx
call fcn.18022c440
mov rcx, qword [0x18032f598]
mov qword [0x180327f50], rsi
mov qword [0x180327f48], rsi
mov dword [0x180327f58], esi
mov dword [0x180327f5c], 0xffffffff
test rcx, rcx
je 0x18004f6c8
xor edx, edx
call fcn.180075af0
mov qword [0x18032f598], rsi
add rsp, 0x20
pop rsi
ret
lea rbx, [r9 + rdx*8]
mov rcx, qword [rdi + 0x10]
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rcx, rdi
call fcn.18022c440
test rbx, rbx
jne 0x18004f5f0
jmp 0x18004f672
sub rsp, 0x28
call fcn.180076ea0
add rsp, 0x28
jmp 0x18004f590

Function at 0x18004f700
Capabilities:
Get common file path

Disassembly:
push rbx
sub rsp, 0x140
mov rax, qword [0x18032d860]
xor rax, rsp
mov qword [rsp + 0x130], rax
mov rbx, rcx
mov edx, 0x104
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
test eax, eax
je 0x18004f7ac
mov rdx, 0xffffffffffffffff
nop dword [rax]
inc rdx
cmp byte [rbx + rdx], 0
jne 0x18004f740
mov ecx, eax
add rcx, 2
add rcx, rdx
cmp rcx, 0x104
jae 0x18004f7ac
lea rcx, [rsp + 0x20]
dec rcx
cmp byte [rcx + 1], 0
lea rcx, [rcx + 1]
jne 0x18004f763
movzx eax, word [0x1802612d0]
mov word [rcx], ax
lea rcx, [rsp + 0x20]
dec rcx
nop
cmp byte [rcx + 1], 0
lea rcx, [rcx + 1]
jne 0x18004f780
xor edx, edx
nop dword [rax]
movzx eax, byte [rbx + rdx]
mov byte [rcx + rdx], al
lea rdx, [rdx + 1]
test al, al
jne 0x18004f790
lea rcx, [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
jmp 0x18004f7ae
xor eax, eax
mov rcx, qword [rsp + 0x130]
xor rcx, rsp
call fcn.180227e50
add rsp, 0x140
pop rbx
ret
Function at 0x18004f8a0
Capabilities:
Set socket configuration

Disassembly:
push rbx
sub rsp, 0x20
xor r8d, r8d
mov rbx, rcx
mov r9, rcx
lea edx, [r8 + 1]
lea ecx, [rdx + 1]
call fcn.18004e2d0
test eax, eax
jne 0x18004f949
mov qword [rsp + 0x30], rdi
lea r8, [rsp + 0x38]
mov rdi, qword [rbx]
mov edx, 0x8004667e
mov rcx, rdi
mov dword [rsp + 0x38], 1
call qword [sym.imp.WS2_32.dll_ioctlsocket]
cmp eax, 0xffffffff
jne 0x18004f92f
mov r8d, edi
lea rdx, str.fcntl__d__F_GETFL_
mov rcx, rdi
call fcn.180062b10
mov rcx, qword [rbx]
call qword [sym.imp.WS2_32.dll_closesocket]
mov rcx, qword [rbx + 8]
call qword [sym.imp.WS2_32.dll_closesocket]
mov rdi, qword [rsp + 0x30]
mov eax, 0xffffffff
mov qword [rbx + 8], 0xffffffffffffffff
mov qword [rbx], 0xffffffffffffffff
add rsp, 0x20
pop rbx
ret
mov rcx, qword [rbx + 8]
call fcn.18004fa80
test eax, eax
js 0x18004f8fd
mov rdi, qword [rsp + 0x30]
xor eax, eax
add rsp, 0x20
pop rbx
ret
mov qword [rbx + 8], 0xffffffffffffffff
mov eax, 0xffffffff
mov qword [rbx], 0xffffffffffffffff
add rsp, 0x20
pop rbx
ret

Function at 0x18004fa80
Capabilities:
Set socket configuration

Disassembly:
push rbx
sub rsp, 0x20
lea r8, [rsp + 0x38]
mov dword [rsp + 0x38], 1
mov edx, 0x8004667e
mov rbx, rcx
call qword [sym.imp.WS2_32.dll_ioctlsocket]
cmp eax, 0xffffffff
jne 0x18004fac3
mov r8d, ebx
lea rdx, str.fcntl__d__F_GETFL_
mov rcx, rbx
call fcn.180062b10
mov eax, 0xffffffff
add rsp, 0x20
pop rbx
ret
xor eax, eax
add rsp, 0x20
pop rbx
ret
Function at 0x1800503a0
Capabilities:
Resolve dns

Disassembly:
mov r11, rsp
mov qword [r11 + 0x20], rbx
push rdi
sub rsp, 0x50
xor eax, eax
lea r9, [r11 + 0x18]
xorps xmm0, xmm0
mov qword [r11 + 0x18], rax
movdqu xmmword [rsp + 0x28], xmm0
mov qword [r11 + 0x10], rax
lea r8, [r11 - 0x38]
xorps xmm1, xmm1
mov qword [r11 + 8], rax
movdqu xmmword [rsp + 0x38], xmm1
lea rdx, [0x180260ffc]
mov qword [r11 - 0x10], rax
lea rcx, str.1.2.3.4
mov qword [r11 - 0x38], 0xc
call qword [sym.imp.WS2_32.dll_getaddrinfo]
lea r9, [rsp + 0x60]
xor edx, edx
lea r8, [rsp + 0x20]
mov ebx, eax
lea rcx, str.1.2.3.4
call qword [sym.imp.WS2_32.dll_getaddrinfo]
mov edi, 1
lea r9, [rsp + 0x68]
lea r8, [rsp + 0x20]
mov dword [rsp + 0x28], edi
lea rdx, [0x180260ffc]
lea rcx, str.1.2.3.4
call qword [sym.imp.WS2_32.dll_getaddrinfo]
test eax, eax
jne 0x18005044b
mov eax, dword [0x18032f57c]
test ebx, ebx
cmovne eax, edi
mov dword [0x18032f57c], eax
mov rdx, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x60]
mov rax, rdx
test rdx, rdx
je 0x18005048f
nop dword [rax]
cmp dword [rax + 0xc], 0
jne 0x180050471
mov rax, qword [rax + 0x28]
test rax, rax
jne 0x180050460
jmp 0x18005048f
mov rax, rcx
test rcx, rcx
je 0x18005048f
nop dword [rax]
cmp dword [rax + 0xc], 0
jne 0x180050495
mov rax, qword [rax + 0x28]
test rax, rax
jne 0x180050480
mov dword [0x18032f580], edi
mov rax, qword [rsp + 0x70]
test rax, rax
je 0x1800504b2
mov rcx, rax
call qword [sym.imp.WS2_32.dll_freeaddrinfo]
mov rdx, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x60]
test rdx, rdx
je 0x1800504c5
mov rcx, rdx
call qword [sym.imp.WS2_32.dll_freeaddrinfo]
mov rcx, qword [rsp + 0x60]
test rcx, rcx
je 0x1800504d0
call qword [sym.imp.WS2_32.dll_freeaddrinfo]
mov rbx, qword [rsp + 0x78]
mov dword [0x18032f584], edi
add rsp, 0x50
pop rdi
ret
Function at 0x180050770
Capabilities:
Encode data using xor
Hash data using murmur3

Disassembly:
push rdi
push r14
sub rsp, 0x28
mov r8d, dword [0x180327fc8]
mov rdi, rcx
movsxd r14, dword [rcx + 0x14]
lea eax, [r8 - 1]
cmp r14d, eax
je 0x18005095a
cmp dword [rcx + 0x10], edx
ja 0x18005095a
movsd xmm1, qword [0x1802612d8]
lea rcx, [0x180327f60]
mov qword [rsp + 0x40], rbx
lea rcx, [rcx + r14*4]
mov qword [rsp + 0x48], rbp
mov qword [rsp + 0x50], rsi
mov qword [rsp + 0x20], r15
mov esi, dword [rcx + 4]
lea rcx, [rcx + 4]
xorps xmm0, xmm0
inc r14d
cvtsi2sd xmm0, rsi
mulsd xmm0, xmm1
cvttsd2si r15, xmm0
cmp r15d, edx
ja 0x1800507e8
cmp r14d, r8d
jl 0x1800507c3
mov rbp, rsi
shl rbp, 3
mov rcx, rbp
call fcn.18022c454
mov rbx, rax
test rax, rax
je 0x18005088e
mov r8, rbp
xor edx, edx
mov rcx, rax
call fcn.180229410
xor r10d, r10d
cmp dword [rdi + 8], r10d
jbe 0x180050878
nop dword [rax]
mov rax, qword [rdi]
mov r9, qword [rax + r10*8]
test r9, r9
je 0x18005086f
nop dword [rax]
mov ecx, dword [r9 + 8]
mov r8, qword [r9]
shr ecx, 0x10
xor ecx, dword [r9 + 8]
imul eax, ecx, 0x85ebca6b
mov ecx, eax
shr ecx, 0xd
xor ecx, eax
imul edx, ecx, 0xc2b2ae35
mov eax, edx
shr eax, 0x10
xor eax, edx
xor edx, edx
div esi
mov rax, qword [rbx + rdx*8]
mov qword [r9], rax
mov qword [rbx + rdx*8], r9
mov r9, r8
test r8, r8
jne 0x180050830
inc r10d
cmp r10d, dword [rdi + 8]
jb 0x180050820
mov rcx, qword [rdi]
test rcx, rcx
je 0x180050945
call fcn.18022c440
jmp 0x180050945
mov rcx, qword [rdi]
mov rdx, rbp
call fcn.180237838
mov rbx, rax
test rax, rax
jne 0x1800508c0
lea eax, [rbx - 1]
mov rsi, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x48]
mov rbx, qword [rsp + 0x40]
mov r15, qword [rsp + 0x20]
add rsp, 0x28
pop r14
pop rdi
ret
mov ecx, dword [rdi + 8]
mov r8d, esi
sub r8d, ecx
xor edx, edx
shl r8, 3
lea rcx, [rax + rcx*8]
call fcn.180229410
xor r10d, r10d
cmp dword [rdi + 8], r10d
jbe 0x180050945
mov r8, qword [rbx + r10*8]
lea r9, [rbx + r10*8]
test r8, r8
je 0x18005093c
nop
mov ecx, dword [r8 + 8]
shr ecx, 0x10
xor ecx, dword [r8 + 8]
imul eax, ecx, 0x85ebca6b
mov ecx, eax
shr ecx, 0xd
xor ecx, eax
imul edx, ecx, 0xc2b2ae35
mov eax, edx
shr eax, 0x10
xor eax, edx
xor edx, edx
div esi
cmp edx, r10d
jne 0x180050923
mov r9, r8
jmp 0x180050934
mov rax, qword [r8]
mov qword [r9], rax
mov rax, qword [rbx + rdx*8]
mov qword [r8], rax
mov qword [rbx + rdx*8], r8
mov r8, qword [r9]
test r8, r8
jne 0x1800508f0
inc r10d
cmp r10d, dword [rdi + 8]
jb 0x1800508e1
mov qword [rdi], rbx
xor eax, eax
mov dword [rdi + 8], esi
mov dword [rdi + 0x14], r14d
mov dword [rdi + 0x10], r15d
jmp 0x1800508a4
xor eax, eax
add rsp, 0x28
pop r14
pop rdi
ret
Function at 0x18005aa40
Capabilities:
Send data
Send data on socket

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
mov rax, qword [rcx + 0xc8]
xor edi, edi
mov rbx, rcx
cmp qword [rax + 0x118], rdi
je 0x18005aa69
call fcn.180075ac0
or dword [rbx + 0xbc], 2
mov rsi, qword [rbx + 0x28]
test rsi, rsi
je 0x18005aba5
cmp byte [rsi + 0x1a1], dil
jne 0x18005aba5
mov rax, qword [rbx + 0xc8]
cmp qword [rax + 0x118], rdi
je 0x18005aa9f
call fcn.180075ac0
cmp dword [rsi + 0x1b0], 1
jne 0x18005aacd
mov rax, qword [rbx + 0xc8]
cmp dword [rax + 0x120], edi
je 0x18005aacd
lea rcx, [rsi + 0x98]
xor edx, edx
call fcn.180052650
test eax, eax
js 0x18005ab8f
mov eax, dword [rsi + 0x88]
lea rdx, [rsi + 8]
mov r8d, dword [rbx + 0xc]
xor r9d, r9d
mov rcx, qword [rsi]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rdx
mov rdx, qword [rbx]
call qword [sym.imp.WS2_32.dll_sendto]
test eax, eax
jns 0x18005ab8a
mov rcx, qword [rsi]
call fcn.18004c750
cmp eax, 0x2733
je 0x18005ab8f
cmp eax, 0x2714
je 0x18005ab8f
mov ecx, eax
call fcn.18004c7d0
mov rcx, qword [rbx + 0x28]
mov rdx, rax
call fcn.18005ccf0
mov edi, 1
mov r9, qword [rbx + 0x28]
lea rdx, str.Setting_timeout_for_request__p__sent_to_nameserver__p
mov r8, rbx
xor ecx, ecx
call fcn.18005c8d0
mov rdx, qword [rbx + 0xc8]
lea rcx, [rbx + 0x40]
add rdx, 0x38
call fcn.180052650
test eax, eax
jns 0x18005ab6e
mov r8, rbx
lea rdx, str.Error_from_libevent_when_adding_timer_for_request__p
mov ecx, 2
call fcn.18005c8d0
inc dword [rbx + 0x14]
mov eax, edi
and dword [rbx + 0xbc], 0xfffffffd
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
cmp eax, dword [rbx + 0xc]
je 0x18005ab2d
mov rax, qword [rbx + 0x28]
mov dl, 1
mov byte [rax + 0x1a1], 1
mov rcx, qword [rbx + 0x28]
call fcn.18005ee10
mov rbx, qword [rsp + 0x40]
mov eax, 1
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret

Function at 0x18005b560
Capabilities:
Send data
Send data on socket

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rbx, qword [rcx + 0xc8]
mov rdi, rcx
cmp qword [rbx + 0x118], 0
je 0x18005b583
call fcn.180075ac0
cmp qword [rdi + 0x28], 0
je 0x18005b5c6
movzx eax, word [rdi + 0xb8]
cdq
idiv dword [rbx + 0x18]
mov rax, qword [rbx]
movsxd rcx, edx
lea rdx, [rax + rcx*8]
mov rcx, rdi
call fcn.18005a810
inc dword [rbx + 0x2c]
mov rcx, rdi
mov rax, qword [rdi + 0x28]
inc dword [rax + 0x1b0]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
jmp fcn.18005aa40
lea rdx, [rbx + 8]
mov rcx, rdi
call fcn.18005a810
inc dword [rbx + 0x30]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x18005e3e0
Capabilities:
Receive data
Receive data on socket

Disassembly:
push rbx
push rdi
sub rsp, 0x738
mov rax, qword [0x18032d860]
xor rax, rsp
mov qword [rsp + 0x720], rax
mov rax, qword [rcx + 0x1a8]
mov rbx, rcx
cmp qword [rax + 0x118], 0
je 0x18005e415
call fcn.180075ac0
mov rcx, qword [rbx]
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
lea rdx, [rsp + 0x140]
lea rax, [rsp + 0x40]
mov qword [rsp + 0x760], rsi
xor r9d, r9d
mov qword [rsp + 0x20], rax
mov r8d, 0x5dc
mov qword [rsp + 0x730], r14
mov dword [rsp + 0x30], 0x80
call qword [sym.imp.WS2_32.dll_recvfrom]
mov edi, eax
test eax, eax
js 0x18005e4ed
xor esi, esi
test edi, edi
je 0x18005e553
lea rdx, [rbx + 8]
xor r8d, r8d
lea rcx, [rsp + 0x40]
call fcn.18004d770
test eax, eax
jne 0x18005e522
mov rcx, qword [rbx + 0x1a8]
cmp dword [rcx + 0x128], esi
jne 0x18005e49d
mov dword [rbx + 0x90], esi
mov r8d, edi
lea rdx, [rsp + 0x140]
call fcn.18005d8a0
mov rcx, qword [rbx]
lea rax, [rsp + 0x30]
mov qword [rsp + 0x28], rax
lea rdx, [rsp + 0x140]
lea rax, [rsp + 0x40]
mov dword [rsp + 0x30], 0x80
xor r9d, r9d
mov qword [rsp + 0x20], rax
mov r8d, 0x5dc
call qword [sym.imp.WS2_32.dll_recvfrom]
mov edi, eax
test eax, eax
jns 0x18005e467
mov rcx, qword [rbx]
call fcn.18004c750
cmp eax, 0x2733
je 0x18005e5eb
cmp eax, 0x2714
je 0x18005e5eb
mov ecx, eax
call fcn.18004c7d0
mov rdx, rax
mov rcx, rbx
call fcn.18005ccf0
jmp 0x18005e5eb
mov r8d, 0x80
lea rdx, [rsp + 0xc0]
lea rcx, [rsp + 0x40]
call fcn.18004f320
mov r8, rax
lea rdx, str.Address_mismatch_on_received_DNS_packet.__Apparent_source_was__s
mov ecx, 2
call fcn.18005c8d0
jmp 0x18005e5eb
cmp dword [rbx + 0x1b0], esi
jne 0x18005e5eb
lea rcx, [rbx + 0x98]
mov qword [rsp + 0x758], rbp
call fcn.180052740
mov rax, qword [rbx + 0x1a8]
xor r8d, r8d
mov edx, 0x84000002
mov dword [rax + 0x120], 1
movzx ecx, word [rbx + 8]
mov rdi, qword [rbx + 0x1a8]
call fcn.18004f7d0
mov rsi, rax
test rax, rax
js 0x18005e5e3
cmp dword [rdi + 0xd8], 0
je 0x18005e615
lea rcx, [rbx + 8]
call fcn.18004f2b0
test eax, eax
jne 0x18005e615
mov r8d, dword [rdi + 0xd8]
lea rdx, [rdi + 0x58]
mov rcx, rsi
call qword [sym.imp.WS2_32.dll_bind]
test eax, eax
jns 0x18005e615
lea rdx, str.Couldnt_bind_to_outgoing_address
mov ecx, 2
call fcn.18005c8d0
mov rbp, qword [rsp + 0x758]
mov r14, qword [rsp + 0x730]
mov rsi, qword [rsp + 0x760]
mov rcx, qword [rsp + 0x720]
xor rcx, rsp
call fcn.180227e50
add rsp, 0x738
pop rdi
pop rbx
ret
lea rcx, [rbx + 0x98]
call fcn.180050f70
mov rcx, qword [rbx]
test rcx, rcx
js 0x18005e62e
call sub.WS2_32.dll_closesocket
mov qword [rbx], rsi
lea rax, [0x18005a910]
mov rdx, qword [rdi + 0x20]
lea rcx, [rbx + 0x98]
mov r9d, reloc.WS2_32.dll_select
mov qword [rsp + 0x28], rbx
mov r8, rsi
mov qword [rsp + 0x20], rax
call fcn.1800522e0
jmp 0x18005e5e3
Function at 0x180060940
Capabilities:
Get hostname

Disassembly:
push rbx
sub rsp, 0x130
mov rax, qword [0x18032d860]
xor rax, rsp
mov qword [rsp + 0x120], rax
cmp qword [rcx + 0x118], 0
mov rbx, rcx
je 0x18006096d
call fcn.180075ac0
mov rcx, rbx
call fcn.180060750
mov edx, 0x100
lea rcx, [rsp + 0x20]
call qword [sym.imp.WS2_32.dll_gethostname]
test eax, eax
jne 0x1800609a6
lea edx, [rax + 0x2e]
lea rcx, [rsp + 0x20]
call fcn.180229898
test rax, rax
je 0x1800609a6
mov rdx, rax
mov rcx, rbx
call fcn.1800607f0
mov rcx, qword [rsp + 0x120]
xor rcx, rsp
call fcn.180227e50
add rsp, 0x130
pop rbx
ret

Function at 0x180061760
Capabilities:
Query or enumerate registry value

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push r14
sub rsp, 0x30
xor ebx, ebx
mov rbp, r8
mov r14, rdx
mov rsi, rcx
mov dword [rsp + 0x50], ebx
mov dword [rsp + 0x68], ebx
cmp qword [rcx + 0x118], rbx
je 0x18006178e
call fcn.180075ac0
lea rax, [rsp + 0x50]
mov qword [rsp + 0x58], rdi
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x68]
xor r8d, r8d
mov qword [rsp + 0x20], rbx
mov rdx, rbp
mov rcx, r14
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
cmp eax, 0xea
jne 0x180061815
mov ecx, dword [rsp + 0x50]
call fcn.18022c454
mov rdi, rax
test rax, rax
je 0x180061815
lea rax, [rsp + 0x50]
xor r8d, r8d
mov qword [rsp + 0x28], rax
lea r9, [rsp + 0x68]
mov rdx, rbp
mov qword [rsp + 0x20], rdi
mov rcx, r14
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x180061809
cmp dword [rsp + 0x50], 1
jbe 0x180061809
mov rdx, rdi
mov rcx, rsi
call fcn.180061240
mov ebx, eax
mov rcx, rdi
call fcn.18022c440
mov eax, ebx
jmp 0x18006181a
mov eax, 0xffffffff
mov rdi, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x60]
add rsp, 0x30
pop r14
pop rsi
pop rbp
ret
Function at 0x180067620
Capabilities:
Get system information on windows
Read file via mapping

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push r12
push r14
push r15
sub rsp, 0x60
xor r12d, r12d
mov rbx, rdx
mov rdx, qword [rcx + 0x30]
mov rbp, r9
mov r14, r8
mov rsi, rcx
mov r15d, r12d
test rdx, rdx
je 0x18006765b
xor ecx, ecx
call fcn.180075b10
mov rdx, qword [rbx]
test rdx, rdx
je 0x18006766a
xor ecx, ecx
call fcn.180075b10
test byte [rsi + 0x3c], 1
je 0x180067702
mov r15d, 1
mov rdx, qword [rbx]
test rdx, rdx
je 0x180067689
xor ecx, ecx
call fcn.180075b30
test byte [rsi + 0x38], 4
mov qword [rsp + 0x80], rdi
jne 0x1800677b9
test rbp, rbp
jns 0x1800676b0
mov rbp, qword [rbx + 0x40]
cmp r14, rbp
jg 0x1800677b9
sub rbp, r14
lea rax, [r14 + rbp]
cmp rax, qword [rbx + 0x40]
jg 0x1800677b9
mov ecx, reloc.WS2_32.dll_recv
call fcn.18006a700
mov rdi, rax
test rax, rax
je 0x1800677b9
mov eax, dword [rax + 0x20]
or eax, 9
mov dword [rdi + 0x20], eax
test r15d, r15d
je 0x180067745
test byte [rbx + 0x10], 1
je 0x180067745
or eax, 2
mov dword [rdi + 0x20], eax
mov rcx, qword [rbx + 0x30]
add rcx, r14
mov qword [rdi + 0x10], rcx
lea r14, [rcx + rbp]
jmp 0x180067811
cmp qword [rbx + 0x28], r12
jne 0x18006767a
mov rcx, rbx
call fcn.18006a570
test eax, eax
jns 0x18006767a
mov rdx, qword [rbx]
test rdx, rdx
je 0x18006772b
xor ecx, ecx
call fcn.180075b30
mov rdx, qword [rsi + 0x30]
test rdx, rdx
je 0x18006773b
xor ecx, ecx
call fcn.180075b30
mov eax, 0xffffffff
jmp 0x1800677de
test byte [rbx + 0x10], 2
je 0x180067803
mov r15, r12
add r14, qword [rbx + 0x38]
je 0x18006778a
xorps xmm0, xmm0
lea rcx, [rsp + 0x30]
movups xmmword [rsp + 0x30], xmm0
movups xmmword [rsp + 0x40], xmm0
movups xmmword [rsp + 0x50], xmm0
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov ecx, dword [rsp + 0x58]
xor edx, edx
mov rax, r14
mov r12, r14
div rcx
mov r15, rdx
sub r12, rdx
mov rcx, qword [rbx + 0x20]
lea r14, [r15 + rbp]
mov r8, r12
mov qword [rsp + 0x20], r14
shr r8, 0x20
mov r9d, r12d
mov edx, 4
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
test rax, rax
jne 0x1800677f9
mov rcx, rdi
call fcn.18022c440
mov rdx, qword [rsi + 0x30]
test rdx, rdx
je 0x1800677c9
xor ecx, ecx
call fcn.180075b30
mov rcx, rbx
call fcn.180067560
mov eax, 0xffffffff
mov rdi, qword [rsp + 0x80]
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x28]
mov rbp, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop r12
ret
mov qword [rdi + 0x28], rax
mov qword [rdi + 0x10], r15
jmp 0x180067811
mov rcx, qword [rbx + 0x28]
add rcx, r14
mov r14, rbp
mov qword [rdi + 0x28], rcx
mov qword [rdi + 8], r14
mov qword [rdi + 0x18], rbp
mov rdx, qword [rbx]
test rdx, rdx
je 0x180067828
xor ecx, ecx
call fcn.180075b10
inc dword [rbx + 8]
mov rdx, qword [rbx]
test rdx, rdx
je 0x18006783a
xor ecx, ecx
call fcn.180075b30
mov qword [rdi + 0x30], rbx
mov rdx, rdi
add qword [rsi + 0x20], rbp
mov rcx, rsi
call fcn.18006a980
mov rcx, rsi
call fcn.18006a040
mov rdx, qword [rsi + 0x30]
test rdx, rdx
je 0x180067865
xor ecx, ecx
call fcn.180075b30
xor eax, eax
jmp 0x1800677d6
Function at 0x180067dd0
Capabilities:
Send data
Send data on socket

Disassembly:
mov r11, rsp
push rsi
sub rsp, 0x180
mov rax, qword [0x18032d860]
xor rax, rsp
mov qword [rsp + 0x150], rax
mov rax, qword [rcx + 0x30]
mov esi, 0xffffffff
mov qword [r11 - 0x18], rdi
mov rdi, r8
mov qword [r11 - 0x20], r14
mov r14, rcx
mov qword [r11 - 0x28], r15
mov r15, rdx
test rax, rax
je 0x180067e1e
mov rdx, rax
xor ecx, ecx
call fcn.180075b10
mov rax, qword [r14 + 0x30]
test byte [r14 + 0x38], 2
jne 0x180067f15
test rdi, rdi
js 0x180067e34
cmp rdi, qword [r14 + 0x18]
jbe 0x180067e38
mov rdi, qword [r14 + 0x18]
test rdi, rdi
jle 0x180067f15
mov qword [rsp + 0x1a0], rbx
mov rbx, qword [r14]
mov qword [rsp + 0x178], rbp
xor ebp, ebp
test rax, rax
je 0x180067e60
call fcn.180075ac0
test rbx, rbx
je 0x180067f03
xor edx, edx
lea rcx, [rsp + 0x50]
cmp rdx, 0x10
jge 0x180067eb5
test rdi, rdi
je 0x180067eb5
mov rax, qword [rbx + 0x28]
add rax, qword [rbx + 0x10]
mov qword [rcx + 8], rax
mov rax, qword [rbx + 0x18]
cmp rdi, rax
jb 0x180067ea9
mov dword [rcx], eax
inc ebp
sub rdi, qword [rbx + 0x18]
inc rdx
mov rbx, qword [rbx]
add rcx, 0x10
test rbx, rbx
jne 0x180067e70
jmp 0x180067eb5
movsxd rax, ebp
add rax, rax
inc ebp
mov dword [rsp + rax*8 + 0x50], edi
test ebp, ebp
je 0x180067f03
mov qword [rsp + 0x30], 0
lea r9, [rsp + 0x40]
mov qword [rsp + 0x28], 0
lea rdx, [rsp + 0x50]
mov r8d, ebp
mov dword [rsp + 0x20], 0
mov rcx, r15
call qword [sym.imp.WS2_32.dll_WSASend]
test eax, eax
jne 0x180067f05
movsxd rsi, dword [rsp + 0x40]
test esi, esi
jle 0x180067f05
mov rdx, rsi
mov rcx, r14
call fcn.180067af0
jmp 0x180067f05
xor esi, esi
mov rbx, qword [rsp + 0x1a0]
mov rbp, qword [rsp + 0x178]
mov rdx, qword [r14 + 0x30]
mov r15, qword [rsp + 0x160]
mov r14, qword [rsp + 0x168]
mov rdi, qword [rsp + 0x170]
test rdx, rdx
je 0x180067f3d
xor ecx, ecx
call fcn.180075b30
mov eax, esi
mov rcx, qword [rsp + 0x150]
xor rcx, rsp
call fcn.180227e50
add rsp, 0x180
pop rsi
ret