joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1413c6058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.1413c61df
push r10
mov r10, rsp
push r10
mov rsi, qword [r10 + 0x10]
mov rdi, qword [r10 + 0x20]
cld
mov dl, 0x80
mov al, byte [rsi]
inc rsi
mov byte [rdi], al
inc rdi
mov ebx, 2
add dl, dl
jne 0x1413c6089
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1413c606f
add dl, dl
jne 0x1413c6096
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1413c60f6
xor eax, eax
add dl, dl
jne 0x1413c60a5
mov dl, byte [rsi]
inc rsi
adc dl, dl
jae 0x1413c61ad
add dl, dl
jne 0x1413c60b6
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1413c60c3
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1413c60d0
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1413c60dd
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
je 0x1413c60ea
push rdi
mov eax, eax
sub rdi, rax
mov al, byte [rdi]
pop rdi
mov byte [rdi], al
inc rdi
mov ebx, 2
jmp 0x1413c607e
mov eax, 1
add dl, dl
jne 0x1413c6106
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1413c6113
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1413c60fb
sub eax, ebx
mov ebx, 1
jne 0x1413c614c
mov ecx, 1
add dl, dl
jne 0x1413c612e
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x1413c613b
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1413c6123
push rsi
mov rsi, rdi
sub rsi, rbp
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x1413c607e
dec eax
shl eax, 8
mov al, byte [rsi]
inc rsi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x1413c6168
mov dl, byte [rsi]
inc rsi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x1413c6175
mov dl, byte [rsi]
inc rsi
adc dl, dl
jb 0x1413c615d
cmp eax, 0x7d00
jae 0x1413c619b
cmp eax, 0x500
jb 0x1413c6196
inc ecx
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x1413c607e
cmp eax, 0x7f
ja 0x1413c619e
add ecx, 2
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
jmp 0x1413c607e
mov al, byte [rsi]
inc rsi
xor ecx, ecx
shr al, 1
je 0x1413c61d2
adc ecx, 2
mov ebp, eax
push rsi
mov rsi, rdi
sub rsi, rax
rep movsb byte [rdi], byte [rsi]
pop rsi
mov ebx, 1
jmp 0x1413c607e
pop r10
sub rdi, qword [r10 + 0x20]
mov eax, edi
pop r10
ret 0x20
Function at 0x1800262b0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
movabs rax, 0xcbf29ce484222325
mov r9d, 0
sub r8, rdx
je 0x1800262e4
movabs r10, 0x100000001b3
nop
movzx ecx, byte [r9 + rdx]
inc r9
xor rax, rcx
imul rax, r10
cmp r9, r8
jb 0x1800262d0
mov rcx, rax
shr rcx, 0x20
xor eax, ecx
ret
Function at 0x180031290
Capabilities:
Enumerate gui resources

Disassembly:
push rdi
sub rsp, 0x160
mov qword [rsp + 0x78], 0xfffffffffffffffe
mov qword [rsp + 0x170], rbx
mov rax, qword [0x180001b10]
xor rax, rsp
mov qword [rsp + 0x150], rax
call fcn.1800306a0
test al, al
je 0x1800314f4
movsxd rdx, dword [reloc.WS2_32.dll_ioctlsocket]
cmp edx, 1
je 0x18003135c
test edx, edx
jne 0x1800312e9
call fcn.1800813c0
test al, al
sete al
jmp 0x180031331
cmp edx, 0xa
jge 0x18003130f
imul rcx, rdx, 0x88
lea rax, [0x1800f84c0]
movzx eax, byte [rcx + rax]
mov byte [rsp + 0x21], al
test al, al
je 0x18003130f
call fcn.180081410
jmp 0x180031331
cmp edx, 2
jne 0x180031353
lea rcx, [rsp + 0x90]
call fcn.180083a20
mov qword [rsp + 0x70], rax
cmp dword [rax + 0xc], 7
je 0x18003133d
call fcn.1800813c0
mov byte [rsp + 0x20], al
test al, al
je 0x1800314f4
cmp dword [reloc.WS2_32.dll_ioctlsocket], 0
jne 0x18003135c
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x18003135c
cmp edx, 4
jne 0x1800314f4
xor eax, eax
mov qword [rsp + 0xa0], rax
mov qword [rsp + 0xa8], rax
call fcn.180031530
mov qword [rsp + 0x80], rax
xor ebx, ebx
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x48], rbx
mov qword [rsp + 0x48], 7
mov qword [rsp + 0x40], rbx
mov word [rsp + 0x30], bx
or rdi, 0xffffffffffffffff
cmp word [rax], bx
jne 0x1800313a8
mov r8d, ebx
jmp 0x1800313ba
mov r8, rdi
nop dword [rax + rax]
inc r8
cmp word [rax + r8*2], bx
jne 0x1800313b0
mov rdx, rax
lea rcx, [rsp + 0x30]
call fcn.1800329a0
nop
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0xa0]
call fcn.1800842b0
nop
cmp qword [rsp + 0x48], 8
jb 0x1800313ed
mov rcx, qword [rsp + 0x30]
call fcn.1800958e0
mov qword [rsp + 0x48], 7
mov qword [rsp + 0x40], rbx
mov word [rsp + 0x30], bx
lea rcx, [rsp + 0xb0]
call fcn.180084010
nop
call fcn.18004d500
mov dl, 1
mov ecx, 0x2718
call fcn.180032ed0
cmp dword [reloc.WS2_32.dll_ioctlsocket], 0
jne 0x180031446
xor edx, edx
lea rcx, [0x180078840]
call qword [sym.imp.USER32.dll_EnumWindows]
xor edx, edx
lea rcx, [0x180078840]
call qword [sym.imp.USER32.dll_EnumWindows]
mov rcx, qword [rsp + 0xa0]
test rcx, rcx
jne 0x18003145d
mov rcx, rbx
mov qword [rsp + 0x50], rbx
jmp 0x180031465
mov rcx, qword [rcx]
mov qword [rsp + 0x50], rcx
or edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
call fcn.18004e600
nop
cmp qword [rsp + 0xc8], 8
jb 0x18003148c
mov rcx, qword [rsp + 0xb0]
call fcn.1800958e0
mov qword [rsp + 0xc8], 7
mov qword [rsp + 0xc0], rbx
mov word [rsp + 0xb0], bx
lea rax, [rsp + 0xa0]
mov qword [rsp + 0x68], rax
mov rcx, qword [rsp + 0xa8]
test rcx, rcx
je 0x1800314f4
mov qword [rsp + 0x28], rcx
mov eax, edi
lock xadd dword [rcx + 8], eax
dec eax
jne 0x1800314f4
mov rbx, qword [rsp + 0x28]
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax]
lock xadd dword [rbx + 0xc], edi
dec edi
jne 0x1800314f4
mov rcx, qword [rsp + 0x28]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_htonl]
nop
call fcn.180081450
cmp qword [0x1800f7f88], 0
je 0x180031508
call fcn.1800310b0
mov rcx, qword [rsp + 0x150]
xor rcx, rsp
call fcn.1800b8aa0
mov rbx, qword [rsp + 0x170]
add rsp, 0x160
pop rdi
ret
Function at 0x18004a760
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbp
lea rbp, [rsp - 0x30]
sub rsp, 0x130
mov rax, qword [0x180001b10]
xor rax, rsp
mov qword [rbp + 0x20], rax
xor eax, eax
mov r9d, 0x444e
lea r8, [0x1800fa250]
lea rcx, [rsp + 0x20]
lea edx, [rax + 0xb]
mov dword [rsp + 0x20], 0x4426442d
mov dword [rsp + 0x24], 0x4421443c
mov dword [rsp + 0x28], 0x442b4423
mov dword [rsp + 0x2c], 0x442a4460
mov dword [rsp + 0x30], 0x44224422
mov qword [rsp + 0x34], r9
mov qword [rsp + 0x3c], rax
mov qword [rsp + 0x44], rax
mov qword [rsp + 0x4c], rax
mov qword [rsp + 0x54], rax
mov qword [rsp + 0x5c], rax
mov qword [rsp + 0x64], rax
mov qword [rsp + 0x6c], rax
mov qword [rsp + 0x74], rax
mov qword [rsp + 0x7c], rax
mov qword [rbp - 0x7c], rax
mov qword [rbp - 0x74], rax
mov qword [rbp - 0x6c], rax
mov qword [rbp - 0x64], rax
mov qword [rbp - 0x5c], rax
mov qword [rbp - 0x54], rax
mov qword [rbp - 0x4c], rax
mov qword [rbp - 0x44], rax
mov qword [rbp - 0x3c], rax
mov qword [rbp - 0x34], rax
mov qword [rbp - 0x2c], rax
mov qword [rbp - 0x24], rax
mov qword [rbp - 0x1c], rax
mov qword [rbp - 0x14], rax
mov qword [rbp - 0xc], rax
mov qword [rbp - 4], rax
mov qword [rbp + 4], rax
mov qword [rbp + 0xc], rax
mov qword [rbp + 0x14], rax
mov dword [rbp + 0x1c], eax
call fcn.18005f120
mov rcx, qword [rbp + 0x20]
xor rcx, rsp
call fcn.1800b8aa0
add rsp, 0x130
pop rbp
ret

Function at 0x18004b7c0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbp
lea rbp, [rsp - 0x30]
sub rsp, 0x130
mov rax, qword [0x180001b10]
xor rax, rsp
mov qword [rbp + 0x20], rax
xor eax, eax
mov r9d, 0x314c
lea r8, [0x1800fa308]
lea rcx, [rsp + 0x20]
lea edx, [rax + 0xb]
mov dword [rsp + 0x20], 0x3124312f
mov dword [rsp + 0x24], 0x3123313e
mov dword [rsp + 0x28], 0x31293121
mov dword [rsp + 0x2c], 0x31283162
mov dword [rsp + 0x30], 0x31203120
mov qword [rsp + 0x34], r9
mov qword [rsp + 0x3c], rax
mov qword [rsp + 0x44], rax
mov qword [rsp + 0x4c], rax
mov qword [rsp + 0x54], rax
mov qword [rsp + 0x5c], rax
mov qword [rsp + 0x64], rax
mov qword [rsp + 0x6c], rax
mov qword [rsp + 0x74], rax
mov qword [rsp + 0x7c], rax
mov qword [rbp - 0x7c], rax
mov qword [rbp - 0x74], rax
mov qword [rbp - 0x6c], rax
mov qword [rbp - 0x64], rax
mov qword [rbp - 0x5c], rax
mov qword [rbp - 0x54], rax
mov qword [rbp - 0x4c], rax
mov qword [rbp - 0x44], rax
mov qword [rbp - 0x3c], rax
mov qword [rbp - 0x34], rax
mov qword [rbp - 0x2c], rax
mov qword [rbp - 0x24], rax
mov qword [rbp - 0x1c], rax
mov qword [rbp - 0x14], rax
mov qword [rbp - 0xc], rax
mov qword [rbp - 4], rax
mov qword [rbp + 4], rax
mov qword [rbp + 0xc], rax
mov qword [rbp + 0x14], rax
mov dword [rbp + 0x1c], eax
call fcn.18005f120
mov rcx, qword [rbp + 0x20]
xor rcx, rsp
call fcn.1800b8aa0
add rsp, 0x130
pop rbp
ret
Function at 0x18004d310
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbp
lea rbp, [rsp - 0x30]
sub rsp, 0x130
mov rax, qword [0x180001b10]
xor rax, rsp
mov qword [rbp + 0x20], rax
xor eax, eax
lea r8, [0x1800fa538]
lea rcx, [rsp + 0x20]
lea edx, [rax + 0xa]
mov r9d, 0x5a47
mov dword [rsp + 0x20], 0x5a345a29
mov dword [rsp + 0x24], 0x5a355a37
mov dword [rsp + 0x28], 0x5a695a73
mov dword [rsp + 0x2c], 0x5a2b5a23
mov qword [rsp + 0x30], 0x5a475a2b
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], rax
mov qword [rsp + 0x70], rax
mov qword [rsp + 0x78], rax
mov qword [rbp - 0x80], rax
mov qword [rbp - 0x78], rax
mov qword [rbp - 0x70], rax
mov qword [rbp - 0x68], rax
mov qword [rbp - 0x60], rax
mov qword [rbp - 0x58], rax
mov qword [rbp - 0x50], rax
mov qword [rbp - 0x48], rax
mov qword [rbp - 0x40], rax
mov qword [rbp - 0x38], rax
mov qword [rbp - 0x30], rax
mov qword [rbp - 0x28], rax
mov qword [rbp - 0x20], rax
mov qword [rbp - 0x18], rax
mov qword [rbp - 0x10], rax
mov qword [rbp - 8], rax
mov qword [rbp], rax
mov qword [rbp + 8], rax
mov qword [rbp + 0x10], rax
mov qword [rbp + 0x18], rax
call fcn.18005f120
mov rcx, qword [rbp + 0x20]
xor rcx, rsp
call fcn.1800b8aa0
add rsp, 0x130
pop rbp
ret
Function at 0x18005f700
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rbp
lea rbp, [rsp - 0x30]
sub rsp, 0x130
mov rax, qword [0x180001b10]
xor rax, rsp
mov qword [rbp + 0x20], rax
xor eax, eax
lea r8, [0x1800fa940]
lea rcx, [rsp + 0x20]
lea edx, [rax + 0xe]
mov r9d, 0x6a52
mov dword [rsp + 0x20], 0x6a376a21
mov dword [rsp + 0x24], 0x6a266a26
mov dword [rsp + 0x28], 0x6a3c6a3b
mov dword [rsp + 0x2c], 0x6a216a35
mov dword [rsp + 0x30], 0x6a386a7c
mov dword [rsp + 0x34], 0x6a3d6a21
mov qword [rsp + 0x38], 0x6a526a3c
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], rax
mov qword [rsp + 0x70], rax
mov qword [rsp + 0x78], rax
mov qword [rbp - 0x80], rax
mov qword [rbp - 0x78], rax
mov qword [rbp - 0x70], rax
mov qword [rbp - 0x68], rax
mov qword [rbp - 0x60], rax
mov qword [rbp - 0x58], rax
mov qword [rbp - 0x50], rax
mov qword [rbp - 0x48], rax
mov qword [rbp - 0x40], rax
mov qword [rbp - 0x38], rax
mov qword [rbp - 0x30], rax
mov qword [rbp - 0x28], rax
mov qword [rbp - 0x20], rax
mov qword [rbp - 0x18], rax
mov qword [rbp - 0x10], rax
mov qword [rbp - 8], rax
mov qword [rbp], rax
mov qword [rbp + 8], rax
mov qword [rbp + 0x10], rax
mov qword [rbp + 0x18], rax
call fcn.18005f120
mov rcx, qword [rbp + 0x20]
xor rcx, rsp
call fcn.1800b8aa0
add rsp, 0x130
pop rbp
ret

Function at 0x18006aac0
Capabilities:
Allocate thread local storage

Disassembly:
push rdi
sub rsp, 0x40
mov rax, qword [0x180001b10]
xor rax, rsp
mov qword [rsp + 0x30], rax
call qword [sym.imp.KERNEL32.dll_TlsAlloc]
mov edi, eax
cmp eax, 0xffffffff
jne 0x18006ab12
xor eax, eax
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x28], rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov dword [rsp + 0x20], eax
call fcn.1800db290
test ebx, ebx
mov rbx, qword [rsp + 0x50]
mov qword [rsp + 0x28], rax
jne 0x18006ab27
mov eax, edi
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.1800b8aa0
add rsp, 0x40
pop rdi
ret
lea rdx, [0x180113558]
lea rcx, [rsp + 0x20]
call fcn.18006a8d0
int3

Function at 0x18006ae00
Capabilities:
Terminate thread

Disassembly:
push rbx
sub rsp, 0x40
mov rax, qword [0x180001b10]
xor rax, rsp
mov qword [rsp + 0x30], rax
mov rax, qword [rcx + 0x10]
xor r8d, r8d
mov rbx, rcx
mov qword [rsp + 0x20], rax
mov rax, qword [rcx + 8]
lea rdx, [rsp + 0x20]
lea ecx, [r8 + 2]
or r9d, 0xffffffff
mov qword [rsp + 0x28], rax
call qword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
mov rcx, qword [rbx + 0x10]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
lock xadd dword [0x1800f979c], eax
test eax, eax
je 0x18006ae77
mov rcx, qword [rbx + 8]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TerminateThread]
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.1800b8aa0
add rsp, 0x40
pop rbx
ret
mov rdx, qword [rbx + 8]
lea rcx, [fcn.180018f50]
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_QueueUserAPC]
mov rcx, qword [rbx + 8]
or edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rsp + 0x30]
xor rcx, rsp
call fcn.1800b8aa0
add rsp, 0x40
pop rbx
ret
Function at 0x18006aeb0
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
sub rsp, 0x50
mov rax, qword [0x180001b10]
xor rax, rsp
mov qword [rsp + 0x48], rax
xor r9d, r9d
mov rsi, rdx
mov rbp, rcx
lea edx, [r9 + 1]
xor r8d, r8d
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov rdi, rax
mov qword [rsi + 8], rax
test rax, rax
jne 0x18006af25
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8, qword [rsi]
lea edx, [rdi + 1]
mov rcx, rsi
mov ebx, eax
call qword [r8]
xor eax, eax
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x30], ebx
mov qword [rsp + 0x38], rax
call fcn.1800db290
mov qword [rsp + 0x38], rax
test ebx, ebx
jne 0x18006b034
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
lea edx, [r9 + 1]
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [rbp + 0x10], rax
mov qword [rsi + 0x10], rax
cmp qword [rbp + 0x10], 0
jne 0x18006af7e
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8, qword [rsi]
mov edx, 1
mov rcx, rsi
mov ebx, eax
call qword [r8]
xor eax, eax
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x30], ebx
mov qword [rsp + 0x38], rax
call fcn.1800db290
mov qword [rsp + 0x38], rax
test ebx, ebx
jne 0x18006b046
xor ecx, ecx
lea rax, [rsp + 0x40]
lea r8, [0x18006b070]
mov qword [rsp + 0x28], rax
mov r9, rsi
xor edx, edx
mov dword [rsp + 0x20], ecx
mov dword [rsp + 0x40], ecx
call fcn.1800ba820
mov qword [rbp + 8], rax
test rax, rax
jne 0x18006affd
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r8, qword [rsi]
mov edx, 1
mov rcx, rsi
mov ebx, eax
call qword [r8]
test rdi, rdi
je 0x18006afd0
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp + 0x10]
test rcx, rcx
je 0x18006afdf
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x30], ebx
mov qword [rsp + 0x38], rax
call fcn.1800db290
mov qword [rsp + 0x38], rax
test ebx, ebx
jne 0x18006b058
test rdi, rdi
je 0x18006b017
or edx, 0xffffffff
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.1800b8aa0
mov rbx, qword [rsp + 0x80]
add rsp, 0x50
pop rdi
pop rsi
pop rbp
ret
lea rdx, str.thread.entry_event
lea rcx, [rsp + 0x30]
call fcn.18006a8d0
int3
lea rdx, str.thread.exit_event
lea rcx, [rsp + 0x30]
call fcn.18006a8d0
int3
lea rdx, str.thread
lea rcx, [rsp + 0x30]
call fcn.18006a8d0
int3
Function at 0x18006b530
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
mov rax, rsp
push rdi
sub rsp, 0x60
mov qword [rax - 0x38], 0xfffffffffffffffe
mov qword [rax + 0x18], rbx
mov qword [rax + 0x20], rsi
mov rax, qword [0x180001b10]
xor rax, rsp
mov qword [rsp + 0x58], rax
mov rsi, rdx
mov rdi, rcx
xor ebx, ebx
mov eax, ebx
lock xadd dword [rcx + 0x30], eax
test eax, eax
jne 0x18006b58c
call fcn.18006b670
mov dword [rsp + 0x20], ebx
call fcn.1800db290
mov qword [rsp + 0x28], rax
movups xmm0, xmmword [rsp + 0x20]
movups xmmword [rsi], xmm0
xor eax, eax
jmp 0x18006b621
mov qword [rsp + 0x38], rbx
xor eax, eax
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x40], rcx
lea rax, [rsp + 0x38]
mov qword [rsp + 0x48], rax
mov ecx, dword [0x1800faaa8]
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov qword [rsp + 0x50], rax
lea rdx, [rsp + 0x40]
mov ecx, dword [0x1800faaa8]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
nop
mov r8, rsi
mov rcx, rdi
call fcn.18006b800
test rax, rax
je 0x18006b5fd
cmp rbx, 0xffffffffffffffff
je 0x18006b5ed
inc rbx
mov r8, rsi
mov rcx, rdi
call fcn.18006b800
test rax, rax
jne 0x18006b5e4
mov rdx, qword [rsp + 0x50]
mov ecx, dword [0x1800faaa8]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
nop
mov rcx, qword [rsp + 0x38]
test rcx, rcx
je 0x18006b61e
call fcn.1800958e0
mov rax, rbx
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.1800b8aa0
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret
Function at 0x18006bc90
Capabilities:
Set socket configuration

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x50
mov rax, qword [0x180001b10]
xor rax, rsp
mov qword [rsp + 0x48], rax
xor r15d, r15d
mov rdi, r9
mov rbp, rdx
mov r14, rcx
mov esi, r15d
cmp rcx, 0xffffffffffffffff
je 0x18006bdcd
test r8b, r8b
je 0x18006bd1f
test byte [rdx], 8
je 0x18006bd1f
mov dword [rsp + 0x40], r15d
call fcn.1800db290
or byte [rbp], 8
xor ecx, ecx
call qword [sym.imp.WS2_32.dll_WSASetLastError]
lea r9, [rsp + 0x40]
mov edx, 0xffff
mov r8d, 0x80
mov rcx, r14
mov dword [rsp + 0x20], 4
call qword [sym.imp.WS2_32.dll_setsockopt]
mov ebx, eax
call fcn.1800db290
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
test ebx, ebx
jne 0x18006bd1f
call fcn.1800db290
xor ecx, ecx
call qword [sym.imp.WS2_32.dll_WSASetLastError]
mov rcx, r14
call qword [sym.imp.WS2_32.dll_closesocket]
mov esi, eax
call fcn.1800db290
mov rbx, rax
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov qword [rsp + 0x38], rbx
mov dword [rsp + 0x30], eax
movups xmm0, xmmword [rsp + 0x30]
movups xmmword [rdi], xmm0
test esi, esi
je 0x18006bdcd
call fcn.1800db290
cmp qword [rdi + 8], rax
jne 0x18006bd68
cmp dword [rdi], 0x2733
je 0x18006bd7b
call fcn.1800db290
cmp qword [rdi + 8], rax
jne 0x18006bdc9
cmp dword [rdi], 0x4d5
jne 0x18006bdc9
lea r8, [rsp + 0x40]
mov edx, 0x8004667e
mov rcx, r14
mov dword [rsp + 0x40], r15d
call qword [sym.imp.WS2_32.dll_ioctlsocket]
and byte [rbp], 0xfc
xor ecx, ecx
call qword [sym.imp.WS2_32.dll_WSASetLastError]
mov rcx, r14
call qword [sym.imp.WS2_32.dll_closesocket]
mov esi, eax
call fcn.1800db290
mov rbx, rax
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov qword [rsp + 0x38], rbx
mov dword [rsp + 0x30], eax
movups xmm0, xmmword [rsp + 0x30]
movups xmmword [rdi], xmm0
test esi, esi
jne 0x18006bde4
mov dword [rsp + 0x30], r15d
call fcn.1800db290
mov qword [rsp + 0x38], rax
movups xmm0, xmmword [rsp + 0x30]
movups xmmword [rdi], xmm0
mov eax, esi
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.1800b8aa0
mov rbx, qword [rsp + 0x90]
add rsp, 0x50
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
Function at 0x18006be10
Capabilities:
Connect socket

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x30
mov rdi, r9
mov rsi, r8
mov rbp, rdx
mov rbx, rcx
cmp rcx, 0xffffffffffffffff
jne 0x18006be54
mov dword [rsp + 0x20], 0x2719
call fcn.1800db290
mov qword [rsp + 0x28], rax
or eax, ebx
movups xmm0, xmmword [rsp + 0x20]
movups xmmword [rdi], xmm0
jmp 0x18006bea8
xor ecx, ecx
call qword [sym.imp.WS2_32.dll_WSASetLastError]
mov r8d, esi
mov rdx, rbp
mov rcx, rbx
call qword [sym.imp.WS2_32.dll_connect]
mov esi, eax
call fcn.1800db290
mov rbx, rax
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov qword [rsp + 0x28], rbx
mov dword [rsp + 0x20], eax
movups xmm0, xmmword [rsp + 0x20]
movups xmmword [rdi], xmm0
test esi, esi
jne 0x18006bea6
mov dword [rsp + 0x20], esi
call fcn.1800db290
mov qword [rsp + 0x28], rax
movups xmm0, xmmword [rsp + 0x20]
movups xmmword [rdi], xmm0
mov eax, esi
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret

Function at 0x18006c000
Capabilities:
Receive data
Receive data on socket

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r14
sub rsp, 0x60
mov rax, qword [0x180001b10]
xor rax, rsp
mov qword [rsp + 0x58], rax
mov r14, qword [rsp + 0xb0]
mov rbx, rcx
xor ecx, ecx
mov rsi, r8
mov rdi, rdx
call qword [sym.imp.WS2_32.dll_WSASetLastError]
xor ebp, ebp
lea rax, [rsp + 0x54]
lea r9, [rsp + 0x50]
mov qword [rsp + 0x30], rbp
mov r8d, esi
mov rdx, rdi
mov rcx, rbx
mov qword [rsp + 0x28], rbp
mov dword [rsp + 0x50], ebp
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x54], ebp
call qword [sym.imp.WS2_32.dll_WSARecv]
mov edi, eax
call fcn.1800db290
mov rbx, rax
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov qword [rsp + 0x48], rbx
mov dword [rsp + 0x40], eax
movups xmm0, xmmword [rsp + 0x40]
movups xmmword [r14], xmm0
mov ecx, dword [r14]
cmp ecx, 0x40
jne 0x18006c099
mov dword [rsp + 0x40], 0x2746
jmp 0x18006c0a9
cmp ecx, 0x4d2
jne 0x18006c0bc
mov dword [rsp + 0x40], 0x274d
call fcn.1800db290
mov qword [rsp + 0x48], rax
movups xmm0, xmmword [rsp + 0x40]
movups xmmword [r14], xmm0
test edi, edi
je 0x18006c0c5
or eax, 0xffffffff
jmp 0x18006c0e0
mov dword [rsp + 0x40], ebp
call fcn.1800db290
mov qword [rsp + 0x48], rax
mov eax, dword [rsp + 0x50]
movups xmm0, xmmword [rsp + 0x40]
movups xmmword [r14], xmm0
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.1800b8aa0
add rsp, 0x60
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret
Function at 0x18006c230
Capabilities:
Send data
Send data on socket

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r14
sub rsp, 0x60
mov rax, qword [0x180001b10]
xor rax, rsp
mov qword [rsp + 0x58], rax
mov r14, qword [rsp + 0xb0]
mov rbx, rcx
xor ecx, ecx
mov rsi, r8
mov rdi, rdx
call qword [sym.imp.WS2_32.dll_WSASetLastError]
xor ebp, ebp
lea r9, [rsp + 0x50]
mov r8d, esi
mov qword [rsp + 0x30], rbp
mov rdx, rdi
mov rcx, rbx
mov qword [rsp + 0x28], rbp
mov dword [rsp + 0x20], ebp
mov dword [rsp + 0x50], ebp
call qword [sym.imp.WS2_32.dll_WSASend]
mov edi, eax
call fcn.1800db290
mov rbx, rax
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov qword [rsp + 0x48], rbx
mov dword [rsp + 0x40], eax
movups xmm0, xmmword [rsp + 0x40]
movups xmmword [r14], xmm0
mov ecx, dword [r14]
cmp ecx, 0x40
jne 0x18006c2bf
mov dword [rsp + 0x40], 0x2746
jmp 0x18006c2cf
cmp ecx, 0x4d2
jne 0x18006c2e2
mov dword [rsp + 0x40], 0x274d
call fcn.1800db290
mov qword [rsp + 0x48], rax
movups xmm0, xmmword [rsp + 0x40]
movups xmmword [r14], xmm0
test edi, edi
je 0x18006c2eb
or eax, 0xffffffff
jmp 0x18006c306
mov dword [rsp + 0x40], ebp
call fcn.1800db290
mov qword [rsp + 0x48], rax
mov eax, dword [rsp + 0x50]
movups xmm0, xmmword [rsp + 0x40]
movups xmmword [r14], xmm0
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.1800b8aa0
add rsp, 0x60
pop r14
pop rdi
pop rsi
pop rbp
pop rbx
ret

Function at 0x18006c430
Capabilities:
Set socket configuration

Disassembly:
push rbx
push rbp
push rsi
push rdi
sub rsp, 0x58
mov rax, qword [0x180001b10]
xor rax, rsp
mov qword [rsp + 0x48], rax
mov esi, ecx
xor ecx, ecx
mov rbp, r9
mov edi, r8d
mov ebx, edx
call qword [sym.imp.WS2_32.dll_WSASetLastError]
xor r9d, r9d
mov r8d, edi
mov edx, ebx
mov ecx, esi
mov dword [rsp + 0x28], 1
mov dword [rsp + 0x20], 0
call qword [sym.imp.WS2_32.dll_WSASocketW]
mov rdi, rax
call fcn.1800db290
mov rbx, rax
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov qword [rsp + 0x38], rbx
mov dword [rsp + 0x30], eax
movups xmm0, xmmword [rsp + 0x30]
movups xmmword [rbp], xmm0
cmp rdi, 0xffffffffffffffff
jne 0x18006c4a8
or rax, rdi
jmp 0x18006c4f0
cmp esi, 0x17
jne 0x18006c4d2
lea r9, [rsp + 0x40]
lea edx, [rsi + 0x12]
lea r8d, [rsi + 4]
mov rcx, rdi
mov dword [rsp + 0x40], 0
mov dword [rsp + 0x20], 4
call qword [sym.imp.WS2_32.dll_setsockopt]
mov dword [rsp + 0x30], 0
call fcn.1800db290
mov qword [rsp + 0x38], rax
mov rax, rdi
movups xmm0, xmmword [rsp + 0x30]
movups xmmword [rbp], xmm0
mov rcx, qword [rsp + 0x48]
xor rcx, rsp
call fcn.1800b8aa0
add rsp, 0x58
pop rdi
pop rsi
pop rbp
pop rbx
ret