joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180011010
Capabilities:
Encode data using base64 via winapi

Disassembly:
mov rax, rsp
mov qword [rax + 8], rcx
push rsi
push rdi
push r14
sub rsp, 0x50
mov qword [rax - 0x30], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rbp
mov rsi, r9
mov rbp, r8
mov rbx, rdx
xor r8d, r8d
lea rdx, [0x18008323b]
mov rcx, rbx
call fcn.180001520
xor r14d, r14d
mov dword [rsp + 0x70], r14d
lea rax, [rsp + 0x70]
mov qword [rsp + 0x20], rax
xor r9d, r9d
lea r8d, [r14 + 1]
mov edx, esi
mov rcx, rbp
call qword [sym.imp.CRYPT32.dll_CryptBinaryToStringA]
test eax, eax
setne dil
mov ecx, dword [rsp + 0x70]
test ecx, ecx
je 0x180011142
inc ecx
call fcn.18002affc
mov qword [rsp + 0x30], rax
lea rcx, [rsp + 0x30]
mov qword [rsp + 0x40], rcx
mov byte [rsp + 0x48], 1
test rax, rax
jne 0x1800110a5
jmp 0x180011142
lea rcx, [rsp + 0x70]
mov qword [rsp + 0x20], rcx
mov r9, rax
mov r8d, 1
mov edx, esi
mov rcx, rbp
call qword [sym.imp.CRYPT32.dll_CryptBinaryToStringA]
test eax, eax
setne dil
test eax, eax
je 0x180011133
mov rdx, qword [rsp + 0x30]
mov r8, 0xffffffffffffffff
nop dword [rax]
inc r8
cmp byte [rdx + r8], 0
jne 0x1800110e0
mov rcx, rbx
call fcn.180026f90
mov rcx, rbx
cmp qword [rbx + 0x18], 0x10
jb 0x1800110ff
mov rcx, qword [rbx]
mov qword [rsp + 0x20], 2
lea r9, [0x180083238]
mov rdx, qword [rbx + 0x10]
call fcn.1800256e0
cmp rax, 0xffffffffffffffff
je 0x180011130
mov qword [rsp + 0x20], r14
mov rdx, rax
mov rcx, rbx
call fcn.18001e160
jmp 0x1800110f2
mov dil, 1
mov rcx, qword [rsp + 0x30]
test rcx, rcx
je 0x180011142
call fcn.18002aef0
movzx eax, dil
mov rbx, qword [rsp + 0x78]
mov rbp, qword [rsp + 0x80]
add rsp, 0x50
pop r14
pop rdi
pop rsi
ret
Function at 0x180011320
Capabilities:
Receive data
Receive data on socket

Disassembly:
push rdi
mov eax, 0x1070
call fcn.18002b8b0
sub rsp, rax
mov qword [rsp + 0x50], 0xfffffffffffffffe
mov qword [rsp + 0x1080], rbx
mov qword [rsp + 0x1088], rsi
mov rdi, rdx
mov rbx, rcx
xor r8d, r8d
lea rdx, [0x18008323b]
call fcn.180001520
xor edx, edx
mov r8d, 0x1001
lea rcx, [rsp + 0x60]
call fcn.18004b570
xor r9d, r9d
mov r8d, 0x1000
lea rdx, [rsp + 0x60]
mov rcx, rdi
call qword [sym.imp.WS2_32.dll_recv]
test eax, eax
jle 0x18001147f
xor esi, esi
mov qword [rsp + 0x40], rsi
mov qword [rsp + 0x48], reloc.WS2_32.dll_ntohs
mov byte [rsp + 0x30], 0
lea rax, [rsp + 0x60]
mov r8, 0xffffffffffffffff
nop
inc r8
cmp byte [rax + r8], 0
jne 0x1800113b0
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0x30]
call fcn.180001520
nop
lea rdx, [rsp + 0x30]
cmp qword [rsp + 0x48], 0x10
cmovae rdx, qword [rsp + 0x30]
mov r8, qword [rsp + 0x40]
mov rcx, rbx
call fcn.180026f90
nop
mov rdx, qword [rsp + 0x48]
cmp rdx, 0x10
jb 0x180011422
inc rdx
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18001141d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18001149a
call fcn.18002aef0
mov rcx, rbx
cmp qword [rbx + 0x18], 0x10
jb 0x18001142f
mov rcx, qword [rbx]
mov qword [rsp + 0x20], 4
lea r9, str._r_n_r_n
mov rdx, qword [rbx + 0x10]
call fcn.1800256e0
cmp rax, 0xffffffffffffffff
jne 0x180011496
xor edx, edx
mov r8d, 0x1001
lea rcx, [rsp + 0x60]
call fcn.18004b570
xor r9d, r9d
mov r8d, 0x1000
lea rdx, [rsp + 0x60]
mov rcx, rdi
call qword [sym.imp.WS2_32.dll_recv]
test eax, eax
jg 0x180011390
xor al, al
lea r11, [rsp + 0x1070]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rsp, r11
pop rdi
ret
mov al, 1
jmp 0x180011481
call fcn.18004df84
int3
Function at 0x180013f40
Capabilities:
Get session user name

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x280
mov qword [rsp + 0x50], 0xfffffffffffffffe
mov rbx, rcx
xor esi, esi
mov qword [rsp + 0x2b8], rsi
cmp byte [rcx + 0x98], sil
je 0x180013f77
mov al, 1
add rsp, 0x280
pop rdi
pop rsi
pop rbx
ret
cmp qword [rcx + 0x40], rsi
jne 0x180013fa2
lea rdx, [0x180081904]
xor ecx, ecx
call qword [sym.imp.CRYPT32.dll_CertOpenSystemStoreW]
mov qword [rbx + 0x40], rax
test rax, rax
jne 0x180013fa2
xor al, al
add rsp, 0x280
pop rdi
pop rsi
pop rbx
ret
xor edx, edx
mov r8d, 0x208
lea rcx, [rsp + 0x70]
call fcn.18004b570
mov dword [rsp + 0x2a0], 0x208
lea rdx, [rsp + 0x2a0]
lea rcx, [rsp + 0x70]
call qword [sym.imp.ADVAPI32.dll_GetUserNameW]
test eax, eax
je 0x180013f95
mov qword [rsp + 0x2b0], rsi
lea rax, [rsp + 0x2b0]
mov qword [rsp + 0x58], rax
mov byte [rsp + 0x60], 1
lea rdi, [rbx + 0x48]
mov dword [rdi], 4
mov qword [rsp + 0x2a8], rsi
call qword [sym.imp.KERNEL32.dll_GetVersion]
movzx ecx, al
shl cx, 8
shr ax, 8
or cx, ax
mov eax, 0x600
cmp cx, ax
jae 0x180014034
mov dword [rsp + 0x2a8], 0x6603
mov dword [rbx + 0x70], 1
jmp 0x180014051
mov dword [rsp + 0x2a8], 0x6610
mov dword [rsp + 0x2ac], 0x6603
mov dword [rbx + 0x70], 2
lea rax, [rsp + 0x2a8]
mov qword [rbx + 0x78], rax
mov dword [rbx + 0x80], 0xfc0
mov dword [rbx + 0x90], 0x18
mov rax, qword [rbx + 0x10]
mov r10, qword [rax + 0x18]
lea rax, [rbx + 0x18]
lea rcx, [rsp + 0x2b8]
mov qword [rsp + 0x40], rcx
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rsi
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x20], rdi
xor r9d, r9d
lea r8d, [r9 + 2]
lea rdx, str.Microsoft_Unified_Security_Protocol_Provider
xor ecx, ecx
call r10
test eax, eax
je 0x1800140b9
xor bl, bl
jmp 0x1800140c2
mov byte [rbx + 0x98], 1
mov bl, 1
mov rcx, qword [rsp + 0x2b0]
test rcx, rcx
je 0x1800140d5
call qword [sym.imp.CRYPT32.dll_CertFreeCertificateContext]
movzx eax, bl
add rsp, 0x280
pop rdi
pop rsi
pop rbx
ret
Function at 0x1800144f0
Capabilities:
Send data
Send data on socket

Disassembly:
mov r11, rsp
mov qword [r11 + 0x10], rbx
push rbp
push rsi
push rdi
sub rsp, 0x80
xor ebp, ebp
mov dword [rsp + 0x74], 1
mov qword [r11 - 0x30], rbp
lea rax, [r11 - 0x38]
mov qword [r11 - 0x20], rax
lea rdi, [rcx + 0x28]
mov rax, qword [rcx + 0x10]
mov rsi, r8
mov dword [rsp + 0x64], 2
mov rbx, rcx
mov dword [rsp + 0x60], ebp
mov r8, rdx
mov dword [rsp + 0x70], ebp
add rcx, 0x18
mov r10, qword [rax + 0x30]
mov r9d, 0xc11c
lea rax, [r11 + 0x20]
xor edx, edx
mov qword [r11 - 0x40], rax
lea rax, [r11 + 8]
mov qword [r11 - 0x48], rax
lea rax, [r11 - 0x28]
mov qword [r11 - 0x50], rax
mov qword [r11 - 0x58], rdi
mov dword [rsp + 0x38], ebp
mov qword [r11 - 0x68], rbp
mov dword [rsp + 0x28], reloc.WS2_32.dll_recv
mov dword [rsp + 0x20], ebp
call r10
cmp eax, 0x90312
jne 0x1800145c8
mov r8d, dword [rsp + 0x60]
test r8d, r8d
je 0x1800145bd
mov rdx, qword [rsp + 0x68]
test rdx, rdx
je 0x1800145bd
mov rcx, qword [rbx]
xor r9d, r9d
call qword [sym.imp.WS2_32.dll_send]
mov rcx, qword [rsp + 0x68]
dec eax
cmp eax, 0xfffffffd
mov rax, qword [rbx + 0x10]
ja 0x1800145db
call qword [rax + 0x80]
mov qword [rsp + 0x68], rbp
mov r8, rsi
mov rcx, rbx
call fcn.1800140f0
mov rbx, qword [rsp + 0xa8]
add rsp, 0x80
pop rdi
pop rsi
pop rbp
ret
call qword [rax + 0x80]
mov rax, qword [rbx + 0x10]
mov rcx, rdi
call qword [rax + 0x48]
mov eax, 0x80090304
jmp 0x1800145c8

Function at 0x180014600
Capabilities:
Set socket configuration

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x40
cmp qword [rcx + 0x10], 0
mov rsi, r8
mov rbx, rdx
mov rdi, rcx
je 0x1800146dd
call fcn.180013f40
test al, al
je 0x1800146dd
cmp byte [rdi + 0x99], 0
jne 0x1800146dd
mov qword [rdi], rbx
mov qword [rdi + 8], rbx
test rbx, rbx
je 0x18001469c
lea r9, [rsp + 0x50]
mov dword [rsp + 0x50], 0x1000000
mov edx, 0xffff
mov dword [rsp + 0x20], 4
mov r8d, 0x1002
mov rcx, rbx
call qword [sym.imp.WS2_32.dll_setsockopt]
mov rcx, qword [rdi + 8]
lea r9, [rsp + 0x68]
mov edx, 0xffff
mov dword [rsp + 0x68], 0x1000000
mov r8d, 0x1001
mov dword [rsp + 0x20], 4
call qword [sym.imp.WS2_32.dll_setsockopt]
xor eax, eax
lea r8, [rsp + 0x30]
mov rdx, rsi
mov qword [rsp + 0x30], rax
mov rcx, rdi
mov qword [rsp + 0x38], rax
call fcn.1800144f0
test eax, eax
je 0x1800146ef
xor esi, esi
mov qword [rdi + 8], rsi
mov rbx, qword [rdi]
mov rcx, rbx
lea edx, [rsi + 2]
call qword [sym.imp.WS2_32.dll_shutdown]
mov rcx, rbx
call qword [sym.imp.WS2_32.dll_closesocket]
mov qword [rdi], rsi
xor al, al
mov rbx, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret
mov rax, qword [rdi + 0x10]
lea r8, [rdi + 0x18180]
lea rcx, [rdi + 0x28]
mov edx, 4
mov r9, qword [rax + 0x58]
call r9
test eax, eax
js 0x1800146bc
mov rbx, qword [rsp + 0x58]
mov al, 1
mov rsi, qword [rsp + 0x60]
mov byte [rdi + 0x99], 1
add rsp, 0x40
pop rdi
ret
Function at 0x180014db0
Capabilities:
Send data
Send data on socket

Disassembly:
mov r11, rsp
push rbp
push rsi
push rdi
sub rsp, 0x90
mov qword [r11 - 0x48], 0xfffffffffffffffe
mov qword [r11 + 0x20], rbx
mov rbx, rcx
xor ebp, ebp
lea rdi, [rcx + 0x28]
cmp byte [rcx + 0x99], bpl
je 0x180014f03
mov dword [r11 + 8], 1
lea rax, [r11 + 8]
mov qword [r11 - 0x38], rax
mov dword [rsp + 0x6c], 2
mov dword [rsp + 0x68], 4
mov dword [rsp + 0x7c], 1
lea rax, [r11 - 0x40]
mov qword [r11 - 0x28], rax
mov dword [rsp + 0x78], ebp
mov rax, qword [rcx + 0x10]
mov r8, qword [rax + 0x50]
lea rdx, [r11 - 0x30]
mov rcx, rdi
call r8
nop
test eax, eax
js 0x180014ef8
mov qword [rsp + 0x70], rbp
mov dword [rsp + 0x6c], 2
mov dword [rsp + 0x68], ebp
mov dword [rsp + 0x7c], 1
lea rax, [rsp + 0x68]
mov qword [rsp + 0x80], rax
mov dword [rsp + 0x78], ebp
mov rax, qword [rbx + 0x10]
mov r10, qword [rax + 0x30]
lea rcx, [rbx + 0x18]
lea rax, [rsp + 0xc0]
mov qword [rsp + 0x58], rax
lea rax, [rsp + 0xb8]
mov qword [rsp + 0x50], rax
lea rax, [rsp + 0x78]
mov qword [rsp + 0x48], rax
mov qword [rsp + 0x40], rdi
mov dword [rsp + 0x38], ebp
mov qword [rsp + 0x30], rbp
mov dword [rsp + 0x28], reloc.WS2_32.dll_recv
mov dword [rsp + 0x20], ebp
mov r9d, 0xc11c
xor r8d, r8d
mov rdx, rdi
call r10
nop
test eax, eax
js 0x180014ef8
mov rsi, qword [rsp + 0x70]
test rsi, rsi
je 0x180014ef8
mov r8d, dword [rsp + 0x68]
test r8d, r8d
je 0x180014ef8
xor r9d, r9d
mov rdx, rsi
mov rcx, qword [rbx]
call qword [sym.imp.WS2_32.dll_send]
nop
dec eax
cmp eax, 0xfffffffd
ja 0x180014ef1
mov rax, qword [rbx + 0x10]
mov rcx, rsi
call qword [rax + 0x80]
nop
jmp 0x180014ef8
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
nop
mov rax, qword [rbx + 0x10]
mov rcx, rdi
call qword [rax + 0x48]
nop
cmp dword [rbx + 0x3c], ebp
je 0x180014f16
mov rax, qword [rbx + 0x10]
mov rcx, rdi
call qword [rax + 0x48]
nop
mov dword [rbx + 0x3c], ebp
cmp dword [rbx + 0x38], ebp
je 0x180014f2a
mov rax, qword [rbx + 0x10]
lea rcx, [rbx + 0x18]
call qword [rax + 0x20]
nop
mov dword [rbx + 0x38], ebp
mov rcx, qword [rbx + 0x40]
test rcx, rcx
je 0x180014f3c
xor edx, edx
call qword [sym.imp.CRYPT32.dll_CertCloseStore]
nop
mov rcx, qword [rbx + 8]
test rcx, rcx
je 0x180014f60
mov edx, 2
call qword [sym.imp.WS2_32.dll_shutdown]
nop
mov rcx, qword [rbx + 8]
call qword [sym.imp.WS2_32.dll_closesocket]
nop
mov qword [rbx + 8], rbp
mov rbx, qword [rsp + 0xc8]
add rsp, 0x90
pop rdi
pop rsi
pop rbp
ret
Function at 0x180014f90
Capabilities:
Initialize winsock library

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rcx
push rsi
push rdi
push r14
sub rsp, 0x1f0
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [r11 + 0x18], rbx
mov qword [r11 + 0x20], rbp
mov rdi, rcx
lea rax, vtable.HttpsConnectSession.0
mov qword [rcx], rax
xor ebp, ebp
mov qword [rcx + 0x18], rbp
mov qword [rcx + 0x20], reloc.WS2_32.dll_ntohs
mov byte [rcx + 8], bpl
lea rbx, [rcx + 0x28]
mov qword [r11 + 0x10], rbx
mov qword [rbx], rbp
mov qword [rbx + 8], rbp
mov qword [rbx + 0x10], rbp
xor eax, eax
mov qword [rbx + 0x18], rax
mov qword [rbx + 0x20], rax
mov qword [rbx + 0x28], rax
mov qword [rbx + 0x30], rax
mov qword [rbx + 0x38], rbp
mov qword [rbx + 0x40], rbp
lea rcx, [rbx + 0x48]
xor edx, edx
lea r8d, [rbp + 0x50]
call fcn.18004b570
mov word [rbx + 0x98], bp
mov dword [rbx + 0x18164], ebp
mov qword [rbx + 0x18168], rbp
mov dword [rbx + 0x18170], ebp
lea rax, [rbx + 0x80fe]
mov qword [rbx + 0x18178], rax
mov ecx, 0x202
lea rdx, [rsp + 0x50]
call qword [sym.imp.WS2_32.dll_WSAStartup]
lea rcx, str.security.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov qword [0x1800a0138], rax
test rax, rax
je 0x180015078
lea rcx, str.secur32.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov qword [0x1800a0130], rax
test rax, rax
jne 0x180015089
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jne 0x1800150b8
mov rax, qword [0x1800a0130]
cmp qword [0x1800a0138], 0
jne 0x180015098
mov rax, rbp
jmp 0x1800150b4
lea rdx, str.InitSecurityInterfaceW
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
jne 0x1800150b2
mov rax, rbp
jmp 0x1800150b4
call rax
mov qword [rbx + 0x10], rax
mov qword [rdi + 0x181d8], rbp
mov qword [rdi + 0x181e0], 0xf
mov byte [rdi + 0x181c8], 0
lea rsi, [rdi + 0x181e8]
mov qword [rsi + 0x10], rbp
mov qword [rsi + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rsi], 0
mov r8d, 5
lea rdx, [0x180081a00]
lea rcx, [rdi + 8]
call fcn.180001520
xor r8d, r8d
lea rdx, [0x18008323b]
lea rcx, [rdi + 0x181c8]
call fcn.180001520
mov qword [rdi + 0x18208], rbp
mov byte [rdi + 0x181c0], 0
mov r8d, 1
lea rdx, [0x180081ebc]
mov rcx, rsi
call fcn.180001520
call fcn.180025c90
lea rdx, [rsp + 0x28]
mov rcx, rax
call fcn.18001da50
mov rbx, rax
cmp rsi, rax
je 0x180015175
mov rcx, rsi
call fcn.1800014a0
movups xmm0, xmmword [rbx]
movups xmmword [rsi], xmm0
movups xmm1, xmmword [rbx + 0x10]
movups xmmword [rsi + 0x10], xmm1
mov qword [rbx + 0x10], rbp
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], 0
mov rdx, qword [rsp + 0x40]
cmp rdx, 0x10
jb 0x1800151ae
inc rdx
mov rcx, qword [rsp + 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800151a9
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1800151d1
call fcn.18002aef0
lock inc qword [rdi + 0x18208]
mov rax, rdi
lea r11, [rsp + 0x1f0]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret
call fcn.18004df84
nop
int3
Function at 0x180015ee0
Capabilities:
Send data
Send data on socket

Disassembly:
sub rsp, 0x28
mov rcx, qword [rcx + 0x28]
lea rdx, [0x18008323b]
xor r9d, r9d
xor r8d, r8d
call qword [sym.imp.WS2_32.dll_send]
test eax, eax
sete al
add rsp, 0x28
ret

Function at 0x180016510
Capabilities:
Send data
Send data on socket

Disassembly:
sub rsp, 0x28
mov rcx, qword [rcx + 0x10028]
test rcx, rcx
je 0x18001652e
test r8d, r8d
jle 0x18001652e
xor r9d, r9d
call qword [sym.imp.WS2_32.dll_send]
xor eax, eax
add rsp, 0x28
ret

Function at 0x180016c40
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
sub rsp, 0x20
mov rdi, rcx
mov ebp, 1
lea rcx, [rsp + 0x40]
mov qword [rsp + 0x40], rbp
call qword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
mov rax, qword [rsp + 0x40]
lea rcx, [rsp + 0x48]
test rax, rax
cmove rax, rbp
mov qword [rsp + 0x40], rax
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
xor ecx, ecx
call fcn.180050584
mov rbx, rax
lea rcx, [rsp + 0x48]
mov rax, qword [rsp + 0x48]
mov esi, 0x7fffffff
cqo
idiv qword [rsp + 0x40]
and eax, esi
sub ebx, eax
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov rax, qword [rsp + 0x48]
mov r9, qword [rdi + 0x10]
cqo
idiv qword [rsp + 0x40]
mov r8, rax
imul rax, rdx, 0xf4240
cqo
idiv qword [rsp + 0x40]
mov rcx, rax
mov eax, 0x10624dd3
imul ecx
lea eax, [r8 + rbx]
sar edx, 6
mov ecx, edx
imul r8d, eax, 0x3e8
shr ecx, 0x1f
add edx, ecx
add r8d, edx
mov dword [rdi + 0x1c], r8d
test r9, r9
je 0x180016e12
cmp dword [rdi + 0x18], r8d
ja 0x180016e12
cmp dword [r9 + 0x70], 0
mov eax, r8d
mov edx, dword [r9 + 0x54]
je 0x180016d6a
sub eax, edx
add eax, 0x2710
cmp eax, 0x4e1f
cmova edx, r8d
cmp r8d, edx
js 0x180016d2c
mov eax, r8d
jmp 0x180016d6a
lea r10, [r9 + 0xa8]
sub edx, r8d
mov rcx, qword [r10]
cmp rcx, r10
je 0x180016d59
nop
mov eax, dword [rcx + 0x30]
sub eax, r8d
test eax, eax
jle 0x180016d27
mov rcx, qword [rcx]
cmp eax, esi
cmovge eax, esi
mov esi, eax
cmp rcx, r10
jne 0x180016d40
mov eax, dword [r9 + 0x50]
cmp esi, edx
cmovl edx, esi
cmp edx, eax
cmovb eax, edx
add eax, r8d
mov dword [rdi + 0x18], eax
cmp eax, r8d
jne 0x180016e12
cmp dword [r9 + 0x70], 0
mov dword [r9 + 0x4c], r8d
jne 0x180016d8e
mov dword [r9 + 0x70], ebp
mov ecx, r8d
mov dword [r9 + 0x54], r8d
jmp 0x180016d92
mov ecx, dword [r9 + 0x54]
mov eax, r8d
sub eax, ecx
cmp eax, 0x2710
jge 0x180016dab
cmp eax, 0xffffd8f0
jl 0x180016dab
test eax, eax
js 0x180016dcf
jmp 0x180016dae
mov ecx, r8d
mov r10d, dword [r9 + 0x50]
lea edx, [r10 + rcx]
cmp r8d, edx
mov dword [r9 + 0x54], edx
js 0x180016dc7
lea eax, [r10 + r8]
mov dword [r9 + 0x54], eax
mov rcx, r9
call fcn.180002650
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + 0x40]
mov rcx, qword [rdi + 0x10]
lea rdx, [rdi + 0x28]
call fcn.180001a30
test eax, eax
js 0x180016e12
nop dword [rax]
mov r9, qword [rdi]
lea rdx, [rdi + 0x28]
mov r8d, eax
mov rcx, rdi
call qword [r9 + reloc.WS2_32.dll_recv]
mov rcx, qword [rdi + 0x10]
lea rdx, [rdi + 0x28]
call fcn.180001a30
test eax, eax
jns 0x180016df0
mov rbx, qword [rsp + 0x50]
add rsp, 0x20
pop rdi
pop rsi
pop rbp
ret
Function at 0x180016ef0
Capabilities:
Resolve dns
Set socket configuration

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x70
mov r12d, 2
movzx r14d, r8w
mov r15, rdx
mov rdi, rcx
mov edx, r12d
mov ecx, r12d
xor r8d, r8d
mov ebp, r9d
call qword [sym.imp.WS2_32.dll_socket]
mov qword [rdi + 8], rax
test rax, rax
je 0x1800170c7
lea r9, [rsp + 0xa0]
mov dword [rsp + 0xa0], 1
mov edx, 0xffff
mov dword [rsp + 0x20], 4
lea r8d, [r12 + 2]
mov rcx, rax
call qword [sym.imp.WS2_32.dll_setsockopt]
xor eax, eax
lea rcx, str.0.0.0.0
mov qword [rdi + 0x10], rax
mov qword [rdi + 0x18], rax
mov word [rdi + 0x10], r12w
call qword [sym.imp.WS2_32.dll_inet_addr]
xor ecx, ecx
mov dword [rdi + 0x14], eax
call qword [sym.imp.WS2_32.dll_htons]
mov rcx, qword [rdi + 8]
lea r8d, [r12 + 0xe]
lea rdx, [rdi + 0x10]
mov word [rdi + 0x12], ax
call qword [sym.imp.WS2_32.dll_bind]
test eax, eax
js 0x1800170c7
mov rcx, r15
call qword [sym.imp.WS2_32.dll_gethostbyname]
xor ecx, ecx
mov qword [rdi + 0x10], rcx
mov qword [rdi + 0x18], rcx
mov word [rdi + 0x10], r12w
mov rax, qword [rax + 0x18]
mov rcx, qword [rax]
mov eax, dword [rcx]
movzx ecx, r14w
mov dword [rdi + 0x14], eax
call qword [sym.imp.WS2_32.dll_htons]
mov ecx, 0x10030
mov word [rdi + 0x12], ax
call fcn.18002aeb4
mov qword [rsp + 0x30], rax
xor r14d, r14d
xor edx, edx
mov r8d, 0x10000
mov rbx, rax
lea rcx, [rax + 0x28]
mov dword [rax + 8], r14d
mov qword [rax + 0x10], r14
mov qword [rax + 0x18], r14
mov dword [rax + 0x24], 0xc350
mov dword [rax + 0x20], 0xc350
call fcn.18004b570
lea rax, vtable.tunnel_client_udp.0
mov qword [rbx + 0x10028], r14
mov qword [rbx], rax
lea r8, [rdi + 8]
mov edx, ebp
mov qword [rdi + 0x20], rbx
mov rcx, rbx
call fcn.1800165e0
test al, al
je 0x1800170c7
lea rax, [0x180016860]
mov byte [rdi + 0x98], r14b
lea rdx, [rsp + 0x30]
mov qword [rsp + 0x30], rax
lea rcx, [rsp + 0x50]
mov qword [rsp + 0x38], rdi
call fcn.180016ad0
cmp dword [rdi + 0x30], r14d
jne 0x1800170e2
movups xmm0, xmmword [rax]
movups xmmword [rdi + 0x28], xmm0
mov qword [rax], r14
mov dword [rax + 8], r14d
cmp dword [rsp + 0x58], r14d
jne 0x1800170e2
lea rax, [0x180016e20]
mov qword [rsp + 0x48], rdi
lea rdx, [rsp + 0x40]
mov qword [rsp + 0x40], rax
lea rcx, [rsp + 0x60]
call fcn.180016ad0
cmp dword [rdi + 0x40], r14d
jne 0x1800170e8
movups xmm0, xmmword [rax]
movups xmmword [rdi + 0x38], xmm0
mov qword [rax], r14
mov dword [rax + 8], r14d
cmp dword [rsp + 0x68], r14d
jne 0x1800170e8
mov al, 1
jmp 0x1800170c9
xor al, al
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret
call fcn.1800509cc
int3
call fcn.1800509cc
int3
Function at 0x180018800
Capabilities:
Send data

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
push r14
push r15
sub rsp, 0x30
mov esi, r8d
mov r14, rdx
mov r15, rcx
xor edi, edi
mov ebx, edi
mov dword [rsp + 0x20], ebx
test rdx, rdx
je 0x180018868
nop dword [rax]
cmp ebx, esi
jae 0x180018866
mov dword [rsp + 0x68], edi
mov r8d, esi
sub r8d, ebx
mov edx, ebx
add rdx, r14
lea r9, [rsp + 0x68]
mov rcx, qword [r15 + 0x40]
call qword [sym.imp.WININET.dll_InternetWriteFile]
test eax, eax
je 0x180018868
mov eax, dword [rsp + 0x68]
test eax, eax
je 0x180018868
add ebx, eax
mov dword [rsp + 0x20], ebx
jmp 0x180018830
mov edi, ebx
cmp edi, esi
jne 0x180018870
mov al, 1
jmp 0x180018876
xor al, al
jmp 0x180018876
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x30
pop r15
pop r14
pop rdi
ret
Function at 0x18001a4e0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rdx
mov qword [rax + 8], rcx
push rbx
push rbp
push rsi
push rdi
sub rsp, 0x48
mov qword [rax + 0x20], r12
mov rsi, r8
mov r12, qword [r8 + 0x18]
mov rbp, rcx
mov qword [rax - 0x28], r13
mov r10, r8
mov qword [rax - 0x30], r14
mov r14, qword [r8 + 0x10]
cmp r12, 0x10
jb 0x18001a519
mov r10, qword [r8]
xor r8d, r8d
movabs r9, 0xcbf29ce484222325
test r14, r14
je 0x18001a554
movabs rcx, 0x100000001b3
nop word [rax + rax]
movzx eax, byte [r8 + r10]
inc r8
xor r9, rax
imul r9, rcx
cmp r8, r14
jb 0x18001a540
mov rax, qword [rbp + 0x18]
mov rcx, qword [rbp + 0x30]
mov rdi, qword [rbp + 8]
and rcx, r9
shl rcx, 4
mov qword [rsp + 0x30], r15
mov r13, qword [rcx + rax]
add rax, 8
add rax, rcx
mov rbx, r13
mov qword [rsp + 0x80], rax
cmp r13, rdi
jne 0x18001a58c
mov rax, rdi
jmp 0x18001a592
mov rax, qword [rax]
mov rax, qword [rax]
cmp rbx, rax
je 0x18001a608
lea rcx, [rbx + 0x10]
mov rdx, rsi
cmp r12, 0x10
jb 0x18001a5a7
mov rdx, qword [rsi]
mov r15, qword [rcx + 0x18]
mov rbp, qword [rcx + 0x10]
cmp r15, 0x10
jb 0x18001a5b8
mov rcx, qword [rcx]
cmp rbp, r14
jne 0x18001a5c9
mov r8, rbp
call fcn.18004b790
test eax, eax
je 0x18001a5d6
mov rbx, qword [rbx]
mov rax, qword [rsp + 0x80]
jmp 0x18001a582
lea rdx, [rbx + 0x10]
cmp r15, 0x10
jb 0x18001a5e3
mov rdx, qword [rdx]
mov rcx, rsi
cmp r12, 0x10
jb 0x18001a5ef
mov rcx, qword [rsi]
cmp r14, rbp
jne 0x18001a600
mov r8, r14
call fcn.18004b790
test eax, eax
je 0x18001a603
mov rbx, rdi
mov rax, rbx
jmp 0x18001a60e
mov rbx, rdi
mov rax, rdi
mov r14, qword [rsp + 0x38]
mov r13, qword [rsp + 0x40]
mov r12, qword [rsp + 0x88]
cmp rax, rdi
jne 0x18001a6a4
mov rbx, qword [rdi]
lea rax, [rsp + 0x80]
mov rdx, rbx
mov qword [rsp + 0x80], rsi
mov qword [rsp + 0x20], rax
mov rdi, qword [rbx + 8]
mov r8, rdi
call fcn.18001a490
mov rbp, qword [rsp + 0x70]
mov rdx, rax
movabs rcx, 0x333333333333332
mov rax, qword [rbp + 0x10]
sub rcx, rax
cmp rcx, 1
jb 0x18001a6c2
inc rax
mov rcx, rbp
mov qword [rbp + 0x10], rax
mov qword [rbx + 8], rdx
mov qword [rdi], rdx
mov r9, qword [rbp + 8]
mov rdx, qword [rsp + 0x78]
mov r9, qword [r9]
lea r8, [r9 + 0x10]
call fcn.18001c720
mov rax, qword [rsp + 0x78]
mov r15, qword [rsp + 0x30]
add rsp, 0x48
pop rdi
pop rsi
pop rbp
pop rbx
ret
mov r15, qword [rsp + 0x78]
mov rax, r15
mov qword [r15], rbx
mov byte [r15 + 8], 0
mov r15, qword [rsp + 0x30]
add rsp, 0x48
pop rdi
pop rsi
pop rbp
pop rbx
ret
lea rcx, str.list_T__too_long
call fcn.18002849c
int3