joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180006c60
Capabilities:
Hash data using fnv

Disassembly:
push rdi
sub rsp, 0x20
movabs rax, 0xfffffffffffffff
mov edi, 1
bsr rcx, rax
mov eax, edi
shl rax, cl
cmp rdx, rax
ja 0x180006e3d
lea rax, [rdx - 1]
mov qword [rsp + 0x30], rbx
mov rbx, qword [0x180032fd8]
or rax, rdi
bsr rcx, rax
mov r8, rbx
inc ecx
shl rdi, cl
lea rcx, [0x180032fe8]
lea rdx, [rdi + rdi]
call fcn.180006350
mov rax, qword [0x180032fd8]
lea r9, [rdi - 1]
mov qword [0x180033000], r9
mov qword [0x180033008], rdi
mov rax, qword [rax]
mov rcx, rax
cmp rax, rbx
je 0x180006e32
mov qword [rsp + 0x40], rsi
movabs rdi, 0x100000001b3
movabs rsi, 0xcbf29ce484222325
nop word [rax + rax]
movzx edx, byte [rax + 0x11]
movzx r11d, byte [rax + 0x10]
mov rcx, qword [rcx]
xor r11, rsi
imul r11, rdi
xor r11, rdx
movzx edx, byte [rax + 0x12]
imul r11, rdi
xor r11, rdx
movzx edx, byte [rax + 0x13]
imul r11, rdi
xor r11, rdx
movzx edx, byte [rax + 0x14]
imul r11, rdi
xor r11, rdx
movzx edx, byte [rax + 0x15]
imul r11, rdi
xor r11, rdx
movzx edx, byte [rax + 0x16]
imul r11, rdi
xor r11, rdx
movzx edx, byte [rax + 0x17]
imul r11, rdi
xor r11, rdx
imul r11, rdi
and r11, r9
shl r11, 4
add r11, qword [0x180032fe8]
mov r9, qword [r11]
cmp r9, rbx
jne 0x180006d7b
mov qword [r11], rax
mov qword [r11 + 8], rax
jmp 0x180006df3
mov rdx, qword [r11 + 8]
mov r8, qword [rax + 0x10]
cmp r8, qword [rdx + 0x10]
jne 0x180006db8
mov r10, qword [rdx]
cmp r10, rax
je 0x180006db2
mov r9, qword [rax + 8]
mov qword [r9], rcx
mov r8, qword [rcx + 8]
mov qword [r8], r10
mov rdx, qword [r10 + 8]
mov qword [rdx], rax
mov qword [r10 + 8], r8
mov qword [rcx + 8], r9
mov qword [rax + 8], rdx
mov qword [r11 + 8], rax
jmp 0x180006df3
cmp r9, rdx
je 0x180006dcf
nop dword [rax]
mov rdx, qword [rdx + 8]
cmp r8, qword [rdx + 0x10]
je 0x180006e07
cmp r9, rdx
jne 0x180006dc0
mov r10, qword [rax + 8]
mov qword [r10], rcx
mov r9, qword [rcx + 8]
mov qword [r9], rdx
mov r8, qword [rdx + 8]
mov qword [r8], rax
mov qword [rdx + 8], r9
mov qword [rcx + 8], r10
mov qword [rax + 8], r8
mov qword [r11], rax
mov rax, rcx
cmp rcx, rbx
je 0x180006e2d
mov r9, qword [0x180033000]
jmp 0x180006d00
mov r10, qword [rdx]
mov r9, qword [rax + 8]
mov qword [r9], rcx
mov r8, qword [rcx + 8]
mov qword [r8], r10
mov rdx, qword [r10 + 8]
mov qword [rdx], rax
mov qword [r10 + 8], r8
mov qword [rcx + 8], r9
mov qword [rax + 8], rdx
jmp 0x180006df3
mov rsi, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
lea rcx, str.invalid_hash_bucket_count
call fcn.18000b160
int3
Function at 0x180006fb0
Capabilities:
Allocate or change rwx memory

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x68
mov rax, qword [rsp + 0x78]
sub rax, 0x10000
mov rcx, rax
call fcn.1800071d0
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x70]
cmp qword [rsp + 0x20], rax
jbe 0x1800070b7
mov rax, qword [section..data]
cmp qword [rsp + 0x20], rax
jb 0x180007014
mov rax, qword [0x18002f008]
cmp qword [rsp + 0x20], rax
ja 0x180007014
mov rax, qword [rsp + 0x20]
sub rax, 0x8000000
mov qword [rsp + 0x20], rax
jmp 0x180006fd6
mov r8d, 0x30
xor edx, edx
lea rcx, [rsp + 0x30]
call fcn.18000da10
mov r8d, 0x30
lea rdx, [rsp + 0x30]
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
jne 0x180007043
jmp 0x1800070b7
cmp dword [rsp + 0x50], 0x10000
jne 0x18000709a
cmp qword [rsp + 0x48], 0x10000
jb 0x18000709a
mov r9d, 0x40
mov r8d, 0x3000
mov edx, 0x10000
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x28], 0
je 0x180007088
mov rax, qword [rsp + 0x28]
jmp 0x1800070b9
mov rax, qword [rsp + 0x20]
sub rax, 0x10000
mov qword [rsp + 0x20], rax
jmp 0x1800070b2
mov rax, qword [rsp + 0x38]
sub rax, 0x10000
mov rcx, rax
call fcn.1800071d0
mov qword [rsp + 0x20], rax
jmp 0x180006fd6
xor eax, eax
add rsp, 0x68
ret

Function at 0x1800070c0
Capabilities:
Allocate or change rwx memory

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
sub rsp, 0x68
mov rcx, qword [rsp + 0x70]
call fcn.180007210
mov qword [rsp + 0x20], rax
mov rax, qword [rsp + 0x78]
cmp qword [rsp + 0x20], rax
jae 0x1800071c3
mov rax, qword [section..data]
cmp qword [rsp + 0x20], rax
jb 0x18000711b
mov rax, qword [0x18002f008]
cmp qword [rsp + 0x20], rax
ja 0x18000711b
mov rax, qword [rsp + 0x20]
add rax, 0x8000000
mov qword [rsp + 0x20], rax
jmp 0x1800070dd
mov r8d, 0x30
xor edx, edx
lea rcx, [rsp + 0x30]
call fcn.18000da10
mov r8d, 0x30
lea rdx, [rsp + 0x30]
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_VirtualQuery]
test rax, rax
jne 0x18000714a
jmp 0x1800071c3
cmp dword [rsp + 0x50], 0x10000
jne 0x1800071a1
cmp qword [rsp + 0x48], 0x10000
jb 0x1800071a1
mov r9d, 0x40
mov r8d, 0x3000
mov edx, 0x10000
mov rcx, qword [rsp + 0x20]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov qword [rsp + 0x28], rax
cmp qword [rsp + 0x28], 0
je 0x18000718f
mov rax, qword [rsp + 0x28]
jmp 0x1800071c5
mov rax, qword [rsp + 0x20]
add rax, 0x10000
mov qword [rsp + 0x20], rax
jmp 0x1800071be
mov rax, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x30]
add rcx, rax
mov rax, rcx
mov rcx, rax
call fcn.180007210
mov qword [rsp + 0x20], rax
jmp 0x1800070dd
xor eax, eax
add rsp, 0x68
ret
Function at 0x180007260
Capabilities:
Hook routines via microsoft detours

Disassembly:
mov qword [rsp + 8], rcx
sub rsp, 0x58
lea r8, [rsp + 0x30]
lea rdx, [rsp + 0x38]
mov rcx, qword [rsp + 0x60]
call fcn.1800077f0
mov qword [rsp + 0x28], 0
cmp qword [0x18002fc58], 0
jne 0x1800072a8
cmp qword [0x18002fc50], 0
je 0x1800072a8
mov rax, qword [0x18002fc50]
mov qword [0x18002fc58], rax
cmp qword [0x18002fc58], 0
je 0x18000734e
mov rax, qword [0x18002fc58]
cmp qword [rax + 0x10], 0
je 0x18000734e
mov rax, qword [0x18002fc58]
mov rcx, qword [rsp + 0x38]
cmp qword [rax + 0x10], rcx
jb 0x18000734e
mov rax, qword [0x18002fc58]
mov rcx, qword [rsp + 0x30]
cmp qword [rax + 0x10], rcx
ja 0x18000734e
mov rax, qword [0x18002fc58]
mov rax, qword [rax + 0x10]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x38]
cmp qword [rsp + 0x28], rax
jb 0x180007314
mov rax, qword [rsp + 0x30]
cmp qword [rsp + 0x28], rax
jbe 0x18000731b
xor eax, eax
jmp 0x1800074c9
mov rax, qword [0x18002fc58]
mov rcx, qword [rsp + 0x28]
mov rcx, qword [rcx + 0x48]
mov qword [rax + 0x10], rcx
mov r8d, 0x60
mov edx, 0xcc
mov rcx, qword [rsp + 0x28]
call fcn.18000da10
mov rax, qword [rsp + 0x28]
jmp 0x1800074c9
mov rax, qword [0x18002fc50]
mov qword [0x18002fc58], rax
jmp 0x180007370
mov rax, qword [0x18002fc58]
mov rax, qword [rax + 8]
mov qword [0x18002fc58], rax
cmp qword [0x18002fc58], 0
je 0x1800073bd
cmp qword [0x18002fc58], 0
je 0x1800073bb
mov rax, qword [0x18002fc58]
cmp qword [rax + 0x10], 0
je 0x1800073bb
mov rax, qword [0x18002fc58]
mov rcx, qword [rsp + 0x38]
cmp qword [rax + 0x10], rcx
jb 0x1800073bb
mov rax, qword [0x18002fc58]
mov rcx, qword [rsp + 0x30]
cmp qword [rax + 0x10], rcx
ja 0x1800073bb
jmp 0x1800072ec
jmp 0x18000735e
mov rcx, qword [rsp + 0x60]
call fcn.180009420
and eax, 0xffff
mov eax, eax
mov rcx, qword [rsp + 0x60]
sub rcx, rax
mov rax, rcx
mov qword [rsp + 0x60], rax
mov r8, qword [rsp + 0x30]
mov rdx, qword [rsp + 0x38]
mov rcx, qword [rsp + 0x60]
call fcn.1800074d0
mov qword [rsp + 0x48], rax
cmp qword [rsp + 0x48], 0
je 0x1800074c7
mov rax, qword [rsp + 0x48]
mov qword [0x18002fc58], rax
mov rax, qword [0x18002fc58]
mov dword [rax], 0x52727464
mov rax, qword [0x18002fc58]
mov qword [rax + 0x10], 0
mov rax, qword [0x18002fc58]
mov rcx, qword [0x18002fc50]
mov qword [rax + 8], rcx
mov rax, qword [0x18002fc58]
mov qword [0x18002fc50], rax
mov qword [rsp + 0x40], 0
mov rax, qword [0x18002fc58]
add rax, 0x60
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0x2a8
jmp 0x180007478
mov eax, dword [rsp + 0x20]
dec eax
mov dword [rsp + 0x20], eax
cmp dword [rsp + 0x20], 1
jle 0x1800074b2
movsxd rax, dword [rsp + 0x20]
imul rax, rax, 0x60
mov rcx, qword [rsp + 0x28]
mov rdx, qword [rsp + 0x40]
mov qword [rcx + rax + 0x48], rdx
movsxd rax, dword [rsp + 0x20]
imul rax, rax, 0x60
mov rcx, qword [rsp + 0x28]
add rcx, rax
mov rax, rcx
mov qword [rsp + 0x40], rax
jmp 0x18000746e
mov rax, qword [0x18002fc58]
mov rcx, qword [rsp + 0x40]
mov qword [rax + 0x10], rcx
jmp 0x1800072ec
xor eax, eax
add rsp, 0x58
ret
Function at 0x180009430
Capabilities:
Link many functions at runtime

Disassembly:
sub rsp, 0x38
cmp dword [0x18002fce0], 0
je 0x180009444
xor eax, eax
jmp 0x1800096ad
cmp qword [0x18002fcd8], 0
je 0x18000945a
mov rax, qword [0x18002fcd8]
jmp 0x1800096ad
mov r8d, 0x48
xor edx, edx
lea rcx, [0x18002fc90]
call fcn.18000da10
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov qword [0x18002fc90], rax
xor r8d, r8d
xor edx, edx
lea rcx, str.dbghelp.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov qword [0x18002fc98], rax
cmp qword [0x18002fc98], 0
jne 0x180009513
mov dword [0x18002fce0], 1
cmp qword [0x18002fc98], 0
je 0x1800094bf
mov rcx, qword [0x18002fc98]
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov qword [0x18002fca0], 0
mov qword [0x18002fca8], 0
mov qword [0x18002fcb0], 0
mov qword [0x18002fcb8], 0
mov qword [0x18002fcc0], 0
mov qword [0x18002fcc8], 0
mov qword [0x18002fcd0], 0
xor eax, eax
jmp 0x1800096ad
lea rdx, str.ImagehlpApiVersionEx
mov rcx, qword [0x18002fc98]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x18002fca0], rax
lea rdx, str.SymInitialize
mov rcx, qword [0x18002fc98]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x18002fca8], rax
lea rdx, str.SymSetOptions
mov rcx, qword [0x18002fc98]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x18002fcb0], rax
lea rdx, str.SymGetOptions
mov rcx, qword [0x18002fc98]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x18002fcb8], rax
lea rdx, str.SymLoadModule64
mov rcx, qword [0x18002fc98]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x18002fcc0], rax
lea rdx, str.SymGetModuleInfo64
mov rcx, qword [0x18002fc98]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x18002fcc8], rax
lea rdx, str.SymFromName
mov rcx, qword [0x18002fc98]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x18002fcd0], rax
mov r8d, 8
xor edx, edx
lea rcx, [rsp + 0x28]
call fcn.18000da10
mov eax, 0xc
mov word [rsp + 0x28], ax
cmp qword [0x18002fca0], 0
je 0x18000961e
cmp qword [0x18002fca8], 0
je 0x18000961e
cmp qword [0x18002fcc0], 0
je 0x18000961e
cmp qword [0x18002fcc8], 0
je 0x18000961e
cmp qword [0x18002fcd0], 0
jne 0x180009623
jmp 0x18000949e
lea rcx, [rsp + 0x28]
call qword [0x18002fca0]
movzx eax, word [rsp + 0x28]
cmp eax, 0xc
jge 0x18000963d
jmp 0x18000949e
xor r8d, r8d
xor edx, edx
mov rcx, qword [0x18002fc90]
call qword [0x18002fca8]
test eax, eax
jne 0x180009658
jmp 0x18000949e
cmp qword [0x18002fcb8], 0
je 0x180009698
cmp qword [0x18002fcb0], 0
je 0x180009698
call qword [0x18002fcb8]
mov dword [rsp + 0x20], eax
mov eax, dword [rsp + 0x20]
and eax, 0xfffffff8
mov dword [rsp + 0x20], eax
mov eax, dword [rsp + 0x20]
or eax, 0x2704
mov dword [rsp + 0x20], eax
mov ecx, dword [rsp + 0x20]
call qword [0x18002fcb0]
lea rax, [0x18002fc90]
mov qword [0x18002fcd8], rax
mov rax, qword [0x18002fcd8]
add rsp, 0x38
ret
Function at 0x180019ae4
Capabilities:
Query environment variable

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x40
call qword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor esi, esi
mov rbx, rax
test rax, rax
jne 0x180019b14
xor eax, eax
jmp 0x180019bd7
mov rbp, rbx
cmp word [rax], si
je 0x180019b39
or rax, 0xffffffffffffffff
inc rax
cmp word [rbp + rax*2], si
jne 0x180019b20
lea rbp, [rbp + rax*2]
add rbp, 2
cmp word [rbp], si
jne 0x180019b1c
mov qword [rsp + 0x38], rsi
sub rbp, rbx
mov qword [rsp + 0x30], rsi
add rbp, 2
sar rbp, 1
mov r8, rbx
mov r9d, ebp
mov dword [rsp + 0x28], esi
xor edx, edx
mov qword [rsp + 0x20], rsi
xor ecx, ecx
call fcn.180017e2c
movsxd r14, eax
test eax, eax
jne 0x180019b77
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
jmp 0x180019b0d
mov rcx, r14
call fcn.180015f7c
mov rdi, rax
test rax, rax
jne 0x180019b90
xor ecx, ecx
call fcn.180015f40
jmp 0x180019b6c
mov qword [rsp + 0x38], rsi
mov r9d, ebp
mov qword [rsp + 0x30], rsi
mov r8, rbx
mov dword [rsp + 0x28], r14d
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x20], rdi
call fcn.180017e2c
test eax, eax
jne 0x180019bc1
mov rcx, rdi
call fcn.180015f40
jmp 0x180019bcb
xor ecx, ecx
call fcn.180015f40
mov rsi, rdi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov rax, rsi
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x40
pop r14
ret
Function at 0x14006a914
Capabilities:
Read file on windows

Disassembly:
mov rax, rsp
push rbp
push rsi
push rdi
push r14
push r15
lea rbp, [rax - 0x178]
sub rsp, 0x250
mov qword [rbp - 0x70], 0xfffffffffffffffe
Function at 0x140005104
Capabilities:
Terminate process

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
mov ecx, 1
mov dword [0x140012e60], eax
call fcn.1400056f0
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
cmp dword [0x140012e60], 0
jne case.default.0x14000515a
mov ecx, 1
call fcn.1400056f0
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
mov edx, 0xc0000409
add rsp, 0x20
pop rbx
jmp qword [sym.imp.KERNEL32.dll_TerminateProcess]
movabs rdi, 0x9737788b6f9b21fb
mov ah, 0x49
movsd dword [rdi], dword [rsi]
out 0xf0, eax
jp 0x14001ad8a
sar dword [rbx - 0x734a0ad7], 1
movabs al, byte [0xfe7b55e77a9db8f7]
out dx, eax
cli
leave
jae 0x14001ad21
sbb ah, cl
int 0x7b
loope 0x14001ad6b
int 0x7b
mov r15d, 0x3ae697f7
stc
invalid
wait
sub dword [rax - 0x324cdc43], esi
cmp dh, byte [rbp - 0x25]
mov al, 0xbd
and esi, dword [rbx - 0x248ac533]
jbe 0x14001ad69
xchg edi, eax
adc dword [rsi + 0x29543ff3], edi
fidivr word [rdx]
out 0xc3, al
pop r11
sal dword [rbx - 0x682c043f], 0xe1
outsb dx, byte [rsi]
sub al, 0x27
xor eax, 0x76fa9f6b
xlatb
jmp 0x14001ad89
insd dword [rdi], dx
adc eax, 0xf03ad04b
jl 0x14001ad49
fcom qword [rcx + 0x32]
sbb dh, dh
add eax, 0xfd247b87
out dx, al
sub bh, ch
jb 0x14001ad47
out dx, al
mov edi, 0x6e13f0b8
jb 0x14001adbe
push rdi
jbe 0x14001adc2
pop rsi
enter 0xffffffffffffd1bf, 0x15
sti
std
mov edi, 0xfdfb15d1
mov ah, 0x5a
invalid
invalid
push rsi
sub bh, dh
movabs byte [0x3069bd5a9185d0f7], al
xchg ecx, eax
mov word [rbx + 0x75d13e2d], gs
adc eax, 0x142eddc4
jge 0x14001adad
invalid
Function at 0x180004a88
Capabilities:
Connect socket
Read file on windows
Resolve dns

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r14
push rbp
lea rbp, [rax - 0x468]
sub rsp, 0x560
mov rax, qword [0x180038008]
xor rax, rsp
mov qword [rbp + 0x450], rax
mov rbx, rcx
mov edi, 0x400
mov r8d, edi
lea rcx, [rbp + 0x50]
xor edx, edx
call fcn.18000ce00
lea rcx, [rbx + 0x218]
cmp qword [rcx + 0x18], 0x10
jb 0x180004ade
mov rcx, qword [rcx]
lea rdx, [0x180030484]
call fcn.180015278
mov qword [rbx + 0x238], rax
test rax, rax
jne 0x180004b00
mov rcx, rbx
call fcn.180005b20
jmp 0x180004b6a
mov r9, rax
lea rcx, [rbp + 0x50]
mov r8d, 1
mov rdx, rdi
call fcn.180016030
xor edx, edx
lea rcx, [rsp + 0x50]
mov r8d, 0x100
call fcn.18000ce00
lea rdx, [rbx + 0x1cc]
or r8, 0xffffffffffffffff
inc r8
cmp byte [rdx + r8], 0
jne 0x180004b32
lea r9, [rbp + 0x50]
mov dword [rsp + 0x20], 0xd0
lea rcx, [rsp + 0x50]
call fcn.180008240
lea rdx, [rbp + 0x50]
mov rcx, rbx
call fcn.180005f04
mov rcx, qword [rbx + 0x238]
call fcn.180015308
mov edx, 1
lea r14d, [rdx + 1]
mov ecx, r14d
lea r8d, [rdx + 5]
call qword [sym.imp.WS2_32.dll_socket]
mov qword [rbx + 0x258], rax
cmp rax, 0xffffffffffffffff
jne 0x180004b94
xor eax, eax
jmp 0x180004c60
lea rcx, [rbx + 0xd4]
mov word [rsp + 0x38], r14w
call qword [sym.imp.WS2_32.dll_gethostbyname]
test rax, rax
je 0x180004bcc
mov rdx, qword [rax + 0x18]
lea rcx, [rsp + 0x30]
movsx r8, word [rax + 0x12]
mov rdx, qword [rdx]
call fcn.18000aef0
mov eax, dword [rsp + 0x30]
mov dword [rsp + 0x3c], eax
jmp 0x180004be6
lea rcx, [rbx + 0x138]
call qword [sym.imp.WS2_32.dll_gethostbyname]
mov rcx, qword [rax + 0x18]
mov rax, qword [rcx]
mov ecx, dword [rax]
mov dword [rsp + 0x3c], ecx
movzx ecx, word [rbx + 0x1a0]
call qword [sym.imp.WS2_32.dll_htons]
mov word [rsp + 0x3a], ax
xor edi, edi
mov rcx, qword [rbx + 0x258]
lea rdx, [rsp + 0x38]
mov r8d, reloc.WS2_32.dll_recv
call qword [sym.imp.WS2_32.dll_connect]
cmp eax, 0xffffffff
jne 0x180004c52
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp edi, r14d
jne 0x180004c34
movzx ecx, word [rbx + 0x1a4]
call qword [sym.imp.WS2_32.dll_htons]
mov word [rsp + 0x3a], ax
mov ecx, 0x2710
call qword [sym.imp.KERNEL32.dll_Sleep]
inc edi
cmp edi, 3
jl 0x180004bfa
mov byte [rbx + 0x19c], 0
jmp 0x180004b8d
mov rax, qword [rbx + 0x258]
mov byte [rbx + 0x19c], 1
mov rcx, qword [rbp + 0x450]
xor rcx, rsp
call fcn.180009ba0
lea r11, [rsp + 0x560]
mov rbx, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov r14, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret
Function at 0x180004d6c
Capabilities:
Hash data with md5
Send data
Send data on socket

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
lea rbp, [rsp - 0x57]
sub rsp, 0xb0
mov rax, qword [0x180038008]
xor rax, rsp
mov qword [rbp + 0x47], rax
xor eax, eax
mov rbx, rcx
lea rcx, [rbp - 0x39]
mov qword [rbp - 0x39], rax
mov qword [rbp - 0x31], rax
lea edx, [rax + 0x10]
call fcn.1800081e4
movups xmm0, xmmword [rbp - 0x39]
and dword [rbp - 0x19], 0
lea rdx, [rbp - 0x39]
and dword [rbp - 0x15], 0
lea rcx, [rbp - 0x19]
mov r8d, reloc.WS2_32.dll_recv
mov dword [rbp - 0x11], 0x67452301
movdqu xmmword [rbx + 0x248], xmm0
mov dword [rbp - 0xd], 0xefcdab89
mov dword [rbp - 9], 0x98badcfe
mov dword [rbp - 5], 0x10325476
call fcn.180007748
lea rdx, [rbp - 0x29]
lea rcx, [rbp - 0x19]
call fcn.18000780c
mov rcx, qword [rbx + 0x258]
lea rdx, [rbp - 0x39]
xor r9d, r9d
lea r8d, [r9 + 0x20]
call qword [sym.imp.WS2_32.dll_send]
cmp eax, 0x20
sete al
mov rcx, qword [rbp + 0x47]
xor rcx, rsp
call fcn.180009ba0
mov rbx, qword [rsp + 0xc8]
add rsp, 0xb0
pop rbp
ret

Function at 0x180004e30
Capabilities:
Hash data with md5
Receive data
Receive data on socket

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rdi
push rbp
lea rbp, [rsp - 0x57]
sub rsp, 0xc0
mov rax, qword [0x180038008]
xor rax, rsp
mov qword [rbp + 0x47], rax
xor r9d, r9d
lea rdx, [rbp - 0x49]
mov rdi, rcx
mov rcx, qword [rcx + 0x258]
lea r8d, [r9 + 0x20]
call qword [sym.imp.WS2_32.dll_recv]
xor ebx, ebx
test eax, eax
jg 0x180004ea9
mov rcx, qword [rdi + 0x258]
lea edx, [rbx + 2]
call qword [sym.imp.WS2_32.dll_shutdown]
xor al, al
mov rcx, qword [rbp + 0x47]
xor rcx, rsp
call fcn.180009ba0
lea r11, [rsp + 0xc0]
mov rbx, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret
mov r8d, reloc.WS2_32.dll_recv
mov qword [rbp - 0x29], rbx
lea rdx, [rbp - 0x49]
mov dword [rbp - 0x21], 0x67452301
lea rcx, [rbp - 0x29]
mov dword [rbp - 0x1d], 0xefcdab89
mov dword [rbp - 0x19], 0x98badcfe
mov dword [rbp - 0x15], 0x10325476
call fcn.180007748
lea rdx, [rbp + 0x37]
lea rcx, [rbp - 0x29]
call fcn.18000780c
mov cl, byte [rbp + rbx - 0x39]
cmp byte [rbp + rbx + 0x37], cl
jne 0x180004e86
inc rbx
cmp rbx, 0x10
jl 0x180004ee9
mov al, 1
jmp 0x180004e88
Function at 0x180004f00
Capabilities:
Send data
Send data on socket

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r13
push r14
push r15
lea rbp, [rsp - 0x110]
sub rsp, 0x210
mov rax, qword [0x180038008]
xor rax, rsp
mov qword [rbp + 0x100], rax
mov r14, qword [rbp + 0x170]
lea rcx, [rbp]
mov rsi, qword [0x180039fe0]
mov r15, r8
mov ebx, edx
mov r8d, 0x100
xor edx, edx
mov edi, r9d
call fcn.18000ce00
mov rcx, qword [rsi]
xor edx, edx
mov r8d, 0xfa000
call fcn.18000ce00
xor edx, edx
mov dword [rsp + 0x30], ebx
mov r8d, 0xc8
mov dword [rsp + 0x34], edi
lea rcx, [rsp + 0x38]
xor r13d, r13d
call fcn.18000ce00
lea rcx, [rsp + 0x38]
test r14, r14
je 0x180004f9a
movsxd r8, dword [rbp + 0x178]
mov rdx, r14
call fcn.18000aef0
jmp 0x180004fa4
mov edx, 0xc8
call fcn.1800081e4
cmp ebx, 7
jne 0x180004fb3
cmp edi, 0x5001
cmove edi, r13d
lea rbx, [rsi + 0x248]
mov dword [rsp + 0x20], 0xd0
mov r14d, reloc.WS2_32.dll_recv
lea r9, [rsp + 0x30]
mov r8d, r14d
lea rcx, [rbp]
mov rdx, rbx
call fcn.180008240
xor edx, edx
lea rcx, [rbp]
mov r8d, 0x100
call fcn.18000ce00
mov r9, r15
mov dword [rsp + 0x20], edi
mov r8d, r14d
lea rcx, [rbp]
mov rdx, rbx
call fcn.180008240
mov rcx, qword [rsi]
lea rax, [rsp + 0x30]
movups xmm0, xmmword [rax]
lea edx, [r14 + 0x70]
movsxd r8, edi
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rcx], xmm0
movups xmm0, xmmword [rax + 0x20]
movups xmmword [rcx + 0x10], xmm1
movups xmm1, xmmword [rax + 0x30]
movups xmmword [rcx + 0x20], xmm0
movups xmm0, xmmword [rax + 0x40]
movups xmmword [rcx + 0x30], xmm1
movups xmm1, xmmword [rax + 0x50]
movups xmmword [rcx + 0x40], xmm0
movups xmm0, xmmword [rax + 0x60]
movups xmmword [rcx + 0x50], xmm1
movups xmmword [rcx + 0x60], xmm0
add rcx, rdx
movups xmm0, xmmword [rax + 0x70]
add rax, rdx
mov rdx, r15
movups xmmword [rcx - 0x10], xmm0
movups xmm1, xmmword [rax]
movups xmm0, xmmword [rax + 0x10]
movups xmmword [rcx], xmm1
movups xmm1, xmmword [rax + 0x20]
movups xmmword [rcx + 0x10], xmm0
movups xmm0, xmmword [rax + 0x30]
movups xmmword [rcx + 0x20], xmm1
movups xmm1, xmmword [rax + 0x40]
movups xmmword [rcx + 0x30], xmm0
movups xmmword [rcx + 0x40], xmm1
mov rcx, qword [rsi]
add rcx, 0xd0
call fcn.18000aef0
mov rdx, qword [rsi]
lea r8d, [rdi + 0xd0]
mov rcx, qword [rsi + 0x258]
xor r9d, r9d
call qword [sym.imp.WS2_32.dll_send]
mov rcx, rsi
mov ebx, eax
call fcn.18000616c
test ebx, ebx
jle 0x1800050ba
mov al, 1
jmp 0x1800050c4
mov rcx, rsi
call fcn.180004a4c
xor al, al
mov rcx, qword [rbp + 0x100]
xor rcx, rsp
call fcn.180009ba0
add rsp, 0x210
pop r15
pop r14
pop r13
pop rdi
pop rsi
pop rbx
pop rbp
ret