joyce8/EMBER2024-capa huggingface dataset:
Function at 0x18001bd30
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push rbx
sub rsp, 0x20
mov eax, dword [rcx + 0x10]
mov rbx, rcx
mov r11d, eax
mov r9d, eax
and r11d, 7
je 0x18001bd64
cmp eax, r11d
jge 0x18001bd55
call fcn.18001b1b0
mov eax, dword [rbx + 0x10]
mov ecx, r11d
shr dword [rbx + 0x14], cl
sub eax, r11d
mov dword [rbx + 0x10], eax
mov r9d, eax
xor r8d, r8d
test eax, eax
jle 0x18001bd94
mov ecx, dword [rbx + 0x14]
lea rdx, [rsp + 0x30]
movzx eax, byte [rbx + 0x14]
inc r8d
mov byte [rdx], al
lea rdx, [rdx + 1]
lea eax, [r9 - 8]
shr ecx, 8
mov dword [rbx + 0x14], ecx
mov r9d, eax
test eax, eax
jg 0x18001bd73
mov dword [rbx + 0x10], eax
jns 0x18001bdc1
mov edx, dword [0x180270e08]
mov rax, qword gs:[0x58]
mov ecx, reloc.WS2_32.dll_recv
mov rax, qword [rax + rdx*8]
lea rdx, [0x1801b76c0]
mov qword [rcx + rax], rdx
xor eax, eax
add rsp, 0x20
pop rbx
ret
movsxd rcx, r8d
cmp rcx, 4
jge 0x18001bdf0
mov r8, qword [rbx + 8]
mov rax, qword [rbx]
cmp rax, r8
jb 0x18001bdda
xor dl, dl
jmp 0x18001bde3
movzx edx, byte [rax]
inc rax
mov qword [rbx], rax
mov byte [rsp + rcx + 0x30], dl
inc rcx
cmp rcx, 4
jl 0x18001bdd1
movzx eax, byte [rsp + 0x30]
movzx r8d, byte [rsp + 0x31]
movzx ecx, byte [rsp + 0x33]
shl r8d, 8
add r8d, eax
shl ecx, 8
movzx eax, byte [rsp + 0x32]
add ecx, eax
mov eax, r8d
xor eax, 0xffff
cmp ecx, eax
je 0x18001be48
mov edx, dword [0x180270e08]
mov rax, qword gs:[0x58]
mov ecx, reloc.WS2_32.dll_recv
mov rax, qword [rax + rdx*8]
lea rdx, str.zlib_corrupt
mov qword [rcx + rax], rdx
xor eax, eax
add rsp, 0x20
pop rbx
ret
mov rcx, qword [rbx]
mov qword [rsp + 0x38], rdi
mov edi, r8d
add rcx, rdi
cmp rcx, qword [rbx + 8]
jbe 0x18001be8c
mov edx, dword [0x180270e08]
mov rax, qword gs:[0x58]
mov ecx, reloc.WS2_32.dll_recv
mov rax, qword [rax + rdx*8]
lea rdx, str.read_past_buffer
mov qword [rcx + rax], rdx
mov rdi, qword [rsp + 0x38]
xor eax, eax
add rsp, 0x20
pop rbx
ret
mov rdx, qword [rbx + 0x18]
lea rax, [r8 + rdx]
cmp rax, qword [rbx + 0x28]
jbe 0x18001bea6
mov rcx, rbx
call fcn.18001b3d0
test eax, eax
je 0x18001be7f
mov rdx, qword [rbx]
mov r8, rdi
mov rcx, qword [rbx + 0x18]
call fcn.18017b690
add qword [rbx], rdi
mov eax, 1
add qword [rbx + 0x18], rdi
mov rdi, qword [rsp + 0x38]
add rsp, 0x20
pop rbx
ret
Function at 0x180020f50
Capabilities:
Create directory

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x160
mov rax, qword [0x18025ed68]
xor rax, rsp
mov qword [rsp + 0x150], rax
mov rdi, rcx
mov qword [rsp + 0x20], rcx
xor r12d, r12d
mov ebx, r12d
lea r15, [0x1801b72d6]
inc rbx
mov rsi, rdi
mov rbp, qword [rdi + 0x18]
cmp rbp, 0x10
jb 0x180020fa3
mov rsi, qword [rdi]
mov r14, qword [rdi + 0x10]
cmp rbx, r14
jae 0x180021006
xor edx, edx
mov r8d, 0x100
lea rcx, [rsp + 0x50]
call fcn.18017baa0
lea rcx, [0x1801b72d4]
nop word [rax + rax]
movzx eax, byte [rcx]
mov byte [rsp + rax + 0x50], 1
inc rcx
cmp rcx, r15
jne 0x180020fd0
lea rcx, [r14 + rsi]
add rbx, rsi
cmp rbx, rcx
jae 0x180021006
nop dword [rax]
movzx eax, byte [rbx]
cmp byte [rsp + rax + 0x50], r12b
jne 0x180021111
inc rbx
cmp rbx, rcx
jb 0x180020ff0
mov rbx, 0xffffffffffffffff
mov qword [rsp + 0x38], r12
mov qword [rsp + 0x40], reloc.WS2_32.dll_ntohs
mov byte [rsp + 0x28], r12b
mov r8, rbx
cmp r14, rbx
cmovb r8, r14
mov rdx, rdi
cmp rbp, 0x10
jb 0x180021036
mov rdx, qword [rdi]
lea rcx, [rsp + 0x28]
call fcn.180009840
lea rcx, [rsp + 0x28]
cmp qword [rsp + 0x40], 0x10
cmovae rcx, qword [rsp + 0x28]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryA]
mov rdx, qword [rsp + 0x40]
cmp rdx, 0x10
jb 0x180021096
inc rdx
mov rcx, qword [rsp + 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180021091
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180021119
call fcn.18015ce94
cmp rbx, 0xffffffffffffffff
jne 0x180020f90
mov rdx, qword [rdi + 0x18]
cmp rdx, 0x10
jb 0x1800210d6
inc rdx
mov rcx, qword [rdi]
cmp rdx, 0x1000
jb 0x1800210d1
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x18002111f
mov rcx, r8
call fcn.18015ce94
mov qword [rdi + 0x10], r12
mov qword [rdi + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rdi], 0
mov rcx, qword [rsp + 0x150]
xor rcx, rsp
call fcn.18015d5d0
lea r11, [rsp + 0x160]
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret
sub rbx, rsi
jmp 0x18002100d
call fcn.18018023c
nop
call fcn.18018023c
int3

Function at 0x180021130
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push rbx
sub rsp, 0x60
mov rax, qword [0x18025ed68]
xor rax, rsp
mov qword [rsp + 0x50], rax
mov rbx, rcx
mov qword [rsp + 0x48], rcx
cmp qword [rcx + 0x18], 0x10
jb 0x180021157
mov rcx, qword [rcx]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x180021166
test al, 0x10
jne 0x18002117c
mov rdx, rbx
lea rcx, [rsp + 0x28]
call fcn.180006480
mov rcx, rax
call fcn.180020f50
nop
mov rdx, qword [rbx + 0x18]
cmp rdx, 0x10
jb 0x1800211b2
inc rdx
mov rcx, qword [rbx]
cmp rdx, 0x1000
jb 0x1800211ad
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x1800211d8
mov rcx, r8
call fcn.18015ce94
mov qword [rbx + 0x10], 0
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], 0
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.18015d5d0
add rsp, 0x60
pop rbx
ret
call fcn.18018023c
int3
Function at 0x1800211f0
Capabilities:
Enumerate files on windows

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r14
sub rsp, 0x1c0
mov rax, qword [0x18025ed68]
xor rax, rsp
mov qword [rsp + 0x1b0], rax
mov rbx, rdx
mov rdi, rcx
mov qword [rsp + 0x38], rcx
mov qword [rsp + 0x40], rdx
xor ebp, ebp
mov dword [rsp + 0x30], ebp
mov qword [rcx], rbp
mov qword [rcx + 8], rbp
mov qword [rcx + 0x10], rbp
mov dword [rsp + 0x30], 1
mov rcx, qword [rdx + 0x10]
mov rdx, qword [rdx + 0x18]
mov rax, rdx
sub rax, rcx
cmp rax, 2
jb 0x180021278
lea rax, [rcx + 2]
mov qword [rbx + 0x10], rax
mov rax, rbx
cmp rdx, 0x10
jb 0x180021268
mov rax, qword [rbx]
mov edx, 0x2a5c
mov word [rax + rcx], dx
mov byte [rax + rcx + 2], 0
jmp 0x1800212b5
mov qword [rsp + 0x20], 2
lea r9, [0x1801b72f4]
xor r8d, r8d
lea edx, [r8 + 2]
mov rcx, rbx
call fcn.180005920
cmp rbx, rax
je 0x1800212b5
mov rdx, rax
cmp qword [rax + 0x18], 0x10
jb 0x1800212a9
mov rdx, qword [rax]
mov r8, qword [rax + 0x10]
mov rcx, rbx
call fcn.180009840
mov rcx, rbx
cmp qword [rbx + 0x18], 0x10
jb 0x1800212c2
mov rcx, qword [rbx]
lea rdx, [rsp + 0x70]
call qword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov rsi, rax
cmp rax, 0xffffffffffffffff
je 0x1800213e9
mov r14d, 0x2e
movzx eax, byte [rsp + 0x9d]
movzx ecx, byte [rsp + 0x9c]
cmp r14b, cl
jne 0x180021316
cmp bpl, al
je 0x1800213c8
cmp r14b, cl
jne 0x180021316
cmp r14b, al
jne 0x180021316
cmp bpl, byte [rsp + 0x9e]
je 0x1800213c8
mov qword [rsp + 0x58], rbp
mov qword [rsp + 0x60], reloc.WS2_32.dll_ntohs
mov byte [rsp + 0x48], 0
lea rax, [rsp + 0x9c]
mov r8, 0xffffffffffffffff
nop dword [rax + rax]
inc r8
cmp byte [rax + r8], 0
jne 0x180021340
lea rdx, [rsp + 0x9c]
lea rcx, [rsp + 0x48]
call fcn.180009840
mov rax, qword [rdi + 8]
cmp rax, qword [rdi + 0x10]
je 0x18002137a
lea rdx, [rsp + 0x48]
mov rcx, rax
call fcn.180006480
add qword [rdi + 8], 0x20
jmp 0x18002138b
lea r8, [rsp + 0x48]
mov rdx, rax
mov rcx, rdi
call fcn.180023db0
nop
mov rdx, qword [rsp + 0x60]
cmp rdx, 0x10
jb 0x1800213c8
inc rdx
mov rcx, qword [rsp + 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800213c3
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180021459
call fcn.18015ce94
lea rdx, [rsp + 0x70]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FindNextFileA]
cmp eax, 1
je 0x1800212e0
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_FindClose]
nop
mov rdx, qword [rbx + 0x18]
cmp rdx, 0x10
jb 0x18002141f
inc rdx
mov rcx, qword [rbx]
cmp rdx, 0x1000
jb 0x18002141a
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x18002145f
mov rcx, r8
call fcn.18015ce94
mov qword [rbx + 0x10], rbp
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rbx], 0
mov rax, rdi
mov rcx, qword [rsp + 0x1b0]
xor rcx, rsp
call fcn.18015d5d0
lea r11, [rsp + 0x1c0]
mov rbx, qword [r11 + 0x30]
mov rbp, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop rdi
pop rsi
ret
call fcn.18018023c
nop
call fcn.18018023c
int3
Function at 0x180025210
Capabilities:
Encrypt data using rc4 prga

Disassembly:
sub rsp, 0x28
mov r8, rdx
mov r11, rcx
test rdx, rdx
jne 0x18002522e
mov rcx, qword [rcx]
mov dl, 0x30
mov rax, qword [rcx]
add rsp, 0x28
jmp qword [rax]
mov qword [rsp + 0x30], rbx
lea r9, [rcx + 0x10]
mov qword [rsp + 0x20], rdi
test rdx, rdx
jns 0x18002534d
mov rax, rdx
mov byte [rcx + 0x10], 0x2d
cqo
mov ecx, 1
mov r8, rax
xor r8, rdx
sub r8, rdx
mov rdx, r8
cmp r8, 0xa
jb 0x1800252a7
movabs r10, 0x346dc5d63886594b
nop
cmp rdx, 0x64
jb 0x180025346
cmp rdx, 0x3e8
jb 0x18002533e
cmp rdx, 0x2710
jb 0x180025336
mov rax, r10
add ecx, 4
mul rdx
shr rdx, 0xb
cmp rdx, 0xa
jae 0x180025270
inc ecx
mov r10d, ecx
lea rdi, [0x1801ba530]
add r9, r10
cmp r8, 0x64
jb 0x180025312
mov qword [rsp + 0x38], rsi
movabs rsi, 0x47ae147ae147ae15
nop dword [rax + rax]
mov rcx, r8
mov rax, rsi
mul r8
sub r8, rdx
shr r8, 1
add r8, rdx
shr r8, 6
imul rax, r8, 0x64
sub rcx, rax
mov eax, ecx
lea rcx, [rax + rax]
movzx eax, byte [rcx + rdi + 1]
mov byte [r9 - 1], al
add r9, 0xfffffffffffffffe
movzx eax, byte [rcx + rdi]
mov byte [r9], al
cmp r8, 0x64
jae 0x1800252d0
mov rsi, qword [rsp + 0x38]
cmp r8, 0xa
jb 0x1800253aa
mov eax, r8d
lea rcx, [rax + rax]
movzx eax, byte [rcx + rdi + 1]
mov byte [r9 - 1], al
movzx eax, byte [rcx + rdi]
mov byte [r9 - 2], al
jmp 0x1800253b2
add ecx, 3
jmp 0x1800252a7
add ecx, 2
jmp 0x1800252a7
inc ecx
jmp 0x1800252a7
mov ecx, 1
cmp rdx, 0xa
jb 0x1800252a9
movabs r10, 0x346dc5d63886594b
cmp rdx, 0x64
jb 0x1800252a7
cmp rdx, 0x3e8
jb 0x1800253a2
cmp rdx, 0x2710
jb 0x18002539a
mov rax, r10
add ecx, 4
mul rdx
shr rdx, 0xb
cmp rdx, 0xa
jae 0x180025366
jmp 0x1800252a9
add ecx, 3
jmp 0x1800252a9
add ecx, 2
jmp 0x1800252a9
add r8b, 0x30
mov byte [r9 - 1], r8b
mov rcx, qword [r11]
lea rdx, [r11 + 0x10]
mov r8, r10
mov rax, qword [rcx]
mov rdi, qword [rsp + 0x20]
mov rbx, qword [rsp + 0x30]
add rsp, 0x28
jmp qword [rax + reloc.WS2_32.dll_htonl]
Function at 0x1800344e0
Capabilities:
Resolve dns

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x80
mov rax, qword [0x18025ed68]
xor rax, rsp
mov qword [rsp + 0x70], rax
mov r14, rdx
mov rsi, rcx
mov qword [rsp + 0x60], rcx
mov qword [rsp + 0x68], rdx
xor r15d, r15d
mov dword [rsp + 0x20], r15d
call fcn.180036550
mov qword [rsi], r15
mov qword [rsi + 8], r15
lea ecx, [r15 + 0x20]
call fcn.18015ce58
mov qword [rax], rax
mov qword [rax + 8], rax
mov qword [rax + 0x10], rax
mov word [rax + 0x18], 0x101
mov qword [rsi], rax
mov dword [rsp + 0x20], 1
mov qword [rsp + 0x28], r15
mov rcx, r14
cmp qword [r14 + 0x18], 0x10
jb 0x180034563
mov rcx, qword [r14]
lea r9, [rsp + 0x28]
xor r8d, r8d
xor edx, edx
call qword [sym.imp.WS2_32.dll_getaddrinfo]
test eax, eax
jne 0x180034659
mov rdi, qword [rsp + 0x28]
test rdi, rdi
je 0x180034659
movabs r12, 0x7ffffffffffffff
cmp dword [rdi + 4], 2
jne 0x18003464c
mov rax, qword [rdi + 0x20]
mov ecx, dword [rax + 4]
call qword [sym.imp.WS2_32.dll_ntohl]
mov ebx, eax
mov rbp, qword [rsi]
mov rax, qword [rbp + 8]
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x38], r15d
mov rcx, rbp
cmp byte [rax + 0x19], 0
jne 0x1800345ef
mov qword [rsp + 0x30], rax
cmp dword [rax + 0x1c], ebx
jae 0x1800345db
mov dword [rsp + 0x38], r15d
mov rax, qword [rax + 0x10]
jmp 0x1800345e9
mov dword [rsp + 0x38], 1
mov rcx, rax
mov rax, qword [rax]
cmp byte [rax + 0x19], 0
je 0x1800345c6
cmp byte [rcx + 0x19], 0
jne 0x1800345fa
cmp ebx, dword [rcx + 0x1c]
jae 0x18003464c
cmp qword [rsi + 8], r12
je 0x1800346cb
mov qword [rsp + 0x50], rsi
mov qword [rsp + 0x58], r15
mov ecx, 0x20
call fcn.18015ce58
nop
mov dword [rax + 0x1c], ebx
mov qword [rax], rbp
mov qword [rax + 8], rbp
mov qword [rax + 0x10], rbp
mov word [rax + 0x18], 0
mov qword [rsp + 0x58], r15
movups xmm0, xmmword [rsp + 0x30]
movaps xmmword [rsp + 0x30], xmm0
mov r8, rax
lea rdx, [rsp + 0x30]
mov rcx, rsi
call fcn.180008440
mov rdi, qword [rdi + 0x28]
test rdi, rdi
jne 0x180034593
mov rdx, qword [r14 + 0x18]
cmp rdx, 0x10
jb 0x18003468f
inc rdx
mov rcx, qword [r14]
cmp rdx, 0x1000
jb 0x18003468a
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x1800346d1
mov rcx, r8
call fcn.18015ce94
mov qword [r14 + 0x10], r15
mov qword [r14 + 0x18], reloc.WS2_32.dll_ntohs
mov byte [r14], 0
mov rax, rsi
mov rcx, qword [rsp + 0x70]
xor rcx, rsp
call fcn.18015d5d0
lea r11, [rsp + 0x80]
mov rbx, qword [r11 + 0x40]
mov rbp, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r12
pop rdi
pop rsi
ret
call fcn.180008af0
nop
call fcn.18018023c
int3
Function at 0x180036550
Capabilities:
Initialize winsock library

Disassembly:
sub rsp, 0x1d8
mov rax, qword [0x18025ed68]
xor rax, rsp
mov qword [rsp + 0x1c0], rax
cmp byte [0x180264ac0], 0
jne 0x1800365c5
mov ecx, 0x202
lea rdx, [rsp + 0x20]
call qword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
jne 0x1800365c5
mov qword [rsp + 0x1d0], rbx
lea ebx, [rax + 0xa]
nop dword [rax]
nop word [rax + rax]
mov ecx, 0x202
lea rdx, [rsp + 0x20]
call qword [sym.imp.WS2_32.dll_WSAStartup]
sub rbx, 1
jne 0x1800365a0
mov rbx, qword [rsp + 0x1d0]
mov byte [0x180264ac0], 1
mov rcx, qword [rsp + 0x1c0]
xor rcx, rsp
call fcn.18015d5d0
add rsp, 0x1d8
ret

Function at 0x180036600
Capabilities:
Send data
Send data on socket

Disassembly:
sub rsp, 0xc8
mov rax, qword [0x18025ed68]
xor rax, rsp
mov qword [rsp + 0xb0], rax
mov dword [rsp + 0x34], edx
mov rax, r8
shr rdx, 0x20
mov r8d, 2
mov word [rsp + 0x32], dx
mov r10d, r9d
lea rdx, [rsp + 0x30]
mov word [rsp + 0x30], r8w
mov dword [rsp + 0x28], reloc.WS2_32.dll_recv
xor r9d, r9d
mov qword [rsp + 0x20], rdx
mov r8d, r10d
mov rdx, rax
mov ecx, ecx
call qword [sym.imp.WS2_32.dll_sendto]
mov rcx, qword [rsp + 0xb0]
xor rcx, rsp
call fcn.18015d5d0
add rsp, 0xc8
ret
Function at 0x180036710
Capabilities:
Send data
Send data on socket

Disassembly:
push rbx
push rbp
push rsi
push r12
push r14
sub rsp, 0xf0
mov rax, qword [0x18025ed68]
xor rax, rsp
mov qword [rsp + 0xc0], rax
cmp dword [0x18022c54c], 0
mov ebp, r9d
mov rsi, r8
mov r12d, ecx
movzx r14d, dx
jl 0x18003675f
movsd xmm1, qword [0x1801bb8f0]
mov rcx, qword [0x180264ac8]
call fcn.1800016b0
test al, al
je 0x1800367b4
movzx ecx, r14w
call fcn.1800361b0
mov r8d, dword [0x18022c54c]
lea rdx, [0x180264a80]
lea rcx, [0x180264a40]
call fcn.180002a30
call fcn.18015a360
mov rbx, rax
call fcn.18015a344
cqo
idiv rbx
mov rcx, rax
imul rax, rdx, 0x3b9aca00
imul rcx, rcx, 0x3b9aca00
cqo
idiv rbx
add rax, rcx
mov qword [0x180264ac8], rax
mov dword [rsp + 0x30], 0xffffffff
mov r9d, ebp
mov word [rsp + 0x34], r14w
mov r8, rsi
mov rdx, qword [rsp + 0x30]
mov ecx, r12d
call fcn.180036600
mov eax, dword [0x18022c54c]
test eax, eax
je 0x1800368c9
mov qword [rsp + 0xe8], rdi
xor edi, edi
mov qword [rsp + 0xe0], r13
mov qword [rsp + 0xd8], r15
lea r13d, [rdi + 2]
test eax, eax
jle 0x180036858
lea rbx, [0x1802649c0]
nop dword [rax]
mov rax, qword [rbx]
xor r9d, r9d
mov dword [rsp + 0x44], eax
mov r8d, ebp
shr rax, 0x20
mov rdx, rsi
mov word [rsp + 0x42], ax
mov rcx, r12
lea rax, [rsp + 0x40]
mov dword [rsp + 0x28], reloc.WS2_32.dll_recv
mov qword [rsp + 0x20], rax
mov word [rsp + 0x40], r13w
call qword [sym.imp.WS2_32.dll_sendto]
inc edi
lea rbx, [rbx + 8]
cmp edi, dword [0x18022c54c]
jl 0x180036810
mov rax, qword [rsp + 0x140]
mov rdi, qword [rax + 8]
mov rbx, qword [rax]
cmp rbx, rdi
je 0x1800368af
nop dword [rax]
mov eax, dword [rbx]
xor r9d, r9d
mov dword [rsp + 0x44], eax
mov r8d, ebp
lea rax, [rsp + 0x40]
mov dword [rsp + 0x28], reloc.WS2_32.dll_recv
mov rdx, rsi
mov qword [rsp + 0x20], rax
mov rcx, r12
mov word [rsp + 0x40], r13w
mov word [rsp + 0x42], r14w
call qword [sym.imp.WS2_32.dll_sendto]
add rbx, 4
cmp rbx, rdi
jne 0x180036870
mov r15, qword [rsp + 0xd8]
mov al, 1
mov r13, qword [rsp + 0xe0]
mov rdi, qword [rsp + 0xe8]
mov rcx, qword [rsp + 0xc0]
xor rcx, rsp
call fcn.18015d5d0
add rsp, 0xf0
pop r14
pop r12
pop rsi
pop rbp
pop rbx
ret

Function at 0x1800368f0
Capabilities:
Set socket configuration

Disassembly:
push rbx
sub rsp, 0x30
mov ebx, ecx
lea r9, [rsp + 0x40]
mov ecx, ecx
mov edx, 0xffff
mov r8d, 0x1002
mov dword [rsp + 0x40], 0x100000
mov dword [rsp + 0x20], 4
call qword [sym.imp.WS2_32.dll_setsockopt]
lea r9, [rsp + 0x40]
mov dword [rsp + 0x20], 4
mov edx, 0xffff
mov r8d, 0x1001
mov ecx, ebx
call qword [sym.imp.WS2_32.dll_setsockopt]
add rsp, 0x30
pop rbx
ret
Function at 0x180036b10
Capabilities:
Send data
Send data on socket

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x20
mov rbp, rcx
mov rsi, rdx
mov rcx, rdx
call fcn.180097b10
mov ebx, dword [rbp + 0x28]
lea rcx, [rbp + 0x20]
sub ebx, dword [rbp + 0x20]
mov rdi, rax
mov edx, eax
add rdx, 4
add rdx, rbx
call fcn.18000a640
mov rcx, qword [rbp + 0x20]
mov r8d, edi
mov dword [rbx + rcx], edi
mov rcx, rsi
mov rdx, qword [rbp + 0x20]
add rdx, 4
add rdx, rbx
call fcn.180155b70
mov rdx, qword [rbp + 0x20]
mov rax, qword [rbp + 0x28]
sub rax, rdx
je 0x180036bb9
mov ecx, dword [rbp]
xor r9d, r9d
mov r8d, eax
call qword [sym.imp.WS2_32.dll_send]
test eax, eax
jle 0x180036bb9
mov rdi, qword [rbp + 0x20]
movsxd rdx, eax
add rdx, rdi
cmp rdi, rdx
je 0x180036bb9
mov rbx, qword [rbp + 0x28]
mov rcx, rdi
sub rbx, rdx
mov r8, rbx
call fcn.18017b690
lea rax, [rbx + rdi]
mov qword [rbp + 0x28], rax
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret

Function at 0x180036cc0
Capabilities:
Receive data
Receive data on socket
Set socket configuration

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x20
mov eax, dword [rcx]
mov rbx, rcx
cmp eax, 0xffffffff
je 0x180036d32
mov ecx, eax
mov dword [rsp + 0x30], 0
lea r8, [rsp + 0x30]
mov edx, 0x4004667f
call qword [sym.imp.WS2_32.dll_ioctlsocket]
mov esi, dword [rbx + 0x10]
lea rcx, [rbx + 8]
sub esi, dword [rbx + 8]
mov r14d, dword [rsp + 0x30]
lea edx, [r14 + rsi]
call fcn.18000a640
test r14d, r14d
je 0x180036d32
mov ecx, dword [rbx]
xor r9d, r9d
mov edx, esi
mov r8d, r14d
add rdx, qword [rbx + 8]
call qword [sym.imp.WS2_32.dll_recv]
mov al, 1
mov byte [rbx + 4], 1
jmp 0x180036d34
xor al, al
mov rbx, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
Function at 0x180047ae0
Capabilities:
Create thread

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
push r14
sub rsp, 0x60
movzx edi, r8b
movzx esi, dl
mov rbx, rcx
lea r14, [0x1802648a0]
mov qword [rax + 0x20], r14
mov rcx, r14
call fcn.18015a800
test eax, eax
jne 0x180047c50
cmp dword [rbx + 0x228], eax
jne 0x180047b93
lea ecx, [rax + 0x10]
call fcn.18015ce58
test rax, rax
je 0x180047b3d
mov qword [rax], rbx
lea rcx, [0x180047dd0]
mov qword [rax + 8], rcx
mov qword [rsp + 0x30], rax
lea rcx, [rsp + 0x48]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], 0
mov r9, rax
lea r8, [0x18004c4a0]
xor edx, edx
xor ecx, ecx
call fcn.18018bfc0
mov qword [rsp + 0x40], rax
test rax, rax
je 0x180047c3d
cmp dword [rbx + 0x228], 0
jne 0x180047c37
movaps xmm0, xmmword [rsp + 0x40]
movaps xmmword [rsp + 0x50], xmm0
movups xmmword [rbx + 0x220], xmm0
mov rcx, qword [rbx + 0x70]
call fcn.180034b50
mov rcx, qword [rbx + 0xd8]
call fcn.180084d20
mov rcx, qword [rbx + 0xb0]
call fcn.18007e020
mov rcx, qword [rbx + 0x1a8]
call fcn.180082830
test sil, sil
je 0x180047bd1
mov rcx, qword [rbx + 0x80]
call fcn.18007e290
test dil, dil
je 0x180047bdf
mov rcx, qword [rbx + 0x78]
call fcn.18007e290
mov rcx, qword [rbx + 0x88]
call fcn.18007e170
mov rcx, qword [rbx + 0x90]
call fcn.18007e170
call fcn.18015a460
mov rdx, rax
movabs rax, 0xd6bf94d5e57a42bd
mul rdx
shr rdx, 0x17
xchg qword [rbx + 0x238], rdx
mov rcx, r14
mov rbx, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
mov rdi, qword [rsp + 0x80]
add rsp, 0x60
pop r14
jmp fcn.18015a824
call fcn.18018be74
nop
mov dword [rsp + 0x48], 0
mov ecx, 6
call fcn.18015b3b4
nop
mov ecx, eax
call fcn.18015b378
int3

Function at 0x180054380
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov rcx, qword [rcx + 0x88]
jmp 0x180116690
mov dl, 1
jmp fcn.1801166c0

Function at 0x18005438c
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub rcx, 8
jmp method.Steam_Friends.2.virtual_200

Function at 0x180054398
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub rcx, 0x10
jmp method.Steam_Friends.2.virtual_200

Function at 0x1800543a4
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub rcx, 0x18
jmp method.Steam_Friends.2.virtual_200

Function at 0x1800543b0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub rcx, 0x20
jmp method.Steam_Friends.2.virtual_200

Function at 0x1800543bc
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub rcx, 0x28
jmp method.Steam_Friends.2.virtual_200

Function at 0x1800543c8
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub rcx, 0x30
jmp method.Steam_Friends.2.virtual_200

Function at 0x1800543d4
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub rcx, 0x38
jmp method.Steam_Friends.2.virtual_200

Function at 0x1800543e0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub rcx, 0x40
jmp method.Steam_Friends.2.virtual_200

Function at 0x1800543ec
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub rcx, 0x48
jmp method.Steam_Friends.2.virtual_200
Function at 0x1800543f8
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub rcx, 0x50
jmp method.Steam_Friends.2.virtual_200

Function at 0x180054404
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub rcx, 0x58
jmp method.Steam_Friends.2.virtual_200
Function at 0x18007524c
Capabilities:
Resolve dns

Disassembly:
sub rcx, 8
jmp method.Steam_Networking_Utils.virtual_144

Function at 0x180075258
Capabilities:
Convert ip address from string
Resolve dns

Disassembly:
sub rcx, 0x10
jmp method.Steam_Networking_Utils.virtual_144

Function at 0x18009a560
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
lea ecx, [rcx*8]
mov rsi, r9
or ecx, 2
lea r10, [r8 + 1]
mov rdi, rdx
cmp ecx, 0x80
jae 0x18009a590
mov byte [r8], cl
jmp 0x18009a5cc
movzx eax, cl
shr ecx, 7
or al, 0x80
mov byte [r8], al
cmp ecx, 0x80
jae 0x18009a5b0
mov byte [r10], cl
lea r10, [r8 + 2]
jmp 0x18009a5cc
movzx eax, cl
shr ecx, 7
or al, 0x80
mov byte [r10], al
inc r10
cmp ecx, 0x80
jae 0x18009a5b0
mov byte [r10], cl
inc r10
mov ecx, dword [rdx + 0x14]
lea rbx, [r10 + 1]
cmp ecx, 0x80
jae 0x18009a5e0
mov byte [r10], cl
jmp 0x18009a61a
movzx eax, cl
shr ecx, 7
or al, 0x80
mov byte [r10], al
cmp ecx, 0x80
jae 0x18009a600
mov byte [rbx], cl
lea rbx, [r10 + 2]
jmp 0x18009a61a
movzx eax, cl
shr ecx, 7
or al, 0x80
mov byte [rbx], al
inc rbx
cmp ecx, 0x80
jae 0x18009a600
mov byte [rbx], cl
inc rbx
mov edx, dword [rdx + 0x10]
test edx, edx
je 0x18009a647
cmp rbx, qword [r9]
jb 0x18009a637
mov rdx, rbx
mov rcx, rsi
call fcn.180157a60
mov edx, dword [rdi + 0x10]
mov rbx, rax
mov r8, rbx
mov ecx, 1
call fcn.18009e660
mov rbx, rax
test byte [rdi + 8], 1
je 0x18009a6ae
mov rdx, qword [rdi + 8]
mov rax, rdx
and rdx, 0xfffffffffffffffe
and rax, 0xfffffffffffffffe
cmp qword [rdx + 0x18], 0x10
jb 0x18009a666
mov rdx, qword [rdx]
movsxd r8, dword [rax + 0x10]
mov rax, qword [rsi]
mov rdi, r8
sub rax, rbx
cmp rax, r8
jge 0x18009a692
mov r9, rbx
mov rcx, rsi
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
jmp fcn.180157d00
mov rcx, rbx
call fcn.18017b690
lea rax, [rdi + rbx]
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret
mov rsi, qword [rsp + 0x38]
mov rax, rbx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret