joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1800148f4
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x50
mov rdi, qword [rdx]
mov rbp, rcx
mov ecx, dword [0x1800c6a88]
mov rbx, r8
mov rsi, rdx
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
jmp 0x18001492b
cmp qword [rax], rdi
je 0x18001494c
mov rax, qword [rax + 0x10]
test rax, rax
jne 0x180014922
mov ecx, dword [0x1800c6a7c]
mov qword [rsp + 0x30], rbx
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
je 0x180014966
mov rdx, qword [rax + 8]
jmp 0x180014968
cmp qword [rax + 8], 0
je 0x180014930
nop
mov rcx, qword [rbx + 0x38]
test rcx, rcx
je 0x1800149c4
mov rax, qword [rcx]
call qword [rax + select]
nop
jmp 0x1800149af
xor edx, edx
mov cl, byte [rsp + 0x68]
mov r9d, 8
lea r8d, [r9 + 0x78]
call fcn.180012960
lea r8, [rsp + 0x20]
mov rdx, rbx
mov rcx, rax
call fcn.18001a5a8
and qword [rsp + 0x40], 0
mov r8, rax
and qword [rsp + 0x38], 0
mov rdx, rsi
mov rcx, rbp
call fcn.180030f98
lea rcx, [rsp + 0x30]
call fcn.180046958
mov rbx, qword [rsp + 0x60]
mov rbp, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
add rsp, 0x50
pop rdi
ret
call fcn.180050950
int3

Function at 0x18001bffc
Capabilities:
Initialize winsock library

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x1d0
mov dil, dl
mov rbx, rcx
mov eax, 1
lock xadd dword [0x1800c69f8], eax
inc eax
cmp eax, 1
jne 0x18001c039
mov ecx, 0x202
lea rdx, [rsp + 0x30]
call qword [sym.imp.WS2_32.dll_WSAStartup]
xchg dword [0x1800c69fc], eax
test dil, dil
je 0x18001c04c
xor eax, eax
lock xadd dword [0x1800c69fc], eax
test eax, eax
jne 0x18001c060
mov rax, rbx
mov rbx, qword [rsp + 0x1e0]
add rsp, 0x1d0
pop rdi
ret
mov dword [rsp + 0x20], eax
call fcn.1800030bc
lea rdx, str.winsock
mov qword [rsp + 0x28], rax
lea rcx, [rsp + 0x20]
call fcn.180002cc0
int3

Function at 0x180023368
Capabilities:
Encode data using xor

Disassembly:
xor r9d, r9d
test r8, r8
je 0x18002338f
mov eax, r9d
and al, 1
neg al
sbb cl, cl
inc r9d
and cl, 0xdb
movsxd rax, r9d
add cl, 0x5e
xor byte [rdx], cl
inc rdx
cmp rax, r8
jb 0x180023370
ret

Function at 0x180023390
Capabilities:
Encode data using add xor sub operations
Encode data using xor

Disassembly:
xor r9d, r9d
mov r10, rdx
test r8, r8
je 0x1800233d3
mov ecx, r9d
mov eax, 0x44d72045
imul r9d
inc r9d
sar edx, 5
mov eax, edx
shr eax, 0x1f
add edx, eax
imul eax, edx, 0x77
sub ecx, eax
movsxd rax, ecx
lea rcx, [0x1800c10f0]
mov al, byte [rax + rcx]
xor byte [r10], al
inc r10
movsxd rax, r9d
cmp rax, r8
jb 0x18002339b
ret
Function at 0x18002b9e8
Capabilities:
Resolve dns

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
mov rax, qword [rdx + 8]
mov rsi, rcx
xor ecx, ecx
mov rbx, r9
mov rdi, r8
test rax, rax
je 0x18002ba57
cmp dword [rax + 8], ecx
je 0x18002ba57
test r8, r8
je 0x18002ba1a
cmp byte [r8], cl
jne 0x18002ba1d
mov rdi, rcx
test rbx, rbx
je 0x18002ba27
cmp byte [r9], cl
jne 0x18002ba2a
mov rbx, rcx
call qword [sym.imp.WS2_32.dll_WSASetLastError]
mov r9, qword [rsp + 0x68]
mov rdx, rbx
mov r8, qword [rsp + 0x60]
mov rcx, rdi
call qword [sym.imp.WS2_32.dll_getaddrinfo]
mov edx, eax
lea rcx, [rsp + 0x20]
call fcn.18004be88
movups xmm0, xmmword [rax]
jmp 0x18002ba6e
mov dword [rsp + 0x20], 0x3e3
call fcn.1800030bc
mov qword [rsp + 0x28], rax
movups xmm0, xmmword [rsp + 0x20]
mov rax, qword [rsp + 0x70]
mov rbx, qword [rsp + 0x40]
movdqu xmmword [rsi], xmm0
movdqu xmmword [rax], xmm0
mov rax, rsi
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
Function at 0x18002ba90
Capabilities:
Encode data using base64

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov rbp, rsp
sub rsp, 0x20
and qword [rcx], 0
xor edi, edi
and qword [rcx + 0x10], 0
mov r14, r8
mov qword [rcx + 0x18], reloc.WS2_32.dll_ntohs
mov r13, rdx
mov rbx, rcx
test r8, r8
je 0x18002bcc6
xor ecx, ecx
lea esi, [rdi + 3]
mov al, byte [r13]
dec r14
mov byte [rbp + rcx + 0x40], al
inc r13
mov dl, byte [rbp + 0x42]
inc rcx
mov r15b, byte [rbp + 0x41]
inc edi
mov r12b, byte [rbp + 0x40]
cmp rcx, rsi
jne 0x18002bb9c
mov al, r12b
mov cl, r12b
shr al, 2
and cl, sil
mov byte [rbp + 0x50], al
mov al, r15b
shr al, 4
shl cl, 4
add cl, al
mov al, dl
mov byte [rbp + 0x51], cl
mov cl, r15b
shr al, 6
and cl, 0xf
shl cl, 2
add cl, al
mov al, dl
and al, 0x3f
mov byte [rbp + 0x52], cl
mov byte [rbp + 0x53], al
xor edi, edi
cmp qword [reloc.WS2_32.dll_ntohs], 0x10
lea rcx, [0x1800c1188]
movzx eax, byte [rbp + rdi + 0x50]
cmovae rcx, qword [0x1800c1188]
mov r9b, byte [rax + rcx]
mov rcx, qword [rbx + 0x10]
cmp rcx, qword [rbx + 0x18]
jae 0x18002bb7b
cmp qword [rbx + 0x18], 0x10
lea rax, [rcx + 1]
mov qword [rbx + 0x10], rax
mov rax, rbx
jb 0x18002bb70
mov rax, qword [rbx]
mov byte [rax + rcx], r9b
mov byte [rax + rcx + 1], 0
jmp 0x18002bb8c
mov r8b, byte [rbp + 0x40]
mov edx, 1
mov rcx, rbx
call fcn.180011fd0
inc rdi
cmp rdi, 4
jl 0x18002bb31
mov dl, byte [rbp + 0x42]
xor edi, edi
xor ecx, ecx
test r14, r14
jne 0x18002bad1
test edi, edi
je 0x18002bcc6
cmp edi, esi
jge 0x18002bbd4
mov eax, esi
lea rcx, [rbp + 0x40]
sub eax, edi
xor edx, edx
movsxd r8, eax
movsxd rax, edi
add rcx, rax
call fcn.180056d30
mov dl, byte [rbp + 0x42]
mov r15b, byte [rbp + 0x41]
mov r12b, byte [rbp + 0x40]
mov al, r12b
and r12b, sil
shr al, 2
mov byte [rbp + 0x50], al
mov al, r15b
shr al, 4
and r15b, 0xf
shl r15b, 2
shl r12b, 4
add r12b, al
mov al, dl
shr al, 6
and dl, 0x3f
add r15b, al
mov byte [rbp + 0x51], r12b
lea eax, [rdi + 1]
mov byte [rbp + 0x52], r15b
mov byte [rbp + 0x53], dl
movsxd r15, eax
test eax, eax
jle 0x18002bc7c
xor r14d, r14d
cmp qword [reloc.WS2_32.dll_ntohs], 0x10
lea rcx, [0x1800c1188]
movzx eax, byte [rbp + r14 + 0x50]
cmovae rcx, qword [0x1800c1188]
mov r9b, byte [rax + rcx]
mov rcx, qword [rbx + 0x10]
cmp rcx, qword [rbx + 0x18]
jae 0x18002bc63
cmp qword [rbx + 0x18], 0x10
lea rax, [rcx + 1]
mov qword [rbx + 0x10], rax
mov rax, rbx
jb 0x18002bc58
mov rax, qword [rbx]
mov byte [rax + rcx], r9b
mov byte [rax + rcx + 1], 0
jmp 0x18002bc74
mov r8b, byte [rbp + 0x40]
mov edx, 1
mov rcx, rbx
call fcn.180011fd0
inc r14
cmp r14, r15
jl 0x18002bc18
cmp edi, esi
jge 0x18002bcc6
sub esi, edi
movsxd rdi, esi
mov rcx, qword [rbx + 0x10]
cmp rcx, qword [rbx + 0x18]
jae 0x18002bcac
cmp qword [rbx + 0x18], 0x10
lea rax, [rcx + 1]
mov qword [rbx + 0x10], rax
mov rax, rbx
jb 0x18002bca4
mov rax, qword [rbx]
mov word [rax + rcx], 0x3d
jmp 0x18002bcc0
mov r8b, byte [rbp + 0x40]
mov r9b, 0x3d
mov edx, 1
mov rcx, rbx
call fcn.180011fd0
sub rdi, 1
jne 0x18002bc85
mov rax, rbx
mov rbx, qword [rsp + 0x68]
add rsp, 0x20
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
Function at 0x18002bf54
Capabilities:
Hash data using sha1

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r14
push r15
lea rbp, [rsp - 0x80]
sub rsp, 0x180
xor ebx, ebx
mov dword [rsp + 0x20], 0x67452301
mov dword [rsp + 0x24], 0xefcdab89
mov r15, r8
mov dword [rsp + 0x28], 0x98badcfe
mov rsi, rdx
mov dword [rsp + 0x2c], 0x10325476
mov r14, rcx
mov dword [rsp + 0x30], 0xc3d2e1f0
cmp rdx, 0x40
jb 0x18002c013
lea rdi, [rdx - 0x40]
lea rax, [rbx + 0x40]
cmp rbx, rax
jae 0x18002bfff
lea rdx, [r14 + 2]
mov r9d, select
add rdx, rbx
lea r8, [rsp + 0x40]
add rbx, 0x40
movzx eax, byte [rdx - 1]
movzx ecx, byte [rdx - 2]
shl ecx, 8
or ecx, eax
movzx eax, byte [rdx]
shl ecx, 8
lea rdx, [rdx + 4]
or ecx, eax
movzx eax, byte [rdx - 3]
shl ecx, 8
or ecx, eax
mov dword [r8], ecx
lea r8, [r8 + 4]
sub r9, 1
jne 0x18002bfd0
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x20]
call fcn.18003bce8
cmp rbx, rdi
jbe 0x18002bfb1
mov r10, rsi
mov edi, reloc.WS2_32.dll_ntohs
sub r10, rbx
mov eax, edi
and dword [rsp + rax*4 + 0x40], 0
sub rax, 1
jns 0x18002c020
xor r9d, r9d
lea r11d, [r9 + 3]
test r10, r10
je 0x18002c065
lea r8, [rbx + r14]
mov cl, r9b
mov eax, r11d
and cl, r11b
mov rdx, r9
sub al, cl
shr rdx, 2
mov cl, al
movzx eax, byte [r8 + r9]
shl cl, 3
inc r9
shl eax, cl
or dword [rsp + rdx*4 + 0x40], eax
cmp r9, r10
jb 0x18002c03b
mov r8, r9
mov edx, 0x80
and r9b, r11b
shr r8, 2
sub r11b, r9b
mov cl, r11b
shl cl, 3
shl edx, cl
or dword [rsp + r8*4 + 0x40], edx
cmp r10, 0x38
jb 0x18002c0a4
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x20]
call fcn.18003bce8
and dword [rsp + rdi*4 + 0x40], 0
sub rdi, 1
jns 0x18002c099
lea rax, [rsi*8]
lea rdx, [rsp + 0x40]
mov dword [rsp + 0x7c], eax
lea rcx, [rsp + 0x20]
call fcn.18003bce8
lea r9, [r15 + 0x13]
mov r10d, shutdown
mov r8d, 0xffffff80
mov rcx, r10
mov eax, r8d
sar rcx, 2
and eax, 0x18
dec r10
add r8d, 8
mov edx, dword [rsp + rcx*4 + 0x20]
mov cl, al
shr edx, cl
mov byte [r9], dl
dec r9
cmp r8d, 0x18
jle 0x18002c0cf
lea r11, [rsp + 0x180]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
Function at 0x18002d404
Capabilities:
Set socket configuration

Disassembly:
mov r11, rsp
mov qword [r11 + 0x10], rbx
mov qword [r11 + 0x18], rbp
mov qword [r11 + 0x20], rsi
push rdi
push r14
push r15
sub rsp, 0x50
xor r15d, r15d
mov rdi, r9
mov r14, rdx
mov rbp, rcx
mov esi, r15d
cmp rcx, 0xffffffffffffffff
je 0x18002d525
test r8b, r8b
je 0x18002d46c
test byte [rdx], 8
je 0x18002d46c
lea rax, [r11 - 0x28]
mov dword [r11 + 8], r15d
mov qword [r11 - 0x38], rax
mov r9d, 0x80
lea rax, [r11 + 8]
mov qword [r11 - 0x40], 4
mov r8d, 0xffff
mov qword [r11 - 0x48], rax
call fcn.18004a01c
mov rcx, rbp
call qword [sym.imp.WS2_32.dll_closesocket]
mov esi, eax
test eax, eax
je 0x18002d500
call fcn.1800030bc
mov rbx, rax
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov dword [rsp + 0x40], eax
mov qword [rsp + 0x48], rbx
movups xmm0, xmmword [rsp + 0x40]
movdqu xmmword [rdi], xmm0
call fcn.1800030bc
mov rcx, qword [rdi + 8]
mov rax, qword [rax + 8]
cmp qword [rcx + 8], rax
jne 0x18002d4ba
cmp dword [rdi], 0x2733
je 0x18002d4d5
call fcn.1800030bc
mov rcx, qword [rdi + 8]
mov rax, qword [rax + 8]
cmp qword [rcx + 8], rax
jne 0x18002d525
cmp dword [rdi], 0x4d5
jne 0x18002d525
lea r8, [rsp + 0x70]
mov dword [rsp + 0x70], r15d
mov edx, 0x8004667e
mov rcx, rbp
call qword [sym.imp.WS2_32.dll_ioctlsocket]
and byte [r14], 0xfc
mov rcx, rbp
call qword [sym.imp.WS2_32.dll_closesocket]
mov esi, eax
test eax, eax
jne 0x18002d505
mov dword [rdi], r15d
jmp 0x18002d525
call fcn.1800030bc
mov rbx, rax
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov dword [rsp + 0x40], eax
mov qword [rsp + 0x48], rbx
movups xmm0, xmmword [rsp + 0x40]
movdqu xmmword [rdi], xmm0
lea r11, [rsp + 0x50]
mov eax, esi
mov rbx, qword [r11 + 0x28]
mov rbp, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rdi
ret

Function at 0x18002d980
Capabilities:
Connect socket

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
mov rdi, r9
cmp rcx, 0xffffffffffffffff
jne 0x18002d9b8
mov dword [rsp + 0x20], 0x2719
call fcn.1800030bc
mov qword [rsp + 0x28], rax
or eax, 0xffffffff
movups xmm0, xmmword [rsp + 0x20]
movdqu xmmword [rdi], xmm0
jmp 0x18002d9ea
call qword [sym.imp.WS2_32.dll_connect]
mov esi, eax
test eax, eax
jne 0x18002d9c8
and dword [rdi], eax
jmp 0x18002d9e8
call fcn.1800030bc
mov rbx, rax
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov dword [rsp + 0x20], eax
mov qword [rsp + 0x28], rbx
movups xmm0, xmmword [rsp + 0x20]
movdqu xmmword [rdi], xmm0
mov eax, esi
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
Function at 0x18002f568
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov ecx, dword [0x1800c6a7c]
mov rdi, r8
mov rbx, rdx
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
je 0x18002f58f
mov rcx, qword [rax + 8]
jmp 0x18002f591
xor ecx, ecx
imul r8, rdi, 0xf0
cmp r8, 0x3fc
ja 0x18002f5bf
test rcx, rcx
je 0x18002f5bf
mov edx, 4
mov eax, edx
cmp qword [rcx + rax*8], 0
je 0x18002f5d2
inc edx
inc rax
cmp rax, 6
jl 0x18002f5ad
mov rcx, rbx
call fcn.18005d538
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
mov al, byte [r8 + rbx]
mov byte [rbx], al
movsxd rax, edx
mov qword [rcx + rax*8], rbx
jmp 0x18002f5c7

Function at 0x18002f5e4
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov ecx, dword [0x1800c6a7c]
mov rdi, r8
mov rbx, rdx
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
je 0x18002f60b
mov rcx, qword [rax + 8]
jmp 0x18002f60d
xor ecx, ecx
lea r8, [rdi + rdi*4]
shl r8, 5
cmp r8, 0x3fc
ja 0x18002f63c
test rcx, rcx
je 0x18002f63c
mov edx, 4
mov eax, edx
cmp qword [rcx + rax*8], 0
je 0x18002f64f
inc edx
inc rax
cmp rax, 6
jl 0x18002f62a
mov rcx, rbx
call fcn.18005d538
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
mov al, byte [r8 + rbx]
mov byte [rbx], al
movsxd rax, edx
mov qword [rcx + rax*8], rbx
jmp 0x18002f644

Function at 0x18002f660
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov ecx, dword [0x1800c6a7c]
mov rdi, r8
mov rbx, rdx
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
je 0x18002f687
mov rcx, qword [rax + 8]
jmp 0x18002f689
xor ecx, ecx
imul r8, rdi, 0xd0
cmp r8, 0x3fc
ja 0x18002f6b7
test rcx, rcx
je 0x18002f6b7
mov edx, 4
mov eax, edx
cmp qword [rcx + rax*8], 0
je 0x18002f6ca
inc edx
inc rax
cmp rax, 6
jl 0x18002f6a5
mov rcx, rbx
call fcn.18005d538
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
mov al, byte [r8 + rbx]
mov byte [rbx], al
movsxd rax, edx
mov qword [rcx + rax*8], rbx
jmp 0x18002f6bf

Function at 0x18002f6dc
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov ecx, dword [0x1800c6a7c]
mov rdi, r8
mov rbx, rdx
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
je 0x18002f703
mov rcx, qword [rax + 8]
jmp 0x18002f705
xor ecx, ecx
imul r8, rdi, 0xd8
cmp r8, 0x3fc
ja 0x18002f733
test rcx, rcx
je 0x18002f733
mov edx, 4
mov eax, edx
cmp qword [rcx + rax*8], 0
je 0x18002f746
inc edx
inc rax
cmp rax, 6
jl 0x18002f721
mov rcx, rbx
call fcn.18005d538
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
mov al, byte [r8 + rbx]
mov byte [rbx], al
movsxd rax, edx
mov qword [rcx + rax*8], rbx
jmp 0x18002f73b
Function at 0x18002f758
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov ecx, dword [0x1800c6a7c]
mov rdi, r8
mov rbx, rdx
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
je 0x18002f77f
mov rcx, qword [rax + 8]
jmp 0x18002f781
xor ecx, ecx
lea r8, [rdi + rdi*2]
shl r8, 6
cmp r8, 0x3fc
ja 0x18002f7b0
test rcx, rcx
je 0x18002f7b0
mov edx, 4
mov eax, edx
cmp qword [rcx + rax*8], 0
je 0x18002f7c3
inc edx
inc rax
cmp rax, 6
jl 0x18002f79e
mov rcx, rbx
call fcn.18005d538
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
mov al, byte [r8 + rbx]
mov byte [rbx], al
movsxd rax, edx
mov qword [rcx + rax*8], rbx
jmp 0x18002f7b8

Function at 0x18002f7d4
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov ecx, dword [0x1800c6a7c]
mov rdi, r8
mov rbx, rdx
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
je 0x18002f7fb
mov rcx, qword [rax + 8]
jmp 0x18002f7fd
xor ecx, ecx
imul r8, rdi, 0xe8
cmp r8, 0x3fc
ja 0x18002f82b
test rcx, rcx
je 0x18002f82b
mov edx, 4
mov eax, edx
cmp qword [rcx + rax*8], 0
je 0x18002f83e
inc edx
inc rax
cmp rax, 6
jl 0x18002f819
mov rcx, rbx
call fcn.18005d538
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
mov al, byte [r8 + rbx]
mov byte [rbx], al
movsxd rax, edx
mov qword [rcx + rax*8], rbx
jmp 0x18002f833

Function at 0x18002f850
Capabilities:
Get thread local storage value

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov ecx, dword [0x1800c6a7c]
mov rdi, r8
mov rbx, rdx
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
test rax, rax
je 0x18002f877
mov rcx, qword [rax + 8]
jmp 0x18002f879
xor ecx, ecx
lea rdx, [rdi + rdi*8]
shl rdx, 3
cmp rdx, 0x3fc
ja 0x18002f8a7
test rcx, rcx
je 0x18002f8a7
xor r8d, r8d
xor eax, eax
cmp qword [rcx + rax*8], 0
je 0x18002f8ba
inc r8d
inc rax
cmp rax, 2
jl 0x18002f894
mov rcx, rbx
call fcn.18005d538
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
mov al, byte [rdx + rbx]
mov byte [rbx], al
movsxd rax, r8d
mov qword [rcx + rax*8], rbx
jmp 0x18002f8af
Function at 0x180030f98
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r14
push rbp
mov rbp, rsp
sub rsp, 0x60
mov rax, qword [rcx + 0x30]
mov r14, rcx
mov ecx, dword [0x1800c6a7c]
mov rbx, r8
mov rdi, rdx
lea r9, [rax + 0x28]
neg rax
sbb rsi, rsi
and rsi, r9
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
jmp 0x180030fe8
cmp qword [rax], rsi
je 0x18003109b
mov rax, qword [rax + 0x10]
test rax, rax
jne 0x180030fdb
xor esi, esi
mov rcx, qword [rdi]
add rcx, 0x38
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
test rsi, rsi
je 0x1800310a4
mov rax, qword [rdi]
cmp byte [rax + 0x60], 0
jne 0x1800310a4
mov byte [rax + 0x60], 1
mov rcx, qword [rdi]
add rcx, 0x38
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov rax, qword [rdi]
mov ecx, dword [0x1800c6a88]
mov qword [rbp - 0x20], rax
call qword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ecx, dword [0x1800c6a88]
lea rdx, [rbp - 0x20]
mov qword [rbp - 0x10], rax
lea rax, [rbp - 0x20]
mov qword [rbp - 0x18], rax
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
mov rax, qword [rdi]
lea r8, [rbp - 0x40]
mov rcx, qword [r14 + 0x30]
xor r9d, r9d
and dword [rbp - 0x40], 0
mov rdx, rbx
mov qword [rbp - 0x28], rax
lea rax, [0x1800c1050]
mov qword [rbp - 0x38], rax
mov qword [rbp - 0x30], rcx
call qword [rbx + 0x28]
lea rcx, [rbp - 0x30]
call fcn.18002065c
mov rdx, qword [rbp - 0x10]
mov ecx, dword [0x1800c6a88]
call qword [sym.imp.KERNEL32.dll_TlsSetValue]
jmp 0x18003111e
mov rsi, qword [rax + 8]
jmp 0x180030fef
mov rax, qword [rdi]
cmp byte [rax + 0x60], 0
je 0x1800310d8
and qword [rbx + 0x20], 0
mov rcx, qword [rax + 0x70]
test rcx, rcx
je 0x1800310c1
mov qword [rcx + 0x20], rbx
jmp 0x1800310c5
mov qword [rax + 0x68], rbx
mov qword [rax + 0x70], rbx
mov rcx, qword [rdi]
add rcx, 0x38
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
jmp 0x18003111e
mov byte [rax + 0x60], 1
mov rcx, qword [rdi]
add rcx, 0x38
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov rax, qword [rdi]
and qword [rbx + 0x20], 0
mov rcx, qword [rax + 0x80]
test rcx, rcx
je 0x180031103
mov qword [rcx + 0x20], rbx
jmp 0x180031107
mov qword [rax + 0x78], rbx
mov qword [rax + 0x80], rbx
mov rcx, qword [r14 + 0x30]
mov rdx, qword [rdi]
lock inc dword [rcx + 0x30]
call fcn.180040380
lea r11, [rsp + 0x60]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov r14, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret
Function at 0x180033288
Capabilities:
Encode data using xor

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov qword [rax + 8], rcx
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x4f]
sub rsp, 0xf0
mov r15, qword [rbp + 0x7f]
mov r14, rcx
mov rsi, r15
lea rcx, [rsp + 0x30]
shr rsi, 6
and r15d, 0x3f
mov qword [rsp + 0x28], rsi
mov qword [rbp + 0x7f], r15
call fcn.18003b8d4
xor ebx, ebx
lea r12d, [rbx + 0x10]
test rsi, rsi
je 0x18003334e
mov r13, qword [rbp + 0x77]
lea rdi, [rbp - 0x59]
mov r14d, ebx
sub rdi, r13
mov ebx, dword [rbp - 0x69]
mov r15, r13
lea rdx, [rsp + 0x30]
lea rcx, [rbp - 0x59]
call fcn.18002a470
inc ebx
lea rax, [r14 + 0x10]
mov dword [rbp - 0x69], ebx
cmp r14, rax
jae 0x18003332e
mov rdx, qword [rbp + 0x57]
mov rcx, r13
sub rdx, r15
mov r8, r12
mov eax, dword [rdi + rcx]
xor eax, dword [rcx]
mov dword [rdx + rcx], eax
lea rcx, [rcx + 4]
sub r8, 1
jne 0x18003331c
add r14, r12
add r13, 0x40
sub rdi, 0x40
sub rsi, 1
jne 0x1800332f3
mov rsi, qword [rsp + 0x28]
xor ebx, ebx
mov r15, qword [rbp + 0x7f]
mov r14, qword [rbp + 0x57]
test r15, r15
je 0x1800333aa
mov rdx, qword [rbp + 0x77]
lea rcx, [rbp - 0x19]
mov rdi, rsi
mov r8, r15
shl rdi, 6
add rdx, rdi
call fcn.180056680
lea rdx, [rsp + 0x30]
lea rcx, [rbp - 0x59]
call fcn.18002a470
shl rsi, 4
lea rax, [rsi + 0x10]
cmp rsi, rax
jae 0x18003339a
mov eax, dword [rbp + rbx - 0x59]
xor dword [rbp + rbx - 0x19], eax
lea rbx, [rbx + 4]
sub r12, 1
jne 0x180033388
lea rcx, [rdi + r14]
mov r8, r15
lea rdx, [rbp - 0x19]
call fcn.180056680
lea r11, [rsp + 0xf0]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret

Function at 0x180036110
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x30
mov rdi, r9
mov rbx, r8
cmp rcx, 0xffffffffffffffff
jne 0x18003614b
mov dword [rsp + 0x20], 0x2719
call fcn.1800030bc
mov qword [rsp + 0x28], rax
or eax, 0xffffffff
movups xmm0, xmmword [rsp + 0x20]
movdqu xmmword [rdi], xmm0
jmp 0x180036191
mov eax, dword [r8]
lea r8, [rsp + 0x40]
mov dword [rsp + 0x40], eax
call qword [sym.imp.WS2_32.dll_getsockname]
movsxd rcx, dword [rsp + 0x40]
mov esi, eax
mov qword [rbx], rcx
test eax, eax
jne 0x18003616f
and dword [rdi], eax
jmp 0x18003618f
call fcn.1800030bc
mov rbx, rax
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov dword [rsp + 0x20], eax
mov qword [rsp + 0x28], rbx
movups xmm0, xmmword [rsp + 0x20]
movdqu xmmword [rdi], xmm0
mov eax, esi
mov rbx, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
Function at 0x18003bce8
Capabilities:
Encode data using xor
Hash data using sha1

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r12
push r14
push r15
mov esi, dword [rcx]
mov rdi, rdx
mov r11d, dword [rcx + 4]
mov r9, rcx
mov r10d, dword [rcx + 8]
xor r8d, r8d
mov ebx, dword [rcx + 0xc]
mov ebp, dword [rcx + 0x10]
mov eax, r10d
mov ecx, r11d
and eax, r11d
mov edx, esi
rol edx, 5
not ecx
and ecx, ebx
or eax, ecx
add eax, edx
add eax, dword [rdi + r8*4]
inc r8
add eax, ebp
mov ebp, ebx
mov ebx, r10d
mov r10d, r11d
ror r10d, 2
mov r11d, esi
lea esi, [rax + 0x5a827999]
cmp r8, 0x10
jl 0x18003bd1a
lea r14, [rdi + 8]
mov r15d, 4
mov r8d, dword [r14 + 0x2c]
mov eax, r10d
xor r8d, dword [r14 + 0x18]
and eax, r11d
xor r8d, dword [r14 - 8]
mov ecx, esi
xor r8d, dword [r14]
mov edx, r11d
rol r8d, 1
not edx
rol ecx, 5
and edx, ebx
mov dword [r14 + 0x38], r8d
lea r14, [r14 + 4]
or edx, eax
lea eax, [r8 + rcx]
add eax, edx
add eax, ebp
mov ebp, ebx
mov ebx, r10d
mov r10d, r11d
ror r10d, 2
mov r11d, esi
lea esi, [rax + 0x5a827999]
sub r15, 1
jne 0x18003bd5e
lea r14d, [r15 + 0x14]
mov r15d, r14d
lea r8, [rdi + 0x18]
mov edx, dword [r8 + 0x2c]
mov eax, esi
xor edx, dword [r8 + 0x18]
mov ecx, ebx
xor edx, dword [r8 - 8]
xor ecx, r10d
xor edx, dword [r8]
xor ecx, r11d
rol eax, 5
lea r8, [r8 + 4]
rol edx, 1
add eax, edx
mov dword [r8 + 0x34], edx
add eax, ecx
add eax, ebp
mov ebp, ebx
mov ebx, r10d
mov r10d, r11d
ror r10d, 2
mov r11d, esi
lea esi, [rax + 0x6ed9eba1]
sub r15, 1
jne 0x18003bdba
lea r15, [rdi + 0x68]
mov r12, r14
mov r8d, dword [r15 + 0x2c]
mov edx, esi
xor r8d, dword [r15 + 0x18]
mov ecx, r10d
xor r8d, dword [r15 - 8]
or ecx, r11d
xor r8d, dword [r15]
and ecx, ebx
mov eax, r10d
rol r8d, 1
and eax, r11d
rol edx, 5
or ecx, eax
mov dword [r15 + 0x38], r8d
add ecx, r8d
lea r15, [r15 + 4]
lea eax, [rdx + rbp]
mov ebp, ebx
mov ebx, r10d
add eax, 0x8f1bbcdc
mov r10d, r11d
add eax, ecx
ror r10d, 2
mov r11d, esi
mov esi, eax
sub r12, 1
jne 0x18003be08
add rdi, 0xb8
mov edx, dword [rdi + 0x2c]
mov ecx, esi
xor edx, dword [rdi + 0x18]
mov eax, ebx
xor edx, dword [rdi - 8]
xor eax, r10d
xor edx, dword [rdi]
xor eax, r11d
rol edx, 1
mov dword [rdi + 0x38], edx
lea rdi, [rdi + 4]
add eax, edx
rol ecx, 5
lea edx, [rcx + rbp]
mov ebp, ebx
mov ebx, r10d
add edx, 0xca62c1d6
mov r10d, r11d
add edx, eax
ror r10d, 2
mov r11d, esi
mov esi, edx
sub r14, 1
jne 0x18003be62
add dword [r9 + 0xc], ebx
add dword [r9], edx
add dword [r9 + 4], r11d
add dword [r9 + 8], r10d
add dword [r9 + 0x10], ebp
mov rbp, qword [rsp + 0x28]
mov rbx, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x30]
mov rdi, qword [rsp + 0x38]
pop r15
pop r14
pop r12
ret