joyce8/EMBER2024-capa huggingface dataset:
Function at 0x18015d1f0
Capabilities:
Get file size

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x20], r9
push rdi
sub rsp, 0x30
mov rbx, rdx
mov rdi, rcx
lea rdx, [rsp + 0x5c]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileSize]
xor esi, esi
xor edx, edx
mov dword [rsp + 0x58], eax
mov r9, qword [rsp + 0x58]
lea r8d, [rsi + 2]
mov rcx, rbx
shr r9, 0x20
mov qword [rsp + 0x28], rsi
mov dword [rsp + 0x20], eax
call qword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov rcx, rax
mov qword [rdi + 0x10], rax
test rax, rax
jne 0x18015d260
call fcn.180144c30
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
mov rax, qword [rsp + 0x58]
mov qword [rdi + 0x18], rsi
mov r8d, dword [rdi + 0x1c]
mov r9d, esi
mov edx, 4
mov qword [rsp + 0x28], rsi
mov qword [rdi + 8], rax
mov dword [rdi + 0x20], 4
mov qword [rsp + 0x20], rax
call qword [sym.imp.KERNEL32.dll_MapViewOfFileEx]
mov qword [rdi], rax
test rax, rax
jne 0x18015d2bf
call fcn.180144c30
mov rcx, qword [rdi + 0x10]
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rdi + 0x10], rsi
mov eax, ebx
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
xor eax, eax
add rsp, 0x30
pop rdi
ret

Function at 0x18015d620
Capabilities:
Resolve dns

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
sub rsp, 0x100
mov rax, qword [0x1802658e0]
xor rax, rsp
mov qword [rsp + 0xf0], rax
xor eax, eax
xor edi, edi
movzx ebp, dx
mov qword [r8 + 2], rax
mov qword [r8 + 0xa], rax
mov qword [r8 + 0x12], rax
mov word [r8 + 0x1a], ax
mov qword [rsp + 0x2c], rax
mov qword [rsp + 0x34], rax
mov qword [rsp + 0x3c], rax
mov qword [rsp + 0x44], rax
mov qword [rsp + 0x4c], rax
mov dword [rsp + 0x54], eax
movzx eax, word [r8]
mov rsi, r8
mov dword [rsp + 0x2c], eax
mov rdx, rcx
lea rax, [rsp + 0x68]
lea r8d, [rdi + 3]
lea rcx, [rsp + 0x60]
mov qword [rsp + 0x20], rdi
mov qword [rsp + 0x60], rax
mov dword [rsp + 0x28], pe_nt_image_headers64
call fcn.18015f670
mov rcx, qword [rsp + 0x60]
lea r9, [rsp + 0x20]
lea r8, [rsp + 0x28]
xor edx, edx
call qword [sym.imp.WS2_32.dll_getaddrinfo]
mov rcx, qword [rsp + 0x60]
mov ebx, eax
lea rax, [rsp + 0x68]
cmp rcx, rax
je 0x18015d6d6
call fcn.180179510
test ebx, ebx
je 0x18015d6e6
mov ecx, ebx
call qword [sym.imp.WS2_32.dll_WSASetLastError]
xor eax, eax
jmp 0x18015d749
mov rbx, qword [rsp + 0x20]
mov rdx, rbx
test rbx, rbx
je 0x18015d720
mov eax, dword [rdx + 4]
cmp eax, 2
je 0x18015d70b
cmp eax, 0x17
je 0x18015d70b
mov rdx, qword [rdx + 0x28]
test rdx, rdx
jne 0x18015d6f3
jmp 0x18015d720
mov r8, qword [rdx + 0x10]
mov rdx, qword [rdx + 0x20]
mov rcx, rsi
call fcn.18017dd20
mov edi, 1
mov rcx, rbx
call qword [sym.imp.WS2_32.dll_freeaddrinfo]
test edi, edi
je 0x18015d73c
movzx ecx, bp
call qword [sym.imp.WS2_32.dll_htons]
mov word [rsi + 2], ax
jmp 0x18015d747
mov ecx, 0x2af9
call qword [sym.imp.WS2_32.dll_WSASetLastError]
mov eax, edi
mov rcx, qword [rsp + 0xf0]
xor rcx, rsp
call fcn.180179370
mov rbx, qword [rsp + 0x138]
add rsp, 0x100
pop rdi
pop rsi
pop rbp
ret
Function at 0x18015dcb0
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push r14
sub rsp, 0x50
xor ebx, ebx
mov rdi, r8
mov rsi, rdx
mov r14, r9
mov dword [rax - 0x38], 0x1c
lea r8, [rax - 0x38]
mov word [rax - 0x30], bx
lea rdx, [rax - 0x30]
cmp dword [rsp + 0x80], ebx
je 0x18015dcf4
call qword [sym.imp.WS2_32.dll_getsockname]
jmp 0x18015dcfa
call qword [sym.imp.WS2_32.dll_getpeername]
test eax, eax
je 0x18015dd02
xor eax, eax
jmp 0x18015dd7d
movzx ecx, word [rsp + 0x2a]
mov qword [rsp + 0x60], rbp
movzx ebp, word [rsp + 0x28]
call qword [sym.imp.WS2_32.dll_ntohs]
lea rcx, [rsp + 0x30]
lea rdx, [rsp + 0x2c]
mov word [r14], ax
movzx eax, word [rsp + 0x28]
movsxd r9, dword [rdi]
cmp eax, 2
mov r8, rsi
cmovne rdx, rcx
mov ecx, eax
call qword [sym.imp.WS2_32.dll_InetNtopW]
test rax, rax
je 0x18015dd58
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov ebx, 1
inc eax
mov dword [rdi], eax
jmp 0x18015dd76
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x57
jne 0x18015dd76
mov ecx, 0x2e
mov eax, reloc.WS2_32.dll_recv
cmp bp, 2
cmove ecx, eax
mov dword [rdi], ecx
mov rbp, qword [rsp + 0x60]
mov eax, ebx
mov rbx, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
mov rdi, qword [rsp + 0x78]
add rsp, 0x50
pop r14
ret

Function at 0x18015e030
Capabilities:
Set socket configuration

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
mov rdi, rcx
mov dword [rsp + 0x50], 1
mov dword [rsp + 0x48], 0
test edx, edx
jne 0x18015e058
lea r9, [rsp + 0x50]
jmp 0x18015e062
cmp edx, 1
jne 0x18015e0ab
lea r9, [rsp + 0x48]
mov edx, 0xffff
mov r8d, 0xfffffffb
mov dword [rsp + 0x20], 4
call qword [sym.imp.WS2_32.dll_setsockopt]
lea r9, [rsp + 0x48]
mov edx, 0xffff
mov r8d, 4
mov rcx, rdi
mov dword [rsp + 0x20], 4
mov ebx, eax
call qword [sym.imp.WS2_32.dll_setsockopt]
or eax, ebx
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
cmp edx, 2
jne 0x18015e0fe
lea r9, [rsp + 0x48]
mov edx, 0xffff
mov r8d, 0xfffffffb
mov dword [rsp + 0x20], 4
call qword [sym.imp.WS2_32.dll_setsockopt]
lea r9, [rsp + 0x50]
mov edx, 0xffff
mov r8d, 4
mov rcx, rdi
mov ebx, eax
mov dword [rsp + 0x20], 4
call qword [sym.imp.WS2_32.dll_setsockopt]
or eax, ebx
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
mov ecx, 0x57
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov rbx, qword [rsp + 0x40]
or eax, 0xffffffff
add rsp, 0x30
pop rdi
ret

Function at 0x18015e230
Capabilities:
Receive data
Receive data on socket

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x40
mov rcx, qword [rcx + 0xc8]
xor edi, edi
mov rax, rdx
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x50]
mov qword [rdx + 0x58], rcx
mov dword [rdx + 0x28], 4
lea r9, [rsp + 0x58]
lea r8d, [rdi + 1]
add rdx, 0x30
mov qword [rsp + 0x20], rax
mov ebx, edi
mov dword [rsp + 0x50], edi
mov dword [rsp + 0x58], edi
call qword [sym.imp.WS2_32.dll_WSARecv]
cmp eax, 0xffffffff
jne 0x18015e28f
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov ebx, eax
cmp ebx, 0x3e5
cmove ebx, edi
mov eax, ebx
mov rbx, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret
Function at 0x18015e2b0
Capabilities:
Send data
Send data on socket

Disassembly:
sub rsp, 0x58
cmp word [rdx + 0x58], 2
mov r9, rdx
lea r8, [rdx + 0x58]
mov dword [rdx + 0x28], 3
mov qword [rsp + 0x40], 0
mov qword [rsp + 0x38], r9
mov eax, 0x1c
mov edx, reloc.WS2_32.dll_recv
mov dword [rsp + 0x68], 0
cmove eax, edx
lea rdx, [r9 + 0x30]
mov dword [r9 + 0x74], eax
mov eax, dword [r9 + 0x74]
mov dword [r9 + 0x44], 2
mov dword [rsp + 0x30], eax
mov qword [rsp + 0x28], r8
lea r9, [rsp + 0x68]
mov r8d, 1
mov dword [rsp + 0x20], 0
call qword [sym.imp.WS2_32.dll_WSASendTo]
cmp eax, 0xffffffff
jne 0x18015e330
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
add rsp, 0x58
ret
xor eax, eax
add rsp, 0x58
ret

Function at 0x18015e340
Capabilities:
Receive data
Receive data on socket

Disassembly:
mov r11, rsp
sub rsp, 0x58
cmp word [rdx + 0x58], 2
mov r10, rdx
mov dword [rdx + 0x28], 4
lea r9, [rdx + 0x58]
lea r8, [r10 + 0x74]
mov eax, 0x1c
mov edx, reloc.WS2_32.dll_recv
mov dword [rsp + 0x68], 0
mov dword [rsp + 0x70], 0
cmove eax, edx
lea rdx, [r10 + 0x30]
mov dword [r8], eax
xor eax, eax
mov qword [r11 - 0x18], rax
mov qword [r10 + 0x5a], rax
mov qword [r10 + 0x62], rax
mov qword [r11 - 0x20], r10
mov qword [r11 - 0x28], r8
mov qword [r10 + 0x6a], rax
mov qword [r11 - 0x30], r9
mov word [r10 + 0x72], ax
lea rax, [r11 + 0x10]
lea r9, [r11 + 0x18]
mov r8d, 1
mov qword [r11 - 0x38], rax
call qword [sym.imp.WS2_32.dll_WSARecvFrom]
cmp eax, 0xffffffff
jne 0x18015e3cd
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
add rsp, 0x58
ret
xor eax, eax
add rsp, 0x58
ret

Function at 0x18015e3e0
Capabilities:
Receive data
Receive data on socket

Disassembly:
mov qword [rsp + 0x18], rbx
push rdi
sub rsp, 0x40
xor edi, edi
lea rbx, [rcx + 0x30]
mov rcx, qword [rcx + 0x58]
lea rax, [rsp + 0x58]
mov qword [rsp + 0x30], rdi
lea r9, [rsp + 0x50]
lea r8d, [rdi + 1]
mov rdx, rbx
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x58], edi
mov dword [rsp + 0x50], edi
mov qword [rsp + 0x20], rax
call qword [sym.imp.WS2_32.dll_WSARecv]
cmp eax, 0xffffffff
jne 0x18015e438
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov rbx, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret
mov ecx, dword [rsp + 0x50]
test ecx, ecx
je 0x18015e44f
mov dword [rbx], ecx
mov eax, edi
mov rbx, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret
mov eax, 0x2775
mov rbx, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret
Function at 0x18015e460
Capabilities:
Receive data
Receive data on socket

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
push rdi
sub rsp, 0x50
xor edi, edi
cmp word [rdx + 0x58], 2
lea r9, [rdx + 0x58]
mov qword [r11 - 0x18], rdi
mov qword [r11 - 0x20], rdi
mov eax, reloc.WS2_32.dll_recv
mov r8d, 0x1c
lea rbx, [rdx + 0x30]
mov dword [rsp + 0x70], edi
cmove r8d, eax
lea rax, [rdx + 0x74]
mov rdx, rbx
mov qword [r11 - 0x28], rax
mov dword [rax], r8d
mov qword [r11 - 0x30], r9
lea rax, [r11 + 0x18]
lea r9, [r11 + 0x10]
lea r8d, [rdi + 1]
mov qword [r11 - 0x38], rax
mov dword [rsp + 0x68], edi
call qword [sym.imp.WS2_32.dll_WSARecvFrom]
cmp eax, 0xffffffff
jne 0x18015e4d8
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rdi
ret
mov ecx, dword [rsp + 0x68]
test ecx, ecx
je 0x18015e4ef
mov dword [rbx], ecx
mov eax, edi
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rdi
ret
mov eax, 0x2775
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rdi
ret

Function at 0x18015e500
Capabilities:
Set socket configuration

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x60
mov rax, qword [0x1802658e0]
xor rax, rsp
mov qword [rsp + 0x58], rax
cmp word [r8], 2
mov rdi, r8
mov dword [rsp + 0x30], r9d
lea r9, [rsp + 0x30]
mov r8d, 0xa
mov rsi, rdx
mov rbx, rcx
mov dword [rsp + 0x20], 4
jne 0x18015e5b4
xor edx, edx
call qword [sym.imp.WS2_32.dll_setsockopt]
cmp eax, 0xffffffff
je 0x18015e640
xor edx, edx
lea r9, [rsp + 0xa0]
mov rcx, rbx
lea r8d, [rdx + 0xb]
mov dword [rsp + 0x20], 4
call qword [sym.imp.WS2_32.dll_setsockopt]
cmp eax, 0xffffffff
je 0x18015e64b
xor eax, eax
mov dword [rsp + 0x20], 8
lea r9, [rsp + 0x38]
mov qword [rsp + 0x38], rax
mov eax, dword [rdi + 4]
xor edx, edx
mov dword [rsp + 0x38], eax
mov eax, dword [rsi + 4]
mov dword [rsp + 0x3c], eax
mov r8d, ntohs
mov rcx, rbx
call qword [sym.imp.WS2_32.dll_setsockopt]
cmp eax, 0xffffffff
jne 0x18015e626
xor eax, eax
jmp 0x18015e62b
mov edx, 0x29
call qword [sym.imp.WS2_32.dll_setsockopt]
cmp eax, 0xffffffff
je 0x18015e656
mov edx, 0x29
lea r9, [rsp + 0xa0]
mov rcx, rbx
lea r8d, [rdx - 0x1e]
mov dword [rsp + 0x20], 4
call qword [sym.imp.WS2_32.dll_setsockopt]
cmp eax, 0xffffffff
je 0x18015e661
movups xmm0, xmmword [rdi + 8]
xor eax, eax
mov dword [rsp + 0x20], reloc.WS2_32.dll_sendto
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x48], rax
mov dword [rsp + 0x50], eax
movups xmmword [rsp + 0x40], xmm0
mov eax, dword [rsi + 0x18]
lea r9, [rsp + 0x40]
mov edx, 0x29
mov dword [rsp + 0x50], eax
jmp 0x18015e59c
mov eax, 1
mov rcx, qword [rsp + 0x58]
xor rcx, rsp
call fcn.180179370
add rsp, 0x60
pop rdi
pop rsi
pop rbx
ret
mov ecx, 0x80004005
call fcn.180127e80
int3
mov ecx, 0x80004005
call fcn.180127e80
int3
mov ecx, 0x80004005
call fcn.180127e80
int3
mov ecx, 0x80004005
call fcn.180127e80
int3
Function at 0x18015f030
Capabilities:
Encode data using base64

Disassembly:
jmp 0x18015f030
mov qword [rsp + 0x20], rbx
push rdi
lea r10d, [rdx + 2]
mov eax, 0xaaaaaaab
mov edi, edx
mov rbx, r9
mov r11, rcx
mul r10d
mov r10d, edx
shr r10d, 1
shl r10d, 2
test r8, r8
je 0x18015f1b1
cmp dword [r9], r10d
jb 0x18015f1b1
mov eax, 0xaaaaaaab
mov qword [rsp + 0x20], r14
lea r14, str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_
mul edi
shr edx, 1
lea ecx, [rdx + rdx*2]
xor edx, edx
test ecx, ecx
je 0x18015f10e
dec ecx
mov eax, 0xaaaaaaab
mul ecx
shr edx, 1
inc edx
mov r9d, edx
lea edx, [rdx + rdx*2]
nop dword [rax + rax]
movzx eax, byte [r11]
add r8, 4
add r11, 3
shr rax, 2
movzx eax, byte [rax + r14]
mov byte [r8 - 4], al
movzx ecx, byte [r11 - 3]
movzx eax, byte [r11 - 2]
shr rax, 4
and ecx, 3
shl rcx, 4
add rcx, rax
movzx eax, byte [rcx + r14]
mov byte [r8 - 3], al
movzx ecx, byte [r11 - 2]
movzx eax, byte [r11 - 1]
shr rax, 6
and ecx, 0xf
lea rcx, [rax + rcx*4]
movzx eax, byte [rcx + r14]
mov byte [r8 - 2], al
movzx eax, byte [r11 - 1]
and eax, 0x3f
movzx eax, byte [rax + r14]
mov byte [r8 - 1], al
dec r9
jne 0x18015f0a0
cmp edx, edi
jae 0x18015f197
mov qword [rsp + 0x10], rbp
movzx ebp, byte [r11]
mov qword [rsp + 0x18], rsi
lea esi, [rdx + 1]
cmp esi, edi
jae 0x18015f132
movzx ecx, byte [r11 + 1]
jmp 0x18015f134
xor cl, cl
movzx edx, bpl
movzx eax, bpl
mov rbp, qword [rsp + 0x10]
shr rax, 2
and edx, 3
movzx r9d, cl
movzx eax, byte [rax + r14]
mov ecx, r9d
shl rdx, 4
shr ecx, 4
mov byte [r8], al
add rdx, rcx
cmp esi, edi
mov rsi, qword [rsp + 0x18]
movzx eax, byte [rdx + r14]
mov byte [r8 + 1], al
jae 0x18015f185
and r9d, 0xf
shl r9d, 2
movsxd rax, r9d
movzx ecx, byte [rax + r14]
jmp 0x18015f18a
mov ecx, 0x3d
mov byte [r8 + 2], cl
mov byte [r8 + 3], 0x3d
add r8, 4
mov r14, qword [rsp + 0x20]
cmp dword [rbx], r10d
jbe 0x18015f1a8
mov byte [r8], 0
mov dword [rbx], r10d
xor eax, eax
mov rbx, qword [rsp + 0x28]
pop rdi
ret
mov rbx, qword [rsp + 0x28]
mov dword [r9], r10d
mov eax, 0xfffffffb
pop rdi
ret
Function at 0x1801627f0
Capabilities:
Hash data using fnv

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rdi
push r14
push r15
sub rsp, 0x20
mov r10, qword [r8]
mov r14, r8
mov r15, rdx
movzx r9d, word [r10]
mov rsi, rcx
mov r11d, 0x811c9dc5
test r9w, r9w
je 0x18016284b
nop
lea eax, [r9 - 0x41]
lea r10, [r10 + 2]
cmp ax, 0x19
ja 0x180162833
add r9w, 0x20
imul r11, r11, 0x1000193
movzx eax, r9w
movzx r9d, word [r10]
xor r11, rax
test r9w, r9w
jne 0x180162820
mov rcx, qword [rcx + 0x28]
mov rdi, rcx
and rdi, r11
cmp qword [rsi + 0x30], rdi
ja 0x180162868
shr rcx, 1
or rax, 0xffffffffffffffff
sub rax, rcx
add rdi, rax
mov rbx, qword [rsi + 0x10]
add rdi, rdi
mov rbx, qword [rbx + rdi*8]
mov rcx, qword [rsi + 0x10]
mov rax, qword [rsi]
cmp qword [rcx + rdi*8], rax
je 0x180162888
mov rax, qword [rcx + rdi*8 + 8]
mov rax, qword [rax]
cmp rbx, rax
je 0x1801628dd
mov rdx, qword [r14]
test rdx, rdx
je 0x180162905
mov rcx, qword [rbx + 0x10]
call fcn.18017e288
test eax, eax
je 0x1801628a7
mov rbx, qword [rbx]
jmp 0x180162873
mov rdx, qword [rbx + 0x10]
test rdx, rdx
je 0x1801628fa
mov rcx, qword [r14]
call fcn.18017e288
test eax, eax
je 0x1801628ce
mov rax, qword [rsi]
mov qword [rsp + 0x40], rax
lea rax, [rsp + 0x40]
mov rax, qword [rax]
jmp 0x1801628e0
lea rax, [rsp + 0x40]
mov qword [rsp + 0x40], rbx
mov rax, qword [rax]
jmp 0x1801628e0
mov rax, qword [rsi]
mov rbx, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
mov qword [r15], rax
mov rax, r15
add rsp, 0x20
pop r15
pop r14
pop rdi
ret
mov ecx, 0x80004005
call fcn.180127e80
int3
mov ecx, 0x80004005
call fcn.180127e80
int3
Function at 0x180162b60
Capabilities:
Hash data using fnv

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 8], rcx
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x30
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov qword [rsp + 0x68], rbx
mov qword [rsp + 0x70], rsi
mov rdi, r9
mov r13, r8
mov r12, rdx
mov r14, rcx
mov r10d, 0x811c9dc5
mov r11, qword [r8]
movzx r9d, word [r11]
test r9w, r9w
je 0x180162bdb
nop dword [rax]
lea r11, [r11 + 2]
lea eax, [r9 - 0x41]
cmp ax, 0x19
ja 0x180162bc3
add r9w, 0x20
imul r10, r10, 0x1000193
movzx eax, r9w
xor r10, rax
movzx r9d, word [r11]
test r9w, r9w
jne 0x180162bb0
mov rcx, qword [rcx + 0x28]
mov rsi, rcx
and rsi, r10
cmp qword [r14 + 0x30], rsi
ja 0x180162bf8
shr rcx, 1
or rax, 0xffffffffffffffff
sub rax, rcx
add rsi, rax
mov rbx, qword [r14]
shl rsi, 4
mov rax, qword [r14 + 0x10]
cmp qword [rax + rsi], rbx
je 0x180162c11
mov rbx, qword [rax + rsi + 8]
mov rbx, qword [rbx]
xor r15d, r15d
nop dword [rax]
nop dword [rax + rax]
mov rax, qword [r14 + 0x10]
cmp rbx, qword [rsi + rax]
je 0x180162cb1
mov rbx, qword [rbx + 8]
mov rdx, qword [rbx + 0x10]
mov eax, r15d
test rdx, rdx
setne al
test eax, eax
jne 0x180162c4d
mov ecx, 0x80004005
call fcn.180127e80
mov rcx, qword [r13]
call fcn.18017e288
test eax, eax
je 0x180162c61
mov rdi, qword [rsp + 0x78]
jmp 0x180162c20
mov rdx, qword [r13]
test rdx, rdx
setne r15b
test r15d, r15d
jne 0x180162c7b
mov ecx, 0x80004005
call fcn.180127e80
mov rcx, qword [rbx + 0x10]
call fcn.18017e288
test eax, eax
je 0x180162c92
mov rbx, qword [rbx]
mov rdi, qword [rsp + 0x78]
jmp 0x180162cb1
mov rdx, qword [rsp + 0x78]
mov rcx, r14
call fcn.180162d60
mov qword [r12], rbx
mov byte [r12 + 8], 0
mov rax, r12
jmp 0x180162d44
mov rax, qword [rdi]
cmp rbx, rax
je 0x180162ce6
mov rcx, qword [rdi + 8]
mov qword [rcx], rax
mov rcx, qword [rax + 8]
mov qword [rcx], rbx
mov rcx, qword [rbx + 8]
mov qword [rcx], rdi
mov rdx, qword [rbx + 8]
mov rcx, qword [rax + 8]
mov qword [rbx + 8], rcx
mov rcx, qword [rdi + 8]
mov qword [rax + 8], rcx
mov qword [rdi + 8], rdx
mov rdx, qword [r14 + 0x10]
add rdx, rsi
mov rax, qword [rdx]
cmp rax, qword [r14]
jne 0x180162d03
mov qword [rdx], rdi
mov rax, qword [r14 + 0x10]
mov qword [rsi + rax + 8], rdi
jmp 0x180162d2f
cmp rax, rbx
jne 0x180162d0d
mov qword [rdx], rdi
jmp 0x180162d2f
mov rax, qword [rdx + 8]
mov rcx, qword [rax]
mov qword [rdx + 8], rcx
cmp rcx, rdi
je 0x180162d2f
mov rdx, qword [r14 + 0x10]
mov rax, qword [rdx + rsi + 8]
mov rcx, qword [rax + 8]
mov qword [rdx + rsi + 8], rcx
mov rcx, r14
call fcn.180162db0
mov qword [r12], rdi
mov byte [r12 + 8], 1
mov rax, r12
mov rbx, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x70]
add rsp, 0x30
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x180164380
Capabilities:
Create thread

Disassembly:
push rbp
push rsi
push r14
sub rsp, 0x30
xor r14d, r14d
mov rbp, rcx
mov esi, r14d
cmp dword [rcx + 0x18], r14d
jbe 0x18016448b
mov qword [rsp + 0x58], rbx
mov qword [rsp + 0x60], rdi
nop word [rax + rax]
lea r8, [0x180165740]
mov r9, rbp
xor edx, edx
xor ecx, ecx
mov qword [rsp + 0x28], r14
mov dword [rsp + 0x20], r14d
call fcn.18017b9a4
mov rdi, rax
mov qword [rsp + 0x50], rax
test rax, rax
je 0x180164471
lea rbx, [rbp + 0x98]
lea rcx, [rsp + 0x50]
mov rax, qword [rbx + 8]
cmp rcx, rax
jae 0x18016442f
mov rcx, qword [rbx]
lea rdx, [rsp + 0x50]
cmp rcx, rdx
ja 0x18016442f
lea rdi, [rsp + 0x50]
sub rdi, rcx
sar rdi, 3
cmp rax, qword [rbx + 0x10]
jne 0x18016441a
mov rcx, rbx
call fcn.180162910
mov rdx, qword [rbx + 8]
test rdx, rdx
je 0x180164449
mov rax, qword [rbx]
mov rcx, qword [rax + rdi*8]
mov qword [rdx], rcx
jmp 0x180164449
cmp rax, qword [rbx + 0x10]
jne 0x18016443d
mov rcx, rbx
call fcn.180162910
mov rcx, qword [rbx + 8]
test rcx, rcx
je 0x180164449
mov qword [rcx], rdi
add qword [rbx + 8], 8
inc esi
cmp esi, dword [rbp + 0x18]
jb 0x1801643b0
mov eax, 1
mov rbx, qword [rsp + 0x58]
mov rdi, qword [rsp + 0x60]
add rsp, 0x30
pop r14
pop rsi
pop rbp
ret
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rbp + 0x74], 8
mov ecx, eax
call qword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, r14d
jmp 0x18016445e
mov eax, 1
add rsp, 0x30
pop r14
pop rsi
pop rbp
ret

Function at 0x180164c80
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x30
mov r11, qword [rcx + 0x1d8]
mov rbx, r9
mov rdi, r8
test r11, r11
je 0x180164cff
mov r10d, dword [rcx + 0x1d0]
mov rcx, qword [rcx + 0x218]
lea rax, [rdx - 1]
xor edx, edx
div r10
movzx r8d, byte [rcx + rdx]
cmp rax, r8
jne 0x180164cff
mov rcx, qword [r11 + rdx*8]
xor eax, eax
cmp rcx, 0xf
seta al
cmp eax, 1
jne 0x180164cff
test rcx, rcx
je 0x180164cff
cmp dword [rcx + 0x48], 0
je 0x180164cff
mov r9, qword [rsp + 0x60]
mov rcx, qword [rcx + 0xc8]
mov r8, rbx
mov rdx, rdi
mov dword [rsp + 0x60], eax
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
jmp fcn.18015dcb0
xor eax, eax
mov rbx, qword [rsp + 0x40]
add rsp, 0x30
pop rdi
ret
Function at 0x180165ad0
Capabilities:
Set socket configuration

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x10], rdx
push rdi
sub rsp, 0x30
mov rdi, r8
mov rsi, rcx
mov rbx, r9
mov rcx, qword [rdi + 0xc8]
lea r9, [rsp + 0x48]
mov edx, 0xffff
mov r8d, 0x7010
mov dword [rsp + 0x48], 0
mov dword [rsp + 0x20], 4
call qword [sym.imp.WS2_32.dll_setsockopt]
mov rdx, rdi
mov rcx, rsi
mov dword [rdi + 0x60], 1
call fcn.180163be0
mov rdx, rdi
mov rcx, rsi
cmp eax, 2
je 0x180165b4e
mov r8, rbx
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
jmp fcn.180165e70
xor r9d, r9d
xor r8d, r8d
mov dword [rsp + 0x20], 0
call fcn.1801649e0
lea rcx, [rsi + 0x100]
mov rdx, rbx
call fcn.180126a20
test eax, eax
jne 0x180165b86
mov rcx, qword [rbx + 0x20]
mov r8, rbx
xor edx, edx
mov rcx, qword [rcx]
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
Function at 0x180166ba0
Capabilities:
Send data
Send data on socket

Disassembly:
mov r11, rsp
mov qword [r11 + 0x10], rdx
push r12
push r14
push r15
sub rsp, 0x70
xor eax, eax
mov r14d, r9d
mov r12, r8
mov r15, rcx
test r9d, r9d
jle 0x180166d03
mov qword [r11 + 8], rbx
mov qword [r11 - 0x20], rbp
mov qword [r11 - 0x28], rsi
mov qword [r11 - 0x30], rdi
lea rax, [rcx + 0xd0]
mov qword [r11 - 0x38], r13
mov ebx, dword [r15 + 0x1c]
mov rcx, rax
cmp r14d, ebx
cmovl ebx, r14d
mov ebp, ebx
call fcn.180167540
mov rsi, rax
test ebx, ebx
jns 0x180166c00
mov ebp, dword [r15 + 0x1c]
mov rcx, qword [rax + 0x38]
movsxd r13, ebx
mov rdx, r12
mov r8, r13
mov dword [rax + 0x30], ebp
call fcn.18017dd20
mov rcx, qword [rsp + 0x98]
mov eax, ebx
lock xadd dword [rcx + 0x58], eax
mov rax, qword [rcx + 0xc8]
xor edx, edx
mov dword [rsi + 0x28], 3
mov qword [rsp + 0x30], rdx
mov qword [rsi + 0x58], rax
mov rcx, qword [rsi + 0x58]
mov dword [rsp + 0xa8], edx
mov ebp, edx
lea r8d, [rdx + 1]
mov qword [rsp + 0x28], rsi
mov dword [rsp + 0x20], edx
lea r9, [rsp + 0xa8]
lea rdx, [rsi + 0x30]
mov dword [rsi + 0x44], 2
call qword [sym.imp.WS2_32.dll_WSASend]
cmp eax, 0xffffffff
jne 0x180166c7d
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov ebp, eax
cmp ebp, 0x3e5
mov eax, 0
cmove ebp, eax
lock dec dword [rsi + 0x44]
je 0x180166c95
test ebp, ebp
je 0x180166cbe
lea rcx, [r15 + 0x100]
mov rdx, rsi
call fcn.180126a20
test eax, eax
jne 0x180166cba
mov rcx, qword [rsi + 0x20]
mov r8, rsi
xor edx, edx
mov rcx, qword [rcx]
call qword [sym.imp.KERNEL32.dll_HeapFree]
test ebp, ebp
jne 0x180166cd6
sub r14d, ebx
add r12, r13
lea rax, [r15 + 0xd0]
test r14d, r14d
jg 0x180166be0
jmp 0x180166ce5
neg ebx
mov rdx, qword [rsp + 0x98]
lock xadd dword [rdx + 0x58], ebx
mov rdi, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov rbx, qword [rsp + 0x90]
mov r13, qword [rsp + 0x50]
mov eax, ebp
mov rbp, qword [rsp + 0x68]
add rsp, 0x70
pop r15
pop r14
pop r12
ret