joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1801ce540
Capabilities:
Receive data
Receive data on socket

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x20
movsxd r9, r8d
lea rbx, [rdx + 0x210]
mov rax, r9
mov rbp, rcx
shl rax, 5
add rbx, rax
mov rax, qword [rdx + 0x370]
mov rsi, qword [rdx + r9*8 + 0x1b8]
mov rdi, qword [rbx + 8]
sub rdi, qword [rbx + 0x10]
test byte [rax + 0x84], 3
je 0x1801ce61d
lea rax, [0x1801decc0]
cmp qword [rdx + r9*8 + 0x1e0], rax
jne 0x1801ce61d
cmp qword [rbx], 0
je 0x1801ce5ab
test rdi, rdi
je 0x1801ce61d
or r8, 0xffffffffffffffff
xor r9d, r9d
or rdx, r8
mov rcx, rsi
call fcn.1801e0170
cmp eax, 0xffffffff
je 0x1801ce61d
test al, 1
je 0x1801ce61d
cmp qword [rbx], 0
jne 0x1801ce5fc
mov eax, dword [rbp + 0x6e4]
lea ecx, [rax + rax]
mov qword [rbx + 8], rcx
call qword [fcn.1802100c8]
mov qword [rbx], rax
test rax, rax
jne 0x1801ce5ee
mov eax, reloc.WLDAP32.dll_Ordinal_27
jmp 0x1801ce61f
mov rdi, qword [rbx + 8]
xor eax, eax
mov qword [rbx + 0x10], rax
mov qword [rbx + 0x18], rax
mov rdx, qword [rbx]
xor r9d, r9d
add rdx, qword [rbx + 0x10]
mov r8d, edi
mov rcx, rsi
call qword [sym.imp.WS2_32.dll_recv]
movsxd rcx, eax
test eax, eax
jle 0x1801ce61d
add qword [rbx + 0x10], rcx
xor eax, eax
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
add rsp, 0x20
pop rdi
ret

Function at 0x1801ceca0
Capabilities:
Receive data
Receive data on socket

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rbx, rdx
mov rdi, rcx
xor edx, edx
call fcn.1801dec80
test al, al
je 0x1801cecd7
mov rdx, rbx
mov rcx, rdi
call fcn.1801c7480
test eax, eax
jne 0x1801ced08
xor al, al
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
mov rcx, qword [rbx + 0x1b8]
cmp rcx, 0xffffffffffffffff
je 0x1801cecca
mov r9d, 2
lea rdx, [rsp + 0x40]
lea r8d, [r9 - 1]
call qword [sym.imp.WS2_32.dll_recv]
test eax, eax
jne 0x1801ced08
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
mov al, 1
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x1801cef60
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
push rbx
push rbp
push rsi
push rdi
sub rsp, 0x1c8
mov rax, qword [0x18049d0e0]
xor rax, rsp
mov qword [rsp + 0x1b0], rax
mov rdi, r8
mov dword [rsp + 0x20], 0x80
mov rbx, rdx
mov rsi, rcx
xor edx, edx
lea rcx, [rsp + 0x30]
mov r8d, 0x80
mov rbp, r9
call fcn.18020d410
lea r8, [rsp + 0x20]
mov rcx, rbx
lea rdx, [rsp + 0x30]
call qword [sym.imp.WS2_32.dll_getsockname]
test eax, eax
je 0x1801cefe4
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov r8d, 0x100
lea rdx, [rsp + 0xb0]
mov ecx, eax
mov ebx, eax
call fcn.1801b6bd0
mov r8d, ebx
lea rdx, str.getsockname___failed_with_errno__d:__s
jmp 0x1801cf02b
mov edx, dword [rsp + 0x20]
lea rcx, [rsp + 0x30]
mov r9, rbp
mov r8, rdi
call fcn.1801ce970
test al, al
jne 0x1801cf036
call fcn.180213f9c
mov rbx, rax
call fcn.180213f9c
mov ecx, dword [rbx]
lea rdx, [rsp + 0xb0]
mov r8d, 0x100
mov rdi, rax
call fcn.1801b6bd0
mov r8d, dword [rdi]
lea rdx, str.ssloc_inet_ntop___failed_with_errno__d:__s
mov r9, rax
mov rcx, rsi
call fcn.1801cdb70
mov rcx, qword [rsp + 0x1b0]
xor rcx, rsp
call fcn.1800b80c0
add rsp, 0x1c8
pop rdi
pop rsi
pop rbp
pop rbx
ret

Function at 0x1801cf390
Capabilities:
Set socket configuration

Disassembly:
push rbx
sub rsp, 0x30
mov eax, dword [0x180518bdc]
mov rbx, rcx
mov dword [rsp + 0x50], 0x4020
mov dword [rsp + 0x48], 0
mov dword [rsp + 0x58], 4
test eax, eax
jne 0x1801cf3f4
lea r9d, [rax + 2]
mov dword [rsp + 0x20], 3
xor r8d, r8d
lea ecx, [rax + 6]
xor edx, edx
call fcn.1801fee70
test al, al
je 0x1801cf3e8
mov dword [0x180518bdc], 2
add rsp, 0x30
pop rbx
ret
mov dword [0x180518bdc], 1
jmp 0x1801cf3f9
cmp eax, 2
je 0x1801cf44b
lea rax, [rsp + 0x58]
mov edx, 0xffff
lea r9, [rsp + 0x48]
mov qword [rsp + 0x20], rax
mov r8d, 0x1001
mov rcx, rbx
call qword [sym.imp.WS2_32.dll_getsockopt]
test eax, eax
jne 0x1801cf42a
mov eax, dword [rsp + 0x50]
cmp dword [rsp + 0x48], eax
jg 0x1801cf44b
lea r9, [rsp + 0x50]
mov dword [rsp + 0x20], 4
mov edx, 0xffff
mov r8d, 0x1001
mov rcx, rbx
call qword [sym.imp.WS2_32.dll_setsockopt]
add rsp, 0x30
pop rbx
ret
Function at 0x1801cf6c0
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
push rbp
push rbx
push rsi
push r14
push r15
lea rbp, [rsp - 0xf0]
sub rsp, 0x1f0
mov rax, qword [0x18049d0e0]
xor rax, rsp
mov qword [rbp + 0xe0], rax
xor eax, eax
or esi, 0xffffffff
mov rbx, r8
mov r14, rdx
mov r15, rcx
mov qword [rbp - 0x50], rax
mov qword [rbp - 0x48], rax
mov qword [rbp - 0x40], rax
mov qword [rbp - 0x38], rax
mov qword [rbp - 0x30], rax
mov dword [rbp - 0x28], eax
mov word [rbp - 0x24], ax
cmp byte [rdx + 0x337], al
jne 0x1801cf72f
cmp byte [rdx + 0x55d], 3
jne 0x1801cf72a
cmp byte [rdx + 0x348], al
jne 0x1801cf72f
call fcn.1801cf060
xor edx, edx
mov dword [rsp + 0x20], 0x80
mov r8d, 0x80
lea rcx, [rsp + 0x30]
call fcn.18020d410
lea r8, [rsp + 0x20]
mov rcx, rbx
lea rdx, [rsp + 0x30]
call qword [sym.imp.WS2_32.dll_getsockname]
test eax, eax
je 0x1801cf793
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov r8d, 0x100
lea rdx, [rbp - 0x20]
mov ecx, eax
mov ebx, eax
call fcn.1801b6bd0
mov r9, rax
lea rdx, str.getsockname___failed_with_errno__d:__s
mov r8d, ebx
mov rcx, r15
call fcn.1801cdb70
jmp 0x1801cf86a
movzx ecx, word [rsp + 0x30]
sub ecx, 1
je 0x1801cf841
sub ecx, 1
je 0x1801cf7dc
cmp ecx, 0x15
jne 0x1801cf7e8
lea rdx, [rsp + 0x38]
mov ecx, reloc.WS2_32.dll_socket
lea r8, [rbp - 0x50]
mov r9d, reloc.WLDAP32.dll_Ordinal_46
call sub.WS2_32.dll_inet_ntop
test rax, rax
je 0x1801cf7e8
movzx ecx, word [rsp + 0x32]
call qword [sym.imp.WS2_32.dll_ntohs]
movzx esi, ax
jmp 0x1801cf86a
lea rdx, [rsp + 0x34]
mov ecx, 2
jmp 0x1801cf7b5
mov qword [rsp + 0x238], rdi
xor esi, esi
mov byte [rbp - 0x50], 0
call fcn.180213f9c
mov dword [rax], 0x273f
call fcn.180213f9c
mov rbx, rax
call fcn.180213f9c
mov ecx, dword [rbx]
lea rdx, [rbp - 0x20]
mov r8d, 0x100
mov rdi, rax
call fcn.1801b6bd0
mov r8d, dword [rdi]
lea rdx, str.ssloc_inet_ntop___failed_with_errno__d:__s
mov r9, rax
mov rcx, r15
call fcn.1801cdb70
mov rdi, qword [rsp + 0x238]
jmp 0x1801cf86a
cmp dword [rsp + 0x20], 2
jle 0x1801cf864
lea r9, [rsp + 0x32]
mov edx, reloc.WLDAP32.dll_Ordinal_46
lea r8, [0x18046c008]
lea rcx, [rbp - 0x50]
call sym.gcm64.dll_curl_msnprintf
jmp 0x1801cf868
mov byte [rbp - 0x50], 0
xor esi, esi
mov r9d, esi
lea r8, [rbp - 0x50]
mov rdx, r14
mov rcx, r15
call fcn.1801cf2a0
mov rcx, qword [rbp + 0xe0]
xor rcx, rsp
call fcn.1800b80c0
add rsp, 0x1f0
pop r15
pop r14
pop rsi
pop rbx
pop rbp
ret
Function at 0x1801d06a0
Capabilities:
Set socket configuration

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x70
mov rax, qword [0x18049d0e0]
xor rax, rsp
mov qword [rsp + 0x68], rax
xor esi, esi
mov dword [rsp + 0x20], 4
mov eax, esi
lea r9, [rsp + 0x50]
cmp byte [rcx + 0xada], al
mov rdi, rdx
mov rbx, rcx
mov edx, 0xffff
setne al
lea r8d, [rsi + 8]
mov rcx, rdi
mov dword [rsp + 0x50], eax
call qword [sym.imp.WS2_32.dll_setsockopt]
test eax, eax
jns 0x1801d070f
mov r8, rdi
lea rdx, str.Failed_to_set_SO_KEEPALIVE_on_fd__d
mov rcx, rbx
call fcn.1801cdd00
jmp 0x1801d079e
mov ecx, dword [rbx + 0xa44]
mov dword [rsp + 0x58], 1
call fcn.1801d0970
imul ecx, eax, 0x3e8
mov dword [rsp + 0x50], ecx
mov dword [rsp + 0x5c], ecx
mov ecx, dword [rbx + 0xa48]
call fcn.1801d0970
imul ecx, eax, 0x3e8
lea r8, [rsp + 0x58]
mov qword [rsp + 0x40], rsi
lea rax, [rsp + 0x54]
mov qword [rsp + 0x38], rsi
mov r9d, recvfrom
mov qword [rsp + 0x30], rax
mov edx, 0x98000004
mov dword [rsp + 0x28], esi
mov dword [rsp + 0x50], ecx
mov dword [rsp + 0x60], ecx
mov rcx, rdi
mov qword [rsp + 0x20], rsi
call qword [sym.imp.WS2_32.dll_WSAIoctl]
test eax, eax
je 0x1801d079e
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov r8d, edi
lea rdx, str.Failed_to_set_SIO_KEEPALIVE_VALS_on_fd__d:__d
mov r9d, eax
mov rcx, rbx
call fcn.1801cdd00
mov rcx, qword [rsp + 0x68]
xor rcx, rsp
call fcn.1800b80c0
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rsp, r11
pop rdi
ret

Function at 0x1801d07c0
Capabilities:
Set socket configuration

Disassembly:
push rbx
sub rsp, 0x150
mov rax, qword [0x18049d0e0]
xor rax, rsp
mov qword [rsp + 0x140], rax
mov rax, rdx
mov dword [rsp + 0x30], 1
mov edx, 6
mov dword [rsp + 0x20], 4
mov rbx, rcx
lea r9, [rsp + 0x30]
mov rcx, rax
lea r8d, [rdx - 5]
call qword [sym.imp.WS2_32.dll_setsockopt]
test eax, eax
jns 0x1801d0836
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov r8d, 0x100
lea rdx, [rsp + 0x40]
mov ecx, eax
call fcn.1801b6bd0
mov r8, rax
lea rdx, str.Could_not_set_TCP_NODELAY:__s
mov rcx, rbx
call fcn.1801cdd00
mov rcx, qword [rsp + 0x140]
xor rcx, rsp
call fcn.1800b80c0
add rsp, 0x150
pop rbx
ret

Function at 0x1801d0930
Capabilities:
Read file on windows

Disassembly:
sub rsp, 0x28
call fcn.1802317cc
cdqe
add rsp, 0x28
ret
Function at 0x1801d0c30
Capabilities:
Get common file path

Disassembly:
push rbx
push rbp
push rdi
sub rsp, 0x20
mov rbx, rcx
xor ebp, ebp
lea rcx, str.kernel32
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rdi, rax
test rax, rax
jne 0x1801d0c5a
add rsp, 0x20
pop rdi
pop rbp
pop rbx
ret
lea rdx, str.LoadLibraryExA
mov qword [rsp + 0x48], r14
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [0x18032ce84]
mov rcx, rbx
mov r14, rax
call fcn.180225bbc
test rax, rax
je 0x1801d0cbd
mov rcx, rbx
test r14, r14
je 0x1801d0ca7
xor edx, edx
lea r8d, [rdx + 8]
call r14
mov r14, qword [rsp + 0x48]
mov rbp, rax
add rsp, 0x20
pop rdi
pop rbp
pop rbx
ret
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov r14, qword [rsp + 0x48]
mov rbp, rax
add rsp, 0x20
pop rdi
pop rbp
pop rbx
ret
test r14, r14
je 0x1801d0cf5
lea rdx, str.AddDllDirectory
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x1801d0cf5
xor edx, edx
mov r8d, 0x800
mov rcx, rbx
call r14
mov r14, qword [rsp + 0x48]
mov rbp, rax
add rsp, 0x20
pop rdi
pop rbp
pop rbx
ret
xor edx, edx
mov qword [rsp + 0x50], r15
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
mov r15d, eax
test eax, eax
je 0x1801d0db8
mov qword [rsp + 0x40], rsi
or rsi, 0xffffffffffffffff
mov rdx, rsi
nop dword [rax + rax]
inc rdx
cmp byte [rbx + rdx], bpl
jne 0x1801d0d20
lea ecx, [rax + 1]
add rcx, rdx
call qword [fcn.1802100c8]
mov rdi, rax
test rax, rax
je 0x1801d0daa
mov edx, r15d
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
test eax, eax
je 0x1801d0daa
mov rax, rsi
cmp byte [rdi + rax + 1], bpl
lea rax, [rax + 1]
jne 0x1801d0d50
mov ecx, 0x5c
mov word [rax + rdi], cx
cmp byte [rdi + rsi + 1], bpl
lea rsi, [rsi + 1]
jne 0x1801d0d64
lea rcx, [rsi + rdi]
sub rcx, rbx
nop word [rax + rax]
movzx eax, byte [rbx]
mov byte [rcx + rbx], al
lea rbx, [rbx + 1]
test al, al
jne 0x1801d0d80
mov rcx, rdi
test r14, r14
je 0x1801d0da1
xor edx, edx
lea r8d, [rdx + 8]
call r14
jmp 0x1801d0da7
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rbp, rax
mov rcx, rdi
call qword [fcn.18020f174]
mov rsi, qword [rsp + 0x40]
mov r15, qword [rsp + 0x50]
mov rax, rbp
mov r14, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
pop rbp
pop rbx
ret
Function at 0x1801d0e20
Capabilities:
Initialize winsock library

Disassembly:
sub rsp, 0x1e8
mov rax, qword [0x18049d0e0]
xor rax, rsp
mov qword [rsp + 0x1d0], rax
test cl, 2
je 0x1801d0e86
mov ecx, 0x202
lea rdx, [rsp + 0x30]
call qword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
jne 0x1801d0e69
movzx eax, word [rsp + 0x30]
cmp al, 2
jne 0x1801d0e63
shr ax, 8
cmp al, 2
je 0x1801d0e86
call qword [sym.imp.WS2_32.dll_WSACleanup]
mov eax, 2
mov rcx, qword [rsp + 0x1d0]
xor rcx, rsp
call fcn.1800b80c0
add rsp, 0x1e8
ret
lea rcx, str.iphlpapi.dll
call fcn.1801d0c30
mov qword [0x180518be8], rax
test rax, rax
je 0x1801d0ec3
lea rdx, str.if_nametoindex
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x180518be0]
test rax, rax
cmovne rcx, rax
mov qword [0x180518be0], rcx
xor edx, edx
mov dword [rsp + 0x20], 3
mov r9d, 2
xor r8d, r8d
lea ecx, [rdx + 6]
call fcn.1801fee70
test al, al
lea rcx, [0x18051fed0]
setne byte [0x18051fece]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
xor eax, eax
mov rcx, qword [rsp + 0x1d0]
xor rcx, rsp
call fcn.1800b80c0
add rsp, 0x1e8
ret

Function at 0x1801d6e10
Capabilities:
Convert ip address from string

Disassembly:
cmp qword [rsp + 0x28], 0
mov qword [r9], 0
jge 0x1801d6e25
mov eax, 0xfffffffe
ret
mov qword [rsp + 0x28], r9
mov r9b, 1
jmp fcn.1801d6ad0

Function at 0x1801d72f0
Capabilities:
Convert ip address from string

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x30
mov rdi, rdx
mov esi, ecx
or rbx, 0xffffffffffffffff
nop dword [rax]
cmp byte [rdx + rbx + 1], 0
lea rbx, [rbx + 1]
jne 0x1801d7310
xor eax, eax
mov ebp, 2
mov qword [rsp + 0x20], rax
mov word [rsp + 0x20], bp
mov qword [rsp + 0x28], rax
call qword [sym.imp.WS2_32.dll_htons]
lea r8, [rsp + 0x40]
mov ecx, ebp
lea rdx, str.127.0.0.1
mov word [rsp + 0x22], ax
call qword [sym.imp.WS2_32.dll_inet_pton]
cmp eax, 1
jge 0x1801d735c
xor eax, eax
jmp 0x1801d73e2
mov eax, dword [rsp + 0x40]
lea rcx, [rbx + 0x41]
mov edx, 1
mov dword [rsp + 0x24], eax
call qword [fcn.180213ff0]
mov rbx, rax
test rax, rax
je 0x1801d7355
movups xmm0, xmmword [rsp + 0x20]
mov dword [rax], 0
mov rdx, rdi
mov dword [rax + 4], ebp
mov dword [rax + 8], 1
mov dword [rax + 0xc], 6
mov dword [rax + reloc.WS2_32.dll_recv], 0x10
add rax, 0x30
mov qword [rbx + 0x20], rax
movups xmmword [rax], xmm0
mov rcx, qword [rbx + 0x20]
add rcx, 0x10
mov qword [rbx + 0x18], rcx
nop dword [rax + rax]
movzx eax, byte [rdx]
lea rdx, [rdx + 1]
mov byte [rcx], al
lea rcx, [rcx + 1]
test al, al
jne 0x1801d73c0
mov rdx, rdi
mov ecx, esi
call fcn.1801d7400
mov qword [rbx + 0x28], rax
mov rax, rbx
mov rbx, qword [rsp + 0x48]
mov rbp, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret
Function at 0x1801d7400
Capabilities:
Convert ip address from string

Disassembly:
push rbx
push rsi
push rdi
sub rsp, 0x60
mov rax, qword [0x18049d0e0]
xor rax, rsp
mov qword [rsp + 0x50], rax
mov esi, ecx
mov rbx, rdx
or rcx, 0xffffffffffffffff
inc rcx
cmp byte [rdx + rcx], 0
jne 0x1801d7420
add rcx, 0x4d
mov edx, 1
call qword [fcn.180213ff0]
mov rdi, rax
test rax, rax
je 0x1801d74fc
mov qword [rsp + 0x90], rbp
movzx ecx, si
mov ebp, reloc.WS2_32.dll_socket
mov word [rsp + 0x20], bp
call qword [sym.imp.WS2_32.dll_htons]
xor esi, esi
lea r8, [rsp + 0x40]
lea rdx, [0x180400588]
mov word [rsp + 0x22], ax
mov ecx, ebp
mov dword [rsp + 0x24], esi
call qword [sym.imp.WS2_32.dll_inet_pton]
cmp eax, 1
jge 0x1801d7487
xor eax, eax
jmp 0x1801d74f4
movups xmm1, xmmword [rsp + 0x40]
lea rax, [rdi + 0x30]
mov dword [rdi], esi
mov qword [rdi + 0x20], rax
mov dword [rdi + 4], ebp
mov dword [rdi + 8], 1
mov dword [rdi + 0xc], 6
mov dword [rdi + 0x10], Ordinal_30
mov qword [rdi + 0x28], rsi
movups xmmword [rsp + 0x28], xmm1
movups xmm0, xmmword [rsp + 0x20]
unpckhpd xmm1, xmm1
movups xmmword [rax], xmm0
movsd qword [rax + 0x10], xmm1
mov dword [rax + 0x18], esi
mov rcx, qword [rdi + 0x20]
add rcx, 0x1c
mov qword [rdi + 0x18], rcx
nop word [rax + rax]
movzx eax, byte [rbx]
lea rbx, [rbx + 1]
mov byte [rcx], al
lea rcx, [rcx + 1]
test al, al
jne 0x1801d74e0
mov rax, rdi
mov rbp, qword [rsp + 0x90]
mov rcx, qword [rsp + 0x50]
xor rcx, rsp
call fcn.1800b80c0
add rsp, 0x60
pop rdi
pop rsi
pop rbx
ret
Function at 0x1801e0e00
Capabilities:
Move file

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x60
mov rbx, rcx
movaps xmmword [rsp + 0x50], xmm6
lea rcx, [rsp + 0x30]
mov rdi, rdx
call fcn.1801d5750
mov rcx, rbx
movups xmm6, xmmword [rax]
call case.0x1801c19f5.0
mov rcx, rdi
mov rsi, rax
call case.0x1801c19f5.0
mov r8d, 1
mov rdx, rax
mov rcx, rsi
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_MoveFileExA]
test eax, eax
jne 0x1801e0eb0
nop dword [rax]
nop word [rax + rax]
lea rcx, [rsp + 0x40]
movdqa xmmword [rsp + 0x20], xmm6
call fcn.1801d5750
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x30]
movups xmm0, xmmword [rax]
movaps xmmword [rsp + 0x30], xmm0
call fcn.1801d57d0
cmp rax, 0x3e8
ja 0x1801e0ee1
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_Sleep]
mov r8d, 1
mov rdx, rbx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_MoveFileExA]
test eax, eax
je 0x1801e0e60
test rsi, rsi
je 0x1801e0ebd
mov rcx, rsi
call fcn.18020f174
test rbx, rbx
je 0x1801e0eca
mov rcx, rbx
call fcn.18020f174
xor eax, eax
mov rbx, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
movaps xmm6, xmmword [rsp + 0x50]
add rsp, 0x60
pop rdi
ret
test rsi, rsi
je 0x1801e0eee
mov rcx, rsi
call fcn.18020f174
test rbx, rbx
je 0x1801e0efb
mov rcx, rbx
call fcn.18020f174
mov eax, 1
jmp 0x1801e0ecc
Function at 0x1801e12b0
Capabilities:
Resolve dns

Disassembly:
push rbp
push r12
push r13
push r15
sub rsp, 0x28
mov r13, r9
xor ebp, ebp
mov qword [r9], rbp
xor r15d, r15d
lea r9, [rsp + 0x68]
call qword [sym.imp.WS2_32.dll_getaddrinfo]
mov r12d, eax
test eax, eax
jne 0x1801e144e
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x60], rdi
mov rdi, qword [rsp + 0x68]
test rdi, rdi
je 0x1801e142e
mov qword [rsp + 0x58], rsi
mov qword [rsp + 0x20], r14
nop
mov rax, qword [rdi + 0x18]
test rax, rax
je 0x1801e131e
or rbx, 0xffffffffffffffff
nop dword [rax]
inc rbx
cmp byte [rax + rbx], 0
jne 0x1801e1310
inc rbx
jmp 0x1801e1320
xor ebx, ebx
mov eax, dword [rdi + 4]
cmp eax, 2
jne 0x1801e132e
lea r14d, [rax + 0xe]
jmp 0x1801e133b
cmp eax, 0x17
jne 0x1801e13d4
lea r14d, [rax + 5]
cmp qword [rdi + 0x20], 0
je 0x1801e13d4
mov rax, qword [rdi + 0x10]
test rax, rax
je 0x1801e13d4
cmp rax, r14
jb 0x1801e13d4
lea rcx, [rbx + 0x30]
add rcx, r14
call qword [fcn.1802100c8]
mov rsi, rax
test rax, rax
je 0x1801e13e3
mov ecx, dword [rdi]
mov r8, r14
mov dword [rax], ecx
mov ecx, dword [rdi + 4]
mov dword [rax + 4], ecx
mov ecx, dword [rdi + 8]
mov dword [rax + 8], ecx
mov ecx, dword [rdi + 0xc]
mov dword [rax + 0xc], ecx
lea rcx, [rsi + 0x30]
mov dword [rax + 0x10], r14d
xor eax, eax
mov qword [rsi + 0x18], rax
mov qword [rsi + 0x28], rax
mov qword [rsi + 0x20], rcx
mov rdx, qword [rdi + 0x20]
call fcn.18020cf10
test rbx, rbx
je 0x1801e13c1
mov rcx, qword [rsi + 0x20]
mov r8, rbx
add rcx, r14
mov qword [rsi + 0x18], rcx
mov rdx, qword [rdi + 0x18]
call fcn.18020cf10
test rbp, rbp
cmove rbp, rsi
test r15, r15
je 0x1801e13d1
mov qword [r15 + 0x28], rsi
mov r15, rsi
mov rdi, qword [rdi + 0x28]
test rdi, rdi
jne 0x1801e1300
jmp 0x1801e13e9
mov r12d, 8
mov rcx, qword [rsp + 0x68]
mov r14, qword [rsp + 0x20]
mov rsi, qword [rsp + 0x58]
test rcx, rcx
je 0x1801e1403
call qword [sym.imp.WS2_32.dll_freeaddrinfo]
test r12d, r12d
je 0x1801e1429
test rbp, rbp
je 0x1801e1425
nop dword [rax]
mov rbx, qword [rbp + 0x28]
mov rcx, rbp
call qword [fcn.18020f174]
mov rbp, rbx
test rbx, rbx
jne 0x1801e1410
xor ebp, ebp
jmp 0x1801e143d
test rbp, rbp
jne 0x1801e143d
mov r12d, 0x2af9
mov ecx, r12d
call qword [sym.imp.WS2_32.dll_WSASetLastError]
mov rdi, qword [rsp + 0x60]
mov eax, r12d
mov rbx, qword [rsp + 0x50]
mov qword [r13], rbp
add rsp, 0x28
pop r15
pop r13
pop r12
pop rbp
ret
Function at 0x1801e16d0
Capabilities:
Convert ip address from string

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rbp
push rsi
push rdi
push r14
sub rsp, 0x40
mov rax, qword [0x18049d0e0]
xor rax, rsp
mov qword [rsp + 0x38], rax
mov ebp, edx
lea r8, [rsp + 0x20]
mov rdx, rcx
mov rbx, rcx
mov ecx, 2
call qword [sym.imp.WS2_32.dll_inet_pton]
test eax, eax
jle 0x1801e1798
mov ecx, 0x40
call qword [fcn.1802100c8]
mov rdi, rax
test rax, rax
je 0x1801e173e
mov rcx, rbx
call qword [case.0x1801c19f5.0]
mov rsi, rax
test rax, rax
jne 0x1801e1747
mov rcx, rdi
call qword [fcn.18020f174]
xor ebx, ebx
mov eax, ebx
jmp 0x1801e17f5
mov eax, dword [rsp + 0x20]
lea rcx, [rdi + 0x20]
mov dword [rcx], eax
mov dword [rdi + 0x10], 0x40002
lea rax, [rdi + 0x30]
xor ebx, ebx
mov qword [rdi + 8], rbx
mov edx, ebp
mov qword [rdi], rsi
mov qword [rdi + 0x18], rax
mov qword [rax], rcx
mov rcx, rdi
mov rax, qword [rdi + 0x18]
mov qword [rax + 8], rbx
call fcn.1801e1460
mov rcx, rsi
mov rbx, rax
call qword [fcn.18020f174]
mov rcx, rdi
call qword [fcn.18020f174]
mov rax, rbx
jmp 0x1801e17f5
lea r8, [rsp + 0x28]
mov rdx, rbx
mov ecx, reloc.WS2_32.dll_socket
call qword [sym.imp.WS2_32.dll_inet_pton]
test eax, eax
jle 0x1801e17f3
mov ecx, 0x40
call qword [fcn.1802100c8]
mov rdi, rax
test rax, rax
je 0x1801e173e
mov rcx, rbx
call qword [case.0x1801c19f5.0]
mov rsi, rax
test rax, rax
je 0x1801e1735
movups xmm0, xmmword [rsp + 0x28]
lea rcx, [rdi + 0x20]
movups xmmword [rcx], xmm0
mov dword [rdi + 0x10], 0x100017
jmp 0x1801e1758
xor eax, eax
mov rcx, qword [rsp + 0x38]
xor rcx, rsp
call fcn.1800b80c0
mov rbx, qword [rsp + 0x70]
mov rbp, qword [rsp + 0x78]
add rsp, 0x40
pop r14
pop rdi
pop rsi
ret

Function at 0x1801e1a40
Capabilities:
Generate random numbers via winapi

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x20
mov rdi, rdx
mov edx, Ordinal_46
mov rsi, r8
mov rbp, rcx
test r8, r8
je 0x1801e1b0b
nop dword [rax + rax]
mov ebx, 4
lea rdx, [rsp + 0x40]
cmp rsi, rbx
mov r8d, 4
mov rcx, rbp
cmovb rbx, rsi
call fcn.1801c7db0
cmp eax, 4
jne 0x1801e1abe
cmp byte [0x180518bf4], 0
jne 0x1801e1aca
xor eax, eax
lea rdx, [rsp + 0x40]
xor ecx, ecx
mov dword [rsp + 0x40], eax
lea r9d, [rax + 2]
lea r8d, [rax + 4]
call sub.bcrypt.dll_BCryptGenRandom
neg eax
sbb eax, eax
and eax, 2
mov edx, eax
test eax, eax
jne 0x1801e1b0d
mov eax, dword [rsp + 0x40]
jmp 0x1801e1ae8
imul eax, dword [0x180518bf0], 0x41c64e6d
add eax, 0x3039
mov dword [0x180518bf0], eax
rol eax, 0x10
mov dword [rsp + 0x40], eax
xor edx, edx
test rbx, rbx
je 0x1801e1b02
sub rsi, rbx
mov byte [rdi], al
inc rdi
shr eax, 8
sub rbx, 1
jne 0x1801e1af0
mov dword [rsp + 0x40], eax
test rsi, rsi
jne 0x1801e1a70
mov eax, edx
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop rdi
ret