joyce8/EMBER2024-capa huggingface dataset:
Function at 0x18001ac90
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rcx
push rbx
push rbp
push rsi
push rdi
push r13
push r14
push r15
sub rsp, 0x60
mov qword [rsp + 0x20], 0xfffffffffffffffe
mov rsi, rdx
mov r14, rcx
mov r15, qword [rdx + 0x10]
mov r13, qword [rdx + 0x18]
cmp r13, 0x10
jb 0x18001acc3
mov rdx, qword [rdx]
movabs r8, 0xcbf29ce484222325
xor r9d, r9d
test r15, r15
je 0x18001acf4
movabs rcx, 0x100000001b3
nop
movzx eax, byte [r9 + rdx]
xor r8, rax
imul r8, rcx
inc r9
cmp r9, r15
jb 0x18001ace0
mov rax, qword [r14 + 0x30]
and rax, r8
shl rax, 4
mov rdx, qword [r14 + 0x18]
mov qword [rsp + 0xb0], rdx
mov rcx, qword [rdx + rax]
mov qword [rsp + 0xa8], rcx
mov rbx, rcx
add rax, 8
mov qword [rsp + 0xb8], rax
mov rbp, qword [r14 + 8]
nop word [rax + rax]
cmp rcx, rbp
jne 0x18001ad3a
mov rax, rbp
jmp 0x18001ad41
mov rax, qword [rax + rdx]
mov rax, qword [rax]
cmp rbx, rax
je 0x18001adbf
lea rdi, [rbx + 0x10]
mov rdx, rsi
cmp r13, 0x10
jb 0x18001ad56
mov rdx, qword [rsi]
mov r14, qword [rdi + 0x10]
mov rcx, rdi
cmp qword [rdi + 0x18], 0x10
jb 0x18001ad67
mov rcx, qword [rdi]
cmp r14, r15
jne 0x18001ad78
mov r8, r14
call fcn.18004b790
test eax, eax
je 0x18001ad95
mov rbx, qword [rbx]
mov rcx, qword [rsp + 0xa8]
mov rdx, qword [rsp + 0xb0]
mov rax, qword [rsp + 0xb8]
jmp 0x18001ad30
cmp qword [rdi + 0x18], 0x10
jb 0x18001ad9f
mov rdi, qword [rdi]
mov rcx, rsi
cmp r13, 0x10
jb 0x18001adab
mov rcx, qword [rsi]
cmp r15, r14
jne 0x18001adbf
mov r8, r15
mov rdx, rdi
call fcn.18004b790
test eax, eax
je 0x18001adc2
mov rbx, rbp
cmp rbx, rbp
jne 0x18001ae87
mov rdx, rsi
lea rcx, [rsp + 0x38]
call fcn.1800279f0
lea rax, [0x18008323b]
mov qword [rsp + 0x58], rax
mov r14, qword [rsp + 0xa0]
mov rax, qword [r14 + 8]
mov rbx, qword [rax]
mov rdi, qword [rbx + 8]
lea r9, [rsp + 0x38]
mov r8, rdi
mov rdx, rbx
call fcn.18001abf0
mov rdx, rax
mov rax, qword [r14 + 0x10]
movabs rcx, 0x333333333333332
sub rcx, rax
cmp rcx, 1
jb 0x18001aebd
inc rax
mov qword [r14 + 0x10], rax
mov qword [rbx + 8], rdx
mov qword [rdi], rdx
mov r9, qword [r14 + 8]
mov r9, qword [r9]
lea r8, [r9 + 0x10]
lea rdx, [rsp + 0x28]
mov rcx, r14
call fcn.18001c720
nop
mov rdx, qword [rsp + 0x50]
cmp rdx, 0x10
jb 0x18001ae8f
inc rdx
mov rcx, qword [rsp + 0x38]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18001ae80
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18001aeb7
call fcn.18002aef0
jmp 0x18001ae8f
mov r14, qword [rsp + 0xa0]
mov r8, rsi
lea rdx, [rsp + 0x28]
mov rcx, r14
call fcn.18001c990
mov rax, qword [rsp + 0x28]
add rax, 0x30
add rsp, 0x60
pop r15
pop r14
pop r13
pop rdi
pop rsi
pop rbp
pop rbx
ret
call fcn.18004df84
nop
lea rcx, str.list_T__too_long
call fcn.18002849c
int3
Function at 0x18001c600
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
mov qword [rsp + 0x20], r14
push r15
sub rsp, 0x20
cmp qword [r8 + 0x28], 0x10
lea r10, [r8 + 0x10]
mov r11, qword [r8 + 0x20]
mov rdi, r8
mov r15, rdx
mov rsi, rcx
jb 0x18001c636
mov r10, qword [r8 + 0x10]
xor r8d, r8d
movabs r9, 0xcbf29ce484222325
test r11, r11
je 0x18001c674
movabs rcx, 0x100000001b3
nop dword [rax]
nop word [rax + rax]
movzx eax, byte [r8 + r10]
inc r8
xor r9, rax
imul r9, rcx
cmp r8, r11
jb 0x18001c660
mov rdx, qword [rsi + 0x30]
mov rcx, qword [rsi + 0x18]
and rdx, r9
shl rdx, 4
add rcx, rdx
mov rax, qword [rcx]
cmp qword [rcx + 8], rdi
jne 0x18001c6b4
cmp rax, rdi
jne 0x18001c6aa
mov rax, qword [rsi + 8]
mov qword [rcx], rax
mov rcx, qword [rsi + 0x18]
mov rax, qword [rsi + 8]
mov qword [rdx + rcx + 8], rax
jmp 0x18001c6bf
mov rax, qword [rdi + 8]
mov qword [rcx + 8], rax
jmp 0x18001c6bf
cmp rax, rdi
jne 0x18001c6bf
mov rax, qword [rdi]
mov qword [rcx], rax
mov rax, qword [rdi + 8]
lea rcx, [rdi + 0x10]
mov rbx, qword [rdi]
mov qword [rax], rbx
mov rdx, qword [rdi]
mov rax, qword [rdi + 8]
mov qword [rdx + 8], rax
dec qword [rsi + 0x10]
call fcn.18001c550
mov edx, 0x50
mov rcx, rdi
call fcn.18002aef0
mov rsi, qword [rsp + 0x38]
mov rax, r15
mov rdi, qword [rsp + 0x40]
mov r14, qword [rsp + 0x48]
mov qword [r15], rbx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop r15
ret
Function at 0x18001c990
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rdx
mov qword [rax + 8], rcx
push rbx
push rbp
push rsi
push rdi
sub rsp, 0x48
mov qword [rax + 0x20], r12
mov rsi, r8
mov r12, qword [r8 + 0x18]
mov rbp, rcx
mov qword [rax - 0x28], r13
mov r10, r8
mov qword [rax - 0x30], r14
mov r14, qword [r8 + 0x10]
cmp r12, 0x10
jb 0x18001c9c9
mov r10, qword [r8]
xor r8d, r8d
movabs r9, 0xcbf29ce484222325
test r14, r14
je 0x18001ca04
movabs rcx, 0x100000001b3
nop word [rax + rax]
movzx eax, byte [r8 + r10]
inc r8
xor r9, rax
imul r9, rcx
cmp r8, r14
jb 0x18001c9f0
mov rax, qword [rbp + 0x18]
mov rcx, qword [rbp + 0x30]
mov rdi, qword [rbp + 8]
and rcx, r9
shl rcx, 4
mov qword [rsp + 0x30], r15
mov r13, qword [rcx + rax]
add rax, 8
add rax, rcx
mov rbx, r13
mov qword [rsp + 0x80], rax
cmp r13, rdi
jne 0x18001ca3c
mov rax, rdi
jmp 0x18001ca42
mov rax, qword [rax]
mov rax, qword [rax]
cmp rbx, rax
je 0x18001cab8
lea rcx, [rbx + 0x10]
mov rdx, rsi
cmp r12, 0x10
jb 0x18001ca57
mov rdx, qword [rsi]
mov r15, qword [rcx + 0x18]
mov rbp, qword [rcx + 0x10]
cmp r15, 0x10
jb 0x18001ca68
mov rcx, qword [rcx]
cmp rbp, r14
jne 0x18001ca79
mov r8, rbp
call fcn.18004b790
test eax, eax
je 0x18001ca86
mov rbx, qword [rbx]
mov rax, qword [rsp + 0x80]
jmp 0x18001ca32
lea rdx, [rbx + 0x10]
cmp r15, 0x10
jb 0x18001ca93
mov rdx, qword [rdx]
mov rcx, rsi
cmp r12, 0x10
jb 0x18001ca9f
mov rcx, qword [rsi]
cmp r14, rbp
jne 0x18001cab0
mov r8, r14
call fcn.18004b790
test eax, eax
je 0x18001cab3
mov rbx, rdi
mov rax, rbx
jmp 0x18001cabe
mov rbx, rdi
mov rax, rdi
mov r14, qword [rsp + 0x38]
mov r13, qword [rsp + 0x40]
mov r12, qword [rsp + 0x88]
cmp rax, rdi
jne 0x18001cb54
mov rbx, qword [rdi]
lea rax, [rsp + 0x80]
mov rdx, rbx
mov qword [rsp + 0x80], rsi
mov qword [rsp + 0x20], rax
mov rdi, qword [rbx + 8]
mov r8, rdi
call fcn.18001c0b0
mov rbp, qword [rsp + 0x70]
mov rdx, rax
movabs rcx, 0x333333333333332
mov rax, qword [rbp + 0x10]
sub rcx, rax
cmp rcx, 1
jb 0x18001cb72
inc rax
mov rcx, rbp
mov qword [rbp + 0x10], rax
mov qword [rbx + 8], rdx
mov qword [rdi], rdx
mov r9, qword [rbp + 8]
mov rdx, qword [rsp + 0x78]
mov r9, qword [r9]
lea r8, [r9 + 0x10]
call fcn.18001c720
mov rax, qword [rsp + 0x78]
mov r15, qword [rsp + 0x30]
add rsp, 0x48
pop rdi
pop rsi
pop rbp
pop rbx
ret
mov r15, qword [rsp + 0x78]
mov rax, r15
mov qword [r15], rbx
mov byte [r15 + 8], 0
mov r15, qword [rsp + 0x30]
add rsp, 0x48
pop rdi
pop rsi
pop rbp
pop rbx
ret
lea rcx, str.list_T__too_long
call fcn.18002849c
int3
Function at 0x18001cb80
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov rax, rsp
push rbp
push rdi
sub rsp, 0x58
mov qword [rax + 0x18], rbx
lea rbp, [rcx + 0x40]
mov qword [rax - 0x18], rsi
mov rdi, rdx
mov qword [rax - 0x20], r12
mov rsi, rcx
mov qword [rax - 0x28], r13
mov r9, rdx
mov r13, qword [rdx + 0x18]
mov qword [rax - 0x30], r14
mov r14, qword [rdx + 0x10]
mov qword [rsp + 0x70], rbp
cmp r13, 0x10
jb 0x18001cbc0
mov r9, qword [rdx]
xor edx, edx
movabs r8, 0xcbf29ce484222325
test r14, r14
je 0x18001cbf4
movabs rcx, 0x100000001b3
nop dword [rax + rax]
movzx eax, byte [rdx + r9]
inc rdx
xor r8, rax
imul r8, rcx
cmp rdx, r14
jb 0x18001cbe0
mov rax, qword [rsi + 0x58]
mov rcx, qword [rsi + 0x70]
mov rsi, qword [rsi + 0x48]
and rcx, r8
shl rcx, 4
mov qword [rsp + 0x30], r15
mov r12, qword [rcx + rax]
add rax, 8
add rax, rcx
mov rbx, r12
mov qword [rsp + 0x78], rax
nop
cmp r12, rsi
jne 0x18001cc2a
mov rax, rsi
jmp 0x18001cc30
mov rax, qword [rax]
mov rax, qword [rax]
cmp rbx, rax
je 0x18001cc9b
lea rcx, [rbx + 0x10]
mov rdx, rdi
cmp r13, 0x10
jb 0x18001cc45
mov rdx, qword [rdi]
mov r15, qword [rcx + 0x18]
mov rbp, qword [rcx + 0x10]
cmp r15, 0x10
jb 0x18001cc56
mov rcx, qword [rcx]
cmp rbp, r14
jne 0x18001cc67
mov r8, rbp
call fcn.18004b790
test eax, eax
je 0x18001cc71
mov rbx, qword [rbx]
mov rax, qword [rsp + 0x78]
jmp 0x18001cc20
lea rdx, [rbx + 0x10]
cmp r15, 0x10
jb 0x18001cc7e
mov rdx, qword [rdx]
mov rcx, rdi
cmp r13, 0x10
jb 0x18001cc8a
mov rcx, qword [rdi]
cmp r14, rbp
jne 0x18001cc9b
mov r8, r14
call fcn.18004b790
test eax, eax
je 0x18001cc9e
mov rbx, rsi
mov r15, qword [rsp + 0x30]
cmp rbx, rsi
mov rsi, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x80]
mov r14, qword [rsp + 0x38]
mov r13, qword [rsp + 0x40]
mov r12, qword [rsp + 0x48]
mov rbp, qword [rsp + 0x70]
jne 0x18001ccf1
mov r8, rdi
lea rdx, [rsp + 0x20]
mov rcx, rbp
call fcn.18001c990
mov rcx, qword [rsp + 0x20]
lea rdx, [0x18008323b]
add rcx, 0x30
xor r8d, r8d
call fcn.180001520
mov r8, rdi
lea rdx, [rsp + 0x20]
mov rcx, rbp
call fcn.18001c990
mov rax, qword [rsp + 0x20]
add rax, 0x30
add rsp, 0x58
pop rdi
pop rbp
ret

Function at 0x18001cd20
Capabilities:
Get socket status

Disassembly:
mov r11, rsp
push rbx
sub rsp, 0x450
mov rbx, rcx
mov dword [rsp + 0x30], 1
xor eax, eax
mov qword [r11 - 0x210], rbx
inc ecx
mov dword [rsp + 0x240], 1
lea r9, [r11 - 0x218]
mov qword [rsp + 0x38], rbx
xor r8d, r8d
mov dword [r11 + 8], 0xffffffff
lea rdx, [rsp + 0x30]
mov dword [r11 + 0xc], eax
mov qword [rsp + 0x20], rax
call qword [sym.imp.WS2_32.dll_select]
test eax, eax
jle 0x18001cd98
lea rdx, [rsp + 0x30]
mov rcx, rbx
call qword [sym.imp.WS2_32.dll___WSAFDIsSet]
test eax, eax
je 0x18001cd98
mov al, 1
add rsp, 0x450
pop rbx
ret
xor al, al
add rsp, 0x450
pop rbx
ret
Function at 0x18001d4d0
Capabilities:
Connect socket
Resolve dns
Set socket configuration

Disassembly:
mov r11, rsp
push rbp
push rsi
sub rsp, 0xb8
cmp qword [rcx], 0
mov rax, r8
mov r10, rdx
mov rsi, rcx
jne 0x18001d69f
xor ebp, ebp
mov dword [r11 - 0x48], 1
xorps xmm0, xmm0
mov qword [r11 - 0x78], rbp
xorps xmm1, xmm1
mov qword [r11 - 0x50], rbp
lea r9, [r11 - 0x78]
mov dword [r11 - 0x44], 6
lea r8, [r11 - 0x50]
mov rdx, rax
mov rcx, r10
movdqu xmmword [r11 - 0x40], xmm0
movdqu xmmword [r11 - 0x30], xmm1
call qword [sym.imp.WS2_32.dll_GetAddrInfoW]
test eax, eax
jne 0x18001d69f
mov qword [rsp + 0xd8], rbx
mov rbx, qword [rsp + 0x50]
mov qword [rsp + 0xb0], rdi
test rbx, rbx
je 0x18001d670
nop word [rax + rax]
mov r8d, dword [rbx + 0xc]
mov edx, dword [rbx + 8]
mov ecx, dword [rbx + 4]
call qword [sym.imp.WS2_32.dll_socket]
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x18001d643
lea r9, [rsp + 0xd0]
mov dword [rsp + 0xd0], 1
mov edx, 0xffff
mov dword [rsp + 0x20], 4
mov r8d, 8
mov rcx, rax
call qword [sym.imp.WS2_32.dll_setsockopt]
cmp eax, 0xffffffff
je 0x18001d61d
xor eax, eax
mov qword [rsp + 0x40], rbp
mov qword [rsp + 0x68], rax
lea r8, [rsp + 0x58]
mov dword [rsp + 0x70], eax
mov r9d, recv
mov qword [rsp + 0x38], rbp
lea rax, [rsp + 0xe8]
mov qword [rsp + 0x30], rax
mov edx, 0x98000004
lea rax, [rsp + 0x68]
mov dword [rsp + 0x28], recv
mov rcx, rdi
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x5c], 0x1388
mov dword [rsp + 0x60], 0xfa0
mov dword [rsp + 0x58], 1
mov dword [rsp + 0xe8], ebp
call qword [sym.imp.WS2_32.dll_WSAIoctl]
mov r8d, dword [rbx + 0x10]
mov rcx, rdi
mov rdx, qword [rbx + 0x20]
call qword [sym.imp.WS2_32.dll_connect]
cmp eax, 0xffffffff
jne 0x18001d650
mov rcx, rdi
call qword [sym.imp.WS2_32.dll_closesocket]
mov rdi, 0xffffffffffffffff
mov rbx, qword [rbx + 0x28]
test rbx, rbx
jne 0x18001d560
cmp rdi, 0xffffffffffffffff
je 0x18001d66b
mov rdx, rdi
mov rcx, rsi
call fcn.1800247f0
mov rbx, qword [rsp + 0x50]
mov dil, 1
jmp 0x18001d673
mov rbx, qword [rsp + 0x50]
xor dil, dil
test rbx, rbx
je 0x18001d681
mov rcx, rbx
call qword [sym.imp.WS2_32.dll_FreeAddrInfoW]
mov rbx, qword [rsp + 0xd8]
movzx eax, dil
mov rdi, qword [rsp + 0xb0]
add rsp, 0xb8
pop rsi
pop rbp
ret
xor al, al
add rsp, 0xb8
pop rsi
pop rbp
ret
Function at 0x18001eea0
Capabilities:
Enumerate processes

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x260
mov rsi, rdx
lea rcx, [rsp + 0x24]
xor edx, edx
mov r8d, 0x234
mov edi, 0xffffffff
call fcn.18004b570
xor edx, edx
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x18001efaa
lea rdx, [rsp + 0x20]
mov dword [rsp + 0x20], 0x238
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x18001efaa
nop word [rax + rax]
lea rdx, str.explorer.exe
lea rcx, [rsp + 0x4c]
call fcn.18005062c
test eax, eax
je 0x18001ef39
lea rdx, [rsp + 0x20]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x18001ef10
jmp 0x18001ef3d
mov edi, dword [rsp + 0x28]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp edi, 0xffffffff
je 0x18001efaa
mov r8d, edi
xor edx, edx
mov ecx, 0x2000000
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [rsp + 0x270], rax
lea rcx, [rax - 1]
cmp rcx, 0xfffffffffffffffd
ja 0x18001ef9a
mov r8, rsi
mov edx, 0x2000000
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
mov rax, qword [rsp + 0x270]
je 0x18001ef9a
mov rcx, rax
mov bl, 1
call qword [sym.imp.KERNEL32.dll_CloseHandle]
movzx eax, bl
jmp 0x18001efac
xor bl, bl
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
movzx eax, bl
jmp 0x18001efac
xor al, al
lea r11, [rsp + 0x260]
mov rbx, qword [r11 + 0x18]
mov rsi, qword [r11 + 0x20]
mov rsp, r11
pop rdi
ret
Function at 0x18001eff0
Capabilities:
Query or enumerate registry value

Disassembly:
mov rax, rsp
push rbp
lea rbp, [rax - 0x3a8]
sub rsp, 0x4a0
mov qword [rsp + 0x60], 0xfffffffffffffffe
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov rbx, r8
xor esi, esi
mov qword [rsp + 0x58], rsi
lea rax, [rsp + 0x58]
mov qword [rsp + 0x68], rax
mov byte [rsp + 0x70], 1
mov qword [rsp + 0x40], rsi
lea rax, [rsp + 0x58]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rsi
mov dword [rsp + 0x28], 0x20019
mov dword [rsp + 0x20], esi
xor r9d, r9d
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x18001f190
mov edi, esi
xor edx, edx
mov r8d, 0x208
lea rcx, [rbp - 0x80]
call fcn.18004b570
xor edx, edx
mov r8d, 0x208
lea rcx, [rbp + 0x190]
call fcn.18004b570
mov dword [rsp + 0x50], 0x208
mov dword [rbp + 0x3c8], 0x208
lea rax, [rbp + 0x3c8]
mov qword [rsp + 0x38], rax
lea rax, [rbp + 0x190]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x20], rsi
lea r9, [rsp + 0x50]
lea r8, [rbp - 0x80]
xor edx, edx
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegEnumValueW]
test eax, eax
jne 0x18001f190
nop dword [rax]
mov r8d, 1
lea rdx, [0x180082134]
mov rcx, rbx
call fcn.180026ba0
lea rax, [rbp - 0x80]
mov r8, 0xffffffffffffffff
inc r8
cmp word [rax + r8*2], 0
jne 0x18001f100
lea rdx, [rbp - 0x80]
mov rcx, rbx
call fcn.180026ba0
inc edi
xor edx, edx
mov r8d, 0x208
lea rcx, [rbp - 0x80]
call fcn.18004b570
xor edx, edx
mov r8d, 0x208
lea rcx, [rbp + 0x190]
call fcn.18004b570
mov dword [rsp + 0x50], 0x208
mov dword [rbp + 0x3c8], 0x208
lea rax, [rbp + 0x3c8]
mov qword [rsp + 0x38], rax
lea rax, [rbp + 0x190]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x20], rsi
lea r9, [rsp + 0x50]
lea r8, [rbp - 0x80]
mov edx, edi
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegEnumValueW]
test eax, eax
je 0x18001f0e0
mov rcx, qword [rsp + 0x58]
test rcx, rcx
je 0x18001f1a0
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea r11, [rsp + 0x4a0]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret
Function at 0x18001fba0
Capabilities:
Create http request

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x30
cmp qword [rdx + 0x18], 8
mov rbx, rdx
mov rcx, rdx
jb 0x18001fbbf
mov rcx, qword [rdx]
xor esi, esi
xor r9d, r9d
xor r8d, r8d
mov dword [rsp + 0x20], esi
xor edx, edx
call qword [sym.imp.WININET.dll_InternetOpenW]
mov rdx, qword [rbx + 0x18]
mov rdi, rax
cmp rdx, 8
jb 0x18001fc11
mov rcx, qword [rbx]
lea rdx, [rdx*2 + 2]
cmp rdx, 0x1000
jb 0x18001fc0c
mov r8, qword [rcx - 8]
add rdx, 0x27
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x18001fc33
mov rcx, r8
call fcn.18002aef0
mov qword [rbx + 0x10], rsi
mov rax, rdi
mov qword [rbx + 0x18], 7
mov word [rbx], si
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
add rsp, 0x30
pop rdi
ret
call fcn.18004df84
int3

Function at 0x18001fc40
Capabilities:
Connect to http server

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x40
cmp qword [r9 + 0x18], 8
mov rbx, r9
mov rdi, r8
mov rsi, rdx
mov rcx, r9
jb 0x18001fc6a
mov rcx, qword [r9]
call fcn.18005147c
cmp qword [rdi + 0x18], 8
mov rdx, rdi
jb 0x18001fc7c
mov rdx, qword [rdi]
xor ebp, ebp
xor r9d, r9d
mov qword [rsp + 0x38], rbp
movzx r8d, ax
mov dword [rsp + 0x30], 0x84400100
mov rcx, rsi
mov dword [rsp + 0x28], 3
mov qword [rsp + 0x20], rbp
call qword [sym.imp.WININET.dll_InternetConnectW]
mov rdx, qword [rdi + 0x18]
mov rsi, rax
cmp rdx, 8
jb 0x18001fce6
mov rcx, qword [rdi]
lea rdx, [rdx*2 + 2]
cmp rdx, 0x1000
jb 0x18001fce1
mov r8, qword [rcx - 8]
add rdx, 0x27
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x18001fd57
mov rcx, r8
call fcn.18002aef0
mov qword [rdi + 0x10], rbp
mov qword [rdi + 0x18], 7
mov word [rdi], bp
mov rdx, qword [rbx + 0x18]
cmp rdx, 8
jb 0x18001fd30
mov rcx, qword [rbx]
lea rdx, [rdx*2 + 2]
cmp rdx, 0x1000
jb 0x18001fd2b
mov r8, qword [rcx - 8]
add rdx, 0x27
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x18001fd57
mov rcx, r8
call fcn.18002aef0
mov qword [rbx + 0x10], rbp
mov rax, rsi
mov rsi, qword [rsp + 0x60]
mov qword [rbx + 0x18], 7
mov word [rbx], bp
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
add rsp, 0x40
pop rdi
ret
call fcn.18004df84
int3
Function at 0x180021b60
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
cmp qword [r8 + 0x28], 8
lea r11, [r8 + 0x10]
mov rdi, rcx
mov rsi, rdx
mov rcx, qword [r11 + 0x10]
jb 0x180021b87
mov r11, qword [r11]
xor r9d, r9d
movabs r10, 0xcbf29ce484222325
add rcx, rcx
je 0x180021bc4
movabs rdx, 0x100000001b3
nop dword [rax]
nop word [rax + rax]
movzx eax, byte [r9 + r11]
inc r9
xor r10, rax
imul r10, rdx
cmp r9, rcx
jb 0x180021bb0
mov rdx, qword [rdi + 0x30]
mov rcx, qword [rdi + 0x18]
and rdx, r10
shl rdx, 4
add rcx, rdx
mov rax, qword [rcx]
cmp qword [rcx + 8], r8
jne 0x180021c04
cmp rax, r8
jne 0x180021bfa
mov rax, qword [rdi + 8]
mov qword [rcx], rax
mov rcx, qword [rdi + 0x18]
mov rax, qword [rdi + 8]
mov qword [rdx + rcx + 8], rax
jmp 0x180021c0f
mov rax, qword [r8 + 8]
mov qword [rcx + 8], rax
jmp 0x180021c0f
cmp rax, r8
jne 0x180021c0f
mov rax, qword [r8]
mov qword [rcx], rax
mov rax, qword [r8 + 8]
mov rdx, r8
mov rbx, qword [r8]
mov qword [rax], rbx
mov rcx, qword [r8]
mov rax, qword [r8 + 8]
mov qword [rcx + 8], rax
dec qword [rdi + 0x10]
call fcn.180021ef0
mov qword [rsi], rbx
mov rax, rsi
mov rsi, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret
Function at 0x180022150
Capabilities:
Encode data using xor
Encrypt data using rc4 prga
Hash data using fnv

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r12
push r13
push r14
push r15
mov r15, qword [r8 + 0x18]
mov r11, r8
mov rbx, qword [r8 + 0x10]
mov r12, rdx
mov rdi, rcx
cmp r15, 8
jb 0x180022181
mov r8, qword [r8]
lea r10, [rbx + rbx]
xor edx, edx
movabs r9, 0xcbf29ce484222325
test r10, r10
je 0x1800221b4
movabs rcx, 0x100000001b3
movzx eax, byte [rdx + r8]
inc rdx
xor r9, rax
imul r9, rcx
cmp rdx, r10
jb 0x1800221a0
mov rax, qword [rdi + 0x18]
mov rdx, qword [rdi + 0x30]
mov rsi, qword [rdi + 8]
and rdx, r9
shl rdx, 4
mov qword [rsp + 0x28], rbp
mov r14, qword [rdx + rax]
lea r13, [rdx + rax]
mov rcx, r14
cmp r14, rsi
jne 0x1800221e1
mov rax, rsi
jmp 0x1800221e8
mov rax, qword [r13 + 8]
mov rax, qword [rax]
cmp rcx, rax
je 0x1800222b8
lea r10, [rcx + 0x10]
mov rax, r11
cmp r15, 8
jb 0x180022201
mov rax, qword [r11]
mov rbp, qword [r10 + 0x18]
mov rdi, qword [r10 + 0x10]
cmp rbp, 8
jb 0x180022212
mov r10, qword [r10]
cmp rdi, rbx
jne 0x180022253
mov r9, rdi
test rdi, rdi
je 0x18002225b
movzx edx, word [r10]
movzx r8d, word [rax]
cmp dx, r8w
jb 0x180022253
sub r10, rax
cmp dx, r8w
ja 0x180022253
cmp r9, 1
je 0x18002225b
movzx edx, word [rax + r10 + 2]
add rax, 2
dec r9
movzx r8d, word [rax]
cmp dx, r8w
jae 0x180022234
mov rcx, qword [rcx]
jmp 0x1800221d7
lea rax, [rcx + 0x10]
cmp rbp, 8
jb 0x180022268
mov rax, qword [rax]
cmp r15, 8
jb 0x180022271
mov r11, qword [r11]
cmp rbx, rdi
jne 0x1800222af
test rbx, rbx
je 0x1800222b2
movzx edx, word [r11]
movzx r8d, word [rax]
cmp dx, r8w
jb 0x1800222af
sub r11, rax
cmp dx, r8w
ja 0x1800222af
cmp rbx, 1
je 0x1800222b2
movzx edx, word [rax + r11 + 2]
add rax, 2
dec rbx
movzx r8d, word [rax]
cmp dx, r8w
jae 0x180022290
mov rcx, rsi
mov qword [r12], rcx
jmp 0x1800222bc
mov qword [r12], rsi
mov rbp, qword [rsp + 0x28]
mov rax, r12
mov rbx, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x38]
mov rdi, qword [rsp + 0x40]
pop r15
pop r14
pop r13
pop r12
ret
Function at 0x180024740
Capabilities:
Send data
Send data on socket

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r14
sub rsp, 0x20
cmp qword [rcx], 0
mov esi, r8d
mov rbp, rdx
mov r14, rcx
je 0x1800247b1
xor ebx, ebx
xor edi, edi
test rdx, rdx
je 0x1800247b1
test r8d, r8d
jle 0x1800247e5
nop word [rax + rax]
mov rcx, qword [r14]
mov r8d, esi
movsxd rdx, ebx
sub r8d, ebx
add rdx, rbp
xor r9d, r9d
call qword [sym.imp.WS2_32.dll_send]
cmp eax, 0xffffffff
jne 0x1800247d1
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
cmp eax, 0x274c
jne 0x1800247b1
inc edi
cmp edi, 0x32
jl 0x1800247d9
mov eax, 0xffffffff
mov rbx, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x38]
mov rsi, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x48]
add rsp, 0x20
pop r14
ret
test eax, eax
je 0x1800247e1
xor edi, edi
add ebx, eax
cmp ebx, esi
jl 0x180024780
mov eax, ebx
jmp 0x1800247b6
test ebx, ebx
je 0x1800247b1
mov eax, ebx
jmp 0x1800247b6

Function at 0x1800247f0
Capabilities:
Set socket configuration

Disassembly:
push rbx
sub rsp, 0x30
mov qword [rcx], rdx
mov rax, rdx
mov rbx, rcx
test rdx, rdx
je 0x180024856
lea r9, [rsp + 0x40]
mov dword [rsp + 0x40], 0x1000000
mov edx, 0xffff
mov dword [rsp + 0x20], 4
mov r8d, 0x1002
mov rcx, rax
call qword [sym.imp.WS2_32.dll_setsockopt]
mov rcx, qword [rbx]
lea r9, [rsp + 0x48]
mov edx, 0xffff
mov dword [rsp + 0x48], 0x1000000
mov r8d, 0x1001
mov dword [rsp + 0x20], 4
call qword [sym.imp.WS2_32.dll_setsockopt]
add rsp, 0x30
pop rbx
ret