joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1402f4d50
Capabilities:
Get system information on windows

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rdi
push rsi
push rbx
sub rsp, 0x58
lea rbp, [rsp + 0x90]
xor eax, eax
mov qword [rbp - 0x40], rax
mov qword [rbp - 0x40], rcx
mov qword [rbp - 0x48], rcx
lea rcx, [rbp - 0x70]
call fcn.140008280
mov rcx, qword [rbp - 0x48]
call sub.KERNEL32.dll_GetSystemInfo
lea rcx, [rbp - 0x70]
call fcn.1400082d0
nop
add rsp, 0x58
pop rbx
pop rsi
pop rdi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret

Function at 0x1402f52d0
Capabilities:
Get file size

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rdi
push rsi
push rbx
sub rsp, 0x78
lea rbp, [rsp + 0xb0]
vxorps xmm4, xmm4, xmm4
vmovdqa xmmword [rbp - 0x50], xmm4
xor eax, eax
mov qword [rbp - 0x40], rax
mov qword [rbp + 0x10], rcx
mov rbx, rdx
lea rdx, [rbp - 0x40]
call fcn.140127140
mov rcx, qword [rbp + 0x10]
mov rsi, qword [rcx + 8]
mov qword [rbp - 0x48], rbx
xor ecx, ecx
call sub.KERNEL32.dll_SetLastError
mov rcx, rsi
mov qword [rbp - 0x58], rcx
mov rdx, rbx
mov qword [rbp - 0x60], rdx
lea rcx, [rbp - 0x88]
call fcn.140008280
mov rcx, qword [rbp - 0x58]
mov rdx, qword [rbp - 0x60]
call sub.KERNEL32.dll_GetFileSize
mov ebx, eax
lea rcx, [rbp - 0x88]
call fcn.1400082d0
call fcn.140003eed
mov rsi, rax
mov qword [rbp - 0x50], rsi
call sub.KERNEL32.dll_GetLastError
mov rcx, qword [rbp - 0x50]
mov dword [rcx + 0xc0], eax
cmp byte [rbp - 0x40], 0
je 0x1402f537b
mov rcx, qword [rbp + 0x10]
xor edx, edx
call fcn.140127180
mov eax, ebx
add rsp, 0x78
pop rbx
pop rsi
pop rdi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
Function at 0x140009038
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov rbx, r8
mov r9, rcx
xor ecx, ecx
movabs r8, 0xcbf29ce484222325
mov rsi, rdx
movzx eax, byte [rbx + rcx + 0x10]
movabs rdx, 0x100000001b3
xor r8, rax
inc rcx
imul r8, rdx
cmp rcx, 4
jb 0x14000905c
mov rdx, qword [r9 + 0x30]
mov rcx, qword [r9 + 0x18]
and rdx, r8
add rdx, rdx
cmp qword [rcx + rdx*8 + 8], rbx
jne 0x1400090b3
cmp qword [rcx + rdx*8], rbx
jne 0x1400090a8
mov rax, qword [r9 + 8]
mov qword [rcx + rdx*8], rax
mov rcx, qword [r9 + 0x18]
mov rax, qword [r9 + 8]
jmp 0x1400090ac
mov rax, qword [rbx + 8]
mov qword [rcx + rdx*8 + 8], rax
jmp 0x1400090c0
cmp qword [rcx + rdx*8], rbx
jne 0x1400090c0
mov rax, qword [rbx]
mov qword [rcx + rdx*8], rax
mov rax, qword [rbx + 8]
mov rdi, qword [rbx]
mov qword [rax], rdi
mov rcx, qword [rbx]
mov rax, qword [rbx + 8]
mov qword [rcx + 8], rax
dec qword [r9 + 0x10]
mov rdx, qword [rbx + 0x30]
cmp rdx, 8
jb 0x1400090f5
mov rcx, qword [rbx + 0x18]
inc rdx
mov r8d, 2
call fcn.1400020a4
mov edx, 1
mov rcx, rbx
lea r8d, [rdx + 0x37]
call fcn.1400020a4
mov rbx, qword [rsp + 0x30]
mov rax, rsi
mov qword [rsi], rdi
mov rsi, qword [rsp + 0x38]
add rsp, 0x20
pop rdi
ret

Function at 0x14000b51c
Capabilities:
Terminate process

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, rcx
call qword [sym.imp.api_ms_win_core_debug_l1_1_1.dll_IsDebuggerPresent]
mov ecx, 1
mov dword [0x1400148a0], eax
call fcn.14000b2a4
xor ecx, ecx
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_1.dll_SetUnhandledExceptionFilter]
mov rcx, rbx
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_1.dll_UnhandledExceptionFilter]
cmp dword [0x1400148a0], 0
jne case.default.0x14000b572
mov ecx, 1
call fcn.14000b2a4
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_2.dll_GetCurrentProcess]
mov rcx, rax
mov edx, 0xc0000409
add rsp, 0x20
pop rbx
jmp qword [sym.imp.api_ms_win_core_processthreads_l1_1_2.dll_TerminateProcess]
mov ecx, ebp
xor byte [rdi + 0x432c5510], bl
sub esi, dword [rsi + 0x6f]
jg 0x1400209ff
mov dh, cl
scasb al, byte [rdi]
invalid
mov bl, 0xd0
outsd dx, dword [rsi]
xor dword [rdx + 0x19], 0xcda6cb18
invalid
Function at 0x18000b4b0
Capabilities:
Create directory

Disassembly:
push rbx
sub rsp, 0x90
mov rax, qword [0x1801253c0]
xor rax, rsp
mov qword [rsp + 0x88], rax
mov rbx, rcx
mov rcx, qword [rdx + 0x10]
movabs rax, 0x7fffffffffffffff
sub rax, rcx
cmp rax, 1
jb 0x18000b621
cmp qword [rdx + 0x18], 0xf
jbe 0x18000b4f3
mov rdx, qword [rdx]
mov qword [rsp + 0x30], 1
lea rax, [0x180100878]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rcx
mov r9, rdx
lea rcx, [rsp + 0x48]
call fcn.180033cc0
nop
mov r8, qword [rbx + 0x10]
cmp qword [rbx + 0x18], 0xf
jbe 0x18000b529
mov rbx, qword [rbx]
mov rdx, rbx
lea rcx, [rsp + 0x48]
call fcn.180033bb0
xorps xmm0, xmm0
movups xmmword [rsp + 0x68], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x78], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x68], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x78], xmm1
mov qword [rax + 0x10], 0
mov qword [rax + 0x18], send
mov byte [rax], 0
mov rdx, qword [rsp + 0x60]
cmp rdx, 0xf
jbe 0x18000b5ab
inc rdx
mov rcx, qword [rsp + 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18000b5a6
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x18000b5a6
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.180093b94
lea rcx, [rsp + 0x68]
cmp qword [rsp + 0x80], 0xf
cmova rcx, qword [rsp + 0x68]
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll__mkdir]
mov rdx, qword [rsp + 0x80]
cmp rdx, 0xf
jbe 0x18000b608
inc rdx
mov rcx, qword [rsp + 0x68]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18000b603
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x18000b603
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.180093b94
mov rcx, qword [rsp + 0x88]
xor rcx, rsp
call fcn.1800935b0
add rsp, 0x90
pop rbx
ret
call fcn.180006090
int3

Function at 0x18000db10
Capabilities:
Allocate or change rwx memory

Disassembly:
test rcx, rcx
je 0x18000db86
push rsi
push rdi
sub rsp, 0x38
mov rax, qword [0x1801253c0]
xor rax, rsp
mov qword [rsp + 0x28], rax
mov rsi, rdx
mov qword [rsp + 0x30], rbx
mov ebx, r8d
lea r9, [rsp + 0x20]
mov edx, ebx
mov r8d, 0x40
mov rdi, rcx
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov r8d, ebx
mov rdx, rsi
mov rcx, rdi
call sub.VCRUNTIME140.dll_memcpy
mov r8d, dword [rsp + 0x20]
lea r9, [rsp + 0x20]
mov edx, ebx
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_VirtualProtect]
mov rbx, qword [rsp + 0x30]
mov rcx, qword [rsp + 0x28]
xor rcx, rsp
call fcn.1800935b0
add rsp, 0x38
pop rdi
pop rsi
ret
Function at 0x18000ec60
Capabilities:
Hash data using fnv

Disassembly:
push rbx
sub rsp, 0xb0
mov ebx, ecx
mov r8d, ecx
shr r8d, 0x18
mov eax, ecx
shr eax, 0x10
movzx edx, al
mov eax, ecx
shr eax, 8
movzx ecx, al
movzx eax, bl
movabs r9, 0xcbf29ce484222325
xor rax, r9
movabs r9, 0x100000001b3
imul rax, r9
xor rax, rcx
imul rax, r9
xor rax, rdx
imul rax, r9
xor rax, r8
imul rax, r9
mov rcx, qword [0x180146150]
and rcx, rax
shl rcx, 4
add rcx, qword [0x180146138]
mov rax, qword [rcx + 8]
mov rdx, qword [0x180146128]
cmp rax, rdx
je 0x18000ecf2
mov rcx, qword [rcx]
cmp ebx, dword [rax + 0x10]
je 0x18000ecf4
cmp rax, rcx
je 0x18000ecf2
mov rax, qword [rax + 8]
cmp ebx, dword [rax + 0x10]
jne 0x18000ece2
jmp 0x18000ecf4
xor eax, eax
test rax, rax
je 0x18000ed0b
cmp rax, rdx
je 0x18000ed0b
mov rax, qword [rax + 0x18]
add rsp, 0xb0
pop rbx
ret
xorps xmm0, xmm0
movups xmmword [rsp + 0x28], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x38], xmm1
mov r8d, 1
lea rdx, [0x1800fefd4]
lea rcx, [rsp + 0x28]
call fcn.1800068e0
nop
mov edx, ebx
lea rcx, [rsp + 0x68]
call fcn.1800069e0
nop
mov r9d, send
lea r8, str.Fatal_Error.__x
xor edx, edx
mov rcx, rax
call fcn.180036470
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x48], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x58], xmm1
mov qword [rax + 0x10], 0
mov qword [rax + 0x18], send
mov byte [rax], 0
lea r9, [rsp + 0x28]
lea r8, [rsp + 0x48]
lea rcx, [rsp + 0x88]
call fcn.1800425e0
nop
lea rcx, [rsp + 0x88]
call fcn.18000c170
nop
mov rdx, qword [rsp + 0xa0]
cmp rdx, 0xf
jbe 0x18000ede9
inc rdx
mov rcx, qword [rsp + 0x88]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18000ede3
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x18000ede3
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.180093b94
nop
mov rdx, qword [rsp + 0x60]
cmp rdx, 0xf
jbe 0x18000ee2a
inc rdx
mov rcx, qword [rsp + 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18000ee24
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x18000ee24
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.180093b94
nop
mov rdx, qword [rsp + 0x80]
cmp rdx, 0xf
jbe 0x18000ee6d
inc rdx
mov rcx, qword [rsp + 0x68]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18000ee68
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x18000ee68
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.180093b94
movdqa xmm0, xmmword [0x180108cd0]
movdqu xmmword [rsp + 0x78], xmm0
mov byte [rsp + 0x68], 0
mov rdx, qword [rsp + 0x40]
cmp rdx, 0xf
jbe 0x18000eec0
inc rdx
mov rcx, qword [rsp + 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18000eebb
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x18000eebb
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.180093b94
xor eax, eax
add rsp, 0xb0
pop rbx
ret
Function at 0x18000f7b0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x20
mov rbx, rcx
add rcx, 8
call fcn.18000d920
cmp qword [rbx + 0x18], 0
movabs rdx, 0xcbf29ce484222325
mov qword [rbx], rdx
je 0x18000f826
cmp qword [rbx + 0x20], 0xf
lea r8, [rbx + 8]
jbe 0x18000f7f1
mov r8, qword [rbx + 8]
mov r9, r8
mov rcx, r8
jmp 0x18000f7f9
lea rcx, [rbx + 8]
lea r9, [rbx + 8]
add r9, qword [rbx + 0x18]
cmp r8, r9
je 0x18000f826
movabs r8, 0x100000001b3
nop dword [rax]
movsx rax, byte [rcx]
inc rcx
imul rdx, r8
xor rdx, rax
mov qword [rbx], rdx
cmp rcx, r9
jne 0x18000f810
mov rax, rbx
mov rbx, qword [rsp + 0x30]
add rsp, 0x20
pop rdi
ret

Function at 0x180010490
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
push rdi
sub rsp, 0x20
mov rdi, rcx
xor ecx, ecx
call qword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x180010533
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x40], rsi
call qword [sym.imp.USER32.dll_EmptyClipboard]
cmp qword [rdi + 0x18], 0xf
mov rax, rdi
jbe 0x1800104c6
mov rax, qword [rdi]
mov rbx, 0xffffffffffffffff
nop dword [rax]
cmp byte [rax + rbx + 1], 0
lea rbx, [rbx + 1]
jne 0x1800104d0
lea rdx, [rbx + 1]
mov ecx, 0x2000
call qword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov rsi, rax
test rax, rax
je 0x180010523
cmp qword [rdi + 0x18], 0xf
mov r8, rdi
jbe 0x1800104ff
mov r8, qword [rdi]
lea rdx, [rbx + 1]
mov rcx, rsi
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strcpy_s]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov rdx, rsi
mov ecx, 1
call qword [sym.imp.USER32.dll_SetClipboardData]
call qword [sym.imp.USER32.dll_CloseClipboard]
mov rsi, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x38]
mov rcx, rdi
add rsp, 0x20
pop rdi
jmp fcn.180005610
Function at 0x180010b20
Capabilities:
Encode data using base64

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x40
mov rbx, rcx
mov qword [rsp + 0x30], rcx
xor ebp, ebp
mov dword [rsp + 0x20], ebp
xorps xmm0, xmm0
movups xmmword [rcx], xmm0
mov qword [rcx + 0x10], rbp
mov qword [rcx + 0x18], send
mov byte [rcx], bpl
mov dword [rsp + 0x20], 1
lea r14d, [rbp - 6]
mov rcx, rdx
cmp qword [rdx + 0x18], 0xf
jbe 0x180010b7d
mov rcx, qword [rdx]
mov r8, rcx
jmp 0x180010b80
mov r8, rdx
mov r15, rcx
mov rax, qword [rdx + 0x10]
add rax, r8
mov qword [rsp + 0x28], rax
cmp rcx, rax
je 0x180010ca0
lea r13, [0x1801497b0]
nop
shl ebp, 8
movzx eax, byte [r15]
add ebp, eax
add r14d, 8
js 0x180010c32
movsxd r12, ebp
movsxd rdi, r14d
lea ecx, [r14 + 6]
mov eax, 0xaaaaaaab
mul ecx
shr edx, 2
mov esi, edx
imul eax, edx, 0xfffffffa
add r14d, eax
nop
mov rdx, r13
cmp qword [0x1801497c8], 0xf
cmova rdx, qword [0x1801497b0]
mov rax, r12
mov rcx, rdi
sar rax, cl
and eax, 0x3f
movzx r9d, byte [rax + rdx]
mov rcx, qword [rbx + 0x10]
mov rdx, qword [rbx + 0x18]
cmp rcx, rdx
jae 0x180010c20
lea rax, [rcx + 1]
mov qword [rbx + 0x10], rax
mov rax, rbx
cmp rdx, 0xf
jbe 0x180010c15
mov rax, qword [rbx]
mov byte [rax + rcx], r9b
mov byte [rax + rcx + 1], 0
jmp 0x180010c28
mov rcx, rbx
call fcn.18003e3d0
sub rdi, 6
sub rsi, 1
jne 0x180010bd0
mov ecx, r14d
inc r15
cmp r15, qword [rsp + 0x28]
jne 0x180010ba0
cmp ecx, 0xfffffffa
jle 0x180010ca0
cmp qword [0x1801497c8], 0xf
cmova r13, qword [0x1801497b0]
shl ebp, 8
movsxd rax, ebp
add cl, 8
sar rax, cl
and eax, 0x3f
movzx r9d, byte [rax + r13]
mov rcx, qword [rbx + 0x10]
mov rdx, qword [rbx + 0x18]
cmp rcx, rdx
jae 0x180010c98
lea rax, [rcx + 1]
mov qword [rbx + 0x10], rax
mov rax, rbx
cmp rdx, 0xf
jbe 0x180010c8d
mov rax, qword [rbx]
mov byte [rax + rcx], r9b
mov byte [rax + rcx + 1], 0
jmp 0x180010ca0
mov rcx, rbx
call fcn.18003e3d0
mov rcx, qword [rbx + 0x10]
test cl, 3
je 0x180010ce9
nop dword [rax]
mov rdx, qword [rbx + 0x18]
cmp rcx, rdx
jae 0x180010cd5
lea rax, [rcx + 1]
mov qword [rbx + 0x10], rax
mov rax, rbx
cmp rdx, 0xf
jbe 0x180010ccd
mov rax, qword [rbx]
mov word [rcx + rax], 0x3d
jmp 0x180010ce0
mov r9b, 0x3d
mov rcx, rbx
call fcn.18003e3d0
mov rcx, qword [rbx + 0x10]
test cl, 3
jne 0x180010cb0
mov rax, rbx
lea r11, [rsp + 0x40]
mov rbx, qword [r11 + 0x38]
mov rbp, qword [r11 + 0x40]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
Function at 0x180011240
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Create tcp socket
Initialize winsock library
Resolve dns
Set socket configuration

Disassembly:
mov qword [rsp + 8], rbx
push rsi
sub rsp, 0x210
mov rax, qword [0x1801253c0]
xor rax, rsp
mov qword [rsp + 0x200], rax
cmp byte [0x180148a50], 0
jne 0x180011450
cmp byte [0x180148e48], 0
jne 0x180011450
mov ecx, 0x202
lea rdx, [rsp + 0x60]
call qword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
jne 0x1800113cf
lea edx, [rax + 1]
mov esi, 2
lea r8d, [rax + 6]
mov ecx, esi
call qword [sym.imp.WS2_32.dll_socket]
mov qword [0x180148fa0], rax
cmp rax, 0xffffffffffffffff
je 0x1800113c9
mov dword [rsp + 0x30], 1
mov dword [rsp + 0x20], 4
lea r9, [rsp + 0x30]
mov edx, 0xffff
lea r8d, [rsi + 2]
mov rcx, rax
call qword [sym.imp.WS2_32.dll_setsockopt]
cmp eax, 0xffffffff
je 0x1800113c9
mov dword [rsp + 0x34], 0
lea r8, [rsp + 0x34]
mov edx, 0x8004667e
mov rcx, qword [0x180148fa0]
call qword [sym.imp.WS2_32.dll_ioctlsocket]
mov byte [0x180148a50], 1
cmp byte [0x180148e48], 0
jne 0x180011448
lea rcx, str.4.tcp.ngrok.io
call qword [sym.imp.WS2_32.dll_gethostbyname]
mov rbx, rax
test rax, rax
je 0x180011392
mov qword [rsp + 0x40], 0
mov word [rsp + 0x38], si
movzx ecx, word [0x1801266f0]
call qword [sym.imp.WS2_32.dll_htons]
mov word [rsp + 0x3a], ax
mov rax, qword [rbx + 0x18]
mov rcx, qword [rax]
mov eax, dword [rcx]
mov dword [rsp + 0x3c], eax
xor eax, eax
mov qword [rsp + 0x40], rax
lea r8d, [rsi + 0xe]
lea rdx, [rsp + 0x38]
mov rcx, qword [0x180148fa0]
call qword [sym.imp.WS2_32.dll_connect]
cmp eax, 0xffffffff
je 0x180011392
cmp qword [0x180148fa0], 0xffffffffffffffff
je 0x180011392
mov byte [0x180148e48], 1
mov al, 1
jmp 0x1800113a8
mov byte [0x180148a50], 0
mov byte [0x180148e48], 0
call qword [sym.imp.WS2_32.dll_WSACleanup]
xor al, al
mov rcx, qword [rsp + 0x200]
xor rcx, rsp
call fcn.1800935b0
mov rbx, qword [rsp + 0x220]
add rsp, 0x210
pop rsi
ret
call qword [sym.imp.WS2_32.dll_WSACleanup]
xorps xmm0, xmm0
movups xmmword [rsp + 0x38], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x48], xmm1
mov r8d, 0x1e
lea rdx, str.Authentication_Failed.__400_2_
lea rcx, [rsp + 0x38]
call fcn.1800068e0
nop
lea rcx, [rsp + 0x38]
call fcn.18000c170
nop
mov rdx, qword [rsp + 0x50]
cmp rdx, 0xf
jbe 0x1800113a6
inc rdx
mov rcx, qword [rsp + 0x38]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18001143e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x18001143e
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.180093b94
jmp 0x1800113a6
xor ecx, ecx
call fcn.180011710
int3
lea rcx, [rsp + 0x38]
call fcn.18000fd10
nop
xor edx, edx
mov rcx, rax
call fcn.1800116c0
int3
Function at 0x180011470
Capabilities:
Receive data
Receive data on socket

Disassembly:
mov qword [rsp + 0x10], rbx
push rdi
mov eax, 0x1080
call fcn.1800e8f90
sub rsp, rax
mov rax, qword [0x1801253c0]
xor rax, rsp
mov qword [rsp + 0x1070], rax
mov rbx, rcx
mov qword [rsp + 0x48], rcx
xor edi, edi
xorps xmm0, xmm0
cmp byte [0x180148e48], dil
jne 0x1800114c2
movups xmmword [rcx], xmm0
mov qword [rcx + 0x10], rdi
mov qword [rcx + 0x18], send
mov byte [rcx], dil
jmp 0x18001168d
movups xmmword [rsp + 0x50], xmm0
mov qword [rsp + 0x60], rdi
mov qword [rsp + 0x68], send
mov byte [rsp + 0x50], dil
xor edx, edx
mov r8d, 0x1000
lea rcx, [rsp + 0x70]
call sub.VCRUNTIME140.dll_memset
xor r9d, r9d
mov r8d, 0xfff
lea rdx, [rsp + 0x70]
mov rcx, qword [0x180148fa0]
call qword [sym.imp.WS2_32.dll_recv]
mov dword [0x180148b84], eax
cmp eax, 1
jge 0x180011550
cmp byte [0x180148e48], 0
je 0x180011536
mov byte [0x180148a50], 0
mov byte [0x180148e48], 0
mov rcx, qword [0x180148fa0]
call qword [sym.imp.WS2_32.dll_closesocket]
xorps xmm0, xmm0
movups xmmword [rbx], xmm0
mov qword [rbx + 0x10], rdi
mov qword [rbx + 0x18], send
mov byte [rbx], 0
jmp 0x18001168d
movsxd r8, eax
xorps xmm0, xmm0
movups xmmword [rsp + 0x28], xmm0
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x40], rdi
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x28]
call fcn.1800068e0
lea rdx, [rsp + 0x28]
lea rcx, [rsp + 0x50]
call fcn.180033c30
mov rdx, qword [rsp + 0x40]
cmp rdx, 0xf
jbe 0x1800115c3
inc rdx
mov rcx, qword [rsp + 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800115be
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1800115be
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.180093b94
cmp qword [rsp + 0x60], 0
jne 0x18001163f
cmp byte [0x180148e48], 0
je 0x1800115ef
mov byte [0x180148a50], 0
mov byte [0x180148e48], 0
mov rcx, qword [0x180148fa0]
call qword [sym.imp.WS2_32.dll_closesocket]
xorps xmm0, xmm0
movups xmmword [rbx], xmm0
mov qword [rbx + 0x10], rdi
mov qword [rbx + 0x18], send
mov byte [rbx], 0
mov rdx, qword [rsp + 0x68]
cmp rdx, 0xf
jbe 0x18001168d
inc rdx
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180011688
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x180011688
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
lea rdx, [rsp + 0x50]
mov rcx, rbx
call fcn.180010830
nop
mov rdx, qword [rsp + 0x68]
cmp rdx, 0xf
jbe 0x18001168d
inc rdx
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180011688
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x180011688
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.180093b94
mov rax, rbx
mov rcx, qword [rsp + 0x1070]
xor rcx, rsp
call fcn.1800935b0
mov rbx, qword [rsp + 0x1098]
add rsp, 0x1080
pop rdi
ret
Function at 0x180011730
Capabilities:
Send data
Send data on socket

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x70
mov rax, qword [0x1801253c0]
xor rax, rsp
mov qword [rsp + 0x60], rax
mov rdi, rdx
mov qword [rsp + 0x58], rdx
lea rcx, [rsp + 0x38]
call fcn.180010540
mov rbx, rax
mov qword [rsp + 0x30], rax
cmp byte [0x180148e48], 0
je 0x1800117e9
mov rdx, qword [rax + 0x10]
mov r8, qword [rax + 0x18]
mov rcx, r8
sub rcx, rdx
cmp rcx, 1
jb 0x18001179c
lea rax, [rdx + 1]
mov qword [rbx + 0x10], rax
mov rax, rbx
cmp r8, 0xf
jbe 0x180011794
mov rax, qword [rbx]
mov word [rax + rdx], 0xa
jmp 0x1800117b9
mov qword [rsp + 0x20], 1
lea r9, reloc.WS2_32.dll_ioctlsocket
mov edx, 1
mov rcx, rbx
call fcn.18003e540
mov rdx, rbx
cmp qword [rbx + 0x18], 0xf
jbe 0x1800117c6
mov rdx, qword [rbx]
xor r9d, r9d
mov r8d, dword [rbx + 0x10]
mov rcx, qword [0x180148fa0]
call qword [sym.imp.WS2_32.dll_send]
cmp eax, 0xffffffff
je 0x1800117e9
mov rcx, rbx
call fcn.180005610
jmp 0x180011816
mov rcx, rbx
call fcn.180005610
cmp byte [0x180148e48], 0
je 0x180011816
mov byte [0x180148a50], 0
mov byte [0x180148e48], 0
mov rcx, qword [0x180148fa0]
call qword [sym.imp.WS2_32.dll_closesocket]
nop
mov rcx, rdi
call fcn.180005610
mov rcx, qword [rsp + 0x60]
xor rcx, rsp
call fcn.1800935b0
mov rbx, qword [rsp + 0x80]
add rsp, 0x70
pop rdi
ret
Function at 0x180031db0
Capabilities:
Write file on windows

Disassembly:
push rbx
push rdi
push r15
sub rsp, 0x20
cmp qword [rcx + 0x68], 0
mov rbx, r8
mov r15, rdx
mov rdi, rcx
je 0x180031dd8
add rsp, 0x20
pop r15
pop rdi
pop rbx
jmp qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsputn_char_const____ptr64__long_long___int64_____ptr64]
mov rax, qword [rcx + 0x40]
mov qword [rsp + 0x40], rbp
mov qword [rsp + 0x48], rsi
mov rsi, rbx
mov qword [rsp + 0x58], r14
mov r9, qword [rax]
test r9, r9
je 0x180031dfe
mov rax, qword [rcx + 0x58]
mov ecx, dword [rax]
jmp 0x180031e00
xor ecx, ecx
movsxd rbp, ecx
test rbx, rbx
jle 0x180031e59
test ecx, ecx
jle 0x180031e39
cmp rbx, rbp
mov rcx, r9
cmovl rbp, rbx
mov r8, rbp
call sub.VCRUNTIME140.dll_memcpy
mov rax, qword [rdi + 0x58]
add r15, rbp
sub rbx, rbp
sub dword [rax], ebp
mov rcx, qword [rdi + 0x40]
movsxd rax, ebp
add qword [rcx], rax
test rbx, rbx
jle 0x180031e59
mov r9, qword [rdi + 0x80]
test r9, r9
je 0x180031e59
mov r8, rbx
mov edx, 1
mov rcx, r15
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
sub rbx, rax
mov r14, qword [rsp + 0x58]
sub rsi, rbx
mov rbp, qword [rsp + 0x40]
mov rax, rsi
mov rsi, qword [rsp + 0x48]
add rsp, 0x20
pop r15
pop rdi
pop rbx
ret

Function at 0x180031e80
Capabilities:
Read file on windows

Disassembly:
push rbp
push rsi
push r14
sub rsp, 0x30
mov rbp, r8
mov r14, rdx
mov rsi, rcx
test r8, r8
jg 0x180031ea2
xor eax, eax
add rsp, 0x30
pop r14
pop rsi
pop rbp
ret
cmp qword [rcx + 0x68], 0
je 0x180031eb8
add rsp, 0x30
pop r14
pop rsi
pop rbp
jmp qword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::xsgetn_char____ptr64__long_long___int64_____ptr64]
mov rax, qword [rcx + 0x38]
mov qword [rsp + 0x28], rbx
mov rbx, rbp
mov rdx, qword [rax]
test rdx, rdx
je 0x180031ed4
mov rax, qword [rcx + 0x50]
mov ecx, dword [rax]
jmp 0x180031ed6
xor ecx, ecx
movsxd rax, ecx
test ecx, ecx
je 0x180031f12
mov qword [rsp + 0x20], rdi
cmp rax, rbp
mov rdi, rbp
mov rcx, r14
cmovb rdi, rax
mov r8, rdi
call sub.VCRUNTIME140.dll_memcpy
mov rax, qword [rsi + 0x50]
add r14, rdi
sub rbx, rdi
sub dword [rax], edi
mov rcx, qword [rsi + 0x38]
movsxd rax, edi
mov rdi, qword [rsp + 0x20]
add qword [rcx], rax
cmp qword [rsi + 0x80], 0
je 0x180031fae
mov r8, qword [rsi + 0x18]
lea rax, [rsi + 0x70]
cmp qword [r8], rax
jne 0x180031f4d
mov rcx, qword [rsi + 0x88]
mov rdx, qword [rsi + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rsi + 0x38]
mov qword [rax], rcx
mov rax, qword [rsi + 0x50]
mov dword [rax], edx
cmp rbx, 0xfff
jbe 0x180031f8e
nop word [rax + rax]
mov r9, qword [rsi + 0x80]
mov edx, 1
mov r8d, 0xfff
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
add r14, rax
sub rbx, rax
cmp rax, 0xfff
jne 0x180031fae
cmp rbx, rax
ja 0x180031f60
test rbx, rbx
je 0x180031fae
mov r9, qword [rsi + 0x80]
mov r8, rbx
mov edx, 1
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
sub rbx, rax
sub rbp, rbx
mov rbx, qword [rsp + 0x28]
mov rax, rbp
add rsp, 0x30
pop r14
pop rsi
pop rbp
ret