joyce8/EMBER2024-capa huggingface dataset:
Function at 0x180015700
Capabilities:
Print debug messages

Disassembly:
push rbx
push rdi
push r13
push r14
push r15
sub rsp, 0x40
mov r14, rcx
mov ecx, 0x2002
mov r13, rdx
call qword [sym.imp.msvcrt.dll_void____ptr64___cdecl_operator_new_unsigned_long_long_unsigned___int64__]
xor r15d, r15d
mov rdi, rax
mov ebx, r15d
test rax, rax
je 0x180015739
mov ebx, 0x2000
mov word [rax + 0x2000], r15w
mov rax, qword [0x18002a6a0]
test rax, rax
jne 0x18001577c
mov rax, qword [0x18002a698]
test rax, rax
jne 0x180015765
lea rcx, str.psapi
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov qword [0x18002a698], rax
lea rdx, str.EnumProcesses
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x18002a6a0], rax
lea r8, [rsp + 0x80]
mov edx, ebx
mov rcx, rdi
call rax
test eax, eax
jne 0x1800157b4
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
test rdi, rdi
je 0x1800157a5
mov rcx, rdi
call qword [sym.imp.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_]
mov eax, ebx
add rsp, 0x40
pop r15
pop r14
pop r13
pop rdi
pop rbx
ret
mov eax, dword [rsp + 0x80]
mov qword [rsp + 0x70], rbp
mov qword [rsp + 0x78], rsi
shr eax, 2
mov qword [rsp + 0x88], r12
mov esi, r15d
test eax, eax
jle 0x18001587f
mov rbp, rdi
nop
mov r8d, dword [rbp]
mov rbx, r15
xor edx, edx
mov ecx, 0x2000000
mov r12, r15
mov qword [rsp + 0x38], r15
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x20], r15d
call qword [sym.imp.KERNEL32.dll_OpenProcess]
test rax, rax
jne 0x180015818
call qword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x18001582f
lea rcx, [rsp + 0x20]
mov rdx, rax
call fcn.180015620
mov r12, qword [rsp + 0x38]
mov rbx, qword [rsp + 0x28]
test eax, eax
jne 0x180015859
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
lea rcx, [0x180023adc]
call qword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov rdx, r13
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x1800158b1
test rbx, rbx
je 0x180015867
mov rcx, rbx
call qword [sym.imp.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_]
mov eax, dword [rsp + 0x80]
inc esi
add rbp, 4
shr eax, 2
cmp esi, eax
jl 0x1800157e0
test rdi, rdi
je 0x18001588d
mov rcx, rdi
call qword [sym.imp.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_]
mov eax, 0x490
mov rsi, qword [rsp + 0x78]
mov rbp, qword [rsp + 0x70]
mov r12, qword [rsp + 0x88]
add rsp, 0x40
pop r15
pop r14
pop r13
pop rdi
pop rbx
ret
movsxd rax, esi
mov ecx, dword [rdi + rax*4]
mov dword [r14], ecx
test rbx, rbx
je 0x1800158c8
mov rcx, rbx
call qword [sym.imp.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_]
test rdi, rdi
je 0x1800158d6
mov rcx, rdi
call qword [sym.imp.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_]
xor eax, eax
jmp 0x180015892
Function at 0x180017f90
Capabilities:
Encode data using xor

Disassembly:
push rbx
push rbp
push rsi
push r12
sub rsp, 0x58
mov ebp, r8d
mov rsi, rdx
mov r12, rcx
mov dword [rsp + 0x98], 0
xor ebx, ebx
mov r8d, SQLNumResultCols
movsxd rdx, ebx
lea r9, [rsp + 0x98]
mov rcx, r12
sub r8d, ebx
add rdx, rsi
mov dword [rsp + 0x20], ebp
call fcn.180017d70
test eax, eax
jne 0x180018150
add ebx, dword [rsp + 0x98]
cmp ebx, 0x10
jl 0x180017fb0
mov rax, qword [0x1800290a0]
mov qword [rsp + 0x80], rdi
mov qword [rsp + 0x88], r13
mov qword [rsp + 0x50], r14
test rax, rax
jne 0x180018025
lea ecx, [rax + 0x38]
call qword [sym.imp.msvcrt.dll_void____ptr64___cdecl_operator_new_unsigned_long_long_unsigned___int64__]
test rax, rax
je 0x18001801e
mov rcx, rax
call fcn.180007620
mov qword [0x1800290a0], rax
lea r14, [rax + 0x10]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov r11d, dword [rsi]
lea rax, [rsp + 0x38]
mov r8, rsi
xor r13d, r13d
mov r9d, r11d
mov r10d, r11d
mov edi, r11d
sub r8, rax
nop dword [rax]
mov eax, r11d
lea rdx, [rsp + r13 + 0x38]
mov ecx, r10d
shr eax, 3
shl ecx, 7
inc r13
lea r11d, [r11 + rax - 0x11111111]
mov eax, r9d
shr eax, 5
lea r9d, [r9 + rax - 0x22222222]
mov eax, 0x33333333
sub eax, ecx
mov ecx, edi
add r10d, eax
shl ecx, 9
mov eax, 0x44444444
sub eax, ecx
add edi, eax
lea eax, [r9 + r11]
add al, r10b
add al, dil
xor al, byte [r8 + rdx]
mov byte [rdx], al
cmp r13, 0x10
jl 0x180018050
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
movzx edi, word [rsp + 0x40]
mov r14, qword [rsp + 0x50]
mov r13, qword [rsp + 0x88]
add edi, 0x10
mov dword [rsp + 0x30], edi
cmp edi, 0xf000
jle 0x1800180d9
mov eax, reloc.ODBC32.dll_SQLFetch
jmp 0x180018148
cmp ebx, edi
jge 0x18001810f
nop dword [rax]
mov r8d, edi
movsxd rdx, ebx
lea r9, [rsp + 0x98]
mov rcx, r12
sub r8d, ebx
add rdx, rsi
mov dword [rsp + 0x20], ebp
call fcn.180017d70
test eax, eax
jne 0x180018148
add ebx, dword [rsp + 0x98]
cmp ebx, edi
jl 0x1800180e0
mov rax, qword [0x1800290a0]
test rax, rax
jne 0x180018138
lea ecx, [rax + 0x38]
call qword [sym.imp.msvcrt.dll_void____ptr64___cdecl_operator_new_unsigned_long_long_unsigned___int64__]
test rax, rax
je 0x180018131
mov rcx, rax
call fcn.180007620
mov qword [0x1800290a0], rax
lea r8, [rsp + 0x30]
mov rdx, rsi
mov rcx, rax
call fcn.180007840
mov rdi, qword [rsp + 0x80]
add rsp, 0x58
pop r12
pop rsi
pop rbp
pop rbx
ret
Function at 0x180018410
Capabilities:
Check for time delay via gettickcount
Check if file exists

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
push rdi
sub rsp, 0x40
mov rsi, rdx
mov rdi, rcx
call qword [sym.imp.KERNEL32.dll_GetTickCount]
xor ebp, ebp
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x30], rbp
mov edx, 0xc0000000
mov rcx, rsi
mov dword [rsp + 0x28], 0x40000000
mov ebx, eax
mov dword [rdi + 0x90], ebp
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rdi + 0x88], rax
cmp rax, 0xffffffffffffffff
jne 0x1800184d8
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
je 0x180018482
cmp eax, 0xe7
jne 0x1800184da
call qword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, ebx
cmp eax, 0xbb8
ja 0x1800184ef
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
mov qword [rsp + 0x30], rbp
xor r9d, r9d
xor r8d, r8d
mov edx, 0xc0000000
mov rcx, rsi
mov dword [rsp + 0x28], 0x40000000
mov dword [rdi + 0x90], ebp
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rdi + 0x88], rax
cmp rax, 0xffffffffffffffff
je 0x180018470
xor eax, eax
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
add rsp, 0x40
pop rdi
ret
mov eax, 0x5b4
jmp 0x1800184da
Function at 0x18001b170
Capabilities:
Query or enumerate registry value

Disassembly:
push rsi
push r14
sub rsp, 0x478
mov rsi, rcx
xor r14d, r14d
mov rax, r8
mov qword [rsp + 0x40], r14
mov r10, rdx
lea rcx, [rsp + 0x58]
mov qword [rsp + 0x38], rcx
mov qword [rsp + 0x30], r14
xor r9d, r9d
mov rcx, r10
xor r8d, r8d
mov rdx, rax
mov dword [rsp + 0x28], 0x20019
mov dword [rsp + 0x20], r14d
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
je 0x18001b1cf
call qword [sym.imp.KERNEL32.dll_GetLastError]
add rsp, 0x478
pop r14
pop rsi
ret
mov rcx, qword [rsp + 0x58]
lea rax, [rsp + 0x4a8]
lea r9, [rsp + 0x50]
mov qword [rsp + 0x38], rax
lea rax, [rsp + 0x260]
lea r8, [rsp + 0x60]
mov qword [rsp + 0x30], rax
xor edx, edx
mov qword [rsp + 0x498], rbp
mov qword [rsp + 0x28], r14
mov ebp, r14d
mov dword [rsp + 0x50], 0x200
mov qword [rsp + 0x20], r14
mov dword [rsp + 0x4a8], 0x200
call qword [sym.imp.ADVAPI32.dll_RegEnumValueW]
test eax, eax
jne 0x18001b373
mov qword [rsp + 0x490], rbx
mov qword [rsp + 0x470], rdi
mov qword [rsp + 0x468], r12
mov qword [rsp + 0x460], r13
lea rcx, [0x1800249f0]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
lea rdx, [0x1800249f0]
mov rcx, rsi
lea r8d, [rax + rax]
call fcn.1800046d0
lea rcx, [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
movsxd rbx, dword [rsi]
mov r13d, eax
lea ecx, [rbx + 2]
movsxd rcx, ecx
add r13d, r13d
call qword [sym.imp.msvcrt.dll_void____ptr64___cdecl_operator_new_unsigned_long_long_unsigned___int64__]
mov r12d, r14d
mov rdi, rax
test rax, rax
je 0x18001b2a3
mov r12d, ebx
mov word [rbx + rax], r14w
movsxd r8, dword [rsi]
mov rdx, qword [rsi + 8]
mov rcx, rax
call fcn.18001ca04
mov r11d, dword [rsi]
mov rcx, rsi
lea edx, [r13 + r11]
call fcn.180004470
test eax, eax
jne 0x18001b2ed
mov rcx, qword [rsi + 8]
movsxd rbx, r12d
mov rdx, rdi
mov r8, rbx
call fcn.18001ca04
mov rax, qword [rsi + 8]
lea rdx, [rsp + 0x60]
lea rcx, [rbx + rax]
movsxd r8, r13d
call fcn.18001ca04
test rdi, rdi
je 0x18001b2fb
mov rcx, rdi
call qword [sym.imp.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_]
mov rcx, qword [rsp + 0x58]
lea rax, [rsp + 0x4a8]
inc ebp
mov qword [rsp + 0x38], rax
lea rax, [rsp + 0x260]
lea r9, [rsp + 0x50]
mov qword [rsp + 0x30], rax
lea r8, [rsp + 0x60]
mov edx, ebp
mov qword [rsp + 0x28], r14
mov dword [rsp + 0x50], 0x200
mov dword [rsp + 0x4a8], 0x200
mov qword [rsp + 0x20], r14
call qword [sym.imp.ADVAPI32.dll_RegEnumValueW]
test eax, eax
je 0x18001b250
mov r13, qword [rsp + 0x460]
mov r12, qword [rsp + 0x468]
mov rdi, qword [rsp + 0x470]
mov rbx, qword [rsp + 0x490]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rbp, qword [rsp + 0x498]
xor eax, eax
add rsp, 0x478
pop r14
pop rsi
ret
Function at 0x18001c600
Capabilities:
Create thread
Resume thread

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rbp
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push r12
sub rsp, 0x40
mov rsi, rcx
mov ecx, 0x38
mov rbp, r9
mov r12, r8
mov rbx, rdx
call qword [sym.imp.msvcrt.dll_void____ptr64___cdecl_operator_new_unsigned_long_long_unsigned___int64__]
mov rdi, rax
test rax, rax
jne 0x18001c641
lea eax, [rdi + 8]
jmp 0x18001c6db
lea rax, [rsp + 0x30]
lea r8, [0x18001c790]
mov r9, rdi
mov qword [rsp + 0x28], rax
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x20], 4
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [rbx], rax
test rax, rax
jne 0x18001c684
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, rdi
mov ebx, eax
call qword [sym.imp.msvcrt.dll_void___cdecl_operator_delete_void____ptr64_]
mov eax, ebx
jmp 0x18001c6db
mov qword [rdi + 0x18], rsi
mov eax, dword [rsp + 0x30]
mov rcx, rsi
mov dword [rdi + 0x10], eax
mov rax, qword [rsp + 0x70]
mov qword [rdi + 0x30], r12
mov qword [rdi + 0x28], rax
mov qword [rdi + 0x20], rbp
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
lea r11, [rsi + 0x28]
mov rcx, rsi
mov qword [rdi], r11
mov rax, qword [r11 + 8]
mov qword [rdi + 8], rax
mov rax, qword [r11 + 8]
mov qword [rax], rdi
mov qword [r11 + 8], rdi
inc dword [r11 + 0x10]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov rcx, qword [rbx]
call qword [sym.imp.KERNEL32.dll_ResumeThread]
xor eax, eax
mov rbx, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x40
pop r12
ret
Function at 0x18001c7b8
Capabilities:
Create directory
Query environment variable
Set file attributes
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x20], rdi
push rbp
lea rbp, [rsp - 0x790]
sub rsp, 0x890
mov rdi, rcx
lea rdx, [rbp - 0x70]
lea rcx, str._ALLUSERSPROFILE_
mov r8d, 0x800
call qword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
lea rdx, str.SxS
lea rcx, [rbp - 0x70]
call qword [sym.imp.KERNEL32.dll_lstrcatW]
lea rcx, [rbp - 0x70]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
lea rcx, [rbp - 0x70]
mov edx, 6
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
lea rdx, str._bug.log
lea rcx, [rbp - 0x70]
call qword [sym.imp.KERNEL32.dll_lstrcatW]
and qword [rsp + 0x30], 0
xor r9d, r9d
lea r8d, [r9 + 1]
lea rcx, [rbp - 0x70]
mov edx, 0x40000000
mov dword [rsp + 0x28], 2
mov dword [rsp + 0x20], 4
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x18001c92c
mov r9d, 2
xor r8d, r8d
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
je 0x18001c923
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_GetLocalTime]
movzx ecx, word [rsp + 0x48]
movzx edx, word [rsp + 0x46]
movzx r11d, word [rsp + 0x4c]
movzx eax, word [rsp + 0x4a]
movzx r9d, word [rsp + 0x42]
movzx r8d, word [rsp + 0x40]
mov dword [rsp + 0x38], r11d
mov dword [rsp + 0x30], eax
mov dword [rsp + 0x28], ecx
mov dword [rsp + 0x20], edx
lea rdx, str._4.4d__2.2d__2.2d__2.2d:_2.2d:_2.2d:
lea rcx, [rsp + 0x50]
call qword [sym.imp.USER32.dll_wsprintfW]
and qword [rsp + 0x20], 0
lea r9, [rbp + 0x7a8]
lea rdx, [rsp + 0x50]
lea r8d, [rax + rax]
mov rcx, rbx
mov dword [rbp + 0x7a8], eax
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x18001c923
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_lstrlenW]
and qword [rsp + 0x20], 0
lea r9, [rbp + 0x7b0]
lea r8d, [rax + rax]
mov rdx, rdi
mov rcx, rbx
mov dword [rbp + 0x7b0], eax
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea r11, [rsp + 0x890]
mov rbx, qword [r11 + 0x10]
mov rdi, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret
Function at 0x18001ce14
Capabilities:
Create thread
Get system information on windows
Initialize winsock library

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rbp
mov qword [rsp + 0x20], rsi
push rdi
push r12
push r13
sub rsp, 0x60
mov rdi, qword [0x18002a9c8]
xor esi, esi
mov r12, rcx
test rdi, rdi
jne 0x18001ce96
mov ecx, 0x118
call qword [sym.imp.msvcrt.dll_void____ptr64___cdecl_operator_new_unsigned_long_long_unsigned___int64__]
mov rdi, rax
test rax, rax
je 0x18001ce8c
lea rcx, [rax + 0xf0]
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
lea rax, [0x18001df70]
mov qword [rdi], rsi
mov qword [rdi + 0xe0], rax
lea rax, [0x18001e058]
mov qword [rdi + 0xd0], rsi
mov qword [rdi + 0xe8], rax
mov qword [0x18002a9c8], rdi
jmp 0x18001ce96
mov rdi, rsi
mov qword [0x18002a9c8], rsi
lea rcx, [rdi + 0xf0]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov r11d, dword [0x18002a694]
inc r11d
mov dword [0x18002a694], r11d
cmp r11d, 1
jg 0x18001cfbf
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov r11d, dword [rsp + 0x50]
inc r11d
mov dword [rdi + 0xd8], r11d
cmp r11d, 4
jge 0x18001cee8
mov dword [rdi + 0xd8], 4
mov eax, dword [rdi + 0xd8]
mov ecx, SQLNumResultCols
cmp eax, ecx
lea edx, [rcx - 0xf]
cmovg eax, ecx
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
mov dword [rdi + 0xd8], eax
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov qword [rdi + 0xd0], rax
test rax, rax
jne 0x18001cf26
call qword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x18001cfb3
mov r9d, dword [rdi + 0xd8]
xor r8d, r8d
xor edx, edx
or rcx, 0xffffffffffffffff
call qword [sym.imp.KERNEL32.dll_CreateIoCompletionPort]
mov qword [rdi], rax
test rax, rax
je 0x18001cf1b
mov ebp, esi
cmp dword [rdi + 0xd8], esi
jle 0x18001cf9b
lea r13, [rdi + 0x50]
lea rax, [0x18001db14]
lea r8, [0x18001dd24]
test ebp, ebp
cmove r8, rax
lea rax, [rsp + 0x88]
xor r9d, r9d
mov qword [rsp + 0x28], rax
xor edx, edx
xor ecx, ecx
mov dword [rsp + 0x20], esi
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov qword [r13], rax
test rax, rax
je 0x18001cf1b
inc ebp
add r13, 8
cmp ebp, dword [rdi + 0xd8]
jl 0x18001cf52
mov ecx, 0x101
mov rdx, r12
call qword [sym.imp.WS2_32.dll_WSAStartup]
test eax, eax
je 0x18001cfbf
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov rcx, rdi
mov esi, eax
call fcn.18001d958
jmp 0x18001cfd2
mov eax, 0xfc00
mov dword [r12], 0xb2c0b2c
mov word [r12 + 4], ax
lea rcx, [rdi + 0xf0]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
lea r11, [rsp + 0x60]
mov eax, esi
mov rbx, qword [r11 + 0x20]
mov rbp, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r13
pop r12
pop rdi
ret
Function at 0x18001f8f4
Capabilities:
Get local ipv4 addresses
Get socket information

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbp
mov qword [rax + 0x18], rsi
push rdi
sub rsp, 0x30
mov ebp, 2
mov rsi, rdx
mov rdi, rcx
mov dword [rax - 0x18], 0x10
cmp word [rdx], bp
je 0x18001f924
lea eax, [rbp + 0x55]
jmp 0x18001f99c
lea rbx, [rcx + 0x4120]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [rdi + 0x408c], 1
je 0x18001f944
mov edi, 0x139f
jmp 0x18001f965
mov r8d, dword [rsp + 0x20]
mov rcx, qword [rdi + 0x4078]
mov rdx, rsi
call qword [sym.imp.WS2_32.dll_bind]
test eax, eax
je 0x18001f972
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov edi, eax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, edi
jmp 0x18001f99c
mov rcx, qword [rdi + 0x4078]
lea rdx, [rdi + 0x409c]
lea r8, [rsp + 0x20]
call qword [sym.imp.WS2_32.dll_getsockname]
mov rcx, rbx
mov dword [rdi + 0x408c], ebp
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
xor eax, eax
mov rbx, qword [rsp + 0x40]
mov rbp, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x50]
add rsp, 0x30
pop rdi
ret
Function at 0x180021b20
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rbp
push rdi
sub rsp, 0x20
movzx eax, word [rcx + 0x4094]
mov rbx, rcx
xor edi, edi
mov word [rcx + 0x1427c], ax
mov word [rcx + 0x14288], ax
mov eax, 0x7530
mov qword [rcx + 0x14270], rdi
mov dword [rcx + 0x14278], edi
mov dword [rcx + 0x1427e], edi
mov word [rcx + 0x14282], di
mov dword [rcx + 0x14284], edi
or ecx, 0xffffffff
mov dword [rbx + 0x14294], eax
mov dword [rbx + 0x14290], eax
mov dword [rbx + 0x14298], eax
mov dword [rbx + 0x1428c], ecx
mov dword [rbx + 0x182e0], ecx
mov dword [rbx + 0x182e4], ecx
mov eax, edi
lea rcx, [rbx + 0x142d8]
mov qword [rbx + 0x1429c], 1
mov qword [rbx + 0x142a4], 1
mov qword [rbx + 0x142ac], rdi
mov qword [rbx + 0x142b4], rdi
mov qword [rbx + 0x142bc], rdi
mov qword [rbx + 0x142c4], rdi
mov qword [rbx + 0x142cc], rdi
mov dword [rbx + 0x142d4], edi
mov byte [rbx + rax + 0x182e8], dil
inc rax
mov dword [rcx], edi
add rcx, 4
cmp rax, 0x1002
jl 0x180021bdd
cmp qword [0x18002a9d0], rdi
movabs rbp, 0x20c49ba5e353f7cf
jne 0x180021c35
lea rcx, [0x18002a9d0]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
mov rax, rbp
imul qword [0x18002a9d0]
sar rdx, 7
mov rax, rdx
shr rax, 0x3f
add rdx, rax
mov qword [0x18002a9d0], rdx
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov rax, qword [rsp + 0x30]
xor edx, edx
div qword [0x18002a9d0]
mov dword [rbx + 0x192ec], eax
cmp qword [0x18002a9d0], rdi
jne 0x180021c89
lea rcx, [0x18002a9d0]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
mov rax, rbp
imul qword [0x18002a9d0]
sar rdx, 7
mov rax, rdx
shr rax, 0x3f
add rdx, rax
mov qword [0x18002a9d0], rdx
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov rax, qword [rsp + 0x30]
xor edx, edx
div qword [0x18002a9d0]
mov dword [rbx + 0x192ec], eax
cmp qword [0x18002a9d0], rdi
jne 0x180021cdd
lea rcx, [0x18002a9d0]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
mov rax, rbp
imul qword [0x18002a9d0]
sar rdx, 7
mov rax, rdx
shr rax, 0x3f
add rdx, rax
mov qword [0x18002a9d0], rdx
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov rax, qword [rsp + 0x30]
mov rbp, qword [rsp + 0x40]
xor edx, edx
div qword [0x18002a9d0]
mov dword [rbx + 0x192ec], eax
mov rbx, qword [rsp + 0x38]
xor eax, eax
add rsp, 0x20
pop rdi
ret
Function at 0x180021d78
Capabilities:
Create udp socket
Get local ipv4 addresses
Get socket information
Set socket configuration

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r12
push rbp
push r13
push r14
mov rbp, rsp
sub rsp, 0x70
mov rdi, rcx
xor ecx, ecx
mov r13d, r9d
mov r12, r8
mov rsi, rdx
call fcn.18001cbbc
mov r8, rdi
mov rdx, rsi
mov rcx, rax
call fcn.18001d4f4
xor ebx, ebx
test eax, eax
jne 0x180021f4c
mov rax, qword [rbp + 0x40]
test rax, rax
je 0x180021de5
mov qword [rdi + 0x4080], rax
mov rax, qword [rax + 0x40e0]
mov qword [rdi + 0x40e0], rax
jmp 0x180021f4a
xor r9d, r9d
mov ecx, r13d
mov dword [rsp + 0x28], 1
lea edx, [r9 + 2]
lea r8d, [r9 + 0x11]
mov dword [rsp + 0x20], ebx
call qword [sym.imp.WS2_32.dll_WSASocketA]
mov qword [rdi + 0x4078], rax
cmp rax, 0xffffffffffffffff
jne 0x180021e1d
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
jmp 0x180021f4c
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x38], rbx
lea rcx, [rbp - 0x18]
mov qword [rsp + 0x30], rcx
lea rcx, [rbp - 0x14]
mov r14d, 4
lea r8, [rbp - 0x1c]
mov dword [rsp + 0x28], r14d
mov qword [rsp + 0x20], rcx
mov rcx, rax
mov r9d, r14d
mov edx, 0x9800000c
mov dword [rbp - 0x1c], ebx
mov dword [rbp - 0x14], ebx
mov dword [rbp - 0x18], ebx
mov dword [rbp - 0x20], 0x400000
call qword [sym.imp.WS2_32.dll_WSAIoctl]
mov rcx, qword [rdi + 0x4078]
mov r13d, 0xffff
lea r9, [rbp - 0x20]
mov r8d, 0x1001
mov edx, r13d
mov dword [rsp + 0x20], r14d
call qword [sym.imp.WS2_32.dll_setsockopt]
mov rcx, qword [rdi + 0x4078]
lea r9, [rbp - 0x20]
mov r8d, 0x1002
mov edx, r13d
mov dword [rsp + 0x20], r14d
call qword [sym.imp.WS2_32.dll_setsockopt]
mov rcx, qword [rdi + 0x4078]
lea r9, [rbp - 0x1c]
lea r8d, [r14 + 0xa]
xor edx, edx
mov dword [rsp + 0x20], r14d
call qword [sym.imp.WS2_32.dll_setsockopt]
mov rcx, qword [rdi + 0x4078]
xor r9d, r9d
mov r8, rdi
mov rdx, r12
call qword [sym.imp.KERNEL32.dll_CreateIoCompletionPort]
test rax, rax
jne 0x180021f16
call qword [sym.imp.KERNEL32.dll_GetLastError]
xor ecx, ecx
mov ebx, eax
call fcn.18001cbbc
mov edx, dword [rsi]
mov rcx, rax
call fcn.18001d8d4
mov rcx, qword [rdi + 0x4078]
call qword [sym.imp.WS2_32.dll_closesocket]
or qword [rdi + 0x4078], 0xffffffffffffffff
mov eax, ebx
jmp 0x180021f4c
mov rcx, qword [rdi + 0x4078]
lea rdx, [rdi + 0x409c]
lea r8, [rbp - 0x10]
mov dword [rbp - SQLNumResultCols], 0x10
call qword [sym.imp.WS2_32.dll_getsockname]
mov qword [rdi + 0x40e0], r12
cmp eax, 0xffffffff
setne bl
inc ebx
mov dword [rdi + 0x408c], ebx
xor eax, eax
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov r12, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop r13
pop rbp
ret