joyce8/EMBER2024-capa huggingface dataset:
Function at 0x46d840
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x404203
push rbp
mov rbp, rsp
sub rsp, 0x18
mov rdx, qword [rax]
mov rcx, qword [rax + 8]
mov rax, rdx
call fcn.0040a160
add rsp, 0x18
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.0046ba40
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp 0x4041e0
cmp byte [0x0063202a], 0
je 0x46d855
mov rcx, qword [rax + 8]
mov rax, qword [rax]
jmp 0x46aa80
jmp 0x4041e0

Function at 0x46d860
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
mov rcx, qword [0x006323c8]
mov eax, dword [rax]
xor rcx, rax
xor rax, rbx
xor rax, qword [0x006323c0]
mul rcx
xor rax, rdx
mov rcx, rax
movabs rax, 0x1d8e4e27c47d124b
mul rcx
xor rax, rdx
nop
nop
ret
cmp byte [0x0063202a], 0
je 0x46d895
movq xmm0, rbx
pinsrd xmm0, dword [rax], 2
aesenc xmm0, xmmword [0x00632700]
aesenc xmm0, xmmword [0x00632710]
aesenc xmm0, xmmword [0x00632720]
movq rax, xmm0
ret
jmp 0x40a340

Function at 0x46d8a0
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
mov rcx, qword [0x006323c8]
mov rax, qword [rax]
xor rcx, rax
xor rax, rbx
xor rax, qword [0x006323c0]
mul rcx
xor rax, rdx
mov rcx, rax
movabs rax, 0x1d8e4e27c47d1247
mul rcx
xor rax, rdx
nop
nop
ret
cmp byte [0x0063202a], 0
je 0x46d8d6
movq xmm0, rbx
pinsrq xmm0, qword [rax], 1
aesenc xmm0, xmmword [0x00632700]
aesenc xmm0, xmmword [0x00632710]
aesenc xmm0, xmmword [0x00632720]
movq rax, xmm0
ret
jmp 0x40a380

Function at 0x46f660
Capabilities:
Allocate thread local storage

Disassembly:
push rbp
mov rbp, rsp
mov rax, rsp
and rsp, 0xfffffffffffffff0
sub rsp, 0x30
mov qword [rsp + 0x20], rax
mov rax, qword [sym.imp.kernel32.dll_TlsAlloc]
call rax
mov rsp, qword [rsp + 0x20]
mov rcx, rax
cmp rcx, 0x40
jb 0x46f694
mov rcx, 0x28
jmp 0x46f69f
shl rcx, 3
add rcx, 0x1480
mov qword [0x006322b0], rcx
pop rbp
ret
Function at 0x487ba0
Capabilities:
Hash data using fnv

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4882df
push rbp
mov rbp, rsp
sub rsp, 0x10
mov qword [rsp + 0x20], rax
movabs rcx, 0xcbf29ce484222325
jmp 0x487bcd
lea rax, [rdx + 0x10]
dec rbx
mov rcx, rsi
test rbx, rbx
jle 0x487e51
mov rdx, rax
mov rsi, qword [rax]
nop dword [rax]
test rsi, rsi
je 0x487e7d
mov edi, dword [rsi + 0x10]
shr edi, 1
mov r8, qword [rax + 8]
and edi, 0x3f
lea rax, [0x005360e0]
jmp qword [rax + rdi*8]
mov rax, rcx
add rsp, 0x10
pop rbp
ret
lea rax, [0x004dede0]
lea rbx, [0x00533970]
call fcn.004660e0
inc rax
cmp rax, r8
jge 0x487ea2
mov r9, qword [rsi + rax*8]
xor r10d, r10d
nop
jmp 0x487ed7
lea rdi, [0x004dee60]
mov rsi, rcx
movabs rcx, 0x100000001b3
jmp 0x487bc3
movzx r11d, r9b
xor rcx, r11
inc r10
shr r9, 8
movabs r11, 0x100000001b3
imul rcx, r11
cmp r10, 8
jl 0x487ebb
jmp 0x487e90
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
call fcn.0046ba40
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
jmp fcn.00487ba0

Function at 0x488480
Capabilities:
Hash data using fnv

Disassembly:
test byte [rax], al
mov rcx, rbx
and ebx, 0x7f
shl rbx, 5
lea rdx, [rax + rbx]
xor eax, eax
jmp 0x488497
inc rax
cmp rax, 4
jge 0x4884af
lea rbx, [rdx + rax*8]
mov rbx, qword [rbx]
cmp rbx, rcx
jne 0x488494
mov eax, 1
ret
xor eax, eax
movabs rbx, 0xcbf29ce484222325
jmp 0x4884c0
inc rax
cmp rax, 4
jge 0x4884ce
mov rsi, qword [rdx + rax*8]
xor edi, edi
jmp 0x4884f7
and ebx, 3
lea rdx, [rdx + rbx*8]
xchg qword [rdx], rcx
xor eax, eax
ret
movzx r8d, sil
xor rbx, r8
inc rdi
shr rsi, 8
movabs r8, 0x100000001b3
imul rbx, r8
cmp rdi, 8
jl 0x4884db
jmp 0x4884bd

Function at 0x48c2c0
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x48c38a
push rbp
mov rbp, rsp
sub rsp, 0x48
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rbx
mov qword [rsp], rax
mov qword [rsp + 8], rbx
mov byte [rsp + 0x10], 0
call fcn.004036e0
xorps xmm15, xmm15
mov r14, qword [0x006322b0]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x18], 0xffffffffffffffff
jne 0x48c36f
mov rcx, qword [rsp + 0x60]
lea rdx, [rcx + 1]
mov qword [rsp + 0x40], rdx
lea rax, [0x004deee0]
xor ebx, ebx
mov rcx, rdx
call fcn.00467480
mov rbx, qword [rsp + 0x60]
mov rcx, rax
xor edi, edi
mov rsi, qword [rsp + 0x40]
mov rax, qword [rsp + 0x58]
nop dword [rax]
call fcn.0048ce40
inc rbx
cmp rcx, rbx
jae 0x48c35e
mov edi, 1
lea rsi, [0x004deee0]
call fcn.00467560
mov word [rax + rbx*2 - 2], 0
xor edi, edi
xor esi, esi
add rsp, 0x48
pop rbp
ret
xor eax, eax
xor ebx, ebx
mov rcx, rbx
lea rdi, [0x00533bf8]
lea rsi, [0x00533020]
add rsp, 0x48
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
call fcn.0046ba40
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
jmp fcn.0048c2c0
Function at 0x49a540
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x49a5ec
push rbp
mov rbp, rsp
sub rsp, 0x40
mov byte [rsp + 0x60], cl
mov byte [rsp + 0x61], dil
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], rbx
mov qword [rsp], rax
mov qword [rsp + 8], rbx
mov byte [rsp + 0x10], cl
call fcn.004036e0
xorps xmm15, xmm15
mov r14, qword [0x006322b0]
mov r14, qword gs:[r14]
mov r14, qword [r14]
cmp qword [rsp + 0x18], 0xffffffffffffffff
je 0x49a5b3
lea rax, [rsp + 0x20]
mov rbx, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x58]
call fcn.0044e060
movzx edx, byte [rsp + 0x61]
movzx esi, byte [rsp + 0x60]
xor ecx, ecx
jmp 0x49a5c6
mov rax, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x58]
add rsp, 0x40
pop rbp
ret
inc rcx
cmp rbx, rcx
jle 0x49a5d9
movzx edi, byte [rax + rcx]
cmp dil, sil
jne 0x49a5c3
mov byte [rax + rcx], dl
jmp 0x49a5c3
mov rcx, rbx
mov rbx, rax
xor eax, eax
call fcn.00467d20
add rsp, 0x40
pop rbp
ret
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov byte [rsp + 0x18], cl
mov byte [rsp + 0x19], dil
nop
call fcn.0046ba40
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
movzx ecx, byte [rsp + 0x18]
movzx edi, byte [rsp + 0x19]
jmp fcn.0049a540
Function at 0x4addc0
Capabilities:
Access peb ldr_data

Disassembly:
cmp rsp, qword [r14 + 0x10]
jbe 0x4adfcb
push rbp
mov rbp, rsp
sub rsp, 0x48
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x68], rcx
add qword [rax + 0x58], rcx
mov rdx, qword [rax + 0x50]
test rdx, rdx
jle 0x4adee4
cmp rdx, 0x40
ja 0x4adfbd
mov qword [rsp + 0x70], rdi
mov qword [rsp + 0x60], rbx
lea rsi, [rdx - 0x40]
mov r8, rsi
neg rsi
sar r8, 0x3f
and r8, rdx
lea rdx, [rax + r8]
lea rdx, [rdx + 0x10]
cmp rcx, rsi
cmovl rsi, rcx
mov qword [rsp + 0x28], rsi
cmp rbx, rdx
je 0x4ade54
mov rax, rdx
mov rcx, rsi
call fcn.0046e6a0
mov rax, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x68]
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x28]
mov rdi, qword [rsp + 0x70]
mov rdx, qword [rax + 0x50]
add rdx, rsi
mov qword [rax + 0x50], rdx
nop
cmp rdx, 0x40
jne 0x4adec0
mov qword [rsp], rax
lea rcx, [rax + 0x10]
mov qword [rsp + 8], rcx
mov qword [rsp + 0x10], 0x40
mov qword [rsp + 0x18], 0x40
call fcn.004ae200
xorps xmm15, xmm15
mov r14, qword [0x006322b0]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x58]
mov qword [rax + 0x50], 0
mov rcx, qword [rsp + 0x68]
mov rbx, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x28]
mov rdi, qword [rsp + 0x70]
nop dword [rax]
cmp rcx, rsi
jb 0x4adfb5
sub rdi, rsi
mov rdx, rdi
neg rdx
sar rdx, 0x3f
and rdx, rsi
mov r8, rcx
sub r8, rsi
add rbx, rdx
jmp 0x4adee7
mov r8, rcx
cmp r8, 0x40
jl 0x4adf65
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x38], r8
mov qword [rsp + 0x30], rdi
mov qword [rsp], rax
mov qword [rsp + 8], rbx
and r8, 0xffffffffffffffc0
mov qword [rsp + 0x20], r8
mov qword [rsp + 0x10], r8
mov qword [rsp + 0x18], rdi
call fcn.004ae200
xorps xmm15, xmm15
mov r14, qword [0x006322b0]
mov r14, qword gs:[r14]
mov r14, qword [r14]
mov rax, qword [rsp + 0x20]
mov rcx, qword [rsp + 0x30]
mov rdx, rax
sub rax, rcx
sar rax, 0x3f
mov r8, qword [rsp + 0x38]
and rax, r8
and rax, 0xffffffffffffffc0
mov rcx, qword [rsp + 0x40]
lea rbx, [rcx + rax]
sub r8, rdx
mov rax, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x68]
test r8, r8
je 0x4adfa8
lea rdx, [rax + 0x10]
cmp r8, 0x40
mov esi, 0x40
cmovl rsi, r8
nop dword [rax + rax]
cmp rbx, rdx
je 0x4adfa4
mov qword [rsp + 0x38], rsi
mov rax, rdx
mov rcx, rsi
call fcn.0046e6a0
mov rax, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x38]
mov qword [rax + 0x50], rsi
mov rax, rcx
xor ebx, ebx
xor ecx, ecx
add rsp, 0x48
pop rbp
ret
mov rax, rsi
call fcn.0046dde0
mov rax, rdx
mov ecx, 0x40
call fcn.0046dde0
nop
mov qword [rsp + 8], rax
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rcx
mov qword [rsp + 0x20], rdi
nop
call fcn.0046ba40
mov rax, qword [rsp + 8]
mov rbx, qword [rsp + 0x10]
mov rcx, qword [rsp + 0x18]
mov rdi, qword [rsp + 0x20]
jmp fcn.004addc0
Function at 0x180040110
Capabilities:
Validate payment card number using luhn algorithm

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x20
mov esi, edx
mov dword [rcx + 0x74], 0
mov rbx, rcx
mov edi, 0x7fffffff
movsx ecx, byte [rbx + 0x78]
lea eax, [rcx - 0x30]
cmp al, 9
ja 0x1800401d5
lea r8d, [rcx - 0x30]
cmp r8d, 0xffffffff
je 0x1800401d5
mov r9d, dword [rbx + 0x74]
mov ecx, 0x7fffffff
sub ecx, r8d
mov eax, 0x66666667
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
cmp r9d, edx
jg 0x1800401ee
lea eax, [r9 + r9*4]
dec edi
lea ecx, [r8 + rax*2]
mov rax, qword [rbx + 0x10]
mov dword [rbx + 0x74], ecx
mov rcx, qword [rbx]
cmp rcx, rax
je 0x1800401c5
cmp byte [rcx], 0x5c
jne 0x1800401be
lea rdx, [rcx + 1]
cmp rdx, rax
je 0x1800401be
mov r8d, dword [rbx + 0x80]
test r8b, 8
jne 0x1800401ac
movzx eax, byte [rdx]
sub al, 0x28
cmp al, 1
jbe 0x1800401bb
test r8b, 0x10
jne 0x1800401be
movzx eax, byte [rdx]
sub al, 0x7b
test al, 0xfd
jne 0x1800401be
mov rcx, rdx
lea rax, [rcx + 1]
mov qword [rbx], rax
mov rcx, rbx
call fcn.180043680
test edi, edi
jne 0x180040130
mov rbx, qword [rsp + 0x30]
cmp edi, 0x7fffffff
mov rsi, qword [rsp + 0x38]
setne al
add rsp, 0x20
pop rdi
ret
mov edx, esi
mov rcx, rbx
call fcn.180041930
int3
Function at 0x180043cb0
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
movabs rax, 0xcbf29ce484222325
mov r9d, 0
sub r8, rdx
je 0x180043ce4
movabs r10, 0x100000001b3
nop
movzx ecx, byte [rdx + r9]
inc r9
xor rax, rcx
imul rax, r10
cmp r9, r8
jb 0x180043cd0
ret

Function at 0x18004d7f0
Capabilities:
Read file on windows

Disassembly:
push rbx
push r14
push r15
sub rsp, 0x20
mov r15, r8
mov r14, rdx
mov rbx, rcx
test r8, r8
jg 0x18004d814
xor eax, eax
add rsp, 0x20
pop r15
pop r14
pop rbx
ret
cmp qword [rcx + 0x68], 0
mov qword [rsp + 0x48], rsi
mov qword [rsp + 0x50], rdi
je 0x18004d8a2
mov rdi, r15
mov qword [rsp + 0x40], rbp
lea rsi, [rcx + 0x50]
mov rax, qword [rbx + 0x38]
mov rdx, qword [rax]
test rdx, rdx
je 0x18004d870
mov rax, qword [rsi]
movsxd rcx, dword [rax]
test ecx, ecx
jle 0x18004d870
cmp rdi, rcx
mov rbp, rdi
cmovge rbp, rcx
mov rcx, r14
mov r8, rbp
call fcn.1801f2e10
mov rax, qword [rsi]
sub rdi, rbp
sub dword [rax], ebp
mov rcx, qword [rbx + 0x38]
movsxd rax, ebp
add qword [rcx], rax
jmp 0x18004d88d
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0x38]
cmp eax, 0xffffffff
je 0x18004d895
mov byte [r14], al
lea rsi, [rbx + 0x50]
dec rdi
mov ebp, 1
add r14, rbp
test rdi, rdi
jg 0x18004d831
mov rbp, qword [rsp + 0x40]
sub r15, rdi
jmp 0x18004d980
mov rax, qword [rcx + 0x38]
mov rsi, r15
mov rdx, qword [rax]
test rdx, rdx
je 0x18004d8b9
mov rax, qword [rcx + 0x50]
mov ecx, dword [rax]
jmp 0x18004d8bb
xor ecx, ecx
movsxd rax, ecx
test ecx, ecx
je 0x18004d8ed
cmp rax, r15
mov rdi, r15
mov rcx, r14
cmovb rdi, rax
mov r8, rdi
call fcn.1801f2e10
mov rax, qword [rbx + 0x50]
add r14, rdi
sub rsi, rdi
sub dword [rax], edi
mov rcx, qword [rbx + 0x38]
movsxd rax, edi
add qword [rcx], rax
cmp qword [rbx + 0x80], 0
je 0x18004d97d
mov r8, qword [rbx + 0x18]
lea rax, [rbx + 0x70]
cmp qword [r8], rax
jne 0x18004d928
mov rcx, qword [rbx + 0x88]
mov rdx, qword [rbx + 0x90]
mov qword [r8], rcx
sub edx, ecx
mov rax, qword [rbx + 0x38]
mov qword [rax], rcx
mov rax, qword [rbx + 0x50]
mov dword [rax], edx
cmp rsi, 0xfff
jbe 0x18004d95e
mov r9, qword [rbx + 0x80]
mov edx, 1
mov r8d, 0xfff
mov rcx, r14
call fcn.1801acd6c
add r14, rax
sub rsi, rax
cmp rax, 0xfff
jne 0x18004d97d
cmp rsi, rax
ja 0x18004d931
test rsi, rsi
je 0x18004d97d
mov r9, qword [rbx + 0x80]
mov r8, rsi
mov edx, 1
mov rcx, r14
call fcn.1801acd6c
sub rsi, rax
sub r15, rsi
mov rsi, qword [rsp + 0x48]
mov rax, r15
mov rdi, qword [rsp + 0x50]
add rsp, 0x20
pop r15
pop r14
pop rbx
ret
Function at 0x180061430
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
push rbp
mov rbp, rsp
sub rsp, 0x50
mov rbx, rdx
lea rax, [rbp + 0x30]
mov rcx, rbx
mov qword [rbp - 0x30], rax
mov rdx, r9
call qword [sym.imp.KERNEL32.dll_FindResourceW]
mov rdi, rax
test rax, rax
jne 0x1800614cc
xorps xmm0, xmm0
mov qword [rbp - 0x10], rax
mov ecx, 0x20
mov qword [rbp - 8], rax
movups xmmword [rbp - 0x20], xmm0
call fcn.18013239c
movups xmm0, xmmword [str.FindResource_returned_null.]
mov qword [rbp - 0x20], rax
lea r8, [rbp - 0x20]
mov qword [rbp - 0x10], 0x1b
mov rdx, rax
mov qword [rbp - 8], 0x1f
movups xmmword [rax], xmm0
movsd xmm0, qword [0x18020db40]
movsd qword [rax + 0x10], xmm0
movzx ecx, word [0x18020db48]
mov word [rax + 0x18], cx
movzx eax, byte [0x18020db4a]
mov byte [rdx + 0x1a], al
mov byte [rdx + 0x1b], dil
xor edx, edx
jmp 0x18006162b
mov rdx, rdi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_SizeofResource]
test eax, eax
jne 0x18006153c
xor eax, eax
xorps xmm0, xmm0
mov ecx, 0x20
mov qword [rbp - 0x10], rax
movups xmmword [rbp - 0x20], xmm0
mov qword [rbp - 8], rax
call fcn.18013239c
movups xmm0, xmmword [str.SizeofResource_returned_0.]
mov qword [rbp - 0x20], rax
lea r8, [rbp - 0x20]
mov qword [rbp - 0x10], 0x1a
xor edx, edx
mov qword [rbp - 8], 0x1f
movups xmmword [rax], xmm0
movsd xmm0, qword [0x18020db60]
movsd qword [rax + 0x10], xmm0
movzx ecx, word [0x18020db68]
mov word [rax + 0x18], cx
mov byte [rax + 0x1a], 0
jmp 0x18006162b
mov rdx, rdi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadResource]
test rax, rax
jne 0x1800615b5
xorps xmm0, xmm0
mov qword [rbp - 0x10], rax
mov ecx, 0x20
mov qword [rbp - 8], rax
movups xmmword [rbp - 0x20], xmm0
call fcn.18013239c
movups xmm0, xmmword [str.LockResource_returned_null.]
mov qword [rbp - 0x20], rax
lea r8, [rbp - 0x20]
mov qword [rbp - 0x10], 0x1b
mov rdx, rax
mov qword [rbp - 8], 0x1f
movups xmmword [rax], xmm0
movsd xmm0, qword [0x18020db80]
movsd qword [rax + 0x10], xmm0
movzx ecx, word [0x18020db88]
mov word [rax + 0x18], cx
movzx eax, byte [0x18020db8a]
mov byte [rdx + 0x1a], al
mov byte [rdx + 0x1b], 0
xor edx, edx
jmp 0x18006162b
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LockResource]
test rax, rax
jne 0x18006161a
xorps xmm0, xmm0
mov qword [rbp - 0x10], rax
mov ecx, 0x20
mov qword [rbp - 8], rax
movups xmmword [rbp - 0x20], xmm0
call fcn.18013239c
movups xmm0, xmmword [str.Resource_data_is_null.]
mov qword [rbp - 0x20], rax
lea r8, [rbp - 0x20]
mov qword [rbp - 0x10], socket
xor edx, edx
mov qword [rbp - 8], 0x1f
movups xmmword [rax], xmm0
mov ecx, dword [0x18020dba0]
mov dword [rax + 0x10], ecx
movzx ecx, word [0x18020dba4]
mov word [rax + 0x14], cx
mov byte [rax + 0x16], 0
jmp 0x18006162b
mov rdx, rax
lea rcx, [rbp - 0x20]
call fcn.18001c350
mov r8, rax
mov dl, 1
lea rcx, [rbp - 0x30]
call fcn.1800611b0
mov rbx, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x50
pop rbp
ret
Function at 0x180061cc0
Capabilities:
Get file version info

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rbp
push rdi
push r14
lea rbp, [rsp - 0x47]
sub rsp, 0xc0
mov rax, qword [0x1802da580]
xor rax, rsp
mov qword [rbp + 0x37], rax
mov rsi, rcx
mov qword [rbp - 0x39], rcx
xor ebx, ebx
mov dword [rbp - 0x55], ebx
lea rcx, [rbp - 0x29]
call fcn.180061f80
nop
mov rdx, rax
lea rcx, [rbp - 9]
call fcn.1800604e0
nop
mov rdx, qword [rbp - 0x11]
cmp rdx, 0xf
jbe 0x180061d46
inc rdx
mov rcx, qword [rbp - 0x29]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180061d41
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180061e3b
call fcn.1801323d8
movdqa xmm0, xmmword [0x18020aec0]
movdqu xmmword [rbp - 0x19], xmm0
mov byte [rbp - 0x29], 0
mov dword [rbp - 0x59], ebx
lea rcx, [rbp - 9]
cmp qword [rbp + 0xf], 7
cmova rcx, qword [rbp - 9]
lea rdx, [rbp - 0x59]
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov r14d, eax
test eax, eax
je 0x180061e41
mov qword [rsi], rbx
mov qword [rsi + 8], rbx
mov qword [rsi + 0x10], rbx
mov edx, r14d
mov rcx, rsi
call fcn.180061650
mov rcx, qword [rsi]
lea rbx, [rcx + r14]
mov r8d, r14d
xor edx, edx
call fcn.1801f34b0
mov qword [rsi + 8], rbx
mov dword [rbp - 0x55], 1
lea rcx, [rbp - 9]
cmp qword [rbp + 0xf], 7
cmova rcx, qword [rbp - 9]
mov r9, qword [rsi]
mov r8d, r14d
mov edx, dword [rbp - 0x59]
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
je 0x180061e7f
mov rdx, qword [rbp + 0xf]
cmp rdx, 7
jbe 0x180061e0e
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 9]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180061e09
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180061e35
call fcn.1801323d8
mov rax, rsi
mov rcx, qword [rbp + 0x37]
xor rcx, rsp
call fcn.180132a90
lea r11, [rsp + 0xc0]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret
call fcn.18017ec78
nop
call fcn.18017ec78
int3
lea rcx, [rbp + 0x17]
call fcn.180061ec0
nop
lea rcx, str.Failed_to_GetFileVersionInfoSize._Error:_
mov qword [rbp - 0x29], rcx
mov qword [rbp - 0x21], 0x2b
mov r8, rax
lea rdx, [rbp - 0x29]
lea rcx, [rbp - 0x51]
call fcn.18005ec10
lea rdx, [0x1802d7910]
lea rcx, [rbp - 0x51]
call fcn.18016f784
nop
lea rcx, [rbp + 0x17]
call fcn.180061ec0
nop
lea rcx, str.Failed_to_GetFileVersionInfo._Error:_
mov qword [rbp - 0x29], rcx
mov qword [rbp - 0x21], 0x27
mov r8, rax
lea rdx, [rbp - 0x29]
lea rcx, [rbp - 0x51]
call fcn.18005ec10
lea rdx, [0x1802d7910]
lea rcx, [rbp - 0x51]
call fcn.18016f784
int3
Function at 0x18007dba0
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x18], rbx
mov qword [rsp + 0x20], rsi
push rdi
sub rsp, 0x30
mov rdi, rcx
mov rax, qword [rcx + 0x28]
nop
cmp rax, qword [rcx + 0x10]
jb 0x18007dbcf
xor al, al
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret
mov ecx, reloc.WS2_32.dll_recv
call fcn.18013239c
mov rbx, rax
mov qword [rsp + 0x40], rax
test rax, rax
je 0x18007dc2b
mov ecx, 8
call fcn.18013239c
test rax, rax
je 0x18007dbf8
mov qword [rax], rdi
mov qword [rsp + 0x48], rax
lea rsi, [rbx + 8]
mov qword [rsp + 0x28], rsi
mov dword [rsp + 0x20], 0
mov r9, rax
lea r8, [0x18007cd90]
xor edx, edx
xor ecx, ecx
call fcn.1801b0674
mov qword [rbx], rax
test rax, rax
je 0x18007dc4a
jmp 0x18007dc2d
xor ebx, ebx
mov rdx, rbx
mov rcx, rdi
call fcn.18007d9c0
mov al, 1
mov rbx, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x58]
add rsp, 0x30
pop rdi
ret
mov dword [rsi], 0
mov ecx, 6
call fcn.18014079c
int3

Function at 0x18007de40
Capabilities:
Create thread

Disassembly:
mov qword [rsp + 0x10], rbx
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x30
mov rdi, rcx
xor r15d, r15d
mov eax, dword [rcx + 0x20]
nop
test eax, eax
je 0x18007de74
mov eax, 0xffffffff
mov rbx, qword [rsp + 0x68]
add rsp, 0x30
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
mov eax, 1
xchg dword [rcx + 0x20], eax
cmp rdx, qword [rcx + 8]
cmovb rdx, qword [rcx + 8]
mov rbp, qword [rcx + 0x10]
cmp rdx, rbp
cmovbe rbp, rdx
mov rsi, r15
test rbp, rbp
je 0x18007df1f
nop dword [rax]
mov rax, qword [rdi + 0x28]
nop
cmp rax, qword [rdi + 0x10]
jae 0x18007df17
mov ecx, reloc.WS2_32.dll_recv
call fcn.18013239c
mov rbx, rax
mov qword [rsp + 0x60], rax
test rax, rax
je 0x18007df09
mov ecx, 8
call fcn.18013239c
test rax, rax
je 0x18007ded6
mov qword [rax], rdi
jmp 0x18007ded9
mov rax, r15
mov qword [rsp + 0x70], rax
lea r14, [rbx + 8]
mov qword [rsp + 0x28], r14
mov dword [rsp + 0x20], r15d
mov r9, rax
lea r8, [0x18007cd90]
xor edx, edx
xor ecx, ecx
call fcn.1801b0674
mov qword [rbx], rax
test rax, rax
je 0x18007df32
jmp 0x18007df0c
mov rbx, r15
mov rdx, rbx
mov rcx, rdi
call fcn.18007d9c0
inc rsi
cmp rsi, rbp
jb 0x18007dea0
xor eax, eax
mov rbx, qword [rsp + 0x68]
add rsp, 0x30
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
mov dword [r14], r15d
mov ecx, 6
call fcn.18014079c
int3
Function at 0x180099080
Capabilities:
Receive data
Receive data on socket

Disassembly:
push rbx
sub rsp, 0x20
mov rbx, r9
xor r9d, r9d
call qword [sym.imp.WS2_32.dll_recv]
movsxd rcx, eax
cmp rcx, 0xffffffffffffffff
jne 0x1800990c2
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov ecx, 0x38
mov qword [rbx], 0
cmp eax, 0x2733
mov edx, 0x51
cmove ecx, edx
mov eax, ecx
add rsp, 0x20
pop rbx
ret
mov qword [rbx], rcx
xor eax, eax
add rsp, 0x20
pop rbx
ret

Function at 0x180099260
Capabilities:
Receive data
Receive data on socket
Send data
Send data on socket

Disassembly:
push rbx
push rbp
push rsi
push rdi
push r12
push r14
push r15
sub rsp, 0x130
mov rax, qword [0x1802da580]
xor rax, rsp
mov qword [rsp + 0x120], rax
mov rsi, qword [rsp + 0x190]
mov rbp, rcx
mov rcx, qword [rcx + 0x18]
mov r15, r8
movsxd r8, edx
mov r12, r9
mov rax, r8
shl rax, 5
lea rbx, [rcx + 0x230]
mov r14, qword [rcx + r8*8 + 0x1e8]
add rbx, rax
mov rax, qword [rcx + 0x410]
mov rdi, qword [rbx + 8]
sub rdi, qword [rbx + 0x10]
test byte [rax + 0x84], 3
je 0x18009936c
lea rax, [0x180099110]
cmp qword [rcx + r8*8 + 0x210], rax
jne 0x18009936c
cmp qword [rbx], 0
je 0x1800992f1
test rdi, rdi
je 0x18009936c
mov rdx, 0xffffffffffffffff
xor r9d, r9d
mov r8, rdx
mov rcx, r14
call fcn.1800af4f0
cmp eax, 0xffffffff
je 0x18009936c
test al, 1
je 0x18009936c
mov rcx, qword [rbx]
test rcx, rcx
jne 0x18009934b
mov eax, dword [rbp + 0x734]
add eax, eax
movsxd rcx, eax
mov qword [rbx + 8], rcx
call qword [fcn.1801ade34]
mov qword [rbx], rax
mov rcx, rax
test rax, rax
je 0x1800993a6
mov rdi, qword [rbx + 8]
mov qword [rbx + 0x10], 0
mov qword [rbx + 0x18], 0
mov rdx, qword [rbx + 0x10]
xor r9d, r9d
add rdx, rcx
mov r8d, edi
mov rcx, r14
call qword [sym.imp.WS2_32.dll_recv]
movsxd rcx, eax
test eax, eax
jle 0x18009936c
add qword [rbx + 0x10], rcx
xor r9d, r9d
mov r8d, r12d
mov rdx, r15
mov rcx, r14
call qword [sym.imp.WS2_32.dll_send]
movsxd rbx, eax
mov dword [rsi], 0
cmp rbx, 0xffffffffffffffff
jne 0x1800993e5
call qword [sym.imp.WS2_32.dll_WSAGetLastError]
mov edi, eax
cmp eax, 0x2733
jne 0x1800993b5
xor ebx, ebx
mov dword [rsi], 0x51
jmp 0x1800993e5
mov dword [rsi], 0x1b
mov rax, 0xffffffffffffffff
jmp 0x1800993e8
mov r8d, 0x100
lea rdx, [rsp + 0x20]
mov ecx, edi
call fcn.1800a3170
mov r8, rax
lea rdx, str.Send_failure:__s
mov rcx, rbp
call fcn.180098df0
mov dword [rbp + 0xde4], edi
mov dword [rsi], 0x37
mov rax, rbx
mov rcx, qword [rsp + 0x120]
xor rcx, rsp
call fcn.180132a90
add rsp, 0x130
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret